copilotkit 4.12.0 → 4.13.0

package/index.js

@@ -109,14 +109,14 @@ function getTelemetryEndpointUrl() {
 }
 function getBuildInfo() {
   return {
-    version: true ? "4.12.0" : "dev",
-    buildNumber: true ? "35617651318" : "dev",
-    commitSha: true ? "894cde3a9735b1605afef07a1250bef02a123ca4" : "dev",
+    version: true ? "4.13.0" : "dev",
+    buildNumber: true ? "35742767211" : "dev",
+    commitSha: true ? "addb7285609bab57a4a8ef12d73351fdf5dfaf3f" : "dev",
     copilotKitCommit: getTemplateRef()
   };
 }
 function getTemplateRef() {
-  return true ? "0048ba241fdf14a9036cdad11a4f31aa021a9c8d" : "main";
+  return true ? "1e13b4945b44c6afa2e398a0c9935415d4aa7577" : "main";
 }
 function getC15tBackendUrl() {
   return true ? "https://calm-hazelnut-joy-copilotkit.inth.app" : "";
@@ -26858,6 +26858,66 @@ var init_zod = __esm({
   }
 });
 
+// libs/ops-contracts/src/billing.ts
+var billingProviderSchema, billingContextResponseSchema, paidSelfServicePlanCodeSchema, createCheckoutSessionRequestSchema, createCheckoutSessionResponseSchema, expireCheckoutSessionResponseSchema, checkoutReturnResponseSchema, createPortalSessionRequestSchema, createPortalSessionResponseSchema;
+var init_billing = __esm({
+  "libs/ops-contracts/src/billing.ts"() {
+    "use strict";
+    init_zod();
+    billingProviderSchema = external_exports.enum(["clerk", "stripe"]);
+    billingContextResponseSchema = external_exports.object({
+      billingProvider: billingProviderSchema
+    }).strict();
+    paidSelfServicePlanCodeSchema = external_exports.enum([
+      "pro",
+      "team",
+      "team_self_hosted"
+    ]);
+    createCheckoutSessionRequestSchema = external_exports.object({
+      planCode: paidSelfServicePlanCodeSchema,
+      // Omission preserves the prebuilt checkout for older deployed frontends.
+      uiMode: external_exports.literal("elements").optional(),
+      // An old request must never expire a checkout it has not observed.
+      replacesCheckoutSessionId: external_exports.string().min(1).max(255).startsWith("cs_").optional()
+    }).strict();
+    createCheckoutSessionResponseSchema = external_exports.union([
+      external_exports.object({
+        clientSecret: external_exports.string().min(1),
+        sessionId: external_exports.string().min(1).max(255).startsWith("cs_").optional(),
+        // Present only when resuming an Elements checkout from an earlier attempt.
+        checkoutAttemptId: external_exports.string().uuid().optional()
+      }).strict(),
+      external_exports.object({
+        state: external_exports.literal("confirmation_required"),
+        sessionId: external_exports.string().min(1),
+        checkoutAttemptId: external_exports.string().uuid().optional()
+      }).strict(),
+      external_exports.object({
+        state: external_exports.literal("recovery_required"),
+        sessionId: external_exports.string().min(1).max(255).startsWith("cs_"),
+        planCode: paidSelfServicePlanCodeSchema
+      }).strict()
+    ]);
+    expireCheckoutSessionResponseSchema = external_exports.object({ state: external_exports.literal("expired") }).strict();
+    checkoutReturnResponseSchema = external_exports.discriminatedUnion("state", [
+      external_exports.object({
+        state: external_exports.literal("paid"),
+        planCode: paidSelfServicePlanCodeSchema,
+        quantity: external_exports.number().int().positive()
+      }).strict(),
+      external_exports.object({ state: external_exports.literal("processing") }).strict(),
+      external_exports.object({ state: external_exports.literal("expired") }).strict()
+    ]);
+    createPortalSessionRequestSchema = external_exports.object({}).strict();
+    createPortalSessionResponseSchema = external_exports.object({
+      portalUrl: external_exports.string().url().refine((value) => {
+        const url4 = new URL(value);
+        return url4.origin === "https://billing.stripe.com" && !url4.username && !url4.password;
+      }, "Expected a Stripe Customer Portal URL.")
+    }).strict();
+  }
+});
+
 // libs/license-catalog/src/index.ts
 function isFeatureId(feature) {
   return FEATURE_IDS.includes(feature);
@@ -27349,7 +27409,10 @@ __export(src_exports, {
   adminEnterpriseSubscriptionListResponseSchema: () => adminEnterpriseSubscriptionListResponseSchema,
   adminEnterpriseSubscriptionResponseSchema: () => adminEnterpriseSubscriptionResponseSchema,
   adminEnterpriseSubscriptionSchema: () => adminEnterpriseSubscriptionSchema,
+  billingContextResponseSchema: () => billingContextResponseSchema,
+  billingProviderSchema: () => billingProviderSchema,
   catalogFeatureMapSchema: () => catalogFeatureMapSchema,
+  checkoutReturnResponseSchema: () => checkoutReturnResponseSchema,
   cliProductCredentialActorSchema: () => cliProductCredentialActorSchema,
   cliProductCredentialCapabilitySchema: () => cliProductCredentialCapabilitySchema,
   cliProductCredentialExchangeResponseSchema: () => cliProductCredentialExchangeResponseSchema,
@@ -27360,8 +27423,12 @@ __export(src_exports, {
   cliTelemetryIdentityResponseSchema: () => cliTelemetryIdentityResponseSchema,
   cliTelemetryProjectIdSchema: () => cliTelemetryProjectIdSchema,
   createAdminEnterpriseSubscriptionRequestSchema: () => createAdminEnterpriseSubscriptionRequestSchema,
+  createCheckoutSessionRequestSchema: () => createCheckoutSessionRequestSchema,
+  createCheckoutSessionResponseSchema: () => createCheckoutSessionResponseSchema,
   createHostedApiKeyRequestSchema: () => createHostedApiKeyRequestSchema,
   createHostedProjectRequestSchema: () => createHostedProjectRequestSchema,
+  createPortalSessionRequestSchema: () => createPortalSessionRequestSchema,
+  createPortalSessionResponseSchema: () => createPortalSessionResponseSchema,
   currentEntitlementResponseSchema: () => currentEntitlementResponseSchema,
   currentWaitlistResponseSchema: () => currentWaitlistResponseSchema,
   customerEffectiveEntitlementSchema: () => customerEffectiveEntitlementSchema,
@@ -27373,6 +27440,7 @@ __export(src_exports, {
   entitlementGrantedEventSchema: () => entitlementGrantedEventSchema,
   entitlementSourceSchema: () => entitlementSourceSchema,
   entitlementStateSchema: () => entitlementStateSchema,
+  expireCheckoutSessionResponseSchema: () => expireCheckoutSessionResponseSchema,
   featureValueSchema: () => featureValueSchema,
   hostedProjectApiKeyDeleteResponseSchema: () => hostedProjectApiKeyDeleteResponseSchema,
   hostedProjectApiKeyListItemSchema: () => hostedProjectApiKeyListItemSchema,
@@ -27413,6 +27481,7 @@ __export(src_exports, {
   organizationPlanSelectionGateSchema: () => organizationPlanSelectionGateSchema,
   organizationPlanSelectionRequestSchema: () => organizationPlanSelectionRequestSchema,
   organizationPlanSelectionResponseSchema: () => organizationPlanSelectionResponseSchema,
+  paidSelfServicePlanCodeSchema: () => paidSelfServicePlanCodeSchema,
   parseAdminEnterpriseSubscriptionDetailResponse: () => parseAdminEnterpriseSubscriptionDetailResponse,
   parseAdminEnterpriseSubscriptionListResponse: () => parseAdminEnterpriseSubscriptionListResponse,
   parseAdminEnterpriseSubscriptionResponse: () => parseAdminEnterpriseSubscriptionResponse,
@@ -27519,6 +27588,7 @@ var init_src2 = __esm({
   "libs/ops-contracts/src/index.ts"() {
     "use strict";
     init_zod();
+    init_billing();
     init_src();
     init_hosted_project();
     init_managed_navigation();
@@ -27778,7 +27848,8 @@ var init_src2 = __esm({
       token: true
     });
     cliProductCredentialTokenPayloadSchema = cliProductCredentialPayloadSchema.extend({
-      organizationName: external_exports.string().trim().min(1).optional()
+      organizationName: external_exports.string().trim().min(1).optional(),
+      organizationSlug: external_exports.string().trim().min(1).optional()
     }).strict();
     cliProductCredentialExchangeResponseSchema = external_exports.object({
       productCredential: cliProductCredentialSchema
@@ -28217,6 +28288,9 @@ function normalizeCodingAgent(_value) {
   const normalized = _value?.trim().toLowerCase() ?? "";
   return CODING_AGENT_PATTERN.test(normalized) ? normalized : "unknown";
 }
+function codingAgentProperty(value) {
+  return value === void 0 || value.trim() === "" ? {} : { coding_agent: normalizeCodingAgent(value) };
+}
 function resolveOnboardingRepositoryRoot(cwd2) {
   const canonicalCwd = canonicalizeDir(cwd2);
   return findRepositoryRoot(canonicalCwd) ?? canonicalCwd;
@@ -28242,15 +28316,24 @@ function readBoundRun(store, root2) {
     ...intent === void 0 ? {} : { intent }
   };
 }
-function resolveAnchoredRoot(dependencies) {
+function continuesAnchoredRun(store, root2, bound, lookup) {
+  if (lookup.runId !== void 0 && lookup.runId !== bound.runId)
+    return false;
+  const stored = readStoredRoute(store, stateKey("route", root2));
+  return !(stored?.runId === bound.runId && stored.ended === true);
+}
+function resolveAnchoredRoot(dependencies, lookup = {}) {
   const start = resolveOnboardingRepositoryRoot(dependencies.cwd);
   const home = canonicalizeDir(homedir3());
   const filesystemRoot = parse5(start).root;
   let candidate = start;
   while (true) {
     const bound = readBoundRun(dependencies.store, candidate);
-    if (bound.state === "live" && bound.anchored)
-      return candidate;
+    if (bound.state === "live" && bound.anchored) {
+      if (candidate === start)
+        return candidate;
+      return continuesAnchoredRun(dependencies.store, candidate, bound, lookup) ? candidate : start;
+    }
     const parent = dirname3(candidate);
     if (candidate === filesystemRoot || parent === candidate || parent === home || parent === filesystemRoot) {
       return start;
@@ -28402,9 +28485,15 @@ function startOnboardingRun(dependencies, requestedRunId, requestedIntent) {
   if (requestedIntent !== void 0 && !ONBOARDING_INTENT_PATTERN.test(requestedIntent)) {
     throw new Error("Requested onboarding intent is invalid");
   }
-  const root2 = resolveAnchoredRoot(dependencies);
-  const bound = readBoundRun(dependencies.store, root2);
   const validRequestedRun = requestedRunId !== void 0 && RUN_ID_PATTERN.test(requestedRunId) ? requestedRunId : void 0;
+  const project = resolveOnboardingRepositoryRoot(dependencies.cwd);
+  const anchored = resolveAnchoredRoot(dependencies, {
+    ...validRequestedRun === void 0 ? {} : { runId: validRequestedRun }
+  });
+  const anchoredBinding = readBoundRun(dependencies.store, anchored);
+  const continuesAnchor = anchoredBinding.state === "live" && (validRequestedRun === void 0 ? anchoredBinding.intent === requestedIntent : validRequestedRun === anchoredBinding.runId);
+  const root2 = anchored === project || continuesAnchor ? anchored : project;
+  const bound = root2 === anchored ? anchoredBinding : readBoundRun(dependencies.store, root2);
   const continuesBoundRun = bound.state === "live" && bound.intent === requestedIntent;
   const runId = validRequestedRun ?? (continuesBoundRun ? bound.runId : mintRunId(dependencies));
   dependencies.store.set(stateKey("run", root2), {
@@ -66269,7 +66358,7 @@ var require_websocket = __commonJS({
     var http4 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash8 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash9 } = __require("crypto");
     var { Duplex, Readable: Readable5 } = __require("stream");
     var { URL: URL7 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -66949,7 +67038,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -67336,7 +67425,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter4 = __require("events");
     var http4 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash8 } = __require("crypto");
+    var { createHash: createHash9 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -67645,7 +67734,7 @@ var require_websocket_server = __commonJS({
         }
         if (this._state > RUNNING)
           return abortHandshake(socket, 503);
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -91204,6 +91293,7 @@ __export(telemetry_exports, {
   getTelemetry: () => getTelemetry,
   hasStandaloneTelemetryIdentityConsent: () => hasStandaloneTelemetryIdentityConsent,
   linkConsentSubjectToUser: () => linkConsentSubjectToUser,
+  recordAbandonedInvocation: () => recordAbandonedInvocation,
   recordTelemetryEvent: () => recordTelemetryEvent,
   resolveReturnedOutcome: () => resolveReturnedOutcome,
   submitTelemetryEvent: () => submitTelemetryEvent,
@@ -91321,7 +91411,52 @@ function recordTelemetryEvent(event) {
   });
   if (!gate.send)
     return;
-  getTelemetry().recordEvent(withProjectIdentity(event));
+  for (const paired of pairCommandBookends(event)) {
+    getTelemetry().recordEvent(withProjectIdentity(paired));
+  }
+}
+function isCommandLifecycle(event) {
+  return (event.event === void 0 || event.event === CLI_TELEMETRY_EVENT_NAME) && event.properties.outcome !== void 0;
+}
+function pairCommandBookends(event) {
+  if (!isCommandLifecycle(event))
+    return [event];
+  if (event.properties.outcome === "started") {
+    if (openInvocation !== null || invocationSettled)
+      return [];
+    openInvocation = { properties: event.properties, startedAt: Date.now() };
+    return [event];
+  }
+  if (invocationSettled)
+    return [];
+  invocationSettled = true;
+  if (openInvocation !== null) {
+    openInvocation = null;
+    return [event];
+  }
+  const opening = { ...event.properties };
+  delete opening.outcome;
+  delete opening.error_code;
+  delete opening.duration_ms;
+  return [
+    { ...event, properties: { ...opening, outcome: "started" } },
+    event
+  ];
+}
+function settleOpenInvocation(outcome) {
+  if (openInvocation === null || invocationSettled)
+    return;
+  const { properties, startedAt } = openInvocation;
+  recordTelemetryEvent({
+    properties: {
+      ...properties,
+      outcome,
+      duration_ms: Date.now() - startedAt
+    }
+  });
+}
+function recordAbandonedInvocation() {
+  settleOpenInvocation("abandoned");
 }
 async function submitTelemetryEvent(event) {
   const buildInfo = getBuildInfo();
@@ -91389,6 +91524,7 @@ async function flushTelemetry(timeoutMs = DEFAULT_FLUSH_TIMEOUT_MS) {
   await instance.flush(timeoutMs);
 }
 async function exitWithFlush(code) {
+  settleOpenInvocation(code === 0 ? "succeeded" : "failed");
   await flushTelemetry();
   process.exit(code);
 }
@@ -91519,11 +91655,13 @@ function __resetTelemetryForTests() {
   instance = null;
   consentProviderInstance = null;
   recordedTelemetryIdCache = void 0;
+  openInvocation = null;
+  invocationSettled = false;
 }
 function __setConsentProviderForTests(provider) {
   consentProviderInstance = provider;
 }
-var instance, consentProviderInstance, cliLogTelemetryLogger, recordedTelemetryIdCache;
+var instance, consentProviderInstance, cliLogTelemetryLogger, recordedTelemetryIdCache, openInvocation, invocationSettled;
 var init_telemetry = __esm({
   async "apps/cli/src/services/telemetry/index.ts"() {
     "use strict";
@@ -91552,6 +91690,8 @@ var init_telemetry = __esm({
       warn: (payload) => writeCliLog("info", payload),
       error: (payload) => writeCliLog("error", payload)
     };
+    openInvocation = null;
+    invocationSettled = false;
   }
 });
 
