openmeld 0.3.259 → 0.3.261

package/dist/{service-Ciifmu6w.js → service-8ReqDsOx.js}

@@ -1,40 +1,40 @@
 #!/usr/bin/env node
 
-import { At as ensureOpenMeldManagedProfileWorkspace, Br as resolveRouteRegistrationReconcileDecision, Ct as resolveLocalProjectConnectionForPath, Fn as emitDriftDetectedEvidence, Gr as applyIntervalJitterMs$1, Gt as syncDaemonRouteCatalogState, Hr as MAX_HEARTBEAT_INTERVAL_MS, Ht as createRouteCatalogFromMutableState, I as listAgentTargetStates, In as emitReconcileCompletedEvidence, It as resolveConfiguredProfileWorkspacePathForAccount, Jr as resolveCatalogSyncIntervalMs, Kr as pruneStaleLeases, Ln as emitReconcileStartedEvidence, Lt as setCustomProfileWorkspace, Nt as readProfileWorkspaceConfigForAccount, O as syncDeviceRuntimeStateProjection, Ot as resolveRegistryRuntimeAdapterCapabilitySnapshot, Pt as readSavedProfileWorkspaceForAccount, Rn as DaemonServiceRunError, Ur as MIN_HEARTBEAT_INTERVAL_MS, Vr as ADAPTIVE_HEARTBEAT_JITTER_RATIO, Vt as createMutableRouteCatalogState, Wr as applyAcceptedLeases, Wt as summarizeSkippedDaemonProfiles, Xt as isDaemonReconcileInProgressError, Zn as buildAuthenticatedControlPlaneResponse, _t as removeProjectConnection, bt as setDefaultProjectConnection, ct as ProjectBindingStoreUpdateRequiredError, dn as resolveCatalogSyncSkippedProfilesLogState, ft as listProjectBindings, gt as removeMissingProjectConnections, lt as bindProject, pt as listProjectConnectionsWithStatus, qr as resolveAdaptiveHeartbeatIntervalMs, rn as buildLocalServiceDiagnosticsPayload, st as ProjectBindingOperationError, wn as resolveInstalledCodexLaunchCandidates } from "./prepare-provider-runtime-BYKiQArk.js";
-import { a as resolveBaseUrl, c as resolveExplicitGatewayUrlOrThrow, f as getConfiguredDaemonDispatchLimits, i as normalizeGatewayBaseUrlOrNull, o as resolveBaseUrlOrNull, r as normalizeGatewayBaseUrl } from "./base-url-BMrQwJW4.js";
+import { At as ensureOpenMeldManagedProfileWorkspace, Bn as emitReconcileStartedEvidence, Ct as resolveLocalProjectConnectionForPath, Gr as MAX_HEARTBEAT_INTERVAL_MS, Gt as syncDaemonRouteCatalogState, Ht as createRouteCatalogFromMutableState, I as listAgentTargetStates, It as resolveConfiguredProfileWorkspacePathForAccount, Jr as applyIntervalJitterMs$1, Kr as MIN_HEARTBEAT_INTERVAL_MS, Lt as setCustomProfileWorkspace, Nt as readProfileWorkspaceConfigForAccount, O as syncDeviceRuntimeStateProjection, Ot as resolveRegistryRuntimeAdapterCapabilitySnapshot, Pt as readSavedProfileWorkspaceForAccount, Rn as emitDriftDetectedEvidence, Ur as resolveRouteRegistrationReconcileDecision, Vn as DaemonServiceRunError, Vt as createMutableRouteCatalogState, Wr as ADAPTIVE_HEARTBEAT_JITTER_RATIO, Wt as summarizeSkippedDaemonProfiles, Xr as resolveAdaptiveHeartbeatIntervalMs, Xt as isDaemonReconcileInProgressError, Yr as pruneStaleLeases, Zr as resolveCatalogSyncIntervalMs, _t as removeProjectConnection, bt as setDefaultProjectConnection, ct as ProjectBindingStoreUpdateRequiredError, dn as resolveCatalogSyncSkippedProfilesLogState, er as buildAuthenticatedControlPlaneResponse, ft as listProjectBindings, gt as removeMissingProjectConnections, lt as bindProject, pt as listProjectConnectionsWithStatus, qr as applyAcceptedLeases, rn as buildLocalServiceDiagnosticsPayload, st as ProjectBindingOperationError, wn as resolveInstalledCodexLaunchCandidates, zn as emitReconcileCompletedEvidence } from "./prepare-provider-runtime-CkW7c9bF.js";
+import { a as resolveBaseUrl, c as resolveExplicitGatewayUrlOrThrow, f as getConfiguredDaemonDispatchLimits, i as normalizeGatewayBaseUrlOrNull, o as resolveBaseUrlOrNull, r as normalizeGatewayBaseUrl } from "./base-url-B9NwMjEF.js";
 import { D as openMeldRootDir, F as resolveOpenMeldRootDir, I as resolveOpenMeldServiceOwnedPathInput, P as resolveOpenMeldEnvPreset, h as isPublishedOpenMeldHome, o as accountsDir, y as normalizeAccountKey } from "./paths-De9xdA2h.js";
-import { r as resolveAuthBaseUrl } from "./auth-url-D5LMD4E8.js";
-import { $s as sessionHistoryRequestFrameSchema, Ab as OPENMELD_ADMISSION_EVIDENCE_HEADER, Cr as BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE, Cx as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, Er as betterAuthDeviceAuthorizationCodeResponseSchema, FA as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, Gs as sessionHistoryAuditSchema, Hs as SESSION_HISTORY_CAPABILITY_HEADER, I as formatLocalMachineIssueMessage, IA as OPENMELD_RUNTIME_CAPABILITIES_HEADER, JS as sanitizeDispatchErrorSummary, Jk as localProjectControlDiscoverProjectsResponseSchema, Mr as betterAuthDeviceAuthorizationTokenResponseSchema, Nr as betterAuthSessionSnapshotResponseSchema, Ob as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, RA as computerFileAccessDaemonFrameSchema, So as cliJsonOutputEnvelopeSchema, Sx as runtimeTransportOpenMeldToolsControlFramePayloadSchema, TA as localFolderPickerHelperResultSchema, Tr as betterAuthDeviceAuthorizationCodeRequestSchema, Tx as runtimeTransportRegisterSessionRequestSchema, Wk as localProjectControlDaemonFrameSchema, Ws as SESSION_HISTORY_RUNTIME_CAPABILITY, Xs as sessionHistoryPolicySchema, _E as OPENMELD_COMPUTER_CARE_HEADER, _F as formatLocalComponentsSummaryDescription, _k as OPENMELD_REASONING_STREAM_HEADER, _v as LOCAL_EXECUTION_INPUT_CAPABILITY_HEADER, _x as runtimeTransportLocalAgentControlReadProfileWorkspaceFramePayloadSchema, b as serviceExecutionHostSnapshotSchema, bF as formatLocalSetupActionLabel, bx as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, dF as resolveCliBinaryPlatform, d_ as serviceConnectionEvidenceEventSchema, eT as openMeldDaemonControlPlaneResponseSchema, ej as COMPUTER_POWER_CAPABILITY_HEADER, fM as daemonServiceLaneSchema, f_ as