perchai-cli 2.4.47 → 2.4.49

package/dist/perch.mjs

@@ -83484,6 +83484,8 @@ Browser Operator skill contract:
 - Prefer browser_execute_task for short multi-step jobs: include the goal, requiredValues, successCriteria, allowSharingChange only when the user explicitly approved access changes, and a bounded steps array.
 - Use semantic browser tools for ordinary controls with text, role, or aria labels.
 - Use browser_visual_click or browser_focus_type for canvas, iframe, document-body, drag/drop, or targets that are visible but not exposed as DOM elements.
+- When a semantic click reports no DOM match, the runner auto-escalates to a coordinate/visual (CUA) click on the same target before failing. Do not re-issue the identical semantic click; if it still fails, escalate yourself with browser_visual_click on the target you can see, then report a blocker only if the coordinate click also fails.
+- For targets behind a menu, dropdown, or kebab/overflow (e.g. Reddit "Mod Tools", a "More" menu): observe \u2192 click the parent menu/trigger to open it \u2192 observe \u2192 then click the now-visible item. Do not click a hidden menu item directly; open its parent first.
 - If coordinate tools are unavailable and the target is only visually reachable, do not loop empty semantic clicks; report the missing visual-action capability.
 - For Google Docs: never inspect, open, or change the Viewing / Editing / Suggesting mode dropdown during normal writing or recovery. New Docs should already start editable. If the visible toolbar is already read-only, Viewing, or Suggesting, stop with a permission/mode blocker instead of trying to switch modes yourself. Collapse Document tabs/outlines if they cover the page, click/type into the visible paper area, and verify with URL/title/save status/screenshot. Do not trust DOM body readback as required proof because Kix can be visually written while DOM snapshots stay blank.
 - Never claim completion from intent alone; require visible proof, save/sent status, URL, receipt, or screenshot evidence.
@@ -83589,17 +83591,20 @@ Rules:
       name: "Browser Operator",
       description: "Operates a logged-in browser turn-by-turn for Quill delivery and web tasks.",
       // Browser work runs on the selected main model. Native vision models see
-      // screenshots directly; text-only models can call the plain vision observer
-      // with visionInspect({ currentScreen: true }) when visual confirmation matters.
+      // screenshots directly; for text-only models the loop automatically runs each
+      // post-action screenshot through the vision sidecar and injects the readout,
+      // so the operator is always sighted. visionInspect({ currentScreen: true })
+      // remains available for targeted follow-up questions.
       lane: "chat",
       systemPrompt: `You are Quill's Browser Operator. You operate the user's logged-in browser like a careful human.
 
 Rules:
 - Drive the browser by looking and acting on what you see by name. Never use remembered IDs, refs, CSS selectors, or raw Playwright tools.
 - Before tool calls, send short live preambles so the user sees steady progress: 1-2 friendly sentences, usually 8-12 words. Group related actions. Examples: "I've created the doc; now opening it to verify the title rendered." / "Email's filled; sending and watching for the confirmation." Final summary stays concise, 10 lines or fewer.
-- Use browser_execute_task for short verified sequences, or browser_navigate, browser_observe, browser_click, browser_type, browser_visual_click, browser_focus_type, browser_press_key, browser_read, browser_wait, and browser_handle_dialog for one-off recovery steps. For browser_click/browser_type, pass a semantic target with text, role, ariaLabel, and optional nth. For browser_visual_click/browser_focus_type, pass screenshot-relative x/y coordinates, usually 0-1 viewport fractions.
+- Use browser_execute_task for short verified sequences, or browser_navigate, browser_observe, browser_click, browser_type, browser_visual_click, browser_focus_type, browser_press_key, browser_read, browser_wait, and browser_handle_dialog for one-off recovery steps. For browser_click/browser_type, pass a semantic target with text, role, ariaLabel, and optional nth. For browser_visual_click/browser_focus_type, ALWAYS pass a label naming the target \u2014 the runner grounds that label against the live DOM (including shadow-DOM web components) and clicks the real element; the x/y you pass is only a last-resort fallback for true canvas/non-DOM targets (e.g. the Google Docs paper). Prefer naming the target over guessing coordinates.
+- To fill a field on a web-component/shadow-DOM site (e.g. Reddit's title/body): browser_visual_click the field to focus it, then browser_type the text \u2014 typing goes into the focused field, so you do not need a semantic target. If a type reports the field is still empty, visual_click the field again to focus it, then retype; do not repeat a type into an unfocused field.
 - One action, then look at the result, then choose the next action. If a click does nothing, observe again and try a different visible target; do not repeat the same failed click more than once.
-- After each action, inspect the fresh browser result before deciding the next action. If you can see an attached screenshot, use it as the source of truth. If you cannot see images and visual details matter, call visionInspect with {"currentScreen": true, "prompt": "what to verify"}.
+- After each action, inspect the fresh browser result before deciding the next action. If you can see an attached screenshot, use it as the source of truth. If the result instead carries a "Vision readout of the current screen" message, a vision sidecar already looked for you \u2014 trust it as the source of truth and use the x/y viewport fractions it names for any browser_visual_click. Only call visionInspect with {"currentScreen": true, "prompt": "..."} when you need a more specific visual question answered.
 - Safety: never click anything that grants access or changes sharing/permissions, such as "Share & send", "Share", or "Grant access". If a share/permission dialog appears, choose the option that sends without changing permissions, such as "Send without sharing" or "Send anyway".
 - Do not claim completion unless the browser shows a confirmation, URL, saved state, sent state, or other visible receipt.
 
@@ -86234,7 +86239,8 @@ var init_desktopContextSection = __esm({
     BROWSER_EXECUTION_GUIDANCE = `## Browser execution \u2014 logged-in web surface
 Use the embedded browser as the logged-in execution surface for web apps, account-bound pages, SPAs, and recovery paths. Google delivery uses verified shortcuts first; non-Google apps and pages without a verified surface tool are browser-first.
 Prefer browser_execute_task for short multi-step browser jobs because it carries the goal, requiredValues, successCriteria, sharing/mode flags, and enforced policy in one guarded runner. Use browser_navigate, browser_observe, browser_click, browser_type, browser_visual_click, browser_focus_type, browser_press_key, and browser_wait for single-step recovery. You already have these tools here; do not spawn browser_operator unless you are explicitly running a coordinator/suite workflow where workers own tools.
-Every browser step returns fresh snapshot text and perception fields. Vision-capable turns also receive one annotated screenshot; successful clicks include clickPoint/bounds so you can verify exactly what changed.
+Every browser step returns fresh snapshot text and perception fields. Vision-capable turns also receive one annotated screenshot; successful clicks include clickPoint/bounds so you can verify exactly what changed. On a text-only model the loop automatically runs each post-action screenshot through the vision sidecar and injects a "Vision readout of the current screen" message \u2014 trust it as the source of truth and use the x/y viewport fractions it names for any browser_visual_click instead of guessing coordinates.
+When a semantic browser_click finds no DOM match, the runner auto-escalates to a coordinate/visual (CUA) click on the same target before returning a failure, so the cursor still moves. Never re-issue the identical semantic click; if it still fails, escalate yourself with browser_visual_click on the visible target, and report a blocker only after the coordinate click also fails. browser_visual_click grounds its label against the live DOM (including shadow-DOM web components) and clicks the real element \u2014 always pass a label; the x/y is only a fallback for true canvas/non-DOM targets. To fill a field on a web-component/shadow-DOM site (e.g. Reddit), browser_visual_click the field to focus it then browser_type the text (typing goes into the focused field; no semantic target needed); if the type reports the field still empty, visual_click it again and retype. For a target behind a menu/dropdown/overflow (e.g. Reddit "Mod Tools"), observe \u2192 click the parent trigger to open the menu \u2192 observe \u2192 then click the now-visible item rather than clicking a hidden item.
 If a verified tool returns needs_operator with a live URL/snapshot/screenshot, continue from that evidence with the browser primitives. If it reports the embedded browser/session is disconnected or unavailable, report that blocker instead of trying raw MCP/Playwright or claiming success. Do not restart the task or dispatch a separate browser worker.`;
   }
 });
@@ -87396,7 +87402,7 @@ var init_threadLedger = __esm({
 });
 
 // features/perchTerminal/runtime/perchMemoryGuidance.ts
-var VISIBLE_OUTPUT_STYLE_GUIDANCE, SAFFRON_STYLE_CONTRACT, QUILL_STYLE_CONTRACT, SAFFRON_CORE_IDENTITY, QUILL_CORE_IDENTITY, PERCH_MEMORY_GUIDANCE;
+var VISIBLE_OUTPUT_STYLE_GUIDANCE, PERCH_OPERATOR_CAPABILITIES, SAFFRON_STYLE_CONTRACT, QUILL_STYLE_CONTRACT, SAFFRON_CORE_IDENTITY, QUILL_CORE_IDENTITY, PERCH_MEMORY_GUIDANCE;
 var init_perchMemoryGuidance = __esm({
   "features/perchTerminal/runtime/perchMemoryGuidance.ts"() {
     "use strict";
@@ -87411,6 +87417,36 @@ Avoid stock AI phrases: "delve," "nuanced," "robust," "seamless,"
 Be concise when the user is moving fast.
 Preserve the persona: Quill is warm, literate, and direct; Saffron is sharp,
 practical, and confident.
+`.trim();
+    PERCH_OPERATOR_CAPABILITIES = `
+## What you can do (and you can do a lot)
+
+You run on the user's Mac through Perch Desktop. You are a real operator, not a
+chat box, and you have the tools to act. When someone asks what you can do, or
+whether you can control their computer, answer with specifics and offer to show
+them rather than listing what you cannot do. You can:
+
+- Run shell commands in folders the user approves, including installing tools and
+  packages, running scripts and software, and starting long jobs in the background.
+- Work across their files: read, write, edit, search with glob and grep, move,
+  and organize anything inside approved folders.
+- Run real analysis in a sealed sandbox: write and execute Python or Node over
+  their actual data.
+- Drive a real browser: navigate, click, type, fill forms, research the web, and
+  pull sources.
+- Deliver finished work: draft and send Gmail, create Google Docs and Sheets, and
+  add calendar events.
+- Do forensic and financial work: AP audits, reconciliations, statement and
+  earnings reviews, and multi-step suites.
+
+Lead with what you can do and offer to prove it, for example "want me to run
+something to show you?". Do not talk yourself down or open with a list of limits.
+
+State the real limits once, and only when they matter: file and command access is
+scoped to the folders the user approves, and commands run under their permission
+settings. You work through the shell, their files, the sandbox, and the browser,
+not through arbitrary macOS system settings or other desktop apps. That is already
+a lot. Show it.
 `.trim();
     SAFFRON_STYLE_CONTRACT = `
 ## Voice contract \u2014 Saffron (visible output only)
@@ -87447,6 +87483,8 @@ You genuinely enjoy finding something interesting buried in a mess.
 
 You're not an assistant. You're the operator who gets the work done.
 
+${PERCH_OPERATOR_CAPABILITIES}
+
 ## How you work
 
 Lead with the finding. Skip the preamble. "Seven duplicate payments, same vendor,
@@ -87577,6 +87615,8 @@ the user needs analysis, files, data, an audit, or delivery, you do that work
 yourself with the same tools \u2014 in your own voice. You never punt real work to
 another persona.
 
+${PERCH_OPERATOR_CAPABILITIES}
+
 ## How you work
 
 Read first. Before you draft a single sentence, you know what the piece is for,
@@ -91108,7 +91148,6 @@ Final answers lead with findings, name artifacts or delivery status, and give on
 var MARKET_DESK_TOOL_NAMES;
 var init_marketDeskAccess = __esm({
   "features/perchTerminal/runtime/marketDesk/marketDeskAccess.ts"() {
-    "use strict";
     init_toolNames();
     MARKET_DESK_TOOL_NAMES = /* @__PURE__ */ new Set([
       TOOL_NAMES.getMarketSignal,
@@ -91788,7 +91827,6 @@ function listFinancialPlaybooks() {
 var AP_AUDIT_PACKET_DEF, PLAYBOOKS;
 var init_registry2 = __esm({
   "features/perchTerminal/runtime/financialPlaybooks/registry.ts"() {
-    "use strict";
     init_managedWorkflowRegistry2();
     init_toolNames();
     AP_AUDIT_PACKET_DEF = {
@@ -92416,6 +92454,297 @@ var init_coreSystemPromptLanes = __esm({
   }
 });
 
