@sipher.dev/agents 0.1.0 → 0.1.2

package/dist/index.js

@@ -1,3412 +1,337 @@
 #!/usr/bin/env node
-import { A as MACHINE_MCP_MAX_ERROR_MESSAGE_BYTES, B as validateMachineMcpRequest, C as MAX_MACHINE_JOB_OUTPUT_BYTES, E as MAX_TEXT_FILE_READ_LINES, F as encodeMachineMcpFrame, G as parseArgs, H as MAX_MACHINE_TERMINAL_HISTORY_BYTES, I as sanitizeAndCanonicalizeMachineMcpCatalog, L as substituteMachineMcpLaunch, M as MACHINE_MCP_MAX_STDERR_BYTES, N as MACHINE_MCP_TAG, O as isServerRpcRequest, P as MachineMcpValidationError, R as utf8Bytes, T as MAX_TEXT_FILE_READ_BYTES, U as CliAuthClient, V as validateMachineMcpResult, W as allowInsecureTlsForLocalTesting, _ as detectShell, a as setupConnectorProfile, b as DEFAULT_TEXT_FILE_READ_LINES, g as ShellManager, h as resolveConnectorProfileContext, i as pollConnectorDeviceToken, k as CONNECTOR_MAX_WEBSOCKET_PAYLOAD_BYTES, m as runServiceCommand, n as ensureAccessToken, o as startConnectorDeviceAuthorization, p as loadServiceConfig, s as TokenStore, t as createAccessTokenProvider, v as DEFAULT_MACHINE_FILE_READ_BYTES, w as MAX_PATCH_SOURCE_FILE_BYTES, y as DEFAULT_TEXT_FILE_READ_BYTES, z as validateMachineMcpLaunchSpec } from "./local-machine-controller-Dtiash-C.js";
-import { createRequire } from "node:module";
-import { execFile, spawn } from "node:child_process";
-import { homedir, hostname, platform, userInfo } from "node:os";
-import { createHash, randomUUID } from "node:crypto";
-import path, { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { createReadStream } from "node:fs";
-import { chmod, mkdir, open, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { pathToFileURL } from "node:url";
-import WebSocket from "ws";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { ListRootsRequestSchema, ToolListChangedNotificationSchema } from "@modelcontextprotocol/sdk/types.js";
-import { z } from "zod";
-import process$1 from "node:process";
+import { A as insecureTlsForServer, M as parseArgs, O as deploymentServiceKey, b as resolveConnectorProfileContext, d as TokenStore, g as runServiceCommand, i as resolveVerifiedConnectorSnapshot, m as installConnectorLauncherService, r as resolveVerifiedConnectorRelease, s as withDeploymentReconciliationLock, y as defaultConnectorAuthStorePath } from "./release-resolver-PnPDodU9.js";
+import { a as repairConnectorProfile, c as startConnectorDeviceAuthorization, i as pollConnectorDeviceToken, l as CliAuthClient, n as discoverDeploymentForStore, o as resumeConnectorBootstrap, r as ensureAccessToken, s as setupConnectorProfile } from "./local-machine-controller-CjOyllJj.js";
+import { r as discoverLocalConnector } from "./local-control-Dm6FcXAi.js";
+import { spawn } from "node:child_process";
+import { homedir, hostname, platform } from "node:os";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { randomUUID } from "node:crypto";
 //#region src/cli-setup.ts
 async function login(options = {}) {
 	const store = options.store ?? new TokenStore();
 	const serverUrl = await store.resolveServerUrl(options.serverUrl);
-	const device = await startConnectorDeviceAuthorization({
-		serverUrl,
-		deviceLabel: hostname(),
-		allowInsecureTls: options.allowInsecureTls
-	});
-	console.log(`Open ${device.verificationUriComplete}`);
-	console.log(`Code: ${device.userCode}`);
-	if (options.openBrowser !== false) openBrowser(device.verificationUriComplete);
-	await pollConnectorDeviceToken({
-		serverUrl,
-		store,
-		deviceCode: device.deviceCode,
-		intervalSeconds: device.interval,
-		expiresInSeconds: device.expiresIn,
-		allowInsecureTls: options.allowInsecureTls
-	});
-	const setup = await setupConnectorProfile({
-		serverUrl,
-		store,
-		name: options.name,
-		installService: options.installService ?? true,
-		serviceInstaller: options.serviceInstaller ?? defaultServiceInstaller(options.profileName)
-	});
-	console.log(`Logged in to ${serverUrl}.`);
-	console.log(`Machine: ${setup.machineId}`);
-}
-function serviceInstallConfigInput(input, profileName) {
-	return {
-		serverUrl: input.serverUrl,
-		...profileName ? { profileName } : {},
-		...input.allowInsecureTls ? { allowInsecureTls: true } : {}
-	};
-}
-function defaultServiceInstaller(profileName) {
-	return (input) => runServiceCommand("install", serviceInstallConfigInput(input, profileName));
-}
-async function logout(options = {}) {
-	const store = options.store ?? new TokenStore();
-	const serverUrl = await store.resolveServerUrl(options.serverUrl);
-	const profile = await store.removeProfile(serverUrl);
-	if (profile?.refreshToken) await new CliAuthClient(serverUrl, { allowInsecureTls: options.allowInsecureTls ?? profile.allowInsecureTls }).revoke(profile.refreshToken).catch(() => void 0);
-	console.log(`Logged out of ${serverUrl}.`);
-}
-async function whoami(options = {}) {
-	const store = options.store ?? new TokenStore();
-	const serverUrl = await store.resolveServerUrl(options.serverUrl);
-	const profile = await store.getProfile(serverUrl);
-	if (!profile?.refreshToken) throw new Error(`Not logged in to ${serverUrl}. Run agents login.`);
-	await ensureAccessToken({
+	const deployment = await discoverDeploymentForStore({
 		serverUrl,
 		store,
 		allowInsecureTls: options.allowInsecureTls
 	});
-	console.log(`Server: ${serverUrl}`);
-	console.log(`Machine: ${profile.machineId ?? "not claimed yet"}`);
-}
-function openBrowser(url) {
-	const command = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open";
-	const args = platform() === "win32" ? [
-		"/c",
-		"start",
-		"",
-		url
-	] : [url];
-	try {
-		const child = spawn(command, args, {
-			stdio: "ignore",
-			detached: true
-		});
-		child.once("error", () => void 0);
-		child.unref();
-	} catch {}
-}
-//#endregion
-//#region ../machine-protocol/src/node.ts
-function sanitizeAndFingerprintMachineMcpCatalog(input) {
-	const { catalog, canonicalJson } = sanitizeAndCanonicalizeMachineMcpCatalog(input);
-	return {
-		catalog,
-		canonicalJson,
-		fingerprint: createHash("sha256").update(canonicalJson).digest("hex")
-	};
-}
-//#endregion
-//#region src/mcp-stdio-transport.ts
-function inheritedEnvironmentKeys(platform) {
-	return platform === "win32" ? [
-		"APPDATA",
-		"HOMEDRIVE",
-		"HOMEPATH",
-		"LOCALAPPDATA",
-		"PATH",
-		"PROCESSOR_ARCHITECTURE",
-		"SYSTEMDRIVE",
-		"SYSTEMROOT",
-		"TEMP",
-		"USERNAME",
-		"USERPROFILE",
-		"PROGRAMFILES"
-	] : [
-		"HOME",
-		"LOGNAME",
-		"PATH",
-		"SHELL",
-		"TERM",
-		"USER"
-	];
-}
-var BoundedStdioTransport = class {
-	options;
-	onclose;
-	onerror;
-	onmessage;
-	child;
-	groupPid;
-	chunks = [];
-	bufferedBytes = 0;
-	stderrTail = Buffer.alloc(0);
-	closing;
-	forceClosing;
-	exitedCleanup;
-	constructor(options) {
-		this.options = options;
-	}
-	get pid() {
-		return this.child?.pid ?? null;
-	}
-	get stderr() {
-		return this.stderrTail.toString("utf8");
-	}
-	async start() {
-		if (this.child) throw new Error("MCP stdio transport already started.");
-		const child = spawn(this.options.command, this.options.args, {
-			cwd: this.options.cwd,
-			env: safeEnvironment(),
-			detached: process$1.platform !== "win32",
-			shell: false,
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			],
-			windowsHide: true
-		});
-		this.child = child;
-		this.groupPid = child.pid;
-		child.stdout.on("data", (chunk) => this.acceptChunk(chunk));
-		child.stderr.on("data", (chunk) => this.acceptStderr(chunk));
-		child.stdin.on("error", (error) => this.onerror?.(error));
-		child.stdout.on("error", (error) => this.fail(error));
-		child.on("error", (error) => this.fail(error));
-		child.on("close", () => {
-			const unexpected = !this.closing && !this.forceClosing;
-			if (this.child === child) this.child = void 0;
-			if (unexpected && child.pid) this.exitedCleanup ??= this.cleanupExitedGroup(child);
-			this.options.onProcessExit?.(unexpected);
-			this.onclose?.();
-		});
-		await new Promise((resolve, reject) => {
-			child.once("spawn", resolve);
-			child.once("error", reject);
-		});
-	}
-	async send(message) {
-		const child = this.child;
-		if (!child?.stdin.writable) throw new Error("MCP stdio transport is not connected.");
-		const payload = `${JSON.stringify(message)}\n`;
-		if (utf8Bytes(payload) > 6291456) throw new Error("MCP stdio request frame is too large.");
-		if (!child.stdin.write(payload)) await new Promise((resolve, reject) => {
-			child.stdin.once("drain", resolve);
-			child.stdin.once("error", reject);
-		});
-	}
-	close() {
-		this.closing ??= this.closeChild(false);
-		return this.closing;
-	}
-	forceClose() {
-		this.forceClosing ??= this.forceCloseChild();
-		return this.forceClosing;
-	}
-	acceptChunk(chunk) {
-		let offset = 0;
-		while (offset < chunk.length) {
-			const newline = chunk.indexOf(10, offset);
-			const end = newline < 0 ? chunk.length : newline;
-			const bytes = end - offset;
-			if (this.bufferedBytes + bytes + (newline >= 0 ? 1 : 0) > 6291456) {
-				this.fail(/* @__PURE__ */ new Error("MCP stdio response frame is too large."));
-				return;
-			}
-			if (bytes > 0) {
-				this.chunks.push(chunk.subarray(offset, end));
-				this.bufferedBytes += bytes;
-			}
-			if (newline < 0) return;
-			this.emitLine();
-			offset = newline + 1;
-		}
-	}
-	emitLine() {
-		const chunks = this.chunks;
-		this.chunks = [];
-		this.bufferedBytes = 0;
-		if (chunks.length === 0) return;
-		try {
-			const line = chunks.length === 1 ? chunks[0].toString("utf8") : Buffer.concat(chunks).toString("utf8");
-			this.onmessage?.(JSON.parse(line));
-		} catch (error) {
-			this.fail(error instanceof Error ? error : /* @__PURE__ */ new Error("Invalid MCP stdio JSON."));
-		}
-	}
-	acceptStderr(chunk) {
-		const combined = Buffer.concat([this.stderrTail, chunk]);
-		this.stderrTail = utf8Tail(combined, MACHINE_MCP_MAX_STDERR_BYTES);
-		this.options.onStderr?.(this.stderr);
-	}
-	fail(error) {
-		this.onerror?.(error);
-		this.forceClose();
-	}
-	async closeChild(force) {
-		const child = this.child;
-		this.chunks = [];
-		this.bufferedBytes = 0;
-		if (!child || child.exitCode !== null) {
-			if (this.child === child) this.child = void 0;
-			await this.exitedCleanup;
-			return;
-		}
-		const closed = new Promise((resolve) => child.once("close", () => resolve()));
-		try {
-			child.stdin.end();
-		} catch {}
-		const terminate = this.options.terminate ?? terminateTree;
-		if (force) {
-			await terminate(child, "force");
-			await waitFor(closed, 1e3);
-			if (this.child === child) this.child = void 0;
-			if (this.groupPid === child.pid) this.groupPid = void 0;
-			return;
-		}
-		await waitFor(closed, 1e3);
-		if (this.forceClosing) {
-			if (this.child === child) this.child = void 0;
-			return;
-		}
-		await terminate(child, "graceful");
-		await waitFor(closed, 1e3);
-		await terminate(child, "force");
-		await waitFor(closed, 1e3);
-		if (this.child === child) this.child = void 0;
-		if (this.groupPid === child.pid) this.groupPid = void 0;
-	}
-	async forceCloseChild() {
-		if (!this.closing) {
-			this.closing = this.closeChild(true);
-			await this.closing;
-			return;
-		}
-		const child = this.child;
-		if (child && child.exitCode === null) await (this.options.terminate ?? terminateTree)(child, "force");
-		await this.closing;
-	}
-	async cleanupExitedGroup(child) {
-		try {
-			await (this.options.terminate ?? terminateTree)(child, "force");
-		} finally {
-			if (this.groupPid === child.pid) this.groupPid = void 0;
-		}
-	}
-};
-async function terminateTree(child, mode, runtime = {}) {
-	if (!child.pid) return;
-	if ((runtime.platform ?? process$1.platform) === "win32") {
-		await waitFor(new Promise((resolve) => {
-			const args = [
-				"/PID",
-				String(child.pid),
-				"/T",
-				...mode === "force" ? ["/F"] : []
-			];
-			(runtime.spawnProcess ?? spawn)("taskkill", args, {
-				shell: false,
-				windowsHide: true,
-				stdio: "ignore"
-			}).once("close", () => resolve());
-		}), runtime.taskkillTimeoutMs ?? 1e3);
-		return;
-	}
-	try {
-		const signal = mode === "force" ? "SIGKILL" : "SIGTERM";
-		if (runtime.killProcess) runtime.killProcess(-child.pid, signal);
-		else process$1.kill(-child.pid, signal);
-	} catch {
-		try {
-			child.kill(mode === "force" ? "SIGKILL" : "SIGTERM");
-		} catch {}
-	}
-}
-function safeEnvironment(environment = process$1.env, platform = process$1.platform) {
-	return Object.fromEntries(inheritedEnvironmentKeys(platform).flatMap((key) => {
-		const value = environment[key];
-		return value !== void 0 && !value.startsWith("()") ? [[key, value]] : [];
-	}));
-}
-function utf8Tail(value, maxBytes) {
-	if (value.length <= maxBytes) return value;
-	let start = value.length - maxBytes;
-	while (start < value.length && (value[start] & 192) === 128) start += 1;
-	return value.subarray(start);
-}
-async function waitFor(promise, timeoutMs) {
-	return Promise.race([promise.then(() => true), new Promise((resolve) => {
-		setTimeout(() => resolve(false), timeoutMs).unref();
-	})]);
-}
-const MCP_PROBE_TIMEOUT_MS = 3e4;
-const LIST_CHANGE_DEBOUNCE_MS = 100;
-const RawListToolsResultSchema = z.object({
-	tools: z.array(z.unknown()),
-	nextCursor: z.string().optional()
-}).passthrough();
-var McpProcessManager = class {
-	options;
-	entries = /* @__PURE__ */ new Map();
-	starting = /* @__PURE__ */ new Map();
-	startingLaunches = /* @__PURE__ */ new Map();
-	stoppedKeys = /* @__PURE__ */ new Set();
-	stoppedSelectors = /* @__PURE__ */ new Map();
-	cancelledStartupKeys = /* @__PURE__ */ new Set();
-	startupCancelOwner = /* @__PURE__ */ new Map();
-	probeRequests = /* @__PURE__ */ new Map();
-	callRequests = /* @__PURE__ */ new Map();
-	cancelledProbeRequests = /* @__PURE__ */ new Set();
-	cancelledCallRequests = /* @__PURE__ */ new Set();
-	probeUsers = /* @__PURE__ */ new Map();
-	requestEntries = /* @__PURE__ */ new Map();
-	abortReasons = /* @__PURE__ */ new Map();
-	startupExitedKeys = /* @__PURE__ */ new Set();
-	startingTransports = /* @__PURE__ */ new Map();
-	closingTransports = /* @__PURE__ */ new Set();
-	closed = false;
-	constructor(options = {}) {
-		this.options = options;
-	}
-	get processCount() {
-		return this.entries.size + this.starting.size + this.closingTransports.size;
-	}
-	async probe(request) {
-		this.assertOpen();
-		const launch = {
-			...request.params.launch,
-			projectRoot: this.home()
-		};
-		const key = `probe\0${processKey(launch)}`;
-		this.probeRequests.set(request.id, key);
-		this.probeUsers.set(key, (this.probeUsers.get(key) ?? 0) + 1);
-		let entry;
-		try {
-			entry = await this.startEntry(launch, Math.min(request.params.timeoutMs, MCP_PROBE_TIMEOUT_MS), key);
-			if (this.cancelledProbeRequests.has(request.id)) throw new MachineMcpValidationError("cancelled", "MCP probe was cancelled.");
-			if (!entry.reusable || entry.observedGeneration !== entry.validatedGeneration) throw new MachineMcpValidationError("stale_catalog", "MCP catalog changed during probe discovery.");
-			return {
-				kind: "probe",
-				catalog: entry.catalog,
-				fingerprint: entry.fingerprint,
-				...entry.transport.stderr ? { stderrTail: entry.transport.stderr } : {}
-			};
-		} catch (error) {
-			if (this.cancelledProbeRequests.has(request.id)) throw new MachineMcpValidationError("cancelled", "MCP probe was cancelled.");
-			throw error;
-		} finally {
-			this.probeRequests.delete(request.id);
-			this.cancelledProbeRequests.delete(request.id);
-			const users = (this.probeUsers.get(key) ?? 1) - 1;
-			if (users === 0) {
-				this.probeUsers.delete(key);
-				if (entry) await this.closeEntry(entry);
-			} else this.probeUsers.set(key, users);
-			this.cleanupStartupCancellation(key);
-		}
-	}
-	async call(request) {
-		this.assertOpen();
-		if (!request.params.launch.catalogFingerprint) throw new MachineMcpValidationError("invalid_request", "MCP calls require an accepted catalog fingerprint.");
-		const key = processKey(request.params.launch);
-		const deadline = Date.now() + request.params.timeoutMs;
-		this.callRequests.set(request.id, key);
-		let entry;
-		try {
-			entry = await this.getOrStart(request.params.launch, true, deadline);
-			if (this.closed || this.cancelledCallRequests.has(request.id)) {
-				await this.closeEntry(entry, true);
-				throw new MachineMcpValidationError("cancelled", "MCP tool call was cancelled during startup.");
-			}
-		} catch (error) {
-			const stopReason = this.abortReasons.get(request.id);
-			const owner = this.startupCancelOwner.get(key);
-			const wasCancelled = this.closed || this.cancelledCallRequests.has(request.id) || owner !== void 0 || this.cancelledStartupKeys.has(key);
-			this.finishCallRequest(request.id, key);
-			if (stopReason === "stale_catalog") throw new MachineMcpValidationError("stale_catalog", "MCP tool call was stopped because its catalog authority changed.");
-			if (wasCancelled) {
