@opengeni/react 6.5.2-canary.41607687019001 → 6.7.0

package/dist/chunk-4DVNUCRR.js

@@ -0,0 +1,2386 @@
+"use client";
+import {
+  useCapabilityToolDefaults
+} from "./chunk-UDMFRWVB.js";
+import {
+  sameSessionForContext
+} from "./chunk-CTBP2E2T.js";
+import {
+  startWorkspaceClientConfigRefresh,
+  withWorkspaceClientConfig
+} from "./chunk-DC6CN2XS.js";
+import {
+  ManagedAuthSessionUnavailableError,
+  signOutWithAuthoritativeReconciliation
+} from "./chunk-MXDZE5ML.js";
+import {
+  beginSocialLoginAnalytics,
+  noteSuccessfulLogin,
+  observeSocialLoginResult
+} from "./chunk-2GTZXN6F.js";
+import {
+  startDeploymentRefresh
+} from "./chunk-ARIV4S6T.js";
+import {
+  deleteWorkspaceWithReconciliation
+} from "./chunk-BZ74K6IE.js";
+import {
+  unlinkGitHubInstallationWithReconciliation
+} from "./chunk-3BCPHI4Q.js";
+import {
+  isAuthorizedWorkspaceId,
+  organizationWorkspacePreferenceStorageId,
+  workspaceNavigationPreferenceStorageId,
+  writeLastWorkspaceId,
+  writeLastWorkspaceIdForOrganization
+} from "./chunk-HC4JFZVU.js";
+import {
+  beginWorkspaceOperation,
+  beginWorkspaceTransition,
+  invalidatePrincipalTransition,
+  invalidateWorkspaceTransition,
+  ownsPrincipalTransition,
+  ownsTransitionInvocation,
+  ownsWorkspaceOperation,
+  ownsWorkspaceTransition,
+  runCurrentTransitionInvocation,
+  runCurrentWorkspaceOperation,
+  runCurrentWorkspaceRequest,
+  settleWorkspaceOperation
+} from "./chunk-ANALJOJL.js";
+import {
+  useManualRepositoryCatalogReconciliation
+} from "./chunk-WGBIFKTP.js";
+import {
+  readBootstrap
+} from "./chunk-CBMZS6DL.js";
+import {
+  runSingleFlight
+} from "./chunk-34XTCKDJ.js";
+import {
+  bootstrapErrorPresentation,
+  bootstrapWaitingPresentation
+} from "./chunk-B7QZASPX.js";
+import {
+  createWithOpeningContext
+} from "./chunk-KMDWWTDF.js";
+import {
+  createQuietRetry
+} from "./chunk-MME2XIN6.js";
+import {
+  creationHandoffReconciled
+} from "./chunk-UKZ3SGNF.js";
+import {
+  markIntegrationConnectRedirect
+} from "./chunk-OXD6ET34.js";
+import {
+  SessionChannelProjectionAuthority,
+  applySessionPinProjection,
+  notifySessionPinChanged,
+  reconcileFailedSessionPin
+} from "./chunk-JHZRAYI4.js";
+import {
+  isPaymentRequiredError,
+  paymentRefusalCode
+} from "./chunk-INXGSG3J.js";
+import {
+  upsertWorkspace
+} from "./chunk-NI7NYZ2O.js";
+import {
+  useConsoleSharedQueries
+} from "./chunk-Z2ZZZ6UF.js";
+import {
+  reusablePersonalGitHubAuthority
+} from "./chunk-MFGKX4C3.js";
+import {
+  buildCreateSessionRequest,
+  classifyCreateSessionFailure,
+  prepareCreateSessionAttempt,
+  retainCreateSessionAttemptAfterFailure
+} from "./chunk-IXPTECSC.js";
+import {
+  t
+} from "./chunk-HSOXMJOT.js";
+import {
+  buildOpenGeniUiTools,
+  buildResources,
+  enabledWorkspaceCapabilityMcpServers,
+  groupRepositories,
+  initialReasoningEffort,
+  installedApiIntegrationMcpServers,
+  isAbortError,
+  mergeMcpServerOptions,
+  selectableMcpServers
+} from "./chunk-ZPW5NFYD.js";
+import {
+  hasWorkspacePermission,
+  isWorkspacePermissionDenied,
+  lacksWorkspacePermission
+} from "./chunk-H2ALCTWC.js";
+import {
+  loadCurrentManagedSelfContext,
+  managedSelfContextIdentity
+} from "./chunk-LBSXJVHD.js";
+import {
+  useNavigate,
+  usePage,
+  useRouterState
+} from "./chunk-BXBDYNRP.js";
+import {
+  useEmbedded,
+  useHostMessageContext,
+  useHostMessageContextTools
+} from "./chunk-ENFLCAR3.js";
+import {
+  toast
+} from "./chunk-O4EA4F3W.js";
+import {
+  createSessionEventFeedStore,
+  useLatestCallback
+} from "./chunk-JDFDPMKX.js";
+import {
+  userErrorText
+} from "./chunk-O4OOG3D6.js";
+import {
+  claimHumanInputDraftOwner,
+  forgetAllHumanInputDrafts
+} from "./chunk-X62OJCQW.js";
+import {
+  composerSubmissionErrorMessage
+} from "./chunk-5MOJZORA.js";
+import {
+  isTransientServiceFailure
+} from "./chunk-5AIMVW6Y.js";
+
+// src/app/app-state.tsx
+import {
+  resolveWorkspaceSessionDefaults,
+  resolveWorkspaceSessionToolDefaults
+} from "@opengeni/contracts";
+import { OpenGeniApiError } from "@opengeni/sdk/browser";
+import {
+  useCallback,
+  useEffect,
+  useInsertionEffect,
+  useMemo,
+  useRef,
+  useState
+} from "react";
+import { flushSync } from "react-dom";
+import { errorMessage } from "@opengeni/contracts/values";
+var GITHUB_STATUS_TOAST_ID = "opengeni-github-status";
+var PERSONAL_GITHUB_STATUS_TOAST_ID = "opengeni-personal-github-status";
+var PERSONAL_GITHUB_RECONNECT_TOAST_ID = "opengeni-personal-github-reconnect";
+function personalGitHubNeedsReconnect(connection) {
+  return Boolean(connection && connection.status !== "active" && connection.status !== "revoked");
+}
+function announcePersonalGitHubReconnect(state, connection, onReconnect) {
+  const key = `${connection.id}:${connection.version}`;
+  if (state.shownFor === key) return;
+  state.shownFor = key;
+  const login = typeof connection.metadata.githubLogin === "string" && connection.metadata.githubLogin ? connection.metadata.githubLogin : null;
+  showPersonalGitHubReconnectToast(login, onReconnect);
+}
+function showPersonalGitHubReconnectToast(githubLogin, onReconnect) {
+  toast.warning("Reconnect your GitHub", {
+    id: PERSONAL_GITHUB_RECONNECT_TOAST_ID,
+    description: `Opengeni can't work as ${githubLogin ? `@${githubLogin}` : "you"} until you reconnect.`,
+    duration: Infinity,
+    closeButton: true,
+    action: { label: "Reconnect", onClick: onReconnect }
+  });
+}
+function clearPersonalGitHubReconnectToast(state) {
+  if (state.shownFor === null) return;
+  state.shownFor = null;
+  toast.dismiss(PERSONAL_GITHUB_RECONNECT_TOAST_ID);
+}
+function preserveSlackLinkForManagedAuth(mode, phase) {
+  return mode === "signin" && phase === "raw";
+}
+function createSlackLinkPrepareController(value) {
+  let workspaceId = value?.workspaceId ?? null;
+  let bearer = value?.token ?? null;
+  let inFlight = null;
+  let prepared = null;
+  let failure;
+  let hasFailure = false;
+  let generation = 0;
+  return {
+    workspaceId: () => workspaceId,
+    phase: () => {
+      if (!workspaceId) return "none";
+      if (bearer !== null) return "raw";
+      if (inFlight) return "in_flight";
+      if (prepared !== null) return "prepared";
+      return hasFailure ? "failed" : "none";
+    },
+    prepare: (requestedWorkspaceId, exchange) => {
+      if (!workspaceId || requestedWorkspaceId !== workspaceId) return Promise.resolve(null);
+      if (prepared !== null) return Promise.resolve(prepared);
+      if (hasFailure) return Promise.reject(failure);
+      if (inFlight) return inFlight;
+      if (bearer === null) return Promise.resolve(null);
+      const token = bearer;
+      const claimedGeneration = generation;
+      let exchangePromise;
+      try {
+        exchangePromise = exchange(token);
+      } catch (error) {
+        exchangePromise = Promise.reject(error);
+      }
+      bearer = null;
+      let flight;
+      flight = exchangePromise.then(
+        (request) => {
+          if (generation === claimedGeneration) prepared = request;
+          return request;
+        },
+        (error) => {
+          if (generation === claimedGeneration) {
+            failure = error;
+            hasFailure = true;
+          }
+          throw error;
+        }
+      ).finally(() => {
+        if (generation === claimedGeneration && inFlight === flight) inFlight = null;
+      });
+      inFlight = flight;
+      return flight;
+    },
+    clear: () => {
+      generation += 1;
+      workspaceId = null;
+      bearer = null;
+      inFlight = null;
+      prepared = null;
+      failure = void 0;
+      hasFailure = false;
+    }
+  };
+}
+function useAppState(host, appStateOptions) {
+  const messageContext = useHostMessageContext();
+  const embedded = useEmbedded();
+  const hostMessageContext = useRef(messageContext);
+  hostMessageContext.current = messageContext;
+  const messageContextTools = useHostMessageContextTools();
+  const hostMessageContextTools = useRef(messageContextTools);
+  hostMessageContextTools.current = messageContextTools;
+  const {
+    captureProductEvent,
+    checkDeploymentRevision,
+    clearStoredAccessKey,
+    configureManagedActorEpoch,
+    createOpenGeniClient,
+    fetchAuthSession,
+    fetchClientConfig,
+    getStoredAccessKey,
+    setStoredAccessKey,
+    signInEmail,
+    signOutManaged,
+    signUpEmail,
+    startManagedSocialSignIn,
+    signInPasskey,
+    signUpPasskey,
+    slackLink
+  } = host;
+  const [session, setSessionState] = useState(null);
+  const [sessionChannelProjectionAuthority] = useState(
+    () => new SessionChannelProjectionAuthority()
+  );
+  const [sessionCreationHandoff, setSessionCreationHandoff] = useState(null);
+  const [clientConfig, setClientConfig] = useState(null);
+  const [workspaceConfig, setWorkspaceConfig] = useState(
+    void 0
+  );
+  const [workspaceConfigVersion, setWorkspaceConfigVersion] = useState(0);
+  const [configError, setConfigError] = useState(null);
+  const [configRequestVersion, setConfigRequestVersion] = useState(0);
+  const [authSession, setAuthSession] = useState(void 0);
+  const [managedAuthBootstrapComplete, setManagedAuthBootstrapComplete] = useState(false);
+  const [accessContext, setAccessContext] = useState(null);
+  const accessContextRef = useRef(accessContext);
+  useInsertionEffect(() => {
+    accessContextRef.current = accessContext;
+  }, [accessContext]);
+  const [workspaces, setWorkspaces] = useState([]);
+  const [managedSelfContext, setManagedSelfContext] = useState(null);
+  const [slackLinkContinuationWorkspaceId, setSlackLinkContinuationWorkspaceId] = useState(slackLink.workspaceId);
+  const [invalidSlackLinkQueryWorkspaceId, setInvalidSlackLinkQueryWorkspaceId] = useState(host.initialInvalidSlackLinkQueryWorkspaceId);
+  const [accessLoading, setAccessLoading] = useState(false);
+  const [accessError, setAccessError] = useState(null);
+  const [creditRequired, setCreditRequired] = useState(null);
+  const [model, setModel] = useState("gpt-6-astra");
+  const [reasoningEffort, setReasoningEffort] = useState("low");
+  const [latencyMode, setLatencyMode] = useState("standard");
+  const [inspectorOpen, setInspectorOpen] = useState(false);
+  const [connectionState, setConnectionState] = useState("idle");
+  const [sessionEventFeedStore] = useState(createSessionEventFeedStore);
+  useEffect(() => {
+    const retireReconciledCreation = () => {
+      const feed = sessionEventFeedStore.getSnapshot();
+      if (!feed) return;
+      setSessionCreationHandoff(
+        (current) => creationHandoffReconciled(current, feed.events) ? null : current
+      );
+    };
+    retireReconciledCreation();
+    return sessionEventFeedStore.subscribe(retireReconciledCreation);
+  }, [sessionEventFeedStore]);
+  const [manualRepos, setManualRepos] = useState([]);
+  const [manualReposOpen, setManualReposOpen] = useState(false);
+  const [nextRepoId, setNextRepoId] = useState(1);
+  const [selectedRepoIds, setSelectedRepoIds] = useState(() => /* @__PURE__ */ new Set());
+  const [selectedRepoRefs, setSelectedRepoRefs] = useState({});
+  const [githubRepos, setGithubRepos] = useState([]);
+  const [githubStatus, setGithubStatus] = useState(null);
+  const [githubStatusFailed, setGithubStatusFailed] = useState(false);
+  const [githubCatalogReady, setGithubCatalogReady] = useState(false);
+  const [personalGitHubStatus, setPersonalGitHubStatus] = useState(null);
+  const [personalGitHubRepositories, setPersonalGitHubRepositories] = useState([]);
