aipctl 2026.10.4 → 2026.10.5

package/build/index.cjs

@@ -26,6 +26,7 @@ var require$$0$1 = require('buffer');
 var require$$2 = require('util');
 require('node:net');
 require('node:worker_threads');
+var promises = require('node:timers/promises');
 var require$$0$6 = require('path');
 var require$$0$5 = require('fs');
 var require$$0$4 = require('constants');
@@ -89693,8 +89694,6 @@ const SESSION_EXPIRED_MESSAGE = 'Session expired. Run "aipctl auth login" to con
 
 const CONFIG_SET_HINT = "aipctl config set --app-url https://app.example.com";
 const CONFIG_DIR$2 = path__namespace.join(os__namespace.homedir(), ".config", "aip");
-const CONFIG_FILE = path__namespace.join(CONFIG_DIR$2, "config.json");
-let cachedConfig;
 class ConfigServiceTag extends Tag$1("ConfigService")() {
 }
 class AppUrlNotConfiguredError extends Error {
@@ -89744,9 +89743,9 @@ function cloneConfig(config) {
     currentOrganization: config.currentOrganization ? { ...config.currentOrganization } : void 0
   };
 }
-function readConfigFile() {
+function readConfigFile(configFile) {
   try {
-    const content = fs__namespace.readFileSync(CONFIG_FILE, "utf-8");
+    const content = fs__namespace.readFileSync(configFile, "utf-8");
     return normalizeLoadedConfig(JSON.parse(content));
   } catch {
     return {};
@@ -89831,25 +89830,33 @@ function requireApiBaseUrl(config) {
 function requireChatBaseUrl(config) {
   return deriveInternalBaseUrls(requireAppBaseUrl(config)).chatBaseUrl;
 }
-const ConfigServiceLive = succeed$2(ConfigServiceTag, {
-  load: () => {
-    cachedConfig ??= readConfigFile();
-    return cloneConfig(cachedConfig);
-  },
-  save: (config, currentConfig) => {
-    const current = currentConfig ?? cachedConfig ?? readConfigFile();
-    const merged = cloneConfig({
-      ...current,
-      ...config
-    });
-    cachedConfig = merged;
-    if (isSameConfig(current, merged)) {
-      return;
+function makeConfigService(directory) {
+  const configFile = path__namespace.join(directory, "config.json");
+  return {
+    load: () => {
+      return cloneConfig(readConfigFile(configFile));
+    },
+    save: (config, currentConfig) => {
+      const current = currentConfig ?? readConfigFile(configFile);
+      const merged = cloneConfig({
+        ...current,
+        ...config
+      });
+      if (isSameConfig(current, merged)) {
+        return;
+      }
+      fs__namespace.mkdirSync(directory, { recursive: true, mode: 448 });
+      const temporaryFile = `${configFile}.${crypto.randomUUID()}.tmp`;
+      try {
+        fs__namespace.writeFileSync(temporaryFile, JSON.stringify(merged, null, 2), { mode: 384 });
+        fs__namespace.renameSync(temporaryFile, configFile);
+      } finally {
+        if (fs__namespace.existsSync(temporaryFile)) fs__namespace.unlinkSync(temporaryFile);
+      }
     }
-    fs__namespace.mkdirSync(CONFIG_DIR$2, { recursive: true });
-    fs__namespace.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2));
-  }
-});
+  };
+}
+const ConfigServiceLive = succeed$2(ConfigServiceTag, makeConfigService(CONFIG_DIR$2));
 const ConfigService = ConfigServiceTag;
 
 var properLockfile = {exports: {}};
@@ -91959,9 +91966,10 @@ var lockfile = /*@__PURE__*/getDefaultExportFromCjs(properLockfileExports);
 
 const ACCESS_TOKEN_FALLBACK_TTL_MS = 12 * 60 * 60 * 1e3;
 const REFRESH_TOKEN_FALLBACK_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+const REFRESH_LOCK_WAIT_MS = 7e4;
+class RefreshLockWaitError extends TaggedError$1("RefreshLockWaitError") {
+}
 const CONFIG_DIR$1 = path__namespace.join(os__namespace.homedir(), ".config", "aip");
-const CREDENTIALS_FILE = path__namespace.join(CONFIG_DIR$1, "credentials.json");
-const CREDENTIALS_LOCK_FILE = path__namespace.join(CONFIG_DIR$1, "credentials.lock");
 class CredentialServiceTag extends Tag$1("CredentialService")() {
 }
 function isNonEmptyString(value) {
@@ -91996,28 +92004,30 @@ function hasUsableCredentialSession(credentials, now = Date.now()) {
   const status = getCredentialAuthStatus(credentials, now);
   return status === "authenticated" || status === "refreshable";
 }
-const loadCredentials = () => {
+const loadCredentials = (directory) => {
+  const credentialsFile = path__namespace.join(directory, "credentials.json");
   try {
-    if (fs__namespace.existsSync(CREDENTIALS_FILE)) {
-      const content = fs__namespace.readFileSync(CREDENTIALS_FILE, "utf-8");
+    if (fs__namespace.existsSync(credentialsFile)) {
+      const content = fs__namespace.readFileSync(credentialsFile, "utf-8");
       return JSON.parse(content);
     }
   } catch {
   }
   return null;
 };
-function ensureConfigDir$1() {
-  fs__namespace.mkdirSync(CONFIG_DIR$1, { recursive: true });
+function ensureConfigDir$1(directory) {
+  fs__namespace.mkdirSync(directory, { recursive: true, mode: 448 });
 }
-function ensureLockFile() {
-  ensureConfigDir$1();
-  if (!fs__namespace.existsSync(CREDENTIALS_LOCK_FILE)) {
-    fs__namespace.writeFileSync(CREDENTIALS_LOCK_FILE, "", { mode: 384 });
+function ensureLockFile(directory, name) {
+  ensureConfigDir$1(directory);
+  const lockFile = path__namespace.join(directory, name);
+  if (!fs__namespace.existsSync(lockFile)) {
+    fs__namespace.writeFileSync(lockFile, "", { mode: 384 });
   }
 }
-async function withCredentialLock(fn) {
-  ensureLockFile();
-  const release = await lockfile.lock(CREDENTIALS_LOCK_FILE, {
+async function withCredentialLock(directory, fn, name = "credentials.lock") {
+  ensureLockFile(directory, name);
+  const release = await lockfile.lock(path__namespace.join(directory, name), {
     retries: { retries: 20, minTimeout: 50, maxTimeout: 200 },
     stale: 5e3
   });
@@ -92027,26 +92037,89 @@ async function withCredentialLock(fn) {
     await release();
   }
 }
-const CredentialServiceLive = succeed$2(CredentialServiceTag, {
-  load: loadCredentials,
-  save: (credentials) => {
-    ensureConfigDir$1();
-    fs__namespace.writeFileSync(CREDENTIALS_FILE, JSON.stringify(credentials, null, 2), { mode: 384 });
-  },
-  clear: () => {
+async function withRefreshLock(directory, fn, options = {}) {
+  const checkCancelled = () => {
+    if (options.signal?.aborted)
+      throw new RefreshLockWaitError({
+        code: "CLI_REQUEST_CANCELLED",
+        message: "Authentication refresh wait was cancelled."
+      });
+  };
+  checkCancelled();
+  ensureLockFile(directory, "refresh.lock");
+  const deadline = performance.now() + (options.timeoutMs ?? REFRESH_LOCK_WAIT_MS);
+  const checkDeadline = () => {
+    if (performance.now() >= deadline)
+      throw new RefreshLockWaitError({
+        code: "CLI_AUTH_REFRESH_WAIT_TIMEOUT",
+        message: 'Timed out waiting for another command to refresh authentication. Check "aipctl auth status" before trying again.'
+      });
+  };
+  let release;
+  while (!release) {
+    checkCancelled();
+    checkDeadline();
     try {
-      if (fs__namespace.existsSync(CREDENTIALS_FILE)) {
-        fs__namespace.unlinkSync(CREDENTIALS_FILE);
+      release = await lockfile.lock(path__namespace.join(directory, "refresh.lock"), { retries: 0, stale: 5e3 });
+    } catch (error) {
+      checkCancelled();
+      if (error.code !== "ELOCKED") throw error;
+      try {
+        await promises.setTimeout(Math.max(0, Math.min(100, deadline - performance.now())), void 0, { signal: options.signal });
+      } catch (error2) {
+        checkCancelled();
+        throw error2;
       }
-    } catch {
     }
-  },
-  isLoggedIn: () => {
-    const creds = loadCredentials();
-    return hasUsableCredentialSession(creds);
-  },
-  withLock: withCredentialLock
-});
+  }
+  try {
+    checkCancelled();
+    checkDeadline();
+    return await fn();
+  } finally {
+    await release();
+  }
+}
+function makeCredentialService(directory) {
+  const credentialsFile = path__namespace.join(directory, "credentials.json");
+  const revisionFile = path__namespace.join(directory, "session-revision");
+  return {
+    load: () => loadCredentials(directory),
+    getRevision: () => {
+      try {
+        return fs__namespace.readFileSync(revisionFile, "utf-8");
+      } catch (error) {
+        if (error.code === "ENOENT") return "legacy";
+        throw error;
+      }
+    },
+    save: (credentials, options) => {
+      ensureConfigDir$1(directory);
+      if (!options?.preserveSession) fs__namespace.writeFileSync(revisionFile, crypto.randomUUID(), { mode: 384 });
+      const temporaryFile = `${credentialsFile}.${crypto.randomUUID()}.tmp`;
+      try {
+        fs__namespace.writeFileSync(temporaryFile, JSON.stringify(credentials, null, 2), {
+          mode: 384
+        });
+        fs__namespace.renameSync(temporaryFile, credentialsFile);
+      } finally {
+        if (fs__namespace.existsSync(temporaryFile)) fs__namespace.unlinkSync(temporaryFile);
+      }
+    },
+    clear: () => {
+      ensureConfigDir$1(directory);
+      fs__namespace.writeFileSync(revisionFile, crypto.randomUUID(), { mode: 384 });
+      if (fs__namespace.existsSync(credentialsFile)) fs__namespace.unlinkSync(credentialsFile);
+    },
+    isLoggedIn: () => {
+      const creds = loadCredentials(directory);
+      return hasUsableCredentialSession(creds);
+    },
+    withLock: (fn) => withCredentialLock(directory, fn),
+    withRefreshLock: (fn, options) => withRefreshLock(directory, fn, options)
+  };
+}
+const CredentialServiceLive = succeed$2(CredentialServiceTag, makeCredentialService(CONFIG_DIR$1));
 const CredentialService = CredentialServiceTag;
 