-				const collateral = owner !== void 0 && owner !== request.id;
-				throw new MachineMcpValidationError(collateral ? "process_terminated_due_to_cancel" : "cancelled", collateral ? "MCP tool call ended because its shared startup was terminated." : "MCP tool call was cancelled during startup.");
-			}
-			throw error;
-		}
-		if (!entry.reusable || entry.observedGeneration !== entry.validatedGeneration) {
-			this.finishCallRequest(request.id, key);
-			throw new MachineMcpValidationError("stale_catalog", "MCP catalog changed before tool call.");
-		}
-		if (entry.activeCalls.size >= 2) {
-			this.finishCallRequest(request.id, key);
-			throw new MachineMcpValidationError("mcp_busy", "MCP process call capacity is full.");
-		}
-		const controller = new AbortController();
-		entry.activeCalls.set(request.id, controller);
-		this.requestEntries.set(request.id, entry);
-		try {
-			const timeoutMs = remainingMs(deadline);
-			const result = await entry.client.callTool({
-				name: request.params.toolName,
-				arguments: request.params.arguments
-			}, void 0, {
-				signal: controller.signal,
-				timeout: timeoutMs,
-				maxTotalTimeout: timeoutMs
-			});
-			if (!entry.reusable || entry.observedGeneration !== entry.validatedGeneration) throw new MachineMcpValidationError("stale_catalog", "MCP catalog changed during tool call.");
-			validateMachineMcpResult(result);
-			return {
-				kind: "call",
-				result
-			};
-		} catch (error) {
-			if (controller.signal.aborted) {
-				const reason = this.abortReasons.get(request.id) ?? "cancelled";
-				throw new MachineMcpValidationError(reason, reason === "process_terminated_due_to_cancel" ? "MCP tool call ended because its shared process was terminated." : reason === "process_exited" ? "MCP process exited during the tool call." : reason === "stale_catalog" ? "MCP tool call was stopped because its catalog authority changed." : "MCP tool call was cancelled.");
-			}
-			if (/timeout|timed out/i.test(error instanceof Error ? error.message : "")) {
-				entry.reusable = false;
-				for (const id of entry.activeCalls.keys()) if (id !== request.id) this.abortReasons.set(id, "process_terminated_due_to_cancel");
-				setTimeout(() => void this.closeEntry(entry), 1e3).unref();
-				throw new MachineMcpValidationError("timeout", "MCP tool call timed out.");
-			}
-			throw error;
-		} finally {
-			entry.activeCalls.delete(request.id);
-			this.requestEntries.delete(request.id);
-			this.abortReasons.delete(request.id);
-			this.finishCallRequest(request.id, key);
-			this.touch(entry);
-		}
-	}
-	cancel(requestId) {
-		const entry = this.requestEntries.get(requestId);
-		const controller = entry?.activeCalls.get(requestId);
-		if (!entry || !controller) {
-			const callKey = this.callRequests.get(requestId);
-			if (callKey) {
-				this.cancelledCallRequests.add(requestId);
-				this.cancelledStartupKeys.add(callKey);
-				this.startupCancelOwner.set(callKey, requestId);
-				this.startingTransports.get(callKey)?.forceClose();
-				const active = this.entries.get(callKey);
-				if (active) this.closeEntry(active, true);
-				return true;
-			}
-			const key = this.probeRequests.get(requestId);
-			if (!key) return false;
-			this.cancelledProbeRequests.add(requestId);
-			this.cancelledStartupKeys.add(key);
-			this.startupCancelOwner.set(key, requestId);
-			this.startingTransports.get(key)?.forceClose();
-			const active = this.entries.get(key);
-			if (active) this.closeEntry(active, true);
-			return true;
-		}
-		entry.reusable = false;
-		this.abortReasons.set(requestId, "cancelled");
-		for (const id of entry.activeCalls.keys()) if (id !== requestId) this.abortReasons.set(id, "process_terminated_due_to_cancel");
-		controller.abort();
-		setTimeout(() => void this.closeEntry(entry), 1e3).unref();
-		return true;
-	}
-	async stop(input) {
-		if (!this.addStopSelector(input)) {
-			const stopped = this.processCount;
-			await this.close(true);
-			return stopped;
-		}
-		for (const [requestId, key] of this.callRequests) {
-			const launch = this.startingLaunches.get(key) ?? this.entries.get(key)?.launch;
-			if (launch && matchesStop(launch, input)) this.abortReasons.set(requestId, "stale_catalog");
-		}
-		const matches = [...this.entries.values()].filter((entry) => entry.launch.definitionId === input.definitionId && (input.configVersion === void 0 || entry.launch.configVersion === input.configVersion) && (input.projectRoot === void 0 || entry.launch.projectRoot === input.projectRoot));
-		const startingKeys = [...this.startingLaunches.entries()].filter(([key, launch]) => {
-			return matchesStop(launch, key.startsWith("probe\0") ? {
-				definitionId: input.definitionId,
-				...input.configVersion === void 0 ? {} : { configVersion: input.configVersion }
-			} : input);
-		}).map(([key]) => key);
-		for (const key of startingKeys) {
-			this.stoppedKeys.add(key);
-			await this.startingTransports.get(key)?.forceClose();
-		}
-		for (const entry of matches) for (const requestId of entry.activeCalls.keys()) this.abortReasons.set(requestId, "stale_catalog");
-		await Promise.all(matches.map((entry) => this.closeEntry(entry)));
-		return matches.length + startingKeys.length;
-	}
-	async close(force = false) {
-		if (this.closed && this.entries.size === 0 && this.starting.size === 0 && this.closingTransports.size === 0) return;
-		this.closed = true;
-		for (const key of this.starting.keys()) this.cancelledStartupKeys.add(key);
-		const entryClosures = [...this.entries.values()].map((entry) => this.closeEntry(entry, force));
-		await Promise.all([
-			...[...this.startingTransports.values()].map((transport) => force ? transport.forceClose() : transport.close()),
-			...force ? [...[...this.closingTransports].map((transport) => transport.forceClose())] : [],
-			...entryClosures
-		]);
-		await Promise.allSettled(this.starting.values());
-		await Promise.all([...this.entries.values()].map((entry) => this.closeEntry(entry, force)));
-	}
-	async getOrStart(launch, requireFingerprint, deadline) {
-		const key = processKey(launch);
-		const existing = this.entries.get(key);
-		if (existing) if (!sameLaunchConfiguration(existing.launch, launch)) await this.closeEntry(existing);
-		else {
-			if (launch.catalogRevision < existing.catalogRevision) throw new MachineMcpValidationError("stale_catalog", "MCP catalog revision is stale.");
-			if (existing.observedGeneration !== existing.validatedGeneration && launch.catalogRevision === existing.catalogRevision) throw new MachineMcpValidationError("stale_catalog", "MCP catalog changed before a newer accepted revision was provided.");
-			if (launch.catalogRevision > existing.catalogRevision) {
-				if (existing.revalidation) {
-					await withTimeout(existing.revalidation, remainingMs(deadline));
-					return this.getOrStart(launch, requireFingerprint, deadline);
-				}
-				existing.reservations += 1;
-				let outcome;
-				const revalidation = this.revalidate(existing, launch, remainingMs(deadline));
-				existing.revalidation = revalidation;
-				try {
-					outcome = await revalidation;
-				} finally {
-					existing.reservations -= 1;
-					if (existing.revalidation === revalidation) existing.revalidation = void 0;
-				}
-				if (outcome === "matched") return existing;
-				if (outcome === "stale" || launch.catalogRevision === existing.catalogRevision) throw new MachineMcpValidationError("stale_catalog", "MCP catalog changed during validation.");
-				await this.closeEntry(existing);
-			} else if (existing.reusable && matchesAcceptedCatalog(existing, launch, requireFingerprint)) return existing;
-			else await this.closeEntry(existing);
-		}
-		const entry = await this.startEntry(launch, remainingMs(deadline));
-		if (!matchesAcceptedCatalog(entry, launch, requireFingerprint)) {
-			await this.closeEntry(entry);
-			throw new MachineMcpValidationError("root_catalog_mismatch", "MCP catalog does not match the accepted Project-root catalog.");
-		}
-		return entry;
-	}
-	async revalidate(entry, launch, timeoutMs) {
-		const observed = entry.observedGeneration;
-		const { catalog, fingerprint } = sanitizeAndFingerprintMachineMcpCatalog(await listFullCatalog(entry.client, Date.now() + timeoutMs));
-		if (entry.observedGeneration !== observed) return "stale";
-		if (launch.catalogFingerprint && fingerprint !== launch.catalogFingerprint) return "mismatch";
-		entry.catalog = catalog;
-		entry.fingerprint = fingerprint;
-		entry.catalogRevision = launch.catalogRevision;
-		entry.validatedGeneration = observed;
-		entry.launch = launch;
-		entry.reusable = true;
-		if (entry.changeTimer) clearTimeout(entry.changeTimer);
-		entry.changeTimer = void 0;
-		return "matched";
-	}
-	startEntry(launch, timeoutMs, key = processKey(launch)) {
-		if (this.isStopped(key, launch)) throw new MachineMcpValidationError("cancelled", "MCP process was stopped before startup.");
-		const current = this.starting.get(key);
-		if (current) {
-			const startingLaunch = this.startingLaunches.get(key);
-			if (!startingLaunch || !sameStartupAuthority(startingLaunch, launch)) throw new MachineMcpValidationError("invalid_request", "MCP startup request does not match the in-progress launch.");
-			return withTimeout(current, timeoutMs);
-		}
-		const promise = this.createEntry(key, launch, timeoutMs).finally(() => {
-			this.starting.delete(key);
-			this.startingLaunches.delete(key);
-			this.startingTransports.delete(key);
-			this.startupExitedKeys.delete(key);
-			this.cleanupStartupCancellation(key);
-		});
-		this.starting.set(key, promise);
-		this.startingLaunches.set(key, launch);
-		return promise;
-	}
-	async createEntry(key, launch, timeoutMs) {
-		const deadline = Date.now() + timeoutMs;
-		validateMachineMcpLaunchSpec(launch);
-		const resolved = substituteMachineMcpLaunch(launch, void 0, this.home());
-		await this.reserveProcessSlot(deadline);
-		this.assertOpen();
-		if (this.isStopped(key, launch) || this.cancelledStartupKeys.has(key)) throw new MachineMcpValidationError("cancelled", "MCP process was stopped before startup.");
-		let entry;
-		const transport = new BoundedStdioTransport({
-			...resolved,
-			onProcessExit: (unexpected) => {
-				if (entry) this.removeExitedEntry(entry);
-				else if (unexpected) this.startupExitedKeys.add(key);
-			}
-		});
-		this.startingTransports.set(key, transport);
-		const client = new Client({
-			name: "agents-machine-connector",
-			version: "0.1.0"
-		}, { capabilities: { roots: { listChanged: false } } });
-		client.setRequestHandler(ListRootsRequestSchema, () => ({ roots: [{
-			uri: pathToFileURL(launch.projectRoot).href,
-			name: "Project root"
-		}] }));
-		let observedGeneration = 0;
-		client.setNotificationHandler(ToolListChangedNotificationSchema, () => {
-			observedGeneration += 1;
-			if (!entry) return;
-			entry.observedGeneration = observedGeneration;
-			entry.reusable = false;
-			if (entry.changeTimer) return;
-			entry.changeTimer = setTimeout(() => {
-				entry.changeTimer = void 0;
-				this.options.onCatalogChanged?.({
-					type: "mcp/event",
-					event: "tools/list_changed",
-					definitionId: launch.definitionId,
-					configVersion: launch.configVersion,
-					projectRoot: launch.projectRoot,
-					observedGeneration: entry.observedGeneration
-				});
-			}, LIST_CHANGE_DEBOUNCE_MS);
-			entry.changeTimer.unref();
-		});
-		try {
-			await client.connect(transport, {
-				timeout: remainingMs(deadline),
-				maxTotalTimeout: remainingMs(deadline)
-			});
-			const observedBeforeList = observedGeneration;
-			const { catalog, fingerprint } = sanitizeAndFingerprintMachineMcpCatalog(await listFullCatalog(client, deadline));
-			if (this.closed || this.isStopped(key, launch) || this.cancelledStartupKeys.has(key)) throw new MachineMcpValidationError("cancelled", "MCP process was stopped during startup.");
-			const timer = setTimeout(() => {}, this.options.idleMs ?? 6e5);
-			timer.unref();
-			entry = {
-				key,
-				launch,
-				client,
-				transport,
-				catalog,
-				fingerprint,
-				catalogRevision: launch.catalogRevision,
-				observedGeneration,
-				validatedGeneration: observedBeforeList === observedGeneration ? observedGeneration : observedBeforeList,
-				activeCalls: /* @__PURE__ */ new Map(),
-				reservations: 0,
-				reusable: observedBeforeList === observedGeneration,
-				lastUsedAt: this.now(),
-				idleTimer: timer,
-				changeTimer: void 0,
-				revalidation: void 0
-			};
-			this.entries.set(key, entry);
-			this.startingTransports.delete(key);
-			this.touch(entry);
-			return entry;
-		} catch (error) {
-			this.startingTransports.delete(key);
-			const processExited = this.startupExitedKeys.has(key);
-			await transport.close();
-			if (this.isStopped(key, launch) || this.cancelledStartupKeys.has(key)) throw new MachineMcpValidationError("cancelled", "MCP process was stopped during startup.");
-			if (processExited) throw new MachineMcpValidationError("process_exited", "MCP process exited during startup.");
-			throw mapProcessError(error, transport.stderr);
-		}
-	}
-	async reserveProcessSlot(deadline) {
-		if (this.processCount < 16) return;
-		const idle = [...this.entries.values()].filter((entry) => entry.activeCalls.size === 0 && entry.reservations === 0).sort((a, b) => a.lastUsedAt - b.lastUsedAt)[0];
-		if (!idle) throw new MachineMcpValidationError("process_limit", "MCP process limit reached.");
-		await withTimeout(this.closeEntry(idle), remainingMs(deadline));
-	}
-	isStopped(key, launch) {
-		if (this.stoppedKeys.has(key)) return true;
-		for (const input of this.stoppedSelectors.values()) if (matchesStop(launch, key.startsWith("probe\0") ? {
-			definitionId: input.definitionId,
-			...input.configVersion === void 0 ? {} : { configVersion: input.configVersion }
-		} : input)) return true;
-		return false;
-	}
-	addStopSelector(input) {
-		for (const selector of this.stoppedSelectors.values()) if (subsumesStopSelector(selector, input)) return true;
-		for (const [key, selector] of this.stoppedSelectors) if (subsumesStopSelector(input, selector)) this.stoppedSelectors.delete(key);
-		if (this.stoppedSelectors.size >= 256) return false;
-		this.stoppedSelectors.set(stopSelectorKey(input), input);
-		return true;
-	}
-	touch(entry) {
-		if (this.entries.get(entry.key) !== entry) return;
-		entry.lastUsedAt = this.now();
-		this.armIdleTimer(entry);
-	}
-	armIdleTimer(entry) {
-		clearTimeout(entry.idleTimer);
-		entry.idleTimer = setTimeout(() => {
-			if (entry.activeCalls.size > 0 || entry.reservations > 0) {
-				this.armIdleTimer(entry);
-				return;
-			}
-			this.closeEntry(entry);
-		}, this.options.idleMs ?? 6e5);
-		entry.idleTimer.unref();
-	}
-	now() {
-		return this.options.now?.() ?? Date.now();
-	}
-	home() {
-		return this.options.home ?? homedir();
-	}
-	finishCallRequest(requestId, key) {
-		this.callRequests.delete(requestId);
-		this.cancelledCallRequests.delete(requestId);
-		this.abortReasons.delete(requestId);
-		this.cleanupStartupCancellation(key);
-	}
-	cleanupStartupCancellation(key) {
-		if (this.starting.has(key)) return;
-		if ([...this.callRequests.values()].includes(key)) return;
-		if ([...this.probeRequests.values()].includes(key)) return;
-		this.cancelledStartupKeys.delete(key);
-		this.startupCancelOwner.delete(key);
-	}
-	async closeEntry(entry, force = false) {
-		if (this.entries.get(entry.key) !== entry) return;
-		this.entries.delete(entry.key);
-		entry.reusable = false;
-		clearTimeout(entry.idleTimer);
-		if (entry.changeTimer) clearTimeout(entry.changeTimer);
-		for (const controller of entry.activeCalls.values()) controller.abort();
-		this.closingTransports.add(entry.transport);
-		const forcedClose = force ? entry.transport.forceClose() : void 0;
-		try {
-			await entry.client.close().catch(() => void 0);
-			await (forcedClose ?? entry.transport.close()).catch(() => void 0);
-		} finally {
-			this.closingTransports.delete(entry.transport);
-		}
-	}
-	removeExitedEntry(entry) {
-		if (this.entries.get(entry.key) !== entry) return;
-		this.entries.delete(entry.key);
-		entry.reusable = false;
-		clearTimeout(entry.idleTimer);
-		if (entry.changeTimer) clearTimeout(entry.changeTimer);
-		for (const [requestId, controller] of entry.activeCalls) {
-			this.abortReasons.set(requestId, "process_exited");
-			controller.abort();
-		}
-	}
-	assertOpen() {
-		if (this.closed) throw new MachineMcpValidationError("process_exited", "MCP manager is closed.");
-	}
-};
-async function listFullCatalog(client, deadline) {
-	const tools = [];
-	const seenCursors = /* @__PURE__ */ new Set();
-	let cursor;
-	for (let pageIndex = 0; pageIndex < 512; pageIndex += 1) {
-		const timeoutMs = remainingMs(deadline);
-		const page = await client.request({
-			method: "tools/list",
-			...cursor ? { params: { cursor } } : {}
