@opentig/cli 0.2.0 → 0.2.2

package/dist/server.mjs

@@ -17,8 +17,12 @@ import { Transform, getDefaultHighWaterMark, Duplex, Writable, Readable, PassThr
 import { finished } from "node:stream/promises";
 import path$1 from "node:path/win32";
 import { createServer, isIP } from "node:net";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { createServer as createServer$1 } from "node:http";
 import WebSocket, { WebSocketServer } from "ws";
+function aiExecutablePathsKey(paths) {
+  return JSON.stringify(["codex", "claude", "opencode", "grok"].map((id) => paths[id] ?? ""));
+}
 function isPlainObject$1(value) {
   if (typeof value !== "object" || value === null) {
     return false;
@@ -5709,7 +5713,7 @@ const createReadable = ({ subprocess, concurrentStreams, encoding }, { from, bin
   const binary = binaryOption || BINARY_ENCODINGS.has(encoding);
   const { subprocessStdout, waitReadableDestroy } = getSubprocessStdout(subprocess, from, concurrentStreams);
   const { readableEncoding, readableObjectMode, readableHighWaterMark } = getReadableOptions(subprocessStdout, binary);
-  const { read, onStdoutDataDone } = getReadableMethods({
+  const { read: read2, onStdoutDataDone } = getReadableMethods({
     subprocessStdout,
     subprocess,
     binary,
@@ -5717,7 +5721,7 @@ const createReadable = ({ subprocess, concurrentStreams, encoding }, { from, bin
     preserveNewlines
   });
   const readable2 = new Readable({
-    read,
+    read: read2,
     destroy: callbackify(onReadableDestroy.bind(void 0, { subprocessStdout, subprocess, waitReadableDestroy })),
     highWaterMark: readableHighWaterMark,
     objectMode: readableObjectMode,
@@ -6555,7 +6559,7 @@ const createDuplex = ({ subprocess, concurrentStreams, encoding }, { from, to, b
   const { subprocessStdout, waitReadableDestroy } = getSubprocessStdout(subprocess, from, concurrentStreams);
   const { subprocessStdin, waitWritableFinal, waitWritableDestroy } = getSubprocessStdin(subprocess, to, concurrentStreams);
   const { readableEncoding, readableObjectMode, readableHighWaterMark } = getReadableOptions(subprocessStdout, binary);
-  const { read, onStdoutDataDone } = getReadableMethods({
+  const { read: read2, onStdoutDataDone } = getReadableMethods({
     subprocessStdout,
     subprocess,
     binary,
@@ -6563,7 +6567,7 @@ const createDuplex = ({ subprocess, concurrentStreams, encoding }, { from, to, b
     preserveNewlines
   });
   const duplex2 = new Duplex({
-    read,
+    read: read2,
     ...getWritableMethods(subprocessStdin, subprocess, waitWritableFinal),
     destroy: callbackify(onDuplexDestroy.bind(void 0, {
       subprocessStdout,
@@ -6900,9 +6904,9 @@ function pathDirectories(value, platform2) {
   });
 }
 class CliEnvironment {
-  constructor(host = currentCliHost(), read = readUserEnvironment) {
+  constructor(host = currentCliHost(), read2 = readUserEnvironment) {
     this.host = host;
-    this.read = read;
+    this.read = read2;
   }
   host;
   read;
@@ -6947,7 +6951,7 @@ async function readUserEnvironment(host) {
     env: host.env,
     extendEnv: false,
     input: "",
-    timeout: 5e3,
+    timeout: host.platform === "win32" ? 15e3 : 5e3,
     maxBuffer: 128 * 1024,
     cleanup: true,
     killDescendants: true,
@@ -6961,7 +6965,8 @@ async function readUserEnvironment(host) {
     const shell2 = path.win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
     const script = '$ErrorActionPreference="Stop"; $r=@{}; foreach($scope in @("Machine","User")){ $r[$scope]=[Environment]::GetEnvironmentVariables($scope) }; ConvertTo-Json -InputObject $r -Compress';
     const result = await execa(shell2, ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], options);
-    if (result.exitCode !== 0 || result.timedOut || result.isMaxBuffer) throw new Error("Environment query failed");
+    if (result.timedOut) throw new Error("Environment query timed out");
+    if (result.exitCode !== 0 || result.isMaxBuffer) throw new Error("Environment query failed");
     return windowsLocations(JSON.parse(result.stdout), host.env);
   }
   const shell = host.shell;
@@ -7529,14 +7534,14 @@ const NUMBER_FORMAT_RANGES = {
   float32: [-34028234663852886e22, 34028234663852886e22],
   float64: [-Number.MAX_VALUE, Number.MAX_VALUE]
 };
-function pick(schema, mask) {
-  const currDef = schema._zod.def;
+function pick(schema2, mask) {
+  const currDef = schema2._zod.def;
   const checks = currDef.checks;
   const hasChecks = checks && checks.length > 0;
   if (hasChecks) {
     throw new Error(".pick() cannot be used on object schemas containing refinements");
   }
-  const def = mergeDefs(schema._zod.def, {
+  const def = mergeDefs(schema2._zod.def, {
     get shape() {
       const newShape = {};
       for (const key in mask) {
@@ -7552,18 +7557,18 @@ function pick(schema, mask) {
     },
     checks: []
   });
-  return clone(schema, def);
+  return clone(schema2, def);
 }
-function omit(schema, mask) {
-  const currDef = schema._zod.def;
+function omit(schema2, mask) {
+  const currDef = schema2._zod.def;
   const checks = currDef.checks;
   const hasChecks = checks && checks.length > 0;
   if (hasChecks) {
     throw new Error(".omit() cannot be used on object schemas containing refinements");
   }
-  const def = mergeDefs(schema._zod.def, {
+  const def = mergeDefs(schema2._zod.def, {
     get shape() {
-      const newShape = { ...schema._zod.def.shape };
+      const newShape = { ...schema2._zod.def.shape };
       for (const key in mask) {
         if (!(key in currDef.shape)) {
           throw new Error(`Unrecognized key: "${key}"`);
@@ -7577,43 +7582,43 @@ function omit(schema, mask) {
     },
     checks: []
   });
-  return clone(schema, def);
+  return clone(schema2, def);
 }
-function extend(schema, shape) {
+function extend(schema2, shape) {
   if (!isPlainObject(shape)) {
     throw new Error("Invalid input to extend: expected a plain object");
   }
-  const checks = schema._zod.def.checks;
+  const checks = schema2._zod.def.checks;
   const hasChecks = checks && checks.length > 0;
   if (hasChecks) {
-    const existingShape = schema._zod.def.shape;
+    const existingShape = schema2._zod.def.shape;
     for (const key in shape) {
       if (Object.getOwnPropertyDescriptor(existingShape, key) !== void 0) {
         throw new Error("Cannot overwrite keys on object schemas containing refinements. Use `.safeExtend()` instead.");
       }
     }
   }
-  const def = mergeDefs(schema._zod.def, {
+  const def = mergeDefs(schema2._zod.def, {
     get shape() {
-      const _shape = { ...schema._zod.def.shape, ...shape };
+      const _shape = { ...schema2._zod.def.shape, ...shape };
       assignProp(this, "shape", _shape);
       return _shape;
     }
   });
-  return clone(schema, def);
+  return clone(schema2, def);
 }
-function safeExtend(schema, shape) {
+function safeExtend(schema2, shape) {
   if (!isPlainObject(shape)) {
     throw new Error("Invalid input to safeExtend: expected a plain object");
   }
-  const def = mergeDefs(schema._zod.def, {
+  const def = mergeDefs(schema2._zod.def, {
     get shape() {
-      const _shape = { ...schema._zod.def.shape, ...shape };
+      const _shape = { ...schema2._zod.def.shape, ...shape };
       assignProp(this, "shape", _shape);
       return _shape;
     }
   });
-  return clone(schema, def);
+  return clone(schema2, def);
 }
 function merge(a2, b) {
   if (a2._zod.def.checks?.length) {
@@ -7632,16 +7637,16 @@ function merge(a2, b) {
   });
   return clone(a2, def);
 }
-function partial(Class, schema, mask) {
-  const currDef = schema._zod.def;
+function partial(Class, schema2, mask) {
+  const currDef = schema2._zod.def;
   const checks = currDef.checks;
   const hasChecks = checks && checks.length > 0;
   if (hasChecks) {
     throw new Error(".partial() cannot be used on object schemas containing refinements");
   }
-  const def = mergeDefs(schema._zod.def, {
+  const def = mergeDefs(schema2._zod.def, {
     get shape() {
-      const oldShape = schema._zod.def.shape;
+      const oldShape = schema2._zod.def.shape;
       const shape = { ...oldShape };
       if (mask) {
         for (const key in mask) {
@@ -7668,12 +7673,12 @@ function partial(Class, schema, mask) {
     },
     checks: []
   });
-  return clone(schema, def);
+  return clone(schema2, def);
 }
-function required(Class, schema, mask) {
-  const def = mergeDefs(schema._zod.def, {
+function required(Class, schema2, mask) {
+  const def = mergeDefs(schema2._zod.def, {
     get shape() {
-      const oldShape = schema._zod.def.shape;
+      const oldShape = schema2._zod.def.shape;
       const shape = { ...oldShape };
       if (mask) {
         for (const key in mask) {
@@ -7699,7 +7704,7 @@ function required(Class, schema, mask) {
       return shape;
     }
   });
-  return clone(schema, def);
+  return clone(schema2, def);
 }
 function aborted(x, startIndex = 0) {
   if (x.aborted === true)
@@ -7828,9 +7833,9 @@ function formatError(error, mapper = (issue2) => issue2.message) {
   processError(error);
   return fieldErrors;
 }
-const _parse = (_Err) => (schema, value, _ctx, _params) => {
+const _parse = (_Err) => (schema2, value, _ctx, _params) => {
   const ctx = _ctx ? { ..._ctx, async: false } : { async: false };
-  const result = schema._zod.run({ value, issues: [] }, ctx);
+  const result = schema2._zod.run({ value, issues: [] }, ctx);
   if (result instanceof Promise) {
     throw new $ZodAsyncError();
   }
@@ -7841,9 +7846,9 @@ const _parse = (_Err) => (schema, value, _ctx, _params) => {
   }
   return result.value;
 };
-const _parseAsync = (_Err) => async (schema, value, _ctx, params) => {
+const _parseAsync = (_Err) => async (schema2, value, _ctx, params) => {
   const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
-  let result = schema._zod.run({ value, issues: [] }, ctx);
+  let result = schema2._zod.run({ value, issues: [] }, ctx);
   if (result instanceof Promise)
     result = await result;
   if (result.issues.length) {
@@ -7853,9 +7858,9 @@ const _parseAsync = (_Err) => async (schema, value, _ctx, params) => {
   }
   return result.value;
 };
-const _safeParse = (_Err) => (schema, value, _ctx) => {
+const _safeParse = (_Err) => (schema2, value, _ctx) => {
   const ctx = _ctx ? { ..._ctx, async: false } : { async: false };
-  const result = schema._zod.run({ value, issues: [] }, ctx);
+  const result = schema2._zod.run({ value, issues: [] }, ctx);
   if (result instanceof Promise) {
     throw new $ZodAsyncError();
   }
@@ -7865,9 +7870,9 @@ const _safeParse = (_Err) => (schema, value, _ctx) => {
   } : { success: true, data: result.value };
 };
 const safeParse$1 = /* @__PURE__ */ _safeParse($ZodRealError);
-const _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
+const _safeParseAsync = (_Err) => async (schema2, value, _ctx) => {
   const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
-  let result = schema._zod.run({ value, issues: [] }, ctx);
+  let result = schema2._zod.run({ value, issues: [] }, ctx);
   if (result instanceof Promise)
     result = await result;
   return result.issues.length ? {
@@ -7876,33 +7881,33 @@ const _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
   } : { success: true, data: result.value };
 };
 const safeParseAsync$1 = /* @__PURE__ */ _safeParseAsync($ZodRealError);
-const _encode = (_Err) => (schema, value, _ctx) => {
+const _encode = (_Err) => (schema2, value, _ctx) => {
   const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-  return _parse(_Err)(schema, value, ctx);
+  return _parse(_Err)(schema2, value, ctx);
 };
-const _decode = (_Err) => (schema, value, _ctx) => {
-  return _parse(_Err)(schema, value, _ctx);
+const _decode = (_Err) => (schema2, value, _ctx) => {
+  return _parse(_Err)(schema2, value, _ctx);
 };
-const _encodeAsync = (_Err) => async (schema, value, _ctx) => {
+const _encodeAsync = (_Err) => async (schema2, value, _ctx) => {
   const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-  return _parseAsync(_Err)(schema, value, ctx);
+  return _parseAsync(_Err)(schema2, value, ctx);
 };
-const _decodeAsync = (_Err) => async (schema, value, _ctx) => {
-  return _parseAsync(_Err)(schema, value, _ctx);
+const _decodeAsync = (_Err) => async (schema2, value, _ctx) => {
+  return _parseAsync(_Err)(schema2, value, _ctx);
 };
-const _safeEncode = (_Err) => (schema, value, _ctx) => {
+const _safeEncode = (_Err) => (schema2, value, _ctx) => {
   const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-  return _safeParse(_Err)(schema, value, ctx);
+  return _safeParse(_Err)(schema2, value, ctx);
 };
-const _safeDecode = (_Err) => (schema, value, _ctx) => {
-  return _safeParse(_Err)(schema, value, _ctx);
+const _safeDecode = (_Err) => (schema2, value, _ctx) => {
+  return _safeParse(_Err)(schema2, value, _ctx);
 };
-const _safeEncodeAsync = (_Err) => async (schema, value, _ctx) => {
+const _safeEncodeAsync = (_Err) => async (schema2, value, _ctx) => {
   const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-  return _safeParseAsync(_Err)(schema, value, ctx);
+  return _safeParseAsync(_Err)(schema2, value, ctx);
 };
-const _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
-  return _safeParseAsync(_Err)(schema, value, _ctx);
+const _safeDecodeAsync = (_Err) => async (schema2, value, _ctx) => {
+  return _safeParseAsync(_Err)(schema2, value, _ctx);
 };
 const cuid = /^[cC][0-9a-z]{6,}$/;
 const cuid2 = /^[0-9a-z]+$/;
@@ -9072,9 +9077,9 @@ const $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def)
     for (const key of normalized.keys) {
       const id = ids[key];
       const k = esc(key);
-      const schema = shape[key];
-      const isOptionalIn = schema?._zod?.optin === "optional";
-      const isOptionalOut = schema?._zod?.optout === "optional";
+      const schema2 = shape[key];
+      const isOptionalIn = schema2?._zod?.optin === "optional";
+      const isOptionalOut = schema2?._zod?.optout === "optional";
       doc.write(`const ${id} = ${parseStr(key)};`);
       if (isOptionalIn && isOptionalOut) {
         doc.write(`
@@ -9243,6 +9248,73 @@ const $ZodUnion = /* @__PURE__ */ $constructor("$ZodUnion", (inst, def) => {
     });
   };
 });
+const $ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("$ZodDiscriminatedUnion", (inst, def) => {
+  def.inclusive = false;
+  $ZodUnion.init(inst, def);
+  const _super = inst._zod.parse;
+  defineLazy(inst._zod, "propValues", () => {
+    const propValues = {};
+    for (const option of def.options) {
+      const pv = option._zod.propValues;
+      if (!pv || Object.keys(pv).length === 0)
+        throw new Error(`Invalid discriminated union option at index "${def.options.indexOf(option)}"`);
+      for (const [k, v] of Object.entries(pv)) {
+        if (!propValues[k])
+          propValues[k] = /* @__PURE__ */ new Set();
+        for (const val of v) {
+          propValues[k].add(val);
+        }
+      }
+    }
+    return propValues;
+  });
+  const disc = cached(() => {
+    const opts = def.options;
+    const map = /* @__PURE__ */ new Map();
+    for (const o2 of opts) {
+      const values = o2._zod.propValues?.[def.discriminator];
+      if (!values || values.size === 0)
+        throw new Error(`Invalid discriminated union option at index "${def.options.indexOf(o2)}"`);
+      for (const v of values) {
+        if (map.has(v)) {
+          throw new Error(`Duplicate discriminator value "${String(v)}"`);
+        }
+        map.set(v, o2);
+      }
+    }
+    return map;
+  });
+  inst._zod.parse = (payload, ctx) => {
+    const input = payload.value;
+    if (!isObject(input)) {
+      payload.issues.push({
+        code: "invalid_type",
+        expected: "object",
+        input,
+        inst
+      });
+      return payload;
+    }
+    const opt = disc.value.get(input?.[def.discriminator]);
+    if (opt) {
+      return opt._zod.run(payload, ctx);
+    }
+    if (def.unionFallback || ctx.direction === "backward") {
+      return _super(payload, ctx);
+    }
+    payload.issues.push({
+      code: "invalid_union",
+      errors: [],
+      note: "No matching discriminator",
+      discriminator: def.discriminator,
+      options: Array.from(disc.value.keys()),
+      input,
+      path: [def.discriminator],
+      inst
+    });
+    return payload;
+  };
+});
 const $ZodIntersection = /* @__PURE__ */ $constructor("$ZodIntersection", (inst, def) => {
   $ZodType.init(inst, def);
   inst._zod.parse = (payload, ctx) => {
@@ -9487,6 +9559,28 @@ const $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
     return payload;
   };
 });
+const $ZodLiteral = /* @__PURE__ */ $constructor("$ZodLiteral", (inst, def) => {
+  $ZodType.init(inst, def);
+  if (def.values.length === 0) {
+    throw new Error("Cannot create literal schema with no valid values");
+  }
+  const values = new Set(def.values);
+  inst._zod.values = values;
+  inst._zod.pattern = new RegExp(`^(${def.values.map((o2) => typeof o2 === "string" ? escapeRegex(o2) : o2 ? escapeRegex(o2.toString()) : String(o2)).join("|")})$`);
+  inst._zod.parse = (payload, _ctx) => {
+    const input = payload.value;
+    if (values.has(input)) {
+      return payload;
+    }
+    payload.issues.push({
+      code: "invalid_value",
+      values: def.values,
+      input,
+      inst
+    });
+    return payload;
+  };
+});
 const $ZodTransform = /* @__PURE__ */ $constructor("$ZodTransform", (inst, def) => {
   $ZodType.init(inst, def);
   inst._zod.optin = "optional";
@@ -9761,11 +9855,11 @@ class $ZodRegistry {
     this._map = /* @__PURE__ */ new WeakMap();
     this._idmap = /* @__PURE__ */ new Map();
   }
-  add(schema, ..._meta) {
+  add(schema2, ..._meta) {
     const meta = _meta[0];
-    this._map.set(schema, meta);
+    this._map.set(schema2, meta);
     if (meta && typeof meta === "object" && "id" in meta) {
-      this._idmap.set(meta.id, schema);
+      this._idmap.set(meta.id, schema2);
     }
     return this;
   }
@@ -9774,26 +9868,26 @@ class $ZodRegistry {
     this._idmap = /* @__PURE__ */ new Map();
     return this;
   }
-  remove(schema) {
-    const meta = this._map.get(schema);
+  remove(schema2) {
+    const meta = this._map.get(schema2);
     if (meta && typeof meta === "object" && "id" in meta) {
       this._idmap.delete(meta.id);
     }
-    this._map.delete(schema);
+    this._map.delete(schema2);
     return this;
   }
-  get(schema) {
-    const p = schema._zod.parent;
+  get(schema2) {
+    const p = schema2._zod.parent;
     if (p) {
       const pm = { ...this.get(p) ?? {} };
       delete pm.id;
-      const f = { ...pm, ...this._map.get(schema) };
+      const f = { ...pm, ...this._map.get(schema2) };
       return Object.keys(f).length ? f : void 0;
     }
-    return this._map.get(schema);
+    return this._map.get(schema2);
   }
-  has(schema) {
-    return this._map.has(schema);
+  has(schema2) {
+    return this._map.has(schema2);
   }
 }
 function registry() {
@@ -10270,13 +10364,13 @@ function _array(Class, element, params) {
 }
 // @__NO_SIDE_EFFECTS__
 function _refine(Class, fn, _params) {
-  const schema = new Class({
+  const schema2 = new Class({
     type: "custom",
     check: "custom",
     fn,
     ...normalizeParams(_params)
   });
-  return schema;
+  return schema2;
 }
 // @__NO_SIDE_EFFECTS__
 function _superRefine(fn, params) {
@@ -10329,40 +10423,40 @@ function initializeContext(params) {
     external: params?.external ?? void 0
   };
 }
-function process$1(schema, ctx, _params = { path: [], schemaPath: [] }) {
+function process$1(schema2, ctx, _params = { path: [], schemaPath: [] }) {
   var _a2;
-  const def = schema._zod.def;
-  const seen = ctx.seen.get(schema);
+  const def = schema2._zod.def;
+  const seen = ctx.seen.get(schema2);
   if (seen) {
     seen.count++;
-    const isCycle = _params.schemaPath.includes(schema);
+    const isCycle = _params.schemaPath.includes(schema2);
     if (isCycle) {
       seen.cycle = _params.path;
     }
     return seen.schema;
   }
   const result = { schema: {}, count: 1, cycle: void 0, path: _params.path };
-  ctx.seen.set(schema, result);
-  const overrideSchema = schema._zod.toJSONSchema?.();
+  ctx.seen.set(schema2, result);
+  const overrideSchema = schema2._zod.toJSONSchema?.();
   if (overrideSchema) {
     result.schema = overrideSchema;
   } else {
     const params = {
       ..._params,
-      schemaPath: [..._params.schemaPath, schema],
+      schemaPath: [..._params.schemaPath, schema2],
       path: _params.path
     };
-    if (schema._zod.processJSONSchema) {
-      schema._zod.processJSONSchema(ctx, result.schema, params);
+    if (schema2._zod.processJSONSchema) {
+      schema2._zod.processJSONSchema(ctx, result.schema, params);
     } else {
       const _json = result.schema;
       const processor = ctx.processors[def.type];
       if (!processor) {
         throw new Error(`[toJSONSchema]: Non-representable type encountered: ${def.type}`);
       }
-      processor(schema, ctx, _json, params);
+      processor(schema2, ctx, _json, params);
     }
-    const parent = schema._zod.parent;
+    const parent = schema2._zod.parent;
     if (parent) {
       if (!result.ref)
         result.ref = parent;
@@ -10370,21 +10464,21 @@ function process$1(schema, ctx, _params = { path: [], schemaPath: [] }) {
       ctx.seen.get(parent).isParent = true;
     }
   }
-  const meta = ctx.metadataRegistry.get(schema);
+  const meta = ctx.metadataRegistry.get(schema2);
   if (meta)
     Object.assign(result.schema, meta);
-  if (ctx.io === "input" && isTransforming(schema)) {
+  if (ctx.io === "input" && isTransforming(schema2)) {
     delete result.schema.examples;
     delete result.schema.default;
   }
   if (ctx.io === "input" && "_prefault" in result.schema)
     (_a2 = result.schema).default ?? (_a2.default = result.schema._prefault);
   delete result.schema._prefault;
-  const _result = ctx.seen.get(schema);
+  const _result = ctx.seen.get(schema2);
   return _result.schema;
 }
-function extractDefs(ctx, schema) {
-  const root = ctx.seen.get(schema);
+function extractDefs(ctx, schema2) {
+  const root = ctx.seen.get(schema2);
   if (!root)
     throw new Error("Unprocessed schema. This is a bug in Zod.");
   const idToSchema = /* @__PURE__ */ new Map();
@@ -10427,11 +10521,11 @@ function extractDefs(ctx, schema) {
     seen.def = { ...seen.schema };
     if (defId)
       seen.defId = defId;
-    const schema2 = seen.schema;
-    for (const key in schema2) {
-      delete schema2[key];
+    const schema3 = seen.schema;
+    for (const key in schema3) {
+      delete schema3[key];
     }
-    schema2.$ref = ref;
+    schema3.$ref = ref;
   };
   if (ctx.cycles === "throw") {
     for (const entry of ctx.seen.entries()) {
@@ -10445,13 +10539,13 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
   }
   for (const entry of ctx.seen.entries()) {
     const seen = entry[1];
-    if (schema === entry[0]) {
+    if (schema2 === entry[0]) {
       extractToDef(entry);
       continue;
     }
     if (ctx.external) {
       const ext = ctx.external.registry.get(entry[0])?.id;
-      if (schema !== entry[0] && ext) {
+      if (schema2 !== entry[0] && ext) {
         extractToDef(entry);
         continue;
       }
@@ -10473,16 +10567,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
     }
   }
 }
-function finalize(ctx, schema) {
-  const root = ctx.seen.get(schema);
+function finalize(ctx, schema2) {
+  const root = ctx.seen.get(schema2);
   if (!root)
     throw new Error("Unprocessed schema. This is a bug in Zod.");
   const flattenRef = (zodSchema) => {
     const seen = ctx.seen.get(zodSchema);
     if (seen.ref === null)
       return;
-    const schema2 = seen.def ?? seen.schema;
-    const _cached = { ...schema2 };
+    const schema3 = seen.def ?? seen.schema;
+    const _cached = { ...schema3 };
     const ref = seen.ref;
     seen.ref = null;
     if (ref) {
@@ -10490,28 +10584,28 @@ function finalize(ctx, schema) {
       const refSeen = ctx.seen.get(ref);
       const refSchema = refSeen.schema;
       if (refSchema.$ref && (ctx.target === "draft-07" || ctx.target === "draft-04" || ctx.target === "openapi-3.0")) {
-        schema2.allOf = schema2.allOf ?? [];
-        schema2.allOf.push(refSchema);
+        schema3.allOf = schema3.allOf ?? [];
+        schema3.allOf.push(refSchema);
       } else {
-        Object.assign(schema2, refSchema);
+        Object.assign(schema3, refSchema);
       }
-      Object.assign(schema2, _cached);
+      Object.assign(schema3, _cached);
       const isParentRef = zodSchema._zod.parent === ref;
       if (isParentRef) {
-        for (const key in schema2) {
+        for (const key in schema3) {
           if (key === "$ref" || key === "allOf")
             continue;
           if (!(key in _cached)) {
-            delete schema2[key];
+            delete schema3[key];
           }
         }
       }
       if (refSchema.$ref && refSeen.def) {
-        for (const key in schema2) {
+        for (const key in schema3) {
           if (key === "$ref" || key === "allOf")
             continue;
-          if (key in refSeen.def && JSON.stringify(schema2[key]) === JSON.stringify(refSeen.def[key])) {
-            delete schema2[key];
+          if (key in refSeen.def && JSON.stringify(schema3[key]) === JSON.stringify(refSeen.def[key])) {
+            delete schema3[key];
           }
         }
       }
@@ -10521,13 +10615,13 @@ function finalize(ctx, schema) {
       flattenRef(parent);
       const parentSeen = ctx.seen.get(parent);
       if (parentSeen?.schema.$ref) {
-        schema2.$ref = parentSeen.schema.$ref;
+        schema3.$ref = parentSeen.schema.$ref;
         if (parentSeen.def) {
-          for (const key in schema2) {
+          for (const key in schema3) {
             if (key === "$ref" || key === "allOf")
               continue;
-            if (key in parentSeen.def && JSON.stringify(schema2[key]) === JSON.stringify(parentSeen.def[key])) {
-              delete schema2[key];
+            if (key in parentSeen.def && JSON.stringify(schema3[key]) === JSON.stringify(parentSeen.def[key])) {
+              delete schema3[key];
             }
           }
         }
@@ -10535,7 +10629,7 @@ function finalize(ctx, schema) {
     }
     ctx.override({
       zodSchema,
-      jsonSchema: schema2,
+      jsonSchema: schema3,
       path: seen.path ?? []
     });
   };
@@ -10552,13 +10646,13 @@ function finalize(ctx, schema) {
   } else if (ctx.target === "openapi-3.0") ;
   else ;
   if (ctx.external?.uri) {
-    const id = ctx.external.registry.get(schema)?.id;
+    const id = ctx.external.registry.get(schema2)?.id;
     if (!id)
       throw new Error("Schema is missing an `id` property");
     result.$id = ctx.external.uri(id);
   }
   Object.assign(result, root.def ?? root.schema);
-  const rootMetaId = ctx.metadataRegistry.get(schema)?.id;
+  const rootMetaId = ctx.metadataRegistry.get(schema2)?.id;
   if (rootMetaId !== void 0 && result.id === rootMetaId)
     delete result.id;
   const defs = ctx.external?.defs ?? {};
@@ -10584,10 +10678,10 @@ function finalize(ctx, schema) {
     const finalized = JSON.parse(JSON.stringify(result));
     Object.defineProperty(finalized, "~standard", {
       value: {
-        ...schema["~standard"],
+        ...schema2["~standard"],
         jsonSchema: {
-          input: createStandardJSONSchemaMethod(schema, "input", ctx.processors),
-          output: createStandardJSONSchemaMethod(schema, "output", ctx.processors)
+          input: createStandardJSONSchemaMethod(schema2, "input", ctx.processors),
+          output: createStandardJSONSchemaMethod(schema2, "output", ctx.processors)
         }
       },
       enumerable: false,
