perchai-cli 2.4.49 → 2.4.51

package/dist/perch.mjs

@@ -75918,6 +75918,7 @@ function isTurnAbortedError(error) {
 var TURN_STOPPED_BY_USER_MESSAGE;
 var init_turnAbort = __esm({
   "features/perchTerminal/runtime/turnAbort.ts"() {
+    "use strict";
     TURN_STOPPED_BY_USER_MESSAGE = "Turn stopped by user.";
   }
 });
@@ -76223,6 +76224,7 @@ function getToolDisplayName(toolName) {
 var NON_MODULE_TOOL_OWNERS, TOOL_RISK, TOOL_DISPLAY_NAMES;
 var init_catalog = __esm({
   "features/perchTerminal/runtime/toolSystem/catalog.ts"() {
+    "use strict";
     init_toolNames();
     NON_MODULE_TOOL_OWNERS = {
       [TOOL_NAMES.listSources]: "lane",
@@ -91827,6 +91829,7 @@ function listFinancialPlaybooks() {
 var AP_AUDIT_PACKET_DEF, PLAYBOOKS;
 var init_registry2 = __esm({
   "features/perchTerminal/runtime/financialPlaybooks/registry.ts"() {
+    "use strict";
     init_managedWorkflowRegistry2();
     init_toolNames();
     AP_AUDIT_PACKET_DEF = {
@@ -119507,6 +119510,21 @@ var init_browserSession = __esm({
   }
 });
 
+// features/perchTerminal/runtime/cliAuthRefreshRegistry.ts
+function setCliModelProxyAuthRefresher(fn) {
+  refresher = fn;
+}
+function refreshCliModelProxyAuth() {
+  return refresher ? refresher() : Promise.resolve(null);
+}
+var refresher;
+var init_cliAuthRefreshRegistry = __esm({
+  "features/perchTerminal/runtime/cliAuthRefreshRegistry.ts"() {
+    "use strict";
+    refresher = null;
+  }
+});
+
 // features/perchTerminal/runtime/roostUserSelectionClient.ts
 function coerceSelection(raw) {
   const choice = normalizeRoostModelChoice(raw?.choice);
@@ -119546,507 +119564,6 @@ var init_roostUserSelectionClient = __esm({
   }
 });
 
-// features/perchTerminal/runtime/cliHost/cliAuthSession.ts
-var cliAuthSession_exports = {};
-__export(cliAuthSession_exports, {
-  clearStoredCliAuthSession: () => clearStoredCliAuthSession,
-  isStoredCliAuthSessionUsable: () => isStoredCliAuthSessionUsable,
-  parseStoredCliAuthSession: () => parseStoredCliAuthSession,
-  readStoredCliAuthSession: () => readStoredCliAuthSession,
-  writeStoredCliAuthSession: () => writeStoredCliAuthSession
-});
-import { execFile } from "node:child_process";
-import fs9 from "node:fs/promises";
-import os from "node:os";
-import path10 from "node:path";
-import { promisify } from "node:util";
-async function readStoredCliAuthSession() {
-  const raw = shouldUseFallbackAuthFile() ? await readFallbackSecret().catch(() => null) : process.platform === "darwin" ? await readKeychainSecret().catch(() => null) : await readFallbackSecret().catch(() => null);
-  return parseStoredCliAuthSession(raw);
-}
-async function writeStoredCliAuthSession(session) {
-  const raw = JSON.stringify(session);
-  if (process.platform === "darwin" && !shouldUseFallbackAuthFile()) {
-    await execFileAsync("security", [
-      "add-generic-password",
-      "-U",
-      "-s",
-      KEYCHAIN_SERVICE,
-      "-a",
-      KEYCHAIN_ACCOUNT,
-      "-w",
-      raw
-    ]);
-    return;
-  }
-  await writeFallbackSecret(raw);
-}
-async function clearStoredCliAuthSession() {
-  if (process.platform === "darwin" && !shouldUseFallbackAuthFile()) {
-    await execFileAsync("security", [
-      "delete-generic-password",
-      "-s",
-      KEYCHAIN_SERVICE,
-      "-a",
-      KEYCHAIN_ACCOUNT
-    ]).catch(() => void 0);
-    return;
-  }
-  await fs9.rm(fallbackSessionPath(), { force: true }).catch(() => void 0);
-}
-function shouldUseFallbackAuthFile() {
-  return Boolean(process.env.PERCH_CLI_AUTH_DIR?.trim());
-}
-function isStoredCliAuthSessionUsable(session, nowSeconds = Math.floor(Date.now() / 1e3)) {
-  if (!session?.accessToken?.trim()) return false;
-  if (!session.appUrl?.trim()) return false;
-  if (!session.expiresAt) return true;
-  return session.expiresAt > nowSeconds + 90;
-}
-function parseStoredCliAuthSession(raw) {
-  if (!raw?.trim()) return null;
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed.version !== 1) return null;
-    if (!parsed.appUrl || !parsed.accessToken || !parsed.updatedAt) return null;
-    return {
-      version: 1,
-      appUrl: parsed.appUrl,
-      accessToken: parsed.accessToken,
-      refreshToken: parsed.refreshToken ?? null,
-      expiresAt: typeof parsed.expiresAt === "number" ? parsed.expiresAt : null,
-      userId: parsed.userId ?? null,
-      email: parsed.email ?? null,
-      updatedAt: parsed.updatedAt
-    };
-  } catch {
-    return null;
-  }
-}
-async function readKeychainSecret() {
-  const { stdout } = await execFileAsync("security", [
-    "find-generic-password",
-    "-s",
-    KEYCHAIN_SERVICE,
-    "-a",
-    KEYCHAIN_ACCOUNT,
-    "-w"
-  ]);
-  return stdout.trim() || null;
-}
-function fallbackSessionPath() {
-  const base = process.env.PERCH_CLI_AUTH_DIR?.trim() || path10.join(os.homedir(), ".perch");
-  return path10.join(base, "cli-auth-session.json");
-}
-async function readFallbackSecret() {
-  return await fs9.readFile(fallbackSessionPath(), "utf8");
-}
-async function writeFallbackSecret(raw) {
-  const filePath = fallbackSessionPath();
-  await fs9.mkdir(path10.dirname(filePath), { recursive: true, mode: 448 });
-  await fs9.writeFile(filePath, raw, { mode: 384 });
-}
-var execFileAsync, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT;
-var init_cliAuthSession = __esm({
-  "features/perchTerminal/runtime/cliHost/cliAuthSession.ts"() {
-    "use strict";
-    execFileAsync = promisify(execFile);
-    KEYCHAIN_SERVICE = "app.perchai.cli-auth";
-    KEYCHAIN_ACCOUNT = "default";
-  }
-});
-
-// features/perchTerminal/runtime/publicModelDefault.ts
-function parsePublicModelDefaultPayload(value) {
-  const raw = value && typeof value === "object" ? value : {};
-  const selection = sanitizeFounderModelSelection(
-    raw.selection ?? DEFAULT_FOUNDER_MODEL_SELECTION
-  );
-  return {
-    selection,
-    updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : null,
-    updatedBy: typeof raw.updatedBy === "string" ? raw.updatedBy : null
-  };
-}
-var init_publicModelDefault = __esm({
-  "features/perchTerminal/runtime/publicModelDefault.ts"() {
-    "use strict";
-    init_modelRegistry();
-  }
-});
-
-// features/perchTerminal/runtime/cliHost/modelConnection.ts
-async function connectCliModelProxy(input = {}) {
-  const storedSession = input.storedSession === void 0 ? await readStoredCliAuthSession() : input.storedSession;
-  const usableStoredSession = await ensureFreshCliAuthSession({
-    session: storedSession,
-    fetchImpl: input.fetchImpl
-  });
-  const appUrl = resolveCliAppUrl(input.appUrl, usableStoredSession?.appUrl ?? null);
-  if (!appUrl) return noCliModelConnection();
-  if (!usableStoredSession?.accessToken) return noCliModelConnection(appUrl);
-  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") return noCliModelConnection(appUrl);
-  const selection = await fetchPublicModelDefaultSelection(
-    appUrl,
-    fetchImpl,
-    usableStoredSession?.accessToken ?? null
-  );
-  if (!selection) return noCliModelConnection(appUrl);
-  const priorProxy = process.env[MODEL_PROXY_ENV];
-  const priorToken = process.env[MODEL_PROXY_TOKEN_ENV];
-  process.env[MODEL_PROXY_ENV] = appUrl;
-  if (usableStoredSession?.accessToken) {
-    process.env[MODEL_PROXY_TOKEN_ENV] = usableStoredSession.accessToken;
-  }
-  return {
-    appUrl,
-    authenticated: !!usableStoredSession?.accessToken,
-    userId: usableStoredSession?.userId ?? null,
-    email: usableStoredSession?.email ?? null,
-    founderModelSelection: selection,
-    restore: () => {
-      if (priorProxy === void 0) {
-        delete process.env[MODEL_PROXY_ENV];
-      } else {
-        process.env[MODEL_PROXY_ENV] = priorProxy;
-      }
-      if (priorToken === void 0) {
-        delete process.env[MODEL_PROXY_TOKEN_ENV];
-      } else {
-        process.env[MODEL_PROXY_TOKEN_ENV] = priorToken;
-      }
-    }
-  };
-}
-function resolveCliAppUrl(explicit, stored) {
-  const raw = explicit?.trim() || process.env[CLI_APP_URL_ENV]?.trim() || process.env[FALLBACK_APP_URL_ENV]?.trim() || stored?.trim() || DEFAULT_CLI_APP_URL;
-  if (!raw) return null;
-  const withProtocol = /^https?:\/\//i.test(raw) ? raw : `http://${raw}`;
-  try {
-    const url = new URL(withProtocol);
-    url.pathname = url.pathname.replace(/\/+$/, "");
-    url.search = "";
-    url.hash = "";
-    return url.toString().replace(/\/+$/, "");
-  } catch {
-    return null;
-  }
-}
-async function fetchPublicModelDefaultSelection(appUrl, fetchImpl, accessToken) {
-  const url = `${appUrl}/api/perch-terminal/public-model-default`;
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 3500);
-  try {
-    const response = await fetchImpl(url, {
-      method: "GET",
-      headers: {
-        Accept: "application/json",
-        ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {}
-      },
-      signal: controller.signal
-    });
-    if (!response.ok) return null;
-    const body = await response.json();
-    if (!body || typeof body !== "object") return null;
-    const record = body;
-    if (record.ok !== true) return null;
-    return parsePublicModelDefaultPayload({ selection: record.selection }).selection;
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-function noCliModelConnection(appUrl = null) {
-  return {
-    appUrl,
-    authenticated: false,
-    userId: null,
-    email: null,
-    founderModelSelection: null,
-    restore: () => {
-    }
-  };
-}
-var MODEL_PROXY_ENV, MODEL_PROXY_TOKEN_ENV, CLI_APP_URL_ENV, FALLBACK_APP_URL_ENV, DEFAULT_CLI_APP_URL;
-var init_modelConnection = __esm({
-  "features/perchTerminal/runtime/cliHost/modelConnection.ts"() {
-    "use strict";
-    init_publicModelDefault();
-    init_cliAuthSession();
-    init_cliAuthRefresh();
-    MODEL_PROXY_ENV = "PERCH_MODEL_CALL_PROXY_URL";
-    MODEL_PROXY_TOKEN_ENV = "PERCH_MODEL_CALL_PROXY_TOKEN";
-    CLI_APP_URL_ENV = "PERCH_CLI_APP_URL";
-    FALLBACK_APP_URL_ENV = "PERCH_APP_URL";
-    DEFAULT_CLI_APP_URL = "https://app.perchai.app";
-  }
-});
-
-// features/perchTerminal/runtime/cliHost/cliStandaloneOAuth.ts
-import { execFile as execFile2 } from "node:child_process";
-import http from "node:http";
-import { promisify as promisify2 } from "node:util";
-async function runCliStandaloneOAuthLogin(input) {
-  const appUrl = resolveCliAppUrl(input.appUrl, null);
-  if (!appUrl) {
-    return { ok: false, code: "invalid_app_url", error: "Invalid Perch app URL." };
-  }
-  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") {
-    return { ok: false, code: "fetch_unavailable", error: "This Node runtime does not expose fetch." };
-  }
-  const config = await fetchCliAuthConfig(appUrl, fetchImpl);
-  if (!config.ok || !config.supabaseUrl || !config.supabaseAnonKey) {
-    return {
-      ok: false,
-      code: "auth_config_unavailable",
-      error: "The Perch app did not return CLI auth configuration."