+// lib/perchTerminal/appHostGate.ts
+var PERCH_CHAT_WEB_URL, PERCH_MARKETING_SITE_URL, PERCH_MARKETING_DESKTOP_URL, PERCH_MARKETING_CLI_URL, PERCH_CLI_INSTALL_COMMAND;
+var init_appHostGate = __esm({
+  "lib/perchTerminal/appHostGate.ts"() {
+    PERCH_CHAT_WEB_URL = process.env.NEXT_PUBLIC_PERCHAI_WEB_URL?.trim() || "https://chat.perchai.app";
+    PERCH_MARKETING_SITE_URL = process.env.NEXT_PUBLIC_MARKETING_SITE_URL?.trim() || "https://perchai.app";
+    PERCH_MARKETING_DESKTOP_URL = `${PERCH_MARKETING_SITE_URL}/desktop`;
+    PERCH_MARKETING_CLI_URL = `${PERCH_MARKETING_SITE_URL}/cli`;
+    PERCH_CLI_INSTALL_COMMAND = "npm install -g perchai-cli";
+  }
+});
+
+// lib/perch-ai/plan-catalog.ts
+var PERCH_AI_PLAN_CATALOG;
+var init_plan_catalog = __esm({
+  "lib/perch-ai/plan-catalog.ts"() {
+    PERCH_AI_PLAN_CATALOG = [
+      {
+        code: "internal",
+        name: "Internal",
+        description: "Full Perch AI internal/admin access for Perch Terminal operators.",
+        entitlements: {
+          "shell.preview": { enabled: true },
+          "auth.access_codes.redeem": { enabled: true },
+          "desktop.runtime": { enabled: true },
+          "coding.workspace": { enabled: true },
+          "ap.audit": { enabled: true },
+          "writing.studio": { enabled: true },
+          "writing.studio.web": { enabled: true },
+          "admin.console": { enabled: true },
+          "limits.daily_runs": { limit: null },
+          "limits.weekly_runs": { limit: null },
+          "limits.max_context_tokens": { limit: 2e5 },
+          "limits.allowed_models": { models: ["*"] }
+        }
+      },
+      {
+        code: "pilot",
+        name: "Pilot",
+        description: "Self-serve pilot access with full product features.",
+        entitlements: {
+          "shell.preview": { enabled: true },
+          "auth.access_codes.redeem": { enabled: true },
+          "desktop.runtime": { enabled: true },
+          "coding.workspace": { enabled: true },
+          "ap.audit": { enabled: true },
+          "writing.studio": { enabled: true },
+          "writing.studio.web": { enabled: true },
+          // Admin console stays off for self-serve signups (it grants operator/admin
+          // tooling, not a product feature). Flip to true only for trusted accounts.
+          "admin.console": { enabled: false },
+          "limits.daily_runs": { limit: null },
+          "limits.weekly_runs": { limit: null },
+          "limits.max_context_tokens": { limit: 2e5 },
+          "limits.allowed_models": { models: ["*"] }
+        }
+      },
+      {
+        code: "demo",
+        name: "Demo",
+        description: "Restricted demo access for guided evaluations.",
+        entitlements: {
+          "shell.preview": { enabled: true },
+          "auth.access_codes.redeem": { enabled: true },
+          "desktop.runtime": { enabled: false },
+          "coding.workspace": { enabled: false },
+          "ap.audit": { enabled: false },
+          "writing.studio": { enabled: false },
+          "writing.studio.web": { enabled: false },
+          "admin.console": { enabled: false },
+          "limits.daily_runs": { limit: 10 },
+          "limits.weekly_runs": { limit: 30 },
+          "limits.max_context_tokens": { limit: 32e3 },
+          "limits.allowed_models": { models: ["gpt-4o-mini"] }
+        }
+      }
+    ];
+  }
+});
+
+// features/perchTerminal/runtime/roost.ts
+function normalizeRoostTier(value) {
+  if (value === "max") return "pro_max";
+  return isRoostTier(value) ? value : null;
+}
+function normalizeRoostModelChoice(value) {
+  if (value === "internal") return "internal";
+  return normalizeRoostTier(value);
+}
+function isRoostTier(value) {
+  return value === "standard" || value === "standard_max" || value === "pro" || value === "pro_max";
+}
+var ROOST_TIERS, ROOST_TIER_LABELS, ROOST_TIER_CONTEXT_LABELS;
+var init_roost = __esm({
+  "features/perchTerminal/runtime/roost.ts"() {
+    "use strict";
+    init_modelRegistry();
+    ROOST_TIERS = ["standard", "standard_max", "pro", "pro_max"];
+    ROOST_TIER_LABELS = {
+      standard: "Standard",
+      standard_max: "Standard Max",
+      pro: "Pro",
+      pro_max: "Pro Max"
+    };
+    ROOST_TIER_CONTEXT_LABELS = {
+      standard: "200K context",
+      standard_max: "1M context",
+      pro: "200K context",
+      pro_max: "1M context"
+    };
+  }
+});
+
+// lib/perch/perchFactsCore.ts
+function getPilotEntitlements() {
+  const pilot = PERCH_AI_PLAN_CATALOG.find((p) => p.code === "pilot");
+  if (!pilot) return null;
+  return pilot.entitlements;
+}
+function formatUsageLine() {
+  const ent = getPilotEntitlements();
+  if (!ent) return "Usage limits are configured per plan.";
+  const daily = ent["limits.daily_runs"]?.limit;
+  const weekly = ent["limits.weekly_runs"]?.limit;
+  if (daily === null && weekly === null) {
+    return "No credit card is required. Usage is generous for the pilot period. Perch may apply fair-use limits to keep the service reliable for everyone.";
+  }
+  const parts = [];
+  if (daily !== null && daily !== void 0) parts.push(`${daily} runs per day`);
+  if (weekly !== null && weekly !== void 0) parts.push(`${weekly} runs per week`);
+  return `Usage is capped at ${parts.join(" and ")} on this plan. No credit card is required.`;
+}
+function buildRoostTierSummary() {
+  const lines = ROOST_TIERS.map(
+    (tier) => `- ${ROOST_TIER_LABELS[tier]} (${ROOST_TIER_CONTEXT_LABELS[tier]})`
+  );
+  return lines.join("\n");
+}
+function buildWebCapabilityList() {
+  return [
+    "- Grounded answers with real inline citations from your uploaded documents.",
+    "- Upload and ask: PDF, spreadsheet, image, and document analysis.",
+    "- Web search with cited results.",
+    "- Draft citation check: marks each claim verified or unverified.",
+    "",
+    "The web chat does not run shell commands, access your local files, control a browser,",
+    `or operate your computer. Those capabilities live in Perch Terminal (Desktop and CLI).`,
+    `Get Perch Terminal at ${PERCH_MARKETING_DESKTOP_URL}.`
+  ].join("\n");
+}
+function buildTerminalCapabilityList() {
+  const skillLines = DEDUPLICATED_SKILLS.map(
+    (s) => `- ${s.id}: ${s.description}`
+  ).join("\n");
+  return [
+    "Core operator capabilities (available in Desktop and CLI):",
+    "- Run shell commands in folders the user approves.",
+    "- Read, write, edit, search, and organize files across approved folders.",
+    "- Run real analysis in a sealed sandbox: Python and Node over actual data.",
+    "- Drive a real browser: navigate, click, fill forms, research the web.",
+    "- Deliver finished work: draft and send Gmail, create Google Docs and Sheets, add calendar events.",
+    "- Financial and forensic work: AP audits, reconciliations, statement and earnings reviews, multi-step suites.",
+    "",
+    "Specialized skills (activated per task from the skill registry):",
+    skillLines
+  ].join("\n");
+}
+function buildPerchFactsCore(surface) {
+  const capabilitySection = surface === "web" ? `### What this web chat can do
+
+${buildWebCapabilityList()}` : `### What Perch Terminal can do
+
+${buildTerminalCapabilityList()}`;
+  const tierTwoNote = surface === "terminal" ? `
+For deep detail on Perch (per-tier specifics, full workflow matrix, FAQ), consult the "about-perch" skill when a question goes beyond the facts above.` : "";
+  return [
+    INSTRUCTION_PREAMBLE,
+    "",
+    WHAT_IS_PERCH,
+    "",
+    ACCESS_AND_PRICING,
+    "",
+    MODEL_STORY,
+    "",
+    capabilitySection,
+    tierTwoNote
+  ].join("\n").trim();
+}
+var PERCH_SKILL_REGISTRY, DEDUPLICATED_SKILLS, INSTRUCTION_PREAMBLE, WHAT_IS_PERCH, ACCESS_AND_PRICING, MODEL_STORY;
+var init_perchFactsCore = __esm({
+  "lib/perch/perchFactsCore.ts"() {
+    init_appHostGate();
+    init_plan_catalog();
+    init_roost();
+    PERCH_SKILL_REGISTRY = [
+      {
+        id: "workspace",
+        description: "Navigate, inspect, search, summarize, and safely edit local workspaces, attached folders, source inventories, project files, and codebases with exact file-grounded evidence."
+      },
+      {
+        id: "browser-operator",
+        description: "Operate Perch's logged-in browser surface using visual state, semantic DOM targets, and coordinate actions when available."
+      },
+      {
+        id: "research",
+        description: "Gather, compare, rank, and cite evidence from public web sources, scholarly sources, workspace files, source packets, and attached local folders."
+      },
+      {
+        id: "documents",
+        description: "Create, edit, verify, and deliver professional document artifacts such as DOCX, Google Docs, memos, letters, reports, redlines, and formal written deliverables."
+      },
+      {
+        id: "spreadsheets",
+        description: "Create, inspect, clean, calculate, format, and verify spreadsheet artifacts such as XLSX, CSV, TSV, Google Sheets, formulas, pivots, charts, and reconciliation workbooks."
+      },
+      {
+        id: "pdf",
+        description: "Extract, summarize, cite, split, merge, create, inspect, and verify PDF content, including text PDFs, scanned PDFs, tables, forms, page citations, and generated reports."
+      },
+      {
+        id: "presentations",
+        description: "Build executive decks, board decks, sales decks, research summaries, and visual narratives as PPTX or shareable slide artifacts with verified layout and source-backed content."
+      },
+      {
+        id: "data-quality",
+        description: "Profile messy data, find anomalies, reconcile systems, explain exceptions, score risk, and produce audit-ready evidence through deterministic math before narrative."
+      },
+      {
+        id: "diagrams",
+        description: "Create, edit, and verify diagrams, graphs, workflows, org charts, entity networks, control graphs, architecture maps, and evidence-backed visual structures."
+      },
+      {
+        id: "github",
+        description: "Inspect GitHub and git repository state, review commits and pull requests, debug checks, and publish local changes with clear permission boundaries."
+      },
+      {
+        id: "wait-operator",
+        description: "Watch bounded external or local conditions, poll deployment and job status, wait through short-running tasks, and resume with verified state instead of guessing."
+      },
+      {
+        id: "data-quality",
+        description: "Profile messy data, find anomalies, reconcile systems, explain exceptions, score risk, and produce audit-ready evidence through deterministic math before narrative."
+      }
+    ];
+    DEDUPLICATED_SKILLS = Array.from(
+      new Map(PERCH_SKILL_REGISTRY.map((s) => [s.id, s])).values()
+    );
+    INSTRUCTION_PREAMBLE = `## Perch product facts -- authoritative reference
+
+For any question about Perch (what it is, whether it is free, what you can do,
+what model you are, do I need an account, etc.), answer only from the facts
+below. If something is not covered here, say you are not certain rather than
+guessing.`.trim();
+    WHAT_IS_PERCH = `### What Perch is
+
+Perch is an AI platform built around verifiable AI: every claim is sourced and
+checkable. The goal is to make AI output trustworthy, not just fluent.
+
+Perch has three surfaces:
+- Perch AI Web (chat.perchai.app): a warm, accessible web chat for grounded
+  answers, document upload, web search, and citation checking.
+- Perch Terminal Desktop: a local operator that runs on your Mac, controls
+  your files, runs code in a sandbox, drives a real browser, and delivers
+  finished work. Download at ${PERCH_MARKETING_DESKTOP_URL}.
+- Perch Terminal CLI: the same operator power from your terminal.
+  Install with: ${PERCH_CLI_INSTALL_COMMAND}.`.trim();
+    ACCESS_AND_PRICING = `### Access and pricing
+
+All three surfaces are free during the current pilot. No credit card is
+required to sign up.
+
+${formatUsageLine()}
+
+A Perch account is required to use the web chat. Sign up at ${PERCH_CHAT_WEB_URL}.
+Perch Terminal Desktop and CLI are also free; sign in with your Perch account.`.trim();
+    MODEL_STORY = `### The model -- Roost
+
+Perch does not expose raw model names. The model layer is called Roost.
+Roost picks the best available model for each task and locks it for that task.
+You are powered by Roost.
+
+Roost has four tiers:
+${buildRoostTierSummary()}
+
+Standard and Pro use a 200K context window. Standard Max and Pro Max use a 1M
+context window (Max = long context). Tier selection is available in the
+composer. When someone asks what model you are, say: "I run on Roost, Perch's
+model layer. Perch does not surface the underlying model names."`.trim();
+  }
+});
+
 // features/perchTerminal/runtime/context/coreSystemSection.ts
 function buildCoreSystemSection(input) {
   const enabledToolNames = Array.from(new Set(input.enabledToolNames ?? []));
@@ -92442,6 +92771,7 @@ function buildCoreSystemSection(input) {
   });
   const lines = splitRenderedLaneText(renderedCoreLanes);
   const permissionModeHandled = corePromptPermissionModeHandled(renderedCoreLanes);
+  lines.push("", PERCH_FACTS_CORE_TERMINAL);
   if (!permissionModeHandled && input.chatMode === "plan") {
     if (planGateRejected) {
       lines.push(
@@ -92699,7 +93029,7 @@ function buildCoordinatorNotificationSynthesisInstructions(notifications) {
     hasFailure ? "If the error-code is batch_failed, state that the suite failed and that no downstream stages ran." : "If multiple notifications arrived, combine them into one concise synthesis without exposing raw XML."
   ].join("\n");
 }
-var PLATFORM_DELIVERY_GUIDANCE, LIVE_NARRATION_GUIDANCE;
+var PERCH_FACTS_CORE_TERMINAL, PLATFORM_DELIVERY_GUIDANCE, LIVE_NARRATION_GUIDANCE;
 var init_coreSystemSection = __esm({
   "features/perchTerminal/runtime/context/coreSystemSection.ts"() {
     "use strict";
@@ -92715,6 +93045,8 @@ var init_coreSystemSection = __esm({
     init_operatingCaseService();
     init_planModeStateMachine();
     init_coreSystemPromptLanes();
+    init_perchFactsCore();
+    PERCH_FACTS_CORE_TERMINAL = buildPerchFactsCore("terminal");
     PLATFORM_DELIVERY_GUIDANCE = `## Platform delivery \u2014 use the verified shortcut, do not hand off
 You own delivery end-to-end in your own loop. Do NOT dispatch a sub-agent for Gmail, Google Docs, or Calendar \u2014 handing delivery off loses your context and breaks multi-step tasks (e.g. "make a doc AND email it"). Keep one continuous thread: you drafted it, so you deliver it, and you still remember every prior step (recipients, the doc URL you just created, etc.).
 
@@ -92756,6 +93088,45 @@ var init_agentSkillRegistry = __esm({
   "generated/agentSkillRegistry.ts"() {
     "use strict";
     AGENT_SKILL_REGISTRY = [
+      {
+        "id": "about-perch",
+        "name": "about-perch",
+        "description": "Answer detailed questions about Perch the product -- what it is, surfaces, pricing, the Roost model layer, per-tier details, capabilities, web vs Terminal differences, and common user questions. Consult this skill when a Perch product question goes beyond the always-on core facts.",
+        "path": "features/perchTerminal/agentPlatform/skills/about-perch/SKILL.md",
+        "body": "\n# About Perch\n\nUse the facts in this skill to answer any detailed product question about Perch.\nDo not guess. If a fact is not here and not in the always-on core, say you are not certain.\nNever reveal underlying model names. Always refer to the model layer as Roost.\n\nSee SKILL.md for the full product FAQ, web vs Terminal matrix, and per-tier detail.",
+        "surface": {
+          "gui": "supported",
+          "cli": "supported"
+        },
+        "triggerHints": [
+          "what is perch",
+          "what can you do",
+          "what model are you",
+          "is this free",
+          "is perch free",
+          "is terminal free",
+          "is terminal paid",
+          "do i need an account",
+          "roost",
+          "roost tier",
+          "standard max",
+          "pro max",
+          "perch terminal",
+          "perch desktop",
+          "perch cli",
+          "perch vs",
+          "web vs terminal",
+          "difference between perch",
+          "how does perch work",
+          "citation verifier",
+          "what is roost"
+        ],
+        "companionSkills": [
+          "research",
+          "workspace"
+        ],
+        "preferredTools": []
+      },
       {
         "id": "browser-operator",
         "name": "browser-operator",
@@ -93407,7 +93778,8 @@ var init_skillSelector = __esm({
       "diagrams",
       "workspace",
       "browser-operator",
-      "skill-creator"
+      "skill-creator",
+      "about-perch"
     ];
     INTENT_PATTERNS = {
       "browser-operator": [
@@ -93459,6 +93831,10 @@ var init_skillSelector = __esm({
       ],
       "skill-creator": [
         /\b(skill\s+creator|create\s+(?:a\s+)?skill|skill\.md|agent\s+skill|skill\s+validation|trigger\s+collision|skill\s+test|skill\s+authoring|perch\s+skill)\b/i
+      ],
+      "about-perch": [
+        /\b(what\s+(is|are)\s+perch|what\s+can\s+you\s+do|what\s+model\s+are\s+you|is\s+(this|perch|terminal|it)\s+free|is\s+terminal\s+paid|do\s+i\s+need\s+an\s+account|account\s+required|roost\s+(tier|model|layer)|standard\s+max|pro\s+max|perch\s+terminal|perch\s+desktop|perch\s+cli|web\s+vs\s+terminal|how\s+does\s+perch\s+work|citation\s+verifier|what\s+is\s+roost)\b/i,
+        /\b(tell\s+me\s+about\s+perch|about\s+perch|perch\s+pricing|perch\s+product|perch\s+features?|how\s+much\s+does\s+perch\s+cost)\b/i
       ]
     };
   }
@@ -115612,10 +115988,10 @@ function matchStringTarget(hostname, target) {
   }
   return false;
 }
-function getDefaultPropagationTargets(supabaseUrl2) {
+function getDefaultPropagationTargets(supabaseUrl) {
   const targets = [];
   try {
-    const url = new URL(supabaseUrl2);
+    const url = new URL(supabaseUrl);
     targets.push(url.hostname);
   } catch (error) {
   }
@@ -115712,8 +116088,8 @@ function applySettingDefaults(options, defaults) {
   else delete result2.accessToken;
   return result2;
 }
-function validateSupabaseUrl(supabaseUrl2) {
-  const trimmedUrl = supabaseUrl2 === null || supabaseUrl2 === void 0 ? void 0 : supabaseUrl2.trim();
+function validateSupabaseUrl(supabaseUrl) {
+  const trimmedUrl = supabaseUrl === null || supabaseUrl === void 0 ? void 0 : supabaseUrl.trim();
   if (!trimmedUrl) throw new Error("supabaseUrl is required.");
   if (!trimmedUrl.match(/^https?:\/\//i)) throw new Error("Invalid supabaseUrl: Must be a valid HTTP or HTTPS URL.");
   try {
@@ -115771,12 +116147,12 @@ var init_dist4 = __esm({
     resolveHeadersConstructor = () => {
       return Headers;
     };
-    fetchWithAuth = (supabaseKey, supabaseUrl2, getAccessToken, customFetch, tracePropagationOptions) => {
+    fetchWithAuth = (supabaseKey, supabaseUrl, getAccessToken, customFetch, tracePropagationOptions) => {
       const fetch$1 = resolveFetch2(customFetch);
       const HeadersConstructor = resolveHeadersConstructor();
       const traceEnabled = (tracePropagationOptions === null || tracePropagationOptions === void 0 ? void 0 : tracePropagationOptions.enabled) === true;
       const respectSampling = (tracePropagationOptions === null || tracePropagationOptions === void 0 ? void 0 : tracePropagationOptions.respectSamplingDecision) !== false;
-      const traceTargets = traceEnabled ? getDefaultPropagationTargets(supabaseUrl2) : null;
+      const traceTargets = traceEnabled ? getDefaultPropagationTargets(supabaseUrl) : null;
       return async (input, init) => {
         var _await$getAccessToken;
         const accessToken = (_await$getAccessToken = await getAccessToken()) !== null && _await$getAccessToken !== void 0 ? _await$getAccessToken : supabaseKey;
@@ -115987,11 +116363,11 @@ var init_dist4 = __esm({
       * const { data } = await supabase.from('profiles').select('*')
       * ```
       */
-      constructor(supabaseUrl2, supabaseKey, options) {
+      constructor(supabaseUrl, supabaseKey, options) {
         var _settings$auth$storag, _settings$global$head;
-        this.supabaseUrl = supabaseUrl2;
+        this.supabaseUrl = supabaseUrl;
         this.supabaseKey = supabaseKey;
-        const baseUrl = validateSupabaseUrl(supabaseUrl2);
+        const baseUrl = validateSupabaseUrl(supabaseUrl);
         if (!supabaseKey) throw new Error("supabaseKey is required.");
         this.realtimeUrl = new URL("realtime/v1", baseUrl);
         this.realtimeUrl.protocol = this.realtimeUrl.protocol.replace("http", "ws");
@@ -116019,7 +116395,7 @@ var init_dist4 = __esm({
             throw new Error(`@supabase/supabase-js: Supabase Client is configured with the accessToken option, accessing supabase.auth.${String(prop)} is not possible`);
           } });
         }
-        this.fetch = fetchWithAuth(supabaseKey, supabaseUrl2, this._getAccessToken.bind(this), settings.global.fetch, settings.tracePropagation);
+        this.fetch = fetchWithAuth(supabaseKey, supabaseUrl, this._getAccessToken.bind(this), settings.global.fetch, settings.tracePropagation);
         this.realtime = this._initRealtimeClient(_objectSpread23({
           headers: this.headers,
           accessToken: this._getAccessToken.bind(this),
@@ -116203,8 +116579,8 @@ var init_dist4 = __esm({
         }
       }
     };
-    createClient = (supabaseUrl2, supabaseKey, options) => {
-      return new SupabaseClient(supabaseUrl2, supabaseKey, options);
+    createClient = (supabaseUrl, supabaseKey, options) => {
+      return new SupabaseClient(supabaseUrl, supabaseKey, options);
     };
     if (shouldShowDeprecationWarning()) console.warn("\u26A0\uFE0F  Node.js 18 and below are deprecated and will no longer be supported in future versions of @supabase/supabase-js. Please upgrade to Node.js 20 or later. For more information, visit: https://github.com/orgs/supabase/discussions/37217");
   }
@@ -119113,28 +119489,20 @@ var init_autoRouter = __esm({
   }
 });
 
-// features/perchTerminal/runtime/roost.ts
-function normalizeRoostTier(value) {
-  if (value === "max") return "pro_max";
-  return isRoostTier(value) ? value : null;
-}
-function normalizeRoostModelChoice(value) {
-  if (value === "internal") return "internal";
-  return normalizeRoostTier(value);
-}
-function isRoostTier(value) {
-  return value === "standard" || value === "standard_max" || value === "pro" || value === "pro_max";
+// lib/auth/browserSession.ts
+async function syncBrowserAuthSession() {
+  if (typeof window === "undefined") return null;
+  const response = await fetch("/api/auth/session", SESSION_FETCH_OPTIONS);
+  if (!response.ok) return null;
+  const body = await response.json();
+  return body.session ?? null;
 }
-var ROOST_TIER_LABELS;
-var init_roost = __esm({
-  "features/perchTerminal/runtime/roost.ts"() {
-    "use strict";
-    init_modelRegistry();
-    ROOST_TIER_LABELS = {
-      standard: "Standard",
-      standard_max: "Standard Max",
-      pro: "Pro",
-      pro_max: "Pro Max"
+var SESSION_FETCH_OPTIONS;
+var init_browserSession = __esm({
+  "lib/auth/browserSession.ts"() {
+    SESSION_FETCH_OPTIONS = {
+      credentials: "same-origin",
+      cache: "no-store"
     };
   }
 });
@@ -119178,6 +119546,507 @@ var init_roostUserSelectionClient = __esm({
   }
 });
 
