lody 0.89.2 → 0.89.4

package/dist/index.js

@@ -16,25 +16,25 @@ import * as path from "node:path";
 import path__default, { posix as posix$1, basename, win32, join as join$2, resolve as resolve$1, dirname as dirname$1, relative as relative$1, isAbsolute as isAbsolute$2, sep as sep$1, delimiter, normalize } from "node:path";
 import { _ as _coercedNumber, Z as ZodNumber$1, o as object$1, s as string$1, l as literal$1, n as number$4, b as boolean, a as _enum$1, c as array$2, d as discriminatedUnion, e as _instanceof, r as record$1, u as unknown, f as union$7, p as preprocess, g as ZodError$1, h as _null, i as normalizeParams, $ as $constructor, j as $ZodObject, k as defineLazy, m as $ZodType, q as parse$5, t as safeParse$1, v as parseAsync, w as safeParseAsync$1, x as clone$2, y as looseObject, z as intersection, A as optional$1, B as datetime, C as custom$1, D as toJSONSchema, E as ZodOptional$1, F as never$1, G as xor } from "./chunks/schemas-Du3qLZPS.js";
 import require$$0$4, { once as once$1, EventEmitter as EventEmitter$1 } from "node:events";
-import Gx__default, { execFile, spawn as spawn$1, execFileSync } from "node:child_process";
+import Tw__default, { execFile, spawn as spawn$1, execFileSync } from "node:child_process";
 import process$2 from "node:process";
 import tty from "node:tty";
 import * as os from "os";
 import os__default$1 from "os";
 import crypto__default$1, { randomFillSync, randomUUID, createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import require$$0$5, { promisify as promisify$1 } from "util";
-import So, { Transform as Transform$1, Readable as Readable$1 } from "stream";
+import xo, { Transform as Transform$1, Readable as Readable$1 } from "stream";
 import require$$0$6, { Buffer as Buffer$1 } from "buffer";
 import require$$0$7, { EventEmitter as EventEmitter$2 } from "events";
-import * as Ei from "zlib";
-import Ei__default from "zlib";
+import * as Ri from "zlib";
+import Ri__default from "zlib";
 import require$$1$2 from "tty";
 import require$$1$3 from "string_decoder";
 import http from "http";
 import require$$1__default from "https";
 import require$$0$8, { promisify, inspect as inspect$1, stripVTControlCharacters, isDeepStrictEqual } from "node:util";
-import * as Yt from "node:fs/promises";
-import Yt__default, { mkdir as mkdir$1, realpath, symlink, mkdtemp, chmod, writeFile, rm, rename, readFile, readdir, stat, lstat, unlink, open, opendir } from "node:fs/promises";
+import * as Xt from "node:fs/promises";
+import Xt__default, { mkdir as mkdir$1, realpath, symlink, mkdtemp, chmod, writeFile, rm, rename, readFile, readdir, stat, lstat, unlink, open, opendir } from "node:fs/promises";
 import zlib__default, { gzip, gunzip as gunzip$1, gunzipSync, brotliDecompressSync } from "node:zlib";
 import require$$1$8, { exec, execFile as execFile$1, spawn as spawn$2 } from "child_process";
 import { i as imports, _ as __wbg_set_wasm$1, r as rawWasm, L as LoroDoc, E as EphemeralStoreWasm, U as UndoManager, a as isValidContainerId, c as callPendingEvents$3, b as LoroTree, d as LoroText, e as LoroMovableList, f as LoroList, g as LoroMap, V as VersionVector, h as __vite__initWasm, j as decodeImportBlobMeta, __tla as __tla_0 } from "./chunks/loro_wasm_bg-Br-Fa9wV.js";
@@ -62,11 +62,11 @@ import require$$1$5, { fileURLToPath, pathToFileURL } from "node:url";
 import require$$1$6 from "node:console";
 import require$$1$7 from "node:dns";
 import { C as CodeCollabV2FileIndexRequestSchema, a as CodeCollabV2OpenTextRequestSchema, b as CodeCollabV2RefreshTextRequestSchema, c as CodeCollabV2SaveTextRequestSchema, d as CodeCollabV2OpenCurrentDiffRequestSchema, e as CodeCollabV2OpenAllChangesDiffRequestSchema, f as CodeCollabV2OpenTurnDiffRequestSchema, g as CodeCollabV2InitDirectoryRequestSchema, h as CodeCollabV2FileIndexSnapshotSchema, i as CodeCollabV2OpenTextOkSchema, j as CodeCollabV2RefreshTextResponseSchema, k as CodeCollabV2SaveTextResponseSchema, l as CodeCollabV2OpenCurrentDiffResponseSchema, m as CodeCollabV2OpenAllChangesDiffResponseSchema, n as CodeCollabV2OpenTurnDiffResponseSchema, o as CodeCollabV2InitDirectoryOkSchema, p as CodeCollabV2LspUnsupportedSchema, q as CodeCollabV2ErrorSchema, r as CodeCollabV2RpcContentEnvelopeSchema, s as deriveCodeCollabV2ContentKeyId, t as CodeCollabV2ErrorCodeSchema, u as CodeCollabV2RpcResponseSchema, v as deriveCodeCollabV2ContentKeyBytes, w as readCodeCollabFileIndexSignalFromFlock, x as writeCodeCollabFileIndexSignalToFlock, y as writeCodeCollabFileIndexToFlock, z as buildCodeCollabFileIndexState, A as CODE_COLLAB_V2_TEXT_LIMITS, B as CODE_COLLAB_V2_ALL_CHANGES_DIFF_LIMITS, D as computeAllChanges, E as codeCollabFileIndexStatesEqual, F as scanGitDirectoryEntries, G as closeDirectoryQuietly } from "./chunks/directory-handle-Bp47LF5g.js";
-import { C as ClientSideConnection, P as PROTOCOL_VERSION, n as ndJsonStream } from "./chunks/acp-CrvzLY5A.js";
+import { C as ClientSideConnection, P as PROTOCOL_VERSION, n as ndJsonStream, c as client$2, m as methods$1 } from "./chunks/acp-DBqkNziA.js";
 import { StringDecoder } from "node:string_decoder";
 import { L as LODY_EXTENSION_METHODS, n as normalizeLodyExtensionMethod } from "./chunks/methods-CvEDMahD.js";
 import { pipeline, finished } from "node:stream/promises";
-import { p as packageJson } from "./chunks/package-4KuPYsnp.js";
+import { p as packageJson } from "./chunks/package-DlotPnLa.js";
 import { r as runtimeManifest } from "./chunks/runtime-manifest-DnyvD_EC.js";
 import { AsyncLocalStorage as AsyncLocalStorage$1 } from "async_hooks";
 import { createRequire } from "module";
@@ -4325,7 +4325,7 @@ Upgrade Node, then re-run: npx lody@latest`;
   }
   const name$2 = "lody";
   const name$1 = "@lody/cli-cloud";
-  const version$9 = "0.89.2";
+  const version$9 = "0.89.4";
   const type$2 = "module";
   const scripts = {
     "dev": "node dev.mjs",
@@ -4878,7 +4878,7 @@ Upgrade Node, then re-run: npx lody@latest`;
     },
     {
       id: "default",
-      name: "Default",
+      name: "Manual",
       description: "Standard behavior, prompts for dangerous operations"
     },
     {
@@ -4895,33 +4895,38 @@ Upgrade Node, then re-run: npx lody@latest`;
       id: "dontAsk",
       name: "Don't Ask",
       description: "Don't prompt for permissions, deny if not pre-approved"
+    },
+    {
+      id: "bypassPermissions",
+      name: "Bypass Permissions",
+      description: "Bypass all permission checks"
     }
   ];
   const CLAUDE_STATIC_MODELS = [
     {
       modelId: "default",
-      name: "Default",
-      description: "Claude Code default model"
+      name: "Default (recommended)",
+      description: "Opus (1M context)"
     },
     {
-      modelId: "opus",
-      name: "Opus",
-      description: "Claude Opus"
+      modelId: "opus[1m]",
+      name: "Opus (1M context)",
+      description: "Opus 5 with 1M context \xB7 Best for everyday, complex tasks"
     },
     {
-      modelId: "claude-fable-5[1m]",
+      modelId: "claude-fable-5-1[1m]",
       name: "Fable",
-      description: "Claude Fable 5 with 1M context"
+      description: "Fable 5.1 \xB7 Most capable for your hardest and longest-running tasks"
     },
     {
       modelId: "sonnet",
       name: "Sonnet",
-      description: "Claude Sonnet"
+      description: "Sonnet 5 \xB7 Efficient for routine tasks"
     },
     {
       modelId: "haiku",
       name: "Haiku",
-      description: "Claude Haiku"
+      description: "Haiku 4.5 \xB7 Fastest for quick answers"
     }
   ];
   [
@@ -4974,8 +4979,25 @@ Upgrade Node, then re-run: npx lody@latest`;
         {
           value: "high",
           name: "High"
+        },
+        {
+          value: "xhigh",
+          name: "Xhigh"
+        },
+        {
+          value: "max",
+          name: "Max"
         }
       ]
+    },
+    {
+      id: "fast",
+      name: "Fast mode",
+      description: "Faster responses on supported models",
+      category: "model_config",
+      type: "boolean",
+      currentValue: false,
+      options: []
     }
   ];
   const KIMI_STATIC_MODES = [
@@ -5892,6 +5914,16 @@ Requirements:
     "ANTHROPIC_VERTEX_PROJECT_ID"
   ];
   const hasBuiltinEnvAuthentication = (agentType, env2) => agentType === "claude" && CLAUDE_ENV_AUTH_KEYS.some((key2) => Boolean(env2?.[key2]?.trim()));
+  const ACP_AUTH_METHOD_MAX_COUNT = 32;
+  const ACP_AUTH_FORM_FIELD_MAX_COUNT = 32;
+  const ACP_AUTH_SELECT_OPTION_MAX_COUNT = 256;
+  const ACP_AUTH_ID_MAX_LENGTH = 1024;
+  const ACP_AUTH_LABEL_MAX_LENGTH = 4096;
+  const ACP_AUTH_TEXT_MAX_LENGTH = 16384;
+  const ACP_AUTHORIZATION_URL_MAX_LENGTH = 8192;
+  const ACP_AUTHENTICATION_FORM_MAX_BYTES = 256 * 1024;
+  const textEncoder$5 = new TextEncoder();
+  const isAcpAuthenticationFormWithinByteLimit = (form) => textEncoder$5.encode(JSON.stringify(form)).byteLength <= ACP_AUTHENTICATION_FORM_MAX_BYTES;
   function getMapFieldSchema(schema2, key2) {
     if (!schema2) return void 0;
     if (Object.prototype.hasOwnProperty.call(schema2.definition, key2)) {
@@ -10917,6 +10949,12 @@ Requirements:
     url: schema.String(),
     number: schema.Number()
   });
+  const agentRoleIdSchema = schema.String({
+    required: false
+  }).transform({
+    decode: (value) => value,
+    encode: (value) => value
+  });
   const acpSessionConfigSchema = schema.LoroMap({
     prompt: schema.String(),
     inputBlocks: schema.Any({
@@ -10945,6 +10983,10 @@ Requirements:
     taskToolsEnabled: schema.Boolean({
       required: false
     }),
+    agentRoleId: agentRoleIdSchema,
+    agentRoleRevision: schema.Number({
+      required: false
+    }),
     chainDepth: schema.Number({
       required: false
     })
@@ -12079,6 +12121,8 @@ Requirements:
     configOptionValues: AcpConfigOptionValuesSchema.optional(),
     mcpServerIds: array$2(string$1()).optional(),
     taskToolsEnabled: boolean().optional(),
+    agentRoleId: string$1().trim().min(1).nullable().optional(),
+    agentRoleRevision: number$4().int().nonnegative().optional(),
     issuePRMentions: array$2(IssuePRMentionSchema).optional(),
     resume: ACPSessionIdSchema.optional(),
     chainDepth: number$4().int().nonnegative().optional()
@@ -12095,6 +12139,8 @@ Requirements:
     configOptionValues: AcpConfigOptionValuesSchema.optional(),
     mcpServerIds: array$2(string$1()).optional(),
     taskToolsEnabled: boolean().optional(),
+    agentRoleId: string$1().trim().min(1).nullable().optional(),
+    agentRoleRevision: number$4().int().nonnegative().optional(),
     issuePRMentions: array$2(IssuePRMentionSchema).optional(),
     resume: ACPSessionIdSchema.optional(),
     chainDepth: number$4().int().nonnegative().optional()
@@ -12166,6 +12212,18 @@ Requirements:
     if (taskToolsEnabled !== void 0) {
       normalized.taskToolsEnabled = taskToolsEnabled;
     }
+    if (record2.agentRoleId === null) {
+      normalized.agentRoleId = null;
+    } else {
+      const agentRoleId = trimOptionalString(record2.agentRoleId);
+      if (agentRoleId) {
+        normalized.agentRoleId = agentRoleId;
+      }
+    }
+    const agentRoleRevision = maybeParseField(number$4().int().nonnegative(), record2.agentRoleRevision);
+    if (agentRoleRevision !== void 0) {
+      normalized.agentRoleRevision = agentRoleRevision;
+    }
     const issuePRMentions = maybeParseField(array$2(IssuePRMentionSchema), record2.issuePRMentions);
     if (issuePRMentions) {
       normalized.issuePRMentions = issuePRMentions;
@@ -12681,21 +12739,101 @@ Requirements:
       "env_var",
       "terminal"
     ]),
-    id: string$1().optional(),
-    name: string$1().optional(),
-    description: string$1().optional(),
-    args: array$2(string$1()).optional()
+    id: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH).optional(),
+    name: string$1().max(ACP_AUTH_LABEL_MAX_LENGTH).optional(),
+    description: string$1().max(ACP_AUTH_TEXT_MAX_LENGTH).optional(),
+    args: array$2(string$1().max(ACP_AUTH_LABEL_MAX_LENGTH)).max(64).optional()
   }).strict();
+  const MachineAcpAuthenticationFormFieldSchema = discriminatedUnion("type", [
+    object$1({
+      id: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH),
+      type: literal$1("text"),
+      label: string$1().trim().min(1).max(ACP_AUTH_LABEL_MAX_LENGTH),
+      description: string$1().max(ACP_AUTH_TEXT_MAX_LENGTH).optional(),
+      required: boolean(),
+      defaultValue: string$1().max(ACP_AUTH_TEXT_MAX_LENGTH).optional()
+    }).strict(),
+    object$1({
+      id: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH),
+      type: literal$1("secret"),
+      label: string$1().trim().min(1).max(ACP_AUTH_LABEL_MAX_LENGTH),
+      description: string$1().max(ACP_AUTH_TEXT_MAX_LENGTH).optional(),
+      required: boolean()
+    }).strict(),
+    object$1({
+      id: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH),
+      type: literal$1("select"),
+      label: string$1().trim().min(1).max(ACP_AUTH_LABEL_MAX_LENGTH),
+      description: string$1().max(ACP_AUTH_TEXT_MAX_LENGTH).optional(),
+      required: boolean(),
+      options: array$2(object$1({
+        value: string$1().min(1).max(ACP_AUTH_TEXT_MAX_LENGTH),
+        label: string$1().trim().min(1).max(ACP_AUTH_LABEL_MAX_LENGTH)
+      }).strict()).min(1).max(ACP_AUTH_SELECT_OPTION_MAX_COUNT),
+      defaultValue: string$1().max(ACP_AUTH_TEXT_MAX_LENGTH).optional()
+    }).strict()
+  ]);
+  const MachineAcpAuthenticationFormSchema = object$1({
+    title: string$1().max(ACP_AUTH_LABEL_MAX_LENGTH).optional(),
+    description: string$1().max(ACP_AUTH_TEXT_MAX_LENGTH).optional(),
+    fields: array$2(MachineAcpAuthenticationFormFieldSchema).min(1).max(ACP_AUTH_FORM_FIELD_MAX_COUNT)
+  }).strict().superRefine((value, context2) => {
+    if (!isAcpAuthenticationFormWithinByteLimit(value)) {
+      context2.addIssue({
+        code: "custom",
+        message: "Authentication form exceeds the serialized size limit"
+      });
+    }
+    const fieldIds = /* @__PURE__ */ new Set();
+    value.fields.forEach((field, fieldIndex) => {
+      if (fieldIds.has(field.id)) {
+        context2.addIssue({
+          code: "custom",
+          path: [
+            "fields",
+            fieldIndex,
+            "id"
+          ],
+          message: "Authentication form field ids must be unique"
+        });
+      }
+      fieldIds.add(field.id);
+      if (field.type !== "select") return;
+      const optionValues = /* @__PURE__ */ new Set();
+      field.options.forEach((option2, optionIndex) => {
+        if (optionValues.has(option2.value)) {
+          context2.addIssue({
+            code: "custom",
+            path: [
+              "fields",
+              fieldIndex,
+              "options",
+              optionIndex,
+              "value"
+            ],
+            message: "Authentication select option values must be unique"
+          });
+        }
+        optionValues.add(option2.value);
+      });
+      if (field.defaultValue !== void 0 && !optionValues.has(field.defaultValue)) {
+        context2.addIssue({
+          code: "custom",
+          path: [
+            "fields",
+            fieldIndex,
+            "defaultValue"
+          ],
+          message: "Authentication select default must match an option"
+        });
+      }
+    });
+  });
   const MachineAcpCapabilitiesRefreshRequestSchema = object$1({
     type: literal$1("machine/acp-capabilities-refresh"),
     machineId: MachineIdSchema$1,
     workspaceId: WorkspaceIdSchema,
-    configId: AgentConfigIdSchema,
-    cliType: AgentConfigCliTypeSchema,
-    agentType: string$1().trim().min(1),
-    customAcp: CustomAcpLaunchSpecSchema.optional(),
-    runtimeOverrides: BuiltinRuntimeOverridesSchema.optional(),
-    env: record$1(string$1(), string$1()).optional()
+    configId: AgentConfigIdSchema
   }).strict();
   const MachineAcpCapabilitiesRefreshResponseSchema = object$1({
     type: literal$1("machine/acp-capabilities-refresh_response"),
@@ -12717,55 +12855,36 @@ Requirements:
       description: string$1().optional()
     })).optional(),
     authRequired: boolean().optional(),
-    authMethods: array$2(MachineAcpAuthMethodSummarySchema).optional(),
+    authMethods: array$2(MachineAcpAuthMethodSummarySchema).max(ACP_AUTH_METHOD_MAX_COUNT).optional(),
     error: string$1().optional()
   }).strict();
-  const MachineAcpAuthenticateRequestSchema = object$1({
+  const MachineAcpAuthenticateRequestBaseSchema = object$1({
     type: literal$1("machine/acp-authenticate"),
     machineId: MachineIdSchema$1,
     workspaceId: WorkspaceIdSchema,
-    requestId: string$1().trim().min(1),
-    action: _enum$1([
-      "start",
-      "cancel",
-      "submit-code"
-    ]),
-    authenticationRequestId: string$1().trim().min(1).optional(),
-    authorizationCode: string$1().trim().min(1).max(4096).optional(),
-    methodId: string$1().trim().min(1).max(256).optional(),
-    configId: AgentConfigIdSchema.optional(),
-    cliType: AgentConfigCliTypeSchema,
-    agentType: string$1().trim().min(1),
-    customAcp: CustomAcpLaunchSpecSchema.optional(),
-    runtimeOverrides: BuiltinRuntimeOverridesSchema.optional(),
-    env: record$1(string$1(), string$1()).optional()
-  }).strict().superRefine((value, context2) => {
-    if (value.action === "submit-code") {
-      if (!value.authenticationRequestId) {
-        context2.addIssue({
-          code: "custom",
-          path: [
-            "authenticationRequestId"
-          ],
-          message: "authenticationRequestId is required when submitting an authorization code"
-        });
-      }
-      if (!value.authorizationCode) {
-        context2.addIssue({
-          code: "custom",
-          path: [
-            "authorizationCode"
-          ],
-          message: "authorizationCode is required when submitting an authorization code"
-        });
-      }
