@superblocksteam/cli 2.0.141-next.0 → 2.0.141-next.1

package/dist/{chunk-O3ALZQID.js → chunk-2FCS5636.js}

@@ -1,7 +1,7 @@
 if (typeof process === 'object' && process !== null &&
     process.env !== null && typeof process.env === 'object') {
   process.env.DD_GIT_REPOSITORY_URL = 'https://token@github.com/superblocksteam/superblocks.git';
-  process.env.DD_GIT_COMMIT_SHA = '504a48cde044242c00ff8d69f0c4479cebd5f6b7';
+  process.env.DD_GIT_COMMIT_SHA = '08c6a40ccc6547d3d6f805bdbf0a0be94c8e634d';
 }
 import { createRequire as $dd_createRequire } from 'module';
 import { fileURLToPath as $dd_fileURLToPath } from 'url';
@@ -15,7 +15,7 @@ import {
   require_lib as require_lib2,
   require_lib2 as require_lib3,
   require_picocolors
-} from "./chunk-CQS2FXON.js";
+} from "./chunk-PTS6G4WB.js";
 import {
   debounce_default,
   get_default,
@@ -32,20 +32,20 @@ import {
   require_lib,
   require_slugify,
   throttle_default
-} from "./chunk-PRKEOD4X.js";
+} from "./chunk-NVHNBS53.js";
 import {
   require_dd_trace,
   require_js_yaml,
   require_module_details_from_path,
   require_p_limit,
   require_path_to_regexp
-} from "./chunk-OZIJLVZ3.js";
+} from "./chunk-KT3EIWY2.js";
 import {
   require_commonjs
-} from "./chunk-SH5H64FD.js";
+} from "./chunk-LJGZOL3F.js";
 import {
   require_dc_polyfill
-} from "./chunk-7OSMS4R5.js";
+} from "./chunk-7GFAYTXP.js";
 import {
   ATTR_SUPERBLOCKS_BASE_URL,
   ATTR_SUPERBLOCKS_CSB_ID,
@@ -54,10 +54,10 @@ import {
   SERVICE_NAME,
   getEnvironmentFromHostname,
   otlpBaseUrl
-} from "./chunk-2VUSN3WK.js";
+} from "./chunk-URLVIGGG.js";
 import {
   require_token_error
-} from "./chunk-C7PV3A6E.js";
+} from "./chunk-IQDORFUA.js";
 import {
   SpanKind,
   SpanStatusCode,
@@ -69,7 +69,7 @@ import {
   metrics,
   propagation,
   trace
-} from "./chunk-MXXEIC4T.js";
+} from "./chunk-M6VQ4H4Z.js";
 import {
   __commonJS,
   __esm,
@@ -78,7 +78,7 @@ import {
   __toCommonJS,
   __toESM,
   init_cjs_shims
-} from "./chunk-R6FSVLFU.js";
+} from "./chunk-CHGQBSTI.js";
 
 // ../../../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/internal/constants.js
 var require_constants2 = __commonJS({
@@ -43472,13 +43472,15 @@ var require_git2 = __commonJS({
     init_cjs_shims();
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.GIT_PERMISSION_ERROR_PATTERNS = exports.GIT_AUTH_ERROR_PATTERNS = void 0;
-    exports.isGitAuthErrorMessage = isGitAuthErrorMessage;
+    exports.isGitAuthErrorMessage = isGitAuthErrorMessage3;
     exports.isGitPermissionErrorMessage = isGitPermissionErrorMessage;
     exports.GIT_AUTH_ERROR_PATTERNS = [
       "authentication failed",
       "could not read username",
       "invalid credentials",
+      "invalid username or token",
       "bad credentials",
+      "password authentication is not supported",
       "401"
     ];
     exports.GIT_PERMISSION_ERROR_PATTERNS = [
@@ -43493,7 +43495,7 @@ var require_git2 = __commonJS({
       "does not have write access",
       '"contents" permission'
     ];
-    function isGitAuthErrorMessage(error40) {
+    function isGitAuthErrorMessage3(error40) {
       const message = error40 instanceof Error ? error40.message : String(error40 ?? "");
       const lower = message.toLowerCase();
       return exports.GIT_AUTH_ERROR_PATTERNS.some((pattern) => lower.includes(pattern));
@@ -70636,6 +70638,7 @@ var require_socketWithClientAuth = __commonJS({
     var util_js_1 = require_util2();
     var ISocketWithClientAuth3 = class extends tracedSocket_js_1.TracedSocket {
       authorization;
+      authorizationVersion = 0;
       hasSentAuth = false;
       constructor(ws2, authorization, requestHandlers, globalMiddlewares, tracer3, options8) {
         super(ws2, requestHandlers, globalMiddlewares, tracer3, options8);
@@ -70643,9 +70646,12 @@ var require_socketWithClientAuth = __commonJS({
       }
       // override `request` from the base class to send `authorization` when appropriate
       async request(method, params) {
+        const authorizationVersion = this.authorizationVersion;
         const authorization = this.hasSentAuth ? void 0 : this.authorization;
         const result = await super.request(method, params, authorization);
-        this.hasSentAuth = true;
+        if (this.authorizationVersion === authorizationVersion) {
+          this.hasSentAuth = true;
+        }
         return result;
       }
       /**
@@ -70656,6 +70662,7 @@ var require_socketWithClientAuth = __commonJS({
        */
       setAuthorization(newAuthorization) {
         this.authorization = newAuthorization;
+        this.authorizationVersion++;
         this.hasSentAuth = false;
       }
     };
@@ -78080,12 +78087,11 @@ var require_constants7 = __commonJS({
     "use strict";
     init_cjs_shims();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.ForbiddenError = exports.BadRequestError = exports.NotFoundError = exports.FileAccessError = exports.CUSTOM_COMPONENTS_PATH = exports.ROOT_CONFIG_RELATIVE_PATH = exports.DEV_ENVIRONMENT_CONFIG_PATH = exports.RESOURCE_CONFIG_PATH = exports.TOKEN_CONFIG_PATH = exports.SUPERBLOCKS_HOME_FOLDER_NAME = void 0;
+    exports.ForbiddenError = exports.BadRequestError = exports.NotFoundError = exports.FileAccessError = exports.CUSTOM_COMPONENTS_PATH = exports.DEV_ENVIRONMENT_CONFIG_PATH = exports.RESOURCE_CONFIG_PATH = exports.TOKEN_CONFIG_PATH = exports.SUPERBLOCKS_HOME_FOLDER_NAME = void 0;
     exports.SUPERBLOCKS_HOME_FOLDER_NAME = ".superblocks";
     exports.TOKEN_CONFIG_PATH = ".superblocks/auth.json";
     exports.RESOURCE_CONFIG_PATH = ".superblocks/superblocks.json";
     exports.DEV_ENVIRONMENT_CONFIG_PATH = ".superblocks/dev-environment.json";
-    exports.ROOT_CONFIG_RELATIVE_PATH = "../..";
     exports.CUSTOM_COMPONENTS_PATH = "components";
     var FileAccessError = class extends Error {
       constructor(message) {
@@ -86748,14 +86754,7 @@ var require_data_types = __commonJS({
     "use strict";
     init_cjs_shims();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.dataTypeDefinions = exports.supportedDataTypes = void 0;
-    exports.isValidDataType = isValidDataType;
-    exports.supportedDataTypes = [
-      "string",
-      "number",
-      "boolean",
-      "any"
-    ];
+    exports.dataTypeDefinions = void 0;
     exports.dataTypeDefinions = {
       string: {
         tsType: "string",
@@ -86774,9 +86773,6 @@ var require_data_types = __commonJS({
         prompt: "any (raw js expression)"
       }
     };
-    function isValidDataType(input) {
-      return Object.prototype.hasOwnProperty.call(exports.dataTypeDefinions, input);
-    }
   }
 });
 
@@ -97580,7 +97576,6 @@ var require_resource_configs = __commonJS({
     exports.getSuperblocksApplicationConfigIfExists = getSuperblocksApplicationConfigIfExists2;
     exports.getSuperblocksApplicationV2ConfigJson = getSuperblocksApplicationV2ConfigJson2;
     exports.getSuperblocksBackendConfigIfExists = getSuperblocksBackendConfigIfExists2;
-    exports.getSuperblocksBackendConfigJson = getSuperblocksBackendConfigJson;
     exports.getSuperblocksResourceConfigIfExists = getSuperblocksResourceConfigIfExists2;
     exports.getResourceIdFromUrl = getResourceIdFromUrl;
     var path_1 = __importDefault(__require("path"));
@@ -97783,20 +97778,17 @@ var require_types10 = __commonJS({
     "use strict";
     init_cjs_shims();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.WAIT_TYPE = exports.LoopType = void 0;
+    exports.LoopType = void 0;
     var LoopType;
     (function(LoopType2) {
-      LoopType2["FOR"] = "TYPE_FOR";
       LoopType2["FOR_EACH"] = "TYPE_FOREACH";
-      LoopType2["WHILE"] = "TYPE_WHILE";
-      LoopType2["UNSPECIFIED"] = "TYPE_UNSPECIFIED";
     })(LoopType || (exports.LoopType = LoopType = {}));
     var WAIT_TYPE;
     (function(WAIT_TYPE2) {
       WAIT_TYPE2["ALL"] = "WAIT_ALL";
       WAIT_TYPE2["ANY"] = "WAIT_NONE";
       WAIT_TYPE2["UNSPECIFIED"] = "WAIT_UNSPECIFIED";
-    })(WAIT_TYPE || (exports.WAIT_TYPE = WAIT_TYPE = {}));
+    })(WAIT_TYPE || (WAIT_TYPE = {}));
   }
 });
 
@@ -97810,15 +97802,15 @@ var require_api_files = __commonJS({
     exports.readAppApiYamlFile = readAppApiYamlFile4;
     exports.resolveLanguageSpecificStepContentFromBlocks = resolveLanguageSpecificStepContentFromBlocks2;
     async function writeApiFiles3(...args) {
-      const esmFunction = await import("./api-GRUZLVFH.js");
+      const esmFunction = await import("./api-4T55YEDE.js");
       return esmFunction.writeApiFiles(...args);
     }
     async function readAppApiYamlFile4(...args) {
-      const esmFunction = await import("./api-GRUZLVFH.js");
+      const esmFunction = await import("./api-4T55YEDE.js");
       return esmFunction.readAppApiYamlFile(...args);
     }
     async function resolveLanguageSpecificStepContentFromBlocks2(...args) {
-      const esmFunction = await import("./api-GRUZLVFH.js");
+      const esmFunction = await import("./api-4T55YEDE.js");
       return esmFunction.resolveLanguageSpecificStepContentFromBlocks(...args);
     }
   }
@@ -104506,19 +104498,19 @@ var require_getMachineId = __commonJS({
       if (!getMachineIdImpl) {
         switch (process5.platform) {
           case "darwin":
-            getMachineIdImpl = (await import("./getMachineId-darwin-GWGWAYUL.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-darwin-S365CT4C.js")).getMachineId;
             break;
           case "linux":
-            getMachineIdImpl = (await import("./getMachineId-linux-EX6OHUV7.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-linux-WWEC3Y6J.js")).getMachineId;
             break;
           case "freebsd":
-            getMachineIdImpl = (await import("./getMachineId-bsd-D3Z6NAGQ.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-bsd-R7FUZCBS.js")).getMachineId;
             break;
           case "win32":
-            getMachineIdImpl = (await import("./getMachineId-win-P2APSGTL.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-win-35IZOALZ.js")).getMachineId;
             break;
           default:
-            getMachineIdImpl = (await import("./getMachineId-unsupported-G3KKCZOP.js")).getMachineId;
+            getMachineIdImpl = (await import("./getMachineId-unsupported-WZBZKWFL.js")).getMachineId;
             break;
         }
       }
@@ -115863,9 +115855,9 @@ var require_error2 = __commonJS({
     "use strict";
     init_cjs_shims();
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.getErrorMessage = getErrorMessage3;
+    exports.getErrorMessage = getErrorMessage4;
     exports.getErrorCode = getErrorCode;
-    function getErrorMessage3(error40) {
+    function getErrorMessage4(error40) {
       if (error40 instanceof Error) {
         return error40.message;
       } else {
@@ -165148,7 +165140,7 @@ var require_dist4 = __commonJS({
       TooManyEmbeddingValuesForCallError: () => TooManyEmbeddingValuesForCallError3,
       TypeValidationError: () => TypeValidationError3,
       UnsupportedFunctionalityError: () => UnsupportedFunctionalityError3,
-      getErrorMessage: () => getErrorMessage3,
+      getErrorMessage: () => getErrorMessage4,
       isJSONArray: () => isJSONArray,
       isJSONObject: () => isJSONObject,
       isJSONValue: () => isJSONValue
@@ -165240,7 +165232,7 @@ var require_dist4 = __commonJS({
         return AISDKError3.hasMarker(error40, marker32);
       }
     };
-    function getErrorMessage3(error40) {
+    function getErrorMessage4(error40) {
       if (error40 == null) {
         return "unknown error";
       }
@@ -165318,7 +165310,7 @@ var require_dist4 = __commonJS({
         super({
           name: name62,
           message: `JSON parsing failed: Text: ${text3}.
-Error message: ${getErrorMessage3(cause)}`,
+Error message: ${getErrorMessage4(cause)}`,
           cause
         });
         this[_a72] = true;
@@ -165447,7 +165439,7 @@ Error message: ${getErrorMessage3(cause)}`,
         super({
           name: name122,
           message: `${contextPrefix}: Value: ${JSON.stringify(value2)}.
-Error message: ${getErrorMessage3(cause)}`,
+Error message: ${getErrorMessage4(cause)}`,
           cause
         });
         this[_a132] = true;
@@ -183164,7 +183156,7 @@ var require_dist6 = __commonJS({
       executeTool: () => executeTool,
       extractResponseHeaders: () => extractResponseHeaders2,
       generateId: () => generateId3,
-      getErrorMessage: () => getErrorMessage3,
+      getErrorMessage: () => getErrorMessage4,
       getFromApi: () => getFromApi,
       getRuntimeEnvironmentUserAgent: () => getRuntimeEnvironmentUserAgent2,
       injectJsonInstructionIntoMessages: () => injectJsonInstructionIntoMessages,
@@ -183515,7 +183507,7 @@ var require_dist6 = __commonJS({
       return () => `${prefix}${separator}${generator()}`;
     };
     var generateId3 = createIdGenerator3();
-    function getErrorMessage3(error40) {
+    function getErrorMessage4(error40) {
       if (error40 == null) {
         return "unknown error";
       }
@@ -185721,8 +185713,8 @@ var require_get_vercel_oidc_token = __commonJS({
       }
       try {
         const [{ getTokenPayload, isExpired }, { refreshToken }] = await Promise.all([
-          await import("./token-util-KYTRKMAC.js"),
-          await import("./token-7SZNVNTK.js")
+          await import("./token-util-J6V5LCAN.js"),
+          await import("./token-DWAZ4JCJ.js")
         ]);
         if (!token2 || isExpired(getTokenPayload(token2))) {
           await refreshToken();
@@ -187377,7 +187369,7 @@ var require_dist9 = __commonJS({
         smoothStream: () => smoothStream2,
         stepCountIs: () => stepCountIs2,
         streamObject: () => streamObject,
-        streamText: () => streamText3,
+        streamText: () => streamText2,
         systemModelMessageSchema: () => systemModelMessageSchema,
         tool: () => import_provider_utils39.tool,
         toolModelMessageSchema: () => toolModelMessageSchema,
@@ -193306,7 +193298,7 @@ Learn more: \x1B[34m${moreInfoURL}\x1B[0m
         prefix: "aitxt",
         size: 24
       });
-      function streamText3({
+      function streamText2({
         model,
         tools,
         toolChoice,
@@ -195096,7 +195088,7 @@ Learn more: \x1B[34m${moreInfoURL}\x1B[0m
           onFinish,
           ...options8
         }) {
-          return streamText3({
+          return streamText2({
             ...await this.prepareCall(options8),
             abortSignal,
             timeout,
@@ -470482,7 +470474,7 @@ var require_config_loader = __commonJS({
        * @returns {Promise<{createJiti: Function|undefined, version: string;}>} A promise that fulfills with an object containing the jiti module's createJiti function and version.
        */
       static async loadJiti() {
-        const { createJiti } = await import("./jiti-DGIIEVSP.js");
+        const { createJiti } = await import("./jiti-ETYPYHSK.js");
         const version3 = require_package5().version;
         return { createJiti, version: version3 };
       }
@@ -470811,7 +470803,7 @@ var require_eslint_helpers = __commonJS({
     }
     async function globMatch({ basePath, pattern }) {
       let found = false;
-      const { hfs } = await import("./src-GNBOXZZ5.js");
+      const { hfs } = await import("./src-FHUWJFLE.js");
       const patternToUse = normalizeToPosix(path80.relative(basePath, pattern));
       const matcher = new Minimatch2(patternToUse, MINIMATCH_OPTIONS);
       const walkSettings = {
@@ -470851,7 +470843,7 @@ var require_eslint_helpers = __commonJS({
         return new Minimatch2(patternToUse, MINIMATCH_OPTIONS);
       });
       const unmatchedPatterns = /* @__PURE__ */ new Set([...relativeToPatterns.keys()]);
-      const { hfs } = await import("./src-GNBOXZZ5.js");
+      const { hfs } = await import("./src-FHUWJFLE.js");
       const walk2 = hfs.walk(basePath, {
         async directoryFilter(entry) {
           if (!matchers.some((matcher) => matcher.match(entry.path, true))) {
@@ -486353,7 +486345,7 @@ var require_utils34 = __commonJS({
       overflowChannel.set(obj, maxIndex);
       return obj;
     };
-    var isOverflow2 = function isOverflow3(obj) {
+    var isOverflow = function isOverflow2(obj) {
       return overflowChannel.has(obj);
     };
     var getMaxIndex = function getMaxIndex2(obj) {
@@ -486405,7 +486397,7 @@ var require_utils34 = __commonJS({
           }
           target[nextIndex2] = source2;
         } else if (target && typeof target === "object") {
-          if (isOverflow2(target)) {
+          if (isOverflow(target)) {
             var newIndex = getMaxIndex(target) + 1;
             target[newIndex] = source2;
             setMaxIndex(target, newIndex);
@@ -486420,7 +486412,7 @@ var require_utils34 = __commonJS({
         return target;
       }
       if (!target || typeof target !== "object") {
-        if (isOverflow2(source2)) {
+        if (isOverflow(source2)) {
           var sourceKeys = Object.keys(source2);
           var result = options8 && options8.plainObjects ? { __proto__: null, 0: target } : { 0: target };
           for (var m2 = 0; m2 < sourceKeys.length; m2++) {
@@ -486461,10 +486453,10 @@ var require_utils34 = __commonJS({
         } else {
           acc[key2] = value2;
         }
-        if (isOverflow2(source2) && !isOverflow2(acc)) {
+        if (isOverflow(source2) && !isOverflow(acc)) {
           markOverflow(acc, getMaxIndex(source2));
         }
-        if (isOverflow2(acc)) {
+        if (isOverflow(acc)) {
           var keyNum = parseInt(key2, 10);
           if (String(keyNum) === key2 && keyNum >= 0 && keyNum > getMaxIndex(acc)) {
             setMaxIndex(acc, keyNum);
@@ -486565,7 +486557,7 @@ var require_utils34 = __commonJS({
       return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));
     };
     var combine = function combine2(a, b3, arrayLimit, plainObjects) {
-      if (isOverflow2(a)) {
+      if (isOverflow(a)) {
         var newIndex = getMaxIndex(a) + 1;
         a[newIndex] = b3;
         setMaxIndex(a, newIndex);
@@ -486595,7 +486587,7 @@ var require_utils34 = __commonJS({
       decode,
       encode: encode3,
       isBuffer: isBuffer2,
-      isOverflow: isOverflow2,
+      isOverflow,
       isRegExp: isRegExp2,
       markOverflow,
       maybeMap,
@@ -531355,7 +531347,7 @@ var require_finalhandler = __commonJS({
           } else {
             headers = getErrorHeaders(err);
           }
-          msg = getErrorMessage3(err, status, env2);
+          msg = getErrorMessage4(err, status, env2);
         } else {
           status = 404;
           msg = "Cannot " + req.method + " " + encodeUrl(getResourceName(req));
@@ -531386,7 +531378,7 @@ var require_finalhandler = __commonJS({
       }
       return headers;
     }
-    function getErrorMessage3(err, status, env2) {
+    function getErrorMessage4(err, status, env2) {
       var msg;
       if (env2 !== "production") {
         msg = err.stack;
@@ -539260,7 +539252,7 @@ init_cjs_shims();
 // ../sdk/package.json
 var package_default = {
   name: "@superblocksteam/sdk",
-  version: "2.0.141-next.0",
+  version: "2.0.141-next.1",
   description: "Superblocks JS SDK",
   homepage: "https://www.superblocks.com",
   license: "Superblocks Community Software License",
@@ -539617,7 +539609,7 @@ var config = void 0;
 var configured = false;
 var ddTracePromise = void 0;
 async function getDdTrace() {
-  ddTracePromise ??= import("./dd-trace-OPBAOO5R.js").then((module) => module.default);
+  ddTracePromise ??= import("./dd-trace-D7QUBO7I.js").then((module) => module.default);
   return await ddTracePromise;
 }
 var deploymentType = (() => {
@@ -544103,7 +544095,7 @@ import path65 from "node:path";
 var import_fast_glob3 = __toESM(require_out4(), 1);
 var import_fs_extra2 = __toESM(require_lib(), 1);
 var import_yaml13 = __toESM(require_dist(), 1);
-var import_shared79 = __toESM(require_dist2(), 1);
+var import_shared80 = __toESM(require_dist2(), 1);
 var import_util42 = __toESM(require_dist3(), 1);
 import { createLogger as createLogger3 } from "vite";
 
@@ -544113,7 +544105,7 @@ init_cjs_shims();
 // ../../../vite-plugin-file-sync/dist/ai-service/index.js
 init_cjs_shims();
 init_esm();
-var import_ai11 = __toESM(require_dist9(), 1);
+var import_ai10 = __toESM(require_dist9());
 import { createHash as createHash5, randomUUID as randomUUID5 } from "node:crypto";
 import os6 from "node:os";
 import path52 from "node:path";
@@ -548212,6 +548204,7 @@ var MODEL_CAPABILITIES = {
   "claude-opus-4-5": { maxOutputTokens: 64e3 },
   "claude-opus-4-6": { maxOutputTokens: 128e3 },
   "claude-opus-4-7": { maxOutputTokens: 128e3 },
+  "claude-opus-4-8": { maxOutputTokens: 128e3 },
   "claude-sonnet-4-5": { maxOutputTokens: 64e3 },
   "claude-sonnet-4-6": { maxOutputTokens: 128e3 }
 };
@@ -548448,6 +548441,24 @@ var AiToolExecutionErrorCode;
   AiToolExecutionErrorCode2["INTERNAL_ERROR"] = "tool_internal_error";
 })(AiToolExecutionErrorCode || (AiToolExecutionErrorCode = {}));
 
+// ../../../library-shared/dist/types/tool-permission-response.js
+init_cjs_shims();
+var TOOL_PERMISSION_APPROVAL_PHRASES = [
+  "ok",
+  "sure",
+  "ya",
+  "yah",
+  "yes",
+  "yep",
+  "yup"
+];
+function isToolPermissionApprovalText(text3) {
+  return TOOL_PERMISSION_APPROVAL_PHRASES.includes(text3.trim().toLowerCase());
+}
+function isToolPermissionClarification(approved, denyMessage) {
+  return !approved && Boolean(denyMessage?.trim()) && !isToolPermissionApprovalText(denyMessage);
+}
+
 // ../../../library-shared/dist/types/apis.js
 init_cjs_shims();
 
@@ -548552,7 +548563,7 @@ init_cjs_shims();
 init_cjs_shims();
 