-    };
-  }
-  const provider = selectOAuthProvider(config.providers ?? [], input.provider);
-  if (!provider) {
-    return {
-      ok: false,
-      code: "oauth_provider_unavailable",
-      error: "No supported CLI OAuth provider is enabled for this Perch app."
-    };
-  }
-  const callback = await createOAuthCallbackServer({
-    host: config.redirectHost?.trim() || "127.0.0.1",
-    timeoutMs: input.timeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS
-  });
-  try {
-    const memoryStorage = createMemoryAuthStorage();
-    const supabase = createClient(config.supabaseUrl, config.supabaseAnonKey, {
-      auth: {
-        flowType: "pkce",
-        autoRefreshToken: false,
-        detectSessionInUrl: false,
-        persistSession: true,
-        storage: memoryStorage
-      }
-    });
-    const { data, error } = await supabase.auth.signInWithOAuth({
-      provider,
-      options: {
-        redirectTo: callback.redirectTo,
-        skipBrowserRedirect: true,
-        data: { signup_source: "cli" }
-      }
-    });
-    if (error || !data.url) {
-      return {
-        ok: false,
-        code: "oauth_start_failed",
-        error: error?.message ?? "Supabase did not return an OAuth URL."
-      };
-    }
-    await (input.openExternal ?? openExternal)(data.url);
-    const callbackResult = await callback.waitForCode();
-    if (!callbackResult.ok) {
-      return callbackResult;
-    }
-    const exchanged = await supabase.auth.exchangeCodeForSession(callbackResult.code);
-    if (exchanged.error || !exchanged.data.session) {
-      return {
-        ok: false,
-        code: "oauth_exchange_failed",
-        error: exchanged.error?.message ?? "Supabase did not return a CLI session."
-      };
-    }
-    const session = storedSessionFromSupabaseSession({
-      appUrl,
-      accessToken: exchanged.data.session.access_token,
-      refreshToken: exchanged.data.session.refresh_token,
-      expiresAt: exchanged.data.session.expires_at ?? null,
-      userId: exchanged.data.session.user.id,
-      email: exchanged.data.session.user.email ?? null
-    });
-    await writeStoredCliAuthSession(session);
-    return { ok: true, session };
-  } finally {
-    await callback.close();
-  }
-}
-async function fetchCliAuthConfig(appUrl, fetchImpl = globalThis.fetch) {
-  const response = await fetchImpl(`${appUrl}/api/perch-terminal/cli-auth/config`, {
-    method: "GET",
-    headers: { Accept: "application/json" }
-  });
-  if (!response.ok) return { ok: false };
-  return await response.json();
-}
-function selectOAuthProvider(providers, preferred) {
-  const available = new Set(providers);
-  if (preferred && available.has(preferred)) return preferred;
-  if (available.has("google")) return "google";
-  if (available.has("github")) return "github";
-  return null;
-}
-function storedSessionFromSupabaseSession(input) {
-  return {
-    version: 1,
-    appUrl: input.appUrl,
-    accessToken: input.accessToken,
-    refreshToken: input.refreshToken ?? null,
-    expiresAt: input.expiresAt ?? null,
-    userId: input.userId ?? null,
-    email: input.email ?? null,
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function createMemoryAuthStorage() {
-  const values2 = /* @__PURE__ */ new Map();
-  return {
-    getItem: (key) => values2.get(key) ?? null,
-    setItem: (key, value) => {
-      values2.set(key, value);
-    },
-    removeItem: (key) => {
-      values2.delete(key);
-    }
-  };
-}
-async function createOAuthCallbackServer(input) {
-  let resolveResult = null;
-  const resultPromise = new Promise((resolve5) => {
-    resolveResult = resolve5;
-  });
-  const server = http.createServer((request, response) => {
-    const requestUrl = new URL(request.url ?? "/", `http://${input.host}`);
-    if (requestUrl.pathname !== CALLBACK_PATH) {
-      response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-      response.end("Not found");
-      return;
-    }
-    const code = requestUrl.searchParams.get("code");
-    const error = requestUrl.searchParams.get("error_description") ?? requestUrl.searchParams.get("error");
-    if (!code) {
-      response.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
-      response.end(renderCallbackHtml(false));
-      resolveResult?.({
-        ok: false,
-        code: "oauth_callback_missing_code",
-        error: error ?? "OAuth callback did not include a code."
-      });
-      resolveResult = null;
-      return;
-    }
-    response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-    response.end(renderCallbackHtml(true));
-    resolveResult?.({ ok: true, code });
-    resolveResult = null;
-  });
-  await new Promise((resolve5, reject2) => {
-    server.once("error", reject2);
-    server.listen(0, input.host, () => {
-      server.off("error", reject2);
-      resolve5();
-    });
-  });
-  const address = server.address();
-  const redirectTo = `http://${input.host}:${address.port}${CALLBACK_PATH}`;
-  const timeout = setTimeout(() => {
-    resolveResult?.({
-      ok: false,
-      code: "oauth_timeout",
-      error: "Timed out waiting for browser sign-in to complete."
-    });
-    resolveResult = null;
-  }, input.timeoutMs);
-  return {
-    redirectTo,
-    waitForCode: async () => resultPromise,
-    close: async () => {
-      clearTimeout(timeout);
-      await new Promise((resolve5) => server.close(() => resolve5()));
-    }
-  };
-}
-function renderCallbackHtml(ok) {
-  const title = ok ? "Perch CLI signed in" : "Perch CLI sign-in failed";
-  const message = ok ? "You can close this tab and return to your terminal." : "Return to your terminal and try again.";
-  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body style="font-family:system-ui;padding:32px;background:#100d0b;color:#fff8f0"><h1>${title}</h1><p>${message}</p></body></html>`;
-}
-async function openExternal(url) {
-  if (process.platform === "darwin") {
-    await execFileAsync2("open", [url]);
-  } else if (process.platform === "win32") {
-    await execFileAsync2("cmd", ["/c", "start", "", url]);
-  } else {
-    await execFileAsync2("xdg-open", [url]);
-  }
-}
-var execFileAsync2, DEFAULT_LOGIN_TIMEOUT_MS, CALLBACK_PATH;
-var init_cliStandaloneOAuth = __esm({
-  "features/perchTerminal/runtime/cliHost/cliStandaloneOAuth.ts"() {
-    "use strict";
-    init_dist4();
-    init_modelConnection();
-    init_cliAuthSession();
-    execFileAsync2 = promisify2(execFile2);
-    DEFAULT_LOGIN_TIMEOUT_MS = 12e4;
-    CALLBACK_PATH = "/callback";
-  }
-});
-
-// features/perchTerminal/runtime/cliHost/cliAuthRefresh.ts
-var cliAuthRefresh_exports = {};
-__export(cliAuthRefresh_exports, {
-  ensureFreshCliAuthSession: () => ensureFreshCliAuthSession
-});
-async function ensureFreshCliAuthSession(input) {
-  const session = input.session;
-  if (!session?.accessToken?.trim()) return null;
-  const nowSeconds = Math.floor(Date.now() / 1e3);
-  const stillUsable = !session.expiresAt || session.expiresAt > nowSeconds + 90;
-  if (stillUsable && !input.forceRefresh) return session;
-  if (!session.refreshToken?.trim()) return null;
-  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") return null;
-  const appUrl = session.appUrl?.trim();
-  if (!appUrl) return null;
-  const config = await fetchCliAuthConfig(appUrl, fetchImpl).catch(() => ({ ok: false }));
-  if (!config.ok || !config.supabaseUrl || !config.supabaseAnonKey) return null;
-  const supabase = createClient(config.supabaseUrl, config.supabaseAnonKey, {
-    auth: {
-      autoRefreshToken: false,
-      detectSessionInUrl: false,
-      persistSession: false
-    }
-  });
-  try {
-    const { data, error } = await supabase.auth.refreshSession({
-      refresh_token: session.refreshToken
-    });
-    if (error || !data.session) return null;
-    const refreshed = {
-      version: 1,
-      appUrl: session.appUrl,
-      accessToken: data.session.access_token,
-      refreshToken: data.session.refresh_token ?? session.refreshToken,
-      expiresAt: data.session.expires_at ?? null,
-      userId: data.session.user?.id ?? session.userId ?? null,
-      email: data.session.user?.email ?? session.email ?? null,
-      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await writeStoredCliAuthSession(refreshed);
-    return refreshed;
-  } catch {
-    return null;
-  }
-}
-var init_cliAuthRefresh = __esm({
-  "features/perchTerminal/runtime/cliHost/cliAuthRefresh.ts"() {
-    "use strict";
-    init_dist4();
-    init_cliStandaloneOAuth();
-    init_cliAuthSession();
-  }
-});
-
 // features/perchTerminal/runtime/modelRouter.ts
 function roostUserSelectionBodyFields() {
   const selection = getEffectiveRoostUserSelection();
@@ -120344,17 +119861,7 @@ async function syncModelProxyAuthAfter401() {
     await syncBrowserAuthSession();
     return null;
   }
-  const { readStoredCliAuthSession: readStoredCliAuthSession2 } = await Promise.resolve().then(() => (init_cliAuthSession(), cliAuthSession_exports));
-  const { ensureFreshCliAuthSession: ensureFreshCliAuthSession2 } = await Promise.resolve().then(() => (init_cliAuthRefresh(), cliAuthRefresh_exports));
-  const fresh = await ensureFreshCliAuthSession2({
