@skaile/workspaces 4.9.3 → 4.9.4

package/dist/{chunk-XZYZOCPK.js → chunk-7F4FGEMI.js}

@@ -1,4 +1,4 @@
-import { logErr } from './chunk-2KVFAWUA.js';
+import { logErr } from './chunk-OIXSGSKM.js';
 import { flowKindProvider } from './chunk-AOE4KOMJ.js';
 import { knowledgeKindProvider } from './chunk-7LHSC2DS.js';
 import { createDefaultRegistry } from './chunk-M5H4DWIA.js';
@@ -103,5 +103,5 @@ async function openLibraryManager() {
 }
 
 export { LocalCatalogDisabledError, createFullRegistry, openCatalogSource, openLibrary, openLibraryManager, resolveCatalogSource };
-//# sourceMappingURL=chunk-XZYZOCPK.js.map
-//# sourceMappingURL=chunk-XZYZOCPK.js.map
+//# sourceMappingURL=chunk-7F4FGEMI.js.map
+//# sourceMappingURL=chunk-7F4FGEMI.js.map

package/dist/{chunk-XZYZOCPK.js.map → chunk-7F4FGEMI.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/open-registry.ts","../cli/src/open-library.ts"],"names":["source"],"mappings":";;;;;;AA2BO,SAAS,kBAAA,GAAwC;AACtD,EAAA,MAAM,WAAW,qBAAA,EAAsB;AACvC,EAAA,QAAA,CAAS,SAAS,gBAAgB,CAAA;AAClC,EAAA,QAAA,CAAS,SAAS,qBAAqB,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;;;ACfO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,2BAAA;AAAA,EACd;AACF;AASA,eAAsB,WAAA,GAAc;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAChE,IAAA,OAAO,IAAI,UAAA,CAAW,EAAE,YAAA,EAAc,kBAAA,IAAsB,CAAA;AAAA,EAC9D,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,2BAAA,EAA8B,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACvF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAqBA,eAAsB,kBAAkB,IAAA,EAQtC;AACA,EAAA,MAAM,EAAE,eAAe,mBAAA,EAAqB,iBAAA,EAAmB,mBAAkB,GAAI,MAAM,OACzF,oBACF,CAAA;AACA,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,yBAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,YAAY,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACxD;AAwCA,eAAsB,qBAAqB,IAAA,EAKR;AACjC,EAAA,MAAM;AAAA,IACJ,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAC7C,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AAErD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,EAAA,GAAK,MAAM,OAAO,IAAS,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,WAAA,EAAY;AAG1C,MAAA,MAAM,SAAS,OAAA,CACZ,MAAA;AAAA,QACC,CAAC,CAAA,KACC,CAAA,CAAE,OAAA,KAAY,OAAA,IAAW,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAA,GAAS;AAAA,OAC3E,CACC,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAA,CAAU,OAAA,EAAQ,GAAI,CAAA,CAAE,SAAA,CAAU,OAAA,EAAS,CAAA;AAE/D,MAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SAEF;AAAA,MACF;AAGA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,CAAC,MAAM,EAAA,CAAG,UAAA,CAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,0GAAA,EACkB,IAAA,CAAK,IAAI,CAAA,UAAA,EAAa,KAAK,EAAE,CAAA,mGAAA;AAAA,SAEjD;AAAA,MACF;AAEA,MAAA,MAAMA,UAAS,IAAI,kBAAA;AAAA,QACjB,OAAA;AAAA,QACA,OAAA,CAAQ,EAAA;AAAA,QACR,OAAA,CAAQ,IAAA;AAAA,QACR,kBAAA;AAAmB,OACrB;AACA,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAAA,IAChD,SAAS,GAAA,EAAK;AAGZ,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,MAAM,SACJ,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,GACpB,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,UAAA,EAAY,CAAA,GAC7C,IAAI,oBAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACrD,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACnC;AASA,eAAsB,kBAAA,GAInB;AACD,EAAA,MAAM,EAAE,cAAA,EAAe,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACpE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,EAAA,MAAM,OAAA,GAAU,IAAI,cAAA,CAAe,OAAO,CAAA;AAC1C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAC1D","file":"chunk-XZYZOCPK.js","sourcesContent":["/**\n * open-registry.ts — shared helper to create a full AssetKindRegistry.\n *\n * Bootstraps the registry with all built-in providers (9 core + preset)\n * from @skaile/discovery, plus the extension kind providers (flow from\n * @skaile/workspaces/factory-assets/connectors/flow/engine, knowledge from @skaile/library).\n *\n * This is the single registration point for the CLI. All code paths\n * that need a registry (source sync, lib-status, etc.) should use this.\n */\n\nimport type { AssetKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { createDefaultRegistry } from \"@skaile/workspaces/discovery\";\nimport { flowKindProvider } from \"@skaile/workspaces/factory-assets/connectors/flow/engine\";\nimport { knowledgeKindProvider } from \"@skaile/workspaces/library\";\n\n/**\n * Create a fully-configured AssetKindRegistry with all known providers.\n *\n * Registers:\n * - 9 core kinds (skill, agent, connector, mount, mcp-server, contract, prompt, persona, ruleset)\n * - preset (composition entity)\n * - flow (extension, from @skaile/workspaces/factory-assets/connectors/flow/engine)\n * - knowledge (extension, from @skaile/library)\n *\n * @returns An unfrozen registry (auto-freezes on first read)\n */\nexport function createFullRegistry(): AssetKindRegistry {\n  const registry = createDefaultRegistry();\n  registry.register(flowKindProvider);\n  registry.register(knowledgeKindProvider);\n  return registry;\n}\n","/**\n * open-library.ts — shared helpers to open the LocalIndex and the configured\n * Catalog source.\n *\n * Lazy-loads the `@skaile/workspaces/library` subpath and returns the\n * LocalIndex instance (backed by `@libsql/client`; runs on Node and Bun).\n * The catalog-source helper reads\n * `~/.skaile/config.yaml` (and project-level overlay if `projectDir` is given)\n * to decide between {@link RemoteCatalogSource} (default — points at\n * `https://skaile.store`) and a {@link LocalCatalogSource} bound to the most\n * recent local library registered via `skaile source add`.