codexuse-cli 3.1.2 → 3.1.4

package/dist/server/index.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 
-import { $ as encode, $a as CurrentLogAnnotations, $i as isDone, $n as all, $o as strictEqual, $r as runPromiseWith, $t as run$2, A as NonEmptyString, Aa as flatMap$1, Ai as clamp, An as publish, Ao as makeEquivalence, Ar as ignoreCause, At as FileSystem, B as Tuple, Ba as scope, Bi as provideMerge, Bn as transform$1, Bo as fromNullishOr, Br as matchCauseEffect, Bt as fail$5, C as Defect, Ca as andThen$1, Ci as void_$1, Cn as make$24, Co as fromIterable$2, Cr as forEach, Cs as constVoid, Ct as withConstructorDefault, D as Literal, Da as consolePretty$1, Di as zipWith, Dn as shutdown, Do as map$4, Dr as forkScoped, Ds as pipeArguments, Dt as Path$1, E as Int, Ea as causePretty, Ei as withSpan, En as offerUnsafe, Eo as makeEquivalence$1, Er as forkIn, Es as pipe, Et as omit, F as String$1, Fa as formatLogSpan, Fi as effectDiscard, Fo as failVoid, Fr as logError$1, Ft as callback$1, G as brand, Ga as succeed$3, Gi as addFinalizer, Gn as makeFormatterDefault, Go as isSome, Gr as orElseSucceed, Gt as fromPubSub, H as Union, Ha as servicesWith, Hi as sync$2, Hn as parseJson, Ho as getOrNull, Hr as never, Ht as fromChannel$1, I as Struct, Ia as gen$1, In as BadArgument, Io as getOrThrow, Ir as logInfo$1, It as concat, J as decodeExit, Ja as sync$1, Ji as provide$2, Jn as formatIso, Jo as none$3, Jr as provideService, Jt as isStream, K as declare, Ka as succeedNone, Ki as close, Kn as make$32, Ko as map$5, Kr as promise, Kt as fromQueue, L as TaggedErrorClass, La as ignore$1, Li as empty$6, Ln as badArgument, Lo as isFailure$1, Lr as logWarning$1, Lt as decodeText, M as NullOr, Ma as forever$1, Mi as Error$1, Mn as make$21, Mo as filterMap, Mr as isEffect, Mt as Size, N as Number$1, Na as forkDetach, Ni as TaggedError, Nn as set$4, No as makeEquivalence$2, Nr as log$1, Nt as WatchBackend, O as Literals, Oa as defaultLogger$1, Oi as catchDone, On as take, Oo as of, Or as gen, Ot as TypeId$17, P as Record, Pa as formatLabel, Pi as effect, Pn as makeUnsafe$1, Po as fail$3, Pr as logDebug, Pt as make$22, Q as decodeUnknownSync, Qa as void_$2, Qi as failCause$1, Qn as addFinalizer$1, Qo as make$33, Qr as runPromise, Qt as onExit$1, R as TemplateLiteral, Ra as loggerMake, Ri as mergeAll, Rn as systemError, Ro as succeed$4, Rr as map$3, S as DateValid, Sa as addFinalizer$2, Si as useSpan, Sn as failCauseUnsafe, So as flatMapNullishOr, Sr as fnUntraced, Ss as constTrue, St as toType, T as Finite, Ta as asSome, Ti as withParentSpan, Tn as offerAll, To as isReadonlyArrayNonEmpty, Tr as forkChild, Ts as identity, Tt as assign, U as Unknown, Ua as sleep, Ui as unwrap$1, Un as stringifyJson, Uo as getOrUndefined, Ur as onInterrupt, Ut as fromEffect, V as URLFromString, Va as scopeAddFinalizerExit, Vi as succeed$2, Vn as transformOrFail, Vo as getOrElse, Vr as matchEffect, Vt as flatMap$2, W as Void, Wa as structuredMessage, Wi as Scope, Wn as InvalidValue$1, Wo as isNone, Wr as orDie, Wt as fromIterable$1, X as decodeUnknownEffect, Xa as uninterruptibleMask, Xi as doneUnsafe, Xn as acquireRelease, Xo as Number$2, Xr as result, Xt as merge$1, Y as decodeTo, Ya as tracerLogger$1, Yi as _await, Yn as now, Yo as some, Yr as provideServices, Yt as make$31, Z as decodeUnknownExit, Za as updateServices, Zi as fail$4, Zn as acquireUseRelease, Zo as make$27, Zr as runFork, Zt as mkString, _a as squash, _i as tryPromise, _n as make$25, _o as toMillis, _r as fail$1, _s as isNotNull, _t as optional$2, aa as isFailure, ai as services, an as toReadableStreamEffect, ar