+  const [personalGitHubSelection, setPersonalGitHubSelection] = useState(null);
+  const [personalGitHubCatalogReady, setPersonalGitHubCatalogReady] = useState(false);
+  const [personalGitHubBusy, setPersonalGitHubBusy] = useState(false);
+  const [selectedPersonalGitHubRepoIds, setSelectedPersonalGitHubRepoIds] = useState(
+    () => /* @__PURE__ */ new Set()
+  );
+  const [selectedPersonalGitHubRepoRefs, setSelectedPersonalGitHubRepoRefs] = useState({});
+  const [personalGitHubAuthorityCache, setPersonalGitHubAuthorityCache] = useState(null);
+  const personalGitHubAuthority = personalGitHubAuthorityCache?.authority ?? null;
+  const [githubOrg, setGithubOrg] = useState("");
+  const [workspaceMcpServers, setWorkspaceMcpServers] = useState([]);
+  const [workspaceCapabilityCatalog, setWorkspaceCapabilityCatalog] = useState([]);
+  const [workspaceMemberIntegrationSetup, setWorkspaceMemberIntegrationSetup] = useState(void 0);
+  const [workspaceMcpCatalogReady, setWorkspaceMcpCatalogReady] = useState(false);
+  const [workspaceMcpCatalogLoadedSuccessfully, setWorkspaceMcpCatalogLoadedSuccessfully] = useState(false);
+  const [selectedCapabilityToolIds, setSelectedCapabilityToolIds] = useState(
+    () => /* @__PURE__ */ new Set()
+  );
+  const [workspaceStateOwnerId, setWorkspaceStateOwnerId] = useState(null);
+  const workspaceTransitionIdentity = useRef({
+    workspaceId: null,
+    revision: 0
+  });
+  const principalTransitionIdentity = useRef({
+    revision: 0
+  });
+  const workspaceOperationSequence = useRef(0);
+  const activeCreateOperation = useRef(null);
+  const githubManifestOperationSequence = useRef(0);
+  const activeGitHubManifestOperation = useRef(null);
+  const githubDisconnectOperationSequence = useRef(0);
+  const activeGitHubDisconnectOperation = useRef(null);
+  const authPrincipalIdRef = useRef(null);
+  const accessPrincipalIdRef = useRef(null);
+  const managedSelfContextIdentityRef = useRef(null);
+  const seenCapabilityToolIds = useRef(/* @__PURE__ */ new Set());
+  const githubRefreshId = useRef(0);
+  const personalGitHubRefreshId = useRef(0);
+  const githubQuietRetry = useRef(createQuietRetry());
+  const personalGitHubQuietRetry = useRef(createQuietRetry());
+  const refreshGitHubRef = useRef(async () => {
+  });
+  const refreshPersonalGitHubRef = useRef(async () => {
+  });
+  const personalGitHubReconnectToast = useRef({ shownFor: null });
+  const reconnectPersonalGitHubFromToast = useLatestCallback(
+    (workspaceId, connectionId) => void beginPersonalGitHubOAuth(workspaceId, true, connectionId)
+  );
+  useEffect(
+    () => () => {
+      githubQuietRetry.current.reset();
+      personalGitHubQuietRetry.current.reset();
+    },
+    []
+  );
+  const mcpRefreshId = useRef(0);
+  const mcpCatalogRequests = useRef(/* @__PURE__ */ new Map());
+  const pendingCreateAttempt = useRef(null);
+  const appliedWorkspaceSessionDefaultsKey = useRef(null);
+  const appliedWorkspaceToolDefaultsKey = useRef(null);
+  const [busy, setBusy] = useState(false);
+  const [repoBusy, setRepoBusy] = useState(false);
+  const [githubAppBusy, setGithubAppBusy] = useState(false);
+  const [hasAccessKey, setHasAccessKey] = useState(() => getStoredAccessKey() !== null);
+  const [accessKeyDraft, setAccessKeyDraft] = useState("");
+  const [accessKeyVersion, setAccessKeyVersion] = useState(0);
+  const keyAuthRequired = host.authority === "app" && (clientConfig?.auth.mode === "deploymentKey" || clientConfig?.auth.mode === "configuredToken");
+  const managedAuthRequired = host.authority === "app" && clientConfig?.auth.mode === "managedSession";
+  const browserAccountsConfigured = managedAuthRequired && clientConfig?.managedAuthSessionSetMode !== "legacy";
+  const browserAccountsEnabled = browserAccountsConfigured && managedAuthBootstrapComplete;
+  const managedEmailVerificationRequired = clientConfig?.auth.mode === "managedSession" ? clientConfig.auth.emailVerificationRequired ?? true : true;
+  const managedSocialProviders = clientConfig?.auth.mode === "managedSession" ? clientConfig.auth.socialProviders ?? [] : [];
+  const managedPasskeySignIn = clientConfig?.auth.mode === "managedSession" && clientConfig.auth.passkeySignIn === true && signInPasskey !== void 0;
+  const managedPasskeySignUp = managedPasskeySignIn && clientConfig?.auth.mode === "managedSession" && clientConfig.auth.passkeySignUp === true && signUpPasskey !== void 0;
+  const managedNewSignupsEnabled = clientConfig?.auth.mode === "managedSession" ? clientConfig.auth.newSignupsEnabled !== false : true;
+  const keyAuthReady = !keyAuthRequired || hasAccessKey;
+  const managedAuthReady = !managedAuthRequired || Boolean(authSession);
+  const authReady = keyAuthReady && managedAuthReady;
+  const defaultWorkspaceId = accessContext?.defaultWorkspaceId ?? workspaces[0]?.id ?? accessContext?.workspaceGrants[0]?.workspaceId ?? null;
+  const navigate = useNavigate();
+  const hostPage = usePage();
+  const pathname = useRouterState({
+    select: (state) => state.location.pathname
+  });
+  useEffect(() => {
+    if (!browserAccountsConfigured) configureManagedActorEpoch(null);
+    return () => configureManagedActorEpoch(null);
+  }, [browserAccountsConfigured, configureManagedActorEpoch]);
+  useEffect(() => {
+    if (invalidSlackLinkQueryWorkspaceId && pathname !== `/workspaces/${encodeURIComponent(invalidSlackLinkQueryWorkspaceId)}/capabilities`) {
+      setInvalidSlackLinkQueryWorkspaceId(null);
+    }
+  }, [invalidSlackLinkQueryWorkspaceId, pathname]);
+  const client = useMemo(() => {
+    void accessKeyVersion;
+    return createOpenGeniClient(sessionChannelProjectionAuthority.beginRead);
+  }, [accessKeyVersion, createOpenGeniClient, sessionChannelProjectionAuthority]);
+  useConsoleSharedQueries(client);
+  const setSession = useCallback((value) => {
+    setSessionState((current) => {
+      const next = typeof value === "function" ? value(current) : value;
+      return sameSessionForContext(current, next) ? current : next;
+    });
+  }, []);
+  const resetSessionView = useCallback(() => {
+    setSession(null);
+    setSessionCreationHandoff(null);
+    setConnectionState("idle");
+    sessionEventFeedStore.set(null);
+  }, [sessionEventFeedStore, setSession]);
+  const resetWorkspaceIntegrations = useCallback(() => {
+    setGithubStatus(null);
+    setGithubStatusFailed(false);
+    setGithubRepos([]);
+    setGithubCatalogReady(false);
+    setPersonalGitHubStatus(null);
+    setPersonalGitHubRepositories([]);
+    setPersonalGitHubSelection(null);
+    setPersonalGitHubCatalogReady(false);
+    setPersonalGitHubAuthorityCache(null);
+    setWorkspaceMcpServers([]);
+    setWorkspaceCapabilityCatalog([]);
+    setWorkspaceMemberIntegrationSetup(void 0);
+    setWorkspaceMcpCatalogReady(false);
+    setWorkspaceMcpCatalogLoadedSuccessfully(false);
+  }, []);
+  const resetWorkspaceState = useCallback(
+    (workspaceId, force) => {
+      const previousWorkspaceId = workspaceTransitionIdentity.current.workspaceId;
+      const transition = workspaceId === null ? {
+        identity: invalidateWorkspaceTransition(workspaceTransitionIdentity.current),
+        changed: true
+      } : beginWorkspaceTransition(workspaceTransitionIdentity.current, workspaceId);
+      if (!force && !transition.changed) {
+        return;
+      }
+      workspaceTransitionIdentity.current = transition.identity;
+      if (previousWorkspaceId && (force || previousWorkspaceId !== workspaceId)) {
+        sessionChannelProjectionAuthority.clearWorkspace(previousWorkspaceId);
+      }
+      activeCreateOperation.current = null;
+      activeGitHubManifestOperation.current = null;
+      activeGitHubDisconnectOperation.current = null;
+      githubRefreshId.current += 1;
+      personalGitHubRefreshId.current += 1;
+      mcpRefreshId.current += 1;
+      pendingCreateAttempt.current = null;
+      resetSessionView();
+      setInspectorOpen(false);
+      setManualRepos([]);
+      setManualReposOpen(false);
+      setNextRepoId(1);
+      setSelectedRepoIds(/* @__PURE__ */ new Set());
+      setSelectedRepoRefs({});
+      setSelectedPersonalGitHubRepoIds(/* @__PURE__ */ new Set());
+      setSelectedPersonalGitHubRepoRefs({});
+      setSelectedCapabilityToolIds(/* @__PURE__ */ new Set());
+      seenCapabilityToolIds.current = /* @__PURE__ */ new Set();
+      appliedWorkspaceToolDefaultsKey.current = null;
+      setGithubOrg("");
+      setBusy(false);
+      setRepoBusy(false);
+      setGithubAppBusy(false);
+      setPersonalGitHubBusy(false);
+      resetWorkspaceIntegrations();
+      setWorkspaceConfig(void 0);
+      setWorkspaceStateOwnerId(workspaceId);
+    },
+    [resetSessionView, resetWorkspaceIntegrations, sessionChannelProjectionAuthority]
+  );
+  const prepareWorkspaceTransition = useCallback(
+    (workspaceId) => resetWorkspaceState(workspaceId, false),
+    [resetWorkspaceState]
+  );
+  const captureWorkspaceInvocation = useCallback(
+    (workspaceId) => {
+      const accepted = workspaceTransitionIdentity.current;
+      return ownsWorkspaceTransition(accepted, accepted, workspaceId) ? accepted : null;
+    },
+    []
+  );
+  const ownsWorkspaceInvocation = useCallback(
+    (workspaceId, accepted) => ownsWorkspaceTransition(workspaceTransitionIdentity.current, accepted, workspaceId),
+    []
+  );
+  const clientConfigurationReady = clientConfig !== null;
+  useEffect(() => {
+    if (!clientConfigurationReady || !authReady || !workspaceStateOwnerId) return;
+    const workspaceId = workspaceStateOwnerId;
+    const accepted = captureWorkspaceInvocation(workspaceId);
+    if (!accepted) return;
+    return startWorkspaceClientConfigRefresh({
+      read: (signal) => fetchClientConfig(signal, workspaceId),
+      ownsWorkspace: () => ownsWorkspaceInvocation(workspaceId, accepted),
+      apply: setWorkspaceConfig,
+      subscribeFocus: (refresh) => {
+        window.addEventListener("focus", refresh);
+        return () => window.removeEventListener("focus", refresh);
+      }
+    });
+  }, [
+    fetchClientConfig,
+    clientConfigurationReady,
+    authReady,
+    workspaceStateOwnerId,
+    workspaceConfigVersion,
+    accessContext?.subjectId,
+    accessKeyVersion,
+    captureWorkspaceInvocation,
+    ownsWorkspaceInvocation
+  ]);
+  const refreshWorkspaceConfig = useCallback(
+    () => setWorkspaceConfigVersion((version) => version + 1),
+    []
+  );
+  const invalidatePrincipalWorkspaceState = useCallback(
+    (options) => {
+      principalTransitionIdentity.current = invalidatePrincipalTransition(
+        principalTransitionIdentity.current
+      );
+      authPrincipalIdRef.current = null;
+      accessPrincipalIdRef.current = null;
+      managedSelfContextIdentityRef.current = null;
+      setManagedSelfContext(null);
+      if (options?.preservePendingSlackLink !== true) {
+        slackLink.clear();
+        setSlackLinkContinuationWorkspaceId(null);
+      }
+      resetWorkspaceState(null, true);
+    },
+    [resetWorkspaceState, slackLink]
+  );
+  useEffect(() => {
+    if (appStateOptions.bootstrapSuspended) return;
+    let cancelled = false;
+    let stopDeploymentRefresh = () => {
+    };
+    const controller = new AbortController();
+    void Promise.resolve().then(
+      () => readBootstrap({
+        context: "client_configuration",
+        request: () => fetchClientConfig(controller.signal),
+        signal: controller.signal,
+        // An update parks the API for a while: say so calmly and continue
+        // on our own as soon as it answers.
