dorkos 0.125.2 → 0.125.4

package/dist/bin/cli.js

@@ -26826,7 +26826,7 @@ import path2 from "path";
 import { fileURLToPath } from "url";
 function resolveVersion() {
   if (env2.DORKOS_VERSION_OVERRIDE) return env2.DORKOS_VERSION_OVERRIDE;
-  if (true) return "0.125.2";
+  if (true) return "0.125.4";
   const pkgPath = path2.join(path2.dirname(fileURLToPath(import.meta.url)), "../../package.json");
   return JSON.parse(readFileSync(pkgPath, "utf-8")).version;
 }
@@ -36442,12 +36442,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name2}"`);
       return f3;
     };
-    function addFormats(ajv, list, fs40, exportName) {
+    function addFormats(ajv, list, fs41, exportName) {
       var _a7;
       var _b;
       (_a7 = (_b = ajv.opts.code).formats) !== null && _a7 !== void 0 ? _a7 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f3 of list)
-        ajv.addFormat(f3, fs40[f3]);
+        ajv.addFormat(f3, fs41[f3]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -43902,7 +43902,11 @@ var init_env2 = __esm({
       GH_CONFIG_DIR: external_exports.string().optional(),
       LOCALAPPDATA: external_exports.string().optional(),
       PROGRAMFILES: external_exports.string().optional(),
-      "PROGRAMFILES(X86)": external_exports.string().optional()
+      "PROGRAMFILES(X86)": external_exports.string().optional(),
+      // The Cloud address the server is pointed at, so `dorkos browser` keeps the
+      // same Cloud origin out of saved sign-ins (lib/agent-browser/storage-state.ts).
+      DORKOS_CLOUD_URL: external_exports.string().optional(),
+      DORKOS_CLOUD_API_URL: external_exports.string().optional()
     });
     env4 = cliEnvSchema.parse(process.env);
   }
@@ -49540,7 +49544,6 @@ function parseSkillFile(filePath, content, schema3, options) {
 }
 var init_parser = __esm({
   "../skills/src/parser.ts"() {
-    "use strict";
     init_constants7();
     init_frontmatter();
   }
@@ -52606,6 +52609,7 @@ function foldLegacyPermissionFields(raw) {
 var AgentRuntimeSchema, AgentHealthStatusSchema, ResponseModeSchema, AgentBehaviorSchema, McpServerAuthKindSchema, McpServerTransportSchema, ManagedMcpServerSchema, McpServerAuthStatusSchema, McpClientOriginSchema, ManagedMcpServerViewSchema, TraitsSchema, ConventionsSchema, AgentModelSchema, AgentEffortSchema, AgentWorkspaceBindingSchema, WORKSPACE_BINDING_OPENAPI, UNREADABLE_BINDING_FALLBACK, AgentManifestSchema2, LEGACY_GROUP_AREAS, AgentManifestFileSchema, AgentPathEntrySchema, AgentHintsSchema, DiscoveryCandidateSchema, DenialRecordSchema, AGENT_PAUSED_CODE, AGENT_PAUSE_REASON_MAX, AgentPauseSchema, AgentPauseListSchema, AgentPauseRequestSchema, AgentPauseResultSchema, TopologyAgentSchema, NamespaceInfoSchema, OPEN_MESH_NAMESPACE, CrossNamespaceRuleSchema, TopologyViewSchema, DiscoverRequestSchema, RegisterAgentRequestSchema, DenyRequestSchema, UpdateAgentRequestSchema, UpdateAgentConventionsSchema, WILDCARD_NAMESPACE_BOTH_SIDES_MESSAGE, UpdateAccessRuleRequestSchema, ResolveAgentsRequestSchema, ResolveAgentsResponseSchema, CreateAgentOptionsSchema, CreateAgentRequestSchema, AgentListQuerySchema, AgentHealthSchema, MeshStatusSchema, MeshInspectSchema, MeshLifecycleEventSchema, HeartbeatRequestSchema, ScanProgressSchema;
 var init_mesh_schemas = __esm({
   "../shared/src/mesh-schemas.ts"() {
+    "use strict";
     init_zod();
     init_zod_openapi();
     init_validation();
@@ -53997,6 +54001,8 @@ var init_account_usage = __esm({
     SEVEN_DAY_MS = 7 * 24 * HOUR_MS;
     MAX_FUTURE_SKEW_MS = 5 * MINUTE_MS;
     AccountUsageSchema = external_exports.object({
+      /** Last sign-in proof observed by this server; absence means not checked. */
+      signInState: external_exports.enum(["signed-in", "signed-out", "unknown"]).optional(),
       /** The runtime the account belongs to. */
       runtime: external_exports.enum(LEDGER_RUNTIMES),
       /**
@@ -54307,7 +54313,7 @@ function isSafeSigninUrl(value) {
   if (url2.protocol !== "http:") return false;
   return url2.hostname === "localhost" || url2.hostname === "127.0.0.1" || url2.hostname === "[::1]";
 }
-var PermissionModeSchema, PermissionModeIdSchema, PermissionStopSchema2, SessionTaskStatusSchema, StreamEventTypeSchema, QuestionOptionSchema, QuestionItemSchema, EffortLevelSchema, SessionOriginSchema, SessionLifecycleSchema, LimitPlanSchema, LimitStateSchema, SessionLimitSchema, ContinueAccountOptionSchema, ContinueOptionsResponseSchema, ContinueSessionRequestSchema, ContinueSessionResponseSchema, WaitForResetRequestSchema, LimitPlanResponseSchema, TrackerItemRefSchema, SessionStartedBySchema, SessionSchema, SessionUpdateResponseSchema, SessionSettingsSchema, StoredSessionSettingsResponseSchema, UpdateSessionRequestSchema, ForkSessionRequestSchema, ReloadPluginsResultSchema, SEED_CONTEXT_MAX_LENGTH, MessageDispositionSchema, DispositionDowngradeReasonSchema, MessageDeliveryOutcomeSchema, InterruptOutcomeSchema, InterruptReasonSchema, InterruptReceiptSchema, QueuedWaitingOnSchema, QueuedMessageSchema, SendMessageRequestSchema, SendMessageResponseSchema, SessionTriggerResponseSchema, SessionQueueResponseSchema, QueueMoveTargetSchema, UpdateQueuedMessageRequestSchema, UpdateQueuedMessageResponseSchema, DENY_REASON_MAX_LENGTH, ApprovalRequestSchema, BatchApprovalRequestSchema, SubmitAnswersRequestSchema, UI_ACTION_ID_MAX_LENGTH, UI_ACTION_TITLE_MAX_LENGTH, UI_ACTION_PAYLOAD_MAX_LENGTH, UiActionRequestSchema, McpAppPermissionSchema, McpAppResourceRequestSchema, McpAppResourceResponseSchema, ElicitationModeSchema, ElicitationActionSchema, SubmitElicitationRequestSchema, ListSessionsQuerySchema, SessionListWarningSchema, SessionListResponseSchema, RecentSessionsQuerySchema, RecentSessionsResponseSchema, SessionDailyCountsQuerySchema, SessionDailyCountsResponseSchema, CommandsQuerySchema, TextDeltaSchema, ThinkingDeltaSchema, ToolCallStatusSchema, McpAppRefSchema, ToolCallEventSchema, ToolProgressEventSchema, AlwaysAllowScopeSchema, ApprovalEventSchema, QuestionPromptEventSchema, PendingInteractionDTOSchema, ErrorCategorySchema, ErrorEventSchema, ApiRetryEventSchema, DoneEventSchema, TerminalReasonSchema, UsageStateSchema, UsageStatusSchema, SessionStatusEventSchema, ContextUsageCategorySchema, ContextUsageSchema, TaskItemSchema, TaskUpdateEventSchema, RelayReceiptEventSchema, MessageDeliveredEventSchema, RelayMessageEventSchema, BackgroundTaskTypeSchema, BackgroundTaskStatusSchema, BackgroundTaskStartedEventSchema, BackgroundTaskProgressEventSchema, BackgroundTaskDoneEventSchema, SubagentTextDeltaEventSchema, SystemStatusEventSchema, OperationKindSchema, OperationStateSchema, OperationProgressEventShapeSchema, OperationProgressEventSchema, MemoryEntrySchema, MemoryRecallEventSchema, agentCompactionShape, CompactBoundaryEventSchema, sessionImageShape, SessionImageEventSchema, deniedAgentShape, PermissionDeniedEventSchema, ModelSubstitutedEventSchema, PromptSuggestionEventSchema, HookStartedEventSchema, HookProgressEventSchema, HookResponseEventSchema, SdkSessionStateSchema, SessionStateChangedEventSchema, ElicitationPromptEventSchema, ElicitationCompleteEventSchema, InteractionCancelledEventSchema, CapabilityApprovalRequiredEventSchema, CapabilityApprovalResolvedEventSchema, SigninUrlSchema, MCP_SIGNIN_OUTCOMES, McpSigninOutcomeSchema, McpSigninRequiredEventSchema, McpSigninResolvedEventSchema, StreamEventSchema, TextPartSchema, HookStatusSchema, HookPartSchema, ToolApprovalOutcomeSchema, QuestionOutcomeSchema, ToolCallPartSchema, BackgroundTaskPartSchema, ThinkingPartSchema, ErrorPartSchema, ElicitationPartSchema, CapabilityApprovalPartSchema, McpSigninPartSchema, MemoryRecallPartSchema, PermissionDeniedPartSchema, ModelSubstitutedPartSchema, CompactBoundaryPartSchema, ImagePartSchema, MessagePartSchema, MessageTypeSchema, HistoryToolCallSchema, CompactMetadataSchema, HistoryMessageSchema, HistoryReadSchema, CommandEntrySchema, CommandRegistrySchema, FileListQuerySchema, RawFileQuerySchema, FileListResponseSchema, FileEntrySchema, FileTreeQuerySchema, FileTreeResponseSchema, FileContentQuerySchema, FileContentResponseSchema, CreateEntryRequestSchema, CreateEntryResponseSchema, DeleteEntryQuerySchema, RenameEntryRequestSchema, CopyEntryRequestSchema, RevealEntryRequestSchema, DiffBaselineOriginSchema, DiffBaselineQuerySchema, DiffBaselineResponseSchema, AdvanceDiffBaselineRequestSchema, DiffPendingQuerySchema, DiffPendingResponseSchema, DiffBaselineRawQuerySchema, RevertDiffBaselineRequestSchema, FileMutationResponseSchema, WorkbenchSignRequestSchema, WorkbenchSignResponseSchema, WorkbenchProbeRequestSchema, WorkbenchProbeResponseSchema, FRAME_SCRIPT_HTML_MAX_BYTES, FrameBridgeRefusalSchema, WorkbenchBridgeStatusRequestSchema, WorkbenchBridgeStatusResponseSchema, BrowseDirectoryQuerySchema, DirectoryEntrySchema, BrowseDirectoryResponseSchema, TunnelStatusSchema, LanAccessStatusSchema, RemoteAccessStateSchema, RemoteAccessAvailabilitySchema, RemoteAccessEnrolmentSchema, RemoteAccessReportSchema, HealthResponseSchema, ExecutionDefaultsSchema, ExperimentStateSchema, ServerConfigSchema2, ModelTierSchema, ModelOptionSchema, SubagentInfoSchema, GitStatusResponseSchema, GitStatusErrorSchema, ErrorResponseSchema, SessionLockedErrorSchema, TaskStatusSchema, SettableTaskStatusSchema, TaskNameSchema, TaskRunStatusSchema, TaskRunTriggerSchema, ScheduleOriginMarksSchema, TaskSchema, TaskRunSchema, CancelTaskRunResponseSchema, TaskTemplateSchema, TASK_DURATION_PATTERN, TASK_DURATION_MAX, TASK_DESCRIPTION_MAX, CreateTaskRequestSchema, SIDEBAR_TAB_ID_PATTERN, ShapeLiveLayoutCaptureSchema, ForkShapeRequestSchema, UpdateTaskRequestSchema, ListTaskRunsQuerySchema, ConfigPatchRequestSchema, ConfigPatchResponseSchema, UploadResultSchema, UploadResponseSchema, UploadProgressSchema, CanvasMediaSrcSchema, UiCanvasContentSchema, UiPanelIdSchema, UiToastLevelSchema, CELEBRATION_KINDS, CELEBRATION_KIND_SYNONYMS, CelebrationKindSchema, UiCommandTargetSchema, UiCommandSchema, UiCommandEventSchema, UiStateSchema, UiStateReportDocumentSchema, UiStateReportSchema, DevtoolsConsoleLevelSchema, DEVTOOLS_ARGS_MAX_CHARS, DevtoolsConsoleEntrySchema, DevtoolsNetworkEntrySchema, DEVTOOLS_CONSOLE_BATCH_MAX, DEVTOOLS_NETWORK_BATCH_MAX, DEVTOOLS_SCREENSHOT_MAX_CHARS, DevtoolsScreenshotResultSchema, DevtoolsIngestSchema, BrowserTargetSchema, BrowserActCommandSchema, BrowserPageSummarySchema, DEVTOOLS_OUTLINE_MAX_CHARS, DevtoolsActionResultSchema, DevtoolsRecordingUploadSchema, KeepAwakeUnsupportedReasonSchema, KeepAwakeStatusSchema;
+var PermissionModeSchema, PermissionModeIdSchema, PermissionStopSchema2, SessionTaskStatusSchema, StreamEventTypeSchema, QuestionOptionSchema, QuestionItemSchema, EffortLevelSchema, SessionOriginSchema, SessionLifecycleSchema, LimitPlanSchema, LimitStateSchema, SessionLimitSchema, ContinueAccountOptionSchema, ContinueOptionsResponseSchema, ContinueSessionRequestSchema, ContinueSessionResponseSchema, WaitForResetRequestSchema, LimitPlanResponseSchema, TrackerItemRefSchema, SessionStartedBySchema, SessionSchema, SessionUpdateResponseSchema, SessionSettingsSchema, StoredSessionSettingsResponseSchema, UpdateSessionRequestSchema, ForkSessionRequestSchema, ReloadPluginsResultSchema, SEED_CONTEXT_MAX_LENGTH, MessageDispositionSchema, DispositionDowngradeReasonSchema, MessageDeliveryOutcomeSchema, InterruptOutcomeSchema, InterruptReasonSchema, InterruptReceiptSchema, QueuedWaitingOnSchema, QueuedMessageSchema, SendMessageRequestSchema, SendMessageResponseSchema, SessionTriggerResponseSchema, SessionQueueResponseSchema, QueueMoveTargetSchema, UpdateQueuedMessageRequestSchema, UpdateQueuedMessageResponseSchema, DENY_REASON_MAX_LENGTH, ApprovalRequestSchema, BatchApprovalRequestSchema, SubmitAnswersRequestSchema, UI_ACTION_ID_MAX_LENGTH, UI_ACTION_TITLE_MAX_LENGTH, UI_ACTION_PAYLOAD_MAX_LENGTH, UiActionRequestSchema, McpAppPermissionSchema, McpAppResourceRequestSchema, McpAppResourceResponseSchema, ElicitationModeSchema, ElicitationActionSchema, SubmitElicitationRequestSchema, ListSessionsQuerySchema, SessionListWarningSchema, SessionListResponseSchema, RecentSessionsQuerySchema, RecentSessionsResponseSchema, SessionDailyCountsQuerySchema, SessionDailyCountsResponseSchema, CommandsQuerySchema, TextDeltaSchema, ThinkingDeltaSchema, ToolCallStatusSchema, McpAppRefSchema, ToolCallEventSchema, ToolProgressEventSchema, AlwaysAllowScopeSchema, ApprovalEventSchema, QuestionPromptEventSchema, PendingInteractionDTOSchema, ErrorCategorySchema, ErrorEventSchema, ApiRetryEventSchema, DoneEventSchema, TerminalReasonSchema, UsageStateSchema, UsageStatusSchema, SessionStatusEventSchema, ContextUsageCategorySchema, ContextUsageSchema, TaskItemSchema, TaskUpdateEventSchema, RelayReceiptEventSchema, MessageDeliveredEventSchema, RelayMessageEventSchema, BackgroundTaskTypeSchema, BackgroundTaskStatusSchema, BackgroundTaskStartedEventSchema, BackgroundTaskProgressEventSchema, BackgroundTaskDoneEventSchema, SubagentTextDeltaEventSchema, SystemStatusEventSchema, OperationKindSchema, OperationStateSchema, OperationProgressEventShapeSchema, OperationProgressEventSchema, MemoryEntrySchema, MemoryRecallEventSchema, agentCompactionShape, CompactBoundaryEventSchema, sessionImageShape, SessionImageEventSchema, deniedAgentShape, PermissionDeniedEventSchema, ModelSubstitutedEventSchema, PromptSuggestionEventSchema, HookStartedEventSchema, HookProgressEventSchema, HookResponseEventSchema, SdkSessionStateSchema, SessionStateChangedEventSchema, ElicitationPromptEventSchema, ElicitationCompleteEventSchema, InteractionCancelledEventSchema, CapabilityApprovalRequiredEventSchema, CapabilityApprovalResolvedEventSchema, SigninUrlSchema, MCP_SIGNIN_OUTCOMES, McpSigninOutcomeSchema, McpSigninRequiredEventSchema, McpSigninResolvedEventSchema, StreamEventSchema, TextPartSchema, HookStatusSchema, HookPartSchema, ToolApprovalOutcomeSchema, QuestionOutcomeSchema, ToolCallPartSchema, BackgroundTaskPartSchema, ThinkingPartSchema, ErrorPartSchema, ElicitationPartSchema, CapabilityApprovalPartSchema, McpSigninPartSchema, MemoryRecallPartSchema, PermissionDeniedPartSchema, ModelSubstitutedPartSchema, CompactBoundaryPartSchema, ImagePartSchema, MessagePartSchema, MessageTypeSchema, HistoryToolCallSchema, CompactMetadataSchema, HistoryMessageSchema, HistoryReadSchema, CommandEntrySchema, CommandRegistrySchema, FileListQuerySchema, RawFileQuerySchema, FileListResponseSchema, FileEntrySchema, FileTreeQuerySchema, FileTreeResponseSchema, FileContentQuerySchema, FileContentResponseSchema, CreateEntryRequestSchema, CreateEntryResponseSchema, DeleteEntryQuerySchema, RenameEntryRequestSchema, CopyEntryRequestSchema, RevealEntryRequestSchema, DiffBaselineOriginSchema, DiffBaselineQuerySchema, DiffBaselineResponseSchema, AdvanceDiffBaselineRequestSchema, DiffPendingQuerySchema, DiffPendingResponseSchema, DiffBaselineRawQuerySchema, RevertDiffBaselineRequestSchema, FileMutationResponseSchema, WorkbenchSignRequestSchema, WorkbenchSignResponseSchema, WorkbenchProbeRequestSchema, WorkbenchProbeResponseSchema, FRAME_SCRIPT_HTML_MAX_BYTES, FrameBridgeRefusalSchema, WorkbenchBridgeStatusRequestSchema, WorkbenchBridgeStatusResponseSchema, BrowseDirectoryQuerySchema, DirectoryEntrySchema, BrowseDirectoryResponseSchema, TunnelStatusSchema, LanAccessStatusSchema, RemoteAccessStateSchema, RemoteAccessAvailabilitySchema, RemoteAccessEnrolmentSchema, RemoteAccessReportSchema, HealthResponseSchema, ExecutionDefaultsSchema, ExperimentStateSchema, ServerConfigSchema2, ModelTierSchema, ModelOptionSchema, SubagentInfoSchema, GitStatusResponseSchema, GitStatusErrorSchema, ErrorResponseSchema, SessionLockedErrorSchema, TaskStatusSchema, SettableTaskStatusSchema, TaskNameSchema, TaskRunStatusSchema, TaskRunTriggerSchema, ScheduleOriginMarksSchema, TaskSchema, TaskRunSchema, CancelTaskRunResponseSchema, TaskTemplateSchema, TASK_DURATION_PATTERN, TASK_DURATION_MAX, TASK_DESCRIPTION_MAX, CreateTaskRequestSchema, SIDEBAR_TAB_ID_PATTERN, ShapeLiveLayoutCaptureSchema, ForkShapeRequestSchema, UpdateTaskRequestSchema, ListTaskRunsQuerySchema, ConfigPatchRequestSchema, ConfigPatchResponseSchema, UploadResultSchema, UploadResponseSchema, UploadProgressSchema, CanvasMediaSrcSchema, UiCanvasContentSchema, UiPanelIdSchema, UiToastLevelSchema, CELEBRATION_KINDS, CELEBRATION_KIND_SYNONYMS, CelebrationKindSchema, UiCommandTargetSchema, UiCommandSchema, UiCommandEventSchema, UiStateSchema, UiStateReportDocumentSchema, UiStateReportSchema, DevtoolsConsoleLevelSchema, DEVTOOLS_ARGS_MAX_CHARS, DevtoolsConsoleEntrySchema, DevtoolsNetworkEntrySchema, DEVTOOLS_CONSOLE_BATCH_MAX, DEVTOOLS_NETWORK_BATCH_MAX, DEVTOOLS_SCREENSHOT_MAX_CHARS, DevtoolsScreenshotResultSchema, DevtoolsIngestSchema, BrowserTargetSchema, BrowserActCommandSchema, BrowserPageSummarySchema, DEVTOOLS_OUTLINE_MAX_CHARS, DevtoolsActionResultSchema, DevtoolsRecordingUploadSchema, KeepAwakeUnsupportedReasonSchema, KeepAwakeStatusSchema, StreamHealthReportSchema;
 var init_schemas4 = __esm({
   "../shared/src/schemas.ts"() {
     "use strict";
@@ -58309,6 +58315,15 @@ var init_schemas4 = __esm({
         description: "Waking the computer for scheduled runs. Not built yet: always disabled, `unsupported`, with no next wake and no setup command."
       })
     }).openapi("KeepAwakeStatus");
+    StreamHealthReportSchema = external_exports.object({
+      kind: external_exports.enum(["silent-turn", "unrendered-turn"]),
+      /** How long the window waited without hearing the turn, in milliseconds. */
+      silentMs: external_exports.number().int().nonnegative(),
+      /** The highest event sequence the window had applied. */
+      lastSeq: external_exports.number().int().nonnegative(),
+      /** The window's stream connection state when it noticed. */
+      connectionState: external_exports.enum(["connecting", "connected", "reconnecting", "disconnected"])
+    }).openapi("StreamHealthReport");
   }
 });
 
