@ariobarin/glossa 0.1.0-beta.10 → 0.1.0-beta.12

package/dist/app.js

@@ -5,6 +5,34 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/auth-config.ts
+var DEFAULT_AUTH_CONFIG = {
+  issuer: "https://dev-fl2h5xhp6umeh74m.us.auth0.com/",
+  clientId: "9mwnK9nTAd8q1kxnKIZxC1wodxzfWHg5",
+  audience: "https://mcp.glossa.sh/",
+  scope: "openid profile offline_access glossa:device"
+};
+function configuredValue(environment, name, fallback) {
+  const value = environment[name]?.trim();
+  return value || fallback;
+}
+function loadAuthConfig(environment = process.env) {
+  return {
+    issuer: configuredValue(environment, "GLOSSA_AUTH0_ISSUER", DEFAULT_AUTH_CONFIG.issuer),
+    clientId: configuredValue(
+      environment,
+      "GLOSSA_AUTH0_CLI_CLIENT_ID",
+      DEFAULT_AUTH_CONFIG.clientId
+    ),
+    audience: configuredValue(
+      environment,
+      "GLOSSA_AUTH0_AUDIENCE",
+      DEFAULT_AUTH_CONFIG.audience
+    ),
+    scope: DEFAULT_AUTH_CONFIG.scope
+  };
+}
+
 // src/config-store.ts
 import path2 from "node:path";
 
@@ -239,6 +267,21 @@ var SessionExpiredError = class extends Error {
     this.name = "SessionExpiredError";
   }
 };
+function accessTokenSubject(credentials) {
+  try {
+    const parts = credentials.accessToken.split(".");
+    if (parts.length !== 3) throw new Error();
+    const payload = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString("utf8")
+    );
+    if (typeof payload.sub !== "string" || payload.sub.length === 0) {
+      throw new Error();
+    }
+    return payload.sub;
+  } catch {
+    throw new Error("Glossa could not identify the signed-in account.");
+  }
+}
 function sessionExpiredError() {
   return new SessionExpiredError();
 }
@@ -331,34 +374,6 @@ async function loadUserProfile(credentials, dependencies = {}) {
   return { credentials: current, profile: parseProfile(await response.json()) };
 }
 
-// src/auth-config.ts
-var DEFAULT_AUTH_CONFIG = {
-  issuer: "https://dev-fl2h5xhp6umeh74m.us.auth0.com/",
-  clientId: "9mwnK9nTAd8q1kxnKIZxC1wodxzfWHg5",
-  audience: "https://mcp.glossa.sh/",
-  scope: "openid profile offline_access glossa:device"
-};
-function configuredValue(environment, name, fallback) {
-  const value = environment[name]?.trim();
-  return value || fallback;
-}
-function loadAuthConfig(environment = process.env) {
-  return {
-    issuer: configuredValue(environment, "GLOSSA_AUTH0_ISSUER", DEFAULT_AUTH_CONFIG.issuer),
-    clientId: configuredValue(
-      environment,
-      "GLOSSA_AUTH0_CLI_CLIENT_ID",
-      DEFAULT_AUTH_CONFIG.clientId
-    ),
-    audience: configuredValue(
-      environment,
-      "GLOSSA_AUTH0_AUDIENCE",
-      DEFAULT_AUTH_CONFIG.audience
-    ),
-    scope: DEFAULT_AUTH_CONFIG.scope
-  };
-}
-
 // src/device-flow.ts
 import { setTimeout as delay } from "node:timers/promises";
 
@@ -500,30 +515,34 @@ function credentialsMatchLoginOptions(credentials, options) {
     Boolean(credentials.refreshToken)
   );
 }
-async function ensureSignedIn(options, dependencies = {}) {
+async function signedInSession(options, dependencies = {}) {
   const load = dependencies.loadCredentials ?? loadCredentials;
   const validate = dependencies.validCredentials ?? validCredentials;
   const login = dependencies.loginWithDeviceFlow ?? loginWithDeviceFlow;
   const loaded = await load();
   if (loaded && credentialsMatchLoginOptions(loaded.credentials, options)) {
     try {
-      await validate(
+      const credentials = await validate(
         loaded.credentials,
         options.signal ? { signal: options.signal } : {}
       );
-      return false;
+      return { credentials, loginPerformed: false };
     } catch (error46) {
       if (!(error46 instanceof SessionExpiredError)) throw error46;
     }
   }
   await login(options);
-  return true;
+  const completed = await load();
+  if (!completed) throw new Error("Glossa could not load the completed login.");
+  return {
+    credentials: await validate(
+      completed.credentials,
+      options.signal ? { signal: options.signal } : {}
+    ),
+    loginPerformed: true
+  };
 }
 
-// src/cli-options.ts
-import { existsSync } from "node:fs";
-import path3 from "node:path";
-
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -13070,12 +13089,20 @@ config(en_default());
 var MAX_TEXT_BYTES = 1024 * 1024;
 var MAX_EDIT_DIFF_BYTES = 128 * 1024;
 var MAX_EDIT_OPERATIONS = 100;
+var MAX_COMMAND_OUTPUT_BYTES = 12 * 1024;
 var DEFAULT_COMMAND_TIMEOUT_MS = 15 * 60 * 1e3;
 var MAX_COMMAND_TIMEOUT_MS = 60 * 60 * 1e3;
 var DEFAULT_COMMAND_FAST_WAIT_MS = 750;
 var MAX_COMMAND_FAST_WAIT_MS = 5e3;
 var MAX_COMMAND_STATUS_WAIT_MS = 15e3;
+var MAX_LIST_FILES_RESULTS = 200;
+var MAX_SEARCH_TEXT_RESULTS = 100;
+var MAX_SEARCH_TEXT_SNIPPET_CHARS = 400;
+var MAX_READ_FILE_RANGE_LINES = 500;
+var MAX_READ_FILE_RANGE_BYTES = 64 * 1024;
+var MAX_STRUCTURED_READ_TIMEOUT_MS = 8e3;
 var deviceNameSchema = external_exports.string().trim().min(1).max(80).regex(/^[^\u0000-\u001f\u007f]+$/, "Device name contains control characters");
+var workspaceLabelSchema = external_exports.string().trim().min(1).max(80).regex(/^[^\u0000-\u001f\u007f]+$/, "Workspace label contains control characters");
 var relativePathSchema = external_exports.string().max(4096).describe("Path relative to the exposed workspace root. Absolute paths and parent traversal are rejected.");
 var boundedTextSchema = external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") <= MAX_TEXT_BYTES);
 var readFileRequestSchema = external_exports.object({
@@ -13085,6 +13112,41 @@ var readFileJobSchema = readFileRequestSchema.extend({
   type: external_exports.literal("read_file"),
   requestId: external_exports.string().uuid()
 });
+var structuredReadTimeoutSchema = external_exports.number().int().min(1).max(MAX_STRUCTURED_READ_TIMEOUT_MS);
+var listFilesCursorSchema = external_exports.string().max(4096).describe("Opaque cursor returned by an earlier list_files result.");
+var listFilesRequestSchema = external_exports.object({
+  path: relativePathSchema.optional().describe("Directory relative to the exposed root. Defaults to the root."),
+  recursive: external_exports.boolean().optional().describe("Whether to include descendants. Defaults to false."),
+  cursor: listFilesCursorSchema.optional(),
+  limit: external_exports.number().int().min(1).max(MAX_LIST_FILES_RESULTS).optional().describe("Maximum entries to return, from 1 through 200. Defaults to 100.")
+}).strict();
+var listFilesJobSchema = listFilesRequestSchema.extend({
+  type: external_exports.literal("list_files"),
+  requestId: external_exports.string().uuid(),
+  timeoutMs: structuredReadTimeoutSchema
+});
+var searchTextRequestSchema = external_exports.object({
+  query: external_exports.string().min(1).max(256).refine((value) => !/[\r\n\u0000]/.test(value), "Search text must fit on one line").describe("Literal single-line UTF-8 text to search for."),
+  path: relativePathSchema.optional().describe("File or directory relative to the exposed root. Defaults to the root."),
+  caseSensitive: external_exports.boolean().optional().describe("Whether matching is case-sensitive. Defaults to false."),
+  maxResults: external_exports.number().int().min(1).max(MAX_SEARCH_TEXT_RESULTS).optional().describe("Maximum matching lines to return, from 1 through 100. Defaults to 50."),
+  extensions: external_exports.array(external_exports.string().regex(/^\.[A-Za-z0-9][A-Za-z0-9._-]{0,19}$/).describe("Filename suffix including the leading dot, such as .ts or .d.ts.")).min(1).max(20).optional().describe("Optional filename extensions to search.")
+}).strict();
+var searchTextJobSchema = searchTextRequestSchema.extend({
+  type: external_exports.literal("search_text"),
+  requestId: external_exports.string().uuid(),
+  timeoutMs: structuredReadTimeoutSchema
+});
+var readFileRangeRequestSchema = external_exports.object({
+  path: relativePathSchema,
+  startLine: external_exports.number().int().min(1).optional().describe("First one-based line to return. Defaults to 1."),
+  lineCount: external_exports.number().int().min(1).max(MAX_READ_FILE_RANGE_LINES).optional().describe("Maximum complete lines to return, from 1 through 500. Defaults to 200.")
+}).strict();
+var readFileRangeJobSchema = readFileRangeRequestSchema.extend({
+  type: external_exports.literal("read_file_range"),
+  requestId: external_exports.string().uuid(),
+  timeoutMs: structuredReadTimeoutSchema
+});
 var writeFileRequestSchema = external_exports.object({
   path: relativePathSchema,
   content: boundedTextSchema.describe("Complete UTF-8 text content that will replace the file."),
@@ -13138,7 +13200,8 @@ var runCommandJobSchema = runCommandRequestSchema.safeExtend({
 });
 var getCommandRequestSchema = external_exports.object({
   commandId: external_exports.string().uuid().describe("Command identifier returned by run_command."),
-  waitMs: external_exports.number().int().min(0).max(MAX_COMMAND_STATUS_WAIT_MS).optional().describe("Optional long-poll duration in milliseconds, from 0 through 15000.")
+  waitMs: external_exports.number().int().min(0).max(MAX_COMMAND_STATUS_WAIT_MS).optional().describe("Optional long-poll duration in milliseconds, from 0 through 15000."),
+  afterSequence: external_exports.number().int().min(0).optional().describe("Sequence returned by an earlier command result. When current, wait for output or status to change.")
 }).strict();
 var getCommandJobSchema = getCommandRequestSchema.extend({
   type: external_exports.literal("get_command"),
@@ -13153,6 +13216,9 @@ var cancelCommandJobSchema = cancelCommandRequestSchema.extend({
 });
 var workerJobSchema = external_exports.discriminatedUnion("type", [
   readFileJobSchema,
+  listFilesJobSchema,
+  searchTextJobSchema,
+  readFileRangeJobSchema,
   writeFileJobSchema,
   editFileJobSchema,
   runCommandJobSchema,
@@ -13170,468 +13236,144 @@ var workerResultSchema = external_exports.object({
   }).optional()
 });
 
-// src/completions.ts
-var SUPPORTED_SHELLS = ["powershell", "bash", "zsh", "fish"];
-var commands = [
-  "ui",
-  "start",
-  "status",
-  "doctor",
-  "devices",
-  "completions",
-  "update",
-  "upgrade",
-  "login",
-  "logout"
-];
-function powershellScript() {
-  const list = commands.map((command) => `'${command}'`).join(", ");
-  return `# PowerShell completion for Glossa. Source it from your PowerShell profile.
-Register-ArgumentCompleter -Native -CommandName glossa -ScriptBlock {
-    param($wordToComplete, $commandAst, $cursorPosition)
-    $commands = @(${list})
-    $elements = $commandAst.CommandElements
-    $last = $elements[$elements.Count - 1]
-    # Position of the argument being completed (1 = first argument after glossa).
-    # A trailing space starts a new argument; otherwise we complete the last token.
-    if ($cursorPosition -gt $last.Extent.EndOffset) {
-        $position = $elements.Count
-    } else {
-        $position = $elements.Count - 1
-    }
-    if ($position -eq 1) {
-        @($commands + '--help' + '--version') |
-            Where-Object { $_ -like "$wordToComplete*" } |
-            ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_) }
-        return
-    }
-    $command = $elements[1].Value
-    if ($wordToComplete -like '-*') {
-        switch ($command) {
-            'ui' {
-                @('--allow-broad-root', '--device-name') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-            }
-            'start' {
-                @('--allow-broad-root', '--device-name') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-            }
-            'status' {
-                @('--json') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-            }
-            'doctor' {
-                @('--json') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-            }
-            'devices' {
-                if ($position -eq 3 -and $elements[2].Value -eq 'list') {
-                    @('--json') | Where-Object { $_ -like "$wordToComplete*" } |
-                        ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-                }
-            }
-            'logout' {
-                @('--browser') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterName', $_) }
-            }
-        }
-        return
-    }
-    if ($position -eq 2) {
-        switch ($command) {
-            'devices' {
-                @('list', 'rename', 'revoke') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_) }
-            }
-            'completions' {
-                @('powershell', 'bash', 'zsh', 'fish') | Where-Object { $_ -like "$wordToComplete*" } |
-                    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_) }
-            }
-        }
-    }
-}
-`;
-}
-function bashScript() {
-  return `# Bash completion for Glossa. Source it or install under /etc/bash_completion.d.
-_glossa() {
-  local cur="\${COMP_WORDS[COMP_CWORD]}"
-  if [ "$COMP_CWORD" -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "${commands.join(" ")} --help --version" -- "$cur") )
-    return
-  fi
-  local cmd="\${COMP_WORDS[1]}"
-  if [[ "$cur" == -* ]]; then
-    case "$cmd" in
-      ui|start) COMPREPLY=( $(compgen -W "--allow-broad-root --device-name" -- "$cur") ) ;;
-      status|doctor) COMPREPLY=( $(compgen -W "--json" -- "$cur") ) ;;
-      devices)
-        if [ "$COMP_CWORD" -eq 3 ] && [ "\${COMP_WORDS[2]}" = "list" ]; then
-          COMPREPLY=( $(compgen -W "--json" -- "$cur") )
-        fi ;;
-      logout) COMPREPLY=( $(compgen -W "--browser" -- "$cur") ) ;;
-    esac
-    return
-  fi
-  case "$cmd" in
-    devices)
-      if [ "$COMP_CWORD" -eq 2 ]; then
-        COMPREPLY=( $(compgen -W "list rename revoke" -- "$cur") )
-      fi ;;
-    completions)
-      if [ "$COMP_CWORD" -eq 2 ]; then
-        COMPREPLY=( $(compgen -W "powershell bash zsh fish" -- "$cur") )
-      fi ;;
-    ui|start) ;; # workspace directory: fall through to filename completion
-  esac
-}
-# -o default lets readline fall back to filename completion for workspace paths
-# when the completion function produces no matches.
-complete -o default -F _glossa glossa
-`;
-}
-function zshScript() {
-  return `# Zsh completion for Glossa. Source this after compinit from your profile.
-_glossa() {
-  local context state state_descr line
-  typeset -A opt_args
-  local -a glossa_commands
-  glossa_commands=(
-    'ui:open the interactive session HUD'
-    'start:expose a workspace'
-    'status:show account, relay, and active workers'
-    'doctor:check local and relay readiness'
-    'devices:manage enrolled computers'
-    'completions:emit a shell completion script'
-    'update:update the current Glossa installation'
-    'upgrade:alias for update'
-    'login:ensure a Glossa session'
-    'logout:remove local credentials'
-  )
-  _arguments -C '1:command or workspace:->commands' '*::argument:->args'
-  case "$state" in
-    commands)
-      _describe 'glossa command' glossa_commands
-      _files
-      ;;
-    args)
-      case $words[2] in
-        devices)
-          if (( CURRENT == 3 )); then
-            _values 'device action' list rename revoke
-          elif [[ $words[3] == list ]]; then
-            _arguments '--json[print machine-readable JSON]'
-          fi
-          ;;
-        completions) _arguments '2:shell:(powershell bash zsh fish)' ;;
-        ui|start)
-          _arguments             '--allow-broad-root[allow home or drive roots]'             '--device-name[name this computer on first enrollment]:device name:'             '2:workspace:_directories'
-          ;;
-        status|doctor) _arguments '--json[print machine-readable JSON]' ;;
-        logout) _arguments '--browser[also sign out of the browser session]' ;;
-      esac
-      ;;
-  esac
-}
-compdef _glossa glossa
-`;
-}
-function fishScript() {
-  const lines = [
-    "# Fish completion for Glossa. Source it or drop into ~/.config/fish/completions.",
-    // No global -f: the first argument may be a workspace directory, so fish
-    // should still offer files there.
-    ...commands.map(
-      (command) => `complete -c glossa -n '__fish_use_subcommand' -a '${command}'`
-    ),
-    "complete -c glossa -f -n '__fish_seen_subcommand_from devices; and test (count (commandline -opc)) -eq 2' -a 'list rename revoke'",
-    "complete -c glossa -f -n '__fish_seen_subcommand_from completions; and test (count (commandline -opc)) -eq 2' -a 'powershell bash zsh fish'",
-    "complete -c glossa -n '__fish_seen_subcommand_from ui start' -l allow-broad-root",
-    "complete -c glossa -n '__fish_seen_subcommand_from ui start' -l device-name -r",
-    "complete -c glossa -n '__fish_seen_subcommand_from status doctor' -l json",
-    "complete -c glossa -n '__fish_seen_subcommand_from devices; and contains -- list (commandline -opc)' -l json",
-    "complete -c glossa -n '__fish_seen_subcommand_from logout' -l browser",
-    ""
-  ];
-  return lines.join("\n");
-}
-function completionScript(shell) {
-  switch (shell) {
-    case "powershell":
-      return powershellScript();
-    case "bash":
-      return bashScript();
-    case "zsh":
-      return zshScript();
-    case "fish":
-      return fishScript();
-  }
-}
-
 // src/cli-options.ts
 var UsageError = class extends Error {
 };
-var helpTopics = /* @__PURE__ */ new Set([
-  "ui",
-  "start",
-  "status",
-  "doctor",
-  "devices",
+var retiredCommands = /* @__PURE__ */ new Set([
   "completions",
-  "update",
+  "doctor",
   "login",
-  "logout"
+  "start",
+  "update"
 ]);
-function parseDeviceName(value) {
-  const parsed = deviceNameSchema.safeParse(value);
-  if (!parsed.success) {
-    throw new UsageError(
-      "Device names must be 1 to 80 characters with no control characters."
-    );
-  }
-  return parsed.data;
-}
-function parseWorkspaceCommand(command, args) {
-  if (args.includes("--help") || args.includes("-h")) {
-    return { command: "help", topic: command };
-  }
+function parseWorkspace(args) {
   let selectedPath;
-  let allowBroadRoot = false;
-  let deviceName;
+  let label;
   let optionsEnded = false;
   for (let index = 0; index < args.length; index += 1) {
     const argument = args[index];
     if (!optionsEnded && argument === "--") {
       optionsEnded = true;
-    } else if (!optionsEnded && argument === "--allow-broad-root") {
-      allowBroadRoot = true;
-    } else if (!optionsEnded && argument === "--device-name") {
+    } else if (!optionsEnded && argument === "--label") {
+      if (label !== void 0) {
+        throw new UsageError("Glossa accepts at most one workspace label.");
+      }
       const value = args[index + 1];
-      if (value === void 0 || value.startsWith("-")) {
-        throw new UsageError("--device-name requires a value.");
+      if (value === void 0 || value === "--") {
+        throw new UsageError("Use --label <name>.");
+      }
+      const parsed = workspaceLabelSchema.safeParse(value);
+      if (!parsed.success) {
+        throw new UsageError("Workspace labels must be 1-80 printable characters.");
       }
-      deviceName = parseDeviceName(value);
+      label = parsed.data;
       index += 1;
-    } else if (!optionsEnded && argument.startsWith("--device-name=")) {
-      deviceName = parseDeviceName(argument.slice("--device-name=".length));
     } else if (!optionsEnded && argument.startsWith("-")) {
-      throw new UsageError(`Unknown ${command} option: ${argument}`);
+      throw new UsageError(`Unknown option: ${argument}`);
     } else if (selectedPath) {
-      throw new UsageError(`${command === "ui" ? "UI" : "Start"} accepts at most one directory.`);
+      throw new UsageError("Glossa accepts at most one directory.");
+    } else if (!optionsEnded && retiredCommands.has(argument)) {
+      throw new UsageError(`The ${argument} command is no longer available.`);
     } else {
       selectedPath = argument;
     }
   }
   return {
-    command,
+    command: "workspace",
     ...selectedPath ? { path: selectedPath } : {},
-    allowBroadRoot,
-    ...deviceName ? { deviceName } : {}
+    ...label ? { label } : {}
   };
 }
-function singleJsonOption(command, args) {
-  if (args.length === 0) return false;
-  if (args.length === 1 && args[0] === "--json") return true;
-  throw new UsageError(`${command} accepts only --json.`);
-}
 function parseDevices(args) {
-  const [action, ...options] = args;
-  if (!action || action === "--help" || action === "-h") {
-    return { command: "help", topic: "devices" };
-  }
-  if (action === "list") {
-    return { command: "devices", action, json: singleJsonOption("Devices list", options) };
-  }
-  if (action === "rename" && options.length === 2) {
-    return { command: "devices", action, deviceId: options[0], name: options[1] };
-  }
-  if (action === "revoke" && options.length === 1) {
-    return { command: "devices", action, deviceId: options[0] };
+  if (args[0] === "revoke" && args.length === 2) {
+    return { command: "devices", action: "revoke", deviceId: args[1] };
   }
-  throw new UsageError("Use: glossa devices list, rename <id> <name>, or revoke <id>.");
+  throw new UsageError("Use: glossa devices revoke <id>.");
 }
-function likelyDirectory(value) {
-  return value === "." || value === ".." || path3.isAbsolute(value) || value.includes("/") || value.includes("\\") || existsSync(value);
-}
-var KNOWN_COMMANDS = [
-  "ui",
-  "start",
-  "status",
-  "doctor",
-  "devices",
-  "completions",
-  "update",
-  "upgrade",
-  "login",
-  "logout"
-];
-function editDistance(a, b) {
-  const m = a.length;
-  const n = b.length;
-  if (m === 0) return n;
-  if (n === 0) return m;
-  let previous = Array.from({ length: n + 1 }, (_, index) => index);
-  for (let i = 1; i <= m; i += 1) {
-    const current = [i];
-    for (let j = 1; j <= n; j += 1) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      current[j] = Math.min(
-        previous[j] + 1,
-        current[j - 1] + 1,
-        previous[j - 1] + cost
-      );
-    }
-    previous = current;
-  }
-  return previous[n];
-}
-function suggestCommand(input) {
-  const lower = input.toLowerCase();
-  if (lower.length >= 3) {
-    const prefixMatches = KNOWN_COMMANDS.filter((command) => command.startsWith(lower));
-    if (prefixMatches.length === 1) return prefixMatches[0];
-  }
-  let best;
-  let bestDistance = Infinity;
-  for (const command of KNOWN_COMMANDS) {
-    const distance = editDistance(lower, command);
-    if (distance < bestDistance) {
-      bestDistance = distance;
-      best = command;
-    }
-  }
-  if (best && bestDistance <= 3 && bestDistance <= Math.ceil(lower.length / 2)) {
-    return best;
-  }
-  return void 0;
+function noOptions(command, args) {
+  if (args.length > 0) throw new UsageError(`${command} accepts no options.`);
 }
 function parseInvocation(args) {
   const [command, ...options] = args;
-  if (!command) return parseWorkspaceCommand("start", []);
+  if (!command) return parseWorkspace([]);
   if (command === "--help" || command === "-h") {
-    if (options.length > 0) throw new UsageError("Help accepts one command name.");
+    noOptions("Help", options);
     return { command: "help" };
   }
-  if (command === "help") {
-    if (options.length > 1) throw new UsageError("Help accepts one command name.");
-    const topic = options[0];
-    if (!topic) return { command: "help" };
-    if (!helpTopics.has(topic)) {
-      throw new UsageError(`Unknown help topic: ${topic}`);
-    }
-    return { command: "help", topic };
-  }
   if (command === "--version" || command === "-v") {
-    if (options.length > 0) throw new UsageError("Version accepts no arguments.");
+    noOptions("Version", options);
     return { command: "version" };
   }
-  if (command === "ui") return parseWorkspaceCommand("ui", options);
-  if (command === "start") return parseWorkspaceCommand("start", options);
+  if (command === "--") return parseWorkspace(args);
   if (command === "status") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "status" };
-    }
-    return { command: "status", json: singleJsonOption("Status", options) };
-  }
-  if (command === "doctor") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "doctor" };
-    }
-    return { command: "doctor", json: singleJsonOption("Doctor", options) };
+    noOptions("Status", options);
+    return { command };
   }
   if (command === "devices") return parseDevices(options);
-  if (command === "completions") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "completions" };
-    }
-    if (options.length !== 1) {
-      throw new UsageError("Use: glossa completions <shell>.");
-    }
-    const shell = options[0];
-    if (!SUPPORTED_SHELLS.includes(shell)) {
-      throw new UsageError(
-        `Unsupported shell: ${shell}. Use one of: ${SUPPORTED_SHELLS.join(", ")}.`
-      );
-    }
-    return { command: "completions", shell };
-  }
-  if (command === "update" || command === "upgrade") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "update" };
-    }
-    if (options.length > 0) {
-      throw new UsageError(`${command === "update" ? "Update" : "Upgrade"} accepts no arguments.`);
-    }
-    return { command: "update" };
-  }
-  if (command === "login") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "login" };
-    }
-    if (options.length > 0) throw new UsageError("Login accepts no arguments.");
-    return { command: "login" };
-  }
   if (command === "logout") {
-    if (options.includes("--help") || options.includes("-h")) {
-      return { command: "help", topic: "logout" };
-    }
-    if (options.length === 0) return { command: "logout", browser: false };
-    if (options.length === 1 && options[0] === "--browser") {
-      return { command: "logout", browser: true };
-    }
-    throw new UsageError("Logout accepts only --browser.");
+    noOptions("Logout", options);
+    return { command };
   }
-  if (command === "--") return parseWorkspaceCommand("start", options);
-  if (command.startsWith("-")) return parseWorkspaceCommand("start", args);
-  if (likelyDirectory(command)) return parseWorkspaceCommand("start", args);
-  const suggestion = suggestCommand(command);
-  throw new UsageError(
-    suggestion ? `Unknown command: ${command}. Did you mean "${suggestion}"?` : `Unknown command: ${command}`
-  );
+  return parseWorkspace(args);
 }
 
