@sipher.dev/agents 0.1.0

package/dist/local-machine-controller-Dtiash-C.js

@@ -0,0 +1,2129 @@
+import { spawn } from "node:child_process";
+import { homedir, hostname, platform, userInfo } from "node:os";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { randomUUID } from "node:crypto";
+import { basename, delimiter, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { accessSync, constants, statSync } from "node:fs";
+import { access, chmod, mkdir, readFile, readdir, rename, rm, rmdir, stat, writeFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+function parseArgs(argv) {
+	const result = {};
+	let index = 0;
+	const first = argv[0];
+	if (first === "login" || first === "logout" || first === "whoami" || first === "connect") {
+		result.command = first;
+		index = 1;
+	} else if (first === "service") {
+		result.serviceCommand = parseServiceCommand(argv[1]);
+		index = 2;
+	}
+	for (; index < argv.length; index += 1) {
+		const arg = argv[index];
+		if (arg === "--server") {
+			result.serverUrl = requiredValue(argv, index, arg);
+			index += 1;
+		} else if (arg === "--profile" || arg === "-p") {
+			result.profileName = requiredValue(argv, index, arg);
+			index += 1;
+		} else if (arg === "--config") {
+			result.configPath = requiredValue(argv, index, arg);
+			index += 1;
+		} else if (arg === "--name") {
+			result.name = requiredValue(argv, index, arg);
+			index += 1;
+		} else if (arg === "--foreground") result.foreground = true;
+		else if (arg === "--insecure" || arg === "--tls-skip-verify") result.allowInsecureTls = true;
+		else if (arg === "--token") throw new Error("--token is no longer supported. Run agents login.");
+		else throw new Error(`Unknown argument: ${arg}\n${usage()}`);
+	}
+	if (result.foreground && result.command !== "connect") throw new Error("Use agents connect --foreground for local connector testing.");
+	if (result.command === "connect" && !result.foreground) throw new Error("Use agents connect --foreground for local connector testing.");
+	return result;
+}
+function parseServiceCommand(value) {
+	if (value === "install" || value === "uninstall" || value === "repair" || value === "start" || value === "stop" || value === "restart" || value === "status" || value === "logs") return value;
+	throw new Error("Expected service install, service uninstall, service repair, service start, service stop, service restart, service status, or service logs.");
+}
+function requiredValue(argv, index, flag) {
+	const value = argv[index + 1];
+	if (!value || value.startsWith("-")) throw new Error(`Missing value for ${flag}.\n${usage()}`);
+	return value;
+}
+function usage() {
+	const command = commandName();
+	return [
+		"Usage:",
+		`  ${command} login [--server <url>]`,
+		`  ${command} logout [--server <url>]`,
+		`  ${command} whoami [--server <url>]`,
+		`  ${command} connect --foreground [--server <url>]`,
+		`  ${command} service install [--name <machine-name>] [--server <url>]`,
+		`  ${command} service uninstall`,
+		`  ${command} service repair [--server <url>]`,
+		`  ${command} service start`,
+		`  ${command} service stop`,
+		`  ${command} service restart`,
+		`  ${command} service status`,
+		`  ${command} service logs`,
+		"",
+		"Profiles:",
+		`  ${command} login --profile local --server http://localhost:3000`,
+		`  ${command} service status -p local`,
+		"",
+		"Local testing:",
+		`  ${command} login --server https://agents.lc --insecure`
+	].join("\n");
+}
+function commandName() {
+	const invoked = process.argv[1]?.split(/[\\/]/).pop();
+	if (!invoked || invoked === "index.js") return "agents";
+	return invoked;
+}
+//#endregion
+//#region src/tls.ts
+function allowInsecureTlsForLocalTesting(options = {}) {
+	if (!options.allowInsecureTls) return;
+	process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";
+}
+function tlsFailureHint(error) {
+	const cause = error instanceof Error ? error.cause : void 0;
+	const code = cause && typeof cause === "object" && "code" in cause ? cause.code : void 0;
+	if (code === "SELF_SIGNED_CERT_IN_CHAIN" || code === "DEPTH_ZERO_SELF_SIGNED_CERT" || code === "UNABLE_TO_VERIFY_LEAF_SIGNATURE") return "TLS certificate validation failed. For local self-signed HTTPS, rerun with --insecure.";
+}
+//#endregion
+//#region src/auth-client.ts
+const REQUEST_TIMEOUT_MS$1 = 3e4;
+var CliAuthClient = class {
+	serverUrl;
+	options;
+	constructor(serverUrl, options = {}) {
+		this.serverUrl = serverUrl;
+		this.options = options;
+	}
+	async startDeviceAuthorization(deviceLabel) {
+		const body = deviceLabel ? { device_label: deviceLabel } : {};
+		const response = await postJson(new URL("/api/cli/oauth/device", this.serverUrl), body, this.options);
+		return {
+			deviceCode: readString(response, "device_code"),
+			userCode: readString(response, "user_code"),
+			verificationUri: readString(response, "verification_uri"),
+			verificationUriComplete: readString(response, "verification_uri_complete"),
+			expiresIn: readNumber(response, "expires_in"),
+			interval: readNumber(response, "interval")
+		};
+	}
+	async pollDeviceToken(deviceCode) {
+		return parseTokenResponse(await postForm(new URL("/api/cli/oauth/token", this.serverUrl), {
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			device_code: deviceCode
+		}, this.options));
+	}
+	async refresh(refreshToken) {
+		return parseTokenResponse(await postForm(new URL("/api/cli/oauth/token", this.serverUrl), {
+			grant_type: "refresh_token",
+			refresh_token: refreshToken
+		}, this.options));
+	}
+	async revoke(refreshToken) {
+		await postForm(new URL("/api/cli/oauth/revoke", this.serverUrl), { refresh_token: refreshToken }, this.options);
+	}
+};
+async function postJson(url, body, options) {
+	allowInsecureTlsForLocalTesting(options);
+	const signal = AbortSignal.timeout(REQUEST_TIMEOUT_MS$1);
+	let response;
+	try {
+		response = await fetch(url, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(body),
+			signal
+		});
+	} catch (error) {
+		throw new Error(tlsFailureHint(error) ?? "CLI auth request failed: fetch failed.");
+	}
+	return readResponse(response);
+}
+async function postForm(url, body, options) {
+	allowInsecureTlsForLocalTesting(options);
+	const signal = AbortSignal.timeout(REQUEST_TIMEOUT_MS$1);
+	let response;
+	try {
+		response = await fetch(url, {
+			method: "POST",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams(body),
+			signal
+		});
+	} catch (error) {
+		throw new Error(tlsFailureHint(error) ?? "CLI auth request failed: fetch failed.");
+	}
+	return readResponse(response);
+}
+async function readResponse(response) {
+	const value = await response.json().catch(() => ({}));
+	if (!response.ok) {
+		const error = isRecord$3(value) && typeof value.error === "string" ? value.error : "request_failed";
+		throw new Error(`CLI auth request failed: ${error}`);
+	}
+	if (!isRecord$3(value)) throw new Error("CLI auth response was invalid.");
+	return value;
+}
+function parseTokenResponse(value) {
+	const tokenType = readString(value, "token_type");
+	if (tokenType !== "Bearer") throw new Error("CLI auth token response was invalid.");
+	return {
+		accessToken: readString(value, "access_token"),
+		refreshToken: readString(value, "refresh_token"),
+		expiresIn: readNumber(value, "expires_in"),
+		tokenType
+	};
+}
+function readString(value, key) {
+	const field = value[key];
+	if (typeof field !== "string" || !field.trim()) throw new Error("CLI auth response was invalid.");
+	return field;
+}
+function readNumber(value, key) {
+	const field = value[key];
+	if (typeof field !== "number" || !Number.isFinite(field)) throw new Error("CLI auth response was invalid.");
+	return field;
+}
+function isRecord$3(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+const MAX_MACHINE_TERMINAL_HISTORY_BYTES = 512 * 1024;
+const utf8$2 = new TextEncoder();
+function isTerminalRpcRequest(value) {
+	if (!isRecord$2(value) || value.type !== "rpc/request" || !isNonEmptyString$2(value.id)) return false;
+	if (value.method === "terminal/open") {
+		const params = value.params;
+		return isRecord$2(params) && isMachineTerminalId(params.terminalId) && optionalNonEmptyString$1(params.cwd) && optionalPositiveBoundedSafeInteger$1(params.cols, 1e3) && optionalPositiveBoundedSafeInteger$1(params.rows, 500);
+	}
+	if (value.method === "terminal/write") {
+		const params = value.params;
+		return isRecord$2(params) && isMachineTerminalId(params.terminalId) && isNonEmptyRawString(params.data) && utf8$2.encode(params.data).byteLength <= 65536;
+	}
+	if (value.method === "terminal/resize") {
+		const params = value.params;
+		return isRecord$2(params) && isMachineTerminalId(params.terminalId) && isPositiveBoundedSafeInteger(params.cols, 1e3) && isPositiveBoundedSafeInteger(params.rows, 500);
+	}
+	if (value.method === "terminal/close") {
+		const params = value.params;
+		return isRecord$2(params) && isMachineTerminalId(params.terminalId);
+	}
+	if (value.method === "terminal/clear") {
+		const params = value.params;
+		return isRecord$2(params) && isMachineTerminalId(params.terminalId);
+	}
+	return false;
+}
+function optionalNonEmptyString$1(value) {
+	return value === void 0 || isNonEmptyString$2(value);
+}
+function optionalPositiveBoundedSafeInteger$1(value, max) {
+	return value === void 0 || typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= max;
+}
+function isPositiveBoundedSafeInteger(value, max) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= max;
+}
+function isMachineTerminalId(value) {
+	return isNonEmptyString$2(value) && value.length <= 128;
+}
+function isNonEmptyString$2(value) {
+	return typeof value === "string" && value.trim().length > 0;
+}
+function isNonEmptyRawString(value) {
+	return typeof value === "string" && value.length > 0;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region ../machine-protocol/src/mcp.ts
+const utf8$1 = new TextEncoder();
+const MACHINE_MCP_TAG = "mcp:";
+const MACHINE_MCP_MAX_FRAME_BYTES = 6 * 1024 * 1024;
+const MACHINE_MCP_MAX_STDERR_BYTES = 64 * 1024;
+const MACHINE_MCP_MAX_ERROR_MESSAGE_BYTES = 4 * 1024;
+const CONNECTOR_MAX_WEBSOCKET_PAYLOAD_BYTES = 32 * 1024 * 1024;
+var MachineMcpValidationError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "MachineMcpValidationError";
+	}
+};
+function utf8Bytes(value) {
