@ariobarin/glossa 0.1.0-beta.10 → 0.1.0-beta.11

package/dist/app.js

@@ -239,6 +239,21 @@ var SessionExpiredError = class extends Error {
     this.name = "SessionExpiredError";
   }
 };
+function accessTokenSubject(credentials) {
+  try {
+    const parts = credentials.accessToken.split(".");
+    if (parts.length !== 3) throw new Error();
+    const payload = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString("utf8")
+    );
+    if (typeof payload.sub !== "string" || payload.sub.length === 0) {
+      throw new Error();
+    }
+    return payload.sub;
+  } catch {
+    throw new Error("Glossa could not identify the signed-in account.");
+  }
+}
 function sessionExpiredError() {
   return new SessionExpiredError();
 }
@@ -500,29 +515,164 @@ function credentialsMatchLoginOptions(credentials, options) {
     Boolean(credentials.refreshToken)
   );
 }
-async function ensureSignedIn(options, dependencies = {}) {
+async function signedInSession(options, dependencies = {}) {
   const load = dependencies.loadCredentials ?? loadCredentials;
   const validate = dependencies.validCredentials ?? validCredentials;
   const login = dependencies.loginWithDeviceFlow ?? loginWithDeviceFlow;
   const loaded = await load();
   if (loaded && credentialsMatchLoginOptions(loaded.credentials, options)) {
     try {
-      await validate(
+      const credentials = await validate(
         loaded.credentials,
         options.signal ? { signal: options.signal } : {}
       );
-      return false;
+      return { credentials, loginPerformed: false };
     } catch (error46) {
       if (!(error46 instanceof SessionExpiredError)) throw error46;
     }
   }
   await login(options);
-  return true;
+  const completed = await load();
+  if (!completed) throw new Error("Glossa could not load the completed login.");
+  return {
+    credentials: await validate(
+      completed.credentials,
+      options.signal ? { signal: options.signal } : {}
+    ),
+    loginPerformed: true
+  };
 }
 
 // src/cli-options.ts
-import { existsSync } from "node:fs";
-import path3 from "node:path";
+var UsageError = class extends Error {
+};
+function parseWorkspace(args) {
+  let selectedPath;
+  let optionsEnded = false;
+  for (const argument of args) {
+    if (!optionsEnded && argument === "--") {
+      optionsEnded = true;
+    } else if (!optionsEnded && argument.startsWith("-")) {
+      throw new UsageError(`Unknown option: ${argument}`);
+    } else if (selectedPath) {
+      throw new UsageError("Glossa accepts at most one directory.");
+    } else {
+      selectedPath = argument;
+    }
+  }
+  return {
+    command: "workspace",
+    ...selectedPath ? { path: selectedPath } : {}
+  };
+}
+function parseJsonOption(command, args) {
+  if (args.length === 0) return false;
+  if (args.length === 1 && args[0] === "--json") return true;
+  throw new UsageError(`${command} accepts only --json.`);
+}
+function parseDevices(args) {
+  if (args.length === 0 || args.length === 1 && args[0] === "--json") {
+    return {
+      command: "devices",
+      action: "list",
+      json: parseJsonOption("Devices", args)
+    };
+  }
+  if (args[0] === "revoke" && args.length === 2) {
+    return { command: "devices", action: "revoke", deviceId: args[1] };
+  }
+  throw new UsageError("Use: glossa devices [--json] or glossa devices revoke <id>.");
+}
+function noOptions(command, args) {
+  if (args.length > 0) throw new UsageError(`${command} accepts no options.`);
+}
+function parseInvocation(args) {
+  const [command, ...options] = args;
+  if (!command) return parseWorkspace([]);
+  if (command === "--help" || command === "-h") {
+    noOptions("Help", options);
+    return { command: "help" };
+  }
+  if (command === "--version" || command === "-v") {
+    noOptions("Version", options);
+    return { command: "version" };
+  }
+  if (command === "--") return parseWorkspace(args);
+  if (options.includes("--help") || options.includes("-h")) {
+    return { command: "help" };
+  }
+  if (command === "status") {
+    return { command, json: parseJsonOption("Status", options) };
+  }
+  if (command === "devices") return parseDevices(options);
+  if (command === "update" || command === "login" || command === "logout") {
+    noOptions(command[0].toUpperCase() + command.slice(1), options);
+    return { command };
+  }
+  return parseWorkspace(args);
+}
+
+// src/device-format.ts
+function deviceStatus(device) {
+  if (device.revokedAt) return "revoked";
+  if (device.activeWorkers === null) return "worker count unavailable";
+  if (device.activeWorkers === 0) return "offline";
+  return `${device.activeWorkers} active ${device.activeWorkers === 1 ? "worker" : "workers"}`;
+}
+function formatRelativeTime(iso, now = Date.now()) {
+  if (!iso) return "never";
+  const parsed = Date.parse(iso);
+  if (!Number.isFinite(parsed)) return "unknown";
+  const seconds = Math.max(0, Math.round((now - parsed) / 1e3));
+  if (seconds < 60) return "just now";
+  const minutes = Math.round(seconds / 60);
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  const days = Math.round(hours / 24);
+  return `${days}d ago`;
+}
+function formatDeviceRow(device, now = Date.now()) {
+  const platform = device.platform ?? "unknown platform";
+  return `${device.id}  ${device.name}  ${platform}  last seen ${formatRelativeTime(device.lastSeenAt, now)}  ${deviceStatus(device)}`;
+}
+
+// src/logout.ts
+function browserLogoutUrl(issuer) {
+  return new URL(
+    "v2/logout",
+    issuer.endsWith("/") ? issuer : `${issuer}/`
+  ).toString();
+}
+async function logoutFromGlossa(dependencies = {}) {
+  const remove = dependencies.deleteCredentials ?? deleteCredentials;
+  const peek = dependencies.peekCredentials ?? peekCredentials;
+  const browse = dependencies.openBrowser ?? openBrowser;
+  const log = dependencies.log ?? console.log;
+  let stored = null;
+  let present = true;
+  try {
+    stored = await peek();
+    present = stored !== null;
+  } catch {
+  }
+  const issuer = dependencies.issuer ?? stored?.credentials.issuer;
+  await remove();
+  log(
+    present ? "Signed out of Glossa." : "Already signed out of Glossa."
+  );
+  const url2 = browserLogoutUrl(issuer ?? loadAuthConfig().issuer);
+  const opened = await browse(url2);
+  if (opened) {
+    log("Opened Glossa browser sign-out.");
+  } else {
+    log("Open this URL to finish signing out in your browser:");
+    log(url2);
+  }
+}
+
+// src/relay-client.ts
+import os2 from "node:os";
 
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -1255,10 +1405,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path8) {
-  if (!path8)
+function getElementAtPath(obj, path7) {
+  if (!path7)
     return obj;
-  return path8.reduce((acc, key) => acc?.[key], obj);
+  return path7.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1619,11 +1769,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path8, issues) {
+function prefixIssues(path7, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path8);
+    iss.path.unshift(path7);
     return iss;
   });
 }
@@ -1785,7 +1935,7 @@ function formatError(error46, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error46, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error47, path8 = []) => {
+  const processError = (error47, path7 = []) => {
     var _a, _b;
     for (const issue2 of error47.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -1795,7 +1945,7 @@ function treeifyError(error46, mapper = (issue2) => issue2.message) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path8, ...issue2.path];
+        const fullpath = [...path7, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1827,8 +1977,8 @@ function treeifyError(error46, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path8 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path8) {
+  const path7 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path7) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -13170,472 +13320,7 @@ var workerResultSchema = external_exports.object({
   }).optional()
 });
 
-// src/completions.ts
-var SUPPORTED_SHELLS = ["powershell", "bash", "zsh", "fish"];
-var commands = [
-  "ui",
-  "start",
-  "status",
-  "doctor",
-  "devices",
-  "completions",
-  "update",
-  "upgrade",
-  "login",
-  "logout"
-];
-function powershellScript() {
-  const list = commands.map((command) => `'${command}'`).join(", ");
-  return `# PowerShell completion for Glossa. Source it from your PowerShell profile.
-Register-ArgumentCompleter -Native -CommandName glossa -ScriptBlock {
-    param($wordToComplete, $commandAst, $cursorPosition)
-    $commands = @(${list})
-    $elements = $commandAst.CommandElements
-    $last = $elements[$elements.Count - 1]
-    # Position of the argument being completed (1 = first argument after glossa).
-    # A trailing space starts a new argument; otherwise we complete the last token.
-    if ($cursorPosition -gt $last.Extent.EndOffset) {
-        $position = $elements.Count
-    } else {
-        $position = $elements.Count - 1
-    }
-    if ($position -eq 1) {
-        @($commands + '--help' + '--version') |
-            Where-Object { $_ -like "$wordToComplete*" } |
-            ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_) }
-        return
-    }
-    $command = $elements[1].Value
-    if ($wordToComplete -like '-*') {
-        switch ($command) {
-            'ui' {
-                @('--allow-broad-root', '--device-name') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-            }
-            'start' {
-                @('--allow-broad-root', '--device-name') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-            }
-            'status' {
-                @('--json') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-            }
-            'doctor' {
-                @('--json') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-            }
-            'devices' {
-                if ($position -eq 3 -and $elements[2].Value -eq 'list') {
-                    @('--json') | Where-Object { $_ -like "$wordToComplete*" } |
-                        ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-                }
-            }
-            'logout' {
-                @('--browser') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-            }
-        }
-        return
-    }
-    if ($position -eq 2) {
-        switch ($command) {
-            'devices' {
-                @('list', 'rename', 'revoke') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_) }
-            }
-            'completions' {
-                @('powershell', 'bash', 'zsh', 'fish') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_) }
-            }
-        }
-    }
-}
-`;
-}
-function bashScript() {
-  return `# Bash completion for Glossa. Source it or install under /etc/bash_completion.d.
-_glossa() {
-  local cur="\${COMP_WORDS[COMP_CWORD]}"
-  if [ "$COMP_CWORD" -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "${commands.join(" ")} --help --version" -- "$cur") )
-    return
-  fi
-  local cmd="\${COMP_WORDS[1]}"
-  if [[ "$cur" == -* ]]; then
-    case "$cmd" in
-      ui|start) COMPREPLY=( $(compgen -W "--allow-broad-root --device-name" -- "$cur") ) ;;
-      status|doctor) COMPREPLY=( $(compgen -W "--json" -- "$cur") ) ;;
-      devices)
-        if [ "$COMP_CWORD" -eq 3 ] && [ "\${COMP_WORDS[2]}" = "list" ]; then
-          COMPREPLY=( $(compgen -W "--json" -- "$cur") )
-        fi ;;
-      logout) COMPREPLY=( $(compgen -W "--browser" -- "$cur") ) ;;
-    esac
-    return
-  fi
-  case "$cmd" in
-    devices)
-      if [ "$COMP_CWORD" -eq 2 ]; then
-        COMPREPLY=( $(compgen -W "list rename revoke" -- "$cur") )
-      fi ;;
-    completions)
-      if [ "$COMP_CWORD" -eq 2 ]; then
-        COMPREPLY=( $(compgen -W "powershell bash zsh fish" -- "$cur") )
-      fi ;;
-    ui|start) ;; # workspace directory: fall through to filename completion
-  esac
-}
-# -o default lets readline fall back to filename completion for workspace paths
-# when the completion function produces no matches.
-complete -o default -F _glossa glossa
-`;
-}
-function zshScript() {
-  return `# Zsh completion for Glossa. Source this after compinit from your profile.
-_glossa() {
-  local context state state_descr line
-  typeset -A opt_args
-  local -a glossa_commands
-  glossa_commands=(
-    'ui:open the interactive session HUD'
-    'start:expose a workspace'
-    'status:show account, relay, and active workers'
-    'doctor:check local and relay readiness'
-    'devices:manage enrolled computers'
-    'completions:emit a shell completion script'
-    'update:update the current Glossa installation'
-    'upgrade:alias for update'
-    'login:ensure a Glossa session'
-    'logout:remove local credentials'
-  )
-  _arguments -C '1:command or workspace:->commands' '*::argument:->args'
-  case "$state" in
-    commands)
-      _describe 'glossa command' glossa_commands
-      _files
-      ;;
-    args)
-      case $words[2] in
-        devices)
-          if (( CURRENT == 3 )); then
-            _values 'device action' list rename revoke
-          elif [[ $words[3] == list ]]; then
-            _arguments '--json[print machine-readable JSON]'
-          fi
-          ;;
-        completions) _arguments '2:shell:(powershell bash zsh fish)' ;;
-        ui|start)
-          _arguments             '--allow-broad-root[allow home or drive roots]'             '--device-name[name this computer on first enrollment]:device name:'             '2:workspace:_directories'
-          ;;
-        status|doctor) _arguments '--json[print machine-readable JSON]' ;;
-        logout) _arguments '--browser[also sign out of the browser session]' ;;
-      esac
-      ;;
-  esac
-}
-compdef _glossa glossa
-`;
-}
-function fishScript() {
-  const lines = [
-    "# Fish completion for Glossa. Source it or drop into ~/.config/fish/completions.",
-    // No global -f: the first argument may be a workspace directory, so fish
-    // should still offer files there.
