@ariobarin/glossa 0.2.0-beta.2 → 0.2.1

package/dist/app.js

@@ -10436,10 +10436,10 @@ var require_react_reconciler_development = __commonJS({
           fiber = fiber.next, id--;
         return fiber;
       }
-      function copyWithSetImpl(obj, path13, index, value) {
-        if (index >= path13.length) return value;
-        var key = path13[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
-        updated[key] = copyWithSetImpl(obj[key], path13, index + 1, value);
+      function copyWithSetImpl(obj, path14, index, value) {
+        if (index >= path14.length) return value;
+        var key = path14[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
+        updated[key] = copyWithSetImpl(obj[key], path14, index + 1, value);
         return updated;
       }
       function copyWithRename(obj, oldPath, newPath) {
@@ -10466,11 +10466,11 @@ var require_react_reconciler_development = __commonJS({
         );
         return updated;
       }
-      function copyWithDeleteImpl(obj, path13, index) {
-        var key = path13[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
-        if (index + 1 === path13.length)
+      function copyWithDeleteImpl(obj, path14, index) {
+        var key = path14[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
+        if (index + 1 === path14.length)
           return isArrayImpl(updated) ? updated.splice(key, 1) : delete updated[key], updated;
-        updated[key] = copyWithDeleteImpl(obj[key], path13, index + 1);
+        updated[key] = copyWithDeleteImpl(obj[key], path14, index + 1);
         return updated;
       }
       function shouldSuspendImpl() {
@@ -23747,29 +23747,29 @@ var require_react_reconciler_development = __commonJS({
       var didWarnAboutNestedUpdates = false;
       var didWarnAboutFindNodeInStrictMode = {};
       var overrideHookState = null, overrideHookStateDeletePath = null, overrideHookStateRenamePath = null, overrideProps = null, overridePropsDeletePath = null, overridePropsRenamePath = null, scheduleUpdate = null, scheduleRetry = null, setErrorHandler = null, setSuspenseHandler = null;
-      overrideHookState = function(fiber, id, path13, value) {
+      overrideHookState = function(fiber, id, path14, value) {
         id = findHook(fiber, id);
-        null !== id && (path13 = copyWithSetImpl(id.memoizedState, path13, 0, value), id.memoizedState = path13, id.baseState = path13, fiber.memoizedProps = assign({}, fiber.memoizedProps), path13 = enqueueConcurrentRenderForLane(fiber, 2), null !== path13 && scheduleUpdateOnFiber(path13, fiber, 2));
+        null !== id && (path14 = copyWithSetImpl(id.memoizedState, path14, 0, value), id.memoizedState = path14, id.baseState = path14, fiber.memoizedProps = assign({}, fiber.memoizedProps), path14 = enqueueConcurrentRenderForLane(fiber, 2), null !== path14 && scheduleUpdateOnFiber(path14, fiber, 2));
       };
-      overrideHookStateDeletePath = function(fiber, id, path13) {
+      overrideHookStateDeletePath = function(fiber, id, path14) {
         id = findHook(fiber, id);
-        null !== id && (path13 = copyWithDeleteImpl(id.memoizedState, path13, 0), id.memoizedState = path13, id.baseState = path13, fiber.memoizedProps = assign({}, fiber.memoizedProps), path13 = enqueueConcurrentRenderForLane(fiber, 2), null !== path13 && scheduleUpdateOnFiber(path13, fiber, 2));
+        null !== id && (path14 = copyWithDeleteImpl(id.memoizedState, path14, 0), id.memoizedState = path14, id.baseState = path14, fiber.memoizedProps = assign({}, fiber.memoizedProps), path14 = enqueueConcurrentRenderForLane(fiber, 2), null !== path14 && scheduleUpdateOnFiber(path14, fiber, 2));
       };
       overrideHookStateRenamePath = function(fiber, id, oldPath, newPath) {
         id = findHook(fiber, id);
         null !== id && (oldPath = copyWithRename(id.memoizedState, oldPath, newPath), id.memoizedState = oldPath, id.baseState = oldPath, fiber.memoizedProps = assign({}, fiber.memoizedProps), oldPath = enqueueConcurrentRenderForLane(fiber, 2), null !== oldPath && scheduleUpdateOnFiber(oldPath, fiber, 2));
       };