-		}, RawListToolsResultSchema, {
-			timeout: timeoutMs,
-			maxTotalTimeout: timeoutMs
-		});
-		if (page.tools.length === 0 && page.nextCursor) throw new MachineMcpValidationError("protocol_error", "MCP tools/list returned an empty page with a continuation cursor.");
-		tools.push(...page.tools);
-		if (tools.length > 500) throw new MachineMcpValidationError("catalog_overflow", "MCP catalog has too many tools.");
-		const nextCursor = page.nextCursor;
-		if (!nextCursor) {
-			cursor = void 0;
-			break;
-		}
-		if (seenCursors.has(nextCursor)) throw new MachineMcpValidationError("protocol_error", "MCP tools/list repeated a cursor.");
-		seenCursors.add(nextCursor);
-		cursor = nextCursor;
-	}
-	if (cursor) throw new MachineMcpValidationError("catalog_overflow", "MCP tools/list exceeded the page limit.");
-	const server = client.getServerVersion();
-	return {
-		serverInfo: {
-			name: server?.name ?? "unknown",
-			...server?.version ? { version: server.version } : {}
-		},
-		tools
-	};
-}
-function remainingMs(deadline) {
-	const remaining = deadline - Date.now();
-	if (remaining <= 0) throw new MachineMcpValidationError("timeout", "MCP operation timed out.");
-	return remaining;
-}
-function processKey(launch) {
-	return `${launch.definitionId}\0${launch.configVersion}\0${launch.projectRoot}`;
-}
-function sameStartupAuthority(left, right) {
-	return left.catalogRevision === right.catalogRevision && left.catalogFingerprint === right.catalogFingerprint && sameLaunchConfiguration(left, right);
-}
-function sameLaunchConfiguration(left, right) {
-	return left.command === right.command && left.cwdMode === right.cwdMode && left.args.length === right.args.length && left.args.every((arg, index) => arg === right.args[index]);
-}
-function matchesStop(launch, input) {
-	return launch.definitionId === input.definitionId && (input.configVersion === void 0 || launch.configVersion === input.configVersion) && (input.projectRoot === void 0 || launch.projectRoot === input.projectRoot);
-}
-function stopSelectorKey(input) {
-	return `${input.definitionId}\0${input.configVersion ?? "*"}\0${input.projectRoot ?? "*"}`;
-}
-function subsumesStopSelector(selector, candidate) {
-	return selector.definitionId === candidate.definitionId && (selector.configVersion === void 0 || selector.configVersion === candidate.configVersion) && (selector.projectRoot === void 0 || selector.projectRoot === candidate.projectRoot);
-}
-function matchesAcceptedCatalog(entry, launch, requireFingerprint) {
-	if (entry.catalogRevision !== launch.catalogRevision) return false;
-	if (!launch.catalogFingerprint) return !requireFingerprint;
-	return entry.fingerprint === launch.catalogFingerprint;
-}
-function mapProcessError(error, stderr) {
-	if (error instanceof MachineMcpValidationError) return error;
-	const message = error instanceof Error ? error.message : "MCP process failed.";
-	const mapped = new MachineMcpValidationError(/ENOENT|not found/i.test(message) ? "command_not_found" : /timeout|timed out/i.test(message) ? "timeout" : "protocol_error", message);
-	return stderr ? Object.assign(mapped, { stderrTail: stderr }) : mapped;
-}
-function withTimeout(promise, timeoutMs) {
-	let timer;
-	return Promise.race([promise, new Promise((_, reject) => {
-		timer = setTimeout(() => reject(new MachineMcpValidationError("timeout", "MCP startup timed out.")), timeoutMs);
-		timer.unref();
-	})]).finally(() => {
-		if (timer) clearTimeout(timer);
-	});
-}
-var ConnectorMcpGeneration = class {
-	socket;
-	home;
-	manager;
-	queue = [];
-	active = /* @__PURE__ */ new Map();
-	activeByProcess = /* @__PURE__ */ new Map();
-	controlIds = /* @__PURE__ */ new Set();
-	closed = false;
-	closePromise;
-	constructor(socket, manager, home = homedir()) {
-		this.socket = socket;
-		this.home = home;
-		this.manager = manager ?? new McpProcessManager({ onCatalogChanged: (event) => this.send(event) });
-	}
-	handles(data) {
-		const buffer = rawBuffer(data);
-		return buffer.length >= 4 && buffer.subarray(0, 4).equals(Buffer.from("mcp:"));
-	}
-	accept(data) {
-		const buffer = rawBuffer(data);
-		if (buffer.length > 6291456) {
-			this.sendError("unknown", "frame_too_large", "MCP connector frame is too large.");
-			return;
-		}
-		let request;
-		try {
-			request = validateMachineMcpRequest(JSON.parse(buffer.subarray(MACHINE_MCP_TAG.length).toString("utf8")));
-			if (request.method === "mcp/probe" || request.method === "mcp/call") {
-				const launch = request.method === "mcp/probe" ? {
-					...request.params.launch,
-					projectRoot: this.home
-				} : request.params.launch;
-				validateMachineMcpLaunchSpec(launch);
-				substituteMachineMcpLaunch(launch, void 0, this.home);
-			}
-		} catch (error) {
-			const validation = toValidationError(error);
-			this.sendError(requestIdFromFrame(buffer), validation.code, validation.message);
-			return;
-		}
-		if (this.active.has(request.id) || this.controlIds.has(request.id) || this.queue.some((record) => record.request.id === request.id)) {
-			this.sendError(request.id, "invalid_request", "MCP request id is already in use.");
-			return;
-		}
-		if (request.method === "mcp/cancel") {
-			this.controlIds.add(request.id);
-			try {
-				this.cancel(request.id, request.params.requestId);
-			} finally {
-				this.controlIds.delete(request.id);
-			}
-			return;
-		}
-		if (request.method === "mcp/stop") {
-			this.controlIds.add(request.id);
-			this.stop(request).finally(() => this.controlIds.delete(request.id));
-			return;
-		}
-		if (this.queue.length >= 64) {
-			this.sendError(request.id, "mcp_busy", "MCP work queue is full.");
-			return;
-		}
-		const timeoutMs = request.params.timeoutMs;
-		const record = {
-			request,
-			receivedAt: Date.now(),
-			timer: setTimeout(() => this.expireQueued(request.id), timeoutMs)
-		};
-		record.timer.unref();
-		this.queue.push(record);
-		this.drain();
-	}
-	async close(force = false) {
-		if (!this.closed) {
-			this.closed = true;
-			for (const record of this.queue.splice(0)) {
-				clearTimeout(record.timer);
-				this.sendError(record.request.id, "cancelled", "MCP work cancelled by connector shutdown.");
-			}
-			for (const requestId of this.active.keys()) this.manager.cancel(requestId);
-			this.closePromise = this.manager.close(false);
-		}
-		if (force) await this.manager.close(true);
-		await this.closePromise;
-	}
-	drain() {
-		while (!this.closed && this.active.size < 8 && this.queue.length > 0) {
-			const record = this.queue[0];
-			const key = workProcessKey(record);
-			if (record.request.method === "mcp/call" && (this.activeByProcess.get(key) ?? 0) >= 2) return;
-			this.queue.shift();
-			clearTimeout(record.timer);
-			const elapsed = Date.now() - record.receivedAt;
-			const remaining = record.request.params.timeoutMs - elapsed;
-			if (remaining <= 0) {
-				this.sendError(record.request.id, "timeout", "MCP work timed out in queue.");
-				continue;
-			}
-			record.request.params.timeoutMs = remaining;
-			this.active.set(record.request.id, record);
-			if (record.request.method === "mcp/call") this.activeByProcess.set(key, (this.activeByProcess.get(key) ?? 0) + 1);
-			this.run(record);
-		}
-	}
-	async run(record) {
-		try {
-			const result = record.request.method === "mcp/probe" ? await this.manager.probe(record.request) : await this.manager.call(record.request);
-			this.send({
-				type: "mcp/response",
-				id: record.request.id,
-				result
-			});
-		} catch (error) {
-			const validation = toValidationError(error);
-			const stderrTail = record.request.method === "mcp/probe" && "stderrTail" in validation && typeof validation.stderrTail === "string" ? validation.stderrTail : void 0;
-			this.sendError(record.request.id, validation.code, validation.message, stderrTail);
-		} finally {
-			this.active.delete(record.request.id);
-			if (record.request.method === "mcp/call") {
-				const key = workProcessKey(record);
-				const remaining = (this.activeByProcess.get(key) ?? 1) - 1;
-				if (remaining === 0) this.activeByProcess.delete(key);
-				else this.activeByProcess.set(key, remaining);
-			}
-			this.drain();
-		}
-	}
-	cancel(controlId, requestId) {
-		const index = this.queue.findIndex((record) => record.request.id === requestId);
-		if (index >= 0) {
-			const [record] = this.queue.splice(index, 1);
-			clearTimeout(record.timer);
-			this.sendError(requestId, "cancelled", "MCP work was cancelled before startup.");
-			this.send({
-				type: "mcp/response",
-				id: controlId,
-				result: {
-					kind: "control",
-					cancelled: true
-				}
-			});
-			return;
-		}
-		const cancelled = this.manager.cancel(requestId);
-		this.send({
-			type: "mcp/response",
-			id: controlId,
-			result: {
-				kind: "control",
-				cancelled
-			}
-		});
-	}
-	async stop(request) {
-		try {
-			const removed = this.removeQueued((work) => {
-				const launch = work.request.params.launch;
-				return launch.definitionId === request.params.definitionId && (request.params.configVersion === void 0 || launch.configVersion === request.params.configVersion) && (request.params.projectRoot === void 0 || launch.projectRoot === request.params.projectRoot);
-			});
-			const stopped = await this.manager.stop(request.params);
-			this.send({
-				type: "mcp/response",
-				id: request.id,
-				result: {
-					kind: "control",
-					stopped: stopped + removed
-				}
-			});
-		} catch (error) {
-			const validation = toValidationError(error);
-			this.sendError(request.id, validation.code, validation.message);
-		}
-	}
-	removeQueued(predicate) {
-		let removed = 0;
-		for (let index = this.queue.length - 1; index >= 0; index -= 1) {
-			const record = this.queue[index];
-			if (!predicate(record)) continue;
-			this.queue.splice(index, 1);
-			clearTimeout(record.timer);
-			this.sendError(record.request.id, "cancelled", "MCP work was stopped before startup.");
-			removed += 1;
-		}
-		return removed;
-	}
-	expireQueued(requestId) {
-		const index = this.queue.findIndex((record) => record.request.id === requestId);
-		if (index < 0) return;
-		const [record] = this.queue.splice(index, 1);
-		clearTimeout(record.timer);
-		this.sendError(requestId, "timeout", "MCP work timed out in queue.");
-	}
-	sendError(id, code, message, stderrTail) {
-		const bounded = truncateUtf8(message, MACHINE_MCP_MAX_ERROR_MESSAGE_BYTES);
-		this.send({
-			type: "mcp/error",
-			id,
-			error: {
-				code,
-				message: bounded || code,
-				...stderrTail ? { stderrTail } : {}
-			}
-		});
-	}
-	send(message) {
-		if (this.closed || this.socket.readyState !== WebSocket.OPEN) return;
-		let payload;
-		try {
-			payload = encodeMachineMcpFrame(message);
-		} catch {
-			this.socket.close(1009, "MCP response too large");
-			this.close(true);
-			return;
-		}
-		if (this.socket.bufferedAmount + Buffer.byteLength(payload) > 12582912) {
-			this.socket.close(1009, "MCP outbound buffer exceeded");
-			this.close(true);
-			return;
-		}
-		this.socket.send(payload);
-	}
-};
-function rawBuffer(data) {
-	if (Array.isArray(data)) return Buffer.concat(data);
-	if (Buffer.isBuffer(data)) return data;
-	if (data instanceof ArrayBuffer) return Buffer.from(data);
-	return Buffer.from(data);
-}
-function requestIdFromFrame(buffer) {
-	try {
-		const value = JSON.parse(buffer.subarray(MACHINE_MCP_TAG.length).toString("utf8"));
-		if (typeof value === "object" && value && "id" in value && typeof value.id === "string") return value.id;
-	} catch {}
-	return "unknown";
-}
-function toValidationError(error) {
-	if (error instanceof MachineMcpValidationError) return error;
-	const message = error instanceof Error ? error.message : "MCP request failed.";
-	if (/timeout/i.test(message)) return new MachineMcpValidationError("timeout", message);
-	if (/abort|cancel/i.test(message)) return new MachineMcpValidationError("cancelled", message);
-	return new MachineMcpValidationError("protocol_error", message);
-}
-function workProcessKey(record) {
-	const launch = record.request.params.launch;
-	return `${launch.definitionId}\0${launch.configVersion}\0${launch.projectRoot}`;
-}
-function truncateUtf8(value, maxBytes) {
-	const bytes = Buffer.from(value);
-	if (bytes.length <= maxBytes) return value;
-	let end = maxBytes;
-	while (end > 0 && (bytes[end] & 192) === 128) end -= 1;
-	return bytes.subarray(0, end).toString("utf8");
-}
-//#endregion
-//#region src/file-reader.ts
-async function readFileForRpc(input) {
-	const maxBytes = resolveMaxBytes(input.maxBytes);
-	if (maxBytes === void 0) return {
-		ok: false,
-		errorCode: "invalid_request",
-		message: "maxBytes must be a positive safe integer within the file read limit."
-	};
-	let handle;
-	try {
-		handle = await open(input.path, "r");
-		const stat = await handle.stat();
-		if (!stat.isFile()) return {
-			ok: false,
-			errorCode: "not_file",
-			message: "Path is not a regular file."
-		};
-		if (stat.size > maxBytes) return {
-			ok: false,
-			errorCode: "too_large",
-			message: `File exceeds ${maxBytes} bytes.`
-		};
-		const bytes = await readBounded$1(handle, maxBytes);
-		if (bytes.byteLength > maxBytes) return {
-			ok: false,
-			errorCode: "too_large",
-			message: `File exceeds ${maxBytes} bytes.`
-		};
-		return {
-			ok: true,
-			dataBase64: bytes.toString("base64"),
-			sizeBytes: bytes.byteLength
-		};
-	} catch (error) {
-		return fileReadError(error);
-	} finally {
-		await handle?.close();
-	}
-}
-async function readBounded$1(handle, maxBytes) {
-	const limitBuffer = Buffer.allocUnsafe(maxBytes + 1);
-	let offset = 0;
-	while (offset < limitBuffer.byteLength) {
-		const { bytesRead } = await handle.read(limitBuffer, offset, limitBuffer.byteLength - offset, offset);
-		if (bytesRead === 0) break;
-		offset += bytesRead;
-	}
-	return limitBuffer.subarray(0, offset);
-}
-function resolveMaxBytes(value) {
-	if (value === void 0) return DEFAULT_MACHINE_FILE_READ_BYTES;
-	if (!Number.isSafeInteger(value) || value <= 0 || value > 20971520) return;
-	return value;
-}
-function fileReadError(error) {
-	const code = typeof error === "object" && error && "code" in error ? error.code : void 0;
-	if (code === "ENOENT" || code === "ENOTDIR") return {
-		ok: false,
-		errorCode: "not_found",
-		message: "File was not found."
-	};
-	if (code === "EACCES" || code === "EPERM") return {
-		ok: false,
-		errorCode: "permission_denied",
-		message: "Permission denied."
-	};
-	return {
-		ok: false,
-		errorCode: "read_failed",
-		message: error instanceof Error ? error.message : "File read failed."
-	};
-}
-//#endregion
-//#region src/file-writer.ts
-async function writeFileForRpc(input) {
-	if (Buffer.byteLength(input.content) > 5242880) return {
-		ok: false,
-		errorCode: "too_large",
-		message: "File content exceeds write limit."
-	};
-	try {
-		if ((await existingFileStat(input.path))?.isDirectory()) return {
-			ok: false,
-			errorCode: "not_file",
-			message: "Path is a directory."
-		};
-		await mkdir(dirname(input.path), { recursive: true });
-		await writeFile(input.path, input.content, "utf8");
-		return { ok: true };
-	} catch (error) {
-		return writeError(error);
-	}
-}
-async function deleteFileForRpc(input) {
-	try {
-		if ((await stat(input.path)).isDirectory()) return {
-			ok: false,
-			errorCode: "not_file",
-			message: "Path is a directory."
-		};
-		await rm(input.path);
-		return { ok: true };
-	} catch (error) {
-		return deleteError(error);
-	}
-}
-async function moveFileForRpc(input) {
-	try {
-		if ((await stat(input.sourcePath)).isDirectory()) return {
-			ok: false,
-			errorCode: "not_file",
-			message: "Path is a directory."
-		};
-		if ((await existingFileStat(input.targetPath))?.isDirectory()) return {
-			ok: false,
-			errorCode: "not_file",
-			message: "Path is a directory."
-		};
-		await mkdir(dirname(input.targetPath), { recursive: true });
-		await rename(input.sourcePath, input.targetPath);
-		return { ok: true };
-	} catch (error) {
-		return moveError(error);
-	}
-}
-async function existingFileStat(path) {
-	try {
-		return await stat(path);
-	} catch (error) {
-		const code = typeof error === "object" && error && "code" in error ? error.code : void 0;
-		if (code === "ENOENT" || code === "ENOTDIR") return void 0;
-		throw error;
-	}
-}
-function writeError(error) {
-	return mapFsError(error, "write_failed", "File write failed.");
-}
-function deleteError(error) {
-	return mapFsError(error, "delete_failed", "File delete failed.");
-}
-function moveError(error) {
-	return mapFsError(error, "move_failed", "File move failed.");
-}
-function mapFsError(error, fallbackCode, fallbackMessage) {
-	const code = typeof error === "object" && error && "code" in error ? error.code : void 0;
-	if (code === "ENOENT" || code === "ENOTDIR") return {
-		ok: false,
-		errorCode: "not_found",
-		message: "File was not found."
