terminal-pilot 0.0.21 → 0.0.23

package/dist/testing/cli-repl.js

@@ -83,7 +83,7 @@ import path23 from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // ../toolcraft/src/cli.ts
-import { access as access2, lstat as lstat3, readFile as readFile4, rename as rename3, unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
+import { access as access2, lstat as lstat3, readFile as readFile4, rename as rename3, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
 import path14 from "node:path";
 import {
   Command as CommanderCommand,
@@ -2779,6 +2779,11 @@ function getCommandSourcePath(command) {
   return command[commandSourcePathSymbol];
 }
 
+// ../toolcraft/src/error-codes.ts
+function hasOwnErrorCode(error3, code) {
+  return typeof error3 === "object" && error3 !== null && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === code;
+}
+
 // ../task-list/src/open.ts
 import * as fsPromises from "node:fs/promises";
 
@@ -2799,27 +2804,27 @@ function validateMachine(machine) {
   if (!isRecord(machine)) {
     throw new TypeError("State machine must be an object.");
   }
-  if (!isStateList(machine.states)) {
+  if (!hasOwnRecordField(machine, "states") || !isStateList(machine.states)) {
     throw new TypeError("State machine states must be a string array.");
   }
   const states = new Set(machine.states);
-  if (typeof machine.initial !== "string") {
+  if (!hasOwnRecordField(machine, "initial") || typeof machine.initial !== "string") {
     throw new TypeError("State machine initial must be a string.");
   }
   if (!states.has(machine.initial)) {
     throw new Error(`Initial state "${machine.initial}" is not declared.`);
   }
-  if (!isRecord(machine.events)) {
+  if (!hasOwnRecordField(machine, "events") || !isRecord(machine.events)) {
     throw new TypeError("State machine events must be an object.");
   }
   for (const [eventName, event] of Object.entries(machine.events)) {
     if (!isRecord(event)) {
       throw new TypeError(`Event "${eventName}" must be an object.`);
     }
-    if (event.from !== "*" && !isStateList(event.from)) {
+    if (!hasOwnRecordField(event, "from") || event.from !== "*" && !isStateList(event.from)) {
       throw new TypeError(`Event "${eventName}" has an invalid "from" definition.`);
     }
-    if (typeof event.to !== "string") {
+    if (!hasOwnRecordField(event, "to") || typeof event.to !== "string") {
       throw new TypeError(`Event "${eventName}" target state must be a string.`);
     }
     if (!states.has(event.to)) {
@@ -2834,6 +2839,9 @@ function validateMachine(machine) {
     }
   }
 }
+function hasOwnRecordField(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2);
+}
 function eventsFromState(machine, fromState) {
   const events = [];
   for (const [eventName, event] of Object.entries(machine.events)) {
@@ -2944,10 +2952,12 @@ import path5 from "node:path";
 // ../process-runner/src/host/host-runner.ts
 import { spawn as spawnChildProcess } from "node:child_process";
 function createHostRunner(options = {}) {
-  const detachedByDefault = options.detached === true;
+  const runnerOptions = normalizeHostRunnerOptions(options);
+  const detachedByDefault = runnerOptions.detached === true;
   return {
     name: "host",
-    exec(spec) {
+    exec(inputSpec) {
+      const spec = normalizeRunSpec(inputSpec);
       if (spec.signal?.aborted === true) {
         return {
           pid: null,
@@ -2964,12 +2974,16 @@ function createHostRunner(options = {}) {
       const stderrMode = spec.stderr ?? "pipe";
       const killProcessGroup = detachedByDefault || spec.killProcessGroup === true;
       const stdio = stdinMode === "inherit" && stdoutMode === "inherit" && stderrMode === "inherit" ? "inherit" : [stdinMode, stdoutMode, stderrMode];
-      const child = spawnChildProcess(spec.command, spec.args ?? [], {
-        cwd: spec.cwd,
-        env: spec.env,
-        stdio,
-        ...killProcessGroup ? { detached: true } : {}
-      });
+      const child = spawnChildProcess(
+        spec.command,
+        spec.args ?? [],
+        createNullRecord({
+          cwd: spec.cwd,
+          env: spec.env,
+          stdio,
+          ...killProcessGroup ? { detached: true } : {}
+        })
+      );
       if (killProcessGroup) {
         child.unref();
       }
@@ -3015,6 +3029,38 @@ function createHostRunner(options = {}) {
     }
   };
 }
+function normalizeHostRunnerOptions(options) {
+  return createNullRecord({
+    ...optionalOwnProperty(options, "detached")
+  });
+}
+function normalizeRunSpec(spec) {
+  return createNullRecord({
+    command: getOwnProperty(spec, "command"),
+    ...optionalOwnProperty(spec, "args"),
+    ...optionalOwnProperty(spec, "cwd"),
+    ...optionalOwnProperty(spec, "env"),
+    ...optionalOwnProperty(spec, "stdin"),
+    ...optionalOwnProperty(spec, "stdout"),
+    ...optionalOwnProperty(spec, "stderr"),
+    ...optionalOwnProperty(spec, "tty"),
+    ...optionalOwnProperty(spec, "signal"),
+    ...optionalOwnProperty(spec, "killProcessGroup")
+  });
+}
+function optionalOwnProperty(value, name) {
+  const property = getOwnProperty(value, name);
+  return property === void 0 ? {} : { [name]: property };
+}
+function getOwnProperty(value, name) {
+  return hasOwnProperty(value, name) ? value[name] : void 0;
+}
+function hasOwnProperty(value, name) {
+  return Object.prototype.hasOwnProperty.call(value, name);
+}
+function createNullRecord(value) {
+  return Object.assign(/* @__PURE__ */ Object.create(null), value);
+}
 function bindAbortSignal(signal, onAbort) {
   if (signal === void 0) {
     return () => {
@@ -3105,6 +3151,7 @@ function resolveEndpoint(options = {}) {
 }
 
