opendevbrowser 0.0.25 → 0.0.27

package/dist/cli/index.js

@@ -3,6 +3,7 @@ import {
   CLI_COMMANDS,
   CLI_COMMAND_HELP_DETAILS,
   DEFAULT_CLICK_TRANSPORT_TIMEOUT_MS,
+  DEFAULT_DAEMON_STATUS_FETCH_OPTIONS,
   DEFAULT_DIALOG_TRANSPORT_TIMEOUT_MS,
   DEFAULT_REVIEW_TRANSPORT_TIMEOUT_MS,
   DEFAULT_SCREENSHOT_TRANSPORT_TIMEOUT_MS,
@@ -19,6 +20,8 @@ import {
   VALID_FLAGS,
   buildAnnotateResult,
   callDaemon,
+  createDaemonStopHeaders,
+  createDisconnectedError,
   createOpenDevBrowserCore,
   createUsageError,
   extractExtension,
@@ -28,9 +31,9 @@ import {
   formatErrorPayload,
   generateSecureToken,
   getChromeUserDataRoots,
-  getCurrentDaemonFingerprint,
   getExtensionPath,
   getProfileDirs,
+  isCurrentDaemonFingerprint,
   loadGlobalConfig,
   onboarding_metadata_default,
   readDaemonMetadata,
@@ -38,7 +41,7 @@ import {
   resolveExitCode,
   startDaemon,
   toCliError
-} from "../chunk-7U63PZ4W.js";
+} from "../chunk-MWBDO2L5.js";
 import "../chunk-STGGGVYT.js";
 import {
   createNoOpSkillRemovalResult,
@@ -71,7 +74,7 @@ import {
   setDefaultLogSink,
   stderrSink,
   summarizePrimaryProviderIssue
-} from "../chunk-Z6ENAZUN.js";
+} from "../chunk-V5DJUSPV.js";
 import "../chunk-FUSXMW3G.js";
 
 // src/cli/args.ts
@@ -140,6 +143,17 @@ function parseTransport(args) {
 }
 var VALID_FLAG_SET = new Set(VALID_FLAGS);
 var VALID_EQUALS_FLAG_SET = new Set(VALID_EQUALS_FLAGS);
+var SIGNED_VALUE_FLAG_SET = /* @__PURE__ */ new Set(["--dy"]);
+var SIGNED_INTEGER_VALUE = /^-\d+$/;
+function shouldSkipValueToken(flag, value) {
+  if (!VALID_EQUALS_FLAG_SET.has(flag) || value === void 0) {
+    return false;
+  }
+  if (!value.startsWith("-")) {
+    return true;
+  }
+  return SIGNED_VALUE_FLAG_SET.has(flag) && SIGNED_INTEGER_VALUE.test(value);
+}
 function parseArgs(argv) {
   let args = expandShortFlags(argv.slice(2));
   let commandOverride = null;
@@ -234,7 +248,8 @@ function parseArgs(argv) {
   } else if (noPrompt) {
     mode = "global";
   }
-  for (const arg of args) {
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
     if (arg.startsWith("--") && !VALID_FLAG_SET.has(arg)) {
       if (arg.includes("=")) {
         const baseFlag = arg.split("=", 2)[0] ?? "";
@@ -247,6 +262,9 @@ function parseArgs(argv) {
     if (arg.startsWith("-") && !arg.startsWith("--") && !SHORT_FLAGS[arg]) {
       throw createUsageError(`Unknown flag: ${arg}`);
     }
+    if (shouldSkipValueToken(arg, args[index + 1])) {
+      index += 1;
+    }
   }
   return {
     command: commandOverride ?? "install",
@@ -926,45 +944,292 @@ function installLocal(withConfig = false) {
 import * as fs4 from "fs";
 import * as path2 from "path";
 import * as os2 from "os";
+import { randomUUID } from "crypto";
 var PLUGIN_NAME = "opendevbrowser";
+var CACHE_MANIFEST = "package.json";
+var CACHE_LOCKFILE = "package-lock.json";
+var CACHE_UPDATE_LOCK = ".opendevbrowser-update.lock";
+var CACHE_LOCK_STALE_MS = 30 * 60 * 1e3;
+var DEPENDENCY_SECTIONS = [
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "peerDependencies"
+];
 function getCacheDir() {
   return process.env.OPENCODE_CACHE_DIR || path2.join(os2.homedir(), ".cache", "opencode");
 }
-function rmdir(dirPath) {
-  const cacheDir = getCacheDir();
+function assertCacheChild(targetPath, cacheDir) {
   const resolvedCache = path2.resolve(cacheDir);
-  const resolvedPath = path2.resolve(dirPath);
-  if (!resolvedPath.startsWith(resolvedCache + path2.sep) || resolvedPath === resolvedCache) {
-    throw new Error(`Security: refusing to delete path outside cache directory: ${dirPath}`);
+  const resolvedPath = path2.resolve(targetPath);
+  const relativePath = path2.relative(resolvedCache, resolvedPath);
+  if (!relativePath || relativePath.startsWith("..") || path2.isAbsolute(relativePath)) {
+    throw new Error(`Security: refusing to modify path outside cache directory: ${targetPath}`);
+  }
+}
+function isMissingPathError(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function isExistingPathError(error) {
+  return error instanceof Error && "code" in error && error.code === "EEXIST";
+}
+function assertNoSymlinkCachePath(targetPath, cacheDir) {
+  assertCacheChild(targetPath, cacheDir);
+  const resolvedCache = path2.resolve(cacheDir);
+  const relativeSegments = path2.relative(resolvedCache, path2.resolve(targetPath)).split(path2.sep).filter(Boolean);
+  for (const candidate of [resolvedCache, ...relativeSegments.map((_, index) => path2.join(resolvedCache, ...relativeSegments.slice(0, index + 1)))]) {
+    try {
+      if (fs4.lstatSync(candidate).isSymbolicLink()) {
+        throw new Error(`Security: refusing to modify symlinked cache path: ${candidate}`);
+      }
+    } catch (error) {
+      if (isMissingPathError(error)) {
+        continue;
+      }
+      throw error;
+    }
+  }
+}
+function cacheDirectoryExists(cacheDir) {
+  try {
+    const stat = fs4.lstatSync(cacheDir);
+    if (stat.isSymbolicLink()) {
+      throw new Error(`Security: refusing to modify symlinked cache path: ${cacheDir}`);
+    }
+    if (!stat.isDirectory()) {
+      throw new Error(`${cacheDir} must be a directory`);
+    }
+    return true;
+  } catch (error) {
+    if (isMissingPathError(error)) {
+      return false;
+    }
+    throw error;
+  }
+}
+function removePathIfExists(targetPath, cacheDir) {
+  assertNoSymlinkCachePath(targetPath, cacheDir);
+  if (!fs4.existsSync(targetPath)) {
+    return false;
+  }
+  fs4.rmSync(targetPath, { recursive: true, force: true });
+  return true;
+}
+function cacheFileExists(targetPath, cacheDir) {
+  assertNoSymlinkCachePath(targetPath, cacheDir);
+  try {
+    const stat = fs4.lstatSync(targetPath);
+    if (stat.isSymbolicLink()) {
+      throw new Error(`Security: refusing to modify symlinked cache manifest: ${targetPath}`);
+    }
+    return stat.isFile();
+  } catch (error) {
+    if (isMissingPathError(error)) {
+      return false;
+    }
+    throw error;
+  }
+}
+function writeManifestAtomic(manifestPath, cacheDir, manifest) {
+  const tempPath = `${manifestPath}.${process.pid}.tmp`;
+  assertNoSymlinkCachePath(tempPath, cacheDir);
+  let fd = null;
+  try {
