@muggleai/works 5.11.1 → 5.12.0-staging.74

package/dist/{chunk-MSPMXBO5.js → chunk-DJ6W5PZA.js}

@@ -1,16 +1,16 @@
-import * as crypto from 'crypto';
-import { randomUUID } from 'crypto';
-import * as fs5 from 'fs';
+import * as fs6 from 'fs';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
-import * as path10 from 'path';
+import * as path11 from 'path';
 import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+import * as crypto from 'crypto';
+import { randomUUID } from 'crypto';
 import * as os4 from 'os';
 import { platform } from 'os';
 import winston from 'winston';
-import { fileURLToPath } from 'url';
 import { exec, spawn } from 'child_process';
 import axios, { AxiosError } from 'axios';
-import * as fs9 from 'fs/promises';
+import * as fs10 from 'fs/promises';
 import AppInsights from 'applicationinsights';
 import { z } from 'zod';
 
@@ -30,6 +30,7 @@ var __export = (target, all) => {
 var src_exports = {};
 __export(src_exports, {
   DEFAULT_PREFERENCES: () => DEFAULT_PREFERENCES,
+  ElectronAppReleaseStream: () => ElectronAppReleaseStream,
   PREFERENCES_FILE_NAME: () => PREFERENCES_FILE_NAME,
   PREFERENCES_PROJECT_DIR_NAME: () => PREFERENCES_PROJECT_DIR_NAME,
   PREFERENCES_SCHEMA: () => PREFERENCES_SCHEMA,
@@ -38,8 +39,10 @@ __export(src_exports, {
   PreferenceKey: () => PreferenceKey,
   PreferenceValue: () => PreferenceValue,
   ProjectPreferencesReconcileOutcome: () => ProjectPreferencesReconcileOutcome,
+  RuntimeTarget: () => RuntimeTarget,
   WATCHER_LIFETIME_SECONDS: () => WATCHER_LIFETIME_SECONDS,
   WATCHER_LIFETIME_UNBOUNDED_SECONDS: () => WATCHER_LIFETIME_UNBOUNDED_SECONDS,
+  assertDeviceCodeClientProvisioned: () => assertDeviceCodeClientProvisioned,
   buildElectronAppChecksumsUrl: () => buildElectronAppChecksumsUrl,
   buildElectronAppReleaseAssetUrl: () => buildElectronAppReleaseAssetUrl,
   buildElectronAppReleaseTag: () => buildElectronAppReleaseTag,
@@ -50,6 +53,8 @@ __export(src_exports, {
   deleteCredentials: () => deleteCredentials,
   e2e: () => e2e_exports2,
   formatPreferencesOneLiner: () => formatPreferencesOneLiner,
+  getActiveElectronAppReleaseStream: () => getActiveElectronAppReleaseStream,
+  getActiveRuntimeTarget: () => getActiveRuntimeTarget,
   getApiKey: () => getApiKey,
   getApiKeyFilePath: () => getApiKeyFilePath,
   getAuthService: () => getAuthService,
@@ -63,12 +68,15 @@ __export(src_exports, {
   getDownloadBaseUrl: () => getDownloadBaseUrl,
   getElectronAppChecksums: () => getElectronAppChecksums,
   getElectronAppDir: () => getElectronAppDir,
+  getElectronAppReleaseTagPrefix: () => getElectronAppReleaseTagPrefix,
+  getElectronAppSignedFromVersion: () => getElectronAppSignedFromVersion,
   getElectronAppVersion: () => getElectronAppVersion,
   getElectronAppVersionSource: () => getElectronAppVersionSource,
   getLocalQaTools: () => getLocalQaTools,
   getLogger: () => getLogger,
   getPlatformKey: () => getPlatformKey,
   getQaTools: () => getQaTools,
+  getReleaseSignerIdentityUri: () => getReleaseSignerIdentityUri,
   getValidApiKeyData: () => getValidApiKeyData,
   getValidCredentials: () => getValidCredentials,
   hasApiKey: () => hasApiKey,
@@ -87,8 +95,12 @@ __export(src_exports, {
   resetConfig: () => resetConfig,
   resetLogger: () => resetLogger,
   resetPreference: () => resetPreference,
+  resolveActiveProfile: () => resolveActiveProfile,
+  resolveActiveReleaseStream: () => resolveActiveReleaseStream,
+  resolveActiveReleaseTagPrefix: () => resolveActiveReleaseTagPrefix,
   resolveElectronAppPathOrNull: () => resolveElectronAppPathOrNull,
   resolvePreferences: () => resolvePreferences,
+  resolveRuntimeTarget: () => resolveRuntimeTarget,
   saveApiKey: () => saveApiKey,
   saveApiKeyData: () => saveApiKeyData,
   saveCredentials: () => saveCredentials,
@@ -98,9 +110,121 @@ __export(src_exports, {
   verifyFileChecksum: () => verifyFileChecksum,
   writePreferences: () => writePreferences2
 });
+
+// packages/mcps/src/shared/runtime-target-types.ts
+var RuntimeTarget = /* @__PURE__ */ ((RuntimeTarget2) => {
+  RuntimeTarget2["Production"] = "production";
+  RuntimeTarget2["Staging"] = "staging";
+  RuntimeTarget2["Dev"] = "dev";
+  return RuntimeTarget2;
+})(RuntimeTarget || {});
+var ElectronAppReleaseStream = /* @__PURE__ */ ((ElectronAppReleaseStream3) => {
+  ElectronAppReleaseStream3["Production"] = "production";
+  ElectronAppReleaseStream3["Staging"] = "staging";
+  return ElectronAppReleaseStream3;
+})(ElectronAppReleaseStream || {});
+var DEFAULT_AUTH0_SCOPE = "openid profile email offline_access";
+var DEFAULT_WEB_SERVICE_URL = "http://localhost:3001";
+var RUNTIME_TARGET_ENV_VAR = "MUGGLE_MCP_PROMPT_SERVICE_TARGET";
+var RUNTIME_TARGETS_FILE = path11.join("config", "runtime-targets.json");
+function getPackageRoot() {
+  const currentDir = path11.dirname(fileURLToPath(import.meta.url));
+  if (currentDir.includes(path11.join("dist", "shared"))) {
+    return path11.resolve(currentDir, "..", "..");
+  }
+  if (currentDir.endsWith("dist")) {
+    return path11.resolve(currentDir, "..");
+  }
+  if (currentDir.includes(path11.join("src", "shared"))) {
+    return path11.resolve(currentDir, "..", "..", "..", "..");
+  }
+  return path11.dirname(currentDir);
+}
+var runtimeTargetDataCache = null;
+function getRuntimeTargetData() {
+  if (runtimeTargetDataCache) {
+    return runtimeTargetDataCache;
+  }
+  const profilesPath = path11.join(getPackageRoot(), RUNTIME_TARGETS_FILE);
+  let parsedData;
+  try {
+    parsedData = JSON.parse(fs6.readFileSync(profilesPath, "utf-8"));
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `Failed to read runtime target profiles.
+  Path: ${profilesPath}
+  Error: ${errorMessage}
+  This is a bug - please report it.`,
+      { cause: error }
+    );
+  }
+  for (const target of Object.values(RuntimeTarget)) {
+    if (!parsedData.targets?.[target]) {
+      throw new Error(
+        `Missing runtime target '${target}' in profile data.
+  Path: ${profilesPath}
+  This is a bug - please report it.`
+      );
+    }
+  }
+  for (const stream of Object.values(ElectronAppReleaseStream)) {
+    if (!parsedData.streams?.[stream]) {
+      throw new Error(
+        `Missing electron-app release stream '${stream}' in profile data.
+  Path: ${profilesPath}
+  This is a bug - please report it.`
+      );
+    }
+  }
+  runtimeTargetDataCache = parsedData;
+  return runtimeTargetDataCache;
+}
+function getRuntimeTargetProfiles() {
+  return getRuntimeTargetData().targets;
+}
+function getElectronAppReleaseStreams() {
+  return getRuntimeTargetData().streams;
+}
+
+// packages/mcps/src/shared/runtime-target.ts
+var KNOWN_RUNTIME_TARGETS = [
+  "production" /* Production */,
+  "staging" /* Staging */,
+  "dev" /* Dev */
+];
+function resolveRuntimeTarget(bakedDefault) {
+  const overrideValue = process.env[RUNTIME_TARGET_ENV_VAR];
+  if (overrideValue) {
+    const matchedTarget = KNOWN_RUNTIME_TARGETS.find((target) => target === overrideValue);
+    if (!matchedTarget) {
+      throw new Error(
+        `Invalid ${RUNTIME_TARGET_ENV_VAR} value: '${overrideValue}'. Expected one of: ${KNOWN_RUNTIME_TARGETS.join(", ")}.`
+      );
+    }
+    return matchedTarget;
+  }
+  return bakedDefault ?? "dev" /* Dev */;
+}
+function resolveActiveProfile(bakedDefault) {
+  return getRuntimeTargetProfiles()[resolveRuntimeTarget(bakedDefault)];
+}
+function resolveActiveReleaseStream(bakedDefault) {
+  return resolveActiveProfile(bakedDefault).electronAppReleaseStream;
+}
+function resolveActiveReleaseTagPrefix(bakedDefault) {
+  return getElectronAppReleaseStreams()[resolveActiveReleaseStream(bakedDefault)].electronAppReleaseTagPrefix;
+}
+function assertDeviceCodeClientProvisioned(target) {
+  if (getRuntimeTargetProfiles()[target].auth0ClientId === "") {
+    throw new Error(
+      `Runtime target '${target}' has no Auth0 device code client provisioned. Provision a native application with the device code grant in that tenant, then record its client ID in RUNTIME_TARGET_PROFILES.`
+    );
+  }
+}
 var DATA_DIR_NAME = ".muggle-ai";
 function getDataDir() {
-  return path10.join(os4.homedir(), DATA_DIR_NAME);
+  return path11.join(os4.homedir(), DATA_DIR_NAME);
 }
 var DEV_MANIFEST = {
   release: "dev",
@@ -147,44 +271,34 @@ function readReleaseManifest() {
 }
 
 // packages/mcps/src/shared/config.ts
-var DEFAULT_PROMPT_SERVICE_PRODUCTION_URL = "https://promptservice.muggle-ai.com";
-var DEFAULT_PROMPT_SERVICE_DEV_URL = "http://localhost:5050";
-var DEFAULT_WEB_SERVICE_URL = "http://localhost:3001";
 var ELECTRON_APP_DIR = "electron-app";
-var ELECTRON_APP_RELEASE_TAG_PREFIX = "electron-app-v";
 var API_KEY_FILE = "api-key.json";
-var DEFAULT_AUTH0_PRODUCTION_DOMAIN = "login.muggle-ai.com";
-var DEFAULT_AUTH0_PRODUCTION_CLIENT_ID = "UgG5UjoyLksxMciWWKqVpwfWrJ4rFvtT";
-var DEFAULT_AUTH0_PRODUCTION_AUDIENCE = "https://muggleai.us.auth0.com/api/v2/";
-var DEFAULT_AUTH0_DEV_DOMAIN = "dev-po4mxmz0rd8a0w8w.us.auth0.com";
-var DEFAULT_AUTH0_DEV_CLIENT_ID = "GBvkMdTbCI80XJXnJ90MmbEvXwcWGUtw";
-var DEFAULT_AUTH0_DEV_AUDIENCE = "https://dev-po4mxmz0rd8a0w8w.us.auth0.com/api/v2/";
-var DEFAULT_AUTH0_SCOPE = "openid profile email offline_access";
+var OAUTH_SESSION_FILE = "oauth-session.json";
 var configInstance = null;
 var muggleConfigCache = null;
-function getPackageRoot() {
+function getPackageRoot2() {
   const currentFilePath = fileURLToPath(import.meta.url);
-  const currentDir = path10.dirname(currentFilePath);
-  if (currentDir.includes(path10.join("dist", "shared"))) {
-    return path10.resolve(currentDir, "..", "..");
+  const currentDir = path11.dirname(currentFilePath);
+  if (currentDir.includes(path11.join("dist", "shared"))) {
+    return path11.resolve(currentDir, "..", "..");
   }
   if (currentDir.endsWith("dist")) {
-    return path10.resolve(currentDir, "..");
+    return path11.resolve(currentDir, "..");
   }
-  if (currentDir.includes(path10.join("src", "shared"))) {
-    return path10.resolve(currentDir, "..", "..");
+  if (currentDir.includes(path11.join("src", "shared"))) {
+    return path11.resolve(currentDir, "..", "..", "..", "..");
   }
-  return path10.dirname(currentDir);
+  return path11.dirname(currentDir);
 }
 function getMuggleConfig() {
   if (muggleConfigCache) {
     return muggleConfigCache;
   }
-  const packageRoot = getPackageRoot();
-  const packageJsonPath = path10.join(packageRoot, "package.json");
+  const packageRoot = getPackageRoot2();
+  const packageJsonPath = path11.join(packageRoot, "package.json");
   let packageJson;
   try {
-    const content = fs5.readFileSync(packageJsonPath, "utf-8");
+    const content = fs6.readFileSync(packageJsonPath, "utf-8");
     packageJson = JSON.parse(content);
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
@@ -221,45 +335,65 @@ function getMuggleConfig() {
   This is a bug - please report it.`
     );
   }
-  if (config.runtimeTargetDefault !== void 0 && config.runtimeTargetDefault !== "production" && config.runtimeTargetDefault !== "dev") {
+  const runtimeTargetDefault = config.runtimeTargetDefault;
+  if (runtimeTargetDefault !== void 0 && !Object.values(RuntimeTarget).includes(runtimeTargetDefault)) {
     throw new Error(
       `Invalid muggleConfig.runtimeTargetDefault in package.json.
