@great-arrow/cli 0.9.3 → 0.9.6

package/dist/index.js

@@ -3339,11 +3339,11 @@ var require_util = __commonJS({
           if (files.includes("node_modules") || files.includes("package.json") || files.includes("package.json5") || files.includes("package.yaml") || files.includes("pnpm-workspace.yaml")) {
             return name24;
           }
-          const dirname10 = path10.dirname(name24);
-          if (dirname10 === name24) {
+          const dirname11 = path10.dirname(name24);
+          if (dirname11 === name24) {
             return original;
           }
-          return find(dirname10, original);
+          return find(dirname11, original);
         } catch (error62) {
           if (name24 === original) {
             if (error62.code === "ENOENT") {
@@ -9483,7 +9483,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.9.3";
+var CLI_VERSION = "0.9.6";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -10969,83 +10969,6 @@ function sessionExpired() {
   return authError("Session expired.", "Run 'gad login' to re-authenticate.");
 }
 
-// src/commands/auth.ts
-var EXIT_SESSION_EXPIRED = 2;
-var EXIT_NOT_OAUTH = 3;
-function authCommand() {
-  const cmd = new Command("auth").description("Authentication helpers");
-  cmd.command("token").description("Print a fresh OAuth access token, refreshing it if needed").option("--json", "Output {accessToken, accessExpiresAt, apiUrl} as JSON").action(async (options, actionCommand2) => {
-    try {
-      const t = await getFreshOAuthAccessToken();
-      writeCliLocator();
-      const jsonOutput = options.json || actionCommand2.optsWithGlobals().json;
-      process.stdout.write(
-        jsonOutput ? `${JSON.stringify(t)}
-` : `${t.accessToken}
-`
-      );
-    } catch (error62) {
-      if (error62 instanceof NotOAuthCredential) {
-        process.stderr.write(`${error62.message}
-`);
-        process.exitCode = EXIT_NOT_OAUTH;
-        return;
-      }
-      if (error62 instanceof CliError && error62.code === 1) {
-        const hint = error62.hint ? ` ${error62.hint}` : "";
-        process.stderr.write(`${error62.message}${hint}
-`);
-        process.exitCode = EXIT_SESSION_EXPIRED;
-        return;
-      }
-      throw error62;
-    }
-  });
-  return cmd;
-}
-
-// src/commands/logout.ts
-var logoutCommand = new Command("logout").description("Remove stored authentication credentials").action(async (_options, cmd) => {
-  const parent = cmd.parent;
-  const json3 = parent?.opts().json ?? false;
-  const quiet = parent?.opts().quiet ?? false;
-  const noColor = parent?.opts().noColor ?? false;
-  const fmt = createFormatter({
-    json: json3,
-    quiet,
-    isTTY: isTTY(),
-    noColor
-  });
-  const stored = await loadStoredCredential();
-  if (stored?.kind === "oauth") {
-    await revokeToken({
-      apiUrl: stored.credential.apiUrl,
-      clientId: stored.credential.clientId,
-      token: stored.credential.refreshToken,
-      tokenTypeHint: "refresh_token"
-    });
-  }
-  let clearError = null;
-  try {
-    await clearStoredCredential();
-  } catch (err2) {
-    clearError = err2;
-  }
-  const config2 = await loadConfig();
-  if (config2.token) {
-    config2.token = "";
-    await saveConfig(config2);
-  }
-  if (clearError) {
-    fmt.error(
-      clearError instanceof Error ? clearError.message : "Could not remove stored authentication credentials."
-    );
-    process.exitCode = 1 /* AUTH_ERROR */;
-    return;
-  }
-  fmt.success("Logged out successfully.");
-});
-
 // src/lib/client.ts
 import { execSync } from "node:child_process";
 
@@ -11547,6 +11470,273 @@ async function withNativeResponse(context2, path10, init, consume, parentSignal)
   );
 }
 