as cached, as as BaseProto, at as isGreaterThan, b as Array$1, ba as CurrentLoggers$1, bi as uninterruptibleMask$1, bn as size, bo as ensure, br as flatMap, bs as isUndefined, bt as toCodecStringTree, c as FalseValues, ca as void_$3, ci as succeed, cn as get$2, cr as catchDefect, cs as format$1, ct as isMaxLength, d as boolean$3, da as UnknownError, di as sync, dn as fromChannel, do as fromInputUnsafe, dr as catchTags, ds as symbolRedactable, dt as isNonEmpty, ea as make$28, ei as runSync, en as runCollect, eo as CurrentLogSpans, er as andThen, es as PipeInspectableProto, et as encodeEffect, f as map$7, fa as done, fi as tap, fn as isSink, fo as infinity, fr as catch_, fs as symbol, ft as isPattern, g as string$3, ga as pretty, gi as timeoutOrElse, gn as get$3, go as seconds, gr as exit, gs as hasProperty, gt as mutable, h as port, ha as hasInterruptsOnly, hi as timeoutOption, hn as make$30, ho as minutes, hr as ensuring, hs as symbol$1, ht as makeFilter, ia as hasInterrupts$1, ii as serviceOption, in as suspend$3, io as Service, ir as asVoid, is as withFiber, it as isBetween, j as Null, ja as fnUntraced$1, ji as Class, jn as unbounded$1, jo as map$6, jr as interrupt, jt as FileTypeId, k as NonEmptyArray, ka as fiberInterrupt, ki as Random$1, kn as unbounded, ko as sort, kr as ignore, kt as FileDescriptor, l as TrueValues, la as Done, li as succeedNone$1, ln as make$23, lo as make$26, lr as catchFilter, ls as formatJson$1, lt as isMaxProperties, m as option, ma as hasInterrupts, mi as tapError, mn as mapDone, mo as isZero, mr as effectify, ms as structure, mt as link$1, n as SqlClient, na as succeed$5, ni as scoped, nn as runForEach, no as DisablePropagation, nr as as, ns as exitSucceed, nt as fromJsonString, oa as isSuccess, oi as servicesWith$1, on as transduce, oo as empty$5, or as callback, os as Class$1, ot as isGreaterThanOrEqualTo, p as number, pa as fail$2, pi as tapCause, pn as fromTransform, po as isFinite$1, pr as die, ps as array, pt as isSchemaError, q as decodeEffect, qa as suspend$1, qi as make$29, qn as encodeBase64Url, qo as match, qr as provide, qt as fromReadableStream, ra as fail, ri as service, rn as splitLines, ro as Reference, rr as asSome$1, rs as isEffect$1, rt as is, s as Boolean$1, sa as succeed$1, si as sleep$1, sn as unwrap, so as get$4, sr as catchCause, ss as NodeInspectSymbol, st as isLessThanOrEqualTo, ta as makeUnsafe$2, tn as runFold, to as MinimumLogLevel, tr as annotateLogs, ts as YieldableProto, tt as encodeUnknownEffect, u as all$1, ua as NoSuchElementError, ui as suspend, un as drain, uo as merge$2, ur as catchTag, us as redact$1, ut as isMinLength, v as url, va as ClockRef, vi as try_, vn as remove$2, vo as toSeconds, vr as failCause, vs as isNotUndefined, vt as suspend$2, w as ErrorClass, wa as as$1, wi as withFiber$1, wn as offer$1, wo as isArray, wr as forever, ws as dual, wt as withDecodingDefault, x as Boolean$2, xa as LogToStderr$1, xi as updateServices$1, xn as endUnsafe, xo as filter, xr as fn, xs as constFalse, xt as toJsonSchemaDocument, y as withDefault$2, ya as ConsoleRef, yi as uninterruptible, yn as set$3, yo as zero, yr as filterOrFail, ys as isNullish, yt as tag, z as Trim, za as onExit, zi as provide$1, zn as nominal, zo as filter$1, zr as mapError, zt as empty$4 } from "./SqlClient-CB8oPtuH.mjs";