serviceConnectionEvidenceJournalSchema, g as serviceExecutionHostMethods, jb as OPENMELD_EXECUTION_ADMISSION_HEADER, jr as betterAuthDeviceAuthorizationTokenRequestSchema, jw as SPACE_WORK_HANDOFF_CAPABILITY_HEADER, jx as runtimeTransportRouteCatalogChangedFramePayloadSchema, kr as betterAuthDeviceAuthorizationErrorResponseSchema, tc as sessionHistoryResultFrameSchema, ux as runtimeTransportHeartbeatRequestSchema, vA as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, vF as formatLocalComponentsSummaryLabel, v_ as SERVICE_CONNECTION_ID_QUERY_PARAMETER, vv as localExecutionInputFrameSchema, vx as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, wA as localFolderPickerHelperProtocolResultSchema, xA as localFolderPickerDaemonFrameSchema, xF as installedLocalComponentsSnapshotSchema, xv as localExecutionInputResponseSchema, yA as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, yF as formatLocalSetupActionDescription, zb as localWakeRouteWorkingFolderObservationSchema } from "./dist-Dx5paVZY.js";
-import { C as assessLocalMachineFailure, E as createServiceSpawnPendingIssue, i as isOpenMeldLockError, u as resolveOpenMeldOrphanedLockIssue, x as resolveOpenMeldLaneDescriptor } from "./lock-CDdQw0gQ.js";
-import { i as readProcessStartIdentity, n as isPreciseProcessStartIdentity, t as CURRENT_PROCESS_START_IDENTITY } from "./process-identity-DtRa8niy.js";
-import "./openmeld-dev-environment-C82HhyXf.js";
+import { r as resolveAuthBaseUrl } from "./auth-url-BH-9HTpn.js";
+import { $S as sanitizeDispatchErrorSummary, $s as sessionHistoryRequestFrameSchema, Ax as runtimeTransportRegisterSessionRequestSchema, Cr as BETTER_AUTH_DEVICE_AUTHORIZATION_GRANT_TYPE, Cx as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, DA as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, DF as formatLocalSetupActionDescription, Dx as runtimeTransportOpenMeldToolsControlFramePayloadSchema, EA as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, EF as formatLocalComponentsSummaryLabel, Er as betterAuthDeviceAuthorizationCodeResponseSchema, Fb as OPENMELD_ADMISSION_EVIDENCE_HEADER, Gs as sessionHistoryAuditSchema, Hs as SESSION_HISTORY_CAPABILITY_HEADER, I as formatLocalMachineIssueMessage, Ib as OPENMELD_EXECUTION_ADMISSION_HEADER, Iw as SPACE_WORK_HANDOFF_CAPABILITY_HEADER, Ix as runtimeTransportRouteCatalogChangedFramePayloadSchema, KA as computerFileAccessDaemonFrameSchema, MA as localFolderPickerHelperProtocolResultSchema, Mr as betterAuthDeviceAuthorizationTokenResponseSchema, NA as localFolderPickerHelperResultSchema, Nb as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, Nr as betterAuthSessionSnapshotResponseSchema, OF as formatLocalSetupActionLabel, Ox as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, Qk as localProjectControlDaemonFrameSchema, So as cliJsonOutputEnvelopeSchema, Sx as runtimeTransportLocalAgentControlReadProfileWorkspaceFramePayloadSchema, TE as OPENMELD_COMPUTER_CARE_HEADER, TF as formatLocalComponentsSummaryDescription, Tk as OPENMELD_REASONING_STREAM_HEADER, Tr as betterAuthDeviceAuthorizationCodeRequestSchema, Tx as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, UA as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, WA as OPENMELD_RUNTIME_CAPABILITIES_HEADER, Wb as localWakeRouteWorkingFolderObservationSchema, Ws as SESSION_HISTORY_RUNTIME_CAPABILITY, Xs as sessionHistoryPolicySchema, _v as LOCAL_EXECUTION_INPUT_CAPABILITY_HEADER, aT as openMeldDaemonControlPlaneResponseSchema, b as serviceExecutionHostSnapshotSchema, bM as daemonServiceLaneSchema, cj as COMPUTER_POWER_CAPABILITY_HEADER, d_ as serviceConnectionEvidenceEventSchema, f_ as serviceConnectionEvidenceJournalSchema, g as serviceExecutionHostMethods, hx as runtimeTransportHeartbeatRequestSchema, jr as betterAuthDeviceAuthorizationTokenRequestSchema, kA as localFolderPickerDaemonFrameSchema, kF as installedLocalComponentsSnapshotSchema, kr as betterAuthDeviceAuthorizationErrorResponseSchema, nA as localProjectControlDiscoverProjectsResponseSchema, tc as sessionHistoryResultFrameSchema, v_ as SERVICE_CONNECTION_ID_QUERY_PARAMETER, vv as localExecutionInputFrameSchema, xv as localExecutionInputResponseSchema, yF as resolveCliBinaryPlatform } from "./dist-CMBBVJVE.js";
+import { C as assessLocalMachineFailure, E as createServiceSpawnPendingIssue, i as isOpenMeldLockError, u as resolveOpenMeldOrphanedLockIssue, x as resolveOpenMeldLaneDescriptor } from "./lock-CqozgAXC.js";
+import { i as readProcessStartIdentity, n as isPreciseProcessStartIdentity, t as CURRENT_PROCESS_START_IDENTITY } from "./process-identity-e30Hp6t3.js";
+import "./openmeld-dev-environment-Dt_yVZn2.js";
 import { n as toErrorMessage$5, t as sleep } from "./dist-BLuEEVHh.js";
-import { nr as DAEMON_STREAM_KEEPALIVE_PING, yn as createServiceConnectionEvidenceApi } from "./dist-BJy9X73H.js";
-import { D as createAuthenticationError, E as buildHumanAuthenticationCard, F as resolveCurrentOpenMeldAccountContext, M as resolveAuthenticationReasonFromState, O as extractAuthenticationPromptAction, T as buildCommandAuthenticationPromptMessage$1, a as requireOpenMeldProfile, g as readDaemonCatalogSyncSignal, k as resolveAuthenticationGuidance, n as resolveRuntimeContext, o as resolveOpenMeldProfileOrNull, w as buildAuthenticationStatusLabel, y as clearAllSelectedOpenMeldProfileIds } from "./context-BT5P1qqr.js";
+import { nr as DAEMON_STREAM_KEEPALIVE_PING, yn as createServiceConnectionEvidenceApi } from "./dist-Dip3sgFz.js";
+import { D as createAuthenticationError, E as buildHumanAuthenticationCard, F as resolveCurrentOpenMeldAccountContext, M as resolveAuthenticationReasonFromState, O as extractAuthenticationPromptAction, T as buildCommandAuthenticationPromptMessage$1, a as requireOpenMeldProfile, g as readDaemonCatalogSyncSignal, k as resolveAuthenticationGuidance, n as resolveRuntimeContext, o as resolveOpenMeldProfileOrNull, w as buildAuthenticationStatusLabel, y as clearAllSelectedOpenMeldProfileIds } from "./context-DqkwGCKj.js";