-    ...commands.map(
-      (command) => `complete -c glossa -n '__fish_use_subcommand' -a '${command}'`
-    ),
-    "complete -c glossa -f -n '__fish_seen_subcommand_from devices; and test (count (commandline -opc)) -eq 2' -a 'list rename revoke'",
-    "complete -c glossa -f -n '__fish_seen_subcommand_from completions; and test (count (commandline -opc)) -eq 2' -a 'powershell bash zsh fish'",
-    "complete -c glossa -n '__fish_seen_subcommand_from ui start' -l allow-broad-root",
-    "complete -c glossa -n '__fish_seen_subcommand_from ui start' -l device-name -r",
-    "complete -c glossa -n '__fish_seen_subcommand_from status doctor' -l json",
-    "complete -c glossa -n '__fish_seen_subcommand_from devices; and contains -- list (commandline -opc)' -l json",
-    "complete -c glossa -n '__fish_seen_subcommand_from logout' -l browser",
-    ""
-  ];
-  return lines.join("\n");
-}
-function completionScript(shell) {
-  switch (shell) {
-    case "powershell":
-      return powershellScript();
-    case "bash":
-      return bashScript();
-    case "zsh":
-      return zshScript();
-    case "fish":
-      return fishScript();
-  }
-}
-
-// src/cli-options.ts
-var UsageError = class extends Error {
-};
-var helpTopics = /* @__PURE__ */ new Set([
-  "ui",
-  "start",
-  "status",
-  "doctor",
-  "devices",
-  "completions",
-  "update",
-  "login",
-  "logout"
-]);
-function parseDeviceName(value) {
-  const parsed = deviceNameSchema.safeParse(value);
-  if (!parsed.success) {
-    throw new UsageError(
-      "Device names must be 1 to 80 characters with no control characters."
-    );
-  }
-  return parsed.data;
-}
-function parseWorkspaceCommand(command, args) {
-  if (args.includes("--help") || args.includes("-h")) {
-    return { command: "help", topic: command };
-  }
-  let selectedPath;
-  let allowBroadRoot = false;
-  let deviceName;
-  let optionsEnded = false;
-  for (let index = 0; index < args.length; index += 1) {
-    const argument = args[index];
-    if (!optionsEnded && argument === "--") {
-      optionsEnded = true;
-    } else if (!optionsEnded && argument === "--allow-broad-root") {
-      allowBroadRoot = true;
-    } else if (!optionsEnded && argument === "--device-name") {
-      const value = args[index + 1];
-      if (value === void 0 || value.startsWith("-")) {
-        throw new UsageError("--device-name requires a value.");
-      }
-      deviceName = parseDeviceName(value);
-      index += 1;
-    } else if (!optionsEnded && argument.startsWith("--device-name=")) {
-      deviceName = parseDeviceName(argument.slice("--device-name=".length));
-    } else if (!optionsEnded && argument.startsWith("-")) {
-      throw new UsageError(`Unknown ${command} option: ${argument}`);
-    } else if (selectedPath) {
-      throw new UsageError(`${command === "ui" ? "UI" : "Start"} accepts at most one directory.`);
-    } else {
-      selectedPath = argument;
-    }
-  }
-  return {
-    command,
-    ...selectedPath ? { path: selectedPath } : {},
-    allowBroadRoot,
-    ...deviceName ? { deviceName } : {}
-  };
-}
-function singleJsonOption(command, args) {
-  if (args.length === 0) return false;
-  if (args.length === 1 && args[0] === "--json") return true;
-  throw new UsageError(`${command} accepts only --json.`);
-}
-function parseDevices(args) {
-  const [action, ...options] = args;
-  if (!action || action === "--help" || action === "-h") {
-    return { command: "help", topic: "devices" };
-  }
-  if (action === "list") {
-    return { command: "devices", action, json: singleJsonOption("Devices list", options) };
-  }
-  if (action === "rename" && options.length === 2) {
-    return { command: "devices", action, deviceId: options[0], name: options[1] };
-  }
-  if (action === "revoke" && options.length === 1) {
-    return { command: "devices", action, deviceId: options[0] };
-  }
-  throw new UsageError("Use: glossa devices list, rename <id> <name>, or revoke <id>.");
-}
-function likelyDirectory(value) {
-  return value === "." || value === ".." || path3.isAbsolute(value) || value.includes("/") || value.includes("\\") || existsSync(value);
-}
-var KNOWN_COMMANDS = [
-  "ui",
-  "start",
-  "status",
-  "doctor",
-  "devices",
-  "completions",
-  "update",
-  "upgrade",
-  "login",
-  "logout"
-];
-function editDistance(a, b) {
-  const m = a.length;
-  const n = b.length;
-  if (m === 0) return n;
-  if (n === 0) return m;
-  let previous = Array.from({ length: n + 1 }, (_, index) => index);
-  for (let i = 1; i <= m; i += 1) {
-    const current = [i];
-    for (let j = 1; j <= n; j += 1) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      current[j] = Math.min(
-        previous[j] + 1,
-        current[j - 1] + 1,
-        previous[j - 1] + cost
-      );
-    }
-    previous = current;
-  }
-  return previous[n];
-}
-function suggestCommand(input) {
-  const lower = input.toLowerCase();
-  if (lower.length >= 3) {
-    const prefixMatches = KNOWN_COMMANDS.filter((command) => command.startsWith(lower));
-    if (prefixMatches.length === 1) return prefixMatches[0];
-  }
-  let best;
-  let bestDistance = Infinity;
-  for (const command of KNOWN_COMMANDS) {
-    const distance = editDistance(lower, command);
-    if (distance < bestDistance) {
-      bestDistance = distance;
-      best = command;
-    }
-  }
-  if (best && bestDistance <= 3 && bestDistance <= Math.ceil(lower.length / 2)) {
-    return best;
-  }
-  return void 0;
-}
-function parseInvocation(args) {
-  const [command, ...options] = args;
-  if (!command) return parseWorkspaceCommand("start", []);
-  if (command === "--help" || command === "-h") {
-    if (options.length > 0) throw new UsageError("Help accepts one command name.");
-    return { command: "help" };
-  }
-  if (command === "help") {
-    if (options.length > 1) throw new UsageError("Help accepts one command name.");
-    const topic = options[0];
-    if (!topic) return { command: "help" };
-    if (!helpTopics.has(topic)) {
-      throw new UsageError(`Unknown help topic: ${topic}`);
-    }
-    return { command: "help", topic };
-  }
-  if (command === "--version" || command === "-v") {
-    if (options.length > 0) throw new UsageError("Version accepts no arguments.");
-    return { command: "version" };
-  }
-  if (command === "ui") return parseWorkspaceCommand("ui", options);
-  if (command === "start") return parseWorkspaceCommand("start", options);
-  if (command === "status") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "status" };
-    }
-    return { command: "status", json: singleJsonOption("Status", options) };
-  }
-  if (command === "doctor") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "doctor" };
-    }
-    return { command: "doctor", json: singleJsonOption("Doctor", options) };
-  }
-  if (command === "devices") return parseDevices(options);
-  if (command === "completions") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "completions" };
-    }
-    if (options.length !== 1) {
-      throw new UsageError("Use: glossa completions <shell>.");
-    }
-    const shell = options[0];
-    if (!SUPPORTED_SHELLS.includes(shell)) {
-      throw new UsageError(
-        `Unsupported shell: ${shell}. Use one of: ${SUPPORTED_SHELLS.join(", ")}.`
-      );
-    }
-    return { command: "completions", shell };
-  }
-  if (command === "update" || command === "upgrade") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "update" };
-    }
-    if (options.length > 0) {
-      throw new UsageError(`${command === "update" ? "Update" : "Upgrade"} accepts no arguments.`);
-    }
-    return { command: "update" };
-  }
-  if (command === "login") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "login" };
-    }
-    if (options.length > 0) throw new UsageError("Login accepts no arguments.");
-    return { command: "login" };
-  }
-  if (command === "logout") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "logout" };
-    }
-    if (options.length === 0) return { command: "logout", browser: false };
-    if (options.length === 1 && options[0] === "--browser") {
-      return { command: "logout", browser: true };
-    }
-    throw new UsageError("Logout accepts only --browser.");
-  }
-  if (command === "--") return parseWorkspaceCommand("start", options);
-  if (command.startsWith("-")) return parseWorkspaceCommand("start", args);
-  if (likelyDirectory(command)) return parseWorkspaceCommand("start", args);
-  const suggestion = suggestCommand(command);
-  throw new UsageError(
-    suggestion ? `Unknown command: ${command}. Did you mean "${suggestion}"?` : `Unknown command: ${command}`
-  );
-}
-
-// src/device-store.ts
-import path4 from "node:path";
-var FILE_DEVICE_WARNING = "Warning: the operating-system credential store is unavailable. Glossa is using a mode-0600 device credential file.";
-function parseDeviceCredential(value) {
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    throw new Error("Stored Glossa device credentials are invalid.");
-  }
-  let relayOriginValid = false;
-  if (typeof parsed.relayOrigin === "string") {
-    try {
-      relayOriginValid = new URL(parsed.relayOrigin).origin === parsed.relayOrigin;
-    } catch {
-      relayOriginValid = false;
-    }
-  }
-  if (!relayOriginValid || typeof parsed.deviceId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
-    parsed.deviceId
-  ) || typeof parsed.deviceName !== "string" || parsed.deviceName.length === 0 || typeof parsed.token !== "string" || !parsed.token.startsWith(`gld_${parsed.deviceId}_`)) {
-    throw new Error("Stored Glossa device credentials are invalid.");
-  }
-  return parsed;
-}
-var store2 = new SecureStore({
-  account: "device",
-  file: path4.join(configDirectory(), "device.json"),
-  warning: FILE_DEVICE_WARNING,
-  parse: parseDeviceCredential
-});
-async function loadDeviceCredential() {
-  return (await store2.load())?.value ?? null;
-}
-async function peekDeviceCredential() {
-  return (await store2.peek())?.value ?? null;
-}
-async function saveDeviceCredential(credential) {
-  await store2.save(credential);
-}
-async function deleteDeviceCredential() {
-  await store2.delete();
-}
-
 // src/relay-client.ts
-import os2 from "node:os";
 var DEFAULT_RELAY_ORIGIN = "https://mcp.glossa.sh";
 function isLoopback(hostname3) {
   return hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "[::1]";
@@ -13686,7 +13371,9 @@ function relayError(status, data) {
     );
   }
   if (status === 409 && data.error === "device_name_conflict") {
-    return new Error("A Glossa device already uses this name. Run glossa devices list, then rename or revoke the old device.");
+    return new Error(
+      "Glossa could not choose a unique name for this computer. Try again."