-    session: await readStoredCliAuthSession2(),
-    forceRefresh: true
-  });
-  if (!fresh?.accessToken?.trim()) return null;
-  if (typeof process !== "undefined") {
-    process.env[MODEL_CALL_PROXY_TOKEN_ENV] = fresh.accessToken;
-  }
-  return fresh.accessToken;
+  return refreshCliModelProxyAuth();
 }
 function withModelProxyAuthHeader(init, token) {
   if (!token?.trim()) return init;
@@ -120515,6 +120022,7 @@ var init_modelRouter = __esm({
     init_contextMeter();
     init_inferenceUsageRecorder();
     init_browserSession();
+    init_cliAuthRefreshRegistry();
     init_roostUserSelectionClient();
     init_providerModelStep();
     init_toolCallNormalizer();
@@ -214765,8 +214273,8 @@ var init_barSeries = __esm({
 });
 
 // lib/perchMarketDesk/data/fixtureStore.ts
-import fs10 from "node:fs";
-import path11 from "node:path";
+import fs9 from "node:fs";
+import path10 from "node:path";
 function createFixtureStore(input) {
   const instruments = [...input.instruments].sort((a, b2) => a.ticker.localeCompare(b2.ticker));
   const seriesByTicker = /* @__PURE__ */ new Map();
@@ -214813,22 +214321,22 @@ function createFixtureStore(input) {
   };
 }
 function loadFixtureStoreFromDir(dir) {
-  const instrumentsPath = path11.join(dir, "instruments.json");
-  const instruments = JSON.parse(fs10.readFileSync(instrumentsPath, "utf8"));
+  const instrumentsPath = path10.join(dir, "instruments.json");
+  const instruments = JSON.parse(fs9.readFileSync(instrumentsPath, "utf8"));
   const bars = [];
-  const barsDir = path11.join(dir, "bars");
-  for (const file of fs10.readdirSync(barsDir)) {
+  const barsDir = path10.join(dir, "bars");
+  for (const file of fs9.readdirSync(barsDir)) {
     if (!file.endsWith(".json")) continue;
-    const ticker = path11.basename(file, ".json");
-    const rows = JSON.parse(fs10.readFileSync(path11.join(barsDir, file), "utf8"));
+    const ticker = path10.basename(file, ".json");
+    const rows = JSON.parse(fs9.readFileSync(path10.join(barsDir, file), "utf8"));
     for (const row of rows) bars.push({ ...row, ticker: row.ticker ?? ticker });
   }
   let fundamentals;
-  const fundamentalsPath = path11.join(dir, "fundamentals.json");
-  if (fs10.existsSync(fundamentalsPath)) {
-    fundamentals = JSON.parse(fs10.readFileSync(fundamentalsPath, "utf8"));
+  const fundamentalsPath = path10.join(dir, "fundamentals.json");
+  if (fs9.existsSync(fundamentalsPath)) {
+    fundamentals = JSON.parse(fs9.readFileSync(fundamentalsPath, "utf8"));
   }
-  return createFixtureStore({ instruments, bars, fundamentals, label: `dir:${path11.basename(dir)}` });
+  return createFixtureStore({ instruments, bars, fundamentals, label: `dir:${path10.basename(dir)}` });
 }
 var init_fixtureStore = __esm({
   "lib/perchMarketDesk/data/fixtureStore.ts"() {
@@ -224252,7 +223760,13 @@ async function runFlockTurn(input, deps, options = {}) {
         turnInput: input
       };
       const modelCall = options.plannerModelCall ?? defaultFlockPlannerModelCall(llmCtx);
-      plan = await runLlmFlockPlanner(llmCtx, modelCall).catch(() => null);
+      const plannerTimeoutMs = options.plannerTimeoutMs ?? FLOCK_PLANNER_TIMEOUT_MS;
+      const first2 = await runLlmPlannerWithTimeout(llmCtx, modelCall, plannerTimeoutMs);
+      plan = first2.plan;
+      if (!plan && !first2.timedOut) {
+        const retry = await runLlmPlannerWithTimeout(llmCtx, modelCall, plannerTimeoutMs);
+        plan = retry.plan;
+      }
     }
     if (!plan) {
       plan = (options.planFn ?? planFlock)(task, {
@@ -224356,7 +223870,7 @@ async function runFlockTurn(input, deps, options = {}) {
         toolCallsReserved += reservedToolCalls;
         emitWorkerUpdate(emit, plan, worker, "running");
         try {
-          turnInput = await refreshFlockCliAuth(turnInput);
+          turnInput = deps.refreshTurnInput ? await deps.refreshTurnInput(turnInput) : turnInput;
           const context = contextOverride ?? buildWorkerContext(worker, sharedContext, outputByFlockWorkerId, plan);
           const objective = worker.role === "worker" && contextContainsSources(context) ? `${worker.objective}
 ${FLOCK_GROUNDING_CONTRACT}` : worker.objective;
@@ -224483,14 +223997,25 @@ ${FLOCK_GROUNDING_CONTRACT}` : worker.objective;
     const workersFailed = outcomes.filter((outcome) => outcome.status === "failed").length + workersBlocked;
     const flockStatus = userCancelled || wallTimeHit && workersDone === 0 ? "cancelled" : workersFailed === 0 && workersDone === plan.workers.length ? "completed" : workersDone > 0 ? "partial" : "failed";
     const permissionHint = workersBlocked > 0 && (turnInput.permissionMode ?? "default") === "default" ? "\n\nTip: flock workers inherit default permissions \u2014 run `/permission take_the_wheel` before `/flock` so bash redirects and file writes do not stall on approval gates." : "";
+    const deterministicSummary = buildFlockSummary(
+      plan,
+      [...outcomes, ...revisionOutcomes],
+      flockStatus,
+      toolCallsUsed,
+      wallTimeHit
+    );
+    const synthesisModelCall = options.synthesisModelCall !== void 0 ? options.synthesisModelCall : options.plannerModelCall === void 0 ? defaultFlockSynthesisModelCall(input, plan.flockId) : null;
+    let summaryBody = deterministicSummary;
+    if (synthesisModelCall && !userCancelled && workersDone > 0) {
+      const synthesized = await runFlockSynthesisWithTimeout(
+        synthesisModelCall,
+        buildFlockSynthesisPrompt(task, [...outcomes, ...revisionOutcomes], revisionReport),
+        FLOCK_SYNTHESIS_TIMEOUT_MS
+      );
+      if (synthesized) summaryBody = synthesized;
+    }
     const assistantText = [
-      buildFlockSummary(
-        plan,
-        [...outcomes, ...revisionOutcomes],
-        flockStatus,
-        toolCallsUsed,
-        wallTimeHit
-      ),
+      summaryBody,
       ...buildVerificationSection(revisionReport),
       ...modelOverrides.applied.map(
         (override) => `Model override: ${override.displayName} ran on ${override.label}.`
@@ -224532,6 +224057,89 @@ ${FLOCK_GROUNDING_CONTRACT}` : worker.objective;
     }
   }
 }
+async function runLlmPlannerWithTimeout(ctx, modelCall, timeoutMs) {
+  let timer;
+  const timeout = new Promise((resolve5) => {
+    timer = setTimeout(() => resolve5("timeout"), Math.max(1, timeoutMs));
+  });
+  try {
+    const race = await Promise.race([
+      runLlmFlockPlanner(ctx, modelCall).then((plan) => ({ plan })).catch(() => ({ plan: null })),
+      timeout
+    ]);
+    if (race === "timeout") return { plan: null, timedOut: true };
+    return { plan: race.plan, timedOut: false };
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+function defaultFlockSynthesisModelCall(input, flockId) {
+  return async ({ systemPrompt, userPrompt }) => {
+    const result2 = await runModelToolLoop({
+      lane: "chat",
+      founderModelSelection: input.founderModelSelection ?? null,
+      systemPrompt,
+      messages: [{ role: "user", content: userPrompt }],
+      tools: [],
+      workspaceRoot: input.activeRootPath ?? "",
+      desktopConnected: input.desktopConnected,
+      cliLocalTools: input.cliLocalTools === true,
+      activeRootPath: input.activeRootPath,
+      permissionMode: input.permissionMode,
+      workspaceId: input.workspaceId,
+      threadId: input.threadId,
+      supabaseConfigured: input.supabaseConfigured,
+      supabase: input.supabase ?? null,
+      cliServerAppUrl: input.cliServerAppUrl ?? null,
+      cliServerAccessToken: input.cliServerAccessToken ?? null,
+      runId: flockId,
+      chatMode: "ask",
+      maxIterations: 1,
+      onEvent: () => {
+      }
+    });
+    return { ok: result2.ok, text: result2.text };
+  };
+}
+function buildFlockSynthesisPrompt(task, outcomes, revisionReport) {
+  const results = outcomes.filter((outcome) => outcome.status === "done" && outcome.result).map((outcome) => {
+    const raw = outcome.result?.structuredOutput ?? outcome.result?.summary ?? "";
+    const serialized = typeof raw === "string" ? raw : JSON.stringify(raw);
+    return {
+      role: outcome.worker.displayName,
+      output: serialized.slice(0, FLOCK_SYNTHESIS_MAX_OUTPUT_PER_WORKER)
+    };
+  });
+  const verification = revisionReport ? {
+    verdict: revisionReport.recheckFindings?.verdict ?? revisionReport.findings.verdict ?? null,
+    issues: (revisionReport.recheckFindings?.issues ?? revisionReport.findings.issues).slice(0, 6),
+    revised: revisionReport.revised
+  } : null;
+  const systemPrompt = [
+    "You are the coordinator that just ran a Flock: a team of sub-agents that worked in parallel on the user's task.",
+    "The sub-agents have finished. Write the final answer to the user in your own voice \u2014 clear, direct, friendly, first person.",
+    "Lead with what the user asked for. Present the actual results and fold in any important verification caveats.",
+    "Do not mention sub-agents, workers, roles, nicknames, IDs, or orchestration mechanics unless directly useful to the user.",
+    "Synthesize only from the provided results \u2014 do not invent facts and do not say you will do further work."