@@ -10651,18 +10745,18 @@ function isTransforming(_schema, _ctx) {
   }
   return false;
 }
-const createToJSONSchemaMethod = (schema, processors = {}) => (params) => {
+const createToJSONSchemaMethod = (schema2, processors = {}) => (params) => {
   const ctx = initializeContext({ ...params, processors });
-  process$1(schema, ctx);
-  extractDefs(ctx, schema);
-  return finalize(ctx, schema);
+  process$1(schema2, ctx);
+  extractDefs(ctx, schema2);
+  return finalize(ctx, schema2);
 };
-const createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) => {
+const createStandardJSONSchemaMethod = (schema2, io, processors = {}) => (params) => {
   const { libraryOptions, target } = params ?? {};
   const ctx = initializeContext({ ...libraryOptions ?? {}, target, io, processors });
-  process$1(schema, ctx);
-  extractDefs(ctx, schema);
-  return finalize(ctx, schema);
+  process$1(schema2, ctx);
+  extractDefs(ctx, schema2);
+  return finalize(ctx, schema2);
 };
 const formatMap = {
   guid: "uuid",
@@ -10672,10 +10766,10 @@ const formatMap = {
   regex: ""
   // do not set
 };
-const stringProcessor = (schema, ctx, _json, _params) => {
+const stringProcessor = (schema2, ctx, _json, _params) => {
   const json2 = _json;
   json2.type = "string";
-  const { minimum, maximum, format: format2, patterns, contentEncoding } = schema._zod.bag;
+  const { minimum, maximum, format: format2, patterns, contentEncoding } = schema2._zod.bag;
   if (typeof minimum === "number")
     json2.minLength = minimum;
   if (typeof maximum === "number")
@@ -10704,9 +10798,9 @@ const stringProcessor = (schema, ctx, _json, _params) => {
     }
   }
 };
-const numberProcessor = (schema, ctx, _json, _params) => {
+const numberProcessor = (schema2, ctx, _json, _params) => {
   const json2 = _json;
-  const { minimum, maximum, format: format2, multipleOf, exclusiveMaximum, exclusiveMinimum } = schema._zod.bag;
+  const { minimum, maximum, format: format2, multipleOf, exclusiveMaximum, exclusiveMinimum } = schema2._zod.bag;
   if (typeof format2 === "string" && format2.includes("int"))
     json2.type = "integer";
   else
@@ -10781,8 +10875,8 @@ const dateProcessor = (_schema, ctx, _json, _params) => {
     throw new Error("Date cannot be represented in JSON Schema");
   }
 };
-const enumProcessor = (schema, _ctx, json2, _params) => {
-  const def = schema._zod.def;
+const enumProcessor = (schema2, _ctx, json2, _params) => {
+  const def = schema2._zod.def;
   const values = getEnumValues(def.entries);
   if (values.every((v) => typeof v === "number"))
     json2.type = "number";
@@ -10790,8 +10884,8 @@ const enumProcessor = (schema, _ctx, json2, _params) => {
     json2.type = "string";
   json2.enum = values;
 };
-const literalProcessor = (schema, ctx, json2, _params) => {
-  const def = schema._zod.def;
+const literalProcessor = (schema2, ctx, json2, _params) => {
+  const def = schema2._zod.def;
   const vals = [];
   for (const val of def.values) {
     if (val === void 0) {
@@ -10834,22 +10928,22 @@ const nanProcessor = (_schema, ctx, _json, _params) => {
     throw new Error("NaN cannot be represented in JSON Schema");
   }
 };
-const templateLiteralProcessor = (schema, _ctx, json2, _params) => {
+const templateLiteralProcessor = (schema2, _ctx, json2, _params) => {
   const _json = json2;
-  const pattern = schema._zod.pattern;
+  const pattern = schema2._zod.pattern;
   if (!pattern)
     throw new Error("Pattern not found in template literal");
   _json.type = "string";
   _json.pattern = pattern.source;
 };
-const fileProcessor = (schema, _ctx, json2, _params) => {
+const fileProcessor = (schema2, _ctx, json2, _params) => {
   const _json = json2;
   const file = {
     type: "string",
     format: "binary",
     contentEncoding: "binary"
   };
-  const { minimum, maximum, mime } = schema._zod.bag;
+  const { minimum, maximum, mime } = schema2._zod.bag;
   if (minimum !== void 0)
     file.minLength = minimum;
   if (maximum !== void 0)
@@ -10894,10 +10988,10 @@ const setProcessor = (_schema, ctx, _json, _params) => {
     throw new Error("Set cannot be represented in JSON Schema");
   }
 };
-const arrayProcessor = (schema, ctx, _json, params) => {
+const arrayProcessor = (schema2, ctx, _json, params) => {
   const json2 = _json;
-  const def = schema._zod.def;
-  const { minimum, maximum } = schema._zod.bag;
+  const def = schema2._zod.def;
+  const { minimum, maximum } = schema2._zod.bag;
   if (typeof minimum === "number")
     json2.minItems = minimum;
   if (typeof maximum === "number")
@@ -10908,9 +11002,9 @@ const arrayProcessor = (schema, ctx, _json, params) => {
     path: [...params.path, "items"]
   });
 };
-const objectProcessor = (schema, ctx, _json, params) => {
+const objectProcessor = (schema2, ctx, _json, params) => {
   const json2 = _json;
-  const def = schema._zod.def;
+  const def = schema2._zod.def;
   json2.type = "object";
   json2.properties = {};
   const shape = def.shape;
@@ -10944,8 +11038,8 @@ const objectProcessor = (schema, ctx, _json, params) => {
     });
   }
 };
-const unionProcessor = (schema, ctx, json2, params) => {
-  const def = schema._zod.def;
+const unionProcessor = (schema2, ctx, json2, params) => {
+  const def = schema2._zod.def;
   const isExclusive = def.inclusive === false;
   const options = def.options.map((x, i2) => process$1(x, ctx, {
     ...params,
@@ -10957,8 +11051,8 @@ const unionProcessor = (schema, ctx, json2, params) => {
     json2.anyOf = options;
   }
 };
-const intersectionProcessor = (schema, ctx, json2, params) => {
-  const def = schema._zod.def;
+const intersectionProcessor = (schema2, ctx, json2, params) => {
+  const def = schema2._zod.def;
   const a2 = process$1(def.left, ctx, {
     ...params,
     path: [...params.path, "allOf", 0]
@@ -10974,9 +11068,9 @@ const intersectionProcessor = (schema, ctx, json2, params) => {
   ];
   json2.allOf = allOf;
 };
-const tupleProcessor = (schema, ctx, _json, params) => {
+const tupleProcessor = (schema2, ctx, _json, params) => {
   const json2 = _json;
-  const def = schema._zod.def;
+  const def = schema2._zod.def;
   json2.type = "array";
   const prefixPath = ctx.target === "draft-2020-12" ? "prefixItems" : "items";
   const restPath = ctx.target === "draft-2020-12" ? "items" : ctx.target === "openapi-3.0" ? "items" : "additionalItems";
@@ -11010,15 +11104,15 @@ const tupleProcessor = (schema, ctx, _json, params) => {
       json2.additionalItems = rest;
     }
   }
-  const { minimum, maximum } = schema._zod.bag;
+  const { minimum, maximum } = schema2._zod.bag;
   if (typeof minimum === "number")
     json2.minItems = minimum;
   if (typeof maximum === "number")
     json2.maxItems = maximum;
 };
-const recordProcessor = (schema, ctx, _json, params) => {
+const recordProcessor = (schema2, ctx, _json, params) => {
   const json2 = _json;
-  const def = schema._zod.def;
+  const def = schema2._zod.def;
   json2.type = "object";
   const keyType = def.keyType;
   const keyBag = keyType._zod.bag;
@@ -11052,10 +11146,10 @@ const recordProcessor = (schema, ctx, _json, params) => {
     }
   }
 };
-const nullableProcessor = (schema, ctx, json2, params) => {
-  const def = schema._zod.def;
+const nullableProcessor = (schema2, ctx, json2, params) => {
+  const def = schema2._zod.def;
   const inner = process$1(def.innerType, ctx, params);
-  const seen = ctx.seen.get(schema);
+  const seen = ctx.seen.get(schema2);
   if (ctx.target === "openapi-3.0") {
     seen.ref = def.innerType;
     json2.nullable = true;
@@ -11063,31 +11157,31 @@ const nullableProcessor = (schema, ctx, json2, params) => {
     json2.anyOf = [inner, { type: "null" }];
   }
 };
-const nonoptionalProcessor = (schema, ctx, _json, params) => {
-  const def = schema._zod.def;
+const nonoptionalProcessor = (schema2, ctx, _json, params) => {
+  const def = schema2._zod.def;
   process$1(def.innerType, ctx, params);
-  const seen = ctx.seen.get(schema);
+  const seen = ctx.seen.get(schema2);
   seen.ref = def.innerType;
 };
-const defaultProcessor = (schema, ctx, json2, params) => {
-  const def = schema._zod.def;
+const defaultProcessor = (schema2, ctx, json2, params) => {
+  const def = schema2._zod.def;
   process$1(def.innerType, ctx, params);
-  const seen = ctx.seen.get(schema);
+  const seen = ctx.seen.get(schema2);
   seen.ref = def.innerType;
   json2.default = JSON.parse(JSON.stringify(def.defaultValue));
 };
-const prefaultProcessor = (schema, ctx, json2, params) => {
-  const def = schema._zod.def;
+const prefaultProcessor = (schema2, ctx, json2, params) => {
+  const def = schema2._zod.def;
   process$1(def.innerType, ctx, params);
-  const seen = ctx.seen.get(schema);
+  const seen = ctx.seen.get(schema2);
   seen.ref = def.innerType;
   if (ctx.io === "input")
     json2._prefault = JSON.parse(JSON.stringify(def.defaultValue));
 };
-const catchProcessor = (schema, ctx, json2, params) => {
-  const def = schema._zod.def;
+const catchProcessor = (schema2, ctx, json2, params) => {
+  const def = schema2._zod.def;
   process$1(def.innerType, ctx, params);
-  const seen = ctx.seen.get(schema);
+  const seen = ctx.seen.get(schema2);
   seen.ref = def.innerType;
   let catchValue;
   try {
@@ -11097,37 +11191,37 @@ const catchProcessor = (schema, ctx, json2, params) => {
   }
   json2.default = catchValue;
 };
-const pipeProcessor = (schema, ctx, _json, params) => {
-  const def = schema._zod.def;
+const pipeProcessor = (schema2, ctx, _json, params) => {
+  const def = schema2._zod.def;
   const inIsTransform = def.in._zod.traits.has("$ZodTransform");
   const innerType = ctx.io === "input" ? inIsTransform ? def.out : def.in : def.out;
   process$1(innerType, ctx, params);
-  const seen = ctx.seen.get(schema);
+  const seen = ctx.seen.get(schema2);
   seen.ref = innerType;
 };
-const readonlyProcessor = (schema, ctx, json2, params) => {
-  const def = schema._zod.def;
+const readonlyProcessor = (schema2, ctx, json2, params) => {
+  const def = schema2._zod.def;
   process$1(def.innerType, ctx, params);
-  const seen = ctx.seen.get(schema);
+  const seen = ctx.seen.get(schema2);
   seen.ref = def.innerType;
   json2.readOnly = true;
 };
-const promiseProcessor = (schema, ctx, _json, params) => {
-  const def = schema._zod.def;
+const promiseProcessor = (schema2, ctx, _json, params) => {
+  const def = schema2._zod.def;
   process$1(def.innerType, ctx, params);
-  const seen = ctx.seen.get(schema);
+  const seen = ctx.seen.get(schema2);
   seen.ref = def.innerType;
 };
-const optionalProcessor = (schema, ctx, _json, params) => {
-  const def = schema._zod.def;
+const optionalProcessor = (schema2, ctx, _json, params) => {
+  const def = schema2._zod.def;
   process$1(def.innerType, ctx, params);
-  const seen = ctx.seen.get(schema);
+  const seen = ctx.seen.get(schema2);
   seen.ref = def.innerType;
 };
-const lazyProcessor = (schema, ctx, _json, params) => {
-  const innerType = schema._zod.innerType;
+const lazyProcessor = (schema2, ctx, _json, params) => {
+  const innerType = schema2._zod.innerType;
   process$1(innerType, ctx, params);
-  const seen = ctx.seen.get(schema);
+  const seen = ctx.seen.get(schema2);
   seen.ref = innerType;
 };
 const allProcessors = {
@@ -11177,8 +11271,8 @@ function toJSONSchema(input, params) {
     const ctx2 = initializeContext({ ...params, processors: allProcessors });
     const defs = {};
     for (const entry of registry2._idmap.entries()) {
-      const [_, schema] = entry;
-      process$1(schema, ctx2);
+      const [_, schema2] = entry;
+      process$1(schema2, ctx2);
     }
     const schemas = {};
     const external = {
@@ -11188,9 +11282,9 @@ function toJSONSchema(input, params) {
     };
     ctx2.external = external;
     for (const entry of registry2._idmap.entries()) {
-      const [key, schema] = entry;
-      extractDefs(ctx2, schema);
-      schemas[key] = finalize(ctx2, schema);
+      const [key, schema2] = entry;
+      extractDefs(ctx2, schema2);
+      schemas[key] = finalize(ctx2, schema2);
     }
     if (Object.keys(defs).length > 0) {
       const defsSegment = ctx2.target === "draft-2020-12" ? "$defs" : "definitions";
@@ -11814,6 +11908,18 @@ function union(options, params) {
     ...normalizeParams(params)
   });
 }
+const ZodDiscriminatedUnion = /* @__PURE__ */ $constructor("ZodDiscriminatedUnion", (inst, def) => {
+  ZodUnion.init(inst, def);
+  $ZodDiscriminatedUnion.init(inst, def);
+});
+function discriminatedUnion(discriminator, options, params) {
+  return new ZodDiscriminatedUnion({
+    type: "union",
+    options,
+    discriminator,
+    ...normalizeParams(params)
+  });
+}
 const ZodIntersection = /* @__PURE__ */ $constructor("ZodIntersection", (inst, def) => {
   $ZodIntersection.init(inst, def);
   ZodType.init(inst, def);
@@ -11895,6 +12001,27 @@ function _enum(values, params) {
     ...normalizeParams(params)
   });
 }
+const ZodLiteral = /* @__PURE__ */ $constructor("ZodLiteral", (inst, def) => {
+  $ZodLiteral.init(inst, def);
+  ZodType.init(inst, def);
+  inst._zod.processJSONSchema = (ctx, json2, params) => literalProcessor(inst, ctx, json2);
+  inst.values = new Set(def.values);
+  Object.defineProperty(inst, "value", {
+    get() {
+      if (def.values.length > 1) {
+        throw new Error("This schema contains multiple valid literal values. Use `.values` instead.");
+      }
+      return def.values[0];
+    }
+  });
+});
+function literal(value, params) {
+  return new ZodLiteral({
+    type: "literal",
+    values: Array.isArray(value) ? value : [value],
+    ...normalizeParams(params)
+  });
+}
 const ZodTransform = /* @__PURE__ */ $constructor("ZodTransform", (inst, def) => {
   $ZodTransform.init(inst, def);
   ZodType.init(inst, def);
@@ -12068,7 +12195,7 @@ function superRefine(fn, params) {
   return /* @__PURE__ */ _superRefine(fn, params);
 }
 function redactSensitiveText(value) {
-  const withoutHeaders = value.replace(/\b(authorization|cookie|set-cookie)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]").replace(/\b(token|secret|password)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]");
+  const withoutHeaders = value.replace(/\b(?:github_pat_|gh[opusr]_)[A-Za-z0-9_]{16,}/g, "[redacted]").replace(/\bauthorization\s*[:=]\s*(?:bearer|basic)\s+[^\s,;]+/gi, "authorization=[redacted]").replace(/\b(authorization|cookie|set-cookie)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]").replace(/\b(token|secret|password)\s*[:=]\s*[^\s,;]+/gi, "$1=[redacted]");
   return withoutHeaders.replace(/https?:\/\/[^\s"'<>]+/gi, (candidate) => redactUrl(candidate));
 }
 function redactUrl(candidate) {
@@ -12460,51 +12587,71 @@ function cleanText(value, maxLength) {
 }
 const DEFAULT_MODEL$1 = { id: "default", label: "Default (CLI)" };
 class CommitMessageService {
-  constructor(operations, providers, log, invalidateDiscovery) {
+  constructor(operations, providers, log, invalidateDiscovery, statusPersistence) {
     this.operations = operations;
     this.log = log;
     this.invalidateDiscovery = invalidateDiscovery;
+    this.statusPersistence = statusPersistence;
     for (const provider of providers) this.providers.set(provider.id, provider);
   }
   operations;
   log;
   invalidateDiscovery;
+  statusPersistence;
   providers = /* @__PURE__ */ new Map();
   active = /* @__PURE__ */ new Map();
   statusCache = null;
+  statusInvalidated = false;
   statusGeneration = 0;
   pendingStatus;
   invalidateStatuses() {
     this.statusGeneration++;
     this.statusCache = null;
+    this.statusInvalidated = true;
     this.pendingStatus = void 0;
     this.invalidateDiscovery?.();
   }
   async statuses(forceRefresh = false) {
-    if (!forceRefresh && this.statusCache && Date.now() - this.statusCache.at < 3e4) return this.statusCache.value;
-    if (this.pendingStatus && (!forceRefresh || this.pendingStatus.force)) return this.pendingStatus.promise;
+    const key = this.statusPersistence?.key() ?? "";
+    if (!forceRefresh && this.statusCache?.key === key) return this.statusCache.value;
+    if (this.pendingStatus?.key === key && (!forceRefresh || this.pendingStatus.force)) return this.pendingStatus.promise;
     const generation = ++this.statusGeneration;
-    const promise = Promise.all([...this.providers.values()].map(async (provider) => {
-      try {
-        return await provider.status(forceRefresh);
-      } catch {
-        return {
-          id: provider.id,
-          label: { codex: "Codex", claude: "Claude Code", opencode: "OpenCode", grok: "Grok Build" }[provider.id],
-          installed: false,
-          availability: "error",
-          authStatus: "unknown",
-          installationStatus: "inspection-failed",
-          message: "Could not inspect this CLI. Check again or review its executable path.",
-          models: [DEFAULT_MODEL$1],
-          checkedAt: (/* @__PURE__ */ new Date()).toISOString()
-        };
+    const promise = (async () => {
+      if (!forceRefresh && !this.statusInvalidated && this.statusPersistence) {
+        const saved = await this.statusPersistence.store.load(key).catch(() => null);
+        if (saved?.length === this.providers.size && saved.every((status) => this.providers.has(status.id))) {
+          if (generation === this.statusGeneration) this.statusCache = { key, value: saved };
+          return saved;
+        }
+      }
+      const value = await Promise.all([...this.providers.values()].map(async (provider) => {
+        try {
+          return { ...await provider.status(forceRefresh), checkedAt: (/* @__PURE__ */ new Date()).toISOString() };
+        } catch {
+          return {
+            id: provider.id,
+            label: { codex: "Codex", claude: "Claude Code", opencode: "OpenCode", grok: "Grok Build" }[provider.id],
+            installed: false,
+            availability: "error",
+            authStatus: "unknown",
+            installationStatus: "inspection-failed",
+            message: "Could not inspect this CLI. Check again or review its executable path.",
+            models: [DEFAULT_MODEL$1],
+            checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+        }
+      }));
+      if (generation === this.statusGeneration) {
+        this.statusCache = { key, value };
+        this.statusInvalidated = false;
+        try {
+          await this.statusPersistence?.store.save(key, value);
+        } catch {
+        }
       }
-    })).then((value) => {
-      if (generation === this.statusGeneration) this.statusCache = { at: Date.now(), value };
       return value;
-    });
-    this.pendingStatus = { force: forceRefresh, promise };
+    })();
+    this.pendingStatus = { force: forceRefresh, key, promise };
     try {
       return await promise;
     } finally {
@@ -12896,8 +13043,8 @@ function label(harness) {
 function stripAnsi(value) {
   return value.replace(new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g"), "");
 }
-function toCodexOutputSchema(schema) {
-  return strictify(structuredClone(schema));
+function toCodexOutputSchema(schema2) {
+  return strictify(structuredClone(schema2));
 }
 function strictify(value) {
   if (!value || typeof value !== "object") return value;
@@ -13051,9 +13198,9 @@ class CodexProvider {
     const failure2 = detectionFailure(detected, { id: this.id, label: "Codex", models: [DEFAULT_MODEL$1], checkedAt });
     if (failure2) return failure2;
     const executable = requireCandidate(detected, this.id);
-    const login = await runCandidate(this.runner, executable, ["login", "status"]);
-    if (login.exitCode !== 0 || !/logged in/i.test(`${login.stdout}
-${login.stderr}`)) {
+    const login2 = await runCandidate(this.runner, executable, ["login", "status"]);
+    if (login2.exitCode !== 0 || !/logged in/i.test(`${login2.stdout}
+${login2.stderr}`)) {
       return { ...detectionFields(detected), id: this.id, label: "Codex", availability: "error", installed: true, authStatus: "unauthenticated", version: detected.version ?? "", message: "Run codex login.", models: [DEFAULT_MODEL$1], checkedAt };
     }
     const catalog = await runCandidate(this.runner, executable, ["debug", "models", "--bundled"]);
@@ -13547,11 +13694,10 @@ class OpenCodeProvider {
     const executable = requireCandidate(detected, this.id);
     const version2 = detected.version ?? "";
     const cliName = openCodeCliName(executable.executable);
-    const [auth, catalog] = await Promise.all([
+    const [auth, models] = await Promise.all([
       runCandidate(this.runner, executable, ["auth", "list", "--format", "json", "--standalone"]),
-      runCandidate(this.runner, executable, ["models", "--standalone"], { timeoutMs: 3e4 })
+      this.loadModels(executable)
     ]);
-    const models = catalog.exitCode === 0 ? parseOpenCodeModels(catalog.stdout) : [DEFAULT_MODEL$1];
     let authStatus = parseOpenCodeAuthList(auth.stdout, auth.exitCode);
     if (authStatus === "unauthenticated" && models.length > 1) authStatus = "unknown";
     const confirmed = authStatus === "authenticated";
@@ -13566,9 +13712,20 @@ class OpenCodeProvider {
       version: version2,
       models,
       checkedAt,
-      ...authStatus === "unauthenticated" ? { message: `Run ${openCodeLoginCommand(cliName)}.` } : !confirmed ? { message: "Could not confirm authentication for the selected provider." } : {}
+      ...authStatus === "unauthenticated" ? { message: `Run ${openCodeLoginCommand(cliName)}.` } : models.length === 1 ? { message: `Could not load the OpenCode model catalog. Check again or verify that ${cliName} models lists your models in a terminal.` } : !confirmed ? { message: "Could not confirm authentication for the selected provider." } : {}
     };
   }
+  async loadModels(executable) {
+    for (const args of [["models", "--standalone"], ["models"]]) {
+      try {
+        const catalog = await runCandidate(this.runner, executable, args, { timeoutMs: 3e4 });
+        const models = catalog.exitCode === 0 ? parseOpenCodeModels(catalog.stdout) : [DEFAULT_MODEL$1];
+        if (models.length > 1) return models;
+      } catch {
+      }
+    }
+    return [DEFAULT_MODEL$1];
+  }
   async generate(input) {
     const detected = await this.detect(false, input.signal);
     const executable = requireCandidate(detected, this.id);
@@ -14679,6 +14836,450 @@ class RepositoryWatcher {
     this.onChange(this.active.id, scope);
   }
 }
+const OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/;
+const REPO_PATTERN = /^[A-Za-z0-9._-]+$/;
+function parseGitHubRemote(url) {
+  const trimmed = url.trim();
+  if (!trimmed) return null;
+  let rest = null;
+  const https = /^https?:\/\/(?:[^@/\s]+@)?github\.com\/(.+)$/i.exec(trimmed);
+  const ssh = /^ssh:\/\/(?:[^@/\s]+@)?github\.com(?::\d+)?\/(.+)$/i.exec(trimmed);
+  const scp = /^(?:[^@\s]+)@github\.com:(.+)$/i.exec(trimmed);
+  const git = /^git:\/\/github\.com\/(.+)$/i.exec(trimmed);
+  if (https) rest = https[1] ?? null;
+  else if (ssh) rest = ssh[1] ?? null;
+  else if (scp) rest = scp[1] ?? null;
+  else if (git) rest = git[1] ?? null;
+  if (!rest) return null;
+  const segments = rest.replace(/\/+$/, "").split("/");
+  if (segments.length !== 2) return null;
+  const owner = segments[0] ?? "";
+  const repo = (segments[1] ?? "").replace(/\.git$/i, "");
+  if (!OWNER_PATTERN.test(owner) || !repo || repo === "." || repo === ".." || !REPO_PATTERN.test(repo)) return null;
+  return { nameWithOwner: `${owner}/${repo}` };
+}
+function parseSshRemote(url) {
+  const trimmed = url.trim();
+  const ssh = /^ssh:\/\/(?:(\w[\w.-]*)@)?([A-Za-z0-9][A-Za-z0-9._-]*)(?::(\d+))?\/(.+)$/i.exec(trimmed);
+  const scp = /^(?:(\w[\w.-]*)@)?([A-Za-z0-9][A-Za-z0-9._-]*):(.+)$/.exec(trimmed);
+  const match = ssh ?? scp;
+  if (!match) return null;
+  const parsed = parseGitHubRemote(`https://github.com/${ssh ? match[4] : match[3]}`);
+  if (!parsed) return null;
+  return { destination: `${match[1] ? `${match[1]}@` : ""}${match[2]}`, port: ssh ? match[3] ?? null : null, ...parsed };
+}
+const GITHUB_LOGIN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
+function parseGitHubAuthStatus(raw) {
+  const input = JSON.parse(raw);
+  if (!input || typeof input !== "object" || !("hosts" in input) || !input.hosts || typeof input.hosts !== "object") throw new Error("Invalid gh status");
+  const entries = input.hosts["github.com"] ?? [];
+  if (!Array.isArray(entries) || entries.length > 100) throw new Error("Invalid gh accounts");
+  const accounts = [];
+  for (const entry of entries) {
+    if (!entry || typeof entry !== "object" || typeof entry.login !== "string" || !GITHUB_LOGIN.test(entry.login)) continue;
+    accounts.push({
+      host: "github.com",
+      login: entry.login,
+      active: entry.active === true,
+      state: entry.state === "success" ? "authenticated" : entry.state === "error" ? "invalid" : "unknown",
+      storage: entry.tokenSource === "keyring" ? "keyring" : typeof entry.tokenSource === "string" && (entry.tokenSource === "oauth_token" || /(?:^|[/\\])hosts\.yml$/.test(entry.tokenSource)) ? "file" : "unknown",
+      ...typeof entry.scopes === "string" && /^[A-Za-z0-9_:, -]{0,500}$/.test(entry.scopes) ? { scopes: entry.scopes } : {}
+    });
+  }
+  return { accounts, activeLogin: accounts.find((account) => account.active)?.login ?? null };
+}
+const GH_ENV = { GH_HOST: "github.com", GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1", GH_PAGER: "cat", NO_COLOR: "1" };
+const GH_PRIVATE_ENV = ["GITHUB_TOKEN", "GH_DEBUG", "DEBUG"];
+async function identifySshAccount(remote, runner) {
+  const ssh = parseSshRemote(remote);
+  if (!ssh) return null;
+  try {
+    const config2 = await runner.run("ssh", ["-G", ...ssh.port ? ["-p", ssh.port] : [], "--", ssh.destination], {
+      cwd: os.homedir(),
+      timeoutMs: 5e3,
+      maxOutputBytes: 64 * 1024
+    });
+    const hostname = config2.stdout.split(/\r?\n/).find((line) => /^hostname\s/i.test(line))?.trim().split(/\s+/)[1];
+    if (config2.exitCode !== 0 || hostname?.toLowerCase() !== "github.com") return null;
+    const result = await runner.run("ssh", [
+      "-T",
+      "-o",
+      "BatchMode=yes",
+      "-o",
+      "StrictHostKeyChecking=yes",
+      "-o",
+      "ConnectTimeout=5",
+      "-o",
+      "ConnectionAttempts=1",
+      "-o",
+      "RemoteCommand=none",
+      "-o",
+      "UpdateHostKeys=no",
+      ...ssh.port ? ["-p", ssh.port] : [],
+      "--",
+      ssh.destination
+    ], { cwd: os.homedir(), timeoutMs: 1e4, maxOutputBytes: 64 * 1024 });
+    if (result.exitCode !== 0 && result.exitCode !== 1) return null;
+    const login2 = /^Hi ([A-Za-z0-9-]+)! You've successfully authenticated, but GitHub does not provide shell access\.\s*$/m.exec(`${result.stdout}
+${result.stderr}`)?.[1];
+    return login2 && GITHUB_LOGIN.test(login2) ? login2 : null;
+  } catch {
+    return null;
+  }
+}
+async function accountAuthentication(login2, executable, runner, operation) {
+  try {
+    const result = await runner.run(executable.executable, ["auth", "token", "--hostname", "github.com", ...login2 ? ["--user", login2] : []], {
+      cwd: os.homedir(),
+      env: { ...executable.env, ...GH_ENV },
+      removeEnv: login2 ? ["GH_TOKEN", ...GH_PRIVATE_ENV] : ["GH_DEBUG", "DEBUG"],
+      timeoutMs: 1e4,
+      maxOutputBytes: 8 * 1024
+    });
+    const token = result.stdout.trim();
+    if (result.exitCode === 0 && /^[A-Za-z0-9_]{20,4096}$/.test(token)) return { env: { GH_TOKEN: token }, removeEnv: GH_PRIVATE_ENV };
+    if (/unknown flag.*user/i.test(result.stderr)) throw new GhOperationError({
+      code: "GH_CLI_INCOMPATIBLE",
+      operation,
+      message: "Update GitHub CLI to a version supporting multiple accounts and auth token --user."
