@qodalis/cli 2.0.0-beta.12 → 2.0.0-beta.14

package/public-api.js

@@ -409,10 +409,31 @@ var ICliPingServerService_TOKEN = "cli-ping-server-service";
 var CliModuleRegistry_TOKEN = "cli-module-registry";
 var CliBackgroundServiceRegistry_TOKEN = "cli-background-service-registry";
 var CliPackageManagerService_TOKEN = "cli-package-manager-service";
+var CliKeyValueStore_TOKEN = "cli-key-value-store";
+var SyntaxHighlighterRegistry_TOKEN = "syntax-highlighter-registry";
 
 // src/lib/version.ts
-var LIBRARY_VERSION = "2.0.0-beta.12";
+var LIBRARY_VERSION = "2.0.0-beta.14";
 var API_VERSION = 2;
+var ANONYMOUS = "\0anonymous";
+function aliasOwner(context2) {
+  let auth;
+  try {
+    auth = context2.services.get(cliCore.ICliAuthorizationService_TOKEN);
+  } catch {
+    auth = void 0;
+  }
+  if (!auth) return void 0;
+  return auth.getPrincipal()?.name ?? ANONYMOUS;
+}
+function aliasesFor(state, owner) {
+  if (owner === void 0) return state?.aliases ?? {};
+  return state?.aliasesByUser?.[owner] ?? {};
+}
+function withAliases(state, owner, aliases) {
+  if (owner === void 0) return { aliases };
+  return { aliasesByUser: { ...state?.aliasesByUser ?? {}, [owner]: aliases } };
+}
 var CliAliasCommandProcessor = class {
   constructor() {
     this.command = "alias";
@@ -429,26 +450,33 @@ var CliAliasCommandProcessor = class {
       },
       storeName: "aliases"
     };
+    /** Shared aliases (used when no auth module is loaded) */
     this.userAliases = {};
+    this.aliasState = {};
     this.processors = [
       {
         command: "ls",
         description: "List all aliases",
         processCommand: async (_, context2) => {
           const { writer } = context2;
+          const visible = this.aliasesFor(context2);
           writer.writeln("Aliases:");
-          Object.entries(this.userAliases).forEach(
+          Object.entries(visible).forEach(
             ([alias, command2]) => {
               writer.writeInfo(`  ${alias} -> ${command2}`);
             }
           );
-          if (Object.keys(this.userAliases).length === 0) {
+          if (Object.keys(visible).length === 0) {
             writer.writeInfo("  No aliases defined");
           }
         }
       }
     ];
   }
+  /** Aliases visible to the current principal */
+  aliasesFor(context2) {
+    return aliasesFor(this.aliasState, aliasOwner(context2));
+  }
   writeDescription(context2) {
     const { writer, translator: t } = context2;
     writer.writeln(t.t("cli.alias.long_description", "Create shortcut aliases for frequently used commands"));
@@ -474,7 +502,7 @@ var CliAliasCommandProcessor = class {
     );
   }
   async processCommand(command2, context2) {
-    const registry = context2.services.get(
+    const registry = context2.services.getRequired(
       CliProcessorsRegistry_TOKEN
     );
     const { writer } = context2;
@@ -494,18 +522,20 @@ var CliAliasCommandProcessor = class {
       }
       context2.writer.writeInfo(`${alias} -> ${command2.args[alias]}`);
     }
-    context2.state.updateState({
-      aliases: {
-        ...this.userAliases,
+    const owner = aliasOwner(context2);
+    context2.state.updateState(
+      withAliases(this.aliasState, owner, {
+        ...aliasesFor(this.aliasState, owner),
         ...command2.args
-      }
-    });
+      })
+    );
     await context2.state.persist();
   }
   async initialize(context2) {
     this.stateSubscription?.unsubscribe();
-    this.stateSubscription = context2.state.select((x) => x["aliases"]).subscribe((aliases) => {
-      this.userAliases = aliases ?? {};
+    this.stateSubscription = context2.state.select((x) => x).subscribe((state) => {
+      this.aliasState = state ?? {};
+      this.userAliases = this.aliasState.aliases ?? {};
     });
   }
 };
@@ -1333,7 +1363,9 @@ var CliEvalCommandProcessor = class {
     this.acceptsRawInput = true;
     this.metadata = {
       icon: "\u{1F9EE}",
-      module: "misc"
+      module: "misc",
+      // Enforced only when an auth module is loaded (eval also needs allowEval)
+      requiredPermissions: ["system:eval"]
     };
   }
   async processCommand(command, context) {
@@ -2448,7 +2480,9 @@ var CliUnAliasCommandProcessor = class {
   async processCommand(command2, context2) {
     const { writer } = context2;
     const aliasToRemove = command2.value;
-    const { aliases } = context2.state.getState();
+    const state = context2.state.getState();
+    const owner = aliasOwner(context2);
+    const aliases = aliasesFor(state, owner);
     if (!aliases[aliasToRemove]) {
       writer.writeError(`Alias ${aliasToRemove} not found`);
       context2.process.exit(-1);
@@ -2458,9 +2492,7 @@ var CliUnAliasCommandProcessor = class {
     Object.keys(aliases).filter((alias) => alias !== aliasToRemove).forEach((alias) => {
       updated[alias] = aliases[alias];
     });
-    context2.state.updateState({
-      aliases: updated
-    });
+    context2.state.updateState(withAliases(state, owner, updated));
     await context2.state.persist();
   }
 };
@@ -2814,7 +2846,7 @@ var CliConfigureCommandProcessor = class _CliConfigureCommandProcessor {
     ];
   }
   async processCommand(command2, context2) {
-    const registry = context2.services.get(
+    const registry = context2.services.getRequired(
       CliProcessorsRegistry_TOKEN
     );
     const pluginCategories = cliCore.resolveConfigurationCategories(registry);
@@ -2911,10 +2943,10 @@ var CliConfigureCommandProcessor = class _CliConfigureCommandProcessor {
     if (stateKey === "system") {
       const langOption = options.find((o) => o.key === "language");
       if (langOption) {
-        try {
-          const translator = context2.services.get(
-            cliCore.ICliTranslationService_TOKEN
-          );
+        const translator = context2.services.get(
+          cliCore.ICliTranslationService_TOKEN
+        );
+        if (translator) {
           const locales = translator.getAvailableLocales();
           if (locales.length > 0) {
             langOption.options = locales.map((l) => ({
@@ -2922,7 +2954,6 @@ var CliConfigureCommandProcessor = class _CliConfigureCommandProcessor {
               value: l
             }));
           }
-        } catch {
         }
       }
     }
@@ -3067,13 +3098,10 @@ var CliConfigureCommandProcessor = class _CliConfigureCommandProcessor {
       }
     }
     if (settings["language"]) {
-      try {
-        const translator = context2.services.get(
-          cliCore.ICliTranslationService_TOKEN
-        );
-        translator.setLocale(settings["language"]);
-      } catch {
-      }
+      const translator = context2.services.get(
+        cliCore.ICliTranslationService_TOKEN
+      );
+      translator?.setLocale(settings["language"]);
     }
     if (context2.terminal?.options) {
       if (settings["cursorBlink"] !== void 0) {
@@ -3103,7 +3131,7 @@ var CliConfigureCommandProcessor = class _CliConfigureCommandProcessor {
       aliases: ["ls"],
       description: "List all configuration options and their current values",
       processCommand: async (_, context2) => {
-        const registry = context2.services.get(
+        const registry = context2.services.getRequired(
           CliProcessorsRegistry_TOKEN
         );
         const allOptions = this.getAllOptions(registry);
@@ -3165,7 +3193,7 @@ var CliConfigureCommandProcessor = class _CliConfigureCommandProcessor {
         }
         const category = path.substring(0, dotIndex);
         const key = path.substring(dotIndex + 1);
-        const registry = context2.services.get(
+        const registry = context2.services.getRequired(
           CliProcessorsRegistry_TOKEN
         );
         const allOptions = this.getAllOptions(registry);
@@ -3217,7 +3245,7 @@ var CliConfigureCommandProcessor = class _CliConfigureCommandProcessor {
         }
         const category = path.substring(0, dotIndex);
         const key = path.substring(dotIndex + 1);
-        const registry = context2.services.get(
+        const registry = context2.services.getRequired(
           CliProcessorsRegistry_TOKEN
         );
         const allOptions = this.getAllOptions(registry);
@@ -3277,7 +3305,7 @@ var CliConfigureCommandProcessor = class _CliConfigureCommandProcessor {
               t.t("cli.configure.system_reset", "System configuration reset to defaults")
             );
           } else {
-            const registry = context2.services.get(
+            const registry = context2.services.getRequired(
               CliProcessorsRegistry_TOKEN
             );
             const categories2 = cliCore.resolveConfigurationCategories(registry);
@@ -3673,7 +3701,7 @@ var CliHelpCommandProcessor = class {
   async processCommand(command2, context2) {
     const { writer } = context2;
     const t = context2.translator;
-    const registry = context2.services.get(
+    const registry = context2.services.getRequired(
       CliProcessorsRegistry_TOKEN
     );
     const [_, ...commandsToHelp] = command2.command.split(" ");
@@ -3773,24 +3801,23 @@ var CliHelpCommandProcessor = class {
   writeProcessorDescription(processor, context2) {
     const { writer } = context2;
     const t = context2.translator;
-    const icon = processor.metadata?.icon || "";
-    const name = `${BOLD}${writer.wrapInColor(processor.command, cliCore.CliForegroundColor.Cyan)}${RESET}`;
     const version = `${DIM}v${processor.version || "1.0.0"}${RESET}`;
-    writer.writeln();
-    writer.writeln(`  ${icon}${icon ? "  " : ""}${name} ${version}`);
+    const headerLines = [];
     if (processor.description) {
-      const desc = this.translateDescription(
-        processor.description,
-        processor.command,
-        context2
+      headerLines.push(
+        this.translateDescription(processor.description, processor.command, context2)
       );
-      writer.writeln(`  ${desc}`);
     }
     if (processor.aliases?.length) {
-      writer.writeln(
-        `  ${DIM}${t.t("cli.help.aliases", "Aliases:")}${RESET} ${processor.aliases.map((a) => writer.wrapInColor(a, cliCore.CliForegroundColor.Magenta)).join(", ")}`
+      headerLines.push(
+        `${DIM}${t.t("cli.help.aliases", "Aliases:")}${RESET} ${processor.aliases.map((a) => writer.wrapInColor(a, cliCore.CliForegroundColor.Magenta)).join(", ")}`
       );
     }
+    writer.writeln();
+    writer.writeBox(headerLines, {
+      title: `${writer.wrapInColor(processor.command, cliCore.CliForegroundColor.Cyan)} ${version}`,
+      borderColor: cliCore.CliForegroundColor.White
+    });
     if (processor.originalProcessor) {
       writer.writeln();
       writer.writeln(
@@ -3956,20 +3983,13 @@ var CliVersionCommandProcessor = class {
     writer.writeln(
       writer.wrapInColor(getCliNameArt(context2.terminal.cols), cliCore.CliForegroundColor.Cyan)
     );
-    writer.writeln(
-      `  ${DIM2}CLI${RESET2}  ${writer.wrapInColor(`v${LIBRARY_VERSION}`, cliCore.CliForegroundColor.Green)}    ${DIM2}Core${RESET2}  ${writer.wrapInColor(`v${cliCore.LIBRARY_VERSION}`, cliCore.CliForegroundColor.Green)}`
-    );
-    let framework = "vanilla";
-    try {
-      framework = context2.services.get("cli-framework");
-    } catch {
-    }
-    writer.writeln(
-      `  ${DIM2}Framework${RESET2}  ${writer.wrapInColor(framework, cliCore.CliForegroundColor.Cyan)}`
-    );
-    writer.writeln(
-      `  ${DIM2}Docs${RESET2}  ${writer.wrapInColor("https://cli.qodalis.com/docs/", cliCore.CliForegroundColor.Blue)}`
-    );
+    const framework = context2.services.get("cli-framework") ?? "vanilla";
+    writer.writeBox([
+      `${DIM2}CLI${RESET2}        ${writer.wrapInColor(`v${LIBRARY_VERSION}`, cliCore.CliForegroundColor.Green)}`,
+      `${DIM2}Core${RESET2}       ${writer.wrapInColor(`v${cliCore.LIBRARY_VERSION}`, cliCore.CliForegroundColor.Green)}`,