+  ].join("\n");
+  const userPrompt = JSON.stringify({ task, results, verification });
+  return { systemPrompt, userPrompt };
+}
+async function runFlockSynthesisWithTimeout(call, prompt, timeoutMs) {
+  let timer;
+  const timeout = new Promise((resolve5) => {
+    timer = setTimeout(() => resolve5("timeout"), Math.max(1, timeoutMs));
+  });
+  try {
+    const race = await Promise.race([
+      call(prompt).then((result2) => result2.ok && result2.text.trim() ? result2.text.trim() : null).catch(() => null),
+      timeout
+    ]);
+    return race === "timeout" ? null : race;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 function emitPlanEvent(emit, plan) {
   emit({
     type: "flock_plan_ready",
@@ -224761,36 +224369,16 @@ function flockWorkerStatusFromSpawnResult(result2) {
   if (result2.usabilityStatus === "needs_user_input") return "blocked";
   return "done";
 }
-async function refreshFlockCliAuth(input) {
-  if (input.cliLocalTools !== true) return input;
-  const stored = await readStoredCliAuthSession();
-  if (!stored?.accessToken?.trim()) return input;
-  const turnToken = input.cliServerAccessToken?.trim();
-  if (turnToken && turnToken !== stored.accessToken) return input;
-  const fresh = await ensureFreshCliAuthSession({ session: stored });
-  if (!fresh?.accessToken?.trim()) return input;
-  if (fresh.accessToken === input.cliServerAccessToken) return input;
-  if (typeof process !== "undefined") {
-    process.env.PERCH_MODEL_CALL_PROXY_TOKEN = fresh.accessToken;
-  }
-  return {
-    ...input,
-    cliServerAccessToken: fresh.accessToken,
-    marketDeskProxyAccessToken: input.marketDeskProxyAccessToken ?? fresh.accessToken
-  };
-}
 function now11() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
-var FLOCK_GROUNDING_CONTRACT;
+var FLOCK_PLANNER_TIMEOUT_MS, FLOCK_SYNTHESIS_TIMEOUT_MS, FLOCK_SYNTHESIS_MAX_OUTPUT_PER_WORKER, FLOCK_GROUNDING_CONTRACT;
 var init_runFlockTurn = __esm({
   "features/perchTerminal/runtime/flock/runFlockTurn.ts"() {
     "use strict";
     init_operatorStream();
     init_runRegistry();
     init_spawnWorker2();
-    init_cliAuthSession();
-    init_cliAuthRefresh();
     init_registry();
     init_flockCommand();
     init_flockLimits();
@@ -224798,6 +224386,10 @@ var init_runFlockTurn = __esm({
     init_flockLlmPlanner();
     init_flockPlanner();
     init_flockRoles();
+    init_toolLoop();
+    FLOCK_PLANNER_TIMEOUT_MS = 35e3;
+    FLOCK_SYNTHESIS_TIMEOUT_MS = 3e4;
+    FLOCK_SYNTHESIS_MAX_OUTPUT_PER_WORKER = 2e3;
     FLOCK_GROUNDING_CONTRACT = [
       "Grounding contract: your context includes sources[] gathered by research.",
       "Every nontrivial factual claim in the draft must carry an inline [n] marker mapping to one of those sources, with a numbered source list at the end.",
@@ -233104,9 +232696,9 @@ var init_backgroundTaskTypes = __esm({
 });
 
 // features/perchTerminal/runtime/background/backgroundTaskRegistry.ts
-import fs11 from "node:fs";
-import os2 from "node:os";
-import path12 from "node:path";
+import fs10 from "node:fs";
+import os from "node:os";
+import path11 from "node:path";
 function isTerminalStatus(status) {
   return status !== "running";
 }
@@ -233163,19 +232755,19 @@ function runtimeMs(record) {
 function readOutputPreview(outputPath, previewBytes = BACKGROUND_TASK_BOUNDS.previewBytes) {
   if (!outputPath) return { preview: "", truncated: false };
   try {
-    const stat2 = fs11.statSync(outputPath);
-    const fd = fs11.openSync(outputPath, "r");
+    const stat2 = fs10.statSync(outputPath);
+    const fd = fs10.openSync(outputPath, "r");
     try {
       if (stat2.size <= previewBytes) {
         const buf2 = Buffer.alloc(stat2.size);
-        fs11.readSync(fd, buf2, 0, stat2.size, 0);
+        fs10.readSync(fd, buf2, 0, stat2.size, 0);
         return { preview: buf2.toString("utf8"), truncated: false };
       }
       const buf = Buffer.alloc(previewBytes);
-      fs11.readSync(fd, buf, 0, previewBytes, stat2.size - previewBytes);
+      fs10.readSync(fd, buf, 0, previewBytes, stat2.size - previewBytes);
       return { preview: buf.toString("utf8"), truncated: true };
     } finally {
-      fs11.closeSync(fd);
+      fs10.closeSync(fd);
     }
   } catch {
     return { preview: "", truncated: false };
@@ -233210,28 +232802,26 @@ function getBackgroundTaskStore() {
 var STORE_FILE, BackgroundTaskStore, singleton;
 var init_backgroundTaskRegistry = __esm({
   "features/perchTerminal/runtime/background/backgroundTaskRegistry.ts"() {
+    "use strict";
     init_backgroundTaskTypes();
     STORE_FILE = "background-tasks.json";
     BackgroundTaskStore = class {
-      baseDir;
-      storePath;
-      outputDir;
-      records = /* @__PURE__ */ new Map();
-      loaded = false;
       constructor(options = {}) {
-        this.baseDir = options.baseDir ?? path12.join(os2.homedir(), ".perch");
-        this.storePath = path12.join(this.baseDir, STORE_FILE);
-        this.outputDir = path12.join(this.baseDir, "background-output");
+        this.records = /* @__PURE__ */ new Map();
+        this.loaded = false;
+        this.baseDir = options.baseDir ?? path11.join(os.homedir(), ".perch");
+        this.storePath = path11.join(this.baseDir, STORE_FILE);
+        this.outputDir = path11.join(this.baseDir, "background-output");
       }
       ensureDirs() {
-        fs11.mkdirSync(this.baseDir, { recursive: true });
-        fs11.mkdirSync(this.outputDir, { recursive: true });
+        fs10.mkdirSync(this.baseDir, { recursive: true });
+        fs10.mkdirSync(this.outputDir, { recursive: true });
       }
       load() {
         if (this.loaded) return;
         this.loaded = true;
         try {
-          const raw = fs11.readFileSync(this.storePath, "utf8");
+          const raw = fs10.readFileSync(this.storePath, "utf8");
           const parsed = JSON.parse(raw);
           const tasks = Array.isArray(parsed.tasks) ? parsed.tasks : [];
           this.records = new Map(tasks.map((t) => [t.taskId, t]));
@@ -233243,11 +232833,11 @@ var init_backgroundTaskRegistry = __esm({
         this.ensureDirs();
         const tasks = Array.from(this.records.values());
         const tmp = `${this.storePath}.tmp`;
-        fs11.writeFileSync(tmp, JSON.stringify({ version: 1, tasks }, null, 2), "utf8");
-        fs11.renameSync(tmp, this.storePath);
+        fs10.writeFileSync(tmp, JSON.stringify({ version: 1, tasks }, null, 2), "utf8");
+        fs10.renameSync(tmp, this.storePath);
       }
       outputPathFor(taskId) {
-        return path12.join(this.outputDir, `${taskId}.log`);
+        return path11.join(this.outputDir, `${taskId}.log`);
       }
       list() {
         this.load();
@@ -233409,14 +232999,14 @@ var init_backgroundWakeController = __esm({
 
 // features/perchTerminal/runtime/background/runBackgroundCommand.ts
 import { spawn as spawn2 } from "node:child_process";
-import fs12 from "node:fs";
-import path13 from "node:path";
+import fs11 from "node:fs";
+import path12 from "node:path";
 function newTaskId() {
   return `bg-${Date.now()}-${Math.random().toString(16).slice(2, 8)}`;
 }
 function createCappedWriter(filePath, maxBytes) {
-  fs12.mkdirSync(path13.dirname(filePath), { recursive: true });
-  const stream = fs12.createWriteStream(filePath, { flags: "w" });
+  fs11.mkdirSync(path12.dirname(filePath), { recursive: true });
+  const stream = fs11.createWriteStream(filePath, { flags: "w" });
   let written = 0;
   let truncated = false;
   return {
@@ -233589,10 +233179,10 @@ var init_runBackgroundCommand = __esm({
 
 // features/perchTerminal/runtime/cliHost/nodeLocalBridge.ts
 import { spawn as spawn3 } from "node:child_process";
-import fs13 from "node:fs";
+import fs12 from "node:fs";
 import fsp from "node:fs/promises";
-import os3 from "node:os";
-import path14 from "node:path";
+import os2 from "node:os";
+import path13 from "node:path";
 function installCliNodeLocalBridge(input) {
   const globalRef = globalThis;
   const previous = globalRef.__PERCH_TEST_DESKTOP_BRIDGE__;
@@ -233606,7 +233196,7 @@ function installCliNodeLocalBridge(input) {
   };
 }
 function readCliProjectMemoryState(workspaceRoot) {
-  const root2 = path14.resolve(expandHome4(workspaceRoot));
+  const root2 = path13.resolve(expandHome4(workspaceRoot));
   if (!isCliProjectMemoryAvailable(root2)) {
     return {
       available: false,
@@ -233621,7 +233211,7 @@ function readCliProjectMemoryState(workspaceRoot) {
   };
 }
 function createCliNodeLocalBridge(input) {
-  const workspaceRoot = path14.resolve(input.workspaceRoot);
+  const workspaceRoot = path13.resolve(input.workspaceRoot);
   const now23 = () => (/* @__PURE__ */ new Date()).toISOString();
   const sandboxHandlers = /* @__PURE__ */ new Map();
   const emitSandboxEvent = (event) => {
@@ -233635,7 +233225,7 @@ function createCliNodeLocalBridge(input) {
     cwd: workspaceRoot,
     projectRoot: workspaceRoot,
     shellPath: process.env.SHELL || "/bin/zsh",
-    shellName: path14.basename(process.env.SHELL || "zsh"),
+    shellName: path13.basename(process.env.SHELL || "zsh"),
     path: process.env.PATH || "",
     status: "running",
     backend: "spawn-fallback",
@@ -233662,7 +233252,7 @@ function createCliNodeLocalBridge(input) {
       capabilities: ["local-files", "local-shell"]
     }),
     checkFsAccess: async (request) => {
-      const absolutePath = path14.resolve(expandHome4(request.absolutePath));
+      const absolutePath = path13.resolve(expandHome4(request.absolutePath));
       return {
         decision: "allow",
         reason: "Allowed by Perch CLI local filesystem access.",
@@ -233680,7 +233270,7 @@ function createCliNodeLocalBridge(input) {
       ok: true,
       directory: workspaceRoot,
       fileName: request.fileName,
-      absolutePath: path14.join(workspaceRoot, request.fileName),