-	};
-	if (code === "EISDIR") return {
-		ok: false,
-		errorCode: "not_file",
-		message: "Path is a directory."
-	};
-	if (code === "EACCES" || code === "EPERM") return {
-		ok: false,
-		errorCode: "permission_denied",
-		message: "Permission denied."
-	};
-	return {
-		ok: false,
-		errorCode: fallbackCode,
-		message: error instanceof Error ? error.message : fallbackMessage
-	};
-}
-//#endregion
-//#region src/machine-file-search-index.ts
-const INDEX_STALE_MS = 3e3;
-const SCAN_TIMEOUT_MS = 5e3;
-const indexes = /* @__PURE__ */ new Map();
-async function searchFileEntriesForRpc(params, options = {}) {
-	const limit = params.limit ?? 50;
-	const rootPath = path.resolve(params.rootPath);
-	if (!path.isAbsolute(params.rootPath) || limit < 1 || limit > 100) return {
-		ok: false,
-		errorCode: "invalid_request",
-		message: "Invalid file search request."
-	};
-	const rootState = await validateRoot(rootPath);
-	if (!rootState.ok) return rootState;
-	const indexResult = await getIndex(rootPath);
-	if (!indexResult.ok) return indexResult;
-	const refreshResult = await refreshIfStale(rootPath, indexResult.index, options.staleMs);
-	if (!refreshResult.ok) return refreshResult;
-	const searchResult = indexResult.index.finder.mixedSearch(params.query, { pageSize: limit });
-	if (!searchResult.ok) return {
-		ok: false,
-		errorCode: "search_failed",
-		message: searchResult.error
-	};
-	const candidates = searchResult.value.items.map((item) => toEntry(item)).filter((entry) => entry !== void 0);
-	const seen = /* @__PURE__ */ new Set();
-	const entries = candidates.filter((entry) => {
-		const key = `${entry.kind}:${entry.relativePath}`;
-		if (seen.has(key)) return false;
-		seen.add(key);
-		return true;
-	}).slice(0, limit);
-	return {
-		ok: true,
-		entries,
-		truncated: searchResult.value.totalMatched > entries.length
-	};
-}
-function disposeMachineFileSearchIndexes() {
-	for (const index of indexes.values()) index.then((result) => {
-		if (result.ok) result.index.finder.destroy();
-	}).catch(() => {});
-	indexes.clear();
-}
-async function validateRoot(rootPath) {
-	try {
-		if (!(await stat(rootPath)).isDirectory()) return {
-			ok: false,
-			errorCode: "not_directory",
-			message: "Search root is not a directory."
-		};
-		return { ok: true };
-	} catch (error) {
-		const code = nodeErrorCode(error);
-		if (code === "ENOENT") return {
-			ok: false,
-			errorCode: "not_found",
-			message: "Search root does not exist."
-		};
-		if (code === "EACCES" || code === "EPERM") return {
-			ok: false,
-			errorCode: "permission_denied",
-			message: "Search root is not readable."
-		};
-		return {
-			ok: false,
-			errorCode: "search_failed",
-			message: "Failed to inspect search root."
-		};
-	}
-}
-async function getIndex(rootPath) {
-	const existing = indexes.get(rootPath);
-	if (existing) return existing;
-	const pending = createIndex(rootPath);
-	indexes.set(rootPath, pending);
-	const result = await pending;
-	if (!result.ok && indexes.get(rootPath) === pending) indexes.delete(rootPath);
-	return result;
-}
-async function createIndex(rootPath) {
-	try {
-		const { FileFinder } = await import("@ff-labs/fff-node");
-		const created = FileFinder.create({
-			basePath: rootPath,
-			disableContentIndexing: true,
-			disableWatch: true
-		});
-		if (!created.ok) return unsupported(created.error);
-		const scan = await created.value.waitForScan(SCAN_TIMEOUT_MS);
-		if (!scan.ok || !scan.value) {
-			created.value.destroy();
-			return {
-				ok: false,
-				errorCode: "search_failed",
-				message: "Timed out scanning search root."
-			};
-		}
-		return {
-			ok: true,
-			index: {
-				finder: created.value,
-				lastScannedAt: Date.now()
-			}
-		};
-	} catch (error) {
-		return unsupported(error instanceof Error ? error.message : "Native file search is unavailable.");
-	}
-}
-async function refreshIfStale(rootPath, index, staleMs = INDEX_STALE_MS) {
-	if (Date.now() - index.lastScannedAt < staleMs) return { ok: true };
-	const refresh = index.finder.scanFiles();
-	if (!refresh.ok) return {
-		ok: false,
-		errorCode: "search_failed",
-		message: refresh.error
-	};
-	const scan = await index.finder.waitForScan(SCAN_TIMEOUT_MS);
-	if (!scan.ok || !scan.value) return {
-		ok: false,
-		errorCode: "search_failed",
-		message: `Timed out refreshing ${rootPath}.`
-	};
-	index.lastScannedAt = Date.now();
-	return { ok: true };
-}
-function toEntry(item) {
-	if (item.type === "file") return toEntryFromPath(item.item.relativePath, "file", item.item.size);
-	return toEntryFromPath(item.item.relativePath, "directory", null);
-}
-function toEntryFromPath(value, kind, sizeBytes) {
-	const relativePath = normalizeRelativePath(value);
-	if (!relativePath) return void 0;
-	if (kind === "file") {
-		if (sizeBytes === null) return void 0;
-		return {
-			relativePath,
-			kind,
-			sizeBytes
-		};
-	}
-	return {
-		relativePath,
-		kind,
-		sizeBytes: null
-	};
-}
-function normalizeRelativePath(value) {
-	const normalized = value.replace(/\\/g, "/").replace(/\/+$/, "");
-	if (!normalized || normalized.startsWith("/") || normalized.includes("\0")) return void 0;
-	if (normalized.length > 4096) return void 0;
-	if (normalized.split("/").some((segment) => !segment || segment === "." || segment === ".." || segment === ".git")) return;
-	return normalized;
-}
-function unsupported(message) {
-	return {
-		ok: false,
-		errorCode: "unsupported",
-		message: `Native file search is not supported on this host: ${message}`
-	};
-}
-function nodeErrorCode(error) {
-	return typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
-}
-//#endregion
-//#region src/shell-environment.ts
-const LOGIN_ENV_NAMES = [
-	"PATH",
-	"SSH_AUTH_SOCK",
-	"HOMEBREW_PREFIX",
-	"HOMEBREW_CELLAR",
-	"HOMEBREW_REPOSITORY",
-	"XDG_CONFIG_HOME",
-	"XDG_DATA_HOME"
-];
-const WINDOWS_PROFILE_ENV_NAMES = [
-	"PATH",
-	"FNM_DIR",
-	"FNM_MULTISHELL_PATH"
-];
-const WINDOWS_SHELLS = ["pwsh.exe", "powershell.exe"];
-const LOGIN_SHELL_TIMEOUT_MS = 5e3;
-const LAUNCHCTL_TIMEOUT_MS = 2e3;
-const FORCE_KILL_GRACE_MS = 1e3;
-const TERMINAL_ENV_BLOCKLIST = /* @__PURE__ */ new Set([
-	"PORT",
-	"ELECTRON_RENDERER_PORT",
-	"ELECTRON_RUN_AS_NODE"
-]);
-async function installShellEnvironment(options = {}) {
-	const env = options.env ?? process.env;
-	const platform = options.platform ?? process.platform;
-	const spawn$1 = options.spawn ?? spawn;
-	const warn = options.warn ?? console.warn;
-	if (platform === "win32") {
-		await installWindowsEnvironment(env, spawn$1, warn);
-		return;
-	}
-	if (platform !== "darwin" && platform !== "linux") return;
-	await installPosixEnvironment(env, platform, readUserShell(options.userInfo ?? userInfo), spawn$1, warn);
-}
-function createTerminalSpawnEnv(env = process.env) {
-	const result = {};
-	for (const [key, value] of Object.entries(env)) {
-		if (value === void 0 || shouldExcludeTerminalEnv(key)) continue;
-		result[key] = value;
-	}
-	return result;
-}
-async function installPosixEnvironment(env, platform, userShell, spawn, warn) {
-	const shellEnvironment = {};
-	for (const shell of loginShellCandidates(platform, env.SHELL, userShell)) {
-		Object.assign(shellEnvironment, await readPosixEnvironment(shell, LOGIN_ENV_NAMES, spawn, warn));
-		if (shellEnvironment.PATH) break;
-	}
-	const launchctlPath = platform === "darwin" && !shellEnvironment.PATH ? trim(await runProbe("launchctl-path", "/bin/launchctl", ["getenv", "PATH"], LAUNCHCTL_TIMEOUT_MS, spawn, warn)) : void 0;
-	const path = mergePaths(platform, shellEnvironment.PATH ?? launchctlPath, readPath(env));
-	if (path) env.PATH = path;
-	for (const name of LOGIN_ENV_NAMES.slice(1)) if (!env[name] && shellEnvironment[name]) env[name] = shellEnvironment[name];
-}
-async function installWindowsEnvironment(env, spawn, warn) {
-	const noProfile = await readWindowsEnvironment(["PATH"], false, spawn, warn);
-	const profile = await readWindowsEnvironment(WINDOWS_PROFILE_ENV_NAMES, true, spawn, warn);
-	const path = mergePaths("win32", profile.PATH, knownWindowsCliDirs(env).join(";"), noProfile.PATH, readPath(env));
-	if (path) env.PATH = path;
-	if (!env.FNM_DIR && profile.FNM_DIR) env.FNM_DIR = profile.FNM_DIR;
-	if (!env.FNM_MULTISHELL_PATH && profile.FNM_MULTISHELL_PATH) env.FNM_MULTISHELL_PATH = profile.FNM_MULTISHELL_PATH;
-}
-async function readPosixEnvironment(shell, names, spawn, warn) {
-	return extractEnvironment(await runProbe("login-shell", shell, ["-ilc", capturePosixEnvironment(names)], LOGIN_SHELL_TIMEOUT_MS, spawn, warn), names);
-}
-async function readWindowsEnvironment(names, loadProfile, spawn, warn) {
-	const args = [
-		"-NoLogo",
-		...loadProfile ? [] : ["-NoProfile"],
-		"-NonInteractive",
-		"-Command",
-		captureWindowsEnvironment(names)
-	];
-	const probe = loadProfile ? "powershell-profile" : "powershell-no-profile";
-	for (const shell of WINDOWS_SHELLS) {
-		const environment = extractEnvironment(await runProbe(probe, shell, args, LOGIN_SHELL_TIMEOUT_MS, spawn, warn), names);
-		if (Object.keys(environment).length > 0) return environment;
-	}
-	return {};
-}
-function runProbe(probe, file, args, timeoutMs, spawn, warn) {
-	return new Promise((resolve) => {
-		let output = "";
-		let timedOut = false;
-		let settled = false;
-		let timeout;
-		let forceKill;
-		const finish = (output, error) => {
-			if (settled) return;
-			settled = true;
-			if (timeout) clearTimeout(timeout);
-			if (forceKill) clearTimeout(forceKill);
-			if (timedOut) {
-				warn(`Shell environment ${probe} probe (${executableName(file)}, ${args.length} args) timed out after ${timeoutMs}ms.`);
-				resolve("");
-				return;
-			}
-			if (error) {
-				const code = errorCode(error);
-				warn(`Shell environment ${probe} probe (${executableName(file)}, ${args.length} args) failed${code ? `: ${code}` : "."}`);
-				resolve("");
-				return;
-			}
-			resolve(output);
-		};
-		try {
-			const child = spawn(file, [...args], { stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			] });
-			child.stdout.setEncoding("utf8");
-			child.stdout.on("data", (chunk) => {
-				output += chunk;
-			});
-			child.stderr.resume();
-			child.once("error", (error) => finish("", error));
-			child.once("close", (code) => {
-				finish(code === 0 ? output : "", code === 0 ? void 0 : { code: `exit ${code}` });
-			});
-			timeout = setTimeout(() => {
-				timedOut = true;
-				child.kill("SIGTERM");
-				forceKill = setTimeout(() => child.kill("SIGKILL"), FORCE_KILL_GRACE_MS);
-			}, timeoutMs);
-		} catch (error) {
-			finish("", error);
-		}
-	});
-}
-function loginShellCandidates(platform, shell, userShell) {
-	const fallback = platform === "darwin" ? "/bin/zsh" : "/bin/bash";
-	return [...new Set([
-		trim(shell),
-		trim(userShell),
-		fallback
-	].filter(isString))];
-}
-function capturePosixEnvironment(names) {
-	return names.map((name) => [
-		`printf '%s\\n' '${startMarker(name)}'`,
-		`printenv ${name} || true`,
-		`printf '%s\\n' '${endMarker(name)}'`
-	].join("; ")).join("; ");
-}
-function captureWindowsEnvironment(names) {
-	return ["$ErrorActionPreference = 'Stop'", ...names.flatMap((name) => [
-		`Write-Output '${startMarker(name)}'`,
-		`$value = [Environment]::GetEnvironmentVariable('${name}')`,
-		"if ($null -ne $value -and $value.Length -gt 0) { Write-Output $value }",
-		`Write-Output '${endMarker(name)}'`
-	])].join("; ");
-}
-function extractEnvironment(output, names) {
-	const environment = {};
-	for (const name of names) {
-		const start = output.indexOf(startMarker(name));
-		if (start === -1) continue;
-		const valueStart = start + startMarker(name).length;
-		const end = output.indexOf(endMarker(name), valueStart);
-		if (end === -1) continue;
-		const value = output.slice(valueStart, end).replace(/^\r?\n/, "").replace(/\r?\n$/, "");
-		if (value) environment[name] = value;
-	}
-	return environment;
-}
-function mergePaths(platform, ...values) {
-	const delimiter = platform === "win32" ? ";" : ":";
-	const entries = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const value of values) for (const entry of value?.split(delimiter) ?? []) {
-		const trimmed = entry.trim();
-		const key = trimmed.replace(/^"+|"+$/g, "");
-		const comparisonKey = platform === "win32" ? key.toLowerCase() : key;
-		if (!comparisonKey || seen.has(comparisonKey)) continue;
-		seen.add(comparisonKey);
-		entries.push(trimmed);
-	}
-	return entries.length > 0 ? entries.join(delimiter) : void 0;
-}
-function knownWindowsCliDirs(env) {
-	const appData = trim(env.APPDATA);
-	const localAppData = trim(env.LOCALAPPDATA);
-	const userProfile = trim(env.USERPROFILE);
-	return [
-		...appData ? [`${appData}\\npm`] : [],
-		...localAppData ? [
-			`${localAppData}\\Programs\\nodejs`,
-			`${localAppData}\\Volta\\bin`,
-			`${localAppData}\\pnpm`
-		] : [],
-		...userProfile ? [`${userProfile}\\.bun\\bin`, `${userProfile}\\scoop\\shims`] : []
-	];
-}
-function shouldExcludeTerminalEnv(key) {
-	const normalized = key.toUpperCase();
-	return normalized.startsWith("AGENTS_") || normalized.startsWith("VITE_") || TERMINAL_ENV_BLOCKLIST.has(normalized);
-}
-function readUserShell(userInfo) {
-	try {
-		return trim(userInfo().shell);
-	} catch {
-		return;
-	}
-}
-function readPath(env) {
-	return env.PATH ?? env.Path ?? env.path;
-}
-function startMarker(name) {
-	return `__AGENTS_ENV_${name}_START__`;
-}
-function endMarker(name) {
-	return `__AGENTS_ENV_${name}_END__`;
-}
-function executableName(file) {
-	return file.split(/[\\/]/).at(-1) ?? file;
-}
-function errorCode(error) {
-	if (!error || typeof error !== "object" || !("code" in error)) return void 0;
-	const code = error.code;
-	return typeof code === "string" || typeof code === "number" ? String(code) : void 0;
-}
-function trim(value) {
-	return value?.trim() || void 0;
-}
-function isString(value) {
-	return value !== void 0;
-}
-//#endregion
-//#region src/terminal-history.ts
-const MAX_PENDING_TERMINAL_CONTROL_SEQUENCE_BYTES = 4 * 1024;
-function createTerminalHistorySanitizerState() {
-	return {
-		discardSawEscape: false,
-		pending: ""
-	};
-}
-function sanitizeTerminalHistoryChunk(state, data) {
-	const visible = [];
-	let input = data;
-	let index = 0;
-	let nextState = state;
-	if (state.discardMode) {
-		const discarded = discardUntilTerminator(state, data);
-		nextState = discarded.state;
-		if (!discarded.done) return {