+import { $ as encode, $a as CurrentLogAnnotations, $i as isDone, $n as all, $o as strictEqual, $r as runPromiseWith, $t as run$2, A as NonEmptyString, Aa as flatMap$1, Ai as clamp, An as publish, Ao as makeEquivalence, Ar as ignoreCause, At as FileSystem, B as Tuple, Ba as scope, Bi as provideMerge, Bn as transform$1, Bo as fromNullishOr, Br as matchCauseEffect, Bt as fail$5, C as Defect, Ca as andThen$1, Ci as void_$1, Cn as make$24, Co as fromIterable$2, Cr as forEach, Cs as constVoid, Ct as withConstructorDefault, D as Literal, Da as consolePretty$1, Di as zipWith, Dn as shutdown, Do as map$4, Dr as forkScoped, Ds as pipeArguments, Dt as Path$1, E as Int, Ea as causePretty, Ei as withSpan, En as offerUnsafe, Eo as makeEquivalence$1, Er as forkIn, Es as pipe, Et as omit, F as String$1, Fa as formatLogSpan, Fi as effectDiscard, Fo as failVoid, Fr as logError$1, Ft as callback$1, G as brand, Ga as succeed$3, Gi as addFinalizer, Gn as makeFormatterDefault, Go as isSome, Gr as orElseSucceed, Gt as fromPubSub, H as Union, Ha as servicesWith, Hi as sync$2, Hn as parseJson, Ho as getOrNull, Hr as never, Ht as fromChannel$1, I as Struct, Ia as gen$1, In as BadArgument, Io as getOrThrow, Ir as logInfo$1, It as concat, J as decodeExit, Ja as sync$1, Ji as provide$2, Jn as formatIso, Jo as none$3, Jr as provideService, Jt as isStream, K as declare, Ka as succeedNone, Ki as close, Kn as make$32, Ko as map$5, Kr as promise, Kt as fromQueue, L as TaggedErrorClass, La as ignore$1, Li as empty$6, Ln as badArgument, Lo as isFailure$1, Lr as logWarning$1, Lt as decodeText, M as NullOr, Ma as forever$1, Mi as Error$1, Mn as make$21, Mo as filterMap, Mr as isEffect, Mt as Size, N as Number$1, Na as forkDetach, Ni as TaggedError, Nn as set$4, No as makeEquivalence$2, Nr as log$1, Nt as WatchBackend, O as Literals, Oa as defaultLogger$1, Oi as catchDone, On as take, Oo as of, Or as gen, Ot as TypeId$17, P as Record, Pa as formatLabel, Pi as effect, Pn as makeUnsafe$1, Po as fail$3, Pr as logDebug, Pt as make$22, Q as decodeUnknownSync, Qa as void_$2, Qi as failCause$1, Qn as addFinalizer$1, Qo as make$33, Qr as runPromise, Qt as onExit$1, R as TemplateLiteral, Ra as loggerMake, Ri as mergeAll, Rn as systemError, Ro as succeed$4, Rr as map$3, S as DateValid, Sa as addFinalizer$2, Si as useSpan, Sn as failCauseUnsafe, So as flatMapNullishOr, Sr as fnUntraced, Ss as constTrue, St as toType, T as Finite, Ta as asSome, Ti as withParentSpan, Tn as offerAll, To as isReadonlyArrayNonEmpty, Tr as forkChild, Ts as identity, Tt as assign, U as Unknown, Ua as sleep$1, Ui as unwrap$1, Un as stringifyJson, Uo as getOrUndefined, Ur as onInterrupt, Ut as fromEffect, V as URLFromString, Va as scopeAddFinalizerExit, Vi as succeed$2, Vn as transformOrFail, Vo as getOrElse, Vr as matchEffect, Vt as flatMap$2, W as Void, Wa as structuredMessage, Wi as Scope, Wn as InvalidValue$1, Wo as isNone, Wr as orDie, Wt as fromIterable$1, X as decodeUnknownEffect, Xa as uninterruptibleMask, Xi as doneUnsafe, Xn as acquireRelease, Xo as Number$2, Xr as result, Xt as merge$1, Y as decodeTo, Ya as tracerLogger$1, Yi as _await, Yn as now, Yo as some, Yr as provideServices, Yt as make$31, Z as decodeUnknownExit, Za as updateServices, Zi as fail$4, Zn as acquireUseRelease, Zo as make$27, Zr as runFork, Zt as mkString, _a as squash, _i as tryPromise, _n as make$25, _o as toMillis, _r as fail$1, _s as isNotNull, _t as optional$2, aa as isFailure, ai as services, an as toReadableStreamEffect, ar as cached, as as BaseProto, at as isGreaterThan, b as Array$1, ba as CurrentLoggers$1, bi as uninterruptibleMask$1, bn as size, bo as ensure, br as flatMap, bs as isUndefined, bt as toCodecStringTree, c as FalseValues, ca as void_$3, ci as succeed, cn as get$2, cr as catchDefect, cs as format$1, ct as isMaxLength, d as boolean$3, da as UnknownError, di as sync, dn as fromChannel, do