+        waiting: {
+          onWaiting: (error, elapsedMs) => {
+            if (!cancelled) {
+              setConfigError(
+                bootstrapWaitingPresentation(error, "client_configuration", elapsedMs)
+              );
+            }
+          }
+        }
+      })
+    ).then((config) => {
+      if (cancelled) {
+        return;
+      }
+      setClientConfig(config);
+      setConfigError(null);
+      setModel(config.defaultModel);
+      setReasoningEffort(initialReasoningEffort(config));
+      setLatencyMode("standard");
+      if (checkDeploymentRevision) {
+        stopDeploymentRefresh = startDeploymentRefresh(checkDeploymentRevision);
+      }
+    }).catch((error) => {
+      if (cancelled) {
+        return;
+      }
+      const presentation = bootstrapErrorPresentation(error, "client_configuration");
+      setConfigError(presentation);
+    });
+    return () => {
+      cancelled = true;
+      controller.abort();
+      stopDeploymentRefresh();
+    };
+  }, [
+    checkDeploymentRevision,
+    configRequestVersion,
+    fetchClientConfig,
+    appStateOptions.bootstrapSuspended
+  ]);
+  useEffect(() => {
+    if (!clientConfig) {
+      setManagedAuthBootstrapComplete(false);
+      return;
+    }
+    if (!managedAuthRequired) {
+      if (authPrincipalIdRef.current !== null) {
+        invalidatePrincipalWorkspaceState();
+      }
+      setAuthSession(null);
+      setManagedAuthBootstrapComplete(true);
+      return;
+    }
+    let cancelled = false;
+    const acceptedPrincipal = principalTransitionIdentity.current;
+    const controller = new AbortController();
+    setManagedAuthBootstrapComplete(false);
+    setAuthSession(void 0);
+    void readBootstrap({
+      context: "client_configuration",
+      request: fetchAuthSession,
+      signal: controller.signal,
+      waiting: {
+        onWaiting: (error, elapsedMs) => {
+          if (!cancelled) {
+            setConfigError(bootstrapWaitingPresentation(error, "client_configuration", elapsedMs));
+          }
+        }
+      }
+    }).then((nextSession) => {
+      if (cancelled || !ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal)) {
+        return;
+      }
+      setConfigError((current) => current?.recovering ? null : current);
+      const nextPrincipalId = nextSession?.user.id ?? null;
+      if (authPrincipalIdRef.current !== null && authPrincipalIdRef.current !== nextPrincipalId) {
+        invalidatePrincipalWorkspaceState();
+      }
+      authPrincipalIdRef.current = nextPrincipalId;
+      observeSocialLoginResult(nextSession);
+      setAuthSession(nextSession);
+      setManagedAuthBootstrapComplete(true);
+    }).catch(() => {
+      if (cancelled || !ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal)) {
+        return;
+      }
+      setConfigError((current) => current?.recovering ? null : current);
+      setAuthSession(null);
+      setManagedAuthBootstrapComplete(true);
+    });
+    return () => {
+      cancelled = true;
+      controller.abort();
+    };
+  }, [clientConfig, fetchAuthSession, managedAuthRequired, invalidatePrincipalWorkspaceState]);
+  useEffect(() => {
+    if (!clientConfig || !authReady) {
+      setAccessContext(null);
+      setWorkspaces([]);
+      managedSelfContextIdentityRef.current = null;
+      setManagedSelfContext(null);
+      setAccessLoading(false);
+      setAccessError(null);
+      return;
+    }
+    let cancelled = false;
+    let acceptedPrincipal = principalTransitionIdentity.current;
+    const acceptedManagedIdentity = managedAuthRequired && authSession ? managedSelfContextIdentity({
+      credentialGeneration: accessKeyVersion,
+      managedUserId: authSession.user.id
+    }) : null;
+    managedSelfContextIdentityRef.current = acceptedManagedIdentity;
+    setManagedSelfContext(null);
+    setAccessLoading(true);
+    setAccessError((current) => current?.recovering ? current : null);
+    const controller = new AbortController();
+    const readAccess = (request) => readBootstrap({
+      context: "workspace_access",
+      request,
+      signal: controller.signal,
+      isCurrent: () => ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal),
+      waiting: {
+        onWaiting: (error, elapsedMs) => {
+          if (!cancelled && ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal)) {
+            setAccessError(bootstrapWaitingPresentation(error, "workspace_access", elapsedMs));
+          }
+        }
+      }
+    });
+    const selfContextPromise = acceptedManagedIdentity ? loadCurrentManagedSelfContext({
+      identity: acceptedManagedIdentity,
+      currentIdentity: () => managedSelfContextIdentityRef.current,
+      request: () => readAccess(() => client.listOrganizationMemberships())
+    }) : Promise.resolve(null);
+    void Promise.all([
+      readAccess(() => client.getAccessContext()),
+      readAccess(() => client.listWorkspaces()),
+      selfContextPromise
+    ]).then(([context, nextWorkspaces, nextManagedSelfContext]) => {
+      if (cancelled || !ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal)) {
+        return;
+      }
+      setAccessError((current) => current?.recovering ? null : current);
+      if (acceptedManagedIdentity && nextManagedSelfContext === null) {
+        return;
+      }
+      if (nextManagedSelfContext && context.subjectId !== nextManagedSelfContext.identity.subjectId) {
+        throw new Error("managed self context did not match the authenticated subject");
+      }
+      if (accessPrincipalIdRef.current !== null && accessPrincipalIdRef.current !== context.subjectId) {
+        invalidatePrincipalWorkspaceState();
+        acceptedPrincipal = principalTransitionIdentity.current;
+        managedSelfContextIdentityRef.current = acceptedManagedIdentity;
+      }
+      accessPrincipalIdRef.current = context.subjectId;
+      claimHumanInputDraftOwner(context.subjectId);
+      setAccessContext(context);
+      setWorkspaces(nextWorkspaces);
+      setManagedSelfContext(nextManagedSelfContext);
+    }).catch((error) => {
+      if (cancelled || !ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal)) {
+        return;
+      }
+      const presentation = bootstrapErrorPresentation(error, "workspace_access");
+      controller.abort();
+      setAccessContext(null);
+      setWorkspaces([]);
+      setAccessError(presentation);
+    }).finally(() => {
+      if (!cancelled && ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal)) {
+        setAccessLoading(false);
+      }
+    });
+    return () => {
+      cancelled = true;
+      if (managedSelfContextIdentityRef.current === acceptedManagedIdentity) {
+        managedSelfContextIdentityRef.current = null;
+      }
+      controller.abort();
+    };
+  }, [
+    accessKeyVersion,
+    authSession,
+    clientConfig,
+    authReady,
+    client,
+    managedAuthRequired,
+    invalidatePrincipalWorkspaceState
+  ]);
+  useEffect(() => {
+    if (!accessContext) return;
+    const workspaceId = /^\/workspaces\/([^/]+)/.exec(pathname)?.[1] ?? null;
+    if (!isAuthorizedWorkspaceId(workspaceId, workspaces, accessContext)) return;
+    writeLastWorkspaceId(
+      workspaceNavigationPreferenceStorageId(accessContext.subjectId),
+      workspaceId
+    );
+    const accountId = workspaces.find((workspace) => workspace.id === workspaceId)?.accountId;
+    if (accountId) {
+      writeLastWorkspaceIdForOrganization(
+        organizationWorkspacePreferenceStorageId(accessContext.subjectId),
+        accountId,
+        workspaceId
+      );
+    }
+  }, [accessContext, pathname, workspaces]);
+  useEffect(() => {
+    if (!clientConfig) return;
+    const workspaceId = /^\/workspaces\/([^/]+)/.exec(pathname)?.[1] ?? null;
+    if (!workspaceId) return;
+    const workspace = workspaces.find((candidate) => candidate.id === workspaceId);
+    if (!workspace) return;
+    const configured = resolveWorkspaceSessionDefaults(workspace.settings);
+    const nextModel = configured?.model ?? clientConfig.defaultModel;
+    const nextEffort = configured?.reasoningEffort ?? initialReasoningEffort(clientConfig);
+    const key = `${workspaceId}\0${nextModel}\0${nextEffort}`;
+    if (appliedWorkspaceSessionDefaultsKey.current === key) return;
+    appliedWorkspaceSessionDefaultsKey.current = key;
+    setModel(nextModel);
+    setReasoningEffort(nextEffort);
+    setLatencyMode("standard");
+  }, [clientConfig, pathname, workspaces]);
+  const repositoryGroups = useMemo(() => groupRepositories(githubRepos), [githubRepos]);
+  const toolMcpServers = useMemo(
+    () => mergeMcpServerOptions(selectableMcpServers(clientConfig), workspaceMcpServers),
+    [clientConfig, workspaceMcpServers]
+  );
+  const routedWorkspaceId = /^\/workspaces\/([^/]+)/.exec(pathname)?.[1] ?? null;
+  const routedWorkspace = workspaces.find((workspace) => workspace.id === routedWorkspaceId) ?? null;
+  const configuredWorkspaceToolDefaults = useMemo(
+    () => resolveWorkspaceSessionToolDefaults(routedWorkspace?.settings),
+    [routedWorkspace?.settings]
+  );
+  const workspaceDefaultToolIds = useMemo(() => {
+    const available = new Set(toolMcpServers.map((server) => server.id));
+    const configured = configuredWorkspaceToolDefaults?.mcpServerIds;
+    return configured ? [
+      .../* @__PURE__ */ new Set([
+        ...configured.filter((id) => available.has(id)),
+        ...configuredWorkspaceToolDefaults?.inheritConnectedMcpServers ? toolMcpServers.filter((server) => !["opengeni", "files", "docs"].includes(server.id)).map((server) => server.id) : []
+      ])
+    ] : toolMcpServers.map((server) => server.id);
+  }, [configuredWorkspaceToolDefaults, toolMcpServers]);
+  const lastValidResources = useRef([]);
+  const repositoryBuild = useMemo(() => {
+    try {
+      return {
+        resources: buildResources(
+          manualRepos,
+          githubRepos,
+          selectedRepoIds,
+          selectedRepoRefs,
+          personalGitHubRepositories,
+          selectedPersonalGitHubRepoIds,
+          selectedPersonalGitHubRepoRefs,
+          personalGitHubSelection?.credentialBindingId ?? null
+        ),
+        error: null
+      };
+    } catch (error) {
+      return {
+        resources: lastValidResources.current,
+        error: errorMessage(error)
+      };
+    }
+  }, [
+    manualRepos,
+    githubRepos,
+    selectedRepoIds,
+    selectedRepoRefs,
+    personalGitHubRepositories,
+    selectedPersonalGitHubRepoIds,
+    selectedPersonalGitHubRepoRefs,
+    personalGitHubSelection?.credentialBindingId
+  ]);
+  useEffect(() => {
+    if (!repositoryBuild.error) lastValidResources.current = repositoryBuild.resources;
+  }, [repositoryBuild]);
+  useManualRepositoryCatalogReconciliation({
+    manualRepos,
+    selectedRepoIds,
+    selectedRepoRefs,
+    repositories: githubRepos,
+    catalogReady: githubCatalogReady,
+    personalRepositories: personalGitHubRepositories,
+    selectedPersonalRepoIds: selectedPersonalGitHubRepoIds,
+    selectedPersonalRepoRefs: selectedPersonalGitHubRepoRefs,
+    setManualRepos,
+    setSelectedRepoIds,
+    setSelectedRepoRefs
+  });
+  const currentResources = repositoryBuild.resources;
+  const repositoryValidationError = repositoryBuild.error;
+  useCapabilityToolDefaults({
+    principalKey: JSON.stringify(principalTransitionIdentity.current),
+    ready: clientConfig !== null && !/^\/workspaces\/[^/]+\/sessions\/?$/.test(pathname),
+    workspaceId: routedWorkspaceId,
+    configuredIds: configuredWorkspaceToolDefaults?.mcpServerIds,
+    availableIds: toolMcpServers.map((server) => server.id),
+    defaultIds: workspaceDefaultToolIds,
+    appliedKey: appliedWorkspaceToolDefaultsKey,
+    seenIds: seenCapabilityToolIds,
+    setSelected: setSelectedCapabilityToolIds
+  });
+  async function createWorkspace(request) {
+    const acceptedTransition = workspaceTransitionIdentity.current;
+    const ownsInvocation = () => ownsTransitionInvocation(workspaceTransitionIdentity.current, acceptedTransition);
+    let created;
+    try {
+      const creation = await runCurrentTransitionInvocation({
+        isCurrent: ownsInvocation,
+        request: async () => await client.createWorkspace(request)
+      });
+      if (creation.status === "stale") return null;
+      created = creation.value;
+    } catch (error) {
+      toast.error("Failed to create workspace", {
+        description: userErrorText(error)
+      });
+      return null;
+    }
+    setWorkspaces((current) => upsertWorkspace(current, created));
+    captureProductEvent("workspace_created", {
+      $insert_id: `workspace_created:${created.id}`,
+      account_id: created.accountId,
+      workspace_id: created.id
+    });
+    try {
+      const accessRefresh = await runCurrentTransitionInvocation({
+        isCurrent: ownsInvocation,
+        request: async () => await client.getAccessContext()
+      });
+      if (accessRefresh.status === "stale") return null;
+      claimHumanInputDraftOwner(accessRefresh.value.subjectId);
+      setAccessContext(accessRefresh.value);
+    } catch {
+      toast.warning("Permissions may be out of date", {
+        description: "Reload if something looks off."
