@ponythewhite/base-context 1.0.2 → 1.0.5

package/dist/bundle/{chunk-44PEHPOG.js → chunk-WFJRFQGG.js}

@@ -347,7 +347,7 @@ import {
   watchWithErrorHandler,
   workerRosterEntryFromSummary,
   wrapTextWithAnsi
-} from "./chunk-IADCPVEI.js";
+} from "./chunk-6FZM46AU.js";
 import {
   array,
   boolean,
@@ -366,7 +366,7 @@ import {
 import {
   installFileLogSink,
   setLogContext
-} from "./chunk-HKINIBP4.js";
+} from "./chunk-LFPWHI42.js";
 import {
   APP_NAME,
   APP_TITLE,
@@ -383,7 +383,6 @@ import {
   getAgentLogPath,
   getAuthPath,
   getBinDir,
-  getBundledInteractiveAssetPath,
   getBundledSkillsDir,
   getChangelogPath,
   getClientErrorLogPath,
@@ -413,7 +412,7 @@ import {
   shouldUseWindowsShell,
   signalProcessGroupOrProcess,
   typebox_exports
-} from "./chunk-27QCJ2AZ.js";
+} from "./chunk-UPVDERMD.js";
 import {
   PRODUCT,
   PRODUCT_ENV
@@ -605,9 +604,9 @@ var require_pump = __commonJS({
   "../../node_modules/pump/index.js"(exports, module) {
     var once = require_once();
     var eos = require_end_of_stream();
-    var fs6;
+    var fs5;
     try {
-      fs6 = __require("fs");
+      fs5 = __require("fs");
     } catch (e) {
     }
     var noop = function() {
@@ -618,8 +617,8 @@ var require_pump = __commonJS({
     };
     var isFS = function(stream) {
       if (!ancient) return false;
-      if (!fs6) return false;
-      return (stream instanceof (fs6.ReadStream || noop) || stream instanceof (fs6.WriteStream || noop)) && isFn(stream.close);
+      if (!fs5) return false;
+      return (stream instanceof (fs5.ReadStream || noop) || stream instanceof (fs5.WriteStream || noop)) && isFn(stream.close);
     };
     var isRequest = function(stream) {
       return stream.setHeader && isFn(stream.abort);
@@ -831,7 +830,7 @@ var require_pend = __commonJS({
 // ../../node_modules/fd-slicer/index.js
 var require_fd_slicer = __commonJS({
   "../../node_modules/fd-slicer/index.js"(exports) {
-    var fs6 = __require("fs");
+    var fs5 = __require("fs");
     var util = __require("util");
     var stream = __require("stream");
     var Readable3 = stream.Readable;
@@ -856,7 +855,7 @@ var require_fd_slicer = __commonJS({
     FdSlicer.prototype.read = function(buffer, offset, length, position, callback) {
       var self = this;
       self.pend.go(function(cb) {
-        fs6.read(self.fd, buffer, offset, length, position, function(err, bytesRead, buffer2) {
+        fs5.read(self.fd, buffer, offset, length, position, function(err, bytesRead, buffer2) {
           cb();
           callback(err, bytesRead, buffer2);
         });
@@ -865,7 +864,7 @@ var require_fd_slicer = __commonJS({
     FdSlicer.prototype.write = function(buffer, offset, length, position, callback) {
       var self = this;
       self.pend.go(function(cb) {
-        fs6.write(self.fd, buffer, offset, length, position, function(err, written, buffer2) {
+        fs5.write(self.fd, buffer, offset, length, position, function(err, written, buffer2) {
           cb();
           callback(err, written, buffer2);
         });
@@ -886,7 +885,7 @@ var require_fd_slicer = __commonJS({
       if (self.refCount > 0) return;
       if (self.refCount < 0) throw new Error("invalid unref");
       if (self.autoClose) {
-        fs6.close(self.fd, onCloseDone);
+        fs5.close(self.fd, onCloseDone);
       }
       function onCloseDone(err) {
         if (err) {
@@ -923,7 +922,7 @@ var require_fd_slicer = __commonJS({
       self.context.pend.go(function(cb) {
         if (self.destroyed) return cb();
         var buffer = new Buffer(toRead);
-        fs6.read(self.context.fd, buffer, 0, toRead, self.pos, function(err, bytesRead) {
+        fs5.read(self.context.fd, buffer, 0, toRead, self.pos, function(err, bytesRead) {
           if (err) {
             self.destroy(err);
           } else if (bytesRead === 0) {
@@ -970,7 +969,7 @@ var require_fd_slicer = __commonJS({
       }
       self.context.pend.go(function(cb) {
         if (self.destroyed) return cb();
-        fs6.write(self.context.fd, buffer, 0, buffer.length, self.pos, function(err2, bytes) {
+        fs5.write(self.context.fd, buffer, 0, buffer.length, self.pos, function(err2, bytes) {
           if (err2) {
             self.destroy();
             cb();
@@ -1397,7 +1396,7 @@ var require_buffer_crc32 = __commonJS({
 // ../../node_modules/yauzl/index.js
 var require_yauzl = __commonJS({
   "../../node_modules/yauzl/index.js"(exports) {
-    var fs6 = __require("fs");
+    var fs5 = __require("fs");
     var zlib = __require("zlib");
     var fd_slicer = require_fd_slicer();
     var crc32 = require_buffer_crc32();
@@ -1427,10 +1426,10 @@ var require_yauzl = __commonJS({
       if (options.validateEntrySizes == null) options.validateEntrySizes = true;
       if (options.strictFileNames == null) options.strictFileNames = false;
       if (callback == null) callback = defaultCallback;
-      fs6.open(path6, "r", function(err, fd) {
+      fs5.open(path6, "r", function(err, fd) {
         if (err) return callback(err);
         fromFd(fd, options, function(err2, zipfile) {
-          if (err2) fs6.close(fd, defaultCallback);
+          if (err2) fs5.close(fd, defaultCallback);
           callback(err2, zipfile);
         });
       });
@@ -1447,7 +1446,7 @@ var require_yauzl = __commonJS({
       if (options.validateEntrySizes == null) options.validateEntrySizes = true;
       if (options.strictFileNames == null) options.strictFileNames = false;
       if (callback == null) callback = defaultCallback;
-      fs6.fstat(fd, function(err, stats) {
+      fs5.fstat(fd, function(err, stats) {
         if (err) return callback(err);
         var reader = fd_slicer.createFromFd(fd, { autoClose: true });
         fromRandomAccessReader(reader, stats.size, options, callback);
@@ -2027,7 +2026,7 @@ var require_yauzl = __commonJS({
 var require_extract_zip = __commonJS({
   "../../node_modules/extract-zip/index.js"(exports, module) {
     var debug = require_src()("extract-zip");
-    var { createWriteStream: createWriteStream2, promises: fs6 } = __require("fs");
+    var { createWriteStream: createWriteStream2, promises: fs5 } = __require("fs");
     var getStream = require_get_stream();
     var path6 = __require("path");
     var { promisify } = __require("util");
@@ -2068,8 +2067,8 @@ var require_extract_zip = __commonJS({
             }
             const destDir = path6.dirname(path6.join(this.opts.dir, entry.fileName));
             try {
-              await fs6.mkdir(destDir, { recursive: true });
-              const canonicalDestDir = await fs6.realpath(destDir);
+              await fs5.mkdir(destDir, { recursive: true });
+              const canonicalDestDir = await fs5.realpath(destDir);
               const relativeDestDir = path6.relative(this.opts.dir, canonicalDestDir);
               if (relativeDestDir.split(path6.sep).includes("..")) {
                 throw new Error(`Out of bound path "${canonicalDestDir}" found while processing file ${entry.fileName}`);
@@ -2113,14 +2112,14 @@ var require_extract_zip = __commonJS({
           mkdirOptions.mode = procMode;
         }
         debug("mkdir", { dir: destDir, ...mkdirOptions });
-        await fs6.mkdir(destDir, mkdirOptions);
+        await fs5.mkdir(destDir, mkdirOptions);
         if (isDir) return;
         debug("opening read stream", dest);
         const readStream = await promisify(this.zipfile.openReadStream.bind(this.zipfile))(entry);
         if (symlink) {
           const link = await getStream(readStream);
           debug("creating symlink", link, dest);
-          await fs6.symlink(link, dest);
+          await fs5.symlink(link, dest);
         } else {
           await pipeline2(readStream, createWriteStream2(dest, { mode: procMode }));
         }
@@ -2152,8 +2151,8 @@ var require_extract_zip = __commonJS({
       if (!path6.isAbsolute(opts.dir)) {
         throw new Error("Target directory is expected to be absolute");
       }
-      await fs6.mkdir(opts.dir, { recursive: true });
-      opts.dir = await fs6.realpath(opts.dir);
+      await fs5.mkdir(opts.dir, { recursive: true });
+      opts.dir = await fs5.realpath(opts.dir);
       return new Extractor(zipPath, opts).extract();
     };
   }
@@ -2348,7 +2347,7 @@ function formatErrorDetails(error) {
   return String(error);
 }
 async function startCallbackServer(expectedState) {
-  const { createServer: createServer3 } = await getNodeApis();
+  const { createServer: createServer4 } = await getNodeApis();
   return new Promise((resolve26, reject) => {
     let settleWait;
     const waitForCodePromise = new Promise((resolveWait) => {
@@ -2359,7 +2358,7 @@ async function startCallbackServer(expectedState) {
         resolveWait(value);
       };
     });
-    const server = createServer3((req, res) => {
+    const server = createServer4((req, res) => {
       try {
         const url2 = new URL(req.url || "", "http://localhost");
         if (url2.pathname !== CALLBACK_PATH) {
@@ -3263,6 +3262,7 @@ async function getOAuthApiKey(providerId, credentials) {
 }
 