-			output: "",
-			state: nextState
-		};
-		input = data.slice(discarded.consumed);
-	} else if (state.pending) {
-		input = `${state.pending}${data}`;
-		nextState = createTerminalHistorySanitizerState();
-	}
-	while (index < input.length) {
-		const code = input.charCodeAt(index);
-		if (code === 27) {
-			const next = input.charCodeAt(index + 1);
-			if (Number.isNaN(next)) return pendingResult(visible, input.slice(index), "escape");
-			if (next === 91) {
-				const end = findCsiEnd(input, index + 2);
-				if (end === null) return pendingResult(visible, input.slice(index), "csi");
-				const sequence = input.slice(index, end);
-				const final = sequence.at(-1) ?? "";
-				if (!shouldStripCsiSequence(sequence.slice(2, -1), final)) visible.push(sequence);
-				index = end;
-				continue;
-			}
-			if (isStringIntroducer(next)) {
-				const mode = next === 93 ? "osc" : "st-string";
-				const end = findStringEnd(input, index + 2, mode === "osc");
-				if (end === null) return pendingResult(visible, input.slice(index), mode);
-				const sequence = input.slice(index, end);
-				const content = stripStringTerminator(sequence.slice(2));
-				if (next !== 93 || !shouldStripOscSequence(content)) visible.push(sequence);
-				index = end;
-				continue;
-			}
-			const end = findEscapeEnd(input, index + 1);
-			if (end === null) return pendingResult(visible, input.slice(index), "escape");
-			const sequence = input.slice(index, end);
-			visible.push(sequence);
-			index = end;
-			continue;
-		}
-		if (code === 155) {
-			const end = findCsiEnd(input, index + 1);
-			if (end === null) return pendingResult(visible, input.slice(index), "csi");
-			const sequence = input.slice(index, end);
-			const final = sequence.at(-1) ?? "";
-			if (!shouldStripCsiSequence(sequence.slice(1, -1), final)) visible.push(sequence);
-			index = end;
-			continue;
-		}
-		if (isC1StringIntroducer(code)) {
-			const mode = code === 157 ? "osc" : "st-string";
-			const end = findStringEnd(input, index + 1, mode === "osc");
-			if (end === null) return pendingResult(visible, input.slice(index), mode);
-			const sequence = input.slice(index, end);
-			const content = stripStringTerminator(sequence.slice(1));
-			if (code !== 157 || !shouldStripOscSequence(content)) visible.push(sequence);
-			index = end;
-			continue;
-		}
-		visible.push(input[index] ?? "");
-		index += 1;
-	}
-	return {
-		output: visible.join(""),
-		state: nextState
-	};
-}
-function appendBoundedTerminalHistory(current, data, maxBytes) {
-	const combined = Buffer.from(`${current}${data}`, "utf8");
-	if (combined.length <= maxBytes) return combined.toString("utf8");
-	let start = combined.length - maxBytes;
-	while (start < combined.length && (combined[start] & 192) === 128) start += 1;
-	return combined.subarray(start).toString("utf8");
-}
-function pendingResult(visible, pending, mode) {
-	if (bounded(pending)) return {
-		output: visible.join(""),
-		state: {
-			discardSawEscape: false,
-			pending
-		}
-	};
-	return {
-		output: visible.join(""),
-		state: {
-			discardMode: mode,
-			discardSawEscape: (mode === "osc" || mode === "st-string") && pending.endsWith("\x1B"),
-			pending: ""
-		}
-	};
-}
-function discardUntilTerminator(state, data) {
-	let sawEscape = state.discardSawEscape;
-	for (let index = 0; index < data.length; index += 1) {
-		const code = data.charCodeAt(index);
-		if (state.discardMode === "osc" || state.discardMode === "st-string" ? state.discardMode === "osc" && code === 7 || code === 156 || sawEscape && code === 92 : state.discardMode === "csi" ? isCsiFinalByte(code) : isEscapeFinalByte(code)) return {
-			consumed: index + 1,
-			done: true,
-			state: createTerminalHistorySanitizerState()
-		};
-		sawEscape = (state.discardMode === "osc" || state.discardMode === "st-string") && code === 27;
-	}
-	return {
-		consumed: data.length,
-		done: false,
-		state: {
-			discardMode: state.discardMode,
-			discardSawEscape: sawEscape,
-			pending: ""
-		}
-	};
-}
-function bounded(value) {
-	return Buffer.byteLength(value) <= MAX_PENDING_TERMINAL_CONTROL_SEQUENCE_BYTES;
-}
-function findCsiEnd(input, start) {
-	for (let index = start; index < input.length; index += 1) if (isCsiFinalByte(input.charCodeAt(index))) return index + 1;
-	return null;
-}
-function findStringEnd(input, start, allowBel) {
-	for (let index = start; index < input.length; index += 1) {
-		const code = input.charCodeAt(index);
-		if (allowBel && code === 7 || code === 156) return index + 1;
-		if (code === 27 && input.charCodeAt(index + 1) === 92) return index + 2;
-	}
-	return null;
-}
-function findEscapeEnd(input, start) {
-	let index = start;
-	while (index < input.length && isEscapeIntermediateByte(input.charCodeAt(index))) index += 1;
-	if (index >= input.length) return null;
-	return isEscapeFinalByte(input.charCodeAt(index)) ? index + 1 : start;
-}
-function shouldStripCsiSequence(body, final) {
-	if (final === "n") return true;
-	if (final === "R" && /^[0-9;?]*$/.test(body)) return true;
-	return final === "c" && /^[>0-9;?]*$/.test(body);
-}
-function shouldStripOscSequence(content) {
-	return /^(10|11|12);(?:\?|rgb:)/.test(content);
-}
-function stripStringTerminator(value) {
-	if (value.endsWith("\x1B\\")) return value.slice(0, -2);
-	return value.endsWith("\x07") || value.endsWith("œ") ? value.slice(0, -1) : value;
-}
-function isCsiFinalByte(code) {
-	return code >= 64 && code <= 126;
-}
-function isEscapeIntermediateByte(code) {
-	return code >= 32 && code <= 47;
-}
-function isEscapeFinalByte(code) {
-	return code >= 48 && code <= 126;
-}
-function isStringIntroducer(code) {
-	return code === 93 || code === 80 || code === 94 || code === 95;
-}
-function isC1StringIntroducer(code) {
-	return code === 157 || code === 144 || code === 158 || code === 159;
-}
-var TerminalManager = class TerminalManager {
-	terminals = /* @__PURE__ */ new Map();
-	pendingOpens = /* @__PURE__ */ new Map();
-	shell;
-	spawnPty;
-	onEvent;
-	generation = 0;
-	constructor(options = {}) {
-		this.shell = options.shell ?? detectShell();
-		this.spawnPty = options.spawnPty;
-		this.onEvent = options.onEvent ?? (() => {});
-	}
-	static async create() {
-		try {
-			await ensureInstalledNodePtySpawnHelpersExecutable();
-			const { spawn } = await import("node-pty");
-			return new TerminalManager({ spawnPty: spawn });
-		} catch {
-			return new TerminalManager();
-		}
-	}
-	get supported() {
-		return this.spawnPty !== void 0;
-	}
-	setEventHandler(onEvent) {
-		this.onEvent = onEvent;
-	}
-	open(params) {
-		const existing = this.terminals.get(params.terminalId);
-		if (existing) return Promise.resolve({
-			ok: true,
-			snapshot: snapshot$1(existing)
-		});
-		const pending = this.pendingOpens.get(params.terminalId);
-		if (pending) return pending;
-		if (!this.spawnPty) return Promise.resolve({
-			ok: false,
-			errorCode: "pty_start_failed",
-			message: "Interactive terminals are unavailable on this Machine."
-		});
-		if (this.terminals.size + this.pendingOpens.size >= 8) return Promise.resolve({
-			ok: false,
-			errorCode: "terminal_limit_exceeded",
-			message: `A Machine can run at most 8 terminals.`
-		});
-		const generation = this.generation;
-		const tracked = this.openNew(params, generation, this.spawnPty).finally(() => {
-			if (this.pendingOpens.get(params.terminalId) === tracked) this.pendingOpens.delete(params.terminalId);
-		});
-		this.pendingOpens.set(params.terminalId, tracked);
-		return tracked;
-	}
-	async openNew(params, generation, spawnPty) {
-		const cwd = await resolveTerminalCwd(params.cwd);
-		if (!cwd.ok) return cwd;
-		if (generation !== this.generation) return {
-			ok: false,
-			errorCode: "pty_start_failed",
-			message: "Terminal open was cancelled because the connector disconnected."
-		};
-		try {
-			const pty = spawnPty(this.shell.path, this.shell.args, {
-				name: "xterm-256color",
-				cols: params.cols ?? 80,
-				rows: params.rows ?? 24,
-				cwd: cwd.path,
-				env: createTerminalSpawnEnv(process.env)
-			});
-			const session = {
-				terminalId: params.terminalId,
-				pty,
-				cwd: cwd.path,
-				status: "running",
-				history: "",
-				historySanitizer: createTerminalHistorySanitizerState(),
-				exitCode: null,
-				exitSignal: null,
-				sequence: 0,
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				dispose: () => {}
-			};
-			const dataDisposable = pty.onData((data) => this.handleOutput(session, data));
-			const exitDisposable = pty.onExit(({ exitCode, signal }) => this.handleExit(session, exitCode, signal ?? null));
-			session.dispose = () => {
-				dataDisposable.dispose();
-				exitDisposable.dispose();
-			};
-			this.terminals.set(params.terminalId, session);
-			return {
-				ok: true,
-				snapshot: snapshot$1(session)
-			};
-		} catch (error) {
-			return {
-				ok: false,
-				errorCode: "pty_start_failed",
-				message: errorMessage(error, "Failed to start terminal.")
-			};
-		}
-	}
-	write(terminalId, data) {
-		const session = this.terminals.get(terminalId);
-		if (!session) return missingTerminal();
-		if (session.status !== "running") return closedTerminal();
-		try {
-			session.pty.write(data);
-			return mutationSucceeded(session);
-		} catch (error) {
-			return mutationFailed("write_failed", error, "Failed to write terminal input.");
-		}
-	}
-	resize(terminalId, cols, rows) {
-		const session = this.terminals.get(terminalId);
-		if (!session) return missingTerminal();
-		if (session.status !== "running") return closedTerminal();
-		try {
-			session.pty.resize(cols, rows);
-			return mutationSucceeded(session);
-		} catch (error) {
-			return mutationFailed("resize_failed", error, "Failed to resize terminal.");
-		}
-	}
-	clear(terminalId) {
-		const session = this.terminals.get(terminalId);
-		if (!session) return missingTerminal();
-		if (session.status !== "running") return closedTerminal();
-		session.history = "";
-		session.historySanitizer = createTerminalHistorySanitizerState();
-		const response = mutationSucceeded(session);
-		this.emit({
-			type: "terminal/event",
-			machineTerminalEvent: "cleared",
-			terminalId,
-			sequence: session.sequence
-		});
-		return response;
-	}
-	close(terminalId) {
-		const session = this.terminals.get(terminalId);
-		if (!session) return missingTerminal();
-		const previousStatus = session.status;
-		session.status = "closed";
-		try {
-			session.pty.kill();
-			session.dispose();
-			session.historySanitizer = createTerminalHistorySanitizerState();
-			const response = mutationSucceeded(session);
-			this.emit({
-				type: "terminal/event",
-				machineTerminalEvent: "closed",
-				terminalId,
-				sequence: session.sequence
-			});
-			this.terminals.delete(terminalId);
-			return response;
-		} catch (error) {
-			session.status = previousStatus;
-			return mutationFailed("close_failed", error, "Failed to close terminal.");
-		}
-	}
-	closeAll() {
-		this.generation += 1;
-		this.pendingOpens.clear();
-		for (const terminalId of [...this.terminals.keys()]) this.close(terminalId);
-	}
-	handleOutput(session, data) {
-		if (session.status !== "running") return;
-		const sanitized = sanitizeTerminalHistoryChunk(session.historySanitizer, data);
-		session.historySanitizer = sanitized.state;
-		session.history = appendBoundedTerminalHistory(session.history, sanitized.output, MAX_MACHINE_TERMINAL_HISTORY_BYTES);
-		touch(session);
-		this.emit({
-			type: "terminal/event",
-			machineTerminalEvent: "output",
-			terminalId: session.terminalId,
-			sequence: session.sequence,
-			data
-		});
-	}
-	handleExit(session, exitCode, exitSignal) {
-		if (session.status === "closed") return;
-		session.status = "exited";
-		session.exitCode = exitCode;
-		session.exitSignal = exitSignal;
-		session.historySanitizer = createTerminalHistorySanitizerState();
-		touch(session);
-		this.emit({
-			type: "terminal/event",
-			machineTerminalEvent: "exited",
-			terminalId: session.terminalId,
-			sequence: session.sequence,
-			exitCode,
-			exitSignal
-		});
-	}
-	emit(event) {
-		try {
-			this.onEvent(event);
-		} catch {
-			return;
-		}
-	}
-};
-async function ensureInstalledNodePtySpawnHelpersExecutable() {
-	if (process.platform === "win32") return;
-	const packageRoot = dirname(createRequire(import.meta.url).resolve("node-pty/package.json"));
-	await Promise.all([join(packageRoot, "build", "Release", "spawn-helper"), join(packageRoot, "prebuilds", `${process.platform}-${process.arch}`, "spawn-helper")].map(ensureNodePtySpawnHelperExecutable));
-}
-async function ensureNodePtySpawnHelperExecutable(path) {
-	let details;
-	try {
-		details = await stat(path);
-	} catch (error) {
-		if (isNodeError(error) && error.code === "ENOENT") return;
-		throw error;
-	}
-	if (!details.isFile() || (details.mode & 73) === 73) return;
-	await chmod(path, details.mode | 73);
-}
-function isNodeError(error) {
-	return error instanceof Error && "code" in error;
-}
-function snapshot$1(session) {
-	return {
-		terminalId: session.terminalId,
-		cwd: session.cwd,
-		status: session.status,
-		pid: session.pty.pid,
-		history: session.history,
-		exitCode: session.exitCode,
-		exitSignal: session.exitSignal,
-		sequence: session.sequence,
-		updatedAt: session.updatedAt
-	};
-}
-function mutationSucceeded(session) {
-	touch(session);
-	return {
-		ok: true,
-		terminalId: session.terminalId,
-		sequence: session.sequence
-	};
-}
-function touch(session) {
-	session.sequence += 1;
-	session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-}
-function missingTerminal() {
-	return {
-		ok: false,
-		errorCode: "not_found",
-		message: "Terminal was not found."
-	};
-}
-function closedTerminal() {
-	return {
-		ok: false,
-		errorCode: "closed",
-		message: "Terminal is not running."
-	};
-}
-function mutationFailed(errorCode, error, fallback) {
-	return {
-		ok: false,
-		errorCode,
-		message: errorMessage(error, fallback)
-	};
-}
-async function resolveTerminalCwd(cwd) {
-	const path = cwd ? isAbsolute(cwd) ? cwd : resolve(homedir(), cwd) : homedir();
-	try {
-		if ((await stat(path)).isDirectory()) return {
-			ok: true,
-			path
-		};
-	} catch {
-		return invalidCwd$1();
-	}
-	return invalidCwd$1();
-}
-function invalidCwd$1() {
-	return {
-		ok: false,
-		errorCode: "invalid_cwd",
-		message: "Terminal cwd is not a directory."