@@ -136207,6 +136222,55 @@ var init_runtime_error_classification = __esm({
   }
 });
 
+// ../../apps/server/src/services/core/usage/runtime-accounts.ts
+import fs21 from "node:fs";
+import path37 from "node:path";
+function systemRealpath(dir) {
+  try {
+    return fs21.realpathSync.native(dir);
+  } catch {
+    return null;
+  }
+}
+function expandAccountPath(dir, home2) {
+  let expanded = dir;
+  if (home2 !== void 0) {
+    if (expanded === "~") expanded = home2;
+    else if (expanded.startsWith("~/")) expanded = path37.join(home2, expanded.slice(2));
+  }
+  return path37.resolve(expanded);
+}
+function canonicalAccountPath(dir, home2, realpath6 = systemRealpath) {
+  const expanded = expandAccountPath(dir, home2);
+  return realpath6(expanded) ?? expanded;
+}
+var init_runtime_accounts = __esm({
+  "../../apps/server/src/services/core/usage/runtime-accounts.ts"() {
+    "use strict";
+    init_account_usage();
+    init_config_schema();
+  }
+});
+
+// ../../apps/server/src/services/observability/account-signin-state.ts
+function recordAccountSignin(runtime, accountRoot, state) {
+  states.set(
+    JSON.stringify([
+      runtime,
+      accountRoot === void 0 ? null : canonicalAccountPath(accountRoot, void 0)
+    ]),
+    state
+  );
+}
+var states;
+var init_account_signin_state = __esm({
+  "../../apps/server/src/services/observability/account-signin-state.ts"() {
+    "use strict";
+    init_runtime_accounts();
+    states = /* @__PURE__ */ new Map();
+  }
+});
+
 // ../../apps/server/src/services/observability/runtime-signin-watch.ts
 function creditsRefusalOf(event) {
   if (event.type !== "error") return null;
@@ -136221,43 +136285,42 @@ function noteCreditsRefused(runtime, sessionId, message2) {
   }
 }
 function noteSigninFailure(runtimeType, account2) {
+  recordAccountSignin(runtimeType, account2, "signed-out");
   if (!sink) return;
   const key = account2 ?? null;
-  const standing = failingSince.get(runtimeType);
-  if (standing) {
-    if (!standing.accounts.has(key)) standing.accounts.set(key, Date.now());
-    return;
-  }
+  const episode = failingSince.get(runtimeType) ?? { accounts: /* @__PURE__ */ new Map() };
+  if (episode.accounts.has(key)) return;
   const since = Date.now();
-  failingSince.set(runtimeType, { since, accounts: /* @__PURE__ */ new Map([[key, since]]) });
-  logger.info("[Runtimes] A turn failed on its sign-in", { runtime: runtimeType, account: account2 });
-  if (!report({ runtime: runtimeType, edge: "failing", since: new Date(since).toISOString() })) {
-    failingSince.delete(runtimeType);
+  episode.accounts.set(key, since);
+  failingSince.set(runtimeType, episode);
+  if (!report({
+    runtime: runtimeType,
+    ...account2 ? { accountRoot: account2 } : {},
+    edge: "failing",
+    since: new Date(since).toISOString()
+  })) {
+    episode.accounts.delete(key);
+    if (episode.accounts.size === 0) failingSince.delete(runtimeType);
   }
 }
 function noteSigninRecovery(runtimeType, account2, turnStartedAt) {
-  const episode = failingSince.get(runtimeType);
-  if (episode === void 0) return;
-  for (const key of account2 === void 0 ? [null] : [account2, null]) {
-    const noticedAt = episode.accounts.get(key);
-    if (noticedAt !== void 0 && noticedAt < turnStartedAt) episode.accounts.delete(key);
-  }
-  reportIfEveryAccountProved(runtimeType, episode, {
-    account: account2,
-    proof: "A turn went through on a sign-in that had failed"
-  });
+  const noticedAt = failingSince.get(runtimeType)?.accounts.get(account2 ?? null);
+  if (noticedAt !== void 0 && noticedAt >= turnStartedAt) return;
+  noteSigninRepaired(runtimeType, account2);
 }
-function reportIfEveryAccountProved(runtimeType, episode, context2) {
-  if (episode.accounts.size > 0) return;
-  failingSince.delete(runtimeType);
-  logger.info(`[Runtimes] ${context2.proof}`, {
-    runtime: runtimeType,
-    account: context2.account
-  });
+function noteSigninRepaired(runtimeType, account2) {
+  recordAccountSignin(runtimeType, account2, "signed-in");
+  const episode = failingSince.get(runtimeType);
+  const key = account2 ?? null;
+  const since = episode?.accounts.get(key);
+  if (since === void 0 || !episode) return;
+  episode.accounts.delete(key);
+  if (episode.accounts.size === 0) failingSince.delete(runtimeType);
   report({
     runtime: runtimeType,
+    ...account2 ? { accountRoot: account2 } : {},
     edge: "recovered",
-    since: new Date(episode.since).toISOString()
+    since: new Date(since).toISOString()
   });
 }
 function report(event) {
@@ -136333,6 +136396,7 @@ var init_runtime_signin_watch = __esm({
     "use strict";
     init_runtime_error_classification();
     init_logger();
+    init_account_signin_state();
     sink = null;
     creditsRefusedSink = null;
     CREDITS_UNAVAILABLE_CODE = "credits_unavailable";
@@ -137265,9 +137329,9 @@ var init_permission_history = __esm({
 });
 
 // ../../apps/server/src/services/core/permissions/existing-chats-raise.ts
-import path37 from "node:path";
+import path38 from "node:path";
 function isKept(agent) {
-  const names = [path37.basename(agent.projectPath), agent.name, agent.displayName ?? ""];
+  const names = [path38.basename(agent.projectPath), agent.name, agent.displayName ?? ""];
   return names.some((n2) => KEPT_AS_THEY_ARE.has(n2.trim().toLowerCase().replace(/\s+/g, "-")));
 }
 function isChosenMode(declared, modeId) {
@@ -137316,7 +137380,7 @@ var init_chat_rise_facts = __esm({
 });
 
 // ../../apps/server/src/services/core/turn-power/agent-level-bound.ts
-import path38 from "node:path";
+import path39 from "node:path";
 function withBound(ceiling, bound) {
   if (ceiling === void 0) return bound;
   const existing = Array.isArray(ceiling) ? ceiling : [ceiling];
@@ -137332,11 +137396,11 @@ function levelBinds(declared, level, stored, opts) {
   });
 }
 function enclosingAgentHome(dir) {
-  let current3 = path38.resolve(dir);
+  let current3 = path39.resolve(dir);
   for (; ; ) {
     const home2 = homeOf(resolveAgentHome(current3));
     if (home2) return home2;
-    const parent = path38.dirname(current3);
+    const parent = path39.dirname(current3);
     if (parent === current3) return void 0;
     current3 = parent;
   }
@@ -138176,7 +138240,7 @@ var init_audit_redaction = __esm({
 });
 
 // ../../apps/server/src/services/audit/record-tool-use.ts
-import path39 from "node:path";
+import path40 from "node:path";
 function isDorkosTool(runtime, name2) {
   if (runtime === "doe") return Object.hasOwn(MCP_TOOL_TIERS, name2);
   const prefix = DORKOS_PREFIX[runtime];
@@ -138223,7 +138287,7 @@ function toolTarget(name2, input4) {
     if (files.length === 0) return null;
     const first = clip2(files[0]);
     const more = files.length > 1 ? ` and ${files.length - 1} more` : "";
-    return { type: "file", id: first, name: `${clip2(path39.basename(first))}${more}` };
+    return { type: "file", id: first, name: `${clip2(path40.basename(first))}${more}` };
   }
   if (!parsed) return null;
   const command = firstString(parsed, ["command", "cmd"]);
@@ -138236,7 +138300,7 @@ function toolTarget(name2, input4) {
     return { type: "url", id: address, name: address };
   }
   const file2 = firstString(parsed, ["file_path", "filePath", "path", "notebook_path"]);
-  if (file2) return { type: "file", id: clip2(file2), name: clip2(path39.basename(file2)) };
+  if (file2) return { type: "file", id: clip2(file2), name: clip2(path40.basename(file2)) };
   const query = firstString(parsed, ["query", "pattern"]);
   if (query) return { type: "search", id: clip2(query), name: clip2(query) };
   if (command) return { type: "command", id: clip2(command), name: clip2(command) };
@@ -140039,26 +140103,26 @@ var init_git = __esm({
 });
 
 // ../../apps/server/src/services/projects/extension-copy.ts
-import { promises as fs21 } from "node:fs";
-import path40 from "node:path";
+import { promises as fs22 } from "node:fs";
+import path41 from "node:path";
 async function folderExists(dir) {
   try {
-    return (await fs21.stat(dir)).isDirectory();
+    return (await fs22.stat(dir)).isDirectory();
   } catch {
     return false;
   }
 }
 async function holdsExtensionCopy(root, extensionId) {
-  if (await folderExists(path40.join(root, ".dork", "extensions", extensionId))) return true;
+  if (await folderExists(path41.join(root, ".dork", "extensions", extensionId))) return true;
   let plugins;
   try {
-    plugins = await fs21.readdir(path40.join(root, ".dork", "plugins"));
+    plugins = await fs22.readdir(path41.join(root, ".dork", "plugins"));
   } catch {
     return false;
   }
   for (const plugin of plugins) {
     if (isInstallSiblingName(plugin)) continue;
-    const copy2 = path40.join(root, ".dork", "plugins", plugin, ".dork", "extensions", extensionId);
+    const copy2 = path41.join(root, ".dork", "plugins", plugin, ".dork", "extensions", extensionId);
     if (await folderExists(copy2)) return true;
   }
   return false;
@@ -140092,14 +140156,14 @@ var init_origin_repo = __esm({
 });
 
 // ../../apps/server/src/services/projects/project-names.ts
-import path41 from "node:path";
+import path42 from "node:path";
 function sanitizeNameSegment(segment) {
   return segment.replace(/[^A-Za-z0-9._-]/g, "-");
 }
 function assignProjectName(root, isTaken) {
-  const base = sanitizeNameSegment(path41.basename(root)) || "project";
+  const base = sanitizeNameSegment(path42.basename(root)) || "project";
   if (!isTaken(base)) return base;
-  const parent = sanitizeNameSegment(path41.basename(path41.dirname(root))) || "root";
+  const parent = sanitizeNameSegment(path42.basename(path42.dirname(root))) || "root";
   const withParent = `${base}~${parent}`;
   if (!isTaken(withParent)) return withParent;
   for (let n2 = 2; ; n2++) {
@@ -140151,11 +140215,11 @@ var init_slots = __esm({
 });
 
 // ../../apps/server/src/services/projects/resolve-project-root.ts
-import path42 from "node:path";
+import path43 from "node:path";
 function projectRootFromCommonDir(commonDir) {
   const trimmed = commonDir.trim();
   if (trimmed.length === 0) return null;
-  return path42.basename(trimmed) === ".git" ? path42.dirname(trimmed) : trimmed;
+  return path43.basename(trimmed) === ".git" ? path43.dirname(trimmed) : trimmed;
 }
 function isNotARepository(err) {
   if (typeof err !== "object" || err === null) return false;
@@ -140172,7 +140236,7 @@ function createProjectRootResolver(overrides = {}) {
   const byCwd = /* @__PURE__ */ new Map();
   async function lookUp(cwd) {
     const dir = deps.canonical(cwd);
-    if (!path42.isAbsolute(dir)) return { root: null, answered: true };
+    if (!path43.isAbsolute(dir)) return { root: null, answered: true };
     try {
       const commonDir = await deps.runGit(
         ["rev-parse", "--path-format=absolute", "--git-common-dir"],
@@ -140246,7 +140310,7 @@ var init_resolve_project_root = __esm({
 });
 
 // ../../apps/server/src/services/projects/project-registry.ts
-import path43 from "node:path";
+import path44 from "node:path";
 async function readOriginRepoFromGit(root) {
   try {
     return parseOriginRepo(
@@ -140718,7 +140782,7 @@ var init_project_registry = __esm({
         this.sourcesReadAt = now3;
         this.sourcesRead = (async () => {
           try {
-            const folders = [...new Set(await sources2())].filter((dir) => path43.isAbsolute(dir));
+            const folders = [...new Set(await sources2())].filter((dir) => path44.isAbsolute(dir));
             await this.seedBatch(folders);
           } catch (err) {
             this.warn("could not read the folders to seed projects from", err);
@@ -141394,24 +141458,6 @@ var init_account_switch = __esm({
   }
 });
 
-// ../../apps/server/src/services/core/usage/runtime-accounts.ts
-import path44 from "node:path";
-function expandAccountPath(dir, home2) {
-  let expanded = dir;
-  if (home2 !== void 0) {
-    if (expanded === "~") expanded = home2;
-    else if (expanded.startsWith("~/")) expanded = path44.join(home2, expanded.slice(2));
-  }
-  return path44.resolve(expanded);
-}
-var init_runtime_accounts = __esm({
-  "../../apps/server/src/services/core/usage/runtime-accounts.ts"() {
-    "use strict";
-    init_account_usage();
-    init_config_schema();
-  }
-});
-
 // ../../apps/server/src/services/runtimes/claude-code/credits-root.ts
 var init_credits_root = __esm({
   "../../apps/server/src/services/runtimes/claude-code/credits-root.ts"() {
@@ -155974,7 +156020,7 @@ Examples:
 });
 