+	return utf8$1.encode(value).byteLength;
+}
+function serializedBytes(value) {
+	return utf8Bytes(JSON.stringify(value));
+}
+function validateMachineMcpLaunchSpec(value) {
+	if (!isRecord$1(value)) invalid("Invalid MCP launch specification.");
+	const launch = value;
+	if (!hasOnlyKeys(launch, [
+		"definitionId",
+		"configVersion",
+		"catalogRevision",
+		"catalogFingerprint",
+		"command",
+		"args",
+		"cwdMode",
+		"projectRoot"
+	]) || !isBoundedString(launch.definitionId, 256, true) || !isPositiveInteger(launch.configVersion) || !isNonNegativeInteger(launch.catalogRevision) || launch.catalogFingerprint !== void 0 && (typeof launch.catalogFingerprint !== "string" || !/^[a-f0-9]{64}$/.test(launch.catalogFingerprint)) || !isBoundedString(launch.command, 4096, true) || !Array.isArray(launch.args) || launch.args.length > 64 || !launch.args.every((arg) => typeof arg === "string" && utf8Bytes(arg) <= 4096) || launch.args.reduce((total, arg) => total + (typeof arg === "string" ? utf8Bytes(arg) : 0), 0) > 65536 || launch.cwdMode !== "project_root" && launch.cwdMode !== "home" || !isAbsoluteHostPath$1(launch.projectRoot)) invalid("Invalid MCP launch specification.");
+	if (utf8Bytes(launch.projectRoot) > 32768) throw new MachineMcpValidationError("project_root_too_large", "Project root is too large.");
+	if (serializedBytes(value) > 131072) throw new MachineMcpValidationError("launch_request_too_large", "MCP launch request is too large.");
+	if (serializedBytes({
+		...launch,
+		args: launch.args.map((arg) => arg === "{projectRoot}" ? launch.projectRoot : arg),
+		cwd: launch.projectRoot
+	}) > 131072) throw new MachineMcpValidationError("launch_request_too_large", "Expanded MCP launch request is too large.");
+	return value;
+}
+function validateMachineMcpRequest(value) {
+	if (!isRecord$1(value) || value.type !== "mcp/request" || !isBoundedString(value.id, 256, true)) invalid("Invalid MCP request.");
+	if (!isRecord$1(value.params)) invalid("Invalid MCP request parameters.");
+	if (!hasOnlyKeys(value, [
+		"type",
+		"id",
+		"method",
+		"params"
+	])) invalid("Invalid MCP request.");
+	if (value.method === "mcp/probe") {
+		if (!hasOnlyKeys(value.params, ["launch", "timeoutMs"])) invalid("Invalid MCP probe parameters.");
+		validateMachineMcpLaunchSpec(value.params.launch);
+		if (!isBoundedTimeout(value.params.timeoutMs)) invalid("Invalid MCP timeout.");
+	} else if (value.method === "mcp/call") {
+		if (!hasOnlyKeys(value.params, [
+			"launch",
+			"toolName",
+			"arguments",
+			"timeoutMs"
+		])) invalid("Invalid MCP call parameters.");
+		validateMachineMcpCallRequestSize(value);
+		if (!validateMachineMcpLaunchSpec(value.params.launch).catalogFingerprint) invalid("MCP calls require an accepted catalog fingerprint.");
+		if (!isBoundedString(value.params.toolName, 256, true)) invalid("Invalid MCP tool name.");
+		if (!isRecord$1(value.params.arguments)) invalid("Invalid MCP tool arguments.");
+		if (serializedBytes(value.params.arguments) > 262144) throw new MachineMcpValidationError("arguments_too_large", "MCP tool arguments are too large.");
+		if (!isBoundedTimeout(value.params.timeoutMs)) invalid("Invalid MCP timeout.");
+	} else if (value.method === "mcp/stop") {
+		if (!hasOnlyKeys(value.params, [
+			"definitionId",
+			"configVersion",
+			"projectRoot"
+		]) || !isBoundedString(value.params.definitionId, 256, true) || value.params.configVersion !== void 0 && !isPositiveInteger(value.params.configVersion) || value.params.projectRoot !== void 0 && (!isAbsoluteHostPath$1(value.params.projectRoot) || utf8Bytes(value.params.projectRoot) > 32768)) invalid("Invalid MCP stop request.");
+	} else if (value.method === "mcp/cancel") {
+		if (!hasOnlyKeys(value.params, ["requestId"]) || !isBoundedString(value.params.requestId, 256, true)) invalid("Invalid MCP cancel request.");
+	} else invalid("Unknown MCP request method.");
+	return value;
+}
+function validateMachineMcpCallRequestSize(value) {
+	if (serializedBytes(value) > 524288) throw new MachineMcpValidationError("launch_request_too_large", "MCP call request is too large.");
+}
+function encodeMachineMcpFrame(message) {
+	const frame = `${MACHINE_MCP_TAG}${JSON.stringify(message)}`;
+	if (utf8Bytes(frame) > 6291456) throw new MachineMcpValidationError("frame_too_large", "MCP connector frame is too large.");
+	return frame;
+}
+function validateMachineMcpResult(result) {
+	if (serializedBytes(result) > 5242880) throw new MachineMcpValidationError("result_too_large", "MCP result is too large.");
+	return result;
+}
+function sanitizeMachineMcpCatalog(input) {
+	const serverInfo = sanitizeServerInfo(input.serverInfo);
+	if (!Array.isArray(input.tools) || input.tools.length > 500) throw new MachineMcpValidationError("catalog_overflow", "MCP catalog has too many tools.");
+	let catalogValues = 0;
+	const tools = input.tools.map((tool) => {
+		if (!isRecord$1(tool) || typeof tool.name !== "string") throw new MachineMcpValidationError("catalog_structure_overflow", "Invalid MCP tool name.");
+		const name = tool.name.trim();
+		if (!isBoundedString(name, 256, true)) throw new MachineMcpValidationError("catalog_structure_overflow", "Invalid MCP tool name.");
+		let toolValues = 0;
+		const countValues = (count) => {
+			toolValues += count;
+			catalogValues += count;
+			if (toolValues > 1e4) structureError();
+			if (catalogValues > 1e5) structureError();
+		};
+		const sanitized = {
+			name,
+			inputSchema: isRecord$1(tool.inputSchema) ? sanitizeObject(tool.inputSchema, countValues) : { type: "object" }
+		};
+		if (typeof tool.title === "string") {
+			if (utf8Bytes(tool.title) > 16384) structureError();
+			sanitized.title = tool.title;
+		}
+		if (typeof tool.description === "string") {
+			if (utf8Bytes(tool.description) > 16384) structureError();
+			sanitized.description = tool.description.trim();
+		}
+		if (isRecord$1(tool.outputSchema)) sanitized.outputSchema = sanitizeObject(tool.outputSchema, countValues);
+		if (isRecord$1(tool.annotations)) sanitized.annotations = sanitizeObject(tool.annotations, countValues);
+		if (catalogValues > 1e5) structureError();
+		if (serializedBytes(sanitized) > 262144) throw new MachineMcpValidationError("catalog_overflow", "MCP tool is too large.");
+		return sanitized;
+	}).sort((a, b) => compareCodeUnits(a.name, b.name));
+	if (new Set(tools.map((tool) => tool.name)).size !== tools.length) throw new MachineMcpValidationError("catalog_structure_overflow", "MCP tool names must be unique.");
+	const catalog = {
+		serverInfo,
+		tools
+	};
+	if (serializedBytes(catalog) > 1048576) throw new MachineMcpValidationError("catalog_overflow", "MCP catalog is too large.");
+	return catalog;
+}
+function sanitizeAndCanonicalizeMachineMcpCatalog(input) {
+	const catalog = sanitizeMachineMcpCatalog(input);
+	return {
+		catalog,
+		canonicalJson: canonicalizeSanitizedMachineMcpCatalog(catalog)
+	};
+}
+function canonicalizeSanitizedMachineMcpCatalog(catalog) {
+	return canonicalJson(catalog.tools);
+}
+function substituteMachineMcpLaunch(launch, platform = processPlatform(), homeRoot = launch.projectRoot) {
+	const root = platform === "windows" ? launch.projectRoot.replaceAll("/", "\\") : launch.projectRoot.replaceAll("\\", "/");
+	const command = launch.command;
+	const args = launch.args.map((argument) => argument === "{projectRoot}" ? root : argument);
+	const cwd = launch.cwdMode === "project_root" ? root : homeRoot;
+	const resolved = {
+		command,
+		args,
+		cwd
+	};
+	if (serializedBytes({
+		...launch,
+		command,
+		args,
+		...cwd ? { cwd } : {}
+	}) > 131072) throw new MachineMcpValidationError("launch_request_too_large", "Resolved MCP launch request is too large.");
+	return resolved;
+}
+function sanitizeServerInfo(value) {
+	if (!isRecord$1(value) || !isBoundedString(value.name, 256, true)) structureError("Invalid MCP server info.");
+	if (value.version !== void 0 && !isBoundedString(value.version, 256, true)) structureError("Invalid MCP server version.");
+	return {
+		name: value.name,
+		...value.version ? { version: value.version } : {}
+	};
+}
+function sanitizeObject(value, addToCatalog) {
+	if (!isRecord$1(value)) structureError();
+	const output = {};
+	const stack = [{
+		source: value,
+		target: output,
+		depth: 1
+	}];
+	let values = 0;
+	while (stack.length > 0) {
+		const item = stack.pop();
+		if (item.depth > 32) structureError();
+		const entries = Array.isArray(item.source) ? item.source.map((entry, index) => [String(index), entry]) : Object.entries(item.source).sort(([a], [b]) => compareCodeUnits(a, b));
+		if (Array.isArray(item.source) && entries.length > 4096) structureError();
+		if (!Array.isArray(item.source) && entries.length > 1024) structureError();
+		for (const [key, child] of entries) {
+			values += 1;
+			if (values > 1e4) structureError();
+			if (utf8Bytes(key) > 65536) structureError();
+			let next;
+			if (typeof child === "string") {
+				if (utf8Bytes(child) > 65536) structureError();
+				next = child;
+			} else if (child === null || typeof child === "boolean" || typeof child === "number") {
+				if (typeof child === "number" && !Number.isFinite(child)) structureError();
+				next = child;
+			} else if (Array.isArray(child)) {
+				next = [];
+				stack.push({
+					source: child,
+					target: next,
+					depth: item.depth + 1
+				});
+			} else if (isRecord$1(child)) {
+				next = {};
+				stack.push({
+					source: child,
+					target: next,
+					depth: item.depth + 1
+				});
+			} else structureError();
+			if (Array.isArray(item.target)) item.target.push(next);
+			else Object.defineProperty(item.target, key, {
+				configurable: true,
+				enumerable: true,
+				value: next,
+				writable: true
+			});
+		}
+	}
+	addToCatalog(values);
+	return output;
+}
+function canonicalJson(value) {
+	const output = [];
+	const stack = [{
+		kind: "value",
+		value
+	}];
+	while (stack.length > 0) {
+		const task = stack.pop();
+		if (task.kind === "text") {
+			output.push(task.value);
+			continue;
+		}
+		const item = task.value;
+		if (Array.isArray(item)) {
+			stack.push({
+				kind: "text",
+				value: "]"
+			});
+			for (let index = item.length - 1; index >= 0; index -= 1) {
+				stack.push({
+					kind: "value",
+					value: item[index]
+				});
+				if (index > 0) stack.push({
+					kind: "text",
