terminal-pilot 0.0.20 → 0.0.22

package/dist/cli.js

@@ -6,12 +6,12 @@ var __export = (target, all) => {
 };
 
 // src/cli.ts
-import { realpath as realpath2 } from "node:fs/promises";
+import { realpath as realpath3 } from "node:fs/promises";
 import path23 from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // ../toolcraft/src/cli.ts
-import { access as access2, lstat as lstat3, readFile as readFile4, rename as rename3, unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
+import { access as access2, lstat as lstat3, readFile as readFile4, rename as rename3, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
 import path14 from "node:path";
 import {
   Command as CommanderCommand,
@@ -20,7 +20,7 @@ import {
   Option
 } from "commander";
 
-// ../design-system/src/internal/color-support.ts
+// ../toolcraft-design/src/internal/color-support.ts
 function supportsColor(env = process.env, stream = process.stdout) {
   if (env.FORCE_COLOR !== void 0 && env.FORCE_COLOR !== "0") {
     return true;
@@ -34,7 +34,7 @@ function supportsColor(env = process.env, stream = process.stdout) {
   return typeof env.TERM === "string" && env.TERM.length > 0 && env.TERM !== "dumb";
 }
 
-// ../design-system/src/components/color.ts
+// ../toolcraft-design/src/components/color.ts
 var reset = "\x1B[0m";
 var ansiStyles = {
   reset: { open: reset },
@@ -136,41 +136,135 @@ function createColor(styles = []) {
 }
 var color = createColor();
 
-// ../design-system/src/tokens/colors.ts
-var dark = {
-  header: (text5) => color.magentaBright.bold(text5),
-  divider: (text5) => color.dim(text5),
-  prompt: (text5) => color.cyan(text5),
-  number: (text5) => color.cyanBright(text5),
-  intro: (text5) => color.bgMagenta.white(` Poe - ${text5} `),
-  resolvedSymbol: color.magenta("\u25C7"),
-  errorSymbol: color.red("\u25A0"),
-  accent: (text5) => color.cyan(text5),
-  muted: (text5) => color.dim(text5),
-  success: (text5) => color.green(text5),
-  warning: (text5) => color.yellow(text5),
-  error: (text5) => color.red(text5),
-  info: (text5) => color.magenta(text5),
-  badge: (text5) => color.bgYellow.black(` ${text5} `)
+// ../toolcraft-design/src/tokens/brand.ts
+var brands = {
+  purple: { name: "purple", primary: "#a200ff" },
+  blue: { name: "blue", primary: "#2f6fed" },
+  green: { name: "green", primary: "#1f9d57" }
 };
-var light = {
-  header: (text5) => color.hex("#a200ff").bold(text5),
-  divider: (text5) => color.hex("#666666")(text5),
-  prompt: (text5) => color.hex("#006699").bold(text5),
-  number: (text5) => color.hex("#0077cc").bold(text5),
-  intro: (text5) => color.bgHex("#a200ff").white(` Poe - ${text5} `),
-  resolvedSymbol: color.hex("#a200ff")("\u25C7"),
-  errorSymbol: color.hex("#cc0000")("\u25A0"),
-  accent: (text5) => color.hex("#006699").bold(text5),
-  muted: (text5) => color.hex("#666666")(text5),
-  success: (text5) => color.hex("#008800")(text5),
-  warning: (text5) => color.hex("#cc6600")(text5),
-  error: (text5) => color.hex("#cc0000")(text5),
-  info: (text5) => color.hex("#a200ff")(text5),
-  badge: (text5) => color.bgHex("#cc6600").white(` ${text5} `)
+
+// ../toolcraft-design/src/internal/theme-state.ts
+var defaults = {
+  brand: "purple",
+  label: "Poe"
 };
+var config = { ...defaults };
+var revision = 0;
+var brandConfigured = false;
+function configureTheme(patch) {
+  if (patch.brand !== void 0 && !Object.hasOwn(brands, patch.brand)) {
+    throw new Error(`Unknown brand: ${patch.brand}`);
+  }
+  config = {
+    brand: patch.brand ?? config.brand,
+    label: patch.label ?? config.label
+  };
+  if (patch.brand !== void 0) {
+    brandConfigured = true;
+  }
+  revision += 1;
+}
+function getThemeConfig() {
+  return { ...config };
+}
+function getThemeRevision() {
+  return revision;
+}
+function isThemeBrandConfigured() {
+  return brandConfigured;
+}
+
+// ../toolcraft-design/src/tokens/colors.ts
+var brand = brands.purple.primary;
+function withStyles(palette, styles) {
+  return Object.defineProperty(palette, "styles", {
+    value: styles,
+    enumerable: false
+  });
+}
+function brandColor(activeBrand, purple) {
+  return activeBrand.name === "purple" ? purple : color.hex(activeBrand.primary);
+}
+function brandBackground(activeBrand, purple) {
+  return activeBrand.name === "purple" ? purple : color.bgHex(activeBrand.primary);
+}
+function createPalette(activeBrand, mode) {
+  const isPurple = activeBrand.name === "purple";
+  if (mode === "light") {
+    const active2 = color.hex(activeBrand.primary);
+    const prompt2 = isPurple ? color.hex("#006699") : active2;
+    const number2 = isPurple ? color.hex("#0077cc") : active2;
+    return withStyles(
+      {
+        header: (text5) => active2.bold(text5),
+        divider: (text5) => color.hex("#666666")(text5),
+        prompt: (text5) => prompt2.bold(text5),
+        number: (text5) => number2.bold(text5),
+        intro: (text5) => color.bgHex(activeBrand.primary).white(` ${getThemeConfig().label} - ${text5} `),
+        get resolvedSymbol() {
+          return active2("\u25C7");
+        },
+        get errorSymbol() {
+          return color.hex("#cc0000")("\u25A0");
+        },
+        accent: (text5) => prompt2.bold(text5),
+        muted: (text5) => color.hex("#666666")(text5),
+        success: (text5) => color.hex("#008800")(text5),
+        warning: (text5) => color.hex("#cc6600")(text5),
+        error: (text5) => color.hex("#cc0000")(text5),
+        info: (text5) => active2(text5),
+        badge: (text5) => color.bgHex("#cc6600").white(` ${text5} `)
+      },
+      {
+        accent: { fg: isPurple ? "#006699" : activeBrand.primary, bold: true },
+        muted: { fg: "#666666" },
+        success: { fg: "#008800" },
+        warning: { fg: "#cc6600" },
+        error: { fg: "#cc0000" },
+        info: { fg: activeBrand.primary }
+      }
+    );
+  }
+  const active = brandColor(activeBrand, color.magenta);
+  const activeBright = brandColor(activeBrand, color.magentaBright);
+  const activeBackground = brandBackground(activeBrand, color.bgMagenta);
+  const prompt = isPurple ? color.cyan : active;
+  const number = isPurple ? color.cyanBright : active;
+  return withStyles(
+    {
+      header: (text5) => activeBright.bold(text5),
+      divider: (text5) => color.dim(text5),
+      prompt: (text5) => prompt(text5),
+      number: (text5) => number(text5),
+      intro: (text5) => activeBackground.white(` ${getThemeConfig().label} - ${text5} `),
+      get resolvedSymbol() {
+        return active("\u25C7");
+      },
+      get errorSymbol() {
+        return color.red("\u25A0");
+      },
+      accent: (text5) => prompt(text5),
+      muted: (text5) => color.dim(text5),
+      success: (text5) => color.green(text5),
+      warning: (text5) => color.yellow(text5),
+      error: (text5) => color.red(text5),
+      info: (text5) => active(text5),
+      badge: (text5) => color.bgYellow.black(` ${text5} `)
+    },
+    {
+      accent: { fg: isPurple ? "cyan" : activeBrand.primary, bold: true },
+      muted: { dim: true },
+      success: { fg: "green" },
+      warning: { fg: "yellow" },
+      error: { fg: "red" },
+      info: { fg: isPurple ? "magenta" : activeBrand.primary }
+    }
+  );
+}
+var dark = createPalette(brands.purple, "dark");
+var light = createPalette(brands.purple, "light");
 
-// ../design-system/src/tokens/typography.ts
+// ../toolcraft-design/src/tokens/typography.ts
 var typography = {
   bold: (text5) => color.bold(text5),
   dim: (text5) => color.dim(text5),
@@ -179,14 +273,14 @@ var typography = {
   strikethrough: (text5) => color.strikethrough(text5)
 };
 
-// ../design-system/src/tokens/widths.ts
+// ../toolcraft-design/src/tokens/widths.ts
 var widths = {
   header: 60,
   helpColumn: 24,
   maxLine: 80
 };
 
-// ../design-system/src/internal/output-format.ts
+// ../toolcraft-design/src/internal/output-format.ts
 import { AsyncLocalStorage } from "node:async_hooks";
 var VALID_FORMATS = /* @__PURE__ */ new Set(["terminal", "markdown", "json"]);
 var formatStorage = new AsyncLocalStorage();
@@ -207,7 +301,7 @@ function resetOutputFormatCache() {
   cached = void 0;
 }
 
-// ../design-system/src/internal/theme-detect.ts
+// ../toolcraft-design/src/internal/theme-detect.ts
 function detectThemeFromEnv(env) {
   const apple = env.APPLE_INTERFACE_STYLE;
   if (typeof apple === "string") {
@@ -244,17 +338,30 @@ function resolveThemeName(env = process.env) {
   }
   return "dark";
 }
-var cachedTheme;
+var themeCache = /* @__PURE__ */ new Map();
+var cachedRevision = -1;
 function getTheme(env) {
+  const themeName = resolveThemeName(env);
+  const config2 = getThemeConfig();
+  const requestedBrand = env?.POE_BRAND?.toLowerCase();
+  const activeBrandName = !isThemeBrandConfigured() && requestedBrand && Object.hasOwn(brands, requestedBrand) ? requestedBrand : config2.brand;
+  const revision2 = getThemeRevision();
+  if (revision2 !== cachedRevision) {
+    themeCache.clear();
+    cachedRevision = revision2;
+  }
+  const cacheKey = `${activeBrandName}:${themeName}`;
+  const cachedTheme = themeCache.get(cacheKey);
   if (cachedTheme) {
     return cachedTheme;
   }
-  const themeName = resolveThemeName(env);
-  cachedTheme = themeName === "light" ? light : dark;
-  return cachedTheme;
+  const activeBrand = brands[activeBrandName];
+  const theme = activeBrandName === "purple" ? themeName === "light" ? light : dark : createPalette(activeBrand, themeName);
+  themeCache.set(cacheKey, theme);
+  return theme;
 }
 
-// ../design-system/src/components/text.ts
+// ../toolcraft-design/src/components/text.ts
 function renderMarkdownInline(content) {
   return content.replaceAll("\r\n", " ").replaceAll("\n", " ").replaceAll("\r", " ");
 }
@@ -370,7 +477,7 @@ var text = {
   }
 };
 
-// ../design-system/src/components/symbols.ts
+// ../toolcraft-design/src/components/symbols.ts
 var symbols = {
   get info() {
     const format = resolveOutputFormat();
@@ -424,12 +531,12 @@ var symbols = {
   }
 };
 
-// ../design-system/src/internal/strip-ansi.ts
+// ../toolcraft-design/src/internal/strip-ansi.ts
 function stripAnsi(value) {
   return value.replace(/\u001b\[[0-9;]*m/g, "");
 }
 
-// ../design-system/src/prompts/primitives/log.ts
+// ../toolcraft-design/src/prompts/primitives/log.ts
 function renderMarkdownInline2(value) {
   return stripAnsi(value).replaceAll("\r\n", " ").replaceAll("\n", " ").replaceAll("\r", " ");
 }
@@ -556,7 +663,7 @@ var log = {
   error
 };
 
-// ../design-system/src/components/logger.ts
+// ../toolcraft-design/src/components/logger.ts
 function createLogger(emitter) {
   const emit = (level, message2) => {
     if (emitter) {
@@ -617,7 +724,7 @@ function createLogger(emitter) {
 }
 var logger = createLogger();
 
-// ../design-system/src/components/help-formatter.ts
+// ../toolcraft-design/src/components/help-formatter.ts
 var graphemeSegmenter = new Intl.Segmenter(void 0, { granularity: "grapheme" });
 function normalizeInline(value) {
   return value.replaceAll("\r\n", " ").replaceAll("\n", " ").replaceAll("\r", " ");
@@ -793,7 +900,7 @@ function formatOptionList(options) {
   });
 }
 
-// ../design-system/src/components/help-formatter-plain.ts
+// ../toolcraft-design/src/components/help-formatter-plain.ts
 var help_formatter_plain_exports = {};
 __export(help_formatter_plain_exports, {
   formatColumns: () => formatColumns2,
@@ -930,7 +1037,7 @@ function formatOptionList2(options) {
   });
 }
 
-// ../design-system/src/components/table.ts
+// ../toolcraft-design/src/components/table.ts
 var reset2 = "\x1B[0m";
 var ellipsis = "\u2026";
 var graphemeSegmenter2 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
@@ -1214,7 +1321,7 @@ function renderTable(options) {
   }
 }
 
-// ../design-system/src/components/detail-card.ts
+// ../toolcraft-design/src/components/detail-card.ts
 function wrap(value, width) {
   const lines = [];
   for (const paragraph of value.split("\n")) {
@@ -1277,7 +1384,7 @@ ${options.theme.muted(options.badges.map((badge) => badge[0] + badge.slice(1).to
   return blocks.join("\n\n");
 }
 
-// ../design-system/src/components/template.ts
+// ../toolcraft-design/src/components/template.ts
 var MAX_PARTIAL_DEPTH = 100;
 var HTML_ESCAPE = {
   "&": "&",
@@ -1689,22 +1796,22 @@ function hasProperty(value, key2) {
   return Object.prototype.hasOwnProperty.call(value, key2);
 }
 
-// ../design-system/src/components/browser.ts
+// ../toolcraft-design/src/components/browser.ts
 import { spawn } from "node:child_process";
 import process2 from "node:process";
 
-// ../design-system/src/acp/writer.ts
+// ../toolcraft-design/src/acp/writer.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 var storage = new AsyncLocalStorage2();
 
-// ../design-system/src/dashboard/terminal-width.ts
+// ../toolcraft-design/src/dashboard/terminal-width.ts
 var graphemeSegmenter3 = new Intl.Segmenter(void 0, { granularity: "grapheme" });
 
-// ../design-system/src/dashboard/terminal.ts
+// ../toolcraft-design/src/dashboard/terminal.ts
 import readline from "node:readline";
 import { PassThrough } from "node:stream";
 
-// ../design-system/src/explorer/state.ts
+// ../toolcraft-design/src/explorer/state.ts
 var REGION_HEADER = 1 << 0;
 var REGION_LIST = 1 << 1;
 var REGION_DETAIL = 1 << 2;
@@ -1713,10 +1820,10 @@ var REGION_MODAL = 1 << 4;
 var REGION_TOAST = 1 << 5;
 var REGION_ALL = REGION_HEADER | REGION_LIST | REGION_DETAIL | REGION_FOOTER | REGION_MODAL | REGION_TOAST;
 
-// ../design-system/src/prompts/index.ts
+// ../toolcraft-design/src/prompts/index.ts
 import * as clack from "@clack/prompts";
 
-// ../design-system/src/prompts/primitives/cancel.ts
+// ../toolcraft-design/src/prompts/primitives/cancel.ts
 import { isCancel } from "@clack/prompts";
 function cancel(msg = "") {
   if (resolveOutputFormat() !== "terminal") {
@@ -1727,7 +1834,7 @@ function cancel(msg = "") {
 `);
 }
 
-// ../design-system/src/prompts/primitives/note.ts
+// ../toolcraft-design/src/prompts/primitives/note.ts
 function getVisibleWidth(value) {
   return stripAnsi(value).length;
 }
@@ -1776,10 +1883,10 @@ function note(message2, title) {
 `);
 }
 