-    } else if (value.authenticationRequestId || value.authorizationCode) {
-      context2.addIssue({
-        code: "custom",
-        message: "Authorization-code fields are only valid for submit-code"
-      });
-    }
+    requestId: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH)
   });
+  const MachineAcpAuthenticateRequestSchema = discriminatedUnion("action", [
+    MachineAcpAuthenticateRequestBaseSchema.extend({
+      action: literal$1("start"),
+      configId: AgentConfigIdSchema
+    }).strict(),
+    MachineAcpAuthenticateRequestBaseSchema.extend({
+      action: literal$1("cancel"),
+      authenticationRequestId: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH)
+    }).strict(),
+    MachineAcpAuthenticateRequestBaseSchema.extend({
+      action: literal$1("submit-code"),
+      authenticationRequestId: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH),
+      authorizationCode: string$1().trim().min(1).max(ACP_AUTH_LABEL_MAX_LENGTH)
+    }).strict(),
+    MachineAcpAuthenticateRequestBaseSchema.extend({
+      action: literal$1("submit-input"),
+      authenticationRequestId: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH),
+      interactionId: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH),
+      authenticationInput: string$1().min(1).max(65536)
+    }).strict()
+  ]);
   const MachineAcpAuthenticateResponseSchema = object$1({
     type: literal$1("machine/acp-authenticate_response"),
     machineId: MachineIdSchema$1,
@@ -12782,7 +12901,7 @@ Requirements:
     ]),
     capabilitiesRefreshed: boolean().optional(),
     authRequired: boolean().optional(),
-    authMethods: array$2(MachineAcpAuthMethodSummarySchema).optional(),
+    authMethods: array$2(MachineAcpAuthMethodSummarySchema).max(ACP_AUTH_METHOD_MAX_COUNT).optional(),
     error: string$1().optional()
   }).strict();
   const MachineAcpAuthenticationProgressMessageSchema = object$1({
@@ -12792,23 +12911,34 @@ Requirements:
     agentType: string$1().trim().min(1),
     status: _enum$1([
       "starting",
+      "auth-methods",
       "authorization",
+      "input-required",
       "output",
       "authenticated",
       "cancelled",
       "error"
     ]),
-    authorizationUrl: string$1().url().max(8192).optional(),
+    authMethods: array$2(MachineAcpAuthMethodSummarySchema).max(ACP_AUTH_METHOD_MAX_COUNT).optional(),
+    interactionId: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH).optional(),
+    message: string$1().max(ACP_AUTH_TEXT_MAX_LENGTH).optional(),
+    form: MachineAcpAuthenticationFormSchema.optional(),
+    authorizationUrl: string$1().url().max(ACP_AUTHORIZATION_URL_MAX_LENGTH).refine((value) => {
+      const protocol = new URL(value).protocol;
+      return protocol === "https:" || protocol === "http:";
+    }, "authorizationUrl must use http or https").optional(),
     userCode: string$1().trim().min(1).max(128).optional(),
     acceptsAuthorizationCode: boolean().optional(),
     authorizationCodePublicKey: RpcSecretPublicKeySchema.optional(),
+    authenticationInputPublicKey: RpcSecretPublicKeySchema.optional(),
+    requiresAuthorizationConsent: boolean().optional(),
     expiresInSeconds: number$4().int().positive().optional(),
     stream: _enum$1([
       "stdout",
       "stderr"
     ]).optional(),
-    output: string$1().optional(),
-    error: string$1().optional()
+    output: string$1().max(16384).optional(),
+    error: string$1().max(65536).optional()
   }).strict().superRefine((value, context2) => {
     if (value.status === "authorization" && !value.authorizationUrl) {
       context2.addIssue({
@@ -12819,6 +12949,33 @@ Requirements:
         message: "authorizationUrl is required for authorization progress"
       });
     }
+    if (value.status === "auth-methods" && (!value.interactionId || !value.authMethods?.length || value.authMethods.some((method) => !method.id || method.type !== "agent") || new Set(value.authMethods.map((method) => method.id)).size !== value.authMethods.length)) {
+      context2.addIssue({
+        code: "custom",
+        path: [
+          "authMethods"
+        ],
+        message: "auth-methods progress requires an interaction and methods with ids"
+      });
+    }
+    if (value.status === "input-required" && (!value.interactionId || !value.form)) {
+      context2.addIssue({
+        code: "custom",
+        path: [
+          "form"
+        ],
+        message: "input-required progress requires an interaction and form"
+      });
+    }
+    if (value.status === "authorization" && value.requiresAuthorizationConsent && !value.interactionId) {
+      context2.addIssue({
+        code: "custom",
+        path: [
+          "interactionId"
+        ],
+        message: "URL consent requires an interaction id"
+      });
+    }
   });
   const MachineAcpBinaryStatusRequestSchema = object$1({
     type: literal$1("machine/acp-binary-status"),
@@ -14103,6 +14260,7 @@ Requirements:
     "acp_auth_required",
     "acp_internal_error",
     "acp_upstream_api_error",
+    "acp_provider_overloaded",
     "acp_session_storage_incompatible",
     "acp_resource_not_found",
     "acp_request_cancelled",
@@ -18436,6 +18594,13 @@ ${outputTail}` : blockTail.output;
       "~/.cursor/skills"
     ]),
     deepagents: skillDirs([], []),
+    deepseek: skillDirs([
+      DEFAULT_PROJECT_SKILL_DIR,
+      ".dsh/skills"
+    ], [
+      "~/.dsh/skills",
+      DEFAULT_AGENTS_GLOBAL_SKILL_DIR
+    ]),
     devin: skillDirs([
       ".devin/skills",
       ".windsurf/skills"
@@ -18519,6 +18684,17 @@ ${outputTail}` : blockTail.output;
       "~/.config/goose/skills",
       DEFAULT_AGENTS_GLOBAL_SKILL_DIR
     ]),
+    grok: skillDirs([
+      DEFAULT_PROJECT_SKILL_DIR,
+      ".grok/skills",
+      CLAUDE_PROJECT_SKILL_DIR,
+      ".cursor/skills"
+    ], [
+      "~/.grok/skills",
+      DEFAULT_AGENTS_GLOBAL_SKILL_DIR,
+      CLAUDE_GLOBAL_SKILL_DIR,
+      "~/.cursor/skills"
+    ]),
     "hermes-agent": skillDirs([
       ".hermes/skills"
     ], [
@@ -18577,16 +18753,25 @@ ${outputTail}` : blockTail.output;
     ]),
     kimi: skillDirs([
       DEFAULT_PROJECT_SKILL_DIR,
-      ".kimi/skills"
-    ], []),
+      ".kimi-code/skills"
+    ], [
+      "~/.kimi-code/skills",
+      DEFAULT_AGENTS_GLOBAL_SKILL_DIR
+    ]),
     "kimi-code": skillDirs([
       DEFAULT_PROJECT_SKILL_DIR,
-      ".kimi/skills"
-    ], []),
+      ".kimi-code/skills"
+    ], [
+      "~/.kimi-code/skills",
+      DEFAULT_AGENTS_GLOBAL_SKILL_DIR
+    ]),
     "kimi-code-cli": skillDirs([
       DEFAULT_PROJECT_SKILL_DIR,
-      ".kimi/skills"
-    ], []),
+      ".kimi-code/skills"
+    ], [
+      "~/.kimi-code/skills",
+      DEFAULT_AGENTS_GLOBAL_SKILL_DIR
+    ]),
     kode: skillDirs([
       ".kode/skills"
     ], [
@@ -18656,13 +18841,15 @@ ${outputTail}` : blockTail.output;
       DEFAULT_PROJECT_SKILL_DIR,
       ".pi/skills"
     ], [
-      "~/.pi/agent/skills"
+      "~/.pi/agent/skills",
+      DEFAULT_AGENTS_GLOBAL_SKILL_DIR
     ]),
     "pi-acp": skillDirs([
       DEFAULT_PROJECT_SKILL_DIR,
       ".pi/skills"
     ], [
-      "~/.pi/agent/skills"
+      "~/.pi/agent/skills",
+      DEFAULT_AGENTS_GLOBAL_SKILL_DIR
     ]),
     pochi: skillDirs([
       ".pochi/skills"
@@ -20685,14 +20872,17 @@ ${tailedOutput}` : null;
     return parsed;
   };
   const MACHINE_PROTOCOL_CAPABILITIES = {
+    acpAuthenticationInteractions: "acpAuthenticationInteractions",
     localProjectRemoval: "localProjectRemoval",
     providerSetup: "providerSetup",
     acpProtocolAuthentication: "acpProtocolAuthentication"
   };
+  const ACP_AUTHENTICATION_INTERACTIONS_PROTOCOL_VERSION = 2;
   const LOCAL_PROJECT_REMOVAL_PROTOCOL_VERSION = 1;
   const PROVIDER_SETUP_PROTOCOL_VERSION = 1;
-  const ACP_PROTOCOL_AUTHENTICATION_VERSION = 1;
+  const ACP_PROTOCOL_AUTHENTICATION_VERSION = 2;
   const CURRENT_MACHINE_PROTOCOL_CAPABILITIES = {
+    [MACHINE_PROTOCOL_CAPABILITIES.acpAuthenticationInteractions]: ACP_AUTHENTICATION_INTERACTIONS_PROTOCOL_VERSION,
     [MACHINE_PROTOCOL_CAPABILITIES.localProjectRemoval]: LOCAL_PROJECT_REMOVAL_PROTOCOL_VERSION,
     [MACHINE_PROTOCOL_CAPABILITIES.providerSetup]: PROVIDER_SETUP_PROTOCOL_VERSION,
     [MACHINE_PROTOCOL_CAPABILITIES.acpProtocolAuthentication]: ACP_PROTOCOL_AUTHENTICATION_VERSION
@@ -20713,6 +20903,29 @@ ${tailedOutput}` : null;
     }
     return false;
   };
+  const collectSessionConversationSources = (history, messageQueue = []) => {
+    const sources = [];
+    for (let index = messageQueue.length - 1; index >= 0; index -= 1) {
+      const item = messageQueue[index];
+      const itemId = typeof item?.$cid === "string" ? item.$cid : String(index);
+      const userTurnId = typeof item?.userTurnId === "string" && item.userTurnId.trim() ? item.userTurnId.trim() : null;
+      sources.push({
+        value: item?.acpSessionConfig,
+        configKey: `queue:${itemId}`,
+        turnKey: `turn:${userTurnId ?? `queued-${itemId}`}`
+      });
+    }
+    for (let index = history.length - 1; index >= 0; index -= 1) {
+      const entry = history[index];
+      if (entry?.role !== "user") continue;
+      sources.push({
+        value: entry.inputConfig,
+        configKey: `history:${entry.id}`,
+        turnKey: `turn:${entry.id}`
+      });
+    }
+    return sources;
+  };
   const resolveSessionConversationConfig = (history, messageQueue = []) => {
     const resolveConfig = (value, sourceConfigKey) => {
       const inputConfig = normalizeSessionTurnInputConfig(value);
@@ -20735,23 +20948,32 @@ ${tailedOutput}` : null;
         } : {},
         ...typeof inputConfig.taskToolsEnabled === "boolean" ? {
           taskToolsEnabled: inputConfig.taskToolsEnabled
+        } : {},
+        ...inputConfig.agentRoleId !== void 0 ? {
+          agentRoleId: inputConfig.agentRoleId
+        } : {},
+        ...typeof inputConfig.agentRoleId === "string" && inputConfig.agentRoleRevision !== void 0 ? {
+          agentRoleRevision: inputConfig.agentRoleRevision
         } : {}
       };
     };
-    const latestQueuedIndex = messageQueue.length - 1;
-    if (latestQueuedIndex >= 0) {
-      const item = messageQueue[latestQueuedIndex];
-      const itemId = typeof item?.$cid === "string" ? item.$cid : String(latestQueuedIndex);
-      return resolveConfig(item?.acpSessionConfig, `queue:${itemId}`) ?? {};
-    }
-    for (let index = history.length - 1; index >= 0; index -= 1) {
-      const entry = history[index];
-      if (entry?.role !== "user") {
-        continue;
-      }
-      return resolveConfig(entry.inputConfig, `history:${entry.id}`) ?? {};
+    const sources = collectSessionConversationSources(history, messageQueue);
+    const latest2 = sources[0];
+    if (!latest2) return {};
+    const resolved = resolveConfig(latest2.value, latest2.configKey) ?? {};
+    if (resolved.agentRoleId !== void 0) return resolved;
+    for (const source of sources.slice(1)) {
+      const older = normalizeSessionTurnInputConfig(source.value);
+      if (!older || older.agentRoleId === void 0) continue;
+      return {
+        ...resolved,
+        agentRoleId: older.agentRoleId,
+        ...older.agentRoleId !== null && older.agentRoleRevision !== void 0 ? {
+          agentRoleRevision: older.agentRoleRevision
+        } : {}
+      };
     }
-    return {};
+    return resolved;
   };
   const resolveSessionMcpSelection = (history, messageQueue = []) => resolveSessionConversationConfig(history, messageQueue).mcpServerIds ?? [];
   const resolveSessionTaskToolsEnabled = (history, messageQueue = []) => resolveSessionConversationConfig(history, messageQueue).taskToolsEnabled === true;
@@ -20999,6 +21221,12 @@ ${tailedOutput}` : null;
       ...args2.taskToolsEnabled !== void 0 ? {
         taskToolsEnabled: args2.taskToolsEnabled === true
       } : {},
+      ...args2.agentRoleId !== void 0 ? {
+        agentRoleId: args2.agentRoleId
+      } : {},
+      ...typeof args2.agentRoleId === "string" && args2.agentRoleRevision !== void 0 ? {
+        agentRoleRevision: args2.agentRoleRevision
+      } : {},
       issuePRMentions: args2.issuePRMentions,
       resume: args2.resume
     };
@@ -23869,7 +24097,7 @@ ${context2.authorReply.trim()}
       }
       case "agentConfig": {
         const config2 = normalizeAgentConfigMeta$1(value);
-        return config2 ? {
+        return config2 && config2.id === parsedKey.agentConfigId ? {
           key: parsedKey.key,
           value: config2
         } : void 0;
@@ -26406,7 +26634,7 @@ ${context2.authorReply.trim()}
     if (hasRequiredCommand$1) return command$1;
     hasRequiredCommand$1 = 1;
     const EventEmitter2 = require$$0$4.EventEmitter;
-    const childProcess = Gx__default;
+    const childProcess = Tw__default;
     const path2 = path__default;
     const fs2 = fs__default$1;
     const process2 = process$2;
@@ -31348,7 +31576,7 @@ ${originalIndentation}`;
   function requireStream$3() {
     if (hasRequiredStream$3) return stream$3;
     hasRequiredStream$3 = 1;
-    stream$3 = So;
+    stream$3 = xo;
     return stream$3;
   }
   var destroy_1;
@@ -34939,7 +35167,7 @@ ${originalIndentation}`;
     if (hasRequiredReadable$1) return readable$1.exports;
     hasRequiredReadable$1 = 1;
     (function(module2, exports$1) {
-      var Stream = So;
+      var Stream = xo;
       if (process.env.READABLE_STREAM === "disable" && Stream) {
         module2.exports = Stream.Readable;
         Object.assign(module2.exports, Stream);
@@ -37845,7 +38073,7 @@ ${originalIndentation}`;
     const fs2 = fs__default;
     const path2 = path__default$1;
     const asyncSeries = requireSeries();
-    const zlib = Ei__default;
+    const zlib = Ri__default;
     const { MESSAGE } = requireTripleBeam();
     const { Stream, PassThrough: PassThrough2 } = requireReadable$1();
     const TransportStream = requireWinstonTransport();
@@ -44782,10 +45010,10 @@ ${originalIndentation}`;
     const os2 = os__default$1;
     const path2 = path__default$1;
     const util2 = require$$0$5;
-    const zlib = Ei__default;
+    const zlib = Ri__default;
     const hash2 = requireObjectHash();
     const MESSAGE = requireTripleBeam().MESSAGE;
-    const PassThrough2 = So.PassThrough;
+    const PassThrough2 = xo.PassThrough;
     const Transport = requireWinstonTransport();
     const loggerDefaults = {
       json: false,
@@ -45237,7 +45465,7 @@ ${value.slice(value.length - safeTailChars)}`;
     return files;
   }
   async function readDailyLogFile(file2) {
-    const raw2 = await Yt__default.readFile(file2.path);
+    const raw2 = await Xt__default.readFile(file2.path);
     if (!file2.compressed) return raw2.toString("utf8");
     return (await gunzip(raw2)).toString("utf8");
   }
@@ -50155,7 +50383,7 @@ ${fromBody}`;
   function isRecord$6(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
   }
-  function asRecord$1(value) {
+  function asRecord$2(value) {
     return isRecord$6(value) ? value : null;
   }
   function readSessionUserFromResponse(response2) {
@@ -50168,7 +50396,7 @@ ${fromBody}`;
         return nested;
       }
     }
-    const user = asRecord$1(response2.user);
+    const user = asRecord$2(response2.user);
     const parsed = SessionUserSchema.safeParse(user);
     if (!parsed.success) {
       return null;
@@ -65152,7 +65380,7 @@ ${peerId}`;
   function requirePermessageDeflate$1() {
     if (hasRequiredPermessageDeflate$1) return permessageDeflate$1;
     hasRequiredPermessageDeflate$1 = 1;
-    const zlib = Ei__default;
+    const zlib = Ri__default;
     const bufferUtil2 = requireBufferUtil();
     const Limiter = requireLimiter();
     const { kStatusCode } = requireConstants$5();
@@ -65607,7 +65835,7 @@ ${peerId}`;
   function requireReceiver$1() {
     if (hasRequiredReceiver$1) return receiver$1;
     hasRequiredReceiver$1 = 1;
-    const { Writable } = So;
+    const { Writable } = xo;
     const PerMessageDeflate = requirePermessageDeflate$1();
     const { BINARY_TYPES, EMPTY_BUFFER, kStatusCode, kWebSocket } = requireConstants$5();
     const { concat: concat2, toArrayBuffer: toArrayBuffer2, unmask } = requireBufferUtil();
@@ -65974,7 +66202,7 @@ ${peerId}`;
   function requireSender$1() {
     if (hasRequiredSender$1) return sender$1;
     hasRequiredSender$1 = 1;
-    const { Duplex } = So;
+    const { Duplex } = xo;
     const { randomFillSync: randomFillSync2 } = crypto__default;
     const PerMessageDeflate = requirePermessageDeflate$1();
     const { EMPTY_BUFFER, kWebSocket, NOOP } = requireConstants$5();
@@ -66711,7 +66939,7 @@ ${peerId}`;
     const net2 = require$$0$9;
     const tls = require$$4$2;
     const { randomBytes: randomBytes2, createHash: createHash2 } = crypto__default;
-    const { Duplex, Readable: Readable2 } = So;
+    const { Duplex, Readable: Readable2 } = xo;
     const { URL: URL2 } = require$$7$2;
     const PerMessageDeflate = requirePermessageDeflate$1();
     const Receiver = requireReceiver$1();
@@ -67449,7 +67677,7 @@ ${peerId}`;
     if (hasRequiredStream$1) return stream$1;
     hasRequiredStream$1 = 1;
     requireWebsocket$1();
-    const { Duplex } = So;
+    const { Duplex } = xo;
     function emitClose(stream2) {
       stream2.emit("close");
     }
@@ -67600,7 +67828,7 @@ ${peerId}`;
     hasRequiredWebsocketServer = 1;
     const EventEmitter2 = require$$0$7;
     const http$12 = http;
-    const { Duplex } = So;
+    const { Duplex } = xo;
     const { createHash: createHash2 } = crypto__default;
     const extension2 = requireExtension();
     const PerMessageDeflate = requirePermessageDeflate$1();
@@ -101627,15 +101855,15 @@ ${value}`;
     }
     undiciDiagnosticsInstalled = true;
     channel("undici:client:connected").subscribe((message) => {
-      const record2 = asRecord(message);
-      const socket = asRecord(record2?.socket);
-      const connectParams = asRecord(record2?.connectParams);