 // src/lib/api-client.ts
-import fs22 from "node:fs";
+import fs23 from "node:fs";
 import path49 from "node:path";
 function getServerBaseUrl() {
   const envPort = process.env.DORKOS_PORT;
@@ -155987,7 +156033,7 @@ function getServerBaseUrl() {
 function readConfigPort() {
   const dorkHome = resolveDorkHome2();
   try {
-    const raw = fs22.readFileSync(path49.join(dorkHome, "config.json"), "utf-8");
+    const raw = fs23.readFileSync(path49.join(dorkHome, "config.json"), "utf-8");
     const config3 = JSON.parse(raw);
     const port2 = config3?.server?.port;
     if (typeof port2 === "number" && port2 > 0) return port2;
@@ -156006,7 +156052,7 @@ function resolveApiKey() {
   const fromEnv = process.env[API_KEY_ENV_VAR]?.trim();
   if (fromEnv) return fromEnv;
   try {
-    const fromFile = fs22.readFileSync(apiKeyFilePath(), "utf-8").trim();
+    const fromFile = fs23.readFileSync(apiKeyFilePath(), "utf-8").trim();
     if (fromFile) return fromFile;
   } catch {
   }
@@ -156994,7 +157040,7 @@ var init_contracts = __esm({
 // ../browser/src/runtime/installation/filesystem.ts
 import { createHash as createHash6, randomUUID as randomUUID5 } from "node:crypto";
 import { constants as constants5 } from "node:fs";
-import * as fs23 from "node:fs/promises";
+import * as fs24 from "node:fs/promises";
 import path50 from "node:path";
 function requireFact(value, code) {
   if (!value) throw new InstallationFailure(code);
@@ -157125,7 +157171,7 @@ var init_filesystem = __esm({
         for (const part of ["", ...parts]) {
           if (part) current3 = path50.join(current3, part);
           try {
-            const stat5 = await fs23.lstat(current3, { bigint: true });
+            const stat5 = await fs24.lstat(current3, { bigint: true });
             this.directorySecure(stat5);
             result2.push({ path: current3, identity: identity(stat5) });
           } catch (error63) {
@@ -157137,7 +157183,7 @@ var init_filesystem = __esm({
       }
       async recheckParents(parents) {
         for (const parent of parents) {
-          const stat5 = await fs23.lstat(parent.path, { bigint: true });
+          const stat5 = await fs24.lstat(parent.path, { bigint: true });
           this.directorySecure(stat5);
           requireFact(directoryIdentity(parent.identity, identity(stat5)), "ROOT_CHANGED");
         }
@@ -157146,7 +157192,7 @@ var init_filesystem = __esm({
         const duty = { path: name2, original: null, state: "acquiring", lease };
         this.duties.add(duty);
         try {
-          duty.original = await fs23.open(name2, flags, mode);
+          duty.original = await fs24.open(name2, flags, mode);
           duty.state = "open";
           return duty;
         } catch (error63) {
@@ -157214,7 +157260,7 @@ var init_filesystem = __esm({
         }
       }
       async checkDirectory(directory) {
-        const named3 = identity(await fs23.lstat(directory.path, { bigint: true }));
+        const named3 = identity(await fs24.lstat(directory.path, { bigint: true }));
         const held2 = identity(await directory.handle.stat({ bigint: true }));
         requireFact(
           directoryIdentity(directory.identity, named3) && directoryIdentity(named3, held2),
@@ -157235,16 +157281,16 @@ var init_filesystem = __esm({
           const parent = current3;
           current3 = path50.join(current3, part);
           try {
-            this.directorySecure(await fs23.lstat(current3, { bigint: true }));
+            this.directorySecure(await fs24.lstat(current3, { bigint: true }));
           } catch (error63) {
             if (!isMissing(error63)) throw error63;
             await this.ancestors(parent);
             try {
-              await fs23.mkdir(current3, { mode: 448 });
+              await fs24.mkdir(current3, { mode: 448 });
             } catch (mkdirError) {
               if (!isExists(mkdirError)) throw mkdirError;
             }
-            this.directorySecure(await fs23.lstat(current3, { bigint: true }));
+            this.directorySecure(await fs24.lstat(current3, { bigint: true }));
             await this.syncDirectory(current3);
             await this.syncDirectory(parent);
           }
@@ -157252,8 +157298,8 @@ var init_filesystem = __esm({
       }
       async exclusiveDirectory(name2) {
         await this.ancestors(path50.dirname(name2));
-        await fs23.mkdir(name2, { mode: 448 });
-        const stat5 = await fs23.lstat(name2, { bigint: true });
+        await fs24.mkdir(name2, { mode: 448 });
+        const stat5 = await fs24.lstat(name2, { bigint: true });
         this.directorySecure(stat5);
         requireFact(
           Number(stat5.uid) === process.getuid?.() && (Number(stat5.mode) & 63) === 0,
@@ -157264,7 +157310,7 @@ var init_filesystem = __esm({
       }
       async read(name2, cap, retain = 0) {
         const parents = await this.ancestors(path50.dirname(name2));
-        const named3 = identity(await fs23.lstat(name2, { bigint: true }));
+        const named3 = identity(await fs24.lstat(name2, { bigint: true }));
         requireFact(named3.type === "file" && BigInt(named3.size) <= BigInt(cap), "INSTALLATION_INVALID");
         const duty = await this.acquire(
           name2,
@@ -157294,7 +157340,7 @@ var init_filesystem = __esm({
             }
           }
           requireFact(
-            bytes === Number(acquired.size) && sameFileIdentity(acquired, identity(await handle.stat({ bigint: true }))) && sameFileIdentity(acquired, identity(await fs23.lstat(name2, { bigint: true }))),
+            bytes === Number(acquired.size) && sameFileIdentity(acquired, identity(await handle.stat({ bigint: true }))) && sameFileIdentity(acquired, identity(await fs24.lstat(name2, { bigint: true }))),
             "ROOT_CHANGED"
           );
           await this.recheckParents(parents);
@@ -157310,7 +157356,7 @@ var init_filesystem = __esm({
         this.duties.add(duty);
         return this.closeAfter([duty, directory.duty], async () => {
           try {
-            duty.original = await fs23.opendir(name2, { bufferSize: 1 });
+            duty.original = await fs24.opendir(name2, { bufferSize: 1 });
             duty.state = "open";
           } catch (error63) {
             duty.state = "uncertain";
@@ -157333,26 +157379,26 @@ var init_filesystem = __esm({
       }
       async libraryBinMetadata(root, directory) {
         const parents = await this.ancestors(directory), bins = path50.join(directory, ".bin");
-        const before = identity(await fs23.lstat(directory, { bigint: true }));
+        const before = identity(await fs24.lstat(directory, { bigint: true }));
         requireFact(
           (await this.names(directory, INSTALLATION_LIMITS.libraryEntries)).join(",") === ".bin",
           "LIBRARY_MISMATCH"
         );
-        const binParents = await this.ancestors(bins), binBefore = identity(await fs23.lstat(bins, { bigint: true }));
+        const binParents = await this.ancestors(bins), binBefore = identity(await fs24.lstat(bins, { bigint: true }));
         requireFact(
           (await this.names(bins, INSTALLATION_LIMITS.libraryEntries)).join(",") === "playwright-core",
           "LIBRARY_MISMATCH"
         );
-        const shim = path50.join(bins, "playwright-core"), stat5 = await fs23.lstat(shim, { bigint: true });
+        const shim = path50.join(bins, "playwright-core"), stat5 = await fs24.lstat(shim, { bigint: true });
         if (stat5.isSymbolicLink()) {
-          const link3 = await fs23.readlink(shim);
+          const link3 = await fs24.readlink(shim);
           requireFact(
-            Buffer.byteLength(link3) <= INSTALLATION_LIMITS.bufferBytes && await fs23.realpath(shim) === path50.join(root, "cli.js"),
+            Buffer.byteLength(link3) <= INSTALLATION_LIMITS.bufferBytes && await fs24.realpath(shim) === path50.join(root, "cli.js"),
             "LIBRARY_MISMATCH"
           );
-          const after = await fs23.lstat(shim, { bigint: true });
+          const after = await fs24.lstat(shim, { bigint: true });
           requireFact(
-            after.isSymbolicLink() && stat5.dev === after.dev && stat5.ino === after.ino && stat5.size === after.size && stat5.mode === after.mode && stat5.uid === after.uid && stat5.mtimeNs === after.mtimeNs && stat5.ctimeNs === after.ctimeNs && link3 === await fs23.readlink(shim),
+            after.isSymbolicLink() && stat5.dev === after.dev && stat5.ino === after.ino && stat5.size === after.size && stat5.mode === after.mode && stat5.uid === after.uid && stat5.mtimeNs === after.mtimeNs && stat5.ctimeNs === after.ctimeNs && link3 === await fs24.readlink(shim),
             "ROOT_CHANGED"
           );
         } else {
@@ -157361,7 +157407,7 @@ var init_filesystem = __esm({
           requireFact(sameFileIdentity(identity(stat5), read.file.identity), "ROOT_CHANGED");
         }
         requireFact(
-          sameFileIdentity(before, identity(await fs23.lstat(directory, { bigint: true }))) && sameFileIdentity(binBefore, identity(await fs23.lstat(bins, { bigint: true }))),
+          sameFileIdentity(before, identity(await fs24.lstat(directory, { bigint: true }))) && sameFileIdentity(binBefore, identity(await fs24.lstat(bins, { bigint: true }))),
           "ROOT_CHANGED"
         );
         await this.recheckParents(binParents);
@@ -157374,7 +157420,7 @@ var init_filesystem = __esm({
         const totalLimit = library ? INSTALLATION_LIMITS.libraryBytes : INSTALLATION_LIMITS.payloadBytes;
         const visit2 = async (directory, depth) => {
           requireFact(depth <= INSTALLATION_LIMITS.payloadDepth, "RETENTION_EXCEEDED");
-          const dirIdentity = identity(await fs23.lstat(directory, { bigint: true }));
+          const dirIdentity = identity(await fs24.lstat(directory, { bigint: true }));
           requireFact(dirIdentity.type === "directory", "ROOT_CHANGED");
           result2.directories.push({ path: directory, identity: dirIdentity });
           result2.rows.push({
@@ -157386,7 +157432,7 @@ var init_filesystem = __esm({
             requireFact(++result2.entries <= entryLimit, "RETENTION_EXCEEDED");
             const absolute = path50.join(directory, name2), relative12 = path50.relative(root, absolute).split(path50.sep).join("/");
             requireFact(relativePath.safeParse(relative12).success, "INSTALLATION_INVALID");
-            const stat5 = await fs23.lstat(absolute, { bigint: true });
+            const stat5 = await fs24.lstat(absolute, { bigint: true });
             if (library && relative12 === "node_modules") {
               requireFact(stat5.isDirectory() && !stat5.isSymbolicLink(), "LIBRARY_MISMATCH");
               await this.libraryBinMetadata(root, absolute);
@@ -157394,13 +157440,13 @@ var init_filesystem = __esm({
             }
             if (stat5.isSymbolicLink()) {
               requireFact(!library, "LIBRARY_MISMATCH");
-              const link3 = await fs23.readlink(absolute), resolved = await fs23.realpath(absolute);
+              const link3 = await fs24.readlink(absolute), resolved = await fs24.realpath(absolute);
               requireFact(resolved.startsWith(root + path50.sep), "ROOT_CHANGED");
-              const target = await fs23.stat(resolved, { bigint: true });
+              const target = await fs24.stat(resolved, { bigint: true });
               requireFact(target.isFile() || target.isDirectory(), "ROOT_CHANGED");
-              const after = await fs23.lstat(absolute, { bigint: true });
+              const after = await fs24.lstat(absolute, { bigint: true });
               requireFact(
-                stat5.dev === after.dev && stat5.ino === after.ino && stat5.mtimeNs === after.mtimeNs && stat5.ctimeNs === after.ctimeNs && link3 === await fs23.readlink(absolute),
+                stat5.dev === after.dev && stat5.ino === after.ino && stat5.mtimeNs === after.mtimeNs && stat5.ctimeNs === after.ctimeNs && link3 === await fs24.readlink(absolute),
                 "ROOT_CHANGED"
               );
               result2.rows.push({
@@ -157433,7 +157479,7 @@ var init_filesystem = __esm({
             }
           }
           requireFact(
-            sameFileIdentity(dirIdentity, identity(await fs23.lstat(directory, { bigint: true }))),
+            sameFileIdentity(dirIdentity, identity(await fs24.lstat(directory, { bigint: true }))),
             "ROOT_CHANGED"
           );
         };
@@ -157637,7 +157683,7 @@ var init_filesystem = __esm({
             await this.exclusiveDirectory(path50.join(root, child));
           await this.syncDirectory(root);
           await this.syncDirectory(parent);
-          const stat5 = identity(await fs23.lstat(root, { bigint: true }));
+          const stat5 = identity(await fs24.lstat(root, { bigint: true }));
           const attempt = Object.freeze({
             kind: "installation-attempt",
             binding: handle.binding,
@@ -157659,7 +157705,7 @@ var init_filesystem = __esm({
         const bytes = recordBytes(record2, cap), parent = path50.dirname(name2), parents = await this.ancestors(parent);
         if (!replace) {
           try {
-            await fs23.lstat(name2);
+            await fs24.lstat(name2);
             throw new InstallationFailure("RECORD_FAILED");
           } catch (error63) {
             if (!isMissing(error63)) throw error63;
@@ -157684,7 +157730,7 @@ var init_filesystem = __esm({
           requireFact(
             sameFileIdentity(
               identity(await handle.stat({ bigint: true })),
-              identity(await fs23.lstat(temporary, { bigint: true }))
+              identity(await fs24.lstat(temporary, { bigint: true }))
             ),
             "ROOT_CHANGED"
           );