-// ../design-system/src/static/spinner.ts
+// ../toolcraft-design/src/static/spinner.ts
 var SPINNER_FRAMES = Object.freeze(["\u25D2", "\u25D0", "\u25D3", "\u25D1"]);
 
-// ../design-system/src/prompts/index.ts
+// ../toolcraft-design/src/prompts/index.ts
 async function select2(opts) {
   return clack.select(opts);
 }
@@ -1822,19 +1929,19 @@ var ApprovalDeclinedError = class extends UserError {
 };
 
 // ../toolcraft/src/human-in-loop/config.ts
-function validateHumanInLoopOnDefine(config) {
-  const label = Array.isArray(config.children) ? "group" : "command";
-  if (config.confirm === true && config.humanInLoop !== void 0 && config.humanInLoop !== null) {
-    throw new Error(`${label} '${config.name}': use either confirm or humanInLoop, not both`);
+function validateHumanInLoopOnDefine(config2) {
+  const label = Array.isArray(config2.children) ? "group" : "command";
+  if (config2.confirm === true && config2.humanInLoop !== void 0 && config2.humanInLoop !== null) {
+    throw new Error(`${label} '${config2.name}': use either confirm or humanInLoop, not both`);
   }
-  if (config.humanInLoop === void 0 || config.humanInLoop === null) {
+  if (config2.humanInLoop === void 0 || config2.humanInLoop === null) {
     return;
   }
-  if (config.humanInLoop.mode !== "sync" && config.humanInLoop.mode !== "async") {
-    throw new Error(`${label} '${config.name}': humanInLoop.mode must be "sync" or "async"`);
+  if (config2.humanInLoop.mode !== "sync" && config2.humanInLoop.mode !== "async") {
+    throw new Error(`${label} '${config2.name}': humanInLoop.mode must be "sync" or "async"`);
   }
-  if (typeof config.humanInLoop.message !== "function") {
-    throw new Error(`${label} '${config.name}': humanInLoop.message must be a function`);
+  if (typeof config2.humanInLoop.message !== "function") {
+    throw new Error(`${label} '${config2.name}': humanInLoop.message must be a function`);
   }
 }
 function mergeHumanInLoopFromGroup(groupHumanInLoop, childHumanInLoop) {
@@ -1910,12 +2017,12 @@ function assertValidBranches(branches, discriminator) {
     }
   }
 }
-function OneOf(config) {
-  assertValidBranches(config.branches, config.discriminator);
+function OneOf(config2) {
+  assertValidBranches(config2.branches, config2.discriminator);
   return {
     kind: "oneOf",
-    discriminator: config.discriminator,
-    branches: config.branches
+    discriminator: config2.discriminator,
+    branches: config2.branches
   };
 }
 
@@ -2165,22 +2272,22 @@ function cloneStringArray(values) {
 function cloneStringRecord(values) {
   return values === void 0 ? void 0 : { ...values };
 }
-function cloneMcpServerConfig(config) {
-  if (config === void 0) {
+function cloneMcpServerConfig(config2) {
+  if (config2 === void 0) {
     return void 0;
   }
-  if (config.transport === "stdio") {
+  if (config2.transport === "stdio") {
     return {
       transport: "stdio",
-      command: config.command,
-      args: cloneStringArray(config.args),
-      env: cloneStringRecord(config.env)
+      command: config2.command,
+      args: cloneStringArray(config2.args),
+      env: cloneStringRecord(config2.env)
     };
   }
   return {
     transport: "http",
-    url: config.url,
-    headers: cloneStringRecord(config.headers)
+    url: config2.url,
+    headers: cloneStringRecord(config2.headers)
   };
 }
 function cloneRenameMap(rename5) {
@@ -2421,57 +2528,57 @@ function resolveCommandScope(ownScope, inheritedScope) {
 function resolveGroupScope(ownScope, inheritedScope) {
   return cloneScope(ownScope ?? inheritedScope);
 }
-function createBaseCommand(config) {
+function createBaseCommand(config2) {
   const command = {
     kind: "command",
-    name: config.name,
-    description: config.description,
-    aliases: [...config.aliases ?? []],
-    positional: [...config.positional ?? []],
-    params: config.params,
-    secrets: cloneSecrets(config.secrets),
-    scope: resolveCommandScope(config.scope, void 0),
-    confirm: config.confirm ?? false,
-    humanInLoop: config.humanInLoop,
-    requires: cloneRequires(config.requires),
-    handler: config.handler,
-    render: config.render
+    name: config2.name,
+    description: config2.description,
+    aliases: [...config2.aliases ?? []],
+    positional: [...config2.positional ?? []],
+    params: config2.params,
+    secrets: cloneSecrets(config2.secrets),
+    scope: resolveCommandScope(config2.scope, void 0),
+    confirm: config2.confirm ?? false,
+    humanInLoop: config2.humanInLoop,
+    requires: cloneRequires(config2.requires),
+    handler: config2.handler,
+    render: config2.render
   };
   Object.defineProperty(command, commandConfigSymbol, {
     value: {
-      scope: cloneScope(config.scope),
-      humanInLoop: config.humanInLoop,
-      secrets: cloneSecrets(config.secrets),
-      requires: cloneRequires(config.requires),
+      scope: cloneScope(config2.scope),
+      humanInLoop: config2.humanInLoop,
+      secrets: cloneSecrets(config2.secrets),
+      requires: cloneRequires(config2.requires),
       sourcePath: inferCommandSourcePath()
     }
   });
   return command;
 }
-function createBaseGroup(config) {
+function createBaseGroup(config2) {
   const group = {
     kind: "group",
-    name: config.name,
-    description: config.description,
-    aliases: [...config.aliases ?? []],
-    scope: resolveGroupScope(config.scope, void 0),
-    humanInLoop: config.humanInLoop,
-    secrets: cloneSecrets(config.secrets),
-    requires: cloneRequires(config.requires),
+    name: config2.name,
+    description: config2.description,
+    aliases: [...config2.aliases ?? []],
+    scope: resolveGroupScope(config2.scope, void 0),
+    humanInLoop: config2.humanInLoop,
+    secrets: cloneSecrets(config2.secrets),
+    requires: cloneRequires(config2.requires),
     children: [],
     default: void 0
   };
   Object.defineProperty(group, groupConfigSymbol, {
     value: {
-      mcp: cloneMcpServerConfig(config.mcp),
-      scope: cloneScope(config.scope),
-      humanInLoop: config.humanInLoop,
-      secrets: cloneSecrets(config.secrets),
-      tools: cloneStringArray(config.tools),
-      rename: cloneRenameMap(config.rename),
-      requires: cloneRequires(config.requires),
-      children: [...config.children],
-      default: config.default
+      mcp: cloneMcpServerConfig(config2.mcp),
+      scope: cloneScope(config2.scope),
+      humanInLoop: config2.humanInLoop,
+      secrets: cloneSecrets(config2.secrets),
+      tools: cloneStringArray(config2.tools),
+      rename: cloneRenameMap(config2.rename),
+      requires: cloneRequires(config2.requires),
+      children: [...config2.children],
+      default: config2.default
     }
   });
   return group;
@@ -2574,10 +2681,10 @@ function materializeNode(node, inherited) {
   }
   return materializeGroup(node, inherited);
 }
-function defineCommand(config) {
-  validateHumanInLoopOnDefine(config);
+function defineCommand(config2) {
+  validateHumanInLoopOnDefine(config2);
   return materializeCommand(
-    createBaseCommand(config),
+    createBaseCommand(config2),
     {
       scope: void 0,
       humanInLoop: void 0,
@@ -2586,10 +2693,10 @@ function defineCommand(config) {
     }
   );
 }
-function defineGroup(config) {
-  validateRenameMap(config.rename);
-  validateHumanInLoopOnDefine(config);
-  return materializeGroup(createBaseGroup(config), {
+function defineGroup(config2) {
+  validateRenameMap(config2.rename);
+  validateHumanInLoopOnDefine(config2);
+  return materializeGroup(createBaseGroup(config2), {
     scope: void 0,
     humanInLoop: void 0,
     secrets: {},
@@ -2620,27 +2727,27 @@ function validateMachine(machine) {
   if (!isRecord(machine)) {
     throw new TypeError("State machine must be an object.");
   }
-  if (!isStateList(machine.states)) {
+  if (!hasOwnRecordField(machine, "states") || !isStateList(machine.states)) {
     throw new TypeError("State machine states must be a string array.");
   }
   const states = new Set(machine.states);
-  if (typeof machine.initial !== "string") {
+  if (!hasOwnRecordField(machine, "initial") || typeof machine.initial !== "string") {
     throw new TypeError("State machine initial must be a string.");
   }
   if (!states.has(machine.initial)) {
     throw new Error(`Initial state "${machine.initial}" is not declared.`);
   }
-  if (!isRecord(machine.events)) {
+  if (!hasOwnRecordField(machine, "events") || !isRecord(machine.events)) {
     throw new TypeError("State machine events must be an object.");
   }
   for (const [eventName, event] of Object.entries(machine.events)) {
     if (!isRecord(event)) {
       throw new TypeError(`Event "${eventName}" must be an object.`);
     }
-    if (event.from !== "*" && !isStateList(event.from)) {
+    if (!hasOwnRecordField(event, "from") || event.from !== "*" && !isStateList(event.from)) {
       throw new TypeError(`Event "${eventName}" has an invalid "from" definition.`);
     }
-    if (typeof event.to !== "string") {
+    if (!hasOwnRecordField(event, "to") || typeof event.to !== "string") {
       throw new TypeError(`Event "${eventName}" target state must be a string.`);
     }
     if (!states.has(event.to)) {
@@ -2655,6 +2762,9 @@ function validateMachine(machine) {
     }
   }
 }
+function hasOwnRecordField(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2);
+}
 function eventsFromState(machine, fromState) {
   const events = [];
   for (const [eventName, event] of Object.entries(machine.events)) {
@@ -2758,7 +2868,7 @@ import path3 from "node:path";
 // ../process-runner/src/docker/docker-execution-env.ts
 import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "node:fs";
-import { readdir, readFile, writeFile } from "node:fs/promises";
+import { readdir, readFile, realpath, writeFile } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import path5 from "node:path";
 