+      `${DIM2}Framework${RESET2}  ${writer.wrapInColor(framework, cliCore.CliForegroundColor.Cyan)}`,
+      `${DIM2}Docs${RESET2}       ${writer.wrapInColor("https://cli.qodalis.com/docs/", cliCore.CliForegroundColor.Blue)}`
+    ], { borderColor: cliCore.CliForegroundColor.White });
     writer.writeln();
   }
   writeDescription(context2) {
@@ -4027,11 +4047,7 @@ function collectSystemInfo(context2) {
   const lines = [];
   lines.push(`- **CLI Version:** ${LIBRARY_VERSION}`);
   lines.push(`- **Core Version:** ${cliCore.LIBRARY_VERSION}`);
-  let framework = "vanilla";
-  try {
-    framework = context2.services.get("cli-framework");
-  } catch {
-  }
+  const framework = context2.services.get("cli-framework") ?? "vanilla";
   lines.push(`- **Framework:** ${framework}`);
   lines.push(`- **Terminal:** ${context2.terminal.cols}x${context2.terminal.rows}`);
   if (typeof navigator !== "undefined") {
@@ -4103,12 +4119,8 @@ async function runInteractiveFlow(type, initialTitle, context2) {
     `${writer.wrapInColor("\u2500\u2500 System Info (auto-attached) \u2500\u2500", cliCore.CliForegroundColor.Cyan)}`
   );
   writer.writeln(`  CLI: ${LIBRARY_VERSION}  Core: ${cliCore.LIBRARY_VERSION}`);
-  let framework = "vanilla";
-  try {
-    framework = context2.services.get("cli-framework");
-  } catch {
-  }
-  writer.writeln(`  Framework: ${framework}  Terminal: ${context2.terminal.cols}x${context2.terminal.rows}`);
+  const previewFramework = context2.services.get("cli-framework") ?? "vanilla";
+  writer.writeln(`  Framework: ${previewFramework}  Terminal: ${context2.terminal.cols}x${context2.terminal.rows}`);
   if (typeof navigator !== "undefined") {
     writer.writeln(`  Platform: ${navigator.platform}  Language: ${navigator.language}`);
   }
@@ -4250,7 +4262,7 @@ var CliHistoryCommandProcessor = class {
       command: "clear",
       description: "Clears the command history",
       processCommand: async (_, context2) => {
-        const commandHistory = context2.services.get(
+        const commandHistory = context2.services.getRequired(
           CliCommandHistory_TOKEN
         );
         await commandHistory.clearHistory();
@@ -4273,7 +4285,7 @@ var CliHistoryCommandProcessor = class {
       description: "Search command history for a pattern",
       parameters: searchParameters,
       processCommand: async (cmd, context2) => {
-        const commandHistory = context2.services.get(
+        const commandHistory = context2.services.getRequired(
           CliCommandHistory_TOKEN
         );
         const query = (cmd.value ?? "").trim();
@@ -4327,7 +4339,7 @@ var CliHistoryCommandProcessor = class {
   }
   async processCommand(_, context2) {
     const { writer } = context2;
-    const commandHistory = context2.services.get(
+    const commandHistory = context2.services.getRequired(
       CliCommandHistory_TOKEN
     );
     const history = commandHistory.getHistory();
@@ -4716,7 +4728,9 @@ var CliPackagesCommandProcessor = class {
     this.metadata = {
       sealed: true,
       icon: "\u{1F4E6}",
-      module: "system"
+      module: "system",
+      // Enforced only when an auth module is loaded
+      requiredPermissions: ["system:packages"]
     };
     this.stateConfiguration = {
       initialState: {
@@ -4774,7 +4788,7 @@ var CliPackagesCommandProcessor = class {
           const { progressBar, writer } = context2;
           const { signal, cleanup } = scope.createAbortSignal(context2);
           progressBar.show();
-          context2.setStatusText("Browsing packages");
+          context2.notifier.info("Browsing packages");
           const prefix = packagesManager.QODALIS_COMMAND_PREFIX;
           const knownShortNames = [
             "browser-storage",
@@ -4967,7 +4981,7 @@ var CliPackagesCommandProcessor = class {
           const packages = command2.value.split(" ");
           for (const pkg of packages) {
             if (signal.aborted) break;
-            context2.setStatusText(`Installing ${pkg}`);
+            context2.notifier.info(`Installing ${pkg}`);
             await scope.addPackage(pkg, context2, signal);
           }
           cleanup();
@@ -5008,7 +5022,7 @@ var CliPackagesCommandProcessor = class {
           const packages = command2.value.split(" ");
           for (const pkg of packages) {
             if (signal.aborted) break;
-            context2.setStatusText(`Removing ${pkg}`);
+            context2.notifier.info(`Removing ${pkg}`);
             await scope.removePackage(pkg, context2);
           }
           cleanup();
@@ -5044,7 +5058,7 @@ var CliPackagesCommandProcessor = class {
           const fullName = name.startsWith(prefix) ? name : `${prefix}${name}`;
           progressBar.show();
           progressBar.setText(`Fetching versions for ${name}`);
-          context2.setStatusText(`Fetching versions for ${name}`);
+          context2.notifier.info(`Fetching versions for ${name}`);
           try {
             const response = await scriptsLoader.getScript(
               `https://registry.npmjs.org/${encodeURIComponent(fullName)}`,
@@ -5508,11 +5522,11 @@ var CliPackagesCommandProcessor = class {
     );
   }
   async initialize(context2) {
-    this.registry = context2.services.get(
+    this.registry = context2.services.getRequired(
       CliProcessorsRegistry_TOKEN
     );
-    const store = context2.services.get(
-      "cli-key-value-store"
+    const store = context2.services.getRequired(
+      CliKeyValueStore_TOKEN
     );
     this.packagesManager.setStore(store);
     context2.services.set([{
@@ -5778,10 +5792,11 @@ var CliPackagesCommandProcessor = class {
   }
 };
 var CliServerConnection = class _CliServerConnection {
-  constructor(_config, _backgroundServices, _logger) {
+  constructor(_config, _backgroundServices, _logger, _authService) {
     this._config = _config;
     this._backgroundServices = _backgroundServices;
     this._logger = _logger;
+    this._authService = _authService;
     this._connected = false;
     this._commands = [];
     this._capabilities = null;
@@ -5790,6 +5805,8 @@ var CliServerConnection = class _CliServerConnection {
     this._basePath = "";
     this._wsReconnectAttempts = 0;
     this._wsReconnectTimer = null;
+    /** True once this connection registered its `server-events:<name>` background service */
+    this._eventServiceRegistered = false;
     this._healthCheckTimer = null;
     this._healthCheckAttempts = 0;
   }
@@ -5820,10 +5837,33 @@ var CliServerConnection = class _CliServerConnection {
   get apiVersion() {
     return this._apiVersion;
   }
+  /**
+   * Resolve auth headers for this server connection.
+   * Uses the auth service (which merges config headers with registered
+   * ICliServerAuthTokenProviders), or falls back to config headers directly.
+   */
+  resolveAuthHeaders() {
+    if (this._authService) {
+      return this._authService.getHeaders(this._config.name, this._config.headers);
+    }
+    return cliCore.resolveHeaders(this._config.headers);
+  }
+  /**
+   * WebSocket URL for this server with auth: single-use upgrade params from
+   * auth providers when available, otherwise headers copied into the URL.
+   */
+  async buildWebSocketUrl(path) {
+    const url = this.toWebSocketUrl(this.normalizeUrl(this._config.url)) + path;
+    const params = await this._authService?.getWebSocketParams?.(this._config.name);
+    if (params) {
+      return cliCore.appendQueryParams(url, params);
+    }
+    return cliCore.buildAuthenticatedWebSocketUrl(url, () => this.resolveAuthHeaders());
+  }
   async connect() {
     try {
       const baseUrl = this.normalizeUrl(this._config.url);
-      const negotiated = await cliCore.ServerVersionNegotiator.discover(baseUrl);
+      const negotiated = await cliCore.ServerVersionNegotiator.discover(baseUrl, () => this.resolveAuthHeaders());
       if (negotiated) {
         this._apiVersion = negotiated.apiVersion;
         this._basePath = negotiated.basePath;
@@ -6011,15 +6051,25 @@ var CliServerConnection = class _CliServerConnection {
       return;
     }
     const serviceName = `server-events:${this._config.name}`;
+    if (this._eventServiceRegistered && this._backgroundServices.getStatus(serviceName)) {
+      const status = this._backgroundServices.getStatus(serviceName).status;
+      const restart = status === "running" ? this._backgroundServices.restart(serviceName) : this._backgroundServices.start(serviceName);
+      restart.catch((e) => {
+        this._logger?.debug(`Background event service failed for "${this._config.name}", falling back to direct: ${e}`);
+        this.connectEventSocketDirect();
+      });
+      return;
+    }
     try {
       this._backgroundServices.register({
         name: serviceName,
         description: `Event stream for server '${this._config.name}'`,
         type: "daemon",
         onStart: async (ctx) => {
-          const baseUrl = this.normalizeUrl(this._config.url);
-          const wsUrl = this.toWebSocketUrl(baseUrl) + "/ws/v1/qcli/events";
-          ctx.log(`Connecting to ${wsUrl}`);
+          const wsUrl = await this.buildWebSocketUrl("/ws/v1/qcli/events");
+          if (!this._connected) return;
+          ctx.log(`Connecting to ${wsUrl.split("?")[0]}`);
+          this.closeEventSocketDirect();
           this._eventSocket = new WebSocket(wsUrl);
           this._eventSocket.onopen = () => {
             this._wsReconnectAttempts = 0;
@@ -6042,7 +6092,11 @@ var CliServerConnection = class _CliServerConnection {
             } catch {
             }
           };
-          this._eventSocket.onclose = () => {
+          this._eventSocket.onclose = (event) => {
+            if (this.isSessionEndedClose(event)) {
+              ctx.log("Event socket closed: session ended", "info");
+              return;
+            }
             if (this._connected) {
               ctx.log("WebSocket closed unexpectedly, scheduling reconnect", "warn");
               this.scheduleWsReconnect();
@@ -6056,6 +6110,7 @@ var CliServerConnection = class _CliServerConnection {
           this.closeEventSocketDirect();
         }
       });
+      this._eventServiceRegistered = true;
       this._backgroundServices.start(serviceName).catch((e) => {
         this._logger?.debug(`Background event service failed for "${this._config.name}", falling back to direct: ${e}`);
         this.connectEventSocketDirect();
@@ -6066,9 +6121,13 @@ var CliServerConnection = class _CliServerConnection {
     }
   }
   connectEventSocketDirect() {
+    void this.connectEventSocketDirectAsync();
+  }
+  async connectEventSocketDirectAsync() {
     try {
-      const baseUrl = this.normalizeUrl(this._config.url);
-      const wsUrl = this.toWebSocketUrl(baseUrl) + "/ws/v1/qcli/events";
+      const wsUrl = await this.buildWebSocketUrl("/ws/v1/qcli/events");
+      if (!this._connected) return;
+      this.closeEventSocketDirect();
       this._eventSocket = new WebSocket(wsUrl);
       this._eventSocket.onopen = () => {
         this._wsReconnectAttempts = 0;
@@ -6086,7 +6145,8 @@ var CliServerConnection = class _CliServerConnection {
         } catch {
         }
       };
-      this._eventSocket.onclose = () => {
+      this._eventSocket.onclose = (event) => {
+        if (this.isSessionEndedClose(event)) return;
         if (this._connected) {
           this.scheduleWsReconnect();
         }
@@ -6097,6 +6157,16 @@ var CliServerConnection = class _CliServerConnection {
       this._logger?.debug(`WebSocket not available for "${this._config.name}": ${e}`);
     }
   }
+  /**
+   * The server closes the event socket with 4401 when the session behind it
+   * ended (logout, revoke, expiry). Retrying with the same credentials cannot
+   * succeed; the auth layer reconnects the server when the session changes.