+      });
+    }
+    return created;
+  }
+  async function renameWorkspace(workspaceId, name) {
+    const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+    if (!acceptedTransition) return null;
+    try {
+      const update = await runCurrentTransitionInvocation({
+        isCurrent: () => ownsWorkspaceInvocation(workspaceId, acceptedTransition),
+        request: async () => await client.updateWorkspace(workspaceId, { name })
+      });
+      if (update.status === "stale") return null;
+      setWorkspaces((current) => upsertWorkspace(current, update.value));
+      return update.value;
+    } catch (error) {
+      toast.error("Failed to rename workspace", {
+        description: userErrorText(error)
+      });
+      return null;
+    }
+  }
+  async function setWorkspaceInferenceControl(workspaceId, action) {
+    const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+    if (!acceptedTransition) return false;
+    const current = workspaces.find((workspace) => workspace.id === workspaceId);
+    const update = await runCurrentTransitionInvocation({
+      isCurrent: () => ownsWorkspaceInvocation(workspaceId, acceptedTransition),
+      request: async () => await client.setWorkspaceInferenceState(workspaceId, {
+        action,
+        clientEventId: crypto.randomUUID(),
+        ...current ? { expectedRevision: current.inferenceControl.revision } : {}
+      })
+    });
+    if (update.status === "stale") return false;
+    const response = update.value;
+    setWorkspaces(
+      (all) => all.map(
+        (workspace) => workspace.id === workspaceId ? {
+          ...workspace,
+          inferenceControl: {
+            state: response.state,
+            revision: response.revision,
+            reason: null,
+            changedBy: null,
+            changedAt: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        } : workspace
+      )
+    );
+    return true;
+  }
+  const refreshWorkspace = useCallback(
+    async (workspaceId) => {
+      const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+      if (!acceptedTransition) return;
+      const refresh = await runCurrentTransitionInvocation({
+        isCurrent: () => ownsWorkspaceInvocation(workspaceId, acceptedTransition),
+        request: async () => await client.getWorkspace(workspaceId)
+      });
+      if (refresh.status === "stale") return;
+      setWorkspaces((current) => upsertWorkspace(current, refresh.value));
+    },
+    [captureWorkspaceInvocation, client, ownsWorkspaceInvocation]
+  );
+  async function updateWorkspaceSettings(workspaceId, settings) {
+    const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+    if (!acceptedTransition) return null;
+    try {
+      const update = await runCurrentTransitionInvocation({
+        isCurrent: () => ownsWorkspaceInvocation(workspaceId, acceptedTransition),
+        request: async () => await client.updateWorkspaceSettings(workspaceId, settings)
+      });
+      if (update.status === "stale") return null;
+      setWorkspaces((current) => upsertWorkspace(current, update.value));
+      return update.value;
+    } catch (error) {
+      toast.error("Failed to update workspace settings", {
+        description: userErrorText(error)
+      });
+      return null;
+    }
+  }
+  async function setWorkspaceDefaultRig(workspaceId, rigId) {
+    const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+    if (!acceptedTransition) return null;
+    try {
+      const update = await runCurrentTransitionInvocation({
+        isCurrent: () => ownsWorkspaceInvocation(workspaceId, acceptedTransition),
+        request: async () => await client.setWorkspaceDefaultRig(workspaceId, {
+          rigId
+        })
+      });
+      if (update.status === "stale") return null;
+      setWorkspaces((current) => upsertWorkspace(current, update.value));
+      return update.value;
+    } catch (error) {
+      toast.error("Failed to update the workspace default sandbox environment", {
+        description: userErrorText(error)
+      });
+      return null;
+    }
+  }
+  async function updateSessionTitle(workspaceId, sessionId, title) {
+    const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+    if (!acceptedTransition) return null;
+    try {
+      const update = await runCurrentTransitionInvocation({
+        isCurrent: () => ownsWorkspaceInvocation(workspaceId, acceptedTransition),
+        request: async () => await client.updateSession(workspaceId, sessionId, {
+          title
+        })
+      });
+      if (update.status === "stale") return null;
+      const updated = update.value;
+      setSession(
+        (current) => current && current.id === updated.id ? {
+          ...current,
+          title: updated.title,
+          titleSource: updated.titleSource
+        } : current
+      );
+      return updated;
+    } catch (error) {
+      toast.error("Failed to rename session", {
+        description: userErrorText(error)
+      });
+      return null;
+    }
+  }
+  async function updateSessionProfile(workspaceId, sessionId, change) {
+    const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+    if (!acceptedTransition) return null;
+    const update = await runCurrentTransitionInvocation({
+      isCurrent: () => ownsWorkspaceInvocation(workspaceId, acceptedTransition),
+      request: async () => await client.updateSession(workspaceId, sessionId, change)
+    });
+    if (update.status === "stale") return null;
+    const updated = update.value;
+    setSession(
+      (current) => current && current.id === updated.id ? {
+        ...current,
+        title: updated.title,
+        titleSource: updated.titleSource,
+        description: updated.description ?? null,
+        avatar: updated.avatar ?? null
+      } : current
+    );
+    return updated;
+  }
+  async function updateSessionPin(workspaceId, sessionId, pinned, expectedVersion) {
+    const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+    if (!acceptedTransition) return null;
+    const ownsInvocation = () => ownsWorkspaceInvocation(workspaceId, acceptedTransition);
+    const before = session;
+    const optimisticVersion = (expectedVersion ?? before?.pinVersion ?? 0) + 1;
+    const optimistic = before && before.id === sessionId ? {
+      ...before,
+      pinned,
+      pinnedAt: pinned ? (/* @__PURE__ */ new Date()).toISOString() : null,
+      pinVersion: optimisticVersion
+    } : null;
+    if (optimistic) {
+      setSession(optimistic);
+    }
+    try {
+      const update = await runCurrentTransitionInvocation({
+        isCurrent: ownsInvocation,
+        request: async () => await client.updateSessionPin(workspaceId, sessionId, {
+          pinned,
+          ...expectedVersion !== void 0 ? { expectedVersion } : {}
+        })
+      });
+      if (update.status === "stale") return null;
+      const updated = update.value;
+      setSession((current) => applySessionPinProjection(current, updated));
+      notifySessionPinChanged(workspaceId, sessionId);
+      return updated;
+    } catch (error) {
+      const reconciliation = await runCurrentTransitionInvocation({
+        isCurrent: ownsInvocation,
+        request: async () => await client.getSession(workspaceId, sessionId, { fresh: true }).catch(() => null)
+      });
+      if (reconciliation.status === "stale") return null;
+      const authoritative = reconciliation.value;
+      if (authoritative) {
+        setSession((current) => reconcileFailedSessionPin(current, optimistic, authoritative));
+        notifySessionPinChanged(workspaceId, sessionId);
+        if (Boolean(authoritative.pinned) === pinned) {
+          return authoritative;
+        }
+      } else if (optimistic) {
+        setSession(
+          (current) => current?.id === sessionId && Boolean(current.pinned) === Boolean(optimistic.pinned) && (current.pinnedAt ?? null) === (optimistic.pinnedAt ?? null) && (current.pinVersion ?? 0) === (optimistic.pinVersion ?? 0) ? before : current
+        );
+      }
+      toast.error(
+        error instanceof OpenGeniApiError && error.status === 409 ? "Session pin changed elsewhere" : `Couldn't ${pinned ? "pin" : "unpin"} session`,
+        {
+          description: userErrorText(error)
+        }
+      );
+      return null;
+    }
+  }
+  async function deleteWorkspace(workspaceId) {
+    const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+    if (!acceptedTransition) return false;
+    const ownsInvocation = () => ownsWorkspaceInvocation(workspaceId, acceptedTransition);
+    try {
+      const deletion = await runCurrentTransitionInvocation({
+        isCurrent: ownsInvocation,
+        request: async () => await deleteWorkspaceWithReconciliation({
+          deleteWorkspace: async () => await client.deleteWorkspace(workspaceId),
+          readWorkspace: async () => await client.getWorkspace(workspaceId)
+        })
+      });
+      if (deletion.status === "stale") return false;
+    } catch (error) {
+      toast.error("Failed to delete workspace", {
+        description: userErrorText(error)
+      });
+      return false;
+    }
+    setWorkspaces((current) => current.filter((workspace) => workspace.id !== workspaceId));
+    try {
+      const accessRefresh = await runCurrentTransitionInvocation({
+        isCurrent: ownsInvocation,
+        request: async () => await client.getAccessContext()
+      });
+      if (accessRefresh.status === "stale") return false;
+      claimHumanInputDraftOwner(accessRefresh.value.subjectId);
+      setAccessContext(accessRefresh.value);
+    } catch {
+      toast.warning("Permissions may be out of date", {
+        description: "Reload if something looks off."