 import { a as formatOpenMeldCliTextBlock, n as formatOpenMeldCliCommand, r as formatOpenMeldCliCommands, t as formatInlineOpenMeldCliCommands } from "./cli-entry-command-CR_9QU1i.js";
-import { C as setAuthSession, O as ServiceAccountAdmissionError, T as withAdmittedServiceSession, _ as onAuthSessionCredentialAvailable, a as beginAuthSessionTransition, d as getAuthSessionState, i as assertAuthSessionMutationAvailable, o as buildStoredAuthSessionIdentity, s as clearAuthSession, v as onAuthSessionCredentialObservation } from "./auth-session-mNZMZihh.js";
+import { C as setAuthSession, O as ServiceAccountAdmissionError, T as withAdmittedServiceSession, _ as onAuthSessionCredentialAvailable, a as beginAuthSessionTransition, d as getAuthSessionState, i as assertAuthSessionMutationAvailable, o as buildStoredAuthSessionIdentity, s as clearAuthSession, v as onAuthSessionCredentialObservation } from "./auth-session-RQOVI0Gb.js";
 import { n as writeDaemonLocalStateFile, t as readDaemonLocalStateFile } from "./daemon-local-state-file-jOXuXrky.js";
 import { t as isBinaryDistribution } from "./distribution-BDQT2ilb.js";
-import { A as getDaemonStatus, G as withDaemonServiceReconcileLock, H as setDaemonServiceRuntimeState, I as readDaemonServiceRuntimeSnapshot, J as withDaemonServiceStopLock, K as withDaemonServiceRegistrationMutationLock, L as releaseDaemonServiceLifecycleLock, M as isDaemonServiceRuntimeHeartbeatStale, O as ensureDaemonControlPlaneToken, R as resolveDaemonControlPlaneEndpoint, S as daemonServiceRepairJournalPath, U as uninstallDaemon, _ as daemonRuntimeStateRootPath, a as DAEMON_SERVICE_RUNTIME_MODE_ENV, c as acquireDaemonServiceLifecycleLock, f as daemonLifecycleJournalPath, h as daemonRuntimeRootPath, i as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, j as installDaemon, l as clearDaemonServiceRuntimeState, o as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, q as withDaemonServiceRunLock, z as resolveDaemonServiceRuntimeMetadata } from "./daemon-state-B8L0_xPT.js";
+import { A as getDaemonStatus, G as withDaemonServiceReconcileLock, H as setDaemonServiceRuntimeState, I as readDaemonServiceRuntimeSnapshot, J as withDaemonServiceStopLock, K as withDaemonServiceRegistrationMutationLock, L as releaseDaemonServiceLifecycleLock, M as isDaemonServiceRuntimeHeartbeatStale, O as ensureDaemonControlPlaneToken, R as resolveDaemonControlPlaneEndpoint, S as daemonServiceRepairJournalPath, U as uninstallDaemon, _ as daemonRuntimeStateRootPath, a as DAEMON_SERVICE_RUNTIME_MODE_ENV, c as acquireDaemonServiceLifecycleLock, f as daemonLifecycleJournalPath, h as daemonRuntimeRootPath, i as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, j as installDaemon, l as clearDaemonServiceRuntimeState, o as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, q as withDaemonServiceRunLock, z as resolveDaemonServiceRuntimeMetadata } from "./daemon-state-e0klzRsC.js";
 import { a as outJsonLine, n as sanitizeTerminalDisplayText, o as outLine, t as createPresenter } from "./presenter-DiP7Yh2y.js";
-import { c as buildRequestAuthHeaders, i as AuthRequestCredentialError, l as canAttachAuthTokenToRequest, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, t as createCliApiClientFoundation, u as fingerprintRequestAuthorization } from "./api-client-foundation-BDbeHD1i.js";
-import { a as upsertDaemonServiceContract, i as readDaemonServiceContract, n as isDaemonServiceContractIdentityReusable, t as clearDaemonServiceContract } from "./daemon-service-contract-Dkgengx4.js";
-import { i as writeDaemonRuntimeLease } from "./daemon-runtime-lease-CB0ZCPMd.js";
-import { t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-BftVniKn.js";
-import { t as admitServiceAccountStop } from "./service-account-authorization-CYcUJnZy.js";
-import { S as requestLocalDaemonShutdown, c as runWithDaemonLifecycleCommandJournal, d as compareSemver, i as readLatestDaemonLifecycleOriginEvent, l as OPENMELD_VERSION, n as formatDaemonLifecycleOriginSummary, o as resolveRecentDaemonSignalStopCause, r as readLatestDaemonLifecycleConnectionStateEvent, s as runDaemonServiceManagerAction, t as emitDaemonLifecycleEvent, w as sendLocalDaemonControlPlaneRequest, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-oMoQyKEB.js";
-import { A as prepareDaemonServiceBundle, G as readManagedCliInstallation, M as resolveAlignedDaemonActiveBundleEntryPath, N as resolveDaemonBundleEntryPathFromState, a as resolveDaemonRuntimeState, b as cleanupInactiveDaemonServiceBundles, f as listDaemonOwnedProcesses, h as resolveDaemonBundleIdFromEntryPath, i as readCurrentObservedDaemonRuntimeStatus, j as readDaemonActiveBundleState, n as getEffectiveDaemonRuntimeStatus, o as resolveDaemonServiceManagerForRuntimeState, p as extractDaemonCommandEntryPath, r as readCurrentDaemonRuntimeContext, s as waitForDaemonSystemServiceToStop, t as clearDaemonRuntimeStateIfDefinitelyStopped, u as cleanupLegacySharedDaemonServiceState, v as isOpenMeldManagedBinaryPath } from "./daemon-service-runtime-BSFTYU0n.js";
-import { r as readWindowsManagedCliInstallation } from "./windows-managed-install-BDtTogaf.js";
-import { S as resolveDaemonServiceManager, _ as readDaemonServiceJobCrashExitCode, a as disableDaemonServiceAutostartIfConfigured, c as getDaemonSystemServiceLogPath, f as isDaemonServiceJobSpawnPending, o as formatDaemonServiceJobDiagnosticsEvidence, s as getDaemonServiceLaunchdLabel } from "./daemon-service-manager-BjBYyE6i.js";