-	};
-}
-function errorMessage(error, fallback) {
-	return error instanceof Error && error.message ? error.message : fallback;
-}
-//#endregion
-//#region src/text-file-reader.ts
-const TRUNCATION_MARKER = "[truncated]";
-const TAIL_READ_BYTES = 64 * 1024;
-async function readTextFileForRpc(input) {
-	if (input.mode === "tail" && input.offset !== void 0) return invalidRequest("offset is not allowed when mode is tail.");
-	const offset = positiveIntegerOrDefault(input.offset, 1, Number.MAX_SAFE_INTEGER);
-	const limit = positiveIntegerOrDefault(input.limit, DEFAULT_TEXT_FILE_READ_LINES, MAX_TEXT_FILE_READ_LINES);
-	const requestedMaxBytes = positiveIntegerOrDefault(input.maxBytes, DEFAULT_TEXT_FILE_READ_BYTES, MAX_TEXT_FILE_READ_BYTES);
-	if (offset === void 0 || limit === void 0 || requestedMaxBytes === void 0) return invalidRequest("offset, limit, and maxBytes must be positive bounded integers.");
-	const maxBytes = Math.max(requestedMaxBytes, Buffer.byteLength(TRUNCATION_MARKER));
-	try {
-		await assertReadableFile(input.path);
-		if (input.mode === "tail") return await readTextTail(input.path, {
-			limit,
-			maxBytes
-		});
-		return await readTextWindow(input.path, {
-			offset,
-			limit,
-			maxBytes
-		});
-	} catch (error) {
-		return textReadError(error);
-	}
-}
-async function readTextTail(path, input) {
-	const tail = await readTailBytes(path, Math.max(TAIL_READ_BYTES, input.maxBytes + input.limit + 4));
-	const lines = splitTailLines(tail.buffer, !tail.reachedStart);
-	const retained = lines.slice(-input.limit);
-	const chunks = [];
-	let bytes = 0;
-	let omittedByBytes = false;
-	for (let index = retained.length - 1; index >= 0; index -= 1) {
-		const line = retained[index];
-		const overLimit = line.overLimit || line.content.byteLength > input.maxBytes;
-		const content = overLimit ? TRUNCATION_MARKER : line.content.toString("utf8");
-		const lineBytes = Buffer.byteLength(content);
-		if (overLimit || bytes + lineBytes > input.maxBytes) {
-			if (overLimit && chunks.length === 0) {
-				chunks.unshift(TRUNCATION_MARKER);
-				bytes += Buffer.byteLength(TRUNCATION_MARKER);
-				omittedByBytes = index > 0;
-				break;
-			}
-			omittedByBytes = true;
-			break;
-		}
-		chunks.unshift(content);
-		bytes += lineBytes;
-	}
-	const lineCount = chunks.length;
-	const totalLines = tail.reachedStart ? lines.length : void 0;
-	const endLine = totalLines === void 0 || lineCount === 0 ? 0 : totalLines;
-	const startLine = totalLines === void 0 || lineCount === 0 ? 0 : totalLines - lineCount + 1;
-	const offset = startLine || 1;
-	return {
-		ok: true,
-		content: chunks.join(""),
-		offset,
-		limit: input.limit,
-		maxBytes: input.maxBytes,
-		startLine,
-		endLine,
-		...totalLines !== void 0 ? { totalLines } : {},
-		truncated: !tail.reachedStart || lines.length > lineCount || omittedByBytes
-	};
-}
-async function readTailBytes(path, maxBytes) {
-	const handle = await open(path, "r");
-	try {
-		const details = await handle.stat();
-		if (!details.isFile()) throw fileError("not_file", "Path is not a regular file.");
-		const length = Math.min(details.size, maxBytes);
-		const position = details.size - length;
-		const buffer = Buffer.allocUnsafe(length);
-		let offset = 0;
-		while (offset < length) {
-			const { bytesRead } = await handle.read(buffer, offset, length - offset, position + offset);
-			if (bytesRead === 0) break;
-			offset += bytesRead;
-		}
-		return {
-			buffer: buffer.subarray(0, offset),
-			reachedStart: position === 0
-		};
-	} finally {
-		await handle.close();
-	}
-}
-function splitTailLines(buffer, prefixTruncated) {
-	const lines = [];
-	let start = 0;
-	for (let index = 0; index < buffer.byteLength; index += 1) {
-		if (buffer[index] !== 10) continue;
-		lines.push({
-			content: buffer.subarray(start, index + 1),
-			overLimit: prefixTruncated && start === 0
-		});
-		start = index + 1;
-	}
-	if (start < buffer.byteLength) lines.push({
-		content: buffer.subarray(start),
-		overLimit: prefixTruncated && start === 0
-	});
-	return lines;
-}
-async function readPatchSourceForRpc(input) {
-	const maxBytes = positiveIntegerOrDefault(input.maxBytes, MAX_PATCH_SOURCE_FILE_BYTES, MAX_PATCH_SOURCE_FILE_BYTES);
-	if (maxBytes === void 0) return invalidRequest("maxBytes must be a positive bounded integer.");
-	try {
-		const content = await readUtf8FileBounded(input.path, maxBytes);
-		return {
-			ok: true,
-			content,
-			sizeBytes: Buffer.byteLength(content)
-		};
-	} catch (error) {
-		return textReadError(error);
-	}
-}
-async function assertReadableFile(path) {
-	const handle = await open(path, "r");
-	try {
-		if (!(await handle.stat()).isFile()) throw fileError("not_file", "Path is not a regular file.");
-	} finally {
-		await handle.close();
-	}
-}
-async function readUtf8FileBounded(path, maxBytes) {
-	const handle = await open(path, "r");
-	try {
-		const stat = await handle.stat();
-		if (!stat.isFile()) throw fileError("not_file", "Path is not a regular file.");
-		if (stat.size > maxBytes) throw fileError("too_large", `File exceeds ${maxBytes} bytes.`);
-		const buffer = await readBounded(handle, maxBytes);
-		if (buffer.byteLength > maxBytes) throw fileError("too_large", `File exceeds ${maxBytes} bytes.`);
-		return buffer.toString("utf8");
-	} finally {
-		await handle.close();
-	}
-}
-async function readBounded(handle, maxBytes) {
-	const buffer = Buffer.allocUnsafe(maxBytes + 1);
-	let offset = 0;
-	while (offset < buffer.byteLength) {
-		const { bytesRead } = await handle.read(buffer, offset, buffer.byteLength - offset, offset);
-		if (bytesRead === 0) break;
-		offset += bytesRead;
-	}
-	return buffer.subarray(0, offset);
-}
-async function readTextWindow(path, input) {
-	const chunks = [];
-	let bytes = 0;
-	let currentLine = 0;
-	let lineCount = 0;
-	let truncatedByBytes = false;
-	let hasMoreAfterWindow = false;
-	let nextOffset;
-	for await (const line of readCappedLines(path, input.maxBytes)) {
-		currentLine += 1;
-		if (currentLine < input.offset) continue;
-		if (truncatedByBytes) {
-			nextOffset = currentLine;
-			break;
-		}
-		if (lineCount >= input.limit) {
-			hasMoreAfterWindow = true;
-			break;
-		}
-		const lineBytes = Buffer.byteLength(line.content);
-		if (line.overLimit || bytes + lineBytes > input.maxBytes) {
-			truncatedByBytes = true;
-			if (lineCount === 0) {
-				chunks.push(TRUNCATION_MARKER);
-				bytes += Buffer.byteLength(TRUNCATION_MARKER);
-				lineCount += 1;
-				continue;
-			}
-			nextOffset = currentLine;
-			break;
-		}
-		chunks.push(line.content);
-		bytes += lineBytes;
-		lineCount += 1;
-	}
-	const startLine = lineCount === 0 ? 0 : input.offset;
-	const endLine = lineCount === 0 ? 0 : input.offset + lineCount - 1;
-	nextOffset ??= lineCount > 0 && hasMoreAfterWindow ? endLine + 1 : void 0;
-	return {
-		ok: true,
-		content: chunks.join(""),
-		offset: input.offset,
-		limit: input.limit,
-		maxBytes: input.maxBytes,
-		startLine,
-		endLine,
-		truncated: truncatedByBytes || nextOffset !== void 0,
-		...nextOffset !== void 0 ? { nextOffset } : {}
-	};
-}
-async function* readCappedLines(path, maxLineBytes) {
-	let line = "";
-	let lineBytes = 0;
-	let overLimit = false;
-	const pushChar = (char) => {
-		if (!overLimit) {
-			const charBytes = Buffer.byteLength(char);
-			if (lineBytes + charBytes <= maxLineBytes) {
-				line += char;
-				lineBytes += charBytes;
-			} else overLimit = true;
-		}
-	};
-	for await (const chunk of createReadStream(path, { encoding: "utf8" })) for (const char of chunk) {
-		pushChar(char);
-		if (char === "\n") {
-			yield {
-				content: line,
-				overLimit
-			};
-			line = "";
-			lineBytes = 0;
-			overLimit = false;
-		}
-	}
-	if (line.length > 0 || overLimit) yield {
-		content: line,
-		overLimit
-	};
-}
-function positiveIntegerOrDefault(value, fallback, max) {
-	const resolved = value ?? fallback;
-	return Number.isSafeInteger(resolved) && resolved > 0 && resolved <= max ? resolved : void 0;
-}
-function invalidRequest(message) {
-	return {
-		ok: false,
-		errorCode: "invalid_request",
-		message
-	};
-}
-function textReadError(error) {
-	if (isFileError(error)) return {
-		ok: false,
-		errorCode: error.errorCode,
-		message: error.message
-	};
-	const code = typeof error === "object" && error && "code" in error ? error.code : void 0;
-	if (code === "ENOENT" || code === "ENOTDIR") return {
-		ok: false,
-		errorCode: "not_found",
-		message: "File was not found."
-	};
-	if (code === "EACCES" || code === "EPERM") return {
-		ok: false,
-		errorCode: "permission_denied",
-		message: "Permission denied."
-	};
-	return {
-		ok: false,
-		errorCode: "read_failed",
-		message: error instanceof Error ? error.message : "File read failed."
-	};
-}
-function fileError(errorCode, message) {
-	const error = new Error(message);
-	error.errorCode = errorCode;
-	return error;
-}
-function isFileError(error) {
-	return error instanceof Error && "errorCode" in error && (error.errorCode === "not_file" || error.errorCode === "too_large");
-}
-var JobManager = class {
-	jobs = /* @__PURE__ */ new Map();
-	shell;
-	now;
-	randomId;
-	homeDirectory;
-	statPath;
-	createDirectory;
-	setPermissions;
-	openLog;
-	removeFile;
-	spawnProcess;
-	signalProcessGroup;
-	runTaskkill;
-	startWatchdog;
-	wait;
-	startQueue = Promise.resolve();
-	stopping = false;
-	constructor(options = {}) {
-		this.shell = options.shell ?? detectShell();
-		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-		this.randomId = options.randomId ?? randomUUID;
-		this.homeDirectory = options.homeDirectory ?? homedir();
-		this.statPath = options.statPath ?? stat;
-		this.createDirectory = options.createDirectory ?? mkdir;
-		this.setPermissions = options.setPermissions ?? chmod;
-		this.openLog = options.openLog ?? openJobLog;
-		this.removeFile = options.removeFile ?? unlink;
-		this.spawnProcess = options.spawnProcess ?? spawnJobProcess;
-		this.signalProcessGroup = options.signalProcessGroup ?? signalPosixProcessGroup;
-		this.runTaskkill = options.runTaskkill ?? runWindowsTaskkill;
-		this.startWatchdog = options.startWatchdog ?? startParentWatchdog;
-		this.wait = options.wait ?? wait;
-	}
-	async start(input) {
-		if (this.stopping) return managerStopping();
-		let releaseStart = () => {};
-		const previousStart = this.startQueue;
-		this.startQueue = new Promise((resolve) => {
-			releaseStart = resolve;
-		});
-		await previousStart;
-		try {
-			if (this.stopping) return managerStopping();
-			return await this.startExclusive(input);
+	let local = await discoverLocalConnector({
+		deploymentId: deployment.deploymentId,
+		serviceKey: deployment.serviceKey
+	});
+	if (local.state === "ownership_conflict") throw Object.assign(/* @__PURE__ */ new Error("The local connector service belongs to another deployment."), { code: "ownership_conflict" });
+	const storedProfile = await store.getProfile(deployment.deploymentId);
+	if (local.entry) {
+		await adoptInstalledConnectorBinding({
+			store,
+			deployment,
+			entry: local.entry,
+			allowInsecureTls: options.allowInsecureTls
+		});
+		if (local.state === "needs_bootstrap" && !storedProfile?.bootstrapReceipt) {
+			local = await restartInstalledConnector(deployment.deploymentId, deployment.serviceKey);
+			if (local.state !== "ready") throw Object.assign(/* @__PURE__ */ new Error("The installed connector service could not be started."), { code: "installed_connector_unavailable" });
+		}
+	}
+	if (local.state === "needs_bootstrap" && storedProfile?.bootstrapReceipt) {
+		const recoveredRelease = await (options.snapshotResolver ?? resolveVerifiedConnectorSnapshot)(storedProfile.bootstrapReceipt.snapshot);
+		try {
+			const recovered = await withDeploymentReconciliationLock({
+				serviceKey: deployment.serviceKey,
+				run: () => resumeConnectorBootstrap({
+					deployment,
+					store,
+					release: recoveredRelease,
+					allowInsecureTls: insecureTlsForServer(serverUrl, deployment.serverUrl, options.allowInsecureTls ?? storedProfile.allowInsecureTls),
+					reconciliationLockHeld: true
+				})
+			});
+			console.log(`Logged in to ${deployment.serverUrl}.`);
+			console.log(`Machine: ${recovered.machineId}`);
+			return;
 		} finally {
-			releaseStart();
+			await recoveredRelease.dispose();
 		}
 	}
-	async startExclusive(input) {
-		this.pruneExpired();
-		const active = [...this.jobs.values()].filter((job) => job.status === "running").sort((left, right) => left.startedAt.localeCompare(right.startedAt));
-		if (active.length >= 8) {
-			const oldest = active[0];
-			return {
-				ok: false,
-				errorCode: "too_large",
-				message: `A Machine can run at most 8 background jobs. Oldest active job: ${oldest.jobId} (started ${oldest.startedAt}).`
-			};
-		}
-		const cwd = input.cwd ? isAbsolute(input.cwd) ? input.cwd : resolve(this.homeDirectory, input.cwd) : this.homeDirectory;
-		try {
-			if (!(await this.statPath(cwd)).isDirectory()) return invalidCwd();
-		} catch {
-			return invalidCwd();
-		}
-		const jobId = this.randomId();
-		const logPath = machineJobLogPath(this.shell.os, jobId);
-		let log;
-		try {
-			await this.prepareLogDirectory();
-			log = await this.openLog(logPath);
-		} catch (error) {
-			return {
-				ok: false,
-				errorCode: "unavailable",
-				message: boundedError(error, "Could not create the background job log.")
-			};
-		}
-		let process;
-		try {
-			process = this.spawnProcess(this.shell.path, oneShotShellArgs(this.shell, input.command), {
-				cwd,
-				env: { ...globalThis.process.env },
-				detached: this.shell.os !== "windows",
-				windowsHide: true
+	let release;
+	if (local.state === "needs_bootstrap" && !options.serviceInstaller) release = await (options.releaseResolver ?? resolveVerifiedConnectorRelease)(deployment);
+	try {
+		let bindingReauthorizations = 0;
+		while (true) {
+			const device = await startConnectorDeviceAuthorization({
+				serverUrl,
+				store,
+				deviceLabel: hostname(),
+				allowInsecureTls: options.allowInsecureTls,
+				...release ? { bootstrap: {
+					policyDigest: deployment.policyDigest,
+					releaseTuple: release.snapshot.tuple
+				} } : {}
 			});
-		} catch (error) {
-			await closeAndRemoveEmptyLog(log, logPath, this.removeFile);
-			return {
-				ok: false,
-				errorCode: "execution_failed",
-				message: boundedError(error, "Could not start the background job.")
-			};
-		}
-		const spawned = await waitForSpawn(process);
-		if (!spawned.ok || !process.pid) {
-			await closeAndRemoveEmptyLog(log, logPath, this.removeFile);
-			return {
-				ok: false,
-				errorCode: "execution_failed",
-				message: boundedError(spawned.ok ? void 0 : spawned.error, "Could not start the background job.")
-			};
-		}
-		let job;
-		const pendingOutput = [];
-		let pendingClose;
-		process.stdout.on("data", (chunk) => {
-			if (job) this.enqueueOutput(job, chunk);
-			else pendingOutput.push(chunk);
-		});
-		process.stderr.on("data", (chunk) => {
-			if (job) this.enqueueOutput(job, chunk);
-			else pendingOutput.push(chunk);
-		});
-		process.once("close", (exitCode, signal) => {
-			if (job) this.handleProcessClose(job, exitCode, signal);
-			else pendingClose = {
-				exitCode,
-				signal
-			};
-		});
-		const timestamp = this.now().toISOString();
-		let watchdog;
-		try {
-			watchdog = await this.startWatchdog(globalThis.process.pid, process.pid, this.shell.os);
-		} catch (error) {
-			let cleanupError;
-			try {
-				await this.forceTerminateStartedProcess(process.pid);
-			} catch (terminationError) {
-				cleanupError = terminationError;
-			}
-			await closeAndRemoveEmptyLog(log, logPath, this.removeFile);
-			return {
-				ok: false,
-				errorCode: "execution_failed",
-				message: cleanupError ? `${boundedError(error, "Could not start the background job watchdog.")} Process-tree cleanup also failed: ${boundedError(cleanupError, "unknown error")}`.slice(0, 1e3) : boundedError(error, "Could not start the background job watchdog.")
+			console.log(`Open ${device.verificationUriComplete}`);
+			console.log(`Code: ${device.userCode}`);
+			if (options.openBrowser !== false) openBrowser(device.verificationUriComplete);
+			await pollConnectorDeviceToken({
+				serverUrl: device.serverUrl,
+				deploymentId: device.deploymentId,
+				store,
+				deviceCode: device.deviceCode,
+				intervalSeconds: device.interval,
+				expiresInSeconds: device.expiresIn,
+				allowInsecureTls: insecureTlsForServer(serverUrl, device.serverUrl, options.allowInsecureTls)
+			});
+			const finishSetup = async () => {
+				const currentDeployment = await discoverDeploymentForStore({
+					serverUrl: device.serverUrl,
+					store,
+					allowInsecureTls: options.allowInsecureTls
+				});
+				if (currentDeployment.deploymentId !== deployment.deploymentId || currentDeployment.policyDigest !== deployment.policyDigest) throw Object.assign(/* @__PURE__ */ new Error("Connector deployment policy changed during login."), { code: "bootstrap_policy_drift" });
+				const currentLocal = await discoverLocalConnector({
+					deploymentId: deployment.deploymentId,
+					serviceKey: deployment.serviceKey
+				});
+				if (currentLocal.state === "ownership_conflict") throw Object.assign(/* @__PURE__ */ new Error("The local connector service belongs to another deployment."), { code: "ownership_conflict" });
+				if (currentLocal.entry) {
+					const adopted = await adoptInstalledConnectorBinding({
+						store,
+						deployment: currentDeployment,
+						entry: currentLocal.entry,
+						allowInsecureTls: insecureTlsForServer(serverUrl, device.serverUrl, options.allowInsecureTls)
+					});
+					if (adopted.staleCredentials) throw new BindingReauthorizationRequired(adopted.staleCredentials.refreshToken);
+				}
+				if (release && currentLocal.entry && currentLocal.state !== "ready") throw Object.assign(/* @__PURE__ */ new Error("The installed connector service could not be reconciled."), { code: "installed_connector_unavailable" });
+				return setupConnectorProfile({
+					serverUrl: device.serverUrl,
+					store,
+					name: options.name,
+					installService: release ? false : options.installService ?? Boolean(options.serviceInstaller),
+					serviceInstaller: options.serviceInstaller,
+					allowInsecureTls: insecureTlsForServer(serverUrl, device.serverUrl, options.allowInsecureTls),
+					...release && currentLocal.state !== "ready" ? {
+						bootstrap: {
+							release,
+							policyDigest: deployment.policyDigest,
+							releaseTuple: release.snapshot.tuple
+						},
+						reconciliationLockHeld: true
+					} : {}
+				});
 			};
-		}
-		let resolveClosed = () => {};
-		const closePromise = new Promise((resolve) => {
-			resolveClosed = resolve;
-		});
-		job = {
-			jobId,
-			process,
-			pid: process.pid,
-			cwd,
-			startedAt: timestamp,
-			updatedAt: timestamp,
-			status: "running",
-			exitCode: null,
-			exitSignal: null,
-			fullLogPath: void 0,
-			errorCode: void 0,
-			message: void 0,
-			pendingError: void 0,
-			tail: Buffer.alloc(0),
-			tailStartCursor: 0,
-			nextCursor: 0,
-			log,
-			writeQueue: Promise.resolve(),
-			logFailed: false,
-			closePromise,
-			resolveClosed,
-			killRequested: false,
-			processClosed: false,
-			watchdog
-		};
-		this.jobs.set(jobId, job);
-		for (const chunk of pendingOutput) this.enqueueOutput(job, chunk);
-		if (pendingClose) this.handleProcessClose(job, pendingClose.exitCode, pendingClose.signal);
-		return {
-			ok: true,
-			job: snapshot(job)
-		};
-	}
-	get(input) {
-		this.pruneExpired();
-		const job = this.jobs.get(input.jobId);
-		if (!job) return jobNotFound();
-		const requestedCursor = input.cursor ?? 0;
-		const cursor = Math.max(requestedCursor, job.tailStartCursor);
-		const safeEnd = completeUtf8PrefixLength(job.tail);
-		const relativeCursor = Math.min(Math.max(cursor - job.tailStartCursor, 0), safeEnd);
-		const safeRelativeCursor = nextUtf8Boundary(job.tail, relativeCursor);
-		const actualCursor = job.tailStartCursor + safeRelativeCursor;
-		const nextCursor = job.tailStartCursor + safeEnd;
-		const response = {
-			ok: true,
-			job: snapshot(job),
-			output: job.tail.subarray(safeRelativeCursor, safeEnd).toString("utf8"),
-			cursor: actualCursor,
-			nextCursor,
-			gapBytes: Math.max(0, actualCursor - requestedCursor)
-		};
-		if (job.status !== "running") this.jobs.delete(job.jobId);
-		return response;
-	}
-	async kill(input) {
-		this.pruneExpired();
-		const job = this.jobs.get(input.jobId);
-		if (!job) return jobNotFound();
-		if (job.status !== "running") return {
-			ok: true,
-			job: snapshot(job)
-		};
-		if (job.killPromise) return job.killPromise;
-		const killPromise = this.killRunning(job);
-		job.killPromise = killPromise;
-		const result = await killPromise;
-		if (!result.ok && job.killPromise === killPromise) job.killPromise = void 0;
-		return result;
-	}
-	async stop() {
-		this.stopping = true;
-		await this.startQueue;
-		const active = [...this.jobs.values()].filter((job) => job.status === "running");
-		await Promise.all(active.map(async (job) => {
-			if (!(await this.kill({ jobId: job.jobId })).ok) {
-				const retry = await this.kill({ jobId: job.jobId });
-				if (!retry.ok) throw new Error(retry.message);
-			}
-		}));
-		await Promise.all([...this.jobs.values()].map((job) => job.closePromise));
-		this.jobs.clear();
-	}
-	enqueueOutput(job, value) {
-		const bytes = Buffer.isBuffer(value) ? value : Buffer.from(String(value));
-		job.writeQueue = job.writeQueue.then(async () => {
-			if (job.logFailed) return;
-			job.nextCursor += bytes.byteLength;
-			job.tail = appendBoundedUtf8Bytes(job.tail, bytes, MAX_MACHINE_JOB_OUTPUT_BYTES);
-			job.tailStartCursor = job.nextCursor - job.tail.byteLength;
-			job.updatedAt = this.now().toISOString();
 			try {
-				let written = 0;
-				while (written < bytes.byteLength) {
-					const bytesWritten = await job.log.write(bytes.subarray(written));
-					if (!Number.isSafeInteger(bytesWritten) || bytesWritten <= 0) throw new Error("The background job log write made no progress.");
-					written += bytesWritten;
-				}
+				const setup = release ? await withDeploymentReconciliationLock({
+					serviceKey: deployment.serviceKey,
+					run: finishSetup
+				}) : await finishSetup();
+				console.log(`Logged in to ${device.serverUrl}.`);
+				console.log(`Machine: ${setup.machineId}`);
+				return;
 			} catch (error) {
-				job.logFailed = true;
-				job.pendingError = {
-					errorCode: "unavailable",
-					message: boundedError(error, "The background job log could not be written.")