@@ -2926,6 +3036,7 @@ function resolveEndpoint(options = {}) {
 }
 
 // ../task-list/src/backends/utils.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
 import path6 from "node:path";
 function compareCreated(left, right) {
   const leftCreated = typeof left.raw.created === "string" ? left.raw.created : "";
@@ -2946,9 +3057,8 @@ function applyOrder(entries, order) {
   }
   return entries.map((entry) => entry.task);
 }
-var tmpFileCounter = 0;
 function hasErrorCode(error3, code) {
-  return !!error3 && typeof error3 === "object" && "code" in error3 && error3.code === code;
+  return !!error3 && typeof error3 === "object" && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === code;
 }
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -2995,18 +3105,22 @@ async function rejectSymbolicLinkComponents(fs4, filePath) {
   }
 }
 async function writeAtomically(fs4, filePath, content) {
-  const tempPath = `${filePath}.tmp-${process.pid}-${tmpFileCounter}`;
-  tmpFileCounter += 1;
+  const tempPath = `${filePath}.${process.pid}.${randomUUID2()}.tmp`;
+  let tempCreated = false;
   await fs4.mkdir(path6.dirname(filePath), { recursive: true });
   try {
     await fs4.writeFile(tempPath, content, { encoding: "utf8", flag: "wx" });
+    tempCreated = true;
     await fs4.rename(tempPath, filePath);
+    tempCreated = false;
   } catch (error3) {
-    try {
-      await fs4.unlink(tempPath);
-    } catch (unlinkError) {
-      if (!hasErrorCode(unlinkError, "ENOENT")) {
-        throw unlinkError;
+    if (tempCreated || !hasErrorCode(error3, "EEXIST")) {
+      try {
+        await fs4.unlink(tempPath);
+      } catch (unlinkError) {
+        if (!hasErrorCode(unlinkError, "ENOENT")) {
+          throw unlinkError;
+        }
       }
     }
     throw error3;
@@ -3020,6 +3134,7 @@ async function withFileLock(fs4, lockPath, operation) {
       break;
     } catch (error3) {
       if (!hasErrorCode(error3, "EEXIST")) {
+        await fs4.unlink(lockPath).catch(() => void 0);
         throw error3;
       }
       if (await removeAbandonedLock(fs4, lockPath)) {
@@ -4303,27 +4418,30 @@ function readFrontmatter(frontmatterContent, filePath) {
   return parsed;
 }
 function assertValidTaskRecord(frontmatter, filePath, validStates) {
-  if ("$schema" in frontmatter && frontmatter.$schema !== TASK_SCHEMA_ID) {
+  if (hasOwnTaskField(frontmatter, "$schema") && frontmatter.$schema !== TASK_SCHEMA_ID) {
     throw malformedTask(filePath, "$schema");
   }
-  if ("kind" in frontmatter && frontmatter.kind !== TASK_KIND) {
+  if (hasOwnTaskField(frontmatter, "kind") && frontmatter.kind !== TASK_KIND) {
     throw malformedTask(filePath, "kind");
   }
-  if ("version" in frontmatter) {
+  if (hasOwnTaskField(frontmatter, "version")) {
     if (typeof frontmatter.version !== "number" || !Number.isInteger(frontmatter.version) || frontmatter.version !== TASK_VERSION) {
       throw malformedTask(filePath, "version");
     }
   }
-  if (typeof frontmatter.name !== "string" || frontmatter.name.length === 0) {
+  if (!hasOwnTaskField(frontmatter, "name") || typeof frontmatter.name !== "string" || frontmatter.name.length === 0) {
     throw malformedTask(filePath, "name");
   }
-  if (typeof frontmatter.state !== "string" || !validStates.has(frontmatter.state)) {
+  if (!hasOwnTaskField(frontmatter, "state") || typeof frontmatter.state !== "string" || !validStates.has(frontmatter.state)) {
     throw malformedTask(filePath, "state");
   }
-  if ("description" in frontmatter && typeof frontmatter.description !== "string") {
+  if (hasOwnTaskField(frontmatter, "description") && typeof frontmatter.description !== "string") {
     throw malformedTask(filePath, "description");
   }
 }
+function hasOwnTaskField(frontmatter, key2) {
+  return Object.prototype.hasOwnProperty.call(frontmatter, key2);
+}
 function reservedFrontmatterKeys(mode) {
   return mode === "passthrough" ? PASSTHROUGH_RESERVED_FRONTMATTER_KEYS : RESERVED_FRONTMATTER_KEYS;
 }
@@ -4446,7 +4564,7 @@ async function readTaskAtLocation(fs4, rootPath, layout, list, id, validStates,
   }
   return readTaskFile(fs4, list, id, location.path, validStates, initialState, mode);
 }
-function createdFrontmatter(defaults, input, initialState, mode) {
+function createdFrontmatter(defaults2, input, initialState, mode) {
   const frontmatter = mode !== "passthrough" ? {
     $schema: TASK_SCHEMA_ID,
     kind: TASK_KIND,
@@ -4458,7 +4576,7 @@ function createdFrontmatter(defaults, input, initialState, mode) {
     state: initialState
   };
   const reservedKeys = reservedFrontmatterKeys(mode);
-  for (const [key2, value] of Object.entries(defaults.metadata)) {
+  for (const [key2, value] of Object.entries(defaults2.metadata)) {
     if (!reservedKeys.has(key2)) {
       setOwnValue(frontmatter, key2, value);
     }
@@ -5172,7 +5290,8 @@ function parseQualifiedId3(qualifiedId) {
   };
 }
 function descriptionFromTaskRecord(taskRecord) {
-  return typeof taskRecord.description === "string" ? taskRecord.description : "";
+  const description = getOwnEntry(taskRecord, "description");
+  return typeof description === "string" ? description : "";
 }
 function metadataFromTaskRecord(taskRecord) {
   const metadata = /* @__PURE__ */ Object.create(null);
@@ -5188,8 +5307,8 @@ function createTask2(list, id, taskRecord, sourcePath) {
     list,
     id,
     qualifiedId: `${list}/${id}`,
-    name: taskRecord.name,
-    state: taskRecord.state,
+    name: getOwnEntry(taskRecord, "name"),
+    state: getOwnEntry(taskRecord, "state"),
     description: descriptionFromTaskRecord(taskRecord),
     metadata: metadataFromTaskRecord(taskRecord),
     ...sourcePath !== void 0 && { sourcePath: path8.resolve(sourcePath) }
@@ -5204,13 +5323,13 @@ function matchesFilter(task, filter) {
   }
   return true;
 }
-function createTaskRecord(defaults, input, initialState) {
+function createTaskRecord(defaults2, input, initialState) {
   const taskRecord = Object.assign(/* @__PURE__ */ Object.create(null), {
     name: input.name,
     state: initialState,
     description: input.description ?? ""
   });
-  for (const [key2, value] of Object.entries(defaults.metadata)) {
+  for (const [key2, value] of Object.entries(defaults2.metadata)) {
     if (!RESERVED_TASK_KEYS.has(key2)) {
       taskRecord[key2] = value;
     }
@@ -5286,16 +5405,17 @@ function assertValidStoreRecord(store, filePath) {
   if (!isRecord2(store)) {
     throw malformedStore(filePath, "store");
   }
-  if (store.$schema !== STORE_SCHEMA_ID) {
+  if (getOwnEntry(store, "$schema") !== STORE_SCHEMA_ID) {
     throw malformedStore(filePath, "$schema");
   }
-  if (store.kind !== STORE_KIND) {
+  if (getOwnEntry(store, "kind") !== STORE_KIND) {
     throw malformedStore(filePath, "kind");
   }
-  if (typeof store.version !== "number" || !Number.isInteger(store.version) || store.version !== STORE_VERSION) {
+  const version = getOwnEntry(store, "version");
+  if (typeof version !== "number" || !Number.isInteger(version) || version !== STORE_VERSION) {
     throw malformedStore(filePath, "version");
   }
-  if (!isRecord2(store.lists)) {
+  if (!isRecord2(getOwnEntry(store, "lists"))) {
     throw malformedStore(filePath, "lists");
   }
 }
@@ -5303,29 +5423,38 @@ function assertValidTaskRecord2(taskRecord, list, id, validStates) {
   if (!isRecord2(taskRecord)) {
     throw malformedTask2(list, id, "task");
   }
-  if ("$schema" in taskRecord && taskRecord.$schema !== TASK_SCHEMA_ID2) {
+  if (hasOwnTaskField2(taskRecord, "$schema") && getOwnEntry(taskRecord, "$schema") !== TASK_SCHEMA_ID2) {
     throw malformedTask2(list, id, "$schema");
   }
-  if ("kind" in taskRecord && taskRecord.kind !== TASK_KIND2) {
+  if (hasOwnTaskField2(taskRecord, "kind") && getOwnEntry(taskRecord, "kind") !== TASK_KIND2) {
     throw malformedTask2(list, id, "kind");
   }
-  if ("version" in taskRecord) {
-    if (typeof taskRecord.version !== "number" || !Number.isInteger(taskRecord.version) || taskRecord.version !== TASK_VERSION2) {
+  if (hasOwnTaskField2(taskRecord, "version")) {
+    const version = getOwnEntry(taskRecord, "version");
+    if (typeof version !== "number" || !Number.isInteger(version) || version !== TASK_VERSION2) {
       throw malformedTask2(list, id, "version");
     }
   }
-  if (typeof taskRecord.name !== "string" || taskRecord.name.length === 0) {
+  const name = getOwnEntry(taskRecord, "name");
+  if (!hasOwnTaskField2(taskRecord, "name") || typeof name !== "string" || name.length === 0) {
     throw malformedTask2(list, id, "name");
   }
-  if (typeof taskRecord.state !== "string" || !validStates.has(taskRecord.state)) {
+  const state = getOwnEntry(taskRecord, "state");
+  if (!hasOwnTaskField2(taskRecord, "state") || typeof state !== "string" || !validStates.has(state)) {
     throw malformedTask2(list, id, "state");
   }
-  if ("description" in taskRecord && typeof taskRecord.description !== "string") {
+  if (hasOwnTaskField2(taskRecord, "description") && typeof getOwnEntry(taskRecord, "description") !== "string") {
     throw malformedTask2(list, id, "description");
   }
 }
+function hasOwnTaskField2(taskRecord, key2) {
+  return Object.prototype.hasOwnProperty.call(taskRecord, key2);
+}
+function getOwnEntry(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
 function validateStoreEntries(store, filePath, validStates) {
-  const lists = store.lists;
+  const lists = getOwnEntry(store, "lists");
   if (!isRecord2(lists)) {
     throw malformedStore(filePath, "lists");
   }
@@ -5365,10 +5494,11 @@ async function readStore(fs4, filePath, validStates) {
   };
 }
 function getListsRecord(store) {
-  return store.lists;
+  const lists = getOwnEntry(store, "lists");
+  return isRecord2(lists) ? lists : {};
 }
 function getListRecord(store, list) {
-  const listRecord = getListsRecord(store)[list];
+  const listRecord = getOwnEntry(getListsRecord(store), list);
   return isRecord2(listRecord) ? listRecord : void 0;
 }
 function getTaskRecord(store, list, id) {
@@ -5661,7 +5791,7 @@ async function yamlFileBackend(deps) {
     const result = [];
     const listNames = sortStrings(Object.keys(getListsRecord(store)));
     for (const listName of listNames) {
-      const listRecord = getListsRecord(store)[listName];
+      const listRecord = getOwnEntry(getListsRecord(store), listName);
       if (!isRecord2(listRecord)) continue;
       const entries = Object.entries(listRecord).map(([id, taskRecord]) => ({
         task: createTask2(listName, id, taskRecord, deps.path),
@@ -6295,8 +6425,8 @@ function createHandlerContext(command, params17) {
 function createFs() {
   return {
     readFile: async (path24, encoding = "utf8") => readFile2(path24, { encoding }),
-    writeFile: async (path24, contents) => {
-      await writeFile2(path24, contents);
+    writeFile: async (path24, contents, options) => {
+      await writeFile2(path24, contents, options);
     },
     exists: async (path24) => {
       try {
@@ -6584,17 +6714,17 @@ function isMissingStateError(error3) {
 }
 
 // ../toolcraft/src/error-report.ts
-import { mkdir as mkdir2, realpath, writeFile as writeFile4 } from "node:fs/promises";
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { mkdir as mkdir2, realpath as realpath2, writeFile as writeFile4 } from "node:fs/promises";
+import { randomUUID as randomUUID5 } from "node:crypto";
 import os from "node:os";
 import path13 from "node:path";
 import { CommanderError } from "commander";
 
 // ../toolcraft/src/mcp-proxy.ts
 import { existsSync as existsSync2 } from "node:fs";
-import { lstat as lstat2, mkdir, readFile as readFile3, rename as rename2, writeFile as writeFile3 } from "node:fs/promises";
+import { lstat as lstat2, mkdir, readFile as readFile3, rename as rename2, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
 import path12 from "node:path";
-import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash3, randomUUID as randomUUID4 } from "node:crypto";
 
 // ../tiny-mcp-client/src/internal.ts
 import { spawn as spawn5 } from "node:child_process";
@@ -6605,7 +6735,7 @@ import crypto from "node:crypto";
 import path11 from "node:path";
 
 // ../auth-store/src/encrypted-file-store.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes4, scrypt } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes4, randomUUID as randomUUID3, scrypt } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
 import path10 from "node:path";
@@ -6616,7 +6746,6 @@ var ENCRYPTION_KEY_BYTES = 32;
 var ENCRYPTION_IV_BYTES = 12;
 var ENCRYPTION_AUTH_TAG_BYTES = 16;
 var ENCRYPTION_FILE_MODE = 384;
-var temporaryFileSequence = 0;
 var EncryptedFileStore = class {
   fs;
   filePath;
@@ -6648,7 +6777,7 @@ var EncryptedFileStore = class {
     this.getRandomBytes = input.getRandomBytes ?? randomBytes4;
   }
   async get() {
-    await this.assertRegularCredentialPath();
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
     let rawDocument;
     try {
       rawDocument = await this.fs.readFile(this.filePath, "utf8");
@@ -6679,7 +6808,7 @@ var EncryptedFileStore = class {
     }
   }
   async set(value) {
-    await this.assertRegularCredentialPath();
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
     const key2 = await this.getEncryptionKey();
     const iv = this.getRandomBytes(ENCRYPTION_IV_BYTES);
     const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key2, iv);
@@ -6695,25 +6824,28 @@ var EncryptedFileStore = class {
       ciphertext: ciphertext.toString("base64")
     };
     await this.fs.mkdir(path10.dirname(this.filePath), { recursive: true });
-    await this.assertRegularCredentialPath();
-    const temporaryPath = `${this.filePath}.${process.pid}.${temporaryFileSequence++}.tmp`;
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID3()}.tmp`;
+    let temporaryCreated = false;
     try {
+      await this.assertCredentialPathHasNoSymbolicLinks(temporaryPath);
       await this.fs.writeFile(temporaryPath, JSON.stringify(document), {
         encoding: "utf8",
         flag: "wx",
         mode: ENCRYPTION_FILE_MODE
       });
+      temporaryCreated = true;
       await this.fs.chmod(temporaryPath, ENCRYPTION_FILE_MODE);
       await this.fs.rename(temporaryPath, this.filePath);
     } catch (error3) {
-      if (!isAlreadyExistsError(error3)) {
+      if (temporaryCreated || !isAlreadyExistsError(error3)) {
         await removeIfPresent(this.fs, temporaryPath).catch(() => void 0);
       }
       throw error3;
     }
   }
   async delete() {
-    await this.assertRegularCredentialPath();
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
     try {
       await this.fs.unlink(this.filePath);
     } catch (error3) {
@@ -6722,8 +6854,8 @@ var EncryptedFileStore = class {
       }
     }
   }
-  async assertRegularCredentialPath() {
-    const resolvedPath = path10.resolve(this.filePath);
+  async assertCredentialPathHasNoSymbolicLinks(targetPath) {
+    const resolvedPath = path10.resolve(targetPath);
     const protectedPaths = getProtectedCredentialPaths(
       resolvedPath,
       this.symbolicLinkCheckStartPath
@@ -6788,9 +6920,6 @@ async function removeIfPresent(fileSystem, filePath) {
     }
   }
 }
-function isAlreadyExistsError(error3) {
-  return typeof error3 === "object" && error3 !== null && "code" in error3 && error3.code === "EEXIST";
-}
 function defaultMachineIdentity() {
   return {
     hostname: hostname(),
@@ -6828,17 +6957,21 @@ function parseEncryptedDocument(raw) {
     if (!isRecord4(parsed)) {
       return null;
     }
-    if (parsed.version !== ENCRYPTION_VERSION) {
+    const version = getOwnEntry2(parsed, "version");
+    const iv = getOwnEntry2(parsed, "iv");
+    const authTag = getOwnEntry2(parsed, "authTag");
+    const ciphertext = getOwnEntry2(parsed, "ciphertext");
+    if (version !== ENCRYPTION_VERSION) {
       return null;
     }
-    if (typeof parsed.iv !== "string" || typeof parsed.authTag !== "string" || typeof parsed.ciphertext !== "string") {
+    if (typeof iv !== "string" || typeof authTag !== "string" || typeof ciphertext !== "string") {
       return null;
     }
     return {
-      version: parsed.version,
-      iv: parsed.iv,
-      authTag: parsed.authTag,
-      ciphertext: parsed.ciphertext
+      version,
+      iv,
+      authTag,
+      ciphertext
     };
   } catch {
     return null;
@@ -6847,9 +6980,17 @@ function parseEncryptedDocument(raw) {
 function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
+function getOwnEntry2(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
 function isNotFoundError(error3) {
   return Boolean(
-    error3 && typeof error3 === "object" && "code" in error3 && error3.code === "ENOENT"
+    error3 && typeof error3 === "object" && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === "ENOENT"
+  );
+}
+function isAlreadyExistsError(error3) {
+  return Boolean(
+    error3 && typeof error3 === "object" && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === "EEXIST"
   );
 }
 
@@ -6871,8 +7012,8 @@ var KeychainStore = class {
       ["find-generic-password", "-s", this.service, "-a", this.account, "-w"],
       "read secret from macOS Keychain"
     );
-    if (result.exitCode === 0) {
-      return stripTrailingLineBreak(result.stdout);
+    if (getCommandExitCode(result) === 0) {
+      return stripTrailingLineBreak(getCommandOutput(result, "stdout"));
     }
     if (isKeychainEntryNotFound(result)) {
       return null;
@@ -6896,7 +7037,7 @@ var KeychainStore = class {
       "store secret in macOS Keychain",
       { stdin: value }
     );
-    if (result.exitCode !== 0) {
+    if (getCommandExitCode(result) !== 0) {
       throw createSecurityCliFailure("store secret in macOS Keychain", result);
     }
   }
@@ -6905,7 +7046,7 @@ var KeychainStore = class {
       ["delete-generic-password", "-s", this.service, "-a", this.account],
       "delete secret from macOS Keychain"
     );
-    if (result.exitCode === 0 || isKeychainEntryNotFound(result)) {
+    if (getCommandExitCode(result) === 0 || isKeychainEntryNotFound(result)) {
       return;
     }
     throw createSecurityCliFailure("delete secret from macOS Keychain", result);
@@ -6984,16 +7125,28 @@ function stripTrailingLineBreak(value) {
   return value;
 }
 function isKeychainEntryNotFound(result) {
-  return result.exitCode === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE;
+  return getCommandExitCode(result) === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE;
 }
 function createSecurityCliFailure(operation, result) {
-  const details = result.stderr.trim() || result.stdout.trim();
+  const exitCode = getCommandExitCode(result);
+  const details = getCommandOutput(result, "stderr").trim() || getCommandOutput(result, "stdout").trim();
   if (details) {
     return new Error(
-      `Failed to ${operation}: security exited with code ${result.exitCode}: ${details}`
+      `Failed to ${operation}: security exited with code ${exitCode}: ${details}`
     );
   }
-  return new Error(`Failed to ${operation}: security exited with code ${result.exitCode}`);
+  return new Error(`Failed to ${operation}: security exited with code ${exitCode}`);
+}
+function getCommandExitCode(result) {
+  const value = getOwnEntry3(result, "exitCode");
+  return typeof value === "number" && Number.isInteger(value) ? value : 1;
+}
+function getCommandOutput(result, key2) {
+  const value = getOwnEntry3(result, key2);
+  return typeof value === "string" ? value : "";
+}
+function getOwnEntry3(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
 }
 
 // ../auth-store/src/create-secret-store.ts
@@ -7026,7 +7179,7 @@ function createSecretStore(input) {
 }
 function resolveBackend(input) {
   const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
-  const configuredBackend = input.backend ?? input.env?.[envVar] ?? process.env[envVar];
+  const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
   if (configuredBackend === "keychain") {
     return "keychain";
   }
@@ -7035,6 +7188,9 @@ function resolveBackend(input) {
   }
   throw new Error(`Unsupported auth store backend: ${configuredBackend}`);
 }
+function getOwnEnvValue(env, key2) {
+  return env !== void 0 && Object.prototype.hasOwnProperty.call(env, key2) ? env[key2] : void 0;
+}
 