as fromInputUnsafe, dr as catchTags, ds as symbolRedactable, dt as isNonEmpty, ea as make$28, ei as runSync, en as runCollect, eo as CurrentLogSpans, er as andThen, es as PipeInspectableProto, et as encodeEffect, f as map$7, fa as done, fi as tap, fn as isSink, fo as infinity, fr as catch_, fs as symbol, ft as isPattern, g as string$3, ga as pretty, gi as timeoutOrElse, gn as get$3, go as seconds, gr as exit, gs as hasProperty, gt as mutable, h as port, ha as hasInterruptsOnly, hi as timeoutOption, hn as make$30, ho as minutes, hr as ensuring, hs as symbol$1, ht as makeFilter, ia as hasInterrupts$1, ii as serviceOption, in as suspend$3, io as Service, ir as asVoid, is as withFiber, it as isBetween, j as Null, ja as fnUntraced$1, ji as Class, jn as unbounded$1, jo as map$6, jr as interrupt, jt as FileTypeId, k as NonEmptyArray, ka as fiberInterrupt, ki as Random$1, kn as unbounded, ko as sort, kr as ignore, kt as FileDescriptor, l as TrueValues, la as Done, li as succeedNone$1, ln as make$23, lo as make$26, lr as catchFilter, ls as formatJson$1, lt as isMaxProperties, m as option, ma as hasInterrupts, mi as tapError, mn as mapDone, mo as isZero, mr as effectify, ms as structure, mt as link$1, n as SqlClient, na as succeed$5, ni as scoped, nn as runForEach, no as DisablePropagation, nr as as, ns as exitSucceed, nt as fromJsonString, oa as isSuccess, oi as servicesWith$1, on as transduce, oo as empty$5, or as callback, os as Class$1, ot as isGreaterThanOrEqualTo, p as number, pa as fail$2, pi as tapCause, pn as fromTransform, po as isFinite$1, pr as die, ps as array, pt as isSchemaError, q as decodeEffect, qa as suspend$1, qi as make$29, qn as encodeBase64Url, qo as match, qr as provide, qt as fromReadableStream, ra as fail, ri as service, rn as splitLines, ro as Reference, rr as asSome$1, rs as isEffect$1, rt as is, s as Boolean$1, sa as succeed$1, si as sleep$2, sn as unwrap, so as get$4, sr as catchCause, ss as NodeInspectSymbol, st as isLessThanOrEqualTo, ta as makeUnsafe$2, tn as runFold, to as MinimumLogLevel, tr as annotateLogs, ts as YieldableProto, tt as encodeUnknownEffect, u as all$1, ua as NoSuchElementError, ui as suspend, un as drain, uo as merge$2, ur as catchTag, us as redact$1, ut as isMinLength, v as url, va as ClockRef, vi as try_, vn as remove$2, vo as toSeconds, vr as failCause, vs as isNotUndefined, vt as suspend$2, w as ErrorClass, wa as as$1, wi as withFiber$1, wn as offer$1, wo as isArray, wr as forever, ws as dual, wt as withDecodingDefault, x as Boolean$2, xa as LogToStderr$1, xi as updateServices$1, xn as endUnsafe, xo as filter, xr as fn, xs as constFalse, xt as toJsonSchemaDocument, y as withDefault$2, ya as ConsoleRef, yi as uninterruptible, yn as set$3, yo as zero, yr as filterOrFail, ys as isNullish, yt as tag, z as Trim, za as onExit, zi as provide$1, zn as nominal, zo as filter$1, zr as mapError, zt as empty$4 } from "./SqlClient-CB8oPtuH.mjs";
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
@@ -2754,7 +2754,7 @@ const batched = /* @__PURE__ */ dual(2, (self, options) => flatMap$1(scope, (sco
 		buffer = [];
 		return options.flush(arr);
 	});
-	return uninterruptibleMask((restore) => restore(sleep(options.window).pipe(andThen$1(flush), forever$1)).pipe(forkDetach, flatMap$1((fiber) => scopeAddFinalizerExit(scope, () => fiberInterrupt(fiber))), andThen$1(addFinalizer$2(() => flush)), as$1(loggerMake((options) => {
+	return uninterruptibleMask((restore) => restore(sleep$1(options.window).pipe(andThen$1(flush), forever$1)).pipe(forkDetach, flatMap$1((fiber) => scopeAddFinalizerExit(scope, () => fiberInterrupt(fiber))), andThen$1(addFinalizer$2(() => flush)), as$1(loggerMake((options) => {