+      const record2 = asRecord$1(message);
+      const socket = asRecord$1(record2?.socket);
+      const connectParams = asRecord$1(record2?.connectParams);
       const alpn = readString(socket, "alpnProtocol") ?? "unknown";
       const origin = readString(connectParams, "origin") ?? readString(connectParams, "host") ?? readString(connectParams, "hostname") ?? "unknown";
       logger2.debug(`[http-transport] undici connected origin=${sanitizeUrlForLogging(origin)} alpn=${alpn}`);
     });
     channel("undici:proxy:connected").subscribe((message) => {
-      const record2 = asRecord(message);
+      const record2 = asRecord$1(message);
       const proxy = readString(record2, "proxy") ?? readString(record2, "origin") ?? "configured";
       logger2.debug(`[http-transport] undici proxy connected proxy=${sanitizeUrlForLogging(proxy)}`);
     });
@@ -101671,7 +101899,7 @@ ${value}`;
     const parsed = Number.parseInt(value, 10);
     return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback2;
   }
-  function asRecord(value) {
+  function asRecord$1(value) {
     return typeof value === "object" && value !== null ? value : null;
   }
   function readString(record2, key2) {
@@ -101930,7 +102158,7 @@ ${value}`;
         return "internal";
     }
   }
-  async function withDeadline$1(operation, options) {
+  async function withDeadline(operation, options) {
     const { timeoutMs, signal } = options;
     if (timeoutMs === void 0 && !signal) return operation;
     if (signal?.aborted) options.onAbort();
@@ -102262,7 +102490,7 @@ ${value}`;
       });
     }
     awaitWithDeadline(operation, options, ctx) {
-      return withDeadline$1(operation, {
+      return withDeadline(operation, {
         timeoutMs: options?.timeout,
         signal: options?.signal,
         onTimeout: () => {
@@ -103717,6 +103945,21 @@ ${value}`;
     ...entry,
     inputConfig: normalizeSessionTurnInputConfig(entry.inputConfig)
   });
+  const isValidDaemonLaunchConfig = (config2, expectedConfigId, expectedMachineId) => {
+    if (config2.id !== expectedConfigId || config2.machineId !== expectedMachineId || typeof config2.agentType !== "string" || config2.agentType.trim().length === 0 || typeof config2.env !== "object" || config2.env === null || Array.isArray(config2.env) || Object.values(config2.env).some((value) => typeof value !== "string")) {
+      return false;
+    }
+    if (config2.cliType === "custom") {
+      return CustomAcpLaunchSpecSchema.safeParse(config2.customAcp).success && config2.runtimeOverrides === void 0;
+    }
+    if (config2.cliType === "registry") {
+      return config2.customAcp === void 0 && config2.runtimeOverrides === void 0;
+    }
+    if (config2.cliType === "builtin") {
+      return config2.customAcp === void 0 && (config2.runtimeOverrides === void 0 || BuiltinRuntimeOverridesSchema.safeParse(config2.runtimeOverrides).success);
+    }
+    return false;
+  };
   const localLoroDataPlaneScheduler = createLocalLoroDataPlaneScheduler((work) => {
     const handle = setImmediate(work);
     return () => clearImmediate(handle);
@@ -104459,6 +104702,24 @@ ${value}`;
       const configs = await listMergedAgentConfigs(this.repo, this.workspaceId);
       return configs.find((config2) => config2.id === agentConfigId) ?? null;
     }
+    async getAgentConfigForMachineLaunch(agentConfigId, machineId) {
+      const config2 = await this.getAgentConfigById(agentConfigId, machineId);
+      if (config2) {
+        return isValidDaemonLaunchConfig(config2, agentConfigId, machineId) ? config2 : null;
+      }
+      const handle = await this.repo.openFlockDoc(getMachineFlockDocId(this.workspaceId, machineId));
+      const rows = readMachineFlockRowsFromFlock(handle.flock, {
+        prefixes: [
+          machineFlockKeys.providerSetup(agentConfigId),
+          machineFlockKeys.providerSetupCancellation(agentConfigId)
+        ]
+      });
+      if (getMachineFlockProviderSetupCancellations(rows)[agentConfigId]) {
+        return null;
+      }
+      const setup = getMachineFlockProviderSetups(rows)[agentConfigId];
+      return setup?.machineId === machineId && isValidDaemonLaunchConfig(setup.config, agentConfigId, machineId) ? setup.config : null;
+    }
     async createAgentConfig(cliType, agentType, machineId, name2) {
       const agentConfigId = v4();
       await upsertMachineAgentConfig(this.repo, this.workspaceId, {
@@ -105885,6 +106146,7 @@ ${value}`;
     return pair;
   };
   const getMachineAcpAuthorizationCodeSecretContext = (options) => `machine/acp-authenticate\0${options.workspaceId}\0${options.machineId}\0${options.authenticationRequestId}`;
+  const getMachineAcpAuthenticationInputSecretContext = (options) => `machine/acp-authenticate-input\0${options.workspaceId}\0${options.machineId}\0${options.authenticationRequestId}\0${options.interactionId}`;
   const createRpcSecretRecipient = async () => {
     const pair = await createKeyPair();
     const keyIdBytes = new Uint8Array(16);
@@ -106034,12 +106296,7 @@ ${value}`;
   const LoroMachineAcpCapabilitiesRefreshRpcRequestSchema = BaseRpcRequestSchema.extend({
     method: literal$1("machine/acp-capabilities-refresh"),
     params: object$1({
-      configId: AgentConfigIdSchema,
-      cliType: AgentConfigCliTypeSchema,
-      agentType: string$1().trim().min(1),
-      customAcp: CustomAcpLaunchSpecSchema.optional(),
-      runtimeOverrides: BuiltinRuntimeOverridesSchema.optional(),
-      env: record$1(string$1(), string$1()).optional()
+      configId: AgentConfigIdSchema
     }).strict()
   }).strict();
   const LoroMachineAcpCapabilitiesRefreshCancelRpcRequestSchema = BaseRpcRequestSchema.extend({
@@ -106050,37 +106307,31 @@ ${value}`;
   }).strict();
   const LoroMachineAcpAuthenticateRpcRequestSchema = BaseRpcRequestSchema.extend({
     method: literal$1("machine/acp-authenticate"),
-    params: object$1({
-      requestId: string$1().trim().min(1),
-      action: _enum$1([
-        "start",
-        "cancel",
-        "submit-code"
-      ]),
-      authenticationRequestId: string$1().trim().min(1).optional(),
-      authorizationCodeEnvelope: RpcSecretEnvelopeSchema.optional(),
-      methodId: string$1().trim().min(1).max(256).optional(),
-      configId: AgentConfigIdSchema.optional(),
-      cliType: AgentConfigCliTypeSchema,
-      agentType: string$1().trim().min(1),
-      customAcp: CustomAcpLaunchSpecSchema.optional(),
-      runtimeOverrides: BuiltinRuntimeOverridesSchema.optional(),
-      env: record$1(string$1(), string$1()).optional()
-    }).strict().superRefine((value, context2) => {
-      if (value.action === "submit-code") {
-        if (!value.authenticationRequestId || !value.authorizationCodeEnvelope) {
-          context2.addIssue({
-            code: "custom",
-            message: "submit-code requires an authentication request and authorization code"
-          });
-        }
-      } else if (value.authenticationRequestId || value.authorizationCodeEnvelope) {
-        context2.addIssue({
-          code: "custom",
-          message: "Authorization-code fields are only valid for submit-code"
-        });
-      }
-    })
+    params: discriminatedUnion("action", [
+      object$1({
+        requestId: string$1().trim().min(1).max(1024),
+        action: literal$1("start"),
+        configId: AgentConfigIdSchema
+      }).strict(),
+      object$1({
+        requestId: string$1().trim().min(1).max(1024),
+        action: literal$1("cancel"),
+        authenticationRequestId: string$1().trim().min(1).max(1024)
+      }).strict(),
+      object$1({
+        requestId: string$1().trim().min(1).max(1024),
+        action: literal$1("submit-code"),
+        authenticationRequestId: string$1().trim().min(1).max(1024),
+        authorizationCodeEnvelope: RpcSecretEnvelopeSchema
+      }).strict(),
+      object$1({
+        requestId: string$1().trim().min(1).max(1024),
+        action: literal$1("submit-input"),
+        authenticationRequestId: string$1().trim().min(1).max(1024),
+        interactionId: string$1().trim().min(1).max(1024),
+        authenticationInputEnvelope: RpcSecretEnvelopeSchema
+      }).strict()
+    ])
   }).strict();
   const LoroMachineAcpBinaryStatusRpcRequestSchema = BaseRpcRequestSchema.extend({
     method: literal$1("machine/acp-binary-status"),
@@ -107392,18 +107643,14 @@ ${value}`;
         onAcpBinaryProgress: options.onProgress,
         signal: options.signal,
         params: {
-          configId: options.configId,
-          cliType: options.cliType,
-          agentType: options.agentType,
-          customAcp: options.customAcp,
-          runtimeOverrides: options.runtimeOverrides,
-          env: options.env
+          configId: options.configId
         }
       });
     }
     async requestMachineAcpAuthenticate(options) {
-      const authenticationRequestId = options.authenticationRequestId;
+      const authenticationRequestId = options.action === "start" ? void 0 : options.authenticationRequestId;
       let authorizationCodeEnvelope;
+      let authenticationInputEnvelope;
       if (options.action === "submit-code") {
         if (!authenticationRequestId || !options.authorizationCode?.trim() || options.authorizationCode.length > 4096) {
           throw new Error("Submitting an authorization code requires an authentication request.");
@@ -107418,36 +107665,79 @@ ${value}`;
           authenticationRequestId
         }));
       }
+      if (options.action === "submit-input") {
+        if (!authenticationRequestId || !options.interactionId || !options.authenticationInput || options.authenticationInput.length > 65536) {
+          throw new Error("Submitting authentication input requires an active interaction.");
+        }
+        const publicKey = this.acpAuthorizationCodePublicKeys.get(authenticationRequestId);
+        if (!publicKey) {
+          throw new Error("The target machine did not provide an authentication-input key.");
+        }
+        authenticationInputEnvelope = await encryptRpcSecret(publicKey, options.authenticationInput, getMachineAcpAuthenticationInputSecretContext({
+          workspaceId: this.options.workspaceId,
+          machineId: this.options.machineId,
+          authenticationRequestId,
+          interactionId: options.interactionId
+        }));
+      }
       const onProgress = (progress) => {
-        if (progress.authorizationCodePublicKey) {
-          this.acpAuthorizationCodePublicKeys.set(progress.requestId, progress.authorizationCodePublicKey);
+        const inputPublicKey = progress.authenticationInputPublicKey ?? progress.authorizationCodePublicKey;
+        if (inputPublicKey) {
+          this.acpAuthorizationCodePublicKeys.set(progress.requestId, inputPublicKey);
         }
         options.onProgress?.(progress);
       };
       try {
+        const params = (() => {
+          switch (options.action) {
+            case "start":
+              return {
+                requestId: options.requestId,
+                action: options.action,
+                configId: options.configId
+              };
+            case "cancel":
+              return {
+                requestId: options.requestId,
+                action: options.action,
+                authenticationRequestId: options.authenticationRequestId
+              };
+            case "submit-code":
+              if (!authorizationCodeEnvelope) {
+                throw new Error("Authorization-code encryption did not produce an envelope.");
+              }
+              return {
+                requestId: options.requestId,
+                action: options.action,
+                authenticationRequestId: options.authenticationRequestId,
+                authorizationCodeEnvelope
+              };
+            case "submit-input":
+              if (!authenticationInputEnvelope) {
+                throw new Error("Authentication-input encryption did not produce an envelope.");
+              }
+              return {
+                requestId: options.requestId,
+                action: options.action,
+                authenticationRequestId: options.authenticationRequestId,
+                interactionId: options.interactionId,
+                authenticationInputEnvelope
+              };
+            default:
+              throw new Error("Unsupported ACP authentication action.");
+          }
+        })();
         return await this.sendRequest({
           method: "machine/acp-authenticate",
           timeoutMs: options.timeoutMs ?? 3e5,
           onAcpAuthenticationProgress: onProgress,
-          params: {
-            requestId: options.requestId,
-            action: options.action,
-            authenticationRequestId,
-            authorizationCodeEnvelope,
-            ...options.methodId ? {
-              methodId: options.methodId
-            } : {},
-            configId: options.configId,
-            cliType: options.cliType,
-            agentType: options.agentType,
-            customAcp: options.customAcp,
-            runtimeOverrides: options.runtimeOverrides,
-            env: options.env
-          }
+          params
         });
       } finally {
-        if (options.action === "start" || options.action === "cancel") {
+        if (options.action === "start") {
           this.acpAuthorizationCodePublicKeys.delete(options.requestId);
+        } else if (options.action === "cancel") {
+          this.acpAuthorizationCodePublicKeys.delete(options.authenticationRequestId);
         }
       }
     }
@@ -107812,8 +108102,8 @@ ${value}`;
         timeoutMs,
         refreshContext: args2.method === "machine/acp-capabilities-refresh" ? {
           configId: args2.params.configId,
-          cliType: args2.params.cliType,
-          agentType: args2.params.agentType
+          cliType: "builtin",
+          agentType: "unknown"
         } : void 0,
         pingContext: args2.method === "machine/ping" ? {
           requestId: args2.params.requestId
@@ -107825,7 +108115,7 @@ ${value}`;
           requestId: args2.params.requestId
         } : void 0,
         binaryContext: args2.method === "machine/acp-authenticate" ? {
-          agentType: args2.params.agentType,
+          agentType: "unknown",
           requestId: args2.params.requestId
         } : args2.method === "machine/acp-binary-status" || args2.method === "machine/acp-binary-install" ? {
           agentType: args2.params.agentType
@@ -108240,14 +108530,29 @@ ${value}`;
   const redactRpcRequestForLog = (raw2) => {
     if (typeof raw2 !== "object" || raw2 === null) return raw2;
     const request2 = raw2;
-    if (request2.method !== "machine/acp-authenticate" || typeof request2.params !== "object" || request2.params === null || !Object.hasOwn(request2.params, "authorizationCode")) {
+    if (request2.method !== "machine/acp-authenticate" && request2.method !== "machine/acp-capabilities-refresh" || typeof request2.params !== "object" || request2.params === null) {
       return raw2;
     }
+    const params = request2.params;
     return {
       ...request2,
       params: {
-        ...request2.params,
-        authorizationCode: "[REDACTED]"
+        ...params,
+        ...Object.hasOwn(params, "env") ? {
+          env: "[REDACTED]"
+        } : {},
+        ...Object.hasOwn(params, "authorizationCode") ? {
+          authorizationCode: "[REDACTED]"
+        } : {},
+        ...Object.hasOwn(params, "authenticationInput") ? {
+          authenticationInput: "[REDACTED]"
+        } : {},
+        ...Object.hasOwn(params, "authorizationCodeEnvelope") ? {
+          authorizationCodeEnvelope: "[REDACTED]"
+        } : {},
+        ...Object.hasOwn(params, "authenticationInputEnvelope") ? {
+          authenticationInputEnvelope: "[REDACTED]"
+        } : {}
       }
     };
   };
@@ -108492,7 +108797,7 @@ ${value}`;
         return false;
       }
       const action = request2.params.action;
-      return action === "cancel" || action === "submit-code";
+      return action === "cancel" || action === "submit-code" || action === "submit-input";
     }
     async runRequestTask(raw2, lane, options) {
       if (options?.deferredAcquire) {
@@ -108606,11 +108911,6 @@ ${value}`;
               };
               const response2 = await this.deps.refreshMachineAcpCapabilities({
                 configId: request2.params.configId,
-                cliType: request2.params.cliType,
-                agentType: request2.params.agentType,
-                customAcp: request2.params.customAcp,
-                runtimeOverrides: request2.params.runtimeOverrides,
-                env: request2.params.env,
                 onAcpBinaryProgress: appendProgress,
                 signal: controller.signal
               });
@@ -108647,19 +108947,23 @@ ${value}`;
             }
             let progressWrites = Promise.resolve();
             const appendProgress = (progress) => {
-              const safeProgress = progress.acceptsAuthorizationCode && recipient ? {
+              const acceptsInteractionInput = progress.status === "auth-methods" || progress.status === "input-required" || progress.requiresAuthorizationConsent === true;
+              const safeProgress = recipient && (progress.acceptsAuthorizationCode || acceptsInteractionInput) ? {
                 ...progress,
-                authorizationCodePublicKey: recipient.publicKey
+                ...progress.acceptsAuthorizationCode ? {
+                  authorizationCodePublicKey: recipient.publicKey
+                } : {},
+                ...acceptsInteractionInput ? {
+                  authenticationInputPublicKey: recipient.publicKey
+                } : {}
               } : progress;
               progressWrites = progressWrites.then(() => this.appendResultResponse(request2.replyTo, request2.id, request2.method, safeProgress)).catch(() => void 0);