 // ../mcp-oauth/src/resource-indicator.ts
 function canonicalizeResourceIndicator(value) {
@@ -7088,8 +7244,13 @@ function createAuthStoreClientStore(options) {
         return null;
       }
       const parsed = JSON.parse(value);
-      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && typeof parsed.clientId === "string") {
-        return parsed;
+      const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : void 0;
+      if (clientId !== void 0) {
+        const client = { clientId };
+        if (isObjectRecord(parsed) && Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
+          client.clientSecret = getOwnEntry4(parsed, "clientSecret");
+        }
+        return client;
       }
       throw new Error("Stored OAuth client must be a JSON object with clientId");
     },
@@ -7103,19 +7264,24 @@ function createAuthStoreClientStore(options) {
     }
   };
 }
-function createNamedSecretStore(key2, options, defaults) {
+function createNamedSecretStore(key2, options, defaults2) {
   const hash = crypto.createHash("sha256").update(key2).digest("hex");
-  const parsedFilePath = options.fileStore?.filePath === void 0 ? null : path11.parse(options.fileStore.filePath);
+  const configuredFilePath = options.fileStore?.filePath;
+  const parsedFilePath = configuredFilePath === void 0 ? null : path11.parse(configuredFilePath);
   const fileStore = {
     ...options.fileStore,
-    salt: options.fileStore?.salt ?? defaults.salt,
-    defaultDirectory: parsedFilePath?.dir || options.fileStore?.defaultDirectory || defaults.directory,
+    filePath: parsedFilePath === null ? void 0 : path11.join(
+      parsedFilePath.dir,
+      `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
+    ),
+    salt: options.fileStore?.salt ?? defaults2.salt,
+    defaultDirectory: options.fileStore?.defaultDirectory || defaults2.directory,
     defaultFileName: parsedFilePath === null ? `${hash}.enc` : `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
   };
   const keychainStore = {
     ...options.keychainStore,
-    service: options.keychainStore?.service ?? defaults.service,
-    account: `${options.keychainStore?.account ?? defaults.accountPrefix}:${hash}`
+    service: options.keychainStore?.service ?? defaults2.service,
+    account: `${options.keychainStore?.account ?? defaults2.accountPrefix}:${hash}`
   };
   return createSecretStore({ ...options, fileStore, keychainStore }).store;
 }
@@ -7143,6 +7309,16 @@ function createIssuerSecretStore(issuer, options) {
     }
   );
 }
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry4(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+function getOwnString(record, key2) {
+  const value = getOwnEntry4(record, key2);
+  return typeof value === "string" ? value : void 0;
+}
 
 // ../mcp-oauth/src/client/default-oauth-client-provider.ts
 import { URL as URL2 } from "node:url";
@@ -7168,17 +7344,30 @@ function parseAuthorizationState(value) {
   try {
     const decoded = Buffer.from(value, "base64url").toString("utf8");
     const parsed = JSON.parse(decoded);
-    if (parsed.v !== 1 || typeof parsed.n !== "string" || parsed.n.length === 0 || typeof parsed.i !== "string" || parsed.i.length === 0 || typeof parsed.r !== "boolean") {
+    if (!isObjectRecord2(parsed)) {
+      return null;
+    }
+    const version = getOwnEntry5(parsed, "v");
+    const nonce = getOwnEntry5(parsed, "n");
+    const issuer = getOwnEntry5(parsed, "i");
+    const requireIssuer = getOwnEntry5(parsed, "r");
+    if (version !== 1 || typeof nonce !== "string" || nonce.length === 0 || typeof issuer !== "string" || issuer.length === 0 || typeof requireIssuer !== "boolean") {
       return null;
     }
     return {
-      issuer: parsed.i,
-      requireIssuer: parsed.r
+      issuer,
+      requireIssuer
     };
   } catch {
     return null;
   }
 }
+function isObjectRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry5(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
 