 // ../../../vite-plugin-file-sync/dist/ai-service/index.js
-var import_shared54 = __toESM(require_dist2(), 1);
+var import_shared55 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/migration/translation-prompt.js
 init_cjs_shims();
@@ -563563,7 +563574,7 @@ function createClark(options8 = {
 // ../../../clark/dist/thinking-options.js
 init_cjs_shims();
 var INTERLEAVED_THINKING_BETA = "interleaved-thinking-2025-05-14";
-var ADAPTIVE_EFFORT_MODELS = /* @__PURE__ */ new Set(["claude-opus-4-7"]);
+var ADAPTIVE_EFFORT_MODELS = /* @__PURE__ */ new Set(["claude-opus-4-7", "claude-opus-4-8"]);
 var HARDCODED_EFFORT = "high";
 function usesAdaptiveEffort(coreModel) {
   return coreModel !== void 0 && ADAPTIVE_EFFORT_MODELS.has(coreModel);
@@ -564962,6 +564973,60 @@ var getEnclosingApiExportName = (path80) => {
   }
   return void 0;
 };
+var topLevelApiExportName = (node) => {
+  if (t.isExportNamedDeclaration(node) && node.declaration && t.isVariableDeclaration(node.declaration)) {
+    for (const declarator of node.declaration.declarations) {
+      if (t.isIdentifier(declarator.id) && t.isCallExpression(declarator.init) && t.isIdentifier(declarator.init.callee) && declarator.init.callee.name === "api") {
+        return declarator.id.name;
+      }
+    }
+  }
+  if (t.isExportDefaultDeclaration(node) && t.isCallExpression(node.declaration) && t.isIdentifier(node.declaration.callee) && node.declaration.callee.name === "api") {
+    return "default";
+  }
+  return void 0;
+};
+var extractApiExportSources = (source2) => {
+  let ast;
+  try {
+    ast = (0, import_parser2.parse)(source2, {
+      sourceType: "module",
+      plugins: ["typescript"],
+      errorRecovery: true
+    });
+  } catch {
+    return null;
+  }
+  const exportSources = /* @__PURE__ */ new Map();
+  const sharedNodes = [];
+  for (const node of ast.program.body) {
+    const exportName = topLevelApiExportName(node);
+    if (exportName) {
+      exportSources.set(exportName, generate(node).code);
+    } else {
+      sharedNodes.push(node);
+    }
+  }
+  const sharedSource = sharedNodes.map((node) => generate(node).code).join("\n");
+  return { exportSources, sharedSource };
+};
+var detectChangedApiExports = (previousSource, nextSource) => {
+  const previous = extractApiExportSources(previousSource);
+  const next2 = extractApiExportSources(nextSource);
+  if (!previous || !next2) {
+    return { changedExportNames: /* @__PURE__ */ new Set(), canScope: false };
+  }
+  if (previous.sharedSource !== next2.sharedSource) {
+    return { changedExportNames: /* @__PURE__ */ new Set(), canScope: false };
+  }
+  const changedExportNames = /* @__PURE__ */ new Set();
+  for (const [exportName, code] of next2.exportSources) {
+    if (previous.exportSources.get(exportName) !== code) {
+      changedExportNames.add(exportName);
+    }
+  }
+  return { changedExportNames, canScope: true };
+};
 var extractMutations = (source2, exportName) => {
   const mutations = [];
   const jsStepNames = extractStepNames(source2);
@@ -565696,7 +565761,7 @@ var MAX_ATTRIBUTE_LENGTH = 64e3;
 var LLMObsSpanWriter = null;
 async function loadLLMObsSpanWriter() {
   if (!LLMObsSpanWriter) {
-    const module = await import("./spans-DHM7DAAH.js");
+    const module = await import("./spans-DJ6DK2RF.js");
     LLMObsSpanWriter = module.default;
   }
   return LLMObsSpanWriter;
@@ -574798,6 +574863,16 @@ var RESOLUTION_EXTENSIONS = [".ts", ".tsx", ".js"];
 async function parseSdkRegistryEntryPoints(registryContent, pathExists6) {
   return parseSdkRegistryFromContent(registryContent, (importPath) => resolveImportPath(importPath, pathExists6));
 }
+async function parseSdkRegistryExportNames(registryContent, pathExists6) {
+  const entries = await parseSdkRegistryEntries(registryContent, (importPath) => resolveImportPath(importPath, pathExists6));
+  const exportNames = /* @__PURE__ */ new Map();
+  for (const [apiName, entry] of entries) {
+    if (entry.exportName) {
+      exportNames.set(apiName, entry.exportName);
+    }
+  }
+  return exportNames;
+}
 async function readSdkRegistryEntryPoints(fs39) {
   try {
     if (!await fs39.pathExists(SDK_REGISTRY_PATH)) {
@@ -574862,10 +574937,14 @@ async function ensureRegistryCache(clark, services) {
   } catch {
   }
   const entryPoints = await parseSdkRegistryEntryPoints(content18, pathExists6);
-  clark.updateContext({ sdkApiRegistryEntryPoints: entryPoints });
+  const exportNames = await parseSdkRegistryExportNames(content18, pathExists6);
+  clark.updateContext({
+    sdkApiRegistryEntryPoints: entryPoints,
+    sdkApiRegistryExportNames: exportNames
+  });
   return entryPoints;
 }
-async function markSdkApiAsUntestedIfNeeded(filePath, clark, services) {
+async function markSdkApiAsUntestedIfNeeded(filePath, clark, services, editContents) {
   if (!services.features?.sdkApiEnabled) {
     return;
   }
@@ -574883,7 +574962,11 @@ async function markSdkApiAsUntestedIfNeeded(filePath, clark, services) {
     } catch {
     }
     const newEntryPoints = await parseSdkRegistryEntryPoints(newContent, pathExists6);
-    clark.updateContext({ sdkApiRegistryEntryPoints: newEntryPoints });
+    const newExportNames = await parseSdkRegistryExportNames(newContent, pathExists6);
+    clark.updateContext({
+      sdkApiRegistryEntryPoints: newEntryPoints,
+      sdkApiRegistryExportNames: newExportNames
+    });
     const apiNamesToMark = Array.from(newEntryPoints.entries()).filter(([name16, ep]) => previousEntryPoints.get(name16) !== ep).map(([name16]) => name16);
     const apiNamesToRemove = Array.from(previousEntryPoints.keys()).filter((name16) => !newEntryPoints.has(name16));
     removeApis(clark, apiNamesToRemove);
@@ -574895,12 +574978,13 @@ async function markSdkApiAsUntestedIfNeeded(filePath, clark, services) {
   }
   const directlyAffected = Array.from(previousEntryPoints.entries()).filter(([, ep]) => ep === filePath).map(([name16]) => name16);
   if (directlyAffected.length > 0) {
-    markApis(clark, directlyAffected);
+    const scoped = scopeToChangedApis(directlyAffected, clark.context.sdkApiRegistryExportNames, editContents);
+    markApis(clark, scoped.apiNames, { forceRetest: scoped.forceRetest });
     return;
   }
   const scopedApis = Array.from(previousEntryPoints.entries()).filter(([, ep]) => filePath.startsWith(entryPointScope(ep))).map(([name16]) => name16);
   if (scopedApis.length > 0) {
-    markApis(clark, scopedApis);
+    markApis(clark, scopedApis, { forceRetest: true });
   }
 }
 function entryPointScope(entryPoint) {
@@ -574910,6 +574994,23 @@ function entryPointScope(entryPoint) {
   }
   return withoutExt + "/";
 }
+function scopeToChangedApis(apiNames, exportNames, editContents) {
+  if (!editContents || !exportNames) {
+    return { apiNames, forceRetest: true };
+  }
+  const { changedExportNames, canScope } = detectChangedApiExports(editContents.previous, editContents.next);
+  if (!canScope) {
+    return { apiNames, forceRetest: true };
+  }
+  if (apiNames.some((apiName) => !exportNames.get(apiName))) {
+    return { apiNames, forceRetest: true };
+  }
+  return {
+    apiNames: apiNames.filter((apiName) => changedExportNames.has(exportNames.get(apiName))),
+    // Attributed changes must retest even if the API already passed.
+    forceRetest: true
+  };
+}
 function markApis(clark, apiNames, options8) {
   if (apiNames.length === 0) {
     return;
@@ -574924,7 +575025,7 @@ function markApis(clark, apiNames, options8) {
         denied.delete(apiName);
       } else if (denied.has(apiName)) {
         continue;
-      } else if (passed.has(apiName)) {
+      } else if (!options8?.forceRetest && passed.has(apiName)) {
         continue;
       }
       untested.add(apiName);
@@ -596816,9 +596917,11 @@ function selectContextManagementStrategy(options8) {
       }
     };
   }
+  const { model, providerConfig } = options8.summarizeModel();
   return {
     type: "client",
-    summarizationModel: options8.summarizationModel()
+    summarizationModel: model,
+    summarizationProviderConfig: providerConfig
   };
 }
 var BEDROCK_CONTEXT_MANAGEMENT_BETAS = [
@@ -596933,14 +597036,6 @@ function getTotalInputTokens(usage) {
 function computeContextUsed(usage) {
   return getTotalInputTokens(usage);
 }
-function getTotalTokens(usage) {
-  const recomputedTotal = getTotalInputTokens(usage) + (usage.outputTokens ?? 0);
-  const hasDetailedBreakdown = usage.inputTokenDetails?.noCacheTokens !== void 0 || usage.inputTokenDetails?.cacheReadTokens !== void 0 || usage.inputTokenDetails?.cacheWriteTokens !== void 0;
-  if (hasDetailedBreakdown) {
-    return recomputedTotal;
-  }
-  return usage.totalTokens ?? recomputedTotal;
-}
 
 // ../../../vite-plugin-file-sync/dist/ai-service/util/llm-config-utils.js
 init_cjs_shims();
@@ -597664,6 +597759,9 @@ var Clark = class _Clark extends TracedFSM {
         // markSdkApiAsUntestedIfNeeded can diff against the previous state
         // instead of treating every API as newly added.
         sdkApiRegistryEntryPoints: ctx.sdkApiRegistryEntryPoints,
+        // ENG-4547: preserve the cached export names so that edited-file diffs
+        // can be attributed to the correct API across resets.
+        sdkApiRegistryExportNames: ctx.sdkApiRegistryExportNames,
         // APPS-4080: preserve credit-paywall pause state across resets so
         // the resume hint can fire on the next user prompt. Without this,
         // the mid-stream paywall path (LLM_ERRORED -> AGENT_CANCELED ->
@@ -597776,7 +597874,7 @@ var Clark = class _Clark extends TracedFSM {
     const model = providedModel ?? services.llmProvider.modelForTask("generateBroadEdit").model;
     const contextManagement = selectContextManagementStrategy({
       serverContextManagementEnabled: this.context.llmConfig?.serverContextManagement?.enabled,
-      summarizationModel: () => services.llmProvider.modelForTask("summarizeMessages").model
+      summarizeModel: () => services.llmProvider.modelForTask("summarizeMessages")
     });
     const { thinkingEnabled, thinkingBudgetTokens, interleavedThinking, maxOutputTokens, headers, providerOptions } = processLLMConfig(this.context.llmConfig, void 0, void 0, contextManagement);
     const thinking = streamOptions.thinking ?? {
@@ -600300,6 +600398,11 @@ var buildWriteFileToolFactory = createToolFactory("build_writeFile", ({ clark, s
       content: zod_default.string().describe("Content to write to the file")
     }),
     execute: async ({ filePath, content: content18 }) => {
+      let previousContent = "";
+      try {
+        previousContent = await services.appShell.readFile(filePath);
+      } catch {
+      }
       await services.appShell.writeFile(filePath, content18);
       debugCache.invalidateTypeScript();
       clark.updateContext({
@@ -600308,7 +600411,10 @@ var buildWriteFileToolFactory = createToolFactory("build_writeFile", ({ clark, s
       });
       debugCache.invalidateContextErrors();
       try {
-        await markSdkApiAsUntestedIfNeeded(filePath, clark, services);
+        await markSdkApiAsUntestedIfNeeded(filePath, clark, services, {
+          previous: previousContent,
+          next: content18
+        });
       } catch {
       }
       const typeCheckFunction = createTypeScriptCheckFunction(services.appShell, clark.context.abortController?.signal);
@@ -601136,7 +601242,10 @@ var buildEditFileToolFactory = createToolFactory("build_editFile", ({ clark, ser
         });
         debugCache.invalidateContextErrors();
         try {
-          await markSdkApiAsUntestedIfNeeded(filePath, clark, services);
+          await markSdkApiAsUntestedIfNeeded(filePath, clark, services, {
+            previous: contentOld,
+            next: contentNew
+          });
         } catch {
         }
         const typeCheckFunction2 = createTypeScriptCheckFunction(services.appShell, clark.context.abortController?.signal);
@@ -601171,7 +601280,10 @@ var buildEditFileToolFactory = createToolFactory("build_editFile", ({ clark, ser
       });
       debugCache.invalidateContextErrors();
       try {
-        await markSdkApiAsUntestedIfNeeded(filePath, clark, services);
+        await markSdkApiAsUntestedIfNeeded(filePath, clark, services, {
+          previous: contentOld,
+          next: contentNew
+        });
       } catch {
       }
       const typeCheckFunction = createTypeScriptCheckFunction(services.appShell, clark.context.abortController?.signal);
@@ -601343,7 +601455,10 @@ var buildMultiEditFileToolFactory = createToolFactory("build_multiEditFile", ({
       });
       debugCache.invalidateContextErrors();
       try {
-        await markSdkApiAsUntestedIfNeeded(filePath, clark, services);
+        await markSdkApiAsUntestedIfNeeded(filePath, clark, services, {
+          previous: contentOriginal,
+          next: contentCurrent
+        });
       } catch {
       }
       const typeCheckFunction = createTypeScriptCheckFunction(services.appShell, clark.context.abortController?.signal);
@@ -609454,7 +609569,7 @@ function isTaskAccessibleTo(task, callerUserId) {
 // ../../../vite-plugin-file-sync/dist/ai-service/agent/tools2/tools/check-task.js
 var checkTaskToolFactory = createToolFactory("checkTask", ({ services }) => {
   return {
-    description: "PREFERRED way to inspect a background task. Returns the current state of the task by id INSTANTLY (no waiting). Use this whenever you started a background task earlier and want to know whether it's done before relying on its result \u2014 including the very next step where you need the result. If state='completed', the result is included. If state='running', keep doing other useful work and call checkTask again later. Use `waitForTask` ONLY when you've exhausted other useful work and are blocked.",
+    description: "PREFERRED way to inspect a background task. Returns the current state of the task by id INSTANTLY (no waiting). Use this whenever you started a background task earlier and want to know whether it's done before relying on its result \u2014 including the very next step where you need the result. If state='completed', the result is included. If state='running', keep doing other useful work and call checkTask again later. Use `waitForTask` ONLY when you've exhausted other useful work and are blocked. If the result includes an integrationId, use it only for tool inputs or generated source code; do not repeat internal UUIDs in user-facing chat.",
     category: ToolCategory.GENERAL,
     defaultPermission: PermissionLevel.ALLOW,
     readOnly: true,
@@ -609469,10 +609584,9 @@ var checkTaskToolFactory = createToolFactory("checkTask", ({ services }) => {
       if (!isTaskAccessibleTo(task, services.getCurrentOwnerId?.())) {
         throw new Error(`unknown task: ${taskId}`);
       }
-      const summary = services.taskStore.summarize(task);
       return {
-        ...summary,
-        result: task.state === "completed" ? task.result : void 0
+        ...services.taskStore.summarize(task),
+        result: task.state === "completed" && task.result !== void 0 ? task.result : void 0
       };
     }
   };
@@ -609709,7 +609823,7 @@ function isTimeoutOrAbortError(err) {
 }
 var waitForTaskToolFactory = createToolFactory("waitForTask", ({ services }) => {
   return {
-    description: "LAST RESORT for background tasks. BLOCKS your current turn until the task leaves running or the timeout fires, defeating the whole point of running it in the background. Prefer `checkTask` (instant, non-blocking) and do other useful work in between. ONLY call waitForTask when (a) checkTask reports state='running', (b) you literally cannot make progress without the task's result, AND (c) there is no other useful work left to do this turn. On timeout, returns the latest running snapshot with `timedOut: true`.",
+    description: "LAST RESORT for background tasks. BLOCKS your current turn until the task leaves running or the timeout fires, defeating the whole point of running it in the background. Prefer `checkTask` (instant, non-blocking) and do other useful work in between. ONLY call waitForTask when (a) checkTask reports state='running', (b) you literally cannot make progress without the task's result, AND (c) there is no other useful work left to do this turn. On timeout, returns the latest running snapshot with `timedOut: true`. If the result includes an integrationId, use it only for tool inputs or generated source code; do not repeat internal UUIDs in user-facing chat.",
     category: ToolCategory.GENERAL,
     defaultPermission: PermissionLevel.ALLOW,
     readOnly: true,
@@ -609734,10 +609848,12 @@ var waitForTaskToolFactory = createToolFactory("waitForTask", ({ services }) =>
       }
       try {
         const terminal = await services.taskStore.waitFor(taskId, timeoutMs, options8.abortSignal);
-        const snapshot = services.taskStore.summarize(services.taskStore.get(taskId));
+        const task2 = services.taskStore.get(taskId);
+        const snapshot = services.taskStore.summarize(task2);
+        const terminalResult = terminal.result;
         return {
           ...snapshot,
-          result: terminal.state === "completed" ? terminal.result : void 0,
+          result: terminal.state === "completed" && terminalResult !== void 0 ? terminalResult : void 0,
           timedOut: false
         };
       } catch (err) {
@@ -610600,7 +610716,7 @@ var provisionDevDatabaseTaskMetadata = {
   // dev environment name are platform-controlled, so they're not in the
   // input. BG wrapping (taskId, don't waitForTask, check first) is the
   // only behavioral delta from master.
-  description: "Create or reuse a lifecycle-managed dev database binding for this application on Amazon RDS as a BACKGROUND TASK. Clark provisions the database and returns lifecycle progress. Returns a taskId IMMEDIATELY while RDS provisioning runs in the background; the user already sees live progress in the chat's background-tasks indicator. DO NOT call waitForTask right after this \u2014 that defeats the whole point of a background task and blocks your turn for minutes while RDS spins up. Instead: keep working on whatever does NOT depend on the database (scaffold the UI, draft API code that will use the binding, write or read SQL migration files, plan next steps). When you reach a step that genuinely cannot proceed without the connection details, FIRST call checkTask({ taskId }) \u2014 it returns instantly. Only fall back to waitForTask if checkTask still reports state='running' AND you literally have no other useful work to do. On completion the result includes bindingKey, lifecycleState, integrationId, connectionMetadata, and credentialRefs. This task ONLY creates the database server + an integration; it does NOT apply SQL migrations \u2014 query attempts will fail with `relation \"X\" does not exist` until you call startApplyDevDatabaseMigrations. Cancellation only stops local polling; the underlying RDS provisioning continues on the server.",
+  description: "Create or reuse a lifecycle-managed dev database binding for this application on Amazon RDS as a BACKGROUND TASK. Clark provisions the database and returns lifecycle progress. Returns a taskId IMMEDIATELY while RDS provisioning runs in the background; the user already sees live progress in the chat's background-tasks indicator. DO NOT call waitForTask right after this \u2014 that defeats the whole point of a background task and blocks your turn for minutes while RDS spins up. Instead: keep working on whatever does NOT depend on the database (scaffold the UI, draft API code that will use the binding, write or read SQL migration files, plan next steps). When you reach a step that genuinely cannot proceed without the connection details, FIRST call checkTask({ taskId }) \u2014 it returns instantly. Only fall back to waitForTask if checkTask still reports state='running' AND you literally have no other useful work to do. On completion the result includes bindingKey, integrationId, lifecycleState, connectionMetadata, and credentialRefs. Use integrationId only for tool inputs or generated source code such as postgres(...); do not repeat internal UUIDs in user-facing chat. This task ONLY creates the database server + an integration; it does NOT apply SQL migrations \u2014 query attempts will fail with `relation \"X\" does not exist` until you call startApplyDevDatabaseMigrations. Cancellation only stops local polling; the underlying RDS provisioning continues on the server.",
   externalHandleSchema: provisionHandleSchema,
   inputSchema: provisionInputSchema,
   name: "provisionDatabase",
@@ -626481,7 +626597,7 @@ Read existing knowledge before drafting new entries, and avoid duplicates unless
 
 // ../../../vite-plugin-file-sync/dist/ai-service/agent/tools2/tools/git.js
 init_cjs_shims();
-var import_shared41 = __toESM(require_dist2());
+var import_shared42 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/git-operation-lock.js
 init_cjs_shims();
@@ -631561,6 +631677,7 @@ init_git_response_error();
 var simpleGit = gitInstanceFactory;
 
 // ../../../vite-plugin-file-sync/dist/git-service/index.js
+var import_shared41 = __toESM(require_dist2(), 1);
 function createGitService(cwd) {
   const git = simpleGit(cwd, {
     unsafe: { allowUnsafeCredentialHelper: true }
@@ -631691,7 +631808,7 @@ function createGitService(cwd) {
 function classifyGitError(error40) {
   const message = extractMessage(error40);
   const lower = message.toLowerCase();
-  if (lower.includes("authentication failed") || lower.includes("could not read username") || lower.includes("invalid credentials")) {
+  if ((0, import_shared41.isGitAuthErrorMessage)(message)) {
     getLogger3().warn("[git] auth failure classified", {
       gitCategory: "setup",
       gitOperation: "classify-error",
@@ -631826,13 +631943,13 @@ var gitInputSchema = external_exports.object({
     }
   }
 });
-var REMOTE_LIVE_BRANCH = `origin/${import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH}`;
-var GIT_DESCRIPTION = `Run a git operation in the repository. All work happens on the ${import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH} branch. Use status for working tree and sync state; log for recent commits on ${import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH}; log_from_main to fetch and list commits on the default branch (origin/main) \u2014 use this to get commit SHAs for deploy; diff for changes (unstaged or staged); stage to stage paths; commit to stage all, commit with a message, and push to ${REMOTE_LIVE_BRANCH}; merge_abort to abort an in-progress merge; pull to fetch and merge ${REMOTE_LIVE_BRANCH} and sync; create_pr to generate a GitHub "new pull request" URL \u2014 always show the returned prUrl as a clickable markdown link so the user can open it (provide title and body you generate from the session context); deploy to build and deploy a specific commit from the main/default branch (requires the full SHA from log_from_main \u2014 the SHA MUST be a commit directly on main, not a commit from a feature branch; always use log_from_main first to get the correct SHA). If commit reports pushed=false with a non-fast-forward error, use pull to merge remote changes (resolving any conflicts), then commit again.`;
+var REMOTE_LIVE_BRANCH = `origin/${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}`;
+var GIT_DESCRIPTION = `Run a git operation in the repository. All work happens on the ${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH} branch. Use status for working tree and sync state; log for recent commits on ${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}; log_from_main to fetch and list commits on the default branch (origin/main) \u2014 use this to get commit SHAs for deploy; diff for changes (unstaged or staged); stage to stage paths; commit to stage all, commit with a message, and push to ${REMOTE_LIVE_BRANCH}; merge_abort to abort an in-progress merge; pull to fetch and merge ${REMOTE_LIVE_BRANCH} and sync; create_pr to generate a GitHub "new pull request" URL \u2014 always show the returned prUrl as a clickable markdown link so the user can open it (provide title and body you generate from the session context); deploy to build and deploy a specific commit from the main/default branch (requires the full SHA from log_from_main \u2014 the SHA MUST be a commit directly on main, not a commit from a feature branch; always use log_from_main first to get the correct SHA). If commit reports pushed=false with a non-fast-forward error, use pull to merge remote changes (resolving any conflicts), then commit again.`;
 function getGitToolInputFields(input) {
   switch (input.operation) {
     case "commit":
       return {
-        gitBranch: import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH,
+        gitBranch: import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH,
         gitMessageLength: input.message?.length ?? 0
       };
     case "diff":
@@ -631849,7 +631966,7 @@ function getGitToolInputFields(input) {
       };
     case "pull":
       return {
-        gitBranch: import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH,
+        gitBranch: import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH,
         gitRemoteRef: REMOTE_LIVE_BRANCH
       };
     case "stage":
@@ -631858,7 +631975,7 @@ function getGitToolInputFields(input) {
       };
     case "create_pr":
       return {
-        gitBranch: import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH,
+        gitBranch: import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH,
         gitHasTitle: !!input.title,
         gitHasBody: !!input.body
       };
@@ -631970,7 +632087,7 @@ function getActionNameForOp(input) {
 function formatInputForOp(input) {
   switch (input.operation) {
     case "commit":
-      return { targets: [import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH], details: input.message };
+      return { targets: [import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH], details: input.message };
     case "stage":
       return { targets: input.paths ?? [] };
     case "pull":
@@ -631979,7 +632096,7 @@ function formatInputForOp(input) {
       return { targets: [] };
     case "create_pr":
       return {
-        targets: [import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH],
+        targets: [import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH],
         summary: input.title
       };
     case "deploy":
@@ -631997,7 +632114,7 @@ async function getStatusSyncCounts(args) {
   const { gitService, logger: logger25 } = args;
   const syncCounts = await getSyncCountsAgainstDefaultBranch({
     gitService,
-    leftRef: import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH
+    leftRef: import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH
   });
   if ("degraded" in syncCounts) {
     logger25.info("[git] tool status base ref missing; defaulting ahead/behind to 0", {
@@ -632005,7 +632122,7 @@ async function getStatusSyncCounts(args) {
       gitOperation: "status",
       gitOutcome: "degraded",
       gitErrorKind: "default_branch_ref_missing",
-      branch: import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH,
+      branch: import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH,
       gitBaseRefCandidates: syncCounts.baseRefCandidates
     });
   }
@@ -632014,7 +632131,7 @@ async function getStatusSyncCounts(args) {
 async function getRepositoryWebUrl(gitService) {
   try {
     const remoteUrl = (await gitService.raw(["remote", "get-url", "origin"])).trim();
-    return (0, import_shared41.gitRemoteUrlToWeb)(remoteUrl) ?? void 0;
+    return (0, import_shared42.gitRemoteUrlToWeb)(remoteUrl) ?? void 0;
   } catch {
     return void 0;
   }
@@ -632080,7 +632197,7 @@ var gitToolFactory = createToolFactory("git", (deps) => ({
             sha: entry.hash,
             message: entry.message,
             ...repositoryWebUrl ? {
-              url: (0, import_shared41.getCommitUrlForHash)({
+              url: (0, import_shared42.getCommitUrlForHash)({
                 hash: entry.hash,
                 repositoryWebUrl
               }) ?? void 0
@@ -632110,7 +632227,7 @@ var gitToolFactory = createToolFactory("git", (deps) => ({
               sha: hash3,
               message,
               ...repositoryWebUrl ? {
-                url: (0, import_shared41.getCommitUrlForHash)({
+                url: (0, import_shared42.getCommitUrlForHash)({
                   hash: hash3,
                   repositoryWebUrl
                 }) ?? void 0
@@ -632157,19 +632274,19 @@ var gitToolFactory = createToolFactory("git", (deps) => ({
                 "ls-remote",
                 "--heads",
                 "origin",
-                `refs/heads/${import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH}`
+                `refs/heads/${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}`
               ]);
-              remoteExists = refs.includes(`refs/heads/${import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
+              remoteExists = refs.includes(`refs/heads/${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
             } catch {
             }
             try {
-              await gitService.push("origin", import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH);
+              await gitService.push("origin", import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH);
             } catch (pushError) {
               if (remoteExists === false) {
                 await gitService.raw([
                   "push",
                   "origin",
-                  `HEAD:${import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH}`
+                  `HEAD:${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}`
                 ]);
                 return;
               }
@@ -632202,7 +632319,7 @@ var gitToolFactory = createToolFactory("git", (deps) => ({
               sha,
               pushed,
               ...repositoryWebUrl ? {
-                url: (0, import_shared41.getCommitUrlForHash)({
+                url: (0, import_shared42.getCommitUrlForHash)({
                   hash: sha,
                   repositoryWebUrl
                 }) ?? void 0
@@ -632254,7 +632371,7 @@ var gitToolFactory = createToolFactory("git", (deps) => ({
         }
         case "create_pr": {
           const remoteUrl = (await gitService.raw(["remote", "get-url", "origin"])).trim();
-          if (!(0, import_shared41.isGitHubUrl)(remoteUrl)) {
+          if (!(0, import_shared42.isGitHubUrl)(remoteUrl)) {
             throw new ToolExecutionError("Cannot create a pull request URL: only GitHub repositories are supported.", {
               toolName: "git",
               input: { operation: "create_pr" },
@@ -632263,9 +632380,9 @@ var gitToolFactory = createToolFactory("git", (deps) => ({
             });
           }
           const defaultBranch = await gitService.getDefaultBranch();
-          const prUrl = (0, import_shared41.getGitHubCompareUrl)({
+          const prUrl = (0, import_shared42.getGitHubCompareUrl)({
             gitRemoteUrl: remoteUrl,
-            fromBranch: import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH,
+            fromBranch: import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH,
             toBranch: defaultBranch,
             title: input.title,
             body: input.body
@@ -632430,7 +632547,7 @@ var gitToolFactory = createToolFactory("git", (deps) => ({
               deployed: false,
               sha: fullSha,
               stage: "validation",
-              error: `Commit ${fullSha} is not a commit on the ${defaultBranch} branch. Use log_from_main to find valid commit SHAs. Deployments can only be made from commits directly on ${defaultBranch}. If your changes are only on ${import_shared41.SUPERBLOCKS_LIVE_GIT_BRANCH}, create a pull request to merge into ${defaultBranch} first.`
+              error: `Commit ${fullSha} is not a commit on the ${defaultBranch} branch. Use log_from_main to find valid commit SHAs. Deployments can only be made from commits directly on ${defaultBranch}. If your changes are only on ${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}, create a pull request to merge into ${defaultBranch} first.`
             };
           }
           let commitMessage;
@@ -632572,7 +632689,7 @@ var gitToolFactory = createToolFactory("git", (deps) => ({
 