             };
             let authorizationCode;
+            let authenticationInput;
             if (request2.params.action === "submit-code") {
               const authenticationRequestId = request2.params.authenticationRequestId;
               const authorizationCodeEnvelope = request2.params.authorizationCodeEnvelope;
-              if (!authenticationRequestId || !authorizationCodeEnvelope) {
-                throw new Error("Missing encrypted authorization-code input.");
-              }
               const activeRecipient = this.acpAuthorizationCodeRecipients.get(authenticationRequestId);
               if (!activeRecipient) {
                 throw new Error("Authorization-code recipient is no longer active.");
@@ -108673,27 +108977,79 @@ ${value}`;
                 throw new Error("Invalid decrypted authorization-code input.");
               }
             }
+            if (request2.params.action === "submit-input") {
+              const authenticationRequestId = request2.params.authenticationRequestId;
+              const interactionId = request2.params.interactionId;
+              const authenticationInputEnvelope = request2.params.authenticationInputEnvelope;
+              const activeRecipient = this.acpAuthorizationCodeRecipients.get(authenticationRequestId);
+              if (!activeRecipient) {
+                throw new Error("Authentication-input recipient is no longer active.");
+              }
+              authenticationInput = await activeRecipient.decrypt(authenticationInputEnvelope, getMachineAcpAuthenticationInputSecretContext({
+                workspaceId: this.deps.workspaceId,
+                machineId: this.deps.machineId,
+                authenticationRequestId,
+                interactionId
+              }));
+              if (!authenticationInput || authenticationInput.length > 65536) {
+                throw new Error("Invalid decrypted authentication input.");
+              }
+            }
             try {
-              const response2 = await this.deps.authenticateMachineAcp({
-                requestId: request2.params.requestId,
-                action: request2.params.action,
-                authenticationRequestId: request2.params.authenticationRequestId,
-                authorizationCode,
-                methodId: request2.params.methodId,
-                configId: request2.params.configId,
-                cliType: request2.params.cliType,
-                agentType: request2.params.agentType,
-                customAcp: request2.params.customAcp,
-                runtimeOverrides: request2.params.runtimeOverrides,
-                env: request2.params.env,
-                onProgress: appendProgress
-              });
+              const response2 = await (() => {
+                switch (request2.params.action) {
+                  case "start":
+                    return this.deps.authenticateMachineAcp?.({
+                      requestId: request2.params.requestId,
+                      action: request2.params.action,
+                      configId: request2.params.configId,
+                      onProgress: appendProgress
+                    });
+                  case "cancel":
+                    return this.deps.authenticateMachineAcp?.({
+                      requestId: request2.params.requestId,
+                      action: request2.params.action,
+                      authenticationRequestId: request2.params.authenticationRequestId,
+                      onProgress: appendProgress
+                    });
+                  case "submit-code":
+                    if (authorizationCode === void 0) {
+                      throw new Error("Missing decrypted authorization-code input.");
+                    }
+                    return this.deps.authenticateMachineAcp?.({
+                      requestId: request2.params.requestId,
+                      action: request2.params.action,
+                      authenticationRequestId: request2.params.authenticationRequestId,
+                      authorizationCode,
+                      onProgress: appendProgress
+                    });
+                  case "submit-input":
+                    if (authenticationInput === void 0) {
+                      throw new Error("Missing decrypted authentication input.");
+                    }
+                    return this.deps.authenticateMachineAcp?.({
+                      requestId: request2.params.requestId,
+                      action: request2.params.action,
+                      authenticationRequestId: request2.params.authenticationRequestId,
+                      interactionId: request2.params.interactionId,
+                      authenticationInput,
+                      onProgress: appendProgress
+                    });
+                  default:
+                    throw new Error("Unsupported ACP authentication action.");
+                }
+              })();
+              if (!response2) {
+                throw new Error("ACP authentication is not available on this machine.");
+              }
               await progressWrites;
               await this.appendResultResponse(request2.replyTo, request2.id, request2.method, response2);
               return;
             } finally {
-              if (isStart || request2.params.action === "cancel") {
+              if (isStart) {
                 this.acpAuthorizationCodeRecipients.delete(request2.params.requestId);
+              } else if (request2.params.action === "cancel") {
+                this.acpAuthorizationCodeRecipients.delete(request2.params.authenticationRequestId);
               }
             }
           }
@@ -109434,12 +109790,7 @@ ${value}`;
           type: "machine/acp-capabilities-refresh",
           machineId: this.machineId,
           workspaceId: this.workspaceId,
-          configId: verifying.config.id,
-          cliType: verifying.config.cliType,
-          agentType: verifying.config.agentType,
-          customAcp: verifying.config.customAcp,
-          runtimeOverrides: verifying.config.runtimeOverrides,
-          env: verifying.config.env
+          configId: verifying.config.id
         });
         if (response2.success) {
           await this.publishVerifiedConfig(verifying.id, attempt);
@@ -109863,20 +110214,20 @@ ${value}`;
     };
     const parsed = DaemonUpgradeIntentSchema.parse(value);
     const dir = path.dirname(DAEMON_UPGRADE_INTENT_FILE);
-    await Yt.mkdir(dir, {
+    await Xt.mkdir(dir, {
       recursive: true
     });
     const tmpPath = path.join(dir, `.${path.basename(DAEMON_UPGRADE_INTENT_FILE)}.${process.pid}.tmp`);
-    await Yt.writeFile(tmpPath, `${JSON.stringify(parsed, null, 2)}
+    await Xt.writeFile(tmpPath, `${JSON.stringify(parsed, null, 2)}
 `, {
       encoding: "utf8",
       mode: 384
     });
-    await Yt.rename(tmpPath, DAEMON_UPGRADE_INTENT_FILE);
+    await Xt.rename(tmpPath, DAEMON_UPGRADE_INTENT_FILE);
   };
   const readDaemonUpgradeIntent = async () => {
     try {
-      const raw2 = await Yt.readFile(DAEMON_UPGRADE_INTENT_FILE, "utf8");
+      const raw2 = await Xt.readFile(DAEMON_UPGRADE_INTENT_FILE, "utf8");
       const parsed = DaemonUpgradeIntentSchema.safeParse(JSON.parse(raw2));
       return parsed.success ? parsed.data : null;
     } catch {
@@ -109885,7 +110236,7 @@ ${value}`;
   };
   const clearDaemonUpgradeIntent = async () => {
     try {
-      await Yt.unlink(DAEMON_UPGRADE_INTENT_FILE);
+      await Xt.unlink(DAEMON_UPGRADE_INTENT_FILE);
     } catch {
     }
   };
@@ -117522,7 +117873,7 @@ ${error2.message}` : execaMessage;
   function requireBufferStream() {
     if (hasRequiredBufferStream) return bufferStream;
     hasRequiredBufferStream = 1;
-    const { PassThrough: PassThroughStream } = So;
+    const { PassThrough: PassThroughStream } = xo;
     bufferStream = (options) => {
       options = {
         ...options
@@ -117571,7 +117922,7 @@ ${error2.message}` : execaMessage;
     if (hasRequiredGetStream) return getStream.exports;
     hasRequiredGetStream = 1;
     const { constants: BufferConstants } = require$$0$6;
-    const stream2 = So;
+    const stream2 = xo;
     const { promisify: promisify2 } = require$$0$5;
     const bufferStream2 = requireBufferStream();
     const streamPipelinePromisified = promisify2(stream2.pipeline);
@@ -117631,7 +117982,7 @@ ${error2.message}` : execaMessage;
   function requireMergeStream() {
     if (hasRequiredMergeStream) return mergeStream;
     hasRequiredMergeStream = 1;
-    const { PassThrough: PassThrough2 } = So;
+    const { PassThrough: PassThrough2 } = xo;
     mergeStream = function() {
       var sources = [];
       var output = new PassThrough2({
@@ -119362,7 +119713,7 @@ ${error2.message}` : execaMessage;
       validate: validate2
     });
   };
-  const realZlibConstants = Ei__default.constants || {
+  const realZlibConstants = Ri__default.constants || {
     ZLIB_VERNUM: 4736
   };
   const constants = Object.freeze(Object.assign(/* @__PURE__ */ Object.create(null), {
@@ -119522,11 +119873,11 @@ ${error2.message}` : execaMessage;
       this.#flushFlag = opts.flush ?? 0;
       this.#finishFlushFlag = opts.finishFlush ?? 0;
       this.#fullFlushFlag = opts.fullFlushFlag ?? 0;
-      if (typeof Ei[mode2] !== "function") {
+      if (typeof Ri[mode2] !== "function") {
         throw new TypeError("Compression method not supported: " + mode2);
       }
       try {
-        this.#handle = new Ei[mode2](opts);
+        this.#handle = new Ri[mode2](opts);
       } catch (er) {
         throw new ZlibError(er, this.constructor);
       }
@@ -122541,7 +122892,7 @@ ${error2.message}` : execaMessage;
       return checkCwd(dir, done2);
     }
     if (preserve) {
-      return Yt__default.mkdir(dir, {
+      return Xt__default.mkdir(dir, {
         mode: mode2,
         recursive: true
       }).then((made) => done2(null, made ?? void 0), done2);
@@ -123791,7 +124142,7 @@ ${error2.message}` : execaMessage;
     hasRequiredFdSlicer = 1;
     var fs2 = fs__default;
     var util2 = require$$0$5;
-    var stream2 = So;
+    var stream2 = xo;
     var Readable2 = stream2.Readable;
     var Writable = stream2.Writable;
     var PassThrough2 = stream2.PassThrough;
@@ -124357,14 +124708,14 @@ ${error2.message}` : execaMessage;
     if (hasRequiredYauzl) return yauzl;
     hasRequiredYauzl = 1;
     var fs2 = fs__default;
-    var zlib = Ei__default;
+    var zlib = Ri__default;
     var fd_slicer = requireFdSlicer();
     var crc322 = requireBufferCrc32();
     var util2 = require$$0$5;
     var EventEmitter2 = require$$0$7.EventEmitter;
-    var Transform2 = So.Transform;
-    var PassThrough2 = So.PassThrough;
-    var Writable = So.Writable;
+    var Transform2 = xo.Transform;
+    var PassThrough2 = xo.PassThrough;
+    var Writable = xo.Writable;
     yauzl.open = open2;
     yauzl.fromFd = fromFd;
     yauzl.fromBuffer = fromBuffer;
@@ -125805,99 +126156,99 @@ ${error2.message}` : execaMessage;
   const grokPackageJson = {
     version: version$6
   };
-  const version$5 = "2.1.251";
+  const version$5 = "2.1.258";
   const platforms = {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "625869b01e0050f260b2980fac248fd9cef9e462612bded4ec9d3d49ff8969a5",
-      "size": 197171680
+      "checksum": "b63136194160791c27cfa7b0403060d85eb0752991625fde8c09f9acacb17c78",
+      "size": 199027600
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "44221d72a3f35772faa85ad9a36a678084a516f720e64b45e26eb9015315500b",
-      "size": 205778256
+      "checksum": "c857db5cd712865623bd61e806cf3f7e8e279c9e5c7c0af5eca06ca6717fc7fb",
+      "size": 207778640
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "65445bd4dd042079cc3fa43791b561370a05c8599e8ec47580e25a81050abbdd",
-      "size": 213835016
+      "checksum": "43dc490af55262edcb3e9b1cb315de22cc09ccb08bd52a4c39bc5eabaa63100f",
+      "size": 215014736
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "fd5f10ff0eb58daec04900466b143ea98aab50abf208a422bc008eaec13f61f7",
-      "size": 214326616
+      "checksum": "704f1334ac65d3e89e1c6c1d7663293ad786a6166afdb71b5075337df630f976",
+      "size": 215473560
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "165f6236abf5b0c42892b164c2299c82023421805e0c3eaddf925a3195513f84",
-      "size": 206648896
+      "checksum": "d3bef6ba403fe3efba684fa93e1bb26bc7a08c054bd516639d54e77c77bb9821",
+      "size": 207894168
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "5056970c13f46dd2bff2c44dd2a7f766553a63392615412d5711278264730e07",
-      "size": 208301944
+      "checksum": "e74a226cf174d911664aff982486c55ca770d9c00007e52e86b13d10bae72af3",
+      "size": 209493960
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "8d1229a281281b98fd2dee72b3253a704be4fce4d45207200cd32a9bb5a6c909",
-      "size": 217360032
+      "checksum": "22f5f3a44093e14c75a4d1c8ce25c730b21dd634318fbe3268e9057d12b17c41",
+      "size": 218507936
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "89e91fed2dc6f6278fa1e179e6401c0a1c252fe80c57ee47f17f10f7f7b4e99c",
-      "size": 208465056
+      "checksum": "42675c431b6014ad7243fea0ed0e371045dedc89d94aac81a9a0f528e644ed97",
+      "size": 209548960
     }
   };
   const claudeSdkManifestJson = {
     version: version$5,
     platforms
   };
-  const version$4 = "0.3.251";
+  const version$4 = "0.3.258";
   const claudeSdkPackageJson = {
     version: version$4
   };
-  const sdkVersion = "0.3.251";
-  const version$3 = "2.1.251";
+  const sdkVersion = "0.3.258";
+  const version$3 = "2.1.258";
   const artifacts$1 = {
     "darwin-arm64": {
-      "fileName": "anthropic-ai-claude-agent-sdk-darwin-arm64-0.3.251.tar.zst",
-      "sha256": "536a3755844d168b87250af3ee6e3dd103391305514f28abe564f91a5aa856ee",
-      "size": 71945899
+      "fileName": "anthropic-ai-claude-agent-sdk-darwin-arm64-0.3.258.tar.zst",
+      "sha256": "dd01a1ae8868c41ac7755e89fa4fc087d28e265b6d7ab122c18317dfd7023ed2",
+      "size": 73550133
     },
     "darwin-x64": {
-      "fileName": "anthropic-ai-claude-agent-sdk-darwin-x64-0.3.251.tar.zst",
-      "sha256": "68e88be76d4399d1dea054d9dbbf7106c393578fa1fa5714c9a8890b6ff3213c",
-      "size": 75692035
+      "fileName": "anthropic-ai-claude-agent-sdk-darwin-x64-0.3.258.tar.zst",
+      "sha256": "f46392ec768822fca40d61f6986d7d293a42b3ee5820b0c1a6c14bee474fdb02",
+      "size": 77362894
     },
     "linux-arm64": {
-      "fileName": "anthropic-ai-claude-agent-sdk-linux-arm64-0.3.251.tar.zst",
-      "sha256": "92e61ffb31b8beae919beb6a9458f4a376067bf25d4df7e5c8fe29b84ed1edaa",
-      "size": 81951594
+      "fileName": "anthropic-ai-claude-agent-sdk-linux-arm64-0.3.258.tar.zst",
+      "sha256": "b2df6e0ac548e348a1609d5cba8c1c22c8f4f98b9a3ab54f5ce2082ff96db0f2",
+      "size": 83313235
     },
     "linux-x64": {
-      "fileName": "anthropic-ai-claude-agent-sdk-linux-x64-0.3.251.tar.zst",
-      "sha256": "9e51358bb06885a29c0cdcaff6ffbbed47718e3210b8e92ae074802440a46dd3",
-      "size": 81994218
+      "fileName": "anthropic-ai-claude-agent-sdk-linux-x64-0.3.258.tar.zst",
+      "sha256": "ea9bfd7a1cfe218b9c9451450401d654711787bf1972b8a22d3b5f7b495a73f8",
+      "size": 83414920
     },
     "linux-arm64-musl": {
-      "fileName": "anthropic-ai-claude-agent-sdk-linux-arm64-musl-0.3.251.tar.zst",
-      "sha256": "bfad7556c20b01776c2205898c7f76a31448e42b7c2e7254476d25aac9c0d84c",
-      "size": 80166022
+      "fileName": "anthropic-ai-claude-agent-sdk-linux-arm64-musl-0.3.258.tar.zst",
+      "sha256": "9293b47fd63fa6f368fe0a9fa2930fd6963e6108e65b34584f854919df7f227b",
+      "size": 81542174
     },
     "linux-x64-musl": {
-      "fileName": "anthropic-ai-claude-agent-sdk-linux-x64-musl-0.3.251.tar.zst",
-      "sha256": "143efe291c6cd6501681fff2930c58c9eeeef5f924dded6b340e84a9e069e1d1",
-      "size": 80324347
+      "fileName": "anthropic-ai-claude-agent-sdk-linux-x64-musl-0.3.258.tar.zst",
+      "sha256": "ba0e031ff3266f41d73a28effc25d4334d992891b0495542ca7cf3b2a75632c8",
+      "size": 81733248
     },
     "win32-arm64": {
-      "fileName": "anthropic-ai-claude-agent-sdk-win32-arm64-0.3.251.tar.zst",
-      "sha256": "0d70dd262d40b39fe354e3b7c0e5a1b3a4895beef2692509a3830511ff184023",
-      "size": 81916953
+      "fileName": "anthropic-ai-claude-agent-sdk-win32-arm64-0.3.258.tar.zst",
+      "sha256": "13cd9e1ad2958bc8dbaaf908362852136b63f8ce4f452beade38d0323a40774d",
+      "size": 83257894
     },
     "win32-x64": {
-      "fileName": "anthropic-ai-claude-agent-sdk-win32-x64-0.3.251.tar.zst",
-      "sha256": "db8bcee96e0f0bc42b01977c1897977c204d5cee07464656ec49fa44d31014aa",
-      "size": 84974808
+      "fileName": "anthropic-ai-claude-agent-sdk-win32-x64-0.3.258.tar.zst",
+      "sha256": "ae93d318561a4c069d7074726d345224b588e1b3b0a6955b604f6a06ec0c3195",
+      "size": 86357676
     }
   };
   const claudeRuntimeManifestJson = {
@@ -127787,19 +128138,33 @@ ${error2.message}` : execaMessage;
     let streamStarted = false;
     let pendingController = null;
     let stdoutEnded = false;
-    stdout.on("data", (chunk) => {
+    let controllerClosed = false;
+    const onData = (chunk) => {
+      if (controllerClosed) return;
       if (streamStarted && pendingController) {
         pendingController.enqueue(chunk);
       } else {
         bufferedChunks.push(chunk);
       }
-    });
-    stdout.on("end", () => {
+    };
+    const closeController = () => {
+      if (!pendingController || controllerClosed) return;
+      controllerClosed = true;
+      const controller = pendingController;
+      pendingController = null;
+      controller.close();
+    };
+    const onEnd = () => {
       stdoutEnded = true;
-      if (streamStarted && pendingController) {
-        pendingController.close();
-      }
-    });