+					value: ","
+				});
+			}
+			stack.push({
+				kind: "text",
+				value: "["
+			});
+			continue;
+		}
+		if (isRecord$1(item)) {
+			const keys = Object.keys(item).sort(compareCodeUnits);
+			stack.push({
+				kind: "text",
+				value: "}"
+			});
+			for (let index = keys.length - 1; index >= 0; index -= 1) {
+				const key = keys[index];
+				stack.push({
+					kind: "value",
+					value: item[key]
+				});
+				stack.push({
+					kind: "text",
+					value: `${JSON.stringify(key)}:`
+				});
+				if (index > 0) stack.push({
+					kind: "text",
+					value: ","
+				});
+			}
+			stack.push({
+				kind: "text",
+				value: "{"
+			});
+			continue;
+		}
+		const encoded = JSON.stringify(item);
+		if (encoded === void 0) structureError();
+		output.push(encoded);
+	}
+	return output.join("");
+}
+function compareCodeUnits(left, right) {
+	return left < right ? -1 : left > right ? 1 : 0;
+}
+function isBoundedString(value, maxBytes, nonBlank) {
+	return typeof value === "string" && (!nonBlank || value.trim().length > 0) && utf8Bytes(value) <= maxBytes;
+}
+function isAbsoluteHostPath$1(value) {
+	return isNonEmptyString$1(value) && !value.includes("\0") && (value.startsWith("/") || value.startsWith("\\\\") || /^[A-Za-z]:[\\/]/.test(value));
+}
+function isNonEmptyString$1(value) {
+	return typeof value === "string" && value.trim().length > 0;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isPositiveInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function isNonNegativeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isBoundedTimeout(value) {
+	return isPositiveInteger(value) && value <= 12e4;
+}
+function hasOnlyKeys(value, allowed) {
+	return Object.keys(value).every((key) => allowed.includes(key));
+}
+function invalid(message) {
+	throw new MachineMcpValidationError("invalid_request", message);
+}
+function structureError(message = "MCP catalog structure is too large or invalid.") {
+	throw new MachineMcpValidationError("catalog_structure_overflow", message);
+}
+function processPlatform() {
+	return typeof process !== "undefined" && process.platform === "win32" ? "windows" : "posix";
+}
+//#endregion
+//#region ../machine-protocol/src/index.ts
+const DEFAULT_MACHINE_EXEC_TIMEOUT_MS = 6e4;
+const MAX_MACHINE_EXEC_TIMEOUT_MS = 12e4;
+const DEFAULT_MACHINE_EXEC_OUTPUT_BYTES = 512e3;
+const MAX_MACHINE_EXEC_OUTPUT_BYTES = 1048576;
+const DEFAULT_MACHINE_FILE_READ_BYTES = 20 * 1024 * 1024;
+const MAX_MACHINE_FILE_READ_BYTES = 20 * 1024 * 1024;
+const DEFAULT_TEXT_FILE_READ_BYTES = 50 * 1024;
+const MAX_TEXT_FILE_READ_BYTES = 50 * 1024;
+const DEFAULT_TEXT_FILE_READ_LINES = 2e3;
+const MAX_TEXT_FILE_READ_LINES = 2e3;
+const MAX_MACHINE_JOB_OUTPUT_BYTES = 512 * 1024;
+const MAX_PATCH_SOURCE_FILE_BYTES = 5 * 1024 * 1024;
+const MAX_TEXT_FILE_WRITE_BYTES = 5 * 1024 * 1024;
+const MAX_MACHINE_FILE_SEARCH_PATH_LENGTH = 4096;
+const utf8 = new TextEncoder();
+function isServerRpcRequest(value) {
+	if (!isRecord(value)) return false;
+	if (value.type !== "rpc/request" || !isNonEmptyString(value.id)) return false;
+	if (isTerminalRpcRequest(value)) return true;
+	if (value.method === "shell/exec") {
+		const params = value.params;
+		return isRecord(params) && isNonEmptyString(params.shellId) && isNonEmptyString(params.command) && optionalString(params.cwd) && optionalNumber(params.timeoutMs) && optionalNumber(params.maxOutputBytes);
+	}
+	if (value.method === "shell/close") {
+		const params = value.params;
+		return isRecord(params) && isNonEmptyString(params.shellId);
+	}
+	if (value.method === "shell/job_start") {
+		const params = value.params;
+		return isRecord(params) && isNonEmptyString(params.command) && optionalNonEmptyString(params.cwd);
+	}
+	if (value.method === "shell/job_get") {
+		const params = value.params;
+		return isRecord(params) && isBoundedNonEmptyString(params.jobId, 128) && optionalNonNegativeSafeInteger(params.cursor);
+	}
+	if (value.method === "shell/job_kill") {
+		const params = value.params;
+		return isRecord(params) && isBoundedNonEmptyString(params.jobId, 128);
+	}
+	if (value.method === "file/read") {
+		const params = value.params;
+		return isRecord(params) && isNonEmptyString(params.path) && optionalPositiveBoundedSafeInteger(params.maxBytes, 20971520);
+	}
+	if (value.method === "file/read_text") {
+		const params = value.params;
+		return isRecord(params) && isNonEmptyString(params.path) && (params.mode === void 0 || params.mode === "offset" || params.mode === "tail") && !(params.mode === "tail" && params.offset !== void 0) && optionalPositiveSafeInteger(params.offset) && optionalPositiveBoundedSafeInteger(params.limit, 2e3) && optionalPositiveBoundedSafeInteger(params.maxBytes, 51200);
+	}
+	if (value.method === "file/read_patch_source") {
+		const params = value.params;
+		return isRecord(params) && isNonEmptyString(params.path) && optionalPositiveBoundedSafeInteger(params.maxBytes, 5242880);
+	}
+	if (value.method === "file/write") {
+		const params = value.params;
+		return isRecord(params) && isNonEmptyString(params.path) && typeof params.content === "string" && utf8.encode(params.content).byteLength <= 5242880;
+	}
+	if (value.method === "file/delete") {
+		const params = value.params;
+		return isRecord(params) && isNonEmptyString(params.path);
+	}
+	if (value.method === "file/move") {
+		const params = value.params;
+		return isRecord(params) && isNonEmptyString(params.sourcePath) && isNonEmptyString(params.targetPath);
+	}
+	if (value.method === "file/search_entries") {
+		const params = value.params;
+		return isRecord(params) && isAbsoluteHostPath(params.rootPath) && typeof params.query === "string" && optionalPositiveBoundedSafeInteger(params.limit, 100);
+	}
+	return false;
+}
+function optionalString(value) {
+	return value === void 0 || typeof value === "string";
+}
+function optionalNonEmptyString(value) {
+	return value === void 0 || isNonEmptyString(value);
+}
+function isBoundedNonEmptyString(value, maxLength) {
+	return isNonEmptyString(value) && value.length <= maxLength;
+}
+function optionalNumber(value) {
+	return value === void 0 || typeof value === "number" && Number.isFinite(value);
+}
+function optionalPositiveBoundedSafeInteger(value, max) {
+	return value === void 0 || typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= max;
+}
+function optionalPositiveSafeInteger(value) {
+	return value === void 0 || isPositiveSafeInteger(value);
+}
+function optionalNonNegativeSafeInteger(value) {
+	return value === void 0 || isNonNegativeSafeInteger(value);
+}
+function isPositiveSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+function isNonNegativeSafeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isAbsoluteHostPath(value) {
+	if (!isNonEmptyString(value) || value.includes("\0")) return false;
+	return value.startsWith("/") || value.startsWith("\\\\") || /^[A-Za-z]:[\\/]/.test(value);
+}
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.trim().length > 0;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/shell-detect.ts
+function detectShell() {
+	if (process.platform === "win32") return {
+		os: "windows",
+		name: "powershell",
+		path: "powershell.exe",
+		args: [
+			"-NoLogo",
+			"-NoProfile",
+			"-Command",
+			"-"
+		]
+	};
+	const path = findExecutable([
+		process.env.SHELL,
+		loginShellPath(),
+		"/bin/bash",
+		"/usr/bin/bash",
+		"/opt/homebrew/bin/bash",
+		"/bin/sh"
+	]);
+	const name = shellName(path);
+	return {
+		os: toMachineOs(platform()),
+		name,
+		path,
+		args: name === "bash" ? ["--noprofile", "--norc"] : []
+	};
+}
+function loginShellPath() {
+	try {
+		return userInfo().shell ?? void 0;
+	} catch {
+		return;
+	}
+}
+function findExecutable(paths) {
+	return paths.find(isExecutable) ?? "/bin/sh";
+}
+function isExecutable(path) {
+	if (!path || !isAbsolute(path)) return false;
+	try {
+		accessSync(path, constants.X_OK);
+		return statSync(path).isFile();
+	} catch {
+		return false;
+	}
+}
+function shellName(path) {
+	const name = basename(path);
+	if (name === "bash" || name === "sh" || name === "zsh") return name;
+	return "unknown";
+}
+function toMachineOs(value) {
+	if (value === "darwin" || value === "linux") return value;
+	if (value === "win32") return "windows";
+	return "unknown";
+}
+//#endregion
+//#region src/shell-manager.ts
+const PARSE_TAIL_BYTES = 16384;
+var ShellManager = class {
+	shells = /* @__PURE__ */ new Map();
+	shell = detectShell();
+	async exec(input) {
+		return this.getOrCreate(input.shellId, input.cwd).exec(input.command, {
+			timeoutMs: clampPositiveInteger(input.timeoutMs, DEFAULT_MACHINE_EXEC_TIMEOUT_MS, MAX_MACHINE_EXEC_TIMEOUT_MS),
+			maxOutputBytes: clampPositiveInteger(input.maxOutputBytes, DEFAULT_MACHINE_EXEC_OUTPUT_BYTES, MAX_MACHINE_EXEC_OUTPUT_BYTES)
+		});
+	}
+	close(shellId) {
+		this.shells.get(shellId)?.close();
+		this.shells.delete(shellId);
+	}
+	closeAll() {
+		for (const shell of this.shells.values()) shell.close();
+		this.shells.clear();
+	}
+	shellInfo() {
+		return this.shell;
+	}
+	getOrCreate(shellId, cwd) {
+		const existing = this.shells.get(shellId);
+		if (existing && !existing.closed) return existing;
+		const session = new ShellSession(this.shell, resolveShellCwd(cwd));
+		this.shells.set(shellId, session);
+		return session;
+	}
+};
+function resolveShellCwd(cwd) {
+	const home = homedir();
+	if (!cwd) return home;
+	return isAbsolute(cwd) ? cwd : resolve(home, cwd);
+}
+var ShellSession = class {
+	shell;
+	child;
+	active;
+	queue = Promise.resolve();
+	closed = false;
+	constructor(shell, cwd) {
+		this.shell = shell;
+		this.child = spawn(shell.path, shell.args, {
+			cwd,
+			stdio: "pipe",
+			env: process.env
+		});
+		this.child.stdout.setEncoding("utf8");
+		this.child.stderr.setEncoding("utf8");
+		this.child.stdout.on("data", (chunk) => this.handleStdout(chunk));
+		this.child.stderr.on("data", (chunk) => this.handleStderr(chunk));
+		this.child.once("error", (error) => {
+			this.closed = true;
+			this.active?.resolve({
+				ok: false,
+				errorCode: "shell_start_failed",
+				message: error.message
+			});
+			this.active = void 0;
+		});
+		this.child.once("exit", () => {
+			this.closed = true;
+			this.active?.resolve({
+				ok: false,
+				errorCode: "execution_failed",
+				message: "Shell exited before the command completed."