+// features/perchTerminal/runtime/cliHost/cliAuthSession.ts
+var cliAuthSession_exports = {};
+__export(cliAuthSession_exports, {
+  clearStoredCliAuthSession: () => clearStoredCliAuthSession,
+  isStoredCliAuthSessionUsable: () => isStoredCliAuthSessionUsable,
+  parseStoredCliAuthSession: () => parseStoredCliAuthSession,
+  readStoredCliAuthSession: () => readStoredCliAuthSession,
+  writeStoredCliAuthSession: () => writeStoredCliAuthSession
+});
+import { execFile } from "node:child_process";
+import fs9 from "node:fs/promises";
+import os from "node:os";
+import path10 from "node:path";
+import { promisify } from "node:util";
+async function readStoredCliAuthSession() {
+  const raw = shouldUseFallbackAuthFile() ? await readFallbackSecret().catch(() => null) : process.platform === "darwin" ? await readKeychainSecret().catch(() => null) : await readFallbackSecret().catch(() => null);
+  return parseStoredCliAuthSession(raw);
+}
+async function writeStoredCliAuthSession(session) {
+  const raw = JSON.stringify(session);
+  if (process.platform === "darwin" && !shouldUseFallbackAuthFile()) {
+    await execFileAsync("security", [
+      "add-generic-password",
+      "-U",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      KEYCHAIN_ACCOUNT,
+      "-w",
+      raw
+    ]);
+    return;
+  }
+  await writeFallbackSecret(raw);
+}
+async function clearStoredCliAuthSession() {
+  if (process.platform === "darwin" && !shouldUseFallbackAuthFile()) {
+    await execFileAsync("security", [
+      "delete-generic-password",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      KEYCHAIN_ACCOUNT
+    ]).catch(() => void 0);
+    return;
+  }
+  await fs9.rm(fallbackSessionPath(), { force: true }).catch(() => void 0);
+}
+function shouldUseFallbackAuthFile() {
+  return Boolean(process.env.PERCH_CLI_AUTH_DIR?.trim());
+}
+function isStoredCliAuthSessionUsable(session, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!session?.accessToken?.trim()) return false;
+  if (!session.appUrl?.trim()) return false;
+  if (!session.expiresAt) return true;
+  return session.expiresAt > nowSeconds + 90;
+}
+function parseStoredCliAuthSession(raw) {
+  if (!raw?.trim()) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1) return null;
+    if (!parsed.appUrl || !parsed.accessToken || !parsed.updatedAt) return null;
+    return {
+      version: 1,
+      appUrl: parsed.appUrl,
+      accessToken: parsed.accessToken,
+      refreshToken: parsed.refreshToken ?? null,
+      expiresAt: typeof parsed.expiresAt === "number" ? parsed.expiresAt : null,
+      userId: parsed.userId ?? null,
+      email: parsed.email ?? null,
+      updatedAt: parsed.updatedAt
+    };
+  } catch {
+    return null;
+  }
+}
+async function readKeychainSecret() {
+  const { stdout } = await execFileAsync("security", [
+    "find-generic-password",
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-a",
+    KEYCHAIN_ACCOUNT,
+    "-w"
+  ]);
+  return stdout.trim() || null;
+}
+function fallbackSessionPath() {
+  const base = process.env.PERCH_CLI_AUTH_DIR?.trim() || path10.join(os.homedir(), ".perch");
+  return path10.join(base, "cli-auth-session.json");
+}
+async function readFallbackSecret() {
+  return await fs9.readFile(fallbackSessionPath(), "utf8");
+}
+async function writeFallbackSecret(raw) {
+  const filePath = fallbackSessionPath();
+  await fs9.mkdir(path10.dirname(filePath), { recursive: true, mode: 448 });
+  await fs9.writeFile(filePath, raw, { mode: 384 });
+}
+var execFileAsync, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT;
+var init_cliAuthSession = __esm({
+  "features/perchTerminal/runtime/cliHost/cliAuthSession.ts"() {
+    "use strict";
+    execFileAsync = promisify(execFile);
+    KEYCHAIN_SERVICE = "app.perchai.cli-auth";
+    KEYCHAIN_ACCOUNT = "default";
+  }
+});
+
+// features/perchTerminal/runtime/publicModelDefault.ts
+function parsePublicModelDefaultPayload(value) {
+  const raw = value && typeof value === "object" ? value : {};
+  const selection = sanitizeFounderModelSelection(
+    raw.selection ?? DEFAULT_FOUNDER_MODEL_SELECTION
+  );
+  return {
+    selection,
+    updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : null,
+    updatedBy: typeof raw.updatedBy === "string" ? raw.updatedBy : null
+  };
+}
+var init_publicModelDefault = __esm({
+  "features/perchTerminal/runtime/publicModelDefault.ts"() {
+    "use strict";
+    init_modelRegistry();
+  }
+});
+
+// features/perchTerminal/runtime/cliHost/modelConnection.ts
+async function connectCliModelProxy(input = {}) {
+  const storedSession = input.storedSession === void 0 ? await readStoredCliAuthSession() : input.storedSession;
+  const usableStoredSession = await ensureFreshCliAuthSession({
+    session: storedSession,
+    fetchImpl: input.fetchImpl
+  });
+  const appUrl = resolveCliAppUrl(input.appUrl, usableStoredSession?.appUrl ?? null);
+  if (!appUrl) return noCliModelConnection();
+  if (!usableStoredSession?.accessToken) return noCliModelConnection(appUrl);
+  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") return noCliModelConnection(appUrl);
+  const selection = await fetchPublicModelDefaultSelection(
+    appUrl,
+    fetchImpl,
+    usableStoredSession?.accessToken ?? null
+  );
+  if (!selection) return noCliModelConnection(appUrl);
+  const priorProxy = process.env[MODEL_PROXY_ENV];
+  const priorToken = process.env[MODEL_PROXY_TOKEN_ENV];
+  process.env[MODEL_PROXY_ENV] = appUrl;
+  if (usableStoredSession?.accessToken) {
+    process.env[MODEL_PROXY_TOKEN_ENV] = usableStoredSession.accessToken;
+  }
+  return {
+    appUrl,
+    authenticated: !!usableStoredSession?.accessToken,
+    userId: usableStoredSession?.userId ?? null,
+    email: usableStoredSession?.email ?? null,
+    founderModelSelection: selection,
+    restore: () => {
+      if (priorProxy === void 0) {
+        delete process.env[MODEL_PROXY_ENV];
+      } else {
+        process.env[MODEL_PROXY_ENV] = priorProxy;
+      }
+      if (priorToken === void 0) {
+        delete process.env[MODEL_PROXY_TOKEN_ENV];
+      } else {
+        process.env[MODEL_PROXY_TOKEN_ENV] = priorToken;
+      }
+    }
+  };
+}
+function resolveCliAppUrl(explicit, stored) {
+  const raw = explicit?.trim() || process.env[CLI_APP_URL_ENV]?.trim() || process.env[FALLBACK_APP_URL_ENV]?.trim() || stored?.trim() || DEFAULT_CLI_APP_URL;
+  if (!raw) return null;
+  const withProtocol = /^https?:\/\//i.test(raw) ? raw : `http://${raw}`;
+  try {
+    const url = new URL(withProtocol);
+    url.pathname = url.pathname.replace(/\/+$/, "");
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+async function fetchPublicModelDefaultSelection(appUrl, fetchImpl, accessToken) {
+  const url = `${appUrl}/api/perch-terminal/public-model-default`;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3500);
+  try {
+    const response = await fetchImpl(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {}
+      },
+      signal: controller.signal
+    });
+    if (!response.ok) return null;
+    const body = await response.json();
+    if (!body || typeof body !== "object") return null;
+    const record = body;
+    if (record.ok !== true) return null;
+    return parsePublicModelDefaultPayload({ selection: record.selection }).selection;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function noCliModelConnection(appUrl = null) {
+  return {
+    appUrl,
+    authenticated: false,
+    userId: null,
+    email: null,
+    founderModelSelection: null,
+    restore: () => {
+    }
+  };
+}
+var MODEL_PROXY_ENV, MODEL_PROXY_TOKEN_ENV, CLI_APP_URL_ENV, FALLBACK_APP_URL_ENV, DEFAULT_CLI_APP_URL;
+var init_modelConnection = __esm({
+  "features/perchTerminal/runtime/cliHost/modelConnection.ts"() {
+    "use strict";
+    init_publicModelDefault();
+    init_cliAuthSession();
+    init_cliAuthRefresh();
+    MODEL_PROXY_ENV = "PERCH_MODEL_CALL_PROXY_URL";
+    MODEL_PROXY_TOKEN_ENV = "PERCH_MODEL_CALL_PROXY_TOKEN";
+    CLI_APP_URL_ENV = "PERCH_CLI_APP_URL";
+    FALLBACK_APP_URL_ENV = "PERCH_APP_URL";
+    DEFAULT_CLI_APP_URL = "https://app.perchai.app";
+  }
+});
+
+// features/perchTerminal/runtime/cliHost/cliStandaloneOAuth.ts
+import { execFile as execFile2 } from "node:child_process";
+import http from "node:http";
+import { promisify as promisify2 } from "node:util";
+async function runCliStandaloneOAuthLogin(input) {
+  const appUrl = resolveCliAppUrl(input.appUrl, null);
+  if (!appUrl) {
+    return { ok: false, code: "invalid_app_url", error: "Invalid Perch app URL." };
+  }
+  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    return { ok: false, code: "fetch_unavailable", error: "This Node runtime does not expose fetch." };
+  }
+  const config = await fetchCliAuthConfig(appUrl, fetchImpl);
+  if (!config.ok || !config.supabaseUrl || !config.supabaseAnonKey) {
+    return {
+      ok: false,
+      code: "auth_config_unavailable",
+      error: "The Perch app did not return CLI auth configuration."
+    };
+  }
+  const provider = selectOAuthProvider(config.providers ?? [], input.provider);
+  if (!provider) {
+    return {
+      ok: false,
+      code: "oauth_provider_unavailable",
+      error: "No supported CLI OAuth provider is enabled for this Perch app."
+    };
+  }
+  const callback = await createOAuthCallbackServer({
+    host: config.redirectHost?.trim() || "127.0.0.1",
+    timeoutMs: input.timeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS
+  });
+  try {
+    const memoryStorage = createMemoryAuthStorage();
+    const supabase = createClient(config.supabaseUrl, config.supabaseAnonKey, {
+      auth: {
+        flowType: "pkce",
+        autoRefreshToken: false,
+        detectSessionInUrl: false,
+        persistSession: true,
+        storage: memoryStorage
+      }
+    });
+    const { data, error } = await supabase.auth.signInWithOAuth({
+      provider,
+      options: {
+        redirectTo: callback.redirectTo,
+        skipBrowserRedirect: true,
+        data: { signup_source: "cli" }
+      }
+    });
+    if (error || !data.url) {
+      return {
+        ok: false,
+        code: "oauth_start_failed",
+        error: error?.message ?? "Supabase did not return an OAuth URL."
+      };
+    }
+    await (input.openExternal ?? openExternal)(data.url);
+    const callbackResult = await callback.waitForCode();
+    if (!callbackResult.ok) {
+      return callbackResult;
+    }
+    const exchanged = await supabase.auth.exchangeCodeForSession(callbackResult.code);
+    if (exchanged.error || !exchanged.data.session) {
+      return {
+        ok: false,
+        code: "oauth_exchange_failed",
+        error: exchanged.error?.message ?? "Supabase did not return a CLI session."
+      };
+    }
+    const session = storedSessionFromSupabaseSession({
+      appUrl,
+      accessToken: exchanged.data.session.access_token,
+      refreshToken: exchanged.data.session.refresh_token,
+      expiresAt: exchanged.data.session.expires_at ?? null,
+      userId: exchanged.data.session.user.id,
+      email: exchanged.data.session.user.email ?? null
+    });
+    await writeStoredCliAuthSession(session);
+    return { ok: true, session };
+  } finally {
+    await callback.close();
+  }
+}
+async function fetchCliAuthConfig(appUrl, fetchImpl = globalThis.fetch) {
+  const response = await fetchImpl(`${appUrl}/api/perch-terminal/cli-auth/config`, {
+    method: "GET",
+    headers: { Accept: "application/json" }
+  });
+  if (!response.ok) return { ok: false };
+  return await response.json();
+}
+function selectOAuthProvider(providers, preferred) {
+  const available = new Set(providers);
+  if (preferred && available.has(preferred)) return preferred;
+  if (available.has("google")) return "google";
+  if (available.has("github")) return "github";
+  return null;
+}
+function storedSessionFromSupabaseSession(input) {
+  return {
+    version: 1,
+    appUrl: input.appUrl,
+    accessToken: input.accessToken,
+    refreshToken: input.refreshToken ?? null,
+    expiresAt: input.expiresAt ?? null,
+    userId: input.userId ?? null,
+    email: input.email ?? null,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function createMemoryAuthStorage() {
+  const values2 = /* @__PURE__ */ new Map();
+  return {
+    getItem: (key) => values2.get(key) ?? null,
+    setItem: (key, value) => {
+      values2.set(key, value);
+    },
+    removeItem: (key) => {
+      values2.delete(key);
+    }
+  };
+}
+async function createOAuthCallbackServer(input) {
+  let resolveResult = null;
+  const resultPromise = new Promise((resolve5) => {
+    resolveResult = resolve5;
+  });
+  const server = http.createServer((request, response) => {
+    const requestUrl = new URL(request.url ?? "/", `http://${input.host}`);
+    if (requestUrl.pathname !== CALLBACK_PATH) {
+      response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+      response.end("Not found");
+      return;
+    }
+    const code = requestUrl.searchParams.get("code");
+    const error = requestUrl.searchParams.get("error_description") ?? requestUrl.searchParams.get("error");
+    if (!code) {
+      response.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+      response.end(renderCallbackHtml(false));
+      resolveResult?.({
+        ok: false,
+        code: "oauth_callback_missing_code",
+        error: error ?? "OAuth callback did not include a code."
+      });
+      resolveResult = null;
+      return;
+    }
+    response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    response.end(renderCallbackHtml(true));
+    resolveResult?.({ ok: true, code });
+    resolveResult = null;
+  });
+  await new Promise((resolve5, reject2) => {
+    server.once("error", reject2);
+    server.listen(0, input.host, () => {
+      server.off("error", reject2);
+      resolve5();
+    });
+  });
+  const address = server.address();
+  const redirectTo = `http://${input.host}:${address.port}${CALLBACK_PATH}`;
+  const timeout = setTimeout(() => {
+    resolveResult?.({
+      ok: false,
+      code: "oauth_timeout",
+      error: "Timed out waiting for browser sign-in to complete."
+    });
+    resolveResult = null;
+  }, input.timeoutMs);
+  return {
+    redirectTo,
+    waitForCode: async () => resultPromise,
+    close: async () => {
+      clearTimeout(timeout);
+      await new Promise((resolve5) => server.close(() => resolve5()));
+    }
+  };
+}
+function renderCallbackHtml(ok) {
+  const title = ok ? "Perch CLI signed in" : "Perch CLI sign-in failed";
+  const message = ok ? "You can close this tab and return to your terminal." : "Return to your terminal and try again.";
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body style="font-family:system-ui;padding:32px;background:#100d0b;color:#fff8f0"><h1>${title}</h1><p>${message}</p></body></html>`;
+}
+async function openExternal(url) {
+  if (process.platform === "darwin") {
+    await execFileAsync2("open", [url]);
+  } else if (process.platform === "win32") {
+    await execFileAsync2("cmd", ["/c", "start", "", url]);
+  } else {
+    await execFileAsync2("xdg-open", [url]);
+  }
+}
+var execFileAsync2, DEFAULT_LOGIN_TIMEOUT_MS, CALLBACK_PATH;
+var init_cliStandaloneOAuth = __esm({
+  "features/perchTerminal/runtime/cliHost/cliStandaloneOAuth.ts"() {
+    "use strict";
+    init_dist4();
+    init_modelConnection();
+    init_cliAuthSession();
+    execFileAsync2 = promisify2(execFile2);
+    DEFAULT_LOGIN_TIMEOUT_MS = 12e4;
+    CALLBACK_PATH = "/callback";
+  }
+});
+
+// features/perchTerminal/runtime/cliHost/cliAuthRefresh.ts
+var cliAuthRefresh_exports = {};
+__export(cliAuthRefresh_exports, {
+  ensureFreshCliAuthSession: () => ensureFreshCliAuthSession
+});
+async function ensureFreshCliAuthSession(input) {
+  const session = input.session;
+  if (!session?.accessToken?.trim()) return null;
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  const stillUsable = !session.expiresAt || session.expiresAt > nowSeconds + 90;
+  if (stillUsable && !input.forceRefresh) return session;
+  if (!session.refreshToken?.trim()) return null;
+  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") return null;
+  const appUrl = session.appUrl?.trim();
+  if (!appUrl) return null;
+  const config = await fetchCliAuthConfig(appUrl, fetchImpl).catch(() => ({ ok: false }));
+  if (!config.ok || !config.supabaseUrl || !config.supabaseAnonKey) return null;
+  const supabase = createClient(config.supabaseUrl, config.supabaseAnonKey, {
+    auth: {
+      autoRefreshToken: false,
+      detectSessionInUrl: false,
+      persistSession: false
+    }
+  });
+  try {
+    const { data, error } = await supabase.auth.refreshSession({
+      refresh_token: session.refreshToken
+    });
+    if (error || !data.session) return null;
+    const refreshed = {
+      version: 1,
+      appUrl: session.appUrl,
+      accessToken: data.session.access_token,
+      refreshToken: data.session.refresh_token ?? session.refreshToken,
+      expiresAt: data.session.expires_at ?? null,
+      userId: data.session.user?.id ?? session.userId ?? null,
+      email: data.session.user?.email ?? session.email ?? null,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await writeStoredCliAuthSession(refreshed);
+    return refreshed;
+  } catch {
+    return null;
+  }
+}
+var init_cliAuthRefresh = __esm({
+  "features/perchTerminal/runtime/cliHost/cliAuthRefresh.ts"() {
+    "use strict";
+    init_dist4();
+    init_cliStandaloneOAuth();
+    init_cliAuthSession();
+  }
+});
+
 // features/perchTerminal/runtime/modelRouter.ts
 function roostUserSelectionBodyFields() {
   const selection = getEffectiveRoostUserSelection();
@@ -119470,23 +120339,59 @@ async function callModelRouterViaServer(request, opts, endpoint = "/api/perch-te
     durationMs: 0
   };
 }
+async function syncModelProxyAuthAfter401() {
+  if (typeof globalThis.window !== "undefined") {
+    await syncBrowserAuthSession();
+    return null;
+  }
+  const { readStoredCliAuthSession: readStoredCliAuthSession2 } = await Promise.resolve().then(() => (init_cliAuthSession(), cliAuthSession_exports));
+  const { ensureFreshCliAuthSession: ensureFreshCliAuthSession2 } = await Promise.resolve().then(() => (init_cliAuthRefresh(), cliAuthRefresh_exports));
+  const fresh = await ensureFreshCliAuthSession2({
+    session: await readStoredCliAuthSession2(),
+    forceRefresh: true
+  });
+  if (!fresh?.accessToken?.trim()) return null;
+  if (typeof process !== "undefined") {
+    process.env[MODEL_CALL_PROXY_TOKEN_ENV] = fresh.accessToken;
+  }
+  return fresh.accessToken;
+}
+function withModelProxyAuthHeader(init, token) {
+  if (!token?.trim()) return init;
+  const headers = new Headers(init.headers);
+  headers.set("Authorization", `Bearer ${token}`);
+  return { ...init, headers };
+}
 async function fetchModelProxyWithRetry(endpoint, init, options) {
   const maxAttempts = Math.max(1, options?.maxAttempts ?? MODEL_PROXY_MAX_ATTEMPTS);
   let lastError = null;
+  let authSynced = false;
+  let requestInit = init;
   for (let attempt = 0; attempt < maxAttempts; attempt++) {
     try {
-      const response = await fetch(endpoint, init);
+      const response = await fetch(endpoint, requestInit);
+      if (response.status === 401 && !authSynced) {
+        authSynced = true;
+        const refreshedToken = await syncModelProxyAuthAfter401();
+        if (refreshedToken) {
+          requestInit = withModelProxyAuthHeader(requestInit, refreshedToken);
+        }
+        options?.onRetry?.(attempt, "HTTP 401 (session sync)");
+        await response.body?.cancel().catch(() => void 0);
+        await waitForModelProxyRetry(attempt, requestInit.signal);
+        continue;
+      }
       if (!isRetriableModelProxyStatus(response.status) || attempt === maxAttempts - 1) {
         return response;
       }
       options?.onRetry?.(attempt, `HTTP ${response.status}`);
       await response.body?.cancel().catch(() => void 0);
-      await waitForModelProxyRetry(attempt, init.signal);
+      await waitForModelProxyRetry(attempt, requestInit.signal);
     } catch (error) {
       if (isAbortLikeError(error) || attempt === maxAttempts - 1) throw error;
       lastError = error;
       options?.onRetry?.(attempt, error instanceof Error ? error.message : String(error));
-      await waitForModelProxyRetry(attempt, init.signal);
+      await waitForModelProxyRetry(attempt, requestInit.signal);
     }
   }
   throw lastError instanceof Error ? lastError : new Error(String(lastError ?? "Model proxy request failed"));
@@ -119609,6 +120514,7 @@ var init_modelRouter = __esm({
     init_modelRegistry();
     init_contextMeter();
     init_inferenceUsageRecorder();
+    init_browserSession();
     init_roostUserSelectionClient();
     init_providerModelStep();
     init_toolCallNormalizer();
@@ -129014,10 +129920,10 @@ var require_dist4 = __commonJS({
       }
       return false;
     }
-    function getDefaultPropagationTargets2(supabaseUrl2) {
+    function getDefaultPropagationTargets2(supabaseUrl) {
       const targets = [];
       try {
-        const url = new URL(supabaseUrl2);
+        const url = new URL(supabaseUrl);
         targets.push(url.hostname);
       } catch (error) {
       }
@@ -129083,12 +129989,12 @@ var require_dist4 = __commonJS({
     var resolveHeadersConstructor2 = () => {
       return Headers;
     };
-    var fetchWithAuth2 = (supabaseKey, supabaseUrl2, getAccessToken, customFetch, tracePropagationOptions) => {
+    var fetchWithAuth2 = (supabaseKey, supabaseUrl, getAccessToken, customFetch, tracePropagationOptions) => {
       const fetch$1 = resolveFetch3(customFetch);
       const HeadersConstructor = resolveHeadersConstructor2();
       const traceEnabled = (tracePropagationOptions === null || tracePropagationOptions === void 0 ? void 0 : tracePropagationOptions.enabled) === true;
       const respectSampling = (tracePropagationOptions === null || tracePropagationOptions === void 0 ? void 0 : tracePropagationOptions.respectSamplingDecision) !== false;
-      const traceTargets = traceEnabled ? getDefaultPropagationTargets2(supabaseUrl2) : null;
+      const traceTargets = traceEnabled ? getDefaultPropagationTargets2(supabaseUrl) : null;
       return async (input, init) => {
         var _await$getAccessToken;
         const accessToken = (_await$getAccessToken = await getAccessToken()) !== null && _await$getAccessToken !== void 0 ? _await$getAccessToken : supabaseKey;
@@ -129144,8 +130050,8 @@ var require_dist4 = __commonJS({
       else delete result2.accessToken;
       return result2;
     }
-    function validateSupabaseUrl2(supabaseUrl2) {
-      const trimmedUrl = supabaseUrl2 === null || supabaseUrl2 === void 0 ? void 0 : supabaseUrl2.trim();
+    function validateSupabaseUrl2(supabaseUrl) {
+      const trimmedUrl = supabaseUrl === null || supabaseUrl === void 0 ? void 0 : supabaseUrl.trim();
       if (!trimmedUrl) throw new Error("supabaseUrl is required.");
       if (!trimmedUrl.match(/^https?:\/\//i)) throw new Error("Invalid supabaseUrl: Must be a valid HTTP or HTTPS URL.");
       try {
@@ -129347,11 +130253,11 @@ var require_dist4 = __commonJS({
       * const { data } = await supabase.from('profiles').select('*')
       * ```
       */
-      constructor(supabaseUrl2, supabaseKey, options) {
+      constructor(supabaseUrl, supabaseKey, options) {
         var _settings$auth$storag, _settings$global$head;
-        this.supabaseUrl = supabaseUrl2;
+        this.supabaseUrl = supabaseUrl;
         this.supabaseKey = supabaseKey;
-        const baseUrl = validateSupabaseUrl2(supabaseUrl2);
+        const baseUrl = validateSupabaseUrl2(supabaseUrl);
         if (!supabaseKey) throw new Error("supabaseKey is required.");
         this.realtimeUrl = new URL("realtime/v1", baseUrl);
         this.realtimeUrl.protocol = this.realtimeUrl.protocol.replace("http", "ws");
@@ -129379,7 +130285,7 @@ var require_dist4 = __commonJS({
             throw new Error(`@supabase/supabase-js: Supabase Client is configured with the accessToken option, accessing supabase.auth.${String(prop)} is not possible`);
           } });
         }
-        this.fetch = fetchWithAuth2(supabaseKey, supabaseUrl2, this._getAccessToken.bind(this), settings.global.fetch, settings.tracePropagation);
+        this.fetch = fetchWithAuth2(supabaseKey, supabaseUrl, this._getAccessToken.bind(this), settings.global.fetch, settings.tracePropagation);
         this.realtime = this._initRealtimeClient(_objectSpread24({
           headers: this.headers,
           accessToken: this._getAccessToken.bind(this),
@@ -129563,8 +130469,8 @@ var require_dist4 = __commonJS({
         }
       }
     };
-    var createClient3 = (supabaseUrl2, supabaseKey, options) => {
-      return new SupabaseClient2(supabaseUrl2, supabaseKey, options);
+    var createClient3 = (supabaseUrl, supabaseKey, options) => {
+      return new SupabaseClient2(supabaseUrl, supabaseKey, options);
     };
     function shouldShowDeprecationWarning2() {
       if (typeof window !== "undefined") return false;
@@ -130625,13 +131531,13 @@ var require_createBrowserClient = __commonJS({
     var cookies_1 = require_cookies();
     var warnDeprecatedPackage_1 = require_warnDeprecatedPackage();
     var cachedBrowserClient;
-    function createBrowserClient2(supabaseUrl2, supabaseKey, options) {
+    function createBrowserClient2(supabaseUrl, supabaseKey, options) {
       (0, warnDeprecatedPackage_1.warnIfUsingDeprecatedAuthHelpersPackage)();
       const shouldUseSingleton = options?.isSingleton === true || (!options || !("isSingleton" in options)) && (0, utils_1.isBrowser)();
       if (shouldUseSingleton && cachedBrowserClient) {
         return cachedBrowserClient;
       }
-      if (!supabaseUrl2 || !supabaseKey) {
+      if (!supabaseUrl || !supabaseKey) {
         throw new Error(`@supabase/ssr: Your project's URL and API key are required to create a Supabase client!
 