 // ../task-list/src/backends/utils.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
 import path6 from "node:path";
 function compareCreated(left, right) {
   const leftCreated = typeof left.raw.created === "string" ? left.raw.created : "";
@@ -3125,9 +3172,8 @@ function applyOrder(entries, order) {
   }
   return entries.map((entry) => entry.task);
 }
-var tmpFileCounter = 0;
 function hasErrorCode(error3, code) {
-  return !!error3 && typeof error3 === "object" && "code" in error3 && error3.code === code;
+  return !!error3 && typeof error3 === "object" && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === code;
 }
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -3174,18 +3220,22 @@ async function rejectSymbolicLinkComponents(fs4, filePath) {
   }
 }
 async function writeAtomically(fs4, filePath, content) {
-  const tempPath = `${filePath}.tmp-${process.pid}-${tmpFileCounter}`;
-  tmpFileCounter += 1;
+  const tempPath = `${filePath}.${process.pid}.${randomUUID2()}.tmp`;
+  let tempCreated = false;
   await fs4.mkdir(path6.dirname(filePath), { recursive: true });
   try {
     await fs4.writeFile(tempPath, content, { encoding: "utf8", flag: "wx" });
+    tempCreated = true;
     await fs4.rename(tempPath, filePath);
+    tempCreated = false;
   } catch (error3) {
-    try {
-      await fs4.unlink(tempPath);
-    } catch (unlinkError) {
-      if (!hasErrorCode(unlinkError, "ENOENT")) {
-        throw unlinkError;
+    if (tempCreated || !hasErrorCode(error3, "EEXIST")) {
+      try {
+        await fs4.unlink(tempPath);
+      } catch (unlinkError) {
+        if (!hasErrorCode(unlinkError, "ENOENT")) {
+          throw unlinkError;
+        }
       }
     }
     throw error3;
@@ -3199,6 +3249,7 @@ async function withFileLock(fs4, lockPath, operation) {
       break;
     } catch (error3) {
       if (!hasErrorCode(error3, "EEXIST")) {
+        await fs4.unlink(lockPath).catch(() => void 0);
         throw error3;
       }
       if (await removeAbandonedLock(fs4, lockPath)) {
@@ -4482,27 +4533,30 @@ function readFrontmatter(frontmatterContent, filePath) {
   return parsed;
 }
 function assertValidTaskRecord(frontmatter, filePath, validStates) {
-  if ("$schema" in frontmatter && frontmatter.$schema !== TASK_SCHEMA_ID) {
+  if (hasOwnTaskField(frontmatter, "$schema") && frontmatter.$schema !== TASK_SCHEMA_ID) {
     throw malformedTask(filePath, "$schema");
   }
-  if ("kind" in frontmatter && frontmatter.kind !== TASK_KIND) {
+  if (hasOwnTaskField(frontmatter, "kind") && frontmatter.kind !== TASK_KIND) {
     throw malformedTask(filePath, "kind");
   }
-  if ("version" in frontmatter) {
+  if (hasOwnTaskField(frontmatter, "version")) {
     if (typeof frontmatter.version !== "number" || !Number.isInteger(frontmatter.version) || frontmatter.version !== TASK_VERSION) {
       throw malformedTask(filePath, "version");
     }
   }
-  if (typeof frontmatter.name !== "string" || frontmatter.name.length === 0) {
+  if (!hasOwnTaskField(frontmatter, "name") || typeof frontmatter.name !== "string" || frontmatter.name.length === 0) {
     throw malformedTask(filePath, "name");
   }
-  if (typeof frontmatter.state !== "string" || !validStates.has(frontmatter.state)) {
+  if (!hasOwnTaskField(frontmatter, "state") || typeof frontmatter.state !== "string" || !validStates.has(frontmatter.state)) {
     throw malformedTask(filePath, "state");
   }
-  if ("description" in frontmatter && typeof frontmatter.description !== "string") {
+  if (hasOwnTaskField(frontmatter, "description") && typeof frontmatter.description !== "string") {
     throw malformedTask(filePath, "description");
   }
 }
+function hasOwnTaskField(frontmatter, key2) {
+  return Object.prototype.hasOwnProperty.call(frontmatter, key2);
+}
 function reservedFrontmatterKeys(mode) {
   return mode === "passthrough" ? PASSTHROUGH_RESERVED_FRONTMATTER_KEYS : RESERVED_FRONTMATTER_KEYS;
 }
@@ -5351,7 +5405,8 @@ function parseQualifiedId3(qualifiedId) {
   };
 }
 function descriptionFromTaskRecord(taskRecord) {
-  return typeof taskRecord.description === "string" ? taskRecord.description : "";
+  const description = getOwnEntry(taskRecord, "description");
+  return typeof description === "string" ? description : "";
 }
 function metadataFromTaskRecord(taskRecord) {
   const metadata = /* @__PURE__ */ Object.create(null);
@@ -5367,8 +5422,8 @@ function createTask2(list, id, taskRecord, sourcePath) {
     list,
     id,
     qualifiedId: `${list}/${id}`,
-    name: taskRecord.name,
-    state: taskRecord.state,
+    name: getOwnEntry(taskRecord, "name"),
+    state: getOwnEntry(taskRecord, "state"),
     description: descriptionFromTaskRecord(taskRecord),
     metadata: metadataFromTaskRecord(taskRecord),
     ...sourcePath !== void 0 && { sourcePath: path8.resolve(sourcePath) }
@@ -5465,16 +5520,17 @@ function assertValidStoreRecord(store, filePath) {
   if (!isRecord2(store)) {
     throw malformedStore(filePath, "store");
   }
-  if (store.$schema !== STORE_SCHEMA_ID) {
+  if (getOwnEntry(store, "$schema") !== STORE_SCHEMA_ID) {
     throw malformedStore(filePath, "$schema");
   }
-  if (store.kind !== STORE_KIND) {
+  if (getOwnEntry(store, "kind") !== STORE_KIND) {
     throw malformedStore(filePath, "kind");
   }
-  if (typeof store.version !== "number" || !Number.isInteger(store.version) || store.version !== STORE_VERSION) {
+  const version = getOwnEntry(store, "version");
+  if (typeof version !== "number" || !Number.isInteger(version) || version !== STORE_VERSION) {
     throw malformedStore(filePath, "version");
   }
-  if (!isRecord2(store.lists)) {
+  if (!isRecord2(getOwnEntry(store, "lists"))) {
     throw malformedStore(filePath, "lists");
   }
 }
@@ -5482,29 +5538,38 @@ function assertValidTaskRecord2(taskRecord, list, id, validStates) {
   if (!isRecord2(taskRecord)) {
     throw malformedTask2(list, id, "task");
   }
-  if ("$schema" in taskRecord && taskRecord.$schema !== TASK_SCHEMA_ID2) {
+  if (hasOwnTaskField2(taskRecord, "$schema") && getOwnEntry(taskRecord, "$schema") !== TASK_SCHEMA_ID2) {
     throw malformedTask2(list, id, "$schema");
   }
-  if ("kind" in taskRecord && taskRecord.kind !== TASK_KIND2) {
+  if (hasOwnTaskField2(taskRecord, "kind") && getOwnEntry(taskRecord, "kind") !== TASK_KIND2) {
     throw malformedTask2(list, id, "kind");
   }
-  if ("version" in taskRecord) {
-    if (typeof taskRecord.version !== "number" || !Number.isInteger(taskRecord.version) || taskRecord.version !== TASK_VERSION2) {
+  if (hasOwnTaskField2(taskRecord, "version")) {
+    const version = getOwnEntry(taskRecord, "version");
+    if (typeof version !== "number" || !Number.isInteger(version) || version !== TASK_VERSION2) {
       throw malformedTask2(list, id, "version");
     }
   }
-  if (typeof taskRecord.name !== "string" || taskRecord.name.length === 0) {
+  const name = getOwnEntry(taskRecord, "name");
+  if (!hasOwnTaskField2(taskRecord, "name") || typeof name !== "string" || name.length === 0) {
     throw malformedTask2(list, id, "name");
   }
-  if (typeof taskRecord.state !== "string" || !validStates.has(taskRecord.state)) {
+  const state = getOwnEntry(taskRecord, "state");
+  if (!hasOwnTaskField2(taskRecord, "state") || typeof state !== "string" || !validStates.has(state)) {
     throw malformedTask2(list, id, "state");
   }
-  if ("description" in taskRecord && typeof taskRecord.description !== "string") {
+  if (hasOwnTaskField2(taskRecord, "description") && typeof getOwnEntry(taskRecord, "description") !== "string") {
     throw malformedTask2(list, id, "description");
   }
 }
+function hasOwnTaskField2(taskRecord, key2) {
+  return Object.prototype.hasOwnProperty.call(taskRecord, key2);
+}
+function getOwnEntry(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
 function validateStoreEntries(store, filePath, validStates) {
-  const lists = store.lists;
+  const lists = getOwnEntry(store, "lists");
   if (!isRecord2(lists)) {
     throw malformedStore(filePath, "lists");
   }
@@ -5544,10 +5609,11 @@ async function readStore(fs4, filePath, validStates) {
   };
 }
 function getListsRecord(store) {
-  return store.lists;
+  const lists = getOwnEntry(store, "lists");
+  return isRecord2(lists) ? lists : {};
 }
 function getListRecord(store, list) {
-  const listRecord = getListsRecord(store)[list];
+  const listRecord = getOwnEntry(getListsRecord(store), list);
   return isRecord2(listRecord) ? listRecord : void 0;
 }
 function getTaskRecord(store, list, id) {
@@ -5840,7 +5906,7 @@ async function yamlFileBackend(deps) {
     const result = [];
     const listNames = sortStrings(Object.keys(getListsRecord(store)));
     for (const listName of listNames) {
-      const listRecord = getListsRecord(store)[listName];
+      const listRecord = getOwnEntry(getListsRecord(store), listName);
       if (!isRecord2(listRecord)) continue;
       const entries = Object.entries(listRecord).map(([id, taskRecord]) => ({
         task: createTask2(listName, id, taskRecord, deps.path),
@@ -5888,51 +5954,74 @@ function createDefaultFs() {
   return fsPromises;
 }
 async function openTaskList(options) {
-  switch (options.type) {
+  const type2 = getOwnProperty2(options, "type");
+  switch (type2) {
     case "markdown-dir":
     case "yaml-file":
       return openFileBackend(options);
     case "gh-issues":
       return openGhIssuesBackend(options);
     default:
-      throw new Error(`Unknown task list backend type "${options.type}".`);
+      throw new Error(`Unknown task list backend type "${String(type2)}".`);
   }
 }
 async function openFileBackend(options) {
-  const factory = backendFactories[options.type];
-  const stateMachine = resolveStateMachine(options.stateMachine);
+  const type2 = getOwnProperty2(options, "type");
+  const factory = backendFactories[type2];
+  const stateMachine = resolveStateMachine(
+    getOwnProperty2(options, "stateMachine")
+  );
   validateMachine(stateMachine);
-  const markdownOptions = options.type === "markdown-dir" ? options : void 0;
+  const markdownOptions = type2 === "markdown-dir" ? options : void 0;
+  const defaults2 = getOwnProperty2(options, "defaults");
   const deps = {
-    path: options.path,
+    path: getOwnProperty2(options, "path"),
     defaults: {
-      metadata: { ...options.defaults?.metadata ?? {} }
+      metadata: readDefaultMetadata(defaults2)
     },
-    singleList: markdownOptions?.singleList,
-    frontmatterMode: markdownOptions?.frontmatterMode ?? "strict",
-    create: options.create ?? false,
-    fs: options.fs ?? createDefaultFs(),
+    singleList: markdownOptions === void 0 ? void 0 : getOwnProperty2(markdownOptions, "singleList"),
+    frontmatterMode: markdownOptions === void 0 ? "strict" : getOwnProperty2(
+      markdownOptions,
+      "frontmatterMode"
+    ) ?? "strict",
+    create: getOwnProperty2(options, "create") ?? false,
+    fs: getOwnProperty2(options, "fs") ?? createDefaultFs(),
     stateMachine
   };
   return factory(deps);
 }
 async function openGhIssuesBackend(options) {
-  const token = await resolveAuth({ explicitToken: options.auth?.token });
+  const auth = getOwnProperty2(options, "auth");
+  const explicitToken = auth && hasOwnProperty2(auth, "token") ? auth.token : void 0;
   const endpoint = resolveEndpoint();
+  const defaults2 = getOwnProperty2(options, "defaults");
   return ghIssuesBackend({
-    repo: options.repo,
-    project: options.project,
-    filter: options.filter,
-    state: options.state,
-    stateMachine: options.stateMachine,
+    repo: getOwnProperty2(options, "repo"),
+    project: getOwnProperty2(options, "project"),
+    filter: getOwnProperty2(options, "filter"),
+    state: getOwnProperty2(options, "state"),
+    stateMachine: getOwnProperty2(options, "stateMachine"),
     defaults: {
-      metadata: { ...options.defaults?.metadata ?? {} }
+      metadata: readDefaultMetadata(defaults2)
     },
-    token,
+    token: await resolveAuth({ explicitToken }),
     endpoint,
-    fetch: options.fetch
+    fetch: getOwnProperty2(options, "fetch")
   });
 }
+function readDefaultMetadata(defaults2) {
+  const metadata = defaults2 === void 0 ? void 0 : getOwnProperty2(defaults2, "metadata");
+  return isRecord4(metadata) ? { ...metadata } : {};
+}
+function getOwnProperty2(value, name) {
+  return hasOwnProperty2(value, name) ? value[name] : void 0;
+}
+function hasOwnProperty2(value, name) {
+  return Object.prototype.hasOwnProperty.call(value, name);
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 
 // ../task-list/src/move.ts
 import * as fsPromises2 from "node:fs/promises";
@@ -6190,7 +6279,7 @@ function osascriptProvider(options = {}) {
         const { stdout } = await execFileAsync(binary, ["-e", script]);
         return parseStdout(stdout);
       } catch (error3) {
-        if (error3.code === "ENOENT") {
+        if (hasOwnErrorCode2(error3, "ENOENT")) {
           throw new Error("osascript not found \u2014 provide a different provider on this platform");
         }
         if (isUserCanceled(error3)) {
@@ -6202,6 +6291,9 @@ function osascriptProvider(options = {}) {
     }
   };
 }
+function hasOwnErrorCode2(error3, code) {
+  return typeof error3 === "object" && error3 !== null && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === code;
+}
 