+    fd = fs4.openSync(tempPath, "wx");
+    fs4.writeFileSync(fd, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+    fs4.closeSync(fd);
+    fd = null;
+    fs4.renameSync(tempPath, manifestPath);
+  } catch (error) {
+    if (fd !== null) {
+      fs4.closeSync(fd);
+    }
+    fs4.rmSync(tempPath, { force: true });
+    throw error;
   }
-  if (fs4.existsSync(dirPath)) {
-    fs4.rmSync(dirPath, { recursive: true, force: true });
+}
+function withCacheMutationLock(cacheDir, action) {
+  const lockPath = path2.join(cacheDir, CACHE_UPDATE_LOCK);
+  assertNoSymlinkCachePath(lockPath, cacheDir);
+  let lock = null;
+  try {
+    lock = openCacheMutationLock(lockPath);
+    return action();
+  } catch (error) {
+    if (isExistingPathError(error)) {
+      throw new Error("another update is already running for this OpenCode cache");
+    }
+    throw error;
+  } finally {
+    if (lock !== null) {
+      fs4.closeSync(lock.fd);
+      removeOwnedCacheMutationLock(lockPath, lock.token);
+    }
   }
 }
+function openCacheMutationLock(lockPath) {
+  try {
+    return writeCacheMutationLock(lockPath);
+  } catch (error) {
+    if (!isExistingPathError(error) || !isStaleCacheMutationLock(lockPath)) {
+      throw error;
+    }
+    removeStaleCacheMutationLock(lockPath);
+    return writeCacheMutationLock(lockPath);
+  }
+}
+function writeCacheMutationLock(lockPath) {
+  const fd = fs4.openSync(lockPath, "wx");
+  const token = randomUUID();
+  try {
+    const lock = { pid: process.pid, createdAt: Date.now(), token };
+    fs4.writeFileSync(fd, `${JSON.stringify(lock)}
+`, "utf8");
+    return { fd, token };
+  } catch (error) {
+    fs4.closeSync(fd);
+    fs4.rmSync(lockPath, { force: true });
+    throw error;
+  }
+}
+function isStaleCacheMutationLock(lockPath) {
+  const lock = readCacheMutationLock(lockPath);
+  if (!lock) {
+    return isLegacyCacheMutationLockStale(lockPath);
+  }
+  if (Date.now() - lock.createdAt < CACHE_LOCK_STALE_MS) {
+    return false;
+  }
+  return !isProcessRunning(lock.pid);
+}
+function isLegacyCacheMutationLockStale(lockPath) {
+  try {
+    const pid = readLegacyCacheMutationLockPid(lockPath);
+    if (pid !== null && isProcessRunning(pid)) {
+      return false;
+    }
+    return Date.now() - fs4.statSync(lockPath).mtimeMs >= CACHE_LOCK_STALE_MS;
+  } catch {
+    return false;
+  }
+}
+function readLegacyCacheMutationLockPid(lockPath) {
+  const raw = fs4.readFileSync(lockPath, "utf8").trim();
+  if (!/^\d+$/.test(raw)) {
+    return null;
+  }
+  const pid = Number(raw);
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+function readCacheMutationLock(lockPath) {
+  try {
+    const parsed = JSON.parse(fs4.readFileSync(lockPath, "utf8"));
+    const { pid, createdAt, token } = parsed;
+    const hasToken = token === void 0 || typeof token === "string" && token.length > 0;
+    if (typeof pid === "number" && typeof createdAt === "number" && hasToken && Number.isInteger(pid) && Number.isFinite(createdAt)) {
+      return token === void 0 ? { pid, createdAt } : { pid, createdAt, token };
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function isProcessRunning(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error instanceof Error && "code" in error && error.code === "EPERM";
+  }
+}
+function createExistingLockError() {
+  const error = new Error("cache update lock changed before stale cleanup");
+  error.code = "EEXIST";
+  return error;
+}
+function removeStaleCacheMutationLock(lockPath) {
+  const content = fs4.readFileSync(lockPath, "utf8");
+  if (!isStaleCacheMutationLock(lockPath) || fs4.readFileSync(lockPath, "utf8") !== content) {
+    throw createExistingLockError();
+  }
+  fs4.rmSync(lockPath, { force: true });
+}
+function removeOwnedCacheMutationLock(lockPath, token) {
+  const lock = readCacheMutationLock(lockPath);
+  if (lock?.token === token) {
+    fs4.rmSync(lockPath, { force: true });
+  }
+}
+function preflightCacheMutationPaths(cacheDir, paths) {
+  for (const targetPath of paths) {
+    assertNoSymlinkCachePath(targetPath, cacheDir);
+  }
+}
+function isJsonObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function removeDependencyPin(manifest, section) {
+  const dependencies = manifest[section];
+  if (!isJsonObject(dependencies) || !(PLUGIN_NAME in dependencies)) {
+    return false;
+  }
+  delete dependencies[PLUGIN_NAME];
+  if (Object.keys(dependencies).length === 0) {
+    delete manifest[section];
+  }
+  return true;
+}
+function removeManifestPin(cacheDir) {
+  const manifestPath = path2.join(cacheDir, CACHE_MANIFEST);
+  if (!cacheFileExists(manifestPath, cacheDir)) {
+    return false;
+  }
+  const manifest = JSON.parse(fs4.readFileSync(manifestPath, "utf8"));
+  if (!isJsonObject(manifest)) {
+    throw new Error(`${CACHE_MANIFEST} must contain a JSON object`);
+  }
+  const removed = DEPENDENCY_SECTIONS.map((section) => removeDependencyPin(manifest, section)).some(Boolean);
+  if (removed) {
+    writeManifestAtomic(manifestPath, cacheDir, manifest);
+  }
+  return removed;
+}
 function runUpdate() {
   const cacheDir = getCacheDir();
   const nodeModulesDir = path2.join(cacheDir, "node_modules");
   const pluginCacheDir = path2.join(nodeModulesDir, PLUGIN_NAME);
+  const lockfilePath = path2.join(cacheDir, CACHE_LOCKFILE);
   try {
-    if (!fs4.existsSync(pluginCacheDir)) {
-      if (fs4.existsSync(nodeModulesDir)) {
-        rmdir(nodeModulesDir);
-        return {
-          success: true,
-          message: "Cleared OpenCode plugin cache. The latest version will be installed on next run.",
-          cleared: true
-        };
-      }
+    if (!cacheDirectoryExists(cacheDir)) {
+      return {
+        success: true,
+        message: "No cached plugin found. OpenCode will install the latest version on next run.",
+        cleared: false
+      };
+    }
+    preflightCacheMutationPaths(cacheDir, [
+      path2.join(cacheDir, CACHE_MANIFEST),
+      pluginCacheDir,
+      lockfilePath,
+      path2.join(cacheDir, CACHE_UPDATE_LOCK)
+    ]);
+    const cleared = withCacheMutationLock(cacheDir, () => {
+      const manifestPinRemoved = removeManifestPin(cacheDir);
