@specific.dev/cli 0.1.71 → 0.1.72

package/dist/cli.js

@@ -39,10 +39,10 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // node_modules/.pnpm/is-docker@3.0.0/node_modules/is-docker/index.js
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 function hasDockerEnv() {
   try {
-    fs5.statSync("/.dockerenv");
+    fs6.statSync("/.dockerenv");
     return true;
   } catch {
     return false;
@@ -50,7 +50,7 @@ function hasDockerEnv() {
 }
 function hasDockerCGroup() {
   try {
-    return fs5.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
+    return fs6.readFileSync("/proc/self/cgroup", "utf8").includes("docker");
   } catch {
     return false;
   }
@@ -68,7 +68,7 @@ var init_is_docker = __esm({
 });
 
 // node_modules/.pnpm/is-inside-container@1.0.0/node_modules/is-inside-container/index.js
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 function isInsideContainer() {
   if (cachedResult === void 0) {
     cachedResult = hasContainerEnv() || isDocker();
@@ -81,7 +81,7 @@ var init_is_inside_container = __esm({
     init_is_docker();
     hasContainerEnv = () => {
       try {
-        fs6.statSync("/run/.containerenv");
+        fs7.statSync("/run/.containerenv");
         return true;
       } catch {
         return false;
@@ -92,8 +92,8 @@ var init_is_inside_container = __esm({
 
 // node_modules/.pnpm/is-wsl@3.1.0/node_modules/is-wsl/index.js
 import process2 from "node:process";
-import os4 from "node:os";
-import fs7 from "node:fs";
+import os5 from "node:os";
+import fs8 from "node:fs";
 var isWsl, is_wsl_default;
 var init_is_wsl = __esm({
   "node_modules/.pnpm/is-wsl@3.1.0/node_modules/is-wsl/index.js"() {
@@ -102,14 +102,14 @@ var init_is_wsl = __esm({
       if (process2.platform !== "linux") {
         return false;
       }
-      if (os4.release().toLowerCase().includes("microsoft")) {
+      if (os5.release().toLowerCase().includes("microsoft")) {
         if (isInsideContainer()) {
           return false;
         }
         return true;
       }
       try {
-        return fs7.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
+        return fs8.readFileSync("/proc/version", "utf8").toLowerCase().includes("microsoft") ? !isInsideContainer() : false;
       } catch {
         return false;
       }
@@ -179,7 +179,7 @@ var init_utilities = __esm({
 // node_modules/.pnpm/wsl-utils@0.3.1/node_modules/wsl-utils/index.js
 import { promisify as promisify2 } from "node:util";
 import childProcess2 from "node:child_process";
-import fs8, { constants as fsConstants } from "node:fs/promises";
+import fs9, { constants as fsConstants } from "node:fs/promises";
 var execFile2, wslDrivesMountPoint, powerShellPathFromWsl, powerShellPath2, canAccessPowerShellPromise, canAccessPowerShell, wslDefaultBrowser, convertWslPathToWindows;
 var init_wsl_utils = __esm({
   "node_modules/.pnpm/wsl-utils@0.3.1/node_modules/wsl-utils/index.js"() {
@@ -198,14 +198,14 @@ var init_wsl_utils = __esm({
         const configFilePath = "/etc/wsl.conf";
         let isConfigFileExists = false;
         try {
-          await fs8.access(configFilePath, fsConstants.F_OK);
+          await fs9.access(configFilePath, fsConstants.F_OK);
           isConfigFileExists = true;
         } catch {
         }
         if (!isConfigFileExists) {
           return defaultMountPoint;
         }
-        const configContent = await fs8.readFile(configFilePath, { encoding: "utf8" });
+        const configContent = await fs9.readFile(configFilePath, { encoding: "utf8" });
         const parsedMountPoint = parseMountPointFromConfig(configContent);
         if (parsedMountPoint === void 0) {
           return defaultMountPoint;
@@ -224,7 +224,7 @@ var init_wsl_utils = __esm({
       canAccessPowerShellPromise ??= (async () => {
         try {
           const psPath = await powerShellPath2();
-          await fs8.access(psPath, fsConstants.X_OK);
+          await fs9.access(psPath, fsConstants.X_OK);
           return true;
         } catch {
           return false;
@@ -435,7 +435,7 @@ import process8 from "node:process";
 import path5 from "node:path";
 import { fileURLToPath } from "node:url";
 import childProcess3 from "node:child_process";
-import fs9, { constants as fsConstants2 } from "node:fs/promises";
+import fs10, { constants as fsConstants2 } from "node:fs/promises";
 function detectArchBinary(binary) {
   if (typeof binary === "string" || Array.isArray(binary)) {
     return binary;
@@ -446,16 +446,16 @@ function detectArchBinary(binary) {
   }
   return archBinary;
 }
-function detectPlatformBinary({ [platform3]: platformBinary }, { wsl } = {}) {
+function detectPlatformBinary({ [platform4]: platformBinary }, { wsl } = {}) {
   if (wsl && is_wsl_default) {
     return detectArchBinary(wsl);
   }
   if (!platformBinary) {
-    throw new Error(`${platform3} is not supported`);
+    throw new Error(`${platform4} is not supported`);
   }
   return detectArchBinary(platformBinary);
 }
-var fallbackAttemptSymbol, __dirname, localXdgOpenPath, platform3, arch, tryEachApp, baseOpen, open, openApp, apps, open_default;
+var fallbackAttemptSymbol, __dirname, localXdgOpenPath, platform4, arch, tryEachApp, baseOpen, open, openApp, apps, open_default;
 var init_open = __esm({
   "node_modules/.pnpm/open@11.0.0/node_modules/open/index.js"() {
     init_wsl_utils();
@@ -467,7 +467,7 @@ var init_open = __esm({
     fallbackAttemptSymbol = Symbol("fallbackAttempt");
     __dirname = import.meta.url ? path5.dirname(fileURLToPath(import.meta.url)) : "";
     localXdgOpenPath = path5.join(__dirname, "xdg-open");
-    ({ platform: platform3, arch } = process8);
+    ({ platform: platform4, arch } = process8);
     tryEachApp = async (apps2, opener) => {
       if (apps2.length === 0) {
         return;
@@ -564,7 +564,7 @@ var init_open = __esm({
       if (is_wsl_default && !isInsideContainer() && !is_in_ssh_default && !app) {
         shouldUseWindowsInWsl = await canAccessPowerShell();
       }
-      if (platform3 === "darwin") {
+      if (platform4 === "darwin") {
         command = "open";
         if (options2.wait) {
           cliArguments.push("--wait-apps");
@@ -578,7 +578,7 @@ var init_open = __esm({
         if (app) {
           cliArguments.push("-a", app);
         }
-      } else if (platform3 === "win32" || shouldUseWindowsInWsl) {
+      } else if (platform4 === "win32" || shouldUseWindowsInWsl) {
         command = await powerShellPath2();
         cliArguments.push(...executePowerShell.argumentsPrefix);
         if (!is_wsl_default) {
@@ -614,11 +614,11 @@ var init_open = __esm({
           const isBundled = !__dirname || __dirname === "/";
           let exeLocalXdgOpen = false;
           try {
-            await fs9.access(localXdgOpenPath, fsConstants2.X_OK);
+            await fs10.access(localXdgOpenPath, fsConstants2.X_OK);
             exeLocalXdgOpen = true;
           } catch {
           }
-          const useSystemXdgOpen = process8.versions.electron ?? (platform3 === "android" || isBundled || !exeLocalXdgOpen);
+          const useSystemXdgOpen = process8.versions.electron ?? (platform4 === "android" || isBundled || !exeLocalXdgOpen);
           command = useSystemXdgOpen ? "xdg-open" : localXdgOpenPath;
         }
         if (appArguments.length > 0) {
@@ -629,7 +629,7 @@ var init_open = __esm({
           childProcessOptions.detached = true;
         }
       }
-      if (platform3 === "darwin" && appArguments.length > 0) {
+      if (platform4 === "darwin" && appArguments.length > 0) {
         cliArguments.push("--args", ...appArguments);
       }
       if (options2.target) {
@@ -754,8 +754,8 @@ var require_dist = __commonJS({
       var $global, $module, $NaN = NaN;
       if ("undefined" != typeof window ? $global = window : "undefined" != typeof self ? $global = self : "undefined" != typeof global ? ($global = global).require = __require : $global = this, void 0 === $global || void 0 === $global.Array) throw new Error("no global object found");
       if ("undefined" != typeof module && ($module = module), !$global.fs && $global.require) try {
-        var fs32 = $global.require("fs");
-        "object" == typeof fs32 && null !== fs32 && 0 !== Object.keys(fs32).length && ($global.fs = fs32);
+        var fs33 = $global.require("fs");
+        "object" == typeof fs33 && null !== fs33 && 0 !== Object.keys(fs33).length && ($global.fs = fs33);
       } catch (e) {
       }
       if (!$global.fs) {
@@ -183430,11 +183430,14 @@ import { Command } from "commander";
 import React2, { useState, useEffect } from "react";
 import { render as render2, Text as Text2, Box as Box2, useInput, useApp } from "ink";
 import "ink-spinner";
-import * as fs11 from "fs";
+import * as fs12 from "fs";
 import * as path7 from "path";
 
 // src/lib/dev/system-setup.ts
 import { execSync as execSync2 } from "child_process";
+import * as fs4 from "fs";
+import * as os4 from "os";
+import * as path3 from "path";
 