 // ../toolcraft/src/human-in-loop/default-provider.ts
 function noProviderConfigured() {
@@ -6474,8 +6566,8 @@ function createHandlerContext(command, params17) {
 function createFs() {
   return {
     readFile: async (path24, encoding = "utf8") => readFile2(path24, { encoding }),
-    writeFile: async (path24, contents) => {
-      await writeFile2(path24, contents);
+    writeFile: async (path24, contents, options) => {
+      await writeFile2(path24, contents, options);
     },
     exists: async (path24) => {
       try {
@@ -6759,21 +6851,21 @@ function escapeMarkdownCell(value) {
   return value.replaceAll("|", "\\|");
 }
 function isMissingStateError(error3) {
-  return typeof error3 === "object" && error3 !== null && "code" in error3 && error3.code === "ENOENT";
+  return hasOwnErrorCode(error3, "ENOENT");
 }
 
 // ../toolcraft/src/error-report.ts
 import { mkdir as mkdir2, realpath as realpath2, writeFile as writeFile4 } from "node:fs/promises";
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 import os from "node:os";
 import path13 from "node:path";
 import { CommanderError } from "commander";
 
 // ../toolcraft/src/mcp-proxy.ts
 import { existsSync as existsSync2 } from "node:fs";
-import { lstat as lstat2, mkdir, readFile as readFile3, rename as rename2, writeFile as writeFile3 } from "node:fs/promises";
+import { lstat as lstat2, mkdir, readFile as readFile3, rename as rename2, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
 import path12 from "node:path";
-import { createHash as createHash3, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash3, randomUUID as randomUUID4 } from "node:crypto";
 
 // ../tiny-mcp-client/src/internal.ts
 import { spawn as spawn5 } from "node:child_process";
@@ -6784,10 +6876,17 @@ import crypto from "node:crypto";
 import path11 from "node:path";
 
 // ../auth-store/src/encrypted-file-store.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes4, scrypt } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes4, randomUUID as randomUUID3, scrypt } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
 import path10 from "node:path";
+
+// ../auth-store/src/error-codes.ts
+function hasOwnErrorCode3(error3, code) {
+  return error3 instanceof Error && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === code;
+}
+
+// ../auth-store/src/encrypted-file-store.ts
 var derivedKeyCache = /* @__PURE__ */ new Map();
 var ENCRYPTION_ALGORITHM = "aes-256-gcm";
 var ENCRYPTION_VERSION = 1;
@@ -6795,7 +6894,6 @@ var ENCRYPTION_KEY_BYTES = 32;
 var ENCRYPTION_IV_BYTES = 12;
 var ENCRYPTION_AUTH_TAG_BYTES = 16;
 var ENCRYPTION_FILE_MODE = 384;
-var temporaryFileSequence = 0;
 var EncryptedFileStore = class {
   fs;
   filePath;
@@ -6827,7 +6925,7 @@ var EncryptedFileStore = class {
     this.getRandomBytes = input.getRandomBytes ?? randomBytes4;
   }
   async get() {
-    await this.assertRegularCredentialPath();
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
     let rawDocument;
     try {
       rawDocument = await this.fs.readFile(this.filePath, "utf8");
@@ -6858,7 +6956,7 @@ var EncryptedFileStore = class {
     }
   }
   async set(value) {
-    await this.assertRegularCredentialPath();
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
     const key2 = await this.getEncryptionKey();
     const iv = this.getRandomBytes(ENCRYPTION_IV_BYTES);
     const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key2, iv);
@@ -6874,25 +6972,28 @@ var EncryptedFileStore = class {
       ciphertext: ciphertext.toString("base64")
     };
     await this.fs.mkdir(path10.dirname(this.filePath), { recursive: true });
-    await this.assertRegularCredentialPath();
-    const temporaryPath = `${this.filePath}.${process.pid}.${temporaryFileSequence++}.tmp`;
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID3()}.tmp`;
+    let temporaryCreated = false;
     try {
+      await this.assertCredentialPathHasNoSymbolicLinks(temporaryPath);
       await this.fs.writeFile(temporaryPath, JSON.stringify(document), {
         encoding: "utf8",
         flag: "wx",
         mode: ENCRYPTION_FILE_MODE
       });
+      temporaryCreated = true;
       await this.fs.chmod(temporaryPath, ENCRYPTION_FILE_MODE);
       await this.fs.rename(temporaryPath, this.filePath);
     } catch (error3) {
-      if (!isAlreadyExistsError(error3)) {
+      if (temporaryCreated || !isAlreadyExistsError(error3)) {
         await removeIfPresent(this.fs, temporaryPath).catch(() => void 0);
       }
       throw error3;
     }
   }
   async delete() {
-    await this.assertRegularCredentialPath();
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
     try {
       await this.fs.unlink(this.filePath);
     } catch (error3) {
@@ -6901,8 +7002,8 @@ var EncryptedFileStore = class {
       }
     }
   }
-  async assertRegularCredentialPath() {
-    const resolvedPath = path10.resolve(this.filePath);
+  async assertCredentialPathHasNoSymbolicLinks(targetPath) {
+    const resolvedPath = path10.resolve(targetPath);
     const protectedPaths = getProtectedCredentialPaths(
       resolvedPath,
       this.symbolicLinkCheckStartPath
@@ -6967,9 +7068,6 @@ async function removeIfPresent(fileSystem, filePath) {
     }
   }
 }
-function isAlreadyExistsError(error3) {
-  return typeof error3 === "object" && error3 !== null && "code" in error3 && error3.code === "EEXIST";
-}
 function defaultMachineIdentity() {
   return {
     hostname: hostname(),
@@ -7004,32 +7102,40 @@ async function deriveEncryptionKey(getMachineIdentity, salt) {
 function parseEncryptedDocument(raw) {
   try {
     const parsed = JSON.parse(raw);
-    if (!isRecord4(parsed)) {
+    if (!isRecord5(parsed)) {
       return null;
     }
-    if (parsed.version !== ENCRYPTION_VERSION) {
+    const version = getOwnEntry2(parsed, "version");
+    const iv = getOwnEntry2(parsed, "iv");
+    const authTag = getOwnEntry2(parsed, "authTag");
+    const ciphertext = getOwnEntry2(parsed, "ciphertext");
+    if (version !== ENCRYPTION_VERSION) {
       return null;
     }
-    if (typeof parsed.iv !== "string" || typeof parsed.authTag !== "string" || typeof parsed.ciphertext !== "string") {
+    if (typeof iv !== "string" || typeof authTag !== "string" || typeof ciphertext !== "string") {
       return null;
     }
     return {
-      version: parsed.version,
-      iv: parsed.iv,
-      authTag: parsed.authTag,
-      ciphertext: parsed.ciphertext
+      version,
+      iv,
+      authTag,
+      ciphertext
     };
   } catch {
     return null;
   }
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
+function getOwnEntry2(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
 function isNotFoundError(error3) {
-  return Boolean(
-    error3 && typeof error3 === "object" && "code" in error3 && error3.code === "ENOENT"
-  );
+  return hasOwnErrorCode3(error3, "ENOENT");
+}
+function isAlreadyExistsError(error3) {
+  return hasOwnErrorCode3(error3, "EEXIST");
 }
 
 // ../auth-store/src/keychain-store.ts
@@ -7050,8 +7156,8 @@ var KeychainStore = class {
       ["find-generic-password", "-s", this.service, "-a", this.account, "-w"],
       "read secret from macOS Keychain"
     );
-    if (result.exitCode === 0) {
-      return stripTrailingLineBreak(result.stdout);
+    if (getCommandExitCode(result) === 0) {
+      return stripTrailingLineBreak(getCommandOutput(result, "stdout"));
     }
     if (isKeychainEntryNotFound(result)) {
       return null;
@@ -7075,7 +7181,7 @@ var KeychainStore = class {
       "store secret in macOS Keychain",
       { stdin: value }
     );
-    if (result.exitCode !== 0) {
+    if (getCommandExitCode(result) !== 0) {
       throw createSecurityCliFailure("store secret in macOS Keychain", result);
     }
   }
@@ -7084,7 +7190,7 @@ var KeychainStore = class {
       ["delete-generic-password", "-s", this.service, "-a", this.account],
       "delete secret from macOS Keychain"
     );
-    if (result.exitCode === 0 || isKeychainEntryNotFound(result)) {
+    if (getCommandExitCode(result) === 0 || isKeychainEntryNotFound(result)) {
       return;
     }
     throw createSecurityCliFailure("delete secret from macOS Keychain", result);
@@ -7163,16 +7269,28 @@ function stripTrailingLineBreak(value) {
   return value;
 }
 function isKeychainEntryNotFound(result) {
-  return result.exitCode === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE;
+  return getCommandExitCode(result) === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE;
 }
 function createSecurityCliFailure(operation, result) {
-  const details = result.stderr.trim() || result.stdout.trim();
+  const exitCode = getCommandExitCode(result);
+  const details = getCommandOutput(result, "stderr").trim() || getCommandOutput(result, "stdout").trim();
   if (details) {
     return new Error(
-      `Failed to ${operation}: security exited with code ${result.exitCode}: ${details}`
+      `Failed to ${operation}: security exited with code ${exitCode}: ${details}`
     );
   }
-  return new Error(`Failed to ${operation}: security exited with code ${result.exitCode}`);
+  return new Error(`Failed to ${operation}: security exited with code ${exitCode}`);
+}
+function getCommandExitCode(result) {
+  const value = getOwnEntry3(result, "exitCode");
+  return typeof value === "number" && Number.isInteger(value) ? value : 1;
+}
+function getCommandOutput(result, key2) {
+  const value = getOwnEntry3(result, key2);
+  return typeof value === "string" ? value : "";
+}
+function getOwnEntry3(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
 }
 
 // ../auth-store/src/create-secret-store.ts
@@ -7205,7 +7323,7 @@ function createSecretStore(input) {
 }
 function resolveBackend(input) {
   const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
-  const configuredBackend = input.backend ?? input.env?.[envVar] ?? process.env[envVar];
+  const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
   if (configuredBackend === "keychain") {
     return "keychain";
   }
@@ -7214,6 +7332,9 @@ function resolveBackend(input) {
   }
   throw new Error(`Unsupported auth store backend: ${configuredBackend}`);
 }
+function getOwnEnvValue(env, key2) {
+  return env !== void 0 && Object.prototype.hasOwnProperty.call(env, key2) ? env[key2] : void 0;
+}
 
