@ponythewhite/base-context 1.0.2 → 1.0.4

package/dist/bundle/{chunk-44PEHPOG.js → chunk-BV25CVRM.js}

@@ -347,7 +347,7 @@ import {
   watchWithErrorHandler,
   workerRosterEntryFromSummary,
   wrapTextWithAnsi
-} from "./chunk-IADCPVEI.js";
+} from "./chunk-XDJ56NJA.js";
 import {
   array,
   boolean,
@@ -2348,7 +2348,7 @@ function formatErrorDetails(error) {
   return String(error);
 }
 async function startCallbackServer(expectedState) {
-  const { createServer: createServer3 } = await getNodeApis();
+  const { createServer: createServer4 } = await getNodeApis();
   return new Promise((resolve26, reject) => {
     let settleWait;
     const waitForCodePromise = new Promise((resolveWait) => {
@@ -2359,7 +2359,7 @@ async function startCallbackServer(expectedState) {
         resolveWait(value);
       };
     });
-    const server = createServer3((req, res) => {
+    const server = createServer4((req, res) => {
       try {
         const url2 = new URL(req.url || "", "http://localhost");
         if (url2.pathname !== CALLBACK_PATH) {
@@ -3263,6 +3263,7 @@ async function getOAuthApiKey(providerId, credentials) {
 }
 