 // src/lib/dev/local-ca.ts
 import * as fs from "fs";
@@ -183453,17 +183456,17 @@ function caInstalledInTrustStore() {
   if (!caFilesExist()) {
     return false;
   }
-  const platform5 = os.platform();
+  const platform6 = os.platform();
   const certPath = path.join(getCADir(), "ca.crt");
   const diskCert = fs.readFileSync(certPath, "utf-8").replace(/\r\n/g, "\n").trim();
   try {
-    if (platform5 === "darwin") {
+    if (platform6 === "darwin") {
       const keychainCert = execSync(
         'security find-certificate -c "Specific Local Development CA" -p /Library/Keychains/System.keychain',
         { encoding: "utf-8" }
       ).replace(/\r\n/g, "\n").trim();
       return keychainCert === diskCert;
-    } else if (platform5 === "linux") {
+    } else if (platform6 === "linux") {
       const trustPaths = [
         "/usr/local/share/ca-certificates/specific-local-ca.crt",
         "/etc/pki/ca-trust/source/anchors/specific-local-ca.crt"
@@ -183571,15 +183574,15 @@ function removeCA() {
   }
 }
 function getCAInstallCommands(certPath) {
-  const platform5 = os.platform();
-  if (platform5 === "darwin") {
+  const platform6 = os.platform();
+  if (platform6 === "darwin") {
     return [
       // Remove any existing cert with the same CN first — add-trusted-cert
       // silently does nothing if a cert with the same subject already exists.
       'security delete-certificate -c "Specific Local Development CA" /Library/Keychains/System.keychain 2>/dev/null || true',
       `security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`
     ];
-  } else if (platform5 === "linux") {
+  } else if (platform6 === "linux") {
     if (fs.existsSync("/usr/local/share/ca-certificates")) {
       return [
         `cp "${certPath}" /usr/local/share/ca-certificates/specific-local-ca.crt`,
@@ -183593,7 +183596,7 @@ function getCAInstallCommands(certPath) {
     }
     throw new Error("Could not detect Linux certificate trust mechanism");
   }
-  throw new Error(`Unsupported platform: ${platform5}`);
+  throw new Error(`Unsupported platform: ${platform6}`);
 }
 function generateCertificate(domain, keys = []) {
   const caDir = getCADir();
@@ -183638,22 +183641,22 @@ import * as os2 from "os";
 var RESOLVER_FILE_MACOS = "/etc/resolver/local.spcf.app";
 var RESOLVER_FILE_LINUX = "/etc/systemd/resolved.conf.d/specific-local.conf";
 function resolverConfigExists() {
-  const platform5 = os2.platform();
-  if (platform5 === "darwin") {
+  const platform6 = os2.platform();
+  if (platform6 === "darwin") {
     return fs2.existsSync(RESOLVER_FILE_MACOS);
-  } else if (platform5 === "linux") {
+  } else if (platform6 === "linux") {
     return fs2.existsSync(RESOLVER_FILE_LINUX);
   }
   return false;
 }
 function getResolverInstallCommands(port) {
-  const platform5 = os2.platform();
-  if (platform5 === "darwin") {
+  const platform6 = os2.platform();
+  if (platform6 === "darwin") {
     return [
       "mkdir -p /etc/resolver",
       `printf "nameserver 127.0.0.1\\nport ${port}\\n" > ${RESOLVER_FILE_MACOS}`
     ];
-  } else if (platform5 === "linux") {
+  } else if (platform6 === "linux") {
     if (fs2.existsSync("/etc/systemd/resolved.conf.d") || fs2.existsSync("/etc/systemd")) {
       return [
         "mkdir -p /etc/systemd/resolved.conf.d",
@@ -183746,7 +183749,6 @@ async function startDnsServer(port = DNS_PORT) {
 }
 
 // src/lib/dev/system-setup.ts
-import * as path3 from "path";
 function systemSetupNeeded() {
   return !caInstalledInTrustStore() || !resolverConfigExists();
 }
@@ -183773,7 +183775,7 @@ function performSystemSetup() {
     return;
   }
   try {
-    execSync2(`sudo sh -c '${commands.join(" && ")}'`, { stdio: "inherit" });
+    execPrivileged(commands);
   } catch (err) {
     if (needsGenerate) {
       removeCA();
@@ -183781,14 +183783,43 @@ function performSystemSetup() {
     throw err;
   }
 }
+function execPrivileged(commands) {
+  if (commands.length === 0) return;
+  if (os4.platform() === "darwin") {
+    const scriptPath = path3.join(os4.tmpdir(), "specific-setup.sh");
+    const appPath = path3.join(os4.tmpdir(), "Specific.app");
+    try {
+      fs4.writeFileSync(
+        scriptPath,
+        "#!/bin/sh\nset -e\n" + commands.join("\n") + "\n",
+        { mode: 448 }
+      );
+      execSync2(
+        `osacompile -o '${appPath}' -e 'do shell script "sh ${scriptPath}" with administrator privileges'`
+      );
+      execSync2(`'${appPath}/Contents/MacOS/applet'`, { stdio: "pipe" });
+    } finally {
+      try {
+        fs4.unlinkSync(scriptPath);
+      } catch {
+      }
+      try {
+        fs4.rmSync(appPath, { recursive: true });
+      } catch {
+      }
+    }
+  } else {
+    execSync2(`sudo sh -c '${commands.join(" && ")}'`, { stdio: "inherit" });
+  }
+}
 
 // src/lib/analytics/index.ts
 import { PostHog } from "posthog-node";
-import * as os6 from "os";
+import * as os7 from "os";
 import * as crypto from "crypto";
 
 // src/lib/project/config.ts
-import * as fs4 from "fs";
+import * as fs5 from "fs";
 import * as path4 from "path";
 var PROJECT_ID_FILE = ".specific/project_id";
 var ProjectNotLinkedError = class extends Error {
@@ -183805,10 +183836,10 @@ Run: specific deploy`
 };
 function readProjectId(projectDir = process.cwd()) {
   const projectIdPath = path4.join(projectDir, PROJECT_ID_FILE);
-  if (!fs4.existsSync(projectIdPath)) {
+  if (!fs5.existsSync(projectIdPath)) {
     throw new ProjectNotLinkedError();
   }
-  const projectId = fs4.readFileSync(projectIdPath, "utf-8").trim();
+  const projectId = fs5.readFileSync(projectIdPath, "utf-8").trim();
   if (!projectId) {
     throw new Error(`${PROJECT_ID_FILE} is empty`);
   }
@@ -183816,20 +183847,20 @@ function readProjectId(projectDir = process.cwd()) {
 }
 function hasProjectId(projectDir = process.cwd()) {
   const projectIdPath = path4.join(projectDir, PROJECT_ID_FILE);
-  return fs4.existsSync(projectIdPath);
+  return fs5.existsSync(projectIdPath);
 }
 function writeProjectId(projectId, projectDir = process.cwd()) {
   const specificDir = path4.join(projectDir, ".specific");
-  if (!fs4.existsSync(specificDir)) {
-    fs4.mkdirSync(specificDir, { recursive: true });
+  if (!fs5.existsSync(specificDir)) {
+    fs5.mkdirSync(specificDir, { recursive: true });
   }
-  fs4.writeFileSync(path4.join(specificDir, "project_id"), projectId + "\n");
+  fs5.writeFileSync(path4.join(specificDir, "project_id"), projectId + "\n");
 }
 
 // src/lib/auth/credentials.ts
-import * as fs10 from "fs";
+import * as fs11 from "fs";
 import * as path6 from "path";
-import * as os5 from "os";
+import * as os6 from "os";
 
 // src/lib/auth/errors.ts
 var RefreshTokenExpiredError = class extends Error {
@@ -184382,18 +184413,18 @@ var ApiClient = class {
 