 // ../mcp-oauth/src/resource-indicator.ts
 function canonicalizeResourceIndicator(value) {
@@ -7267,8 +7388,13 @@ function createAuthStoreClientStore(options) {
         return null;
       }
       const parsed = JSON.parse(value);
-      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && typeof parsed.clientId === "string") {
-        return parsed;
+      const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : void 0;
+      if (clientId !== void 0) {
+        const client = { clientId };
+        if (isObjectRecord(parsed) && Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
+          client.clientSecret = getOwnEntry4(parsed, "clientSecret");
+        }
+        return client;
       }
       throw new Error("Stored OAuth client must be a JSON object with clientId");
     },
@@ -7327,6 +7453,16 @@ function createIssuerSecretStore(issuer, options) {
     }
   );
 }
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry4(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+function getOwnString(record, key2) {
+  const value = getOwnEntry4(record, key2);
+  return typeof value === "string" ? value : void 0;
+}
 
 // ../mcp-oauth/src/client/default-oauth-client-provider.ts
 import { URL as URL2 } from "node:url";
@@ -7352,17 +7488,30 @@ function parseAuthorizationState(value) {
   try {
     const decoded = Buffer.from(value, "base64url").toString("utf8");
     const parsed = JSON.parse(decoded);
-    if (parsed.v !== 1 || typeof parsed.n !== "string" || parsed.n.length === 0 || typeof parsed.i !== "string" || parsed.i.length === 0 || typeof parsed.r !== "boolean") {
+    if (!isObjectRecord2(parsed)) {
+      return null;
+    }
+    const version = getOwnEntry5(parsed, "v");
+    const nonce = getOwnEntry5(parsed, "n");
+    const issuer = getOwnEntry5(parsed, "i");
+    const requireIssuer = getOwnEntry5(parsed, "r");
+    if (version !== 1 || typeof nonce !== "string" || nonce.length === 0 || typeof issuer !== "string" || issuer.length === 0 || typeof requireIssuer !== "boolean") {
       return null;
     }
     return {
-      issuer: parsed.i,
-      requireIssuer: parsed.r
+      issuer,
+      requireIssuer
     };
   } catch {
     return null;
   }
 }
+function isObjectRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry5(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
 
