@great-arrow/cli 0.9.2 → 0.9.4

package/dist/index.js

@@ -9483,7 +9483,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.9.2";
+var CLI_VERSION = "0.9.4";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -10969,83 +10969,6 @@ function sessionExpired() {
   return authError("Session expired.", "Run 'gad login' to re-authenticate.");
 }
 
-// src/commands/auth.ts
-var EXIT_SESSION_EXPIRED = 2;
-var EXIT_NOT_OAUTH = 3;
-function authCommand() {
-  const cmd = new Command("auth").description("Authentication helpers");
-  cmd.command("token").description("Print a fresh OAuth access token, refreshing it if needed").option("--json", "Output {accessToken, accessExpiresAt, apiUrl} as JSON").action(async (options, actionCommand2) => {
-    try {
-      const t = await getFreshOAuthAccessToken();
-      writeCliLocator();
-      const jsonOutput = options.json || actionCommand2.optsWithGlobals().json;
-      process.stdout.write(
-        jsonOutput ? `${JSON.stringify(t)}
-` : `${t.accessToken}
-`
-      );
-    } catch (error62) {
-      if (error62 instanceof NotOAuthCredential) {
-        process.stderr.write(`${error62.message}
-`);
-        process.exitCode = EXIT_NOT_OAUTH;
-        return;
-      }
-      if (error62 instanceof CliError && error62.code === 1) {
-        const hint = error62.hint ? ` ${error62.hint}` : "";
-        process.stderr.write(`${error62.message}${hint}
-`);
-        process.exitCode = EXIT_SESSION_EXPIRED;
-        return;
-      }
-      throw error62;
-    }
-  });
-  return cmd;
-}
-
-// src/commands/logout.ts
-var logoutCommand = new Command("logout").description("Remove stored authentication credentials").action(async (_options, cmd) => {
-  const parent = cmd.parent;
-  const json3 = parent?.opts().json ?? false;
-  const quiet = parent?.opts().quiet ?? false;
-  const noColor = parent?.opts().noColor ?? false;
-  const fmt = createFormatter({
-    json: json3,
-    quiet,
-    isTTY: isTTY(),
-    noColor
-  });
-  const stored = await loadStoredCredential();
-  if (stored?.kind === "oauth") {
-    await revokeToken({
-      apiUrl: stored.credential.apiUrl,
-      clientId: stored.credential.clientId,
-      token: stored.credential.refreshToken,
-      tokenTypeHint: "refresh_token"
-    });
-  }
-  let clearError = null;
-  try {
-    await clearStoredCredential();
-  } catch (err2) {
-    clearError = err2;
-  }
-  const config2 = await loadConfig();
-  if (config2.token) {
-    config2.token = "";
-    await saveConfig(config2);
-  }
-  if (clearError) {
-    fmt.error(
-      clearError instanceof Error ? clearError.message : "Could not remove stored authentication credentials."
-    );
-    process.exitCode = 1 /* AUTH_ERROR */;
-    return;
-  }
-  fmt.success("Logged out successfully.");
-});
-
 // src/lib/client.ts
 import { execSync } from "node:child_process";
 
@@ -11547,6 +11470,273 @@ async function withNativeResponse(context2, path10, init, consume, parentSignal)
   );
 }
 