 // src/lib/auth/credentials.ts
 function getUserCredentialsDir() {
-  return path6.join(os5.homedir(), ".specific");
+  return path6.join(os6.homedir(), ".specific");
 }
 function getCredentialsPath() {
   return path6.join(getUserCredentialsDir(), "credentials.json");
 }
 function readUserCredentials() {
   const credentialsPath = getCredentialsPath();
-  if (!fs10.existsSync(credentialsPath)) {
+  if (!fs11.existsSync(credentialsPath)) {
     return null;
   }
   try {
-    const content = fs10.readFileSync(credentialsPath, "utf-8");
+    const content = fs11.readFileSync(credentialsPath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -184401,18 +184432,18 @@ function readUserCredentials() {
 }
 function writeUserCredentials(credentials) {
   const dir = getUserCredentialsDir();
-  if (!fs10.existsSync(dir)) {
-    fs10.mkdirSync(dir, { recursive: true, mode: 448 });
+  if (!fs11.existsSync(dir)) {
+    fs11.mkdirSync(dir, { recursive: true, mode: 448 });
   }
   const credentialsPath = getCredentialsPath();
-  fs10.writeFileSync(credentialsPath, JSON.stringify(credentials, null, 2), {
+  fs11.writeFileSync(credentialsPath, JSON.stringify(credentials, null, 2), {
     mode: 384
   });
 }
 function clearUserCredentials() {
   const credentialsPath = getCredentialsPath();
-  if (fs10.existsSync(credentialsPath)) {
-    fs10.unlinkSync(credentialsPath);
+  if (fs11.existsSync(credentialsPath)) {
+    fs11.unlinkSync(credentialsPath);
   }
 }
 function isLoggedIn() {
@@ -184491,7 +184522,7 @@ function isEnabled() {
 }
 function getAnonymousId() {
   if (anonymousId) return anonymousId;
-  const machineId = `${os6.hostname()}-${os6.userInfo().username}`;
+  const machineId = `${os7.hostname()}-${os7.userInfo().username}`;
   anonymousId = crypto.createHash("sha256").update(machineId).digest("hex").slice(0, 16);
   return anonymousId;
 }
@@ -184538,7 +184569,7 @@ function trackEvent(event, properties) {
     event,
     properties: {
       ...properties,
-      cli_version: "0.1.71",
+      cli_version: "0.1.72",
       platform: process.platform,
       node_version: process.version,
       project_id: getProjectId()
@@ -184575,57 +184606,57 @@ var options = [
 ];
 function isGitProject() {
   const gitPath = path7.join(process.cwd(), ".git");
-  return fs11.existsSync(gitPath);
+  return fs12.existsSync(gitPath);
 }
 function detectExistingAgents() {
   const detected = {};
   const cursorDir = path7.join(process.cwd(), ".cursor");
-  if (fs11.existsSync(cursorDir)) {
+  if (fs12.existsSync(cursorDir)) {
     detected["cursor"] = true;
   }
   const claudeDir = path7.join(process.cwd(), ".claude");
   const claudeMd = path7.join(process.cwd(), "CLAUDE.md");
-  if (fs11.existsSync(claudeDir) || fs11.existsSync(claudeMd)) {
+  if (fs12.existsSync(claudeDir) || fs12.existsSync(claudeMd)) {
     detected["claude"] = true;
   }
   const agentsMd = path7.join(process.cwd(), "AGENTS.md");
-  if (fs11.existsSync(agentsMd)) {
+  if (fs12.existsSync(agentsMd)) {
     detected["codex"] = true;
   }
   return detected;
 }
 function appendOrCreateFile(filePath, content) {
-  if (fs11.existsSync(filePath)) {
-    const existing = fs11.readFileSync(filePath, "utf-8");
+  if (fs12.existsSync(filePath)) {
+    const existing = fs12.readFileSync(filePath, "utf-8");
     if (existing.includes("specific docs") || existing.includes("specific check")) {
       return "unchanged";
     }
     const separator = existing.endsWith("\n") ? "\n" : "\n\n";
-    fs11.writeFileSync(filePath, existing + separator + content + "\n");
+    fs12.writeFileSync(filePath, existing + separator + content + "\n");
     return "modified";
   } else {
-    fs11.writeFileSync(filePath, content + "\n");
+    fs12.writeFileSync(filePath, content + "\n");
     return "created";
   }
 }
 function addToGitignore() {
   const gitignorePath = path7.join(process.cwd(), ".gitignore");
   const entries = [".specific", "specific.local"];
-  if (fs11.existsSync(gitignorePath)) {
-    const existing = fs11.readFileSync(gitignorePath, "utf-8");
+  if (fs12.existsSync(gitignorePath)) {
+    const existing = fs12.readFileSync(gitignorePath, "utf-8");
     const lines = existing.split("\n").map((l) => l.trim());
     const missingEntries = entries.filter((entry) => !lines.includes(entry));
     if (missingEntries.length === 0) {
       return "unchanged";
     }
     const separator = existing.endsWith("\n") ? "" : "\n";
-    fs11.writeFileSync(
+    fs12.writeFileSync(
       gitignorePath,
       existing + separator + missingEntries.join("\n") + "\n"
     );
     return "modified";
   } else {
-    fs11.writeFileSync(gitignorePath, entries.join("\n") + "\n");
+    fs12.writeFileSync(gitignorePath, entries.join("\n") + "\n");
     return "created";
   }
 }
@@ -184633,8 +184664,8 @@ function configureClaudeCodePermissions() {
   const claudeDir = path7.join(process.cwd(), ".claude");
   const settingsPath = path7.join(claudeDir, "settings.local.json");
   const permissions = ["Bash(specific docs:*)", "Bash(specific check:*)"];
-  if (fs11.existsSync(settingsPath)) {
-    const existing = JSON.parse(fs11.readFileSync(settingsPath, "utf-8"));
+  if (fs12.existsSync(settingsPath)) {
+    const existing = JSON.parse(fs12.readFileSync(settingsPath, "utf-8"));
     const allowList = existing?.permissions?.allow || [];
     const missingPermissions = permissions.filter(
       (p) => !allowList.includes(p)
@@ -184649,39 +184680,39 @@ function configureClaudeCodePermissions() {
       existing.permissions.allow = [];
     }
     existing.permissions.allow.push(...missingPermissions);
-    fs11.writeFileSync(settingsPath, JSON.stringify(existing, null, 2) + "\n");
+    fs12.writeFileSync(settingsPath, JSON.stringify(existing, null, 2) + "\n");
     return "modified";
   }
-  if (!fs11.existsSync(claudeDir)) {
-    fs11.mkdirSync(claudeDir);
+  if (!fs12.existsSync(claudeDir)) {
+    fs12.mkdirSync(claudeDir);
   }
   const settings = {
     permissions: {
       allow: permissions
     }
   };
-  fs11.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+  fs12.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   return "created";
 }
 function createCursorRule() {
   const cursorDir = path7.join(process.cwd(), ".cursor");
   const rulesDir = path7.join(cursorDir, "rules");
   const mdcPath = path7.join(rulesDir, "specific.mdc");
-  if (fs11.existsSync(mdcPath)) {
-    const existing = fs11.readFileSync(mdcPath, "utf-8");
+  if (fs12.existsSync(mdcPath)) {
+    const existing = fs12.readFileSync(mdcPath, "utf-8");
     if (existing.includes("specific docs") || existing.includes("specific check")) {
       return "unchanged";
     }
-    fs11.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
+    fs12.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
     return "modified";
   }
-  if (!fs11.existsSync(cursorDir)) {
-    fs11.mkdirSync(cursorDir);
+  if (!fs12.existsSync(cursorDir)) {
+    fs12.mkdirSync(cursorDir);
   }
-  if (!fs11.existsSync(rulesDir)) {
-    fs11.mkdirSync(rulesDir);
+  if (!fs12.existsSync(rulesDir)) {
+    fs12.mkdirSync(rulesDir);
   }
-  fs11.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
+  fs12.writeFileSync(mdcPath, CURSOR_MDC_CONTENT);
   return "created";
 }
 function configureAgents(checked) {
@@ -184736,7 +184767,7 @@ function InitUI() {
   const [phase, setPhase] = useState(
     () => !systemSetupNeeded() ? "agents" : "installing-ca"
   );
-  const [caInstallPhase, setCaInstallPhase] = useState(() => !systemSetupNeeded() ? "done" : "installing");
+  const [caInstallPhase, setCaInstallPhase] = useState(() => !systemSetupNeeded() ? "done" : "prompt");
   const [focusedIndex, setFocusedIndex] = useState(initialState.focusedIndex);
   const [checked, setChecked] = useState(
     initialState.detected
@@ -184767,6 +184798,10 @@ function InitUI() {
   }
   const isSubmitFocused = focusedIndex === options.length;
   useInput((input, key) => {
+    if (phase === "installing-ca" && caInstallPhase === "prompt" && key.return) {
+      setCaInstallPhase("installing");
+      return;
+    }
     if (phase !== "agents") return;
     if (key.upArrow || input === "k") {
       setFocusedIndex((prev) => Math.max(0, prev - 1));
@@ -184796,8 +184831,11 @@ function InitUI() {
     }
   }, [phase, exit]);
   if (phase === "installing-ca") {
+    if (caInstallPhase === "prompt") {
+      return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "Configure development environment"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "We need to do a one-time setup for all your Specific projects."), /* @__PURE__ */ React2.createElement(Text2, null, "This is so we can run your apps locally with secure URLs:"), /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "green" }, "https://your-app.local.spcf.app"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "You will be prompted to authorize with your password."), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Press ", /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "Enter"), " to authorize."));
+    }
     if (caInstallPhase === "installing") {
-      return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "Local Development Setup"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Setting up TLS certificates and DNS resolution for local"), /* @__PURE__ */ React2.createElement(Text2, null, "development. This is a one-time setup for Specific projects."), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Your password is required to configure your system."), /* @__PURE__ */ React2.createElement(Text2, null, " "));
+      return /* @__PURE__ */ React2.createElement(Box2, { flexDirection: "column" }, /* @__PURE__ */ React2.createElement(Text2, { bold: true, color: "cyan" }, "Configure development environment"), /* @__PURE__ */ React2.createElement(Text2, null, " "), /* @__PURE__ */ React2.createElement(Text2, null, "Awaiting authorization\u2026"));
     }
   }
   if (phase === "done") {
@@ -184917,7 +184955,7 @@ var BETA_REGISTRY = [
 ];
 
 // src/lib/beta/storage.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, existsSync as existsSync6, mkdirSync as mkdirSync6 } from "fs";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync6, existsSync as existsSync6, mkdirSync as mkdirSync6 } from "fs";
 import { join as join7 } from "path";
 var BETAS_FILE = ".specific/betas.json";
 function loadEnabledBetas(projectDir = process.cwd()) {
@@ -184950,7 +184988,7 @@ function saveBetas(enabled, projectDir) {
     mkdirSync6(specificDir, { recursive: true });
   }
   const data = { enabled };
-  writeFileSync5(
+  writeFileSync6(
     join7(projectDir, BETAS_FILE),
     JSON.stringify(data, null, 2) + "\n"
   );
@@ -185017,7 +185055,7 @@ function resolveFilesystemDoc(path30) {
 import React3, { useState as useState2, useEffect as useEffect2 } from "react";
 import { render as render3, Text as Text3, Box as Box3 } from "ink";
 import Spinner3 from "ink-spinner";
-import * as fs13 from "fs";
+import * as fs14 from "fs";
 import * as path9 from "path";
 import { execFile as execFile7 } from "child_process";
 
@@ -185889,32 +185927,32 @@ var ExtractionError = class extends Error {
 };
 