\n */\n\nimport { logErr } from \"./helpers.ts\";\nimport { createFullRegistry } from \"./open-registry.ts\";\n\n/** Thrown by {@link openCatalogSource} when `catalog.url` is the `local` sentinel. */\nexport class LocalCatalogDisabledError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"LocalCatalogDisabledError\";\n  }\n}\n\n/**\n * Open the LocalIndex with the full kind registry. Exits with code 1\n * if the library directory cannot be created.\n *\n * @returns A `LocalIndex` instance ready for use.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibrary() {\n  try {\n    const { LocalIndex } = await import(\"@skaile/workspaces/library\");\n    return new LocalIndex({ kindRegistry: createFullRegistry() });\n  } catch (err) {\n    logErr(`Could not open LocalIndex: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/**\n * Resolve the configured **remote** Catalog source for the CLI.\n *\n * Reads `~/.skaile/config.yaml` (plus the optional project-level overlay) and\n * returns a {@link RemoteCatalogSource} pointing at `catalog.url` (default:\n * `https://skaile.store`). The `cache_ttl: 0` config flag flips the source\n * into air-gapped mode: network reads are disabled, only `skaile update`\n * performs refreshes.\n *\n * **Local-mode rejection.** If the resolved config has `catalog.url: local`\n * this helper throws — callers wanting the dispatched local-or-remote source\n * must use {@link resolveCatalogSource}. Remote-only consumers like\n * `skaile update --catalog-only` rely on this strict behaviour.\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A configured {@link RemoteCatalogSource}.\n * @throws When `catalog.url` is the `local` sentinel.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<\n  | import(\"@skaile/workspaces/library\").RemoteCatalogSource\n  | import(\"@skaile/workspaces/library\").RestCatalogSource\n> {\n  const { resolveConfig, RemoteCatalogSource, RestCatalogSource, isLocalCatalogUrl } = await import(\n    \"@skaile/workspaces/library\"\n  );\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n  if (isLocalCatalogUrl(baseUrl)) {\n    throw new LocalCatalogDisabledError(\n      \"catalog.url is set to 'local' — remote catalog is disabled. \" +\n        \"Use `skaile source add <path>` + `skaile source sync` for local sources, \" +\n        \"or set `catalog.url: https://skaile.store` in ~/.skaile/config.yaml.\",\n    );\n  }\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  if (cfg.catalog.framing === \"rest\") {\n    return new RestCatalogSource({ baseUrl, cacheTtlMs });\n  }\n  return new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n}\n\n/**\n * Resolved catalog source plus a close handle for releasing any underlying\n * resources (e.g. the `LocalIndex` SQLite connection in local mode).\n *\n * Callers MUST invoke `close()` when done — typically in a `finally` block.\n * For remote-mode sources `close()` is a no-op, but the contract is uniform\n * so consumers don't have to branch.\n *\n * @docLink cli/dev-guide#open-library\n */\nexport interface ResolvedCatalogSource {\n  /** The {@link ICatalogSource} ready for use. */\n  source: import(\"@skaile/workspaces/library\").ICatalogSource;\n  /** Release any underlying resources (SQLite handle in local mode). */\n  close(): void;\n}\n\n/**\n * Resolve the configured Catalog source — local or remote — based on\n * `~/.skaile/config.yaml`.\n *\n * Dispatch:\n * - `catalog.url: local` → opens {@link LocalIndex}, picks the most recently\n *   registered local library whose `path` still exists on disk, and returns a\n *   {@link LocalCatalogSource} bound to that library. Throws if no usable\n *   local library is registered.\n * - any URL → returns {@link RemoteCatalogSource} (same as\n *   {@link openCatalogSource}).\n *\n * The returned `close()` releases the underlying `LocalIndex` SQLite handle\n * in local mode (no-op in remote mode). Callers MUST invoke it — typically in\n * a `finally` block — to satisfy `library/CLAUDE.md` § \"Notes for Consumers\".\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A `ResolvedCatalogSource` carrying the source and a close handle.\n * @throws When `local` is configured but no usable local library is registered.\n * @docLink cli/dev-guide#open-library\n */\nexport async function resolveCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<ResolvedCatalogSource> {\n  const {\n    resolveConfig,\n    RemoteCatalogSource,\n    RestCatalogSource,\n    LocalCatalogSource,\n    isLocalCatalogUrl,\n  } = await import(\"@skaile/workspaces/library\");\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n\n  if (isLocalCatalogUrl(baseUrl)) {\n    const fs = await import(\"node:fs\");\n    const library = await openLibrary();\n    try {\n      const sources = await library.listSources();\n      type LibraryRow = (typeof sources)[number];\n      // Type-narrow: `path` is required for local libraries after the filter.\n      const usable = sources\n        .filter(\n          (s): s is LibraryRow & { path: string } =>\n            s.backend === \"local\" && typeof s.path === \"string\" && s.path.length > 0,\n        )\n        .