-      overrideProps = function(fiber, path13, value) {
-        fiber.pendingProps = copyWithSetImpl(fiber.memoizedProps, path13, 0, value);
+      overrideProps = function(fiber, path14, value) {
+        fiber.pendingProps = copyWithSetImpl(fiber.memoizedProps, path14, 0, value);
         fiber.alternate && (fiber.alternate.pendingProps = fiber.pendingProps);
-        path13 = enqueueConcurrentRenderForLane(fiber, 2);
-        null !== path13 && scheduleUpdateOnFiber(path13, fiber, 2);
+        path14 = enqueueConcurrentRenderForLane(fiber, 2);
+        null !== path14 && scheduleUpdateOnFiber(path14, fiber, 2);
       };
-      overridePropsDeletePath = function(fiber, path13) {
-        fiber.pendingProps = copyWithDeleteImpl(fiber.memoizedProps, path13, 0);
+      overridePropsDeletePath = function(fiber, path14) {
+        fiber.pendingProps = copyWithDeleteImpl(fiber.memoizedProps, path14, 0);
         fiber.alternate && (fiber.alternate.pendingProps = fiber.pendingProps);
-        path13 = enqueueConcurrentRenderForLane(fiber, 2);
-        null !== path13 && scheduleUpdateOnFiber(path13, fiber, 2);
+        path14 = enqueueConcurrentRenderForLane(fiber, 2);
+        null !== path14 && scheduleUpdateOnFiber(path14, fiber, 2);
       };
       overridePropsRenamePath = function(fiber, oldPath, newPath) {
         fiber.pendingProps = copyWithRename(
@@ -27007,21 +27007,6 @@ var SessionExpiredError = class extends Error {
     this.name = "SessionExpiredError";
   }
 };
-function accessTokenSubject(credentials) {
-  try {
-    const parts = credentials.accessToken.split(".");
-    if (parts.length !== 3) throw new Error();
-    const payload = JSON.parse(
-      Buffer.from(parts[1], "base64url").toString("utf8")
-    );
-    if (typeof payload.sub !== "string" || payload.sub.length === 0) {
-      throw new Error();
-    }
-    return payload.sub;
-  } catch {
-    throw new Error("Glossa could not identify the signed-in account.");
-  }
-}
 function sessionExpiredError() {
   return new SessionExpiredError();
 }
@@ -27162,11 +27147,10 @@ async function postForm(fetchRequest, url2, values, signal) {
   }
   return data;
 }
-async function loginWithDeviceFlow(options, dependencies = {}) {
+async function authorizeWithDeviceFlow(options, dependencies = {}) {
   const fetchRequest = dependencies.fetch ?? fetch;
   const wait = dependencies.delay ?? defaultDelay;
   const browse = dependencies.openBrowser ?? openBrowser;
-  const save = dependencies.saveCredentials ?? saveCredentials;
   const now = dependencies.now ?? Date.now;
   const log = dependencies.log ?? console.log;
   try {
@@ -27204,26 +27188,25 @@ async function loginWithDeviceFlow(options, dependencies = {}) {
       });
       const data = await response.json();
       if (response.ok && "access_token" in data) {
-        if (!data.refresh_token) {
-          throw new Error("Auth0 did not issue a refresh token.");
-        }
         const grantedScope = data.scope ?? options.scope;
-        if (!grantedScopesSatisfyRequest(grantedScope, options.scope, true)) {
+        if (!grantedScopesSatisfyRequest(
+          grantedScope,
+          options.scope,
+          Boolean(data.refresh_token)
+        )) {
           throw new Error("Auth0 did not grant the permissions Glossa requires.");
         }
-        await save({
+        return {
           issuer: options.issuer,
           clientId: options.clientId,
           audience: options.audience,
           accessToken: data.access_token,
-          refreshToken: data.refresh_token,
+          ...data.refresh_token ? { refreshToken: data.refresh_token } : {},
           expiresAt: new Date(now() + data.expires_in * 1e3).toISOString(),
           tokenType: data.token_type,
           scope: grantedScope,
           requestedScope: options.scope
-        });
-        log("Signed in to Glossa.");
-        return;
+        };
       }
       const error46 = data;
       if (error46.error === "authorization_pending") continue;
@@ -27243,6 +27226,15 @@ async function loginWithDeviceFlow(options, dependencies = {}) {
     throw error46;