 // ../ai/src/mcp/oauth.ts
+import { createServer } from "node:http";
 var CALLBACK_HOST3 = process.env.BASE_CONTEXT_OAUTH_CALLBACK_HOST || "127.0.0.1";
 var CALLBACK_PORT_BASE = Number(process.env.BASE_CONTEXT_MCP_OAUTH_CALLBACK_PORT || 53700);
 var CALLBACK_PORT_COUNT = 10;
@@ -3271,6 +3271,8 @@ var CALLBACK_PORTS = Array.from({ length: CALLBACK_PORT_COUNT }, (_2, i) => CALL
 var redirectUriFor = (port) => `http://localhost:${port}${CALLBACK_PATH2}`;
 var ALL_REDIRECT_URIS = CALLBACK_PORTS.map(redirectUriFor);
 var TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1e3;
+var OAUTH_REQUEST_TIMEOUT_MS = 3e4;
+var OAUTH_MAX_RESPONSE_BYTES = 1024 * 1024;
 function validatedHttpsUrl(value, name) {
   let url2;
   try {
@@ -3296,15 +3298,74 @@ function authorizationServerMetadataUrls(issuer) {
     new URL(`${path6}/.well-known/openid-configuration`, url2.origin).toString()
   ];
 }
-async function fetchResponse(url2, init) {
-  return fetch(url2, { ...init, redirect: "error" });
+async function withResponse(url2, init, read) {
+  const controller = new AbortController();
+  const signal = init.signal ? AbortSignal.any([init.signal, controller.signal]) : controller.signal;
+  const timer = setTimeout(() => controller.abort(new Error("MCP OAuth request timed out")), OAUTH_REQUEST_TIMEOUT_MS);
+  let response;
+  try {
+    signal.throwIfAborted();
+    response = await fetch(url2, { ...init, signal, redirect: "error" });
+    return await read(response, signal);
+  } finally {
+    clearTimeout(timer);
+    if (response?.body && !response.body.locked) void response.body.cancel().catch(() => {
+    });
+  }
+}
+async function readJson(response, signal, label) {
+  const reader = response.body?.getReader();
+  if (!reader) throw new Error(`${label} returned invalid JSON`);
+  const decoder = new TextDecoder();
+  let text = "";
+  let bytes = 0;
+  const cancel = () => {
+    void reader.cancel().catch(() => {
+    });
+  };
+  signal.addEventListener("abort", cancel, { once: true });
+  try {
+    while (true) {
+      signal.throwIfAborted();
+      const { done, value } = await reader.read();
+      signal.throwIfAborted();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > OAUTH_MAX_RESPONSE_BYTES) throw new Error(`${label} exceeded the OAuth response size limit`);
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+  } finally {
+    signal.removeEventListener("abort", cancel);
+    cancel();
+    reader.releaseLock();
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`${label} returned invalid JSON`);
+  }
 }
 async function fetchJson2(url2, init) {
-  const res = await fetchResponse(url2, init);
-  if (!res.ok) {
-    throw new Error(`${init?.method ?? "GET"} ${url2} failed: ${res.status}`);
+  return withResponse(url2, init, async (response, signal) => {
+    const label = `${init.method ?? "GET"} ${url2}`;
+    if (!response.ok) throw new Error(`${label} failed: ${response.status}`);
+    return readJson(response, signal, label);
+  });
+}
+async function abortable(work, signal) {
+  if (!signal) return work;
+  let onAbort;
+  const aborted = new Promise((_2, reject) => {
+    onAbort = () => reject(signal.reason);
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) onAbort();
+  });
+  try {
+    return await Promise.race([work, aborted]);
+  } finally {
+    if (onAbort) signal.removeEventListener("abort", onAbort);
   }
-  return res.json();
 }
 function authorizationServerMetadata(value, issuer, requireExactIssuer) {
   if (!value || typeof value !== "object") throw new Error(`Authorization server metadata for ${issuer} is invalid`);
@@ -3330,21 +3391,28 @@ function authorizationServerMetadata(value, issuer, requireExactIssuer) {
   if (metadata.registration_endpoint) validatedHttpsUrl(metadata.registration_endpoint, "Registration endpoint");
   return metadata;
 }
-async function jsonMetadata(response, url2) {
+async function jsonMetadata(response, url2, signal) {
   if (response.status !== 200) throw new Error(`GET ${url2} failed: ${response.status}`);
   const contentType = response.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase();
   if (contentType !== "application/json") throw new Error(`GET ${url2} did not return application/json`);
-  return response.json();
+  return readJson(response, signal, `GET ${url2}`);
 }
-async function discoverAuthorizationServer(issuer, requireExactIssuer) {
+async function discoverAuthorizationServer(issuer, requireExactIssuer, signal) {
   const candidates = authorizationServerMetadataUrls(issuer);
   let lastError;
   for (const candidate of candidates) {
     try {
-      const response = await fetchResponse(candidate);
-      if (response.status === 404) continue;
-      return authorizationServerMetadata(await jsonMetadata(response, candidate), issuer, requireExactIssuer);
+      const metadata = await withResponse(candidate, { signal }, async (response, requestSignal) => {
+        if (response.status === 404) return void 0;
+        return authorizationServerMetadata(
+          await jsonMetadata(response, candidate, requestSignal),
+          issuer,
+          requireExactIssuer
+        );
+      });
+      if (metadata) return metadata;
     } catch (error) {
+      signal?.throwIfAborted();
       lastError = error;
     }
   }
@@ -3370,6 +3438,9 @@ function resourceMetadata(value, resource) {
       throw new Error("Protected-resource metadata has an invalid authorization server");
     validatedHttpsUrl(issuer, "Authorization server issuer");
   }
+  if (metadata.scopes_supported !== void 0 && (!Array.isArray(metadata.scopes_supported) || metadata.scopes_supported.some((scope) => typeof scope !== "string"))) {
+    throw new Error("Protected-resource metadata has invalid scopes_supported");
+  }
   return metadata;
 }
 function resourceMetadataUrl(resource) {
@@ -3381,34 +3452,39 @@ function headerResourceMetadata(value) {
   if (!match2) return void 0;
   return match2[1].replace(/\\(.)/g, "$1");
 }
-async function tryProtectedResourceMetadata(url2) {
+async function tryProtectedResourceMetadata(url2, signal) {
   const resource = validatedHttpsUrl(url2, "MCP endpoint");
   let headerUrl;
   try {
-    const response2 = await fetchResponse(resource.toString());
-    headerUrl = headerResourceMetadata(response2.headers.get("www-authenticate"));
-    await response2.body?.cancel();
+    headerUrl = await withResponse(
+      resource.toString(),
+      { signal },
+      async (response) => headerResourceMetadata(response.headers.get("www-authenticate"))
+    );
   } catch {
+    signal?.throwIfAborted();
   }
   const candidate = headerUrl ? validatedHttpsUrl(headerUrl, "resource_metadata").toString() : resourceMetadataUrl(resource);
-  const response = await fetchResponse(candidate);
-  if (response.status === 404 && !headerUrl) return void 0;
-  return resourceMetadata(await jsonMetadata(response, candidate), canonicalResource(resource));
+  return withResponse(candidate, { signal }, async (response, requestSignal) => {
+    if (response.status === 404 && !headerUrl) return void 0;
+    return resourceMetadata(await jsonMetadata(response, candidate, requestSignal), canonicalResource(resource));
+  });
 }
-async function discover(url2) {
-  const protectedResource = await tryProtectedResourceMetadata(url2);
+async function discover(url2, signal) {
+  const protectedResource = await tryProtectedResourceMetadata(url2, signal);
   if (protectedResource) {
     const issuer2 = protectedResource.authorization_servers[0];
     return {
-      metadata: await discoverAuthorizationServer(issuer2, true),
+      metadata: await discoverAuthorizationServer(issuer2, true, signal),
+      scopes: protectedResource.scopes_supported,
       resource: protectedResource.resource,
       issuer: issuer2
     };
   }
   const issuer = validatedHttpsUrl(url2, "MCP endpoint").origin;
-  return { metadata: await discoverAuthorizationServer(issuer, false) };
+  return { metadata: await discoverAuthorizationServer(issuer, false, signal) };
 }
-async function registerClient(registrationEndpoint, label) {
+async function registerClient(registrationEndpoint, label, signal) {
   validatedHttpsUrl(registrationEndpoint, "Registration endpoint");
   const body = {
     client_name: label,
@@ -3420,7 +3496,8 @@ async function registerClient(registrationEndpoint, label) {
   const data = await fetchJson2(registrationEndpoint, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body)
+    body: JSON.stringify(body),
+    signal
   });
   if (typeof data.client_id !== "string" || !data.client_id) {
     throw new Error(`Dynamic client registration at ${registrationEndpoint} returned no client_id`);
@@ -3428,7 +3505,6 @@ async function registerClient(registrationEndpoint, label) {
   return data.client_id;
 }
 async function startCallbackServer2(label) {
-  const { createServer: createServer3 } = await import("node:http");
   let settle;
   const waitPromise = new Promise((resolve26) => {
     let settled = false;
@@ -3465,7 +3541,7 @@ async function startCallbackServer2(label) {
   };
   let lastError;
   for (const port of CALLBACK_PORTS) {
-    const server = createServer3(handler);
+    const server = createServer(handler);
     let bindErr;
     server.on("error", (err) => bindErr?.(err));
     try {
@@ -3516,23 +3592,22 @@ function parseRedirectInput(input, expectedState) {
   }
   return { code, state: state ?? expectedState };
 }
-async function exchangeToken(tokenEndpoint, params) {
+async function exchangeToken(tokenEndpoint, params, signal) {
   validatedHttpsUrl(tokenEndpoint, "Token endpoint");
-  const res = await fetchResponse(tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams(params).toString()
-  });
-  const text = await res.text();
-  if (!res.ok) {
-    throw new Error(`Token request to ${tokenEndpoint} failed: ${res.status}`);
-  }
-  let token;
-  try {
-    token = JSON.parse(text);
-  } catch {
-    throw new Error(`Token request to ${tokenEndpoint} returned invalid JSON`);
-  }
+  const token = await withResponse(
+    tokenEndpoint,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams(params).toString(),
+      signal
+    },
+    async (response, requestSignal) => {
+      const label = `Token request to ${tokenEndpoint}`;
+      if (!response.ok) throw new Error(`${label} failed: ${response.status}`);
+      return readJson(response, requestSignal, label);
+    }
+  );
   if (!token || typeof token !== "object" || typeof token.access_token !== "string") {
     throw new Error(`Token request to ${tokenEndpoint} returned no access_token`);
   }
@@ -3562,7 +3637,7 @@ function toCredentials(token, tokenEndpoint, clientId, endpoint, resource, issue
 function createMcpOAuthProvider(config) {
   const label = config.label ?? config.server;
   async function login(callbacks) {
-    const discovery = await discover(config.url);
+    const discovery = await discover(config.url, callbacks.signal);
     const { metadata: meta } = discovery;
     callbacks.onProgress?.(`Discovered ${discovery.issuer ?? meta.issuer}`);
     let clientId = config.clientId;
@@ -3573,13 +3648,15 @@ function createMcpOAuthProvider(config) {
         );
       }
       callbacks.onProgress?.("Registering OAuth client\u2026");
-      clientId = await registerClient(meta.registration_endpoint, `Prime Agent (${label})`);
+      clientId = await registerClient(meta.registration_endpoint, `Base Context (${label})`, callbacks.signal);
     }
     const { verifier, challenge } = await generatePKCE();
     const state = randomState();
-    const scope = config.scopes ?? meta.scopes_supported?.join(" ");
+    const scope = config.scopes ?? discovery.scopes?.join(" ");
+    callbacks.signal?.throwIfAborted();
     const cb = await startCallbackServer2(label);
     try {
+      callbacks.signal?.throwIfAborted();
       const authParams = new URLSearchParams({
         client_id: clientId,
         response_type: "code",
@@ -3596,6 +3673,7 @@ function createMcpOAuthProvider(config) {
         url: authorizationUrl.toString(),
         instructions: "Complete login in your browser. If the browser is on another machine, paste the final redirect URL here."
       });
+      callbacks.signal?.throwIfAborted();
       let result;
       let manualCancelled = false;
       let manualError;
@@ -3614,16 +3692,19 @@ function createMcpOAuthProvider(config) {
           cb.cancel();
           return null;
         });
-        const fromCallback = await cb.waitForCode();
-        result = fromCallback ?? await manual;
+        const fromCallback = await abortable(cb.waitForCode(), callbacks.signal);
+        result = fromCallback ?? await abortable(manual, callbacks.signal);
         if (!result && manualError) throw manualError;
       } else {
-        result = await cb.waitForCode();
+        result = await abortable(cb.waitForCode(), callbacks.signal);
         if (!result) {
-          const input = await callbacks.onPrompt({
-            message: "Paste the authorization code or full redirect URL:",
-            placeholder: cb.redirectUri
-          });
+          const input = await abortable(
+            callbacks.onPrompt({
+              message: "Paste the authorization code or full redirect URL:",
+              placeholder: cb.redirectUri
+            }),
+            callbacks.signal
+          );
           result = parseRedirectInput(input, state);
         }
       }
@@ -3634,16 +3715,21 @@ function createMcpOAuthProvider(config) {
         throw new Error("OAuth state mismatch");
       }
       callbacks.onProgress?.("Exchanging authorization code for tokens\u2026");
-      const token = await exchangeToken(meta.token_endpoint, {
-        grant_type: "authorization_code",
-        code: result.code,
-        redirect_uri: cb.redirectUri,
-        client_id: clientId,
-        code_verifier: verifier,
-        ...discovery.resource ? { resource: discovery.resource } : {}
-      });
+      const token = await exchangeToken(
+        meta.token_endpoint,
+        {
+          grant_type: "authorization_code",
+          code: result.code,
+          redirect_uri: cb.redirectUri,
+          client_id: clientId,
+          code_verifier: verifier,
+          ...discovery.resource ? { resource: discovery.resource } : {}
+        },
+        callbacks.signal
+      );
       return toCredentials(token, meta.token_endpoint, clientId, config.url, discovery.resource, discovery.issuer);
     } finally {
+      cb.cancel();
       cb.server.close();
     }
   }
@@ -4638,7 +4724,7 @@ ${loadError}`));
 import { resolve as resolve11 } from "node:path";
 