+      const packageRemoved = removePathIfExists(pluginCacheDir, cacheDir);
+      const lockfileRemoved = removePathIfExists(lockfilePath, cacheDir);
+      return packageRemoved || manifestPinRemoved || lockfileRemoved;
+    });
+    if (!cleared) {
       return {
         success: true,
         message: "No cached plugin found. OpenCode will install the latest version on next run.",
         cleared: false
       };
     }
-    rmdir(pluginCacheDir);
     return {
       success: true,
-      message: "Cache cleared. OpenCode will install the latest version on next run.",
+      message: "Cache repaired. OpenCode will install the latest version on next run.",
       cleared: true
     };
   } catch (error) {
@@ -1053,7 +1318,24 @@ function findInstalledConfigs() {
 import { spawnSync } from "child_process";
 
 // src/cli/utils/parse.ts
+var SIGNED_INTEGER_PATTERN = /^-?\d+$/;
+var UNSIGNED_INTEGER_PATTERN = /^\d+$/;
+var SIGNED_DECIMAL_PATTERN = /^-?(?:\d+|\d+\.\d+|\.\d+)$/;
+var UNSIGNED_DECIMAL_PATTERN = /^(?:\d+|\d+\.\d+|\.\d+)$/;
+function allowsNegative(options) {
+  return typeof options.min !== "number" || options.min < 0;
+}
+function decimalPattern(options) {
+  const signed = allowsNegative(options);
+  if (options.integer ?? true) {
+    return signed ? SIGNED_INTEGER_PATTERN : UNSIGNED_INTEGER_PATTERN;
+  }
+  return signed ? SIGNED_DECIMAL_PATTERN : UNSIGNED_DECIMAL_PATTERN;
+}
 function parseNumberFlag(value, flag, options = {}) {
+  if (value.trim() === "" || value !== value.trim() || !decimalPattern(options).test(value)) {
+    throw createUsageError(`Invalid ${flag}: ${value}`);
+  }
   const parsed = Number(value);
   if (!Number.isFinite(parsed)) {
     throw createUsageError(`Invalid ${flag}: ${value}`);
@@ -1526,7 +1808,15 @@ async function runNativeCommand(args) {
 // src/cli/commands/serve.ts
 var daemonHandle = null;
 var PS_MAX_BUFFER = 8 * 1024 * 1024;
+var DAEMON_SHUTDOWN_POLL_ATTEMPTS = 10;
+var DAEMON_SHUTDOWN_POLL_DELAY_MS = 100;
+var DAEMON_SHUTDOWN_STATUS_TIMEOUT_MS = 250;
+var DAEMON_STOP_TIMEOUT_MS = 1e3;
+var MIN_PORT = 1;
+var MAX_PORT = 65535;
 var SERVE_COMMAND_PATTERN = /(?:^|\s)(?:\S*[\\/])?(?:opendevbrowser|dist[\\/]+cli[\\/]+index\.js)(?=\s|$).*?\bserve\b/;
+var SERVE_PORT_SPLIT_PATTERN = /(?:^|\s)--port\s+(\d+)(?=\s|$)/;
+var SERVE_PORT_EQUALS_PATTERN = /(?:^|\s)--port=(\d+)(?=\s|$)/;
 var SERVE_STOP_PATTERN = /(?:^|\s)--stop(?:\s|$)/;
 var CURRENT_UID = typeof process.getuid === "function" ? process.getuid() : null;
 var CURRENT_EXECUTABLE = process.execPath;
@@ -1545,29 +1835,6 @@ async function resolveExistingDaemon(port, tokens) {
 function isPositivePid(value) {
   return typeof value === "number" && Number.isInteger(value) && value > 0;
 }
-function rememberStalePid(staleDaemonPids, pid) {
-  if (isPositivePid(pid)) {
-    staleDaemonPids.add(pid);
-  }
-}
-async function stopDaemonOnPort(port, token) {
-  try {
-    const response = await fetchWithTimeout(`http://127.0.0.1:${port}/stop`, {
-      method: "POST",
-      headers: { Authorization: `Bearer ${token}` }
-    });
-    return response.ok;
-  } catch {
-    return false;
-  }
-}
-async function stopStaleDaemon(port, daemon, staleDaemonPids) {
-  rememberStalePid(staleDaemonPids, daemon.status.pid);
-  const stopped = await stopDaemonOnPort(port, daemon.token);
-  if (!stopped && isPositivePid(daemon.status.pid)) {
-    terminateProcess(daemon.status.pid);
-  }
-}
 function parseServeArgs(rawArgs) {
   const parsed = { stop: false };
   for (let i = 0; i < rawArgs.length; i += 1) {
@@ -1581,7 +1848,7 @@ function parseServeArgs(rawArgs) {
       if (!value) {
         throw createUsageError("Missing value for --port");
       }
-      parsed.port = parseNumberFlag(value, "--port", { min: 1, max: 65535 });
+      parsed.port = parseNumberFlag(value, "--port", { min: MIN_PORT, max: MAX_PORT });
       i += 1;
       continue;
     }
@@ -1590,7 +1857,7 @@ function parseServeArgs(rawArgs) {
       if (!value) {
         throw createUsageError("Missing value for --port");
       }
-      parsed.port = parseNumberFlag(value, "--port", { min: 1, max: 65535 });
+      parsed.port = parseNumberFlag(value, "--port", { min: MIN_PORT, max: MAX_PORT });
       continue;
     }
     if (arg === "--token") {
@@ -1638,6 +1905,14 @@ function parseServeProcessSnapshot(line) {
     command
   };
 }
+function parseServeCommandPort(command) {
+  const rawPort = command.match(SERVE_PORT_EQUALS_PATTERN)?.[1] ?? command.match(SERVE_PORT_SPLIT_PATTERN)?.[1];
+  if (!rawPort) {
+    return null;
+  }
+  const port = Number.parseInt(rawPort, 10);
+  return Number.isInteger(port) && port >= MIN_PORT && port <= MAX_PORT ? port : null;
+}
 function listServeProcessSnapshots() {
   const result = spawnSync("ps", ["-axww", "-o", "pid=,uid=,command="], {
     encoding: "utf-8",
@@ -1660,6 +1935,9 @@ function isCurrentExecutableServeProcess(snapshot) {
   }
   return !SERVE_STOP_PATTERN.test(snapshot.command);
 }
+function isRequestedPortServeProcess(snapshot, requestedPort) {
+  return isCurrentExecutableServeProcess(snapshot) && parseServeCommandPort(snapshot.command) === requestedPort;
+}
 function terminateProcess(pid) {
   if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid || pid === process.ppid) {
     return false;
@@ -1675,9 +1953,9 @@ function terminateProcess(pid) {
   }
   return true;
 }
-function cleanupCompetingServeProcesses(keepPid) {
+function cleanupCompetingServeProcesses(requestedPort, keepPid) {
   const candidates = listServeProcessSnapshots().filter((snapshot) => {
-    if (!isCurrentExecutableServeProcess(snapshot)) {
+    if (!isRequestedPortServeProcess(snapshot, requestedPort)) {
       return false;
     }
     if (snapshot.pid === process.pid || snapshot.pid === process.ppid) {
@@ -1699,6 +1977,85 @@ function cleanupCompetingServeProcesses(keepPid) {
   }
   return clearedPids;
 }
+function terminateServeProcessByPid(pid) {
+  if (!isPositivePid(pid)) {
+    return false;
+  }
+  const snapshot = listServeProcessSnapshots().find((item) => item.pid === pid);