+      });
+    }
+    return true;
+  }
+  const refreshGitHub = useCallback(
+    async (workspaceId, signal, options) => {
+      const acceptedTransition = workspaceTransitionIdentity.current;
+      if (!ownsWorkspaceTransition(acceptedTransition, acceptedTransition, workspaceId)) {
+        return;
+      }
+      const ownsRefresh = () => ownsWorkspaceTransition(
+        workspaceTransitionIdentity.current,
+        acceptedTransition,
+        workspaceId
+      );
+      const refreshId = githubRefreshId.current + 1;
+      githubRefreshId.current = refreshId;
+      githubQuietRetry.current.cancel();
+      if (lacksWorkspacePermission(accessContextRef.current, workspaceId, "github:use")) {
+        githubQuietRetry.current.reset();
+        setGithubStatus(null);
+        setGithubStatusFailed(false);
+        setGithubRepos([]);
+        setGithubCatalogReady(true);
+        setRepoBusy(false);
+        return;
+      }
+      setRepoBusy(true);
+      try {
+        const status = await client.getGitHubApp(workspaceId);
+        if (signal?.aborted || githubRefreshId.current !== refreshId || !ownsRefresh()) {
+          return;
+        }
+        setGithubStatus(status);
+        setGithubStatusFailed(false);
+        if (status.status === "bound") {
+          const { repositories } = options?.sync ? await client.syncGitHubRepositories(workspaceId) : await client.listGitHubRepositories(workspaceId);
+          if (signal?.aborted || githubRefreshId.current !== refreshId || !ownsRefresh()) {
+            return;
+          }
+          setGithubRepos(repositories);
+          setGithubCatalogReady(true);
+        } else {
+          setGithubRepos([]);
+          setGithubCatalogReady(true);
+        }
+        githubQuietRetry.current.reset();
+      } catch (error) {
+        if (isAbortError(error) || signal?.aborted || githubRefreshId.current !== refreshId || !ownsRefresh()) {
+          return;
+        }
+        setGithubStatusFailed(true);
+        if (isTransientServiceFailure(error)) {
+          githubQuietRetry.current.schedule(() => {
+            if (!ownsRefresh() || githubRefreshId.current !== refreshId) return;
+            void refreshGitHubRef.current(workspaceId);
+          }, workspaceId);
+        }
+        if (!options?.userInitiated || isWorkspacePermissionDenied(error)) return;
+        toast.error("GitHub status unavailable", {
+          id: GITHUB_STATUS_TOAST_ID,
+          description: userErrorText(error)
+        });
+      } finally {
+        if (githubRefreshId.current === refreshId && ownsRefresh()) {
+          setRepoBusy(false);
+        }
+      }
+    },
+    [client]
+  );
+  useInsertionEffect(() => {
+    refreshGitHubRef.current = refreshGitHub;
+  }, [refreshGitHub]);
+  const refreshPersonalGitHub = useCallback(
+    async (workspaceId, signal, options) => {
+      const acceptedTransition = workspaceTransitionIdentity.current;
+      if (!ownsWorkspaceTransition(acceptedTransition, acceptedTransition, workspaceId)) return;
+      const refreshId = personalGitHubRefreshId.current + 1;
+      personalGitHubRefreshId.current = refreshId;
+      personalGitHubQuietRetry.current.cancel();
+      const ownsRefresh = () => ownsWorkspaceTransition(
+        workspaceTransitionIdentity.current,
+        acceptedTransition,
+        workspaceId
+      ) && personalGitHubRefreshId.current === refreshId;
+      if (!hasWorkspacePermission(accessContextRef.current, workspaceId, "connections:read")) {
+        setPersonalGitHubStatus(null);
+        setPersonalGitHubRepositories([]);
+        setPersonalGitHubSelection(null);
+        setPersonalGitHubAuthorityCache(null);
+        setSelectedPersonalGitHubRepoIds(/* @__PURE__ */ new Set());
+        setSelectedPersonalGitHubRepoRefs({});
+        setPersonalGitHubCatalogReady(true);
+        setPersonalGitHubBusy(false);
+        personalGitHubQuietRetry.current.reset();
+        clearPersonalGitHubReconnectToast(personalGitHubReconnectToast.current);
+        return;
+      }
+      setPersonalGitHubBusy(true);
+      const clearPersonalCatalog = () => {
+        setPersonalGitHubRepositories([]);
+        setPersonalGitHubSelection(null);
+        setSelectedPersonalGitHubRepoIds(/* @__PURE__ */ new Set());
+        setSelectedPersonalGitHubRepoRefs({});
+        setPersonalGitHubCatalogReady(true);
+        personalGitHubQuietRetry.current.reset();
+      };
+      const showReconnectState = (status) => {
+        const connection = status.connection;
+        if (!status.enabled || !personalGitHubNeedsReconnect(connection)) {
+          clearPersonalGitHubReconnectToast(personalGitHubReconnectToast.current);
+          return false;
+        }
+        announcePersonalGitHubReconnect(
+          personalGitHubReconnectToast.current,
+          connection,
+          () => reconnectPersonalGitHubFromToast(workspaceId, connection.id)
+        );
+        return true;
+      };
+      try {
+        const status = await client.personalGitHubStatus(workspaceId);
+        if (signal?.aborted || !ownsRefresh()) return;
+        const connection = status.connection;
+        setPersonalGitHubStatus(status);
+        setPersonalGitHubAuthorityCache(
+          (current) => connection && reusablePersonalGitHubAuthority(current, {
+            connectionId: connection.id,
+            connectionVersion: connection.version
+          }) ? current : null
+        );
+        showReconnectState(status);
+        if (!status.enabled || connection?.status !== "active") {
+          clearPersonalCatalog();
+          return;
+        }
+        const repositories = [];
+        let cursor;
+        let selection = null;
+        do {
+          const page = await client.listPersonalGitHubRepositories(workspaceId, connection.id, {
+            ...cursor ? { cursor } : {},
+            limit: 100
+          });
+          repositories.push(...page.repositories);
+          selection = page.selection;
+          cursor = page.nextCursor ?? void 0;
+        } while (cursor !== void 0 && repositories.length < 1e3);
+        if (signal?.aborted || !ownsRefresh()) return;
+        setPersonalGitHubRepositories(repositories);
+        setPersonalGitHubSelection(selection);
+        setPersonalGitHubAuthorityCache(
+          (current) => selection && reusablePersonalGitHubAuthority(current, {
+            connectionId: connection.id,
+            connectionVersion: connection.version
+          }) ? current : null
+        );
+        setSelectedPersonalGitHubRepoIds(
+          (current) => new Set(
+            [...current].filter(
+              (id) => repositories.some((repo) => repo.repositoryId === id && repo.selectedAccess)
+            )
+          )
+        );
+        setPersonalGitHubCatalogReady(true);
+        personalGitHubQuietRetry.current.reset();
+      } catch (error) {
+        if (signal?.aborted || !ownsRefresh() || isAbortError(error)) return;
+        setPersonalGitHubCatalogReady(true);
+        if (isTransientServiceFailure(error)) {
+          personalGitHubQuietRetry.current.schedule(() => {
+            if (!ownsRefresh()) return;
+            void refreshPersonalGitHubRef.current(workspaceId);
+          }, workspaceId);
+          if (!options?.userInitiated) return;
+        } else {
+          const current = await client.personalGitHubStatus(workspaceId).catch(() => null);
+          if (signal?.aborted || !ownsRefresh()) return;
+          if (current) {
+            setPersonalGitHubStatus(current);
+            if (showReconnectState(current)) {
+              clearPersonalCatalog();
+              return;
+            }
+          }
+          if (!options?.userInitiated) return;
+        }
+        toast.error("Your GitHub account is unavailable", {
+          id: PERSONAL_GITHUB_STATUS_TOAST_ID,
+          description: userErrorText(error)
+        });
+      } finally {
+        if (ownsRefresh()) setPersonalGitHubBusy(false);
+      }
+    },
+    [client, reconnectPersonalGitHubFromToast]
+  );
+  useInsertionEffect(() => {
+    refreshPersonalGitHubRef.current = refreshPersonalGitHub;
+  }, [refreshPersonalGitHub]);
+  async function beginPersonalGitHubOAuth(workspaceId, reconnect, connectionId) {
+    const reconnectAccountId = connectionId ?? personalGitHubStatus?.connection?.id;
+    try {
+      const attempt = await client.beginConnect(workspaceId, {
+        providerId: "github-personal",
+        ownership: "personal",
+        returnUrl: hostPage.href(),
+        idempotencyKey: crypto.randomUUID(),
+        ...reconnect && reconnectAccountId ? { reconnectAccountId } : {}
+      });
+      if (attempt.nextAction.type !== "authorize")
+        throw new Error("GitHub did not return an authorization link");
+      await markIntegrationConnectRedirect("github", "oauth", { returnsWithOutcome: false });
+      hostPage.assign(attempt.nextAction.url);
+    } catch (error) {
+      toast.error("Couldn't open GitHub sign-in", {
+        description: userErrorText(error)
+      });
+    }
+  }
+  async function disconnectPersonalGitHub(workspaceId) {
+    const connection = personalGitHubStatus?.connection;
+    if (!connection) return true;
+    setPersonalGitHubBusy(true);
+    try {
+      const disconnect = (target) => client.disconnectPersonalGitHub(workspaceId, target.id, {
+        expectedVersion: target.version,
+        idempotencyKey: crypto.randomUUID()
+      });
+      try {
+        await disconnect(connection);
+      } catch (error) {
+        if (!(error instanceof OpenGeniApiError && error.status === 409)) throw error;
+        const current = (await client.personalGitHubStatus(workspaceId)).connection;
+        if (current && current.status !== "revoked") await disconnect(current);
+      }
+      await refreshPersonalGitHub(workspaceId, void 0, { userInitiated: true });
+      toast.success("Your GitHub account was disconnected");
+      return true;
+    } catch (error) {
+      toast.error("Couldn't disconnect your GitHub account", {
+        description: userErrorText(error)
+      });
+      return false;
+    } finally {
+      setPersonalGitHubBusy(false);
+    }
+  }
+  async function savePersonalGitHubRepositories(workspaceId, repositories) {
+    const connection = personalGitHubStatus?.connection;
+    const selection = personalGitHubSelection;
+    if (!connection || !selection) return false;
+    setPersonalGitHubBusy(true);
+    try {
+      await client.replacePersonalGitHubRepositorySelections(workspaceId, connection.id, {
+        expectedConnectionAuthorityGeneration: selection.connectionAuthorityGeneration,
+        expectedSelectionGeneration: selection.selectionGeneration,
+        idempotencyKey: crypto.randomUUID(),
+        repositories
+      });
+      await refreshPersonalGitHub(workspaceId, void 0, { userInitiated: true });
+      toast.success("GitHub repository access updated");
+      return true;
+    } catch (error) {
+      toast.error("Couldn't update GitHub repository access", {
+        description: userErrorText(error)
+      });
+      return false;
+    } finally {
+      setPersonalGitHubBusy(false);
+    }
+  }
+  async function ensurePersonalGitHubAuthority(_workspaceId) {
+    const connection = personalGitHubStatus?.connection;
+    if (!connection?.authorityId || connection.status !== "active") {
+      toast.error("Connect your GitHub account before selecting its repositories");
+      return null;
+    }
+    const authority = { serverId: "github:personal", connectionId: connection.id };
+    setPersonalGitHubAuthorityCache({ authority, connectionVersion: connection.version });
+    return authority;
+  }
+  async function togglePersonalGitHubRepository(workspaceId, repository) {
+    if (selectedPersonalGitHubRepoIds.has(repository.repositoryId)) {
+      setSelectedPersonalGitHubRepoIds((current) => {
+        const next = new Set(current);
+        next.delete(repository.repositoryId);
+        return next;
+      });
+      return;
+    }
+    if (!repository.selectedAccess) return;
+    if (!await ensurePersonalGitHubAuthority(workspaceId)) return;
+    setSelectedRepoIds(
+      (current) => new Set(
+        [...current].filter(
+          (id) => githubRepos.find((candidate) => candidate.id === id)?.fullName.toLowerCase() !== repository.fullName.toLowerCase()
+        )
+      )
+    );
+    setSelectedPersonalGitHubRepoIds((current) => new Set(current).add(repository.repositoryId));
+    setSelectedPersonalGitHubRepoRefs((current) => ({
+      ...current,
+      [repository.repositoryId]: current[repository.repositoryId] ?? repository.defaultBranch
+    }));
+  }
+  const refreshWorkspaceMcpServers = useCallback(
+    async (workspaceId, signal) => {
+      const refreshId = mcpRefreshId.current + 1;
+      mcpRefreshId.current = refreshId;
+      setWorkspaceMcpCatalogLoadedSuccessfully(false);
+      const requestKey = `${accessKeyVersion}:${workspaceId}`;
+      try {
+        const result = await runCurrentWorkspaceRequest({
+          signal,
+          requestId: refreshId,
+          currentRequestId: () => mcpRefreshId.current,
+          request: async () => await Promise.all([
+            runSingleFlight(
+              mcpCatalogRequests.current,
+              requestKey,
+              async () => await client.listCapabilities(workspaceId)
+            ),
+            client.listApiIntegrations(workspaceId)
+          ])
+        });
+        if (!result) {
+          return;
+        }
+        const [catalog, apiIntegrations] = result;
+        setWorkspaceMcpServers(
+          mergeMcpServerOptions(
+            enabledWorkspaceCapabilityMcpServers(catalog.items),
+            installedApiIntegrationMcpServers(apiIntegrations.integrations)
+          )
+        );
+        setWorkspaceCapabilityCatalog(catalog.items);
+        setWorkspaceMemberIntegrationSetup(catalog.memberIntegrationSetup);
+        setWorkspaceMcpCatalogLoadedSuccessfully(true);
+        setWorkspaceMcpCatalogReady(true);
+      } catch (error) {
+        if (signal?.aborted || mcpRefreshId.current !== refreshId) throw error;
+        setWorkspaceMcpCatalogLoadedSuccessfully(false);
+        setWorkspaceMcpCatalogReady(true);
+        throw error;
+      }
+    },
+    [accessKeyVersion, client]
+  );
+  async function startSession(workspaceId, submission, options) {
+    const startedOperation = beginWorkspaceOperation(
+      workspaceOperationSequence.current,
+      workspaceTransitionIdentity.current
+    );
+    workspaceOperationSequence.current = startedOperation.sequence;
+    const operation = startedOperation.operation;
+    activeCreateOperation.current = operation;
+    let attempted = null;
+    setBusy(true);
+    try {
+      if (repositoryValidationError) {
+        toast.error("Fix repository details", { description: repositoryValidationError });
+        return null;
+      }
+      const sessionTools = options?.sessionTools;
+      if (!workspaceMcpCatalogReady && !sessionTools) {
+        toast.error("Tools are still loading", {
+          description: "Wait for the workspace tool catalog to finish loading, then try again."