+    );
   }
   if (status === 404 && data.error === "device_not_found") {
     return new Error("The Glossa device was not found.");
@@ -13733,44 +13420,48 @@ async function accountOwnsDevice(endpoints, credentials, deviceId, fetchRequest
   );
 }
 async function enrollDevice(endpoints, credentials, deviceName, fetchRequest = fetch) {
-  const name = deviceNameSchema.parse(deviceName);
-  const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/enroll`, {
-    method: "POST",
-    headers: {
-      authorization: `${credentials.tokenType} ${credentials.accessToken}`,
-      "content-type": "application/json"
-    },
-    body: JSON.stringify({ name, platform: `${process.platform}-${process.arch}` })
-  });
-  let data = {};
-  try {
-    data = await response.json();
-  } catch {
-  }
-  if (!response.ok) throw relayError(response.status, data);
-  if (typeof data.device?.id !== "string" || typeof data.device.name !== "string" || typeof data.device_token !== "string") {
-    throw new Error("The Glossa relay returned an invalid device enrollment response.");
+  const baseName = deviceNameSchema.parse(deviceName);
+  let name = baseName;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/enroll`, {
+      method: "POST",
+      headers: {
+        authorization: `${credentials.tokenType} ${credentials.accessToken}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ name, platform: `${process.platform}-${process.arch}` })
+    });
+    let data = {};
+    try {
+      data = await response.json();
+    } catch {
+    }
+    if (response.status === 409 && data.error === "device_name_conflict" && attempt < 2) {
+      const activeNames = new Set(
+        (await listDevices(endpoints, credentials, fetchRequest)).filter((device) => device.revokedAt === null).map((device) => device.name)
+      );
+      for (let suffix = 2; ; suffix += 1) {
+        const ending = `-${suffix}`;
+        const candidate = `${baseName.slice(0, 80 - ending.length)}${ending}`;
+        if (!activeNames.has(candidate)) {
+          name = deviceNameSchema.parse(candidate);
+          break;
+        }
+      }
+      continue;
+    }
+    if (!response.ok) throw relayError(response.status, data);
+    if (typeof data.device?.id !== "string" || typeof data.device.name !== "string" || typeof data.device_token !== "string") {
+      throw new Error("The Glossa relay returned an invalid device enrollment response.");
+    }
+    return {
+      relayOrigin: endpoints.relayOrigin,
+      deviceId: data.device.id,
+      deviceName: data.device.name,
+      token: data.device_token
+    };
   }
-  return {
-    relayOrigin: endpoints.relayOrigin,
-    deviceId: data.device.id,
-    deviceName: data.device.name,
-    token: data.device_token
-  };
-}
-async function renameDevice(endpoints, credentials, deviceId, name, fetchRequest = fetch) {
-  const validName = deviceNameSchema.parse(name);
-  const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/${encodeURIComponent(deviceId)}`, {
-    method: "PATCH",
-    headers: {
-      authorization: `${credentials.tokenType} ${credentials.accessToken}`,
-      "content-type": "application/json"
-    },
-    body: JSON.stringify({ name: validName })
-  });
-  const data = await response.json().catch(() => ({}));
-  if (!response.ok) throw relayError(response.status, data);
-  return parseDevices2([data.device])[0];
+  throw new Error("Glossa could not enroll this computer.");
 }
 async function revokeDevice(endpoints, credentials, deviceId, fetchRequest = fetch) {
   const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/${encodeURIComponent(deviceId)}`, {
@@ -13785,258 +13476,605 @@ async function revokeDevice(endpoints, credentials, deviceId, fetchRequest = fet
   }
 }
 
-// src/runtime.ts
-function isStandaloneExecutable(value = true ? false : false) {
-  if (typeof value === "boolean") return value;
-  if (!value || typeof value !== "object") return false;
-  return value.isStandaloneExecutable === true;
-}
-
-// src/doctor.ts
-var MIN_NODE_MAJOR = 22;
-var MIN_NODE_MINOR = 9;
-var HEALTHZ_TIMEOUT_MS = 5e3;
-function nodeVersionSatisfies(version2) {
-  const match = /^v?(\d+)\.(\d+)/.exec(version2.trim());
-  if (!match) return false;
-  const major = Number(match[1]);
-  const minor = Number(match[2]);
-  if (!Number.isInteger(major) || !Number.isInteger(minor)) return false;
-  return major > MIN_NODE_MAJOR || major === MIN_NODE_MAJOR && minor >= MIN_NODE_MINOR;
-}
-async function runDoctorChecks(dependencies = {}) {
-  const standalone = dependencies.standalone ?? isStandaloneExecutable();
-  const checks = [];
-  if (standalone) {
-    const runtimeReady = await (dependencies.probeStandaloneRuntime ?? defaultProbeStandaloneRuntime)();
-    checks.push({
-      name: "Runtime",
-      status: runtimeReady ? "pass" : "fail",
-      detail: runtimeReady ? "Self-contained Glossa executable." : "The executable is missing its native credential module.",
-      ...runtimeReady ? {} : { nextStep: "Reinstall Glossa with npm or the direct installer." }
-    });
-  } else {
-    const nodeVersion = dependencies.nodeVersion ?? process.versions.node;
-    const nodeOk = nodeVersionSatisfies(nodeVersion);
-    const displayedNodeVersion = nodeVersion.startsWith("v") ? nodeVersion : `v${nodeVersion}`;
-    checks.push({
-      name: "Node.js",
-      status: nodeOk ? "pass" : "fail",
-      detail: `Node.js ${displayedNodeVersion}`,
-      ...nodeOk ? {} : { nextStep: `Install Node.js ${MIN_NODE_MAJOR}.${MIN_NODE_MINOR} or newer and restart your terminal.` }
-    });
+// src/status-service.ts
+function accountLabel(profile) {
+  return profile.email ?? profile.name ?? profile.sub;
+}
+function activeWorkerCount(devices) {
+  if (devices.some((device) => device.activeWorkers === null)) return null;
+  return devices.reduce((sum, device) => sum + device.activeWorkers, 0);
+}
+var WorkspaceStatusService = class {
+  constructor(credentials, endpoints, dependencies = {}) {
+    this.endpoints = endpoints;
+    this.dependencies = dependencies;
+    this.#credentials = credentials;
+  }
+  endpoints;
+  dependencies;
+  #credentials;
+  #account;
+  #accountUnavailable = false;
+  #cached;
+  #inFlight;
+  #profileInFlight;
+  #listeners = /* @__PURE__ */ new Set();
+  peek() {
+    return this.#cached;
+  }
+  subscribe(listener) {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+  async refresh(signal, waitForAccount = false) {
+    let status;
+    if (this.#inFlight) {
+      status = await this.#inFlight;
+    } else {
+      const pending = this.#load(signal);
+      this.#inFlight = pending;
+      try {
+        status = await pending;
+      } finally {
+        if (this.#inFlight === pending) this.#inFlight = void 0;
+      }
+    }
+    if (waitForAccount && this.#profileInFlight) {
+      await this.#profileInFlight;
+      return this.#cached ?? status;
+    }
+    return status;
   }
-  let endpoints = dependencies.endpoints;
-  if (!endpoints) {
-    try {
-      endpoints = (dependencies.loadEndpoints ?? loadRelayEndpoints)();
-    } catch (error46) {
-      const message = error46 instanceof Error ? error46.message : String(error46);
-      checks.push({
-        name: "Relay",
-        status: "fail",
-        detail: `Endpoint configuration is invalid: ${message}`,
-        nextStep: "Set GLOSSA_RELAY_ORIGIN and GLOSSA_WORKER_ORIGIN to origin URLs only, without paths."
+  async #load(signal) {
+    const validate = this.dependencies.validCredentials ?? validCredentials;
+    const devicesForAccount = this.dependencies.listDevices ?? listDevices;
+    const baseFetch = this.dependencies.fetch ?? fetch;
+    const fetchRequest = signal ? async (input, init) => await baseFetch(input, { ...init, signal }) : baseFetch;
+    this.#credentials = await validate(
+      this.#credentials,
+      signal ? { signal } : {}
+    );
+    const requestCredentials = this.#credentials;
+    if (!this.#account && !this.#profileInFlight) {
+      this.#accountUnavailable = false;
+      const pending = this.#loadAccount(
+        requestCredentials,
+        fetchRequest,
+        signal
+      ).catch(() => {
+        if (signal?.aborted) return;
+        this.#accountUnavailable = true;
+        if (this.#cached) {
+          this.#cached = { ...this.#cached, account: "Account unavailable" };
+          this.#publish(this.#cached);
+        }
+      });
+      this.#profileInFlight = pending;
+      void pending.finally(() => {
+        if (this.#profileInFlight === pending) this.#profileInFlight = void 0;
       });
     }
+    const devices = await devicesForAccount(
+      this.endpoints,
+      requestCredentials,
+      fetchRequest
+    );
+    const status = {
+      account: this.#account ?? (this.#accountUnavailable ? "Account unavailable" : "Loading account\u2026"),
+      relay: this.endpoints.relayOrigin,
+      activeWorkers: activeWorkerCount(devices),
+      devices
+    };
+    this.#cached = status;
+    this.#publish(status);
+    return status;
   }
-  if (endpoints) {
-    const fetchHealthz = dependencies.fetchHealthz ?? defaultFetchHealthz;
-    const relayOk = await fetchHealthz(endpoints.relayOrigin);
-    checks.push({
-      name: "Relay",
-      status: relayOk ? "pass" : "fail",
-      detail: relayOk ? `${endpoints.relayOrigin} is reachable.` : `${endpoints.relayOrigin} is not reachable.`,
-      ...relayOk ? {} : { nextStep: "Check your internet connection. If you self-host, confirm GLOSSA_RELAY_ORIGIN." }
-    });
-    if (endpoints.workerOrigin !== endpoints.relayOrigin) {
-      const workerOk = await fetchHealthz(endpoints.workerOrigin);
-      checks.push({
-        name: "Worker",
-        status: workerOk ? "pass" : "fail",
-        detail: workerOk ? `${endpoints.workerOrigin} is reachable.` : `${endpoints.workerOrigin} is not reachable.`,
-        ...workerOk ? {} : { nextStep: "Confirm GLOSSA_WORKER_ORIGIN and the worker endpoint reverse proxy." }
-      });
+  async #loadAccount(credentials, fetchRequest, signal) {
+    const profile = this.dependencies.loadUserProfile ?? loadUserProfile;
+    const result = await profile(
+      credentials,
+      signal ? { signal, fetch: fetchRequest } : { fetch: fetchRequest }
+    );
+    this.#credentials = result.credentials;
+    this.#account = accountLabel(result.profile);
+    this.#accountUnavailable = false;
+    if (this.#cached) {
+      this.#cached = { ...this.#cached, account: this.#account };
+      this.#publish(this.#cached);
     }
   }
-  const probeCredentials = dependencies.probeCredentials ?? defaultProbeCredentials;
-  const credentialState = await probeCredentials();
-  checks.push(signInCheck(credentialState));
-  const probeDeviceCredential = dependencies.probeDeviceCredential ?? defaultProbeDeviceCredential;
-  const deviceCredentialState = await probeDeviceCredential();
-  checks.push(deviceCredentialCheck(deviceCredentialState));
-  return checks;
-}
-async function defaultProbeStandaloneRuntime() {
-  try {
-    const keyring = await import("@napi-rs/keyring");
-    return typeof keyring.AsyncEntry === "function";
-  } catch {
-    return false;
+  #publish(status) {
+    for (const listener of this.#listeners) listener(status);
   }
+};
+
+// src/ui-hud.ts
+import { emitKeypressEvents } from "node:readline";
+function initialHudState(workspace) {
+  return {
+    workspace,
+    connection: "starting",
+    message: void 0,
+    activities: [],
+    view: "session",
+    status: void 0,
+    statusLoading: false,
+    prompt: void 0,
+    busy: false,
+    notice: void 0
+  };
+}
+function activityLabel(event) {
+  const noun = event.jobType === "write_file" ? "File write" : event.jobType === "edit_file" ? "File edit" : event.jobType === "run_command" ? "Command" : "Cancellation";
+  if (event.phase === "requested") return `${noun} requested`;
+  if (event.jobType === "run_command") return `Command ${event.ok ? "started" : "rejected"}`;
+  return `${noun} ${event.ok ? "completed" : "rejected"}`;
 }
-function signInCheck(state) {
-  if (state === "present") {
-    return { name: "Sign-in", status: "pass", detail: "Signed in to Glossa." };
+function applyHudEvent(state, event) {
+  if (event.type === "session") {
+    return { ...state, workspace: event.root, deviceName: event.deviceName };
   }
-  if (state === "absent") {
-    return {
-      name: "Sign-in",
-      status: "warn",
-      detail: "Not signed in yet.",
-      nextStep: 'Run "glossa" inside a workspace. Sign-in opens automatically.'
-    };
+  if (event.type === "status") {
+    if (event.status.state === "retrying") {
+      return { ...state, connection: "retrying", message: event.status.error.message };
+    }
+    return { ...state, connection: event.status.state, message: void 0 };
   }
-  return {
-    name: "Sign-in",
-    status: "fail",
-    detail: "Stored credentials are unreadable.",
-    nextStep: 'Run "glossa logout" to clear them, then start Glossa again.'
-  };
+  if (event.type === "notice") return { ...state, message: event.message };
+  const activity = event.phase === "finished" ? { label: activityLabel(event), requestId: event.requestId, ok: event.ok } : { label: activityLabel(event), requestId: event.requestId };
+  return { ...state, activities: [...state.activities.slice(-7), activity] };
 }
-function deviceCredentialCheck(state) {
-  if (state === "present") {
-    return {
-      name: "Device",
-      status: "pass",
-      detail: "Device credentials are readable."
-    };
+var ANSI_BASE = "\x1B[22;38;2;244;241;251;48;2;17;16;22m";
+var PALETTE = {
+  ink: "38;2;244;241;251",
+  muted: "38;2;170;164;181",
+  purple: "38;2;128;84;255",
+  purpleReadable: "38;2;173;152;255",
+  coral: "38;2;255;102;95",
+  line: "38;2;92;85;110"
+};
+function style(enabled, code, value) {
+  return enabled ? `\x1B[${code}m${value}${ANSI_BASE}` : value;
+}
+function truncate(value, width) {
+  if (value.length <= width) return value;
+  if (width <= 1) return "\u2026";
+  return `${value.slice(0, width - 1)}\u2026`;
+}
+function wrapText(value, width) {
+  const words = value.split(/\s+/);
+  const lines = [];
+  let line = "";
+  for (const word of words) {
+    if (!line) line = word;
+    else if (`${line} ${word}`.length <= width) line += ` ${word}`;
+    else {
+      lines.push(line);
+      line = word;
+    }
   }
-  if (state === "absent") {
+  if (line) lines.push(line);
+  return lines;
+}
+function sectionTitle(label, color, tone = PALETTE.purpleReadable) {
+  return style(color, `${tone};1`, label.toUpperCase());
+}
+function renderHeader(view, usable, color) {
+  const brand = "Glossa";
+  const fullViewLabel = {
+    session: "SESSION",
+    activity: "ACTIVITY",
+    status: "ACCOUNT & DEVICES",
+    help: "KEYBOARD"
+  }[view];
+  const viewLabel = truncate(
+    fullViewLabel,
+    Math.max(4, usable - brand.length - 1)
+  );
+  const gap = " ".repeat(Math.max(1, usable - brand.length - viewLabel.length));
+  return [
+    `${style(color, `${PALETTE.purple};1`, brand)}${gap}${style(color, `${PALETTE.coral};1`, viewLabel)}`,
+    style(color, PALETTE.line, "\u2500".repeat(usable))
+  ];
+}
+function connectionCopy(state) {
+  if (state.connection === "connected") {
     return {
-      name: "Device",
-      status: "warn",
-      detail: "No device is enrolled on this computer yet.",
-      nextStep: 'Run "glossa --device-name <name> ." inside a workspace to enroll it.'
