@opencode/browse 0.0.6-dev.18 → 0.0.6-dev.19

package/dist/{main-fkhwazsm.mjs → main-90enpn5q.mjs}

@@ -1,1667 +1,1843 @@
-import {
-  isNodeError,
-  writeJsonFileAtomically
-} from "./main-9y22cffn.mjs";
 import {
   dataRoot,
   cliCommand
-} from "./main-ha5bnd77.mjs";
+} from "./main-yd50d95g.mjs";
+import {
+  parseTargetSelection2,
+  getObject2,
+  getString2
+} from "./main-8a245rm1.mjs";
+import {
+  isNodeError,
+  writeJsonFileAtomically
+} from "./main-75rdz6bc.mjs";
 
-// src/site-secrets.ts
-import crypto from "node:crypto";
-import fs2 from "node:fs/promises";
-import path2 from "node:path";
-import { Effect as Effect2, Schema as Schema2 } from "effect";
+// src/relay/user-settings.ts
+var settingKeys = ["window", "grouping", "idleMinutes", "cursor", "humanInput", "handoffNotifications", "autoUpdate"];
+var relaySettingKeys = ["autoUpdate"];
+var settingSpecs = {
+  window: { label: "Where agents open their tabs (current: the user's window; separate: an unfocused window of their own)", values: ["current", "separate"], variable: "OPENCODE_BROWSER_AGENT_WINDOW" },
+  grouping: { label: "How agent tabs are grouped (one group per session, one shared group, or none)", values: ["session", "shared", "none"] },
+  idleMinutes: { label: "Close agent tabs untouched for this many minutes", values: [10, 30, 60, "never"] },
+  cursor: { label: "Agent cursor on agent tabs outside recordings (pages can detect it)", values: ["off", "always"], variable: "OPENCODE_BROWSER_GHOST_CURSOR" },
+  humanInput: { label: "Human-like input (off is faster, but easier for sites to flag)", values: ["on", "off"], variable: "OPENCODE_BROWSER_HUMAN_INPUT" },
+  handoffNotifications: { label: "System notification on a handoff (only while recorded, or every handoff)", values: ["recording", "always"] },
+  autoUpdate: { label: "npm installs: install updates automatically when idle, only notify, or never check", values: ["on", "notify", "off"], variable: "OPENCODE_BROWSER_AUTO_UPDATE" }
+};
+var securityVariables = [
+  "OPENCODE_BROWSER_ALLOW_NODE",
+  "OPENCODE_BROWSER_ALLOW_ALL_COOKIES",
+  "OPENCODE_BROWSER_ALLOW_FOREGROUND",
+  "OPENCODE_BROWSER_ALLOW_ALL_STORAGE",
+  "OPENCODE_BROWSER_ALLOW_FILE_URLS",
+  "OPENCODE_BROWSER_UPDATE_CHECK"
+];
 
-// src/auth-profile.ts
-import { Effect, Schema, Semaphore } from "effect";
-import { spawn } from "node:child_process";
-import fs from "node:fs/promises";
-import path from "node:path";
+class SettingsInputError extends Error {
+}
+var allowed = (key) => settingSpecs[key].values.map(String).join(", ");
+function parseSettingChanges(input) {
+  if (input === null || typeof input !== "object" || Array.isArray(input))
+    throw new SettingsInputError('Pass the settings to change as an object, for example { grouping: "shared" }.');
+  const problems = [];
+  const changes = {};
+  for (const [key, raw] of Object.entries(input)) {
+    if (!settingKeys.includes(key)) {
+      problems.push(/allow|update|security|node|cookie|foreground|storage|file/i.test(key) ? `"${key}" is not a setting: security switches (${securityVariables.join(", ")}) are set only in the relay's environment, never here.` : `Unknown setting "${key}". Settings: ${settingKeys.join(", ")}.`);
+      continue;
+    }
+    const setting = key;
+    const value = setting === "idleMinutes" ? idleValue(raw) : raw;
+    if (value === undefined || !settingSpecs[setting].values.includes(value)) {
+      problems.push(`${setting} must be one of ${allowed(setting)} (got ${JSON.stringify(raw)}).`);
+      continue;
+    }
+    changes[setting] = value;
+  }
+  if (problems.length)
+    throw new SettingsInputError(problems.join(" "));
+  if (!Object.keys(changes).length)
+    throw new SettingsInputError(`Nothing to change. Settings: ${settingKeys.join(", ")}.`);
+  return changes;
+}
+function idleValue(raw) {
+  if (raw === "never" || raw === 0 || raw === "0")
+    return "never";
+  if (typeof raw === "number")
+    return raw;
+  if (typeof raw === "string" && /^\d+$/.test(raw))
+    return Number(raw);
+  return;
+}
+function settingsFromExtension(wire) {
+  const values = wire && typeof wire.settings === "object" && wire.settings !== null && !Array.isArray(wire.settings) ? wire.settings : undefined;
+  if (!values)
+    throw new Error("The extension answered settings without them");
+  const settings = {};
+  for (const key of settingKeys) {
+    const value = values[key];
+    if (relaySettingKeys.includes(key))
+      settings[key] = String(settingSpecs[key].values[0]);
+    else if (key === "idleMinutes")
+      settings[key] = value === 0 ? "never" : typeof value === "number" ? value : 10;
+    else
+      settings[key] = typeof value === "string" ? value : String(settingSpecs[key].values[0]);
+  }
+  return settings;
+}
+function settingsToExtension(changes) {
+  return Object.fromEntries(Object.entries(changes).filter(([key]) => !relaySettingKeys.includes(key)).map(([key, value]) => [key, key === "idleMinutes" && value === "never" ? 0 : value]));
+}
+function report(stored, overrides) {
+  return Object.fromEntries(settingKeys.map((key) => {
+    const override = overrides[key];
+    return [key, {
+      value: stored[key],
+      effective: override?.value ?? stored[key],
+      allowed: settingSpecs[key].values,
+      description: settingSpecs[key].label,
+      ...override ? { overriddenBy: override.variable } : {}
+    }];
+  }));
+}
+var securityNote = `Security switches (${securityVariables.join(", ")}) are environment-only and can't be read or changed here.`;
+function describeSettings(stored, overrides) {
+  return { settings: report(stored, overrides), note: securityNote };
+}
+function describeChanges(options) {
+  const changed = [];
+  const unchanged = [];
+  const overridden = [];
+  for (const [key, value] of Object.entries(options.requested)) {
+    const override = options.overrides[key];
+    if (override)
+      overridden.push({ key, requested: value, variable: override.variable, effective: override.value });
+    else if (options.before[key] === options.after[key])
+      unchanged.push(key);
+    else
+      changed.push({ key, from: options.before[key], to: options.after[key] });
+  }
+  const lines = [];
+  if (changed.length)
+    lines.push(`Changed ${changed.map((item) => `${item.key} from ${item.from} to ${item.to}`).join(", ")}. Tell the user what you changed; they can change it back on the extension's options page.`);
+  if (unchanged.length)
+    lines.push(`Already set: ${unchanged.map((key) => `${key} is ${options.after[key]}`).join(", ")}.`);
+  for (const item of overridden)
+    lines.push(`Not changed: ${item.key} is fixed to ${item.effective} by ${item.variable} in the relay's environment, so this setting has no effect. Tell the user; to change it they remove or edit ${item.variable} where opencode starts, then run \`${cliCommand("relay restart")}\`.`);
+  return { changed, unchanged, overridden, settings: report(options.after, options.overrides), message: lines.join(" ") };
+}
+function formatSettings(settings) {
+  const width = Math.max(...settingKeys.map((key) => key.length));
+  return settingKeys.map((key) => {
+    const item = settings[key];
+    const override = item.overriddenBy ? `  (in effect: ${item.effective}, set by ${item.overriddenBy} on the relay)` : "";
+    return `${key.padEnd(width)}  ${String(item.value).padEnd(9)}  one of ${item.allowed.join(", ")}${override}`;
+  });
+}
 
-// src/child-process.ts
-async function terminateChildProcess(options) {
-  const isExited = options.isExited ?? (() => options.child.exitCode !== null || options.child.signalCode !== null);
-  if (isExited())
+// src/mcp/schema.ts
+import { Effect, Predicate } from "effect";
+import { McpSchema } from "effect/ai";
+function browsersNote2(browsers) {
+  if (browsers.length < 2)
+    return "";
+  const list = browsers.map((browser) => `${browser.id} (${browser.name}${browser.default ? ", default" : ""})`).join(", ");
+  return ` Connected browsers: ${list}. Pass browser to use one other than the default.`;
+}
+function mcpUpdateNote2(notice) {
+  return `Note: Browse has an update: ${notice.summary}. Tell the user they can run \`${notice.command}\` and then restart opencode, or ask you to run it for them.`;
+}
+function objectSchema(properties, required = []) {
+  return {
+    type: "object",
+    properties,
+    required: [...required],
+    additionalProperties: false
+  };
+}
+var emptyInputSchema = objectSchema({});
+var sessionSchemaProperty = {
+  type: "string",
+  description: "Optional session id. Defaults to this MCP server's current session."
+};
+var sessionAliasSchemaProperty = { type: "string", description: "Same as id." };
+var sessionOnlyInputSchema = objectSchema({
+  session: sessionSchemaProperty
+});
+var ensureSessionExists = Effect.fnUntraced(function* (relay, id) {
+  const sessions = yield* relay.sessions;
+  const exists = sessions.some((session) => {
+    return session.id === id;
+  });
+  if (!exists) {
+    return yield* Effect.fail(new Error(`Session not found: ${id}`));
+  }
+});
+function parseExecuteArguments(input) {
+  const object = requireObject(input);
+  const code = requiredStringField(object, "code");
+  const session = optionalStringField(object, "session");
+  const timeoutMs = optionalNonNegativeIntegerField(object, "timeoutMs");
+  const targetSelection = parseMcpTargetSelection(object);
+  const browser = optionalStringField(object, "browser");
+  return {
+    code,
+    ...session ? { session } : {},
+    ...timeoutMs === undefined ? {} : { timeoutMs },
+    ...targetSelection ? { targetSelection } : {},
+    ...browser ? { browser } : {}
+  };
+}
+function parseAdoptArguments(input) {
+  const object = requireObject(input);
+  const session = optionalStringField(object, "session");
+  const targetSelection = parseMcpTargetSelection(object);
+  const tabId = typeof object.tabId === "number" && Number.isInteger(object.tabId) ? object.tabId : undefined;
+  if (tabId !== undefined && targetSelection)
+    throw new Error("Use only one of tabId, targetUrl, or targetIndex");
+  return {
+    ...session ? { session } : {},
+    ...targetSelection ? { targetSelection } : {},
+    ...tabId === undefined ? {} : { tabId }
+  };
+}
+function parseMcpTargetSelection(input) {
+  const urlIncludes = optionalStringField(input, "targetUrl");
+  const selection = parseTargetSelection2({
+    ...urlIncludes ? { urlIncludes } : {},
+    ...input.targetIndex === undefined ? {} : { index: input.targetIndex }
+  });
+  return selection?.urlIncludes || selection?.index !== undefined ? selection : undefined;
+}
+function requiredStringField(input, field) {
+  const value = optionalStringField(input, field);
+  if (!value) {
+    throw new Error(`${field} is required`);
+  }
+  return value;
+}
+function optionalStringField(input, field) {
+  const value = getString2(requireObject(input), field);
+  return value ? value : undefined;
+}
+function optionalBooleanField(input, field) {
+  const value = requireObject(input)[field];
+  return Predicate.isBoolean(value) ? value : undefined;
+}
+function optionalPositiveIntegerField(input, field) {
+  const value = requireObject(input)[field];
+  if (value === undefined)
     return;
-  signalChildProcess(options.child, "SIGTERM");
-  let timeout;
-  await Promise.race([
-    options.exit,
-    new Promise((resolve) => {
-      timeout = setTimeout(resolve, options.graceMs);
-    })
-  ]);
-  if (timeout)
-    clearTimeout(timeout);
-  if (isExited())
+  if (!Predicate.isNumber(value) || !Number.isInteger(value) || value <= 0) {
+    throw new Error(`${field} must be a positive integer`);
+  }
+  return value;
+}
+function optionalNonNegativeIntegerField(input, field) {
+  const value = requireObject(input)[field];
+  if (value === undefined)
     return;
-  signalChildProcess(options.child, "SIGKILL");
-  await options.exit;
+  if (!Predicate.isNumber(value) || !Number.isInteger(value) || value < 0) {
+    throw new Error(`${field} must be a non-negative integer`);
+  }
+  return value;
 }
-function signalChildProcess(child, signal) {
-  if (process.platform !== "win32" && child.pid !== undefined) {
-    try {
-      process.kill(-child.pid, signal);
-      return;
-    } catch {}
+function optionalStringArrayField(input, field) {
+  const value = requireObject(input)[field];
+  if (value === undefined)
+    return;
+  if (!Array.isArray(value) || !value.every((item) => Predicate.isString(item) && item.length > 0)) {
+    throw new Error(`${field} must be an array of non-empty strings`);
   }
-  child.kill(signal);
+  return value;
 }
-
-// src/network-redaction.ts
-import { Predicate } from "effect";
-var secretNamePattern = /auth(?:orization)?|cookie|credential|csrf|xsrf|token|secret|session|password|passwd|pwd|passcode|otp|(?:^|[-_.])code(?:$|[-_.])|(?:api|access|refresh)[-_.]?key|signature|(?:^|[-_.])sig(?:$|[-_.])/i;
-var oneTimeFieldPattern = /pass(?:word|wd|code|phrase)|(?:^|[-_.])pwd(?:$|[-_.])|otp|totp|(?:^|[-_.])(?:mfa_?|2fa_?|verification_?|auth_?)?code(?:$|[-_.])|(?:^|[-_.])pin(?:$|[-_.])/i;
-var referencePattern = String.raw`BC_(?:SECRET|REDACTED)_\d+`;
-var secretHeaders = new Set([
-  "authorization",
-  "proxy-authorization",
-  "x-api-key",
-  "api-key",
-  "x-csrf-token",
-  "csrf-token",
-  "x-xsrf-token"
-]);
-
-class SecretCollector {
-  slotsByRef = new Map;
-  refsByValue = new Map;
-  refsBySource = new Map;
-  retiredRefsByValue = new Map;
-  redactedRefsByValue = new Map;
-  nextRedactedRef = 1;
-  nextRef = 1;
-  updated = new Set;
-  observed = new Set;
-  constructor(existing = []) {
-    for (const slot of existing) {
-      const copy = {
-        ref: slot.ref,
-        value: slot.value,
-        sources: [...slot.sources],
-        ...slot.expiresAt ? { expiresAt: slot.expiresAt } : {}
-      };
-      this.slotsByRef.set(copy.ref, copy);
-      this.refsByValue.set(copy.value, copy.ref);
-      for (const source of copy.sources) {
-        this.refsBySource.set(source, copy.ref);
-      }
-      const number = /^BC_SECRET_(\d+)$/.exec(copy.ref)?.[1];
-      if (number)
-        this.nextRef = Math.max(this.nextRef, Number(number) + 1);
-    }
+function requireObject(input) {
+  const object = getObject2(input);
+  if (!object) {
+    throw new Error("Expected arguments object");
   }
-  protectHeaders(headers, location, requestScope = "") {
-    const occurrences = new Map;
-    return headers.map(({ name, value }) => {
-      const lowerName = name.toLowerCase();
-      const occurrence = occurrences.get(lowerName) ?? 0;
-      occurrences.set(lowerName, occurrence + 1);
-      return {
-        name,
-        value: this.protectHeader(name, value, sourceName(requestScope, `${location}.header.${lowerName}`, occurrence))
-      };
+  return object;
+}
+function stringifyResult(value) {
+  if (Predicate.isString(value)) {
+    return value;
+  }
+  return JSON.stringify(value, null, 2);
+}
+function toolResultForValue2(value) {
+  const object = getObject2(value);
+  const isError = object?.isError === true;
+  const media = Array.isArray(object?.media) ? object.media.flatMap((item) => {
+    const image = getObject2(item);
+    const mimeType = getString2(image, "mimeType");
+    const data = getString2(image, "data");
+    return image?.type === "image" && mimeType !== undefined && data !== undefined ? [{ data, mimeType }] : [];
+  }) : [];
+  const errorText = isError ? getString2(object, "text") : undefined;
+  if (media.length > 0) {
+    const { media: _media, ...structuredContent } = object ?? {};
+    const text = errorText ?? stringifyResult(structuredContent);
+    return new McpSchema.CallToolResult({
+      content: [
+        McpSchema.TextContent.make({ text }),
+        ...media.map((image) => McpSchema.ImageContent.make({
+          data: new Uint8Array(Buffer.from(image.data, "base64")),
+          mimeType: image.mimeType
+        }))
+      ],
+      structuredContent,
+      isError
     });
   }
-  protectUrl(rawUrl, requestScope = "") {
-    const fragmentStart = rawUrl.indexOf("#");
-    const base = fragmentStart < 0 ? rawUrl : rawUrl.slice(0, fragmentStart);
-    const protectQuery = (name, value, occurrence) => this.reference(value, sourceName(requestScope, `query.${name}`, occurrence));
-    const protectPath = (pathname) => protectPathSegments(pathname, (segment) => this.redactionReference(segment));
-    let protectedUrl;
-    try {
-      const url = new URL(base);
-      url.pathname = protectPath(url.pathname);
-      url.search = protectSearchParams(url.searchParams, protectQuery).toString();
-      protectedUrl = restoreReferencePlaceholders(url.toString());
-    } catch {
-      protectedUrl = protectRelativeUrl(base, protectQuery, protectPath);
-    }
-    if (fragmentStart < 0)
-      return protectedUrl;
-    const fragment = protectFragment(rawUrl.slice(fragmentStart + 1), (name, value, occurrence) => this.reference(value, sourceName(requestScope, `fragment.${name}`, occurrence)));
-    return `${protectedUrl}#${fragment}`;
+  const text = errorText ?? stringifyResult(value);
+  return toolResult({ text, ...object ? { structuredContent: object } : {}, isError });
+}
+function mcpErrorMessage2(tool, message) {
+  if (!message.startsWith("Session not found:")) {
+    return message;
   }
-  protectBody(body, contentType, location, requestScope = "") {
-    const type = contentType?.toLowerCase() ?? "";
-    if (type.includes("json")) {
-      try {
-        return JSON.stringify(this.protectJson(JSON.parse(body), sourceName(requestScope, location)));
-      } catch {
-        return;
-      }
-    }
-    if (type.includes("application/x-www-form-urlencoded")) {
-      const protectedParams = protectSearchParams(new URLSearchParams(body), (name, value, occurrence) => this.reference(value, sourceName(requestScope, `${location}.form.${name}`, occurrence)));
-      return restoreReferencePlaceholders(protectedParams.toString());
-    }
-    if (type.includes("multipart/form-data")) {
-      return this.protectMultipart(body, contentType ?? "", location, requestScope);
-    }
-    return;
-  }
-  slots() {
-    return Array.from(this.slotsByRef.values()).sort((left, right) => left.ref.localeCompare(right.ref, undefined, { numeric: true })).map((slot) => ({ ...slot, sources: [...slot.sources] }));
-  }
-  updatedRefs() {
-    return Array.from(this.updated).sort();
+  return tool === "execute" || tool === "session_adopt" ? `${message} Create it with session_new first, or omit the explicit session id to use the MCP current session.` : `${message} Create it with session_new first.`;
+}
+function toolResult(options) {
+  return new McpSchema.CallToolResult({
+    content: [McpSchema.TextContent.make({ text: options.text })],
+    structuredContent: options.structuredContent,
+    isError: options.isError
+  });
+}
+
+// src/auth/deadbolt.ts
+import { spawn, spawnSync } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+class DeadboltError extends Error {
+  name = "DeadboltError";
+  code;
+  detail;
+  constructor(code, message, detail = {}) {
+    super(message);
+    this.code = code;
+    this.detail = detail;
   }
-  observedRefs() {
-    return Array.from(this.observed).sort();
+}
+var clientFileName = "deadbolt-client.json";
+function clientFilePath(root = dataRoot()) {
+  return path.join(root, clientFileName);
+}
+function readClientFile(root = dataRoot()) {
+  let text;
+  try {
+    const file = clientFilePath(root);
+    const stat = fs.statSync(file);
+    if (process.platform !== "win32" && (stat.mode & 63) !== 0)
+      fs.chmodSync(file, 384);
+    text = fs.readFileSync(file, "utf8");
+  } catch {
+    return;
   }
-  redactText(text) {
-    return redactKnownValues(text, this.redactionSlots());
+  try {
+    const value = JSON.parse(text);
+    if (typeof value.id !== "string" || !value.id || typeof value.token !== "string" || !value.token)
+      return;
+    return {
+      version: 1,
+      id: value.id,
+      token: value.token,
+      connectedAt: typeof value.connectedAt === "string" ? value.connectedAt : ""
+    };
+  } catch {
+    return;
   }
-  redactValue(value) {
-    return redactKnownValue(value, this.redactionSlots());
+}
+function readClient(root = dataRoot()) {
+  const file = readClientFile(root);
+  return file ? { id: file.id, token: file.token } : undefined;
+}
+async function saveClient(client, root = dataRoot()) {
+  const value = { version: 1, id: client.id, token: client.token, connectedAt: new Date().toISOString() };
+  await writeJsonFileAtomically(clientFilePath(root), value, { dirMode: 448 });
+}
+function removeClient(root = dataRoot()) {
+  const file = clientFilePath(root);
+  if (!fs.existsSync(file))
+    return false;
+  fs.rmSync(file, { force: true });
+  return true;
+}
+function computedSocketPath(env = process.env) {
+  const nonEmpty = (name) => env[name] ? env[name] : undefined;
+  const deadboltHome = nonEmpty("DEADBOLT_HOME");
+  const suffix = deadboltHome ? `-${blake3Hex(Buffer.from(deadboltHome, "utf8")).slice(0, 8)}` : "";
+  const uid = typeof process.getuid === "function" ? process.getuid() : 0;
+  const runtime = nonEmpty("XDG_RUNTIME_DIR") ?? userRuntimeDir(uid);
+  const directory = runtime ? path.join(runtime, `deadbolt${suffix}`) : path.join(nonEmpty("TMPDIR") ?? os.tmpdir(), `deadbolt${suffix}-${uid}`);
+  return path.join(directory, "agent.sock");
+}
+function userRuntimeDir(uid) {
+  const directory = `/run/user/${uid}`;
+  try {
+    const stat = fs.statSync(directory);
+    return stat.isDirectory() && stat.uid === uid ? directory : undefined;
+  } catch {
+    return;
   }
-  redactExactValue(value, minimumLength) {
-    if (!Predicate.isString(value) && !Predicate.isNumber(value) && !Predicate.isBoolean(value))
-      return value;
-    const serialized = String(value);
-    if (serialized.length < minimumLength)
-      return value;
-    const ref = this.refsByValue.get(serialized) ?? this.retiredRefsByValue.get(serialized) ?? this.redactedRefsByValue.get(serialized);
-    return ref ? `\${${ref}}` : value;
+}
+function socketPath(options = {}) {
+  const env = options.env ?? process.env;
+  return env.OPENCODE_BROWSER_DEADBOLT_SOCKET || computedSocketPath(env);
+}
+var requestTimeoutMs = 15000;
+var maxReplyBytes = 4 * 1024 * 1024;
+function errorCode(code) {
+  const normalized = typeof code === "string" ? code.replace(/-/g, "_") : "";
+  switch (normalized) {
+    case "locked":
+    case "not_granted":
+    case "forbidden":
+    case "rate_limited":
+    case "domain_mismatch":
+    case "not_found":
+    case "choose_passkey":
+      return normalized;
+    case "not_initialized":
+      return "locked";
+    default:
+      return "failed";
   }
-  redactKnownSubstrings(text, minimumLength) {
-    const slots = this.redactionSlots().filter((slot) => slot.value.length >= minimumLength);
-    const encoded = slots.flatMap((slot) => {
-      const variant = encodeURIComponent(slot.value);
-      return variant === slot.value ? [] : [{ ref: slot.ref, value: variant }];
+}
+var errorHints = {
+  locked: "Deadbolt is locked, so agent sign-ins are paused until the user unlocks it.",
+  forbidden: "Deadbolt doesn't know this Browse install (its client was removed or revoked). Ask the user to run `opencode-browser deadbolt connect`.",
+  rate_limited: "Deadbolt is rate-limiting this client; wait before trying again."