@@ -91921,6 +92061,30 @@ function createApiClient(baseUrl, token, options = {}) {
       }
       return res.json();
     },
+    /**
+     * Redeems a short sign-in code for a CLI session.
+     *
+     * @param code - The code the browser displayed or the callback delivered.
+     * @param codeVerifier - The PKCE verifier this process generated.
+     * @param telemetryInstallationId - Anonymous installation id to bind, or
+     *   omitted when telemetry is disabled or the CLI is running in CI.
+     * @returns The parsed {@link AuthPayload} containing the CLI session token.
+     */
+    async exchangeAuthorizationCode(code, codeVerifier, telemetryInstallationId) {
+      const res = await fetchWithTimeout(`${baseUrl}/api/cli/auth/session`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          code,
+          codeVerifier,
+          ...telemetryInstallationId === void 0 ? {} : { telemetryInstallationId }
+        })
+      });
+      if (!res.ok) {
+        throw await readApiError(res);
+      }
+      return res.json();
+    },
     async verifySession(telemetryInstallationId) {
       const query = telemetryInstallationId === void 0 ? "" : `?telemetryInstallationId=${encodeURIComponent(telemetryInstallationId)}`;
       const res = await retryTransient(async () => {
@@ -93017,17 +93181,29 @@ var init_open = __esm({
 // apps/cli/src/services/auth.service.ts
 var auth_service_exports = {};
 __export(auth_service_exports, {
+  MANUAL_LOGIN_ONLY_ENV_VAR: () => MANUAL_LOGIN_ONLY_ENV_VAR,
   TERMINAL_SESSION_INVALID_MESSAGE: () => TERMINAL_SESSION_INVALID_MESSAGE,
   clearAuthOnTerminalSessionInvalidation: () => clearAuthOnTerminalSessionInvalidation,
+  createPkcePair: () => createPkcePair,
+  isManualLoginOnlyEnabled: () => isManualLoginOnlyEnabled,
   isTerminalSessionInvalidationError: () => isTerminalSessionInvalidationError,
   login: () => login,
   logout: () => logout,
-  raceForClerkToken: () => raceForClerkToken,
+  raceForAuthCode: () => raceForAuthCode,
   startCallbackServer: () => startCallbackServer,
   verifyAndRefresh: () => verifyAndRefresh
 });
 import * as crypto3 from "crypto";
 import * as http from "http";
+function createPkcePair() {
+  const codeVerifier = crypto3.randomBytes(32).toString("base64url");
+  const codeChallenge = crypto3.createHash("sha256").update(codeVerifier).digest("base64url");
+  return { codeVerifier, codeChallenge };
+}
+function isManualLoginOnlyEnabled() {
+  const value = process.env[MANUAL_LOGIN_ONLY_ENV_VAR]?.trim().toLowerCase();
+  return value === "1" || value === "true";
+}
 function startCallbackServer(expectedState, waitForLoginCompletion = false) {
   const diagnostics = createCliAuthDiagnostics(expectedState);
   diagnostics.logPhase("callback-server.starting", {
@@ -93051,6 +93227,26 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
 <html><head><meta charset="utf-8"><title>Sign-in failed</title>
 <style>body{font-family:-apple-system,system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;color:#111}main{text-align:center;max-width:420px;padding:2rem}h1{font-size:1.25rem;margin:0 0 .5rem;color:#c0392b}p{color:#555;font-size:.95rem;line-height:1.5;margin:0}</style>
 </head><body><main><h1>Sign-in failed</h1><p>${msg}</p></main></body></html>`;
+    const MANUAL_ONLY_HTML = (code) => `<!doctype html>
+<html><head><meta charset="utf-8"><title>Automatic sign-in blocked</title>
+<style>body{font-family:-apple-system,system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;color:#111}main{text-align:center;max-width:640px;padding:2rem}h1{font-size:1.25rem;margin:0 0 .5rem}p{color:#555;font-size:.95rem;line-height:1.5;margin:0 0 1rem}code{display:block;word-break:break-all;text-align:left;background:#f4f4f5;border:1px solid #e4e4e7;border-radius:6px;padding:.75rem;font-size:.8rem}button{margin-top:.75rem;font-size:.9rem;padding:.5rem 1rem;border-radius:6px;border:1px solid #d4d4d8;background:#fff;cursor:pointer}#age{margin-top:.75rem;color:#777;font-size:.85rem}</style>
+</head><body><main><h1>Automatic sign-in blocked</h1>
+<p>This CLI runs with <code style="display:inline;padding:.1rem .3rem">${MANUAL_LOGIN_ONLY_ENV_VAR}</code> set, so it ignored this redirect. Copy the code below and paste it into the CLI prompt.</p>
+<code id="t">${code}</code>
+<button id="c">Copy code</button>
+<p id="age"></p>
+<script>
+const minted = Date.now();
+document.getElementById("c").addEventListener("click", async () => {
+  await navigator.clipboard.writeText(document.getElementById("t").textContent);
+  document.getElementById("c").textContent = "Copied";
+});
+setInterval(() => {
+  document.getElementById("age").textContent =
+    "On this page for " + Math.round((Date.now() - minted) / 1000) + "s.";
+}, 1000);
+</script>
+</main></body></html>`;
     const sendCompletion = (res, success3) => new Promise((resolve9) => {
       if (res.destroyed) {
         resolve9();
@@ -93113,12 +93309,14 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
         rejectResult(reason);
       };
       const state = url4.searchParams.get("state");
+      const code = url4.searchParams.get("code");
       const clerkToken = url4.searchParams.get("clerkToken");
       const hostedSnapshot = parseHostedCliAuthDiagnosticSnapshot(
         url4.searchParams.get("cliAuthDiag")
       );
       diagnostics.logPhase("callback-server.callback-received", {
         callback: summarizeCallbackUrl(`http://127.0.0.1${url4.pathname}`),
+        hasCode: Boolean(code),
         hasClerkToken: Boolean(clerkToken),
         receivedState: summarizeState(state)
       });
@@ -93142,10 +93340,10 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
         rejectOnce(new Error("State mismatch in callback"));
         return;
       }
-      if (!clerkToken) {
+      if (!code && !clerkToken) {
         diagnostics.logError(
-          "callback-server.missing-clerk-token",
-          new Error("Missing clerkToken in callback"),
+          "callback-server.missing-code",
+          new Error("Missing code in callback"),
           {
             receivedState: summarizeState(state)
           }
@@ -93154,8 +93352,20 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
           "Content-Type": "text/html; charset=utf-8",
           Connection: "close"
         });
-        res.end(ERROR_HTML("Missing Clerk token. Please retry from the CLI."));
-        rejectOnce(new Error("Missing clerkToken in callback"));
+        res.end(ERROR_HTML("Missing sign-in code. Please retry from the CLI."));
+        rejectOnce(new Error("Missing code in callback"));
+        return;
+      }
+      if (isManualLoginOnlyEnabled() && code) {
+        res.writeHead(200, {
+          "Content-Type": "text/html; charset=utf-8",
+          Connection: "close"
+        });
+        res.end(MANUAL_ONLY_HTML(code));
+        diagnostics.logPhase("callback-server.callback-ignored", {
+          reason: "manual-login-only",
+          receivedState: summarizeState(state)
+        });
         return;
       }
       if (waitForLoginCompletion) {
@@ -93179,9 +93389,10 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
         res.end(SUCCESS_HTML);
       }
       diagnostics.logPhase("callback-server.callback-accepted", {
-        receivedState: summarizeState(state)
+        receivedState: summarizeState(state),
+        via: code ? "code" : "clerkToken"
       });
-      resolveOnce({ clerkToken });
+      resolveOnce(code ? { code } : { clerkToken });
     });
     server.on("error", (error98) => {
       diagnostics.logError("callback-server.error", error98);
@@ -93204,16 +93415,16 @@ function startCallbackServer(expectedState, waitForLoginCompletion = false) {
     });
   });
 }
-async function raceForClerkToken(resultPromise, manualClerkToken) {
+async function raceForAuthCode(resultPromise, manualClerkToken) {
   const callbackBranch = resultPromise.then((result) => ({
-    clerkToken: result.clerkToken,
+    ...result,
     source: "callback"
   }));
   if (!manualClerkToken) {
     return await callbackBranch;
   }
-  const manualBranch = manualClerkToken.then((clerkToken) => ({
-    clerkToken,
+  const manualBranch = manualClerkToken.then((code) => ({
+    code,
     source: "manual"
   }));
   const swallow = (promise3) => {
@@ -93223,8 +93434,21 @@ async function raceForClerkToken(resultPromise, manualClerkToken) {
   swallow(manualBranch);
   return await Promise.race([callbackBranch, manualBranch]);
 }
+function reportAuthCodeShape(code, source, diagnostics) {
+  diagnostics.logPhase("login.code-shape", {
+    length: code.length,
+    source
+  });
+  if (!isManualLoginOnlyEnabled()) {
+    return;
+  }
+  process.stderr.write(`
+[manual-login-only] Code length ${code.length}.
+`);
+}
 async function login(options = {}) {
   const state = crypto3.randomBytes(16).toString("hex");
+  const { codeVerifier, codeChallenge } = createPkcePair();
   const diagnostics = createCliAuthDiagnostics(state);
   diagnostics.logPhase("login.start", {
     opsApiUrl: getOpsApiUrl(),
@@ -93242,6 +93466,8 @@ async function login(options = {}) {
     const loginParams = new URLSearchParams({
       callback: callbackUrl,
       state,
+      code_challenge: codeChallenge,
+      code_challenge_method: "S256",
       ...isCliAuthDiagnosticsVerboseEnabled() ? { verbose: "1" } : {},
       ...posthogDistinctId !== null ? { posthog_distinct_id: posthogDistinctId } : {}
     });
@@ -93273,13 +93499,14 @@ async function login(options = {}) {
       }
     }
     diagnostics.logPhase("login.waiting-for-callback");
-    const { clerkToken, source } = await raceForClerkToken(
+    const credential = await raceForAuthCode(
       resultPromise,
       options.manualClerkToken
     );
+    const { source } = credential;
     tokenSource = source;
     diagnostics.logPhase("login.callback-complete", {
-      clerkTokenReceived: true,
+      codeReceived: "code" in credential,
       tokenSource: source
     });
     const apiClient = createApiClient(getOpsApiUrl());
@@ -93288,10 +93515,20 @@ async function login(options = {}) {
     let authPayload;
     try {
       diagnostics.logPhase("login.exchange-start");
-      authPayload = await apiClient.exchangeClerkToken(
-        clerkToken,
-        bindDuringExchange
-      );
+      if ("code" in credential) {
+        reportAuthCodeShape(credential.code, source, diagnostics);
+        authPayload = await apiClient.exchangeAuthorizationCode(
+          credential.code,
+          codeVerifier,
+          bindDuringExchange
+        );
+      } else {
+        diagnostics.logPhase("login.exchange-clerk-token-fallback");
+        authPayload = await apiClient.exchangeClerkToken(
+          credential.clerkToken,
+          bindDuringExchange
+        );
+      }
       diagnostics.logPhase("login.exchange-complete", {
         organizationId: authPayload.organization.clerkOrgId,
         userId: authPayload.user.id
@@ -93422,7 +93659,7 @@ async function logout() {
   authStore.clear();
   rotateInstallationId({ configStore });
 }
-var MANUAL_PASTE_SERVER_LINGER_MS, TERMINAL_SESSION_INVALID_MESSAGE;
+var MANUAL_LOGIN_ONLY_ENV_VAR, MANUAL_PASTE_SERVER_LINGER_MS, TERMINAL_SESSION_INVALID_MESSAGE;
 var init_auth_service = __esm({
   async "apps/cli/src/services/auth.service.ts"() {
     "use strict";
@@ -93433,6 +93670,7 @@ var init_auth_service = __esm({
     await init_telemetry();
     init_cli_auth_diagnostics();
     init_config();
+    MANUAL_LOGIN_ONLY_ENV_VAR = "COPILOTKIT_CLI_MANUAL_LOGIN_ONLY";
     MANUAL_PASTE_SERVER_LINGER_MS = 6e3;
     TERMINAL_SESSION_INVALID_MESSAGE = "Existing CLI sessions are invalid after the Clerk cutover. Please log in again.";
   }
@@ -93536,6 +93774,37 @@ var init_build4 = __esm({
   }
 });
 
