perchai-cli 2.4.47 → 2.4.48

package/dist/perch.mjs

@@ -75918,6 +75918,7 @@ function isTurnAbortedError(error) {
 var TURN_STOPPED_BY_USER_MESSAGE;
 var init_turnAbort = __esm({
   "features/perchTerminal/runtime/turnAbort.ts"() {
+    "use strict";
     TURN_STOPPED_BY_USER_MESSAGE = "Turn stopped by user.";
   }
 });
@@ -76223,6 +76224,7 @@ function getToolDisplayName(toolName) {
 var NON_MODULE_TOOL_OWNERS, TOOL_RISK, TOOL_DISPLAY_NAMES;
 var init_catalog = __esm({
   "features/perchTerminal/runtime/toolSystem/catalog.ts"() {
+    "use strict";
     init_toolNames();
     NON_MODULE_TOOL_OWNERS = {
       [TOOL_NAMES.listSources]: "lane",
@@ -91108,7 +91110,6 @@ Final answers lead with findings, name artifacts or delivery status, and give on
 var MARKET_DESK_TOOL_NAMES;
 var init_marketDeskAccess = __esm({
   "features/perchTerminal/runtime/marketDesk/marketDeskAccess.ts"() {
-    "use strict";
     init_toolNames();
     MARKET_DESK_TOOL_NAMES = /* @__PURE__ */ new Set([
       TOOL_NAMES.getMarketSignal,
@@ -91788,7 +91789,6 @@ function listFinancialPlaybooks() {
 var AP_AUDIT_PACKET_DEF, PLAYBOOKS;
 var init_registry2 = __esm({
   "features/perchTerminal/runtime/financialPlaybooks/registry.ts"() {
-    "use strict";
     init_managedWorkflowRegistry2();
     init_toolNames();
     AP_AUDIT_PACKET_DEF = {
@@ -115612,10 +115612,10 @@ function matchStringTarget(hostname, target) {
   }
   return false;
 }
-function getDefaultPropagationTargets(supabaseUrl2) {
+function getDefaultPropagationTargets(supabaseUrl) {
   const targets = [];
   try {
-    const url = new URL(supabaseUrl2);
+    const url = new URL(supabaseUrl);
     targets.push(url.hostname);
   } catch (error) {
   }
@@ -115712,8 +115712,8 @@ function applySettingDefaults(options, defaults) {
   else delete result2.accessToken;
   return result2;
 }
-function validateSupabaseUrl(supabaseUrl2) {
-  const trimmedUrl = supabaseUrl2 === null || supabaseUrl2 === void 0 ? void 0 : supabaseUrl2.trim();
+function validateSupabaseUrl(supabaseUrl) {
+  const trimmedUrl = supabaseUrl === null || supabaseUrl === void 0 ? void 0 : supabaseUrl.trim();
   if (!trimmedUrl) throw new Error("supabaseUrl is required.");
   if (!trimmedUrl.match(/^https?:\/\//i)) throw new Error("Invalid supabaseUrl: Must be a valid HTTP or HTTPS URL.");
   try {
@@ -115771,12 +115771,12 @@ var init_dist4 = __esm({
     resolveHeadersConstructor = () => {
       return Headers;
     };
-    fetchWithAuth = (supabaseKey, supabaseUrl2, getAccessToken, customFetch, tracePropagationOptions) => {
+    fetchWithAuth = (supabaseKey, supabaseUrl, getAccessToken, customFetch, tracePropagationOptions) => {
       const fetch$1 = resolveFetch2(customFetch);
       const HeadersConstructor = resolveHeadersConstructor();
       const traceEnabled = (tracePropagationOptions === null || tracePropagationOptions === void 0 ? void 0 : tracePropagationOptions.enabled) === true;
       const respectSampling = (tracePropagationOptions === null || tracePropagationOptions === void 0 ? void 0 : tracePropagationOptions.respectSamplingDecision) !== false;
-      const traceTargets = traceEnabled ? getDefaultPropagationTargets(supabaseUrl2) : null;
+      const traceTargets = traceEnabled ? getDefaultPropagationTargets(supabaseUrl) : null;
       return async (input, init) => {
         var _await$getAccessToken;
         const accessToken = (_await$getAccessToken = await getAccessToken()) !== null && _await$getAccessToken !== void 0 ? _await$getAccessToken : supabaseKey;