 		buffer.push(self.log(options));
 	}))));
 }));
@@ -28589,6 +28589,9 @@ function normalizeCommitMessagePrompt(value) {
 const APP_STORAGE_TABLE = "app_storage_documents";
 const APP_STORAGE_DB_DIR = "t3-projects";
 const APP_STORAGE_DB_NAME = "state.sqlite";
+const SQLITE_BUSY_TIMEOUT_MS = 5e3;
+const SQLITE_BUSY_MAX_ATTEMPTS = 3;
+const SQLITE_BUSY_RETRY_DELAY_MS = 100;
 const initializedDbPaths = /* @__PURE__ */ new Set();
 function isRecord$9(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -28604,6 +28607,15 @@ function safeParseJson(raw) {
 		return null;
 	}
 }
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isSqliteBusyError(error) {
+	if (!error || typeof error !== "object") return false;
+	const sqliteError = error;
+	const message = typeof sqliteError.message === "string" ? sqliteError.message.toLowerCase() : "";
+	return sqliteError.code === "SQLITE_BUSY" || sqliteError.errno === 5 || message.includes("sqlite_busy") || message.includes("database is locked");
+}
 function beginImmediate(db) {
 	db.exec("BEGIN IMMEDIATE");
 }
@@ -28615,10 +28627,13 @@ function rollback(db) {
 		db.exec("ROLLBACK");
 	} catch {}
 }
-function ensureSchema(db, dbPath) {
-	if (initializedDbPaths.has(dbPath)) return;
+function applyConnectionPragmas(db) {
+	db.exec(`PRAGMA busy_timeout = ${SQLITE_BUSY_TIMEOUT_MS};`);
 	db.exec("PRAGMA journal_mode = WAL;");
 	db.exec("PRAGMA foreign_keys = ON;");
+}
+function ensureSchema(db, dbPath) {
+	if (initializedDbPaths.has(dbPath)) return;
 	db.exec(`
     CREATE TABLE IF NOT EXISTS ${APP_STORAGE_TABLE} (
       namespace TEXT PRIMARY KEY,
@@ -28638,7 +28653,7 @@ async function openDatabase(dbPath) {
 			close: database.close.bind(database)
 		};
 	}
-	const database = new (await (import("node:sqlite"))).DatabaseSync(dbPath);
+	const database = new (await (Function("return import('node:sqlite')")())).DatabaseSync(dbPath);
 	return {
 		exec: database.exec.bind(database),
 		prepare: database.prepare.bind(database),
@@ -28646,13 +28661,20 @@ async function openDatabase(dbPath) {
 	};
 }
 async function withDatabase(dbPath, task) {
-	const db = await openDatabase(dbPath);
-	try {
-		ensureSchema(db, dbPath);
-		return task(db);
-	} finally {
-		db.close();
+	for (let attempt = 1; attempt <= SQLITE_BUSY_MAX_ATTEMPTS; attempt += 1) {
+		const db = await openDatabase(dbPath);
+		try {
+			applyConnectionPragmas(db);
+			ensureSchema(db, dbPath);
+			return task(db);
+		} catch (error) {
+			if (!isSqliteBusyError(error) || attempt >= SQLITE_BUSY_MAX_ATTEMPTS) throw error;
+		} finally {
+			db.close();
+		}
+		await sleep(SQLITE_BUSY_RETRY_DELAY_MS * attempt);
 	}
+	throw new Error("App storage database remained busy after retrying.");
 }
 function resolveAppStorageDbPath(userDataDir) {
 	return path.join(userDataDir, APP_STORAGE_DB_DIR, APP_STORAGE_DB_NAME);
@@ -32397,10 +32419,18 @@ const runExternalCodexThreadSync = gen(function* () {
 		});
 	}
 	let bootstrappedProjectCount = 0;
+	let remainingBootstrapProjects = (yield* promise(() => readProjectPolicy(readModel))).remainingProjects;
 	for (const workspace of importableParityWorkspaces) {
 		const workspaceRoot = workspace.path;
 		const workspaceRootCanonicalKey = projectRootKey(workspaceRoot);
 		if (projectIdByRootKey.has(workspaceRootCanonicalKey)) continue;
+		if (remainingBootstrapProjects !== null && remainingBootstrapProjects <= 0) {
+			yield* logInfo$1("skipping parity workspace bootstrap because free project limit is already reached", {