-// src/device-store.ts
-import path4 from "node:path";
-var FILE_DEVICE_WARNING = "Warning: the operating-system credential store is unavailable. Glossa is using a mode-0600 device credential file.";
-function parseDeviceCredential(value) {
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    throw new Error("Stored Glossa device credentials are invalid.");
-  }
-  let relayOriginValid = false;
-  if (typeof parsed.relayOrigin === "string") {
-    try {
-      relayOriginValid = new URL(parsed.relayOrigin).origin === parsed.relayOrigin;
-    } catch {
-      relayOriginValid = false;
-    }
-  }
-  if (!relayOriginValid || typeof parsed.deviceId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
-    parsed.deviceId
-  ) || typeof parsed.deviceName !== "string" || parsed.deviceName.length === 0 || typeof parsed.token !== "string" || !parsed.token.startsWith(`gld_${parsed.deviceId}_`)) {
-    throw new Error("Stored Glossa device credentials are invalid.");
-  }
-  return parsed;
+// src/device-format.ts
+function deviceStatus(device) {
+  if (device.revokedAt) return "revoked";
+  if (device.activeWorkers === null) return "worker count unavailable";
+  if (device.activeWorkers === 0) return "offline";
+  return `${device.activeWorkers} active ${device.activeWorkers === 1 ? "worker" : "workers"}`;
 }
-var store2 = new SecureStore({
-  account: "device",
-  file: path4.join(configDirectory(), "device.json"),
-  warning: FILE_DEVICE_WARNING,
-  parse: parseDeviceCredential
-});
-async function loadDeviceCredential() {
-  return (await store2.load())?.value ?? null;
+function formatRelativeTime(iso, now = Date.now()) {
+  if (!iso) return "never";
+  const parsed = Date.parse(iso);
+  if (!Number.isFinite(parsed)) return "unknown";
+  const seconds = Math.max(0, Math.round((now - parsed) / 1e3));
+  if (seconds < 60) return "just now";
+  const minutes = Math.round(seconds / 60);
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  const days = Math.round(hours / 24);
+  return `${days}d ago`;
 }
-async function peekDeviceCredential() {
-  return (await store2.peek())?.value ?? null;
+function formatDeviceRow(device, now = Date.now()) {
+  const platform = device.platform ?? "unknown platform";
+  return `${device.id}  ${device.name}  ${platform}  last seen ${formatRelativeTime(device.lastSeenAt, now)}  ${deviceStatus(device)}`;
 }
-async function saveDeviceCredential(credential) {
-  await store2.save(credential);
+
+// src/logout.ts
+function browserLogoutUrl(issuer) {
+  return new URL(
+    "v2/logout",
+    issuer.endsWith("/") ? issuer : `${issuer}/`
+  ).toString();
 }
-async function deleteDeviceCredential() {
-  await store2.delete();
+async function logoutFromGlossa(dependencies = {}) {
+  const remove = dependencies.deleteCredentials ?? deleteCredentials;
+  const peek = dependencies.peekCredentials ?? peekCredentials;
+  const browse = dependencies.openBrowser ?? openBrowser;
+  const log = dependencies.log ?? console.log;
+  let stored = null;
+  let present = true;
+  try {
+    stored = await peek();
+    present = stored !== null;
+  } catch {
+  }
+  const issuer = dependencies.issuer ?? stored?.credentials.issuer;
+  await remove();
+  log(
+    present ? "Signed out of Glossa." : "Already signed out of Glossa."
+  );
+  const url2 = browserLogoutUrl(issuer ?? loadAuthConfig().issuer);
+  const opened = await browse(url2);
+  if (opened) {
+    log("Opened Glossa browser sign-out.");
+  } else {
+    log("Open this URL to finish signing out in your browser:");
+    log(url2);
+  }
 }
 
 // src/relay-client.ts
@@ -13661,15 +13403,21 @@ function normalizedOrigin(value, kind) {
   }
   return url2.origin;
 }
-function loadRelayEndpoints(environment = process.env) {
-  const relayOrigin = normalizedOrigin(
+function loadRelayOrigin(environment = process.env) {
+  return normalizedOrigin(
     environment.GLOSSA_RELAY_ORIGIN?.trim() || DEFAULT_RELAY_ORIGIN,
     "relay"
   );
-  const workerOrigin = normalizedOrigin(
+}
+function loadWorkerOrigin(relayOrigin, environment = process.env) {
+  return normalizedOrigin(
     environment.GLOSSA_WORKER_ORIGIN?.trim() || relayOrigin,
     "worker"
   );
+}
+function loadRelayEndpoints(environment = process.env) {
+  const relayOrigin = loadRelayOrigin(environment);
+  const workerOrigin = loadWorkerOrigin(relayOrigin, environment);
   return { relayOrigin, workerOrigin };
 }
 function defaultDeviceName() {
@@ -13686,7 +13434,9 @@ function relayError(status, data) {
     );
   }
   if (status === 409 && data.error === "device_name_conflict") {
-    return new Error("A Glossa device already uses this name. Run glossa devices list, then rename or revoke the old device.");
+    return new Error(
+      "Glossa could not choose a unique name for this computer. Try again."
+    );
   }
   if (status === 404 && data.error === "device_not_found") {
     return new Error("The Glossa device was not found.");
@@ -13733,44 +13483,48 @@ async function accountOwnsDevice(endpoints, credentials, deviceId, fetchRequest
   );
 }
 async function enrollDevice(endpoints, credentials, deviceName, fetchRequest = fetch) {
-  const name = deviceNameSchema.parse(deviceName);
-  const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/enroll`, {
-    method: "POST",
-    headers: {
-      authorization: `${credentials.tokenType} ${credentials.accessToken}`,
-      "content-type": "application/json"
-    },
-    body: JSON.stringify({ name, platform: `${process.platform}-${process.arch}` })
-  });
-  let data = {};
-  try {
-    data = await response.json();
-  } catch {
-  }
-  if (!response.ok) throw relayError(response.status, data);
-  if (typeof data.device?.id !== "string" || typeof data.device.name !== "string" || typeof data.device_token !== "string") {
-    throw new Error("The Glossa relay returned an invalid device enrollment response.");
+  const baseName = deviceNameSchema.parse(deviceName);
+  let name = baseName;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/enroll`, {
+      method: "POST",
+      headers: {
+        authorization: `${credentials.tokenType} ${credentials.accessToken}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ name, platform: `${process.platform}-${process.arch}` })
+    });
+    let data = {};
+    try {
+      data = await response.json();
+    } catch {
+    }
+    if (response.status === 409 && data.error === "device_name_conflict" && attempt < 2) {
+      const activeNames = new Set(
+        (await listDevices(endpoints, credentials, fetchRequest)).filter((device) => device.revokedAt === null).map((device) => device.name)
+      );
+      for (let suffix = 2; ; suffix += 1) {
+        const ending = `-${suffix}`;
+        const candidate = `${baseName.slice(0, 80 - ending.length)}${ending}`;
+        if (!activeNames.has(candidate)) {
+          name = deviceNameSchema.parse(candidate);
+          break;
+        }
+      }
+      continue;
+    }
+    if (!response.ok) throw relayError(response.status, data);
+    if (typeof data.device?.id !== "string" || typeof data.device.name !== "string" || typeof data.device_token !== "string") {
+      throw new Error("The Glossa relay returned an invalid device enrollment response.");
+    }
+    return {
+      relayOrigin: endpoints.relayOrigin,
+      deviceId: data.device.id,
+      deviceName: data.device.name,
+      token: data.device_token
+    };
   }
-  return {
-    relayOrigin: endpoints.relayOrigin,
-    deviceId: data.device.id,
-    deviceName: data.device.name,
-    token: data.device_token
-  };
-}
-async function renameDevice(endpoints, credentials, deviceId, name, fetchRequest = fetch) {
-  const validName = deviceNameSchema.parse(name);
-  const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/${encodeURIComponent(deviceId)}`, {
-    method: "PATCH",
-    headers: {
-      authorization: `${credentials.tokenType} ${credentials.accessToken}`,
-      "content-type": "application/json"
-    },
-    body: JSON.stringify({ name: validName })
-  });
-  const data = await response.json().catch(() => ({}));
-  if (!response.ok) throw relayError(response.status, data);
-  return parseDevices2([data.device])[0];
+  throw new Error("Glossa could not enroll this computer.");
 }
 async function revokeDevice(endpoints, credentials, deviceId, fetchRequest = fetch) {
   const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/${encodeURIComponent(deviceId)}`, {
@@ -13785,671 +13539,331 @@ async function revokeDevice(endpoints, credentials, deviceId, fetchRequest = fet
   }
 }
 
-// src/runtime.ts
-function isStandaloneExecutable(value = true ? false : false) {
-  if (typeof value === "boolean") return value;
-  if (!value || typeof value !== "object") return false;
-  return value.isStandaloneExecutable === true;
-}
-
-// src/doctor.ts
-var MIN_NODE_MAJOR = 22;
-var MIN_NODE_MINOR = 9;
-var HEALTHZ_TIMEOUT_MS = 5e3;
-function nodeVersionSatisfies(version2) {
-  const match = /^v?(\d+)\.(\d+)/.exec(version2.trim());
-  if (!match) return false;
-  const major = Number(match[1]);
-  const minor = Number(match[2]);
-  if (!Number.isInteger(major) || !Number.isInteger(minor)) return false;
-  return major > MIN_NODE_MAJOR || major === MIN_NODE_MAJOR && minor >= MIN_NODE_MINOR;
-}
-async function runDoctorChecks(dependencies = {}) {
-  const standalone = dependencies.standalone ?? isStandaloneExecutable();
-  const checks = [];
-  if (standalone) {
-    const runtimeReady = await (dependencies.probeStandaloneRuntime ?? defaultProbeStandaloneRuntime)();
-    checks.push({
-      name: "Runtime",
-      status: runtimeReady ? "pass" : "fail",
-      detail: runtimeReady ? "Self-contained Glossa executable." : "The executable is missing its native credential module.",
-      ...runtimeReady ? {} : { nextStep: "Reinstall Glossa with npm or the direct installer." }
-    });
+// src/status-display.ts
+function formatStatus(status) {
+  const lines = [
+    `Signed in as ${status.account}.`,
+    `Relay connected: ${status.relay}`
+  ];
+  if (status.activeWorkers === null) {
+    lines.push("Active workspaces: unavailable");
+  } else if (status.activeWorkers === 0) {
+    lines.push("No active workspaces. Run glossa from the project folder you want to expose.");
   } else {
-    const nodeVersion = dependencies.nodeVersion ?? process.versions.node;
-    const nodeOk = nodeVersionSatisfies(nodeVersion);
-    const displayedNodeVersion = nodeVersion.startsWith("v") ? nodeVersion : `v${nodeVersion}`;
-    checks.push({
-      name: "Node.js",
-      status: nodeOk ? "pass" : "fail",
-      detail: `Node.js ${displayedNodeVersion}`,
-      ...nodeOk ? {} : { nextStep: `Install Node.js ${MIN_NODE_MAJOR}.${MIN_NODE_MINOR} or newer and restart your terminal.` }
-    });
+    lines.push(`Active workspaces: ${status.activeWorkers}`);
   }
-  let endpoints = dependencies.endpoints;
-  if (!endpoints) {
+  if (status.devices.length === 0) lines.push("No active devices.");
+  else lines.push(...status.devices.map((device) => formatDeviceRow(device)));
+  return lines;
+}
+
+// src/status-service.ts
+function accountLabel(profile) {
+  return profile.email ?? profile.name ?? profile.sub;
+}
+function activeWorkerCount(devices) {
+  if (devices.some((device) => device.activeWorkers === null)) return null;
+  return devices.reduce((sum, device) => sum + device.activeWorkers, 0);
+}
+var WorkspaceStatusService = class {
+  constructor(credentials, endpoints, dependencies = {}) {
+    this.endpoints = endpoints;
+    this.dependencies = dependencies;
+    this.#credentials = credentials;
+  }
+  endpoints;
+  dependencies;
+  #credentials;
+  #inFlight;
+  async refresh(signal) {
+    if (this.#inFlight) return await this.#inFlight;
+    const pending = this.#load(signal);
+    this.#inFlight = pending;
     try {
-      endpoints = (dependencies.loadEndpoints ?? loadRelayEndpoints)();
-    } catch (error46) {
-      const message = error46 instanceof Error ? error46.message : String(error46);
-      checks.push({
-        name: "Relay",
-        status: "fail",
-        detail: `Endpoint configuration is invalid: ${message}`,
-        nextStep: "Set GLOSSA_RELAY_ORIGIN and GLOSSA_WORKER_ORIGIN to origin URLs only, without paths."
-      });
+      return await pending;
+    } finally {
+      if (this.#inFlight === pending) this.#inFlight = void 0;
     }
   }
-  if (endpoints) {
-    const fetchHealthz = dependencies.fetchHealthz ?? defaultFetchHealthz;
-    const relayOk = await fetchHealthz(endpoints.relayOrigin);
-    checks.push({
-      name: "Relay",
-      status: relayOk ? "pass" : "fail",
-      detail: relayOk ? `${endpoints.relayOrigin} is reachable.` : `${endpoints.relayOrigin} is not reachable.`,
-      ...relayOk ? {} : { nextStep: "Check your internet connection. If you self-host, confirm GLOSSA_RELAY_ORIGIN." }
+  async #load(signal) {
+    const validate = this.dependencies.validCredentials ?? validCredentials;
+    const devicesForAccount = this.dependencies.listDevices ?? listDevices;
+    const profileForAccount = this.dependencies.loadUserProfile ?? loadUserProfile;
+    const baseFetch = this.dependencies.fetch ?? fetch;
+    const fetchRequest = signal ? async (input, init) => await baseFetch(input, { ...init, signal }) : baseFetch;
+    this.#credentials = await validate(
+      this.#credentials,
+      signal ? { signal } : {}
+    );
+    const requestCredentials = this.#credentials;
+    const profileRequest = profileForAccount(
+      requestCredentials,
+      signal ? { signal, fetch: fetchRequest } : { fetch: fetchRequest }
+    ).catch((error46) => {
+      if (signal?.aborted) throw error46;
+      return null;
     });
-    if (endpoints.workerOrigin !== endpoints.relayOrigin) {
-      const workerOk = await fetchHealthz(endpoints.workerOrigin);
-      checks.push({
-        name: "Worker",
-        status: workerOk ? "pass" : "fail",
-        detail: workerOk ? `${endpoints.workerOrigin} is reachable.` : `${endpoints.workerOrigin} is not reachable.`,
-        ...workerOk ? {} : { nextStep: "Confirm GLOSSA_WORKER_ORIGIN and the worker endpoint reverse proxy." }
-      });
-    }
-  }
-  const probeCredentials = dependencies.probeCredentials ?? defaultProbeCredentials;
-  const credentialState = await probeCredentials();
-  checks.push(signInCheck(credentialState));
-  const probeDeviceCredential = dependencies.probeDeviceCredential ?? defaultProbeDeviceCredential;
-  const deviceCredentialState = await probeDeviceCredential();
-  checks.push(deviceCredentialCheck(deviceCredentialState));
-  return checks;
-}
-async function defaultProbeStandaloneRuntime() {
-  try {
-    const keyring = await import("@napi-rs/keyring");
-    return typeof keyring.AsyncEntry === "function";
-  } catch {
-    return false;
-  }
-}
-function signInCheck(state) {
-  if (state === "present") {
-    return { name: "Sign-in", status: "pass", detail: "Signed in to Glossa." };
-  }
-  if (state === "absent") {
+    const devicesRequest = devicesForAccount(
+      this.endpoints,
+      requestCredentials,
+      fetchRequest
+    );
+    const [profile, devices] = await Promise.all([
+      profileRequest,
+      devicesRequest
+    ]);
+    if (profile) this.#credentials = profile.credentials;
+    const activeDevices = devices.filter((device) => device.revokedAt === null);
     return {
-      name: "Sign-in",
-      status: "warn",
-      detail: "Not signed in yet.",
-      nextStep: 'Run "glossa" inside a workspace. Sign-in opens automatically.'
+      account: profile ? accountLabel(profile.profile) : "Account unavailable",
+      relay: this.endpoints.relayOrigin,
+      activeWorkers: activeWorkerCount(activeDevices),
+      devices: activeDevices
     };
   }
-  return {
-    name: "Sign-in",
-    status: "fail",
-    detail: "Stored credentials are unreadable.",
-    nextStep: 'Run "glossa logout" to clear them, then start Glossa again.'
-  };
+};
+
+// src/ui-hud.ts
+import { emitKeypressEvents } from "node:readline";
+
+// src/first-run.ts
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import path3 from "node:path";
+var CONNECT_HINT_FILE = "connect-hint-shown";
+var CONNECT_HINT_URL = "https://glossa.sh/docs/quickstart";
+function shouldShowConnectHint(relayOrigin) {
+  return relayOrigin === DEFAULT_RELAY_ORIGIN;
 }
-function deviceCredentialCheck(state) {
-  if (state === "present") {
-    return {
-      name: "Device",
-      status: "pass",
-      detail: "Device credentials are readable."
-    };
-  }
-  if (state === "absent") {
-    return {
-      name: "Device",
-      status: "warn",
-      detail: "No device is enrolled on this computer yet.",
-      nextStep: 'Run "glossa --device-name <name> ." inside a workspace to enroll it.'
-    };
-  }
+function connectHintStore(directory = configDirectory()) {
+  const file2 = path3.join(directory, CONNECT_HINT_FILE);
   return {
-    name: "Device",
-    status: "fail",
-    detail: "Stored device credentials are unreadable.",
-    nextStep: "Remove the local Glossa device credential from the operating-system credential store (or the device.json fallback), then start Glossa again to re-enroll."
-  };
-}
-function formatDoctorResult(checks, json2) {
-  if (json2) return JSON.stringify({ checks }, null, 2);
-  const nameWidth = Math.max(...checks.map((check2) => check2.name.length));
-  const lines = ["Glossa doctor", ""];
-  for (const check2 of checks) {
-    const name = check2.name.padEnd(nameWidth);
-    lines.push(`  ${name}  ${check2.status.toUpperCase()}  ${check2.detail}`);
-    if (check2.nextStep) {
-      lines.push(`  ${" ".repeat(nameWidth)}  ${check2.nextStep}`);
+    async exists() {
+      try {
+        await readFile2(file2, "utf8");
+        return true;
+      } catch (error46) {
+        if (error46.code === "ENOENT") return false;
+        throw error46;
+      }
+    },
+    async mark() {
+      await mkdir2(directory, { recursive: true, mode: 448 });
+      await writeFile2(file2, "", { encoding: "utf8", mode: 384 });
     }
-  }
-  const failed = checks.filter((check2) => check2.status === "fail").length;
-  lines.push("");
-  lines.push(
-    failed === 0 ? "Glossa is ready to start." : `${failed} check${failed === 1 ? "" : "s"} failed. Resolve the items above before starting.`
-  );
-  return lines.join("\n");
+  };
 }
-async function runDoctor(json2, dependencies = {}, log = console.log) {
-  const checks = await runDoctorChecks(dependencies);
-  log(formatDoctorResult(checks, json2));
-  return checks.every((check2) => check2.status !== "fail");
+async function announceConnectHint(store3, log) {
+  if (await store3.exists()) return false;
+  log(`Next: add Glossa in ChatGPT. Follow the quickstart at ${CONNECT_HINT_URL}.`);
+  await store3.mark();
+  return true;
 }
-async function defaultFetchHealthz(origin) {
+
+// src/device-store.ts
+import path4 from "node:path";
+var FILE_DEVICE_WARNING = "Warning: the operating-system credential store is unavailable. Glossa is using a mode-0600 device credential file.";
+function parseDeviceCredential(value) {
+  let parsed;
   try {
-    const response = await fetch(`${origin}/healthz`, {
-      signal: AbortSignal.timeout(HEALTHZ_TIMEOUT_MS)
-    });
-    if (!response.ok) return false;
-    const data = await response.json();
-    return data.ok === true && data.service === "glossa-relay";
+    parsed = JSON.parse(value);
   } catch {
-    return false;
+    throw new Error("Stored Glossa device credentials are invalid.");
   }
-}
-async function defaultProbeCredentials() {
-  try {
-    return await peekCredentials() !== null ? "present" : "absent";
-  } catch {
-    return "error";
+  let relayOriginValid = false;
+  if (typeof parsed.relayOrigin === "string") {
+    try {
+      relayOriginValid = new URL(parsed.relayOrigin).origin === parsed.relayOrigin;
+    } catch {
+      relayOriginValid = false;
+    }
   }
-}
-async function defaultProbeDeviceCredential() {
-  try {
-    return await peekDeviceCredential() !== null ? "present" : "absent";
-  } catch {
-    return "error";
+  if (!relayOriginValid || typeof parsed.deviceId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
+    parsed.deviceId
+  ) || typeof parsed.deviceName !== "string" || parsed.deviceName.length === 0 || parsed.accountSubject !== void 0 && (typeof parsed.accountSubject !== "string" || parsed.accountSubject.length === 0) || typeof parsed.token !== "string" || !parsed.token.startsWith(`gld_${parsed.deviceId}_`)) {
+    throw new Error("Stored Glossa device credentials are invalid.");
   }
+  return parsed;
 }
-
-// src/device-format.ts
-function deviceStatus(device) {
-  if (device.revokedAt) return "revoked";
-  if (device.activeWorkers === null) return "worker count unavailable";
-  if (device.activeWorkers === 0) return "offline";
-  return `${device.activeWorkers} active ${device.activeWorkers === 1 ? "worker" : "workers"}`;
+var store2 = new SecureStore({
+  account: "device",
+  file: path4.join(configDirectory(), "device.json"),
+  warning: FILE_DEVICE_WARNING,
+  parse: parseDeviceCredential
+});
+async function loadDeviceCredential() {
+  return (await store2.load())?.value ?? null;
 }
-function formatRelativeTime(iso, now = Date.now()) {
-  if (!iso) return "never";
-  const parsed = Date.parse(iso);
-  if (!Number.isFinite(parsed)) return "unknown";
-  const seconds = Math.max(0, Math.round((now - parsed) / 1e3));
-  if (seconds < 60) return "just now";
-  const minutes = Math.round(seconds / 60);
-  if (minutes < 60) return `${minutes}m ago`;
-  const hours = Math.round(minutes / 60);
-  if (hours < 24) return `${hours}h ago`;
-  const days = Math.round(hours / 24);
-  return `${days}d ago`;
+async function saveDeviceCredential(credential) {
+  await store2.save(credential);
 }
-function formatDeviceRow(device, now = Date.now()) {
-  const platform = device.platform ?? "unknown platform";
-  return `${device.id}  ${device.name}  ${platform}  last seen ${formatRelativeTime(device.lastSeenAt, now)}  ${deviceStatus(device)}`;
+async function deleteDeviceCredential() {
+  await store2.delete();
 }
 