@@ -115987,11 +115987,11 @@ var init_dist4 = __esm({
       * const { data } = await supabase.from('profiles').select('*')
       * ```
       */
-      constructor(supabaseUrl2, supabaseKey, options) {
+      constructor(supabaseUrl, supabaseKey, options) {
         var _settings$auth$storag, _settings$global$head;
-        this.supabaseUrl = supabaseUrl2;
+        this.supabaseUrl = supabaseUrl;
         this.supabaseKey = supabaseKey;
-        const baseUrl = validateSupabaseUrl(supabaseUrl2);
+        const baseUrl = validateSupabaseUrl(supabaseUrl);
         if (!supabaseKey) throw new Error("supabaseKey is required.");
         this.realtimeUrl = new URL("realtime/v1", baseUrl);
         this.realtimeUrl.protocol = this.realtimeUrl.protocol.replace("http", "ws");
@@ -116019,7 +116019,7 @@ var init_dist4 = __esm({
             throw new Error(`@supabase/supabase-js: Supabase Client is configured with the accessToken option, accessing supabase.auth.${String(prop)} is not possible`);
           } });
         }
-        this.fetch = fetchWithAuth(supabaseKey, supabaseUrl2, this._getAccessToken.bind(this), settings.global.fetch, settings.tracePropagation);
+        this.fetch = fetchWithAuth(supabaseKey, supabaseUrl, this._getAccessToken.bind(this), settings.global.fetch, settings.tracePropagation);
         this.realtime = this._initRealtimeClient(_objectSpread23({
           headers: this.headers,
           accessToken: this._getAccessToken.bind(this),
@@ -116203,8 +116203,8 @@ var init_dist4 = __esm({
         }
       }
     };
-    createClient = (supabaseUrl2, supabaseKey, options) => {
-      return new SupabaseClient(supabaseUrl2, supabaseKey, options);
+    createClient = (supabaseUrl, supabaseKey, options) => {
+      return new SupabaseClient(supabaseUrl, supabaseKey, options);
     };
     if (shouldShowDeprecationWarning()) console.warn("\u26A0\uFE0F  Node.js 18 and below are deprecated and will no longer be supported in future versions of @supabase/supabase-js. Please upgrade to Node.js 20 or later. For more information, visit: https://github.com/orgs/supabase/discussions/37217");
   }
@@ -119113,6 +119113,24 @@ var init_autoRouter = __esm({
   }
 });
 
+// lib/auth/browserSession.ts
+async function syncBrowserAuthSession() {
+  if (typeof window === "undefined") return null;
+  const response = await fetch("/api/auth/session", SESSION_FETCH_OPTIONS);
+  if (!response.ok) return null;
+  const body = await response.json();
+  return body.session ?? null;
+}
+var SESSION_FETCH_OPTIONS;
+var init_browserSession = __esm({
+  "lib/auth/browserSession.ts"() {
+    SESSION_FETCH_OPTIONS = {
+      credentials: "same-origin",
+      cache: "no-store"
+    };
+  }
+});
+
 // features/perchTerminal/runtime/roost.ts
 function normalizeRoostTier(value) {
   if (value === "max") return "pro_max";
@@ -119473,9 +119491,18 @@ async function callModelRouterViaServer(request, opts, endpoint = "/api/perch-te
 async function fetchModelProxyWithRetry(endpoint, init, options) {
   const maxAttempts = Math.max(1, options?.maxAttempts ?? MODEL_PROXY_MAX_ATTEMPTS);
   let lastError = null;
+  let authSynced = false;
   for (let attempt = 0; attempt < maxAttempts; attempt++) {
     try {
       const response = await fetch(endpoint, init);
+      if (response.status === 401 && !authSynced && typeof globalThis.window !== "undefined") {
+        authSynced = true;
+        await syncBrowserAuthSession();
+        options?.onRetry?.(attempt, "HTTP 401 (session sync)");