   Path: ${packageJsonPath}
   Value: ${JSON.stringify(config.runtimeTargetDefault)}
-  Expected: "production" or "dev"
+  Expected one of: ${Object.values(RuntimeTarget).join(", ")}
   This is a bug - please report it.`
     );
   }
   muggleConfigCache = {
     electronAppVersion: config.electronAppVersion,
     downloadBaseUrl: config.downloadBaseUrl,
-    checksums: config.checksums || {},
-    runtimeTargetDefault: config.runtimeTargetDefault
+    checksumsByStream: config.checksumsByStream || {},
+    runtimeTargetDefault
   };
   return muggleConfigCache;
 }
 function getDataDir2() {
   return getDataDir();
 }
+function buildElectronAppDirName(params) {
+  if (params.releaseStream === "production" /* Production */) {
+    return params.version;
+  }
+  return `${params.version}-${params.releaseStream}`;
+}
+function buildOAuthSessionFileName(params) {
+  if (params.runtimeTarget === "production" /* Production */) {
+    return OAUTH_SESSION_FILE;
+  }
+  return `oauth-session-${params.runtimeTarget}.json`;
+}
 function getDownloadedElectronAppPath() {
   const platformName = os4.platform();
   const version = getElectronAppVersion();
-  const baseDir = path10.join(getDataDir2(), ELECTRON_APP_DIR, version);
+  const baseDir = path11.join(
+    getDataDir2(),
+    ELECTRON_APP_DIR,
+    buildElectronAppDirName({
+      version,
+      releaseStream: getActiveElectronAppReleaseStream()
+    })
+  );
   let binaryPath;
   switch (platformName) {
     case "darwin":
-      binaryPath = path10.join(baseDir, "MuggleAI.app", "Contents", "MacOS", "MuggleAI");
+      binaryPath = path11.join(baseDir, "MuggleAI.app", "Contents", "MacOS", "MuggleAI");
       break;
     case "win32":
-      binaryPath = path10.join(baseDir, "MuggleAI.exe");
+      binaryPath = path11.join(baseDir, "MuggleAI.exe");
       break;
     case "linux":
-      binaryPath = path10.join(baseDir, "MuggleAI");
+      binaryPath = path11.join(baseDir, "MuggleAI");
       break;
     default:
       return null;
   }
-  if (fs5.existsSync(binaryPath)) {
+  if (fs6.existsSync(binaryPath)) {
     return binaryPath;
   }
   return null;
@@ -270,25 +404,25 @@ function getSystemElectronAppPath() {
   let binaryPath;
   switch (platformName) {
     case "darwin":
-      binaryPath = path10.join(homeDir, "Applications", "MuggleAI.app", "Contents", "MacOS", "MuggleAI");
+      binaryPath = path11.join(homeDir, "Applications", "MuggleAI.app", "Contents", "MacOS", "MuggleAI");
       break;
     case "win32":
-      binaryPath = path10.join(homeDir, "AppData", "Local", "Programs", "MuggleAI", "MuggleAI.exe");
+      binaryPath = path11.join(homeDir, "AppData", "Local", "Programs", "MuggleAI", "MuggleAI.exe");
       break;
     case "linux":
-      binaryPath = path10.join(homeDir, ".local", "share", "muggle-ai", "MuggleAI");
+      binaryPath = path11.join(homeDir, ".local", "share", "muggle-ai", "MuggleAI");
       break;
     default:
       return null;
   }
-  if (fs5.existsSync(binaryPath)) {
+  if (fs6.existsSync(binaryPath)) {
     return binaryPath;
   }
   return null;
 }
 function resolveElectronAppPathOrNull() {
   const customPath = process.env.ELECTRON_APP_PATH;
-  if (customPath && fs5.existsSync(customPath)) {
+  if (customPath && fs6.existsSync(customPath)) {
     return customPath;
   }
   const downloadedPath = getDownloadedElectronAppPath();
@@ -303,12 +437,12 @@ function resolveElectronAppPathOrNull() {
 }
 function resolveWebServicePath() {
   const customPath = process.env.WEB_SERVICE_PATH;
-  if (customPath && fs5.existsSync(customPath)) {
+  if (customPath && fs6.existsSync(customPath)) {
     return customPath;
   }
-  const packageRoot = getPackageRoot();
-  const siblingPath = path10.resolve(packageRoot, "..", "web-service", "dist", "src", "index.js");
-  if (fs5.existsSync(siblingPath)) {
+  const packageRoot = getPackageRoot2();
+  const siblingPath = path11.resolve(packageRoot, "..", "web-service", "dist", "src", "index.js");
+  if (fs6.existsSync(siblingPath)) {
     return siblingPath;
   }
   return null;
@@ -320,65 +454,24 @@ function parseInteger(value, defaultValue) {
   const parsed = parseInt(value, 10);
   return isNaN(parsed) ? defaultValue : parsed;
 }
-function getPromptServiceRuntimeTarget() {
-  const runtimeTargetFromEnv = process.env.MUGGLE_MCP_PROMPT_SERVICE_TARGET;
-  if (runtimeTargetFromEnv) {
-    if (runtimeTargetFromEnv === "production" || runtimeTargetFromEnv === "dev") {
-      return runtimeTargetFromEnv;
-    }
-    throw new Error(
-      `Invalid MUGGLE_MCP_PROMPT_SERVICE_TARGET value: '${runtimeTargetFromEnv}'. Expected 'production' or 'dev'.`
-    );
-  }
-  const muggleConfig = getMuggleConfig();
-  if (muggleConfig.runtimeTargetDefault) {
-    return muggleConfig.runtimeTargetDefault;
-  }
-  return "dev";
-}
-function getDefaultPromptServiceUrl() {
-  const runtimeTarget = getPromptServiceRuntimeTarget();
-  if (runtimeTarget === "dev") {
-    return DEFAULT_PROMPT_SERVICE_DEV_URL;
-  }
-  return DEFAULT_PROMPT_SERVICE_PRODUCTION_URL;
+function getActiveRuntimeTarget() {
+  return resolveRuntimeTarget(getMuggleConfig().runtimeTargetDefault);
 }
-function getDefaultAuth0Domain() {
-  const runtimeTarget = getPromptServiceRuntimeTarget();
-  if (runtimeTarget === "dev") {
-    return DEFAULT_AUTH0_DEV_DOMAIN;
-  }
-  return DEFAULT_AUTH0_PRODUCTION_DOMAIN;
-}
-function getDefaultAuth0ClientId() {
-  const runtimeTarget = getPromptServiceRuntimeTarget();
-  if (runtimeTarget === "production") {
-    return DEFAULT_AUTH0_PRODUCTION_CLIENT_ID;
-  }
-  return DEFAULT_AUTH0_DEV_CLIENT_ID;
-}
-function getDefaultAuth0Audience() {
-  const runtimeTarget = getPromptServiceRuntimeTarget();
-  if (runtimeTarget === "dev") {
-    return DEFAULT_AUTH0_DEV_AUDIENCE;
-  }
-  return DEFAULT_AUTH0_PRODUCTION_AUDIENCE;
+function getActiveProfile() {
+  return resolveActiveProfile(getMuggleConfig().runtimeTargetDefault);
 }
 function buildAuth0Config() {
-  const defaultAuth0Domain = getDefaultAuth0Domain();
-  const defaultAuth0ClientId = getDefaultAuth0ClientId();
-  const defaultAuth0Audience = getDefaultAuth0Audience();
+  const activeProfile = getActiveProfile();
   return {
-    domain: process.env.AUTH0_DOMAIN ?? defaultAuth0Domain,
-    clientId: process.env.AUTH0_CLIENT_ID ?? defaultAuth0ClientId,
-    audience: process.env.AUTH0_AUDIENCE ?? defaultAuth0Audience,
+    domain: process.env.AUTH0_DOMAIN ?? activeProfile.auth0Domain,
+    clientId: process.env.AUTH0_CLIENT_ID ?? activeProfile.auth0ClientId,
+    audience: process.env.AUTH0_AUDIENCE ?? activeProfile.auth0Audience,
     scope: process.env.AUTH0_SCOPE ?? DEFAULT_AUTH0_SCOPE
   };
 }
 function buildE2eConfig() {
-  const defaultPromptServiceUrl = getDefaultPromptServiceUrl();
   return {
-    promptServiceBaseUrl: process.env.PROMPT_SERVICE_BASE_URL ?? defaultPromptServiceUrl,
+    promptServiceBaseUrl: process.env.PROMPT_SERVICE_BASE_URL ?? getActiveProfile().promptServiceBaseUrl,
     requestTimeoutMs: parseInteger(process.env.REQUEST_TIMEOUT_MS, 3e4),
     workflowTimeoutMs: parseInteger(process.env.WORKFLOW_TIMEOUT_MS, 12e4)
   };
@@ -386,25 +479,25 @@ function buildE2eConfig() {
 function buildLocalQaConfig() {
   const dataDir = getDataDir2();
   const auth0Scopes = (process.env.AUTH0_SCOPE ?? DEFAULT_AUTH0_SCOPE).split(" ");
-  const defaultPromptServiceUrl = getDefaultPromptServiceUrl();
-  const defaultAuth0Domain = getDefaultAuth0Domain();
-  const defaultAuth0ClientId = getDefaultAuth0ClientId();
-  const defaultAuth0Audience = getDefaultAuth0Audience();
+  const activeProfile = getActiveProfile();
   return {
     webServiceUrl: process.env.WEB_SERVICE_URL ?? DEFAULT_WEB_SERVICE_URL,
-    promptServiceUrl: process.env.PROMPT_SERVICE_BASE_URL ?? defaultPromptServiceUrl,
+    promptServiceUrl: process.env.PROMPT_SERVICE_BASE_URL ?? activeProfile.promptServiceBaseUrl,
     dataDir,
-    sessionsDir: path10.join(dataDir, "sessions"),
-    projectsDir: path10.join(dataDir, "projects"),
-    tempDir: path10.join(dataDir, "temp"),
-    apiKeyFilePath: path10.join(dataDir, API_KEY_FILE),
-    oauthSessionFilePath: path10.join(dataDir, "oauth-session.json"),
+    sessionsDir: path11.join(dataDir, "sessions"),
+    projectsDir: path11.join(dataDir, "projects"),
+    tempDir: path11.join(dataDir, "temp"),
+    apiKeyFilePath: path11.join(dataDir, API_KEY_FILE),
+    oauthSessionFilePath: path11.join(
+      dataDir,
+      buildOAuthSessionFileName({ runtimeTarget: getActiveRuntimeTarget() })
+    ),
     webServicePath: resolveWebServicePath(),
-    webServicePidFile: path10.join(dataDir, "web-service.pid"),
+    webServicePidFile: path11.join(dataDir, "web-service.pid"),
     auth0: {
-      domain: process.env.AUTH0_DOMAIN ?? defaultAuth0Domain,
-      clientId: process.env.AUTH0_CLIENT_ID ?? defaultAuth0ClientId,
-      audience: process.env.AUTH0_AUDIENCE ?? defaultAuth0Audience,
+      domain: process.env.AUTH0_DOMAIN ?? activeProfile.auth0Domain,
+      clientId: process.env.AUTH0_CLIENT_ID ?? activeProfile.auth0ClientId,