+			});
+			this.active = void 0;
+		});
+		this.child.stdin.on("error", (error) => {
+			this.failActive("execution_failed", error.message);
+		});
+	}
+	async exec(command, options) {
+		const run = () => this.execNow(command, options);
+		const result = this.queue.then(run, run);
+		this.queue = result.then(() => void 0, () => void 0);
+		return result;
+	}
+	close() {
+		this.closed = true;
+		this.child.kill();
+	}
+	execNow(command, options) {
+		if (this.closed) return Promise.resolve({
+			ok: false,
+			errorCode: "shell_start_failed",
+			message: "Shell is closed."
+		});
+		const marker = randomUUID().replaceAll("-", "");
+		const wrapped = wrapCommand(this.shell.name, command, marker);
+		return new Promise((resolve) => {
+			const timeout = setTimeout(() => {
+				this.active = void 0;
+				this.close();
+				resolve({
+					ok: false,
+					errorCode: "command_timeout",
+					message: `Command timed out after ${options.timeoutMs}ms. The persistent shell was reset.`
+				});
+			}, options.timeoutMs);
+			this.active = {
+				marker,
+				started: false,
+				stdout: "",
+				stdoutBytes: 0,
+				stdoutTruncated: false,
+				stdoutTail: "",
+				stderr: "",
+				stderrBytes: 0,
+				stderrTruncated: false,
+				maxOutputBytes: options.maxOutputBytes,
+				resolve: (response) => {
+					clearTimeout(timeout);
+					this.active = void 0;
+					resolve(response);
+				}
+			};
+			if (this.child.stdin.destroyed || this.child.stdin.writableEnded || !this.child.stdin.writable) {
+				this.failActive("execution_failed", "Shell stdin is not writable.");
+				return;
+			}
+			this.child.stdin.write(wrapped, (error) => {
+				if (error && this.active?.marker === marker) this.failActive("execution_failed", error.message);
+			});
+		});
+	}
+	failActive(errorCode, message) {
+		this.closed = true;
+		this.child.kill();
+		this.active?.resolve({
+			ok: false,
+			errorCode,
+			message
+		});
+		this.active = void 0;
+	}
+	handleStdout(chunk) {
+		const active = this.active;
+		if (!active) return;
+		appendStdout(active, chunk);
+		const parsed = parseCompletedStdout(active.stdoutTail, active.marker);
+		if (!parsed) return;
+		active.resolve({
+			ok: true,
+			stdout: finishStdout(active, parsed.stdout),
+			stderr: finishCapturedOutput(active.stderr, active.stderrTruncated, active.maxOutputBytes),
+			exitCode: parsed.exitCode,
+			timedOut: false
+		});
+	}
+	handleStderr(chunk) {
+		if (this.active) {
+			const next = appendCappedChunk(this.active.stderr, this.active.stderrBytes, this.active.stderrTruncated, chunk, this.active.maxOutputBytes);
+			this.active.stderr = next.value;
+			this.active.stderrBytes = next.bytes;
+			this.active.stderrTruncated = next.truncated;
+		}
+	}
+};
+function wrapCommand(shellName, command, marker) {
+	if (shellName === "powershell") return [
+		`Write-Output "__APP_START_${marker}__"`,
+		"& {",
+		command,
+		"}",
+		"$appEc = if ($LASTEXITCODE -ne $null) { $LASTEXITCODE } else { 0 }",
+		`Write-Output "__APP_DONE_${marker}__:$appEc"`,
+		""
+	].join("\n");
+	return [
+		`printf '\\n__APP_START_${marker}__\\n'`,
+		"{",
+		command,
+		"}",
+		"__app_ec=$?",
+		`printf '\\n__APP_DONE_${marker}__:%s\\n' "$__app_ec"`,
+		""
+	].join("\n");
+}
+function parseCompletedStdout(stdout, marker) {
+	const donePattern = new RegExp(`(^|\\r?\\n)__APP_DONE_${marker}__:(-?\\d+)(\\r?\\n|$)`);
+	const doneMatch = stdout.match(donePattern);
+	if (doneMatch?.index === void 0) return void 0;
+	const beforeDone = stdout.slice(0, doneMatch.index);
+	const startPattern = new RegExp(`(^|\\r?\\n)__APP_START_${marker}__(\\r?\\n|$)`);
+	return {
+		stdout: beforeDone.replace(startPattern, "").replace(/^\r?\n/, ""),
+		exitCode: Number(doneMatch[2])
+	};
+}
+function appendStdout(active, chunk) {
+	const outputChunk = stdoutOutputChunk(active, chunk);
+	if (!outputChunk) {
+		active.stdoutTail = capTail(`${active.stdoutTail}${chunk}`, PARSE_TAIL_BYTES);
+		return;
+	}
+	const next = appendCappedChunk(active.stdout, active.stdoutBytes, active.stdoutTruncated, outputChunk, active.maxOutputBytes);
+	active.stdout = next.value;
+	active.stdoutBytes = next.bytes;
+	active.stdoutTruncated = next.truncated;
+	active.stdoutTail = capTail(`${active.stdoutTail}${chunk}`, PARSE_TAIL_BYTES);
+}
+function appendCappedChunk(current, currentBytes, truncated, chunk, capBytes) {
+	if (currentBytes >= capBytes) return {
+		value: current,
+		bytes: currentBytes,
+		truncated: truncated || chunk.length > 0
+	};
+	const remaining = capBytes - currentBytes;
+	const chunkBytes = Buffer.byteLength(chunk, "utf8");
+	if (chunkBytes <= remaining) return {
+		value: `${current}${chunk}`,
+		bytes: currentBytes + chunkBytes,
+		truncated
+	};
+	return {
+		value: `${current}${sliceUtf8Bytes(chunk, remaining)}`,
+		bytes: capBytes,
+		truncated: true
+	};
+}
+function finishStdout(active, parsedTailStdout) {
+	return finishCapturedOutput((parseCompletedStdout(active.stdout, active.marker)?.stdout ?? active.stdout) || parsedTailStdout, active.stdoutTruncated, active.maxOutputBytes);
+}
+function stdoutOutputChunk(active, chunk) {
+	if (active.started) return chunk;
+	const nextTail = `${active.stdoutTail}${chunk}`;
+	const startPattern = new RegExp(`(^|\\r?\\n)__APP_START_${active.marker}__(\\r?\\n|$)`);
+	const match = nextTail.match(startPattern);
+	if (match?.index === void 0) return "";
+	active.started = true;
+	const afterStartIndex = match.index + match[0].length;
+	return nextTail.slice(afterStartIndex);
+}
+function finishCapturedOutput(value, truncated, capBytes) {
+	return truncated ? `${value}\n[output truncated at ${capBytes} bytes]` : value;
+}
+function capTail(value, capBytes) {
+	if (Buffer.byteLength(value, "utf8") <= capBytes) return value;
+	return sliceUtf8BytesFromEnd(value, capBytes);
+}
+function sliceUtf8Bytes(value, maxBytes) {
+	let bytes = 0;
+	let result = "";
+	for (const char of value) {
+		const charBytes = Buffer.byteLength(char, "utf8");
+		if (bytes + charBytes > maxBytes) break;
+		bytes += charBytes;
+		result += char;
+	}
+	return result;
+}
+function sliceUtf8BytesFromEnd(value, maxBytes) {
+	let bytes = 0;
+	let result = "";
+	const chars = Array.from(value);
+	for (let index = chars.length - 1; index >= 0; index -= 1) {
+		const char = chars[index];
+		const charBytes = Buffer.byteLength(char, "utf8");
+		if (bytes + charBytes > maxBytes) break;
+		bytes += charBytes;
+		result = `${char}${result}`;
+	}
+	return result;
+}
+function clampPositiveInteger(value, fallback, maximum) {
+	if (value === void 0 || !Number.isFinite(value)) return fallback;
+	return Math.min(Math.max(Math.trunc(value), 1), maximum);
+}
+//#endregion
+//#region src/machine-client.ts
+const REQUEST_TIMEOUT_MS = 3e4;
+var MachineClaimError = class extends Error {
+	code;
+	status;
+	constructor(message, code, status) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.name = "MachineClaimError";
+	}
+};
+var MachineClient = class {
+	serverUrl;
+	options;
+	constructor(serverUrl, options = {}) {
+		this.serverUrl = serverUrl;
+		this.options = options;
+	}
+	async claim(input) {
+		allowInsecureTlsForLocalTesting(this.options);
+		const shell = new ShellManager().shellInfo();
+		const response = await fetch(new URL("/api/cli/machines/claim", this.serverUrl), {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${input.accessToken}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({
+				connector_install_id: input.connectorInstallId,
+				host_label: input.name ?? hostname(),
+				os: shell.os,
+				connector_version: "0.1.0",
+				shell: {
+					defaultName: shell.name,
+					...shell.path ? { defaultPath: shell.path } : {}
+				}
+			}),
+			signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+		});
+		const body = await response.json().catch(() => ({}));
+		if (!response.ok) {
+			const error = readError(body);
+			throw new MachineClaimError(`Machine claim failed: ${error}`, error, response.status);
+		}
+		if (!body || typeof body !== "object" || !("machine" in body)) throw new Error("Machine claim response was invalid.");
+		const machine = body.machine;
+		if (!machine || typeof machine !== "object") throw new Error("Machine claim response was invalid.");
+		const raw = machine;
+		if (typeof raw.machineId !== "string" || typeof raw.name !== "string") throw new Error("Machine claim response was invalid.");
+		return {
+			machineId: raw.machineId,
+			name: raw.name
+		};
+	}
+};
+function readError(value) {
+	if (value && typeof value === "object" && typeof value.error === "string") return value.error;
+	return "request_failed";
+}
+//#endregion
+//#region src/connector-profile.ts
+const CONNECTOR_SERVICE_BASE_NAME = "agents.connector";
+function resolveConnectorProfileContext(profileName, servicePlatform = platform()) {
+	const parsedProfileName = parseConnectorProfileName(profileName);
+	const serviceName = connectorServiceName(parsedProfileName, servicePlatform);
+	const paths = connectorProfilePaths(parsedProfileName, servicePlatform);
+	return {
+		...parsedProfileName ? { profileName: parsedProfileName } : {},
+		serviceName,
+		serviceUnitName: `${serviceName}.service`,
+		...paths,
+		launchAgentPath: join(homedir(), "Library", "LaunchAgents", `${serviceName}.plist`),
+		systemdUnitPath: join(homedir(), ".config", "systemd", "user", `${serviceName}.service`)
+	};
+}
+function parseConnectorProfileName(value) {
+	if (value === void 0) return void 0;
+	const name = value.trim();
+	if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(name)) throw new Error("Connector profile names must use lowercase letters, numbers, and hyphens, and start with a letter or number.");