-import { A as DEFAULT_RECONNECT_DELAY_MS, C as CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS, D as DAEMON_STREAM_CONNECT_TIMEOUT_MS, F as REGISTER_RESPONSE_TIMEOUT_MS, I as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS, L as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS, M as MAX_RECONNECT_DELAY_MS, N as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS, O as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS, P as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS, R as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS, _ as toErrorMessage$6, b as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS, c as normalizeHeartbeatIntervalMs, d as normalizeText$1, f as nowIsoString, i as resolvePreferredDaemonDeviceId, j as HEARTBEAT_RESPONSE_TIMEOUT_MS, k as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS, n as ensureDaemonRuntimePaths, r as resolveDaemonDeviceId, s as emitRunLine, u as normalizeOptionalText$1, v as warnDaemonEvent, w as DAEMON_RUNTIME_CONTRACT_EPOCH, x as CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS, y as CATALOG_SYNC_RETRY_INTERVAL_MS } from "./daemon-device-id-DrGRbKdb.js";
-import { $ as buildDaemonServiceDependencyTitle, At as DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES, C as formatDaemonServiceRefreshReliabilityMessage, Ct as ensureDaemonRuntimeContractState, D as writeDaemonStartFailureState, Dt as isVersionDowngrade, E as clearDaemonStartFailureState, Et as resolveDaemonServiceAlignmentDecision, Ft as resolveCurrentDaemonExpectedVersion, It as resolveServiceUpdateUrgency, Lt as assessServerRequiredVersion, Nt as classifyDaemonServiceRunStartability, Pt as classifyDaemonServiceWakeability, Q as buildDaemonServiceDependencySummary, Rt as describeServerRequiredVersionUnavailableReason, S as buildDaemonServiceUpdateRequiredNextStep, Tt as buildDaemonServiceTargetSpec, Ut as ensureDaemonSystemServiceCommandFiles, Vt as assessCliUpdate, W as resolveLocalServiceDemand, Wt as resolveInstalledDaemonSystemServiceCommandSpec, X as buildDaemonServiceDependencyMeaning, Y as buildDaemonServiceDependencyDetails, Z as buildDaemonServiceDependencyNextStep, _t as readCurrentDaemonOwnerSnapshot, a as isDaemonInventoryRunningAndStartReady$1, bt as summarizeDaemonOwnerSnapshot, c as waitForSystemServiceStartup$1, ct as writeOpenMeldToolsMaintenancePolicy, d as captureDaemonServiceEvidenceBestEffort, et as resolveDaemonServiceDependencyDiagnostics, f as formatDaemonFailureContextText, ft as uninstallDaemonServiceUpdateWorker, g as resolveServiceReadiness, gt as hasActiveDaemonOwners, h as resolveDaemonStatusAuthenticationAttention, ht as formatDaemonOwnerSummaryLabel, i as runDaemonServiceLifecycle, jt as DAEMON_SERVICE_REPAIR_ANOMALIES, kt as DAEMON_SERVICE_AUTO_HEAL_ANOMALIES, l as startDaemonSystemServiceWithAutoRepair, lt as ensureDaemonServiceMaintenanceInstalled, m as resolveDaemonStatusAttention, mt as buildDaemonOwnerSnapshotFromObservedState, n as scheduleDaemonServiceUpdate, nt as createOpenMeldToolsUpdateCoordinator, o as isSystemServiceStartupTimeoutError, ot as readOpenMeldToolsMaintenancePolicy, p as resolveDaemonStatusSnapshot, pt as inspectDaemonServiceInventory, r as DaemonServiceLifecycleDrainTimeoutError, s as resolveSystemServiceStartupWaitMs, st as resolveOpenMeldToolsMaintenanceProjection, tt as writeDaemonServiceContract, u as captureDaemonServiceEvidence, v as buildDaemonServiceRefreshNextStep, vt as resolveDaemonStopStrategy, w as formatDaemonServiceUpdateRequiredMessage, wt as readDaemonRuntimeContractRepairReport, x as buildDaemonServiceStatusReadOnlyDetail, y as buildDaemonServiceRefreshPromptMessage, yt as resolveStoppedContractWriteBlockedReason } from "./daemon-service-update-coordinator-BUAkAxqT.js";
-import { Ct as buildAgentOverviewFromContract, Q as getCommandEntryContract, ht as validateDaemonControlTargetInput, t as createAuthLoginGuideError } from "./dual-view-guide-catalog-D4rlZXO_.js";
-import { a as formatDaemonServiceDowngradeBlockedRecommendation, d as formatDaemonServiceMissingStatus, f as getDaemonDowngradeBlockedTitle, g as canUseInteractivePrompts, h as resolveOpenMeldToolsUpdateOperationProjection, l as formatDaemonServiceMissingRunStepOne, n as resolveElapsedTimeMs, o as formatDaemonServiceMissingAction, r as formatDaemonDowngradeBlockedNextStep, s as formatDaemonServiceMissingMeaning, t as formatElapsedTime, u as formatDaemonServiceMissingRunStepTwo } from "./elapsed-time-pHCf33Jh.js";
-import { E as queryOpenCodeReadOnly, K as buildRepositoryFingerprint, W as createServiceGitEnvironment, _ as sendDaemonFrame, at as emitDaemonDispatchJournalEvent, ct as readComputerFileAccessPolicy, dt as isSameOrDescendantPath, g as parseDaemonFrame, h as handleDaemonTransportFrame, it as resolveNextRuntimeAgentControllerReportSyncAtMs, k as resolveOpenCodeDatabasePath, lt as resolveComputerFileAccessStorePath, m as createCodexJsonRpcClient, n as assertDispatchOwnedRuntimeServiceMutationAllowed, st as ComputerFileAccessStoreError, ut as updateComputerFileAccessPolicy, v as collectObservedSessionWorkingDirectories } from "./dispatch-owned-runtime-D5THLVZR.js";
-import { n as createExecutionHostClient, t as ExecutionHostError } from "./channel-48XSbUsz.js";
-import { t as childExecutionHostChannel } from "./process-channel-BYaPF16N.js";
-import { m as hashBundledSkillAssets, p as computeDirectoryContentHash, u as loadSelectedSkillAssets } from "./state-Defk8u-_.js";
-import { n as collectSkillsReadinessSnapshot } from "./installation-inventory-Cr8q27L_.js";
+import { c as buildRequestAuthHeaders, i as AuthRequestCredentialError, l as canAttachAuthTokenToRequest, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, t as createCliApiClientFoundation, u as fingerprintRequestAuthorization } from "./api-client-foundation-DBl_OaMj.js";
