githits 0.4.11 → 0.4.12

package/dist/shared/{chunk-5xd5rcm9.js → chunk-1045f3nq.js}

@@ -1,7 +1,7 @@
 import {
   __require,
   version
-} from "./chunk-agpezzpd.js";
+} from "./chunk-tmhsq5ft.js";
 
 // src/services/app-config-paths.ts
 var APP_DIR = "githits";
@@ -57,6 +57,7 @@ function getLegacyMacAuthFileStorageDir(fs) {
 function getLegacyMacAuthFileStorageDirForEnv(fs, env) {
   return fs.joinPath(getLegacyMacAppConfigDirForEnv(fs, env), "auth");
 }
+
 // src/services/auth-config.ts
 import { parse as parseToml } from "smol-toml";
 import { z } from "zod";
@@ -126,6 +127,7 @@ async function loadAuthConfig(fs) {
     throw error;
   }
 }
+
 // src/services/auth-service.ts
 import { createServer } from "node:http";
 
@@ -796,6 +798,7 @@ var HELP_CTA = ctaBlock("Explore available commands with:", [
 function escapeHtml(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
+
 // src/services/auth-storage.ts
 var AUTH_FILE = "auth.json";
 var CLIENT_FILE = "client.json";
@@ -1002,6 +1005,7 @@ function isAuthSessionMetadata(value) {
     return false;
   return typeof value.createdAt === "string" && value.createdAt.length > 0 && typeof value.updatedAt === "string" && value.updatedAt.length > 0 && (value.expiresAt === null || typeof value.expiresAt === "string" && value.expiresAt.length > 0);
 }
+
 // src/services/browser-service.ts
 import open from "open";
 
@@ -1010,6 +1014,7 @@ class BrowserServiceImpl {
     await open(url);
   }
 }
+
 // src/services/chunking-keyring-service.ts
 var WINDOWS_MAX_ENTRY_SIZE = 1200;
 var CHUNKED_PREFIX = "CHUNKED:";
@@ -1121,30 +1126,7 @@ class ChunkingKeyringService {
     }
   }
 }
-// src/services/client-update-required-error.ts
-var CLIENT_UPDATE_REQUIRED_REASON = "Backend protocol changed";
 
-class ClientUpdateRequiredError extends Error {
-  reason;
-  currentVersion;
-  constructor(message = `Update required: ${CLIENT_UPDATE_REQUIRED_REASON}`, reason = CLIENT_UPDATE_REQUIRED_REASON, currentVersion = version) {
-    super(message);
-    this.reason = reason;
-    this.currentVersion = currentVersion;
-    this.name = "ClientUpdateRequiredError";
-  }
-}
-function isClientUpdateRequiredGraphQLError(input) {
-  return input.code === "CLIENT_UPDATE_REQUIRED";
-}
-function isGraphQLSchemaMismatchError(input) {
-  if (!isGraphQLSchemaMismatchMessage(input.message))
-    return false;
-  return !input.code || input.code === "GRAPHQL_VALIDATION_FAILED" || input.code === "BAD_USER_INPUT";
-}
-function isGraphQLSchemaMismatchMessage(message) {
-  return /Cannot query field|Field .* does not exist|Unknown argument|Unknown type|Unknown field/i.test(message);
-}
 // src/services/code-navigation-service.ts
 import { z as z2 } from "zod";
 
@@ -1188,158 +1170,6 @@ function isExplicitOnlyArea(area) {
   return area === "code-nav-wire";
 }
 
-// src/shared/request-headers.ts
-import { createHash as createHash2, randomUUID } from "node:crypto";
-var MAX_HEADER_BYTES = 256;
-var SESSION_ENV_VARS = [
-  "TERM_SESSION_ID",
-  "ITERM_SESSION_ID",
-  "WEZTERM_PANE",
-  "KITTY_PID",
-  "ALACRITTY_SOCKET",
-  "WT_SESSION",
-  "VSCODE_PID",
-  "SUPERSET_PANE_ID",
-  "SUPERSET_WORKSPACE_ID",
-  "STARSHIP_SESSION_KEY",
-  "SSH_CONNECTION"
-];
-var cachedSessionId;
-function resolveRawSessionId(env = process.env, ppid = process.ppid) {
-  for (const key of SESSION_ENV_VARS) {
-    const value = env[key];
-    if (value && value.trim().length > 0) {
-      return value.trim();
-    }
-  }
-  if (typeof ppid === "number" && !Number.isNaN(ppid) && ppid > 0) {
-    return String(ppid);
-  }
-  return randomUUID();
-}
-function getSessionId(env, ppid) {
-  if (cachedSessionId !== undefined && env === undefined && ppid === undefined) {
-    return cachedSessionId;
-  }
-  const raw = resolveRawSessionId(env, ppid);
-  const hashed = hashValue(raw);
-  if (env === undefined && ppid === undefined) {
-    cachedSessionId = hashed;
-  }
-  return hashed;
-}
-function hashValue(input) {
-  return createHash2("sha256").update(input).digest("hex").slice(0, 16);
-}
-var AGENT_PROBES = [
-  { envVar: "OPENCODE", name: "opencode" },
-  { envVar: "CLAUDECODE", name: "claude-code" },
-  { envVar: "CURSOR_TRACE_ID", name: "cursor" },
-  { envVar: "WINDSURF_CONFIG_DIR", name: "windsurf" },
-  { envVar: "ZED_TERM", name: "zed" },
-  { envVar: "VSCODE_PID", name: "vscode" }
-];
-function parseAgentString(raw) {
-  const trimmed = raw.trim();
-  if (trimmed.length === 0)
-    return;
-  const slashIndex = trimmed.indexOf("/");
-  if (slashIndex === -1)
-    return { name: trimmed };
-  const name = trimmed.slice(0, slashIndex);
-  const ver = trimmed.slice(slashIndex + 1);
-  if (name.length === 0)
-    return;
-  return { name, version: ver || undefined };
-}
-function formatAgentInfo(info) {
-  return info.version ? `${info.name}/${info.version}` : info.name;
-}
-function resolveAgentInfo(env = process.env) {
-  const explicit = env.GITHITS_AGENT;
-  if (explicit && explicit.trim().length > 0) {
-    return parseAgentString(explicit);
-  }
-  for (const probe of AGENT_PROBES) {
-    const value = env[probe.envVar];
-    if (value && value.trim().length > 0) {
-      return { name: probe.name };
-    }
-  }
-  return;
-}
-var currentAgentInfo;
-var agentInfoInitialized = false;
-var agentInfoExplicitlySet = false;
-var mcpClientVersionProvider;
-function setMcpClientVersionProvider(provider) {
-  mcpClientVersionProvider = provider;
-}
-function getAgentInfo(env) {
-  if (agentInfoExplicitlySet) {
-    return currentAgentInfo;
-  }
-  if (mcpClientVersionProvider) {
-    try {
-      const fromProvider = mcpClientVersionProvider();
-      if (fromProvider && fromProvider.name.trim().length > 0) {
-        return fromProvider;
-      }
-    } catch {}
-  }
-  if (!agentInfoInitialized || env !== undefined) {
-    currentAgentInfo = resolveAgentInfo(env);
-    if (env === undefined) {
-      agentInfoInitialized = true;
-    }
-  }
-  return currentAgentInfo;
-}
-var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
-function sanitizeHeaderValue(value) {
-  if (value === undefined || value === null || typeof value !== "string") {
-    return;
-  }
-  const cleaned = value.replace(CONTROL_CHARS, "").trim();
-  if (cleaned.length === 0)
-    return;
-  if (Buffer.byteLength(cleaned, "utf8") > MAX_HEADER_BYTES)
-    return;
-  return cleaned;
-}
-var BASE_CLIENT_NAME = "githits-cli";
-var clientName = BASE_CLIENT_NAME;
-function setClientMode(mode) {
-  clientName = `${BASE_CLIENT_NAME}/${mode}`;
-}
-function buildClientHeaders(env, ppid) {
-  try {
-    const headers = {};
-    const name = sanitizeHeaderValue(clientName);
-    if (name) {
-      headers["x-githits-client-name"] = name;
-    }
-    const clientVersion = sanitizeHeaderValue(version);
-    if (clientVersion) {
-      headers["x-githits-client-version"] = clientVersion;
-    }
-    const agentInfo = getAgentInfo(env);
-    if (agentInfo) {
-      const agentValue = sanitizeHeaderValue(formatAgentInfo(agentInfo));
-      if (agentValue) {
-        headers["x-githits-agent"] = agentValue;
-      }
-    }
-    const sessionId = sanitizeHeaderValue(getSessionId(env, ppid));
-    if (sessionId) {
-      headers["x-githits-session-id"] = sessionId;
-    }
-    return headers;
-  } catch {
-    return {};
-  }
-}
-
 // src/shared/pkgseer-graphql.ts
 class PkgseerTransportError extends Error {
   constructor(message, options) {
@@ -1351,14 +1181,14 @@ function baseUrl(endpointUrl) {
   return endpointUrl.replace(/\/+$/, "");
 }
 async function postPkgseerGraphql(request) {
-  const userAgent = request.userAgent ?? `githits-cli/${version}`;
+  const userAgent = request.userAgent ?? "githits-cli";
   const timeoutMs = request.timeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   let response;
   try {
     response = await fetchWithTimeout(`${baseUrl(request.endpointUrl)}/api/graphql`, {
       method: "POST",
       headers: {
-        ...buildClientHeaders(),
+        ...request.clientHeaders?.(),
         Authorization: `Bearer ${request.token}`,
         "Content-Type": "application/json",
         "User-Agent": userAgent
@@ -1394,6 +1224,31 @@ function parseJsonOrNull(body) {
   }
 }
 