 // ../../../vite-plugin-file-sync/dist/ai-service/agent/tools2/tools/git-raw.js
 init_cjs_shims();
-var import_shared42 = __toESM(require_dist2());
+var import_shared43 = __toESM(require_dist2());
 var READ_ONLY_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "blame",
   "cat-file",
@@ -632763,8 +632880,8 @@ function isStashReadOnlyCommand(args) {
 }
 async function assertOnLiveBranch(gitService, input) {
   const currentBranch = (await gitService.raw(["rev-parse", "--abbrev-ref", "HEAD"])).trim();
-  if (currentBranch !== import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH) {
-    throw new ToolExecutionError(`Raw git write operations are only allowed on the ${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH} branch.`, {
+  if (currentBranch !== import_shared43.SUPERBLOCKS_LIVE_GIT_BRANCH) {
+    throw new ToolExecutionError(`Raw git write operations are only allowed on the ${import_shared43.SUPERBLOCKS_LIVE_GIT_BRANCH} branch.`, {
       toolName: "git_raw",
       input,
       context: {},
@@ -632779,19 +632896,19 @@ async function pushLiveBranchWithAutoRecreate(gitService) {
       "ls-remote",
       "--heads",
       "origin",
-      `refs/heads/${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}`
+      `refs/heads/${import_shared43.SUPERBLOCKS_LIVE_GIT_BRANCH}`
     ]);
-    remoteExists = refs.includes(`refs/heads/${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
+    remoteExists = refs.includes(`refs/heads/${import_shared43.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
   } catch {
   }
   try {
-    await gitService.push("origin", import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH);
+    await gitService.push("origin", import_shared43.SUPERBLOCKS_LIVE_GIT_BRANCH);
   } catch (pushError) {
     if (remoteExists === false) {
       await gitService.raw([
         "push",
         "origin",
-        `HEAD:${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}`
+        `HEAD:${import_shared43.SUPERBLOCKS_LIVE_GIT_BRANCH}`
       ]);
       return;
     }
@@ -632815,7 +632932,7 @@ function isGitRawWriteCommand(args) {
   return !isGitRawReadOnlyCommand(args) && args[0] !== "fetch";
 }
 var gitRawToolFactory = createToolFactory("git_raw", ({ gitService, gitOperationLock, onGitOperationComplete, onGitSetupRequired }) => ({
-  description: `Run a raw git argv command for operations not covered by the structured git tool. Pass argv only without the leading 'git'. All mutating operations must happen on ${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}. Branch-changing commands and raw push are not allowed. Detached-HEAD workflows such as bisect are not allowed. If you run commit, the tool will automatically push to origin/${import_shared42.SUPERBLOCKS_LIVE_GIT_BRANCH}. `,
+  description: `Run a raw git argv command for operations not covered by the structured git tool. Pass argv only without the leading 'git'. All mutating operations must happen on ${import_shared43.SUPERBLOCKS_LIVE_GIT_BRANCH}. Branch-changing commands and raw push are not allowed. Detached-HEAD workflows such as bisect are not allowed. If you run commit, the tool will automatically push to origin/${import_shared43.SUPERBLOCKS_LIVE_GIT_BRANCH}. `,
   category: ToolCategory.GIT,
   defaultPermission: PermissionLevel.ALLOW,
   readOnly: false,
@@ -647546,11 +647663,11 @@ var CsvJudgeStorage = class {
 
 // ../../../vite-plugin-file-sync/dist/ai-service/knowledge/knowledge-manager.js
 init_cjs_shims();
-var import_shared45 = __toESM(require_dist2());
+var import_shared46 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/ai-service/knowledge/helpers.js
 init_cjs_shims();
-var import_shared44 = __toESM(require_dist2());
+var import_shared45 = __toESM(require_dist2());
 function escapeXml3(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
@@ -647562,10 +647679,10 @@ function formatFact(fact) {
 </fact>`;
 }
 function filterAlwaysInjectFacts(facts) {
-  return facts.filter((fact) => fact.accessType === import_shared44.FactAccessType.ALWAYS_INJECT);
+  return facts.filter((fact) => fact.accessType === import_shared45.FactAccessType.ALWAYS_INJECT);
 }
 function filterOnDemandFacts(facts) {
-  return facts.filter((fact) => fact.accessType === import_shared44.FactAccessType.ON_DEMAND);
+  return facts.filter((fact) => fact.accessType === import_shared45.FactAccessType.ON_DEMAND);
 }
 function formatIntegrationFrontmatter(integration) {
   const displayName = integration.displayName || integration.name;
@@ -647685,19 +647802,19 @@ ${entries.join("\n")}
 var orgFactLookup = (organizationId) => ({
   cacheKeyPrefix: "organization",
   entityId: organizationId,
-  entityScope: import_shared45.FactEntityScope.ORG,
+  entityScope: import_shared46.FactEntityScope.ORG,
   label: "org"
 });
 var integrationFactLookup = (integrationId) => ({
   cacheKeyPrefix: "integration",
   entityId: integrationId,
-  entityScope: import_shared45.FactEntityScope.INTEGRATION,
+  entityScope: import_shared46.FactEntityScope.INTEGRATION,
   label: "integration"
 });
 var userFactLookup = (userId) => ({
   cacheKeyPrefix: "user",
   entityId: userId,
-  entityScope: import_shared45.FactEntityScope.USER,
+  entityScope: import_shared46.FactEntityScope.USER,
   label: "user"
 });
 var CACHE_TTL_MS2 = 1 * 60 * 1e3;
@@ -647740,9 +647857,9 @@ var KnowledgeManager = class {
     const alwaysInject = [];
     const onDemand = [];
     for (const fact of facts) {
-      if (fact.accessType === import_shared45.FactAccessType.ALWAYS_INJECT) {
+      if (fact.accessType === import_shared46.FactAccessType.ALWAYS_INJECT) {
         alwaysInject.push(fact);
-      } else if (fact.accessType === import_shared45.FactAccessType.ON_DEMAND) {
+      } else if (fact.accessType === import_shared46.FactAccessType.ON_DEMAND) {
         onDemand.push(fact);
       }
     }
@@ -647939,7 +648056,7 @@ var KnowledgeManager = class {
    */
   filterAlwaysInjectFacts(facts) {
     const filterAlwaysInject = (factList) => {
-      return factList.filter((fact) => fact.accessType === import_shared45.FactAccessType.ALWAYS_INJECT);
+      return factList.filter((fact) => fact.accessType === import_shared46.FactAccessType.ALWAYS_INJECT);
     };
     const alwaysInjectIntegrations = {};
     for (const [integrationId, integrationFacts] of Object.entries(facts.integrations)) {
@@ -650242,7 +650359,6 @@ function estimateJsonTokens(value2) {
 
 // ../../../vite-plugin-file-sync/dist/ai-service/llm/context-v2/phase2-session-summarizer.js
 init_cjs_shims();
-var import_ai7 = __toESM(require_dist9());
 
 // ../../../vite-plugin-file-sync/dist/ai-service/llm/context-v2/prompts/compaction.js
 init_cjs_shims();
@@ -650598,7 +650714,7 @@ function formatGroundedCompactionRequest(groundingFacts, messagesJson) {
 ${formatCompactionRequest(messagesJson)}`;
 }
 async function summarizeSession(options8) {
-  const { messages: messages3, groundingMessages = messages3, model, targetTokens, abortSignal, tracer: tracer3 = LLMObsTracer.instance } = options8;
+  const { messages: messages3, groundingMessages = messages3, model, targetTokens, abortSignal, tracer: tracer3 = LLMObsTracer.instance, summarizeLLM, providerConfig } = options8;
   const cleanedGroundingMessages = groundingMessages.map(stripMedia).map(stripProviderOptions).map(stripSuperblocksMeta);
   const groundingFacts = buildGroundingFacts(cleanedGroundingMessages);
   return tracer3.trace({ name: "session.summarize", kind: "task" }, async (summarizeSpan) => {
@@ -650607,40 +650723,30 @@ async function summarizeSession(options8) {
         const cleanedMessages = msgs.map(stripMedia).map(stripProviderOptions).map(stripSuperblocksMeta);
         const messagesJson = JSON.stringify(cleanedMessages, null, 2);
         const userMessage = formatGroundedCompactionRequest(groundingFacts, messagesJson);
-        let capturedError = null;
         const inputMetadata = {
           messageCount: msgs.length,
           promptLength: userMessage.length
         };
-        const streamResult = (0, import_ai7.streamText)({
-          model,
-          system: COMPACTION_PROMPT,
-          messages: [{ role: "user", content: userMessage }],
-          maxOutputTokens: 16384,
-          abortSignal,
-          onError: (event) => {
-            capturedError = event.error;
-          }
-        });
-        let summary = "";
-        for await (const part of streamResult.textStream) {
-          summary += part;
-        }
-        if (capturedError) {
+        let result2;
+        try {
+          result2 = await summarizeLLM({
+            model,
+            system: COMPACTION_PROMPT,
+            messages: [{ role: "user", content: userMessage }],
+            maxOutputTokens: 16384,
+            abortSignal,
+            providerConfig
+          });
+        } catch (err) {
           tracer3.annotate(llmSpan, {
-            metadata: {
-              input: inputMetadata
-            },
-            error: capturedError
+            metadata: { input: inputMetadata },
+            error: err
           });
-          throw capturedError;
+          throw err;
         }
-        const [usage, finishReason, warnings, response] = await Promise.all([
-          streamResult.usage,
-          streamResult.finishReason,
-          streamResult.warnings,
-          streamResult.response
-        ]);
+        const summary = result2.text ?? "";
+        const usage = result2.usage;
+        const finishReason = result2.finishReason;
         if (!summary) {
           const debugInfo = {
             model: {
@@ -650653,13 +650759,6 @@ async function summarizeSession(options8) {
               inputTokens: usage?.inputTokens,
               outputTokens: usage?.outputTokens,
               cachedInputTokens: usage?.cachedInputTokens
-            },
-            warnings,
-            response: {
-              id: response?.id,
-              modelId: response?.modelId,
-              timestamp: response?.timestamp,
-              headers: response?.headers
             }
           };
           logger12.warn("Summarization produced empty summary - debug info:", debugInfo);
@@ -650812,14 +650911,14 @@ function captureSession(data3, rootDir) {
 // ../../../vite-plugin-file-sync/dist/ai-service/llm/context-v2/compactor.js
 var logger14 = getPrefixedLogger("[context-v2:compactor]");
 async function compact(options8) {
-  const { messages: messages3, usage, model, config: config4 = {}, callbacks, tracer: tracer3 = LLMObsTracer.instance, rootDir } = options8;
+  const { messages: messages3, usage, model, summarizeLLM, providerConfig, config: config4 = {}, callbacks, tracer: tracer3 = LLMObsTracer.instance, rootDir } = options8;
   return tracer3.trace({ name: "context.compaction", kind: "task" }, async (compactionSpan) => {
     const mergedOptions = {
       ...DEFAULT_OPTIONS3,
       ...config4
     };
     const { contextLimit, maxOutputTokens, phase2TargetRatio, phase1Enabled, phase1MinPruneable, phase1ProtectedTokens, phase1ProtectedToolUseCount } = mergedOptions;
-    const initialTokens = getTotalTokens(usage);
+    const inputContextTokens = computeContextUsed(usage);
     const availableForInput = contextLimit - maxOutputTokens;
     const targetTokens = Math.floor(availableForInput * phase2TargetRatio);
     let currentMessages = messages3;
@@ -650843,7 +650942,7 @@ async function compact(options8) {
           protectedTokens: phase1ProtectedTokens,
           protectedToolUseCount: phase1ProtectedToolUseCount
         });
-        const estimatedTokensAfter = initialTokens - phase1EstimatedSavings;
+        const estimatedTokensAfter = inputContextTokens - phase1EstimatedSavings;
         tracer3.annotate(phase1Span, {
           metadata: {
             input: {
@@ -650870,14 +650969,19 @@ async function compact(options8) {
       phase1Applied = true;
       logger14.info(`Phase 1 complete: summarized ${result.summarizedCount} tool outputs`);
       callbacks?.onCompactionComplete?.("phase1", phase1MessageId);
-      const estimatedNewTokens = initialTokens - phase1EstimatedSavings;
+      const estimatedNewTokens = inputContextTokens - phase1EstimatedSavings;
       if (estimatedNewTokens < targetTokens) {
         tokensSaved = phase1EstimatedSavings;
         tracer3.annotate(compactionSpan, {
           metadata: {
             input: {
               messageCount: messages3.length,
-              tokens: initialTokens
+              tokens: inputContextTokens,
+              // Discriminator: `tokens` reports input-only context (via
+              // computeContextUsed). Earlier spans reported input+output, so
+              // absolute-value dashboards/alerts step down at the deploy
+              // boundary — filter/annotate on this field.
+              tokensMetric: "inputContext"
             },
             config: {
               contextLimit,
@@ -650890,7 +650994,7 @@ async function compact(options8) {
               phase2TargetRatio
             },
             result: {
-              tokens: initialTokens - tokensSaved,
+              tokens: inputContextTokens - tokensSaved,
               tokensSaved,
               tokensSavedIsEstimate: true,
               phase1Applied,
@@ -650909,14 +651013,16 @@ async function compact(options8) {
     logger14.info("Phase 2: generating session summary");
     const phase2MessageId = crypto.randomUUID();
     callbacks?.onCompactionStart?.("phase2", phase2MessageId);
-    const phase2SourceMessages = initialTokens <= availableForInput ? messages3 : currentMessages;
+    const phase2SourceMessages = inputContextTokens <= availableForInput ? messages3 : currentMessages;
     const summaryResult = await tracer3.trace({ name: "context.compaction.phase2", kind: "task" }, async (phase2Span) => {
       const result = await summarizeSession({
         messages: phase2SourceMessages,
         groundingMessages: messages3,
         model,
         targetTokens,
-        tracer: tracer3
+        tracer: tracer3,
+        summarizeLLM,
+        providerConfig
       });
       tracer3.annotate(phase2Span, {
         metadata: {
@@ -650935,14 +651041,18 @@ async function compact(options8) {
     phase2Applied = true;
     currentMessages = summaryResult.messages;
     const summaryTokens = summaryResult.messages.reduce((sum, msg) => sum + (msg._superblocks?.tokenCount ?? 100), 0);
-    tokensSaved = initialTokens - summaryTokens;
-    logger14.info(`Phase 2 complete: ${initialTokens}\u2192${summaryTokens} tokens (saved ${tokensSaved})`);
+    tokensSaved = inputContextTokens - summaryTokens;
+    logger14.info(`Phase 2 complete: ${inputContextTokens}\u2192${summaryTokens} tokens (saved ${tokensSaved})`);
     callbacks?.onCompactionComplete?.("phase2", phase2MessageId, summaryResult.summary);
     tracer3.annotate(compactionSpan, {
       metadata: {
         input: {
           messageCount: messages3.length,
-          tokens: initialTokens
+          tokens: inputContextTokens,
+          // Discriminator: `tokens` reports input-only context (via
+          // computeContextUsed), not input+output — filter/annotate on this
+          // field so absolute-value dashboards can account for the step down.
+          tokensMetric: "inputContext"
         },
         config: {
           contextLimit,
@@ -650976,6 +651086,8 @@ async function compact(options8) {
 var logger15 = getPrefixedLogger("[compaction:client-side]");
 var ClientSideCompactionStrategy = class {
   summarizationModel;
+  summarizeLLM;
+  summarizationProviderConfig;
   config;
   getModeState;
   rootDir;
@@ -650986,6 +651098,8 @@ var ClientSideCompactionStrategy = class {
   callbacks;
   constructor(options8) {
     this.summarizationModel = options8.summarizationModel;
+    this.summarizeLLM = options8.summarizeLLM;
+    this.summarizationProviderConfig = options8.summarizationProviderConfig;
     this.config = { ...DEFAULT_OPTIONS3, ...options8.config };
     this.getModeState = options8.getModeState;
     this.rootDir = options8.rootDir;
@@ -651060,14 +651174,16 @@ var ClientSideCompactionStrategy = class {
       return {};
     }
     logger15.info(`Compaction triggered: ${inputContextUsed} tokens > ${threshold} threshold (${params.messages.length} messages)`);
-    if (!this.summarizationModel) {
-      logger15.warn("Client-side compaction is selected but no summarization model is configured; skipping compaction");
+    if (!this.summarizationModel || !this.summarizeLLM || !this.summarizationProviderConfig) {
+      logger15.warn("Client-side compaction is selected but no summarization model, summarizer callback, or provider config is configured; skipping compaction");
       return {};
     }
     const result = await compact({
       messages: params.messages,
       usage: params.usage,
       model: this.summarizationModel,
+      summarizeLLM: this.summarizeLLM,
+      providerConfig: this.summarizationProviderConfig,
       config: this.config,
       callbacks: this.callbacks,
       tracer: this.tracer,
@@ -651625,6 +651741,8 @@ var ContextManagerV2 = class {
     }
     return new ClientSideCompactionStrategy({
       summarizationModel: contextManagement?.summarizationModel,
+      summarizationProviderConfig: contextManagement?.summarizationProviderConfig,
+      summarizeLLM: contextManagement?.summarizeLLM,
       config: config4,
       getModeState: this.getModeState,
       rootDir: this.rootDir,
@@ -651738,7 +651856,7 @@ init_cjs_shims();
 
 // ../../../vite-plugin-file-sync/dist/ai-service/llm/interaction/adapters/vercel.js
 init_cjs_shims();
-var import_ai8 = __toESM(require_dist9());
+var import_ai7 = __toESM(require_dist9());
 
 // ../../../vite-plugin-file-sync/dist/ai-service/llm/tool-context-integrity.js
 init_cjs_shims();
@@ -651952,7 +652070,7 @@ var VercelStreamTextAdapter = class {
    */
   async streamText(options8) {
     const { onFinally, user, ...rest } = options8;
-    const sdkOutput = rest.experimental_output ? import_ai8.Output.object({
+    const sdkOutput = rest.experimental_output ? import_ai7.Output.object({
       schema: rest.experimental_output
     }) : void 0;
     const normalizeError = (error40) => error40 instanceof Error ? error40 : new Error(String(error40));
@@ -651978,7 +652096,7 @@ var VercelStreamTextAdapter = class {
       logProviderMessages(preparedStep?.messages ?? step.messages);
       return preparedStep;
     });
-    const rawResult = (0, import_ai8.streamText)({
+    const rawResult = (0, import_ai7.streamText)({
       model: rest.model,
       messages: messagesForLLM,
       system: rest.system,
@@ -652730,7 +652848,7 @@ async function raceWithStallDetection(promise2, idleMonitor) {
 
 // ../../../vite-plugin-file-sync/dist/ai-service/llm/stream/retry-engine.js
 init_cjs_shims();
-var import_ai9 = __toESM(require_dist9());
+var import_ai8 = __toESM(require_dist9());
 var RetryEngine = class {
   config;
   fallbackChain;
@@ -652758,7 +652876,7 @@ var RetryEngine = class {
       return { shouldRetry: false, delayMs: 0, reason: "aborted" };
     }
     if (!this.isRetryable(error40)) {
-      if (import_ai9.APICallError.isInstance(error40)) {
+      if (import_ai8.APICallError.isInstance(error40)) {
         const statusCode = error40.statusCode;
         let cause = "non-retryable";
         if (statusCode === 401 || statusCode === 403) {
@@ -653549,6 +653667,10 @@ var StreamOrchestrator = class {
       tools: options8.tools
     });
     internalAbortController.signal.addEventListener("abort", () => {
+      if (!session.isPending()) {
+        this.logger.debug("[orchestrator] session:abort suppressed \u2014 session already finalized", { session_id: session.id, outcome: session.outcome });
+        return;
+      }
       void session.events.emit("session:abort", session);
     });
     const idleMonitor = new IdleMonitor({
@@ -653712,6 +653834,7 @@ var StreamOrchestrator = class {
       } finally {
         reader.releaseLock();
         if (!drained) {
+          internalAbortController.abort();
           await branch.cancel().catch(() => {
           });
         }
@@ -654749,7 +654872,7 @@ ${from.name}/${from.model} -> ${to2.name}/${to2.model} reason=${reason}
 
 // ../../../vite-plugin-file-sync/dist/ai-service/llm/stream/observers/llmobs.js
 init_cjs_shims();
-var import_ai10 = __toESM(require_dist9());
+var import_ai9 = __toESM(require_dist9());
 
 // ../../../vite-plugin-file-sync/dist/ai-service/llmobs/helpers.js
 init_cjs_shims();
@@ -654856,7 +654979,7 @@ function classifyError(error40, provider = "anthropic") {
       providerErrorType: error40.data?.type
     };
   }
-  if (import_ai10.APICallError.isInstance(error40) || isAPICallErrorLike(error40)) {
+  if (import_ai9.APICallError.isInstance(error40) || isAPICallErrorLike(error40)) {
     const providerError = new LLMProviderError({
       provider,
       cause: error40
@@ -655269,10 +655392,11 @@ var LLMObsObserver = class {
       });
     }
     if (this.fullSpan) {
+      const totalDurationMs = session.metrics.durationMs > 0 ? session.metrics.durationMs : session.getElapsedMs();
       this.tracer.annotate(this.fullSpan, {
         metadata: {
           outcome,
-          totalDurationMs: session.metrics.durationMs,
+          totalDurationMs,
           totalChunks: session.metrics.chunkCount,
           totalRetries: session.metrics.retryCount,
           totalRetryDelayMs: session.metrics.totalRetryDelayMs,
@@ -655981,8 +656105,12 @@ var LLMClient = class {
     const managedContextConfig = usesManagedContext ? contextConfig : void 0;
     const contextId = managedContextConfig?.contextId;
     const effectiveLoggingConfig = loggingConfig === void 0 && !usesManagedContext ? false : loggingConfig;
+    const contextManagement = managedContextConfig?.contextManagement?.type === "client" ? {
+      ...managedContextConfig.contextManagement,
+      summarizeLLM: this.summarizeViaClient
+    } : managedContextConfig?.contextManagement;
     const contextSetupStartedAt = performance.now();
-    const managedContext = usesManagedContext ? await this.createContext(contextId, managedContextConfig?.contextOptionsV2, tracer3, managedContextConfig?.contextManagement, peer) : void 0;
+    const managedContext = usesManagedContext ? await this.createContext(contextId, managedContextConfig?.contextOptionsV2, tracer3, contextManagement, peer) : void 0;
     const contextHandle = managedContext?.contextHandle;
     const ctx = managedContext?.ctx;
     if (ctx) {
@@ -656203,6 +656331,73 @@ var LLMClient = class {
       throw error40;
     }
   }
+  /**
+   * Runs the Phase-2 context-compaction summarization call through this client
+   * so it inherits retry, idle-monitor stall handling, and the standardized
+   * observer pipeline instead of calling the AI SDK's `streamText`
+   * directly. Injected into the client-side compaction strategy via
+   * `contextManagement.summarizeLLM`.
+   *
+   * - Runs `stateless`: summarization is a one-shot with no
+   *   conversation to attach to, so it skips the managed-context machinery
+   *   (ephemeral context, turn tracking, context observer) and — because
+   *   stateless defaults logging off — persists no `.superblocks/generations`
+   *   artifacts without a per-call-site `logging: false`.
+   * - No `safety` object (reads as `safety: undefined`, like every other
+   *   non-user-prompt turn — subagent, judge, plan mode): the compaction prompt
+   *   is internally generated, not user content, so the migration adds only
+   *   retry/observability, never classification or redaction. The client skips
+   *   the safety pipeline whenever no safety feature is enabled.
+   * - `recordObsContent: false` — the LLMObsObserver is always attached, and the
+   *   compaction input is the serialized prior session (which can carry secrets
+   *   and tool output). With redaction off, recording content would annotate the
+   *   span with that raw conversation, so redact it on the span (model, usage,
+   *   timing, and span structure are still recorded). Mirrors how the safety
+   *   classifier keeps its prompt content off LLMObs.
+   * - `providerConfig` is threaded in via `args` from
+   *   `modelForTask("summarizeMessages")` (the `{ model, providerConfig }` pair
+   *   the other migrated call sites pass, see #20263), so it reflects the org's real
+   *   provider/core model instead of a hardcode. It only sets the retry-budget
+   *   profile + initial telemetry label; the real per-call model/provider are
+   *   recorded from the response headers on the obs span.
+   *
+   * Drains `fullStream` (not `textStream`) so the managed-stream wrapper fires
+   * session finalization, and captures usage/finishReason from the terminal
+   * `finish` part — emitted on the stream we already drain, so it is in-order
+   * with the loop (unlike `onFinish`, which is the AI SDK's callback on the
+   * inner provider stream and can fire *after* this loop exits, leaving the
+   * counts undefined and silently zeroing the summary message's tokenCount).
+   */
+  summarizeViaClient = async (args) => {
+    const user = args.messages[args.messages.length - 1];
+    if (!args.providerConfig) {
+      throw new Error("summarizeViaClient requires a providerConfig threaded from the compaction strategy (modelForTask). None was supplied.");
+    }
+    const result = await this.streamText({
+      // The summarization model always resolves to a LanguageModelV3 (from
+      // `modelForTask`), never a bare string, in the compaction path.
+      model: args.model,
+      user,
+      system: args.system,
+      maxOutputTokens: args.maxOutputTokens,
+      abortSignal: args.abortSignal,
+      providerConfig: args.providerConfig,
+      context: { mode: "stateless" },
+      recordObsContent: false
+    });
+    let text3 = "";
+    let usage;
+    let finishReason;
+    for await (const part of result.fullStream) {
+      if (part.type === "text-delta") {
+        text3 += part.text;
+      } else if (part.type === "finish") {
+        usage = part.totalUsage;
+        finishReason = part.finishReason;
+      }
+    }
+    return { text: text3, usage, finishReason };
+  };
   async createContext(contextId, contextOptionsV2, tracer3, contextManagement, peer) {
     const context2 = await this.contextManagerV2.getOrCreateContext(contextId, contextOptionsV2, tracer3, contextManagement, {
       ...this.applicationId ?? contextId?.appId ? { applicationId: this.applicationId ?? contextId?.appId } : {},
@@ -656803,7 +656998,7 @@ var PlaywrightMcpServerManager = class {
       this.logger.info(`Starting embedded Playwright MCP server: browser=${options8?.browser || "chromium"}, headless=${options8?.headless !== false}`);
     }
     try {
-      const { startEmbeddedPlaywrightMcpServer } = await import("./embedded-playwright-mcp-server-6ZRCB7OJ.js");
+      const { startEmbeddedPlaywrightMcpServer } = await import("./embedded-playwright-mcp-server-SWUZ5WRJ.js");
       this.server = await startEmbeddedPlaywrightMcpServer({
         storageStatePath: options8?.storageStatePath,
         jwt: options8?.jwt,
@@ -657020,6 +657215,7 @@ var VALID_CORE_MODELS = [
   "claude-opus-4-5",
   "claude-opus-4-6",
   "claude-opus-4-7",
+  "claude-opus-4-8",
   "claude-sonnet-4-5",
   "claude-sonnet-4-6"
 ];
@@ -657500,7 +657696,7 @@ function resolveGenerationStateForUi(input) {
 
 // ../../../vite-plugin-file-sync/dist/ai-service/state-machine/handlers/agent-planning.js
 init_cjs_shims();
-var import_shared48 = __toESM(require_dist2());
+var import_shared49 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/ids.js
 init_cjs_shims();
@@ -657526,7 +657722,7 @@ var generateShortId = () => {
 