+	return name;
+}
+function defaultConnectorAuthStorePath() {
+	return resolveConnectorProfileContext().authStorePath;
+}
+function connectorServiceName(profileName, servicePlatform) {
+	if (!profileName) return CONNECTOR_SERVICE_BASE_NAME;
+	if (servicePlatform === "linux") return `${CONNECTOR_SERVICE_BASE_NAME}@${profileName}`;
+	return `${CONNECTOR_SERVICE_BASE_NAME}.${profileName}`;
+}
+function connectorProfilePaths(profileName, servicePlatform) {
+	const configRoot = configDir(servicePlatform);
+	const stateRoot = stateDir(servicePlatform);
+	if (!profileName) return {
+		configPath: join(configRoot, "config.json"),
+		authStorePath: legacyAuthStorePath(servicePlatform),
+		logPath: join(stateRoot, "connector.log"),
+		errorLogPath: join(stateRoot, "connector.err.log")
+	};
+	return {
+		configPath: join(configRoot, "connectors", profileName, "config.json"),
+		authStorePath: join(configRoot, "connectors", profileName, "auth.json"),
+		logPath: join(stateRoot, "connectors", profileName, "connector.log"),
+		errorLogPath: join(stateRoot, "connectors", profileName, "connector.err.log")
+	};
+}
+function configDir(servicePlatform) {
+	if (servicePlatform === "darwin") return join(homedir(), "Library", "Application Support", "agents");
+	if (servicePlatform === "win32") return join(process.env.APPDATA ?? homedir(), "agents");
+	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "agents");
+}
+function legacyAuthStorePath(servicePlatform) {
+	if (servicePlatform === "darwin") return join(homedir(), "Library", "Application Support", "agents", "auth.json");
+	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "agents", "auth.json");
+}
+function stateDir(servicePlatform) {
+	if (servicePlatform === "darwin") return join(homedir(), "Library", "Logs", "agents");
+	if (servicePlatform === "win32") return join(process.env.LOCALAPPDATA ?? homedir(), "agents");
+	return join(process.env.XDG_STATE_HOME ?? join(homedir(), ".local", "state"), "agents");
+}
+//#endregion
+//#region src/service-manager.ts
+var ConnectorServiceUnsupportedError = class extends Error {
+	code = "connector_service_unsupported";
+	constructor() {
+		super("Service commands support macOS LaunchAgent, Linux systemd user services, and Windows Scheduled Tasks.");
+		this.name = "ConnectorServiceUnsupportedError";
+	}
+};
+function isConnectorServiceUnsupportedError(error) {
+	return error instanceof ConnectorServiceUnsupportedError || Boolean(error && typeof error === "object" && error.code === "connector_service_unsupported");
+}
+let runCommand = run;
+async function runServiceCommand(command, config) {
+	await runServiceCommandForPlatform(command, resolveServicePlatform(), config);
+}
+async function runServiceCommandForPlatform(command, servicePlatform, config) {
+	const context = resolveConnectorProfileContext(config?.profileName, servicePlatform);
+	if (command === "install") {
+		if (!config?.serverUrl) throw new Error("A server profile is required for service install.");
+		const installed = await installConnectorService({
+			serverUrl: config.serverUrl,
+			...config.allowInsecureTls ? { allowInsecureTls: true } : {},
+			...config.profileName ? { profileName: config.profileName } : {}
+		});
+		console.log(`Installed ${context.serviceName} ${serviceLabel(installed.service)}.`);
+		return;
+	}
+	if (command === "repair") {
+		if (!config?.serverUrl) throw new Error("A server profile is required for service repair.");
+		await repairService(servicePlatform, {
+			serverUrl: config.serverUrl,
+			...config.allowInsecureTls ? { allowInsecureTls: true } : {},
+			authStorePath: context.authStorePath
+		}, {}, context);
+		console.log(`Repaired ${context.serviceName} ${serviceLabel(serviceKind(servicePlatform))}.`);
+		return;
+	}
+	if (command === "uninstall") {
+		await uninstallService(servicePlatform, context);
+		return;
+	}
+	if (command === "start") {
+		await startService(servicePlatform, context);
+		return;
+	}
+	if (command === "stop") {
+		await stopService(servicePlatform, context);
+		return;
+	}
+	if (command === "restart") {
+		await restartService(servicePlatform, context);
+		return;
+	}
+	if (command === "status") {
+		await printServiceStatus(servicePlatform, context);
+		return;
+	}
+	await printServiceLogs(servicePlatform, {}, context);
+}
+async function installConnectorService(config) {
+	if (!config.serverUrl) throw new Error("A server profile is required for service install.");
+	const servicePlatform = resolveServicePlatform();
+	const context = resolveConnectorProfileContext(config.profileName, servicePlatform);
+	await installService(servicePlatform, {
+		serverUrl: config.serverUrl,
+		...config.allowInsecureTls ? { allowInsecureTls: true } : {},
+		authStorePath: context.authStorePath
+	}, context, config.connectorEntryPath);
+	return {
+		platform: servicePlatform,
+		service: serviceKind(servicePlatform)
+	};
+}
+async function loadServiceConfig(path = resolveConnectorProfileContext().configPath, options = {}) {
+	const raw = await readFile(path, "utf8");
+	const value = JSON.parse(raw);
+	if (typeof value.serverUrl !== "string") throw new Error(`Invalid connector service config at ${path}.`);
+	const defaultContext = resolveConnectorProfileContext();
+	const authStorePath = typeof value.authStorePath === "string" && value.authStorePath.trim() ? value.authStorePath : path === (options.legacyDefaultConfigPath ?? defaultContext.configPath) ? options.defaultAuthStorePath ?? defaultContext.authStorePath : void 0;
+	if (!authStorePath) throw new Error(`Invalid connector service config at ${path}.`);
+	return {
+		serverUrl: value.serverUrl,
+		...value.allowInsecureTls === true ? { allowInsecureTls: true } : {},
+		authStorePath
+	};
+}
+async function installService(servicePlatform, config, context = resolveConnectorProfileContext(void 0, servicePlatform), connectorEntryPath) {
+	const command = await resolveConnectorCommand(connectorEntryPath);
+	if (servicePlatform === "darwin") {
+		await installLaunchAgent(command, config, context);
+		return;
+	}
+	if (servicePlatform === "win32") {
+		await installWindowsScheduledTaskService(command, config, {}, context);
+		return;
+	}
+	await installSystemdUserService(command, config, {}, context);
+}
+async function uninstallService(servicePlatform, context = resolveConnectorProfileContext(void 0, servicePlatform)) {
+	if (servicePlatform === "darwin") {
+		await cleanupLaunchAgent(context.launchAgentPath, context.configPath, context);
+		console.log(`Uninstalled ${context.serviceName} LaunchAgent.`);
+		return;
+	}
+	if (servicePlatform === "win32") {
+		await cleanupWindowsScheduledTask(context.configPath, context);
+		console.log(`Uninstalled ${context.serviceName} Scheduled Task.`);
+		return;
+	}
+	await cleanupSystemdUserService(context.systemdUnitPath, context.configPath, context);
+	console.log(`Uninstalled ${context.serviceName} systemd user service.`);
+}
+async function repairService(servicePlatform, config, paths = {}, context = resolveConnectorProfileContext(void 0, servicePlatform)) {
+	await writeServiceConfig(withAuthStorePath(config, context), paths.configPath ?? context.configPath);
+	await restartService(servicePlatform, context);
+}
+async function startService(servicePlatform, context = resolveConnectorProfileContext(void 0, servicePlatform)) {
+	if (servicePlatform === "darwin") {
+		await runCommand("launchctl", ["enable", `gui/${currentUid()}/${context.serviceName}`]);
+		await runCommand("launchctl", ["kickstart", `gui/${currentUid()}/${context.serviceName}`]);
+		return;
+	}
+	if (servicePlatform === "win32") {
+		await runCommand("schtasks", [
+			"/Run",
+			"/TN",
+			context.serviceName
+		]);
+		return;
+	}
+	await runCommand("systemctl", [
+		"--user",
+		"start",
+		context.serviceUnitName
+	]);
+}
+async function stopService(servicePlatform, context = resolveConnectorProfileContext(void 0, servicePlatform)) {
+	if (servicePlatform === "darwin") {
+		await runCommand("launchctl", ["disable", `gui/${currentUid()}/${context.serviceName}`]);
+		await runCommand("launchctl", ["stop", `gui/${currentUid()}/${context.serviceName}`]);
+		return;
+	}
+	if (servicePlatform === "win32") {
+		await runCommand("schtasks", [
+			"/End",
+			"/TN",
+			context.serviceName
+		]);
+		return;
+	}
+	await runCommand("systemctl", [
+		"--user",
+		"stop",
+		context.serviceUnitName
+	]);
+}
+async function restartService(servicePlatform, context = resolveConnectorProfileContext(void 0, servicePlatform)) {
+	if (servicePlatform === "darwin") {
+		await runCommand("launchctl", ["enable", `gui/${currentUid()}/${context.serviceName}`]);
+		await runCommand("launchctl", [
+			"kickstart",
+			"-k",
+			`gui/${currentUid()}/${context.serviceName}`
+		]);
+		return;
+	}
+	if (servicePlatform === "win32") {
+		await runCommand("schtasks", [
+			"/End",
+			"/TN",
+			context.serviceName
+		], { allowFailure: true });
+		await runCommand("schtasks", [
+			"/Run",
+			"/TN",
+			context.serviceName
+		]);
+		return;
+	}
+	await runCommand("systemctl", [
+		"--user",
+		"restart",
+		context.serviceUnitName
+	]);
+}
+async function printServiceStatus(servicePlatform, context = resolveConnectorProfileContext(void 0, servicePlatform)) {
+	if (servicePlatform === "darwin") {
+		await runCommand("launchctl", ["print", `gui/${currentUid()}/${context.serviceName}`], { allowFailure: true });
+		return;
+	}
+	if (servicePlatform === "win32") {
+		await runCommand("schtasks", [
+			"/Query",
+			"/TN",
+			context.serviceName,
+			"/V",
+			"/FO",
+			"LIST"
+		], { allowFailure: true });
+		return;
+	}
+	await runCommand("systemctl", [
+		"--user",
+		"status",
