@ariobarin/glossa 0.1.0-beta.3 → 0.1.0-beta.6

package/dist/main.js

@@ -6,88 +6,52 @@ var __export = (target, all) => {
 };
 
 // src/config-store.ts
+import path2 from "node:path";
+
+// src/secure-store.ts
 import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 var KEYRING_SERVICE = "Glossa";
-var KEYRING_ACCOUNT = "oauth";
-var FILE_CREDENTIAL_WARNING = "Warning: the operating-system credential store is unavailable. Glossa is using a mode-0600 credential file.";
 function configDirectory() {
   if (process.platform === "win32") {
     return path.join(process.env.APPDATA ?? os.homedir(), "Glossa");
   }
-  return path.join(process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"), "glossa");
-}
-function credentialsPath() {
-  return path.join(configDirectory(), "credentials.json");
-}
-async function defaultEntryProvider() {
-  try {
-    const { AsyncEntry } = await import("@napi-rs/keyring");
-    return new AsyncEntry(KEYRING_SERVICE, KEYRING_ACCOUNT);
-  } catch {
-    return null;
-  }
-}
-function parseCredentials(value) {
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    throw new Error("Stored Glossa credentials are invalid.");
-  }
-  if (typeof parsed.issuer !== "string" || typeof parsed.clientId !== "string" || typeof parsed.audience !== "string" || typeof parsed.accessToken !== "string" || typeof parsed.expiresAt !== "string" || !Number.isFinite(Date.parse(parsed.expiresAt)) || typeof parsed.tokenType !== "string" || parsed.refreshToken !== void 0 && typeof parsed.refreshToken !== "string" || parsed.scope !== void 0 && typeof parsed.scope !== "string") {
-    throw new Error("Stored Glossa credentials are invalid.");
-  }
-  return parsed;
-}
-async function readFileCredentials(target) {
-  try {
-    return parseCredentials(await readFile(target, "utf8"));
-  } catch (error46) {
-    const code = error46.code;
-    if (code === "ENOENT") return null;
-    throw error46;
-  }
-}
-async function writeFileCredentials(target, credentials) {
-  await mkdir(path.dirname(target), { recursive: true, mode: 448 });
-  await writeFile(target, `${JSON.stringify(credentials, null, 2)}
-`, {
-    encoding: "utf8",
-    mode: 384
-  });
-  if (process.platform !== "win32") await chmod(target, 384);
+  return path.join(
+    process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"),
+    "glossa"
+  );
 }
-var CredentialStore = class {
-  #credentialsFile;
-  #entryProvider;
-  #warn;
-  constructor(options = {}) {
-    this.#credentialsFile = options.credentialsFile ?? credentialsPath();
-    this.#entryProvider = options.entryProvider ?? defaultEntryProvider;
-    this.#warn = options.warn ?? console.warn;
-  }
-  async #entry() {
-    try {
-      return await this.#entryProvider();
-    } catch {
-      return null;
-    }
+var SecureStore = class {
+  #options;
+  constructor(options) {
+    this.#options = options;
   }
-  async save(credentials) {
-    const serialized = JSON.stringify(credentials);
+  async save(value) {
+    const serialized = JSON.stringify(value);
     const entry = await this.#entry();
     if (entry) {
       try {
         await entry.setPassword(serialized);
-        await rm(this.#credentialsFile, { force: true });
+        await rm(this.#options.file, { force: true });
         return "keyring";
       } catch {
       }
     }
-    this.#warn(FILE_CREDENTIAL_WARNING);
-    await writeFileCredentials(this.#credentialsFile, credentials);
+    this.#warn();
+    await mkdir(path.dirname(this.#options.file), {
+      recursive: true,
+      mode: 448
+    });
+    await writeFile(
+      this.#options.file,
+      `${JSON.stringify(value, null, 2)}
+`,
+      { encoding: "utf8", mode: 384 }
+    );
+    if (process.platform !== "win32") {
+      await chmod(this.#options.file, 384);
+    }
     return "file";
   }
   async load() {
@@ -98,22 +62,27 @@ var CredentialStore = class {
         serialized = await entry.getPassword();
       } catch {
       }
-      if (serialized) {
-        return { credentials: parseCredentials(serialized), backend: "keyring" };
+      if (serialized !== void 0) {
+        return { value: this.#options.parse(serialized), backend: "keyring" };
       }
     }
-    const credentials = await readFileCredentials(this.#credentialsFile);
-    if (!credentials) return null;
+    let value;
+    try {
+      value = this.#options.parse(await readFile(this.#options.file, "utf8"));
+    } catch (error46) {
+      if (error46.code === "ENOENT") return null;
+      throw error46;
+    }
     if (entry) {
       try {
-        await entry.setPassword(JSON.stringify(credentials));
-        await rm(this.#credentialsFile, { force: true });
-        return { credentials, backend: "keyring" };
+        await entry.setPassword(JSON.stringify(value));
+        await rm(this.#options.file, { force: true });
+        return { value, backend: "keyring" };
       } catch {
       }
     }
-    this.#warn(FILE_CREDENTIAL_WARNING);
-    return { credentials, backend: "file" };
+    this.#warn();
+    return { value, backend: "file" };
   }
   async delete() {
     const entry = await this.#entry();
@@ -123,18 +92,71 @@ var CredentialStore = class {
       } catch {
       }
     }
-    await rm(this.#credentialsFile, { force: true });
+    await rm(this.#options.file, { force: true });
+  }
+  async #entry() {
+    if (this.#options.entryProvider) {
+      try {
+        return await this.#options.entryProvider();
+      } catch {
+        return null;
+      }
+    }
+    try {
+      const { AsyncEntry } = await import("@napi-rs/keyring");
+      return new AsyncEntry(KEYRING_SERVICE, this.#options.account);
+    } catch {
+      return null;
+    }
+  }
+  #warn() {
+    (this.#options.warn ?? console.warn)(this.#options.warning);
   }
 };
-var defaultStore = new CredentialStore();
+
+// src/config-store.ts
+var FILE_CREDENTIAL_WARNING = "Warning: the operating-system credential store is unavailable. Glossa is using a mode-0600 credential file.";
+function parseCredentials(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("Stored Glossa credentials are invalid.");
+  }
+  if (typeof parsed.issuer !== "string" || typeof parsed.clientId !== "string" || typeof parsed.audience !== "string" || typeof parsed.accessToken !== "string" || typeof parsed.expiresAt !== "string" || !Number.isFinite(Date.parse(parsed.expiresAt)) || typeof parsed.tokenType !== "string" || parsed.refreshToken !== void 0 && typeof parsed.refreshToken !== "string" || parsed.scope !== void 0 && typeof parsed.scope !== "string" || parsed.requestedScope !== void 0 && typeof parsed.requestedScope !== "string") {
+    throw new Error("Stored Glossa credentials are invalid.");
+  }
+  return parsed;
+}
+var store = new SecureStore({
+  account: "oauth",
+  file: path2.join(configDirectory(), "credentials.json"),
+  warning: FILE_CREDENTIAL_WARNING,
+  parse: parseCredentials
+});
 async function saveCredentials(credentials) {
-  return await defaultStore.save(credentials);
+  return await store.save(credentials);
 }
 async function loadCredentials() {
-  return await defaultStore.load();
+  const loaded = await store.load();
+  return loaded ? { credentials: loaded.value, backend: loaded.backend } : null;
 }
 async function deleteCredentials() {
-  await defaultStore.delete();
+  await store.delete();
+}
+
+// src/auth-scopes.ts
+function normalizedScopes(value) {
+  return [...new Set(value?.trim().split(/\s+/).filter(Boolean) ?? [])].sort();
+}
+function scopesMatch(left, right) {
+  return JSON.stringify(normalizedScopes(left)) === JSON.stringify(normalizedScopes(right));
+}
+function grantedScopesSatisfyRequest(granted, requested, hasRefreshToken) {
+  const grantedSet = new Set(normalizedScopes(granted));
+  return normalizedScopes(requested).every(
+    (scope) => grantedSet.has(scope) || scope === "offline_access" && hasRefreshToken
+  );
 }
 
 // src/auth-session.ts
@@ -142,8 +164,14 @@ var EXPIRY_BUFFER_MS = 6e4;
 function endpoint(issuer, pathname) {
   return new URL(pathname, issuer.endsWith("/") ? issuer : `${issuer}/`).toString();
 }
+var SessionExpiredError = class extends Error {
+  constructor() {
+    super("Session expired. Run Glossa again to sign in.");
+    this.name = "SessionExpiredError";
+  }
+};
 function sessionExpiredError() {
-  return new Error("Session expired. Run: glossa login");
+  return new SessionExpiredError();
 }
 function oauthMessage(data, status) {
   return data.error_description ?? data.error ?? `HTTP ${status}`;
@@ -178,13 +206,22 @@ async function refreshCredentials(credentials, dependencies = {}) {
     }
     throw new Error(oauthMessage(oauth, response.status));
   }
+  const grantedScope = data.scope ?? credentials.scope;
+  if (credentials.requestedScope && !grantedScopesSatisfyRequest(
+    grantedScope,
+    credentials.requestedScope,
+    Boolean(data.refresh_token ?? credentials.refreshToken)
+  )) {
+    await remove();
+    throw sessionExpiredError();
+  }
   const refreshed = {
     ...credentials,
     accessToken: data.access_token,
     refreshToken: data.refresh_token ?? credentials.refreshToken,
     expiresAt: new Date(now() + data.expires_in * 1e3).toISOString(),
     tokenType: data.token_type,
-    ...data.scope ? { scope: data.scope } : {}
+    ...grantedScope ? { scope: grantedScope } : {}
   };
   await save(refreshed);
   return refreshed;
@@ -344,6 +381,10 @@ async function loginWithDeviceFlow(options, dependencies = {}) {