 Check your Supabase project's API settings to find these values
@@ -130642,7 +131548,7 @@ https://supabase.com/dashboard/project/_/settings/api`);
         ...options,
         cookieEncoding: options?.cookieEncoding ?? "base64url"
       }, false);
-      const client = (0, supabase_js_1.createClient)(supabaseUrl2, supabaseKey, {
+      const client = (0, supabase_js_1.createClient)(supabaseUrl, supabaseKey, {
         // TODO: resolve type error
         ...options,
         global: {
@@ -130678,15 +131584,15 @@ var require_createServerClient = __commonJS({
   "node_modules/@supabase/ssr/dist/main/createServerClient.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.createServerClient = createServerClient2;
+    exports2.createServerClient = createServerClient;
     var supabase_js_1 = require_dist4();
     var version_1 = require_version3();
     var cookies_1 = require_cookies();
     var helpers_1 = require_helpers2();
     var warnDeprecatedPackage_1 = require_warnDeprecatedPackage();
-    function createServerClient2(supabaseUrl2, supabaseKey, options) {
+    function createServerClient(supabaseUrl, supabaseKey, options) {
       (0, warnDeprecatedPackage_1.warnIfUsingDeprecatedAuthHelpersPackage)();
-      if (!supabaseUrl2 || !supabaseKey) {
+      if (!supabaseUrl || !supabaseKey) {
         throw new Error(`Your project's URL and Key are required to create a Supabase client!
 
 Check your Supabase project's API settings to find these values
@@ -130697,7 +131603,7 @@ https://supabase.com/dashboard/project/_/settings/api`);
         ...options,
         cookieEncoding: options?.cookieEncoding ?? "base64url"
       }, true);
-      const client = (0, supabase_js_1.createClient)(supabaseUrl2, supabaseKey, {
+      const client = (0, supabase_js_1.createClient)(supabaseUrl, supabaseKey, {
         // TODO: resolve type error
         ...options,
         global: {
@@ -130776,36 +131682,6 @@ var require_main4 = __commonJS({
   }
 });
 
-// lib/supabase/factory.ts
-function supabaseUrl() {
-  return process.env.NEXT_PUBLIC_SUPABASE_URL;
-}
-function supabaseAnonKey() {
-  return process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
-}
-function authCookieOptions() {
-  const secure = process.env.NODE_ENV === "production";
-  return {
-    cookieOptions: {
-      path: "/",
-      sameSite: "lax",
-      ...secure ? { secure: true } : {}
-    }
-  };
-}
-function createBrowserSupabaseClient() {
-  return (0, import_ssr.createBrowserClient)(supabaseUrl(), supabaseAnonKey(), {
-    isSingleton: true,
-    ...authCookieOptions()
-  });
-}
-var import_ssr;
-var init_factory = __esm({
-  "lib/supabase/factory.ts"() {
-    import_ssr = __toESM(require_main4());
-  }
-});
-
 // lib/supabase/client.ts
 function createClient2() {
   if (!isSupabaseConfigured()) {
@@ -130814,15 +131690,19 @@ function createClient2() {
     );
   }
   if (!browserClient) {
-    browserClient = createBrowserSupabaseClient();
+    browserClient = (0, import_ssr.createBrowserClient)(
+      process.env.NEXT_PUBLIC_SUPABASE_URL,
+      process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
+      { isSingleton: true }
+    );
   }
   return browserClient;
 }
-var browserClient;
+var import_ssr, browserClient;
 var init_client = __esm({
   "lib/supabase/client.ts"() {
+    import_ssr = __toESM(require_main4());
     init_config();
-    init_factory();
   }
 });
 