+      audience: process.env.AUTH0_AUDIENCE ?? activeProfile.auth0Audience,
       scopes: auth0Scopes
     }
   };
@@ -435,10 +528,10 @@ function getElectronAppVersion() {
   if (envVersion && /^\d+\.\d+\.\d+$/.test(envVersion)) {
     return envVersion;
   }
-  const overridePath = path10.join(getDataDir2(), VERSION_OVERRIDE_FILE);
-  if (fs5.existsSync(overridePath)) {
+  const overridePath = path11.join(getDataDir2(), VERSION_OVERRIDE_FILE);
+  if (fs6.existsSync(overridePath)) {
     try {
-      const content = JSON.parse(fs5.readFileSync(overridePath, "utf-8"));
+      const content = JSON.parse(fs6.readFileSync(overridePath, "utf-8"));
       if (content.version && typeof content.version === "string") {
         return content.version;
       }
@@ -452,10 +545,10 @@ function getElectronAppVersionSource() {
   if (envVersion && /^\d+\.\d+\.\d+$/.test(envVersion)) {
     return "env";
   }
-  const overridePath = path10.join(getDataDir2(), VERSION_OVERRIDE_FILE);
-  if (fs5.existsSync(overridePath)) {
+  const overridePath = path11.join(getDataDir2(), VERSION_OVERRIDE_FILE);
+  if (fs6.existsSync(overridePath)) {
     try {
-      const content = JSON.parse(fs5.readFileSync(overridePath, "utf-8"));
+      const content = JSON.parse(fs6.readFileSync(overridePath, "utf-8"));
       if (content.version && typeof content.version === "string") {
         return "override";
       }
@@ -470,8 +563,14 @@ function getBundledElectronAppVersion() {
 function getDownloadBaseUrl() {
   return getMuggleConfig().downloadBaseUrl;
 }
+function getActiveElectronAppReleaseStream() {
+  return resolveActiveReleaseStream(getMuggleConfig().runtimeTargetDefault);
+}
+function getElectronAppReleaseTagPrefix() {
+  return resolveActiveReleaseTagPrefix(getMuggleConfig().runtimeTargetDefault);
+}
 function buildElectronAppReleaseTag(version) {
-  return `${ELECTRON_APP_RELEASE_TAG_PREFIX}${version}`;
+  return `${getElectronAppReleaseTagPrefix()}${version}`;
 }
 function buildElectronAppReleaseAssetUrl(params) {
   return `${getDownloadBaseUrl()}/${buildElectronAppReleaseTag(params.version)}/${params.assetFileName}`;
@@ -480,14 +579,27 @@ function buildElectronAppChecksumsUrl(version) {
   return `${getDownloadBaseUrl()}/${buildElectronAppReleaseTag(version)}/checksums.txt`;
 }
 function getElectronAppChecksums() {
-  return getMuggleConfig().checksums;
+  return getMuggleConfig().checksumsByStream?.[getActiveElectronAppReleaseStream()];
+}
+function getElectronAppSignedFromVersion() {
+  return getMuggleConfig().electronAppSignedFromVersion ?? "";
+}
+function getReleaseSignerIdentityUri() {
+  return getMuggleConfig().signerIdentityUri ?? "";
 }
 function isElectronAppInstalled() {
   return getDownloadedElectronAppPath() !== null;
 }
 function getElectronAppDir(version) {
   const resolvedVersion = version ?? getElectronAppVersion();
-  return path10.join(getDataDir2(), ELECTRON_APP_DIR, resolvedVersion);
+  return path11.join(
+    getDataDir2(),
+    ELECTRON_APP_DIR,
+    buildElectronAppDirName({
+      version: resolvedVersion,
+      releaseStream: getActiveElectronAppReleaseStream()
+    })
+  );
 }
 
 // packages/mcps/src/shared/logger.ts
@@ -544,14 +656,14 @@ function getPlatformKey() {
   }
 }
 async function calculateFileChecksum(filePath) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const hash = crypto.createHash("sha256");
-    const stream = fs5.createReadStream(filePath);
+    const stream = fs6.createReadStream(filePath);
     stream.on("data", (data) => {
       hash.update(data);
     });
     stream.on("end", () => {
-      resolve5(hash.digest("hex"));
+      resolve6(hash.digest("hex"));
     });
     stream.on("error", (error) => {
       reject(error);
@@ -561,7 +673,7 @@ async function calculateFileChecksum(filePath) {
 async function verifyFileChecksum(filePath, expectedChecksum) {
   if (!expectedChecksum || expectedChecksum.trim() === "") {
     logger.warn("Checksum verification skipped - no checksum provided", {
-      file: path10.basename(filePath)
+      file: path11.basename(filePath)
     });
     return {
       valid: true,
@@ -577,13 +689,13 @@ async function verifyFileChecksum(filePath, expectedChecksum) {
     const valid = normalizedExpected === normalizedActual;
     if (!valid) {
       logger.error("Checksum verification failed", {
-        file: path10.basename(filePath),
+        file: path11.basename(filePath),
         expected: normalizedExpected,
         actual: normalizedActual
       });
     } else {
       logger.info("Checksum verified successfully", {
-        file: path10.basename(filePath),
+        file: path11.basename(filePath),
         checksum: normalizedActual
       });
     }
@@ -596,7 +708,7 @@ async function verifyFileChecksum(filePath, expectedChecksum) {
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
     logger.error("Checksum calculation failed", {
-      file: path10.basename(filePath),
+      file: path11.basename(filePath),
       error: errorMessage
     });
     return {
@@ -629,7 +741,7 @@ function getOpenCommand(url) {
   }
 }
 async function openBrowserUrl(options) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     try {
       const command = getOpenCommand(options.url);
       logger2.debug("[Browser] Opening URL", { url: options.url, command });
@@ -639,13 +751,13 @@ async function openBrowserUrl(options) {
             url: options.url,
             error: error.message
           });
-          resolve5({
+          resolve6({
             opened: false,
             error: error.message
           });
         } else {
           logger2.info("[Browser] URL opened successfully", { url: options.url });
-          resolve5({ opened: true });
+          resolve6({ opened: true });
         }
       });
     } catch (error) {
@@ -654,7 +766,7 @@ async function openBrowserUrl(options) {
         url: options.url,
         error: errorMessage
       });
-      resolve5({
+      resolve6({
         opened: false,
         error: errorMessage
       });
@@ -663,23 +775,23 @@ async function openBrowserUrl(options) {
 }
 var API_KEY_FILE2 = "api-key.json";
 function getApiKeyFilePath() {
-  return path10.join(getDataDir(), API_KEY_FILE2);
+  return path11.join(getDataDir(), API_KEY_FILE2);
 }
 function ensureDataDir() {
   const dataDir = getDataDir();
-  if (!fs5.existsSync(dataDir)) {
-    fs5.mkdirSync(dataDir, { recursive: true });
+  if (!fs6.existsSync(dataDir)) {
+    fs6.mkdirSync(dataDir, { recursive: true });
   }
 }
 function loadApiKeyData() {
   const logger6 = getLogger();
   const apiKeyPath = getApiKeyFilePath();
   try {
-    if (!fs5.existsSync(apiKeyPath)) {
+    if (!fs6.existsSync(apiKeyPath)) {
       logger6.debug("No API key file found", { path: apiKeyPath });
       return null;
     }
-    const content = fs5.readFileSync(apiKeyPath, "utf-8");
+    const content = fs6.readFileSync(apiKeyPath, "utf-8");
     const data = JSON.parse(content);
     return data;
   } catch (error) {
@@ -695,7 +807,7 @@ function saveApiKeyData(data) {
   try {
     ensureDataDir();
     const content = JSON.stringify(data, null, 2);
-    fs5.writeFileSync(apiKeyPath, content, { mode: 384 });
+    fs6.writeFileSync(apiKeyPath, content, { mode: 384 });
     logger6.info("API key saved", { path: apiKeyPath });
   } catch (error) {
     logger6.error("Failed to save API key", {
@@ -708,8 +820,8 @@ function deleteApiKeyData() {
   const logger6 = getLogger();
   const apiKeyPath = getApiKeyFilePath();
   try {
-    if (fs5.existsSync(apiKeyPath)) {
-      fs5.unlinkSync(apiKeyPath);
+    if (fs6.existsSync(apiKeyPath)) {
+      fs6.unlinkSync(apiKeyPath);
       logger6.info("API key deleted", { path: apiKeyPath });
     }
   } catch (error) {
@@ -748,7 +860,7 @@ function saveApiKey(params) {
       apiKeyId: params.apiKeyId
     };
     const content = JSON.stringify(data, null, 2);
-    fs5.writeFileSync(apiKeyPath, content, { mode: 384 });
+    fs6.writeFileSync(apiKeyPath, content, { mode: 384 });
     logger6.info("API key saved", { path: apiKeyPath });
   } catch (error) {
     logger6.error("Failed to save API key", {
@@ -839,6 +951,14 @@ var TestResultStatus = /* @__PURE__ */ ((TestResultStatus2) => {
   return TestResultStatus2;
 })(TestResultStatus || {});
 
+// packages/mcps/src/mcp/local/services/stored-auth-target.ts
+function isStoredAuthForRuntimeTarget(params) {
+  if (!params.storedRuntimeTarget) {
+    return params.activeRuntimeTarget === "production" /* Production */;
+  }
+  return params.storedRuntimeTarget === params.activeRuntimeTarget;
+}
+
 // packages/mcps/src/mcp/local/services/auth-service.ts
 var DEFAULT_LOGIN_WAIT_TIMEOUT_MS = 12e4;
 var AuthService = class {
@@ -852,8 +972,8 @@ var AuthService = class {
   constructor() {
     const config = getConfig();
     this.oauthSessionFilePath = config.localQa.oauthSessionFilePath;
-    this.pendingDeviceCodePath = path10.join(
-      path10.dirname(config.localQa.oauthSessionFilePath),
+    this.pendingDeviceCodePath = path11.join(
+      path11.dirname(config.localQa.oauthSessionFilePath),