+  return snapshot ? isCurrentExecutableServeProcess(snapshot) && terminateProcess(pid) : false;
+}
+function buildStaleStopMessage(metadata) {
+  const pid = isPositivePid(metadata.pid) ? ` pid=${metadata.pid}` : "";
+  return `Daemon rejected stale stop request for 127.0.0.1:${metadata.port}${pid}. Run \`opendevbrowser status --daemon\` to inspect the active daemon, then restart from the current install if needed.`;
+}
+function buildProtectedMismatchMessage(port, status) {
+  return `Daemon on 127.0.0.1:${port} pid=${status.pid} is protected by a different opendevbrowser build. Run \`opendevbrowser status --daemon\` to inspect it, then restart from the current install.`;
+}
+async function waitForDaemonShutdown(port, token) {
+  for (let attempt = 0; attempt < DAEMON_SHUTDOWN_POLL_ATTEMPTS; attempt += 1) {
+    const status = await fetchDaemonStatus(port, token, { timeoutMs: DAEMON_SHUTDOWN_STATUS_TIMEOUT_MS });
+    if (!status?.ok) {
+      return true;
+    }
+    await new Promise((resolve5) => setTimeout(resolve5, DAEMON_SHUTDOWN_POLL_DELAY_MS));
+  }
+  return false;
+}
+async function stopMismatchedDaemon(port, daemon) {
+  let response;
+  try {
+    response = await fetchWithTimeout(`http://127.0.0.1:${port}/stop`, {
+      method: "POST",
+      headers: createDaemonStopHeaders(daemon.token, "serve.upgrade")
+    }, DAEMON_STOP_TIMEOUT_MS);
+  } catch (error) {
+    const status = await fetchDaemonStatus(port, daemon.token, {
+      timeoutMs: DAEMON_SHUTDOWN_STATUS_TIMEOUT_MS
+    });
+    if (!status?.ok) {
+      return null;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return `Failed to stop mismatched daemon on 127.0.0.1:${port}: ${message}.`;
+  }
+  if (response.status === 409) {
+    return buildProtectedMismatchMessage(port, daemon.status);
+  }
+  if (!response.ok) {
+    return `Failed to stop mismatched daemon on 127.0.0.1:${port}: stop returned ${response.status}.`;
+  }
+  if (await waitForDaemonShutdown(port, daemon.token)) {
+    return null;
+  }
+  if (terminateServeProcessByPid(daemon.status.pid)) {
+    return null;
+  }
+  return `Timed out waiting for mismatched daemon on 127.0.0.1:${port} to stop.`;
+}
+async function prepareExistingDaemon(port, daemon) {
+  if (isCurrentDaemonFingerprint(daemon.status.fingerprint)) {
+    return null;
+  }
+  return await stopMismatchedDaemon(port, daemon);
+}
+function buildAlreadyRunningResult(port, status, fallbackRelayPort, clearedCount) {
+  const relayPort = status.relay.port ?? fallbackRelayPort;
+  const staleNote = clearedCount > 0 ? `
+Cleared ${clearedCount} stale daemon process${clearedCount === 1 ? "" : "es"}.` : "";
+  return {
+    success: true,
+    message: `Daemon already running on 127.0.0.1:${port} (pid=${status.pid}, relay ${relayPort}).${staleNote}`,
+    data: {
+      port,
+      pid: status.pid,
+      relayPort,
+      alreadyRunning: true,
+      staleDaemonsCleared: clearedCount,
+      relay: status.relay
+    },
+    exitCode: null
+  };
+}
 async function runServe(args) {
   const serveArgs = parseServeArgs(args.rawArgs);
   if (serveArgs.stop) {
@@ -1714,8 +2071,11 @@ async function runServe(args) {
     try {
       const response = await fetchWithTimeout(`http://127.0.0.1:${metadata2.port}/stop`, {
         method: "POST",
-        headers: { Authorization: `Bearer ${metadata2.token}` }
+        headers: createDaemonStopHeaders(metadata2.token, "serve.stop")
       });
+      if (response.status === 409) {
+        return { success: false, message: buildStaleStopMessage(metadata2), exitCode: EXIT_EXECUTION };
+      }
       if (!response.ok) {
         throw new Error(`Stop failed (${response.status})`);
       }
@@ -1730,34 +2090,23 @@ async function runServe(args) {
   const metadata = readDaemonMetadata();
   const metadataToken = metadata?.port === requestedPort ? metadata.token : void 0;
   const tokenCandidates = resolveTokenCandidates(serveArgs.token, metadataToken, config.daemonToken);
-  const currentFingerprint = getCurrentDaemonFingerprint();
   const existingDaemon = await resolveExistingDaemon(requestedPort, tokenCandidates);
-  const staleDaemonPids = new Set(cleanupCompetingServeProcesses(existingDaemon?.status.pid));
+  const staleDaemonPids = /* @__PURE__ */ new Set();
   const staleCleared = () => staleDaemonPids.size;
-  let replacedStaleFingerprint = false;
   if (existingDaemon) {
-    const fingerprintMatches = existingDaemon.status.fingerprint === currentFingerprint;
-    if (fingerprintMatches) {
-      const relayPort = existingDaemon.status.relay.port ?? config.relayPort;
-      const clearedCount2 = staleCleared();
-      const staleNote2 = clearedCount2 > 0 ? `
-Cleared ${clearedCount2} stale daemon process${clearedCount2 === 1 ? "" : "es"}.` : "";
-      return {
-        success: true,
-        message: `Daemon already running on 127.0.0.1:${requestedPort} (pid=${existingDaemon.status.pid}, relay ${relayPort}).${staleNote2}`,
-        data: {
-          port: requestedPort,
-          pid: existingDaemon.status.pid,
-          relayPort,
-          alreadyRunning: true,
-          staleDaemonsCleared: clearedCount2,
-          relay: existingDaemon.status.relay
-        },
-        exitCode: null
-      };
+    const mismatchMessage = await prepareExistingDaemon(requestedPort, existingDaemon);
+    if (mismatchMessage) {
+      return { success: false, message: mismatchMessage, exitCode: EXIT_EXECUTION };
+    }
+    if (isCurrentDaemonFingerprint(existingDaemon.status.fingerprint)) {
+      for (const pid of cleanupCompetingServeProcesses(requestedPort, existingDaemon.status.pid)) {
+        staleDaemonPids.add(pid);
+      }
+      return buildAlreadyRunningResult(requestedPort, existingDaemon.status, config.relayPort, staleCleared());
     }
-    await stopStaleDaemon(requestedPort, existingDaemon, staleDaemonPids);
-    replacedStaleFingerprint = true;
+  }
+  for (const pid of cleanupCompetingServeProcesses(requestedPort)) {
+    staleDaemonPids.add(pid);
   }
   let nativeStatus = getNativeStatusSnapshot();
   let nativeMessage = null;
@@ -1800,35 +2149,17 @@ Cleared ${clearedCount2} stale daemon process${clearedCount2 === 1 ? "" : "es"}.