+import { a as upsertDaemonServiceContract, i as readDaemonServiceContract, n as isDaemonServiceContractIdentityReusable, t as clearDaemonServiceContract } from "./daemon-service-contract-DGPRa_PH.js";
+import { i as writeDaemonRuntimeLease } from "./daemon-runtime-lease-B--QbOlQ.js";
+import { t as resolveOpenMeldEnvironmentTarget } from "./openmeld-environment-target-BjcRwYW3.js";
+import { t as admitServiceAccountStop } from "./service-account-authorization-CznmJjXZ.js";
+import { S as requestLocalDaemonShutdown, c as runWithDaemonLifecycleCommandJournal, d as compareSemver, i as readLatestDaemonLifecycleOriginEvent, l as OPENMELD_VERSION, n as formatDaemonLifecycleOriginSummary, o as resolveRecentDaemonSignalStopCause, r as readLatestDaemonLifecycleConnectionStateEvent, s as runDaemonServiceManagerAction, t as emitDaemonLifecycleEvent, w as sendLocalDaemonControlPlaneRequest, y as LocalDaemonControlPlaneClientError } from "./daemon-lifecycle-journal-D4Xupqhp.js";
+import { A as prepareDaemonServiceBundle, G as readManagedCliInstallation, M as resolveAlignedDaemonActiveBundleEntryPath, N as resolveDaemonBundleEntryPathFromState, a as resolveDaemonRuntimeState, b as cleanupInactiveDaemonServiceBundles, f as listDaemonOwnedProcesses, h as resolveDaemonBundleIdFromEntryPath, i as readCurrentObservedDaemonRuntimeStatus, j as readDaemonActiveBundleState, n as getEffectiveDaemonRuntimeStatus, o as resolveDaemonServiceManagerForRuntimeState, p as extractDaemonCommandEntryPath, r as readCurrentDaemonRuntimeContext, s as waitForDaemonSystemServiceToStop, t as clearDaemonRuntimeStateIfDefinitelyStopped, u as cleanupLegacySharedDaemonServiceState, v as isOpenMeldManagedBinaryPath } from "./daemon-service-runtime-BMUXKr64.js";
+import { r as readWindowsManagedCliInstallation } from "./windows-managed-install-q2TxKIIe.js";
+import { S as resolveDaemonServiceManager, _ as readDaemonServiceJobCrashExitCode, a as disableDaemonServiceAutostartIfConfigured, c as getDaemonSystemServiceLogPath, f as isDaemonServiceJobSpawnPending, o as formatDaemonServiceJobDiagnosticsEvidence, s as getDaemonServiceLaunchdLabel } from "./daemon-service-manager-CDBNfjOu.js";
+import { A as DEFAULT_RECONNECT_DELAY_MS, C as CONTROLLED_SHUTDOWN_SOCKET_CLOSE_TIMEOUT_MS, D as DAEMON_STREAM_CONNECT_TIMEOUT_MS, F as REGISTER_RESPONSE_TIMEOUT_MS, I as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS, L as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS, M as MAX_RECONNECT_DELAY_MS, N as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS, O as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS, P as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS, R as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS, _ as toErrorMessage$6, b as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS, c as normalizeHeartbeatIntervalMs, d as normalizeText$1, f as nowIsoString, i as resolvePreferredDaemonDeviceId, j as HEARTBEAT_RESPONSE_TIMEOUT_MS, k as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS, n as ensureDaemonRuntimePaths, r as resolveDaemonDeviceId, s as emitRunLine, u as normalizeOptionalText$1, v as warnDaemonEvent, w as DAEMON_RUNTIME_CONTRACT_EPOCH, x as CONTROLLED_SHUTDOWN_REQUEST_TIMEOUT_MS, y as CATALOG_SYNC_RETRY_INTERVAL_MS } from "./daemon-device-id-BmL_1aHE.js";
+import { $ as buildDaemonServiceDependencyTitle, At as DAEMON_SERVICE_FULL_ALIGNMENT_ANOMALIES, C as formatDaemonServiceRefreshReliabilityMessage, Ct as ensureDaemonRuntimeContractState, D as writeDaemonStartFailureState, Dt as isVersionDowngrade, E as clearDaemonStartFailureState, Et as resolveDaemonServiceAlignmentDecision, Ft as resolveCurrentDaemonExpectedVersion, It as resolveServiceUpdateUrgency, Lt as assessServerRequiredVersion, Nt as classifyDaemonServiceRunStartability, Pt as classifyDaemonServiceWakeability, Q as buildDaemonServiceDependencySummary, Rt as describeServerRequiredVersionUnavailableReason, S as buildDaemonServiceUpdateRequiredNextStep, Tt as buildDaemonServiceTargetSpec, Ut as ensureDaemonSystemServiceCommandFiles, Vt as assessCliUpdate, W as resolveLocalServiceDemand, Wt as resolveInstalledDaemonSystemServiceCommandSpec, X as buildDaemonServiceDependencyMeaning, Y as buildDaemonServiceDependencyDetails, Z as buildDaemonServiceDependencyNextStep, _t as readCurrentDaemonOwnerSnapshot, a as isDaemonInventoryRunningAndStartReady$1, bt as summarizeDaemonOwnerSnapshot, c as waitForSystemServiceStartup$1, ct as writeOpenMeldToolsMaintenancePolicy, d as captureDaemonServiceEvidenceBestEffort, et as resolveDaemonServiceDependencyDiagnostics, f as formatDaemonFailureContextText, ft as uninstallDaemonServiceUpdateWorker, g as resolveServiceReadiness, gt as hasActiveDaemonOwners, h as resolveDaemonStatusAuthenticationAttention, ht as formatDaemonOwnerSummaryLabel, i as runDaemonServiceLifecycle, jt as DAEMON_SERVICE_REPAIR_ANOMALIES, kt as DAEMON_SERVICE_AUTO_HEAL_ANOMALIES, l as startDaemonSystemServiceWithAutoRepair, lt as ensureDaemonServiceMaintenanceInstalled, m as resolveDaemonStatusAttention, mt as buildDaemonOwnerSnapshotFromObservedState, n as scheduleDaemonServiceUpdate, nt as createOpenMeldToolsUpdateCoordinator, o as isSystemServiceStartupTimeoutError, ot as readOpenMeldToolsMaintenancePolicy, p as resolveDaemonStatusSnapshot, pt as inspectDaemonServiceInventory, r as DaemonServiceLifecycleDrainTimeoutError, s as resolveSystemServiceStartupWaitMs, st as resolveOpenMeldToolsMaintenanceProjection, tt as writeDaemonServiceContract, u as captureDaemonServiceEvidence, v as buildDaemonServiceRefreshNextStep, vt as resolveDaemonStopStrategy, w as formatDaemonServiceUpdateRequiredMessage, wt as readDaemonRuntimeContractRepairReport, x as buildDaemonServiceStatusReadOnlyDetail, y as buildDaemonServiceRefreshPromptMessage, yt as resolveStoppedContractWriteBlockedReason } from "./daemon-service-update-coordinator-ef1RLL_R.js";