+      if (streamStarted) closeController();
+      detach();
+    };
+    const detach = () => {
+      stdout.removeListener("data", onData);
+      stdout.removeListener("end", onEnd);
+    };
+    stdout.on("data", onData);
+    stdout.on("end", onEnd);
     return new ReadableStream({
       start(controller) {
         pendingController = controller;
@@ -127809,8 +128174,14 @@ ${error2.message}` : execaMessage;
         bufferedChunks.length = 0;
         streamStarted = true;
         if (stdoutEnded) {
-          controller.close();
+          closeController();
         }
+      },
+      cancel() {
+        controllerClosed = true;
+        pendingController = null;
+        bufferedChunks.length = 0;
+        detach();
       }
     });
   }
@@ -129201,217 +129572,6 @@ ${fallbackStderrTail}` : errorMessage2;
       super(isLikelyAuthorizationUrl, false);
     }
   }
-  const ACP_AUTHENTICATION_INITIALIZE_TIMEOUT_MS = 6e4;
-  const AUTHENTICATION_TERMINATION_GRACE_MS = 3e3;
-  function normalizeAcpAuthMethod(method) {
-    const record2 = method;
-    const id2 = typeof record2.id === "string" ? record2.id.trim() : "";
-    if (!id2) return null;
-    const type2 = record2.type === "terminal" || record2.type === "env_var" ? record2.type : "agent";
-    const args2 = Array.isArray(record2.args) && record2.args.every((arg) => typeof arg === "string") ? record2.args : void 0;
-    const env2 = typeof record2.env === "object" && record2.env !== null ? Object.fromEntries(Object.entries(record2.env).filter((entry) => typeof entry[1] === "string")) : void 0;
-    return {
-      type: type2,
-      id: id2,
-      ...typeof record2.name === "string" ? {
-        name: record2.name
-      } : {},
-      ...typeof record2.description === "string" ? {
-        description: record2.description
-      } : {},
-      ...args2 ? {
-        args: args2
-      } : {},
-      ...env2 && Object.keys(env2).length > 0 ? {
-        env: env2
-      } : {}
-    };
-  }
-  function describeAcpAuthMethod(method) {
-    return method.name?.trim() ? method.name : method.id;
-  }
-  function formatEnvVarAuthMethodError(method, normalized) {
-    const vars = method.vars;
-    const names2 = Array.isArray(vars) ? vars.map((entry) => typeof entry === "object" && entry !== null && typeof entry.name === "string" ? entry.name : null).filter((name2) => Boolean(name2)) : [];
-    const suffix = names2.length > 0 ? `: ${names2.join(", ")}` : "";
-    return `${describeAcpAuthMethod(normalized)} authenticates through environment variables. Add them to this agent's environment in its settings${suffix}.`;
-  }
-  function selectAuthMethod(methods2, methodId) {
-    for (const method of methods2) {
-      const normalized = normalizeAcpAuthMethod(method);
-      if (!normalized) continue;
-      if (methodId === void 0 || normalized.id === methodId) {
-        return {
-          method,
-          normalized
-        };
-      }
-    }
-    return null;
-  }
-  function withDeadline(promise2, timeoutMs, label2) {
-    let timeoutHandle;
-    const timeout2 = new Promise((_resolve, reject2) => {
-      timeoutHandle = setTimeout(() => reject2(new Error(`${label2} timed out after ${Math.round(timeoutMs / 1e3)}s`)), timeoutMs);
-      timeoutHandle.unref?.();
-    });
-    return Promise.race([
-      promise2,
-      timeout2
-    ]).finally(() => {
-      if (timeoutHandle) clearTimeout(timeoutHandle);
-    });
-  }
-  async function runAcpProtocolAuthentication(options) {
-    options.signal?.throwIfAborted();
-    const child = spawnAcpProcess({
-      cliType: options.cliType,
-      agentType: options.agentType,
-      workdir: options.workdir,
-      env: options.env,
-      command: options.launch.command,
-      args: options.launch.args,
-      spawnImpl: options.spawnProcess
-    });
-    options.attachProcess?.(child);
-    let stderrTail = "";
-    const parser = new AcpAgentAuthorizationOutputParser();
-    child.stderr?.setEncoding("utf8");
-    child.stderr?.on("data", (chunk) => {
-      if (!chunk) return;
-      stderrTail = appendStderrTail(stderrTail, chunk);
-      const authorization = parser.push(chunk);
-      if (authorization) {
-        options.onProgress?.({
-          status: "authorization",
-          ...authorization
-        });
-      }
-    });
-    let rejectProcessFailure;
-    const processFailure = new Promise((_resolve, reject2) => {
-      rejectProcessFailure = reject2;
-    });
-    const handleExit = (code2, signal) => {
-      rejectProcessFailure?.(new Error(`${options.agentType} exited during authentication (code ${code2 ?? "null"}${signal ? `, signal ${signal}` : ""})${stderrTail ? `: ${stderrTail}` : ""}`));
-    };
-    const handleError2 = (error2) => {
-      rejectProcessFailure?.(new Error(`${options.agentType} failed to start: ${error2.message}`));
-    };
-    child.once("exit", handleExit);
-    child.once("error", handleError2);
-    processFailure.catch(() => void 0);
-    const handleAbort = () => {
-      rejectProcessFailure?.(new DOMException("ACP authentication was cancelled", "AbortError"));
-    };
-    options.signal?.addEventListener("abort", handleAbort, {
-      once: true
-    });
-    const terminate = () => {
-      child.off("exit", handleExit);
-      child.off("error", handleError2);
-      options.signal?.removeEventListener("abort", handleAbort);
-      void shutdownLocalAcpAgent({
-        agentProcess: child,
-        logger: options.logger,
-        sessionLabel: `acp-auth-protocol:${options.agentType}`,
-        exitTimeoutMs: AUTHENTICATION_TERMINATION_GRACE_MS
-      }).catch((error2) => {
-        options.logger.debug(`[acp-auth] Failed to stop ${options.agentType} after authentication: ${formatErrorMessage(error2)}`);
-      });
-    };
-    try {
-      if (!child.stdout || !child.stdin) {
-        throw new Error("Agent process stdio is not available");
-      }
-      const stream2 = ndJsonStream(createStdinWritableStream(child.stdin), createStdoutReadableStream(child.stdout));
-      const connection2 = new ClientSideConnection(() => ({
-        requestPermission: async () => ({
-          outcome: {
-            outcome: "cancelled"
-          }
-        }),
-        sessionUpdate: () => {
-        }
-      }), stream2);
-      const initializeResponse = await Promise.race([
-        withDeadline(connection2.initialize({
-          protocolVersion: PROTOCOL_VERSION,
-          clientCapabilities: {
-            terminal: false,
-            fs: {
-              readTextFile: false,
-              writeTextFile: false
-            },
-            auth: {
-              terminal: true
-            }
-          }
-        }), Math.max(1, options.initializeTimeoutMs ?? ACP_AUTHENTICATION_INITIALIZE_TIMEOUT_MS), `${options.agentType} initialize`),
-        processFailure
-      ]);
-      options.signal?.throwIfAborted();
-      const advertised = initializeResponse.authMethods ?? [];
-      if (advertised.length === 0) {
-        return {
-          kind: "error",
-          error: `${options.agentType} does not advertise an authentication method. Check the agent's own setup instructions or configure its credentials in this agent's environment.`
-        };
-      }
-      const selected = selectAuthMethod(advertised, options.methodId);
-      if (!selected) {
-        if (options.methodId !== void 0) {
-          return {
-            kind: "error",
-            error: `${options.agentType} no longer advertises the authentication method "${options.methodId}"`
-          };
-        }
-        return {
-          kind: "error",
-          error: `${options.agentType} advertised no usable authentication method`
-        };
-      }
-      const normalizedMethods = advertised.map(normalizeAcpAuthMethod).filter((method) => method !== null);
-      if (options.methodId === void 0 && normalizedMethods.length > 1) {
-        return {
-          kind: "method-required",
-          authMethods: normalizedMethods
-        };
-      }
-      if (selected.normalized.type === "env_var") {
-        return {
-          kind: "error",
-          error: formatEnvVarAuthMethodError(selected.method, selected.normalized)
-        };
-      }
-      if (selected.normalized.type === "terminal") {
-        return {
-          kind: "terminal-method",
-          method: selected.normalized
-        };
-      }
-      options.logger.debug(`[acp-auth] ${options.agentType} authenticate methodId=${selected.normalized.id}`);
-      await Promise.race([
-        connection2.authenticate({
-          methodId: selected.normalized.id
-        }),
-        processFailure
-      ]);
-      return {
-        kind: "authenticated"
-      };
-    } catch (error2) {
-      if (error2 instanceof DOMException && error2.name === "AbortError") {
-        throw error2;
-      }
-      return {
-        kind: "error",
-        error: formatErrorMessage(error2)
-      };
-    } finally {
-      terminate();
-    }
-  }
   const DEFAULT_AUTHENTICATION_TIMEOUT_MS = 285e3;
   const DEFAULT_TERMINATION_GRACE_MS$1 = 3e3;
   const DEFAULT_STATUS_PROBE_TIMEOUT_MS = 15e3;
@@ -129460,6 +129620,139 @@ ${fallbackStderrTail}` : errorMessage2;
       }
     ]
   };
+  const AcpAuthenticationInteractionInputSchema = discriminatedUnion("action", [
+    object$1({
+      action: literal$1("accept"),
+      methodId: string$1().trim().min(1).max(ACP_AUTH_ID_MAX_LENGTH).optional(),
+      content: record$1(string$1(), unknown()).optional()
+    }).strict(),
+    object$1({
+      action: _enum$1([
+        "decline",
+        "cancel"
+      ])
+    }).strict()
+  ]);
+  const asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  function isAllowedAuthorizationUrl(value) {
+    if (value.length > ACP_AUTHORIZATION_URL_MAX_LENGTH) return false;
+    try {
+      const protocol = new URL(value).protocol;
+      return protocol === "https:" || protocol === "http:";
+    } catch {
+      return false;
+    }
+  }
+  function toAuthenticationForm(request2) {
+    const rawRequest = asRecord(request2);
+    const schema2 = asRecord(rawRequest?.requestedSchema);
+    const properties2 = asRecord(schema2?.properties);
+    if (!rawRequest || rawRequest.mode !== "form" || !schema2 || !properties2) return null;
+    const propertyEntries = Object.entries(properties2);
+    if (propertyEntries.length === 0 || propertyEntries.length > ACP_AUTH_FORM_FIELD_MAX_COUNT) {
+      return null;
+    }
+    if (typeof schema2.title === "string" && schema2.title.length > ACP_AUTH_LABEL_MAX_LENGTH || typeof schema2.description === "string" && schema2.description.length > ACP_AUTH_TEXT_MAX_LENGTH) {
+      return null;
+    }
+    if (schema2.required !== void 0 && (!Array.isArray(schema2.required) || schema2.required.some((value) => typeof value !== "string"))) {
+      return null;
+    }
+    const required2 = new Set(schema2.required ?? []);
+    if ([
+      ...required2
+    ].some((id2) => !Object.hasOwn(properties2, id2))) return null;
+    const fields = [];
+    for (const [id2, rawProperty] of propertyEntries) {
+      const property = asRecord(rawProperty);
+      if (!property || property.type !== "string") return null;
+      const label2 = typeof property.title === "string" && property.title.trim() ? property.title : id2;
+      const description2 = typeof property.description === "string" ? property.description : void 0;
+      if (!id2.trim() || id2.length > ACP_AUTH_ID_MAX_LENGTH || !label2.trim() || label2.length > ACP_AUTH_LABEL_MAX_LENGTH || (description2?.length ?? 0) > ACP_AUTH_TEXT_MAX_LENGTH) {
+        return null;
+      }
+      const meta = asRecord(property._meta);
+      const secret = getLodyElicitationMeta(property._meta)?.secret === true || meta?.secret === true || meta?.sensitive === true || property.format === "password";
+      const defaultValue = !secret && typeof property.default === "string" ? property.default : void 0;
+      if ((defaultValue?.length ?? 0) > ACP_AUTH_TEXT_MAX_LENGTH) return null;
+      if (property.oneOf !== void 0 && !Array.isArray(property.oneOf) || property.enum !== void 0 && !Array.isArray(property.enum)) {
+        return null;
+      }
+      const titledOptions = Array.isArray(property.oneOf) ? property.oneOf.map((rawOption) => {
+        const option2 = asRecord(rawOption);
+        if (!option2 || typeof option2.const !== "string" || !option2.const) return null;
+        const optionLabel = typeof option2.title === "string" && option2.title.trim() ? option2.title : option2.const;
+        return {
+          value: option2.const,
+          label: optionLabel
+        };
+      }) : [];
+      const enumOptions = Array.isArray(property.enum) ? property.enum.map((value) => typeof value === "string" && value ? {
+        value,
+        label: value
+      } : null) : [];
+      if (titledOptions.some((option2) => option2 === null) || enumOptions.some((option2) => option2 === null)) {
+        return null;
+      }
+      const options = titledOptions.length > 0 ? titledOptions : enumOptions;
+      if ((Array.isArray(property.oneOf) || Array.isArray(property.enum)) && options.length === 0 || options.length > ACP_AUTH_SELECT_OPTION_MAX_COUNT || options.some((option2) => option2 === null || option2.value.length > ACP_AUTH_TEXT_MAX_LENGTH || option2.label.length > ACP_AUTH_LABEL_MAX_LENGTH)) {
+        return null;
+      }
+      if (options.length > 0) {
+        if (new Set(options.map((option2) => option2?.value)).size !== options.length) {
+          return null;
+        }
+        if (defaultValue !== void 0 && !options.some((option2) => option2?.value === defaultValue)) {
+          return null;
+        }
+        fields.push({
+          id: id2,
+          type: "select",
+          label: label2,
+          ...description2 !== void 0 ? {
+            description: description2
+          } : {},
+          required: required2.has(id2),
+          options: options.filter((option2) => !!option2),
+          ...defaultValue !== void 0 ? {
+            defaultValue
+          } : {}
+        });
+        continue;
+      }
+      fields.push(secret ? {
+        id: id2,
+        type: "secret",
+        label: label2,
+        ...description2 !== void 0 ? {
+          description: description2
+        } : {},
+        required: required2.has(id2)
+      } : {
+        id: id2,
+        type: "text",
+        label: label2,
+        ...description2 !== void 0 ? {
+          description: description2
+        } : {},
+        required: required2.has(id2),
+        ...defaultValue !== void 0 ? {
+          defaultValue
+        } : {}
+      });
+    }
+    if (fields.length === 0) return null;
+    const form = {
+      title: typeof schema2.title === "string" ? schema2.title : void 0,
+      description: typeof schema2.description === "string" ? schema2.description : void 0,
+      fields
+    };
+    return isAcpAuthenticationFormWithinByteLimit(form) ? form : null;
+  }
+  function getAuthMethodType(method) {
+    const type2 = asRecord(method)?.type;
+    return type2 === "env_var" || type2 === "terminal" ? type2 : "agent";
+  }
   function getBuiltinDisplayName(agentType) {
     return getManagedBuiltinRuntimeByAgentType(agentType)?.displayName ?? agentType;
   }
@@ -129476,7 +129769,7 @@ ${fallbackStderrTail}` : errorMessage2;
       NO_COLOR: "1"
     };
     delete baseEnv.FORCE_COLOR;
-    return withoutElectronBootstrapCredentials(withDefaultAcpPathEntries(mergeACPProcessEnv(options.launch, mergeLoginShellEnv(baseEnv, loginShellEnv)), options.agentType));
+    return withLoopbackNoProxy(withoutElectronBootstrapCredentials(withLodyNpmCacheForNpx(options.launch.command, withDefaultAcpPathEntries(mergeACPProcessEnv(options.launch, mergeLoginShellEnv(baseEnv, loginShellEnv)), options.agentType))));
   }
   async function probeBuiltinAuthentication(options) {
     options.signal?.throwIfAborted();
@@ -129600,8 +129893,8 @@ ${fallbackStderrTail}` : errorMessage2;
     spawnProcess;
     resolveLoginShellEnv;
     async authenticate(options) {
-      const managedBuiltinAgentType = options.cliType === "builtin" && isManagedBuiltinAgentType(options.agentType) ? options.agentType : null;
-      const displayName = managedBuiltinAgentType ? getBuiltinDisplayName(managedBuiltinAgentType) : options.agentType;
+      const isBuiltinAuthentication = options.cliType === "builtin" && isManagedBuiltinAgentType(options.agentType);
+      const displayName = isBuiltinAuthentication ? getBuiltinDisplayName(options.agentType) : options.agentType;
       if (this.runningByAgentType.has(options.agentType)) {
         return {
           success: false,
@@ -129616,7 +129909,7 @@ ${fallbackStderrTail}` : errorMessage2;
         terminating: false,
         acceptsAuthorizationCode: false,
         authorizationCodeSubmitted: false,
-        abort: new AbortController()
+        abortController: new AbortController()
       };
       this.runningByAgentType.set(options.agentType, running2);
       let timeoutHandle;
@@ -129647,6 +129940,11 @@ ${fallbackStderrTail}` : errorMessage2;
       timeoutHandle = setTimeout(() => {
         if (running2.cancelled) return;
         running2.timedOut = true;
+        running2.abortController.abort();
+        running2.pendingInteraction?.resolve({
+          action: "cancel"
+        });
+        running2.pendingInteraction = void 0;
         if (!running2.child && this.runningByAgentType.get(options.agentType) === running2) {
           this.runningByAgentType.delete(options.agentType);
         }
@@ -129654,18 +129952,103 @@ ${fallbackStderrTail}` : errorMessage2;
       }, this.authenticationTimeoutMs);
       timeoutHandle.unref?.();
       try {
-        const result = managedBuiltinAgentType ? await this.runBuiltinLogin({
-          options,
-          running: running2,