 // ../mcp-oauth/src/client/loopback-authorization.ts
 async function createLoopbackAuthorizationSession(options = {}) {
@@ -7455,22 +7644,26 @@ async function requestTokens(input) {
     body: body.toString()
   });
   const payload = await readOAuthJsonObjectResponse(response);
-  if (typeof payload.access_token !== "string" || payload.access_token.trim().length === 0) {
+  const accessToken = getOwnEntry6(payload, "access_token");
+  if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
     throw new Error("OAuth token response missing access_token");
   }
-  const tokenType = normalizeBearerTokenType(payload.token_type);
+  const tokenType = normalizeBearerTokenType(getOwnEntry6(payload, "token_type"));
   if (tokenType === null) {
     throw new Error("OAuth token response missing token_type=Bearer");
   }
-  if (typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) && payload.expires_in < 0) {
+  const expiresIn = getOwnEntry6(payload, "expires_in");
+  if (typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn < 0) {
     throw new Error("OAuth token response has invalid expires_in");
   }
+  const refreshToken = getOwnEntry6(payload, "refresh_token");
+  const scope = getOwnEntry6(payload, "scope");
   return {
-    accessToken: payload.access_token,
-    refreshToken: typeof payload.refresh_token === "string" && payload.refresh_token.length > 0 ? payload.refresh_token : void 0,
+    accessToken,
+    refreshToken: typeof refreshToken === "string" && refreshToken.length > 0 ? refreshToken : void 0,
     tokenType,
-    expiresAt: typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) ? input.now() + payload.expires_in * 1e3 : null,
-    scope: typeof payload.scope === "string" && payload.scope.length > 0 ? payload.scope : void 0
+    expiresAt: typeof expiresIn === "number" && Number.isFinite(expiresIn) ? input.now() + expiresIn * 1e3 : null,
+    scope: typeof scope === "string" && scope.length > 0 ? scope : void 0
   };
 }
 async function readOAuthJsonObjectResponse(response) {
@@ -7497,12 +7690,18 @@ async function readOAuthJsonObjectResponse(response) {
   return record;
 }
 function readOAuthError(payload, fallbackError = "server_error") {
+  const error3 = getOwnEntry6(payload, "error");
+  const errorDescription = getOwnEntry6(payload, "error_description");
+  const errorUri = getOwnEntry6(payload, "error_uri");
   return {
-    error: typeof payload.error === "string" ? payload.error : fallbackError,
-    error_description: typeof payload.error_description === "string" ? payload.error_description : void 0,
-    error_uri: typeof payload.error_uri === "string" ? payload.error_uri : void 0
+    error: typeof error3 === "string" ? error3 : fallbackError,
+    error_description: typeof errorDescription === "string" ? errorDescription : void 0,
+    error_uri: typeof errorUri === "string" ? errorUri : void 0
   };
 }
+function getOwnEntry6(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
 function createFallbackOAuthError(status) {
   const error3 = status === 503 ? "temporarily_unavailable" : "server_error";
   return new OAuthError({ error: error3 }, status);
@@ -7607,7 +7806,11 @@ function createDefaultOAuthClientProvider(options) {
         while (true) {
           try {
             refreshedTokens = await refreshAccessToken({
-              tokenEndpoint: discovery.authorizationServerMetadata.token_endpoint,
+              tokenEndpoint: requireOwnString(
+                discovery.authorizationServerMetadata,
+                "token_endpoint",
+                "Authorization server metadata"
+              ),
               clientId: session.client.clientId,
               clientSecret: session.client.clientSecret,
               refreshToken: session.tokens.refreshToken,
@@ -7695,7 +7898,11 @@ function createDefaultOAuthClientProvider(options) {
           });
           const code = await loopback.waitForCode(authorizationUrl);
           const tokens = await exchangeAuthorizationCode({
-            tokenEndpoint: discovery.authorizationServerMetadata.token_endpoint,
+            tokenEndpoint: requireOwnString(
+              discovery.authorizationServerMetadata,
+              "token_endpoint",
+              "Authorization server metadata"
+            ),
             clientId: resolvedClient.client.clientId,
             clientSecret: resolvedClient.client.clientSecret,
             code,
@@ -7748,7 +7955,10 @@ function createDefaultOAuthClientProvider(options) {
         }
       };
     }
-    const registrationEndpoint = discovery.authorizationServerMetadata.registration_endpoint;
+    const registrationEndpoint = getOwnString2(
+      discovery.authorizationServerMetadata,
+      "registration_endpoint"
+    );
     if (registrationEndpoint === void 0 && options.client.clientId !== void 0) {
       return {
         kind: "static",
@@ -7800,12 +8010,14 @@ function createDefaultOAuthClientProvider(options) {
       body: JSON.stringify(registrationBody)
     });
     const payload = await readOAuthJsonObjectResponse(response);
-    if (typeof payload.client_id !== "string" || payload.client_id.trim().length === 0) {
+    const clientId = getOwnString2(payload, "client_id");
+    if (clientId === void 0 || clientId.trim().length === 0) {
       throw new Error("OAuth client registration response missing client_id");
     }
+    const clientSecret = getOwnString2(payload, "client_secret");
     const registeredClient = {
-      clientId: payload.client_id,
-      clientSecret: typeof payload.client_secret === "string" && payload.client_secret.length > 0 ? payload.client_secret : void 0
+      clientId,
+      clientSecret: clientSecret !== void 0 && clientSecret.length > 0 ? clientSecret : void 0
     };
     await saveRegisteredClient(discovery.authorizationServer, registeredClient);
     return {
@@ -7831,12 +8043,13 @@ function createDefaultOAuthClientProvider(options) {
       return null;
     }
     const client = await clientStore.load(issuer);
-    if (client !== null && !isUsableClient(client)) {
+    const normalizedClient = client === null ? null : normalizeStoredClient(client);
+    if (client !== null && normalizedClient === null) {
       await clientStore.clear(issuer);
       return null;
     }
-    registeredClients.set(issuer, client);
-    return client;
+    registeredClients.set(issuer, normalizedClient);
+    return normalizedClient;
   }
   async function saveRegisteredClient(issuer, client) {
     registeredClients.set(issuer, client);
@@ -7852,7 +8065,7 @@ function createDefaultOAuthClientProvider(options) {
   }
 }
 function isProviderOptions(options) {
-  return "provider" in options;
+  return Object.prototype.hasOwnProperty.call(options, "provider");
 }
 function isExpired(tokens, now) {
   return tokens.expiresAt !== null && tokens.expiresAt <= now();
@@ -7868,7 +8081,14 @@ function resolveDiscovery(discovery, session) {
     return void 0;
   }
   const metadata = session.discovery.authorizationServerMetadata;
-  if (typeof metadata.issuer !== "string" || typeof metadata.authorization_endpoint !== "string" || typeof metadata.token_endpoint !== "string" || !Array.isArray(metadata.code_challenge_methods_supported) || !metadata.code_challenge_methods_supported.includes("S256")) {
+  const issuer = getOwnString2(metadata, "issuer");
+  const authorizationEndpoint = getOwnString2(metadata, "authorization_endpoint");
+  const tokenEndpoint = getOwnString2(metadata, "token_endpoint");
+  const codeChallengeMethodsSupported = getOwnStringArray(
+    metadata,
+    "code_challenge_methods_supported"
+  );
+  if (issuer === void 0 || authorizationEndpoint === void 0 || tokenEndpoint === void 0 || codeChallengeMethodsSupported === void 0 || !codeChallengeMethodsSupported.includes("S256")) {
     return void 0;
   }
   return {
@@ -7892,29 +8112,94 @@ function normalizeLoadedSession(session) {
   if (session === null) {
     return null;
   }
-  if (!isUsableClient(session.client)) {
+  const client = normalizeStoredClient(getOwnEntry7(session, "client"));
+  if (client === null) {
     return { ...session, client: { clientId: "" }, tokens: void 0 };
   }
-  return isUsableTokens(session.tokens) ? session : { ...session, tokens: void 0 };
+  return {
+    ...session,
+    client,
+    tokens: normalizeStoredTokens(getOwnEntry7(session, "tokens"))
+  };
 }
-function isUsableClient(client) {
-  return typeof client.clientId === "string" && client.clientId.trim().length > 0 && (client.clientSecret === void 0 || typeof client.clientSecret === "string" && client.clientSecret.trim().length > 0);
+function normalizeStoredClient(value) {
+  if (!isObjectRecord3(value)) {
+    return null;
+  }
+  const clientId = getOwnString2(value, "clientId");
+  if (clientId === void 0 || clientId.trim().length === 0) {
+    return null;
+  }
+  const clientSecret = getOwnEntry7(value, "clientSecret");
+  if (clientSecret === void 0) {
+    return { clientId };
+  }
+  if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
+    return null;
+  }
+  return { clientId, clientSecret };
 }
-function isUsableTokens(tokens) {
-  if (tokens === void 0) {
-    return true;
+function normalizeStoredTokens(value) {
+  if (value === void 0 || !isObjectRecord3(value)) {
+    return void 0;
+  }
+  const accessToken = getOwnString2(value, "accessToken");
+  const tokenType = getOwnString2(value, "tokenType");
+  const expiresAt = getOwnEntry7(value, "expiresAt");
+  const refreshToken = getOwnEntry7(value, "refreshToken");
+  const scope = getOwnString2(value, "scope");
+  const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken : void 0;
+  if (accessToken === void 0 || accessToken.trim().length === 0 || tokenType !== "Bearer" || !(expiresAt === null || typeof expiresAt === "number" && Number.isFinite(expiresAt)) || refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
+    return void 0;
   }
-  return typeof tokens.accessToken === "string" && tokens.accessToken.trim().length > 0 && tokens.tokenType === "Bearer" && (tokens.expiresAt === null || typeof tokens.expiresAt === "number" && Number.isFinite(tokens.expiresAt)) && (tokens.refreshToken === void 0 || typeof tokens.refreshToken === "string" && tokens.refreshToken.trim().length > 0);
+  return {
+    accessToken,
+    tokenType,
+    expiresAt,
+    ...normalizedRefreshToken === void 0 ? {} : { refreshToken: normalizedRefreshToken },
+    ...scope === void 0 || scope.length === 0 ? {} : { scope }
+  };
 }
 function getClientMetadata(client) {
   return client.metadata;
 }
+function getOwnEntry7(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+function isObjectRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnString2(record, key2) {
+  const value = getOwnEntry7(record, key2);
+  return typeof value === "string" ? value : void 0;
+}
+function requireOwnString(record, key2, label) {
+  const value = getOwnString2(record, key2);
+  if (value === void 0) {
+    throw new Error(`${label} is missing ${key2}`);
+  }
+  return value;
+}
+function getOwnStringArray(record, key2) {
+  const value = getOwnEntry7(record, key2);
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+}
 function buildAuthorizationUrl(input) {
-  const url = new URL2(input.metadata.authorization_endpoint);
+  const authorizationEndpoint = requireOwnString(
+    input.metadata,
+    "authorization_endpoint",
+    "Authorization server metadata"
+  );
+  const issuer = requireOwnString(
+    input.metadata,
+    "issuer",
+    "Authorization server metadata"
+  );
+  const url = new URL2(authorizationEndpoint);
   const resource = canonicalizeResourceIndicator(input.resource);
   const state = createAuthorizationState({
-    issuer: input.metadata.issuer,
-    requireIssuer: input.metadata.authorization_response_iss_parameter_supported === true
+    issuer,
+    requireIssuer: getOwnEntry7(input.metadata, "authorization_response_iss_parameter_supported") === true
   });
   url.searchParams.set("response_type", "code");
   url.searchParams.set("client_id", input.clientId);
@@ -7929,7 +8214,7 @@ function buildAuthorizationUrl(input) {
   return url.toString();
 }
 function assertS256PkceSupport(metadata) {
-  if (!metadata.code_challenge_methods_supported.includes("S256")) {
+  if (!getOwnStringArray(metadata, "code_challenge_methods_supported")?.includes("S256")) {
     throw new Error(
       "Authorization server metadata must advertise code_challenge_methods_supported including S256"
     );
@@ -7953,13 +8238,24 @@ function assertSecureUrl(value, label) {
   throw new Error(`${label} must use https unless it targets a loopback host`);
 }
 function assertSecureOAuthFlowEndpoints(metadata) {
-  assertNoAccessTokenInUrl(metadata.authorization_endpoint, "Authorization endpoint");
-  assertNoAccessTokenInUrl(metadata.token_endpoint, "Token endpoint");
-  assertSecureUrl(metadata.authorization_endpoint, "Authorization endpoint");
-  assertSecureUrl(metadata.token_endpoint, "Token endpoint");
-  if (metadata.registration_endpoint !== void 0) {
-    assertNoAccessTokenInUrl(metadata.registration_endpoint, "Registration endpoint");
-    assertSecureUrl(metadata.registration_endpoint, "Registration endpoint");
+  const authorizationEndpoint = requireOwnString(
+    metadata,
+    "authorization_endpoint",
+    "Authorization server metadata"
+  );
+  const tokenEndpoint = requireOwnString(
+    metadata,
+    "token_endpoint",
+    "Authorization server metadata"
+  );
+  const registrationEndpoint = getOwnString2(metadata, "registration_endpoint");
+  assertNoAccessTokenInUrl(authorizationEndpoint, "Authorization endpoint");
+  assertNoAccessTokenInUrl(tokenEndpoint, "Token endpoint");
+  assertSecureUrl(authorizationEndpoint, "Authorization endpoint");
+  assertSecureUrl(tokenEndpoint, "Token endpoint");
+  if (registrationEndpoint !== void 0) {
+    assertNoAccessTokenInUrl(registrationEndpoint, "Registration endpoint");
+    assertSecureUrl(registrationEndpoint, "Registration endpoint");
   }
 }
 function assertNoAccessTokenInUrl(value, label) {
@@ -7982,17 +8278,21 @@ function buildClientRegistrationBody(metadata, redirectUri) {
     response_types: ["code"],
     token_endpoint_auth_method: "none"
   };
-  if (metadata?.clientName !== void 0 && metadata.clientName.length > 0) {
-    body.client_name = metadata.clientName;
+  const clientName = metadata === void 0 ? void 0 : getOwnString2(metadata, "clientName");
+  const scope = metadata === void 0 ? void 0 : getOwnString2(metadata, "scope");
+  const softwareId = metadata === void 0 ? void 0 : getOwnString2(metadata, "softwareId");
+  const softwareVersion = metadata === void 0 ? void 0 : getOwnString2(metadata, "softwareVersion");
+  if (clientName !== void 0 && clientName.length > 0) {
+    body.client_name = clientName;
   }
-  if (metadata?.scope !== void 0 && metadata.scope.length > 0) {
-    body.scope = metadata.scope;
+  if (scope !== void 0 && scope.length > 0) {
+    body.scope = scope;
   }
-  if (metadata?.softwareId !== void 0 && metadata.softwareId.length > 0) {
-    body.software_id = metadata.softwareId;
+  if (softwareId !== void 0 && softwareId.length > 0) {
+    body.software_id = softwareId;
   }
-  if (metadata?.softwareVersion !== void 0 && metadata.softwareVersion.length > 0) {
-    body.software_version = metadata.softwareVersion;
+  if (softwareVersion !== void 0 && softwareVersion.length > 0) {
+    body.software_version = softwareVersion;
   }
   return body;
 }
@@ -8028,7 +8328,7 @@ import {
 function defaultOAuthMetadataFetch(input, init) {
   return fetch(input, init);
 }
-function isObjectRecord(value) {
+function isObjectRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isStringArray(value) {
@@ -8051,7 +8351,7 @@ function assertSecureUrl2(url, label) {
   throw new Error(`${label} must use https unless it targets a loopback host`);
 }
 function validateProtectedResourceMetadata(value, resourceUrl) {
-  if (!isObjectRecord(value)) {
+  if (!isObjectRecord4(value)) {
     throw new Error("Protected resource metadata must be a JSON object");
   }
   if (typeof value.resource !== "string" || value.resource.length === 0) {
@@ -8074,7 +8374,7 @@ function validateProtectedResourceMetadata(value, resourceUrl) {
   };
 }
 function validateAuthorizationServerMetadata(value, issuer) {
-  if (!isObjectRecord(value)) {
+  if (!isObjectRecord4(value)) {
     throw new Error("Authorization server metadata must be a JSON object");
   }
   if (typeof value.issuer !== "string" || value.issuer.length === 0) {
@@ -8527,7 +8827,7 @@ var McpClient = class {
       await onPromptsChanged();
     });
     messageLayer.onNotification("notifications/message", async (params17) => {
-      if (onLog === void 0 || !isObjectRecord2(params17) || !isLogLevel(params17.level)) {
+      if (onLog === void 0 || !isObjectRecord5(params17) || !isLogLevel(params17.level)) {
         return;
       }
       if (!hasOwn(params17, "data")) {
@@ -8546,7 +8846,7 @@ var McpClient = class {
       await onLog(message2);
     });
     messageLayer.onNotification("notifications/progress", async (params17) => {
-      if (onProgress === void 0 || !isObjectRecord2(params17)) {
+      if (onProgress === void 0 || !isObjectRecord5(params17)) {
         return;
       }
       const { progressToken, progress } = params17;
@@ -8715,6 +9015,9 @@ var McpClient = class {
       const abortPromise = new Promise((_, reject) => {
         const rejectWithAbortReason = () => {
           sendCancellationNotification();
+          if (requestId !== void 0) {
+            messageLayer.cancelRequest(requestId, signal.reason);
+          }
           reject(signal.reason);
         };
         abortListener = rejectWithAbortReason;
@@ -8889,11 +9192,13 @@ var StdioTransport = class _StdioTransport {
     const child = this.child;
     this.readable = child.stdout;
     this.writable = child.stdin;
+    const stderrDecoder = new TextDecoder();
     child.stderr.on("data", (chunk) => {
-      this.stderrOutput += chunkToString(chunk);
-      if (this.stderrOutput.length > _StdioTransport.STDERR_MAX_LENGTH) {
-        this.stderrOutput = this.stderrOutput.slice(-_StdioTransport.STDERR_MAX_LENGTH);
-      }
+      const decoded = chunk instanceof Uint8Array ? stderrDecoder.decode(chunk, { stream: true }) : `${stderrDecoder.decode()}${String(chunk)}`;
+      this.appendStderrOutput(decoded);
+    });
+    child.stderr.once("end", () => {
+      this.appendStderrOutput(stderrDecoder.decode());
     });
     this.closed = new Promise((resolve) => {
       let settled = false;
@@ -8933,6 +9238,15 @@ var StdioTransport = class _StdioTransport {
   getStderrOutput() {
     return this.stderrOutput;
   }
+  appendStderrOutput(chunk) {
+    if (chunk.length === 0) {
+      return;
+    }
+    this.stderrOutput += chunk;
+    if (this.stderrOutput.length > _StdioTransport.STDERR_MAX_LENGTH) {
+      this.stderrOutput = this.stderrOutput.slice(-_StdioTransport.STDERR_MAX_LENGTH);
+    }
+  }
   dispose(reason = new Error("Stdio transport disposed")) {
     void reason;
     if (this.disposed) {
@@ -9340,15 +9654,6 @@ function serializeJsonRpcMessage(message2) {
   return `${JSON.stringify(message2)}
 `;
 }
-function chunkToString(chunk) {
-  if (typeof chunk === "string") {
-    return chunk;
-  }
-  if (chunk instanceof Uint8Array) {
-    return Buffer.from(chunk).toString("utf8");
-  }
-  return String(chunk);
-}
 function normalizeLine(line) {
   return line.endsWith("\r") ? line.slice(0, -1) : line;
 }
@@ -9538,6 +9843,16 @@ var JsonRpcMessageLayer = class {
       }
     });
   }
+  cancelRequest(requestId, reason) {
+    const pending = this.pendingRequests.get(requestId);
+    if (pending === void 0) {
+      return false;
+    }
+    this.pendingRequests.delete(requestId);
+    clearTimeout(pending.timeout);
+    pending.reject(reason);
+    return true;
+  }
   dispose(reason = new Error("JSON-RPC message layer disposed")) {
     if (this.disposedError !== void 0) {
       return;
@@ -9732,7 +10047,7 @@ var JsonRpcMessageLayer = class {
     })();
   }
   handleCancellationNotification(params17) {
-    if (!isObjectRecord2(params17)) {
+    if (!isObjectRecord5(params17)) {
       return;
     }
     const requestId = params17.requestId;
@@ -9747,34 +10062,34 @@ var JsonRpcMessageLayer = class {
     this.activeIncomingRequests.delete(requestId);
   }
 };
-function isObjectRecord2(value) {
+function isObjectRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isInitializeResult(value) {
-  if (!isObjectRecord2(value) || typeof value.protocolVersion !== "string") {
+  if (!isObjectRecord5(value) || typeof value.protocolVersion !== "string") {
     return false;
   }
   if (!isServerCapabilities(value.capabilities)) {
     return false;
   }
-  if (!isObjectRecord2(value.serverInfo) || typeof value.serverInfo.name !== "string" || value.serverInfo.name.length === 0 || typeof value.serverInfo.version !== "string" || value.serverInfo.version.length === 0) {
+  if (!isObjectRecord5(value.serverInfo) || typeof value.serverInfo.name !== "string" || value.serverInfo.name.length === 0 || typeof value.serverInfo.version !== "string" || value.serverInfo.version.length === 0) {
     return false;
   }
   return value.instructions === void 0 || typeof value.instructions === "string";
 }
 function isServerCapabilities(value) {
-  if (!isObjectRecord2(value)) {
+  if (!isObjectRecord5(value)) {
     return false;
   }
   for (const capability of ["prompts", "resources", "tools", "logging", "completions", "experimental"]) {
-    if (value[capability] !== void 0 && !isObjectRecord2(value[capability])) {
+    if (value[capability] !== void 0 && !isObjectRecord5(value[capability])) {
       return false;
     }
   }
   return true;
 }
 function isCallToolResult(value) {
-  if (!isObjectRecord2(value) || !Array.isArray(value.content)) {
+  if (!isObjectRecord5(value) || !Array.isArray(value.content)) {
     return false;
   }
   if (value.isError !== void 0 && typeof value.isError !== "boolean") {
@@ -9783,10 +10098,10 @@ function isCallToolResult(value) {
   return value.content.every(isContentItem);
 }
 function isToolsListResult(value) {
-  return isObjectRecord2(value) && Array.isArray(value.tools) && (value.nextCursor === void 0 || typeof value.nextCursor === "string");
+  return isObjectRecord5(value) && Array.isArray(value.tools) && (value.nextCursor === void 0 || typeof value.nextCursor === "string");
 }
 function isContentItem(value) {
-  if (!isObjectRecord2(value)) {
+  if (!isObjectRecord5(value)) {
     return false;
   }
   if (value.type === "text") {
@@ -9795,7 +10110,7 @@ function isContentItem(value) {
   if (value.type === "image" || value.type === "audio") {
     return typeof value.data === "string" && typeof value.mimeType === "string";
   }
-  if (value.type !== "resource" || !isObjectRecord2(value.resource)) {
+  if (value.type !== "resource" || !isObjectRecord5(value.resource)) {
     return false;
   }
   return typeof value.resource.uri === "string" && (value.resource.mimeType === void 0 || typeof value.resource.mimeType === "string") && (typeof value.resource.text === "string" || typeof value.resource.blob === "string");
@@ -9819,7 +10134,7 @@ function invalidRequest() {
   return new McpError(ERROR_INVALID_REQUEST, "Invalid Request");
 }
 function isJsonRpcErrorObject(value) {
-  if (!isObjectRecord2(value)) {
+  if (!isObjectRecord5(value)) {
     return false;
   }
   if (typeof value.code !== "number" || typeof value.message !== "string") {
@@ -9828,7 +10143,7 @@ function isJsonRpcErrorObject(value) {
   return value.data === void 0 || hasOwn(value, "data");
 }
 function parseJsonRpcPayload(parsed) {
-  if (!isObjectRecord2(parsed)) {
+  if (!isObjectRecord5(parsed)) {
     return {
       type: "invalid",
       id: null,
@@ -10155,7 +10470,11 @@ function convertObjectSchema(schema, root, options) {
       "properties",
       key2
     ]);
-    shape[key2] = requiredKeys.has(key2) ? convertedProperty : S.Optional(convertedProperty);
+    setOwnShapeProperty(
+      shape,
+      key2,
+      requiredKeys.has(key2) ? convertedProperty : S.Optional(convertedProperty)
+    );
   }
   return applyMetadata(
     S.Object(shape, {
@@ -10167,6 +10486,14 @@ function convertObjectSchema(schema, root, options) {
     }
   );
 }
+function setOwnShapeProperty(shape, key2, value) {
+  Object.defineProperty(shape, key2, {
+    configurable: true,
+    enumerable: true,
+    writable: true,
+    value
+  });
+}
 function createCommonOptions(schema, nullable, defaultValue) {
   return {
     ...schema.description === void 0 ? {} : { description: schema.description },
@@ -10417,6 +10744,9 @@ function resolveLocalRef(root, ref) {
     if (!isPlainObject(current)) {
       return void 0;
     }
+    if (!Object.prototype.hasOwnProperty.call(current, segment)) {
+      return void 0;
+    }
     current = current[segment];
   }
   return isPlainObject(current) ? current : void 0;
@@ -10606,10 +10936,10 @@ function validateRenameMap2(name, tools, rename5) {
     }
   }
 }
-function createConnection(name, config) {
+function createConnection(name, config2) {
   const connection = {
     name,
-    config,
+    config: config2,
     async dispose() {
       shutdownDisposers.delete(connection.dispose);
       connection.connecting = void 0;
@@ -10665,24 +10995,42 @@ async function readCache(cachePath) {
 }
 async function writeCache(cachePath, cache) {
   const directory = path12.dirname(cachePath);
-  const tempPath = `${cachePath}.tmp-${randomUUID2()}`;
+  const tempPath = `${cachePath}.tmp-${randomUUID4()}`;
+  let tempCreated = false;
   await assertCachePathHasNoSymlinks(cachePath);
   await assertCachePathHasNoSymlinks(tempPath);
   await mkdir(directory, { recursive: true });
   await assertCachePathHasNoSymlinks(directory);
-  await writeFile3(tempPath, `${JSON.stringify(cache, null, 2)}
-`);
-  await assertCachePathHasNoSymlinks(tempPath);
-  await assertCachePathHasNoSymlinks(cachePath);
-  await rename2(tempPath, cachePath);
+  try {
+    await writeFile3(tempPath, `${JSON.stringify(cache, null, 2)}
+`, {
+      encoding: "utf8",
+      flag: "wx"
+    });
+    tempCreated = true;
+    await assertCachePathHasNoSymlinks(tempPath);
+    await assertCachePathHasNoSymlinks(cachePath);
+    await rename2(tempPath, cachePath);
+    tempCreated = false;
+  } catch (error3) {
+    if (tempCreated || !isAlreadyExistsError2(error3)) {
+      await unlink2(tempPath).catch(() => void 0);
+    }
+    throw error3;
+  }
 }
-async function fetchCache(name, config) {
+function isAlreadyExistsError2(error3) {
+  return Boolean(
+    error3 && typeof error3 === "object" && error3.code === "EEXIST"
+  );
+}
+async function fetchCache(name, config2) {
   const logger2 = createLogger((message2) => {
     process.stderr.write(`${message2}
 `);
   });
   logger2.info(`MCP ${name}: connecting`);
-  const client = await dialUpstream(name, config);
+  const client = await dialUpstream(name, config2);
   try {
     logger2.info(`MCP ${name}: listing tools`);
     const tools = [];
@@ -10701,7 +11049,7 @@ async function fetchCache(name, config) {
       $schema: MCP_PROXY_SCHEMA_URL,
       version: 1,
       upstream,
-      configFingerprint: fingerprintMcpServerConfig(config),
+      configFingerprint: fingerprintMcpServerConfig(config2),
       fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
       tools
     };
@@ -10771,8 +11119,8 @@ function isRefreshRequested(name, refresh) {
 }
 async function resolveSingleProxy(group, options) {
   const internal = getInternalGroupConfig2(group);
-  const config = internal.mcp;
-  if (config === void 0) {
+  const config2 = internal.mcp;
+  if (config2 === void 0) {
     return;
   }
   const name = group.name;
@@ -10782,21 +11130,21 @@ async function resolveSingleProxy(group, options) {
     let cache;
     let shouldWriteCache = false;
     if (isRefreshRequested(name, refresh)) {
-      cache = await fetchCache(name, config);
+      cache = await fetchCache(name, config2);
       shouldWriteCache = true;
     } else {
       const storedCache = await readCache(cachePath);
-      if (storedCache && cacheMatchesConfig(storedCache, config)) {
+      if (storedCache && cacheMatchesConfig(storedCache, config2)) {
         cache = storedCache;
       } else {
-        cache = await fetchCache(name, config);
+        cache = await fetchCache(name, config2);
         shouldWriteCache = true;
       }
     }
     const tools = filterAllowlistedTools(cache.tools, internal.tools);
     validateRenameMap2(name, tools, internal.rename);
     const previousConnection = getProxyConnection(group);
-    const nextConnection = createConnection(name, config);
+    const nextConnection = createConnection(name, config2);
     try {
       replaceProxyChildrenSafely(group, tools, internal.rename, nextConnection);
       if (shouldWriteCache) {
@@ -10821,11 +11169,11 @@ async function resolveSingleProxy(group, options) {
     );
   }
 }
-function cacheMatchesConfig(cache, config) {
-  return cache.configFingerprint === fingerprintMcpServerConfig(config);
+function cacheMatchesConfig(cache, config2) {
+  return cache.configFingerprint === fingerprintMcpServerConfig(config2);
 }
-function fingerprintMcpServerConfig(config) {
-  return createHash3("sha256").update(JSON.stringify(config)).digest("hex");
+function fingerprintMcpServerConfig(config2) {
+  return createHash3("sha256").update(JSON.stringify(config2)).digest("hex");
 }
 function collectProxyGroups(root) {
   const groups = [];
@@ -10903,20 +11251,20 @@ function parseRefreshEnv(value) {
   const names = trimmed.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
   return names.length === 0 ? void 0 : new Set(names);
 }
-async function dialUpstream(name, config) {
+async function dialUpstream(name, config2) {
   const client = new McpClient({
     clientInfo: {
       name: `${DEFAULT_CLIENT_INFO.name}-${name}`,
       version: DEFAULT_CLIENT_INFO.version
     }
   });
-  const transport = config.transport === "stdio" ? new StdioTransport({
-    command: config.command,
-    ...config.args === void 0 ? {} : { args: config.args },
-    ...config.env === void 0 ? {} : { env: config.env }
+  const transport = config2.transport === "stdio" ? new StdioTransport({
+    command: config2.command,
+    ...config2.args === void 0 ? {} : { args: config2.args },
+    ...config2.env === void 0 ? {} : { env: config2.env }
   }) : new HttpTransport({
-    url: config.url,
-    ...config.headers === void 0 ? {} : { headers: config.headers }
+    url: config2.url,
+    ...config2.headers === void 0 ? {} : { headers: config2.headers }
   });
   await client.connect(transport);
   return client;
@@ -10926,10 +11274,82 @@ async function resolveMcpProxies(root, options = {}) {
   await Promise.all(groups.map((group) => resolveSingleProxy(group, options)));
 }
 