+};
+function rawRequest(socket, request, timeoutMs = requestTimeoutMs) {
+  return new Promise((resolve, reject) => {
+    const connection = net.createConnection(socket);
+    let buffer = "";
+    let settled = false;
+    const finish = (error, value) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      connection.destroy();
+      if (error)
+        reject(error);
+      else
+        resolve(value);
+    };
+    const timer = setTimeout(() => finish(new DeadboltError("unavailable", `Deadbolt did not answer ${String(request.cmd)} within ${timeoutMs} ms`)), timeoutMs);
+    connection.setEncoding("utf8");
+    connection.on("connect", () => connection.write(`${JSON.stringify(request)}
+`));
+    connection.on("error", (cause) => {
+      const missing = cause.code === "ENOENT" || cause.code === "ECONNREFUSED";
+      finish(new DeadboltError("unavailable", missing ? "Deadbolt isn't running (no agent socket). Ask the user to start or unlock Deadbolt." : `Could not reach Deadbolt: ${cause.message}`));
     });
-    return redactKnownValues(text, [...slots, ...encoded]);
-  }
-  redactionSlots() {
-    return [
-      ...this.slotsByRef.values(),
-      ...Array.from(this.retiredRefsByValue, ([value, ref]) => ({ ref, value })),
-      ...Array.from(this.redactedRefsByValue, ([value, ref]) => ({ ref, value }))
-    ];
-  }
-  addRedactionOnly(value) {
-    if (value)
-      this.redactionReference(value);
-  }
-  redactValuesEverywhere(text, values) {
-    const slots = [];
-    for (const value of values) {
-      if (!value)
-        continue;
-      const ref = /^\$\{(.+)\}$/.exec(this.redactionReference(value))?.[1] ?? "BC_REDACTED_0";
-      for (const variant of new Set([value, encodeURIComponent(value), new URLSearchParams({ v: value }).toString().slice(2)])) {
-        slots.push({ ref, value: variant });
+    connection.on("data", (chunk) => {
+      buffer += chunk;
+      if (buffer.length > maxReplyBytes)
+        return finish(new DeadboltError("failed", "Deadbolt's reply was too large"));
+      let newline;
+      while ((newline = buffer.indexOf(`
+`)) !== -1) {
+        const line = buffer.slice(0, newline).trim();
+        buffer = buffer.slice(newline + 1);
+        if (!line)
+          continue;
+        let message;
+        try {
+          message = JSON.parse(line);
+        } catch {
+          return finish(new DeadboltError("failed", "Deadbolt sent a reply that isn't JSON"));
+        }
+        if (message.type === "ok")
+          return finish(undefined, message.reply ?? {});
+        if (message.type === "error") {
+          const code = errorCode(message.code);
+          const text = typeof message.message === "string" ? message.message : String(message.code);
+          const detail = message.grant ?? {};
+          const choices = passkeyList(message.choices ?? message.passkeys);
+          return finish(new DeadboltError(code, errorHints[code] ? `${text.replace(/[\s.]*$/, ".")} ${errorHints[code]}` : text, {
+            ...typeof detail.site === "string" ? { site: detail.site } : {},
+            ...typeof detail.login === "string" ? { login: detail.login } : {},
+            ...choices.length > 0 ? { choices } : {}
+          }));
+        }
       }
-    }
-    return redactKnownValues(text, slots);
+    });
+    connection.on("end", () => finish(new DeadboltError("failed", "Deadbolt closed the connection without a reply")));
+  });
+}
+var str = (value) => typeof value === "string" ? value : undefined;
+function passkeyList(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.filter((entry) => entry !== null && typeof entry === "object").map((entry) => {
+    const username = str(entry.username);
+    const displayName = str(entry.display_name) ?? str(entry.displayName);
+    return { ref: entry.ref ?? entry.login, ...username ? { username } : {}, ...displayName ? { displayName } : {}, granted: entry.granted !== false };
+  });
+}
+function toLogin(raw) {
+  const signIn = raw.sign_in;
+  const fields = Array.isArray(raw.fields) ? raw.fields.filter((field) => typeof field === "string") : undefined;
+  const username = str(raw.username);
+  return {
+    ref: raw.ref ?? raw.login,
+    title: str(raw.title) ?? "",
+    ...username ? { username } : {},
+    hasPassword: raw.has_password === true,
+    hasTotp: raw.has_totp === true || raw.has_otp === true,
+    hasPasskey: raw.has_passkey === true,
+    granted: fields !== undefined && fields.length > 0 || raw.passkeys === true,
+    passkeys: raw.passkeys === true,
+    ...fields ? { fields } : {},
+    ...signIn && typeof signIn.provider === "string" ? { signIn: { provider: signIn.provider, ...str(signIn.account) ? { account: str(signIn.account) } : {} } } : {}
+  };
+}
+function connect(options = {}) {
+  const client = options.client ?? readClient(options.root);
+  if (!client) {
+    throw new DeadboltError("not_connected", "Browse isn't connected to Deadbolt. Ask the user to run `opencode-browser deadbolt connect` and to allow the logins agents may use with `deadbolt agents allow <site>`.");
   }
-  redactionReference(value) {
-    const persisted = this.refsByValue.get(value);
-    if (persisted) {
-      this.observed.add(persisted);
-      return `\${${persisted}}`;
-    }
-    let ref = this.redactedRefsByValue.get(value);
-    if (!ref) {
-      ref = `BC_REDACTED_${this.nextRedactedRef++}`;
-      this.redactedRefsByValue.set(value, ref);
+  const socket = options.socket ?? socketPath();
+  let protocol;
+  const version = async () => {
+    if (protocol === undefined) {
+      const status = await rawRequest(socket, { v: 0, cmd: "status" });
+      protocol = typeof status.protocol === "number" ? status.protocol : 0;
     }
-    return `\${${ref}}`;
-  }
-  protectHeader(name, value, source) {
-    if (!value)
-      return value;
-    const lower = name.toLowerCase();
-    if (lower === "cookie" || lower === "set-cookie") {
-      const cookieOccurrences = new Map;
-      return value.split(/;\s*/).map((part, index) => {
-        const separator = part.indexOf("=");
-        if (separator < 1)
-          return part;
-        const cookieName = part.slice(0, separator).trim();
-        const cookieValue = part.slice(separator + 1);
-        if (lower === "set-cookie" && index > 0 && /^(domain|path|expires|max-age|samesite)$/i.test(cookieName)) {
-          return part;
-        }
-        if (!cookieValue)
-          return part;
-        const occurrence = cookieOccurrences.get(cookieName) ?? 0;
-        cookieOccurrences.set(cookieName, occurrence + 1);
-        return `${cookieName}=${this.reference(cookieValue, sourceName("", `${source}.${cookieName}`, occurrence))}`;
-      }).join("; ");
-    }
-    if (lower === "location" || lower === "referer" || lower === "referrer") {
-      return this.protectUrl(value, `${source}.url`);
-    }
-    if (lower === "authorization" || lower === "proxy-authorization") {
-      const match = /^(\S+)\s+(.+)$/.exec(value);
-      if (match)
-        return `${match[1]} ${this.reference(match[2] ?? "", source)}`;
-    }
-    if (secretHeaders.has(lower) || secretNamePattern.test(lower)) {
-      return this.reference(value, source);
-    }
-    return value;
-  }
-  protectJson(value, location, path = [], inSecret = false) {
-    if (Array.isArray(value)) {
-      return value.map((item, index) => this.protectJson(item, location, [...path, String(index)], inSecret));
-    }
-    if (Predicate.isObject(value)) {
-      return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-        key,
-        this.protectJson(item, location, [...path, key], inSecret || secretNamePattern.test(key))
-      ]));
-    }
-    if (!inSecret || value === null || value === "")
-      return value;
-    return this.reference(String(value), `${location}.json.${path.join(".")}`);
-  }
-  protectMultipart(body, contentType, location, requestScope) {
-    const boundary = /boundary=(?:"([^"]+)"|([^;\s]+))/i.exec(contentType)?.slice(1).find(Boolean);
-    if (!boundary)
-      return;
-    const delimiter = `--${boundary}`;
-    const parts = body.split(delimiter);
-    if (parts.length < 3)
-      return;
-    const occurrences = new Map;
-    for (let index = 1;index < parts.length - 1; index += 1) {
-      const part = parts[index];
-      if (!part?.startsWith(`\r
-`))
-        return;
-      const headerEnd = part.indexOf(`\r
-\r
-`);
-      if (headerEnd < 0 || !part.endsWith(`\r
-`))
-        return;
-      const headers = part.slice(2, headerEnd);
-      const disposition = headers.split(`\r
-`).find((line) => /^content-disposition:/i.test(line));
-      if (!disposition || /;\s*filename\*?=/i.test(disposition))
-        return;
-      const name = /;\s*name="([^"]+)"/i.exec(disposition)?.[1];
-      if (!name)
-        return;
-      const valueStart = headerEnd + 4;
-      const valueEnd = part.length - 2;
-      const value = part.slice(valueStart, valueEnd);
-      if (!value || !secretNamePattern.test(name))
-        continue;
-      const occurrence = occurrences.get(name) ?? 0;
-      occurrences.set(name, occurrence + 1);
-      const reference = this.reference(value, sourceName(requestScope, `${location}.multipart.${name}`, occurrence));
-      parts[index] = `${part.slice(0, valueStart)}${reference}${part.slice(valueEnd)}`;
+    return protocol;
+  };
+  const send = async (cmd, fields) => rawRequest(socket, { v: await version(), cmd, client: { id: client.id, token: client.token }, ...fields });
+  const site = async (origin) => {
+    const reply = await send("agent-logins", { origin });
+    const raw = (Array.isArray(reply.logins) ? reply.logins : []).filter((login) => login !== null && typeof login === "object");
+    const logins = raw.map(toLogin);
+    let passkeys = passkeyList(reply.passkeys);
+    if (!Array.isArray(reply.passkeys)) {
+      passkeys = logins.filter((login) => login.hasPasskey).map((login) => ({ ref: login.ref, ...login.username ? { username: login.username } : {}, granted: login.passkeys }));
     }
-    return parts.join(delimiter);
-  }
-  reference(value, source) {
-    if (oneTimeFieldPattern.test(sourceFieldName(source)))
-      return this.redactionReference(value);
-    const sourceRef = this.refsBySource.get(source);
-    if (sourceRef) {
-      const slot = this.slotsByRef.get(sourceRef);
-      if (slot) {
-        if (slot.value === value) {
-          this.observed.add(sourceRef);
-          return `\${${sourceRef}}`;
-        }
-        if (slot.sources.length === 1) {
-          this.retiredRefsByValue.set(slot.value, slot.ref);
-          if (this.refsByValue.get(slot.value) === sourceRef)
-            this.refsByValue.delete(slot.value);
-          slot.value = value;
-          const expiresAt = jwtExpiration(value);
-          if (expiresAt)
-            slot.expiresAt = expiresAt;
-          else
-            delete slot.expiresAt;
-          this.refsByValue.set(value, sourceRef);
-          this.updated.add(sourceRef);
-          this.observed.add(sourceRef);
-          return `\${${sourceRef}}`;
-        }
-        const sourceIndex = slot.sources.indexOf(source);
-        if (sourceIndex >= 0)
-          slot.sources.splice(sourceIndex, 1);
-        const replacementRef = this.refsByValue.get(value);
-        if (replacementRef) {
-          this.refsBySource.set(source, replacementRef);
-          this.addSource(replacementRef, source);
-          this.updated.add(replacementRef);
-          this.observed.add(replacementRef);
-          return `\${${replacementRef}}`;
-        }
+    return { logins, passkeys };
+  };
+  return {
+    socket,
+    client,
+    status: async () => {
+      const status = await rawRequest(socket, { v: 0, cmd: "status" });
+      protocol = typeof status.protocol === "number" ? status.protocol : 0;
+      return { protocol, unlocked: status.unlocked === true, ...str(status.version) ? { version: str(status.version) } : {} };
+    },
+    logins: async (origin) => (await site(origin)).logins,
+    site: (origin) => site(origin),
+    fill: async (origin, login, want) => {
+      const reply = await send("agent-fill", { origin, login: login.ref, want: [...want] });
+      const values = reply.values ?? reply;
+      return {
+        ...str(values.username) !== undefined ? { username: str(values.username) } : {},
+        ...str(values.password) !== undefined ? { password: str(values.password) } : {},
+        ...str(values.totp) !== undefined ? { totp: str(values.totp) } : {}
+      };
+    },
+    passkeyGet: async (request) => {
+      const reply = await send("agent-passkey-get", {
+        origin: request.origin,
+        ...request.rpId ? { rp_id: request.rpId } : {},
+        challenge: request.challenge,
+        allow_credentials: [...request.allowCredentials],
+        user_verification: request.userVerification,
+        ...request.login !== undefined ? { login: request.login } : {}
+      });
+      if (reply.reply === "choose-passkey") {
+        throw new DeadboltError("choose_passkey", "Several passkeys could sign in here; name one by its username.", { choices: passkeyList(reply.choices ?? reply.passkeys) });
       }
+      const credentialId = str(reply.credential_id);
+      const clientDataJson = str(reply.client_data_json);
+      const authenticatorData = str(reply.authenticator_data);
+      const signature = str(reply.signature);
+      if (!credentialId || !clientDataJson || !authenticatorData || !signature)
+        throw new DeadboltError("failed", "Deadbolt's passkey assertion is incomplete");
+      return { credentialId, clientDataJson, authenticatorData, signature, ...str(reply.user_handle) ? { userHandle: str(reply.user_handle) } : {} };
     }
-    const valueRef = this.refsByValue.get(value);
-    if (valueRef) {
-      this.observed.add(valueRef);
-      this.addSource(valueRef, source);
-      return `\${${valueRef}}`;
-    }
-    const ref = `BC_SECRET_${this.nextRef++}`;
-    const expiresAt = jwtExpiration(value);
-    this.slotsByRef.set(ref, { ref, value, sources: [source], ...expiresAt ? { expiresAt } : {} });
-    this.refsByValue.set(value, ref);
-    this.refsBySource.set(source, ref);
-    this.updated.add(ref);
-    this.observed.add(ref);
-    return `\${${ref}}`;
-  }
-  addSource(ref, source) {
-    const slot = this.slotsByRef.get(ref);
-    if (!slot || slot.sources.includes(source))
-      return;
-    slot.sources.push(source);
-    this.refsBySource.set(source, ref);
-  }
-}
-function restoreReferencePlaceholders(value) {
-  return value.replace(/(?:%24|\$)%7B(BC_(?:SECRET|REDACTED)_\d+)%7D/gi, (_match, ref) => `\${${ref}}`);
+  };
 }
-function sourceFieldName(source) {
-  const segments = source.split(".");
-  for (let index = segments.length - 1;index >= 0; index -= 1) {
-    const segment = segments[index] ?? "";
-    if (!/^\d+$/.test(segment))
-      return segment;
-  }
-  return "";
+var deadboltNamePrefix = "deadbolt:";
+function parseDeadboltName(name) {
+  if (!name.startsWith(deadboltNamePrefix))
+    return;
+  const rest = name.slice(deadboltNamePrefix.length).trim();
+  const origin = /^https?:\/\/[^/]+/i.exec(rest);
+  const site = origin ? origin[0] : rest.split("/")[0];
+  const username = rest.slice(site.length + 1);
+  if (!site)
+    return;
+  return { site: site.toLowerCase(), ...username ? { username } : {} };
 }
-var uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function looksLikeTokenSegment(segment) {
-  if (segment.length < 24 || uuidPattern.test(segment) || segment.includes("${"))
-    return false;
-  if (/^eyJ[\w-]+\.[\w-]+\.[\w-]*$/.test(segment))
-    return true;
-  if (/^[0-9a-f]{32,}$/i.test(segment))
-    return true;
-  if (!/^[A-Za-z0-9_~+/-]+={0,2}$/.test(segment))
-    return false;
-  if (/^[a-z]+(?:[-_][a-z]+)+$/i.test(segment))
+function originOnSite(origin, site) {
+  let url;
+  try {
+    url = new URL(origin);
+  } catch {
     return false;
-  const hasDigit = /\d/.test(segment);
-  const hasLower = /[a-z]/.test(segment);
-  const hasUpper = /[A-Z]/.test(segment);
-  return new Set(segment).size >= 12 && hasDigit && (hasLower || hasUpper) && (hasLower && hasUpper || segment.length >= 32);
-}
-function protectPathSegments(pathname, protect) {
-  return pathname.split("/").map((segment) => {
-    let decoded;
+  }
+  if (/^https?:\/\//i.test(site)) {
     try {
-      decoded = decodeURIComponent(segment);