       }
       const runningDaemon = await resolveExistingDaemon(requestedPort, tokenCandidates);
       if (runningDaemon) {
-        const fingerprintMatches = runningDaemon.status.fingerprint === currentFingerprint;
-        if (fingerprintMatches) {
-          const relayPort = runningDaemon.status.relay.port ?? config.relayPort;
-          const clearedCount2 = staleCleared();
-          const staleNote2 = clearedCount2 > 0 ? `
-Cleared ${clearedCount2} stale daemon process${clearedCount2 === 1 ? "" : "es"}.` : "";
-          return {
-            success: true,
-            message: `Daemon already running on 127.0.0.1:${requestedPort} (pid=${runningDaemon.status.pid}, relay ${relayPort}).${staleNote2}`,
-            data: {
-              port: requestedPort,
-              pid: runningDaemon.status.pid,
-              relayPort,
-              alreadyRunning: true,
-              staleDaemonsCleared: clearedCount2,
-              relay: runningDaemon.status.relay
-            },
-            exitCode: null
-          };
+        const mismatchMessage = await prepareExistingDaemon(requestedPort, runningDaemon);
+        if (mismatchMessage) {
+          return { success: false, message: mismatchMessage, exitCode: EXIT_EXECUTION };
         }
-        await stopStaleDaemon(requestedPort, runningDaemon, staleDaemonPids);
-        replacedStaleFingerprint = true;
-        if (attempt === 0) {
-          continue;
+        if (isCurrentDaemonFingerprint(runningDaemon.status.fingerprint)) {
+          return buildAlreadyRunningResult(requestedPort, runningDaemon.status, config.relayPort, staleCleared());
         }
       }
       if (attempt === 0) {
         let clearedNewPid = false;
-        for (const pid of cleanupCompetingServeProcesses()) {
+        for (const pid of cleanupCompetingServeProcesses(requestedPort)) {
           const previousSize = staleDaemonPids.size;
           staleDaemonPids.add(pid);
           if (staleDaemonPids.size > previousSize) {
@@ -1863,9 +2194,8 @@ Cleared ${clearedCount2} stale daemon process${clearedCount2 === 1 ? "" : "es"}.
   const clearedCount = staleCleared();
   const staleNote = clearedCount > 0 ? `
 Cleared ${clearedCount} stale daemon process${clearedCount === 1 ? "" : "es"}.` : "";
-  const fingerprintNote = replacedStaleFingerprint ? "\nReplaced stale daemon fingerprint." : "";
   const message = nativeMessage ? `${baseMessage}
-${nativeMessage}${fingerprintNote}${staleNote}` : `${baseMessage}${fingerprintNote}${staleNote}`;
+${nativeMessage}${staleNote}` : `${baseMessage}${staleNote}`;
   return {
     success: true,
     message,
@@ -1876,9 +2206,9 @@ ${nativeMessage}${fingerprintNote}${staleNote}` : `${baseMessage}${fingerprintNo
 
 // src/cli/daemon-autostart.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir4, tmpdir } from "os";
-import { dirname as dirname3, isAbsolute, join as join5, relative, resolve as resolve3 } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join5, relative as relative2, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var MAC_LABEL = "com.opendevbrowser.daemon";
 var WIN_TASK_NAME = "OpenDevBrowser Daemon";
@@ -1891,7 +2221,8 @@ var defaultDeps = () => ({
   homedir: homedir4,
   existsSync: existsSync5,
   mkdirSync: mkdirSync2,
-  writeFileSync: writeFileSync4,
+  statSync: statSync2,
+  writeFileSync: writeFileSync5,
   unlinkSync: unlinkSync2,
   execFileSync: execFileSync2,
   transientEntrypointRoots: void 0
@@ -1900,6 +2231,17 @@ var NPX_CACHE_SEGMENT_PATTERN = /[\\/]_npx(?:[\\/]|$)/;
 var formatCommand = (programArguments) => {
   return programArguments.map((value) => `"${value}"`).join(" ");
 };
+var resolveMacWorkingDirectory = (home) => {
+  return join5(home, ".cache", "opendevbrowser");
+};
+var pathIsDirectory = (path5, deps) => {
+  if (!deps.existsSync(path5)) return false;
+  try {
+    return deps.statSync(path5).isDirectory();
+  } catch {
+    return false;
+  }
+};
 var resolveCliPathFromModule = (moduleUrl, exists) => {
   const modulePath = fileURLToPath2(moduleUrl);
   const candidate = resolve3(dirname3(modulePath), "..", "index.js");
@@ -1915,8 +2257,8 @@ var normalizeComparisonPath = (value, platform) => {
 var isPathInsideRoot = (candidate, root, platform) => {
   const normalizedCandidate = normalizeComparisonPath(candidate, platform);
   const normalizedRoot = normalizeComparisonPath(root, platform);
-  const relation = relative(normalizedRoot, normalizedCandidate);
-  return relation === "" || !relation.startsWith("..") && !isAbsolute(relation);
+  const relation = relative2(normalizedRoot, normalizedCandidate);
+  return relation === "" || !relation.startsWith("..") && !isAbsolute2(relation);
 };
 var getTransientEntrypointRoots = (deps) => {
   const configuredRoots = deps.transientEntrypointRoots;
@@ -1962,18 +2304,20 @@ var resolveCliEntrypoint = (deps = {}) => {
 var getLaunchAgentPath = (home = homedir4()) => {
   return join5(home, "Library", "LaunchAgents", `${MAC_LABEL}.plist`);
 };
+var escapePlistString = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 var buildLaunchAgentPlist = (entrypoint, options = {}) => {
   const label = options.label ?? MAC_LABEL;
   const stdoutPath = options.stdoutPath ?? join5(homedir4(), "Library", "Logs", "opendevbrowser-daemon.log");
   const stderrPath = options.stderrPath ?? join5(homedir4(), "Library", "Logs", "opendevbrowser-daemon.err.log");
-  const programArgs = [entrypoint.nodePath, ...entrypoint.args].map((value) => `      <string>${value}</string>`).join("\n");
+  const workingDirectory = options.workingDirectory ?? resolveMacWorkingDirectory(homedir4());
+  const programArgs = [entrypoint.nodePath, ...entrypoint.args].map((value) => `      <string>${escapePlistString(value)}</string>`).join("\n");
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
     '<plist version="1.0">',
     "<dict>",
     `  <key>Label</key>`,
-    `  <string>${label}</string>`,
+    `  <string>${escapePlistString(label)}</string>`,
     "  <key>ProgramArguments</key>",
     "  <array>",
     programArgs,
@@ -1982,10 +2326,12 @@ var buildLaunchAgentPlist = (entrypoint, options = {}) => {