 // dist/core/auth-storage.js
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 
 // ../ai/src/oauth.ts
 var oauth_exports = {};
@@ -5143,11 +5229,18 @@ var AuthStorage = class _AuthStorage {
       this.staleAuthSources.set(provider, next);
     }
   }
+  parseStorageState(content) {
+    const { __base_context_login_attempts: loginAttempts = {}, ...credentials } = JSON.parse(content || "{}");
+    return { credentials, loginAttempts };
+  }
+  serializeStorageState({ credentials, loginAttempts }) {
+    return JSON.stringify({
+      ...credentials,
+      ...Object.keys(loginAttempts).length > 0 ? { __base_context_login_attempts: loginAttempts } : {}
+    }, null, 2);
+  }
   parseStorageData(content) {
-    if (!content) {
-      return {};
-    }
-    return JSON.parse(content);
+    return this.parseStorageState(content).credentials;
   }
   /**
    * Reload credentials from storage.
@@ -5172,14 +5265,14 @@ var AuthStorage = class _AuthStorage {
     }
     try {
       this.storage.withLock((current) => {
-        const currentData = this.parseStorageData(current);
-        const merged = { ...currentData };
+        const state = this.parseStorageState(current);
+        delete state.loginAttempts[provider];
         if (credential) {
-          merged[provider] = credential;
+          state.credentials[provider] = credential;
         } else {
-          delete merged[provider];
+          delete state.credentials[provider];
         }
-        return { result: void 0, next: JSON.stringify(merged, null, 2) };
+        return { result: void 0, next: this.serializeStorageState(state) };
       });
     } catch (error) {
       this.recordError(error);
@@ -5218,12 +5311,12 @@ var AuthStorage = class _AuthStorage {
   removeVerified(provider) {
     this.assertWritableStorage();
     this.storage.withLock((current) => {
-      const currentData = this.parseStorageData(current);
-      if (!(provider in currentData))
+      const state = this.parseStorageState(current);
+      if (!(provider in state.credentials) && !(provider in state.loginAttempts))
         return { result: void 0 };
-      const merged = { ...currentData };
-      delete merged[provider];
-      return { result: void 0, next: JSON.stringify(merged, null, 2) };
+      delete state.credentials[provider];
+      delete state.loginAttempts[provider];
+      return { result: void 0, next: this.serializeStorageState(state) };
     });
     delete this.data[provider];
     this.clearStaleAuthSource(provider, "stored");
@@ -5277,8 +5370,55 @@ var AuthStorage = class _AuthStorage {
     if (!provider) {
       throw new Error(`Unknown OAuth provider: ${providerId}`);
     }
-    const credentials = await provider.login(callbacks);
-    this.set(providerId, { type: "oauth", ...credentials });
+    await this.setFromLogin(providerId, async () => ({ type: "oauth", ...await provider.login(callbacks) }), callbacks.signal);
+  }
+  /** Collect credentials without holding the lock, then commit only for the current login. */
+  async setFromLogin(providerId, collectCredential, signal) {
+    this.assertWritableStorage();
+    if (signal?.aborted)
+      throw new Error("Login cancelled");
+    const attemptId = randomUUID();
+    this.storage.withLock((current) => {
+      const state = this.parseStorageState(current);
+      state.loginAttempts[providerId] = attemptId;
+      return { result: void 0, next: this.serializeStorageState(state) };
+    });
+    const releaseAttempt = () => {
+      try {
+        this.storage.withLock((current) => {
+          const state = this.parseStorageState(current);
+          if (state.loginAttempts[providerId] !== attemptId)
+            return { result: void 0 };
+          delete state.loginAttempts[providerId];
+          return { result: void 0, next: this.serializeStorageState(state) };
+        });
+      } catch (error) {
+        this.recordError(error);
+      }
+    };
+    signal?.addEventListener("abort", releaseAttempt, { once: true });
+    try {
+      const credential = await collectCredential();
+      if (signal?.aborted)
+        throw new Error("Login cancelled");
+      const data = this.storage.withLock((current) => {
+        const state = this.parseStorageState(current);
+        if (state.loginAttempts[providerId] !== attemptId) {
+          throw new Error("Login cancelled: credentials changed or login was superseded");
+        }
+        delete state.loginAttempts[providerId];
+        state.credentials[providerId] = credential;
+        return { result: state.credentials, next: this.serializeStorageState(state) };
+      });
+      this.data = data;
+      this.loadError = null;
+      this.clearStaleAuthSource(providerId, "stored");
+    } catch (error) {
+      releaseAttempt();
+      throw error;
+    } finally {
+      signal?.removeEventListener("abort", releaseAttempt);
+    }
   }
   /**
    * Logout from a provider.
@@ -5299,7 +5439,8 @@ var AuthStorage = class _AuthStorage {
       return null;
     }
     const result = await this.storage.withLockAsync(async (current) => {
-      const currentData = this.parseStorageData(current);
+      const state = this.parseStorageState(current);
+      const currentData = state.credentials;
       this.data = currentData;
       this.loadError = null;
       const cred = currentData[providerId];
@@ -5325,7 +5466,7 @@ var AuthStorage = class _AuthStorage {
       };
       this.data = merged;
       this.loadError = null;
-      return { result: refreshed, next: JSON.stringify(merged, null, 2) };
+      return { result: refreshed, next: this.serializeStorageState({ ...state, credentials: merged }) };
     });
     return result;
   }
@@ -7080,7 +7221,7 @@ async function selectConfig(options) {
 // dist/cli/daemon-update-restart.js
 var import_proper_lockfile3 = __toESM(require_proper_lockfile(), 1);
 import { spawn } from "node:child_process";
-import { createHash as createHash2, randomUUID } from "node:crypto";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync2, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 var DAEMON_UPDATE_RESTART_COORDINATOR_FLAG = "--internal-update-restart-coordinator";
@@ -7141,7 +7282,7 @@ function socketKey(socketPath) {
   return createHash2("sha256").update(normalizeSocketPath(socketPath)).digest("hex");
 }
 function writeJsonAtomically(path6, value) {
-  const tempPath = `${path6}.${process.pid}.${randomUUID()}.tmp`;
+  const tempPath = `${path6}.${process.pid}.${randomUUID2()}.tmp`;
   try {
     writeFileSync3(tempPath, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
@@ -7375,7 +7516,7 @@ var DaemonUpdateRestartCoordinatorAlreadyRunningError = class extends Error {
 async function acquireDaemonUpdateRestartCoordinator(options) {
   const registryDir = options.registryDir ?? defaultCoordinatorRegistryDir();
   const path6 = coordinatorRecordPath(registryDir, options.socketPath);
-  const token = randomUUID();
+  const token = randomUUID2();
   const processStartId = getProcessStartId(process.pid);
   const record3 = {
     version: 1,
@@ -7461,7 +7602,7 @@ function selectedUpdateInstallation() {
   return ownedVersion(owned.root, selected.active);
 }
 async function launchDaemonUpdateRestartCoordinator(options) {
-  const requestId = randomUUID();
+  const requestId = randomUUID2();
   const agentDir = resolve2(options.agentDir);
   const socketPath = resolveDaemonUpdateRestartSocketPath(options.socketPath);
   const statusPath = createStatusPath(agentDir, socketPath, requestId);
@@ -14345,7 +14486,7 @@ var DefaultPackageManager = class {
 