+// apps/cli/src/services/auth-code-shape.ts
+function normalizeAuthCode(raw2) {
+  return raw2.trim().toUpperCase().replaceAll("-", "").replaceAll(/\s/gu, "").replaceAll(/[IL]/gu, "1").replaceAll("O", "0");
+}
+function inspectAuthCode(value) {
+  const normalized = normalizeAuthCode(value);
+  if (normalized.length === 0) {
+    return { ok: false, reason: "The code is empty." };
+  }
+  if (normalized.includes(".")) {
+    return {
+      ok: false,
+      reason: "That looks like a session token, not a sign-in code. Copy the short code shown on the page."
+    };
+  }
+  if (!CODE_PATTERN.test(normalized)) {
+    return {
+      ok: false,
+      reason: "A sign-in code is eight characters, like WDJB-MJHT. Check the code on the page and enter it again."
+    };
+  }
+  return { ok: true };
+}
+var CODE_PATTERN;
+var init_auth_code_shape = __esm({
+  "apps/cli/src/services/auth-code-shape.ts"() {
+    "use strict";
+    CODE_PATTERN = /^[0-9ABCDEFGHJKMNPQRSTVWXYZ]{8}$/u;
+  }
+});
+
 // apps/cli/src/services/cli-tips.ts
 function rankCliTips(tips = CLI_TIPS) {
   return [...tips].sort((firstTip, secondTip) => {
@@ -94063,7 +94332,16 @@ function BrowserLoginProvider({
     if (trimmed.length === 0) {
       return void 0;
     }
+    const inspection = inspectAuthCode(trimmed);
+    if (!inspection.ok) {
+      setState((previous) => ({
+        ...previous,
+        manualTokenError: inspection.reason
+      }));
+      return void 0;
+    }
     pendingManualTokenRef.current = null;
+    setState((previous) => ({ ...previous, manualTokenError: "" }));
     pendingManualToken.resolve(trimmed);
     return void 0;
   }, []);
@@ -94115,7 +94393,8 @@ function BrowserLoginProvider({
           phase: "finalizing",
           identity,
           errorMessage: "",
-          loginUrl: ""
+          loginUrl: "",
+          manualTokenError: ""
         });
         await new Promise((resolve9) => {
           setTimeout(() => {
@@ -94127,7 +94406,8 @@ function BrowserLoginProvider({
         phase: "success",
         identity,
         errorMessage: "",
-        loginUrl: ""
+        loginUrl: "",
+        manualTokenError: ""
       });
       return result;
     } catch (error98) {
@@ -94140,7 +94420,8 @@ function BrowserLoginProvider({
         phase: "error",
         identity: null,
         errorMessage: concreteError.message,
-        loginUrl: ""
+        loginUrl: "",
+        manualTokenError: ""
       });
       throw concreteError;
     }
@@ -94233,6 +94514,7 @@ function BrowserLoginConfirmation({
           )
         ] })
       ] }) : null,
+      state.manualTokenError !== "" ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(Box_default, { marginTop: 1, children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(Text, { color: "red", children: state.manualTokenError }) }) : null,
       /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(CliTip, {})
     ] });
   }
@@ -94278,6 +94560,7 @@ var init_browser_login = __esm({
     await init_build4();
     await init_auth_service();
     init_cli_auth_diagnostics();
+    init_auth_code_shape();
     await init_cli_tip();
     await init_spinner();
     await init_success_text();
@@ -94289,10 +94572,11 @@ var init_browser_login = __esm({
       phase: "idle",
       identity: null,
       errorMessage: "",
-      loginUrl: ""
+      loginUrl: "",
+      manualTokenError: ""
     };
     BrowserLoginContext = (0, import_react35.createContext)(null);
-    BROWSER_LOGIN_MANUAL_PASTE_LABEL = "If your browser finished sign-in but the CLI didn't notice, paste the code shown in the browser:";
+    BROWSER_LOGIN_MANUAL_PASTE_LABEL = "If your browser finished sign-in but the CLI didn't notice, paste the short code shown there:";
     BROWSER_LOGIN_MANUAL_URL_LABEL = "If the browser didn't open, sign in at:";
   }
 });
@@ -96721,7 +97005,7 @@ var init_learning_skills_api = __esm({
 });
 
 // apps/cli/src/services/learning-skills-download.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import {
   existsSync as existsSync10,
   mkdirSync as mkdirSync5,
@@ -96932,7 +97216,7 @@ function verifyEtag(bytes, etag) {
   if (etag === void 0) {
     return;
   }
-  const expected = `"${createHash2("sha256").update(bytes).digest("hex")}"`;
+  const expected = `"${createHash3("sha256").update(bytes).digest("hex")}"`;
   if (etag !== expected) {
     throw learningSkillsError(
       TELEMETRY_ERROR_CODES.LEARNING_SKILLS_INTEGRITY_FAILED,
@@ -97053,6 +97337,68 @@ var init_skills_download = __esm({
   }
 });
 