+// ../toolcraft/src/redaction.ts
+var REDACTED_VALUE = "<redacted>";
+var SENSITIVE_NAME_PARTS = ["password", "token", "apikey", "secret"];
+var AUTHORIZATION_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization", "proxyauthorization"]);
+var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set(["cookie", "setcookie"]);
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeName(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function isSensitiveName(name) {
+  const normalized = normalizeName(name);
+  return SENSITIVE_NAME_PARTS.some((candidate) => normalized.includes(candidate));
+}
+function redactSecretLikeFieldsValue(value, name, seen) {
+  if (name.length > 0 && isSensitiveName(name)) {
+    return REDACTED_VALUE;
+  }
+  if (Array.isArray(value)) {
+    if (seen.has(value)) {
+      return "[Circular]";
+    }
+    seen.add(value);
+    return value.map((entry) => redactSecretLikeFieldsValue(entry, name, seen));
+  }
+  if (isPlainObject2(value)) {
+    if (seen.has(value)) {
+      return "[Circular]";
+    }
+    seen.add(value);
+    return Object.fromEntries(
+      Object.entries(value).map(([key2, entry]) => [
+        key2,
+        redactSecretLikeFieldsValue(entry, key2, seen)
+      ])
+    );
+  }
+  return value;
+}
+function redactSecretLikeFields(value, name = "") {
+  return redactSecretLikeFieldsValue(value, name, /* @__PURE__ */ new WeakSet());
+}
+function parseJsonObjectOrArray(value) {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) {
+    return void 0;
+  }
+  try {
+    const parsed = JSON.parse(trimmed);
+    return isPlainObject2(parsed) || Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function redactHttpBody(body) {
+  if (typeof body === "string") {
+    const parsed = parseJsonObjectOrArray(body);
+    return parsed === void 0 ? body : redactSecretLikeFields(parsed);
+  }
+  return redactSecretLikeFields(body);
+}
+function redactHttpHeaderValue(name, value) {
+  const normalized = normalizeName(name);
+  if (AUTHORIZATION_HEADER_NAMES.has(normalized)) {
+    return "Bearer ****";
+  }
+  if (SECRET_HEADER_NAMES.has(normalized) || isSensitiveName(name)) {
+    return REDACTED_VALUE;
+  }
+  return value;
+}
+
 // ../toolcraft/src/error-report.ts
 var ERROR_REPORTS_ENV = "TOOLCRAFT_ERROR_REPORTS";
-var DEFAULT_SENSITIVE_NAMES = ["password", "token", "apikey", "secret"];
-function isPlainObject2(value) {
+function isPlainObject3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function unwrapOptional(schema) {
@@ -10939,7 +11359,7 @@ function unwrapOptional(schema) {
   return schema;
 }
 function hasHttpContext(error3) {
-  return error3 instanceof Error && error3.name === "HttpError" && isPlainObject2(error3.request) && isPlainObject2(error3.response);
+  return error3 instanceof Error && error3.name === "HttpError" && isPlainObject3(error3.request) && isPlainObject3(error3.response);
 }
 function isSkippedError(error3) {
   if (error3 instanceof ApprovalDeclinedError) {
@@ -10976,8 +11396,8 @@ async function assertReportDirWithinProject(projectRoot, reportDir) {
     throw new Error("Error report directory resolves outside project root.");
   }
   const [canonicalProjectRoot, canonicalReportDir] = await Promise.all([
-    realpath(projectRoot),
-    realpath(reportDir)
+    realpath2(projectRoot),
+    realpath2(reportDir)
   ]);
   if (!isWithinDirectory(canonicalProjectRoot, canonicalReportDir)) {
     throw new Error("Error report directory resolves outside project root.");
@@ -11032,9 +11452,24 @@ function redactValue(value) {
   }
   return `<set, ${value.length} chars>`;
 }
-function isSensitiveName(name) {
-  const normalized = name.toLowerCase();
-  return DEFAULT_SENSITIVE_NAMES.some((candidate) => normalized.includes(candidate));
+function collectStringLeaves(value, output) {
+  if (typeof value === "string") {
+    if (value.length > 0) {
+      output.add(value);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      collectStringLeaves(entry, output);
+    }
+    return;
+  }
+  if (isPlainObject3(value)) {
+    for (const entry of Object.values(value)) {
+      collectStringLeaves(entry, output);
+    }
+  }
 }
 function schemaSecretValue(schema) {
   const unwrapped = unwrapOptional(schema);
@@ -11055,7 +11490,7 @@ function redactParamsValue(value, schema, name) {
     return "<redacted>";
   }
   const unwrapped = unwrapOptional(schema);
-  if (unwrapped.kind === "object" && isPlainObject2(value)) {
+  if (unwrapped.kind === "object" && isPlainObject3(value)) {
     return Object.fromEntries(
       Object.entries(value).map(([key2, childValue]) => {
         const childSchema = unwrapped.shape[key2];
@@ -11077,6 +11512,52 @@ function redactParams(params17, command) {
   }
   return redactParamsValue(params17, command.params, "");
 }
+function collectSensitiveParamValues(value, schema, name, output) {
+  if (shouldRedactParam(name, schema)) {
+    collectStringLeaves(value, output);
+    return;
+  }
+  const unwrapped = unwrapOptional(schema);
+  if (unwrapped.kind === "object" && isPlainObject3(value)) {
+    for (const [key2, childValue] of Object.entries(value)) {
+      const childSchema = unwrapped.shape[key2];
+      if (childSchema !== void 0) {
+        collectSensitiveParamValues(childValue, childSchema, key2, output);
+      }
+    }
+    return;
+  }
+  if (unwrapped.kind === "array" && Array.isArray(value)) {
+    for (const entry of value) {
+      collectSensitiveParamValues(entry, unwrapped.item, name, output);
+    }
+  }
+}
+function createReportStringRedactor(context, env) {
+  const values = /* @__PURE__ */ new Set();
+  for (const value of Object.values(context.secrets ?? {})) {
+    if (value !== void 0 && value.length > 0) {
+      values.add(value);
+    }
+  }
+  for (const [name, secret] of Object.entries(context.command?.secrets ?? {})) {
+    const value = context.secrets?.[name] ?? env[secret.env];
+    if (value !== void 0 && value.length > 0) {
+      values.add(value);
+    }
+  }
+  if (context.command !== void 0) {
+    collectSensitiveParamValues(context.params, context.command.params, "", values);
+  }
+  const orderedValues = [...values].sort((left, right) => right.length - left.length);
+  return (value) => {
+    let redacted = value;
+    for (const secretValue of orderedValues) {
+      redacted = redacted.split(secretValue).join("<redacted>");
+    }
+    return redacted;
+  };
+}
 function commandSecretEnvNames(secrets) {
   if (secrets === void 0) {
     return [];
@@ -11130,28 +11611,42 @@ function redactArgv(argv, options) {
 function stableJson(value) {
   return JSON.stringify(value, null, 2) ?? "undefined";
 }
-function redactStructuredErrorField(name, value) {
-  if (typeof value === "string" && name.toLowerCase() === "authorization") {
-    return "Bearer ****";
+function redactStructuredErrorField(name, value, redactString) {
+  if (typeof value === "string") {
+    const redactedHeaderValue = redactHttpHeaderValue(name, value);
+    if (redactedHeaderValue !== value) {
+      return redactedHeaderValue;
+    }
+    if (isSensitiveName(name)) {
+      return "<redacted>";
+    }
+    return redactString(value);
   }
   if (Array.isArray(value)) {
-    return value.map((entry) => redactStructuredErrorField(name, entry));
+    return value.map((entry) => redactStructuredErrorField(name, entry, redactString));
   }
-  if (isPlainObject2(value)) {
+  if (isPlainObject3(value)) {
     return Object.fromEntries(
-      Object.entries(value).map(([key2, entry]) => [key2, redactStructuredErrorField(key2, entry)])
+      Object.entries(value).map(([key2, entry]) => [
+        key2,
+        redactStructuredErrorField(key2, entry, redactString)
+      ])
     );
   }
   return value;
 }
-function ownStructuredFields(error3) {
+function ownStructuredFields(error3, redactString) {
   const fields = {};
   for (const key2 of Object.keys(error3)) {
     if (key2 === "name" || key2 === "message" || key2 === "stack" || key2 === "cause") {
       continue;
     }
     Object.defineProperty(fields, key2, {
-      value: redactStructuredErrorField(key2, error3[key2]),
+      value: redactStructuredErrorField(
+        key2,
+        error3[key2],
+        redactString
+      ),
       enumerable: true,
       configurable: true,
       writable: true
@@ -11159,43 +11654,44 @@ function ownStructuredFields(error3) {
   }
   return fields;
 }
-function formatStackChain(error3) {
+function formatStackChain(error3, redactString) {
   const lines = [];
   let current = error3;
   let index = 0;
   while (current !== void 0) {
     if (current instanceof Error) {
-      lines.push(
-        index === 0 ? current.stack ?? String(current) : `Caused by: ${current.stack ?? String(current)}`
-      );
+      const stack = current.stack ?? String(current);
+      lines.push(redactString(index === 0 ? stack : `Caused by: ${stack}`));
       current = current.cause;
     } else {
-      lines.push(index === 0 ? String(current) : `Caused by: ${String(current)}`);
+      const message2 = String(current);
+      lines.push(redactString(index === 0 ? message2 : `Caused by: ${message2}`));
       current = void 0;
     }
     index += 1;
   }
   return lines.join("\n");
 }
-function formatHeaderValue(name, value) {
-  return name.toLowerCase() === "authorization" ? "Bearer ****" : value;
+function formatHeaderValue(name, value, redactString) {
+  return redactString(redactHttpHeaderValue(name, value));
 }
-function formatHeaders(headers) {
-  return Object.entries(headers).map(([name, value]) => `${name}: ${formatHeaderValue(name, value)}`).join("\n");
+function formatHeaders(headers, redactString) {
+  return Object.entries(headers).map(([name, value]) => `${name}: ${formatHeaderValue(name, value, redactString)}`).join("\n");
 }
-function formatBody(body) {
-  if (typeof body === "string") {
-    return body;
+function formatBody(body, redactString) {
+  const redactedBody = redactHttpBody(body);
+  if (typeof redactedBody === "string") {
+    return redactString(redactedBody);
   }
-  return stableJson(body);
+  return redactString(stableJson(redactedBody));
 }
-function formatHttpTranscript(error3) {
+function formatHttpTranscript(error3, redactString) {
   const requestLines = [
     `${error3.request.method} ${error3.request.url}`,
-    formatHeaders(error3.request.headers)
+    formatHeaders(error3.request.headers, redactString)
   ].filter((line) => line.length > 0);
   if (error3.request.body !== void 0) {
-    requestLines.push("", formatBody(error3.request.body));
+    requestLines.push("", formatBody(error3.request.body, redactString));
   }
   return [
     "Request:",
@@ -11203,9 +11699,9 @@ function formatHttpTranscript(error3) {
     "",
     "Response:",
     `${error3.response.status} ${error3.response.statusText}`,
-    formatHeaders(error3.response.headers),
+    formatHeaders(error3.response.headers, redactString),
     "",
-    formatBody(error3.response.body)
+    formatBody(error3.response.body, redactString)
   ].join("\n");
 }
 function resolveToolcraftVersion(version) {
@@ -11214,9 +11710,10 @@ function resolveToolcraftVersion(version) {
 function buildReport(context) {
   const env = context.env ?? process.env;
   const error3 = context.error;
+  const redactString = createReportStringRedactor(context, env);
   const errorName = error3 instanceof Error ? error3.name : typeof error3;
-  const errorMessage = error3 instanceof Error ? error3.message : String(error3);
-  const structuredFields = error3 instanceof Error ? ownStructuredFields(error3) : {};
+  const errorMessage = redactString(error3 instanceof Error ? error3.message : String(error3));
+  const structuredFields = error3 instanceof Error ? ownStructuredFields(error3, redactString) : {};
   const secretLines = Object.entries(context.command?.secrets ?? {}).map(([name, secret]) => {
     const value = context.secrets?.[name] ?? env[secret.env];
     return `${secret.env}=${redactValue(value)}`;
@@ -11230,7 +11727,9 @@ function buildReport(context) {
     `platform: ${process.platform} ${process.arch}`,
     "",
     "Argv",
-    stableJson(redactArgv(context.argv, { command: context.command, secrets: context.secrets })),
+    redactString(
+      stableJson(redactArgv(context.argv, { command: context.command, secrets: context.secrets }))
+    ),
     "",
     "Resolved Secrets",
     ...secretLines.length === 0 ? ["<none>"] : secretLines,
@@ -11239,19 +11738,19 @@ function buildReport(context) {
     context.commandPath === void 0 || context.commandPath.length === 0 ? "root" : context.commandPath,
     "",
     "Parsed Params",
-    stableJson(redactParams(context.params, context.command)),
+    redactString(stableJson(redactParams(context.params, context.command))),
     "",
     "Error",
     `name: ${errorName}`,
     `message: ${errorMessage}`,
     "structured fields:",
-    stableJson(structuredFields),
+    redactString(stableJson(structuredFields)),
     "",
     "Stack",
-    formatStackChain(error3)
+    formatStackChain(error3, redactString)
   ];
   if (hasHttpContext(error3)) {
-    lines.push("", "HTTP Transcript", formatHttpTranscript(error3));
+    lines.push("", "HTTP Transcript", formatHttpTranscript(error3, redactString));
   }
   return `${lines.join("\n")}
 `;
@@ -11263,7 +11762,7 @@ async function writeErrorReport(context) {
   }
   const projectRoot = resolveProjectRoot(context.projectRoot);
   const reportDir = resolveReportDir(context.errorReports, projectRoot);
-  const fileName = `${formatTimestamp(/* @__PURE__ */ new Date())}-${slugifyCommandPath(context.commandPath)}-${randomUUID3()}.log`;
+  const fileName = `${formatTimestamp(/* @__PURE__ */ new Date())}-${slugifyCommandPath(context.commandPath)}-${randomUUID5()}.log`;
   const absolutePath = path13.join(reportDir, fileName);
   await mkdir2(reportDir, { recursive: true });
   if (reportDirMustStayWithinProject(context.errorReports)) {
@@ -11711,6 +12210,7 @@ ${rendered.join("\n")}`);
 }
 