 // src/lib/bin/manager.ts
-import * as fs12 from "fs";
+import * as fs13 from "fs";
 import * as path8 from "path";
-import * as os7 from "os";
+import * as os8 from "os";
 import { createReadStream } from "fs";
 import { createTarExtractor, extractTo } from "tar-vern";
 function getLibraryEnv(binary) {
   if (!binary.libraryPath) {
     return {};
   }
-  const platform5 = os7.platform();
-  if (platform5 === "darwin") {
+  const platform6 = os8.platform();
+  if (platform6 === "darwin") {
     return { DYLD_LIBRARY_PATH: binary.libraryPath };
-  } else if (platform5 === "linux") {
+  } else if (platform6 === "linux") {
     return { LD_LIBRARY_PATH: binary.libraryPath };
   }
   return {};
 }
 function getBinBaseDir() {
-  return path8.join(os7.homedir(), ".specific", "bin");
+  return path8.join(os8.homedir(), ".specific", "bin");
 }
 function getPlatformInfo() {
-  const platform5 = os7.platform();
-  const arch3 = os7.arch();
-  if (platform5 !== "darwin" && platform5 !== "linux") {
+  const platform6 = os8.platform();
+  const arch3 = os8.arch();
+  if (platform6 !== "darwin" && platform6 !== "linux") {
     throw new Error(
-      `Unsupported platform: ${platform5}. Only macOS and Linux are supported.`
+      `Unsupported platform: ${platform6}. Only macOS and Linux are supported.`
     );
   }
   const archStr = arch3;
@@ -185928,7 +185966,7 @@ function getPlatformInfo() {
       `Unsupported architecture: ${arch3}. Only x64 and arm64 are supported.`
     );
   }
-  return { platform: platform5, arch: mappedArch };
+  return { platform: platform6, arch: mappedArch };
 }
 function getBinaryDir(definition, version, platformInfo) {
   return path8.join(
@@ -185942,7 +185980,7 @@ function isBinaryInstalled(definition, version, platformInfo) {
   const binDir = getBinaryDir(definition, version, platformInfo);
   for (const execPath of definition.executables) {
     const fullPath = path8.join(binDir, execPath);
-    if (!fs12.existsSync(fullPath)) {
+    if (!fs13.existsSync(fullPath)) {
       return false;
     }
   }
@@ -185971,11 +186009,11 @@ async function downloadFile(url, destPath, onProgress) {
   );
   let bytesDownloaded = 0;
   const parentDir = path8.dirname(destPath);
-  if (!fs12.existsSync(parentDir)) {
-    fs12.mkdirSync(parentDir, { recursive: true });
+  if (!fs13.existsSync(parentDir)) {
+    fs13.mkdirSync(parentDir, { recursive: true });
   }
   const partPath = destPath + ".part";
-  const fileStream = fs12.createWriteStream(partPath);
+  const fileStream = fs13.createWriteStream(partPath);
   try {
     const reader = response.body.getReader();
     while (true) {
@@ -185998,12 +186036,12 @@ async function downloadFile(url, destPath, onProgress) {
         else resolve10();
       });
     });
-    fs12.renameSync(partPath, destPath);
+    fs13.renameSync(partPath, destPath);
   } catch (error) {
     try {
       fileStream.close();
-      if (fs12.existsSync(partPath)) {
-        fs12.unlinkSync(partPath);
+      if (fs13.existsSync(partPath)) {
+        fs13.unlinkSync(partPath);
       }
     } catch {
     }
@@ -186012,8 +186050,8 @@ async function downloadFile(url, destPath, onProgress) {
 }
 async function extractTarball(archivePath, destDir, definition, onProgress) {
   onProgress?.({ phase: "extracting" });
-  if (!fs12.existsSync(destDir)) {
-    fs12.mkdirSync(destDir, { recursive: true });
+  if (!fs13.existsSync(destDir)) {
+    fs13.mkdirSync(destDir, { recursive: true });
   }
   try {
     const fileStream = createReadStream(archivePath);
@@ -186022,8 +186060,8 @@ async function extractTarball(archivePath, destDir, definition, onProgress) {
     onProgress?.({ phase: "finalizing" });
     for (const execPath of definition.executables) {
       const fullPath = path8.join(destDir, execPath);
-      if (fs12.existsSync(fullPath)) {
-        fs12.chmodSync(fullPath, 493);
+      if (fs13.existsSync(fullPath)) {
+        fs13.chmodSync(fullPath, 493);
       }
     }
   } catch (error) {
@@ -186047,12 +186085,12 @@ async function ensureBinary(definition, version, onProgress) {
           `Binary type definitions must have exactly one executable, got ${definition.executables.length}`
         );
       }
-      if (!fs12.existsSync(binDir)) {
-        fs12.mkdirSync(binDir, { recursive: true });
+      if (!fs13.existsSync(binDir)) {
+        fs13.mkdirSync(binDir, { recursive: true });
       }
       const execPath = path8.join(binDir, definition.executables[0]);
       await downloadFile(url, execPath, onProgress);
-      fs12.chmodSync(execPath, 493);
+      fs13.chmodSync(execPath, 493);
       onProgress?.({ phase: "finalizing" });
     } else {
       const downloadDir = path8.join(getBinBaseDir(), "downloads");
@@ -186063,8 +186101,8 @@ async function ensureBinary(definition, version, onProgress) {
         await extractTarball(archivePath, binDir, definition, onProgress);
       } finally {
         try {
-          if (fs12.existsSync(archivePath)) {
-            fs12.unlinkSync(archivePath);
+          if (fs13.existsSync(archivePath)) {
+            fs13.unlinkSync(archivePath);
           }
         } catch {
         }
@@ -186240,20 +186278,20 @@ function CheckUI() {
   useEffect2(() => {
     async function load() {
       const configPath = path9.join(process.cwd(), "specific.hcl");
-      if (!fs13.existsSync(configPath)) {
+      if (!fs14.existsSync(configPath)) {
         setState({
           status: "error",
           error: "No specific.hcl found in current directory"
         });
         return;
       }
-      const hcl = fs13.readFileSync(configPath, "utf-8");
+      const hcl = fs14.readFileSync(configPath, "utf-8");
       try {
         const config2 = await parseConfig(hcl);
         for (const build of config2.builds) {
           if (build.dockerfile) {
             const dockerfilePath = path9.resolve(process.cwd(), build.dockerfile);
-            if (!fs13.existsSync(dockerfilePath)) {
+            if (!fs14.existsSync(dockerfilePath)) {
               setState({
                 status: "error",
                 error: `Build "${build.name}": Dockerfile not found at "${build.dockerfile}" (resolved to ${dockerfilePath})`
@@ -186269,7 +186307,7 @@ function CheckUI() {
               process.cwd(),
               pg.reshape.migrations_dir ?? "migrations"
             );
-            if (!fs13.existsSync(migrationsDir)) {
+            if (!fs14.existsSync(migrationsDir)) {
               reshapeChecks2.push({
                 databaseName: pg.name,
                 migrationsDir: pg.reshape.migrations_dir ?? "migrations",
@@ -186320,9 +186358,9 @@ function checkCommand() {
 
 // src/commands/dev.tsx
 import React6, { useState as useState5, useEffect as useEffect3, useRef } from "react";
-import { render as render4, Text as Text6, Box as Box6, useApp as useApp2, Static } from "ink";
+import { render as render4, Text as Text6, Box as Box6, useApp as useApp2, Static, useInput as useInput4 } from "ink";
 import Spinner4 from "ink-spinner";
-import * as fs23 from "fs";
+import * as fs24 from "fs";
 import * as path20 from "path";
 
 // node_modules/.pnpm/chokidar@5.0.0/node_modules/chokidar/index.js
@@ -188077,7 +188115,7 @@ var PortAllocator = class {
 };
 
 // src/lib/dev/stable-port-allocator.ts
-import * as fs14 from "fs";
+import * as fs15 from "fs";
 import * as path10 from "path";
 var PORT_RANGE_START2 = 4e4;
 var PORT_RANGE_END2 = 49999;
@@ -188092,11 +188130,11 @@ var StablePortAllocator = class {
     this.loadPorts();
   }
   loadPorts() {
-    if (!fs14.existsSync(this.portsFilePath)) {
+    if (!fs15.existsSync(this.portsFilePath)) {
       return;
     }
     try {
-      const content = fs14.readFileSync(this.portsFilePath, "utf-8");
+      const content = fs15.readFileSync(this.portsFilePath, "utf-8");
       const data = JSON.parse(content);
       if (data.version === 1 && data.ports) {
         this.savedPorts = data.ports;
@@ -188109,14 +188147,14 @@ var StablePortAllocator = class {
     }
   }
   savePorts() {
-    if (!fs14.existsSync(this.portsDir)) {
-      fs14.mkdirSync(this.portsDir, { recursive: true });
+    if (!fs15.existsSync(this.portsDir)) {
+      fs15.mkdirSync(this.portsDir, { recursive: true });
     }
     const data = {
       version: 1,
       ports: this.savedPorts
     };
-    fs14.writeFileSync(this.portsFilePath, JSON.stringify(data, null, 2));
+    fs15.writeFileSync(this.portsFilePath, JSON.stringify(data, null, 2));
   }
   allocateRandom() {
     const rangeSize = PORT_RANGE_END2 - PORT_RANGE_START2 + 1;
@@ -188143,7 +188181,7 @@ var StablePortAllocator = class {
 };
 