+// src/services/client-update-required-error.ts
+var CLIENT_UPDATE_REQUIRED_REASON = "Backend protocol changed";
+
+class ClientUpdateRequiredError extends Error {
+  reason;
+  currentVersion;
+  constructor(message = `Update required: ${CLIENT_UPDATE_REQUIRED_REASON}`, reason = CLIENT_UPDATE_REQUIRED_REASON, currentVersion) {
+    super(message);
+    this.reason = reason;
+    this.currentVersion = currentVersion;
+    this.name = "ClientUpdateRequiredError";
+  }
+}
+function isClientUpdateRequiredGraphQLError(input) {
+  return input.code === "CLIENT_UPDATE_REQUIRED";
+}
+function isGraphQLSchemaMismatchError(input) {
+  if (!isGraphQLSchemaMismatchMessage(input.message))
+    return false;
+  return !input.code || input.code === "GRAPHQL_VALIDATION_FAILED" || input.code === "BAD_USER_INPUT";
+}
+function isGraphQLSchemaMismatchMessage(message) {
+  return /Cannot query field|Field .* does not exist|Unknown argument|Unknown type|Unknown field/i.test(message);
+}
+
 // src/shared/telemetry.ts
 import { writeSync } from "node:fs";
 var ENABLED_VALUES = new Set(["1", "true", "yes", "on"]);
@@ -1535,10 +1390,16 @@ function formatMs(value) {
 }
 
 // src/services/githits-service.ts
+var AUTHENTICATION_REQUIRED_MESSAGE = "Authentication required.";
+var LOCAL_AUTHENTICATION_MISSING_MESSAGE = "No local GitHits authentication token found.";
+var SERVER_AUTHENTICATION_REJECTED_MESSAGE = "GitHits could not accept the authentication token.";
+
 class AuthenticationError extends Error {
-  constructor(message) {
+  source;
+  constructor(message = AUTHENTICATION_REQUIRED_MESSAGE, source = "local") {
     super(message);
     this.name = "AuthenticationError";
+    this.source = source;
   }
 }
 function parseDetail(body) {
@@ -1559,11 +1420,13 @@ class GitHitsServiceImpl {
   token;
   fetchFn;
   fetchTimeoutMs;
-  constructor(apiUrl, token, fetchFn, fetchTimeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
+  runtime;
+  constructor(apiUrl, token, fetchFn, fetchTimeoutMs = DEFAULT_FETCH_TIMEOUT_MS, runtime = {}) {
     this.apiUrl = apiUrl;
     this.token = token;
     this.fetchFn = fetchFn;
     this.fetchTimeoutMs = fetchTimeoutMs;
+    this.runtime = runtime;
   }
   async search(params) {
     return withTelemetrySpan("githits.search.request", async () => {
@@ -1621,10 +1484,10 @@ class GitHitsServiceImpl {
   }
   headers() {
     return {
-      ...buildClientHeaders(),
+      ...this.runtime.clientHeaders?.(),
       Authorization: `Bearer ${this.token}`,
       "Content-Type": "application/json",
-      "User-Agent": `githits-cli/${version}`
+      "User-Agent": this.runtime.userAgent ?? "githits-cli"
     };
   }
   fetchOptions() {
@@ -1638,7 +1501,7 @@ class GitHitsServiceImpl {
     const body = await response.text().catch(() => "");
     switch (status) {
       case 401:
-        return new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+        return new AuthenticationError(SERVER_AUTHENTICATION_REJECTED_MESSAGE, "server");
       case 403:
         return new Error("Access denied.");
       case 404:
@@ -1658,7 +1521,7 @@ class GitHitsServiceImpl {
 async function executeWithTokenRefresh(options) {
   const token = await options.getToken();
   if (!token) {
-    throw new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+    throw new AuthenticationError(LOCAL_AUTHENTICATION_MISSING_MESSAGE, "local");
   }
   try {
     return await options.executeWithToken(token);
@@ -2636,10 +2499,12 @@ class CodeNavigationServiceImpl {
   codeNavigationUrl;
   tokenProvider;
   fetchFn;
-  constructor(codeNavigationUrl, tokenProvider, fetchFn = globalThis.fetch) {
+  runtime;
+  constructor(codeNavigationUrl, tokenProvider, fetchFn = globalThis.fetch, runtime = {}) {
     this.codeNavigationUrl = codeNavigationUrl;
     this.tokenProvider = tokenProvider;
     this.fetchFn = fetchFn;
+    this.runtime = runtime;
   }
   async postGraphqlWithTargetResolutionFallback(input) {
     const response = await postPkgseerGraphql({
@@ -2647,7 +2512,9 @@ class CodeNavigationServiceImpl {
       token: input.token,
       query: input.query,
       variables: input.variables,
-      fetchFn: this.fetchFn
+      fetchFn: this.fetchFn,
+      clientHeaders: this.runtime.clientHeaders,
+      userAgent: this.runtime.userAgent
     });
     if (response.status < 200 || response.status >= 300)
       return response;
@@ -2662,7 +2529,9 @@ class CodeNavigationServiceImpl {
         token: input.token,
         query: fallbackQuery,
         variables: input.variables,
-        fetchFn: this.fetchFn
+        fetchFn: this.fetchFn,
+        clientHeaders: this.runtime.clientHeaders,
+        userAgent: this.runtime.userAgent
       });
       if (!hasSchemaMismatchErrors(fallbackResponse.parsedBody)) {
         return fallbackResponse;
@@ -2791,7 +2660,7 @@ class CodeNavigationServiceImpl {
     const status = response.status;
     const detail = parseDetail2(response.responseBody);
     if (status === 401) {
-      return new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+      return new AuthenticationError(SERVER_AUTHENTICATION_REJECTED_MESSAGE, "server");
     }
     if (status === 403) {
       return new CodeNavigationAccessError(detail ?? "Code navigation access denied.");
@@ -2814,7 +2683,7 @@ class CodeNavigationServiceImpl {
     const retryable = typeof extensions?.retryable === "boolean" ? extensions.retryable : undefined;
     const indexingRef = getGraphQLIndexingRef(errors);
     if (isClientUpdateRequiredGraphQLError({ message, code })) {
-      return new ClientUpdateRequiredError;
+      return new ClientUpdateRequiredError(undefined, undefined, this.runtime.clientVersion);
     }
     if (isGraphQLSchemaMismatchError({ message, code })) {
       const sanitized = "Backend protocol mismatch. Your CLI may be newer than the server, or the server may require a newer CLI. Run `githits update-check` to verify your installed version. Set GITHITS_DEBUG=code-nav-wire to inspect GraphQL details during local development.";
@@ -2856,7 +2725,7 @@ class CodeNavigationServiceImpl {
       case "FEATURE_FLAG_REQUIRED":
         return new CodeNavigationFeatureFlagRequiredError(message);
       case "UNAUTHORIZED":
-        return new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+        return new AuthenticationError(SERVER_AUTHENTICATION_REJECTED_MESSAGE, "server");
       case "FORBIDDEN":
         return new CodeNavigationAccessError("Code navigation access denied. This feature may not be enabled for your account.");
       case "UPSTREAM_ERROR":
@@ -3459,6 +3328,7 @@ function isUnresolvableMessage(message) {
   const lower = message.toLowerCase();
   return lower.includes("could not resolve") || lower.includes("cannot resolve");
 }
+
 // src/services/config.ts
 var DEFAULT_MCP_URL = "https://mcp.githits.com";
 var DEFAULT_API_URL = "https://api.githits.com";
@@ -3479,83 +3349,9 @@ function getCodeNavigationUrl() {
 function getEnvApiToken() {
   return process.env.GITHITS_API_TOKEN;
 }
-// src/services/exec-service.ts
-import { spawn } from "node:child_process";
-var WINDOWS_CMD_META_CHARS = /([()[\]%!^"`<>&|;, *?])/g;
-function escapeWindowsCommand(value) {
-  return value.replace(WINDOWS_CMD_META_CHARS, "^$1");
-}
-function escapeWindowsArgument(value) {
-  let arg = `${value}`;
-  arg = arg.replace(/(?=(\\+?)?)\1"/g, "$1$1\\\"");
-  arg = arg.replace(/(?=(\\+?)?)\1$/, "$1$1");
-  return `"${arg}"`.replace(WINDOWS_CMD_META_CHARS, "^$1");
-}
-function buildWindowsShellCommand(command, args) {
-  return [
-    escapeWindowsCommand(command),
-    ...args.map(escapeWindowsArgument)
-  ].join(" ");
-}
-function isWindowsCommandNotFound(exitCode, stderr, platform = process.platform) {
-  return platform === "win32" && exitCode !== 0 && /^\s*'[^']+'\s+is not recognized as an internal or external command,/i.test(stderr);
-}
-function createCommandNotFoundError(command) {
-  const error = new Error(`spawn ${command} ENOENT`);
-  error.code = "ENOENT";
-  error.syscall = "spawn";
-  error.path = command;
-  return error;
-}
-function normalizeSpawnCommand(command, args, platform = process.platform) {
-  if (platform !== "win32") {
-    return { command, args };
-  }
-  const shellCommand = buildWindowsShellCommand(command, args);
-  return {
-    command: process.env.ComSpec ?? "cmd.exe",
-    args: ["/d", "/s", "/c", `"${shellCommand}"`],
-    windowsVerbatimArguments: true
-  };
-}
 