+   */
+  isSessionEndedClose(event) {
+    if (event?.code !== 4401) return false;
+    this.closeEventSocketDirect();
+    return true;
+  }
   handleServerDisconnect() {
     this._connected = false;
     this._commands = [];
@@ -6171,7 +6241,7 @@ var CliServerConnection = class _CliServerConnection {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeout);
     const headers = {
-      ...this._config.headers ?? {},
+      ...this.resolveAuthHeaders(),
       ...init?.headers ?? {}
     };
     return fetch(url, {
@@ -6252,7 +6322,7 @@ async function executeOnServer(connection, serverName, descriptor, command2, con
     chainCommands: commandPath && commandPath.length > 1 ? commandPath.slice(1) : []
   };
   const cmdLabel = commandPath && commandPath.length > 0 ? commandPath.join(" ") : descriptor.command;
-  context2.setStatusText(`executing command: ${cmdLabel} on server ${serverName}`);
+  context2.notifier.info(`executing command: ${cmdLabel} on server ${serverName}`);
   try {
     if (connection.capabilities?.streaming) {
       const result = await connection.executeStream(
@@ -6307,6 +6377,7 @@ var CliServerProxyProcessor = class _CliServerProxyProcessor {
     this.processors = descriptor.processors?.map(
       (sub) => new _CliServerProxyProcessor(connection, sub, serverName, true, this.commandPath)
     );
+    this.acceptsRawInput = !this.processors?.length;
   }
   async processCommand(command2, context2) {
     return executeOnServer(
@@ -6355,6 +6426,7 @@ var CliServerMultiProxyProcessor = class _CliServerMultiProxyProcessor {
       }).filter((e) => e !== null);
       return new _CliServerMultiProxyProcessor(subEntries, this.provider, this.commandPath);
     });
+    this.acceptsRawInput = !this.processors?.length;
   }
   async processCommand(command2, context2) {
     const defaultServer = this.provider.defaultServer;
@@ -6440,14 +6512,26 @@ var CliServerMultiProxyProcessor = class _CliServerMultiProxyProcessor {
 // src/lib/server/cli-server-manager.ts
 var CliServerManager_TOKEN = "cli-server-manager";
 var CliServerManager = class {
-  constructor(registry) {
+  constructor(registry, authService) {
     this.registry = registry;
+    this.authService = authService;
     this.connections = /* @__PURE__ */ new Map();
     this._defaultServer = null;
+    /** Bare-name aliases this manager registered (only these are ever removed) */
+    this._bareAliases = /* @__PURE__ */ new Set();
   }
   get defaultServer() {
     return this._defaultServer;
   }
+  preferredServer() {
+    if (this._defaultServer && this.connections.get(this._defaultServer)?.connected) {
+      return this._defaultServer;
+    }
+    for (const [name, connection] of this.connections) {
+      if (connection.connected) return name;
+    }
+    return null;
+  }
   setDefaultServer(name) {
     if (name !== null && !this.connections.has(name)) {
       throw new Error(`Unknown server: ${name}`);
@@ -6462,7 +6546,7 @@ var CliServerManager = class {
     this._backgroundServices = backgroundServices;
     for (const config of servers) {
       if (config.enabled === false) continue;
-      const connection = new CliServerConnection(config, backgroundServices, cliLogger);
+      const connection = new CliServerConnection(config, backgroundServices, cliLogger, this.authService);
       this.connections.set(config.name, connection);
       connection.onDisconnect = () => {
         this.handleDisconnect(config.name);
@@ -6510,6 +6594,7 @@ var CliServerManager = class {
     await connection.connect();
     if (connection.connected) {
       this.registerProxyProcessors(connection, name);
+      this.unregisterBareAliases();
       this.registerBareAliases();
       return { success: true, commandCount: connection.commands.length };
     }
@@ -6540,11 +6625,12 @@ var CliServerManager = class {
     this.registerBareAliases();
   }
   unregisterBareAliases() {
-    for (const p of [...this.registry.processors]) {
-      if (p.metadata?.module === "server:multi" || p.metadata?.requireServer && !p.command.includes(":")) {
+    for (const p of this._bareAliases) {
+      if (this.registry.processors.includes(p)) {
         this.registry.unregisterProcessor(p);
       }
     }
+    this._bareAliases.clear();
   }
   registerProxyProcessors(connection, serverName) {
     for (const descriptor of connection.commands) {
@@ -6568,7 +6654,7 @@ var CliServerManager = class {
     }
     for (const [command2, servers] of commandCounts) {
       const existingProcessor = this.registry.findProcessor(command2, []);
-      if (existingProcessor && !existingProcessor.metadata?.requireServer)
+      if (existingProcessor && !this._bareAliases.has(existingProcessor))
         continue;
       if (servers.length === 1) {
         const serverName = servers[0];
@@ -6590,6 +6676,7 @@ var CliServerManager = class {
         alias.command = command2;
         alias.aliases = [namespacedCommand];
         this.registry.registerProcessor(alias);
+        this._bareAliases.add(alias);
       } else {
         const entries = servers.map((serverName) => {
           const connection = this.connections.get(serverName);
@@ -6600,6 +6687,7 @@ var CliServerManager = class {
         });
         const multi = new CliServerMultiProxyProcessor(entries, this);
         this.registry.registerProcessor(multi);
+        this._bareAliases.add(multi);
       }
     }
   }
@@ -6745,6 +6833,28 @@ var WASM_SEARCH_PATHS = [
   "./assets/wasm/qodalis_cli_wasm_bg.wasm",
   "/wasm/qodalis_cli_wasm_bg.wasm"
 ];
+function wasmCandidates(wasmUrl, baseUri) {
+  const baseUrl = (typeof document !== "undefined" ? document.baseURI : void 0);
+  let base;
+  try {
+    base = baseUrl ? new URL(baseUrl) : void 0;
+  } catch {
+    base = void 0;
+  }
+  const resolve = (url) => {
+    if (!base) return url;
+    try {
+      return new URL(url, base).href;
+    } catch {
+      return url;
+    }
+  };
+  const candidates = [];
+  if (wasmUrl) candidates.push(resolve(wasmUrl));
+  if (base) candidates.push(resolve("assets/wasm/qodalis_cli_wasm_bg.wasm"));
+  candidates.push(...WASM_SEARCH_PATHS.map(resolve));
+  return [...new Set(candidates)];
+}
 var wasm;
 var cachedDataViewMemory0 = null;
 var cachedInt32ArrayMemory0 = null;
@@ -6973,7 +7083,7 @@ async function initWasmAccelerator(wasmUrl) {
     return accelerator;
   }
   try {
-    const paths = wasmUrl ? [wasmUrl, ...WASM_SEARCH_PATHS] : WASM_SEARCH_PATHS;
+    const paths = wasmCandidates(wasmUrl);
     const bytes = await fetchWasmBinary(paths);
     await instantiateWasm(bytes);
     accelerator = createWasmAccelerator();
@@ -7013,7 +7123,7 @@ var CliDebugCommandProcessor = class {
         metadata: { icon: cliCore.CliIcon.Extension, module: "system" },
         processCommand: async (_, context2) => {
           const { writer } = context2;
-          const registry = context2.services.get(
+          const registry = context2.services.getRequired(
             CliProcessorsRegistry_TOKEN
           );
           writer.writeln(
@@ -7064,12 +7174,10 @@ var CliDebugCommandProcessor = class {
         metadata: { icon: cliCore.CliIcon.Module, module: "system" },
         processCommand: async (_, context2) => {
           const { writer } = context2;
-          let moduleRegistry;
-          try {
-            moduleRegistry = context2.services.get(
-              CliModuleRegistry_TOKEN
-            );
-          } catch {
+          const moduleRegistry = context2.services.get(
+            CliModuleRegistry_TOKEN
+          );
+          if (!moduleRegistry) {
             writer.writeError("Module registry not available.");
             return;
           }
@@ -7110,7 +7218,7 @@ var CliDebugCommandProcessor = class {
         metadata: { icon: cliCore.CliIcon.Database, module: "system" },
         processCommand: async (_, context2) => {
           const { writer } = context2;
-          const storeManager = context2.services.get(
+          const storeManager = context2.services.getRequired(
             CliStateStoreManager_TOKEN
           );
           const entries = storeManager.getStoreEntries();
@@ -7189,11 +7297,7 @@ var CliDebugCommandProcessor = class {
           writer.writeln(
             `  ${writer.wrapInColor("CLI Version:", cliCore.CliForegroundColor.Cyan)} ${LIBRARY_VERSION}`
           );
-          let framework = "vanilla";
-          try {
-            framework = context2.services.get("cli-framework");
-          } catch {
-          }
+          const framework = context2.services.get("cli-framework") ?? "vanilla";
           writer.writeln(
             `  ${writer.wrapInColor("Framework:", cliCore.CliForegroundColor.Cyan)} ${framework}`
           );
@@ -7234,7 +7338,7 @@ var CliDebugCommandProcessor = class {
         metadata: { icon: cliCore.CliIcon.Logs, module: "system" },
         processCommand: async (_, context2) => {
           const { writer } = context2;
-          const history = context2.services.get(
+          const history = context2.services.getRequired(
             CliCommandHistory_TOKEN
           );
           const commands = history.getHistory();
@@ -7323,14 +7427,14 @@ var CliDebugCommandProcessor = class {
           writer.writeln(
             `  ${online ? cliCore.CliIcon.CheckIcon : cliCore.CliIcon.CrossIcon} Network: ${online ? "online" : "offline"}`
           );
-          const registry = context2.services.get(
+          const registry = context2.services.getRequired(
             CliProcessorsRegistry_TOKEN
           );
           writer.writeln(
             `  ${cliCore.CliIcon.CheckIcon} Processors: ${registry.processors.length} loaded`
           );
           try {
-            const moduleRegistry = context2.services.get(
+            const moduleRegistry = context2.services.getRequired(
               CliModuleRegistry_TOKEN
             );
             const modules = moduleRegistry.getAll();
@@ -7346,7 +7450,7 @@ var CliDebugCommandProcessor = class {
           writer.writeln(
             `  ${wasmActive ? cliCore.CliIcon.CheckIcon : cliCore.CliIcon.WarningIcon} WASM Accelerator: ${wasmActive ? "loaded" : "using JS fallback"}`
           );
-          const historyService = context2.services.get(
+          const historyService = context2.services.getRequired(
             CliCommandHistory_TOKEN
           );
           writer.writeln(
@@ -7360,13 +7464,13 @@ var CliDebugCommandProcessor = class {
         metadata: { icon: cliCore.CliIcon.Save, module: "system" },
         processCommand: async (_, context2) => {
           const { writer } = context2;
-          const registry = context2.services.get(
+          const registry = context2.services.getRequired(
             CliProcessorsRegistry_TOKEN
           );
-          const history = context2.services.get(
+          const history = context2.services.getRequired(
             CliCommandHistory_TOKEN
           );
-          const storeManager = context2.services.get(
+          const storeManager = context2.services.getRequired(
             CliStateStoreManager_TOKEN
           );
           const report = {
@@ -7399,7 +7503,7 @@ var CliDebugCommandProcessor = class {
             state: storeManager.getStoreEntries()
           };
           try {
-            const moduleRegistry = context2.services.get(
+            const moduleRegistry = context2.services.getRequired(
               CliModuleRegistry_TOKEN
             );
             report["modules"] = moduleRegistry.getAll().map((m) => ({
@@ -7417,7 +7521,7 @@ var CliDebugCommandProcessor = class {
             report["services"] = container.getRegisteredTokens();
           }
           try {
-            const serverManager = context2.services.get(
+            const serverManager = context2.services.getRequired(
               CliServerManager_TOKEN
             );
             if (serverManager && serverManager.connections.size > 0) {
@@ -7441,13 +7545,9 @@ var CliDebugCommandProcessor = class {
         metadata: { icon: cliCore.CliIcon.Server, module: "system" },
         processCommand: async (_, context2) => {
           const { writer } = context2;
-          let manager;
-          try {
-            manager = context2.services.get(
-              CliServerManager_TOKEN
-            );
-          } catch {
-          }
+          const manager = context2.services.get(
+            CliServerManager_TOKEN
+          );
           if (!manager || manager.connections.size === 0) {
             writer.writeInfo("No servers configured.");
             return;
@@ -7487,70 +7587,48 @@ var CliDebugCommandProcessor = class {
   }
   async processCommand(_, context2) {
     const { writer } = context2;
-    const registry = context2.services.get(
+    const registry = context2.services.getRequired(
       CliProcessorsRegistry_TOKEN
     );
-    writer.writeln(
-      writer.wrapInColor(
-        `${cliCore.CliIcon.Bug}  CLI Debug Info`,
-        cliCore.CliForegroundColor.Yellow
-      )
-    );
-    writer.writeDivider({ char: "=" });
-    writer.writeln(
-      `  ${writer.wrapInColor("Core Version:", cliCore.CliForegroundColor.Cyan)} ${cliCore.LIBRARY_VERSION}`
-    );
-    writer.writeln(
-      `  ${writer.wrapInColor("CLI Version:", cliCore.CliForegroundColor.Cyan)} ${LIBRARY_VERSION}`
+    const summaryFramework = context2.services.get("cli-framework") ?? "vanilla";
+    const summaryModuleRegistry = context2.services.get(
+      CliModuleRegistry_TOKEN
     );
-    let framework = "vanilla";
-    try {
-      framework = context2.services.get("cli-framework");
-    } catch {
-    }
-    writer.writeln(
-      `  ${writer.wrapInColor("Framework:", cliCore.CliForegroundColor.Cyan)} ${framework}`
-    );
-    writer.writeln(
-      `  ${writer.wrapInColor("Terminal:", cliCore.CliForegroundColor.Cyan)} ${context2.terminal.cols}x${context2.terminal.rows}`
+    const summaryServerManager = context2.services.get(
+      CliServerManager_TOKEN
     );
-    writer.writeln(
-      `  ${writer.wrapInColor("Processors:", cliCore.CliForegroundColor.Cyan)} ${registry.processors.length}`