+        });
+        return null;
+      }
+      const selectedTools = sessionTools ? [...sessionTools] : buildOpenGeniUiTools(submission.tools, selectedCapabilityToolIds);
+      const includesPersonalGitHub = currentResources.some(
+        (resource) => resource.kind === "repository" && resource.connectionType === "github_personal"
+      );
+      if (includesPersonalGitHub && !personalGitHubAuthority) {
+        toast.error("Your GitHub identity is still being prepared", {
+          description: "Select the repository again, then send when it is ready."
+        });
+        return null;
+      }
+      const effectiveSubmission = includesPersonalGitHub ? {
+        ...submission,
+        connectionAccounts: [
+          ...(submission.connectionAccounts ?? []).filter(
+            (authority) => authority.serverId !== "github:personal"
+          ),
+          personalGitHubAuthority
+        ]
+      } : submission;
+      const freshIdempotencyKey = crypto.randomUUID();
+      const attempt = prepareCreateSessionAttempt({
+        pending: pendingCreateAttempt.current,
+        client,
+        workspaceId,
+        freshIdempotencyKey,
+        request: buildCreateSessionRequest({
+          currentResources,
+          submission: effectiveSubmission,
+          instructions: options?.instructions,
+          installedSkillIds: options?.installedSkillIds,
+          bot: options?.bot,
+          omitWorkspaceResources: options?.omitWorkspaceResources,
+          selectedTools,
+          newSessionDraftToolPolicy: options?.newSessionDraftToolPolicy,
+          defaultModel: model,
+          defaultReasoningEffort: reasoningEffort,
+          defaultLatencyMode: latencyMode,
+          clientEventId: crypto.randomUUID(),
+          idempotencyKey: freshIdempotencyKey,
+          workspaceDefaultMcpServerIds: workspaceDefaultToolIds,
+          workspaceMcpCatalogReady,
+          targetSandboxId: options?.targetSandboxId,
+          workingDir: options?.workingDir,
+          channelId: options?.channelId,
+          expectedNewSessionDraftRevision: options?.expectedNewSessionDraftRevision,
+          agentLearning: options?.agentLearning,
+          startMode: options?.startMode,
+          visibility: options?.visibility,
+          usageLimitMicros: options?.usageLimitMicros
+        })
+      });
+      attempted = attempt;
+      pendingCreateAttempt.current = attempt.pending;
+      const hostContext = attempt.request.startMode === "realtime" ? void 0 : hostMessageContext.current?.();
+      const created = await createWithOpeningContext(
+        (request) => client.createSession(workspaceId, request),
+        attempt.request,
+        hostContext,
+        hostContext ? hostMessageContextTools.current?.() : void 0
+      );
+      if (pendingCreateAttempt.current?.idempotencyKey === attempt.pending.idempotencyKey) {
+        pendingCreateAttempt.current = null;
+      }
+      if (!ownsWorkspaceOperation(
+        activeCreateOperation.current,
+        workspaceTransitionIdentity.current,
+        operation,
+        workspaceId
+      )) {
+        return null;
+      }
+      setSession(created);
+      if (attempt.request.clientEventId && attempt.request.startMode !== "realtime") {
+        setSessionCreationHandoff({
+          session: created,
+          clientEventId: attempt.request.clientEventId
+        });
+      } else {
+        setSessionCreationHandoff(null);
+      }
+      setConnectionState("idle");
+      captureProductEvent("session_started", {
+        $insert_id: `session_started:${created.id}`,
+        account_id: created.accountId,
+        workspace_id: created.workspaceId,
+        session_id: created.id,
+        ...attempt.request.model ? { model: attempt.request.model } : {},
+        start_mode: options?.startMode ?? "standard"
+      });
+      return created;
+    } catch (error) {
+      const { error: problem, outcomeUnknown } = classifyCreateSessionFailure(error);
+      if (attempted) {
+        pendingCreateAttempt.current = retainCreateSessionAttemptAfterFailure({
+          current: pendingCreateAttempt.current,
+          attempted: attempted.pending,
+          outcomeUnknown
+        });
+      }
+      if (ownsWorkspaceOperation(
+        activeCreateOperation.current,
+        workspaceTransitionIdentity.current,
+        operation,
+        workspaceId
+      )) {
+        const handled = attempted ? options?.onFailure?.({
+          error: problem,
+          request: attempted.request,
+          outcomeUnknown
+        }) : false;
+        if (isPaymentRequiredError(problem) && handled !== true) {
+          const workspace = workspaces.find((candidate) => candidate.id === workspaceId);
+          setCreditRequired({
+            workspaceId,
+            accountId: workspace?.accountId ?? null,
+            code: paymentRefusalCode(problem)
+          });
+        } else if (handled !== true) {
+          toast.error("Failed to start session", {
+            description: composerSubmissionErrorMessage(t, problem)
+          });
+        }
+      }
+      return null;
+    } finally {
+      const settlement = settleWorkspaceOperation(activeCreateOperation.current, operation);
+      activeCreateOperation.current = settlement.active;
+      if (settlement.settledCurrent) {
+        setBusy(false);
+      }
+    }
+  }
+  async function startGitHubAppManifestFlow(workspaceId) {
+    const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+    if (!acceptedTransition) return;
+    const started = beginWorkspaceOperation(
+      githubManifestOperationSequence.current,
+      acceptedTransition
+    );
+    githubManifestOperationSequence.current = started.sequence;
+    const operation = started.operation;
+    activeGitHubManifestOperation.current = operation;
+    setGithubAppBusy(true);
+    try {
+      const result = await runCurrentWorkspaceOperation({
+        activeOperation: () => activeGitHubManifestOperation.current,
+        currentTransition: () => workspaceTransitionIdentity.current,
+        operation,
+        workspaceId,
+        request: async () => await client.createGitHubAppManifest(workspaceId, {
+          ...githubOrg.trim() ? { organization: githubOrg.trim() } : {},
+          public: false,
+          includeCiPermissions: true
+        })
+      });
+      if (result.status === "stale" || !ownsWorkspaceOperation(
+        activeGitHubManifestOperation.current,
+        workspaceTransitionIdentity.current,
+        operation,
+        workspaceId
+      )) {
+        return;
+      }
+      submitGitHubManifest(result.value.actionUrl, result.value.manifest, embedded);
+    } catch (error) {
+      if (ownsWorkspaceOperation(
+        activeGitHubManifestOperation.current,
+        workspaceTransitionIdentity.current,
+        operation,
+        workspaceId
+      )) {
+        toast.error("GitHub App setup failed", {
+          description: userErrorText(error)
+        });
+      }
+    } finally {
+      const settlement = settleWorkspaceOperation(activeGitHubManifestOperation.current, operation);
+      activeGitHubManifestOperation.current = settlement.active;
+      if (settlement.settledCurrent) {
+        setGithubAppBusy(false);
+      }
+    }
+  }
+  async function disconnectGitHubInstallation(workspaceId, installationId) {
+    const acceptedTransition = captureWorkspaceInvocation(workspaceId);
+    if (!acceptedTransition) return false;
+    const started = beginWorkspaceOperation(
+      githubDisconnectOperationSequence.current,
+      acceptedTransition
+    );
+    githubDisconnectOperationSequence.current = started.sequence;
+    const operation = started.operation;
+    activeGitHubDisconnectOperation.current = operation;
+    const previousStatus = githubStatus;
+    const previousRepositories = githubRepos;
+    const previousSelectedIds = selectedRepoIds;
+    const previousSelectedRefs = selectedRepoRefs;
+    const removedRepositoryIds = new Set(
+      githubRepos.filter((repository) => repository.installationId === installationId).map((repository) => repository.id)
+    );
+    setGithubRepos(
+      (current) => current.filter((repository) => repository.installationId !== installationId)
+    );
+    setGithubStatus(
+      (current) => current ? {
+        ...current,
+        installations: current.installations.filter(
+          (installation) => installation.installationId !== installationId
+        )
+      } : current
+    );
+    setSelectedRepoIds(
+      (current) => new Set([...current].filter((repositoryId) => !removedRepositoryIds.has(repositoryId)))
+    );
+    setSelectedRepoRefs(
+      (current) => Object.fromEntries(
+        Object.entries(current).filter(
+          ([repositoryId]) => !removedRepositoryIds.has(Number(repositoryId))
+        )
+      )
+    );
+    try {
+      const unlink = await runCurrentWorkspaceOperation({
+        activeOperation: () => activeGitHubDisconnectOperation.current,
+        currentTransition: () => workspaceTransitionIdentity.current,
+        operation,
+        workspaceId,
+        request: async () => await unlinkGitHubInstallationWithReconciliation({
+          installationId,
+          unlink: async () => await client.unlinkGitHubInstallation(workspaceId, installationId),
+          readStatus: async () => await client.getGitHubApp(workspaceId)
+        })
+      });
+      if (unlink.status === "stale" || !ownsWorkspaceOperation(
+        activeGitHubDisconnectOperation.current,
+        workspaceTransitionIdentity.current,
+        operation,
+        workspaceId
+      )) {
+        return false;
+      }
+      await refreshGitHub(workspaceId, void 0, { sync: true, userInitiated: true });
+      if (!ownsWorkspaceOperation(
+        activeGitHubDisconnectOperation.current,
+        workspaceTransitionIdentity.current,
+        operation,
+        workspaceId
+      )) {
+        return false;
+      }
+      toast.success("GitHub installation unlinked from this workspace");
+      return true;
+    } catch (error) {
+      if (ownsWorkspaceOperation(
+        activeGitHubDisconnectOperation.current,
+        workspaceTransitionIdentity.current,
+        operation,
+        workspaceId
+      )) {
+        setGithubStatus(previousStatus);
+        setGithubRepos(previousRepositories);
+        setSelectedRepoIds(previousSelectedIds);
+        setSelectedRepoRefs(previousSelectedRefs);
+        toast.error("Failed to unlink GitHub installation", {
+          description: userErrorText(error)
+        });
+      }
+      return false;
+    } finally {
+      const settlement = settleWorkspaceOperation(
+        activeGitHubDisconnectOperation.current,
+        operation
+      );
+      activeGitHubDisconnectOperation.current = settlement.active;
+    }
+  }
+  function toggleGitHubRepository(repo) {
+    setSelectedRepoIds((current) => {