+      absolutePath: path13.join(workspaceRoot, request.fileName),
       source: "approved_root"
     }),
     validateWorkspaceRoot: async () => ({
@@ -233769,7 +233359,7 @@ function createCliNodeLocalBridge(input) {
     writeWorkspaceFile: async (request) => {
       const baseRoot = resolveRequestRoot(workspaceRoot, request.workspaceRoot);
       const target = resolveWritePath(baseRoot, request.relativePath);
-      await fsp.mkdir(path14.dirname(target), { recursive: true });
+      await fsp.mkdir(path13.dirname(target), { recursive: true });
       const flag = request.overwrite === true ? "w" : "wx";
       const payload = request.encoding === "base64" && typeof request.contentBase64 === "string" ? Buffer.from(request.contentBase64, "base64") : request.content ?? "";
       try {
@@ -233789,14 +233379,14 @@ function createCliNodeLocalBridge(input) {
     moveLocalFile: async (request) => {
       const src = resolveReadPath(workspaceRoot, request.src);
       const dest = resolveWritePath(workspaceRoot, request.dest);
-      await fsp.mkdir(path14.dirname(dest), { recursive: true });
+      await fsp.mkdir(path13.dirname(dest), { recursive: true });
       await fsp.rename(src, dest);
       return { ok: true, fromPath: src, toPath: dest };
     },
     copyLocalFile: async (request) => {
       const src = resolveReadPath(workspaceRoot, request.src);
       const dest = resolveWritePath(workspaceRoot, request.dest);
-      await fsp.mkdir(path14.dirname(dest), { recursive: true });
+      await fsp.mkdir(path13.dirname(dest), { recursive: true });
       await fsp.copyFile(src, dest);
       return { ok: true, fromPath: src, toPath: dest };
     },
@@ -233821,7 +233411,7 @@ function createCliNodeLocalBridge(input) {
       const pattern = request.pattern?.trim() || "**/*";
       const regex2 = globToRegex(pattern);
       const files = await collectFiles(root2, { maxVisits: Math.max(maxResults * 20, 1e3) });
-      const matches = files.map((file) => path14.relative(root2, file).replace(/\\/g, "/")).filter((relative2) => regex2.test(relative2)).slice(0, maxResults);
+      const matches = files.map((file) => path13.relative(root2, file).replace(/\\/g, "/")).filter((relative2) => regex2.test(relative2)).slice(0, maxResults);
       return {
         ok: true,
         matches,
@@ -233844,7 +233434,7 @@ function createCliNodeLocalBridge(input) {
       const files = await collectFiles(root2, { maxVisits: 5e3 });
       const matches = [];
       for (const file of files) {
-        const relative2 = path14.relative(root2, file).replace(/\\/g, "/");
+        const relative2 = path13.relative(root2, file).replace(/\\/g, "/");
         if (includeRegex && !includeRegex.test(relative2)) continue;
         const text = await readTextFileIfReasonable(file);
         if (text === null) continue;
@@ -233883,7 +233473,7 @@ function createCliNodeLocalBridge(input) {
       const stat2 = await safeStat(target);
       return {
         ok: true,
-        relativePath: path14.isAbsolute(request.relativePath) || request.relativePath.startsWith("~") ? target : path14.relative(baseRoot, target) || ".",
+        relativePath: path13.isAbsolute(request.relativePath) || request.relativePath.startsWith("~") ? target : path13.relative(baseRoot, target) || ".",
         exists: Boolean(stat2),
         isFile: stat2?.isFile() ?? false,
         isDirectory: stat2?.isDirectory() ?? false,
@@ -233917,7 +233507,7 @@ function createCliNodeLocalBridge(input) {
       return {
         ok: true,
         data: buffer.toString("base64"),
-        fileName: path14.relative(workspaceRoot, target) || path14.basename(target),
+        fileName: path13.relative(workspaceRoot, target) || path13.basename(target),
         mimeType: inferMimeType(target),
         sizeBytes: stat2.size,
         encoding: "base64"
@@ -234013,7 +233603,7 @@ async function runCliPrepareAPEvidence(workspaceRoot, request) {
         topCases: (artifact.cases ?? []).slice(0, 12),
         duplicateCases: result2.payload.duplicateCases,
         controlGraph: result2.payload.controlGraph,
-        relativeOutputDir: typeof artifact.outputDir === "string" ? path14.basename(artifact.outputDir) : null,
+        relativeOutputDir: typeof artifact.outputDir === "string" ? path13.basename(artifact.outputDir) : null,
         approvedRootMatch: true
       },
       executionHost: "electron_desktop",
@@ -234102,7 +233692,7 @@ async function prepareCliSandboxInputs(workspaceRoot, request) {
   const jobId = request.jobId?.trim() || `cli-sandbox-${Date.now()}`;
   const maxFiles = Math.max(1, Math.min(request.maxFiles ?? 20, 100));
   const maxBytesPerFile = Math.max(1, Math.min(request.maxBytesPerFile ?? 20 * 1024 * 1024, 50 * 1024 * 1024));
-  const tempDir = await fsp.mkdtemp(path14.join(os3.tmpdir(), `${jobId}-`));
+  const tempDir = await fsp.mkdtemp(path13.join(os2.tmpdir(), `${jobId}-`));
   const entries = [];
   const skipped = [];
   for (const localSourceId of request.localSourceIds.slice(0, maxFiles)) {
@@ -234116,13 +233706,13 @@ async function prepareCliSandboxInputs(workspaceRoot, request) {
       skipped.push({ localSourceId, reason: `File is too large: ${stat2.size} bytes.` });
       continue;
     }
-    const relativePath = safeSandboxRelativePath(path14.isAbsolute(localSourceId) || localSourceId.startsWith("~") ? path14.basename(sourcePath) : path14.relative(workspaceRoot, sourcePath));
-    const tempPath = path14.join(tempDir, relativePath);
-    await fsp.mkdir(path14.dirname(tempPath), { recursive: true });
+    const relativePath = safeSandboxRelativePath(path13.isAbsolute(localSourceId) || localSourceId.startsWith("~") ? path13.basename(sourcePath) : path13.relative(workspaceRoot, sourcePath));
+    const tempPath = path13.join(tempDir, relativePath);
+    await fsp.mkdir(path13.dirname(tempPath), { recursive: true });
     await fsp.copyFile(sourcePath, tempPath);
     entries.push({
       localSourceId,
-      fileName: path14.basename(sourcePath),
+      fileName: path13.basename(sourcePath),
       relativePath,
       tempPath,
       sizeBytes: stat2.size,
@@ -234160,11 +233750,11 @@ async function runCliSandboxCodeJob(workspaceRoot, request, onEvent) {
       getApprovedRoot: (rootId) => rootId === CLI_ROOT_ID ? { id: CLI_ROOT_ID, path: workspaceRoot, approvedAt: (/* @__PURE__ */ new Date()).toISOString() } : null,
       isPathSafe: (_rootPath, targetPath) => !targetPath.split(/[\\/]+/).includes(".."),
       isInsideApprovedRoot: (filePath) => {
-        const absolute = path14.resolve(expandHome4(filePath));
+        const absolute = path13.resolve(expandHome4(filePath));
         if (isInside(workspaceRoot, absolute)) {
           return { id: CLI_ROOT_ID, path: workspaceRoot, approvedAt: (/* @__PURE__ */ new Date()).toISOString() };
         }
-        return { id: "cli-absolute-root", path: path14.dirname(absolute), approvedAt: (/* @__PURE__ */ new Date()).toISOString() };
+        return { id: "cli-absolute-root", path: path13.dirname(absolute), approvedAt: (/* @__PURE__ */ new Date()).toISOString() };
       },
       shouldIgnore: (fileName) => IGNORED_DIRS.has(fileName),
       guessMimeType: inferMimeType,
@@ -234207,7 +233797,7 @@ function safeSandboxRelativePath(value) {
   return clean || "input";
 }
 function guessCliFileType(filePath) {
-  const ext = path14.extname(filePath).toLowerCase();
+  const ext = path13.extname(filePath).toLowerCase();
   if ([".xlsx", ".xls"].includes(ext)) return "spreadsheet";
   if (ext === ".csv" || ext === ".tsv") return "csv";
   if (ext === ".pdf") return "pdf";
@@ -234226,7 +233816,7 @@ async function readCliProjectMemoryBridge(workspaceRoot) {
   return { ok: true, meta: state.meta };
 }
 async function writeCliProjectMemory(workspaceRoot, patch) {
-  const root2 = path14.resolve(expandHome4(workspaceRoot));
+  const root2 = path13.resolve(expandHome4(workspaceRoot));
   if (!isCliProjectMemoryAvailable(root2)) {
     return {
       ok: false,
@@ -234242,12 +233832,12 @@ async function writeCliProjectMemory(workspaceRoot, patch) {
     lastOpenedThreadId: patch.lastOpenedThreadId !== void 0 ? patch.lastOpenedThreadId : current.lastOpenedThreadId,
     memorySummary: patch.memorySummary !== void 0 ? patch.memorySummary : current.memorySummary
   };
-  await fsp.mkdir(path14.join(root2, PERCH_DIR), { recursive: true });
+  await fsp.mkdir(path13.join(root2, PERCH_DIR), { recursive: true });
   await atomicWriteCliUtf8(getCliProjectFilePath(root2), JSON.stringify(next, null, 2));
   return { ok: true, meta: enrichCliProjectMeta(root2, next) };
 }
 async function writeCliMemoryFile(workspaceRoot, request) {
-  const root2 = path14.resolve(expandHome4(workspaceRoot));
+  const root2 = path13.resolve(expandHome4(workspaceRoot));
   if (!isCliProjectMemoryAvailable(root2)) {
     return {
       ok: false,
@@ -234259,8 +233849,8 @@ async function writeCliMemoryFile(workspaceRoot, request) {
   }
   const fileName = normalizeCliMemoryFileName(request.fileName);
   if (!fileName) return { ok: false, error: "Invalid memory file name." };
-  const relativePath = path14.join(PERCH_DIR, MEMORY_DIR, fileName);
-  const fullPath = path14.join(root2, relativePath);
+  const relativePath = path13.join(PERCH_DIR, MEMORY_DIR, fileName);
+  const fullPath = path13.join(root2, relativePath);
   const existing = await fsp.readFile(fullPath, "utf8").catch(() => "");
   let nextContent;
   try {
@@ -234273,7 +233863,7 @@ async function writeCliMemoryFile(workspaceRoot, request) {
   }
   const capError = assertCliMemoryWithinCap(nextContent);
   if (capError) return { ok: false, error: capError };
-  await fsp.mkdir(path14.dirname(fullPath), { recursive: true });
+  await fsp.mkdir(path13.dirname(fullPath), { recursive: true });
   await atomicWriteCliUtf8(fullPath, nextContent);