+    const history = context2.services.getRequired(
+      CliCommandHistory_TOKEN
     );
-    try {
-      const moduleRegistry = context2.services.get(
-        CliModuleRegistry_TOKEN
-      );
-      writer.writeln(
-        `  ${writer.wrapInColor("Modules:", cliCore.CliForegroundColor.Cyan)} ${moduleRegistry.getAll().length}`
+    const wasmStatus = isWasmAccelerated() ? "active" : "inactive (JS fallback)";
+    const lines = [
+      `${writer.wrapInColor("Core Version:", cliCore.CliForegroundColor.Cyan)}      ${cliCore.LIBRARY_VERSION}`,
+      `${writer.wrapInColor("CLI Version:", cliCore.CliForegroundColor.Cyan)}       ${LIBRARY_VERSION}`,
+      `${writer.wrapInColor("Framework:", cliCore.CliForegroundColor.Cyan)}         ${summaryFramework}`,
+      `${writer.wrapInColor("Terminal:", cliCore.CliForegroundColor.Cyan)}          ${context2.terminal.cols}x${context2.terminal.rows}`,
+      `${writer.wrapInColor("Processors:", cliCore.CliForegroundColor.Cyan)}        ${registry.processors.length}`
+    ];
+    if (summaryModuleRegistry) {
+      lines.push(
+        `${writer.wrapInColor("Modules:", cliCore.CliForegroundColor.Cyan)}           ${summaryModuleRegistry.getAll().length}`
       );
-    } catch {
     }
-    try {
-      const serverManager = context2.services.get(
-        CliServerManager_TOKEN
+    if (summaryServerManager && summaryServerManager.connections.size > 0) {
+      const connected = Array.from(
+        summaryServerManager.connections.values()
+      ).filter((c) => c.connected).length;
+      lines.push(
+        `${writer.wrapInColor("Servers:", cliCore.CliForegroundColor.Cyan)}           ${connected}/${summaryServerManager.connections.size} connected`
       );
-      if (serverManager && serverManager.connections.size > 0) {
-        const connected = Array.from(
-          serverManager.connections.values()
-        ).filter((c) => c.connected).length;
-        writer.writeln(
-          `  ${writer.wrapInColor("Servers:", cliCore.CliForegroundColor.Cyan)} ${connected}/${serverManager.connections.size} connected`
-        );
-      }
-    } catch {
     }
-    const history = context2.services.get(
-      CliCommandHistory_TOKEN
+    lines.push(
+      `${writer.wrapInColor("History:", cliCore.CliForegroundColor.Cyan)}           ${history.getHistory().length} commands`,
+      `${writer.wrapInColor("WASM Accelerator:", cliCore.CliForegroundColor.Cyan)}  ${wasmStatus}`
     );
-    writer.writeln(
-      `  ${writer.wrapInColor("History:", cliCore.CliForegroundColor.Cyan)} ${history.getHistory().length} commands`
-    );
-    const wasmStatus = isWasmAccelerated() ? "active" : "inactive (JS fallback)";
-    writer.writeln(
-      `  ${writer.wrapInColor("WASM Accelerator:", cliCore.CliForegroundColor.Cyan)} ${wasmStatus}`
-    );
-    writer.writeDivider({ char: "=" });
+    writer.writeBox(lines, {
+      title: "CLI Debug Info",
+      borderColor: cliCore.CliForegroundColor.Yellow
+    });
     writer.writeln();
     writer.writeln(`${cliCore.CliIcon.Light} Subcommands:`);
     for (const sub of this.processors || []) {
@@ -8136,7 +8214,7 @@ var CliNanoCommandProcessor = class {
     this.replaceWith = "";
     this.statusMessage = void 0;
     try {
-      this.fs = context2.services.get(FS_TOKEN);
+      this.fs = context2.services.getRequired(FS_TOKEN);
     } catch {
       this.fs = null;
     }
@@ -8475,8 +8553,8 @@ var CliNanoCommandProcessor = class {
       return;
     }
     try {
-      const registry = this.context.services.get(
-        "syntax-highlighter-registry"
+      const registry = this.context.services.getRequired(
+        SyntaxHighlighterRegistry_TOKEN
       );
       const ext = "." + filePath.split(".").pop()?.toLowerCase();
       const highlighter = registry.getByExtension(ext);
@@ -8741,7 +8819,9 @@ var CliServicesCommandProcessor = class {
     this.metadata = {
       sealed: true,
       icon: "\u2699",
-      module: "system"
+      module: "system",
+      // Enforced only when an auth module is loaded
+      requiredPermissions: ["system:services"]
     };
     this.processors = [
       // ── list ──────────────────────────────────────────────
@@ -9113,7 +9193,7 @@ var CliPsCommandProcessor = class {
   async processCommand(_command, context2) {
     let registry;
     try {
-      registry = context2.services.get(
+      registry = context2.services.getRequired(
         CliProcessRegistry_TOKEN
       );
     } catch {
@@ -9152,7 +9232,7 @@ var CliKillCommandProcessor = class {
   async processCommand(command2, context2) {
     let registry;
     try {
-      registry = context2.services.get(
+      registry = context2.services.getRequired(
         CliProcessRegistry_TOKEN
       );
     } catch {
@@ -9267,11 +9347,10 @@ var CliHtopCommandProcessor = class {
     this.errorTimeout = null;
   }
   async processCommand(_command, context2) {
-    try {
-      this.registry = context2.services.get(
-        CliProcessRegistry_TOKEN
-      );
-    } catch {
+    this.registry = context2.services.get(
+      CliProcessRegistry_TOKEN
+    ) ?? null;
+    if (!this.registry) {
       context2.writer.writeError("Process registry not available");
       return;
     }
@@ -10411,7 +10490,7 @@ var CliPingCommandProcessor = class {
     context2.writer.writeln(
       `PING ${host} (${url}):`
     );
-    context2.setStatusText(`ping ${host}`);
+    context2.notifier.info(`ping ${host}`);
     const times = [];
     let transmitted = 0;
     let received = 0;
@@ -10426,18 +10505,17 @@ var CliPingCommandProcessor = class {
         transmitted++;
         const start = performance.now();
         try {
-          const response = await fetch(url, {
+          const response = await context2.http.fetch(url, {
             method: "HEAD",
             mode: "no-cors",
-            cache: "no-store",
-            signal: context2.signal
+            cache: "no-store"
           });
           const elapsed = performance.now() - start;
           const ms = elapsed.toFixed(1);
           received++;
           times.push(elapsed);
           const status = response.type === "opaque" ? "ok" : `status=${response.status}`;
-          context2.setStatusText(`ping ${host}: seq=${seq} time=${ms}ms`);
+          context2.notifier.info(`ping ${host}: seq=${seq} time=${ms}ms`);
           context2.writer.writeln(
             `${url}: seq=${seq} ${status} time=${ms} ms`
           );
@@ -10571,7 +10649,7 @@ var CliExportCommandProcessor = class {
     this.metadata = { icon: "\u{1F4E6}", module: "system" };
   }
   async processCommand(command2, context2) {
-    const env = context2.services.get(
+    const env = context2.services.getRequired(
       ICliEnvironment_TOKEN
     );
     const raw = (command2.value || "").trim();
@@ -10625,7 +10703,7 @@ var CliUnsetCommandProcessor = class {
     this.metadata = { icon: "\u{1F5D1}\uFE0F", module: "system" };
   }
   async processCommand(command2, context2) {
-    const env = context2.services.get(
+    const env = context2.services.getRequired(
       ICliEnvironment_TOKEN
     );
     const varName = (command2.value || "").trim();
@@ -10659,7 +10737,7 @@ var CliEnvCommandProcessor = class {
     this.metadata = { icon: "\u{1F30D}", module: "system" };
   }
   async processCommand(command2, context2) {
-    const env = context2.services.get(
+    const env = context2.services.getRequired(
       ICliEnvironment_TOKEN
     );
     const varName = (command2.value || "").trim();
@@ -10907,16 +10985,9 @@ var CliCommandExecutionContext = class {
     this.createInterval = (cb, ms) => context2.createInterval(cb, ms);
     this.createTimeout = (cb, ms) => context2.createTimeout(cb, ms);
     this.backgroundServices = context2.backgroundServices;
-    this.state = context2.services.get(CliStateStoreManager_TOKEN).getProcessorStateStore(processor);
-  }
-  setStatusText(text) {
-    this.context.setStatusText(text);
-  }
-  clearStatusText() {
-    this.context.clearStatusText();
-  }
-  getStatusText() {
-    return this.context.getStatusText();
+    this.http = context2.http;
+    this.notifier = context2.notifier;
+    this.state = context2.services.getRequired(CliStateStoreManager_TOKEN).getProcessorStateStore(processor);
   }
   get promptLength() {
     return this.context.promptLength;
@@ -11466,6 +11537,175 @@ var CliBackgroundServiceRegistry = class {
     }
   }
 };
+var CliHttpClient = class {
+  constructor(signal) {
+    this.signal = signal;
+  }
+  async fetch(url, init) {
+    return fetch(url, {
+      ...init,
+      signal: this.mergeSignal(init?.signal)
+    });
+  }
+  async get(url, options) {
+    return this.jsonRequest("GET", url, void 0, options);
+  }
+  async post(url, body, options) {
+    return this.jsonRequest("POST", url, body, options);
+  }
+  async put(url, body, options) {
+    return this.jsonRequest("PUT", url, body, options);
+  }
+  async patch(url, body, options) {
+    return this.jsonRequest("PATCH", url, body, options);
+  }
+  async delete(url, options) {
+    return this.jsonRequest("DELETE", url, void 0, options);
+  }
+  async head(url, options) {
+    const { timeout, signal: callerSignal, ...fetchOptions } = options ?? {};
+    let timeoutController;
+    let timeoutId;
+    if (timeout) {
+      timeoutController = new AbortController();
+      timeoutId = setTimeout(() => timeoutController.abort(), timeout);
+    }
+    try {
+      return await fetch(url, {
+        ...fetchOptions,
+        method: "HEAD",
+        signal: this.mergeSignal(callerSignal, timeoutController?.signal)
+      });
+    } finally {
+      if (timeoutId !== void 0) clearTimeout(timeoutId);
+    }
+  }
+  async options(url, options) {
+    return this.jsonRequest("OPTIONS", url, void 0, options);
+  }
+  // ── Internals ────────────────────────────────────────────────────
+  async jsonRequest(method, url, body, options) {
+    const { timeout, ...fetchOptions } = options ?? {};
+    const headers = new Headers(fetchOptions.headers);
+    let resolvedBody;
+    if (body !== void 0 && body !== null) {
+      if (this.isRawBody(body)) {
+        resolvedBody = body;
+      } else {
+        resolvedBody = JSON.stringify(body);
+        if (!headers.has("Content-Type")) {
+          headers.set("Content-Type", "application/json");
+        }
+      }
+    }
+    let timeoutId;
+    let timeoutController;
+    if (timeout) {
+      timeoutController = new AbortController();
+      timeoutId = setTimeout(() => timeoutController.abort(), timeout);
+    }
+    const signal = this.mergeSignal(
+      fetchOptions.signal,
+      timeoutController?.signal
+    );
+    try {
+      const response = await fetch(url, {
+        ...fetchOptions,
+        method,
+        headers,
+        body: resolvedBody,
+        signal
+      });
+      if (!response.ok) {
+        let errorMessage = `${response.status} ${response.statusText}`;
+        let errorBody;
+        try {
+          errorBody = await response.json();
+          const parsed = errorBody;
+          if (parsed.error) {
+            errorMessage = parsed.error;
+          } else if (parsed.message) {
+            errorMessage = parsed.message;
+          }
+        } catch {
+        }
+        throw new cliCore.CliHttpError(
+          errorMessage,
+          response.status,
+          response.statusText,
+          errorBody
+        );
+      }
+      const text = await response.text();
+      if (!text) {
+        return void 0;
+      }
+      return JSON.parse(text);
+    } finally {
+      if (timeoutId !== void 0) {
+        clearTimeout(timeoutId);
+      }
+    }
+  }
+  isRawBody(body) {
+    return typeof body === "string" || body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer || body instanceof URLSearchParams || body instanceof ReadableStream;
+  }
+  /**
+   * Merge the command signal with any additional signals (caller, timeout).
+   * Uses AbortSignal.any() when available, falls back to a manual composite
+   * controller for older browsers (pre-Chrome 116 / Safari 17.4).
+   */
+  mergeSignal(...additional) {
+    const signals = [];
+    if (this.signal) signals.push(this.signal);
+    for (const s of additional) {
+      if (s) signals.push(s);
+    }
+    if (signals.length === 0) return void 0;
+    if (signals.length === 1) return signals[0];
+    if (typeof AbortSignal.any === "function") {
+      return AbortSignal.any(signals);
+    }
+    const controller = new AbortController();
+    for (const s of signals) {
+      if (s.aborted) {
+        controller.abort(s.reason);
+        return controller.signal;
+      }
+      s.addEventListener("abort", () => controller.abort(s.reason), { once: true });
+    }
+    return controller.signal;
+  }
+};
+var CliNotifier = class {
+  constructor() {
+    this._change$ = new rxjs.Subject();
+    this.change$ = this._change$.asObservable();
+  }
+  get current() {
+    return this._current;
+  }
+  info(message) {
+    this.set("info", message);
+  }
+  success(message) {
+    this.set("success", message);
+  }
+  warn(message) {
+    this.set("warn", message);
+  }
+  error(message) {
+    this.set("error", message);
+  }
+  clear() {
+    this._current = void 0;
+    this._change$.next(void 0);
+  }
+  set(level, message) {
+    this._current = { level, message, timestamp: Date.now() };
+    this._change$.next(this._current);
+  }
+};
 
 // src/lib/context/cli-fullscreen-manager.ts
 var CliFullScreenManager = class {
@@ -14427,7 +14667,7 @@ var CliTerminalLineRenderer = class {
    */
   getPromptString(options) {
     const name = options.userName ?? "";
-    let promptStart = options.hideUserName || !name ? "" : `\x1B[32m${name}\x1B[0m:`;
+    let promptStart = options.hideUserName ? "" : name ? `\x1B[32m${name}\x1B[0m:` : options.anonymousName ? `\x1B[90m${options.anonymousName}\x1B[0m:` : "";
     if (options.contextProcessor) {
       promptStart = `${options.contextProcessor}`;
     }
@@ -14489,7 +14729,6 @@ var CliExecutionContext = class {
      * Set by the command executor at start/end of executeCommand().