+		context.serviceUnitName
+	], { allowFailure: true });
+}
+async function printServiceLogs(servicePlatform, paths = {}, context = resolveConnectorProfileContext(void 0, servicePlatform)) {
+	if (servicePlatform === "darwin") {
+		await printServiceLogFiles(context, paths);
+		return;
+	}
+	if (servicePlatform === "win32") {
+		await printServiceLogFiles(context, paths);
+		return;
+	}
+	if (servicePlatform === "linux") {
+		await runCommand("journalctl", [
+			"--user",
+			"-u",
+			context.serviceUnitName,
+			"-n",
+			"100",
+			"--no-pager"
+		], { allowFailure: true });
+		return;
+	}
+}
+async function printServiceLogFiles(context = resolveConnectorProfileContext(), paths = {}) {
+	await printFile(paths.logPath ?? context.logPath);
+	await printFile(paths.errorLogPath ?? context.errorLogPath);
+}
+async function writeServiceConfig(config, path = resolveConnectorProfileContext().configPath) {
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
+	await chmod(path, 384).catch(() => void 0);
+}
+async function removeServiceConfig(path = resolveConnectorProfileContext().configPath) {
+	await rm(path, { force: true });
+}
+function withAuthStorePath(config, context) {
+	return {
+		...config,
+		authStorePath: config.authStorePath ?? context.authStorePath
+	};
+}
+async function removeInstallArtifacts(unitPath, configPath = resolveConnectorProfileContext().configPath) {
+	await Promise.all([rm(unitPath, { force: true }), removeServiceConfig(configPath)]);
+}
+async function installLaunchAgent(command, config, context = resolveConnectorProfileContext(void 0, "darwin")) {
+	const plistPath = context.launchAgentPath;
+	try {
+		await mkdir(dirname(context.logPath), { recursive: true });
+		await mkdir(dirname(plistPath), { recursive: true });
+		await writeFile(plistPath, launchAgentPlist(command, {}, context), { mode: 420 });
+		await writeServiceConfig(withAuthStorePath(config, context), context.configPath);
+		await runCommand("launchctl", [
+			"bootout",
+			`gui/${currentUid()}`,
+			plistPath
+		], {
+			allowFailure: true,
+			quietFailure: true
+		});
+		await runCommand("launchctl", [
+			"bootstrap",
+			`gui/${currentUid()}`,
+			plistPath
+		]);
+		await runCommand("launchctl", ["enable", `gui/${currentUid()}/${context.serviceName}`], { allowFailure: true });
+	} catch (error) {
+		await cleanupLaunchAgent(plistPath, context.configPath, context);
+		throw error;
+	}
+}
+async function installSystemdUserService(command, config, paths = {}, context = resolveConnectorProfileContext(void 0, "linux")) {
+	const unitPath = paths.unitPath ?? context.systemdUnitPath;
+	const configPath = paths.configPath ?? context.configPath;
+	try {
+		await mkdir(dirname(unitPath), { recursive: true });
+		await writeFile(unitPath, systemdUnit(command, { configPath }), { mode: 420 });
+		await writeServiceConfig(withAuthStorePath(config, context), configPath);
+		await runCommand("systemctl", ["--user", "daemon-reload"]);
+		await runCommand("systemctl", [
+			"--user",
+			"enable",
+			context.serviceUnitName
+		]);
+		await runCommand("systemctl", [
+			"--user",
+			"restart",
+			context.serviceUnitName
+		]);
+	} catch (error) {
+		await cleanupSystemdUserService(unitPath, configPath, context);
+		throw error;
+	}
+}
+async function installWindowsScheduledTaskService(command, config, paths = {}, context = resolveConnectorProfileContext(void 0, "win32")) {
+	const configPath = paths.configPath ?? context.configPath;
+	const logPath = paths.logPath ?? context.logPath;
+	const errorLogPath = paths.errorLogPath ?? context.errorLogPath;
+	try {
+		await mkdir(dirname(logPath), { recursive: true });
+		await mkdir(dirname(errorLogPath), { recursive: true });
+		await writeServiceConfig(withAuthStorePath(config, context), configPath);
+		await runCommand("schtasks", [
+			"/Create",
+			"/F",
+			"/SC",
+			"ONLOGON",
+			"/TN",
+			context.serviceName,
+			"/TR",
+			windowsScheduledTaskAction(command, configPath, logPath, errorLogPath)
+		]);
+		await runCommand("schtasks", [
+			"/Run",
+			"/TN",
+			context.serviceName
+		]);
+	} catch (error) {
+		await cleanupWindowsScheduledTask(configPath, context);
+		throw error;
+	}
+}
+async function cleanupLaunchAgent(plistPath = resolveConnectorProfileContext(void 0, "darwin").launchAgentPath, configPath = resolveConnectorProfileContext(void 0, "darwin").configPath, context = resolveConnectorProfileContext(void 0, "darwin")) {
+	await runCommand("launchctl", [
+		"bootout",
+		`gui/${currentUid()}`,
+		plistPath
+	], {
+		allowFailure: true,
+		quietFailure: true
+	});
+	await removeInstallArtifacts(plistPath, configPath);
+}
+async function cleanupSystemdUserService(unitPath = resolveConnectorProfileContext(void 0, "linux").systemdUnitPath, configPath = resolveConnectorProfileContext(void 0, "linux").configPath, context = resolveConnectorProfileContext(void 0, "linux")) {
+	await runCommand("systemctl", [
+		"--user",
+		"disable",
+		"--now",
+		context.serviceUnitName
+	], { allowFailure: true });
+	await removeInstallArtifacts(unitPath, configPath);
+	await runCommand("systemctl", ["--user", "daemon-reload"], { allowFailure: true });
+}
+async function cleanupWindowsScheduledTask(configPath = resolveConnectorProfileContext(void 0, "win32").configPath, context = resolveConnectorProfileContext(void 0, "win32")) {
+	await runCommand("schtasks", [
+		"/End",
+		"/TN",
+		context.serviceName
+	], {
+		allowFailure: true,
+		quietFailure: true
+	});
+	await runCommand("schtasks", [
+		"/Delete",
+		"/TN",
+		context.serviceName,
+		"/F"
+	], {
+		allowFailure: true,
+		quietFailure: true
+	});
+	await removeServiceConfig(configPath);
+}
+function launchAgentPlist(command, paths = {}, context = resolveConnectorProfileContext(void 0, "darwin")) {
+	const configPath = paths.configPath ?? context.configPath;
+	const logPath = paths.logPath ?? context.logPath;
+	const errorLogPath = paths.errorLogPath ?? context.errorLogPath;
+	const programArguments = [
+		command.executable,
+		...command.args,
+		"--config",
+		configPath
+	].map((value) => `    <string>${xmlEscape(value)}</string>`).join("\n");
+	return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${context.serviceName}</string>
+  <key>ProgramArguments</key>
+  <array>
+${programArguments}
+  </array>
+  <key>RunAtLoad</key><true/>
+  <key>KeepAlive</key><true/>
+  <key>StandardOutPath</key><string>${xmlEscape(logPath)}</string>
+  <key>StandardErrorPath</key><string>${xmlEscape(errorLogPath)}</string>
+</dict>
+</plist>
+`;
+}
+function systemdUnit(command, paths = {}) {
+	const configPath = paths.configPath ?? resolveConnectorProfileContext(void 0, "linux").configPath;
+	return `[Unit]
+Description=agent connector
+
+[Service]
+ExecStart=${[
+		command.executable,
+		...command.args,
+		"--config",
+		configPath
+	].map(systemdQuote).join(" ")}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`;
+}
+function windowsScheduledTaskAction(command, configPath = resolveConnectorProfileContext(void 0, "win32").configPath, logPath = resolveConnectorProfileContext(void 0, "win32").logPath, errorLogPath = resolveConnectorProfileContext(void 0, "win32").errorLogPath) {
+	return `cmd.exe /d /c "${[
+		command.executable,
+		...command.args,
+		"--config",
+		configPath
+	].map(windowsCmdQuote).join(" ")} >> ${windowsCmdQuote(logPath)} 2>> ${windowsCmdQuote(errorLogPath)}"`;
+}
+function resolveServicePlatform() {
+	const current = platform();
+	if (current === "darwin" || current === "linux" || current === "win32") return current;
+	throw new ConnectorServiceUnsupportedError();
+}
+function serviceKind(servicePlatform) {
+	if (servicePlatform === "darwin") return "launch-agent";
+	if (servicePlatform === "win32") return "windows-scheduled-task";
+	return "systemd-user";
+}
+function serviceLabel(service) {
+	if (service === "launch-agent") return "LaunchAgent";
+	if (service === "windows-scheduled-task") return "Scheduled Task";
+	return "systemd user service";
+}
+async function resolveConnectorCommand(connectorEntryPath) {
+	const bin = connectorEntryPath ?? connectorBin();
+	const executable = await nodeExecutable();
+	await access(executable);
+	await access(bin);
+	return {
+		executable,
+		args: [bin]
+	};
+}
+function connectorBin() {
+	const current = fileURLToPath(import.meta.url);
+	const currentDir = dirname(current);
+	if (currentDir.endsWith(`${sep}dist`)) return join(currentDir, "index.js");
+	return join(dirname(dirname(current)), "bin", "agent-connector.mjs");
+}
+async function nodeExecutable() {
+	if (!isElectronExecutable(process.execPath)) return process.execPath;
+	const fromPath = await findNodeOnPath();
+	if (fromPath) return fromPath;
+	throw new Error("Connector service install from desktop requires a Node.js executable on PATH.");
+}
+function isElectronExecutable(value) {
+	return Boolean(process.versions.electron) || value.endsWith(`${sep}Electron`);
+}
+async function findNodeOnPath() {
+	const names = platform() === "win32" ? ["node.exe", "node"] : ["node"];
+	for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+		if (!dir) continue;
+		for (const name of names) {
+			const candidate = join(dir, name);
+			if (await exists(candidate)) return candidate;
+		}
+	}
+}
+async function exists(path) {
+	try {
+		await access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function currentUid() {
+	if (!process.getuid) throw new Error("launchctl service management requires a user id.");
+	return String(process.getuid());
+}
+function xmlEscape(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&apos;");
+}
+function systemdQuote(value) {
+	return `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"`;