 // dist/modes/daemon/daemon-supervisor-ownership.js
 var import_proper_lockfile4 = __toESM(require_proper_lockfile(), 1);
-import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync5, realpathSync, renameSync as renameSync3, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { basename as basename3, dirname as dirname6, join as join7, resolve as resolve4 } from "node:path";
 var DAEMON_SUPERVISOR_REGISTRY_DIR_ENV = "BASE_CONTEXT_INTERNAL_DAEMON_SUPERVISOR_REGISTRY_DIR";
@@ -14413,17 +14554,15 @@ var RenewableRegistryRecord = class {
     await this.refreshPromise;
   }
   async performRenew() {
-    try {
-      await withDaemonSupervisorRegistryGuard(this.registryDir, () => {
-        if (this.stopped || this.lost) {
-          throw this.createLostError();
-        }
-        this.renewUnderGuard();
-      });
-    } catch (error) {
+    const held = await withDaemonSupervisorRegistryGuard(this.registryDir, () => {
+      if (this.stopped || this.lost)
+        return false;
+      return this.renewUnderGuard();
+    });
+    if (!held) {
       this.lost = true;
       clearInterval(this.refreshTimer);
-      throw error;
+      throw this.createLostError();
     }
   }
   async stop() {
@@ -14490,7 +14629,7 @@ var DaemonSupervisorOwnership = class {
         if (!current || current.token !== this.record.token) {
           return;
         }
-        releasedDirectory = `${this.ownerDirectory}.released-${randomUUID2()}`;
+        releasedDirectory = `${this.ownerDirectory}.released-${randomUUID3()}`;
         renameSync3(this.ownerDirectory, releasedDirectory);
       });
       this.released = true;
@@ -14520,13 +14659,14 @@ var DaemonShutdownAdmission = class {
   renewUnderGuard() {
     const path6 = shutdownAdmissionPath(this.registryDir);
     const current = readShutdownAdmission(path6);
-    if (!current || current.token !== this.record.token || current.pid !== this.record.pid || current.processStartId !== this.record.processStartId || Date.parse(current.expiresAt) <= Date.now() || !matchesExactProcessIdentity(this.record)) {
-      throw new DaemonShutdownAdmissionError("Daemon shutdown admission was lost");
+    if (!current || current.token !== this.record.token || current.pid !== this.record.pid || current.processStartId !== this.record.processStartId || !matchesExactProcessIdentity(this.record)) {
+      return false;
     }
     const now = Date.now();
     this.record.updatedAt = new Date(now).toISOString();
     this.record.expiresAt = new Date(now + SHUTDOWN_ADMISSION_LEASE_MS).toISOString();
     writeJsonAtomically2(path6, this.record);
+    return true;
   }
   async release() {
     if (this.released) {
@@ -14636,7 +14776,7 @@ async function mutateDaemonSupervisorOwner(generation, expectedToken, mutation,
 async function acquireDaemonSupervisorOwnership(options) {
   const registryDir = options.registryDir ?? defaultDaemonSupervisorRegistryDir();
   mkdirSync5(registryDir, { recursive: true, mode: 448 });
-  const token = randomUUID2();
+  const token = randomUUID3();
   const processStartId = getProcessStartId(process.pid);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const record3 = {
@@ -14677,7 +14817,7 @@ async function acquireDaemonSupervisorOwnership(options) {
         if (isProcessIdentityAlive2(owner)) {
           throw new DaemonSupervisorAlreadyRunningError(owner);
         }
-        const staleDirectory = `${directory}.stale-${randomUUID2()}`;
+        const staleDirectory = `${directory}.stale-${randomUUID3()}`;
         renameSync3(directory, staleDirectory);
         staleDirectories.push(staleDirectory);
       }
@@ -14740,7 +14880,7 @@ async function acquireDaemonShutdownAdmission() {
       const now = Date.now();
       acquired = {
         version: OWNER_VERSION,
-        token: randomUUID2(),
+        token: randomUUID3(),
         pid: process.pid,
         ...processStartId ? { processStartId } : {},
         createdAt: new Date(now).toISOString(),
@@ -14757,7 +14897,7 @@ async function acquireDaemonShutdownAdmission() {
 }
 async function isDaemonShutdownAdmissionActive() {
   const registryDir = defaultDaemonSupervisorRegistryDir();
-  return withDaemonSupervisorRegistryGuard(registryDir, () => readActiveShutdownAdmission(registryDir) !== void 0);
+  return withDaemonSupervisorRegistryGuard(registryDir, () => shutdownAdmissionIsActive(readShutdownAdmission(shutdownAdmissionPath(registryDir))));
 }
 async function persistDaemonStartupFenceFromOwner(socketPath, hello, registryDir, legacyRegistryDir = void 0) {
   registryDir ??= defaultDaemonSupervisorRegistryDir();
@@ -14795,7 +14935,7 @@ async function persistDaemonStartupFenceFromOwner(socketPath, hello, registryDir
     }
     const record3 = {
       version: OWNER_VERSION,
-      token: randomUUID2(),
+      token: randomUUID3(),
       ownerToken: owner.token,
       pid: owner.pid,
       processStartId: owner.processStartId,
@@ -14923,7 +15063,7 @@ function readOwnerRecordForScope(directory, isRelevant) {
   const scope = readOwnerScope(directory);
   const entries2 = !scope ? readdirSync2(directory) : [];
   if (!scope && !entries2.includes("owner.json") && !entries2.includes("scope.json")) {
-    const abandonedDirectory = `${directory}.abandoned-${randomUUID2()}`;
+    const abandonedDirectory = `${directory}.abandoned-${randomUUID3()}`;
     renameSync3(directory, abandonedDirectory);
     rmSync3(abandonedDirectory, { recursive: true, force: true });
     return void 0;
@@ -15000,13 +15140,16 @@ function readStartupFence(path6) {
     throw error;
   }
 }
+function shutdownAdmissionIsActive(admission) {
+  return admission !== void 0 && Date.parse(admission.expiresAt) > Date.now() && isProcessIdentityAlive2(admission);
+}
 function readActiveShutdownAdmission(registryDir) {
   const path6 = shutdownAdmissionPath(registryDir);
   const admission = readShutdownAdmission(path6);
   if (!admission) {
     return void 0;
   }
-  if (Date.parse(admission.expiresAt) > Date.now() && isProcessIdentityAlive2(admission)) {
+  if (shutdownAdmissionIsActive(admission)) {
     return admission;
   }
   rmSync3(path6, { force: true });
@@ -15031,7 +15174,7 @@ function readShutdownAdmission(path6) {
   }
 }
 function writeJsonAtomically2(path6, value) {
-  const tempPath = `${path6}.${process.pid}.${randomUUID2()}.tmp`;
+  const tempPath = `${path6}.${process.pid}.${randomUUID3()}.tmp`;
   try {
     writeFileSync5(tempPath, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
@@ -15053,7 +15196,7 @@ function delay2(ms2) {
 }
 
 // dist/owned-install.js
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 import { existsSync as existsSync5, mkdirSync as mkdirSync6, readdirSync as readdirSync3, readFileSync as readFileSync6, renameSync as renameSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "node:fs";
 import { homedir as homedir3, tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname7, join as join8, resolve as resolve5 } from "node:path";
@@ -15214,7 +15357,7 @@ async function installOwnedRelease(options) {
   });
   assertSelection(root, expected);
   initializeRoot(root);
-  const installation = ownedVersion(root, `${version}-${randomUUID3()}`);
+  const installation = ownedVersion(root, `${version}-${randomUUID4()}`);
   const directory = join8(root, "versions", installation.version);
   mkdirSync6(directory, { recursive: true, mode: 448 });
   writeFileSync6(join8(directory, "package.json"), `${JSON.stringify({
@@ -17979,6 +18122,7 @@ async function runShutdownAllConverging(json, force, assertAdmission) {
 }
 async function stopHiddenSupervisors(stopped, failed, handledPids, reportedFailures, assertAdmission) {
   while (true) {
+    await assertAdmission();
     const listeners = scanListeningDaemons().filter((listener) => !isWorkerSocketPath(listener.socketPath));
     const bySocket = /* @__PURE__ */ new Map();
     for (const listener of listeners) {
@@ -20989,8 +21133,8 @@ var McpManager = class {
     const { bearerTokenEnvVar } = integration.config;
     if (!integration.usesOAuth && !bearerTokenEnvVar)
       return true;
-    if (bearerTokenEnvVar && process.env[bearerTokenEnvVar]?.trim()) {
-      return true;
+    if (bearerTokenEnvVar) {
+      return Boolean(process.env[bearerTokenEnvVar]?.trim());
     }
     const providerId = this.providerId(integration.server);
     const cred = this.authStorage.get(providerId);
@@ -24557,7 +24701,7 @@ function runMigrations(cwd) {
 