-class ExecServiceImpl {
-  async exec(command, args) {
-    return new Promise((resolve, reject) => {
-      const spawnCommand = normalizeSpawnCommand(command, args);
-      const child = spawn(spawnCommand.command, spawnCommand.args, {
-        stdio: ["ignore", "pipe", "pipe"],
-        env: { ...process.env },
-        ...spawnCommand.shell !== undefined && { shell: spawnCommand.shell },
-        ...spawnCommand.windowsVerbatimArguments !== undefined && {
-          windowsVerbatimArguments: spawnCommand.windowsVerbatimArguments
-        }
-      });
-      const stdoutChunks = [];
-      const stderrChunks = [];
-      child.stdout.on("data", (chunk) => stdoutChunks.push(chunk));
-      child.stderr.on("data", (chunk) => stderrChunks.push(chunk));
-      child.on("error", (error) => {
-        reject(error);
-      });
-      child.on("close", (code) => {
-        const exitCode = code ?? 1;
-        const stderr = Buffer.concat(stderrChunks).toString("utf-8");
-        if (isWindowsCommandNotFound(exitCode, stderr)) {
-          reject(createCommandNotFoundError(command));
-          return;
-        }
-        resolve({
-          exitCode,
-          stdout: Buffer.concat(stdoutChunks).toString("utf-8"),
-          stderr
-        });
-      });
-    });
-  }
-}
 // src/services/filesystem-service.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import {
   mkdir,
   readdir,
@@ -3619,7 +3415,7 @@ class FileSystemServiceImpl {
     }
   }
   async atomicWriteFile(path, contents) {
-    const tmpPath = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+    const tmpPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
     let mode = 384;
     try {
       const existing = await stat(path);
@@ -3636,6 +3432,7 @@ class FileSystemServiceImpl {
     }
   }
 }
+
 // src/services/keychain-auth-storage.ts
 var SERVICE_NAME = "githits";
 var TOKEN_PREFIX = "v1:tokens:";
@@ -3734,6 +3531,7 @@ class KeychainAuthStorage {
     }
   }
 }
+
 // src/services/keyring-service.ts
 import { Entry } from "@napi-rs/keyring";
 
@@ -3772,14 +3570,16 @@ class KeyringServiceImpl {
     }
   }
 }
+
 // src/services/locked-auth-storage.ts
+import { AsyncLocalStorage } from "node:async_hooks";
 import { execFile } from "node:child_process";
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname2 } from "node:path";
 import { promisify } from "node:util";
 var LOCK_DIR = "auth.lock";
-var LOCK_TIMEOUT_MS = 1e4;
+var LOCK_TIMEOUT_MS = DEFAULT_FETCH_TIMEOUT_MS * 2 + 1e4;
 var LOCK_RETRY_MS = 25;
 var ORPHANED_LOCK_MS = 5000;
 var OWNER_FILE = "owner.json";
@@ -3791,12 +3591,16 @@ class AuthStorageLockTimeoutError extends Error {
     this.name = "AuthStorageLockTimeoutError";
   }
 }
+function withAuthStorageLock(storage, fn) {
+  return storage.withAuthStorageLock(fn);
+}
 