-// src/logout.ts
-function browserLogoutUrl(issuer) {
-  return new URL(
-    "v2/logout",
-    issuer.endsWith("/") ? issuer : `${issuer}/`
-  ).toString();
-}
-async function logoutFromGlossa(options, dependencies = {}) {
-  const remove = dependencies.deleteCredentials ?? deleteCredentials;
-  const peek = dependencies.peekCredentials ?? peekCredentials;
-  const browse = dependencies.openBrowser ?? openBrowser;
-  const log = dependencies.log ?? console.log;
-  let stored = null;
-  let present = true;
-  try {
-    stored = await peek();
-    present = stored !== null;
-  } catch {
-  }
-  const issuer = dependencies.issuer ?? stored?.credentials.issuer;
-  await remove();
-  log(
-    present ? "Signed out of Glossa locally." : "Already signed out of Glossa locally."
-  );
-  if (!options.browser) return;
-  const url2 = browserLogoutUrl(issuer ?? loadAuthConfig().issuer);
-  const opened = await browse(url2);
-  if (opened) {
-    log("Opened Glossa browser sign-out.");
-  } else {
-    log("Open this URL to finish signing out in your browser:");
-    log(url2);
-  }
-  log(
-    "Reconnect Glossa in ChatGPT, then choose the same Google account when the CLI signs in."
-  );
-}
+// src/worker/command-service.ts
+import { spawn as spawn2 } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { StringDecoder } from "node:string_decoder";
+import { setTimeout as delay2 } from "node:timers/promises";
 
-// src/status-guidance.ts
-function noActiveWorkerHint(activeWorkers, deviceCount) {
-  if (deviceCount === 0) return null;
-  if (activeWorkers === 0) {
-    return 'No active workers. Run "glossa" inside a workspace so ChatGPT can use it.';
+// src/worker/errors.ts
+var WorkerError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "WorkerError";
   }
-  return null;
-}
+  code;
+};
 
-// src/update.ts
-import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import {
-  chmodSync,
-  existsSync as existsSync2,
-  renameSync,
-  rmSync,
-  writeFileSync
-} from "node:fs";
-var NPM_PACKAGE = "@ariobarin/glossa@beta";
-var DEFAULT_RELEASES_API = "https://api.github.com/repos/ariobarin/glossa/releases?per_page=20";
-function npmUpdateInvocation(platform = process.platform, environment = process.env) {
-  if (platform === "win32") {
-    return {
-      command: environment.ComSpec ?? environment.COMSPEC ?? "cmd.exe",
-      args: ["/d", "/s", "/c", `npm install --global ${NPM_PACKAGE}`]
-    };
-  }
-  return {
-    command: "npm",
-    args: ["install", "--global", NPM_PACKAGE]
-  };
-}
-function standaloneAssetName(platform = process.platform, architecture = process.arch) {
-  const operatingSystem = platform === "win32" ? "windows" : platform === "darwin" ? "macos" : platform === "linux" ? "linux" : null;
-  if (!operatingSystem || !["x64", "arm64"].includes(architecture)) {
-    throw new Error(
-      `The direct Glossa installer does not support ${platform}/${architecture}. Use npm instead.`
-    );
-  }
-  return `glossa-${operatingSystem}-${architecture}${platform === "win32" ? ".exe" : ""}`;
-}
-function selectStandaloneRelease(value, assetName) {
-  if (!Array.isArray(value)) {
-    throw new Error("The Glossa release service returned an invalid response.");
-  }
-  for (const candidate of value) {
-    if (candidate.draft === true || typeof candidate.tag_name !== "string") {
-      continue;
-    }
-    if (!candidate.tag_name.startsWith("cli-v") || !Array.isArray(candidate.assets)) {
-      continue;
-    }
-    const assets = candidate.assets;
-    const binary = assets.find((asset) => asset.name === assetName);
-    const checksum = assets.find(
-      (asset) => asset.name === `${assetName}.sha256`
+// src/worker/command-service.ts
+var STREAM_HEAD_BYTES = Math.floor(MAX_COMMAND_OUTPUT_BYTES / 3);
+var STREAM_TAIL_BYTES = MAX_COMMAND_OUTPUT_BYTES - STREAM_HEAD_BYTES;
+function appendTail(existing, chunk) {
+  if (chunk.byteLength >= STREAM_TAIL_BYTES) {
+    return Buffer.from(chunk.subarray(chunk.byteLength - STREAM_TAIL_BYTES));
+  }
+  const combined = existing.byteLength === 0 ? chunk : Buffer.concat([existing, chunk]);
+  return combined.byteLength <= STREAM_TAIL_BYTES ? combined : combined.subarray(combined.byteLength - STREAM_TAIL_BYTES);
+}
+function capture(_record2, stream, chunk) {
+  if (chunk.byteLength === 0) return false;
+  stream.totalBytes += chunk.byteLength;
+  let offset = 0;
+  if (stream.headBytes < STREAM_HEAD_BYTES) {
+    const accepted = chunk.subarray(
+      0,
+      Math.min(chunk.byteLength, STREAM_HEAD_BYTES - stream.headBytes)
     );
-    if (typeof binary?.browser_download_url === "string" && typeof checksum?.browser_download_url === "string") {
-      return {
-        version: candidate.tag_name.slice("cli-v".length),
-        binaryUrl: binary.browser_download_url,
-        checksumUrl: checksum.browser_download_url
-      };
+    if (accepted.byteLength > 0) {
+      stream.head.push(Buffer.from(accepted));
+      stream.headBytes += accepted.byteLength;
+      offset = accepted.byteLength;
     }
   }
-  throw new Error(
-    `No Glossa direct-install release contains ${assetName}. Use npm or try again after the next release.`
-  );
-}
-function expectedChecksum(text, assetName) {
-  for (const line of text.split(/\r?\n/)) {
-    const match = /^([a-fA-F0-9]{64})\s+\*?(.+)$/.exec(line.trim());
-    if (match?.[1] && match[2] === assetName) return match[1].toLowerCase();
+  if (offset < chunk.byteLength) {
+    stream.tail = appendTail(stream.tail, chunk.subarray(offset));
   }
-  throw new Error(`The checksum file did not contain ${assetName}.`);
+  return true;
 }
-async function checkedFetch(fetcher, url2) {
-  const response = await fetcher(url2, {
-    headers: { "User-Agent": "glossa-cli" }
-  });
-  if (!response.ok) {
-    throw new Error(`Download failed with HTTP ${response.status}: ${url2}`);
-  }
-  return response;
-}
-async function updateStandalone(dependencies) {
-  const platform = dependencies.platform ?? process.platform;
-  const architecture = dependencies.architecture ?? process.arch;
-  const environment = dependencies.environment ?? process.env;
-  const executablePath = dependencies.executablePath ?? process.execPath;
-  const fetcher = dependencies.fetch ?? fetch;
-  const assetName = standaloneAssetName(platform, architecture);
-  const releasesUrl = environment.GLOSSA_RELEASES_API ?? DEFAULT_RELEASES_API;
-  const releasesResponse = await checkedFetch(fetcher, releasesUrl);
-  const release = selectStandaloneRelease(
-    await releasesResponse.json(),
-    assetName
-  );
-  if (release.version === dependencies.currentVersion) {
-    return `Glossa ${release.version} is already current.`;
-  }
-  const [binaryResponse, checksumResponse] = await Promise.all([
-    checkedFetch(fetcher, release.binaryUrl),
-    checkedFetch(fetcher, release.checksumUrl)
-  ]);
-  const binary = Buffer.from(await binaryResponse.arrayBuffer());
-  const expected = expectedChecksum(await checksumResponse.text(), assetName);
-  const actual = createHash("sha256").update(binary).digest("hex");
-  if (actual !== expected) {
-    throw new Error(
-      `Glossa refused the update because the SHA-256 checksum did not match.`
-    );
+function markChanged(record2) {
+  record2.sequence += 1;
+  const waiters = [...record2.changeWaiters];
+  record2.changeWaiters.clear();
+  for (const waiter of waiters) waiter();
+}
+async function waitForChange(record2, afterSequence, waitMs) {
+  if (record2.status !== "running" || record2.sequence > afterSequence || waitMs === 0) {
+    return;
   }
-  const downloadPath = `${executablePath}.download-${process.pid}`;
-  const backupPath = `${executablePath}.old`;
-  writeFileSync(downloadPath, binary, { mode: 493 });
-  if (platform !== "win32") chmodSync(downloadPath, 493);
+  let changed;
+  const change = new Promise((resolve) => {
+    changed = resolve;
+    record2.changeWaiters.add(changed);
+  });
+  const waitController = new AbortController();
   try {
-    if (platform === "win32") {
-      rmSync(backupPath, { force: true });
-      renameSync(executablePath, backupPath);
-      try {
-        renameSync(downloadPath, executablePath);
-      } catch (error46) {
-        renameSync(backupPath, executablePath);
-        throw error46;
-      }
-      try {
-        rmSync(backupPath, { force: true });
-      } catch {
-      }
-    } else {
-      renameSync(downloadPath, executablePath);
-    }
+    await Promise.race([
+      change,
+      delay2(waitMs, void 0, { signal: waitController.signal })
+    ]);
   } finally {
-    if (existsSync2(downloadPath)) rmSync(downloadPath, { force: true });
+    record2.changeWaiters.delete(changed);
+    waitController.abort();
   }
-  return `Updated Glossa to ${release.version}.`;
 }
-async function updateGlossa(dependencies = {}) {
-  const log = dependencies.log ?? console.log;
-  const standalone = dependencies.standalone ?? isStandaloneExecutable();
-  if (standalone) {
-    log("Updating the standalone Glossa executable...");
-    const message = dependencies.updateStandalone ? await dependencies.updateStandalone() : await updateStandalone(dependencies);
-    log(message);
-    return;
+function emptyCapture() {
+  return {
+    head: [],
+    headBytes: 0,
+    tail: Buffer.alloc(0),
+    totalBytes: 0
+  };
+}
+function retainedBytes(stream, complete) {
+  const head = Buffer.concat(stream.head, stream.headBytes);
+  const retained = Buffer.concat([head, stream.tail]);
+  const content = stream.totalBytes <= MAX_COMMAND_OUTPUT_BYTES ? complete ? retained.toString("utf8") : new StringDecoder("utf8").write(retained) : safePrefix(head) + safeSuffix(stream.tail);
+  return Math.min(Buffer.byteLength(content), MAX_COMMAND_OUTPUT_BYTES);
+}
+function safePrefix(buffer) {
+  return new StringDecoder("utf8").write(buffer);
+}
+function safeSuffix(buffer) {
+  let start = 0;
+  while (start < buffer.byteLength && (buffer[start] & 192) === 128) {
+    start += 1;
+  }
+  return new StringDecoder("utf8").write(buffer.subarray(start));
+}
+function utf8PrefixWithinBudget(value, budget) {
+  let used = 0;
+  let end = 0;
+  for (const character of value) {
+    const bytes = Buffer.byteLength(character);
+    if (used + bytes > budget) break;
+    used += bytes;
+    end += character.length;
+  }
+  return value.slice(0, end);
+}
+function utf8SuffixWithinBudget(value, budget) {
+  const characters = Array.from(value);
+  let used = 0;
+  let start = characters.length;
+  while (start > 0) {
+    const bytes = Buffer.byteLength(characters[start - 1]);
+    if (used + bytes > budget) break;
+    used += bytes;
+    start -= 1;
+  }
+  return characters.slice(start).join("");
+}
+function renderStream(stream, budget, complete) {
+  if (budget <= 0 || stream.totalBytes === 0) {
+    return { content: "", truncated: stream.totalBytes > 0 };
+  }
+  const head = Buffer.concat(stream.head, stream.headBytes);
+  const retained = Buffer.concat([head, stream.tail]);
+  if (stream.totalBytes <= budget) {
+    const content = complete ? retained.toString("utf8") : new StringDecoder("utf8").write(retained);
+    if (Buffer.byteLength(content) <= budget) {
+      return { content, truncated: false };
+    }
+    const prefixBudget2 = Math.floor(budget / 3);
+    return {
+      content: utf8PrefixWithinBudget(content, prefixBudget2) + utf8SuffixWithinBudget(content, budget - prefixBudget2),
+      truncated: true
+    };
   }
-  const run = dependencies.run ?? spawnSync;
-  const invocation = npmUpdateInvocation(
-    dependencies.platform,
-    dependencies.environment
-  );
-  log("Updating Glossa from npm...");
-  const result = run(invocation.command, invocation.args, { stdio: "inherit" });
-  if (result.error) {
-    throw new Error(`Glossa could not start npm: ${result.error.message}`);
-  }
-  if (result.status !== 0) {
-    throw new Error(
-      `npm could not update Glossa (exit ${result.status ?? "unknown"}).`
-    );
-  }
-  log("Glossa updated. Run glossa --version to verify the installed version.");
-}
-
-// src/ui-hud.ts
-import { emitKeypressEvents } from "node:readline";
-function initialHudState(workspace) {
+  const headBudget = Math.min(head.byteLength, Math.floor(budget / 3));
+  const tailBudget = Math.min(stream.tail.byteLength, budget - headBudget);
+  const remaining = budget - headBudget - tailBudget;
+  const extraHead = Math.min(remaining, head.byteLength - headBudget);
+  const prefixBudget = headBudget + extraHead;
+  const prefix = head.subarray(0, headBudget + extraHead);
+  const suffix = stream.tail.subarray(stream.tail.byteLength - tailBudget);
   return {
-    workspace,
-    connection: "starting",
-    message: void 0,
-    activities: [],
-    showDetails: false,
-    showHelp: false
-  };
-}
-function activityLabel(event) {
-  const noun = event.jobType === "write_file" ? "File write" : event.jobType === "edit_file" ? "File edit" : event.jobType === "run_command" ? "Command" : "Cancellation";
-  if (event.phase === "requested") return `${noun} requested`;
-  if (event.jobType === "run_command") return `Command ${event.ok ? "started" : "rejected"}`;
-  return `${noun} ${event.ok ? "completed" : "rejected"}`;
-}
-function applyHudEvent(state, event) {
-  if (event.type === "session") {
-    return { ...state, workspace: event.root, deviceName: event.deviceName };
-  }
-  if (event.type === "status") {
-    if (event.status.state === "retrying") {
-      return { ...state, connection: "retrying", message: event.status.error.message };
-    }
-    return { ...state, connection: event.status.state, message: void 0 };
-  }
-  if (event.type === "notice") return { ...state, message: event.message };
-  const activity = event.phase === "finished" ? { label: activityLabel(event), requestId: event.requestId, ok: event.ok } : { label: activityLabel(event), requestId: event.requestId };
-  return { ...state, activities: [...state.activities.slice(-7), activity] };
-}
-function style(enabled, code, value) {
-  return enabled ? `\x1B[${code}m${value}\x1B[0m` : value;
-}
-function renderTitle(width, color) {
-  const title = "Glossa";
-  const padding = " ".repeat(Math.max(0, Math.floor((width - title.length) / 2)));
-  return `${padding}${style(color, "38;2;120;77;250;1", title)}`;
-}
-function truncate(value, width) {
-  if (value.length <= width) return value;
-  if (width <= 1) return "\u2026";
-  return `${value.slice(0, width - 1)}\u2026`;
-}
-function wrapText(value, width) {
-  const words = value.split(/\s+/);
-  const lines = [];
-  let line = "";
-  for (const word of words) {
-    if (!line) line = word;
-    else if (`${line} ${word}`.length <= width) line += ` ${word}`;
-    else {
-      lines.push(line);
-      line = word;
-    }
-  }
-  if (line) lines.push(line);
-  return lines;
-}
-function connectionCopy(state) {
-  if (state.connection === "connected") {
-    return {
-      glyph: "\u25CF",
-      label: "Connected",
-      detail: state.message ?? "ChatGPT can use this workspace."
-    };
-  }
-  if (state.connection === "connecting" || state.connection === "starting") {
-    return { glyph: "\u25CC", label: "Connecting", detail: "Establishing the managed relay session\u2026" };
-  }
-  if (state.connection === "retrying") {
-    return { glyph: "\u25CC", label: "Reconnecting", detail: state.message ?? "Retrying automatically\u2026" };
-  }
-  if (state.connection === "error") {
-    return { glyph: "\xD7", label: "Error", detail: state.message ?? "The session stopped unexpectedly." };
-  }
-  return { glyph: "\u25CB", label: "Disconnected", detail: "The workspace is no longer exposed." };
-}
-function renderHud(state, width = 80, color = !process.env.NO_COLOR) {
-  const copy = connectionCopy(state);
-  const usable = Math.max(24, width - 4);
-  const lines = [
-    renderTitle(width, color),
-    "",
-    `${style(color, state.connection === "connected" ? "32;1" : "36;1", copy.glyph)} ${style(color, "1", copy.label)}`,
-    `  ${truncate(copy.detail, usable)}`,
-    "",
-    `${style(color, "2", "Workspace")}  ${truncate(state.workspace, Math.max(8, usable - 11))}`,
-    "",
-    style(color, "1", "Authority"),
-    ...wrapText(
-      "Files may be modified and commands have the full environment and permissions of this account.",
-      usable
-    ).map((line) => `  ${line}`)
-  ];
-  if (state.deviceName) lines.push(`${style(color, "2", "Device")}     ${truncate(state.deviceName, Math.max(8, usable - 11))}`);
-  if (state.showHelp) {
-    lines.push("", style(color, "1", "Keys"));
-    lines.push("  d  toggle recent activity");
-    lines.push("  ?  hide this help");
-    lines.push("  q  disconnect and quit");
-  } else if (state.showDetails) {
-    lines.push("", style(color, "1", "Recent activity"));
-    if (state.activities.length === 0) lines.push(style(color, "2", "  No tool activity yet."));
-    for (const activity of state.activities.slice(-5)) {
-      const outcome = activity.ok === false ? style(color, "31", "\xD7") : style(color, "2", "\xB7");
-      lines.push(`${outcome} ${truncate(activity.label, Math.max(8, usable - 16))}  ${style(color, "2", activity.requestId.slice(0, 8))}`);
-    }
-  } else {
-    const latest = state.activities.at(-1);
-    lines.push("", latest ? `${style(color, "2", "Latest")}     ${truncate(latest.label, Math.max(8, usable - 11))}` : style(color, "2", "No tool activity yet."));
-  }
-  lines.push("", style(color, "2", "d details  ? help  q disconnect"));
-  return lines.join("\n");
-}
-async function runSessionHud(actions, input = process.stdin, output = process.stdout) {
-  if (!input.isTTY || !output.isTTY) {
-    throw new Error("glossa ui requires an interactive terminal. Use glossa start instead.");
-  }
-  emitKeypressEvents(input);
-  const wasRaw = input.isRaw;
-  const wasPaused = input.isPaused();
-  const controller = new AbortController();
-  let state = initialHudState(actions.workspace);
-  let stopUi;
-  const render = () => {
-    const view = renderHud(state, output.columns ?? 80);
-    output.write(`\x1B[H\x1B[2J${view}`);
-  };
-  const session = actions.run(controller.signal, (event) => {
-    state = applyHudEvent(state, event);
-    render();
-  }).then(() => {
-    if (!controller.signal.aborted) state = { ...state, connection: "disconnected" };
-    render();
-  }).catch((error46) => {
-    state = {
-      ...state,
-      connection: "error",
-      message: error46 instanceof Error ? error46.message : String(error46)
-    };
-    render();
-    throw error46;
-  });
-  input.setRawMode(true);
-  input.resume();
-  output.write("\x1B[?1049h\x1B[?25l");
-  render();
-  const stop = () => {
-    controller.abort();
-    stopUi?.();
-  };
-  process.once("SIGINT", stop);
-  process.once("SIGTERM", stop);
-  try {
-    await new Promise((resolve) => {
-      stopUi = resolve;
-      const onKeypress = (value, key) => {
-        if (key.ctrl && key.name === "c" || key.name === "q") return stop();
-        if (key.name === "d") {
-          state = { ...state, showDetails: !state.showDetails, showHelp: false };
-          render();
-        } else if (value === "?" || key.sequence === "?") {
-          state = { ...state, showHelp: !state.showHelp };
-          render();
-        }
-      };
-      input.on("keypress", onKeypress);
-      void session.catch(() => stopUi?.());
-      stopUi = () => {
-        input.removeListener("keypress", onKeypress);
-        resolve();
-      };
-    });
-    await session;
-  } finally {
-    process.removeListener("SIGINT", stop);
-    process.removeListener("SIGTERM", stop);
-    input.setRawMode(wasRaw);
-    if (wasPaused) input.pause();
-    output.write("\x1B[?25h\x1B[?1049l");
-  }
-}
-
-// src/first-run.ts
-import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import path5 from "node:path";
-var CONNECT_HINT_FILE = "connect-hint-shown";
-var CONNECT_HINT_URL = "https://glossa.sh/docs/quickstart";
-function shouldShowConnectHint(relayOrigin) {
-  return relayOrigin === DEFAULT_RELAY_ORIGIN;
-}
-function connectHintStore(directory = configDirectory()) {
-  const file2 = path5.join(directory, CONNECT_HINT_FILE);
+    content: utf8PrefixWithinBudget(safePrefix(prefix), prefixBudget) + utf8SuffixWithinBudget(safeSuffix(suffix), tailBudget),
+    truncated: true
+  };
+}
+function renderOutput(stdout, stderr, complete) {
+  const half = Math.floor(MAX_COMMAND_OUTPUT_BYTES / 2);
+  const stdoutAvailable = retainedBytes(stdout, complete);
+  const stderrAvailable = retainedBytes(stderr, complete);
+  let stdoutBudget = Math.min(stdoutAvailable, half);
+  let stderrBudget = Math.min(stderrAvailable, half);
+  let remaining = MAX_COMMAND_OUTPUT_BYTES - stdoutBudget - stderrBudget;
+  const stderrExtra = Math.min(remaining, stderrAvailable - stderrBudget);
+  stderrBudget += stderrExtra;
+  remaining -= stderrExtra;
+  stdoutBudget += Math.min(remaining, stdoutAvailable - stdoutBudget);
   return {
-    async exists() {
-      try {
-        await readFile2(file2, "utf8");
-        return true;
-      } catch (error46) {
-        if (error46.code === "ENOENT") return false;
-        throw error46;
-      }
-    },
-    async mark() {
-      await mkdir2(directory, { recursive: true, mode: 448 });
-      await writeFile2(file2, "", { encoding: "utf8", mode: 384 });
-    }
+    stdout: renderStream(stdout, stdoutBudget, complete),
+    stderr: renderStream(stderr, stderrBudget, complete)
   };
 }
-async function announceConnectHint(store3, log) {
-  if (await store3.exists()) return false;
-  log(`Next: add Glossa in ChatGPT. Follow the quickstart at ${CONNECT_HINT_URL}.`);
-  await store3.mark();
-  return true;
-}
-
-// src/worker/command-service.ts
-import { spawn as spawn2 } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { StringDecoder } from "node:string_decoder";
-import { setTimeout as delay2 } from "node:timers/promises";
-
-// src/worker/errors.ts
-var WorkerError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "WorkerError";
-  }
-  code;
-};
-
-// src/worker/command-service.ts
-function capture(stream, chunk) {
-  if (stream.bytes >= MAX_TEXT_BYTES) {
-    stream.truncated = true;
-    return;
-  }
-  const remaining = MAX_TEXT_BYTES - stream.bytes;
-  const accepted = chunk.subarray(0, remaining);
-  stream.chunks.push(accepted);
-  stream.bytes += accepted.byteLength;
-  if (accepted.byteLength < chunk.byteLength) stream.truncated = true;
-}
-function emptyCapture() {
-  return { chunks: [], bytes: 0, truncated: false };
-}
-function decodeCapture(stream) {
-  const content = Buffer.concat(stream.chunks);
-  return stream.truncated ? new StringDecoder("utf8").write(content) : content.toString("utf8");
-}
 function shellInvocation(command) {
   if (process.platform === "win32") {
     const file2 = process.env.GLOSSA_WINDOWS_SHELL ?? "powershell.exe";
@@ -14540,6 +13954,8 @@ var CommandService = class {
       id,
       child,
       status: "running",
+      sequence: 0,
+      changeWaiters: /* @__PURE__ */ new Set(),
       startedAt: Date.now(),
       stdout: emptyCapture(),
       stderr: emptyCapture(),
@@ -14554,15 +13970,20 @@ var CommandService = class {
     record2.timeout.unref();
     this.#commands.set(id, record2);
     this.#activeCommandId = id;
-    child.stdout.on("data", (chunk) => capture(record2.stdout, chunk));
-    child.stderr.on("data", (chunk) => capture(record2.stderr, chunk));
+    child.stdout.on("data", (chunk) => {
+      if (capture(record2, record2.stdout, chunk)) markChanged(record2);
+    });
+    child.stderr.on("data", (chunk) => {
+      if (capture(record2, record2.stderr, chunk)) markChanged(record2);
+    });
     child.once("error", (error46) => {
       if (record2.status !== "running") return;
       if (record2.timeout) clearTimeout(record2.timeout);
       record2.status = "failed";
       record2.finishedAt = Date.now();
-      capture(record2.stderr, Buffer.from(error46.message, "utf8"));
+      capture(record2, record2.stderr, Buffer.from(error46.message, "utf8"));
       this.#activeCommandId = null;
+      markChanged(record2);
       record2.complete();
     });
     child.once("close", (exitCode, signal) => {
@@ -14573,6 +13994,7 @@ var CommandService = class {
       record2.signal = signal;
       record2.status = record2.requestedTerminal ?? (exitCode === 0 ? "succeeded" : "failed");
       this.#activeCommandId = null;
+      markChanged(record2);
       record2.complete();
       setTimeout(() => this.#commands.delete(id), 5 * 60 * 1e3).unref();
     });
@@ -14601,21 +14023,31 @@ var CommandService = class {
     }
     return this.snapshot(record2);
   }
-  async get(commandId, waitMs = 0) {
+  async get(commandId, waitMs = 0, afterSequence) {
     const record2 = this.#commands.get(commandId);
     if (!record2) throw new WorkerError("command_not_found", "The command was not found.");
     if (!Number.isInteger(waitMs) || waitMs < 0 || waitMs > MAX_COMMAND_STATUS_WAIT_MS) {
       throw new WorkerError("invalid_wait", "Status wait must be between 0 and 15 seconds.");
     }
+    if (afterSequence !== void 0 && (!Number.isInteger(afterSequence) || afterSequence < 0 || afterSequence > record2.sequence)) {
+      throw new WorkerError(
+        "invalid_sequence",
+        "The command sequence is invalid for this command."
+      );
+    }
     if (record2.status === "running" && waitMs > 0) {
-      const waitController = new AbortController();
-      try {
-        await Promise.race([
-          record2.completion,
-          delay2(waitMs, void 0, { signal: waitController.signal })
-        ]);
-      } finally {
-        waitController.abort();
+      if (afterSequence === void 0) {
+        const waitController = new AbortController();
+        try {
+          await Promise.race([
+            record2.completion,
+            delay2(waitMs, void 0, { signal: waitController.signal })
+          ]);
+        } finally {
+          waitController.abort();
+        }
+      } else {
+        await waitForChange(record2, afterSequence, waitMs);
       }
     }
     return this.snapshot(record2);
@@ -14638,31 +14070,225 @@ var CommandService = class {
     await record2.completion;
   }
   snapshot(record2) {
+    const output = renderOutput(
+      record2.stdout,
+      record2.stderr,
+      record2.status !== "running"
+    );
     const base = {
       commandId: record2.id,
       status: record2.status,
-      startedAt: new Date(record2.startedAt).toISOString()
+      sequence: record2.sequence,
+      startedAt: new Date(record2.startedAt).toISOString(),
+      stdout: output.stdout.content,
+      stderr: output.stderr.content,
+      stdoutTruncated: output.stdout.truncated,
+      stderrTruncated: output.stderr.truncated
     };
     if (record2.finishedAt !== void 0) {
       base.finishedAt = new Date(record2.finishedAt).toISOString();
       base.exitCode = record2.exitCode ?? null;
       base.signal = record2.signal ?? null;
-      base.stdout = decodeCapture(record2.stdout);
-      base.stderr = decodeCapture(record2.stderr);
-      base.stdoutTruncated = record2.stdout.truncated;
-      base.stderrTruncated = record2.stderr.truncated;
     }
     return base;
   }
 };
 