@@ -157692,14 +157738,14 @@ var init_filesystem = __esm({
         });
         if (!replace) {
           try {
-            await fs23.lstat(name2);
+            await fs24.lstat(name2);
             throw new InstallationFailure("RECORD_FAILED");
           } catch (error63) {
             if (!isMissing(error63)) throw error63;
           }
         }
         await this.recheckParents(parents);
-        await fs23.rename(temporary, name2);
+        await fs24.rename(temporary, name2);
         await this.syncDirectory(parent);
         const result2 = await this.read(name2, cap, cap);
         requireFact(result2.file.sha256 === sha2562(bytes), "RECORD_FAILED");
@@ -157968,7 +158014,7 @@ var init_filesystem = __esm({
               requireFact(
                 sameFileIdentity(file2.identity, identity(await original.stat({ bigint: true }))) && sameFileIdentity(
                   file2.identity,
-                  identity(await fs23.lstat(file2.path, { bigint: true }))
+                  identity(await fs24.lstat(file2.path, { bigint: true }))
                 ),
                 "ROOT_CHANGED"
               );
@@ -158082,7 +158128,7 @@ var init_filesystem = __esm({
             requireFact(compareCurrent(before, await this.current()), "ROOT_CHANGED");
             this.checkEnd(reservation);
             replacementAttempted = true;
-            await fs23.rename(temporary, path50.join(this.configuration.cacheRoot, "current.json"));
+            await fs24.rename(temporary, path50.join(this.configuration.cacheRoot, "current.json"));
             pointerReplaced = true;
             await this.syncDirectory(this.configuration.cacheRoot);
             after = await this.current();
@@ -158184,7 +158230,7 @@ var init_filesystem = __esm({
         let expected;
         let hash3;
         const observe = async (size, growth = false) => {
-          const held2 = identity(await original.stat({ bigint: true })), named3 = identity(await fs23.lstat(name2, { bigint: true }));
+          const held2 = identity(await original.stat({ bigint: true })), named3 = identity(await fs24.lstat(name2, { bigint: true }));
           requireFact(
             held2.type === "file" && held2.size === String(size) && sameFileIdentity(held2, named3),
             "ROOT_CHANGED"
@@ -158347,7 +158393,7 @@ var init_filesystem = __esm({
           requireFact(
             sameFileIdentity(
               attempt.identity,
-              identity(await fs23.lstat(attempt.attemptRoot, { bigint: true }))
+              identity(await fs24.lstat(attempt.attemptRoot, { bigint: true }))
             ),
             "ROOT_CHANGED"
           );
@@ -158460,7 +158506,7 @@ var init_filesystem = __esm({
             parsed.attemptRoot === path50.join(c3.cacheRoot, "attempts", parsed.binding.attemptId) && parsed.candidateRoot === path50.join(c3.cacheRoot, "candidates", parsed.binding.installationId) && parsed.executablePath === INSTALLATION_TARGET.executablePath,
             "BINDING_MISMATCH"
           );
-          const attempt = identity(await fs23.lstat(parsed.attemptRoot, { bigint: true }));
+          const attempt = identity(await fs24.lstat(parsed.attemptRoot, { bigint: true }));
           requireFact(sameFileIdentity(attempt, parsed.attemptIdentity), "ROOT_CHANGED");
           await this.ancestors(parsed.attemptRoot);
           const ownerRead = await this.read(
@@ -158506,7 +158552,7 @@ var init_filesystem = __esm({
             "HASH_MISMATCH"
           );
           requireFact(
-            sameFileIdentity(attempt, identity(await fs23.lstat(parsed.attemptRoot, { bigint: true }))),
+            sameFileIdentity(attempt, identity(await fs24.lstat(parsed.attemptRoot, { bigint: true }))),
             "ROOT_CHANGED"
           );
           this.fresh.set(request, {
@@ -158555,11 +158601,11 @@ var init_filesystem = __esm({
             "OWNERSHIP_UNCERTAIN"
           );
           try {
-            await fs23.unlink(owner.file.path);
+            await fs24.unlink(owner.file.path);
             await reservation.directory.handle.sync();
             await this.checkDirectory(reservation.directory);
             await this.close(reservation.directory.duty);
-            await fs23.rmdir(reservation.directory.path);
+            await fs24.rmdir(reservation.directory.path);
             await reservation.root.handle.sync();
             await this.checkDirectory(reservation.root);
             await this.close(reservation.root.duty);
@@ -159348,7 +159394,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
     ...parsed.data,
     sourceVintage: Object.freeze(parsed.data.sourceVintage)
   });
-  const { filesystem: fs40, jobs } = dependencies;
+  const { filesystem: fs41, jobs } = dependencies;
   const now3 = dependencies.now;
   const createId = dependencies.createId;
   let active3 = null;
@@ -159381,7 +159427,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
   };
   const id = () => IdSchema2.parse(Reflect.apply(createId, dependencies, []));
   const fsReturned = () => {
-    const custody = fs40.custody(reservation);
+    const custody = fs41.custody(reservation);
     require2(custody.pendingOperations === 0 && custody.unresolvedHandles === 0, "CUSTODY_UNCERTAIN");
     require2(custody.firstCause === null, custody.firstCause ?? "CUSTODY_UNCERTAIN");
     require2(custody.reservation === "held", "OWNERSHIP_UNCERTAIN");
@@ -159437,7 +159483,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
           finalEnd: origin + config3.finalMilliseconds
         })
       );
-      const before = await fs40.inspectExisting({ signal: options.signal });
+      const before = await fs41.inspectExisting({ signal: options.signal });
       check4(bounds, options.signal);
       require2(before.current.state !== "unknown" && before.status.state !== "unverified", "OWNERSHIP_UNCERTAIN");
       const existing = before.installation;
@@ -159459,18 +159505,18 @@ function createInstallationTransaction(configuration, dependencies, generation3)
         binding.nonce,
         ...reuse ? [] : [binding.installationId]
       ])).size === (reuse ? 3 : 4), "BINDING_MISMATCH");
-      reservation = await fs40.acquireReservation(binding, bounds);
+      reservation = await fs41.acquireReservation(binding, bounds);
       check4(bounds, options.signal);
-      const reserved = await fs40.inspectExisting({ signal: options.signal });
+      const reserved = await fs41.inspectExisting({ signal: options.signal });
       require2(canonicalDigest(reserved.current) === canonicalDigest(before.current), "ROOT_CHANGED");
       require2(reserved.status.state !== "unverified", "OWNERSHIP_UNCERTAIN");
       if (reuse)
         require2(reserved.installation && canonicalDigest(reserved.installation) === canonicalDigest(existing), "ROOT_CHANGED");
       check4(bounds, options.signal);
-      const attempt = await fs40.createAttempt(reservation);
+      const attempt = await fs41.createAttempt(reservation);
       require2(sameBinding(attempt.binding, binding), "BINDING_MISMATCH");
       const owner = async (phase) => {
-        await fs40.writeOwner(
+        await fs41.writeOwner(
           reservation,
           attempt,
           Object.freeze({
@@ -159485,12 +159531,12 @@ function createInstallationTransaction(configuration, dependencies, generation3)
       };
       await owner("reserved");
       check4(bounds, options.signal);
-      const library = await fs40.validateLibrary();
+      const library = await fs41.validateLibrary();
       validateLibrary(library);
       check4(bounds, options.signal);
-      const candidate = reuse ? await fs40.bindExistingCandidate(reservation, attempt, reserved.installation) : await fs40.stageCandidate(reservation, attempt);
+      const candidate = reuse ? await fs41.bindExistingCandidate(reservation, attempt, reserved.installation) : await fs41.stageCandidate(reservation, attempt);
       require2(sameBinding(candidate.binding, binding) && candidate.reuse === reuse, "BINDING_MISMATCH");
-      const sink3 = fs40.createJobSink(reservation, attempt);
+      const sink3 = fs41.createJobSink(reservation, attempt);
       let installer = {
         kind: "not-invoked"
       };
@@ -159516,7 +159562,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
         installer = { kind: "invoked", jobId: facts2.jobId, receiptDigest: canonicalDigest(facts2) };
         check4(bounds, options.signal);
       }
-      const snapshot = await fs40.observeCandidate(candidate);
+      const snapshot = await fs41.observeCandidate(candidate);
       validateCandidate(snapshot, binding);
       check4(bounds, options.signal);
       await owner("verifying");
@@ -159570,7 +159616,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
       require2(reply.libraryDistributionSHA256 === library.distributionSHA256, "LIBRARY_MISMATCH");
       require2(reply.sourceManifestSHA256 === config3.sourceVintage.sourceManifestSHA256, "SOURCE_MISMATCH");
       require2(reply.machOCPU === snapshot.machOCPU, "INSTALLATION_INVALID");
-      await fs40.revalidateCandidate(candidate, snapshot);
+      await fs41.revalidateCandidate(candidate, snapshot);
       check4(bounds, options.signal);
       allJobsReturned();
       fsReturned();
@@ -159604,17 +159650,17 @@ function createInstallationTransaction(configuration, dependencies, generation3)
         });
         recordBytes(journal, INSTALLATION_LIMITS.journalBytes);
         check4(bounds, options.signal);
-        const written2 = await fs40.writeReuseJournal(reservation, attempt, journal);
+        const written2 = await fs41.writeReuseJournal(reservation, attempt, journal);
         require2(written2.path === join56(attempt.attemptRoot, "reuse.json") && written2.sha256 === sha2562(recordBytes(journal, INSTALLATION_LIMITS.journalBytes)), "OWNERSHIP_UNCERTAIN");
-        const unchanged = await fs40.inspectExisting({ signal: options.signal });
+        const unchanged = await fs41.inspectExisting({ signal: options.signal });
         require2(canonicalDigest(unchanged.current) === canonicalDigest(reserved.current) && canonicalDigest(unchanged.installation) === canonicalDigest(reserved.installation), "ROOT_CHANGED");
         journalDigest = written2.sha256;
         currentManifestDigest = reserved.installation.current.pointer.manifestDigest;
       } else {
         await owner("publishing");
         check4(bounds, options.signal);
-        await fs40.makeCandidateDurable(candidate, snapshot);
-        await fs40.revalidateCandidate(candidate, snapshot);
+        await fs41.makeCandidateDurable(candidate, snapshot);
+        await fs41.revalidateCandidate(candidate, snapshot);
         check4(bounds, options.signal);
         allJobsReturned();
         fsReturned();
@@ -159637,7 +159683,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
           }
         });
         recordBytes(manifest, INSTALLATION_LIMITS.manifestBytes);
-        const published = await fs40.publish(
+        const published = await fs41.publish(
           reservation,
           candidate,
           manifest,
@@ -159657,9 +159703,9 @@ function createInstallationTransaction(configuration, dependencies, generation3)
       check4(bounds, options.signal, true);
       allJobsReturned();
       fsReturned();
-      await fs40.releaseReservation(reservation);
+      await fs41.releaseReservation(reservation);
       check4(bounds, options.signal, true);
-      const final = fs40.custody(reservation);
+      const final = fs41.custody(reservation);
       require2(final.reservation === "released" && final.pendingOperations === 0 && final.unresolvedHandles === 0 && final.firstCause === null, "CUSTODY_UNCERTAIN");
       return Object.freeze({
         state: reuse ? "verified-reused" : "verified-installed",
@@ -159679,7 +159725,7 @@ function createInstallationTransaction(configuration, dependencies, generation3)
       fail(error63);
       let uncertain = !!reservation || publicationMayHaveChanged;
       try {
-        const files = fs40.custody(reservation);
+        const files = fs41.custody(reservation);
         const processes = jobs.custody();
         uncertain ||= files.reservation !== "released" || files.pendingOperations !== 0 || files.unresolvedHandles !== 0 || files.firstCause !== null || processes.pending !== 0 || processes.firstCause !== null;
       } catch {
@@ -160220,7 +160266,7 @@ function summarizeStorageState(state, nowSeconds) {
   const originHosts = state.origins.map((o3) => originHost(o3.origin)).filter((h2) => Boolean(h2));
   const siteOf = groupHosts([...state.cookies.map((c3) => c3.domain), ...originHosts]);
   const bySite = /* @__PURE__ */ new Map();
-  const entryFor = (site) => {
+  const entryFor2 = (site) => {
     let entry = bySite.get(site);
     if (!entry) {
       entry = {
@@ -160238,7 +160284,7 @@ function summarizeStorageState(state, nowSeconds) {
   for (const cookie of state.cookies) {
     const site = siteOf.get(normalizeHost(cookie.domain));
     if (!site) continue;
-    const entry = entryFor(site);
+    const entry = entryFor2(site);
     entry.cookies += 1;
     if (cookie.expires === -1) {
       entry.live += 1;
@@ -160250,7 +160296,7 @@ function summarizeStorageState(state, nowSeconds) {
   for (const origin of state.origins) {
     const host = originHost(origin.origin);
     const site = host ? siteOf.get(host) : void 0;
-    if (site && origin.localStorage.length > 0) entryFor(site).pageStorage = true;
+    if (site && origin.localStorage.length > 0) entryFor2(site).pageStorage = true;
   }
   return [...bySite.values()].map(({ live, ...site }) => ({
     ...site,
@@ -160551,7 +160597,7 @@ var init_process_liveness = __esm({
 });
 