+      return new URL(site).origin === url.origin;
     } catch {
-      decoded = segment;
+      return false;
     }
-    return looksLikeTokenSegment(decoded) ? protect(decoded) : segment;
-  }).join("/");
-}
-function protectRelativeUrl(rawUrl, protect, protectPath) {
-  const queryStart = rawUrl.indexOf("?");
-  if (queryStart < 0)
-    return protectPath(rawUrl);
-  const protectedQuery = protectSearchParams(new URLSearchParams(rawUrl.slice(queryStart + 1)), protect).toString();
-  return restoreReferencePlaceholders(`${protectPath(rawUrl.slice(0, queryStart))}?${protectedQuery}`);
+  }
+  const host = url.hostname.toLowerCase();
+  const bare = site.replace(/^\*\./, "").replace(/:\d+$/, "").toLowerCase();
+  const local = host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host.endsWith(".localhost");
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && local))
+    return false;
+  return host === bare || host.endsWith(`.${bare}`);
 }
-function protectSearchParams(params, protect) {
-  const result = new URLSearchParams;
-  const occurrences = new Map;
-  for (const [name, value] of params) {
-    const occurrence = occurrences.get(name) ?? 0;
-    occurrences.set(name, occurrence + 1);
-    result.append(name, value && secretNamePattern.test(name) ? protect(name, value, occurrence) : value);
+function pickLogin(logins, site, username, field) {
+  const granted = logins.filter((login) => login.granted && (field === undefined || login.fields === undefined || login.fields.includes(field)));
+  const candidates = username === undefined ? granted : granted.filter((login) => login.username?.toLowerCase() === username.toLowerCase());
+  if (candidates.length === 1)
+    return candidates[0];
+  if (candidates.length === 0) {
+    throw new DeadboltError("not_granted", username === undefined ? `No Deadbolt login is granted to Browse for ${site}${field ? ` (${field})` : ""}. Ask the user to allow one with \`deadbolt agents allow ${site}\`.` : `No Deadbolt login for ${username} is granted to Browse for ${site}${field ? ` (${field})` : ""}. Ask the user to allow it with \`deadbolt agents allow ${site} --login ${username}\`.`, { site, ...username ? { login: username } : {} });
   }
-  return result;
+  throw new DeadboltError("failed", `Several Deadbolt logins are granted for ${site}; name one: deadbolt:${site}/<username> (${candidates.map((login) => login.username ?? login.title).join(", ")})`);
 }
-function protectFragment(fragment, protect) {
-  const occurrences = new Map;
-  return fragment.split("&").map((part) => {
-    const separator = part.indexOf("=");
-    if (separator < 1)
-      return part;
-    const entry = new URLSearchParams(part).entries().next().value;
-    if (!entry)
-      return part;
-    const [name, value] = entry;
-    if (!/^[\w.-]+$/.test(name) || !secretNamePattern.test(name))
-      return part;
-    const occurrence = occurrences.get(name) ?? 0;
-    occurrences.set(name, occurrence + 1);
-    return value ? `${part.slice(0, separator + 1)}${protect(name, value, occurrence)}` : part;
-  }).join("&");
+function originsFromPatterns(patterns) {
+  const origins = new Set;
+  for (const pattern of patterns) {
+    const scheme = /^(https?):\/\//i.exec(pattern)?.[1]?.toLowerCase() ?? "https";
+    const host = pattern.replace(/^https?:\/\//i, "").replace(/^\*\./, "").replace(/\/$/, "");
+    try {
+      origins.add(new URL(`${scheme}://${host}`).origin);
+    } catch {}
+  }
+  return [...origins];
 }
-function sourceName(requestScope, location, occurrence = 0) {
-  const base = requestScope ? `${requestScope}.${location}` : location;
-  return occurrence === 0 ? base : `${base}.${occurrence}`;
+async function listLogins(origins, connection) {
+  let deadbolt;
+  try {
+    deadbolt = connection ?? connect();
+  } catch (error) {
+    return { connected: false, logins: [], passkeys: [], error: { code: error instanceof DeadboltError ? error.code : "failed", message: error instanceof Error ? error.message : String(error) } };
+  }
+  const logins = [];
+  const passkeys = [];
+  for (const origin of origins.slice(0, 20)) {
+    try {
+      const found = await deadbolt.site(origin);
+      for (const { ref: _ref, ...login } of found.logins)
+        logins.push({ ...login, origin });
+      for (const { ref: _ref, ...passkey } of found.passkeys)
+        passkeys.push({ ...passkey, origin });
+    } catch (error) {
+      if (error instanceof DeadboltError && (error.code === "domain_mismatch" || error.code === "not_found" || error.code === "not_granted"))
+        continue;
+      return { connected: true, logins, passkeys, error: { code: error instanceof DeadboltError ? error.code : "failed", message: error instanceof Error ? error.message : String(error) } };
+    }
+  }
+  return { connected: true, logins, passkeys };
 }
-function redactKnownValues(text, slots) {
-  return [...slots].sort((left, right) => right.value.length - left.value.length).reduce((output, slot) => replaceOutsideReferences(output, slot.value, `\${${slot.ref}}`), text);
+function pickPasskey(passkeys, username) {
+  const wanted = username.toLowerCase();
+  const granted = passkeys.filter((passkey) => passkey.granted);
+  return granted.find((passkey) => passkey.username?.toLowerCase() === wanted) ?? granted.find((passkey) => passkey.displayName?.toLowerCase() === wanted);
 }
-function redactKnownValue(value, slots) {
-  if (Predicate.isString(value))
-    return redactKnownValues(value, slots);
-  if (Predicate.isNumber(value) || Predicate.isBoolean(value)) {
-    const slot = slots.find((candidate) => candidate.value === String(value));
-    return slot ? `\${${slot.ref}}` : value;
+async function pair(options = {}) {
+  const command = options.command ?? (process.env.OPENCODE_BROWSER_DEADBOLT_CLI || "deadbolt");
+  const stdout = await new Promise((resolve, reject) => {
+    const child = spawn(command, ["agents", "add-client", options.name ?? "browse", "--json"], { stdio: ["inherit", "pipe", "inherit"] });
+    let output = "";
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk) => {
+      output += chunk;
+    });
+    child.on("error", (cause) => reject(new DeadboltError("unavailable", cause.code === "ENOENT" ? `${command} isn't installed or on PATH. Install Deadbolt first.` : `Could not run ${command}: ${cause.message}`)));
+    child.on("close", (code) => code === 0 ? resolve(output) : reject(new DeadboltError("failed", `deadbolt agents add-client exited with status ${code}`)));
+  });
+  let parsed;
+  try {
+    const line = stdout.trim().split(`
+`).filter(Boolean).at(-1) ?? "";
+    parsed = JSON.parse(line);
+  } catch {
+    throw new DeadboltError("failed", "deadbolt agents add-client --json didn't print a client");
   }
-  if (Array.isArray(value))
-    return value.map((item) => redactKnownValue(item, slots));
-  if (!Predicate.isObject(value))
-    return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    secretNamePattern.test(key) ? redactSecretValue(item) : redactKnownValue(item, slots)
-  ]));
+  const client = parsed.client ?? parsed;
+  const id = str(client.id);
+  const token = str(client.token) ?? str(parsed.token);
+  if (!id || !token)
+    throw new DeadboltError("failed", "deadbolt agents add-client --json printed no id and token");
+  await saveClient({ id, token }, options.root);
+  return { id };
 }
-function redactSecretValue(value) {
-  if (Array.isArray(value))
-    return value.map(redactSecretValue);
-  if (Predicate.isObject(value)) {
-    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactSecretValue(item)]));
+function unpair(options = {}) {
+  const client = readClient(options.root);
+  if (!client)
+    return { removed: false, revoked: false };
+  const command = options.command ?? (process.env.OPENCODE_BROWSER_DEADBOLT_CLI || "deadbolt");
+  const result = spawnSync(command, ["agents", "remove-client", client.id], { stdio: ["inherit", "ignore", "inherit"], timeout: 120000 });
+  return { removed: removeClient(options.root), revoked: result.status === 0 };
+}
+function isBase64Url(value, maxLength = 8192) {
+  return typeof value === "string" && value.length <= maxLength && /^[A-Za-z0-9_-]*$/.test(value);
+}
+function randomName(prefix) {
+  return `${prefix}${crypto.randomBytes(12).toString("hex")}`;
+}
+var blake3Iv = [1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225];
+var blake3Permutation = [2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8];
+function blake3Compress(cv, block, blockLength, flags) {
+  const s = new Uint32Array([...cv, blake3Iv[0], blake3Iv[1], blake3Iv[2], blake3Iv[3], 0, 0, blockLength, flags]);
+  let m = Uint32Array.from(block);
+  const rotr = (x, n) => x >>> n | x << 32 - n;
+  const g = (a, b, c, d, x, y) => {
+    s[a] = s[a] + s[b] + x;
+    s[d] = rotr(s[d] ^ s[a], 16);
+    s[c] = s[c] + s[d];
+    s[b] = rotr(s[b] ^ s[c], 12);
+    s[a] = s[a] + s[b] + y;
+    s[d] = rotr(s[d] ^ s[a], 8);
+    s[c] = s[c] + s[d];
+    s[b] = rotr(s[b] ^ s[c], 7);
+  };
+  for (let round = 0;round < 7; round++) {
+    g(0, 4, 8, 12, m[0], m[1]);
+    g(1, 5, 9, 13, m[2], m[3]);
+    g(2, 6, 10, 14, m[4], m[5]);
+    g(3, 7, 11, 15, m[6], m[7]);
+    g(0, 5, 10, 15, m[8], m[9]);
+    g(1, 6, 11, 12, m[10], m[11]);
+    g(2, 7, 8, 13, m[12], m[13]);
+    g(3, 4, 9, 14, m[14], m[15]);
+    if (round < 6)
+      m = Uint32Array.from(blake3Permutation, (index) => m[index]);
   }
-  return value === null || value === "" ? value : "[REDACTED]";
+  return Array.from({ length: 8 }, (_, index) => (s[index] ^ s[index + 8]) >>> 0);
 }
-function replaceOutsideReferences(text, value, replacement) {
-  if (!value)
-    return text;
-  const references = new RegExp(String.raw`\$\{${referencePattern}\}`, "g");
-  let output = "";
-  let offset = 0;
-  for (const match of text.matchAll(references)) {
-    const index = match.index ?? 0;
-    output += text.slice(offset, index).split(value).join(replacement);
-    output += match[0];
-    offset = index + match[0].length;
+function blake3Hex(input) {
+  if (input.length > 1024)
+    throw new Error("blake3Hex handles inputs up to 1024 bytes (DEADBOLT_HOME is longer: set OPENCODE_BROWSER_DEADBOLT_SOCKET)");
+  const blocks = Math.max(1, Math.ceil(input.length / 64));
+  let cv = [...blake3Iv];
+  for (let index = 0;index < blocks; index++) {
+    const bytes = new Uint8Array(64);
+    const chunk = input.subarray(index * 64, index * 64 + 64);
+    bytes.set(chunk);
+    const words = new Uint32Array(16);
+    const view = new DataView(bytes.buffer);
+    for (let word = 0;word < 16; word++)
+      words[word] = view.getUint32(word * 4, true);
+    const flags = (index === 0 ? 1 : 0) | (index === blocks - 1 ? 2 | 8 : 0);
+    cv = blake3Compress(cv, words, chunk.length, flags);
   }
-  return output + text.slice(offset).split(value).join(replacement);
+  const out = Buffer.alloc(32);
+  cv.forEach((word, index) => out.writeUInt32LE(word, index * 4));
+  return out.toString("hex");
 }
-function jwtExpiration(value) {
-  const parts = value.split(".");
-  if (parts.length !== 3 || !parts[1])
+
+// src/auth/site-secrets.ts
+import crypto2 from "node:crypto";
+import fs3 from "node:fs/promises";
+import path3 from "node:path";
+import { Effect as Effect3, Schema as Schema2 } from "effect";
+
+// src/auth/profile.ts
+import { Effect as Effect2, Schema, Semaphore } from "effect";
+import { spawn as spawn2 } from "node:child_process";
+import fs2 from "node:fs/promises";
+import path2 from "node:path";
+
+// src/update/child-process.ts
+async function terminateChildProcess(options) {
+  const isExited = options.isExited ?? (() => options.child.exitCode !== null || options.child.signalCode !== null);
+  if (isExited())
     return;
-  try {
-    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
-    return Predicate.isNumber(payload.exp) ? new Date(payload.exp * 1000).toISOString() : undefined;
-  } catch {
+  signalChildProcess(options.child, "SIGTERM");
+  let timeout;
+  await Promise.race([
+    options.exit,
+    new Promise((resolve) => {
+      timeout = setTimeout(resolve, options.graceMs);
+    })
+  ]);
+  if (timeout)
+    clearTimeout(timeout);
+  if (isExited())
     return;
+  signalChildProcess(options.child, "SIGKILL");
+  await options.exit;
+}
+function signalChildProcess(child, signal) {
+  if (process.platform !== "win32" && child.pid !== undefined) {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch {}
   }
+  child.kill(signal);
 }
 
-// src/auth-profile.ts
-var StoredCredentialSlot = Schema.Struct({
-  ref: Schema.String.check(Schema.isPattern(/^BC_SECRET_[1-9][0-9]*$/)),
-  value: Schema.String,
-  sources: Schema.Array(Schema.String),
-  expiresAt: Schema.optionalKey(Schema.String)
-});
-var StoredAuthProfile = Schema.Struct({
-  version: Schema.Literal(1),
-  name: Schema.String,
-  createdAt: Schema.String,
-  updatedAt: Schema.String,
-  slots: Schema.Array(StoredCredentialSlot)
-}).check(Schema.makeFilter((profile) => {
-  const refs = profile.slots.map((slot) => slot.ref);
-  if (new Set(refs).size !== refs.length)
-    return "Auth profile refs must be unique";
-  const sources = profile.slots.flatMap((slot) => slot.sources);
-  return new Set(sources).size === sources.length ? undefined : "Auth profile sources must be unique";
-}));
-
-class AuthProfileError extends Schema.TaggedError()("AuthProfile.Error", {
-  message: Schema.String,
-  operation: Schema.String,
-  reason: Schema.Literals(["invalid-name", "not-found", "read-failed", "invalid-json", "invalid-profile", "write-failed", "run-failed"]),
-  cause: Schema.optionalKey(Schema.Defect())
-}) {
-}
-var defaultBaseDir = () => path.join(dataRoot(), "secrets");
-var writeLock = Semaphore.makeUnsafe(1);
-var profileLockTimeoutMs = 30000;
-var staleProfileLockMs = 60000;
-var maximumRunOutputBytes = 1e7;
-var maximumTimeoutMs = 2147483647;
-var read = Effect.fn("AuthProfile.read")(function* (name, options = {}) {
-  const filePath = yield* profilePath(options.baseDir ?? defaultBaseDir(), name);
-  const text = yield* Effect.tryPromise({
-    try: () => fs.readFile(filePath, "utf8"),
-    catch: (cause) => isNodeError(cause) && cause.code === "ENOENT" ? new AuthProfileError({ message: `Auth profile not found: ${name}`, operation: "read", reason: "not-found", cause }) : new AuthProfileError({ message: `Could not read auth profile: ${name}`, operation: "read", reason: "read-failed", cause })
-  });
-  return yield* Schema.decodeUnknownEffect(StoredAuthProfile)(yield* Effect.try({
-    try: () => JSON.parse(text),
-    catch: (cause) => new AuthProfileError({ message: `Auth profile is not valid JSON: ${name}`, operation: "read", reason: "invalid-json", cause })
-  })).pipe(Effect.mapError((cause) => cause instanceof AuthProfileError ? cause : new AuthProfileError({ message: `Auth profile has an invalid shape: ${name}`, operation: "read", reason: "invalid-profile", cause })));
-});
-var readOptional = Effect.fn("AuthProfile.readOptional")(function* (name, options = {}) {
-  return yield* read(name, options).pipe(Effect.catchIf((error) => error.reason === "not-found", () => Effect.succeed(undefined)));
-});
-function withLock(name, options, effect) {
-  const baseDir = options.baseDir ?? defaultBaseDir();
-  const acquire = Effect.gen(function* () {
-    const filePath = yield* profilePath(baseDir, name);
-    const lockPath = `${filePath}.lock`;
-    yield* Effect.tryPromise({
-      try: async () => {
-        await fs.mkdir(baseDir, { recursive: true, mode: 448 });
-        await fs.chmod(baseDir, 448);
-        const deadline = Date.now() + profileLockTimeoutMs;
-        while (true) {
-          try {
-            const handle = await fs.open(lockPath, "wx", 384);
-            let written = false;
-            try {
-              await handle.writeFile(`${process.pid}
-`);
-              written = true;
-            } finally {
-              await handle.close();
-              if (!written)
-                await fs.unlink(lockPath).catch(() => {});
-            }
-            return;
-          } catch (cause) {
-            if (!isNodeError(cause) || cause.code !== "EEXIST")
-              throw cause;
-            const stat = await fs.stat(lockPath).catch(() => {
-              return;
-            });
-            if (stat && Date.now() - stat.mtimeMs > staleProfileLockMs) {
-              await fs.unlink(lockPath).catch(() => {});
-              continue;