 // ../ai/src/mcp/oauth.ts
+import { createServer } from "node:http";
 var CALLBACK_HOST3 = process.env.BASE_CONTEXT_OAUTH_CALLBACK_HOST || "127.0.0.1";
 var CALLBACK_PORT_BASE = Number(process.env.BASE_CONTEXT_MCP_OAUTH_CALLBACK_PORT || 53700);
 var CALLBACK_PORT_COUNT = 10;
@@ -3271,6 +3272,8 @@ var CALLBACK_PORTS = Array.from({ length: CALLBACK_PORT_COUNT }, (_2, i) => CALL
 var redirectUriFor = (port) => `http://localhost:${port}${CALLBACK_PATH2}`;
 var ALL_REDIRECT_URIS = CALLBACK_PORTS.map(redirectUriFor);
 var TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1e3;
+var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
+var OAUTH_MAX_RESPONSE_BYTES = 1024 * 1024;
 function validatedHttpsUrl(value, name) {
   let url2;
   try {
@@ -3296,15 +3299,74 @@ function authorizationServerMetadataUrls(issuer) {
     new URL(`${path6}/.well-known/openid-configuration`, url2.origin).toString()
   ];
 }
-async function fetchResponse(url2, init) {
-  return fetch(url2, { ...init, redirect: "error" });
+async function withResponse(url2, init, read) {
+  const controller = new AbortController();
+  const signal = init.signal ? AbortSignal.any([init.signal, controller.signal]) : controller.signal;
+  const timer = setTimeout(() => controller.abort(new Error("MCP OAuth request timed out")), OAUTH_REQUEST_TIMEOUT_MS);
+  let response;
+  try {
+    signal.throwIfAborted();
+    response = await fetch(url2, { ...init, signal, redirect: "error" });
+    return await read(response, signal);
+  } finally {
+    clearTimeout(timer);
+    if (response?.body && !response.body.locked) void response.body.cancel().catch(() => {
+    });
+  }
+}
+async function readJson(response, signal, label) {
+  const reader = response.body?.getReader();
+  if (!reader) throw new Error(`${label} returned invalid JSON`);
+  const decoder = new TextDecoder();
+  let text = "";
+  let bytes = 0;
+  const cancel = () => {
+    void reader.cancel().catch(() => {
+    });
+  };
+  signal.addEventListener("abort", cancel, { once: true });
+  try {
+    while (true) {
+      signal.throwIfAborted();
+      const { done, value } = await reader.read();
+      signal.throwIfAborted();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > OAUTH_MAX_RESPONSE_BYTES) throw new Error(`${label} exceeded the OAuth response size limit`);
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+  } finally {
+    signal.removeEventListener("abort", cancel);
+    cancel();
+    reader.releaseLock();
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`${label} returned invalid JSON`);
+  }
 }
 async function fetchJson2(url2, init) {
-  const res = await fetchResponse(url2, init);
-  if (!res.ok) {
-    throw new Error(`${init?.method ?? "GET"} ${url2} failed: ${res.status}`);
+  return withResponse(url2, init, async (response, signal) => {
+    const label = `${init.method ?? "GET"} ${url2}`;
+    if (!response.ok) throw new Error(`${label} failed: ${response.status}`);
+    return readJson(response, signal, label);
+  });
+}
+async function abortable(work, signal) {
+  if (!signal) return work;
+  let onAbort;
+  const aborted = new Promise((_2, reject) => {
+    onAbort = () => reject(signal.reason);
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) onAbort();
+  });
+  try {
+    return await Promise.race([work, aborted]);
+  } finally {
+    if (onAbort) signal.removeEventListener("abort", onAbort);
   }
-  return res.json();
 }
 function authorizationServerMetadata(value, issuer, requireExactIssuer) {
   if (!value || typeof value !== "object") throw new Error(`Authorization server metadata for ${issuer} is invalid`);
@@ -3330,21 +3392,28 @@ function authorizationServerMetadata(value, issuer, requireExactIssuer) {
   if (metadata.registration_endpoint) validatedHttpsUrl(metadata.registration_endpoint, "Registration endpoint");
   return metadata;
 }
-async function jsonMetadata(response, url2) {
+async function jsonMetadata(response, url2, signal) {
   if (response.status !== 200) throw new Error(`GET ${url2} failed: ${response.status}`);
   const contentType = response.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase();
   if (contentType !== "application/json") throw new Error(`GET ${url2} did not return application/json`);
-  return response.json();
+  return readJson(response, signal, `GET ${url2}`);
 }
-async function discoverAuthorizationServer(issuer, requireExactIssuer) {
+async function discoverAuthorizationServer(issuer, requireExactIssuer, signal) {
   const candidates = authorizationServerMetadataUrls(issuer);
   let lastError;
   for (const candidate of candidates) {
     try {
-      const response = await fetchResponse(candidate);
-      if (response.status === 404) continue;
-      return authorizationServerMetadata(await jsonMetadata(response, candidate), issuer, requireExactIssuer);
+      const metadata = await withResponse(candidate, { signal }, async (response, requestSignal) => {
+        if (response.status === 404) return void 0;
+        return authorizationServerMetadata(
+          await jsonMetadata(response, candidate, requestSignal),
+          issuer,
+          requireExactIssuer
+        );
+      });
+      if (metadata) return metadata;
     } catch (error) {
+      signal?.throwIfAborted();
       lastError = error;
     }
   }
@@ -3370,6 +3439,9 @@ function resourceMetadata(value, resource) {
       throw new Error("Protected-resource metadata has an invalid authorization server");
     validatedHttpsUrl(issuer, "Authorization server issuer");
   }
+  if (metadata.scopes_supported !== void 0 && (!Array.isArray(metadata.scopes_supported) || metadata.scopes_supported.some((scope) => typeof scope !== "string"))) {
+    throw new Error("Protected-resource metadata has invalid scopes_supported");
+  }
   return metadata;
 }
 function resourceMetadataUrl(resource) {
@@ -3381,34 +3453,39 @@ function headerResourceMetadata(value) {
   if (!match2) return void 0;
   return match2[1].replace(/\\(.)/g, "$1");
 }
-async function tryProtectedResourceMetadata(url2) {
+async function tryProtectedResourceMetadata(url2, signal) {
   const resource = validatedHttpsUrl(url2, "MCP endpoint");
   let headerUrl;
   try {
-    const response2 = await fetchResponse(resource.toString());
-    headerUrl = headerResourceMetadata(response2.headers.get("www-authenticate"));
-    await response2.body?.cancel();
+    headerUrl = await withResponse(
+      resource.toString(),
+      { signal },
+      async (response) => headerResourceMetadata(response.headers.get("www-authenticate"))
+    );
   } catch {
+    signal?.throwIfAborted();
   }
   const candidate = headerUrl ? validatedHttpsUrl(headerUrl, "resource_metadata").toString() : resourceMetadataUrl(resource);
-  const response = await fetchResponse(candidate);
-  if (response.status === 404 && !headerUrl) return void 0;
-  return resourceMetadata(await jsonMetadata(response, candidate), canonicalResource(resource));
+  return withResponse(candidate, { signal }, async (response, requestSignal) => {
+    if (response.status === 404 && !headerUrl) return void 0;
+    return resourceMetadata(await jsonMetadata(response, candidate, requestSignal), canonicalResource(resource));
+  });
 }
-async function discover(url2) {
-  const protectedResource = await tryProtectedResourceMetadata(url2);
+async function discover(url2, signal) {
+  const protectedResource = await tryProtectedResourceMetadata(url2, signal);
   if (protectedResource) {
     const issuer2 = protectedResource.authorization_servers[0];
     return {
-      metadata: await discoverAuthorizationServer(issuer2, true),
+      metadata: await discoverAuthorizationServer(issuer2, true, signal),
+      scopes: protectedResource.scopes_supported,
       resource: protectedResource.resource,
       issuer: issuer2
     };
   }
   const issuer = validatedHttpsUrl(url2, "MCP endpoint").origin;
-  return { metadata: await discoverAuthorizationServer(issuer, false) };
+  return { metadata: await discoverAuthorizationServer(issuer, false, signal) };
 }
-async function registerClient(registrationEndpoint, label) {
+async function registerClient(registrationEndpoint, label, signal) {
   validatedHttpsUrl(registrationEndpoint, "Registration endpoint");
   const body = {
     client_name: label,
@@ -3420,7 +3497,8 @@ async function registerClient(registrationEndpoint, label) {
   const data = await fetchJson2(registrationEndpoint, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body)
+    body: JSON.stringify(body),
+    signal
   });
   if (typeof data.client_id !== "string" || !data.client_id) {
     throw new Error(`Dynamic client registration at ${registrationEndpoint} returned no client_id`);
@@ -3428,7 +3506,6 @@ async function registerClient(registrationEndpoint, label) {
   return data.client_id;
 }
 async function startCallbackServer2(label) {
-  const { createServer: createServer3 } = await import("node:http");
   let settle;
   const waitPromise = new Promise((resolve26) => {
     let settled = false;
@@ -3465,7 +3542,7 @@ async function startCallbackServer2(label) {
   };
   let lastError;
   for (const port of CALLBACK_PORTS) {
-    const server = createServer3(handler);
+    const server = createServer(handler);
     let bindErr;
     server.on("error", (err) => bindErr?.(err));
     try {
@@ -3516,23 +3593,22 @@ function parseRedirectInput(input, expectedState) {
   }
   return { code, state: state ?? expectedState };
 }
-async function exchangeToken(tokenEndpoint, params) {
+async function exchangeToken(tokenEndpoint, params, signal) {
   validatedHttpsUrl(tokenEndpoint, "Token endpoint");
-  const res = await fetchResponse(tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams(params).toString()
-  });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Token request to ${tokenEndpoint} failed: ${res.status}`);
-  }
-  let token;
-  try {
-    token = JSON.parse(text);
-  } catch {
-    throw new Error(`Token request to ${tokenEndpoint} returned invalid JSON`);
-  }
+  const token = await withResponse(
+    tokenEndpoint,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams(params).toString(),
+      signal
+    },
+    async (response, requestSignal) => {
+      const label = `Token request to ${tokenEndpoint}`;
+      if (!response.ok) throw new Error(`${label} failed: ${response.status}`);
+      return readJson(response, requestSignal, label);
+    }
+  );
   if (!token || typeof token !== "object" || typeof token.access_token !== "string") {
     throw new Error(`Token request to ${tokenEndpoint} returned no access_token`);
   }
@@ -3562,7 +3638,7 @@ function toCredentials(token, tokenEndpoint, clientId, endpoint, resource, issue
 function createMcpOAuthProvider(config) {
   const label = config.label ?? config.server;
   async function login(callbacks) {
-    const discovery = await discover(config.url);
+    const discovery = await discover(config.url, callbacks.signal);
     const { metadata: meta } = discovery;
     callbacks.onProgress?.(`Discovered ${discovery.issuer ?? meta.issuer}`);
     let clientId = config.clientId;
@@ -3573,13 +3649,15 @@ function createMcpOAuthProvider(config) {
         );
       }
       callbacks.onProgress?.("Registering OAuth client\u2026");
-      clientId = await registerClient(meta.registration_endpoint, `Prime Agent (${label})`);
+      clientId = await registerClient(meta.registration_endpoint, `Base Context (${label})`, callbacks.signal);
     }
     const { verifier, challenge } = await generatePKCE();
     const state = randomState();
-    const scope = config.scopes ?? meta.scopes_supported?.join(" ");
+    const scope = config.scopes ?? discovery.scopes?.join(" ");
+    callbacks.signal?.throwIfAborted();
     const cb = await startCallbackServer2(label);
     try {
+      callbacks.signal?.throwIfAborted();
       const authParams = new URLSearchParams({
         client_id: clientId,
         response_type: "code",
@@ -3596,6 +3674,7 @@ function createMcpOAuthProvider(config) {
         url: authorizationUrl.toString(),
         instructions: "Complete login in your browser. If the browser is on another machine, paste the final redirect URL here."
       });
+      callbacks.signal?.throwIfAborted();
       let result;
       let manualCancelled = false;
       let manualError;
@@ -3614,16 +3693,19 @@ function createMcpOAuthProvider(config) {
           cb.cancel();
           return null;
         });
-        const fromCallback = await cb.waitForCode();
-        result = fromCallback ?? await manual;
+        const fromCallback = await abortable(cb.waitForCode(), callbacks.signal);
+        result = fromCallback ?? await abortable(manual, callbacks.signal);
         if (!result && manualError) throw manualError;
       } else {
-        result = await cb.waitForCode();
+        result = await abortable(cb.waitForCode(), callbacks.signal);
         if (!result) {
-          const input = await callbacks.onPrompt({
-            message: "Paste the authorization code or full redirect URL:",
-            placeholder: cb.redirectUri
-          });
+          const input = await abortable(
+            callbacks.onPrompt({
+              message: "Paste the authorization code or full redirect URL:",
+              placeholder: cb.redirectUri
+            }),
+            callbacks.signal
+          );
           result = parseRedirectInput(input, state);
         }
       }
@@ -3634,16 +3716,21 @@ function createMcpOAuthProvider(config) {
         throw new Error("OAuth state mismatch");
       }
       callbacks.onProgress?.("Exchanging authorization code for tokens\u2026");
-      const token = await exchangeToken(meta.token_endpoint, {
-        grant_type: "authorization_code",
-        code: result.code,
-        redirect_uri: cb.redirectUri,
-        client_id: clientId,
-        code_verifier: verifier,
-        ...discovery.resource ? { resource: discovery.resource } : {}
-      });
+      const token = await exchangeToken(
+        meta.token_endpoint,
+        {
+          grant_type: "authorization_code",
+          code: result.code,
+          redirect_uri: cb.redirectUri,
+          client_id: clientId,
+          code_verifier: verifier,
+          ...discovery.resource ? { resource: discovery.resource } : {}
+        },
+        callbacks.signal
+      );
       return toCredentials(token, meta.token_endpoint, clientId, config.url, discovery.resource, discovery.issuer);
     } finally {
+      cb.cancel();
       cb.server.close();
     }
   }
@@ -4638,7 +4725,7 @@ ${loadError}`));
 import { resolve as resolve11 } from "node:path";
 