+}
+function windowsCmdQuote(value) {
+	if (value.includes("\"")) throw new Error("Windows Scheduled Task command values cannot contain double quotes.");
+	return `"${value}"`;
+}
+async function printFile(path) {
+	try {
+		await access(path);
+		console.log(await readFile(path, "utf8"));
+	} catch {
+		console.log(`${path} does not exist yet.`);
+	}
+}
+async function run(command, args, options = {}) {
+	const exitCode = await new Promise((resolveExit) => {
+		const child = spawn(command, args, { stdio: options.quietFailure ? "ignore" : "inherit" });
+		child.once("error", () => resolveExit(127));
+		child.once("exit", (code) => resolveExit(code ?? 1));
+	});
+	if (exitCode !== 0 && !options.allowFailure) throw new Error(`${command} ${args.join(" ")} failed with exit code ${exitCode}.`);
+}
+const TOKEN_STORE_LOCK_WAIT_MS = 45e3;
+var TokenStore = class {
+	path;
+	constructor(path = defaultTokenStorePath()) {
+		this.path = path;
+	}
+	async read() {
+		return this.readData();
+	}
+	async resolveServerUrl(explicitServerUrl) {
+		if (explicitServerUrl) return normalizeServerUrl(explicitServerUrl);
+		return (await this.readData()).activeServerUrl ?? "https://devbox.sipher.gg";
+	}
+	async getProfile(serverUrl) {
+		return (await this.readData()).profiles[normalizeServerUrl(serverUrl)];
+	}
+	async saveLogin(input) {
+		const serverUrl = normalizeServerUrl(input.serverUrl);
+		return this.withLockedData((data) => {
+			const existing = data.profiles[serverUrl];
+			const profile = {
+				serverUrl,
+				connectorInstallId: existing?.connectorInstallId ?? randomUUID(),
+				...input.allowInsecureTls ? { allowInsecureTls: true } : {},
+				refreshToken: input.refreshToken,
+				accessToken: input.accessToken,
+				accessTokenExpiresAt: expiresAt$1(input.expiresInSeconds, input.now),
+				...existing?.machineId ? { machineId: existing.machineId } : {}
+			};
+			data.activeServerUrl = serverUrl;
+			data.profiles[serverUrl] = profile;
+			return profile;
+		});
+	}
+	async updateProfile(serverUrl, update) {
+		const normalized = normalizeServerUrl(serverUrl);
+		return this.withLockedData((data) => {
+			const profile = update(data.profiles[normalized]);
+			data.profiles[normalized] = profile;
+			return profile;
+		});
+	}
+	async removeProfile(serverUrl) {
+		const normalized = normalizeServerUrl(serverUrl);
+		return this.withLockedData((data) => {
+			const profile = data.profiles[normalized];
+			delete data.profiles[normalized];
+			if (data.activeServerUrl === normalized) {
+				const [nextActive] = Object.keys(data.profiles);
+				if (nextActive) data.activeServerUrl = nextActive;
+				else delete data.activeServerUrl;
+			}
+			return profile;
+		});
+	}
+	async withLockedData(callback) {
+		const lockPath = `${this.path}.lock`;
+		const owner = await acquireLock(lockPath);
+		try {
+			const data = await this.readData();
+			const result = await callback(data);
+			await this.writeData(data);
+			return result;
+		} finally {
+			await releaseLock(lockPath, owner);
+		}
+	}
+	async readData() {
+		try {
+			const parsed = JSON.parse(await readFile(this.path, "utf8"));
+			if (!parsed || typeof parsed !== "object") return emptyData();
+			const raw = parsed;
+			const profiles = {};
+			if (raw.profiles && typeof raw.profiles === "object") for (const [key, value] of Object.entries(raw.profiles)) {
+				const profile = parseProfile(value);
+				if (profile) profiles[normalizeServerUrl(key)] = profile;
+			}
+			return {
+				profiles,
+				...typeof raw.activeServerUrl === "string" ? { activeServerUrl: normalizeServerUrl(raw.activeServerUrl) } : {}
+			};
+		} catch (error) {
+			if (!isNotFoundError(error)) throw error;
+			return emptyData();
+		}
+	}
+	async writeData(data) {
+		await mkdir(dirname(this.path), { recursive: true });
+		const tempPath = `${this.path}.${process.pid}.${Date.now()}.tmp`;
+		await writeFile(tempPath, `${JSON.stringify(data, null, 2)}\n`, { mode: 384 });
+		await chmod(tempPath, 384).catch(() => void 0);
+		await rename(tempPath, this.path);
+		await chmod(this.path, 384).catch(() => void 0);
+	}
+};
+function normalizeServerUrl(value) {
+	const url = new URL(value);
+	url.hash = "";
+	url.search = "";
+	url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+	return url.toString().replace(/\/$/, "");
+}
+function defaultTokenStorePath() {
+	return defaultConnectorAuthStorePath();
+}
+function emptyData() {
+	return { profiles: {} };
+}
+function expiresAt$1(expiresInSeconds, now = /* @__PURE__ */ new Date()) {
+	return new Date(now.getTime() + Math.max(0, expiresInSeconds) * 1e3).toISOString();
+}
+function parseProfile(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const raw = value;
+	if (typeof raw.serverUrl !== "string" || typeof raw.connectorInstallId !== "string") return;
+	return {
+		serverUrl: normalizeServerUrl(raw.serverUrl),
+		connectorInstallId: raw.connectorInstallId,
+		...raw.allowInsecureTls === true ? { allowInsecureTls: true } : {},
+		...typeof raw.refreshToken === "string" ? { refreshToken: raw.refreshToken } : {},
+		...typeof raw.accessToken === "string" ? { accessToken: raw.accessToken } : {},
+		...typeof raw.accessTokenExpiresAt === "string" ? { accessTokenExpiresAt: raw.accessTokenExpiresAt } : {},
+		...typeof raw.machineId === "string" ? { machineId: raw.machineId } : {}
+	};
+}
+async function acquireLock(lockPath) {
+	const started = Date.now();
+	let attempts = 0;
+	debugLock("acquire:start", {
+		lockPath,
+		waitMs: TOKEN_STORE_LOCK_WAIT_MS
+	});
+	await mkdir(dirname(lockPath), { recursive: true });
+	while (true) {
+		attempts += 1;
+		const owner = {
+			token: randomUUID(),
+			pid: process.pid,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		try {
+			await mkdir(lockPath, { recursive: false });
+			await writeLockOwner(lockPath, owner);
+			debugLock("acquire:success", {
+				lockPath,
+				attempts,
+				owner
+			});
+			return owner;
+		} catch (error) {
+			if (!isAlreadyExistsError(error) || Date.now() - started > 45e3) {
+				const currentOwner = await readLockOwner(lockPath).catch((readError) => ({ readError: errorMessage(readError) }));
+				debugLock("acquire:timeout", {
+					lockPath,
+					attempts,
+					elapsedMs: Date.now() - started,
+					error: errorMessage(error),
+					currentOwner
+				});
+				throw new Error("Timed out waiting for CLI token store lock.");
+			}
+			if (attempts === 1 || attempts % 40 === 0) {
+				const currentOwner = await readLockOwner(lockPath).catch((readError) => ({ readError: errorMessage(readError) }));
+				debugLock("acquire:waiting", {
+					lockPath,
+					attempts,
+					elapsedMs: Date.now() - started,
+					currentOwner
+				});
+			}
+			await removeStaleLock(lockPath);
+			await setTimeout$1(25);
+		}
+	}
+}
+function isAlreadyExistsError(error) {
+	return Boolean(error && typeof error === "object" && error.code === "EEXIST");
+}
+function isNotFoundError(error) {
+	return Boolean(error && typeof error === "object" && error.code === "ENOENT");
+}
+async function removeStaleLock(lockPath, beforeConfirm) {
+	const owner = await readLockOwner(lockPath);
+	const stale = owner ? lockOwnerStaleReason(owner) : void 0;
+	debugLock("stale:check", {
+		lockPath,
+		owner,
+		stale
+	});
+	if (!owner || !stale) return;
+	await beforeConfirm?.();
+	const confirmedOwner = await readLockOwner(lockPath);
+	const confirmedStale = confirmedOwner ? lockOwnerStaleReason(confirmedOwner) : void 0;
+	if (!confirmedOwner || confirmedOwner.token !== owner.token || !confirmedStale) {
+		debugLock("stale:skip-remove", {
+			lockPath,
+			owner,
+			confirmedOwner,
+			confirmedStale
+		});
+		return;
+	}
+	await rm(ownerPath(lockPath, owner), { force: true });
+	await rmdir(lockPath).catch(() => void 0);
+	debugLock("stale:removed", {
+		lockPath,
+		owner,
+		stale: confirmedStale
+	});
+}
+async function releaseLock(lockPath, owner, beforeRemove) {
+	await beforeRemove?.();
+	await rm(ownerPath(lockPath, owner), { force: true });
+	await rmdir(lockPath).catch(() => void 0);
+}
+async function writeLockOwner(lockPath, owner) {
+	await writeFile(ownerPath(lockPath, owner), `${JSON.stringify(owner)}\n`, { mode: 384 });
+}
+async function readLockOwner(lockPath) {
+	const token = await readActiveOwnerToken(lockPath);
+	if (token) return readOwnerFile(join(lockPath, `owner-${token}.json`));
+	const legacyOwner = await readOwnerFile(join(lockPath, "owner.json")).catch((error) => {
+		if (isNotFoundError(error)) return void 0;
+		throw error;
+	});
+	if (legacyOwner) return {
+		...legacyOwner,
+		token: `legacy-owner-json:${legacyOwner.token}`
+	};
+	return fallbackLockOwner(lockPath);
+}
+async function readActiveOwnerToken(lockPath) {
+	if (!await stat(lockPath).catch(() => void 0)) return void 0;
+	try {
+		const owners = (await readdir(lockPath)).filter((name) => name.startsWith("owner-") && name.endsWith(".json"));
+		return owners.length === 1 ? owners[0]?.slice(6, -5) : void 0;
+	} catch (error) {
+		if (isNotFoundError(error)) return void 0;
+		throw error;
+	}
+}
+async function readOwnerFile(path) {
+	const value = JSON.parse(await readFile(path, "utf8"));
+	if (!value || typeof value !== "object") return void 0;
+	const raw = value;
+	if (typeof raw.token !== "string" || typeof raw.pid !== "number" || typeof raw.createdAt !== "string") return;
+	return {
+		token: raw.token,
+		pid: raw.pid,
+		createdAt: raw.createdAt
+	};
+}
+async function fallbackLockOwner(lockPath) {
+	const stats = await stat(lockPath).catch(() => void 0);
+	if (!stats) return void 0;
+	return {
+		token: `legacy:${stats.mtimeMs}`,
+		pid: 0,
+		createdAt: new Date(stats.mtimeMs).toISOString()
+	};
+}
+function lockOwnerStaleReason(owner) {
+	const createdAt = new Date(owner.createdAt).getTime();
+	if (!Number.isFinite(createdAt)) return "invalid-created-at";
+	if (Date.now() - createdAt >= 3e5) return "expired";
+	if (lockOwnerProcessIsGone(owner.pid)) return "owner-process-exited";
+}
+function lockOwnerProcessIsGone(pid) {
+	if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid) return false;
+	try {
+		process.kill(pid, 0);
+		return false;
+	} catch (error) {
+		return error.code !== "EPERM";
+	}
+}
+function debugLock(event, payload) {
+	if (process.env.AGENTS_TOKEN_STORE_DEBUG !== "1") return;
+	console.error(`[agents token-store] ${event} ${JSON.stringify(payload)}`);
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function ownerPath(lockPath, owner) {
+	if (owner.token.startsWith("legacy-owner-json:")) return join(lockPath, "owner.json");
+	return join(lockPath, `owner-${owner.token}.json`);
+}
+//#endregion
+//#region src/local-machine-controller.ts
+const ACCESS_TOKEN_REFRESH_SKEW_MS = 3e4;
+async function ensureLocalMachineReady(options) {
+	const serverUrl = normalizeServerUrl(options.serverUrl);
+	if (!(await options.store.getProfile(serverUrl))?.refreshToken) return {
+		state: "needs_login",
+		serverUrl,
+		message: `Not logged in to ${serverUrl}. Run agents login.`
+	};
+	let machine;
+	let allowInsecureTls;
+	try {
+		const result = await claimLocalMachine({
+			serverUrl,
+			store: options.store,
+			name: options.name,
+			allowInsecureTls: options.allowInsecureTls
+		});
+		machine = result.machine;
+		allowInsecureTls = result.allowInsecureTls;
+	} catch (error) {
+		const claimError = classifyClaimError(error);
+		return {
+			state: "error",
+			code: isRefreshError(error) ? "refresh_failed" : claimError.code,
+			serverUrl,
+			message: error instanceof Error ? error.message : "Failed to prepare local Machine.",
+			canRetry: !isRefreshError(error) && claimError.canRetry
+		};
+	}
+	if (options.installService) {
+		if (!options.serviceInstaller) return {
+			state: "error",
+			code: "service_unsupported",
+			serverUrl,
+			message: "Connector service install is not available in this runtime.",
+			canRetry: false
+		};
+		try {
+			await options.serviceInstaller({
+				serverUrl,
+				...allowInsecureTls ? { allowInsecureTls: true } : {}
+			});
+		} catch (error) {
+			if (isConnectorServiceUnsupportedError(error)) return {
+				state: "error",
+				code: "service_unsupported",
+				serverUrl,
+				message: error.message,
+				canRetry: false
+			};
+			return {
+				state: "error",
+				code: "service_install_failed",
+				serverUrl,
+				message: error instanceof Error ? error.message : "Failed to install connector service.",
+				canRetry: true
+			};
+		}
+	}
+	return {
+		state: "ready",
+		serverUrl,
+		machineId: machine.machineId,
+		machineName: machine.name
+	};
+}
+async function setupConnectorProfile(options) {
+	const { machine, allowInsecureTls, serverUrl } = await claimLocalMachine({
+		serverUrl: options.serverUrl,
+		store: options.store,
+		name: options.name,
+		allowInsecureTls: options.allowInsecureTls
+	});
+	if (options.installService) {
+		if (!options.serviceInstaller) throw new Error("Connector service install is not available in this runtime.");
+		await options.serviceInstaller({
+			serverUrl,
+			...allowInsecureTls ? { allowInsecureTls: true } : {}
+		});
+	}
+	return machine;
+}
+async function startConnectorDeviceAuthorization(options) {
+	const serverUrl = normalizeServerUrl(options.serverUrl);
+	return {
+		...await new CliAuthClient(serverUrl, { allowInsecureTls: options.allowInsecureTls }).startDeviceAuthorization(options.deviceLabel ?? hostname()),
+		serverUrl
+	};
+}
+async function pollConnectorDeviceToken(options) {
+	const serverUrl = normalizeServerUrl(options.serverUrl);
+	const token = await pollDeviceToken(new CliAuthClient(serverUrl, { allowInsecureTls: options.allowInsecureTls }), {
+		deviceCode: options.deviceCode,
+		intervalSeconds: options.intervalSeconds,
+		expiresInSeconds: options.expiresInSeconds
+	});
+	return options.store.saveLogin({
+		serverUrl,
+		refreshToken: token.refreshToken,
+		accessToken: token.accessToken,
+		expiresInSeconds: token.expiresIn,
+		allowInsecureTls: options.allowInsecureTls
+	});
+}
+async function ensureAccessToken(input) {
+	const serverUrl = normalizeServerUrl(input.serverUrl);
+	return input.store.withLockedData(async (data) => {
+		const now = input.now ?? /* @__PURE__ */ new Date();
+		const profile = data.profiles[serverUrl];
+		if (!profile?.refreshToken) throw new Error(`Not logged in to ${serverUrl}. Run agents login.`);
+		const auth = input.authClient ?? new CliAuthClient(serverUrl, { allowInsecureTls: input.allowInsecureTls ?? profile.allowInsecureTls });
+		if (!input.forceRefresh && profile.accessToken && tokenIsFresh(profile.accessTokenExpiresAt, now)) return profile.accessToken;
+		const refreshed = await auth.refresh(profile.refreshToken);
+		const updated = {
+			...profile,
+			refreshToken: refreshed.refreshToken,
+			accessToken: refreshed.accessToken,
+			accessTokenExpiresAt: expiresAt(refreshed.expiresIn, now)
+		};
+		data.profiles[serverUrl] = updated;
+		return refreshed.accessToken;
+	});
+}
+function createAccessTokenProvider(input) {
+	return (options) => ensureAccessToken({
+		...input,
+		forceRefresh: options?.forceRefresh
+	});
+}
+async function claimLocalMachine(options) {
+	const serverUrl = normalizeServerUrl(options.serverUrl);
+	if (options.allowInsecureTls !== void 0) await options.store.updateProfile(serverUrl, (current) => ({
+		...requireProfile(current, serverUrl),
+		...options.allowInsecureTls ? { allowInsecureTls: true } : {}
+	}));
+	const accessToken = await ensureAccessToken({
+		serverUrl,
+		store: options.store,
+		allowInsecureTls: options.allowInsecureTls
+	}).catch((error) => {
+		throw markRefreshError(error);
+	});
+	const profile = await options.store.getProfile(serverUrl);
+	if (!profile) throw new Error(`Not logged in to ${serverUrl}. Run agents login.`);
+	const allowInsecureTls = options.allowInsecureTls ?? profile.allowInsecureTls;
+	const machine = await new MachineClient(serverUrl, { allowInsecureTls }).claim({
+		accessToken,
+		connectorInstallId: profile.connectorInstallId,
+		name: options.name
+	});
+	await options.store.updateProfile(serverUrl, (current) => ({
+		...requireProfile(current, serverUrl),
+		machineId: machine.machineId
+	}));
+	return {
+		machine,
+		serverUrl,
+		allowInsecureTls
+	};
+}
+async function pollDeviceToken(auth, input) {
+	const expiresAt = Date.now() + input.expiresInSeconds * 1e3;
+	let intervalMs = Math.max(1, input.intervalSeconds) * 1e3;
+	while (Date.now() < expiresAt) try {
+		return await auth.pollDeviceToken(input.deviceCode);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "";
+		if (message.includes("slow_down")) intervalMs += 5e3;
+		if (!message.includes("authorization_pending") && !message.includes("slow_down")) throw error;
+		await setTimeout$1(intervalMs);
+	}
+	throw new Error("CLI login expired before authorization completed.");
+}
+function tokenIsFresh(expiresAtValue, now) {
+	if (!expiresAtValue) return false;
+	return new Date(expiresAtValue).getTime() - now.getTime() > ACCESS_TOKEN_REFRESH_SKEW_MS;
+}
+function expiresAt(expiresInSeconds, now) {
+	return new Date(now.getTime() + Math.max(0, expiresInSeconds) * 1e3).toISOString();
+}
+function requireProfile(profile, serverUrl) {
+	if (!profile) throw new Error(`Not logged in to ${serverUrl}. Run agents login.`);
+	return profile;
+}
+function markRefreshError(error) {
+	if (error instanceof Error) return Object.assign(error, { localMachineStage: "refresh" });
+	return Object.assign(/* @__PURE__ */ new Error("Failed to refresh connector access token."), { localMachineStage: "refresh" });
+}
+function isRefreshError(error) {
+	return Boolean(error && typeof error === "object" && error.localMachineStage === "refresh");
+}
+function classifyClaimError(error) {
+	if (error instanceof MachineClaimError && error.code === "machine_claim_conflict") return {
+		code: "claim_conflict",
+		canRetry: false
+	};
+	return {
+		code: "claim_failed",
+		canRetry: true
+	};
+}
+//#endregion
+export { MACHINE_MCP_MAX_ERROR_MESSAGE_BYTES as A, validateMachineMcpRequest as B, MAX_MACHINE_JOB_OUTPUT_BYTES as C, MAX_TEXT_FILE_WRITE_BYTES as D, MAX_TEXT_FILE_READ_LINES as E, encodeMachineMcpFrame as F, parseArgs as G, MAX_MACHINE_TERMINAL_HISTORY_BYTES as H, sanitizeAndCanonicalizeMachineMcpCatalog as I, substituteMachineMcpLaunch as L, MACHINE_MCP_MAX_STDERR_BYTES as M, MACHINE_MCP_TAG as N, isServerRpcRequest as O, MachineMcpValidationError as P, utf8Bytes as R, MAX_MACHINE_FILE_SEARCH_PATH_LENGTH as S, MAX_TEXT_FILE_READ_BYTES as T, CliAuthClient as U, validateMachineMcpResult as V, allowInsecureTlsForLocalTesting as W, detectShell as _, setupConnectorProfile as a, DEFAULT_TEXT_FILE_READ_LINES as b, defaultTokenStorePath as c, installConnectorService as d, isConnectorServiceUnsupportedError as f, ShellManager as g, resolveConnectorProfileContext as h, pollConnectorDeviceToken as i, MACHINE_MCP_MAX_FRAME_BYTES as j, CONNECTOR_MAX_WEBSOCKET_PAYLOAD_BYTES as k, normalizeServerUrl as l, runServiceCommand as m, ensureAccessToken as n, startConnectorDeviceAuthorization as o, loadServiceConfig as p, ensureLocalMachineReady as r, TokenStore as s, createAccessTokenProvider as t, ConnectorServiceUnsupportedError as u, DEFAULT_MACHINE_FILE_READ_BYTES as v, MAX_PATCH_SOURCE_FILE_BYTES as w, MAX_MACHINE_FILE_READ_BYTES as x, DEFAULT_TEXT_FILE_READ_BYTES as y, validateMachineMcpLaunchSpec as z };