+// src/lib/keys-handoff.ts
+import { spawn } from "node:child_process";
+
+// src/commands/open.ts
+import { execFile as execFile2 } from "node:child_process";
+
+// src/lib/global-opts.ts
+function globalOutputOpts(cmd) {
+  const merged = cmd.optsWithGlobals();
+  return {
+    json: Boolean(merged.json),
+    quiet: Boolean(merged.quiet),
+    // --no-color sets `color: false`; some commands declare `--no-color`
+    // locally which surfaces as `noColor`.
+    noColor: merged.color === false || Boolean(merged.noColor)
+  };
+}
+
+// src/commands/open.ts
+var PLANE_NOTE = {
+  workspace: "follows your active workspace",
+  cross: "spans every workspace you belong to",
+  account: "your account, not a workspace"
+};
+function browserLaunchCommand(url2, platform2 = process.platform) {
+  let parsed;
+  try {
+    parsed = new URL(url2);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  if (platform2 === "darwin") return { file: "open", args: [url2] };
+  if (platform2 === "win32") return { file: "explorer.exe", args: [url2] };
+  return { file: "xdg-open", args: [url2] };
+}
+function openBrowser2(url2) {
+  const command = browserLaunchCommand(url2);
+  if (!command) return Promise.resolve(false);
+  return new Promise((resolve7) => {
+    execFile2(command.file, command.args, (error62) => resolve7(!error62));
+  });
+}
+function toSurfaceRow(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const r = value;
+  if (typeof r.id !== "string" || typeof r.href !== "string") return null;
+  if (!r.href.startsWith("/") || r.href.startsWith("//")) return null;
+  const plane = r.plane === "workspace" || r.plane === "cross" || r.plane === "account" ? r.plane : "workspace";
+  return {
+    id: r.id,
+    label: typeof r.label === "string" ? r.label : r.id,
+    href: r.href,
+    plane,
+    group: typeof r.group === "string" ? r.group : ""
+  };
+}
+function surfaceUrl(apiUrl, href) {
+  return `${apiUrl.replace(/\/$/, "")}${href}`;
+}
+function openCommand() {
+  return new Command("open").description("Open an app surface in the browser (e.g. gad open library)").argument(
+    "<surface>",
+    "Surface id, path, label or keyword \u2014 e.g. library, /leads, 'Pitch page'"
+  ).option("--print", "Print the URL instead of opening a browser").option("--json", "Output the resolved surface as JSON").action(async (surface, options, command) => {
+    const g = globalOutputOpts(command);
+    const auth = await resolveAuth();
+    const client2 = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
+    const result = await client2.mcpCall("surfaces_list", {
+      query: surface
+    });
+    const match = toSurfaceRow(result?.match);
+    const candidates = (Array.isArray(result?.candidates) ? result.candidates : []).map(toSurfaceRow).filter((r) => r !== null);
+    if (!match) {
+      throw new CliError(
+        candidates.length === 0 ? `No app surface matches '${surface}'.` : `'${surface}' matches ${candidates.length} surfaces.`,
+        3 /* VALIDATION_ERROR */,
+        candidates.length === 0 ? "Run 'gad open --help', or ask an AI for surfaces_list to see every page." : `Did you mean: ${candidates.map((c2) => c2.id).join(", ")}?`
+      );
+    }
+    const url2 = surfaceUrl(auth.apiUrl, match.href);
+    if (g.json) {
+      process.stdout.write(JSON.stringify({ ...match, url: url2 }) + "\n");
+      return;
+    }
+    const c = createColor(g.noColor || g.quiet);
+    if (options.print) {
+      process.stdout.write(url2 + "\n");
+      return;
+    }
+    const opened = await openBrowser2(url2);
+    process.stdout.write(
+      `${match.label} ${c.dim(`(${PLANE_NOTE[match.plane]})`)}
+${c.cyan(url2)}
+`
+    );
+    if (!opened) {
+      process.stderr.write(
+        `${c.dim("Couldn't launch a browser \u2014 open the URL above.")}
+`
+      );
+    }
+  });
+}
+
+// src/lib/keys-paths.ts
+function keyRotationPath() {
+  return "/settings/key-rotation";
+}
+function keyRotationRunPath(runId) {
+  return `/settings/key-rotation/runs/${encodeURIComponent(runId)}`;
+}
+function keyRotationHandoffPath(jti) {
+  return `/settings/key-rotation/handoff/${encodeURIComponent(jti)}`;
+}
+
+// src/lib/keys-handoff.ts
+var HANDOFF_POLL_INTERVAL_MS = 2e3;
+var HANDOFF_DEADLINE_MS = 5 * 6e4;
+var BROWSER_LAUNCH_TIMEOUT_MS = 5e3;
+function openInBrowser(url2) {
+  const command = browserLaunchCommand(url2);
+  if (!command) return Promise.resolve(false);
+  return new Promise((resolve7) => {
+    let settled = false;
+    const done = (ok2) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve7(ok2);
+    };
+    const timer = setTimeout(() => done(false), BROWSER_LAUNCH_TIMEOUT_MS);
+    timer.unref?.();
+    try {
+      const child = spawn(command.file, command.args, {
+        detached: true,
+        stdio: "ignore"
+      });
+      child.once("error", () => done(false));
+      child.once("spawn", () => {
+        child.unref();
+        done(true);
+      });
+    } catch {
+      done(false);
+    }
+  });
+}
+var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+function stepUpError(message, hint) {
+  return new CliError(message, 1 /* AUTH_ERROR */, hint);
+}
+async function requestBrowserStepUp(client2, kind, subjectId, opts = {}) {
+  const openUrl = opts.openUrl ?? openInBrowser;
+  const notify = opts.notify ?? ((line) => process.stderr.write(`${line}
+`));
+  const sleep3 = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const interval = opts.pollIntervalMs ?? HANDOFF_POLL_INTERVAL_MS;
+  const deadline = now() + (opts.deadlineMs ?? HANDOFF_DEADLINE_MS);
+  const created = await client2.post("/api/key-rotation/handoffs", {
+    kind,
+    subjectId
+  });
+  const jti = typeof created?.jti === "string" ? created.jti : null;
+  if (!jti || !/^[A-Za-z0-9-]{1,64}$/.test(jti)) {
+    throw stepUpError("The server did not return a browser approval.");
+  }
+  const url2 = `${client2.apiOrigin}${keyRotationHandoffPath(jti)}`;
+  notify(`Approve this in your browser (passkey or two-step code): ${url2}`);
+  if (!await openUrl(url2)) {
+    notify("Couldn't launch a browser. Open the URL above to approve.");
+  }
+  while (now() < deadline) {
+    const polled = await client2.get(
+      `/api/key-rotation/handoffs/${encodeURIComponent(jti)}`
+    );
+    const status = polled?.status;
+    if (status === "approved") {
+      if (typeof polled.token === "string" && polled.token.length > 0) {
+        return polled.token;
+      }
+      throw stepUpError(
+        "This approval was already collected by another request.",
+        "Run the command again to request a new approval."
+      );
+    }
+    if (status === "consumed") {
+      throw stepUpError(
+        "This approval was already used.",
+        "Run the command again to request a new approval."
+      );
+    }
+    if (status === "expired") {
+      throw stepUpError(
+        "The browser approval expired.",
+        "Run the command again and approve within 5 minutes."
+      );
+    }
+    await sleep3(interval);
+  }
+  throw stepUpError(
+    "Timed out waiting for the browser approval.",
+    "Run the command again and approve within 5 minutes."
+  );
+}
+
+// src/lib/admin-access.ts
+async function requestAdminAccess(client2, apiOrigin, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const deadline = now() + (opts.deadlineMs ?? 5 * 6e4);
+  const notify = opts.notify ?? ((line) => process.stderr.write(`${line}
+`));
+  const created = await client2.requestOnce("POST", "/api/admin/access", {
+    timeoutMs: 15e3
+  });
+  const request = created.body;
+  if (created.status !== 200 || !request?.requestId || !/^[a-f0-9-]{36}$/.test(request.requestId))
+    throw new CliError(
+      "Could not request admin approval.",
+      1 /* AUTH_ERROR */,
+      "Check this connection has admin scope and belongs to a super admin."
+    );
+  if (request.status === "approved") return;
+  if (request.status !== "pending")
+    throw new CliError("Admin approval is unavailable.", 1 /* AUTH_ERROR */);
+  const url2 = new URL(`/admin/compliance/audit/${request.requestId}`, apiOrigin).href;
+  notify(`Approve 15-minute admin access with your passkey: ${url2}`);
+  if (!await (opts.openUrl ?? openInBrowser)(url2))
+    notify("Open the link above in your browser to approve.");
+  const sleep3 = opts.sleep ?? ((ms) => new Promise((resolve7) => setTimeout(resolve7, ms)));
+  while (now() < deadline) {
+    const result = await client2.requestOnce("GET", "/api/admin/access", {
+      params: { requestId: request.requestId },
+      timeoutMs: 15e3
+    });
+    const status = result.body;
+    if (result.status !== 200)
+      throw new CliError(
+        "Admin approval could not be checked.",
+        1 /* AUTH_ERROR */,
+        "The connection may have changed. Run the command again."
+      );
+    if (status?.status === "approved") {
+      notify(
+        `Admin access approved until ${status.expiresAt}. No key was copied or saved.`
+      );
+      return;
+    }
+    if (status?.status !== "pending")
+      throw new CliError(
+        "Admin approval was denied or expired.",
+        1 /* AUTH_ERROR */
+      );
+    await sleep3(opts.pollIntervalMs ?? 2e3);
+  }
+  throw new CliError(
+    "Timed out waiting for admin approval.",
+    1 /* AUTH_ERROR */,
+    "Run the command again to request a new approval."
+  );
+}
+
 // src/lib/client.ts
 var DEFAULT_TIMEOUT_MS2 = 3e4;
 var PRESENCE_TIMEOUT_MS = 4e4;
@@ -11811,6 +12001,16 @@ var GadClient = class {
    * @returns The decoded JSON payload from the tool result content
    */
   async mcpCall(toolName, args, timeoutMs) {
+    try {
+      return await this.mcpCallOnce(toolName, args, timeoutMs);
+    } catch (error62) {
+      if (!(error62 instanceof McpToolError) || !["step_up_required", "needs_grant"].includes(error62.toolCode))
+        throw error62;
+      await requestAdminAccess(this, this.apiUrl);
+      return this.mcpCallOnce(toolName, args, timeoutMs);
+    }
+  }
+  async mcpCallOnce(toolName, args, timeoutMs) {
     const url2 = `${this.apiUrl}/api/mcp`;
     const body = JSON.stringify({
       jsonrpc: "2.0",
@@ -12101,18 +12301,94 @@ var GadClient = class {
   }
 };
 