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n      if (usable.length === 0) {\n        throw new Error(\n          \"catalog.url is set to 'local' but no local library is registered. \" +\n            \"Run `skaile source add <path>` first, then `skaile source sync`.\",\n        );\n      }\n\n      // Prefer the most recently added library whose path still exists.\n      const present = usable.find((s) => fs.existsSync(s.path));\n      if (!present) {\n        const head = usable[0];\n        throw new Error(\n          `catalog.url is set to 'local' but every registered local library has a missing path on disk. ` +\n            `Most recent: ${head.path} (library ${head.id}). ` +\n            `Re-register with \\`skaile source add <existing-path>\\` or run \\`skaile source list\\` to inspect.`,\n        );\n      }\n\n      const source = new LocalCatalogSource(\n        library,\n        present.id,\n        present.path,\n        createFullRegistry(),\n      );\n      return { source, close: () => library.close() };\n    } catch (err) {\n      // Release the handle on any failure during dispatch — otherwise the\n      // SQLite WAL state leaks for the lifetime of the process.\n      library.close();\n      throw err;\n    }\n  }\n\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  const source =\n    cfg.catalog.framing === \"rest\"\n      ? new RestCatalogSource({ baseUrl, cacheTtlMs })\n      : new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n  return { source, close: () => {} };\n}\n\n/**\n * Open the LibraryManager bound to the active LocalIndex.\n * Caller owns lifetime — must call `close()` (returned helper closes the\n * underlying LocalIndex).\n *\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibraryManager(): Promise<{\n  manager: import(\"@skaile/workspaces/library\").LibraryManager;\n  library: import(\"@skaile/workspaces/library\").LocalIndex;\n  close: () => void;\n}> {\n  const { LibraryManager } = await import(\"@skaile/workspaces/library\");\n  const library = await openLibrary();\n  const manager = new LibraryManager(library);\n  return { manager, library, close: () => library.close() };\n}\n"]}
+{"version":3,"sources":["../cli/src/open-registry.ts","../cli/src/open-library.ts"],"names":["source"],"mappings":";;;;;;AA2BO,SAAS,kBAAA,GAAwC;AACtD,EAAA,MAAM,WAAW,qBAAA,EAAsB;AACvC,EAAA,QAAA,CAAS,SAAS,gBAAgB,CAAA;AAClC,EAAA,QAAA,CAAS,SAAS,qBAAqB,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;;;ACfO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,2BAAA;AAAA,EACd;AACF;AASA,eAAsB,WAAA,GAAc;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAChE,IAAA,OAAO,IAAI,UAAA,CAAW,EAAE,YAAA,EAAc,kBAAA,IAAsB,CAAA;AAAA,EAC9D,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,2BAAA,EAA8B,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACvF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAqBA,eAAsB,kBAAkB,IAAA,EAQtC;AACA,EAAA,MAAM,EAAE,eAAe,mBAAA,EAAqB,iBAAA,EAAmB,mBAAkB,GAAI,MAAM,OACzF,oBACF,CAAA;AACA,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,yBAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,YAAY,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACxD;AAwCA,eAAsB,qBAAqB,IAAA,EAKR;AACjC,EAAA,MAAM;AAAA,IACJ,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAC7C,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AAErD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,EAAA,GAAK,MAAM,OAAO,IAAS,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,WAAA,EAAY;AAG1C,MAAA,MAAM,SAAS,OAAA,CACZ,MAAA;AAAA,QACC,CAAC,CAAA,KACC,CAAA,CAAE,OAAA,KAAY,OAAA,IAAW,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAA,GAAS;AAAA,OAC3E,CACC,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAA,CAAU,OAAA,EAAQ,GAAI,CAAA,CAAE,SAAA,CAAU,OAAA,EAAS,CAAA;AAE/D,MAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SAEF;AAAA,MACF;AAGA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,CAAC,MAAM,EAAA,CAAG,UAAA,CAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,0GAAA,EACkB,IAAA,CAAK,IAAI,CAAA,UAAA,EAAa,KAAK,EAAE,CAAA,mGAAA;AAAA,SAEjD;AAAA,MACF;AAEA,MAAA,MAAMA,UAAS,IAAI,kBAAA;AAAA,QACjB,OAAA;AAAA,QACA,OAAA,CAAQ,EAAA;AAAA,QACR,OAAA,CAAQ,IAAA;AAAA,QACR,kBAAA;AAAmB,OACrB;AACA,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAAA,IAChD,SAAS,GAAA,EAAK;AAGZ,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,MAAM,SACJ,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,GACpB,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,UAAA,EAAY,CAAA,GAC7C,IAAI,oBAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACrD,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACnC;AASA,eAAsB,kBAAA,GAInB;AACD,EAAA,MAAM,EAAE,cAAA,EAAe,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACpE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,EAAA,MAAM,OAAA,GAAU,IAAI,cAAA,CAAe,OAAO,CAAA;AAC1C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAC1D","file":"chunk-7F4FGEMI.js","sourcesContent":["/**\n * open-registry.ts — shared helper to create a full AssetKindRegistry.\n *\n * Bootstraps the registry with all built-in providers (9 core + preset)\n * from @skaile/discovery, plus the extension kind providers (flow from\n * @skaile/workspaces/factory-assets/connectors/flow/engine, knowledge from @skaile/library).\n *\n * This is the single registration point for the CLI. All code paths\n * that need a registry (source sync, lib-status, etc.) should use this.