@@ -139130,7 +140010,6 @@ function offSandboxEvent(runId, handler) {
 var LOCAL_WORKSPACE_ACCESS_UNAVAILABLE;
 var init_bridge = __esm({
   "features/perchTerminal/desktop/bridge.ts"() {
-    "use strict";
     LOCAL_WORKSPACE_ACCESS_UNAVAILABLE = "Local workspace access is unavailable. Open Perch Desktop or update the app.";
   }
 });
@@ -198993,10 +199872,10 @@ function evaluateBrowserAction(action, observation, context = {}) {
   if (action.kind === "click" && !label && !("role" in action && action.role)) {
     return block("empty_click_target", "Refusing a browser click with no target. Observe the page and name a button/link, or use a coordinate (visual) click.");
   }
-  if ((action.kind === "click" || action.kind === "visual_click" || action.kind === "type") && context.recentFailedClickSignatures?.includes(clickSignature(action))) {
+  if ((action.kind === "click" || action.kind === "visual_click") && context.recentFailedClickSignatures?.includes(clickSignature(action))) {
     return block(
       "repeated_failed_click",
-      `The action "${label || action.kind}" already failed on this surface. Not retrying the identical click. Try a different target or report a blocker.`
+      `The action "${label || action.kind}" already failed on this surface as a semantic/DOM click. Not retrying the identical semantic click. Escalate to a coordinate/visual (CUA) click on the same target before reporting a blocker.`
     );
   }
   if (action.kind === "click" && (observation.app === "google_docs" || observation.app === "google_sheets")) {
@@ -199361,6 +200240,17 @@ async function safeBrowserAction(input, runtime = {}) {
       if (target.kind === "ambiguous") {
         lastFailure = fail("selector_ambiguous", target.message, startMs, latestSnapshot.text, latestSnapshot.url, target.candidates);
       } else if (target.kind === "missing") {
+        const escalated = await escalateMissingClickToCoordinate({
+          input,
+          snapshot: latestSnapshot,
+          callTool,
+          startMs,
+          runtime
+        });
+        if (escalated) {
+          clearPolicyClickFailure(input, runtime, latestSnapshot);
+          return escalated;
+        }
         lastFailure = fail("selector_not_found", target.message, startMs, latestSnapshot.text, latestSnapshot.url);
       } else {
         const actionResult = await executeBrowserAction(input, target.target, callTool);
@@ -199497,7 +200387,7 @@ function enforceActionPolicy(input, preSnapshot, runtime, startMs) {
 }
 function recordPolicyClickFailure(input, runtime, snapshot) {
   if (!runtime.policy) return;
-  if (input.intent !== "click" && input.intent !== "visual_click" && input.intent !== "type") return;
+  if (input.intent !== "click" && input.intent !== "visual_click") return;
   const key = policySessionKey(runtime);
   const signature = `${policySurfaceFingerprint(snapshot)}::${clickSignature(inputToProposedAction(input))}`;
   const existing = failedClickMemory.get(key) ?? [];
@@ -199609,6 +200499,7 @@ async function clickGmailComposeSendButton(callTool) {
             };
           });
           if (!target || target.result !== "target") return JSON.stringify(target || { result: "missing" });
+          await page.evaluate(${PERCH_CURSOR_OVERLAY_SNIPPET}, { x: target.x, y: target.y });
           await page.mouse.click(target.x, target.y);
           return JSON.stringify({ result: "clicked", label: target.label, x: target.x, y: target.y, bounds: target.bounds, viewport: target.viewport });
         }
@@ -199669,7 +200560,8 @@ async function dispatchSyntheticPaste(payload, runtime) {
     () => {
       const html = ${JSON.stringify(payload.html)};
       const plain = ${JSON.stringify(payload.plain)};
-      const active = document.activeElement;
+      const deepActive = () => { let n = document.activeElement; while (n && n.shadowRoot && n.shadowRoot.activeElement) n = n.shadowRoot.activeElement; return n; };
+      const active = deepActive();
       if (!active) return false;
       const isLongBody = plain.length > ${TYPE_DIRECT_MAX_CHARS} || plain.includes("\\n");
       if (isLongBody && active.tagName === "INPUT") return false;
@@ -199987,7 +200879,26 @@ async function resolveTargetForAction(input, snapshot, callTool) {
   }
   const resolved = resolveTarget(snapshot.text, input.targetDescriptor);
   if (resolved.kind === "found") return resolved;
-  if (input.intent === "type") return { kind: "found", target: null };
+  if (input.intent === "type") {
+    const desc = input.targetDescriptor;
+    const named = (desc?.text ?? "").trim() || (desc?.ariaLabel ?? "").trim();
+    if (named) {
+      return {
+        kind: "found",
+        target: {
+          kind: "semantic",
+          descriptor: {
+            ...desc?.text ? { text: desc.text } : {},
+            ...desc?.ariaLabel ? { ariaLabel: desc.ariaLabel } : {},
+            ...desc?.role ? { role: desc.role } : {},
+            nth: normalizeNth(desc?.nth)
+          },
+          matched: desc?.text ?? desc?.ariaLabel ?? "target"
+        }
+      };
+    }
+    return { kind: "found", target: null };
+  }
   return resolved;
 }
 function resolveTarget(snapshot, descriptor) {
@@ -200014,7 +200925,7 @@ function resolveTarget(snapshot, descriptor) {
       if (!match) {
         return {
           kind: "missing",
-          message: `No browser element matched "${desc.text ?? desc.ariaLabel ?? desc.role ?? "target"}" at nth=${nth}.`
+          message: `No DOM match for "${desc.text ?? desc.ariaLabel ?? desc.role ?? "target"}" at nth=${nth}. Escalate to a coordinate/visual (CUA) click on the same target before reporting a blocker.`
         };
       }
       if (matches.length > 1 && desc.nth === void 0) {
@@ -200046,7 +200957,7 @@ function resolveTarget(snapshot, descriptor) {
   }
   return {
     kind: "missing",
-    message: `No browser element matched "${desc.text ?? desc.ariaLabel ?? desc.role ?? "target"}".`
+    message: `No DOM match for "${desc.text ?? desc.ariaLabel ?? desc.role ?? "target"}". Escalate to a coordinate/visual (CUA) click on the same target before reporting a blocker.`
   };
 }
 function liveResolverSource() {
@@ -200095,17 +201006,50 @@ function liveResolverSource() {
           el.textContent,
         ].filter(Boolean).map((v) => String(v).trim()).find(Boolean) || "";
       };
-      const candidates = () => Array.from(document.querySelectorAll([
-        "button",
-        "a[href]",
-        "input",
-        "textarea",
-        "select",
-        "[role]",
-        "[aria-label]",
-        "[data-tooltip]",
-        "[contenteditable='true']"
-      ].join(","))).filter(visible);
+      const candidates = () => {
+        const INTERACTIVE_SELECTOR = [
+          "button",
+          "a[href]",
+          "input",
+          "textarea",
+          "select",
+          "[role]",
+          "[aria-label]",
+          "[data-tooltip]",
+          "[contenteditable='true']"
+        ].join(",");
+        // Collect open shadow roots recursively so the resolver reaches controls
+        // inside web components (e.g. Reddit/shreddit). Shadow-DOM elements share
+        // the top document's viewport coordinate space, so getBoundingClientRect
+        // (used for the coordinate click) stays correct. Same-origin iframes are
+        // intentionally skipped: their rects are in the frame's own space and
+        // would misplace the click.
+        const roots = [document];
+        const seenRoots = new Set();
+        const walk = (root) => {
+          let hosts;
+          try { hosts = root.querySelectorAll("*"); } catch (e) { return; }
+          for (const host of hosts) {
+            const sr = host.shadowRoot;
+            if (sr && !seenRoots.has(sr)) {
+              seenRoots.add(sr);
+              roots.push(sr);
+              walk(sr);
+            }
+          }
+        };
+        walk(document);
+        const out = [];
+        const seenEl = new Set();
+        for (const root of roots) {
+          let found;
+          try { found = root.querySelectorAll(INTERACTIVE_SELECTOR); } catch (e) { continue; }
+          for (const el of found) {
+            if (!seenEl.has(el) && visible(el)) { seenEl.add(el); out.push(el); }
+          }
+        }
+        return out;
+      };
       const rankMatch = (el, descriptor) => {
         const label = labelFor(el);
         const aria = el.getAttribute("aria-label") || "";
@@ -200143,6 +201087,32 @@ function liveResolverSource() {
       };
   `;
 }
+async function escalateMissingClickToCoordinate(args) {
+  const { input, snapshot, callTool, startMs, runtime } = args;
+  if (input.intent !== "click") return null;
+  const descriptor = input.targetDescriptor;
+  const label = descriptor?.text ?? descriptor?.ariaLabel ?? descriptor?.role;
+  if (!descriptor || !label) return null;
+  const coordinateTarget = { kind: "semantic", descriptor, matched: label };
+  const clicked = await clickTargetTrusted(callTool, coordinateTarget, label);
+  if (!clicked.ok) return null;
+  const outcome = await waitForExpectedOutcome({
+    input,
+    callTool,
+    preSnapshot: snapshot,
+    startMs,
+    signal: runtime.signal
+  });
+  if (!outcome.ok) return null;
+  return {
+    ...outcome,
+    evidence: {
+      ...outcome.evidence,
+      matched: `${clicked.matched} \xB7 escalated to coordinate (CUA) click`,
+      ...clicked.actionGeometry ? { actionGeometry: clicked.actionGeometry } : {}
+    }
+  };
+}
 async function executeBrowserAction(input, target, callTool) {
   if (input.intent === "snapshot" || input.intent === "extract") return { ok: true, matched: input.intent };
   if (input.intent === "navigate") {
@@ -200171,6 +201141,8 @@ async function executeBrowserAction(input, target, callTool) {
     if (!clicked.ok) return clicked;
     const typed = await typeViaRealKeys(callTool, input.text ?? "", clicked.matched);
     if (typed.ok) {
+      const verified = await verifyTypedTextLanded(callTool, input.text ?? "", clicked.matched);
+      if (!verified.ok) return verified;
       return {
         ok: true,
         matched: `${clicked.matched} then typed into focused surface`,
@@ -200180,7 +201152,10 @@ async function executeBrowserAction(input, target, callTool) {
     return typed;
   }
   if (input.intent === "type") {
-    return enterText(callTool, target, input.text ?? "");
+    const typed = await enterText(callTool, target, input.text ?? "");
+    if (!typed.ok) return typed;
+    const verified = await verifyTypedTextLanded(callTool, input.text ?? "", typed.matched);
+    return verified.ok ? typed : verified;
   }
   if (!target) return { ok: false, error: "target could not be resolved" };
   if (target.kind === "selector") {
@@ -200191,8 +201166,24 @@ async function executeBrowserAction(input, target, callTool) {
   }
   return { ok: false, error: `Unsupported browser intent: ${input.intent}` };
 }
+function labelGroundingVariants(label) {
+  const trimmed = (label ?? "").trim();
+  if (!trimmed || trimmed.toLowerCase() === "visual target") return [];
+  const variants = [trimmed];
+  const stripped = trimmed.replace(/\b(button|btn|field|input|textbox|tab|link|icon|menu|option|box|area|control)\b/gi, "").replace(/\s{2,}/g, " ").trim();
+  if (stripped && stripped.toLowerCase() !== trimmed.toLowerCase()) variants.push(stripped);
+  return variants;
+}
 async function clickVisualTarget(callTool, visualTarget) {
   if (!visualTarget) return { ok: false, error: "visual target requires x and y" };
+  for (const candidate of labelGroundingVariants(visualTarget.label)) {
+    const grounded = await clickTargetTrusted(
+      callTool,
+      { kind: "semantic", descriptor: { text: candidate }, matched: candidate },
+      candidate
+    );
+    if (grounded.ok) return grounded;
+  }
   const x = Number(visualTarget.x);
   const y = Number(visualTarget.y);
   if (!Number.isFinite(x) || !Number.isFinite(y)) {
@@ -200210,6 +201201,7 @@ async function clickVisualTarget(callTool, visualTarget) {
     const py = coordinateSpace === "viewport_pixels" ? rawY : rawY * viewport.height;
     const safeX = Math.max(1, Math.min(viewport.width - 1, px));
     const safeY = Math.max(1, Math.min(viewport.height - 1, py));
+    await page.evaluate(${PERCH_CURSOR_OVERLAY_SNIPPET}, { x: safeX, y: safeY });
     await page.mouse.click(safeX, safeY);
     return JSON.stringify({
       result: "clicked",
@@ -200233,17 +201225,78 @@ async function clickVisualTarget(callTool, visualTarget) {
   }
   return { ok: false, error: text || "visual click failed" };
 }
+async function verifyTypedTextLanded(callTool, text, matched) {
+  if (!text.trim()) return { ok: true };
+  const expr = `() => {
+    const url = String(location.href || "");
+    if (/docs\\.google\\.com\\/(document|spreadsheets|presentation)\\//i.test(url)) return "PERCH_DOCS_BLIND";
+    const deepActive = () => { let n = document.activeElement; while (n && n.shadowRoot && n.shadowRoot.activeElement) n = n.shadowRoot.activeElement; return n; };
+    const el = deepActive();
+    if (!el) return "PERCH_UNKNOWN";
+    const tag = (el.tagName || "").toLowerCase();
+    const readableEditable =
+      el.isContentEditable ||
+      tag === "textarea" ||
+      (tag === "input") ||
+      ("value" in el && typeof el.value === "string");
+    if (!readableEditable) return "PERCH_UNKNOWN";
+    const read = (n) => {
+      if ("value" in n && typeof n.value === "string") return n.value;
+      if (n.isContentEditable) return n.textContent || "";
+      return "";
+    };
+    const val = String(read(el) || "").replace(/\\s+/g, " ").trim();
+    return val ? "PERCH_LANDED" : "PERCH_EMPTY";
+  }`;
+  const result2 = await callTool({
+    serverName: "playwright",
+    toolName: "browser_evaluate",
+    args: { function: expr }
+  });
+  if (!result2.ok) return { ok: true };
+  if (firstText(result2.content).trim() !== "PERCH_EMPTY") return { ok: true };
+  return {
+    ok: false,
+    error: `Typed text did not land in "${matched}" \u2014 the focused field is still empty. Click the field with a visual_click to focus the real editable, then type again (typing goes into the focused field). Do not repeat the identical type into an unfocused field.`
+  };
+}
+async function hasEditableFocus(callTool) {
+  const expr = `() => {
+    const deepActive = () => { let n = document.activeElement; while (n && n.shadowRoot && n.shadowRoot.activeElement) n = n.shadowRoot.activeElement; return n; };
+    const el = deepActive();
+    if (!el) return false;
+    if (el.isContentEditable) return true;
+    const tag = (el.tagName || "").toLowerCase();
+    if (tag === "textarea") return true;
+    if (tag === "input") {
+      const t = (el.getAttribute("type") || "text").toLowerCase();
+      return !["button","submit","reset","checkbox","radio","range","file","image","color"].includes(t);
+    }
+    if ("value" in el && typeof el.value === "string") return true;
+    return false;
+  }`;
+  const result2 = await callTool({
+    serverName: "playwright",
+    toolName: "browser_evaluate",
+    args: { function: expr }
+  });
+  if (!result2.ok) return false;
+  return /^\s*true\s*$/i.test(firstText(result2.content));
+}
 async function enterText(callTool, target, text) {
   const matched = target?.matched ?? "focused field";
   const isLong = text.length > TYPE_DIRECT_MAX_CHARS || text.includes("\n");
+  const alreadyFocused = await hasEditableFocus(callTool);
   if (!isLong) {
-    if (target) {
+    let focusGeometry;
+    if (!alreadyFocused && target) {
       const focused = await focusTarget(callTool, target, matched);
-      if (!focused.ok) return focused;
+      if (focused.ok) focusGeometry = focused.actionGeometry;
     }
-    return typeViaRealKeys(callTool, text, matched);
+    const typed = await typeViaRealKeys(callTool, text, matched);
+    return typed.ok && focusGeometry ? { ...typed, actionGeometry: focusGeometry } : typed;
   }
-  if (target) {
+  if (!alreadyFocused && target) {
     const focused = await focusTarget(callTool, target, matched);
     if (focused.ok) {
       const pasted2 = await dispatchSyntheticPaste({ html: null, plain: text }, { callTool });
@@ -200271,7 +201324,8 @@ function shouldRefuseRealKeys(error) {
 async function typeIntoActiveElement(callTool, text) {
   const json = JSON.stringify(text);
   const expr = `() => {
-    const el = document.activeElement;
+    const deepActive = () => { let n = document.activeElement; while (n && n.shadowRoot && n.shadowRoot.activeElement) n = n.shadowRoot.activeElement; return n; };
+    const el = deepActive();
     if (!el) throw new Error("no active element to type into");
     const isLongBody = ${JSON.stringify(text.length > TYPE_DIRECT_MAX_CHARS || text.includes("\n"))};
     if (isLongBody && el.tagName === "INPUT") {
@@ -200357,6 +201411,7 @@ async function clickTargetTrusted(callTool, target, matched) {
       };
     }, { descriptor: ${JSON.stringify(descriptor)}, selector: ${JSON.stringify(selector)} });
     if (!target || target.result !== "target") return JSON.stringify(target || { result: "missing" });
+    await page.evaluate(${PERCH_CURSOR_OVERLAY_SNIPPET}, { x: target.x, y: target.y });
     await page.mouse.click(target.x, target.y);
     return JSON.stringify({ result: "clicked", label: target.label, x: target.x, y: target.y, bounds: target.bounds, viewport: target.viewport });
   }`;
@@ -200684,7 +201739,7 @@ function delay(ms, signal) {
     );
   });
 }
-var DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS, SNAPSHOT_REF_PREFIX, HUMAN_RECOVERY_FAILURES, MODAL_DISMISSERS, failedClickMemory, FAILED_CLICK_MEMORY_MAX, TYPE_DIRECT_MAX_CHARS, PRESS_KEY_LOOP_MAX_CHARS;
+var DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS, SNAPSHOT_REF_PREFIX, HUMAN_RECOVERY_FAILURES, MODAL_DISMISSERS, failedClickMemory, FAILED_CLICK_MEMORY_MAX, PERCH_CURSOR_OVERLAY_SNIPPET, TYPE_DIRECT_MAX_CHARS, PRESS_KEY_LOOP_MAX_CHARS;
 var init_safeBrowserAction = __esm({
   "features/perchTerminal/runtime/playwright/safeBrowserAction.ts"() {
     "use strict";
@@ -200711,6 +201766,26 @@ var init_safeBrowserAction = __esm({
     ];
     failedClickMemory = /* @__PURE__ */ new Map();
     FAILED_CLICK_MEMORY_MAX = 12;
+    PERCH_CURSOR_OVERLAY_SNIPPET = `(coord) => {
+  try {
+    const id = "__perch_operator_cursor__";
+    let el = document.getElementById(id);
+    if (!el) {
+      el = document.createElement("div");
+      el.id = id;
+      el.setAttribute("aria-hidden", "true");
+      el.style.cssText = "position:fixed;left:0;top:0;z-index:2147483647;pointer-events:none;width:24px;height:30px;transform-origin:0 0;transition:left .1s ease,top .1s ease,opacity .4s ease;filter:drop-shadow(0 1px 2px rgba(0,0,0,.6));";
+      el.innerHTML = '<svg width="24" height="30" viewBox="0 0 16 20" xmlns="http://www.w3.org/2000/svg"><path d="M0 0 L0 15 L4.5 11.6 L6.9 17.2 L9.2 16.2 L6.8 10.8 L11.8 10.8 Z" fill="#111827" stroke="#ffffff" stroke-width="1.4" stroke-linejoin="round"/></svg>';
+      (document.body || document.documentElement).appendChild(el);
+    }
+    // The arrow tip is at the SVG origin (0,0), so left/top place the tip on the point.
+    el.style.left = coord.x + "px";
+    el.style.top = coord.y + "px";
+    el.style.opacity = "1";
+    if (el.__perchHide) clearTimeout(el.__perchHide);
+    el.__perchHide = setTimeout(function () { el.style.opacity = "0.6"; }, 1500);
+  } catch (e) {}
+}`;
     TYPE_DIRECT_MAX_CHARS = 200;
     PRESS_KEY_LOOP_MAX_CHARS = 4e3;
   }
@@ -213690,8 +214765,8 @@ var init_barSeries = __esm({
 });
 
 // lib/perchMarketDesk/data/fixtureStore.ts
-import fs9 from "node:fs";
-import path10 from "node:path";
+import fs10 from "node:fs";
+import path11 from "node:path";
 function createFixtureStore(input) {
   const instruments = [...input.instruments].sort((a, b2) => a.ticker.localeCompare(b2.ticker));
   const seriesByTicker = /* @__PURE__ */ new Map();
@@ -213738,22 +214813,22 @@ function createFixtureStore(input) {
   };
 }
 function loadFixtureStoreFromDir(dir) {
-  const instrumentsPath = path10.join(dir, "instruments.json");
-  const instruments = JSON.parse(fs9.readFileSync(instrumentsPath, "utf8"));
+  const instrumentsPath = path11.join(dir, "instruments.json");
+  const instruments = JSON.parse(fs10.readFileSync(instrumentsPath, "utf8"));
   const bars = [];
-  const barsDir = path10.join(dir, "bars");
-  for (const file of fs9.readdirSync(barsDir)) {
+  const barsDir = path11.join(dir, "bars");
+  for (const file of fs10.readdirSync(barsDir)) {
     if (!file.endsWith(".json")) continue;
-    const ticker = path10.basename(file, ".json");
-    const rows = JSON.parse(fs9.readFileSync(path10.join(barsDir, file), "utf8"));
+    const ticker = path11.basename(file, ".json");
+    const rows = JSON.parse(fs10.readFileSync(path11.join(barsDir, file), "utf8"));
     for (const row of rows) bars.push({ ...row, ticker: row.ticker ?? ticker });
   }
   let fundamentals;
-  const fundamentalsPath = path10.join(dir, "fundamentals.json");
-  if (fs9.existsSync(fundamentalsPath)) {
-    fundamentals = JSON.parse(fs9.readFileSync(fundamentalsPath, "utf8"));
+  const fundamentalsPath = path11.join(dir, "fundamentals.json");
+  if (fs10.existsSync(fundamentalsPath)) {
+    fundamentals = JSON.parse(fs10.readFileSync(fundamentalsPath, "utf8"));
   }
-  return createFixtureStore({ instruments, bars, fundamentals, label: `dir:${path10.basename(dir)}` });
+  return createFixtureStore({ instruments, bars, fundamentals, label: `dir:${path11.basename(dir)}` });
 }
 var init_fixtureStore = __esm({
   "lib/perchMarketDesk/data/fixtureStore.ts"() {
@@ -218835,9 +219910,19 @@ async function executeToolBatch(toolCalls, ctx) {
               { type: "image_url", image_url: { url: execution.imageDataUrl } }
             ]
           });
+        } else if (isOperatorScreenshot) {
+          const readout = await describeOperatorScreenshotViaVision(execution.imageDataUrl, ctx);
+          ctx.messages.push({
+            role: "user",
+            content: readout ? `${OPERATOR_SCREENSHOT_MARKER} Vision readout of the current screen after that action (the selected model is text-only, so a vision sidecar looked for you). Treat this as the source of truth. For a coordinate click, use the approximate x/y viewport fractions named below.
+
+${readout}` : `${OPERATOR_SCREENSHOT_MARKER} A current browser screenshot was captured after that action, but this selected model is text-only and the vision sidecar was unavailable. Call visionInspect with {"currentScreen": true, "prompt": "describe what I need to verify"} before any coordinate click. Otherwise continue from the browser snapshot/perception text.`
+          });
         } else {
-          const text = isLocalVisualAttachment ? `${LOCAL_VISUAL_ATTACHMENT_MARKER} A visual preview for ${label} was captured, but this selected model is text-only. If visual details matter, call visionInspect on the same file path/localSourceId with {"prompt": "read this file visually"}. Otherwise continue from any extracted text in the tool result.` : `${OPERATOR_SCREENSHOT_MARKER} A current browser screenshot was captured after that action, but this selected model is text-only. If visual details matter, call visionInspect with {"currentScreen": true, "prompt": "describe what I need to verify"}. Otherwise continue from the browser snapshot/perception text.`;
-          ctx.messages.push({ role: "user", content: text });
+          ctx.messages.push({
+            role: "user",
+            content: `${LOCAL_VISUAL_ATTACHMENT_MARKER} A visual preview for ${label} was captured, but this selected model is text-only. If visual details matter, call visionInspect on the same file path/localSourceId with {"prompt": "read this file visually"}. Otherwise continue from any extracted text in the tool result.`
+          });
         }
       }
     }
@@ -218858,6 +219943,26 @@ function parseImageDataUrlForTool(dataUrl) {
     base64
   };
 }
+async function describeOperatorScreenshotViaVision(dataUrl, ctx) {
+  if (ctx.signal?.aborted) return null;
+  const parsed = parseImageDataUrlForTool(dataUrl);
+  if (!parsed) return null;
+  try {
+    const result2 = await callVisionLaneModel({
+      founderModelSelection: ctx.founderModelSelection,
+      imageBase64: parsed.base64,
+      mimeType: parsed.mimeType,
+      userPrompt: OPERATOR_VISION_OBSERVER_PROMPT,
+      signal: ctx.signal ?? void 0,
+      userId: ctx.userId ?? null,
+      workspaceId: ctx.workspaceId ?? null,
+      runId: ctx.runId ?? null
+    });
+    if (result2.ok && result2.text.trim()) return result2.text.trim();
+  } catch {
+  }
+  return null;
+}
 function currentScreenVisionToolCall(input) {
   const { toolCall, imageDataUrl } = input;
   if (toolCall.name !== TOOL_NAMES.visionInspect) return { toolCall };
@@ -218916,11 +220021,12 @@ function updateConsecutiveRequiredArgFailures(counts, execution) {
 function now6() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
-var MAX_PARALLEL_TOOL_CALLS, LOCAL_VISUAL_ATTACHMENT_MARKER;
+var MAX_PARALLEL_TOOL_CALLS, LOCAL_VISUAL_ATTACHMENT_MARKER, OPERATOR_VISION_OBSERVER_PROMPT;
 var init_toolBatchExecutor = __esm({
   "features/perchTerminal/runtime/toolLoop/toolBatchExecutor.ts"() {
     "use strict";
     init_modelRegistry();
+    init_visionLaneCall();
     init_toolExecutor();
     init_fileDiff();
     init_toolNames();
@@ -218933,6 +220039,14 @@ var init_toolBatchExecutor = __esm({
     init_sourceReadPolicy();
     MAX_PARALLEL_TOOL_CALLS = 8;
     LOCAL_VISUAL_ATTACHMENT_MARKER = "[local-visual]";
+    OPERATOR_VISION_OBSERVER_PROMPT = [
+      "You are the eyes of a browser operator that cannot see this screen.",
+      "Describe the current browser screen so the operator can act precisely.",
+      "List the key interactive controls (buttons, links, text fields, tabs, menus) with their exact visible labels and approximate position as viewport fractions x,y in [0,1], where 0,0 is the top-left and 1,1 is the bottom-right.",
+      "State which field or control is focused or selected, the values already entered in visible fields, and any error, confirmation, or toast text.",
+      "If a crosshair or marker is drawn on the image, say which element it is pointing at.",
+      "Plain text only. Do not suggest or decide the next action."
+    ].join(" ");
   }
 });
 