-// src/lib/global-opts.ts
-function globalOutputOpts(cmd) {
-  const merged = cmd.optsWithGlobals();
-  return {
-    json: Boolean(merged.json),
-    quiet: Boolean(merged.quiet),
-    // --no-color sets `color: false`; some commands declare `--no-color`
-    // locally which surfaces as `noColor`.
-    noColor: merged.color === false || Boolean(merged.noColor)
-  };
+// src/commands/auth.ts
+var EXIT_SESSION_EXPIRED = 2;
+var EXIT_NOT_OAUTH = 3;
+function authCommand() {
+  const cmd = new Command("auth").description("Authentication helpers");
+  cmd.command("admin").description(
+    "Approve 15-minute admin access in your browser; no key is printed"
+  ).action(async () => {
+    const auth = await resolveAuth();
+    const client2 = new GadClient({
+      token: auth.token,
+      getToken: auth.getToken,
+      apiUrl: auth.apiUrl
+    });
+    await requestAdminAccess(client2, auth.apiUrl);
+  });
+  cmd.command("token").description("Print a fresh OAuth access token, refreshing it if needed").option("--json", "Output {accessToken, accessExpiresAt, apiUrl} as JSON").action(async (options, actionCommand2) => {
+    try {
+      const t = await getFreshOAuthAccessToken();
+      writeCliLocator();
+      const jsonOutput = options.json || actionCommand2.optsWithGlobals().json;
+      process.stdout.write(
+        jsonOutput ? `${JSON.stringify(t)}
+` : `${t.accessToken}
+`
+      );
+    } catch (error62) {
+      if (error62 instanceof NotOAuthCredential) {
+        process.stderr.write(`${error62.message}
+`);
+        process.exitCode = EXIT_NOT_OAUTH;
+        return;
+      }
+      if (error62 instanceof CliError && error62.code === 1) {
+        const hint = error62.hint ? ` ${error62.hint}` : "";
+        process.stderr.write(`${error62.message}${hint}
+`);
+        process.exitCode = EXIT_SESSION_EXPIRED;
+        return;
+      }
+      throw error62;
+    }
+  });
+  return cmd;
 }
 
+// src/commands/logout.ts
+var logoutCommand = new Command("logout").description("Remove stored authentication credentials").action(async (_options, cmd) => {
+  const parent = cmd.parent;
+  const json3 = parent?.opts().json ?? false;
+  const quiet = parent?.opts().quiet ?? false;
+  const noColor = parent?.opts().noColor ?? false;
+  const fmt = createFormatter({
+    json: json3,
+    quiet,
+    isTTY: isTTY(),
+    noColor
+  });
+  const stored = await loadStoredCredential();
+  if (stored?.kind === "oauth") {
+    await revokeToken({
+      apiUrl: stored.credential.apiUrl,
+      clientId: stored.credential.clientId,
+      token: stored.credential.refreshToken,
+      tokenTypeHint: "refresh_token"
+    });
+  }
+  let clearError = null;
+  try {
+    await clearStoredCredential();
+  } catch (err2) {
+    clearError = err2;
+  }
+  const config2 = await loadConfig();
+  if (config2.token) {
+    config2.token = "";
+    await saveConfig(config2);
+  }
+  if (clearError) {
+    fmt.error(
+      clearError instanceof Error ? clearError.message : "Could not remove stored authentication credentials."
+    );
+    process.exitCode = 1 /* AUTH_ERROR */;
+    return;
+  }
+  fmt.success("Logged out successfully.");
+});
+
 // src/commands/whoami.ts
 function firstThingsToTry(data) {
   const o = data.onboarding;
@@ -13079,7 +13355,7 @@ var claim_default = claimCommand;
 import { readFileSync } from "node:fs";
 
 // src/lib/work-status.ts
-import { execFile as execFile2, execFileSync as execFileSync2 } from "node:child_process";
+import { execFile as execFile3, execFileSync as execFileSync2 } from "node:child_process";
 