+      glyph: "\u25CF",
+      label: "Connected",
+      detail: state.message ?? "ChatGPT can use this workspace."
     };
   }
-  return {
-    name: "Device",
-    status: "fail",
-    detail: "Stored device credentials are unreadable.",
-    nextStep: "Remove the local Glossa device credential from the operating-system credential store (or the device.json fallback), then start Glossa again to re-enroll."
-  };
+  if (state.connection === "connecting" || state.connection === "starting") {
+    return { glyph: "\u25CC", label: "Connecting", detail: "Establishing the managed relay session\u2026" };
+  }
+  if (state.connection === "retrying") {
+    return { glyph: "\u25CC", label: "Reconnecting", detail: state.message ?? "Retrying automatically\u2026" };
+  }
+  if (state.connection === "error") {
+    return { glyph: "\xD7", label: "Error", detail: state.message ?? "The session stopped unexpectedly." };
+  }
+  return { glyph: "\u25CB", label: "Disconnected", detail: "The workspace is no longer exposed." };
 }
-function formatDoctorResult(checks, json2) {
-  if (json2) return JSON.stringify({ checks }, null, 2);
-  const nameWidth = Math.max(...checks.map((check2) => check2.name.length));
-  const lines = ["Glossa doctor", ""];
-  for (const check2 of checks) {
-    const name = check2.name.padEnd(nameWidth);
-    lines.push(`  ${name}  ${check2.status.toUpperCase()}  ${check2.detail}`);
-    if (check2.nextStep) {
-      lines.push(`  ${" ".repeat(nameWidth)}  ${check2.nextStep}`);
-    }
+function renderSession(state, usable, color) {
+  const copy = connectionCopy(state);
+  const statusTone = state.connection === "connected" ? PALETTE.purpleReadable : state.connection === "error" ? PALETTE.coral : PALETTE.muted;
+  const lines = [
+    "",
+    style(color, `${statusTone};1`, `${copy.glyph} ${copy.label}`),
+    ...wrapText(copy.detail, usable).map((line) => style(color, PALETTE.muted, line)),
+    "",
+    sectionTitle("Workspace", color),
+    style(color, PALETTE.ink, truncate(state.workspace, usable))
+  ];
+  if (state.deviceName) {
+    lines.push(
+      style(color, PALETTE.muted, `Device  ${truncate(state.deviceName, Math.max(8, usable - 8))}`)
+    );
   }
-  const failed = checks.filter((check2) => check2.status === "fail").length;
-  lines.push("");
   lines.push(
-    failed === 0 ? "Glossa is ready to start." : `${failed} check${failed === 1 ? "" : "s"} failed. Resolve the items above before starting.`
+    "",
+    ...wrapText(
+      "Files and commands use your account permissions.",
+      Math.max(8, usable - 2)
+    ).map(
+      (line, index) => `${index === 0 ? style(color, `${PALETTE.coral};1`, "!") : " "} ${style(color, PALETTE.muted, line)}`
+    )
   );
-  return lines.join("\n");
-}
-async function runDoctor(json2, dependencies = {}, log = console.log) {
-  const checks = await runDoctorChecks(dependencies);
-  log(formatDoctorResult(checks, json2));
-  return checks.every((check2) => check2.status !== "fail");
+  const latest = state.activities.at(-1);
+  lines.push(
+    "",
+    sectionTitle("Latest activity", color),
+    latest ? `${style(color, latest.ok === false ? PALETTE.coral : PALETTE.purpleReadable, latest.ok === false ? "\xD7" : "\u2022")} ${style(color, PALETTE.ink, truncate(latest.label, Math.max(8, usable - 2)))}` : style(color, PALETTE.muted, "No tool activity yet.")
+  );
+  return lines;
 }
-async function defaultFetchHealthz(origin) {
-  try {
-    const response = await fetch(`${origin}/healthz`, {
-      signal: AbortSignal.timeout(HEALTHZ_TIMEOUT_MS)
-    });
-    if (!response.ok) return false;
-    const data = await response.json();
-    return data.ok === true && data.service === "glossa-relay";
-  } catch {
-    return false;
+function renderActivity(state, usable, color) {
+  const lines = ["", sectionTitle("Recent activity", color)];
+  if (state.activities.length === 0) {
+    lines.push("", style(color, PALETTE.muted, "No tool activity yet."));
   }
-}
-async function defaultProbeCredentials() {
-  try {
-    return await peekCredentials() !== null ? "present" : "absent";
-  } catch {
-    return "error";
+  for (const activity of state.activities.slice(-8)) {
+    const outcome = activity.ok === false ? style(color, PALETTE.coral, "\xD7") : style(color, activity.ok === true ? PALETTE.purpleReadable : PALETTE.muted, "\u2022");
+    lines.push(
+      "",
+      `${outcome} ${style(color, PALETTE.ink, truncate(activity.label, Math.max(8, usable - 2)))}`,
+      `  ${style(color, PALETTE.muted, `Request ${activity.requestId.slice(0, 8)}`)}`
+    );
   }
+  return lines;
 }
-async function defaultProbeDeviceCredential() {
-  try {
-    return await peekDeviceCredential() !== null ? "present" : "absent";
-  } catch {
-    return "error";
+function renderStatus(state, usable, color) {
+  const lines = ["", sectionTitle("Account", color)];
+  if (state.statusLoading) {
+    lines.push("", style(color, PALETTE.muted, "Loading account and devices\u2026"));
+    return lines;
   }
+  if (!state.status) {
+    lines.push("", style(color, PALETTE.muted, "Status is not loaded."));
+    return lines;
+  }
+  lines.push(
+    style(color, PALETTE.ink, truncate(state.status.account, usable)),
+    style(color, PALETTE.muted, truncate(state.status.relay, usable)),
+    "",
+    sectionTitle("Active workspaces", color, PALETTE.coral),
+    style(
+      color,
+      PALETTE.ink,
+      state.status.activeWorkers === null ? "Unavailable" : String(state.status.activeWorkers)
+    ),
+    "",
+    sectionTitle(`Devices  ${state.status.devices.length}`, color)
+  );
+  if (state.status.devices.length === 0) {
+    lines.push("", style(color, PALETTE.muted, "No devices enrolled."));
+  }
+  state.status.devices.slice(0, 9).forEach((device, index) => {
+    const statusTone = device.status.includes("active") ? PALETTE.purpleReadable : device.status === "revoked" ? PALETTE.coral : PALETTE.muted;
+    lines.push(
+      "",
+      `${style(color, `${PALETTE.coral};1`, String(index + 1).padStart(2))}  ${style(color, `${PALETTE.ink};1`, truncate(device.name, Math.max(8, usable - 4)))}`,
+      `    ${style(color, statusTone, device.status)}`,
+      `    ${style(color, PALETTE.muted, truncate(`${device.platform}  \u2022  seen ${device.lastSeen}`, Math.max(8, usable - 4)))}`
+    );
+  });
+  return lines;
 }
-
-// src/device-format.ts
-function deviceStatus(device) {
-  if (device.revokedAt) return "revoked";
-  if (device.activeWorkers === null) return "worker count unavailable";
-  if (device.activeWorkers === 0) return "offline";
-  return `${device.activeWorkers} active ${device.activeWorkers === 1 ? "worker" : "workers"}`;
+function helpRows(key, label, usable, color, tone = PALETTE.purpleReadable) {
+  const indent = " ".repeat(key.length + 2);
+  return wrapText(label, Math.max(8, usable - indent.length)).map(
+    (line, index) => index === 0 ? `${style(color, `${tone};1`, key)}  ${line}` : `${indent}${line}`
+  );
 }
-function formatRelativeTime(iso, now = Date.now()) {
-  if (!iso) return "never";
-  const parsed = Date.parse(iso);
-  if (!Number.isFinite(parsed)) return "unknown";
-  const seconds = Math.max(0, Math.round((now - parsed) / 1e3));
-  if (seconds < 60) return "just now";
-  const minutes = Math.round(seconds / 60);
-  if (minutes < 60) return `${minutes}m ago`;
-  const hours = Math.round(minutes / 60);
-  if (hours < 24) return `${hours}h ago`;
-  const days = Math.round(hours / 24);
-  return `${days}d ago`;
+function renderHelp(usable, color) {
+  return [
+    "",
+    sectionTitle("Navigate", color),
+    ...helpRows("D", "Recent activity", usable, color),
+    ...helpRows("S", "Account and devices", usable, color),
+    ...helpRows("?", "Close help", usable, color),
+    "",
+    sectionTitle("Manage", color, PALETTE.coral),
+    ...helpRows("R", "Revoke a device from the status view", usable, color, PALETTE.coral),
+    ...helpRows("L", "Sign out", usable, color, PALETTE.coral),
+    ...helpRows("U", "Update Glossa", usable, color, PALETTE.coral),
+    "",
+    sectionTitle("Session", color),
+    ...helpRows("Q", "Disconnect and quit", usable, color, PALETTE.coral),
+    ...helpRows("Ctrl+C", "Disconnect and quit", usable, color, PALETTE.coral)
+  ];
 }
-function formatDeviceRow(device, now = Date.now()) {
-  const platform = device.platform ?? "unknown platform";
-  return `${device.id}  ${device.name}  ${platform}  last seen ${formatRelativeTime(device.lastSeenAt, now)}  ${deviceStatus(device)}`;
+function promptText(state) {
+  if (state.busy) return { message: "Working\u2026" };
+  if (!state.prompt) return void 0;
+  if (state.prompt.type === "logout") {
+    return { message: "Sign out and disconnect?", choices: "Y confirm  N cancel" };
+  }
+  if (state.prompt.type === "update") {
+    return { message: "Disconnect and update Glossa?", choices: "Y confirm  N cancel" };
+  }
+  if (state.prompt.type === "revoke-select") {
+    return { message: "Choose a device number to revoke.", choices: "Esc cancel" };
+  }
+  const device = state.status?.devices[state.prompt.deviceIndex];
+  return {
+    message: `Revoke ${device?.name ?? "this device"}?`,
+    choices: "Y confirm  N cancel"
+  };
+}
+function footerHints(state) {
+  if (state.view === "status") {
+    return [
+      { key: "R", label: "Revoke", tone: PALETTE.coral },
+      { key: "L", label: "Sign out", tone: PALETTE.coral },
+      { key: "U", label: "Update", tone: PALETTE.coral },
+      { key: "Esc", label: "Session" },
+      { key: "Q", label: "Disconnect", tone: PALETTE.coral }
+    ];
+  }
+  if (state.view === "activity") {
+    return [
+      { key: "D", label: "Session" },
+      { key: "S", label: "Status" },
+      { key: "?", label: "Help" },
+      { key: "Q", label: "Disconnect", tone: PALETTE.coral }
+    ];
+  }
+  if (state.view === "help") {
+    return [
+      { key: "?", label: "Session" },
+      { key: "Q", label: "Disconnect", tone: PALETTE.coral }
+    ];
+  }
+  return [
+    { key: "D", label: "Activity" },
+    { key: "S", label: "Status" },
+    { key: "?", label: "Help" },
+    { key: "Q", label: "Disconnect", tone: PALETTE.coral }
+  ];
 }
-
-// src/logout.ts
-function browserLogoutUrl(issuer) {
-  return new URL(
-    "v2/logout",
-    issuer.endsWith("/") ? issuer : `${issuer}/`
-  ).toString();
+function renderFooter(state, usable, color) {
+  const rows = [[]];
+  let rowLength = 0;
+  for (const hint of footerHints(state)) {
+    const tokenLength = hint.key.length + hint.label.length + 1;
+    if (rows.at(-1).length > 0 && rowLength + 3 + tokenLength > usable) {
+      rows.push([]);
+      rowLength = 0;
+    }
+    rows.at(-1).push(hint);
+    rowLength += (rowLength > 0 ? 3 : 0) + tokenLength;
+  }
+  return rows.map(
+    (row) => row.map(
+      (hint) => `${style(color, `${hint.tone ?? PALETTE.purpleReadable};1`, hint.key)} ${style(color, PALETTE.muted, hint.label)}`
+    ).join("   ")
+  );
 }
-async function logoutFromGlossa(options, dependencies = {}) {
-  const remove = dependencies.deleteCredentials ?? deleteCredentials;
-  const peek = dependencies.peekCredentials ?? peekCredentials;
-  const browse = dependencies.openBrowser ?? openBrowser;
-  const log = dependencies.log ?? console.log;
-  let stored = null;
-  let present = true;
-  try {
-    stored = await peek();
-    present = stored !== null;
-  } catch {
+function renderHud(state, width = 80, color = !process.env.NO_COLOR) {
+  const usable = Math.max(20, width - 4);
+  const margin = width >= 24 ? "  " : "";
+  const lines = [...renderHeader(state.view, usable, color)];
+  if (state.view === "activity") lines.push(...renderActivity(state, usable, color));
+  else if (state.view === "status") lines.push(...renderStatus(state, usable, color));
+  else if (state.view === "help") lines.push(...renderHelp(usable, color));
+  else lines.push(...renderSession(state, usable, color));
+  if (state.notice) {
+    lines.push(
+      "",
+      style(color, PALETTE.line, "\u2500".repeat(usable)),
+      ...wrapText(`! ${state.notice}`, usable).map((line) => style(color, PALETTE.coral, line))
+    );
   }
-  const issuer = dependencies.issuer ?? stored?.credentials.issuer;
-  await remove();
-  log(
-    present ? "Signed out of Glossa locally." : "Already signed out of Glossa locally."