\n */\n\nimport type { AssetKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { createDefaultRegistry } from \"@skaile/workspaces/discovery\";\nimport { flowKindProvider } from \"@skaile/workspaces/factory-assets/connectors/flow/engine\";\nimport { knowledgeKindProvider } from \"@skaile/workspaces/library\";\n\n/**\n * Create a fully-configured AssetKindRegistry with all known providers.\n *\n * Registers:\n * - 9 core kinds (skill, agent, connector, mount, mcp-server, contract, prompt, persona, ruleset)\n * - preset (composition entity)\n * - flow (extension, from @skaile/workspaces/factory-assets/connectors/flow/engine)\n * - knowledge (extension, from @skaile/library)\n *\n * @returns An unfrozen registry (auto-freezes on first read)\n */\nexport function createFullRegistry(): AssetKindRegistry {\n  const registry = createDefaultRegistry();\n  registry.register(flowKindProvider);\n  registry.register(knowledgeKindProvider);\n  return registry;\n}\n","/**\n * open-library.ts — shared helpers to open the LocalIndex and the configured\n * Catalog source.\n *\n * Lazy-loads the `@skaile/workspaces/library` subpath and returns the\n * LocalIndex instance (backed by `@libsql/client`; runs on Node and Bun).\n * The catalog-source helper reads\n * `~/.skaile/config.yaml` (and project-level overlay if `projectDir` is given)\n * to decide between {@link RemoteCatalogSource} (default — points at\n * `https://skaile.store`) and a {@link LocalCatalogSource} bound to the most\n * recent local library registered via `skaile source add`.\n */\n\nimport { logErr } from \"./helpers.ts\";\nimport { createFullRegistry } from \"./open-registry.ts\";\n\n/** Thrown by {@link openCatalogSource} when `catalog.url` is the `local` sentinel. */\nexport class LocalCatalogDisabledError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"LocalCatalogDisabledError\";\n  }\n}\n\n/**\n * Open the LocalIndex with the full kind registry. Exits with code 1\n * if the library directory cannot be created.\n *\n * @returns A `LocalIndex` instance ready for use.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibrary() {\n  try {\n    const { LocalIndex } = await import(\"@skaile/workspaces/library\");\n    return new LocalIndex({ kindRegistry: createFullRegistry() });\n  } catch (err) {\n    logErr(`Could not open LocalIndex: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/**\n * Resolve the configured **remote** Catalog source for the CLI.\n *\n * Reads `~/.skaile/config.yaml` (plus the optional project-level overlay) and\n * returns a {@link RemoteCatalogSource} pointing at `catalog.url` (default:\n * `https://skaile.store`). The `cache_ttl: 0` config flag flips the source\n * into air-gapped mode: network reads are disabled, only `skaile update`\n * performs refreshes.\n *\n * **Local-mode rejection.** If the resolved config has `catalog.url: local`\n * this helper throws — callers wanting the dispatched local-or-remote source\n * must use {@link resolveCatalogSource}. Remote-only consumers like\n * `skaile update --catalog-only` rely on this strict behaviour.\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A configured {@link RemoteCatalogSource}.\n * @throws When `catalog.url` is the `local` sentinel.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<\n  | import(\"@skaile/workspaces/library\").RemoteCatalogSource\n  | import(\"@skaile/workspaces/library\").RestCatalogSource\n> {\n  const { resolveConfig, RemoteCatalogSource, RestCatalogSource, isLocalCatalogUrl } = await import(\n    \"@skaile/workspaces/library\"\n  );\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n  if (isLocalCatalogUrl(baseUrl)) {\n    throw new LocalCatalogDisabledError(\n      \"catalog.url is set to 'local' — remote catalog is disabled. \" +\n        \"Use `skaile source add <path>` + `skaile source sync` for local sources, \" +\n        \"or set `catalog.url: https://skaile.store` in ~/.skaile/config.yaml.\",\n    );\n  }\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  if (cfg.catalog.framing === \"rest\") {\n    return new RestCatalogSource({ baseUrl, cacheTtlMs });\n  }\n  return new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n}\n\n/**\n * Resolved catalog source plus a close handle for releasing any underlying\n * resources (e.g. the `LocalIndex` SQLite connection in local mode).\n *\n * Callers MUST invoke `close()` when done — typically in a `finally` block.\n * For remote-mode sources `close()` is a no-op, but the contract is uniform\n * so consumers don't have to branch.\n *\n * @docLink cli/dev-guide#open-library\n */\nexport interface ResolvedCatalogSource {\n  /** The {@link ICatalogSource} ready for use. */\n  source: import(\"@skaile/workspaces/library\").ICatalogSource;\n  /** Release any underlying resources (SQLite handle in local mode). */\n  close(): void;\n}\n\n/**\n * Resolve the configured Catalog source — local or remote — based on\n * `~/.skaile/config.yaml`.\n *\n * Dispatch:\n * - `catalog.url: local` → opens {@link LocalIndex}, picks the most recently\n *   registered local library whose `path` still exists on disk, and returns a\n *   {@link LocalCatalogSource} bound to that library. Throws if no usable\n *   local library is registered.\n * - any URL → returns {@link RemoteCatalogSource} (same as\n *   {@link openCatalogSource}).\n *\n * The returned `close()` releases the underlying `LocalIndex` SQLite handle\n * in local mode (no-op in remote mode). Callers MUST invoke it — typically in\n * a `finally` block — to satisfy `library/CLAUDE.md` § \"Notes for Consumers\".