+    });
+  } catch (error) {
+    if (error instanceof GhOperationError) throw error;
+  }
+  throw new GhOperationError({
+    code: login2 ? "GH_ACCOUNT_MISSING" : "GH_AUTH_REQUIRED",
+    operation,
+    message: login2 ? `GitHub CLI has no usable saved credentials for @${login2}. Sign in as ${login2} on the backend host and check Settings → GitHub again. SSH and GitHub CLI authentication are separate.` : "GitHub CLI has no usable credentials. Sign in on the backend host and check Settings → GitHub again."
+  });
+}
+function redactCommandToken(value, auth) {
+  const token = auth.env?.GH_TOKEN;
+  return token ? value.split(token).join("[redacted]") : value;
+}
+function gitShellQuote(value) {
+  return `'${value.replace(/\\/g, "/").replace(/'/g, `'\\''`)}'`;
+}
+function managedGitHubPath(value) {
+  try {
+    const url = new URL(value);
+    if (!/^https:\/\/github\.com\//i.test(value) || url.protocol !== "https:" || url.hostname !== "github.com" || url.port || url.username || url.password || url.search || url.hash) return null;
+    if (!/^\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(url.pathname)) return null;
+    return url.pathname.slice(1);
+  } catch {
+    return null;
+  }
+}
+async function createCredentialBroker(url, login2, token) {
+  const allowedPath = managedGitHubPath(url);
+  if (!allowedPath) throw new Error("Managed authentication requires one plain github.com HTTPS repository URL.");
+  const directory = await mkdtemp(path.join(os.tmpdir(), "opentig-git-auth-"));
+  const key = randomBytes(32).toString("hex");
+  const server = createServer$1((request, response) => {
+    response.setHeader("Connection", "close");
+    if (request.method !== "POST" || request.url !== "/" || request.headers["x-opentig-key"] !== key) {
+      response.writeHead(403).end();
+      return;
+    }
+    let body = "";
+    request.setTimeout(5e3, () => request.destroy());
+    request.on("data", (data) => {
+      body += data.toString("utf8");
+      if (body.length > 8192) request.destroy();
+    });
+    request.on("end", () => {
+      const fields = body.trim().split("\n").map((line) => line.replace(/\r$/, "").split(/=(.*)/s));
+      const value = Object.fromEntries(fields.map(([name, field]) => [name, field]));
+      const unique = ["protocol", "host", "path"].every((name) => fields.filter(([key2]) => key2 === name).length === 1);
+      if (!unique || value.protocol !== "https" || value.host !== "github.com" || value.path !== allowedPath) {
+        response.writeHead(403).end();
+        return;
+      }
+      response.end(`username=${login2}
+password=${token}
+
+`);
+    });
+  });
+  const dispose = async () => {
+    server.closeAllConnections();
+    if (server.listening) await new Promise((resolve2) => server.close(() => resolve2()));
+    await rm(directory, { recursive: true, force: true });
+  };
+  try {
+    server.listen(0, "127.0.0.1");
+    await once(server, "listening");
+    const port = server.address().port;
+    const headers = path.join(directory, "headers");
+    const helper = path.join(directory, "helper.sh");
+    await writeFile(headers, `X-OpenTig-Key: ${key}
+`, { mode: 384 });
+    await writeFile(helper, `#!/bin/sh
+[ "$1" = get ] || exit 0
+curl --disable --silent --fail --noproxy '*' --max-time 10 --proto '=http' --header @${gitShellQuote(headers)} --data-binary @- http://127.0.0.1:${port}/ || exit 1
+`, { mode: 448 });
+    return { helper: `!sh ${gitShellQuote(helper)}`, directory, dispose };
+  } catch (error) {
+    await dispose();
+    throw error;
+  }
+}
+const read$1 = { operation: "repository-access", readOnly: true, maxOutputBytes: 1024 * 1024 };
+const unchecked = () => ({ state: "unchecked" });
+const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+class RepositoryGitAccess {
+  constructor(git, repositories, accounts, runner) {
+    this.git = git;
+    this.repositories = repositories;
+    this.accounts = accounts;
+    this.runner = runner;
+  }
+  git;
+  repositories;
+  accounts;
+  runner;
+  sessions = new AsyncLocalStorage();
+  checks = /* @__PURE__ */ new Map();
+  latest = /* @__PURE__ */ new Map();
+  install() {
+    this.git.network = (cwd, args, options, execute) => this.scope(cwd, () => this.execute(args, options, execute));
+    this.git.authenticationKey = (cwd) => {
+      const repository = this.repositories.recents().find((item) => item.path === cwd);
+      return repository ? digest([this.accounts.selection(repository), this.accounts.revisionFor(repository)]) : "";
+    };
+    this.git.networkScope = (cwd, task) => this.scope(cwd, task);
+  }
+  async scope(cwd, task) {
+    if (this.sessions.getStore()?.repository.path === cwd) return task();
+    const repository = this.repositories.recents().find((item) => item.path === cwd);
+    if (!repository) throw new Error("The repository must be open before remote operations.");
+    return this.sessions.run({ repository, selection: this.accounts.selection(repository), revision: this.accounts.revisionFor(repository) }, task);
+  }
+  async config(repository, key, all = false) {
+    try {
+      return (await this.git.run(repository.path, ["config", all ? "--get-all" : "--get", key], read$1)).stdout.toString("utf8").trim();
+    } catch (error) {
+      if (error instanceof GitOperationError && error.detail.exitCode === 1) return "";
+      throw error;
+    }
+  }
+  async resolve(repository, push, selected) {
+    const branch = (await this.git.run(repository.path, ["branch", "--show-current"], read$1)).stdout.toString("utf8").trim() || null;
+    const remotes = (await this.git.run(repository.path, ["remote"], read$1)).stdout.toString("utf8").trim().split(/\r?\n/).filter(Boolean);
+    let remote = selected;
+    if (!remote) for (const key of [...push ? [`branch.${branch}.pushRemote`, "remote.pushDefault"] : [], `branch.${branch}.remote`]) {
+      remote = await this.config(repository, key);
+      if (remote) break;
+    }
+    if (!remote && !push && remotes.includes("origin")) remote = "origin";
+    remote ||= remotes.length === 1 ? remotes[0] : void 0;
+    let urls = [];
+    if (remote === ".") urls = ["."];
+    else if (remote && remotes.includes(remote)) urls = (await this.git.run(repository.path, ["remote", "get-url", ...push ? ["--push", "--all"] : [], "--", remote], read$1)).stdout.toString("utf8").trim().split(/\r?\n/).filter(Boolean);
+    else if (selected && !remotes.includes(selected)) {
+      urls = [(await this.git.run(repository.path, ["ls-remote", "--get-url", "--", selected], { ...read$1, operation: "resolve-git-url" })).stdout.toString("utf8").trim()];
+    }
+    return { branch, remotes, remote: remote ?? null, urls };
+  }
+  async publication(repositoryId, selected) {
+    const repository = this.repositories.get(repositoryId);
+    const selection = this.accounts.selection(repository);
+    const revision2 = this.accounts.revisionFor(repository);
+    const target = await this.resolve(repository, true, selected);
+    let oid = null;
+    try {
+      oid = (await this.git.run(repository.path, ["rev-parse", "--verify", "HEAD"], read$1)).stdout.toString("utf8").trim();
+    } catch {
+    }
+    const managed = selection.mode === "account" && selection.gitMode === "managed";
+    const compatible = target.urls.length === 1 && !!managedGitHubPath(target.urls[0]);
+    const configuration = (await this.git.run(repository.path, ["config", "--null", "--list"], read$1)).stdout.toString("utf8");
+    const upstreamRemote = await this.config(repository, `branch.${target.branch}.remote`);
+    const merge2 = await this.config(repository, `branch.${target.branch}.merge`, true);
+    const pushDefault = await this.config(repository, "push.default") || "simple";
+    const targetRef = target.branch ? target.remote === upstreamRemote && merge2 && ["simple", "upstream"].includes(pushDefault) ? merge2 : `refs/heads/${target.branch}` : null;
+    const unsafe = merge2 && (merge2.includes("\n") || !["simple", "upstream", "current"].includes(pushDefault) || pushDefault === "simple" && target.remote === upstreamRemote && merge2 !== `refs/heads/${target.branch}` || pushDefault === "upstream" && target.remote !== upstreamRemote || await this.config(repository, `remote.${target.remote}.push`) || await this.config(repository, `remote.${target.remote}.mirror`) === "true");
+    const blocked = selected && selected !== "." && !target.remotes.includes(selected) ? "The selected push remote is not configured. Review the repository remotes." : unsafe ? "The push refspec, mirror or push.default configuration requires review in Git before publishing." : target.urls.length > 1 ? "This remote has multiple push URLs. Choose a single destination in Git configuration before publishing." : target.remote && !target.urls.length ? "The configured push remote is unavailable." : managed && target.urls.some(isGitHubHttp) && !compatible ? "Managed Git requires a plain github.com HTTPS destination. Review the URL or use external authentication." : void 0;
+    return {
+      ...target,
+      urls: target.urls.map(redactSensitiveText),
+      repositoryId,
+      oid,
+      targetRef,
+      id: digest([repository.commonDir, selection, revision2, target, oid, configuration]),
+      mode: managed && compatible ? "managed" : "external",
+      login: managed && compatible && selection.mode === "account" ? selection.login : null,
+      ...blocked ? { blocked } : {}
+    };
+  }
+  async assertPublication(repositoryId, expected, remote) {
+    const current = await this.publication(repositoryId, remote);
+    if (expected && expected !== current.id) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "push", message: "The account, branch or destination changed. Review the publication context and try again." });
+    if (current.blocked) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "push", message: current.blocked });
+    return current;
+  }
+  async status(repositoryId, force = false, apiContext) {
+    const publication = await this.publication(repositoryId);
+    const repository = this.repositories.get(repositoryId);
+    const previous = this.checks.get(repositoryId);
+    const value = previous?.publication.id === publication.id ? structuredClone(previous) : {
+      publication,
+      identity: unchecked(),
+      api: unchecked(),
+      read: publication.mode === "external" ? { state: "external" } : unchecked(),
+      write: unchecked(),
+      checkedAt: null
+    };
+    const last = this.latest.get(repositoryId);
+    if (last) value.lastOperation = last;
+    if (!force) {
+      if (value.checkedAt && Date.now() - Date.parse(value.checkedAt) > 6e4) for (const key of ["identity", "api", "read", "write"]) {
+        if (value[key].state === "ok") value[key] = { state: "stale", message: value[key].message ?? "Check access again for a current result." };
+      }
+      return value;
+    }
+    value.identity = unchecked();
+    value.api = unchecked();
+    value.write = unchecked();
+    value.read = publication.mode === "external" ? { state: "external" } : unchecked();
+    const selection = this.accounts.selection(repository);
+    if (selection.mode !== "account") {
+      value.identity = { state: "unchecked", message: "Choose a saved account to pin access for this repository." };
+    } else {
+      try {
+        this.accounts.refreshAuthentication();
+        const { auth, executable } = await this.accounts.authenticate(repository, apiContext?.remote ?? "", apiContext?.nameWithOwner ?? "", "repository-access");
+        value.identity = { state: "ok" };
+        const origin = await this.resolve(repository, false, "origin");
+        const apiUrl = origin.urls[0] ?? "";
+        const apiPath = apiContext?.nameWithOwner ?? managedGitHubPath(apiUrl) ?? /^git@github\.com:([\w.-]+\/[\w.-]+)$/.exec(apiUrl)?.[1];
+        const checkApi = async (name) => {
+          try {
+            const result = await this.runner.run(executable.executable, ["api", `repos/${name.replace(/\.git$/, "")}`], {
+              cwd: repository.path,
+              env: { ...executable.env, ...GH_ENV, ...auth.env },
+              ...auth.removeEnv ? { removeEnv: auth.removeEnv } : {},
+              timeoutMs: 15e3,
+              maxOutputBytes: 128 * 1024
+            });
+            if (result.exitCode !== 0) {
+              const check = accessError(redactCommandToken(result.stderr, auth));
+              return { check, write: check };
+            }
+            const data = JSON.parse(result.stdout);
+            return { check: { state: "ok" }, write: typeof data.permissions?.push === "boolean" ? { state: data.permissions.push ? "ok" : "inaccessible", message: data.permissions.push ? "Write permission declared by GitHub; branch policies still apply." : "GitHub does not declare write permission." } : unchecked() };
+          } catch (error) {
+            const check = accessError(redactCommandToken(messageOf(error), auth));
+            return { check, write: check };
+          }
+        };
+        if (apiPath) value.api = (await checkApi(apiPath)).check;
+        const destination = publication.urls[0];
+        const pushPath = destination && managedGitHubPath(destination);
+        if (pushPath) value.write = (await checkApi(pushPath)).write;
+        if (publication.mode === "managed" && destination && !publication.blocked) {
+          try {
+            await this.git.withNetworkContext(repository.path, () => this.git.run(repository.path, ["ls-remote", "--", destination, "HEAD"], { ...read$1, timeoutMs: 3e4 }));
+            value.read = { state: "ok", message: "Read verified at the push destination. This does not guarantee a push." };
+          } catch (error) {
+            value.read = accessError(messageOf(error));
+          }
+        }
+      } catch (error) {
+        if (value.identity.state === "ok") value.api = accessError(messageOf(error));
+        else value.identity = accessError(messageOf(error));
+      }
+    }
+    if ((await this.publication(repositoryId)).id !== publication.id) return this.status(repositoryId, false, apiContext);
+    value.checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.checks.set(repositoryId, value);
+    return value;
+  }
+  async execute(args, options, execute) {
+    const session = this.sessions.getStore();
+    const { repository, selection } = session;
+    let index = 0;
+    while (args[index] === "-c") index += 2;
+    const command2 = args[index];
+    if (command2 === "ls-remote" && args.includes("--get-url")) return execute(args, options);
+    const selected = args.slice(index + 1).find((arg) => !arg.startsWith("-"));
+    const target = await this.resolve(repository, command2 === "push", selected);
+    if (target.urls.length !== 1) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: options.operation, message: "The remote destination is ambiguous. Configure or choose a single remote URL." });
+    const url = target.urls[0];
+    if (selected?.includes("://") && selected !== url) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: options.operation, message: "URL rewriting changes the reviewed destination again. Resolve the chained rewrite before checking or publishing." });
+    const managed = selection.mode === "account" && selection.gitMode === "managed" && isGitHubHttp(url);
+    let broker;
+    let token = "";
+    try {
+      if (managed) {
+        if (!managedGitHubPath(url)) throw new Error("Managed Git cannot send credentials to this destination. Use external authentication for unsupported URLs.");
+        if (!session.auth) {
+          if (session.revision !== this.accounts.revisionFor(repository)) throw new Error("The repository account changed before the operation started. Review and retry.");
+          session.auth = await this.accounts.authenticate(repository, url, managedGitHubPath(url), options.operation);
+          if (session.revision !== this.accounts.revisionFor(repository) || digest(session.auth.context.selection) !== digest(selection)) throw new Error("The repository account changed before authentication completed. Review and retry.");
+        }
+        if (command2 === "fetch" && !selected && target.remote) args = [...args, "--", target.remote];
+        token = session.auth.auth.env?.GH_TOKEN ?? "";
+        broker = await createCredentialBroker(url, selection.login, token);
+        const config2 = (await this.git.run(repository.path, ["config", "--name-only", "--list"], read$1)).stdout.toString("utf8").trim().split(/\r?\n/);
+        const overrides = [...new Set(config2)].flatMap((key) => {
+          if (/^credential\..*helper$/i.test(key)) return ["-c", `${key}=`];
+          if (/^http\..*extraheader$/i.test(key)) return ["-c", `${key}=`];
+          if (/^http\..*followredirects$/i.test(key)) return ["-c", `${key}=false`];
+          if (/^http\..*sslverify$/i.test(key)) return ["-c", `${key}=true`];
+          if (/^credential\..*usehttppath$/i.test(key)) return ["-c", `${key}=true`];
+          return [];
+        });
+        args = [
+          ...overrides,
+          "-c",
+          "credential.helper=",
+          "-c",
+          `credential.helper=${broker.helper}`,
+          "-c",
+          "credential.useHttpPath=true",
+          "-c",
+          "core.askPass=",
+          "-c",
+          "http.extraHeader=",
+          "-c",
+          "http.followRedirects=false",
+          "-c",
+          "http.sslVerify=true",
+          "-c",
+          "fetch.recurseSubmodules=false",
+          "-c",
+          "push.recurseSubmodules=no",
+          ...args
+        ];
+      }
+      if (options.publication) await this.assertPublication(options.publication.repositoryId, options.publication.id, options.publication.remote);
+      const result = await execute(args, { ...options, ...managed ? { managed: true, managedSecrets: [token] } : {} });
+      this.latest.set(repository.id, { operation: options.operation, url: redactSensitiveText(url), login: managed && selection.mode === "account" ? selection.login : null, at: (/* @__PURE__ */ new Date()).toISOString(), ok: true });
+      return result;
+    } catch (error) {
+      const message = redactSensitiveText(token ? messageOf(error).split(token).join("[redacted]") : messageOf(error));
+      this.latest.set(repository.id, { operation: options.operation, url: redactSensitiveText(url), login: managed && selection.mode === "account" ? selection.login : null, at: (/* @__PURE__ */ new Date()).toISOString(), ok: false, message });
+      if (error instanceof GitOperationError) throw error;
+      throw new GitOperationError({ code: "UNKNOWN", operation: options.operation, message });
+    } finally {
+      await broker?.dispose();
+    }
+  }
+}
+function messageOf(error) {
+  return error instanceof Error ? error.message : "Could not check remote access.";
+}
+function accessError(message) {
+  return { state: /401|bad credentials|expired|revoked|no usable saved credentials/i.test(message) ? "expired" : /404|403|not found|denied|not accessible/i.test(message) ? "inaccessible" : "offline", message: redactSensitiveText(message).slice(0, 1500) };
+}
+function isGitHubHttp(value) {
+  try {
+    const url = new URL(value);
+    return ["http:", "https:"].includes(url.protocol) && url.hostname === "github.com";
+  } catch {
+    return false;
+  }
+}
 function normalizeLockKey(value) {
   const unified = value.replace(/\\/g, "/").replace(/\/+$/, "");
   return process.platform === "win32" ? unified.toLowerCase() : unified;
@@ -14689,7 +15290,21 @@ class GitProcess {
   activeControllers = /* @__PURE__ */ new Set();
   idleWaiters = /* @__PURE__ */ new Set();
   closePromise = null;
+  authenticationKey;
+  network;
+  networkScope;
+  withNetworkContext(cwd, task) {
+    return this.networkScope ? this.networkScope(cwd, task) : task();
+  }
   run(cwd, args, options) {
+    let index = 0;
+    while (args[index] === "-c") index += 2;
+    if (this.network && ["fetch", "push", "ls-remote"].includes(args[index] ?? "")) {
+      return this.network(cwd, args, options, (next, settings) => this.runDirect(cwd, next, settings));
+    }
+    return this.runDirect(cwd, args, options);
+  }
+  runDirect(cwd, args, options) {
     const globalArgs = ["--no-pager"];
     if (options.readOnly) globalArgs.push("--no-optional-locks");
     return this.spawnGit(cwd, [...globalArgs, ...args], options);
@@ -14745,6 +15360,10 @@ class GitProcess {
         LC_ALL: "C"
       }).filter((entry) => entry[1] !== void 0)
     );
+    if (options.managed) for (const key of Object.keys(environment)) {
+      if (/^(GH_TOKEN|GITHUB_TOKEN|GH_DEBUG|SSLKEYLOGFILE|GIT_SSL_NO_VERIFY|GIT_ASKPASS|SSH_ASKPASS|GIT_CONFIG.*|GIT_TRACE.*|GIT_CURL_VERBOSE)$/i.test(key)) delete environment[key];
+    }
+    const sanitize = (value) => redactSensitiveText((options.managedSecrets ?? []).reduce((text2, secret) => text2.split(secret).join("[redacted]"), value));
     const resolvedCommand = resolveProcessCommand("git", cwd, environment);
     const outputLimit = new AbortController();
     const lifecycle = new AbortController();
@@ -14784,8 +15403,8 @@ class GitProcess {
       childPid = subprocess.pid;
       if (childPid) this.activeChildren.add(childPid);
       const result = await subprocess;
-      const stdout = Buffer.from(result.stdout);
-      const stderr = Buffer.from(result.stderr);
+      const stdout = options.managed ? Buffer.from(sanitize(Buffer.from(result.stdout).toString("utf8"))) : Buffer.from(result.stdout);
+      const stderr = Buffer.from(sanitize(Buffer.from(result.stderr).toString("utf8")));
       if (overLimit || result.isMaxBuffer) {
         if (options.truncateOverflow) return { stdout, stderr, exitCode: 0, truncated: true };
         throw new GitOperationError({ code: "OUTPUT_LIMIT", operation: options.operation, message: "Git output exceeded the safety limit." });
@@ -14796,11 +15415,11 @@ class GitProcess {
       if (result.exitCode === void 0 || !resolvedCommand.found) {
         throw this.mapError(options.operation, Object.assign(new Error("Git was not found in PATH."), { code: "ENOENT" }));
       }
-      if (result.exitCode !== 0) throw this.fromExit(options.operation, result.exitCode, stderr.toString("utf8"));
+      if (result.exitCode !== 0) throw this.fromExit(options.operation, result.exitCode, sanitize(`${stderr.toString("utf8")}${options.operation.includes("push") || options.operation === "publish-branch" ? "\n" + stdout.toString("utf8") : ""}`));
       return { stdout, stderr, exitCode: result.exitCode };
     } catch (error) {
       if (error instanceof GitOperationError) throw error;
-      throw this.mapError(options.operation, error);
+      throw this.mapError(options.operation, Object.assign(new Error(sanitize(error instanceof Error ? error.message : "Could not start Git.")), { code: error?.code }));
     } finally {
       if (childPid) this.activeChildren.delete(childPid);
       this.activeControllers.delete(lifecycle);
@@ -15140,47 +15759,381 @@ function parseWorktrees(buffer) {
   if (current) worktrees.push(current);
   return worktrees;
 }
-const AI_PATCH_BUDGET = 4e5;
-const AI_SUMMARY_BUDGET = 24e3;
-class GitRepositoryOperations {
-  constructor(git, repositories, files) {
+const commitAuthorshipInputSchema = object({
+  name: string().trim().min(1).max(120).regex(/^[^<>]+$/).refine(noControls),
+  email: string().trim().max(254).regex(/^[^\s<>@]+@[^\s<>@]+$/).refine(noControls),
+  expectedRevision: string().regex(/^[a-f0-9]{64}$/)
+});
+function noControls(value) {
+  return [...value].every((character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127);
+}
+const environmentKeys = ["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL", "EMAIL"];
+const identityPattern = "^(user|author|committer)\\.(name|email)$";
+class GitCommitAuthorship {
+  constructor(git, repositories) {
     this.git = git;
     this.repositories = repositories;
-    this.files = files;
   }
   git;
   repositories;
-  files;
-  knownOids = /* @__PURE__ */ new Map();
-  async diff(request) {
-    const repository = this.repositories.get(request.repositoryId);
-    const paths = this.repositories.validatePaths(request.repositoryId, [request.path]);
-    const tracked = (await this.git.run(
-      repository.path,
-      ["--literal-pathspecs", "ls-files", "-z", "--", ...paths],
-      { operation: "diff-tracked-check", readOnly: true, maxOutputBytes: 1024 * 1024 }
-    )).stdout.length > 0;
-    if (request.kind === "unstaged" && !tracked) return this.untrackedDiff(request.repositoryId, request.path);
-    const args = ["--literal-pathspecs", "diff"];
-    if (request.kind === "staged") args.push("--cached");
-    args.push("--no-color", "--no-ext-diff", "--unified=3", "--", ...paths);
-    const output = await this.git.run(repository.path, args, { operation: `diff-${request.kind}`, readOnly: true, maxOutputBytes: 32 * 1024 * 1024 });
-    return makeDiffResult(request.path, output.stdout);
-  }
-  async commitDiff(repositoryId, oid) {
-    this.assertKnownOid(repositoryId, oid);
+  revisionKey = randomBytes(32);
+  async get(repositoryId) {
     const repository = this.repositories.get(repositoryId);
-    const output = await this.git.run(repository.path, ["show", "--format=", "--no-color", "--no-ext-diff", oid, "--"], { operation: "commit-diff", readOnly: true, maxOutputBytes: 32 * 1024 * 1024 });
-    return makeDiffResult(oid, output.stdout);
+    return this.git.runWriteTask(repository.path, () => this.read(repositoryId), repository.commonDir);
   }
-  async commitFiles(repositoryId, oid) {
-    this.assertKnownOid(repositoryId, oid);
+  async set(repositoryId, input) {
+    const parsed = commitAuthorshipInputSchema.safeParse(input);
+    if (!parsed.success) throw invalid$1("Enter a valid name, email and reviewed identity.");
+    const { name, email: email2, expectedRevision } = parsed.data;