+      const next = new Set(current);
+      if (next.has(repo.id)) {
+        next.delete(repo.id);
+      } else {
+        next.add(repo.id);
+      }
+      return next;
+    });
+    if (!selectedRepoIds.has(repo.id)) {
+      const personal = personalGitHubRepositories.find(
+        (candidate) => candidate.fullName.toLowerCase() === repo.fullName.toLowerCase()
+      );
+      if (personal) {
+        setSelectedPersonalGitHubRepoIds((current) => {
+          const next = new Set(current);
+          next.delete(personal.repositoryId);
+          return next;
+        });
+      }
+    }
+    setSelectedRepoRefs((current) => ({
+      ...current,
+      [repo.id]: current[repo.id] ?? repo.defaultBranch
+    }));
+  }
+  function addManualRepository() {
+    setManualRepos((current) => [
+      ...current,
+      { id: nextRepoId, url: "", ref: "main", attached: false }
+    ]);
+    setNextRepoId((value) => value + 1);
+    setManualReposOpen(true);
+  }
+  function saveAccessKey() {
+    const key = accessKeyDraft.trim();
+    if (!key) {
+      toast.error("Enter an access key");
+      return;
+    }
+    invalidatePrincipalWorkspaceState();
+    setStoredAccessKey(key);
+    setHasAccessKey(true);
+    setAccessKeyDraft("");
+    setAccessError(null);
+    setAccessKeyVersion((version) => version + 1);
+  }
+  function forgetAccessKey() {
+    invalidatePrincipalWorkspaceState();
+    clearStoredAccessKey();
+    setHasAccessKey(false);
+    setSession(null);
+    setAccessContext(null);
+    setWorkspaces([]);
+    setAccessError(null);
+    setAccessKeyVersion((version) => version + 1);
+  }
+  async function handleManagedAuth(mode, input) {
+    invalidatePrincipalWorkspaceState({
+      preservePendingSlackLink: preserveSlackLinkForManagedAuth(mode, slackLink.phase())
+    });
+    const acceptedPrincipal = principalTransitionIdentity.current;
+    const ownsInvocation = () => ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal);
+    if (mode === "signup") {
+      const signup = await runCurrentTransitionInvocation({
+        isCurrent: ownsInvocation,
+        request: async () => await signUpEmail(input)
+      });
+      if (signup.status === "stale") return;
+      captureProductEvent("signup_submitted", {
+        method: "email",
+        verification_required: managedEmailVerificationRequired
+      });
+    } else {
+      const signin = await runCurrentTransitionInvocation({
+        isCurrent: ownsInvocation,
+        request: async () => await signInEmail({
+          email: input.email,
+          password: input.password,
+          rememberMe: true
+        })
+      });
+      if (signin.status === "stale") return;
+    }
+    const sessionRead = await runCurrentTransitionInvocation({
+      isCurrent: ownsInvocation,
+      request: fetchAuthSession
+    });
+    if (sessionRead.status === "stale") return;
+    const nextSession = sessionRead.value;
+    if (!nextSession && !(mode === "signup" && managedEmailVerificationRequired)) {
+      throw new ManagedAuthSessionUnavailableError(mode);
+    }
+    authPrincipalIdRef.current = nextSession?.user.id ?? null;
+    if (mode === "signin" && nextSession) noteSuccessfulLogin(nextSession.user.id, "email");
+    setAuthSession(nextSession);
+    setAccessKeyVersion((version) => version + 1);
+  }
+  async function handleManagedSessionSetSignup(input) {
+    invalidatePrincipalWorkspaceState();
+    const acceptedPrincipal = principalTransitionIdentity.current;
+    const signup = await runCurrentTransitionInvocation({
+      isCurrent: () => ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal),
+      request: async () => await signUpEmail(input)
+    });
+    if (signup.status === "stale") return;
+    captureProductEvent("signup_submitted", {
+      method: "email",
+      verification_required: managedEmailVerificationRequired
+    });
+  }
+  async function handleManagedSocialAuth(provider, signupChallengeToken) {
+    invalidatePrincipalWorkspaceState({
+      preservePendingSlackLink: preserveSlackLinkForManagedAuth("signin", slackLink.phase())
+    });
+    beginSocialLoginAnalytics(provider);
+    await startManagedSocialSignIn(provider, signupChallengeToken);
+  }
+  async function handleManagedPasskeyAuth(mode, input) {
+    if (!signInPasskey || mode === "signup" && (!signUpPasskey || !input)) {
+      throw new Error("Passkeys aren't available here");
+    }
+    invalidatePrincipalWorkspaceState({
+      preservePendingSlackLink: preserveSlackLinkForManagedAuth(mode, slackLink.phase())
+    });
+    const acceptedPrincipal = principalTransitionIdentity.current;
+    const ownsInvocation = () => ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal);
+    const ceremony = await runCurrentTransitionInvocation({
+      isCurrent: ownsInvocation,
+      request: async () => mode === "signup" ? await signUpPasskey(input) : await signInPasskey()
+    });
+    if (ceremony.status === "stale") return;
+    if (mode === "signup") {
+      captureProductEvent("signup_submitted", { method: "passkey", verification_required: false });
+    }
+    const sessionRead = await runCurrentTransitionInvocation({
+      isCurrent: ownsInvocation,
+      request: fetchAuthSession
+    });
+    if (sessionRead.status === "stale") return;
+    const nextSession = sessionRead.value;
+    if (!nextSession) throw new ManagedAuthSessionUnavailableError(mode);
+    authPrincipalIdRef.current = nextSession.user.id;
+    if (mode === "signin") noteSuccessfulLogin(nextSession.user.id, "passkey");
+    else captureProductEvent("signup_completed", { method: "passkey", is_new_user: true });
+    setAuthSession(nextSession);
+    setAccessKeyVersion((version) => version + 1);
+  }
+  async function handleManagedSignOut() {
+    flushSync(() => {
+      invalidatePrincipalWorkspaceState();
+      setAuthSession(void 0);
+      setAccessContext(null);
+      setWorkspaces([]);
+      setAccessError(null);
+    });
+    forgetAllHumanInputDrafts();
+    const acceptedPrincipal = principalTransitionIdentity.current;
+    const ownsInvocation = () => ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal);
+    const reconciliation = await runCurrentTransitionInvocation({
+      isCurrent: ownsInvocation,
+      request: async () => await signOutWithAuthoritativeReconciliation({
+        signOut: signOutManaged,
+        readSession: fetchAuthSession
+      })
+    });
+    if (reconciliation.status === "stale") return;
+    const result = reconciliation.value;
+    authPrincipalIdRef.current = result.session?.user.id ?? null;
+    setAuthSession(result.session);
+    setAccessKeyVersion((version) => version + 1);
+    if (result.status === "reconciled_failure") {
+      throw result.error;
+    }
+    setSession(null);
+    await navigate({ to: "/", replace: true });
+  }
+  async function handleBrowserActorTransition(transition) {
+    flushSync(() => {
+      invalidatePrincipalWorkspaceState();
+      setAuthSession(void 0);
+      setAccessContext(null);
+      setWorkspaces([]);
+      setAccessError(null);
+    });
+    configureManagedActorEpoch(transition.to?.actorEpoch ?? null);
+    flushSync(() => {
+      setAccessKeyVersion((version) => version + 1);
+    });
+    if (transition.to === null) return;
+    if (transition.to.selectedSlotId === null || transition.to.state !== "ready") {
+      authPrincipalIdRef.current = null;
+      setAuthSession(null);
+      setSession(null);
+      await navigate({ to: "/", replace: true });
+      return;
+    }
+    const acceptedPrincipal = principalTransitionIdentity.current;
+    const ownsInvocation = () => !transition.signal.aborted && ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal);
+    try {
+      const sessionRead = await runCurrentTransitionInvocation({
+        isCurrent: ownsInvocation,
+        request: fetchAuthSession
+      });
+      if (sessionRead.status === "stale") return;
+      const nextSession = sessionRead.value;
+      authPrincipalIdRef.current = nextSession?.user.id ?? null;
+      setAuthSession(nextSession);
+    } catch (error) {
+      if (ownsInvocation()) setAuthSession(null);
+      throw error;
+    }
+  }
+  const contextAddManualRepository = useLatestCallback(addManualRepository);
+  const contextForgetAccessKey = useLatestCallback(forgetAccessKey);
+  const contextHandleManagedSignOut = useLatestCallback(handleManagedSignOut);
+  const contextHandleBrowserActorTransition = useLatestCallback(handleBrowserActorTransition);
+  const revalidatePrincipalAccess = useCallback(
+    () => setAccessKeyVersion((version) => version + 1),
+    []
+  );
+  const completeOrganizationOnboarding = useCallback(
+    async (destination) => {
+      const arrived = destination?.sessionId ? navigate({
+        to: "/workspaces/$workspaceId/sessions/$sessionId",
+        params: { workspaceId: destination.workspaceId, sessionId: destination.sessionId }
+      }) : destination ? navigate({
+        to: "/workspaces/$workspaceId/sessions",
+        params: { workspaceId: destination.workspaceId }
+      }) : null;
+      revalidatePrincipalAccess();
+      await arrived;
+    },
+    [navigate, revalidatePrincipalAccess]
+  );
+  async function refreshPrincipalAccess() {
+    if (!clientConfig || !authReady) return false;
+    let acceptedPrincipal = principalTransitionIdentity.current;
+    const acceptedManagedIdentity = clientConfig.auth.mode === "managedSession" && authSession ? managedSelfContextIdentity({
+      credentialGeneration: accessKeyVersion,
+      managedUserId: authSession.user.id
+    }) : null;
+    managedSelfContextIdentityRef.current = acceptedManagedIdentity;
+    const selfContextPromise = acceptedManagedIdentity ? loadCurrentManagedSelfContext({
+      identity: acceptedManagedIdentity,
+      currentIdentity: () => managedSelfContextIdentityRef.current,
+      request: () => client.listOrganizationMemberships()
+    }) : Promise.resolve(null);
+    const [nextAccessContext, nextWorkspaces, nextManagedSelfContext] = await Promise.all([
+      client.getAccessContext(),
+      client.listWorkspaces(),
+      selfContextPromise
+    ]);
+    if (!ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal)) {
+      return false;
+    }
+    if (acceptedManagedIdentity && nextManagedSelfContext === null) return false;
+    if (nextManagedSelfContext && nextAccessContext.subjectId !== nextManagedSelfContext.identity.subjectId) {
+      throw new Error("managed self context did not match the authenticated subject");
+    }
+    if (accessPrincipalIdRef.current !== null && accessPrincipalIdRef.current !== nextAccessContext.subjectId) {
+      invalidatePrincipalWorkspaceState();
+      acceptedPrincipal = principalTransitionIdentity.current;
+      managedSelfContextIdentityRef.current = acceptedManagedIdentity;
+    }
+    if (!ownsPrincipalTransition(principalTransitionIdentity.current, acceptedPrincipal)) {