 class LockedAuthStorage {
   storage;
   lockPath;
   lockTimeoutMs;
   isOwnerAlive;
+  lockContext = new AsyncLocalStorage;
   currentOwner = null;
   constructor(storage, fileSystemService, options = {}) {
     this.storage = storage;
@@ -3808,52 +3612,63 @@ class LockedAuthStorage {
     return this.storage.loadTokens(baseUrl2);
   }
   saveTokens(baseUrl2, data) {
-    return this.withLock(() => this.storage.saveTokens(baseUrl2, data));
+    return this.withAuthStorageLock(() => this.storage.saveTokens(baseUrl2, data));
   }
   saveTokensIfUnchanged(baseUrl2, expected, data) {
-    return this.withLock(() => this.storage.saveTokensIfUnchanged(baseUrl2, expected, data));
+    return this.withAuthStorageLock(() => this.storage.saveTokensIfUnchanged(baseUrl2, expected, data));
   }
   clearTokens(baseUrl2) {
-    return this.withLock(() => this.storage.clearTokens(baseUrl2));
+    return this.withAuthStorageLock(() => this.storage.clearTokens(baseUrl2));
   }
   clearTokensIfUnchanged(baseUrl2, expected) {
-    return this.withLock(() => this.storage.clearTokensIfUnchanged(baseUrl2, expected));
+    return this.withAuthStorageLock(() => this.storage.clearTokensIfUnchanged(baseUrl2, expected));
   }
   loadClient(baseUrl2) {
     return this.storage.loadClient(baseUrl2);
   }
   saveClient(baseUrl2, data) {
-    return this.withLock(() => this.storage.saveClient(baseUrl2, data));
+    return this.withAuthStorageLock(() => this.storage.saveClient(baseUrl2, data));
   }
   clearClient(baseUrl2) {
-    return this.withLock(() => this.storage.clearClient(baseUrl2));
+    return this.withAuthStorageLock(() => this.storage.clearClient(baseUrl2));
   }
   saveAuthSession(baseUrl2, client, tokens) {
-    return this.withLock(() => this.storage.saveAuthSession(baseUrl2, client, tokens));
+    return this.withAuthStorageLock(() => this.storage.saveAuthSession(baseUrl2, client, tokens));
   }
   clearAuthSession(baseUrl2) {
-    return this.withLock(() => this.storage.clearAuthSession(baseUrl2));
+    return this.withAuthStorageLock(() => this.storage.clearAuthSession(baseUrl2));
   }
   getStorageLocation() {
     return this.storage.getStorageLocation();
   }
-  async withLock(fn) {
+  async withAuthStorageLock(fn) {
+    const ownerId = this.lockContext.getStore();
+    if (ownerId && this.currentOwner?.id === ownerId) {
+      return fn();
+    }
     await this.acquireLock();
+    const acquiredOwnerId = this.currentOwner?.id;
     try {
-      return await fn();
+      return await this.lockContext.run(acquiredOwnerId ?? "", fn);
     } finally {
       await this.releaseLock();
     }
   }
   async acquireLock() {
+    const processStartedAt = await getProcessStartedAt(process.pid);
     const startedAt = Date.now();
     await mkdir2(dirname2(this.lockPath), { recursive: true, mode: 448 });
     while (true) {
       try {
         await mkdir2(this.lockPath, { recursive: false, mode: 448 });
         try {
-          await this.writeOwner();
+          await this.writeOwner(processStartedAt);
         } catch (error) {
+          this.currentOwner = null;
+          if (error.code === "EEXIST") {
+            await sleep(LOCK_RETRY_MS);
+            continue;
+          }
           await rm(this.lockPath, { recursive: true, force: true }).catch(() => {
             return;
           });
@@ -3871,15 +3686,18 @@ class LockedAuthStorage {
       }
     }
   }
-  async writeOwner() {
+  async writeOwner(processStartedAt) {
     const owner = {
-      id: randomUUID3(),
+      id: randomUUID2(),
       pid: process.pid,
       createdAt: new Date().toISOString(),
-      processStartedAt: await getProcessStartedAt(process.pid)
+      processStartedAt
     };
+    await writeFile2(this.ownerPath(), JSON.stringify(owner), {
+      mode: 384,
+      flag: "wx"
+    });
     this.currentOwner = owner;
-    await writeFile2(this.ownerPath(), JSON.stringify(owner), { mode: 384 });
   }
   async reclaimStaleLock() {
     const owner = await this.readOwner();
@@ -3989,6 +3807,7 @@ async function lockCreatedAtMs(path) {
     return 0;
   }
 }
+
 // src/services/mode-aware-file-auth-storage.ts
 class AuthStoragePolicyError extends Error {
   constructor(message) {
@@ -4420,6 +4239,7 @@ class MigratingAuthStorage {
     return a.accessToken === b.accessToken && a.refreshToken === b.refreshToken && a.expiresAt === b.expiresAt && a.createdAt === b.createdAt;
   }
 }
+
 // src/services/package-intelligence-service.ts
 import { z as z3 } from "zod";
 
@@ -5419,10 +5239,12 @@ class PackageIntelligenceServiceImpl {
   endpointUrl;
   tokenProvider;
   fetchFn;
-  constructor(endpointUrl, tokenProvider, fetchFn = globalThis.fetch) {
+  runtime;
+  constructor(endpointUrl, tokenProvider, fetchFn = globalThis.fetch, runtime = {}) {
     this.endpointUrl = endpointUrl;
     this.tokenProvider = tokenProvider;
     this.fetchFn = fetchFn;
+    this.runtime = runtime;
   }
   async packageSummary(params) {
     return withTelemetrySpan("pkg-intel.summary.request", () => executeWithTokenRefresh({
@@ -5443,7 +5265,9 @@ class PackageIntelligenceServiceImpl {
           registry: params.registry,
           name: params.packageName
         },
-        fetchFn: this.fetchFn
+        fetchFn: this.fetchFn,
+        clientHeaders: this.runtime.clientHeaders,
+        userAgent: this.runtime.userAgent
       });
     } catch (cause) {
       if (cause instanceof PkgseerTransportError) {
@@ -5471,7 +5295,7 @@ class PackageIntelligenceServiceImpl {
     const status = response.status;
     const detail = parseDetail3(response.responseBody);
     if (status === 401) {
-      return new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+      return new AuthenticationError(SERVER_AUTHENTICATION_REJECTED_MESSAGE, "server");
     }
     if (status === 403) {
       return new PackageIntelligenceAccessError(detail ?? "Access denied.");
@@ -5493,7 +5317,7 @@ class PackageIntelligenceServiceImpl {
     const code = typeof extensions?.code === "string" ? extensions.code : undefined;
     const retryable = typeof extensions?.retryable === "boolean" ? extensions.retryable : undefined;
     if (isClientUpdateRequiredGraphQLError({ message, code })) {
-      return new ClientUpdateRequiredError;
+      return new ClientUpdateRequiredError(undefined, undefined, this.runtime.clientVersion);
     }
     if (isGraphQLSchemaMismatchError({ message, code })) {
       const sanitized = "Backend protocol mismatch. Your CLI may be newer than the server, or the server may require a newer CLI. Run `githits update-check` to verify your installed version. Set GITHITS_DEBUG=pkg-graphql to inspect GraphQL details during local development.";
@@ -5516,7 +5340,7 @@ class PackageIntelligenceServiceImpl {
       case "FEATURE_FLAG_REQUIRED":
         return new PackageIntelligenceFeatureFlagRequiredError(message);
       case "UNAUTHORIZED":
-        return new AuthenticationError("Authentication required. Run `githits login` to authenticate.");
+        return new AuthenticationError(SERVER_AUTHENTICATION_REJECTED_MESSAGE, "server");
       case "FORBIDDEN":
         return new PackageIntelligenceAccessError("Access denied. This feature may not be enabled for your account.");
       case "UPSTREAM_ERROR":
@@ -5654,7 +5478,9 @@ class PackageIntelligenceServiceImpl {
           scope: params.advisoryScope,
           after
         },
-        fetchFn: this.fetchFn
+        fetchFn: this.fetchFn,
+        clientHeaders: this.runtime.clientHeaders,
+        userAgent: this.runtime.userAgent
       });
     } catch (cause) {
       if (cause instanceof PkgseerTransportError) {
@@ -5758,7 +5584,9 @@ class PackageIntelligenceServiceImpl {
           lifecycle: params.includeGroups === true ? ["peer"] : undefined,
           minSeverity: params.minSeverity
         },
-        fetchFn: this.fetchFn
+        fetchFn: this.fetchFn,
+        clientHeaders: this.runtime.clientHeaders,
+        userAgent: this.runtime.userAgent
       });
     } catch (cause) {
       if (cause instanceof PkgseerTransportError) {
@@ -5797,7 +5625,9 @@ class PackageIntelligenceServiceImpl {
           maxDepth: params.maxDepth,
           lifecycle: params.lifecycle && params.lifecycle.length > 0 ? params.lifecycle : undefined
         },
-        fetchFn: this.fetchFn
+        fetchFn: this.fetchFn,
+        clientHeaders: this.runtime.clientHeaders,
+        userAgent: this.runtime.userAgent
       });
     } catch (cause) {
       if (cause instanceof PkgseerTransportError) {
@@ -6034,7 +5864,9 @@ class PackageIntelligenceServiceImpl {
           toVersion: params.toVersion,
           limit: params.limit
         },
-        fetchFn: this.fetchFn
+        fetchFn: this.fetchFn,
+        clientHeaders: this.runtime.clientHeaders,
+        userAgent: this.runtime.userAgent
       });
     } catch (cause) {
       if (cause instanceof PkgseerTransportError) {
@@ -6109,7 +5941,9 @@ class PackageIntelligenceServiceImpl {
           limit: params.limit,
           after: params.after
         },
-        fetchFn: this.fetchFn
+        fetchFn: this.fetchFn,
+        clientHeaders: this.runtime.clientHeaders,
+        userAgent: this.runtime.userAgent
       });
     } catch (cause) {
       if (cause instanceof PkgseerTransportError) {
@@ -6178,7 +6012,9 @@ class PackageIntelligenceServiceImpl {
         variables: {
           pageId: params.pageId
         },
-        fetchFn: this.fetchFn
+        fetchFn: this.fetchFn,
+        clientHeaders: this.runtime.clientHeaders,
+        userAgent: this.runtime.userAgent
       });
     } catch (cause) {
       if (cause instanceof PkgseerTransportError) {
@@ -6263,44 +6099,18 @@ function parseVersionList(raw) {
   }
   return versions.length > 0 ? versions : undefined;
 }
-// src/services/prompt-service.ts
-import { checkbox, confirm, select } from "@inquirer/prompts";
 