-          interruptedResult,
-          agentType: managedBuiltinAgentType,
-          displayName
-        }) : await this.runProtocolAuthentication({
-          options,
-          running: running2,
-          interruptedResult
+        if (!isBuiltinAuthentication) {
+          return await this.authenticateProtocolDrivenAcp(options, running2);
+        }
+        const agentType = options.agentType;
+        const launch = await resolveBuiltinAuthenticationProcessLaunch({
+          cliType: options.cliType,
+          agentType: options.agentType,
+          runtimeOverrides: options.runtimeOverrides,
+          action: "login"
         });
-        return result;
+        if (!launch) {
+          throw new Error(`${displayName} authentication is unavailable`);
+        }
+        const launchInterruption = interruptedResult();
+        if (launchInterruption) return launchInterruption;
+        const env2 = await buildAuthenticationProcessEnv({
+          launch,
+          agentType: options.agentType,
+          env: options.env,
+          resolveLoginShellEnv: this.resolveLoginShellEnv
+        });
+        const preparationInterruption = interruptedResult();
+        if (preparationInterruption) return preparationInterruption;
+        options.onProgress?.({
+          status: "starting"
+        });
+        const child = this.spawnProcess(launch.command, launch.args, {
+          cwd: os__default$1.homedir(),
+          env: env2,
+          stdio: [
+            "pipe",
+            "pipe",
+            "pipe"
+          ],
+          detached: process.platform !== "win32",
+          windowsHide: true
+        });
+        running2.child = child;
+        child.stdin?.on("error", (error2) => {
+          this.logger.debug(`[acp-auth] ${displayName} authorization input failed: ${formatErrorMessage(error2)}`);
+        });
+        const outputParser = new BuiltinAuthenticationOutputParser(agentType);
+        const emitOutput = (stream2, chunk) => {
+          const output = String(chunk);
+          if (output.length === 0) return;
+          const authorization = outputParser.push(output);
+          if (authorization) {
+            running2.acceptsAuthorizationCode = authorization.acceptsAuthorizationCode === true;
+            options.onProgress?.({
+              status: "authorization",
+              ...authorization
+            });
+          }
+          options.onProgress?.({
+            status: "output",
+            stream: stream2,
+            output: output.slice(0, 16384)
+          });
+        };
+        child.stdout?.on("data", (chunk) => emitOutput("stdout", chunk));
+        child.stderr?.on("data", (chunk) => emitOutput("stderr", chunk));
+        const exit2 = await new Promise((resolve2) => {
+          let settled = false;
+          const finish = (result) => {
+            if (settled) return;
+            settled = true;
+            resolve2(result);
+          };
+          child.once("error", (error2) => finish({
+            code: null,
+            error: error2
+          }));
+          child.once("exit", (code2) => finish({
+            code: code2
+          }));
+        });
+        const processInterruption = interruptedResult();
+        if (processInterruption) return processInterruption;
+        if (exit2.error !== void 0 || exit2.code !== 0) {
+          const error2 = exit2.error !== void 0 ? formatErrorMessage(exit2.error) : formatAuthenticationExitError(agentType, displayName, exit2.code);
+          options.onProgress?.({
+            status: "error",
+            error: error2
+          });
+          return {
+            success: false,
+            disposition: "error",
+            error: error2
+          };
+        }
+        options.onProgress?.({
+          status: "authenticated"
+        });
+        return {
+          success: true,
+          disposition: "authenticated"
+        };
       } catch (error2) {
         const interruption2 = interruptedResult();
         if (interruption2) return interruption2;
@@ -129688,250 +130071,24 @@ ${fallbackStderrTail}` : errorMessage2;
         }
       }
     }
-    async runBuiltinLogin(ctx) {
-      const { options, interruptedResult, agentType, displayName } = ctx;
-      const launch = await resolveBuiltinAuthenticationProcessLaunch({
-        cliType: options.cliType,
-        agentType: options.agentType,
-        runtimeOverrides: options.runtimeOverrides,
-        action: "login"
-      });
-      if (!launch) {
-        throw new Error(`${displayName} authentication is unavailable`);
-      }
-      const launchInterruption = interruptedResult();
-      if (launchInterruption) return launchInterruption;
-      const env2 = await buildAuthenticationProcessEnv({
-        launch,
-        agentType: options.agentType,
-        env: options.env,
-        resolveLoginShellEnv: this.resolveLoginShellEnv
-      });
-      const preparationInterruption = interruptedResult();
-      if (preparationInterruption) return preparationInterruption;
-      options.onProgress?.({
-        status: "starting"
-      });
-      return await this.runLoginProcess({
-        ...ctx,
-        displayName,
-        command: launch.command,
-        args: launch.args,
-        env: env2,
-        parser: new BuiltinAuthenticationOutputParser(agentType),
-        formatExitError: (code2) => formatAuthenticationExitError(agentType, displayName, code2),
-        acceptsAuthorizationCodeOnStdin: true
-      });
+    getAgentType(requestId) {
+      return this.findRunningAuthentication(requestId)?.agentType;
     }
-    async runProtocolAuthentication(ctx) {
-      const { options, running: running2, interruptedResult } = ctx;
-      const launch = await resolveACPProcessLaunchAsync({
-        cliType: options.cliType,
-        agentType: options.agentType,
-        customAcp: options.customAcp,
-        runtimeOverrides: options.runtimeOverrides,
-        signal: running2.abort.signal
-      });
-      const launchInterruption = interruptedResult();
-      if (launchInterruption) return launchInterruption;
-      const env2 = await this.buildAcpAuthenticationProcessEnv(launch, options, {
-        protocolStdio: true
-      });
-      const preparationInterruption = interruptedResult();
-      if (preparationInterruption) return preparationInterruption;
-      options.onProgress?.({
-        status: "starting"
-      });
-      const outcome = await runAcpProtocolAuthentication({
-        launch: {
-          command: launch.command,
-          args: launch.args
-        },
-        cliType: options.cliType,
-        agentType: options.agentType,
-        workdir: os__default$1.homedir(),
-        env: env2,
-        methodId: options.methodId,
-        logger: this.logger,
-        signal: running2.abort.signal,
-        onProgress: options.onProgress,
-        attachProcess: (child) => {
-          running2.child = child;
-        },
-        spawnProcess: this.spawnProcess
-      });
-      const outcomeInterruption = interruptedResult();
-      if (outcomeInterruption) return outcomeInterruption;
-      if (outcome.kind === "authenticated") {
-        options.onProgress?.({
-          status: "authenticated"
-        });
-        return {
-          success: true,
-          disposition: "authenticated"
-        };
-      }
-      if (outcome.kind === "method-required") {
-        return {
-          success: true,
-          disposition: "method-required",
-          authMethods: outcome.authMethods.map((method) => ({
-            type: method.type,
-            id: method.id,
-            ...method.name ? {
-              name: method.name
-            } : {},
-            ...method.description ? {
-              description: method.description
-            } : {}
-          }))
-        };
-      }
-      if (outcome.kind === "terminal-method") {
-        running2.child = void 0;
-        return await this.runTerminalAuthMethod(ctx, outcome.method);
-      }
-      options.onProgress?.({
-        status: "error",
-        error: outcome.error
-      });
-      return {
-        success: false,
-        disposition: "error",
-        error: outcome.error
-      };
-    }
-    async runTerminalAuthMethod(ctx, method) {
-      const { options, interruptedResult } = ctx;
-      const displayName = describeAcpAuthMethod(method);
-      const launch = await resolveACPProcessLaunchAsync({
-        cliType: options.cliType,
-        agentType: options.agentType,
-        customAcp: options.customAcp,
-        runtimeOverrides: options.runtimeOverrides,
-        extraArgs: [
-          ...method.args ?? []
-        ],
-        signal: ctx.running.abort.signal
-      });
-      const launchInterruption = interruptedResult();
-      if (launchInterruption) return launchInterruption;
-      const env2 = await this.buildAcpAuthenticationProcessEnv(launch, options, {
-        methodEnv: method.env
-      });
-      const preparationInterruption = interruptedResult();
-      if (preparationInterruption) return preparationInterruption;
-      return await this.runLoginProcess({
-        ...ctx,
-        displayName,
-        command: launch.command,
-        args: launch.args,
-        env: env2,
-        parser: new AcpAgentAuthorizationOutputParser(),
-        formatExitError: (code2) => `${options.agentType} authentication exited with code ${code2 ?? "unknown"}`,
-        acceptsAuthorizationCodeOnStdin: false
-      });
-    }
-    async buildAcpAuthenticationProcessEnv(launch, options, settings = {}) {
-      const env2 = await buildAuthenticationProcessEnv({
-        launch,
-        agentType: options.agentType,
-        env: settings.methodEnv ? {
-          ...options.env,
-          ...settings.methodEnv
-        } : options.env,
-        resolveLoginShellEnv: this.resolveLoginShellEnv
-      });
-      if (settings.protocolStdio) {
-        delete env2.TERM;
-      }
-      return withLodyNpmCacheForNpx(launch.command, env2);
-    }
-    async runLoginProcess(ctx) {
-      const { options, running: running2, interruptedResult, displayName } = ctx;
-      const child = this.spawnProcess(ctx.command, ctx.args, {
-        cwd: os__default$1.homedir(),
-        env: ctx.env,
-        stdio: [
-          "pipe",
-          "pipe",
-          "pipe"
-        ],
-        detached: process.platform !== "win32",
-        windowsHide: true
-      });
-      running2.child = child;
-      if (running2.cancelled || running2.timedOut) {
-        this.terminateAuthentication(options.agentType, running2, running2.cancelled ? "cancelled" : "timed out");
-      }
-      child.stdin?.on("error", (error2) => {
-        this.logger.debug(`[acp-auth] ${displayName} authorization input failed: ${formatErrorMessage(error2)}`);
-      });
-      const emitOutput = (stream2, chunk) => {
-        const output = String(chunk);
-        if (output.length === 0) return;
-        const authorization = ctx.parser.push(output);
-        if (authorization) {
-          running2.acceptsAuthorizationCode = ctx.acceptsAuthorizationCodeOnStdin && authorization.acceptsAuthorizationCode === true;
-          options.onProgress?.({
-            status: "authorization",
-            ...authorization
-          });
-        }
-        options.onProgress?.({
-          status: "output",
-          stream: stream2,
-          output: output.slice(0, 16384)
-        });
-      };
-      child.stdout?.on("data", (chunk) => emitOutput("stdout", chunk));
-      child.stderr?.on("data", (chunk) => emitOutput("stderr", chunk));
-      const exit2 = await new Promise((resolve2) => {
-        let settled = false;
-        const finish = (result) => {
-          if (settled) return;
-          settled = true;
-          resolve2(result);
-        };
-        child.once("error", (error2) => finish({
-          code: null,
-          error: error2
-        }));
-        child.once("exit", (code2) => finish({
-          code: code2
-        }));
-      });
-      const processInterruption = interruptedResult();
-      if (processInterruption) return processInterruption;
-      if (exit2.error !== void 0 || exit2.code !== 0) {
-        const error2 = exit2.error !== void 0 ? formatErrorMessage(exit2.error) : ctx.formatExitError(exit2.code);
-        options.onProgress?.({
-          status: "error",
-          error: error2
-        });
-        return {
-          success: false,
-          disposition: "error",
-          error: error2
-        };
-      }
-      options.onProgress?.({
-        status: "authenticated"
-      });
-      return {
-        success: true,
-        disposition: "authenticated"
-      };
-    }
-    cancel(agentType, requestId) {
-      const running2 = this.runningByAgentType.get(agentType);
-      if (!running2 || running2.requestId !== requestId) {
+    cancel(requestId) {
+      const active2 = this.findRunningAuthentication(requestId);
+      if (!active2) {
         return {
           success: true,
           disposition: "not-running"
         };
       }
+      const { agentType, running: running2 } = active2;
       running2.cancelled = true;
+      running2.abortController.abort();
+      running2.pendingInteraction?.resolve({
+        action: "cancel"
+      });
+      running2.pendingInteraction = void 0;
       if (!running2.child && this.runningByAgentType.get(agentType) === running2) {
         this.runningByAgentType.delete(agentType);
       }
@@ -129941,14 +130098,15 @@ ${fallbackStderrTail}` : errorMessage2;
         disposition: "cancelled"
       };
     }
-    submitAuthorizationCode(agentType, requestId, authorizationCode) {
-      const running2 = this.runningByAgentType.get(agentType);
-      if (!running2 || running2.requestId !== requestId) {
+    submitAuthorizationCode(requestId, authorizationCode) {
+      const active2 = this.findRunningAuthentication(requestId);
+      if (!active2) {
         return {
           success: true,
           disposition: "not-running"
         };
       }
+      const { agentType, running: running2 } = active2;
       if (!running2.acceptsAuthorizationCode) {
         return {
           success: false,
@@ -129996,8 +130154,327 @@ ${fallbackStderrTail}` : errorMessage2;
         };
       }
     }
+    submitAuthenticationInput(requestId, interactionId, authenticationInput) {
+      const active2 = this.findRunningAuthentication(requestId);
+      if (!active2) {
+        return {
+          success: true,
+          disposition: "not-running"
+        };
+      }
+      const { agentType, running: running2 } = active2;
+      const pending2 = running2.pendingInteraction;
+      if (!pending2 || pending2.id !== interactionId) {
+        return {
+          success: false,
+          disposition: "error",
+          error: `${getBuiltinDisplayName(agentType)} is not waiting for this authentication input`
+        };
+      }
+      const parsedJson = (() => {
+        try {
+          return JSON.parse(authenticationInput);
+        } catch {
+          return null;
+        }
+      })();
+      const parsed = AcpAuthenticationInteractionInputSchema.safeParse(parsedJson);
+      if (!parsed.success) {
+        return {
+          success: false,
+          disposition: "error",
+          error: "Invalid authentication input"
+        };
+      }
+      running2.pendingInteraction = void 0;
+      pending2.resolve(parsed.data);
+      return {
+        success: true,
+        disposition: "input-accepted"
+      };
+    }
+    findRunningAuthentication(requestId) {
+      for (const [agentType, running2] of this.runningByAgentType) {
+        if (running2.requestId === requestId) return {
+          agentType,
+          running: running2
+        };
+      }
+      return void 0;
+    }
+    waitForAuthenticationInput(running2, interactionId) {
+      if (running2.pendingInteraction) {
+        return null;
+      }
+      return new Promise((resolve2) => {
+        running2.pendingInteraction = {
+          id: interactionId,
+          resolve: resolve2
+        };
+        if (running2.abortController.signal.aborted) {
+          running2.pendingInteraction = void 0;
+          resolve2({
+            action: "cancel"
+          });
+        }
+      });
+    }
+    async authenticateProtocolDrivenAcp(options, running2) {
+      const launch = await resolveACPProcessLaunchAsync({
+        cliType: options.cliType,
+        agentType: options.agentType,
+        customAcp: options.customAcp,
+        runtimeOverrides: options.runtimeOverrides,
+        signal: running2.abortController.signal
+      });
+      const env2 = await buildAuthenticationProcessEnv({
+        launch,
+        agentType: options.agentType,
+        env: options.env,
+        resolveLoginShellEnv: this.resolveLoginShellEnv
+      });
+      delete env2.TERM;
+      running2.abortController.signal.throwIfAborted();
+      let lastStderrTail = "";
+      await withAcpSessionStartSlot({
+        label: `acp-auth:${options.agentType}`,
+        logger: this.logger,
+        abortSignal: running2.abortController.signal
+      }, async () => await runNpxStartupWithRecovery({
+        command: launch.command,
+        args: launch.args,
+        env: env2,
+        logger: this.logger,
+        logPrefix: "[acp-auth]",
+        getStderrTail: () => lastStderrTail,
+        attempt: async ({ args: args2 }) => {
+          running2.abortController.signal.throwIfAborted();
+          lastStderrTail = "";
+          options.onProgress?.({
+            status: "starting"
+          });
+          const child = spawnAcpProcess({
+            cliType: options.cliType,
+            agentType: options.agentType,
+            customAcp: options.customAcp,
+            runtimeOverrides: options.runtimeOverrides,
+            workdir: process.cwd(),