       "pending-device-code.json"
     );
   }
@@ -962,11 +1082,11 @@ var AuthService = class {
    */
   storePendingDeviceCode(params) {
     const logger6 = getLogger();
-    const dir = path10.dirname(this.pendingDeviceCodePath);
-    if (!fs5.existsSync(dir)) {
-      fs5.mkdirSync(dir, { recursive: true });
+    const dir = path11.dirname(this.pendingDeviceCodePath);
+    if (!fs6.existsSync(dir)) {
+      fs6.mkdirSync(dir, { recursive: true });
     }
-    fs5.writeFileSync(this.pendingDeviceCodePath, JSON.stringify(params, null, 2), {
+    fs6.writeFileSync(this.pendingDeviceCodePath, JSON.stringify(params, null, 2), {
       encoding: "utf-8",
       mode: 384
     });
@@ -977,12 +1097,12 @@ var AuthService = class {
    */
   getPendingDeviceCode() {
     const logger6 = getLogger();
-    if (!fs5.existsSync(this.pendingDeviceCodePath)) {
+    if (!fs6.existsSync(this.pendingDeviceCodePath)) {
       logger6.debug("No pending device code found");
       return null;
     }
     try {
-      const content = fs5.readFileSync(this.pendingDeviceCodePath, "utf-8");
+      const content = fs6.readFileSync(this.pendingDeviceCodePath, "utf-8");
       const data = JSON.parse(content);
       const now = /* @__PURE__ */ new Date();
       const expiresAt = new Date(data.expiresAt);
@@ -1004,9 +1124,9 @@ var AuthService = class {
    */
   clearPendingDeviceCode() {
     const logger6 = getLogger();
-    if (fs5.existsSync(this.pendingDeviceCodePath)) {
+    if (fs6.existsSync(this.pendingDeviceCodePath)) {
       try {
-        fs5.unlinkSync(this.pendingDeviceCodePath);
+        fs6.unlinkSync(this.pendingDeviceCodePath);
         logger6.debug("Pending device code cleared");
       } catch (error) {
         logger6.warn("Failed to clear pending device code", {
@@ -1173,29 +1293,43 @@ var AuthService = class {
       refreshToken: tokenResponse.refreshToken,
       expiresAt,
       email,
-      userId
+      userId,
+      runtimeTarget: getActiveRuntimeTarget()
     };
-    const dir = path10.dirname(this.oauthSessionFilePath);
-    if (!fs5.existsSync(dir)) {
-      fs5.mkdirSync(dir, { recursive: true });
+    const dir = path11.dirname(this.oauthSessionFilePath);
+    if (!fs6.existsSync(dir)) {
+      fs6.mkdirSync(dir, { recursive: true });
     }
-    fs5.writeFileSync(this.oauthSessionFilePath, JSON.stringify(storedAuth, null, 2), {
+    fs6.writeFileSync(this.oauthSessionFilePath, JSON.stringify(storedAuth, null, 2), {
       encoding: "utf-8",
       mode: 384
     });
     logger6.info("Auth stored successfully", { email, expiresAt });
   }
   /**
-   * Load stored authentication.
+   * Load stored authentication for the active runtime target.
+   * @returns Stored auth, or null when it is absent, unreadable, or was issued for another target.
    */
   loadStoredAuth() {
     const logger6 = getLogger();
-    if (!fs5.existsSync(this.oauthSessionFilePath)) {
+    if (!fs6.existsSync(this.oauthSessionFilePath)) {
       return null;
     }
     try {
-      const content = fs5.readFileSync(this.oauthSessionFilePath, "utf-8");
-      return JSON.parse(content);
+      const content = fs6.readFileSync(this.oauthSessionFilePath, "utf-8");
+      const storedAuth = JSON.parse(content);
+      const activeRuntimeTarget = getActiveRuntimeTarget();
+      if (!isStoredAuthForRuntimeTarget({
+        storedRuntimeTarget: storedAuth.runtimeTarget,
+        activeRuntimeTarget
+      })) {
+        logger6.warn("Ignoring stored auth issued for a different runtime target", {
+          storedRuntimeTarget: storedAuth.runtimeTarget ?? "unrecorded",
+          activeRuntimeTarget
+        });
+        return null;
+      }
+      return storedAuth;
     } catch (error) {
       logger6.error("Failed to load stored auth", {
         error: error instanceof Error ? error.message : String(error)
@@ -1276,13 +1410,14 @@ var AuthService = class {
         refreshToken: tokenData.refresh_token ?? storedAuth.refreshToken,
         expiresAt: newExpiresAt,
         email: storedAuth.email,
-        userId: storedAuth.userId
+        userId: storedAuth.userId,
+        runtimeTarget: storedAuth.runtimeTarget ?? getActiveRuntimeTarget()
       };
-      const dir = path10.dirname(this.oauthSessionFilePath);
-      if (!fs5.existsSync(dir)) {
-        fs5.mkdirSync(dir, { recursive: true });
+      const dir = path11.dirname(this.oauthSessionFilePath);
+      if (!fs6.existsSync(dir)) {
+        fs6.mkdirSync(dir, { recursive: true });
       }
-      fs5.writeFileSync(this.oauthSessionFilePath, JSON.stringify(updatedAuth, null, 2), {
+      fs6.writeFileSync(this.oauthSessionFilePath, JSON.stringify(updatedAuth, null, 2), {
         encoding: "utf-8",
         mode: 384
       });
@@ -1334,12 +1469,12 @@ var AuthService = class {
    */
   logout() {
     const logger6 = getLogger();
-    if (!fs5.existsSync(this.oauthSessionFilePath)) {
+    if (!fs6.existsSync(this.oauthSessionFilePath)) {
       logger6.debug("No auth to clear");
       return false;
     }
     try {
-      fs5.unlinkSync(this.oauthSessionFilePath);
+      fs6.unlinkSync(this.oauthSessionFilePath);
       logger6.info("Auth cleared successfully");
       return true;
     } catch (error) {
@@ -1359,9 +1494,9 @@ function resetAuthService() {
   serviceInstance = null;
 }
 function sleep(params) {
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     setTimeout(() => {
-      resolve5();
+      resolve6();
     }, params.durationMs);
   });
 }
@@ -1384,12 +1519,12 @@ var StorageService = class {
    */
   ensureDirectories() {
     const logger6 = getLogger();
-    if (!fs5.existsSync(this.dataDir)) {
-      fs5.mkdirSync(this.dataDir, { recursive: true });
+    if (!fs6.existsSync(this.dataDir)) {
+      fs6.mkdirSync(this.dataDir, { recursive: true });
       logger6.info("Created data directory", { path: this.dataDir });
     }
-    if (!fs5.existsSync(this.sessionsDir)) {
-      fs5.mkdirSync(this.sessionsDir, { recursive: true });
+    if (!fs6.existsSync(this.sessionsDir)) {
+      fs6.mkdirSync(this.sessionsDir, { recursive: true });
       logger6.info("Created sessions directory", { path: this.sessionsDir });
     }
   }
@@ -1401,11 +1536,11 @@ var StorageService = class {
   createSessionDirectory(sessionId) {
     const logger6 = getLogger();
     this.ensureDirectories();
-    const sessionDir = path10.join(this.sessionsDir, sessionId);
-    if (!fs5.existsSync(sessionDir)) {
-      fs5.mkdirSync(sessionDir, { recursive: true });
-      fs5.mkdirSync(path10.join(sessionDir, "screenshots"), { recursive: true });
-      fs5.mkdirSync(path10.join(sessionDir, "logs"), { recursive: true });
+    const sessionDir = path11.join(this.sessionsDir, sessionId);
+    if (!fs6.existsSync(sessionDir)) {
+      fs6.mkdirSync(sessionDir, { recursive: true });
+      fs6.mkdirSync(path11.join(sessionDir, "screenshots"), { recursive: true });
+      fs6.mkdirSync(path11.join(sessionDir, "logs"), { recursive: true });
       logger6.info("Created session directory", { sessionId, path: sessionDir });
     }
     return sessionDir;
@@ -1417,8 +1552,8 @@ var StorageService = class {
   saveSessionMetadata(metadata) {
     const logger6 = getLogger();
     const sessionDir = this.createSessionDirectory(metadata.sessionId);
-    const metadataPath = path10.join(sessionDir, "metadata.json");
-    fs5.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf-8");
+    const metadataPath = path11.join(sessionDir, "metadata.json");
+    fs6.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf-8");
     logger6.debug("Saved session metadata", { sessionId: metadata.sessionId });
   }
   /**
@@ -1428,12 +1563,12 @@ var StorageService = class {
    */
   loadSessionMetadata(sessionId) {
     const logger6 = getLogger();
-    const metadataPath = path10.join(this.sessionsDir, sessionId, "metadata.json");
-    if (!fs5.existsSync(metadataPath)) {
+    const metadataPath = path11.join(this.sessionsDir, sessionId, "metadata.json");
+    if (!fs6.existsSync(metadataPath)) {
       return null;
     }
     try {
-      const content = fs5.readFileSync(metadataPath, "utf-8");
+      const content = fs6.readFileSync(metadataPath, "utf-8");
       return JSON.parse(content);
     } catch (error) {
       logger6.error("Failed to load session metadata", {
@@ -1448,12 +1583,12 @@ var StorageService = class {
    * @returns Array of session IDs.
    */
   listSessions() {
-    if (!fs5.existsSync(this.sessionsDir)) {
+    if (!fs6.existsSync(this.sessionsDir)) {
       return [];
     }
-    return fs5.readdirSync(this.sessionsDir).filter((entry) => {
-      const entryPath = path10.join(this.sessionsDir, entry);
-      return fs5.statSync(entryPath).isDirectory();
+    return fs6.readdirSync(this.sessionsDir).filter((entry) => {
+      const entryPath = path11.join(this.sessionsDir, entry);
+      return fs6.statSync(entryPath).isDirectory();
     });
   }
   /**
@@ -1461,13 +1596,13 @@ var StorageService = class {
    * @returns Current session ID, or null.