-class PromptServiceImpl {
-  async select(message, choices, defaultValue) {
-    return select({ message, choices, default: defaultValue });
-  }
-  async checkbox(message, choices) {
-    return checkbox({ message, choices });
-  }
-  async confirm(message, defaultValue) {
-    return confirm({ message, default: defaultValue });
-  }
-  async confirm3(message, defaultValue) {
-    return select({
-      message,
-      default: defaultValue,
-      choices: [
-        { value: "yes", name: "Yes" },
-        { value: "no", name: "No" },
-        {
-          value: "always",
-          name: "Yes to all",
-          description: "Skip confirmation for remaining agents"
-        }
-      ]
-    });
-  }
-}
 // src/services/refreshing-githits-service.ts
 class RefreshingGitHitsService {
   apiUrl;
   tokenProvider;
   serviceFactory;
-  constructor(apiUrl, tokenProvider, serviceFactory = (url, token) => new GitHitsServiceImpl(url, token)) {
+  runtime;
+  constructor(apiUrl, tokenProvider, serviceFactory, runtime = {}) {
     this.apiUrl = apiUrl;
     this.tokenProvider = tokenProvider;
     this.serviceFactory = serviceFactory;
+    this.runtime = runtime;
   }
   async search(params) {
     return this.withTokenRefresh((service) => service.search(params));
@@ -6317,12 +6127,13 @@ class RefreshingGitHitsService {
       forceRefresh: () => this.tokenProvider.forceRefresh(),
       shouldRefresh: (error) => error instanceof AuthenticationError,
       executeWithToken: async (token) => {
-        const service = this.serviceFactory(this.apiUrl, token);
+        const service = this.serviceFactory ? this.serviceFactory(this.apiUrl, token) : new GitHitsServiceImpl(this.apiUrl, token, undefined, undefined, this.runtime);
         return operation(service);
       }
     });
   }
 }
+
 // src/services/token-manager.ts
 var PROACTIVE_REFRESH_RATIO = 0.9;
 function shouldRefreshToken(token, ratio, now) {
@@ -6361,11 +6172,19 @@ class TokenManager {
   }
   async getToken() {
     return withTelemetrySpan("token-manager.get-token", async () => {
-      if (this.forceRefreshPromise) {
-        return (await this.forceRefreshPromise).accessToken;
+      const activeForceRefresh = this.forceRefreshPromise;
+      if (activeForceRefresh) {
+        return (await activeForceRefresh).accessToken;
       }
       if (!this.cachedToken) {
-        this.cachedToken = await withTelemetrySpan("token-manager.load-tokens", () => this.authStorage.loadTokens(this.mcpUrl));
+        const storedToken = await withTelemetrySpan("token-manager.load-tokens", () => this.authStorage.loadTokens(this.mcpUrl));
+        const startedForceRefresh = this.forceRefreshPromise;
+        if (startedForceRefresh) {
+          return (await startedForceRefresh).accessToken;
+        }
+        if (!this.cachedToken) {
+          this.cachedToken = storedToken;
+        }
         if (!this.cachedToken)
           return;
       }
@@ -6374,9 +6193,7 @@ class TokenManager {
       if (!shouldRefresh) {
         return currentToken;
       }
-      const refreshedToken = await this.doRefresh({
-        allowFreshExternalToken: true
-      });
+      const refreshedToken = await this.refreshFromGetToken();
       if (refreshedToken) {
         return refreshedToken;
       }
@@ -6387,48 +6204,52 @@ class TokenManager {
     });
   }
   async forceRefresh() {
-    return withTelemetrySpan("token-manager.force-refresh", () => this.doRefresh({ allowFreshExternalToken: false }));
+    return withTelemetrySpan("token-manager.force-refresh", () => this.refreshAfterAuthFailure());
   }
-  async doRefresh(options) {
-    const result = await this.doRefreshResult(options);
+  async refreshFromGetToken() {
+    const result = await this.softRefresh();
     return result.accessToken;
   }
-  async doRefreshResult(options) {
-    if (!options.allowFreshExternalToken) {
-      if (this.forceRefreshPromise)
-        return this.forceRefreshPromise;
-      this.forceRefreshPromise = (async () => {
-        const softResult = await this.softRefreshPromise?.catch(() => {
-          return;
-        });
-        if (softResult?.accessToken && softResult.refreshedViaEndpoint) {
-          return softResult;
-        }
-        return this.executeRefresh(options);
-      })();
-      try {
-        return await this.forceRefreshPromise;
-      } finally {
-        this.forceRefreshPromise = null;
-      }
-    }
+  async softRefresh() {
     if (this.forceRefreshPromise)
       return this.forceRefreshPromise;
     if (this.softRefreshPromise)
       return this.softRefreshPromise;
-    this.softRefreshPromise = this.executeRefresh(options);
+    this.softRefreshPromise = this.executeRefresh();
     try {
       return await this.softRefreshPromise;
     } finally {
       this.softRefreshPromise = null;
     }
   }
-  async executeRefresh(options) {
-    return withTelemetrySpan("token-manager.refresh", async () => {
+  async refreshAfterAuthFailure() {
+    const result = await this.forceEndpointRefresh();
+    return result.accessToken;
+  }
+  async forceEndpointRefresh() {
+    if (this.forceRefreshPromise)
+      return this.forceRefreshPromise;
+    this.forceRefreshPromise = (async () => {
+      const softResult = await this.softRefreshPromise?.catch(() => {
+        return;
+      });
+      if (softResult?.accessToken && softResult.refreshedViaEndpoint) {
+        return softResult;
+      }
+      return this.executeRefresh();
+    })();
+    try {
+      return await this.forceRefreshPromise;
+    } finally {
+      this.forceRefreshPromise = null;
+    }
+  }
+  async executeRefresh() {
+    return withAuthStorageLock(this.authStorage, () => withTelemetrySpan("token-manager.refresh", async () => {
       const candidate = await this.loadRefreshCandidate();
       if (!candidate)
         return refreshResult(undefined, false);
-      if (candidate.externallyUpdated && options.allowFreshExternalToken) {
+      if (candidate.externallyUpdated) {
         const { shouldRefresh } = shouldRefreshToken(candidate.tokens, PROACTIVE_REFRESH_RATIO, new Date);
         if (!shouldRefresh)
           return refreshResult(candidate.tokens.accessToken, false);
@@ -6481,7 +6302,7 @@ class TokenManager {
       }
       this.cachedToken = newTokenData;
       return refreshResult(response.accessToken, true);
-    });
+    }));
   }
   async resolveSuccessfulRefreshConflict(refreshedFrom, response, newTokenData) {
     const currentToken = await withTelemetrySpan("token-manager.reload-tokens", () => this.authStorage.loadTokens(this.mcpUrl));
@@ -6534,330 +6355,139 @@ function areSameTokenData(a, b) {
 function refreshResult(accessToken, refreshedViaEndpoint) {
   return { accessToken, refreshedViaEndpoint };
 }
-// src/services/update-check-service.ts
-import semver from "semver";
-var NPM_DIST_TAGS_URL = "https://registry.npmjs.org/-/package/githits/dist-tags";
-var NPM_PACKAGE_VERSION_URL = "https://registry.npmjs.org/githits";
-var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
-var FETCH_TIMEOUT_MS = 1000;
-var DIR_MODE3 = 448;
-var UPDATE_COMMAND = "npm i -g githits@latest";
-var MAX_DEPRECATION_REASON_LENGTH = 200;
 