+        await response.body?.cancel().catch(() => void 0);
+        await waitForModelProxyRetry(attempt, init.signal);
+        continue;
+      }
       if (!isRetriableModelProxyStatus(response.status) || attempt === maxAttempts - 1) {
         return response;
       }
@@ -119609,6 +119636,7 @@ var init_modelRouter = __esm({
     init_modelRegistry();
     init_contextMeter();
     init_inferenceUsageRecorder();
+    init_browserSession();
     init_roostUserSelectionClient();
     init_providerModelStep();
     init_toolCallNormalizer();
@@ -129014,10 +129042,10 @@ var require_dist4 = __commonJS({
       }
       return false;
     }
-    function getDefaultPropagationTargets2(supabaseUrl2) {
+    function getDefaultPropagationTargets2(supabaseUrl) {
       const targets = [];
       try {
-        const url = new URL(supabaseUrl2);
+        const url = new URL(supabaseUrl);
         targets.push(url.hostname);
       } catch (error) {
       }
@@ -129083,12 +129111,12 @@ var require_dist4 = __commonJS({
     var resolveHeadersConstructor2 = () => {
       return Headers;
     };
-    var fetchWithAuth2 = (supabaseKey, supabaseUrl2, getAccessToken, customFetch, tracePropagationOptions) => {
+    var fetchWithAuth2 = (supabaseKey, supabaseUrl, getAccessToken, customFetch, tracePropagationOptions) => {
       const fetch$1 = resolveFetch3(customFetch);
       const HeadersConstructor = resolveHeadersConstructor2();
       const traceEnabled = (tracePropagationOptions === null || tracePropagationOptions === void 0 ? void 0 : tracePropagationOptions.enabled) === true;
       const respectSampling = (tracePropagationOptions === null || tracePropagationOptions === void 0 ? void 0 : tracePropagationOptions.respectSamplingDecision) !== false;
-      const traceTargets = traceEnabled ? getDefaultPropagationTargets2(supabaseUrl2) : null;
+      const traceTargets = traceEnabled ? getDefaultPropagationTargets2(supabaseUrl) : null;
       return async (input, init) => {
         var _await$getAccessToken;
         const accessToken = (_await$getAccessToken = await getAccessToken()) !== null && _await$getAccessToken !== void 0 ? _await$getAccessToken : supabaseKey;
@@ -129144,8 +129172,8 @@ var require_dist4 = __commonJS({
       else delete result2.accessToken;
       return result2;
     }
-    function validateSupabaseUrl2(supabaseUrl2) {
-      const trimmedUrl = supabaseUrl2 === null || supabaseUrl2 === void 0 ? void 0 : supabaseUrl2.trim();
+    function validateSupabaseUrl2(supabaseUrl) {
+      const trimmedUrl = supabaseUrl === null || supabaseUrl === void 0 ? void 0 : supabaseUrl.trim();
       if (!trimmedUrl) throw new Error("supabaseUrl is required.");
       if (!trimmedUrl.match(/^https?:\/\//i)) throw new Error("Invalid supabaseUrl: Must be a valid HTTP or HTTPS URL.");
       try {
@@ -129347,11 +129375,11 @@ var require_dist4 = __commonJS({
       * const { data } = await supabase.from('profiles').select('*')
       * ```
       */
-      constructor(supabaseUrl2, supabaseKey, options) {
+      constructor(supabaseUrl, supabaseKey, options) {
         var _settings$auth$storag, _settings$global$head;
-        this.supabaseUrl = supabaseUrl2;
+        this.supabaseUrl = supabaseUrl;
         this.supabaseKey = supabaseKey;
-        const baseUrl = validateSupabaseUrl2(supabaseUrl2);
+        const baseUrl = validateSupabaseUrl2(supabaseUrl);
         if (!supabaseKey) throw new Error("supabaseKey is required.");
         this.realtimeUrl = new URL("realtime/v1", baseUrl);