+// src/lib/keys-handoff.ts
+import { spawn } from "node:child_process";
+
+// src/commands/open.ts
+import { execFile as execFile2 } from "node:child_process";
+
+// src/lib/global-opts.ts
+function globalOutputOpts(cmd) {
+  const merged = cmd.optsWithGlobals();
+  return {
+    json: Boolean(merged.json),
+    quiet: Boolean(merged.quiet),
+    // --no-color sets `color: false`; some commands declare `--no-color`
+    // locally which surfaces as `noColor`.
+    noColor: merged.color === false || Boolean(merged.noColor)
+  };
+}
+
+// src/commands/open.ts
+var PLANE_NOTE = {
+  workspace: "follows your active workspace",
+  cross: "spans every workspace you belong to",
+  account: "your account, not a workspace"
+};
+function browserLaunchCommand(url2, platform2 = process.platform) {
+  let parsed;
+  try {
+    parsed = new URL(url2);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  if (platform2 === "darwin") return { file: "open", args: [url2] };
+  if (platform2 === "win32") return { file: "explorer.exe", args: [url2] };
+  return { file: "xdg-open", args: [url2] };
+}
+function openBrowser2(url2) {
+  const command = browserLaunchCommand(url2);
+  if (!command) return Promise.resolve(false);
+  return new Promise((resolve7) => {
+    execFile2(command.file, command.args, (error62) => resolve7(!error62));
+  });
+}
+function toSurfaceRow(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const r = value;
+  if (typeof r.id !== "string" || typeof r.href !== "string") return null;
+  if (!r.href.startsWith("/") || r.href.startsWith("//")) return null;
+  const plane = r.plane === "workspace" || r.plane === "cross" || r.plane === "account" ? r.plane : "workspace";
+  return {
+    id: r.id,
+    label: typeof r.label === "string" ? r.label : r.id,
+    href: r.href,
+    plane,
+    group: typeof r.group === "string" ? r.group : ""
+  };
+}
+function surfaceUrl(apiUrl, href) {
+  return `${apiUrl.replace(/\/$/, "")}${href}`;
+}
+function openCommand() {
+  return new Command("open").description("Open an app surface in the browser (e.g. gad open library)").argument(
+    "<surface>",
+    "Surface id, path, label or keyword \u2014 e.g. library, /leads, 'Pitch page'"
+  ).option("--print", "Print the URL instead of opening a browser").option("--json", "Output the resolved surface as JSON").action(async (surface, options, command) => {
+    const g = globalOutputOpts(command);
+    const auth = await resolveAuth();
+    const client2 = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
+    const result = await client2.mcpCall("surfaces_list", {
+      query: surface
+    });
+    const match = toSurfaceRow(result?.match);
+    const candidates = (Array.isArray(result?.candidates) ? result.candidates : []).map(toSurfaceRow).filter((r) => r !== null);
+    if (!match) {
+      throw new CliError(
+        candidates.length === 0 ? `No app surface matches '${surface}'.` : `'${surface}' matches ${candidates.length} surfaces.`,
+        3 /* VALIDATION_ERROR */,
+        candidates.length === 0 ? "Run 'gad open --help', or ask an AI for surfaces_list to see every page." : `Did you mean: ${candidates.map((c2) => c2.id).join(", ")}?`
+      );
+    }
+    const url2 = surfaceUrl(auth.apiUrl, match.href);
+    if (g.json) {
+      process.stdout.write(JSON.stringify({ ...match, url: url2 }) + "\n");
+      return;
+    }
+    const c = createColor(g.noColor || g.quiet);
+    if (options.print) {
+      process.stdout.write(url2 + "\n");
+      return;
+    }
+    const opened = await openBrowser2(url2);
+    process.stdout.write(
+      `${match.label} ${c.dim(`(${PLANE_NOTE[match.plane]})`)}
+${c.cyan(url2)}
+`
+    );
+    if (!opened) {
+      process.stderr.write(
+        `${c.dim("Couldn't launch a browser \u2014 open the URL above.")}
+`
+      );
+    }
+  });
+}
+
+// src/lib/keys-paths.ts
+function keyRotationPath() {
+  return "/settings/key-rotation";
+}
+function keyRotationRunPath(runId) {
+  return `/settings/key-rotation/runs/${encodeURIComponent(runId)}`;
+}
+function keyRotationHandoffPath(jti) {
+  return `/settings/key-rotation/handoff/${encodeURIComponent(jti)}`;
+}
+
+// src/lib/keys-handoff.ts
+var HANDOFF_POLL_INTERVAL_MS = 2e3;
+var HANDOFF_DEADLINE_MS = 5 * 6e4;
+var BROWSER_LAUNCH_TIMEOUT_MS = 5e3;
+function openInBrowser(url2) {
+  const command = browserLaunchCommand(url2);
+  if (!command) return Promise.resolve(false);
+  return new Promise((resolve7) => {
+    let settled = false;
+    const done = (ok2) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve7(ok2);
+    };
+    const timer = setTimeout(() => done(false), BROWSER_LAUNCH_TIMEOUT_MS);
+    timer.unref?.();
+    try {
+      const child = spawn(command.file, command.args, {
+        detached: true,
+        stdio: "ignore"
+      });
+      child.once("error", () => done(false));
+      child.once("spawn", () => {
+        child.unref();
+        done(true);
+      });
+    } catch {
+      done(false);
+    }
+  });
+}
+var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+function stepUpError(message, hint) {
+  return new CliError(message, 1 /* AUTH_ERROR */, hint);
+}
+async function requestBrowserStepUp(client2, kind, subjectId, opts = {}) {
+  const openUrl = opts.openUrl ?? openInBrowser;
+  const notify = opts.notify ?? ((line) => process.stderr.write(`${line}
+`));
+  const sleep3 = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const interval = opts.pollIntervalMs ?? HANDOFF_POLL_INTERVAL_MS;
+  const deadline = now() + (opts.deadlineMs ?? HANDOFF_DEADLINE_MS);
+  const created = await client2.post("/api/key-rotation/handoffs", {
+    kind,
+    subjectId
+  });
+  const jti = typeof created?.jti === "string" ? created.jti : null;
+  if (!jti || !/^[A-Za-z0-9-]{1,64}$/.test(jti)) {
+    throw stepUpError("The server did not return a browser approval.");
+  }
+  const url2 = `${client2.apiOrigin}${keyRotationHandoffPath(jti)}`;
+  notify(`Approve this in your browser (passkey or two-step code): ${url2}`);
+  if (!await openUrl(url2)) {
+    notify("Couldn't launch a browser. Open the URL above to approve.");
+  }
+  while (now() < deadline) {
+    const polled = await client2.get(
+      `/api/key-rotation/handoffs/${encodeURIComponent(jti)}`
+    );
+    const status = polled?.status;
+    if (status === "approved") {
+      if (typeof polled.token === "string" && polled.token.length > 0) {
+        return polled.token;
+      }
+      throw stepUpError(
+        "This approval was already collected by another request.",
+        "Run the command again to request a new approval."
+      );
+    }
+    if (status === "consumed") {
+      throw stepUpError(
+        "This approval was already used.",
+        "Run the command again to request a new approval."
+      );
+    }
+    if (status === "expired") {
+      throw stepUpError(
+        "The browser approval expired.",
+        "Run the command again and approve within 5 minutes."
+      );
+    }
+    await sleep3(interval);
+  }
+  throw stepUpError(
+    "Timed out waiting for the browser approval.",
+    "Run the command again and approve within 5 minutes."
+  );
+}
+
+// src/lib/admin-access.ts
+async function requestAdminAccess(client2, apiOrigin, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const deadline = now() + (opts.deadlineMs ?? 5 * 6e4);
+  const notify = opts.notify ?? ((line) => process.stderr.write(`${line}
+`));
+  const created = await client2.requestOnce("POST", "/api/admin/access", {
+    timeoutMs: 15e3
+  });
+  const request = created.body;
+  if (created.status !== 200 || !request?.requestId || !/^[a-f0-9-]{36}$/.test(request.requestId))
+    throw new CliError(
+      "Could not request admin approval.",
+      1 /* AUTH_ERROR */,
+      "Check this connection has admin scope and belongs to a super admin."
+    );
+  if (request.status === "approved") return;
+  if (request.status !== "pending")
+    throw new CliError("Admin approval is unavailable.", 1 /* AUTH_ERROR */);
+  const url2 = new URL(`/admin/compliance/audit/${request.requestId}`, apiOrigin).href;
+  notify(`Approve 15-minute admin access with your passkey: ${url2}`);
+  if (!await (opts.openUrl ?? openInBrowser)(url2))
+    notify("Open the link above in your browser to approve.");
+  const sleep3 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  while (now() < deadline) {
+    const result = await client2.requestOnce("GET", "/api/admin/access", {
+      params: { requestId: request.requestId },
+      timeoutMs: 15e3
+    });
+    const status = result.body;
+    if (result.status !== 200)
+      throw new CliError(
+        "Admin approval could not be checked.",
+        1 /* AUTH_ERROR */,
+        "The connection may have changed. Run the command again."
+      );
+    if (status?.status === "approved") {
+      notify(
+        `Admin access approved until ${status.expiresAt}. No key was copied or saved.`
+      );
+      return;
+    }
+    if (status?.status !== "pending")
+      throw new CliError(
+        "Admin approval was denied or expired.",
+        1 /* AUTH_ERROR */
+      );
+    await sleep3(opts.pollIntervalMs ?? 2e3);
+  }
+  throw new CliError(
+    "Timed out waiting for admin approval.",
+    1 /* AUTH_ERROR */,
+    "Run the command again to request a new approval."
+  );
+}
+
 // src/lib/client.ts
 var DEFAULT_TIMEOUT_MS2 = 3e4;
 var PRESENCE_TIMEOUT_MS = 4e4;
@@ -11811,6 +12001,16 @@ var GadClient = class {
    * @returns The decoded JSON payload from the tool result content
    */
   async mcpCall(toolName, args, timeoutMs) {
+    try {
+      return await this.mcpCallOnce(toolName, args, timeoutMs);
+    } catch (error62) {
+      if (!(error62 instanceof McpToolError) || !["step_up_required", "needs_grant"].includes(error62.toolCode))
+        throw error62;
+      await requestAdminAccess(this, this.apiUrl);
+      return this.mcpCallOnce(toolName, args, timeoutMs);
+    }
+  }
+  async mcpCallOnce(toolName, args, timeoutMs) {
     const url2 = `${this.apiUrl}/api/mcp`;
     const body = JSON.stringify({
       jsonrpc: "2.0",
@@ -12101,18 +12301,94 @@ var GadClient = class {
   }
 };
 