+				workspaceId: workspace.id,
+				workspaceRoot
+			});
+			continue;
+		}
 		const projectId = resolveBootstrapProjectId(workspace, state.projectIds);
 		const projectScripts = buildProjectScripts(workspace);
 		yield* orchestrationEngine.dispatch({
@@ -32431,6 +32461,7 @@ const runExternalCodexThreadSync = gen(function* () {
 			}
 		});
 		bootstrappedProjectCount += 1;
+		if (remainingBootstrapProjects !== null && remainingBootstrapProjects > 0) remainingBootstrapProjects -= 1;
 	}
 	if (syncTargets.length === 0) return;
 	let createdThreadCount = 0;
@@ -43179,10 +43210,13 @@ function buildEnv() {
 	const extra = [
 		"/opt/homebrew/bin",
 		"/usr/local/bin",
-		path.join(homeDir, ".local", "bin")
+		path.join(homeDir, ".local", "bin"),
+		path.join(homeDir, ".fnm", "aliases", "default", "bin"),
+		path.join(homeDir, ".fnm", "current", "bin"),
+		path.join(homeDir, ".volta", "bin"),
+		path.join(homeDir, ".asdf", "shims")
 	];
-	const currentPath = env.PATH ?? "";
-	const segments = [...extra, ...currentPath.split(path.delimiter).filter(Boolean)];
+	const segments = [...(env.PATH ?? "").split(path.delimiter).filter(Boolean), ...extra];
 	env.PATH = Array.from(new Set(segments)).join(path.delimiter);
 	return env;
 }
@@ -43192,6 +43226,12 @@ function runCommand$1(command, args, env) {
 		encoding: "utf8"
 	});
 }
+function resolveRunnableCommand(command, env, shellInfo) {
+	const resolved = resolveCommandPath(command, env, shellInfo)?.trim();
+	if (!resolved) return command;
+	if (resolved.includes(path.sep) || resolved.includes("/")) return resolved;
+	return command;
+}
 function resolveShell() {
 	if (process.platform === "win32") return {
 		shell: process.env.ComSpec ?? "cmd.exe",
@@ -43312,6 +43352,22 @@ function buildNpmInstallCommand(packageName) {
 function readCommandOutput(result) {
 	return `${result.stderr ?? ""}\n${result.stdout ?? ""}`.trim();
 }
+function resolveInstalledPackageVersion(npmCommand, packageName, env) {
+	const raw = (runCommand$1(npmCommand, [
+		"ls",
+		"-g",
+		packageName,
+		"--depth=0",
+		"--json"
+	], env).stdout ?? "").trim();
+	if (!raw) return null;
+	try {
+		const version = JSON.parse(raw).dependencies?.[packageName]?.version;
+		return typeof version === "string" ? normalizeVersion(version) : null;
+	} catch {
+		return null;
+	}
+}
 function isPackageNotFoundOutput(output, packageName) {
 	const normalized = output.toLowerCase();
 	if (!normalized.includes("e404") && !normalized.includes("404 not found")) return false;
@@ -43409,7 +43465,9 @@ async function getCliInstallStatusWithFreshness(options) {
 	};
 }
 async function updateGlobalCliNow() {
+	const previousStatus = await getCliInstallStatusWithFreshness({ forceFreshness: true });
 	const env = buildEnv();
+	const npmCommand = resolveRunnableCommand("npm", env, resolveShell());
 	let packageNameUsed = null;
 	let result = null;
 	let recoveredBinConflict = false;
@@ -43419,11 +43477,11 @@ async function updateGlobalCliNow() {
 			"-g",
 			packageName
 		];
-		let nextResult = runCommand$1("npm", installArgs, env);
+		let nextResult = runCommand$1(npmCommand, installArgs, env);
 		let nextRecoveredBinConflict = false;
 		if (!nextResult.error && nextResult.status !== 0) {
 			if (isCodexuseBinConflict(readCommandOutput(nextResult))) {
-				nextResult = runCommand$1("npm", [...installArgs, "--force"], env);
+				nextResult = runCommand$1(npmCommand, [...installArgs, "--force"], env);
 				nextRecoveredBinConflict = nextResult.status === 0 && !nextResult.error;
 			}
 		}
@@ -43445,6 +43503,7 @@ async function updateGlobalCliNow() {