    */
   getCurrentSessionId() {
-    const currentPath = path10.join(this.sessionsDir, "current");
-    if (!fs5.existsSync(currentPath)) {
+    const currentPath = path11.join(this.sessionsDir, "current");
+    if (!fs6.existsSync(currentPath)) {
       return null;
     }
     try {
-      const target = fs5.readlinkSync(currentPath);
-      return path10.basename(target);
+      const target = fs6.readlinkSync(currentPath);
+      return path11.basename(target);
     } catch {
       return null;
     }
@@ -1478,12 +1613,12 @@ var StorageService = class {
    */
   setCurrentSession(sessionId) {
     const logger6 = getLogger();
-    const currentPath = path10.join(this.sessionsDir, "current");
-    const targetPath = path10.join(this.sessionsDir, sessionId);
-    if (fs5.existsSync(currentPath)) {
-      fs5.unlinkSync(currentPath);
+    const currentPath = path11.join(this.sessionsDir, "current");
+    const targetPath = path11.join(this.sessionsDir, sessionId);
+    if (fs6.existsSync(currentPath)) {
+      fs6.unlinkSync(currentPath);
     }
-    fs5.symlinkSync(targetPath, currentPath);
+    fs6.symlinkSync(targetPath, currentPath);
     logger6.info("Set current session", { sessionId });
   }
   /**
@@ -1494,8 +1629,8 @@ var StorageService = class {
     const { sessionId, filename, data } = params;
     const logger6 = getLogger();
     const sessionDir = this.createSessionDirectory(sessionId);
-    const screenshotPath = path10.join(sessionDir, "screenshots", filename);
-    fs5.writeFileSync(screenshotPath, data);
+    const screenshotPath = path11.join(sessionDir, "screenshots", filename);
+    fs6.writeFileSync(screenshotPath, data);
     logger6.debug("Saved screenshot", { sessionId, filename });
     return screenshotPath;
   }
@@ -1507,8 +1642,8 @@ var StorageService = class {
     const { sessionId, content } = params;
     const logger6 = getLogger();
     const sessionDir = this.createSessionDirectory(sessionId);
-    const resultsPath = path10.join(sessionDir, "results.md");
-    fs5.appendFileSync(resultsPath, content + "\n", "utf-8");
+    const resultsPath = path11.join(sessionDir, "results.md");
+    fs6.appendFileSync(resultsPath, content + "\n", "utf-8");
     logger6.debug("Appended to results", { sessionId });
   }
   /**
@@ -1517,11 +1652,11 @@ var StorageService = class {
    * @returns Results content, or null if not found.
    */
   getResults(sessionId) {
-    const resultsPath = path10.join(this.sessionsDir, sessionId, "results.md");
-    if (!fs5.existsSync(resultsPath)) {
+    const resultsPath = path11.join(this.sessionsDir, sessionId, "results.md");
+    if (!fs6.existsSync(resultsPath)) {
       return null;
     }
-    return fs5.readFileSync(resultsPath, "utf-8");
+    return fs6.readFileSync(resultsPath, "utf-8");
   }
   /**
    * Get the data directory path.
@@ -1586,7 +1721,7 @@ var StorageService = class {
     const { sessionId, targetUrl, testInstructions } = params;
     const logger6 = getLogger();
     const sessionDir = this.createSessionDirectory(sessionId);
-    const resultsPath = path10.join(sessionDir, "results.md");
+    const resultsPath = path11.join(sessionDir, "results.md");
     const header = [
       `# Test Results: ${sessionId}`,
       "",
@@ -1599,7 +1734,7 @@ var StorageService = class {
       "## Test Steps",
       ""
     ].join("\n");
-    fs5.writeFileSync(resultsPath, header, "utf-8");
+    fs6.writeFileSync(resultsPath, header, "utf-8");
     logger6.debug("Initialized results.md", { sessionId });
   }
   /**
@@ -1610,7 +1745,7 @@ var StorageService = class {
     const { sessionId, step } = params;
     const logger6 = getLogger();
     const sessionDir = this.createSessionDirectory(sessionId);
-    const resultsPath = path10.join(sessionDir, "results.md");
+    const resultsPath = path11.join(sessionDir, "results.md");
     const statusIcon = step.success ? "\u2713" : "\u2717";
     const stepContent = [
       `### Step ${step.stepNumber}: ${step.action}`,
@@ -1620,7 +1755,7 @@ var StorageService = class {
       step.screenshotPath ? `- **Screenshot:** [step-${String(step.stepNumber).padStart(3, "0")}.png](screenshots/step-${String(step.stepNumber).padStart(3, "0")}.png)` : "",
       ""
     ].filter(Boolean).join("\n");
-    fs5.appendFileSync(resultsPath, stepContent + "\n", "utf-8");
+    fs6.appendFileSync(resultsPath, stepContent + "\n", "utf-8");
     logger6.debug("Appended step to results", { sessionId, stepNumber: step.stepNumber });
     const metadata = this.loadSessionMetadata(sessionId);
     if (metadata) {
@@ -1635,9 +1770,9 @@ var StorageService = class {
   finalizeResults(params) {
     const { sessionId, status, summary } = params;
     const logger6 = getLogger();
-    const sessionDir = path10.join(this.sessionsDir, sessionId);
-    const resultsPath = path10.join(sessionDir, "results.md");
-    if (!fs5.existsSync(resultsPath)) {
+    const sessionDir = path11.join(this.sessionsDir, sessionId);
+    const resultsPath = path11.join(sessionDir, "results.md");
+    if (!fs6.existsSync(resultsPath)) {
       logger6.warn("Results file not found for finalization", { sessionId });
       return;
     }
@@ -1660,7 +1795,7 @@ var StorageService = class {
       "",
       summary ? summary : ""
     ].join("\n");
-    fs5.appendFileSync(resultsPath, footer, "utf-8");
+    fs6.appendFileSync(resultsPath, footer, "utf-8");
     logger6.debug("Finalized results.md", { sessionId, status });
     if (metadata) {
       metadata.durationMs = durationMs;
@@ -1718,9 +1853,9 @@ var StorageService = class {
       }
       const sessionDate = new Date(metadata.startTime);
       if (sessionDate < cutoffDate) {
-        const sessionDir = path10.join(this.sessionsDir, sessionId);
+        const sessionDir = path11.join(this.sessionsDir, sessionId);
         try {
-          fs5.rmSync(sessionDir, { recursive: true, force: true });
+          fs6.rmSync(sessionDir, { recursive: true, force: true });
           deletedCount++;
           logger6.info("Deleted old session", {
             sessionId,
@@ -1748,7 +1883,7 @@ var StorageService = class {
    * @returns Session directory path.
    */
   getSessionPath(sessionId) {
-    return path10.join(this.sessionsDir, sessionId);
+    return path11.join(this.sessionsDir, sessionId);
   }
   /**
    * Delete a specific session.
@@ -1757,20 +1892,20 @@ var StorageService = class {
    */
   deleteSession(sessionId) {
     const logger6 = getLogger();
-    const sessionDir = path10.join(this.sessionsDir, sessionId);
-    if (!fs5.existsSync(sessionDir)) {
+    const sessionDir = path11.join(this.sessionsDir, sessionId);
+    if (!fs6.existsSync(sessionDir)) {
       logger6.warn("Session not found for deletion", { sessionId });
       return false;
     }
     try {
       const currentId = this.getCurrentSessionId();
       if (currentId === sessionId) {
-        const currentPath = path10.join(this.sessionsDir, "current");
-        if (fs5.existsSync(currentPath)) {
-          fs5.unlinkSync(currentPath);
+        const currentPath = path11.join(this.sessionsDir, "current");
+        if (fs6.existsSync(currentPath)) {
+          fs6.unlinkSync(currentPath);
         }
       }
-      fs5.rmSync(sessionDir, { recursive: true, force: true });
+      fs6.rmSync(sessionDir, { recursive: true, force: true });
       logger6.info("Deleted session", { sessionId });
       return true;
     } catch (error) {
@@ -1799,19 +1934,19 @@ var RunResultStorageService = class {
   constructor() {
     const storageService = getStorageService();
     const dataDir = storageService.getDataDir();
-    this.runResultsDir = path10.join(dataDir, "run-results");
-    this.testScriptsDir = path10.join(dataDir, "test-scripts");
+    this.runResultsDir = path11.join(dataDir, "run-results");
+    this.testScriptsDir = path11.join(dataDir, "test-scripts");
     this.ensureDirectories();
   }
   /**
    * Ensure storage directories exist.
    */
   ensureDirectories() {
-    if (!fs5.existsSync(this.runResultsDir)) {
-      fs5.mkdirSync(this.runResultsDir, { recursive: true });
+    if (!fs6.existsSync(this.runResultsDir)) {
+      fs6.mkdirSync(this.runResultsDir, { recursive: true });
     }
-    if (!fs5.existsSync(this.testScriptsDir)) {
-      fs5.mkdirSync(this.testScriptsDir, { recursive: true });
+    if (!fs6.existsSync(this.testScriptsDir)) {
+      fs6.mkdirSync(this.testScriptsDir, { recursive: true });
     }
   }
   // ========================================
@@ -1822,11 +1957,11 @@ var RunResultStorageService = class {
    */
   listRunResults() {
     try {
-      const files = fs5.readdirSync(this.runResultsDir).filter((f) => f.endsWith(".json"));
+      const files = fs6.readdirSync(this.runResultsDir).filter((f) => f.endsWith(".json"));
       const results = [];
       for (const file of files) {
         try {
-          const content = fs5.readFileSync(path10.join(this.runResultsDir, file), "utf-8");
+          const content = fs6.readFileSync(path11.join(this.runResultsDir, file), "utf-8");
           results.push(JSON.parse(content));
         } catch {
           logger3.warn("Failed to read run result file", { file });
@@ -1841,12 +1976,12 @@ var RunResultStorageService = class {
    * Get a run result by ID.
    */
   getRunResult(runId) {
-    const filePath = path10.join(this.runResultsDir, `${runId}.json`);
-    if (!fs5.existsSync(filePath)) {
+    const filePath = path11.join(this.runResultsDir, `${runId}.json`);
+    if (!fs6.existsSync(filePath)) {
       return void 0;
     }
     try {
-      const content = fs5.readFileSync(filePath, "utf-8");
+      const content = fs6.readFileSync(filePath, "utf-8");
       return JSON.parse(content);
     } catch {
       return void 0;
@@ -1856,8 +1991,8 @@ var RunResultStorageService = class {
    * Save a run result.
    */
   saveRunResult(result) {
-    const filePath = path10.join(this.runResultsDir, `${result.id}.json`);
-    fs5.writeFileSync(filePath, JSON.stringify(result, null, 2));
+    const filePath = path11.join(this.runResultsDir, `${result.id}.json`);
+    fs6.writeFileSync(filePath, JSON.stringify(result, null, 2));
   }
   /**
    * Create a new run result.