+import { Ct as buildAgentOverviewFromContract, Q as getCommandEntryContract, ht as validateDaemonControlTargetInput, t as createAuthLoginGuideError } from "./dual-view-guide-catalog-DkoOcvAt.js";
+import { a as formatDaemonServiceDowngradeBlockedRecommendation, d as formatDaemonServiceMissingStatus, f as getDaemonDowngradeBlockedTitle, g as canUseInteractivePrompts, h as resolveOpenMeldToolsUpdateOperationProjection, l as formatDaemonServiceMissingRunStepOne, n as resolveElapsedTimeMs, o as formatDaemonServiceMissingAction, r as formatDaemonDowngradeBlockedNextStep, s as formatDaemonServiceMissingMeaning, t as formatElapsedTime, u as formatDaemonServiceMissingRunStepTwo } from "./elapsed-time-COLGQWPQ.js";
+import { E as queryOpenCodeReadOnly, K as buildRepositoryFingerprint, W as createServiceGitEnvironment, _ as sendDaemonFrame, at as emitDaemonDispatchJournalEvent, ct as readComputerFileAccessPolicy, dt as isSameOrDescendantPath, g as parseDaemonFrame, h as handleDaemonTransportFrame, it as resolveNextRuntimeAgentControllerReportSyncAtMs, k as resolveOpenCodeDatabasePath, lt as resolveComputerFileAccessStorePath, m as createCodexJsonRpcClient, n as assertDispatchOwnedRuntimeServiceMutationAllowed, st as ComputerFileAccessStoreError, ut as updateComputerFileAccessPolicy, v as collectObservedSessionWorkingDirectories } from "./dispatch-owned-runtime-D5J7omXK.js";
+import { n as createExecutionHostClient, t as ExecutionHostError } from "./channel-fUczwp7l.js";
+import { t as childExecutionHostChannel } from "./process-channel-BCIgC7jM.js";
+import { m as hashBundledSkillAssets, p as computeDirectoryContentHash, u as loadSelectedSkillAssets } from "./state-6y71kBCo.js";
+import { n as collectSkillsReadinessSnapshot } from "./installation-inventory-Bxelkj89.js";
 import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -4227,6 +4227,7 @@ function resolveDaemonCapabilitiesFromAdapterIds(input) {
 			interrupt: true,
 			manageInstallations: true,
 			manageInstallationsSafely: true,
+			updateInstallations: true,
 			refreshCatalog: true,
 			resumeControllerConversation: true,
 			setEnabled: true,
@@ -6455,6 +6456,7 @@ async function runDaemonSocketSession(input) {
 	let routeCatalogSyncInFlight = false;
 	let heartbeatTimer = null;
 	let heartbeatTimerDueAtMs = null;
+	const transportEnded = Promise.withResolvers();
 	const keepalive = createDaemonStreamKeepalive({
 		onPongTimeout: () => {
 			emitRunLine({
@@ -6466,7 +6468,7 @@ async function runDaemonSocketSession(input) {
 					daemonSessionId: input.daemonSessionId
 				}
 			});
-			input.socket.terminate();
+			terminateForReconnect("keepalive_pong_timeout");
 		},
 		sendPing: () => {
 			if (closed) return false;
@@ -6543,14 +6545,42 @@ async function runDaemonSocketSession(input) {
 			}))
 		});
 	};
+	function retireTransport(error) {
+		if (closed) return;
+		closed = true;
+		admissionHeartbeatPending = false;
+		clearHeartbeatTimer();
+		keepalive.stop();
+		clearCatalogSyncSignalTimer();
+		hostLink.detach().catch(reportHostFailure);
+		input.attachRouteCatalogSyncInvoker?.(null);
+		waiters.registerRejecter?.(error);
+		waiters.heartbeatRejecter?.(error);
+		failPendingRouteCatalogSyncRequests(error);
+		transportEnded.resolve(error);
+	}
+	function terminateForReconnect(reasonCode) {
+		if (closed) return;
+		retireTransport(new DaemonServiceRunError({
+			code: "daemon.run.socket_closed",
+			message: `daemon stream unavailable (${reasonCode})`
+		}));
+		warnDaemonEvent("[openmeld.daemon.reconnect_required]", {
+			event: "cli.daemon.reconnect_required",
+			reasonCode,
+			connectionGeneration: activeConnectionGeneration,
+			daemonSessionId: input.daemonSessionId
+		});
+		input.socket.terminate();
+	}
 	const waitForClose = new Promise((resolve) => {
 		input.socket.onClose((code, reason) => {
-			closed = true;
-			admissionHeartbeatPending = false;
-			clearHeartbeatTimer();
-			hostLink.detach().catch(reportHostFailure);
 			closeCode = code;
 			closeReason = normalizeText$1(reason) || "closed";
+			retireTransport(new DaemonServiceRunError({
+				code: "daemon.run.socket_closed",
+				message: `daemon stream closed (code=${String(closeCode)}, reason=${closeReason})`
+			}));
 			const closedAtMs = Date.now();
 			const durationMs = Math.max(0, closedAtMs - socketConnectedAtMs);
 			const disconnectClass = classifyDaemonSocketDisconnect({
@@ -6575,13 +6605,6 @@ async function runDaemonSocketSession(input) {
 					socketDisconnectedAtMs: closedAtMs
 				}
 			});
-			const closeError = new DaemonServiceRunError({
-				code: "daemon.run.socket_closed",
-				message: `daemon stream closed (code=${String(closeCode)}, reason=${closeReason})`
-			});
-			waiters.registerRejecter?.(closeError);
-			waiters.heartbeatRejecter?.(closeError);
-			failPendingRouteCatalogSyncRequests(closeError);
 			resolve();
 		});
 	});
@@ -6797,7 +6820,7 @@ async function runDaemonSocketSession(input) {
 		} catch (error) {
 			if (recordHeartbeatFailure(error) && !options.requireAcknowledgement) {
 				admissionHeartbeatPending = false;
-				input.socket.terminate();
+				terminateForReconnect("heartbeat_failed");
 				return;
 			}
 			updateHeartbeatInterval({
@@ -7418,6 +7441,7 @@ async function runDaemonSocketSession(input) {
 			code: "daemon.run.socket_error",
 			text: `daemon stream socket error: ${toErrorMessage$6(error)}`
 		});
+		terminateForReconnect("socket_error");
 	});
 	const handleOpenMeldToolsControlFrame = (frame) => {