 	const stderr = (result.stderr ?? "").trim();
 	const stdout = (result.stdout ?? "").trim();
 	const status = await getCliInstallStatusWithFreshness({ forceFreshness: true });
+	const installedPackageVersion = resolveInstalledPackageVersion(npmCommand, packageNameUsed, env);
 	if (result.error) return {
 		ok: false,
 		message: result.error.message || `Failed to run ${buildNpmInstallCommand(packageNameUsed)}.`,
@@ -43455,6 +43514,14 @@ async function updateGlobalCliNow() {
 		message: stderr || stdout || `${buildNpmInstallCommand(packageNameUsed)} failed.`,
 		status
 	};
+	if (status.latestVersion && status.installedVersion !== status.latestVersion) {
+		const downgraded = previousStatus.installedVersion && status.installedVersion && isUpdateAvailable(status.installedVersion, previousStatus.installedVersion);
+		return {
+			ok: false,
+			message: installedPackageVersion === status.latestVersion && status.installedVersion !== installedPackageVersion ? `${CLI_DISPLAY_NAME} npm package ${installedPackageVersion} installed, but \`codexuse --version\` still reports ${status.installedVersion}. The published npm bundle looks stale.` : downgraded ? `${CLI_DISPLAY_NAME} update regressed from ${previousStatus.installedVersion} to ${status.installedVersion}. npm latest is ${status.latestVersion}.` : `${CLI_DISPLAY_NAME} still reports ${status.installedVersion ?? "unknown"} after update. npm latest is ${status.latestVersion}.`,
+			status
+		};
+	}
 	const installSuffix = packageNameUsed === LEGACY_NPM_PACKAGE_NAME ? " using the current public npm package." : ".";
 	return {
 		ok: true,
@@ -45716,6 +45783,69 @@ var ProfileManager = class {
 			return null;
 		}
 	}
+	async captureActiveAuthSnapshot() {
+		await this.initialize();
+		let raw;
+		try {
+			raw = await promises$1.readFile(this.activeAuth, "utf8");
+		} catch (error) {
+			if (this.isNotFoundError(error)) return {
+				fingerprint: null,
+				email: null,
+				accountId: null,
+				userId: null,
+				chatgptUserId: null,
+				workspaceId: null
+			};
+			const message = error instanceof Error ? error.message : "unknown error";
+			const signature = typeof message === "string" ? `${message}:${this.activeAuth}` : this.activeAuth;
+			if (this.lastActiveAuthErrorSignature !== signature) {
+				logWarn("Failed to snapshot active auth file:", error);
+				this.lastActiveAuthErrorSignature = signature;
+			}
+			return {
+				fingerprint: null,
+				email: null,
+				accountId: null,
+				userId: null,
+				chatgptUserId: null,
+				workspaceId: null
+			};
+		}
+		const trimmed = raw.trim();
+		if (!trimmed) return {
+			fingerprint: null,
+			email: null,
+			accountId: null,
+			userId: null,
+			chatgptUserId: null,
+			workspaceId: null
+		};
+		const fingerprint = createHash("sha256").update(trimmed).digest("hex");
+		try {
+			const parsed = JSON.parse(trimmed);
+			const normalized = this.normalizeProfileData(parsed);
+			const metadata = this.extractProfileMetadata(normalized);
+			const workspace = this.resolveWorkspaceIdentity(normalized, metadata);
+			return {
+				fingerprint,
+				email: this.resolveProfileEmail(normalized, metadata) ?? null,
+				accountId: this.getAccountIdFromData(normalized) ?? null,
+				userId: metadata?.userId ?? null,
+				chatgptUserId: metadata?.chatgptUserId ?? null,
+				workspaceId: workspace.id ?? null
+			};
+		} catch {
+			return {
+				fingerprint,
+				email: null,
+				accountId: null,
+				userId: null,
+				chatgptUserId: null,
+				workspaceId: null
+			};
+		}
+	}
 	/**
 	* Decode a JWT payload into an object without validating the signature.