   }
 }
+async function loginWithDeviceFlow(options, dependencies = {}) {
+  const credentials = await authorizeWithDeviceFlow(options, dependencies);
+  if (!credentials.refreshToken) {
+    throw new Error("Auth0 did not issue a refresh token.");
+  }
+  const save = dependencies.saveCredentials ?? saveCredentials;
+  await save(credentials);
+  (dependencies.log ?? console.log)("Signed in to Glossa.");
+}
 
 // src/auth-login.ts
 function normalizedIssuer(value) {
@@ -28014,10 +28006,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path13) {
-  if (!path13)
+function getElementAtPath(obj, path14) {
+  if (!path14)
     return obj;
-  return path13.reduce((acc, key) => acc?.[key], obj);
+  return path14.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -28378,11 +28370,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path13, issues) {
+function prefixIssues(path14, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path13);
+    iss.path.unshift(path14);
     return iss;
   });
 }
@@ -28544,7 +28536,7 @@ function formatError(error46, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error46, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error47, path13 = []) => {
+  const processError = (error47, path14 = []) => {
     var _a, _b;
     for (const issue2 of error47.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -28554,7 +28546,7 @@ function treeifyError(error46, mapper = (issue2) => issue2.message) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path13, ...issue2.path];
+        const fullpath = [...path14, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -28586,8 +28578,8 @@ function treeifyError(error46, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path13 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path13) {
+  const path14 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path14) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -40271,6 +40263,10 @@ function parseInvocation(args) {
     noOptions("Logout", options);
     return { command };
   }
+  if (command === "unpair") {
+    noOptions("Unpair", options);
+    return { command };
+  }
   if (command === "update") return parseUpdate(options);
   return parseWorkspace(args);
 }
@@ -40322,7 +40318,7 @@ async function logoutFromGlossa(dependencies = {}) {
   const issuer = dependencies.issuer ?? stored?.credentials.issuer;
   await remove();
   log(
-    present ? "Signed out of Glossa." : "Already signed out of Glossa."
+    present ? "Signed out of the Glossa account. Computer pairing stays active." : "Already signed out of the Glossa account. Computer pairing stays active."
   );
   const url2 = browserLogoutUrl(issuer ?? loadAuthConfig().issuer);
   const opened = await browse(url2);
@@ -40434,12 +40430,6 @@ async function listDevices(endpoints, credentials, fetchRequest = fetch) {
   if (!response.ok) throw relayError(response.status, data);
   return parseDevices2(data.devices);
 }
-async function accountOwnsDevice(endpoints, credentials, deviceId, fetchRequest = fetch) {
-  const devices = await listDevices(endpoints, credentials, fetchRequest);
-  return devices.some(
-    (device) => device.id === deviceId && device.revokedAt === null
-  );
-}
 async function enrollDevice(endpoints, credentials, deviceName, fetchRequest = fetch) {
   const baseName = deviceNameSchema.parse(deviceName);
   let name = baseName;
@@ -40484,6 +40474,17 @@ async function enrollDevice(endpoints, credentials, deviceName, fetchRequest = f
   }
   throw new Error("Glossa could not enroll this computer.");
 }
+async function revokePairedDevice(endpoints, device, fetchRequest = fetch) {
+  const response = await fetchRequest(`${endpoints.relayOrigin}/device`, {
+    method: "DELETE",
+    headers: { authorization: `Device ${device.token}` }
+  });
+  if (response.ok || response.status === 401 || response.status === 404) return;
+  if (response.status === 429) {
+    throw new Error("Glossa device authentication is rate limited. Try again later.");
+  }
+  throw new Error(`The Glossa relay returned HTTP ${response.status}.`);
+}