@@ -1905,11 +2040,11 @@ var RunResultStorageService = class {
    */
   listTestScripts() {
     try {
-      const files = fs5.readdirSync(this.testScriptsDir).filter((f) => f.endsWith(".json"));
+      const files = fs6.readdirSync(this.testScriptsDir).filter((f) => f.endsWith(".json"));
       const scripts = [];
       for (const file of files) {
         try {
-          const content = fs5.readFileSync(path10.join(this.testScriptsDir, file), "utf-8");
+          const content = fs6.readFileSync(path11.join(this.testScriptsDir, file), "utf-8");
           scripts.push(JSON.parse(content));
         } catch {
           logger3.warn("Failed to read test script file", { file });
@@ -1924,12 +2059,12 @@ var RunResultStorageService = class {
    * Get a test script by ID.
    */
   getTestScript(testScriptId) {
-    const filePath = path10.join(this.testScriptsDir, `${testScriptId}.json`);
-    if (!fs5.existsSync(filePath)) {
+    const filePath = path11.join(this.testScriptsDir, `${testScriptId}.json`);
+    if (!fs6.existsSync(filePath)) {
       return void 0;
     }
     try {
-      const content = fs5.readFileSync(filePath, "utf-8");
+      const content = fs6.readFileSync(filePath, "utf-8");
       return JSON.parse(content);
     } catch {
       return void 0;
@@ -1939,8 +2074,8 @@ var RunResultStorageService = class {
    * Save a test script.
    */
   saveTestScript(script) {
-    const filePath = path10.join(this.testScriptsDir, `${script.id}.json`);
-    fs5.writeFileSync(filePath, JSON.stringify(script, null, 2));
+    const filePath = path11.join(this.testScriptsDir, `${script.id}.json`);
+    fs6.writeFileSync(filePath, JSON.stringify(script, null, 2));
   }
   /**
    * Create a new test script.
@@ -2190,13 +2325,13 @@ var PREFERENCES_SCHEMA = {
 
 // packages/mcps/src/shared/llm-env-service.ts
 function resolveLlmEnvOverrides(dataDirOverride2) {
-  const filePath = path10.join(getDataDir(), PREFERENCES_FILE_NAME);
+  const filePath = path11.join(getDataDir(), PREFERENCES_FILE_NAME);
   let block;
   try {
-    if (!fs5.existsSync(filePath)) {
+    if (!fs6.existsSync(filePath)) {
       return {};
     }
-    const raw = JSON.parse(fs5.readFileSync(filePath, "utf-8"));
+    const raw = JSON.parse(fs6.readFileSync(filePath, "utf-8"));
     block = raw[LLM_ENV_PREFERENCE_KEY];
   } catch {
     return {};
@@ -2404,13 +2539,13 @@ var MODIFY_LOCK_STALE_MS = 5e3;
 
 // packages/mcps/src/mcp/local/services/local-execution-lock.ts
 function lockFilePath() {
-  return path10.join(getDataDir(), LOCK_FILE_NAME);
+  return path11.join(getDataDir(), LOCK_FILE_NAME);
 }
 function modifyLockPath() {
   return lockFilePath() + MODIFY_LOCK_SUFFIX;
 }
 function normalizeCwd(cwd) {
-  const resolved = path10.resolve(cwd);
+  const resolved = path11.resolve(cwd);
   return os4.platform() === "win32" ? resolved.toLowerCase() : resolved;
 }
 function pidIsAlive(pid) {
@@ -2426,7 +2561,7 @@ function pidIsAlive(pid) {
 }
 async function readState() {
   try {
-    const raw = await fs9.readFile(lockFilePath(), "utf-8");
+    const raw = await fs10.readFile(lockFilePath(), "utf-8");
     return JSON.parse(raw);
   } catch (error) {
     if (error.code === "ENOENT") return null;
@@ -2434,28 +2569,28 @@ async function readState() {
   }
 }
 async function writeState(state2) {
-  await fs9.writeFile(lockFilePath(), JSON.stringify(state2, null, 2), "utf-8");
+  await fs10.writeFile(lockFilePath(), JSON.stringify(state2, null, 2), "utf-8");
 }
 async function deleteStateFile() {
   try {
-    await fs9.unlink(lockFilePath());
+    await fs10.unlink(lockFilePath());
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
 }
 async function withModifyLock(fn) {
-  await fs9.mkdir(path10.dirname(modifyLockPath()), { recursive: true });
+  await fs10.mkdir(path11.dirname(modifyLockPath()), { recursive: true });
   const modifyPath = modifyLockPath();
   let fileHandle = null;
   while (fileHandle === null) {
     try {
-      fileHandle = await fs9.open(modifyPath, "wx");
+      fileHandle = await fs10.open(modifyPath, "wx");
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
       try {
-        const stat3 = await fs9.stat(modifyPath);
+        const stat3 = await fs10.stat(modifyPath);
         if (Date.now() - stat3.mtimeMs > MODIFY_LOCK_STALE_MS) {
-          await fs9.unlink(modifyPath).catch(() => void 0);
+          await fs10.unlink(modifyPath).catch(() => void 0);
           continue;
         }
       } catch {
@@ -2468,7 +2603,7 @@ async function withModifyLock(fn) {
     return await fn();
   } finally {
     await fileHandle.close().catch(() => void 0);
-    await fs9.unlink(modifyPath).catch(() => void 0);
+    await fs10.unlink(modifyPath).catch(() => void 0);
   }
 }
 async function tryAcquireOnce(params) {
@@ -2607,12 +2742,12 @@ function extractStudioCloudRefs(studioReturnedResult) {
   return refs;
 }
 async function readCloudRefsFile(inputFilePath) {
-  const cloudRefsPath = path10.join(
-    path10.dirname(inputFilePath),
-    `cloudrefs_${path10.basename(inputFilePath)}`
+  const cloudRefsPath = path11.join(
+    path11.dirname(inputFilePath),
+    `cloudrefs_${path11.basename(inputFilePath)}`
   );
   try {
-    return JSON.parse(await fs9.readFile(cloudRefsPath, "utf-8"));
+    return JSON.parse(await fs10.readFile(cloudRefsPath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -2631,15 +2766,15 @@ function getAuthenticatedUserId() {
 }
 async function findPackageJsonAsync() {
   const currentFileUrl = import.meta.url;
-  const currentDir = path10.dirname(fileURLToPath(currentFileUrl));
+  const currentDir = path11.dirname(fileURLToPath(currentFileUrl));
   const candidatePaths = [
-    path10.resolve(currentDir, "../../../package.json"),
-    path10.resolve(currentDir, "../package.json"),
-    path10.resolve(currentDir, "../../package.json")
+    path11.resolve(currentDir, "../../../package.json"),
+    path11.resolve(currentDir, "../package.json"),
+    path11.resolve(currentDir, "../../package.json")
   ];
   for (const candidatePath of candidatePaths) {
     try {
-      const packageJsonRaw = await fs9.readFile(candidatePath, "utf-8");
+      const packageJsonRaw = await fs10.readFile(candidatePath, "utf-8");
       const packageJson = JSON.parse(packageJsonRaw);
       if (packageJson.name === "@muggleai/works" && packageJson.version && packageJson.muggleConfig?.electronAppVersion) {
         return {
@@ -2685,20 +2820,20 @@ function buildStudioAuthContent() {
 }
 async function ensureTempDir() {
   const config = getConfig();
-  const tempDir = path10.join(config.localQa.dataDir, "temp");
-  await fs9.mkdir(tempDir, { recursive: true });
+  const tempDir = path11.join(config.localQa.dataDir, "temp");
+  await fs10.mkdir(tempDir, { recursive: true });
   return tempDir;
 }
 async function writeTempFile(params) {
   const tempDir = await ensureTempDir();
-  const filePath = path10.join(tempDir, params.filename);
-  await fs9.writeFile(filePath, JSON.stringify(params.data, null, 2));
+  const filePath = path11.join(tempDir, params.filename);
+  await fs10.writeFile(filePath, JSON.stringify(params.data, null, 2));
   return filePath;
 }
 async function cleanupTempFiles(params) {
   for (const filePath of params.filePaths) {
     try {
-      await fs9.unlink(filePath);
+      await fs10.unlink(filePath);
     } catch {
     }
   }
@@ -2706,12 +2841,12 @@ async function cleanupTempFiles(params) {
 async function moveResultsToArtifacts(params) {
   const storageService = getStorageService();
   const sessionsDir = storageService.getSessionsDir();
-  const artifactsDir = path10.join(sessionsDir, params.runId);
-  const actionScriptPath = path10.join(artifactsDir, "action-script.json");
-  await fs9.mkdir(artifactsDir, { recursive: true });
-  await fs9.copyFile(params.generatedScriptPath, actionScriptPath);
+  const artifactsDir = path11.join(sessionsDir, params.runId);
+  const actionScriptPath = path11.join(artifactsDir, "action-script.json");
+  await fs10.mkdir(artifactsDir, { recursive: true });
+  await fs10.copyFile(params.generatedScriptPath, actionScriptPath);
   try {
-    await fs9.unlink(params.generatedScriptPath);
+    await fs10.unlink(params.generatedScriptPath);
   } catch {
   }
   return artifactsDir;
@@ -2719,13 +2854,13 @@ async function moveResultsToArtifacts(params) {
 async function writeExecutionLogs(params) {
   const storageService = getStorageService();
   const sessionsDir = storageService.getSessionsDir();
-  const artifactsDir = path10.join(sessionsDir, params.runId);
-  await fs9.mkdir(artifactsDir, { recursive: true });
-  const stdoutPath = path10.join(artifactsDir, "stdout.log");
-  const stderrPath = path10.join(artifactsDir, "stderr.log");
+  const artifactsDir = path11.join(sessionsDir, params.runId);
+  await fs10.mkdir(artifactsDir, { recursive: true });
+  const stdoutPath = path11.join(artifactsDir, "stdout.log");
+  const stderrPath = path11.join(artifactsDir, "stderr.log");
   await Promise.all([
-    fs9.writeFile(stdoutPath, params.stdout, "utf-8"),
-    fs9.writeFile(stderrPath, params.stderr, "utf-8")
+    fs10.writeFile(stdoutPath, params.stdout, "utf-8"),
+    fs10.writeFile(stderrPath, params.stderr, "utf-8")
   ]);
   logger4.info("Wrote execution logs to artifacts directory", {
     runId: params.runId,
@@ -2735,10 +2870,10 @@ async function writeExecutionLogs(params) {
 async function preserveElectronRuntimeArtifacts(params) {
   try {
     const tempDir = await ensureTempDir();
-    const markerPath = path10.join(tempDir, `${params.runId}_runtime_dir.txt`);
+    const markerPath = path11.join(tempDir, `${params.runId}_runtime_dir.txt`);
     let runtimeDir = null;
     try {
-      const marker = await fs9.readFile(markerPath, "utf-8");
+      const marker = await fs10.readFile(markerPath, "utf-8");
       const trimmed = marker.trim();