 // src/lib/agent-browser/profile.ts
-import fs24 from "node:fs";
+import fs25 from "node:fs";
 import path52 from "node:path";
 function themePreferences() {
   const color = AGENT_BROWSER_THEME_COLOR;
@@ -160596,7 +160642,7 @@ function deepMerge2(base, patch) {
 }
 function readJsonObject(file2) {
   try {
-    const parsed = JSON.parse(fs24.readFileSync(file2, "utf8"));
+    const parsed = JSON.parse(fs25.readFileSync(file2, "utf8"));
     return isObject6(parsed) ? parsed : {};
   } catch {
     return {};
@@ -160611,26 +160657,26 @@ function hasOwnThemeColor(prefs) {
   return isObject6(extensions) && typeof extensions.id === "string" && extensions.id !== "";
 }
 function ensureAgentProfile(profileDir, now3 = /* @__PURE__ */ new Date()) {
-  const created = !fs24.existsSync(profileDir);
-  fs24.mkdirSync(path52.dirname(profileDir), { recursive: true, mode: 448 });
-  fs24.chmodSync(path52.dirname(profileDir), 448);
-  fs24.mkdirSync(profileDir, { recursive: true, mode: 448 });
+  const created = !fs25.existsSync(profileDir);
+  fs25.mkdirSync(path52.dirname(profileDir), { recursive: true, mode: 448 });
+  fs25.chmodSync(path52.dirname(profileDir), 448);
+  fs25.mkdirSync(profileDir, { recursive: true, mode: 448 });
   const marker = path52.join(profileDir, THEME_MARKER_FILE);
-  if (fs24.existsSync(marker)) return { created, themed: false };
+  if (fs25.existsSync(marker)) return { created, themed: false };
   const prefsFile = path52.join(profileDir, "Default", "Preferences");
   const prefs = readJsonObject(prefsFile);
   const themed = !hasOwnThemeColor(prefs);
   if (themed) {
-    fs24.mkdirSync(path52.dirname(prefsFile), { recursive: true, mode: 448 });
-    fs24.writeFileSync(prefsFile, JSON.stringify(deepMerge2(prefs, themePreferences())));
+    fs25.mkdirSync(path52.dirname(prefsFile), { recursive: true, mode: 448 });
+    fs25.writeFileSync(prefsFile, JSON.stringify(deepMerge2(prefs, themePreferences())));
     const localStateFile = path52.join(profileDir, "Local State");
     const localState = readJsonObject(localStateFile);
-    fs24.writeFileSync(
+    fs25.writeFileSync(
       localStateFile,
       JSON.stringify(deepMerge2(localState, localStateProfileInfo()))
     );
   }
-  fs24.writeFileSync(
+  fs25.writeFileSync(
     marker,
     `${JSON.stringify({ themeAppliedAt: now3.toISOString(), themed }, null, 2)}
 `
@@ -160640,9 +160686,9 @@ function ensureAgentProfile(profileDir, now3 = /* @__PURE__ */ new Date()) {
 function profileLock(profileDir, platform3 = process.platform) {
   if (platform3 === "win32") {
     const lockfile = path52.join(profileDir, "lockfile");
-    if (!fs24.existsSync(lockfile)) return { inUse: false };
+    if (!fs25.existsSync(lockfile)) return { inUse: false };
     try {
-      fs24.rmSync(lockfile);
+      fs25.rmSync(lockfile);
       return { inUse: false };
     } catch {
       return { inUse: true };
@@ -160650,7 +160696,7 @@ function profileLock(profileDir, platform3 = process.platform) {
   }
   let target;
   try {
-    target = fs24.readlinkSync(path52.join(profileDir, "SingletonLock"));
+    target = fs25.readlinkSync(path52.join(profileDir, "SingletonLock"));
   } catch {
     return { inUse: false };
   }
@@ -160671,8 +160717,88 @@ var init_profile2 = __esm({
   }
 });
 