 		if (frame.code !== "daemon.openmeld_tools_control.request") return false;
@@ -7471,7 +7495,7 @@ async function runDaemonSocketSession(input) {
 		});
 		return true;
 	};
-	input.socket.onMessage((raw) => {
+	const handleMessage = (raw) => {
 		if (raw === "pong") {
 			keepalive.observePong();
 			return;
@@ -7559,6 +7583,9 @@ async function runDaemonSocketSession(input) {
 			presenter: input.presenter,
 			waiters
 		})) hostLink.forward(parsedFrame);
+	};
+	input.socket.onMessage((raw) => {
+		if (!closed) handleMessage(raw);
 	});
 	const registerResponse = await registerDaemonSession(createRouteCatalogFromMutableState(input.routeCatalogState));
 	applyAcceptedLeases({
@@ -7605,15 +7632,16 @@ async function runDaemonSocketSession(input) {
 		persistAcceptedRouteCatalogCache,
 		registerRejected: registerResponse.rejectedProfiles.length > 0,
 		scheduleCatalogSyncNext,
-		shutdownRequested: input.shutdownRequested
+		shutdownRequested: input.shutdownRequested,
+		transportEnded: transportEnded.promise
 	});
 	const bootstrapShutdownStopCause = bootstrap.shutdownStopCause;
 	if (!bootstrapShutdownStopCause) {
 		latestCatalogSyncSignalMarker = resolveCatalogSyncSignalMarker(bootstrap.initialCatalogSyncSignal);
 		scheduleCatalogSyncSignalPoll();
 		await sendHeartbeat();
-		keepalive.start();
 	}
+	keepalive.start();
 	async function finishControlledShutdown(stopCause) {
 		acceptingDispatches = false;
 		shutdownStopCause = stopCause;
@@ -7626,7 +7654,7 @@ async function runDaemonSocketSession(input) {
 			reasonCode: "controlled_stop",
 			detailCode: stopCause
 		};
-		await input.executionHost.call("beginDrain", {});
+		await input.executionHost.call("beginDrain", {}).catch(input.failHostShutdown);
 		clearHeartbeatTimer();
 		emitRunLine({
 			presenter: input.presenter,
@@ -7655,8 +7683,10 @@ async function runDaemonSocketSession(input) {
 			code: "daemon.run.controlled_shutdown_draining",
 			text: "Waiting for accepted local work to finish in the execution host."
 		});
-		await input.executionHost.call("drain", {}, { timeoutMs: null });
-		const result = await input.executionHost.call("settleResults", {});
+		await Promise.race([input.drainExecutionHost(), transportEnded.promise.then((error) => {
+			throw error;
+		})]);
+		const result = await input.executionHost.call("settleResults", {}).catch(input.failHostShutdown);
 		if (finalHeartbeatError) throw finalHeartbeatError;
 		if (result.status === "connection_closed") return false;
 		if (result.status === "timeout") emitRunLine({
@@ -7687,14 +7717,17 @@ async function runDaemonSocketSession(input) {
 	const sessionExit = bootstrapShutdownStopCause ? {
 		kind: "shutdown_requested",
 		stopCause: bootstrapShutdownStopCause
-	} : await Promise.race([waitForClose.then(() => ({ kind: "socket_closed" })), input.shutdownRequested?.then((stopCause) => ({
+	} : await Promise.race([transportEnded.promise.then((error) => ({
+		kind: "transport_ended",
+		error
+	})), input.shutdownRequested?.then((stopCause) => ({
 		kind: "shutdown_requested",
 		stopCause
 	})) ?? new Promise(() => void 0)]);
 	try {
 		if (sessionExit.kind === "shutdown_requested" && !closed) controlledShutdownCompleted = await finishControlledShutdown(sessionExit.stopCause);
 	} catch (error) {
-		input.socket.terminate();
+		if (!closed) input.socket.terminate();
 		throw error;
 	} finally {
 		hostLink.detach().catch(reportHostFailure);
@@ -7704,6 +7737,7 @@ async function runDaemonSocketSession(input) {
 		clearCatalogSyncSignalTimer();
 	}
 	if (controlledShutdownCompleted || closeCode === 1e3 && closeReason === "shutdown") return;
+	if (sessionExit.kind === "transport_ended") throw sessionExit.error;
 	throw new DaemonServiceRunError({
 		code: "daemon.run.socket_closed",
 		message: `daemon stream closed (code=${String(closeCode)}, reason=${closeReason})`
@@ -7731,9 +7765,10 @@ async function completeRegisteredSessionBootstrap(input) {
 			syncIntervalMs: resolveCatalogSyncIntervalMs({ heartbeatIntervalMs: input.heartbeatIntervalMs })
 		});
 		if (bootstrapPlan.persistCache) {
-			const persistence = await awaitOperationOrShutdown({
+			const persistence = await awaitOperationOrSessionExit({
 				operation: input.persistAcceptedRouteCatalogCache(),
-				shutdownRequested: input.shutdownRequested
+				shutdownRequested: input.shutdownRequested,
+				transportEnded: input.transportEnded
 			});
 			if (persistence.kind === "shutdown_requested") return {
 				initialCatalogSyncSignal: null,
@@ -7742,9 +7777,10 @@ async function completeRegisteredSessionBootstrap(input) {
 		}
 		input.scheduleCatalogSyncNext(bootstrapPlan.nextSyncDelayMs);
 	}
-	const catalogSignal = await awaitOperationOrShutdown({
+	const catalogSignal = await awaitOperationOrSessionExit({
 		operation: readDaemonCatalogSyncSignal().catch(() => null),
-		shutdownRequested: input.shutdownRequested
+		shutdownRequested: input.shutdownRequested,
+		transportEnded: input.transportEnded
 	});
 	if (catalogSignal.kind === "shutdown_requested") return {
 		initialCatalogSyncSignal: null,
@@ -7755,18 +7791,20 @@ async function completeRegisteredSessionBootstrap(input) {
 		shutdownStopCause: null
 	};
 }
-async function awaitOperationOrShutdown(input) {
-	if (!input.shutdownRequested) return {
-		kind: "completed",
-		value: await input.operation
-	};
-	return await Promise.race([input.operation.then((value) => ({
-		kind: "completed",
-		value
-	})), input.shutdownRequested.then((stopCause) => ({
-		kind: "shutdown_requested",
-		stopCause
-	}))]);
+async function awaitOperationOrSessionExit(input) {
+	return await Promise.race([
+		input.operation.then((value) => ({
+			kind: "completed",
+			value
+		})),
+		input.transportEnded.then((error) => {
+			throw error;
+		}),