+// apps/cli/src/services/child-timeout.ts
+function signalChildTree(child, signal, ownsProcessGroup) {
+  const { pid } = child;
+  if (ownsProcessGroup && pid !== void 0) {
+    try {
+      process.kill(-pid, signal);
+      return;
+    } catch {
+    }
+  }
+  try {
+    child.kill(signal);
+  } catch {
+  }
+}
+function armChildTimeout(child, timeoutMs, onTimeout, options = {}) {
+  if (timeoutMs <= 0)
+    return { cancel: () => void 0 };
+  const ownsProcessGroup = options.ownsProcessGroup === true;
+  let closed = false;
+  let graceTimer;
+  const timer = setTimeout(() => {
+    signalChildTree(child, "SIGTERM", ownsProcessGroup);
+    onTimeout();
+    graceTimer = setTimeout(() => {
+      if (!closed)
+        signalChildTree(child, "SIGKILL", ownsProcessGroup);
+    }, TERMINATION_GRACE_MS);
+  }, timeoutMs);
+  const forwarders = (ownsProcessGroup ? FORWARDED_SIGNALS : []).flatMap((signal) => {
+    if (process.listenerCount(signal) === 0)
+      return [];
+    const forward = () => {
+      signalChildTree(child, signal, ownsProcessGroup);
+    };
+    process.once(signal, forward);
+    return [{ signal, forward }];
+  });
+  const cancel = () => {
+    clearTimeout(timer);
+    if (graceTimer !== void 0)
+      clearTimeout(graceTimer);
+    for (const { signal, forward } of forwarders) {
+      process.off(signal, forward);
+    }
+  };
+  child.once("close", () => {
+    closed = true;
+    cancel();
+  });
+  return { cancel };
+}
+var TERMINATION_GRACE_MS, OWN_PROCESS_GROUP, FORWARDED_SIGNALS;
+var init_child_timeout = __esm({
+  "apps/cli/src/services/child-timeout.ts"() {
+    "use strict";
+    TERMINATION_GRACE_MS = 5e3;
+    OWN_PROCESS_GROUP = { detached: true };
+    FORWARDED_SIGNALS = ["SIGINT", "SIGTERM"];
+  }
+});
+
 // apps/cli/src/services/skills-install.ts
 import { spawn } from "node:child_process";
 import {
@@ -97158,6 +97504,65 @@ function removePartialFailureMonitor(monitor) {
   } catch {
   }
 }
+function createSkillsInstallRunner(timeoutMs = SKILLS_INSTALL_TIMEOUT_MS) {
+  return (command2, args, outputMode) => new Promise((resolve9, reject) => {
+    let capture = {
+      output: "",
+      reportedPartialFailure: false
+    };
+    const monitor = outputMode === "monitor" ? createPartialFailureMonitor() : null;
+    const ownsProcessGroup = outputMode === "capture";
+    const child = spawn(command2, [...args], {
+      stdio: outputMode === "capture" ? ["ignore", "pipe", "pipe"] : "inherit",
+      ...ownsProcessGroup ? OWN_PROCESS_GROUP : {},
+      env: monitor === null ? void 0 : {
+        ...process.env,
+        NODE_OPTIONS: monitor.nodeOptions,
+        [PARTIAL_FAILURE_FILE_ENV]: monitor.markerPath
+      },
+      // `npx` is a `.cmd` shim on Windows and is only resolvable through a shell
+      // there; POSIX can exec it directly. Selection tokens are validated against
+      // SELECTION_TOKEN before reaching here, so there is no injection surface.
+      shell: process.platform === "win32"
+    });
+    if (outputMode === "capture") {
+      child.stdout?.on("data", (chunk) => {
+        capture = appendSkillsInstallOutput(capture, chunk);
+      });
+      child.stderr?.on("data", (chunk) => {
+        capture = appendSkillsInstallOutput(capture, chunk);
+      });
+    }
+    let timedOut = false;
+    const timeout = armChildTimeout(
+      child,
+      timeoutMs,
+      () => {
+        timedOut = true;
+      },
+      { ownsProcessGroup }
+    );
+    child.on("error", (error98) => {
+      timeout.cancel();
+      removePartialFailureMonitor(monitor);
+      reject(error98);
+    });
+    child.on("close", (code) => {
+      timeout.cancel();
+      const reportedPartialFailure = capture.reportedPartialFailure || monitor !== null && existsSync11(monitor.markerPath);
+      removePartialFailureMonitor(monitor);
+      if (timedOut) {
+        reject(
+          new Error(
+            `The skills installer stopped responding after ${timeoutMs} ms and was stopped. Check the network and the npm registry configuration, then run \`${command2} ${args.join(" ")}\` by hand.`
+          )
+        );
+        return;
+      }
+      resolve9({ exitCode: code ?? 1, ...capture, reportedPartialFailure });
+    });
+  });
+}
 async function installCopilotKitSkills(options = {}, deps = {}) {
   const run = deps.run ?? defaultRunner;
   const args = buildSkillsInstallArgs(options);
@@ -97183,10 +97588,11 @@ Retry with \`${SKILLS_INSTALL_COMMAND} ${retryArgs}\`.`
     );
   }
 }
-var SKILLS_INSTALL_COMMAND, SKILLS_INSTALL_PACKAGE, SKILLS_SOURCE, ALL_SELECTION, DEFAULT_ONBOARD_AGENTS, SELECTION_TOKEN, MAX_CAPTURED_OUTPUT_CHARACTERS, PARTIAL_FAILURE_PATTERN, PARTIAL_FAILURE_FILE_ENV, PARTIAL_FAILURE_MONITOR_SOURCE, defaultRunner;
+var SKILLS_INSTALL_COMMAND, SKILLS_INSTALL_PACKAGE, SKILLS_SOURCE, ALL_SELECTION, DEFAULT_ONBOARD_AGENTS, SELECTION_TOKEN, MAX_CAPTURED_OUTPUT_CHARACTERS, SKILLS_INSTALL_TIMEOUT_MS, PARTIAL_FAILURE_PATTERN, PARTIAL_FAILURE_FILE_ENV, PARTIAL_FAILURE_MONITOR_SOURCE, defaultRunner;
 var init_skills_install = __esm({
   "apps/cli/src/services/skills-install.ts"() {
     "use strict";
+    init_child_timeout();
     init_event_properties();
     SKILLS_INSTALL_COMMAND = "npx";
     SKILLS_INSTALL_PACKAGE = "skills@1.5.18";
@@ -97195,6 +97601,7 @@ var init_skills_install = __esm({
     DEFAULT_ONBOARD_AGENTS = ["universal", "claude-code"];
     SELECTION_TOKEN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
     MAX_CAPTURED_OUTPUT_CHARACTERS = 16384;
+    SKILLS_INSTALL_TIMEOUT_MS = 5 * 6e4;
     PARTIAL_FAILURE_PATTERN = /\bFailed to install [1-9]\d*\b/;
     PARTIAL_FAILURE_FILE_ENV = "CPKI_SKILLS_PARTIAL_FAILURE_FILE";
     PARTIAL_FAILURE_MONITOR_SOURCE = String.raw`"use strict";
@@ -97228,42 +97635,7 @@ function monitor(stream) {
 monitor(process.stdout);
 monitor(process.stderr);
 `;
-    defaultRunner = (command2, args, outputMode) => new Promise((resolve9, reject) => {
-      let capture = {
-        output: "",
-        reportedPartialFailure: false
-      };
-      const monitor = outputMode === "monitor" ? createPartialFailureMonitor() : null;
-      const child = spawn(command2, [...args], {
-        stdio: outputMode === "capture" ? ["ignore", "pipe", "pipe"] : "inherit",
-        env: monitor === null ? void 0 : {
-          ...process.env,
-          NODE_OPTIONS: monitor.nodeOptions,
-          [PARTIAL_FAILURE_FILE_ENV]: monitor.markerPath
-        },
-        // `npx` is a `.cmd` shim on Windows and is only resolvable through a shell
-        // there; POSIX can exec it directly. Selection tokens are validated against
-        // SELECTION_TOKEN before reaching here, so there is no injection surface.
-        shell: process.platform === "win32"
-      });
-      if (outputMode === "capture") {
-        child.stdout?.on("data", (chunk) => {
-          capture = appendSkillsInstallOutput(capture, chunk);
-        });
-        child.stderr?.on("data", (chunk) => {
-          capture = appendSkillsInstallOutput(capture, chunk);
-        });
-      }
-      child.on("error", (error98) => {
-        removePartialFailureMonitor(monitor);
-        reject(error98);
-      });
-      child.on("close", (code) => {
-        const reportedPartialFailure = capture.reportedPartialFailure || monitor !== null && existsSync11(monitor.markerPath);
-        removePartialFailureMonitor(monitor);
-        resolve9({ exitCode: code ?? 1, ...capture, reportedPartialFailure });
-      });
-    });
+    defaultRunner = createSkillsInstallRunner();
   }
 });
 
@@ -98791,7 +99163,7 @@ var init_inspector_metadata = __esm({
 });
 
 // libs/app-api-contracts/src/inspector-learning.ts
-var text, idSchema, boundedTextSchema, urlSchema, originSchema, candidateReviewUrlSchema, inspectorLearningRequestV1Schema, inspectorLearningUpstreamRequestV1Schema, evidenceSchema, inspectorLearningInsightSchema, configurationSchema, runSchema, pageSchema, skillSchema, inspectorLearningSnapshotV1Schema;
+var text, idSchema, boundedTextSchema, urlSchema, originSchema, candidateReviewUrlSchema, analysisResultsUrlSchema, inspectorLearningRequestV1Schema, inspectorLearningUpstreamRequestV1Schema, evidenceSchema, inspectorLearningInsightSchema, configurationSchema, runSchema, pageSchema, skillSchema, inspectorLearningSnapshotV1Schema;
 var init_inspector_learning = __esm({
   "libs/app-api-contracts/src/inspector-learning.ts"() {
     "use strict";
@@ -98818,6 +99190,12 @@ var init_inspector_learning = __esm({
       const url4 = new URL(value);
       return /^\/o\/[^/]+\/[^/]+\/learning\/[^/]+\/skills$/u.test(url4.pathname) && url4.search === "" && url4.hash === "";
     }, "Expected a project-scoped Learning Skill-review URL.");
+    analysisResultsUrlSchema = urlSchema.refine((value) => {
+      const url4 = new URL(value);
+      return /^\/o\/[^/]+\/[^/]+\/learning\/[^/]+\/analysis-results$/u.test(
+        url4.pathname
+      ) && url4.search === "" && url4.hash === "";
+    }, "Expected a project-scoped Learning analysis-results URL.");
     inspectorLearningRequestV1Schema = external_exports.object({
       agentId: idSchema.optional(),
       skillsPage: external_exports.number().int().min(1).optional(),
@@ -98914,7 +99292,7 @@ var init_inspector_learning = __esm({
       links: external_exports.object({
         learning: urlSchema,
         candidates: candidateReviewUrlSchema.nullable(),
-        runs: urlSchema.nullable()
+        runs: analysisResultsUrlSchema.nullable()
       }).strict()
     }).strict().superRefine((snapshot, context3) => {
       const origin = new URL(snapshot.webAppOrigin).origin;
@@ -100778,7 +101156,7 @@ var init_import_metadata = __esm({
 });
 