 // ../mcp-oauth/src/client/loopback-authorization.ts
 async function createLoopbackAuthorizationSession(options = {}) {
@@ -7639,22 +7788,26 @@ async function requestTokens(input) {
     body: body.toString()
   });
   const payload = await readOAuthJsonObjectResponse(response);
-  if (typeof payload.access_token !== "string" || payload.access_token.trim().length === 0) {
+  const accessToken = getOwnEntry6(payload, "access_token");
+  if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
     throw new Error("OAuth token response missing access_token");
   }
-  const tokenType = normalizeBearerTokenType(payload.token_type);
+  const tokenType = normalizeBearerTokenType(getOwnEntry6(payload, "token_type"));
   if (tokenType === null) {
     throw new Error("OAuth token response missing token_type=Bearer");
   }
-  if (typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) && payload.expires_in < 0) {
+  const expiresIn = getOwnEntry6(payload, "expires_in");
+  if (typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn < 0) {
     throw new Error("OAuth token response has invalid expires_in");
   }
+  const refreshToken = getOwnEntry6(payload, "refresh_token");
+  const scope = getOwnEntry6(payload, "scope");
   return {
-    accessToken: payload.access_token,
-    refreshToken: typeof payload.refresh_token === "string" && payload.refresh_token.length > 0 ? payload.refresh_token : void 0,
+    accessToken,
+    refreshToken: typeof refreshToken === "string" && refreshToken.length > 0 ? refreshToken : void 0,
     tokenType,
-    expiresAt: typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in) ? input.now() + payload.expires_in * 1e3 : null,
-    scope: typeof payload.scope === "string" && payload.scope.length > 0 ? payload.scope : void 0
+    expiresAt: typeof expiresIn === "number" && Number.isFinite(expiresIn) ? input.now() + expiresIn * 1e3 : null,
+    scope: typeof scope === "string" && scope.length > 0 ? scope : void 0
   };
 }
 async function readOAuthJsonObjectResponse(response) {
@@ -7681,12 +7834,18 @@ async function readOAuthJsonObjectResponse(response) {
   return record;
 }
 function readOAuthError(payload, fallbackError = "server_error") {
+  const error3 = getOwnEntry6(payload, "error");
+  const errorDescription = getOwnEntry6(payload, "error_description");
+  const errorUri = getOwnEntry6(payload, "error_uri");
   return {
-    error: typeof payload.error === "string" ? payload.error : fallbackError,
-    error_description: typeof payload.error_description === "string" ? payload.error_description : void 0,
-    error_uri: typeof payload.error_uri === "string" ? payload.error_uri : void 0
+    error: typeof error3 === "string" ? error3 : fallbackError,
+    error_description: typeof errorDescription === "string" ? errorDescription : void 0,
+    error_uri: typeof errorUri === "string" ? errorUri : void 0
   };
 }
+function getOwnEntry6(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
 function createFallbackOAuthError(status) {
   const error3 = status === 503 ? "temporarily_unavailable" : "server_error";
   return new OAuthError({ error: error3 }, status);
@@ -7791,7 +7950,11 @@ function createDefaultOAuthClientProvider(options) {
         while (true) {
           try {
             refreshedTokens = await refreshAccessToken({
-              tokenEndpoint: discovery.authorizationServerMetadata.token_endpoint,
+              tokenEndpoint: requireOwnString(
+                discovery.authorizationServerMetadata,
+                "token_endpoint",
+                "Authorization server metadata"
+              ),
               clientId: session.client.clientId,
               clientSecret: session.client.clientSecret,
               refreshToken: session.tokens.refreshToken,
@@ -7879,7 +8042,11 @@ function createDefaultOAuthClientProvider(options) {
           });
           const code = await loopback.waitForCode(authorizationUrl);
           const tokens = await exchangeAuthorizationCode({
-            tokenEndpoint: discovery.authorizationServerMetadata.token_endpoint,
+            tokenEndpoint: requireOwnString(
+              discovery.authorizationServerMetadata,
+              "token_endpoint",
+              "Authorization server metadata"
+            ),
             clientId: resolvedClient.client.clientId,
             clientSecret: resolvedClient.client.clientSecret,
             code,
@@ -7932,7 +8099,10 @@ function createDefaultOAuthClientProvider(options) {
         }
       };
     }
-    const registrationEndpoint = discovery.authorizationServerMetadata.registration_endpoint;
+    const registrationEndpoint = getOwnString2(
+      discovery.authorizationServerMetadata,
+      "registration_endpoint"
+    );
     if (registrationEndpoint === void 0 && options.client.clientId !== void 0) {
       return {
         kind: "static",
@@ -7984,12 +8154,14 @@ function createDefaultOAuthClientProvider(options) {
       body: JSON.stringify(registrationBody)
     });
     const payload = await readOAuthJsonObjectResponse(response);
-    if (typeof payload.client_id !== "string" || payload.client_id.trim().length === 0) {
+    const clientId = getOwnString2(payload, "client_id");
+    if (clientId === void 0 || clientId.trim().length === 0) {
       throw new Error("OAuth client registration response missing client_id");
     }
+    const clientSecret = getOwnString2(payload, "client_secret");
     const registeredClient = {
-      clientId: payload.client_id,
-      clientSecret: typeof payload.client_secret === "string" && payload.client_secret.length > 0 ? payload.client_secret : void 0
+      clientId,
+      clientSecret: clientSecret !== void 0 && clientSecret.length > 0 ? clientSecret : void 0
     };
     await saveRegisteredClient(discovery.authorizationServer, registeredClient);
     return {
@@ -8015,12 +8187,13 @@ function createDefaultOAuthClientProvider(options) {
       return null;
     }
     const client = await clientStore.load(issuer);
-    if (client !== null && !isUsableClient(client)) {
+    const normalizedClient = client === null ? null : normalizeStoredClient(client);
+    if (client !== null && normalizedClient === null) {
       await clientStore.clear(issuer);
       return null;
     }
-    registeredClients.set(issuer, client);
-    return client;
+    registeredClients.set(issuer, normalizedClient);
+    return normalizedClient;
   }
   async function saveRegisteredClient(issuer, client) {
     registeredClients.set(issuer, client);
@@ -8036,7 +8209,7 @@ function createDefaultOAuthClientProvider(options) {
   }
 }
 function isProviderOptions(options) {
-  return "provider" in options;
+  return Object.prototype.hasOwnProperty.call(options, "provider");
 }
 function isExpired(tokens, now) {
   return tokens.expiresAt !== null && tokens.expiresAt <= now();
@@ -8052,7 +8225,14 @@ function resolveDiscovery(discovery, session) {
     return void 0;
   }
   const metadata = session.discovery.authorizationServerMetadata;
-  if (typeof metadata.issuer !== "string" || typeof metadata.authorization_endpoint !== "string" || typeof metadata.token_endpoint !== "string" || !Array.isArray(metadata.code_challenge_methods_supported) || !metadata.code_challenge_methods_supported.includes("S256")) {
+  const issuer = getOwnString2(metadata, "issuer");
+  const authorizationEndpoint = getOwnString2(metadata, "authorization_endpoint");
+  const tokenEndpoint = getOwnString2(metadata, "token_endpoint");
+  const codeChallengeMethodsSupported = getOwnStringArray(
+    metadata,
+    "code_challenge_methods_supported"
+  );
+  if (issuer === void 0 || authorizationEndpoint === void 0 || tokenEndpoint === void 0 || codeChallengeMethodsSupported === void 0 || !codeChallengeMethodsSupported.includes("S256")) {
     return void 0;
   }
   return {
@@ -8076,29 +8256,94 @@ function normalizeLoadedSession(session) {
   if (session === null) {
     return null;
   }
-  if (!isUsableClient(session.client)) {
+  const client = normalizeStoredClient(getOwnEntry7(session, "client"));
+  if (client === null) {
     return { ...session, client: { clientId: "" }, tokens: void 0 };
   }
-  return isUsableTokens(session.tokens) ? session : { ...session, tokens: void 0 };
+  return {
+    ...session,
+    client,
+    tokens: normalizeStoredTokens(getOwnEntry7(session, "tokens"))
+  };
 }
-function isUsableClient(client) {
-  return typeof client.clientId === "string" && client.clientId.trim().length > 0 && (client.clientSecret === void 0 || typeof client.clientSecret === "string" && client.clientSecret.trim().length > 0);
+function normalizeStoredClient(value) {
+  if (!isObjectRecord3(value)) {
+    return null;
+  }
+  const clientId = getOwnString2(value, "clientId");
+  if (clientId === void 0 || clientId.trim().length === 0) {
+    return null;
+  }
+  const clientSecret = getOwnEntry7(value, "clientSecret");
+  if (clientSecret === void 0) {
+    return { clientId };
+  }
+  if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
+    return null;
+  }
+  return { clientId, clientSecret };
 }
-function isUsableTokens(tokens) {
-  if (tokens === void 0) {
-    return true;
+function normalizeStoredTokens(value) {
+  if (value === void 0 || !isObjectRecord3(value)) {
+    return void 0;
+  }
+  const accessToken = getOwnString2(value, "accessToken");
+  const tokenType = getOwnString2(value, "tokenType");
+  const expiresAt = getOwnEntry7(value, "expiresAt");
+  const refreshToken = getOwnEntry7(value, "refreshToken");
+  const scope = getOwnString2(value, "scope");
+  const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken : void 0;
+  if (accessToken === void 0 || accessToken.trim().length === 0 || tokenType !== "Bearer" || !(expiresAt === null || typeof expiresAt === "number" && Number.isFinite(expiresAt)) || refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
+    return void 0;
   }
-  return typeof tokens.accessToken === "string" && tokens.accessToken.trim().length > 0 && tokens.tokenType === "Bearer" && (tokens.expiresAt === null || typeof tokens.expiresAt === "number" && Number.isFinite(tokens.expiresAt)) && (tokens.refreshToken === void 0 || typeof tokens.refreshToken === "string" && tokens.refreshToken.trim().length > 0);
+  return {
+    accessToken,
+    tokenType,
+    expiresAt,
+    ...normalizedRefreshToken === void 0 ? {} : { refreshToken: normalizedRefreshToken },
+    ...scope === void 0 || scope.length === 0 ? {} : { scope }
+  };
 }
 function getClientMetadata(client) {
   return client.metadata;
 }
+function getOwnEntry7(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+function isObjectRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnString2(record, key2) {
+  const value = getOwnEntry7(record, key2);
+  return typeof value === "string" ? value : void 0;
+}
+function requireOwnString(record, key2, label) {
+  const value = getOwnString2(record, key2);
+  if (value === void 0) {
+    throw new Error(`${label} is missing ${key2}`);
+  }
+  return value;
+}
+function getOwnStringArray(record, key2) {
+  const value = getOwnEntry7(record, key2);
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+}
 function buildAuthorizationUrl(input) {
-  const url = new URL2(input.metadata.authorization_endpoint);
+  const authorizationEndpoint = requireOwnString(
+    input.metadata,
+    "authorization_endpoint",
+    "Authorization server metadata"
+  );
+  const issuer = requireOwnString(
+    input.metadata,
+    "issuer",
+    "Authorization server metadata"
+  );
+  const url = new URL2(authorizationEndpoint);
   const resource = canonicalizeResourceIndicator(input.resource);
   const state = createAuthorizationState({
-    issuer: input.metadata.issuer,
-    requireIssuer: input.metadata.authorization_response_iss_parameter_supported === true
+    issuer,
+    requireIssuer: getOwnEntry7(input.metadata, "authorization_response_iss_parameter_supported") === true
   });
   url.searchParams.set("response_type", "code");
   url.searchParams.set("client_id", input.clientId);
@@ -8113,7 +8358,7 @@ function buildAuthorizationUrl(input) {
   return url.toString();
 }
 function assertS256PkceSupport(metadata) {
-  if (!metadata.code_challenge_methods_supported.includes("S256")) {
+  if (!getOwnStringArray(metadata, "code_challenge_methods_supported")?.includes("S256")) {
     throw new Error(
       "Authorization server metadata must advertise code_challenge_methods_supported including S256"
     );
@@ -8137,13 +8382,24 @@ function assertSecureUrl(value, label) {
   throw new Error(`${label} must use https unless it targets a loopback host`);
 }
 function assertSecureOAuthFlowEndpoints(metadata) {
-  assertNoAccessTokenInUrl(metadata.authorization_endpoint, "Authorization endpoint");
-  assertNoAccessTokenInUrl(metadata.token_endpoint, "Token endpoint");
-  assertSecureUrl(metadata.authorization_endpoint, "Authorization endpoint");
-  assertSecureUrl(metadata.token_endpoint, "Token endpoint");
-  if (metadata.registration_endpoint !== void 0) {
-    assertNoAccessTokenInUrl(metadata.registration_endpoint, "Registration endpoint");
-    assertSecureUrl(metadata.registration_endpoint, "Registration endpoint");
+  const authorizationEndpoint = requireOwnString(
+    metadata,
+    "authorization_endpoint",
+    "Authorization server metadata"
+  );
+  const tokenEndpoint = requireOwnString(
+    metadata,
+    "token_endpoint",
+    "Authorization server metadata"
+  );
+  const registrationEndpoint = getOwnString2(metadata, "registration_endpoint");
+  assertNoAccessTokenInUrl(authorizationEndpoint, "Authorization endpoint");
+  assertNoAccessTokenInUrl(tokenEndpoint, "Token endpoint");
+  assertSecureUrl(authorizationEndpoint, "Authorization endpoint");
+  assertSecureUrl(tokenEndpoint, "Token endpoint");
+  if (registrationEndpoint !== void 0) {
+    assertNoAccessTokenInUrl(registrationEndpoint, "Registration endpoint");
+    assertSecureUrl(registrationEndpoint, "Registration endpoint");
   }
 }
 function assertNoAccessTokenInUrl(value, label) {
@@ -8166,17 +8422,21 @@ function buildClientRegistrationBody(metadata, redirectUri) {
     response_types: ["code"],
     token_endpoint_auth_method: "none"
   };
-  if (metadata?.clientName !== void 0 && metadata.clientName.length > 0) {
-    body.client_name = metadata.clientName;
+  const clientName = metadata === void 0 ? void 0 : getOwnString2(metadata, "clientName");
+  const scope = metadata === void 0 ? void 0 : getOwnString2(metadata, "scope");
+  const softwareId = metadata === void 0 ? void 0 : getOwnString2(metadata, "softwareId");
+  const softwareVersion = metadata === void 0 ? void 0 : getOwnString2(metadata, "softwareVersion");
+  if (clientName !== void 0 && clientName.length > 0) {
+    body.client_name = clientName;
   }
-  if (metadata?.scope !== void 0 && metadata.scope.length > 0) {
-    body.scope = metadata.scope;
+  if (scope !== void 0 && scope.length > 0) {
+    body.scope = scope;
   }
-  if (metadata?.softwareId !== void 0 && metadata.softwareId.length > 0) {
-    body.software_id = metadata.softwareId;
+  if (softwareId !== void 0 && softwareId.length > 0) {
+    body.software_id = softwareId;
   }
-  if (metadata?.softwareVersion !== void 0 && metadata.softwareVersion.length > 0) {
-    body.software_version = metadata.softwareVersion;
+  if (softwareVersion !== void 0 && softwareVersion.length > 0) {
+    body.software_version = softwareVersion;
   }
   return body;
 }
@@ -8212,7 +8472,7 @@ import {
 function defaultOAuthMetadataFetch(input, init) {
   return fetch(input, init);
 }
-function isObjectRecord(value) {
+function isObjectRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isStringArray(value) {
@@ -8235,7 +8495,7 @@ function assertSecureUrl2(url, label) {
   throw new Error(`${label} must use https unless it targets a loopback host`);
 }
 function validateProtectedResourceMetadata(value, resourceUrl) {
-  if (!isObjectRecord(value)) {
+  if (!isObjectRecord4(value)) {
     throw new Error("Protected resource metadata must be a JSON object");
   }
   if (typeof value.resource !== "string" || value.resource.length === 0) {
@@ -8258,7 +8518,7 @@ function validateProtectedResourceMetadata(value, resourceUrl) {
   };
 }
 function validateAuthorizationServerMetadata(value, issuer) {
-  if (!isObjectRecord(value)) {
+  if (!isObjectRecord4(value)) {
     throw new Error("Authorization server metadata must be a JSON object");
   }
   if (typeof value.issuer !== "string" || value.issuer.length === 0) {
@@ -8711,7 +8971,7 @@ var McpClient = class {