         if (!data.refresh_token) {
           throw new Error("Auth0 did not issue a refresh token.");
         }
+        const grantedScope = data.scope ?? options.scope;
+        if (!grantedScopesSatisfyRequest(grantedScope, options.scope, true)) {
+          throw new Error("Auth0 did not grant the permissions Glossa requires.");
+        }
         await save({
           issuer: options.issuer,
           clientId: options.clientId,
@@ -352,7 +393,8 @@ async function loginWithDeviceFlow(options, dependencies = {}) {
           refreshToken: data.refresh_token,
           expiresAt: new Date(now() + data.expires_in * 1e3).toISOString(),
           tokenType: data.token_type,
-          ...data.scope ? { scope: data.scope } : {}
+          scope: grantedScope,
+          requestedScope: options.scope
         });
         log("Signed in to Glossa.");
         return;
@@ -376,6 +418,141 @@ async function loginWithDeviceFlow(options, dependencies = {}) {
   }
 }
 
+// src/auth-login.ts
+function normalizedIssuer(value) {
+  return value.replace(/\/+$/, "");
+}
+function credentialsMatchLoginOptions(credentials, options) {
+  return normalizedIssuer(credentials.issuer) === normalizedIssuer(options.issuer) && credentials.clientId === options.clientId && credentials.audience === options.audience && scopesMatch(credentials.requestedScope, options.scope) && grantedScopesSatisfyRequest(
+    credentials.scope,
+    options.scope,
+    Boolean(credentials.refreshToken)
+  );
+}
+async function ensureSignedIn(options, dependencies = {}) {
+  const load = dependencies.loadCredentials ?? loadCredentials;
+  const validate = dependencies.validCredentials ?? validCredentials;
+  const login = dependencies.loginWithDeviceFlow ?? loginWithDeviceFlow;
+  const loaded = await load();
+  if (loaded && credentialsMatchLoginOptions(loaded.credentials, options)) {
+    try {
+      await validate(loaded.credentials);
+      return false;
+    } catch (error46) {
+      if (!(error46 instanceof SessionExpiredError)) throw error46;
+    }
+  }
+  await login(options);
+  return true;
+}
+
+// src/cli-options.ts
+import { existsSync } from "node:fs";
+import path3 from "node:path";
+var UsageError = class extends Error {
+};
+var helpTopics = /* @__PURE__ */ new Set(["start", "status", "devices", "login", "logout"]);
+function parseStart(args) {
+  if (args.includes("--help") || args.includes("-h")) {
+    return { command: "help", topic: "start" };
+  }
+  let selectedPath;
+  let allowBroadRoot = false;
+  let optionsEnded = false;
+  for (const argument of args) {
+    if (!optionsEnded && argument === "--") {
+      optionsEnded = true;
+    } else if (!optionsEnded && argument === "--allow-broad-root") {
+      allowBroadRoot = true;
+    } else if (!optionsEnded && argument.startsWith("-")) {
+      throw new UsageError(`Unknown start option: ${argument}`);
+    } else if (selectedPath) {
+      throw new UsageError("Start accepts at most one directory.");
+    } else {
+      selectedPath = argument;
+    }
+  }
+  return {
+    command: "start",
+    ...selectedPath ? { path: selectedPath } : {},
+    allowBroadRoot
+  };
+}
+function singleJsonOption(command, args) {
+  if (args.length === 0) return false;
+  if (args.length === 1 && args[0] === "--json") return true;
+  throw new UsageError(`${command} accepts only --json.`);
+}
+function parseDevices(args) {
+  const [action, ...options] = args;
+  if (!action || action === "--help" || action === "-h") {
+    return { command: "help", topic: "devices" };
+  }
+  if (action === "list") {
+    return { command: "devices", action, json: singleJsonOption("Devices list", options) };
+  }
+  if (action === "rename" && options.length === 2) {
+    return { command: "devices", action, deviceId: options[0], name: options[1] };
+  }
+  if (action === "revoke" && options.length === 1) {
+    return { command: "devices", action, deviceId: options[0] };
+  }
+  throw new UsageError("Use: glossa devices list, rename <id> <name>, or revoke <id>.");
+}
+function likelyDirectory(value) {
+  return value === "." || value === ".." || path3.isAbsolute(value) || value.includes("/") || value.includes("\\") || existsSync(value);
+}
+function parseInvocation(args) {
+  const [command, ...options] = args;
+  if (!command) return parseStart([]);
+  if (command === "--help" || command === "-h") {
+    if (options.length > 0) throw new UsageError("Help accepts one command name.");
+    return { command: "help" };
+  }
+  if (command === "help") {
+    if (options.length > 1) throw new UsageError("Help accepts one command name.");
+    const topic = options[0];
+    if (!topic) return { command: "help" };
+    if (!helpTopics.has(topic)) {
+      throw new UsageError(`Unknown help topic: ${topic}`);
+    }
+    return { command: "help", topic };
+  }
+  if (command === "--version" || command === "-v") {
+    if (options.length > 0) throw new UsageError("Version accepts no arguments.");
+    return { command: "version" };
+  }
+  if (command === "start") return parseStart(options);
+  if (command === "status") {
+    if (options.includes("--help") || options.includes("-h")) {
+      return { command: "help", topic: "status" };
+    }
+    return { command: "status", json: singleJsonOption("Status", options) };
+  }
+  if (command === "devices") return parseDevices(options);
+  if (command === "login") {
+    if (options.includes("--help") || options.includes("-h")) {
+      return { command: "help", topic: "login" };
+    }
+    if (options.length > 0) throw new UsageError("Login accepts no arguments.");
+    return { command: "login" };
+  }
+  if (command === "logout") {
+    if (options.includes("--help") || options.includes("-h")) {
+      return { command: "help", topic: "logout" };
+    }
+    if (options.length === 0) return { command: "logout", browser: false };
+    if (options.length === 1 && options[0] === "--browser") {
+      return { command: "logout", browser: true };
+    }
+    throw new UsageError("Logout accepts only --browser.");
+  }
+  if (command === "--") return parseStart(options);
+  if (command.startsWith("-")) return parseStart(args);
+  if (likelyDirectory(command)) return parseStart(args);
+  throw new UsageError(`Unknown command: ${command}`);
+}
+
 // src/relay-client.ts
 import os2 from "node:os";
 
@@ -1110,10 +1287,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path6) {
-  if (!path6)
+function getElementAtPath(obj, path7) {
+  if (!path7)
     return obj;
-  return path6.reduce((acc, key) => acc?.[key], obj);
+  return path7.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1474,11 +1651,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path6, issues) {
+function prefixIssues(path7, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path6);
+    iss.path.unshift(path7);
     return iss;
   });
 }
@@ -1640,7 +1817,7 @@ function formatError(error46, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error46, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error47, path6 = []) => {
+  const processError = (error47, path7 = []) => {
     var _a, _b;
     for (const issue2 of error47.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -1650,7 +1827,7 @@ function treeifyError(error46, mapper = (issue2) => issue2.message) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path6, ...issue2.path];
+        const fullpath = [...path7, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1682,8 +1859,8 @@ function treeifyError(error46, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path6 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path6) {
+  const path7 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path7) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -12927,65 +13104,64 @@ var DEFAULT_COMMAND_TIMEOUT_MS = 15 * 60 * 1e3;
 var MAX_COMMAND_TIMEOUT_MS = 60 * 60 * 1e3;
 var MAX_COMMAND_STATUS_WAIT_MS = 15e3;
 var deviceNameSchema = external_exports.string().trim().min(1).max(80).regex(/^[^\u0000-\u001f\u007f]+$/, "Device name contains control characters");
-var openWorkspaceJobSchema = external_exports.object({
-  type: external_exports.literal("open_workspace"),
-  requestId: external_exports.string().uuid(),
-  path: external_exports.string().max(4096)
-});
-var readFileJobSchema = external_exports.object({
+var relativePathSchema = external_exports.string().max(4096).describe("Path relative to the exposed workspace root. Absolute paths and parent traversal are rejected.");
+var boundedTextSchema = external_exports.string().refine((value) => Buffer.byteLength(value, "utf8") <= MAX_TEXT_BYTES);
+var readFileRequestSchema = external_exports.object({
+  path: relativePathSchema
+}).strict();
+var readFileJobSchema = readFileRequestSchema.extend({
   type: external_exports.literal("read_file"),
-  requestId: external_exports.string().uuid(),
-  workspaceId: external_exports.string().uuid(),
-  path: external_exports.string().max(4096)
-});
-var writeFileJobSchema = external_exports.object({
+  requestId: external_exports.string().uuid()
+});
+var writeFileRequestSchema = external_exports.object({
+  path: relativePathSchema,
+  content: boundedTextSchema.describe("Complete UTF-8 text content that will replace the file."),
+  expectedSha256: external_exports.string().regex(/^[a-f0-9]{64}$/).optional().describe("SHA-256 returned by read_file. When provided, the write fails if the file changed.")