+      return false;
+    }
+    accessPrincipalIdRef.current = nextAccessContext.subjectId;
+    claimHumanInputDraftOwner(nextAccessContext.subjectId);
+    setAccessContext(nextAccessContext);
+    setWorkspaces(nextWorkspaces);
+    setManagedSelfContext(nextManagedSelfContext);
+    return true;
+  }
+  const contextRefreshPrincipalAccess = useLatestCallback(refreshPrincipalAccess);
+  const contextCreateWorkspace = useLatestCallback(createWorkspace);
+  const contextRenameWorkspace = useLatestCallback(renameWorkspace);
+  const contextSetWorkspaceInferenceControl = useLatestCallback(setWorkspaceInferenceControl);
+  const contextUpdateWorkspaceSettings = useLatestCallback(updateWorkspaceSettings);
+  const contextSetWorkspaceDefaultRig = useLatestCallback(setWorkspaceDefaultRig);
+  const contextUpdateSessionTitle = useLatestCallback(updateSessionTitle);
+  const contextUpdateSessionProfile = useLatestCallback(updateSessionProfile);
+  const contextUpdateSessionPin = useLatestCallback(updateSessionPin);
+  const contextDeleteWorkspace = useLatestCallback(deleteWorkspace);
+  const contextStartGitHubAppManifestFlow = useLatestCallback(startGitHubAppManifestFlow);
+  const contextDisconnectGitHubInstallation = useLatestCallback(disconnectGitHubInstallation);
+  const contextToggleGitHubRepository = useLatestCallback(toggleGitHubRepository);
+  const contextConnectPersonalGitHub = useLatestCallback(
+    (workspaceId) => beginPersonalGitHubOAuth(workspaceId, false)
+  );
+  const contextReconnectPersonalGitHub = useLatestCallback(
+    (workspaceId) => beginPersonalGitHubOAuth(workspaceId, true)
+  );
+  const contextDisconnectPersonalGitHub = useLatestCallback(disconnectPersonalGitHub);
+  const contextSavePersonalGitHubRepositories = useLatestCallback(savePersonalGitHubRepositories);
+  const contextEnsurePersonalGitHubAuthority = useLatestCallback(ensurePersonalGitHubAuthority);
+  const contextTogglePersonalGitHubRepository = useLatestCallback(togglePersonalGitHubRepository);
+  const contextStartSession = useLatestCallback(startSession);
+  const preparePendingSlackLink = useCallback(
+    async (workspaceId) => await slackLink.prepare(
+      workspaceId,
+      async (token) => await client.prepareSlackUserLinkAccess(workspaceId, {
+        linkToken: token
+      })
+    ),
+    [client, slackLink]
+  );
+  const clearSlackLinkContinuation = useCallback(() => {
+    slackLink.clear();
+    setSlackLinkContinuationWorkspaceId(null);
+  }, [slackLink]);
+  const appContext = useMemo(() => {
+    return clientConfig && accessContext ? {
+      client,
+      clientConfig: withWorkspaceClientConfig(clientConfig, workspaceConfig),
+      refreshWorkspaceConfig,
+      authSession: authSession ?? null,
+      accessContext,
+      workspaces,
+      managedSelfContext,
+      slackLinkContinuationWorkspaceId,
+      invalidSlackLinkQueryWorkspaceId,
+      preparePendingSlackLink,
+      clearSlackLinkContinuation,
+      accessKeyVersion,
+      keyAuthRequired: keyAuthRequired === true,
+      model,
+      setModel,
+      reasoningEffort,
+      setReasoningEffort,
+      latencyMode,
+      setLatencyMode,
+      inspectorOpen,
+      setInspectorOpen,
+      session,
+      setSession,
+      sessionChannelProjectionAuthority,
+      sessionCreationHandoff,
+      connectionState,
+      setConnectionState,
+      sessionEventFeedStore,
+      manualRepos,
+      setManualRepos,
+      manualReposOpen,
+      setManualReposOpen,
+      selectedRepoIds,
+      setSelectedRepoIds,
+      selectedRepoRefs,
+      setSelectedRepoRefs,
+      githubRepos,
+      githubStatus,
+      githubStatusFailed,
+      githubCatalogReady,
+      personalGitHubStatus,
+      personalGitHubRepositories,
+      personalGitHubSelection,
+      personalGitHubCatalogReady,
+      personalGitHubBusy,
+      selectedPersonalGitHubRepoIds,
+      setSelectedPersonalGitHubRepoIds,
+      selectedPersonalGitHubRepoRefs,
+      setSelectedPersonalGitHubRepoRefs,
+      personalGitHubAuthority,
+      githubOrg,
+      setGithubOrg,
+      selectedCapabilityToolIds,
+      setSelectedCapabilityToolIds,
+      busy,
+      repoBusy,
+      githubAppBusy,
+      repositoryGroups,
+      toolMcpServers,
+      workspaceDefaultToolIds,
+      workspaceMcpCatalogReady,
+      workspaceMcpCatalogLoadedSuccessfully,
+      workspaceCapabilityCatalog,
+      workspaceMemberIntegrationSetup,
+      currentResources,
+      repositoryValidationError,
+      workspaceStateOwnerId,
+      prepareWorkspaceTransition,
+      captureWorkspaceInvocation,
+      ownsWorkspaceInvocation,
+      addManualRepository: contextAddManualRepository,
+      forgetAccessKey: contextForgetAccessKey,
+      handleManagedSignOut: contextHandleManagedSignOut,
+      revalidatePrincipalAccess,
+      refreshPrincipalAccess: contextRefreshPrincipalAccess,
+      createWorkspace: contextCreateWorkspace,
+      renameWorkspace: contextRenameWorkspace,
+      setWorkspaceInferenceControl: contextSetWorkspaceInferenceControl,
+      refreshWorkspace,
+      updateWorkspaceSettings: contextUpdateWorkspaceSettings,
+      setWorkspaceDefaultRig: contextSetWorkspaceDefaultRig,
+      updateSessionTitle: contextUpdateSessionTitle,
+      updateSessionProfile: contextUpdateSessionProfile,
+      updateSessionPin: contextUpdateSessionPin,
+      deleteWorkspace: contextDeleteWorkspace,
+      refreshGitHub,
+      refreshPersonalGitHub,
+      connectPersonalGitHub: contextConnectPersonalGitHub,
+      reconnectPersonalGitHub: contextReconnectPersonalGitHub,
+      disconnectPersonalGitHub: contextDisconnectPersonalGitHub,
+      savePersonalGitHubRepositories: contextSavePersonalGitHubRepositories,
+      ensurePersonalGitHubAuthority: contextEnsurePersonalGitHubAuthority,
+      togglePersonalGitHubRepository: contextTogglePersonalGitHubRepository,
+      refreshWorkspaceMcpServers,
+      startGitHubAppManifestFlow: contextStartGitHubAppManifestFlow,
+      disconnectGitHubInstallation: contextDisconnectGitHubInstallation,
+      toggleGitHubRepository: contextToggleGitHubRepository,
+      startSession: contextStartSession,
+      resetSessionView,
+      resetWorkspaceIntegrations
+    } : null;
+  }, [
+    accessContext,
+    accessKeyVersion,
+    authSession,
+    busy,
+    captureWorkspaceInvocation,
+    clearSlackLinkContinuation,
+    client,
+    clientConfig,
+    workspaceConfig,
+    refreshWorkspaceConfig,
+    connectionState,
+    contextAddManualRepository,
+    contextCreateWorkspace,
+    contextDeleteWorkspace,
+    contextConnectPersonalGitHub,
+    contextDisconnectPersonalGitHub,
+    contextEnsurePersonalGitHubAuthority,
+    contextForgetAccessKey,
+    contextHandleManagedSignOut,
+    contextRenameWorkspace,
+    contextReconnectPersonalGitHub,
+    contextSavePersonalGitHubRepositories,
+    contextSetWorkspaceInferenceControl,
+    contextUpdateSessionProfile,
+    contextSetWorkspaceDefaultRig,
+    contextDisconnectGitHubInstallation,
+    contextStartGitHubAppManifestFlow,
+    contextStartSession,
+    contextToggleGitHubRepository,
+    contextTogglePersonalGitHubRepository,
+    contextUpdateSessionPin,
+    contextUpdateSessionTitle,
+    contextUpdateWorkspaceSettings,
+    currentResources,
+    repositoryValidationError,
+    githubAppBusy,
+    githubOrg,
+    githubRepos,
+    githubStatus,
+    githubStatusFailed,
+    personalGitHubStatus,
+    personalGitHubRepositories,
+    personalGitHubSelection,
+    personalGitHubCatalogReady,
+    personalGitHubBusy,
+    selectedPersonalGitHubRepoIds,
+    selectedPersonalGitHubRepoRefs,
+    personalGitHubAuthority,
+    githubCatalogReady,
+    inspectorOpen,
+    invalidSlackLinkQueryWorkspaceId,
+    keyAuthRequired,
+    manualRepos,
+    manualReposOpen,
+    managedSelfContext,
+    model,
+    ownsWorkspaceInvocation,
+    preparePendingSlackLink,
+    prepareWorkspaceTransition,
+    slackLinkContinuationWorkspaceId,
+    latencyMode,
+    reasoningEffort,
+    revalidatePrincipalAccess,
+    contextRefreshPrincipalAccess,
+    refreshGitHub,
+    refreshPersonalGitHub,
+    refreshWorkspace,
+    refreshWorkspaceMcpServers,
+    repoBusy,
+    repositoryGroups,
+    resetSessionView,
+    resetWorkspaceIntegrations,
+    selectedCapabilityToolIds,
+    selectedRepoIds,
+    selectedRepoRefs,
+    session,
+    sessionChannelProjectionAuthority,
+    sessionCreationHandoff,
+    sessionEventFeedStore,
+    setSession,
+    toolMcpServers,
+    workspaceDefaultToolIds,
+    workspaceMcpCatalogReady,
+    workspaceMcpCatalogLoadedSuccessfully,
+    workspaceCapabilityCatalog,
+    workspaceMemberIntegrationSetup,
+    workspaceStateOwnerId,
+    workspaces
+  ]);
+  return {
+    appContext,
+    client,
+    clientConfig,
+    configError,
+    retryClientConfig: () => {
+      setConfigError((current) => current?.recovering ? current : null);
+      setConfigRequestVersion((version) => version + 1);
+    },
+    authSession,
+    accessContext,
+    accessError,
+    accessLoading,
+    accessKeyVersion,
+    retryAccess: () => setAccessKeyVersion((version) => version + 1),
+    keyAuthRequired,
+    hasAccessKey,
+    accessKeyDraft,
+    setAccessKeyDraft,
+    saveAccessKey,
+    managedAuthRequired,
+    managedEmailVerificationRequired,
+    managedNewSignupsEnabled,
+    managedSocialProviders,
+    managedPasskeySignIn,
+    managedPasskeySignUp,
+    browserAccountsConfigured,
+    browserAccountsEnabled,
+    handleManagedAuth,
+    handleManagedSessionSetSignup,
+    handleManagedSocialAuth,
+    handleManagedPasskeyAuth,
+    handleManagedSignOut: contextHandleManagedSignOut,
+    handleBrowserActorTransition: contextHandleBrowserActorTransition,
+    completeOrganizationOnboarding,
+    revalidatePrincipalAccess,
+    defaultWorkspaceId,
+    slackLinkContinuationWorkspaceId,
+    routedWorkspace,
+    creditRequired,
+    setCreditRequired,
+    mutationBusy: busy || repoBusy || githubAppBusy || pendingCreateAttempt.current !== null
+  };
+}
+function submitGitHubManifest(actionUrl, manifest, newTab) {
+  const form = document.createElement("form");
+  form.method = "POST";
+  form.action = actionUrl;
+  if (newTab) form.target = "_blank";
+  form.style.display = "none";
+  form.acceptCharset = "utf-8";
+  const input = document.createElement("input");
+  input.type = "hidden";
+  input.name = "manifest";
+  input.value = JSON.stringify(manifest);
+  form.append(input);
+  document.body.append(form);
+  form.submit();
+  if (newTab) form.remove();
+}
+
+export {
+  GITHUB_STATUS_TOAST_ID,
+  PERSONAL_GITHUB_STATUS_TOAST_ID,
+  PERSONAL_GITHUB_RECONNECT_TOAST_ID,
+  showPersonalGitHubReconnectToast,
+  preserveSlackLinkForManagedAuth,
+  createSlackLinkPrepareController,
+  useAppState
+};
+//# sourceMappingURL=chunk-4DVNUCRR.js.map