 // dist/modes/daemon/daemon-catalog-process.js
 import { spawn as spawn6 } from "node:child_process";
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 import { existsSync as existsSync16 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { join as join19, sep as sep7 } from "node:path";
@@ -27434,7 +27578,7 @@ var DaemonCatalogClient = class {
     if (options && "page" in options)
       return this.request({
         type: "request",
-        id: randomUUID4(),
+        id: randomUUID5(),
         command: "list",
         cwd,
         sessionDir,
@@ -27443,16 +27587,16 @@ var DaemonCatalogClient = class {
         ledgerSessionDir: options.ledgerSessionDir,
         scope: options.scope
       });
-    const data = await this.request({ type: "request", id: randomUUID4(), command: "list", cwd, sessionDir }, options);
+    const data = await this.request({ type: "request", id: randomUUID5(), command: "list", cwd, sessionDir }, options);
     return data.sessions.map(deserializeSessionInfo);
   }
   async rename(sessionPath, name) {
-    await this.request({ type: "request", id: randomUUID4(), command: "rename", sessionPath, name });
+    await this.request({ type: "request", id: randomUUID5(), command: "rename", sessionPath, name });
   }
   async resolve(selector, cwd, sessionDir) {
     const data = await this.request({
       type: "request",
-      id: randomUUID4(),
+      id: randomUUID5(),
       command: "resolve",
       selector,
       cwd,
@@ -27461,12 +27605,12 @@ var DaemonCatalogClient = class {
     return data.sessionPath;
   }
   delete(sessionPath) {
-    return this.request({ type: "request", id: randomUUID4(), command: "delete", sessionPath });
+    return this.request({ type: "request", id: randomUUID5(), command: "delete", sessionPath });
   }
   async archive(sessionPath, sessionId) {
     const data = await this.request({
       type: "request",
-      id: randomUUID4(),
+      id: randomUUID5(),
       command: "archive",
       sessionPath,
       sessionId
@@ -27476,7 +27620,7 @@ var DaemonCatalogClient = class {
   async markInterrupted(sessionPath, activeSessionId, operations) {
     await this.request({
       type: "request",
-      id: randomUUID4(),
+      id: randomUUID5(),
       command: "mark_interrupted",
       sessionPath,
       activeSessionId,
@@ -27490,7 +27634,7 @@ var DaemonCatalogClient = class {
       const child = this.child;
       if (!child && !this.starting)
         return;
-      await this.request({ type: "request", id: randomUUID4(), command: "shutdown" }).catch(() => void 0);
+      await this.request({ type: "request", id: randomUUID5(), command: "shutdown" }).catch(() => void 0);
       if (child?.connected)
         child.disconnect();
       if (this.child === child)
@@ -27964,7 +28108,7 @@ function bashToolCallId(runId) {
 }
 
 // dist/modes/acp/acp-mode.js
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import { realpathSync as realpathSync4, statSync as statSync6 } from "node:fs";
 import { resolve as resolve19 } from "node:path";
 import { Readable } from "node:stream";
@@ -33064,7 +33208,7 @@ async function runAcpModeWithConnection(connection, options = {}) {
     takeOverStdout();
   }
   const supportsMcpServers = connection.supportsAcpMcpServers?.() === true && connection.replaceAcpMcpServers !== void 0 && connection.releaseAcpMcpServers !== void 0;
-  const acpMcpOwnerId = randomUUID5();
+  const acpMcpOwnerId = randomUUID6();
   let acpMcpServerNames = [];
   const clearAcpMcpServers = async (serverNames = acpMcpServerNames) => {
     if (!supportsMcpServers || !connection.releaseAcpMcpServers)
@@ -33187,7 +33331,7 @@ async function runAcpModeWithConnection(connection, options = {}) {
       await entry.inputPauseRelease.promise.catch(() => void 0);
       entry.inputPauseRelease = void 0;
     }
-    const leaseKey = entry.inputPauseKey ?? randomUUID5();
+    const leaseKey = entry.inputPauseKey ?? randomUUID6();
     entry.inputPauseKey = leaseKey;
     const pause = await connection.acquireSessionInputPause(leaseKey);
     entry.inputPause = pause;
@@ -33279,7 +33423,7 @@ async function runAcpModeWithConnection(connection, options = {}) {
       if (typeof requestedCwd === "string" && requestedCwd.length > 0 && actualCwd && !sameCwd(requestedCwd, actualCwd)) {
         cwdMismatch = { requested: requestedCwd, actual: actualCwd };
       }
-      const sessionId = randomUUID5();
+      const sessionId = randomUUID6();
       const producer = new AcpUpdateProducer(sessionId, ctx.client);
       let inputPauseRelease;
       if (closedInputPause) {
@@ -33605,7 +33749,7 @@ async function runAcpModeWithConnection(connection, options = {}) {
 }
 
 // dist/modes/agent-connection/daemon-agent-connection.js
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 
 // dist/modes/agents-view/roster-store.js
 var STALE_ROSTER_DAEMON_MESSAGE = "Daemon is stale: it does not advertise the agent_roster capability; restart the daemon";
@@ -34084,7 +34228,7 @@ var DaemonAgentConnection = class _DaemonAgentConnection {
   listeners = /* @__PURE__ */ new Set();
   unsubscribeDaemonMessages;
   unsubscribeDaemonClose;
-  clientId = `daemon-agent-connection:${randomUUID6()}`;
+  clientId = `daemon-agent-connection:${randomUUID7()}`;
   sessionInputPauses = /* @__PURE__ */ new Map();
   sessionInputPauseGeneration = 0;
   ownedSessionPromotionTail = Promise.resolve();
@@ -34709,7 +34853,7 @@ var DaemonAgentConnection = class _DaemonAgentConnection {
       }, DAEMON_LONG_RUNNING_REQUEST_TIMEOUT_MS);
       return;
     }
-    const admissionId = `prompt-admission:${randomUUID6()}`;
+    const admissionId = `prompt-admission:${randomUUID7()}`;
     let resolveAbort = () => {
     };
     const aborted = new Promise((resolve26) => {
@@ -36560,8 +36704,8 @@ var CustomEditor = class extends Editor {
 };
 
 // dist/modes/interactive/interactive-mode.js
-import { randomUUID as randomUUID8 } from "node:crypto";
-import * as fs5 from "node:fs";
+import { randomUUID as randomUUID9 } from "node:crypto";
+import * as fs4 from "node:fs";
 import * as os3 from "node:os";
 import * as path5 from "node:path";
 import { spawnSync as spawnSync8 } from "child_process";
@@ -36876,17 +37020,14 @@ function requireNewPrompt(value) {
   return prompt;
 }
 
-// dist/themes/prime-logo.js
-var PRIME_BUTTERFLY_LOGO = `                          \u2584\u2584\u2588\u2588\u2588\u2580
-    \u2584\u2584\u2584\u2584\u2584              \u2584\u2588\u2588\u2588\u2588\u2588\u2580
-    \u2588\u2588\u2588\u2588\u2588\u2588\u2584         \u2584\u2588\u2588\u2588\u2588\u2588\u2588\u2580
-   \u2584\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2584     \u2584\u2588\u2588\u2588\u2580\u2584\u2588\u2588\u2580
-   \u2588\u2588\u2588 \u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2584\u2588\u2588\u2588\u2588\u2580\u2584\u2584\u2588\u2588
-  \u2580\u2588\u2588  \u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2580\u2580\u2580\u2580\u2580
-  \u2584\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2580 \u2584\u2588\u2588\u2588
- \u2588\u2588\u2588\u2588\u2588    \u2580\u2588\u2584\u2584\u2584\u2588\u2588\u2588\u2588\u2588\u2580
-\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2584  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580
-\u2580\u2588\u2588\u2588\u2580\u2580    \u2588\u2588\u2588\u2588\u2588\u2580`;
+// dist/themes/synerise-logo.js
+var SYNERISE_LOGO = ` #### #   # #   # ##### ####  #####  #### #####
+#      # #  ##  # #     #   #   #   #     #
+ ###    #   # # # ####  ####    #    ###  ####
+    #   #   #  ## #     #  #    #       # #
+####    #   #   # ##### #   # ##### ####  #####
+
+Synerise base-context`;
 
 // dist/utils/changelog.js
 import { existsSync as existsSync19, readFileSync as readFileSync16 } from "fs";
@@ -36943,7 +37084,7 @@ import { platform as platform2 } from "os";
 