-// src/lib/global-opts.ts
-function globalOutputOpts(cmd) {
-  const merged = cmd.optsWithGlobals();
-  return {
-    json: Boolean(merged.json),
-    quiet: Boolean(merged.quiet),
-    // --no-color sets `color: false`; some commands declare `--no-color`
-    // locally which surfaces as `noColor`.
-    noColor: merged.color === false || Boolean(merged.noColor)
-  };
+// src/commands/auth.ts
+var EXIT_SESSION_EXPIRED = 2;
+var EXIT_NOT_OAUTH = 3;
+function authCommand() {
+  const cmd = new Command("auth").description("Authentication helpers");
+  cmd.command("admin").description(
+    "Approve 15-minute admin access in your browser; no key is printed"
+  ).action(async () => {
+    const auth = await resolveAuth();
+    const client2 = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
+    await requestAdminAccess(client2, auth.apiUrl);
+  });
+  cmd.command("token").description("Print a fresh OAuth access token, refreshing it if needed").option("--json", "Output {accessToken, accessExpiresAt, apiUrl} as JSON").action(async (options, actionCommand2) => {
+    try {
+      const t = await getFreshOAuthAccessToken();
+      writeCliLocator();
+      const jsonOutput = options.json || actionCommand2.optsWithGlobals().json;
+      process.stdout.write(
+        jsonOutput ? `${JSON.stringify(t)}
+` : `${t.accessToken}
+`
+      );
+    } catch (error62) {
+      if (error62 instanceof NotOAuthCredential) {
+        process.stderr.write(`${error62.message}
+`);
+        process.exitCode = EXIT_NOT_OAUTH;
+        return;
+      }
+      if (error62 instanceof CliError && error62.code === 1) {
+        const hint = error62.hint ? ` ${error62.hint}` : "";
+        process.stderr.write(`${error62.message}${hint}
+`);
+        process.exitCode = EXIT_SESSION_EXPIRED;
+        return;
+      }
+      throw error62;
+    }
+  });
+  return cmd;
 }
 