       await onPromptsChanged();
     });
     messageLayer.onNotification("notifications/message", async (params17) => {
-      if (onLog === void 0 || !isObjectRecord2(params17) || !isLogLevel(params17.level)) {
+      if (onLog === void 0 || !isObjectRecord5(params17) || !isLogLevel(params17.level)) {
         return;
       }
       if (!hasOwn(params17, "data")) {
@@ -8730,7 +8990,7 @@ var McpClient = class {
       await onLog(message2);
     });
     messageLayer.onNotification("notifications/progress", async (params17) => {
-      if (onProgress === void 0 || !isObjectRecord2(params17)) {
+      if (onProgress === void 0 || !isObjectRecord5(params17)) {
         return;
       }
       const { progressToken, progress } = params17;
@@ -9931,7 +10191,7 @@ var JsonRpcMessageLayer = class {
     })();
   }
   handleCancellationNotification(params17) {
-    if (!isObjectRecord2(params17)) {
+    if (!isObjectRecord5(params17)) {
       return;
     }
     const requestId = params17.requestId;
@@ -9946,34 +10206,34 @@ var JsonRpcMessageLayer = class {
     this.activeIncomingRequests.delete(requestId);
   }
 };
-function isObjectRecord2(value) {
+function isObjectRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isInitializeResult(value) {
-  if (!isObjectRecord2(value) || typeof value.protocolVersion !== "string") {
+  if (!isObjectRecord5(value) || typeof value.protocolVersion !== "string") {
     return false;
   }
   if (!isServerCapabilities(value.capabilities)) {
     return false;
   }
-  if (!isObjectRecord2(value.serverInfo) || typeof value.serverInfo.name !== "string" || value.serverInfo.name.length === 0 || typeof value.serverInfo.version !== "string" || value.serverInfo.version.length === 0) {
+  if (!isObjectRecord5(value.serverInfo) || typeof value.serverInfo.name !== "string" || value.serverInfo.name.length === 0 || typeof value.serverInfo.version !== "string" || value.serverInfo.version.length === 0) {
     return false;
   }
   return value.instructions === void 0 || typeof value.instructions === "string";
 }
 function isServerCapabilities(value) {
-  if (!isObjectRecord2(value)) {
+  if (!isObjectRecord5(value)) {
     return false;
   }
   for (const capability of ["prompts", "resources", "tools", "logging", "completions", "experimental"]) {
-    if (value[capability] !== void 0 && !isObjectRecord2(value[capability])) {
+    if (value[capability] !== void 0 && !isObjectRecord5(value[capability])) {
       return false;
     }
   }
   return true;
 }
 function isCallToolResult(value) {
-  if (!isObjectRecord2(value) || !Array.isArray(value.content)) {
+  if (!isObjectRecord5(value) || !Array.isArray(value.content)) {
     return false;
   }
   if (value.isError !== void 0 && typeof value.isError !== "boolean") {
@@ -9982,10 +10242,10 @@ function isCallToolResult(value) {
   return value.content.every(isContentItem);
 }
 function isToolsListResult(value) {
-  return isObjectRecord2(value) && Array.isArray(value.tools) && (value.nextCursor === void 0 || typeof value.nextCursor === "string");
+  return isObjectRecord5(value) && Array.isArray(value.tools) && (value.nextCursor === void 0 || typeof value.nextCursor === "string");
 }
 function isContentItem(value) {
-  if (!isObjectRecord2(value)) {
+  if (!isObjectRecord5(value)) {
     return false;
   }
   if (value.type === "text") {
@@ -9994,7 +10254,7 @@ function isContentItem(value) {
   if (value.type === "image" || value.type === "audio") {
     return typeof value.data === "string" && typeof value.mimeType === "string";
   }
-  if (value.type !== "resource" || !isObjectRecord2(value.resource)) {
+  if (value.type !== "resource" || !isObjectRecord5(value.resource)) {
     return false;
   }
   return typeof value.resource.uri === "string" && (value.resource.mimeType === void 0 || typeof value.resource.mimeType === "string") && (typeof value.resource.text === "string" || typeof value.resource.blob === "string");
@@ -10018,7 +10278,7 @@ function invalidRequest() {
   return new McpError(ERROR_INVALID_REQUEST, "Invalid Request");
 }
 function isJsonRpcErrorObject(value) {
-  if (!isObjectRecord2(value)) {
+  if (!isObjectRecord5(value)) {
     return false;
   }
   if (typeof value.code !== "number" || typeof value.message !== "string") {
@@ -10027,7 +10287,7 @@ function isJsonRpcErrorObject(value) {
   return value.data === void 0 || hasOwn(value, "data");
 }
 function parseJsonRpcPayload(parsed) {
-  if (!isObjectRecord2(parsed)) {
+  if (!isObjectRecord5(parsed)) {
     return {
       type: "invalid",
       id: null,
@@ -10354,7 +10614,11 @@ function convertObjectSchema(schema, root, options) {
       "properties",
       key2
     ]);
-    shape[key2] = requiredKeys.has(key2) ? convertedProperty : S.Optional(convertedProperty);
+    setOwnShapeProperty(
+      shape,
+      key2,
+      requiredKeys.has(key2) ? convertedProperty : S.Optional(convertedProperty)
+    );
   }
   return applyMetadata(
     S.Object(shape, {
@@ -10366,6 +10630,14 @@ function convertObjectSchema(schema, root, options) {
     }
   );
 }
+function setOwnShapeProperty(shape, key2, value) {
+  Object.defineProperty(shape, key2, {
+    configurable: true,
+    enumerable: true,
+    writable: true,
+    value
+  });
+}
 function createCommonOptions(schema, nullable, defaultValue) {
   return {
     ...schema.description === void 0 ? {} : { description: schema.description },
@@ -10616,6 +10888,9 @@ function resolveLocalRef(root, ref) {
     if (!isPlainObject(current)) {
       return void 0;
     }
+    if (!Object.prototype.hasOwnProperty.call(current, segment)) {
+      return void 0;
+    }
     current = current[segment];
   }
   return isPlainObject(current) ? current : void 0;
@@ -10855,8 +11130,7 @@ async function readCache(cachePath) {
       version: parsed.version === 1 ? 1 : 1
     };
   } catch (error3) {
-    const code = error3.code;
-    if (code === "ENOENT" || error3 instanceof SyntaxError) {
+    if (hasOwnErrorCode(error3, "ENOENT") || error3 instanceof SyntaxError) {
       return void 0;
     }
     return void 0;
@@ -10864,16 +11138,32 @@ async function readCache(cachePath) {
 }
 async function writeCache(cachePath, cache) {
   const directory = path12.dirname(cachePath);
-  const tempPath = `${cachePath}.tmp-${randomUUID2()}`;
+  const tempPath = `${cachePath}.tmp-${randomUUID4()}`;
+  let tempCreated = false;
   await assertCachePathHasNoSymlinks(cachePath);
   await assertCachePathHasNoSymlinks(tempPath);
   await mkdir(directory, { recursive: true });
   await assertCachePathHasNoSymlinks(directory);
-  await writeFile3(tempPath, `${JSON.stringify(cache, null, 2)}
-`);
-  await assertCachePathHasNoSymlinks(tempPath);
-  await assertCachePathHasNoSymlinks(cachePath);
-  await rename2(tempPath, cachePath);
+  try {
+    await writeFile3(tempPath, `${JSON.stringify(cache, null, 2)}
+`, {
+      encoding: "utf8",
+      flag: "wx"
+    });
+    tempCreated = true;
+    await assertCachePathHasNoSymlinks(tempPath);
+    await assertCachePathHasNoSymlinks(cachePath);
+    await rename2(tempPath, cachePath);
+    tempCreated = false;
+  } catch (error3) {
+    if (tempCreated || !isAlreadyExistsError2(error3)) {
+      await unlink2(tempPath).catch(() => void 0);
+    }
+    throw error3;
+  }
+}
+function isAlreadyExistsError2(error3) {
+  return hasOwnErrorCode(error3, "EEXIST");
 }
 async function fetchCache(name, config2) {
   const logger2 = createLogger((message2) => {
@@ -11077,7 +11367,7 @@ async function assertCachePathHasNoSymlinks(filePath) {
         throw new Error(`MCP cache path must not contain symbolic links: ${currentPath}.`);
       }
     } catch (error3) {
-      if (error3.code !== "ENOENT") {
+      if (!hasOwnErrorCode(error3, "ENOENT")) {
         throw error3;
       }
     }
@@ -11613,7 +11903,7 @@ async function writeErrorReport(context) {
   }
   const projectRoot = resolveProjectRoot(context.projectRoot);
   const reportDir = resolveReportDir(context.errorReports, projectRoot);
-  const fileName = `${formatTimestamp(/* @__PURE__ */ new Date())}-${slugifyCommandPath(context.commandPath)}-${randomUUID3()}.log`;
+  const fileName = `${formatTimestamp(/* @__PURE__ */ new Date())}-${slugifyCommandPath(context.commandPath)}-${randomUUID5()}.log`;
   const absolutePath = path13.join(reportDir, fileName);
   await mkdir2(reportDir, { recursive: true });
   if (reportDirMustStayWithinProject(context.errorReports)) {
@@ -12525,7 +12815,7 @@ function getJsonParseErrorLocation(error3, source) {
   return null;
 }
 function getJsonParseCauseLocation(error3) {
-  if (typeof error3 !== "object" || error3 === null || !("cause" in error3)) {
+  if (typeof error3 !== "object" || error3 === null || !hasOwnProperty3(error3, "cause")) {
     return null;
   }
   const cause = error3.cause;
@@ -12537,7 +12827,7 @@ function getJsonParseCauseLocation(error3) {
   return { line, column };
 }
 function getNumericProperty(value, key2) {
-  if (typeof value !== "object" || value === null || !(key2 in value)) {
+  if (typeof value !== "object" || value === null || !hasOwnProperty3(value, key2)) {
     return null;
   }
   const propertyValue = value[key2];
@@ -13092,10 +13382,10 @@ function renderHelpSections(sections) {
   return sections.filter((section) => section.length > 0).join("\n\n");
 }
 function formatHelpCommandList(rows) {
-  return process.stdout.isTTY === false ? help_formatter_plain_exports.formatCommandList(rows) : formatCommandList(rows);
+  return process.stdout.isTTY !== true ? help_formatter_plain_exports.formatCommandList(rows) : formatCommandList(rows);
 }
 function formatHelpOptionList(rows) {
-  return process.stdout.isTTY === false ? help_formatter_plain_exports.formatOptionList(rows) : formatOptionList(rows);
+  return process.stdout.isTTY !== true ? help_formatter_plain_exports.formatOptionList(rows) : formatOptionList(rows);
 }
 function buildUsageLine(breadcrumb, rootUsageName, suffix) {
   const visibleBreadcrumb = breadcrumb.filter((segment) => segment.length > 0);
@@ -13383,11 +13673,18 @@ function formatResolvedValue(value) {
 function fieldPromptLabel(field) {
   return field.positionalIndex === void 0 ? field.optionFlag : `<${field.displayPath}>`;
 }
+function enumOptionLabel(schema, value) {
+  const key2 = String(value);
+  if (schema.labels === void 0 || !Object.prototype.hasOwnProperty.call(schema.labels, key2)) {
+    return key2;
+  }
+  return schema.labels[key2] ?? key2;
+}
 async function promptForField(field) {
   const schema = field.schema;
   if (schema.kind === "enum") {
     const options = schema.loadOptions ? await schema.loadOptions() : schema.values.map((value) => ({
-      label: schema.labels?.[String(value)] ?? String(value),
+      label: enumOptionLabel(schema, value),
       value
     }));
     const selected = await select2({
@@ -13472,8 +13769,8 @@ async function withOutputFormat2(output, fn) {
 function createFs2() {
   return {
     readFile: async (path24, encoding = "utf8") => readFile4(path24, { encoding }),
-    writeFile: async (path24, contents) => {
-      await writeFile5(path24, contents);
+    writeFile: async (path24, contents, options) => {
+      await writeFile5(path24, contents, options);
     },
     exists: async (path24) => {
       try {
@@ -13485,7 +13782,7 @@ function createFs2() {
     },
     lstat: async (path24) => lstat3(path24),
     rename: async (fromPath, toPath) => rename3(fromPath, toPath),
-    unlink: async (path24) => unlink2(path24)
+    unlink: async (path24) => unlink3(path24)
   };
 }
 function createEnv2(values = process.env) {
@@ -13587,7 +13884,7 @@ async function loadPresetValues(fields, presetPath) {
       encoding: "utf8"
     });
   } catch (error3) {
-    if (typeof error3 === "object" && error3 !== null && "code" in error3 && error3.code === "ENOENT") {
+    if (hasOwnErrorCode(error3, "ENOENT")) {
       throw new UserError(`Preset file "${presetPath}" was not found.`);
     }
     const message2 = error3 instanceof Error && error3.message.length > 0 ? error3.message : "Unknown read error.";
@@ -14686,10 +14983,10 @@ function isHttpErrorLike(error3) {
   }
   const request = error3.request;
   const response = error3.response;
-  return isPlainObject4(request) && typeof request.method === "string" && typeof request.url === "string" && isStringRecord(request.headers) && isPlainObject4(response) && typeof response.status === "number" && typeof response.statusText === "string" && isStringRecord(response.headers) && "body" in response;
+  return isPlainObject4(request) && typeof request.method === "string" && typeof request.url === "string" && isStringRecord(request.headers) && isPlainObject4(response) && typeof response.status === "number" && typeof response.statusText === "string" && isStringRecord(response.headers) && hasOwnProperty3(response, "body");
 }
 function hasTypedOptionalField(value, field, type2) {
-  return !(field in value) || typeof value[field] === type2;
+  return !hasOwnProperty3(value, field) || typeof value[field] === type2;
 }
 function isNonEmptyString(value) {
   return typeof value === "string" && value.trim().length > 0;
@@ -14713,7 +15010,7 @@ function isProblemDetailsLike(body) {
   if (!hasTypedOptionalField(body, "instance", "string")) {
     return false;
   }
-  return isNonEmptyString(body.title) || isNonEmptyString(body.detail);
+  return hasOwnNonEmptyString(body, "title") || hasOwnNonEmptyString(body, "detail");
 }
 function isGraphQLErrorEnvelopeLike(body) {
   if (!isPlainObject4(body) || !Array.isArray(body.errors) || body.errors.length === 0) {
@@ -14723,44 +15020,50 @@ function isGraphQLErrorEnvelopeLike(body) {
     if (!isPlainObject4(error3) || typeof error3.message !== "string") {
       return false;
     }
-    if ("path" in error3) {
+    if (hasOwnProperty3(error3, "path")) {
       const pathValue = error3.path;
       if (!Array.isArray(pathValue) || !pathValue.every((entry) => typeof entry === "string" || typeof entry === "number")) {
         return false;
       }
     }
-    if ("extensions" in error3) {
+    if (hasOwnProperty3(error3, "extensions")) {
       if (!isPlainObject4(error3.extensions)) {
         return false;
       }
-      if ("code" in error3.extensions && typeof error3.extensions.code !== "string") {
+      if (hasOwnProperty3(error3.extensions, "code") && typeof error3.extensions.code !== "string") {
         return false;
       }
     }
     return true;
   });
 }
+function hasOwnProperty3(value, name) {
+  return Object.prototype.hasOwnProperty.call(value, name);
+}
+function hasOwnNonEmptyString(value, name) {
+  return hasOwnProperty3(value, name) && isNonEmptyString(value[name]);
+}
 function styleHttpErrorLine(value, style) {
-  return process.stdout.isTTY === false ? value : style(value);
+  return process.stdout.isTTY !== true ? value : style(value);
 }
 function formatHttpErrorStatus(value) {
   return styleHttpErrorLine(value, text.error);
 }
 function formatProblemDetailsBody(body) {
   const lines = [];
-  if (isNonEmptyString(body.title)) {
+  if (hasOwnNonEmptyString(body, "title")) {
     lines.push(`Problem: ${body.title}`);
   }
-  if (isNonEmptyString(body.detail)) {
+  if (hasOwnNonEmptyString(body, "detail")) {
     lines.push(`Detail:  ${body.detail}`);
   }
-  if (body.type !== void 0) {
+  if (hasOwnProperty3(body, "type") && body.type !== void 0) {
     lines.push(`Type:    ${body.type}`);
   }
-  if (body.instance !== void 0) {
+  if (hasOwnProperty3(body, "instance") && body.instance !== void 0) {
     lines.push(`Instance: ${body.instance}`);
   }
-  if (body.status !== void 0) {
+  if (hasOwnProperty3(body, "status") && body.status !== void 0) {
     lines.push(`Status:  ${body.status}`);
   }
   return lines.join("\n");
@@ -14768,10 +15071,10 @@ function formatProblemDetailsBody(body) {
 function formatGraphQLErrorEnvelopeBody(body) {
   return body.errors.map((error3) => {
     const lines = [`GraphQL error: ${error3.message}`];
-    if (error3.path !== void 0) {
+    if (hasOwnProperty3(error3, "path") && error3.path !== void 0) {
       lines.push(`  at path: ${error3.path.join(".")}`);
     }
-    if (error3.extensions?.code !== void 0) {
+    if (hasOwnProperty3(error3, "extensions") && error3.extensions !== void 0 && hasOwnProperty3(error3.extensions, "code") && error3.extensions.code !== void 0) {
       lines.push(`  code:    ${error3.extensions.code}`);
     }
     return lines.join("\n");
@@ -15223,7 +15526,7 @@ async function runCLI(roots, options = {}) {
 }
 