 // ../../../vite-plugin-file-sync/dist/ai-service/app-skills/helpers.js
 init_cjs_shims();
-var import_shared46 = __toESM(require_dist2());
+var import_shared47 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/ai-service/state-machine/helpers/background-chat-record.js
 init_cjs_shims();
@@ -657662,12 +657858,12 @@ ${failedCount} ${failedCount === 1 ? "entry" : "entries"} failed to save.`);
 // ../../../vite-plugin-file-sync/dist/ai-service/app-skills/helpers.js
 function resolveFactScope(scope) {
   if (scope === "org") {
-    return import_shared46.FactEntityScope.ORG;
+    return import_shared47.FactEntityScope.ORG;
   }
   if (scope === "user") {
-    return import_shared46.FactEntityScope.USER;
+    return import_shared47.FactEntityScope.USER;
   }
-  return import_shared46.FactEntityScope.INTEGRATION;
+  return import_shared47.FactEntityScope.INTEGRATION;
 }
 function resolveKnowledgeScopeSelection(selection) {
   if (selection) {
@@ -657751,8 +657947,8 @@ async function saveKnowledgeAndNotify(clark, params, chatSessionStore, appRootDi
           content: knowledgeEntry.content,
           entityScope: resolveFactScope(selection.scope),
           entityId,
-          accessType: import_shared46.FactAccessType.ALWAYS_INJECT,
-          createdSource: import_shared46.FactCreatedSource.AGENT
+          accessType: import_shared47.FactAccessType.ALWAYS_INJECT,
+          createdSource: import_shared47.FactCreatedSource.AGENT
         };
         const createdFact = await params.rpcClient.call(async (client) => {
           const rpcClient = client;
@@ -658380,6 +658576,23 @@ Address the errors and return the fixed code.`;
             if (clark.context.activeInteractiveMessage) {
               clark.updateContext({ activeInteractiveMessage: void 0 });
             }
+            if (request.responseMetadata.clarification && request.prompt.trim()) {
+              void clark.context.peer.call.aiPushMessage({
+                role: "user",
+                type: "text",
+                content: request.prompt,
+                id: crypto.randomUUID(),
+                timestamp: Date.now()
+              }).catch((err) => {
+                getLogger3().warn("[agent-planning] Failed to echo tool-permission clarification to UI", err);
+              });
+              recordChatMessageInBackground({
+                clark,
+                record: () => params.chatSessionStore.recordUser(request.prompt, {
+                  attachments: request.promptContext?.attachments
+                })
+              });
+            }
           } else {
             clark.updateContext({
               activeInteractiveMessage: void 0
@@ -658441,23 +658654,23 @@ Address the errors and return the fixed code.`;
             };
             const isTypedOverride = request.responseMetadata.type === "multi_choice_response" && request.responseMetadata.selectedChoiceIndices.length === 0 || request.responseMetadata.type === "plan_response" && !request.responseMetadata.approved;
             const responseMetadataType = request.responseMetadata.type;
+            if (isTypedOverride) {
+              void clark.context.peer.call.aiPushMessage({
+                role: "user",
+                type: "text",
+                content: request.prompt,
+                id: crypto.randomUUID(),
+                timestamp: Date.now()
+              }).catch((err) => {
+                getLogger3().warn("[agent-planning] Failed to echo user response to UI", {
+                  promptId: clark.context.promptId,
+                  responseType: responseMetadataType
+                }, err);
+              });
+            }
             recordChatMessageInBackground({
               clark,
-              record: () => params.chatSessionStore.recordUserResponse(request.prompt, responseMetadataType, metadata),
-              onRecorded: (chatmessageId) => {
-                if (!isTypedOverride) {
-                  return;
-                }
-                void clark.context.peer.call.aiPushMessage({
-                  role: "user",
-                  type: "text",
-                  content: request.prompt,
-                  id: chatmessageId,
-                  timestamp: Date.now()
-                }).catch((err) => {
-                  getLogger3().warn("[agent-planning] Failed to echo user response to UI", err);
-                });
-              }
+              record: () => params.chatSessionStore.recordUserResponse(request.prompt, responseMetadataType, metadata)
             });
             if (isIntegrationActionResponse) {
               const selectedResponseText = request.prompt.trim().toLowerCase();
@@ -658804,9 +659017,9 @@ ${request.prompt}`;
           const data3 = e.data;
           const responseMeta = data3?.responseMeta;
           const wireReason = responseMeta?.error?.reason;
-          if ((0, import_shared48.isAiQuotaPaywallReason)(wireReason))
+          if ((0, import_shared49.isAiQuotaPaywallReason)(wireReason))
             return wireReason;
-          if ((0, import_shared48.isAiQuotaPaywallReason)(data3?.reason))
+          if ((0, import_shared49.isAiQuotaPaywallReason)(data3?.reason))
             return data3.reason;
           if (data3?.type === "clark_quota_exceeded") {
             return "credit_limit_exceeded";
@@ -658817,13 +659030,13 @@ ${request.prompt}`;
           if (!err || typeof err !== "object" || depth > 5)
             return void 0;
           const e = err;
-          return reasonFromData(err) ?? (typeof e.message === "string" ? (0, import_shared48.getAiQuotaPaywallReasonFromMessage)(e.message) : void 0) ?? walkCause(e.cause, depth + 1);
+          return reasonFromData(err) ?? (typeof e.message === "string" ? (0, import_shared49.getAiQuotaPaywallReasonFromMessage)(e.message) : void 0) ?? walkCause(e.cause, depth + 1);
         };
         const paywallReason = (
           // Prefer structured data over message text so we keep the specific
           // reason (`trial_expired`, `no_seat_assigned`, etc.) rather than
           // collapsing to whatever string the substring matcher hits first.
-          reasonFromData(error40) ?? (0, import_shared48.getAiQuotaPaywallReasonFromMessage)(error40.message) ?? (error40.type === "ai_quota_exceeded" ? "credit_limit_exceeded" : void 0) ?? walkCause(error40.cause)
+          reasonFromData(error40) ?? (0, import_shared49.getAiQuotaPaywallReasonFromMessage)(error40.message) ?? (error40.type === "ai_quota_exceeded" ? "credit_limit_exceeded" : void 0) ?? walkCause(error40.cause)
         );
         if (paywallReason) {
           const multiChoiceCtx = clark.context.lastTurnMultiChoiceContext;
@@ -659428,11 +659641,11 @@ var doIdle = (clark, { chatSessionStore, clarkProfiler }) => {
 // ../../../vite-plugin-file-sync/dist/ai-service/state-machine/handlers/llm-generating.js
 init_cjs_shims();
 import path49 from "node:path";
-var import_shared50 = __toESM(require_dist2());
+var import_shared51 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/ai-service/agent/prompts/build-base-system-prompt.js
 init_cjs_shims();
-var import_shared49 = __toESM(require_dist2());
+var import_shared50 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/ai-service/agent/prompts/api-prompts.js
 init_cjs_shims();
@@ -660266,15 +660479,15 @@ When a pull results in merge conflicts, you will be told which files have confli
 ${config4.features.nativeGitRawEnabled ? `
 
 **Git Workflow:**
-- This workspace uses a single live branch model: all mutating git work must stay on \`${import_shared49.SUPERBLOCKS_LIVE_GIT_BRANCH}\`.
-- The **History** tab in the Versions panel shows all commits on \`${import_shared49.SUPERBLOCKS_LIVE_GIT_BRANCH}\`. Use it to review recent changes.
-- Deployments can only be made from the main branch and must be triggered manually from the History tab's **\u22EF** menu. If changes are only on \`${import_shared49.SUPERBLOCKS_LIVE_GIT_BRANCH}\`, create a pull request first to merge into main.
+- This workspace uses a single live branch model: all mutating git work must stay on \`${import_shared50.SUPERBLOCKS_LIVE_GIT_BRANCH}\`.
+- The **History** tab in the Versions panel shows all commits on \`${import_shared50.SUPERBLOCKS_LIVE_GIT_BRANCH}\`. Use it to review recent changes.
+- Deployments can only be made from the main branch and must be triggered manually from the History tab's **\u22EF** menu. If changes are only on \`${import_shared50.SUPERBLOCKS_LIVE_GIT_BRANCH}\`, create a pull request first to merge into main.
 - Never try to create, switch, delete, or compare against other branches with git commands.
 - Never leave the repository in detached HEAD, and never use detached-head workflows such as bisect.
-- Do not run raw push commands. If you run \`git_raw\` commit, it will automatically push to \`origin/${import_shared49.SUPERBLOCKS_LIVE_GIT_BRANCH}\` after the commit succeeds.
+- Do not run raw push commands. If you run \`git_raw\` commit, it will automatically push to \`origin/${import_shared50.SUPERBLOCKS_LIVE_GIT_BRANCH}\` after the commit succeeds.
 - Favor inspection commands first when debugging git state, and only use mutating git commands when they clearly preserve the single live-branch workflow.
 ` : `
-- Deployments can only be made from the main branch. To deploy, first use \`git\` with \`operation: "log_from_main"\` to get commit SHAs from main, then use \`operation: "deploy"\` with the full SHA. NEVER use a SHA from \`git log\` (which shows \`${import_shared49.SUPERBLOCKS_LIVE_GIT_BRANCH}\` commits) for deploy. If the commit is only on \`${import_shared49.SUPERBLOCKS_LIVE_GIT_BRANCH}\`, create a pull request first to merge it into main.
+- Deployments can only be made from the main branch. To deploy, first use \`git\` with \`operation: "log_from_main"\` to get commit SHAs from main, then use \`operation: "deploy"\` with the full SHA. NEVER use a SHA from \`git log\` (which shows \`${import_shared50.SUPERBLOCKS_LIVE_GIT_BRANCH}\` commits) for deploy. If the commit is only on \`${import_shared50.SUPERBLOCKS_LIVE_GIT_BRANCH}\`, create a pull request first to merge it into main.
 `}
 ` : `**Version Control:**
 If the user asks about committing, deploying, publishing, or version-controlling their application, read the documentation at \`https://docs.superblocks.com/development-lifecycle/deploy/version-control\` using \`web_fetch\` and guide them based on its contents.
@@ -661510,7 +661723,7 @@ note: ${escapeAttachmentReferenceValue(getTextUploadFallbackNote(options8.attach
           }
         ];
       }
-      const delivery = (0, import_shared50.classifyAttachmentDelivery)({
+      const delivery = (0, import_shared51.classifyAttachmentDelivery)({
         fileName: attachment.fileName,
         mimeType: attachment.mediaType
       });
@@ -664452,7 +664665,7 @@ var AiServiceFeatureFlags = {
 
 // ../../../vite-plugin-file-sync/dist/ai-service/sdk-api-templates.js
 init_cjs_shims();
-var import_shared53 = __toESM(require_dist2());
+var import_shared54 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/ai-service/index.js
 function streamRetryOptionsFromConfig(retryOptions, streamTimeoutBudgets) {
@@ -664630,7 +664843,7 @@ var POLICY_GATE_USAGE_METADATA = {
   origin: "policy_gate",
   surface: "policy_gate"
 };
-var AiService = class extends import_shared54.TracedEventEmitter {
+var AiService = class extends import_shared55.TracedEventEmitter {
   config;
   templateRenderer;
   appShell;
@@ -665091,7 +665304,7 @@ var AiService = class extends import_shared54.TracedEventEmitter {
       "handlePromptInterpretation",
       "handleJudgeEvaluation"
     ];
-    (0, import_shared54.addTracingToMethods)(this, handlerMethods, config4.tracer);
+    (0, import_shared55.addTracingToMethods)(this, handlerMethods, config4.tracer);
   }
   /**
    * Initialize the AI service. Must be called after construction.
@@ -665524,7 +665737,7 @@ var AiService = class extends import_shared54.TracedEventEmitter {
     return selectContextManagementStrategy({
       serverContextManagementEnabled: llmConfig?.serverContextManagement?.enabled,
       thresholds: llmConfig?.serverContextManagement,
-      summarizationModel: () => createLLMProvider(this.getLLMProviderSettings(llmConfig), () => this.getInferenceJwt(), llmConfig, () => this.getLlmAiAttributes(this.clark), this.clark.context.traceHeaders).modelForTask("summarizeMessages").model
+      summarizeModel: () => createLLMProvider(this.getLLMProviderSettings(llmConfig), () => this.getInferenceJwt(), llmConfig, () => this.getLlmAiAttributes(this.clark), this.clark.context.traceHeaders).modelForTask("summarizeMessages")
     });
   }
   getLlmAiAttributes(clark) {
@@ -665781,7 +665994,7 @@ var AiService = class extends import_shared54.TracedEventEmitter {
       return void 0;
     } catch (error40) {
       if (error40 instanceof Error) {
-        const reason = (0, import_shared54.getAiQuotaPaywallReasonFromMessage)(error40.message);
+        const reason = (0, import_shared55.getAiQuotaPaywallReasonFromMessage)(error40.message);
         if (reason) {
           await this.handlePreCallPaywall(request, reason);
           return reason;
@@ -666301,7 +666514,7 @@ ${apiSourceCode.slice(0, 2e3)}
       type: attachment.type
     });
     const attachmentMimeType = attachment.type === "uploaded" ? attachment.mediaType : attachment.type === "pdf" ? attachment.data.match(/^data:([^;]+);base64,/)?.[1] ?? "application/pdf" : attachment.type === "archive" ? attachment.data.match(/^data:([^;]+);base64,/)?.[1] ?? "application/octet-stream" : attachment.type === "image" ? attachment.image.match(/^data:([^;]+);base64,/)?.[1] ?? "image/png" : attachment.mimeType;
-    const delivery = (0, import_shared54.classifyAttachmentDelivery)({
+    const delivery = (0, import_shared55.classifyAttachmentDelivery)({
       fileName: attachment.fileName,
       mimeType: attachmentMimeType
     });
@@ -666904,8 +667117,14 @@ ${request.prompt}`;
     if (!this.clark.context.llmConfig) {
       throw new Error("Cannot continue after tool permission: llmConfig is missing from context");
     }
+    const isClarification = isToolPermissionClarification(request.approved, request.denyMessage);
+    logger25.info("[ai-service] tool_permission_response continuation", {
+      approved: request.approved,
+      clarification: isClarification
+    });
+    trace.getActiveSpan()?.setAttribute("clark.tool_permission.clarification", isClarification);
     const continueRequest = {
-      prompt: request.approved ? `` : this.buildDenialContinuationPrompt(toolName, rawInput),
+      prompt: request.approved ? `` : isClarification ? request.denyMessage.trim() : this.buildDenialContinuationPrompt(toolName, rawInput),
       promptContext: {
         entities: [],
         integrations: []
@@ -666914,12 +667133,12 @@ ${request.prompt}`;
       llmConfig: this.clark.context.llmConfig,
       mode: this.clark.context.currentMode,
       browserContext: this.clark.context.browserContext,
-      // Mark as tool_permission_response to skip user message recording in agent-planning
       responseMetadata: {
         type: "tool_permission_response",
         responseToMessageId: request.messageId,
         approved: request.approved,
-        alwaysAllowPermissions: request.alwaysAllowPermissions
+        alwaysAllowPermissions: request.alwaysAllowPermissions,
+        ...isClarification ? { clarification: true } : {}
       }
     };
     const transitionTo = transitionFrom(this.clark);
@@ -667369,7 +667588,7 @@ ${request.prompt}`;
       llmProvider
     };
     const tools = await buildSecurityScanTools(this.clark, scanToolsDeps);
-    const result = (0, import_ai11.streamText)({
+    const result = (0, import_ai10.streamText)({
       messages: [
         { content: systemPrompt, role: "system" },
         {
@@ -667379,7 +667598,7 @@ ${request.prompt}`;
       ],
       model,
       tools,
-      stopWhen: (0, import_ai11.stepCountIs)(30)
+      stopWhen: (0, import_ai10.stepCountIs)(30)
     });
     const peer = this.clark.context.peer;
     const emitAgentStep = (part) => {
@@ -667578,7 +667797,7 @@ ${request.prompt}`;
     if (!entityId) {
       throw new Error(`Missing entity id for move scope '${payload.targetScope}'`);
     }
-    const entityScope = payload.targetScope === "org" ? import_shared54.FactEntityScope.ORG : payload.targetScope === "user" ? import_shared54.FactEntityScope.USER : import_shared54.FactEntityScope.INTEGRATION;
+    const entityScope = payload.targetScope === "org" ? import_shared55.FactEntityScope.ORG : payload.targetScope === "user" ? import_shared55.FactEntityScope.USER : import_shared55.FactEntityScope.INTEGRATION;
     let createdFactId;
     try {
       const createdFact = await this.config.rpcClient.call(async (client) => {
@@ -667589,8 +667808,8 @@ ${request.prompt}`;
           content: sourceFact.content,
           entityScope,
           entityId,
-          accessType: import_shared54.FactAccessType.ALWAYS_INJECT,
-          createdSource: import_shared54.FactCreatedSource.AGENT
+          accessType: import_shared55.FactAccessType.ALWAYS_INJECT,
+          createdSource: import_shared55.FactCreatedSource.AGENT
         });
       });
       createdFactId = typeof createdFact?.id === "string" ? createdFact.id : typeof createdFact?.data?.id === "string" ? createdFact.data.id : void 0;
@@ -667763,9 +667982,9 @@ ${request.prompt}`;
 init_cjs_shims();
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { normalizePath as normalizePath8 } from "vite";
-var import_shared60 = __toESM(require_dist2(), 1);
-var import_shared61 = __toESM(require_dist2(), 1);
-var import_shared62 = __toESM(require_dist2(), 1);
+var import_shared61 = __toESM(require_dist2());
+var import_shared62 = __toESM(require_dist2());
+var import_shared63 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/errors/make-server-error.js
 init_cjs_shims();
@@ -667816,13 +668035,13 @@ function classifyCheckpointResult(commitId, checkpointSkipped) {
 
 // ../../../vite-plugin-file-sync/dist/sync-service/download.js
 init_cjs_shims();
-var import_shared56 = __toESM(require_dist2());
 var import_shared57 = __toESM(require_dist2());
+var import_shared58 = __toESM(require_dist2());
 import * as fsp2 from "node:fs/promises";
 
 // ../../../vite-plugin-file-sync/dist/sync-service/hash-dir-tree.js
 init_cjs_shims();
-var import_shared55 = __toESM(require_dist2());
+var import_shared56 = __toESM(require_dist2());
 var import_util20 = __toESM(require_dist3());
 
 // ../../../vite-plugin-file-sync/dist/sync-service/list-dir.js
@@ -667929,7 +668148,7 @@ async function hashLocalDirectory(localDirectoryPath, rootDirectoryPath = localD
     let entry;
     switch (localDirEntry.type) {
       case "-": {
-        const hash4 = await (0, import_shared55.hashFileContents)(localDirEntry.contents);
+        const hash4 = await (0, import_shared56.hashFileContents)(localDirEntry.contents);
         entry = {
           type: "-",
           executable: localDirEntry.executable,
@@ -667961,7 +668180,7 @@ async function hashLocalDirectory(localDirectoryPath, rootDirectoryPath = localD
     }
     directoryContents.push(entry);
   }
-  const hash3 = await (0, import_shared55.hashDirectoryContents)(directoryContents);
+  const hash3 = await (0, import_shared56.hashDirectoryContents)(directoryContents);
   return { contents: directoryContents, hash: hash3 };
 }
 
@@ -667988,16 +668207,17 @@ async function downloadApplicationDirectory({ rpcClient, applicationId, branch,
   return { directoryHash: serverDirectoryHash, latestNonDraftCommitId };
 }
 async function doDownloadApplicationDirectory(rpcClient, directoryHash, oldLocalDirState, localDirectoryPath) {
-  const hashesToGet = {};
-  const doRecursive = async (rpcClient2, directoryHash2, oldLocalDirState2, localDirectoryPath2, hashesToGet2) => {
+  const filesToGet = [];
+  const doRecursive = async (rpcClient2, directoryHash2, oldLocalDirState2, localDirectoryPath2, dbfsPath, filesToGet2) => {
     if (oldLocalDirState2?.hash === directoryHash2) {
       return oldLocalDirState2;
     }
     const newStateContents = [];
-    const directoryContentsResponse = await (0, import_shared56.unwrapResponseDto)(rpcClient2.call.v1.dbfs.directoryContents.get({ hash: directoryHash2 }));
+    const directoryContentsResponse = await (0, import_shared57.unwrapResponseDto)(rpcClient2.call.v1.dbfs.directoryContents.get({ hash: directoryHash2 }));
     const localDirMap = new Map(oldLocalDirState2?.contents.map((entry) => [entry.name, entry]) ?? []);
     for (const entry of directoryContentsResponse.contents) {
       const localFilePath = `${localDirectoryPath2}/${entry.name}`;
+      const entryDbfsPath = dbfsPath === "" ? entry.name : `${dbfsPath}/${entry.name}`;
       let localEntry = localDirMap.get(entry.name);
       localDirMap.delete(entry.name);
       if (localEntry !== void 0 && localEntry.type !== entry.type) {
@@ -668009,10 +668229,11 @@ async function doDownloadApplicationDirectory(rpcClient, directoryHash, oldLocal
           newStateContents.push(entry);
           const localEntryTyped = localEntry;
           if (localEntryTyped?.hash !== entry.hash) {
-            hashesToGet2[entry.hash] = { localFilePath };
-            const fileContentsResponse = await (0, import_shared56.unwrapResponseDto)(rpcClient2.call.v1.dbfs.fileContents.get({ hash: entry.hash }));
-            const fileContents = Buffer.from(fileContentsResponse.contents, "base64");
-            await fsp2.writeFile(localFilePath, fileContents);
+            filesToGet2.push({
+              dbfsPath: entryDbfsPath,
+              hash: entry.hash,
+              localFilePath
+            });
           }
           break;
         }
@@ -668033,7 +668254,7 @@ async function doDownloadApplicationDirectory(rpcClient, directoryHash, oldLocal
             hash: localEntryTyped.hash,
             contents: localEntryTyped.contents
           };
-          const newSubDirState = await doRecursive(rpcClient2, entry.hash, localSubDirState, localFilePath, hashesToGet2);
+          const newSubDirState = await doRecursive(rpcClient2, entry.hash, localSubDirState, localFilePath, entryDbfsPath, filesToGet2);
           newStateContents.push({
             ...entry,
             contents: newSubDirState.contents
@@ -668059,25 +668280,88 @@ async function doDownloadApplicationDirectory(rpcClient, directoryHash, oldLocal
       contents: newStateContents
     };
   };
-  const newLocalDirState = await doRecursive(rpcClient, directoryHash, oldLocalDirState, localDirectoryPath, hashesToGet);
+  const newLocalDirState = await doRecursive(rpcClient, directoryHash, oldLocalDirState, localDirectoryPath, "", filesToGet);
+  const downloadedWithGetMany = await tryDownloadFilesByPath(rpcClient, directoryHash, filesToGet);
+  if (downloadedWithGetMany) {
+    return newLocalDirState;
+  }
   const DOWNLOAD_BATCH_SIZE = 50;
-  const entries = Object.entries(hashesToGet);
-  for (let i2 = 0; i2 < entries.length; i2 += DOWNLOAD_BATCH_SIZE) {
-    const batch = entries.slice(i2, i2 + DOWNLOAD_BATCH_SIZE);
-    await Promise.all(batch.map(async ([hash3, { localFilePath }]) => {
-      const fileContentsResponse = await (0, import_shared56.unwrapResponseDto)(rpcClient.call.v1.dbfs.fileContents.get({ hash: hash3 }));
+  for (let i2 = 0; i2 < filesToGet.length; i2 += DOWNLOAD_BATCH_SIZE) {
+    const batch = filesToGet.slice(i2, i2 + DOWNLOAD_BATCH_SIZE);
+    await Promise.all(batch.map(async ({ hash: hash3, localFilePath }) => {
+      const fileContentsResponse = await (0, import_shared57.unwrapResponseDto)(rpcClient.call.v1.dbfs.fileContents.get({ hash: hash3 }));
       const fileContents = Buffer.from(fileContentsResponse.contents, "base64");
       await fsp2.writeFile(localFilePath, fileContents);
     }));
   }
   return newLocalDirState;
 }
+async function tryDownloadFilesByPath(rpcClient, rootHash, filesToGet) {
+  if (filesToGet.length === 0) {
+    return true;
+  }
+  const getMany = rpcClient.call.v1.dbfs.getMany;
+  if (getMany === void 0) {
+    return false;
+  }
+  try {
+    const response = await (0, import_shared57.unwrapResponseDto)(getMany({
+      rootHash,
+      paths: filesToGet.map((file2) => file2.dbfsPath)
+    }));
+    const itemByPath = new Map(response.items.map((item) => [item.path, item]));
+    if (response.items.length !== filesToGet.length) {
+      throw new InvalidGetManyResponseError(`DBFS getMany returned ${response.items.length} items for ${filesToGet.length} requested files`);
+    }
+    const filesWithContents = filesToGet.map((file2) => {
+      const item = itemByPath.get(file2.dbfsPath);
+      if (item?.type !== "fileContents") {
+        throw new InvalidGetManyResponseError(`DBFS getMany did not return file contents for ${file2.dbfsPath}`);
+      }
+      if (item.hash !== file2.hash) {
+        throw new InvalidGetManyResponseError(`DBFS getMany returned hash ${item.hash} for ${file2.dbfsPath}, expected ${file2.hash}`);
+      }
+      return {
+        file: file2,
+        contents: Buffer.from(item.contents, "base64")
+      };
+    });
+    for (const { file: file2, contents: contents2 } of filesWithContents) {
+      await fsp2.writeFile(file2.localFilePath, contents2);
+    }
+    return true;
+  } catch (e) {
+    if (e instanceof InvalidGetManyResponseError || isGetManyUnsupported(e) || isBulkReadLimitError(e)) {
+      getLogger3().warn(`DBFS getMany unavailable, invalid, or exceeded bulk limits (${getErrorMessage3(e)}), falling back to per-file download`);
+      return false;
+    }
+    throw e;
+  }
+}
+var InvalidGetManyResponseError = class extends Error {
+};
+function isSocketError(e) {
+  return typeof e === "object" && e !== null && "code" in e && typeof e.code === "number" && "message" in e && typeof e.message === "string";
+}
+function getErrorMessage3(e) {
+  if (e instanceof Error || isSocketError(e)) {
+    return e.message;
+  }
+  return String(e);
+}
+function isBulkReadLimitError(e) {
+  const message = getErrorMessage3(e);
+  return message.includes("maxObjects") || message.includes("maxBytes") || message.includes("bulk read");
+}
+function isGetManyUnsupported(e) {
+  return isSocketError(e) && e.code === 2 || getErrorMessage3(e).includes("is not implemented");
+}
 async function getDraftOrLiveDirectoryHash(rpcClient, applicationId, branch) {
   try {
-    const response = await (0, import_shared56.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
+    const response = await (0, import_shared57.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
       applicationId,
       branchName: branch,
-      viewMode: import_shared57.ExportViewMode.EXPORT_LIVE_EDIT
+      viewMode: import_shared58.ExportViewMode.EXPORT_LIVE_EDIT
     }));
     const directoryHash = response;
     return {
@@ -668094,10 +668378,10 @@ async function getDraftOrLiveDirectoryHash(rpcClient, applicationId, branch) {
 }
 async function getDraftOrLiveCommitDirectoryHash(rpcClient, applicationId, branch) {
   try {
-    const response = await (0, import_shared56.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
+    const response = await (0, import_shared57.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
       applicationId,
       branchName: branch,
-      viewMode: import_shared57.ExportViewMode.EXPORT_DRAFT
+      viewMode: import_shared58.ExportViewMode.EXPORT_DRAFT
     }));
     const directoryHash = response;
     return {
@@ -668105,11 +668389,11 @@ async function getDraftOrLiveCommitDirectoryHash(rpcClient, applicationId, branc
       latestNonDraftCommitId: directoryHash.latestNonDraftCommitId
     };
   } catch (e) {
-    if (e instanceof import_shared56.NotFoundError) {
-      const response = await (0, import_shared56.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
+    if (e instanceof import_shared57.NotFoundError) {
+      const response = await (0, import_shared57.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
         applicationId,
         branchName: branch,
-        viewMode: import_shared57.ExportViewMode.EXPORT_LIVE
+        viewMode: import_shared58.ExportViewMode.EXPORT_LIVE
       }));
       getLogger3().warn(`Draft commit not found, falling back to the latest live commit: ${response.hash}`);
       const directoryHash = response;
@@ -668122,7 +668406,7 @@ async function getDraftOrLiveCommitDirectoryHash(rpcClient, applicationId, branc
   }
 }
 function isMissingLiveEditOrUnsupportedViewMode(e) {
-  if (e instanceof import_shared56.NotFoundError) {
+  if (e instanceof import_shared57.NotFoundError) {
     return true;
   }
   const message = e instanceof Error ? e.message : String(e);
@@ -668560,7 +668844,7 @@ var HashCache = class {
 