 let isDockerCached;
@@ -93134,6 +93207,7 @@ async function performHttpResponse(input, init, consume, options) {
       }
     }
     controller.signal.throwIfAborted();
+    options.beforeDispatch?.();
     dispatched = true;
     response = await fetch(input, { ...init, signal: controller.signal });
     controller.signal.throwIfAborted();
@@ -93186,6 +93260,30 @@ async function performHttpResponse(input, init, consume, options) {
   }
 }
 
+class AuthSessionChangedError extends TaggedError$1("AuthSessionChangedError") {
+}
+function captureAuthSession(config, credentials) {
+  return {
+    revision: credentials.getRevision(),
+    appBaseUrl: requireAppBaseUrl(config.load())
+  };
+}
+function isCurrentAuthSession(snapshot, config, credentials) {
+  try {
+    return credentials.getRevision() === snapshot.revision && requireAppBaseUrl(config.load()) === snapshot.appBaseUrl;
+  } catch {
+    return false;
+  }
+}
+function assertAuthSession(snapshot, config, credentials) {
+  if (!isCurrentAuthSession(snapshot, config, credentials)) {
+    throw new AuthSessionChangedError({
+      code: "CLI_AUTH_SESSION_CHANGED",
+      message: 'Authentication or App URL changed. Check "aipctl auth status" before trying again.'
+    });
+  }
+}
+
 const CALLBACK_HOST = "127.0.0.1";
 const CALLBACK_PORT = 8484;
 const CALLBACK_PATH = "/callback";
@@ -93228,6 +93326,7 @@ function trimTrailingSlash(value) {
 }
 function toError$1(error, fallbackMessage) {
   if (error instanceof OAuthRequestError) return error;
+  if (error instanceof AuthSessionChangedError) return new OAuthRequestError(error.message, void 0, error.code);
   return error instanceof Error ? new Error(maskSensitiveText(error.message)) : new Error(maskSensitiveText(fallbackMessage));
 }
 function isRecord(value) {
@@ -93301,7 +93400,7 @@ async function fetchJson(input, init, parse = (value) => value) {
     );
   }
 }
-async function discoverOAuthMetadata(apiBaseUrl) {
+async function discoverOAuthMetadata(apiBaseUrl, signal) {
   const normalizedBaseUrl = trimTrailingSlash(apiBaseUrl);
   const fallback = {
     authorizationEndpoint: `${normalizedBaseUrl}/oauth2/authorize`,
@@ -93311,7 +93410,7 @@ async function discoverOAuthMetadata(apiBaseUrl) {
   };
   const metadataUrl = `${normalizedBaseUrl}/.well-known/oauth-authorization-server`;
   try {
-    const metadata = await fetchJson(metadataUrl);
+    const metadata = await fetchJson(metadataUrl, { signal });
     return {
       authorizationEndpoint: metadata.authorization_endpoint ?? fallback.authorizationEndpoint,
       tokenEndpoint: metadata.token_endpoint ?? fallback.tokenEndpoint,
@@ -93399,13 +93498,18 @@ async function refreshOAuthToken(input) {
     client_id: input.clientId,
     refresh_token: input.refreshToken
   });
-  return fetchJson(input.tokenEndpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
+  return fetchJson(
+    input.tokenEndpoint,
+    {
+      method: "POST",
+      signal: input.signal,
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body
     },
-    body
-  }, parseOAuthTokenResponse);
+    parseOAuthTokenResponse
+  );
 }
 function tokenExpiresAt(now, expiresInSeconds, fallbackMs) {
   return now + (expiresInSeconds === void 0 ? fallbackMs : expiresInSeconds * 1e3);
@@ -93580,10 +93684,11 @@ async function listenOnCallbackPort$1(server) {
 const startOAuthFlow = gen(function* () {
   const config = yield* ConfigService;
   const credentials = yield* CredentialService;
-  const apiBaseUrl = yield* try_({
-    try: () => requireApiBaseUrl(config.load()),
-    catch: (error) => toError$1(error, "App URL validation failed")
+  const session = yield* tryPromise({
+    try: () => credentials.withLock(() => captureAuthSession(config, credentials)),
+    catch: (error) => toError$1(error, "Could not read authentication state")
   });
+  const apiBaseUrl = deriveInternalBaseUrls(session.appBaseUrl).apiBaseUrl;
   const pkce = generatePkcePair();
   const state = generateState$1();
   const deferred = yield* make$m();
@@ -93640,12 +93745,15 @@ const startOAuthFlow = gen(function* () {
       console.log("Authorization received. Exchanging token...");
     });
     const tokenResponse = yield* tryPromise({
-      try: () => exchangeAuthorizationCode({
-        tokenEndpoint: metadata.tokenEndpoint,
-        clientId: registration.clientId,
-        code: callback.code,
-        codeVerifier: pkce.verifier
-      }),
+      try: () => {
+        assertAuthSession(session, config, credentials);
+        return exchangeAuthorizationCode({
+          tokenEndpoint: metadata.tokenEndpoint,
+          clientId: registration.clientId,
+          code: callback.code,
+          codeVerifier: pkce.verifier
+        });
+      },
       catch: (error) => toError$1(error, "OAuth token exchange failed")
     });
     const nextCredentials = toCredentialsFromTokenResponse({
@@ -93653,7 +93761,13 @@ const startOAuthFlow = gen(function* () {
       clientId: registration.clientId,
       issuer: metadata.issuer
     });
-    credentials.save(nextCredentials);
+    yield* tryPromise({
+      try: () => credentials.withLock(() => {
+        assertAuthSession(session, config, credentials);
+        credentials.save(nextCredentials);
+      }),
+      catch: (error) => toError$1(error, "Could not save authentication state")
+    });
     return nextCredentials;
   }).pipe(ensuring$1(promise$1(() => closeServer())));
 });
@@ -93665,7 +93779,7 @@ const injectedBuildEnv = "dev".length > 0 ? "dev" : "local";
 if (!isBuildEnv(injectedBuildEnv)) {
   throw new Error(`Invalid AIPCTL_BUILD_ENV: ${injectedBuildEnv}`);
 }
-const VERSION = "2026.10.4".length > 0 ? "2026.10.4" : "0.0.0";
+const VERSION = "2026.10.5".length > 0 ? "2026.10.5" : "0.0.0";
 const BUILD_ENV = injectedBuildEnv;
 const INCLUDE_NATIVE_LOGS = BUILD_ENV !== "prod";
 