+}).strict();
+var writeFileJobSchema = writeFileRequestSchema.extend({
   type: external_exports.literal("write_file"),
-  requestId: external_exports.string().uuid(),
-  workspaceId: external_exports.string().uuid(),
-  path: external_exports.string().max(4096),
-  content: external_exports.string(),
-  expectedSha256: external_exports.string().regex(/^[a-f0-9]{64}$/).optional()
+  requestId: external_exports.string().uuid()
 });
-var runCommandJobSchema = external_exports.object({
-  type: external_exports.literal("run_command"),
-  requestId: external_exports.string().uuid(),
-  workspaceId: external_exports.string().uuid(),
-  argv: external_exports.array(external_exports.string()).min(1).max(256).optional(),
-  shellCommand: external_exports.string().max(64 * 1024).optional(),
-  stdin: external_exports.string().max(MAX_TEXT_BYTES).optional(),
-  timeoutMs: external_exports.number().int().min(1).max(MAX_COMMAND_TIMEOUT_MS).default(DEFAULT_COMMAND_TIMEOUT_MS)
-}).superRefine((value, context) => {
+function requireOneCommand(value, context) {
   if ((value.argv ? 1 : 0) + (value.shellCommand ? 1 : 0) !== 1) {
     context.addIssue({
       code: "custom",
-      message: "Exactly one of argv or shellCommand is required."
+      message: "Exactly one of argv or shellCommand is required.",
+      input: value
     });
   }
+}
+var runCommandRequestSchema = external_exports.object({
+  argv: external_exports.array(external_exports.string()).min(1).max(256).optional().describe("Executable and arguments passed without shell parsing. Provide this or shellCommand, not both."),
+  shellCommand: external_exports.string().max(64 * 1024).optional().describe("PowerShell command text. Provide this or argv, not both."),
+  stdin: boundedTextSchema.optional().describe("Optional UTF-8 text sent to the command standard input."),
+  timeoutMs: external_exports.number().int().min(1).max(MAX_COMMAND_TIMEOUT_MS).default(DEFAULT_COMMAND_TIMEOUT_MS).describe("Maximum command runtime in milliseconds. Defaults to 900000 and cannot exceed 3600000.")
+}).strict().superRefine(requireOneCommand);
+var runCommandJobSchema = runCommandRequestSchema.safeExtend({
+  type: external_exports.literal("run_command"),
+  requestId: external_exports.string().uuid()
 });
-var getCommandJobSchema = external_exports.object({
+var getCommandRequestSchema = external_exports.object({
+  commandId: external_exports.string().uuid().describe("Command identifier returned by run_command."),
+  waitMs: external_exports.number().int().min(0).max(MAX_COMMAND_STATUS_WAIT_MS).optional().describe("Optional long-poll duration in milliseconds, from 0 through 15000.")
+}).strict();
+var getCommandJobSchema = getCommandRequestSchema.extend({
   type: external_exports.literal("get_command"),
-  requestId: external_exports.string().uuid(),
-  commandId: external_exports.string().uuid(),
-  waitMs: external_exports.number().int().min(0).max(MAX_COMMAND_STATUS_WAIT_MS).optional()
+  requestId: external_exports.string().uuid()
 });
-var cancelCommandJobSchema = external_exports.object({
+var cancelCommandRequestSchema = external_exports.object({
+  commandId: external_exports.string().uuid().describe("Command identifier returned by run_command.")
+}).strict();
+var cancelCommandJobSchema = cancelCommandRequestSchema.extend({
   type: external_exports.literal("cancel_command"),
-  requestId: external_exports.string().uuid(),
-  commandId: external_exports.string().uuid()
-});
-var closeWorkspaceJobSchema = external_exports.object({
-  type: external_exports.literal("close_workspace"),
-  requestId: external_exports.string().uuid(),
-  workspaceId: external_exports.string().uuid()
+  requestId: external_exports.string().uuid()
 });
 var workerJobSchema = external_exports.discriminatedUnion("type", [
-  openWorkspaceJobSchema,
   readFileJobSchema,
   writeFileJobSchema,
   runCommandJobSchema,
   getCommandJobSchema,
-  cancelCommandJobSchema,
-  closeWorkspaceJobSchema
+  cancelCommandJobSchema
 ]);
 var workerResultSchema = external_exports.object({
   requestId: external_exports.string().uuid(),
@@ -13038,16 +13214,62 @@ function loadRelayEndpoints(environment = process.env) {
 function defaultDeviceName() {
   return deviceNameSchema.parse(os2.hostname());
 }
-function enrollmentError(status, data) {
-  if (status === 401) return new Error("Glossa login was rejected. Run: glossa login");
+function relayError(status, data) {
+  if (status === 401) return new Error("Glossa login was rejected. Sign in again when prompted.");
   if (status === 403 && data.error === "account_disabled") {
     return new Error("This Glossa account is disabled.");
   }
+  if (status === 403 && data.error === "identity_provider_not_allowed") {
+    return new Error(
+      "This Glossa identity provider is not allowed. Sign in with Google."