-            }
-            if (Date.now() >= deadline)
-              throw new Error(`Timed out waiting for auth profile lock: ${name}`);
-            await new Promise((resolve) => setTimeout(resolve, 25));
-          }
-        }
-      },
-      catch: (cause) => new AuthProfileError({ message: `Could not lock auth profile: ${name}`, operation: "lock", reason: "write-failed", cause })
-    });
-    return lockPath;
-  });
-  return Effect.acquireUseRelease(acquire, () => effect, (lockPath) => Effect.tryPromise({
-    try: () => fs.unlink(lockPath).catch(() => {}).then(() => {}),
-    catch: (cause) => new AuthProfileError({ message: `Could not release auth profile lock: ${name}`, operation: "lock", reason: "write-failed", cause })
-  }));
-}
-var writeProfile = Effect.fnUntraced(function* (options) {
-  const baseDir = options.baseDir ?? defaultBaseDir();
-  const filePath = yield* profilePath(baseDir, options.name);
-  const existing = yield* readOptional(options.name, { baseDir });
-  const now = new Date().toISOString();
-  const profile = {
-    version: 1,
-    name: options.name,
-    createdAt: existing?.createdAt ?? now,
-    updatedAt: now,
-    slots: options.slots.map((slot) => ({
-      ref: slot.ref,
-      value: slot.value,
-      sources: [...slot.sources],
-      ...slot.expiresAt ? { expiresAt: slot.expiresAt } : {}
-    }))
-  };
-  yield* Schema.decodeUnknownEffect(StoredAuthProfile)(profile).pipe(Effect.mapError((cause) => new AuthProfileError({ message: `Auth profile has an invalid shape: ${options.name}`, operation: "write", reason: "invalid-profile", cause })));
-  if (existing && sameSlots(existing.slots, profile.slots))
-    return summary(existing);
-  yield* Effect.tryPromise({
-    try: () => writeJsonFileAtomically(filePath, profile, { dirMode: 448 }),
-    catch: (cause) => new AuthProfileError({ message: `Could not write auth profile: ${options.name}`, operation: "write", reason: "write-failed", cause })
-  });
-  return summary(profile);
-});
-var write = Effect.fn("AuthProfile.write")(function* (options) {
-  return yield* writeLock.withPermit(writeProfile(options));
-});
-var status = Effect.fn("AuthProfile.status")(function* (name, options = {}) {
-  return summary(yield* read(name, options));
-});
-var run = Effect.fn("AuthProfile.run")(function* (options) {
-  if (!options.command.trim()) {
-    return yield* new AuthProfileError({ message: "Auth command must not be empty", operation: "run", reason: "run-failed" });
+// src/network-capture/redaction.ts
+import { Predicate as Predicate2 } from "effect";
+var secretNamePattern = /auth(?:orization)?|cookie|credential|csrf|xsrf|token|secret|session|password|passwd|pwd|passcode|otp|(?:^|[-_.])code(?:$|[-_.])|(?:api|access|refresh)[-_.]?key|signature|(?:^|[-_.])sig(?:$|[-_.])/i;
+var oneTimeFieldPattern = /pass(?:word|wd|code|phrase)|(?:^|[-_.])pwd(?:$|[-_.])|otp|totp|(?:^|[-_.])(?:mfa_?|2fa_?|verification_?|auth_?)?code(?:$|[-_.])|(?:^|[-_.])pin(?:$|[-_.])/i;
+var referencePattern = String.raw`BC_(?:SECRET|REDACTED)_\d+`;
+var secretHeaders = new Set([
+  "authorization",
+  "proxy-authorization",
+  "x-api-key",
+  "api-key",
+  "x-csrf-token",
+  "csrf-token",
+  "x-xsrf-token"
+]);
+
+class SecretCollector {
+  slotsByRef = new Map;
+  refsByValue = new Map;
+  refsBySource = new Map;
+  retiredRefsByValue = new Map;
+  redactedRefsByValue = new Map;
+  nextRedactedRef = 1;
+  nextRef = 1;
+  updated = new Set;
+  observed = new Set;
+  constructor(existing = []) {
+    for (const slot of existing) {
+      const copy = {
+        ref: slot.ref,
+        value: slot.value,
+        sources: [...slot.sources],
+        ...slot.expiresAt ? { expiresAt: slot.expiresAt } : {}
+      };
+      this.slotsByRef.set(copy.ref, copy);
+      this.refsByValue.set(copy.value, copy.ref);
+      for (const source of copy.sources) {
+        this.refsBySource.set(source, copy.ref);
+      }
+      const number = /^BC_SECRET_(\d+)$/.exec(copy.ref)?.[1];
+      if (number)
+        this.nextRef = Math.max(this.nextRef, Number(number) + 1);
+    }
   }
-  const timeoutMs = options.timeoutMs ?? 120000;
-  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > maximumTimeoutMs) {
-    return yield* new AuthProfileError({ message: `Auth command timeout must be an integer between 1 and ${maximumTimeoutMs} milliseconds`, operation: "run", reason: "run-failed" });
+  protectHeaders(headers, location, requestScope = "") {
+    const occurrences = new Map;
+    return headers.map(({ name, value }) => {
+      const lowerName = name.toLowerCase();
+      const occurrence = occurrences.get(lowerName) ?? 0;
+      occurrences.set(lowerName, occurrence + 1);
+      return {
+        name,
+        value: this.protectHeader(name, value, sourceName(requestScope, `${location}.header.${lowerName}`, occurrence))
+      };
+    });
   }
-  const maxOutputBytes = options.maxOutputBytes ?? 1e6;
-  if (!Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 0 || maxOutputBytes > maximumRunOutputBytes) {
-    return yield* new AuthProfileError({ message: `Auth command output limit must be an integer between 0 and ${maximumRunOutputBytes} bytes`, operation: "run", reason: "run-failed" });
+  protectUrl(rawUrl, requestScope = "") {
+    const fragmentStart = rawUrl.indexOf("#");
+    const base = fragmentStart < 0 ? rawUrl : rawUrl.slice(0, fragmentStart);
+    const protectQuery = (name, value, occurrence) => this.reference(value, sourceName(requestScope, `query.${name}`, occurrence));
+    const protectPath = (pathname) => protectPathSegments(pathname, (segment) => this.redactionReference(segment));
+    let protectedUrl;
+    try {
+      const url = new URL(base);
+      url.pathname = protectPath(url.pathname);
+      url.search = protectSearchParams(url.searchParams, protectQuery).toString();
+      protectedUrl = restoreReferencePlaceholders(url.toString());
+    } catch {
+      protectedUrl = protectRelativeUrl(base, protectQuery, protectPath);
+    }
+    if (fragmentStart < 0)
+      return protectedUrl;
+    const fragment = protectFragment(rawUrl.slice(fragmentStart + 1), (name, value, occurrence) => this.reference(value, sourceName(requestScope, `fragment.${name}`, occurrence)));
+    return `${protectedUrl}#${fragment}`;
   }
-  const profile = yield* read(options.name, { ...options.baseDir ? { baseDir: options.baseDir } : {} });
-  const startedAt = Date.now();
-  const maxSecretBytes = profile.slots.reduce((max, slot) => Math.max(max, Buffer.byteLength(slot.value)), 0);
-  const result = yield* runChild({
-    command: options.command,
-    args: options.args ?? [],
-    ...options.cwd ? { cwd: options.cwd } : {},
-    timeoutMs,
-    maxOutputBytes: maxOutputBytes + maxSecretBytes,
-    env: Object.fromEntries(profile.slots.map((slot) => [slot.ref, slot.value]))
-  }).pipe(Effect.mapError((cause) => new AuthProfileError({ message: `Could not run command with auth profile ${options.name}`, operation: "run", reason: "run-failed", cause })));
-  const stdout = redactOutput(result.stdout, profile.slots, maxOutputBytes);
-  const stderr = redactOutput(result.stderr, profile.slots, maxOutputBytes);
-  return {
-    ...result,
-    stdout: stdout.text,
-    stderr: stderr.text,
-    stdoutTruncated: result.stdoutTruncated || stdout.truncated,
-    stderrTruncated: result.stderrTruncated || stderr.truncated,
-    durationMs: Date.now() - startedAt
-  };
-});
-function summary(profile) {
-  const now = Date.now();
-  return {
-    name: profile.name,
-    createdAt: profile.createdAt,
-    updatedAt: profile.updatedAt,
-    slotCount: profile.slots.length,
-    slots: profile.slots.map((slot) => ({
-      ref: slot.ref,
-      sources: [...slot.sources],
-      ...slot.expiresAt ? { expiresAt: slot.expiresAt } : {},
-      expired: slot.expiresAt ? Date.parse(slot.expiresAt) <= now : false
-    }))
-  };
-}
-function profilePath(baseDir, name) {
-  return /^[a-z0-9][a-z0-9._-]{0,63}$/i.test(name) ? Effect.succeed(path.join(baseDir, `${name}.json`)) : Effect.fail(new AuthProfileError({ message: `Invalid auth profile name: ${name}`, operation: "path", reason: "invalid-name" }));
-}
-function sameSlots(left, right) {
-  return JSON.stringify(left) === JSON.stringify(right);
-}
-function redactOutput(text, slots, maxBytes) {
-  const bytes = Buffer.from(text);
-  let cutoff = Math.min(bytes.length, maxBytes);
-  let changed = true;
-  while (changed) {
-    changed = false;
-    for (const slot of slots) {
-      if (!slot.value)
-        continue;
-      const secret = Buffer.from(slot.value);
-      let start = bytes.indexOf(secret);
-      while (start >= 0 && start < cutoff) {
-        if (start + secret.length > cutoff) {
-          cutoff = start;
-          changed = true;
-          break;
-        }
-        start = bytes.indexOf(secret, start + secret.length);
+  protectBody(body, contentType, location, requestScope = "") {
+    const type = contentType?.toLowerCase() ?? "";
+    if (type.includes("json")) {
+      try {
+        return JSON.stringify(this.protectJson(JSON.parse(body), sourceName(requestScope, location)));
+      } catch {
+        return;
       }
     }
+    if (type.includes("application/x-www-form-urlencoded")) {
+      const protectedParams = protectSearchParams(new URLSearchParams(body), (name, value, occurrence) => this.reference(value, sourceName(requestScope, `${location}.form.${name}`, occurrence)));
+      return restoreReferencePlaceholders(protectedParams.toString());
+    }
+    if (type.includes("multipart/form-data")) {
+      return this.protectMultipart(body, contentType ?? "", location, requestScope);
+    }
+    return;
   }
-  return {
-    text: redactKnownValues(bytes.subarray(0, cutoff).toString("utf8"), slots),
-    truncated: cutoff < bytes.length
-  };
-}
-function runChild(options) {
-  return Effect.callback((resume) => {
-    const child = spawn(options.command, [...options.args], {
-      ...options.cwd ? { cwd: options.cwd } : {},
-      env: childEnvironment(options.env),
-      detached: process.platform !== "win32",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    const stdout = [];
-    const stderr = [];
-    let stdoutBytes = 0;
-    let stderrBytes = 0;
-    let stdoutTruncated = false;
-    let stderrTruncated = false;
-    const append = (chunks, chunk, currentBytes) => {
-      const remaining = options.maxOutputBytes - currentBytes;
-      if (remaining <= 0)
-        return currentBytes;
-      chunks.push(chunk.subarray(0, remaining));
-      return currentBytes + Math.min(chunk.length, remaining);
-    };
-    child.stdout.on("data", (chunk) => {
-      const next = append(stdout, chunk, stdoutBytes);
-      stdoutTruncated ||= next - stdoutBytes < chunk.length;
-      stdoutBytes = next;
-    });
-    child.stderr.on("data", (chunk) => {
-      const next = append(stderr, chunk, stderrBytes);
-      stderrTruncated ||= next - stderrBytes < chunk.length;
-      stderrBytes = next;
-    });
-    let closed = false;
-    let settled = false;
-    let closePromiseResolve;
-    const closePromise = new Promise((resolve) => {
-      closePromiseResolve = resolve;
-    });
-    const timeout = setTimeout(() => {
-      terminateChildProcess({ child, exit: closePromise, graceMs: 1000, isExited: () => closed });
-    }, options.timeoutMs);
-    child.once("error", (cause) => {
-      clearTimeout(timeout);
-      closed = true;
-      closePromiseResolve?.();
-      if (settled)
-        return;
-      settled = true;
-      resume(Effect.fail(cause));
-    });
-    child.once("close", (code, signal) => {
-      clearTimeout(timeout);
-      closed = true;
-      closePromiseResolve?.();
-      if (settled)
-        return;
-      settled = true;
-      resume(Effect.succeed({
-        exitCode: code ?? 1,
-        signal,
-        stdout: Buffer.concat(stdout).toString("utf8"),
-        stderr: Buffer.concat(stderr).toString("utf8"),
-        stdoutTruncated,
-        stderrTruncated
-      }));
+  slots() {
+    return Array.from(this.slotsByRef.values()).sort((left, right) => left.ref.localeCompare(right.ref, undefined, { numeric: true })).map((slot) => ({ ...slot, sources: [...slot.sources] }));
+  }
+  updatedRefs() {
+    return Array.from(this.updated).sort();
+  }
+  observedRefs() {
+    return Array.from(this.observed).sort();
+  }
+  redactText(text) {
+    return redactKnownValues(text, this.redactionSlots());
+  }
+  redactValue(value) {
+    return redactKnownValue(value, this.redactionSlots());
+  }
+  redactExactValue(value, minimumLength) {
+    if (!Predicate2.isString(value) && !Predicate2.isNumber(value) && !Predicate2.isBoolean(value))
+      return value;
+    const serialized = String(value);
+    if (serialized.length < minimumLength)
+      return value;
+    const ref = this.refsByValue.get(serialized) ?? this.retiredRefsByValue.get(serialized) ?? this.redactedRefsByValue.get(serialized);
+    return ref ? `\${${ref}}` : value;
+  }
+  redactKnownSubstrings(text, minimumLength) {
+    const slots = this.redactionSlots().filter((slot) => slot.value.length >= minimumLength);
+    const encoded = slots.flatMap((slot) => {
+      const variant = encodeURIComponent(slot.value);
+      return variant === slot.value ? [] : [{ ref: slot.ref, value: variant }];
     });
-    return Effect.promise(() => terminateChildProcess({ child, exit: closePromise, graceMs: 1000, isExited: () => closed }));
-  });
-}
-function childEnvironment(profile) {
-  const inherited = Object.fromEntries(Object.entries(process.env).filter(([name]) => !/^BC_SECRET_[1-9][0-9]*$/.test(name)));
-  return { ...inherited, ...profile };
-}
-
-// src/domain-policy.ts
-import dns from "node:dns/promises";
-import net from "node:net";
-
-class OriginPatternError extends Error {
-  name = "OriginPatternError";
-}
-var maxPatterns = 100;
-function parseOriginPattern(raw) {
-  const pattern = raw.trim();
-  if (!pattern)
-    throw new OriginPatternError("Empty origin pattern");
-  if (pattern === "*" || pattern === "*.*")
-    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)} allows every site; leave the allowlist unset instead`);
-  const schemeMatch = /^([a-z][a-z0-9+.-]*):\/\//i.exec(pattern);
-  const scheme = schemeMatch?.[1]?.toLowerCase();
-  if (scheme !== undefined && scheme !== "http" && scheme !== "https") {
-    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)}: only http and https origins can be allowed`);
+    return redactKnownValues(text, [...slots, ...encoded]);
+  }
+  redactionSlots() {
+    return [
+      ...this.slotsByRef.values(),
+      ...Array.from(this.retiredRefsByValue, ([value, ref]) => ({ ref, value })),
+      ...Array.from(this.redactedRefsByValue, ([value, ref]) => ({ ref, value }))
+    ];
   }
-  let rest = schemeMatch ? pattern.slice(schemeMatch[0].length) : pattern;
-  if (/[/?#]/.test(rest.replace(/\/$/, "")))
-    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)} must be a host or origin, without a path`);
-  rest = rest.replace(/\/$/, "");
-  const wildcard = rest.startsWith("*.");
-  if (wildcard)
-    rest = rest.slice(2);
-  if (rest.includes("*"))
-    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)}: a wildcard is only allowed as a leading "*."`);
-  let parsed;
-  try {
-    parsed = new URL(`${scheme ?? "http"}://${rest}`);
-  } catch {
-    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)} is not a valid host or origin`);
+  addRedactionOnly(value) {
+    if (value)
+      this.redactionReference(value);
   }
-  if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || !parsed.hostname) {
-    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)} must be a host or origin`);
+  redactValuesEverywhere(text, values) {
+    const slots = [];
+    for (const value of values) {
+      if (!value)
+        continue;
+      const ref = /^\$\{(.+)\}$/.exec(this.redactionReference(value))?.[1] ?? "BC_REDACTED_0";
+      for (const variant of new Set([value, encodeURIComponent(value), new URLSearchParams({ v: value }).toString().slice(2)])) {
+        slots.push({ ref, value: variant });
+      }
+    }
+    return redactKnownValues(text, slots);
   }
-  const host = unbracket(parsed.hostname.toLowerCase());
-  if (wildcard && net.isIP(host))
-    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)}: wildcards don't apply to IP addresses`);
-  if (wildcard && !host.includes("."))