@@ -94617,7 +94731,7 @@ const JSON_CONTENT_TYPE = "application/json";
 const AGENT_CHAT_STREAM_RETRY_DELAY_MS = 1e3;
 const AGENT_CHAT_STREAM_MAX_ATTEMPTS = 4;
 function bearerHeaders(accessToken) {
-  return { Authorization: `Bearer ${accessToken}` };
+  return { Authorization: `Bearer ${accessToken.value}` };
 }
 function jsonBearerHeaders(accessToken) {
   return {
@@ -94635,6 +94749,13 @@ function apiErrorFromUnknown(error, fallbackMessage) {
   if (error instanceof ApiError) {
     return error;
   }
+  if (error instanceof AuthSessionChangedError) {
+    return createApiError({
+      message: error.message,
+      code: error.code,
+      outcome: "not-dispatched"
+    });
+  }
   if (error instanceof HttpRequestError) {
     return createApiError({
       message: error.message + (error.outcome === "unknown" ? " The server may have completed the action. Check its state before running it again." : ""),
@@ -94833,19 +94954,29 @@ function parseRetryAfterSeconds(value) {
 const makeRequest = (baseUrl, path, accessToken, options) => tryPromise({
   try: async (signal) => {
     const resolvedBaseUrl = typeof baseUrl === "function" ? baseUrl() : baseUrl;
-    return withHttpResponse(`${resolvedBaseUrl}${path}`, {
-      method: options?.method || "GET",
-      headers: jsonBearerHeaders(accessToken),
-      body: options?.body ? JSON.stringify(options.body) : void 0
-    }, async (response) => {
-      if (!response.ok) {
-        throw await toApiError(response);
-      }
-      if (options?.skipJsonParse || response.status === 202 || response.status === 204) {
-        return void 0;
+    return withHttpResponse(
+      `${resolvedBaseUrl}${path}`,
+      {
+        method: options?.method || "GET",
+        headers: jsonBearerHeaders(accessToken),
+        body: options?.body ? JSON.stringify(options.body) : void 0
+      },
+      async (response) => {
+        if (!response.ok) {
+          throw await toApiError(response);
+        }
+        if (options?.skipJsonParse || response.status === 202 || response.status === 204) {
+          return void 0;
+        }
+        return await response.json();
+      },
+      {
+        signal,
+        beforeDispatch: () => accessToken.assertCurrent(resolvedBaseUrl),
+        ...options?.timeoutMs ? { timeoutMs: options.timeoutMs } : {},
+        ...options?.responseBudget ? { responseBudget: options.responseBudget } : {}
       }
-      return await response.json();
-    }, { signal, ...options?.timeoutMs ? { timeoutMs: options.timeoutMs } : {}, ...options?.responseBudget ? { responseBudget: options.responseBudget } : {} });
+    );
   },
   catch: (error) => apiErrorFromUnknown(error, "The request could not be completed.")
 });
@@ -94994,6 +95125,12 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       if (error instanceof ApiError || error instanceof NotLoggedInError) {
         return error;
       }
+      if (error instanceof AuthSessionChangedError) {
+        return createApiError({ message: error.message, code: error.code });
+      }
+      if (error instanceof RefreshLockWaitError) {
+        return createApiError({ message: error.message, code: error.code, outcome: "not-dispatched" });
+      }
       if (error instanceof OAuthRequestError) {
         if (error.statusCode === 401 || error.code === "invalid_grant") {
           return sessionExpired();
@@ -95010,18 +95147,20 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         message: error instanceof Error ? error.message : "OAuth token refresh failed"
       });
     };
-    const performOAuthRefresh = async (lockedCreds) => {
+    const performOAuthRefresh = async (lockedCreds, session, signal) => {
       const clientId = lockedCreds.clientId;
       const refreshToken = lockedCreds.refreshToken;
       if (!clientId || !refreshToken) {
-        throw clearInvalidSession();
+        throw sessionExpired();
       }
-      const metadata = await discoverOAuthMetadata(loadConfiguredApiBaseUrl());
+      const metadata = await discoverOAuthMetadata(deriveInternalBaseUrls(session.appBaseUrl).apiBaseUrl, signal);
+      assertAuthSession(session, configService, credentialService);
       try {
         const tokenResponse = await refreshOAuthToken({
           tokenEndpoint: metadata.tokenEndpoint,
           clientId,
-          refreshToken
+          refreshToken,
+          signal
         });
         const nextCredentials = toCredentialsFromTokenResponse({
           tokenResponse,
@@ -95030,11 +95169,17 @@ const makeApiServiceLive = (buildEnv) => effect$1(
           previousRefreshToken: refreshToken,
           previousRefreshExpiresAt: lockedCreds.refreshExpiresAt
         });
-        credentialService.save(nextCredentials);
+        await credentialService.withLock(() => {
+          signal.throwIfAborted();
+          assertAuthSession(session, configService, credentialService);
+          credentialService.save(nextCredentials, { preserveSession: true });
+        });
         return nextCredentials;
       } catch (error) {
         if (error instanceof OAuthRequestError && (error.statusCode === 401 || error.code === "invalid_grant")) {
-          credentialService.clear();
+          await credentialService.withLock(() => {
+            if (isCurrentAuthSession(session, configService, credentialService)) credentialService.clear();
+          });
         }
         throw error;
       }
@@ -95042,28 +95187,57 @@ const makeApiServiceLive = (buildEnv) => effect$1(
     const refreshAccessToken = (options) => gen(function* () {
       yield* requireApiBaseUrlEffect();
       return yield* tryPromise({
-        try: async () => credentialService.withLock(async () => {
-          const lockedCreds = credentialService.load();
-          if (!lockedCreds) {
-            throw notLoggedIn();
-          }
-          const status = getCredentialAuthStatus(lockedCreds, Date.now(), {
-            accessExpiryBufferMs: REFRESH_BUFFER_MS,
-            forceRefresh: options?.force
-          });
-          switch (status) {
-            case "authenticated":
-              return lockedCreds;
-            case "refreshable":
-              return performOAuthRefresh(lockedCreds);
-            case "missing":
-            case "expired":
-              throw clearInvalidSession();
-          }
-        }),
+        try: async (signal) => credentialService.withRefreshLock(
+          async () => {
+            const state = await credentialService.withLock(() => {
+              signal.throwIfAborted();
+              const session = captureAuthSession(configService, credentialService);
+              const lockedCreds = credentialService.load();
+              if (!lockedCreds) {
+                throw notLoggedIn();
+              }
+              const status = getCredentialAuthStatus(lockedCreds, Date.now(), {
+                accessExpiryBufferMs: REFRESH_BUFFER_MS,
+                forceRefresh: options?.force
+              });
+              switch (status) {
+                case "authenticated":
+                case "refreshable":
+                  return { lockedCreds, session, status };
+                case "missing":
+                case "expired":
+                  throw clearInvalidSession();
+              }
+            });
+            return state.status === "authenticated" ? state.lockedCreds : performOAuthRefresh(state.lockedCreds, state.session, signal);
+          },
+          { signal }
+        ),
         catch: toRefreshFailure
       });
     });
+    const bindAccessToken = (creds) => {
+      const session = captureAuthSession(configService, credentialService);
+      const urls = deriveInternalBaseUrls(session.appBaseUrl);
+      const destinations = [urls.apiBaseUrl, urls.chatBaseUrl].map((url) => new URL(url).origin);
+      return {
+        value: creds.accessToken,
+        assertCurrent: (destination) => {
+          assertAuthSession(session, configService, credentialService);
+          if (!destinations.includes(new URL(destination).origin)) {
+            throw new AuthSessionChangedError({
+              code: "CLI_AUTH_SESSION_CHANGED",
+              message: 'App URL changed. Check "aipctl config status" before trying again.'
+            });
+          }
+          if (credentialService.load()?.accessToken !== creds.accessToken) throw notLoggedIn();
+        }
+      };
+    };
+    const bindAccessTokenEffect = (creds) => try_({
+      try: () => bindAccessToken(creds),
+      catch: toRefreshFailure
+    });
     const getAccessToken = () => gen(function* () {
       yield* requireApiBaseUrlEffect();
       const creds = credentialService.load();
@@ -95075,14 +95249,14 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       });
       switch (status) {
         case "authenticated":
-          return creds.accessToken;
+          return yield* bindAccessTokenEffect(creds);
         case "refreshable": {
           const refreshedCredentials = yield* refreshAccessToken();
-          return refreshedCredentials.accessToken;
+          return yield* bindAccessTokenEffect(refreshedCredentials);
         }
         case "missing":
         case "expired":
-          return yield* fail$3(clearInvalidSession());
+          return yield* refreshAccessToken().pipe(flatMap$5(bindAccessTokenEffect));
       }
     });
     const baseUrl = () => loadConfiguredApiBaseUrl();
@@ -95090,11 +95264,13 @@ const makeApiServiceLive = (buildEnv) => effect$1(
     const requireReleaseEnabledOperation = (operationId) => {
       if (buildEnv !== "prod") return _void;
       if (!releaseEnabledCommandOperationIds.has(operationId)) {
-        return fail$3(createApiError({
-          message: `CLI operation "${operationId}" is not enabled in this aipctl release.`,
-          statusCode: 404,
-          code: "CLI_OPERATION_NOT_ENABLED"
-        }));
+        return fail$3(
+          createApiError({
+            message: `CLI operation "${operationId}" is not enabled in this aipctl release.`,
+            statusCode: 404,
+            code: "CLI_OPERATION_NOT_ENABLED"
+          })
+        );
       }
       return _void;
     };
@@ -95106,19 +95282,30 @@ const makeApiServiceLive = (buildEnv) => effect$1(
           const deadline = Date.now() + TRANSFER_DEADLINE_MS;
           for (let attempt = 1; attempt <= AGENT_CHAT_STREAM_MAX_ATTEMPTS; attempt += 1) {
             try {
-              return await withHttpResponse(`${resolvedChatBaseUrl}${path}`, {
-                method: "POST",
-                headers: jsonBearerHeaders(token),
-                body: JSON.stringify({})
-              }, async (response) => {
-                if (!response.ok) {
-                  throw await toApiError(response);
-                }
-                if (!response.body) {
-                  throw createApiError({ message: "No response body from agent chat stream endpoint" });
+              return await withHttpResponse(
+                `${resolvedChatBaseUrl}${path}`,
+                {
+                  method: "POST",
+                  headers: jsonBearerHeaders(token),
+                  body: JSON.stringify({})
+                },
+                async (response) => {
+                  if (!response.ok) {
+                    throw await toApiError(response);
+                  }
+                  if (!response.body) {
+                    throw createApiError({
+                      message: "No response body from agent chat stream endpoint"
+                    });
+                  }
+                  return await parseSseStream(response.body);
+                },
+                {
+                  signal,
+                  beforeDispatch: () => token.assertCurrent(resolvedChatBaseUrl),
+                  timeoutMs: Math.max(1, deadline - Date.now())
                 }
-                return await parseSseStream(response.body);
-              }, { signal, timeoutMs: Math.max(1, deadline - Date.now()) });