     "  <true/>",
     "  <key>KeepAlive</key>",
     "  <true/>",
+    "  <key>WorkingDirectory</key>",
+    `  <string>${escapePlistString(workingDirectory)}</string>`,
     "  <key>StandardOutPath</key>",
-    `  <string>${stdoutPath}</string>`,
+    `  <string>${escapePlistString(stdoutPath)}</string>`,
     "  <key>StandardErrorPath</key>",
-    `  <string>${stderrPath}</string>`,
+    `  <string>${escapePlistString(stderrPath)}</string>`,
     "</dict>",
     "</plist>",
     ""
@@ -2077,6 +2423,7 @@ var readMacLaunchAgentProgramArguments = (plistPath, deps) => {
     const text = deps.execFileSync("plutil", ["-convert", "json", "-o", "-", plistPath], { encoding: "utf-8" });
     const parsed = JSON.parse(text);
     const programArguments = parsed?.ProgramArguments;
+    const workingDirectory = typeof parsed?.WorkingDirectory === "string" ? parsed.WorkingDirectory : void 0;
     if (!Array.isArray(programArguments) || programArguments.length < 2 || programArguments.some((value) => typeof value !== "string")) {
       return { ok: false, reason: "missing_program_arguments" };
     }
@@ -2084,7 +2431,8 @@ var readMacLaunchAgentProgramArguments = (plistPath, deps) => {
     return {
       ok: true,
       command: formatCommand(commandArgs),
-      programArguments: commandArgs
+      programArguments: commandArgs,
+      ...workingDirectory ? { workingDirectory } : {}
     };
   } catch {
     return { ok: false, reason: "malformed_plist" };
@@ -2100,11 +2448,13 @@ var classifyMacAutostartStatus = (entrypoint, location, deps) => {
     });
   }
   const parsed = readMacLaunchAgentProgramArguments(location, deps);
+  const expectedWorkingDirectory = resolveMacWorkingDirectory(deps.homedir());
   if (!parsed.ok) {
     return createMacAutostartStatus(entrypoint, location, {
       installed: true,
       health: "malformed",
       needsRepair: true,
+      expectedWorkingDirectory,
       reason: parsed.reason
     });
   }
@@ -2119,15 +2469,41 @@ var classifyMacAutostartStatus = (entrypoint, location, deps) => {
       health: "needs_repair",
       needsRepair: true,
       command: parsed.command,
+      workingDirectory: parsed.workingDirectory,
+      expectedWorkingDirectory,
       reason: actualStatus.reason
     });
   }
+  if (parsed.workingDirectory !== expectedWorkingDirectory) {
+    return createMacAutostartStatus(entrypoint, location, {
+      installed: true,
+      health: "needs_repair",
+      needsRepair: true,
+      command: parsed.command,
+      workingDirectory: parsed.workingDirectory,
+      expectedWorkingDirectory,
+      reason: "working_directory_mismatch"
+    });
+  }
+  if (!pathIsDirectory(expectedWorkingDirectory, deps)) {
+    return createMacAutostartStatus(entrypoint, location, {
+      installed: true,
+      health: "needs_repair",
+      needsRepair: true,
+      command: parsed.command,
+      workingDirectory: parsed.workingDirectory,
+      expectedWorkingDirectory,
+      reason: "working_directory_mismatch"
+    });
+  }
   if (entrypoint.isTransient) {
     return createMacAutostartStatus(entrypoint, location, {
       installed: true,
       health: "healthy",
       needsRepair: false,
-      command: parsed.command
+      command: parsed.command,
+      workingDirectory: parsed.workingDirectory,
+      expectedWorkingDirectory
     });
   }
   const mismatchReason = classifyExpectedProgramArguments(expectedArgs, actualArgs, deps);
@@ -2137,6 +2513,8 @@ var classifyMacAutostartStatus = (entrypoint, location, deps) => {
       health: "needs_repair",
       needsRepair: true,
       command: parsed.command,
+      workingDirectory: parsed.workingDirectory,
+      expectedWorkingDirectory,
       reason: mismatchReason
     });
   }
@@ -2144,7 +2522,9 @@ var classifyMacAutostartStatus = (entrypoint, location, deps) => {
     installed: true,
     health: "healthy",
     needsRepair: false,
-    command: parsed.command
+    command: parsed.command,
+    workingDirectory: parsed.workingDirectory,
+    expectedWorkingDirectory
   });
 };
 var runCommand = (exec, command, args, ignoreFailure = false) => {
@@ -2172,12 +2552,14 @@ var installMacAutostart = (deps = {}) => {
   const plistPath = getLaunchAgentPath(home);
   const stdoutPath = join5(home, "Library", "Logs", "opendevbrowser-daemon.log");
   const stderrPath = join5(home, "Library", "Logs", "opendevbrowser-daemon.err.log");
+  const workingDirectory = resolveMacWorkingDirectory(home);
   const logsDir = dirname3(stdoutPath);
   resolved.mkdirSync(dirname3(plistPath), { recursive: true });
   resolved.mkdirSync(logsDir, { recursive: true });
+  resolved.mkdirSync(workingDirectory, { recursive: true });
   resolved.writeFileSync(
     plistPath,
-    buildLaunchAgentPlist(entrypoint, { stdoutPath, stderrPath }),
+    buildLaunchAgentPlist(entrypoint, { stdoutPath, stderrPath, workingDirectory }),
     { encoding: "utf-8" }
   );
   const uid = resolved.uid;
@@ -2189,7 +2571,9 @@ var installMacAutostart = (deps = {}) => {
     installed: true,
     health: "healthy",
     needsRepair: false,
-    command: entrypoint.command
+    command: entrypoint.command,
+    workingDirectory,
+    expectedWorkingDirectory: workingDirectory
   });
 };
 var uninstallMacAutostart = (deps = {}) => {
@@ -2433,17 +2817,40 @@ var parseDaemonArgs = (rawArgs) => {
 var stopDaemonIfRunning = async () => {
   const metadata = readDaemonMetadata();
   if (!metadata) {
-    return false;
+    return { outcome: "not_running" };
   }
   try {
     const response = await fetchWithTimeout(`http://127.0.0.1:${metadata.port}/stop`, {
       method: "POST",
-      headers: { Authorization: `Bearer ${metadata.token}` }
+      headers: createDaemonStopHeaders(metadata.token, "daemon.uninstall")
     });
-    return response.ok;
-  } catch {
+    if (response.status === 409) {
+      return { outcome: "fingerprint_rejected", pid: metadata.pid, port: metadata.port };
+    }
+    return response.ok ? { outcome: "stopped", pid: metadata.pid, port: metadata.port } : { outcome: "failed", pid: metadata.pid, port: metadata.port, status: response.status };