 // dist/utils/clipboard-image.js
 import { spawnSync as spawnSync6 } from "child_process";
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { readFileSync as readFileSync17, unlinkSync as unlinkSync3 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
 import { join as join22 } from "path";
@@ -37049,7 +37190,7 @@ function isWSL(env = process.env) {
   }
 }
 function readClipboardImageViaPowerShell() {
-  const tmpFile = join22(tmpdir3(), `pi-wsl-clip-${randomUUID7()}.png`);
+  const tmpFile = join22(tmpdir3(), `pi-wsl-clip-${randomUUID8()}.png`);
   try {
     const winPathResult = runCommand("wslpath", ["-w", tmpFile], { timeoutMs: DEFAULT_LIST_TIMEOUT_MS });
     if (!winPathResult.ok) {
@@ -37325,7 +37466,7 @@ async function checkTmuxKeyboardSetup() {
     return "tmux extended-keys is off. Modified Enter keys may not work. Add `set -g extended-keys on` to ~/.tmux.conf and restart tmux.";
   }
   if (extendedKeysFormat === "xterm") {
-    return "tmux extended-keys-format is xterm. Pi works best with csi-u. Add `set -g extended-keys-format csi-u` to ~/.tmux.conf and restart tmux.";
+    return "tmux extended-keys-format is xterm. base-context works best with csi-u. Add `set -g extended-keys-format csi-u` to ~/.tmux.conf and restart tmux.";
   }
   return void 0;
 }
@@ -37632,6 +37773,9 @@ var MenuSearchInput = class {
   setValue(value) {
     this.input.setValue(value);
   }
+  setMasked(masked) {
+    this.input.setMasked(masked);
+  }
   handleInput(data) {
     this.input.handleInput(data);
   }
@@ -37967,6 +38111,7 @@ var LoginDialogComponent = class extends Container {
    * Show input for manual code/URL entry (for callback server providers)
    */
   showManualInput(prompt) {
+    this.input.setMasked(true);
     this.addSectionSpacer();
     this.addSectionTitle("Manual fallback");
     this.addMutedText(prompt);
@@ -37990,7 +38135,8 @@ var LoginDialogComponent = class extends Container {
    * Called by onPrompt callback - show prompt and wait for input
    * Note: Does NOT clear content, appends to existing (preserves URL from showAuth)
    */
-  showPrompt(message, placeholder) {
+  showPrompt(message, placeholder, options) {
+    this.input.setMasked(options?.masked === true);
     this.addSectionSpacer();
     this.addSectionTitle(message);
     if (placeholder) {
@@ -38528,7 +38674,7 @@ var ProviderAuthFlows = class {
       const selector = new OAuthSelectorComponent("logout", this.host.modelRegistry.authStorage, providerOptions, async (providerOption) => {
         close();
         try {
-          this.host.modelRegistry.authStorage.logout(providerOption.id);
+          this.host.modelRegistry.authStorage.removeVerified(providerOption.id);
           this.host.modelRegistry.refresh();
           await this.host.onAuthChanged?.();
           const message = providerOption.authType === "oauth" ? `Logged out of ${providerOption.name}` : `Removed stored API key for ${providerOption.name}. Environment variables and models.json config are unchanged.`;
@@ -38666,11 +38812,12 @@ var ProviderAuthFlows = class {
       this.host.ui.requestRender();
     };
     try {
-      const apiKey = (await dialog.showPrompt("Enter API key:")).trim();
-      if (!apiKey) {
-        throw new Error("API key cannot be empty.");
-      }
-      this.host.modelRegistry.authStorage.set(providerId, { type: "api_key", key: apiKey });
+      await this.host.modelRegistry.authStorage.setFromLogin(providerId, async () => {
+        const apiKey = (await dialog.showPrompt("Enter API key:", void 0, { masked: true })).trim();
+        if (!apiKey)
+          throw new Error("API key cannot be empty.");
+        return { type: "api_key", key: apiKey };
+      }, dialog.signal);
       closeDialog();
       return await this.completeProviderAuthentication(providerId, providerName, "api_key", void 0, kind);
     } catch (error) {
@@ -39826,6 +39973,17 @@ var BranchSummaryMessageComponent = class extends Box {
   }
 };
 
+// dist/modes/interactive/components/brand-announcement.js
+var BrandAnnouncementComponent = class extends Container {
+  constructor() {
+    super();
+    this.addChild(new DynamicBorder((text) => theme.fg("accent", text)));
+    this.addChild(new Text(theme.fg("accent", SYNERISE_LOGO), 1, 0));
+    this.addChild(new Spacer(1));
+    this.addChild(new DynamicBorder((text) => theme.fg("accent", text)));
+  }
+};
+
 // dist/modes/interactive/components/compaction-outcome-message.js
 var CompactionOutcomeMessageComponent = class extends Container {
   constructor(message) {
@@ -42168,45 +42326,9 @@ var DaxnutsComponent = class {
   }
 };
 
-// dist/modes/interactive/components/earendil-announcement.js
-import * as fs3 from "node:fs";
-var BLOG_URL = "https://mariozechner.at/posts/2026-04-08-ive-sold-out/";
-var IMAGE_FILENAME = "clankolas.png";
-var cachedImageBase64;
-var attemptedImageLoad = false;
-function loadImageBase64() {
-  if (attemptedImageLoad) {
-    return cachedImageBase64;
-  }
-  attemptedImageLoad = true;
-  try {
-    cachedImageBase64 = fs3.readFileSync(getBundledInteractiveAssetPath(IMAGE_FILENAME)).toString("base64");
-  } catch {
-    cachedImageBase64 = void 0;
-  }
-  return cachedImageBase64;
-}
-var EarendilAnnouncementComponent = class extends Container {
-  constructor() {
-    super();
-    this.addChild(new DynamicBorder((text) => theme.fg("accent", text)));
-    this.addChild(new Text(theme.bold(theme.fg("accent", "pi has joined Earendil")), 1, 0));
-    this.addChild(new Spacer(1));
-    this.addChild(new Text(theme.fg("muted", "Read the blog post:"), 1, 0));
-    this.addChild(new Text(theme.fg("mdLink", BLOG_URL), 1, 0));
-    this.addChild(new Spacer(1));
-    const imageBase64 = loadImageBase64();
-    if (imageBase64) {
-      this.addChild(new Image(imageBase64, "image/png", { fallbackColor: (text) => theme.fg("muted", text) }, { maxWidthCells: 56, filename: IMAGE_FILENAME, fallbackOnly: true }));
-      this.addChild(new Spacer(1));
-    }
-    this.addChild(new DynamicBorder((text) => theme.fg("accent", text)));
-  }
-};
-
 // dist/modes/interactive/components/extension-editor.js
 import { spawnSync as spawnSync7 } from "node:child_process";
-import * as fs4 from "node:fs";
+import * as fs3 from "node:fs";
 import * as os2 from "node:os";
 import * as path4 from "node:path";
 var ExtensionEditorComponent = class extends Container {
@@ -42268,7 +42390,7 @@ var ExtensionEditorComponent = class extends Container {
     const currentText = this.editor.getText();
     const tmpFile = path4.join(os2.tmpdir(), `pi-extension-editor-${Date.now()}.md`);
     try {
-      fs4.writeFileSync(tmpFile, currentText, "utf-8");
+      fs3.writeFileSync(tmpFile, currentText, "utf-8");
       this.tui.stop();
       const [editor, ...editorArgs] = editorCmd.split(" ");
       const result = spawnSync7(editor, [...editorArgs, tmpFile], {
@@ -42276,12 +42398,12 @@ var ExtensionEditorComponent = class extends Container {
         shell: process.platform === "win32"
       });
       if (result.status === 0) {
-        const newContent = fs4.readFileSync(tmpFile, "utf-8").replace(/\n$/, "");
+        const newContent = fs3.readFileSync(tmpFile, "utf-8").replace(/\n$/, "");
         this.editor.setText(newContent);
       }
     } finally {
       try {
-        fs4.unlinkSync(tmpFile);
+        fs3.unlinkSync(tmpFile);
       } catch {
       }
       this.tui.start();
@@ -46792,6 +46914,8 @@ var SettingsSelectorComponent = class extends Container {
   constructor(config, callbacks) {
     super();
     let currentWarnings = { ...config.warnings };
+    let currentTheme = config.currentTheme;
+    const themeLabel = (name) => name === "prime" ? "Synerise" : name;
     const idleEvictionValues = [30, 60, 90, 180, 360];
     if (typeof config.idleEvictionMinutes === "number" && !idleEvictionValues.includes(config.idleEvictionMinutes)) {
       idleEvictionValues.push(config.idleEvictionMinutes);
@@ -46889,15 +47013,16 @@ var SettingsSelectorComponent = class extends Container {
         id: "theme",
         label: "Theme",
         description: "Color theme for the interface",
-        currentValue: config.currentTheme,
-        submenu: (currentValue, done) => new SelectSubmenu("Theme", "Select color theme", config.availableThemes.map((t) => ({
+        currentValue: themeLabel(currentTheme),
+        submenu: (_currentValue, done) => new SelectSubmenu("Theme", "Select color theme", config.availableThemes.map((t) => ({
           value: t,
-          label: t
-        })), currentValue, (value) => {
+          label: themeLabel(t)
+        })), currentTheme, (value) => {
+          currentTheme = value;
           callbacks.onThemeChange(value);
-          done(value);
+          done(themeLabel(value));
         }, () => {
-          callbacks.onThemePreview?.(currentValue);
+          callbacks.onThemePreview?.(currentTheme);
           done();
         }, (value) => {
           callbacks.onThemePreview?.(value);
@@ -48738,7 +48863,7 @@ var BrandSplashHeader = class {
     this.getCwd = getCwd;
     this.verboseInstructions = verboseInstructions;
     this.options = options;
-    this.logoRaw = (options.logo ?? PRIME_BUTTERFLY_LOGO).split("\n");
+    this.logoRaw = (options.logo ?? SYNERISE_LOGO).split("\n");
     this.logoCanvasWidth = this.logoRaw.reduce((max, line) => Math.max(max, visibleWidth(line)), 0);
   }
   invalidate() {
@@ -51827,7 +51952,7 @@ ${message}`, ["Yes", "No"], opts);
     }
     const previousTurns = this.sideQuestionTurns.filter((turn) => turn.answer).map((turn) => ({ question: turn.question, answer: turn.answer }));
     const event = {
-      id: randomUUID8(),
+      id: randomUUID9(),
       question,
       answer: "",
       status: "running"
@@ -51881,7 +52006,7 @@ ${message}`, ["Yes", "No"], opts);
     const truncation = truncateTail(rawOutput);
     const output = truncation.content.replace(/\n+$/, "");
     this.sideQuestionTurns.push({
-      id: `side-bash-${randomUUID8()}`,
+      id: `side-bash-${randomUUID9()}`,
       question: bash.input,
       answer: bashOutputToText({
         output,
@@ -51975,7 +52100,7 @@ ${message}`, ["Yes", "No"], opts);
         if (this.sideQuestionComponent && slashCommand !== void 0 && (isBuiltinSlashCommandName(slashCommand.name) || this.connectionCommands.some((command) => command.name === slashCommand.name))) {
           this.editor.addToHistory?.(text);
           this.sideQuestionComponent.addTurn({
-            id: `side-notice-${randomUUID8()}`,
+            id: `side-notice-${randomUUID9()}`,
             question: text,
             answer: "Slash commands are not available in side conversations. Press esc to return to the main thread.",
             status: "complete"
@@ -52214,7 +52339,7 @@ ${message}`, ["Yes", "No"], opts);
             this.showWarning("Wait for the current side question to finish or cancel it first.");
             return;
           }
-          const sideBash = this.sideQuestionComponent ? { runId: randomUUID8(), input: text, seedTranscript: !isExcluded } : void 0;
+          const sideBash = this.sideQuestionComponent ? { runId: randomUUID9(), input: text, seedTranscript: !isExcluded } : void 0;
           if (sideBash) {
             this.sideQuestionBash = sideBash;
           } else {
@@ -52259,7 +52384,7 @@ ${message}`, ["Yes", "No"], opts);
           if (this.hasPastedImagesFor(text)) {
             this.editor.setText(text);
             this.sideQuestionComponent.addTurn({
-              id: `side-notice-${randomUUID8()}`,
+              id: `side-notice-${randomUUID9()}`,
               question: text,
               answer: "Images are not supported in side conversations. Press esc to return to the main thread.",
               status: "complete"
@@ -54217,7 +54342,7 @@ ${message}`, ["Yes", "No"], opts);
     const currentText = this.editor.getExpandedText?.() ?? this.editor.getText();
     const tmpFile = path5.join(os3.tmpdir(), `pi-editor-${Date.now()}.pi.md`);
     try {
-      fs5.writeFileSync(tmpFile, currentText, "utf-8");
+      fs4.writeFileSync(tmpFile, currentText, "utf-8");
       this.ui.stop();
       const [editor, ...editorArgs] = editorCmd.split(" ");
       const result = spawnSync8(editor, [...editorArgs, tmpFile], {
@@ -54225,12 +54350,12 @@ ${message}`, ["Yes", "No"], opts);
         shell: process.platform === "win32"
       });
       if (result.status === 0) {
-        const newContent = fs5.readFileSync(tmpFile, "utf-8").replace(/\n$/, "");
+        const newContent = fs4.readFileSync(tmpFile, "utf-8").replace(/\n$/, "");
         this.editor.setText(newContent);
       }
     } finally {
       try {
-        fs5.unlinkSync(tmpFile);
+        fs4.unlinkSync(tmpFile);
       } catch {
       }
       this.ui.start();
@@ -55239,12 +55364,12 @@ Fell back to dark theme.`);
         this.showError("Usage: /mcp logout <name>");
         return;
       }
-      if (!isAuthed(server)) {
-        this.showStatus(`${server} is not connected.`);
-        return;
+      try {
+        authStorage.removeVerified(`mcp:${server}`);
+        await this.reloadAfterMcpChange(`Disconnected ${server}.`);
+      } catch (error) {
+        this.showError(`Logout failed: ${error instanceof Error ? error.message : String(error)}`);
       }
-      authStorage.logout(`mcp:${server}`);
-      await this.reloadAfterMcpChange(`Disconnected ${server}.`);
       return;
     }
     try {
@@ -55685,8 +55810,8 @@ Fell back to dark theme.`);
 `;
     let files = [];
     try {
-      if (fs5.existsSync(logsDir)) {
-        files = fs5.readdirSync(logsDir).filter((name) => !name.startsWith("."));
+      if (fs4.existsSync(logsDir)) {
+        files = fs4.readdirSync(logsDir).filter((name) => !name.startsWith("."));
       }
     } catch {
     }
@@ -55697,7 +55822,7 @@ Fell back to dark theme.`);
       for (const name of files.sort()) {
         let size = "";
         try {
-          size = ` ${theme.fg("dim", `(${(fs5.statSync(path5.join(logsDir, name)).size / 1024).toFixed(1)} KB)`)}`;
+          size = ` ${theme.fg("dim", `(${(fs4.statSync(path5.join(logsDir, name)).size / 1024).toFixed(1)} KB)`)}`;
         } catch {
         }
         info += `${theme.fg("dim", "\u2022")} ${name}${size}
@@ -56144,8 +56269,8 @@ ${interrupt ? `| \`${interrupt}\` | Interrupt current operation |
         ...messages.map((msg) => JSON.stringify(msg)),
         ""
       ].join("\n");
-      fs5.mkdirSync(path5.dirname(debugLogPath), { recursive: true });
-      fs5.writeFileSync(debugLogPath, debugData);
+      fs4.mkdirSync(path5.dirname(debugLogPath), { recursive: true });
+      fs4.writeFileSync(debugLogPath, debugData);
       this.chatContainer.addChild(new Spacer(1));
       this.chatContainer.addChild(new Text(`${theme.fg("accent", "\u2713 Debug log written")}
 ${theme.fg("muted", debugLogPath)}`, 1, 1));
@@ -56161,7 +56286,7 @@ ${theme.fg("muted", debugLogPath)}`, 1, 1));
   }
   handleDementedDelves() {
     this.chatContainer.addChild(new Spacer(1));
-    this.chatContainer.addChild(new EarendilAnnouncementComponent());
+    this.chatContainer.addChild(new BrandAnnouncementComponent());
     this.ui.requestRender();
   }
   handleDaxnuts() {
@@ -58723,10 +58848,10 @@ function padLine(line, width) {
 