         this.realtimeUrl.protocol = this.realtimeUrl.protocol.replace("http", "ws");
@@ -129379,7 +129407,7 @@ var require_dist4 = __commonJS({
             throw new Error(`@supabase/supabase-js: Supabase Client is configured with the accessToken option, accessing supabase.auth.${String(prop)} is not possible`);
           } });
         }
-        this.fetch = fetchWithAuth2(supabaseKey, supabaseUrl2, this._getAccessToken.bind(this), settings.global.fetch, settings.tracePropagation);
+        this.fetch = fetchWithAuth2(supabaseKey, supabaseUrl, this._getAccessToken.bind(this), settings.global.fetch, settings.tracePropagation);
         this.realtime = this._initRealtimeClient(_objectSpread24({
           headers: this.headers,
           accessToken: this._getAccessToken.bind(this),
@@ -129563,8 +129591,8 @@ var require_dist4 = __commonJS({
         }
       }
     };
-    var createClient3 = (supabaseUrl2, supabaseKey, options) => {
-      return new SupabaseClient2(supabaseUrl2, supabaseKey, options);
+    var createClient3 = (supabaseUrl, supabaseKey, options) => {
+      return new SupabaseClient2(supabaseUrl, supabaseKey, options);
     };
     function shouldShowDeprecationWarning2() {
       if (typeof window !== "undefined") return false;
@@ -130625,13 +130653,13 @@ var require_createBrowserClient = __commonJS({
     var cookies_1 = require_cookies();
     var warnDeprecatedPackage_1 = require_warnDeprecatedPackage();
     var cachedBrowserClient;
-    function createBrowserClient2(supabaseUrl2, supabaseKey, options) {
+    function createBrowserClient2(supabaseUrl, supabaseKey, options) {
       (0, warnDeprecatedPackage_1.warnIfUsingDeprecatedAuthHelpersPackage)();
       const shouldUseSingleton = options?.isSingleton === true || (!options || !("isSingleton" in options)) && (0, utils_1.isBrowser)();
       if (shouldUseSingleton && cachedBrowserClient) {
         return cachedBrowserClient;
       }
-      if (!supabaseUrl2 || !supabaseKey) {
+      if (!supabaseUrl || !supabaseKey) {
         throw new Error(`@supabase/ssr: Your project's URL and API key are required to create a Supabase client!
 
 Check your Supabase project's API settings to find these values
@@ -130642,7 +130670,7 @@ https://supabase.com/dashboard/project/_/settings/api`);
         ...options,
         cookieEncoding: options?.cookieEncoding ?? "base64url"
       }, false);
-      const client = (0, supabase_js_1.createClient)(supabaseUrl2, supabaseKey, {
+      const client = (0, supabase_js_1.createClient)(supabaseUrl, supabaseKey, {
         // TODO: resolve type error
         ...options,
         global: {
@@ -130678,15 +130706,15 @@ var require_createServerClient = __commonJS({
   "node_modules/@supabase/ssr/dist/main/createServerClient.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.createServerClient = createServerClient2;
+    exports2.createServerClient = createServerClient;
     var supabase_js_1 = require_dist4();
     var version_1 = require_version3();
     var cookies_1 = require_cookies();
     var helpers_1 = require_helpers2();
     var warnDeprecatedPackage_1 = require_warnDeprecatedPackage();
-    function createServerClient2(supabaseUrl2, supabaseKey, options) {
+    function createServerClient(supabaseUrl, supabaseKey, options) {
       (0, warnDeprecatedPackage_1.warnIfUsingDeprecatedAuthHelpersPackage)();
-      if (!supabaseUrl2 || !supabaseKey) {
+      if (!supabaseUrl || !supabaseKey) {
         throw new Error(`Your project's URL and Key are required to create a Supabase client!