   const updatedFile = readCliTextMemoryFile(root2, relativePath, MAX_MEMORY_BYTES);
   return {
@@ -234299,17 +233889,17 @@ function defaultCliProjectMeta() {
 }
 function isCliProjectMemoryAvailable(root2) {
   try {
-    return fs13.statSync(path14.join(root2, PERCH_DIR)).isDirectory();
+    return fs12.statSync(path13.join(root2, PERCH_DIR)).isDirectory();
   } catch {
     return false;
   }
 }
 function getCliProjectFilePath(root2) {
-  return path14.join(root2, PERCH_DIR, PROJECT_FILE);
+  return path13.join(root2, PERCH_DIR, PROJECT_FILE);
 }
 function loadCliStoredMeta(root2) {
   try {
-    const raw = fs13.readFileSync(getCliProjectFilePath(root2), "utf8");
+    const raw = fs12.readFileSync(getCliProjectFilePath(root2), "utf8");
     return { ...defaultCliProjectMeta(), ...JSON.parse(raw) };
   } catch {
     return defaultCliProjectMeta();
@@ -234317,7 +233907,7 @@ function loadCliStoredMeta(root2) {
 }
 function enrichCliProjectMeta(root2, base) {
   const perchMd = readCliFirstExisting(root2, [
-    path14.join(PERCH_DIR, PERCH_INDEX_FILE),
+    path13.join(PERCH_DIR, PERCH_INDEX_FILE),
     PERCH_INDEX_FILE
   ], MAX_TEXT_BYTES);
   const rules = readCliRules(root2);
@@ -234428,10 +234018,10 @@ function readCliFirstExisting(root2, relativePaths, maxBytes) {
   return null;
 }
 function readCliRules(root2) {
-  const dirPath = path14.join(root2, PERCH_DIR, RULES_DIR);
+  const dirPath = path13.join(root2, PERCH_DIR, RULES_DIR);
   try {
-    return fs13.readdirSync(dirPath).filter((name) => [".md", ".txt"].includes(path14.extname(name).toLowerCase())).slice(0, 40).map((name) => readCliTextMemoryFile(root2, path14.join(PERCH_DIR, RULES_DIR, name), MAX_TEXT_BYTES)).filter((file) => file.found).map((file) => ({
-      fileName: path14.basename(file.relativePath),
+    return fs12.readdirSync(dirPath).filter((name) => [".md", ".txt"].includes(path13.extname(name).toLowerCase())).slice(0, 40).map((name) => readCliTextMemoryFile(root2, path13.join(PERCH_DIR, RULES_DIR, name), MAX_TEXT_BYTES)).filter((file) => file.found).map((file) => ({
+      fileName: path13.basename(file.relativePath),
       relativePath: file.relativePath,
       content: file.content,
       sizeBytes: file.sizeBytes,
@@ -234442,15 +234032,15 @@ function readCliRules(root2) {
   }
 }
 function readCliMemoryFiles(root2) {
-  const memoryDir = path14.join(root2, PERCH_DIR, MEMORY_DIR);
+  const memoryDir = path13.join(root2, PERCH_DIR, MEMORY_DIR);
   const discovered = /* @__PURE__ */ new Set();
   const memoryFiles = [];
   try {
-    for (const name of fs13.readdirSync(memoryDir).slice(0, MAX_MEMORY_FILES)) {
-      const ext = path14.extname(name).toLowerCase();
+    for (const name of fs12.readdirSync(memoryDir).slice(0, MAX_MEMORY_FILES)) {
+      const ext = path13.extname(name).toLowerCase();
       if (ext !== ".md" && ext !== ".txt") continue;
       discovered.add(name);
-      memoryFiles.push(readCliTextMemoryFile(root2, path14.join(PERCH_DIR, MEMORY_DIR, name), MAX_MEMORY_BYTES));
+      memoryFiles.push(readCliTextMemoryFile(root2, path13.join(PERCH_DIR, MEMORY_DIR, name), MAX_MEMORY_BYTES));
     }
   } catch {
   }
@@ -234458,20 +234048,20 @@ function readCliMemoryFiles(root2) {
     memoryFiles,
     missingMemoryFiles: EXPECTED_MEMORY_FILES.filter((name) => !discovered.has(name)).map((name) => ({
       fileName: name,
-      relativePath: path14.join(PERCH_DIR, MEMORY_DIR, name),
+      relativePath: path13.join(PERCH_DIR, MEMORY_DIR, name),
       reason: "expected project memory file was not found"
     }))
   };
 }
 function readCliTextMemoryFile(root2, relativePath, maxBytes) {
-  const fullPath = path14.join(root2, relativePath);
-  const fileName = path14.basename(relativePath);
+  const fullPath = path13.join(root2, relativePath);
+  const fileName = path13.basename(relativePath);
   try {
-    const stat2 = fs13.statSync(fullPath);
+    const stat2 = fs12.statSync(fullPath);
     if (!stat2.isFile()) {
       return { fileName, relativePath, content: "", found: false, error: "not a regular file" };
     }
-    const content = fs13.readFileSync(fullPath, "utf8");
+    const content = fs12.readFileSync(fullPath, "utf8");
     if (stat2.size > maxBytes) {
       return {
         fileName,
@@ -234593,7 +234183,7 @@ function terminateProcessGroup(child, signal) {
 }
 function resolveReadPath(root2, inputPath) {
   const expanded = expandHome4(inputPath || ".");
-  return path14.resolve(path14.isAbsolute(expanded) ? expanded : path14.join(root2, expanded));
+  return path13.resolve(path13.isAbsolute(expanded) ? expanded : path13.join(root2, expanded));
 }
 function resolveRequestRoot(defaultRoot, requestRoot) {
   const trimmed = requestRoot?.trim();
@@ -234601,25 +234191,25 @@ function resolveRequestRoot(defaultRoot, requestRoot) {
 }
 function resolveWritePath(root2, inputPath) {
   const expanded = expandHome4(inputPath || ".");
-  return path14.resolve(path14.isAbsolute(expanded) ? expanded : path14.join(root2, expanded));
+  return path13.resolve(path13.isAbsolute(expanded) ? expanded : path13.join(root2, expanded));
 }
 function displayPath(root2, target, requestedPath) {
   const expanded = expandHome4(requestedPath || ".");
-  if (path14.isAbsolute(expanded) || requestedPath.startsWith("~")) return target;
-  return path14.relative(root2, target) || path14.basename(target);
+  if (path13.isAbsolute(expanded) || requestedPath.startsWith("~")) return target;
+  return path13.relative(root2, target) || path13.basename(target);
 }
 function resolveLocalSourceId(root2, localSourceId) {
   const raw = localSourceId.includes("::") ? localSourceId.split("::").slice(1).join("::") : localSourceId;
   return resolveReadPath(root2, raw);
 }
 function expandHome4(inputPath) {
-  if (inputPath === "~") return os3.homedir();
-  if (inputPath.startsWith("~/")) return path14.join(os3.homedir(), inputPath.slice(2));
+  if (inputPath === "~") return os2.homedir();
+  if (inputPath.startsWith("~/")) return path13.join(os2.homedir(), inputPath.slice(2));
   return inputPath;
 }
 function isInside(root2, candidate) {
-  const relative2 = path14.relative(path14.resolve(root2), path14.resolve(candidate));
-  return relative2 === "" || !relative2.startsWith("..") && !path14.isAbsolute(relative2);
+  const relative2 = path13.relative(path13.resolve(root2), path13.resolve(candidate));
+  return relative2 === "" || !relative2.startsWith("..") && !path13.isAbsolute(relative2);
 }
 async function safeStat(target) {
   try {
@@ -234636,7 +234226,7 @@ async function collectFiles(root2, options) {
     for (const entry of entries) {
       if (result2.length >= options.maxVisits) return;
       if (entry.name.startsWith(".") && entry.name !== ".env") continue;
-      const absolute = path14.join(dir, entry.name);
+      const absolute = path13.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (!IGNORED_DIRS.has(entry.name)) await walk2(absolute);
       } else if (entry.isFile()) {
@@ -234692,14 +234282,14 @@ function sanitizeMaxResults(value) {
   return Math.max(1, Math.min(typeof value === "number" ? Math.floor(value) : DEFAULT_MAX_RESULTS, 1e3));
 }
 function localSourceEntry(root2, file, absoluteId = false) {
-  const stat2 = fs13.statSync(file);
-  const relativePath = path14.relative(root2, file);
-  const extension2 = path14.extname(file).toLowerCase();
+  const stat2 = fs12.statSync(file);
+  const relativePath = path13.relative(root2, file);
+  const extension2 = path13.extname(file).toLowerCase();
   return {
     localSourceId: absoluteId ? file : `${CLI_ROOT_ID}::${relativePath}`,
     rootId: absoluteId ? "cli-absolute-root" : CLI_ROOT_ID,
     relativePath,
-    fileName: path14.basename(file),
+    fileName: path13.basename(file),
     extension: extension2,
     sizeBytes: stat2.size,
     modifiedAt: stat2.mtime.toISOString(),
@@ -234708,7 +234298,7 @@ function localSourceEntry(root2, file, absoluteId = false) {
   };
 }
 function inferMimeType(file) {
-  const ext = path14.extname(file).toLowerCase();
+  const ext = path13.extname(file).toLowerCase();
   if (ext === ".pdf") return "application/pdf";
   if (ext === ".json") return "application/json";
   if (ext === ".csv") return "text/csv";
@@ -234768,6 +234358,550 @@ var init_nodeLocalBridge = __esm({
   }
 });
 
+// features/perchTerminal/runtime/cliHost/cliAuthSession.ts
+import { execFile } from "node:child_process";
+import fs13 from "node:fs/promises";
+import os3 from "node:os";
+import path14 from "node:path";
+import { promisify } from "node:util";
+async function readStoredCliAuthSession() {
+  const raw = shouldUseFallbackAuthFile() ? await readFallbackSecret().catch(() => null) : process.platform === "darwin" ? await readKeychainSecret().catch(() => null) : await readFallbackSecret().catch(() => null);
+  return parseStoredCliAuthSession(raw);
+}
+async function writeStoredCliAuthSession(session) {
+  const raw = JSON.stringify(session);
+  if (process.platform === "darwin" && !shouldUseFallbackAuthFile()) {
+    await execFileAsync("security", [
+      "add-generic-password",
+      "-U",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      KEYCHAIN_ACCOUNT,
+      "-w",
+      raw
+    ]);
+    return;
+  }
+  await writeFallbackSecret(raw);
+}
+async function clearStoredCliAuthSession() {
+  if (process.platform === "darwin" && !shouldUseFallbackAuthFile()) {
+    await execFileAsync("security", [
+      "delete-generic-password",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      KEYCHAIN_ACCOUNT
+    ]).catch(() => void 0);
+    return;
+  }
+  await fs13.rm(fallbackSessionPath(), { force: true }).catch(() => void 0);
+}
+function shouldUseFallbackAuthFile() {
+  return Boolean(process.env.PERCH_CLI_AUTH_DIR?.trim());
+}