+// ../shared/src/cloud-origin.ts
+function normalizeHost2(host) {
+  return host.toLowerCase().replace(/\.+$/, "");
+}
+function entryFor(url2) {
+  let parsed;
+  try {
+    parsed = new URL(url2);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  const host = normalizeHost2(parsed.hostname);
+  if (!host) return null;
+  if (LOCAL_HOST.test(host))
+    return { kind: "origin", protocol: parsed.protocol, host, port: parsed.port };
+  return { kind: "host", host };
+}
+function cloudOriginEntries(config3 = {}) {
+  const urls = [CLOUD_ORIGIN, CLOUD_WEBSITE];
+  if (config3.DORKOS_CLOUD_API_URL) urls.push(config3.DORKOS_CLOUD_API_URL);
+  if (config3.DORKOS_CLOUD_URL) urls.push(config3.DORKOS_CLOUD_URL);
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const url2 of urls) {
+    const entry = entryFor(url2);
+    if (!entry) continue;
+    const key = JSON.stringify(entry);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    entries.push(entry);
+  }
+  return entries;
+}
+function hostIsUnder(host, parent) {
+  return host === parent || host.endsWith(`.${parent}`);
+}
+function isCloudOriginUrl(url2, entries = cloudOriginEntries()) {
+  let parsed;
+  try {
+    parsed = new URL(url2);
+    if (parsed.protocol === "blob:") parsed = new URL(parsed.pathname);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+  const host = normalizeHost2(parsed.hostname);
+  return entries.some(
+    (entry) => entry.kind === "host" ? hostIsUnder(host, entry.host) : entry.protocol === parsed.protocol && entry.host === host && entry.port === parsed.port
+  );
+}
+function cookieReachesCloud(domain2, entries = cloudOriginEntries()) {
+  const isDomainCookie = domain2.startsWith(".");
+  const cookieHost = normalizeHost2(domain2.replace(/^\.+/, ""));
+  if (!cookieHost) return false;
+  return entries.some((entry) => {
+    if (entry.kind === "origin") return cookieHost === entry.host;
+    if (hostIsUnder(cookieHost, entry.host)) return true;
+    return isDomainCookie && hostIsUnder(entry.host, cookieHost);
+  });
+}
+function withoutCloudOrigin(state, entries = cloudOriginEntries()) {
+  const cookies = state.cookies.filter((cookie) => !cookieReachesCloud(cookie.domain, entries));
+  const origins = state.origins.filter((origin) => !isCloudOriginUrl(origin.origin, entries));
+  return {
+    state: { ...state, cookies, origins },
+    removedCookies: state.cookies.length - cookies.length,
+    removedOrigins: state.origins.length - origins.length
+  };
+}
+var CLOUD_ORIGIN, CLOUD_WEBSITE, LOCAL_HOST;
+var init_cloud_origin = __esm({
+  "../shared/src/cloud-origin.ts"() {
+    init_links();
+    CLOUD_ORIGIN = links.cloudApi;
+    CLOUD_WEBSITE = links.site;
+    LOCAL_HOST = /^(localhost|\[[0-9a-f:.]+\]|\d{1,3}(\.\d{1,3}){3})$/i;
+  }
+});
+
 // src/lib/agent-browser/storage-state.ts
-import fs25 from "node:fs";
+import fs26 from "node:fs";
 import path53 from "node:path";
 function toStorageStateCookie(cookie) {
   const copy2 = {
@@ -160736,21 +160862,29 @@ async function collectStorageState(cdp, options = {}) {
   const origins = options.pageStorage === false ? [] : await readOpenTabStorage(cdp);
   return { cookies: cookies.map(toStorageStateCookie), origins };
 }
+function cliCloudOrigins() {
+  return cloudOriginEntries({
+    DORKOS_CLOUD_URL: env4.DORKOS_CLOUD_URL,
+    DORKOS_CLOUD_API_URL: env4.DORKOS_CLOUD_API_URL
+  });
+}
 async function writeStorageState(file2, state) {
-  fs25.mkdirSync(path53.dirname(file2), { recursive: true, mode: 448 });
-  await writeFileAtomic2(file2, `${JSON.stringify(state, null, 2)}
+  const saved = withoutCloudOrigin(state, cliCloudOrigins()).state;
+  fs26.mkdirSync(path53.dirname(file2), { recursive: true, mode: 448 });
+  await writeFileAtomic2(file2, `${JSON.stringify(saved, null, 2)}
 `, { mode: 384 });
+  return saved;
 }
 function readStorageState(file2) {
   let raw;
   try {
-    raw = fs25.readFileSync(file2, "utf8");
+    raw = fs26.readFileSync(file2, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
   }
   try {
-    return StorageStateSchema.parse(JSON.parse(raw));
+    return withoutCloudOrigin(StorageStateSchema.parse(JSON.parse(raw)), cliCloudOrigins()).state;
   } catch {
     throw new UnreadableStorageStateError(file2);
   }
@@ -160761,6 +160895,8 @@ var init_storage_state = __esm({
     "use strict";
     init_agent_browser();
     init_atomic_write2();
+    init_cloud_origin();
+    init_env2();
     UnreadableStorageStateError = class extends Error {
       constructor(file2) {
         super(
@@ -160852,7 +160988,7 @@ __export(browser_commands_exports, {
   runBrowserLogin: () => runBrowserLogin,
   runBrowserStatus: () => runBrowserStatus
 });
-import fs26 from "node:fs";
+import fs27 from "node:fs";
 import path54 from "node:path";
 import { parseArgs as parseArgs8 } from "node:util";
 function agentBrowserPaths(dorkHome) {
@@ -160909,8 +161045,8 @@ ${LOGIN_USAGE}`);
   }
 }
 async function saveAndReport(deps, stateFile, state, note) {
-  await writeStorageState(stateFile, state);
-  const sites = summarizeStorageState(state, deps.now().getTime() / 1e3).filter((s2) => !s2.expired);
+  const saved = await writeStorageState(stateFile, state);
+  const sites = summarizeStorageState(saved, deps.now().getTime() / 1e3).filter((s2) => !s2.expired);
   deps.log("");
   if (sites.length === 0) {
     deps.log("Saved, but no site is signed in yet. Sign in to a site in the agent browser,");
@@ -161048,7 +161184,7 @@ function parseBrowserStatusArgs(rawArgs) {
 async function runBrowserStatus(args, deps) {
   const { stateFile } = agentBrowserPaths(deps.dorkHome);
   const state = readStorageState(stateFile);
-  const savedAt = state ? fs26.statSync(stateFile).mtime : null;
+  const savedAt = state ? fs27.statSync(stateFile).mtime : null;
   const sites = state ? summarizeStorageState(state, deps.now().getTime() / 1e3) : [];
   if (args.json) {
     printJson({
@@ -161125,7 +161261,7 @@ ${FORGET_USAGE}`);
   };
 }
 async function cleanProfile(deps, profileDir, target, knownOrigins, chromeFlag) {
-  if (!fs26.existsSync(profileDir)) return null;
+  if (!fs27.existsSync(profileDir)) return null;
   const what = target === "all" ? "those sites are" : `${target.site} is`;
   const nextSave = "the next `dorkos browser login` will save it again";
   if (deps.profileLock(profileDir).inUse) {
@@ -161221,7 +161357,7 @@ var browser_deps_exports = {};
 __export(browser_deps_exports, {
   defaultBrowserDeps: () => defaultBrowserDeps
 });
-import fs27 from "node:fs";
+import fs28 from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { spawn as spawn3, spawnSync } from "node:child_process";
 import { createInterface as createInterface2 } from "node:readline";
@@ -161277,7 +161413,7 @@ function defaultBrowserDeps() {
         programFilesX86: env4["PROGRAMFILES(X86)"],
         exists: (file2) => {
           try {
-            return fs27.statSync(file2).isFile();
+            return fs28.statSync(file2).isFile();
           } catch {
             return false;
           }
@@ -162783,7 +162919,7 @@ __export(marketplace_link_exports, {
   parseMarketplaceLinkArgs: () => parseMarketplaceLinkArgs,
   runMarketplaceLink: () => runMarketplaceLink
 });
-import fs28 from "node:fs";
+import fs29 from "node:fs";
 import path56 from "node:path";
 import { parseArgs as parseArgs17 } from "node:util";
 function parseMarketplaceLinkArgs(rawArgs) {
@@ -162845,7 +162981,7 @@ function describeLinkPreview(preview) {
 async function runMarketplaceLink(args) {
   let folder;
   try {
-    folder = fs28.realpathSync(args.folder);
+    folder = fs29.realpathSync(args.folder);
   } catch (err) {
     console.error(describeUnreadableFolder(args.folder, err));
     return 1;
@@ -170644,7 +170780,7 @@ There is no --yes mode. Before the first write, type the generated app name in a
 // src/commands/doctor-checks.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import net from "node:net";
-import fs29 from "node:fs";
+import fs30 from "node:fs";
 import path57 from "node:path";
 function checkNode() {
   const issue2 = checkNodeVersion();
@@ -170656,9 +170792,9 @@ function checkNode() {
 function checkDorkHomeWritable(dorkHome) {
   const probe2 = path57.join(dorkHome, `.doctor-write-${process.pid}`);
   try {
-    fs29.mkdirSync(dorkHome, { recursive: true });
-    fs29.writeFileSync(probe2, "ok");
-    fs29.rmSync(probe2, { force: true });
+    fs30.mkdirSync(dorkHome, { recursive: true });
+    fs30.writeFileSync(probe2, "ok");
+    fs30.rmSync(probe2, { force: true });
     return { label: `Data directory is writable`, status: "pass", detail: dorkHome };
   } catch (err) {
     return {
@@ -170708,7 +170844,7 @@ function readGitVersion() {
 }
 function checkClaudeAuth(homeDir) {
   const claudeDir = path57.join(homeDir, ".claude");
-  if (fs29.existsSync(claudeDir)) {
+  if (fs30.existsSync(claudeDir)) {
     return { label: "Claude looks configured", status: "info", detail: claudeDir };
   }
   return {
@@ -170801,7 +170937,7 @@ function checkDevLinks(dorkHome) {
   const file2 = path57.join(dorkHome, DEV_LINKS_FILE);
   let text3;
   try {
-    text3 = fs29.readFileSync(file2, "utf-8");
+    text3 = fs30.readFileSync(file2, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return judgeDevLinks({ entries: [] }, { paths: true });
@@ -170827,7 +170963,7 @@ function devLinkStateSync(record2) {
   let lstatIsLink = false;
   let present = false;
   try {
-    lstatIsLink = fs29.lstatSync(record2.slot).isSymbolicLink();
+    lstatIsLink = fs30.lstatSync(record2.slot).isSymbolicLink();
     present = true;
   } catch (err) {
     const code = err.code;
@@ -170835,14 +170971,14 @@ function devLinkStateSync(record2) {
   }
   let realpathOfSlot = null;
   try {
-    realpathOfSlot = fs29.realpathSync(record2.slot);
+    realpathOfSlot = fs30.realpathSync(record2.slot);
   } catch {
   }
   if (isActiveDevLink(record2, { lstatIsLink, realpathOfSlot })) return "active";
   if (!present) return "link-missing";
   if (lstatIsLink && realpathOfSlot === null) {
     try {
-      const text3 = fs29.readlinkSync(record2.slot);
+      const text3 = fs30.readlinkSync(record2.slot);
       if (path57.resolve(path57.dirname(record2.slot), text3) === record2.target) return "folder-missing";
     } catch {
     }
@@ -170963,7 +171099,7 @@ __export(doctor_exports, {
   runDoctor: () => runDoctor,
   withCleanStdout: () => withCleanStdout
 });
-import fs30 from "node:fs";
+import fs31 from "node:fs";
 import os9 from "node:os";
 import path58 from "node:path";
 function parseDoctorArgs(rawArgs) {
@@ -171068,7 +171204,7 @@ async function gatherResults(dorkHome, store) {
     checkDevLinks(dorkHome),
     checkAuthConfig({
       authEnabled: readBool(store, "auth.enabled", false),
-      secretFileExists: fs30.existsSync(path58.join(dorkHome, SECRET_FILE_NAME2)),
+      secretFileExists: fs31.existsSync(path58.join(dorkHome, SECRET_FILE_NAME2)),
       // eslint-disable-next-line no-restricted-syntax -- reading an operator env override, matching secret.ts
       secretEnvSet: Boolean(process.env.BETTER_AUTH_SECRET?.trim())
     }),
@@ -171475,7 +171611,7 @@ __export(ended_standing_grants_exports, {
   readStandingGrantLicence: () => readStandingGrantLicence,
   recordEndedStandingGrants: () => recordEndedStandingGrants
 });
-import fs31 from "node:fs/promises";
+import fs32 from "node:fs/promises";
 import { readFileSync as readFileSync22, writeFileSync as writeFileSync4, renameSync as renameSync4 } from "node:fs";
 import path59 from "node:path";
 function readStandingGrantLicence(dorkHome) {
@@ -171559,7 +171695,7 @@ async function recordEndedStandingGrants(deps) {
   const file2 = path59.join(deps.dorkHome, ENDED_STANDING_GRANTS_FILE);
   const grants = readCaptured(file2);
   if (grants.length === 0) {
-    await fs31.rm(file2, { force: true });
+    await fs32.rm(file2, { force: true });
     return 0;
   }
   const agents2 = new Map(deps.agents().map((agent) => [agent.projectPath, agent]));
@@ -171589,7 +171725,7 @@ async function recordEndedStandingGrants(deps) {
     });
   }
   try {
-    await fs31.rm(file2, { force: true });
+    await fs32.rm(file2, { force: true });
   } catch (err) {
     deps.logger.warn("[Permissions] could not remove the ended standing permissions file", {
       err: err instanceof Error ? err.message : String(err)
@@ -173662,19 +173798,19 @@ var init_cloud_link_client = __esm({
 