 
 Check your Supabase project's API settings to find these values
@@ -130697,7 +130725,7 @@ https://supabase.com/dashboard/project/_/settings/api`);
         ...options,
         cookieEncoding: options?.cookieEncoding ?? "base64url"
       }, true);
-      const client = (0, supabase_js_1.createClient)(supabaseUrl2, supabaseKey, {
+      const client = (0, supabase_js_1.createClient)(supabaseUrl, supabaseKey, {
         // TODO: resolve type error
         ...options,
         global: {
@@ -130776,36 +130804,6 @@ var require_main4 = __commonJS({
   }
 });
 
-// lib/supabase/factory.ts
-function supabaseUrl() {
-  return process.env.NEXT_PUBLIC_SUPABASE_URL;
-}
-function supabaseAnonKey() {
-  return process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
-}
-function authCookieOptions() {
-  const secure = process.env.NODE_ENV === "production";
-  return {
-    cookieOptions: {
-      path: "/",
-      sameSite: "lax",
-      ...secure ? { secure: true } : {}
-    }
-  };
-}
-function createBrowserSupabaseClient() {
-  return (0, import_ssr.createBrowserClient)(supabaseUrl(), supabaseAnonKey(), {
-    isSingleton: true,
-    ...authCookieOptions()
-  });
-}
-var import_ssr;
-var init_factory = __esm({
-  "lib/supabase/factory.ts"() {
-    import_ssr = __toESM(require_main4());
-  }
-});
-
 // lib/supabase/client.ts
 function createClient2() {
   if (!isSupabaseConfigured()) {
@@ -130814,15 +130812,19 @@ function createClient2() {
     );
   }
   if (!browserClient) {
-    browserClient = createBrowserSupabaseClient();
+    browserClient = (0, import_ssr.createBrowserClient)(
+      process.env.NEXT_PUBLIC_SUPABASE_URL,
+      process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
+      { isSingleton: true }
+    );
   }
   return browserClient;
 }
-var browserClient;
+var import_ssr, browserClient;
 var init_client = __esm({
   "lib/supabase/client.ts"() {
+    import_ssr = __toESM(require_main4());
     init_config();
-    init_factory();
   }
 });
 
@@ -223673,6 +223675,12 @@ var init_usageCommand = __esm({
   }
 });
 
+// lib/perch-ai/entitlements.ts
+var init_entitlements = __esm({
+  "lib/perch-ai/entitlements.ts"() {
+  }
+});
+
 // lib/perch-ai/access.ts
 function hasPrivilegedPerchAiRole(memberships) {
   return memberships.some(
@@ -223690,6 +223698,7 @@ function canShowPerchDevTools(membershipRole) {
 }
 var init_access = __esm({
   "lib/perch-ai/access.ts"() {
+    init_entitlements();
   }
 });
 
@@ -234040,111 +234049,6 @@ var init_cliAuthSession = __esm({
   }
 });
 
-// features/perchTerminal/runtime/cliHost/modelConnection.ts
-async function connectCliModelProxy(input = {}) {
-  const storedSession = input.storedSession === void 0 ? await readStoredCliAuthSession() : input.storedSession;
-  const usableStoredSession = isStoredCliAuthSessionUsable(storedSession) ? storedSession : null;
-  const appUrl = resolveCliAppUrl(input.appUrl, usableStoredSession?.appUrl ?? null);
-  if (!appUrl) return noCliModelConnection();
-  if (!usableStoredSession?.accessToken) return noCliModelConnection(appUrl);
-  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") return noCliModelConnection(appUrl);
-  const selection = await fetchPublicModelDefaultSelection(
-    appUrl,
-    fetchImpl,
-    usableStoredSession?.accessToken ?? null
-  );
-  if (!selection) return noCliModelConnection(appUrl);
-  const priorProxy = process.env[MODEL_PROXY_ENV];
-  const priorToken = process.env[MODEL_PROXY_TOKEN_ENV];
-  process.env[MODEL_PROXY_ENV] = appUrl;
-  if (usableStoredSession?.accessToken) {
-    process.env[MODEL_PROXY_TOKEN_ENV] = usableStoredSession.accessToken;
-  }
-  return {
-    appUrl,
-    authenticated: !!usableStoredSession?.accessToken,
-    userId: usableStoredSession?.userId ?? null,
-    email: usableStoredSession?.email ?? null,
-    founderModelSelection: selection,
-    restore: () => {
-      if (priorProxy === void 0) {
-        delete process.env[MODEL_PROXY_ENV];
-      } else {
-        process.env[MODEL_PROXY_ENV] = priorProxy;
-      }
-      if (priorToken === void 0) {
-        delete process.env[MODEL_PROXY_TOKEN_ENV];
-      } else {