+    );
+  }
   if (status === 409 && data.error === "device_name_conflict") {
-    return new Error("A Glossa device with this computer name already exists and must be revoked before reenrollment.");
+    return new Error("A Glossa device already uses this name. Run glossa devices list, then rename or revoke the old device.");
+  }
+  if (status === 404 && data.error === "device_not_found") {
+    return new Error("The Glossa device was not found.");
   }
   if (status === 429) return new Error("Glossa device enrollment is rate limited. Try again later.");
-  return new Error(`Glossa device enrollment failed with HTTP ${status}.`);
+  return new Error(`The Glossa relay returned HTTP ${status}.`);
+}
+function validNullableString(value) {
+  return value === null || typeof value === "string";
+}
+function parseDevices2(value) {
+  if (!Array.isArray(value)) {
+    throw new Error("The Glossa relay returned an invalid device list response.");
+  }
+  const devices = value;
+  if (devices.some(
+    (device) => typeof device.id !== "string" || typeof device.name !== "string" || !validNullableString(device.platform) || !validNullableString(device.lastSeenAt) || !validNullableString(device.revokedAt) || device.activeWorkers !== void 0 && (!Number.isInteger(device.activeWorkers) || device.activeWorkers < 0)
+  )) {
+    throw new Error("The Glossa relay returned an invalid device list response.");
+  }
+  return devices.map((device) => ({
+    ...device,
+    activeWorkers: device.activeWorkers ?? null
+  }));
+}
+async function listDevices(endpoints, credentials, fetchRequest = fetch) {
+  const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices`, {
+    headers: {
+      authorization: `${credentials.tokenType} ${credentials.accessToken}`
+    }
+  });
+  let data = {};
+  try {
+    data = await response.json();
+  } catch {
+  }
+  if (!response.ok) throw relayError(response.status, data);
+  return parseDevices2(data.devices);
+}
+async function accountOwnsDevice(endpoints, credentials, deviceId, fetchRequest = fetch) {
+  const devices = await listDevices(endpoints, credentials, fetchRequest);
+  return devices.some(
+    (device) => device.id === deviceId && device.revokedAt === null
+  );
 }
 async function enrollDevice(endpoints, credentials, deviceName, fetchRequest = fetch) {
   const name = deviceNameSchema.parse(deviceName);
@@ -13064,7 +13286,7 @@ async function enrollDevice(endpoints, credentials, deviceName, fetchRequest = f
     data = await response.json();
   } catch {
   }
-  if (!response.ok) throw enrollmentError(response.status, data);
+  if (!response.ok) throw relayError(response.status, data);
   if (typeof data.device?.id !== "string" || typeof data.device.name !== "string" || typeof data.device_token !== "string") {
     throw new Error("The Glossa relay returned an invalid device enrollment response.");
   }
@@ -13075,9 +13297,108 @@ async function enrollDevice(endpoints, credentials, deviceName, fetchRequest = f
     token: data.device_token
   };
 }
+async function renameDevice(endpoints, credentials, deviceId, name, fetchRequest = fetch) {
+  const validName = deviceNameSchema.parse(name);
+  const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/${encodeURIComponent(deviceId)}`, {
+    method: "PATCH",
+    headers: {
+      authorization: `${credentials.tokenType} ${credentials.accessToken}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({ name: validName })
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok) throw relayError(response.status, data);
+  return parseDevices2([data.device])[0];
+}
+async function revokeDevice(endpoints, credentials, deviceId, fetchRequest = fetch) {
+  const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/${encodeURIComponent(deviceId)}`, {
+    method: "DELETE",
+    headers: {
+      authorization: `${credentials.tokenType} ${credentials.accessToken}`
+    }
+  });
+  if (!response.ok) {
+    const data = await response.json().catch(() => ({}));
+    throw relayError(response.status, data);
+  }
+}
 
-// src/worker/local-session.ts
-import readline from "node:readline";
+// src/logout.ts
+function browserLogoutUrl(issuer) {
+  return new URL(
+    "v2/logout",
+    issuer.endsWith("/") ? issuer : `${issuer}/`
+  ).toString();
+}
+async function logoutFromGlossa(options, dependencies = {}) {
+  const remove = dependencies.deleteCredentials ?? deleteCredentials;
+  const browse = dependencies.openBrowser ?? openBrowser;
+  const log = dependencies.log ?? console.log;
+  let issuer = dependencies.issuer;
+  if (options.browser && issuer === void 0) {
+    const loadStoredIssuer = dependencies.loadStoredIssuer ?? (async () => (await loadCredentials())?.credentials.issuer);
+    try {
+      issuer = await loadStoredIssuer();
+    } catch {
+    }
+  }
+  await remove();
+  log("Signed out of Glossa locally.");
+  if (!options.browser) return;
+  const url2 = browserLogoutUrl(issuer ?? loadAuthConfig().issuer);
+  const opened = await browse(url2);
+  if (opened) {
+    log("Opened Glossa browser sign-out.");
+  } else {
+    log("Open this URL to finish signing out in your browser:");
+    log(url2);
+  }
+  log(
+    "Reconnect Glossa in ChatGPT, then choose the same Google account when the CLI signs in."
+  );
+}
+
+// src/device-store.ts
+import path4 from "node:path";
+var FILE_DEVICE_WARNING = "Warning: the operating-system credential store is unavailable. Glossa is using a mode-0600 device credential file.";
+function parseDeviceCredential(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("Stored Glossa device credentials are invalid.");
+  }
+  let relayOriginValid = false;
+  if (typeof parsed.relayOrigin === "string") {
+    try {
+      relayOriginValid = new URL(parsed.relayOrigin).origin === parsed.relayOrigin;
+    } catch {
+      relayOriginValid = false;
+    }
+  }
+  if (!relayOriginValid || typeof parsed.deviceId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
+    parsed.deviceId
+  ) || typeof parsed.deviceName !== "string" || parsed.deviceName.length === 0 || typeof parsed.token !== "string" || !parsed.token.startsWith(`gld_${parsed.deviceId}_`)) {
+    throw new Error("Stored Glossa device credentials are invalid.");
+  }
+  return parsed;
+}
+var store2 = new SecureStore({
+  account: "device",
+  file: path4.join(configDirectory(), "device.json"),
+  warning: FILE_DEVICE_WARNING,
+  parse: parseDeviceCredential
+});
+async function loadDeviceCredential() {
+  return (await store2.load())?.value ?? null;
+}
+async function saveDeviceCredential(credential) {
+  await store2.save(credential);
+}
+async function deleteDeviceCredential() {
+  await store2.delete();
+}
 
 // src/worker/command-service.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -13147,10 +13468,10 @@ async function terminateProcessTree(child) {
   }
 }
 var CommandService = class {
-  constructor(workspaces) {
-    this.workspaces = workspaces;
+  constructor(policy) {
+    this.policy = policy;
   }
-  workspaces;
+  policy;
   #commands = /* @__PURE__ */ new Map();
   #activeCommandId = null;
   async start(options) {
@@ -13174,12 +13495,12 @@ var CommandService = class {
         "Command timeout must be between 1 millisecond and 60 minutes."
       );
     }
-    const cwd = await this.workspaces.resolve(options.workspaceId, ".");
+    const cwd = this.policy.root;
     const invocation = options.argv ? { file: options.argv[0], args: options.argv.slice(1) } : shellInvocation(options.shellCommand);
     const child = spawn2(invocation.file, invocation.args, {
       cwd,
       env: process.env,
-      detached: true,
+      detached: process.platform !== "win32",
       stdio: "pipe",
       windowsHide: true
     });
@@ -13249,7 +13570,15 @@ var CommandService = class {
       throw new WorkerError("invalid_wait", "Status wait must be between 0 and 15 seconds.");
     }
     if (record2.status === "running" && waitMs > 0) {
-      await Promise.race([record2.completion, delay2(waitMs)]);
+      const waitController = new AbortController();
+      try {
+        await Promise.race([
+          record2.completion,
+          delay2(waitMs, void 0, { signal: waitController.signal })
+        ]);
+      } finally {
+        waitController.abort();
+      }
     }
     return this.snapshot(record2);
   }
@@ -13292,19 +13621,17 @@ var CommandService = class {
 // src/worker/file-service.ts
 import { createHash, randomUUID as randomUUID2 } from "node:crypto";
 import { lstat, readFile as readFile2, rename, rm as rm2, stat, writeFile as writeFile2 } from "node:fs/promises";
-import path2 from "node:path";
+import path5 from "node:path";
 function sha256(content) {
   return createHash("sha256").update(content).digest("hex");
 }
 var FileService = class {
-  constructor(policy, workspaces) {
+  constructor(policy) {
     this.policy = policy;
-    this.workspaces = workspaces;
   }
   policy;
-  workspaces;
-  async readText(workspaceId, relativePath) {
-    const target = await this.workspaces.resolve(workspaceId, relativePath);
+  async readText(relativePath) {
+    const target = await this.policy.resolveExisting(relativePath);
     const targetStat = await stat(target);
     if (!targetStat.isFile()) {
       throw new WorkerError("not_file", "The requested path is not a file.");
@@ -13321,13 +13648,12 @@ var FileService = class {
     }
     return { content: text, sha256: sha256(content), bytes: content.byteLength };
   }
-  async writeText(workspaceId, relativePath, content, expectedSha256) {
+  async writeText(relativePath, content, expectedSha256) {
     const bytes = Buffer.from(content, "utf8");
     if (bytes.byteLength > MAX_TEXT_BYTES) {
       throw new WorkerError("file_too_large", "The content exceeds the 1 MiB text limit.");
     }