 // ../../apps/server/src/lib/instance-id.ts
 import { randomUUID as randomUUID8 } from "node:crypto";
-import fs32 from "node:fs/promises";
+import fs33 from "node:fs/promises";
 import path61 from "node:path";
 async function getOrCreateInstanceId(dorkHome) {
   const filePath = path61.join(dorkHome, INSTANCE_ID_FILENAME2);
   try {
-    const existing = await fs32.readFile(filePath, "utf8");
+    const existing = await fs33.readFile(filePath, "utf8");
     const trimmed = existing.trim();
     if (trimmed) return trimmed;
   } catch {
   }
   const id = randomUUID8();
-  await fs32.mkdir(dorkHome, { recursive: true });
-  await fs32.writeFile(filePath, id, "utf8");
+  await fs33.mkdir(dorkHome, { recursive: true });
+  await fs33.writeFile(filePath, id, "utf8");
   return id;
 }
 var INSTANCE_ID_FILENAME2;
@@ -175181,7 +175317,7 @@ __export(room_exports, {
   runRoomExport: () => runRoomExport
 });
 import { parseArgs as parseArgs30 } from "node:util";
-import fs33 from "node:fs";
+import fs34 from "node:fs";
 import path62 from "node:path";
 import { Readable } from "node:stream";
 import { finished as finished2, pipeline } from "node:stream/promises";
@@ -175268,18 +175404,18 @@ async function streamExport(body, destination, closeDestination) {
   return { entryCount: null, reason };
 }
 async function writeExportFile(body, target) {
-  const staging = fs33.mkdtempSync(path62.join(path62.dirname(target), ".dorkos-export-"));
+  const staging = fs34.mkdtempSync(path62.join(path62.dirname(target), ".dorkos-export-"));
   const scratch = path62.join(staging, path62.basename(target));
   let file2;
   try {
-    file2 = fs33.createWriteStream(scratch);
+    file2 = fs34.createWriteStream(scratch);
     const outcome = await streamExport(body, file2, true);
-    if (outcome.entryCount !== null) fs33.renameSync(scratch, target);
+    if (outcome.entryCount !== null) fs34.renameSync(scratch, target);
     return outcome;
   } finally {
     if (file2) await finished2(file2).catch(() => {
     });
-    fs33.rmSync(staging, { recursive: true, force: true });
+    fs34.rmSync(staging, { recursive: true, force: true });
   }
 }
 async function runRoomExport(args) {
@@ -175293,7 +175429,7 @@ async function runRoomExport(args) {
       target = path62.resolve(
         args.out ?? suggestedFilename(res.headers.get("content-disposition"), roomId)
       );
-      if (!args.force && fs33.existsSync(target)) {
+      if (!args.force && fs34.existsSync(target)) {
         console.error(`Error: ${target} already exists. Pass --force to replace it.`);
         return 1;
       }
@@ -175487,7 +175623,7 @@ var init_connector_schemas2 = __esm({
 });
 