-    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)}: "*." needs a domain with a dot, like *.example.com`);
-  const port = parsed.port || (scheme ? scheme === "https" ? "443" : "80" : undefined);
-  return {
-    pattern,
-    ...scheme ? { scheme: `${scheme}:` } : {},
-    host,
-    wildcard,
-    ...port ? { port } : {}
-  };
-}
-function parseOriginPatterns(raw) {
-  if (raw.length > maxPatterns)
-    throw new OriginPatternError(`At most ${maxPatterns} origin patterns are allowed`);
-  return raw.map(parseOriginPattern);
-}
-function normalizeOriginPatterns(raw) {
-  return Array.from(new Set(parseOriginPatterns(raw.flatMap((entry) => entry.split(",")).map((entry) => entry.trim()).filter(Boolean)).map((rule) => rule.pattern.toLowerCase())));
-}
-function unbracket(host) {
-  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-}
-function ipv4ToNumber(ip) {
-  return ip.split(".").reduce((value, part) => value * 256 + Number(part), 0);
-}
-var privateIpv4Ranges = [
-  ["0.0.0.0", 8],
-  ["10.0.0.0", 8],
-  ["100.64.0.0", 10],
-  ["127.0.0.0", 8],
-  ["169.254.0.0", 16],
-  ["172.16.0.0", 12],
-  ["192.0.0.0", 24],
-  ["192.0.2.0", 24],
-  ["192.168.0.0", 16],
-  ["198.18.0.0", 15],
-  ["198.51.100.0", 24],
-  ["203.0.113.0", 24],
-  ["224.0.0.0", 4],
-  ["240.0.0.0", 4]
-];
-function isPrivateAddress(address) {
-  const ip = unbracket(address.toLowerCase()).replace(/%.*$/, "");
-  if (net.isIPv4(ip)) {
-    const value = ipv4ToNumber(ip);
-    return privateIpv4Ranges.some(([base, bits]) => {
-      const mask = bits === 0 ? 0 : 4294967295 << 32 - bits >>> 0;
-      return (value & mask) >>> 0 === (ipv4ToNumber(base) & mask) >>> 0;
-    });
+  redactionReference(value) {
+    const persisted = this.refsByValue.get(value);
+    if (persisted) {
+      this.observed.add(persisted);
+      return `\${${persisted}}`;
+    }
+    let ref = this.redactedRefsByValue.get(value);
+    if (!ref) {
+      ref = `BC_REDACTED_${this.nextRedactedRef++}`;
+      this.redactedRefsByValue.set(value, ref);
+    }
+    return `\${${ref}}`;
   }
-  if (net.isIPv6(ip)) {
-    if (ip === "::" || ip === "::1")
-      return true;
-    const mapped = /^(?:0*:)*:?ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(ip) ?? /^::(\d+\.\d+\.\d+\.\d+)$/.exec(ip);
-    if (mapped?.[1])
-      return isPrivateAddress(mapped[1]);
-    const hexMapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(ip);
-    if (hexMapped?.[1] && hexMapped[2]) {
-      const high = parseInt(hexMapped[1], 16);
-      const low = parseInt(hexMapped[2], 16);
-      return isPrivateAddress(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+  protectHeader(name, value, source) {
+    if (!value)
+      return value;
+    const lower = name.toLowerCase();
+    if (lower === "cookie" || lower === "set-cookie") {
+      const cookieOccurrences = new Map;
+      return value.split(/;\s*/).map((part, index) => {
+        const separator = part.indexOf("=");
+        if (separator < 1)
+          return part;
+        const cookieName = part.slice(0, separator).trim();
+        const cookieValue = part.slice(separator + 1);
+        if (lower === "set-cookie" && index > 0 && /^(domain|path|expires|max-age|samesite)$/i.test(cookieName)) {
+          return part;
+        }
+        if (!cookieValue)
+          return part;
+        const occurrence = cookieOccurrences.get(cookieName) ?? 0;
+        cookieOccurrences.set(cookieName, occurrence + 1);
+        return `${cookieName}=${this.reference(cookieValue, sourceName("", `${source}.${cookieName}`, occurrence))}`;
+      }).join("; ");
     }
-    const first = parseInt(ip.split(":")[0] || "0", 16);
-    if ((first & 65024) === 64512 || (first & 65472) === 65152 || (first & 65280) === 65280)
-      return true;
-    if (ip.startsWith("64:ff9b::"))
-      return true;
-    return false;
+    if (lower === "location" || lower === "referer" || lower === "referrer") {
+      return this.protectUrl(value, `${source}.url`);
+    }
+    if (lower === "authorization" || lower === "proxy-authorization") {
+      const match = /^(\S+)\s+(.+)$/.exec(value);
+      if (match)
+        return `${match[1]} ${this.reference(match[2] ?? "", source)}`;
+    }
+    if (secretHeaders.has(lower) || secretNamePattern.test(lower)) {
+      return this.reference(value, source);
+    }
+    return value;
+  }
+  protectJson(value, location, path = [], inSecret = false) {
+    if (Array.isArray(value)) {
+      return value.map((item, index) => this.protectJson(item, location, [...path, String(index)], inSecret));
+    }
+    if (Predicate2.isObject(value)) {
+      return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+        key,
+        this.protectJson(item, location, [...path, key], inSecret || secretNamePattern.test(key))
+      ]));
+    }
+    if (!inSecret || value === null || value === "")
+      return value;
+    return this.reference(String(value), `${location}.json.${path.join(".")}`);
+  }
+  protectMultipart(body, contentType, location, requestScope) {
+    const boundary = /boundary=(?:"([^"]+)"|([^;\s]+))/i.exec(contentType)?.slice(1).find(Boolean);
+    if (!boundary)
+      return;
+    const delimiter = `--${boundary}`;
+    const parts = body.split(delimiter);
+    if (parts.length < 3)
+      return;
+    const occurrences = new Map;
+    for (let index = 1;index < parts.length - 1; index += 1) {
+      const part = parts[index];
+      if (!part?.startsWith(`\r
+`))
+        return;
+      const headerEnd = part.indexOf(`\r
+\r
+`);
+      if (headerEnd < 0 || !part.endsWith(`\r
+`))
+        return;
+      const headers = part.slice(2, headerEnd);
+      const disposition = headers.split(`\r
+`).find((line) => /^content-disposition:/i.test(line));
+      if (!disposition || /;\s*filename\*?=/i.test(disposition))
+        return;
+      const name = /;\s*name="([^"]+)"/i.exec(disposition)?.[1];
+      if (!name)
+        return;
+      const valueStart = headerEnd + 4;
+      const valueEnd = part.length - 2;
+      const value = part.slice(valueStart, valueEnd);
+      if (!value || !secretNamePattern.test(name))
+        continue;
+      const occurrence = occurrences.get(name) ?? 0;
+      occurrences.set(name, occurrence + 1);
+      const reference = this.reference(value, sourceName(requestScope, `${location}.multipart.${name}`, occurrence));
+      parts[index] = `${part.slice(0, valueStart)}${reference}${part.slice(valueEnd)}`;
+    }
+    return parts.join(delimiter);
+  }
+  reference(value, source) {
+    if (oneTimeFieldPattern.test(sourceFieldName(source)))
+      return this.redactionReference(value);
+    const sourceRef = this.refsBySource.get(source);
+    if (sourceRef) {
+      const slot = this.slotsByRef.get(sourceRef);
+      if (slot) {
+        if (slot.value === value) {
+          this.observed.add(sourceRef);
+          return `\${${sourceRef}}`;
+        }
+        if (slot.sources.length === 1) {
+          this.retiredRefsByValue.set(slot.value, slot.ref);
+          if (this.refsByValue.get(slot.value) === sourceRef)
+            this.refsByValue.delete(slot.value);
+          slot.value = value;
+          const expiresAt = jwtExpiration(value);
+          if (expiresAt)
+            slot.expiresAt = expiresAt;
+          else
+            delete slot.expiresAt;
+          this.refsByValue.set(value, sourceRef);
+          this.updated.add(sourceRef);
+          this.observed.add(sourceRef);
+          return `\${${sourceRef}}`;
+        }
+        const sourceIndex = slot.sources.indexOf(source);
+        if (sourceIndex >= 0)
+          slot.sources.splice(sourceIndex, 1);
+        const replacementRef = this.refsByValue.get(value);
+        if (replacementRef) {
+          this.refsBySource.set(source, replacementRef);
+          this.addSource(replacementRef, source);
+          this.updated.add(replacementRef);
+          this.observed.add(replacementRef);
+          return `\${${replacementRef}}`;
+        }
+      }
+    }
+    const valueRef = this.refsByValue.get(value);
+    if (valueRef) {
+      this.observed.add(valueRef);
+      this.addSource(valueRef, source);
+      return `\${${valueRef}}`;
+    }
+    const ref = `BC_SECRET_${this.nextRef++}`;
+    const expiresAt = jwtExpiration(value);
+    this.slotsByRef.set(ref, { ref, value, sources: [source], ...expiresAt ? { expiresAt } : {} });
+    this.refsByValue.set(value, ref);
+    this.refsBySource.set(source, ref);
+    this.updated.add(ref);
+    this.observed.add(ref);
+    return `\${${ref}}`;
+  }
+  addSource(ref, source) {
+    const slot = this.slotsByRef.get(ref);
+    if (!slot || slot.sources.includes(source))
+      return;
+    slot.sources.push(source);
+    this.refsBySource.set(source, ref);
   }
-  return false;
-}
-function isLocalhostName(host) {
-  return host === "localhost" || host.endsWith(".localhost") || host === "localhost.localdomain";
 }
-function isPrivateHost(host) {
-  const bare = unbracket(host.toLowerCase());
-  return isLocalhostName(bare) || net.isIP(bare) !== 0 && isPrivateAddress(bare);
+function restoreReferencePlaceholders(value) {
+  return value.replace(/(?:%24|\$)%7B(BC_(?:SECRET|REDACTED)_\d+)%7D/gi, (_match, ref) => `\${${ref}}`);
 }
-function defaultPort(protocol) {
-  return protocol === "https:" ? "443" : "80";
+function sourceFieldName(source) {
+  const segments = source.split(".");
+  for (let index = segments.length - 1;index >= 0; index -= 1) {
+    const segment = segments[index] ?? "";
+    if (!/^\d+$/.test(segment))
+      return segment;
+  }
+  return "";
 }
-function ruleMatches(rule, url, host, options) {
-  if (rule.scheme !== undefined && rule.scheme !== url.protocol)
-    return false;
-  if (rule.scheme === undefined && options.httpsOnlyWithoutScheme && url.protocol !== "https:" && !isPrivateHost(host))
+var uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function looksLikeTokenSegment(segment) {
+  if (segment.length < 24 || uuidPattern.test(segment) || segment.includes("${"))
     return false;
-  if (rule.port !== undefined && rule.port !== (url.port || defaultPort(url.protocol)))
+  if (/^eyJ[\w-]+\.[\w-]+\.[\w-]*$/.test(segment))
+    return true;
+  if (/^[0-9a-f]{32,}$/i.test(segment))
+    return true;
+  if (!/^[A-Za-z0-9_~+/-]+={0,2}$/.test(segment))
     return false;
-  if (rule.wildcard)
-    return host === rule.host || host.endsWith(`.${rule.host}`);
-  return host === rule.host;
-}
-function explicitlyAllowsHost(rules, url) {
-  try {
-    const parsed = new URL(url);
-    const host = unbracket(parsed.hostname.toLowerCase());
-    return rules.some((rule) => !rule.wildcard && ruleMatches(rule, parsed, host, {}));
-  } catch {
+  if (/^[a-z]+(?:[-_][a-z]+)+$/i.test(segment))
     return false;
-  }
+  const hasDigit = /\d/.test(segment);
+  const hasLower = /[a-z]/.test(segment);
+  const hasUpper = /[A-Z]/.test(segment);
+  return new Set(segment).size >= 12 && hasDigit && (hasLower || hasUpper) && (hasLower && hasUpper || segment.length >= 32);
 }
-var neutralSchemes = new Set(["about:", "data:", "blob:"]);
-function checkUrl(rawUrl, rules, options = {}) {
-  let url;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    return { allowed: false, reason: `${JSON.stringify(rawUrl.slice(0, 200))} is not a valid URL` };
-  }
-  if (neutralSchemes.has(url.protocol))
-    return { allowed: true };
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    return { allowed: false, reason: `${url.protocol} URLs are not allowed for this session` };
-  }
-  const host = unbracket(url.hostname.toLowerCase());
-  const matching = rules.filter((rule) => ruleMatches(rule, url, host, options));
-  if (matching.length === 0) {
-    return { allowed: false, reason: `${url.host} is not in the allowed origins (${rules.map((rule) => rule.pattern).join(", ") || "none"})` };
-  }
-  const explicit = matching.some((rule) => !rule.wildcard);
-  if (isPrivateHost(host) && !explicit) {
-    return { allowed: false, reason: `${url.host} is a private, loopback or local address; allow it by naming that exact host` };
-  }
-  return { allowed: true, host, explicit };
+function protectPathSegments(pathname, protect) {
+  return pathname.split("/").map((segment) => {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {
+      decoded = segment;
+    }
+    return looksLikeTokenSegment(decoded) ? protect(decoded) : segment;
+  }).join("/");
 }
-async function resolvesToPrivateAddress(host, timeoutMs = 2000) {
-  const bare = unbracket(host);
-  if (net.isIP(bare) || isLocalhostName(bare))
-    return isPrivateHost(bare) ? bare : undefined;
-  let timer;
-  try {
-    const addresses = await Promise.race([
-      dns.lookup(bare, { all: true, verbatim: true }),
-      new Promise((_, reject) => {
-        timer = setTimeout(() => reject(new Error("DNS lookup timed out")), timeoutMs);
-      })
-    ]);
-    return addresses.find((entry) => isPrivateAddress(entry.address))?.address;
-  } catch {
-    return;
-  } finally {
-    if (timer)
-      clearTimeout(timer);
-  }
+function protectRelativeUrl(rawUrl, protect, protectPath) {
+  const queryStart = rawUrl.indexOf("?");
+  if (queryStart < 0)
+    return protectPath(rawUrl);
+  const protectedQuery = protectSearchParams(new URLSearchParams(rawUrl.slice(queryStart + 1)), protect).toString();
+  return restoreReferencePlaceholders(`${protectPath(rawUrl.slice(0, queryStart))}?${protectedQuery}`);
 }
-async function checkNavigationUrl(rawUrl, rules) {
-  const decision = checkUrl(rawUrl, rules);
-  if (!decision.allowed || decision.host === undefined || decision.explicit)
-    return decision;
-  const privateAddress = await resolvesToPrivateAddress(decision.host);
-  if (privateAddress) {
-    return { allowed: false, reason: `${decision.host} resolves to the private address ${privateAddress}; allow it by naming that exact host` };
+function protectSearchParams(params, protect) {
+  const result = new URLSearchParams;
+  const occurrences = new Map;
+  for (const [name, value] of params) {
+    const occurrence = occurrences.get(name) ?? 0;
+    occurrences.set(name, occurrence + 1);
+    result.append(name, value && secretNamePattern.test(name) ? protect(name, value, occurrence) : value);
   }
-  return decision;
-}
-
-// src/site-secrets.ts
-var StoredSiteSecret = Schema2.Struct({
-  version: Schema2.Literal(1),
-  name: Schema2.String,
-  kind: Schema2.Literals(["password", "totp"]),
-  value: Schema2.String,
-  allowedOrigins: Schema2.Array(Schema2.String),
-  createdAt: Schema2.String,
-  updatedAt: Schema2.String
-});
-
-class SiteSecretError extends Schema2.TaggedError()("SiteSecret.Error", {
-  message: Schema2.String,
-  reason: Schema2.Literals(["invalid-name", "invalid-origins", "invalid-value", "not-found", "read-failed", "write-failed"]),
-  cause: Schema2.optionalKey(Schema2.Defect())
-}) {
+  return result;
 }
-var defaultSiteSecretsDir = () => path2.join(dataRoot(), "site-secrets");
-var namePattern = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
-function secretPath(baseDir, name) {
-  return namePattern.test(name) ? Effect2.succeed(path2.join(baseDir, `${name}.json`)) : Effect2.fail(new SiteSecretError({ message: `Invalid secret name: ${name} (letters, digits, ".", "_" and "-", up to 64)`, reason: "invalid-name" }));
+function protectFragment(fragment, protect) {
+  const occurrences = new Map;
+  return fragment.split("&").map((part) => {
+    const separator = part.indexOf("=");
+    if (separator < 1)
+      return part;
+    const entry = new URLSearchParams(part).entries().next().value;
+    if (!entry)
+      return part;
+    const [name, value] = entry;
+    if (!/^[\w.-]+$/.test(name) || !secretNamePattern.test(name))
+      return part;
+    const occurrence = occurrences.get(name) ?? 0;
+    occurrences.set(name, occurrence + 1);
+    return value ? `${part.slice(0, separator + 1)}${protect(name, value, occurrence)}` : part;
+  }).join("&");
 }
-function summary2(secret) {
-  return { name: secret.name, kind: secret.kind, allowedOrigins: [...secret.allowedOrigins], createdAt: secret.createdAt, updatedAt: secret.updatedAt };
+function sourceName(requestScope, location, occurrence = 0) {
+  const base = requestScope ? `${requestScope}.${location}` : location;
+  return occurrence === 0 ? base : `${base}.${occurrence}`;
 }
-var readSecret = Effect2.fn("SiteSecrets.read")(function* (name, options = {}) {
-  const filePath = yield* secretPath(options.baseDir ?? defaultSiteSecretsDir(), name);
-  const text = yield* Effect2.tryPromise({
-    try: () => fs2.readFile(filePath, "utf8"),
-    catch: (cause) => isNodeError(cause) && cause.code === "ENOENT" ? new SiteSecretError({ message: `Secret not found: ${name}. Ask the user to add it with \`opencode-browser secrets add ${name} --origin <origin>\`.`, reason: "not-found" }) : new SiteSecretError({ message: `Could not read secret ${name}`, reason: "read-failed", cause })
-  });
-  return yield* Effect2.try({
-    try: () => Schema2.decodeUnknownSync(StoredSiteSecret)(JSON.parse(text)),
-    catch: (cause) => new SiteSecretError({ message: `Secret ${name} is not a valid secret file`, reason: "read-failed", cause })
-  });
-});
-var addSecret = Effect2.fn("SiteSecrets.add")(function* (options) {
-  const baseDir = options.baseDir ?? defaultSiteSecretsDir();
-  const filePath = yield* secretPath(baseDir, options.name);
-  const kind = options.kind ?? "password";
-  const allowedOrigins = yield* Effect2.try({
-    try: () => normalizeOriginPatterns(options.allowedOrigins),
-    catch: (cause) => new SiteSecretError({ message: cause instanceof Error ? cause.message : "Invalid origins", reason: "invalid-origins", cause })
-  });
-  if (allowedOrigins.length === 0) {
-    return yield* new SiteSecretError({ message: "A secret needs at least one allowed origin (--origin https://example.com)", reason: "invalid-origins" });
-  }
-  const value = kind === "totp" ? options.value.trim() : options.value.replace(/\r?\n$/, "");
-  if (!value)
-    return yield* new SiteSecretError({ message: "The secret value is empty", reason: "invalid-value" });
-  if (kind === "totp")
-    yield* Effect2.try({
-      try: () => totpCode(value),
-      catch: (cause) => new SiteSecretError({ message: `Not a TOTP seed or otpauth:// URI: ${cause instanceof Error ? cause.message : "invalid"}`, reason: "invalid-value", cause })
-    });
-  const write = Effect2.gen(function* () {
-    const existing = yield* readSecret(options.name, { baseDir }).pipe(Effect2.catchIf((error) => error.reason === "not-found", () => Effect2.succeed(undefined)));
-    const now = new Date().toISOString();
-    const secret = { version: 1, name: options.name, kind, value, allowedOrigins: [...allowedOrigins], createdAt: existing?.createdAt ?? now, updatedAt: now };
-    yield* Effect2.tryPromise({
-      try: () => writeJsonFileAtomically(filePath, secret, { dirMode: 448 }),
-      catch: (cause) => new SiteSecretError({ message: `Could not write secret ${options.name}`, reason: "write-failed", cause })
-    });
-    return summary2(secret);