      */
     this.isExecuting = false;
-    this.statusTextChange$ = new rxjs.Subject();
     this.lineBuffer = new CliLineBuffer();
     this.modeStack = [];
     this.timerManager = new CliTimerManager();
@@ -14534,6 +14773,8 @@ var CliExecutionContext = class {
     this.logger.setCliLogLevel(cliOptions?.logLevel || cliCore.CliLogLevel.ERROR);
     this.commandHistory = deps.commandHistory;
     this.lineRenderer = new CliTerminalLineRenderer(terminal, this.writer);
+    this.http = new CliHttpClient();
+    this.notifier = new CliNotifier();
     this.backgroundServices = new CliBackgroundServiceRegistry(
       this.state,
       deps.services,
@@ -14544,17 +14785,6 @@ var CliExecutionContext = class {
       this.backgroundServices
     );
   }
-  setStatusText(text) {
-    this._statusText = text;
-    this.statusTextChange$.next(text);
-  }
-  clearStatusText() {
-    this._statusText = void 0;
-    this.statusTextChange$.next(void 0);
-  }
-  getStatusText() {
-    return this._statusText;
-  }
   // -- Public API (ICliExecutionContext) --
   writeToTerminal(text) {
     this.terminal.write(text);
@@ -14748,15 +14978,13 @@ var CliExecutionContext = class {
   }
   // -- CommandLineModeHost interface --
   getPromptOptions() {
-    let hideUserName = false;
-    try {
-      const config = this.services.get("cli-users-module-config");
-      hideUserName = config?.hideUserName ?? false;
-    } catch {
-    }
+    const usersConfig = this.services.get("cli-users-module-config");
+    const hideUserName = usersConfig?.hideUserName ?? false;
+    const anonymousName = usersConfig && !this.userSession ? (usersConfig.anonymousName ?? "anonymous") || void 0 : void 0;
     return {
       userName: this.userSession?.displayName,
       hideUserName,
+      anonymousName,
       contextProcessor: this.contextProcessor?.command,
       pathProvider: this.promptPathProvider
     };
@@ -15001,10 +15229,8 @@ var contextGlobalParameter = {
 // src/lib/executor/cli-io-redirect-handler.ts
 var FS_TOKEN2 = "cli-file-system-service";
 async function writeOutputToFile(filePath, context2) {
-  let fs;
-  try {
-    fs = context2.services.get(FS_TOKEN2);
-  } catch {
+  const fs = context2.services.get(FS_TOKEN2);
+  if (!fs) {
     context2.writer.writeError(
       "> redirect requires @qodalis/cli-files plugin"
     );
@@ -15028,10 +15254,8 @@ async function writeOutputToFile(filePath, context2) {
   }
 }
 async function appendOutputToFile(filePath, context2) {
-  let fs;
-  try {
-    fs = context2.services.get(FS_TOKEN2);
-  } catch {
+  const fs = context2.services.get(FS_TOKEN2);
+  if (!fs) {
     context2.writer.writeError(
       ">> redirect requires @qodalis/cli-files plugin"
     );
@@ -15057,10 +15281,8 @@ async function appendOutputToFile(filePath, context2) {
 async function writeStderrToFile(filePath, context2, capturingWriter) {
   const stderr = capturingWriter?.getCapturedStderr();
   if (!stderr) return;
-  let fs;
-  try {
-    fs = context2.services.get(FS_TOKEN2);
-  } catch {
+  const fs = context2.services.get(FS_TOKEN2);
+  if (!fs) {
     context2.writer.writeError(
       "2> redirect requires @qodalis/cli-files plugin"
     );
@@ -15081,10 +15303,8 @@ async function writeStderrToFile(filePath, context2, capturingWriter) {
 async function appendStderrToFile(filePath, context2, capturingWriter) {
   const stderr = capturingWriter?.getCapturedStderr();
   if (!stderr) return;
-  let fs;
-  try {
-    fs = context2.services.get(FS_TOKEN2);
-  } catch {
+  const fs = context2.services.get(FS_TOKEN2);
+  if (!fs) {
     context2.writer.writeError(
       "2>> redirect requires @qodalis/cli-files plugin"
     );
@@ -15104,10 +15324,8 @@ async function appendStderrToFile(filePath, context2, capturingWriter) {
 }
 async function tryExecuteScript(filePath, context2, executeCommand) {
   const FS_TOKEN3 = "cli-file-system-service";
-  let fs;
-  try {
-    fs = context2.services.get(FS_TOKEN3);
-  } catch {
+  const fs = context2.services.get(FS_TOKEN3);
+  if (!fs) {
     return false;
   }
   const resolved = fs.resolvePath(filePath);
@@ -15184,10 +15402,8 @@ function substituteVars(input, variables) {
   return result;
 }
 function expandEnvironmentVars(command2, context2) {
-  let env;
-  try {
-    env = context2.services.get(ICliEnvironment_TOKEN);
-  } catch {
+  const env = context2.services.get(ICliEnvironment_TOKEN);
+  if (!env) {
     return command2;
   }
   const parts = command2.split("'");
@@ -15332,7 +15548,7 @@ var CliCommandExecutor = class {
       }
     } finally {
       rootContext.isExecuting = false;
-      rootContext.clearStatusText?.();
+      rootContext.notifier?.clear();
     }
   }
   async executeSingleCommand(command2, data, context2) {
@@ -15340,8 +15556,8 @@ var CliCommandExecutor = class {
     command2 = expandEnvironmentVars(command2, context2);
     const assignMatch = command2.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
     if (assignMatch) {
-      try {
-        const env = context2.services.get(ICliEnvironment_TOKEN);
+      const env = context2.services.get(ICliEnvironment_TOKEN);
+      if (env) {
         let val = assignMatch[2];
         if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
           val = val.slice(1, -1);
@@ -15350,15 +15566,13 @@ var CliCommandExecutor = class {
         process.start();
         process.end();
         return;
-      } catch {
       }
     }
     process.start();
     let processEntry;
-    try {
-      const procRegistry = context2.services.get(CliProcessRegistry_TOKEN);
+    const procRegistry = context2.services.get(CliProcessRegistry_TOKEN);
+    if (procRegistry) {
       processEntry = procRegistry.register(command2);
-    } catch {
     }
     const parsed = this.commandParser.parse(command2);
     let { commandName } = parsed;
@@ -15381,7 +15595,7 @@ var CliCommandExecutor = class {
     }
     if (!processor) {
       const aliasProcessor = this.registry.findProcessor("alias", []);
-      const aliases = aliasProcessor?.userAliases ?? {};
+      const aliases = aliasProcessor?.aliasesFor?.(context2) ?? aliasProcessor?.userAliases ?? {};
       if (aliases[mainCommand]) {
         this.completeProcess(processEntry, context2, 0);
         return await this.executeSingleCommand(
@@ -15438,13 +15652,21 @@ var CliCommandExecutor = class {
     }
     const value = processor.acceptsRawInput || processor.valueRequired ? cliCore.getRightOfWord(commandName, processor.command) : void 0;
     commandToProcess.value = value;
+    const blockedBy = await this.runGuards(commandToProcess, processor, context2);
+    if (blockedBy) {
+      context2.writer.writeError(blockedBy);
+      this.failProcess(processEntry, context2);
+      context2.process.exit(-1, { silent: true });
+      return;
+    }
     const hasPositionalInput = !!value || !!data;
     const hasNamedArgs = Object.keys(args).length > 0;
     if (processor.valueRequired && !hasPositionalInput && !hasNamedArgs) {
       context2.writer.writeError(
         `Value required: ${context2.writer.wrapInColor(`${commandName} <value>`, cliCore.CliForegroundColor.Cyan)}`
       );
-      context2.process.exit(-1);
+      this.failProcess(processEntry, context2);
+      context2.process.exit(-1, { silent: true });
       return;
     }
     if (!this.validateBeforeExecution(context2, processor, args, hasPositionalInput)) {
@@ -15460,7 +15682,8 @@ var CliCommandExecutor = class {
         context2.writer.writeError(
           validationResult?.message || "An error occurred while validating the command."
         );
-        context2.process.exit(-1);
+        this.failProcess(processEntry, context2);
+        context2.process.exit(-1, { silent: true });
         return;
       }
     }
@@ -15471,6 +15694,7 @@ var CliCommandExecutor = class {
     );
     const commandAbortController = new AbortController();
     commandContext.signal = commandAbortController.signal;
+    commandContext.http = new CliHttpClient(commandAbortController.signal);
     const abortSub = context2.onAbort.subscribe(() => {
       commandAbortController.abort();
     });
@@ -15523,6 +15747,10 @@ var CliCommandExecutor = class {
             "Process exited successfully with code 0"
           );
         }
+      } else if (cliCore.isCliAccessDeniedError(e)) {
+        this.failProcess(processEntry, context2);
+        context2.writer.writeError(e.message);
+        context2.process.exit(-1);
       } else {
         this.failProcess(processEntry, context2);
         context2.writer.writeError(`Error executing command: ${e}`);
@@ -15535,19 +15763,13 @@ var CliCommandExecutor = class {
   }
   completeProcess(processEntry, context2, exitCode) {
     if (!processEntry) return;
-    try {
-      const procRegistry = context2.services.get(CliProcessRegistry_TOKEN);
-      procRegistry.complete(processEntry.pid, exitCode);
-    } catch {
-    }
+    const procRegistry = context2.services.get(CliProcessRegistry_TOKEN);
+    procRegistry?.complete(processEntry.pid, exitCode);
   }
   failProcess(processEntry, context2) {
     if (!processEntry) return;
-    try {
-      const procRegistry = context2.services.get(CliProcessRegistry_TOKEN);
-      procRegistry.fail(processEntry.pid);
-    } catch {
-    }
+    const failRegistry = context2.services.get(CliProcessRegistry_TOKEN);
+    failRegistry?.fail(processEntry.pid);
   }
   async showHelp(command2, context2) {
     try {
@@ -15613,6 +15835,52 @@ var CliCommandExecutor = class {
    * parameter.  In that case the global handler must be skipped so the
    * processor can handle the flag itself.
    */
+  /**
+   * Runs all registered {@link ICliCommandGuard}s that apply to this command,
+   * in priority order. Returns the block message of the first guard that
+   * denies the command, or `undefined` when every guard allows it.
+   * A guard that throws is treated as a denial (fail closed).
+   */
+  async runGuards(command2, processor, context2) {
+    let guards;
+    try {
+      guards = context2.services.getAll(cliCore.ICliCommandGuard_TOKEN);
+    } catch {
+      return void 0;
+    }
+    if (!guards.length) {
+      return void 0;
+    }
+    const ordered = [...guards].sort(
+      (a, b) => (a.priority ?? 0) - (b.priority ?? 0)
+    );
+    for (const guard of ordered) {
+      let result;
+      try {
+        if (guard.appliesTo && !await guard.appliesTo(processor, command2, context2)) {
+          continue;
+        }
+        result = await guard.canActivate(command2, processor, context2);
+      } catch (e) {
+        return `${processor.command}: blocked by guard '${guard.name}' (${e?.message ?? e})`;
+      }
+      const denial = this.guardDenial(result, processor.command);
+      if (denial) {
+        return denial;
+      }
+    }
+    return void 0;
+  }
+  guardDenial(result, commandName) {
+    const denied = `${commandName}: permission denied`;
+    if (result === void 0 || result === true) return void 0;
+    if (result === false) return denied;
+    if (typeof result === "string") return result || denied;
+    if (typeof result === "object" && result !== null) {
+      return result.allowed ? void 0 : result.message || denied;
+    }
+    return void 0;
+  }
   processorOwnsParameter(processor, globalParam) {
     const globalNames = /* @__PURE__ */ new Set([
       globalParam.name,
@@ -15629,29 +15897,94 @@ var CliCommandExecutor = class {
 // src/lib/services/cli-service-container.ts
 var CliServiceContainer = class {
   constructor() {
-    /** Stores single-value providers (resolved or pending). */
+    /** Stores single-value providers (resolved singletons). */
     this.services = /* @__PURE__ */ new Map();
     /** Stores multi-provider arrays. */
     this.multiServices = /* @__PURE__ */ new Map();
+    /** Tokens that cannot be overwritten by subsequent `set()` calls. */
+    this.sealedTokens = /* @__PURE__ */ new Set();
+    /** Stores provider recipes for transient tokens (re-resolved on every get). */
+    this.transientRecipes = /* @__PURE__ */ new Map();
   }
   /**
    * Retrieve a service by its token.
+   * Returns `undefined` when no provider is registered for the token.
+   * For multi-provider tokens, returns the last registered value (use `getAll` for the full array).
    *
    * @param token The token used to register the service.
-   * @returns The resolved service instance (or array for multi providers).
-   * @throws Error if the token has not been registered.
+   * @returns The resolved service instance, or `undefined` if not registered.
    */
   get(token) {
+    if (this.transientRecipes.has(token)) {
+      return this.resolveProvider(this.transientRecipes.get(token));
+    }
     if (this.multiServices.has(token)) {
-      return this.multiServices.get(token);
+      const arr = this.multiServices.get(token);
+      return arr[arr.length - 1];
     }
     if (this.services.has(token)) {
       return this.services.get(token);
     }
-    const tokenName = typeof token === "string" ? token : typeof token === "function" ? token.name : String(token);
-    throw new Error(
-      `CliServiceContainer: No provider found for token "${tokenName}".`
-    );
+    return void 0;
+  }
+  /**
+   * Retrieve all registered services for a multi-provider token.
+   * Returns an empty array when no provider is registered for the token.
+   *
+   * @param token The token used to register the service.
+   * @returns Array of all resolved service instances.
+   */
+  getAll(token) {
+    if (this.multiServices.has(token)) {
+      return this.multiServices.get(token);
+    }
+    const single = this.get(token);
+    return single !== void 0 ? [single] : [];
+  }
+  /**
+   * Retrieve a service by its token, throwing if not registered.
+   * Use this when the service is required and its absence is a programming error.
+   * For multi-provider tokens, returns the last registered value (use `getAll` for the full array).