 // src/terminal-pilot.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 
 // src/terminal-session.ts
 import { EventEmitter } from "node:events";
@@ -15232,6 +15535,11 @@ import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import * as nodePty from "node-pty";
 
+// src/errors.ts
+function hasOwnErrorCode4(error3, code) {
+  return error3 instanceof Error && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === code;
+}
+
 // src/terminal-buffer.ts
 var RESET_SGR = "\x1B[0m";
 var DEC_SPECIAL_GRAPHICS = {
@@ -16331,10 +16639,7 @@ function ensureSpawnHelperExecutable() {
   }
 }
 function isMissingFileError(error3) {
-  if (!(error3 instanceof Error)) {
-    return false;
-  }
-  return "code" in error3 && error3.code === "ENOENT";
+  return hasOwnErrorCode4(error3, "ENOENT");
 }
 function matchPattern(buffer, pattern) {
   const clean = normalizeHistoryBuffer(stripAnsi(buffer));
@@ -16425,7 +16730,7 @@ var TerminalPilot = class _TerminalPilot {
   }
   async newSession(opts) {
     const session = new TerminalSession({
-      id: randomUUID4(),
+      id: randomUUID6(),
       command: opts.command,
       args: opts.args,
       cwd: opts.cwd,
@@ -16711,6 +17016,11 @@ var claudeCodeAgent = {
   aliases: ["claude"],
   binaryName: "claude",
   apiShapes: ["anthropic-messages"],
+  otelCapture: {
+    env: {
+      CLAUDE_CODE_ENABLE_TELEMETRY: "1"
+    }
+  },
   configPath: "~/.claude/settings.json",
   branding: {
     colors: {
@@ -16743,6 +17053,16 @@ var codexAgent = {
   summary: "Configure Codex to use Poe as the model provider.",
   binaryName: "codex",
   apiShapes: ["openai-responses"],
+  otelCapture: {
+    args: (endpoint, content) => [
+      "-c",
+      `otel.trace_exporter={"otlp-http"={endpoint=${JSON.stringify(`${endpoint}/v1/traces`)},protocol="json"}}`,
+      "-c",
+      `otel.exporter={"otlp-http"={endpoint=${JSON.stringify(`${endpoint}/v1/logs`)},protocol="json"}}`,
+      "-c",
+      `otel.log_user_prompt=${content}`
+    ]
+  },
   configPath: "~/.codex/config.toml",
   branding: {
     colors: {
@@ -16778,6 +17098,11 @@ var openCodeAgent = {
   summary: "Configure OpenCode CLI to use the Poe API.",
   binaryName: "opencode",
   apiShapes: ["openai-chat-completions"],
+  otelCapture: {
+    env: {
+      OPENCODE_CONFIG_CONTENT: '{"experimental":{"openTelemetry":true}}'
+    }
+  },
   configPath: "~/.config/opencode/config.json",
   branding: {
     colors: {
@@ -16813,6 +17138,7 @@ var gooseAgent = {
   summary: "Block's open-source AI agent with ACP support.",
   binaryName: "goose",
   apiShapes: ["openai-chat-completions"],
+  otelCapture: {},
   configPath: "~/.config/goose/config.yaml",
   branding: {
     colors: {
@@ -16846,6 +17172,12 @@ function freezeAgent(agent) {
   if (agent.apiShapes !== void 0) {
     Object.freeze(agent.apiShapes);
   }
+  if (agent.otelCapture?.env !== void 0) {
+    Object.freeze(agent.otelCapture.env);
+  }
+  if (agent.otelCapture !== void 0) {
+    Object.freeze(agent.otelCapture);
+  }
   Object.freeze(agent.branding.colors);
   Object.freeze(agent.branding);
   return Object.freeze(agent);
@@ -17009,6 +17341,7 @@ var templateMutation = {
 };
 
 // ../config-mutations/src/execution/apply-mutation.ts
+import { randomUUID as randomUUID7 } from "node:crypto";
 import path17 from "node:path";
 