 // libs/import-contracts/src/schemas.ts
-var TextContentBlockSchema, ReasoningContentBlockSchema, InlineMediaContentBlockSchema, UnresolvedMediaContentBlockSchema, MediaContentBlockSchema, ToolCallContentBlockSchema, NormalizedContentBlockSchema, NormalizedMessageRoleSchema, NormalizedRunStatusSchema, NormalizedSourceBackendSchema, EndUserPolicySchema, NormalizedMessageSchema, NormalizedRunUsageSchema, NormalizedRunSchema, NormalizedConversationSchema, ImportRequestSchema;
+var TextContentBlockSchema, ReasoningContentBlockSchema, InlineMediaContentBlockSchema, UnresolvedMediaContentBlockSchema, MediaContentBlockSchema, ToolCallContentBlockSchema, NormalizedContentBlockSchema, NormalizedMessageRoleSchema, NormalizedRunStatusSchema, NormalizedSourceBackendSchema, EndUserPolicySchema, NormalizedMessageSchema, NormalizedRunUsageSchema, NormalizedRunSchema, NormalizedPendingInterruptSchema, NormalizedConversationSchema, ImportRequestSchema;
 var init_schemas3 = __esm({
   "libs/import-contracts/src/schemas.ts"() {
     "use strict";
@@ -100840,6 +101218,7 @@ var init_schemas3 = __esm({
       role: NormalizedMessageRoleSchema,
       timestamp: external_exports.string(),
       toolCallId: external_exports.string().optional(),
+      error: external_exports.string().optional(),
       content: external_exports.array(NormalizedContentBlockSchema)
     });
     NormalizedRunUsageSchema = external_exports.object({
@@ -100854,9 +101233,14 @@ var init_schemas3 = __esm({
       finishedAt: external_exports.string().optional(),
       usage: NormalizedRunUsageSchema.optional(),
       finishReason: external_exports.string().optional(),
+      errorMessage: external_exports.string().optional(),
       interruptValue: external_exports.unknown().optional(),
       messages: external_exports.array(NormalizedMessageSchema)
     });
+    NormalizedPendingInterruptSchema = external_exports.object({
+      id: external_exports.string().min(1).optional(),
+      value: external_exports.json()
+    }).loose();
     NormalizedConversationSchema = external_exports.object({
       // Non-empty: `sourceThreadId` is half of the conversation-level dedup key
       // (project_id, import_metadata->>'source', ->>'source_thread_id'); a blank
@@ -100866,6 +101250,8 @@ var init_schemas3 = __esm({
       sourceBackend: NormalizedSourceBackendSchema.optional(),
       endUserId: external_exports.string().nullable(),
       lastActivityAt: external_exports.string().optional(),
+      stateSnapshot: external_exports.json().optional(),
+      pendingInterrupts: external_exports.array(NormalizedPendingInterruptSchema).optional(),
       runs: external_exports.array(NormalizedRunSchema)
     });
     ImportRequestSchema = external_exports.object({
@@ -140643,7 +141029,7 @@ var require_websocket2 = __commonJS({
     var http4 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes4, createHash: createHash8 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash9 } = __require("crypto");
     var { Duplex, Readable: Readable5 } = __require("stream");
     var { URL: URL7 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate2();
@@ -141331,7 +141717,7 @@ var require_websocket2 = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -141720,7 +142106,7 @@ var require_websocket_server2 = __commonJS({
     var EventEmitter4 = __require("events");
     var http4 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash8 } = __require("crypto");
+    var { createHash: createHash9 } = __require("crypto");
     var extension2 = require_extension2();
     var PerMessageDeflate2 = require_permessage_deflate2();
     var subprotocol2 = require_subprotocol2();
@@ -142035,7 +142421,7 @@ var require_websocket_server2 = __commonJS({
         }
         if (this._state > RUNNING)
           return abortHandshake(socket, 503);
-        const digest = createHash8("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -233269,7 +233655,7 @@ var init_crc32c = __esm({
 });
 
 // node_modules/.pnpm/@google-cloud+storage@7.21.0_encoding@0.1.13/node_modules/@google-cloud/storage/build/esm/src/hash-stream-validator.js
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { Transform as Transform3 } from "stream";
 var __classPrivateFieldSet2, __classPrivateFieldGet2, _HashStreamValidator_crc32cHash, _HashStreamValidator_md5Hash, _HashStreamValidator_md5Digest, HashStreamValidator;
 var init_hash_stream_validator = __esm({
@@ -233314,7 +233700,7 @@ var init_hash_stream_validator = __esm({
           }
         }
         if (this.md5Enabled) {
-          __classPrivateFieldSet2(this, _HashStreamValidator_md5Hash, createHash3("md5"), "f");
+          __classPrivateFieldSet2(this, _HashStreamValidator_md5Hash, createHash4("md5"), "f");
         }
       }
       /**
@@ -233382,7 +233768,7 @@ var init_hash_stream_validator = __esm({
 });
 
 // node_modules/.pnpm/@google-cloud+storage@7.21.0_encoding@0.1.13/node_modules/@google-cloud/storage/build/esm/src/resumable-upload.js
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { Readable as Readable2, Writable } from "stream";
 import * as crypto10 from "crypto";
 function upload(cfg) {
@@ -233514,13 +233900,13 @@ var init_resumable_upload = __esm({
             const base64Key = Buffer.from(cfg.key).toString("base64");
             this.encryption = {
               key: base64Key,
-              hash: createHash4("sha256").update(cfg.key).digest("base64")
+              hash: createHash5("sha256").update(cfg.key).digest("base64")
             };
           } else {
             const base64Key = cfg.key.toString("base64");
             this.encryption = {
               key: base64Key,
-              hash: createHash4("sha256").update(cfg.key).digest("base64")
+              hash: createHash5("sha256").update(cfg.key).digest("base64")
             };
           }
         }
@@ -376392,7 +376778,9 @@ var init_messages6 = __esm({
           content.push(reasoning);
         }
       }
-      content.push(...contentBlocksFrom(message.content));
+      content.push(
+        ...contentBlocksFrom(message.content)
+      );
       if (type2 === "ai") {
         content.push(...toolCallBlocksFrom(message));
       }
@@ -376405,6 +376793,8 @@ var init_messages6 = __esm({
         content
       };
       if (type2 === "tool") {
+        if ("status" in message && message.status === "error")
+          normalized.error = "error";
         const toolCallId = message.tool_call_id;
         if (typeof toolCallId === "string" && toolCallId !== "") {
           return { ...normalized, toolCallId };
@@ -376541,6 +376931,135 @@ var init_state2 = __esm({
   }
 });
 