 // dist/core/auth-storage.js
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 
 // ../ai/src/oauth.ts
 var oauth_exports = {};
@@ -5143,11 +5230,18 @@ var AuthStorage = class _AuthStorage {
       this.staleAuthSources.set(provider, next);
     }
   }
+  parseStorageState(content) {
+    const { __base_context_login_attempts: loginAttempts = {}, ...credentials } = JSON.parse(content || "{}");
+    return { credentials, loginAttempts };
+  }
+  serializeStorageState({ credentials, loginAttempts }) {
+    return JSON.stringify({
+      ...credentials,
+      ...Object.keys(loginAttempts).length > 0 ? { __base_context_login_attempts: loginAttempts } : {}
+    }, null, 2);
+  }
   parseStorageData(content) {
-    if (!content) {
-      return {};
-    }
-    return JSON.parse(content);
+    return this.parseStorageState(content).credentials;
   }
   /**
    * Reload credentials from storage.
@@ -5172,14 +5266,14 @@ var AuthStorage = class _AuthStorage {
     }
     try {
       this.storage.withLock((current) => {
-        const currentData = this.parseStorageData(current);
-        const merged = { ...currentData };
+        const state = this.parseStorageState(current);
+        delete state.loginAttempts[provider];
         if (credential) {
-          merged[provider] = credential;
+          state.credentials[provider] = credential;
         } else {
-          delete merged[provider];
+          delete state.credentials[provider];
         }
-        return { result: void 0, next: JSON.stringify(merged, null, 2) };
+        return { result: void 0, next: this.serializeStorageState(state) };
       });
     } catch (error) {
       this.recordError(error);
@@ -5218,12 +5312,12 @@ var AuthStorage = class _AuthStorage {
   removeVerified(provider) {
     this.assertWritableStorage();
     this.storage.withLock((current) => {
-      const currentData = this.parseStorageData(current);
-      if (!(provider in currentData))
+      const state = this.parseStorageState(current);
+      if (!(provider in state.credentials) && !(provider in state.loginAttempts))
         return { result: void 0 };
-      const merged = { ...currentData };
-      delete merged[provider];
-      return { result: void 0, next: JSON.stringify(merged, null, 2) };
+      delete state.credentials[provider];
+      delete state.loginAttempts[provider];
+      return { result: void 0, next: this.serializeStorageState(state) };
     });
     delete this.data[provider];
     this.clearStaleAuthSource(provider, "stored");
@@ -5277,8 +5371,55 @@ var AuthStorage = class _AuthStorage {
     if (!provider) {
       throw new Error(`Unknown OAuth provider: ${providerId}`);
     }
-    const credentials = await provider.login(callbacks);
-    this.set(providerId, { type: "oauth", ...credentials });
+    await this.setFromLogin(providerId, async () => ({ type: "oauth", ...await provider.login(callbacks) }), callbacks.signal);
+  }
+  /** Collect credentials without holding the lock, then commit only for the current login. */
+  async setFromLogin(providerId, collectCredential, signal) {
+    this.assertWritableStorage();
+    if (signal?.aborted)
+      throw new Error("Login cancelled");
+    const attemptId = randomUUID();
+    this.storage.withLock((current) => {
+      const state = this.parseStorageState(current);
+      state.loginAttempts[providerId] = attemptId;
+      return { result: void 0, next: this.serializeStorageState(state) };
+    });
+    const releaseAttempt = () => {
+      try {
+        this.storage.withLock((current) => {
+          const state = this.parseStorageState(current);
+          if (state.loginAttempts[providerId] !== attemptId)
+            return { result: void 0 };
+          delete state.loginAttempts[providerId];
+          return { result: void 0, next: this.serializeStorageState(state) };
+        });
+      } catch (error) {
+        this.recordError(error);
+      }
+    };
+    signal?.addEventListener("abort", releaseAttempt, { once: true });
+    try {
+      const credential = await collectCredential();
+      if (signal?.aborted)
+        throw new Error("Login cancelled");
+      const data = this.storage.withLock((current) => {
+        const state = this.parseStorageState(current);
+        if (state.loginAttempts[providerId] !== attemptId) {
+          throw new Error("Login cancelled: credentials changed or login was superseded");
+        }
+        delete state.loginAttempts[providerId];
+        state.credentials[providerId] = credential;
+        return { result: state.credentials, next: this.serializeStorageState(state) };
+      });
+      this.data = data;
+      this.loadError = null;
+      this.clearStaleAuthSource(providerId, "stored");
+    } catch (error) {
+      releaseAttempt();
+      throw error;
+    } finally {
+      signal?.removeEventListener("abort", releaseAttempt);
+    }
   }
   /**
    * Logout from a provider.
@@ -5299,7 +5440,8 @@ var AuthStorage = class _AuthStorage {
       return null;
     }
     const result = await this.storage.withLockAsync(async (current) => {
-      const currentData = this.parseStorageData(current);
+      const state = this.parseStorageState(current);
+      const currentData = state.credentials;
       this.data = currentData;
       this.loadError = null;
       const cred = currentData[providerId];
@@ -5325,7 +5467,7 @@ var AuthStorage = class _AuthStorage {
       };
       this.data = merged;
       this.loadError = null;
-      return { result: refreshed, next: JSON.stringify(merged, null, 2) };
+      return { result: refreshed, next: this.serializeStorageState({ ...state, credentials: merged }) };
     });
     return result;
   }
@@ -7080,7 +7222,7 @@ async function selectConfig(options) {
 // dist/cli/daemon-update-restart.js
 var import_proper_lockfile3 = __toESM(require_proper_lockfile(), 1);
 import { spawn } from "node:child_process";
-import { createHash as createHash2, randomUUID } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 var DAEMON_UPDATE_RESTART_COORDINATOR_FLAG = "--internal-update-restart-coordinator";
@@ -7141,7 +7283,7 @@ function socketKey(socketPath) {
   return createHash2("sha256").update(normalizeSocketPath(socketPath)).digest("hex");
 }
 function writeJsonAtomically(path6, value) {
-  const tempPath = `${path6}.${process.pid}.${randomUUID()}.tmp`;
+  const tempPath = `${path6}.${process.pid}.${randomUUID2()}.tmp`;
   try {
     writeFileSync3(tempPath, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
@@ -7375,7 +7517,7 @@ var DaemonUpdateRestartCoordinatorAlreadyRunningError = class extends Error {
 async function acquireDaemonUpdateRestartCoordinator(options) {
   const registryDir = options.registryDir ?? defaultCoordinatorRegistryDir();
   const path6 = coordinatorRecordPath(registryDir, options.socketPath);
-  const token = randomUUID();
+  const token = randomUUID2();
   const processStartId = getProcessStartId(process.pid);
   const record3 = {
     version: 1,
@@ -7461,7 +7603,7 @@ function selectedUpdateInstallation() {
   return ownedVersion(owned.root, selected.active);
 }
 async function launchDaemonUpdateRestartCoordinator(options) {
-  const requestId = randomUUID();
+  const requestId = randomUUID2();
   const agentDir = resolve2(options.agentDir);
   const socketPath = resolveDaemonUpdateRestartSocketPath(options.socketPath);
   const statusPath = createStatusPath(agentDir, socketPath, requestId);
@@ -14345,7 +14487,7 @@ var DefaultPackageManager = class {
 