-				};
-				this.terminate(job).catch((killError) => {
-					job.pendingError = {
-						errorCode: "unavailable",
-						message: `${job.pendingError?.message ?? "The background job log failed."} Process-tree termination also failed: ${boundedError(killError, "unknown error")}`.slice(0, 1e3)
-					};
-				});
+				if (!(error instanceof BindingReauthorizationRequired) || bindingReauthorizations >= 1) throw error;
+				bindingReauthorizations += 1;
+				await new CliAuthClient(device.serverUrl, { allowInsecureTls: insecureTlsForServer(serverUrl, device.serverUrl, options.allowInsecureTls) }).revoke(error.refreshToken).catch(() => void 0);
 			}
-		});
-	}
-	async finish(job, exitCode, signal) {
-		await job.writeQueue;
-		try {
-			await job.log.close();
-		} catch (error) {
-			job.logFailed = true;
-			job.pendingError = {
-				errorCode: "unavailable",
-				message: boundedError(error, "The background job log could not be closed.")
-			};
-		}
-		job.exitCode = exitCode;
-		job.exitSignal = signal;
-		if (job.logFailed) {
-			job.status = "failed";
-			job.fullLogPath = void 0;
-			job.errorCode = job.pendingError?.errorCode ?? "unavailable";
-			job.message = job.pendingError?.message ?? "The background job log is incomplete.";
-		} else if (job.killRequested) {
-			job.status = "killed";
-			job.fullLogPath = machineJobLogPath(this.shell.os, job.jobId);
-		} else if (exitCode === 0) {
-			job.status = "completed";
-			job.fullLogPath = machineJobLogPath(this.shell.os, job.jobId);
-		} else {
-			job.status = "failed";
-			job.errorCode = "execution_failed";
-			job.message = `Background job exited with code ${exitCode ?? "unknown"}${signal ? ` (${signal})` : ""}.`;
-			job.fullLogPath = machineJobLogPath(this.shell.os, job.jobId);
-		}
-		job.updatedAt = this.now().toISOString();
-		job.completedAtMs = this.now().getTime();
-		job.resolveClosed();
-	}
-	handleProcessClose(job, exitCode, signal) {
-		job.processClosed = true;
-		job.exitCode = exitCode;
-		job.exitSignal = signal;
-		job.watchdog.stop();
-		this.finish(job, exitCode, signal);
-	}
-	async killRunning(job) {
-		if (job.processClosed) {
-			await job.closePromise;
-			return {
-				ok: true,
-				job: snapshot(job)
-			};
-		}
-		job.killRequested = true;
-		job.updatedAt = this.now().toISOString();
-		try {
-			await this.terminate(job);
-			await job.closePromise;
-			return {
-				ok: true,
-				job: snapshot(job)
-			};
-		} catch (error) {
-			if (job.completedAtMs !== void 0) return {
-				ok: true,
-				job: snapshot(job)
-			};
-			job.killRequested = false;
-			return {
-				ok: false,
-				errorCode: "unavailable",
-				message: boundedError(error, "Could not stop the background job process tree.")
-			};
 		}
+	} finally {
+		await release?.dispose();
 	}
-	async terminate(job) {
-		if (job.processClosed || job.completedAtMs !== void 0) return;
-		if (this.shell.os === "windows") {
-			await this.runTaskkill(job.pid, false);
-			if (!await waitForClose(job.closePromise, this.wait, 5e3)) await this.runTaskkill(job.pid, true);
-			return;
-		}
-		await this.signalProcessGroup(job.pid, "SIGTERM");
-		if (!await waitForClose(job.closePromise, this.wait, 5e3)) await this.signalProcessGroup(job.pid, "SIGKILL");
-	}
-	async prepareLogDirectory() {
-		const directory = machineJobLogDirectory(this.shell.os);
-		await this.createDirectory(directory, {
-			recursive: true,
-			...this.shell.os === "windows" ? {} : { mode: 448 }
-		});
-		if (this.shell.os === "windows") return;
-		await this.setPermissions(directory, 448);
-		const details = await this.statPath(directory);
-		const owner = typeof process.getuid === "function" ? process.getuid() : void 0;
-		if (!details.isDirectory() || owner !== void 0 && details.uid !== owner || (details.mode & 63) !== 0) throw new Error("The background job log directory is not private to this connector user.");
-	}
-	async forceTerminateStartedProcess(pid) {
-		if (this.shell.os === "windows") await this.runTaskkill(pid, true);
-		else await this.signalProcessGroup(pid, "SIGKILL");
-	}
-	pruneExpired() {
-		const now = this.now().getTime();
-		for (const [jobId, job] of this.jobs) if (job.completedAtMs !== void 0 && now - job.completedAtMs >= 36e5) this.jobs.delete(jobId);
-	}
-};
-function machineJobLogDirectory(os) {
-	return os === "windows" ? "C:\\Windows\\Temp\\agents\\tool-output" : "/tmp/agents/tool-output";
-}
-function machineJobLogPath(os, jobId) {
-	const safeId = jobId.replace(/[^A-Za-z0-9._-]/g, "-");
-	const directory = machineJobLogDirectory(os);
-	return os === "windows" ? win32.join(directory, `job-${safeId}.txt`) : posix.join(directory, `job-${safeId}.txt`);
 }
-function oneShotShellArgs(shell, command) {
-	if (shell.os === "windows") {
-		if (shell.name === "cmd") return [
-			"/d",
-			"/s",
-			"/c",
-			command
-		];
-		return [...shell.args.filter((arg) => arg !== "-"), command];
+var BindingReauthorizationRequired = class extends Error {
+	refreshToken;
+	constructor(refreshToken) {
+		super("Connector binding changed during authorization.");
+		this.refreshToken = refreshToken;
 	}
-	return [
-		...shell.args,
-		"-c",
-		command
-	];
-}
-function spawnJobProcess(file, args, options) {
-	return spawn(file, args, {
-		...options,
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-}
-async function openJobLog(path) {
-	const handle = await open(path, "wx", 384);
+};
+async function serviceLocalConfigInput(options) {
+	const profile = options.serverUrl ? await options.store.findProfileForServerUrl(options.serverUrl) : await options.store.getActiveProfile();
+	if (!profile) throw new Error("Connector deployment profile was not found. Run agents login.");
 	return {
-		write: async (data) => (await handle.write(data)).bytesWritten,
-		close: () => handle.close()
+		deploymentId: profile.deploymentId,
+		serviceKey: deploymentServiceKey(profile.deploymentId)
 	};
 }
-async function signalPosixProcessGroup(pid, signal) {
-	try {
-		process.kill(-pid, signal);
-	} catch (error) {
-		if (error.code !== "ESRCH") throw error;
-	}
-}
-async function runWindowsTaskkill(pid, force) {
-	const args = [
-		"/PID",
-		String(pid),
-		"/T",
-		...force ? ["/F"] : []
-	];
-	await new Promise((resolve, reject) => {
-		execFile("taskkill.exe", args, { windowsHide: true }, (error) => {
-			if (error && error.code !== "ESRCH") reject(error);
-			else resolve();
-		});
-	});
+async function logout(options = {}) {
+	const store = options.store ?? new TokenStore();
+	const serverUrl = await store.resolveServerUrl(options.serverUrl);
+	const storedProfile = options.serverUrl ? await store.findStoredProfileForServerUrl(serverUrl) : await store.getActiveProfile();
+	if (!storedProfile) throw new Error(`Not logged in to ${serverUrl}.`);
+	const removed = await store.removeClientCredentials(storedProfile.deploymentId);
+	const refreshTokens = new Set([removed.active?.refreshToken, removed.pending?.refreshToken].filter((value) => Boolean(value)));
+	const revokeServerUrl = (await discoverDeploymentForStore({
+		serverUrl: storedProfile.canonicalOrigin,
+		store,
+		allowInsecureTls: options.allowInsecureTls ?? storedProfile.allowInsecureTls
+	}).catch(() => void 0))?.serverUrl ?? storedProfile.canonicalOrigin;
+	const auth = new CliAuthClient(revokeServerUrl, { allowInsecureTls: insecureTlsForServer(storedProfile.canonicalOrigin, revokeServerUrl, options.allowInsecureTls ?? storedProfile.allowInsecureTls) });
+	await Promise.all([...refreshTokens].map((refreshToken) => auth.revoke(refreshToken).catch(() => void 0)));
+	console.log(`Logged out of ${revokeServerUrl}.`);
 }
-async function startParentWatchdog(connectorPid, jobPid, os) {
-	const child = spawn(process.execPath, [
-		"-e",
-		PARENT_WATCHDOG_SCRIPT,
-		String(connectorPid),
-		String(jobPid),
-		os
-	], {
-		detached: true,
-		stdio: "ignore",
-		windowsHide: true
-	});
-	await new Promise((resolve, reject) => {
-		child.once("spawn", resolve);
-		child.once("error", reject);
+async function whoami(options = {}) {
+	const store = options.store ?? new TokenStore();
+	const serverUrl = await store.resolveServerUrl(options.serverUrl);
+	const deployment = await discoverDeploymentForStore({
+		serverUrl,
+		store,
+		allowInsecureTls: options.allowInsecureTls
 	});
-	child.on("error", () => void 0);
-	child.unref();
-	return { stop: () => {
-		try {
-			child.kill();
-		} catch {}
-	} };
-}
-const PARENT_WATCHDOG_SCRIPT = String.raw`
-const { execFileSync } = require("node:child_process");
-const [connectorText, jobText, os] = process.argv.slice(1);
-const connectorPid = Number(connectorText);
-const jobPid = Number(jobText);
-function alive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-setInterval(() => {
-  if (!alive(jobPid)) process.exit(0);
-  if (alive(connectorPid)) return;
-  try {
-    if (os === "windows") {
-      execFileSync("taskkill.exe", ["/PID", String(jobPid), "/T", "/F"], {
-        windowsHide: true,
-        stdio: "ignore",
-      });
-    } else {
-      process.kill(-jobPid, "SIGKILL");
-    }
-  } catch {}
-  process.exit(0);
-}, 250);
-`;
-function waitForSpawn(process) {
-	return new Promise((resolve) => {
-		process.once("spawn", () => resolve({ ok: true }));
-		process.once("error", (error) => resolve({
-			ok: false,
-			error
-		}));
+	const profile = await store.getProfile(deployment.deploymentId);
+	if (!profile?.refreshToken) throw new Error(`Not logged in to ${serverUrl}. Run agents login.`);
+	await ensureAccessToken({
+		serverUrl: deployment.serverUrl,
+		deploymentId: deployment.deploymentId,
+		store,
+		allowInsecureTls: insecureTlsForServer(serverUrl, deployment.serverUrl, options.allowInsecureTls ?? profile.allowInsecureTls)
 	});
+	console.log(`Server: ${deployment.serverUrl}`);
+	console.log(`Machine: ${profile.machineId ?? "not claimed yet"}`);
 }
-async function waitForClose(closePromise, sleep, milliseconds) {
-	return Promise.race([closePromise.then(() => true), sleep(milliseconds).then(() => false)]);
-}
-function wait(milliseconds) {
-	return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
-function snapshot(job) {
-	return {
-		jobId: job.jobId,
-		status: job.status,
-		cwd: job.cwd,
-		startedAt: job.startedAt,
-		updatedAt: job.updatedAt,
-		exitCode: job.exitCode,
-		exitSignal: job.exitSignal,
-		...job.fullLogPath ? { fullLogPath: job.fullLogPath } : {},
-		...job.errorCode ? {
-			errorCode: job.errorCode,
-			message: job.message
-		} : {}
-	};
-}
-function invalidCwd() {
-	return {
-		ok: false,
-		errorCode: "invalid_cwd",
-		message: "Background job cwd is not a directory."
-	};
-}
-function jobNotFound() {
-	return {
-		ok: false,
-		errorCode: "not_found",
-		message: "Background job was not found."
-	};
-}
-function nextUtf8Boundary(buffer, offset) {
-	let next = offset;
-	while (next < buffer.length && (buffer[next] & 192) === 128) next += 1;
-	return next;
-}
-function completeUtf8PrefixLength(buffer) {
-	if (buffer.length === 0) return 0;
-	let start = buffer.length - 1;
-	while (start > 0 && (buffer[start] & 192) === 128) start -= 1;
-	const first = buffer[start];
-	const expected = (first & 128) === 0 ? 1 : (first & 224) === 192 ? 2 : (first & 240) === 224 ? 3 : 4;
-	return buffer.length - start < expected ? start : buffer.length;
-}
-function appendBoundedUtf8Bytes(current, chunk, maxBytes) {
-	const combined = Buffer.concat([current, chunk]);
-	if (combined.byteLength <= maxBytes) return combined;
-	let start = combined.byteLength - maxBytes;
-	while (start < combined.byteLength && (combined[start] & 192) === 128) start += 1;
-	return combined.subarray(start);
-}
-async function closeAndRemoveEmptyLog(log, path, removeFile) {
-	await log.close().catch(() => void 0);
-	await removeFile(path).catch(() => void 0);
-}
-function boundedError(error, fallback) {
-	return (error instanceof Error && error.message ? error.message : fallback).slice(0, 1e3);
+function openBrowser(url) {
+	const command = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open";
+	const args = platform() === "win32" ? [
+		"/c",
+		"start",
+		"",
+		url
+	] : [url];
+	try {
+		const child = spawn(command, args, {
+			stdio: "ignore",
+			detached: true
+		});
+		child.once("error", () => void 0);
+		child.unref();
+	} catch {}
 }
-function managerStopping() {
+async function readInstalledBinding(path, deploymentId) {
+	const value = JSON.parse(await readFile(path, "utf8"));
+	if (value.deploymentId !== deploymentId || typeof value.connectorInstallId !== "string" || typeof value.challenge !== "string" || typeof value.machineId !== "string") throw Object.assign(/* @__PURE__ */ new Error("Installed connector binding is invalid."), { code: "ownership_conflict" });
 	return {
-		ok: false,
-		errorCode: "unavailable",
-		message: "The Machine connector is stopping and cannot start a background job."