+              );
             } catch (error) {
               if (error instanceof AgentChatStreamIncompleteError && error.sawOnlyTerminalEnvelope && attempt < AGENT_CHAT_STREAM_MAX_ATTEMPTS) {
                 await sleep(AGENT_CHAT_STREAM_RETRY_DELAY_MS);
@@ -95158,10 +95345,12 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         token
       );
       if (!conversation?.agentInstallationId) {
-        return yield* fail$3(createApiError({
-          message: `Conversation "${conversationId}" is missing an agent installation id.`,
-          statusCode: 400
-        }));
+        return yield* fail$3(
+          createApiError({
+            message: `Conversation "${conversationId}" is missing an agent installation id.`,
+            statusCode: 400
+          })
+        );
       }
       return conversation.agentInstallationId;
     });
@@ -95647,10 +95836,14 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         return { ...response, pagination: normalizePageNumberPagination(response.pagination, response.list.length) };
       }),
       // Phase 5: Drive/Integration
-      listDriveEntries: (orgSlug) => gen(function* () {
+      listDriveEntries: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
         yield* requireReleaseEnabledOperation("listCliDriveEntries");
-        const params = new URLSearchParams({ count: "200" });
+        const params = new URLSearchParams({
+          count: String(options?.count ?? 200)
+        });
+        if (options?.cursor !== void 0) params.set("cursor", options.cursor);
+        if (options?.parentId !== void 0) params.set("parentId", options.parentId);
         const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/drive/entries?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
@@ -95792,15 +95985,25 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         const token = yield* getAccessToken();
         const path = `/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/installed-agents/${encodeURIComponent(agentId)}/export`;
         return yield* tryPromise({
-          try: async (signal) => withHttpResponse(`${resolvedApiBaseUrl}${path}`, {
-            headers: bearerHeaders(token)
-          }, async (response) => {
-            if (!response.ok) {
-              throw await toApiError(response);
+          try: async (signal) => withHttpResponse(
+            `${resolvedApiBaseUrl}${path}`,
+            {
+              headers: bearerHeaders(token)
+            },
+            async (response) => {
+              if (!response.ok) {
+                throw await toApiError(response);
+              }
+              const arrayBuffer = await response.arrayBuffer();
+              return Buffer.from(arrayBuffer);
+            },
+            {
+              signal,
+              beforeDispatch: () => token.assertCurrent(resolvedApiBaseUrl),
+              timeoutMs: TRANSFER_DEADLINE_MS,
+              maxResponseBytes: TRANSFER_MAX_RESPONSE_BYTES
             }
-            const arrayBuffer = await response.arrayBuffer();
-            return Buffer.from(arrayBuffer);
-          }, { signal, timeoutMs: TRANSFER_DEADLINE_MS, maxResponseBytes: TRANSFER_MAX_RESPONSE_BYTES }),
+          ),
           catch: (error) => apiErrorFromUnknown(error, "Export failed")
         });
       }),
@@ -96119,7 +96322,9 @@ const ApiService = ApiServiceTag;
 function jsonOutputRequested(args) {
   const forced = args.indexOf("--");
   const options = forced === -1 ? args : args.slice(0, forced);
-  return options.some((arg, index) => arg === "--json=true" || arg === "--json" && options[index + 1] !== "false");
+  return options.some(
+    (arg, index) => ["--json=true", "--json-page=true"].includes(arg) || ["--json", "--json-page"].includes(arg) && options[index + 1] !== "false"
+  );
 }
 function reportInterruption(json) {
   const message = "The command was interrupted. Check the status of any change or execution before running it again.";
@@ -96170,9 +96375,21 @@ function withCliFailureOutput(program, json) {
   });
 }
 function formatCliFailure(error, json) {
-  if (!(error instanceof ApiError || error instanceof OAuthRequestError || error instanceof NotLoggedInError || error instanceof NoOrganizationSelectedError)) return void 0;
+  if (error instanceof AuthSessionChangedError)
+    return json ? JSON.stringify({
+      error: {
+        code: error.code,
+        message: error.message,
+        outcome: "not-dispatched"
+      }
+    }) : error.message;
+  if (!(error instanceof ApiError || error instanceof OAuthRequestError || error instanceof NotLoggedInError || error instanceof NoOrganizationSelectedError))
+    return void 0;
   const diagnosticError = error instanceof ApiError || error instanceof OAuthRequestError;
-  if (!json) return maskSensitiveText(error.message + (diagnosticError && error.requestId ? ` Request ID: ${error.requestId}` : ""));
+  if (!json)
+    return maskSensitiveText(
+      error.message + (diagnosticError && error.requestId ? ` Request ID: ${error.requestId}` : "")
+    );
   return JSON.stringify({ error: {
     code: diagnosticError ? error.code ?? (error instanceof OAuthRequestError ? "CLI_OAUTH_ERROR" : "CLI_API_ERROR") : error._tag === "NotLoggedInError" ? "CLI_AUTH_REQUIRED" : "CLI_ORGANIZATION_REQUIRED",
     message: maskSensitiveText(error.message),
@@ -96244,21 +96461,101 @@ const isNativeCommandEnabled = (command, includeLogs = INCLUDE_NATIVE_LOGS) => {
 const FORCED_ARGS_SEPARATOR = "--";
 const NATIVE_ROOT_COMMANDS = new Set(nativeCommandNames);
 const trailingOptionSpecs = [
+  ...[
+    ["skill", "library"],
+    ["skill", "built-in"],
+    ["admin", "skill", "built-in"],
+    ["admin", "skill", "list"]
+  ].map(
+    (command) => ({
+      command,
+      booleanOptions: new Set(command.at(-1) === "list" ? ["--json", "--json-page"] : ["--json-page"]),
+      valueOptions: /* @__PURE__ */ new Set([
+        "--org",
+        "--search",
+        ...command.at(-1) === "list" ? ["--page", "--page-size"] : ["--cursor", command.at(-1) === "library" ? "--count" : "--limit"]
+      ]),
+      explicitBooleanValues: true
+    })
+  ),
+  ...["skill", "chat", "drive"].map(
+    (domain) => ({
+      command: [domain, "list"],
+      booleanOptions: new Set(domain === "drive" ? ["--json-page"] : ["--json", "--json-page"]),
+      valueOptions: /* @__PURE__ */ new Set([
+        "--org",
+        "--cursor",
+        ...domain === "chat" ? [] : ["--count"],
+        ...domain === "skill" ? ["--search"] : domain === "drive" ? ["--parent-id"] : []
+      ]),
+      explicitBooleanValues: true
+    })
+  ),
+  ...[
+    ["skill", "delete"],
+    ["admin", "skill", "delete"],
+    ["admin", "integration", "delete"]
+  ].map(
+    (command) => ({
+      command,
+      booleanOptions: /* @__PURE__ */ new Set(["--force", "-f"]),
+      valueOptions: /* @__PURE__ */ new Set(["--org"]),
+      explicitBooleanValues: true,
+      booleanAliases: { "-f": "--force" }
+    })
+  ),
   { command: ["quota", "status"], booleanOptions: /* @__PURE__ */ new Set(["--json"]), valueOptions: /* @__PURE__ */ new Set(["--org"]), explicitBooleanValues: true },
-  ...["list", "get", "create", "update", "rename", "delete", "set-default", "unset-default"].map((command) => ({
-    command: ["admin", "preset", command],
-    booleanOptions: new Set(command === "delete" ? ["--force", "-f"] : ["list", "get"].includes(command) ? ["--json"] : []),
-    valueOptions: /* @__PURE__ */ new Set(["--org", ...command === "list" ? ["--page", "--pageSize"] : []]),
-    explicitBooleanValues: true,
-    booleanAliases: { "-f": "--force" }
-  })),
-  ...["invite", "remove-member", "update-member-role"].map((command) => ({
-    command: ["admin", "org", command],
-    booleanOptions: new Set(command === "remove-member" ? ["--force", "-f"] : []),
-    valueOptions: /* @__PURE__ */ new Set(["--org", ...command !== "remove-member" ? ["--role"] : []]),
-    explicitBooleanValues: true,
-    booleanAliases: { "-f": "--force" }
-  })),
+  ...["list", "get", "enable", "disable"].map(
+    (command) => ({
+      command: ["agent", command],
+      booleanOptions: new Set(["list", "get"].includes(command) ? ["--json"] : []),
+      valueOptions: /* @__PURE__ */ new Set(["--org"]),
+      explicitBooleanValues: true
+    })
+  ),
+  ...["create", "update", "delete", "share", "templates"].map(
+    (command) => ({
+      command: ["admin", "agent", command],
+      booleanOptions: new Set(command === "delete" ? ["--force", "-f"] : []),
+      valueOptions: /* @__PURE__ */ new Set(["--org"]),
+      explicitBooleanValues: true,
+      booleanAliases: { "-f": "--force" }
+    })
+  ),
+  ...["mkdir", "rename"].map(
+    (command) => ({
+      command: ["drive", command],
+      booleanOptions: /* @__PURE__ */ new Set(),
+      valueOptions: /* @__PURE__ */ new Set(["--org"])
+    })
+  ),
+  ...["create", "update", "enable", "disable"].map(
+    (command) => ({
+      command: ["automation", command],
+      booleanOptions: /* @__PURE__ */ new Set(),
+      valueOptions: /* @__PURE__ */ new Set(["--org"])
+    })
+  ),
+  ...["list", "get", "create", "update", "rename", "delete", "set-default", "unset-default"].map(
+    (command) => ({
+      command: ["admin", "preset", command],
+      booleanOptions: new Set(
+        command === "delete" ? ["--force", "-f"] : ["list", "get"].includes(command) ? ["--json"] : []
+      ),
+      valueOptions: /* @__PURE__ */ new Set(["--org", ...command === "list" ? ["--page", "--pageSize"] : []]),
+      explicitBooleanValues: true,
+      booleanAliases: { "-f": "--force" }
+    })
+  ),
+  ...["invite", "remove-member", "update-member-role"].map(
+    (command) => ({
+      command: ["admin", "org", command],
+      booleanOptions: new Set(command === "remove-member" ? ["--force", "-f"] : []),
+      valueOptions: /* @__PURE__ */ new Set(["--org", ...command !== "remove-member" ? ["--role"] : []]),
+      explicitBooleanValues: true,
+      booleanAliases: { "-f": "--force" }
+    })
+  ),
   {
     command: ["org", "exit"],
     booleanOptions: /* @__PURE__ */ new Set(["--force", "-f"]),
@@ -96266,12 +96563,14 @@ const trailingOptionSpecs = [
     explicitBooleanValues: true,
     booleanAliases: { "-f": "--force" }
   },
-  ...["list", "get"].map((command) => ({
-    command: ["automation", command],
-    booleanOptions: /* @__PURE__ */ new Set(["--json"]),
-    valueOptions: /* @__PURE__ */ new Set(["--org", ...command === "list" ? ["--name"] : []]),
-    explicitBooleanValues: true
-  })),
+  ...["list", "get"].map(
+    (command) => ({
+      command: ["automation", command],
+      booleanOptions: /* @__PURE__ */ new Set(["--json"]),
+      valueOptions: /* @__PURE__ */ new Set(["--org", ...command === "list" ? ["--name"] : []]),
+      explicitBooleanValues: true
+    })
+  ),
   {
     command: ["automation", "delete"],
     booleanOptions: /* @__PURE__ */ new Set(["--force", "-f"]),
@@ -96282,7 +96581,9 @@ const trailingOptionSpecs = [
   {
     command: ["drive", "delete"],
     booleanOptions: /* @__PURE__ */ new Set(["--force", "-f"]),
-    valueOptions: /* @__PURE__ */ new Set(["--org"])
+    valueOptions: /* @__PURE__ */ new Set(["--org"]),
+    explicitBooleanValues: true,
+    booleanAliases: { "-f": "--force" }
   },
   {
     command: ["automation", "history"],
@@ -96331,8 +96632,11 @@ const normalizeTrailingOptions = (args, spec) => {
       continue;
     }
     if (isValueOption(arg, spec)) {
-      options.push(arg);
       const nextArg = args[index + 1];
+      if (!arg.includes("=") && (nextArg === void 0 || nextArg.startsWith("-"))) {
+        return [...args];
+      }
+      options.push(arg);
       if (!arg.includes("=") && nextArg !== void 0 && !nextArg.startsWith("-")) {
         index += 1;
         options.push(nextArg);
@@ -96483,22 +96787,26 @@ const createCommand$2 = make$4(
   })
 ).pipe(withDescription("Create an installed agent from a JSON file"));
 
+const requireConfirmation = (force, action) => force ? _void : fail$3(
+  new ApiError({
+    code: "CLI_CONFIRMATION_REQUIRED",
+    outcome: "not-dispatched",
+    message: `${action} was not performed. Use --force (-f) to confirm.`
+  })
+);
+
 const agentIdArg$5 = text$2({ name: "id" }).pipe(withDescription$5("Agent ID to delete"));
 const forceOption$8 = boolean("force").pipe(
   withAlias("f"),
-  withDescription$3("Skip confirmation prompt")
+  withDescription$3("Confirm permanent deletion")
 );
 const deleteCommand$6 = make$4(
   "delete",
   { agentId: agentIdArg$5, org: orgOption, force: forceOption$8 },
   ({ agentId, org, force }) => gen(function* () {
+    yield* requireConfirmation(force, "Agent deletion");
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    if (!force) {
-      yield* log(`Warning: This will permanently delete agent "${agentId}".`);
-      yield* log("Use --force to skip this confirmation.");
-      return;
-    }
     yield* log(`Deleting agent ${agentId}...`);
     yield* api.deleteInstalledAgent(orgSlug, agentId).pipe(
       catchTag(
@@ -96887,19 +97195,15 @@ const availableCommand = make$4(
 const integrationIdArg$4 = text$2({ name: "id" }).pipe(withDescription$5("Integration ID to delete"));
 const forceOption$7 = boolean("force").pipe(
   withAlias("f"),
-  withDescription$3("Skip confirmation prompt")
+  withDescription$3("Confirm permanent deletion")
 );
 const deleteCommand$5 = make$4(
   "delete",
   { integrationId: integrationIdArg$4, org: orgOption, force: forceOption$7 },
   ({ integrationId, org, force }) => gen(function* () {
+    yield* requireConfirmation(force, "Integration deletion");
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    if (!force) {
-      yield* log(`Warning: This will permanently delete integration "${integrationId}".`);
-      yield* log("Use --force to skip this confirmation.");
-      return;
-    }
     yield* log(`Deleting integration ${integrationId}...`);
     yield* api.deleteIntegration(orgSlug, integrationId).pipe(
       catchTag(
@@ -97158,13 +97462,14 @@ const emailsArg$1 = text$2({ name: "email" }).pipe(
 );
 const forceOption$6 = boolean("force").pipe(
   withAlias("f"),
-  withDescription$3("Skip confirmation prompt"),
+  withDescription$3("Confirm member removal"),
   withDefault(false)
 );
 const removeMemberCommand = make$4(
   "remove-member",
   { emails: emailsArg$1, org: orgOption, force: forceOption$6 },
   ({ emails, org, force }) => gen(function* () {
+    yield* requireConfirmation(force, "Member removal");
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
     const emailList = Array.from(emails);
@@ -97172,11 +97477,6 @@ const removeMemberCommand = make$4(
       yield* error$1("Please provide at least one email address to remove.");
       return yield* fail$3(new Error("No email addresses provided"));
     }
-    if (!force) {
-      yield* log(`Warning: This will remove ${emailList.join(", ")} from the organization.`);
-      yield* log("Use --force (-f) to confirm.");
-      return;
-    }
     const membersResult = yield* api.listOrgMembers(orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
@@ -97342,7 +97642,7 @@ const createCommand$1 = make$4(
 
 const idArg$7 = text$2({ name: "id" }).pipe(withDescription$5("Preset ID"));
 const forceOption$5 = boolean("force").pipe(
-  withDescription$3("Skip confirmation prompt"),
+  withDescription$3("Confirm permanent deletion"),
   withAlias("f"),
   withDefault(false)
 );
@@ -97350,13 +97650,9 @@ const deleteCommand$4 = make$4(
   "delete",
   { id: idArg$7, org: orgOption, force: forceOption$5 },
   ({ id, org, force }) => gen(function* () {
+    yield* requireConfirmation(force, "Preset deletion");
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    if (!force) {
-      yield* log(`Warning: This will permanently delete preset "${id}".`);
-      yield* log("Use --force (-f) to skip this confirmation.");
-      return;
-    }
     yield* api.deletePreset(id, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
@@ -97695,18 +97991,62 @@ const presetCommand = make$4("preset", {}).pipe(
   withSubcommands(presetSubcommands)
 );
 
+const cursorOption = text("cursor").pipe(
+  withDescription$3("Continue from the previous page nextCursor"),
+  optional
+);
+const countOption = integer("count").pipe(
+  withDescription$3("Items per page (1\u2013200)"),
+  optional
+);
+const jsonPageOption = boolean("json-page").pipe(
+  withDescription$3("Output the full page, including pagination metadata"),
+  withDefault(false)
+);
+function validatePageOptions(count, json, jsonPage, maximum = 200, option = "--count") {
+  if (count !== void 0 && (count < 1 || count > maximum)) {
+    return fail$3(
+      new ApiError({
+        message: `${option} must be between 1 and ${maximum}.`,
+        code: "CLI_INVALID_ARGUMENT",
+        outcome: "not-dispatched"
+      })
+    );
+  }
+  if (json && jsonPage) {
+    return fail$3(
+      new ApiError({
+        message: "Choose either --json or --json-page.",
+        code: "CLI_INVALID_ARGUMENT",
+        outcome: "not-dispatched"
+      })
+    );
+  }
+  return _void;
+}
+const reportNextPage = (hasNext) => hasNext ? error$1(
+  "More results are available. Use --json-page to read nextCursor, then pass it with --cursor using the same filters."
+) : _void;
+
+const limitOption$2 = integer("limit").pipe(withDescription$3("Items per page (1\u2013100)"), optional);
 const searchOption$3 = text("search").pipe(
   withDescription$3("Search built-in skills by name"),
   optional
 );
 const makeBuiltInCommand = (listSkills = (api, orgSlug, options) => api.listBuiltInSkills(orgSlug, options), description = "List built-in skills from the library") => make$4(
   "built-in",
-  { org: orgOption, search: searchOption$3 },
-  ({ org, search }) => gen(function* () {
+  { org: orgOption, search: searchOption$3, limit: limitOption$2, cursor: cursorOption, jsonPage: jsonPageOption },
+  ({ org, search, limit, cursor, jsonPage }) => gen(function* () {
+    const limitValue = limit._tag === "Some" ? limit.value : void 0;
+    yield* validatePageOptions(limitValue, false, jsonPage, 100, "--limit");
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
     const searchValue = search._tag === "Some" ? search.value : void 0;
-    const result = yield* listSkills(api, orgSlug, { search: searchValue }).pipe(
+    const result = yield* listSkills(api, orgSlug, {
+      search: searchValue,
+      limit: limitValue,
+      cursor: cursor._tag === "Some" ? cursor.value : void 0
+    }).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97722,6 +98062,11 @@ const makeBuiltInCommand = (listSkills = (api, orgSlug, options) => api.listBuil
         })
       )
     );
+    if (jsonPage) {
+      yield* log(jsonFormat({ ...result, nextCursor: result.nextCursor ?? null }));
+      return;
+    }
+    yield* reportNextPage(result.hasNext);
     if (result.items.length === 0) {
       yield* log("No built-in skills found.");
       return;
@@ -97740,9 +98085,6 @@ const makeBuiltInCommand = (listSkills = (api, orgSlug, options) => api.listBuil
       yield* log(`    Updated: ${formatDate(skill.updatedAt)}`);
       yield* log("");
     }
-    if (result.hasNext) {
-      yield* log("(More built-in skills available.)");
-    }
   })
 ).pipe(withDescription(description));
 const builtInCommand = makeBuiltInCommand();
@@ -98118,7 +98460,7 @@ const jsonOption$e = boolean("json").pipe(
 const skillIdArg$2 = text$2({ name: "id" }).pipe(withDescription$5("Skill ID"));
 const forceOption$4 = boolean("force").pipe(
   withAlias("f"),
-  withDescription$3("Skip confirmation prompt")
+  withDescription$3("Confirm permanent deletion")
 );
 const fileArg$2 = file({ name: "file", exists: "yes" }).pipe(
   withDescription$5("Path to the skill file (.zip or .skill)")
@@ -98128,8 +98470,16 @@ const overwriteOption$1 = boolean("overwrite").pipe(
 );
 const listCommand$8 = make$4(
   "list",
-  { org: orgOption, search: searchOption$2, page: pageOption$2, pageSize: pageSizeOption, json: jsonOption$e },
-  ({ org, search, page, pageSize, json }) => gen(function* () {
+  {
+    org: orgOption,
+    search: searchOption$2,
+    page: pageOption$2,
+    pageSize: pageSizeOption,
+    json: jsonOption$e,
+    jsonPage: jsonPageOption
+  },
+  ({ org, search, page, pageSize, json, jsonPage }) => gen(function* () {
+    yield* validatePageOptions(void 0, json, jsonPage);
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
     const result = yield* api.listAdminSkills(orgSlug, {
@@ -98152,6 +98502,15 @@ const listCommand$8 = make$4(
         })
       )
     );
+    if (jsonPage) {
+      yield* log(jsonFormat(result));
+      return;
+    }
+    if (result.pagination.page * result.pagination.pageSize < result.pagination.total) {
+      yield* error$1(
+        "More results are available. Use --json-page to read pagination, then pass --page using the same filters."
+      );
+    }
     if (json) {
       yield* log(jsonFormat(result.list));
       return;
@@ -98338,13 +98697,9 @@ const deleteCommand$3 = make$4(
   "delete",
   { skillId: skillIdArg$2, org: orgOption, force: forceOption$4 },
   ({ skillId, org, force }) => gen(function* () {
+    yield* requireConfirmation(force, "Organization skill deletion");
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    if (!force) {
-      yield* log(`Warning: This will permanently delete organization skill "${skillId}".`);
-      yield* log("Use --force to skip this confirmation.");
-      return;
-    }
     yield* api.deleteAdminSkill(orgSlug, skillId).pipe(
       catchTag(
         "ApiError",
@@ -99274,7 +99629,7 @@ function saveOrganization(org, configService) {
   });
 }
 function toSelectionError(error) {
-  return new Error(error.message);
+  return error;
 }
 function findOrganizationBySlug(organizations, slug) {
   return organizations?.find((org) => org.slug === slug);
@@ -99286,17 +99641,27 @@ const getOrganizationBySlug = (slug) => gen(function* () {
     catchTag("ApiError", (e) => fail$3(toSelectionError(e)))
   );
 });
-const saveSelectedOrganization = (slug, knownOrganizations) => gen(function* () {
+const saveSelectedOrganization = (slug, knownOrganizations, initialSession) => gen(function* () {
   const configService = yield* ConfigService;
+  const credentials = yield* CredentialService;
+  const session = initialSession ?? (yield* promise$1(() => credentials.withLock(() => captureAuthSession(configService, credentials))));
   const org = findOrganizationBySlug(knownOrganizations, slug) ?? (yield* getOrganizationBySlug(slug));
   if (org.ipBlocked) {
     return yield* fail$3(new Error(`Organization "${slug}" is blocked due to IP restrictions.`));
   }
-  saveOrganization(org, configService);
+  yield* tryPromise({
+    try: () => credentials.withLock(() => {
+      assertAuthSession(session, configService, credentials);
+      saveOrganization(org, configService);
+    }),
+    catch: (error) => toError(error, "Organization selection failed")
+  });
   return org;
 });
-const startOrganizationSelectionBrowserFlow = (knownOrganizations) => gen(function* () {
+const startOrganizationSelectionBrowserFlow = (knownOrganizations, initialSession) => gen(function* () {
   const config = yield* ConfigService;
+  const credentials = yield* CredentialService;
+  const session = initialSession ?? (yield* promise$1(() => credentials.withLock(() => captureAuthSession(config, credentials))));
   const appBaseUrl = yield* try_({
     try: () => requireAppBaseUrl(config.load()),
     catch: (error) => toError(error, "App URL validation failed")
@@ -99338,11 +99703,14 @@ const startOrganizationSelectionBrowserFlow = (knownOrganizations) => gen(functi
       _await(deferred),
       sleep$1("5 minutes").pipe(flatMap$5(() => fail$3(new Error(ORG_SELECTION_TIMEOUT_MESSAGE))))
     );
-    return yield* saveSelectedOrganization(callback.slug, knownOrganizations);
+    return yield* saveSelectedOrganization(callback.slug, knownOrganizations, session);
   }).pipe(ensuring$1(promise$1(() => closeServer())));
 });
 const selectOrganizationAfterLogin = gen(function* () {
   const api = yield* ApiService;
+  const config = yield* ConfigService;
+  const credentials = yield* CredentialService;
+  const session = yield* promise$1(() => credentials.withLock(() => captureAuthSession(config, credentials)));
   yield* log("Selecting organization...");
   const organizations = yield* api.listOrganizations().pipe(
     catchTag("NotLoggedInError", (e) => fail$3(toSelectionError(e))),
@@ -99356,11 +99724,11 @@ const selectOrganizationAfterLogin = gen(function* () {
     if (!org2) {
       return yield* fail$3(new Error(NO_ORGANIZATIONS_LOGIN_MESSAGE));
     }
-    const selectedOrg = yield* saveSelectedOrganization(org2.slug, organizations);
+    const selectedOrg = yield* saveSelectedOrganization(org2.slug, organizations, session);
     yield* log(`\u2713 Selected organization: ${selectedOrg.name} (${selectedOrg.slug})`);
     return selectedOrg;
   }
-  const org = yield* startOrganizationSelectionBrowserFlow(organizations).pipe(
+  const org = yield* startOrganizationSelectionBrowserFlow(organizations, session).pipe(
     catchAll((error) => {
       if (error.message === ORG_SELECTION_TIMEOUT_MESSAGE) {
         return fail$3(new Error(`${ORG_SELECTION_TIMEOUT_MESSAGE}
@@ -99425,19 +99793,25 @@ const loginCommand = make$4(
   () => loginEffect(startOAuthFlow, selectOrganizationAfterLogin)
 ).pipe(withDescription("Log in to AIP via browser-based OAuth"));
 
-const logoutCommand = make$4(
-  "logout",
-  {},
-  () => gen(function* () {
-    const credentials = yield* CredentialService;
-    if (!credentials.load()) {
-      yield* log("Not logged in.");
-      return;
-    }
-    credentials.clear();
-    yield* log("\u2713 Logged out successfully.");
-  })
-).pipe(withDescription("Log out and clear stored credentials"));
+const logoutEffect = gen(function* () {
+  const credentials = yield* CredentialService;
+  const hadCredentials = yield* tryPromise({
+    try: () => credentials.withLock(() => {
+      const existed = credentials.load() !== null;
+      credentials.clear();
+      return existed;
+    }),
+    catch: (error) => error instanceof Error ? error : new Error("Could not clear saved credentials.")
+  });
+  if (!hadCredentials) {
+    yield* log("Not logged in.");
+    return;
+  }
+  yield* log("\u2713 Logged out successfully.");
+});
+const logoutCommand = make$4("logout", {}, () => logoutEffect).pipe(
+  withDescription("Log out and clear stored credentials")
+);
 
 const refreshEffect = () => gen(function* () {
   const api = yield* ApiService;
@@ -99618,19 +99992,15 @@ const createCommand = make$4(
 const automationIdArg$6 = text$2({ name: "id" }).pipe(withDescription$5("Automation ID to delete"));
 const forceOption$3 = boolean("force").pipe(
   withAlias("f"),
-  withDescription$3("Skip confirmation prompt")
+  withDescription$3("Confirm permanent deletion")
 );
 const deleteCommand$2 = make$4(
   "delete",
   { automationId: automationIdArg$6, org: orgOption, force: forceOption$3 },
   ({ automationId, org, force }) => gen(function* () {
+    yield* requireConfirmation(force, "Automation deletion");
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    if (!force) {
-      yield* log(`Warning: This will permanently delete automation "${automationId}".`);
-      yield* log("Use --force to skip this confirmation.");
-      return;
-    }
     yield* log(`Deleting automation ${automationId}...`);
     yield* api.deleteAutomation(orgSlug, automationId).pipe(
       catchTag(
@@ -100157,11 +100527,19 @@ const jsonOption$8 = boolean("json").pipe(
 );
 const listCommand$5 = make$4(
   "list",
-  { org: orgOption, json: jsonOption$8 },
-  ({ org, json }) => gen(function* () {
+  {
+    org: orgOption,
+    json: jsonOption$8,
+    cursor: cursorOption,
+    jsonPage: jsonPageOption
+  },
+  ({ org, json, cursor, jsonPage }) => gen(function* () {
+    yield* validatePageOptions(void 0, json, jsonPage);
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    const result = yield* api.listConversations(orgSlug).pipe(
+    const result = yield* api.listConversations(orgSlug, {
+      cursor: cursor._tag === "Some" ? cursor.value : void 0
+    }).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -100177,10 +100555,16 @@ const listCommand$5 = make$4(
         })
       )
     );
+    if (jsonPage) {
+      yield* log(jsonFormat({ ...result, nextCursor: result.nextCursor ?? null }));
+      return;
+    }
     if (json) {
       yield* log(jsonFormat(result.conversations));
+      yield* reportNextPage(result.nextCursor != null);
       return;
     }
+    yield* reportNextPage(result.nextCursor != null);
     if (result.conversations.length === 0) {
       yield* log("No conversations found.");
       return;
@@ -100194,9 +100578,6 @@ const listCommand$5 = make$4(
       yield* log(`    Updated: ${formatDate(conv.updatedAt)}`);
       yield* log("");
     }
-    if (result.nextCursor) {
-      yield* log("(more available)");
-    }
   })
 ).pipe(withDescription("List conversations"));
 
@@ -100427,20 +100808,24 @@ const appUrlOption = text("app-url").pipe(
 const setConfigEffect = (input) => gen(function* () {
   const configService = yield* ConfigService;
   const credentials = yield* CredentialService;
-  const currentConfig = yield* sync$1(() => configService.load());
   const appBaseUrl = yield* try_({
     try: () => normalizeAppUrl(input.appUrl),
     catch: (error) => error instanceof Error ? error : new Error(String(error))
   });
-  const shouldClearSession = currentConfig.appBaseUrl !== appBaseUrl;
-  const savedConfig = {
-    appBaseUrl,
-    currentOrganization: shouldClearSession ? void 0 : currentConfig.currentOrganization
-  };
-  yield* sync$1(() => configService.save(savedConfig, currentConfig));
-  if (shouldClearSession) {
-    yield* sync$1(() => credentials.clear());
-  }
+  const { shouldClearSession, savedConfig } = yield* tryPromise({
+    try: () => credentials.withLock(() => {
+      const currentConfig = configService.load();
+      const shouldClearSession2 = currentConfig.appBaseUrl !== appBaseUrl;
+      const savedConfig2 = {
+        appBaseUrl,
+        currentOrganization: shouldClearSession2 ? void 0 : currentConfig.currentOrganization
+      };
+      if (shouldClearSession2) credentials.clear();
+      configService.save(savedConfig2, currentConfig);
+      return { shouldClearSession: shouldClearSession2, savedConfig: savedConfig2 };
+    }),
+    catch: (error) => error instanceof Error ? error : new Error("Could not save app configuration.")
+  });
   yield* log("\n\u2713 Saved app configuration");
   yield* log(`  App URL: ${appBaseUrl}`);
   if (shouldClearSession) {
@@ -100533,23 +100918,18 @@ const entryIdsArg = text$2({ name: "id" }).pipe(
 );
 const forceOption$2 = boolean("force").pipe(
   withAlias("f"),
-  withDescription$3("Skip confirmation prompt")
+  withDescription$3("Confirm permanent deletion")
 );
 const deleteCommand$1 = make$4(
   "delete",
   { entryIds: entryIdsArg, org: orgOption, force: forceOption$2 },
   ({ entryIds, org, force }) => gen(function* () {
+    yield* requireConfirmation(force, "Drive entry deletion");
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
     const ids = Array.from(entryIds);
     if (ids.length === 0) {
-      yield* error$1("Please provide at least one entry ID to delete.");
-      return;
-    }
-    if (!force) {
-      yield* log(`Warning: This will permanently delete ${ids.length} drive entry/entries.`);
-      yield* log("Use --force to skip this confirmation.");
-      return;
+      return yield* fail$3(new ApiError({ message: "Provide at least one entry ID to delete.", code: "CLI_INVALID_ARGUMENT", outcome: "not-dispatched" }));
     }
     yield* log(`Deleting ${ids.length} drive entry/entries...`);
     yield* api.deleteDriveEntries(orgSlug, ids).pipe(
@@ -100637,13 +101017,29 @@ File downloaded successfully!`);
   })
 ).pipe(withDescription("Download a file from My Drive"));
 
+const parentOption = text("parent-id").pipe(
+  withDescription$3("List entries in this folder (default: root)"),
+  optional
+);
 const listCommand$4 = make$4(
   "list",
-  { org: orgOption },
-  ({ org }) => gen(function* () {
+  {
+    org: orgOption,
+    count: countOption,
+    cursor: cursorOption,
+    parentId: parentOption,
+    jsonPage: jsonPageOption
+  },
+  ({ org, count, cursor, parentId, jsonPage }) => gen(function* () {
+    const countValue = count._tag === "Some" ? count.value : void 0;
+    yield* validatePageOptions(countValue, false, jsonPage);
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    const result = yield* api.listDriveEntries(orgSlug).pipe(
+    const result = yield* api.listDriveEntries(orgSlug, {
+      count: countValue,
+      cursor: cursor._tag === "Some" ? cursor.value : void 0,
+      parentId: parentId._tag === "Some" ? parentId.value : void 0
+    }).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -100659,6 +101055,11 @@ const listCommand$4 = make$4(
         })
       )
     );
+    if (jsonPage) {
+      yield* log(jsonFormat({ ...result, nextCursor: result.nextCursor ?? null }));
+      return;
+    }
+    yield* reportNextPage(result.hasNext);
     if (result.items.length === 0) {
       yield* log("No files found in drive.");
       return;
@@ -100672,9 +101073,6 @@ const listCommand$4 = make$4(
       yield* log(`    Modified: ${formatDate(entry.modifiedAt)}`);
       yield* log("");
     }
-    if (result.hasNext) {
-      yield* log("More drive entries are available. Re-run with future pagination support to continue.");
-    }
   })
 ).pipe(withDescription("List files in My Drive"));
 
@@ -101412,12 +101810,9 @@ const exitCommand = make$4(
   "exit",
   { org: orgOption, force: forceOption$1 },
   ({ org, force }) => gen(function* () {
+    yield* requireConfirmation(force, "Leaving the organization");
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    if (!force) {
-      yield* log("Use --force (-f) to confirm leaving the organization.");
-      return;
-    }
     yield* api.exitOrg(orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
@@ -101567,40 +101962,14 @@ const useCommand = make$4(
   "use",
   { slug: slugArg },
   ({ slug }) => gen(function* () {
-    const api = yield* ApiService;
-    const configService = yield* ConfigService;
     yield* log(`Selecting organization: ${slug}`);
-    const org = yield* api.getOrganization(slug).pipe(
-      catchTag(
-        "NotLoggedInError",
-        (e) => gen(function* () {
-          yield* error$1(e.message);
-          return yield* fail$3(e);
-        })
-      ),
-      catchTag(
-        "ApiError",
-        (e) => gen(function* () {
-          yield* error$1(`Failed to select organization: ${e.message}`);
-          return yield* fail$3(e);
-        })
-      )
-    );
-    if (org.ipBlocked) {
-      yield* error$1(`Organization "${slug}" is blocked due to IP restrictions.`);
-      return;
-    }
-    configService.save({
-      currentOrganization: {
-        id: org.id,
-        slug: org.slug,
-        name: org.name
-      }
-    });
+    const org = yield* saveSelectedOrganization(slug);
     yield* log(`
 Switched to organization: ${org.name} (${org.slug})`);
   })
-).pipe(withDescription('Select an organization by slug for subsequent commands. Use "aipctl org select" if you do not know the slug.'));
+).pipe(
+  withDescription('Select an organization by slug for subsequent commands. Use "aipctl org select" if you do not know the slug.')
+);
 
 const orgCommandDescription = "Organization (list, current, use, select, members, capabilities, settings, exit)";
 const orgSubcommands = [
@@ -101671,19 +102040,15 @@ const cloneCommand = make$4(
 const skillIdArg$1 = text$2({ name: "id" }).pipe(withDescription$5("Skill ID to delete"));
 const forceOption = boolean("force").pipe(
   withAlias("f"),
-  withDescription$3("Skip confirmation prompt")
+  withDescription$3("Confirm permanent deletion")
 );
 const deleteCommand = make$4(
   "delete",
   { skillId: skillIdArg$1, org: orgOption, force: forceOption },
   ({ skillId, org, force }) => gen(function* () {
+    yield* requireConfirmation(force, "Skill deletion");
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    if (!force) {
-      yield* log(`Warning: This will permanently delete skill "${skillId}".`);
-      yield* log("Use --force to skip this confirmation.");
-      return;
-    }
     yield* log(`Deleting skill ${skillId}...`);
     yield* api.deleteSkill(orgSlug, skillId).pipe(
       catchTag(
@@ -101792,12 +102157,18 @@ const searchOption$1 = text("search").pipe(
 );
 const libraryCommand = make$4(
   "library",
-  { org: orgOption, search: searchOption$1 },
-  ({ org, search }) => gen(function* () {
+  { org: orgOption, search: searchOption$1, count: countOption, cursor: cursorOption, jsonPage: jsonPageOption },
+  ({ org, search, count, cursor, jsonPage }) => gen(function* () {
+    const countValue = count._tag === "Some" ? count.value : void 0;
+    yield* validatePageOptions(countValue, false, jsonPage);
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
     const searchValue = search._tag === "Some" ? search.value : void 0;
-    const result = yield* api.listLibrarySkills(orgSlug, { search: searchValue }).pipe(
+    const result = yield* api.listLibrarySkills(orgSlug, {
+      search: searchValue,
+      count: countValue,
+      cursor: cursor._tag === "Some" ? cursor.value : void 0
+    }).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -101813,6 +102184,11 @@ const libraryCommand = make$4(
         })
       )
     );
+    if (jsonPage) {
+      yield* log(jsonFormat({ ...result, nextCursor: result.nextCursor ?? null }));
+      return;
+    }
+    yield* reportNextPage(result.hasNext);
     if (result.items.length === 0) {
       yield* log("No shared skills found.");
       return;
@@ -101830,9 +102206,6 @@ const libraryCommand = make$4(
       yield* log(`    Uploaded: ${formatDate(skill.uploadedAt)}`);
       yield* log("");
     }
-    if (result.hasNext) {
-      yield* log("(More shared skills available.)");
-    }
   })
 ).pipe(withDescription("List shared skills from the library"));
 
@@ -101848,12 +102221,25 @@ const jsonOption = boolean("json").pipe(
 );
 const listCommand = make$4(
   "list",
-  { org: orgOption, search: searchOption, json: jsonOption },
-  ({ org, search, json }) => gen(function* () {
+  {
+    org: orgOption,
+    search: searchOption,
+    json: jsonOption,
+    count: countOption,
+    cursor: cursorOption,
+    jsonPage: jsonPageOption
+  },
+  ({ org, search, json, count, cursor, jsonPage }) => gen(function* () {
+    const countValue = count._tag === "Some" ? count.value : void 0;
+    yield* validatePageOptions(countValue, json, jsonPage);
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
     const searchValue = search._tag === "Some" ? search.value : void 0;
-    const result = yield* api.listSkills(orgSlug, { search: searchValue }).pipe(
+    const result = yield* api.listSkills(orgSlug, {
+      search: searchValue,
+      count: countValue,
+      cursor: cursor._tag === "Some" ? cursor.value : void 0
+    }).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -101869,10 +102255,16 @@ const listCommand = make$4(
         })
       )
     );
+    if (jsonPage) {
+      yield* log(jsonFormat({ ...result, nextCursor: result.nextCursor ?? null }));
+      return;
+    }
     if (json) {
       yield* log(jsonFormat(result.items));
+      yield* reportNextPage(result.hasNext);
       return;
     }
+    yield* reportNextPage(result.hasNext);
     if (result.items.length === 0) {
       yield* log("No skills found.");
       return;
@@ -101905,9 +102297,6 @@ const listCommand = make$4(
       }
       yield* log("");
     }
-    if (result.hasNext) {
-      yield* log("(More skills available. Use pagination to see all.)");
-    }
   })
 ).pipe(withDescription("List skills in the current (or specified) organization"));