 // src/lib/dev/database-manager.ts
-import * as fs15 from "fs";
+import * as fs16 from "fs";
 import * as path11 from "path";
 import * as net from "net";
 import { spawn } from "child_process";
@@ -188155,9 +188193,9 @@ async function startPostgres(pg, port, dataDir, onProgress) {
   const password = "postgres";
   const libraryEnv = getLibraryEnv(binary);
   const env2 = { ...process.env, ...libraryEnv };
-  const dataExists = fs15.existsSync(dbDataPath);
+  const dataExists = fs16.existsSync(dbDataPath);
   if (!dataExists) {
-    fs15.mkdirSync(dbDataPath, { recursive: true });
+    fs16.mkdirSync(dbDataPath, { recursive: true });
     await runCommand(
       binary.executables["initdb"],
       ["-D", dbDataPath, "-U", user, "--auth=trust", "--no-locale", "-E", "UTF8"],
@@ -188234,8 +188272,8 @@ async function startRedis(redis, port, onProgress) {
 async function startStorage(storage, port, dataDir) {
   const S3rver = (await import("s3rver")).default;
   const storageDataPath = path11.join(process.cwd(), dataDir, storage.name);
-  if (!fs15.existsSync(storageDataPath)) {
-    fs15.mkdirSync(storageDataPath, { recursive: true });
+  if (!fs16.existsSync(storageDataPath)) {
+    fs16.mkdirSync(storageDataPath, { recursive: true });
   }
   const host = "127.0.0.1";
   const accessKey = "S3RVER";
@@ -188878,7 +188916,7 @@ function startService(service, resources, secrets, configs, endpointPorts, servi
 }
 
 // src/lib/dev/instance-state.ts
-import * as fs16 from "fs";
+import * as fs17 from "fs";
 import * as path12 from "path";
 var InstanceStateManager = class {
   stateDir;
@@ -188896,8 +188934,8 @@ var InstanceStateManager = class {
     return this.key;
   }
   ensureStateDir() {
-    if (!fs16.existsSync(this.stateDir)) {
-      fs16.mkdirSync(this.stateDir, { recursive: true });
+    if (!fs17.existsSync(this.stateDir)) {
+      fs17.mkdirSync(this.stateDir, { recursive: true });
     }
   }
   isProcessRunning(pid) {
@@ -188914,15 +188952,15 @@ var InstanceStateManager = class {
     const startTime = Date.now();
     while (Date.now() - startTime < timeoutMs) {
       try {
-        const fd = fs16.openSync(
+        const fd = fs17.openSync(
           this.lockPath,
-          fs16.constants.O_CREAT | fs16.constants.O_EXCL | fs16.constants.O_WRONLY
+          fs17.constants.O_CREAT | fs17.constants.O_EXCL | fs17.constants.O_WRONLY
         );
-        fs16.writeSync(fd, String(process.pid));
-        fs16.closeSync(fd);
+        fs17.writeSync(fd, String(process.pid));
+        fs17.closeSync(fd);
         return () => {
           try {
-            fs16.unlinkSync(this.lockPath);
+            fs17.unlinkSync(this.lockPath);
           } catch {
           }
         };
@@ -188931,16 +188969,16 @@ var InstanceStateManager = class {
         if (err.code === "EEXIST") {
           try {
             const lockPid = parseInt(
-              fs16.readFileSync(this.lockPath, "utf-8").trim(),
+              fs17.readFileSync(this.lockPath, "utf-8").trim(),
               10
             );
             if (!this.isProcessRunning(lockPid)) {
-              fs16.unlinkSync(this.lockPath);
+              fs17.unlinkSync(this.lockPath);
               continue;
             }
           } catch {
             try {
-              fs16.unlinkSync(this.lockPath);
+              fs17.unlinkSync(this.lockPath);
             } catch {
             }
             continue;
@@ -188954,12 +188992,12 @@ var InstanceStateManager = class {
     throw new Error("Failed to acquire state lock (timeout)");
   }
   async getExistingInstances() {
-    if (!fs16.existsSync(this.statePath)) {
+    if (!fs17.existsSync(this.statePath)) {
       return null;
     }
     const releaseLock = await this.acquireLock();
     try {
-      const content = fs16.readFileSync(this.statePath, "utf-8");
+      const content = fs17.readFileSync(this.statePath, "utf-8");
       const state = JSON.parse(content);
       if (!this.isProcessRunning(state.owner.pid)) {
         return null;
@@ -188972,21 +189010,21 @@ var InstanceStateManager = class {
     }
   }
   async cleanStaleState() {
-    if (!fs16.existsSync(this.statePath)) {
+    if (!fs17.existsSync(this.statePath)) {
       return false;
     }
     const releaseLock = await this.acquireLock();
     try {
-      const content = fs16.readFileSync(this.statePath, "utf-8");
+      const content = fs17.readFileSync(this.statePath, "utf-8");
       const state = JSON.parse(content);
       if (!this.isProcessRunning(state.owner.pid)) {
-        fs16.unlinkSync(this.statePath);
+        fs17.unlinkSync(this.statePath);
         return true;
       }
       return false;
     } catch {
       try {
-        fs16.unlinkSync(this.statePath);
+        fs17.unlinkSync(this.statePath);
         return true;
       } catch {
       }
@@ -188998,8 +189036,8 @@ var InstanceStateManager = class {
   async claimOwnership(command) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs16.existsSync(this.statePath)) {
-        const content = fs16.readFileSync(this.statePath, "utf-8");
+      if (fs17.existsSync(this.statePath)) {
+        const content = fs17.readFileSync(this.statePath, "utf-8");
         const state2 = JSON.parse(content);
         if (this.isProcessRunning(state2.owner.pid)) {
           throw new Error(`Instances already owned by PID ${state2.owner.pid}`);
@@ -189068,8 +189106,8 @@ var InstanceStateManager = class {
     }
     const releaseLock = await this.acquireLock();
     try {
-      if (fs16.existsSync(this.statePath)) {
-        fs16.unlinkSync(this.statePath);
+      if (fs17.existsSync(this.statePath)) {
+        fs17.unlinkSync(this.statePath);
       }
       this.ownsInstances = false;
     } finally {
@@ -189077,21 +189115,21 @@ var InstanceStateManager = class {
     }
   }
   readState() {
-    const content = fs16.readFileSync(this.statePath, "utf-8");
+    const content = fs17.readFileSync(this.statePath, "utf-8");
     return JSON.parse(content);
   }
   writeStateAtomic(state) {
     this.ensureStateDir();
     const tmpPath = this.statePath + ".tmp";
-    fs16.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
-    fs16.renameSync(tmpPath, this.statePath);
+    fs17.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
+    fs17.renameSync(tmpPath, this.statePath);
   }
 };
 
 // src/lib/dev/http-proxy.ts
 import * as http from "http";
 import * as https from "https";
-import * as fs17 from "fs";
+import * as fs18 from "fs";
 import * as path13 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import httpProxy from "http-proxy";
@@ -189499,10 +189537,10 @@ function serveFilesystemFile(res, pathname) {
     res.end("<h1>Forbidden</h1>");
     return;
   }
-  if (fs17.existsSync(resolvedPath)) {
-    if (fs17.statSync(resolvedPath).isDirectory()) {
+  if (fs18.existsSync(resolvedPath)) {
+    if (fs18.statSync(resolvedPath).isDirectory()) {
       const indexPath2 = path13.join(resolvedPath, "index.html");
-      if (fs17.existsSync(indexPath2)) {
+      if (fs18.existsSync(indexPath2)) {
         return serveFile(res, indexPath2);
       }
     } else {
@@ -189510,15 +189548,15 @@ function serveFilesystemFile(res, pathname) {
     }
   }
   const htmlPath = resolvedPath + ".html";
-  if (fs17.existsSync(htmlPath)) {
+  if (fs18.existsSync(htmlPath)) {
     return serveFile(res, htmlPath);
   }
   const indexPath = path13.join(resolvedPath, "index.html");
-  if (fs17.existsSync(indexPath)) {
+  if (fs18.existsSync(indexPath)) {
     return serveFile(res, indexPath);
   }
   const notFoundPath = path13.join(adminDir, "404.html");
-  if (fs17.existsSync(notFoundPath)) {
+  if (fs18.existsSync(notFoundPath)) {
     return serveFileContent(res, notFoundPath, "text/html", 404);
   }
   res.writeHead(404, { "Content-Type": "text/html" });
@@ -189531,7 +189569,7 @@ function serveFile(res, filePath) {
 }
 function serveFileContent(res, filePath, contentType, statusCode = 200) {
   try {
-    const content = fs17.readFileSync(filePath);
+    const content = fs18.readFileSync(filePath);
     res.writeHead(statusCode, { "Content-Type": contentType });
     res.end(content);
   } catch (err) {
@@ -189906,7 +189944,7 @@ async function startMailServer(mail, smtpPort, apiPort) {
 
 // src/lib/dev/drizzle-gateway-manager.ts
 import * as net3 from "net";
-import * as fs18 from "fs";
+import * as fs19 from "fs";
 import * as path15 from "path";
 import { spawn as spawn4 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
@@ -189940,12 +189978,12 @@ async function startDrizzleGateway(postgresInstances, port, configDir, options2)
   );
   const host = "127.0.0.1";
   const drizzleConfigDir = path15.join(configDir, "drizzle-gateway");
-  if (!fs18.existsSync(drizzleConfigDir)) {
-    fs18.mkdirSync(drizzleConfigDir, { recursive: true });
+  if (!fs19.existsSync(drizzleConfigDir)) {
+    fs19.mkdirSync(drizzleConfigDir, { recursive: true });
   }
   const storeJson = generateStoreJson(postgresInstances);
   const storeJsonPath = path15.join(drizzleConfigDir, "store.json");
-  fs18.writeFileSync(storeJsonPath, JSON.stringify(storeJson, null, 2));
+  fs19.writeFileSync(storeJsonPath, JSON.stringify(storeJson, null, 2));
   writeLog("drizzle-gateway", `Starting Drizzle Gateway`);
   writeLog("drizzle-gateway", `STORE_PATH: ${drizzleConfigDir}`);
   writeLog("drizzle-gateway", `PORT: ${port}`);
@@ -190047,16 +190085,16 @@ function detectSyncDatabases(config) {
 }
 