@@ -219377,8 +220491,11 @@ async function prepareLoopMessagesForSend(input) {
     toolDefinitionsJson,
     modelContext
   });
-  const contextLimitTokens = resolveEffectiveContextLimit(input.option);
-  const compactThreshold = getAutoCompactThreshold(input.option);
+  const budgetModel = typeof input.effectiveContextLimitTokens === "number" && input.effectiveContextLimitTokens > 0 ? { ...input.option, effectiveLimitTokens: input.effectiveContextLimitTokens } : input.option;
+  const contextLimitTokens = resolveEffectiveContextLimit(
+    budgetModel
+  );
+  const compactThreshold = getAutoCompactThreshold(budgetModel);
   const postCompactTargetTokens = resolvePostCompactTargetTokens(contextLimitTokens);
   const recentTailTokenBudget = resolveRecentTailBudgetTokens({
     postCompactTargetTokens,
@@ -219404,11 +220521,6 @@ async function prepareLoopMessagesForSend(input) {
         toolDefinitionsJson,
         modelContext
       });
-      input.onEvent?.({
-        type: "activity_delta",
-        text: `Cleared ${microcompactedToolResults} old tool result(s) to free context.`,
-        ts: (/* @__PURE__ */ new Date()).toISOString()
-      });
     }
   }
   if (autoCompactEnabled && anchoredTokens(breakdown.total) >= compactThreshold) {
@@ -223195,6 +224307,7 @@ async function runFlockTurn(input, deps, options = {}) {
       emitWorkerUpdate(emit, plan, worker, "queued");
     }
     const spawnFn = options.spawnWorkerFn ?? spawnWorker;
+    let turnInput = input;
     const outcomes = [];
     const revisionOutcomes = [];
     let revisionReport = null;
@@ -223243,6 +224356,7 @@ async function runFlockTurn(input, deps, options = {}) {
         toolCallsReserved += reservedToolCalls;
         emitWorkerUpdate(emit, plan, worker, "running");
         try {
+          turnInput = await refreshFlockCliAuth(turnInput);
           const context = contextOverride ?? buildWorkerContext(worker, sharedContext, outputByFlockWorkerId, plan);
           const objective = worker.role === "worker" && contextContainsSources(context) ? `${worker.objective}
 ${FLOCK_GROUNDING_CONTRACT}` : worker.objective;
@@ -223254,18 +224368,18 @@ ${FLOCK_GROUNDING_CONTRACT}` : worker.objective;
               maxIterations: worker.maxIterations,
               maxToolCalls: reservedToolCalls
             },
-            buildSpawnContext(input, plan.flockId, flockRun.controller.signal, emit, worker)
+            buildSpawnContext(turnInput, plan.flockId, flockRun.controller.signal, emit, worker)
           );
           toolCallsReserved -= reservedToolCalls;
           toolCallsUsed += Math.min(result2.toolCalls ?? 0, reservedToolCalls);
-          const ok = result2.ok;
+          const status = flockWorkerStatusFromSpawnResult(result2);
           const outcome = {
             worker,
             result: result2,
-            status: ok ? "done" : "failed",
+            status,
             detail: clampLine(result2.summary, 200)
           };
-          emitWorkerUpdate(emit, plan, worker, ok ? "done" : "failed", clampLine(result2.summary, 160));
+          emitWorkerUpdate(emit, plan, worker, status, clampLine(result2.summary, 160));
           return outcome;
         } catch (error) {
           toolCallsReserved -= reservedToolCalls;
@@ -223365,8 +224479,10 @@ ${FLOCK_GROUNDING_CONTRACT}` : worker.objective;
     }
     const userCancelled = Boolean(deps.signal?.aborted);
     const workersDone = outcomes.filter((outcome) => outcome.status === "done").length;
-    const workersFailed = outcomes.filter((outcome) => outcome.status === "failed").length;
+    const workersBlocked = outcomes.filter((outcome) => outcome.status === "blocked").length;
+    const workersFailed = outcomes.filter((outcome) => outcome.status === "failed").length + workersBlocked;
     const flockStatus = userCancelled || wallTimeHit && workersDone === 0 ? "cancelled" : workersFailed === 0 && workersDone === plan.workers.length ? "completed" : workersDone > 0 ? "partial" : "failed";
+    const permissionHint = workersBlocked > 0 && (turnInput.permissionMode ?? "default") === "default" ? "\n\nTip: flock workers inherit default permissions \u2014 run `/permission take_the_wheel` before `/flock` so bash redirects and file writes do not stall on approval gates." : "";
     const assistantText = [
       buildFlockSummary(
         plan,
@@ -223382,7 +224498,7 @@ ${FLOCK_GROUNDING_CONTRACT}` : worker.objective;
       ...modelOverrides.unavailable.map(
         (override) => `Requested model "${override.modelText}"${override.roleText ? ` for ${override.roleText}` : ""} is not available \u2014 that worker stayed on the default model path.`
       )
-    ].join("\n");
+    ].join("\n") + permissionHint;
     emit({
       type: "flock_run_completed",
       flockId: plan.flockId,
@@ -223616,6 +224732,12 @@ function buildFlockSummary(plan, outcomes, status, toolCallsUsed, wallTimeHit) {
 function friendlyOutcomeDetail(detail) {
   const clean = clampLine(detail, 220);
   if (!clean) return "";
+  if (/approval gate|requires approval|Blocked at an approval/i.test(clean)) {
+    return clean;
+  }
+  if (/No usable model response|Model proxy error|not_authenticated|Unauthorized/i.test(clean)) {
+    return clean;
+  }
   if (/Reached maximum \d+ tool-call iterations/i.test(clean)) {
     return "finished from gathered evidence";
   }
@@ -223634,6 +224756,29 @@ function clampLine(text, max2) {
 function makeFlockRunId() {
   return `flock-run-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
 }
+function flockWorkerStatusFromSpawnResult(result2) {
+  if (!result2.ok || result2.usabilityStatus === "failed") return "failed";
+  if (result2.usabilityStatus === "needs_user_input") return "blocked";
+  return "done";
+}
+async function refreshFlockCliAuth(input) {
+  if (input.cliLocalTools !== true) return input;
+  const stored = await readStoredCliAuthSession();
+  if (!stored?.accessToken?.trim()) return input;
+  const turnToken = input.cliServerAccessToken?.trim();
+  if (turnToken && turnToken !== stored.accessToken) return input;
+  const fresh = await ensureFreshCliAuthSession({ session: stored });
+  if (!fresh?.accessToken?.trim()) return input;
+  if (fresh.accessToken === input.cliServerAccessToken) return input;
+  if (typeof process !== "undefined") {
+    process.env.PERCH_MODEL_CALL_PROXY_TOKEN = fresh.accessToken;
+  }
+  return {
+    ...input,
+    cliServerAccessToken: fresh.accessToken,
+    marketDeskProxyAccessToken: input.marketDeskProxyAccessToken ?? fresh.accessToken
+  };
+}
 function now11() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -223644,6 +224789,8 @@ var init_runFlockTurn = __esm({
     init_operatorStream();
     init_runRegistry();
     init_spawnWorker2();
+    init_cliAuthSession();
+    init_cliAuthRefresh();
     init_registry();
     init_flockCommand();
     init_flockLimits();
@@ -223673,6 +224820,12 @@ var init_usageCommand = __esm({
   }
 });
 
+// lib/perch-ai/entitlements.ts
+var init_entitlements = __esm({
+  "lib/perch-ai/entitlements.ts"() {
+  }
+});
+
 // lib/perch-ai/access.ts
 function hasPrivilegedPerchAiRole(memberships) {
   return memberships.some(
@@ -223690,6 +224843,7 @@ function canShowPerchDevTools(membershipRole) {
 }
 var init_access = __esm({
   "lib/perch-ai/access.ts"() {
+    init_entitlements();
   }
 });
 
@@ -231950,9 +233104,9 @@ var init_backgroundTaskTypes = __esm({
 });
 
 // features/perchTerminal/runtime/background/backgroundTaskRegistry.ts
-import fs10 from "node:fs";
-import os from "node:os";
-import path11 from "node:path";
+import fs11 from "node:fs";
+import os2 from "node:os";
+import path12 from "node:path";
 function isTerminalStatus(status) {
   return status !== "running";
 }
@@ -232009,19 +233163,19 @@ function runtimeMs(record) {
 function readOutputPreview(outputPath, previewBytes = BACKGROUND_TASK_BOUNDS.previewBytes) {
   if (!outputPath) return { preview: "", truncated: false };
   try {
-    const stat2 = fs10.statSync(outputPath);
-    const fd = fs10.openSync(outputPath, "r");
+    const stat2 = fs11.statSync(outputPath);
+    const fd = fs11.openSync(outputPath, "r");
     try {
       if (stat2.size <= previewBytes) {
         const buf2 = Buffer.alloc(stat2.size);
-        fs10.readSync(fd, buf2, 0, stat2.size, 0);
+        fs11.readSync(fd, buf2, 0, stat2.size, 0);
         return { preview: buf2.toString("utf8"), truncated: false };
       }
       const buf = Buffer.alloc(previewBytes);
-      fs10.readSync(fd, buf, 0, previewBytes, stat2.size - previewBytes);
+      fs11.readSync(fd, buf, 0, previewBytes, stat2.size - previewBytes);
       return { preview: buf.toString("utf8"), truncated: true };
     } finally {
-      fs10.closeSync(fd);
+      fs11.closeSync(fd);
     }
   } catch {
     return { preview: "", truncated: false };
@@ -232056,26 +233210,28 @@ function getBackgroundTaskStore() {
 var STORE_FILE, BackgroundTaskStore, singleton;
 var init_backgroundTaskRegistry = __esm({
   "features/perchTerminal/runtime/background/backgroundTaskRegistry.ts"() {
-    "use strict";
     init_backgroundTaskTypes();
     STORE_FILE = "background-tasks.json";
     BackgroundTaskStore = class {
+      baseDir;
+      storePath;
+      outputDir;
+      records = /* @__PURE__ */ new Map();
+      loaded = false;
       constructor(options = {}) {
-        this.records = /* @__PURE__ */ new Map();
-        this.loaded = false;
-        this.baseDir = options.baseDir ?? path11.join(os.homedir(), ".perch");
-        this.storePath = path11.join(this.baseDir, STORE_FILE);
-        this.outputDir = path11.join(this.baseDir, "background-output");
+        this.baseDir = options.baseDir ?? path12.join(os2.homedir(), ".perch");
+        this.storePath = path12.join(this.baseDir, STORE_FILE);
+        this.outputDir = path12.join(this.baseDir, "background-output");
       }
       ensureDirs() {
-        fs10.mkdirSync(this.baseDir, { recursive: true });
-        fs10.mkdirSync(this.outputDir, { recursive: true });
+        fs11.mkdirSync(this.baseDir, { recursive: true });
+        fs11.mkdirSync(this.outputDir, { recursive: true });
       }
       load() {
         if (this.loaded) return;
         this.loaded = true;
         try {
-          const raw = fs10.readFileSync(this.storePath, "utf8");
+          const raw = fs11.readFileSync(this.storePath, "utf8");
           const parsed = JSON.parse(raw);
           const tasks = Array.isArray(parsed.tasks) ? parsed.tasks : [];
           this.records = new Map(tasks.map((t) => [t.taskId, t]));
@@ -232087,11 +233243,11 @@ var init_backgroundTaskRegistry = __esm({
         this.ensureDirs();
         const tasks = Array.from(this.records.values());
         const tmp = `${this.storePath}.tmp`;
-        fs10.writeFileSync(tmp, JSON.stringify({ version: 1, tasks }, null, 2), "utf8");
-        fs10.renameSync(tmp, this.storePath);
+        fs11.writeFileSync(tmp, JSON.stringify({ version: 1, tasks }, null, 2), "utf8");
+        fs11.renameSync(tmp, this.storePath);
       }
       outputPathFor(taskId) {
-        return path11.join(this.outputDir, `${taskId}.log`);
+        return path12.join(this.outputDir, `${taskId}.log`);
       }
       list() {
         this.load();
@@ -232253,14 +233409,14 @@ var init_backgroundWakeController = __esm({
 
 // features/perchTerminal/runtime/background/runBackgroundCommand.ts
 import { spawn as spawn2 } from "node:child_process";
-import fs11 from "node:fs";
-import path12 from "node:path";
+import fs12 from "node:fs";
+import path13 from "node:path";
 function newTaskId() {
   return `bg-${Date.now()}-${Math.random().toString(16).slice(2, 8)}`;
 }
 function createCappedWriter(filePath, maxBytes) {
-  fs11.mkdirSync(path12.dirname(filePath), { recursive: true });
-  const stream = fs11.createWriteStream(filePath, { flags: "w" });
+  fs12.mkdirSync(path13.dirname(filePath), { recursive: true });
+  const stream = fs12.createWriteStream(filePath, { flags: "w" });
   let written = 0;
   let truncated = false;
   return {
@@ -232433,10 +233589,10 @@ var init_runBackgroundCommand = __esm({
 