 // ../../src/lib/work-risk/push-state.ts
 var REMOTE_BRANCH_REF_PREFIX = "refs/remotes/origin/";
@@ -13131,7 +13407,7 @@ var WORKTREE_STATUS_CONCURRENCY = 8;
 var WORKTREE_STATUS_TIMEOUT_MS = 2e3;
 function gitAsync(args, cwd) {
   return new Promise((resolve7) => {
-    execFile2(
+    execFile3(
       "git",
       args,
       {
@@ -15479,7 +15755,7 @@ function serverMapsFromJson(parsed, serversKey) {
   return maps;
 }
 function findCodexEntries(location, content) {
-  const entries = [];
+  const entries2 = [];
   const sections = content.split(/^\s*\[/m).slice(1);
   const seen = /* @__PURE__ */ new Set();
   for (const raw of sections) {
@@ -15493,7 +15769,7 @@ function findCodexEntries(location, content) {
     const transport = codexTransportFields(body);
     if (!isGreatArrowServer(name23, transport)) continue;
     seen.add(name23);
-    entries.push({
+    entries2.push({
       clientId: location.clientId,
       client: location.client,
       scope: location.scope,
@@ -15502,7 +15778,7 @@ function findCodexEntries(location, content) {
       surface: typeof transport.command === "string" ? "stdio" : "http"
     });
   }
-  return entries;
+  return entries2;
 }
 function findGreatArrowEntries(location, content, options = {}) {
   if (location.format === "toml") return findCodexEntries(location, content);
@@ -15514,7 +15790,7 @@ function findGreatArrowEntries(location, content, options = {}) {
   }
   if (!parsed) return [];
   const serversKey = location.serversKey ?? "mcpServers";
-  const entries = [];
+  const entries2 = [];
   for (const { servers, projectDir } of serverMapsFromJson(
     parsed,
     serversKey
@@ -15523,7 +15799,7 @@ function findGreatArrowEntries(location, content, options = {}) {
       const entry = asObject3(value);
       if (!entry) continue;
       if (!isGreatArrowServer(name23, entry)) continue;
-      entries.push({
+      entries2.push({
         clientId: location.clientId,
         client: location.client,
         scope: projectDir ? "project" : location.scope,
@@ -15538,7 +15814,7 @@ function findGreatArrowEntries(location, content, options = {}) {
       });
     }
   }
-  return entries;
+  return entries2;
 }
 function hasGreatArrowHooks(settingsContent) {
   let parsed = null;
@@ -15573,9 +15849,9 @@ function compareEntries(a, b) {
   if (a.scope !== b.scope) return a.scope === "user" ? -1 : 1;
   return a.path.localeCompare(b.path);
 }
-function detectDuplicates(entries) {
+function detectDuplicates(entries2) {
   const byClient = /* @__PURE__ */ new Map();
-  for (const entry of entries) {
+  for (const entry of entries2) {
     const list = byClient.get(entry.clientId) ?? [];
     list.push(entry);
     byClient.set(entry.clientId, list);
@@ -15602,8 +15878,8 @@ function detectDuplicates(entries) {
   }
   return findings.sort((a, b) => a.clientId.localeCompare(b.clientId));
 }
-function connectorGuidance(entries) {
-  const hasLocalClaude = entries.some(
+function connectorGuidance(entries2) {
+  const hasLocalClaude = entries2.some(
     (entry) => entry.clientId === "claude-code" || entry.clientId === "claude-desktop"
   );
   if (!hasLocalClaude) return null;
@@ -17294,12 +17570,12 @@ var logsCommand = new Command("logs").description("Tail MCP connection log with
       ]);
       return;
     }
-    const entries = Array.isArray(data) ? data : [];
-    if (entries.length === 0) {
+    const entries2 = Array.isArray(data) ? data : [];
+    if (entries2.length === 0) {
       fmt.info("No recent MCP connection events.");
       return;
     }
-    for (const entry of entries) {
+    for (const entry of entries2) {
       renderLogEntry(entry, c);
     }
   } catch {
@@ -17646,15 +17922,15 @@ async function scanConnections() {
     join19(home, ".claude", "settings.json")
   );
   const hooksInstalled = hookSettings ? hasGreatArrowHooks(hookSettings) : false;
-  const entries = [];
+  const entries2 = [];
   for (const location of knownConfigLocations(home, process.cwd())) {
     const content = await readIfExists(location.path);
     if (content === null) continue;
-    entries.push(
+    entries2.push(
       ...findGreatArrowEntries(location, content, { hooksInstalled })
     );
   }
-  return entries;
+  return entries2;
 }
 async function probeEndpoint() {
   try {
@@ -17739,8 +18015,8 @@ var doctorSubcommand = new Command("doctor").description(
     const home = homedir12();
     const proxyPath = await resolveProxyScript(options.proxy);
     const diagnostics = proxyPath ? await runProxyDiagnostics(proxyPath) : null;
-    const entries = await scanConnections();
-    const duplicates = detectDuplicates(entries);
+    const entries2 = await scanConnections();
+    const duplicates = detectDuplicates(entries2);
     const credentialFile = await readIfExists(
       join19(home, ".great-arrow", "credential")
     );
@@ -17763,7 +18039,7 @@ var doctorSubcommand = new Command("doctor").description(
       }),
       await probeEndpoint()
     ];
-    if (entries.length === 0) {
+    if (entries2.length === 0) {
       findings.push({
         code: "no_connections",
         level: "warn",
@@ -17788,14 +18064,14 @@ var doctorSubcommand = new Command("doctor").description(
       now: Date.now()
     });
     const applied = options.migrate ? await applyMigration(plan) : [];
-    const guidance = connectorGuidance(entries);
+    const guidance = connectorGuidance(entries2);
     if (jsonFlag) {
       process.stdout.write(
         JSON.stringify(
           {
             proxyPath,
             diagnostics,
-            entries,
+            entries: entries2,
             duplicates,
             findings,
             migration: { plan, applied, migrated: Boolean(options.migrate) },
@@ -17808,10 +18084,10 @@ var doctorSubcommand = new Command("doctor").description(
     } else {
       process.stdout.write(`${c.dim("Connections")}
 `);
-      if (entries.length === 0) {
+      if (entries2.length === 0) {
         process.stdout.write("  (none found)\n");
       }
-      for (const entry of entries) {
+      for (const entry of entries2) {
         process.stdout.write(`  ${entry.client}: ${describeEntry(entry)}
 `);
       }
@@ -20733,9 +21009,9 @@ function assertNever(_x) {
 }
 function assert(_) {
 }
-function getEnumValues(entries) {
-  const numericValues = Object.values(entries).filter((v) => typeof v === "number");
-  const values = Object.entries(entries).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
+function getEnumValues(entries2) {
+  const numericValues = Object.values(entries2).filter((v) => typeof v === "number");
+  const values = Object.entries(entries2).filter(([k, _]) => numericValues.indexOf(+k) === -1).map(([_, v]) => v);
   return values;
 }
 function joinValues(array3, separator = "|") {
@@ -22570,16 +22846,16 @@ var $ZodCheckProperties = /* @__PURE__ */ $constructor("$ZodCheckProperties", (i
   hide(inst, Symbol.iterator, function* () {
     yield inst;
   });
-  let entries;
+  let entries2;
   inst._zod.check = (payload) => {
     if (payload.value == null) {
       payload.issues.push({ expected: "object", code: "invalid_type", input: payload.value, inst });
       return void 0;
     }
-    entries ?? (entries = Reflect.ownKeys(def.shape).map((key) => [key, def.shape[key]]));
+    entries2 ?? (entries2 = Reflect.ownKeys(def.shape).map((key) => [key, def.shape[key]]));
     const input2 = payload.value;
     let proms;
-    for (const [key, schema] of entries) {
+    for (const [key, schema] of entries2) {
       const result = schema._zod.run({ value: input2[key], issues: [] }, {});
       if (result instanceof Promise) {
         proms ?? (proms = []);
@@ -35397,18 +35673,18 @@ function _set(Class2, valueType, params) {
 }
 // @__NO_SIDE_EFFECTS__
 function _enum(Class2, values, params) {
-  const entries = Array.isArray(values) ? Object.fromEntries(values.map((v) => [v, v])) : values;
+  const entries2 = Array.isArray(values) ? Object.fromEntries(values.map((v) => [v, v])) : values;
   return new Class2({
     type: "enum",
-    entries,
+    entries: entries2,
     ...normalizeParams(params)
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _nativeEnum(Class2, entries, params) {
+function _nativeEnum(Class2, entries2, params) {
   return new Class2({
     type: "enum",
-    entries,
+    entries: entries2,
     ...normalizeParams(params)
   });
 }
@@ -38391,17 +38667,17 @@ var ZodEnum = /* @__PURE__ */ $constructor("ZodEnum", (inst, def) => {
   };
 });
 function _enum2(values, params) {
-  const entries = Array.isArray(values) ? Object.fromEntries(values.map((v) => [v, v])) : values;
+  const entries2 = Array.isArray(values) ? Object.fromEntries(values.map((v) => [v, v])) : values;
   return new ZodEnum({
     type: "enum",
-    entries,
+    entries: entries2,
     ...util_exports.normalizeParams(params)
   });
 }
-function nativeEnum(entries, params) {
+function nativeEnum(entries2, params) {
   return new ZodEnum({
     type: "enum",
-    entries,
+    entries: entries2,
     ...util_exports.normalizeParams(params)
   });
 }
@@ -49178,11 +49454,11 @@ function firstString(...candidates) {
   }
   return void 0;
 }
-function collect(entries, read) {
-  if (!Array.isArray(entries)) return [];
+function collect(entries2, read) {
+  if (!Array.isArray(entries2)) return [];
   const out2 = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const entry of entries) {
+  for (const entry of entries2) {
     if (out2.length >= MAX_LOCAL_MODELS) break;
     if (!entry || typeof entry !== "object") continue;
     const { id, label, contextLength } = read(entry);
@@ -50050,98 +50326,6 @@ function renderStatus2(payload, plain, apiUrl) {
   process.stdout.write(brandedBlock("status", lines) + "\n");
 }
 