 // dist/modes/daemon/daemon-supervisor-ownership.js
 var import_proper_lockfile4 = __toESM(require_proper_lockfile(), 1);
-import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync5, realpathSync, renameSync as renameSync3, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { basename as basename3, dirname as dirname6, join as join7, resolve as resolve4 } from "node:path";
 var DAEMON_SUPERVISOR_REGISTRY_DIR_ENV = "BASE_CONTEXT_INTERNAL_DAEMON_SUPERVISOR_REGISTRY_DIR";
@@ -14413,17 +14555,15 @@ var RenewableRegistryRecord = class {
     await this.refreshPromise;
   }
   async performRenew() {
-    try {
-      await withDaemonSupervisorRegistryGuard(this.registryDir, () => {
-        if (this.stopped || this.lost) {
-          throw this.createLostError();
-        }
-        this.renewUnderGuard();
-      });
-    } catch (error) {
+    const held = await withDaemonSupervisorRegistryGuard(this.registryDir, () => {
+      if (this.stopped || this.lost)
+        return false;
+      return this.renewUnderGuard();
+    });
+    if (!held) {
       this.lost = true;
       clearInterval(this.refreshTimer);
-      throw error;
+      throw this.createLostError();
     }
   }
   async stop() {
@@ -14490,7 +14630,7 @@ var DaemonSupervisorOwnership = class {
         if (!current || current.token !== this.record.token) {
           return;
         }
-        releasedDirectory = `${this.ownerDirectory}.released-${randomUUID2()}`;
+        releasedDirectory = `${this.ownerDirectory}.released-${randomUUID3()}`;
         renameSync3(this.ownerDirectory, releasedDirectory);
       });
       this.released = true;
@@ -14520,13 +14660,14 @@ var DaemonShutdownAdmission = class {
   renewUnderGuard() {
     const path6 = shutdownAdmissionPath(this.registryDir);
     const current = readShutdownAdmission(path6);
-    if (!current || current.token !== this.record.token || current.pid !== this.record.pid || current.processStartId !== this.record.processStartId || Date.parse(current.expiresAt) <= Date.now() || !matchesExactProcessIdentity(this.record)) {
-      throw new DaemonShutdownAdmissionError("Daemon shutdown admission was lost");
+    if (!current || current.token !== this.record.token || current.pid !== this.record.pid || current.processStartId !== this.record.processStartId || !matchesExactProcessIdentity(this.record)) {
+      return false;
     }
     const now = Date.now();
     this.record.updatedAt = new Date(now).toISOString();
     this.record.expiresAt = new Date(now + SHUTDOWN_ADMISSION_LEASE_MS).toISOString();
     writeJsonAtomically2(path6, this.record);
+    return true;
   }
   async release() {
     if (this.released) {
@@ -14636,7 +14777,7 @@ async function mutateDaemonSupervisorOwner(generation, expectedToken, mutation,
 async function acquireDaemonSupervisorOwnership(options) {
   const registryDir = options.registryDir ?? defaultDaemonSupervisorRegistryDir();
   mkdirSync5(registryDir, { recursive: true, mode: 448 });
-  const token = randomUUID2();
+  const token = randomUUID3();
   const processStartId = getProcessStartId(process.pid);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record3 = {
@@ -14677,7 +14818,7 @@ async function acquireDaemonSupervisorOwnership(options) {
         if (isProcessIdentityAlive2(owner)) {
           throw new DaemonSupervisorAlreadyRunningError(owner);
         }
-        const staleDirectory = `${directory}.stale-${randomUUID2()}`;
+        const staleDirectory = `${directory}.stale-${randomUUID3()}`;
         renameSync3(directory, staleDirectory);
         staleDirectories.push(staleDirectory);
       }
@@ -14740,7 +14881,7 @@ async function acquireDaemonShutdownAdmission() {
       const now = Date.now();
       acquired = {
         version: OWNER_VERSION,
-        token: randomUUID2(),
+        token: randomUUID3(),
         pid: process.pid,
         ...processStartId ? { processStartId } : {},
         createdAt: new Date(now).toISOString(),
@@ -14757,7 +14898,7 @@ async function acquireDaemonShutdownAdmission() {
 }
 async function isDaemonShutdownAdmissionActive() {
   const registryDir = defaultDaemonSupervisorRegistryDir();
-  return withDaemonSupervisorRegistryGuard(registryDir, () => readActiveShutdownAdmission(registryDir) !== void 0);
+  return withDaemonSupervisorRegistryGuard(registryDir, () => shutdownAdmissionIsActive(readShutdownAdmission(shutdownAdmissionPath(registryDir))));
 }
 async function persistDaemonStartupFenceFromOwner(socketPath, hello, registryDir, legacyRegistryDir = void 0) {
   registryDir ??= defaultDaemonSupervisorRegistryDir();
@@ -14795,7 +14936,7 @@ async function persistDaemonStartupFenceFromOwner(socketPath, hello, registryDir
     }
     const record3 = {
       version: OWNER_VERSION,
-      token: randomUUID2(),
+      token: randomUUID3(),
       ownerToken: owner.token,
       pid: owner.pid,
       processStartId: owner.processStartId,
@@ -14923,7 +15064,7 @@ function readOwnerRecordForScope(directory, isRelevant) {
   const scope = readOwnerScope(directory);
   const entries2 = !scope ? readdirSync2(directory) : [];
   if (!scope && !entries2.includes("owner.json") && !entries2.includes("scope.json")) {
-    const abandonedDirectory = `${directory}.abandoned-${randomUUID2()}`;
+    const abandonedDirectory = `${directory}.abandoned-${randomUUID3()}`;
     renameSync3(directory, abandonedDirectory);
     rmSync3(abandonedDirectory, { recursive: true, force: true });
     return void 0;
@@ -15000,13 +15141,16 @@ function readStartupFence(path6) {
     throw error;
   }
 }
+function shutdownAdmissionIsActive(admission) {
+  return admission !== void 0 && Date.parse(admission.expiresAt) > Date.now() && isProcessIdentityAlive2(admission);
+}
 function readActiveShutdownAdmission(registryDir) {
   const path6 = shutdownAdmissionPath(registryDir);
   const admission = readShutdownAdmission(path6);
   if (!admission) {
     return void 0;
   }
-  if (Date.parse(admission.expiresAt) > Date.now() && isProcessIdentityAlive2(admission)) {
+  if (shutdownAdmissionIsActive(admission)) {
     return admission;
   }
   rmSync3(path6, { force: true });
@@ -15031,7 +15175,7 @@ function readShutdownAdmission(path6) {
   }
 }
 function writeJsonAtomically2(path6, value) {
-  const tempPath = `${path6}.${process.pid}.${randomUUID2()}.tmp`;
+  const tempPath = `${path6}.${process.pid}.${randomUUID3()}.tmp`;
   try {
     writeFileSync5(tempPath, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
@@ -15053,7 +15197,7 @@ function delay2(ms2) {
 }
 