 // ../config-mutations/src/formats/json.ts
@@ -17084,7 +17417,7 @@ function merge(base, patch) {
     if (value === void 0) {
       continue;
     }
-    const existing = result[key2];
+    const existing = hasConfigEntry(result, key2) ? result[key2] : void 0;
     if (isConfigObject(existing) && isConfigObject(value)) {
       setConfigEntry(result, key2, merge(existing, value));
       continue;
@@ -17212,7 +17545,7 @@ function merge2(base, patch) {
     if (value === void 0) {
       continue;
     }
-    const existing = result[key2];
+    const existing = hasConfigEntry(result, key2) ? result[key2] : void 0;
     if (isConfigObject2(existing) && isConfigObject2(value)) {
       setConfigEntry(result, key2, merge2(existing, value));
       continue;
@@ -17292,7 +17625,7 @@ function merge3(base, patch) {
     if (value === void 0) {
       continue;
     }
-    const existing = result[key2];
+    const existing = hasConfigEntry(result, key2) ? result[key2] : void 0;
     if (isConfigObject3(existing) && isConfigObject3(value)) {
       setConfigEntry(result, key2, merge3(existing, value));
       continue;
@@ -17427,9 +17760,14 @@ function resolvePath(rawPath, homeDir, pathMapper) {
   return filename.length === 0 ? mappedDirectory : path16.join(mappedDirectory, filename);
 }
 
+// ../config-mutations/src/error-codes.ts
+function hasOwnErrorCode5(error3, code) {
+  return typeof error3 === "object" && error3 !== null && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === code;
+}
+
 // ../config-mutations/src/fs-utils.ts
 function isNotFound(error3) {
-  return typeof error3 === "object" && error3 !== null && "code" in error3 && error3.code === "ENOENT";
+  return hasOwnErrorCode5(error3, "ENOENT");
 }
 async function readFileIfExists(fs4, target) {
   try {
@@ -17478,6 +17816,7 @@ async function backupInvalidDocument(context, targetPath, content) {
       return;
     } catch (error3) {
       if (!isAlreadyExists(error3)) {
+        await context.fs.unlink(backupPath).catch(() => void 0);
         throw error3;
       }
       attempt += 1;
@@ -17485,7 +17824,7 @@ async function backupInvalidDocument(context, targetPath, content) {
   }
 }
 function isAlreadyExists(error3) {
-  return Boolean(error3 && typeof error3 === "object" && "code" in error3 && error3.code === "EEXIST");
+  return hasOwnErrorCode5(error3, "EEXIST");
 }
 async function assertRegularWriteTarget(context, targetPath) {
   const boundary = path17.dirname(path17.resolve(context.homeDir));
@@ -17509,28 +17848,34 @@ async function assertRegularWriteTarget(context, targetPath) {
 }
 async function writeAtomically2(context, targetPath, content) {
   await assertRegularWriteTarget(context, targetPath);
-  let attempt = 0;
-  while (true) {
-    const tempPath = `${targetPath}.mutation-tmp-${attempt}`;
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    const tempPath = `${targetPath}.mutation-tmp-${process.pid}-${randomUUID7()}`;
+    let tempCreated = false;
     try {
+      await assertRegularWriteTarget(context, tempPath);
       await context.fs.writeFile(tempPath, content, { encoding: "utf8", flag: "wx" });
+      tempCreated = true;
       await context.fs.rename(tempPath, targetPath);
+      tempCreated = false;
       return;
     } catch (error3) {
-      if (isAlreadyExists(error3)) {
-        attempt += 1;
-        continue;
-      }
-      try {
-        await context.fs.unlink(tempPath);
-      } catch (cleanupError) {
-        if (!isNotFound(cleanupError)) {
-          void cleanupError;
+      const alreadyExists = isAlreadyExists(error3);
+      if (tempCreated || !alreadyExists) {
+        try {
+          await context.fs.unlink(tempPath);
+        } catch (cleanupError) {
+          if (!isNotFound(cleanupError)) {
+            void cleanupError;
+          }
         }
       }
+      if (alreadyExists) {
+        continue;
+      }
       throw error3;
     }
   }
+  throw new Error(`Unable to create temporary mutation file for ${targetPath}.`);
 }
 function describeMutation(kind, targetPath) {
   const displayPath = targetPath ?? "target";
@@ -17822,6 +18167,7 @@ async function applyBackup(mutation, context, options) {
         break;
       } catch (error3) {
         if (!isAlreadyExists(error3)) {
+          await context.fs.unlink(backupPath).catch(() => void 0);
           throw error3;
         }
         attempt += 1;
@@ -18205,6 +18551,11 @@ async function executeMutation(mutation, context, options) {
   }
 }
 
+// ../agent-skill-config/src/error-codes.ts
+function hasOwnErrorCode6(error3, code) {
+  return error3 instanceof Error && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === code;
+}
+
 // ../agent-skill-config/src/templates.ts
 import { readFile as readFile5, stat } from "node:fs/promises";
 import path18 from "node:path";
@@ -18229,7 +18580,7 @@ async function pathExists2(fs4, targetPath) {
     await fs4.stat(targetPath);
     return true;
   } catch (error3) {
-    if (error3 && typeof error3 === "object" && "code" in error3 && error3.code === "ENOENT") {
+    if (hasOwnErrorCode6(error3, "ENOENT")) {
       return false;
     }
     throw error3;
@@ -18288,12 +18639,13 @@ import path19 from "node:path";
 
 // ../agent-skill-config/src/git-exclude.ts
 import { execFileSync } from "node:child_process";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import * as fs2 from "node:fs";
 import path20 from "node:path";
 
 // ../agent-skill-config/src/bridge-active-skills.ts
 import * as fs3 from "node:fs";
-import { createHash as createHash4, randomUUID as randomUUID5 } from "node:crypto";
+import { createHash as createHash4, randomUUID as randomUUID9 } from "node:crypto";
 import path21 from "node:path";
 
 // src/commands/installer.ts
@@ -18306,7 +18658,7 @@ var DEFAULT_INSTALL_SCOPE = "local";
 var TERMINAL_PILOT_SKILL_NAME = "terminal-pilot";
 var installableAgents = supportedAgents;
 function isNotFoundError2(error3) {
-  return typeof error3 === "object" && error3 !== null && "code" in error3 && error3.code === "ENOENT";
+  return hasOwnErrorCode4(error3, "ENOENT");
 }
 function resolveInstallerServices(installer) {
   return {
@@ -18537,7 +18889,7 @@ var resize = defineCommand({
 });
 
 // ../terminal-png/src/index.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID10 } from "node:crypto";
 import { rename as rename4, rm, writeFile as writeFile6 } from "node:fs/promises";
 
 // ../terminal-png/src/ansi-parser.ts
@@ -18924,6 +19276,11 @@ function parseAnsi2(input) {
   return buildRuns(lines, lineBreakStyles);
 }
 
+// ../terminal-png/src/error-codes.ts
+function hasOwnErrorCode7(error3, code) {
+  return typeof error3 === "object" && error3 !== null && Object.prototype.hasOwnProperty.call(error3, "code") && error3.code === code;
+}
+
 // ../terminal-png/src/png-renderer.ts
 import { Resvg } from "@resvg/resvg-js";
 
@@ -19477,21 +19834,28 @@ async function renderTerminalPng(ansiText, options = {}) {
   });
   const png = renderPng(svg);
   if (options.output) {
-    const temporaryPath = `${options.output}.${randomUUID6()}.tmp`;
+    const temporaryPath = `${options.output}.${randomUUID10()}.tmp`;
+    let temporaryCreated = false;
     try {
       await writeFile6(temporaryPath, png, { flag: "wx" });
+      temporaryCreated = true;
       await rename4(temporaryPath, options.output);
     } catch (error3) {
-      try {
-        await rm(temporaryPath, { force: true });
-      } catch (cleanupError) {
-        void cleanupError;
+      if (temporaryCreated || !isAlreadyExistsError3(error3)) {
+        try {
+          await rm(temporaryPath, { force: true });
+        } catch (cleanupError) {
+          void cleanupError;
+        }
       }
       throw error3;
     }
   }
   return png;
 }
+function isAlreadyExistsError3(error3) {
+  return error3 instanceof Error && hasOwnErrorCode7(error3, "EEXIST");
+}
 
 // src/commands/screenshot.ts
 var params11 = S.Object({
@@ -19554,7 +19918,7 @@ var type = defineCommand({
 });
 
 // src/commands/uninstall.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID11 } from "node:crypto";
 var params14 = S.Object({
   agent: S.Enum(installableAgents, {
     description: "Agent to uninstall terminal-pilot from",
@@ -19590,7 +19954,7 @@ var uninstall = defineCommand({
         if (!await folderExists(services.fs, skill.fullPath)) {
           continue;
         }
-        const stagingPath = `${skill.fullPath}.removing-${randomUUID7()}`;
+        const stagingPath = `${skill.fullPath}.removing-${randomUUID11()}`;
         await services.fs.rename(skill.fullPath, stagingPath);
         staged.push({ ...skill, stagingPath });
       }
@@ -19616,7 +19980,7 @@ async function folderExists(fs4, folderPath) {
     await fs4.stat(folderPath);
     return true;
   } catch (error3) {
-    if (typeof error3 === "object" && error3 !== null && "code" in error3 && error3.code === "ENOENT") {
+    if (hasOwnErrorCode4(error3, "ENOENT")) {
       return false;
     }
     throw error3;
@@ -19670,8 +20034,6 @@ var waitForExit2 = defineCommand({
 
 // src/commands/index.ts
 var children = [
-  install,
-  uninstall,
   createSession,
   fill,
   type,
@@ -19685,7 +20047,9 @@ var children = [
   resize,
   closeSession,
   getSession,
-  listSessions
+  listSessions,
+  install,
+  uninstall
 ];
 function createTerminalPilotGroup() {
   return defineGroup({
@@ -19708,7 +20072,7 @@ async function main(argv = process.argv) {
   const originalArgv = process.argv;
   process.argv = normalizeArgv(argv);
   try {
-    await runCLI(createTerminalPilotGroup());
+    await runCLI(createTerminalPilotGroup(), { approvals: false });
   } finally {
     process.argv = originalArgv;
   }