 // ../../../vite-plugin-file-sync/dist/sync-service/snapshot/take-snapshot.js
 init_cjs_shims();
-var import_shared58 = __toESM(require_dist2());
+var import_shared59 = __toESM(require_dist2());
 var import_util21 = __toESM(require_dist3());
 async function snapshotLocalDirectory(localDirectoryPath, rootDirectoryPath = localDirectoryPath) {
   const directoryContents = [];
@@ -668569,7 +668853,7 @@ async function snapshotLocalDirectory(localDirectoryPath, rootDirectoryPath = lo
     let entry;
     switch (localDirEntry.type) {
       case "-": {
-        const hash3 = await (0, import_shared58.hashFileContents)(localDirEntry.contents);
+        const hash3 = await (0, import_shared59.hashFileContents)(localDirEntry.contents);
         entry = {
           type: "-",
           name: localDirEntry.name,
@@ -668602,7 +668886,7 @@ async function snapshotLocalDirectory(localDirectoryPath, rootDirectoryPath = lo
     }
     directoryContents.push(entry);
   }
-  const directoryHash = await (0, import_shared58.hashDirectoryContents)(directoryContents);
+  const directoryHash = await (0, import_shared59.hashDirectoryContents)(directoryContents);
   return {
     hash: directoryHash,
     contents: directoryContents
@@ -668614,7 +668898,7 @@ async function snapshotLocalDirectoryWithDrafts(localDirectoryPath) {
 
 // ../../../vite-plugin-file-sync/dist/sync-service/snapshot/upload-snapshot.js
 init_cjs_shims();
-var import_shared59 = __toESM(require_dist2());
+var import_shared60 = __toESM(require_dist2());
 var BATCH_SIZE2 = 64;
 async function uploadDirectorySnapshot(rpcClient, directorySnapshot, hashCache) {
   const itemsToUpload = [];
@@ -668669,7 +668953,7 @@ async function uploadDirectorySnapshot(rpcClient, directorySnapshot, hashCache)
   await processRecursively(directorySnapshot);
   for (let idx = 0; idx < itemsToUpload.length; idx += BATCH_SIZE2) {
     const batch = itemsToUpload.slice(idx, idx + BATCH_SIZE2);
-    await (0, import_shared59.unwrapResponseDto)(rpcClient.call.v1.dbfs.putMany({
+    await (0, import_shared60.unwrapResponseDto)(rpcClient.call.v1.dbfs.putMany({
       items: batch
     }));
   }
@@ -668717,7 +669001,7 @@ function isTransientAiAcceptUploadError(error40) {
   return msg.includes("Connection closed") || msg.includes("RPC client is shutting down") || msg.includes("RPC timeout") || msg.toLowerCase().includes("deadline exceeded");
 }
 var sleep = (ms2) => new Promise((resolve13) => setTimeout(resolve13, ms2));
-var SyncService = class extends import_shared60.TracedEventEmitter {
+var SyncService = class extends import_shared61.TracedEventEmitter {
   appRootDirPath;
   applicationId;
   _branchName;
@@ -668776,7 +669060,7 @@ var SyncService = class extends import_shared60.TracedEventEmitter {
       "discardLocalDraftChanges",
       "commitLocalDraftChanges"
     ];
-    (0, import_shared60.addTracingToMethods)(this, methods, this._tracer);
+    (0, import_shared61.addTracingToMethods)(this, methods, this._tracer);
   }
   getLogger() {
     return this._logger;
@@ -669053,7 +669337,7 @@ var SyncService = class extends import_shared60.TracedEventEmitter {
         await uploadDirectorySnapshot(rpcClient, directorySnapshot, this.hashCache);
         return;
       } catch (error40) {
-        if (error40 instanceof import_shared61.BadRequestError) {
+        if (error40 instanceof import_shared62.BadRequestError) {
           retryCount++;
           logSyncError(this.getLogger(), error40, "[sync-service] Error synchronizing directory and server with error: " + error40.message);
           this.getLogger().warn("[sync-service] Retrying upload due to BadRequestError and clearing hash cache");
@@ -669102,7 +669386,7 @@ var SyncService = class extends import_shared60.TracedEventEmitter {
           payload.selfRestart = true;
         }
         this.getLogger().info(`[sync-service] setApplicationHash RPC start (source=${source2})`);
-        return (0, import_shared62.unwrapResponseDto)(rpcClient.call.v3.application.liveEditDirectoryContents.set(payload));
+        return (0, import_shared63.unwrapResponseDto)(rpcClient.call.v3.application.liveEditDirectoryContents.set(payload));
       });
       if (degradedMode) {
         const errMsg = "There is an issue with the application and it was put in degraded mode: " + degradedMode.errors.map((e) => e.message).join("\n");
@@ -669151,7 +669435,7 @@ var SyncService = class extends import_shared60.TracedEventEmitter {
    */
   async flipTemplate({ targetTemplateName, migrationGeneration, selfRestart }) {
     if (!targetTemplateName) {
-      throw new import_shared61.BadRequestError("flipTemplate requires a non-empty targetTemplateName");
+      throw new import_shared62.BadRequestError("flipTemplate requires a non-empty targetTemplateName");
     }
     this.getLogger().info(`[sync-service] Flipping template to ${targetTemplateName}`);
     return this.fsOperation(async () => {
@@ -669523,8 +669807,8 @@ var SyncService = class extends import_shared60.TracedEventEmitter {
 
 // ../../../vite-plugin-file-sync/dist/lock-service/index.js
 init_cjs_shims();
-var import_shared63 = __toESM(require_dist2(), 1);
-var import_shared64 = __toESM(require_dist2(), 1);
+var import_shared64 = __toESM(require_dist2());
+var import_shared65 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/lock-service/activity-tracker.js
 init_cjs_shims();
@@ -669650,7 +669934,7 @@ var ActivityTracker = class {
 // ../../../vite-plugin-file-sync/dist/lock-service/index.js
 var LOCK_HEARTBEAT_INTERVAL_MS = 30 * 1e3;
 var LOCK_BUFFER_MS = 30 * 1e3;
-var STARTUP_CONNECTION_TIMEOUT_MS = 90 * 1e3;
+var STARTUP_CONNECTION_TIMEOUT_MS = 4 * 60 * 1e3;
 var LockServiceStatus;
 (function(LockServiceStatus2) {
   LockServiceStatus2["IDLE"] = "IDLE";
@@ -669666,7 +669950,7 @@ var LockType;
   LockType2["LOCAL"] = "local";
   LockType2["CSB"] = "csb";
 })(LockType || (LockType = {}));
-var LockService = class extends import_shared63.TracedEventEmitter {
+var LockService = class extends import_shared64.TracedEventEmitter {
   applicationId;
   branchName;
   lockType;
@@ -669692,7 +669976,6 @@ var LockService = class extends import_shared63.TracedEventEmitter {
   _rpcClient;
   _inactivityThresholdMs;
   _lockBufferMs;
-  _startupConnectionTimeoutMs;
   _startupConnectionTimeout;
   _startupConnectionTimeoutStartedAt;
   _startupConnectionTimeoutExpired = false;
@@ -669705,7 +669988,6 @@ var LockService = class extends import_shared63.TracedEventEmitter {
     this._inactivityThresholdMs = config4.inactivityThresholdMs;
     this.heartbeatIntervalMs = config4.heartbeatIntervalMs || LOCK_HEARTBEAT_INTERVAL_MS;
     this._lockBufferMs = config4.lockBufferMs || LOCK_BUFFER_MS;
-    this._startupConnectionTimeoutMs = config4.startupConnectionTimeoutMs ?? STARTUP_CONNECTION_TIMEOUT_MS;
     this._rpcClient = config4.rpcClient;
     this._tracer = config4.tracer;
     this._logger = config4.logger;
@@ -669725,7 +670007,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
       "shutdownAndExit",
       "restartInactivityTimer"
     ];
-    (0, import_shared63.addTracingToMethods)(this, methods, this._tracer);
+    (0, import_shared64.addTracingToMethods)(this, methods, this._tracer);
     void this.restartInactivityTimer();
   }
   getLogger() {
@@ -669784,7 +670066,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
       this.stopHeartbeat();
       try {
         const lockResponse = await this._rpcClient.call(async (client) => {
-          return (0, import_shared64.unwrapResponseDto)(client.call.v3.lock.transfer({
+          return (0, import_shared65.unwrapResponseDto)(client.call.v3.lock.transfer({
             applicationId: this.applicationId,
             fromBranchName: previousBranchName,
             toBranchName: nextBranchName,
@@ -669831,7 +670113,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
     this.stopHeartbeat();
     try {
       const lockResponse = await this._rpcClient.call(async (client) => {
-        return (0, import_shared64.unwrapResponseDto)(client.call.v3.lock.acquire({
+        return (0, import_shared65.unwrapResponseDto)(client.call.v3.lock.acquire({
           applicationId: this.applicationId,
           branchName: this.branchName,
           sessionType: this.lockType
@@ -669848,7 +670130,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
         return;
       }
     } catch (error40) {
-      if (error40 instanceof import_shared63.ConflictError) {
+      if (error40 instanceof import_shared64.ConflictError) {
         this.getLogger().error(`[lock-service] ${error40.message}`);
         this.emit("statusChange", LockServiceStatus.FAILED_TO_ACQUIRE_LOCK);
         this.status = LockServiceStatus.FAILED_TO_ACQUIRE_LOCK;
@@ -669878,7 +670160,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
         return true;
       }
       await this._rpcClient.call(async (client) => {
-        await (0, import_shared64.unwrapResponseDto)(client.call.v3.lock.release({
+        await (0, import_shared65.unwrapResponseDto)(client.call.v3.lock.release({
           applicationId: this.applicationId,
           branchName: this.branchName,
           lockId: lockIdToRelease
@@ -669889,7 +670171,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
       this.getLogger().info("[lock-service] lock released");
       return true;
     } catch (error40) {
-      if (error40 instanceof import_shared63.NotFoundError) {
+      if (error40 instanceof import_shared64.NotFoundError) {
         this.status = LockServiceStatus.LOCK_RELEASED;
         this.emit("statusChange", LockServiceStatus.LOCK_RELEASED);
         this.getLogger().warn("[lock-service] lock already released on server");
@@ -669914,7 +670196,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
   async grabLockImpl() {
     if (this._lockId) {
       const lockResponse = await this._rpcClient.call(async (client) => {
-        return (0, import_shared64.unwrapResponseDto)(client.call.v3.lock.grab({
+        return (0, import_shared65.unwrapResponseDto)(client.call.v3.lock.grab({
           applicationId: this.applicationId,
           branchName: this.branchName,
           lockId: this._lockId
@@ -669929,7 +670211,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
    */
   async inspectLock() {
     const lockInfo = await this._rpcClient.call(async (client) => {
-      return (0, import_shared64.unwrapResponseDto)(client.call.v3.lock.inspect({
+      return (0, import_shared65.unwrapResponseDto)(client.call.v3.lock.inspect({
         applicationId: this.applicationId,
         branchName: this.branchName
       }));
@@ -669944,7 +670226,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
     this.status = LockServiceStatus.ACQUIRING;
     try {
       const lockResponse = await this._rpcClient.call(async (client) => {
-        return (0, import_shared64.unwrapResponseDto)(client.call.v3.lock.forceTake({
+        return (0, import_shared65.unwrapResponseDto)(client.call.v3.lock.forceTake({
           applicationId: this.applicationId,
           branchName: this.branchName,
           sessionType: this.lockType
@@ -669976,7 +670258,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
           const returnedLock = response.appBranchLock[0];
           if (returnedLock.sessionType && returnedLock.sessionType !== this.lockType) {
             this.getLogger().warn(`[lock-service] lock fallback returned mismatched session type (${returnedLock.sessionType}) for expected ${this.lockType}; ignoring fallback lock`);
-            throw new import_shared63.NotFoundError("Lock not found");
+            throw new import_shared64.NotFoundError("Lock not found");
           }
           if (returnedLock.lockId && returnedLock.lockId !== this._lockId) {
             this.getLogger().info(`[lock-service] lock ID changed from ${this._lockId} to ${returnedLock.lockId} (cross-branch transfer)`);
@@ -669986,7 +670268,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
           return true;
         }
       } catch (error40) {
-        if (error40 instanceof import_shared63.NotFoundError) {
+        if (error40 instanceof import_shared64.NotFoundError) {
           this.getLogger().warn("[lock-service] lock not found during heartbeat grab, attempting to reacquire before shutdown");
           this.stopHeartbeat();
           this._lockId = void 0;
@@ -669996,7 +670278,7 @@ var LockService = class extends import_shared63.TracedEventEmitter {
             this.getLogger().info("[lock-service] lock reacquired after heartbeat grab miss");
             return true;
           } catch (reacquireError) {
-            if (reacquireError instanceof import_shared63.ConflictError) {
+            if (reacquireError instanceof import_shared64.ConflictError) {
               const message = "\u26A0\uFE0F  Edit access lost \u2013 another user has taken over this branch. Shutting down server.";
               if (process.env.SUPERBLOCKS_VSCODE === "true") {
                 this.getLogger().error(`clierr: ${JSON.stringify({ message })}`);
@@ -670161,17 +670443,17 @@ var LockService = class extends import_shared63.TracedEventEmitter {
     this._startupConnectionTimeoutStartedAt = void 0;
   }
   startStartupConnectionTimeoutIfNeeded() {
-    if (this._startupConnectionTimeoutStartedAt !== void 0 || this._startupConnectionTimeoutMs === void 0 || this._startupConnectionTimeoutMs <= 0) {
+    if (this._startupConnectionTimeoutStartedAt !== void 0) {
       return;
     }
     this.clearStartupConnectionTimeout();
     this._startupConnectionTimeoutStartedAt = Date.now();
-    this.getLogger().debug(`[lock-service] starting initial connection timeout window (${this._startupConnectionTimeoutMs}ms)`);
+    this.getLogger().info(`[lock-service] starting initial connection timeout window (${STARTUP_CONNECTION_TIMEOUT_MS}ms)`);
     this._startupConnectionTimeout = setTimeout(() => {
       this._startupConnectionTimeout = void 0;
       this._startupConnectionTimeoutExpired = true;
       this.evaluateStartupConnectionTimeoutIfNeeded();
-    }, this._startupConnectionTimeoutMs);
+    }, STARTUP_CONNECTION_TIMEOUT_MS);
     this._startupConnectionTimeout.unref();
   }
   evaluateStartupConnectionTimeoutIfNeeded() {
@@ -670184,10 +670466,10 @@ var LockService = class extends import_shared63.TracedEventEmitter {
     if (this._activityTracker.connectedUsers.length > 0) {
       return;
     }
-    this.getLogger().warn(`[lock-service] no socket connection detected within ${this._startupConnectionTimeoutMs}ms after initial lock acquisition, marking session inactive`);
+    this.getLogger().warn(`[lock-service] no socket connection detected within ${STARTUP_CONNECTION_TIMEOUT_MS}ms after initial lock acquisition, marking session inactive (lockId=${this._lockId}, appId=${this.applicationId})`);
     this._activityTracker.markDisconnectedDueToStartupTimeout();
     void this.evaluateLockState().catch((error40) => {
-      this.getLogger().error("[lock-service] failed to evaluate lock state after startup connection timeout", getErrorMeta2(error40));
+      this.getLogger().error(`[lock-service] failed to evaluate lock state after startup connection timeout (lockId=${this._lockId}, appId=${this.applicationId})`, getErrorMeta2(error40));
     });
   }
   /**
@@ -670279,12 +670561,12 @@ init_cjs_shims();
 
 // ../../../vite-plugin-file-sync/dist/server-rpc/client.js
 init_cjs_shims();
-var import_shared66 = __toESM(require_dist2());
+var import_shared67 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/package.json
 var package_default2 = {
   name: "@superblocksteam/vite-plugin-file-sync",
-  version: "2.0.141-next.0",
+  version: "2.0.141-next.1",
   keywords: [
     "vite-plugin"
   ],
@@ -670486,9 +670768,9 @@ var package_default2 = {
 
 // ../../../vite-plugin-file-sync/dist/server-rpc/handlers.js
 init_cjs_shims();
-var import_shared65 = __toESM(require_dist2());
+var import_shared66 = __toESM(require_dist2());
 async function notImplemented() {
-  throw new import_shared65.NotImplementedError("Signing methods are not implemented");
+  throw new import_shared66.NotImplementedError("Signing methods are not implemented");
 }
 function createRequestHandlers() {
   const requestHandlers = {
@@ -670505,11 +670787,11 @@ function createRequestHandlers() {
 }
 
 // ../../../vite-plugin-file-sync/dist/server-rpc/client.js
-var DEV_SERVER_USER_AGENT = (0, import_shared66.buildClientUserAgent)("superblocks-dev-server", package_default2.version);
+var DEV_SERVER_USER_AGENT = (0, import_shared67.buildClientUserAgent)("superblocks-dev-server", package_default2.version);
 async function connectToISocketRPCServer({ superblocksBaseUrl, token: token2, tracer: tracer3, onClose }) {
   const requestHandlers = createRequestHandlers();
   const authorization = `Bearer ${token2}`;
-  const wsUrl = new URL(`api/${import_shared66.serverWsPath}`, superblocksBaseUrl);
+  const wsUrl = new URL(`api/${import_shared67.serverWsPath}`, superblocksBaseUrl);
   if (wsUrl.protocol === "http:") {
     wsUrl.protocol = "ws:";
   } else if (wsUrl.protocol === "https:") {
@@ -670520,11 +670802,11 @@ async function connectToISocketRPCServer({ superblocksBaseUrl, token: token2, tr
   } else if (wsUrl.hostname === "localhost") {
     wsUrl.hostname = "127.0.0.1";
   }
-  const ws2 = await (0, import_shared66.connectWebSocket)(wsUrl.href, {
+  const ws2 = await (0, import_shared67.connectWebSocket)(wsUrl.href, {
     timeout: 5e3,
     headers: { "User-Agent": DEV_SERVER_USER_AGENT }
   });
-  const isocket = new import_shared66.ISocketWithClientAuth(ws2, authorization, requestHandlers, [], tracer3, {
+  const isocket = new import_shared67.ISocketWithClientAuth(ws2, authorization, requestHandlers, [], tracer3, {
     onClose,
     timeouts: {
       connectionTimeoutInSeconds: 6 * 60,
@@ -670533,7 +670815,7 @@ async function connectToISocketRPCServer({ superblocksBaseUrl, token: token2, tr
       // 5 minutes (for judge evaluation)
     }
   });
-  const client = (0, import_shared66.createISocketClient)(isocket);
+  const client = (0, import_shared67.createISocketClient)(isocket);
   return client;
 }
 
@@ -670649,7 +670931,7 @@ init_cjs_shims();
 var import_archiver2 = __toESM(require_archiver());
 var import_body_parser4 = __toESM(require_body_parser());
 init_lodash();
-var import_shared78 = __toESM(require_dist2());
+var import_shared79 = __toESM(require_dist2());
 import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, unlinkSync } from "node:fs";
 import path61 from "node:path";
 import { pipeline as pipeline5 } from "node:stream/promises";
@@ -670789,7 +671071,7 @@ init_cjs_shims();
 // ../../../vite-plugin-file-sync/dist/socket-manager.js
 init_cjs_shims();
 var import_ws = __toESM(require_ws());
-var import_shared72 = __toESM(require_dist2());
+var import_shared73 = __toESM(require_dist2());
 import { cp as cp3, mkdir as mkdir19, mkdtemp as mkdtemp2, rm as rm15 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join26 } from "node:path";
@@ -670833,7 +671115,7 @@ function parseGitLog(raw) {
 
 // ../../../vite-plugin-file-sync/dist/git-service/azure-devops-workflow.js
 init_cjs_shims();
-var import_shared67 = __toESM(require_dist2());
+var import_shared68 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/git-service/ensure-workflow-file.js
 init_cjs_shims();
@@ -670887,57 +671169,57 @@ function ensureAzureDevOpsWorkflowFile(gitService, superblocksBaseUrl) {
   return ensureWorkflowFile(gitService, {
     providerName: "azure-devops",
     workflowPath: AZURE_DEVOPS_PIPELINE_PATH,
-    isProviderRemoteUrl: import_shared67.isAzureDevOpsRemoteUrl,
-    buildWorkflowFromBaseUrl: import_shared67.buildAzureDevOpsSuperblocksSyncPipelineFromBaseUrl
+    isProviderRemoteUrl: import_shared68.isAzureDevOpsRemoteUrl,
+    buildWorkflowFromBaseUrl: import_shared68.buildAzureDevOpsSuperblocksSyncPipelineFromBaseUrl
   }, superblocksBaseUrl);
 }
 
 // ../../../vite-plugin-file-sync/dist/git-service/bitbucket-workflow.js
 init_cjs_shims();
-var import_shared68 = __toESM(require_dist2());
+var import_shared69 = __toESM(require_dist2());
 var BITBUCKET_PIPELINE_PATH = "bitbucket-pipelines.yml";
 function ensureBitbucketWorkflowFile(gitService, superblocksBaseUrl) {
   return ensureWorkflowFile(gitService, {
     providerName: "bitbucket",
     workflowPath: BITBUCKET_PIPELINE_PATH,
-    isProviderRemoteUrl: import_shared68.isBitbucketRemoteUrl,
-    buildWorkflowFromBaseUrl: import_shared68.buildBitbucketSuperblocksSyncPipelineFromBaseUrl
+    isProviderRemoteUrl: import_shared69.isBitbucketRemoteUrl,
+    buildWorkflowFromBaseUrl: import_shared69.buildBitbucketSuperblocksSyncPipelineFromBaseUrl
   }, superblocksBaseUrl);
 }
 
 // ../../../vite-plugin-file-sync/dist/git-service/github-workflow.js
 init_cjs_shims();
-var import_shared69 = __toESM(require_dist2());
+var import_shared70 = __toESM(require_dist2());
 var GITHUB_WORKFLOW_PATH = ".github/workflows/superblocks-sync.yml";
 function ensureGithubWorkflowFile(gitService, superblocksBaseUrl) {
   return ensureWorkflowFile(gitService, {
     providerName: "github",
     workflowPath: GITHUB_WORKFLOW_PATH,
-    isProviderRemoteUrl: import_shared69.isGitHubRemoteUrl,
-    buildWorkflowFromBaseUrl: import_shared69.buildGithubSuperblocksSyncWorkflowFromBaseUrl
+    isProviderRemoteUrl: import_shared70.isGitHubRemoteUrl,
+    buildWorkflowFromBaseUrl: import_shared70.buildGithubSuperblocksSyncWorkflowFromBaseUrl
   }, superblocksBaseUrl);
 }
 
 // ../../../vite-plugin-file-sync/dist/git-service/gitlab-workflow.js
 init_cjs_shims();
-var import_shared70 = __toESM(require_dist2());
+var import_shared71 = __toESM(require_dist2());
 var GITLAB_WORKFLOW_PATH = ".gitlab-ci.yml";
 function ensureGitlabWorkflowFile(gitService, superblocksBaseUrl) {
   return ensureWorkflowFile(gitService, {
     providerName: "gitlab",
     workflowPath: GITLAB_WORKFLOW_PATH,
-    isProviderRemoteUrl: import_shared70.isGitLabRemoteUrl,
-    buildWorkflowFromBaseUrl: import_shared70.buildGitlabSuperblocksSyncWorkflowFromBaseUrl
+    isProviderRemoteUrl: import_shared71.isGitLabRemoteUrl,
+    buildWorkflowFromBaseUrl: import_shared71.buildGitlabSuperblocksSyncWorkflowFromBaseUrl
   }, superblocksBaseUrl);
 }
 