 // dist/owned-install.js
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 import { existsSync as existsSync5, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync6, renameSync as renameSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
 import { homedir as homedir3, tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname7, join as join8, resolve as resolve5 } from "node:path";
@@ -15214,7 +15358,7 @@ async function installOwnedRelease(options) {
   });
   assertSelection(root, expected);
   initializeRoot(root);
-  const installation = ownedVersion(root, `${version}-${randomUUID3()}`);
+  const installation = ownedVersion(root, `${version}-${randomUUID4()}`);
   const directory = join8(root, "versions", installation.version);
   mkdirSync6(directory, { recursive: true, mode: 448 });
   writeFileSync6(join8(directory, "package.json"), `${JSON.stringify({
@@ -17979,6 +18123,7 @@ async function runShutdownAllConverging(json, force, assertAdmission) {
 }
 async function stopHiddenSupervisors(stopped, failed, handledPids, reportedFailures, assertAdmission) {
   while (true) {
+    await assertAdmission();
     const listeners = scanListeningDaemons().filter((listener) => !isWorkerSocketPath(listener.socketPath));
     const bySocket = /* @__PURE__ */ new Map();
     for (const listener of listeners) {
@@ -20989,8 +21134,8 @@ var McpManager = class {
     const { bearerTokenEnvVar } = integration.config;
     if (!integration.usesOAuth && !bearerTokenEnvVar)
       return true;
-    if (bearerTokenEnvVar && process.env[bearerTokenEnvVar]?.trim()) {
-      return true;
+    if (bearerTokenEnvVar) {
+      return Boolean(process.env[bearerTokenEnvVar]?.trim());
     }
     const providerId = this.providerId(integration.server);
     const cred = this.authStorage.get(providerId);
@@ -24557,7 +24702,7 @@ function runMigrations(cwd) {
 
 // dist/modes/daemon/daemon-catalog-process.js
 import { spawn as spawn6 } from "node:child_process";
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 import { existsSync as existsSync16 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { join as join19, sep as sep7 } from "node:path";
@@ -27434,7 +27579,7 @@ var DaemonCatalogClient = class {
     if (options && "page" in options)
       return this.request({
         type: "request",
-        id: randomUUID4(),
+        id: randomUUID5(),
         command: "list",
         cwd,
         sessionDir,
@@ -27443,16 +27588,16 @@ var DaemonCatalogClient = class {
         ledgerSessionDir: options.ledgerSessionDir,
         scope: options.scope
       });
-    const data = await this.request({ type: "request", id: randomUUID4(), command: "list", cwd, sessionDir }, options);
+    const data = await this.request({ type: "request", id: randomUUID5(), command: "list", cwd, sessionDir }, options);
     return data.sessions.map(deserializeSessionInfo);
   }
   async rename(sessionPath, name) {
-    await this.request({ type: "request", id: randomUUID4(), command: "rename", sessionPath, name });
+    await this.request({ type: "request", id: randomUUID5(), command: "rename", sessionPath, name });
   }
   async resolve(selector, cwd, sessionDir) {
     const data = await this.request({
       type: "request",
-      id: randomUUID4(),
+      id: randomUUID5(),
       command: "resolve",
       selector,
       cwd,
@@ -27461,12 +27606,12 @@ var DaemonCatalogClient = class {
     return data.sessionPath;
   }
   delete(sessionPath) {
-    return this.request({ type: "request", id: randomUUID4(), command: "delete", sessionPath });
+    return this.request({ type: "request", id: randomUUID5(), command: "delete", sessionPath });
   }
   async archive(sessionPath, sessionId) {
     const data = await this.request({
       type: "request",
-      id: randomUUID4(),
+      id: randomUUID5(),
       command: "archive",
       sessionPath,
       sessionId
@@ -27476,7 +27621,7 @@ var DaemonCatalogClient = class {
   async markInterrupted(sessionPath, activeSessionId, operations) {
     await this.request({
       type: "request",
-      id: randomUUID4(),
+      id: randomUUID5(),
       command: "mark_interrupted",
       sessionPath,
       activeSessionId,
@@ -27490,7 +27635,7 @@ var DaemonCatalogClient = class {
       const child = this.child;
       if (!child && !this.starting)
         return;
-      await this.request({ type: "request", id: randomUUID4(), command: "shutdown" }).catch(() => void 0);
+      await this.request({ type: "request", id: randomUUID5(), command: "shutdown" }).catch(() => void 0);
       if (child?.connected)
         child.disconnect();
       if (this.child === child)
@@ -27964,7 +28109,7 @@ function bashToolCallId(runId) {
 }
 