+		input.shutdownRequested?.then((stopCause) => ({
+			kind: "shutdown_requested",
+			stopCause
+		})) ?? new Promise(() => void 0)
+	]);
 }
 async function waitForPromiseDeadline(input) {
 	let timeout = null;
@@ -8452,15 +8490,29 @@ async function buildDaemonStreamRequestHeaders(input) {
 }
 function createControlledShutdownCoordinator(input) {
 	let activeSessionShutdownResolver = null;
+	let hostDrain = null;
 	let shutdownAttempt = null;
 	const requestServiceStop = (stopCause) => {
 		if (input.isStopRequested()) return;
 		input.markStopping();
 		Promise.resolve(stopCause).then((resolvedStopCause) => activeSessionShutdownResolver?.(resolvedStopCause), () => activeSessionShutdownResolver?.("unknown"));
 	};
+	const failHostShutdown = (error) => {
+		shutdownAttempt?.reject(error);
+		throw error;
+	};
 	return {
+		failHostShutdown,
+		waitForDrain() {
+			hostDrain ??= input.drainHost().catch((error) => {
+				hostDrain = null;
+				return failHostShutdown(error);
+			});
+			return hostDrain;
+		},
 		attachSession(shutdownResolver) {
 			activeSessionShutdownResolver = shutdownResolver;
+			if (shutdownAttempt) shutdownResolver(shutdownAttempt.stopCause);
 		},
 		detachSession(shutdownResolver) {
 			if (activeSessionShutdownResolver === shutdownResolver) activeSessionShutdownResolver = null;
@@ -8473,12 +8525,9 @@ function createControlledShutdownCoordinator(input) {
 		},
 		handleSessionCompleted() {
 			if (!shutdownAttempt) return;
-			requestServiceStop("controlled_service_update");
+			requestServiceStop(shutdownAttempt.stopCause);
 			shutdownAttempt.resolve();
 		},
-		handleSessionFailure(error) {
-			shutdownAttempt?.reject(error);
-		},
 		requestServiceStop,
 		async request(payload) {
 			return await withControlledStopRefusalProof({
@@ -8492,7 +8541,10 @@ function createControlledShutdownCoordinator(input) {
 						await payload.onAdmission?.(() => void 0);
 						await existingAttempt.promise;
 					} else if (activeSessionShutdownResolver) {
-						const currentAttempt = Promise.withResolvers();
+						const currentAttempt = {
+							...Promise.withResolvers(),
+							stopCause
+						};
 						const clearAttempt = () => {
 							if (shutdownAttempt === currentAttempt) shutdownAttempt = null;
 						};
@@ -8548,11 +8600,10 @@ async function runSocketSessionWithControlledShutdown(input) {
 	try {
 		await runDaemonSocketSession({
 			...input.sessionInput,
+			drainExecutionHost: input.controlledShutdown.waitForDrain,
+			failHostShutdown: input.controlledShutdown.failHostShutdown,
 			shutdownRequested: sessionShutdown.promise
 		});
-	} catch (error) {
-		input.controlledShutdown.handleSessionFailure(error);
-		throw error;
 	} finally {
 		input.controlledShutdown.detachSession(sessionShutdown.resolve);
 	}
@@ -8712,6 +8763,9 @@ const runAccountBoundDaemonServiceLoop = async (input) => {
 	};
 	let requestActiveRouteCatalogSync = null;
 	const controlledShutdown = createControlledShutdownCoordinator({
+		drainHost: async () => {
+			await executionHost.call("drain", {}, { timeoutMs: null });
+		},
 		hasUndrainedWork: () => {
 			const observed = executionHost.snapshot();
 			return !(executionHost.available() && observed?.localQuiescent) || observed.unacknowledgedResultCount > 0;
@@ -16605,4 +16659,4 @@ function parseDaemonRunMode(rawMode) {
 //#endregion
 export { buildAuthStatusSnapshot as $, buildDaemonStartNeedsAttentionCard as A, resolveDaemonServiceParticipationStatus as B, buildProfileWorkspaceRows as C, createDelayedSpinner as D, emitDaemonAgentOverview as E, emitCliJsonEnvelope as F, ensureCommandAuthenticationOrCancel as G, validateLocalProjectConnectionPath as H, runDaemonStartupPreflight as I, runAuthLogout as J, evaluateCommandAuthentication as K, readDaemonIncidentLogTail as L, buildHumanErrorCopy as M, renderHumanErrorCard as N, shouldEmitAgentOverview as O, renderHumanTextErrorCard as P, buildAuthStatusRows as Q, resolveLocalComponentsStatus as R, buildProfileWorkspacePresentation as S, createQuietPresenter as T, connectWebSocket as U, LocalProjectConnectionError as V, buildCommandAuthenticationPromptMessage as W, runAuthStatus as X, runAuthMenu as Y, exchangeOneTimeTokenAuthSession as Z, buildDaemonBackgroundStartFailure as _, resolveDeviceTokenExpiresAt as _t, runDaemonBackgroundStartForDecision as a, promptTextEntry as at, formatServiceRuntimeHeadline as b, runDaemonInterrupt as c, finishCurrentCommandCheckScope as ct, runDaemonServiceDetached as d, resetCurrentCommandCheckState as dt, formatActiveOrganizationLabel as et, runDaemonSnapshot as f, startCurrentCommandCheckScope as ft, runDaemonUninstall as g, resolveDeviceAuthClientId as gt, runDaemonTeardownStrict as h, requestDeviceToken as ht, runDaemonAutostart as i, buildUnifiedCardFrame as it, runDaemonStartDecisionPrompt as j, buildDaemonStartDeferredCard as k, runDaemonReinstall as l, getCurrentCommandCheckState as lt, runDaemonStop as m, fetchAuthUserSnapshot as mt, isManagedSystemServiceBootstrapRun as n, renderInfoCard as nt, runDaemonCancel as o, isReturnKeypress as ot, runDaemonStatusFlow as p, extractAuthApiErrorMessage as pt, runAuthLogin as q, runDaemon as r, renderTextInfoCard as rt, runDaemonInstall as s, runInteractivePrompt as st, bestEffortStopCurrentLaneDaemonService as t, buildTextInfoCardLines as tt, runDaemonRunAfterEntryChecks as u, isCurrentCommandCheckScopeActive as ut, buildSystemServiceStartupFailureReportFromVerdict as v, revokeAuthAccessToken as vt, reconcileCliVersionView as w, resolveServiceParticipationReadiness as x, formatServiceParticipationReadinessLabel as y, writeInstalledLocalComponentsSnapshot as z };
 
-//# sourceMappingURL=service-Ciifmu6w.js.map
+//# sourceMappingURL=service-8ReqDsOx.js.map