+// src/commands/logout.ts
+var logoutCommand = new Command("logout").description("Remove stored authentication credentials").action(async (_options, cmd) => {
+  const parent = cmd.parent;
+  const json3 = parent?.opts().json ?? false;
+  const quiet = parent?.opts().quiet ?? false;
+  const noColor = parent?.opts().noColor ?? false;
+  const fmt = createFormatter({
+    json: json3,
+    quiet,
+    isTTY: isTTY(),
+    noColor
+  });
+  const stored = await loadStoredCredential();
+  if (stored?.kind === "oauth") {
+    await revokeToken({
+      apiUrl: stored.credential.apiUrl,
+      clientId: stored.credential.clientId,
+      token: stored.credential.refreshToken,
+      tokenTypeHint: "refresh_token"
+    });
+  }
+  let clearError = null;
+  try {
+    await clearStoredCredential();
+  } catch (err2) {
+    clearError = err2;
+  }
+  const config2 = await loadConfig();
+  if (config2.token) {
+    config2.token = "";
+    await saveConfig(config2);
+  }
+  if (clearError) {
+    fmt.error(
+      clearError instanceof Error ? clearError.message : "Could not remove stored authentication credentials."
+    );
+    process.exitCode = 1 /* AUTH_ERROR */;
+    return;
+  }
+  fmt.success("Logged out successfully.");
+});
+
 // src/commands/whoami.ts
 function firstThingsToTry(data) {
   const o = data.onboarding;
@@ -13079,7 +13355,7 @@ var claim_default = claimCommand;
 import { readFileSync } from "node:fs";
 