-// src/commands/open.ts
-import { execFile as execFile3 } from "node:child_process";
-var PLANE_NOTE = {
-  workspace: "follows your active workspace",
-  cross: "spans every workspace you belong to",
-  account: "your account, not a workspace"
-};
-function browserLaunchCommand(url2, platform2 = process.platform) {
-  let parsed;
-  try {
-    parsed = new URL(url2);
-  } catch {
-    return null;
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
-  if (platform2 === "darwin") return { file: "open", args: [url2] };
-  if (platform2 === "win32") return { file: "explorer.exe", args: [url2] };
-  return { file: "xdg-open", args: [url2] };
-}
-function openBrowser2(url2) {
-  const command = browserLaunchCommand(url2);
-  if (!command) return Promise.resolve(false);
-  return new Promise((resolve7) => {
-    execFile3(command.file, command.args, (error62) => resolve7(!error62));
-  });
-}
-function toSurfaceRow(value) {
-  if (typeof value !== "object" || value === null) return null;
-  const r = value;
-  if (typeof r.id !== "string" || typeof r.href !== "string") return null;
-  if (!r.href.startsWith("/") || r.href.startsWith("//")) return null;
-  const plane = r.plane === "workspace" || r.plane === "cross" || r.plane === "account" ? r.plane : "workspace";
-  return {
-    id: r.id,
-    label: typeof r.label === "string" ? r.label : r.id,
-    href: r.href,
-    plane,
-    group: typeof r.group === "string" ? r.group : ""
-  };
-}
-function surfaceUrl(apiUrl, href) {
-  return `${apiUrl.replace(/\/$/, "")}${href}`;
-}
-function openCommand() {
-  return new Command("open").description("Open an app surface in the browser (e.g. gad open library)").argument(
-    "<surface>",
-    "Surface id, path, label or keyword \u2014 e.g. library, /leads, 'Pitch page'"
-  ).option("--print", "Print the URL instead of opening a browser").option("--json", "Output the resolved surface as JSON").action(async (surface, options, command) => {
-    const g = globalOutputOpts(command);
-    const auth = await resolveAuth();
-    const client2 = new GadClient({
-      token: auth.token,
-      getToken: auth.getToken,
-      apiUrl: auth.apiUrl
-    });
-    const result = await client2.mcpCall("surfaces_list", {
-      query: surface
-    });
-    const match = toSurfaceRow(result?.match);
-    const candidates = (Array.isArray(result?.candidates) ? result.candidates : []).map(toSurfaceRow).filter((r) => r !== null);
-    if (!match) {
-      throw new CliError(
-        candidates.length === 0 ? `No app surface matches '${surface}'.` : `'${surface}' matches ${candidates.length} surfaces.`,
-        3 /* VALIDATION_ERROR */,
-        candidates.length === 0 ? "Run 'gad open --help', or ask an AI for surfaces_list to see every page." : `Did you mean: ${candidates.map((c2) => c2.id).join(", ")}?`
-      );
-    }
-    const url2 = surfaceUrl(auth.apiUrl, match.href);
-    if (g.json) {
-      process.stdout.write(JSON.stringify({ ...match, url: url2 }) + "\n");
-      return;
-    }
-    const c = createColor(g.noColor || g.quiet);
-    if (options.print) {
-      process.stdout.write(url2 + "\n");
-      return;
-    }
-    const opened = await openBrowser2(url2);
-    process.stdout.write(
-      `${match.label} ${c.dim(`(${PLANE_NOTE[match.plane]})`)}
-${c.cyan(url2)}
-`
-    );
-    if (!opened) {
-      process.stderr.write(
-        `${c.dim("Couldn't launch a browser \u2014 open the URL above.")}
-`
-      );
-    }
-  });
-}
-
 // src/commands/next.ts
 var PICKUP_LIMIT = 10;
 function pickupArgs(identityStatus) {
@@ -50334,7 +50518,7 @@ function callCommand() {
 // src/lib/runner/approval.ts
 import { createHash as createHash6 } from "node:crypto";
 import { chmod as chmod4, mkdir as mkdir9, readFile as readFile8, rename as rename3, writeFile as writeFile7 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { dirname as dirname9, join as join14 } from "node:path";
 
 // src/lib/runner/repo.ts
 import { chmod as chmod3, mkdir as mkdir8, realpath as realpath2, writeFile as writeFile6 } from "node:fs/promises";
@@ -50342,7 +50526,7 @@ import { homedir as homedir10 } from "node:os";
 import { isAbsolute as isAbsolute3, join as join13, relative, resolve as resolve5 } from "node:path";
 
 // src/lib/runner/git.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 var GIT_DEADLINE_MS = 12e4;
 var HOST_PATH = "/usr/bin:/bin:/usr/sbin:/sbin";
 var MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
@@ -50386,7 +50570,7 @@ function safeGitBytes(cwd, args, opts = {}) {
   return new Promise((resolve7) => {
     const failed = (stderr) => resolve7({ code: 1, stdout: Buffer.alloc(0), stderr });
     if (opts.signal?.aborted) return failed("aborted");
-    const child = spawn("git", argv, {
+    const child = spawn2("git", argv, {
       cwd,
       env: { ...gitEnv(), ...opts.env ?? {} },
       stdio: ["pipe", "pipe", "pipe"],
@@ -50464,11 +50648,12 @@ function worktreeGitBytes(layout, args, opts = {}) {
 }
 
 // src/lib/runner/text.ts
+var FORMAT = new RegExp("(?!\\u200d)\\p{Cf}", "gu");
 function cleanLine(text3) {
-  return text3.replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ").trim();
+  return text3.replace(FORMAT, "").replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ").trim();
 }
 function cleanText(text3) {
-  return text3.replace(/\r\n?/g, "\n").replace(/\t/g, "  ").replace(/[\u0000-\u0009\u000b-\u001f\u007f-\u009f]+/g, " ");
+  return text3.replace(FORMAT, "").replace(/\r\n?/g, "\n").replace(/\t/g, "  ").replace(/[\u0000-\u0009\u000b-\u001f\u007f-\u009f]+/g, " ");
 }
 var PREVIEW_LINES = 3;
 var PREVIEW_CHARS = 240;
@@ -50493,8 +50678,9 @@ function preview(text3) {
 }
 