-class NpmRegistryUpdateCheckService {
-  currentVersion;
-  fs;
-  fetcher;
-  env;
-  now;
-  checkIntervalMs;
-  fetchTimeoutMs;
-  configDir;
-  cachePath;
-  constructor(options) {
-    this.currentVersion = options.currentVersion;
-    this.fs = options.fileSystemService;
-    this.fetcher = options.fetcher ?? fetch;
-    this.env = options.env ?? process.env;
-    this.now = options.now ?? (() => new Date);
-    this.checkIntervalMs = options.checkIntervalMs ?? CHECK_INTERVAL_MS;
-    this.fetchTimeoutMs = options.fetchTimeoutMs ?? FETCH_TIMEOUT_MS;
-    this.configDir = this.fs.joinPath(resolveConfigHome(this.env, this.fs), "githits");
-    this.cachePath = this.fs.joinPath(this.configDir, "update-check.json");
-  }
-  async checkForUpdate(signal) {
-    const cache = await this.loadCache();
-    const latestDue = !cache || this.isCheckDue(cache);
-    const currentVersionStatusDue = this.isCurrentVersionStatusDue(cache?.currentVersionStatus);
-    const currentVersionStatus = await this.refreshCurrentVersionStatusIfDue(cache?.currentVersionStatus, signal);
-    const currentVersionStatusChanged = currentVersionStatusDue && !sameCurrentVersionStatus(currentVersionStatus, cache?.currentVersionStatus);
-    if (cache && !latestDue) {
-      if (currentVersionStatusChanged) {
-        await this.saveCache({
-          ...cache,
-          currentVersionStatus
-        });
-      }
-      return this.noticeFromLatest(cache.latestVersion);
-    }
-    const latestVersion = await this.fetchLatestVersion(signal);
-    if (!latestVersion) {
-      if (currentVersionStatusChanged) {
-        await this.saveCache({
-          ...cache,
-          currentVersionStatus
-        });
-      }
-      return this.noticeFromLatest(cache?.latestVersion);
-    }
-    await this.saveCache({
-      checkedAt: this.now().toISOString(),
-      latestVersion,
-      currentVersionStatus
-    });
-    return this.noticeFromLatest(latestVersion);
-  }
-  async refreshRequiredUpdateStatus(signal) {
-    const cache = await this.loadCache();
-    const currentVersionStatusDue = this.isCurrentVersionStatusDue(cache?.currentVersionStatus);
-    const currentVersionStatus = await this.refreshCurrentVersionStatusIfDue(cache?.currentVersionStatus, signal);
-    if (currentVersionStatusDue && !sameCurrentVersionStatus(currentVersionStatus, cache?.currentVersionStatus)) {
-      await this.saveCache({
-        ...cache,
-        currentVersionStatus
-      });
-    }
-  }
-  async getRequiredUpdateNotice() {
-    const cache = await this.loadCache();
-    const status = cache?.currentVersionStatus;
-    if (!status || status.version !== this.currentVersion || !status.deprecatedReason) {
-      return;
-    }
-    return {
-      currentVersion: this.currentVersion,
-      ...cache.latestVersion ? { latestKnownVersion: cache.latestVersion } : {},
-      reason: status.deprecatedReason,
-      updateCommand: formatUpdateCommand(this.env)
-    };
-  }
-  noticeFromLatest(latestVersion) {
-    if (!latestVersion || !semver.valid(latestVersion) || !semver.valid(this.currentVersion) || !semver.gt(latestVersion, this.currentVersion)) {
-      return;
-    }
-    return {
-      currentVersion: this.currentVersion,
-      latestVersion,
-      updateCommand: UPDATE_COMMAND
-    };
-  }
-  isCheckDue(cache) {
-    if (!cache.checkedAt || !cache.latestVersion) {
-      return true;
-    }
-    const checkedAtMs = Date.parse(cache.checkedAt);
-    if (Number.isNaN(checkedAtMs)) {
-      return true;
-    }
-    return this.now().getTime() - checkedAtMs >= this.checkIntervalMs;
-  }
-  isCurrentVersionStatusDue(status) {
-    if (!status || status.version !== this.currentVersion) {
-      return true;
-    }
-    const checkedAtMs = Date.parse(status.checkedAt);
-    if (Number.isNaN(checkedAtMs)) {
-      return true;
-    }
-    return this.now().getTime() - checkedAtMs >= this.checkIntervalMs;
-  }
-  async refreshCurrentVersionStatusIfDue(cached, signal) {
-    const reusableCached = cached?.version === this.currentVersion ? cached : undefined;
-    if (!this.isCurrentVersionStatusDue(reusableCached)) {
-      return reusableCached;
-    }
-    const remote = await this.fetchCurrentVersionStatus(signal);
-    if (!remote) {
-      return reusableCached;
-    }
-    return remote;
-  }
-  async fetchLatestVersion(signal) {
-    try {
-      const timeoutSignal = AbortSignal.timeout(this.fetchTimeoutMs);
-      const response = await this.fetcher(NPM_DIST_TAGS_URL, {
-        signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal
-      });
-      if (!response.ok) {
-        return;
-      }
-      const body = await response.json();
-      if (!body || typeof body !== "object" || typeof body.latest !== "string") {
-        return;
-      }
-      const latest = body.latest;
-      return semver.valid(latest) ? latest : undefined;
-    } catch {
-      return;
-    }
-  }
-  async fetchCurrentVersionStatus(signal) {
-    try {
-      const timeoutSignal = AbortSignal.timeout(this.fetchTimeoutMs);
-      const response = await this.fetcher(`${NPM_PACKAGE_VERSION_URL}/${this.currentVersion}`, {
-        signal: signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal
-      });
-      if (!response.ok) {
-        return;
-      }
-      const body = await response.json();
-      if (!body || typeof body !== "object") {
-        return;
-      }
-      const rawDeprecated = body.deprecated;
-      const deprecatedReason = typeof rawDeprecated === "string" ? sanitizeDeprecationReason(rawDeprecated) : undefined;
-      return {
-        version: this.currentVersion,
-        checkedAt: this.now().toISOString(),
-        ...deprecatedReason ? { deprecatedReason } : {}
-      };
-    } catch {
-      return;
-    }
-  }
-  async loadCache() {
-    try {
-      if (!await this.fs.exists(this.cachePath)) {
-        return;
-      }
-      const raw = await this.fs.readFile(this.cachePath);
-      const parsed = JSON.parse(raw);
-      const currentVersionStatus = parseCurrentVersionStatus(parsed.currentVersionStatus);
-      const hasLatest = typeof parsed.checkedAt === "string" && typeof parsed.latestVersion === "string";
-      if (!hasLatest && !currentVersionStatus) {
-        return;
-      }
-      return {
-        ...hasLatest ? {
-          checkedAt: parsed.checkedAt,
-          latestVersion: parsed.latestVersion
-        } : {},
-        currentVersionStatus
-      };
-    } catch {
-      return;
+// src/shared/request-headers.ts
+import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
+var MAX_HEADER_BYTES = 256;
+var SESSION_ENV_VARS = [
+  "TERM_SESSION_ID",
+  "ITERM_SESSION_ID",
+  "WEZTERM_PANE",
+  "KITTY_PID",
+  "ALACRITTY_SOCKET",
+  "WT_SESSION",
+  "VSCODE_PID",
+  "SUPERSET_PANE_ID",
+  "SUPERSET_WORKSPACE_ID",
+  "STARSHIP_SESSION_KEY",
+  "SSH_CONNECTION"
+];
+var cachedSessionId;
+function resolveRawSessionId(env = process.env, ppid = process.ppid) {
+  for (const key of SESSION_ENV_VARS) {
+    const value = env[key];
+    if (value && value.trim().length > 0) {
+      return value.trim();
     }
   }
-  async saveCache(cache) {
-    try {
-      await this.fs.ensureDir(this.configDir, DIR_MODE3);
-      if (typeof this.fs.atomicWriteFile === "function") {
-        await this.fs.atomicWriteFile(this.cachePath, `${JSON.stringify(cache, null, 2)}
-`);
-        return;
-      }
-      await this.fs.writeFile(this.cachePath, `${JSON.stringify(cache, null, 2)}
-`, 384);
-    } catch {}
-  }
-}
-function resolveConfigHome(env, fs) {
-  const xdgConfigHome = env.XDG_CONFIG_HOME?.trim();
-  if (xdgConfigHome) {
-    return xdgConfigHome;
+  if (typeof ppid === "number" && !Number.isNaN(ppid) && ppid > 0) {
+    return String(ppid);
   }
-  return fs.joinPath(fs.getHomeDir(), ".config");
+  return randomUUID3();
 }
-function shouldRunUpdateCheck(input) {
-  if (input.stderrIsTTY !== true) {
-    return false;
-  }
-  const env = input.env ?? process.env;
-  if (env.CI || env.GITHITS_DISABLE_UPDATE_CHECK) {
-    return false;
-  }
-  if (isHelpOrVersionInvocation(input.args)) {
-    return false;
-  }
-  if (isLikelyEphemeralPackageRunner(env)) {
-    return false;
+function getSessionId(env, ppid) {
+  if (cachedSessionId !== undefined && env === undefined && ppid === undefined) {
+    return cachedSessionId;
   }
-  if (isMcpStdioInvocation(input.args, input.stdinIsTTY === true, input.stdoutIsTTY === true)) {
-    return false;
+  const raw = resolveRawSessionId(env, ppid);
+  const hashed = hashValue(raw);
+  if (env === undefined && ppid === undefined) {
+    cachedSessionId = hashed;
   }
-  return true;
+  return hashed;
 }
-function shouldRunRequiredUpdateEnforcement(input) {
-  if (isHelpOrVersionInvocation(input.args)) {
-    return false;
-  }
-  const env = input.env ?? process.env;
-  if (isLikelyEphemeralPackageRunner(env)) {
-    return false;
-  }
-  return true;
+function hashValue(input) {
+  return createHash2("sha256").update(input).digest("hex").slice(0, 16);