       if (trimmed.length > 0) runtimeDir = trimmed;
     } catch (markerReadError) {
@@ -2760,25 +2895,25 @@ async function preserveElectronRuntimeArtifacts(params) {
       return;
     }
     try {
-      await fs9.access(runtimeDir);
+      await fs10.access(runtimeDir);
     } catch {
       logger4.warn("Electron runtime dir referenced but missing on disk", {
         runId: params.runId,
         runtimeDir
       });
-      await fs9.unlink(markerPath).catch(() => void 0);
+      await fs10.unlink(markerPath).catch(() => void 0);
       return;
     }
     const storage = getStorageService();
-    const destDir = path10.join(storage.getSessionsDir(), params.runId, "electron-runtime");
-    await fs9.mkdir(destDir, { recursive: true });
-    await fs9.cp(runtimeDir, destDir, { recursive: true });
+    const destDir = path11.join(storage.getSessionsDir(), params.runId, "electron-runtime");
+    await fs10.mkdir(destDir, { recursive: true });
+    await fs10.cp(runtimeDir, destDir, { recursive: true });
     logger4.info("Preserved Electron runtime artifacts", {
       runId: params.runId,
       sourceDir: runtimeDir,
       destDir
     });
-    await fs9.unlink(markerPath).catch(() => void 0);
+    await fs10.unlink(markerPath).catch(() => void 0);
   } catch (preserveError) {
     logger4.warn("Failed to preserve Electron runtime artifacts", {
       runId: params.runId,
@@ -2787,14 +2922,14 @@ async function preserveElectronRuntimeArtifacts(params) {
   }
 }
 async function scanForRuntimeDirByMtime(params) {
-  const runtimeRoot = path10.join(params.electronCwd, "user_data", "runtime");
+  const runtimeRoot = path11.join(params.electronCwd, "user_data", "runtime");
   try {
-    const entries = await fs9.readdir(runtimeRoot, { withFileTypes: true });
+    const entries = await fs10.readdir(runtimeRoot, { withFileTypes: true });
     let bestCandidate = null;
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const fullPath = path10.join(runtimeRoot, entry.name);
-      const stat3 = await fs9.stat(fullPath);
+      const fullPath = path11.join(runtimeRoot, entry.name);
+      const stat3 = await fs10.stat(fullPath);
       if (stat3.mtimeMs < params.spawnAtMs) continue;
       if (bestCandidate === null || stat3.mtimeMs > bestCandidate.mtimeMs) {
         bestCandidate = { path: fullPath, mtimeMs: stat3.mtimeMs };
@@ -2850,7 +2985,7 @@ async function executeElectronAppAsync(params) {
     spawnArgs,
     llmEnvOverrideNames
   });
-  const electronCwd = path10.dirname(electronAppPath);
+  const electronCwd = path11.dirname(electronAppPath);
   const child = spawn(electronAppPath, spawnArgs, {
     stdio: ["ignore", "pipe", "pipe"],
     env: electronEnv,
@@ -2865,7 +3000,7 @@ async function executeElectronAppAsync(params) {
     capturedStderr: ""
   };
   activeProcesses.set(params.runId, processInfo);
-  return await new Promise((resolve5, reject) => {
+  return await new Promise((resolve6, reject) => {
     let settled = false;
     const finalize = (result) => {
       if (settled) {
@@ -2877,7 +3012,7 @@ async function executeElectronAppAsync(params) {
       }
       activeProcesses.delete(params.runId);
       if (result.ok) {
-        resolve5(result.payload);
+        resolve6(result.payload);
       } else {
         reject(result.payload);
       }
@@ -3032,17 +3167,17 @@ ${executionResult.stdout}
 STDERR:
 ${executionResult.stderr}`;
         const sessionsDir = getStorageService().getSessionsDir();
-        const artifactsDir2 = path10.join(sessionsDir, runId);
-        const generatedScriptPath2 = path10.join(
-          path10.dirname(inputFilePath),
-          `gen_${path10.basename(inputFilePath)}`
+        const artifactsDir2 = path11.join(sessionsDir, runId);
+        const generatedScriptPath2 = path11.join(
+          path11.dirname(inputFilePath),
+          `gen_${path11.basename(inputFilePath)}`
         );
         let failedStudioResult;
         try {
-          const failedScriptRaw = await fs9.readFile(generatedScriptPath2, "utf-8");
+          const failedScriptRaw = await fs10.readFile(generatedScriptPath2, "utf-8");
           failedStudioResult = JSON.parse(failedScriptRaw);
-          await fs9.copyFile(generatedScriptPath2, path10.join(artifactsDir2, "action-script.json"));
-          await fs9.unlink(generatedScriptPath2).catch(() => {
+          await fs10.copyFile(generatedScriptPath2, path11.join(artifactsDir2, "action-script.json"));
+          await fs10.unlink(generatedScriptPath2).catch(() => {
           });
         } catch {
         }
@@ -3071,11 +3206,11 @@ ${executionResult.stderr}`;
           errorMessage: failureMessage
         };
       }
-      const generatedScriptPath = path10.join(
-        path10.dirname(inputFilePath),
-        `gen_${path10.basename(inputFilePath)}`
+      const generatedScriptPath = path11.join(
+        path11.dirname(inputFilePath),
+        `gen_${path11.basename(inputFilePath)}`
       );
-      const generatedScriptRaw = await fs9.readFile(generatedScriptPath, "utf-8");
+      const generatedScriptRaw = await fs10.readFile(generatedScriptPath, "utf-8");
       const generatedScript = JSON.parse(generatedScriptRaw);
       const generatedSteps = generatedScript.steps;
       if (!Array.isArray(generatedSteps)) {
@@ -3218,7 +3353,7 @@ STDOUT:
 ${executionResult.stdout}
 STDERR:
 ${executionResult.stderr}`;
-        const artifactsDir2 = path10.join(getStorageService().getSessionsDir(), runId);
+        const artifactsDir2 = path11.join(getStorageService().getSessionsDir(), runId);
         storage.updateRunResult(runId, {
           status: "failed",
           executionTimeMs,
@@ -3236,7 +3371,7 @@ ${executionResult.stderr}`;
           errorMessage: failureMessage
         };
       }
-      const artifactsDir = path10.join(getStorageService().getSessionsDir(), runId);
+      const artifactsDir = path11.join(getStorageService().getSessionsDir(), runId);
       const replayStudioResult = await readCloudRefsFile(inputFilePath);
       const replayStudioCloudRefs = extractStudioCloudRefs(replayStudioResult);
       storage.updateRunResult(runId, {
@@ -3673,7 +3808,7 @@ var PREFS_FILENAME = "preferences.json";
 var OAUTH_SESSION_FILENAME = "oauth-session.json";
 var RELEASE_MANIFEST_FILENAME = "release-manifest.json";
 function getDataDir3() {
-  return path10.join(os4.homedir(), DATA_DIR_NAME2);
+  return path11.join(os4.homedir(), DATA_DIR_NAME2);
 }
 
 var cachedInstallId;
@@ -3738,9 +3873,9 @@ function isValid2(value) {
 function readReleaseManifest2() {
   if (cachedManifest2 !== void 0)
     return cachedManifest2;
-  const path16 = MANIFEST_PATH2;
+  const path17 = MANIFEST_PATH2;
   try {
-    const raw = readFileSync(path16, "utf8");
+    const raw = readFileSync(path17, "utf8");
     const parsed = JSON.parse(raw);
     cachedManifest2 = isValid2(parsed) ? parsed : DEV_MANIFEST2;
     return cachedManifest2;
@@ -4519,17 +4654,17 @@ var PromptServiceClient = class {
    * @param path - Path to validate.
    * @throws GatewayError if path is not allowed.
    */
-  validatePath(path16) {
-    const isAllowed = ALLOWED_UPSTREAM_PREFIXES.some((prefix) => path16.startsWith(prefix));
+  validatePath(path17) {
+    const isAllowed = ALLOWED_UPSTREAM_PREFIXES.some((prefix) => path17.startsWith(prefix));
     if (!isAllowed) {
       const logger6 = getLogger();
       logger6.error("Path not in allowlist", {
-        path: path16,
+        path: path17,
         allowedPrefixes: ALLOWED_UPSTREAM_PREFIXES
       });
       throw new GatewayError({
         code: "FORBIDDEN" /* FORBIDDEN */,
-        message: `Path '${path16}' is not allowed`
+        message: `Path '${path17}' is not allowed`
       });
     }
   }
@@ -6582,11 +6717,11 @@ var TELEMETRY_DIR_NAME = "telemetry";
 var FAILURE_EVENTS_FILE_NAME = "failure-events.jsonl";
 function appendFailureEvent(record) {
   try {
-    const dir = path10.join(getDataDir(), TELEMETRY_DIR_NAME);
-    fs5.mkdirSync(dir, { recursive: true });
-    const filePath = path10.join(dir, FAILURE_EVENTS_FILE_NAME);
+    const dir = path11.join(getDataDir(), TELEMETRY_DIR_NAME);
+    fs6.mkdirSync(dir, { recursive: true });
+    const filePath = path11.join(dir, FAILURE_EVENTS_FILE_NAME);
     const full = { ts: (/* @__PURE__ */ new Date()).toISOString(), ...record };
-    fs5.appendFileSync(filePath, `${JSON.stringify(full)}
+    fs6.appendFileSync(filePath, `${JSON.stringify(full)}
 `, "utf-8");
   } catch (error) {
     getLogger().warn("Failed to append failure event", {
@@ -6605,17 +6740,17 @@ var ProjectPreferencesReconcileOutcome = /* @__PURE__ */ ((ProjectPreferencesRec
 
 // packages/mcps/src/shared/preferences-service.ts
 function getGlobalPreferencesFilePath(dataDirOverride2) {
-  return path10.join(dataDirOverride2 ?? getDataDir(), PREFERENCES_FILE_NAME);
+  return path11.join(dataDirOverride2 ?? getDataDir(), PREFERENCES_FILE_NAME);
 }
 function isFirstRun(dataDirOverride2) {
-  return !fs5.existsSync(getGlobalPreferencesFilePath(dataDirOverride2));
+  return !fs6.existsSync(getGlobalPreferencesFilePath(dataDirOverride2));
 }
 function readPreferencesFile(filePath) {
   try {
-    if (!fs5.existsSync(filePath)) {
+    if (!fs6.existsSync(filePath)) {
       return {};
     }
-    const raw = JSON.parse(fs5.readFileSync(filePath, "utf-8"));
+    const raw = JSON.parse(fs6.readFileSync(filePath, "utf-8"));
     return raw.preferences ?? {};
   } catch (error) {
     getLogger().warn("Failed to read preferences file", {
@@ -6631,15 +6766,15 @@ function writePreferencesFile(filePath, prefs) {
     version: PREFERENCES_VERSION,
     preferences: prefs
   };
-  fs5.writeFileSync(filePath, `${JSON.stringify(file, null, 2)}
+  fs6.writeFileSync(filePath, `${JSON.stringify(file, null, 2)}
 `, "utf-8");
 }
 function readRawPreferencesFile(filePath) {
   try {
-    if (!fs5.existsSync(filePath)) {