+  } catch (error) {
+    return {
+      outcome: "failed",
+      pid: metadata.pid,
+      port: metadata.port,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+};
+var buildStopFailureMessage = (stop) => {
+  const target = stop.port ? `127.0.0.1:${stop.port}` : "recorded daemon";
+  const pid = stop.pid ? ` pid=${stop.pid}` : "";
+  if (stop.outcome === "fingerprint_rejected") {
+    return `Daemon autostart removed, but the running daemon at ${target}${pid} rejected the stop request as stale. Run \`opendevbrowser status --daemon\` to inspect it and restart from the current install if needed.`;
+  }
+  const reason = stop.error ?? (stop.status ? `HTTP ${stop.status}` : "unknown error");
+  return `Daemon autostart removed, but stopping ${target}${pid} failed (${reason}).`;
+};
+var shouldFailUninstallStop = (stop) => {
+  if (stop.outcome === "stopped" || stop.outcome === "not_running") {
     return false;
   }
+  return true;
 };
 var formatReason = (reason) => {
   return reason ? reason.replace(/_/g, " ") : "unknown reason";
@@ -2518,7 +2925,15 @@ async function runDaemonCommand(args) {
         exitCode: EXIT_EXECUTION
       };
     }
-    await stopDaemonIfRunning();
+    const stop = await stopDaemonIfRunning();
+    if (shouldFailUninstallStop(stop)) {
+      return {
+        success: false,
+        message: buildStopFailureMessage(stop),
+        data: { ...result, stop },
+        exitCode: EXIT_EXECUTION
+      };
+    }
     return {
       success: true,
       message: `Daemon autostart removed (${result.platform}).`,
@@ -2526,7 +2941,7 @@ async function runDaemonCommand(args) {
     };
   }
   const autostart = getAutostartStatus();
-  const daemonStatus = await fetchDaemonStatusFromMetadata();
+  const daemonStatus = await fetchDaemonStatusFromMetadata(void 0, DEFAULT_DAEMON_STATUS_FETCH_OPTIONS);
   const running = Boolean(daemonStatus);
   const message = buildStatusMessage(autostart, running);
   const data = {
@@ -2750,7 +3165,7 @@ function formatAutostartReconciliationMessage(result) {
 }
 
 // src/cli/commands/run.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 
 // src/cli/output.ts
 var normalizeExitCode = (code) => {
@@ -2914,7 +3329,7 @@ async function runScriptCommand(args) {
   const outputOptions = { format: args.outputFormat, quiet: args.quiet };
   let scriptRaw = "";
   if (runArgs.scriptPath) {
-    scriptRaw = readFileSync2(runArgs.scriptPath, "utf-8");
+    scriptRaw = readFileSync3(runArgs.scriptPath, "utf-8");
   } else if (!process.stdin.isTTY) {
     scriptRaw = await readScriptFromStdin();
   } else {
@@ -3574,11 +3989,6 @@ async function runSessionStatus(args) {
 }
 
 // src/cli/commands/status.ts
-var DAEMON_STATUS_READ_OPTIONS = {
-  timeoutMs: 5e3,
-  retryAttempts: 5,
-  retryDelayMs: 250
-};
 var parseStatusArgs2 = (rawArgs) => {
   const parsed = { daemon: false };
   for (let i = 0; i < rawArgs.length; i += 1) {
@@ -3619,21 +4029,23 @@ async function runStatus(args) {
       exitCode: assessment.exitCode ?? void 0
     };
   }
-  const daemonStatus = await fetchDaemonStatusFromMetadata(void 0, DAEMON_STATUS_READ_OPTIONS);
+  const daemonStatus = await fetchDaemonStatusFromMetadata(void 0, DEFAULT_DAEMON_STATUS_FETCH_OPTIONS);
   if (!daemonStatus) {
-    throw createUsageError("Daemon not running. Start with `opendevbrowser serve`.");
+    throw createDisconnectedError("Daemon not running. Start with `opendevbrowser serve`.");
   }
   const nativeStatus = getNativeStatusSnapshot();
   const nativeAssessment = assessNativeStatus(nativeStatus);
+  const fingerprintLine = daemonStatus.fingerprintCurrent === false ? "Daemon fingerprint: mismatch with current build" : "Daemon fingerprint: current";
   const baseLines = [
     `Daemon OK (pid=${daemonStatus.pid})`,
+    fingerprintLine,
     `Relay: port=${daemonStatus.relay.port ?? "n/a"} ext=${daemonStatus.relay.extensionConnected ? "on" : "off"} handshake=${daemonStatus.relay.extensionHandshakeComplete ? "on" : "off"} cdp=${daemonStatus.relay.cdpConnected ? "on" : "off"} annotate=${daemonStatus.relay.annotationConnected ? "on" : "off"} ops=${daemonStatus.relay.opsConnected ? "on" : "off"} canvas=${daemonStatus.relay.canvasConnected ? "on" : "off"} pairing=${daemonStatus.relay.pairingRequired ? "on" : "off"} health=${daemonStatus.relay.health?.reason ?? "n/a"}`,
     `Native: ${nativeAssessment.summary}`,
     daemonStatus.relay.lastHandshakeError ? `Relay last handshake error: ${daemonStatus.relay.lastHandshakeError.code} (${daemonStatus.relay.lastHandshakeError.message})` : "Relay last handshake error: none",
     "Legend: ext=extension websocket, handshake=extension handshake, cdp=active /cdp client, annotate=annotation channel, ops=ops clients, canvas=canvas clients, pairing=token required, health=relay status"
   ];
   if (!nativeAssessment.success) {
-    baseLines.splice(3, 0, `Native detail: ${nativeAssessment.message}`);
+    baseLines.splice(4, 0, `Native detail: ${nativeAssessment.message}`);
   }
   const baseMessage = baseLines.join("\n");
   const message = daemon || args.outputFormat !== "text" ? baseMessage : [
@@ -3850,12 +4262,12 @@ function parseSnapshotArgs(rawArgs) {
     if (arg === "--max-chars") {
       const value = rawArgs[i + 1];
       if (!value) throw createUsageError("Missing value for --max-chars");
-      parsed.maxChars = Number(value);
+      parsed.maxChars = parseNumberFlag(value, "--max-chars", { min: 1 });
       i += 1;
       continue;
     }
     if (arg?.startsWith("--max-chars=")) {
-      parsed.maxChars = Number(arg.split("=", 2)[1]);
+      parsed.maxChars = parseNumberFlag(arg.split("=", 2)[1] ?? "", "--max-chars", { min: 1 });
       continue;
     }
     if (arg === "--cursor") {
@@ -4114,7 +4526,7 @@ async function runAnnotate(args) {
 }
 
 // src/cli/commands/canvas.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 var DEFAULT_FEEDBACK_STREAM_TIMEOUT_MS = 3e4;
 var isRecord = (value) => {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -4315,7 +4727,7 @@ var resolveCanvasParams = (canvasArgs) => {
   if (hasParamsFile) {
     let raw = "";
     try {