 // dist/modes/acp/acp-mode.js
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import { realpathSync as realpathSync4, statSync as statSync6 } from "node:fs";
 import { resolve as resolve19 } from "node:path";
 import { Readable } from "node:stream";
@@ -33064,7 +33209,7 @@ async function runAcpModeWithConnection(connection, options = {}) {
     takeOverStdout();
   }
   const supportsMcpServers = connection.supportsAcpMcpServers?.() === true && connection.replaceAcpMcpServers !== void 0 && connection.releaseAcpMcpServers !== void 0;
-  const acpMcpOwnerId = randomUUID5();
+  const acpMcpOwnerId = randomUUID6();
   let acpMcpServerNames = [];
   const clearAcpMcpServers = async (serverNames = acpMcpServerNames) => {
     if (!supportsMcpServers || !connection.releaseAcpMcpServers)
@@ -33187,7 +33332,7 @@ async function runAcpModeWithConnection(connection, options = {}) {
       await entry.inputPauseRelease.promise.catch(() => void 0);
       entry.inputPauseRelease = void 0;
     }
-    const leaseKey = entry.inputPauseKey ?? randomUUID5();
+    const leaseKey = entry.inputPauseKey ?? randomUUID6();
     entry.inputPauseKey = leaseKey;
     const pause = await connection.acquireSessionInputPause(leaseKey);
     entry.inputPause = pause;
@@ -33279,7 +33424,7 @@ async function runAcpModeWithConnection(connection, options = {}) {
       if (typeof requestedCwd === "string" && requestedCwd.length > 0 && actualCwd && !sameCwd(requestedCwd, actualCwd)) {
         cwdMismatch = { requested: requestedCwd, actual: actualCwd };
       }
-      const sessionId = randomUUID5();
+      const sessionId = randomUUID6();
       const producer = new AcpUpdateProducer(sessionId, ctx.client);
       let inputPauseRelease;
       if (closedInputPause) {
@@ -33605,7 +33750,7 @@ async function runAcpModeWithConnection(connection, options = {}) {
 }
 
 // dist/modes/agent-connection/daemon-agent-connection.js
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 
 // dist/modes/agents-view/roster-store.js
 var STALE_ROSTER_DAEMON_MESSAGE = "Daemon is stale: it does not advertise the agent_roster capability; restart the daemon";
@@ -34084,7 +34229,7 @@ var DaemonAgentConnection = class _DaemonAgentConnection {
   listeners = /* @__PURE__ */ new Set();
   unsubscribeDaemonMessages;
   unsubscribeDaemonClose;
-  clientId = `daemon-agent-connection:${randomUUID6()}`;
+  clientId = `daemon-agent-connection:${randomUUID7()}`;
   sessionInputPauses = /* @__PURE__ */ new Map();
   sessionInputPauseGeneration = 0;
   ownedSessionPromotionTail = Promise.resolve();
@@ -34709,7 +34854,7 @@ var DaemonAgentConnection = class _DaemonAgentConnection {
       }, DAEMON_LONG_RUNNING_REQUEST_TIMEOUT_MS);
       return;
     }
-    const admissionId = `prompt-admission:${randomUUID6()}`;
+    const admissionId = `prompt-admission:${randomUUID7()}`;
     let resolveAbort = () => {
     };
     const aborted = new Promise((resolve26) => {
@@ -36560,7 +36705,7 @@ var CustomEditor = class extends Editor {
 };
 
 // dist/modes/interactive/interactive-mode.js
-import { randomUUID as randomUUID8 } from "node:crypto";
+import { randomUUID as randomUUID9 } from "node:crypto";
 import * as fs5 from "node:fs";
 import * as os3 from "node:os";
 import * as path5 from "node:path";
@@ -36943,7 +37088,7 @@ import { platform as platform2 } from "os";
 