 // src/worker/file-service.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { chmod as chmod2, lstat, readFile as readFile3, rename, rm as rm2, stat, writeFile as writeFile3 } from "node:fs/promises";
-import path6 from "node:path";
+import { createHash, randomUUID as randomUUID2 } from "node:crypto";
+import {
+  chmod as chmod2,
+  lstat,
+  opendir,
+  open,
+  readFile as readFile3,
+  rename,
+  rm as rm2,
+  stat,
+  writeFile as writeFile3
+} from "node:fs/promises";
+import path5 from "node:path";
+import { performance } from "node:perf_hooks";
 import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 function sha256(content) {
-  return createHash2("sha256").update(content).digest("hex");
+  return createHash("sha256").update(content).digest("hex");
+}
+var DEFAULT_LIST_FILES_LIMIT = 100;
+var DEFAULT_SEARCH_TEXT_RESULTS = 50;
+var DEFAULT_READ_RANGE_LINES = 200;
+var MAX_REPOSITORY_SCAN_ENTRIES = 2e4;
+var MAX_SEARCH_FILES = 5e3;
+var MAX_SEARCH_BYTES = 32 * 1024 * 1024;
+var SKIPPED_RECURSIVE_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".git",
+  ".hg",
+  ".svn",
+  "node_modules"
+]);
+function compareNames(left, right) {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function relativeSortKey(root, target) {
+  const relative = path5.relative(root, target);
+  if (!relative) return ".";
+  return process.platform === "win32" ? relative.replaceAll("\\", "/") : relative;
+}
+function displayPath(root, target) {
+  const relative = relativeSortKey(root, target);
+  if (process.platform === "win32") return relative;
+  return relative.includes("\\") ? "./" + relative : relative;
+}
+function isUnavailableFileError(error46) {
+  const code = error46?.code;
+  return code === "ENOENT" || code === "EACCES" || code === "EPERM" || code === "ENOTDIR";
+}
+function isUnavailableDiscoveredPathError(error46) {
+  return isUnavailableFileError(error46) || error46 instanceof WorkerError && error46.code === "path_not_found";
+}
+function isLinkedPathError(error46) {
+  return error46 instanceof WorkerError && error46.code === "linked_path";
+}
+async function readBoundedFile(target, maximumBytes, expectedBytes) {
+  const handle = await open(target, "r");
+  try {
+    const openedStat = await handle.stat();
+    if (!openedStat.isFile()) {
+      throw new WorkerError("not_file", "The requested path is not a file.");
+    }
+    if (openedStat.size !== expectedBytes) {
+      throw new WorkerError("file_changed", "The file changed while it was being read.");
+    }
+    if (openedStat.size > maximumBytes) {
+      throw new WorkerError("search_byte_limit", "The search byte limit was reached.");
+    }
+    const buffer = Buffer.allocUnsafe(openedStat.size);
+    let offset = 0;
+    while (offset < buffer.byteLength) {
+      const { bytesRead } = await handle.read(
+        buffer,
+        offset,
+        buffer.byteLength - offset,
+        offset
+      );
+      if (bytesRead === 0) break;
+      offset += bytesRead;
+    }
+    const completedStat = await handle.stat();
+    if (completedStat.size !== openedStat.size || offset !== openedStat.size) {
+      throw new WorkerError("file_changed", "The file changed while it was being read.");
+    }
+    return Buffer.from(buffer);
+  } finally {
+    await handle.close();
+  }
+}
+function normalizedLines(content) {
+  if (content.length === 0) return [];
+  const normalized = content.replace(/\r\n?/g, "\n");
+  const lines = normalized.split("\n");
+  if (normalized.endsWith("\n")) lines.pop();
+  return lines;
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function heapPush(heap, value) {
+  heap.push(value);
+  let index = heap.length - 1;
+  while (index > 0) {
+    const parent = Math.floor((index - 1) / 2);
+    if (compareNames(heap[parent].sortKey, value.sortKey) <= 0) break;
+    heap[index] = heap[parent];
+    index = parent;
+  }
+  heap[index] = value;
+}
+function heapPop(heap) {
+  const first = heap[0];
+  const last = heap.pop();
+  if (!first || !last || heap.length === 0) return first;
+  let index = 0;
+  while (true) {
+    const left = index * 2 + 1;
+    if (left >= heap.length) break;
+    const right = left + 1;
+    const child = right < heap.length && compareNames(heap[right].sortKey, heap[left].sortKey) < 0 ? right : left;
+    if (compareNames(last.sortKey, heap[child].sortKey) <= 0) break;
+    heap[index] = heap[child];
+    index = child;
+  }
+  heap[index] = last;
+  return first;
+}
+function scanTimeoutError() {
+  return new WorkerError(
+    "scan_timeout",
+    "The structured repository operation exceeded its local deadline."
+  );
+}
+async function defaultBeforeDeadline(operation, deadlineAt, onLateValue) {
+  const settled = operation.then(
+    (value) => ({ ok: true, value }),
+    (error46) => ({ ok: false, error: error46 })
+  );
+  const remainingMs = deadlineAt - performance.now();
+  const expired = /* @__PURE__ */ Symbol("structured_read_deadline");
+  let winner;
+  let timer;
+  if (remainingMs <= 0) {
+    winner = expired;
+  } else {
+    try {
+      winner = await Promise.race([
+        settled,
+        new Promise((resolve) => {
+          timer = setTimeout(() => resolve(expired), remainingMs);
+        })
+      ]);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+  if (winner === expired) {
+    const eventual = await settled;
+    if (eventual.ok && onLateValue) {
+      await onLateValue(eventual.value);
+    }
+    throw scanTimeoutError();
+  }
+  if (!winner.ok) throw winner.error;
+  return winner.value;
+}
+async function closeDirectory(handle) {
+  await handle.close().catch((error46) => {
+    if (error46.code !== "ERR_DIR_CLOSED") throw error46;
+  });
+}
+function boundedPositiveInteger(value, fallback, maximum, label) {
+  const resolved = value ?? fallback;
+  if (!Number.isInteger(resolved) || resolved < 1 || resolved > maximum) {
+    throw new WorkerError(
+      "invalid_limit",
+      `${label} must be between 1 and ${maximum}.`
+    );
+  }
+  return resolved;
+}
+function searchSnippet(line, matchIndex, matchLength) {
+  if (line.length <= MAX_SEARCH_TEXT_SNIPPET_CHARS) {
+    return { text: line, truncated: false };
+  }
+  const windowLength = MAX_SEARCH_TEXT_SNIPPET_CHARS - 6;
+  let start = Math.max(0, matchIndex - 120);
+  if (start + windowLength < matchIndex + matchLength) {
+    start = matchIndex + matchLength - windowLength;
+  }
+  start = Math.min(start, line.length - windowLength);
+  const end = start + windowLength;
+  return {
+    text: `${start > 0 ? "..." : ""}${line.slice(start, end)}${end < line.length ? "..." : ""}`,
+    truncated: true
+  };
 }
 function lineNumberAt(content, index) {
   let line = 1;
@@ -14708,8 +14334,8 @@ function createUnifiedDiff(relativePath, original, updated, edits) {
       hunks.push(candidate);
     }
   }
-  const displayPath = relativePath.replaceAll("\\", "/");
-  const lines = [`--- a/${displayPath}`, `+++ b/${displayPath}`];
+  const displayPath2 = process.platform === "win32" ? relativePath.replaceAll("\\", "/") : relativePath;
+  const lines = [`--- a/${displayPath2}`, `+++ b/${displayPath2}`];
   for (const hunk of hunks) {
     const newStart = mappedIndex(hunk.oldStart, edits);
     const newEnd = mappedIndex(hunk.oldEnd, edits);
@@ -14738,12 +14364,81 @@ function boundDiff(diff) {
   return { diff: `${prefix}${marker}`, truncated: true };
 }
 var FileService = class {
-  constructor(policy) {
+  constructor(policy, dependencies = {}) {
     this.policy = policy;
+    this.#now = dependencies.now ?? (() => performance.now());
+    this.#beforeDeadline = dependencies.beforeDeadline ?? defaultBeforeDeadline;
+    this.#openDirectory = dependencies.openDirectory ?? ((directory) => opendir(directory));
+    this.#readFileBytes = dependencies.readFileBytes ?? readBoundedFile;
+    this.#lstatPath = dependencies.lstatPath ?? ((target) => lstat(target));
+    this.#maxRepositoryScanEntries = dependencies.maxRepositoryScanEntries ?? MAX_REPOSITORY_SCAN_ENTRIES;
+    this.#maxSearchBytes = dependencies.maxSearchBytes ?? MAX_SEARCH_BYTES;
+    if (!Number.isInteger(this.#maxRepositoryScanEntries) || this.#maxRepositoryScanEntries < 1 || this.#maxRepositoryScanEntries > MAX_REPOSITORY_SCAN_ENTRIES) {
+      throw new WorkerError(
+        "invalid_limit",
+        `Repository scan limit must be between 1 and ${MAX_REPOSITORY_SCAN_ENTRIES}.`
+      );
+    }
+    if (!Number.isInteger(this.#maxSearchBytes) || this.#maxSearchBytes < 1 || this.#maxSearchBytes > MAX_SEARCH_BYTES) {
+      throw new WorkerError(
+        "invalid_limit",
+        `Search byte limit must be between 1 and ${MAX_SEARCH_BYTES}.`
+      );
+    }
   }
   policy;
-  async readText(relativePath) {
-    const target = await this.policy.resolveExisting(relativePath);
+  #now;
+  #beforeDeadline;
+  #openDirectory;
+  #readFileBytes;
+  #lstatPath;
+  #maxRepositoryScanEntries;
+  #maxSearchBytes;
+  #scanDeadline(timeoutMs = MAX_STRUCTURED_READ_TIMEOUT_MS) {
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_STRUCTURED_READ_TIMEOUT_MS) {
+      throw new WorkerError(
+        "invalid_timeout",
+        `Structured read timeout must be between 1 and ${MAX_STRUCTURED_READ_TIMEOUT_MS}.`
+      );
+    }
+    return this.#now() + timeoutMs;
+  }
+  async #withinDeadline(operation, deadlineAt, onLateValue) {
+    return await this.#beforeDeadline(operation, deadlineAt, onLateValue);
+  }
+  #assertBeforeDeadline(deadlineAt) {
+    if (this.#now() >= deadlineAt) {
+      throw new WorkerError(
+        "scan_timeout",
+        "The structured repository operation exceeded its local deadline."
+      );
+    }
+  }
+  async #readDirectoryBounded(directory, deadlineAt, remainingEntries) {
+    const handle = await this.#withinDeadline(
+      this.#openDirectory(directory),
+      deadlineAt,
+      closeDirectory
+    );
+    const children = [];
+    try {
+      while (true) {
+        this.#assertBeforeDeadline(deadlineAt);
+        const child = await this.#withinDeadline(handle.read(), deadlineAt);
+        if (!child) break;
+        if (children.length >= remainingEntries) {
+          return { children: [], overflow: true };
+        }
+        children.push(child);
+      }
+    } finally {
+      await closeDirectory(handle);
+    }
+    children.sort((left, right) => compareNames(left.name, right.name));
+    return { children, overflow: false };
+  }
+  async #readResolvedText(target, maximumBytes = MAX_TEXT_BYTES) {
+    const boundedMaximum = Math.min(maximumBytes, MAX_TEXT_BYTES);
     const targetStat = await stat(target);
     if (!targetStat.isFile()) {
       throw new WorkerError("not_file", "The requested path is not a file.");
@@ -14751,15 +14446,471 @@ var FileService = class {
     if (targetStat.size > MAX_TEXT_BYTES) {
       throw new WorkerError("file_too_large", "The file exceeds the 1 MiB text limit.");
     }
-    const content = await readFile3(target);
-    let text;
-    try {
-      text = new TextDecoder("utf-8", { fatal: true }).decode(content);
-    } catch {
-      throw new WorkerError("not_text", "The file is not valid UTF-8 text.");
+    if (targetStat.size > boundedMaximum) {
+      throw new WorkerError("search_byte_limit", "The search byte limit was reached.");
+    }
+    const content = await this.#readFileBytes(
+      target,
+      boundedMaximum,
+      targetStat.size
+    );
+    if (content.byteLength > MAX_TEXT_BYTES) {
+      throw new WorkerError("file_too_large", "The file exceeds the 1 MiB text limit.");
+    }
+    if (content.byteLength > boundedMaximum) {
+      throw new WorkerError("search_byte_limit", "The search byte limit was reached.");
+    }
+    if (content.byteLength > targetStat.size) {
+      throw new WorkerError("file_changed", "The file changed while it was being read.");
+    }
+    let text;
+    try {
+      text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+    } catch {
+      throw new WorkerError("not_text", "The file is not valid UTF-8 text.");
     }
     return { content: text, sha256: sha256(content), bytes: content.byteLength };
   }
+  async readText(relativePath) {
+    const target = await this.policy.resolveExisting(relativePath);
+    return await this.#readResolvedText(target);
+  }
+  async listFiles(options = {}) {
+    const deadlineAt = this.#scanDeadline(options.timeoutMs);
+    const startPath = options.path ?? ".";
+    const start = await this.#withinDeadline(
+      this.policy.resolveExisting(startPath),
+      deadlineAt
+    );
+    const startStat = await this.#withinDeadline(stat(start), deadlineAt);
+    if (!startStat.isDirectory()) {
+      throw new WorkerError("not_directory", "The requested path is not a directory.");
+    }
+    const limit = boundedPositiveInteger(
+      options.limit,
+      DEFAULT_LIST_FILES_LIMIT,
+      MAX_LIST_FILES_RESULTS,
+      "List limit"
+    );
+    const cursor = process.platform === "win32" ? options.cursor?.replaceAll("\\", "/") : options.cursor;
+    const entries = [];
+    const frontier = [];
+    let scannedEntries = 0;
+    let skippedLinks = 0;
+    let hasMore = false;
+    const scanLimitError = () => new WorkerError(
+      "scan_limit",
+      `The directory scan exceeds ${this.#maxRepositoryScanEntries} entries. Narrow the requested path.`
+    );
+    const enqueueChildren = async (directory) => {
+      const batch = await this.#readDirectoryBounded(
+        directory,
+        deadlineAt,
+        this.#maxRepositoryScanEntries - scannedEntries
+      );
+      if (batch.overflow) throw scanLimitError();
+      scannedEntries += batch.children.length;
+      for (const child of batch.children) {
+        const target = path5.join(directory, child.name);
+        heapPush(frontier, {
+          target,
+          sortKey: relativeSortKey(this.policy.root, target),
+          path: displayPath(this.policy.root, target),
+          name: child.name
+        });
+      }
+    };
+    const hasListableChild = async (directory) => {
+      const handle = await this.#withinDeadline(
+        this.#openDirectory(directory),
+        deadlineAt,
+        closeDirectory
+      );
+      try {
+        while (true) {
+          this.#assertBeforeDeadline(deadlineAt);
+          const child = await this.#withinDeadline(handle.read(), deadlineAt);
+          if (!child) return false;
+          if (scannedEntries >= this.#maxRepositoryScanEntries) {
+            throw scanLimitError();
+          }
+          scannedEntries += 1;
+          const target = path5.join(directory, child.name);
+          let childStat;
+          try {
+            childStat = await this.#withinDeadline(
+              this.#lstatPath(target),
+              deadlineAt
+            );
+          } catch (error46) {
+            if (isUnavailableFileError(error46)) continue;
+            throw error46;
+          }
+          if (childStat.isSymbolicLink()) {
+            skippedLinks += 1;
+            continue;
+          }
+          if (childStat.isFile() || childStat.isDirectory()) return true;
+        }
+      } finally {
+        await closeDirectory(handle);
+      }
+    };
+    await enqueueChildren(start);
+    while (frontier.length > 0 && entries.length <= limit) {
+      this.#assertBeforeDeadline(deadlineAt);
+      const candidate = heapPop(frontier);
+      let targetStat;
+      try {
+        targetStat = await this.#withinDeadline(
+          this.#lstatPath(candidate.target),
+          deadlineAt
+        );
+      } catch (error46) {
+        if (isUnavailableFileError(error46)) continue;
+        throw error46;
+      }
+      if (targetStat.isSymbolicLink()) {
+        skippedLinks += 1;
+        continue;
+      }
+      const type = targetStat.isDirectory() ? "directory" : targetStat.isFile() ? "file" : void 0;
+      if (!type) continue;
+      if (entries.length === limit && (!cursor || compareNames(candidate.sortKey, cursor) > 0)) {
+        try {
+          const safeCandidate = await this.#withinDeadline(
+            this.policy.resolveDiscoveredExisting(candidate.target),
+            deadlineAt
+          );
+          if (type === "directory" && options.recursive === true && !SKIPPED_RECURSIVE_DIRECTORIES.has(candidate.name.toLowerCase())) {
+            const handle = await this.#withinDeadline(
+              this.#openDirectory(safeCandidate),
+              deadlineAt,
+              closeDirectory
+            );
+            await closeDirectory(handle);
+          }
+        } catch (error46) {
+          if (isUnavailableDiscoveredPathError(error46)) continue;
+          if (isLinkedPathError(error46)) {
+            skippedLinks += 1;
+            continue;
+          }
+          throw error46;
+        }
+        hasMore = true;
+        break;
+      }
+      const shouldReturn = !cursor || compareNames(candidate.sortKey, cursor) > 0;
+      const shouldRecurse = type === "directory" && options.recursive === true && !SKIPPED_RECURSIVE_DIRECTORIES.has(candidate.name.toLowerCase());
+      let safeDirectory;
+      if (shouldRecurse) {
+        try {
+          safeDirectory = await this.#withinDeadline(
+            this.policy.resolveDiscoveredExisting(candidate.target),
+            deadlineAt
+          );
+        } catch (error46) {
+          if (isUnavailableDiscoveredPathError(error46)) continue;
+          if (isLinkedPathError(error46)) {
+            skippedLinks += 1;
+            continue;
+          }
+          throw error46;
+        }
+      }
+      const fillsPage = shouldReturn && entries.length + 1 === limit;
+      if (fillsPage && safeDirectory) {
+        let hasChild;
+        try {
+          hasChild = await hasListableChild(safeDirectory);
+        } catch (error46) {
+          if (isUnavailableDiscoveredPathError(error46)) continue;
+          throw error46;
+        }
+        entries.push({
+          entry: { path: candidate.path, type },
+          cursor: candidate.sortKey
+        });
+        if (hasChild) {
+          hasMore = true;
+          break;
+        }
+        continue;
+      }
+      if (safeDirectory) {
+        try {
+          await enqueueChildren(safeDirectory);
+        } catch (error46) {
+          if (isUnavailableDiscoveredPathError(error46)) continue;
+          throw error46;
+        }
+      }
+      if (shouldReturn) {
+        entries.push({
+          entry: {
+            path: candidate.path,
+            type,
+            ...type === "file" ? { bytes: targetStat.size } : {}
+          },
+          cursor: candidate.sortKey
+        });
+      }
+    }
+    return {
+      entries: entries.map(({ entry }) => entry),
+      truncated: hasMore,
+      scannedEntries,
+      skippedLinks,
+      ...hasMore && entries.length > 0 ? { nextCursor: entries.at(-1).cursor } : {}
+    };
+  }
+  async searchText(options) {
+    const deadlineAt = this.#scanDeadline(options.timeoutMs);
+    if (options.query.length === 0 || options.query.length > 256 || /[\r\n\u0000]/.test(options.query)) {
+      throw new WorkerError(
+        "invalid_search",
+        "Search text must be one non-empty line of at most 256 characters."
+      );
+    }
+    const maxResults = boundedPositiveInteger(
+      options.maxResults,
+      DEFAULT_SEARCH_TEXT_RESULTS,
+      MAX_SEARCH_TEXT_RESULTS,
+      "Search result limit"
+    );
+    const matchLimit = maxResults + 1;
+    const extensions = options.extensions?.map((extension) => extension.toLowerCase());
+    const matcher = new RegExp(
+      escapeRegExp(options.query),
+      options.caseSensitive === true ? "u" : "iu"
+    );
+    const start = await this.#withinDeadline(
+      this.policy.resolveExisting(options.path ?? "."),
+      deadlineAt
+    );
+    const startStat = await this.#withinDeadline(stat(start), deadlineAt);
+    const matches = [];
+    let scannedEntries = 0;
+    let scannedFiles = 0;
+    let scannedBytes = 0;
+    let skippedFiles = 0;
+    let skippedLinks = 0;
+    let scanTruncated = false;
+    const searchFile = async (target) => {
+      const relative = displayPath(this.policy.root, target);
+      if (extensions && !extensions.some(
+        (extension) => path5.basename(target).toLowerCase().endsWith(extension)
+      )) {
+        return false;
+      }
+      if (scannedFiles >= MAX_SEARCH_FILES) {
+        scanTruncated = true;
+        return true;
+      }
+      const remainingBytes = this.#maxSearchBytes - scannedBytes;
+      if (remainingBytes <= 0) {
+        scanTruncated = true;
+        return true;
+      }
+      let result;
+      try {
+        const safeTarget = await this.#withinDeadline(
+          this.policy.resolveDiscoveredExisting(target),
+          deadlineAt
+        );
+        result = await this.#withinDeadline(
+          this.#readResolvedText(safeTarget, remainingBytes),
+          deadlineAt
+        );
+      } catch (error46) {
+        if (error46 instanceof WorkerError && error46.code === "search_byte_limit") {
+          scanTruncated = true;
+          return true;
+        }
+        if (isLinkedPathError(error46)) {
+          skippedLinks += 1;
+          return false;
+        }
+        if (isUnavailableFileError(error46) || error46 instanceof WorkerError && [
+          "not_text",
+          "file_too_large",
+          "file_changed",
+          "path_not_found"
+        ].includes(
+          error46.code
+        )) {
+          skippedFiles += 1;
+          return false;
+        }
+        throw error46;
+      }
+      if (scannedBytes + result.bytes > this.#maxSearchBytes) {
+        scanTruncated = true;
+        return true;
+      }
+      scannedFiles += 1;
+      scannedBytes += result.bytes;
+      const lines = result.content.replace(/\r\n?/g, "\n").split("\n");
+      for (const [index, line] of lines.entries()) {
+        if (index % 256 === 0) this.#assertBeforeDeadline(deadlineAt);
+        const match = matcher.exec(line);
+        if (!match) continue;
+        const matchIndex = match.index;
+        const snippet = searchSnippet(line, matchIndex, match[0].length);
+        matches.push({
+          path: relative,
+          line: index + 1,
+          column: matchIndex + 1,
+          text: snippet.text,
+          lineTruncated: snippet.truncated
+        });
+        if (matches.length >= matchLimit) return true;
+      }
+      return false;
+    };
+    const visit = async (directory) => {
+      let batch;
+      try {
+        batch = await this.#readDirectoryBounded(
+          directory,
+          deadlineAt,
+          this.#maxRepositoryScanEntries - scannedEntries
+        );
+      } catch (error46) {
+        if (isUnavailableFileError(error46)) {
+          skippedFiles += 1;
+          return false;
+        }
+        throw error46;
+      }
+      if (batch.overflow) {
+        scanTruncated = true;
+        scannedEntries = this.#maxRepositoryScanEntries;
+        return true;
+      }
+      scannedEntries += batch.children.length;
+      for (const child of batch.children) {
+        this.#assertBeforeDeadline(deadlineAt);
+        const target = path5.join(directory, child.name);
+        let targetStat;
+        try {
+          targetStat = await this.#withinDeadline(this.#lstatPath(target), deadlineAt);
+        } catch (error46) {
+          if (isUnavailableFileError(error46)) {
+            skippedFiles += 1;
+            continue;
+          }
+          throw error46;
+        }
+        if (targetStat.isSymbolicLink()) {
+          skippedLinks += 1;
+          continue;
+        }
+        if (targetStat.isDirectory()) {
+          if (SKIPPED_RECURSIVE_DIRECTORIES.has(child.name.toLowerCase())) continue;
+          try {
+            await this.#withinDeadline(
+              this.policy.resolveDiscoveredExisting(target),
+              deadlineAt
+            );
+          } catch (error46) {
+            if (isLinkedPathError(error46)) {
+              skippedLinks += 1;
+              continue;
+            }
+            if (isUnavailableDiscoveredPathError(error46)) {
+              skippedFiles += 1;
+              continue;
+            }
+            throw error46;
+          }
+          if (await visit(target)) return true;
+        } else if (targetStat.isFile() && await searchFile(target)) {
+          return true;
+        }
+      }
+      return false;
+    };
+    if (startStat.isFile()) {
+      await searchFile(start);
+    } else if (startStat.isDirectory()) {
+      await visit(start);
+    } else {
+      throw new WorkerError("not_file", "The requested path is not a file or directory.");
+    }
+    return {
+      matches: matches.slice(0, maxResults),
+      truncated: scanTruncated || matches.length > maxResults,
+      scannedFiles,
+      scannedBytes,
+      skippedFiles,
+      skippedLinks
+    };
+  }
+  async readTextRange(relativePath, startLine = 1, lineCount = DEFAULT_READ_RANGE_LINES, timeoutMs = MAX_STRUCTURED_READ_TIMEOUT_MS) {
+    const deadlineAt = this.#scanDeadline(timeoutMs);
+    if (!Number.isInteger(startLine) || startLine < 1) {
+      throw new WorkerError("invalid_range", "Start line must be a positive integer.");
+    }
+    lineCount = boundedPositiveInteger(
+      lineCount,
+      DEFAULT_READ_RANGE_LINES,
+      MAX_READ_FILE_RANGE_LINES,
+      "Line count"
+    );
+    const file2 = await this.#withinDeadline(
+      this.readText(relativePath),
+      deadlineAt
+    );
+    const lines = normalizedLines(file2.content);
+    if (lines.length === 0) {
+      if (startLine !== 1) {
+        throw new WorkerError("line_out_of_range", "The requested line is outside the file.");
+      }
+      return {
+        content: "",
+        startLine: 1,
+        endLine: 0,
+        totalLines: 0,
+        sha256: file2.sha256,
+        bytes: file2.bytes,
+        contentBytes: 0
+      };
+    }
+    if (startLine > lines.length) {
+      throw new WorkerError("line_out_of_range", "The requested line is outside the file.");
+    }
+    const selected = [];
+    let contentBytes = 0;
+    const requestedEnd = Math.min(lines.length, startLine - 1 + lineCount);
+    for (let index = startLine - 1; index < requestedEnd; index += 1) {
+      const line = lines[index];
+      const addedBytes = Buffer.byteLength(line, "utf8") + (selected.length === 0 ? 0 : 1);
+      if (contentBytes + addedBytes > MAX_READ_FILE_RANGE_BYTES) {
+        if (selected.length === 0) {
+          throw new WorkerError(
+            "line_too_large",
+            "The first requested line exceeds the 64 KiB range limit. Use read_file instead."
+          );
+        }
+        break;
+      }
+      selected.push(line);
+      contentBytes += addedBytes;
+    }
+    const endLine = startLine + selected.length - 1;
+    return {
+      content: selected.join("\n"),
+      startLine,
+      endLine,
+      totalLines: lines.length,
+      sha256: file2.sha256,
+      bytes: file2.bytes,
+      contentBytes,
+      ...endLine < lines.length ? { nextLine: endLine + 1 } : {}
+    };
+  }
   async editText(relativePath, edits, expectedSha256) {
     const original = await this.readText(relativePath);
     if (expectedSha256 && original.sha256 !== expectedSha256) {
@@ -14827,7 +14978,7 @@ var FileService = class {
         throw new WorkerError("stale_revision", "The file revision has changed.");
       }
     }
-    const temporary = path6.join(path6.dirname(target), `.glossa-${randomUUID2()}.tmp`);
+    const temporary = path5.join(path5.dirname(target), `.glossa-${randomUUID2()}.tmp`);
     try {
       await writeFile3(temporary, bytes, { flag: "wx", mode: 384 });
       target = await this.policy.resolveWritableFile(relativePath);
@@ -14849,29 +15000,37 @@ var FileService = class {
 // src/worker/path-policy.ts
 import { lstat as lstat2, realpath, stat as stat2 } from "node:fs/promises";
 import os3 from "node:os";
-import path7 from "node:path";
+import path6 from "node:path";
 function samePath(left, right) {
   return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
+function accountHomeDirectory() {
+  try {
+    return os3.userInfo().homedir;
+  } catch {
+    return os3.homedir();
+  }
+}
 function isWithin(root, candidate) {
-  const relative = path7.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path7.sep}`) && relative !== ".." && !path7.isAbsolute(relative);
+  const relative = path6.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path6.sep}`) && relative !== ".." && !path6.isAbsolute(relative);
 }
 function validateRelativePath(value) {
   if (value.includes("\0")) {
     throw new WorkerError("invalid_path", "Paths cannot contain null bytes.");
   }
-  if (path7.isAbsolute(value) || path7.win32.isAbsolute(value) || path7.posix.isAbsolute(value)) {
+  const explicitNativePosixPath = process.platform !== "win32" && value.startsWith("./");
+  if (path6.isAbsolute(value) || path6.posix.isAbsolute(value) || !explicitNativePosixPath && path6.win32.isAbsolute(value)) {
     throw new WorkerError("absolute_path", "Absolute paths are not allowed.");
   }
-  const segments = value.split(/[\\/]+/);
+  const segments = explicitNativePosixPath ? value.split(/\/+/).filter(Boolean) : value.split(/[\\/]+/);
   if (segments.includes("..")) {
     throw new WorkerError("path_traversal", "Parent path traversal is not allowed.");
   }
   return value === "" ? "." : value;
 }
-async function canonicalizeRoot(candidate, allowBroadRoot = false) {
-  const root = await realpath(path7.resolve(candidate)).catch((error46) => {
+async function canonicalizeRoot(candidate) {
+  const root = await realpath(path6.resolve(candidate)).catch((error46) => {
     if (error46.code === "ENOENT") {
       throw new WorkerError("root_not_found", "The workspace directory does not exist.");
     }
@@ -14881,16 +15040,19 @@ async function canonicalizeRoot(candidate, allowBroadRoot = false) {
   if (!rootStat.isDirectory()) {
     throw new WorkerError("root_not_directory", "The exposed root must be a directory.");
   }
-  if (!allowBroadRoot) {
-    const filesystemRoot = path7.parse(root).root;
-    const home = await realpath(os3.homedir()).catch(() => path7.resolve(os3.homedir()));
-    if (samePath(root, filesystemRoot) || samePath(root, home)) {
-      const kind = samePath(root, home) ? "your home directory" : "a filesystem root";
-      throw new WorkerError(
-        "broad_root_refused",
-        `The selected root is ${kind}, which Glossa protects by default. Add --allow-broad-root to expose it anyway.`
-      );
-    }
+  const filesystemRoot = path6.parse(root).root;
+  const homes = await Promise.all(
+    [os3.homedir(), accountHomeDirectory()].map(
+      async (home) => await realpath(home).catch(() => path6.resolve(home))
+    )
+  );
+  const isHomeDirectory = homes.some((home) => samePath(root, home));
+  if (samePath(root, filesystemRoot) || isHomeDirectory) {
+    const kind = isHomeDirectory ? "your home directory" : "a filesystem root";
+    throw new WorkerError(
+      "broad_root_refused",
+      `The selected root is ${kind}, which Glossa will not expose. Choose a project directory instead.`
+    );
   }
   return root;
 }
@@ -14899,8 +15061,8 @@ var PathPolicy = class _PathPolicy {
     this.root = root;
   }
   root;
-  static async create(candidate, allowBroadRoot = false) {
-    return new _PathPolicy(await canonicalizeRoot(candidate, allowBroadRoot));
+  static async create(candidate) {
+    return new _PathPolicy(await canonicalizeRoot(candidate));
   }
   async resolveExisting(relativePath) {
     const lexical = this.resolveLexical(relativePath);
@@ -14916,9 +15078,26 @@ var PathPolicy = class _PathPolicy {
     }
     return canonical;
   }
+  async resolveDiscoveredExisting(candidate) {
+    const lexical = path6.resolve(candidate);
+    if (!isWithin(this.root, lexical)) {
+      throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
+    }
+    await this.rejectLinkedComponents(lexical);
+    const canonical = await realpath(lexical).catch((error46) => {
+      if (error46.code === "ENOENT") {
+        throw new WorkerError("path_not_found", "The requested path does not exist.");
+      }
+      throw error46;
+    });
+    if (!isWithin(this.root, canonical)) {
+      throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
+    }
+    return canonical;
+  }
   async resolveWritableFile(relativePath) {
     const lexical = this.resolveLexical(relativePath);
-    const parent = path7.dirname(lexical);
+    const parent = path6.dirname(lexical);
     await this.rejectLinkedComponents(parent);
     const canonicalParent = await realpath(parent).catch((error46) => {
       if (error46.code === "ENOENT") {
@@ -14944,11 +15123,11 @@ var PathPolicy = class _PathPolicy {
       if (error46 instanceof WorkerError) throw error46;
       if (error46.code !== "ENOENT") throw error46;
     }
-    return path7.join(canonicalParent, path7.basename(lexical));
+    return path6.join(canonicalParent, path6.basename(lexical));
   }
   resolveLexical(relativePath) {
     const validated = validateRelativePath(relativePath);
-    const candidate = path7.resolve(this.root, validated);
+    const candidate = path6.resolve(this.root, validated);
     if (!isWithin(this.root, candidate)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
@@ -14958,11 +15137,11 @@ var PathPolicy = class _PathPolicy {
     if (!isWithin(this.root, candidate)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
-    const relative = path7.relative(this.root, candidate);
+    const relative = path6.relative(this.root, candidate);
     if (!relative) return;
     let current = this.root;
-    for (const segment of relative.split(path7.sep)) {
-      current = path7.join(current, segment);
+    for (const segment of relative.split(path6.sep)) {
+      current = path6.join(current, segment);
       try {
         const currentStat = await lstat2(current);
         if (currentStat.isSymbolicLink()) {
@@ -14982,16 +15161,16 @@ var PathPolicy = class _PathPolicy {
 