 // features/perchTerminal/runtime/cliHost/nodeLocalBridge.ts
 import { spawn as spawn3 } from "node:child_process";
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 import fsp from "node:fs/promises";
-import os2 from "node:os";
-import path13 from "node:path";
+import os3 from "node:os";
+import path14 from "node:path";
 function installCliNodeLocalBridge(input) {
   const globalRef = globalThis;
   const previous = globalRef.__PERCH_TEST_DESKTOP_BRIDGE__;
@@ -232450,7 +233606,7 @@ function installCliNodeLocalBridge(input) {
   };
 }
 function readCliProjectMemoryState(workspaceRoot) {
-  const root2 = path13.resolve(expandHome4(workspaceRoot));
+  const root2 = path14.resolve(expandHome4(workspaceRoot));
   if (!isCliProjectMemoryAvailable(root2)) {
     return {
       available: false,
@@ -232465,7 +233621,7 @@ function readCliProjectMemoryState(workspaceRoot) {
   };
 }
 function createCliNodeLocalBridge(input) {
-  const workspaceRoot = path13.resolve(input.workspaceRoot);
+  const workspaceRoot = path14.resolve(input.workspaceRoot);
   const now23 = () => (/* @__PURE__ */ new Date()).toISOString();
   const sandboxHandlers = /* @__PURE__ */ new Map();
   const emitSandboxEvent = (event) => {
@@ -232479,7 +233635,7 @@ function createCliNodeLocalBridge(input) {
     cwd: workspaceRoot,
     projectRoot: workspaceRoot,
     shellPath: process.env.SHELL || "/bin/zsh",
-    shellName: path13.basename(process.env.SHELL || "zsh"),
+    shellName: path14.basename(process.env.SHELL || "zsh"),
     path: process.env.PATH || "",
     status: "running",
     backend: "spawn-fallback",
@@ -232506,7 +233662,7 @@ function createCliNodeLocalBridge(input) {
       capabilities: ["local-files", "local-shell"]
     }),
     checkFsAccess: async (request) => {
-      const absolutePath = path13.resolve(expandHome4(request.absolutePath));
+      const absolutePath = path14.resolve(expandHome4(request.absolutePath));
       return {
         decision: "allow",
         reason: "Allowed by Perch CLI local filesystem access.",
@@ -232524,7 +233680,7 @@ function createCliNodeLocalBridge(input) {
       ok: true,
       directory: workspaceRoot,
       fileName: request.fileName,
-      absolutePath: path13.join(workspaceRoot, request.fileName),
+      absolutePath: path14.join(workspaceRoot, request.fileName),
       source: "approved_root"
     }),
     validateWorkspaceRoot: async () => ({
@@ -232613,7 +233769,7 @@ function createCliNodeLocalBridge(input) {
     writeWorkspaceFile: async (request) => {
       const baseRoot = resolveRequestRoot(workspaceRoot, request.workspaceRoot);
       const target = resolveWritePath(baseRoot, request.relativePath);
-      await fsp.mkdir(path13.dirname(target), { recursive: true });
+      await fsp.mkdir(path14.dirname(target), { recursive: true });
       const flag = request.overwrite === true ? "w" : "wx";
       const payload = request.encoding === "base64" && typeof request.contentBase64 === "string" ? Buffer.from(request.contentBase64, "base64") : request.content ?? "";
       try {
@@ -232633,14 +233789,14 @@ function createCliNodeLocalBridge(input) {
     moveLocalFile: async (request) => {
       const src = resolveReadPath(workspaceRoot, request.src);
       const dest = resolveWritePath(workspaceRoot, request.dest);
-      await fsp.mkdir(path13.dirname(dest), { recursive: true });
+      await fsp.mkdir(path14.dirname(dest), { recursive: true });
       await fsp.rename(src, dest);
       return { ok: true, fromPath: src, toPath: dest };
     },
     copyLocalFile: async (request) => {
       const src = resolveReadPath(workspaceRoot, request.src);
       const dest = resolveWritePath(workspaceRoot, request.dest);
-      await fsp.mkdir(path13.dirname(dest), { recursive: true });
+      await fsp.mkdir(path14.dirname(dest), { recursive: true });
       await fsp.copyFile(src, dest);
       return { ok: true, fromPath: src, toPath: dest };
     },
@@ -232665,7 +233821,7 @@ function createCliNodeLocalBridge(input) {
       const pattern = request.pattern?.trim() || "**/*";
       const regex2 = globToRegex(pattern);
       const files = await collectFiles(root2, { maxVisits: Math.max(maxResults * 20, 1e3) });
-      const matches = files.map((file) => path13.relative(root2, file).replace(/\\/g, "/")).filter((relative2) => regex2.test(relative2)).slice(0, maxResults);
+      const matches = files.map((file) => path14.relative(root2, file).replace(/\\/g, "/")).filter((relative2) => regex2.test(relative2)).slice(0, maxResults);
       return {
         ok: true,
         matches,
@@ -232688,7 +233844,7 @@ function createCliNodeLocalBridge(input) {
       const files = await collectFiles(root2, { maxVisits: 5e3 });
       const matches = [];
       for (const file of files) {
-        const relative2 = path13.relative(root2, file).replace(/\\/g, "/");
+        const relative2 = path14.relative(root2, file).replace(/\\/g, "/");
         if (includeRegex && !includeRegex.test(relative2)) continue;
         const text = await readTextFileIfReasonable(file);
         if (text === null) continue;
@@ -232727,7 +233883,7 @@ function createCliNodeLocalBridge(input) {
       const stat2 = await safeStat(target);
       return {
         ok: true,
-        relativePath: path13.isAbsolute(request.relativePath) || request.relativePath.startsWith("~") ? target : path13.relative(baseRoot, target) || ".",
+        relativePath: path14.isAbsolute(request.relativePath) || request.relativePath.startsWith("~") ? target : path14.relative(baseRoot, target) || ".",
         exists: Boolean(stat2),
         isFile: stat2?.isFile() ?? false,
         isDirectory: stat2?.isDirectory() ?? false,
@@ -232761,7 +233917,7 @@ function createCliNodeLocalBridge(input) {
       return {
         ok: true,
         data: buffer.toString("base64"),
-        fileName: path13.relative(workspaceRoot, target) || path13.basename(target),
+        fileName: path14.relative(workspaceRoot, target) || path14.basename(target),
         mimeType: inferMimeType(target),
         sizeBytes: stat2.size,
         encoding: "base64"
@@ -232857,7 +234013,7 @@ async function runCliPrepareAPEvidence(workspaceRoot, request) {
         topCases: (artifact.cases ?? []).slice(0, 12),
         duplicateCases: result2.payload.duplicateCases,
         controlGraph: result2.payload.controlGraph,
-        relativeOutputDir: typeof artifact.outputDir === "string" ? path13.basename(artifact.outputDir) : null,
+        relativeOutputDir: typeof artifact.outputDir === "string" ? path14.basename(artifact.outputDir) : null,
         approvedRootMatch: true
       },
       executionHost: "electron_desktop",
@@ -232946,7 +234102,7 @@ async function prepareCliSandboxInputs(workspaceRoot, request) {
   const jobId = request.jobId?.trim() || `cli-sandbox-${Date.now()}`;
   const maxFiles = Math.max(1, Math.min(request.maxFiles ?? 20, 100));
   const maxBytesPerFile = Math.max(1, Math.min(request.maxBytesPerFile ?? 20 * 1024 * 1024, 50 * 1024 * 1024));
-  const tempDir = await fsp.mkdtemp(path13.join(os2.tmpdir(), `${jobId}-`));
+  const tempDir = await fsp.mkdtemp(path14.join(os3.tmpdir(), `${jobId}-`));
   const entries = [];
   const skipped = [];
   for (const localSourceId of request.localSourceIds.slice(0, maxFiles)) {
@@ -232960,13 +234116,13 @@ async function prepareCliSandboxInputs(workspaceRoot, request) {
       skipped.push({ localSourceId, reason: `File is too large: ${stat2.size} bytes.` });
       continue;
     }
-    const relativePath = safeSandboxRelativePath(path13.isAbsolute(localSourceId) || localSourceId.startsWith("~") ? path13.basename(sourcePath) : path13.relative(workspaceRoot, sourcePath));
-    const tempPath = path13.join(tempDir, relativePath);
-    await fsp.mkdir(path13.dirname(tempPath), { recursive: true });
+    const relativePath = safeSandboxRelativePath(path14.isAbsolute(localSourceId) || localSourceId.startsWith("~") ? path14.basename(sourcePath) : path14.relative(workspaceRoot, sourcePath));
+    const tempPath = path14.join(tempDir, relativePath);
+    await fsp.mkdir(path14.dirname(tempPath), { recursive: true });
     await fsp.copyFile(sourcePath, tempPath);
     entries.push({
       localSourceId,
-      fileName: path13.basename(sourcePath),
+      fileName: path14.basename(sourcePath),
       relativePath,
       tempPath,
       sizeBytes: stat2.size,
@@ -233004,11 +234160,11 @@ async function runCliSandboxCodeJob(workspaceRoot, request, onEvent) {
       getApprovedRoot: (rootId) => rootId === CLI_ROOT_ID ? { id: CLI_ROOT_ID, path: workspaceRoot, approvedAt: (/* @__PURE__ */ new Date()).toISOString() } : null,
       isPathSafe: (_rootPath, targetPath) => !targetPath.split(/[\\/]+/).includes(".."),
       isInsideApprovedRoot: (filePath) => {
-        const absolute = path13.resolve(expandHome4(filePath));
+        const absolute = path14.resolve(expandHome4(filePath));
         if (isInside(workspaceRoot, absolute)) {
           return { id: CLI_ROOT_ID, path: workspaceRoot, approvedAt: (/* @__PURE__ */ new Date()).toISOString() };
         }
-        return { id: "cli-absolute-root", path: path13.dirname(absolute), approvedAt: (/* @__PURE__ */ new Date()).toISOString() };
+        return { id: "cli-absolute-root", path: path14.dirname(absolute), approvedAt: (/* @__PURE__ */ new Date()).toISOString() };
       },
       shouldIgnore: (fileName) => IGNORED_DIRS.has(fileName),
       guessMimeType: inferMimeType,
@@ -233051,7 +234207,7 @@ function safeSandboxRelativePath(value) {
   return clean || "input";
 }
 function guessCliFileType(filePath) {
-  const ext = path13.extname(filePath).toLowerCase();
+  const ext = path14.extname(filePath).toLowerCase();
   if ([".xlsx", ".xls"].includes(ext)) return "spreadsheet";
   if (ext === ".csv" || ext === ".tsv") return "csv";
   if (ext === ".pdf") return "pdf";
@@ -233070,7 +234226,7 @@ async function readCliProjectMemoryBridge(workspaceRoot) {
   return { ok: true, meta: state.meta };
 }
 async function writeCliProjectMemory(workspaceRoot, patch) {
-  const root2 = path13.resolve(expandHome4(workspaceRoot));
+  const root2 = path14.resolve(expandHome4(workspaceRoot));
   if (!isCliProjectMemoryAvailable(root2)) {
     return {
       ok: false,
@@ -233086,12 +234242,12 @@ async function writeCliProjectMemory(workspaceRoot, patch) {
     lastOpenedThreadId: patch.lastOpenedThreadId !== void 0 ? patch.lastOpenedThreadId : current.lastOpenedThreadId,
     memorySummary: patch.memorySummary !== void 0 ? patch.memorySummary : current.memorySummary
   };
-  await fsp.mkdir(path13.join(root2, PERCH_DIR), { recursive: true });
+  await fsp.mkdir(path14.join(root2, PERCH_DIR), { recursive: true });
   await atomicWriteCliUtf8(getCliProjectFilePath(root2), JSON.stringify(next, null, 2));
   return { ok: true, meta: enrichCliProjectMeta(root2, next) };
 }
 async function writeCliMemoryFile(workspaceRoot, request) {
-  const root2 = path13.resolve(expandHome4(workspaceRoot));
+  const root2 = path14.resolve(expandHome4(workspaceRoot));
   if (!isCliProjectMemoryAvailable(root2)) {
     return {
       ok: false,
@@ -233103,8 +234259,8 @@ async function writeCliMemoryFile(workspaceRoot, request) {
   }
   const fileName = normalizeCliMemoryFileName(request.fileName);
   if (!fileName) return { ok: false, error: "Invalid memory file name." };
-  const relativePath = path13.join(PERCH_DIR, MEMORY_DIR, fileName);
-  const fullPath = path13.join(root2, relativePath);
+  const relativePath = path14.join(PERCH_DIR, MEMORY_DIR, fileName);
+  const fullPath = path14.join(root2, relativePath);
   const existing = await fsp.readFile(fullPath, "utf8").catch(() => "");
   let nextContent;
   try {
@@ -233117,7 +234273,7 @@ async function writeCliMemoryFile(workspaceRoot, request) {
   }
   const capError = assertCliMemoryWithinCap(nextContent);
   if (capError) return { ok: false, error: capError };
-  await fsp.mkdir(path13.dirname(fullPath), { recursive: true });
+  await fsp.mkdir(path14.dirname(fullPath), { recursive: true });
   await atomicWriteCliUtf8(fullPath, nextContent);
   const updatedFile = readCliTextMemoryFile(root2, relativePath, MAX_MEMORY_BYTES);
   return {
@@ -233143,17 +234299,17 @@ function defaultCliProjectMeta() {
 }
 function isCliProjectMemoryAvailable(root2) {
   try {
-    return fs12.statSync(path13.join(root2, PERCH_DIR)).isDirectory();
+    return fs13.statSync(path14.join(root2, PERCH_DIR)).isDirectory();
   } catch {
     return false;
   }
 }
 function getCliProjectFilePath(root2) {
-  return path13.join(root2, PERCH_DIR, PROJECT_FILE);
+  return path14.join(root2, PERCH_DIR, PROJECT_FILE);
 }
 function loadCliStoredMeta(root2) {
   try {
-    const raw = fs12.readFileSync(getCliProjectFilePath(root2), "utf8");
+    const raw = fs13.readFileSync(getCliProjectFilePath(root2), "utf8");
     return { ...defaultCliProjectMeta(), ...JSON.parse(raw) };
   } catch {
     return defaultCliProjectMeta();
@@ -233161,7 +234317,7 @@ function loadCliStoredMeta(root2) {
 }
 function enrichCliProjectMeta(root2, base) {
   const perchMd = readCliFirstExisting(root2, [
-    path13.join(PERCH_DIR, PERCH_INDEX_FILE),
+    path14.join(PERCH_DIR, PERCH_INDEX_FILE),
     PERCH_INDEX_FILE
   ], MAX_TEXT_BYTES);
   const rules = readCliRules(root2);
@@ -233272,10 +234428,10 @@ function readCliFirstExisting(root2, relativePaths, maxBytes) {
   return null;
 }
 function readCliRules(root2) {
-  const dirPath = path13.join(root2, PERCH_DIR, RULES_DIR);
+  const dirPath = path14.join(root2, PERCH_DIR, RULES_DIR);
   try {
-    return fs12.readdirSync(dirPath).filter((name) => [".md", ".txt"].includes(path13.extname(name).toLowerCase())).slice(0, 40).map((name) => readCliTextMemoryFile(root2, path13.join(PERCH_DIR, RULES_DIR, name), MAX_TEXT_BYTES)).filter((file) => file.found).map((file) => ({
-      fileName: path13.basename(file.relativePath),
+    return fs13.readdirSync(dirPath).filter((name) => [".md", ".txt"].includes(path14.extname(name).toLowerCase())).slice(0, 40).map((name) => readCliTextMemoryFile(root2, path14.join(PERCH_DIR, RULES_DIR, name), MAX_TEXT_BYTES)).filter((file) => file.found).map((file) => ({
+      fileName: path14.basename(file.relativePath),
       relativePath: file.relativePath,
       content: file.content,
       sizeBytes: file.sizeBytes,
@@ -233286,15 +234442,15 @@ function readCliRules(root2) {
   }
 }
 function readCliMemoryFiles(root2) {
-  const memoryDir = path13.join(root2, PERCH_DIR, MEMORY_DIR);
+  const memoryDir = path14.join(root2, PERCH_DIR, MEMORY_DIR);
   const discovered = /* @__PURE__ */ new Set();
   const memoryFiles = [];
   try {
-    for (const name of fs12.readdirSync(memoryDir).slice(0, MAX_MEMORY_FILES)) {
-      const ext = path13.extname(name).toLowerCase();
+    for (const name of fs13.readdirSync(memoryDir).slice(0, MAX_MEMORY_FILES)) {
+      const ext = path14.extname(name).toLowerCase();
       if (ext !== ".md" && ext !== ".txt") continue;
       discovered.add(name);
-      memoryFiles.push(readCliTextMemoryFile(root2, path13.join(PERCH_DIR, MEMORY_DIR, name), MAX_MEMORY_BYTES));
+      memoryFiles.push(readCliTextMemoryFile(root2, path14.join(PERCH_DIR, MEMORY_DIR, name), MAX_MEMORY_BYTES));
     }
   } catch {
   }
@@ -233302,20 +234458,20 @@ function readCliMemoryFiles(root2) {
     memoryFiles,
     missingMemoryFiles: EXPECTED_MEMORY_FILES.filter((name) => !discovered.has(name)).map((name) => ({
       fileName: name,
-      relativePath: path13.join(PERCH_DIR, MEMORY_DIR, name),
+      relativePath: path14.join(PERCH_DIR, MEMORY_DIR, name),
       reason: "expected project memory file was not found"
     }))
   };
 }
 function readCliTextMemoryFile(root2, relativePath, maxBytes) {
-  const fullPath = path13.join(root2, relativePath);
-  const fileName = path13.basename(relativePath);
+  const fullPath = path14.join(root2, relativePath);
+  const fileName = path14.basename(relativePath);
   try {
-    const stat2 = fs12.statSync(fullPath);
+    const stat2 = fs13.statSync(fullPath);
     if (!stat2.isFile()) {
       return { fileName, relativePath, content: "", found: false, error: "not a regular file" };
     }
-    const content = fs12.readFileSync(fullPath, "utf8");
+    const content = fs13.readFileSync(fullPath, "utf8");
     if (stat2.size > maxBytes) {
       return {
         fileName,
@@ -233437,7 +234593,7 @@ function terminateProcessGroup(child, signal) {
 }
 function resolveReadPath(root2, inputPath) {
   const expanded = expandHome4(inputPath || ".");
-  return path13.resolve(path13.isAbsolute(expanded) ? expanded : path13.join(root2, expanded));
+  return path14.resolve(path14.isAbsolute(expanded) ? expanded : path14.join(root2, expanded));
 }
 function resolveRequestRoot(defaultRoot, requestRoot) {
   const trimmed = requestRoot?.trim();
@@ -233445,25 +234601,25 @@ function resolveRequestRoot(defaultRoot, requestRoot) {
 }
 function resolveWritePath(root2, inputPath) {
   const expanded = expandHome4(inputPath || ".");
-  return path13.resolve(path13.isAbsolute(expanded) ? expanded : path13.join(root2, expanded));
+  return path14.resolve(path14.isAbsolute(expanded) ? expanded : path14.join(root2, expanded));
 }
 function displayPath(root2, target, requestedPath) {
   const expanded = expandHome4(requestedPath || ".");
-  if (path13.isAbsolute(expanded) || requestedPath.startsWith("~")) return target;
-  return path13.relative(root2, target) || path13.basename(target);
+  if (path14.isAbsolute(expanded) || requestedPath.startsWith("~")) return target;
+  return path14.relative(root2, target) || path14.basename(target);
 }
 function resolveLocalSourceId(root2, localSourceId) {
   const raw = localSourceId.includes("::") ? localSourceId.split("::").slice(1).join("::") : localSourceId;
   return resolveReadPath(root2, raw);
 }
 function expandHome4(inputPath) {
-  if (inputPath === "~") return os2.homedir();
-  if (inputPath.startsWith("~/")) return path13.join(os2.homedir(), inputPath.slice(2));
+  if (inputPath === "~") return os3.homedir();
+  if (inputPath.startsWith("~/")) return path14.join(os3.homedir(), inputPath.slice(2));
   return inputPath;
 }
 function isInside(root2, candidate) {
-  const relative2 = path13.relative(path13.resolve(root2), path13.resolve(candidate));
-  return relative2 === "" || !relative2.startsWith("..") && !path13.isAbsolute(relative2);
+  const relative2 = path14.relative(path14.resolve(root2), path14.resolve(candidate));
+  return relative2 === "" || !relative2.startsWith("..") && !path14.isAbsolute(relative2);
 }
 async function safeStat(target) {
   try {
@@ -233480,7 +234636,7 @@ async function collectFiles(root2, options) {
     for (const entry of entries) {
       if (result2.length >= options.maxVisits) return;
       if (entry.name.startsWith(".") && entry.name !== ".env") continue;
-      const absolute = path13.join(dir, entry.name);
+      const absolute = path14.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (!IGNORED_DIRS.has(entry.name)) await walk2(absolute);
       } else if (entry.isFile()) {
@@ -233536,14 +234692,14 @@ function sanitizeMaxResults(value) {
   return Math.max(1, Math.min(typeof value === "number" ? Math.floor(value) : DEFAULT_MAX_RESULTS, 1e3));
 }
 function localSourceEntry(root2, file, absoluteId = false) {
-  const stat2 = fs12.statSync(file);
-  const relativePath = path13.relative(root2, file);
-  const extension2 = path13.extname(file).toLowerCase();
+  const stat2 = fs13.statSync(file);
+  const relativePath = path14.relative(root2, file);
+  const extension2 = path14.extname(file).toLowerCase();
   return {
     localSourceId: absoluteId ? file : `${CLI_ROOT_ID}::${relativePath}`,
     rootId: absoluteId ? "cli-absolute-root" : CLI_ROOT_ID,
     relativePath,
-    fileName: path13.basename(file),
+    fileName: path14.basename(file),
     extension: extension2,
     sizeBytes: stat2.size,
     modifiedAt: stat2.mtime.toISOString(),
@@ -233552,7 +234708,7 @@ function localSourceEntry(root2, file, absoluteId = false) {
   };
 }
 function inferMimeType(file) {
-  const ext = path13.extname(file).toLowerCase();
+  const ext = path14.extname(file).toLowerCase();
   if (ext === ".pdf") return "application/pdf";
   if (ext === ".json") return "application/json";
   if (ext === ".csv") return "text/csv";
@@ -233613,12 +234769,12 @@ var init_nodeLocalBridge = __esm({
 });
 
 // features/perchTerminal/runtime/cliHost/runCliTurn.ts
-import path14 from "node:path";
+import path15 from "node:path";
 async function runPerchCliTurn(input, options = {}) {
   const prompt = input.prompt.trim();
   if (!prompt) throw new Error("Missing prompt for perch run");
   const now23 = options.now ?? (() => Date.now());
-  const cwd2 = path14.resolve(input.cwd ?? process.cwd());
+  const cwd2 = path15.resolve(input.cwd ?? process.cwd());
   const threadId = input.threadId?.trim() || `cli-${now23()}`;
   const events = [];
   let latestContextSnapshot = null;
@@ -233919,440 +235075,6 @@ var init_cliHost = __esm({
   }
 });
 