+function isStoredCliAuthSessionUsable(session, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!session?.accessToken?.trim()) return false;
+  if (!session.appUrl?.trim()) return false;
+  if (!session.expiresAt) return true;
+  return session.expiresAt > nowSeconds + 90;
+}
+function parseStoredCliAuthSession(raw) {
+  if (!raw?.trim()) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1) return null;
+    if (!parsed.appUrl || !parsed.accessToken || !parsed.updatedAt) return null;
+    return {
+      version: 1,
+      appUrl: parsed.appUrl,
+      accessToken: parsed.accessToken,
+      refreshToken: parsed.refreshToken ?? null,
+      expiresAt: typeof parsed.expiresAt === "number" ? parsed.expiresAt : null,
+      userId: parsed.userId ?? null,
+      email: parsed.email ?? null,
+      updatedAt: parsed.updatedAt
+    };
+  } catch {
+    return null;
+  }
+}
+async function readKeychainSecret() {
+  const { stdout } = await execFileAsync("security", [
+    "find-generic-password",
+    "-s",
+    KEYCHAIN_SERVICE,
+    "-a",
+    KEYCHAIN_ACCOUNT,
+    "-w"
+  ]);
+  return stdout.trim() || null;
+}
+function fallbackSessionPath() {
+  const base = process.env.PERCH_CLI_AUTH_DIR?.trim() || path14.join(os3.homedir(), ".perch");
+  return path14.join(base, "cli-auth-session.json");
+}
+async function readFallbackSecret() {
+  return await fs13.readFile(fallbackSessionPath(), "utf8");
+}
+async function writeFallbackSecret(raw) {
+  const filePath = fallbackSessionPath();
+  await fs13.mkdir(path14.dirname(filePath), { recursive: true, mode: 448 });
+  await fs13.writeFile(filePath, raw, { mode: 384 });
+}
+var execFileAsync, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT;
+var init_cliAuthSession = __esm({
+  "features/perchTerminal/runtime/cliHost/cliAuthSession.ts"() {
+    "use strict";
+    execFileAsync = promisify(execFile);
+    KEYCHAIN_SERVICE = "app.perchai.cli-auth";
+    KEYCHAIN_ACCOUNT = "default";
+  }
+});
+
+// features/perchTerminal/runtime/publicModelDefault.ts
+function parsePublicModelDefaultPayload(value) {
+  const raw = value && typeof value === "object" ? value : {};
+  const selection = sanitizeFounderModelSelection(
+    raw.selection ?? DEFAULT_FOUNDER_MODEL_SELECTION
+  );
+  return {
+    selection,
+    updatedAt: typeof raw.updatedAt === "string" ? raw.updatedAt : null,
+    updatedBy: typeof raw.updatedBy === "string" ? raw.updatedBy : null
+  };
+}
+var init_publicModelDefault = __esm({
+  "features/perchTerminal/runtime/publicModelDefault.ts"() {
+    "use strict";
+    init_modelRegistry();
+  }
+});
+
+// features/perchTerminal/runtime/cliHost/installCliModelProxyAuthRefresh.ts
+function installCliModelProxyAuthRefresh() {
+  setCliModelProxyAuthRefresher(async () => {
+    const fresh = await ensureFreshCliAuthSession({
+      session: await readStoredCliAuthSession(),
+      forceRefresh: true
+    });
+    if (!fresh?.accessToken?.trim()) return null;
+    if (typeof process !== "undefined") {
+      process.env[MODEL_CALL_PROXY_TOKEN_ENV2] = fresh.accessToken;
+    }
+    return fresh.accessToken;
+  });
+  return () => setCliModelProxyAuthRefresher(null);
+}
+var MODEL_CALL_PROXY_TOKEN_ENV2;
+var init_installCliModelProxyAuthRefresh = __esm({
+  "features/perchTerminal/runtime/cliHost/installCliModelProxyAuthRefresh.ts"() {
+    "use strict";
+    init_cliAuthRefreshRegistry();
+    init_cliAuthRefresh();
+    init_cliAuthSession();
+    MODEL_CALL_PROXY_TOKEN_ENV2 = "PERCH_MODEL_CALL_PROXY_TOKEN";
+  }
+});
+
+// features/perchTerminal/runtime/cliHost/modelConnection.ts
+async function connectCliModelProxy(input = {}) {
+  installCliModelProxyAuthRefresh();
+  const storedSession = input.storedSession === void 0 ? await readStoredCliAuthSession() : input.storedSession;
+  const usableStoredSession = await ensureFreshCliAuthSession({
+    session: storedSession,
+    fetchImpl: input.fetchImpl
+  });
+  const appUrl = resolveCliAppUrl(input.appUrl, usableStoredSession?.appUrl ?? null);
+  if (!appUrl) return noCliModelConnection();
+  if (!usableStoredSession?.accessToken) return noCliModelConnection(appUrl);
+  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") return noCliModelConnection(appUrl);
+  const selection = await fetchPublicModelDefaultSelection(
+    appUrl,
+    fetchImpl,
+    usableStoredSession?.accessToken ?? null
+  );
+  if (!selection) return noCliModelConnection(appUrl);
+  const priorProxy = process.env[MODEL_PROXY_ENV];
+  const priorToken = process.env[MODEL_PROXY_TOKEN_ENV];
+  process.env[MODEL_PROXY_ENV] = appUrl;
+  if (usableStoredSession?.accessToken) {
+    process.env[MODEL_PROXY_TOKEN_ENV] = usableStoredSession.accessToken;
+  }
+  return {
+    appUrl,
+    authenticated: !!usableStoredSession?.accessToken,
+    userId: usableStoredSession?.userId ?? null,
+    email: usableStoredSession?.email ?? null,
+    founderModelSelection: selection,
+    restore: () => {
+      if (priorProxy === void 0) {
+        delete process.env[MODEL_PROXY_ENV];
+      } else {
+        process.env[MODEL_PROXY_ENV] = priorProxy;
+      }
+      if (priorToken === void 0) {
+        delete process.env[MODEL_PROXY_TOKEN_ENV];
+      } else {
+        process.env[MODEL_PROXY_TOKEN_ENV] = priorToken;
+      }
+    }
+  };
+}
+function resolveCliAppUrl(explicit, stored) {
+  const raw = explicit?.trim() || process.env[CLI_APP_URL_ENV]?.trim() || process.env[FALLBACK_APP_URL_ENV]?.trim() || stored?.trim() || DEFAULT_CLI_APP_URL;
+  if (!raw) return null;
+  const withProtocol = /^https?:\/\//i.test(raw) ? raw : `http://${raw}`;
+  try {
+    const url = new URL(withProtocol);
+    url.pathname = url.pathname.replace(/\/+$/, "");
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return null;
+  }
+}
+async function fetchPublicModelDefaultSelection(appUrl, fetchImpl, accessToken) {
+  const url = `${appUrl}/api/perch-terminal/public-model-default`;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3500);
+  try {
+    const response = await fetchImpl(url, {
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {}
+      },
+      signal: controller.signal
+    });
+    if (!response.ok) return null;
+    const body = await response.json();
+    if (!body || typeof body !== "object") return null;
+    const record = body;
+    if (record.ok !== true) return null;
+    return parsePublicModelDefaultPayload({ selection: record.selection }).selection;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function noCliModelConnection(appUrl = null) {
+  return {
+    appUrl,
+    authenticated: false,
+    userId: null,
+    email: null,
+    founderModelSelection: null,
+    restore: () => {
+    }
+  };
+}
+var MODEL_PROXY_ENV, MODEL_PROXY_TOKEN_ENV, CLI_APP_URL_ENV, FALLBACK_APP_URL_ENV, DEFAULT_CLI_APP_URL;
+var init_modelConnection = __esm({
+  "features/perchTerminal/runtime/cliHost/modelConnection.ts"() {
+    "use strict";
+    init_publicModelDefault();
+    init_cliAuthSession();
+    init_cliAuthRefresh();
+    init_installCliModelProxyAuthRefresh();
+    MODEL_PROXY_ENV = "PERCH_MODEL_CALL_PROXY_URL";
+    MODEL_PROXY_TOKEN_ENV = "PERCH_MODEL_CALL_PROXY_TOKEN";
+    CLI_APP_URL_ENV = "PERCH_CLI_APP_URL";
+    FALLBACK_APP_URL_ENV = "PERCH_APP_URL";
+    DEFAULT_CLI_APP_URL = "https://app.perchai.app";
+  }
+});
+
+// features/perchTerminal/runtime/cliHost/cliStandaloneOAuth.ts
+import { execFile as execFile2 } from "node:child_process";
+import http from "node:http";
+import { promisify as promisify2 } from "node:util";
+async function runCliStandaloneOAuthLogin(input) {
+  const appUrl = resolveCliAppUrl(input.appUrl, null);
+  if (!appUrl) {
+    return { ok: false, code: "invalid_app_url", error: "Invalid Perch app URL." };
+  }
+  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    return { ok: false, code: "fetch_unavailable", error: "This Node runtime does not expose fetch." };
+  }
+  const config = await fetchCliAuthConfig(appUrl, fetchImpl);
+  if (!config.ok || !config.supabaseUrl || !config.supabaseAnonKey) {
+    return {
+      ok: false,
+      code: "auth_config_unavailable",
+      error: "The Perch app did not return CLI auth configuration."
+    };
+  }
+  const provider = selectOAuthProvider(config.providers ?? [], input.provider);
+  if (!provider) {
+    return {
+      ok: false,
+      code: "oauth_provider_unavailable",
+      error: "No supported CLI OAuth provider is enabled for this Perch app."
+    };
+  }
+  const callback = await createOAuthCallbackServer({
+    host: config.redirectHost?.trim() || "127.0.0.1",
+    timeoutMs: input.timeoutMs ?? DEFAULT_LOGIN_TIMEOUT_MS
+  });
+  try {
+    const memoryStorage = createMemoryAuthStorage();
+    const supabase = createClient(config.supabaseUrl, config.supabaseAnonKey, {
+      auth: {
+        flowType: "pkce",
+        autoRefreshToken: false,
+        detectSessionInUrl: false,
+        persistSession: true,
+        storage: memoryStorage
+      }
+    });
+    const { data, error } = await supabase.auth.signInWithOAuth({
+      provider,
+      options: {
+        redirectTo: callback.redirectTo,
+        skipBrowserRedirect: true,
+        data: { signup_source: "cli" }
+      }
+    });
+    if (error || !data.url) {
+      return {
+        ok: false,
+        code: "oauth_start_failed",
+        error: error?.message ?? "Supabase did not return an OAuth URL."
+      };
+    }
+    await (input.openExternal ?? openExternal)(data.url);
+    const callbackResult = await callback.waitForCode();
+    if (!callbackResult.ok) {
+      return callbackResult;
+    }
+    const exchanged = await supabase.auth.exchangeCodeForSession(callbackResult.code);
+    if (exchanged.error || !exchanged.data.session) {
+      return {
+        ok: false,
+        code: "oauth_exchange_failed",
+        error: exchanged.error?.message ?? "Supabase did not return a CLI session."