 // ../../../vite-plugin-file-sync/dist/git-service/live-branch.js
 init_cjs_shims();
-var import_shared71 = __toESM(require_dist2());
+var import_shared72 = __toESM(require_dist2());
 async function ensureLiveBranchCheckedOut(gitService) {
   const logger25 = getLogger3();
   const currentBranch = await gitService.raw(["branch", "--show-current"]).then((branch) => branch.trim()).catch(() => "");
-  if (currentBranch === import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH) {
+  if (currentBranch === import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH) {
     return;
   }
   logger25.warn("[git] live branch mismatch detected", {
@@ -670945,10 +671227,10 @@ async function ensureLiveBranchCheckedOut(gitService) {
     gitOperation: "checkout-live-branch",
     gitOutcome: "fallback",
     currentBranch: currentBranch || "(detached)",
-    targetBranch: import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH
+    targetBranch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH
   });
   try {
-    await gitService.fetch("origin", import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH);
+    await gitService.fetch("origin", import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH);
   } catch (fetchErr) {
     const classified = classifyGitError(fetchErr);
     if (classified instanceof GitAuthError || classified instanceof GitPermissionError) {
@@ -670958,27 +671240,27 @@ async function ensureLiveBranchCheckedOut(gitService) {
       gitCategory: "branch",
       gitOperation: "checkout-live-branch",
       gitOutcome: "fetch_failed",
-      branch: import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH,
+      branch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH,
       ...getErrorMeta2(fetchErr)
     });
   }
   try {
-    await gitService.revparse(`origin/${import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
-    await gitService.checkoutOrCreate(import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH, `origin/${import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
+    await gitService.revparse(`origin/${import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
+    await gitService.checkoutOrCreate(import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH, `origin/${import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
     logger25.info("[git] live branch switched from remote", {
       gitCategory: "branch",
       gitOperation: "checkout-live-branch",
       gitOutcome: "succeeded",
-      targetBranch: import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH,
-      startPoint: `origin/${import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH}`
+      targetBranch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH,
+      startPoint: `origin/${import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH}`
     });
   } catch {
-    await gitService.checkoutOrCreate(import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH);
+    await gitService.checkoutOrCreate(import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH);
     logger25.info("[git] live branch created locally", {
       gitCategory: "branch",
       gitOperation: "checkout-live-branch",
       gitOutcome: "fallback",
-      targetBranch: import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH
+      targetBranch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH
     });
   }
 }
@@ -670988,15 +671270,15 @@ async function doesRemoteLiveBranchExist(gitService) {
       "ls-remote",
       "--heads",
       "origin",
-      `refs/heads/${import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH}`
+      `refs/heads/${import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH}`
     ]);
-    return remoteRefs.includes(`refs/heads/${import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
+    return remoteRefs.includes(`refs/heads/${import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
   } catch (error40) {
     getLogger3().warn("[git] live branch existence check failed", {
       gitCategory: "branch",
       gitOperation: "check-live-branch-exists",
       gitOutcome: "failed",
-      branch: import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH,
+      branch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH,
       message: error40 instanceof Error ? error40.message : String(error40)
     });
     return null;
@@ -671009,7 +671291,7 @@ async function pushLiveBranchWithAutoRecreate2(gitService) {
       gitCategory: "branch",
       gitOperation: "check-live-branch-exists",
       gitOutcome: "failed",
-      branch: import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH
+      branch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH
     });
   }
   try {
@@ -671017,14 +671299,14 @@ async function pushLiveBranchWithAutoRecreate2(gitService) {
       gitCategory: "commit",
       gitOperation: "push-live-branch",
       gitOutcome: "started",
-      branch: import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH
+      branch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH
     });
-    await gitService.push("origin", import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH);
+    await gitService.push("origin", import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH);
     getLogger3().info("[git] live branch push succeeded", {
       gitCategory: "commit",
       gitOperation: "push-live-branch",
       gitOutcome: "succeeded",
-      branch: import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH,
+      branch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH,
       recreated: false
     });
   } catch (pushError) {
@@ -671036,7 +671318,7 @@ async function pushLiveBranchWithAutoRecreate2(gitService) {
       gitCategory: "branch",
       gitOperation: "push-live-branch",
       gitOutcome: "fallback",
-      branch: import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH,
+      branch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH,
       fallback: "explicit-head-push",
       error: getErrorMeta2(pushError).error.message
     });
@@ -671044,13 +671326,13 @@ async function pushLiveBranchWithAutoRecreate2(gitService) {
     await gitService.raw([
       "push",
       "origin",
-      `HEAD:${import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH}`
+      `HEAD:${import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH}`
     ]);
     getLogger3().info("[git] live branch recreated on remote", {
       gitCategory: "branch",
       gitOperation: "push-live-branch",
       gitOutcome: "succeeded",
-      branch: import_shared71.SUPERBLOCKS_LIVE_GIT_BRANCH,
+      branch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH,
       recreated: true
     });
   }
@@ -671110,7 +671392,7 @@ function disposeSocketManager() {
   _socketManager?.dispose();
   _socketManager = void 0;
 }
-var SocketManager = class extends import_shared72.TracedEventEmitter {
+var SocketManager = class extends import_shared73.TracedEventEmitter {
   peerIds = /* @__PURE__ */ new Map();
   editorSockets = /* @__PURE__ */ new Set();
   librarySockets = /* @__PURE__ */ new Set();
@@ -671120,7 +671402,7 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
     super(tracer3);
   }
   socketServer;
-  startSocketServer({ server, fileSyncManager, syncService, lockService, aiService, gitService, gitBootstrapFailed, activateGitService, checkAuthorization, path: path80, tracer: tracer3, gitOperationLock, superblocksBaseUrl, maxPayloadBytes = import_shared72.MAX_SOCKET_PAYLOAD_BYTES }) {
+  startSocketServer({ server, fileSyncManager, syncService, lockService, aiService, gitService, gitBootstrapAuthFailed, gitBootstrapFailed, activateGitService, refreshGitCredentials, checkAuthorization, path: path80, tracer: tracer3, gitOperationLock, superblocksBaseUrl, maxPayloadBytes = import_shared73.MAX_SOCKET_PAYLOAD_BYTES }) {
     if (this.socketServer) {
       throw new Error("Socket server already started");
     }
@@ -671138,6 +671420,15 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
       });
     }
     let disconnectInProgress = false;
+    let runtimeGitAuthFailed = false;
+    const markRuntimeGitAuthFailed = (error40) => {
+      if (classifyGitError(error40) instanceof GitAuthError) {
+        runtimeGitAuthFailed = true;
+      }
+    };
+    const clearRuntimeGitAuthFailed = () => {
+      runtimeGitAuthFailed = false;
+    };
     const getActiveGitService = async () => {
       if (disconnectInProgress) {
         return void 0;
@@ -671165,6 +671456,7 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
           }
           activeGitService = activated;
           if (activeGitService) {
+            clearRuntimeGitAuthFailed();
             await ensureLiveBranchCheckedOut(activeGitService);
             if (disconnectInProgress) {
               return void 0;
@@ -671273,7 +671565,7 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
       };
       const recordingMiddleware = aiService ? createSocketRecordingMiddleware(aiService.getRecordingManager()) : void 0;
       const middlewares = [recordingMiddleware, authMiddleware].filter((m2) => m2 != null);
-      const socket = (0, import_shared72.createISocketClient)(new import_shared72.TracedSocket(ws2, {
+      const socket = (0, import_shared73.createISocketClient)(new import_shared73.TracedSocket(ws2, {
         editor: {
           // Renames
           renameElement: [fileSyncManager.handleRenameElement],
@@ -671564,7 +671856,7 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
                 if (!readyGitService) {
                   throw new Error("Git is not configured for this application");
                 }
-                await readyGitService.fetch("origin", import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH).catch((fetchErr) => {
+                await readyGitService.fetch("origin", import_shared73.SUPERBLOCKS_LIVE_GIT_BRANCH).catch((fetchErr) => {
                   const msg = fetchErr instanceof Error ? fetchErr.message : String(fetchErr);
                   if (!msg.includes("couldn't find remote ref")) {
                     throw fetchErr;
@@ -671608,6 +671900,7 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
                 return { sha: result.commit };
               } catch (error40) {
                 getLogger3().error("[git] gitCommitLocal failed", getErrorMeta2(error40));
+                markRuntimeGitAuthFailed(error40);
                 throw error40;
               }
             })
@@ -671620,8 +671913,10 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
                   throw new Error("Git is not configured for this application");
                 }
                 await pushLiveBranchWithAutoRecreate2(readyGitService);
+                clearRuntimeGitAuthFailed();
               } catch (error40) {
                 getLogger3().error("[git] gitPushLiveBranch failed", getErrorMeta2(error40));
+                markRuntimeGitAuthFailed(error40);
                 throw error40;
               }
             })
@@ -671640,87 +671935,97 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
           ],
           gitPull: [
             async (_request, _context) => runWithGitLock(async () => {
-              const readyGitService = await getActiveGitService();
-              if (!readyGitService) {
-                throw new Error("Git is not configured for this application");
-              }
-              await readyGitService.fetch();
-              await assertIncomingLiveLayout(readyGitService);
-              const status = await readyGitService.status();
-              const hasLocalChanges = status.files.length > 0;
-              if (hasLocalChanges) {
-                await readyGitService.add(".");
-                await readyGitService.stash();
-              }
-              let hasConflicts = false;
-              let merged = false;
               try {
-                const mergeResult = await readyGitService.mergeRef(`origin/${import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
-                merged = !mergeResult.alreadyUpToDate;
-                if (merged) {
-                  const unmerged = await readyGitService.getConflictedFiles();
-                  if (unmerged.length > 0) {
-                    hasConflicts = true;
-                  }
+                const readyGitService = await getActiveGitService();
+                if (!readyGitService) {
+                  throw new Error("Git is not configured for this application");
                 }
-              } catch (mergeError) {
-                if (!(mergeError instanceof GitConflictError)) {
-                  getLogger3().error("[git] gitPull: merge failed (non-conflict), aborting", getErrorMeta2(mergeError));
-                  try {
-                    await readyGitService.raw(["merge", "--abort"]);
-                  } catch (abortErr) {
-                    getLogger3().warn(`[git] gitPull: merge --abort failed: ${abortErr instanceof Error ? abortErr.message : String(abortErr)}`);
+                await readyGitService.fetch();
+                await assertIncomingLiveLayout(readyGitService);
+                const status = await readyGitService.status();
+                const hasLocalChanges = status.files.length > 0;
+                if (hasLocalChanges) {
+                  await readyGitService.add(".");
+                  await readyGitService.stash();
+                }
+                let hasConflicts = false;
+                let merged = false;
+                try {
+                  const mergeResult = await readyGitService.mergeRef(`origin/${import_shared73.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
+                  merged = !mergeResult.alreadyUpToDate;
+                  if (merged) {
+                    const unmerged = await readyGitService.getConflictedFiles();
+                    if (unmerged.length > 0) {
+                      hasConflicts = true;
+                    }
                   }
-                  if (hasLocalChanges) {
+                } catch (mergeError) {
+                  if (!(mergeError instanceof GitConflictError)) {
+                    getLogger3().error("[git] gitPull: merge failed (non-conflict), aborting", getErrorMeta2(mergeError));
                     try {
-                      await readyGitService.stashPop();
-                    } catch (popErr) {
-                      getLogger3().warn(`[git] gitPull: stash pop after merge abort failed: ${popErr instanceof Error ? popErr.message : String(popErr)}`);
+                      await readyGitService.raw(["merge", "--abort"]);
+                    } catch (abortErr) {
+                      getLogger3().warn(`[git] gitPull: merge --abort failed: ${abortErr instanceof Error ? abortErr.message : String(abortErr)}`);
                     }
+                    if (hasLocalChanges) {
+                      try {
+                        await readyGitService.stashPop();
+                      } catch (popErr) {
+                        getLogger3().warn(`[git] gitPull: stash pop after merge abort failed: ${popErr instanceof Error ? popErr.message : String(popErr)}`);
+                      }
+                    }
+                    throw mergeError;
                   }
-                  throw mergeError;
+                  merged = true;
+                  hasConflicts = true;
                 }
-                merged = true;
-                hasConflicts = true;
-              }
-              if (hasLocalChanges) {
-                try {
-                  await readyGitService.stashPop();
-                } catch (popError) {
-                  if (popError instanceof GitConflictError) {
-                    hasConflicts = true;
-                  } else {
-                    getLogger3().error("[git] gitPull: stash pop failed (non-conflict)", getErrorMeta2(popError));
-                    throw popError;
+                if (hasLocalChanges) {
+                  try {
+                    await readyGitService.stashPop();
+                  } catch (popError) {
+                    if (popError instanceof GitConflictError) {
+                      hasConflicts = true;
+                    } else {
+                      getLogger3().error("[git] gitPull: stash pop failed (non-conflict)", getErrorMeta2(popError));
+                      throw popError;
+                    }
                   }
-                }
-                if (!hasConflicts) {
-                  const unmerged = await readyGitService.getConflictedFiles();
-                  if (unmerged.length > 0) {
-                    hasConflicts = true;
+                  if (!hasConflicts) {
+                    const unmerged = await readyGitService.getConflictedFiles();
+                    if (unmerged.length > 0) {
+                      hasConflicts = true;
+                    }
                   }
                 }
+                if (hasConflicts) {
+                  const conflictedFiles = await readyGitService.getConflictedFiles();
+                  getLogger3().warn("[git] pull conflict detected", {
+                    gitCategory: "pull",
+                    gitOperation: "pull",
+                    gitOutcome: "conflict",
+                    branch: import_shared73.SUPERBLOCKS_LIVE_GIT_BRANCH,
+                    conflictedFileCount: conflictedFiles.length,
+                    conflictedFiles
+                  });
+                  clearRuntimeGitAuthFailed();
+                  return { merged: false, conflictedFiles };
+                }
+                clearRuntimeGitAuthFailed();
+                return { merged };
+              } catch (error40) {
+                markRuntimeGitAuthFailed(error40);
+                throw error40;
               }
-              if (hasConflicts) {
-                const conflictedFiles = await readyGitService.getConflictedFiles();
-                getLogger3().warn("[git] pull conflict detected", {
-                  gitCategory: "pull",
-                  gitOperation: "pull",
-                  gitOutcome: "conflict",
-                  branch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH,
-                  conflictedFileCount: conflictedFiles.length,
-                  conflictedFiles
-                });
-                return { merged: false, conflictedFiles };
-              }
-              return { merged };
             })
           ],
           gitSyncStatus: [
             async () => {
               const readyGitService = await getActiveGitService();
               if (!readyGitService) {
-                return gitBootstrapFailed ? { bootstrapFailed: true } : null;
+                return gitBootstrapFailed ? {
+                  authFailed: gitBootstrapAuthFailed,
+                  bootstrapFailed: true
+                } : null;
               }
               let hasUncommittedChanges = false;
               try {
@@ -671739,17 +672044,29 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
               let ahead = 0;
               let behind = 0;
               try {
-                await readyGitService.fetch("origin", import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH);
-                const counts = await readyGitService.revList("HEAD", `origin/${import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
-                ahead = counts.ahead;
-                behind = counts.behind;
+                let missingRemoteLiveBranch = false;
+                await readyGitService.fetch("origin", import_shared73.SUPERBLOCKS_LIVE_GIT_BRANCH).catch((fetchErr) => {
+                  const msg = fetchErr instanceof Error ? fetchErr.message : String(fetchErr);
+                  if (msg.includes("couldn't find remote ref")) {
+                    missingRemoteLiveBranch = true;
+                    return;
+                  }
+                  throw fetchErr;
+                });
+                if (!missingRemoteLiveBranch) {
+                  const counts = await readyGitService.revList("HEAD", `origin/${import_shared73.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
+                  ahead = counts.ahead;
+                  behind = counts.behind;
+                }
+                clearRuntimeGitAuthFailed();
               } catch (fetchErr) {
+                markRuntimeGitAuthFailed(fetchErr);
                 getLogger3().warn("[git] gitSyncStatus fetch/revList failed", {
                   gitCategory: "status",
                   gitOperation: "syncStatus",
                   gitOutcome: "failed",
                   gitErrorKind: "fetch_or_rev_list_failed",
-                  branch: import_shared72.SUPERBLOCKS_LIVE_GIT_BRANCH,
+                  branch: import_shared73.SUPERBLOCKS_LIVE_GIT_BRANCH,
                   remote: "origin",
                   ...getErrorMeta2(fetchErr)
                 });
@@ -671770,7 +672087,8 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
                 behind,
                 hasUncommittedChanges,
                 aheadOfDefaultBranch,
-                isLiveBranchMissing
+                isLiveBranchMissing,
+                remoteAuthFailed: runtimeGitAuthFailed
               };
             }
           ],
@@ -671800,20 +672118,37 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
           gitActivate: [
             async () => runWithGitLock(async () => {
               disconnectInProgress = false;
+              clearRuntimeGitAuthFailed();
               const service = await getActiveGitService();
               return { activated: !!service };
             })
           ],
+          gitRefreshCredentials: [
+            async () => runWithGitLock(async () => {
+              if (!refreshGitCredentials) {
+                return { refreshed: false };
+              }
+              const service = await refreshGitCredentials();
+              if (!service) {
+                return { refreshed: false };
+              }
+              activeGitService = service;
+              clearRuntimeGitAuthFailed();
+              aiService?.setRuntimeGitServices(service, syncService, gitOperationLock);
+              return { refreshed: true };
+            })
+          ],
           gitDisconnect: [
             async () => runWithGitLock(async () => {
               const serviceToDisconnect = activeGitService;
               activeGitService = void 0;
               disconnectInProgress = true;
-              syncService?.setBranchName(import_shared72.DEFAULT_NON_GIT_BRANCH);
+              clearRuntimeGitAuthFailed();
+              syncService?.setBranchName(import_shared73.DEFAULT_NON_GIT_BRANCH);
               if (lockService) {
                 const wasLockedBeforeDisconnect = lockService.isLocked;
                 try {
-                  await lockService.switchBranch(import_shared72.DEFAULT_NON_GIT_BRANCH, {
+                  await lockService.switchBranch(import_shared73.DEFAULT_NON_GIT_BRANCH, {
                     reacquireLock: wasLockedBeforeDisconnect
                   });
                 } catch (err) {
@@ -671825,7 +672160,7 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
                     ...getErrorMeta2(err)
                   });
                   try {
-                    await lockService.switchBranch(import_shared72.DEFAULT_NON_GIT_BRANCH, {
+                    await lockService.switchBranch(import_shared73.DEFAULT_NON_GIT_BRANCH, {
                       reacquireLock: false
                     });
                     if (wasLockedBeforeDisconnect) {
@@ -671844,7 +672179,7 @@ var SocketManager = class extends import_shared72.TracedEventEmitter {
               }
               if (serviceToDisconnect) {
                 const gitDir = join26(serviceToDisconnect.workDir, ".git");
-                let checkoutBranchBeforeDisconnect = import_shared72.DEFAULT_NON_GIT_BRANCH;
+                let checkoutBranchBeforeDisconnect = import_shared73.DEFAULT_NON_GIT_BRANCH;
                 try {
                   checkoutBranchBeforeDisconnect = await serviceToDisconnect.getDefaultBranch();
                 } catch (defaultBranchErr) {
@@ -672244,7 +672579,7 @@ import nodePath from "node:path";
 init_lodash();
 var import_yaml9 = __toESM(require_dist());
 import { normalizePath as normalizePath11 } from "vite";
-var import_shared75 = __toESM(require_dist2());
+var import_shared76 = __toESM(require_dist2());
 var import_util37 = __toESM(require_dist3());
 
 // ../../../vite-plugin-file-sync/dist/codegen.js
@@ -673612,21 +673947,21 @@ var t13 = __toESM(require_lib10());
 init_cjs_shims();
 var import_esprima2 = __toESM(require_esprima());
 init_lodash();
-var import_shared73 = __toESM(require_dist2());
+var import_shared74 = __toESM(require_dist2());
 var extractPythonEvaluationPairs2 = async (code, entities, dataTree, namespacedEntitiesToExtract) => {
-  return (0, import_shared73.extractPythonEvaluationPairsWithParser)(code, entities, dataTree, parser, namespacedEntitiesToExtract);
+  return (0, import_shared74.extractPythonEvaluationPairsWithParser)(code, entities, dataTree, parser, namespacedEntitiesToExtract);
 };
 var extractJsEvaluationPairs2 = async (jsSnippet, entitiesToExtract, dataTree, namespacedEntitiesToExtract) => {
-  return (0, import_shared73.extractJsEvaluationPairsWithTokenizer)(jsSnippet, entitiesToExtract, dataTree, import_esprima2.tokenize, namespacedEntitiesToExtract);
+  return (0, import_shared74.extractJsEvaluationPairsWithTokenizer)(jsSnippet, entitiesToExtract, dataTree, import_esprima2.tokenize, namespacedEntitiesToExtract);
 };
 function getExtractorByPluginId(pluginId) {
   if (!pluginId) {
     return extractJsEvaluationPairs2;
   }
   switch (pluginId.trim().toLowerCase()) {
-    case import_shared73.LanguagePluginID.Python:
+    case import_shared74.LanguagePluginID.Python:
       return extractPythonEvaluationPairs2;
-    case import_shared73.LanguagePluginID.JavaScript:
+    case import_shared74.LanguagePluginID.JavaScript:
     default:
       return extractJsEvaluationPairs2;
   }
@@ -673635,14 +673970,14 @@ async function refactorNameInBlocks(params) {
   const { blocks, oldName, newName, namespace } = params;
   const flattenedBlocks = flattenBlocks(blocks);
   for (const block of flattenedBlocks) {
-    const pluginType = (0, import_shared73.getPluginType)(block) ?? void 0;
+    const pluginType = (0, import_shared74.getPluginType)(block) ?? void 0;
     const extractor = getExtractorByPluginId(pluginType);
-    if ((0, import_shared73.isStepBlock)(block) && pluginType) {
+    if ((0, import_shared74.isStepBlock)(block) && pluginType) {
       const configuration = block.config[pluginType];
       if (typeof configuration !== "object" || configuration == null) {
         continue;
       }
-      await (0, import_shared73.refactorNameInStep)({
+      await (0, import_shared74.refactorNameInStep)({
         ...params,
         dataTree: {
           [newName]: {},
@@ -673652,9 +673987,9 @@ async function refactorNameInBlocks(params) {
         configuration,
         extractor
       });
-    } else if ((0, import_shared73.isControlBlock)(block)) {
+    } else if ((0, import_shared74.isControlBlock)(block)) {
       for (const [value2, setValue] of getSetControlBlockExpressions2(block)) {
-        const newValue = await (0, import_shared73.refactorNameInString)({
+        const newValue = await (0, import_shared74.refactorNameInString)({
           value: value2,
           oldName,
           newName,
@@ -673684,34 +674019,34 @@ function getSetControlBlockExpressions2(block) {
   const { config: config4, type } = block;
   const results = [];
   switch (type) {
-    case import_shared73.BlockType.BREAK: {
+    case import_shared74.BlockType.BREAK: {
       const controlConfig = config4;
       results.push(makeGetSet2(controlConfig, "condition"));
       break;
     }
-    case import_shared73.BlockType.THROW: {
+    case import_shared74.BlockType.THROW: {
       const controlConfig = config4;
       results.push(makeGetSet2(controlConfig, "error"));
       break;
     }
-    case import_shared73.BlockType.RETURN: {
+    case import_shared74.BlockType.RETURN: {
       const controlConfig = config4;
       results.push(makeGetSet2(controlConfig, "data"));
       break;
     }
-    case import_shared73.BlockType.WAIT: {
+    case import_shared74.BlockType.WAIT: {
       const controlConfig = config4;
       results.push(makeGetSet2(controlConfig, "condition"));
       break;
     }
-    case import_shared73.BlockType.PARALLEL: {
+    case import_shared74.BlockType.PARALLEL: {
       const controlConfig = config4;
       if (controlConfig.dynamic) {
         results.push(makeGetSet2(controlConfig.dynamic, "paths"));
       }
       break;
     }
-    case import_shared73.BlockType.CONDITION: {
+    case import_shared74.BlockType.CONDITION: {
       const controlConfig = config4;
       if (controlConfig.if) {
         results.push(makeGetSet2(controlConfig.if, "condition"));
@@ -673721,15 +674056,15 @@ function getSetControlBlockExpressions2(block) {
       }
       break;
     }
-    case import_shared73.BlockType.LOOP: {
+    case import_shared74.BlockType.LOOP: {
       const controlConfig = config4;
       results.push(makeGetSet2(controlConfig, "range"));
       break;
     }
-    case import_shared73.BlockType.TRY_CATCH: {
+    case import_shared74.BlockType.TRY_CATCH: {
       break;
     }
-    case import_shared73.BlockType.VARIABLES: {
+    case import_shared74.BlockType.VARIABLES: {
       const controlConfig = config4;
       for (const variable of controlConfig.items) {
         if (variable.value) {
@@ -673738,12 +674073,12 @@ function getSetControlBlockExpressions2(block) {
       }
       break;
     }
-    case import_shared73.BlockType.SEND: {
+    case import_shared74.BlockType.SEND: {
       const controlConfig = config4;
       results.push(makeGetSet2(controlConfig, "message"));
       break;
     }
-    case import_shared73.BlockType.STREAM: {
+    case import_shared74.BlockType.STREAM: {
       break;
     }
     default: {
@@ -673757,7 +674092,7 @@ function getSetControlBlockExpressions2(block) {
 // ../../../vite-plugin-file-sync/dist/refactor/javascript.js
 init_cjs_shims();
 var t12 = __toESM(require_lib10());
-var import_shared74 = __toESM(require_dist2());
+var import_shared75 = __toESM(require_dist2());
 function renameEntityInJavascript({ oldName, newName, nodePath: nodePath2, parentBinding, checkFunctionBinding = false }) {
   const functionVisitor = checkFunctionBinding ? {
     Function(path80) {
@@ -694488,7 +694823,7 @@ var parseYaml3;
 async function loadYaml(file2) {
   const content18 = await read_file_default(file2);
   if (!parseYaml3) {
-    ({ __parsePrettierYamlConfig: parseYaml3 } = await import("./yaml-EU2JTNYQ.js"));
+    ({ __parsePrettierYamlConfig: parseYaml3 } = await import("./yaml-E452PT2S.js"));
   }
   try {
     return parseYaml3(content18);
@@ -699882,7 +700217,7 @@ function createParsersAndPrinters(modules) {
 }
 var estreePlugin = createParsersAndPrinters([
   {
-    importPlugin: () => import("./estree-G6A3CLHM.js"),
+    importPlugin: () => import("./estree-IGFHWX3W.js"),
     printers: ["estree", "estree-json"]
   }
 ]);
@@ -699906,11 +700241,11 @@ var languages = [
 ];
 var { parsers: parsers12, printers } = createParsersAndPrinters([
   {
-    importPlugin: () => import("./acorn-DJYL2AMA.js"),
+    importPlugin: () => import("./acorn-33PDNT4G.js"),
     parsers: ["acorn", "espree"]
   },
   {
-    importPlugin: () => import("./angular-D4OXWSTQ.js"),
+    importPlugin: () => import("./angular-JI4DJHZ6.js"),
     parsers: [
       "__ng_action",
       "__ng_binding",
@@ -699919,7 +700254,7 @@ var { parsers: parsers12, printers } = createParsersAndPrinters([
     ]
   },
   {
-    importPlugin: () => import("./babel-E2YRPG6X.js"),
+    importPlugin: () => import("./babel-O5SHO5HA.js"),
     parsers: [
       "babel",
       "babel-flow",
@@ -699938,44 +700273,44 @@ var { parsers: parsers12, printers } = createParsersAndPrinters([
     ]
   },
   {
-    importPlugin: () => import("./flow-SOAATWPH.js"),
+    importPlugin: () => import("./flow-K6ENOKSA.js"),
     parsers: ["flow"]
   },
   {
-    importPlugin: () => import("./glimmer-AAPXV3KF.js"),
+    importPlugin: () => import("./glimmer-J22DQNP7.js"),
     parsers: ["glimmer"],
     printers: ["glimmer"]
   },
   {
-    importPlugin: () => import("./graphql-BLB7FCAN.js"),
+    importPlugin: () => import("./graphql-PA3QKIAK.js"),
     parsers: ["graphql"],
     printers: ["graphql"]
   },
   {
-    importPlugin: () => import("./html-QYMNEYJ4.js"),
+    importPlugin: () => import("./html-IZ5VQFTA.js"),
     parsers: ["html", "angular", "vue", "lwc", "mjml"],
     printers: ["html"]
   },
   {
-    importPlugin: () => import("./markdown-5A6WF6FY.js"),
+    importPlugin: () => import("./markdown-FVGVAVL4.js"),
     parsers: ["markdown", "mdx", "remark"],
     printers: ["mdast"]
   },
   {
-    importPlugin: () => import("./meriyah-DTNGYWT2.js"),
+    importPlugin: () => import("./meriyah-QEL5Q3O3.js"),
     parsers: ["meriyah"]
   },
   {
-    importPlugin: () => import("./postcss-KSVRPJLF.js"),
+    importPlugin: () => import("./postcss-YBLMJPFI.js"),
     parsers: ["css", "less", "scss"],
     printers: ["postcss"]
   },
   {
-    importPlugin: () => import("./typescript-PQSNN2AA.js"),
+    importPlugin: () => import("./typescript-3QAPWCSE.js"),
     parsers: ["typescript"]
   },
   {
-    importPlugin: () => import("./yaml-EU2JTNYQ.js"),
+    importPlugin: () => import("./yaml-E452PT2S.js"),
     parsers: ["yaml"],
     printers: ["yaml"]
   }
@@ -700635,7 +700970,7 @@ var SUPPORTED_FILETYPES = [
     extension: ".md"
   }
 ];
-var FileSystemManager = class extends import_shared75.TracedEventEmitter {
+var FileSystemManager = class extends import_shared76.TracedEventEmitter {
   rootDir;
   tsFiles = {};
   apiFiles = {};
@@ -700676,7 +701011,7 @@ var FileSystemManager = class extends import_shared75.TracedEventEmitter {
       "handleRenameApi",
       "handleRenameElement"
     ];
-    (0, import_shared75.addTracingToMethods)(this, methods, tracer3);
+    (0, import_shared76.addTracingToMethods)(this, methods, tracer3);
   }
   get appFilePath() {
     if (!this.rootDir) {
@@ -701854,7 +702189,7 @@ var import_body_parser = __toESM(require_body_parser());
 var import_yaml12 = __toESM(require_dist());
 import { access as access9, mkdir as mkdir21, readFile as readFile23, readdir as readdir16, rm as rm17, writeFile as writeFile18 } from "node:fs/promises";
 import { dirname as dirname22, join as join37 } from "node:path";
-var import_shared77 = __toESM(require_dist2());
+var import_shared78 = __toESM(require_dist2());
 
 // ../../../vite-plugin-file-sync/dist/migration/get-fullstack-template-dir.js
 init_cjs_shims();
@@ -703415,9 +703750,9 @@ init_cjs_shims();
 init_cjs_shims();
 
 // ../../../vite-plugin-file-sync/dist/migration/unsupported-integrations.js
-var import_shared76 = __toESM(require_dist2());
+var import_shared77 = __toESM(require_dist2());
 var SUPPORTED_PLUGIN_ID_SET = new Set(SUPPORTED_PLUGIN_IDS);
-var CODE_EXECUTION_PLUGIN_ID_SET = new Set(Object.values(import_shared76.LanguagePluginID));
+var CODE_EXECUTION_PLUGIN_ID_SET = new Set(Object.values(import_shared77.LanguagePluginID));
 var IGNORED_ROOT_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "scratch"]);
 var IGNORED_DIRS_ANY_DEPTH = /* @__PURE__ */ new Set([
   ".git",
@@ -703685,7 +704020,7 @@ async function findLiveApiYamls(rootDir) {
   }
   return results.sort();
 }
-var LANGUAGE_PLUGIN_IDS3 = new Set(Object.values(import_shared77.LanguagePluginID));
+var LANGUAGE_PLUGIN_IDS3 = new Set(Object.values(import_shared78.LanguagePluginID));
 async function extractIntegrationsFromYamls(yamlPaths) {
   const integrationSteps = /* @__PURE__ */ new Map();
   for (const yamlPath of yamlPaths) {
@@ -705241,6 +705576,28 @@ function createGenerationFreshnessTracker() {
     isLatest: (generationId) => generationId === latestGenerationId
   };
 }
+async function handleTokenUpdateRequest({ authorization, checkAuthorization, logger: logger25, tokenManager }) {
+  if (!authorization?.startsWith("Bearer ")) {
+    return {
+      statusCode: 401,
+      body: JSON.stringify({ error: "Invalid authorization header" })
+    };
+  }
+  const result = await checkAuthorization(authorization);
+  if (!result.success) {
+    return {
+      statusCode: result.status,
+      body: JSON.stringify({ error: result.error })
+    };
+  }
+  if (!tokenManager) {
+    logger25.warn("[auth] token refresh received without a tokenManager");
+    return { statusCode: 204 };
+  }
+  tokenManager.updateToken(authorization.substring("Bearer ".length));
+  logger25.info("[auth] updated tokenManager from editor token refresh");
+  return { statusCode: 204 };
+}
 async function handleGenerationCompletedFileSync({ aiService, contextFlushScheduler, hasHadAnyDrafts, isFirstContentfulGeneration, isLatestGeneration = () => true, logger: logger25, producedDraft, server, syncService }) {
   logger25.info("[file-sync] generationCompleted event received", {
     applicationId: syncService.applicationId,
@@ -705312,6 +705669,7 @@ function fileSyncVitePlugin(pluginParams, options8) {
   const aiService = pluginParams.aiService;
   const gitService = pluginParams.gitService;
   const activateGitService = pluginParams.activateGitService;
+  const refreshGitCredentials = pluginParams.refreshGitCredentials;
   const gitOperationLock = createGitOperationLock();
   const fsOperationQueue = pluginParams.fsOperationQueue;
   const httpServer2 = pluginParams.httpServer;
@@ -705432,6 +705790,40 @@ function fileSyncVitePlugin(pluginParams, options8) {
         aiService.setViteServer(server);
         aiService.setRuntimeGitServices(gitService, syncService, gitOperationLock);
       }
+      server.middlewares.use("/_sb_update_token", (req, res) => {
+        void (async () => {
+          if (req.method !== "POST" && req.method !== "OPTIONS") {
+            res.statusCode = 405;
+            res.end("Method not allowed");
+            return;
+          }
+          if (req.method === "OPTIONS") {
+            res.statusCode = 204;
+            res.end();
+            return;
+          }
+          const result = await handleTokenUpdateRequest({
+            authorization: req.headers.authorization,
+            checkAuthorization: pluginParams.checkAuthorization,
+            logger: logger25,
+            tokenManager: pluginParams.tokenManager
+          });
+          res.statusCode = result.statusCode;
+          if (result.body) {
+            res.setHeader("Content-Type", "application/json");
+            res.end(result.body);
+          } else {
+            res.end();
+          }
+        })().catch((error40) => {
+          logger25.error("Error updating auth token", getErrorMeta2(error40));
+          if (!res.headersSent) {
+            res.statusCode = 500;
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ error: "Failed to update auth token" }));
+          }
+        });
+      });
       server.middlewares.use((req, res, next2) => {
         void indexHtmlMiddleware(server, pluginParams?.features)(req, res, next2);
       });
@@ -705676,8 +706068,10 @@ function fileSyncVitePlugin(pluginParams, options8) {
             syncService,
             aiService,
             gitService,
+            gitBootstrapAuthFailed: pluginParams.gitBootstrapAuthFailed,
             gitBootstrapFailed: pluginParams.gitBootstrapFailed,
             activateGitService,
+            refreshGitCredentials,
             checkAuthorization: pluginParams.checkAuthorization,
             tracer: pluginParams.tracer,
             path: "/sb-updates",
@@ -705744,7 +706138,7 @@ function fileSyncVitePlugin(pluginParams, options8) {
           pageId: apiPb.trigger?.application?.pageId,
           organizationId: apiPb.metadata?.organization,
           updated: apiPb.metadata?.timestamps?.updated ? new Date(apiPb.metadata?.timestamps?.updated) : void 0,
-          triggerType: import_shared78.ApiTriggerType.UI,
+          triggerType: import_shared79.ApiTriggerType.UI,
           apiPb
         };
       };
@@ -706422,7 +706816,7 @@ async function getAppScope(fileSyncManager) {
     pageId: apiPb.trigger?.application?.pageId,
     organizationId: apiPb.metadata.organization,
     updated: apiPb.metadata?.timestamps?.updated ? new Date(apiPb.metadata?.timestamps?.updated) : void 0,
-    triggerType: import_shared78.ApiTriggerType.UI,
+    triggerType: import_shared79.ApiTriggerType.UI,
     apiPb,
     scopeId
   }));
@@ -706517,7 +706911,7 @@ function generateApiBuildManifestPlugin(root3) {
   };
   viteLogger.clearScreen = () => {
   };
-  const sdkApiEnabled = (0, import_shared79.isSdkApiTemplate)(process.env.SUPERBLOCKS_APP_TEMPLATE_NAME);
+  const sdkApiEnabled = (0, import_shared80.isSdkApiTemplate)(process.env.SUPERBLOCKS_APP_TEMPLATE_NAME);
   const apiFiles = {};
   let manifestCode = "export default {};";
   return {
@@ -711410,7 +711804,7 @@ init_lodash();
 var import_semver3 = __toESM(require_semver2(), 1);
 var import_slugify = __toESM(require_slugify(), 1);
 var import_yaml14 = __toESM(require_dist(), 1);
-var import_shared80 = __toESM(require_dist2(), 1);
+var import_shared81 = __toESM(require_dist2(), 1);
 var import_util45 = __toESM(require_dist3(), 1);
 var LATEST_EDITS_MODE = "latest-edits";
 var DRAFT_MODE = "draft";
@@ -711430,13 +711824,13 @@ var FileStructureType;
 function modeFlagToViewMode(modeFlag) {
   switch (modeFlag) {
     case LATEST_EDITS_MODE:
-      return import_shared80.ExportViewMode.EXPORT_LIVE;
+      return import_shared81.ExportViewMode.EXPORT_LIVE;
     case MOST_RECENT_COMMIT_MODE:
-      return import_shared80.ExportViewMode.EXPORT_LATEST;
+      return import_shared81.ExportViewMode.EXPORT_LATEST;
     case DEPLOYED_MODE:
-      return import_shared80.ExportViewMode.EXPORT_DEPLOYED;
+      return import_shared81.ExportViewMode.EXPORT_DEPLOYED;
     case DRAFT_MODE:
-      return import_shared80.ExportViewMode.EXPORT_DRAFT;
+      return import_shared81.ExportViewMode.EXPORT_DRAFT;
     default:
       throw new Error(`Unsupported mode flag: ${modeFlag}`);
   }
@@ -711856,7 +712250,7 @@ async function writeCodeModeApplicationToDisk(sdk, resource, appDirName, directo
     } else {
       await sdk.dbfsGetApplication({
         applicationId: resource.application.id,
-        branch: branch ?? import_shared80.DEFAULT_BRANCH,
+        branch: branch ?? import_shared81.DEFAULT_BRANCH,
         localDirectoryPath: appDirName
       });
     }
@@ -712200,12 +712594,12 @@ import path70 from "node:path";
 var import_form_data2 = __toESM(require_form_data());
 init_lodash();
 var import_bucketeer_sdk = __toESM(require_dist15());
-var import_shared83 = __toESM(require_dist2());
+var import_shared84 = __toESM(require_dist2());
 var import_util48 = __toESM(require_dist3());
 
 // ../sdk/dist/dbfs/local.js
 init_cjs_shims();
-var import_shared81 = __toESM(require_dist2());
+var import_shared82 = __toESM(require_dist2());
 var import_util46 = __toESM(require_dist3());
 import * as fsp4 from "node:fs/promises";
 async function doDownloadDirectoryToLocal(rpcClient, directoryHash, localDirectoryPath) {
@@ -712250,7 +712644,7 @@ async function hashLocalDirectory2(localDirectoryPath) {
     let entry;
     switch (localDirEntry.type) {
       case "-": {
-        const hash4 = await (0, import_shared81.hashFileContents)(new Uint8Array(localDirEntry.contents));
+        const hash4 = await (0, import_shared82.hashFileContents)(new Uint8Array(localDirEntry.contents));
         entry = {
           type: "-",
           executable: localDirEntry.executable,
@@ -712282,7 +712676,7 @@ async function hashLocalDirectory2(localDirectoryPath) {
     }
     directoryContents.push(entry);
   }
-  const hash3 = await (0, import_shared81.hashDirectoryContents)(directoryContents);
+  const hash3 = await (0, import_shared82.hashDirectoryContents)(directoryContents);
   return { contents: directoryContents, hash: hash3 };
 }
 async function doUploadLocalDirectory(rpcClient, localDirectoryPath) {
@@ -712372,7 +712766,7 @@ var FeatureFlags = class {
 
 // ../sdk/dist/socket/index.js
 init_cjs_shims();
-var import_shared82 = __toESM(require_dist2());
+var import_shared83 = __toESM(require_dist2());
 
 // ../sdk/dist/socket/handlers.js
 init_cjs_shims();
@@ -712628,7 +713022,7 @@ function createRequestHandlers2({ agentUrl, token: token2 }) {
 }
 
 // ../sdk/dist/socket/index.js
-var CLI_USER_AGENT = (0, import_shared82.buildClientUserAgent)("superblocks-cli", package_default.version);
+var CLI_USER_AGENT = (0, import_shared83.buildClientUserAgent)("superblocks-cli", package_default.version);
 async function connectToISocketRPCServer2({ superblocksBaseUrl, agentUrl, token: token2 }) {
   const requestHandlers = createRequestHandlers2({
     agentUrl,
@@ -712646,10 +713040,10 @@ async function connectToISocketRPCServer2({ superblocksBaseUrl, agentUrl, token:
   } else if (wsUrl.hostname === "localhost") {
     wsUrl.hostname = "127.0.0.1";
   }
-  const ws2 = await (0, import_shared82.connectWebSocket)(wsUrl.href, {
+  const ws2 = await (0, import_shared83.connectWebSocket)(wsUrl.href, {
     headers: { "User-Agent": CLI_USER_AGENT }
   });
-  const isocket = new import_shared82.ISocketWithClientAuth(ws2, authorization, requestHandlers, [], getTracer(), {
+  const isocket = new import_shared83.ISocketWithClientAuth(ws2, authorization, requestHandlers, [], getTracer(), {
     timeouts: {
       connectionTimeoutInSeconds: 6 * 60,
       // 6 minutes
@@ -712659,7 +713053,7 @@ async function connectToISocketRPCServer2({ superblocksBaseUrl, agentUrl, token:
     onClose: () => {
     }
   });
-  return (0, import_shared82.createISocketClient)(isocket);
+  return (0, import_shared83.createISocketClient)(isocket);
 }
 
 // ../sdk/dist/client.js
@@ -712737,13 +713131,13 @@ async function getCurrentBranchInfo(userSpecifiedBranch, pathPrefix) {
     });
   }
   return new CurrentBranch({
-    branchName: import_shared80.DEFAULT_BRANCH,
+    branchName: import_shared81.DEFAULT_BRANCH,
     source: BranchSource.DEFAULT,
     userSpecifiedBranch
   });
 }
 async function fetchApplication({ cliVersion, applicationId, branch, token: token2, superblocksBaseUrl, viewMode, commitId, skipSigningVerification = false, injectedHeaders = {}, keepOriginalNotFoundError = false }) {
-  if (commitId && viewMode !== import_shared83.ExportViewMode.EXPORT_COMMIT) {
+  if (commitId && viewMode !== import_shared84.ExportViewMode.EXPORT_COMMIT) {
     throw new Error(`If commitId ${commitId} is provided, viewMode cannot be ${viewMode}`);
   }
   try {
@@ -713442,7 +713836,7 @@ async function pushApi({ cliVersion, apiId, token: token2, superblocksBaseUrl, a
     throw new Error(`Could not push api ${e.message ? "\n" + e.message : ""}`);
   }
 }
-async function fetchApplicationCommits({ cliVersion, applicationId, branch, commitType = import_shared83.CommitType.COMMIT, token: token2, superblocksBaseUrl, injectedHeaders = {}, limit, offset: offset2 }) {
+async function fetchApplicationCommits({ cliVersion, applicationId, branch, commitType = import_shared84.CommitType.COMMIT, token: token2, superblocksBaseUrl, injectedHeaders = {}, limit, offset: offset2 }) {
   try {
     const serverURL = branch ? new URL(`${BASE_SERVER_API_URL_V2}/applications/${applicationId}/branches/${encodeURIComponent(branch)}/commits`, superblocksBaseUrl) : new URL(`${BASE_SERVER_API_URL_V2}/applications/${applicationId}/commits`, superblocksBaseUrl);
     serverURL.search = new URLSearchParams({
@@ -713468,7 +713862,7 @@ async function fetchApplicationCommits({ cliVersion, applicationId, branch, comm
     throw new Error("Could not fetch application");
   }
 }
-async function fetchApiCommits({ cliVersion, applicationId, branch, commitType = import_shared83.CommitType.COMMIT, token: token2, superblocksBaseUrl, injectedHeaders = {}, limit, offset: offset2 }) {
+async function fetchApiCommits({ cliVersion, applicationId, branch, commitType = import_shared84.CommitType.COMMIT, token: token2, superblocksBaseUrl, injectedHeaders = {}, limit, offset: offset2 }) {
   try {
     const serverURL = branch ? new URL(`${BASE_SERVER_API_URL_V3}/apis/${applicationId}/branches/${encodeURIComponent(branch)}/commits`, superblocksBaseUrl) : new URL(`${BASE_SERVER_API_URL_V3}/apis/${applicationId}/commits`, superblocksBaseUrl);
     serverURL.search = new URLSearchParams({
@@ -714369,11 +714763,11 @@ function filesToFileDescriptors(files, appRoot) {
 
 // ../sdk/dist/sdk.js
 init_cjs_shims();
-var import_shared85 = __toESM(require_dist2());
+var import_shared86 = __toESM(require_dist2());
 
 // ../sdk/dist/dbfs/client.js
 init_cjs_shims();
-var import_shared84 = __toESM(require_dist2());
+var import_shared85 = __toESM(require_dist2());
 var import_util49 = __toESM(require_dist3());
 async function getApplicationDirectoryHash2(token2, superblocksBaseUrl, applicationId, branch, options8) {
   const rpcClient = await connectToISocketRPCServer2({
@@ -714382,10 +714776,10 @@ async function getApplicationDirectoryHash2(token2, superblocksBaseUrl, applicat
   });
   try {
     if (options8?.commitId) {
-      const response = await (0, import_shared84.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
+      const response = await (0, import_shared85.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
         applicationId,
         commitId: options8.commitId,
-        viewMode: import_shared84.ExportViewMode.EXPORT_COMMIT
+        viewMode: import_shared85.ExportViewMode.EXPORT_COMMIT
       }));
       const commitHash = response.hash;
       if (!commitHash) {
@@ -714394,10 +714788,10 @@ async function getApplicationDirectoryHash2(token2, superblocksBaseUrl, applicat
       return commitHash;
     }
     try {
-      const response = await (0, import_shared84.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
+      const response = await (0, import_shared85.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
         applicationId,
         branchName: branch,
-        viewMode: import_shared84.ExportViewMode.EXPORT_LIVE_EDIT
+        viewMode: import_shared85.ExportViewMode.EXPORT_LIVE_EDIT
       }));
       if (response.hash) {
         return response.hash;
@@ -714417,22 +714811,22 @@ async function getApplicationDirectoryHash2(token2, superblocksBaseUrl, applicat
 }
 async function getDraftOrLiveCommitHash(rpcClient, applicationId, branch, options8) {
   try {
-    const response = await (0, import_shared84.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
+    const response = await (0, import_shared85.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
       applicationId,
       branchName: branch,
-      viewMode: import_shared84.ExportViewMode.EXPORT_DRAFT
+      viewMode: import_shared85.ExportViewMode.EXPORT_DRAFT
     }));
     const hash3 = response.hash;
     if (!hash3) {
-      throw new Error(`No directory contents hash found for the view mode ${import_shared84.ExportViewMode.EXPORT_DRAFT}`);
+      throw new Error(`No directory contents hash found for the view mode ${import_shared85.ExportViewMode.EXPORT_DRAFT}`);
     }
     return hash3;
   } catch (e) {
-    if (e instanceof import_shared84.NotFoundError) {
-      const response = await (0, import_shared84.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
+    if (e instanceof import_shared85.NotFoundError) {
+      const response = await (0, import_shared85.unwrapResponseDto)(rpcClient.call.v3.application.directoryContents.get({
         applicationId,
         branchName: branch,
-        viewMode: import_shared84.ExportViewMode.EXPORT_LIVE
+        viewMode: import_shared85.ExportViewMode.EXPORT_LIVE
       }));
       if (!options8?.silent) {
         getLogger2().warn(`Draft commit not found, falling back to the latest live commit: ${response.hash}`);
@@ -714443,7 +714837,7 @@ async function getDraftOrLiveCommitHash(rpcClient, applicationId, branch, option
   }
 }
 function isMissingLiveEditOrUnsupportedViewMode2(e) {
-  if (e instanceof import_shared84.NotFoundError) {
+  if (e instanceof import_shared85.NotFoundError) {
     return true;
   }
   const message = e instanceof Error ? e.message : String(e);
@@ -714581,7 +714975,7 @@ var SuperblocksSdk = class {
   async getGitFreshToken(host, applicationId) {
     return getGitFreshToken(this.token, this.superblocksBaseUrl, host, applicationId);
   }
-  async fetchApplication({ applicationId, branch, headers = {}, viewMode = import_shared85.ExportViewMode.EXPORT_LIVE, skipSigningVerification = false }) {
+  async fetchApplication({ applicationId, branch, headers = {}, viewMode = import_shared86.ExportViewMode.EXPORT_LIVE, skipSigningVerification = false }) {
     return fetchApplication({
       cliVersion: this.cliVersion,
       applicationId,
@@ -714602,7 +714996,7 @@ var SuperblocksSdk = class {
       injectedHeaders: headers
     });
   }
-  async fetchApplicationWithComponents({ applicationId, branch, headers = {}, viewMode = import_shared85.ExportViewMode.EXPORT_LIVE, commitId, skipSigningVerification = false, keepOriginalNotFoundError = false }) {
+  async fetchApplicationWithComponents({ applicationId, branch, headers = {}, viewMode = import_shared86.ExportViewMode.EXPORT_LIVE, commitId, skipSigningVerification = false, keepOriginalNotFoundError = false }) {
     return fetchApplicationWithComponents({
       cliVersion: this.cliVersion,
       applicationId,
@@ -714616,7 +715010,7 @@ var SuperblocksSdk = class {
       keepOriginalNotFoundError
     });
   }
-  async fetchApplicationCommits({ applicationId, branch, commitType = import_shared85.CommitType.COMMIT, headers = {}, limit, offset: offset2 }) {
+  async fetchApplicationCommits({ applicationId, branch, commitType = import_shared86.CommitType.COMMIT, headers = {}, limit, offset: offset2 }) {
     return fetchApplicationCommits({
       cliVersion: this.cliVersion,
       applicationId,
@@ -714809,7 +715203,7 @@ var SuperblocksSdk = class {
       folderId
     });
   }
-  async fetchApi({ apiId, branch, viewMode = import_shared85.ExportViewMode.EXPORT_LIVE, commitId, skipSigningVerification = false }) {
+  async fetchApi({ apiId, branch, viewMode = import_shared86.ExportViewMode.EXPORT_LIVE, commitId, skipSigningVerification = false }) {
     return fetchApi(this.cliVersion, apiId, this.token, this.superblocksBaseUrl, viewMode, branch, commitId, skipSigningVerification);
   }
   async fetchApis() {
@@ -714993,7 +715387,7 @@ import { promisify as promisify8 } from "node:util";
 import { isNativeError as isNativeError2 } from "node:util/types";
 var import_gt = __toESM(require_gt());
 var import_valid = __toESM(require_valid());
-var import_shared86 = __toESM(require_dist2());
+var import_shared87 = __toESM(require_dist2());
 
 // ../sdk/dist/cli-replacement/dependency-install-classifier.mjs
 init_cjs_shims();
@@ -715593,7 +715987,7 @@ async function getRemoteVersions(config4) {
     } else {
       const error40 = await response.json();
       const msg = `Could not get latest CLI version: ${error40.responseMeta.message}`;
-      if (error40.responseMeta.message?.includes(import_shared86.NON_SB_ORG_UPDATE_ERROR)) {
+      if (error40.responseMeta.message?.includes(import_shared87.NON_SB_ORG_UPDATE_ERROR)) {
         logger23.warn(msg);
       } else {
         logger23.error(msg);
@@ -715725,11 +716119,11 @@ async function checkVersionsAndWritePackageJson(lockService, config4, forceUpgra
   let cliUpdated = false;
   let hasFailedToUpgrade = false;
   const upgradePromises = [];
-  await (0, import_shared86.traceFunction)({
+  await (0, import_shared87.traceFunction)({
     name: "checkVersionsAndUpgrade",
     tracer: tracer2,
     fn: async () => {
-      const packageManager = await (0, import_shared86.traceFunction)({
+      const packageManager = await (0, import_shared87.traceFunction)({
         name: "detectPackageManager",
         tracer: tracer2,
         fn: async () => {
@@ -715749,14 +716143,14 @@ async function checkVersionsAndWritePackageJson(lockService, config4, forceUpgra
         hasFailedToUpgrade = true;
         return;
       }
-      const currentCliInfo = await (0, import_shared86.traceFunction)({
+      const currentCliInfo = await (0, import_shared87.traceFunction)({
         name: "getCurrentCliVersion",
         tracer: tracer2,
         fn: async () => {
           return await getCurrentCliVersion();
         }
       });
-      const targetVersions = await (0, import_shared86.traceFunction)({
+      const targetVersions = await (0, import_shared87.traceFunction)({
         name: "getRemoteVersions",
         tracer: tracer2,
         fn: async () => {
@@ -715770,7 +716164,7 @@ async function checkVersionsAndWritePackageJson(lockService, config4, forceUpgra
         cliNeedsUpgrade = Boolean(currentCliInfo && (0, import_valid.default)(currentCliInfo.version) && !(currentCliInfo.version.startsWith("file:") || currentCliInfo.version.startsWith("link:")) && targetVersions.cli && (currentCliInfo.version.toLowerCase().includes("snapshot") ? targetVersions.cli !== currentCliInfo.version : (0, import_gt.default)(targetVersions.cli, currentCliInfo.version)));
       } catch (error40) {
         logger23.error("Error checking versions to upgrade, releasing lock and exiting", getErrorMeta(error40));
-        await (0, import_shared86.traceFunction)({
+        await (0, import_shared87.traceFunction)({
           name: "shutdownLockService",
           tracer: tracer2,
           fn: async () => {
@@ -715784,7 +716178,7 @@ async function checkVersionsAndWritePackageJson(lockService, config4, forceUpgra
       }
       try {
         if (!skipCliUpgrade && (cliNeedsUpgrade || forceUpgrade) && currentCliInfo) {
-          const cliUpgradePromise = (0, import_shared86.traceFunction)({
+          const cliUpgradePromise = (0, import_shared87.traceFunction)({
             name: "upgradeCli",
             tracer: tracer2,
             // APPS-4544: capture the span so the `outcome` attribute can be
@@ -715798,7 +716192,7 @@ async function checkVersionsAndWritePackageJson(lockService, config4, forceUpgra
               try {
                 logger23.info(`Beginning CLI upgrade from ${currentCliInfo.version} to ${targetVersions.cli}`);
                 const oclifStart = Date.now();
-                const oclifUpgradeSucceeded = await (0, import_shared86.traceFunction)({
+                const oclifUpgradeSucceeded = await (0, import_shared87.traceFunction)({
                   name: "upgradeCliWithOclif",
                   tracer: tracer2,
                   fn: async () => {
@@ -715827,7 +716221,7 @@ async function checkVersionsAndWritePackageJson(lockService, config4, forceUpgra
                   logger23.info(`Successfully upgraded CLI to ${targetVersions.cli} via oclif`);
                 } else {
                   logger23.info(`Falling back to package manager upgrade for CLI`);
-                  await (0, import_shared86.traceFunction)({
+                  await (0, import_shared87.traceFunction)({
                     name: "upgradePackageWithPackageManager - cli",
                     tracer: tracer2,
                     fn: async () => {
@@ -715836,7 +716230,7 @@ async function checkVersionsAndWritePackageJson(lockService, config4, forceUpgra
                   });
                 }
                 try {
-                  await (0, import_shared86.traceFunction)({
+                  await (0, import_shared87.traceFunction)({
                     name: "stripUpgradedCliLockfiles",
                     tracer: tracer2,
                     fn: async () => {
@@ -716206,9 +716600,8 @@ import os8 from "node:os";
 import path76 from "node:path";
 import react3 from "@vitejs/plugin-react";
 import { createLogger as createLogger6, createServer, loadEnv } from "vite";
-var import_shared87 = __toESM(require_dist2(), 1);
+var import_shared88 = __toESM(require_dist2(), 1);
 var import_util50 = __toESM(require_dist3(), 1);
-var import_util51 = __toESM(require_dist3(), 1);
 
 // ../sdk/dist/telemetry/memory-metrics.js
 init_cjs_shims();
@@ -716492,6 +716885,90 @@ function isRecoverableShutdownError(reason) {
   return RECOVERABLE_SHUTDOWN_CODES.has(code);
 }
 
+// ../sdk/dist/dev-utils/optimize-deps-config.mjs
+init_cjs_shims();
+var OPTIMIZE_DEPS_CONFIG = {
+  // Crawl app source (not just the HTML entry graph) during the cold-start dep
+  // scan so lazily/dynamically imported deps (`@radix-ui/*`, `lucide-react/*`
+  // icons behind route/code-splits) are pre-bundled up front. Without this,
+  // Vite discovers them at runtime and forces an "optimized dependencies
+  // changed. reloading" full-page reload that drops the editor websocket
+  // (close 1001) mid Clark generation (APPS-4576).
+  //
+  // `entries` is NOT part of Vite's optimizeDeps config hash (verified against
+  // Vite 6.4.2: `getConfigHash` in `dist/node/chunks/dep-*.js` hashes only
+  // `optimizeDeps.{include,exclude,esbuildOptions}`, never `entries`), so adding
+  // it cannot desync the pre-warm vs activation dep cache. Re-verify after a
+  // Vite upgrade: if `entries` ever enters the hash, the pre-warm cache would be
+  // discarded on activation whenever the two servers scan different source trees.
+  // `node_modules`/`outDir` are always excluded by Vite.
+  //
+  // The source globs cover every extension a generated app can import a heavy
+  // dep from (`.ts` utilities, not just `.tsx`/`.jsx` components), so a future
+  // `.ts` module importing a tree-shakeable dep is still pre-bundled. `**/*.html`
+  // preserves the default HTML-entry discovery; the `!` patterns keep the scan
+  // off the externalized custom-component dir and the drafts dir (both
+  // watch-ignored elsewhere) so churny user content can't slow or fail the
+  // cold-start scan.
+  //
+  // Node-side files must never become browser dep-scan entries. A generated
+  // app's `vite.config.ts` imports `@tailwindcss/vite`, and a fullstack app's
+  // `server/**` imports Node/native packages; when those files are scan entries
+  // esbuild follows their imports into build-time-only packages and aborts the
+  // whole browser optimize — `@tailwindcss/oxide` has no `.node` loader (see
+  // esbuildOptions below) and `lightningcss` fails to resolve its generated
+  // `../pkg` binding ("Could not resolve \"../pkg\""). Either crashes cold-start
+  // pre-warm for *every* tailwind-v4 app, so exclude config files and the server
+  // tree up front rather than trying to make esbuild tolerate every native dep.
+  entries: [
+    "**/*.html",
+    "**/*.{js,ts,jsx,tsx}",
+    "!custom/**",
+    "!.superblocks/**",
+    "!**/*.config.{js,ts,mjs,mts,cjs,cts}",
+    "!server/**"
+  ],
+  // Force-bundle deps the cold-start scan structurally cannot discover, so they
+  // aren't found at runtime and don't trigger their own reload (verified on an
+  // EE warm-pool box: without this, a freshly-generated app still reloads once
+  // on first render for the JSX runtime — APPS-4576).
+  //
+  // The scan's esbuild uses the DEFAULT (react) JSX runtime, so it emits
+  // `react/jsx-runtime` imports and pre-bundles those — but never
+  // `@superblocksteam/library/jsx-dev-runtime`, even though every generated app
+  // sets `jsxImportSource: "@superblocksteam/library"` and pulls that runtime in
+  // at serve time. Force-including it pre-bundles it up front. An unresolvable
+  // `include` entry is a no-op (Vite warns and skips), so an app that somehow
+  // lacks the library never fails cold-start over this.
+  include: ["@superblocksteam/library/jsx-dev-runtime"],
+  // `@superblocksteam/sdk-api` is a VIRTUAL module the `sb-sdk-api-entry-point`
+  // plugin serves (not a real package), imported by generated app code. Left to
+  // the optimizer it gets discovered as a "new dependency" on first import and
+  // forces a reload; excluding it keeps the dep optimizer from ever trying to
+  // pre-bundle or re-optimize it (the plugin serves it as-is). `include` cannot
+  // fix this one — there is no real file for esbuild to pre-bundle.
+  exclude: ["@superblocksteam/sdk-api"],
+  esbuildOptions: {
+    supported: {
+      destructuring: true
+    },
+    // Tolerate native `.node` addons reached during the cold-start scan. The
+    // widened `entries` glob crawls Node-side app files too (a fullstack app's
+    // `vite.config.ts` imports `@tailwindcss/vite`, which pulls in the native
+    // `@tailwindcss/oxide` `tailwindcss-oxide.<platform>.node`). esbuild has no
+    // loader for `.node`, so bundling such a dep aborts the whole optimize with
+    // "Build failed ... No loader is configured for \".node\" files", which
+    // stops the dev server from serving and leaves the editor websocket stuck
+    // "released" after a respawn (APPS-4576, PR #19858 CI). A native addon
+    // reached during the *browser* dep optimize is always build-time-only and
+    // never executed in the browser, so emptying it is safe and keeps the
+    // cold-start scan from crashing on any native dependency, not just oxide.
+    loader: {
+      ".node": "empty"
+    }
+  }
+};
+
 // ../sdk/dist/dev-utils/prepare-in-place-restart.mjs
 init_cjs_shims();
 var RESTART_REASON_IPC_TIMEOUT_MS = 1e3;
@@ -716709,6 +717186,8 @@ function endpointForUrl(url4) {
       return "_sb_status";
     case "/_sb_activity":
       return "_sb_activity";
+    case "/_sb_update_token":
+      return "_sb_update_token";
     case "/_sb_persist":
       return "_sb_persist";
     case "/_sb_ready":
@@ -716744,13 +717223,6 @@ function reactPlugin() {
     }
   });
 }
-var OPTIMIZE_DEPS_CONFIG = {
-  esbuildOptions: {
-    supported: {
-      destructuring: true
-    }
-  }
-};
 function buildResolveConfig() {
   const alias = reactCompilerRuntimeAlias();
   return {
@@ -716946,7 +717418,7 @@ function buildHealthResponse(args) {
     startedAt: DEV_SERVER_STARTED_AT
   };
 }
-async function createDevServer({ root: root3, mode, fsOperationQueue, syncService, lockService, aiService, gitService, gitBootstrapFailed, activateGitService, snapshotManager, logger: loggerOverride, port, sdk, superblocksBaseUrl: explicitBaseUrl, existingServer, warmActivationStart, devServerStatus }) {
+async function createDevServer({ root: root3, mode, fsOperationQueue, syncService, lockService, tokenManager, aiService, gitService, gitBootstrapAuthFailed, gitBootstrapFailed, activateGitService, refreshGitCredentials, snapshotManager, logger: loggerOverride, port, sdk, superblocksBaseUrl: explicitBaseUrl, existingServer, warmActivationStart, devServerStatus }) {
   const logger25 = getLogger2(loggerOverride);
   if (httpServer) {
     logger25.debug("Dev server already running");
@@ -717084,8 +717556,8 @@ async function createDevServer({ root: root3, mode, fsOperationQueue, syncServic
       res.status(500).send("Error holding request");
     });
   });
-  const localToken = await (0, import_util51.getLocalTokenWithUrlIfExists)();
-  const jwtVerifier = new import_shared87.JwtVerifier({
+  const localToken = await (0, import_util50.getLocalTokenWithUrlIfExists)();
+  const jwtVerifier = new import_shared88.JwtVerifier({
     jwksUri: getJwksUriWithBaseUrl(localToken?.superblocksBaseUrl),
     cache: true,
     cacheMaxAge: 24 * 60 * 60 * 1e3
@@ -717174,7 +717646,7 @@ async function createDevServer({ root: root3, mode, fsOperationQueue, syncServic
         return;
       }
       const incomingBranch = req.headers["x-superblocks-branch"];
-      if (currentBranch && incomingBranch !== currentBranch && incomingBranch !== import_shared87.SUPERBLOCKS_LIVE_GIT_BRANCH) {
+      if (currentBranch && incomingBranch !== currentBranch && incomingBranch !== import_shared88.SUPERBLOCKS_LIVE_GIT_BRANCH) {
         logger25.error(`Dev server expects branch ${currentBranch}, but received ${incomingBranch}. Check your current branch with 'git branch' and try again.`);
         logger25.info(`[dev-server-runtime] _sb_connect branch mismatch: expected ${currentBranch}, got ${incomingBranch}`);
         res.locals.sbFailureType = "branch_mismatch";
@@ -717377,10 +717849,13 @@ async function createDevServer({ root: root3, mode, fsOperationQueue, syncServic
       fsOperationQueue,
       syncService,
       lockService,
+      tokenManager,
       aiService,
       gitService,
+      gitBootstrapAuthFailed,
       gitBootstrapFailed,
       activateGitService,
+      refreshGitCredentials,
       snapshotManager,
       checkAuthorization,
       logger: loggerOverride,
@@ -717411,7 +717886,7 @@ async function createDevServer({ root: root3, mode, fsOperationQueue, syncServic
   }
   return httpServer;
 }
-async function startVite({ app, httpServer: httpServer2, root: root3, mode, port, fsOperationQueue, syncService, lockService, aiService, gitService, gitBootstrapFailed, activateGitService, snapshotManager, checkAuthorization, logger: loggerOverride, superblocksBaseUrl, features, prepareInPlaceRestart: prepareInPlaceRestart2 }) {
+async function startVite({ app, httpServer: httpServer2, root: root3, mode, port, fsOperationQueue, syncService, lockService, tokenManager, aiService, gitService, gitBootstrapAuthFailed, gitBootstrapFailed, activateGitService, refreshGitCredentials, snapshotManager, checkAuthorization, logger: loggerOverride, superblocksBaseUrl, features, prepareInPlaceRestart: prepareInPlaceRestart2 }) {
   const tracer3 = getDevServerTracer();
   return tracer3.startActiveSpan("startVite", async (startViteSpan) => {
     try {
@@ -717462,10 +717937,13 @@ async function startVite({ app, httpServer: httpServer2, root: root3, mode, port
         fsOperationQueue,
         syncService,
         lockService,
+        tokenManager,
         aiService,
         gitService,
+        gitBootstrapAuthFailed,
         gitBootstrapFailed,
         activateGitService,
+        refreshGitCredentials,
         snapshotManager,
         httpServer: httpServer2,
         checkAuthorization,
@@ -717691,15 +718169,15 @@ function tryDecodeJwtToken(token2) {
 
 // ../sdk/dist/cli-replacement/init.js
 init_cjs_shims();
-var import_shared88 = __toESM(require_dist2());
-var import_util52 = __toESM(require_dist3());
+var import_shared89 = __toESM(require_dist2());
+var import_util51 = __toESM(require_dist3());
 async function fetchAndWriteApplication({ resourceId, viewMode, featureFlags, projectRootFolder, appRelativePath, sdk, skipSigningVerification, keepOriginalNotFoundError = false }) {
   const headers = {
-    [import_util52.COMPONENT_EVENT_HEADER]: import_shared88.ComponentEvent.INIT
+    [import_util51.COMPONENT_EVENT_HEADER]: import_shared89.ComponentEvent.INIT
   };
   const application = await sdk.fetchApplicationWithComponents({
     applicationId: resourceId,
-    branch: import_shared80.DEFAULT_BRANCH,
+    branch: import_shared81.DEFAULT_BRANCH,
     viewMode,
     headers,
     skipSigningVerification,
@@ -717711,7 +718189,7 @@ async function fetchAndWriteApplication({ resourceId, viewMode, featureFlags, pr
       resource: application,
       projectRootFolder,
       appRelativePath,
-      branch: import_shared80.DEFAULT_BRANCH,
+      branch: import_shared81.DEFAULT_BRANCH,
       featureFlags
     });
   }
@@ -718053,12 +718531,12 @@ import path79 from "node:path";
 import * as readline2 from "node:readline";
 import { promisify as promisify9 } from "node:util";
 var import_fs_extra5 = __toESM(require_lib(), 1);
-var import_shared90 = __toESM(require_dist2(), 1);
-var import_util53 = __toESM(require_dist3(), 1);
+var import_shared91 = __toESM(require_dist2(), 1);
+var import_util52 = __toESM(require_dist3(), 1);
 
 // ../sdk/dist/index.js
 init_cjs_shims();
-var import_shared89 = __toESM(require_dist2(), 1);
+var import_shared90 = __toESM(require_dist2(), 1);
 
 // ../sdk/dist/cli-replacement/auth-hot-reload.mjs
 init_cjs_shims();
@@ -718372,7 +718850,7 @@ async function handleLockConflict(error40, lockSvc, span, logger25) {
 }
 async function readPkgJson(cwd) {
   try {
-    const { readPackage } = await import("./read-pkg-ANYNELJU.js");
+    const { readPackage } = await import("./read-pkg-6TOKHW7I.js");
     return await readPackage({ cwd });
   } catch {
     return null;
@@ -718733,6 +719211,7 @@ async function dev(options8) {
       const port = devServerPort ?? 5173;
       const fsOperationQueue = new OperationQueue();
       let activeDbfsBranchName = applicationConfig?.branchName ?? "main";
+      let devStartupGitBootstrapAuthFailed = false;
       let devStartupGitOutcome = "skipped_no_remote";
       if (applicationConfig && !skipSync) {
         const rpcClient = new AutoConnectingRpcClient(tokenConfig.superblocksBaseUrl, tokenConfig.token, tracer3, tokenManager, logger25);
@@ -718770,7 +719249,7 @@ async function dev(options8) {
         });
         logger25.info("Checking if local files are synced with the server");
         try {
-          await (0, import_util53.maskUnixSignals)(async () => {
+          await (0, import_util52.maskUnixSignals)(async () => {
             if (lockService) {
               const lockSvc = lockService;
               await tracer3.startActiveSpan("acquiringInitialLock", async (span) => {
@@ -718783,7 +719262,7 @@ async function dev(options8) {
                     await lockSvc.acquireLock();
                   }
                 } catch (error40) {
-                  if (error40 instanceof import_shared90.ConflictError) {
+                  if (error40 instanceof import_shared91.ConflictError) {
                     await handleLockConflict(error40, lockSvc, span, logger25);
                     return;
                   }
@@ -718823,7 +719302,7 @@ async function dev(options8) {
               downloadFirst = false;
             }
             const templateName = process.env.SUPERBLOCKS_APP_TEMPLATE_NAME ?? options8.prefetchedApplication?.application?.templateName;
-            const sdkApiEnabled = (0, import_shared53.isSdkApiTemplate)(templateName);
+            const sdkApiEnabled = (0, import_shared54.isSdkApiTemplate)(templateName);
             const rawFlagBootstrap = currentUser.flagBootstrap;
             const flagBootstrap = {
               ...rawFlagBootstrap,
@@ -718904,6 +719383,7 @@ async function dev(options8) {
                 }
               } catch (gitError) {
                 devStartupGitOutcome = "bootstrap_failed";
+                devStartupGitBootstrapAuthFailed = (0, import_shared91.isGitAuthErrorMessage)(gitError);
                 gitService = void 0;
                 logger25.warn("[git] startup git setup failed, continuing without git", {
                   gitCategory: "setup",
@@ -719276,6 +719756,26 @@ async function dev(options8) {
           return void 0;
         }
       };
+      const refreshRuntimeGitCredentials = async () => {
+        const gitConfigSdk = sdk;
+        const gitConfig = await gitConfigSdk.getApplicationGitConfig(applicationConfig.id);
+        if (!gitConfig?.gitRemoteUrl) {
+          return void 0;
+        }
+        if (gitService) {
+          const refreshed = await refreshGitServiceCredentials({
+            applicationId: applicationConfig.id,
+            gitRemoteUrl: gitConfig.gitRemoteUrl,
+            logger: logger25,
+            sdk,
+            service: gitService,
+            userEmail: gitUserEmail,
+            userName: gitUserName
+          });
+          return refreshed ? gitService : void 0;
+        }
+        return activateRuntimeGitService();
+      };
       const httpServer2 = await tracer3.startActiveSpan("createDevServer", async (span) => {
         const createDevServerOptions = {
           root: options8.cwd,
@@ -719284,10 +719784,13 @@ async function dev(options8) {
           fsOperationQueue,
           syncService,
           lockService,
+          tokenManager,
           aiService,
           gitService,
+          gitBootstrapAuthFailed: devStartupGitBootstrapAuthFailed,
           gitBootstrapFailed: devStartupGitOutcome === "bootstrap_failed",
           activateGitService: activateRuntimeGitService,
+          refreshGitCredentials: refreshRuntimeGitCredentials,
           snapshotManager,
           logger: options8.logger,
           sdk,
@@ -719332,6 +719835,42 @@ async function dev(options8) {
     }
   });
 }
+async function fetchGitCredentials({ applicationId, gitRemoteUrl, logger: logger25, sdk }) {
+  const gitConfigSdk = sdk;
+  try {
+    const host = new URL(gitRemoteUrl).hostname;
+    const freshToken = await gitConfigSdk.getGitFreshToken(host, applicationId);
+    return freshToken ?? void 0;
+  } catch (error40) {
+    let gitRemoteHost;
+    try {
+      gitRemoteHost = new URL(gitRemoteUrl).hostname;
+    } catch {
+    }
+    logger25.warn("[git] credential fetch failed, continuing without auth", {
+      gitCategory: "setup",
+      gitOperation: "fetch-credentials",
+      gitOutcome: "failed",
+      applicationId,
+      gitRemoteHost,
+      ...getGitErrorFields(error40)
+    });
+    return void 0;
+  }
+}
+async function refreshGitServiceCredentials({ applicationId, gitRemoteUrl, logger: logger25, sdk, service, userEmail, userName }) {
+  const credentials = await fetchGitCredentials({
+    applicationId,
+    gitRemoteUrl,
+    logger: logger25,
+    sdk
+  });
+  if (!credentials) {
+    return false;
+  }
+  await service.configure({ credentials, userEmail, userName });
+  return true;
+}
 async function bootstrapGitService({ sdk, applicationId, cwd, logger: logger25, userName, userEmail, superblocksBaseUrl }) {
   const gitConfigSdk = sdk;
   const gitConfig = await gitConfigSdk.getApplicationGitConfig(applicationId);
@@ -719339,28 +719878,12 @@ async function bootstrapGitService({ sdk, applicationId, cwd, logger: logger25,
     return void 0;
   }
   const service = createGitService(cwd);
-  let credentials;
-  let gitRemoteHost;
-  if (gitConfig.hasCredential) {
-    try {
-      const host = new URL(gitConfig.gitRemoteUrl).hostname;
-      gitRemoteHost = host;
-      const freshToken = await gitConfigSdk.getGitFreshToken(host, applicationId);
-      if (freshToken) {
-        credentials = freshToken;
-      }
-    } catch (error40) {
-      logger25.warn("[git] credential fetch failed, continuing without auth", {
-        gitCategory: "setup",
-        gitOperation: "fetch-credentials",
-        gitOutcome: "failed",
-        applicationId,
-        gitRemoteHost,
-        gitRemoteUrl: gitConfig.gitRemoteUrl,
-        ...getGitErrorFields(error40)
-      });
-    }
-  }
+  const credentials = gitConfig.hasCredential ? await fetchGitCredentials({
+    applicationId,
+    gitRemoteUrl: gitConfig.gitRemoteUrl,
+    logger: logger25,
+    sdk
+  }) : void 0;
   await service.configure({ credentials, userName, userEmail });
   logger25.info("[git] configure complete, proceeding to ensureGitRepo", {
     gitCategory: "setup",
@@ -719407,20 +719930,20 @@ async function ensureGitRepo(git, remoteUrl, superblocksBaseUrl) {
       "ls-remote",
       "--heads",
       "origin",
-      `refs/heads/${import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH}`
+      `refs/heads/${import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH}`
     ]).catch((err) => {
       getLogger2().warn("[git] ensure repo ls-remote failed", {
         gitCategory: "setup",
         gitOperation: "ensure-repo",
         gitOutcome: "failed",
         gitRemote: "origin",
-        gitBranch: import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH,
+        gitBranch: import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH,
         gitRemoteUrl: remoteUrl,
         ...getGitErrorFields(err)
       });
       return "";
     });
-    if (!remoteRefs.includes(`refs/heads/${import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH}`)) {
+    if (!remoteRefs.includes(`refs/heads/${import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH}`)) {
       await seedGithubWorkflowIfNeeded(git.workDir, remoteUrl, superblocksBaseUrl);
       let defaultBranch;
       try {
@@ -719450,9 +719973,9 @@ async function ensureGitRepo(git, remoteUrl, superblocksBaseUrl) {
       await git.raw([
         "symbolic-ref",
         "HEAD",
-        `refs/heads/${import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH}`
+        `refs/heads/${import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH}`
       ]);
-      await git.raw(["reset", `origin/${import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH}`]);
+      await git.raw(["reset", `origin/${import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH}`]);
     }
   } else {
     try {
@@ -719498,7 +720021,7 @@ async function ensureGitRepo(git, remoteUrl, superblocksBaseUrl) {
   await seedGithubWorkflowIfNeeded(git.workDir, remoteUrl, superblocksBaseUrl);
 }
 async function seedGithubWorkflowIfNeeded(workDir, remoteUrl, superblocksBaseUrl) {
-  if (!(0, import_shared90.isGitHubRemoteUrl)(remoteUrl)) {
+  if (!(0, import_shared91.isGitHubRemoteUrl)(remoteUrl)) {
     return;
   }
   const workflowDir = path79.join(workDir, ".github", "workflows");
@@ -719509,7 +720032,7 @@ async function seedGithubWorkflowIfNeeded(workDir, remoteUrl, superblocksBaseUrl
   }
   await nodeFs2.mkdir(workflowDir, { recursive: true });
   const baseUrl = superblocksBaseUrl || process.env.SUPERBLOCKS_BASE_URL || "";
-  await nodeFs2.writeFile(workflowFile, baseUrl ? (0, import_shared90.buildGithubSuperblocksSyncWorkflowFromBaseUrl)(baseUrl) : (0, import_shared90.buildGithubSuperblocksSyncWorkflow)(), "utf-8");
+  await nodeFs2.writeFile(workflowFile, baseUrl ? (0, import_shared91.buildGithubSuperblocksSyncWorkflowFromBaseUrl)(baseUrl) : (0, import_shared91.buildGithubSuperblocksSyncWorkflow)(), "utf-8");
 }
 async function canResolveRef(git, ref2) {
   try {
@@ -719520,13 +720043,13 @@ async function canResolveRef(git, ref2) {
   }
 }
 async function ensureLiveBranchCheckedOutAfterFetch(git) {
-  if (await canResolveRef(git, `origin/${import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH}`)) {
-    await git.checkoutOrCreate(import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH, `origin/${import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
+  if (await canResolveRef(git, `origin/${import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH}`)) {
+    await git.checkoutOrCreate(import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH, `origin/${import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH}`);
     return;
   }
   const branch = await git.raw(["branch", "--show-current"]).then((b3) => b3.trim()).catch(() => "");
-  if (branch !== import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH) {
-    await git.checkoutOrCreate(import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH);
+  if (branch !== import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH) {
+    await git.checkoutOrCreate(import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH);
   }
 }
 async function ensureRuntimeDbfsBranchConsistency({ sdk, applicationConfig, logger: logger25, lockService, syncService, currentBranchName }) {
@@ -719574,15 +720097,15 @@ async function resolveDbfsBranchName(sdk, applicationConfig, logger25) {
   const fallbackBranchName = applicationConfig.branchName;
   const gitAwareSdk = sdk;
   const normalizeNonGitBranchFallback = (branchName) => {
-    if (branchName !== import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH) {
+    if (branchName !== import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH) {
       return branchName;
     }
-    logger25.warn(`[git] stale '${import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH}' branch context detected after git disconnect; falling back to '${import_shared90.DEFAULT_NON_GIT_BRANCH}'`);
-    return import_shared90.DEFAULT_NON_GIT_BRANCH;
+    logger25.warn(`[git] stale '${import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH}' branch context detected after git disconnect; falling back to '${import_shared91.DEFAULT_NON_GIT_BRANCH}'`);
+    return import_shared91.DEFAULT_NON_GIT_BRANCH;
   };
   try {
     const gitConfig = await gitAwareSdk.getApplicationGitConfig(applicationConfig.id);
-    return gitConfig?.gitRemoteUrl ? import_shared90.SUPERBLOCKS_LIVE_GIT_BRANCH : normalizeNonGitBranchFallback(fallbackBranchName);
+    return gitConfig?.gitRemoteUrl ? import_shared91.SUPERBLOCKS_LIVE_GIT_BRANCH : normalizeNonGitBranchFallback(fallbackBranchName);
   } catch (error40) {
     const normalizedFallbackBranchName = normalizeNonGitBranchFallback(fallbackBranchName);
     logger25.warn(`Could not resolve DBFS branch selection; falling back to '${normalizedFallbackBranchName}': ${error40 instanceof Error ? error40.message : String(error40)}`);
@@ -719613,7 +720136,7 @@ export {
   BranchNotCheckedOutError,
   CommitAlreadyExistsError,
   ValidateGitSetupError,
-  import_shared80 as import_shared,
+  import_shared81 as import_shared,
   DRAFT_MODE,
   modeFlagValuesMap,
   FileStructureType,
@@ -719661,7 +720184,7 @@ export {
   dev,
   AuthHotReloadServer,
   isAuthHotReloadEnabled,
-  import_shared89 as import_shared2
+  import_shared90 as import_shared2
 };
 /*! Bundled license information:
 
@@ -720199,4 +720722,4 @@ serve-static/index.js:
 chokidar/esm/index.js:
   (*! chokidar - MIT License (c) 2012 Paul Miller (paulmillr.com) *)
 */
-//# sourceMappingURL=chunk-O3ALZQID.js.map
+//# sourceMappingURL=chunk-2FCS5636.js.map