-	};
+		connectorInstallId: value.connectorInstallId,
+		challenge: value.challenge,
+		machineId: value.machineId
+	};
+}
+async function adoptInstalledConnectorBinding(input) {
+	const binding = await readInstalledBinding(input.entry.configPath, input.deployment.deploymentId);
+	return input.store.adoptPendingDeploymentBinding(input.deployment, {
+		connectorInstallId: binding.connectorInstallId,
+		challenge: binding.challenge,
+		machineId: binding.machineId,
+		allowInsecureTls: input.allowInsecureTls
+	});
 }
-var ConnectorClient = class {
-	options;
-	shellManager = new ShellManager();
-	jobManager;
-	terminalManagerPromise;
-	socket;
-	reconnectTimer;
-	stableTimer;
-	stopPromise;
-	stopped = false;
-	reconnectAttempt = 0;
-	authFailureRetried = false;
-	mcpGenerations = /* @__PURE__ */ new Set();
-	constructor(options) {
-		this.options = options;
-		this.jobManager = options.jobManager ?? new JobManager();
-		this.terminalManagerPromise = options.terminalManager ? Promise.resolve(options.terminalManager) : TerminalManager.create();
-	}
-	start() {
-		this.stopped = false;
-		this.authFailureRetried = false;
-		this.connect();
-	}
-	async stop(force = false) {
-		this.stopped = true;
-		if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
-		if (this.stableTimer) clearTimeout(this.stableTimer);
-		this.reconnectTimer = void 0;
-		this.stableTimer = void 0;
-		this.shellManager.closeAll();
-		this.stopPromise ??= this.stopOwnedResources();
-		if (!force) return this.stopPromise;
-		const forceResults = await Promise.allSettled([...this.mcpGenerations].map((generation) => generation.close(true)));
-		const cleanupResults = await Promise.allSettled([this.stopPromise]);
-		throwCleanupFailures([...forceResults, ...cleanupResults]);
-	}
-	async stopOwnedResources() {
-		const cleanup = [
-			this.jobManager.stop(),
-			this.terminalManagerPromise.then((manager) => manager.closeAll()),
-			...[...this.mcpGenerations].map((generation) => generation.close())
-		];
-		const failures = [];
-		try {
-			disposeMachineFileSearchIndexes();
-		} catch (error) {
-			failures.push(error);
-		}
-		try {
-			this.socket?.close();
-		} catch (error) {
-			failures.push(error);
-		}
-		throwCleanupFailures(await Promise.allSettled(cleanup), failures);
-	}
-	async connect(options = {}) {
-		const terminalManager = await this.terminalManagerPromise;
-		let accessToken;
-		try {
-			accessToken = await this.options.accessTokenProvider(options);
-		} catch (error) {
-			const message = error instanceof Error ? error.message : "Failed to refresh connector access token.";
-			console.error(message.includes("Run agents login") ? message : `${message} Run agents login.`);
-			await this.stop();
-			return;
-		}
-		if (this.stopped) return;
-		allowInsecureTlsForLocalTesting(this.options);
-		const socket = new WebSocket(toWebSocketUrl(this.options.serverUrl), {
-			maxPayload: CONNECTOR_MAX_WEBSOCKET_PAYLOAD_BYTES,
-			headers: { authorization: `Bearer ${accessToken}` },
-			...this.options.allowInsecureTls ? { rejectUnauthorized: false } : {}
-		});
-		const mcpGeneration = new ConnectorMcpGeneration(socket);
-		this.mcpGenerations.add(mcpGeneration);
-		terminalManager.setEventHandler((event) => this.sendTerminalEvent(socket, terminalManager, event));
-		this.socket = socket;
-		socket.on("open", () => {
-			this.stableTimer = setTimeout(() => {
-				this.reconnectAttempt = 0;
-				this.authFailureRetried = false;
-				this.stableTimer = void 0;
-			}, stableConnectionMs());
-			socket.send(JSON.stringify(this.createHello(terminalManager)));
-		});
-		socket.on("message", (data) => {
-			if (mcpGeneration.handles(data)) {
-				mcpGeneration.accept(data);
-				return;
-			}
-			this.handleMessage(socket, data.toString());
-		});
-		socket.on("close", (code, reason) => {
-			if (this.stableTimer) clearTimeout(this.stableTimer);
-			this.stableTimer = void 0;
-			this.shellManager.closeAll();
-			terminalManager.closeAll();
-			mcpGeneration.close().finally(() => this.mcpGenerations.delete(mcpGeneration));
-			if (code === 1008) {
-				if (!this.authFailureRetried && this.options.reconnect !== false && !this.stopped) {
-					this.authFailureRetried = true;
-					this.connect({ forceRefresh: true });
-					return;
-				}
-				const message = reason.toString() || "connector authentication failed";
-				console.error(`Connector stopped: ${message}`);
-				this.stop().catch((error) => {
-					console.error(error instanceof Error ? error.message : "Connector cleanup failed after auth failure.");
-				});
-				return;
-			}
-			this.scheduleReconnect();
-		});
-		socket.on("error", (error) => {
-			console.error("Connector websocket error:", error.message);
-		});
-	}
-	async handleMessage(socket, raw) {
-		const value = parseJson(raw);
-		if (!isServerRpcRequest(value)) {
-			this.send(socket, {
-				type: "rpc/error",
-				id: requestId(value),
-				error: {
-					code: "invalid_request",
-					message: "Invalid connector RPC request."
-				}
-			});
-			return;
-		}
-		if (value.method === "shell/exec") {
-			const result = await this.shellManager.exec(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "shell/job_start") {
-			const result = await this.jobManager.start(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "shell/job_get") {
-			const result = this.jobManager.get(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "shell/job_kill") {
-			const result = await this.jobManager.kill(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		const terminalManager = await this.terminalManagerPromise;
-		if (value.method === "terminal/open") {
-			const result = await terminalManager.open(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "terminal/write") {
-			const result = terminalManager.write(value.params.terminalId, value.params.data);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "terminal/resize") {
-			const result = terminalManager.resize(value.params.terminalId, value.params.cols, value.params.rows);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "terminal/clear") {
-			const result = terminalManager.clear(value.params.terminalId);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "terminal/close") {
-			const result = terminalManager.close(value.params.terminalId);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "file/read") {
-			const result = await readFileForRpc(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "file/read_text") {
-			const result = await readTextFileForRpc(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "file/read_patch_source") {
-			const result = await readPatchSourceForRpc(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "file/write") {
-			const result = await writeFileForRpc(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "file/delete") {
-			const result = await deleteFileForRpc(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "file/move") {
-			const result = await moveFileForRpc(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "file/search_entries") {
-			const result = await searchFileEntriesForRpc(value.params);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result
-			});
-			return;
-		}
-		if (value.method === "shell/close") {
-			this.shellManager.close(value.params.shellId);
-			this.send(socket, {
-				type: "rpc/response",
-				id: value.id,
-				result: { ok: true }
-			});
-			return;
-		}
-		this.send(socket, {
-			type: "rpc/error",
-			id: value.id,
-			error: {
-				code: "unknown_method",
-				message: `Unsupported RPC method: ${value.method}`
-			}
+async function restartInstalledConnector(deploymentId, serviceKey) {
+	const servicePlatform = platform();
+	if (servicePlatform !== "darwin" && servicePlatform !== "linux" && servicePlatform !== "win32") throw new Error(`Unsupported service platform: ${servicePlatform}.`);
+	await installConnectorLauncherService({
+		platform: servicePlatform,
+		context: resolveConnectorProfileContext(serviceKey, servicePlatform)
+	});
+	for (let attempt = 0; attempt < 50; attempt += 1) {
+		const local = await discoverLocalConnector({
+			deploymentId,
+			serviceKey
 		});
+		if (local.state === "ready" || local.state === "ownership_conflict") return local;
+		await setTimeout$1(100);
 	}
-	createHello(terminalManager) {
-		const shell = this.shellManager.shellInfo();
-		return {
-			type: "connector/hello",
-			protocolVersion: 3,
-			os: shell.os,
-			connectorVersion: "0.1.0",
-			shell: {
-				defaultName: shell.name,
-				defaultPath: shell.path
-			},
-			capabilities: {
-				mcpStdio: true,
-				...terminalManager.supported ? { terminalPty: true } : {}
-			},
-			hostLabel: hostname()
-		};
-	}
-	send(socket, message) {
-		if (socket.readyState === WebSocket.OPEN) socket.send(JSON.stringify(message));
-	}
-	sendTerminalEvent(socket, manager, event) {
-		const payload = JSON.stringify(event);
-		if (event.machineTerminalEvent === "output" && socket.bufferedAmount + Buffer.byteLength(payload) > 1048576) {
-			manager.close(event.terminalId);
-			return;
-		}
-		socket.send(payload);
-	}
-	scheduleReconnect() {
-		if (this.stopped || this.options.reconnect === false) return;
-		this.reconnectAttempt = nextReconnectAttempt(this.reconnectAttempt, false);
-		const delayMs = reconnectDelayMs(this.reconnectAttempt);
-		this.reconnectTimer = setTimeout(() => {
-			this.reconnectTimer = void 0;
-			this.connect();
-		}, delayMs);
+	return discoverLocalConnector({
+		deploymentId,
+		serviceKey
+	});
+}
+//#endregion
+//#region package.json
+var version = "0.1.2";
+//#endregion
+//#region src/cli-update-notice.ts
+const CLI_PACKAGE_NAME = "@sipher.dev/agents";
+const CLI_PACKAGE_URL = "https://registry.npmjs.org/%40sipherxyz%2Fagents/latest";
+const DEFAULT_CACHE_MS = 1440 * 60 * 1e3;
+const DEFAULT_TIMEOUT_MS = 750;
+async function withCliUpdateNotice(command, options) {
+	if (options.enabled !== false) maybePrintCliUpdateNotice(options).catch(() => void 0);
+	return command();
+}
+async function maybePrintCliUpdateNotice(options) {
+	const now = options.now ?? Date.now;
+	const cachePath = options.cachePath ?? defaultCliUpdateCachePath();
+	const cached = await readCache(cachePath);
+	let latestVersion = cached?.latestVersion;
+	if (!cached || now() - cached.checkedAt >= (options.cacheMs ?? DEFAULT_CACHE_MS)) {
+		const fresh = await lookupLatestVersion({
+			fetch: options.fetch ?? fetch,
+			timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS
+		}).catch(() => void 0);
+		if (fresh) {
+			latestVersion = fresh;
+			await writeCache(cachePath, {
+				checkedAt: now(),
+				latestVersion: fresh
+			}).catch(() => void 0);
+		}
+	}
+	if (latestVersion && compareSemver(latestVersion, options.currentVersion) > 0) (options.print ?? console.error)(`Update available for ${CLI_PACKAGE_NAME}: ${options.currentVersion} → ${latestVersion}. Run your package manager to update the CLI.`);
+}
+async function lookupLatestVersion(options) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), options.timeoutMs);
+	timer.unref();
+	try {
+		const response = await options.fetch(CLI_PACKAGE_URL, {
+			redirect: "error",
+			signal: controller.signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) throw new Error(`npm returned HTTP ${response.status}.`);
+		const value = await response.json();
+		if (typeof value.version !== "string") throw new Error("npm metadata has no version.");
+		parseSemver(value.version);
+		return value.version;
+	} finally {
+		clearTimeout(timer);
 	}
-};
-function toWebSocketUrl(value) {
-	const url = new URL(value);
-	if (url.protocol === "http:") url.protocol = "ws:";
-	if (url.protocol === "https:") url.protocol = "wss:";
-	if (url.pathname === "/" || url.pathname === "") url.pathname = "/api/connectors/ws";
-	return url;
 }
-function parseJson(raw) {
+async function readCache(path) {
 	try {
-		return JSON.parse(raw);
+		const value = JSON.parse(await readFile(path, "utf8"));
+		if (!Number.isSafeInteger(value.checkedAt) || (value.checkedAt ?? -1) < 0 || typeof value.latestVersion !== "string") return;
+		parseSemver(value.latestVersion);
+		return value;
 	} catch {
 		return;
 	}
 }
-function requestId(value) {
-	if (typeof value === "object" && value && "id" in value && typeof value.id === "string") return value.id;
-	return "unknown";
-}
-function throwCleanupFailures(results, failures = []) {
-	for (const result of results) if (result.status === "rejected") failures.push(result.reason);
-	if (failures.length === 1) throw failures[0];
-	if (failures.length > 1) throw new AggregateError(failures, "Connector cleanup failed.");
-}
-function reconnectDelayMs(attempt) {
-	const baseMs = 1e3 * 2 ** (Math.max(1, Math.min(attempt, 6)) - 1);
-	return Math.min(baseMs, 3e4);
-}
-function nextReconnectAttempt(currentAttempt, wasStable) {
-	if (wasStable) return 1;
-	return currentAttempt + 1;
-}
-function stableConnectionMs() {
-	return 1e4;
-}
-//#endregion
-//#region src/connector-daemon.ts
-async function runConnector(options) {
-	await installShellEnvironment();
-	await setupConnectorProfile({
-		serverUrl: options.serverUrl,
-		store: options.store,
-		name: options.name,
-		installService: false,
-		allowInsecureTls: options.allowInsecureTls
-	});
-	const profile = await options.store.getProfile(options.serverUrl);
-	const allowInsecureTls = options.allowInsecureTls ?? profile?.allowInsecureTls;
-	const client = (options.createClient ?? ((input) => new ConnectorClient(input)))({
-		serverUrl: options.serverUrl,
-		allowInsecureTls,
-		accessTokenProvider: createAccessTokenProvider({
-			serverUrl: options.serverUrl,
-			store: options.store,
-			allowInsecureTls
-		})
+async function writeCache(path, value) {
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
 	});
-	client.start();
-	if (options.handleSignals !== false) installSignalHandlers(client);
-	return client;
+	const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+	try {
+		await writeFile(temporary, `${JSON.stringify(value)}\n`, { mode: 384 });
+		await rename(temporary, path);
+	} finally {
+		await rm(temporary, { force: true }).catch(() => void 0);
+	}
 }
-function installSignalHandlers(client) {
-	const stop = createSignalStopHandler(client, (code) => process.exit(code));
-	process.on("SIGINT", stop);
-	process.on("SIGTERM", stop);
+function defaultCliUpdateCachePath() {
+	if (process.platform === "win32") return join(process.env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local"), "agents", "cli-update.json");
+	return join(process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache"), "agents", "cli-update.json");
 }
-function createSignalStopHandler(client, exit, forceAfterMs = 5e3) {
-	let stopping = false;
-	let forcing = false;
-	let finished = false;
-	let forceTimer;
-	const finish = (code) => {
-		if (finished) return;
-		finished = true;
-		if (forceTimer) clearTimeout(forceTimer);
-		exit(code);
-	};
-	const stop = () => {
-		if (stopping) {
-			if (forceTimer) clearTimeout(forceTimer);
-			forceStop(1);
-			return;
-		}
-		stopping = true;
-		const graceful = Promise.resolve(client.stop());
-		forceTimer = setTimeout(() => {
-			forceStop(0);
-		}, forceAfterMs);
-		forceTimer.unref();
-		graceful.then(() => {
-			if (!forcing) finish(0);
-		}, () => {
-			if (!forcing) finish(1);
-		});
-	};
-	const forceStop = async (code) => {
-		forcing = true;
-		try {
-			await client.stop(true);
-			finish(code);
-		} catch {
-			finish(1);
-		}
-	};
-	return stop;
+function compareSemver(left, right) {
+	const a = parseSemver(left);
+	const b = parseSemver(right);
+	for (let index = 0; index < 3; index += 1) if (a[index] !== b[index]) return a[index] > b[index] ? 1 : -1;
+	return 0;
+}
+function parseSemver(value) {
+	if (!/^\d+\.\d+\.\d+$/u.test(value)) throw new Error(`Invalid semantic version: ${value}.`);
+	return value.split(".").map(Number);
 }
 //#endregion
 //#region src/index.ts
@@ -3416,11 +341,16 @@ main().catch((error) => {
 });
 async function main() {
 	const args = parseArgs(process.argv.slice(2));
-	const store = new TokenStore(resolveConnectorProfileContext(args.profileName).authStorePath);
+	const store = new TokenStore(defaultConnectorAuthStorePath());
+	await withCliUpdateNotice(() => runCommand(args, store), {
+		currentVersion: version,
+		enabled: true
+	});
+}
+async function runCommand(args, store) {
 	if (args.command === "login") {
 		await login({
 			serverUrl: args.serverUrl,
-			profileName: args.profileName,
 			name: args.name,
 			store,
 			allowInsecureTls: args.allowInsecureTls
@@ -3445,51 +375,40 @@ async function main() {
 	}
 	if (args.serviceCommand) {
 		if (args.serviceCommand === "install") {
-			await setupConnectorProfile({
+			const repaired = await repairConnectorProfile({
 				serverUrl: await store.resolveServerUrl(args.serverUrl),
 				store,
 				name: args.name,
-				installService: true,
-				serviceInstaller: (input) => runServiceCommand("install", {
-					serverUrl: input.serverUrl,
-					...args.profileName ? { profileName: args.profileName } : {},
-					...input.allowInsecureTls ? { allowInsecureTls: true } : {}
-				}),
 				allowInsecureTls: args.allowInsecureTls
 			});
+			await runServiceCommand("install", {
+				serverUrl: repaired.serverUrl,
+				deploymentId: repaired.profile.deploymentId,
+				serviceKey: repaired.profile.serviceKey,
+				...repaired.profile.allowInsecureTls ? { allowInsecureTls: true } : {}
+			});
 			return;
 		}
 		if (args.serviceCommand === "repair") {
-			const serverUrl = await store.resolveServerUrl(args.serverUrl);
-			const profile = await store.getProfile(serverUrl);
-			if (!profile?.refreshToken) throw new Error(`Not logged in to ${serverUrl}. Run agents login.`);
-			const allowInsecureTls = args.allowInsecureTls ?? profile?.allowInsecureTls;
+			const repaired = await repairConnectorProfile({
+				serverUrl: await store.resolveServerUrl(args.serverUrl),
+				store,
+				name: args.name,
+				allowInsecureTls: args.allowInsecureTls
+			});
 			await runServiceCommand("repair", {
-				serverUrl,
-				...args.profileName ? { profileName: args.profileName } : {},
-				...allowInsecureTls ? { allowInsecureTls: true } : {}
+				serverUrl: repaired.serverUrl,
+				deploymentId: repaired.profile.deploymentId,
+				serviceKey: repaired.profile.serviceKey,
+				...repaired.profile.allowInsecureTls ? { allowInsecureTls: true } : {}
 			});
 			return;
 		}
-		await runServiceCommand(args.serviceCommand, { ...args.profileName ? { profileName: args.profileName } : {} });
-		return;
-	}
-	if (args.configPath) {
-		const config = await loadServiceConfig(args.configPath);
-		await runConnector({
-			serverUrl: config.serverUrl,
-			store: new TokenStore(config.authStorePath),
-			allowInsecureTls: config.allowInsecureTls
-		});
-		return;
-	}
-	if (args.command === "connect") {
-		await runConnector({
-			serverUrl: await store.resolveServerUrl(args.serverUrl),
-			store,
-			name: args.name,
-			allowInsecureTls: args.allowInsecureTls
+		const config = await serviceLocalConfigInput({
+			serverUrl: args.serverUrl,
+			store
 		});
+		await runServiceCommand(args.serviceCommand, config);
 		return;
 	}
 	throw new Error("Run agents login to set up this Machine.");