-  );
-  if (!options.browser) return;
-  const url2 = browserLogoutUrl(issuer ?? loadAuthConfig().issuer);
-  const opened = await browse(url2);
-  if (opened) {
-    log("Opened Glossa browser sign-out.");
-  } else {
-    log("Open this URL to finish signing out in your browser:");
-    log(url2);
+  const prompt = promptText(state);
+  if (prompt) {
+    lines.push(
+      "",
+      style(color, PALETTE.line, "\u2500".repeat(usable)),
+      style(color, `${PALETTE.coral};1`, truncate(prompt.message, usable))
+    );
+    if (prompt.choices) lines.push(style(color, PALETTE.muted, prompt.choices));
   }
-  log(
-    "Reconnect Glossa in ChatGPT, then choose the same Google account when the CLI signs in."
+  lines.push(
+    "",
+    style(color, PALETTE.line, "\u2500".repeat(usable)),
+    ...renderFooter(state, usable, color)
   );
+  return lines.map((line) => line ? `${margin}${line}` : "").join("\n");
 }
-
-// src/status-guidance.ts
-function noActiveWorkerHint(activeWorkers, deviceCount) {
-  if (deviceCount === 0) return null;
-  if (activeWorkers === 0) {
-    return 'No active workers. Run "glossa" inside a workspace so ChatGPT can use it.';
+async function runSessionHud(actions, input = process.stdin, output = process.stdout) {
+  if (!input.isTTY || !output.isTTY) {
+    throw new Error("Glossa requires an interactive terminal.");
+  }
+  emitKeypressEvents(input);
+  const wasRaw = input.isRaw;
+  const controller = new AbortController();
+  let state = initialHudState(actions.workspace);
+  let exitAction = "quit";
+  let stopUi;
+  const color = !process.env.NO_COLOR;
+  const render = () => {
+    const view = renderHud(state, output.columns ?? 80, color);
+    output.write(`${color ? ANSI_BASE : ""}\x1B[H\x1B[2J${view}`);
+  };
+  const loadStatus = async () => {
+    if (state.connection !== "connected" && state.connection !== "retrying") {
+      state = { ...state, notice: "Status is available after Glossa connects." };
+      render();
+      return;
+    }
+    const cached2 = state.status ?? actions.peekStatus?.();
+    state = {
+      ...state,
+      view: "status",
+      status: cached2,
+      statusLoading: !cached2,
+      prompt: void 0,
+      notice: void 0
+    };
+    render();
+    try {
+      const refreshed = await actions.loadStatus(controller.signal);
+      if (controller.signal.aborted) return;
+      const status = actions.peekStatus?.() ?? refreshed;
+      state = { ...state, status, statusLoading: false };
+    } catch (error46) {
+      if (controller.signal.aborted) return;
+      state = {
+        ...state,
+        statusLoading: false,
+        notice: error46 instanceof Error ? error46.message : String(error46)
+      };
+    }
+    render();
+  };
+  const unsubscribeStatus = actions.subscribeStatus?.((status) => {
+    state = { ...state, status, statusLoading: false };
+    if (state.view === "status") render();
+  }) ?? (() => void 0);
+  const session = actions.run(controller.signal, (event) => {
+    state = applyHudEvent(state, event);
+    render();
+  }).then(() => {
+    if (!controller.signal.aborted) state = { ...state, connection: "disconnected" };
+    render();
+  }).catch((error46) => {
+    if (controller.signal.aborted) return;
+    state = {
+      ...state,
+      connection: "error",
+      message: error46 instanceof Error ? error46.message : String(error46)
+    };
+    render();
+    throw error46;
+  });
+  input.setRawMode(true);
+  input.resume();
+  output.write("\x1B[?1049h\x1B[?25l");
+  render();
+  const stop = (action = "quit") => {
+    exitAction = action;
+    controller.abort();
+    stopUi?.();
+  };
+  const stopFromSignal = () => stop();
+  process.once("SIGINT", stopFromSignal);
+  process.once("SIGTERM", stopFromSignal);
+  try {
+    await new Promise((resolve) => {
+      stopUi = resolve;
+      const onKeypress = (value, key) => {
+        if (key.ctrl && key.name === "c" || key.name === "q") return stop();
+        if (state.busy) return;
+        if (state.prompt) {
+          if (key.name === "escape" || key.name === "n") {
+            state = { ...state, prompt: void 0, notice: void 0 };
+            render();
+            return;
+          }
+          if (state.prompt.type === "revoke-select") {
+            const deviceIndex = Number(value) - 1;
+            if (Number.isInteger(deviceIndex) && deviceIndex >= 0 && deviceIndex < (state.status?.devices.length ?? 0)) {
+              state = { ...state, prompt: { type: "revoke-confirm", deviceIndex } };
+              render();
+            }
+            return;
+          }
+          if (key.name !== "y") return;
+          if (state.prompt.type === "logout") return stop("logout");
+          if (state.prompt.type === "update") return stop("update");
+          const device = state.status?.devices[state.prompt.deviceIndex];
+          if (!device) return;
+          state = { ...state, busy: true, prompt: void 0, notice: void 0 };
+          render();
+          void actions.revokeDevice(device.id, controller.signal).then(async () => {
+            if (controller.signal.aborted) return;
+            state = { ...state, busy: false, notice: `Revoked ${device.name}.` };
+            render();
+            await loadStatus();
+          }).catch((error46) => {
+            if (controller.signal.aborted) return;
+            state = {
+              ...state,
+              busy: false,
+              notice: error46 instanceof Error ? error46.message : String(error46)
+            };
+            render();
+          });
+          return;
+        }
+        if (key.name === "escape") {
+          state = { ...state, view: "session", notice: void 0 };
+          render();
+        } else if (key.name === "d") {
+          state = {
+            ...state,
+            view: state.view === "activity" ? "session" : "activity",
+            notice: void 0
+          };
+          render();
+        } else if (key.name === "s") {
+          void loadStatus();
+        } else if (key.name === "r" && state.view === "status") {
+          if ((state.status?.devices.length ?? 0) === 0) {
+            state = { ...state, notice: "There are no devices to revoke." };
+          } else {
+            state = { ...state, prompt: { type: "revoke-select" }, notice: void 0 };
+          }
+          render();
+        } else if (key.name === "l") {
+          state = { ...state, prompt: { type: "logout" }, notice: void 0 };
+          render();
+        } else if (key.name === "u") {
+          state = { ...state, prompt: { type: "update" }, notice: void 0 };
+          render();
+        } else if (value === "?" || key.sequence === "?") {
+          state = {
+            ...state,
+            view: state.view === "help" ? "session" : "help",
+            notice: void 0
+          };
+          render();
+        }
+      };
+      input.on("keypress", onKeypress);
+      void session.catch(() => stopUi?.());
+      stopUi = () => {
+        input.removeListener("keypress", onKeypress);
+        resolve();
+      };
+    });
+    await session;
+    return exitAction;
+  } finally {
+    unsubscribeStatus();
+    process.removeListener("SIGINT", stopFromSignal);
+    process.removeListener("SIGTERM", stopFromSignal);
+    input.setRawMode(wasRaw);
+    input.pause();
+    output.write("\x1B[0m\x1B[?25h\x1B[?1049l");
   }
-  return null;
 }
 
 // src/update.ts
@@ -14044,11 +14082,20 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
   chmodSync,
-  existsSync as existsSync2,
+  existsSync,
   renameSync,
   rmSync,
   writeFileSync
 } from "node:fs";
+
+// src/runtime.ts
+function isStandaloneExecutable(value = true ? false : false) {
+  if (typeof value === "boolean") return value;
+  if (!value || typeof value !== "object") return false;
+  return value.isStandaloneExecutable === true;
+}
+
+// src/update.ts
 var NPM_PACKAGE = "@ariobarin/glossa@beta";
 var DEFAULT_RELEASES_API = "https://api.github.com/repos/ariobarin/glossa/releases?per_page=20";
 function npmUpdateInvocation(platform = process.platform, environment = process.env) {
@@ -14134,264 +14181,81 @@ async function updateStandalone(dependencies) {
   }
   const [binaryResponse, checksumResponse] = await Promise.all([
     checkedFetch(fetcher, release.binaryUrl),
-    checkedFetch(fetcher, release.checksumUrl)
-  ]);
-  const binary = Buffer.from(await binaryResponse.arrayBuffer());
-  const expected = expectedChecksum(await checksumResponse.text(), assetName);
-  const actual = createHash("sha256").update(binary).digest("hex");
-  if (actual !== expected) {
-    throw new Error(
-      `Glossa refused the update because the SHA-256 checksum did not match.`
-    );
-  }
-  const downloadPath = `${executablePath}.download-${process.pid}`;
-  const backupPath = `${executablePath}.old`;
-  writeFileSync(downloadPath, binary, { mode: 493 });
-  if (platform !== "win32") chmodSync(downloadPath, 493);
-  try {
-    if (platform === "win32") {
-      rmSync(backupPath, { force: true });
-      renameSync(executablePath, backupPath);
-      try {
-        renameSync(downloadPath, executablePath);
-      } catch (error46) {
-        renameSync(backupPath, executablePath);
-        throw error46;
-      }
-      try {
-        rmSync(backupPath, { force: true });
-      } catch {
-      }
-    } else {
-      renameSync(downloadPath, executablePath);
-    }
-  } finally {
-    if (existsSync2(downloadPath)) rmSync(downloadPath, { force: true });
-  }
-  return `Updated Glossa to ${release.version}.`;
-}
-async function updateGlossa(dependencies = {}) {
-  const log = dependencies.log ?? console.log;
-  const standalone = dependencies.standalone ?? isStandaloneExecutable();
-  if (standalone) {
-    log("Updating the standalone Glossa executable...");
-    const message = dependencies.updateStandalone ? await dependencies.updateStandalone() : await updateStandalone(dependencies);
-    log(message);
-    return;
-  }
-  const run = dependencies.run ?? spawnSync;
-  const invocation = npmUpdateInvocation(
-    dependencies.platform,
-    dependencies.environment
-  );
-  log("Updating Glossa from npm...");
-  const result = run(invocation.command, invocation.args, { stdio: "inherit" });
-  if (result.error) {
-    throw new Error(`Glossa could not start npm: ${result.error.message}`);
-  }
-  if (result.status !== 0) {
-    throw new Error(
-      `npm could not update Glossa (exit ${result.status ?? "unknown"}).`
-    );
-  }
-  log("Glossa updated. Run glossa --version to verify the installed version.");
-}
-
-// src/ui-hud.ts
-import { emitKeypressEvents } from "node:readline";
-function initialHudState(workspace) {
-  return {
-    workspace,
-    connection: "starting",
-    message: void 0,
-    activities: [],
-    showDetails: false,
-    showHelp: false
-  };
-}
-function activityLabel(event) {
-  const noun = event.jobType === "write_file" ? "File write" : event.jobType === "edit_file" ? "File edit" : event.jobType === "run_command" ? "Command" : "Cancellation";
-  if (event.phase === "requested") return `${noun} requested`;
-  if (event.jobType === "run_command") return `Command ${event.ok ? "started" : "rejected"}`;
-  return `${noun} ${event.ok ? "completed" : "rejected"}`;
-}
-function applyHudEvent(state, event) {
-  if (event.type === "session") {
-    return { ...state, workspace: event.root, deviceName: event.deviceName };
-  }
-  if (event.type === "status") {
-    if (event.status.state === "retrying") {
-      return { ...state, connection: "retrying", message: event.status.error.message };
-    }
-    return { ...state, connection: event.status.state, message: void 0 };
-  }
-  if (event.type === "notice") return { ...state, message: event.message };
-  const activity = event.phase === "finished" ? { label: activityLabel(event), requestId: event.requestId, ok: event.ok } : { label: activityLabel(event), requestId: event.requestId };
-  return { ...state, activities: [...state.activities.slice(-7), activity] };
-}
-function style(enabled, code, value) {
-  return enabled ? `\x1B[${code}m${value}\x1B[0m` : value;
-}
-function renderTitle(width, color) {
-  const title = "Glossa";
-  const padding = " ".repeat(Math.max(0, Math.floor((width - title.length) / 2)));
-  return `${padding}${style(color, "38;2;120;77;250;1", title)}`;
-}
-function truncate(value, width) {
-  if (value.length <= width) return value;
-  if (width <= 1) return "\u2026";
-  return `${value.slice(0, width - 1)}\u2026`;
-}
-function wrapText(value, width) {
-  const words = value.split(/\s+/);
-  const lines = [];
-  let line = "";
-  for (const word of words) {
-    if (!line) line = word;
-    else if (`${line} ${word}`.length <= width) line += ` ${word}`;
-    else {
-      lines.push(line);
-      line = word;
-    }
-  }
-  if (line) lines.push(line);
-  return lines;
-}
-function connectionCopy(state) {
-  if (state.connection === "connected") {
-    return {
-      glyph: "\u25CF",
-      label: "Connected",
-      detail: state.message ?? "ChatGPT can use this workspace."