-  });
-  return yield* withLock(options.name, { baseDir }, write).pipe(Effect2.mapError((error) => error instanceof SiteSecretError ? error : new SiteSecretError({ message: error.message, reason: "write-failed", cause: error })));
-});
-var listSecrets = Effect2.fn("SiteSecrets.list")(function* (options = {}) {
-  const baseDir = options.baseDir ?? defaultSiteSecretsDir();
-  const names = yield* Effect2.tryPromise({
-    try: () => fs2.readdir(baseDir).catch((cause) => isNodeError(cause) && cause.code === "ENOENT" ? [] : Promise.reject(cause)),
-    catch: (cause) => new SiteSecretError({ message: "Could not list secrets", reason: "read-failed", cause })
-  });
-  const secrets = [];
-  for (const file of names.filter((entry) => entry.endsWith(".json")).sort()) {
-    const secret = yield* readSecret(file.slice(0, -".json".length), { baseDir }).pipe(Effect2.option);
-    if (secret._tag === "Some")
-      secrets.push(summary2(secret.value));
-  }
-  return secrets;
-});
-var removeSecret = Effect2.fn("SiteSecrets.remove")(function* (name, options = {}) {
-  const baseDir = options.baseDir ?? defaultSiteSecretsDir();
-  const filePath = yield* secretPath(baseDir, name);
-  return yield* withLock(name, { baseDir }, Effect2.tryPromise({
-    try: () => fs2.rm(filePath).then(() => true, (cause) => isNodeError(cause) && cause.code === "ENOENT" ? false : Promise.reject(cause)),
-    catch: (cause) => new SiteSecretError({ message: `Could not remove secret ${name}`, reason: "write-failed", cause })
-  })).pipe(Effect2.mapError((error) => error instanceof SiteSecretError ? error : new SiteSecretError({ message: error.message, reason: "write-failed", cause: error })));
-});
-function base32Decode(input) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-  const clean = input.toUpperCase().replace(/[\s=-]/g, "");
-  if (!clean || /[^A-Z2-7]/.test(clean))
-    throw new Error("the seed must be base32");
-  let bits = 0;
-  let value = 0;
-  const bytes = [];
-  for (const char of clean) {
-    value = value << 5 | alphabet.indexOf(char);
-    bits += 5;
-    if (bits >= 8) {
-      bytes.push(value >>> bits - 8 & 255);
-      bits -= 8;
-    }
-  }
-  return Buffer.from(bytes);
+function redactKnownValues(text, slots) {
+  return [...slots].sort((left, right) => right.value.length - left.value.length).reduce((output, slot) => replaceOutsideReferences(output, slot.value, `\${${slot.ref}}`), text);
 }
-function totpParameters(seed) {
-  if (/^otpauth:\/\//i.test(seed)) {
-    const url = new URL(seed);
-    const secret = url.searchParams.get("secret");
-    if (!secret)
-      throw new Error("the otpauth URI has no secret");
-    const digits = Number(url.searchParams.get("digits") ?? 6);
-    const period = Number(url.searchParams.get("period") ?? 30);
-    const algorithm = (url.searchParams.get("algorithm") ?? "SHA1").toLowerCase();
-    if (![6, 7, 8].includes(digits) || !Number.isInteger(period) || period <= 0 || !["sha1", "sha256", "sha512"].includes(algorithm)) {
-      throw new Error("unsupported otpauth parameters");
-    }
-    return { key: base32Decode(secret), digits, period, algorithm };
+function redactKnownValue(value, slots) {
+  if (Predicate2.isString(value))
+    return redactKnownValues(value, slots);
+  if (Predicate2.isNumber(value) || Predicate2.isBoolean(value)) {
+    const slot = slots.find((candidate) => candidate.value === String(value));
+    return slot ? `\${${slot.ref}}` : value;
   }
-  return { key: base32Decode(seed), digits: 6, period: 30, algorithm: "sha1" };
-}
-function totpCode(seed, now = Date.now()) {
-  const { key, digits, period, algorithm } = totpParameters(seed);
-  const counter = Buffer.alloc(8);
-  counter.writeBigUInt64BE(BigInt(Math.floor(now / 1000 / period)));
-  const hmac = crypto.createHmac(algorithm, key).update(counter).digest();
-  const offset = hmac[hmac.length - 1] & 15;
-  const binary = (hmac.readUInt32BE(offset) & 2147483647) % 10 ** digits;
-  return String(binary).padStart(digits, "0");
-}
-function secretText(secret) {
-  return secret.kind === "totp" ? totpCode(secret.value) : secret.value;
+  if (Array.isArray(value))
+    return value.map((item) => redactKnownValue(item, slots));
+  if (!Predicate2.isObject(value))
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    secretNamePattern.test(key) ? redactSecretValue(item) : redactKnownValue(item, slots)
+  ]));
 }
-
-// src/deadbolt.ts
-import { spawn as spawn2, spawnSync } from "node:child_process";
-import crypto2 from "node:crypto";
-import fs3 from "node:fs";
-import net2 from "node:net";
-import os from "node:os";
-import path3 from "node:path";
-class DeadboltError extends Error {
-  name = "DeadboltError";
-  code;
-  detail;
-  constructor(code, message, detail = {}) {
-    super(message);
-    this.code = code;
-    this.detail = detail;
+function redactSecretValue(value) {
+  if (Array.isArray(value))
+    return value.map(redactSecretValue);
+  if (Predicate2.isObject(value)) {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactSecretValue(item)]));
   }
+  return value === null || value === "" ? value : "[REDACTED]";
 }
-var clientFileName = "deadbolt-client.json";
-function clientFilePath(root = dataRoot()) {
-  return path3.join(root, clientFileName);
+function replaceOutsideReferences(text, value, replacement) {
+  if (!value)
+    return text;
+  const references = new RegExp(String.raw`\$\{${referencePattern}\}`, "g");
+  let output = "";
+  let offset = 0;
+  for (const match of text.matchAll(references)) {
+    const index = match.index ?? 0;
+    output += text.slice(offset, index).split(value).join(replacement);
+    output += match[0];
+    offset = index + match[0].length;
+  }
+  return output + text.slice(offset).split(value).join(replacement);
 }
-function readClientFile(root = dataRoot()) {
-  let text;
-  try {
-    const file = clientFilePath(root);
-    const stat = fs3.statSync(file);
-    if (process.platform !== "win32" && (stat.mode & 63) !== 0)
-      fs3.chmodSync(file, 384);
-    text = fs3.readFileSync(file, "utf8");
-  } catch {
+function jwtExpiration(value) {
+  const parts = value.split(".");
+  if (parts.length !== 3 || !parts[1])
     return;
-  }
   try {
-    const value = JSON.parse(text);
-    if (typeof value.id !== "string" || !value.id || typeof value.token !== "string" || !value.token)
-      return;
-    return {
-      version: 1,
-      id: value.id,
-      token: value.token,
-      connectedAt: typeof value.connectedAt === "string" ? value.connectedAt : ""
-    };
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    return Predicate2.isNumber(payload.exp) ? new Date(payload.exp * 1000).toISOString() : undefined;
   } catch {
     return;
   }
 }
-function readClient(root = dataRoot()) {
-  const file = readClientFile(root);
-  return file ? { id: file.id, token: file.token } : undefined;
-}
-async function saveClient(client, root = dataRoot()) {
-  const value = { version: 1, id: client.id, token: client.token, connectedAt: new Date().toISOString() };
-  await writeJsonFileAtomically(clientFilePath(root), value, { dirMode: 448 });
-}
-function removeClient(root = dataRoot()) {
-  const file = clientFilePath(root);
-  if (!fs3.existsSync(file))
-    return false;
-  fs3.rmSync(file, { force: true });
-  return true;
+
+// src/auth/profile.ts
+var StoredCredentialSlot = Schema.Struct({
+  ref: Schema.String.check(Schema.isPattern(/^BC_SECRET_[1-9][0-9]*$/)),
+  value: Schema.String,
+  sources: Schema.Array(Schema.String),
+  expiresAt: Schema.optionalKey(Schema.String)
+});
+var StoredAuthProfile = Schema.Struct({
+  version: Schema.Literal(1),
+  name: Schema.String,
+  createdAt: Schema.String,
+  updatedAt: Schema.String,
+  slots: Schema.Array(StoredCredentialSlot)
+}).check(Schema.makeFilter((profile) => {
+  const refs = profile.slots.map((slot) => slot.ref);
+  if (new Set(refs).size !== refs.length)
+    return "Auth profile refs must be unique";
+  const sources = profile.slots.flatMap((slot) => slot.sources);
+  return new Set(sources).size === sources.length ? undefined : "Auth profile sources must be unique";
+}));
+
+class AuthProfileError extends Schema.TaggedError()("AuthProfile.Error", {
+  message: Schema.String,
+  operation: Schema.String,
+  reason: Schema.Literals(["invalid-name", "not-found", "read-failed", "invalid-json", "invalid-profile", "write-failed", "run-failed"]),
+  cause: Schema.optionalKey(Schema.Defect())
+}) {
 }
-function computedSocketPath(env = process.env) {
-  const nonEmpty = (name) => env[name] ? env[name] : undefined;
-  const deadboltHome = nonEmpty("DEADBOLT_HOME");
-  const suffix = deadboltHome ? `-${blake3Hex(Buffer.from(deadboltHome, "utf8")).slice(0, 8)}` : "";
-  const uid = typeof process.getuid === "function" ? process.getuid() : 0;
-  const runtime = nonEmpty("XDG_RUNTIME_DIR") ?? userRuntimeDir(uid);
-  const directory = runtime ? path3.join(runtime, `deadbolt${suffix}`) : path3.join(nonEmpty("TMPDIR") ?? os.tmpdir(), `deadbolt${suffix}-${uid}`);
-  return path3.join(directory, "agent.sock");
+var defaultBaseDir = () => path2.join(dataRoot(), "secrets");
+var writeLock = Semaphore.makeUnsafe(1);
+var profileLockTimeoutMs = 30000;
+var staleProfileLockMs = 60000;
+var maximumRunOutputBytes = 1e7;
+var maximumTimeoutMs = 2147483647;
+var read = Effect2.fn("AuthProfile.read")(function* (name, options = {}) {
+  const filePath = yield* profilePath(options.baseDir ?? defaultBaseDir(), name);
+  const text = yield* Effect2.tryPromise({
+    try: () => fs2.readFile(filePath, "utf8"),
+    catch: (cause) => isNodeError(cause) && cause.code === "ENOENT" ? new AuthProfileError({ message: `Auth profile not found: ${name}`, operation: "read", reason: "not-found", cause }) : new AuthProfileError({ message: `Could not read auth profile: ${name}`, operation: "read", reason: "read-failed", cause })
+  });
+  return yield* Schema.decodeUnknownEffect(StoredAuthProfile)(yield* Effect2.try({
+    try: () => JSON.parse(text),
+    catch: (cause) => new AuthProfileError({ message: `Auth profile is not valid JSON: ${name}`, operation: "read", reason: "invalid-json", cause })
+  })).pipe(Effect2.mapError((cause) => cause instanceof AuthProfileError ? cause : new AuthProfileError({ message: `Auth profile has an invalid shape: ${name}`, operation: "read", reason: "invalid-profile", cause })));
+});
+var readOptional = Effect2.fn("AuthProfile.readOptional")(function* (name, options = {}) {
+  return yield* read(name, options).pipe(Effect2.catchIf((error) => error.reason === "not-found", () => Effect2.succeed(undefined)));
+});
+function withLock(name, options, effect) {
+  const baseDir = options.baseDir ?? defaultBaseDir();
+  const acquire = Effect2.gen(function* () {
+    const filePath = yield* profilePath(baseDir, name);
+    const lockPath = `${filePath}.lock`;
+    yield* Effect2.tryPromise({
+      try: async () => {
+        await fs2.mkdir(baseDir, { recursive: true, mode: 448 });
+        await fs2.chmod(baseDir, 448);
+        const deadline = Date.now() + profileLockTimeoutMs;
+        while (true) {
+          try {
+            const handle = await fs2.open(lockPath, "wx", 384);
+            let written = false;
+            try {
+              await handle.writeFile(`${process.pid}
+`);
+              written = true;
+            } finally {
+              await handle.close();
+              if (!written)
+                await fs2.unlink(lockPath).catch(() => {});
+            }
+            return;
+          } catch (cause) {
+            if (!isNodeError(cause) || cause.code !== "EEXIST")
+              throw cause;
+            const stat = await fs2.stat(lockPath).catch(() => {
+              return;
+            });
+            if (stat && Date.now() - stat.mtimeMs > staleProfileLockMs) {
+              await fs2.unlink(lockPath).catch(() => {});
+              continue;
+            }
+            if (Date.now() >= deadline)
+              throw new Error(`Timed out waiting for auth profile lock: ${name}`);
+            await new Promise((resolve) => setTimeout(resolve, 25));
+          }
+        }
+      },
+      catch: (cause) => new AuthProfileError({ message: `Could not lock auth profile: ${name}`, operation: "lock", reason: "write-failed", cause })
+    });
+    return lockPath;
+  });
+  return Effect2.acquireUseRelease(acquire, () => effect, (lockPath) => Effect2.tryPromise({
+    try: () => fs2.unlink(lockPath).catch(() => {}).then(() => {}),
+    catch: (cause) => new AuthProfileError({ message: `Could not release auth profile lock: ${name}`, operation: "lock", reason: "write-failed", cause })
+  }));
 }
-function userRuntimeDir(uid) {
-  const directory = `/run/user/${uid}`;
-  try {
-    const stat = fs3.statSync(directory);
-    return stat.isDirectory() && stat.uid === uid ? directory : undefined;
-  } catch {
-    return;
+var writeProfile = Effect2.fnUntraced(function* (options) {
+  const baseDir = options.baseDir ?? defaultBaseDir();
+  const filePath = yield* profilePath(baseDir, options.name);
+  const existing = yield* readOptional(options.name, { baseDir });
+  const now = new Date().toISOString();
+  const profile = {
+    version: 1,
+    name: options.name,
+    createdAt: existing?.createdAt ?? now,
+    updatedAt: now,
+    slots: options.slots.map((slot) => ({
+      ref: slot.ref,
+      value: slot.value,
+      sources: [...slot.sources],
+      ...slot.expiresAt ? { expiresAt: slot.expiresAt } : {}
+    }))
+  };
+  yield* Schema.decodeUnknownEffect(StoredAuthProfile)(profile).pipe(Effect2.mapError((cause) => new AuthProfileError({ message: `Auth profile has an invalid shape: ${options.name}`, operation: "write", reason: "invalid-profile", cause })));
+  if (existing && sameSlots(existing.slots, profile.slots))
+    return summary(existing);
+  yield* Effect2.tryPromise({
+    try: () => writeJsonFileAtomically(filePath, profile, { dirMode: 448 }),
+    catch: (cause) => new AuthProfileError({ message: `Could not write auth profile: ${options.name}`, operation: "write", reason: "write-failed", cause })
+  });
+  return summary(profile);
+});
+var write = Effect2.fn("AuthProfile.write")(function* (options) {
+  return yield* writeLock.withPermit(writeProfile(options));
+});
+var status = Effect2.fn("AuthProfile.status")(function* (name, options = {}) {
+  return summary(yield* read(name, options));
+});
+var run = Effect2.fn("AuthProfile.run")(function* (options) {
+  if (!options.command.trim()) {
+    return yield* new AuthProfileError({ message: "Auth command must not be empty", operation: "run", reason: "run-failed" });
   }
-}
-function socketPath(options = {}) {
-  const env = options.env ?? process.env;
-  return env.OPENCODE_BROWSER_DEADBOLT_SOCKET || computedSocketPath(env);
-}
-var requestTimeoutMs = 15000;
-var maxReplyBytes = 4 * 1024 * 1024;
-function errorCode(code) {
-  const normalized = typeof code === "string" ? code.replace(/-/g, "_") : "";
-  switch (normalized) {
-    case "locked":
-    case "not_granted":
-    case "forbidden":
-    case "rate_limited":
-    case "domain_mismatch":
-    case "not_found":
-    case "choose_passkey":
-      return normalized;
-    case "not_initialized":
-      return "locked";
-    default:
-      return "failed";
+  const timeoutMs = options.timeoutMs ?? 120000;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > maximumTimeoutMs) {
+    return yield* new AuthProfileError({ message: `Auth command timeout must be an integer between 1 and ${maximumTimeoutMs} milliseconds`, operation: "run", reason: "run-failed" });
+  }
+  const maxOutputBytes = options.maxOutputBytes ?? 1e6;
+  if (!Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 0 || maxOutputBytes > maximumRunOutputBytes) {
+    return yield* new AuthProfileError({ message: `Auth command output limit must be an integer between 0 and ${maximumRunOutputBytes} bytes`, operation: "run", reason: "run-failed" });
+  }
+  const profile = yield* read(options.name, { ...options.baseDir ? { baseDir: options.baseDir } : {} });
+  const startedAt = Date.now();
+  const maxSecretBytes = profile.slots.reduce((max, slot) => Math.max(max, Buffer.byteLength(slot.value)), 0);
+  const result = yield* runChild({
+    command: options.command,
+    args: options.args ?? [],
+    ...options.cwd ? { cwd: options.cwd } : {},
+    timeoutMs,
+    maxOutputBytes: maxOutputBytes + maxSecretBytes,
+    env: Object.fromEntries(profile.slots.map((slot) => [slot.ref, slot.value]))
+  }).pipe(Effect2.mapError((cause) => new AuthProfileError({ message: `Could not run command with auth profile ${options.name}`, operation: "run", reason: "run-failed", cause })));
+  const stdout = redactOutput(result.stdout, profile.slots, maxOutputBytes);
+  const stderr = redactOutput(result.stderr, profile.slots, maxOutputBytes);
+  return {
+    ...result,
+    stdout: stdout.text,
+    stderr: stderr.text,
+    stdoutTruncated: result.stdoutTruncated || stdout.truncated,
+    stderrTruncated: result.stderrTruncated || stderr.truncated,
+    durationMs: Date.now() - startedAt
+  };
+});
+function summary(profile) {
+  const now = Date.now();
+  return {
+    name: profile.name,
+    createdAt: profile.createdAt,
+    updatedAt: profile.updatedAt,
+    slotCount: profile.slots.length,
+    slots: profile.slots.map((slot) => ({
+      ref: slot.ref,
+      sources: [...slot.sources],
+      ...slot.expiresAt ? { expiresAt: slot.expiresAt } : {},
+      expired: slot.expiresAt ? Date.parse(slot.expiresAt) <= now : false
+    }))
+  };
+}
+var profileNamePattern = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
+function profilePath(baseDir, name) {
+  return profileNamePattern.test(name) ? Effect2.succeed(path2.join(baseDir, `${name}.json`)) : Effect2.fail(new AuthProfileError({ message: `Invalid auth profile name: ${name}`, operation: "path", reason: "invalid-name" }));
+}
+function sameSlots(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function redactOutput(text, slots, maxBytes) {
+  const bytes = Buffer.from(text);
+  let cutoff = Math.min(bytes.length, maxBytes);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const slot of slots) {
+      if (!slot.value)
+        continue;
+      const secret = Buffer.from(slot.value);
+      let start = bytes.indexOf(secret);
+      while (start >= 0 && start < cutoff) {
+        if (start + secret.length > cutoff) {
+          cutoff = start;
+          changed = true;
+          break;
+        }
+        start = bytes.indexOf(secret, start + secret.length);
+      }
+    }
   }
+  return {
+    text: redactKnownValues(bytes.subarray(0, cutoff).toString("utf8"), slots),
+    truncated: cutoff < bytes.length
+  };
 }
-var errorHints = {
-  locked: "Deadbolt is locked, so agent sign-ins are paused until the user unlocks it.",
-  forbidden: "Deadbolt doesn't know this Browse install (its client was removed or revoked). Ask the user to run `opencode-browser deadbolt connect`.",
-  rate_limited: "Deadbolt is rate-limiting this client; wait before trying again."