 // src/worker/local-worker.ts
 var LocalWorker = class _LocalWorker {
-  constructor(policy, files, commands2) {
+  constructor(policy, files, commands) {
     this.policy = policy;
     this.files = files;
-    this.commands = commands2;
+    this.commands = commands;
   }
   policy;
   files;
   commands;
-  static async create(root, allowBroadRoot = false) {
-    const policy = await PathPolicy.create(root, allowBroadRoot);
+  static async create(root) {
+    const policy = await PathPolicy.create(root);
     return new _LocalWorker(
       policy,
       new FileService(policy),
@@ -15005,6 +15184,33 @@ var LocalWorker = class _LocalWorker {
         case "read_file":
           value = await this.files.readText(job.path);
           break;
+        case "list_files":
+          value = await this.files.listFiles({
+            ...job.path ? { path: job.path } : {},
+            ...job.recursive === void 0 ? {} : { recursive: job.recursive },
+            ...job.cursor ? { cursor: job.cursor } : {},
+            ...job.limit === void 0 ? {} : { limit: job.limit },
+            timeoutMs: job.timeoutMs
+          });
+          break;
+        case "search_text":
+          value = await this.files.searchText({
+            query: job.query,
+            ...job.path ? { path: job.path } : {},
+            ...job.caseSensitive === void 0 ? {} : { caseSensitive: job.caseSensitive },
+            ...job.maxResults === void 0 ? {} : { maxResults: job.maxResults },
+            ...job.extensions ? { extensions: job.extensions } : {},
+            timeoutMs: job.timeoutMs
+          });
+          break;
+        case "read_file_range":
+          value = await this.files.readTextRange(
+            job.path,
+            job.startLine,
+            job.lineCount,
+            job.timeoutMs
+          );
+          break;
         case "write_file":
           value = await this.files.writeText(
             job.path,
@@ -15029,7 +15235,11 @@ var LocalWorker = class _LocalWorker {
           });
           break;
         case "get_command":
-          value = await this.commands.get(job.commandId, job.waitMs);
+          value = await this.commands.get(
+            job.commandId,
+            job.waitMs,
+            job.afterSequence
+          );
           break;
         case "cancel_command":
           value = await this.commands.cancel(job.commandId);
@@ -15056,6 +15266,9 @@ var WORKER_REQUEST_TIMEOUT_MS = 19e3;
 var DEFAULT_RECONNECT_BASE_MS = 500;
 var DEFAULT_RECONNECT_MAX_MS = 1e4;
 var DEFAULT_HEARTBEAT_MS = 15e3;
+var CONCURRENT_WORKER_POLL_MS = 1e3;
+var MAX_CONCURRENT_JOBS = 5;
+var WORKER_TOKEN_PATTERN = /^glw_[A-Za-z0-9_-]{43}$/;
 var DeviceRejectedError = class extends Error {
   constructor() {
     super("The relay rejected the device credential.");
@@ -15070,6 +15283,53 @@ var RelayResponseError = class extends Error {
   }
   status;
 };
+function optionalWorkerToken(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !WORKER_TOKEN_PATTERN.test(value)) {
+    throw new Error("The relay returned an invalid worker credential.");
+  }
+  return value;
+}
+function supportsCapability(value, capability) {
+  if (typeof value !== "object" || value === null) return false;
+  if (!("capabilities" in value)) return false;
+  const capabilities = value.capabilities;
+  if (typeof capabilities !== "object" || capabilities === null) return false;
+  return capabilities[capability] === true;
+}
+function jobLane(job) {
+  switch (job.type) {
+    case "get_command":
+      return "status";
+    case "cancel_command":
+      return "cancel";
+    case "read_file":
+    case "list_files":
+    case "search_text":
+    case "read_file_range":
+      return "read";
+    case "write_file":
+    case "edit_file":
+    case "run_command":
+      return "mutation";
+  }
+}
+function acceptedJobTypes(counts, total, structuredReads) {
+  if (total >= MAX_CONCURRENT_JOBS) return [];
+  const accepted = [];
+  if (counts.status < 1) accepted.push("get_command");
+  if (counts.cancel < 1) accepted.push("cancel_command");
+  if (counts.read < 2) {
+    accepted.push("read_file");
+    if (structuredReads) {
+      accepted.push("list_files", "search_text", "read_file_range");
+    }
+  }
+  if (counts.mutation < 1) {
+    accepted.push("write_file", "edit_file", "run_command");
+  }
+  return accepted;
+}
 function defaultSleep(milliseconds, signal) {
   if (signal.aborted) return Promise.reject(signal.reason);
   return new Promise((resolve, reject) => {
@@ -15092,6 +15352,7 @@ function reconnectDelayMs(failureCount, random, baseMs = DEFAULT_RECONNECT_BASE_
 var RemoteWorker = class {
   #origin;
   #deviceToken;
+  #workspaceLabel;
   #worker;
   #signal;
   #fetcher;
@@ -15105,6 +15366,7 @@ var RemoteWorker = class {
   constructor(options) {
     this.#origin = new URL(options.origin);
     this.#deviceToken = options.deviceToken;
+    this.#workspaceLabel = options.workspaceLabel;
     this.#worker = options.worker;
     this.#signal = options.signal;
     this.#fetcher = options.fetcher ?? fetch;
@@ -15119,15 +15381,18 @@ var RemoteWorker = class {
   async run() {
     let failures = 0;
     let connectedBefore = false;
+    let registeredSession;
     this.#onStatus({ state: "connecting" });
     try {
       while (!this.#signal.aborted) {
         try {
           const session = await this.#register();
+          registeredSession = session;
           this.#onStatus({
             state: "connected",
             reconnected: connectedBefore,
-            legacyRelay: session.legacyRelay
+            legacyRelay: session.legacyRelay,
+            workspaceLabelAccepted: session.workspaceLabelAccepted
           });
           connectedBefore = true;
           failures = 0;
@@ -15156,350 +15421,1230 @@ var RemoteWorker = class {
         }
       }
     } finally {
-      await this.#unregister();
+      await this.#unregister(registeredSession);
       this.#onStatus({ state: "disconnected" });
     }
   }
   async #register() {
-    let response;
-    try {
-      response = await this.#post("/device/register", {
-        workerId: this.#workerId
-      });
-    } catch (error46) {
-      if (!(error46 instanceof RelayResponseError) || error46.status !== 400) {
+    const structuredBody = {
+      workerId: this.#workerId,
+      capabilities: {
+        commandProgress: true,
+        concurrentJobs: true,
+        structuredReads: true
+      }
+    };
+    const concurrentBody = {
+      workerId: this.#workerId,
+      capabilities: { commandProgress: true, concurrentJobs: true }
+    };
+    const attempts = [
+      ...this.#workspaceLabel ? [{
+        body: {
+          ...structuredBody,
+          workspaceLabel: this.#workspaceLabel
+        },
+        legacyRelay: false
+      }] : [],
+      {
+        body: structuredBody,
+        legacyRelay: false
+      },
+      ...this.#workspaceLabel ? [{
+        body: {
+          ...concurrentBody,
+          workspaceLabel: this.#workspaceLabel
+        },
+        legacyRelay: false
+      }] : [],
+      {
+        body: concurrentBody,
+        legacyRelay: false
+      },
+      {
+        body: {
+          workerId: this.#workerId,
+          capabilities: { commandProgress: true }
+        },
+        legacyRelay: false
+      },
+      { body: { workerId: this.#workerId }, legacyRelay: false },
+      { body: {}, legacyRelay: true }
+    ];
+    for (const [index, attempt] of attempts.entries()) {
+      let response;
+      try {
+        response = await this.#post("/device/register", attempt.body);
+      } catch (error46) {
+        if (error46 instanceof RelayResponseError && error46.status === 400 && index < attempts.length - 1) {
+          continue;
+        }
         throw error46;
       }
-      response = await this.#post("/device/register", {});
-      const legacyValue = await response.json();
-      if (typeof legacyValue !== "object" || legacyValue === null || !("generation" in legacyValue) || typeof legacyValue.generation !== "string") {
+      const value = await response.json();
+      if (typeof value !== "object" || value === null || !("generation" in value) || typeof value.generation !== "string") {
         throw new Error("The relay returned an invalid registration response.");
       }
-      return { generation: legacyValue.generation, legacyRelay: true };
-    }
-    const value = await response.json();
-    if (typeof value !== "object" || value === null || !("generation" in value) || typeof value.generation !== "string" || !("workerId" in value) || value.workerId !== this.#workerId) {
-      throw new Error("The relay returned an invalid registration response.");
+      if (!attempt.legacyRelay && (!("workerId" in value) || value.workerId !== this.#workerId)) {
+        throw new Error("The relay returned an invalid registration response.");
+      }
+      const workerToken = "workerToken" in value ? optionalWorkerToken(value.workerToken) : void 0;
+      return {
+        generation: value.generation,
+        legacyRelay: attempt.legacyRelay,
+        concurrentJobs: !attempt.legacyRelay && supportsCapability(value, "concurrentJobs"),
+        structuredReads: !attempt.legacyRelay && supportsCapability(value, "structuredReads"),
+        workspaceLabelAccepted: this.#workspaceLabel === void 0 || "workspaceLabel" in value && value.workspaceLabel === this.#workspaceLabel,
+        ...workerToken ? { workerToken } : {}
+      };
     }
-    return { generation: value.generation, legacyRelay: false };
+    throw new Error("The relay rejected every supported registration shape.");
   }
   async #pollGeneration(session) {
+    if (session.legacyRelay || !session.concurrentJobs) {
+      await this.#pollSequentially(session);
+      return;
+    }
+    await this.#pollConcurrently(session);
+  }
+  async #pollSequentially(session) {
     while (!this.#signal.aborted) {
-      const response = await this.#post(
-        "/device/poll",
-        session.legacyRelay ? { generation: session.generation } : { workerId: this.#workerId, generation: session.generation }
-      );
-      if (response.status === 204) continue;
-      const value = await response.json();
-      const parsed = workerJobSchema.safeParse(
-        typeof value === "object" && value !== null && "job" in value ? value.job : void 0
-      );
-      if (!parsed.success) {
-        throw new Error("The relay returned an invalid worker job.");
-      }
-      const heartbeat = session.legacyRelay ? void 0 : setInterval(() => {
-        void this.#post("/device/heartbeat", {
-          workerId: this.#workerId,
-          generation: session.generation
-        }).catch(() => {
+      const job = await this.#pollForJob(session);
+      if (!job) continue;
+      await this.#handleAndPost(session, job, true);
+    }
+  }
+  async #pollConcurrently(session) {
+    const counts = {
+      status: 0,
+      cancel: 0,
+      read: 0,
+      mutation: 0
+    };
+    const inFlight = /* @__PURE__ */ new Set();
+    let failure;
+    let heartbeat;
+    const stopHeartbeat = () => {
+      if (!heartbeat) return;
+      clearInterval(heartbeat);
+      heartbeat = void 0;
+    };
+    const ensureHeartbeat = () => {
+      if (heartbeat) return;
+      heartbeat = setInterval(() => {
+        void this.#post(
+          "/device/heartbeat",
+          { workerId: this.#workerId, generation: session.generation },
+          session.workerToken
+        ).catch(() => {
         });
       }, this.#heartbeatMs);
-      heartbeat?.unref();
-      let result;
-      try {
-        result = await this.#worker.handle(parsed.data);
-      } finally {
-        if (heartbeat) clearInterval(heartbeat);
+      heartbeat.unref();
+    };
+    const dispatch = (job) => {
+      const lane = jobLane(job);
+      counts[lane] += 1;
+      ensureHeartbeat();
+      let task;
+      task = this.#handleAndPost(session, job, false).catch((error46) => {
+        failure ??= error46;
+      }).finally(() => {
+        counts[lane] -= 1;
+        inFlight.delete(task);
+        if (inFlight.size === 0) stopHeartbeat();
+      });
+      inFlight.add(task);
+    };
+    try {
+      while (!this.#signal.aborted) {
+        if (failure !== void 0) throw failure;
+        const acceptedTypes = acceptedJobTypes(
+          counts,
+          inFlight.size,
+          session.structuredReads
+        );
+        if (acceptedTypes.length === 0) {
+          await Promise.race(inFlight);
+          continue;
+        }
+        const job = await this.#pollForJob(
+          session,
+          acceptedTypes,
+          inFlight.size > 0 ? CONCURRENT_WORKER_POLL_MS : void 0
+        );
+        if (!job) continue;
+        if (!acceptedTypes.includes(job.type)) {
+          throw new Error("The relay delivered a job outside worker capacity.");
+        }
+        dispatch(job);
       }
+    } finally {
+      stopHeartbeat();
+      await Promise.allSettled(inFlight);
+    }
+    if (failure !== void 0) throw failure;
+  }
+  async #pollForJob(session, acceptedTypes, waitMs) {
+    const response = await this.#post(
+      "/device/poll",
+      session.legacyRelay ? { generation: session.generation } : {
+        workerId: this.#workerId,
+        generation: session.generation,
+        ...acceptedTypes ? { acceptedTypes } : {},
+        ...waitMs === void 0 ? {} : { waitMs }
+      },
+      session.workerToken
+    );
+    if (response.status === 204) return null;
+    const value = await response.json();
+    const parsed = workerJobSchema.safeParse(
+      typeof value === "object" && value !== null && "job" in value ? value.job : void 0
+    );
+    if (!parsed.success) {
+      throw new Error("The relay returned an invalid worker job.");
+    }
+    return parsed.data;
+  }
+  async #handleAndPost(session, job, heartbeatWhileRunning) {
+    const heartbeat = heartbeatWhileRunning && !session.legacyRelay ? setInterval(() => {
+      void this.#post(
+        "/device/heartbeat",
+        { workerId: this.#workerId, generation: session.generation },
+        session.workerToken
+      ).catch(() => {
+      });
+    }, this.#heartbeatMs) : void 0;
+    heartbeat?.unref();
+    let result;
+    try {
+      result = await this.#worker.handle(job);
+    } finally {
+      if (heartbeat) clearInterval(heartbeat);
+    }
+    try {
       await this.#post(
         "/device/result",
-        session.legacyRelay ? result : { workerId: this.#workerId, result }
+        session.legacyRelay ? result : { workerId: this.#workerId, result },
+        session.workerToken
       );
+    } catch (error46) {
+      if (error46 instanceof RelayResponseError && error46.status === 410) return;
+      throw error46;
     }
   }
-  async #unregister() {
-    try {
-      await this.#fetcher(new URL("/device/unregister", this.#origin), {
-        method: "POST",
-        headers: {
-          authorization: `Device ${this.#deviceToken}`,
-          "content-type": "application/json"
-        },
-        body: JSON.stringify({ workerId: this.#workerId }),
-        signal: AbortSignal.timeout(3e3)
-      });
-    } catch {
+  async #unregister(session) {
+    const unregister = async (authorization) => {
+      try {
+        const response = await this.#fetcher(
+          new URL("/device/unregister", this.#origin),
+          {
+            method: "POST",
+            headers: {
+              authorization,
+              "content-type": "application/json"
+            },
+            body: JSON.stringify({ workerId: this.#workerId }),
+            signal: AbortSignal.timeout(3e3)
+          }
+        );
+        if (response.ok) return "accepted";
+        return [400, 401, 404, 409].includes(response.status) ? "rejected" : "unreachable";
+      } catch {
+        return "unreachable";
+      }
+    };
+    if (!session?.workerToken) {
+      await unregister(`Device ${this.#deviceToken}`);
+      return;
+    }
+    const result = await unregister(`Worker ${session.workerToken}`);
+    if (result === "rejected") {
+      await unregister(`Device ${this.#deviceToken}`);
     }
   }
-  async #post(path8, body) {
+  async #post(path8, body, workerToken) {
     const timeout = AbortSignal.timeout(WORKER_REQUEST_TIMEOUT_MS);
     const signal = AbortSignal.any([this.#signal, timeout]);
     const response = await this.#fetcher(new URL(path8, this.#origin), {
       method: "POST",
       headers: {
-        authorization: `Device ${this.#deviceToken}`,
+        authorization: workerToken ? `Worker ${workerToken}` : `Device ${this.#deviceToken}`,
         "content-type": "application/json"
       },
       body: JSON.stringify(body),
       signal
     });
-    if (response.status === 401) throw new DeviceRejectedError();
+    if (response.status === 401 && !workerToken) throw new DeviceRejectedError();
     if (!response.ok) throw new RelayResponseError(response.status);
     return response;
   }
 };
 