 // src/lib/runner/sandbox.ts
+import { readdirSync } from "node:fs";
 import { lstat, readFile as readFile7, realpath } from "node:fs/promises";
-import { dirname as dirname8, join as join12, resolve as resolve4 } from "node:path";
+import { basename as basename2, dirname as dirname8, join as join12, resolve as resolve4 } from "node:path";
 var TASK_FILE = ".gad/task.md";
 var CLAUDE_ALLOWED_DOMAINS = [
   "api.anthropic.com",
@@ -50595,13 +50781,44 @@ var CLI_READ_HARDENING = [
   ".cargo/credentials.toml",
   ".terraform.d/credentials.tfrc.json"
 ];
-function approvalFile(layout) {
-  return join12(dirname8(dirname8(layout.worktree)), "approved.json");
+var CLI_ONLY_READ_HARDENING = ["Library/Keychains"];
+function runsDirOf(layout) {
+  return dirname8(dirname8(dirname8(layout.worktree)));
+}
+function approvalsDir(layout) {
+  return join12(dirname8(runsDirOf(layout)), "approvals");
+}
+function entries(dir) {
+  try {
+    return readdirSync(dir);
+  } catch {
+    return [];
+  }
+}
+var UUID5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function siblingPaths(layout) {
+  const wtDir = dirname8(layout.worktree);
+  const runDir = dirname8(wtDir);
+  const runsDir = dirname8(runDir);
+  if (basename2(wtDir) !== "wt" || !UUID5.test(basename2(runDir))) return [];
+  const others = (dir, keep) => entries(dir).map((name23) => join12(dir, name23)).filter((path10) => path10 !== keep);
+  return [
+    ...others(runsDir, runDir),
+    ...others(runDir, wtDir),
+    ...others(wtDir, layout.worktree)
+  ];
+}
+function cliOnlyDenyRead(layout) {
+  return [
+    ...CLI_ONLY_READ_HARDENING.map((rel) => join12(layout.home, rel)),
+    approvalsDir(layout),
+    ...siblingPaths(layout)
+  ];
 }
 function denyRead(layout) {
   return [
     ...CLI_READ_HARDENING.map((rel) => join12(layout.home, rel)),
-    approvalFile(layout)
+    ...cliOnlyDenyRead(layout)
   ];
 }
 var CREDENTIAL_SET = new Set(
@@ -50741,14 +50958,14 @@ function kickoff(runId, todoId) {
 }
 
 // src/lib/runner/repo.ts
-var UUID5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var UUID6 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var BRANCH_NAME = /^(?!-)(?!.*\.\.)[A-Za-z0-9._/-]+$/;
 var GITHUB_REMOTE = /^(?:https?:\/\/(?:[^@/]+@)?github\.com\/|ssh:\/\/git@github\.com(?::\d+)?\/|git@github\.com:)([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?\/?$/;
 function runsRoot() {
   return join13(homedir10(), ".gad", "runs");
 }
 function isRunId(id) {
-  return UUID5.test(id);
+  return UUID6.test(id);
 }
 var short = (id) => id.slice(0, 8);
 function runnerBranch(runId, todoId) {
@@ -50859,9 +51076,12 @@ function sha256(text3) {
   return createHash6("sha256").update(text3, "utf8").digest("hex");
 }
 var plainTitle = cleanLine;
+function approvalsDir2(runsDir) {
+  return join14(dirname9(runsDir), "approvals");
+}
 function approvedFile(runsDir, runId) {
   if (!isRunId(runId)) throw new Error("run id must be a UUID");
-  return join14(runsDir, runId, "approved.json");
+  return join14(approvalsDir2(runsDir), `${runId}.json`);
 }
 function approveShown(cards) {
   return new Map(
@@ -50873,9 +51093,8 @@ function approveShown(cards) {
 }
 async function saveApproved(runsDir, runId, approved) {
   const file2 = approvedFile(runsDir, runId);
-  const dir = join14(runsDir, runId);
+  const dir = approvalsDir2(runsDir);
   await mkdir9(dir, { recursive: true, mode: 448 });
-  await chmod4(runsDir, 448);
   await chmod4(dir, 448);
   const body = [...approved].map(([todoId, c]) => ({ todoId, ...c }));
   const tmp = `${file2}.tmp`;
@@ -50977,13 +51196,19 @@ async function workCard(deps, todoId, card) {
   if (ran.exit !== 0)
     return { outcome: "failed", detail: `agent_exit_${ran.exit ?? "signal"}` };
   const result = await deps.publish(prepared, todoId, card.title, deps.signal).catch(() => ({ failed: "publish_failed" }));
-  if (deps.signal.aborted) return { outcome: "stopped" };
+  const takeBack = (sha) => () => deps.unpublish(prepared, sha).catch(() => false);
+  if (deps.signal.aborted) {
+    if (typeof result === "object" && "pushed" in result)
+      await sayTakenBack(deps, prepared.branch, takeBack(result.pushed));
+    return { outcome: "stopped" };
+  }
   if (result === "no_changes") return { outcome: "no_changes" };
   if ("pushed" in result)
     return {
       outcome: "pushed",
       branch: prepared.branch,
-      headSha: result.pushed
+      headSha: result.pushed,
+      takeBack: takeBack(result.pushed)
     };
   return {
     outcome: "failed",
@@ -50993,6 +51218,12 @@ async function workCard(deps, todoId, card) {
     } : {}
   };
 }
+async function sayTakenBack(deps, branch, takeBack) {
+  if (!await takeBack())
+    deps.print(
+      `    Could not delete the pushed branch ${branch}; delete it on GitHub if you do not want it.`
+    );
+}
 function reportFields(o) {
   if (o.outcome === "pushed")
     return { outcome: o.outcome, branch: o.branch, head_sha: o.headSha };
@@ -51105,6 +51336,8 @@ async function runLoop(deps, input2) {
       if (!(error62 instanceof RunnerCallError && error62.code === "card_released"))
         throw error62;
       deps.print(`${label} \u2026 taken back on the board`);
+      if (outcome.outcome === "pushed")
+        await sayTakenBack(deps, outcome.branch, outcome.takeBack);
       continue;
     } finally {
       if (claimed) await release(deps, next.todoId);
@@ -51327,7 +51560,7 @@ import { join as join17 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 
 // src/lib/runner/agent.ts
-import { execFile as execFile4, spawn as spawn2 } from "node:child_process";
+import { execFile as execFile4, spawn as spawn3 } from "node:child_process";
 import { accessSync, chmodSync as chmodSync3, closeSync, constants as constants2, openSync } from "node:fs";
 import { delimiter, join as join15 } from "node:path";
 var KILL_GRACE_MS = 5e3;
@@ -51395,7 +51628,7 @@ async function runAgent(input2) {
   const env4 = { ...stripCredentialEnv(process.env), GIT_TERMINAL_PROMPT: "0" };
   let child;
   try {
-    child = spawn2(input2.bin, agentArgv(input2), {
+    child = spawn3(input2.bin, agentArgv(input2), {
       cwd: input2.layout.worktree,
       detached: true,
       stdio: ["ignore", fd, fd],
@@ -51466,7 +51699,7 @@ async function reapGroup(pgid, waitMs = REAP_WAIT_MS) {
 