-    const workspaceRelative = this.workspaces.relativePath(workspaceId, relativePath);
-    let target = await this.policy.resolveWritableFile(workspaceRelative);
+    let target = await this.policy.resolveWritableFile(relativePath);
     if (expectedSha256) {
       let actual = null;
       try {
@@ -13340,10 +13666,10 @@ var FileService = class {
         throw new WorkerError("stale_revision", "The file revision has changed.");
       }
     }
-    const temporary = path2.join(path2.dirname(target), `.glossa-${randomUUID2()}.tmp`);
+    const temporary = path5.join(path5.dirname(target), `.glossa-${randomUUID2()}.tmp`);
     try {
       await writeFile2(temporary, bytes, { flag: "wx", mode: 384 });
-      target = await this.policy.resolveWritableFile(workspaceRelative);
+      target = await this.policy.resolveWritableFile(relativePath);
       const tempStat = await lstat(temporary);
       if (!tempStat.isFile() || tempStat.isSymbolicLink()) {
         throw new WorkerError("unsafe_temporary_file", "The atomic write temporary file changed.");
@@ -13359,19 +13685,19 @@ var FileService = class {
 // src/worker/path-policy.ts
 import { lstat as lstat2, realpath, stat as stat2 } from "node:fs/promises";
 import os3 from "node:os";
-import path3 from "node:path";
+import path6 from "node:path";
 function samePath(left, right) {
   return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
 function isWithin(root, candidate) {
-  const relative = path3.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path3.sep}`) && relative !== ".." && !path3.isAbsolute(relative);
+  const relative = path6.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path6.sep}`) && relative !== ".." && !path6.isAbsolute(relative);
 }
 function validateRelativePath(value) {
   if (value.includes("\0")) {
     throw new WorkerError("invalid_path", "Paths cannot contain null bytes.");
   }
-  if (path3.isAbsolute(value) || path3.win32.isAbsolute(value) || path3.posix.isAbsolute(value)) {
+  if (path6.isAbsolute(value) || path6.win32.isAbsolute(value) || path6.posix.isAbsolute(value)) {
     throw new WorkerError("absolute_path", "Absolute paths are not allowed.");
   }
   const segments = value.split(/[\\/]+/);
@@ -13381,14 +13707,19 @@ function validateRelativePath(value) {
   return value === "" ? "." : value;
 }
 async function canonicalizeRoot(candidate, allowBroadRoot = false) {
-  const root = await realpath(path3.resolve(candidate));
+  const root = await realpath(path6.resolve(candidate)).catch((error46) => {
+    if (error46.code === "ENOENT") {
+      throw new WorkerError("root_not_found", "The workspace directory does not exist.");
+    }
+    throw error46;
+  });
   const rootStat = await stat2(root);
   if (!rootStat.isDirectory()) {
     throw new WorkerError("root_not_directory", "The exposed root must be a directory.");
   }
   if (!allowBroadRoot) {
-    const filesystemRoot = path3.parse(root).root;
-    const home = await realpath(os3.homedir()).catch(() => path3.resolve(os3.homedir()));
+    const filesystemRoot = path6.parse(root).root;
+    const home = await realpath(os3.homedir()).catch(() => path6.resolve(os3.homedir()));
     if (samePath(root, filesystemRoot) || samePath(root, home)) {
       throw new WorkerError(
         "broad_root_refused",
@@ -13420,16 +13751,9 @@ var PathPolicy = class _PathPolicy {
     }
     return canonical;
   }
-  async resolveDirectory(relativePath) {
-    const resolved = await this.resolveExisting(relativePath);
-    if (!(await stat2(resolved)).isDirectory()) {
-      throw new WorkerError("not_directory", "The requested workspace is not a directory.");
-    }
-    return resolved;
-  }
   async resolveWritableFile(relativePath) {
     const lexical = this.resolveLexical(relativePath);
-    const parent = path3.dirname(lexical);
+    const parent = path6.dirname(lexical);
     await this.rejectLinkedComponents(parent);
     const canonicalParent = await realpath(parent).catch((error46) => {
       if (error46.code === "ENOENT") {
@@ -13455,11 +13779,11 @@ var PathPolicy = class _PathPolicy {
       if (error46 instanceof WorkerError) throw error46;
       if (error46.code !== "ENOENT") throw error46;
     }
-    return path3.join(canonicalParent, path3.basename(lexical));
+    return path6.join(canonicalParent, path6.basename(lexical));
   }
   resolveLexical(relativePath) {
     const validated = validateRelativePath(relativePath);
-    const candidate = path3.resolve(this.root, validated);
+    const candidate = path6.resolve(this.root, validated);
     if (!isWithin(this.root, candidate)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
@@ -13469,11 +13793,11 @@ var PathPolicy = class _PathPolicy {
     if (!isWithin(this.root, candidate)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
-    const relative = path3.relative(this.root, candidate);
+    const relative = path6.relative(this.root, candidate);
     if (!relative) return;
     let current = this.root;
-    for (const segment of relative.split(path3.sep)) {
-      current = path3.join(current, segment);
+    for (const segment of relative.split(path6.sep)) {
+      current = path6.join(current, segment);
       try {
         const currentStat = await lstat2(current);
         if (currentStat.isSymbolicLink()) {
@@ -13491,93 +13815,33 @@ var PathPolicy = class _PathPolicy {
   }
 };
 
-// src/worker/workspace-manager.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import path4 from "node:path";
-var DEFAULT_LEASE_MS = 5 * 60 * 1e3;
-var WorkspaceManager = class {
-  constructor(policy, leaseMs = DEFAULT_LEASE_MS) {
-    this.policy = policy;
-    this.leaseMs = leaseMs;
-  }
-  policy;
-  leaseMs;
-  #leases = /* @__PURE__ */ new Map();
-  async open(relativePath = ".") {
-    const resolved = await this.policy.resolveDirectory(relativePath);
-    const normalized = path4.relative(this.policy.root, resolved) || ".";
-    const lease = {
-      id: randomUUID3(),
-      relativePath: normalized,
-      expiresAt: Date.now() + this.leaseMs
-    };
-    this.#leases.set(lease.id, lease);
-    return {
-      workspaceId: lease.id,
-      path: normalized,
-      expiresAt: new Date(lease.expiresAt).toISOString()
-    };
-  }
-  async resolve(workspaceId, relativePath = ".") {
-    const lease = this.#leases.get(workspaceId);
-    if (!lease || lease.expiresAt <= Date.now()) {
-      this.#leases.delete(workspaceId);
-      throw new WorkerError("workspace_expired", "The workspace lease has expired.");
-    }
-    lease.expiresAt = Date.now() + this.leaseMs;
-    return await this.policy.resolveExisting(
-      path4.join(lease.relativePath, validateRelativePath(relativePath))
-    );
-  }
-  relativePath(workspaceId, relativePath) {
-    const lease = this.#leases.get(workspaceId);
-    if (!lease || lease.expiresAt <= Date.now()) {
-      this.#leases.delete(workspaceId);
-      throw new WorkerError("workspace_expired", "The workspace lease has expired.");
-    }
-    lease.expiresAt = Date.now() + this.leaseMs;
-    return path4.join(lease.relativePath, validateRelativePath(relativePath));
-  }
-  close(workspaceId) {
-    return this.#leases.delete(workspaceId);
-  }
-};
-
 // src/worker/local-worker.ts
 var LocalWorker = class _LocalWorker {
-  constructor(policy, workspaces, files, commands) {
+  constructor(policy, files, commands) {
     this.policy = policy;
-    this.workspaces = workspaces;
     this.files = files;
     this.commands = commands;
   }
   policy;
-  workspaces;
   files;
   commands;
   static async create(root, allowBroadRoot = false) {
     const policy = await PathPolicy.create(root, allowBroadRoot);
-    const workspaces = new WorkspaceManager(policy);
     return new _LocalWorker(
       policy,
-      workspaces,
-      new FileService(policy, workspaces),
-      new CommandService(workspaces)
+      new FileService(policy),
+      new CommandService(policy)
     );
   }
   async handle(job) {
     try {
       let value;
       switch (job.type) {
-        case "open_workspace":
-          value = await this.workspaces.open(job.path);
-          break;
         case "read_file":
-          value = await this.files.readText(job.workspaceId, job.path);
+          value = await this.files.readText(job.path);
           break;
         case "write_file":
           value = await this.files.writeText(
-            job.workspaceId,
             job.path,
             job.content,
             job.expectedSha256
@@ -13585,7 +13849,6 @@ var LocalWorker = class _LocalWorker {
           break;
         case "run_command":
           value = await this.commands.start({
-            workspaceId: job.workspaceId,
             ...job.argv ? { argv: job.argv } : {},
             ...job.shellCommand ? { shellCommand: job.shellCommand } : {},
             ...job.stdin !== void 0 ? { stdin: job.stdin } : {},
@@ -13598,9 +13861,6 @@ var LocalWorker = class _LocalWorker {
         case "cancel_command":
           value = await this.commands.cancel(job.commandId);
           break;
-        case "close_workspace":
-          value = { closed: this.workspaces.close(job.workspaceId) };
-          break;
       }
       return { requestId: job.requestId, ok: true, value };
     } catch (error46) {
@@ -13617,181 +13877,12 @@ var LocalWorker = class _LocalWorker {
   }
 };
 
-// src/worker/local-session.ts
-var visibleActivity = /* @__PURE__ */ new Set(["write_file", "run_command", "cancel_command"]);
-async function runLocalSession(root, allowBroadRoot = false) {
-  const worker = await LocalWorker.create(root, allowBroadRoot);
-  console.error(`Glossa local worker root: ${worker.policy.root}`);
-  console.error(
-    "Commands have the full environment and permissions of this account. Press Ctrl+C to disconnect."