 // dist/utils/clipboard-image.js
 import { spawnSync as spawnSync6 } from "child_process";
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { readFileSync as readFileSync17, unlinkSync as unlinkSync3 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
 import { join as join22 } from "path";
@@ -37049,7 +37194,7 @@ function isWSL(env = process.env) {
   }
 }
 function readClipboardImageViaPowerShell() {
-  const tmpFile = join22(tmpdir3(), `pi-wsl-clip-${randomUUID7()}.png`);
+  const tmpFile = join22(tmpdir3(), `pi-wsl-clip-${randomUUID8()}.png`);
   try {
     const winPathResult = runCommand("wslpath", ["-w", tmpFile], { timeoutMs: DEFAULT_LIST_TIMEOUT_MS });
     if (!winPathResult.ok) {
@@ -37632,6 +37777,9 @@ var MenuSearchInput = class {
   setValue(value) {
     this.input.setValue(value);
   }
+  setMasked(masked) {
+    this.input.setMasked(masked);
+  }
   handleInput(data) {
     this.input.handleInput(data);
   }
@@ -37967,6 +38115,7 @@ var LoginDialogComponent = class extends Container {
    * Show input for manual code/URL entry (for callback server providers)
    */
   showManualInput(prompt) {
+    this.input.setMasked(true);
     this.addSectionSpacer();
     this.addSectionTitle("Manual fallback");
     this.addMutedText(prompt);
@@ -37990,7 +38139,8 @@ var LoginDialogComponent = class extends Container {
    * Called by onPrompt callback - show prompt and wait for input
    * Note: Does NOT clear content, appends to existing (preserves URL from showAuth)
    */
-  showPrompt(message, placeholder) {
+  showPrompt(message, placeholder, options) {
+    this.input.setMasked(options?.masked === true);
     this.addSectionSpacer();
     this.addSectionTitle(message);
     if (placeholder) {
@@ -38528,7 +38678,7 @@ var ProviderAuthFlows = class {
       const selector = new OAuthSelectorComponent("logout", this.host.modelRegistry.authStorage, providerOptions, async (providerOption) => {
         close();
         try {
-          this.host.modelRegistry.authStorage.logout(providerOption.id);
+          this.host.modelRegistry.authStorage.removeVerified(providerOption.id);
           this.host.modelRegistry.refresh();
           await this.host.onAuthChanged?.();
           const message = providerOption.authType === "oauth" ? `Logged out of ${providerOption.name}` : `Removed stored API key for ${providerOption.name}. Environment variables and models.json config are unchanged.`;
@@ -38666,11 +38816,12 @@ var ProviderAuthFlows = class {
       this.host.ui.requestRender();
     };
     try {
-      const apiKey = (await dialog.showPrompt("Enter API key:")).trim();
-      if (!apiKey) {
-        throw new Error("API key cannot be empty.");
-      }
-      this.host.modelRegistry.authStorage.set(providerId, { type: "api_key", key: apiKey });
+      await this.host.modelRegistry.authStorage.setFromLogin(providerId, async () => {
+        const apiKey = (await dialog.showPrompt("Enter API key:", void 0, { masked: true })).trim();
+        if (!apiKey)
+          throw new Error("API key cannot be empty.");
+        return { type: "api_key", key: apiKey };
+      }, dialog.signal);
       closeDialog();
       return await this.completeProviderAuthentication(providerId, providerName, "api_key", void 0, kind);
     } catch (error) {
@@ -51827,7 +51978,7 @@ ${message}`, ["Yes", "No"], opts);
     }
     const previousTurns = this.sideQuestionTurns.filter((turn) => turn.answer).map((turn) => ({ question: turn.question, answer: turn.answer }));
     const event = {
-      id: randomUUID8(),
+      id: randomUUID9(),
       question,
       answer: "",
       status: "running"
@@ -51881,7 +52032,7 @@ ${message}`, ["Yes", "No"], opts);
     const truncation = truncateTail(rawOutput);
     const output = truncation.content.replace(/\n+$/, "");
     this.sideQuestionTurns.push({
-      id: `side-bash-${randomUUID8()}`,
+      id: `side-bash-${randomUUID9()}`,
       question: bash.input,
       answer: bashOutputToText({
         output,
@@ -51975,7 +52126,7 @@ ${message}`, ["Yes", "No"], opts);
         if (this.sideQuestionComponent && slashCommand !== void 0 && (isBuiltinSlashCommandName(slashCommand.name) || this.connectionCommands.some((command) => command.name === slashCommand.name))) {
           this.editor.addToHistory?.(text);
           this.sideQuestionComponent.addTurn({
-            id: `side-notice-${randomUUID8()}`,
+            id: `side-notice-${randomUUID9()}`,
             question: text,
             answer: "Slash commands are not available in side conversations. Press esc to return to the main thread.",
             status: "complete"
@@ -52214,7 +52365,7 @@ ${message}`, ["Yes", "No"], opts);
             this.showWarning("Wait for the current side question to finish or cancel it first.");
             return;
           }
-          const sideBash = this.sideQuestionComponent ? { runId: randomUUID8(), input: text, seedTranscript: !isExcluded } : void 0;
+          const sideBash = this.sideQuestionComponent ? { runId: randomUUID9(), input: text, seedTranscript: !isExcluded } : void 0;
           if (sideBash) {
             this.sideQuestionBash = sideBash;
           } else {
@@ -52259,7 +52410,7 @@ ${message}`, ["Yes", "No"], opts);
           if (this.hasPastedImagesFor(text)) {
             this.editor.setText(text);
             this.sideQuestionComponent.addTurn({
-              id: `side-notice-${randomUUID8()}`,
+              id: `side-notice-${randomUUID9()}`,
               question: text,
               answer: "Images are not supported in side conversations. Press esc to return to the main thread.",
               status: "complete"
@@ -55239,12 +55390,12 @@ Fell back to dark theme.`);
         this.showError("Usage: /mcp logout <name>");
         return;
       }
-      if (!isAuthed(server)) {
-        this.showStatus(`${server} is not connected.`);
-        return;
+      try {
+        authStorage.removeVerified(`mcp:${server}`);
+        await this.reloadAfterMcpChange(`Disconnected ${server}.`);
+      } catch (error) {
+        this.showError(`Logout failed: ${error instanceof Error ? error.message : String(error)}`);
       }
-      authStorage.logout(`mcp:${server}`);
-      await this.reloadAfterMcpChange(`Disconnected ${server}.`);
       return;
     }
     try {
@@ -58723,10 +58874,10 @@ function padLine(line, width) {
 
 // dist/modes/daemon/daemon-mode.js
 import { spawn as spawn9 } from "node:child_process";
-import { createHash as createHash8, randomUUID as randomUUID12, timingSafeEqual } from "node:crypto";
+import { createHash as createHash8, randomUUID as randomUUID13, timingSafeEqual } from "node:crypto";
 import { existsSync as existsSync24, mkdirSync as mkdirSync16, readFileSync as readFileSync23, renameSync as renameSync11, rmSync as rmSync12, writeFileSync as writeFileSync11 } from "node:fs";
 import { stat as stat3 } from "node:fs/promises";
-import { createConnection as createConnection2, createServer } from "node:net";
+import { createConnection as createConnection2, createServer as createServer2 } from "node:net";
 import { basename as basename11, dirname as dirname18, isAbsolute as isAbsolute5, join as join30, resolve as resolve23 } from "node:path";
 
 // dist/core/rlm-journal-owner.js
@@ -58904,10 +59055,10 @@ var RlmJournalOwner = class _RlmJournalOwner {
 };
 
 // dist/modes/daemon/active-session-state.js
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 function createActiveSessionId(existingIds) {
   while (true) {
-    const activeSessionId = formatSessionDisplayId(randomUUID9());
+    const activeSessionId = formatSessionDisplayId(randomUUID10());
     if (!existingIds?.has(activeSessionId)) {
       return activeSessionId;
     }
@@ -59204,7 +59355,7 @@ async function withClientEnv(env, fn) {
 }
 
 // dist/modes/daemon/daemon-extension-binding.js
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 function slimSessionEventForWire(event) {
   if (event.type !== "message_update") {
     return event;
@@ -59281,7 +59432,7 @@ function createCommandContextActions(state) {
 }
 function createExtensionUIContext(state, broadcast) {
   const emitUiRequest = (method, payload) => {
-    const id = randomUUID10();
+    const id = randomUUID11();
     broadcast(state, {
       type: "extension_ui_request",
       activeSessionId: state.activeSessionId,
@@ -59381,7 +59532,7 @@ function hasExtensionUiClientForMethod(state, method) {
 }
 