 // ../toolcraft/src/cli.ts
+configureTheme({ brand: "blue", label: "Toolcraft" });
 var RESERVED_SERVICE_NAMES = /* @__PURE__ */ new Set([
   "params",
   "secrets",
@@ -12741,10 +13241,10 @@ function renderHelpSections(sections) {
   return sections.filter((section) => section.length > 0).join("\n\n");
 }
 function formatHelpCommandList(rows) {
-  return process.stdout.isTTY === false ? help_formatter_plain_exports.formatCommandList(rows) : formatCommandList(rows);
+  return process.stdout.isTTY !== true ? help_formatter_plain_exports.formatCommandList(rows) : formatCommandList(rows);
 }
 function formatHelpOptionList(rows) {
-  return process.stdout.isTTY === false ? help_formatter_plain_exports.formatOptionList(rows) : formatOptionList(rows);
+  return process.stdout.isTTY !== true ? help_formatter_plain_exports.formatOptionList(rows) : formatOptionList(rows);
 }
 function buildUsageLine(breadcrumb, rootUsageName, suffix) {
   const visibleBreadcrumb = breadcrumb.filter((segment) => segment.length > 0);
@@ -13032,11 +13532,18 @@ function formatResolvedValue(value) {
 function fieldPromptLabel(field) {
   return field.positionalIndex === void 0 ? field.optionFlag : `<${field.displayPath}>`;
 }
+function enumOptionLabel(schema, value) {
+  const key2 = String(value);
+  if (schema.labels === void 0 || !Object.prototype.hasOwnProperty.call(schema.labels, key2)) {
+    return key2;
+  }
+  return schema.labels[key2] ?? key2;
+}
 async function promptForField(field) {
   const schema = field.schema;
   if (schema.kind === "enum") {
     const options = schema.loadOptions ? await schema.loadOptions() : schema.values.map((value) => ({
-      label: schema.labels?.[String(value)] ?? String(value),
+      label: enumOptionLabel(schema, value),
       value
     }));
     const selected = await select2({
@@ -13121,8 +13628,8 @@ async function withOutputFormat2(output, fn) {
 function createFs2() {
   return {
     readFile: async (path24, encoding = "utf8") => readFile4(path24, { encoding }),
-    writeFile: async (path24, contents) => {
-      await writeFile5(path24, contents);
+    writeFile: async (path24, contents, options) => {
+      await writeFile5(path24, contents, options);
     },
     exists: async (path24) => {
       try {
@@ -13134,7 +13641,7 @@ function createFs2() {
     },
     lstat: async (path24) => lstat3(path24),
     rename: async (fromPath, toPath) => rename3(fromPath, toPath),
-    unlink: async (path24) => unlink2(path24)
+    unlink: async (path24) => unlink3(path24)
   };
 }
 function createEnv2(values = process.env) {
@@ -13144,7 +13651,7 @@ function createEnv2(values = process.env) {
     }
   };
 }
-function isPlainObject3(value) {
+function isPlainObject4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasFieldValue(value) {
@@ -13253,7 +13760,7 @@ async function loadPresetValues(fields, presetPath) {
       { cause: error3 }
     );
   }
-  if (!isPlainObject3(parsedPreset)) {
+  if (!isPlainObject4(parsedPreset)) {
     throw new UserError(`Preset file "${presetPath}" must contain a JSON object.`);
   }
   const fieldByPath = new Map(fields.map((field) => [field.displayPath, field]));
@@ -13272,7 +13779,7 @@ async function loadPresetValues(fields, presetPath) {
           `Preset file "${presetPath}" contains unknown parameter "${displayPath}".`
         );
       }
-      if (!isPlainObject3(value)) {
+      if (!isPlainObject4(value)) {
         throw new UserError(
           `Preset file "${presetPath}" has an invalid value for "${displayPath}". Expected an object, got ${describeReceived(value)}.`
         );
@@ -13315,8 +13822,8 @@ function matchesFixtureValue(expected, actual) {
     }
     return expected.every((item, index) => matchesFixtureValue(item, actual[index]));
   }
-  if (isPlainObject3(expected)) {
-    if (!isPlainObject3(actual)) {
+  if (isPlainObject4(expected)) {
+    if (!isPlainObject4(actual)) {
       return false;
     }
     return Object.entries(expected).every(
@@ -13379,9 +13886,9 @@ function createFixtureFetch(entries) {
   };
 }
 function createFixtureFs(definition) {
-  const fsDefinition = isPlainObject3(definition) ? definition : {};
-  const readFileEntries = isPlainObject3(fsDefinition.readFile) ? fsDefinition.readFile : {};
-  const existsEntries = isPlainObject3(fsDefinition.exists) ? fsDefinition.exists : {};
+  const fsDefinition = isPlainObject4(definition) ? definition : {};
+  const readFileEntries = isPlainObject4(fsDefinition.readFile) ? fsDefinition.readFile : {};
+  const existsEntries = isPlainObject4(fsDefinition.exists) ? fsDefinition.exists : {};
   return {
     readFile: async (filePath) => {
       if (Object.prototype.hasOwnProperty.call(readFileEntries, filePath)) {
@@ -13404,10 +13911,10 @@ function createFixtureFs(definition) {
 function resolveFixtureMethodResult(methodName, definition, args) {
   if (Array.isArray(definition)) {
     for (const entry of definition) {
-      if (!isPlainObject3(entry)) {
+      if (!isPlainObject4(entry)) {
         continue;
       }
-      const explicitMatcher = isPlainObject3(entry.request) ? entry.request : void 0;
+      const explicitMatcher = isPlainObject4(entry.request) ? entry.request : void 0;
       const matcher = explicitMatcher ?? Object.fromEntries(
         Object.entries(entry).filter(
           ([key2]) => key2 !== "result" && key2 !== "response" && key2 !== "error"
@@ -13419,7 +13926,7 @@ function resolveFixtureMethodResult(methodName, definition, args) {
         matched = matchesFixtureValue(matcher.args, args);
       } else if (Object.keys(matcher).length === 0) {
         matched = true;
-      } else if (isPlainObject3(firstArg)) {
+      } else if (isPlainObject4(firstArg)) {
         matched = matchesFixtureValue(matcher, firstArg);
       } else if (args.length === 1 && Object.keys(matcher).length === 1) {
         const [[, expectedValue]] = Object.entries(matcher);
@@ -13440,7 +13947,7 @@ function resolveFixtureMethodResult(methodName, definition, args) {
       return Promise.resolve(null);
     }
   }
-  if (isPlainObject3(definition)) {
+  if (isPlainObject4(definition)) {
     const firstArg = args[0];
     if (typeof firstArg === "string" && Object.prototype.hasOwnProperty.call(definition, firstArg)) {
       return Promise.resolve(definition[firstArg]);
@@ -13452,7 +13959,7 @@ function resolveFixtureMethodResult(methodName, definition, args) {
   return Promise.resolve(null);
 }
 function createFixtureService(definition) {
-  const methods = isPlainObject3(definition) ? definition : {};
+  const methods = isPlainObject4(definition) ? definition : {};
   return new Proxy(
     {},
     {
@@ -13550,7 +14057,7 @@ async function resolveFixtureRuntime(command, services, requirementOptions) {
     };
   }
   const scenario = await loadFixtureScenario(command, selector);
-  const scenarioServices = isPlainObject3(scenario.services) ? scenario.services : {};
+  const scenarioServices = isPlainObject4(scenario.services) ? scenario.services : {};
   const customServiceNames = /* @__PURE__ */ new Set([
     ...Object.keys(services),
     ...Object.keys(scenarioServices).filter((name) => !RESERVED_SERVICE_NAMES.has(name))
@@ -13832,7 +14339,7 @@ function finalizeDynamicValue(schema, value, displayPath, errors2) {
       if (itemSchema.kind !== "object") {
         return value;
       }
-      if (!isPlainObject3(value)) {
+      if (!isPlainObject4(value)) {
         errors2.push({
           path: displayPath,
           message: `Invalid value for "${displayPath}". Expected indexed object entries, got ${describeReceived(value)}.`
@@ -13867,7 +14374,7 @@ function finalizeDynamicValue(schema, value, displayPath, errors2) {
       );
     }
     case "object": {
-      if (!isPlainObject3(value)) {
+      if (!isPlainObject4(value)) {
         errors2.push({
           path: displayPath,
           message: `Invalid value for "${displayPath}". Expected an object, got ${describeReceived(value)}.`
@@ -13898,7 +14405,7 @@ function finalizeDynamicValue(schema, value, displayPath, errors2) {
       return result;
     }
     case "record": {
-      if (!isPlainObject3(value)) {
+      if (!isPlainObject4(value)) {
         errors2.push({
           path: displayPath,
           message: `Invalid value for "${displayPath}". Expected an object, got ${describeReceived(value)}.`
@@ -14324,10 +14831,10 @@ async function executeCommand(state, services, requirementOptions, runtimeOption
   }
 }
 function isStringRecord(value) {
-  return isPlainObject3(value) && Object.values(value).every((entry) => typeof entry === "string");
+  return isPlainObject4(value) && Object.values(value).every((entry) => typeof entry === "string");
 }
 function isHttpErrorLike(error3) {
-  if (!isPlainObject3(error3)) {
+  if (!isPlainObject4(error3)) {
     return false;
   }
   if (error3.name !== "HttpError" || typeof error3.message !== "string") {
@@ -14335,7 +14842,7 @@ function isHttpErrorLike(error3) {
   }
   const request = error3.request;
   const response = error3.response;
-  return isPlainObject3(request) && typeof request.method === "string" && typeof request.url === "string" && isStringRecord(request.headers) && isPlainObject3(response) && typeof response.status === "number" && typeof response.statusText === "string" && isStringRecord(response.headers) && "body" in response;
+  return isPlainObject4(request) && typeof request.method === "string" && typeof request.url === "string" && isStringRecord(request.headers) && isPlainObject4(response) && typeof response.status === "number" && typeof response.statusText === "string" && isStringRecord(response.headers) && "body" in response;
 }
 function hasTypedOptionalField(value, field, type2) {
   return !(field in value) || typeof value[field] === type2;
@@ -14344,7 +14851,7 @@ function isNonEmptyString(value) {
   return typeof value === "string" && value.trim().length > 0;
 }
 function isProblemDetailsLike(body) {
-  if (!isPlainObject3(body)) {
+  if (!isPlainObject4(body)) {
     return false;
   }
   if (!hasTypedOptionalField(body, "type", "string")) {
@@ -14365,11 +14872,11 @@ function isProblemDetailsLike(body) {
   return isNonEmptyString(body.title) || isNonEmptyString(body.detail);
 }
 function isGraphQLErrorEnvelopeLike(body) {
-  if (!isPlainObject3(body) || !Array.isArray(body.errors) || body.errors.length === 0) {
+  if (!isPlainObject4(body) || !Array.isArray(body.errors) || body.errors.length === 0) {
     return false;
   }
   return body.errors.every((error3) => {
-    if (!isPlainObject3(error3) || typeof error3.message !== "string") {
+    if (!isPlainObject4(error3) || typeof error3.message !== "string") {
       return false;
     }
     if ("path" in error3) {
@@ -14379,7 +14886,7 @@ function isGraphQLErrorEnvelopeLike(body) {
       }
     }
     if ("extensions" in error3) {
-      if (!isPlainObject3(error3.extensions)) {
+      if (!isPlainObject4(error3.extensions)) {
         return false;
       }
       if ("code" in error3.extensions && typeof error3.extensions.code !== "string") {
@@ -14390,7 +14897,7 @@ function isGraphQLErrorEnvelopeLike(body) {
   });
 }
 function styleHttpErrorLine(value, style) {
-  return process.stdout.isTTY === false ? value : style(value);
+  return process.stdout.isTTY !== true ? value : style(value);
 }
 function formatHttpErrorStatus(value) {
   return styleHttpErrorLine(value, text.error);
@@ -14427,23 +14934,24 @@ function formatGraphQLErrorEnvelopeBody(body) {
   }).join("\n\n");
 }
 function formatHttpErrorBody(body) {
-  if (typeof body === "string") {
-    return body;
+  const redactedBody = redactHttpBody(body);
+  if (typeof redactedBody === "string") {
+    return redactedBody;
   }
-  if (isProblemDetailsLike(body)) {
-    return formatProblemDetailsBody(body);
+  if (isProblemDetailsLike(redactedBody)) {
+    return formatProblemDetailsBody(redactedBody);
   }
-  if (isGraphQLErrorEnvelopeLike(body)) {
-    return formatGraphQLErrorEnvelopeBody(body);
+  if (isGraphQLErrorEnvelopeLike(redactedBody)) {
+    return formatGraphQLErrorEnvelopeBody(redactedBody);
   }
-  const serialized = JSON.stringify(body, null, 2);
-  return serialized === void 0 ? String(body) : serialized;
+  const serialized = JSON.stringify(redactedBody, null, 2);
+  return serialized === void 0 ? String(redactedBody) : serialized;
 }
 function indentHttpErrorBlock(value) {
   return value.split("\n").map((line) => `  ${line}`).join("\n");
 }
 function formatHttpHeaderValue(name, value) {
-  return name.toLowerCase() === "authorization" ? "Bearer ****" : value;
+  return redactHttpHeaderValue(name, value);
 }
 function formatHttpErrorHeaders(headers) {
   return Object.entries(headers).map(
@@ -14461,7 +14969,11 @@ function renderHttpError(error3, options) {
   if (detailed) {
     lines.push("", "Request headers:", ...formatHttpErrorHeaders(error3.request.headers), "");
     if (error3.request.body !== void 0) {
-      lines.push("Request body:", indentHttpErrorBlock(formatHttpErrorBody(error3.request.body)), "");
+      lines.push(
+        "Request body:",
+        indentHttpErrorBlock(formatHttpErrorBody(error3.request.body)),
+        ""
+      );
     }
   }
   lines.push(
@@ -14867,7 +15379,7 @@ async function runCLI(roots, options = {}) {
 }
 
 // src/terminal-pilot.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 
 // src/terminal-session.ts
 import { EventEmitter } from "node:events";
@@ -14949,6 +15461,11 @@ function consumeTerminatedString(input, index, allowBellTerminator) {
   return input.length;
 }
 