+// libs/import-langgraph/src/state-snapshot.ts
+var defaultWarn2, assistantSchema, createAssistantSchemaCache, hasRecoverableState, readAssistantSchemas, readStateSnapshot;
+var init_state_snapshot = __esm({
+  "libs/import-langgraph/src/state-snapshot.ts"() {
+    "use strict";
+    init_zod();
+    defaultWarn2 = (warning) => {
+      console.warn("[import-langgraph] schema lookup fallback", warning);
+    };
+    assistantSchema = external_exports.object({
+      output_schema: external_exports.object({
+        properties: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+      }).loose().nullish()
+    }).loose();
+    createAssistantSchemaCache = () => /* @__PURE__ */ new Map();
+    hasRecoverableState = (values) => {
+      if (values === void 0 || values === null)
+        return false;
+      if (typeof values !== "object")
+        return true;
+      return Object.keys(values).length > 0;
+    };
+    readAssistantSchemas = async (assistants, assistantId, cache3, onLookupFailure) => {
+      if (cache3.has(assistantId))
+        return cache3.get(assistantId);
+      try {
+        const schemas = await assistants.getSchemas(assistantId);
+        cache3.set(assistantId, schemas);
+        return schemas;
+      } catch {
+        onLookupFailure();
+        return { output_schema: { properties: { messages: {}, tools: {} } } };
+      }
+    };
+    readStateSnapshot = async (client2, thread, checkpoints, assistantId, cache3, onWarn = defaultWarn2) => {
+      const values = checkpoints[0]?.values !== void 0 ? checkpoints[0].values : thread.values;
+      if (!hasRecoverableState(values))
+        return void 0;
+      const assistants = client2.assistants;
+      if (assistants === void 0)
+        return values;
+      const schemas = await readAssistantSchemas(
+        assistants,
+        assistantId,
+        cache3,
+        () => onWarn({
+          reason: "schema_lookup_fallback",
+          sourceThreadId: thread.thread_id,
+          assistantId,
+          detail: "State limited to messages and tools. After fixing schema access, re-import with --replace to recover graph-defined state."
+        })
+      );
+      if (schemas === void 0)
+        return values;
+      const schema2 = assistantSchema.safeParse(schemas);
+      const properties = schema2.success ? schema2.data.output_schema?.properties : void 0;
+      if (properties === void 0 || Object.keys(properties).length === 0 || typeof values !== "object" || values === null || Array.isArray(values)) {
+        return values;
+      }
+      const keys2 = /* @__PURE__ */ new Set(["messages", "tools", ...Object.keys(properties)]);
+      const projected = Object.fromEntries(
+        Object.entries(values).filter(([key]) => keys2.has(key))
+      );
+      return hasRecoverableState(projected) ? projected : void 0;
+    };
+  }
+});
+
+// libs/import-langgraph/src/interrupts.ts
+var headInterruptsSchema, readHeadInterrupts, readPendingInterrupts;
+var init_interrupts2 = __esm({
+  "libs/import-langgraph/src/interrupts.ts"() {
+    "use strict";
+    init_src6();
+    init_zod();
+    headInterruptsSchema = external_exports.object({ interrupts: external_exports.array(external_exports.unknown()).optional() }).loose();
+    readHeadInterrupts = (head) => {
+      const parsed = headInterruptsSchema.safeParse(head);
+      return parsed.success ? parsed.data.interrupts ?? [] : [];
+    };
+    readPendingInterrupts = (head, thread) => {
+      const fromTasks = (head?.tasks ?? []).flatMap(
+        (task) => task.interrupts ?? []
+      );
+      const fromHead = head === void 0 ? [] : readHeadInterrupts(head);
+      const fromThread = external_exports.record(external_exports.string(), external_exports.array(external_exports.unknown())).safeParse(thread?.interrupts);
+      const raw2 = fromTasks.length > 0 ? fromTasks : fromHead.length > 0 ? fromHead : fromThread.success ? Object.values(fromThread.data).flat() : [];
+      const seen = /* @__PURE__ */ new Set();
+      const result = [];
+      for (const candidate of raw2) {
+        const parsed = NormalizedPendingInterruptSchema.safeParse(candidate);
+        if (!parsed.success)
+          continue;
+        const interrupt = parsed.data;
+        if (interrupt.id !== void 0) {
+          if (seen.has(interrupt.id))
+            continue;
+          seen.add(interrupt.id);
+        }
+        result.push(interrupt);
+      }
+      return result;
+    };
+  }
+});
+
+// libs/import-langgraph/src/errors.ts
+var readTaskError, readRunErrors;
+var init_errors10 = __esm({
+  "libs/import-langgraph/src/errors.ts"() {
+    "use strict";
+    readTaskError = (checkpoint) => {
+      const errors = (checkpoint?.tasks ?? []).flatMap(
+        (task) => typeof task.error === "string" && task.error.trim() !== "" ? [task.error] : []
+      );
+      return errors.length > 0 ? [...new Set(errors)].join("\n") : void 0;
+    };
+    readRunErrors = (checkpoints) => {
+      const errors = /* @__PURE__ */ new Map();
+      for (const checkpoint of checkpoints) {
+        const runId = checkpoint.metadata?.["run_id"];
+        if (typeof runId === "string" && !errors.has(runId))
+          errors.set(runId, readTaskError(checkpoint));
+      }
+      return errors;
+    };
+  }
+});
+
 // libs/import-langgraph/src/user-source.ts
 var LANGGRAPH_AUTH_USER_ID_KEY, parseUserSource, readStringField, readValuesStringField, resolveEndUserId;
 var init_user_source = __esm({
@@ -376635,9 +377154,16 @@ async function* streamLangGraph(config3) {
   const client2 = await resolveClient(config3);
   const userSource = parseUserSource(config3.userSource);
   const pageSize = config3.pageSize ?? DEFAULT_THREAD_PAGE_SIZE;
+  const schemaCache = createAssistantSchemaCache();
   for await (const thread of enumerateThreads(client2, pageSize)) {
     try {
-      yield await extractThread(client2, thread, userSource);
+      yield await extractThread(
+        client2,
+        thread,
+        userSource,
+        schemaCache,
+        config3.onWarn
+      );
     } catch (error98) {
       yield {
         kind: "failed",
@@ -376659,11 +377185,14 @@ var init_extract2 = __esm({
     init_graph_id();
     init_runs2();
     init_state2();
+    init_state_snapshot();
+    init_interrupts2();
+    init_errors10();
     init_user_source();
     DEFAULT_THREAD_PAGE_SIZE = 50;
     FULL_HISTORY_LIMIT = 1e3;
-    synthesizeSingleRun = (threadId, messages, activityAt) => {
-      if (messages.length === 0) {
+    synthesizeSingleRun = (threadId, messages, activityAt, hasState = false) => {
+      if (messages.length === 0 && !hasState) {
         return null;
       }
       return {
@@ -376695,7 +377224,7 @@ var init_extract2 = __esm({
       const head = await client2.threads.getState(threadId);
       return [head];
     };
-    extractThread = async (client2, thread, userSource) => {
+    extractThread = async (client2, thread, userSource, schemaCache, onWarn) => {
       const threadId = thread.thread_id;
       const checkpoints = await readCheckpoints(client2, threadId);
       const graphResolution = resolveGraphId(thread, checkpoints);
@@ -376713,9 +377242,27 @@ var init_extract2 = __esm({
       }
       const messages = readMessages(thread, checkpoints);
       const lastActivityAt = readLastActivityAt(thread, checkpoints);
-      const rawRuns = await client2.runs.list(threadId, { limit: FULL_HISTORY_LIMIT });
+      const rawRuns = await client2.runs.list(threadId, {
+        limit: FULL_HISTORY_LIMIT
+      });
       const sortedRuns = sortRunsChronologically(rawRuns);
-      const synthetic = synthesizeSingleRun(threadId, messages, lastActivityAt);
+      const runErrors = readRunErrors(checkpoints);
+      const headError = readTaskError(checkpoints[0]);
+      const pendingInterrupts = readPendingInterrupts(checkpoints[0], thread);
+      const stateSnapshot = await readStateSnapshot(
+        client2,
+        thread,
+        checkpoints,
+        sortedRuns.at(-1)?.assistant_id ?? graphResolution.graphId,
+        schemaCache,
+        onWarn
+      );
+      const synthetic = synthesizeSingleRun(
+        threadId,
+        messages,
+        lastActivityAt,
+        stateSnapshot !== void 0 || pendingInterrupts.length > 0 || headError !== void 0
+      );
       const runs = sortedRuns.length === 0 && synthetic !== null ? [synthetic] : sortedRuns;
       const spans = partitionMessagesByRun(messages, runs);
       const normalizedRuns = [];
@@ -376723,7 +377270,13 @@ var init_extract2 = __esm({
       for (const span of spans) {
         const slice = messages.slice(cursor, cursor + span.messageCount);
         cursor += span.messageCount;
-        normalizedRuns.push(normalizeRun(span, slice));
+        const normalized = normalizeRun(span, slice);
+        const recordedError = sortedRuns.length === 0 ? headError : runErrors.get(normalized.sourceRunId);
+        if (sortedRuns.length === 0 && recordedError !== void 0)
+          normalized.status = "error";
+        if (normalized.status === "error" && recordedError !== void 0)
+          normalized.errorMessage = recordedError;
+        normalizedRuns.push(normalized);
       }
       const endUserId = resolveEndUserId(userSource, thread, checkpoints);
       const conversation = {
@@ -376732,6 +377285,8 @@ var init_extract2 = __esm({
         sourceBackend: "server",
         endUserId,
         ...lastActivityAt !== void 0 ? { lastActivityAt } : {},
+        ...stateSnapshot !== void 0 ? { stateSnapshot } : {},
+        ...pendingInterrupts.length > 0 ? { pendingInterrupts } : {},
         runs: normalizedRuns
       };
       return {
@@ -379045,7 +379600,7 @@ function createSlackIngressUrl(input) {
   return new URL(input.path, ingressBaseUrl).toString();
 }
 function createSlackAppDisplayName(channelDisplayName) {
-  return [...channelDisplayName].slice(0, 35).join("");
+  return [...channelDisplayName].slice(0, SLACK_APP_NAME_MAX_LENGTH).join("");
 }
 function normalizeSlackIdentity(value) {
   return value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 80).replace(/-+$/gu, "");
@@ -379058,6 +379613,48 @@ function createSlackBotDisplayName(channelDisplayName, fallbackName = DEFAULT_SL
   const safeFallback = normalizeSlackIdentity(fallbackName);
   return safeFallback && !RESERVED_SLACK_IDENTITIES.has(safeFallback) ? safeFallback : DEFAULT_SLACK_IDENTITY;
 }
+function reservedWordIn(candidate) {
+  const folded = candidate.normalize("NFKD").toLowerCase();
+  return SLACK_RESERVED_NAME_WORDS.find(
+    (word) => folded.includes(word.toLowerCase())
+  );
+}
+function suggestSlackDisplayName(channelName) {
+  const words = channelName.normalize("NFKD").toLowerCase().split(/[^a-z0-9]+/u).filter((word) => word.length > 0 && reservedWordIn(word) === void 0).map((word) => `${word.slice(0, 1).toUpperCase()}${word.slice(1)}`);
+  const suggestion = [...words.join(" ")].slice(0, SLACK_APP_NAME_MAX_LENGTH).join("").trim();
+  return suggestion.length > 0 ? suggestion : DEFAULT_SLACK_APP_NAME;
+}
+function validateSlackDisplayName(input) {
+  const appName = input.channelDisplayName.trim();
+  const suggestion = suggestSlackDisplayName(input.channelName);
+  if (appName.length === 0) {
+    return {
+      message: `A Slack app needs a name: Slack rejects a manifest whose display_information.name is empty. Pass --display-name, for example "${suggestion}".`,
+      status: "invalid",
+      suggestion,
+      violation: "empty"
+    };
+  }
+  const length = [...appName].length;
+  if (length > SLACK_APP_NAME_MAX_LENGTH) {
+    return {
+      message: `A Slack app name may be at most ${SLACK_APP_NAME_MAX_LENGTH} characters, and "${appName}" is ${length}. Pass a shorter --display-name, for example "${suggestion}".`,
+      status: "invalid",
+      suggestion,
+      violation: "too_long"
+    };
+  }
+  const reserved = reservedWordIn(appName) ?? reservedWordIn(createSlackBotDisplayName(appName, input.channelName));
+  if (reserved !== void 0) {
+    return {
+      message: `A Slack app name and bot display name may not contain "${reserved}"; Slack refuses to create the app. Pass a different --display-name, for example "${suggestion}".`,
+      status: "invalid",
+      suggestion,
+      violation: "reserved_word"
+    };
+  }
+  return { status: "ok" };
+}
 function createSlackInviteCommand(channelDisplayName, fallbackName) {
   return `/invite @${createSlackBotDisplayName(
     channelDisplayName,
@@ -379116,12 +379713,13 @@ function createSlackManifestInstallUrl(manifest) {
   url4.searchParams.set("manifest_yaml", manifest);
   return url4.toString();
 }
-var SLACK_EVENTS_INGRESS_PATH, SLACK_INTERACTIVITY_INGRESS_PATH, DEFAULT_SLACK_IDENTITY, RESERVED_SLACK_IDENTITIES, REQUIRED_SLACK_BOT_SCOPES, REQUIRED_SLACK_BOT_SCOPE_COUNT, SLACK_PREINSTALL_GRANTED_SCOPES, SLACK_PREINSTALL_SCOPE_COUNT;
+var SLACK_EVENTS_INGRESS_PATH, SLACK_INTERACTIVITY_INGRESS_PATH, SLACK_APP_NAME_MAX_LENGTH, DEFAULT_SLACK_IDENTITY, RESERVED_SLACK_IDENTITIES, SLACK_RESERVED_NAME_WORDS, DEFAULT_SLACK_APP_NAME, REQUIRED_SLACK_BOT_SCOPES, REQUIRED_SLACK_BOT_SCOPE_COUNT, SLACK_PREINSTALL_GRANTED_SCOPES, SLACK_PREINSTALL_SCOPE_COUNT;
 var init_slack = __esm({
   "libs/channels-setup/src/slack.ts"() {
     "use strict";
     SLACK_EVENTS_INGRESS_PATH = "/api/channels/adapters/slack/events";
     SLACK_INTERACTIVITY_INGRESS_PATH = "/api/channels/adapters/slack/interactivity";
+    SLACK_APP_NAME_MAX_LENGTH = 35;
     DEFAULT_SLACK_IDENTITY = "intelligence-agent";
     RESERVED_SLACK_IDENTITIES = /* @__PURE__ */ new Set([
       "channel",
@@ -379129,6 +379727,8 @@ var init_slack = __esm({
       "here",
       "slackbot"
     ]);
+    SLACK_RESERVED_NAME_WORDS = Object.freeze(["Slack"]);
+    DEFAULT_SLACK_APP_NAME = "Intelligence Agent";
     REQUIRED_SLACK_BOT_SCOPES = Object.freeze([
       "app_mentions:read",
       "assistant:write",
@@ -380897,9 +381497,26 @@ function delay2(ms) {
     setTimeout(resolve9, ms);
   });
 }
-function runInstallOnce(cwd2, command2) {
+function formatTimeoutTail(command2, timeoutMs) {
+  return `\`${command2}\` stopped responding after ${timeoutMs} ms and was stopped. Check the network and the npm registry configuration, then run it by hand.`;
+}
+function runInstallOnce(cwd2, command2, timeoutMs) {
   return new Promise((resolve9) => {
-    const child = spawn4(command2, { cwd: cwd2, shell: true, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn4(command2, {
+      cwd: cwd2,
+      shell: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      ...OWN_PROCESS_GROUP
+    });
+    let timedOut = false;
+    const timeout = armChildTimeout(
+      child,
+      timeoutMs,
+      () => {
+        timedOut = true;
+      },
+      { ownsProcessGroup: true }
+    );
     const stdoutDecoder = new StringDecoder("utf8");
     const stderrDecoder = new StringDecoder("utf8");
     let stdout = "";
@@ -380917,22 +381534,26 @@ function runInstallOnce(cwd2, command2) {
       }
     });
     child.once("error", (error98) => {
+      timeout.cancel();
       resolve9({
         ok: false,
         code: null,
         stdoutTail: "",
         stderrTail: "",
-        spawnError: error98.message
+        spawnError: error98.message,
+        timedOut
       });
     });
     child.once("close", (code) => {
+      timeout.cancel();
       stdout += stdoutDecoder.end();
       stderr += stderrDecoder.end();
       resolve9({
         ok: code === 0,
         code,
         stdoutTail: stdout.slice(-STDOUT_TAIL_LIMIT).trim(),
-        stderrTail: stderr.slice(-STDERR_TAIL_LIMIT).trim()
+        stderrTail: stderr.slice(-STDERR_TAIL_LIMIT).trim(),
+        timedOut
       });
     });
   });
@@ -380941,14 +381562,15 @@ async function installDependencies({
   cwd: cwd2,
   command: command2,
   log,
-  retryDelayMs = DEFAULT_RETRY_DELAY_MS
+  retryDelayMs = DEFAULT_RETRY_DELAY_MS,
+  timeoutMs = DEFAULT_INSTALL_TIMEOUT_MS
 }) {
   let lastAttempt;
   for (let attempt = 1; attempt <= INSTALL_MAX_ATTEMPTS; attempt += 1) {
     if (attempt > 1 && retryDelayMs > 0) {
       await delay2(retryDelayMs);
     }
-    lastAttempt = await runInstallOnce(cwd2, command2);
+    lastAttempt = await runInstallOnce(cwd2, command2, timeoutMs);
     if (lastAttempt.ok) {
       if (attempt > 1) {
         log?.("info", {
@@ -380960,6 +381582,18 @@ async function installDependencies({
       }
       return { ok: true };
     }
+    if (lastAttempt.timedOut) {
+      log?.("error", {
+        event: "install_timed_out",
+        command: command2,
+        cwd: cwd2,
+        attempt,
+        timeoutMs,
+        stdoutTail: lastAttempt.stdoutTail,
+        stderrTail: lastAttempt.stderrTail
+      });
+      return { ok: false, stderrTail: formatTimeoutTail(command2, timeoutMs) };
+    }
     log?.("error", {
       event: "install_failed",
       command: command2,
@@ -380977,14 +381611,16 @@ async function installDependencies({
     stderrTail: lastAttempt?.spawnError ?? lastAttempt?.stderrTail ?? "install failed"
   };
 }
-var STDERR_TAIL_LIMIT, STDOUT_TAIL_LIMIT, INSTALL_MAX_ATTEMPTS, DEFAULT_RETRY_DELAY_MS;
+var STDERR_TAIL_LIMIT, STDOUT_TAIL_LIMIT, INSTALL_MAX_ATTEMPTS, DEFAULT_RETRY_DELAY_MS, DEFAULT_INSTALL_TIMEOUT_MS;
 var init_install_dependencies = __esm({
   "apps/cli/src/services/install-dependencies.ts"() {
     "use strict";
+    init_child_timeout();
     STDERR_TAIL_LIMIT = 2e3;
     STDOUT_TAIL_LIMIT = 4e3;
     INSTALL_MAX_ATTEMPTS = 2;
     DEFAULT_RETRY_DELAY_MS = 1e3;
+    DEFAULT_INSTALL_TIMEOUT_MS = 10 * 6e4;
   }
 });
 