+   *
+   * @param token The token used to register the service.
+   * @returns The resolved service instance.
+   * @throws Error if the token has not been registered.
+   */
+  getRequired(token) {
+    const value = this.get(token);
+    if (value === void 0 && !this.has(token)) {
+      throw new Error(
+        `CliServiceContainer: No provider found for token "${this.tokenToString(token)}".`
+      );
+    }
+    return value;
+  }
+  /**
+   * Check whether a service is registered for the given token.
+   */
+  has(token) {
+    return this.services.has(token) || this.multiServices.has(token) || this.transientRecipes.has(token);
+  }
+  /**
+   * Mark a token as sealed so it cannot be overwritten by future `set()` calls.
+   * Only available on the concrete container — not exposed on `ICliServiceProvider`.
+   */
+  seal(token) {
+    this.sealedTokens.add(token);
+  }
+  /**
+   * Mark multiple tokens as sealed at once.
+   */
+  sealAll(tokens) {
+    for (const token of tokens) {
+      this.sealedTokens.add(token);
+    }
+  }
+  /**
+   * Check whether a token is sealed.
+   */
+  isSealed(token) {
+    return this.sealedTokens.has(token);
   }
   /**
    * Register one or more providers.
@@ -15673,13 +16006,13 @@ var CliServiceContainer = class {
   getRegisteredTokens() {
     const tokens = [];
     for (const key of this.services.keys()) {
-      tokens.push(
-        typeof key === "string" ? key : typeof key === "function" ? key.name : String(key)
-      );
+      tokens.push(this.tokenToString(key));
+    }
+    for (const key of this.transientRecipes.keys()) {
+      tokens.push(`${this.tokenToString(key)} (transient)`);
     }
     for (const key of this.multiServices.keys()) {
-      const name = typeof key === "string" ? key : typeof key === "function" ? key.name : String(key);
-      tokens.push(`${name} (multi)`);
+      tokens.push(`${this.tokenToString(key)} (multi)`);
     }
     return tokens;
   }
@@ -15690,20 +16023,34 @@ var CliServiceContainer = class {
     const details = [];
     for (const [key, value] of this.services.entries()) {
       details.push({
-        token: typeof key === "string" ? key : typeof key === "function" ? key.name : String(key),
+        token: this.tokenToString(key),
         type: this.describeValue(value),
         multi: false
       });
     }
+    for (const [key, provider] of this.transientRecipes.entries()) {
+      const className = provider["useClass"]?.name ?? provider["useFactory"]?.name ?? "transient";
+      details.push({
+        token: this.tokenToString(key),
+        type: `transient(${className})`,
+        multi: false
+      });
+    }
     for (const [key, values] of this.multiServices.entries()) {
       details.push({
-        token: typeof key === "string" ? key : typeof key === "function" ? key.name : String(key),
+        token: this.tokenToString(key),
         type: `[${values.map((v) => this.describeValue(v)).join(", ")}]`,
         multi: true
       });
     }
     return details;
   }
+  /**
+   * Convert a token to a human-readable string for diagnostics/errors.
+   */
+  tokenToString(token) {
+    return typeof token === "string" ? token : typeof token === "function" ? token.name : String(token);
+  }
   /**
    * Describe a resolved value for diagnostic display.
    */
@@ -15723,27 +16070,45 @@ var CliServiceContainer = class {
    * Register a single provider.
    */
   registerProvider(provider) {
-    const value = this.resolveProvider(provider);
-    if (provider.multi) {
-      const existing = this.multiServices.get(provider.provide) ?? [];
-      existing.push(value);
-      this.multiServices.set(provider.provide, existing);
+    if (!provider.multi && this.sealedTokens.has(provider.provide)) {
+      throw new Error(
+        `CliServiceContainer: Cannot override sealed service "${this.tokenToString(provider.provide)}".`
+      );
+    }
+    if (provider["transient"] && !provider.multi) {
+      this.transientRecipes.set(provider.provide, provider);
+      this.services.delete(provider.provide);
     } else {
-      this.services.set(provider.provide, value);
+      const value = this.resolveProvider(provider);
+      if (provider.multi) {
+        const existing = this.multiServices.get(provider.provide) ?? [];
+        existing.push(value);
+        this.multiServices.set(provider.provide, existing);
+      } else {
+        this.services.set(provider.provide, value);
+        this.transientRecipes.delete(provider.provide);
+      }
+    }
+    if (provider.sealed) {
+      this.sealedTokens.add(provider.provide);
     }
   }
   /**
    * Resolve a provider definition to a concrete value.
+   *
+   * Note: `deps` are resolved eagerly at registration time, so
+   * dependency tokens must be registered before the provider that needs them.
    */
   resolveProvider(provider) {
     if ("useValue" in provider) {
       return provider.useValue;
     }
+    const deps = (provider["deps"] ?? []).map((dep) => this.getRequired(dep));
     if ("useFactory" in provider) {
-      return provider.useFactory();
+      return provider.useFactory(...deps);
     }
     if ("useClass" in provider) {
-      return new provider.useClass();
+      return new provider.useClass(...deps);
     }
     throw new Error(
       "CliServiceContainer: Provider must specify useValue, useFactory, or useClass."
@@ -15884,10 +16249,10 @@ var welcomeModule = {
   async onAfterBoot(context2) {
     const config = this.config || {};
     let showOption = config.show;
-    try {
-      const storeManager = context2.services.get(
-        CliStateStoreManager_TOKEN
-      );
+    const storeManager = context2.services.get(
+      CliStateStoreManager_TOKEN
+    );
+    if (storeManager) {
       const configureStore = storeManager.getStateStore(
         cliCore.CLI_CONFIGURE_STORE_NAME
       );
@@ -15896,7 +16261,6 @@ var welcomeModule = {
       if (state?.["system"]?.["welcomeMessage"]) {
         showOption = state["system"]["welcomeMessage"];
       }
-    } catch {
     }
     if (showOption) {
       if (!shouldDisplayWelcomeMessage(showOption)) {
@@ -15924,11 +16288,11 @@ var welcomeModule = {
     recordWelcomeMessageDisplay();
     context2.showPrompt();
     let showGreeting = true;
-    try {
-      const storeManager = context2.services.get(
-        CliStateStoreManager_TOKEN
-      );
-      const configureStore = storeManager.getStateStore(
+    const greetingStoreManager = context2.services.get(
+      CliStateStoreManager_TOKEN
+    );
+    if (greetingStoreManager) {
+      const configureStore = greetingStoreManager.getStateStore(
         cliCore.CLI_CONFIGURE_STORE_NAME
       );
       await configureStore.initialize();
@@ -15936,7 +16300,6 @@ var welcomeModule = {
       if (configState?.["system"]?.["greeting"] === false) {
         showGreeting = false;
       }
-    } catch {
     }
     if (showGreeting) {
       await context2.textAnimator?.showText(getGreetingBasedOnTime(), {
@@ -16040,6 +16403,18 @@ var CliBoot = class {
     if (module.services && module.services.length > 0) {
       this.services.set(module.services);
     }
+    if (module.guards && module.guards.length > 0) {
+      this.services.set(
+        module.guards.map((guard) => ({
+          provide: cliCore.ICliCommandGuard_TOKEN,
+          useValue: guard,
+          multi: true
+        }))
+      );
+    }
+    if (module.permissions && module.permissions.length > 0) {
+      this.services.get(cliCore.ICliPermissionRegistry_TOKEN)?.register(module.permissions, module.name);
+    }
     if (module.translations) {
       for (const [locale, translations] of Object.entries(module.translations)) {
         context2.translator.addTranslations(locale, translations);
@@ -16056,8 +16431,8 @@ var CliBoot = class {
       }
     }
     if (module.onSetup) {
-      const kvStore = context2.services.get(
-        "cli-key-value-store"
+      const kvStore = context2.services.getRequired(
+        CliKeyValueStore_TOKEN
       );
       const setupKey = `cli-module-setup:${module.name}`;
       const setupState = await kvStore.get(setupKey);
@@ -16087,19 +16462,47 @@ var CliBoot = class {
         this.registry.registerProcessor(processor);
       }
       await this.initializeProcessorsInternal(context2, filtered);
+      this.adoptMergedSubProcessors(filtered);
     }
     this.bootedModules.add(module.name);
     if (!this.moduleRegistry.has(module.name)) {
       this.moduleRegistry.track(module);
     }
   }
+  /**
+   * Sub-processors of an `extendsProcessor` processor are merged into the
+   * processor it extends, so they belong to that one: re-parent them so they
+   * inherit its access rules (`requiredPermissions` etc.) and help/root
+   * lookups resolve to the registered processor.
+   */
+  adoptMergedSubProcessors(processors) {
+    for (const processor of processors) {
+      if (!processor.extendsProcessor) continue;
+      const name = processor.command.toLowerCase();
+      const host = this.registry.processors.find(
+        (p) => p.command.toLowerCase() === name
+      );
+      if (!host || host === processor) continue;
+      for (const sub of processor.processors ?? []) {
+        if (host.processors?.includes(sub)) {
+          sub.parent = host;
+        }
+      }
+    }
+  }
   buildCoreModule() {
     return {
       apiVersion: API_VERSION,
       name: "@qodalis/cli-core",
       version: cliCore.LIBRARY_VERSION,
       description: "Core CLI services and utilities",
-      processors: [...builtinProcessors]
+      processors: [...builtinProcessors],
+      permissions: [
+        { name: "system:packages", description: "Install, update and remove packages (pkg)" },
+        { name: "system:services", description: "Start and stop background services" },
+        { name: "system:eval", description: "Evaluate JavaScript (eval, also requires allowEval)" },
+        { name: "shell:execute", description: "Open a remote shell on a server (ssh)" }
+      ]
     };
   }
   /**
@@ -16231,6 +16634,29 @@ var CliDragDropService = class {
   }
 };
 
+// src/lib/services/cli-permission-registry.ts
+var CliPermissionRegistry = class {
+  constructor() {
+    this.definitions = /* @__PURE__ */ new Map();
+  }
+  register(definitions, module) {
+    for (const def of definitions ?? []) {
+      const name = def?.name?.trim();
+      if (!name) continue;
+      const key = name.toLowerCase();
+      if (!this.definitions.has(key)) {
+        this.definitions.set(key, { ...def, name, module: def.module ?? module });
+      }
+    }
+  }
+  list() {
+    return [...this.definitions.values()].sort((a, b) => a.name.localeCompare(b.name));
+  }
+  get(name) {
+    return this.definitions.get(name.trim().toLowerCase());
+  }
+};
+
 // src/lib/addons/overlay.ts
 var OverlayAddon = class {
   constructor() {
@@ -16437,16 +16863,19 @@ var CliStateStore = class {
     this.state$.next(this.initialState);
   }
   async persist() {
-    const keyValueStore = this.services.get(
-      "cli-key-value-store"
+    const keyValueStore = this.services.getRequired(
+      CliKeyValueStore_TOKEN
     );
     await keyValueStore.set(this.storageKey, this.getState());
   }
   async initialize() {
+    const keyValueStore = this.services.get(
+      CliKeyValueStore_TOKEN
+    );
+    if (!keyValueStore) {
+      return;
+    }
     try {
-      const keyValueStore = this.services.get(
-        "cli-key-value-store"
-      );
       const state = await keyValueStore.get(this.storageKey);
       if (state) {
         this.state$.next(state);
@@ -16513,6 +16942,39 @@ var CliStateStoreManager = class {
     this.stores.clear();
   }
 };
+var CliServerAuthService = class {
+  constructor(services) {
+    this.services = services;
+  }
+  getHeaders(serverName, configHeaders) {
+    const merged = {
+      ...cliCore.resolveHeaders(configHeaders)
+    };
+    const providers = this.services.getAll(
+      cliCore.ICliServerAuthTokenProvider_TOKEN
+    );
+    for (const provider of providers) {
+      Object.assign(merged, provider.getHeaders(serverName));
+    }
+    return merged;
+  }
+  async getWebSocketParams(serverName) {
+    const providers = this.services.getAll(
+      cliCore.ICliServerAuthTokenProvider_TOKEN
+    );
+    let handled = false;
+    const merged = {};
+    for (const provider of providers) {
+      if (!provider.getWebSocketParams) continue;
+      const params = await provider.getWebSocketParams(serverName);
+      if (params) {
+        handled = true;
+        Object.assign(merged, params);
+      }
+    }
+    return handled ? merged : void 0;
+  }
+};
 
 // src/lib/completion/cli-command-completion-provider.ts
 var CliCommandCompletionProvider = class {
@@ -16660,12 +17122,10 @@ var CliPackageNameCompletionProvider = class {
     if (!INSTALLED_PKG_SUBCOMMANDS.has(subCommand)) {
       return [];
     }
-    let manager;
-    try {
-      manager = this.services.get(
-        CliPackageManagerService_TOKEN
-      );
-    } catch {
+    const manager = this.services.get(
+      CliPackageManagerService_TOKEN
+    );
+    if (!manager) {
       return [];
     }
     const packages = await manager.getPackages();
@@ -16868,7 +17328,7 @@ var ServerListProcessor = class {
     this.description = "Show configured servers and their connection status";
   }
   async processCommand(_command, context2) {
-    const manager = context2.services.get(
+    const manager = context2.services.getRequired(
       CliServerManager_TOKEN
     );
     if (!manager || manager.connections.size === 0) {
@@ -16907,7 +17367,7 @@ var ServerStatusProcessor = class {
       context2.process.exit(1);
       return;
     }
-    const manager = context2.services.get(
+    const manager = context2.services.getRequired(
       CliServerManager_TOKEN
     );
     const connection = manager?.getConnection(serverName);
@@ -16917,7 +17377,7 @@ var ServerStatusProcessor = class {
       return;
     }
     context2.spinner?.show(`Pinging ${serverName}...`);
-    context2.setStatusText(`Pinging ${serverName}`);
+    context2.notifier.info(`Pinging ${serverName}`);
     const reachable = await connection.ping();
     context2.spinner?.hide();
     if (reachable) {
@@ -16948,7 +17408,7 @@ var ServerReconnectProcessor = class {
       context2.process.exit(1);
       return;
     }
-    const manager = context2.services.get(
+    const manager = context2.services.getRequired(
       CliServerManager_TOKEN
     );
     if (!manager) {
@@ -16957,7 +17417,7 @@ var ServerReconnectProcessor = class {
       return;
     }
     context2.spinner?.show(`Reconnecting to ${serverName}...`);
-    context2.setStatusText(`Reconnecting to ${serverName}`);
+    context2.notifier.info(`Reconnecting to ${serverName}`);
     const result = await manager.reconnect(serverName);
     context2.spinner?.hide();
     if (result.success) {
@@ -16987,7 +17447,7 @@ var ServerDefaultProcessor = class {
     ];
   }
   async processCommand(command2, context2) {
-    const manager = context2.services.get(
+    const manager = context2.services.getRequired(
       CliServerManager_TOKEN
     );
     if (!manager) {
@@ -17023,8 +17483,6 @@ var ServerDefaultProcessor = class {
     }
   }
 };
-
-// src/lib/server/cli-ssh-command-processor.ts
 var CliSshCommandProcessor = class {
   constructor() {
     this.command = "ssh";
@@ -17033,7 +17491,9 @@ var CliSshCommandProcessor = class {
     this.valueRequired = false;
     this.metadata = {
       module: "@qodalis/cli-server",
-      icon: "\u{1F5A5}"
+      icon: "\u{1F5A5}",
+      // Enforced only when an auth module is loaded; the server checks it too
+      requiredPermissions: [cliCore.CliServerPermissions.ShellExecute]
     };
     this.parameters = [
       {
@@ -17043,12 +17503,9 @@ var CliSshCommandProcessor = class {
         type: "string"
       }
     ];
-    this.socket = null;
-    this.context = null;
-    this.resolved = false;
   }
   async processCommand(command2, context2) {
-    const manager = context2.services.get(
+    const manager = context2.services.getRequired(
       CliServerManager_TOKEN
     );
     if (!manager) {
@@ -17077,26 +17534,34 @@ var CliSshCommandProcessor = class {
       await this.executeInteractive(connection, serverName, context2);
     }
   }
-  async onData(data, context2) {
-    if (this.socket?.readyState === WebSocket.OPEN) {
-      const msg = { type: "stdin", data };
-      this.socket.send(JSON.stringify(msg));
-    }
-  }
-  onResize(cols, rows, _context) {
-    if (this.socket?.readyState === WebSocket.OPEN) {
-      const msg = { type: "resize", cols, rows };
-      this.socket.send(JSON.stringify(msg));
-    }
-  }
-  onDispose(_context) {
-    if (this.socket) {
-      if (this.socket.readyState === WebSocket.OPEN || this.socket.readyState === WebSocket.CONNECTING) {
-        this.socket.close();
+  /**
+   * Full-screen handler for one session: input, resize and disposal go to
+   * that session's socket only.