+      };
+    }
+    const session = storedSessionFromSupabaseSession({
+      appUrl,
+      accessToken: exchanged.data.session.access_token,
+      refreshToken: exchanged.data.session.refresh_token,
+      expiresAt: exchanged.data.session.expires_at ?? null,
+      userId: exchanged.data.session.user.id,
+      email: exchanged.data.session.user.email ?? null
+    });
+    await writeStoredCliAuthSession(session);
+    return { ok: true, session };
+  } finally {
+    await callback.close();
+  }
+}
+async function fetchCliAuthConfig(appUrl, fetchImpl = globalThis.fetch) {
+  const response = await fetchImpl(`${appUrl}/api/perch-terminal/cli-auth/config`, {
+    method: "GET",
+    headers: { Accept: "application/json" }
+  });
+  if (!response.ok) return { ok: false };
+  return await response.json();
+}
+function selectOAuthProvider(providers, preferred) {
+  const available = new Set(providers);
+  if (preferred && available.has(preferred)) return preferred;
+  if (available.has("google")) return "google";
+  if (available.has("github")) return "github";
+  return null;
+}
+function storedSessionFromSupabaseSession(input) {
+  return {
+    version: 1,
+    appUrl: input.appUrl,
+    accessToken: input.accessToken,
+    refreshToken: input.refreshToken ?? null,
+    expiresAt: input.expiresAt ?? null,
+    userId: input.userId ?? null,
+    email: input.email ?? null,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function createMemoryAuthStorage() {
+  const values2 = /* @__PURE__ */ new Map();
+  return {
+    getItem: (key) => values2.get(key) ?? null,
+    setItem: (key, value) => {
+      values2.set(key, value);
+    },
+    removeItem: (key) => {
+      values2.delete(key);
+    }
+  };
+}
+async function createOAuthCallbackServer(input) {
+  let resolveResult = null;
+  const resultPromise = new Promise((resolve5) => {
+    resolveResult = resolve5;
+  });
+  const server = http.createServer((request, response) => {
+    const requestUrl = new URL(request.url ?? "/", `http://${input.host}`);
+    if (requestUrl.pathname !== CALLBACK_PATH) {
+      response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+      response.end("Not found");
+      return;
+    }
+    const code = requestUrl.searchParams.get("code");
+    const error = requestUrl.searchParams.get("error_description") ?? requestUrl.searchParams.get("error");
+    if (!code) {
+      response.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });
+      response.end(renderCallbackHtml(false));
+      resolveResult?.({
+        ok: false,
+        code: "oauth_callback_missing_code",
+        error: error ?? "OAuth callback did not include a code."
+      });
+      resolveResult = null;
+      return;
+    }
+    response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    response.end(renderCallbackHtml(true));
+    resolveResult?.({ ok: true, code });
+    resolveResult = null;
+  });
+  await new Promise((resolve5, reject2) => {
+    server.once("error", reject2);
+    server.listen(0, input.host, () => {
+      server.off("error", reject2);
+      resolve5();
+    });
+  });
+  const address = server.address();
+  const redirectTo = `http://${input.host}:${address.port}${CALLBACK_PATH}`;
+  const timeout = setTimeout(() => {
+    resolveResult?.({
+      ok: false,
+      code: "oauth_timeout",
+      error: "Timed out waiting for browser sign-in to complete."
+    });
+    resolveResult = null;
+  }, input.timeoutMs);
+  return {
+    redirectTo,
+    waitForCode: async () => resultPromise,
+    close: async () => {
+      clearTimeout(timeout);
+      await new Promise((resolve5) => server.close(() => resolve5()));
+    }
+  };
+}
+function renderCallbackHtml(ok) {
+  const title = ok ? "Perch CLI signed in" : "Perch CLI sign-in failed";
+  const message = ok ? "You can close this tab and return to your terminal." : "Return to your terminal and try again.";
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head><body style="font-family:system-ui;padding:32px;background:#100d0b;color:#fff8f0"><h1>${title}</h1><p>${message}</p></body></html>`;
+}
+async function openExternal(url) {
+  if (process.platform === "darwin") {
+    await execFileAsync2("open", [url]);
+  } else if (process.platform === "win32") {
+    await execFileAsync2("cmd", ["/c", "start", "", url]);
+  } else {
+    await execFileAsync2("xdg-open", [url]);
+  }
+}
+var execFileAsync2, DEFAULT_LOGIN_TIMEOUT_MS, CALLBACK_PATH;
+var init_cliStandaloneOAuth = __esm({
+  "features/perchTerminal/runtime/cliHost/cliStandaloneOAuth.ts"() {
+    "use strict";
+    init_dist4();
+    init_modelConnection();
+    init_cliAuthSession();
+    execFileAsync2 = promisify2(execFile2);
+    DEFAULT_LOGIN_TIMEOUT_MS = 12e4;
+    CALLBACK_PATH = "/callback";
+  }
+});
+
+// features/perchTerminal/runtime/cliHost/cliAuthRefresh.ts
+async function ensureFreshCliAuthSession(input) {
+  const session = input.session;
+  if (!session?.accessToken?.trim()) return null;
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  const stillUsable = !session.expiresAt || session.expiresAt > nowSeconds + 90;
+  if (stillUsable && !input.forceRefresh) return session;
+  if (!session.refreshToken?.trim()) return null;
+  const fetchImpl = input.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") return null;
+  const appUrl = session.appUrl?.trim();
+  if (!appUrl) return null;
+  const config = await fetchCliAuthConfig(appUrl, fetchImpl).catch(() => ({ ok: false }));
+  if (!config.ok || !config.supabaseUrl || !config.supabaseAnonKey) return null;
+  const supabase = createClient(config.supabaseUrl, config.supabaseAnonKey, {
+    auth: {
+      autoRefreshToken: false,
+      detectSessionInUrl: false,
+      persistSession: false
+    }
+  });
+  try {
+    const { data, error } = await supabase.auth.refreshSession({
+      refresh_token: session.refreshToken
+    });
+    if (error || !data.session) return null;
+    const refreshed = {
+      version: 1,
+      appUrl: session.appUrl,
+      accessToken: data.session.access_token,
+      refreshToken: data.session.refresh_token ?? session.refreshToken,
+      expiresAt: data.session.expires_at ?? null,
+      userId: data.session.user?.id ?? session.userId ?? null,
+      email: data.session.user?.email ?? session.email ?? null,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await writeStoredCliAuthSession(refreshed);
+    return refreshed;
+  } catch {
+    return null;
+  }
+}
+var init_cliAuthRefresh = __esm({
+  "features/perchTerminal/runtime/cliHost/cliAuthRefresh.ts"() {
+    "use strict";
+    init_dist4();
+    init_cliStandaloneOAuth();
+    init_cliAuthSession();
+  }
+});
+
+// features/perchTerminal/runtime/cliHost/refreshCliTurnAuth.ts
+async function refreshCliTurnAuth(input) {
+  if (input.cliLocalTools !== true) return input;
+  const stored = await readStoredCliAuthSession();
+  if (!stored?.accessToken?.trim()) return input;
+  const turnToken = input.cliServerAccessToken?.trim();
+  if (turnToken && turnToken !== stored.accessToken) return input;
+  const fresh = await ensureFreshCliAuthSession({ session: stored });
+  if (!fresh?.accessToken?.trim()) return input;
+  if (fresh.accessToken === input.cliServerAccessToken) return input;
+  if (typeof process !== "undefined") {
+    process.env.PERCH_MODEL_CALL_PROXY_TOKEN = fresh.accessToken;
+  }
+  return {
+    ...input,
+    cliServerAccessToken: fresh.accessToken,
+    marketDeskProxyAccessToken: input.marketDeskProxyAccessToken ?? fresh.accessToken
+  };
+}
+var init_refreshCliTurnAuth = __esm({
+  "features/perchTerminal/runtime/cliHost/refreshCliTurnAuth.ts"() {
+    "use strict";
+    init_cliAuthSession();
+    init_cliAuthRefresh();
+  }
+});
+
 // features/perchTerminal/runtime/cliHost/runCliTurn.ts
 import path15 from "node:path";
 async function runPerchCliTurn(input, options = {}) {
@@ -234790,7 +234924,8 @@ async function runPerchCliTurn(input, options = {}) {
     onEvent: input.onEvent,
     onContextSnapshot: (snapshot) => {
       latestContextSnapshot = snapshot;
-    }
+    },
+    refreshTurnInput: input.cliLocalTools !== false ? refreshCliTurnAuth : void 0
   });
   const restoreLocalBridge = input.cliLocalTools === false ? null : installCliNodeLocalBridge({ workspaceRoot: cwd2 });
   try {
@@ -234877,6 +235012,7 @@ function buildCliTurnDeps(input) {
       input.onEvent?.(event);
     },
     onContextAssembled: input.onContextSnapshot,
+    ...input.refreshTurnInput ? { refreshTurnInput: input.refreshTurnInput } : {},
     persistUserMessage: async () => null,
     persistAssistantMessage: async () => null,
     createWorkflowRun: async () => null,
@@ -234932,6 +235068,7 @@ var init_runCliTurn = __esm({
     init_runOperatorTurn();
     init_nodeLocalBridge();
     init_nodeLocalBridge();
+    init_refreshCliTurnAuth();
   }
 });
 
@@ -289942,9 +290079,17 @@ function flockEventToCliRow(event) {
   switch (event.type) {
     case "flock_run_started":
       return { id: null, text: "gathering the flock\u2026", tone: "accent" };
-    case "flock_plan_ready":
+    case "flock_plan_ready": {
       if (!event.accepted) return null;
-      return { id: null, text: `flock plan \xB7 ${event.workers.length} workers`, tone: "muted" };
+      const names = event.workers.map((worker) => worker.displayName);
+      const shown = names.slice(0, 4).join(", ");
+      const extra = names.length > 4 ? ` +${names.length - 4} more` : "";
+      return {
+        id: null,
+        text: `flock plan \xB7 ${event.workers.length} agents \xB7 ${shown}${extra}`,
+        tone: "accent"
+      };
+    }
     case "flock_worker_update":
       return {
         id: `flock-${event.flockId}-${event.flockWorkerId}`,
@@ -290440,18 +290585,18 @@ async function runReadlineInteractivePerchCli(writer, deps, options) {
     trimRecentMessages(state.recentMessages);
     recordCliUsageRunId(state, result2.runId);
     state.contextSnapshot = result2.contextSnapshot ?? state.contextSnapshot;
-    const admitted = await admitCliLearningMemory(connection, {
+    void admitCliLearningMemory(connection, {
       prompt: turnPrompt,
       assistantText: result2.assistantText,
       status: result2.status,
       personaId: state.personaId,
       threadId: result2.threadId,
       runId: result2.runId
+    }).then((admitted) => {
+      if (admitted > 0) writeModeLine(writer, "memory", `saved ${admitted}`);
+    }).catch(() => {
     });
     await persistInteractiveCliState(state);
-    if (admitted > 0) {
-      writeModeLine(writer, "memory", `saved ${admitted}`);
-    }
   };
   try {
     while (true) {
@@ -291153,17 +291298,19 @@ async function runInkInteractivePerchCli(writer, deps, options) {
             trimRecentMessages(state.recentMessages);
             recordCliUsageRunId(state, result2.runId);
             state.contextSnapshot = result2.contextSnapshot ?? state.contextSnapshot;
-            const admitted = await admitCliLearningMemory(connection, {
+            void admitCliLearningMemory(connection, {
               prompt,
               assistantText,
               status: result2.status,
               personaId: state.personaId,
               threadId: result2.threadId,
               runId: result2.runId
+            }).then((admitted) => {
+              if (admitted > 0) {
+                addItem({ label: "memory", text: `saved ${admitted}`, tone: "muted" });
+              }
+            }).catch(() => {
             });
-            if (admitted > 0) {
-              addItem({ label: "memory", text: `saved ${admitted}`, tone: "muted" });
-            }
             await persistInteractiveCliState(state);
           } catch (error) {
             addItem({ label: "stop", text: humanizeCliError(errorMessage(error)), tone: "danger" });