     const repository = this.repositories.get(repositoryId);
-    const common2 = ["show", "--format=", "--no-color", "--no-ext-diff", "-M", "-z"];
-    const [nameStatus, numstat] = await Promise.all([
-      this.git.run(repository.path, [...common2, "--name-status", oid, "--"], { operation: "commit-files", readOnly: true, maxOutputBytes: 8 * 1024 * 1024 }),
-      this.git.run(repository.path, [...common2, "--numstat", oid, "--"], { operation: "commit-files", readOnly: true, maxOutputBytes: 8 * 1024 * 1024 })
-    ]);
+    const configPath = path.join(repository.commonDir, "config");
+    const lockPath = `${configPath}.lock`;
+    return this.git.runWriteTask(repository.path, async (run) => {
+      const current = await this.read(repositoryId);
+      if (!current.editable) throw invalid$1(current.blockers.join(" "));
+      if (current.revision !== expectedRevision) throw invalid$1("Git identity or repository settings changed. Reopen the editor and review them again.");
+      let locked = false;
+      try {
+        const file = await open(lockPath, "wx", 384);
+        locked = true;
+        try {
+          await file.writeFile(await readFile(configPath));
+        } finally {
+          await file.close();
+        }
+        const reviewed = await this.read(repositoryId);
+        if (!reviewed.editable || reviewed.revision !== expectedRevision) throw invalid$1("Git settings changed before saving. Reopen the editor and review them again.");
+        const mode = (await lstat(configPath)).mode & 511;
+        await run(["config", "--file", lockPath, "--replace-all", "--", "user.name", name], { operation: "commit-authorship-set" });
+        await run(["config", "--file", lockPath, "--replace-all", "--", "user.email", email2], { operation: "commit-authorship-set" });
+        const candidate = await this.identities(repository.path, ["-c", `include.path=${lockPath}`]);
+        if (candidate.author?.name !== name || candidate.author.email !== email2 || candidate.committer?.name !== name || candidate.committer.email !== email2) {
+          throw invalid$1("An included Git setting overrides this identity. Edit that setting outside OpenTig before applying a repository identity.");
+        }
+        const latest = await this.read(repositoryId);
+        if (!latest.editable || latest.revision !== expectedRevision) throw invalid$1("Git settings changed while saving. Reopen the editor and review them again.");
+        await chmod(lockPath, mode);
+        await rename(lockPath, configPath);
+        locked = false;
+      } catch (error) {
+        if (error.code === "EEXIST") {
+          throw invalid$1("Another Git process is editing repository settings. Wait for it to finish and try again.");
+        }
+        throw error;
+      } finally {
+        if (locked) await rm(lockPath, { force: true });
+      }
+      return this.read(repositoryId);
+    }, repository.commonDir);
+  }
+  async read(repositoryId) {
+    const repository = this.repositories.get(repositoryId);
+    const configPath = path.join(repository.commonDir, "config");
+    const [entries, identities, config2, info] = await Promise.all([
+      this.config(repository.path),
+      this.identities(repository.path),
+      readFile(configPath),
+      lstat(configPath)
+    ]);
+    const environment = environmentKeys.filter((key) => process.env[key] !== void 0);
+    const custom = entries.some((entry) => entry.key.startsWith("author.") || entry.key.startsWith("committer."));
+    const worktree = entries.some((entry) => entry.scope === "worktree");
+    const command2 = entries.some((entry) => entry.scope === "command");
+    const blockers = [];
+    if (environment.length) blockers.push("Backend environment variables override Git identity. Manage them outside OpenTig before editing repository authorship.");
+    if (custom) blockers.push("Git author.* or committer.* settings override user.name/email. Manage those settings outside OpenTig first.");
+    if (worktree) blockers.push("This worktree has its own identity. Manage its worktree settings outside OpenTig first.");
+    if (command2) blockers.push("Backend command configuration overrides Git identity. Manage it outside OpenTig first.");
+    if (!info.isFile() || info.nlink !== 1) blockers.push("The repository config is linked or shared. Edit it outside OpenTig to avoid changing another repository.");
+    const scopes = ["user.name", "user.email"].map((key) => entries.filter((entry) => entry.key === key).at(-1)?.scope ?? "inferred");
+    const source = environment.length || command2 ? "environment" : custom ? "custom" : worktree ? "worktree" : !identities.author ? "unset" : scopes[0] !== scopes[1] ? "mixed" : scopes[0] === "local" || scopes[0] === "global" || scopes[0] === "system" ? scopes[0] : "inferred";
+    const revision2 = createHmac("sha256", this.revisionKey).update(repository.path).update(config2).update(JSON.stringify({ entries, identities, environment, mode: info.mode, linked: info.nlink, blockers })).digest("hex");
+    return { ...identities, source, editable: blockers.length === 0, blockers, revision: revision2 };
+  }
+  async config(cwd) {
+    try {
+      const output = await this.git.run(cwd, ["config", "--null", "--show-scope", "--get-regexp", identityPattern], { operation: "commit-authorship-read", readOnly: true });
+      const fields = output.stdout.toString("utf8").split("\0");
+      const entries = [];
+      for (let index = 0; index + 1 < fields.length; index += 2) {
+        const field = fields[index + 1];
+        const separator = field.indexOf("\n");
+        if (separator >= 0) entries.push({ scope: fields[index], key: field.slice(0, separator), value: field.slice(separator + 1) });
+      }
+      return entries;
+    } catch (error) {
+      if (error instanceof GitOperationError && error.detail.exitCode === 1) return [];
+      throw error;
+    }
+  }
+  async identities(cwd, prefix = []) {
+    const [author, committer] = await Promise.all(["GIT_AUTHOR_IDENT", "GIT_COMMITTER_IDENT"].map(async (variable) => {
+      try {
+        const output = await this.git.run(cwd, [...prefix, "var", variable], { operation: "commit-authorship-read", readOnly: true });
+        const match = /^(.*?) <([^<>]*)> \d+ [+-]\d{4}$/.exec(output.stdout.toString("utf8").trim());
+        if (!match) throw invalid$1("Git returned an unreadable commit identity.");
+        return { name: match[1], email: match[2] };
+      } catch (error) {
+        if (error instanceof GitOperationError && error.detail.exitCode === 128 && /identity unknown|unable to auto-detect|empty ident|no email was given|no name was given/i.test(error.detail.stderr ?? "")) return null;
+        throw error;
+      }
+    }));
+    return { author, committer };
+  }
+}
+function invalid$1(message) {
+  return new GitOperationError({ code: "INVALID_ARGUMENT", operation: "commit-authorship-set", message });
+}
+const read = { operation: "remote-branches", readOnly: true, maxOutputBytes: 4 * 1024 * 1024 };
+const network = { ...read, timeoutMs: 6e4 };
+class GitRemoteBranches {
+  constructor(git, repositories) {
+    this.git = git;
+    this.repositories = repositories;
+  }
+  git;
+  repositories;
+  reader(root) {
+    return (args, options) => this.git.run(root, args, options);
+  }
+  async remotes(run) {
+    const names = (await run(["remote"], read)).stdout.toString("utf8").trim().split(/\r?\n/).filter(Boolean);
+    return Promise.all(names.map(async (name) => ({ name, refspecs: (await this.config(run, `remote.${name}.fetch`)).split(/\r?\n/).filter(Boolean) })));
+  }
+  async config(run, key) {
+    try {
+      return (await run(["config", "--get-all", key], read)).stdout.toString("utf8").trim();
+    } catch (error) {
+      if (error instanceof GitOperationError && error.detail.exitCode === 1) return "";
+      throw error;
+    }
+  }
+  mappings(fullName, remotes) {
+    return remotes.flatMap((remote) => remote.refspecs.flatMap((spec) => {
+      if (spec.startsWith("^")) return [];
+      const [source, destination] = spec.replace(/^\+/, "").split(":");
+      if (!source?.startsWith("refs/heads/") || !destination?.startsWith("refs/remotes/")) return [];
+      const match = refspecMatch(destination, fullName);
+      if (match === null) return [];
+      const sourceRef = source.replace("*", match);
+      if (remote.refspecs.some((excluded) => excluded.startsWith("^") && refspecMatch(excluded.slice(1), sourceRef) !== null)) return [];
+      return [{ remote: remote.name, sourceRef }];
+    }));
+  }
+  async snapshotBranches(repositoryId, branches) {
+    const root = this.repositories.get(repositoryId).path;
+    const run = this.reader(root);
+    const remotes = await this.remotes(run);
+    const aliases = new Set((await run(["for-each-ref", "--format=%(refname)%09%(symref)", "refs/remotes"], read)).stdout.toString("utf8").split(/\r?\n/).filter((line) => line.split("	")[1]).map((line) => line.split("	")[0]));
+    return { remotes: remotes.map((remote) => remote.name), branches: branches.filter((branch) => !aliases.has(branch.fullName)).map((branch) => {
+      if (!branch.remote) return branch;
+      const mappings = this.mappings(branch.fullName, remotes);
+      if (mappings.length !== 1) return branch;
+      return { ...branch, remoteName: mappings[0].remote, remoteBranchName: mappings[0].sourceRef.slice("refs/heads/".length) };
+    }) };
+  }
+  async target(fullName, run) {
+    const branches = parseRefs((await run(["for-each-ref", `--format=${REF_FORMAT}`, "refs/remotes"], read)).stdout);
+    const branch = branches.find((item) => item.fullName === fullName);
+    if (!branch) return null;
+    const aliases = (await run(["for-each-ref", "--format=%(refname)%09%(symref)", fullName], read)).stdout.toString("utf8").split(/\r?\n/).some((line) => line.split("	")[0] === fullName && Boolean(line.split("	")[1]));
+    const mappings = this.mappings(fullName, await this.remotes(run));
+    if (aliases || mappings.length !== 1) throw new GitOperationError({
+      code: "INVALID_ARGUMENT",
+      operation: "remote-branch",
+      message: "This reference does not map to one configured remote branch. Check the remote fetch settings."
+    });
+    return { branch, ...mappings[0], branchName: mappings[0].sourceRef.slice("refs/heads/".length) };
+  }
+  async destination(target, run, root) {
+    const fetchUrls = (await run(["remote", "get-url", "--all", "--", target.remote], read)).stdout.toString("utf8").trim().split(/\r?\n/);
+    const pushUrls = (await run(["remote", "get-url", "--push", "--all", "--", target.remote], read)).stdout.toString("utf8").trim().split(/\r?\n/);
+    const id = createHash("sha256").update(JSON.stringify([target.remote, target.sourceRef, fetchUrls, pushUrls, this.git.authenticationKey?.(root)])).digest("hex");
+    const blocked = fetchUrls.length !== 1 || pushUrls.length !== 1 || fetchUrls[0] !== pushUrls[0] ? "Fetch and push destinations differ or have multiple URLs. Manage remote deletion outside OpenTig." : null;
+    return { id, blocked, url: fetchUrls[0] };
+  }
+  async advertised(target, run, url) {
+    const lines = (await run(["ls-remote", "--symref", "--", url, "HEAD", target.sourceRef], network)).stdout.toString("utf8").split(/\r?\n/);
+    const defaultRef = lines.find((line) => line.startsWith("ref: refs/heads/") && line.endsWith("	HEAD"))?.split("	")[0]?.slice(5) ?? null;
+    const oid = lines.find((line) => line.split("	")[1] === target.sourceRef)?.split("	")[0] ?? null;
+    return { defaultRef, oid };
+  }
+  async details(repositoryId, fullName) {
+    const run = this.reader(this.repositories.get(repositoryId).path);
+    const target = await this.target(fullName, run);
+    if (!target) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "remote-branch-details", message: "The remote reference no longer exists. Fetch branches again." });
+    const destination = await this.destination(target, run, this.repositories.get(repositoryId).path);
+    let blocked = destination.blocked;
+    let defaultRef = null;
+    let remoteState = "unchecked";
+    if (!blocked) {
+      try {
+        const state = await this.advertised(target, run, destination.url);
+        defaultRef = state.defaultRef;
+        remoteState = !state.oid ? "missing" : state.oid === target.branch.oid ? "current" : "changed";
+        blocked = !state.oid ? "The branch no longer exists on the remote. Fetch to remove the obsolete reference." : state.oid !== target.branch.oid ? "The remote branch changed since the last fetch. Fetch before deleting." : !state.defaultRef ? "The remote does not identify its default branch. Deletion is unavailable here." : state.defaultRef === target.sourceRef ? "This is the remote’s default branch and cannot be deleted here." : null;
+      } catch {
+        blocked = "Could not check the remote. Fetch again or check your connection and Git permissions.";
+      }
+    }
+    const upstreams = (await run(["for-each-ref", "--format=%(refname)%00%(refname:short)%00%(upstream)%00%(worktreepath)", "refs/heads"], read)).stdout.toString("utf8");
+    const localBranches = upstreams.split(/\r?\n/).map((line) => line.split("\0")).filter((fields) => fields[2] === fullName).map(([ref, name, , worktreePath]) => ({ fullName: ref, name, worktreePath: worktreePath || null }));
+    return {
+      ...target.branch,
+      remote: target.remote,
+      branchName: target.branchName,
+      localBranches,
+      defaultBranch: defaultRef?.slice("refs/heads/".length) ?? null,
+      remoteState,
+      destinationId: destination.id,
+      deletionBlockedReason: blocked
+    };
+  }
+  async create(request) {
+    const repository = this.repositories.get(request.repositoryId);
+    return this.git.runWriteTask(repository.path, async (run) => {
+      const target = await this.target(request.fullName, run);
+      if (!target) return { status: "missing" };
+      if (target.branch.oid !== request.expectedOid) return { status: "stale" };
+      if (request.localName.startsWith("-")) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "create-tracking-branch", message: "Invalid local branch name." });
+      await run(["check-ref-format", `refs/heads/${request.localName}`], read);
+      const localRef = `refs/heads/${request.localName}`;
+      const existing = (await run(["for-each-ref", "--format=%(refname)", "refs/heads"], read)).stdout.toString("utf8").trim().split(/\r?\n/);
+      if (existing.includes(localRef)) return { status: "exists" };
+      await run(["branch", "--track", "--", request.localName, target.branch.fullName], { operation: "create-tracking-branch" });
+      return { status: "created", fullName: localRef };
+    }, repository.commonDir);
+  }
+  async delete(request) {
+    const repository = this.repositories.get(request.repositoryId);
+    return this.git.runWriteTask(repository.path, async (run) => {
+      const target = await this.target(request.fullName, run);
+      if (!target) return { status: "missing" };
+      if (target.branch.oid !== request.expectedOid) return { status: "stale" };
+      const destination = await this.destination(target, run, repository.path);
+      if (destination.id !== request.destinationId) return { status: "destination-changed" };
+      if (destination.blocked) return { status: "rejected", message: destination.blocked };
+      try {
+        const state = await this.advertised(target, run, destination.url);
+        if (!state.oid) return { status: "missing" };
+        if (!state.defaultRef) return { status: "rejected", message: "Could not identify the remote default branch. Nothing was deleted." };
+        if (state.defaultRef === target.sourceRef) return { status: "default" };
+        if (state.oid !== request.expectedOid) return { status: "stale" };
+        await run(
+          [
+            "-c",
+            `remote.${target.remote}.mirror=false`,
+            "push",
+            "--porcelain",
+            "--no-follow-tags",
+            `--force-with-lease=${target.sourceRef}:${request.expectedOid}`,
+            "--",
+            destination.url,
+            `:${target.sourceRef}`
+          ],
+          { operation: "delete-remote-branch", timeoutMs: 12e4, maxOutputBytes: 4 * 1024 * 1024 }
+        );
+        return { status: "deleted" };
+      } catch {
+        return { status: "rejected", message: "Git refused the remote deletion. Check permissions or branch protection, fetch, and try again. No local branch or worktree was removed." };
+      }
+    }, repository.commonDir);
+  }
+  async fetch(repositoryId) {
+    const repository = this.repositories.get(repositoryId);
+    try {
+      await this.git.runWriteTask(repository.path, async (run) => {
+        for (const remote of await this.remotes(run)) {
+          const specs = remote.refspecs.filter((spec) => spec.startsWith("^refs/heads/") || /^\+?refs\/heads\/[^:]+:refs\/remotes\//.test(spec));
+          if (!specs.some((spec) => !spec.startsWith("^"))) continue;
+          await run(
+            ["-c", "fetch.pruneTags=false", "fetch", "--prune", "--no-prune-tags", "--no-tags", "--no-recurse-submodules", "--", remote.name, ...specs],
+            { operation: "fetch-branches", timeoutMs: 12e4, maxOutputBytes: 4 * 1024 * 1024 }
+          );
+        }
+      }, repository.commonDir);
+    } catch {
+      return { status: "failed", message: "Could not fetch all remote branches. Check your connection and Git credentials, then fetch again." };
+    }
+    const status = await this.repositories.status(repositoryId, false);
+    return { status: "success", ahead: status.ahead, behind: status.behind };
+  }
+}
+function refspecMatch(pattern, ref) {
+  const star = pattern.indexOf("*");
+  if (star < 0) return pattern === ref ? "" : null;
+  const prefix = pattern.slice(0, star);
+  const suffix = pattern.slice(star + 1);
+  return ref.startsWith(prefix) && ref.endsWith(suffix) && ref.length >= prefix.length + suffix.length ? ref.slice(prefix.length, suffix ? -suffix.length : void 0) : null;
+}
+const AI_PATCH_BUDGET = 4e5;
+const AI_SUMMARY_BUDGET = 24e3;
+class GitRepositoryOperations {
+  constructor(git, repositories, files) {
+    this.git = git;
+    this.repositories = repositories;
+    this.files = files;
+    this.authorship = new GitCommitAuthorship(git, repositories);
+    this.remoteBranches = new GitRemoteBranches(git, repositories);
+  }
+  git;
+  repositories;
+  files;
+  access;
+  publicationContext(repositoryId, remote) {
+    if (!this.access) throw new Error("Repository access is unavailable.");
+    return this.access.publication(repositoryId, remote);
+  }
+  knownOids = /* @__PURE__ */ new Map();
+  authorship;
+  remoteBranches;
+  remoteBranchDetails(repositoryId, fullName) {
+    return this.remoteBranches.details(repositoryId, fullName);
+  }
+  createTrackingBranch(request) {
+    return this.remoteBranches.create(request);
+  }
+  deleteRemoteBranch(request) {
+    return this.git.withNetworkContext(this.repositories.get(request.repositoryId).path, () => this.remoteBranches.delete(request));
+  }
+  fetchBranches(repositoryId) {
+    return this.git.withNetworkContext(this.repositories.get(repositoryId).path, () => this.remoteBranches.fetch(repositoryId));
+  }
+  getCommitAuthorship(repositoryId) {
+    return this.authorship.get(repositoryId);
+  }
+  setCommitAuthorship(repositoryId, input) {
+    return this.authorship.set(repositoryId, input);
+  }
+  async diff(request) {
+    const repository = this.repositories.get(request.repositoryId);
+    const paths = this.repositories.validatePaths(request.repositoryId, [request.path]);
+    const tracked = (await this.git.run(
+      repository.path,
+      ["--literal-pathspecs", "ls-files", "-z", "--", ...paths],
+      { operation: "diff-tracked-check", readOnly: true, maxOutputBytes: 1024 * 1024 }
+    )).stdout.length > 0;
+    if (request.kind === "unstaged" && !tracked) return this.untrackedDiff(request.repositoryId, request.path);
+    const args = ["--literal-pathspecs", "diff"];
+    if (request.kind === "staged") args.push("--cached");
+    args.push("--no-color", "--no-ext-diff", "--unified=3", "--", ...paths);
+    const output = await this.git.run(repository.path, args, { operation: `diff-${request.kind}`, readOnly: true, maxOutputBytes: 32 * 1024 * 1024 });
+    return makeDiffResult(request.path, output.stdout);
+  }
+  async commitDiff(repositoryId, oid) {
+    this.assertKnownOid(repositoryId, oid);
+    const repository = this.repositories.get(repositoryId);
+    const output = await this.git.run(repository.path, ["show", "--format=", "--no-color", "--no-ext-diff", oid, "--"], { operation: "commit-diff", readOnly: true, maxOutputBytes: 32 * 1024 * 1024 });
+    return makeDiffResult(oid, output.stdout);
+  }
+  async commitFiles(repositoryId, oid) {
+    this.assertKnownOid(repositoryId, oid);
+    const repository = this.repositories.get(repositoryId);
+    const common2 = ["show", "--format=", "--no-color", "--no-ext-diff", "-M", "-z"];
+    const [nameStatus, numstat] = await Promise.all([
+      this.git.run(repository.path, [...common2, "--name-status", oid, "--"], { operation: "commit-files", readOnly: true, maxOutputBytes: 8 * 1024 * 1024 }),
+      this.git.run(repository.path, [...common2, "--numstat", oid, "--"], { operation: "commit-files", readOnly: true, maxOutputBytes: 8 * 1024 * 1024 })
+    ]);
     return parseCommitFiles(nameStatus.stdout.toString("utf8"), numstat.stdout.toString("utf8"));
   }
   async commitFileDiff(repositoryId, oid, filePath, oldPath) {
@@ -15555,6 +16508,9 @@ ${base}
     }, repository.commonDir);
   }
   async fetch(repositoryId) {
+    return this.git.withNetworkContext(this.repositories.get(repositoryId).path, () => this.fetchInContext(repositoryId));
+  }
+  async fetchInContext(repositoryId) {
     const repository = this.repositories.get(repositoryId);
     try {
       await this.runFetch(repository.path, "fetch");
@@ -15566,6 +16522,9 @@ ${base}
     return { status: "success", ahead: status.ahead, behind: status.behind };
   }
   async pull(repositoryId) {
+    return this.git.withNetworkContext(this.repositories.get(repositoryId).path, () => this.pullInContext(repositoryId));
+  }
+  async pullInContext(repositoryId) {
     const repository = this.repositories.get(repositoryId);
     let status = await this.repositories.status(repositoryId, false);
     const existingConflicts = conflictPaths(status);
@@ -15642,7 +16601,47 @@ ${base}
     const nextStatus = await this.repositories.status(repositoryId, false);
     return { status: "success", commits, restoredLocalChanges: hasLocalChanges, rebased, localCommits: nextStatus.ahead };
   }
-  async push(repositoryId, publish) {
+  async push(repositoryId, publish, expectedContext) {
+    if (this.access) return this.pushWithContext(repositoryId, publish, expectedContext);
+    return this.legacyPush(repositoryId, publish);
+  }
+  async pushWithContext(repositoryId, publish, expectedContext) {
+    const repository = this.repositories.get(repositoryId);
+    try {
+      const reviewed = await this.access.assertPublication(repositoryId, expectedContext, publish?.remote);
+      return await this.git.withNetworkContext(repository.path, () => this.git.runWriteTask(repository.path, async (run) => {
+        const context = await this.access.assertPublication(repositoryId, reviewed.id, publish?.remote);
+        const status = await this.repositories.status(repositoryId, false);
+        const conflicts = conflictPaths(status);
+        if (conflicts.length) return { status: "blocked-conflicts", files: conflicts };
+        if (status.operation) return { status: "blocked-operation", operation: status.operation };
+        if (!context.branch || !context.oid || !context.targetRef) return { status: "rejected", reason: "configuration", message: "Check out a branch with a commit before publishing." };
+        if (publish && (publish.expectedBranch !== context.branch || publish.expectedOid !== context.oid)) return { status: "rejected", reason: "configuration", message: "The branch changed. Review and try again." };
+        if (!context.remote) return context.remotes.length ? { status: "remote-required", branch: context.branch, oid: context.oid, remotes: context.remotes } : { status: "rejected", reason: "configuration", message: "No remote is configured." };
+        const result = await run([
+          "-c",
+          `remote.${context.remote}.mirror=false`,
+          "push",
+          "--porcelain",
+          "--no-follow-tags",
+          ...!status.upstream ? ["--set-upstream"] : [],
+          "--",
+          context.remote,
+          `refs/heads/${context.branch}:${context.targetRef}`
+        ], {
+          operation: "push",
+          timeoutMs: 12e4,
+          maxOutputBytes: 4 * 1024 * 1024,
+          publication: { repositoryId, id: context.id, ...publish?.remote ? { remote: publish.remote } : {} }
+        });
+        if (!status.upstream) return { status: "published", branch: context.branch, remote: context.remote };
+        return result.stdout.toString("utf8").includes("[up to date]") ? { status: "up-to-date" } : { status: "success", commits: status.ahead };
+      }, repository.commonDir));
+    } catch (error) {
+      return pushFailure(error);
+    }
+  }
+  async legacyPush(repositoryId, publish) {
     const repository = this.repositories.get(repositoryId);
     let status = await this.repositories.status(repositoryId, false);
     const existingConflicts = conflictPaths(status);
@@ -15736,15 +16735,16 @@ ${base}
     return this.repositories.openPath(worktree.path);
   }
   /**
-   * Cheap enumeration for the local refs manager. Deliberately runs no status
+   * Cheap enumeration for the refs manager. Deliberately runs no status
    * scan per worktree so ordinary refreshes stay as fast as the selectors.