 	*/
@@ -49791,6 +49921,10 @@ function recordRefreshRedeemed(session, output) {
 		appendSessionError(session, detected);
 	}
 }
+function describeActiveAuthOwner(snapshot) {
+	if (!snapshot) return null;
+	return snapshot.email ?? snapshot.userId ?? snapshot.chatgptUserId ?? snapshot.accountId ?? null;
+}
 async function resolveCodexBinaryOrThrow(context) {
 	try {
 		return await requireCodexCli();
@@ -49898,10 +50032,20 @@ const createServer = fn(function* () {
 		return canonicalizeProjectRoot(normalizedWorkspaceRoot);
 	});
 	const normalizeDispatchCommand = fnUntraced(function* (input) {
-		if (input.command.type === "project.create") return {
-			...input.command,
-			workspaceRoot: yield* normalizeProjectWorkspaceRoot(input.command.workspaceRoot)
-		};
+		if (input.command.type === "project.create") {
+			const workspaceRoot = yield* normalizeProjectWorkspaceRoot(input.command.workspaceRoot);
+			const snapshot = yield* projectionReadModelQuery.getSnapshot().pipe(mapError((cause) => new RouteRequestError({ message: `Failed to validate project creation: ${String(cause)}` })));
+			if (!findActiveProjectByCanonicalRoot(snapshot.projects, workspaceRoot)) {
+				if (!(yield* tryPromise({
+					try: () => readProjectPolicy(snapshot),
+					catch: (cause) => new RouteRequestError({ message: `Failed to validate project creation: ${String(cause)}` })
+				})).canCreateProject) return yield* new RouteRequestError({ message: PROJECT_LIMIT_MESSAGE });
+			}
+			return {
+				...input.command,
+				workspaceRoot
+			};
+		}
 		if (input.command.type === "project.meta.update" && input.command.workspaceRoot !== void 0) return {
 			...input.command,
 			workspaceRoot: yield* normalizeProjectWorkspaceRoot(input.command.workspaceRoot)
@@ -50195,6 +50339,7 @@ const createServer = fn(function* () {
 		let bootstrapProjectDefaultModel;
 		const normalizedCwd = canonicalizeProjectRoot(cwd);
 		if (!existingProject) {
+			if (!(yield* promise(() => readProjectPolicy(snapshot))).canCreateProject) return;
 			const createdAt = (/* @__PURE__ */ new Date()).toISOString();
 			bootstrapProjectId = ProjectId.makeUnsafe(crypto.randomUUID());
 			const bootstrapProjectTitle = path.basename(normalizedCwd) || "project";
@@ -50617,6 +50762,7 @@ const createServer = fn(function* () {
 					authSessions.delete(name);
 				}
 				const startedAt = Date.now();
+				const initialAuthSnapshot = yield* promise(() => profileManager.captureActiveAuthSnapshot());
 				let cleanupConfig = null;
 				const restoreConfig = async () => {
 					if (!cleanupConfig) return;
@@ -50648,6 +50794,7 @@ const createServer = fn(function* () {
 						exitCode: null,
 						mode,
 						startedAt,
+						initialAuthSnapshot,
 						restoreConfig
 					};
 					authSessions.set(name, session);
@@ -50722,6 +50869,16 @@ const createServer = fn(function* () {
 					trackTelemetryEvent("profile_auth_failed", { mode: session.mode });
 					return yield* new RouteRequestError({ message: formatUserFacingError(session.error ?? `Authentication failed with code ${session.exitCode}`, { fallback: "Authentication failed. Try again." }) });
 				}
+				if (session.mode === "create") {
+					const currentAuthSnapshot = yield* promise(() => profileManager.captureActiveAuthSnapshot());
+					if (currentAuthSnapshot.fingerprint === (session.initialAuthSnapshot?.fingerprint ?? null)) {
+						authSessions.delete(body.name);
+						trackTelemetryEvent("profile_auth_complete_failed", { mode: session.mode });
+						const activeOwner = describeActiveAuthOwner(currentAuthSnapshot);
+						const ownerText = activeOwner ? ` The active auth still belongs to '${activeOwner}'.` : "";
+						return yield* new RouteRequestError({ message: `Codex login finished without updating the active auth for '${body.name}'.${ownerText} Finish the browser login for the new account and try again.` });
+					}
+				}
 				try {
 					if (session.mode === "refresh") yield* promise(() => profileManager.refreshProfileAuth(body.name));
 					else {
@@ -52564,7 +52721,7 @@ const makeAnalyticsService = gen(function* () {
 			event
 		});
 	});
-	yield* forever(sleep$1(1e3).pipe(flatMap(() => flush)), { disableYield: true }).pipe(forkScoped);
+	yield* forever(sleep$2(1e3).pipe(flatMap(() => flush)), { disableYield: true }).pipe(forkScoped);
 	yield* addFinalizer$1(() => flush);
 	return {
 		record,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codexuse-cli",
-  "version": "3.1.2",
+  "version": "3.1.4",
   "description": "CodexUse CLI for managing Codex profiles and licenses.",
   "author": {
     "name": "Hoang",