 // src/lib/work-status.ts
-import { execFile as execFile2, execFileSync as execFileSync2 } from "node:child_process";
+import { execFile as execFile3, execFileSync as execFileSync2 } from "node:child_process";
 
 // ../../src/lib/work-risk/push-state.ts
 var REMOTE_BRANCH_REF_PREFIX = "refs/remotes/origin/";
@@ -13131,7 +13407,7 @@ var WORKTREE_STATUS_CONCURRENCY = 8;
 var WORKTREE_STATUS_TIMEOUT_MS = 2e3;
 function gitAsync(args, cwd) {
   return new Promise((resolve7) => {
-    execFile2(
+    execFile3(
       "git",
       args,
       {
@@ -50050,98 +50326,6 @@ function renderStatus2(payload, plain, apiUrl) {
   process.stdout.write(brandedBlock("status", lines) + "\n");
 }
 
-// src/commands/open.ts
-import { execFile as execFile3 } from "node:child_process";
-var PLANE_NOTE = {
-  workspace: "follows your active workspace",
-  cross: "spans every workspace you belong to",
-  account: "your account, not a workspace"
-};
-function browserLaunchCommand(url2, platform2 = process.platform) {
-  let parsed;
-  try {
-    parsed = new URL(url2);
-  } catch {
-    return null;
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
-  if (platform2 === "darwin") return { file: "open", args: [url2] };
-  if (platform2 === "win32") return { file: "explorer.exe", args: [url2] };
-  return { file: "xdg-open", args: [url2] };
-}
-function openBrowser2(url2) {
-  const command = browserLaunchCommand(url2);
-  if (!command) return Promise.resolve(false);
-  return new Promise((resolve7) => {
-    execFile3(command.file, command.args, (error62) => resolve7(!error62));
-  });
-}
-function toSurfaceRow(value) {
-  if (typeof value !== "object" || value === null) return null;
-  const r = value;
-  if (typeof r.id !== "string" || typeof r.href !== "string") return null;
-  if (!r.href.startsWith("/") || r.href.startsWith("//")) return null;
-  const plane = r.plane === "workspace" || r.plane === "cross" || r.plane === "account" ? r.plane : "workspace";
-  return {
-    id: r.id,
-    label: typeof r.label === "string" ? r.label : r.id,
-    href: r.href,
-    plane,
-    group: typeof r.group === "string" ? r.group : ""
-  };
-}
-function surfaceUrl(apiUrl, href) {
-  return `${apiUrl.replace(/\/$/, "")}${href}`;
-}
-function openCommand() {
-  return new Command("open").description("Open an app surface in the browser (e.g. gad open library)").argument(
-    "<surface>",
-    "Surface id, path, label or keyword \u2014 e.g. library, /leads, 'Pitch page'"
-  ).option("--print", "Print the URL instead of opening a browser").option("--json", "Output the resolved surface as JSON").action(async (surface, options, command) => {
-    const g = globalOutputOpts(command);
-    const auth = await resolveAuth();
-    const client2 = new GadClient({
-      token: auth.token,
-      getToken: auth.getToken,
-      apiUrl: auth.apiUrl
-    });
-    const result = await client2.mcpCall("surfaces_list", {
-      query: surface
-    });
-    const match = toSurfaceRow(result?.match);
-    const candidates = (Array.isArray(result?.candidates) ? result.candidates : []).map(toSurfaceRow).filter((r) => r !== null);
-    if (!match) {
-      throw new CliError(
-        candidates.length === 0 ? `No app surface matches '${surface}'.` : `'${surface}' matches ${candidates.length} surfaces.`,
-        3 /* VALIDATION_ERROR */,
-        candidates.length === 0 ? "Run 'gad open --help', or ask an AI for surfaces_list to see every page." : `Did you mean: ${candidates.map((c2) => c2.id).join(", ")}?`
-      );
-    }
-    const url2 = surfaceUrl(auth.apiUrl, match.href);
-    if (g.json) {
-      process.stdout.write(JSON.stringify({ ...match, url: url2 }) + "\n");
-      return;
-    }
-    const c = createColor(g.noColor || g.quiet);
-    if (options.print) {
-      process.stdout.write(url2 + "\n");
-      return;
-    }
-    const opened = await openBrowser2(url2);
-    process.stdout.write(
-      `${match.label} ${c.dim(`(${PLANE_NOTE[match.plane]})`)}
-${c.cyan(url2)}
-`
-    );
-    if (!opened) {
-      process.stderr.write(
-        `${c.dim("Couldn't launch a browser \u2014 open the URL above.")}
-`
-      );
-    }
-  });
-}
-
 // src/commands/next.ts
 var PICKUP_LIMIT = 10;
 function pickupArgs(identityStatus) {
@@ -50342,7 +50526,7 @@ import { homedir as homedir10 } from "node:os";
 import { isAbsolute as isAbsolute3, join as join13, relative, resolve as resolve5 } from "node:path";
 