 // src/worker/managed-session.ts
-var visibleActivity = /* @__PURE__ */ new Set([
-  "write_file",
-  "edit_file",
-  "run_command",
-  "cancel_command"
-]);
-function activityLabel2(type, finished, ok = true) {
-  if (type === "run_command") {
-    return finished ? ok ? "Command started" : "Command rejected" : "Command requested";
+function report(options, event, message) {
+  options.onEvent?.(event);
+  if (!options.quiet) console.error(message);
+}
+function activityResultLabel(job, result) {
+  if (!result.ok) return `${job.type} failed`;
+  if (job.type === "run_command" && result.value && typeof result.value === "object" && "status" in result.value && result.value.status === "running") {
+    return "run_command started";
+  }
+  return `${job.type} completed`;
+}
+function visibleWorker(worker, options) {
+  return {
+    async handle(job) {
+      options.onEvent?.({ type: "activity", phase: "started", job });
+      try {
+        const result = await worker.handle(job);
+        report(
+          options,
+          { type: "activity", phase: "returned", job, ok: result.ok },
+          `${activityResultLabel(job, result)} (${job.requestId}).`
+        );
+        return result;
+      } catch (error46) {
+        report(
+          options,
+          { type: "activity", phase: "returned", job, ok: false },
+          `${job.type} failed (${job.requestId}).`
+        );
+        throw error46;
+      }
+    }
+  };
+}
+async function deviceForSession(endpoints, dependencies = {}, signal) {
+  const loadDevice = dependencies.loadDeviceCredential ?? loadDeviceCredential;
+  const loadLogin = dependencies.loadCredentials ?? loadCredentials;
+  const validate = dependencies.validCredentials ?? validCredentials;
+  const subjectFor = dependencies.accessTokenSubject ?? accessTokenSubject;
+  const removeDevice = dependencies.deleteDeviceCredential ?? deleteDeviceCredential;
+  const enroll = dependencies.enrollDevice ?? enrollDevice;
+  const saveDevice = dependencies.saveDeviceCredential ?? saveDeviceCredential;
+  const ownsDevice = dependencies.accountOwnsDevice ?? accountOwnsDevice;
+  const name = dependencies.defaultDeviceName ?? defaultDeviceName;
+  const baseFetch = dependencies.fetch ?? fetch;
+  const fetchRequest = signal ? async (input, init) => await baseFetch(input, { ...init, signal }) : baseFetch;
+  signal?.throwIfAborted();
+  const stored = await loadDevice();
+  let credentials = dependencies.credentials;
+  const currentCredentials = async () => {
+    if (credentials) return credentials;
+    const loaded = await loadLogin();
+    if (!loaded) throw new Error("Not signed in. Run Glossa again to sign in.");
+    credentials = await validate(loaded.credentials, { fetch: fetchRequest });
+    return credentials;
+  };
+  if (stored?.relayOrigin === endpoints.relayOrigin) {
+    const current2 = await currentCredentials();
+    const accountSubject = subjectFor(current2);
+    if (stored.accountSubject === accountSubject) return stored;
+    if (stored.accountSubject === void 0 && await ownsDevice(endpoints, current2, stored.deviceId, fetchRequest)) {
+      const migrated = { ...stored, accountSubject };
+      await saveDevice(migrated);
+      return migrated;
+    }
+    await removeDevice();
+  }
+  signal?.throwIfAborted();
+  const current = await currentCredentials();
+  const enrolled = await enroll(
+    endpoints,
+    current,
+    name(),
+    fetchRequest
+  );
+  const bound = {
+    ...enrolled,
+    accountSubject: subjectFor(current)
+  };
+  await saveDevice(bound);
+  return bound;
+}
+async function reenrollRejectedDevice(endpoints, dependencies = {}, signal) {
+  const remove = dependencies.deleteDeviceCredential ?? deleteDeviceCredential;
+  await remove();
+  return await deviceForSession(endpoints, dependencies, signal);
+}
+function retryMessage(retryInMs) {
+  const seconds = Math.max(1, Math.ceil(retryInMs / 1e3));
+  return `Retrying in ${seconds} ${seconds === 1 ? "second" : "seconds"}.`;
+}
+function workspaceLabelNotice(status, requestedLabel) {
+  if (status.state !== "connected" || !requestedLabel || status.workspaceLabelAccepted !== false) {
+    return void 0;
+  }
+  return "The relay needs an update before workspace labels are available. This workspace is online without the requested label.";
+}
+var legacyRelayNotice = "The relay needs an update before this computer can expose several workspaces at once.";
+function combinedCompatibilityNotice(labelNotice, includeLegacyRelayNotice) {
+  const messages = [
+    labelNotice,
+    includeLegacyRelayNotice ? legacyRelayNotice : void 0
+  ].filter((message) => Boolean(message));
+  return messages.length > 0 ? messages.join(" ") : void 0;
+}
+function statusMessage(status, connectedBefore) {
+  if (status.state === "connecting") return "Connecting to Glossa...";
+  if (status.state === "connected") {
+    return status.reconnected ? "Reconnected to Glossa." : "Connected to Glossa. ChatGPT can now use this workspace.";
+  }
+  if (status.state === "retrying") {
+    const prefix = connectedBefore ? "Connection lost" : "Could not connect";
+    return `${prefix}: ${status.error.message} ${retryMessage(status.retryInMs)}`;
+  }
+  return "Disconnected from Glossa.";
+}
+async function connectRemoteWorker(endpoints, device, worker, options, signal, onConnected) {
+  let connectionState;
+  let connectedBefore = false;
+  let labelNoticeShown = false;
+  let legacyNoticeShown = false;
+  let connectHintTask;
+  const remoteWorker = new RemoteWorker({
+    origin: endpoints.workerOrigin,
+    deviceToken: device.token,
+    ...options.workspaceLabel ? { workspaceLabel: options.workspaceLabel } : {},
+    worker: visibleWorker(worker, options),
+    signal,
+    onStatus(status) {
+      if (status.state === "connected") {
+        connectedBefore = true;
+        onConnected();
+      }
+      if (status.state !== "retrying" || connectionState !== "retrying") {
+        report(options, { type: "status", status }, statusMessage(status, connectedBefore));
+      } else {
+        options.onEvent?.({ type: "status", status });
+      }
+      const labelNotice = labelNoticeShown ? void 0 : workspaceLabelNotice(status, options.workspaceLabel);
+      const includeLegacyNotice = status.state === "connected" && status.legacyRelay && !legacyNoticeShown;
+      const compatibilityNotice = combinedCompatibilityNotice(
+        labelNotice,
+        includeLegacyNotice
+      );
+      if (labelNotice) labelNoticeShown = true;
+      if (includeLegacyNotice) legacyNoticeShown = true;
+      if (compatibilityNotice) {
+        report(
+          options,
+          { type: "notice", message: compatibilityNotice },
+          compatibilityNotice
+        );
+      }
+      if (status.state === "connected" && !status.reconnected && !compatibilityNotice && shouldShowConnectHint(endpoints.relayOrigin) && !connectHintTask) {
+        connectHintTask = announceConnectHint(
+          connectHintStore(),
+          (message) => {
+            report(
+              options,
+              { type: "notice", message, persistAfterExit: true },
+              message
+            );
+          }
+        ).then(() => void 0).catch(() => void 0);
+      }
+      connectionState = status.state;
+    }
+  });
+  try {
+    await remoteWorker.run();
+  } finally {
+    await connectHintTask;
+  }
+}
+function shouldRecoverRejectedDevice(error46, recoveredRejectedDevice, connected) {
+  return error46 instanceof DeviceRejectedError && !recoveredRejectedDevice && !connected;
+}
+async function runManagedSession(root, endpoints, options = {}) {
+  const controller = new AbortController();
+  const stop = () => controller.abort();
+  const handleProcessSignals = options.handleProcessSignals ?? true;
+  let worker;
+  if (options.signal?.aborted) controller.abort();
+  else options.signal?.addEventListener("abort", stop, { once: true });
+  if (handleProcessSignals) {
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+  }
+  try {
+    let device = await deviceForSession(
+      endpoints,
+      options.credentials ? { credentials: options.credentials } : {},
+      controller.signal
+    );
+    controller.signal.throwIfAborted();
+    worker = await LocalWorker.create(root);
+    controller.signal.throwIfAborted();
+    report(
+      options,
+      { type: "session", root: worker.policy.root, deviceName: device.deviceName },
+      `Glossa worker root: ${worker.policy.root}`
+    );
+    if (!options.quiet) {
+      console.error(`Glossa device: ${device.deviceName}`);
+      console.error(
+        "Files may be modified and commands have the full environment and permissions of this account. Press Ctrl+C to disconnect."
+      );
+    }
+    let recoveredRejectedDevice = false;
+    while (!controller.signal.aborted) {
+      let connected = false;
+      try {
+        await connectRemoteWorker(
+          endpoints,
+          device,
+          worker,
+          options,
+          controller.signal,
+          () => {
+            connected = true;
+          }
+        );
+        break;
+      } catch (error46) {
+        if (!shouldRecoverRejectedDevice(
+          error46,
+          recoveredRejectedDevice,
+          connected
+        )) {
+          throw error46;
+        }
+        recoveredRejectedDevice = true;
+        device = await reenrollRejectedDevice(
+          endpoints,
+          options.credentials ? { credentials: options.credentials } : {},
+          controller.signal
+        );
+      }
+    }
+  } catch (error46) {
+    if (error46 instanceof DeviceRejectedError) {
+      await deleteDeviceCredential();
+      throw new Error("The relay rejected this device. Run Glossa again to reenroll it.");
+    }
+    throw error46;
+  } finally {
+    options.signal?.removeEventListener("abort", stop);
+    if (handleProcessSignals) {
+      process.removeListener("SIGINT", stop);
+      process.removeListener("SIGTERM", stop);
+    }
+    await worker?.shutdown();
+  }
+}
+
+// src/ui-hud.ts
+function retainPostExitNotice(current, event) {
+  return event.type === "notice" && event.persistAfterExit ? event.message : current;
+}
+function initialHudState(workspace) {
+  return {
+    workspace,
+    connection: "starting",
+    connectedBefore: false,
+    message: void 0,
+    activities: [],
+    view: "session",
+    status: void 0,
+    statusLoading: false,
+    prompt: void 0,
+    busy: false,
+    notice: void 0
+  };
+}
+function truncate(value, width) {
+  if (width <= 0) return "";
+  if (value.length <= width) return value;
+  if (width === 1) return "\u2026";
+  return `${value.slice(0, width - 1)}\u2026`;
+}
+function compactJobBody(job) {
+  const entries = Object.entries(job).filter(
+    ([key]) => key !== "type" && key !== "requestId"
+  );
+  const body = JSON.stringify(Object.fromEntries(entries));
+  return truncate(body, 360);
+}
+function applyHudEvent(state, event) {
+  if (event.type === "session") {
+    return { ...state, workspace: event.root, deviceName: event.deviceName };
+  }
+  if (event.type === "status") {
+    if (event.status.state === "retrying") {
+      return {
+        ...state,
+        connection: "retrying",
+        message: statusMessage(event.status, state.connectedBefore)
+      };
+    }
+    return {
+      ...state,
+      connection: event.status.state,
+      connectedBefore: state.connectedBefore || event.status.state === "connected",
+      message: void 0
+    };
+  }
+  if (event.type === "notice") {
+    return { ...state, notice: event.message };
+  }
+  const requestId = event.job.requestId;
+  const existingIndex = state.activities.findIndex(
+    (activity2) => activity2.requestId === requestId
+  );
+  const activity = {
+    tool: event.job.type,
+    body: compactJobBody(event.job),
+    requestId,
+    state: event.phase === "started" ? "working" : event.ok ? "returned" : "failed"
+  };
+  const activities = [...state.activities];
+  if (existingIndex >= 0) activities[existingIndex] = activity;
+  else activities.push(activity);
+  return { ...state, activities: activities.slice(-20) };
+}
+var ANSI_BASE = "\x1B[22;38;2;244;241;251;48;2;17;16;22m";
+var PALETTE = {
+  ink: "38;2;244;241;251",
+  muted: "38;2;170;164;181",
+  purple: "38;2;128;84;255",
+  purpleReadable: "38;2;173;152;255",
+  coral: "38;2;255;102;95",
+  line: "38;2;92;85;110"
+};
+function style(enabled, code, value) {
+  return enabled ? `\x1B[${code}m${value}${ANSI_BASE}` : value;
+}
+function sectionTitle(label, color, tone = PALETTE.purpleReadable) {
+  return style(color, `${tone};1`, label.toUpperCase());
+}
+function connectionLabel(state) {
+  if (state.connection === "connected") return "Connected";
+  if (state.connection === "connecting" || state.connection === "starting") {
+    return "Connecting";
+  }
+  if (state.connection === "retrying") return "Reconnecting";
+  if (state.connection === "error") return "Error";
+  return "Disconnected";
+}
+function headerLabel(state) {
+  const running = [...state.activities].reverse().find(
+    (activity) => activity.state === "working"
+  );
+  return running?.tool ?? connectionLabel(state);
+}
+function renderHeader(state, usable, color) {
+  const brand = "Glossa";
+  const label = truncate(
+    headerLabel(state),
+    Math.max(1, usable - brand.length - 1)
+  );
+  const gap = " ".repeat(Math.max(1, usable - brand.length - label.length));
+  const tone = state.connection === "error" ? PALETTE.coral : PALETTE.purpleReadable;
+  return [
+    `${style(color, `${PALETTE.purple};1`, brand)}${gap}${style(color, `${tone};1`, label)}`,
+    style(color, PALETTE.line, "\u2500".repeat(usable))
+  ];
+}
+function renderSession(state, usable, color) {
+  const lines = [
+    "",
+    sectionTitle("Workspace", color),
+    style(color, PALETTE.ink, truncate(state.workspace, usable))
+  ];
+  if (state.deviceName) {
+    lines.push(
+      "",
+      sectionTitle("Device", color),
+      style(color, PALETTE.ink, truncate(state.deviceName, usable))
+    );
+  }
+  if (state.message && (state.connection === "retrying" || state.connection === "error")) {
+    lines.push(
+      "",
+      style(color, PALETTE.coral, truncate(state.message, usable))
+    );
+  }
+  return lines;
+}
+function activityGlyph(activity, color) {
+  if (activity.state === "working") {
+    return style(color, PALETTE.muted, "\u25CC");
+  }
+  return activity.state === "failed" ? style(color, PALETTE.coral, "\xD7") : style(color, PALETTE.purpleReadable, "\u25CF");
+}
+function renderActivity(state, usable, color, bodyBudget) {
+  const lines = ["", sectionTitle("Recent activity", color)];
+  if (state.activities.length === 0) {
+    lines.push("", style(color, PALETTE.muted, "No activity yet."));
+    return lines;
+  }
+  const visibleEntryCount = Math.min(
+    8,
+    Math.max(0, Math.floor((bodyBudget - lines.length) / 3))
+  );
+  if (visibleEntryCount === 0) return lines;
+  for (const activity of state.activities.slice(-visibleEntryCount)) {
+    lines.push(
+      "",
+      `${activityGlyph(activity, color)} ${style(color, `${PALETTE.ink};1`, truncate(activity.tool, Math.max(1, usable - 2)))}`,
+      style(color, PALETTE.muted, truncate(activity.body, usable))
+    );
+  }
+  return lines;
+}
+function metric(label, value, usable, color) {
+  const visibleValue = truncate(value, Math.max(1, usable - 1));
+  const visibleLabel = truncate(
+    label,
+    Math.max(0, usable - visibleValue.length - 1)
+  );
+  const gap = " ".repeat(
+    Math.max(1, usable - visibleLabel.length - visibleValue.length)
+  );
+  return `${style(color, PALETTE.muted, visibleLabel)}${gap}${style(color, PALETTE.ink, visibleValue)}`;
+}
+function tableCell(value, width) {
+  return truncate(value, width).padEnd(width);
+}
+function renderDeviceRows(device, index, usable, color) {
+  const number4 = String(index + 1).padStart(2);
+  const statusTone = device.status.includes("active") ? PALETTE.purpleReadable : PALETTE.muted;
+  if (usable < 64) {
+    const prefix = `${number4}  `;
+    const details = `${device.name} \xB7 ${device.status} \xB7 ${device.platform} \xB7 ${device.lastSeen}`;
+    return [
+      `${style(color, `${PALETTE.purpleReadable};1`, number4)}  ${style(
+        color,
+        statusTone,
+        truncate(details, Math.max(1, usable - prefix.length))
+      )}`
+    ];
+  }
+  const statusWidth = 16;
+  const platformWidth = 12;
+  const lastSeenWidth = Math.min(
+    18,
+    Math.max(10, Math.floor(usable * 0.18))
+  );
+  const nameWidth = usable - 38 - lastSeenWidth;
+  return [
+    `${style(color, `${PALETTE.purpleReadable};1`, number4)}  ${style(color, PALETTE.ink, tableCell(device.name, nameWidth))}  ${style(color, statusTone, tableCell(device.status, statusWidth))}  ${style(color, PALETTE.muted, tableCell(device.platform, platformWidth))}  ${style(color, PALETTE.muted, tableCell(device.lastSeen, lastSeenWidth))}`
+  ];
+}
+function deviceTableHeading(usable, color) {
+  if (usable < 64) return void 0;
+  const statusWidth = 16;
+  const platformWidth = 12;
+  const lastSeenWidth = Math.min(
+    18,
+    Math.max(10, Math.floor(usable * 0.18))
+  );
+  const nameWidth = usable - 38 - lastSeenWidth;
+  return style(
+    color,
+    PALETTE.muted,
+    `    ${tableCell("Device", nameWidth)}  ${tableCell("Workers", statusWidth)}  ${tableCell("Platform", platformWidth)}  ${tableCell("Last seen", lastSeenWidth)}`
+  );
+}
+function renderStatus(state, usable, color, visibleDeviceCount) {
+  const lines = ["", sectionTitle("Account", color)];
+  if (state.statusLoading) {
+    lines.push("", style(color, PALETTE.muted, "Loading status\u2026"));
+    return lines;
   }
-  if (type === "write_file") {
-    return finished ? ok ? "File write completed" : "File write rejected" : "File write started";
+  if (!state.status) {
+    lines.push("", style(color, PALETTE.muted, "Status is not loaded."));
+    return lines;
   }
-  if (type === "edit_file") {
-    return finished ? ok ? "File edit completed" : "File edit rejected" : "File edit started";
+  const workerCount = state.status.activeWorkers === null ? "Unavailable" : String(state.status.activeWorkers);
+  lines.push(
+    style(color, PALETTE.ink, truncate(state.status.account, usable)),
+    style(color, PALETTE.muted, truncate(state.status.relay, usable)),
+    "",
+    sectionTitle("Overview", color),
+    metric("Active workspaces", workerCount, usable, color),
+    metric("Devices", String(state.status.devices.length), usable, color),
+    "",
+    sectionTitle("Devices", color)
+  );
+  if (state.status.devices.length === 0) {
+    lines.push("", style(color, PALETTE.muted, "No active devices."));
+    return lines;
+  }
+  const heading = deviceTableHeading(usable, color);
+  if (heading) lines.push(heading);
+  state.status.devices.slice(0, visibleDeviceCount).forEach((device, index) => {
+    lines.push(...renderDeviceRows(device, index, usable, color));
+  });
+  const hiddenCount = state.status.devices.length - visibleDeviceCount;
+  if (hiddenCount > 0) {
+    lines.push(
+      style(
+        color,
+        PALETTE.muted,
+        truncate(
+          `${hiddenCount} more. Use glossa devices revoke <id>.`,
+          usable
+        )
+      )
+    );
   }
-  return finished ? ok ? "Command cancellation completed" : "Command cancellation rejected" : "Command cancellation requested";
+  return lines;
 }
-function report(options, event, message) {
-  options.onEvent?.(event);
-  if (!options.quiet) console.error(message);
+function helpRows(key, label, usable, color, tone = PALETTE.purpleReadable) {
+  const available = Math.max(1, usable - key.length - 2);
+  return [
+    `${style(color, `${tone};1`, key)}  ${truncate(label, available)}`
+  ];
 }
-function visibleWorker(worker, options) {
-  return {
-    async handle(job) {
-      if (visibleActivity.has(job.type)) {
-        report(
-          options,
-          { type: "activity", phase: "requested", jobType: job.type, requestId: job.requestId },
-          `${activityLabel2(job.type, false)} (${job.requestId}).`
-        );
-      }
-      const result = await worker.handle(job);
-      if (visibleActivity.has(job.type)) {
-        report(
-          options,
-          {
-            type: "activity",
-            phase: "finished",
-            jobType: job.type,
-            requestId: job.requestId,
-            ok: result.ok
-          },
-          `${activityLabel2(job.type, true, result.ok)} (${job.requestId}).`
-        );
-      }
-      return result;
-    }
-  };
+function renderHelp(usable, color) {
+  return [
+    "",
+    sectionTitle("Navigate", color),
+    ...helpRows("D", "Recent activity", usable, color),
+    ...helpRows("S", "Account and devices", usable, color),
+    ...helpRows("?", "Close help", usable, color),
+    "",
+    sectionTitle("Manage", color, PALETTE.coral),
+    ...helpRows(
+      "R",
+      "Revoke a device from status",
+      usable,
+      color,
+      PALETTE.coral
+    ),
+    ...helpRows("L", "Sign out", usable, color, PALETTE.coral),
+    "",
+    sectionTitle("Session", color),
+    ...helpRows("Q", "Disconnect and quit", usable, color, PALETTE.coral),
+    ...helpRows(
+      "Ctrl+C",
+      "Disconnect and quit",
+      usable,
+      color,
+      PALETTE.coral
+    )
+  ];
 }
-async function deviceForSession(endpoints, dependencies = {}, signal) {
-  const loadDevice = dependencies.loadDeviceCredential ?? loadDeviceCredential;
-  const loadLogin = dependencies.loadCredentials ?? loadCredentials;
-  const validate = dependencies.validCredentials ?? validCredentials;
-  const removeDevice = dependencies.deleteDeviceCredential ?? deleteDeviceCredential;
-  const ownsDevice = dependencies.accountOwnsDevice ?? accountOwnsDevice;
-  const enroll = dependencies.enrollDevice ?? enrollDevice;
-  const saveDevice = dependencies.saveDeviceCredential ?? saveDeviceCredential;
-  const name = dependencies.defaultDeviceName ?? defaultDeviceName;
-  const baseFetch = dependencies.fetch ?? fetch;
-  const fetchRequest = signal ? async (input, init) => await baseFetch(input, { ...init, signal }) : baseFetch;
-  signal?.throwIfAborted();
-  const stored = await loadDevice();
-  const loaded = await loadLogin();
-  if (!loaded) throw new Error("Not signed in. Run Glossa again to sign in.");
-  const credentials = await validate(loaded.credentials, { fetch: fetchRequest });
-  signal?.throwIfAborted();
-  if (stored?.relayOrigin === endpoints.relayOrigin) {
-    if (await ownsDevice(
-      endpoints,
-      credentials,
-      stored.deviceId,
-      fetchRequest
-    )) {
-      return stored;
-    }
-    await removeDevice();
+function promptText(state) {
+  if (state.busy) return { message: "Working\u2026" };
+  if (!state.prompt) return void 0;
+  if (state.prompt.type === "logout") {
+    return { message: "Sign out and disconnect?", choices: "Y confirm  N cancel" };
   }
-  const enrolled = await enroll(
-    endpoints,
-    credentials,
-    dependencies.deviceName ?? name(),
-    fetchRequest
+  if (state.prompt.type === "revoke-select") {
+    return { message: "Choose a device number to revoke.", choices: "Esc cancel" };
+  }
+  const device = state.status?.devices[state.prompt.deviceIndex];
+  return {
+    message: `Revoke ${device?.name ?? "this device"}?`,
+    choices: "Y confirm  N cancel"
+  };
+}
+function footerHints(state) {
+  if (state.view === "status") {
+    return [
+      { key: "R", label: "Revoke", tone: PALETTE.coral },
+      { key: "L", label: "Sign out", tone: PALETTE.coral },
+      { key: "Esc", label: "Session" },
+      { key: "Q", label: "Quit", tone: PALETTE.coral }
+    ];
+  }
+  if (state.view === "activity") {
+    return [
+      { key: "D", label: "Session" },
+      { key: "S", label: "Status" },
+      { key: "?", label: "Help" },
+      { key: "Q", label: "Quit", tone: PALETTE.coral }
+    ];
+  }
+  if (state.view === "help") {
+    return [
+      { key: "?", label: "Session" },
+      { key: "Q", label: "Quit", tone: PALETTE.coral }
+    ];
+  }
+  return [
+    { key: "D", label: "Activity" },
+    { key: "S", label: "Status" },
+    { key: "?", label: "Help" },
+    { key: "L", label: "Sign out", tone: PALETTE.coral },
+    { key: "Q", label: "Quit", tone: PALETTE.coral }
+  ];
+}
+function renderFooter(state, usable, color) {
+  const rows = [[]];
+  let rowLength = 0;
+  for (const hint of footerHints(state)) {
+    const tokenLength = hint.key.length + hint.label.length + 1;
+    if (rows.at(-1).length > 0 && rowLength + 3 + tokenLength > usable) {
+      rows.push([]);
+      rowLength = 0;
+    }
+    rows.at(-1).push(hint);
+    rowLength += (rowLength > 0 ? 3 : 0) + tokenLength;
+  }
+  return rows.map(
+    (row) => row.map(
+      (hint) => `${style(color, `${hint.tone ?? PALETTE.purpleReadable};1`, hint.key)} ${style(color, PALETTE.muted, hint.label)}`
+    ).join("   ")
   );
-  await saveDevice(enrolled);
-  return enrolled;
 }
-function statusMessage(status, previous) {
-  if (status.state === "connecting") return "Connecting to Glossa...";
-  if (status.state === "connected") {
-    return status.reconnected ? "Reconnected to Glossa." : "Connected to Glossa. ChatGPT can now use this workspace.";
-  }
-  if (status.state === "retrying") {
-    const prefix = previous === "connecting" ? "Could not connect" : "Connection lost";
-    return `${prefix}: ${status.error.message} Retrying automatically.`;
+function renderOverlay(state, usable, color) {
+  const prompt = promptText(state);
+  const message = prompt?.message ?? state.notice;
+  if (!message) return [];
+  const lines = [
+    style(color, PALETTE.line, "\u2500".repeat(usable)),
+    style(
+      color,
+      prompt ? `${PALETTE.coral};1` : PALETTE.coral,
+      truncate(message, usable)
+    )
+  ];
+  if (prompt?.choices) {
+    lines.push(style(color, PALETTE.muted, truncate(prompt.choices, usable)));
   }
-  return "Disconnected from Glossa.";
+  return lines;
 }
-async function runManagedSession(root, endpoints, allowBroadRoot = false, options = {}) {
-  const controller = new AbortController();
-  const stop = () => controller.abort();
-  const handleProcessSignals = options.handleProcessSignals ?? true;
-  let worker;
-  if (options.signal?.aborted) controller.abort();
-  else options.signal?.addEventListener("abort", stop, { once: true });
-  if (handleProcessSignals) {
-    process.once("SIGINT", stop);
-    process.once("SIGTERM", stop);
+function renderHud(state, width = 80, color = !process.env.NO_COLOR, height = 24) {
+  const margin = width >= 24 ? "  " : "";
+  const usable = Math.max(8, width - margin.length * 2);
+  const terminalHeight = Math.max(6, height);
+  const header = renderHeader(state, usable, color);
+  const overlay = renderOverlay(state, usable, color);
+  const footer = [
+    style(color, PALETTE.line, "\u2500".repeat(usable)),
+    ...renderFooter(state, usable, color)
+  ];
+  const bodyBudget = Math.max(
+    0,
+    terminalHeight - header.length - overlay.length - footer.length
+  );
+  const visibleDeviceCount = statusDeviceCapacity(
+    state,
+    bodyBudget,
+    usable
+  );
+  const body = state.view === "activity" ? renderActivity(state, usable, color, bodyBudget) : state.view === "status" ? renderStatus(state, usable, color, visibleDeviceCount) : state.view === "help" ? renderHelp(usable, color) : renderSession(state, usable, color);
+  const visibleBody = body.slice(0, bodyBudget);
+  const padding = Array.from(
+    {
+      length: Math.max(
+        0,
+        terminalHeight - header.length - visibleBody.length - overlay.length - footer.length
+      )
+    },
+    () => ""
+  );
+  const lines = [...header, ...visibleBody, ...padding, ...overlay, ...footer].slice(-terminalHeight);
+  return lines.map((line) => line ? `${margin}${line}` : "").join("\n");
+}
+function statusDeviceCapacity(state, bodyBudget, usable) {
+  if (state.view !== "status" || !state.status || state.statusLoading || state.status.devices.length === 0) {
+    return 0;
+  }
+  const statusPreambleLines = usable >= 64 ? 11 : 10;
+  const available = Math.max(0, bodyBudget - statusPreambleLines);
+  let visible = Math.min(9, state.status.devices.length, available);
+  if (state.status.devices.length > visible && visible > 0 && available - visible < 1) {
+    visible -= 1;
+  }
+  return visible;
+}
+function terminalStatusDeviceCapacity(state, width, height) {
+  const marginLength = width >= 24 ? 4 : 0;
+  const usable = Math.max(8, width - marginLength);
+  const terminalHeight = Math.max(6, height);
+  const bodyBudget = Math.max(
+    0,
+    terminalHeight - renderHeader(state, usable, false).length - renderOverlay(state, usable, false).length - 1 - renderFooter(state, usable, false).length
+  );
+  return statusDeviceCapacity(state, bodyBudget, usable);
+}
+async function runSessionHud(actions, input = process.stdin, output = process.stdout) {
+  if (!input.isTTY || !output.isTTY) {
+    throw new Error("Glossa requires an interactive terminal.");
   }
-  try {
-    const device = await deviceForSession(
-      endpoints,
-      options.deviceName ? { deviceName: options.deviceName } : {},
-      controller.signal
-    );
-    controller.signal.throwIfAborted();
-    worker = await LocalWorker.create(root, allowBroadRoot);
-    controller.signal.throwIfAborted();
-    report(
-      options,
-      { type: "session", root: worker.policy.root, deviceName: device.deviceName },
-      `Glossa worker root: ${worker.policy.root}`
+  emitKeypressEvents(input);
+  const wasRaw = input.isRaw;
+  const controller = new AbortController();
+  let state = initialHudState(actions.workspace);
+  let exitAction = "quit";
+  let stopUi;
+  const color = !process.env.NO_COLOR;
+  const render = () => {
+    const view = renderHud(
+      state,
+      output.columns ?? 80,
+      color,
+      output.rows ?? 24
     );
-    if (!options.quiet) {
-      console.error(`Glossa device: ${device.deviceName}`);
-      console.error(
-        "Files may be modified and commands have the full environment and permissions of this account. Press Ctrl+C to disconnect."
+    output.write(`${color ? ANSI_BASE : ""}\x1B[H\x1B[2J${view}`);
+  };
+  const resize = () => {
+    if (state.prompt?.type === "revoke-select" || state.prompt?.type === "revoke-confirm") {
+      const deviceCount = terminalStatusDeviceCapacity(
+        state,
+        output.columns ?? 80,
+        output.rows ?? 24
       );
-    }
-    let connectionState;
-    await new RemoteWorker({
-      origin: endpoints.workerOrigin,
-      deviceToken: device.token,
-      worker: visibleWorker(worker, options),
-      signal: controller.signal,
-      onStatus(status) {
-        if (status.state !== "retrying" || connectionState !== "retrying") {
-          report(options, { type: "status", status }, statusMessage(status, connectionState));
-        } else {
-          options.onEvent?.({ type: "status", status });
-        }
-        if (status.state === "connected" && status.legacyRelay) {
-          report(
-            options,
-            { type: "notice", message: "The relay needs an update before this computer can expose several workspaces at once." },
-            "The relay needs an update before this computer can expose several workspaces at once."
-          );
-        }
-        if (status.state === "connected" && !status.reconnected && shouldShowConnectHint(endpoints.relayOrigin)) {
-          void announceConnectHint(connectHintStore(), (message) => {
-            report(options, { type: "notice", message }, message);
-          }).catch(() => void 0);
-        }
-        connectionState = status.state;
+      const selectedDeviceIsHidden = state.prompt.type === "revoke-confirm" && state.prompt.deviceIndex >= deviceCount;
+      if (deviceCount === 0 || selectedDeviceIsHidden) {
+        state = {
+          ...state,
+          prompt: void 0,
+          notice: "Increase the terminal height to choose a device."
+        };
+      } else if (state.prompt.type === "revoke-select") {
+        state = {
+          ...state,
+          prompt: { type: "revoke-select", deviceCount }
+        };
       }
-    }).run();
-  } catch (error46) {
-    if (error46 instanceof DeviceRejectedError) {
-      await deleteDeviceCredential();
-      throw new Error("The relay rejected this device. Run Glossa again to reenroll it.");
     }
+    render();
+  };
+  const loadStatus = async () => {
+    if (state.statusLoading) return;
+    if (state.connection !== "connected" && state.connection !== "retrying") {
+      state = { ...state, notice: "Status is available after Glossa connects." };
+      render();
+      return;
+    }
+    state = {
+      ...state,
+      view: "status",
+      statusLoading: true,
+      prompt: void 0,
+      notice: void 0
+    };
+    render();
+    try {
+      const status = await actions.loadStatus(controller.signal);
+      if (controller.signal.aborted) return;
+      state = { ...state, status, statusLoading: false };
+    } catch (error46) {
+      if (controller.signal.aborted) return;
+      state = {
+        ...state,
+        statusLoading: false,
+        notice: error46 instanceof Error ? error46.message : String(error46)
+      };
+    }
+    render();
+  };
+  const session = actions.run(controller.signal, (event) => {
+    state = applyHudEvent(state, event);
+    render();
+  }).then(() => {
+    if (!controller.signal.aborted) {
+      state = { ...state, connection: "disconnected" };
+    }
+    render();
+  }).catch((error46) => {
+    if (controller.signal.aborted) return;
+    state = {
+      ...state,
+      connection: "error",
+      message: error46 instanceof Error ? error46.message : String(error46)
+    };
+    render();
     throw error46;
+  });
+  input.setRawMode(true);
+  input.resume();
+  output.write("\x1B[?1049h\x1B[?25l");
+  output.on("resize", resize);
+  render();
+  const stop = (action = "quit") => {
+    exitAction = action;
+    controller.abort();
+    stopUi?.();
+  };
+  const stopFromSignal = () => stop();
+  process.once("SIGINT", stopFromSignal);
+  process.once("SIGTERM", stopFromSignal);
+  try {
+    await new Promise((resolve) => {
+      const onKeypress = (value, key) => {
+        if (key.ctrl && key.name === "c" || key.name === "q") return stop();
+        if (state.busy) return;
+        if (state.prompt) {
+          if (key.name === "escape" || key.name === "n") {
+            state = { ...state, prompt: void 0, notice: void 0 };
+            render();
+            return;
+          }
+          if (state.prompt.type === "revoke-select") {
+            const deviceIndex = Number(value) - 1;
+            if (Number.isInteger(deviceIndex) && deviceIndex >= 0 && deviceIndex < state.prompt.deviceCount) {
+              state = {
+                ...state,
+                prompt: { type: "revoke-confirm", deviceIndex }
+              };
+              render();
+            }
+            return;
+          }
+          if (key.name !== "y") return;
+          if (state.prompt.type === "logout") return stop("logout");
+          const device = state.status?.devices[state.prompt.deviceIndex];
+          if (!device) return;
+          state = {
+            ...state,
+            busy: true,
+            prompt: void 0,
+            notice: void 0
+          };
+          render();
+          void actions.revokeDevice(device.id, controller.signal).then(
+            async () => {
+              if (controller.signal.aborted) return;
+              state = {
+                ...state,
+                busy: false
+              };
+              await loadStatus();
+              if (controller.signal.aborted) return;
+              state = {
+                ...state,
+                notice: `Revoked ${device.name}.`
+              };
+              render();
+            }
+          ).catch((error46) => {
+            if (controller.signal.aborted) return;
+            state = {
+              ...state,
+              busy: false,
+              notice: error46 instanceof Error ? error46.message : String(error46)
+            };
+            render();
+          });
+          return;
+        }
+        if (key.name === "escape") {
+          state = { ...state, view: "session", notice: void 0 };
+          render();
+        } else if (key.name === "d") {
+          state = {
+            ...state,
+            view: state.view === "activity" ? "session" : "activity",
+            notice: void 0
+          };
+          render();
+        } else if (key.name === "s") {
+          void loadStatus();
+        } else if (key.name === "r" && state.view === "status") {
+          if ((state.status?.devices.length ?? 0) === 0) {
+            state = { ...state, notice: "There are no devices to revoke." };
+          } else {
+            const promptState = {
+              ...state,
+              prompt: { type: "revoke-select", deviceCount: 0 },
+              notice: void 0
+            };
+            const deviceCount = terminalStatusDeviceCapacity(
+              promptState,
+              output.columns ?? 80,
+              output.rows ?? 24
+            );
+            state = deviceCount === 0 ? {
+              ...state,
+              notice: "Increase the terminal height to choose a device."
+            } : {
+              ...promptState,
+              prompt: { type: "revoke-select", deviceCount }
+            };
+          }
+          render();
+        } else if (key.name === "l") {
+          state = {
+            ...state,
+            prompt: { type: "logout" },
+            notice: void 0
+          };
+          render();
+        } else if (value === "?" || key.sequence === "?") {
+          state = {
+            ...state,
+            view: state.view === "help" ? "session" : "help",
+            notice: void 0
+          };
+          render();
+        }
+      };
+      input.on("keypress", onKeypress);
+      void session.catch(() => stopUi?.());
+      stopUi = () => {
+        input.removeListener("keypress", onKeypress);
+        resolve();
+      };
+    });
+    await session;
+    return exitAction;
   } finally {
-    options.signal?.removeEventListener("abort", stop);
-    if (handleProcessSignals) {
-      process.removeListener("SIGINT", stop);
-      process.removeListener("SIGTERM", stop);
-    }
-    await worker?.shutdown();
+    output.removeListener("resize", resize);
+    process.removeListener("SIGINT", stopFromSignal);
+    process.removeListener("SIGTERM", stopFromSignal);
+    input.setRawMode(wasRaw);
+    input.pause();
+    output.write("\x1B[0m\x1B[?25h\x1B[?1049l");
   }
 }
 