 // src/lib/runner/holders.ts
 import { execFile as execFile5 } from "node:child_process";
-import { readdirSync, readlinkSync, statSync as statSync2 } from "node:fs";
+import { readdirSync as readdirSync2, readlinkSync, statSync as statSync2 } from "node:fs";
 var LSOF_DEADLINE_MS = 2e4;
 var CHECKS = 5;
 var PAUSE_MS = 250;
@@ -51579,15 +51812,15 @@ async function lsofUsers(root, uid, exec2 = run3) {
   return users;
 }
 var errno = (error62) => error62.code;
-function procUsers(root, uid, fs6 = { readdirSync, statSync: statSync2, readlinkSync }) {
-  let entries;
+function procUsers(root, uid, fs6 = { readdirSync: readdirSync2, statSync: statSync2, readlinkSync }) {
+  let entries2;
   try {
-    entries = fs6.readdirSync("/proc").filter((e) => /^\d+$/.test(e));
+    entries2 = fs6.readdirSync("/proc").filter((e) => /^\d+$/.test(e));
   } catch {
     return null;
   }
   const users = [];
-  for (const pid of entries) {
+  for (const pid of entries2) {
     try {
       if (fs6.statSync(`/proc/${pid}`).uid !== uid) continue;
     } catch (error62) {
@@ -52093,6 +52326,17 @@ async function publishBranch(layout, branch, base, message, signal, options = {}
     throw error62;
   }
 }
+async function unpublishBranch(layout, branch, sha) {
+  if (!RUNNER_BRANCH.test(branch) || !SHA.test(sha)) return false;
+  const push = await worktreeGit(layout, [
+    "push",
+    "--quiet",
+    `--force-with-lease=refs/heads/${branch}:${sha}`,
+    "origin",
+    `:refs/heads/${branch}`
+  ]);
+  return push.code === 0;
+}
 
 // src/commands/board-run.ts
 function parseData(result) {
@@ -52199,6 +52443,7 @@ var work = ({
       commitMessage(title, view.runId, todoId),
       signal
     ),
+    unpublish: (prepared, headSha2) => unpublishBranch(prepared, prepared.branch, headSha2),
     sleep: sleep2,
     note: (todoId, line) => {
       try {
@@ -52610,7 +52855,7 @@ import { createInterface as createInterface4 } from "node:readline";
 import { Writable } from "node:stream";
 
 // src/lib/keys-apply.ts
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 import {
   chmod as chmod6,
   mkdir as mkdir10,
@@ -52621,7 +52866,7 @@ import {
   writeFile as writeFile9
 } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
-import { basename as basename2, dirname as dirname9, isAbsolute as isAbsolute4, join as join18, relative as relative2, sep } from "node:path";
+import { basename as basename3, dirname as dirname10, isAbsolute as isAbsolute4, join as join18, relative as relative2, sep } from "node:path";
 var GH_APPLY_TIMEOUT_MS = 3e4;
 var GIT_APPLY_TIMEOUT_MS = 3e4;
 function runWithStdin(file2, args, input2, timeoutMs) {
@@ -52635,7 +52880,7 @@ function runWithStdin(file2, args, input2, timeoutMs) {
     };
     let child;
     try {
-      child = spawn3(file2, args, { stdio: ["pipe", "ignore", "ignore"] });
+      child = spawn4(file2, args, { stdio: ["pipe", "ignore", "ignore"] });
     } catch {
       resolve7("not_found");
       return;
@@ -52778,7 +53023,7 @@ async function applySshKey(path10, privatePem) {
   const content = privatePem.endsWith("\n") ? privatePem : `${privatePem}
 `;
   try {
-    await mkdir10(dirname9(file2), { recursive: true, mode: 448 });
+    await mkdir10(dirname10(file2), { recursive: true, mode: 448 });
     await writeAtomic(file2, content, 384);
   } catch {
     return { ok: false, code: "ssh_write_failed" };
@@ -52799,14 +53044,14 @@ var SSH_NOT_A_KEY = /* @__PURE__ */ new Set([
 async function sshTargetRefusal(path10, sshDir = join18(homedir11(), ".ssh")) {
   const file2 = expandHome(path10);
   if (!isAbsolute4(file2)) return { ok: false, code: "target_invalid" };
-  if (SSH_NOT_A_KEY.has(basename2(file2))) {
+  if (SSH_NOT_A_KEY.has(basename3(file2))) {
     return { ok: false, code: "target_not_a_key" };
   }
   let root;
   let parent;
   try {
     root = await realpath3(sshDir);
-    parent = await realpath3(dirname9(file2));
+    parent = await realpath3(dirname10(file2));
   } catch {
     return { ok: false, code: "target_outside_ssh_dir" };
   }
@@ -52953,111 +53198,6 @@ function openFromServer(sealed, devicePrivateKeyB64) {
   }
 }
 