-// features/perchTerminal/runtime/publicModelDefault.ts
-function parsePublicModelDefaultPayload(value) {
-  const raw = value && typeof value === "object" ? value : {};
-  const selection = sanitizeFounderModelSelection(
-    raw.selection ?? DEFAULT_FOUNDER_MODEL_SELECTION
-  );
-  return {
-    selection,
-    updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : null,
-    updatedBy: typeof raw.updatedBy === "string" ? raw.updatedBy : null
-  };
-}
-var init_publicModelDefault = __esm({
-  "features/perchTerminal/runtime/publicModelDefault.ts"() {
-    "use strict";
-    init_modelRegistry();
-  }
-});
-
-// features/perchTerminal/runtime/cliHost/cliAuthSession.ts
-import { execFile } from "node:child_process";
-import fs13 from "node:fs/promises";
-import os3 from "node:os";
-import path15 from "node:path";
-import { promisify } from "node:util";
-async function readStoredCliAuthSession() {
-  const raw = shouldUseFallbackAuthFile() ? await readFallbackSecret().catch(() => null) : process.platform === "darwin" ? await readKeychainSecret().catch(() => null) : await readFallbackSecret().catch(() => null);
-  return parseStoredCliAuthSession(raw);
-}
-async function writeStoredCliAuthSession(session) {
-  const raw = JSON.stringify(session);
-  if (process.platform === "darwin" && !shouldUseFallbackAuthFile()) {
-    await execFileAsync("security", [
-      "add-generic-password",
-      "-U",
-      "-s",
-      KEYCHAIN_SERVICE,
-      "-a",
-      KEYCHAIN_ACCOUNT,
-      "-w",
-      raw
-    ]);
-    return;
-  }
-  await writeFallbackSecret(raw);
-}
-async function clearStoredCliAuthSession() {
-  if (process.platform === "darwin" && !shouldUseFallbackAuthFile()) {
-    await execFileAsync("security", [
-      "delete-generic-password",
-      "-s",
-      KEYCHAIN_SERVICE,
-      "-a",
-      KEYCHAIN_ACCOUNT
-    ]).catch(() => void 0);
-    return;
-  }
-  await fs13.rm(fallbackSessionPath(), { force: true }).catch(() => void 0);
-}
-function shouldUseFallbackAuthFile() {
-  return Boolean(process.env.PERCH_CLI_AUTH_DIR?.trim());
-}
-function isStoredCliAuthSessionUsable(session, nowSeconds = Math.floor(Date.now() / 1e3)) {
-  if (!session?.accessToken?.trim()) return false;
-  if (!session.appUrl?.trim()) return false;
-  if (!session.expiresAt) return true;
-  return session.expiresAt > nowSeconds + 90;
-}
-function parseStoredCliAuthSession(raw) {
-  if (!raw?.trim()) return null;
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed.version !== 1) return null;
-    if (!parsed.appUrl || !parsed.accessToken || !parsed.updatedAt) return null;
-    return {
-      version: 1,
-      appUrl: parsed.appUrl,
-      accessToken: parsed.accessToken,
-      refreshToken: parsed.refreshToken ?? null,
-      expiresAt: typeof parsed.expiresAt === "number" ? parsed.expiresAt : null,
-      userId: parsed.userId ?? null,
-      email: parsed.email ?? null,
-      updatedAt: parsed.updatedAt
-    };
-  } catch {
-    return null;
-  }
-}
-async function readKeychainSecret() {
-  const { stdout } = await execFileAsync("security", [
-    "find-generic-password",
-    "-s",
-    KEYCHAIN_SERVICE,
-    "-a",
-    KEYCHAIN_ACCOUNT,
-    "-w"
-  ]);
-  return stdout.trim() || null;
-}
-function fallbackSessionPath() {
-  const base = process.env.PERCH_CLI_AUTH_DIR?.trim() || path15.join(os3.homedir(), ".perch");
-  return path15.join(base, "cli-auth-session.json");
-}
-async function readFallbackSecret() {
-  return await fs13.readFile(fallbackSessionPath(), "utf8");
-}
-async function writeFallbackSecret(raw) {
-  const filePath = fallbackSessionPath();
-  await fs13.mkdir(path15.dirname(filePath), { recursive: true, mode: 448 });
-  await fs13.writeFile(filePath, raw, { mode: 384 });
-}
-var execFileAsync, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT;
-var init_cliAuthSession = __esm({
-  "features/perchTerminal/runtime/cliHost/cliAuthSession.ts"() {
-    "use strict";
-    execFileAsync = promisify(execFile);
-    KEYCHAIN_SERVICE = "app.perchai.cli-auth";
-    KEYCHAIN_ACCOUNT = "default";
-  }
-});
-
-// features/perchTerminal/runtime/cliHost/modelConnection.ts
-async function connectCliModelProxy(input = {}) {
-  const storedSession = input.storedSession === void 0 ? await readStoredCliAuthSession() : input.storedSession;
-  const usableStoredSession = isStoredCliAuthSessionUsable(storedSession) ? storedSession : null;
-  const appUrl = resolveCliAppUrl(input.appUrl, usableStoredSession?.appUrl ?? null);
-  if (!appUrl) return noCliModelConnection();
-  if (!usableStoredSession?.accessToken) return noCliModelConnection(appUrl);
-  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") return noCliModelConnection(appUrl);
-  const selection = await fetchPublicModelDefaultSelection(
-    appUrl,
-    fetchImpl,
-    usableStoredSession?.accessToken ?? null
-  );
-  if (!selection) return noCliModelConnection(appUrl);
-  const priorProxy = process.env[MODEL_PROXY_ENV];
-  const priorToken = process.env[MODEL_PROXY_TOKEN_ENV];
-  process.env[MODEL_PROXY_ENV] = appUrl;
-  if (usableStoredSession?.accessToken) {
-    process.env[MODEL_PROXY_TOKEN_ENV] = usableStoredSession.accessToken;
-  }
-  return {
-    appUrl,
-    authenticated: !!usableStoredSession?.accessToken,
-    userId: usableStoredSession?.userId ?? null,
-    email: usableStoredSession?.email ?? null,
-    founderModelSelection: selection,
-    restore: () => {
-      if (priorProxy === void 0) {
-        delete process.env[MODEL_PROXY_ENV];
-      } else {
-        process.env[MODEL_PROXY_ENV] = priorProxy;
-      }
-      if (priorToken === void 0) {
-        delete process.env[MODEL_PROXY_TOKEN_ENV];
-      } else {
-        process.env[MODEL_PROXY_TOKEN_ENV] = priorToken;
-      }
-    }
-  };
-}
-function resolveCliAppUrl(explicit, stored) {
-  const raw = explicit?.trim() || process.env[CLI_APP_URL_ENV]?.trim() || process.env[FALLBACK_APP_URL_ENV]?.trim() || stored?.trim() || DEFAULT_CLI_APP_URL;
-  if (!raw) return null;
-  const withProtocol = /^https?:\/\//i.test(raw) ? raw : `http://${raw}`;
-  try {
-    const url = new URL(withProtocol);
-    url.pathname = url.pathname.replace(/\/+$/, "");
-    url.search = "";
-    url.hash = "";
-    return url.toString().replace(/\/+$/, "");
-  } catch {
-    return null;
-  }
-}
-async function fetchPublicModelDefaultSelection(appUrl, fetchImpl, accessToken) {
-  const url = `${appUrl}/api/perch-terminal/public-model-default`;
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 3500);
-  try {
-    const response = await fetchImpl(url, {
-      method: "GET",
-      headers: {
-        Accept: "application/json",
-        ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {}
-      },
-      signal: controller.signal
-    });
-    if (!response.ok) return null;
-    const body = await response.json();
-    if (!body || typeof body !== "object") return null;
-    const record = body;
-    if (record.ok !== true) return null;
-    return parsePublicModelDefaultPayload({ selection: record.selection }).selection;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-function noCliModelConnection(appUrl = null) {
-  return {
-    appUrl,
-    authenticated: false,
-    userId: null,
-    email: null,
-    founderModelSelection: null,
-    restore: () => {
-    }
-  };
-}
-var MODEL_PROXY_ENV, MODEL_PROXY_TOKEN_ENV, CLI_APP_URL_ENV, FALLBACK_APP_URL_ENV, DEFAULT_CLI_APP_URL;
-var init_modelConnection = __esm({
-  "features/perchTerminal/runtime/cliHost/modelConnection.ts"() {
-    "use strict";
-    init_publicModelDefault();
-    init_cliAuthSession();
-    MODEL_PROXY_ENV = "PERCH_MODEL_CALL_PROXY_URL";
-    MODEL_PROXY_TOKEN_ENV = "PERCH_MODEL_CALL_PROXY_TOKEN";
-    CLI_APP_URL_ENV = "PERCH_CLI_APP_URL";
-    FALLBACK_APP_URL_ENV = "PERCH_APP_URL";
-    DEFAULT_CLI_APP_URL = "https://app.perchai.app";
-  }
-});
-
-// features/perchTerminal/runtime/cliHost/cliStandaloneOAuth.ts
-import { execFile as execFile2 } from "node:child_process";
-import http from "node:http";
-import { promisify as promisify2 } from "node:util";
-async function runCliStandaloneOAuthLogin(input) {
-  const appUrl = resolveCliAppUrl(input.appUrl, null);
-  if (!appUrl) {
-    return { ok: false, code: "invalid_app_url", error: "Invalid Perch app URL." };
-  }
-  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") {
-    return { ok: false, code: "fetch_unavailable", error: "This Node runtime does not expose fetch." };
-  }
-  const config = await fetchCliAuthConfig(appUrl, fetchImpl);
-  if (!config.ok || !config.supabaseUrl || !config.supabaseAnonKey) {
-    return {
-      ok: false,
-      code: "auth_config_unavailable",
-      error: "The Perch app did not return CLI auth configuration."
-    };
-  }
-  const provider = selectOAuthProvider(config.providers ?? [], input.provider);
-  if (!provider) {
-    return {
-      ok: false,
-      code: "oauth_provider_unavailable",
-      error: "No supported CLI OAuth provider is enabled for this Perch app."
-    };
-  }
-  const callback = await createOAuthCallbackServer({
-    host: config.redirectHost?.trim() || "127.0.0.1",
-    timeoutMs: input.timeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS
-  });
-  try {
-    const memoryStorage = createMemoryAuthStorage();
-    const supabase = createClient(config.supabaseUrl, config.supabaseAnonKey, {
-      auth: {
-        flowType: "pkce",
-        autoRefreshToken: false,
-        detectSessionInUrl: false,
-        persistSession: true,
-        storage: memoryStorage
-      }
-    });
-    const { data, error } = await supabase.auth.signInWithOAuth({
-      provider,
-      options: {
-        redirectTo: callback.redirectTo,
-        skipBrowserRedirect: true,
-        data: { signup_source: "cli" }
-      }
-    });
-    if (error || !data.url) {
-      return {
-        ok: false,
-        code: "oauth_start_failed",
-        error: error?.message ?? "Supabase did not return an OAuth URL."
-      };
-    }
-    await (input.openExternal ?? openExternal)(data.url);
-    const callbackResult = await callback.waitForCode();
-    if (!callbackResult.ok) {
-      return callbackResult;
-    }
-    const exchanged = await supabase.auth.exchangeCodeForSession(callbackResult.code);
-    if (exchanged.error || !exchanged.data.session) {
-      return {
-        ok: false,
-        code: "oauth_exchange_failed",
-        error: exchanged.error?.message ?? "Supabase did not return a CLI session."
-      };
-    }
-    const session = storedSessionFromSupabaseSession({
-      appUrl,
-      accessToken: exchanged.data.session.access_token,
-      refreshToken: exchanged.data.session.refresh_token,
-      expiresAt: exchanged.data.session.expires_at ?? null,
-      userId: exchanged.data.session.user.id,
-      email: exchanged.data.session.user.email ?? null
-    });
-    await writeStoredCliAuthSession(session);
-    return { ok: true, session };
-  } finally {
-    await callback.close();
-  }
-}
-async function fetchCliAuthConfig(appUrl, fetchImpl = globalThis.fetch) {
-  const response = await fetchImpl(`${appUrl}/api/perch-terminal/cli-auth/config`, {
-    method: "GET",
-    headers: { Accept: "application/json" }
-  });
-  if (!response.ok) return { ok: false };
-  return await response.json();
-}
-function selectOAuthProvider(providers, preferred) {
-  const available = new Set(providers);
-  if (preferred && available.has(preferred)) return preferred;
-  if (available.has("google")) return "google";
-  if (available.has("github")) return "github";
-  return null;
-}
-function storedSessionFromSupabaseSession(input) {
-  return {
-    version: 1,
-    appUrl: input.appUrl,
-    accessToken: input.accessToken,
-    refreshToken: input.refreshToken ?? null,
-    expiresAt: input.expiresAt ?? null,
-    userId: input.userId ?? null,
-    email: input.email ?? null,
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function createMemoryAuthStorage() {
-  const values2 = /* @__PURE__ */ new Map();
-  return {
-    getItem: (key) => values2.get(key) ?? null,
-    setItem: (key, value) => {
-      values2.set(key, value);
-    },
-    removeItem: (key) => {
-      values2.delete(key);
-    }
-  };
-}
-async function createOAuthCallbackServer(input) {
-  let resolveResult = null;
-  const resultPromise = new Promise((resolve5) => {
-    resolveResult = resolve5;
-  });
-  const server = http.createServer((request, response) => {
-    const requestUrl = new URL(request.url ?? "/", `http://${input.host}`);
-    if (requestUrl.pathname !== CALLBACK_PATH) {
-      response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-      response.end("Not found");
-      return;
-    }
-    const code = requestUrl.searchParams.get("code");
-    const error = requestUrl.searchParams.get("error_description") ?? requestUrl.searchParams.get("error");
-    if (!code) {
-      response.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-      response.end(renderCallbackHtml(false));
-      resolveResult?.({
-        ok: false,
-        code: "oauth_callback_missing_code",
-        error: error ?? "OAuth callback did not include a code."
-      });
-      resolveResult = null;
-      return;
-    }
-    response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-    response.end(renderCallbackHtml(true));
-    resolveResult?.({ ok: true, code });
-    resolveResult = null;
-  });
-  await new Promise((resolve5, reject2) => {
-    server.once("error", reject2);
-    server.listen(0, input.host, () => {
-      server.off("error", reject2);
-      resolve5();
-    });
-  });
-  const address = server.address();
-  const redirectTo = `http://${input.host}:${address.port}${CALLBACK_PATH}`;
-  const timeout = setTimeout(() => {
-    resolveResult?.({
-      ok: false,
-      code: "oauth_timeout",
-      error: "Timed out waiting for browser sign-in to complete."
-    });
-    resolveResult = null;
-  }, input.timeoutMs);
-  return {
-    redirectTo,
-    waitForCode: async () => resultPromise,
-    close: async () => {
-      clearTimeout(timeout);
-      await new Promise((resolve5) => server.close(() => resolve5()));
-    }
-  };
-}
-function renderCallbackHtml(ok) {
-  const title = ok ? "Perch CLI signed in" : "Perch CLI sign-in failed";
-  const message = ok ? "You can close this tab and return to your terminal." : "Return to your terminal and try again.";
-  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body style="font-family:system-ui;padding:32px;background:#100d0b;color:#fff8f0"><h1>${title}</h1><p>${message}</p></body></html>`;
-}
-async function openExternal(url) {
-  if (process.platform === "darwin") {
-    await execFileAsync2("open", [url]);
-  } else if (process.platform === "win32") {
-    await execFileAsync2("cmd", ["/c", "start", "", url]);
-  } else {
-    await execFileAsync2("xdg-open", [url]);
-  }
-}
-var execFileAsync2, DEFAULT_LOGIN_TIMEOUT_MS, CALLBACK_PATH;
-var init_cliStandaloneOAuth = __esm({
-  "features/perchTerminal/runtime/cliHost/cliStandaloneOAuth.ts"() {
-    "use strict";
-    init_dist4();
-    init_modelConnection();
-    init_cliAuthSession();
-    execFileAsync2 = promisify2(execFile2);
-    DEFAULT_LOGIN_TIMEOUT_MS = 12e4;
-    CALLBACK_PATH = "/callback";
-  }
-});
-
 // lib/perchTerminal/statusLabels.ts
 function sectionLabel(sectionKey) {
   if (STATUS_LABELS[sectionKey]) return STATUS_LABELS[sectionKey];
@@ -234873,6 +235595,17 @@ function claimFirstRun(dir = stateDir()) {
     return false;
   }
 }
+function claimFirstPrompt(dir = stateDir()) {
+  const file = path17.join(dir, "cli-first-prompt");
+  try {
+    if (fs15.existsSync(file)) return false;
+    fs15.mkdirSync(dir, { recursive: true });
+    fs15.writeFileSync(file, (/* @__PURE__ */ new Date()).toISOString());
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function postCapture(event, properties) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS2);
@@ -234899,6 +235632,17 @@ function captureCliFirstRun(version4) {
   if (!claimFirstRun()) return;
   void postCapture("cli_first_run", { version: version4, platform: process.platform });
 }
+function captureCliSessionStarted() {
+  if (!POSTHOG_KEY || telemetryDisabled()) return;
+  void postCapture("cli_session_started", { platform: process.platform });
+}
+function captureCliMessageSent() {
+  if (!POSTHOG_KEY || telemetryDisabled()) return;
+  void postCapture("message_sent", { surface: "cli" });
+  if (claimFirstPrompt()) {
+    void postCapture("first_message", { surface: "cli" });
+  }
+}
 var POSTHOG_KEY, POSTHOG_HOST, FETCH_TIMEOUT_MS2;
 var init_cliAnalytics = __esm({
   "features/perchTerminal/runtime/cliHost/cliAnalytics.ts"() {
@@ -289205,7 +289949,7 @@ function flockEventToCliRow(event) {
       return {
         id: `flock-${event.flockId}-${event.flockWorkerId}`,
         text: `${event.displayName} \xB7 ${event.nickname} \xB7 ${FLOCK_STATUS_LABELS[event.status] ?? event.status}`,
-        tone: event.status === "done" ? "success" : event.status === "failed" ? "danger" : "muted"
+        tone: event.status === "done" ? "success" : event.status === "failed" || event.status === "blocked" ? "danger" : "muted"
       };
     case "flock_run_completed":
       return {
@@ -289326,6 +290070,7 @@ ${HELP_TEXT}`);
           recentMessages: nextRecentMessages,
           contextSnapshot: result3.contextSnapshot ?? persisted?.contextSnapshot ?? null
         });
+        captureCliMessageSent();
         return cliExitCodeForTurn(result3);
       } finally {
         connection.restore();
@@ -289626,6 +290371,7 @@ async function runReadlineInteractivePerchCli(writer, deps, options) {
     terminal: true
   });
   const state = createInteractiveCliState(options);
+  captureCliSessionStarted();
   const connectModelProxy = deps.connectModelProxy ?? connectCliModelProxy;
   let connection = await connectModelProxy({ appUrl: state.appUrl });
   if (!state.appUrl && connection.appUrl) state.appUrl = connection.appUrl;
@@ -289686,6 +290432,7 @@ async function runReadlineInteractivePerchCli(writer, deps, options) {
     });
     if (!opts.systemInitiated) {
       appendRecentMessage(state.recentMessages, "user", turnPrompt);
+      captureCliMessageSent();
     }
     if (result2.assistantText.trim()) {
       appendRecentMessage(state.recentMessages, "assistant", result2.assistantText.trim());
@@ -289778,6 +290525,7 @@ async function runInkInteractivePerchCli(writer, deps, options) {
     const runTurn = deps.runCliTurn ?? runPerchCliTurn;
     const updateNotice = resolveUpdateNotice(CLI_PACKAGE_VERSION);
     captureCliFirstRun(CLI_PACKAGE_VERSION);
+    captureCliSessionStarted();
     const instance = Ink2.render(
       React11.createElement(function PerchInkApp() {
         const app = Ink2.useApp();
@@ -290399,6 +291147,7 @@ async function runInkInteractivePerchCli(writer, deps, options) {
             }
             if (!systemInitiated) {
               appendRecentMessage(state.recentMessages, "user", prompt);
+              captureCliMessageSent();
             }
             if (assistantText) appendRecentMessage(state.recentMessages, "assistant", assistantText);
             trimRecentMessages(state.recentMessages);