 // src/worker/root-selection.ts
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-var execFileAsync = promisify(execFile);
-async function gitWorktreeRoot(cwd) {
-  try {
-    const { stdout } = await execFileAsync("git", ["rev-parse", "--show-toplevel"], {
-      cwd,
-      encoding: "utf8",
-      windowsHide: true
-    });
-    const root = stdout.trim();
-    return root || null;
-  } catch {
-    return null;
+import { realpath as realpath2 } from "node:fs/promises";
+import os4 from "node:os";
+import path7 from "node:path";
+function containsPath(root, candidate) {
+  const relative = path7.relative(root, candidate);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path7.sep}`) && !path7.isAbsolute(relative);
+}
+async function rejectImplicitHomeAncestor(root) {
+  const homes = await Promise.all(
+    [os4.homedir(), accountHomeDirectory()].map(
+      async (home) => await realpath2(home).catch(() => path7.resolve(home))
+    )
+  );
+  if (homes.some((home) => containsPath(root, home))) {
+    throw new WorkerError(
+      "broad_root_refused",
+      "The selected root contains a home directory, which Glossa will not expose implicitly. Choose a workspace directory instead."
+    );
   }
 }
-async function selectExposureRoot(explicitPath, allowBroadRoot = false, cwd = process.cwd()) {
-  const selected = explicitPath ?? await gitWorktreeRoot(cwd) ?? cwd;
-  return await canonicalizeRoot(selected, allowBroadRoot);
+async function selectExposureRoot(explicitPath, cwd = process.cwd()) {
+  const root = await canonicalizeRoot(explicitPath ?? cwd);
+  if (explicitPath === void 0) await rejectImplicitHomeAncestor(root);
+  return root;
 }
 