 }
-function formatUpdateNotice(notice) {
-  return `Update available: githits ${notice.currentVersion} -> ${notice.latestVersion}
-Run: ${notice.updateCommand}`;
+var AGENT_PROBES = [
+  { envVar: "OPENCODE", name: "opencode" },
+  { envVar: "CLAUDECODE", name: "claude-code" },
+  { envVar: "CURSOR_TRACE_ID", name: "cursor" },
+  { envVar: "WINDSURF_CONFIG_DIR", name: "windsurf" },
+  { envVar: "ZED_TERM", name: "zed" },
+  { envVar: "VSCODE_PID", name: "vscode" }
+];
+function parseAgentString(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length === 0)
+    return;
+  const slashIndex = trimmed.indexOf("/");
+  if (slashIndex === -1)
+    return { name: trimmed };
+  const name = trimmed.slice(0, slashIndex);
+  const ver = trimmed.slice(slashIndex + 1);
+  if (name.length === 0)
+    return;
+  return { name, version: ver || undefined };
 }
-function formatRequiredUpdateNotice(notice) {
-  const lines = [
-    `Update required: ${notice.reason}`,
-    "",
-    `Installed githits ${notice.currentVersion} is no longer supported.`
-  ];
-  if (notice.latestKnownVersion) {
-    lines.push(`Latest known version: ${notice.latestKnownVersion}`);
-  }
-  lines.push("Update with:", `  ${notice.updateCommand}`);
-  return [...lines].join(`
-`);
+function formatAgentInfo(info) {
+  return info.version ? `${info.name}/${info.version}` : info.name;
 }
-function formatUpdateCommand(env = process.env) {
-  const userAgent = env.npm_config_user_agent ?? "";
-  const execPath = env.npm_execpath ?? "";
-  const signal = `${userAgent} ${execPath}`.toLowerCase();
-  if (signal.includes("pnpm")) {
-    return "pnpm add -g githits@latest";
-  }
-  if (signal.includes("yarn")) {
-    return "yarn global add githits@latest";
+function resolveAgentInfo(env = process.env) {
+  const explicit = env.GITHITS_AGENT;
+  if (explicit && explicit.trim().length > 0) {
+    return parseAgentString(explicit);
   }
-  if (signal.includes("bun")) {
-    return "bun add -g githits@latest";
+  for (const probe of AGENT_PROBES) {
+    const value = env[probe.envVar];
+    if (value && value.trim().length > 0) {
+      return { name: probe.name };
+    }
   }
-  return UPDATE_COMMAND;
+  return;
 }
-function parseCurrentVersionStatus(value) {
-  if (!value || typeof value !== "object") {
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function sanitizeHeaderValue(value) {
+  if (value === undefined || value === null || typeof value !== "string") {
     return;
   }
-  const status = value;
-  if (typeof status.version !== "string") {
+  const cleaned = value.replace(CONTROL_CHARS, "").trim();
+  if (cleaned.length === 0)
     return;
-  }
-  if (typeof status.checkedAt !== "string") {
+  if (Buffer.byteLength(cleaned, "utf8") > MAX_HEADER_BYTES)
     return;
-  }
-  const deprecatedReason = typeof status.deprecatedReason === "string" ? sanitizeDeprecationReason(status.deprecatedReason) : undefined;
-  return {
-    version: status.version,
-    checkedAt: status.checkedAt,
-    ...deprecatedReason ? { deprecatedReason } : {}
-  };
-}
-function sameCurrentVersionStatus(left, right) {
-  return left?.version === right?.version && left?.checkedAt === right?.checkedAt && left?.deprecatedReason === right?.deprecatedReason;
-}
-function sanitizeDeprecationReason(value) {
-  const sanitized = Array.from(value).map((character) => isControlCharacter(character) ? " " : character).join("").replace(/\s+/g, " ").trim().slice(0, MAX_DEPRECATION_REASON_LENGTH).trim();
-  return sanitized.length > 0 ? sanitized : undefined;
-}
-function isControlCharacter(value) {
-  const code = value.charCodeAt(0);
-  return code <= 31 || code >= 127 && code <= 159;
-}
-function isHelpOrVersionInvocation(args) {
-  return args.length === 0 || args[0] === "help" || args.includes("--help") || args.includes("-h") || args.includes("--version") || args.includes("-V");
+  return cleaned;
 }
-function isLikelyEphemeralPackageRunner(env) {
-  const lifecycleEvent = env.npm_lifecycle_event;
-  if (lifecycleEvent === "npx" || lifecycleEvent === "bunx") {
-    return true;
-  }
-  const userAgent = env.npm_config_user_agent ?? "";
-  return env.npm_command === "exec" && (userAgent.startsWith("npm/") || userAgent.startsWith("bun/"));
+function createClientHeaderBuilder(options) {
+  return () => buildClientHeadersWithContext({
+    clientName: options.clientName,
+    clientVersion: options.clientVersion,
+    agentProvider: options.agentProvider,
+    env: options.env,
+    ppid: options.ppid
+  });
 }
-function isMcpStdioInvocation(args, stdinIsTTY, stdoutIsTTY) {
-  const firstTokenIndex = args.findIndex((arg) => !arg.startsWith("-"));
-  if (firstTokenIndex === -1 || args[firstTokenIndex] !== "mcp") {
-    return false;
+function buildClientHeadersWithContext(context) {
+  try {
+    const headers = {};
+    const name = sanitizeHeaderValue(context.clientName);
+    if (name) {
+      headers["x-githits-client-name"] = name;
+    }
+    const safeClientVersion = sanitizeHeaderValue(context.clientVersion);
+    if (safeClientVersion) {
+      headers["x-githits-client-version"] = safeClientVersion;
+    }
+    const agentInfo = context.agentProvider?.() ?? resolveAgentInfo(context.env);
+    if (agentInfo) {
+      const agentValue = sanitizeHeaderValue(formatAgentInfo(agentInfo));
+      if (agentValue) {
+        headers["x-githits-agent"] = agentValue;
+      }
+    }
+    const sessionId = sanitizeHeaderValue(getSessionId(context.env, context.ppid));
+    if (sessionId) {
+      headers["x-githits-session-id"] = sessionId;
+    }
+    return headers;
+  } catch {
+    return {};
   }
-  const remainingArgs = args.slice(firstTokenIndex + 1);
-  return remainingArgs.includes("start") || !stdinIsTTY || !stdoutIsTTY;
 }
+
 // src/container.ts
+var BASE_CLIENT_NAME = "githits-cli";
+var USER_AGENT = `${BASE_CLIENT_NAME}/${version}`;
 async function createAuthStorage(fileSystemService) {
   return withTelemetrySpan("container.create-auth-storage", async () => {
     const authConfig = await loadAuthConfig(fileSystemService);
@@ -6937,12 +6567,22 @@ async function createContainer(options = {}) {
     const fileSystemService = new FileSystemServiceImpl;
     const authService = new AuthServiceImpl;
     const browserService = new BrowserServiceImpl;
+    const clientHeaders = createClientHeaderBuilder({
+      clientName: options.clientName ?? BASE_CLIENT_NAME,
+      clientVersion: version,
+      agentProvider: options.agentProvider
+    });
+    const serviceRuntime = {
+      clientHeaders,
+      userAgent: USER_AGENT,
+      clientVersion: version
+    };
     const envToken = getEnvApiToken();
     if (envToken) {
       const authStorage2 = createAuthStorageForMode(fileSystemService, "keychain");
       const tokenProvider = createStaticTokenProvider(envToken);
-      const codeNavigationService2 = new CodeNavigationServiceImpl(codeNavigationUrl, tokenProvider);
-      const packageIntelligenceService2 = new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenProvider);
+      const codeNavigationService2 = new CodeNavigationServiceImpl(codeNavigationUrl, tokenProvider, globalThis.fetch, serviceRuntime);
+      const packageIntelligenceService2 = new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenProvider, globalThis.fetch, serviceRuntime);
       return {
         authStorage: authStorage2,
         authService,
@@ -6956,7 +6596,7 @@ async function createContainer(options = {}) {
         codeNavigationUrl,
         codeNavigationService: codeNavigationService2,
         packageIntelligenceService: packageIntelligenceService2,
-        githitsService: new GitHitsServiceImpl(apiUrl, envToken)
+        githitsService: new GitHitsServiceImpl(apiUrl, envToken, undefined, undefined, serviceRuntime)
       };
     }
     const authStorage = await createAuthStorage(fileSystemService);
@@ -6965,8 +6605,8 @@ async function createContainer(options = {}) {
     if (resolveStoredToken && apiToken === undefined) {
       await new AuthSessionMetadataStorage(fileSystemService).clear(mcpUrl);
     }
-    const codeNavigationService = new CodeNavigationServiceImpl(codeNavigationUrl, tokenManager);
-    const packageIntelligenceService = new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenManager);
+    const codeNavigationService = new CodeNavigationServiceImpl(codeNavigationUrl, tokenManager, globalThis.fetch, serviceRuntime);
+    const packageIntelligenceService = new PackageIntelligenceServiceImpl(codeNavigationUrl, tokenManager, globalThis.fetch, serviceRuntime);
     return {
       authStorage,
       authService,
@@ -6980,9 +6620,9 @@ async function createContainer(options = {}) {
       codeNavigationUrl,
       codeNavigationService,
       packageIntelligenceService,
-      githitsService: new RefreshingGitHitsService(apiUrl, tokenManager)
+      githitsService: new RefreshingGitHitsService(apiUrl, tokenManager, undefined, serviceRuntime)
     };
   });
 }
 