+   */
+  fullScreenHandler(session) {
+    const handler = Object.create(this);
+    handler.onData = async (data) => {
+      if (session.socket?.readyState === WebSocket.OPEN) {
+        const msg = { type: "stdin", data };
+        session.socket.send(JSON.stringify(msg));
       }
-      this.socket = null;
-    }
-    this.context = null;
+    };
+    handler.onResize = (cols, rows) => {
+      if (session.socket?.readyState === WebSocket.OPEN) {
+        const msg = { type: "resize", cols, rows };
+        session.socket.send(JSON.stringify(msg));
+      }
+    };
+    handler.onDispose = () => {
+      session.disposed = true;
+      if (session.socket) {
+        if (session.socket.readyState === WebSocket.OPEN || session.socket.readyState === WebSocket.CONNECTING) {
+          session.socket.close();
+        }
+        session.socket = null;
+      }
+    };
+    return handler;
   }
   async resolveServer(command2, shellServers, context2) {
     const empty = { serverName: null, oneShotCmd: null, connection: null };
@@ -17122,7 +17587,7 @@ var CliSshCommandProcessor = class {
       const candidateName = parts[0];
       const entry2 = shellServers.find((s) => s.name === candidateName);
       if (entry2) {
-        const oneShotCmd = parts.slice(1).join(" ") || null;
+        const oneShotCmd = this.remoteCommandFromRaw(command2.rawCommand, candidateName) ?? (parts.slice(1).join(" ") || null);
         return {
           serverName: candidateName,
           oneShotCmd,
@@ -17142,7 +17607,7 @@ var CliSshCommandProcessor = class {
         connection: shellServers[0].connection
       };
     }
-    const manager = context2.services.get(
+    const manager = context2.services.getRequired(
       CliServerManager_TOKEN
     );
     if (manager?.defaultServer) {
@@ -17176,41 +17641,57 @@ var CliSshCommandProcessor = class {
     };
   }
   async executeInteractive(connection, serverName, context2) {
-    this.context = context2;
+    const session = { socket: null, resolved: false, disposed: false };
     const cols = context2.terminal.cols;
     const rows = context2.terminal.rows;
-    const wsUrl = this.buildShellUrl(connection, cols, rows);
+    const wsUrl = await this.buildShellUrl(connection, cols, rows);
     context2.spinner?.show(`Connecting to ${serverName}...`);
-    this.resolved = false;
+    let fullScreen = false;
     return new Promise((resolve) => {
+      const signal = context2.signal;
       const resolveOnce = () => {
-        if (!this.resolved) {
-          this.resolved = true;
+        signal?.removeEventListener("abort", onAbort);
+        if (!session.resolved) {
+          session.resolved = true;
           resolve();
         }
       };
+      const onAbort = () => {
+        context2.spinner?.hide();
+        this.cleanup(session);
+        if (fullScreen) context2.exitFullScreenMode();
+        context2.process.exit(130, { silent: true });
+        resolveOnce();
+      };
+      if (signal?.aborted) {
+        onAbort();
+        return;
+      }
+      signal?.addEventListener("abort", onAbort, { once: true });
       try {
-        this.socket = new WebSocket(wsUrl);
+        session.socket = new WebSocket(wsUrl);
       } catch (e) {
         context2.spinner?.hide();
         context2.writer.writeError(
           `Failed to connect to '${serverName}': ${e.message}`
         );
-        context2.process.exit(1);
+        context2.process.exit(1, { silent: true });
         resolveOnce();
         return;
       }
-      this.socket.onopen = () => {
+      session.socket.onopen = () => {
       };
-      this.socket.onmessage = (event) => {
-        const msg = JSON.parse(event.data);
+      session.socket.onmessage = (event) => {
+        const msg = parseShellMessage(event.data);
+        if (!msg) return;
         switch (msg.type) {
           case "ready":
             context2.spinner?.hide();
             context2.writer.writeInfo(
               `Connected to ${serverName} (${msg.os}, ${msg.shell})`
             );
-            context2.enterFullScreenMode(this);
+            context2.enterFullScreenMode(this.fullScreenHandler(session));
+            fullScreen = true;
             context2.terminal.write("\x1B[2J\x1B[H\x1B[?25h");
             break;
           case "stdout":
@@ -17220,70 +17701,82 @@ var CliSshCommandProcessor = class {
             context2.terminal.write(msg.data);
             break;
           case "exit":
-            context2.exitFullScreenMode();
+            if (fullScreen) context2.exitFullScreenMode();
             context2.writer.writeInfo(
               `Shell exited with code ${msg.code}.`
             );
-            context2.process.exit(msg.code);
-            this.cleanup();
+            context2.process.exit(msg.code, { silent: true });
+            this.cleanup(session);
             resolveOnce();
             break;
           case "error":
             context2.spinner?.hide();
-            context2.exitFullScreenMode();
+            if (fullScreen) context2.exitFullScreenMode();
             context2.writer.writeError(
               `Server error: ${msg.message}`
             );
-            context2.process.exit(1);
-            this.cleanup();
+            context2.process.exit(1, { silent: true });
+            this.cleanup(session);
             resolveOnce();
             break;
         }
       };
-      this.socket.onclose = () => {
+      let errored = false;
+      session.socket.onclose = (event) => {
         context2.spinner?.hide();
-        if (this.context && !this.resolved) {
-          context2.exitFullScreenMode();
-          context2.writer.writeWarning(
-            `Connection to '${serverName}' closed.`
-          );
-          context2.process.exit(1);
+        if (!session.disposed && !session.resolved) {
+          if (fullScreen) context2.exitFullScreenMode();
+          const reason = describeShellClose(event ?? {}, serverName);
+          if (reason) context2.writer.writeError(reason);
+          else if (errored) context2.writer.writeError(`WebSocket error connecting to '${serverName}'.`);
+          else context2.writer.writeWarning(`Connection to '${serverName}' closed.`);
+          context2.process.exit(1, { silent: true });
         }
-        this.cleanup();
+        this.cleanup(session);
         resolveOnce();
       };
-      this.socket.onerror = () => {
-        context2.spinner?.hide();
-        if (!this.resolved) {
-          context2.writer.writeError(
-            `WebSocket error connecting to '${serverName}'.`
-          );
-          context2.process.exit(1);
-        }
-        this.cleanup();
-        resolveOnce();
+      session.socket.onerror = () => {
+        errored = true;
       };
     });
   }
   async executeOneShot(connection, serverName, cmd, context2) {
     const cols = context2.terminal.cols;
     const rows = context2.terminal.rows;
-    const wsUrl = this.buildShellUrl(connection, cols, rows, cmd);
+    const wsUrl = await this.buildShellUrl(connection, cols, rows, cmd);
     context2.spinner?.show(`Running on ${serverName}...`);
-    return new Promise((resolve) => {
+    const session = { socket: null, resolved: false, disposed: false };
+    return new Promise((resolvePromise) => {
+      const signal = context2.signal;
+      const resolve = () => {
+        signal?.removeEventListener("abort", onAbort);
+        resolvePromise();
+      };
+      const onAbort = () => {
+        context2.spinner?.hide();
+        this.cleanup(session);
+        context2.process.exit(130, { silent: true });
+        resolve();
+      };
+      if (signal?.aborted) {
+        onAbort();
+        return;
+      }
+      signal?.addEventListener("abort", onAbort, { once: true });
       try {
-        this.socket = new WebSocket(wsUrl);
+        session.socket = new WebSocket(wsUrl);
       } catch (e) {
         context2.spinner?.hide();
         context2.writer.writeError(
           `Failed to connect to '${serverName}': ${e.message}`
         );
-        context2.process.exit(1);
+        context2.process.exit(1, { silent: true });
         resolve();
         return;
       }
-      this.socket.onmessage = (event) => {
-        const msg = JSON.parse(event.data);
+      session.socket.onmessage = (event) => {
+        const msg = parseShellMessage(event.data);
+        if (!msg) return;
         switch (msg.type) {
           case "ready":
             context2.spinner?.hide();
@@ -17296,9 +17789,9 @@ var CliSshCommandProcessor = class {
             break;
           case "exit":
             if (msg.code !== 0) {
-              context2.process.exit(msg.code);
+              context2.process.exit(msg.code, { silent: true });
             }
-            this.cleanup();
+            this.cleanup(session);
             resolve();
             break;
           case "error":
@@ -17306,50 +17799,82 @@ var CliSshCommandProcessor = class {
             context2.writer.writeError(
               `Server error: ${msg.message}`
             );
-            context2.process.exit(1);
-            this.cleanup();
+            context2.process.exit(1, { silent: true });
+            this.cleanup(session);
             resolve();
             break;
         }
       };
-      this.socket.onclose = () => {
+      let errored = false;
+      session.socket.onclose = (event) => {
         context2.spinner?.hide();
-        this.cleanup();
+        const reason = describeShellClose(event ?? {}, serverName);
+        if (reason || errored) {
+          context2.writer.writeError(reason ?? `WebSocket error connecting to '${serverName}'.`);
+          context2.process.exit(1, { silent: true });
+        }
+        this.cleanup(session);
         resolve();
       };
-      this.socket.onerror = () => {
-        context2.spinner?.hide();
-        context2.writer.writeError(
-          `WebSocket error connecting to '${serverName}'.`
-        );
-        context2.process.exit(1);
-        this.cleanup();
-        resolve();
+      session.socket.onerror = () => {
+        errored = true;
       };
     });
   }
+  /** `ssh <server> <cmd...>` → `<cmd...>` exactly as typed */
+  remoteCommandFromRaw(raw, serverName) {
+    const match = raw?.trim().match(/^\S+\s+(\S+)\s+([\s\S]+)$/);
+    return match && match[1] === serverName ? match[2].trim() : null;
+  }
   buildShellUrl(connection, cols, rows, cmd) {
-    const baseUrl = connection.config.url.endsWith("/") ? connection.config.url.slice(0, -1) : connection.config.url;
-    const wsBase = baseUrl.replace(/^https:/, "wss:").replace(/^http:/, "ws:");
-    let url = `${wsBase}/ws/v1/qcli/shell?cols=${cols}&rows=${rows}`;
+    let path = `/ws/v1/qcli/shell?cols=${cols}&rows=${rows}`;
     if (cmd) {
-      url += `&cmd=${encodeURIComponent(cmd)}`;
+      path += `&cmd=${encodeURIComponent(cmd)}`;
     }
-    return url;
+    return connection.buildWebSocketUrl(path);
   }
-  cleanup() {
-    if (this.socket) {
-      this.socket.onmessage = null;
-      this.socket.onclose = null;
-      this.socket.onerror = null;
-      if (this.socket.readyState === WebSocket.OPEN || this.socket.readyState === WebSocket.CONNECTING) {
-        this.socket.close();
+  cleanup(session) {
+    const socket = session.socket;
+    if (socket) {
+      socket.onmessage = null;
+      socket.onclose = null;
+      socket.onerror = null;