 // src/lib/dev/reshape-watcher.ts
-import * as fs19 from "fs";
+import * as fs20 from "fs";
 import * as path16 from "path";
 import { spawnSync } from "child_process";
 function getMigrationFiles(dir, log) {
   log(`Scanning migrations directory: ${dir}`);
-  if (!fs19.existsSync(dir)) {
+  if (!fs20.existsSync(dir)) {
     log(`Migrations directory does not exist: ${dir}`);
     return [];
   }
-  const files = fs19.readdirSync(dir);
+  const files = fs20.readdirSync(dir);
   log(`Found ${files.length} files in directory`);
   const tomlFiles = files.filter((f) => f.endsWith(".toml")).sort((a, b) => a.localeCompare(b));
   log(`Found ${tomlFiles.length} .toml migration files: ${tomlFiles.join(", ") || "(none)"}`);
@@ -190106,7 +190144,7 @@ function runReshape(args, databaseUrl, migrationsDir, reshapeBinaryPath, log) {
 }
 function makeReadOnly(filePath, log) {
   try {
-    fs19.chmodSync(filePath, 292);
+    fs20.chmodSync(filePath, 292);
     log(`Set file permissions to read-only (444): ${filePath}`);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -190192,9 +190230,9 @@ function createReshapeWatcher(options2) {
   };
   const startWatching = () => {
     log(`Starting file watcher for migrations directory...`);
-    if (!fs19.existsSync(migrationsDir)) {
+    if (!fs20.existsSync(migrationsDir)) {
       log(`Migrations directory does not exist, creating: ${migrationsDir}`);
-      fs19.mkdirSync(migrationsDir, { recursive: true });
+      fs20.mkdirSync(migrationsDir, { recursive: true });
     }
     log(`Watching directory: ${migrationsDir}`);
     watcher = chokidar_default.watch(migrationsDir, {
@@ -190329,7 +190367,7 @@ function createReshapeWatcher(options2) {
 }
 
 // src/lib/dev/temporal-manager.ts
-import * as fs20 from "fs";
+import * as fs21 from "fs";
 import * as path17 from "path";
 import * as net4 from "net";
 import { spawn as spawn5 } from "child_process";
@@ -190337,8 +190375,8 @@ async function startTemporalDevServer(temporals, grpcPort, uiPort, dataDir, onPr
   const binary = await ensureBinary(temporalBinary, void 0, onProgress);
   const dbPath = path17.join(process.cwd(), dataDir, "temporal.db");
   const dbDir = path17.dirname(dbPath);
-  if (!fs20.existsSync(dbDir)) {
-    fs20.mkdirSync(dbDir, { recursive: true });
+  if (!fs21.existsSync(dbDir)) {
+    fs21.mkdirSync(dbDir, { recursive: true });
   }
   const host = "127.0.0.1";
   const namespaceArgs = temporals.flatMap((t) => ["--namespace", t.name]);
@@ -190667,7 +190705,7 @@ function watchConfigFile(configPath, debounceMs, onChange) {
 }
 
 // src/lib/dev/subdomain-generator.ts
-import * as fs21 from "fs";
+import * as fs22 from "fs";
 import * as path18 from "path";
 import { generateSlug } from "random-word-slugs";
 var StableSubdomainAllocator = class {
@@ -190680,11 +190718,11 @@ var StableSubdomainAllocator = class {
     this.loadTunnels();
   }
   loadTunnels() {
-    if (!fs21.existsSync(this.tunnelsFilePath)) {
+    if (!fs22.existsSync(this.tunnelsFilePath)) {
       return;
     }
     try {
-      const content = fs21.readFileSync(this.tunnelsFilePath, "utf-8");
+      const content = fs22.readFileSync(this.tunnelsFilePath, "utf-8");
       const data = JSON.parse(content);
       if (data.version === 1 && data.baseSlug) {
         this.baseSlug = data.baseSlug;
@@ -190694,14 +190732,14 @@ var StableSubdomainAllocator = class {
     }
   }
   saveTunnels() {
-    if (!fs21.existsSync(this.tunnelsDir)) {
-      fs21.mkdirSync(this.tunnelsDir, { recursive: true });
+    if (!fs22.existsSync(this.tunnelsDir)) {
+      fs22.mkdirSync(this.tunnelsDir, { recursive: true });
     }
     const data = {
       version: 1,
       baseSlug: this.baseSlug
     };
-    fs21.writeFileSync(this.tunnelsFilePath, JSON.stringify(data, null, 2));
+    fs22.writeFileSync(this.tunnelsFilePath, JSON.stringify(data, null, 2));
   }
   generateBaseSlug() {
     return generateSlug(2, {
@@ -190857,9 +190895,9 @@ async function startTunnel(serviceName, endpointName, port, subdomain, callbacks
 }
 
 // src/lib/dev/proxy-registry.ts
-import * as fs22 from "fs";
+import * as fs23 from "fs";
 import * as path19 from "path";
-import * as os8 from "os";
+import * as os9 from "os";
 import * as net6 from "net";
 var ProxyRegistryManager = class {
   proxyDir;
@@ -190869,14 +190907,14 @@ var ProxyRegistryManager = class {
   isOwner = false;
   registryWatcher = null;
   constructor() {
-    this.proxyDir = path19.join(os8.homedir(), ".specific", "proxy");
+    this.proxyDir = path19.join(os9.homedir(), ".specific", "proxy");
     this.ownerPath = path19.join(this.proxyDir, "owner.json");
     this.registryPath = path19.join(this.proxyDir, "registry.json");
     this.lockPath = path19.join(this.proxyDir, "registry.lock");
   }
   ensureProxyDir() {
-    if (!fs22.existsSync(this.proxyDir)) {
-      fs22.mkdirSync(this.proxyDir, { recursive: true });
+    if (!fs23.existsSync(this.proxyDir)) {
+      fs23.mkdirSync(this.proxyDir, { recursive: true });
     }
   }
   isProcessRunning(pid) {
@@ -190933,15 +190971,15 @@ var ProxyRegistryManager = class {
     const startTime = Date.now();
     while (Date.now() - startTime < timeoutMs) {
       try {
-        const fd = fs22.openSync(
+        const fd = fs23.openSync(
           this.lockPath,
-          fs22.constants.O_CREAT | fs22.constants.O_EXCL | fs22.constants.O_WRONLY
+          fs23.constants.O_CREAT | fs23.constants.O_EXCL | fs23.constants.O_WRONLY
         );
-        fs22.writeSync(fd, String(process.pid));
-        fs22.closeSync(fd);
+        fs23.writeSync(fd, String(process.pid));
+        fs23.closeSync(fd);
         return () => {
           try {
-            fs22.unlinkSync(this.lockPath);
+            fs23.unlinkSync(this.lockPath);
           } catch {
           }
         };
@@ -190950,16 +190988,16 @@ var ProxyRegistryManager = class {
         if (err.code === "EEXIST") {
           try {
             const lockPid = parseInt(
-              fs22.readFileSync(this.lockPath, "utf-8").trim(),
+              fs23.readFileSync(this.lockPath, "utf-8").trim(),
               10
             );
             if (!this.isProcessRunning(lockPid)) {
-              fs22.unlinkSync(this.lockPath);
+              fs23.unlinkSync(this.lockPath);
               continue;
             }
           } catch {
             try {
-              fs22.unlinkSync(this.lockPath);
+              fs23.unlinkSync(this.lockPath);
             } catch {
             }
             continue;
@@ -190979,8 +191017,8 @@ var ProxyRegistryManager = class {
   async claimProxyOwnership(key) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs22.existsSync(this.ownerPath)) {
-        const content = fs22.readFileSync(this.ownerPath, "utf-8");
+      if (fs23.existsSync(this.ownerPath)) {
+        const content = fs23.readFileSync(this.ownerPath, "utf-8");
         const ownerFile2 = JSON.parse(content);
         if (await this.isProxyOwnerHealthy(ownerFile2.owner.pid)) {
           return false;
@@ -191010,11 +191048,11 @@ var ProxyRegistryManager = class {
     }
     const releaseLock = await this.acquireLock();
     try {
-      if (fs22.existsSync(this.ownerPath)) {
-        const content = fs22.readFileSync(this.ownerPath, "utf-8");
+      if (fs23.existsSync(this.ownerPath)) {
+        const content = fs23.readFileSync(this.ownerPath, "utf-8");
         const ownerFile = JSON.parse(content);
         if (ownerFile.owner.pid === process.pid) {
-          fs22.unlinkSync(this.ownerPath);
+          fs23.unlinkSync(this.ownerPath);
         }
       }
       this.isOwner = false;
@@ -191026,12 +191064,12 @@ var ProxyRegistryManager = class {
    * Get the current proxy owner.
    */
   async getProxyOwner() {
-    if (!fs22.existsSync(this.ownerPath)) {
+    if (!fs23.existsSync(this.ownerPath)) {
       return null;
     }
     const releaseLock = await this.acquireLock();
     try {
-      const content = fs22.readFileSync(this.ownerPath, "utf-8");
+      const content = fs23.readFileSync(this.ownerPath, "utf-8");
       const ownerFile = JSON.parse(content);
       if (!await this.isProxyOwnerHealthy(ownerFile.owner.pid)) {
         return null;
@@ -191128,7 +191166,7 @@ var ProxyRegistryManager = class {
    */
   watchRegistry(onChange) {
     this.ensureProxyDir();
-    if (!fs22.existsSync(this.registryPath)) {
+    if (!fs23.existsSync(this.registryPath)) {
       const emptyRegistry = {
         version: 1,
         keys: {},
@@ -191171,13 +191209,13 @@ var ProxyRegistryManager = class {
   async attemptElection(key) {
     const releaseLock = await this.acquireLock();
     try {
-      if (fs22.existsSync(this.ownerPath)) {
-        const content = fs22.readFileSync(this.ownerPath, "utf-8");
+      if (fs23.existsSync(this.ownerPath)) {
+        const content = fs23.readFileSync(this.ownerPath, "utf-8");
         const ownerFile2 = JSON.parse(content);
         if (await this.isProxyOwnerHealthy(ownerFile2.owner.pid)) {
           return false;
         }
-        fs22.unlinkSync(this.ownerPath);
+        fs23.unlinkSync(this.ownerPath);
       }
       const ownerFile = {
         version: 1,
@@ -191195,7 +191233,7 @@ var ProxyRegistryManager = class {
     }
   }
   readRegistry() {
-    if (!fs22.existsSync(this.registryPath)) {
+    if (!fs23.existsSync(this.registryPath)) {
       return {
         version: 1,
         keys: {},
@@ -191203,7 +191241,7 @@ var ProxyRegistryManager = class {
       };
     }
     try {
-      const content = fs22.readFileSync(this.registryPath, "utf-8");
+      const content = fs23.readFileSync(this.registryPath, "utf-8");
       return JSON.parse(content);
     } catch {
       return {
@@ -191216,8 +191254,8 @@ var ProxyRegistryManager = class {
   writeFileAtomic(filePath, data) {
     this.ensureProxyDir();
     const tmpPath = filePath + ".tmp";
-    fs22.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
-    fs22.renameSync(tmpPath, filePath);
+    fs23.writeFileSync(tmpPath, JSON.stringify(data, null, 2));
+    fs23.renameSync(tmpPath, filePath);
   }
 };
 