-};
-function rawRequest(socket, request, timeoutMs = requestTimeoutMs) {
-  return new Promise((resolve, reject) => {
-    const connection = net2.createConnection(socket);
-    let buffer = "";
+function runChild(options) {
+  return Effect2.callback((resume) => {
+    const child = spawn2(options.command, [...options.args], {
+      ...options.cwd ? { cwd: options.cwd } : {},
+      env: childEnvironment(options.env),
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const stdout = [];
+    const stderr = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let stdoutTruncated = false;
+    let stderrTruncated = false;
+    const append = (chunks, chunk, currentBytes) => {
+      const remaining = options.maxOutputBytes - currentBytes;
+      if (remaining <= 0)
+        return currentBytes;
+      chunks.push(chunk.subarray(0, remaining));
+      return currentBytes + Math.min(chunk.length, remaining);
+    };
+    child.stdout.on("data", (chunk) => {
+      const next = append(stdout, chunk, stdoutBytes);
+      stdoutTruncated ||= next - stdoutBytes < chunk.length;
+      stdoutBytes = next;
+    });
+    child.stderr.on("data", (chunk) => {
+      const next = append(stderr, chunk, stderrBytes);
+      stderrTruncated ||= next - stderrBytes < chunk.length;
+      stderrBytes = next;
+    });
+    let closed = false;
     let settled = false;
-    const finish = (error, value) => {
+    let closePromiseResolve;
+    const closePromise = new Promise((resolve) => {
+      closePromiseResolve = resolve;
+    });
+    const timeout = setTimeout(() => {
+      terminateChildProcess({ child, exit: closePromise, graceMs: 1000, isExited: () => closed });
+    }, options.timeoutMs);
+    child.once("error", (cause) => {
+      clearTimeout(timeout);
+      closed = true;
+      closePromiseResolve?.();
       if (settled)
         return;
       settled = true;
-      clearTimeout(timer);
-      connection.destroy();
-      if (error)
-        reject(error);
-      else
-        resolve(value);
-    };
-    const timer = setTimeout(() => finish(new DeadboltError("unavailable", `Deadbolt did not answer ${String(request.cmd)} within ${timeoutMs} ms`)), timeoutMs);
-    connection.setEncoding("utf8");
-    connection.on("connect", () => connection.write(`${JSON.stringify(request)}
-`));
-    connection.on("error", (cause) => {
-      const missing = cause.code === "ENOENT" || cause.code === "ECONNREFUSED";
-      finish(new DeadboltError("unavailable", missing ? "Deadbolt isn't running (no agent socket). Ask the user to start or unlock Deadbolt." : `Could not reach Deadbolt: ${cause.message}`));
+      resume(Effect2.fail(cause));
     });
-    connection.on("data", (chunk) => {
-      buffer += chunk;
-      if (buffer.length > maxReplyBytes)
-        return finish(new DeadboltError("failed", "Deadbolt's reply was too large"));
-      let newline;
-      while ((newline = buffer.indexOf(`
-`)) !== -1) {
-        const line = buffer.slice(0, newline).trim();
-        buffer = buffer.slice(newline + 1);
-        if (!line)
-          continue;
-        let message;
-        try {
-          message = JSON.parse(line);
-        } catch {
-          return finish(new DeadboltError("failed", "Deadbolt sent a reply that isn't JSON"));
-        }
-        if (message.type === "ok")
-          return finish(undefined, message.reply ?? {});
-        if (message.type === "error") {
-          const code = errorCode(message.code);
-          const text = typeof message.message === "string" ? message.message : String(message.code);
-          const detail = message.grant ?? {};
-          const choices = passkeyList(message.choices ?? message.passkeys);
-          return finish(new DeadboltError(code, errorHints[code] ? `${text.replace(/[\s.]*$/, ".")} ${errorHints[code]}` : text, {
-            ...typeof detail.site === "string" ? { site: detail.site } : {},
-            ...typeof detail.login === "string" ? { login: detail.login } : {},
-            ...choices.length > 0 ? { choices } : {}
-          }));
-        }
-      }
+    child.once("close", (code, signal) => {
+      clearTimeout(timeout);
+      closed = true;
+      closePromiseResolve?.();
+      if (settled)
+        return;
+      settled = true;
+      resume(Effect2.succeed({
+        exitCode: code ?? 1,
+        signal,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        stdoutTruncated,
+        stderrTruncated
+      }));
     });
-    connection.on("end", () => finish(new DeadboltError("failed", "Deadbolt closed the connection without a reply")));
-  });
-}
-var str = (value) => typeof value === "string" ? value : undefined;
-function passkeyList(value) {
-  if (!Array.isArray(value))
-    return [];
-  return value.filter((entry) => entry !== null && typeof entry === "object").map((entry) => {
-    const username = str(entry.username);
-    const displayName = str(entry.display_name) ?? str(entry.displayName);
-    return { ref: entry.ref ?? entry.login, ...username ? { username } : {}, ...displayName ? { displayName } : {}, granted: entry.granted !== false };
+    return Effect2.promise(() => terminateChildProcess({ child, exit: closePromise, graceMs: 1000, isExited: () => closed }));
   });
 }
-function toLogin(raw) {
-  const signIn = raw.sign_in;
-  const fields = Array.isArray(raw.fields) ? raw.fields.filter((field) => typeof field === "string") : undefined;
-  const username = str(raw.username);
-  return {
-    ref: raw.ref ?? raw.login,
-    title: str(raw.title) ?? "",
-    ...username ? { username } : {},
-    hasPassword: raw.has_password === true,
-    hasTotp: raw.has_totp === true || raw.has_otp === true,
-    hasPasskey: raw.has_passkey === true,
-    granted: fields !== undefined && fields.length > 0 || raw.passkeys === true,
-    passkeys: raw.passkeys === true,
-    ...fields ? { fields } : {},
-    ...signIn && typeof signIn.provider === "string" ? { signIn: { provider: signIn.provider, ...str(signIn.account) ? { account: str(signIn.account) } : {} } } : {}
-  };
-}
-function connect(options = {}) {
-  const client = options.client ?? readClient(options.root);
-  if (!client) {
-    throw new DeadboltError("not_connected", "Browse isn't connected to Deadbolt. Ask the user to run `opencode-browser deadbolt connect` and to allow the logins agents may use with `deadbolt agents allow <site>`.");
-  }
-  const socket = options.socket ?? socketPath();
-  let protocol;
-  const version = async () => {
-    if (protocol === undefined) {
-      const status = await rawRequest(socket, { v: 0, cmd: "status" });
-      protocol = typeof status.protocol === "number" ? status.protocol : 0;
-    }
-    return protocol;
-  };
-  const send = async (cmd, fields) => rawRequest(socket, { v: await version(), cmd, client: { id: client.id, token: client.token }, ...fields });
-  const site = async (origin) => {
-    const reply = await send("agent-logins", { origin });
-    const raw = (Array.isArray(reply.logins) ? reply.logins : []).filter((login) => login !== null && typeof login === "object");
-    const logins = raw.map(toLogin);
-    let passkeys = passkeyList(reply.passkeys);
-    if (!Array.isArray(reply.passkeys)) {
-      passkeys = logins.filter((login) => login.hasPasskey).map((login) => ({ ref: login.ref, ...login.username ? { username: login.username } : {}, granted: login.passkeys }));
-    }
-    return { logins, passkeys };
-  };
-  return {
-    socket,
-    client,
-    status: async () => {
-      const status = await rawRequest(socket, { v: 0, cmd: "status" });
-      protocol = typeof status.protocol === "number" ? status.protocol : 0;
-      return { protocol, unlocked: status.unlocked === true, ...str(status.version) ? { version: str(status.version) } : {} };
-    },
-    logins: async (origin) => (await site(origin)).logins,
-    site: (origin) => site(origin),
-    fill: async (origin, login, want) => {
-      const reply = await send("agent-fill", { origin, login: login.ref, want: [...want] });
-      const values = reply.values ?? reply;
-      return {
-        ...str(values.username) !== undefined ? { username: str(values.username) } : {},
-        ...str(values.password) !== undefined ? { password: str(values.password) } : {},
-        ...str(values.totp) !== undefined ? { totp: str(values.totp) } : {}
-      };
-    },
-    passkeyGet: async (request) => {
-      const reply = await send("agent-passkey-get", {
-        origin: request.origin,
-        ...request.rpId ? { rp_id: request.rpId } : {},
-        challenge: request.challenge,
-        allow_credentials: [...request.allowCredentials],
-        user_verification: request.userVerification,
-        ...request.login !== undefined ? { login: request.login } : {}
-      });
-      if (reply.reply === "choose-passkey") {
-        throw new DeadboltError("choose_passkey", "Several passkeys could sign in here; name one by its username.", { choices: passkeyList(reply.choices ?? reply.passkeys) });
-      }
-      const credentialId = str(reply.credential_id);
-      const clientDataJson = str(reply.client_data_json);
-      const authenticatorData = str(reply.authenticator_data);
-      const signature = str(reply.signature);
-      if (!credentialId || !clientDataJson || !authenticatorData || !signature)
-        throw new DeadboltError("failed", "Deadbolt's passkey assertion is incomplete");
-      return { credentialId, clientDataJson, authenticatorData, signature, ...str(reply.user_handle) ? { userHandle: str(reply.user_handle) } : {} };
-    }
-  };
+function childEnvironment(profile) {
+  const inherited = Object.fromEntries(Object.entries(process.env).filter(([name]) => !/^BC_SECRET_[1-9][0-9]*$/.test(name)));
+  return { ...inherited, ...profile };
 }
-var deadboltNamePrefix = "deadbolt:";
-function parseDeadboltName(name) {
-  if (!name.startsWith(deadboltNamePrefix))
-    return;
-  const rest = name.slice(deadboltNamePrefix.length).trim();
-  const origin = /^https?:\/\/[^/]+/i.exec(rest);
-  const site = origin ? origin[0] : rest.split("/")[0];
-  const username = rest.slice(site.length + 1);
-  if (!site)
-    return;
-  return { site: site.toLowerCase(), ...username ? { username } : {} };
+
+// src/auth/domain-policy.ts
+import dns from "node:dns/promises";
+import net2 from "node:net";
+
+class OriginPatternError extends Error {
+  name = "OriginPatternError";
 }
-function originOnSite(origin, site) {
-  let url;
+var maxPatterns = 100;
+function parseOriginPattern(raw) {
+  const pattern = raw.trim();
+  if (!pattern)
+    throw new OriginPatternError("Empty origin pattern");
+  if (pattern === "*" || pattern === "*.*")
+    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)} allows every site; leave the allowlist unset instead`);
+  const schemeMatch = /^([a-z][a-z0-9+.-]*):\/\//i.exec(pattern);
+  const scheme = schemeMatch?.[1]?.toLowerCase();
+  if (scheme !== undefined && scheme !== "http" && scheme !== "https") {
+    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)}: only http and https origins can be allowed`);
+  }
+  let rest = schemeMatch ? pattern.slice(schemeMatch[0].length) : pattern;
+  if (/[/?#]/.test(rest.replace(/\/$/, "")))
+    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)} must be a host or origin, without a path`);
+  rest = rest.replace(/\/$/, "");
+  const wildcard = rest.startsWith("*.");
+  if (wildcard)
+    rest = rest.slice(2);
+  if (rest.includes("*"))
+    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)}: a wildcard is only allowed as a leading "*."`);
+  let parsed;
   try {
-    url = new URL(origin);
+    parsed = new URL(`${scheme ?? "http"}://${rest}`);
   } catch {
-    return false;
+    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)} is not a valid host or origin`);
   }
-  if (/^https?:\/\//i.test(site)) {
-    try {
-      return new URL(site).origin === url.origin;
-    } catch {
-      return false;
-    }
+  if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || !parsed.hostname) {
+    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)} must be a host or origin`);
   }
-  const host = url.hostname.toLowerCase();
-  const bare = site.replace(/^\*\./, "").replace(/:\d+$/, "").toLowerCase();
-  const local = host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host.endsWith(".localhost");
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && local))
-    return false;
-  return host === bare || host.endsWith(`.${bare}`);
+  const host = unbracket(parsed.hostname.toLowerCase());
+  if (wildcard && net2.isIP(host))
+    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)}: wildcards don't apply to IP addresses`);
+  if (wildcard && !host.includes("."))
+    throw new OriginPatternError(`Origin pattern ${JSON.stringify(raw)}: "*." needs a domain with a dot, like *.example.com`);
+  const port = parsed.port || (scheme ? scheme === "https" ? "443" : "80" : undefined);
+  return {
+    pattern,
+    ...scheme ? { scheme: `${scheme}:` } : {},
+    host,
+    wildcard,
+    ...port ? { port } : {}
+  };
 }
-function pickLogin(logins, site, username, field) {
-  const granted = logins.filter((login) => login.granted && (field === undefined || login.fields === undefined || login.fields.includes(field)));
-  const candidates = username === undefined ? granted : granted.filter((login) => login.username?.toLowerCase() === username.toLowerCase());
-  if (candidates.length === 1)
-    return candidates[0];
-  if (candidates.length === 0) {
-    throw new DeadboltError("not_granted", username === undefined ? `No Deadbolt login is granted to Browse for ${site}${field ? ` (${field})` : ""}. Ask the user to allow one with \`deadbolt agents allow ${site}\`.` : `No Deadbolt login for ${username} is granted to Browse for ${site}${field ? ` (${field})` : ""}. Ask the user to allow it with \`deadbolt agents allow ${site} --login ${username}\`.`, { site, ...username ? { login: username } : {} });
-  }
-  throw new DeadboltError("failed", `Several Deadbolt logins are granted for ${site}; name one: deadbolt:${site}/<username> (${candidates.map((login) => login.username ?? login.title).join(", ")})`);
+function parseOriginPatterns(raw) {
+  if (raw.length > maxPatterns)
+    throw new OriginPatternError(`At most ${maxPatterns} origin patterns are allowed`);
+  return raw.map(parseOriginPattern);
 }
-function originsFromPatterns(patterns) {
-  const origins = new Set;
-  for (const pattern of patterns) {
-    const scheme = /^(https?):\/\//i.exec(pattern)?.[1]?.toLowerCase() ?? "https";
-    const host = pattern.replace(/^https?:\/\//i, "").replace(/^\*\./, "").replace(/\/$/, "");
-    try {
-      origins.add(new URL(`${scheme}://${host}`).origin);
-    } catch {}
-  }
-  return [...origins];
+function normalizeOriginPatterns(raw) {
+  return Array.from(new Set(parseOriginPatterns(raw.flatMap((entry) => entry.split(",")).map((entry) => entry.trim()).filter(Boolean)).map((rule) => rule.pattern.toLowerCase())));
 }
-async function listLogins(origins, connection) {
-  let deadbolt;
-  try {
-    deadbolt = connection ?? connect();
-  } catch (error) {
-    return { connected: false, logins: [], passkeys: [], error: { code: error instanceof DeadboltError ? error.code : "failed", message: error instanceof Error ? error.message : String(error) } };
+function unbracket(host) {
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function ipv4ToNumber(ip) {
+  return ip.split(".").reduce((value, part) => value * 256 + Number(part), 0);
+}
+var privateIpv4Ranges = [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+];
+function isPrivateAddress(address) {
+  const ip = unbracket(address.toLowerCase()).replace(/%.*$/, "");
+  if (net2.isIPv4(ip)) {
+    const value = ipv4ToNumber(ip);
+    return privateIpv4Ranges.some(([base, bits]) => {
+      const mask = bits === 0 ? 0 : 4294967295 << 32 - bits >>> 0;
+      return (value & mask) >>> 0 === (ipv4ToNumber(base) & mask) >>> 0;
+    });
   }
-  const logins = [];
-  const passkeys = [];
-  for (const origin of origins.slice(0, 20)) {
-    try {
-      const found = await deadbolt.site(origin);
-      for (const { ref: _ref, ...login } of found.logins)
-        logins.push({ ...login, origin });
-      for (const { ref: _ref, ...passkey } of found.passkeys)
-        passkeys.push({ ...passkey, origin });
-    } catch (error) {
-      if (error instanceof DeadboltError && (error.code === "domain_mismatch" || error.code === "not_found" || error.code === "not_granted"))
-        continue;
-      return { connected: true, logins, passkeys, error: { code: error instanceof DeadboltError ? error.code : "failed", message: error instanceof Error ? error.message : String(error) } };
+  if (net2.isIPv6(ip)) {
+    if (ip === "::" || ip === "::1")
+      return true;
+    const mapped = /^(?:0*:)*:?ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(ip) ?? /^::(\d+\.\d+\.\d+\.\d+)$/.exec(ip);
+    if (mapped?.[1])
+      return isPrivateAddress(mapped[1]);
+    const hexMapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(ip);
+    if (hexMapped?.[1] && hexMapped[2]) {
+      const high = parseInt(hexMapped[1], 16);
+      const low = parseInt(hexMapped[2], 16);
+      return isPrivateAddress(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
     }
+    const first = parseInt(ip.split(":")[0] || "0", 16);
+    if ((first & 65024) === 64512 || (first & 65472) === 65152 || (first & 65280) === 65280)
+      return true;
+    if (ip.startsWith("64:ff9b::"))
+      return true;
+    return false;
   }
-  return { connected: true, logins, passkeys };
+  return false;
 }
-function pickPasskey(passkeys, username) {
-  const wanted = username.toLowerCase();
-  const granted = passkeys.filter((passkey) => passkey.granted);
-  return granted.find((passkey) => passkey.username?.toLowerCase() === wanted) ?? granted.find((passkey) => passkey.displayName?.toLowerCase() === wanted);
+function isLocalhostName(host) {
+  return host === "localhost" || host.endsWith(".localhost") || host === "localhost.localdomain";
 }
-async function pair(options = {}) {
-  const command = options.command ?? (process.env.OPENCODE_BROWSER_DEADBOLT_CLI || "deadbolt");
-  const stdout = await new Promise((resolve, reject) => {
-    const child = spawn2(command, ["agents", "add-client", options.name ?? "browse", "--json"], { stdio: ["inherit", "pipe", "inherit"] });
-    let output = "";
-    child.stdout.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      output += chunk;
-    });
-    child.on("error", (cause) => reject(new DeadboltError("unavailable", cause.code === "ENOENT" ? `${command} isn't installed or on PATH. Install Deadbolt first.` : `Could not run ${command}: ${cause.message}`)));
-    child.on("close", (code) => code === 0 ? resolve(output) : reject(new DeadboltError("failed", `deadbolt agents add-client exited with status ${code}`)));
-  });
-  let parsed;
+function isPrivateHost(host) {
+  const bare = unbracket(host.toLowerCase());
+  return isLocalhostName(bare) || net2.isIP(bare) !== 0 && isPrivateAddress(bare);
+}
+function defaultPort(protocol) {
+  return protocol === "https:" ? "443" : "80";
+}
+function ruleMatches(rule, url, host, options) {
+  if (rule.scheme !== undefined && rule.scheme !== url.protocol)
+    return false;
+  if (rule.scheme === undefined && options.httpsOnlyWithoutScheme && url.protocol !== "https:" && !isPrivateHost(host))
+    return false;
+  if (rule.port !== undefined && rule.port !== (url.port || defaultPort(url.protocol)))
+    return false;
+  if (rule.wildcard)
+    return host === rule.host || host.endsWith(`.${rule.host}`);
+  return host === rule.host;
+}
+function explicitlyAllowsHost(rules, url) {
   try {
-    const line = stdout.trim().split(`
-`).filter(Boolean).at(-1) ?? "";
-    parsed = JSON.parse(line);
+    const parsed = new URL(url);
+    const host = unbracket(parsed.hostname.toLowerCase());
+    return rules.some((rule) => !rule.wildcard && ruleMatches(rule, parsed, host, {}));
   } catch {
-    throw new DeadboltError("failed", "deadbolt agents add-client --json didn't print a client");
+    return false;
   }
-  const client = parsed.client ?? parsed;
-  const id = str(client.id);
-  const token = str(client.token) ?? str(parsed.token);
-  if (!id || !token)
-    throw new DeadboltError("failed", "deadbolt agents add-client --json printed no id and token");
-  await saveClient({ id, token }, options.root);
-  return { id };
 }
-function unpair(options = {}) {
-  const client = readClient(options.root);
-  if (!client)
-    return { removed: false, revoked: false };