    */
   async localRefsSnapshot(repositoryId) {
     const repository = this.repositories.get(repositoryId);
     const [branches, worktrees] = await Promise.all([this.branches(repositoryId), this.worktrees(repositoryId)]);
-    const locals = branches.filter((branch) => !branch.remote).sort(compareBranches);
+    const managed = await this.remoteBranches.snapshotBranches(repositoryId, branches);
     return {
-      branches: locals,
+      branches: managed.branches.sort(compareBranches),
+      remotes: managed.remotes,
       worktrees: await Promise.all(worktrees.map(async (worktree) => ({ ...worktree, current: await samePath(worktree.path, repository.path) })))
     };
   }
@@ -16139,24 +17139,20 @@ function bounded(value, limit) {
 }
 function pushFailure(error) {
   const detail = error instanceof GitOperationError ? error.detail : null;
-  const raw = `${detail?.stderr ?? ""}
-${detail?.message ?? (error instanceof Error ? error.message : "")}`.toLowerCase();
-  if (/authentication failed|permission denied|could not read username|access denied|publickey/.test(raw)) {
-    return { status: "rejected", reason: "authentication", message: "The remote rejected the credentials or you do not have permission to push." };
-  }
-  if (/non-fast-forward|fetch first|stale info|failed to push some refs/.test(raw)) {
-    return { status: "rejected", reason: "remote-changed", message: "The remote contains new changes. Update the branch and try again." };
-  }
-  if (/hook declined|pre-receive hook|protected branch|remote rejected/.test(raw)) {
-    return { status: "rejected", reason: "hook", message: "The server rejected the push because of a rule or branch protection." };
-  }
-  if (/could not resolve host|unable to access|connection timed out|connection reset|network is unreachable/.test(raw)) {
-    return { status: "rejected", reason: "network", message: "Could not connect to the remote. Check your network and try again." };
-  }
-  if (/upstream branch .* does not match|no upstream branch|push\.default/.test(raw)) {
-    return { status: "rejected", reason: "configuration", message: "The local branch and its upstream do not allow a safe push with the current configuration." };
-  }
-  return { status: "rejected", reason: "unknown", message: "Git rejected the push. No force push was performed." };
+  const message = redactSensitiveText(detail?.stderr || detail?.message || (error instanceof Error ? error.message : "Git rejected the push.")).trim().slice(0, 3e3);
+  const raw = message.toLowerCase();
+  let reason = "unknown";
+  let explanation = "";
+  if (/repository not found|repository .* not found|(?:http|error:)\s*404/.test(raw)) {
+    reason = "inaccessible";
+    explanation = "The repository is missing or inaccessible to this account. ";
+  } else if (/authentication failed|could not read username|bad credentials|expired|revoked|no usable saved credentials|publickey|(?:http|error:)\s*401/.test(raw)) reason = "authentication";
+  else if (/protected branch|hook declined|pre-receive hook|remote rejected|gh006|gh013|repository rule/.test(raw)) reason = "hook";
+  else if (/permission.*denied|write access.*not granted|access denied|(?:http|error:)\s*403/.test(raw)) reason = "permission";
+  else if (/non-fast-forward|fetch first|stale info/.test(raw)) reason = "remote-changed";
+  else if (/could not resolve host|unable to access|connection.*(timed out|reset|refused)|network is unreachable|(?:http|error:)\s*50[0-4]/.test(raw)) reason = "network";
+  else if (detail?.code === "INVALID_ARGUMENT" || /upstream branch .* does not match|no upstream branch|push\.default|context|account changed/.test(raw)) reason = "configuration";
+  return { status: "rejected", reason, message: explanation + message };
 }
 function makeDiffResult(path2, buffer) {
   const patch = buffer.toString("utf8");
@@ -16168,7 +17164,6 @@ const MAX_REPOSITORY_PROJECTS = 50;
 const MAX_PROJECT_NAME_LENGTH = 60;
 const MAX_REPOSITORIES_PER_PROJECT = 200;
 const MAX_REPOSITORY_KEY_LENGTH = 2048;
-const UNASSIGNED_RECENT_LIMIT = 10;
 function normalizeRepositoryKey(commonDir) {
   return commonDir.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
 }
@@ -16196,8 +17191,23 @@ class RepositoryService {
     return this.openPath(recent.path);
   }
   async openPath(selectedPath) {
+    const repository = await this.preparePath(selectedPath);
+    await this.settings.touchRepository(repository);
+    return repository;
+  }
+  /** Inspect/cache only: no recent entry, active repository, or persistence. */
+  async preparePath(selectedPath) {
     const repository = await this.inspectPath(selectedPath);
     this.repositories.set(repository.id, repository);
+    return repository;
+  }
+  async completeSetup(id, validate2 = () => void 0) {
+    const prepared = this.get(id);
+    const repository = await this.inspectPath(prepared.path);
+    if (repository.id !== prepared.id || repository.commonDir !== prepared.commonDir) {
+      throw new Error("The repository location changed. Select the folder again.");
+    }
+    validate2();
     await this.settings.touchRepository(repository);
     return repository;
   }
@@ -16692,6 +17702,331 @@ function revision(bytes) {
 function invalidReplacement(message) {
   return new GitOperationError({ code: "INVALID_ARGUMENT", operation: "replace-search", message });
 }
+const githubAccountSelectionSchema = discriminatedUnion("mode", [
+  object({ mode: literal("auto") }),
+  object({ mode: literal("account"), host: literal("github.com"), login: string().regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/), gitMode: _enum(["external", "managed"]).optional(), useGlobalDefault: boolean().optional() })
+]);
+const AUTOMATIC_GITHUB_ACCOUNT = { mode: "auto" };
+function githubRepositoryKey(commonDir, platform2 = process.platform) {
+  const key = commonDir.replace(/\\/g, "/").replace(/\/+$/, "");
+  return platform2 === "win32" ? key.toLowerCase() : key;
+}
+const CACHE_MS = 6e4;
+const emptyStatus = () => ({
+  installationStatus: "unchecked",
+  accounts: [],
+  activeLogin: null,
+  environment: { present: false, login: null, state: "unknown" },
+  checkedAt: null
+});
+class GitHubAccountsService {
+  constructor(resolver, runner, git, settings, store, changed = () => void 0) {
+    this.resolver = resolver;
+    this.runner = runner;
+    this.git = git;
+    this.settings = settings;
+    this.store = store;
+    this.changed = changed;
+  }
+  resolver;
+  runner;
+  git;
+  settings;
+  store;
+  changed;
+  inventory = null;
+  loading = null;
+  checking = null;
+  detection = null;
+  revision = 0;
+  get authRevision() {
+    return this.revision;
+  }
+  revisions = /* @__PURE__ */ new Map();
+  defaultRevision = 0;
+  revisionFor(repository) {
+    const selection = this.selection(repository);
+    return Math.max(
+      this.revisions.get(githubRepositoryKey(repository.commonDir)) ?? 0,
+      selection.mode === "account" && selection.useGlobalDefault ? this.defaultRevision : 0
+    );
+  }
+  contexts = /* @__PURE__ */ new Map();
+  ssh = /* @__PURE__ */ new Map();
+  identities = /* @__PURE__ */ new Map();
+  status(force = false) {
+    if (force) {
+      this.checking ??= this.check().finally(() => {
+        this.checking = null;
+      });
+      return this.checking.then((value) => ({ ...structuredClone(value), defaultLogin: this.settings?.githubDefaultLogin ?? null }));
+    }
+    this.loading ??= (async () => {
+      this.inventory ??= await this.store?.load() ?? emptyStatus();
+      return this.inventory;
+    })();
+    return this.loading.then(() => ({ ...structuredClone(this.inventory ?? emptyStatus()), defaultLogin: this.settings?.githubDefaultLogin ?? null }));
+  }
+  selection(repository) {
+    return this.settings?.githubAccount(repository.commonDir) ?? { ...AUTOMATIC_GITHUB_ACCOUNT };
+  }
+  context(repository, remote, nameWithOwner) {
+    const cached2 = this.contexts.get(repository.id);
+    if (cached2?.remote === remote && cached2.value.revision === this.revisionFor(repository)) return structuredClone(cached2.value);
+    const selection = this.selection(repository);
+    return {
+      selection,
+      nameWithOwner,
+      login: selection.mode === "account" ? selection.login : null,
+      source: selection.mode === "account" ? "explicit" : null,
+      state: "unchecked",
+      checkedAt: null,
+      revision: this.revisionFor(repository)
+    };
+  }
+  async setSelection(repository, selection) {
+    if (!this.settings) throw new Error("GitHub account settings are unavailable.");
+    const saving = this.settings.setGitHubAccount(repository.commonDir, selection);
+    this.invalidate(repository);
+    try {
+      await saving;
+    } catch (error) {
+      this.invalidate(repository);
+      throw error;
+    }
+  }
+  async setDefaultAccount(login2) {
+    if (!this.settings) throw new Error("GitHub account settings are unavailable.");
+    this.defaultRevision = ++this.revision;
+    try {
+      await this.settings.setGitHubDefaultLogin(login2);
+    } finally {
+      this.changed(void 0, true);
+    }
+    return this.status();
+  }
+  invalidate(repository) {
+    this.revision++;
+    if (repository) {
+      const key = githubRepositoryKey(repository.commonDir);
+      this.revisions.set(key, this.revision);
+    } else {
+      this.contexts.clear();
+    }
+    this.ssh.clear();
+    this.identities.clear();
+    this.changed(repository);
+  }
+  refreshAuthentication() {
+    this.ssh.clear();
+    this.identities.clear();
+  }
+  async detect(force = false) {
+    if (force || !this.detection || Date.now() - this.detection.at > CACHE_MS) {
+      this.detection = { at: Date.now(), promise: selectCli(this.resolver, this.runner, "gh", {
+        forceRefresh: force,
+        runOptions: { cwd: os.homedir(), env: { ...GH_ENV }, removeEnv: ["GH_DEBUG", "DEBUG"] }
+      }) };
+    }
+    return this.detection.promise;
+  }
+  async authenticate(repository, remote, nameWithOwner, operation) {
+    const revision2 = this.revisionFor(repository);
+    const selection = this.selection(repository);
+    let login2 = selection.mode === "account" ? selection.login : null;
+    let source = selection.mode === "account" ? "explicit" : null;
+    try {
+      const detection = await this.detect();
+      if (detection.state !== "available" || !detection.candidate) throw new GhOperationError({
+        code: detection.state === "not-found" ? "GH_CLI_NOT_FOUND" : "GH_PROCESS_FAILED",
+        operation,
+        message: detection.state === "not-found" ? "GitHub CLI is not installed on the backend host." : "GitHub CLI could not run. Check Settings → GitHub."
+      });
+      const executable = detection.candidate;
+      if (selection.mode === "auto" && parseSshRemote(remote)) {
+        const override = executable.env.GIT_SSH_COMMAND || executable.env.GIT_SSH || process.env.GIT_SSH_COMMAND || process.env.GIT_SSH;
+        const configured = await this.git.run(repository.path, ["config", "--default", "", "--get", "core.sshCommand"], {
+          operation: "github-ssh-configuration",
+          readOnly: true,
+          maxOutputBytes: 8 * 1024
+        });
+        if (override || configured.stdout.toString("utf8").trim()) throw new GhOperationError({
+          code: "GH_ACCOUNT_UNRESOLVED",
+          operation,
+          message: "This repository uses a custom SSH command. Choose an explicit account in Settings → GitHub."
+        });
+        const key = `${repository.path}\0${remote}`;
+        let cached2 = this.ssh.get(key);
+        if (!cached2 || Date.now() - cached2.at > CACHE_MS) {
+          cached2 = { at: Date.now(), promise: identifySshAccount(remote, this.runner) };
+          this.ssh.set(key, cached2);
+        }
+        login2 = await cached2.promise;
+        source = "ssh";
+        if (!login2) throw new GhOperationError({
+          code: "GH_ACCOUNT_UNRESOLVED",
+          operation,
+          message: "SSH could not verify a GitHub user account. Check again or choose an explicit account in Settings → GitHub. Deploy keys do not identify user accounts."
+        });
+      }
+      if (!source) source = executable.env.GH_TOKEN || executable.env.GITHUB_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_TOKEN ? "environment" : "global";
+      const auth = await accountAuthentication(login2, executable, this.runner, operation);
+      const verified = await this.identity(executable, auth, operation);
+      if (login2 && login2.toLowerCase() !== verified.toLowerCase()) throw new GhOperationError({
+        code: "GH_AUTH_REQUIRED",
+        operation,
+        message: `The saved credentials for @${login2} authenticate a different account. Authenticate @${login2} again and check Settings → GitHub.`
+      });
+      login2 = verified;
+      const context = { selection, nameWithOwner, login: login2, source, state: "ready", checkedAt: (/* @__PURE__ */ new Date()).toISOString(), revision: revision2 };
+      if (revision2 === this.revisionFor(repository)) {
+        const previous = this.contexts.get(repository.id)?.value;
+        if (previous?.state === "ready" && previous.revision === revision2 && (previous.login?.toLowerCase() !== login2.toLowerCase() || previous.source !== source)) {
+          this.invalidate(repository);
+          context.revision = this.revisionFor(repository);
+        }
+        this.contexts.set(repository.id, { remote, value: context });
+      }
+      return { auth, executable, context };
+    } catch (error) {
+      const message = error instanceof GhOperationError ? error.message : "Could not inspect GitHub authentication. Check Settings → GitHub again.";
+      if (revision2 === this.revisionFor(repository)) this.contexts.set(repository.id, { remote, value: {
+        selection,
+        nameWithOwner,
+        login: login2,
+        source,
+        state: "error",
+        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        message,
+        revision: revision2
+      } });
+      if (error instanceof GhOperationError) throw error;
+      throw new GhOperationError({ code: "GH_PROCESS_FAILED", operation, message, retryable: true });
+    }
+  }
+  identity(executable, auth, operation) {
+    const fingerprint = createHash("sha256").update(auth.env?.GH_TOKEN ?? "").digest("hex");
+    let cached2 = this.identities.get(fingerprint);
+    if (!cached2 || Date.now() - cached2.at > CACHE_MS) {
+      const promise = (async () => {
+        const result = await this.runner.run(executable.executable, ["api", "user", "--jq", ".login"], {
+          cwd: os.homedir(),
+          env: { ...executable.env, ...GH_ENV, ...auth.env },
+          ...auth.removeEnv ? { removeEnv: auth.removeEnv } : {},
+          timeoutMs: 15e3,
+          maxOutputBytes: 8 * 1024
+        });
+        const login2 = result.stdout.trim();
+        if (result.exitCode === 0 && GITHUB_LOGIN.test(login2)) return login2;
+        const invalid2 = /401|bad credentials|requires authentication/i.test(result.stderr);
+        throw new GhOperationError({
+          code: invalid2 ? "GH_AUTH_REQUIRED" : "GH_PROCESS_FAILED",
+          operation,
+          message: invalid2 ? "GitHub rejected these credentials. They may be expired or revoked. Authenticate this account again and check Settings → GitHub." : "Could not verify this GitHub account. Check your connection and try again.",
+          retryable: !invalid2
+        });
+      })();
+      cached2 = { at: Date.now(), promise };
+      this.identities.set(fingerprint, cached2);
+      void promise.catch(() => {
+        if (this.identities.get(fingerprint)?.promise === promise) this.identities.delete(fingerprint);
+      });
+    }
+    return cached2.promise;
+  }
+  async check() {
+    await this.status();
+    this.refreshAuthentication();
+    const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const detection = await this.detect(true);
+    const result = {
+      ...emptyStatus(),
+      installationStatus: detection.state,
+      checkedAt,
+      ...detection.version ? { version: detection.version } : {}
+    };
+    if (detection.state === "available" && detection.candidate) {
+      const executable = detection.candidate;
+      try {
+        const status = await this.runner.run(executable.executable, ["auth", "status", "--hostname", "github.com", "--json", "hosts"], {
+          cwd: os.homedir(),
+          env: { ...executable.env, ...GH_ENV },
+          removeEnv: ["GH_TOKEN", ...GH_PRIVATE_ENV],
+          timeoutMs: 6e4,
+          maxOutputBytes: 256 * 1024
+        });
+        if (status.exitCode !== 0) {
+          if (/unknown flag.*json/i.test(status.stderr)) result.installationStatus = "incompatible";
+          throw new Error("Status failed");
+        }
+        Object.assign(result, parseGitHubAuthStatus(status.stdout));
+        const envToken = executable.env.GH_TOKEN || executable.env.GITHUB_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+        if (envToken) {
+          result.environment.present = true;
+          try {
+            const auth = await accountAuthentication(null, executable, this.runner, "gh-auth-status");
+            result.environment.login = await this.identity(executable, auth, "gh-auth-status");
+            result.environment.state = "authenticated";
+          } catch (error) {
+            result.environment.state = error instanceof GhOperationError && error.detail.code === "GH_AUTH_REQUIRED" ? "invalid" : "unknown";
+          }
+        }
+      } catch {
+        result.message = result.installationStatus === "incompatible" ? "Update GitHub CLI to a version supporting auth status --json and multiple accounts." : "Could not check the saved GitHub accounts. Check your connection and CLI configuration, then try again.";
+        result.accounts = this.inventory?.accounts.map((account) => ({ ...account, state: "unknown" })) ?? [];
+        result.activeLogin = this.inventory?.activeLogin ?? null;
+      }
+    } else result.message = detection.state === "not-found" ? "Install GitHub CLI on the backend host." : "GitHub CLI was found but could not run. Check its installation and dependencies.";
+    this.inventory = result;
+    try {
+      await this.store?.save(result);
+    } finally {
+      this.invalidate();
+    }
+    return result;
+  }
+}
+const authState = _enum(["authenticated", "invalid", "unknown"]);
+const login = string().regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/);
+const schema = object({
+  installationStatus: _enum(["unchecked", "available", "not-found", "not-executable", "incompatible", "inspection-failed"]),
+  version: string().max(200).optional(),
+  accounts: array(object({
+    host: literal("github.com"),
+    login,
+    active: boolean(),
+    state: authState,
+    storage: _enum(["keyring", "file", "unknown"]),
+    scopes: string().max(500).optional()
+  })).max(100),
+  activeLogin: login.nullable(),
+  environment: object({ present: boolean(), login: login.nullable(), state: authState }),
+  checkedAt: string().datetime().nullable(),
+  message: string().max(500).optional()
+});
+class GitHubStatusStore {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  pending = Promise.resolve();
+  async load() {
+    await this.pending;
+    try {
+      if ((await stat(this.filePath)).size > 256 * 1024) return null;
+      const parsed = schema.safeParse(JSON.parse(await readFile(this.filePath, "utf8")));
+      return parsed.success ? parsed.data : null;
+    } catch {
+      return null;
+    }
+  }
+  save(value) {
+    const snapshot = JSON.stringify(schema.parse(value));
+    const write = this.pending.then(() => writeFileAtomically(this.filePath, snapshot, { parseJson: true }));
+    this.pending = write.catch(() => void 0);
+    return write;
+  }
+}
 const positive = number().int().positive().safe();
 const membershipSchema = object({
   stack: object({ number: positive, size: positive, baseRefName: string().min(1) }).nullable(),
@@ -16759,28 +18094,6 @@ function parsePullRequestStack(raw, prNumber, listing = false) {
     }))
   };
 }
-const OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/;
-const REPO_PATTERN = /^[A-Za-z0-9._-]+$/;
-function parseGitHubRemote(url) {
-  const trimmed = url.trim();
-  if (!trimmed) return null;
-  let rest = null;
-  const https = /^https?:\/\/(?:[^@/\s]+@)?github\.com\/(.+)$/i.exec(trimmed);
-  const ssh = /^ssh:\/\/(?:[^@/\s]+@)?github\.com(?::\d+)?\/(.+)$/i.exec(trimmed);
-  const scp = /^(?:[^@\s]+)@github\.com:(.+)$/i.exec(trimmed);
-  const git = /^git:\/\/github\.com\/(.+)$/i.exec(trimmed);
-  if (https) rest = https[1] ?? null;
-  else if (ssh) rest = ssh[1] ?? null;
-  else if (scp) rest = scp[1] ?? null;
-  else if (git) rest = git[1] ?? null;
-  if (!rest) return null;
-  const segments = rest.replace(/\/+$/, "").split("/");
-  if (segments.length !== 2) return null;
-  const owner = segments[0] ?? "";
-  const repo = (segments[1] ?? "").replace(/\.git$/i, "");
-  if (!OWNER_PATTERN.test(owner) || !repo || repo === "." || repo === ".." || !REPO_PATTERN.test(repo)) return null;
-  return { nameWithOwner: `${owner}/${repo}` };
-}
 const PR_SUMMARY_FIELDS = "number,title,state,isDraft,author,headRefName,baseRefName,updatedAt,url,reviewDecision,additions,deletions,statusCheckRollup";
 const PR_DETAIL_FIELDS = `${PR_SUMMARY_FIELDS},body,changedFiles,labels,commits`;
 const tolerantRecordSchema = looseObject({});
@@ -16795,6 +18108,15 @@ function parsePullRequestList(raw) {
   if (!list.success) throw invalidOutput("gh-pr-list");
   return list.data.map((item) => parseSummary(item, "gh-pr-list"));
 }
+function parseBranchPullRequestList(raw, nameWithOwner, branch) {
+  const list = pullRequestArraySchema.safeParse(parseJson(raw, "gh-pr-for-branch"));
+  if (!list.success) throw invalidOutput("gh-pr-for-branch");
+  const headSchema = looseObject({ headRefName: string(), headRepository: looseObject({ nameWithOwner: string() }) });
+  return list.data.filter((item) => {
+    const head = headSchema.safeParse(item);
+    return head.success && head.data.headRefName === branch && head.data.headRepository.nameWithOwner.toLowerCase() === nameWithOwner.toLowerCase();
+  }).map((item) => parseSummary(item, "gh-pr-for-branch"));
+}
 function parsePullRequestDetails(raw) {
   const item = parseJson(raw, "gh-pr-view");
   const summary = parseSummary(item, "gh-pr-view");
@@ -16876,14 +18198,14 @@ function parseCommits(value) {
     if (typeof record2.oid !== "string" || !record2.oid) return [];
     const authors = Array.isArray(record2.authors) ? record2.authors : [];
     const authorRecord = authors.map((author) => tolerantRecordSchema.safeParse(author)).find((author) => author.success)?.data;
-    const login = typeof authorRecord?.login === "string" ? authorRecord.login : null;
-    const name = typeof authorRecord?.name === "string" && authorRecord.name ? authorRecord.name : login ?? "unknown";
+    const login2 = typeof authorRecord?.login === "string" ? authorRecord.login : null;
+    const name = typeof authorRecord?.name === "string" && authorRecord.name ? authorRecord.name : login2 ?? "unknown";
     return [{
       oid: record2.oid,
       messageHeadline: typeof record2.messageHeadline === "string" ? record2.messageHeadline : "",
       authoredAt: typeof record2.authoredDate === "string" ? record2.authoredDate : "",
       author: name,
-      authorAvatarUrl: login ? avatarUrl(login, login.endsWith("[bot]")) : null
+      authorAvatarUrl: login2 ? avatarUrl(login2, login2.endsWith("[bot]")) : null
     }];
   });
 }
@@ -16902,11 +18224,11 @@ function parseChecksState(value) {
   }
   return pending ? "PENDING" : "PASSING";
 }
-function avatarUrl(login, isBot) {
-  if (!login || login === "unknown") return null;
-  if (login === "app/dependabot" || login === "dependabot[bot]") return "https://avatars.githubusercontent.com/in/29110?s=40&v=4";
-  const botName = login.startsWith("app/") ? login.slice(4) : login.replace(/\[bot\]$/i, "");
-  const path2 = isBot || login.startsWith("app/") ? botName : login;
+function avatarUrl(login2, isBot) {
+  if (!login2 || login2 === "unknown") return null;
+  if (login2 === "app/dependabot" || login2 === "dependabot[bot]") return "https://avatars.githubusercontent.com/in/29110?s=40&v=4";
+  const botName = login2.startsWith("app/") ? login2.slice(4) : login2.replace(/\[bot\]$/i, "");
+  const path2 = isBot || login2.startsWith("app/") ? botName : login2;
   return `https://github.com/${encodeURIComponent(path2)}.png?size=40`;
 }
 function parseJson(raw, operation) {
@@ -16926,70 +18248,113 @@ function validTimestamp(value) {
 function invalidOutput(operation) {
   return new GhOperationError({ code: "GH_INVALID_OUTPUT", operation, message: "GitHub CLI returned an unexpected response." });
 }
-const GH_ENV = { GH_PROMPT_DISABLED: "1", GH_NO_UPDATE_NOTIFIER: "1", GH_PAGER: "cat", NO_COLOR: "1" };
 const NETWORK_TIMEOUT_MS = 6e4;
 class GitHubService {
-  constructor(resolver, runner, git, repositories) {
-    this.resolver = resolver;
+  constructor(resolver, runner, git, repositories, accounts) {
     this.runner = runner;
     this.git = git;
     this.repositories = repositories;
+    this.accounts = accounts ?? new GitHubAccountsService(resolver, runner, git);
   }
-  resolver;
   runner;
   git;
   repositories;
-  statusCache = null;
+  gitAccess;
+  accounts;
   async status(forceRefresh = false) {
-    if (!forceRefresh && this.statusCache && Date.now() - this.statusCache.at < 3e4) return this.statusCache.value;
-    const value = await this.checkStatus(forceRefresh);
-    this.statusCache = { at: Date.now(), value };
-    return value;
+    if (forceRefresh) this.accounts.refreshAuthentication();
+    const detected = await this.accounts.detect(forceRefresh);
+    return {
+      installed: !!detected.candidate,
+      availability: detected.state === "available" ? "ready" : "error",
+      authStatus: "unknown",
+      ...detected.version ? { version: detected.version } : {},
+      checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
   }
-  async repositoryInfo(repositoryId) {
+  async repositoryAccount(repositoryId, forceRefresh = false) {
+    const repository = this.repositories.get(repositoryId);
+    const info = await this.repositoryInfo(repositoryId);
+    const remote = await this.remote(repositoryId);
+    if (forceRefresh && info.nameWithOwner && !this.gitAccess) {
+      this.accounts.refreshAuthentication();
+      try {
+        await this.accounts.authenticate(repository, remote, info.nameWithOwner, "gh-repository-account");
+      } catch {
+      }
+    }