-        process.env[MODEL_PROXY_TOKEN_ENV] = priorToken;
-      }
-    }
-  };
-}
-function resolveCliAppUrl(explicit, stored) {
-  const raw = explicit?.trim() || process.env[CLI_APP_URL_ENV]?.trim() || process.env[FALLBACK_APP_URL_ENV]?.trim() || stored?.trim() || DEFAULT_CLI_APP_URL;
-  if (!raw) return null;
-  const withProtocol = /^https?:\/\//i.test(raw) ? raw : `http://${raw}`;
-  try {
-    const url = new URL(withProtocol);
-    url.pathname = url.pathname.replace(/\/+$/, "");
-    url.search = "";
-    url.hash = "";
-    return url.toString().replace(/\/+$/, "");
-  } catch {
-    return null;
-  }
-}
-async function fetchPublicModelDefaultSelection(appUrl, fetchImpl, accessToken) {
-  const url = `${appUrl}/api/perch-terminal/public-model-default`;
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 3500);
-  try {
-    const response = await fetchImpl(url, {
-      method: "GET",
-      headers: {
-        Accept: "application/json",
-        ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {}
-      },
-      signal: controller.signal
-    });
-    if (!response.ok) return null;
-    const body = await response.json();
-    if (!body || typeof body !== "object") return null;
-    const record = body;
-    if (record.ok !== true) return null;
-    return parsePublicModelDefaultPayload({ selection: record.selection }).selection;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-function noCliModelConnection(appUrl = null) {
-  return {
-    appUrl,
-    authenticated: false,
-    userId: null,
-    email: null,
-    founderModelSelection: null,
-    restore: () => {
-    }
-  };
-}
-var MODEL_PROXY_ENV, MODEL_PROXY_TOKEN_ENV, CLI_APP_URL_ENV, FALLBACK_APP_URL_ENV, DEFAULT_CLI_APP_URL;
-var init_modelConnection = __esm({
-  "features/perchTerminal/runtime/cliHost/modelConnection.ts"() {
-    "use strict";
-    init_publicModelDefault();
-    init_cliAuthSession();
-    MODEL_PROXY_ENV = "PERCH_MODEL_CALL_PROXY_URL";
-    MODEL_PROXY_TOKEN_ENV = "PERCH_MODEL_CALL_PROXY_TOKEN";
-    CLI_APP_URL_ENV = "PERCH_CLI_APP_URL";
-    FALLBACK_APP_URL_ENV = "PERCH_APP_URL";
-    DEFAULT_CLI_APP_URL = "https://app.perchai.app";
-  }
-});
-
 // features/perchTerminal/runtime/cliHost/cliStandaloneOAuth.ts
 import { execFile as execFile2 } from "node:child_process";
 import http from "node:http";
@@ -234353,6 +234257,166 @@ var init_cliStandaloneOAuth = __esm({
   }
 });
 
+// features/perchTerminal/runtime/cliHost/cliAuthRefresh.ts
+async function ensureFreshCliAuthSession(input) {
+  const session = input.session;
+  if (!session?.accessToken?.trim()) return null;
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  const stillUsable = !session.expiresAt || session.expiresAt > nowSeconds + 90;
+  if (stillUsable) return session;
+  if (!session.refreshToken?.trim()) return null;
+  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") return null;
+  const appUrl = session.appUrl?.trim();
+  if (!appUrl) return null;
+  const config = await fetchCliAuthConfig(appUrl, fetchImpl).catch(() => ({ ok: false }));
+  if (!config.ok || !config.supabaseUrl || !config.supabaseAnonKey) return null;
+  const supabase = createClient(config.supabaseUrl, config.supabaseAnonKey, {
+    auth: {
+      autoRefreshToken: false,
+      detectSessionInUrl: false,
+      persistSession: false
+    }
+  });
+  try {
+    const { data, error } = await supabase.auth.refreshSession({
+      refresh_token: session.refreshToken
+    });
+    if (error || !data.session) return null;
+    const refreshed = {
+      version: 1,
+      appUrl: session.appUrl,
+      accessToken: data.session.access_token,
+      refreshToken: data.session.refresh_token ?? session.refreshToken,
+      expiresAt: data.session.expires_at ?? null,
+      userId: data.session.user?.id ?? session.userId ?? null,
+      email: data.session.user?.email ?? session.email ?? null,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await writeStoredCliAuthSession(refreshed);
+    return refreshed;
+  } catch {
+    return null;
+  }
+}
+var init_cliAuthRefresh = __esm({
+  "features/perchTerminal/runtime/cliHost/cliAuthRefresh.ts"() {