+// src/errors.ts
+function hasOwnErrorCode(error3, code) {
+  return error3 instanceof Error && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === code;
+}
+
 // src/terminal-buffer.ts
 var RESET_SGR = "\x1B[0m";
 var DEC_SPECIAL_GRAPHICS = {
@@ -16048,10 +16565,7 @@ function ensureSpawnHelperExecutable() {
   }
 }
 function isMissingFileError(error3) {
-  if (!(error3 instanceof Error)) {
-    return false;
-  }
-  return "code" in error3 && error3.code === "ENOENT";
+  return hasOwnErrorCode(error3, "ENOENT");
 }
 function matchPattern(buffer, pattern) {
   const clean = normalizeHistoryBuffer(stripAnsi4(buffer));
@@ -16142,7 +16656,7 @@ var TerminalPilot = class _TerminalPilot {
   }
   async newSession(opts) {
     const session = new TerminalSession({
-      id: randomUUID4(),
+      id: randomUUID6(),
       command: opts.command,
       args: opts.args,
       cwd: opts.cwd,
@@ -16421,6 +16935,11 @@ var claudeCodeAgent = {
   aliases: ["claude"],
   binaryName: "claude",
   apiShapes: ["anthropic-messages"],
+  otelCapture: {
+    env: {
+      CLAUDE_CODE_ENABLE_TELEMETRY: "1"
+    }
+  },
   configPath: "~/.claude/settings.json",
   branding: {
     colors: {
@@ -16453,6 +16972,16 @@ var codexAgent = {
   summary: "Configure Codex to use Poe as the model provider.",
   binaryName: "codex",
   apiShapes: ["openai-responses"],
+  otelCapture: {
+    args: (endpoint, content) => [
+      "-c",
+      `otel.trace_exporter={"otlp-http"={endpoint=${JSON.stringify(`${endpoint}/v1/traces`)},protocol="json"}}`,
+      "-c",
+      `otel.exporter={"otlp-http"={endpoint=${JSON.stringify(`${endpoint}/v1/logs`)},protocol="json"}}`,
+      "-c",
+      `otel.log_user_prompt=${content}`
+    ]
+  },
   configPath: "~/.codex/config.toml",
   branding: {
     colors: {
@@ -16488,6 +17017,11 @@ var openCodeAgent = {
   summary: "Configure OpenCode CLI to use the Poe API.",
   binaryName: "opencode",
   apiShapes: ["openai-chat-completions"],
+  otelCapture: {
+    env: {
+      OPENCODE_CONFIG_CONTENT: '{"experimental":{"openTelemetry":true}}'
+    }
+  },
   configPath: "~/.config/opencode/config.json",
   branding: {
     colors: {
@@ -16523,6 +17057,7 @@ var gooseAgent = {
   summary: "Block's open-source AI agent with ACP support.",
   binaryName: "goose",
   apiShapes: ["openai-chat-completions"],
+  otelCapture: {},
   configPath: "~/.config/goose/config.yaml",
   branding: {
     colors: {
@@ -16556,6 +17091,12 @@ function freezeAgent(agent) {
   if (agent.apiShapes !== void 0) {
     Object.freeze(agent.apiShapes);
   }
+  if (agent.otelCapture?.env !== void 0) {
+    Object.freeze(agent.otelCapture.env);
+  }
+  if (agent.otelCapture !== void 0) {
+    Object.freeze(agent.otelCapture);
+  }
   Object.freeze(agent.branding.colors);
   Object.freeze(agent.branding);
   return Object.freeze(agent);
@@ -16616,11 +17157,11 @@ function resolveAgentSupport(input, registry = agentSkillConfigs) {
   if (!resolvedId) {
     return { status: "unknown", input };
   }
-  const config = registry[resolvedId];
-  if (!config) {
+  const config2 = registry[resolvedId];
+  if (!config2) {
     return { status: "unsupported", input, id: resolvedId };
   }
-  return { status: "supported", input, id: resolvedId, config: { ...config } };
+  return { status: "supported", input, id: resolvedId, config: { ...config2 } };
 }
 function getAgentConfig(agentId) {
   const support = resolveAgentSupport(agentId);
@@ -16719,6 +17260,7 @@ var templateMutation = {
 };
 
 // ../config-mutations/src/execution/apply-mutation.ts
+import { randomUUID as randomUUID7 } from "node:crypto";
 import path17 from "node:path";
 
 // ../config-mutations/src/formats/json.ts
@@ -16794,7 +17336,7 @@ function merge(base, patch) {
     if (value === void 0) {
       continue;
     }
-    const existing = result[key2];
+    const existing = hasConfigEntry(result, key2) ? result[key2] : void 0;
     if (isConfigObject(existing) && isConfigObject(value)) {
       setConfigEntry(result, key2, merge(existing, value));
       continue;
@@ -16922,7 +17464,7 @@ function merge2(base, patch) {
     if (value === void 0) {
       continue;
     }
-    const existing = result[key2];
+    const existing = hasConfigEntry(result, key2) ? result[key2] : void 0;
     if (isConfigObject2(existing) && isConfigObject2(value)) {
       setConfigEntry(result, key2, merge2(existing, value));
       continue;
@@ -17002,7 +17544,7 @@ function merge3(base, patch) {
     if (value === void 0) {
       continue;
     }
-    const existing = result[key2];
+    const existing = hasConfigEntry(result, key2) ? result[key2] : void 0;
     if (isConfigObject3(existing) && isConfigObject3(value)) {
       setConfigEntry(result, key2, merge3(existing, value));
       continue;
@@ -17139,7 +17681,7 @@ function resolvePath(rawPath, homeDir, pathMapper) {
 
 // ../config-mutations/src/fs-utils.ts
 function isNotFound(error3) {
-  return typeof error3 === "object" && error3 !== null && "code" in error3 && error3.code === "ENOENT";
+  return typeof error3 === "object" && error3 !== null && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === "ENOENT";
 }
 async function readFileIfExists(fs4, target) {
   try {
@@ -17188,6 +17730,7 @@ async function backupInvalidDocument(context, targetPath, content) {
       return;
     } catch (error3) {
       if (!isAlreadyExists(error3)) {
+        await context.fs.unlink(backupPath).catch(() => void 0);
         throw error3;
       }
       attempt += 1;
@@ -17195,7 +17738,7 @@ async function backupInvalidDocument(context, targetPath, content) {
   }
 }
 function isAlreadyExists(error3) {
-  return Boolean(error3 && typeof error3 === "object" && "code" in error3 && error3.code === "EEXIST");
+  return typeof error3 === "object" && error3 !== null && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === "EEXIST";
 }
 async function assertRegularWriteTarget(context, targetPath) {
   const boundary = path17.dirname(path17.resolve(context.homeDir));
@@ -17219,28 +17762,34 @@ async function assertRegularWriteTarget(context, targetPath) {
 }
 async function writeAtomically2(context, targetPath, content) {
   await assertRegularWriteTarget(context, targetPath);
-  let attempt = 0;
-  while (true) {
-    const tempPath = `${targetPath}.mutation-tmp-${attempt}`;
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    const tempPath = `${targetPath}.mutation-tmp-${process.pid}-${randomUUID7()}`;
+    let tempCreated = false;
     try {
+      await assertRegularWriteTarget(context, tempPath);
       await context.fs.writeFile(tempPath, content, { encoding: "utf8", flag: "wx" });
+      tempCreated = true;
       await context.fs.rename(tempPath, targetPath);
+      tempCreated = false;
       return;
     } catch (error3) {
-      if (isAlreadyExists(error3)) {
-        attempt += 1;
-        continue;
-      }
-      try {
-        await context.fs.unlink(tempPath);
-      } catch (cleanupError) {
-        if (!isNotFound(cleanupError)) {
-          void cleanupError;
+      const alreadyExists = isAlreadyExists(error3);
+      if (tempCreated || !alreadyExists) {
+        try {
+          await context.fs.unlink(tempPath);
+        } catch (cleanupError) {
+          if (!isNotFound(cleanupError)) {
+            void cleanupError;
+          }
         }
       }
+      if (alreadyExists) {
+        continue;
+      }
       throw error3;
     }
   }
+  throw new Error(`Unable to create temporary mutation file for ${targetPath}.`);
 }
 function describeMutation(kind, targetPath) {
   const displayPath = targetPath ?? "target";
@@ -17532,6 +18081,7 @@ async function applyBackup(mutation, context, options) {
         break;
       } catch (error3) {
         if (!isAlreadyExists(error3)) {
+          await context.fs.unlink(backupPath).catch(() => void 0);
           throw error3;
         }
         attempt += 1;
@@ -17939,7 +18489,7 @@ async function pathExists2(fs4, targetPath) {
     await fs4.stat(targetPath);
     return true;
   } catch (error3) {
-    if (error3 && typeof error3 === "object" && "code" in error3 && error3.code === "ENOENT") {
+    if (typeof error3 === "object" && error3 !== null && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === "ENOENT") {
       return false;
     }
     throw error3;
@@ -17952,14 +18502,14 @@ async function installSkill(agentId, skill, options) {
     throw new UnsupportedAgentError(agentId);
   }
   const scope = options.scope ?? "local";
-  const config = support.config;
+  const config2 = support.config;
   if (skill.name.length === 0 || skill.name === "." || skill.name === ".." || skill.name.includes("/") || skill.name.includes("\\") || skill.name.includes("\n") || skill.name.includes("\r")) {
     throw new Error(`Invalid skill name: ${skill.name}`);
   }
-  const skillDir = scope === "global" ? config.globalSkillDir : toHomeRelative(config.localSkillDir);
+  const skillDir = scope === "global" ? config2.globalSkillDir : toHomeRelative(config2.localSkillDir);
   const skillFolderPath = `${skillDir}/${skill.name}`;
   const skillFilePath = `${skillFolderPath}/SKILL.md`;
-  const displayPath = `${scope === "global" ? config.globalSkillDir : config.localSkillDir}/${skill.name}/SKILL.md`;
+  const displayPath = `${scope === "global" ? config2.globalSkillDir : config2.localSkillDir}/${skill.name}/SKILL.md`;
   const absoluteSkillPath = `${scope === "global" ? options.homeDir : options.cwd}/${skillFilePath.slice(2)}`;
   if (await pathExists2(options.fs, absoluteSkillPath)) {
     throw new Error(`Skill already exists: ${displayPath}`);
@@ -17998,12 +18548,13 @@ import path19 from "node:path";
 
 // ../agent-skill-config/src/git-exclude.ts
 import { execFileSync } from "node:child_process";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import * as fs2 from "node:fs";
 import path20 from "node:path";
 
 // ../agent-skill-config/src/bridge-active-skills.ts
 import * as fs3 from "node:fs";
-import { createHash as createHash4, randomUUID as randomUUID5 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID9 } from "node:crypto";
 import path21 from "node:path";
 
 // src/commands/installer.ts
@@ -18016,7 +18567,7 @@ var DEFAULT_INSTALL_SCOPE = "local";
 var TERMINAL_PILOT_SKILL_NAME = "terminal-pilot";
 var installableAgents = supportedAgents;
 function isNotFoundError2(error3) {
-  return typeof error3 === "object" && error3 !== null && "code" in error3 && error3.code === "ENOENT";
+  return hasOwnErrorCode(error3, "ENOENT");
 }
 function resolveInstallerServices(installer) {
   return {
@@ -18080,17 +18631,17 @@ function resolveHomeRelativePath(targetPath, homeDir) {
   return targetPath;
 }
 function getSkillFolderWithHome(agent, scope, cwd, homeDir) {
-  const config = getAgentConfig(agent);
-  if (!config) {
+  const config2 = getAgentConfig(agent);
+  if (!config2) {
     throwUnsupportedAgent(agent);
   }
   return {
     displayPath: path22.join(
-      scope === "global" ? config.globalSkillDir : config.localSkillDir,
+      scope === "global" ? config2.globalSkillDir : config2.localSkillDir,
       TERMINAL_PILOT_SKILL_NAME
     ),
     fullPath: path22.join(
-      scope === "global" ? resolveHomeRelativePath(config.globalSkillDir, homeDir) : path22.resolve(cwd, config.localSkillDir),
+      scope === "global" ? resolveHomeRelativePath(config2.globalSkillDir, homeDir) : path22.resolve(cwd, config2.localSkillDir),
       TERMINAL_PILOT_SKILL_NAME
     )
   };
@@ -18247,7 +18798,7 @@ var resize = defineCommand({
 });
 
 // ../terminal-png/src/index.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 import { rename as rename4, rm, writeFile as writeFile6 } from "node:fs/promises";
 
 // ../terminal-png/src/ansi-parser.ts
@@ -19187,21 +19738,28 @@ async function renderTerminalPng(ansiText, options = {}) {
   });
   const png = renderPng(svg);
   if (options.output) {
-    const temporaryPath = `${options.output}.${randomUUID6()}.tmp`;
+    const temporaryPath = `${options.output}.${randomUUID10()}.tmp`;
+    let temporaryCreated = false;
     try {
       await writeFile6(temporaryPath, png, { flag: "wx" });
+      temporaryCreated = true;
       await rename4(temporaryPath, options.output);
     } catch (error3) {
-      try {
-        await rm(temporaryPath, { force: true });
-      } catch (cleanupError) {
-        void cleanupError;
+      if (temporaryCreated || !isAlreadyExistsError3(error3)) {
+        try {
+          await rm(temporaryPath, { force: true });
+        } catch (cleanupError) {
+          void cleanupError;
+        }
       }
       throw error3;
     }
   }
   return png;
 }
+function isAlreadyExistsError3(error3) {
+  return error3 instanceof Error && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === "EEXIST";
+}
 
 // src/commands/screenshot.ts
 var params11 = S.Object({
@@ -19264,7 +19822,7 @@ var type = defineCommand({
 });
 
 // src/commands/uninstall.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 var params14 = S.Object({
   agent: S.Enum(installableAgents, {
     description: "Agent to uninstall terminal-pilot from",
@@ -19300,7 +19858,7 @@ var uninstall = defineCommand({
         if (!await folderExists(services.fs, skill.fullPath)) {
           continue;
         }
-        const stagingPath = `${skill.fullPath}.removing-${randomUUID7()}`;
+        const stagingPath = `${skill.fullPath}.removing-${randomUUID11()}`;
         await services.fs.rename(skill.fullPath, stagingPath);
         staged.push({ ...skill, stagingPath });
       }
@@ -19326,7 +19884,7 @@ async function folderExists(fs4, folderPath) {
     await fs4.stat(folderPath);
     return true;
   } catch (error3) {
-    if (typeof error3 === "object" && error3 !== null && "code" in error3 && error3.code === "ENOENT") {
+    if (hasOwnErrorCode(error3, "ENOENT")) {
       return false;
     }
     throw error3;
@@ -19407,6 +19965,7 @@ function createTerminalPilotGroup() {
 var terminalPilotGroup = Object.freeze(createTerminalPilotGroup());
 
 // src/cli.ts
+configureTheme({ brand: "green", label: "Terminal Pilot" });
 function normalizeArgv(argv) {
   if (argv.includes("--json") && !argv.some((argument) => argument === "--output" || argument.startsWith("--output="))) {
     return argv.flatMap((argument) => argument === "--json" ? ["--output", "json"] : [argument]);
@@ -19430,8 +19989,8 @@ async function isDirectExecution(argv) {
   try {
     const modulePath = fileURLToPath5(import.meta.url);
     const [resolvedEntryPoint, resolvedModulePath] = await Promise.all([
-      realpath2(path23.resolve(entryPoint)),
-      realpath2(modulePath)
+      realpath3(path23.resolve(entryPoint)),
+      realpath3(modulePath)
     ]);
     return resolvedEntryPoint === resolvedModulePath;
   } catch {