+    const access2 = await this.gitAccess?.status(repositoryId, forceRefresh, { remote, nameWithOwner: info.nameWithOwner });
+    return { ...this.accounts.context(repository, remote, info.nameWithOwner), ...access2 ? { access: access2 } : {} };
+  }
+  async setRepositoryAccount(repositoryId, selection, expectedRevision) {
+    if (expectedRevision !== void 0 && expectedRevision !== this.accounts.revisionFor(this.repositories.get(repositoryId))) throw new Error("The repository account changed in another session. Reopen the account setup and review it.");
+    await this.accounts.setSelection(this.repositories.get(repositoryId), selection);
+    return this.repositoryAccount(repositoryId);
+  }
+  async remote(repositoryId) {
     const repository = this.repositories.get(repositoryId);
     try {
-      const output = await this.git.run(repository.path, ["config", "--get", "remote.origin.url"], { operation: "github-remote-url", readOnly: true, maxOutputBytes: 64 * 1024 });
-      const parsed = parseGitHubRemote(output.stdout.toString("utf8"));
+      const output = await this.git.run(repository.path, ["remote", "get-url", "--", "origin"], { operation: "github-remote-url", readOnly: true, maxOutputBytes: 64 * 1024 });
+      return output.stdout.toString("utf8").trim();
+    } catch {
+      return "";
+    }
+  }
+  async repositoryInfo(repositoryId) {
+    try {
+      const url = await this.remote(repositoryId);
+      let parsed = parseGitHubRemote(url);
+      if (!parsed) {
+        const ssh = parseSshRemote(url);
+        if (ssh) {
+          const config2 = await this.runner.run("ssh", ["-G", ...ssh.port ? ["-p", ssh.port] : [], "--", ssh.destination], {
+            cwd: os.homedir(),
+            timeoutMs: 5e3,
+            maxOutputBytes: 64 * 1024
+          });
+          const hostname = config2.stdout.split(/\r?\n/).find((line) => /^hostname\s/i.test(line))?.trim().split(/\s+/)[1];
+          if (config2.exitCode === 0 && hostname?.toLowerCase() === "github.com") parsed = { nameWithOwner: ssh.nameWithOwner };
+        }
+      }
       return parsed ? { isGitHub: true, nameWithOwner: parsed.nameWithOwner } : { isGitHub: false, nameWithOwner: null };
     } catch {
       return { isGitHub: false, nameWithOwner: null };
     }
   }
   async listPullRequests(repositoryId, states) {
-    const { repository, nameWithOwner } = await this.requireGitHub(repositoryId, "gh-pr-list");
+    const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, "gh-pr-list");
     const results = await Promise.all(states.map((state) => this.runGh(
       ["pr", "list", "-R", nameWithOwner, "--state", state.toLowerCase(), "--json", PR_SUMMARY_FIELDS, "--limit", "50"],
-      { cwd: repository.path, operation: "gh-pr-list", timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 4 * 1024 * 1024 }
+      { auth, executable, cwd: repository.path, operation: "gh-pr-list", timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 4 * 1024 * 1024 }
     )));
-    return this.withStackMembership(repository.path, nameWithOwner, selectPullRequestsNewestFirst(results.flatMap((result) => parsePullRequestList(result.stdout)), states));
+    return this.withStackMembership(repository.path, nameWithOwner, auth, executable, selectPullRequestsNewestFirst(results.flatMap((result) => parsePullRequestList(result.stdout)), states));
   }
   async findPullRequestForBranch(repositoryId, branchName) {
     const operation = "gh-pr-for-branch";
-    const { repository, nameWithOwner } = await this.requireGitHub(repositoryId, operation);
+    const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, operation);
     const branch = validateRef(branchName, operation);
     const openResult = await this.runGh(
-      ["pr", "list", "-R", nameWithOwner, "--head", branch, "--state", "open", "--json", PR_SUMMARY_FIELDS, "--limit", "10"],
-      { cwd: repository.path, operation, timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 1024 * 1024 }
+      ["pr", "list", "-R", nameWithOwner, "--head", branch, "--state", "open", "--json", `${PR_SUMMARY_FIELDS},headRepository`, "--limit", "10"],
+      { auth, executable, cwd: repository.path, operation, timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 1024 * 1024 }
     );
-    const openPull = sortPullRequestsNewestFirst(parsePullRequestList(openResult.stdout)).find((pull) => pull.state === "OPEN");
+    const openPull = sortPullRequestsNewestFirst(parseBranchPullRequestList(openResult.stdout, nameWithOwner, branch)).find((pull) => pull.state === "OPEN");
     if (openPull) return openPull;
     const result = await this.runGh(
-      ["pr", "list", "-R", nameWithOwner, "--head", branch, "--state", "all", "--json", PR_SUMMARY_FIELDS, "--limit", "10"],
-      { cwd: repository.path, operation, timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 1024 * 1024 }
+      ["pr", "list", "-R", nameWithOwner, "--head", branch, "--state", "all", "--json", `${PR_SUMMARY_FIELDS},headRepository`, "--limit", "10"],
+      { auth, executable, cwd: repository.path, operation, timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 1024 * 1024 }
     );
-    return sortPullRequestsNewestFirst(parsePullRequestList(result.stdout))[0] ?? null;
+    return sortPullRequestsNewestFirst(parseBranchPullRequestList(result.stdout, nameWithOwner, branch))[0] ?? null;
   }
   async getPullRequest(repositoryId, prNumber) {
-    const { repository, nameWithOwner } = await this.requireGitHub(repositoryId, "gh-pr-view");
+    const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, "gh-pr-view");
     const result = await this.runGh(
       ["pr", "view", String(prNumber), "-R", nameWithOwner, "--json", PR_DETAIL_FIELDS],
-      { cwd: repository.path, operation: "gh-pr-view", timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 4 * 1024 * 1024 }
+      { auth, executable, cwd: repository.path, operation: "gh-pr-view", timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 4 * 1024 * 1024 }
     );
     const details = parsePullRequestDetails(result.stdout);
-    return (await this.withStackMembership(repository.path, nameWithOwner, [details]))[0];
+    return (await this.withStackMembership(repository.path, nameWithOwner, auth, executable, [details]))[0];
   }
-  async withStackMembership(cwd, nameWithOwner, pulls) {
+  async withStackMembership(cwd, nameWithOwner, auth, executable, pulls) {
     const [owner, name] = nameWithOwner.split("/");
     const enriched = [];
     for (let start = 0; start < pulls.length; start += 25) {
@@ -16997,6 +18362,8 @@ class GitHubService {
       try {
         const numbers = batch.map((pr) => pr.number);
         const result = await this.runGh(["api", "graphql", "-f", `owner=${owner}`, "-f", `name=${name}`, "-f", `query=${stackMembershipQuery(numbers)}`], {
+          auth,
+          executable,
           cwd,
           operation: "gh-pr-stack-membership",
           timeoutMs: 1e4,
@@ -17015,28 +18382,28 @@ class GitHubService {
   }
   async getPullRequestStack(repositoryId, prNumber) {
     const operation = "gh-pr-stack";
-    const { repository, nameWithOwner } = await this.requireGitHub(repositoryId, operation);
-    const options = { cwd: repository.path, operation, timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 4 * 1024 * 1024 };
-    const read = async (endpoint) => this.runGh(["api", endpoint], options);
+    const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, operation);
+    const options = { auth, executable, cwd: repository.path, operation, timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 4 * 1024 * 1024 };
+    const read2 = async (endpoint) => this.runGh(["api", endpoint], options);
     let listing;
     try {
-      listing = await read(`repos/${nameWithOwner}/stacks?pull_request=${prNumber}`);
+      listing = await read2(`repos/${nameWithOwner}/stacks?pull_request=${prNumber}`);
     } catch (error) {
       if (error instanceof GhOperationError && error.detail.code === "GH_PROCESS_FAILED" && /HTTP 404/.test(error.message)) return null;
       throw error;
     }
     const stack = parsePullRequestStack(listing.stdout, prNumber, true);
     if (!stack) return null;
-    const details = await read(`repos/${nameWithOwner}/stacks/${stack.number}`);
+    const details = await read2(`repos/${nameWithOwner}/stacks/${stack.number}`);
     const complete = parsePullRequestStack(details.stdout, prNumber);
     if (complete?.number !== stack.number) throw new GhOperationError({ code: "GH_INVALID_OUTPUT", operation, message: "The stack changed while loading. Refresh to try again." });
     return complete;
   }
   async getPullRequestDiff(repositoryId, prNumber) {
-    const { repository, nameWithOwner } = await this.requireGitHub(repositoryId, "gh-pr-diff");
+    const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, "gh-pr-diff");
     const result = await this.runGh(
       ["pr", "diff", String(prNumber), "-R", nameWithOwner],
-      { cwd: repository.path, operation: "gh-pr-diff", timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 32 * 1024 * 1024 }
+      { auth, executable, cwd: repository.path, operation: "gh-pr-diff", timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 32 * 1024 * 1024 }
     );
     const patch = result.stdout;
     const binary = /Binary files .* differ|GIT binary patch/.test(patch);
@@ -17044,13 +18411,13 @@ class GitHubService {
   }
   async getPullRequestCommitDiff(repositoryId, oid) {
     const operation = "gh-pr-commit-diff";
-    const { repository, nameWithOwner } = await this.requireGitHub(repositoryId, operation);
+    const { repository, nameWithOwner, auth, executable } = await this.requireGitHub(repositoryId, operation);
     if (!/^[0-9a-f]{40,64}$/i.test(oid)) {
       throw new GhOperationError({ code: "GH_PROCESS_FAILED", operation, message: "The commit is not valid." });
     }
     const result = await this.runGh(
       ["api", `repos/${nameWithOwner}/commits/${oid}`, "--header", "Accept: application/vnd.github.diff"],
-      { cwd: repository.path, operation, timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 32 * 1024 * 1024 }
+      { auth, executable, cwd: repository.path, operation, timeoutMs: NETWORK_TIMEOUT_MS, maxOutputBytes: 32 * 1024 * 1024 }
     );
     const patch = result.stdout;
     const binary = /Binary files .* differ|GIT binary patch/.test(patch);
@@ -17058,7 +18425,13 @@ class GitHubService {
   }
   async createPullRequest(input) {
     const operation = "gh-pr-create";
-    const { repository, nameWithOwner } = await this.requireGitHub(input.repositoryId, operation);
+    const { repository, nameWithOwner, auth, executable, context } = await this.requireGitHub(input.repositoryId, operation);
+    const verifyAccount = () => {
+      if (input.expectedAccount && (input.expectedAccount.revision !== this.accounts.revisionFor(repository) || input.expectedAccount.revision !== context.revision || input.expectedAccount.login.toLowerCase() !== context.login?.toLowerCase())) {
+        throw new GhOperationError({ code: "GH_ACCOUNT_UNRESOLVED", operation, message: "The GitHub account changed. Review the current identity before creating the pull request." });
+      }
+    };
+    verifyAccount();
     const status = await this.repositories.status(input.repositoryId, false);
     if (status.detached || status.unborn || !status.branch) {
       throw new GhOperationError({ code: "GH_PROCESS_FAILED", operation, message: "Check out a branch before creating a pull request." });
@@ -17076,7 +18449,8 @@ class GitHubService {
       await writeFile(bodyPath, input.body, { encoding: "utf8", mode: 384 });
       const args = ["pr", "create", "-R", nameWithOwner, "--title", input.title, "--body-file", bodyPath, "--base", base, "--head", head];
       if (input.draft) args.push("--draft");
-      const result = await this.runGh(args, { cwd: repository.path, operation, timeoutMs: 12e4, maxOutputBytes: 1024 * 1024 });
+      verifyAccount();
+      const result = await this.runGh(args, { auth, executable, cwd: repository.path, operation, timeoutMs: 12e4, maxOutputBytes: 1024 * 1024 });
       const created = parseCreatedPullRequestUrl(result.stdout);
       if (!created) throw new GhOperationError({ code: "GH_INVALID_OUTPUT", operation, message: "GitHub CLI did not return the URL of the new pull request." });
       return created;
@@ -17084,51 +18458,32 @@ class GitHubService {
       await rm(temporary, { recursive: true, force: true });
     }
   }
-  async checkStatus(forceRefresh) {
-    const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
-    const detected = await selectCli(this.resolver, this.runner, "gh", { forceRefresh, runOptions: { cwd: os.tmpdir(), env: { ...GH_ENV } } });
-    const executable = detected.candidate;
-    if (!executable) {
-      return { installed: false, availability: "error", authStatus: "unknown", message: "Install GitHub CLI (cli.github.com) to work with pull requests.", checkedAt };
-    }
-    if (detected.state !== "available") return { installed: true, availability: "error", authStatus: "unknown", message: "GitHub CLI was found but could not run. Check its installation and dependencies.", checkedAt };
-    const versionLabel = detected.version ?? "";
-    const auth = await this.run(executable, ["auth", "status", "--hostname", "github.com", "--active"], { cwd: os.tmpdir(), operation: "gh-auth-status" });
-    if (auth.exitCode !== 0) {
-      return { installed: true, availability: "error", authStatus: "unauthenticated", version: versionLabel, message: "Run gh auth login.", checkedAt };
-    }
-    return { installed: true, availability: "ready", authStatus: "authenticated", version: versionLabel, checkedAt };
-  }
   async requireGitHub(repositoryId, operation) {
     const repository = this.repositories.get(repositoryId);
     const info = await this.repositoryInfo(repositoryId);
-    if (!info.isGitHub || !info.nameWithOwner) {
-      throw new GhOperationError({ code: "GH_NOT_GITHUB_REPO", operation, message: "The origin remote does not point to a GitHub repository." });
-    }
-    const status = await this.status();
-    if (!status.installed) throw new GhOperationError({ code: "GH_CLI_NOT_FOUND", operation, message: "GitHub CLI is not installed." });
-    if (status.authStatus === "unauthenticated") throw new GhOperationError({ code: "GH_AUTH_REQUIRED", operation, message: "Sign in with gh auth login to continue." });
-    return { repository, nameWithOwner: info.nameWithOwner };
+    if (!info.isGitHub || !info.nameWithOwner) throw new GhOperationError({ code: "GH_NOT_GITHUB_REPO", operation, message: "The origin remote does not point to a GitHub repository." });
+    const remote = await this.remote(repositoryId);
+    const authenticated = await this.accounts.authenticate(repository, remote, info.nameWithOwner, operation);
+    return { repository, nameWithOwner: info.nameWithOwner, ...authenticated };
   }
   async runGh(args, options) {
-    const detected = await selectCli(this.resolver, this.runner, "gh", { runOptions: { cwd: options.cwd, env: { ...GH_ENV } } });
-    const executable = detected.state === "available" ? detected.candidate : void 0;
-    if (!executable) throw new GhOperationError({ code: "GH_CLI_NOT_FOUND", operation: options.operation, message: "GitHub CLI is not installed." });
-    const result = await this.run(executable, args, options);
-    if (result.exitCode !== 0) throw classifyFailure(result, options.operation);
+    const result = await this.run(options.executable, args, options);
+    if (result.exitCode !== 0) throw classifyFailure({ ...result, stdout: redactCommandToken(result.stdout, options.auth), stderr: redactCommandToken(result.stderr, options.auth) }, options.operation);
     return result;
   }
   async run(executable, args, options) {
     try {
       return await this.runner.run(executable.executable, args, {
         cwd: options.cwd,
-        env: { ...executable.env, ...GH_ENV },
+        env: { ...executable.env, ...GH_ENV, ...options.auth?.env },
+        ...options.auth?.removeEnv ? { removeEnv: options.auth.removeEnv } : {},
         ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
         ...options.maxOutputBytes !== void 0 ? { maxOutputBytes: options.maxOutputBytes } : {},
         ...options.stdin !== void 0 ? { stdin: options.stdin } : {}
       });
     } catch (error) {
-      throw mapRunnerError(error, options.operation);
+      const mapped = mapRunnerError(error, options.operation);
+      throw new GhOperationError({ ...mapped.detail, message: redactCommandToken(mapped.message, options.auth ?? {}) });
     }
   }
 }
@@ -17152,6 +18507,8 @@ ${result.stdout}`.toLowerCase();
   if (/could not resolve|no such host|connection refused|connection reset|network|dial tcp|tls handshake/.test(raw)) {
     return new GhOperationError({ code: "GH_PROCESS_FAILED", operation, message: "Could not connect to GitHub. Check your network and try again.", exitCode: result.exitCode, retryable: true });
   }
+  if (/403|resource not accessible|insufficient.*scope|saml|sso/.test(raw)) return new GhOperationError({ code: "GH_ACCESS_DENIED", operation, message: "This GitHub account cannot perform the operation. Check repository permissions, token permissions and organisation SSO policies.", exitCode: result.exitCode });
+  if (/404|could not resolve to a repository/.test(raw) && operation !== "gh-pr-stack") return new GhOperationError({ code: "GH_ACCESS_DENIED", operation, message: "The repository was not found or is not accessible with this GitHub account.", exitCode: result.exitCode });
   const detail = firstLine(result.stderr) || firstLine(result.stdout);
   return new GhOperationError({ code: "GH_PROCESS_FAILED", operation, message: detail || "GitHub CLI could not complete the operation.", exitCode: result.exitCode });
 }
@@ -17167,6 +18524,50 @@ function mapRunnerError(error, operation) {
 function firstLine(value) {
   return (value.split(/\r?\n/).map((line) => line.trim()).find(Boolean) ?? "").slice(0, 300);
 }
+const statusSchema = object({
+  id: _enum(["codex", "claude", "opencode", "grok"]),
+  label: string(),
+  availability: _enum(["ready", "warning", "error"]),
+  installed: boolean(),
+  authStatus: _enum(["authenticated", "unauthenticated", "unknown"]),
+  installationStatus: _enum(["available", "not-found", "not-executable", "incompatible", "inspection-failed"]).optional(),
+  executablePath: string().optional(),
+  executableSource: _enum(["configured", "process-path", "user-path", "known-location"]).optional(),
+  discoveryWarning: string().optional(),
+  version: string().optional(),
+  message: string().optional(),
+  cliName: string().optional(),
+  models: array(object({ id: string(), label: string(), description: string().optional() })),
+  checkedAt: string().datetime()
+});
+const cacheSchema = object({
+  version: literal(1),
+  key: string(),
+  statuses: array(statusSchema).min(1).max(4)
+}).refine(({ statuses }) => new Set(statuses.map((status) => status.id)).size === statuses.length);
+class AiStatusStore {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  pending = Promise.resolve();
+  async load(key) {
+    await this.pending;
+    try {
+      if ((await stat(this.filePath)).size > 4 * 1024 * 1024) return null;
+      const parsed = cacheSchema.safeParse(JSON.parse(await readFile(this.filePath, "utf8")));
+      return parsed.success && parsed.data.key === key ? parsed.data.statuses : null;
+    } catch {
+      return null;
+    }
+  }
+  save(key, statuses) {
+    const snapshot = cacheSchema.parse({ version: 1, key, statuses });
+    const write = this.pending.then(() => writeFileAtomically(this.filePath, JSON.stringify(snapshot), { parseJson: true }));
+    this.pending = write.catch(() => void 0);
+    return write;
+  }
+}
 const MAX_PROBLEM_LOG_ENTRIES = 500;
 const PROBLEM_LOG_COMPACTION_SLACK = 1.25;
 const LEVELS = ["error", "warn"];
@@ -17567,9 +18968,11 @@ function normalizeRemoteFetchIntervalSeconds(value) {
     Math.max(MIN_REMOTE_FETCH_INTERVAL_SECONDS, stepped)
   );
 }
-const SETTINGS_SCHEMA_VERSION = 1;
+const SETTINGS_SCHEMA_VERSION = 2;
 const defaults = {
   version: SETTINGS_SCHEMA_VERSION,
+  githubAccounts: {},
+  githubDefaultLogin: null,
   recentRepositories: [],
   repositoryProjects: [],
   filesTreeStates: [],
@@ -17596,6 +18999,7 @@ const defaults = {
 };
 const settingsRecordSchema = looseObject({
   version: unknown().optional(),
+  githubAccounts: unknown().optional(),
   recentRepositories: unknown().optional(),
   repositoryProjects: unknown().optional(),
   filesTreeStates: unknown().optional(),
@@ -17672,11 +19076,53 @@ class SettingsStore {
   get windowBounds() {
     return { ...this.data.windowBounds };
   }
+  githubAccount(commonDir) {
+    const selection = this.data.githubAccounts[githubRepositoryKey(commonDir)] ?? AUTOMATIC_GITHUB_ACCOUNT;
+    if (selection.mode === "account" && selection.useGlobalDefault) {
+      if (!this.data.githubDefaultLogin) throw new Error("Choose an OpenTig default account in Settings → GitHub.");
+      return { ...selection, login: this.data.githubDefaultLogin };
+    }
+    return { ...selection };
+  }
+  get githubDefaultLogin() {
+    return this.data.githubDefaultLogin;
+  }
+  async setGitHubDefaultLogin(login2) {
+    const parsed = githubAccountSelectionSchema.parse({ mode: "account", host: "github.com", login: login2 });
+    if (parsed.mode !== "account") throw new Error("Invalid default account.");
+    const previous = this.data.githubDefaultLogin;
+    this.data.githubDefaultLogin = parsed.login;
+    try {
+      await this.save();
+    } catch (error) {
+      if (this.data.githubDefaultLogin === parsed.login) this.data.githubDefaultLogin = previous;
+      throw error;
+    }
+  }
+  async setGitHubAccount(commonDir, selection) {
+    const parsed = githubAccountSelectionSchema.parse(selection);
+    if (parsed.mode === "account" && parsed.useGlobalDefault && parsed.login.toLowerCase() !== this.data.githubDefaultLogin?.toLowerCase()) {
+      throw new Error("The OpenTig default account changed. Review the current account and try again.");
+    }
+    const key = githubRepositoryKey(commonDir);
+    const previous = this.data.githubAccounts[key];
+    if (parsed.mode === "auto") delete this.data.githubAccounts[key];
+    else this.data.githubAccounts[key] = parsed;
+    try {
+      await this.save();
+    } catch (error) {
+      if (this.data.githubAccounts[key] === (parsed.mode === "auto" ? void 0 : parsed)) {
+        if (previous) this.data.githubAccounts[key] = previous;
+        else delete this.data.githubAccounts[key];
+      }
+      throw error;
+    }
+  }
   async touchRepository(repository) {
     const recent = { ...repository, lastOpenedAt: (/* @__PURE__ */ new Date()).toISOString() };
-    this.data.recentRepositories = [recent, ...this.data.recentRepositories.filter((item) => item.id !== repository.id)];
+    const existing = this.data.recentRepositories.some((item) => item.id === repository.id);
+    this.data.recentRepositories = existing ? this.data.recentRepositories.map((item) => item.id === repository.id ? recent : item) : [...this.data.recentRepositories, recent];
     this.data.activeRepositoryId = repository.id;
-    this.pruneRecentRepositories();
     await this.save();
   }
   /**
@@ -17687,6 +19133,12 @@ class SettingsStore {
   async relocateRepository(previousId, repository) {
     const previous = this.data.recentRepositories.find((item) => item.id === previousId);
     if (!previous) throw projectError("Unknown repository.");
+    const previousAccountKey = githubRepositoryKey(previous.commonDir);
+    const nextAccountKey = githubRepositoryKey(repository.commonDir);
+    if (previousAccountKey !== nextAccountKey && this.data.githubAccounts[previousAccountKey]) {
+      this.data.githubAccounts[nextAccountKey] ??= this.data.githubAccounts[previousAccountKey];
+      delete this.data.githubAccounts[previousAccountKey];
+    }
     const previousKey = normalizeRepositoryKey(previous.commonDir);
     const nextKey = normalizeRepositoryKey(repository.commonDir);
     const destinationAlreadyAssigned = this.data.repositoryProjects.some((project) => project.repositoryKeys.some((key) => key === nextKey && key !== previousKey));
@@ -17699,18 +19151,17 @@ class SettingsStore {
     });
     this.data.filesTreeStates = normalizeFilesTreeStates(this.data.filesTreeStates.map((state) => state.repositoryId === previousId ? { ...state, repositoryId: repository.id } : state));
     this.data.openFilesStates = normalizeOpenFilesStates(this.data.openFilesStates.map((state) => state.repositoryId === previousId ? { ...state, repositoryId: repository.id } : state));
-    this.data.recentRepositories = [
-      { ...repository, lastOpenedAt: (/* @__PURE__ */ new Date()).toISOString() },
-      ...this.data.recentRepositories.filter((item) => item.id !== previousId && item.id !== repository.id)
-    ];
+    this.data.recentRepositories = this.data.recentRepositories.flatMap((item) => item.id === previousId ? [{ ...repository, lastOpenedAt: (/* @__PURE__ */ new Date()).toISOString() }] : item.id === repository.id ? [] : [item]);
     this.data.activeRepositoryId = repository.id;
-    this.pruneRecentRepositories();
     await this.save();
   }
   /** Forget the whole repository group, never its directories or Git data. */
   async forgetRepository(repositoryKey) {
     const key = normalizeRepositoryKey(repositoryKey);
     const removedIds = new Set(this.data.recentRepositories.filter((item) => normalizeRepositoryKey(item.commonDir) === key).map((item) => item.id));
+    for (const item of this.data.recentRepositories) {
+      if (removedIds.has(item.id)) delete this.data.githubAccounts[githubRepositoryKey(item.commonDir)];
+    }
     this.data.recentRepositories = this.data.recentRepositories.filter((item) => !removedIds.has(item.id));
     this.data.repositoryProjects = this.data.repositoryProjects.map((project) => ({
       ...project,
@@ -17759,7 +19210,6 @@ class SettingsStore {
   async removeRepositoryProject(projectId) {
     this.getProject(projectId);
     this.data.repositoryProjects = this.data.repositoryProjects.filter((project) => project.id !== projectId);
-    this.pruneRecentRepositories();
     await this.save();
     return this.organization;
   }
@@ -17767,19 +19217,44 @@ class SettingsStore {
     const key = normalizeRepositoryKey(repositoryKey);
     if (!key || key.length > MAX_REPOSITORY_KEY_LENGTH || hasControlCharacters$1(key)) throw projectError("Invalid repository.");
     const target = projectId === null ? null : this.getProject(projectId);
-    if (target && !this.data.recentRepositories.some((repository) => normalizeRepositoryKey(repository.commonDir) === key)) {
+    if (!this.data.recentRepositories.some((repository) => normalizeRepositoryKey(repository.commonDir) === key)) {
       throw projectError("Unknown repository.");
     }
+    if (target?.repositoryKeys.includes(key)) return this.organization;
+    if (target && target.repositoryKeys.length >= MAX_REPOSITORIES_PER_PROJECT) throw projectError("This project is full.");
     this.data.repositoryProjects = this.data.repositoryProjects.map((project) => ({
       ...project,
       repositoryKeys: project.repositoryKeys.filter((item) => item !== key)
     }));
     if (target) {
       const refreshed = this.getProject(target.id);
-      if (refreshed.repositoryKeys.length >= MAX_REPOSITORIES_PER_PROJECT) throw projectError("This project is full.");
       refreshed.repositoryKeys.push(key);
     }
-    this.pruneRecentRepositories();
+    await this.save();
+    return this.organization;
+  }
+  async moveRepositoryProject(projectId, toIndex) {
+    this.data.repositoryProjects = moveToIndex(this.data.repositoryProjects, projectId, toIndex, (project) => project.id);
+    await this.save();
+    return this.organization;
+  }
+  /** Move within the assigned project, or within the unassigned repositories. */
+  async moveRepository(repositoryKey, toIndex) {
+    const key = normalizeRepositoryKey(repositoryKey);
+    const keys = [...new Set(this.data.recentRepositories.map((item) => normalizeRepositoryKey(item.commonDir)))];
+    const known = new Set(keys);
+    const project = this.data.repositoryProjects.find((item) => item.repositoryKeys.includes(key));
+    if (project) {
+      const visible = project.repositoryKeys.filter((item) => known.has(item));
+      project.repositoryKeys = [...moveToIndex(visible, key, toIndex, (item) => item), ...project.repositoryKeys.filter((item) => !known.has(item))];
+    } else {
+      const assigned = new Set(this.data.repositoryProjects.flatMap((item) => item.repositoryKeys));
+      const unassigned = moveToIndex(keys.filter((item) => !assigned.has(item)), key, toIndex, (item) => item);
+      let index = 0;
+      const ordered = keys.map((item) => assigned.has(item) ? item : unassigned[index++]);
+      const positions = new Map(ordered.map((item, position) => [item, position]));
+      this.data.recentRepositories = [...this.data.recentRepositories].sort((a2, b) => positions.get(normalizeRepositoryKey(a2.commonDir)) - positions.get(normalizeRepositoryKey(b.commonDir)));
+    }
     await this.save();
     return this.organization;
   }
@@ -17891,15 +19366,6 @@ class SettingsStore {
       throw projectError("A project with this name already exists.");
     }
   }
-  pruneRecentRepositories() {
-    const assigned = new Set(this.data.repositoryProjects.flatMap((project) => project.repositoryKeys));
-    let unassigned = 0;
-    this.data.recentRepositories = this.data.recentRepositories.filter((repository) => {
-      if (repository.id === this.data.activeRepositoryId || assigned.has(normalizeRepositoryKey(repository.commonDir))) return true;
-      unassigned += 1;
-      return unassigned <= UNASSIGNED_RECENT_LIMIT;
-    });
-  }
 }
 function validate(value, defaultDoubleControlShortcutEnabled) {
   const parsed = settingsRecordSchema.safeParse(value);
@@ -17909,8 +19375,16 @@ function validate(value, defaultDoubleControlShortcutEnabled) {
     return data;
   }
   const input = parsed.data;
-  const recentRepositories = Array.isArray(input.recentRepositories) ? input.recentRepositories.filter(isRecent).map(normalizeRecent).slice(0, 10) : [];
+  const recentRepositories = Array.isArray(input.recentRepositories) ? input.recentRepositories.filter(isRecent).map(normalizeRecent) : [];
   const repositoryProjects = normalizeProjects(input.repositoryProjects);
+  if (input.version !== SETTINGS_SCHEMA_VERSION) {
+    const keys = [...new Set(recentRepositories.map((item) => normalizeRepositoryKey(item.commonDir)))];
+    const known = new Set(keys);
+    for (const project of repositoryProjects) {
+      const assigned = new Set(project.repositoryKeys);
+      project.repositoryKeys = [...keys.filter((key) => assigned.has(key)), ...project.repositoryKeys.filter((key) => !known.has(key))];
+    }
+  }
   const filesTreeStates = normalizeFilesTreeStates(input.filesTreeStates);
   const openFilesStates = normalizeOpenFilesStates(input.openFilesStates);
   const parsedPreferences = preferencesRecordSchema.safeParse(input.preferences);
@@ -17938,6 +19412,8 @@ function validate(value, defaultDoubleControlShortcutEnabled) {
   const windowBounds = bounds && typeof bounds.width === "number" && Number.isFinite(bounds.width) && typeof bounds.height === "number" && Number.isFinite(bounds.height) ? { width: Math.max(900, bounds.width), height: Math.max(600, bounds.height), ...typeof bounds.x === "number" && Number.isFinite(bounds.x) ? { x: bounds.x } : {}, ...typeof bounds.y === "number" && Number.isFinite(bounds.y) ? { y: bounds.y } : {} } : { ...defaults.windowBounds };
   return {
     version: SETTINGS_SCHEMA_VERSION,
+    githubAccounts: normalizeGitHubAccounts(input.githubAccounts),
+    githubDefaultLogin: typeof input.githubDefaultLogin === "string" && githubAccountSelectionSchema.safeParse({ mode: "account", host: "github.com", login: input.githubDefaultLogin }).success ? input.githubDefaultLogin : null,
     recentRepositories,
     repositoryProjects,
     filesTreeStates,
@@ -17990,6 +19466,15 @@ function normalizeWorktreePath(value) {
 function cloneProject(project) {
   return { ...project, repositoryKeys: [...project.repositoryKeys] };
 }
+function moveToIndex(items, key, toIndex, keyOf) {
+  const fromIndex = items.findIndex((item2) => keyOf(item2) === key);
+  if (fromIndex < 0) throw projectError("Unknown project or repository.");
+  if (!Number.isSafeInteger(toIndex) || toIndex < 0 || toIndex >= items.length) throw projectError("Invalid ordering position.");
+  const next = [...items];
+  const [item] = next.splice(fromIndex, 1);
+  next.splice(toIndex, 0, item);
+  return next;
+}
 function cloneFilesTreeState(state) {
   return { ...state, expandedPaths: [...state.expandedPaths] };
 }
@@ -18059,6 +19544,16 @@ function executablePaths(value, strict = false, platform2 = process.platform, ho
   }
   return result;
 }
+function normalizeGitHubAccounts(value) {
+  const result = /* @__PURE__ */ Object.create(null);
+  if (!value || typeof value !== "object" || Array.isArray(value)) return result;
+  for (const [key, selection] of Object.entries(value).slice(0, 1e3)) {
+    if (!key || key.length > MAX_REPOSITORY_KEY_LENGTH || hasControlCharacters$1(key) || !path.isAbsolute(key)) continue;
+    const parsed = githubAccountSelectionSchema.safeParse(selection);
+    if (parsed.success && parsed.data.mode === "account") result[githubRepositoryKey(key)] = parsed.data;
+  }
+  return result;
+}
 class SystemTrash {
   available;
   operation;
@@ -18129,6 +19624,15 @@ class OpenTigRuntime {
     this.lastNotifiedAt = Date.now();
     this.onEvent({ type: "repository.changed", repositoryId, scope });
   }
+  publishGitHubAccountsChange(commonDir, defaultOnly = false) {
+    if (this.closePromise) return;
+    const repositories = this.services.repositories.recents();
+    const repositoryIds = defaultOnly ? repositories.filter((repo) => {
+      const selection = this.settings.githubAccount(repo.commonDir);
+      return selection.mode === "account" && selection.useGlobalDefault;
+    }).map((repo) => repo.id) : commonDir ? repositories.filter((repo) => githubRepositoryKey(repo.commonDir) === githubRepositoryKey(commonDir)).map((repo) => repo.id) : void 0;
+    this.onEvent({ type: "github.accounts-changed", ...repositoryIds ? { repositoryIds } : {}, ...defaultOnly ? { inventoryChanged: true } : {} });
+  }
   publishActiveRepositoryChange(repository) {
     if (!this.closePromise) this.onEvent({ type: "repository.active-changed", repository });
   }
@@ -18187,10 +19691,25 @@ async function createOpenTigRuntime(options) {
   ];
   const aiLog = new AiLogStore(options.aiLogPath);
   await aiLog.load();
-  const ai = new CommitMessageService(operations, providers, aiLog, () => cliResolver.invalidate());
+  const ai = new CommitMessageService(operations, providers, aiLog, () => cliResolver.invalidate(), {
+    store: new AiStatusStore(path.join(path.dirname(options.settingsPath), "ai-statuses.json")),
+    key: () => aiExecutablePathsKey(settings.preferences.aiExecutablePaths)
+  });
   const prDrafts = new PullRequestDraftService(operations, providers, aiLog);
-  const github = new GitHubService(cliResolver, cliRunner, git, repositories);
   let runtime = null;
+  const githubAccounts = new GitHubAccountsService(
+    cliResolver,
+    cliRunner,
+    git,
+    settings,
+    new GitHubStatusStore(path.join(path.dirname(options.settingsPath), "github-status.json")),
+    (repository, defaultOnly) => runtime?.publishGitHubAccountsChange(repository?.commonDir, defaultOnly)
+  );
+  const gitAccess = new RepositoryGitAccess(git, repositories, githubAccounts, cliRunner);
+  gitAccess.install();
+  operations.access = gitAccess;
+  const github = new GitHubService(cliResolver, cliRunner, git, repositories, githubAccounts);
+  github.gitAccess = gitAccess;
   const events = {
     repositoryChanged: (repositoryId, scope) => {
       runtime?.publishRepositoryChange(repositoryId, scope);
@@ -18357,6 +19876,10 @@ const IPC = {
   projectRename: "projects:rename",
   projectRemove: "projects:remove",
   projectAssign: "projects:assign",
+  projectMove: "projects:move",
+  projectMoveRepository: "projects:move-repository",
+  repositoryPreparePath: "repository:prepare-path",
+  repositoryCompleteSetup: "repository:complete-setup",
   repositoryOpenPath: "repository:open-path",
   repositoryBrowseDirectories: "repository:browse-directories",
   repositoryOpenRecent: "repository:open-recent",
@@ -18399,18 +19922,25 @@ const IPC = {
   commitUndoLatest: "commit:undo-latest",
   commitsList: "commits:list",
   commitsFiles: "commits:files",
+  commitAuthorship: "commits:authorship",
+  commitSetAuthorship: "commits:set-authorship",
   branchesList: "refs:branches",
   branchSwitch: "refs:switch",
   worktreesList: "refs:worktrees",
   worktreeSelect: "refs:select-worktree",
   refsPull: "refs:pull",
   refsPush: "refs:push",
+  refsPushContext: "refs:push-context",
   refsFetch: "refs:fetch",
   localRefsSnapshot: "refs:local-snapshot",
   branchDetails: "refs:branch-details",
   worktreeDetails: "refs:worktree-details",
   branchDelete: "refs:delete-branch",
   worktreeRemove: "refs:remove-worktree",
+  remoteBranchDetails: "refs:remote-branch-details",
+  trackingBranchCreate: "refs:create-tracking-branch",
+  remoteBranchDelete: "refs:delete-remote-branch",
+  branchesFetch: "refs:fetch-branches",
   aiStatuses: "ai:statuses",
   aiGenerateCommitMessage: "ai:generate-commit-message",
   aiCancelGeneration: "ai:cancel-generation",
@@ -18419,6 +19949,10 @@ const IPC = {
   diagnosticsList: "diagnostics:list",
   diagnosticsClear: "diagnostics:clear",
   diagnosticsRecord: "diagnostics:record",
+  githubAccountsStatus: "github:accounts-status",
+  githubSetDefaultAccount: "github:set-default-account",
+  githubRepositoryAccount: "github:repository-account",
+  githubSetRepositoryAccount: "github:set-repository-account",
   githubStatus: "github:status",
   githubRepositoryInfo: "github:repository-info",
   githubPrForBranch: "github:pr-for-branch",
@@ -18445,6 +19979,10 @@ const OPEN_TIG_SERVER_COMMANDS = {
   "projects.rename": command(IPC.projectRename, "project-rename", true),
   "projects.remove": command(IPC.projectRemove, "project-remove", true),
   "projects.assign": command(IPC.projectAssign, "project-assign", true),
+  "projects.moveProject": command(IPC.projectMove, "project-move", true),
+  "projects.moveRepository": command(IPC.projectMoveRepository, "project-move-repository", true),
+  "repository.preparePath": command(IPC.repositoryPreparePath, "prepare-path", false),
+  "repository.completeSetup": command(IPC.repositoryCompleteSetup, "complete-setup", true),
   "repository.openPath": command(IPC.repositoryOpenPath, "open-path", true),
   "repository.browseDirectories": command(IPC.repositoryBrowseDirectories, "browse-directories", false),
   "repository.openRecent": command(IPC.repositoryOpenRecent, "open-recent", true),
@@ -18484,6 +20022,8 @@ const OPEN_TIG_SERVER_COMMANDS = {
   "index.updateConflict": command(IPC.indexUpdateConflict, "update-conflict", true, { maxRequestBytes: CONTENT_MAX_REQUEST_BYTES }),
   "index.resolveConflict": command(IPC.indexResolveConflict, "resolve-conflict", true, { maxRequestBytes: CONTENT_MAX_REQUEST_BYTES }),
   "commits.create": command(IPC.commitCreate, "commit", true),
+  "commits.authorship": command(IPC.commitAuthorship, "commit-authorship-read", false),
+  "commits.setAuthorship": command(IPC.commitSetAuthorship, "commit-authorship-set", true),
   "commits.undoLatest": command(IPC.commitUndoLatest, "undo-latest-commit", true),
   "commits.list": command(IPC.commitsList, "history", false),
   "commits.files": command(IPC.commitsFiles, "commit-files", false),
@@ -18492,10 +20032,15 @@ const OPEN_TIG_SERVER_COMMANDS = {
   "refs.listWorktrees": command(IPC.worktreesList, "worktrees", false),
   "refs.selectWorktree": command(IPC.worktreeSelect, "select-worktree", true),
   "refs.pull": command(IPC.refsPull, "pull", true),
+  "refs.pushContext": command(IPC.refsPushContext, "push-context", false),
   "refs.push": command(IPC.refsPush, "push", true),
   "refs.fetch": command(IPC.refsFetch, "fetch", true),
   "refs.localRefsSnapshot": command(IPC.localRefsSnapshot, "local-refs-snapshot", false),
   "refs.branchDetails": command(IPC.branchDetails, "branch-details", false),
+  "refs.remoteBranchDetails": command(IPC.remoteBranchDetails, "remote-branch-details", false, { timeoutMs: 12e4 }),
+  "refs.createTrackingBranch": command(IPC.trackingBranchCreate, "create-tracking-branch", true),
+  "refs.deleteRemoteBranch": command(IPC.remoteBranchDelete, "delete-remote-branch", true, { timeoutMs: 18e4 }),
+  "refs.fetchBranches": command(IPC.branchesFetch, "fetch-branches", true, { timeoutMs: 18e4 }),
   "refs.worktreeDetails": command(IPC.worktreeDetails, "worktree-details", false),
   "refs.deleteBranch": command(IPC.branchDelete, "delete-branch", true),
   "refs.removeWorktree": command(IPC.worktreeRemove, "remove-worktree", true),
@@ -18504,6 +20049,10 @@ const OPEN_TIG_SERVER_COMMANDS = {
   "ai.log": command(IPC.aiLog, "ai-log", false),
   "ai.clearLog": command(IPC.aiClearLog, "ai-clear-log", true),
   "ai.cancelGeneration": command(IPC.aiCancelGeneration, "ai-cancel-generation", true),
+  "github.accountsStatus": command(IPC.githubAccountsStatus, "gh-accounts-status", false, { timeoutMs: 9e4 }),
+  "github.repositoryAccount": command(IPC.githubRepositoryAccount, "gh-repository-account", false, { timeoutMs: 6e4 }),
+  "github.setDefaultAccount": command(IPC.githubSetDefaultAccount, "gh-set-default-account", true),
+  "github.setRepositoryAccount": command(IPC.githubSetRepositoryAccount, "gh-set-repository-account", true),
   "github.status": command(IPC.githubStatus, "gh-status", false),
   "github.repositoryInfo": command(IPC.githubRepositoryInfo, "gh-repository-info", false),
   "github.findPullRequestForBranch": command(IPC.githubPrForBranch, "gh-pr-for-branch", false),
@@ -18730,10 +20279,10 @@ async function inspectRepository(path2, git) {
 }
 const requestRecordSchema = looseObject({});
 function boundedStringSchema(maxLength, options = {}) {
-  let schema = string().max(maxLength).refine((value) => !value.includes("\0"));
-  if (options.empty !== true) schema = schema.min(1);
-  if (options.controls === false) return schema;
-  return schema.refine((value) => ![...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127));
+  let schema2 = string().max(maxLength).refine((value) => !value.includes("\0"));
+  if (options.empty !== true) schema2 = schema2.min(1);
+  if (options.controls === false) return schema2;
+  return schema2.refine((value) => ![...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127));
 }
 const booleanWithDefaultSchema = (fallback) => boolean().optional().default(fallback);
 function parseRecord(value) {
@@ -18884,6 +20433,22 @@ function deleteBranchArg(value, operation) {
     force: booleanArg(request.force, operation)
   };
 }
+function createTrackingBranchArg(value) {
+  const operation = "create-tracking-branch";
+  const request = requestObject(value, operation);
+  return {
+    ...branchDetailsArg(request, operation),
+    expectedOid: oidArg(request.expectedOid, operation),
+    localName: refsString(request.localName, operation, MAX_BRANCH_REF_LENGTH)
+  };
+}
+function deleteRemoteBranchArg(value) {
+  const operation = "delete-remote-branch";
+  const request = requestObject(value, operation);
+  const destinationId = refsString(request.destinationId, operation, 64);
+  if (!/^[0-9a-f]{64}$/.test(destinationId)) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation, message: "Invalid remote destination." });
+  return { ...branchDetailsArg(request, operation), expectedOid: oidArg(request.expectedOid, operation), destinationId };
+}
 function removeWorktreeArg(value, operation) {
   const request = requestObject(value, operation);
   return {
@@ -18981,7 +20546,16 @@ function createPullRequestArg(value) {
   if (typeof input.base !== "string" || !input.base || input.base.length > 300 || input.base.includes("\0")) throw invalidGh(operation);
   if (typeof input.draft !== "boolean") throw invalidGh(operation);
   if (typeof input.repositoryId !== "string" || !input.repositoryId || input.repositoryId.length > 64) throw invalidGh(operation);
-  return { repositoryId: input.repositoryId, title: input.title.trim(), body: input.body, base: input.base, draft: input.draft };
+  const expected = input.expectedAccount;
+  if (expected !== void 0 && (!expected || typeof expected.login !== "string" || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/.test(expected.login) || !Number.isSafeInteger(expected.revision) || expected.revision < 0)) throw invalidGh(operation);
+  return {
+    repositoryId: input.repositoryId,
+    title: input.title.trim(),
+    body: input.body,
+    base: input.base,
+    draft: input.draft,
+    ...expected ? { expectedAccount: { login: expected.login, revision: expected.revision } } : {}
+  };
 }
 function generatePullRequestDraftArg(value) {
   const operation = "ai-pr-draft";
@@ -19023,6 +20597,10 @@ function invalidAi(operation) {
 function invalidProject(operation) {
   return new GitOperationError({ code: "INVALID_ARGUMENT", operation, message: "Invalid project data." });
 }
+function orderingIndexArg(value, operation) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw invalidProject(operation);
+  return value;
+}
 function registerServerCommands(registry2, services, host) {
   const serverDefinitions = new Map(
     Object.values(OPEN_TIG_SERVER_COMMANDS).map((definition) => [definition.command, definition])
@@ -19069,8 +20647,9 @@ function registerServerCommands(registry2, services, host) {
     };
   });
   handle(IPC.preferences, "preferences", async (partial2) => {
+    const previousPaths = aiExecutablePathsKey(services.settings.preferences.aiExecutablePaths);
     const preferences = await services.settings.setPreferences(partial2 ?? {});
-    if (partial2 && typeof partial2 === "object" && "aiExecutablePaths" in partial2) services.ai.invalidateStatuses();
+    if (previousPaths !== aiExecutablePathsKey(preferences.aiExecutablePaths)) services.ai.invalidateStatuses();
     return preferences;
   });
   handle(IPC.filesTreeStateUpdate, "files-tree-state", (repositoryId, expandedPaths) => {
@@ -19085,6 +20664,22 @@ function registerServerCommands(registry2, services, host) {
   handle(IPC.projectRename, "project-rename", (projectId, name) => services.settings.renameRepositoryProject(projectIdArg(projectId, "project-rename"), projectNameArg(name, "project-rename")));
   handle(IPC.projectRemove, "project-remove", (projectId) => services.settings.removeRepositoryProject(projectIdArg(projectId, "project-remove")));
   handle(IPC.projectAssign, "project-assign", (repositoryKey, projectId) => services.settings.assignRepositoryProject(repositoryKeyArg(repositoryKey, "project-assign"), nullableProjectIdArg(projectId, "project-assign")));
+  handle(IPC.projectMove, "project-move", (projectId, toIndex) => services.settings.moveRepositoryProject(projectIdArg(projectId, "project-move"), orderingIndexArg(toIndex, "project-move")));
+  handle(IPC.projectMoveRepository, "project-move-repository", (repositoryKey, toIndex) => services.settings.moveRepository(repositoryKeyArg(repositoryKey, "project-move-repository"), orderingIndexArg(toIndex, "project-move-repository")));
+  handle(IPC.repositoryPreparePath, "prepare-path", (path2) => services.repositories.preparePath(stringArg(path2, "prepare-path", 32768)));
+  handleWithContext(IPC.repositoryCompleteSetup, "complete-setup", async (context, id, revision2) => {
+    const repositoryId = stringArg(id, "complete-setup", 64);
+    if (typeof revision2 !== "number" || !Number.isSafeInteger(revision2) || revision2 < 0) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "complete-setup", message: "Invalid account revision." });
+    const repository = await services.repositories.completeSetup(repositoryId, () => {
+      if (revision2 !== services.github.accounts.revisionFor(services.repositories.get(repositoryId))) {
+        throw new Error("The repository account changed. Reload setup and review it again.");
+      }
+    });
+    fileClipboardState(context).pendingCut = null;
+    services.watcher.start(repository);
+    services.events.activeRepositoryChanged(repository);
+    return repository;
+  });
   handleWithContext(IPC.repositoryOpenPath, "open-path", (context, selectedPath) => openRepositoryPath(
     stringArg(selectedPath, "open-path", 32768),
     context
@@ -19329,6 +20924,17 @@ function registerServerCommands(registry2, services, host) {
     textArg(content, "update-conflict", 8 * 1024 * 1024)
   ));
   handle(IPC.commitCreate, "commit", (id, message) => services.operations.createCommit(stringArg(id, "commit", 64), stringArg(message, "commit", 1e5)));
+  handle(IPC.commitAuthorship, "commit-authorship-read", (id) => services.operations.getCommitAuthorship(stringArg(id, "commit-authorship-read", 64)));
+  handle(IPC.commitSetAuthorship, "commit-authorship-set", async (id, input) => {
+    const repositoryId = stringArg(id, "commit-authorship-set", 64);
+    const parsed = commitAuthorshipInputSchema.safeParse(input);
+    if (!parsed.success) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "commit-authorship-set", message: "Enter a valid name, email and reviewed identity." });
+    const result = await services.operations.setCommitAuthorship(repositoryId, parsed.data);
+    const repository = services.repositories.get(repositoryId);
+    const ids = /* @__PURE__ */ new Set([repositoryId, ...services.repositories.recents().filter((item) => item.commonDir === repository.commonDir).map((item) => item.id)]);
+    for (const siblingId of ids) services.events.repositoryChanged(siblingId, "unknown");
+    return result;
+  });
   handle(IPC.commitUndoLatest, "undo-latest-commit", (id, expectedOid) => services.operations.undoLatestCommit(
     stringArg(id, "undo-latest-commit", 64),
     oidArg(expectedOid, "undo-latest-commit")
@@ -19353,6 +20959,13 @@ function registerServerCommands(registry2, services, host) {
     const { repositoryId, fullName } = branchDetailsArg(request, "branch-details");
     return services.operations.branchDetails(repositoryId, fullName);
   });
+  handle(IPC.remoteBranchDetails, "remote-branch-details", (request) => {
+    const { repositoryId, fullName } = branchDetailsArg(request, "remote-branch-details");
+    return services.operations.remoteBranchDetails(repositoryId, fullName);
+  });
+  handle(IPC.trackingBranchCreate, "create-tracking-branch", (request) => services.operations.createTrackingBranch(createTrackingBranchArg(request)));
+  handle(IPC.remoteBranchDelete, "delete-remote-branch", (request) => services.operations.deleteRemoteBranch(deleteRemoteBranchArg(request)));
+  handle(IPC.branchesFetch, "fetch-branches", (id) => services.operations.fetchBranches(stringArg(id, "fetch-branches", 64)));
   handle(IPC.worktreeDetails, "worktree-details", (request) => {
     const { repositoryId, path: path2 } = worktreeDetailsArg(request, "worktree-details");
     return services.operations.worktreeDetails(repositoryId, path2);
@@ -19366,7 +20979,8 @@ function registerServerCommands(registry2, services, host) {
     return services.operations.removeWorktree(repositoryId, path2, expectedOid, force, deleteBranch);
   });
   handle(IPC.refsPull, "pull", (id) => services.operations.pull(stringArg(id, "pull", 64)));
-  handle(IPC.refsPush, "push", (id, publish) => services.operations.push(stringArg(id, "push", 64), publishBranchArg(publish)));
+  handle(IPC.refsPushContext, "push-context", (id, remote) => services.operations.publicationContext(stringArg(id, "push-context", 64), remote == null ? void 0 : stringArg(remote, "push-context", 512)));
+  handle(IPC.refsPush, "push", (id, publish, expected) => services.operations.push(stringArg(id, "push", 64), publishBranchArg(publish), expected == null ? void 0 : stringArg(expected, "push", 64)));
   handle(IPC.refsFetch, "fetch", (id) => services.operations.fetch(stringArg(id, "fetch", 64)));
   handle(IPC.aiStatuses, "ai-statuses", (forceRefresh) => services.ai.statuses(booleanArg(forceRefresh, "ai-statuses")));
   handleWithContext(IPC.aiGenerateCommitMessage, "ai-generate-commit-message", (context, input) => services.ai.generate(generateCommitMessageArg(input), context.signal));
@@ -19390,6 +21004,15 @@ function registerServerCommands(registry2, services, host) {
   handle(IPC.aiCancelGeneration, "ai-cancel-generation", (requestId2) => {
     services.ai.cancel(aiString(requestId2, "ai-cancel-generation", 100, true));
   });
+  handle(IPC.githubAccountsStatus, "gh-accounts-status", (forceRefresh) => services.github.accounts.status(booleanArg(forceRefresh, "gh-accounts-status")));
+  handle(IPC.githubSetDefaultAccount, "gh-set-default-account", (login2) => services.github.accounts.setDefaultAccount(stringArg(login2, "gh-set-default-account", 39)));
+  handle(IPC.githubRepositoryAccount, "gh-repository-account", (id, forceRefresh) => services.github.repositoryAccount(stringArg(id, "gh-repository-account", 64), booleanArg(forceRefresh, "gh-repository-account")));
+  handle(IPC.githubSetRepositoryAccount, "gh-set-repository-account", (id, selection, expectedRevision) => {
+    const parsed = githubAccountSelectionSchema.safeParse(selection);
+    if (expectedRevision !== void 0 && (typeof expectedRevision !== "number" || !Number.isSafeInteger(expectedRevision) || expectedRevision < 0)) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "gh-set-repository-account", message: "Invalid account revision." });
+    if (!parsed.success) throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "gh-set-repository-account", message: "Invalid GitHub account selection." });
+    return services.github.setRepositoryAccount(stringArg(id, "gh-set-repository-account", 64), parsed.data, typeof expectedRevision === "number" ? expectedRevision : void 0);
+  });
   handle(IPC.githubStatus, "gh-status", (forceRefresh) => services.github.status(booleanArg(forceRefresh, "gh-status")));
   handle(IPC.githubRepositoryInfo, "gh-repository-info", (id) => services.github.repositoryInfo(stringArg(id, "gh-repository-info", 64)));
   handle(IPC.githubPrForBranch, "gh-pr-for-branch", (id, branchName) => services.github.findPullRequestForBranch(
@@ -19439,7 +21062,7 @@ function clipboardImageArg(value) {
   if (value instanceof Uint8Array) return value;
   throw new GitOperationError({ code: "INVALID_ARGUMENT", operation: "paste-entries", message: "Invalid clipboard image." });
 }
-const protocolVersion = 1;
+const protocolVersion = 4;
 const protocolMetadata = {
   protocolVersion
 };
@@ -19455,6 +21078,85 @@ function preferredServerPort(profile) {
 }
 const AUTH_DATA_VERSION = 4;
 const BROWSER_SESSION_MAX_AGE_SECONDS = 30 * 24 * 60 * 60;
+async function hasActiveBrowserSessions(directory, now = Date.now) {
+  const { sessions } = await loadSessions(path.join(directory, "sessions.json"));
+  return sessions.some((session) => session.kind !== "desktop" && session.expiresAt !== null && now() < Date.parse(session.expiresAt));
+}
+async function loadSessions(filePath) {
+  try {
+    const parsed = JSON.parse(await readFile(filePath, "utf8"));
+    if (isLegacyAuthData(parsed)) {
+      await chmod(filePath, 384);
+      return {
+        sessions: parsed.sessions.map((session) => ({
+          ...session,
+          kind: "legacy",
+          expiresAt: sessionExpiry("legacy", session.createdAt),
+          clientName: "Legacy browser session",
+          deviceType: "unknown",
+          os: null,
+          browser: null,
+          remoteAddress: null,
+          viaProxy: false,
+          lastConnectedAt: null
+        })),
+        migrated: true
+      };
+    }
+    if (isVersionTwoAuthData(parsed)) {
+      await chmod(filePath, 384);
+      return {
+        sessions: parsed.sessions.map((session) => ({
+          ...session,
+          expiresAt: sessionExpiry(session.kind, session.createdAt),
+          clientName: session.kind === "legacy" ? "Legacy browser session" : session.clientName,
+          deviceType: session.kind === "desktop" ? "desktop" : "unknown",
+          os: null,
+          browser: session.kind === "browser" ? session.clientName : null,
+          viaProxy: false,
+          lastConnectedAt: null
+        })),
+        migrated: true
+      };
+    }
+    if (isVersionThreeAuthData(parsed)) {
+      await chmod(filePath, 384);
+      return {
+        sessions: parsed.sessions.map((session) => ({ ...session, expiresAt: sessionExpiry(session.kind, session.createdAt) })),
+        migrated: true
+      };
+    }
+    if (!isAuthData(parsed)) throw corrupt$1("session data");
+    await chmod(filePath, 384);
+    return { sessions: parsed.sessions.map((session) => ({ ...session })), migrated: false };
+  } catch (error) {
+    if (error.code === "ENOENT") return { sessions: [], migrated: false };
+    if (error instanceof SyntaxError) throw corrupt$1("session data");
+    throw error;
+  }
+}
+function isAuthData(value) {
+  const data = value;
+  return Boolean(data && data.version === AUTH_DATA_VERSION && isVersionThreeAuthData({ ...data, version: 3 }) && data.sessions?.every((session) => session.kind === "desktop" ? session.expiresAt === null : typeof session.expiresAt === "string" && Number.isFinite(Date.parse(session.expiresAt)) && Date.parse(session.expiresAt) > Date.parse(session.createdAt)));
+}
+function isVersionThreeAuthData(value) {
+  const data = value;
+  return Boolean(data && data.version === 3 && Array.isArray(data.sessions) && data.sessions.every((session) => session && typeof session.id === "string" && /^[A-Za-z0-9_-]{24}$/.test(session.id) && typeof session.digest === "string" && /^[A-Za-z0-9_-]{43}$/.test(session.digest) && (session.kind === "desktop" || session.kind === "browser" || session.kind === "legacy") && typeof session.clientName === "string" && session.clientName.length > 0 && session.clientName.length <= 160 && (session.deviceType === "desktop" || session.deviceType === "mobile" || session.deviceType === "tablet" || session.deviceType === "bot" || session.deviceType === "unknown") && (session.os === null || typeof session.os === "string" && session.os.length <= 80) && (session.browser === null || typeof session.browser === "string" && session.browser.length <= 80) && (session.remoteAddress === null || typeof session.remoteAddress === "string" && session.remoteAddress.length <= 128) && typeof session.viaProxy === "boolean" && typeof session.createdAt === "string" && !Number.isNaN(Date.parse(session.createdAt)) && (session.lastConnectedAt === null || typeof session.lastConnectedAt === "string" && !Number.isNaN(Date.parse(session.lastConnectedAt)))));
+}
+function isVersionTwoAuthData(value) {
+  const data = value;
+  return Boolean(data && data.version === 2 && Array.isArray(data.sessions) && data.sessions.every((session) => session && typeof session.id === "string" && /^[A-Za-z0-9_-]{24}$/.test(session.id) && typeof session.digest === "string" && /^[A-Za-z0-9_-]{43}$/.test(session.digest) && (session.kind === "desktop" || session.kind === "browser" || session.kind === "legacy") && typeof session.clientName === "string" && session.clientName.length > 0 && session.clientName.length <= 160 && (session.remoteAddress === null || typeof session.remoteAddress === "string" && session.remoteAddress.length <= 128) && typeof session.createdAt === "string" && !Number.isNaN(Date.parse(session.createdAt))));
+}
+function isLegacyAuthData(value) {
+  const data = value;
+  return Boolean(data && data.version === 1 && Array.isArray(data.sessions) && data.sessions.every((session) => session && typeof session.id === "string" && /^[A-Za-z0-9_-]{24}$/.test(session.id) && typeof session.digest === "string" && /^[A-Za-z0-9_-]{43}$/.test(session.digest) && typeof session.createdAt === "string" && !Number.isNaN(Date.parse(session.createdAt))));
+}
+function corrupt$1(name) {
+  return new Error(`OpenTig authentication ${name} is corrupt.`);
+}
+function sessionExpiry(kind, createdAt) {
+  return kind === "desktop" ? null : new Date(Date.parse(createdAt) + BROWSER_SESSION_MAX_AGE_SECONDS * 1e3).toISOString();
+}
 const SECRET_BYTES = 32;
 const SECRET_FILE = "server-secret";
 const SESSIONS_FILE = "sessions.json";
@@ -19470,6 +21172,10 @@ class PersistentAuthStore {
   now;
   sessions;
   mutationQueue = Promise.resolve();
+  /** Inspect an existing installation without issuing, revoking, or writing sessions. */
+  static async hasActiveBrowserSessions(directory, now = Date.now) {
+    return hasActiveBrowserSessions(directory, now);
+  }
   static async open(directory, now = Date.now) {
     const resolved = path.resolve(directory);
     await mkdir(resolved, { recursive: true, mode: 448 });
@@ -19527,9 +21233,9 @@ class PersistentAuthStore {
     });
   }
   renewBrowserSession(token) {
-    const digest = this.digestCredential(token);
+    const digest2 = this.digestCredential(token);
     return this.mutate((sessions) => {
-      const index = sessions.findIndex((session2) => session2.kind !== "desktop" && constantTimeEqual(digest, session2.digest) && this.isActive(session2));
+      const index = sessions.findIndex((session2) => session2.kind !== "desktop" && constantTimeEqual(digest2, session2.digest) && this.isActive(session2));
       if (index < 0) return { next: sessions, result: false };
       const session = sessions[index];
       const expiresAt = sessionExpiry(session.kind, new Date(this.now()).toISOString());
@@ -19659,75 +21365,6 @@ async function loadOrCreateSecret(filePath) {
     throw error;
   }
 }
-async function loadSessions(filePath) {
-  try {
-    const parsed = JSON.parse(await readFile(filePath, "utf8"));
-    if (isLegacyAuthData(parsed)) {
-      await chmod(filePath, 384);
-      return {
-        sessions: parsed.sessions.map((session) => ({
-          ...session,
-          kind: "legacy",
-          expiresAt: sessionExpiry("legacy", session.createdAt),
-          clientName: "Legacy browser session",
-          deviceType: "unknown",
-          os: null,
-          browser: null,
-          remoteAddress: null,
-          viaProxy: false,
-          lastConnectedAt: null
-        })),
-        migrated: true
-      };
-    }
-    if (isVersionTwoAuthData(parsed)) {
-      await chmod(filePath, 384);
-      return {
-        sessions: parsed.sessions.map((session) => ({
-          ...session,
-          expiresAt: sessionExpiry(session.kind, session.createdAt),
-          clientName: session.kind === "legacy" ? "Legacy browser session" : session.clientName,
-          deviceType: session.kind === "desktop" ? "desktop" : "unknown",
-          os: null,
-          browser: session.kind === "browser" ? session.clientName : null,
-          viaProxy: false,
-          lastConnectedAt: null
-        })),
-        migrated: true
-      };
-    }
-    if (isVersionThreeAuthData(parsed)) {
-      await chmod(filePath, 384);
-      return {
-        sessions: parsed.sessions.map((session) => ({ ...session, expiresAt: sessionExpiry(session.kind, session.createdAt) })),
-        migrated: true
-      };
-    }
-    if (!isAuthData(parsed)) throw corrupt("session data");
-    await chmod(filePath, 384);
-    return { sessions: parsed.sessions.map((session) => ({ ...session })), migrated: false };
-  } catch (error) {
-    if (error.code === "ENOENT") return { sessions: [], migrated: false };
-    if (error instanceof SyntaxError) throw corrupt("session data");
-    throw error;
-  }
-}
-function isAuthData(value) {
-  const data = value;
-  return Boolean(data && data.version === AUTH_DATA_VERSION && isVersionThreeAuthData({ ...data, version: 3 }) && data.sessions?.every((session) => session.kind === "desktop" ? session.expiresAt === null : typeof session.expiresAt === "string" && Number.isFinite(Date.parse(session.expiresAt)) && Date.parse(session.expiresAt) > Date.parse(session.createdAt)));
-}
-function isVersionThreeAuthData(value) {
-  const data = value;
-  return Boolean(data && data.version === 3 && Array.isArray(data.sessions) && data.sessions.every((session) => session && typeof session.id === "string" && /^[A-Za-z0-9_-]{24}$/.test(session.id) && typeof session.digest === "string" && /^[A-Za-z0-9_-]{43}$/.test(session.digest) && (session.kind === "desktop" || session.kind === "browser" || session.kind === "legacy") && typeof session.clientName === "string" && session.clientName.length > 0 && session.clientName.length <= 160 && (session.deviceType === "desktop" || session.deviceType === "mobile" || session.deviceType === "tablet" || session.deviceType === "bot" || session.deviceType === "unknown") && (session.os === null || typeof session.os === "string" && session.os.length <= 80) && (session.browser === null || typeof session.browser === "string" && session.browser.length <= 80) && (session.remoteAddress === null || typeof session.remoteAddress === "string" && session.remoteAddress.length <= 128) && typeof session.viaProxy === "boolean" && typeof session.createdAt === "string" && !Number.isNaN(Date.parse(session.createdAt)) && (session.lastConnectedAt === null || typeof session.lastConnectedAt === "string" && !Number.isNaN(Date.parse(session.lastConnectedAt)))));
-}
-function isVersionTwoAuthData(value) {
-  const data = value;
-  return Boolean(data && data.version === 2 && Array.isArray(data.sessions) && data.sessions.every((session) => session && typeof session.id === "string" && /^[A-Za-z0-9_-]{24}$/.test(session.id) && typeof session.digest === "string" && /^[A-Za-z0-9_-]{43}$/.test(session.digest) && (session.kind === "desktop" || session.kind === "browser" || session.kind === "legacy") && typeof session.clientName === "string" && session.clientName.length > 0 && session.clientName.length <= 160 && (session.remoteAddress === null || typeof session.remoteAddress === "string" && session.remoteAddress.length <= 128) && typeof session.createdAt === "string" && !Number.isNaN(Date.parse(session.createdAt))));
-}
-function isLegacyAuthData(value) {
-  const data = value;
-  return Boolean(data && data.version === 1 && Array.isArray(data.sessions) && data.sessions.every((session) => session && typeof session.id === "string" && /^[A-Za-z0-9_-]{24}$/.test(session.id) && typeof session.digest === "string" && /^[A-Za-z0-9_-]{43}$/.test(session.digest) && typeof session.createdAt === "string" && !Number.isNaN(Date.parse(session.createdAt))));
-}
 function constantTimeEqual(left, right) {
   const leftBytes = Buffer.from(left);
   const rightBytes = Buffer.from(right);
@@ -19745,17 +21382,15 @@ async function exists(filePath) {
 function corrupt(name) {
   return new Error(`OpenTig authentication ${name} is corrupt.`);
 }
-function sessionExpiry(kind, createdAt) {
-  return kind === "desktop" ? null : new Date(Date.parse(createdAt) + BROWSER_SESSION_MAX_AGE_SECONDS * 1e3).toISOString();
-}
 const DEFAULT_PAIRING_TTL_MS = 5 * 60 * 1e3;
 class OpenTigSessionAuth {
-  constructor(source, store, secureCookies, now, profile) {
+  constructor(source, store, secureCookies, now, profile, browserAccessEnabled) {
     this.source = source;
     this.store = store;
     this.secureCookies = secureCookies;
     this.now = now;
     this.profile = profile;
+    this.browserAccessEnabled = browserAccessEnabled;
   }
   source;
   store;
@@ -19763,15 +21398,30 @@ class OpenTigSessionAuth {
   now;
   profile;
   pairing = null;
+  browserAccessEnabled;
+  browserGeneration = 0;
+  browserQueue = Promise.resolve();
   static async open(options) {
     const store = await PersistentAuthStore.open(options.dataDirectory, options.now);
-    return new OpenTigSessionAuth(options.source, store, options.secureCookies ?? false, options.now ?? Date.now, options.profile ?? "production");
+    return new OpenTigSessionAuth(options.source, store, options.secureCookies ?? false, options.now ?? Date.now, options.profile ?? "production", options.browserAccessEnabled ?? true);
   }
   descriptor() {
     this.dropExpiredPairing();
-    return { authenticationRequired: true, pairingAvailable: this.pairing !== null };
+    return { authenticationRequired: true, pairingAvailable: this.browserAccessEnabled && this.pairing !== null, browserAccessEnabled: this.browserAccessEnabled };
+  }
+  setBrowserAccessEnabled(enabled) {
+    if (!enabled) {
+      this.browserAccessEnabled = false;
+      this.browserGeneration++;
+      this.pairing = null;
+    }
+    const generation = this.browserGeneration;
+    return this.queueBrowserMutation(async () => {
+      this.browserAccessEnabled = enabled && generation === this.browserGeneration;
+    });
   }
   createPairingToken(ttlMs = DEFAULT_PAIRING_TTL_MS) {
+    if (!this.browserAccessEnabled) throw new Error("Web access is disabled.");
     if (!Number.isSafeInteger(ttlMs) || ttlMs < 1e3 || ttlMs > 15 * 60 * 1e3) throw new Error("Invalid pairing token lifetime.");
     const token = randomBytes(32).toString("base64url");
     const expiresAt = this.now() + ttlMs;
@@ -19793,30 +21443,43 @@ class OpenTigSessionAuth {
   async exchangePairingToken(token, metadata, secure = false) {
     this.dropExpiredPairing();
     const pairing = this.pairing;
-    if (!pairing || !isCredential(token) || !this.store.matchesDigest(token, pairing.digest)) return null;
+    if (!this.browserAccessEnabled || !pairing || !isCredential(token) || !this.store.matchesDigest(token, pairing.digest)) return null;
     this.pairing = null;
-    try {
-      return await this.issueCookie({
-        kind: "browser",
-        clientName: metadata?.clientName ?? "Browser",
-        deviceType: metadata?.deviceType ?? "unknown",
-        os: metadata?.os ?? null,
-        browser: metadata?.browser ?? null,
-        remoteAddress: metadata?.remoteAddress ?? null,
-        viaProxy: metadata?.viaProxy ?? false
-      }, secure);
-    } catch (error) {
-      if (this.now() < pairing.expiresAt && !this.pairing) this.pairing = pairing;
-      throw error;
-    }
+    const generation = this.browserGeneration;
+    return this.queueBrowserMutation(async () => {
+      if (!this.browserAccessEnabled || generation !== this.browserGeneration) return null;
+      try {
+        const cookie = await this.issueCookie({
+          kind: "browser",
+          clientName: metadata?.clientName ?? "Browser",
+          deviceType: metadata?.deviceType ?? "unknown",
+          os: metadata?.os ?? null,
+          browser: metadata?.browser ?? null,
+          remoteAddress: metadata?.remoteAddress ?? null,
+          viaProxy: metadata?.viaProxy ?? false
+        }, secure);
+        if (!this.browserAccessEnabled || generation !== this.browserGeneration) {
+          await this.revoke({ cookie });
+          return null;
+        }
+        return cookie;
+      } catch (error) {
+        if (this.browserAccessEnabled && generation === this.browserGeneration && this.now() < pairing.expiresAt && !this.pairing) this.pairing = pairing;
+        throw error;
+      }
+    });
   }
   authenticate(headers) {
     const token = readCookie(headers.cookie, sessionCookieName(this.profile));
-    return token ? this.store.authenticate(token) : null;
+    const sessionId = token ? this.store.authenticate(token) : null;
+    return sessionId && this.hasSession(sessionId) ? sessionId : null;
   }
   async renewBrowserCookie(headers, secure = false) {
+    if (!this.browserAccessEnabled) return null;
+    const generation = this.browserGeneration;
     const token = readCookie(headers.cookie, sessionCookieName(this.profile));
     if (!token || !await this.store.renewBrowserSession(token)) return null;
+    if (!this.browserAccessEnabled || generation !== this.browserGeneration) return null;
     return this.sessionCookie(token, true, secure);
   }
   async revoke(headers) {
@@ -19861,11 +21524,18 @@ class OpenTigSessionAuth {
     };
   }
   hasSession(sessionId) {
-    return this.store.hasSession(sessionId);
+    return this.store.hasSession(sessionId) && (this.browserAccessEnabled || this.sessions().some((session) => session.id === sessionId && session.kind === "desktop"));
   }
   close() {
+    this.browserAccessEnabled = false;
+    this.browserGeneration++;
     this.pairing = null;
-    return this.store.close();
+    return this.browserQueue.then(() => this.store.close());
+  }
+  queueBrowserMutation(operation) {
+    const result = this.browserQueue.then(operation);
+    this.browserQueue = result.then(() => void 0, () => void 0);
+    return result;
   }
   expiredCookie(secure = false) {
     return `${sessionCookieName(this.profile)}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${this.secureCookies || secure ? "; Secure" : ""}`;
@@ -20128,6 +21798,19 @@ async function handleRequest(context, request, response) {
     }
     return sendJson(response, 404, { error: "Not found." });
   }
+  if (method === "GET" && rawPath === "/api/auth/web-access") {
+    if (!context.auth.authenticate(request.headers)) return sendJson(response, 401, { error: "Authentication required." });
+    const listener = context.listenerAddress();
+    const status = {
+      webAccessEnabled: context.auth.descriptor().browserAccessEnabled,
+      pairingAvailable: context.auth.descriptor().pairingAvailable,
+      listeningOnLan: !isLoopbackAddress(listener.host),
+      listenerHost: listener.host,
+      actualPort: listener.port,
+      ready: context.isReady()
+    };
+    return sendJson(response, 200, status);
+  }
   if (method === "GET" && rawPath === "/api/auth/sessions") {
     const currentSessionId = context.auth.authenticate(request.headers);
     if (!currentSessionId) return sendJson(response, 401, { error: "Authentication required." });
@@ -20147,12 +21830,22 @@ async function handleRequest(context, request, response) {
   }
   if (method === "POST" && rawPath.startsWith("/api/")) {
     if (!isAllowedOrigin(request)) return sendJson(response, 403, { error: "Forbidden origin." });
+    if (rawPath === "/api/auth/pairing-link") {
+      if (!context.auth.authenticate(request.headers)) return sendJson(response, 401, { error: "Authentication required." });
+      if (!context.auth.descriptor().browserAccessEnabled) return sendJson(response, 403, { error: "Web access is disabled.", code: "WEB_ACCESS_DISABLED" });
+      if (!context.isReady()) return sendJson(response, 503, { error: "Server is not ready." });
+      const url = new URL("/pair", request.headers.origin);
+      const pairing = context.auth.createPairingToken();
+      url.hash = new URLSearchParams({ token: pairing.token }).toString();
+      return sendJson(response, 200, { url: url.href, expiresAt: pairing.expiresAt });
+    }
     if (rawPath === "/api/auth/renew") {
       const cookie = await context.auth.renewBrowserCookie(request.headers, requestOriginIsSecure(request));
       if (!cookie) return sendJson(response, 401, { error: "Authentication required." });
       return sendJson(response, 204, null, { "Set-Cookie": cookie });
     }
     if (rawPath === "/api/auth/pair" || rawPath === "/api/auth/desktop") {
+      if (rawPath === "/api/auth/pair" && !context.auth.descriptor().browserAccessEnabled) return sendJson(response, 403, { error: "Web access is disabled.", code: "WEB_ACCESS_DISABLED" });
       const body = await readJsonObject(request, response);
       if (!body) return;
       const secure = requestOriginIsSecure(request);
@@ -20164,6 +21857,7 @@ async function handleRequest(context, request, response) {
       } else {
         cookie = await context.auth.exchangeDesktopSecret(body.secret);
       }
+      if (!cookie && rawPath === "/api/auth/pair" && !context.auth.descriptor().browserAccessEnabled) return sendJson(response, 403, { error: "Web access is disabled.", code: "WEB_ACCESS_DISABLED" });
       if (!cookie) return sendJson(response, 401, { error: "Authentication failed." });
       return sendJson(response, 204, null, { "Set-Cookie": cookie });
     }
@@ -20324,6 +22018,7 @@ async function handleLocalAdminPair(context, request, response) {
   }
   const origin = normalizePublicOrigin(body.publicOrigin);
   if (!origin) return sendJson(response, 400, { error: "Invalid public origin." });
+  if (!context.auth.descriptor().browserAccessEnabled) return sendJson(response, 403, { error: "Web access is disabled.", code: "WEB_ACCESS_DISABLED" });
   const pairing = admin.createPairingToken();
   const url = new URL("/pair", origin);
   url.hash = new URLSearchParams({ token: pairing.token }).toString();
@@ -20456,7 +22151,10 @@ class OpenTigWebSocketTransport {
   revokeSessions(sessionIds) {
     const revoked = new Set(sessionIds);
     for (const [socket, state] of this.clients) {
-      if (revoked.has(state.sessionId)) socket.close(1008, "Session revoked");
+      if (revoked.has(state.sessionId)) {
+        for (const controller of state.requests.values()) controller.abort();
+        socket.close(1008, "Session revoked");
+      }
     }
   }
   close() {
@@ -20499,6 +22197,7 @@ class OpenTigWebSocketTransport {
     socket.on("error", () => this.options.logger("warn", "WebSocket connection failed."));
   }
   async message(socket, state, data, isBinary) {
+    if (!this.options.auth.hasSession(state.sessionId)) return socket.close(1008, "Session expired or revoked");
     if (isBinary) return socket.close(1003, "Text messages only");
     const bytes = rawBytes(data);
     if (bytes.byteLength > FILE_WRITE_FRAME_LIMIT) return socket.close(1009, "Message too large");
@@ -20653,6 +22352,10 @@ class OpenTigServer {
       identity: options.identity,
       mode: options.mode ?? "desktop",
       isReady: () => this.ready,
+      listenerAddress: () => {
+        const address = this.httpServer.address();
+        return { host: address.address, port: address.port };
+      },
       sessionConnectionCount: (sessionId) => this.webSockets.connectionCount(sessionId),
       onSessionsRevoked: (sessionIds) => this.disconnectSessions(sessionIds),
       logger: this.logger,
@@ -20696,7 +22399,13 @@ class OpenTigServer {
     return this.options.auth.createPairingToken();
   }
   getStatus() {
-    return { connectedSessionCount: this.webSockets.connectedSessionCount };
+    return { connectedSessionCount: this.webSockets.connectedSessionCount, browserAccessEnabled: this.options.auth.descriptor().browserAccessEnabled };
+  }
+  async setBrowserAccessEnabled(enabled) {
+    if (!this.ready) throw new Error("Server is not ready.");
+    const pending = this.options.auth.setBrowserAccessEnabled(enabled);
+    if (!enabled) this.disconnectSessions(this.options.auth.sessions().filter((session) => session.kind !== "desktop").map((session) => session.id));
+    await pending;
   }
   async revokeAllSessions() {
     if (!this.ready) throw new Error("Server is not ready.");
@@ -20754,6 +22463,7 @@ async function runOpenTigServer(config2) {
   let transport = null;
   const auth = await OpenTigSessionAuth.open({
     source: config2.auth,
+    browserAccessEnabled: config2.browserAccessEnabled ?? config2.mode === "web-access",
     ...config2.profile ? { profile: config2.profile } : {},
     dataDirectory: config2.serverDataPath ?? path.join(path.dirname(config2.settingsPath), "server"),
     ...config2.secureCookies === void 0 ? {} : { secureCookies: config2.secureCookies }
@@ -20807,6 +22517,7 @@ async function runOpenTigServer(config2) {
       createPairingLink: () => pairingLink(address.origin, transport.createPairingToken()),
       getStatus: () => transport.getStatus(),
       revokeAllSessions: () => transport.revokeAllSessions(),
+      setBrowserAccessEnabled: (enabled) => transport.setBrowserAccessEnabled(enabled),
       close: () => transport.stop()
     };
   } catch (error) {