+      if (socket.readyState === WebSocket.OPEN || socket.readyState === WebSocket.CONNECTING) {
+        socket.close();
       }
-      this.socket = null;
+      session.socket = null;
     }
-    this.context = null;
   }
 };
+function parseShellMessage(data) {
+  try {
+    const msg = typeof data === "string" ? JSON.parse(data) : null;
+    return msg && typeof msg === "object" && typeof msg.type === "string" ? msg : null;
+  } catch {
+    return null;
+  }
+}
+function describeShellClose(event, serverName) {
+  const reason = (event.reason ?? "").toLowerCase();
+  switch (event.code) {
+    case 4401:
+      if (reason === "session ended") return `ssh: shell closed by '${serverName}' (session ended or shell access revoked)`;
+      if (reason === "shell access is not configured") {
+        return `ssh: shell access is not configured on '${serverName}'`;
+      }
+      return `ssh: login required on '${serverName}'`;
+    case 4403:
+      return `ssh: permission denied on '${serverName}' (requires shell:execute or a valid shell token)`;
+    case 4404:
+      return `ssh: the shell is disabled on '${serverName}'`;
+    case 4408:
+      return `ssh: shell timed out on '${serverName}'`;
+    case 4429:
+      return `ssh: too many shell sessions on '${serverName}'`;
+    default:
+      return null;
+  }
+}
 
 // src/lib/server/cli-server-module.ts
 function createServerModule() {
@@ -17384,6 +17909,11 @@ function initializeTerminal(container, opts) {
   terminal.open(container);
   fitAddon.fit();
   requestAnimationFrame(() => fitAddon.fit());
+  if (document.fonts?.ready) {
+    document.fonts.ready.then(() => {
+      requestAnimationFrame(() => fitAddon.fit());
+    });
+  }
   container.classList.add("terminal-container");
   container.style.background = opts.theme?.background ?? "#000";
   const wheelListener = (e) => e.preventDefault();
@@ -17626,19 +18156,21 @@ async function initializeServices(options) {
   const logger = new CliLogger();
   const commandHistory = new CliCommandHistory(store);
   await commandHistory.initialize();
-  services.set([{ provide: "cli-key-value-store", useValue: store }]);
+  services.set([{ provide: CliKeyValueStore_TOKEN, useValue: store, sealed: true }]);
   const stateStoreManager = new CliStateStoreManager(services, registry);
   const processRegistry = new CliProcessRegistry();
   services.set([
     {
       provide: CliStateStoreManager_TOKEN,
-      useValue: stateStoreManager
+      useValue: stateStoreManager,
+      sealed: true
     },
-    { provide: CliProcessorsRegistry_TOKEN, useValue: registry },
-    { provide: CliCommandHistory_TOKEN, useValue: commandHistory },
+    { provide: CliProcessorsRegistry_TOKEN, useValue: registry, sealed: true },
+    { provide: CliCommandHistory_TOKEN, useValue: commandHistory, sealed: true },
     {
       provide: CliProcessRegistry_TOKEN,
-      useValue: processRegistry
+      useValue: processRegistry,
+      sealed: true
     }
   ]);
   if (pendingServices.length > 0) {
@@ -17649,7 +18181,8 @@ async function initializeServices(options) {
     services.set([
       {
         provide: ICliPingServerService_TOKEN,
-        useValue: new CliDefaultPingServerService()
+        useClass: CliDefaultPingServerService,
+        sealed: true
       }
     ]);
   }
@@ -17659,25 +18192,41 @@ async function initializeServices(options) {
   syntaxRegistry.register(new MarkdownHighlighter());
   syntaxRegistry.register(new YamlHighlighter());
   services.set([
-    { provide: "syntax-highlighter-registry", useValue: syntaxRegistry }
+    { provide: SyntaxHighlighterRegistry_TOKEN, useValue: syntaxRegistry, sealed: true }
   ]);
   if (!pendingTokens.has(ICliEnvironment_TOKEN)) {
     services.set([
       {
         provide: ICliEnvironment_TOKEN,
-        useValue: new CliEnvironment()
+        useClass: CliEnvironment,
+        sealed: true
       }
     ]);
   }
   services.set([
     {
       provide: cliCore.ICliDragDropService_TOKEN,
-      useValue: dragDropService
+      useValue: dragDropService,
+      sealed: true
+    }
+  ]);
+  services.set(
+    cliCore.cliAccessMetadataGuards.map((guard) => ({
+      provide: cliCore.ICliCommandGuard_TOKEN,
+      useValue: guard,
+      multi: true
+    }))
+  );
+  services.set([
+    {
+      provide: cliCore.ICliPermissionRegistry_TOKEN,
+      useValue: new CliPermissionRegistry(),
+      sealed: true
     }
   ]);
   const translator = new CliTranslationService();
   services.set([
-    { provide: cliCore.ICliTranslationService_TOKEN, useValue: translator }
+    { provide: cliCore.ICliTranslationService_TOKEN, useValue: translator, sealed: true }
   ]);
   return {
     services,
@@ -17746,7 +18295,7 @@ var CliEngine = class {
    * Initialize the terminal, wire up services, boot modules, and show welcome message.
    */
   async start() {
-    initWasmAccelerator().catch(() => {
+    initWasmAccelerator(this.options?.wasmUrl).catch(() => {
     });
     await waitForLayout(this.container);
     const terminalOpts = getTerminalOptions(this.options?.terminalOptions);
@@ -17789,10 +18338,18 @@ var CliEngine = class {
       provide: CliBackgroundServiceRegistry_TOKEN,
       useValue: this.executionContext.backgroundServices
     }]);
-    const serverManager = new CliServerManager(this.registry);
+    const serverAuthService = new CliServerAuthService(services);
     services.set([
-      { provide: CliServerManager_TOKEN, useValue: serverManager }
+      { provide: cliCore.ICliServerAuthService_TOKEN, useValue: serverAuthService, sealed: true }
+    ]);
+    services.set([
+      {
+        provide: CliServerManager_TOKEN,
+        useClass: CliServerManager,
+        deps: [CliProcessorsRegistry_TOKEN, cliCore.ICliServerAuthService_TOKEN]
+      }
     ]);
+    const serverManager = services.getRequired(CliServerManager_TOKEN);
     if (this.options?.servers && this.options.servers.length > 0) {
       await serverManager.connectAll(this.options.servers, {
         warn: (msg) => this.executionContext.logger.warn(msg),
@@ -17812,13 +18369,9 @@ var CliEngine = class {
       new CliCommandCompletionProvider(this.registry),
       new CliParameterCompletionProvider(this.registry, executor)
     ];
-    let pluginProviders = [];
-    try {
-      pluginProviders = services.get(
-        cliCore.ICliCompletionProvider_TOKEN
-      ) ?? [];
-    } catch {
-    }
+    const pluginProviders = services.getAll(
+      cliCore.ICliCompletionProvider_TOKEN
+    );
     this.executionContext.completionEngine.setProviders([
       ...pluginProviders,
       ...defaultProviders
@@ -17926,7 +18479,7 @@ var CliEngine = class {
     if (!this.executionContext) {
       throw new Error("Cannot snapshot before engine has started");
     }
-    const stateStoreManager = this.executionContext.services.get(
+    const stateStoreManager = this.executionContext.services.getRequired(
       CliStateStoreManager_TOKEN
     );
     return {
@@ -17953,7 +18506,7 @@ var CliEngine = class {
       });
     }
     await this.executionContext.commandHistory.setHistory(snap.commandHistory);
-    const stateStoreManager = this.executionContext.services.get(
+    const stateStoreManager = this.executionContext.services.getRequired(
       CliStateStoreManager_TOKEN
     );
     for (const entry of snap.stateStores) {
@@ -18013,7 +18566,7 @@ var CliTestHarness = class {
     this.services = new CliServiceContainer();
     this.processRegistry = new CliProcessRegistry();
     this.services.set({
-      provide: "cli-key-value-store",
+      provide: CliKeyValueStore_TOKEN,
       useValue: createInMemoryKvStore()
     });
     this.services.set({
@@ -18036,6 +18589,24 @@ var CliTestHarness = class {
       provide: ICliEnvironment_TOKEN,
       useValue: new CliEnvironment()
     });
+    this.services.set({
+      provide: cliCore.ICliPermissionRegistry_TOKEN,
+      useValue: new CliPermissionRegistry()
+    });
+    this.services.set(
+      cliCore.cliAccessMetadataGuards.map((guard) => ({
+        provide: cliCore.ICliCommandGuard_TOKEN,
+        useValue: guard,
+        multi: true
+      }))
+    );
+  }
+  /**
+   * Resolve `context.userSession` on every command from this function
+   * (e.g. a session service), instead of the value set via setUserSession().
+   */
+  setUserSessionProvider(provider) {
+    this.userSessionProvider = provider;
   }
   /**
    * Register a service in the test container.
@@ -18120,9 +18691,10 @@ var CliTestHarness = class {
       options: void 0,
       logger: createNoopLogger(),
       process,
-      userSession: this.userSession,
+      userSession: this.userSessionProvider ? this.userSessionProvider() : this.userSession,
       state: this.stateStoreManager.getStateStore("shared"),
       backgroundServices: createNoopBackgroundServices(),
+      http: new CliHttpClient(),
       promptLength: 0,
       currentLine: "",
       cursorPosition: 0,
@@ -18145,11 +18717,7 @@ var CliTestHarness = class {
       submitCommand: async (command2) => {
         await this.executor.executeCommand(command2, context2);
       },
-      setStatusText: () => {
-      },
-      clearStatusText: () => {
-      },
-      getStatusText: () => void 0,
+      notifier: new CliNotifier(),
       createInterval: (cb, ms) => {
         const id = setInterval(cb, ms);
         return {
@@ -18402,18 +18970,22 @@ exports.CliHelpCommandProcessor = CliHelpCommandProcessor;
 exports.CliHistoryCommandProcessor = CliHistoryCommandProcessor;
 exports.CliHotKeysCommandProcessor = CliHotKeysCommandProcessor;
 exports.CliHtopCommandProcessor = CliHtopCommandProcessor;
+exports.CliHttpClient = CliHttpClient;
 exports.CliInputReader = CliInputReader;
 exports.CliJsonCommandProcessor = CliJsonCommandProcessor;
 exports.CliKeyValueStore = CliKeyValueStore;
+exports.CliKeyValueStore_TOKEN = CliKeyValueStore_TOKEN;
 exports.CliKillCommandProcessor = CliKillCommandProcessor;
 exports.CliLogger = CliLogger;
 exports.CliLoremCommandProcessor = CliLoremCommandProcessor;
 exports.CliModuleRegistry_TOKEN = CliModuleRegistry_TOKEN;
 exports.CliNanoCommandProcessor = CliNanoCommandProcessor;
+exports.CliNotifier = CliNotifier;
 exports.CliOpenCommandProcessor = CliOpenCommandProcessor;
 exports.CliPackageManagerService = CliPackageManagerService;
 exports.CliPackageManagerService_TOKEN = CliPackageManagerService_TOKEN;
 exports.CliPackagesCommandProcessor = CliPackagesCommandProcessor;
+exports.CliPermissionRegistry = CliPermissionRegistry;
 exports.CliPingCommandProcessor = CliPingCommandProcessor;
 exports.CliProcessRegistry = CliProcessRegistry;
 exports.CliProcessRegistry_TOKEN = CliProcessRegistry_TOKEN;
@@ -18459,12 +19031,14 @@ exports.LIBRARY_VERSION = LIBRARY_VERSION;
 exports.OverlayAddon = OverlayAddon;
 exports.ProcessExitedError = ProcessExitedError;
 exports.ScriptLoaderService = ScriptLoaderService;
+exports.SyntaxHighlighterRegistry_TOKEN = SyntaxHighlighterRegistry_TOKEN;
 exports.appendOutputToFile = appendOutputToFile;
 exports.appendStderrToFile = appendStderrToFile;
 exports.builtinProcessors = builtinProcessors;
 exports.computeDiff = computeDiff;
 exports.contextGlobalParameter = contextGlobalParameter;
 exports.createServerModule = createServerModule;
+exports.describeShellClose = describeShellClose;
 exports.executeOnServer = executeOnServer;
 exports.expandEnvironmentVars = expandEnvironmentVars;
 exports.formatDiff = formatDiff;