-    };
-  }
-  if (state.connection === "connecting" || state.connection === "starting") {
-    return { glyph: "\u25CC", label: "Connecting", detail: "Establishing the managed relay session\u2026" };
-  }
-  if (state.connection === "retrying") {
-    return { glyph: "\u25CC", label: "Reconnecting", detail: state.message ?? "Retrying automatically\u2026" };
-  }
-  if (state.connection === "error") {
-    return { glyph: "\xD7", label: "Error", detail: state.message ?? "The session stopped unexpectedly." };
+    checkedFetch(fetcher, release.checksumUrl)
+  ]);
+  const binary = Buffer.from(await binaryResponse.arrayBuffer());
+  const expected = expectedChecksum(await checksumResponse.text(), assetName);
+  const actual = createHash("sha256").update(binary).digest("hex");
+  if (actual !== expected) {
+    throw new Error(
+      `Glossa refused the update because the SHA-256 checksum did not match.`
+    );
   }
-  return { glyph: "\u25CB", label: "Disconnected", detail: "The workspace is no longer exposed." };
-}
-function renderHud(state, width = 80, color = !process.env.NO_COLOR) {
-  const copy = connectionCopy(state);
-  const usable = Math.max(24, width - 4);
-  const lines = [
-    renderTitle(width, color),
-    "",
-    `${style(color, state.connection === "connected" ? "32;1" : "36;1", copy.glyph)} ${style(color, "1", copy.label)}`,
-    `  ${truncate(copy.detail, usable)}`,
-    "",
-    `${style(color, "2", "Workspace")}  ${truncate(state.workspace, Math.max(8, usable - 11))}`,
-    "",
-    style(color, "1", "Authority"),
-    ...wrapText(
-      "Files may be modified and commands have the full environment and permissions of this account.",
-      usable
-    ).map((line) => `  ${line}`)
-  ];
-  if (state.deviceName) lines.push(`${style(color, "2", "Device")}     ${truncate(state.deviceName, Math.max(8, usable - 11))}`);
-  if (state.showHelp) {
-    lines.push("", style(color, "1", "Keys"));
-    lines.push("  d  toggle recent activity");
-    lines.push("  ?  hide this help");
-    lines.push("  q  disconnect and quit");
-  } else if (state.showDetails) {
-    lines.push("", style(color, "1", "Recent activity"));
-    if (state.activities.length === 0) lines.push(style(color, "2", "  No tool activity yet."));
-    for (const activity of state.activities.slice(-5)) {
-      const outcome = activity.ok === false ? style(color, "31", "\xD7") : style(color, "2", "\xB7");
-      lines.push(`${outcome} ${truncate(activity.label, Math.max(8, usable - 16))}  ${style(color, "2", activity.requestId.slice(0, 8))}`);
+  const downloadPath = `${executablePath}.download-${process.pid}`;
+  const backupPath = `${executablePath}.old`;
+  writeFileSync(downloadPath, binary, { mode: 493 });
+  if (platform !== "win32") chmodSync(downloadPath, 493);
+  try {
+    if (platform === "win32") {
+      rmSync(backupPath, { force: true });
+      renameSync(executablePath, backupPath);
+      try {
+        renameSync(downloadPath, executablePath);
+      } catch (error46) {
+        renameSync(backupPath, executablePath);
+        throw error46;
+      }
+      try {
+        rmSync(backupPath, { force: true });
+      } catch {
+      }
+    } else {
+      renameSync(downloadPath, executablePath);
     }
-  } else {
-    const latest = state.activities.at(-1);
-    lines.push("", latest ? `${style(color, "2", "Latest")}     ${truncate(latest.label, Math.max(8, usable - 11))}` : style(color, "2", "No tool activity yet."));
+  } finally {
+    if (existsSync(downloadPath)) rmSync(downloadPath, { force: true });
   }
-  lines.push("", style(color, "2", "d details  ? help  q disconnect"));
-  return lines.join("\n");
+  return `Updated Glossa to ${release.version}.`;
 }
-async function runSessionHud(actions, input = process.stdin, output = process.stdout) {
-  if (!input.isTTY || !output.isTTY) {
-    throw new Error("glossa ui requires an interactive terminal. Use glossa start instead.");
+async function updateGlossa(dependencies = {}) {
+  const log = dependencies.log ?? console.log;
+  const standalone = dependencies.standalone ?? isStandaloneExecutable();
+  if (standalone) {
+    log("Updating the standalone Glossa executable...");
+    const message = dependencies.updateStandalone ? await dependencies.updateStandalone() : await updateStandalone(dependencies);
+    log(message);
+    return;
   }
-  emitKeypressEvents(input);
-  const wasRaw = input.isRaw;
-  const wasPaused = input.isPaused();
-  const controller = new AbortController();
-  let state = initialHudState(actions.workspace);
-  let stopUi;
-  const render = () => {
-    const view = renderHud(state, output.columns ?? 80);
-    output.write(`\x1B[H\x1B[2J${view}`);
-  };
-  const session = actions.run(controller.signal, (event) => {
-    state = applyHudEvent(state, event);
-    render();
-  }).then(() => {
-    if (!controller.signal.aborted) state = { ...state, connection: "disconnected" };
-    render();
-  }).catch((error46) => {
-    state = {
-      ...state,
-      connection: "error",
-      message: error46 instanceof Error ? error46.message : String(error46)
-    };
-    render();
-    throw error46;
-  });
-  input.setRawMode(true);
-  input.resume();
-  output.write("\x1B[?1049h\x1B[?25l");
-  render();
-  const stop = () => {
-    controller.abort();
-    stopUi?.();
-  };
-  process.once("SIGINT", stop);
-  process.once("SIGTERM", stop);
-  try {
-    await new Promise((resolve) => {
-      stopUi = resolve;
-      const onKeypress = (value, key) => {
-        if (key.ctrl && key.name === "c" || key.name === "q") return stop();
-        if (key.name === "d") {
-          state = { ...state, showDetails: !state.showDetails, showHelp: false };
-          render();
-        } else if (value === "?" || key.sequence === "?") {
-          state = { ...state, showHelp: !state.showHelp };
-          render();
-        }
-      };
-      input.on("keypress", onKeypress);
-      void session.catch(() => stopUi?.());
-      stopUi = () => {
-        input.removeListener("keypress", onKeypress);
-        resolve();
-      };
-    });
-    await session;
-  } finally {
-    process.removeListener("SIGINT", stop);
-    process.removeListener("SIGTERM", stop);
-    input.setRawMode(wasRaw);
-    if (wasPaused) input.pause();
-    output.write("\x1B[?25h\x1B[?1049l");
+  const run = dependencies.run ?? spawnSync;
+  const invocation = npmUpdateInvocation(
+    dependencies.platform,
+    dependencies.environment
+  );
+  log("Updating Glossa from the npm beta channel...");
+  const result = run(invocation.command, invocation.args, { stdio: "inherit" });
+  if (result.error) {
+    throw new Error(`Glossa could not start npm: ${result.error.message}`);
+  }
+  if (result.status !== 0) {
+    throw new Error(
+      `npm could not update Glossa (exit ${result.status ?? "unknown"}).`
+    );
   }
+  log("Glossa updated.");
+  log("Next: run glossa to reopen this workspace.");
+  log("Inside Glossa, press ? for controls.");
 }
 
 // src/first-run.ts
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import path5 from "node:path";
+import path3 from "node:path";
 var CONNECT_HINT_FILE = "connect-hint-shown";
 var CONNECT_HINT_URL = "https://glossa.sh/docs/quickstart";
 function shouldShowConnectHint(relayOrigin) {
   return relayOrigin === DEFAULT_RELAY_ORIGIN;
 }
 function connectHintStore(directory = configDirectory()) {
-  const file2 = path5.join(directory, CONNECT_HINT_FILE);
+  const file2 = path3.join(directory, CONNECT_HINT_FILE);
   return {
     async exists() {
       try {
@@ -14415,6 +14279,47 @@ async function announceConnectHint(store3, log) {
   return true;
 }
 
+// src/device-store.ts
+import path4 from "node:path";
+var FILE_DEVICE_WARNING = "Warning: the operating-system credential store is unavailable. Glossa is using a mode-0600 device credential file.";
+function parseDeviceCredential(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("Stored Glossa device credentials are invalid.");
+  }
+  let relayOriginValid = false;
+  if (typeof parsed.relayOrigin === "string") {
+    try {
+      relayOriginValid = new URL(parsed.relayOrigin).origin === parsed.relayOrigin;
+    } catch {
+      relayOriginValid = false;
+    }
+  }
+  if (!relayOriginValid || typeof parsed.deviceId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
+    parsed.deviceId
+  ) || typeof parsed.deviceName !== "string" || parsed.deviceName.length === 0 || parsed.accountSubject !== void 0 && (typeof parsed.accountSubject !== "string" || parsed.accountSubject.length === 0) || typeof parsed.token !== "string" || !parsed.token.startsWith(`gld_${parsed.deviceId}_`)) {
+    throw new Error("Stored Glossa device credentials are invalid.");
+  }
+  return parsed;
+}
+var store2 = new SecureStore({
+  account: "device",
+  file: path4.join(configDirectory(), "device.json"),
+  warning: FILE_DEVICE_WARNING,
+  parse: parseDeviceCredential
+});
+async function loadDeviceCredential() {
+  return (await store2.load())?.value ?? null;
+}
+async function saveDeviceCredential(credential) {
+  await store2.save(credential);
+}
+async function deleteDeviceCredential() {
+  await store2.delete();
+}
+
 // src/worker/command-service.ts
 import { spawn as spawn2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
@@ -14659,7 +14564,7 @@ var CommandService = class {
 // src/worker/file-service.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 import { chmod as chmod2, lstat, readFile as readFile3, rename, rm as rm2, stat, writeFile as writeFile3 } from "node:fs/promises";
-import path6 from "node:path";
+import path5 from "node:path";
 import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 function sha256(content) {
   return createHash2("sha256").update(content).digest("hex");
@@ -14827,7 +14732,7 @@ var FileService = class {
         throw new WorkerError("stale_revision", "The file revision has changed.");
       }
     }
-    const temporary = path6.join(path6.dirname(target), `.glossa-${randomUUID2()}.tmp`);
+    const temporary = path5.join(path5.dirname(target), `.glossa-${randomUUID2()}.tmp`);
     try {
       await writeFile3(temporary, bytes, { flag: "wx", mode: 384 });
       target = await this.policy.resolveWritableFile(relativePath);
@@ -14849,19 +14754,19 @@ var FileService = class {
 // src/worker/path-policy.ts
 import { lstat as lstat2, realpath, stat as stat2 } from "node:fs/promises";
 import os3 from "node:os";
-import path7 from "node:path";
+import path6 from "node:path";
 function samePath(left, right) {
   return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
 function isWithin(root, candidate) {
-  const relative = path7.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path7.sep}`) && relative !== ".." && !path7.isAbsolute(relative);
+  const relative = path6.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path6.sep}`) && relative !== ".." && !path6.isAbsolute(relative);
 }
 function validateRelativePath(value) {
   if (value.includes("\0")) {
     throw new WorkerError("invalid_path", "Paths cannot contain null bytes.");
   }
-  if (path7.isAbsolute(value) || path7.win32.isAbsolute(value) || path7.posix.isAbsolute(value)) {
+  if (path6.isAbsolute(value) || path6.win32.isAbsolute(value) || path6.posix.isAbsolute(value)) {
     throw new WorkerError("absolute_path", "Absolute paths are not allowed.");
   }
   const segments = value.split(/[\\/]+/);
@@ -14870,8 +14775,8 @@ function validateRelativePath(value) {
   }
   return value === "" ? "." : value;
 }
-async function canonicalizeRoot(candidate, allowBroadRoot = false) {
-  const root = await realpath(path7.resolve(candidate)).catch((error46) => {
+async function canonicalizeRoot(candidate) {
+  const root = await realpath(path6.resolve(candidate)).catch((error46) => {
     if (error46.code === "ENOENT") {
       throw new WorkerError("root_not_found", "The workspace directory does not exist.");
     }
@@ -14881,16 +14786,14 @@ async function canonicalizeRoot(candidate, allowBroadRoot = false) {
   if (!rootStat.isDirectory()) {
     throw new WorkerError("root_not_directory", "The exposed root must be a directory.");
   }
-  if (!allowBroadRoot) {
-    const filesystemRoot = path7.parse(root).root;
-    const home = await realpath(os3.homedir()).catch(() => path7.resolve(os3.homedir()));
-    if (samePath(root, filesystemRoot) || samePath(root, home)) {
-      const kind = samePath(root, home) ? "your home directory" : "a filesystem root";
-      throw new WorkerError(
-        "broad_root_refused",
-        `The selected root is ${kind}, which Glossa protects by default. Add --allow-broad-root to expose it anyway.`
-      );
-    }
+  const filesystemRoot = path6.parse(root).root;
+  const home = await realpath(os3.homedir()).catch(() => path6.resolve(os3.homedir()));
+  if (samePath(root, filesystemRoot) || samePath(root, home)) {
+    const kind = samePath(root, home) ? "your home directory" : "a filesystem root";
+    throw new WorkerError(
+      "broad_root_refused",
+      `The selected root is ${kind}, which Glossa will not expose. Choose a project directory instead.`
+    );
   }
   return root;
 }
@@ -14899,8 +14802,8 @@ var PathPolicy = class _PathPolicy {
     this.root = root;
   }
   root;