 // src/lib/runner/git.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 var GIT_DEADLINE_MS = 12e4;
 var HOST_PATH = "/usr/bin:/bin:/usr/sbin:/sbin";
 var MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
@@ -50386,7 +50570,7 @@ function safeGitBytes(cwd, args, opts = {}) {
   return new Promise((resolve7) => {
     const failed = (stderr) => resolve7({ code: 1, stdout: Buffer.alloc(0), stderr });
     if (opts.signal?.aborted) return failed("aborted");
-    const child = spawn("git", argv, {
+    const child = spawn2("git", argv, {
       cwd,
       env: { ...gitEnv(), ...opts.env ?? {} },
       stdio: ["pipe", "pipe", "pipe"],
@@ -50463,21 +50647,6 @@ function worktreeGitBytes(layout, args, opts = {}) {
   return safeGitBytes(layout.worktree, [...layoutArgs(layout), ...args], opts);
 }
 
-// src/lib/runner/boot-ticks.ts
-import { readFileSync as readFileSync4 } from "node:fs";
-var USER_HZ = 100;
-function bootTicks(read = readFileSync4) {
-  if (process.platform !== "linux") return void 0;
-  try {
-    const seconds = Number.parseFloat(
-      read("/proc/uptime", "utf8").split(" ")[0] ?? ""
-    );
-    return Number.isFinite(seconds) ? Math.floor(seconds * USER_HZ) : void 0;
-  } catch {
-    return void 0;
-  }
-}
-
 // src/lib/runner/text.ts
 function cleanLine(text3) {
   return text3.replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ").trim();
@@ -50833,7 +51002,6 @@ async function prepareWorktree(input2) {
   await privateDir(join13(runDir, "wt"));
   const path10 = join13(runDir, "wt", short(todoId));
   const branch = runnerBranch(runId, todoId);
-  const preparedAt = bootTicks();
   const fetch2 = await safeGit(repoRoot, [
     "fetch",
     "--no-tags",
@@ -50859,8 +51027,7 @@ async function prepareWorktree(input2) {
     worktreeGitDir: await gitPath(worktree, "--absolute-git-dir"),
     home: homedir10(),
     hooksDir: await configuredHooksDir(worktree, commonDir),
-    branch,
-    ...preparedAt === void 0 ? {} : { preparedAt }
+    branch
   };
   const gad = join13(worktree, ".gad");
   await privateDir(gad);
@@ -51344,7 +51511,7 @@ import { join as join17 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 
 // src/lib/runner/agent.ts
-import { execFile as execFile4, spawn as spawn2 } from "node:child_process";
+import { execFile as execFile4, spawn as spawn3 } from "node:child_process";
 import { accessSync, chmodSync as chmodSync3, closeSync, constants as constants2, openSync } from "node:fs";
 import { delimiter, join as join15 } from "node:path";
 var KILL_GRACE_MS = 5e3;
@@ -51412,7 +51579,7 @@ async function runAgent(input2) {
   const env4 = { ...stripCredentialEnv(process.env), GIT_TERMINAL_PROMPT: "0" };
   let child;
   try {
-    child = spawn2(input2.bin, agentArgv(input2), {
+    child = spawn3(input2.bin, agentArgv(input2), {
       cwd: input2.layout.worktree,
       detached: true,
       stdio: ["ignore", fd, fd],
@@ -51483,7 +51650,7 @@ async function reapGroup(pgid, waitMs = REAP_WAIT_MS) {
 