@@ -191326,7 +191364,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
     const setupDone = tunnelEnabled || !systemSetupNeeded();
     return {
       status: setupDone ? "loading" : "installing-ca",
-      ...setupDone ? {} : { caInstallPhase: "installing" },
+      ...setupDone ? {} : { caInstallPhase: "prompt" },
       resources: /* @__PURE__ */ new Map(),
       resourceStatus: /* @__PURE__ */ new Map(),
       services: [],
@@ -191342,6 +191380,11 @@ function DevUI({ instanceKey, tunnelEnabled }) {
       installSystemConfig();
     }
   }, [state.status, state.caInstallPhase]);
+  useInput4((_input, key) => {
+    if (state.status === "installing-ca" && state.caInstallPhase === "prompt" && key.return) {
+      setState((s) => ({ ...s, caInstallPhase: "installing" }));
+    }
+  });
   async function installSystemConfig() {
     try {
       performSystemSetup();
@@ -191535,7 +191578,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
     const configPath = path20.join(process.cwd(), "specific.hcl");
     const watcher = watchConfigFile(configPath, 1e3, () => {
       try {
-        const hcl = fs23.readFileSync(configPath, "utf-8");
+        const hcl = fs24.readFileSync(configPath, "utf-8");
         parseConfig(hcl).then(() => {
           triggerReload();
         }).catch((err) => {
@@ -191661,7 +191704,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
         return;
       }
       const configPath = path20.join(process.cwd(), "specific.hcl");
-      if (!fs23.existsSync(configPath)) {
+      if (!fs24.existsSync(configPath)) {
         writeLog("system", "Waiting for specific.hcl to appear");
         setState((s) => ({
           ...s,
@@ -191679,7 +191722,7 @@ function DevUI({ instanceKey, tunnelEnabled }) {
         return;
       }
       let config2;
-      const hcl = fs23.readFileSync(configPath, "utf-8");
+      const hcl = fs24.readFileSync(configPath, "utf-8");
       try {
         config2 = await parseConfig(hcl);
       } catch (err) {
@@ -192006,7 +192049,7 @@ Add them to the config block in specific.local`);
           if (service.volumes) {
             for (const vol of service.volumes) {
               const volumeDir = path20.resolve(`.specific/keys/${instanceKey}/data/volumes/${service.name}/${vol.name}`);
-              fs23.mkdirSync(volumeDir, { recursive: true });
+              fs24.mkdirSync(volumeDir, { recursive: true });
               volumePaths.set(vol.name, volumeDir);
             }
           }
@@ -192062,7 +192105,7 @@ Add them to the config block in specific.local`);
             if (service.volumes) {
               for (const vol of service.volumes) {
                 const volumeDir = path20.resolve(`.specific/keys/${instanceKey}/data/volumes/${service.name}/${vol.name}`);
-                fs23.mkdirSync(volumeDir, { recursive: true });
+                fs24.mkdirSync(volumeDir, { recursive: true });
                 volumePaths.set(vol.name, volumeDir);
               }
             }
@@ -192356,8 +192399,11 @@ Add them to the config block in specific.local`);
     };
   }, [reloadTrigger, readyToStart, instanceKey]);
   if (state.status === "installing-ca") {
+    if (state.caInstallPhase === "prompt") {
+      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Configure development environment"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "We need to do a one-time setup for all your Specific projects."), /* @__PURE__ */ React6.createElement(Text6, null, "This is so we can run your apps locally with secure URLs:"), /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "green" }, "https://your-app.local.spcf.app"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "You will be prompted to authorize with your password."), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Press ", /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Enter"), " to authorize."));
+    }
     if (state.caInstallPhase === "installing") {
-      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Local Development Setup"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Setting up TLS certificates and DNS resolution for local"), /* @__PURE__ */ React6.createElement(Text6, null, "development. This is a one-time setup for Specific projects."), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Your password is required to configure your system."), /* @__PURE__ */ React6.createElement(Text6, null, " "));
+      return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { bold: true, color: "cyan" }, "Configure development environment"), /* @__PURE__ */ React6.createElement(Text6, null, " "), /* @__PURE__ */ React6.createElement(Text6, null, "Awaiting authorization\u2026"));
     }
     if (state.caInstallPhase === "error") {
       return /* @__PURE__ */ React6.createElement(Box6, { flexDirection: "column" }, /* @__PURE__ */ React6.createElement(Text6, { color: "red" }, "Setup failed: ", state.caError));
@@ -192630,7 +192676,7 @@ init_open();
 import React7, { useState as useState6, useEffect as useEffect4, useCallback } from "react";
 import { render as render5, Text as Text7, Box as Box7, useApp as useApp3, useInput as useInput5 } from "ink";
 import Spinner5 from "ink-spinner";
-import * as fs25 from "fs";
+import * as fs26 from "fs";
 import * as path23 from "path";
 
 // src/lib/deploy/build-tester.ts
@@ -192815,7 +192861,7 @@ async function testAllBuilds(builds, projectDir) {
 
 // src/lib/tarball/create.ts
 import { execSync as execSync4 } from "child_process";
-import * as fs24 from "fs";
+import * as fs25 from "fs";
 import * as path22 from "path";
 import { createTarPacker, createEntryItemGenerator } from "tar-vern";
 function isInsideGitRepository(dir) {
@@ -192873,7 +192919,7 @@ var EXCLUDED_DIRS = [
 ];
 async function collectPaths(baseDir, currentDir, exclude) {
   const results = [];
-  const entries = await fs24.promises.readdir(currentDir, { withFileTypes: true });
+  const entries = await fs25.promises.readdir(currentDir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = path22.join(currentDir, entry.name);
     const relativePath = path22.relative(baseDir, fullPath);
@@ -192892,7 +192938,7 @@ async function collectPaths(baseDir, currentDir, exclude) {
 async function createTarArchive(projectDir) {
   writeLog("tarball", "Creating tarball using tar-vern (non-git project)");
   const configPath = path22.join(projectDir, "specific.hcl");
-  if (!fs24.existsSync(configPath)) {
+  if (!fs25.existsSync(configPath)) {
     throw new Error("specific.hcl not found in project directory");
   }
   const relativePaths = await collectPaths(projectDir, projectDir, EXCLUDED_DIRS);
@@ -193825,12 +193871,12 @@ ${errorMsg}`
 }
 async function deployCommand(environment, options2) {
   const configPath = path23.join(process.cwd(), "specific.hcl");
-  if (!fs25.existsSync(configPath)) {
+  if (!fs26.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
-  const hcl = fs25.readFileSync(configPath, "utf-8");
+  const hcl = fs26.readFileSync(configPath, "utf-8");
   try {
     config = await parseConfig(hcl);
   } catch (err) {
@@ -193853,7 +193899,7 @@ async function deployCommand(environment, options2) {
 
 // src/commands/exec.tsx
 import { spawn as spawn7 } from "child_process";
-import * as fs26 from "fs";
+import * as fs27 from "fs";
 import * as path24 from "path";
 async function execCommand(serviceName, command, instanceKey = "default") {
   if (command.length === 0) {
@@ -193883,12 +193929,12 @@ async function execCommand(serviceName, command, instanceKey = "default") {
     }
   };
   const configPath = path24.join(process.cwd(), "specific.hcl");
-  if (!fs26.existsSync(configPath)) {
+  if (!fs27.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
-  const hcl = fs26.readFileSync(configPath, "utf-8");
+  const hcl = fs27.readFileSync(configPath, "utf-8");
   try {
     config = await parseConfig(hcl);
   } catch (err) {
@@ -194038,7 +194084,7 @@ async function execCommand(serviceName, command, instanceKey = "default") {
 