-  static async create(candidate, allowBroadRoot = false) {
-    return new _PathPolicy(await canonicalizeRoot(candidate, allowBroadRoot));
+  static async create(candidate) {
+    return new _PathPolicy(await canonicalizeRoot(candidate));
   }
   async resolveExisting(relativePath) {
     const lexical = this.resolveLexical(relativePath);
@@ -14918,7 +14821,7 @@ var PathPolicy = class _PathPolicy {
   }
   async resolveWritableFile(relativePath) {
     const lexical = this.resolveLexical(relativePath);
-    const parent = path7.dirname(lexical);
+    const parent = path6.dirname(lexical);
     await this.rejectLinkedComponents(parent);
     const canonicalParent = await realpath(parent).catch((error46) => {
       if (error46.code === "ENOENT") {
@@ -14944,11 +14847,11 @@ var PathPolicy = class _PathPolicy {
       if (error46 instanceof WorkerError) throw error46;
       if (error46.code !== "ENOENT") throw error46;
     }
-    return path7.join(canonicalParent, path7.basename(lexical));
+    return path6.join(canonicalParent, path6.basename(lexical));
   }
   resolveLexical(relativePath) {
     const validated = validateRelativePath(relativePath);
-    const candidate = path7.resolve(this.root, validated);
+    const candidate = path6.resolve(this.root, validated);
     if (!isWithin(this.root, candidate)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
@@ -14958,11 +14861,11 @@ var PathPolicy = class _PathPolicy {
     if (!isWithin(this.root, candidate)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
-    const relative = path7.relative(this.root, candidate);
+    const relative = path6.relative(this.root, candidate);
     if (!relative) return;
     let current = this.root;
-    for (const segment of relative.split(path7.sep)) {
-      current = path7.join(current, segment);
+    for (const segment of relative.split(path6.sep)) {
+      current = path6.join(current, segment);
       try {
         const currentStat = await lstat2(current);
         if (currentStat.isSymbolicLink()) {
@@ -14982,16 +14885,16 @@ var PathPolicy = class _PathPolicy {
 
 // src/worker/local-worker.ts
 var LocalWorker = class _LocalWorker {
-  constructor(policy, files, commands2) {
+  constructor(policy, files, commands) {
     this.policy = policy;
     this.files = files;
-    this.commands = commands2;
+    this.commands = commands;
   }
   policy;
   files;
   commands;
-  static async create(root, allowBroadRoot = false) {
-    const policy = await PathPolicy.create(root, allowBroadRoot);
+  static async create(root) {
+    const policy = await PathPolicy.create(root);
     return new _LocalWorker(
       policy,
       new FileService(policy),
@@ -15231,10 +15134,10 @@ var RemoteWorker = class {
     } catch {
     }
   }
-  async #post(path8, body) {
+  async #post(path7, body) {
     const timeout = AbortSignal.timeout(WORKER_REQUEST_TIMEOUT_MS);
     const signal = AbortSignal.any([this.#signal, timeout]);
-    const response = await this.#fetcher(new URL(path8, this.#origin), {
+    const response = await this.#fetcher(new URL(path7, this.#origin), {
       method: "POST",
       headers: {
         authorization: `Device ${this.#deviceToken}`,
@@ -15304,38 +15207,54 @@ async function deviceForSession(endpoints, dependencies = {}, signal) {
   const loadDevice = dependencies.loadDeviceCredential ?? loadDeviceCredential;
   const loadLogin = dependencies.loadCredentials ?? loadCredentials;
   const validate = dependencies.validCredentials ?? validCredentials;
+  const subjectFor = dependencies.accessTokenSubject ?? accessTokenSubject;
   const removeDevice = dependencies.deleteDeviceCredential ?? deleteDeviceCredential;
-  const ownsDevice = dependencies.accountOwnsDevice ?? accountOwnsDevice;
   const enroll = dependencies.enrollDevice ?? enrollDevice;
   const saveDevice = dependencies.saveDeviceCredential ?? saveDeviceCredential;
+  const ownsDevice = dependencies.accountOwnsDevice ?? accountOwnsDevice;
   const name = dependencies.defaultDeviceName ?? defaultDeviceName;
   const baseFetch = dependencies.fetch ?? fetch;
   const fetchRequest = signal ? async (input, init) => await baseFetch(input, { ...init, signal }) : baseFetch;
   signal?.throwIfAborted();
   const stored = await loadDevice();
-  const loaded = await loadLogin();
-  if (!loaded) throw new Error("Not signed in. Run Glossa again to sign in.");
-  const credentials = await validate(loaded.credentials, { fetch: fetchRequest });
-  signal?.throwIfAborted();
+  let credentials = dependencies.credentials;
+  const currentCredentials = async () => {
+    if (credentials) return credentials;
+    const loaded = await loadLogin();
+    if (!loaded) throw new Error("Not signed in. Run Glossa again to sign in.");
+    credentials = await validate(loaded.credentials, { fetch: fetchRequest });
+    return credentials;
+  };
   if (stored?.relayOrigin === endpoints.relayOrigin) {
-    if (await ownsDevice(
-      endpoints,
-      credentials,
-      stored.deviceId,
-      fetchRequest
-    )) {
-      return stored;
+    const current2 = await currentCredentials();
+    const accountSubject = subjectFor(current2);
+    if (stored.accountSubject === accountSubject) return stored;
+    if (stored.accountSubject === void 0 && await ownsDevice(endpoints, current2, stored.deviceId, fetchRequest)) {
+      const migrated = { ...stored, accountSubject };
+      await saveDevice(migrated);
+      return migrated;
     }
     await removeDevice();
   }
+  signal?.throwIfAborted();
+  const current = await currentCredentials();
   const enrolled = await enroll(
     endpoints,
-    credentials,
-    dependencies.deviceName ?? name(),
+    current,
+    name(),
     fetchRequest
   );
-  await saveDevice(enrolled);
-  return enrolled;
+  const bound = {
+    ...enrolled,
+    accountSubject: subjectFor(current)
+  };
+  await saveDevice(bound);
+  return bound;
+}
+async function reenrollRejectedDevice(endpoints, dependencies = {}, signal) {
+  const remove = dependencies.deleteDeviceCredential ?? deleteDeviceCredential;
+  await remove();
+  return await deviceForSession(endpoints, dependencies, signal);
 }
 function statusMessage(status, previous) {
   if (status.state === "connecting") return "Connecting to Glossa...";
@@ -15348,7 +15267,40 @@ function statusMessage(status, previous) {
   }
   return "Disconnected from Glossa.";
 }
-async function runManagedSession(root, endpoints, allowBroadRoot = false, options = {}) {
+async function connectRemoteWorker(endpoints, device, worker, options, signal, onConnected) {
+  let connectionState;
+  await new RemoteWorker({
+    origin: endpoints.workerOrigin,
+    deviceToken: device.token,
+    worker: visibleWorker(worker, options),
+    signal,
+    onStatus(status) {
+      if (status.state === "connected") onConnected();
+      if (status.state !== "retrying" || connectionState !== "retrying") {
+        report(options, { type: "status", status }, statusMessage(status, connectionState));
+      } else {
+        options.onEvent?.({ type: "status", status });
+      }
+      if (status.state === "connected" && status.legacyRelay) {
+        report(
+          options,
+          { type: "notice", message: "The relay needs an update before this computer can expose several workspaces at once." },
+          "The relay needs an update before this computer can expose several workspaces at once."
+        );
+      }
+      if (status.state === "connected" && !status.reconnected && shouldShowConnectHint(endpoints.relayOrigin)) {
+        void announceConnectHint(connectHintStore(), (message) => {
+          report(options, { type: "notice", message }, message);
+        }).catch(() => void 0);
+      }
+      connectionState = status.state;
+    }
+  }).run();
+}
+function shouldRecoverRejectedDevice(error46, recoveredRejectedDevice, connected) {
+  return error46 instanceof DeviceRejectedError && !recoveredRejectedDevice && !connected;
+}
+async function runManagedSession(root, endpoints, options = {}) {
   const controller = new AbortController();
   const stop = () => controller.abort();
   const handleProcessSignals = options.handleProcessSignals ?? true;
@@ -15360,13 +15312,13 @@ async function runManagedSession(root, endpoints, allowBroadRoot = false, option
     process.once("SIGTERM", stop);
   }
   try {
-    const device = await deviceForSession(
+    let device = await deviceForSession(
       endpoints,
-      options.deviceName ? { deviceName: options.deviceName } : {},
+      options.credentials ? { credentials: options.credentials } : {},
       controller.signal
     );
     controller.signal.throwIfAborted();
-    worker = await LocalWorker.create(root, allowBroadRoot);
+    worker = await LocalWorker.create(root);
     controller.signal.throwIfAborted();
     report(
       options,
@@ -15379,33 +15331,37 @@ async function runManagedSession(root, endpoints, allowBroadRoot = false, option
         "Files may be modified and commands have the full environment and permissions of this account. Press Ctrl+C to disconnect."
       );
     }
-    let connectionState;
-    await new RemoteWorker({
-      origin: endpoints.workerOrigin,
-      deviceToken: device.token,
-      worker: visibleWorker(worker, options),
-      signal: controller.signal,
-      onStatus(status) {
-        if (status.state !== "retrying" || connectionState !== "retrying") {
-          report(options, { type: "status", status }, statusMessage(status, connectionState));
-        } else {
-          options.onEvent?.({ type: "status", status });
-        }
-        if (status.state === "connected" && status.legacyRelay) {
-          report(
-            options,
-            { type: "notice", message: "The relay needs an update before this computer can expose several workspaces at once." },
-            "The relay needs an update before this computer can expose several workspaces at once."
-          );
-        }
-        if (status.state === "connected" && !status.reconnected && shouldShowConnectHint(endpoints.relayOrigin)) {
-          void announceConnectHint(connectHintStore(), (message) => {
-            report(options, { type: "notice", message }, message);
-          }).catch(() => void 0);
-        }
-        connectionState = status.state;
+    let recoveredRejectedDevice = false;
+    while (!controller.signal.aborted) {
+      let connected = false;
+      try {
+        await connectRemoteWorker(
+          endpoints,
+          device,
+          worker,
+          options,
+          controller.signal,
+          () => {
+            connected = true;
+          }
+        );
+        break;
+      } catch (error46) {
+        if (!shouldRecoverRejectedDevice(
+          error46,
+          recoveredRejectedDevice,
+          connected
+        )) {
+          throw error46;
+        }
+        recoveredRejectedDevice = true;
+        device = await reenrollRejectedDevice(
+          endpoints,
+          options.credentials ? { credentials: options.credentials } : {},
+          controller.signal
+        );
       }
-    }).run();
+    }
   } catch (error46) {
     if (error46 instanceof DeviceRejectedError) {
       await deleteDeviceCredential();
@@ -15439,67 +15395,50 @@ async function gitWorktreeRoot(cwd) {
     return null;
   }
 }
-async function selectExposureRoot(explicitPath, allowBroadRoot = false, cwd = process.cwd()) {
-  const selected = explicitPath ?? await gitWorktreeRoot(cwd) ?? cwd;
-  return await canonicalizeRoot(selected, allowBroadRoot);
+async function rootRequiredMessage(cwd) {
+  try {
+    await canonicalizeRoot(cwd);
+    return `No Git worktree was found in ${cwd}. Run "glossa ." to expose the current folder, or "glossa <path>" to expose another directory.`;
+  } catch (error46) {
+    if (error46 instanceof WorkerError && error46.code === "broad_root_refused") {
+      return `No Git worktree was found in ${cwd}, and this protected root is too broad to expose. Run "glossa <path>" with a project directory.`;
+    }
+    throw error46;
+  }
+}
+async function selectExposureRoot(explicitPath, cwd = process.cwd()) {
+  const selected = explicitPath ?? await gitWorktreeRoot(cwd);
+  if (!selected) {
+    throw new WorkerError("root_required", await rootRequiredMessage(cwd));
+  }
+  return await canonicalizeRoot(selected);
 }
 
 // src/main.ts
-var VERSION = "0.1.0-beta.10";
-var helpText = {
-  main: `Glossa ${VERSION}
+var VERSION = "0.1.0-beta.11";
+var HELP = `Glossa ${VERSION}
 
 Usage:
-  glossa
   glossa [directory]
-  glossa ui [directory] [--allow-broad-root] [--device-name <name>]
-  glossa start [directory] [--allow-broad-root] [--device-name <name>]
   glossa status [--json]
-  glossa doctor [--json]
-  glossa devices list [--json]
-  glossa devices rename <id> <name>
+  glossa devices [--json]
   glossa devices revoke <id>
-  glossa completions <shell>
   glossa update
   glossa login
-  glossa logout [--browser]
+  glossa logout
   glossa --version
-  glossa --help
-
-Glossa signs in automatically and exposes each started workspace through the managed MCP relay.`,
-  ui: `Usage: glossa ui [directory] [--allow-broad-root] [--device-name <name>]
-
-Opens an experimental compact session HUD for the current workspace.
-It starts immediately, shows connection and activity, and exits with q or Ctrl+C. --device-name names this computer on first enrollment.`,
-  start: `Usage: glossa start [directory] [--allow-broad-root] [--device-name <name>]
-
-Starts a foreground worker in the selected directory. Pass . to select the current directory explicitly.
---device-name names this computer the first time it enrolls; once enrolled the name is reused. Press Ctrl+C to disconnect.`,
-  status: `Usage: glossa status [--json]
 
-Validates Google login, contacts the relay, and reports enrolled devices and active workers.`,
-  doctor: `Usage: glossa doctor [--json]
+Running glossa opens one workspace in an interactive terminal.
+Direct commands remain available for scripts and quick checks.
 
-Checks the runtime, relay and worker reachability, and read-only sign-in state, then reports whether Glossa is ready to start.`,
-  devices: `Usage:
-  glossa devices list [--json]
-  glossa devices rename <id> <name>
-  glossa devices revoke <id>
-
-Lists, renames, or revokes computers enrolled with the current Google account.`,
-  completions: `Usage: glossa completions <shell>
-
-Prints a completion script for powershell, bash, zsh, or fish. Source it from your shell profile, for example: glossa completions powershell | Out-String | Invoke-Expression.`,
-  update: `Usage: glossa update
-
-Updates Glossa using the same installation method. glossa upgrade is an alias.`,
-  login: `Usage: glossa login
-
-Ensures the CLI has a valid Google session. Starting Glossa also signs in automatically.`,
-  logout: `Usage: glossa logout [--browser]
-
-Removes local OAuth credentials. --browser also opens the browser-session logout used when switching Google accounts. Running workers remain connected until stopped or revoked.`
-};
+Keys:
+  d  recent activity
+  s  account and devices
+  r  revoke a device
+  l  sign out
+  u  update Glossa
+  ?  show all keys
+  q or Ctrl+C  disconnect and quit`;
 async function withLoginSignal(action) {
   const controller = new AbortController();
   const cancel = () => controller.abort();
@@ -15510,124 +15449,158 @@ async function withLoginSignal(action) {
     process.removeListener("SIGINT", cancel);
   }
 }
+async function authenticatedSession(signal) {
+  if (signal) return await signedInSession({ ...loadAuthConfig(), signal });
+  return await withLoginSignal(
+    async (loginSignal) => await signedInSession({ ...loadAuthConfig(), signal: loginSignal })
+  );
+}
 async function authenticatedCredentials(signal) {
-  const loginPerformed = signal ? await ensureSignedIn({ ...loadAuthConfig(), signal }) : await withLoginSignal(async (loginSignal) => {
-    return await ensureSignedIn({ ...loadAuthConfig(), signal: loginSignal });
-  });
-  const loaded = await loadCredentials();
-  if (!loaded) throw new Error("Glossa could not load the completed login.");
+  return (await authenticatedSession(signal)).credentials;
+}
+async function loadStatusDetails(signal) {
+  const credentials = await authenticatedCredentials(signal);
+  const endpoints = loadRelayEndpoints();
+  return await new WorkspaceStatusService(
+    credentials,
+    endpoints
+  ).refresh(signal, true);
+}
+function hudStatus(status) {
   return {
-    credentials: await validCredentials(
-      loaded.credentials,
-      signal ? { signal } : {}
-    ),
-    loginPerformed
+    ...status,
+    devices: status.devices.map((device) => ({
+      id: device.id,
+      name: device.name,
+      platform: device.platform ?? "Unknown platform",
+      lastSeen: formatRelativeTime(device.lastSeenAt),
+      status: deviceStatus(device)
+    }))
   };
 }
-async function runExposure(path8, allowBroadRoot, deviceName) {
-  const root = await selectExposureRoot(path8, allowBroadRoot);
-  await authenticatedCredentials();
-  await runManagedSession(root, loadRelayEndpoints(), allowBroadRoot, {
-    ...deviceName ? { deviceName } : {}
-  });
+async function revokeKnownDevice(deviceId) {
+  const credentials = await authenticatedCredentials();
+  await revokeDevice(loadRelayEndpoints(), credentials, deviceId);
 }
 async function showStatus(json2) {
-  const { credentials: initial } = await authenticatedCredentials();
-  const { credentials, profile } = await loadUserProfile(initial);
-  const endpoints = loadRelayEndpoints();
-  const devices = await listDevices(endpoints, credentials);
-  const account = profile.email ?? profile.name ?? profile.sub;
-  const workerCountsCurrent = devices.every((device) => device.activeWorkers !== null);
-  const activeWorkers = workerCountsCurrent ? devices.reduce((sum, device) => sum + device.activeWorkers, 0) : null;
-  const result = {
-    account,
-    relay: endpoints.relayOrigin,
-    connected: true,
-    activeWorkers,
-    devices
-  };
+  const status = await loadStatusDetails();
   if (json2) {
-    console.log(JSON.stringify(result, null, 2));
+    console.log(JSON.stringify({ ...status, connected: true }, null, 2));
     return;
   }
-  console.log(`Signed in as ${account}.`);
-  console.log(`Relay connected: ${endpoints.relayOrigin}`);
+  console.log(`Signed in as ${status.account}.`);
+  console.log(`Relay connected: ${status.relay}`);
   console.log(
-    activeWorkers === null ? "Active workers: unavailable until the relay is updated" : `Active workers: ${activeWorkers}`
+    status.activeWorkers === null ? "Active workspaces: unavailable" : `Active workspaces: ${status.activeWorkers}`
   );
-  if (devices.length === 0) {
-    console.log("No devices enrolled. Run glossa start in a workspace.");
-    return;
-  }
-  const hint = noActiveWorkerHint(activeWorkers, devices.length);
-  if (hint) console.log(hint);
-  for (const device of devices) {
-    console.log(formatDeviceRow(device));
+  if (status.devices.length === 0) {
+    console.log("No devices enrolled.");
+  } else {
+    for (const device of status.devices) console.log(formatDeviceRow(device));
   }
 }
-async function deviceCredentials() {
-  return {
-    credentials: (await authenticatedCredentials()).credentials,
-    endpoints: loadRelayEndpoints()
-  };
-}
 async function showDevices(json2) {
-  const { endpoints, credentials } = await deviceCredentials();
-  const devices = await listDevices(endpoints, credentials);
+  const credentials = await authenticatedCredentials();
+  const devices = await listDevices(loadRelayEndpoints(), credentials);
   if (json2) console.log(JSON.stringify({ devices }, null, 2));
   else if (devices.length === 0) console.log("No devices enrolled.");
   else for (const device of devices) console.log(formatDeviceRow(device));
 }
-async function runInteractive(path8, allowBroadRoot, deviceName) {
-  const root = await selectExposureRoot(path8, allowBroadRoot);
-  await runSessionHud({
-    workspace: root,
-    run: async (signal, onEvent) => {
-      await authenticatedCredentials(signal);
-      await runManagedSession(root, loadRelayEndpoints(), allowBroadRoot, {
-        signal,
-        onEvent,
-        quiet: true,
-        handleProcessSignals: false,
-        ...deviceName ? { deviceName } : {}
-      });
-    }
-  });
+async function runWorkspace(path7) {
+  const root = await selectExposureRoot(path7);
+  const endpoints = loadRelayEndpoints();
+  let credentials = (await authenticatedSession()).credentials;
+  let statusService;
+  let statusListener;
+  let postExitNotice;
+  let unsubscribeStatusService = () => void 0;
+  const createStatusService = (sessionCredentials) => {
+    unsubscribeStatusService();
+    const service = new WorkspaceStatusService(sessionCredentials, endpoints);
+    unsubscribeStatusService = service.subscribe((status) => {
+      statusListener?.(hudStatus(status));
+    });
+    statusService = service;
+    return service;
+  };
+  const refreshStatus = async (signal) => {
+    const service = statusService ?? createStatusService(
+      credentials
+    );
+    return hudStatus(await service.refresh(signal));
+  };
+  createStatusService(credentials);
+  let exitAction;
+  try {
+    exitAction = await runSessionHud({
+      workspace: root,
+      peekStatus: () => {
+        const cached2 = statusService?.peek();
+        return cached2 ? hudStatus(cached2) : void 0;
+      },
+      subscribeStatus: (listener) => {
+        statusListener = listener;
+        return () => {
+          if (statusListener === listener) statusListener = void 0;
+        };
+      },
+      run: async (signal, onEvent) => {
+        await runManagedSession(root, endpoints, {
+          credentials,
+          signal,
+          onEvent(event) {
+            onEvent(event);
+            if (event.type === "notice") postExitNotice = event.message;
+            if (event.type === "status" && event.status.state === "connected" && !statusService?.peek()) {
+              void statusService?.refresh(signal).catch(() => void 0);
+            }
+          },
+          quiet: true,
+          handleProcessSignals: false
+        });
+      },
+      loadStatus: refreshStatus,
+      revokeDevice: async (deviceId, signal) => {
+        credentials = await validCredentials(credentials, { signal });
+        await revokeDevice(
+          endpoints,
+          credentials,
+          deviceId,
+          async (input, init) => await fetch(input, { ...init, signal })
+        );
+      }
+    });
+  } finally {
+    unsubscribeStatusService();
+  }
+  if (postExitNotice) console.log(postExitNotice);
+  if (exitAction === "logout") await logoutFromGlossa();
+  else if (exitAction === "update") {
+    await updateGlossa({ currentVersion: VERSION });
+  }
 }
 async function main() {
   const invocation = parseInvocation(process.argv.slice(2));
   if (invocation.command === "help") {
-    console.log(helpText[invocation.topic ?? "main"]);
+    console.log(HELP);
   } else if (invocation.command === "version") {
     console.log(VERSION);
-  } else if (invocation.command === "ui") {
-    await runInteractive(invocation.path, invocation.allowBroadRoot, invocation.deviceName);
-  } else if (invocation.command === "start") {
-    await runExposure(invocation.path, invocation.allowBroadRoot, invocation.deviceName);
+  } else if (invocation.command === "workspace") {
+    await runWorkspace(invocation.path);
   } else if (invocation.command === "status") {
     await showStatus(invocation.json);
-  } else if (invocation.command === "doctor") {
-    const ok = await runDoctor(invocation.json);
-    if (!ok) process.exitCode = 1;
   } else if (invocation.command === "login") {
-    const { loginPerformed } = await authenticatedCredentials();
-    if (!loginPerformed) console.log("Signed in to Glossa.");
+    const session = await authenticatedSession();
+    if (!session.loginPerformed) console.log("Signed in to Glossa.");
   } else if (invocation.command === "logout") {
-    await logoutFromGlossa({ browser: invocation.browser });
-  } else if (invocation.command === "completions") {
-    console.log(completionScript(invocation.shell));
+    await logoutFromGlossa();
   } else if (invocation.command === "update") {
     await updateGlossa({ currentVersion: VERSION });
   } else if (invocation.action === "list") {
     await showDevices(invocation.json);
-  } else if (invocation.action === "rename") {
-    const { endpoints, credentials } = await deviceCredentials();
-    const device = await renameDevice(endpoints, credentials, invocation.deviceId, invocation.name);
-    console.log(`Renamed device ${device.id} to ${device.name}.`);
   } else {
-    const { endpoints, credentials } = await deviceCredentials();
-    await revokeDevice(endpoints, credentials, invocation.deviceId);
-    console.log(`Revoked device ${invocation.deviceId}. Running workers on it are disconnected.`);
+    await revokeKnownDevice(invocation.deviceId);
+    console.log(`Revoked device ${invocation.deviceId}. Running workspaces on it are disconnected.`);
   }
 }
 main().catch((error46) => {