-export { getAppConfigDirForEnv, getAuthConfigPathForEnv, getAuthFileStorageDirForEnv, getLegacyAuthStorageDirForEnv, getLegacyMacAuthConfigPathForEnv, getLegacyMacAuthFileStorageDirForEnv, AuthConfigError, parseAuthStorageMode, normalizeBaseUrl, CLIENT_UPDATE_REQUIRED_REASON, ClientUpdateRequiredError, debugLog, setMcpClientVersionProvider, setClientMode, isTelemetryEnabled, withTelemetrySpan, startTelemetrySpan, endTelemetrySpan, flushTelemetry, AuthenticationError, CodeNavigationAccessError, CodeNavigationGraphQLError, CodeNavigationIndexingError, CodeNavigationUnresolvableError, MalformedCodeNavigationResponseError, CodeNavigationTargetNotFoundError, CodeNavigationFileNotFoundError, CodeNavigationVersionNotFoundError, CodeNavigationValidationError, CodeNavigationFeatureFlagRequiredError, CodeNavigationNetworkError, CodeNavigationBackendError, DEFAULT_MCP_URL, DEFAULT_API_URL, DEFAULT_CODE_NAV_URL, getCodeNavigationUrl, ExecServiceImpl, FileSystemServiceImpl, AuthStorageLockTimeoutError, AuthStoragePolicyError, PackageIntelligenceAccessError, PackageIntelligenceFeatureFlagRequiredError, PackageIntelligenceNetworkError, PackageIntelligenceBackendError, PackageIntelligenceGraphQLError, PackageIntelligenceTargetNotFoundError, PackageIntelligenceValidationError, PackageIntelligenceVersionNotFoundError, MalformedPackageIntelligenceResponseError, PackageIntelligenceChangelogSourceNotFoundError, PromptServiceImpl, refreshExpiredToken, NpmRegistryUpdateCheckService, shouldRunUpdateCheck, shouldRunRequiredUpdateEnforcement, formatUpdateNotice, formatRequiredUpdateNotice, loadAutoLoginAuthSessionMetadata, clearAutoLoginAuthSessionMetadata, createAuthCommandDependencies, createAuthStatusDependencies, createContainer };
+export { getAppConfigDirForEnv, getAuthConfigPathForEnv, getAuthFileStorageDirForEnv, getLegacyAuthStorageDirForEnv, getLegacyMacAuthConfigPathForEnv, getLegacyMacAuthFileStorageDirForEnv, AuthConfigError, parseAuthStorageMode, AuthStorageLockTimeoutError, AuthStoragePolicyError, isTelemetryEnabled, withTelemetrySpan, startTelemetrySpan, endTelemetrySpan, flushTelemetry, LOCAL_AUTHENTICATION_MISSING_MESSAGE, AuthenticationError, normalizeBaseUrl, debugLog, CLIENT_UPDATE_REQUIRED_REASON, ClientUpdateRequiredError, CodeNavigationAccessError, CodeNavigationGraphQLError, CodeNavigationIndexingError, CodeNavigationUnresolvableError, MalformedCodeNavigationResponseError, CodeNavigationTargetNotFoundError, CodeNavigationFileNotFoundError, CodeNavigationVersionNotFoundError, CodeNavigationValidationError, CodeNavigationFeatureFlagRequiredError, CodeNavigationNetworkError, CodeNavigationBackendError, DEFAULT_MCP_URL, DEFAULT_API_URL, DEFAULT_CODE_NAV_URL, getCodeNavigationUrl, FileSystemServiceImpl, PackageIntelligenceAccessError, PackageIntelligenceFeatureFlagRequiredError, PackageIntelligenceNetworkError, PackageIntelligenceBackendError, PackageIntelligenceGraphQLError, PackageIntelligenceTargetNotFoundError, PackageIntelligenceValidationError, PackageIntelligenceVersionNotFoundError, MalformedPackageIntelligenceResponseError, PackageIntelligenceChangelogSourceNotFoundError, refreshExpiredToken, loadAutoLoginAuthSessionMetadata, clearAutoLoginAuthSessionMetadata, createAuthCommandDependencies, createAuthStatusDependencies, createContainer };