\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A `ResolvedCatalogSource` carrying the source and a close handle.\n * @throws When `local` is configured but no usable local library is registered.\n * @docLink cli/dev-guide#open-library\n */\nexport async function resolveCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<ResolvedCatalogSource> {\n  const {\n    resolveConfig,\n    RemoteCatalogSource,\n    RestCatalogSource,\n    LocalCatalogSource,\n    isLocalCatalogUrl,\n  } = await import(\"@skaile/workspaces/library\");\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n\n  if (isLocalCatalogUrl(baseUrl)) {\n    const fs = await import(\"node:fs\");\n    const library = await openLibrary();\n    try {\n      const sources = await library.listSources();\n      type LibraryRow = (typeof sources)[number];\n      // Type-narrow: `path` is required for local libraries after the filter.\n      const usable = sources\n        .filter(\n          (s): s is LibraryRow & { path: string } =>\n            s.backend === \"local\" && typeof s.path === \"string\" && s.path.length > 0,\n        )\n        .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n      if (usable.length === 0) {\n        throw new Error(\n          \"catalog.url is set to 'local' but no local library is registered. \" +\n            \"Run `skaile source add <path>` first, then `skaile source sync`.\",\n        );\n      }\n\n      // Prefer the most recently added library whose path still exists.\n      const present = usable.find((s) => fs.existsSync(s.path));\n      if (!present) {\n        const head = usable[0];\n        throw new Error(\n          `catalog.url is set to 'local' but every registered local library has a missing path on disk. ` +\n            `Most recent: ${head.path} (library ${head.id}). ` +\n            `Re-register with \\`skaile source add <existing-path>\\` or run \\`skaile source list\\` to inspect.`,\n        );\n      }\n\n      const source = new LocalCatalogSource(\n        library,\n        present.id,\n        present.path,\n        createFullRegistry(),\n      );\n      return { source, close: () => library.close() };\n    } catch (err) {\n      // Release the handle on any failure during dispatch — otherwise the\n      // SQLite WAL state leaks for the lifetime of the process.\n      library.close();\n      throw err;\n    }\n  }\n\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  const source =\n    cfg.catalog.framing === \"rest\"\n      ? new RestCatalogSource({ baseUrl, cacheTtlMs })\n      : new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n  return { source, close: () => {} };\n}\n\n/**\n * Open the LibraryManager bound to the active LocalIndex.\n * Caller owns lifetime — must call `close()` (returned helper closes the\n * underlying LocalIndex).\n *\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibraryManager(): Promise<{\n  manager: import(\"@skaile/workspaces/library\").LibraryManager;\n  library: import(\"@skaile/workspaces/library\").LocalIndex;\n  close: () => void;\n}> {\n  const { LibraryManager } = await import(\"@skaile/workspaces/library\");\n  const library = await openLibrary();\n  const manager = new LibraryManager(library);\n  return { manager, library, close: () => library.close() };\n}\n"]}

package/dist/{chunk-JU736VOI.js → chunk-HRVXHRL4.js}

@@ -1749,6 +1749,32 @@ async function ensureTrackingRefspec(branch, cwd) {
   }
   await git(["config", "--add", "remote.origin.fetch", wanted], cwd);
 }
+async function dropTrackingRefspec(branch, cwd) {
+  const name = branch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  await gitOrNull(
+    [
+      "config",
+      "--unset-all",
+      "remote.origin.fetch",
+      `^\\+?refs/heads/${name}:refs/remotes/origin/${name}$`
+    ],
+    cwd
+  );
+}
+async function isAncestor(ancestor, descendant, cwd) {
+  return await gitOrNull(["merge-base", "--is-ancestor", ancestor, descendant], cwd) !== null;
+}
+async function originTrackingRef(branch, cwd) {
+  const ref = `refs/remotes/origin/${branch}`;
+  return await gitOrNull(["rev-parse", "--verify", "--quiet", ref], cwd) === null ? null : ref;
+}
+async function setSessionUpstream(branch, cwd) {
+  await git(["config", `branch.${branch}.remote`, "origin"], cwd);
+  await git(["config", `branch.${branch}.merge`, `refs/heads/${branch}`], cwd);
+}
+function cLocaleEnv() {
+  return { ...process.env, LC_ALL: "C", LANGUAGE: "" };
+}
 async function readGitSyncStatus(cwd, baseBranch) {
   const branchRaw = await gitOrNull(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
   const branch = branchRaw && branchRaw !== "HEAD" ? branchRaw : null;
@@ -1878,6 +1904,9 @@ var GitConnector = class extends AbstractConnector {
       const authUrl = this.authUrl(state);
       await this.prepareCheckout(targetDir, url, branch, authUrl, declaration.access, started);
       if (session.enabled && !session.isMain && session.slug) {
+        if (declaration.mount?.exposeAccessToken !== true) {
+          await this.rebakeRemoteAuth(targetDir, state);
+        }
         await this.checkoutSessionBranch(state, session, targetDir);
       }
       if (sync.fetchIntervalSec > 0) {
@@ -1917,8 +1946,13 @@ var GitConnector = class extends AbstractConnector {
       }
       if (state.sessionBranchFetch === "failed") {
         state.sessionBranchFetch = await this.trackSessionBranch(state.activeBranch, targetDir);
-        if (state.sessionBranchFetch === "fetched" && state.sessionBranchCreated) {
-          await this.adoptOriginSessionBranch(state.activeBranch, targetDir);
+        if (state.sessionBranchFetch === "fetched") {
+          if (state.sessionBranchCreated) {
+            await this.adoptOriginSessionBranch(state.activeBranch, targetDir);
+          } else {
+            await this.reconcileLocalSessionBranch(state, state.activeBranch, targetDir);
+            await syncSubmodules(targetDir, this.log);
+          }
         }
       }
       await ensureSkaileExcluded(targetDir, this.log);
@@ -2040,6 +2074,9 @@ var GitConnector = class extends AbstractConnector {
     if (await localBranchExists(sessionBranch, targetDir)) {
       await gitLocalCheckout([sessionBranch], targetDir);
       this.log.info("reusing existing local session branch", { sessionBranch });
+      if (state.sessionBranchFetch === "fetched") {
+        await this.reconcileLocalSessionBranch(state, sessionBranch, targetDir);
+      }
     } else {
       let originHasBranch = false;
       try {
@@ -2063,6 +2100,7 @@ var GitConnector = class extends AbstractConnector {
     if (created && state.lifecycle.publishOnCreate) {
       try {
         await git(["push", "-u", "origin", sessionBranch], targetDir, 6e4);
+        await this.recordPushedSessionBranch(sessionBranch, targetDir);
         this.log.info("published new session branch", { sessionBranch });
       } catch (err) {
         this.log.warn("publish-on-create push failed; deferring to lifecycle push", {
@@ -2073,36 +2111,47 @@ var GitConnector = class extends AbstractConnector {
     }
   }
   /**
-   * Map the session branch to `refs/remotes/origin/<sessionBranch>` (fetch
-   * refspec) and fetch it once. Never throws: a missing remote branch is the
-   * normal case for a new session, and any other failure leaves the checkout as
-   * it was before this fix (the caller creates the branch from the base).
+   * Fetch the session branch into `refs/remotes/origin/<sessionBranch>` and,
+   * when origin has it, map it with a fetch refspec. Never throws: a missing
+   * remote branch is the normal case for a new session, and any other failure
+   * leaves the checkout as it was (the caller creates the branch from the base).
    *
-   * Also repairs a checkout cloned before this refspec existed, because it runs
-   * on every connect.
+   * The refspec is added only once origin has the branch, and removed when
+   * origin does not have it: a configured refspec for a missing branch makes
+   * every plain `git fetch origin` fail. Runs on every connect, so it also
+   * repairs a checkout cloned before the refspec existed.
    */
   async trackSessionBranch(sessionBranch, targetDir) {
-    try {
-      await ensureTrackingRefspec(sessionBranch, targetDir);
-    } catch (err) {
-      this.log.warn("could not add session-branch fetch refspec", {
-        sessionBranch,
-        error: redactUrlAuth(err instanceof Error ? err.message : String(err))
-      });
-    }
+    let outcome;
     try {
       await runGit([...gitPrefix(targetDir), "fetch", "origin", trackingRefspec(sessionBranch)], {
         cwd: targetDir,
         timeout: 6e4,
-        env: { ...process.env, LC_ALL: "C", LANGUAGE: "" }
+        env: cLocaleEnv()
       });
-      return "fetched";
+      outcome = "fetched";
     } catch (err) {
       const message = redactUrlAuth(err instanceof Error ? err.message : String(err));
-      if (/couldn't find remote ref/i.test(message)) return "absent";
-      this.log.warn("session-branch fetch failed", { sessionBranch, error: message });
-      return "failed";
+      if (!/couldn't find remote ref/i.test(message)) {
+        this.log.warn("session-branch fetch failed", { sessionBranch, error: message });
+        return "failed";
+      }
+      outcome = "absent";
+    }
+    try {
+      if (outcome === "fetched") {
+        await ensureTrackingRefspec(sessionBranch, targetDir);
+      } else {
+        await dropTrackingRefspec(sessionBranch, targetDir);
+        await gitOrNull(["update-ref", "-d", `refs/remotes/origin/${sessionBranch}`], targetDir);
+      }
+    } catch (err) {
+      this.log.warn("could not update session-branch fetch refspec", {
+        sessionBranch,
+        error: redactUrlAuth(err instanceof Error ? err.message : String(err))
+      });
     }
+    return outcome;
   }
   /**
    * Re-point a session branch that this connect cut from the base at
@@ -2124,25 +2173,101 @@ var GitConnector = class extends AbstractConnector {
     }
   }
   /**
-   * Push the active branch. A session branch is pushed with `-u` after its
-   * fetch refspec is ensured, so the push also updates
-   * `refs/remotes/origin/<branch>` and `@{upstream}` resolves — the platform's
-   * hibernate save gate reads exactly that. The base branch keeps its plain push.
+   * Line up a reused local session branch (checked out) with
+   * `origin/<sessionBranch>` after a successful fetch. Never rewrites local
+   * history and never throws:
+   *   - local is an ancestor of origin → fast-forward (another node pushed
+   *     newer work);
+   *   - local has commits that origin does not have → keep them and log a
+   *     warning; when origin also has commits that local lacks (diverged),
+   *     merge origin in with {@link integrateOriginSessionBranch};
+   *   - origin has no such branch → nothing to do.
+   * In the first two cases the upstream is set to `origin/<sessionBranch>`.
    */
-  async pushActiveBranch(s, cwd) {
-    if (s.activeBranch === s.branch) {
-      await git(["push", "origin", s.activeBranch], cwd, 6e4);
-      return;
+  async reconcileLocalSessionBranch(state, sessionBranch, targetDir) {
+    const originRef = await originTrackingRef(sessionBranch, targetDir);
+    if (originRef === null) return;
+    try {
+      await setSessionUpstream(sessionBranch, targetDir);
+      if (await isAncestor("HEAD", originRef, targetDir)) {
+        const before = await git(["rev-parse", "HEAD"], targetDir);
+        await git(["merge", "--ff-only", originRef], targetDir, 6e4);
+        if (await git(["rev-parse", "HEAD"], targetDir) !== before) {
+          this.log.info("session branch fast-forwarded to origin", { sessionBranch });
+        }
+        return;
+      }
+      const { ahead, behind } = await countAheadBehind(targetDir, originRef);
+      this.log.warn("local session branch has commits not on origin; kept", {
+        sessionBranch,
+        ahead,
+        behind
+      });
+      if (behind > 0) await this.integrateOriginSessionBranch(state, targetDir, sessionBranch);
+    } catch (err) {
+      this.log.warn("could not line up the local session branch with origin", {
+        sessionBranch,
+        error: redactUrlAuth(err instanceof Error ? err.message : String(err))
+      });
     }
+  }
+  /**
+   * Merge `origin/<branch>` into the checked-out session branch when origin
+   * holds commits that the local branch lacks (another node or the agent
+   * pushed, or an older driver rewrote the local branch). A merge, never a
+   * rebase: the commits on origin are published. After this, a push of the
+   * branch is a fast-forward and needs no force. Never throws; a merge that
+   * cannot complete is aborted, and the push that follows fails as before.
+   */
+  async integrateOriginSessionBranch(s, cwd, branch = s.activeBranch) {
+    const originRef = await originTrackingRef(branch, cwd);
+    if (originRef === null || await isAncestor(originRef, "HEAD", cwd)) return;
     try {
-      await ensureTrackingRefspec(s.activeBranch, cwd);
+      await gitCommitting(["merge", "--no-edit", originRef], cwd, 6e4);
+      this.log.info("merged origin session branch", { branch });
     } catch (err) {
-      this.log.warn("could not add session-branch fetch refspec", {
-        branch: s.activeBranch,
+      this.log.warn("merge of origin session branch failed", {
+        branch,
         error: redactUrlAuth(err instanceof Error ? err.message : String(err))
       });
+      await this.resolveConflictsOrAbort(s, cwd, "merge");
     }
+  }
+  /**
+   * After a successful push of a session branch: map it with a fetch refspec
+   * and point `refs/remotes/origin/<branch>` at the pushed tip. The push ran
+   * before the refspec existed (a refspec for a branch that origin does not
+   * have yet would break `git fetch origin`), so git did not update the
+   * tracking ref itself. With both, `@{upstream}` resolves and the platform's
+   * hibernate save gate sees `ahead` 0. Never throws.
+   */
+  async recordPushedSessionBranch(branch, cwd) {
+    try {
+      await ensureTrackingRefspec(branch, cwd);
+      await git(["update-ref", `refs/remotes/origin/${branch}`, `refs/heads/${branch}`], cwd);
+    } catch (err) {
+      this.log.warn("could not record the pushed session branch", {
+        branch,
+        error: redactUrlAuth(err instanceof Error ? err.message : String(err))
+      });
+    }
+  }
+  /**
+   * Push the active branch. A session branch first gets any commits that are
+   * only on `origin/<branch>` merged in, so the push is a fast-forward and
+   * never needs a force. It is pushed with `-u` and then recorded (see
+   * {@link recordPushedSessionBranch}), so `@{upstream}` resolves — the
+   * platform's hibernate save gate reads exactly that. The base branch keeps
+   * its plain push.
+   */
+  async pushActiveBranch(s, cwd) {
+    if (s.activeBranch === s.branch) {
+      await git(["push", "origin", s.activeBranch], cwd, 6e4);
+      return;
+    }
+    await this.integrateOriginSessionBranch(s, cwd);
     await git(["push", "-u", "origin", s.activeBranch], cwd, 6e4);
+    await this.recordPushedSessionBranch(s.activeBranch, cwd);
   }
   /**
    * Attempt to create `sessionBranch` anchored on `session.fromRef`. Returns
@@ -3056,7 +3181,7 @@ var GitConnector = class extends AbstractConnector {
       s.fetchInFlight = true;
       void this.runPeriodicFetch(s, mountPath).catch((err) => {
         this.log.debug("periodic fetch failed", {
-          error: err instanceof Error ? err.message : String(err)
+          error: redactUrlAuth(err instanceof Error ? err.message : String(err))
         });
       }).finally(() => {
         s.fetchInFlight = false;
@@ -3065,9 +3190,17 @@ var GitConnector = class extends AbstractConnector {
   }
   /** One periodic-fetch tick. Bails out at each resumption point once disconnected. */
   async runPeriodicFetch(s, mountPath) {
-    await git(["fetch", "origin"], mountPath, 6e4);
+    await this.fetchOrigin(s, mountPath);
     if (s.disposed) return;
     if (s.sync.autoRebase && s.activeBranch !== s.branch) {
+      const onOrigin = await this.trackSessionBranch(s.activeBranch, mountPath);
+      if (s.disposed) return;
+      if (onOrigin !== "absent") {
+        await this.mergeBaseIntoSessionBranch(s, mountPath);
+        if (s.disposed) return;
+        await syncSubmodules(mountPath, this.log);
+        return;
+      }
       try {
         await gitCommitting(["rebase", `origin/${s.branch}`], mountPath, 6e4);
       } catch (err) {
@@ -3085,6 +3218,59 @@ var GitConnector = class extends AbstractConnector {
       await syncSubmodules(mountPath, this.log);
     }
   }
+  /**
+   * `git fetch origin` for the periodic tick. When origin no longer has a
+   * branch that a session refspec names (for example a session branch deleted
+   * after a merge, or one from an earlier session on this checkout), that
+   * refspec fails the whole fetch. Drop it and fetch again. The base branch
+   * refspec is never dropped.