-// src/lib/keys-handoff.ts
-import { spawn as spawn4 } from "node:child_process";
-
-// src/lib/keys-paths.ts
-function keyRotationPath() {
-  return "/settings/key-rotation";
-}
-function keyRotationRunPath(runId) {
-  return `/settings/key-rotation/runs/${encodeURIComponent(runId)}`;
-}
-function keyRotationHandoffPath(jti) {
-  return `/settings/key-rotation/handoff/${encodeURIComponent(jti)}`;
-}
-
-// src/lib/keys-handoff.ts
-var HANDOFF_POLL_INTERVAL_MS = 2e3;
-var HANDOFF_DEADLINE_MS = 5 * 6e4;
-var BROWSER_LAUNCH_TIMEOUT_MS = 5e3;
-function openInBrowser(url2) {
-  const command = browserLaunchCommand(url2);
-  if (!command) return Promise.resolve(false);
-  return new Promise((resolve7) => {
-    let settled = false;
-    const done = (ok2) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve7(ok2);
-    };
-    const timer = setTimeout(() => done(false), BROWSER_LAUNCH_TIMEOUT_MS);
-    timer.unref?.();
-    try {
-      const child = spawn4(command.file, command.args, {
-        detached: true,
-        stdio: "ignore"
-      });
-      child.once("error", () => done(false));
-      child.once("spawn", () => {
-        child.unref();
-        done(true);
-      });
-    } catch {
-      done(false);
-    }
-  });
-}
-var defaultSleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
-function stepUpError(message, hint) {
-  return new CliError(message, 1 /* AUTH_ERROR */, hint);
-}
-async function requestBrowserStepUp(client2, kind, subjectId, opts = {}) {
-  const openUrl = opts.openUrl ?? openInBrowser;
-  const notify = opts.notify ?? ((line) => process.stderr.write(`${line}
-`));
-  const sleep3 = opts.sleep ?? defaultSleep;
-  const now = opts.now ?? Date.now;
-  const interval = opts.pollIntervalMs ?? HANDOFF_POLL_INTERVAL_MS;
-  const deadline = now() + (opts.deadlineMs ?? HANDOFF_DEADLINE_MS);
-  const created = await client2.post("/api/key-rotation/handoffs", {
-    kind,
-    subjectId
-  });
-  const jti = typeof created?.jti === "string" ? created.jti : null;
-  if (!jti || !/^[A-Za-z0-9-]{1,64}$/.test(jti)) {
-    throw stepUpError("The server did not return a browser approval.");
-  }
-  const url2 = `${client2.apiOrigin}${keyRotationHandoffPath(jti)}`;
-  notify(`Approve this in your browser (passkey or two-step code): ${url2}`);
-  if (!await openUrl(url2)) {
-    notify("Couldn't launch a browser. Open the URL above to approve.");
-  }
-  while (now() < deadline) {
-    const polled = await client2.get(
-      `/api/key-rotation/handoffs/${encodeURIComponent(jti)}`
-    );
-    const status = polled?.status;
-    if (status === "approved") {
-      if (typeof polled.token === "string" && polled.token.length > 0) {
-        return polled.token;
-      }
-      throw stepUpError(
-        "This approval was already collected by another request.",
-        "Run the command again to request a new approval."
-      );
-    }
-    if (status === "consumed") {
-      throw stepUpError(
-        "This approval was already used.",
-        "Run the command again to request a new approval."
-      );
-    }
-    if (status === "expired") {
-      throw stepUpError(
-        "The browser approval expired.",
-        "Run the command again and approve within 5 minutes."
-      );
-    }
-    await sleep3(interval);
-  }
-  throw stepUpError(
-    "Timed out waiting for the browser approval.",
-    "Run the command again and approve within 5 minutes."
-  );
-}
-
 // src/lib/keys-device.ts
 var DEFAULT_ENV_FILE = ".env.local";
 var DETECT_TIMEOUT_MS = 5e3;
@@ -53066,7 +53206,7 @@ var REPORT_KEY = /^[A-Z_][A-Z0-9_]{0,127}$/;
 var REPORT_PATH = /^[ -~]{1,200}$/;
 var TOKEN_SHAPED = /[A-Za-z0-9]{33,}/;
 var SECRET_PREFIX = /(gh[pousr]_|github_pat_|-----BEGIN)/;
-var UUID6 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID7 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function deviceSlot(workspaceId) {
   return `key-rotation-device:${workspaceId}`;
 }
@@ -53244,7 +53384,7 @@ async function enroll(client2, workspaceId, opts = {}) {
     publicKey: pair.publicKey,
     report
   });
-  const enrollmentId = typeof begun?.enrollmentId === "string" && UUID6.test(begun.enrollmentId) ? begun.enrollmentId : null;
+  const enrollmentId = typeof begun?.enrollmentId === "string" && UUID7.test(begun.enrollmentId) ? begun.enrollmentId : null;
   if (!enrollmentId) {
     throw new CliError(
       "The server did not start the enrollment.",
@@ -53262,7 +53402,7 @@ async function enroll(client2, workspaceId, opts = {}) {
     action: "enroll",
     approvalToken
   });
-  const deviceId = typeof done?.deviceId === "string" && UUID6.test(done.deviceId) ? done.deviceId : null;
+  const deviceId = typeof done?.deviceId === "string" && UUID7.test(done.deviceId) ? done.deviceId : null;
   if (!deviceId) {
     throw new CliError(
       "The server did not complete the enrollment.",
@@ -53291,7 +53431,7 @@ async function enroll(client2, workspaceId, opts = {}) {
 }
 
 // src/commands/keys.ts
-var UUID7 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID8 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function patRequired(apiUrl) {
   return authError(
     "gad keys needs a personal access token; this sign-in is an OAuth session.",
@@ -53344,7 +53484,7 @@ async function keysContext() {
   });
   const value = await probe.mcpCall("workspace_introspect", {}, 5e3);
   const workspaceId = value?.workspace?.id;
-  if (value?.error || !workspaceId || !UUID7.test(workspaceId)) {
+  if (value?.error || !workspaceId || !UUID8.test(workspaceId)) {
     throw validationError(
       "GreatArrow.ai could not confirm your workspace.",
       "Run 'gad whoami', or choose one with 'gad --workspace <id>'."
@@ -53365,7 +53505,7 @@ async function keysContext() {
   };
 }
 function requireRunId(runId) {
-  if (!UUID7.test(runId)) {
+  if (!UUID8.test(runId)) {
     throw validationError(
       `'${stripControlChars(runId)}' is not a run id.`,
       "Copy the run id from 'gad keys list' or the run page."
@@ -53494,7 +53634,7 @@ function enrollCommand() {
 function toUpdateRow(v) {
   if (typeof v !== "object" || v === null) return null;
   const r = v;
-  if (typeof r.id !== "string" || !UUID7.test(r.id)) return null;
+  if (typeof r.id !== "string" || !UUID8.test(r.id)) return null;
   const ref = {};
   if (typeof r.targetRef === "object" && r.targetRef !== null) {
     for (const [k, val] of Object.entries(r.targetRef)) {
@@ -54381,14 +54521,14 @@ var Temp = {
     }
   },
   truncate: (filePath) => {
-    const basename3 = path3.basename(filePath);
-    if (basename3.length <= LIMIT_BASENAME_LENGTH)
+    const basename4 = path3.basename(filePath);
+    if (basename4.length <= LIMIT_BASENAME_LENGTH)
       return filePath;
-    const truncable = /^(\.?)(.*?)((?:\.[^.]+)?(?:\.tmp-\d{10}[a-f0-9]{6})?)$/.exec(basename3);
+    const truncable = /^(\.?)(.*?)((?:\.[^.]+)?(?:\.tmp-\d{10}[a-f0-9]{6})?)$/.exec(basename4);
     if (!truncable)
       return filePath;
-    const truncationLength = basename3.length - LIMIT_BASENAME_LENGTH;
-    return `${filePath.slice(0, -basename3.length)}${truncable[1]}${truncable[2].slice(0, -truncationLength)}${truncable[3]}`;
+    const truncationLength = basename4.length - LIMIT_BASENAME_LENGTH;
+    return `${filePath.slice(0, -basename4.length)}${truncable[1]}${truncable[2].slice(0, -truncationLength)}${truncable[3]}`;
   }
 };
 node_default(Temp.purgeSyncAll);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.9.3",
+  "version": "0.9.6",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {