aipctl 2026.10.5 → 2026.10.7

package/build/index.cjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 
-var childProcess = require('node:child_process');
+var ChildProcess = require('node:child_process');
 require('node:stream');
 var crypto = require('node:crypto');
 var fs = require('node:fs');
@@ -31,10 +31,7 @@ var require$$0$6 = require('path');
 var require$$0$5 = require('fs');
 var require$$0$4 = require('constants');
 var require$$5 = require('assert');
-var process$1 = require('node:process');
-var node_buffer = require('node:buffer');
-var node_util = require('node:util');
-var fs$1 = require('node:fs/promises');
+var promises$1 = require('node:fs/promises');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 function _interopNamespaceDefault(e) {
@@ -54,7 +51,7 @@ function _interopNamespaceDefault(e) {
   return Object.freeze(n);
 }
 
-var childProcess__namespace = /*#__PURE__*/_interopNamespaceDefault(childProcess);
+var ChildProcess__namespace = /*#__PURE__*/_interopNamespaceDefault(ChildProcess);
 var crypto__namespace = /*#__PURE__*/_interopNamespaceDefault(crypto);
 var fs__namespace = /*#__PURE__*/_interopNamespaceDefault(fs);
 var os__namespace = /*#__PURE__*/_interopNamespaceDefault(os);
@@ -46340,7 +46337,7 @@ const runCommand$1 = fileSystem => command => {
     case "StandardCommand":
       {
         const spawn = flatMap$5(make$m(), exitCode => async(resume => {
-          const handle = childProcess__namespace.spawn(command.command, command.args, {
+          const handle = ChildProcess__namespace.spawn(command.command, command.args, {
             stdio: [inputToStdioOption(command.stdin), outputToStdioOption(command.stdout), outputToStdioOption(command.stderr)],
             cwd: getOrElse(command.cwd, constUndefined),
             shell: command.shell,
@@ -46539,7 +46536,7 @@ const openFactory = method => {
   const nodeClose = effectify(fs__namespace.close, handleErrnoException("FileSystem", method), handleBadArgument(method));
   return (path, options) => pipe(acquireRelease(nodeOpen(path, options?.flag ?? "r", options?.mode), fd => orDie(nodeClose(fd))), map$9(fd => makeFile(FileDescriptor(fd), options?.flag?.startsWith("a") ?? false)));
 };
-const open$1 = /*#__PURE__*/openFactory("open");
+const open = /*#__PURE__*/openFactory("open");
 const makeFile = /*#__PURE__*/(() => {
   const nodeReadFactory = method => effectify(fs__namespace.read, handleErrnoException("FileSystem", method), handleBadArgument(method));
   const nodeRead = /*#__PURE__*/nodeReadFactory("read");
@@ -46809,7 +46806,7 @@ const makeFileSystem = /*#__PURE__*/map$9( /*#__PURE__*/serviceOption(WatchBacke
   makeTempDirectoryScoped,
   makeTempFile,
   makeTempFileScoped,
-  open: open$1,
+  open,
   readDirectory,
   readFile,
   readLink,
@@ -92122,617 +92119,20 @@ function makeCredentialService(directory) {
 const CredentialServiceLive = succeed$2(CredentialServiceTag, makeCredentialService(CONFIG_DIR$1));
 const CredentialService = CredentialServiceTag;
 
-let isDockerCached;
-
-function hasDockerEnv() {
-	try {
-		fs.statSync('/.dockerenv');
-		return true;
-	} catch {
-		return false;
-	}
-}
-
-function hasDockerCGroup() {
-	try {
-		return fs.readFileSync('/proc/self/cgroup', 'utf8').includes('docker');
-	} catch {
-		return false;
-	}
-}
-
-function isDocker() {
-	// TODO: Use `??=` when targeting Node.js 16.
-	if (isDockerCached === undefined) {
-		isDockerCached = hasDockerEnv() || hasDockerCGroup();
-	}
-
-	return isDockerCached;
-}
-
-let cachedResult;
-
-// Podman detection
-const hasContainerEnv = () => {
-	try {
-		fs.statSync('/run/.containerenv');
-		return true;
-	} catch {
-		return false;
-	}
-};
-
-function isInsideContainer() {
-	// TODO: Use `??=` when targeting Node.js 16.
-	if (cachedResult === undefined) {
-		cachedResult = hasContainerEnv() || isDocker();
-	}
-
-	return cachedResult;
-}
-
-const isWsl = () => {
-	if (process$1.platform !== 'linux') {
-		return false;
-	}
-
-	if (os.release().toLowerCase().includes('microsoft')) {
-		if (isInsideContainer()) {
-			return false;
-		}
-
-		return true;
-	}
-
-	try {
-		if (fs.readFileSync('/proc/version', 'utf8').toLowerCase().includes('microsoft')) {
-			return !isInsideContainer();
-		}
-	} catch {}
-
-	// Fallback for custom kernels: check WSL-specific paths.
-	if (
-		fs.existsSync('/proc/sys/fs/binfmt_misc/WSLInterop')
-		|| fs.existsSync('/run/WSL')
-	) {
-		return !isInsideContainer();
-	}
-
-	return false;
-};
-
-var isWsl$1 = process$1.env.__IS_WSL_TEST__ ? isWsl : isWsl();
-
-const wslDrivesMountPoint = (() => {
-	// Default value for "root" param
-	// according to https://docs.microsoft.com/en-us/windows/wsl/wsl-config
-	const defaultMountPoint = '/mnt/';
-
-	let mountPoint;
-
-	return async function () {
-		if (mountPoint) {
-			// Return memoized mount point value
-			return mountPoint;
-		}
-
-		const configFilePath = '/etc/wsl.conf';
-
-		let isConfigFileExists = false;
-		try {
-			await fs$1.access(configFilePath, fs$1.constants.F_OK);
-			isConfigFileExists = true;
-		} catch {}
-
-		if (!isConfigFileExists) {
-			return defaultMountPoint;
-		}
-
-		const configContent = await fs$1.readFile(configFilePath, {encoding: 'utf8'});
-		const configMountPoint = /(?<!#.*)root\s*=\s*(?<mountPoint>.*)/g.exec(configContent);
-
-		if (!configMountPoint) {
-			return defaultMountPoint;
-		}
-
-		mountPoint = configMountPoint.groups.mountPoint.trim();
-		mountPoint = mountPoint.endsWith('/') ? mountPoint : `${mountPoint}/`;
-
-		return mountPoint;
-	};
-})();
-
-const powerShellPathFromWsl = async () => {
-	const mountPoint = await wslDrivesMountPoint();
-	return `${mountPoint}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`;
-};
-
-const powerShellPath = async () => {
-	if (isWsl$1) {
-		return powerShellPathFromWsl();
-	}
-
-	return `${process$1.env.SYSTEMROOT || process$1.env.windir || String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;
-};
-
-function defineLazyProperty(object, propertyName, valueGetter) {
-	const define = value => Object.defineProperty(object, propertyName, {value, enumerable: true, writable: true});
-
-	Object.defineProperty(object, propertyName, {
-		configurable: true,
-		enumerable: true,
-		get() {
-			const result = valueGetter();
-			define(result);
-			return result;
-		},
-		set(value) {
-			define(value);
-		}
-	});
-
-	return object;
-}
-
-const execFileAsync$3 = node_util.promisify(childProcess.execFile);
-
-async function defaultBrowserId() {
-	if (process$1.platform !== 'darwin') {
-		throw new Error('macOS only');
-	}
-
-	const {stdout} = await execFileAsync$3('defaults', ['read', 'com.apple.LaunchServices/com.apple.launchservices.secure', 'LSHandlers']);
-
-	// `(?!-)` is to prevent matching `LSHandlerRoleAll = "-";`.
-	const match = /LSHandlerRoleAll = "(?!-)(?<id>[^"]+?)";\s+?LSHandlerURLScheme = (?:http|https);/.exec(stdout);
-
-	const browserId = match?.groups.id ?? 'com.apple.Safari';
-
-	// Correct the case for Safari's bundle identifier
-	if (browserId === 'com.apple.safari') {
-		return 'com.apple.Safari';
-	}
-
-	return browserId;
-}
-
-const execFileAsync$2 = node_util.promisify(childProcess.execFile);
-
-async function runAppleScript(script, {humanReadableOutput = true, signal} = {}) {
-	if (process$1.platform !== 'darwin') {
-		throw new Error('macOS only');
-	}
-
-	const outputArguments = humanReadableOutput ? [] : ['-ss'];
-
-	const execOptions = {};
-	if (signal) {
-		execOptions.signal = signal;
-	}
-
-	const {stdout} = await execFileAsync$2('osascript', ['-e', script, outputArguments], execOptions);
-	return stdout.trim();
-}
-
-async function bundleName(bundleId) {
-	return runAppleScript(`tell application "Finder" to set app_path to application file id "${bundleId}" as string\ntell application "System Events" to get value of property list item "CFBundleName" of property list file (app_path & ":Contents:Info.plist")`);
-}
-
-const execFileAsync$1 = node_util.promisify(childProcess.execFile);
-
-// TODO: Fix the casing of bundle identifiers in the next major version.
-
-// Windows doesn't have browser IDs in the same way macOS/Linux does so we give fake
-// ones that look real and match the macOS/Linux versions for cross-platform apps.
-const windowsBrowserProgIds = {
-	MSEdgeHTM: {name: 'Edge', id: 'com.microsoft.edge'}, // The missing `L` is correct.
-	MSEdgeBHTML: {name: 'Edge Beta', id: 'com.microsoft.edge.beta'},
-	MSEdgeDHTML: {name: 'Edge Dev', id: 'com.microsoft.edge.dev'},
-	AppXq0fevzme2pys62n3e0fbqa7peapykr8v: {name: 'Edge', id: 'com.microsoft.edge.old'},
-	ChromeHTML: {name: 'Chrome', id: 'com.google.chrome'},
-	ChromeBHTML: {name: 'Chrome Beta', id: 'com.google.chrome.beta'},
-	ChromeDHTML: {name: 'Chrome Dev', id: 'com.google.chrome.dev'},
-	ChromiumHTM: {name: 'Chromium', id: 'org.chromium.Chromium'},
-	BraveHTML: {name: 'Brave', id: 'com.brave.Browser'},
-	BraveBHTML: {name: 'Brave Beta', id: 'com.brave.Browser.beta'},
-	BraveDHTML: {name: 'Brave Dev', id: 'com.brave.Browser.dev'},
-	BraveSSHTM: {name: 'Brave Nightly', id: 'com.brave.Browser.nightly'},
-	FirefoxURL: {name: 'Firefox', id: 'org.mozilla.firefox'},
-	OperaStable: {name: 'Opera', id: 'com.operasoftware.Opera'},
-	VivaldiHTM: {name: 'Vivaldi', id: 'com.vivaldi.Vivaldi'},
-	'IE.HTTP': {name: 'Internet Explorer', id: 'com.microsoft.ie'},
-};
-
-new Map(Object.entries(windowsBrowserProgIds));
-
-class UnknownBrowserError extends Error {}
-
-async function defaultBrowser$1(_execFileAsync = execFileAsync$1) {
-	const {stdout} = await _execFileAsync('reg', [
-		'QUERY',
-		' HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice',
-		'/v',
-		'ProgId',
-	]);
-
-	const match = /ProgId\s*REG_SZ\s*(?<id>\S+)/.exec(stdout);
-	if (!match) {
-		throw new UnknownBrowserError(`Cannot find Windows browser in stdout: ${JSON.stringify(stdout)}`);
-	}
-
-	const {id} = match.groups;
-
-	// Windows can append a hash suffix to ProgIds using a dot or hyphen
-	// (e.g., `ChromeHTML.ABC123`, `FirefoxURL-6F193CCC56814779`).
-	// Try exact match first, then try without the suffix.
-	const dotIndex = id.lastIndexOf('.');
-	const hyphenIndex = id.lastIndexOf('-');
-	const baseIdByDot = dotIndex === -1 ? undefined : id.slice(0, dotIndex);
-	const baseIdByHyphen = hyphenIndex === -1 ? undefined : id.slice(0, hyphenIndex);
-
-	return windowsBrowserProgIds[id] ?? windowsBrowserProgIds[baseIdByDot] ?? windowsBrowserProgIds[baseIdByHyphen] ?? {name: id, id};
-}
-
-const execFileAsync = node_util.promisify(childProcess.execFile);
-
-// Inlined: https://github.com/sindresorhus/titleize/blob/main/index.js
-const titleize = string => string.toLowerCase().replaceAll(/(?:^|\s|-)\S/g, x => x.toUpperCase());
-
-async function defaultBrowser() {
-	if (process$1.platform === 'darwin') {
-		const id = await defaultBrowserId();
-		const name = await bundleName(id);
-		return {name, id};
-	}
-
-	if (process$1.platform === 'linux') {
-		const {stdout} = await execFileAsync('xdg-mime', ['query', 'default', 'x-scheme-handler/http']);
-		const id = stdout.trim();
-		const name = titleize(id.replace(/.desktop$/, '').replace('-', ' '));
-		return {name, id};
-	}
-
-	if (process$1.platform === 'win32') {
-		return defaultBrowser$1();
-	}
-
-	throw new Error('Only macOS, Linux, and Windows are supported');
-}
-
-const execFile = node_util.promisify(childProcess.execFile);
-
-// Path to included `xdg-open`.
-const __dirname$1 = path$1.dirname(NodeUrl.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href))));
-const localXdgOpenPath = path$1.join(__dirname$1, 'xdg-open');
-
-const {platform, arch} = process$1;
-
-/**
-Get the default browser name in Windows from WSL.
-
-@returns {Promise<string>} Browser name.
-*/
-async function getWindowsDefaultBrowserFromWsl() {
-	const powershellPath = await powerShellPath();
-	const rawCommand = String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`;
-	const encodedCommand = node_buffer.Buffer.from(rawCommand, 'utf16le').toString('base64');
-
-	const {stdout} = await execFile(
-		powershellPath,
-		[
-			'-NoProfile',
-			'-NonInteractive',
-			'-ExecutionPolicy',
-			'Bypass',
-			'-EncodedCommand',
-			encodedCommand,
-		],
-		{encoding: 'utf8'},
-	);
-
-	const progId = stdout.trim();
-
-	// Map ProgId to browser IDs
-	const browserMap = {
-		ChromeHTML: 'com.google.chrome',
-		BraveHTML: 'com.brave.Browser',
-		MSEdgeHTM: 'com.microsoft.edge',
-		FirefoxURL: 'org.mozilla.firefox',
-	};
-
-	return browserMap[progId] ? {id: browserMap[progId]} : {};
-}
-
-const pTryEach = async (array, mapper) => {
-	let latestError;
-
-	for (const item of array) {
-		try {
-			return await mapper(item); // eslint-disable-line no-await-in-loop
-		} catch (error) {
-			latestError = error;
-		}
-	}
-
-	throw latestError;
-};
-
-// eslint-disable-next-line complexity
-const baseOpen = async options => {
-	options = {
-		wait: false,
-		background: false,
-		newInstance: false,
-		allowNonzeroExitCode: false,
-		...options,
-	};
-
-	if (Array.isArray(options.app)) {
-		return pTryEach(options.app, singleApp => baseOpen({
-			...options,
-			app: singleApp,
-		}));
-	}
-
-	let {name: app, arguments: appArguments = []} = options.app ?? {};
-	appArguments = [...appArguments];
-
-	if (Array.isArray(app)) {
-		return pTryEach(app, appName => baseOpen({
-			...options,
-			app: {
-				name: appName,
-				arguments: appArguments,
-			},
-		}));
-	}
-
-	if (app === 'browser' || app === 'browserPrivate') {
-		// IDs from default-browser for macOS and windows are the same
-		const ids = {
-			'com.google.chrome': 'chrome',
-			'google-chrome.desktop': 'chrome',
-			'com.brave.Browser': 'brave',
-			'org.mozilla.firefox': 'firefox',
-			'firefox.desktop': 'firefox',
-			'com.microsoft.msedge': 'edge',
-			'com.microsoft.edge': 'edge',
-			'com.microsoft.edgemac': 'edge',
-			'microsoft-edge.desktop': 'edge',
-		};
-
-		// Incognito flags for each browser in `apps`.
-		const flags = {
-			chrome: '--incognito',
-			brave: '--incognito',
-			firefox: '--private-window',
-			edge: '--inPrivate',
-		};
-
-		const browser = isWsl$1 ? await getWindowsDefaultBrowserFromWsl() : await defaultBrowser();
-		if (browser.id in ids) {
-			const browserName = ids[browser.id];
-
-			if (app === 'browserPrivate') {
-				appArguments.push(flags[browserName]);
-			}
-
-			return baseOpen({
-				...options,
-				app: {
-					name: apps[browserName],
-					arguments: appArguments,
-				},
-			});
-		}
-
-		throw new Error(`${browser.name} is not supported as a default browser`);
-	}
-
-	let command;
-	const cliArguments = [];
-	const childProcessOptions = {};
-
-	if (platform === 'darwin') {
-		command = 'open';
-
-		if (options.wait) {
-			cliArguments.push('--wait-apps');
-		}
-
-		if (options.background) {
-			cliArguments.push('--background');
-		}
-
-		if (options.newInstance) {
-			cliArguments.push('--new');
-		}
-
-		if (app) {
-			cliArguments.push('-a', app);
-		}
-	} else if (platform === 'win32' || (isWsl$1 && !isInsideContainer() && !app)) {
-		command = await powerShellPath();
-
-		cliArguments.push(
-			'-NoProfile',
-			'-NonInteractive',
-			'-ExecutionPolicy',
-			'Bypass',
-			'-EncodedCommand',
-		);
-
-		if (!isWsl$1) {
-			childProcessOptions.windowsVerbatimArguments = true;
-		}
-
-		const encodedArguments = ['Start'];
-
-		if (options.wait) {
-			encodedArguments.push('-Wait');
-		}
-
-		if (app) {
-			// Double quote with double quotes to ensure the inner quotes are passed through.
-			// Inner quotes are delimited for PowerShell interpretation with backticks.
-			encodedArguments.push(`"\`"${app}\`""`);
-			if (options.target) {
-				appArguments.push(options.target);
-			}
-		} else if (options.target) {
-			encodedArguments.push(`"${options.target}"`);
-		}
-
-		if (appArguments.length > 0) {
-			appArguments = appArguments.map(argument => `"\`"${argument}\`""`);
-			encodedArguments.push('-ArgumentList', appArguments.join(','));
-		}
-
-		// Using Base64-encoded command, accepted by PowerShell, to allow special characters.
-		options.target = node_buffer.Buffer.from(encodedArguments.join(' '), 'utf16le').toString('base64');
-	} else {
-		if (app) {
-			command = app;
-		} else {
-			// When bundled by Webpack, there's no actual package file path and no local `xdg-open`.
-			const isBundled = !__dirname$1 || __dirname$1 === '/';
-
-			// Check if local `xdg-open` exists and is executable.
-			let exeLocalXdgOpen = false;
-			try {
-				await fs$1.access(localXdgOpenPath, fs$1.constants.X_OK);
-				exeLocalXdgOpen = true;
-			} catch {}
-
-			const useSystemXdgOpen = process$1.versions.electron
-				?? (platform === 'android' || isBundled || !exeLocalXdgOpen);
-			command = useSystemXdgOpen ? 'xdg-open' : localXdgOpenPath;
-		}
-
-		if (appArguments.length > 0) {
-			cliArguments.push(...appArguments);
-		}
-
-		if (!options.wait) {
-			// `xdg-open` will block the process unless stdio is ignored
-			// and it's detached from the parent even if it's unref'd.
-			childProcessOptions.stdio = 'ignore';
-			childProcessOptions.detached = true;
-		}
-	}
-
-	if (platform === 'darwin' && appArguments.length > 0) {
-		cliArguments.push('--args', ...appArguments);
-	}
-
-	// This has to come after `--args`.
-	if (options.target) {
-		cliArguments.push(options.target);
-	}
-
-	const subprocess = childProcess.spawn(command, cliArguments, childProcessOptions);
-
-	if (options.wait) {
-		return new Promise((resolve, reject) => {
-			subprocess.once('error', reject);
-
-			subprocess.once('close', exitCode => {
-				if (!options.allowNonzeroExitCode && exitCode > 0) {
-					reject(new Error(`Exited with code ${exitCode}`));
-					return;
-				}
-
-				resolve(subprocess);
-			});
-		});
-	}
-
-	subprocess.unref();
-
-	return subprocess;
-};
-
-const open = (target, options) => {
-	if (typeof target !== 'string') {
-		throw new TypeError('Expected a `target`');
-	}
-
-	return baseOpen({
-		...options,
-		target,
-	});
-};
-
-function detectArchBinary(binary) {
-	if (typeof binary === 'string' || Array.isArray(binary)) {
-		return binary;
-	}
-
-	const {[arch]: archBinary} = binary;
-
-	if (!archBinary) {
-		throw new Error(`${arch} is not supported`);
-	}
-
-	return archBinary;
-}
-
-function detectPlatformBinary({[platform]: platformBinary}, {wsl}) {
-	if (wsl && isWsl$1) {
-		return detectArchBinary(wsl);
-	}
-
-	if (!platformBinary) {
-		throw new Error(`${platform} is not supported`);
-	}
-
-	return detectArchBinary(platformBinary);
+function openBrowser(url) {
+  try {
+    const os$1 = os.platform();
+    const windows = os$1 === "win32" || os$1 === "linux" && Boolean(process.env["WSL_INTEROP"]);
+    const script = `Start-Process -FilePath '${url.replaceAll("'", "''")}'`;
+    const command = windows ? "powershell.exe" : os$1 === "darwin" ? "/usr/bin/open" : "xdg-open";
+    const args = windows ? ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")] : [url];
+    const child = ChildProcess.spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => void 0);
+    child.unref();
+  } catch {
+  }
 }
 
-const apps = {};
-
-defineLazyProperty(apps, 'chrome', () => detectPlatformBinary({
-	darwin: 'google chrome',
-	win32: 'chrome',
-	linux: ['google-chrome', 'google-chrome-stable', 'chromium'],
-}, {
-	wsl: {
-		ia32: '/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe',
-		x64: ['/mnt/c/Program Files/Google/Chrome/Application/chrome.exe', '/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe'],
-	},
-}));
-
-defineLazyProperty(apps, 'brave', () => detectPlatformBinary({
-	darwin: 'brave browser',
-	win32: 'brave',
-	linux: ['brave-browser', 'brave'],
-}, {
-	wsl: {
-		ia32: '/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe',
-		x64: ['/mnt/c/Program Files/BraveSoftware/Brave-Browser/Application/brave.exe', '/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe'],
-	},
-}));
-
-defineLazyProperty(apps, 'firefox', () => detectPlatformBinary({
-	darwin: 'firefox',
-	win32: String.raw`C:\Program Files\Mozilla Firefox\firefox.exe`,
-	linux: 'firefox',
-}, {
-	wsl: '/mnt/c/Program Files/Mozilla Firefox/firefox.exe',
-}));
-
-defineLazyProperty(apps, 'edge', () => detectPlatformBinary({
-	darwin: 'microsoft edge',
-	win32: 'msedge',
-	linux: ['microsoft-edge', 'microsoft-edge-dev'],
-}, {
-	wsl: '/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe',
-}));
-
-defineLazyProperty(apps, 'browser', () => 'browser');
-
-defineLazyProperty(apps, 'browserPrivate', () => 'browserPrivate');
-
 const REDACTED_VALUE = "[REDACTED]";
 const FULLY_REDACTED_KEYS = /* @__PURE__ */ new Set([
   "token",
@@ -93735,7 +93135,7 @@ const startOAuthFlow = gen(function* () {
     yield* sync$1(() => {
       console.log("Opening browser for login...");
       console.log(`If browser doesn't open, visit: ${sanitizeOAuthAuthorizeUrlForDisplay(authorizeUrl)}`);
-      void open(authorizeUrl).catch(() => void 0);
+      void openBrowser(authorizeUrl);
     });
     const callback = yield* raceFirst(
       _await(deferred),
@@ -93779,7 +93179,7 @@ const injectedBuildEnv = "dev".length > 0 ? "dev" : "local";
 if (!isBuildEnv(injectedBuildEnv)) {
   throw new Error(`Invalid AIPCTL_BUILD_ENV: ${injectedBuildEnv}`);
 }
-const VERSION = "2026.10.5".length > 0 ? "2026.10.5" : "0.0.0";
+const VERSION = "2026.10.7".length > 0 ? "2026.10.7" : "0.0.0";
 const BUILD_ENV = injectedBuildEnv;
 const INCLUDE_NATIVE_LOGS = BUILD_ENV !== "prod";
 
@@ -94769,9 +94169,9 @@ function apiErrorFromUnknown(error, fallbackMessage) {
   });
 }
 class AgentChatStreamIncompleteError extends Error {
-  constructor(sawOnlyTerminalEnvelope) {
+  constructor(canResubscribe) {
     super("Agent chat stream ended without a complete event");
-    this.sawOnlyTerminalEnvelope = sawOnlyTerminalEnvelope;
+    this.canResubscribe = canResubscribe;
     this.name = "AgentChatStreamIncompleteError";
   }
   _tag = "AgentChatStreamIncompleteError";
@@ -95011,7 +94411,12 @@ const extractFinalAgentChatResult = (parsed) => {
     return null;
   }
   const text = getResponseMessageText(parsed["responseMessage"]);
-  return text === void 0 ? null : { text, conversationId };
+  const requestMessage = parseStreamEnvelopeData(parsed["requestMessage"]);
+  return text === void 0 ? null : {
+    text,
+    conversationId,
+    ...typeof requestMessage?.["messageId"] === "string" ? { requestMessageId: requestMessage["messageId"] } : {}
+  };
 };
 const parseStreamEnvelopeData = (data) => {
   if (typeof data === "string") {
@@ -95056,12 +94461,63 @@ const isTerminalStreamEnvelope = (data) => {
     return false;
   }
 };
-const parseSseStream = async (body) => {
+const parseSseStream = async (body, execution) => {
+  const { conversationId, runId: expectedRunId, requestMessageId } = execution;
   const reader = body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
   let hasDataEvent = false;
-  let sawOnlyTerminalEnvelope = false;
+  let hasNonTerminalData = false;
+  let uiStarted = false;
+  let uiFinished = false;
+  const textBlocks = /* @__PURE__ */ new Map();
+  const invalidStream = () => createApiError({
+    message: "The chat response was incomplete. Check the conversation before sending the message again.",
+    code: "CLI_RESPONSE_INVALID",
+    outcome: "unknown"
+  });
+  const consumeUiEnvelope = (payload) => {
+    const chunk = parseStreamEnvelopeData(payload["chunk"]);
+    if (!chunk || payload["conversationId"] !== conversationId || typeof payload["runId"] !== "string" || !payload["runId"]) {
+      throw invalidStream();
+    }
+    if (!expectedRunId || payload["runId"] !== expectedRunId) throw invalidStream();
+    if (uiFinished) throw invalidStream();
+    if (chunk["type"] === "start") {
+      if (uiStarted) throw invalidStream();
+      uiStarted = true;
+      return;
+    }
+    if (!uiStarted || typeof chunk["type"] !== "string") throw invalidStream();
+    switch (chunk["type"]) {
+      case "text-start": {
+        const id = chunk["id"];
+        if (typeof id !== "string" || !id || textBlocks.has(id)) throw invalidStream();
+        textBlocks.set(id, { text: "", closed: false });
+        break;
+      }
+      case "text-delta":
+      case "text-end": {
+        const block = typeof chunk["id"] === "string" ? textBlocks.get(chunk["id"]) : void 0;
+        if (!block || block.closed) throw invalidStream();
+        if (chunk["type"] === "text-end") block.closed = true;
+        else {
+          if (typeof chunk["delta"] !== "string") throw invalidStream();
+          block.text += chunk["delta"];
+        }
+        break;
+      }
+      case "finish": {
+        const blocks = [...textBlocks.values()];
+        if (!blocks.some((block) => block.text.length > 0) || blocks.some((block) => !block.closed)) throw invalidStream();
+        uiFinished = true;
+        break;
+      }
+      case "error":
+      case "abort":
+        throw invalidStream();
+    }
+  };
   try {
     while (true) {
       const { done, value } = await reader.read();
@@ -95076,20 +94532,40 @@ const parseSseStream = async (body) => {
         }
         hasDataEvent = true;
         if (isTerminalStreamEnvelope(data)) {
-          sawOnlyTerminalEnvelope = true;
+          const terminal = JSON.parse(data);
+          if (uiStarted) {
+            if (terminal["type"] !== "end" || !uiFinished || terminal["status"] !== "completed") throw invalidStream();
+            if (terminal["runId"] !== expectedRunId) throw invalidStream();
+            if ("conversationId" in terminal && terminal["conversationId"] !== conversationId) throw invalidStream();
+            return { conversationId, text: [...textBlocks.values()].map((block) => block.text).join("") };
+          }
+          if (expectedRunId) {
+            if (terminal["runId"] === expectedRunId || hasNonTerminalData) throw invalidStream();
+            throw new AgentChatStreamIncompleteError(true);
+          }
+          if (terminal["type"] === "abort" || terminal["status"] === "failed") throw invalidStream();
+          continue;
+        }
+        const envelope = parseStreamEnvelopeData(data);
+        const payload = envelope?.["type"] === "event" ? parseStreamEnvelopeData(envelope["data"]) : envelope;
+        if (payload && "chunk" in payload) {
+          if (expectedRunId && !uiStarted && payload["conversationId"] === conversationId && typeof payload["runId"] === "string" && payload["runId"] && payload["runId"] !== expectedRunId) continue;
+          hasNonTerminalData = true;
+          consumeUiEnvelope(payload);
           continue;
         }
-        sawOnlyTerminalEnvelope = false;
+        hasNonTerminalData = true;
         const result = parseAgentChatEvent(data);
         if (result) {
-          return result;
+          if (expectedRunId || uiStarted || result.conversationId !== conversationId || requestMessageId !== void 0 && result.requestMessageId !== requestMessageId) throw invalidStream();
+          return { conversationId: result.conversationId, text: result.text };
         }
       }
     }
   } finally {
     reader.releaseLock();
   }
-  throw new AgentChatStreamIncompleteError(hasDataEvent && sawOnlyTerminalEnvelope);
+  throw new AgentChatStreamIncompleteError(hasDataEvent && !hasNonTerminalData);
 };
 const makeApiServiceLive = (buildEnv) => effect$1(
   ApiServiceTag,
@@ -95274,8 +94750,9 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }
       return _void;
     };
-    const subscribeAgentChatStream = (orgSlug, conversationId, token) => gen(function* () {
+    const subscribeAgentChatStream = (orgSlug, execution, token) => gen(function* () {
       const resolvedChatBaseUrl = yield* requireChatBaseUrlEffect();
+      const { conversationId, requestMessageId } = execution;
       const path = `/api/${encodeURIComponent(orgSlug)}/conversations/${encodeURIComponent(conversationId)}/stream`;
       return yield* tryPromise({
         try: async (signal) => {
@@ -95287,7 +94764,7 @@ const makeApiServiceLive = (buildEnv) => effect$1(
                 {
                   method: "POST",
                   headers: jsonBearerHeaders(token),
-                  body: JSON.stringify({})
+                  body: JSON.stringify(requestMessageId === void 0 ? {} : { requestMessageId })
                 },
                 async (response) => {
                   if (!response.ok) {
@@ -95298,7 +94775,7 @@ const makeApiServiceLive = (buildEnv) => effect$1(
                       message: "No response body from agent chat stream endpoint"
                     });
                   }
-                  return await parseSseStream(response.body);
+                  return await parseSseStream(response.body, execution);
                 },
                 {
                   signal,
@@ -95307,7 +94784,7 @@ const makeApiServiceLive = (buildEnv) => effect$1(
                 }
               );
             } catch (error) {
-              if (error instanceof AgentChatStreamIncompleteError && error.sawOnlyTerminalEnvelope && attempt < AGENT_CHAT_STREAM_MAX_ATTEMPTS) {
+              if (error instanceof AgentChatStreamIncompleteError && error.canResubscribe && attempt < AGENT_CHAT_STREAM_MAX_ATTEMPTS) {
                 await sleep(AGENT_CHAT_STREAM_RETRY_DELAY_MS);
                 continue;
               }
@@ -95336,7 +94813,14 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         method: "POST",
         body
       });
-      return yield* subscribeAgentChatStream(orgSlug, startResponse.conversationId, token);
+      if (!startResponse || typeof startResponse.conversationId !== "string" || !startResponse.conversationId || body.conversationId !== void 0 && body.conversationId !== startResponse.conversationId || "runId" in startResponse && (typeof startResponse.runId !== "string" || !startResponse.runId) || "requestMessageId" in startResponse && (typeof startResponse.requestMessageId !== "string" || !startResponse.requestMessageId) || body.conversationId !== void 0 && !startResponse.runId && !startResponse.requestMessageId) {
+        return yield* fail$3(createApiError({
+          message: "The chat start response did not identify this execution. Check the conversation before sending the message again.",
+          code: "CLI_RESPONSE_INVALID",
+          outcome: "unknown"
+        }));
+      }
+      return yield* subscribeAgentChatStream(orgSlug, startResponse, token);
     });
     const resolveAgentInstallationId = (orgSlug, conversationId, token) => gen(function* () {
       const conversation = yield* makeRequest(
@@ -96417,7 +95901,7 @@ const resolveNativeBinary = (options = {}) => {
 };
 const runNativeCommand = (args, options = {}) => new Promise((resolve) => {
   const env = options.env ?? process.env;
-  const spawn = options.spawn ?? childProcess.spawn;
+  const spawn = options.spawn ?? ChildProcess.spawn;
   const binaryPath = resolveNativeBinary(options);
   const child = spawn(binaryPath, [...args], {
     stdio: "inherit",
@@ -98616,8 +98100,11 @@ const uploadCommand$2 = make$4(
     const api = yield* ApiService;
     const ext = path__namespace.extname(file).toLowerCase();
     if (ext !== ".zip" && ext !== ".skill") {
-      yield* error$1("Invalid file type. Only .zip and .skill files are supported.");
-      return;
+      return yield* fail$3(new ApiError({
+        message: "Invalid file type. Only .zip and .skill files are supported.",
+        code: "CLI_INVALID_ARGUMENT",
+        outcome: "not-dispatched"
+      }));
     }
     const stats = yield* try_({
       try: () => fs__namespace.statSync(file),
@@ -98789,7 +98276,7 @@ const configCommand$1 = make$4(
     yield* log(
       `Command: ${formatSensitiveDisplayValue(config.command, {
         revealSensitive: showSensitive,
-        mode: "sanitized"
+        mode: "redacted"
       })}`
     );
     if (!showSensitive) {
@@ -99697,7 +99184,7 @@ const startOrganizationSelectionBrowserFlow = (knownOrganizations, initialSessio
   return yield* gen(function* () {
     yield* sync$1(() => {
       console.log(`If browser doesn't open, visit: ${selectionUrl}`);
-      void open(selectionUrl).catch(() => void 0);
+      void openBrowser(selectionUrl);
     });
     const callback = yield* raceFirst(
       _await(deferred),
@@ -100693,14 +100180,14 @@ const buildModelExecImageGenerationRequest = (model, input) => ({
   ...input.options ? { options: input.options } : {}
 });
 const readJsonInputFile = (path) => tryPromise({
-  try: async () => JSON.parse(await fs$1.readFile(path, "utf8")),
+  try: async () => JSON.parse(await promises$1.readFile(path, "utf8")),
   catch: (error) => new ApiError({
     message: `Failed to read JSON input "${path}": ${error instanceof Error ? error.message : String(error)}`
   })
 });
 const saveJsonFile = (path, value) => tryPromise({
   try: async () => {
-    await fs$1.writeFile(path, `${JSON.stringify(value, null, 2)}
+    await promises$1.writeFile(path, `${JSON.stringify(value, null, 2)}
 `, "utf8");
   },
   catch: (error) => new ApiError({
@@ -101339,13 +100826,14 @@ const testConnectionCommand = make$4(
     if (result.success) {
       yield* log(`\u2713 Connection test passed!`);
     } else {
-      yield* log(`\u2717 Connection test failed.`);
-      if (result.error) {
-        yield* log(`  Error: ${formatIntegrationTestMessage(result.error)}`);
-      }
-      if (result.errorDescription) {
-        yield* log(`  Message: ${formatIntegrationTestMessage(result.errorDescription)}`);
-      }
+      return yield* fail$3(new ApiError({
+        code: "CLI_INTEGRATION_TEST_FAILED",
+        message: formatIntegrationTestMessage([
+          "Connection test failed.",
+          ...result.error ? [`Error: ${result.error}`] : [],
+          ...result.errorDescription ? [`Message: ${result.errorDescription}`] : []
+        ].join(" "))
+      }));
     }
   })
 ).pipe(withDescription("Test an integration connection"));
@@ -101628,7 +101116,7 @@ const resolveImageRequest = (model, prompt, input) => gen(function* () {
 });
 const writeImageFile = (path, buffer) => tryPromise({
   try: async () => {
-    await fs$1.writeFile(path, buffer);
+    await promises$1.writeFile(path, buffer);
   },
   catch: (error) => new ApiError({
     message: `Failed to write image "${path}": ${error instanceof Error ? error.message : String(error)}`
@@ -102313,8 +101801,11 @@ const uploadCommand = make$4(
     const api = yield* ApiService;
     const ext = path__namespace.extname(file).toLowerCase();
     if (ext !== ".zip" && ext !== ".skill") {
-      yield* error$1("Invalid file type. Only .zip and .skill files are supported.");
-      return;
+      return yield* fail$3(new ApiError({
+        message: "Invalid file type. Only .zip and .skill files are supported.",
+        code: "CLI_INVALID_ARGUMENT",
+        outcome: "not-dispatched"
+      }));
     }
     const stats = yield* try_({
       try: () => fs__namespace.statSync(file),
@@ -102583,7 +102074,7 @@ const runNativeHelpIfRequested = (args, options = {}) => {
     return;
   }
   const binaryPath = resolveNativeBinary(options);
-  const spawnSync = options.spawnSync ?? childProcess.spawnSync;
+  const spawnSync = options.spawnSync ?? ChildProcess.spawnSync;
   const result = spawnSync(binaryPath, [...nativeArgs], {
     stdio: "inherit",
     env: options.env ?? process.env

package/docs/api-contract-inventory.md

@@ -52,9 +52,9 @@
 | P0-AGENT-01 | agent-user | `aipctl agent list`, `aipctl agent get` | `listInstalledAgents`, `getInstalledAgent` | api | `GET`, `GET` | `/api/cli/v1/organizations/{organizationSlug}/agents`; `/{installedAgentId}` | preserves user read semantics and maps `list`/`installedAgentId` to local `data`/`id` | local `ListInstalledAgentsResponse`, `{ data: InstalledAgentDetail }` | `resource/oas/modules/backend/cli/openapi.yaml`; shared DTO refs from `resource/oas/duplo.yaml` | `backend/api/.../cli/generated/api/CliAgentApi.kt` | `generated-ready` | `P0` | `migrate` | none; dedicated adapter delegates to the working `AgentsApiController` bean | `AI-6344` | `src/core/api.test.ts`, `CliAgentApiControllerTest`, Gateway registry/admission parity; real local production CLI list/get JSON |
 | P0-AGENT-02 | agent-admin | `aipctl admin agent create`, `update`, `delete`, `share`, `templates`; `aipctl agent enable`, `disable` | `createInstalledAgent`, `updateInstalledAgent`, `deleteInstalledAgent`, `getInstalledAgentShare`, `listAgentTemplates`, `updateInstalledAgentStatus` | api | `POST`, `PATCH`, `DELETE`, `GET`, `GET`, `PATCH` | `/api/cli/v1/organizations/{organizationSlug}/agents`; `/{installedAgentId}`; `/{installedAgentId}/share`; `/templates`; `/{installedAgentId}/status` | existing create/update/status bodies; templates collect bounded pages and retain the full catalog; share is read-only | create/update `{ id }`, void mutation responses, existing CLI template/share mapping | `resource/oas/modules/backend/cli/openapi.yaml`; shared legacy DTO refs | `backend/api/.../cli/generated/api/CliAgentApi.kt` | `generated-ready` | `P0` | `migrate` | none; AI operator/workflow/audit policy stays in existing domain owner | `AI-6344` | all eight operations capability/path tests, mutation non-replay, template paging, real CLI lifecycle/DB/audit and metadata 429 verification |
 | P0-AGENT-03 | agent-export | `aipctl admin agent export` (GA-CANDIDATE, production gated) | `exportInstalledAgent` | api | `GET` | `/web/admin/organizations/slug/{organizationSlug}/installed-agents/{installedAgentId}/export` | existing direct controller request | YAML `Buffer` | `backend/api/.../app/controller/AgentExportController.kt`; intentionally OAS-codegen excluded | none | `legacy-generated` | `P0` | `legacy-exception` | owner=`AgentExportController`; dedicated transfer contract, size/timeout/partial-file/authorization/audit gates remain | `AI-6380` | existing direct export path/Buffer/404 tests; production help remains hidden |
-| P1-CHAT-01 | agent-chat | `aipctl agent chat` | `agentNewChat`, `agentChat`, local `parseSseStream` | chat | `POST` + SSE | `/librechat/api/{orgSlug}/agent/new-chat`; `/librechat/api/{orgSlug}/agent/chat` | request body `{ agentInstallationId or conversationId, text, files: [] }` | local `AgentChatResult { text, conversationId }` parsed from SSE event fields `final`, `conversation.conversationId`, `responseMessage` | path source: `resource/oas/chat.yaml` | `frontend/packages/api/src/out/chat-types.ts#paths["/librechat/api/{orgSlug}/agent/new-chat"]`, `#paths["/librechat/api/{orgSlug}/agent/chat"]` | `stream-exception` | `P1` | `legacy-exception` | owner=`chat backend agent SSE stream contract`; rationale=`path exists in OpenAPI but final SSE event payload is still out-of-band`; removal condition=`official SSE event schema or versioned fixture is published with the chat contract`; incorporation plan=`bind CLI parser/tests to the published SSE fixture and drop local-only stream assumptions` | N/A | updated `src/core/api.test.ts`; covers content[] text, fallback text, malformed event skip, and no-final-event failure |
+| P1-CHAT-01 | agent-chat | `aipctl agent chat` | `agentNewChat`, `agentChat`, local `parseSseStream` | chat | `POST` start + `POST` SSE; continuation lookup `GET` | `/api/{orgSlug}/conversations/agent-chat`; `/api/{orgSlug}/conversations/{conversationId}/stream`; continuation lookup `/librechat/api/{orgSlug}/convos/{conversationId}` | start `{ agentInstallationId, conversationId?, text, files: [] }`; stream `{ requestMessageId? }` from the accepted start response | start `{ conversationId,requestMessageId?,runId? }`; Mastra returns both identifiers; `AgentChatResult { text, conversationId }`; UI event.data `{ seq,conversationId,runId,chunk }` and completed end must match the start-issued runId; legacy final requestMessage.messageId must match requestMessageId when provided; an uncorrelated continuation fails unknown | `lib/chat-rest/packages/schema/src/conversation/chat-start.schema.ts`; `lib/chat-rest/packages/schema/src/chat/chat-v2-stream.schema.ts` | `lib/chat-rest/packages/contract/src/chat.ts`; package-local parser fixture (no frontend runtime dependency) | `stream-exception` | `P1` | `legacy-exception` | owner=`Chat conversation/Agent stream`; rationale=`development Agent execution retains its existing conversation transport and candidate gates`; removal condition=`dedicated execution contract and quota/cancel/recovery gates pass`; incorporation plan=`bind the subscription to the accepted request/run; retry only a subscription containing no current-run data, at most 4 times; never replay the paid start` | `AI-6380` | `src/core/api.test.ts` covers prior completed continuation, bounded stale-run retries, start/terminal identifiers, incomplete/failed/abort and legacy request correlation; built CLI local HTTP fixture returns only current reply (start 1/subscription 2); earlier QA success predates run correlation, which requires updated Chat deployment and QA rerun |
 | P1-AUTO-01 | automation | `aipctl automation list`, `get`, `create`, `update`, `delete`, `enable`, `disable`, `history`, `triggers` | `listAutomations`, `getAutomation`, `createAutomation`, `updateAutomation`, `deleteAutomation`, `updateAutomationStatus`, `listAutomationHistories`, `getTriggerProviderMetadata` | api | `GET`, `POST`, `PUT`, `DELETE`, `PATCH` | `/api/cli/v1/organizations/{organizationSlug}/automations`; `/{automationId}`; `/{automationId}/status`; `/{automationId}/history`; `/triggers?type=...` | one-based pageNumber/pageSize (1..100); status `{ status }`; exactly one matching trigger branch; metadata retains required accountId/folderId/serviceType input | existing list/history domain DTOs; dedicated `GetCliAutomationResponse` and ID DTO; webhook detail only serviceType/boolean secretConfigured | `resource/oas/modules/backend/cli/openapi.yaml` → `v1_automations*.yaml`; request/list/history aliases reuse Automation user schemas | `backend/api/.../cli/generated/api/CliAutomationApi.kt` | `generated-ready` | `P1` | `migrate` | owner=`CLI Automation adapter`; Schedule/Webhook/My Drive management enabled; external account provider metadata/mutations return 403 before provider side effects; stored external detail never enriches remotely or fabricates account/folder validity | `AI-6344`; external lifecycle gate `AI-6380`; large pagination gate `AI-6413` | `src/core/automation-contract.test.ts`, `src/core/api.test.ts`, Automation command tests, `redaction.test.ts`, Backend safe-read/controller/audit tests, Gateway parity; real mise servers + production CLI CRUD/ownership/pagination/quota/DB/audit |
-| P1-AUTO-02 | automation-execution | `aipctl automation run`, `cancel`, `webhook-regen` (GA-CANDIDATE, production gated) | `runAutomation`, `cancelAutomationHistory`, `regenerateWebhookUrl` | api | `POST`, `DELETE`, `POST` | legacy `/api/web/organizations/slug/{organizationSlug}/automations/{automationId}/run`; `/histories/{seq}`; `/webhook-url/regen` | existing domain input | existing execution/history/webhook URL DTO | `resource/oas/modules/backend/automation/user/openapi.yaml` | `frontend/packages/api/src/out/modules/automation-user-types.ts#paths[...]` | `generated-ready` | `P1` | `legacy-exception` | owner=`Automation execution domain`; requires execution quota, idempotency/cancel lifetime, webhook secret rotation and safe output verification before customer enablement | `AI-6380` | existing legacy path/command tests; production availability keeps all three hidden |
+| P1-AUTO-02 | automation-execution | `aipctl automation run`, `cancel`, `webhook-regen` (GA-CANDIDATE, production gated) | `runAutomation`, `cancelAutomationHistory`, `regenerateWebhookUrl` | api | `POST`, `POST`, `POST` | legacy `/api/web/organizations/slug/{organizationSlug}/automations/{automationId}/run`; `/histories/{seq}/cancel`; `/webhook/regenerate-url` | existing domain input | existing execution/history/webhook URL DTO | `resource/oas/modules/backend/automation/user/openapi.yaml` | `frontend/packages/api/src/out/modules/automation-user-types.ts#paths[...]` | `generated-ready` | `P1` | `legacy-exception` | owner=`Automation execution domain`; requires execution quota, idempotency/cancel lifetime, webhook secret rotation and safe output verification before customer enablement | `AI-6380` | existing legacy path/command tests; actual QA SUCCESS/result and PENDING→CANCELED, completed cancellation rejection and masked webhook regeneration; production availability keeps all three hidden |
 | CHAT-01 | chat-readonly | `aipctl chat list`, `aipctl chat get`, `aipctl chat messages` | `listConversations`, `getConversation`, `listMessages` | chat | `GET` | `/api/cli/v1/organizations/{orgSlug}/chats`; `/chats/{conversationId}`; `/chats/{conversationId}/messages` | list sends optional cursor; server fixes bounded `updatedAt desc` page size; detail/messages preserve organization and user ownership | local `ListConversationsResponse`, `ConversationDetail`, `ChatMessage[]` | `chat/packages/chat/src/modules/cli-chat/interface/cli-chat-read-v1.interface.controller.ts` | code-first controller contract with `operationId`/quota/capability extensions; no generated backend artifact | `oas-source-only` | `P0` | `migrate` | none; `CliChatReadInterfaceService` reuses the existing conversation/message ownership services and returns CLI-safe fields only | `AI-6344` | updated `src/core/api.test.ts`, Chat read service spec, Gateway registry/contract parity; local CLI/Chat verification covers cursor and no legacy fallback |
 | P0-DRIVE-01 | drive | `aipctl drive list`, `download`, `delete`, `mkdir`, `rename`, `usage` | `listDriveEntries`, `getDriveDownloadUrl`, `deleteDriveEntries`, `createDriveFolder`, `renameDriveEntry`, `getDriveUsage`, `downloadFromUrl` | api + external | `GET`, `POST`, `POST`, `POST`, `PATCH`, `GET`, external `GET` | CLI-managed basic CRUD: `/api/cli/v1/organizations/{organizationSlug}/drive/entries` with optional count/cursor/parentId (default count200), `/drive/entries/delete`, `/drive/folders`, `/drive/entries/{entryId}`, `/drive/usage`; download/upload remain Web/presigned | official list `{ path, hasNext, nextCursor, items }`; delete body `{ entryIds[] }`; mkdir optional `parentId`; rename body `{ newName }`; download body `{ entryIds: [id] }` | official drive list/download DTOs + external file buffer | `resource/oas/modules/backend/cli/openapi.yaml` → `v1_drive_*.yaml` (DTO aliases to organization Storage OAS); download/upload remain `resource/oas/modules/backend/organization/storage/openapi.yaml` | `backend/api/.../cli/generated/api/CliDriveApi.kt`; domain DTOs remain `com.querypie.duplo.api.drive.controller.generated.model.*` | `generated-ready` | `P0` | `migrate` | none; `CliDriveApiController` delegates membership, capacity and audit owner | `AI-6344` | `src/core/api.test.ts`, `CliSkillDriveApiControllerTest`, Gateway registry/contract parity; production CRUD/usage and local 403/404 checks (401/429 remain common gates) |
 | P0-DRIVE-02 | drive | `aipctl drive upload` | `createDriveUploadUrl` → `uploadToS3` → `completeDriveUpload` | api + external | `POST` → `PUT` → `POST` | `/drive/entries/upload-url`; external presigned `uploadUrl`; `/drive/entries/{entryId}/complete` | official upload request `{ parentId: null, filename, fileSize, mimeType }` | official `CreateDriveUploadUrlResponse { id, filename, uploadUrl, headers }` then `void` | `resource/oas/modules/backend/organization/storage/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-storage-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/upload-url"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/{entryId}/complete"]` | `generated-ready` | `P0` | `migrate` | none | `AIP-PUB-05` | updated `src/core/api.test.ts`, `commands/drive/drive.test.ts`; covers `parentId: null` request and response `id`/`filename` usage |
@@ -128,6 +128,25 @@ OAuth registration·authorization-code·refresh POST의 timeout/invalid JSON/잘
 `unknown`과 safe request ID를 로그인·갱신의 최종 오류 경계까지 전달한다. 인증 상태를 확인한 뒤
 재시도하도록 안내하며 자동 재전송 또는 결과가 불명인 응답으로 자격 증명 저장/삭제를 하지 않는다.
 확인된 `invalid_grant`/401 응답은 기존 session-expired 처리로 구분한다.
+
+## QA 후보 기능에서 확인한 결과 경계
+
+개발 Agent SSE의 UI chunk는 같은 conversation/run에 속해야 하며 열린 text block을 모두 닫고
+비어 있지 않은 text payload, `finish`와 `end(status=completed)`를 확인한 뒤 성공한다. terminal에 scope/run이 있으면 그것도
+일치해야 한다. UI stream의 일부 뒤 legacy final이 섞이면 성공으로 처리하지 않는다.
+오류·abort·미완료 결과는 `CLI_RESPONSE_INVALID/outcome=unknown`이며 provider start를 재실행하지
+않는다. legacy final-only stream의 content/text 호환은 유지한다.
+
+Skill 일반/admin upload의 잘못된 확장자는 upload URL 요청 전에
+`CLI_INVALID_ARGUMENT/outcome=not-dispatched/exit1`이다. Integration test가 HTTP 성공 body의
+`success:false`를 반환해도 CLI는 `CLI_INTEGRATION_TEST_FAILED/exit1`로 실패한다. 진단은 마스킹하고
+연결 테스트를 재호출하지 않는다. Tunnel config의 positional token을 포함한 전체 command는
+기본 `[REDACTED]`이고 명시적 `--show-sensitive`에만 표시한다.
+
+OAuth와 조직 선택의 자동 browser launcher 실패는 출력한 URL을 통한 수동 흐름을 유지한다.
+플랫폼 launcher를 shell 없이 spawn하고 같은 동기 호출에서 child-process `error`를 등록한 뒤
+unref한다. next-tick ENOENT와 browser 수명 때문에 CLI가 종료/대기하지 않으며 Windows/WSL은
+single-quoted URL을 encoded PowerShell argument로 전달한다. 인증 성공을 대신하지 않는다.
 Ctrl+C는 보수적인 `CLI_COMMAND_INTERRUPTED`, `outcome=unknown`, exit 130을 출력하며 remote
 rollback을 의미하지 않는다. API/auth/org 실패는 exit 1이고 `--json` stderr에 한 건만 기록한다.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aipctl",
-  "version": "2026.10.5",
+  "version": "2026.10.7",
   "description": "QueryPie AIP and MCP CLI tool",
   "author": "QueryPie",
   "license": "UNLICENSED",
@@ -22,8 +22,8 @@
     "node": ">=24.18.0"
   },
   "metadata": {
-    "contentHash": "b82bf4ae40e40305cc43d0cc31315cd2d21cecfeddf32f03c9df603142cba6ad",
-    "wrapperHash": "b468cab0d6f5dbb8d14c3d3958f004ab0802fd32387d93938a78f71c59aed74d",
+    "contentHash": "0c61f13b85564aea40fbf7791f8b143c9cebff23bbc155c433b812d2e7470f76",
+    "wrapperHash": "acaef65f9385a791a1d261d6f54232be5b0c56c44d2d9a1d4f2fedcb5dac5e01",
     "nativeHash": "006b08c3e391f4571d9b7c0f12d684fe2448106259e7e0581b10f9be362452e9"
   },
   "optionalDependencies": {