-  );
-  const lines = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
-  const stop = () => lines.close();
-  process.once("SIGINT", stop);
-  process.once("SIGTERM", stop);
-  try {
-    for await (const line of lines) {
-      if (!line.trim()) continue;
-      try {
-        const job = workerJobSchema.parse(JSON.parse(line));
-        if (visibleActivity.has(job.type)) {
-          console.error(`Activity started: ${job.type} (${job.requestId})`);
-        }
-        const result = await worker.handle(job);
-        process.stdout.write(`${JSON.stringify(result)}
-`);
-        if (visibleActivity.has(job.type)) {
-          console.error(
-            `Activity finished: ${job.type} (${job.requestId}), ${result.ok ? "accepted" : "rejected"}`
-          );
-        }
-      } catch {
-        process.stdout.write(
-          `${JSON.stringify({ ok: false, error: { code: "invalid_job", message: "Invalid worker job." } })}
-`
-        );
-      }
-    }
-  } finally {
-    process.removeListener("SIGINT", stop);
-    process.removeListener("SIGTERM", stop);
-    await worker.shutdown();
-  }
-}
-
-// src/device-store.ts
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile3, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
-import path5 from "node:path";
-var KEYRING_SERVICE2 = "Glossa";
-var KEYRING_ACCOUNT2 = "device";
-var FILE_DEVICE_WARNING = "Warning: the operating-system credential store is unavailable. Glossa is using a mode-0600 device credential file.";
-function deviceCredentialPath() {
-  return path5.join(configDirectory(), "device.json");
-}
-async function defaultEntryProvider2() {
-  try {
-    const { AsyncEntry } = await import("@napi-rs/keyring");
-    return new AsyncEntry(KEYRING_SERVICE2, KEYRING_ACCOUNT2);
-  } catch {
-    return null;
-  }
-}
-function parseDeviceCredential(value) {
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    throw new Error("Stored Glossa device credentials are invalid.");
-  }
-  let relayOriginValid = false;
-  if (typeof parsed.relayOrigin === "string") {
-    try {
-      relayOriginValid = new URL(parsed.relayOrigin).origin === parsed.relayOrigin;
-    } catch {
-      relayOriginValid = false;
-    }
-  }
-  if (!relayOriginValid || typeof parsed.deviceId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(
-    parsed.deviceId
-  ) || typeof parsed.deviceName !== "string" || parsed.deviceName.length === 0 || typeof parsed.token !== "string" || !parsed.token.startsWith(`gld_${parsed.deviceId}_`)) {
-    throw new Error("Stored Glossa device credentials are invalid.");
-  }
-  return parsed;
-}
-async function readFileCredential(target) {
-  try {
-    return parseDeviceCredential(await readFile3(target, "utf8"));
-  } catch (error46) {
-    if (error46.code === "ENOENT") return null;
-    throw error46;
-  }
-}
-async function writeFileCredential(target, credential) {
-  await mkdir2(path5.dirname(target), { recursive: true, mode: 448 });
-  await writeFile3(target, `${JSON.stringify(credential, null, 2)}
-`, {
-    encoding: "utf8",
-    mode: 384
-  });
-  if (process.platform !== "win32") await chmod2(target, 384);
-}
-var DeviceStore = class {
-  #credentialFile;
-  #entryProvider;
-  #warn;
-  constructor(options = {}) {
-    this.#credentialFile = options.credentialFile ?? deviceCredentialPath();
-    this.#entryProvider = options.entryProvider ?? defaultEntryProvider2;
-    this.#warn = options.warn ?? console.warn;
-  }
-  async #entry() {
-    try {
-      return await this.#entryProvider();
-    } catch {
-      return null;
-    }
-  }
-  async save(credential) {
-    const entry = await this.#entry();
-    if (entry) {
-      try {
-        await entry.setPassword(JSON.stringify(credential));
-        await rm3(this.#credentialFile, { force: true });
-        return;
-      } catch {
-      }
-    }
-    this.#warn(FILE_DEVICE_WARNING);
-    await writeFileCredential(this.#credentialFile, credential);
-  }
-  async load() {
-    const entry = await this.#entry();
-    if (entry) {
-      try {
-        const value = await entry.getPassword();
-        if (value) return parseDeviceCredential(value);
-      } catch {
-      }
-    }
-    const credential = await readFileCredential(this.#credentialFile);
-    if (!credential) return null;
-    if (entry) {
-      try {
-        await entry.setPassword(JSON.stringify(credential));
-        await rm3(this.#credentialFile, { force: true });
-        return credential;
-      } catch {
-      }
-    }
-    this.#warn(FILE_DEVICE_WARNING);
-    return credential;
-  }
-  async delete() {
-    const entry = await this.#entry();
-    if (entry) {
-      try {
-        await entry.deleteCredential();
-      } catch {
-      }
-    }
-    await rm3(this.#credentialFile, { force: true });
-  }
-};
-var defaultStore2 = new DeviceStore();
-async function loadDeviceCredential() {
-  return await defaultStore2.load();
-}
-async function saveDeviceCredential(credential) {
-  await defaultStore2.save(credential);
-}
-async function deleteDeviceCredential() {
-  await defaultStore2.delete();
-}
-
 // src/worker/remote-worker.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
 var WORKER_REQUEST_TIMEOUT_MS = 19e3;
 var DEFAULT_RECONNECT_BASE_MS = 500;
 var DEFAULT_RECONNECT_MAX_MS = 1e4;
+var DEFAULT_HEARTBEAT_MS = 15e3;
 var DeviceRejectedError = class extends Error {
   constructor() {
     super("The relay rejected the device credential.");
@@ -13835,6 +13926,9 @@ var RemoteWorker = class {
   #random;
   #reconnectBaseMs;
   #reconnectMaxMs;
+  #heartbeatMs;
+  #workerId = randomUUID3();
+  #onStatus;
   constructor(options) {
     this.#origin = new URL(options.origin);
     this.#deviceToken = options.deviceToken;
@@ -13845,44 +13939,83 @@ var RemoteWorker = class {
     this.#random = options.random ?? Math.random;
     this.#reconnectBaseMs = options.reconnectBaseMs ?? DEFAULT_RECONNECT_BASE_MS;
     this.#reconnectMaxMs = options.reconnectMaxMs ?? DEFAULT_RECONNECT_MAX_MS;
+    this.#heartbeatMs = options.heartbeatMs ?? DEFAULT_HEARTBEAT_MS;
+    this.#onStatus = options.onStatus ?? (() => {
+    });
   }
   async run() {
     let failures = 0;
-    while (!this.#signal.aborted) {
-      try {
-        const generation = await this.#register();
-        failures = 0;
-        await this.#pollGeneration(generation);
-      } catch (error46) {
-        if (this.#signal.aborted) return;
-        if (error46 instanceof DeviceRejectedError) throw error46;
-        const delay3 = reconnectDelayMs(
-          failures,
-          this.#random,
-          this.#reconnectBaseMs,
-          this.#reconnectMaxMs
-        );
-        failures += 1;
+    let connectedBefore = false;
+    this.#onStatus({ state: "connecting" });
+    try {
+      while (!this.#signal.aborted) {
         try {
-          await this.#sleep(delay3, this.#signal);
-        } catch (sleepError) {
+          const session = await this.#register();
+          this.#onStatus({
+            state: "connected",
+            reconnected: connectedBefore,
+            legacyRelay: session.legacyRelay
+          });
+          connectedBefore = true;
+          failures = 0;
+          await this.#pollGeneration(session);
+        } catch (error46) {
           if (this.#signal.aborted) return;
-          throw sleepError;
+          if (error46 instanceof DeviceRejectedError) throw error46;
+          const delay3 = reconnectDelayMs(
+            failures,
+            this.#random,
+            this.#reconnectBaseMs,
+            this.#reconnectMaxMs
+          );
+          failures += 1;
+          this.#onStatus({
+            state: "retrying",
+            error: error46 instanceof Error ? error46 : new Error(String(error46)),
+            retryInMs: delay3
+          });
+          try {
+            await this.#sleep(delay3, this.#signal);
+          } catch (sleepError) {
+            if (this.#signal.aborted) return;
+            throw sleepError;
+          }
         }
       }
+    } finally {
+      await this.#unregister();
+      this.#onStatus({ state: "disconnected" });
     }
   }
   async #register() {
-    const response = await this.#post("/device/register", {});
+    let response;
+    try {
+      response = await this.#post("/device/register", {
+        workerId: this.#workerId
+      });