 // src/lib/runner/holders.ts
 import { execFile as execFile5 } from "node:child_process";
-import { readFileSync as readFileSync5, readdirSync, readlinkSync, statSync as statSync2 } from "node:fs";
+import { readdirSync, readlinkSync, statSync as statSync2 } from "node:fs";
 var LSOF_DEADLINE_MS = 2e4;
 var CHECKS = 5;
 var PAUSE_MS = 250;
@@ -51595,18 +51762,8 @@ async function lsofUsers(root, uid, exec2 = run3) {
   for (const h of holders) if (!await isIndexer(h, exec2)) users.push(h.pid);
   return users;
 }
-function startTicks(pid, fs6) {
-  try {
-    const stat3 = (fs6.readFileSync ?? readFileSync5)(`/proc/${pid}/stat`, "utf8");
-    const after = stat3.slice(stat3.lastIndexOf(")") + 1).trim().split(/\s+/);
-    const ticks = Number(after[19]);
-    return Number.isSafeInteger(ticks) ? ticks : null;
-  } catch {
-    return null;
-  }
-}
 var errno = (error62) => error62.code;
-function procUsers(root, uid, fs6 = { readdirSync, statSync: statSync2, readlinkSync, readFileSync: readFileSync5 }, notBefore) {
+function procUsers(root, uid, fs6 = { readdirSync, statSync: statSync2, readlinkSync }) {
   let entries;
   try {
     entries = fs6.readdirSync("/proc").filter((e) => /^\d+$/.test(e));
@@ -51636,24 +51793,20 @@ function procUsers(root, uid, fs6 = { readdirSync, statSync: statSync2, readlink
       if (holds) users.push(Number(pid));
     } catch (error62) {
       if (errno(error62) === "ENOENT" || errno(error62) === "ESRCH") continue;
-      if (errno(error62) === "EACCES" && notBefore !== void 0) {
-        const started = startTicks(pid, fs6);
-        if (started !== null && started < notBefore) continue;
-      }
       return null;
     }
   }
   return users;
 }
-async function processesUsing(root, notBefore) {
+async function processesUsing(root) {
   const uid = process.getuid?.();
   if (uid === void 0) return null;
-  const found = process.platform === "darwin" ? await lsofUsers(root, uid) : process.platform === "linux" ? procUsers(root, uid, void 0, notBefore) : null;
+  const found = process.platform === "darwin" ? await lsofUsers(root, uid) : process.platform === "linux" ? procUsers(root, uid) : null;
   return found?.filter((pid) => pid !== process.pid) ?? null;
 }
-async function worktreeUnused(root, notBefore) {
+async function worktreeUnused(root) {
   for (let check2 = 0; check2 < CHECKS; check2++) {
-    const users = await processesUsing(root, notBefore);
+    const users = await processesUsing(root);
     if (users === null) return false;
     if (users.length === 0) return true;
     if (check2 + 1 < CHECKS) await new Promise((r) => setTimeout(r, PAUSE_MS));
@@ -52059,7 +52212,7 @@ async function headSha(layout, opts) {
 }
 async function publishBranch(layout, branch, base, message, signal, options = {}) {
   if (!await verifyGitfile(layout)) return { failed: "sandbox_tampered" };
-  if (!await worktreeUnused(layout.worktree, layout.preparedAt))
+  if (!await worktreeUnused(layout.worktree))
     return { failed: "agent_still_running" };
   if (!RUNNER_BRANCH.test(branch) || branch === base || !BASE_NAME.test(base))
     return { failed: "bad_branch" };
@@ -52641,7 +52794,7 @@ import { createInterface as createInterface4 } from "node:readline";
 import { Writable } from "node:stream";
 