@@ -382182,7 +382818,35 @@ var init_channels_state = __esm({
 });
 
 // apps/cli/src/services/channels-flow.ts
+function slackDisplayNameRefusal(adapter2, channelName, displayName) {
+  if (adapter2 !== "slack") {
+    return void 0;
+  }
+  const validated = validateSlackDisplayName({
+    channelDisplayName: displayName,
+    channelName
+  });
+  if (validated.status === "ok") {
+    return void 0;
+  }
+  return {
+    code: CHANNELS_FLOW_CODES.slackDisplayNameInvalid,
+    message: validated.message,
+    status: "failed"
+  };
+}
 function resolveIdentity(input) {
+  const resolved = resolveChannelIdentity(input);
+  if (resolved.status === "failed") {
+    return resolved;
+  }
+  return slackDisplayNameRefusal(
+    input.adapter,
+    resolved.name,
+    resolved.displayName
+  ) ?? resolved;
+}
+function resolveChannelIdentity(input) {
   if (input.channelName !== void 0) {
     const validated = validateChannelName(input.channelName);
     if (validated.status === "invalid") {
@@ -382263,6 +382927,22 @@ async function runChannelsAdd(input, deps) {
     );
     const wasDeclared = alreadyDeclared?.providers[adapter2] !== void 0;
     const effectiveDisplayName = input.displayName ?? alreadyDeclared?.displayName ?? displayName;
+    const declaredRefusal = slackDisplayNameRefusal(
+      adapter2,
+      name,
+      effectiveDisplayName
+    );
+    if (declaredRefusal !== void 0) {
+      return failedEnvelope({
+        channels: [],
+        command: command2,
+        diagnostics,
+        error: {
+          code: declaredRefusal.code,
+          message: declaredRefusal.message
+        }
+      });
+    }
     let config3 = configRead.config;
     if (!wasDeclared) {
       config3 = declareChannel(config3, {
@@ -382549,6 +383229,7 @@ var init_channels_flow = __esm({
       nameMissing: "CLI_CHANNELS_NAME_MISSING",
       nameUndecidable: "CLI_CHANNELS_NAME_UNDECIDABLE",
       notDeclared: "CLI_CHANNELS_NOT_DECLARED",
+      slackDisplayNameInvalid: "CLI_CHANNELS_SLACK_DISPLAY_NAME_INVALID",
       stalled: "CLI_CHANNELS_RECONCILE_STALLED"
     });
     MAX_RECONCILE_STEPS = 8;
@@ -385081,6 +385762,8 @@ var init_onboarding_checkpoint = __esm({
   "apps/cli/src/services/onboarding-checkpoint.ts"() {
     "use strict";
     CHECKPOINT_PHASES = [
+      "research-dispatched",
+      "surface-probed",
       "research-returned",
       "starter-cloned",
       "plan-written",
@@ -385104,6 +385787,17 @@ function resolveAgentFrameworkAlias(value) {
     return void 0;
   return ONBOARDING_AGENT_FRAMEWORK_ALIASES[value] ?? value;
 }
+function terminalReasonForRoute(route) {
+  for (let index2 = route.length - 1; index2 >= 0; index2 -= 1) {
+    const node = route[index2];
+    if (node === void 0)
+      continue;
+    if (Object.prototype.hasOwnProperty.call(TERMINAL_NODES, node))
+      continue;
+    return STAGE_BY_NODE[node] ?? STAGE_BY_DIRECTORY[node.split("/")[0] ?? ""] ?? "other";
+  }
+  return void 0;
+}
 function unprovenBaselineRefusal(startingState, route, proof) {
   if (startingState !== "both-oss" && startingState !== "both-copilotkit-unproved") {
     return void 0;
@@ -385150,7 +385844,7 @@ function requireOnboardingChoice(flag, value, choices) {
   }
   return selected;
 }
-var ONBOARDING_STARTING_STATES, ONBOARDING_AGENT_FRAMEWORKS, ONBOARDING_AGENT_FRAMEWORK_ALIASES, ONBOARDING_FRONTENDS, ONBOARDING_PROOF_STEPS, ONBOARDING_PROOF_OUTCOMES, ABSENCE_STATES, OSS_BASELINE_NODE, TERMINAL_NODES, REPOSITORY_RESEARCH_NODE;
+var ONBOARDING_STARTING_STATES, ONBOARDING_AGENT_FRAMEWORKS, ONBOARDING_AGENT_FRAMEWORK_ALIASES, ONBOARDING_FRONTENDS, ONBOARDING_PROOF_STEPS, ONBOARDING_PROOF_OUTCOMES, ABSENCE_STATES, OSS_BASELINE_NODE, TERMINAL_NODES, STAGE_BY_DIRECTORY, STAGE_BY_NODE, REPOSITORY_RESEARCH_NODE;
 var init_onboarding_classification = __esm({
   "apps/cli/src/services/onboarding-classification.ts"() {
     "use strict";
@@ -385227,6 +385921,25 @@ var init_onboarding_classification = __esm({
       "stopped/run-failed": "run-failed",
       "unsupported/no-validated-path": "unsupported"
     };
+    STAGE_BY_DIRECTORY = {
+      authenticate: "authentication",
+      conversion: "plan",
+      credentials: "credentials",
+      feature: "feature",
+      framework: "journey",
+      frontend: "journey",
+      implementation: "implementation",
+      proof: "validation",
+      research: "research",
+      starter: "journey"
+    };
+    STAGE_BY_NODE = {
+      "subagent/create-plan": "plan",
+      "subagent/implement-and-validate": "implementation",
+      "subagent/inspect-repository": "research",
+      "subagent/prove-oss-baseline": "validation",
+      "subagent/prove-round-trip": "validation"
+    };
     REPOSITORY_RESEARCH_NODE = "subagent/inspect-repository";
   }
 });
@@ -385334,7 +386047,7 @@ var init_onboarding_resume = __esm({
 