+    if (!fs6.existsSync(filePath)) {
       return {};
     }
-    return JSON.parse(fs5.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs6.readFileSync(filePath, "utf-8"));
   } catch {
     return {};
   }
@@ -6650,14 +6785,14 @@ function resolvePreferences(dataDirOverride2) {
 }
 function writePreferences2(prefs, dataDirOverride2) {
   const dir = dataDirOverride2 ?? getDataDir();
-  fs5.mkdirSync(dir, { recursive: true });
-  const filePath = path10.join(dir, PREFERENCES_FILE_NAME);
+  fs6.mkdirSync(dir, { recursive: true });
+  const filePath = path11.join(dir, PREFERENCES_FILE_NAME);
   const existing = readPreferencesFile(filePath);
   writePreferencesFile(filePath, { ...existing, ...prefs });
 }
 function resetPreference(key, dataDirOverride2) {
   const filePath = getGlobalPreferencesFilePath(dataDirOverride2);
-  if (!fs5.existsSync(filePath)) {
+  if (!fs6.existsSync(filePath)) {
     return;
   }
   if (!key) {
@@ -6669,7 +6804,7 @@ function resetPreference(key, dataDirOverride2) {
   writePreferencesFile(filePath, existing);
 }
 function reconcileProjectPreferences(cwd, dataDirOverride2) {
-  const projectFilePath = path10.join(cwd, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_FILE_NAME);
+  const projectFilePath = path11.join(cwd, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_FILE_NAME);
   const projectPreferences = readPreferencesFile(projectFilePath);
   const projectKeys = Object.keys(projectPreferences);
   if (projectKeys.length === 0) {
@@ -6714,17 +6849,17 @@ var MUGGLE_HOME_DISPLAY_DIR = "~/.muggle-ai";
 
 // packages/mcps/src/shared/cwd-keyed-cache.ts
 function resolveHomeFilePath(cache) {
-  return path10.join(getDataDir(), cache.fileName);
+  return path11.join(getDataDir(), cache.fileName);
 }
 function resolveLegacyFilePath(cache, cwd) {
-  return path10.join(cwd, LEGACY_CACHE_DIR_NAME, cache.fileName);
+  return path11.join(cwd, LEGACY_CACHE_DIR_NAME, cache.fileName);
 }
 function parseJsonFile(filePath) {
   try {
-    if (!fs5.existsSync(filePath)) {
+    if (!fs6.existsSync(filePath)) {
       return null;
     }
-    return JSON.parse(fs5.readFileSync(filePath, "utf-8"));
+    return JSON.parse(fs6.readFileSync(filePath, "utf-8"));
   } catch (error) {
     getLogger().warn("Failed to read cache file", {
       path: filePath,
@@ -6738,12 +6873,12 @@ function readHomeEntries(cache) {
   return parsed?.entries ?? {};
 }
 function writeHomeEntries(cache, entries) {
-  fs5.mkdirSync(getDataDir(), { recursive: true });
+  fs6.mkdirSync(getDataDir(), { recursive: true });
   const file = {
     version: CWD_KEYED_CACHE_VERSION,
     entries
   };
-  fs5.writeFileSync(
+  fs6.writeFileSync(
     resolveHomeFilePath(cache),
     `${JSON.stringify(file, null, 2)}
 `,
@@ -6757,7 +6892,7 @@ function readLegacyEntry(cache, cwd) {
   return parsed?.[cache.legacyEntryKey] ?? null;
 }
 function readCwdEntry(cache, cwd) {
-  const cwdKey = path10.resolve(cwd);
+  const cwdKey = path11.resolve(cwd);
   const entries = readHomeEntries(cache);
   const homeEntry = entries[cwdKey];
   if (homeEntry) {
@@ -6779,18 +6914,18 @@ function readCwdEntry(cache, cwd) {
 }
 function writeCwdEntry(cache, cwd, entry) {
   const entries = readHomeEntries(cache);
-  writeHomeEntries(cache, { ...entries, [path10.resolve(cwd)]: entry });
+  writeHomeEntries(cache, { ...entries, [path11.resolve(cwd)]: entry });
 }
 function clearCwdEntry(cache, cwd) {
   const entries = readHomeEntries(cache);
-  const cwdKey = path10.resolve(cwd);
+  const cwdKey = path11.resolve(cwd);
   if (cwdKey in entries) {
     delete entries[cwdKey];
     writeHomeEntries(cache, entries);
   }
   const legacyFilePath = resolveLegacyFilePath(cache, cwd);
-  if (fs5.existsSync(legacyFilePath)) {
-    fs5.unlinkSync(legacyFilePath);
+  if (fs6.existsSync(legacyFilePath)) {
+    fs6.unlinkSync(legacyFilePath);
   }
 }
 
@@ -6955,7 +7090,7 @@ var runResultGetTool = {
       const testScript = storage.getTestScript(storedRunResult.testScriptId);
       testScriptSteps = testScript?.actionScript?.length;
     }
-    if (storedRunResult.artifactsDir && fs5.existsSync(storedRunResult.artifactsDir)) {
+    if (storedRunResult.artifactsDir && fs6.existsSync(storedRunResult.artifactsDir)) {
       contentParts.push(
         "",
         "### Artifacts (view action script + screenshots)",
@@ -6963,26 +7098,26 @@ var runResultGetTool = {
         `**Location:** \`${storedRunResult.artifactsDir}\``,
         ""
       );
-      const actionScriptPath = path10.join(storedRunResult.artifactsDir, "action-script.json");
-      const resultsMdPath = path10.join(storedRunResult.artifactsDir, "results.md");
-      const screenshotsDir = path10.join(storedRunResult.artifactsDir, "screenshots");
-      const stdoutLogPath = path10.join(storedRunResult.artifactsDir, "stdout.log");
-      const stderrLogPath = path10.join(storedRunResult.artifactsDir, "stderr.log");
+      const actionScriptPath = path11.join(storedRunResult.artifactsDir, "action-script.json");
+      const resultsMdPath = path11.join(storedRunResult.artifactsDir, "results.md");
+      const screenshotsDir = path11.join(storedRunResult.artifactsDir, "screenshots");
+      const stdoutLogPath = path11.join(storedRunResult.artifactsDir, "stdout.log");
+      const stderrLogPath = path11.join(storedRunResult.artifactsDir, "stderr.log");
       const artifactItems = [];
-      if (fs5.existsSync(actionScriptPath)) {
+      if (fs6.existsSync(actionScriptPath)) {
         artifactItems.push("- `action-script.json` \u2014 generated test steps");
       }
-      if (fs5.existsSync(resultsMdPath)) {
+      if (fs6.existsSync(resultsMdPath)) {
         artifactItems.push("- `results.md` \u2014 step-by-step report with screenshot links");
       }
-      if (fs5.existsSync(screenshotsDir)) {
-        const screenshots = fs5.readdirSync(screenshotsDir).filter((f) => /\.(png|jpg|jpeg|webp)$/i.test(f));
+      if (fs6.existsSync(screenshotsDir)) {
+        const screenshots = fs6.readdirSync(screenshotsDir).filter((f) => /\.(png|jpg|jpeg|webp)$/i.test(f));
         artifactItems.push(`- \`screenshots/\` \u2014 ${screenshots.length} image(s)`);
       }
-      if (fs5.existsSync(stdoutLogPath)) {
+      if (fs6.existsSync(stdoutLogPath)) {
         artifactItems.push("- `stdout.log` \u2014 electron-app stdout output");
       }
-      if (fs5.existsSync(stderrLogPath)) {
+      if (fs6.existsSync(stderrLogPath)) {
         artifactItems.push("- `stderr.log` \u2014 electron-app stderr output");
       }
       if (artifactItems.length > 0) {
@@ -7633,4 +7768,4 @@ var WATCHER_LIFETIME_SECONDS = {
   ["never" /* Never */]: WATCHER_LIFETIME_UNBOUNDED_SECONDS
 };
 
-export { DEFAULT_PREFERENCES, EventName, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, ServiceName, Surface, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, __export, __require, buildElectronAppChecksumsUrl, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, calculateFileChecksum, createApiKeyWithToken, createChildLogger, deleteApiKeyData, deleteCredentials, e2e_exports2 as e2e_exports, formatPreferencesOneLiner, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDataDir2 as getDataDir, getDisclosureCopy, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppVersion, getElectronAppVersionSource, getLocalQaTools, getLogger, getPlatformKey, getQaTools, getValidApiKeyData, getValidCredentials, hasApiKey, hasShownDisclosure, initTelemetry, isElectronAppInstalled, isFirstRun, loadApiKeyData, loadCredentials, local_exports2 as local_exports, markDisclosureShown, mcp_exports, openBrowserUrl, performLogin, performLogout, pollDeviceCode, reconcileProjectPreferences, resetConfig, resetLogger, resetPreference, resolveElectronAppPathOrNull, resolvePreferences, saveApiKey, saveApiKeyData, saveCredentials, src_exports, startDeviceCodeFlow, toolRequiresAuth, track, validatePreference, verifyFileChecksum, writePreferences2 as writePreferences };
+export { DEFAULT_PREFERENCES, ElectronAppReleaseStream, EventName, PREFERENCES_FILE_NAME, PREFERENCES_PROJECT_DIR_NAME, PREFERENCES_SCHEMA, PREFERENCES_VERSION, PREFERENCE_ALLOWED_VALUES, PreferenceKey, PreferenceValue, ProjectPreferencesReconcileOutcome, RuntimeTarget, ServiceName, Surface, WATCHER_LIFETIME_SECONDS, WATCHER_LIFETIME_UNBOUNDED_SECONDS, __export, __require, assertDeviceCodeClientProvisioned, buildElectronAppChecksumsUrl, buildElectronAppReleaseAssetUrl, buildElectronAppReleaseTag, calculateFileChecksum, createApiKeyWithToken, createChildLogger, deleteApiKeyData, deleteCredentials, e2e_exports2 as e2e_exports, formatPreferencesOneLiner, getActiveElectronAppReleaseStream, getActiveRuntimeTarget, getApiKey, getApiKeyFilePath, getAuthService, getBundledElectronAppVersion, getCallerCredentials, getCallerCredentialsAsync, getChecksumForPlatform, getConfig, getCredentialsFilePath, getDataDir2 as getDataDir, getDisclosureCopy, getDownloadBaseUrl, getElectronAppChecksums, getElectronAppDir, getElectronAppReleaseTagPrefix, getElectronAppSignedFromVersion, getElectronAppVersion, getElectronAppVersionSource, getLocalQaTools, getLogger, getPlatformKey, getQaTools, getReleaseSignerIdentityUri, getValidApiKeyData, getValidCredentials, hasApiKey, hasShownDisclosure, initTelemetry, isElectronAppInstalled, isFirstRun, loadApiKeyData, loadCredentials, local_exports2 as local_exports, markDisclosureShown, mcp_exports, openBrowserUrl, performLogin, performLogout, pollDeviceCode, reconcileProjectPreferences, resetConfig, resetLogger, resetPreference, resolveActiveProfile, resolveActiveReleaseStream, resolveActiveReleaseTagPrefix, resolveElectronAppPathOrNull, resolvePreferences, resolveRuntimeTarget, saveApiKey, saveApiKeyData, saveCredentials, src_exports, startDeviceCodeFlow, toolRequiresAuth, track, validatePreference, verifyFileChecksum, writePreferences2 as writePreferences };