+    } catch (error46) {
+      if (!(error46 instanceof RelayResponseError) || error46.status !== 400) {
+        throw error46;
+      }
+      response = await this.#post("/device/register", {});
+      const legacyValue = await response.json();
+      if (typeof legacyValue !== "object" || legacyValue === null || !("generation" in legacyValue) || typeof legacyValue.generation !== "string") {
+        throw new Error("The relay returned an invalid registration response.");
+      }
+      return { generation: legacyValue.generation, legacyRelay: true };
+    }
     const value = await response.json();
-    if (typeof value !== "object" || value === null || !("generation" in value) || typeof value.generation !== "string") {
+    if (typeof value !== "object" || value === null || !("generation" in value) || typeof value.generation !== "string" || !("workerId" in value) || value.workerId !== this.#workerId) {
       throw new Error("The relay returned an invalid registration response.");
     }
-    return value.generation;
+    return { generation: value.generation, legacyRelay: false };
   }
-  async #pollGeneration(generation) {
+  async #pollGeneration(session) {
     while (!this.#signal.aborted) {
-      const response = await this.#post("/device/poll", { generation });
+      const response = await this.#post(
+        "/device/poll",
+        session.legacyRelay ? { generation: session.generation } : { workerId: this.#workerId, generation: session.generation }
+      );
       if (response.status === 204) continue;
       const value = await response.json();
       const parsed = workerJobSchema.safeParse(
@@ -13891,14 +14024,44 @@ var RemoteWorker = class {
       if (!parsed.success) {
         throw new Error("The relay returned an invalid worker job.");
       }
-      const result = await this.#worker.handle(parsed.data);
-      await this.#post("/device/result", result);
+      const heartbeat = session.legacyRelay ? void 0 : setInterval(() => {
+        void this.#post("/device/heartbeat", {
+          workerId: this.#workerId,
+          generation: session.generation
+        }).catch(() => {
+        });
+      }, this.#heartbeatMs);
+      heartbeat?.unref();
+      let result;
+      try {
+        result = await this.#worker.handle(parsed.data);
+      } finally {
+        if (heartbeat) clearInterval(heartbeat);
+      }
+      await this.#post(
+        "/device/result",
+        session.legacyRelay ? result : { workerId: this.#workerId, result }
+      );
     }
   }
-  async #post(path6, body) {
+  async #unregister() {
+    try {
+      await this.#fetcher(new URL("/device/unregister", this.#origin), {
+        method: "POST",
+        headers: {
+          authorization: `Device ${this.#deviceToken}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({ workerId: this.#workerId }),
+        signal: AbortSignal.timeout(3e3)
+      });
+    } catch {
+    }
+  }
+  async #post(path7, body) {
     const timeout = AbortSignal.timeout(WORKER_REQUEST_TIMEOUT_MS);
     const signal = AbortSignal.any([this.#signal, timeout]);
-    const response = await this.#fetcher(new URL(path6, this.#origin), {
+    const response = await this.#fetcher(new URL(path7, this.#origin), {
       method: "POST",
       headers: {
         authorization: `Device ${this.#deviceToken}`,
@@ -13914,17 +14077,22 @@ var RemoteWorker = class {
 };
 
 // src/worker/managed-session.ts
-var visibleActivity2 = /* @__PURE__ */ new Set(["write_file", "run_command", "cancel_command"]);
+var visibleActivity = /* @__PURE__ */ new Set(["write_file", "run_command", "cancel_command"]);
+function activityLabel(type, finished, ok = true) {
+  if (type === "run_command") return finished ? ok ? "Command started" : "Command rejected" : "Command requested";
+  if (type === "write_file") return finished ? ok ? "File write completed" : "File write rejected" : "File write started";
+  return finished ? ok ? "Command cancellation completed" : "Command cancellation rejected" : "Command cancellation requested";
+}
 function visibleWorker(worker) {
   return {
     async handle(job) {
-      if (visibleActivity2.has(job.type)) {
-        console.error(`Activity started: ${job.type} (${job.requestId})`);
+      if (visibleActivity.has(job.type)) {
+        console.error(`${activityLabel(job.type, false)} (${job.requestId}).`);
       }
       const result = await worker.handle(job);
-      if (visibleActivity2.has(job.type)) {
+      if (visibleActivity.has(job.type)) {
         console.error(
-          `Activity finished: ${job.type} (${job.requestId}), ${result.ok ? "accepted" : "rejected"}`
+          `${activityLabel(job.type, true, result.ok)} (${job.requestId}).`
         );
       }
       return result;
@@ -13935,14 +14103,19 @@ async function deviceForSession(endpoints, dependencies = {}) {
   const loadDevice = dependencies.loadDeviceCredential ?? loadDeviceCredential;
   const loadLogin = dependencies.loadCredentials ?? loadCredentials;
   const validate = dependencies.validCredentials ?? validCredentials;
+  const removeDevice = dependencies.deleteDeviceCredential ?? deleteDeviceCredential;
+  const ownsDevice = dependencies.accountOwnsDevice ?? accountOwnsDevice;
   const enroll = dependencies.enrollDevice ?? enrollDevice;
   const saveDevice = dependencies.saveDeviceCredential ?? saveDeviceCredential;
   const name = dependencies.defaultDeviceName ?? defaultDeviceName;
   const stored = await loadDevice();
-  if (stored?.relayOrigin === endpoints.relayOrigin) return stored;
   const loaded = await loadLogin();
-  if (!loaded) throw new Error("Not signed in. Run: glossa login");
+  if (!loaded) throw new Error("Not signed in. Run Glossa again to sign in.");
   const credentials = await validate(loaded.credentials);
+  if (stored?.relayOrigin === endpoints.relayOrigin) {
+    if (await ownsDevice(endpoints, credentials, stored.deviceId)) return stored;
+    await removeDevice();
+  }
   const enrolled = await enroll(
     endpoints,
     credentials,
@@ -13963,12 +14136,29 @@ async function runManagedSession(root, endpoints, allowBroadRoot = false) {
   console.error(
     "Files may be modified and commands have the full environment and permissions of this account. Press Ctrl+C to disconnect."
   );
+  let connectionState;
   try {
     await new RemoteWorker({
       origin: endpoints.workerOrigin,
       deviceToken: device.token,
       worker: visibleWorker(worker),
-      signal: controller.signal
+      signal: controller.signal,
+      onStatus(status) {
+        if (status.state === "connecting") {
+          console.error("Connecting to Glossa...");
+        } else if (status.state === "connected") {
+          console.error(status.reconnected ? "Reconnected to Glossa." : "Connected to Glossa. ChatGPT can now use this workspace.");
+          if (status.legacyRelay) {
+            console.error("The relay needs an update before this computer can expose several workspaces at once.");
+          }
+        } else if (status.state === "retrying" && connectionState !== "retrying") {
+          const prefix = connectionState === "connecting" ? "Could not connect" : "Connection lost";
+          console.error(`${prefix}: ${status.error.message} Retrying automatically.`);
+        } else if (status.state === "disconnected") {
+          console.error("Disconnected from Glossa.");
+        }
+        connectionState = status.state;
+      }
     }).run();
   } catch (error46) {
     if (error46 instanceof DeviceRejectedError) {
@@ -14012,127 +14202,147 @@ async function selectExposureRoot(explicitPath, allowBroadRoot = false, cwd = pr
 }
 
 // src/main.ts
-var VERSION = "0.1.0-beta.3";
-function usage() {
-  console.log(`Glossa ${VERSION}
+var VERSION = "0.1.0-beta.6";
+var helpText = {
+  main: `Glossa ${VERSION}
 
 Usage:
-  glossa [path] [--allow-broad-root]
+  glossa
+  glossa [directory]
+  glossa start [directory] [--allow-broad-root]
+  glossa status [--json]
+  glossa devices list [--json]
+  glossa devices rename <id> <name>
+  glossa devices revoke <id>
   glossa login
-  glossa logout
-  glossa status
-  glossa whoami
-  glossa [path] --local [--allow-broad-root]
+  glossa logout [--browser]
   glossa --version
   glossa --help
 
-Running Glossa exposes one local root through the managed MCP relay.