+            env: env2,
+            command: launch.command,
+            args: [
+              ...args2
+            ],
+            spawnImpl: this.spawnProcess
+          });
+          running2.child = child;
+          running2.terminating = false;
+          child.stderr?.setEncoding("utf8");
+          const authorizationParser = new AcpAgentAuthorizationOutputParser();
+          child.stderr?.on("data", (chunk) => {
+            lastStderrTail = appendStderrTail(lastStderrTail, chunk);
+            const authorization = authorizationParser.push(chunk);
+            if (authorization && isAllowedAuthorizationUrl(authorization.authorizationUrl)) {
+              options.onProgress?.({
+                status: "authorization",
+                ...authorization
+              });
+            }
+          });
+          const startupMonitor = createAcpStartupMonitor({
+            onExit: (listener) => {
+              child.on("exit", listener);
+              return () => child.off("exit", listener);
+            },
+            onError: (listener) => {
+              child.on("error", listener);
+              return () => child.off("error", listener);
+            }
+          }, {
+            sessionId: `acp-auth:${options.agentType}`,
+            command: launch.command,
+            args: [
+              ...args2
+            ],
+            getStderrTail: () => ""
+          });
+          try {
+            running2.abortController.signal.throwIfAborted();
+            if (!child.stdin || !child.stdout) {
+              throw new Error(`${options.agentType} ACP authentication streams are unavailable`);
+            }
+            let interactionError;
+            const app = client$2({
+              name: "lody-authentication"
+            }).onRequest(methods$1.client.elicitation.create, async ({ params }) => {
+              const raw2 = asRecord(params);
+              if (raw2?.mode === "url") {
+                if (typeof raw2.url !== "string" || !isAllowedAuthorizationUrl(raw2.url)) {
+                  const error2 = `${options.agentType} requested an unsafe authentication URL. Lody only opens HTTP and HTTPS authorization pages.`;
+                  interactionError = error2;
+                  this.logger.debug(`[acp-auth] ${error2}`);
+                  options.onProgress?.({
+                    status: "error",
+                    error: error2
+                  });
+                  return {
+                    action: "decline"
+                  };
+                }
+                const interactionId2 = randomUUID();
+                const inputPromise2 = this.waitForAuthenticationInput(running2, interactionId2);
+                if (!inputPromise2) return {
+                  action: "decline"
+                };
+                options.onProgress?.({
+                  status: "authorization",
+                  authorizationUrl: raw2.url,
+                  interactionId: interactionId2,
+                  message: typeof raw2.message === "string" ? raw2.message.slice(0, ACP_AUTH_TEXT_MAX_LENGTH) : void 0,
+                  requiresAuthorizationConsent: true
+                });
+                const input22 = await inputPromise2;
+                return input22.action === "accept" ? {
+                  action: "accept"
+                } : {
+                  action: input22.action
+                };
+              }
+              const form = toAuthenticationForm(params);
+              if (!form) {
+                const error2 = `${options.agentType} requested an unsupported authentication form or one larger than Lody's ${ACP_AUTHENTICATION_FORM_MAX_BYTES / 1024} KiB limit. Lody currently supports text, secret, and single-select fields.`;
+                interactionError = error2;
+                this.logger.debug(`[acp-auth] ${error2}`);
+                options.onProgress?.({
+                  status: "error",
+                  error: error2
+                });
+                return {
+                  action: "decline"
+                };
+              }
+              const interactionId = randomUUID();
+              const inputPromise = this.waitForAuthenticationInput(running2, interactionId);
+              if (!inputPromise) return {
+                action: "decline"
+              };
+              options.onProgress?.({
+                status: "input-required",
+                interactionId,
+                message: typeof raw2?.message === "string" ? raw2.message.slice(0, ACP_AUTH_TEXT_MAX_LENGTH) : `Enter the information requested by ${options.agentType}`,
+                form
+              });
+              const input2 = await inputPromise;
+              return input2.action === "accept" ? {
+                action: "accept",
+                content: input2.content ?? {}
+              } : {
+                action: input2.action
+              };
+            });
+            const stream2 = ndJsonStream(createStdinWritableStream(child.stdin), createStdoutReadableStream(child.stdout));
+            await Promise.race([
+              app.connectWith(stream2, async (context2) => {
+                const initialized2 = await context2.request(methods$1.agent.initialize, {
+                  protocolVersion: PROTOCOL_VERSION,
+                  clientCapabilities: {
+                    auth: {
+                      terminal: false
+                    },
+                    elicitation: {
+                      form: {},
+                      url: {}
+                    }
+                  },
+                  clientInfo: {
+                    name: "lody",
+                    title: "Lody",
+                    version: "1"
+                  }
+                }, {
+                  cancellationSignal: running2.abortController.signal
+                });
+                const advertisedMethods = [
+                  ...initialized2.authMethods ?? []
+                ];
+                const methods2 = advertisedMethods.filter((method) => getAuthMethodType(method) === "agent");
+                if (methods2.length === 0) {
+                  const unsupportedTypes = new Set(advertisedMethods.map((method) => getAuthMethodType(method)));
+                  const hasDeprecatedEnv = unsupportedTypes.has("env_var");
+                  const hasUnsupportedTerminal = unsupportedTypes.has("terminal");
+                  throw new Error(hasDeprecatedEnv && hasUnsupportedTerminal ? `${options.agentType} only advertised deprecated env_var and unsupported terminal authentication methods` : hasDeprecatedEnv ? `${options.agentType} only advertised the deprecated ACP env_var authentication method` : hasUnsupportedTerminal ? `${options.agentType} only advertised terminal authentication, which requires an interactive terminal that is not available over Machine RPC` : `${options.agentType} did not advertise an authentication method`);
+                }
+                if (methods2.length > ACP_AUTH_METHOD_MAX_COUNT || new Set(methods2.map((method) => method.id)).size !== methods2.length || methods2.some((method) => typeof method.id !== "string" || !method.id.trim() || method.id.length > ACP_AUTH_ID_MAX_LENGTH)) {
+                  throw new Error(`${options.agentType} advertised too many or invalid authentication methods`);
+                }
+                let methodId;
+                if (methods2.length === 1) {
+                  methodId = methods2[0]?.id;
+                }
+                if (!methodId) {
+                  const interactionId = randomUUID();
+                  const inputPromise = this.waitForAuthenticationInput(running2, interactionId);
+                  if (!inputPromise) {
+                    throw new Error(`${options.agentType} requested overlapping authentication interactions`);
+                  }
+                  options.onProgress?.({
+                    status: "auth-methods",
+                    interactionId,
+                    authMethods: methods2
+                  });
+                  const input2 = await inputPromise;
+                  if (input2.action !== "accept" || !input2.methodId) {
+                    throw new DOMException("ACP authentication was cancelled", "AbortError");
+                  }
+                  methodId = input2.methodId;
+                }
+                const selectedMethod = methods2.find((method) => method.id === methodId);
+                if (!selectedMethod) {
+                  const advertisedMethod = advertisedMethods.find((method) => method.id === methodId);
+                  if (advertisedMethod) {
+                    throw new Error(getAuthMethodType(advertisedMethod) === "env_var" ? `${options.agentType} authentication method ${methodId} uses deprecated env_var authentication` : `${options.agentType} authentication method ${methodId} requires an interactive terminal that is not available over Machine RPC`);
+                  }
+                  throw new Error(`${options.agentType} no longer advertises authentication method ${methodId}`);
+                }
+                await context2.request(methods$1.agent.authenticate, {
+                  methodId
+                }, {
+                  cancellationSignal: running2.abortController.signal
+                });
+                if (interactionError) {
+                  throw new Error(interactionError);
+                }
+              }),
+              startupMonitor.abortPromise
+            ]);
+          } finally {
+            running2.pendingInteraction?.resolve({
+              action: "cancel"
+            });
+            running2.pendingInteraction = void 0;
+            startupMonitor.dispose();
+            await shutdownLocalAcpAgent({
+              agentProcess: child,
+              logger: this.logger,
+              sessionLabel: `acp-auth:${options.agentType}:protocol`,
+              exitTimeoutMs: this.terminationGraceMs
+            }).catch((error2) => {
+              this.logger.debug(`[acp-auth] Failed to terminate protocol authentication process: ${formatErrorMessage(error2)}`);
+            });
+            if (running2.child === child) running2.child = void 0;
+          }
+        }
+      }));
+      running2.abortController.signal.throwIfAborted();
+      options.onProgress?.({
+        status: "authenticated"
+      });
+      return {
+        success: true,
+        disposition: "authenticated"
+      };
+    }
     terminateAuthentication(agentType, running2, reason) {
-      running2.abort.abort();
+      running2.abortController.abort();
       if (running2.terminating || !running2.child) return;
       running2.terminating = true;
       void shutdownLocalAcpAgent({
@@ -134297,6 +134774,7 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
     return firstDataMessage ?? error2.message;
   };
   const isUpstreamApiACPError = (error2) => /API Error:\s*(?:500|502|503|529)\b/.test(getACPDiagnosticText(error2, error2));
+  const isProviderOverloadedACPError = (error2) => getStringField(error2.data, "codexErrorInfo") === "serverOverloaded";
   const isAcpSessionStorageIncompatibleError = (error2) => {
     const diagnosticText = getACPDiagnosticText(error2);
     return /session artifact[\s\S]{0,1000}uses \.jsonl(?:\.zstd)?[\s\S]{0,1000}configured for compression/iu.test(diagnosticText) || /session root[\s\S]{0,1000}contains both raw and Zstandard session artifacts/iu.test(diagnosticText);
@@ -134329,6 +134807,9 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
         if (isAgentDisconnectedError(error2) || isAcpSessionNotFoundError(error2)) {
           return "agent_disconnected";
         }
+        if (isProviderOverloadedACPError(error2)) {
+          return "acp_provider_overloaded";
+        }
         if (isUpstreamApiACPError(error2)) {
           return "acp_upstream_api_error";
         }
@@ -134359,10 +134840,15 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
     if (failureReason === "acp_upstream_api_error") {
       return false;
     }
+    if (failureReason === "acp_provider_overloaded") {
+      return false;
+    }
     return error2.code === ACP_ERROR_CODES.INTERNAL_ERROR;
   };
   const shouldRecoverStaleACPConnectionPrompt = (args2) => !args2.alreadyAttempted && !args2.hasPromptOutput && (isAgentDisconnectedError(args2.error) || isAcpSessionNotFoundError(args2.error));
   const TURN_FINALIZATION_STAGE_WARN_MS = 5e3;
+  const ACP_AUTHENTICATION_WORKFLOW_DEADLINE_MS = 295e3;
+  const ACP_POST_AUTH_REFRESH_MAX_MS = 6e4;
   const SILENT_TURN_FAILURE_MESSAGE = "The agent ended the turn without producing any output. The model call most likely failed upstream (a context-length or rate-limit rejection is the usual cause) and the agent reported it as a normal completion instead of an error. Retry your message, or start a new session if this conversation has grown too long.";
   class SessionTurnCancelled extends TaggedError("SessionTurnCancelled") {
   }
@@ -134411,19 +134897,23 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
   const summarizeAcpAuthMethod = (method) => {
     const record2 = typeof method === "object" && method !== null ? method : {};
     const type2 = record2.type === "terminal" || record2.type === "env_var" ? record2.type : "agent";
+    const boundedString = (value, maxLength) => typeof value === "string" ? value.slice(0, maxLength) : void 0;
+    const id2 = boundedString(record2.id, 1024);
+    const name2 = boundedString(record2.name, 4096);
+    const description2 = boundedString(record2.description, 16384);
     return {
       type: type2,
-      ...typeof record2.id === "string" ? {
-        id: record2.id
+      ...id2 !== void 0 ? {
+        id: id2
       } : {},
-      ...typeof record2.name === "string" ? {
-        name: record2.name
+      ...name2 !== void 0 ? {
+        name: name2
       } : {},
-      ...typeof record2.description === "string" ? {
-        description: record2.description
+      ...description2 !== void 0 ? {
+        description: description2
       } : {},
       ...Array.isArray(record2.args) && record2.args.every((arg) => typeof arg === "string") ? {
-        args: record2.args
+        args: record2.args.slice(0, 64).map((arg) => arg.slice(0, 4096))
       } : {}
     };
   };
@@ -137182,11 +137672,14 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
       });
     }
     async authenticateMachineAcp(message, options = {}) {
+      const workflowStartedAt = Date.now();
+      const targetRequestId = message.action === "start" ? message.requestId : message.authenticationRequestId;
+      const activeAgentType = this.acpAuthenticationManager.getAgentType(targetRequestId);
       const base = {
         type: "machine/acp-authenticate_response",
         machineId: this.deps.machineId,
         requestId: message.requestId,
-        agentType: message.agentType
+        agentType: activeAgentType ?? "unknown"
       };
       if (message.machineId !== this.deps.machineId) {
         return {
@@ -137199,68 +137692,100 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
       if (message.action === "cancel") {
         return {
           ...base,
-          ...this.acpAuthenticationManager.cancel(message.agentType, message.requestId)
+          ...this.acpAuthenticationManager.cancel(message.authenticationRequestId)
         };
       }
       if (message.action === "submit-code") {
-        if (!message.authenticationRequestId || !message.authorizationCode) {
-          return {
-            ...base,
-            success: false,
-            disposition: "error",
-            error: "Missing authentication request or authorization code"
-          };
-        }
         return {
           ...base,
-          ...this.acpAuthenticationManager.submitAuthorizationCode(message.agentType, message.authenticationRequestId, message.authorizationCode)
+          ...this.acpAuthenticationManager.submitAuthorizationCode(message.authenticationRequestId, message.authorizationCode)
+        };
+      }
+      if (message.action === "submit-input") {
+        return {
+          ...base,
+          ...this.acpAuthenticationManager.submitAuthenticationInput(message.authenticationRequestId, message.interactionId, message.authenticationInput)
+        };
+      }
+      const config2 = await this.deps.workspaceDocument.getAgentConfigForMachineLaunch(message.configId, this.deps.machineId);
+      if (!config2 || config2.cliType === "custom" && !config2.customAcp) {
+        return {
+          ...base,
+          success: false,
+          disposition: "error",
+          error: `Provider config not found or invalid on this machine: ${message.configId}`
         };
       }
+      const resolvedBase = {
+        ...base,
+        agentType: config2.agentType
+      };
       const onProgress = (event) => {
+        if (event.status === "auth-methods") {
+          options.onProgress?.({
+            type: "machine/acp-authentication-progress",
+            machineId: this.deps.machineId,
+            requestId: message.requestId,
+            agentType: config2.agentType,
+            status: event.status,
+            interactionId: event.interactionId,
+            authMethods: event.authMethods.map(summarizeAcpAuthMethod)
+          });
+          return;
+        }
         options.onProgress?.({
           type: "machine/acp-authentication-progress",
           machineId: this.deps.machineId,
           requestId: message.requestId,
-          agentType: message.agentType,
+          agentType: config2.agentType,
           ...event
         });
       };
       const result = await this.acpAuthenticationManager.authenticate({
         requestId: message.requestId,
-        cliType: message.cliType,
-        agentType: message.agentType,
-        customAcp: message.customAcp,