-      raw = readFileSync3(canvasArgs.paramsFile ?? "", "utf8");
+      raw = readFileSync4(canvasArgs.paramsFile ?? "", "utf8");
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unable to read file";
       throw createUsageError(`Invalid --params-file: ${message}`);
@@ -4384,7 +4796,7 @@ async function runCanvas(args) {
 }
 
 // src/cli/commands/rpc.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 var requireValue4 = (value, flag) => {
   if (!value) throw createUsageError(`Missing value for ${flag}`);
   return value;
@@ -4464,7 +4876,7 @@ var resolveRpcParams = (rpcArgs) => {
   if (hasParamsFile) {
     let raw = "";
     try {
-      raw = readFileSync4(rpcArgs.paramsFile ?? "", "utf8");
+      raw = readFileSync5(rpcArgs.paramsFile ?? "", "utf8");
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unable to read file";
       throw createUsageError(`Invalid --params-file: ${message}`);
@@ -4895,12 +5307,12 @@ function parseScrollArgs(rawArgs) {
     if (arg === "--dy") {
       const value = rawArgs[i + 1];
       if (!value) throw createUsageError("Missing value for --dy");
-      parsed.dy = Number(value);
+      parsed.dy = parseNumberFlag(value, "--dy");
       i += 1;
       continue;
     }
     if (arg?.startsWith("--dy=")) {
-      parsed.dy = Number(arg.split("=", 2)[1]);
+      parsed.dy = parseNumberFlag(arg.split("=", 2)[1] ?? "", "--dy");
       continue;
     }
   }
@@ -5396,12 +5808,12 @@ function parseDomHtmlArgs(rawArgs) {
     if (arg === "--max-chars") {
       const value = rawArgs[i + 1];
       if (!value) throw createUsageError("Missing value for --max-chars");
-      parsed.maxChars = Number(value);
+      parsed.maxChars = parseNumberFlag(value, "--max-chars", { min: 1 });
       i += 1;
       continue;
     }
     if (arg?.startsWith("--max-chars=")) {
-      parsed.maxChars = Number(arg.split("=", 2)[1]);
+      parsed.maxChars = parseNumberFlag(arg.split("=", 2)[1] ?? "", "--max-chars", { min: 1 });
       continue;
     }
   }
@@ -5451,12 +5863,12 @@ function parseDomTextArgs(rawArgs) {
     if (arg === "--max-chars") {
       const value = rawArgs[i + 1];
       if (!value) throw createUsageError("Missing value for --max-chars");
-      parsed.maxChars = Number(value);
+      parsed.maxChars = parseNumberFlag(value, "--max-chars", { min: 1 });
       i += 1;
       continue;
     }
     if (arg?.startsWith("--max-chars=")) {
-      parsed.maxChars = Number(arg.split("=", 2)[1]);
+      parsed.maxChars = parseNumberFlag(arg.split("=", 2)[1] ?? "", "--max-chars", { min: 1 });
       continue;
     }
   }
@@ -5971,23 +6383,23 @@ function parseConsolePollArgs(rawArgs) {
     if (arg === "--since-seq") {
       const value = rawArgs[i + 1];
       if (!value) throw createUsageError("Missing value for --since-seq");
-      parsed.sinceSeq = Number(value);
+      parsed.sinceSeq = parseNumberFlag(value, "--since-seq", { min: 0 });
       i += 1;
       continue;
     }
     if (arg?.startsWith("--since-seq=")) {
-      parsed.sinceSeq = Number(arg.split("=", 2)[1]);
+      parsed.sinceSeq = parseNumberFlag(arg.split("=", 2)[1] ?? "", "--since-seq", { min: 0 });
       continue;
     }
     if (arg === "--max") {
       const value = rawArgs[i + 1];
       if (!value) throw createUsageError("Missing value for --max");
-      parsed.max = Number(value);
+      parsed.max = parseNumberFlag(value, "--max", { min: 1 });
       i += 1;
       continue;
     }
     if (arg?.startsWith("--max=")) {
-      parsed.max = Number(arg.split("=", 2)[1]);
+      parsed.max = parseNumberFlag(arg.split("=", 2)[1] ?? "", "--max", { min: 1 });
       continue;
     }
   }
@@ -6019,23 +6431,23 @@ function parseNetworkPollArgs(rawArgs) {
     if (arg === "--since-seq") {
       const value = rawArgs[i + 1];
       if (!value) throw createUsageError("Missing value for --since-seq");
-      parsed.sinceSeq = Number(value);
+      parsed.sinceSeq = parseNumberFlag(value, "--since-seq", { min: 0 });
       i += 1;
       continue;
     }
     if (arg?.startsWith("--since-seq=")) {
-      parsed.sinceSeq = Number(arg.split("=", 2)[1]);
+      parsed.sinceSeq = parseNumberFlag(arg.split("=", 2)[1] ?? "", "--since-seq", { min: 0 });
       continue;
     }
     if (arg === "--max") {
       const value = rawArgs[i + 1];
       if (!value) throw createUsageError("Missing value for --max");
-      parsed.max = Number(value);
+      parsed.max = parseNumberFlag(value, "--max", { min: 1 });
       i += 1;
       continue;
     }
     if (arg?.startsWith("--max=")) {
-      parsed.max = Number(arg.split("=", 2)[1]);
+      parsed.max = parseNumberFlag(arg.split("=", 2)[1] ?? "", "--max", { min: 1 });
       continue;
     }
   }
@@ -6247,7 +6659,7 @@ async function runDesktopAccessibilitySnapshot(args) {
 }
 
 // src/cli/commands/session/cookie-import.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 var requireValue5 = (value, flag) => {
   if (!value) {
     throw createUsageError(`Missing value for ${flag}`);
@@ -6362,7 +6774,7 @@ var resolveCookies = (parsed) => {
   }
   let raw = "";
   try {
-    raw = readFileSync5(parsed.cookiesFile ?? "", "utf8");
+    raw = readFileSync6(parsed.cookiesFile ?? "", "utf8");
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unable to read file";
     throw createUsageError(`Invalid --cookies-file: ${message}`);
@@ -7415,7 +7827,7 @@ async function runInspiredesignCommand(args) {
 // package.json
 var package_default = {
   name: "opendevbrowser",
-  version: "0.0.25",
+  version: "0.0.27",
   description: "Browser automation runtime with snapshot-refs-actions, browser replay screencasts, public read-only desktop observation, and browser-scoped computer-use orchestration",
   type: "module",
   main: "dist/index.js",
@@ -7749,7 +8161,7 @@ async function main() {
     });
     registerCommand({
       name: "update",
-      description: "Clear cached plugin and refresh managed skill packs",
+      description: "Repair cached plugin pins and refresh managed skill packs",
       run: () => buildUpdateCommandResult(args, runUpdate(), {
         resolveUpdateSkillModes,
         hasInstalledConfig,