 // dist/modes/daemon/daemon-mode.js
 import { spawn as spawn9 } from "node:child_process";
-import { createHash as createHash8, randomUUID as randomUUID12, timingSafeEqual } from "node:crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync16, readFileSync as readFileSync23, renameSync as renameSync11, rmSync as rmSync12, writeFileSync as writeFileSync11 } from "node:fs";
+import { createHash as createHash8, randomUUID as randomUUID13, timingSafeEqual } from "node:crypto";
+import { existsSync as existsSync24, mkdirSync as mkdirSync16, readFileSync as readFileSync22, renameSync as renameSync11, rmSync as rmSync12, writeFileSync as writeFileSync11 } from "node:fs";
 import { stat as stat3 } from "node:fs/promises";
-import { createConnection as createConnection2, createServer } from "node:net";
+import { createConnection as createConnection2, createServer as createServer2 } from "node:net";
 import { basename as basename11, dirname as dirname18, isAbsolute as isAbsolute5, join as join30, resolve as resolve23 } from "node:path";
 
 // dist/core/rlm-journal-owner.js
@@ -58904,10 +59029,10 @@ var RlmJournalOwner = class _RlmJournalOwner {
 };
 
 // dist/modes/daemon/active-session-state.js
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 function createActiveSessionId(existingIds) {
   while (true) {
-    const activeSessionId = formatSessionDisplayId(randomUUID9());
+    const activeSessionId = formatSessionDisplayId(randomUUID10());
     if (!existingIds?.has(activeSessionId)) {
       return activeSessionId;
     }
@@ -59204,7 +59329,7 @@ async function withClientEnv(env, fn) {
 }
 
 // dist/modes/daemon/daemon-extension-binding.js
-import { randomUUID as randomUUID10 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 function slimSessionEventForWire(event) {
   if (event.type !== "message_update") {
     return event;
@@ -59281,7 +59406,7 @@ function createCommandContextActions(state) {
 }
 function createExtensionUIContext(state, broadcast) {
   const emitUiRequest = (method, payload) => {
-    const id = randomUUID10();
+    const id = randomUUID11();
     broadcast(state, {
       type: "extension_ui_request",
       activeSessionId: state.activeSessionId,
@@ -59381,7 +59506,7 @@ function hasExtensionUiClientForMethod(state, method) {
 }
 
 // dist/modes/daemon/daemon-rlm-capacity.js
-import { randomUUID as randomUUID11 } from "node:crypto";
+import { randomUUID as randomUUID12 } from "node:crypto";
 var DaemonRlmCapacityClient = class {
   options;
   reservations = /* @__PURE__ */ new Map();
@@ -59405,7 +59530,7 @@ var DaemonRlmCapacityClient = class {
     return this.reserve(origin, true);
   }
   async reserve(origin, residentRoot) {
-    const reservationId = randomUUID11();
+    const reservationId = randomUUID12();
     const record3 = { ...origin, reservationId, ...residentRoot ? { residentRoot } : {} };
     this.reservations.set(reservationId, record3);
     let released = false;
@@ -59877,7 +60002,7 @@ async function readRlmSubagentDisplayEntry(sessionDir) {
 }
 
 // dist/modes/daemon/snapshot-transcript-cache.js
-import { mkdirSync as mkdirSync14, readFileSync as readFileSync21, rmSync as rmSync11, writeFileSync as writeFileSync10 } from "node:fs";
+import { mkdirSync as mkdirSync14, readFileSync as readFileSync20, rmSync as rmSync11, writeFileSync as writeFileSync10 } from "node:fs";
 import { join as join29 } from "node:path";
 var SNAPSHOT_TARGET_CHUNK_BYTES = 512 * 1024;
 var SNAPSHOT_MEMORY_CACHE_BYTES = 4 * 1024 * 1024;
@@ -59968,7 +60093,7 @@ var SnapshotTranscriptCache = class {
     if (!chunk.path) {
       throw new Error(`Snapshot transcript chunk ${index} has no backing storage`);
     }
-    return readFileSync21(chunk.path);
+    return readFileSync20(chunk.path);
   }
   *[Symbol.iterator]() {
     for (let index = 0; index < this.chunkCount; index++) {
@@ -60124,7 +60249,7 @@ var SnapshotTranscriptCache = class {
 };
 
 // dist/modes/daemon/worker-recovery-journal.js
-import { fchmodSync, fstatSync as fstatSync3, fsyncSync as fsyncSync6, mkdirSync as mkdirSync15, openSync as openSync6, readFileSync as readFileSync22, readSync as readSync3, renameSync as renameSync10 } from "node:fs";
+import { fchmodSync, fstatSync as fstatSync3, fsyncSync as fsyncSync6, mkdirSync as mkdirSync15, openSync as openSync6, readFileSync as readFileSync21, readSync as readSync3, renameSync as renameSync10 } from "node:fs";
 import { dirname as dirname17 } from "node:path";
 