 // src/main.ts
-var VERSION = "0.1.0-beta.10";
-var helpText = {
-  main: `Glossa ${VERSION}
+var VERSION = "0.1.0-beta.12";
+var HELP = `Glossa ${VERSION}
 
 Usage:
-  glossa
-  glossa [directory]
-  glossa ui [directory] [--allow-broad-root] [--device-name <name>]
-  glossa start [directory] [--allow-broad-root] [--device-name <name>]
-  glossa status [--json]
-  glossa doctor [--json]
-  glossa devices list [--json]
-  glossa devices rename <id> <name>
+  glossa [--label <name>] [directory]
+  glossa status
   glossa devices revoke <id>
-  glossa completions <shell>
-  glossa update
-  glossa login
-  glossa logout [--browser]
-  glossa --version
+  glossa logout
   glossa --help
+  glossa --version
 
-Glossa signs in automatically and exposes each started workspace through the managed MCP relay.`,
-  ui: `Usage: glossa ui [directory] [--allow-broad-root] [--device-name <name>]
-
-Opens an experimental compact session HUD for the current workspace.
-It starts immediately, shows connection and activity, and exits with q or Ctrl+C. --device-name names this computer on first enrollment.`,
-  start: `Usage: glossa start [directory] [--allow-broad-root] [--device-name <name>]
-
-Starts a foreground worker in the selected directory. Pass . to select the current directory explicitly.
---device-name names this computer the first time it enrolls; once enrolled the name is reused. Press Ctrl+C to disconnect.`,
-  status: `Usage: glossa status [--json]
-
-Validates Google login, contacts the relay, and reports enrolled devices and active workers.`,
-  doctor: `Usage: glossa doctor [--json]
-
-Checks the runtime, relay and worker reachability, and read-only sign-in state, then reports whether Glossa is ready to start.`,
-  devices: `Usage:
-  glossa devices list [--json]
-  glossa devices rename <id> <name>
-  glossa devices revoke <id>
-
-Lists, renames, or revokes computers enrolled with the current Google account.`,
-  completions: `Usage: glossa completions <shell>
-
-Prints a completion script for powershell, bash, zsh, or fish. Source it from your shell profile, for example: glossa completions powershell | Out-String | Invoke-Expression.`,
-  update: `Usage: glossa update
-
-Updates Glossa using the same installation method. glossa upgrade is an alias.`,
-  login: `Usage: glossa login
-
-Ensures the CLI has a valid Google session. Starting Glossa also signs in automatically.`,
-  logout: `Usage: glossa logout [--browser]
+Running glossa opens one workspace in an interactive terminal.
 
-Removes local OAuth credentials. --browser also opens the browser-session logout used when switching Google accounts. Running workers remain connected until stopped or revoked.`
-};
+Keys:
+  d  recent activity
+  s  account and devices
+  r  revoke a device from status
+  l  sign out
+  ?  help
+  q  disconnect and quit`;
 async function withLoginSignal(action) {
   const controller = new AbortController();
   const cancel = () => controller.abort();
@@ -15510,124 +16655,92 @@ async function withLoginSignal(action) {
     process.removeListener("SIGINT", cancel);
   }
 }
-async function authenticatedCredentials(signal) {
-  const loginPerformed = signal ? await ensureSignedIn({ ...loadAuthConfig(), signal }) : await withLoginSignal(async (loginSignal) => {
-    return await ensureSignedIn({ ...loadAuthConfig(), signal: loginSignal });
-  });
-  const loaded = await loadCredentials();
-  if (!loaded) throw new Error("Glossa could not load the completed login.");
-  return {
-    credentials: await validCredentials(
-      loaded.credentials,
-      signal ? { signal } : {}
-    ),
-    loginPerformed
-  };
+async function authenticatedSession(signal) {
+  if (signal) return await signedInSession({ ...loadAuthConfig(), signal });
+  return await withLoginSignal(
+    async (loginSignal) => await signedInSession({ ...loadAuthConfig(), signal: loginSignal })
+  );
 }
-async function runExposure(path8, allowBroadRoot, deviceName) {
-  const root = await selectExposureRoot(path8, allowBroadRoot);
-  await authenticatedCredentials();
-  await runManagedSession(root, loadRelayEndpoints(), allowBroadRoot, {
-    ...deviceName ? { deviceName } : {}
-  });
+async function authenticatedCredentials(signal) {
+  return (await authenticatedSession(signal)).credentials;
 }
-async function showStatus(json2) {
-  const { credentials: initial } = await authenticatedCredentials();
-  const { credentials, profile } = await loadUserProfile(initial);
+async function showStatus() {
+  const credentials = await authenticatedCredentials();
   const endpoints = loadRelayEndpoints();
-  const devices = await listDevices(endpoints, credentials);
-  const account = profile.email ?? profile.name ?? profile.sub;
-  const workerCountsCurrent = devices.every((device) => device.activeWorkers !== null);
-  const activeWorkers = workerCountsCurrent ? devices.reduce((sum, device) => sum + device.activeWorkers, 0) : null;
-  const result = {
-    account,
-    relay: endpoints.relayOrigin,
-    connected: true,
-    activeWorkers,
-    devices
-  };
-  if (json2) {
-    console.log(JSON.stringify(result, null, 2));
-    return;
-  }
-  console.log(`Signed in as ${account}.`);
-  console.log(`Relay connected: ${endpoints.relayOrigin}`);
-  console.log(
-    activeWorkers === null ? "Active workers: unavailable until the relay is updated" : `Active workers: ${activeWorkers}`
-  );
-  if (devices.length === 0) {
-    console.log("No devices enrolled. Run glossa start in a workspace.");
-    return;
-  }
-  const hint = noActiveWorkerHint(activeWorkers, devices.length);
-  if (hint) console.log(hint);
-  for (const device of devices) {
-    console.log(formatDeviceRow(device));
-  }
+  const status = await new WorkspaceStatusService(
+    credentials,
+    endpoints
+  ).refresh();
+  for (const line of formatStatus(status)) console.log(line);
 }
-async function deviceCredentials() {
+function hudStatus(status) {
   return {
-    credentials: (await authenticatedCredentials()).credentials,
-    endpoints: loadRelayEndpoints()
-  };
-}
-async function showDevices(json2) {
-  const { endpoints, credentials } = await deviceCredentials();
-  const devices = await listDevices(endpoints, credentials);
-  if (json2) console.log(JSON.stringify({ devices }, null, 2));
-  else if (devices.length === 0) console.log("No devices enrolled.");
-  else for (const device of devices) console.log(formatDeviceRow(device));
-}
-async function runInteractive(path8, allowBroadRoot, deviceName) {
-  const root = await selectExposureRoot(path8, allowBroadRoot);
-  await runSessionHud({
+    ...status,
+    devices: status.devices.map((device) => ({
+      id: device.id,
+      name: device.name,
+      platform: device.platform ?? "Unknown platform",
+      lastSeen: formatRelativeTime(device.lastSeenAt),
+      status: deviceStatus(device)
+    }))
+  };
+}
+async function revokeKnownDevice(deviceId) {
+  const credentials = await authenticatedCredentials();
+  await revokeDevice(loadRelayEndpoints(), credentials, deviceId);
+}
+async function runWorkspace(path8, label) {
+  const root = await selectExposureRoot(path8);
+  const endpoints = loadRelayEndpoints();
+  let credentials = (await authenticatedSession()).credentials;
+  const statusService = new WorkspaceStatusService(credentials, endpoints);
+  let postExitNotice;
+  const exitAction = await runSessionHud({
     workspace: root,
     run: async (signal, onEvent) => {
-      await authenticatedCredentials(signal);
-      await runManagedSession(root, loadRelayEndpoints(), allowBroadRoot, {
+      await runManagedSession(root, endpoints, {
+        credentials,
+        ...label ? { workspaceLabel: label } : {},
         signal,
-        onEvent,
+        onEvent: (event) => {
+          postExitNotice = retainPostExitNotice(postExitNotice, event);
+          onEvent(event);
+        },
         quiet: true,
-        handleProcessSignals: false,
-        ...deviceName ? { deviceName } : {}
+        handleProcessSignals: false
       });
+    },
+    loadStatus: async (signal) => {
+      return hudStatus(await statusService.refresh(signal));
+    },
+    revokeDevice: async (deviceId, signal) => {
+      credentials = await validCredentials(credentials, { signal });
+      await revokeDevice(
+        endpoints,
+        credentials,
+        deviceId,
+        async (input, init) => await fetch(input, { ...init, signal })
+      );
     }
   });
+  if (postExitNotice) console.error(postExitNotice);
+  if (exitAction === "logout") await logoutFromGlossa();
 }
 async function main() {
   const invocation = parseInvocation(process.argv.slice(2));
   if (invocation.command === "help") {
-    console.log(helpText[invocation.topic ?? "main"]);
+    console.log(HELP);
   } else if (invocation.command === "version") {
     console.log(VERSION);
-  } else if (invocation.command === "ui") {
-    await runInteractive(invocation.path, invocation.allowBroadRoot, invocation.deviceName);
-  } else if (invocation.command === "start") {
-    await runExposure(invocation.path, invocation.allowBroadRoot, invocation.deviceName);
+  } else if (invocation.command === "workspace") {
+    await runWorkspace(invocation.path, invocation.label);
   } else if (invocation.command === "status") {
-    await showStatus(invocation.json);
-  } else if (invocation.command === "doctor") {
-    const ok = await runDoctor(invocation.json);
-    if (!ok) process.exitCode = 1;
-  } else if (invocation.command === "login") {
-    const { loginPerformed } = await authenticatedCredentials();
-    if (!loginPerformed) console.log("Signed in to Glossa.");
+    await showStatus();
   } else if (invocation.command === "logout") {
-    await logoutFromGlossa({ browser: invocation.browser });
-  } else if (invocation.command === "completions") {
-    console.log(completionScript(invocation.shell));
-  } else if (invocation.command === "update") {
-    await updateGlossa({ currentVersion: VERSION });
-  } else if (invocation.action === "list") {
-    await showDevices(invocation.json);
-  } else if (invocation.action === "rename") {
-    const { endpoints, credentials } = await deviceCredentials();
-    const device = await renameDevice(endpoints, credentials, invocation.deviceId, invocation.name);
-    console.log(`Renamed device ${device.id} to ${device.name}.`);
+    await logoutFromGlossa();
   } else {
-    const { endpoints, credentials } = await deviceCredentials();
-    await revokeDevice(endpoints, credentials, invocation.deviceId);
-    console.log(`Revoked device ${invocation.deviceId}. Running workers on it are disconnected.`);
+    await revokeKnownDevice(invocation.deviceId);
+    console.log(`Revoked device ${invocation.deviceId}. Running workspaces on it are disconnected.`);
   }
 }
 main().catch((error46) => {