 // apps/cli/src/services/onboarding-protected-paths.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { existsSync as existsSync21, readFileSync as readFileSync22, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
 import { isAbsolute, join as join28, relative as relative3, resolve as resolve7, sep as sep3 } from "node:path";
 function deriveProjectFiles(root2) {
@@ -385465,7 +386178,7 @@ function digestOf(root2, relativePath) {
     if (!existsSync21(absolute))
       return {};
     return {
-      digest: createHash7("sha256").update(readFileSync22(absolute)).digest("hex")
+      digest: createHash8("sha256").update(readFileSync22(absolute)).digest("hex")
     };
   } catch {
     return "unreadable";
@@ -385548,6 +386261,12 @@ function captureEntry(root2, relativePath, derived) {
 }
 function captureProtectedPaths(dependencies, input) {
   const root2 = resolveAnchoredRoot(dependencies);
+  const enclosingRepository = findRepositoryRoot(
+    resolveOnboardingRepositoryRoot(dependencies.cwd)
+  );
+  if (enclosingRepository !== void 0 && enclosingRepository !== root2) {
+    return { status: "blocked", reason: "root-outside-project", detail: root2 };
+  }
   const stored = readManifest(dependencies);
   const ownBaseline = stored !== void 0 && stored !== "malformed" && stored.runId === input.runId ? stored : void 0;
   const derive = ownBaseline === void 0;
@@ -386134,6 +386853,80 @@ function authorizeProtectedPathChange(dependencies, input) {
     authorized: byPath(authorized)
   };
 }
+function commitsAfterCapture(root2, capturedAt) {
+  const since = capturedAt.replace(/\.\d+Z$/, "Z");
+  let output;
+  try {
+    output = execFileSync5(
+      "git",
+      ["log", `--since=${since}`, "--name-only", "--format=%H"],
+      { cwd: root2, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
+    );
+  } catch {
+    return "failed";
+  }
+  const lines = output.split("\n").filter((line) => line.length > 0);
+  if (lines.length === 0)
+    return "none";
+  return lines.filter((line) => !/^[0-9a-f]{40}$/.test(line));
+}
+function readProjectChanges(dependencies, input) {
+  const root2 = resolveAnchoredRoot(dependencies);
+  const stored = readManifest(dependencies);
+  if (stored === void 0) {
+    return { status: "blocked", reason: "no-baseline", detail: input.runId };
+  }
+  if (stored === "malformed") {
+    return {
+      status: "blocked",
+      reason: "unreadable-baseline",
+      detail: input.runId
+    };
+  }
+  if (stored.runId !== input.runId) {
+    return { status: "blocked", reason: "run-mismatch", detail: stored.runId };
+  }
+  const derived = deriveChangedPaths(root2);
+  if (derived === "failed") {
+    return { status: "blocked", reason: "git-failed", detail: root2 };
+  }
+  const current = derived === "no-repository" ? deriveProjectFiles(root2) : derived;
+  const baseline = new Map(
+    stored.entries.map((entry) => [entry.path, entry.digest])
+  );
+  const changed = [];
+  for (const relativePath of new Set(current)) {
+    if (isGraphOwned(relativePath))
+      continue;
+    const read = digestOf(root2, relativePath);
+    if (read === "unreadable") {
+      changed.push(relativePath);
+      continue;
+    }
+    const held = baseline.has(relativePath);
+    if (!held || baseline.get(relativePath) !== read.digest) {
+      changed.push(relativePath);
+    }
+  }
+  const ordered = [...changed].sort(
+    (left, right) => left < right ? -1 : left > right ? 1 : 0
+  );
+  if (ordered.length > 0 || derived === "no-repository") {
+    return { status: "passed", runId: input.runId, changed: ordered };
+  }
+  const committed = commitsAfterCapture(root2, stored.capturedAt);
+  if (committed === "failed" || committed === "none") {
+    return { status: "passed", runId: input.runId, changed: ordered };
+  }
+  return {
+    status: "passed",
+    runId: input.runId,
+    changed: [...new Set(committed)].sort(
+      (left, right) => left < right ? -1 : left > right ? 1 : 0
+    ),
+    committedAfterCapture: true
+  };
+}
 var SKIPPED_DIRECTORIES3, GRAPH_OWNED_SUFFIXES;
 var init_onboarding_protected_paths = __esm({
   "apps/cli/src/services/onboarding-protected-paths.ts"() {
@@ -387068,7 +387861,7 @@ async function runOnboard(argv, dependencies) {
         ...onboardingIntentProperties(deps),
         onboarding_run_id: runId2,
         cli_version: deps.cliVersion,
-        coding_agent: normalizeCodingAgent(parsed.codingAgent)
+        ...codingAgentProperty(parsed.codingAgent)
       }
     });
     deps.stdout.write(`Coding agent recorded for run ${runId2}.
@@ -387143,6 +387936,11 @@ async function runOnboard(argv, dependencies) {
     const check4 = parseSurfaceCheck(blocked2.rest);
     if (check4 === void 0)
       throw new Error(SURFACE_CHECK_USAGE);
+    const unchanged = unchangedProjectRefusal(deps, runId);
+    if (unchanged !== void 0) {
+      deps.stdout.write(unchanged);
+      return;
+    }
     const accepted = readAcceptedDriftBestEffort(deps, runId);
     const authorized = readAuthorizationsBestEffort(deps, runId);
     const removed = readRemovedPathsBestEffort(deps, runId);
@@ -387476,6 +388274,12 @@ Onboarding protects the developer\u2019s own tree and captures nothing beyond it
       "git-failed": `\`git status\` failed in ${result.detail}, so the protected set could not be
 derived. Nothing was captured: an empty baseline would read as "nothing here
 needs protecting", which is the opposite of what just happened.
+`,
+      "root-outside-project": `This run is anchored at ${result.detail}, above the repository this command
+ran in. Nothing was captured: a baseline derived up there reads every file
+below it, including repositories this run has no business in.
+Run \`copilotkit onboard start --run <id>\` here to give this project a run of
+its own, or run this step from the directory the run started in.
 `
     }[result.reason];
     return `Status: blocked
@@ -388075,10 +388879,11 @@ function reportingRefusal(dependencies, runId, code, extra, read) {
     throw error98;
   }
 }
-function recordTerminalWhenReached(dependencies, runId, promptName) {
+function recordTerminalWhenReached(dependencies, runId, promptName, routeBefore) {
   const terminal = TERMINAL_NODES[promptName];
   if (terminal === void 0)
     return;
+  const reason = terminalReasonForRoute(routeBefore);
   markRunEndedBestEffort(dependencies, runId);
   recordBestEffort(dependencies, {
     event: "cli.onboarding.terminal_reached",
@@ -388088,6 +388893,10 @@ function recordTerminalWhenReached(dependencies, runId, promptName) {
       onboarding_run_id: runId,
       cli_version: dependencies.cliVersion,
       terminal,
+      // Omitted rather than sent as `other` when the route names no earlier
+      // step: a route that could not be read has not said the reason is
+      // unknown, it has said nothing at all.
+      ...reason === void 0 ? {} : { terminal_reason: reason },
       ...detectionProperties(dependencies)
     }
   });
@@ -388506,6 +389315,42 @@ function readAuthorizationsBestEffort(dependencies, runId) {
     return [];
   }
 }
+function unchangedProjectRefusal(dependencies, runId) {
+  let changes;
+  try {
+    changes = readProjectChanges(
+      { cwd: dependencies.cwd, store: dependencies.store },
+      { runId }
+    );
+  } catch {
+    return void 0;
+  }
+  if (changes.status === "blocked")
+    return void 0;
+  if (changes.committedAfterCapture === true)
+    return void 0;
+  if (changes.changed.length > 0)
+    return void 0;
+  return [
+    "Status: blocked",
+    "no-changes-in-project",
+    "This project holds no change since its protected baseline was captured: no",
+    "tracked file was modified, and nothing new was added beyond the files this",
+    "graph writes itself, `.env` and `.copilotkit/project.json`. Ignored files do",
+    "not count as work.",
+    "",
+    "A run that built something and left this tree untouched built it somewhere",
+    "else. The usual cause is an implementation subagent that worked in its own",
+    "git worktree, a branch checkout, or a copy of the project, and reported back",
+    "without bringing the changes here. This is not a preservation failure: no",
+    "protected path was changed, and none had to be.",
+    "",
+    "Bring those changes into this project, then run `onboard audit` and this",
+    "command again. Onboarding is not complete until they are here: the developer",
+    "is left with the project in front of them, not the one the work was done in.",
+    ""
+  ].join("\n");
+}
 function readAcceptedDriftBestEffort(dependencies, runId) {
   try {
     return readAcceptedDrift(
@@ -388528,7 +389373,7 @@ function recordStarted(dependencies, runId, origin, idOrigin, codingAgent) {
       ...onboardingIntentProperties(dependencies),
       onboarding_run_id: runId,
       cli_version: dependencies.cliVersion,
-      coding_agent: normalizeCodingAgent(codingAgent),
+      ...codingAgentProperty(codingAgent),
       started_by: origin,
       run_id_origin: idOrigin
     }
@@ -388568,7 +389413,7 @@ function writePrompt(dependencies, runId, prompt) {
 `);
   }
   recordRouteBestEffort(dependencies, runId, prompt.name);
-  recordTerminalWhenReached(dependencies, runId, prompt.name);
+  recordTerminalWhenReached(dependencies, runId, prompt.name, routeBefore);
   const routeAfter = readRouteBestEffort(dependencies);
   recordBestEffort(dependencies, {
     event: "cli.onboarding.prompt_served",
@@ -391737,6 +392582,42 @@ var init_kite = __esm({
   }
 });
 
+// apps/cli/src/node-version.ts
+var MINIMUM_NODE_VERSION = "20.9.0";
+function readVersionParts(version6) {
+  const match2 = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version6.trim());
+  if (match2 === null)
+    return void 0;
+  return [Number(match2[1]), Number(match2[2]), Number(match2[3])];
+}
+function meetsMinimumNodeVersion(running, minimum = MINIMUM_NODE_VERSION) {
+  const current = readVersionParts(running);
+  const floor = readVersionParts(minimum);
+  if (current === void 0 || floor === void 0)
+    return true;
+  for (let index2 = 0; index2 < current.length; index2 += 1) {
+    if (current[index2] !== floor[index2])
+      return current[index2] > floor[index2];
+  }
+  return true;
+}
+function formatUnsupportedNodeMessage(running, minimum = MINIMUM_NODE_VERSION) {
+  return `copilotkit needs Node.js ${minimum} or later.
+This machine is running Node.js ${running}.
+
+Upgrade Node.js, then run the command again. A version manager installs a
+newer one beside the current one:
+
+  nvm install 22
+`;
+}
+
+// apps/cli/src/node-version-gate.ts
+if (!meetsMinimumNodeVersion(process.versions.node)) {
+  process.stderr.write(formatUnsupportedNodeMessage(process.versions.node));
+  process.exit(1);
+}
+
 // apps/cli/src/index.ts
 init_event_properties();
 init_types();
@@ -392098,11 +392979,18 @@ records their answer with --unplanned, which marks the consent as taken outside
 the plan wherever it is printed. The flag is refused before the plan is
 reported, so it can never stand in for the plan's own approval.
 
+Complete refuses a run whose project holds no change since that baseline was
+captured, and prints Status: blocked with no-changes-in-project. The files
+onboarding writes itself do not count, and neither do ignored files. Work done
+in another worktree, a branch checkout, or a copy of the project leaves the
+developer nothing, so bring the changes into this project, then run audit and
+complete again.
+
 Checkpoint reports progress from inside a step, where the graph would
 otherwise say nothing between one prompt and the next. --phase takes one of:
-research-returned, starter-cloned, plan-written, container-surveyed,
-container-settled, build-validated, journey-attempted, repair-attempted,
-delegation-unavailable. Pass --attempt <1-9>
+research-dispatched, surface-probed, research-returned, starter-cloned,
+plan-written, container-surveyed, container-settled, build-validated,
+journey-attempted, repair-attempted, delegation-unavailable. Pass --attempt <1-9>
 where the step loops, so a repair cycle can be counted.
 A refused checkpoint exits zero and prints the closed set. It is called from
 the middle of the longest step of a run, and a non-zero exit there reads as a
@@ -394588,14 +395476,17 @@ async function main(rawArgv = process.argv.slice(2)) {
   const helpText = helpTopic === null ? null : helpTextForTopic(helpTopic);
   const command2 = argv[0];
   if (helpText !== null) {
+    const helpBase = {
+      command: "help",
+      subcommand: helpTopic ?? "unknown"
+    };
     recordTelemetryEvent({
-      properties: {
-        command: "help",
-        outcome: "started",
-        subcommand: helpTopic ?? "unknown"
-      }
+      properties: { ...helpBase, outcome: "started" }
     });
     process.stdout.write(helpText);
+    recordTelemetryEvent({
+      properties: { ...helpBase, outcome: "succeeded" }
+    });
     return;
   }
   await applyGlobalArgs(globalArgs);
@@ -394651,6 +395542,7 @@ function installSignalHandlers() {
       shuttingDown = true;
       const safety = setTimeout(() => process.exit(130), 2e3);
       safety.unref();
+      recordAbandonedInvocation();
       const reraise = () => {
         process.kill(process.pid, signal);
       };