+    "use strict";
+    init_dist4();
+    init_cliStandaloneOAuth();
+    init_cliAuthSession();
+  }
+});
+
+// features/perchTerminal/runtime/cliHost/modelConnection.ts
+async function connectCliModelProxy(input = {}) {
+  const storedSession = input.storedSession === void 0 ? await readStoredCliAuthSession() : input.storedSession;
+  const usableStoredSession = await ensureFreshCliAuthSession({
+    session: storedSession,
+    fetchImpl: input.fetchImpl
+  });
+  const appUrl = resolveCliAppUrl(input.appUrl, usableStoredSession?.appUrl ?? null);
+  if (!appUrl) return noCliModelConnection();
+  if (!usableStoredSession?.accessToken) return noCliModelConnection(appUrl);
+  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") return noCliModelConnection(appUrl);
+  const selection = await fetchPublicModelDefaultSelection(
+    appUrl,
+    fetchImpl,
+    usableStoredSession?.accessToken ?? null
+  );
+  if (!selection) return noCliModelConnection(appUrl);
+  const priorProxy = process.env[MODEL_PROXY_ENV];
+  const priorToken = process.env[MODEL_PROXY_TOKEN_ENV];
+  process.env[MODEL_PROXY_ENV] = appUrl;
+  if (usableStoredSession?.accessToken) {
+    process.env[MODEL_PROXY_TOKEN_ENV] = usableStoredSession.accessToken;
+  }
+  return {
+    appUrl,
+    authenticated: !!usableStoredSession?.accessToken,
+    userId: usableStoredSession?.userId ?? null,
+    email: usableStoredSession?.email ?? null,
+    founderModelSelection: selection,
+    restore: () => {
+      if (priorProxy === void 0) {
+        delete process.env[MODEL_PROXY_ENV];
+      } else {
+        process.env[MODEL_PROXY_ENV] = priorProxy;
+      }
+      if (priorToken === void 0) {
+        delete process.env[MODEL_PROXY_TOKEN_ENV];
+      } else {
+        process.env[MODEL_PROXY_TOKEN_ENV] = priorToken;
+      }
+    }
+  };
+}
+function resolveCliAppUrl(explicit, stored) {
+  const raw = explicit?.trim() || process.env[CLI_APP_URL_ENV]?.trim() || process.env[FALLBACK_APP_URL_ENV]?.trim() || stored?.trim() || DEFAULT_CLI_APP_URL;
+  if (!raw) return null;
+  const withProtocol = /^https?:\/\//i.test(raw) ? raw : `http://${raw}`;
+  try {
+    const url = new URL(withProtocol);
+    url.pathname = url.pathname.replace(/\/+$/, "");
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+async function fetchPublicModelDefaultSelection(appUrl, fetchImpl, accessToken) {
+  const url = `${appUrl}/api/perch-terminal/public-model-default`;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3500);
+  try {
+    const response = await fetchImpl(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {}
+      },
+      signal: controller.signal
+    });
+    if (!response.ok) return null;
+    const body = await response.json();
+    if (!body || typeof body !== "object") return null;
+    const record = body;
+    if (record.ok !== true) return null;
+    return parsePublicModelDefaultPayload({ selection: record.selection }).selection;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function noCliModelConnection(appUrl = null) {
+  return {
+    appUrl,
+    authenticated: false,
+    userId: null,
+    email: null,
+    founderModelSelection: null,
+    restore: () => {
+    }
+  };
+}
+var MODEL_PROXY_ENV, MODEL_PROXY_TOKEN_ENV, CLI_APP_URL_ENV, FALLBACK_APP_URL_ENV, DEFAULT_CLI_APP_URL;
+var init_modelConnection = __esm({
+  "features/perchTerminal/runtime/cliHost/modelConnection.ts"() {
+    "use strict";
+    init_publicModelDefault();
+    init_cliAuthSession();
+    init_cliAuthRefresh();
+    MODEL_PROXY_ENV = "PERCH_MODEL_CALL_PROXY_URL";
+    MODEL_PROXY_TOKEN_ENV = "PERCH_MODEL_CALL_PROXY_TOKEN";
+    CLI_APP_URL_ENV = "PERCH_CLI_APP_URL";
+    FALLBACK_APP_URL_ENV = "PERCH_APP_URL";
+    DEFAULT_CLI_APP_URL = "https://app.perchai.app";
+  }
+});
+
 // lib/perchTerminal/statusLabels.ts
 function sectionLabel(sectionKey) {
   if (STATUS_LABELS[sectionKey]) return STATUS_LABELS[sectionKey];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "perchai-cli",
-  "version": "2.4.47",
+  "version": "2.4.48",
   "description": "Perch AI command-line interface",
   "bin": {
     "perch": "bin/perch"