 // src/lib/keys-apply.ts
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 import {
   chmod as chmod6,
   mkdir as mkdir10,
@@ -52666,7 +52819,7 @@ function runWithStdin(file2, args, input2, timeoutMs) {
     };
     let child;
     try {
-      child = spawn3(file2, args, { stdio: ["pipe", "ignore", "ignore"] });
+      child = spawn4(file2, args, { stdio: ["pipe", "ignore", "ignore"] });
     } catch {
       resolve7("not_found");
       return;
@@ -52984,111 +53137,6 @@ function openFromServer(sealed, devicePrivateKeyB64) {
   }
 }
 
-// src/lib/keys-handoff.ts
-import { spawn as spawn4 } from "node:child_process";
-
-// src/lib/keys-paths.ts
-function keyRotationPath() {
-  return "/settings/key-rotation";
-}
-function keyRotationRunPath(runId) {
-  return `/settings/key-rotation/runs/${encodeURIComponent(runId)}`;
-}
-function keyRotationHandoffPath(jti) {
-  return `/settings/key-rotation/handoff/${encodeURIComponent(jti)}`;
-}
-
-// src/lib/keys-handoff.ts
-var HANDOFF_POLL_INTERVAL_MS = 2e3;
-var HANDOFF_DEADLINE_MS = 5 * 6e4;
-var BROWSER_LAUNCH_TIMEOUT_MS = 5e3;
-function openInBrowser(url2) {
-  const command = browserLaunchCommand(url2);
-  if (!command) return Promise.resolve(false);
-  return new Promise((resolve7) => {
-    let settled = false;
-    const done = (ok2) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve7(ok2);
-    };
-    const timer = setTimeout(() => done(false), BROWSER_LAUNCH_TIMEOUT_MS);
-    timer.unref?.();
-    try {
-      const child = spawn4(command.file, command.args, {
-        detached: true,
-        stdio: "ignore"
-      });
-      child.once("error", () => done(false));
-      child.once("spawn", () => {
-        child.unref();
-        done(true);
-      });
-    } catch {
-      done(false);
-    }
-  });
-}
-var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
-function stepUpError(message, hint) {
-  return new CliError(message, 1 /* AUTH_ERROR */, hint);
-}
-async function requestBrowserStepUp(client2, kind, subjectId, opts = {}) {
-  const openUrl = opts.openUrl ?? openInBrowser;
-  const notify = opts.notify ?? ((line) => process.stderr.write(`${line}
-`));
-  const sleep3 = opts.sleep ?? defaultSleep;
-  const now = opts.now ?? Date.now;
-  const interval = opts.pollIntervalMs ?? HANDOFF_POLL_INTERVAL_MS;
-  const deadline = now() + (opts.deadlineMs ?? HANDOFF_DEADLINE_MS);
-  const created = await client2.post("/api/key-rotation/handoffs", {
-    kind,
-    subjectId
-  });
-  const jti = typeof created?.jti === "string" ? created.jti : null;
-  if (!jti || !/^[A-Za-z0-9-]{1,64}$/.test(jti)) {
-    throw stepUpError("The server did not return a browser approval.");
-  }
-  const url2 = `${client2.apiOrigin}${keyRotationHandoffPath(jti)}`;
-  notify(`Approve this in your browser (passkey or two-step code): ${url2}`);
-  if (!await openUrl(url2)) {
-    notify("Couldn't launch a browser. Open the URL above to approve.");
-  }
-  while (now() < deadline) {
-    const polled = await client2.get(
-      `/api/key-rotation/handoffs/${encodeURIComponent(jti)}`
-    );
-    const status = polled?.status;
-    if (status === "approved") {
-      if (typeof polled.token === "string" && polled.token.length > 0) {
-        return polled.token;
-      }
-      throw stepUpError(
-        "This approval was already collected by another request.",
-        "Run the command again to request a new approval."
-      );
-    }
-    if (status === "consumed") {
-      throw stepUpError(
-        "This approval was already used.",
-        "Run the command again to request a new approval."
-      );
-    }
-    if (status === "expired") {
-      throw stepUpError(
-        "The browser approval expired.",
-        "Run the command again and approve within 5 minutes."
-      );
-    }
-    await sleep3(interval);
-  }
-  throw stepUpError(
-    "Timed out waiting for the browser approval.",
-    "Run the command again and approve within 5 minutes."
-  );
-}
-
 // src/lib/keys-device.ts
 var DEFAULT_ENV_FILE = ".env.local";
 var DETECT_TIMEOUT_MS = 5e3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {