@pipod/cli 0.1.19 → 0.1.21

package/dist/chunk-7TJWBDVX.js

@@ -0,0 +1,100 @@
+// src/log.ts
+import { stripVTControlCharacters } from "util";
+
+// src/redact.ts
+var MIN_REDACTABLE_LENGTH = 4;
+var secrets = /* @__PURE__ */ new Set();
+function registerSecret(value) {
+  if (!value) return;
+  const v = String(value);
+  if (v.length < MIN_REDACTABLE_LENGTH) return;
+  secrets.add(v);
+}
+function registerSecrets(values) {
+  for (const v of Object.values(values)) registerSecret(v);
+}
+function redact(input) {
+  if (secrets.size === 0) return input;
+  let out2 = input;
+  for (const secret of [...secrets].sort((a, b) => b.length - a.length)) {
+    if (out2.includes(secret)) out2 = out2.split(secret).join("[redacted]");
+  }
+  return out2;
+}
+
+// src/log.ts
+var verbose = false;
+var colorEnabled = process.stderr.isTTY === true && !process.env.NO_COLOR;
+function setVerbose(v) {
+  verbose = v;
+}
+function isVerbose() {
+  return verbose;
+}
+var CODES = {
+  reset: "\x1B[0m",
+  dim: "\x1B[2m",
+  bold: "\x1B[1m",
+  red: "\x1B[31m",
+  yellow: "\x1B[33m",
+  cyan: "\x1B[36m",
+  green: "\x1B[32m"
+};
+function paint(code, s) {
+  return colorEnabled ? `${CODES[code]}${s}${CODES.reset}` : s;
+}
+var color = {
+  dim: (s) => paint("dim", s),
+  bold: (s) => paint("bold", s),
+  red: (s) => paint("red", s),
+  yellow: (s) => paint("yellow", s),
+  cyan: (s) => paint("cyan", s),
+  green: (s) => paint("green", s)
+};
+function write(line) {
+  process.stderr.write(redact(line) + "\n");
+}
+function info(msg) {
+  write(`${paint("cyan", "pi pod")} ${msg}`);
+}
+function step(phase, msg) {
+  write(`${paint("cyan", "pi pod")} ${paint("dim", `[${phase}]`)} ${msg}`);
+}
+function warn(msg) {
+  write(`${paint("yellow", "warning")} ${msg}`);
+}
+function error(msg) {
+  write(`${paint("red", "error")} ${msg}`);
+}
+function hint(msg) {
+  const lines = msg.split("\n");
+  write(`${paint("dim", "  hint:")} ${lines[0] ?? ""}`);
+  for (const line of lines.slice(1)) write(paint("dim", `        ${line}`));
+}
+function debug(msg) {
+  if (verbose) write(`${paint("dim", "debug")} ${paint("dim", msg)}`);
+}
+function plain(msg) {
+  write(msg);
+}
+function out(msg) {
+  const line = redact(msg);
+  process.stdout.write((process.stdout.isTTY === true ? line : stripVTControlCharacters(line)) + "\n");
+}
+
+export {
+  registerSecret,
+  registerSecrets,
+  setVerbose,
+  isVerbose,
+  color,
+  info,
+  step,
+  warn,
+  error,
+  hint,
+  debug,
+  plain,
+  out
+};
+//# sourceMappingURL=chunk-7TJWBDVX.js.map

package/dist/chunk-7TJWBDVX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/log.ts","../src/redact.ts"],"sourcesContent":["/**\n * src/log.ts — the launcher's logger. Everything user-visible goes through here so that\n * redaction (§7.3) is structural rather than something each call site has to remember.\n */\nimport { stripVTControlCharacters } from \"node:util\";\nimport { redact } from \"./redact.js\";\n\nlet verbose = false;\nlet colorEnabled = process.stderr.isTTY === true && !process.env.NO_COLOR;\n\nexport function setVerbose(v: boolean): void {\n  verbose = v;\n}\n\nexport function isVerbose(): boolean {\n  return verbose;\n}\n\nexport function setColor(enabled: boolean): void {\n  colorEnabled = enabled;\n}\n\nconst CODES = {\n  reset: \"\\u001b[0m\",\n  dim: \"\\u001b[2m\",\n  bold: \"\\u001b[1m\",\n  red: \"\\u001b[31m\",\n  yellow: \"\\u001b[33m\",\n  cyan: \"\\u001b[36m\",\n  green: \"\\u001b[32m\",\n} as const;\n\nfunction paint(code: keyof typeof CODES, s: string): string {\n  return colorEnabled ? `${CODES[code]}${s}${CODES.reset}` : s;\n}\n\nexport const color = {\n  dim: (s: string) => paint(\"dim\", s),\n  bold: (s: string) => paint(\"bold\", s),\n  red: (s: string) => paint(\"red\", s),\n  yellow: (s: string) => paint(\"yellow\", s),\n  cyan: (s: string) => paint(\"cyan\", s),\n  green: (s: string) => paint(\"green\", s),\n};\n\n/**\n * Diagnostics go to stderr so that stdout stays clean for the PTY stream and for\n * machine-readable output (`--dry-run`, `--version`).\n */\nfunction write(line: string): void {\n  process.stderr.write(redact(line) + \"\\n\");\n}\n\nexport function info(msg: string): void {\n  write(`${paint(\"cyan\", \"pi pod\")} ${msg}`);\n}\n\nexport function step(phase: string, msg: string): void {\n  write(`${paint(\"cyan\", \"pi pod\")} ${paint(\"dim\", `[${phase}]`)} ${msg}`);\n}\n\nexport function warn(msg: string): void {\n  write(`${paint(\"yellow\", \"warning\")} ${msg}`);\n}\n\nexport function error(msg: string): void {\n  write(`${paint(\"red\", \"error\")} ${msg}`);\n}\n\n/** Multi-line hints are one hint: the prefix appears once, continuation lines align under it. */\nexport function hint(msg: string): void {\n  const lines = msg.split(\"\\n\");\n  write(`${paint(\"dim\", \"  hint:\")} ${lines[0] ?? \"\"}`);\n  for (const line of lines.slice(1)) write(paint(\"dim\", `        ${line}`));\n}\n\nexport function debug(msg: string): void {\n  if (verbose) write(`${paint(\"dim\", \"debug\")} ${paint(\"dim\", msg)}`);\n}\n\nexport function plain(msg: string): void {\n  write(msg);\n}\n\n/**\n * Direct stdout writer for command results and machine-readable output; still redacted.\n * Color is useful at a terminal but must never leak into a pipe or redirected file.\n */\nexport function out(msg: string): void {\n  const line = redact(msg);\n  process.stdout.write((process.stdout.isTTY === true ? line : stripVTControlCharacters(line)) + \"\\n\");\n}\n\n/**\n * Wall-clock phase timings for one launch/attach, so the summary line can say where the\n * time went. Overlapping (parallelized) phases each record their own duration; the summary\n * total is wall time, not the sum.\n */\nexport interface PhaseTiming {\n  phase: string;\n  ms: number;\n}\n\nconst phaseTimings: PhaseTiming[] = [];\n\nexport function resetPhaseTimings(): void {\n  phaseTimings.length = 0;\n}\n\nexport function recordPhase(phase: string, ms: number): void {\n  phaseTimings.push({ phase, ms });\n}\n\nexport async function timePhase<T>(phase: string, work: () => Promise<T>): Promise<T> {\n  const startedAt = Date.now();\n  try {\n    return await work();\n  } finally {\n    recordPhase(phase, Date.now() - startedAt);\n  }\n}\n\nfunction fmtSeconds(ms: number): string {\n  return `${(ms / 1000).toFixed(1)}s`;\n}\n\n/** One line naming total wall time and every phase that cost at least 100ms. */\nexport function phaseSummary(label: string, totalMs: number): string {\n  const parts = phaseTimings.filter((t) => t.ms >= 100).map((t) => `${t.phase} ${fmtSeconds(t.ms)}`);\n  const breakdown = parts.length > 0 ? ` (${parts.join(\" · \")})` : \"\";\n  return `${label} in ${fmtSeconds(totalMs)}${breakdown}`;\n}\n\n/**\n * Print a periodic \"still …\" line while a long provider operation runs, so a multi-minute\n * wait is distinguishable from a hang. The line names the elapsed time and, when known,\n * roughly how long the wait usually takes.\n */\nexport const LIVENESS_INTERVAL_MS = 15_000;\n\nexport async function withLiveness<T>(\n  label: string,\n  work: () => Promise<T>,\n  opts: { intervalMs?: number; expectation?: string } = {},\n): Promise<T> {\n  const intervalMs = opts.intervalMs ?? LIVENESS_INTERVAL_MS;\n  const startedAt = Date.now();\n  const timer = setInterval(() => {\n    const elapsed = Math.round((Date.now() - startedAt) / 1000);\n    const usually = opts.expectation ? `, ${opts.expectation}` : \"\";\n    write(`${paint(\"cyan\", \"pi pod\")} ${paint(\"dim\", `still ${label} (${elapsed}s elapsed${usually})`)}`);\n  }, intervalMs);\n  timer.unref?.();\n  try {\n    return await work();\n  } finally {\n    clearInterval(timer);\n  }\n}\n\n/**\n * Stream a child stream to the terminal with a prefix (`[init]`, §4.3). Handles partial\n * lines so a chunk boundary never splits a prefix.\n */\nexport function prefixedStreamer(prefix: string): (chunk: Uint8Array) => void {\n  let pending = \"\";\n  const flushLine = (line: string) => write(`${paint(\"dim\", prefix)} ${line}`);\n  return (chunk: Uint8Array) => {\n    pending += Buffer.from(chunk).toString(\"utf8\");\n    const lines = pending.split(/\\r?\\n/);\n    pending = lines.pop() ?? \"\";\n    for (const line of lines) flushLine(line);\n    // Guard against a runaway line with no newline ever arriving.\n    if (pending.length > 8192) {\n      flushLine(pending);\n      pending = \"\";\n    }\n  };\n}\n","/**\n * src/redact.ts — secret-aware log redaction (§7.3).\n *\n * Every value originating from the env file is registered here; the logger runs all output\n * through `redact()`. The conformance suite (§14) asserts that no registered value ever\n * appears in captured logs.\n */\n\n/** Values short enough to appear coincidentally are not worth redacting (and would mangle output). */\nconst MIN_REDACTABLE_LENGTH = 4;\n\nconst secrets = new Set<string>();\n\nexport function registerSecret(value: string | undefined | null): void {\n  if (!value) return;\n  const v = String(value);\n  if (v.length < MIN_REDACTABLE_LENGTH) return;\n  secrets.add(v);\n}\n\nexport function registerSecrets(values: Record<string, string>): void {\n  for (const v of Object.values(values)) registerSecret(v);\n}\n\n/** Test/reset hook. */\nexport function clearSecrets(): void {\n  secrets.clear();\n}\n\nexport function registeredSecretCount(): number {\n  return secrets.size;\n}\n\n/**\n * Replace every registered secret with `[redacted]`. Longest-first so that a secret which\n * contains another secret as a substring is not partially revealed.\n */\nexport function redact(input: string): string {\n  if (secrets.size === 0) return input;\n  let out = input;\n  for (const secret of [...secrets].sort((a, b) => b.length - a.length)) {\n    if (out.includes(secret)) out = out.split(secret).join(\"[redacted]\");\n  }\n  return out;\n}\n\nexport function redactBytes(input: Uint8Array): Uint8Array {\n  if (secrets.size === 0) return input;\n  const text = Buffer.from(input).toString(\"utf8\");\n  const cleaned = redact(text);\n  return cleaned === text ? input : Buffer.from(cleaned, \"utf8\");\n}\n\n/** Redact an arbitrary structure for debug dumps. Keys are preserved, values scrubbed. */\nexport function redactDeep<T>(value: T): T {\n  if (typeof value === \"string\") return redact(value) as unknown as T;\n  if (Array.isArray(value)) return value.map((v) => redactDeep(v)) as unknown as T;\n  if (value && typeof value === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value as Record<string, unknown>)) out[k] = redactDeep(v);\n    return out as unknown as T;\n  }\n  return value;\n}\n"],"mappings":";AAIA,SAAS,gCAAgC;;;ACKzC,IAAM,wBAAwB;AAE9B,IAAM,UAAU,oBAAI,IAAY;AAEzB,SAAS,eAAe,OAAwC;AACrE,MAAI,CAAC,MAAO;AACZ,QAAM,IAAI,OAAO,KAAK;AACtB,MAAI,EAAE,SAAS,sBAAuB;AACtC,UAAQ,IAAI,CAAC;AACf;AAEO,SAAS,gBAAgB,QAAsC;AACpE,aAAW,KAAK,OAAO,OAAO,MAAM,EAAG,gBAAe,CAAC;AACzD;AAeO,SAAS,OAAO,OAAuB;AAC5C,MAAI,QAAQ,SAAS,EAAG,QAAO;AAC/B,MAAIA,OAAM;AACV,aAAW,UAAU,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;AACrE,QAAIA,KAAI,SAAS,MAAM,EAAG,CAAAA,OAAMA,KAAI,MAAM,MAAM,EAAE,KAAK,YAAY;AAAA,EACrE;AACA,SAAOA;AACT;;;ADrCA,IAAI,UAAU;AACd,IAAI,eAAe,QAAQ,OAAO,UAAU,QAAQ,CAAC,QAAQ,IAAI;AAE1D,SAAS,WAAW,GAAkB;AAC3C,YAAU;AACZ;AAEO,SAAS,YAAqB;AACnC,SAAO;AACT;AAMA,IAAM,QAAQ;AAAA,EACZ,OAAO;AAAA,EACP,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,OAAO;AACT;AAEA,SAAS,MAAM,MAA0B,GAAmB;AAC1D,SAAO,eAAe,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,KAAK;AAC7D;AAEO,IAAM,QAAQ;AAAA,EACnB,KAAK,CAAC,MAAc,MAAM,OAAO,CAAC;AAAA,EAClC,MAAM,CAAC,MAAc,MAAM,QAAQ,CAAC;AAAA,EACpC,KAAK,CAAC,MAAc,MAAM,OAAO,CAAC;AAAA,EAClC,QAAQ,CAAC,MAAc,MAAM,UAAU,CAAC;AAAA,EACxC,MAAM,CAAC,MAAc,MAAM,QAAQ,CAAC;AAAA,EACpC,OAAO,CAAC,MAAc,MAAM,SAAS,CAAC;AACxC;AAMA,SAAS,MAAM,MAAoB;AACjC,UAAQ,OAAO,MAAM,OAAO,IAAI,IAAI,IAAI;AAC1C;AAEO,SAAS,KAAK,KAAmB;AACtC,QAAM,GAAG,MAAM,QAAQ,QAAQ,CAAC,IAAI,GAAG,EAAE;AAC3C;AAEO,SAAS,KAAK,OAAe,KAAmB;AACrD,QAAM,GAAG,MAAM,QAAQ,QAAQ,CAAC,IAAI,MAAM,OAAO,IAAI,KAAK,GAAG,CAAC,IAAI,GAAG,EAAE;AACzE;AAEO,SAAS,KAAK,KAAmB;AACtC,QAAM,GAAG,MAAM,UAAU,SAAS,CAAC,IAAI,GAAG,EAAE;AAC9C;AAEO,SAAS,MAAM,KAAmB;AACvC,QAAM,GAAG,MAAM,OAAO,OAAO,CAAC,IAAI,GAAG,EAAE;AACzC;AAGO,SAAS,KAAK,KAAmB;AACtC,QAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,QAAM,GAAG,MAAM,OAAO,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE;AACpD,aAAW,QAAQ,MAAM,MAAM,CAAC,EAAG,OAAM,MAAM,OAAO,WAAW,IAAI,EAAE,CAAC;AAC1E;AAEO,SAAS,MAAM,KAAmB;AACvC,MAAI,QAAS,OAAM,GAAG,MAAM,OAAO,OAAO,CAAC,IAAI,MAAM,OAAO,GAAG,CAAC,EAAE;AACpE;AAEO,SAAS,MAAM,KAAmB;AACvC,QAAM,GAAG;AACX;AAMO,SAAS,IAAI,KAAmB;AACrC,QAAM,OAAO,OAAO,GAAG;AACvB,UAAQ,OAAO,OAAO,QAAQ,OAAO,UAAU,OAAO,OAAO,yBAAyB,IAAI,KAAK,IAAI;AACrG;","names":["out"]}

package/dist/cli.js

@@ -4,6 +4,21 @@ import {
   POD_SUBCOMMANDS,
   PodCommandRouter
 } from "./chunk-GNKF75X7.js";
+import {
+  color,
+  debug,
+  error,
+  hint,
+  info,
+  isVerbose,
+  out,
+  plain,
+  registerSecret,
+  registerSecrets,
+  setVerbose,
+  step,
+  warn
+} from "./chunk-7TJWBDVX.js";
 
 // src/cli.ts
 import * as fs36 from "fs";
@@ -96,90 +111,6 @@ var PodAsleepError = class extends PiPodError {
 import * as fs7 from "fs";
 import { Readable } from "stream";
 
-// src/log.ts
-import { stripVTControlCharacters } from "util";
-
-// src/redact.ts
-var MIN_REDACTABLE_LENGTH = 4;
-var secrets = /* @__PURE__ */ new Set();
-function registerSecret(value) {
-  if (!value) return;
-  const v = String(value);
-  if (v.length < MIN_REDACTABLE_LENGTH) return;
-  secrets.add(v);
-}
-function registerSecrets(values) {
-  for (const v of Object.values(values)) registerSecret(v);
-}
-function redact(input) {
-  if (secrets.size === 0) return input;
-  let out2 = input;
-  for (const secret of [...secrets].sort((a, b) => b.length - a.length)) {
-    if (out2.includes(secret)) out2 = out2.split(secret).join("[redacted]");
-  }
-  return out2;
-}
-
-// src/log.ts
-var verbose = false;
-var colorEnabled = process.stderr.isTTY === true && !process.env.NO_COLOR;
-function setVerbose(v) {
-  verbose = v;
-}
-function isVerbose() {
-  return verbose;
-}
-var CODES = {
-  reset: "\x1B[0m",
-  dim: "\x1B[2m",
-  bold: "\x1B[1m",
-  red: "\x1B[31m",
-  yellow: "\x1B[33m",
-  cyan: "\x1B[36m",
-  green: "\x1B[32m"
-};
-function paint(code, s) {
-  return colorEnabled ? `${CODES[code]}${s}${CODES.reset}` : s;
-}
-var color = {
-  dim: (s) => paint("dim", s),
-  bold: (s) => paint("bold", s),
-  red: (s) => paint("red", s),
-  yellow: (s) => paint("yellow", s),
-  cyan: (s) => paint("cyan", s),
-  green: (s) => paint("green", s)
-};
-function write(line) {
-  process.stderr.write(redact(line) + "\n");
-}
-function info(msg) {
-  write(`${paint("cyan", "pi pod")} ${msg}`);
-}
-function step(phase, msg) {
-  write(`${paint("cyan", "pi pod")} ${paint("dim", `[${phase}]`)} ${msg}`);
-}
-function warn(msg) {
-  write(`${paint("yellow", "warning")} ${msg}`);
-}
-function error(msg) {
-  write(`${paint("red", "error")} ${msg}`);
-}
-function hint(msg) {
-  const lines = msg.split("\n");
-  write(`${paint("dim", "  hint:")} ${lines[0] ?? ""}`);
-  for (const line of lines.slice(1)) write(paint("dim", `        ${line}`));
-}
-function debug(msg) {
-  if (verbose) write(`${paint("dim", "debug")} ${paint("dim", msg)}`);
-}
-function plain(msg) {
-  write(msg);
-}
-function out(msg) {
-  const line = redact(msg);
-  process.stdout.write((process.stdout.isTTY === true ? line : stripVTControlCharacters(line)) + "\n");
-}
-
 // src/account/oidc.ts
 import { createHash, randomBytes, timingSafeEqual } from "crypto";
 import { createRemoteJWKSet, jwtVerify } from "jose";
@@ -1942,6 +1873,10 @@ var AccountClient = class {
   listPods(query = {}) {
     return this.request("/pods", { query });
   }
+  /** Null means an older server lacks lookup, not that the ref had no matches. */
+  lookupPodRef(ref) {
+    return this.request(`/pods/by-ref/${encodeURIComponent(ref)}`, { allow404: true });
+  }
   /** `waitMs` long-polls: a supporting server answers on the next pod change; older servers ignore it. */
   getPod(id, opts = {}) {
     const waitMs = opts.waitMs != null && opts.waitMs > 0 ? Math.floor(opts.waitMs) : void 0;
@@ -5137,19 +5072,24 @@ function displayRef(id, kind) {
   const tail = id.replaceAll("-", "").slice(-DISPLAY_TAIL_LENGTH).toLowerCase();
   return `${kind === "pod" ? "p" : "j"}-${tail}`;
 }
-function matchesRef(id, ref) {
-  const normalizedId = id.toLowerCase();
-  const normalizedRef = ref.toLowerCase();
-  if (FULL_UUID.test(normalizedRef)) return normalizedId === normalizedRef;
-  const prefixed = /^[pj]-(.*)$/i.exec(normalizedRef);
+function parseRef(ref) {
+  const normalized = ref.toLowerCase();
+  if (FULL_UUID.test(normalized)) return { kind: "uuid", value: normalized };
+  const prefixed = /^[pj]-(.*)$/i.exec(normalized);
   if (prefixed) {
-    const tail = prefixed[1];
-    assertUsableHexRef(ref, tail);
-    return normalizedId.replaceAll("-", "").endsWith(tail);
+    assertUsableHexRef(ref, prefixed[1]);
+    return { kind: "tail", value: prefixed[1] };
   }
-  if (!HEX.test(normalizedRef)) return false;
-  assertUsableHexRef(ref, normalizedRef);
-  return normalizedId.startsWith(normalizedRef) || normalizedId.replaceAll("-", "").endsWith(normalizedRef);
+  if (!HEX.test(normalized)) return null;
+  assertUsableHexRef(ref, normalized);
+  return { kind: "hex", value: normalized };
+}
+function matchesRef(id, ref) {
+  const pattern = parseRef(ref);
+  if (!pattern) return false;
+  const normalizedId = id.toLowerCase();
+  if (pattern.kind === "uuid") return normalizedId === pattern.value;
+  return normalizedId.replaceAll("-", "").endsWith(pattern.value) || pattern.kind === "hex" && normalizedId.startsWith(pattern.value);
 }
 function assertUsableHexRef(ref, hex) {
   if (!HEX.test(hex)) {
@@ -5284,19 +5224,19 @@ async function archiveIntoPod(opts, plan, flags = {}) {
   const ignored = gitIgnoredPaths(plan.root);
   const tmpDir = opts.tmpDir ?? os3.tmpdir();
   const archivePath = path14.join(tmpDir, `pi-pod-seed-${randomBytes3(8).toString("hex")}.tar.gz`);
-  const write2 = opts.tarball ?? createTarball;
+  const write = opts.tarball ?? createTarball;
   try {
     let summary;
     let includeGit = plan.includeGit;
     step("seed", `archiving ${plan.root}${includeGit ? " with .git history" : ""} (${plan.reason})`);
     try {
-      summary = await write2(tarballOptions(opts, plan.root, archivePath, ignored, includeGit));
+      summary = await write(tarballOptions(opts, plan.root, archivePath, ignored, includeGit));
     } catch (error2) {
       throwIfCancelled(opts, error2);
       if (!(error2 instanceof TarballLimitError) || !includeGit) throw error2;
       warn(`${error2.message} \u2014 retrying without .git history`);
       includeGit = false;
-      summary = await write2(tarballOptions(opts, plan.root, archivePath, ignored, includeGit));
+      summary = await write(tarballOptions(opts, plan.root, archivePath, ignored, includeGit));
     }
     if (summary.entries === 0) {
       info("nothing to seed \u2014 the local directory is empty");
@@ -6646,6 +6586,7 @@ var RemoteStateCache = class {
   sessionRefreshRequested = false;
   expectedRefreshLeaf = NO_EXPECTED_LEAF;
   cacheGeneration = 0;
+  modelsRefresh = null;
   replacementInProgress = false;
   labelStates = /* @__PURE__ */ new Map();
   seedBridge = null;
@@ -6881,11 +6822,22 @@ var RemoteStateCache = class {
     }
     throw lastError ?? new Error("pod session refresh could not be reconciled");
   }
-  async refreshModels() {
-    try {
-      this.availableModels = await this.rpc.getAvailableModels();
-    } catch {
-    }
+  refreshModels() {
+    const generation = this.cacheGeneration;
+    if (this.modelsRefresh?.generation === generation) return this.modelsRefresh.promise;
+    const promise = (async () => {
+      try {
+        const models = await this.rpc.getAvailableModels();
+        if (generation === this.cacheGeneration) this.availableModels = models;
+      } catch {
+      }
+    })();
+    const entry = { generation, promise };
+    this.modelsRefresh = entry;
+    void promise.then(() => {
+      if (this.modelsRefresh === entry) this.modelsRefresh = null;
+    });
+    return promise;
   }
   async refreshCommands() {
     try {
@@ -11503,8 +11455,7 @@ function createRemoteRuntime(opts) {
     treeBridge,
     init: async () => {
       await cache.init();
-      await refreshThinkingLevels();
-      await authBridge.refresh();
+      await Promise.all([refreshThinkingLevels(), authBridge.refresh(), cache.refreshModels()]);
       await seedScopedModels();
       if (opts.attestedExtensionPaths?.length) {
         try {
@@ -12472,6 +12423,7 @@ var GatewayRpcClient = class _GatewayRpcClient extends RpcClientBase {
   /** False between adopting a skewed hello and readiness replacing it; ordinary RPC is gated. */
   piVersionReady = false;
   idPrefix = `cli-${randomBytes5(4).toString("hex")}-`;
+  availableModelsRequest = null;
   modelsRequest = null;
   pendingSemantic = /* @__PURE__ */ new Map();
   /** Auxiliary completions multiplex by caller id — unlike single-slot semantic queries. */
@@ -12625,6 +12577,20 @@ var GatewayRpcClient = class _GatewayRpcClient extends RpcClientBase {
     }
     return promise;
   }
+  /** Model and thinking consumers share one semantic catalog, not two large replies. */
+  getAvailableModels() {
+    if (this.availableModelsRequest) return this.availableModelsRequest;
+    const task = this.getModels().then((snapshot) => snapshot.models).catch((error2) => {
+      if (error2 instanceof Error && error2.message === "timed out waiting for the gateway model catalog" && !this.userClosed && this.piVersionReady) return super.getAvailableModels();
+      throw error2;
+    });
+    this.availableModelsRequest = task;
+    const clear = () => {
+      if (this.availableModelsRequest === task) this.availableModelsRequest = null;
+    };
+    void task.then(clear, clear);
+    return task;
+  }
   /** List pod-side sessions. A timeout or unsupported marker is an absent capability. */
   getSessions() {
     const absent = { sessions: [], workdir: "", complete: false, unsupported: true };
@@ -12982,6 +12948,7 @@ var GatewayRpcClient = class _GatewayRpcClient extends RpcClientBase {
     }
   }
   resetHandshakeState(podId) {
+    this.availableModelsRequest = null;
     this.currentPodId = podId;
     this.hello = null;
     this.piExitCode = void 0;
@@ -14346,9 +14313,9 @@ async function runAccountInteractive(opts) {
       latestConnectionState = state;
       noteAsleep(state);
       if (runtimeRef) {
-        const paint2 = () => applyConnectionStatus(runtimeRef?.bridge.ui, state, rpc?.podId ?? opts.pod.id);
-        if (runtimeRef.bridge.ui) paint2();
-        else runtimeRef.bridge.onUiBound(paint2);
+        const paint = () => applyConnectionStatus(runtimeRef?.bridge.ui, state, rpc?.podId ?? opts.pod.id);
+        if (runtimeRef.bridge.ui) paint();
+        else runtimeRef.bridge.onUiBound(paint);
         if (state.kind === "lost") {
           runtimeRef.bridge.notify(
             state.reason ? `could not reconnect: ${state.reason}` : "connection lost",
@@ -14694,20 +14661,27 @@ ${choices.join("\n")}`,
   };
   let unwireDisconnectedQuit = () => {
   };
+  let unwireKeyRepeat = () => {
+  };
   let mode;
   try {
     await runtime.init();
     const { InteractiveMode } = await import("@earendil-works/pi-coding-agent");
     const { wirePodChords } = await import("./chords-SOJBLC6R.js");
+    const { wireKeyRepeatGuard } = await import("./key-repeat-guard-7OVKW5KD.js");
+    const { guardStdinFragments } = await import("./stdin-fragment-guard-SPIJC7GT.js");
+    guardStdinFragments();
     const chords = context.config.pi.chords;
     runtime.bridge.setOnUiBound(() => {
       unwireChords();
       unwireDisconnectedQuit();
+      unwireKeyRepeat();
       unwireChords = wirePodChords(runtime.bridge, runtime.router, chords);
       unwireDisconnectedQuit = wireDisconnectedQuit(
         runtime.bridge,
         () => connectionAllowsQuit(latestConnectionState)
       );
+      unwireKeyRepeat = wireKeyRepeatGuard(runtime.bridge.ui);
     });
     const tuiMode = opts.tuiMode ?? tuiModeFromArgv(context.config.pi.args);
     process.env["PI_SKIP_VERSION_CHECK"] ??= "1";
@@ -14737,6 +14711,7 @@ ${choices.join("\n")}`,
     runtime.bridge.setOnUiBound(null);
     unwireChords();
     unwireDisconnectedQuit();
+    unwireKeyRepeat();
     rpc.close();
     derived?.dispose();
     throw error2;
@@ -14763,6 +14738,7 @@ ${choices.join("\n")}`,
     runtime.bridge.setOnUiBound(null);
     unwireChords();
     unwireDisconnectedQuit();
+    unwireKeyRepeat();
     process.off("SIGHUP", onHangUp);
     process.off("SIGTERM", onHangUp);
   }
@@ -15056,6 +15032,12 @@ function renderPodLines(pods) {
 async function selectAccountPod(client, podRef, action, cwd) {
   if (podRef) {
     if (isFullUuid(podRef)) return client.getPod(podRef.toLowerCase());
+    const found = await client.lookupPodRef(podRef);
+    if (found !== null) {
+      if (found.total > 1) throw ambiguousPodRef(podRef, found.matches, found.total);
+      if (found.pod) return found.pod;
+      throw new PiPodError(`no pod matches "${podRef}"`, { hint: "see `pipod list --all`" });
+    }
     const pods2 = (await listAllPods(client, {})).pods;
     const named = pods2.filter((pod) => pod.name === podRef);
     if (named.length === 1) return named[0];
@@ -15082,10 +15064,11 @@ ${podChoiceLines(pods)}`
   }
   return pods[0];
 }
-function ambiguousPodRef(ref, pods) {
-  return new PiPodError(`"${ref}" matches ${pods.length} pods`, {
+function ambiguousPodRef(ref, pods, total = pods.length) {
+  return new PiPodError(`"${ref}" matches ${total} pods`, {
     hint: `use a longer ref:
-${podChoiceLines(pods)}`
+${podChoiceLines(pods)}` + (total > pods.length ? `
+  \u2026 showing the first ${pods.length} matches` : "")
   });
 }
 function podChoiceLines(pods) {
@@ -18671,10 +18654,10 @@ async function showCmd(client, args) {
   if (t.piSettings && Object.keys(t.piSettings).length > 0) {
     info(`Pi settings ${describePiSettings(flatPiSettings(t.piSettings))}`);
   }
-  const secrets2 = await client.listSecrets("template", t.id).catch(() => null);
-  if (secrets2 && secrets2.secrets.length > 0) {
+  const secrets = await client.listSecrets("template", t.id).catch(() => null);
+  if (secrets && secrets.secrets.length > 0) {
     out("");
-    info(`template secrets: ${secrets2.secrets.map((s) => s.name).join(", ")}`);
+    info(`template secrets: ${secrets.secrets.map((s) => s.name).join(", ")}`);
   }
   return 0;
 }
@@ -18684,9 +18667,9 @@ function describePiSettings(settings) {
   const packageCount = Array.isArray(packages) ? packages.length : 0;
   return `${names.join(", ") || "empty"}${packageCount > 0 ? ` (${packageCount} package(s))` : ""}`;
 }
-async function writeTemplateSnapshot(write2) {
+async function writeTemplateSnapshot(write) {
   try {
-    return await write2();
+    return await write();
   } catch (error2) {
     if (error2 instanceof PiPodError && error2.status === 400 && /(?:unrecognized|unknown|unexpected)[^\n]*piSettings|piSettings[^\n]*(?:unrecognized|unknown|unexpected)/i.test(error2.message)) {
       throw new PiPodError("the pi pod server does not support template-owned Pi settings", {