-        runtimeOverrides: message.runtimeOverrides,
-        env: message.env,
-        methodId: message.methodId,
+        cliType: config2.cliType,
+        agentType: config2.agentType,
+        customAcp: config2.customAcp,
+        runtimeOverrides: config2.runtimeOverrides,
+        env: config2.env,
         onProgress
       });
-      if (result.disposition === "method-required") {
-        return {
-          ...base,
-          success: true,
-          disposition: "method-required",
-          authRequired: true,
-          authMethods: result.authMethods.map((method) => ({
-            ...method
-          }))
-        };
-      }
-      if (result.success && result.disposition === "authenticated" && message.configId) {
-        const refresh = await this.refreshMachineAcpCapabilities({
-          type: "machine/acp-capabilities-refresh",
-          machineId: message.machineId,
-          workspaceId: message.workspaceId,
-          configId: message.configId,
-          cliType: message.cliType,
-          agentType: message.agentType,
-          customAcp: message.customAcp,
-          runtimeOverrides: message.runtimeOverrides,
-          env: message.env
-        });
+      if (result.success && result.disposition === "authenticated") {
+        const refreshController = new AbortController();
+        const refreshTimeoutMs = Math.max(1, Math.min(ACP_POST_AUTH_REFRESH_MAX_MS, ACP_AUTHENTICATION_WORKFLOW_DEADLINE_MS - (Date.now() - workflowStartedAt)));
+        const refreshTimeout = setTimeout(() => refreshController.abort(), refreshTimeoutMs);
+        refreshTimeout.unref?.();
+        let refresh;
+        try {
+          refresh = await this.refreshMachineAcpCapabilitiesForConfig({
+            type: "machine/acp-capabilities-refresh",
+            machineId: message.machineId,
+            workspaceId: message.workspaceId,
+            configId: message.configId,
+            cliType: config2.cliType,
+            agentType: config2.agentType,
+            customAcp: config2.customAcp,
+            runtimeOverrides: config2.runtimeOverrides,
+            env: config2.env
+          }, {
+            signal: refreshController.signal
+          });
+        } catch (error2) {
+          refresh = {
+            type: "machine/acp-capabilities-refresh_response",
+            machineId: message.machineId,
+            configId: message.configId,
+            cliType: config2.cliType,
+            agentType: config2.agentType,
+            success: false,
+            error: refreshController.signal.aborted ? "Authentication succeeded, but capability verification timed out" : formatErrorMessage(error2)
+          };
+        } finally {
+          clearTimeout(refreshTimeout);
+        }
         if (!refresh.success) {
           return {
-            ...base,
+            ...resolvedBase,
             ...result,
             capabilitiesRefreshed: false,
             authRequired: refresh.authRequired,
@@ -137269,13 +137794,13 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
           };
         }
         return {
-          ...base,
+          ...resolvedBase,
           ...result,
           capabilitiesRefreshed: true
         };
       }
       return {
-        ...base,
+        ...resolvedBase,
         ...result
       };
     }
@@ -137285,12 +137810,34 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
           type: "machine/acp-capabilities-refresh_response",
           machineId: this.deps.machineId,
           configId: message.configId,
-          cliType: message.cliType,
-          agentType: message.agentType,
+          cliType: "builtin",
+          agentType: "unknown",
           success: false,
           error: `Machine mismatch: expected ${this.deps.machineId}, got ${message.machineId}`
         };
       }
+      const config2 = await this.deps.workspaceDocument.getAgentConfigForMachineLaunch(message.configId, this.deps.machineId);
+      if (!config2) {
+        return {
+          type: "machine/acp-capabilities-refresh_response",
+          machineId: this.deps.machineId,
+          configId: message.configId,
+          cliType: "builtin",
+          agentType: "unknown",
+          success: false,
+          error: `Provider config not found on this machine: ${message.configId}`
+        };
+      }
+      return await this.refreshMachineAcpCapabilitiesForConfig({
+        ...message,
+        cliType: config2.cliType,
+        agentType: config2.agentType,
+        customAcp: config2.customAcp,
+        runtimeOverrides: config2.runtimeOverrides,
+        env: config2.env
+      }, options);
+    }
+    async refreshMachineAcpCapabilitiesForConfig(message, options = {}) {
       const dedupeKey = computeAcpRefreshDedupeKey(message.configId, message.cliType, message.agentType, message.env, message.customAcp, message.runtimeOverrides);
       this.deps.logger.debug(`[acp-capabilities] Refresh requested (cliType=${message.cliType} agentType=${message.agentType})`);
       if (options.signal?.aborted) {
@@ -138995,6 +139542,8 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
           configOptionValues: entry.inputConfig?.configOptionValues,
           mcpServerIds: entry.inputConfig?.mcpServerIds ?? [],
           taskToolsEnabled: entry.inputConfig?.taskToolsEnabled === true,
+          agentRoleId: entry.inputConfig?.agentRoleId,
+          agentRoleRevision: entry.inputConfig?.agentRoleRevision,
           issuePRMentions: entry.inputConfig?.issuePRMentions,
           resume: entry.inputConfig?.resume ?? resolveDispatchAcpSessionId(meta)
         },
@@ -139028,6 +139577,8 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
           configOptionValues: entry.inputConfig?.configOptionValues,
           mcpServerIds: entry.inputConfig?.mcpServerIds ?? [],
           taskToolsEnabled: entry.inputConfig?.taskToolsEnabled === true,
+          agentRoleId: entry.inputConfig?.agentRoleId,
+          agentRoleRevision: entry.inputConfig?.agentRoleRevision,
           issuePRMentions: entry.inputConfig?.issuePRMentions,
           resume: entry.inputConfig?.resume
         },
@@ -139084,6 +139635,8 @@ The postId is ${normalizedFeedbackPostId}. Use the feedback-progress-reporter sk
           configOptionValues: isConfigOptionValueRecord(queuedItem.acpSessionConfig?.configOptionValues) ? queuedItem.acpSessionConfig.configOptionValues : void 0,
           mcpServerIds: normalizeMcpServerIdSelection(queuedItem.acpSessionConfig?.mcpServerIds) ?? [],
           taskToolsEnabled: queuedItem.acpSessionConfig?.taskToolsEnabled === true,
+          agentRoleId: queuedItem.acpSessionConfig?.agentRoleId,
+          agentRoleRevision: queuedItem.acpSessionConfig?.agentRoleRevision,
           issuePRMentions: queuedItem.acpSessionConfig?.issuePRMentions,
           resume: resolveResumableAcpSessionId(meta)
         });
@@ -153567,10 +154120,7 @@ ${edit.newString}` : edit.newString;
           type: "machine/acp-capabilities-refresh",
           machineId: machine.id,
           workspaceId: workspace.id,
-          configId: config2.id,
-          cliType: config2.cliType,
-          agentType: config2.agentType,
-          env: config2.env
+          configId: config2.id
         }));
         if (!response2.success) {
           throw new Error(response2.error ?? `Failed to refresh capabilities for ${config2.name} on machine ${machine.id}.`);
@@ -157118,11 +157668,11 @@ ${entry.text}`).join("\n\n");
       return null;
     }
     try {
-      const stat2 = await Yt.stat(absolutePath);
+      const stat2 = await Xt.stat(absolutePath);
       if (!stat2.isFile() || stat2.size > (options?.maxBytes ?? defaultMaxTextFileBytes)) {
         return null;
       }
-      const content = await Yt.readFile(absolutePath);
+      const content = await Xt.readFile(absolutePath);
       if (content.includes(0)) {
         return null;
       }
@@ -167887,38 +168437,59 @@ ${escapeHtmlScriptContent(VISUAL_ANNOTATION_INSPECTOR_BROWSER_SCRIPT)}
               this.triggerPendingProcessLifecycleAction(response2.requestId);
             }
           },
-          refreshMachineAcpCapabilities: async ({ configId, cliType, agentType, customAcp, runtimeOverrides, env: env2, onAcpBinaryProgress, signal }) => await this.executionService.refreshMachineAcpCapabilities({
+          refreshMachineAcpCapabilities: async ({ configId, onAcpBinaryProgress, signal }) => await this.executionService.refreshMachineAcpCapabilities({
             type: "machine/acp-capabilities-refresh",
             machineId: this.machineId,
             workspaceId: this.workspaceId,
-            configId,
-            cliType,
-            agentType,
-            customAcp,
-            runtimeOverrides,
-            env: env2
+            configId
           }, {
             onAcpBinaryProgress,
             signal
           }),
-          authenticateMachineAcp: async ({ requestId, action, authenticationRequestId, authorizationCode, methodId, configId, cliType, agentType, customAcp, runtimeOverrides, env: env2, onProgress }) => await this.authenticateMachineAcpAndResumeSetup({
-            type: "machine/acp-authenticate",
-            machineId: this.machineId,
-            workspaceId: this.workspaceId,
-            requestId,
-            action,
-            authenticationRequestId,
-            authorizationCode,
-            methodId,
-            configId,
-            cliType,
-            agentType,
-            customAcp,
-            runtimeOverrides,
-            env: env2
-          }, {
-            onProgress
-          }),
+          authenticateMachineAcp: async (args2) => {
+            const common2 = {
+              type: "machine/acp-authenticate",
+              machineId: this.machineId,
+              workspaceId: this.workspaceId,
+              requestId: args2.requestId
+            };
+            const message = (() => {
+              switch (args2.action) {
+                case "start":
+                  return {
+                    ...common2,
+                    action: args2.action,
+                    configId: args2.configId
+                  };
+                case "cancel":
+                  return {
+                    ...common2,
+                    action: args2.action,
+                    authenticationRequestId: args2.authenticationRequestId
+                  };
+                case "submit-code":
+                  return {
+                    ...common2,
+                    action: args2.action,
+                    authenticationRequestId: args2.authenticationRequestId,
+                    authorizationCode: args2.authorizationCode
+                  };
+                case "submit-input":
+                  return {
+                    ...common2,
+                    action: args2.action,
+                    authenticationRequestId: args2.authenticationRequestId,
+                    interactionId: args2.interactionId,
+                    authenticationInput: args2.authenticationInput
+                  };
+                default:
+                  throw new Error("Unsupported ACP authentication action");
+              }
+            })();
+            return await this.authenticateMachineAcpAndResumeSetup(message, {
+              onProgress: args2.onProgress
+            });
+          },
           getMachineAcpBinaryStatus: async ({ agentType }) => await this.executionService.getMachineAcpBinaryStatus({
             type: "machine/acp-binary-status",
             machineId: this.machineId,
@@ -171703,19 +172274,64 @@ ${escapeHtmlScriptContent(VISUAL_ANNOTATION_INSPECTOR_BROWSER_SCRIPT)}
       const project = meta.project;
       const ownerSessionId = meta.parentSessionId ?? sessionId;
       if (project?.kind === "local") {
-        const workspaceRoot = await resolveWorkspaceLocalProjectRootPath(this.workspaceDocument.repo, this.workspaceId, this.machineId, project.localProjectId);
-        if (!workspaceRoot) {
+        const originalRootPath = await resolveWorkspaceLocalProjectRootPath(this.workspaceDocument.repo, this.workspaceId, this.machineId, project.localProjectId);
+        if (!originalRootPath) {
           return {
             ok: false,
             error: "workspace_unavailable",
             message: `Local project not found in workspace: ${project.localProjectId}`
           };
         }
+        const isLocalWorktree = meta.isWorktree === true || project.useWorktree === true;
+        if (!isLocalWorktree) {
+          return {
+            ok: true,
+            workspaceRoot: originalRootPath,
+            source: `local-project:${project.localProjectId}`,
+            ...ownerSessionIdField(ownerSessionId)
+          };
+        }
+        const worktreeManager = getWorktreeManager({
+          repoId: deriveRepoIdFromLocalProjectPath(originalRootPath),
+          source: {
+            kind: "local-shared",
+            originalRootPath
+          },
+          logger: this.logger
+        });
+        if (worktreeManager.hasWorktree(ownerSessionId)) {
+          return {
+            ok: true,
+            workspaceRoot: worktreeManager.getWorktreeHostPath(ownerSessionId),
+            source: `local-worktree-existing:${ownerSessionId}`,
+            ...ownerSessionIdField(ownerSessionId)
+          };
+        }
+        this.logCodeCollabDebug(`[${sessionId}] Code Collab v2 workspace resolution waiting for local worktree ownerSessionId=${ownerSessionId} project=${project.localProjectId}`);
+        const waited = await waitForSessionWorkspaceRoot({
+          targetSessionId: ownerSessionId,
+          activeSource: ownerSessionId === sessionId ? "active-session-after-wait" : `active-parent-session:${ownerSessionId}`,
+          pendingSource: ownerSessionId === sessionId ? "pending-session-after-wait" : `pending-parent-session:${ownerSessionId}`,
+          timeoutMs: CODE_COLLAB_WORKSPACE_WAIT_TIMEOUT_MS
+        });
+        if (waited) {
+          return waited.ok ? {
+            ...waited,
+            ...ownerSessionIdField(ownerSessionId)
+          } : waited;
+        }
+        if (worktreeManager.hasWorktree(ownerSessionId)) {
+          return {
+            ok: true,
+            workspaceRoot: worktreeManager.getWorktreeHostPath(ownerSessionId),
+            source: `local-worktree-existing-after-wait:${ownerSessionId}`,
+            ...ownerSessionIdField(ownerSessionId)
+          };
+        }
         return {
-          ok: true,
-          workspaceRoot,
-          source: `local-project:${project.localProjectId}`,
-          ...ownerSessionIdField(ownerSessionId)
+          ok: false,
+          error: "session_initializing",
+          message: "Session workspace is still being prepared. Code Collab will start after the session is ready."
         };
       }
       if (meta.parentSessionId) {
@@ -173213,7 +173829,7 @@ ${escapeHtmlScriptContent(VISUAL_ANNOTATION_INSPECTOR_BROWSER_SCRIPT)}
     }
     async authenticateMachineAcpAndResumeSetup(message, options = {}) {
       const response2 = await this.executionService.authenticateMachineAcp(message, options);
-      if (message.action === "start" && message.configId && response2.success && response2.disposition === "authenticated") {
+      if (message.action === "start" && response2.success && response2.disposition === "authenticated") {
         try {
           await this.providerSetupManager.resumeAfterAuthentication(message.configId);
         } catch (error2) {
@@ -197157,7 +197773,7 @@ Shutting down gracefully${reason}...`);
   function requireLib$1() {
     if (hasRequiredLib$1) return lib$1;
     hasRequiredLib$1 = 1;
-    const Stream = So;
+    const Stream = xo;
     class MuteStream2 extends Stream {
       #isTTY = null;
       constructor(opts = {}) {
@@ -206635,7 +207251,7 @@ ${page}${helpTipBottom}${choiceDescription}${error2}${ansiEscapes.cursorHide}`;
   function requireStreams() {
     if (hasRequiredStreams) return streams;
     hasRequiredStreams = 1;
-    var Buffer2 = require$$0$6.Buffer, Transform2 = So.Transform;
+    var Buffer2 = require$$0$6.Buffer, Transform2 = xo.Transform;
     streams = function(iconv2) {
       iconv2.encodeStream = function encodeStream(encoding2, options) {
         return new IconvLiteEncoderStream(iconv2.getEncoder(encoding2, options), options);
@@ -206855,7 +207471,7 @@ ${page}${helpTipBottom}${choiceDescription}${error2}${ansiEscapes.cursorHide}`;
           return length2;
         };
         if (iconv2.supportsStreams) {
-          var Readable2 = So.Readable;
+          var Readable2 = xo.Readable;
           original.ReadableSetEncoding = Readable2.prototype.setEncoding;
           Readable2.prototype.setEncoding = function setEncoding(enc, options) {
             this._readableState.decoder = iconv2.getDecoder(enc, options);
@@ -206876,7 +207492,7 @@ ${page}${helpTipBottom}${choiceDescription}${error2}${ansiEscapes.cursorHide}`;
         Buffer2.prototype.toString = original.BufferToString;
         Buffer2.prototype.write = original.BufferWrite;
         if (iconv2.supportsStreams) {
-          var Readable2 = So.Readable;
+          var Readable2 = xo.Readable;
           Readable2.prototype.setEncoding = original.ReadableSetEncoding;
           delete Readable2.prototype.collect;
         }
@@ -221554,7 +222170,7 @@ ${page}${helpTipBottom}${choiceDescription}${ansiEscapes.cursorHide}`;
       data = createReviewBundleSnapshot(bundle);
     }
     const { injectReviewSnapshot } = await import("./chunks/index-VoI6Ds2-.js");
-    const { resolveReviewViewerTemplate } = await import("./chunks/review-viewer-UwUaqbcj.js").then(async (m) => {
+    const { resolveReviewViewerTemplate } = await import("./chunks/review-viewer-HMN3RPEa.js").then(async (m) => {
       await m.__tla;
       return m;
     });