 // dist/modes/daemon/recovery-journal-io.js
@@ -60155,7 +60280,7 @@ function parseRecords(path6) {
   const latest = /* @__PURE__ */ new Map();
   let contents;
   try {
-    contents = readFileSync22(path6, "utf8");
+    contents = readFileSync21(path6, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return { latest, incompleteTail: false };
@@ -60552,7 +60677,7 @@ var AgentDaemon = class {
     await this.openRlmJournalOwner();
     try {
       await prepareDaemonSocketPath(this.socketPath);
-      this.server = createServer((socket) => this.handleConnection(socket));
+      this.server = createServer2((socket) => this.handleConnection(socket));
       await new Promise((resolveListen, rejectListen) => {
         const onError = (error) => {
           this.server?.off("listening", onListening);
@@ -60731,7 +60856,7 @@ var AgentDaemon = class {
     let ownsLock = false;
     try {
       for (let attempt2 = 0; attempt2 < 3 && !ownsLock; attempt2++) {
-        const token = randomUUID12();
+        const token = randomUUID13();
         const candidateDirectory = `${lockDirectory}.candidate-${process.pid}-${token}`;
         mkdirSync16(candidateDirectory, { mode: 448 });
         writeFileSync11(join30(candidateDirectory, "pid"), `${process.pid}
@@ -60750,7 +60875,7 @@ var AgentDaemon = class {
           }
           let ownerPid;
           try {
-            ownerPid = Number(readFileSync23(join30(lockDirectory, "pid"), "utf8").trim());
+            ownerPid = Number(readFileSync22(join30(lockDirectory, "pid"), "utf8").trim());
           } catch {
           }
           if (ownerPid && this.isProcessAlive(ownerPid)) {
@@ -63793,7 +63918,7 @@ var AgentDaemon = class {
           return success(command.id, "acquire_session_input_pause", { pauseId: existing[0] });
         }
         const state = this.getSessionState(command.activeSessionId);
-        const pauseId = randomUUID12();
+        const pauseId = randomUUID13();
         this.sessionInputPauses.set(pauseId, {
           activeSessionId: command.activeSessionId,
           owner: client,
@@ -66340,14 +66465,14 @@ async function resolveDaemonSessionPath(selector, cwd, sessionDir) {
 
 // dist/modes/daemon/daemon-supervisor.js
 import { spawn as spawn10 } from "node:child_process";
-import { createHash as createHash9, randomBytes, randomUUID as randomUUID13 } from "node:crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync25, mkdirSync as mkdirSync18, readdirSync as readdirSync10, readFileSync as readFileSync25, renameSync as renameSync13, rmSync as rmSync13, writeFileSync as writeFileSync12 } from "node:fs";
-import { createServer as createServer2 } from "node:net";
+import { createHash as createHash9, randomBytes, randomUUID as randomUUID14 } from "node:crypto";
+import { chmodSync as chmodSync3, existsSync as existsSync25, mkdirSync as mkdirSync18, readdirSync as readdirSync10, readFileSync as readFileSync24, renameSync as renameSync13, rmSync as rmSync13, writeFileSync as writeFileSync12 } from "node:fs";
+import { createServer as createServer3 } from "node:net";
 import { basename as basename12, dirname as dirname20, join as join31, resolve as resolve24 } from "node:path";
 import { Writable } from "node:stream";
 
 // dist/modes/daemon/command-recovery-journal.js
-import { fchmodSync as fchmodSync2, fstatSync as fstatSync4, fsyncSync as fsyncSync7, mkdirSync as mkdirSync17, openSync as openSync7, readFileSync as readFileSync24, readSync as readSync4, renameSync as renameSync12 } from "node:fs";
+import { fchmodSync as fchmodSync2, fstatSync as fstatSync4, fsyncSync as fsyncSync7, mkdirSync as mkdirSync17, openSync as openSync7, readFileSync as readFileSync23, readSync as readSync4, renameSync as renameSync12 } from "node:fs";
 import { dirname as dirname19 } from "node:path";
 var COMPACT_AFTER_RECORDS = 4096;
 function createCommandIdempotencyKey(clientId, commandId) {
@@ -66430,7 +66555,7 @@ var CommandRecoveryJournal = class {
   load() {
     let contents;
     try {
-      contents = readFileSync24(this.path, "utf8");
+      contents = readFileSync23(this.path, "utf8");
     } catch (error) {
       if (error.code === "ENOENT") {
         return;
@@ -66974,7 +67099,7 @@ var DaemonSupervisor = class {
   sessionInputPauses = /* @__PURE__ */ new Map();
   signalCleanupHandlers = [];
   descriptorDir;
-  generation = randomUUID13();
+  generation = randomUUID14();
   supervisorConfigPath;
   defaultSessionConfig;
   snapshotCacheRoot;
@@ -67057,7 +67182,7 @@ var DaemonSupervisor = class {
       const workersToAdopt = [...this.workers.values()];
       for (const worker of workersToAdopt)
         this.pendingRlmCapacity.add(worker);
-      this.server = createServer2((socket) => this.handleConnection(socket));
+      this.server = createServer3((socket) => this.handleConnection(socket));
       await this.listen();
       this.assertSocketLeaseHeld();
       this.socketIdentity = getDaemonSocketIdentity(this.socketPath);
@@ -67514,7 +67639,7 @@ var DaemonSupervisor = class {
       }
       const path6 = join31(this.descriptorDir, name);
       try {
-        const descriptor = JSON.parse(readFileSync25(path6, "utf8"));
+        const descriptor = JSON.parse(readFileSync24(path6, "utf8"));
         if (!isDaemonWorkerDescriptor(descriptor, this.socketPath)) {
           continue;
         }
@@ -67556,7 +67681,7 @@ var DaemonSupervisor = class {
       const descriptorPath = join31(this.descriptorDir, name);
       let descriptor;
       try {
-        descriptor = JSON.parse(readFileSync25(descriptorPath, "utf8"));
+        descriptor = JSON.parse(readFileSync24(descriptorPath, "utf8"));
       } catch {
         continue;
       }
@@ -67572,7 +67697,7 @@ var DaemonSupervisor = class {
   }
   loadPersistedSupervisorConfig() {
     try {
-      const parsed = JSON.parse(readFileSync25(this.supervisorConfigPath, "utf8"));
+      const parsed = JSON.parse(readFileSync24(this.supervisorConfigPath, "utf8"));
       if (parsed.version !== 1 || typeof parsed.socketPath !== "string" || normalizeSocketPath(parsed.socketPath) !== this.socketPath || !parsed.defaultSessionConfig || typeof parsed.defaultSessionConfig !== "object" || typeof parsed.defaultSessionConfig.agentDir !== "string") {
         return void 0;
       }
@@ -67709,7 +67834,7 @@ var DaemonSupervisor = class {
       }
       try {
         const response = await this.forwardToWorker(entry.worker, {
-          id: randomUUID13(),
+          id: randomUUID14(),
           type: "release_session_input_pause",
           activeSessionId: entry.activeSessionId,
           pauseId: entry.pauseId
@@ -67846,7 +67971,7 @@ var DaemonSupervisor = class {
         client,
         activeSessionId: command.activeSessionId,
         publicAdmissionId: command.admissionId,
-        workerAdmissionId: `supervisor-admission:${randomUUID13()}`,
+        workerAdmissionId: `supervisor-admission:${randomUUID14()}`,
         status: "waiting",
         controller: new AbortController()
       };
@@ -68339,7 +68464,7 @@ var DaemonSupervisor = class {
         if (!this.clients.has(client) || (this.sessionInputPauseEpochs.get(client) ?? 0) !== acquisitionEpoch) {
           try {
             const release = await this.forwardToWorker(match2.worker, {
-              id: randomUUID13(),
+              id: randomUUID14(),
               type: "release_session_input_pause",
               activeSessionId,
               pauseId
@@ -69164,7 +69289,7 @@ var DaemonSupervisor = class {
     const rootActiveSessionId = existing?.descriptor.rootActiveSessionId ?? createActiveSessionId();
     const socketPath = existing?.descriptor.socketPath ?? workerSocketPath(this.socketPath, workerId);
     const token = existing?.descriptor.authenticationToken ?? randomBytes(32).toString("base64url");
-    const workerInstanceId = randomUUID13();
+    const workerInstanceId = randomUUID14();
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const descriptorPath = existing?.descriptorPath ?? join31(this.descriptorDir, `${workerId}.json`);
     const recoveryJournalPath = existing?.descriptor.recoveryJournalPath ?? join31(this.descriptorDir, `${workerId}.recovery.jsonl`);
@@ -70624,7 +70749,7 @@ var DaemonSupervisor = class {
     if (!socketIdentity) {
       throw new Error("Direct transport requires an exact worker socket identity");
     }
-    const grantId = randomUUID13();
+    const grantId = randomUUID14();
     const token = randomBytes(32).toString("base64url");
     const expiresAt = new Date(Date.now() + PEER_TRANSPORT_GRANT_TTL_MS).toISOString();
     const resolvedActiveSessionId = currentSummary.activeSessionId ?? currentSummary.id;
@@ -71758,7 +71883,7 @@ var DaemonSupervisor = class {
     writeFileSync12(tempPath, `${JSON.stringify(manifest)}
 `, { mode: 384 });
     chmodSync3(tempPath, 384);
-    const validated = JSON.parse(readFileSync25(tempPath, "utf8"));
+    const validated = JSON.parse(readFileSync24(tempPath, "utf8"));
     if (!Array.isArray(validated.sessions) || validated.sessions.length !== manifest.sessions.length) {
       throw new Error("Could not validate aggregate update manifest");
     }
@@ -73137,7 +73262,7 @@ var RpcClient = class {
 };
 
 // dist/modes/rpc/rpc-extension-ui-context.js
-import { randomUUID as randomUUID14 } from "node:crypto";
+import { randomUUID as randomUUID15 } from "node:crypto";
 function createRpcExtensionUiBridge(output) {
   const pending = /* @__PURE__ */ new Map();
   let closed = false;
@@ -73145,7 +73270,7 @@ function createRpcExtensionUiBridge(output) {
     if (closed || opts?.signal?.aborted) {
       return Promise.resolve(defaultValue);
     }
-    const id = randomUUID14();
+    const id = randomUUID15();
     return new Promise((resolve26) => {
       let timeout;
       const cleanup = () => {
@@ -73170,7 +73295,7 @@ function createRpcExtensionUiBridge(output) {
     });
   };
   const fireAndForget = (request) => {
-    output({ type: "extension_ui_request", id: randomUUID14(), ...request });
+    output({ type: "extension_ui_request", id: randomUUID15(), ...request });
   };
   const uiContext = {
     select: (title, options, opts) => createDialogPromise(opts, void 0, { method: "select", title, options, timeout: opts?.timeout }, (response) => "cancelled" in response && response.cancelled ? void 0 : "value" in response ? response.value : void 0),