 // dist/modes/daemon/daemon-rlm-capacity.js
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 var DaemonRlmCapacityClient = class {
   options;
   reservations = /* @__PURE__ */ new Map();
@@ -59405,7 +59556,7 @@ var DaemonRlmCapacityClient = class {
     return this.reserve(origin, true);
   }
   async reserve(origin, residentRoot) {
-    const reservationId = randomUUID11();
+    const reservationId = randomUUID12();
     const record3 = { ...origin, reservationId, ...residentRoot ? { residentRoot } : {} };
     this.reservations.set(reservationId, record3);
     let released = false;
@@ -60552,7 +60703,7 @@ var AgentDaemon = class {
     await this.openRlmJournalOwner();
     try {
       await prepareDaemonSocketPath(this.socketPath);
-      this.server = createServer((socket) => this.handleConnection(socket));
+      this.server = createServer2((socket) => this.handleConnection(socket));
       await new Promise((resolveListen, rejectListen) => {
         const onError = (error) => {
           this.server?.off("listening", onListening);
@@ -60731,7 +60882,7 @@ var AgentDaemon = class {
     let ownsLock = false;
     try {
       for (let attempt2 = 0; attempt2 < 3 && !ownsLock; attempt2++) {
-        const token = randomUUID12();
+        const token = randomUUID13();
         const candidateDirectory = `${lockDirectory}.candidate-${process.pid}-${token}`;
         mkdirSync16(candidateDirectory, { mode: 448 });
         writeFileSync11(join30(candidateDirectory, "pid"), `${process.pid}
@@ -63793,7 +63944,7 @@ var AgentDaemon = class {
           return success(command.id, "acquire_session_input_pause", { pauseId: existing[0] });
         }
         const state = this.getSessionState(command.activeSessionId);
-        const pauseId = randomUUID12();
+        const pauseId = randomUUID13();
         this.sessionInputPauses.set(pauseId, {
           activeSessionId: command.activeSessionId,
           owner: client,
@@ -66340,9 +66491,9 @@ async function resolveDaemonSessionPath(selector, cwd, sessionDir) {
 
 // dist/modes/daemon/daemon-supervisor.js
 import { spawn as spawn10 } from "node:child_process";
-import { createHash as createHash9, randomBytes, randomUUID as randomUUID13 } from "node:crypto";
+import { createHash as createHash9, randomBytes, randomUUID as randomUUID14 } from "node:crypto";
 import { chmodSync as chmodSync3, existsSync as existsSync25, mkdirSync as mkdirSync18, readdirSync as readdirSync10, readFileSync as readFileSync25, renameSync as renameSync13, rmSync as rmSync13, writeFileSync as writeFileSync12 } from "node:fs";
-import { createServer as createServer2 } from "node:net";
+import { createServer as createServer3 } from "node:net";
 import { basename as basename12, dirname as dirname20, join as join31, resolve as resolve24 } from "node:path";
 import { Writable } from "node:stream";
 
@@ -66974,7 +67125,7 @@ var DaemonSupervisor = class {
   sessionInputPauses = /* @__PURE__ */ new Map();
   signalCleanupHandlers = [];
   descriptorDir;
-  generation = randomUUID13();
+  generation = randomUUID14();
   supervisorConfigPath;
   defaultSessionConfig;
   snapshotCacheRoot;
@@ -67057,7 +67208,7 @@ var DaemonSupervisor = class {
       const workersToAdopt = [...this.workers.values()];
       for (const worker of workersToAdopt)
         this.pendingRlmCapacity.add(worker);
-      this.server = createServer2((socket) => this.handleConnection(socket));
+      this.server = createServer3((socket) => this.handleConnection(socket));
       await this.listen();
       this.assertSocketLeaseHeld();
       this.socketIdentity = getDaemonSocketIdentity(this.socketPath);
@@ -67709,7 +67860,7 @@ var DaemonSupervisor = class {
       }
       try {
         const response = await this.forwardToWorker(entry.worker, {
-          id: randomUUID13(),
+          id: randomUUID14(),
           type: "release_session_input_pause",
           activeSessionId: entry.activeSessionId,
           pauseId: entry.pauseId
@@ -67846,7 +67997,7 @@ var DaemonSupervisor = class {
         client,
         activeSessionId: command.activeSessionId,
         publicAdmissionId: command.admissionId,
-        workerAdmissionId: `supervisor-admission:${randomUUID13()}`,
+        workerAdmissionId: `supervisor-admission:${randomUUID14()}`,
         status: "waiting",
         controller: new AbortController()
       };
@@ -68339,7 +68490,7 @@ var DaemonSupervisor = class {
         if (!this.clients.has(client) || (this.sessionInputPauseEpochs.get(client) ?? 0) !== acquisitionEpoch) {
           try {
             const release = await this.forwardToWorker(match2.worker, {
-              id: randomUUID13(),
+              id: randomUUID14(),
               type: "release_session_input_pause",
               activeSessionId,
               pauseId
@@ -69164,7 +69315,7 @@ var DaemonSupervisor = class {
     const rootActiveSessionId = existing?.descriptor.rootActiveSessionId ?? createActiveSessionId();
     const socketPath = existing?.descriptor.socketPath ?? workerSocketPath(this.socketPath, workerId);
     const token = existing?.descriptor.authenticationToken ?? randomBytes(32).toString("base64url");
-    const workerInstanceId = randomUUID13();
+    const workerInstanceId = randomUUID14();
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const descriptorPath = existing?.descriptorPath ?? join31(this.descriptorDir, `${workerId}.json`);
     const recoveryJournalPath = existing?.descriptor.recoveryJournalPath ?? join31(this.descriptorDir, `${workerId}.recovery.jsonl`);
@@ -70624,7 +70775,7 @@ var DaemonSupervisor = class {
     if (!socketIdentity) {
       throw new Error("Direct transport requires an exact worker socket identity");
     }
-    const grantId = randomUUID13();
+    const grantId = randomUUID14();
     const token = randomBytes(32).toString("base64url");
     const expiresAt = new Date(Date.now() + PEER_TRANSPORT_GRANT_TTL_MS).toISOString();
     const resolvedActiveSessionId = currentSummary.activeSessionId ?? currentSummary.id;
@@ -73137,7 +73288,7 @@ var RpcClient = class {
 };
 
 // dist/modes/rpc/rpc-extension-ui-context.js
-import { randomUUID as randomUUID14 } from "node:crypto";
+import { randomUUID as randomUUID15 } from "node:crypto";
 function createRpcExtensionUiBridge(output) {
   const pending = /* @__PURE__ */ new Map();
   let closed = false;
@@ -73145,7 +73296,7 @@ function createRpcExtensionUiBridge(output) {
     if (closed || opts?.signal?.aborted) {
       return Promise.resolve(defaultValue);
     }
-    const id = randomUUID14();
+    const id = randomUUID15();
     return new Promise((resolve26) => {
       let timeout;
       const cleanup = () => {
@@ -73170,7 +73321,7 @@ function createRpcExtensionUiBridge(output) {
     });
   };
   const fireAndForget = (request) => {
-    output({ type: "extension_ui_request", id: randomUUID14(), ...request });
+    output({ type: "extension_ui_request", id: randomUUID15(), ...request });
   };
   const uiContext = {
     select: (title, options, opts) => createDialogPromise(opts, void 0, { method: "select", title, options, timeout: opts?.timeout }, (response) => "cancelled" in response && response.cancelled ? void 0 : "value" in response ? response.value : void 0),