-Local mode reads newline-delimited worker jobs from stdin and writes results to stdout.`);
+Glossa signs in automatically and exposes each started workspace through the managed MCP relay.`,
+  start: `Usage: glossa start [directory] [--allow-broad-root]
+
+Starts a foreground worker. Inside Git, the default directory is the worktree root.
+Outside Git, provide a directory. Press Ctrl+C to disconnect.`,
+  status: `Usage: glossa status [--json]
+
+Validates Google login, contacts the relay, and reports enrolled devices and active workers.`,
+  devices: `Usage:
+  glossa devices list [--json]
+  glossa devices rename <id> <name>
+  glossa devices revoke <id>
+
+Lists, renames, or revokes computers enrolled with the current Google account.`,
+  login: `Usage: glossa login
+
+Ensures the CLI has a valid Google session. Starting Glossa also signs in automatically.`,
+  logout: `Usage: glossa logout [--browser]
+
+Removes local OAuth credentials. --browser also opens the browser-session logout used when switching Google accounts. Running workers remain connected until stopped or revoked.`
+};
+async function withLoginSignal(action) {
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  process.once("SIGINT", cancel);
+  try {
+    return await action(controller.signal);
+  } finally {
+    process.removeListener("SIGINT", cancel);
+  }
 }
-function exposeOptions(args) {
-  let selectedPath;
-  let local = false;
-  let allowBroadRoot = false;
-  for (const argument of args) {
-    if (argument === "--local") local = true;
-    else if (argument === "--allow-broad-root") allowBroadRoot = true;
-    else if (argument.startsWith("-")) throw new Error(`Unknown expose option: ${argument}`);
-    else if (selectedPath) throw new Error("Expose accepts at most one directory.");
-    else selectedPath = argument;
+async function authenticatedCredentials() {
+  const loginPerformed = await withLoginSignal(async (signal) => {
+    return await ensureSignedIn({ ...loadAuthConfig(), signal });
+  });
+  const loaded = await loadCredentials();
+  if (!loaded) throw new Error("Glossa could not load the completed login.");
+  return {
+    credentials: await validCredentials(loaded.credentials),
+    loginPerformed
+  };
+}
+async function runExposure(path7, allowBroadRoot) {
+  const root = await selectExposureRoot(path7, allowBroadRoot);
+  await authenticatedCredentials();
+  await runManagedSession(root, loadRelayEndpoints(), allowBroadRoot);
+}
+function deviceStatus(device) {
+  if (device.revokedAt) return "revoked";
+  if (device.activeWorkers === null) return "worker count unavailable";
+  if (device.activeWorkers === 0) return "offline";
+  return `${device.activeWorkers} active ${device.activeWorkers === 1 ? "worker" : "workers"}`;
+}
+async function showStatus(json2) {
+  const { credentials: initial } = await authenticatedCredentials();
+  const { credentials, profile } = await loadUserProfile(initial);
+  const endpoints = loadRelayEndpoints();
+  const devices = await listDevices(endpoints, credentials);
+  const account = profile.email ?? profile.name ?? profile.sub;
+  const workerCountsCurrent = devices.every((device) => device.activeWorkers !== null);
+  const activeWorkers = workerCountsCurrent ? devices.reduce((sum, device) => sum + device.activeWorkers, 0) : null;
+  const result = {
+    account,
+    relay: endpoints.relayOrigin,
+    connected: true,
+    activeWorkers,
+    devices
+  };
+  if (json2) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
   }
+  console.log(`Signed in as ${account}.`);
+  console.log(`Relay connected: ${endpoints.relayOrigin}`);
+  console.log(
+    activeWorkers === null ? "Active workers: unavailable until the relay is updated" : `Active workers: ${activeWorkers}`
+  );
+  if (devices.length === 0) {
+    console.log("No devices enrolled. Run glossa start in a workspace.");
+    return;
+  }
+  for (const device of devices) {
+    console.log(`${device.id}  ${device.name}  ${deviceStatus(device)}`);
+  }
+}
+async function deviceCredentials() {
   return {
-    ...selectedPath ? { path: selectedPath } : {},
-    local,
-    allowBroadRoot
+    credentials: (await authenticatedCredentials()).credentials,
+    endpoints: loadRelayEndpoints()
   };
 }
 async function main() {
-  const args = process.argv.slice(2);
-  const [command] = args;
-  if (!command || command.startsWith("-") && !["--help", "-h", "--version", "-v"].includes(command)) {
-    const options = exposeOptions(args);
-    const root = await selectExposureRoot(options.path, options.allowBroadRoot);
-    if (options.local) await runLocalSession(root, options.allowBroadRoot);
-    else
-      await runManagedSession(
-        root,
-        loadRelayEndpoints(),
-        options.allowBroadRoot
-      );
-    return;
-  }
-  switch (command) {
-    case "--help":
-    case "-h":
-    case "help":
-      usage();
-      return;
-    case "--version":
-    case "-v":
-      console.log(VERSION);
-      return;
-    case "login":
-      {
-        const authConfig = loadAuthConfig();
-        const controller = new AbortController();
-        const cancel = () => controller.abort();
-        process.once("SIGINT", cancel);
-        try {
-          await loginWithDeviceFlow({
-            ...authConfig,
-            signal: controller.signal
-          });
-        } finally {
-          process.removeListener("SIGINT", cancel);
-        }
-      }
-      return;
-    case "logout":
-      await deleteCredentials();
-      console.log("Signed out of Glossa.");
-      return;
-    case "status": {
-      const loaded = await loadCredentials();
-      if (!loaded) {
-        console.log("Not signed in. Run: glossa login");
-        process.exitCode = 1;
-        return;
-      }
-      console.log(
-        `Signed in with ${loaded.backend} credentials; access token expires ${loaded.credentials.expiresAt}.`
-      );
-      return;
-    }
-    case "whoami": {
-      const loaded = await loadCredentials();
-      if (!loaded) {
-        console.log("Not signed in. Run: glossa login");
-        process.exitCode = 1;
-        return;
-      }
-      const { credentials, profile } = await loadUserProfile(loaded.credentials);
-      const account = profile.email ?? profile.name ?? profile.sub;
-      console.log(
-        `Signed in as ${account} (${profile.sub}); access token expires ${credentials.expiresAt}.`
-      );
-      return;
-    }
-    default: {
-      const options = exposeOptions(args);
-      const root = await selectExposureRoot(options.path, options.allowBroadRoot);
-      if (options.local) await runLocalSession(root, options.allowBroadRoot);
-      else
-        await runManagedSession(
-          root,
-          loadRelayEndpoints(),
-          options.allowBroadRoot
-        );
-      return;
-    }
+  const invocation = parseInvocation(process.argv.slice(2));
+  if (invocation.command === "help") {
+    console.log(helpText[invocation.topic ?? "main"]);
+  } else if (invocation.command === "version") {
+    console.log(VERSION);
+  } else if (invocation.command === "start") {
+    await runExposure(invocation.path, invocation.allowBroadRoot);
+  } else if (invocation.command === "status") {
+    await showStatus(invocation.json);
+  } else if (invocation.command === "login") {
+    const { loginPerformed } = await authenticatedCredentials();
+    if (!loginPerformed) console.log("Signed in to Glossa.");
+  } else if (invocation.command === "logout") {
+    await logoutFromGlossa({ browser: invocation.browser });
+  } else if (invocation.action === "list") {
+    const { endpoints, credentials } = await deviceCredentials();
+    const devices = await listDevices(endpoints, credentials);
+    if (invocation.json) console.log(JSON.stringify({ devices }, null, 2));
+    else if (devices.length === 0) console.log("No devices enrolled.");
+    else for (const device of devices) console.log(`${device.id}  ${device.name}  ${deviceStatus(device)}`);
+  } else if (invocation.action === "rename") {
+    const { endpoints, credentials } = await deviceCredentials();
+    const device = await renameDevice(endpoints, credentials, invocation.deviceId, invocation.name);
+    console.log(`Renamed device ${device.id} to ${device.name}.`);
+  } else {
+    const { endpoints, credentials } = await deviceCredentials();
+    await revokeDevice(endpoints, credentials, invocation.deviceId);
+    console.log(`Revoked device ${invocation.deviceId}. Running workers on it are disconnected.`);
   }
 }
 main().catch((error46) => {
   console.error(error46 instanceof Error ? error46.message : String(error46));
+  if (error46 instanceof UsageError) console.error("Run glossa --help for usage.");
   process.exitCode = 1;
 });
-//# sourceMappingURL=main.js.map