 // src/commands/psql.tsx
 import { spawn as spawn8 } from "child_process";
-import * as fs27 from "fs";
+import * as fs28 from "fs";
 import * as path25 from "path";
 async function psqlCommand(databaseName, instanceKey = "default", extraArgs = []) {
   let startedResources = [];
@@ -194057,12 +194103,12 @@ async function psqlCommand(databaseName, instanceKey = "default", extraArgs = []
     }
   };
   const configPath = path25.join(process.cwd(), "specific.hcl");
-  if (!fs27.existsSync(configPath)) {
+  if (!fs28.existsSync(configPath)) {
     console.error("Error: No specific.hcl found in current directory");
     process.exit(1);
   }
   let config;
-  const hcl = fs27.readFileSync(configPath, "utf-8");
+  const hcl = fs28.readFileSync(configPath, "utf-8");
   try {
     config = await parseConfig(hcl);
   } catch (err) {
@@ -194186,7 +194232,7 @@ async function psqlCommand(databaseName, instanceKey = "default", extraArgs = []
 
 // src/commands/reshape.tsx
 import { spawn as spawn9 } from "child_process";
-import * as fs28 from "fs";
+import * as fs29 from "fs";
 import * as path26 from "path";
 var VALID_ACTIONS = ["start", "complete", "status", "abort", "check"];
 var MIGRATION_SUBCOMMANDS = ["start", "complete", "abort"];
@@ -194204,8 +194250,8 @@ async function reshapeCommand(action, databaseName, instanceKey = "default") {
   let migrationsDir = "migrations";
   let targetDb;
   try {
-    if (fs28.existsSync(configPath)) {
-      const configContent = fs28.readFileSync(configPath, "utf-8");
+    if (fs29.existsSync(configPath)) {
+      const configContent = fs29.readFileSync(configPath, "utf-8");
       config = await parseConfig(configContent);
       if (databaseName) {
         const postgresConfig = config.postgres.find((p) => p.name === databaseName);
@@ -194341,7 +194387,7 @@ async function reshapeCommand(action, databaseName, instanceKey = "default") {
   const reshapeArgs = isMigrationSubcommand ? ["migration", action] : [action];
   const fullMigrationsPath = path26.join(process.cwd(), migrationsDir);
   if (action === "check" || action === "start") {
-    if (fs28.existsSync(fullMigrationsPath)) {
+    if (fs29.existsSync(fullMigrationsPath)) {
       reshapeArgs.push("--dirs", fullMigrationsPath);
     } else if (action === "check") {
       console.error(`Error: Migrations directory not found: ${fullMigrationsPath}`);
@@ -194391,7 +194437,7 @@ async function reshapeCommand(action, databaseName, instanceKey = "default") {
 import React8, { useState as useState7, useEffect as useEffect5 } from "react";
 import { render as render6, Text as Text8, Box as Box8 } from "ink";
 import Spinner6 from "ink-spinner";
-import * as fs29 from "fs";
+import * as fs30 from "fs";
 import * as path27 from "path";
 function CleanUI({ instanceKey }) {
   const [state, setState] = useState7({ status: "checking" });
@@ -194399,13 +194445,13 @@ function CleanUI({ instanceKey }) {
     async function clean() {
       const projectRoot = process.cwd();
       const specificDir = path27.join(projectRoot, ".specific");
-      if (!fs29.existsSync(specificDir)) {
+      if (!fs30.existsSync(specificDir)) {
         setState({ status: "nothing" });
         return;
       }
       if (instanceKey) {
         const keyDir = path27.join(specificDir, "keys", instanceKey);
-        if (!fs29.existsSync(keyDir)) {
+        if (!fs30.existsSync(keyDir)) {
           setState({ status: "nothing" });
           return;
         }
@@ -194421,7 +194467,7 @@ function CleanUI({ instanceKey }) {
         await stateManager.cleanStaleState();
         setState({ status: "cleaning" });
         try {
-          fs29.rmSync(keyDir, { recursive: true, force: true });
+          fs30.rmSync(keyDir, { recursive: true, force: true });
           setState({ status: "success" });
         } catch (err) {
           setState({
@@ -194431,12 +194477,12 @@ function CleanUI({ instanceKey }) {
         }
       } else {
         const keysDir = path27.join(specificDir, "keys");
-        if (!fs29.existsSync(keysDir)) {
+        if (!fs30.existsSync(keysDir)) {
           setState({ status: "nothing" });
           return;
         }
-        const keys = fs29.readdirSync(keysDir).filter(
-          (f) => fs29.statSync(path27.join(keysDir, f)).isDirectory()
+        const keys = fs30.readdirSync(keysDir).filter(
+          (f) => fs30.statSync(path27.join(keysDir, f)).isDirectory()
         );
         for (const key of keys) {
           const stateManager2 = new InstanceStateManager(projectRoot, key);
@@ -194460,7 +194506,7 @@ function CleanUI({ instanceKey }) {
         }
         setState({ status: "cleaning" });
         try {
-          fs29.rmSync(keysDir, { recursive: true, force: true });
+          fs30.rmSync(keysDir, { recursive: true, force: true });
           setState({ status: "success" });
         } catch (err) {
           setState({
@@ -194625,7 +194671,7 @@ import { render as render9, Text as Text11, Box as Box10, useApp as useApp6 } fr
 import Spinner7 from "ink-spinner";
 
 // src/lib/update.ts
-import * as fs30 from "fs";
+import * as fs31 from "fs";
 import * as path28 from "path";
 var BINARIES_BASE_URL = "https://binaries.specific.dev/cli";
 function compareVersions(a, b) {
@@ -194640,7 +194686,7 @@ function compareVersions(a, b) {
   return 0;
 }
 async function checkForUpdate() {
-  const currentVersion = "0.1.71";
+  const currentVersion = "0.1.72";
   const response = await fetch(`${BINARIES_BASE_URL}/latest?t=${Date.now()}`);
   if (!response.ok) {
     throw new Error(`Failed to check for updates: HTTP ${response.status}`);
@@ -194656,7 +194702,7 @@ function isBinaryWritable() {
   const binaryPath = getCurrentBinaryPath();
   const dir = path28.dirname(binaryPath);
   try {
-    fs30.accessSync(dir, fs30.constants.W_OK);
+    fs31.accessSync(dir, fs31.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -194667,21 +194713,21 @@ async function performUpdate(version, onProgress) {
   const binaryDir = path28.dirname(binaryPath);
   const tempPath = path28.join(binaryDir, `.specific-update-${process.pid}`);
   try {
-    const { platform: platform5, arch: arch3 } = getPlatformInfo();
-    const url = `${BINARIES_BASE_URL}/${version}/specific-${platform5}-${arch3}`;
+    const { platform: platform6, arch: arch3 } = getPlatformInfo();
+    const url = `${BINARIES_BASE_URL}/${version}/specific-${platform6}-${arch3}`;
     await downloadFile(url, tempPath, onProgress);
-    const stat4 = fs30.statSync(tempPath);
+    const stat4 = fs31.statSync(tempPath);
     if (stat4.size === 0) {
       throw new Error("Downloaded binary is empty");
     }
-    fs30.chmodSync(tempPath, 493);
+    fs31.chmodSync(tempPath, 493);
     onProgress?.({ phase: "finalizing" });
-    fs30.unlinkSync(binaryPath);
-    fs30.renameSync(tempPath, binaryPath);
+    fs31.unlinkSync(binaryPath);
+    fs31.renameSync(tempPath, binaryPath);
   } catch (error) {
     try {
-      if (fs30.existsSync(tempPath)) {
-        fs30.unlinkSync(tempPath);
+      if (fs31.existsSync(tempPath)) {
+        fs31.unlinkSync(tempPath);
       }
     } catch {
     }
@@ -194691,21 +194737,21 @@ async function performUpdate(version, onProgress) {
 
 // src/lib/background-update.ts
 import { spawn as spawn10 } from "child_process";
-import * as fs31 from "fs";
+import * as fs32 from "fs";
 import * as path29 from "path";
-import * as os9 from "os";
-var SPECIFIC_DIR = path29.join(os9.homedir(), ".specific");
+import * as os10 from "os";
+var SPECIFIC_DIR = path29.join(os10.homedir(), ".specific");
 var RATE_LIMIT_FILE = path29.join(SPECIFIC_DIR, "last-update-check");
 var LOCK_FILE = path29.join(SPECIFIC_DIR, "update.lock");
 var RATE_LIMIT_MS = 60 * 60 * 1e3;
 var STALE_LOCK_MS = 10 * 60 * 1e3;
 function writeCheckTimestamp() {
-  fs31.mkdirSync(SPECIFIC_DIR, { recursive: true });
-  fs31.writeFileSync(RATE_LIMIT_FILE, String(Date.now()), "utf-8");
+  fs32.mkdirSync(SPECIFIC_DIR, { recursive: true });
+  fs32.writeFileSync(RATE_LIMIT_FILE, String(Date.now()), "utf-8");
 }
 function isRateLimited() {
   try {
-    const content = fs31.readFileSync(RATE_LIMIT_FILE, "utf-8").trim();
+    const content = fs32.readFileSync(RATE_LIMIT_FILE, "utf-8").trim();
     const lastCheck = parseInt(content, 10);
     if (isNaN(lastCheck)) return false;
     return Date.now() - lastCheck < RATE_LIMIT_MS;
@@ -194839,7 +194885,7 @@ function updateCommand() {
 var program = new Command();
 var env = "production";
 var envLabel = env !== "production" ? `[${env.toUpperCase()}] ` : "";
-program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.71").enablePositionalOptions();
+program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.72").enablePositionalOptions();
 program.command("init").description("Initialize project for use with a coding agent").option("--agent <name...>", "Agents to configure (cursor, claude, codex, other)").action((options2) => initCommand(options2));
 program.command("docs [topic]").description("Fetch LLM-optimized documentation").action(docsCommand);
 program.command("check").description("Validate specific.hcl configuration").action(checkCommand);