 // src/commands/connections-args.ts
-import fs34 from "node:fs";
+import fs35 from "node:fs";
 function requireNonblank(value, flag, usage) {
   if (typeof value !== "string" || value.trim().length === 0) {
     throw new Error(`Missing required ${flag} value.
@@ -175510,7 +175646,7 @@ ${usage}`);
   if (typeof inline === "string") raw = inline;
   if (typeof file2 === "string") {
     try {
-      raw = fs34.readFileSync(file2 === "-" ? 0 : file2, "utf8");
+      raw = fs35.readFileSync(file2 === "-" ? 0 : file2, "utf8");
     } catch (error63) {
       throw new Error(
         `Cannot read ${fileFlag} '${file2}': ${error63 instanceof Error ? error63.message : String(error63)}`,
@@ -176472,7 +176608,7 @@ __export(call_exports, {
   parseCallArgs: () => parseCallArgs2,
   runCall: () => runCall2
 });
-import fs35 from "node:fs";
+import fs36 from "node:fs";
 import { parseArgs as parseArgs34 } from "node:util";
 function parseCallArgs2(rawArgs) {
   const usage = "Usage: dorkos call <capability-id> [--input <json> | --input-file <path>]";
@@ -176509,7 +176645,7 @@ ${usage}`);
     rawInput = inline;
   } else if (file2 !== void 0) {
     try {
-      rawInput = fs35.readFileSync(file2 === "-" ? 0 : file2, "utf-8");
+      rawInput = fs36.readFileSync(file2 === "-" ? 0 : file2, "utf-8");
     } catch (err) {
       throw new Error(
         `Cannot read --input-file '${file2}': ${err instanceof Error ? err.message : String(err)}`,
@@ -176613,7 +176749,7 @@ __export(version_exports, {
   runVersionCheck: () => runVersionCheck,
   runVersionDispatcher: () => runVersionDispatcher
 });
-import fs36 from "node:fs";
+import fs37 from "node:fs";
 import path63 from "node:path";
 import { parseArgs as parseArgs35 } from "node:util";
 function parseVersionArgs(rawArgs) {
@@ -176636,7 +176772,7 @@ function parseVersionArgs(rawArgs) {
 }
 function readCachedLatest(dorkHome) {
   try {
-    const raw = fs36.readFileSync(path63.join(dorkHome, "cache", "update-check.json"), "utf-8");
+    const raw = fs37.readFileSync(path63.join(dorkHome, "cache", "update-check.json"), "utf-8");
     const cache3 = JSON.parse(raw);
     return typeof cache3.latestVersion === "string" ? cache3.latestVersion : null;
   } catch {
@@ -176730,12 +176866,12 @@ __export(cleanup_command_exports, {
   runCleanup: () => runCleanup
 });
 import { confirm as confirm2 } from "@inquirer/prompts";
-import fs37 from "fs";
+import fs38 from "fs";
 import path64 from "path";
 import http from "node:http";
 function readPort(dorkHome) {
   try {
-    const raw = fs37.readFileSync(path64.join(dorkHome, "config.json"), "utf-8");
+    const raw = fs38.readFileSync(path64.join(dorkHome, "config.json"), "utf-8");
     const config3 = JSON.parse(raw);
     const port2 = config3?.server?.port;
     if (typeof port2 === "number" && port2 > 0) return port2;
@@ -176762,7 +176898,7 @@ async function findProjectPaths(dbPath) {
     const db2 = new Database3(dbPath, { readonly: true });
     try {
       const rows = db2.prepare("SELECT DISTINCT project_path FROM agents").all();
-      return rows.map((r3) => r3.project_path).filter((p) => fs37.existsSync(path64.join(p, ".dork")));
+      return rows.map((r3) => r3.project_path).filter((p) => fs38.existsSync(path64.join(p, ".dork")));
     } finally {
       db2.close();
     }
@@ -176772,7 +176908,7 @@ async function findProjectPaths(dbPath) {
 }
 async function runCleanup(options) {
   const { dorkHome } = options;
-  if (!fs37.existsSync(dorkHome)) {
+  if (!fs38.existsSync(dorkHome)) {
     console.log("\nNo DorkOS data found. Nothing to clean up.\n");
     return;
   }
@@ -176785,7 +176921,7 @@ DorkOS server is running on port ${port2}. Stop it before running cleanup.
     return;
   }
   console.log("\nDorkOS Cleanup\n");
-  const entries = fs37.readdirSync(dorkHome);
+  const entries = fs38.readdirSync(dorkHome);
   if (entries.length === 0) {
     console.log("No DorkOS data found. Nothing to clean up.\n");
     return;
@@ -176797,7 +176933,7 @@ DorkOS server is running on port ${port2}. Stop it before running cleanup.
   }
   console.log("");
   const dbPath = path64.join(dorkHome, "dork.db");
-  const projectPaths = fs37.existsSync(dbPath) ? await findProjectPaths(dbPath) : [];
+  const projectPaths = fs38.existsSync(dbPath) ? await findProjectPaths(dbPath) : [];
   const removeGlobal = await confirm2({
     message: `Remove global DorkOS data (${dorkHome})?`,
     default: false
@@ -176806,7 +176942,7 @@ DorkOS server is running on port ${port2}. Stop it before running cleanup.
     console.log("\n  Aborted.\n");
     return;
   }
-  fs37.rmSync(dorkHome, { recursive: true, force: true });
+  fs38.rmSync(dorkHome, { recursive: true, force: true });
   console.log(`
   Removed ${dorkHome}
 `);
@@ -176823,7 +176959,7 @@ DorkOS server is running on port ${port2}. Stop it before running cleanup.
     if (removeProjects) {
       for (const p of projectPaths) {
         const dorkDir = path64.join(p, ".dork");
-        fs37.rmSync(dorkDir, { recursive: true, force: true });
+        fs38.rmSync(dorkDir, { recursive: true, force: true });
         console.log(`  Removed ${dorkDir}`);
       }
       console.log("");
@@ -177149,7 +177285,7 @@ __export(init_wizard_exports, {
   runInitWizard: () => runInitWizard
 });
 import { input as input3, select, confirm as confirm3 } from "@inquirer/prompts";
-import fs38 from "fs";
+import fs39 from "fs";
 import path66 from "path";
 async function runInitWizard(options) {
   const { yes, dorkHome, store } = options;
@@ -177159,7 +177295,7 @@ async function runInitWizard(options) {
     console.log(`Config initialized with defaults at ${configPath}`);
     return;
   }
-  if (fs38.existsSync(configPath)) {
+  if (fs39.existsSync(configPath)) {
     const overwrite = await confirm3({
       message: "Config already exists. Overwrite with new settings?",
       default: false
@@ -177222,7 +177358,7 @@ init_check_extension_compilation();
 import os11, { networkInterfaces } from "os";
 import path67 from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
-import fs39 from "fs";
+import fs40 from "fs";
 
 // src/update-check.ts
 init_dork_home2();
@@ -178151,7 +178287,7 @@ if (process.argv[2] === "community") {
     );
     Object.assign(childEnv, credentialEnv.pickCommunityCredentialEnv(rawProcessEnv));
     const exitCode = await dispatcher.runCommunityDispatcher(process.argv.slice(3), {
-      cliVersion: "0.125.2",
+      cliVersion: "0.125.4",
       dorkHome: DORK_HOME,
       processEnv: childEnv,
       parseRelease: (bytes) => releaseContract.parseCompatibleCommunityReleaseManifest(
@@ -178169,7 +178305,7 @@ if (process.argv[2] === "community") {
     process.exit(1);
   }
 }
-var cliErrorReporter = initCliErrorReporting({ dorkHome: DORK_HOME, version: "0.125.2" });
+var cliErrorReporter = initCliErrorReporting({ dorkHome: DORK_HOME, version: "0.125.4" });
 var uninstallCliErrorHandlers = cliErrorReporter ? installCliErrorHandlers(cliErrorReporter) : void 0;
 if (process.argv[2] === "doctor") {
   process.env.DORK_HOME = DORK_HOME;
@@ -178179,7 +178315,7 @@ if (process.argv[2] === "doctor") {
 if (process.argv[2] === "feedback") {
   process.env.DORK_HOME = DORK_HOME;
   const { runFeedback: runFeedback2 } = await Promise.resolve().then(() => (init_feedback2(), feedback_exports));
-  process.exit(await runFeedback2(DORK_HOME, "0.125.2", process.argv.slice(3)));
+  process.exit(await runFeedback2(DORK_HOME, "0.125.4", process.argv.slice(3)));
 }
 if (process.argv[2] === "auth") {
   process.env.DORK_HOME = DORK_HOME;
@@ -178188,13 +178324,13 @@ if (process.argv[2] === "auth") {
 }
 if (process.argv[2] === "cloud") {
   process.env.DORK_HOME = DORK_HOME;
-  fs39.mkdirSync(DORK_HOME, { recursive: true });
+  fs40.mkdirSync(DORK_HOME, { recursive: true });
   const { runCloudDispatcher: runCloudDispatcher2 } = await Promise.resolve().then(() => (init_cloud_dispatcher(), cloud_dispatcher_exports));
   process.exit(await runCloudDispatcher2(DORK_HOME, process.argv[3], process.argv.slice(4)));
 }
 if (process.argv[2] === "telemetry") {
   process.env.DORK_HOME = DORK_HOME;
-  fs39.mkdirSync(DORK_HOME, { recursive: true });
+  fs40.mkdirSync(DORK_HOME, { recursive: true });
   const { runTelemetryDispatcher: runTelemetryDispatcher2 } = await Promise.resolve().then(() => (init_telemetry(), telemetry_exports));
   process.exit(await runTelemetryDispatcher2(DORK_HOME, process.argv[3], process.argv.slice(4)));
 }
@@ -178278,7 +178414,7 @@ if (process.argv[2] === "agent" || process.argv[2] === "task" || process.argv[2]
     }
   }
   const { runVersionDispatcher: runVersionDispatcher2 } = await Promise.resolve().then(() => (init_version5(), version_exports));
-  process.exit(await runVersionDispatcher2("0.125.2", DORK_HOME, subArgs));
+  process.exit(await runVersionDispatcher2("0.125.4", DORK_HOME, subArgs));
 }
 var { values, positionals } = parseCliArgs();
 if (positionals[0] && !knownCommands.has(positionals[0])) {
@@ -178372,14 +178508,14 @@ Examples:
   process.exit(0);
 }
 if (values.version) {
-  console.log("0.125.2");
+  console.log("0.125.4");
   process.exit(0);
 }
 if (values["post-install-check"]) {
   const claudeFound = checkClaude();
   const coreExtensionsFound = checkCoreExtensions();
   const extensionsCompile = await checkExtensionCompilation();
-  console.log(`dorkos ${"0.125.2"}`);
+  console.log(`dorkos ${"0.125.4"}`);
   if (!coreExtensionsFound) {
     console.log("Installation incomplete \u2014 bundled core extensions are missing.");
   }
@@ -178402,7 +178538,7 @@ if (subcommand === "cleanup") {
   process.exit(process.exitCode ?? 0);
 }
 try {
-  fs39.mkdirSync(DORK_HOME, { recursive: true });
+  fs40.mkdirSync(DORK_HOME, { recursive: true });
 } catch (err) {
   const reason = err instanceof Error ? err.message : String(err);
   console.error(`\u26A0  DorkOS could not set up ${DORK_HOME}: ${reason}`);
@@ -178521,13 +178657,13 @@ if (resolvedDir !== effectiveBoundary && !resolvedDir.startsWith(effectiveBounda
 var logLevelName = values["log-level"] || env4.LOG_LEVEL || cfgMgr.getDot("logging.level") || (env4.NODE_ENV === "production" ? "info" : "debug");
 process.env.DORKOS_LOG_LEVEL = String(LOG_LEVEL_MAP[logLevelName] ?? 3);
 var envPath = path67.join(process.env.DORKOS_DEFAULT_CWD, ".env");
-if (fs39.existsSync(envPath)) {
+if (fs40.existsSync(envPath)) {
   const dotenv = await import("dotenv");
   dotenv.config({ path: envPath, override: false });
 }
 uninstallCliErrorHandlers?.();
 process.env.DORKOS_CLI_ENTRYPOINT = fileURLToPath7(import.meta.url);
-process.env.DORKOS_CLI_VERSION = "0.125.2";
+process.env.DORKOS_CLI_VERSION = "0.125.4";
 var server;
 try {
   server = await import("../server/index.js");
@@ -178552,7 +178688,7 @@ var ansiReset = "\x1B[0m";
 console.log("");
 console.log(`${purple}${logo}${ansiReset}`);
 console.log("");
-console.log(`  DorkOS v${"0.125.2"}`);
+console.log(`  DorkOS v${"0.125.4"}`);
 console.log(`  Local:   ${link(localUrl, localUrl)}`);
 var nets = networkInterfaces();
 var networkUrl = null;
@@ -178578,9 +178714,9 @@ if (shouldOpenBrowser && process.stdin.isTTY) {
   const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   exec(`${openCmd} ${localUrl}`);
 }
-checkForUpdate("0.125.2").then((latestVersion) => {
+checkForUpdate("0.125.4").then((latestVersion) => {
   if (latestVersion) {
-    const msg = `Update available: ${"0.125.2"} \u2192 ${latestVersion}`;
+    const msg = `Update available: ${"0.125.4"} \u2192 ${latestVersion}`;
     const cmd = "Run npm install -g dorkos@latest to update";
     const width = Math.max(msg.length, cmd.length) + 6;
     const pad2 = (s2) => `\u2502   ${s2}${" ".repeat(width - s2.length - 6)}   \u2502`;