-  const command = options.command ?? (process.env.OPENCODE_BROWSER_DEADBOLT_CLI || "deadbolt");
-  const result = spawnSync(command, ["agents", "remove-client", client.id], { stdio: ["inherit", "ignore", "inherit"], timeout: 120000 });
-  return { removed: removeClient(options.root), revoked: result.status === 0 };
-}
-function isBase64Url(value, maxLength = 8192) {
-  return typeof value === "string" && value.length <= maxLength && /^[A-Za-z0-9_-]*$/.test(value);
-}
-function randomName(prefix) {
-  return `${prefix}${crypto2.randomBytes(12).toString("hex")}`;
+var neutralSchemes = new Set(["about:", "data:", "blob:"]);
+function checkUrl(rawUrl, rules, options = {}) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return { allowed: false, reason: `${JSON.stringify(rawUrl.slice(0, 200))} is not a valid URL` };
+  }
+  if (neutralSchemes.has(url.protocol))
+    return { allowed: true };
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return { allowed: false, reason: `${url.protocol} URLs are not allowed for this session` };
+  }
+  const host = unbracket(url.hostname.toLowerCase());
+  const matching = rules.filter((rule) => ruleMatches(rule, url, host, options));
+  if (matching.length === 0) {
+    return { allowed: false, reason: `${url.host} is not in the allowed origins (${rules.map((rule) => rule.pattern).join(", ") || "none"})` };
+  }
+  const explicit = matching.some((rule) => !rule.wildcard);
+  if (isPrivateHost(host) && !explicit) {
+    return { allowed: false, reason: `${url.host} is a private, loopback or local address; allow it by naming that exact host` };
+  }
+  return { allowed: true, host, explicit };
 }
-var blake3Iv = [1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225];
-var blake3Permutation = [2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8];
-function blake3Compress(cv, block, blockLength, flags) {
-  const s = new Uint32Array([...cv, blake3Iv[0], blake3Iv[1], blake3Iv[2], blake3Iv[3], 0, 0, blockLength, flags]);
-  let m = Uint32Array.from(block);
-  const rotr = (x, n) => x >>> n | x << 32 - n;
-  const g = (a, b, c, d, x, y) => {
-    s[a] = s[a] + s[b] + x;
-    s[d] = rotr(s[d] ^ s[a], 16);
-    s[c] = s[c] + s[d];
-    s[b] = rotr(s[b] ^ s[c], 12);
-    s[a] = s[a] + s[b] + y;
-    s[d] = rotr(s[d] ^ s[a], 8);
-    s[c] = s[c] + s[d];
-    s[b] = rotr(s[b] ^ s[c], 7);
-  };
-  for (let round = 0;round < 7; round++) {
-    g(0, 4, 8, 12, m[0], m[1]);
-    g(1, 5, 9, 13, m[2], m[3]);
-    g(2, 6, 10, 14, m[4], m[5]);
-    g(3, 7, 11, 15, m[6], m[7]);
-    g(0, 5, 10, 15, m[8], m[9]);
-    g(1, 6, 11, 12, m[10], m[11]);
-    g(2, 7, 8, 13, m[12], m[13]);
-    g(3, 4, 9, 14, m[14], m[15]);
-    if (round < 6)
-      m = Uint32Array.from(blake3Permutation, (index) => m[index]);
+async function resolvesToPrivateAddress(host, timeoutMs = 2000) {
+  const bare = unbracket(host);
+  if (net2.isIP(bare) || isLocalhostName(bare))
+    return isPrivateHost(bare) ? bare : undefined;
+  let timer;
+  try {
+    const addresses = await Promise.race([
+      dns.lookup(bare, { all: true, verbatim: true }),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("DNS lookup timed out")), timeoutMs);
+      })
+    ]);
+    return addresses.find((entry) => isPrivateAddress(entry.address))?.address;
+  } catch {
+    return;
+  } finally {
+    if (timer)
+      clearTimeout(timer);
   }
-  return Array.from({ length: 8 }, (_, index) => (s[index] ^ s[index + 8]) >>> 0);
 }
-function blake3Hex(input) {
-  if (input.length > 1024)
-    throw new Error("blake3Hex handles inputs up to 1024 bytes (DEADBOLT_HOME is longer: set OPENCODE_BROWSER_DEADBOLT_SOCKET)");
-  const blocks = Math.max(1, Math.ceil(input.length / 64));
-  let cv = [...blake3Iv];
-  for (let index = 0;index < blocks; index++) {
-    const bytes = new Uint8Array(64);
-    const chunk = input.subarray(index * 64, index * 64 + 64);
-    bytes.set(chunk);
-    const words = new Uint32Array(16);
-    const view = new DataView(bytes.buffer);
-    for (let word = 0;word < 16; word++)
-      words[word] = view.getUint32(word * 4, true);
-    const flags = (index === 0 ? 1 : 0) | (index === blocks - 1 ? 2 | 8 : 0);
-    cv = blake3Compress(cv, words, chunk.length, flags);
+async function checkNavigationUrl(rawUrl, rules) {
+  const decision = checkUrl(rawUrl, rules);
+  if (!decision.allowed || decision.host === undefined || decision.explicit)
+    return decision;
+  const privateAddress = await resolvesToPrivateAddress(decision.host);
+  if (privateAddress) {
+    return { allowed: false, reason: `${decision.host} resolves to the private address ${privateAddress}; allow it by naming that exact host` };
   }
-  const out = Buffer.alloc(32);
-  cv.forEach((word, index) => out.writeUInt32LE(word, index * 4));
-  return out.toString("hex");
+  return decision;
 }
 
-// src/user-settings.ts
-var settingKeys = ["window", "grouping", "idleMinutes", "cursor", "humanInput", "handoffNotifications", "autoUpdate"];
-var relaySettingKeys = ["autoUpdate"];
-var settingSpecs = {
-  window: { label: "Where agents open their tabs (current: the user's window; separate: an unfocused window of their own)", values: ["current", "separate"], variable: "OPENCODE_BROWSER_AGENT_WINDOW" },
-  grouping: { label: "How agent tabs are grouped (one group per session, one shared group, or none)", values: ["session", "shared", "none"] },
-  idleMinutes: { label: "Close agent tabs untouched for this many minutes", values: [10, 30, 60, "never"] },
-  cursor: { label: "Agent cursor on agent tabs outside recordings (pages can detect it)", values: ["off", "always"], variable: "OPENCODE_BROWSER_GHOST_CURSOR" },
-  humanInput: { label: "Human-like input (off is faster, but easier for sites to flag)", values: ["on", "off"], variable: "OPENCODE_BROWSER_HUMAN_INPUT" },
-  handoffNotifications: { label: "System notification on a handoff (only while recorded, or every handoff)", values: ["recording", "always"] },
-  autoUpdate: { label: "npm installs: install updates automatically when idle, only notify, or never check", values: ["on", "notify", "off"], variable: "OPENCODE_BROWSER_AUTO_UPDATE" }
-};
-var securityVariables = [
-  "OPENCODE_BROWSER_ALLOW_NODE",
-  "OPENCODE_BROWSER_ALLOW_ALL_COOKIES",
-  "OPENCODE_BROWSER_ALLOW_FOREGROUND",
-  "OPENCODE_BROWSER_ALLOW_ALL_STORAGE",
-  "OPENCODE_BROWSER_ALLOW_FILE_URLS",
-  "OPENCODE_BROWSER_UPDATE_CHECK"
-];
+// src/auth/site-secrets.ts
+var StoredSiteSecret = Schema2.Struct({
+  version: Schema2.Literal(1),
+  name: Schema2.String,
+  kind: Schema2.Literals(["password", "totp"]),
+  value: Schema2.String,
+  allowedOrigins: Schema2.Array(Schema2.String),
+  createdAt: Schema2.String,
+  updatedAt: Schema2.String
+});
 
-class SettingsInputError extends Error {
+class SiteSecretError extends Schema2.TaggedError()("SiteSecret.Error", {
+  message: Schema2.String,
+  reason: Schema2.Literals(["invalid-name", "invalid-origins", "invalid-value", "not-found", "read-failed", "write-failed"]),
+  cause: Schema2.optionalKey(Schema2.Defect())
+}) {
 }
-var allowed = (key) => settingSpecs[key].values.map(String).join(", ");
-function parseSettingChanges(input) {
-  if (input === null || typeof input !== "object" || Array.isArray(input))
-    throw new SettingsInputError('Pass the settings to change as an object, for example { grouping: "shared" }.');
-  const problems = [];
-  const changes = {};
-  for (const [key, raw] of Object.entries(input)) {
-    if (!settingKeys.includes(key)) {
-      problems.push(/allow|update|security|node|cookie|foreground|storage|file/i.test(key) ? `"${key}" is not a setting: security switches (${securityVariables.join(", ")}) are set only in the relay's environment, never here.` : `Unknown setting "${key}". Settings: ${settingKeys.join(", ")}.`);
-      continue;
-    }
-    const setting = key;
-    const value = setting === "idleMinutes" ? idleValue(raw) : raw;
-    if (value === undefined || !settingSpecs[setting].values.includes(value)) {
-      problems.push(`${setting} must be one of ${allowed(setting)} (got ${JSON.stringify(raw)}).`);
-      continue;
-    }
-    changes[setting] = value;
-  }
-  if (problems.length)
-    throw new SettingsInputError(problems.join(" "));
-  if (!Object.keys(changes).length)
-    throw new SettingsInputError(`Nothing to change. Settings: ${settingKeys.join(", ")}.`);
-  return changes;
+var defaultSiteSecretsDir = () => path3.join(dataRoot(), "site-secrets");
+function secretPath(baseDir, name) {
+  return profileNamePattern.test(name) ? Effect3.succeed(path3.join(baseDir, `${name}.json`)) : Effect3.fail(new SiteSecretError({ message: `Invalid secret name: ${name} (letters, digits, ".", "_" and "-", up to 64)`, reason: "invalid-name" }));
 }
-function idleValue(raw) {
-  if (raw === "never" || raw === 0 || raw === "0")
-    return "never";
-  if (typeof raw === "number")
-    return raw;
-  if (typeof raw === "string" && /^\d+$/.test(raw))
-    return Number(raw);
-  return;
+function summary2(secret) {
+  return { name: secret.name, kind: secret.kind, allowedOrigins: [...secret.allowedOrigins], createdAt: secret.createdAt, updatedAt: secret.updatedAt };
 }
-function settingsFromExtension(wire) {
-  const values = wire && typeof wire.settings === "object" && wire.settings !== null && !Array.isArray(wire.settings) ? wire.settings : undefined;
-  if (!values)
-    throw new Error("The extension answered settings without them");
-  const settings = {};
-  for (const key of settingKeys) {
-    const value = values[key];
-    if (relaySettingKeys.includes(key))
-      settings[key] = String(settingSpecs[key].values[0]);
-    else if (key === "idleMinutes")
-      settings[key] = value === 0 ? "never" : typeof value === "number" ? value : 10;
-    else
-      settings[key] = typeof value === "string" ? value : String(settingSpecs[key].values[0]);
+var readSecret = Effect3.fn("SiteSecrets.read")(function* (name, options = {}) {
+  const filePath = yield* secretPath(options.baseDir ?? defaultSiteSecretsDir(), name);
+  const text = yield* Effect3.tryPromise({
+    try: () => fs3.readFile(filePath, "utf8"),
+    catch: (cause) => isNodeError(cause) && cause.code === "ENOENT" ? new SiteSecretError({ message: `Secret not found: ${name}. Ask the user to add it with \`opencode-browser secrets add ${name} --origin <origin>\`.`, reason: "not-found" }) : new SiteSecretError({ message: `Could not read secret ${name}`, reason: "read-failed", cause })
+  });
+  return yield* Effect3.try({
+    try: () => Schema2.decodeUnknownSync(StoredSiteSecret)(JSON.parse(text)),
+    catch: (cause) => new SiteSecretError({ message: `Secret ${name} is not a valid secret file`, reason: "read-failed", cause })
+  });
+});
+var addSecret = Effect3.fn("SiteSecrets.add")(function* (options) {
+  const baseDir = options.baseDir ?? defaultSiteSecretsDir();
+  const filePath = yield* secretPath(baseDir, options.name);
+  const kind = options.kind ?? "password";
+  const allowedOrigins = yield* Effect3.try({
+    try: () => normalizeOriginPatterns(options.allowedOrigins),
+    catch: (cause) => new SiteSecretError({ message: cause instanceof Error ? cause.message : "Invalid origins", reason: "invalid-origins", cause })
+  });
+  if (allowedOrigins.length === 0) {
+    return yield* new SiteSecretError({ message: "A secret needs at least one allowed origin (--origin https://example.com)", reason: "invalid-origins" });
   }
-  return settings;
-}
-function settingsToExtension(changes) {
-  return Object.fromEntries(Object.entries(changes).filter(([key]) => !relaySettingKeys.includes(key)).map(([key, value]) => [key, key === "idleMinutes" && value === "never" ? 0 : value]));
-}
-function report(stored, overrides) {
-  return Object.fromEntries(settingKeys.map((key) => {
-    const override = overrides[key];
-    return [key, {
-      value: stored[key],
-      effective: override?.value ?? stored[key],
-      allowed: settingSpecs[key].values,
-      description: settingSpecs[key].label,
-      ...override ? { overriddenBy: override.variable } : {}
-    }];
-  }));
-}
-var securityNote = `Security switches (${securityVariables.join(", ")}) are environment-only and can't be read or changed here.`;
-function describeSettings(stored, overrides) {
-  return { settings: report(stored, overrides), note: securityNote };
+  const value = kind === "totp" ? options.value.trim() : options.value.replace(/\r?\n$/, "");
+  if (!value)
+    return yield* new SiteSecretError({ message: "The secret value is empty", reason: "invalid-value" });
+  if (kind === "totp")
+    yield* Effect3.try({
+      try: () => totpCode(value),
+      catch: (cause) => new SiteSecretError({ message: `Not a TOTP seed or otpauth:// URI: ${cause instanceof Error ? cause.message : "invalid"}`, reason: "invalid-value", cause })
+    });
+  const write = Effect3.gen(function* () {
+    const existing = yield* readSecret(options.name, { baseDir }).pipe(Effect3.catchIf((error) => error.reason === "not-found", () => Effect3.succeed(undefined)));
+    const now = new Date().toISOString();
+    const secret = { version: 1, name: options.name, kind, value, allowedOrigins: [...allowedOrigins], createdAt: existing?.createdAt ?? now, updatedAt: now };
+    yield* Effect3.tryPromise({
+      try: () => writeJsonFileAtomically(filePath, secret, { dirMode: 448 }),
+      catch: (cause) => new SiteSecretError({ message: `Could not write secret ${options.name}`, reason: "write-failed", cause })
+    });
+    return summary2(secret);
+  });
+  return yield* withLock(options.name, { baseDir }, write).pipe(Effect3.mapError((error) => error instanceof SiteSecretError ? error : new SiteSecretError({ message: error.message, reason: "write-failed", cause: error })));
+});
+var listSecrets = Effect3.fn("SiteSecrets.list")(function* (options = {}) {
+  const baseDir = options.baseDir ?? defaultSiteSecretsDir();
+  const names = yield* Effect3.tryPromise({
+    try: () => fs3.readdir(baseDir).catch((cause) => isNodeError(cause) && cause.code === "ENOENT" ? [] : Promise.reject(cause)),
+    catch: (cause) => new SiteSecretError({ message: "Could not list secrets", reason: "read-failed", cause })
+  });
+  const secrets = [];
+  for (const file of names.filter((entry) => entry.endsWith(".json")).sort()) {
+    const secret = yield* readSecret(file.slice(0, -".json".length), { baseDir }).pipe(Effect3.option);
+    if (secret._tag === "Some")
+      secrets.push(summary2(secret.value));
+  }
+  return secrets;
+});
+var removeSecret = Effect3.fn("SiteSecrets.remove")(function* (name, options = {}) {
+  const baseDir = options.baseDir ?? defaultSiteSecretsDir();
+  const filePath = yield* secretPath(baseDir, name);
+  return yield* withLock(name, { baseDir }, Effect3.tryPromise({
+    try: () => fs3.rm(filePath).then(() => true, (cause) => isNodeError(cause) && cause.code === "ENOENT" ? false : Promise.reject(cause)),
+    catch: (cause) => new SiteSecretError({ message: `Could not remove secret ${name}`, reason: "write-failed", cause })
+  })).pipe(Effect3.mapError((error) => error instanceof SiteSecretError ? error : new SiteSecretError({ message: error.message, reason: "write-failed", cause: error })));
+});
+function base32Decode(input) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const clean = input.toUpperCase().replace(/[\s=-]/g, "");
+  if (!clean || /[^A-Z2-7]/.test(clean))
+    throw new Error("the seed must be base32");
+  let bits = 0;
+  let value = 0;
+  const bytes = [];
+  for (const char of clean) {
+    value = value << 5 | alphabet.indexOf(char);
+    bits += 5;
+    if (bits >= 8) {
+      bytes.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(bytes);
 }
-function describeChanges(options) {
-  const changed = [];
-  const unchanged = [];
-  const overridden = [];
-  for (const [key, value] of Object.entries(options.requested)) {
-    const override = options.overrides[key];
-    if (override)
-      overridden.push({ key, requested: value, variable: override.variable, effective: override.value });
-    else if (options.before[key] === options.after[key])
-      unchanged.push(key);
-    else
-      changed.push({ key, from: options.before[key], to: options.after[key] });
+function totpParameters(seed) {
+  if (/^otpauth:\/\//i.test(seed)) {
+    const url = new URL(seed);
+    const secret = url.searchParams.get("secret");
+    if (!secret)
+      throw new Error("the otpauth URI has no secret");
+    const digits = Number(url.searchParams.get("digits") ?? 6);
+    const period = Number(url.searchParams.get("period") ?? 30);
+    const algorithm = (url.searchParams.get("algorithm") ?? "SHA1").toLowerCase();
+    if (![6, 7, 8].includes(digits) || !Number.isInteger(period) || period <= 0 || !["sha1", "sha256", "sha512"].includes(algorithm)) {
+      throw new Error("unsupported otpauth parameters");
+    }
+    return { key: base32Decode(secret), digits, period, algorithm };
   }
-  const lines = [];
-  if (changed.length)
-    lines.push(`Changed ${changed.map((item) => `${item.key} from ${item.from} to ${item.to}`).join(", ")}. Tell the user what you changed; they can change it back on the extension's options page.`);
-  if (unchanged.length)
-    lines.push(`Already set: ${unchanged.map((key) => `${key} is ${options.after[key]}`).join(", ")}.`);
-  for (const item of overridden)
-    lines.push(`Not changed: ${item.key} is fixed to ${item.effective} by ${item.variable} in the relay's environment, so this setting has no effect. Tell the user; to change it they remove or edit ${item.variable} where opencode starts, then run \`${cliCommand("relay restart")}\`.`);
-  return { changed, unchanged, overridden, settings: report(options.after, options.overrides), message: lines.join(" ") };
+  return { key: base32Decode(seed), digits: 6, period: 30, algorithm: "sha1" };
 }
-function formatSettings(settings) {
-  const width = Math.max(...settingKeys.map((key) => key.length));
-  return settingKeys.map((key) => {
-    const item = settings[key];
-    const override = item.overriddenBy ? `  (in effect: ${item.effective}, set by ${item.overriddenBy} on the relay)` : "";
-    return `${key.padEnd(width)}  ${String(item.value).padEnd(9)}  one of ${item.allowed.join(", ")}${override}`;
-  });
+function totpCode(seed, now = Date.now()) {
+  const { key, digits, period, algorithm } = totpParameters(seed);
+  const counter = Buffer.alloc(8);
+  counter.writeBigUInt64BE(BigInt(Math.floor(now / 1000 / period)));
+  const hmac = crypto2.createHmac(algorithm, key).update(counter).digest();
+  const offset = hmac[hmac.length - 1] & 15;
+  const binary = (hmac.readUInt32BE(offset) & 2147483647) % 10 ** digits;
+  return String(binary).padStart(digits, "0");
+}
+function secretText(secret) {
+  return secret.kind === "totp" ? totpCode(secret.value) : secret.value;
 }
 
-export { terminateChildProcess, SecretCollector, looksLikeTokenSegment, AuthProfileError, read, readOptional, withLock, write, status, run, OriginPatternError, parseOriginPatterns, normalizeOriginPatterns, isPrivateAddress, explicitlyAllowsHost, checkUrl, checkNavigationUrl, readSecret, addSecret, listSecrets, removeSecret, secretText, DeadboltError, readClient, socketPath, connect, parseDeadboltName, originOnSite, pickLogin, originsFromPatterns, listLogins, pickPasskey, pair, unpair, isBase64Url, randomName, settingKeys, settingSpecs, securityVariables, SettingsInputError, parseSettingChanges, settingsFromExtension, settingsToExtension, describeSettings, describeChanges, formatSettings };
+export { settingKeys, settingSpecs, securityVariables, SettingsInputError, parseSettingChanges, settingsFromExtension, settingsToExtension, describeSettings, describeChanges, formatSettings, browsersNote2, mcpUpdateNote2, objectSchema, emptyInputSchema, sessionSchemaProperty, sessionAliasSchemaProperty, sessionOnlyInputSchema, ensureSessionExists, parseExecuteArguments, parseAdoptArguments, requiredStringField, optionalStringField, optionalBooleanField, optionalPositiveIntegerField, optionalStringArrayField, requireObject, toolResultForValue2, mcpErrorMessage2, toolResult, DeadboltError, readClient, socketPath, connect, parseDeadboltName, originOnSite, pickLogin, originsFromPatterns, listLogins, pickPasskey, pair, unpair, isBase64Url, randomName, terminateChildProcess, SecretCollector, looksLikeTokenSegment, AuthProfileError, read, readOptional, withLock, write, status, run, OriginPatternError, parseOriginPatterns, normalizeOriginPatterns, isPrivateAddress, explicitlyAllowsHost, checkUrl, checkNavigationUrl, readSecret, addSecret, listSecrets, removeSecret, secretText };