+   */
+  async fetchOrigin(s, mountPath) {
+    for (let attempt = 0; ; attempt++) {
+      try {
+        await runGit([...gitPrefix(mountPath), "fetch", "origin"], {
+          cwd: mountPath,
+          timeout: 6e4,
+          env: cLocaleEnv()
+        });
+        return;
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const missing = /couldn't find remote ref refs\/heads\/(\S+)/.exec(message)?.[1];
+        if (missing === void 0 || missing === s.branch || !isValidGitRefOrSha(missing)) {
+          throw err;
+        }
+        if (attempt >= 3) throw err;
+        this.log.info("branch not on origin; dropping its fetch refspec", { branch: missing });
+        await dropTrackingRefspec(missing, mountPath);
+        await gitOrNull(["update-ref", "-d", `refs/remotes/origin/${missing}`], mountPath);
+      }
+    }
+  }
+  /**
+   * Merge `origin/<base>` into a published session branch (periodic tick with
+   * `autoRebase`). No-op when the base is already contained. Conflicts are
+   * handled like the merge on close: keep "ours" (the session branch) and
+   * save "theirs" as `.conflict` files.
+   */
+  async mergeBaseIntoSessionBranch(s, mountPath) {
+    const baseRef = `origin/${s.branch}`;
+    if (await isAncestor(baseRef, "HEAD", mountPath)) return;
+    try {
+      await gitCommitting(["merge", "--no-edit", baseRef], mountPath, 6e4);
+      this.log.info("merged base into published session branch", {
+        branch: s.activeBranch,
+        base: s.branch
+      });
+    } catch (err) {
+      this.log.warn("merge of base into session branch failed", {
+        branch: s.activeBranch,
+        base: s.branch,
+        error: redactUrlAuth(err instanceof Error ? err.message : String(err))
+      });
+      await this.resolveConflictsOrAbort(s, mountPath, "merge");
+    }
+  }
   // ── Conflict resolution ──────────────────────────────────────────────────
   /**
    * Attempt to resolve merge/rebase conflicts by keeping "ours" and copying
@@ -11245,5 +11431,5 @@ function describeFlowOperations() {
 }
 
 export { AbstractConnector, BUILTIN_CONNECTOR_CATALOG, BoxConnector, ClassifierSubpromptRunner, ConnectorManager, DeployConnector, DevServerConnector, FlowAdapter, GitConnector, GmailConnector, GoogleDriveConnector, LocalConnector, LogBuffer, MAX_REARM_MS, MIN_REFRESH_DELAY_MS, ManagedGitconfigCollisionError, MattermostConnector, MemoryConnector, MinIOConnector, NO_ACTIVE_FLOW_ERROR, PortPool, PostgresConnector, REFRESH_LEAD_MS, S3Connector, SQLiteConnector, SessionInlineSubFlowRunner, SessionNodeExecutor, SessionSubpromptRunner, SharePointConnector, StaticServerConnector, TunnelConnector, WebDAVConnector, XStateConnector, XStateStoreConnector, __test, atomicReplaceCredential, buildConnectorPromptSection, buildConnectorToolDefs, buildFlowPromptEvent, buildFlowToolDefs, buildLazyFlowToolDefs, buildLazySdkFlowTools, buildSdkConnectorTools, buildSdkFlowTools, classifierQuestion, classifyConnectError, createConnector, createConnector10, createConnector11, createConnector12, createConnector13, createConnector14, createConnector15, createConnector16, createConnector17, createConnector18, createConnector19, createConnector2, createConnector20, createConnector3, createConnector4, createConnector5, createConnector6, createConnector7, createConnector8, createConnector9, createFsWatcher, createWorktree, defaultSpawn, describeFlowOperations, driveOrchestratorTurn, ensureDirMode, ensureFleetMounted, ensureRefreshAttemptStamp, findGitRoot, findMissingPackages, getConnector, installNpmPackages, isFleetManaged, isPackageResolvable, listConnectors, listWorktrees, readGitSyncStatus, registerBuiltinConnectors, removeMountBlock, removeUnavailableMountBlock, renderCredentialHelperScript, tryGetConnector, worktreeRegistry, writeHelperScript, writeMountBlock, writeUnavailableMountBlock };
-//# sourceMappingURL=chunk-JU736VOI.js.map
-//# sourceMappingURL=chunk-JU736VOI.js.map
+//# sourceMappingURL=chunk-HRVXHRL4.js.map
+//# sourceMappingURL=chunk-HRVXHRL4.js.map