 async function revokeDevice(endpoints, credentials, deviceId, fetchRequest = fetch) {
   const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/${encodeURIComponent(deviceId)}`, {
     method: "DELETE",
@@ -47670,8 +47671,8 @@ function Text({ color, backgroundColor, dimColor = false, bold = false, italic =
 }
 
 // ../../node_modules/ink/build/components/ErrorOverview.js
-var cleanupPath = (path13) => {
-  return path13?.replace(`file://${cwd()}/`, "");
+var cleanupPath = (path14) => {
+  return path14?.replace(`file://${cwd()}/`, "");
 };
 var stackUtils = new import_stack_utils.default({
   cwd: cwd(),
@@ -47845,7 +47846,7 @@ function App({ children, stdin, stdout, stderr, writeToStdout, writeToStderr, ex
     for (const subscriber of animationSubscribersRef.current.values()) {
       nextDueTime = Math.min(nextDueTime, subscriber.nextDueTime);
     }
-    const delay4 = Math.max(0, nextDueTime - performance.now());
+    const delay5 = Math.max(0, nextDueTime - performance.now());
     animationTimerRef.current = setTimeout(() => {
       animationTimerRef.current = void 0;
       const currentTime = performance.now();
@@ -47859,7 +47860,7 @@ function App({ children, stdin, stdout, stderr, writeToStdout, writeToStderr, ex
         subscriber.nextDueTime = subscriber.startTime + elapsedFrames * subscriber.interval;
       }
       scheduleAnimationTick();
-    }, delay4);
+    }, delay5);
   }, [clearAnimationTimer]);
   const animationSubscribe = (0, import_react15.useCallback)((callback, interval) => {
     const startTime = performance.now();
@@ -49799,7 +49800,7 @@ function connectHintStore(directory = configDirectory()) {
 }
 async function announceConnectHint(store3, log) {
   if (await store3.exists()) return false;
-  log(`Next: add Glossa in ChatGPT. Follow the quickstart at ${CONNECT_HINT_URL}.`);
+  log(`Next: return to ChatGPT and use Glossa. If it is not connected yet, follow ${CONNECT_HINT_URL}.`);
   await store3.mark();
   return true;
 }
@@ -49845,11 +49846,294 @@ async function deleteDeviceCredential() {
   await store2.delete();
 }
 
+// src/device-pairing-lock.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { mkdir as mkdir4, readFile as readFile3, rm as rm3, stat, writeFile as writeFile4 } from "node:fs/promises";
+import path6 from "node:path";
+import { setTimeout as delay2 } from "node:timers/promises";
+
+// src/update-lock.ts
+import { randomUUID } from "node:crypto";
+import { mkdir as mkdir3, readdir, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
+import path5 from "node:path";
+var UPDATE_SUFFIX = ".update";
+var SESSION_SUFFIX = ".session";
+function updateRuntimeDirectory() {
+  return path5.join(configDirectory(), "runtime");
+}
+function processIsAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error46) {
+    return error46.code === "EPERM";
+  }
+}
+function leasePid(name, suffix) {
+  if (!name.endsWith(suffix)) return null;
+  const separator = name.indexOf("-");
+  if (separator <= 0) return null;
+  const pid = Number(name.slice(0, separator));
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+async function activeLeaseFiles(directory, suffix) {
+  let entries;
+  try {
+    entries = await readdir(directory, { withFileTypes: true });
+  } catch (error46) {
+    if (error46.code === "ENOENT") return [];
+    throw error46;
+  }
+  const active = [];
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith(suffix)) continue;
+    const pid = leasePid(entry.name, suffix);
+    const file2 = path5.join(directory, entry.name);
+    if (pid !== null && processIsAlive(pid)) active.push(file2);
+    else await rm2(file2, { force: true });
+  }
+  return active;
+}
+async function updateLockIsActive(directory) {
+  return (await activeLeaseFiles(directory, UPDATE_SUFFIX)).length > 0;
+}
+async function activeSessionFiles(directory) {
+  return await activeLeaseFiles(directory, SESSION_SUFFIX);
+}
+async function createUpdateLock(directory) {
+  await mkdir3(directory, { recursive: true, mode: 448 });
+  const lockFile = path5.join(
+    directory,
+    `${process.pid}-${randomUUID()}${UPDATE_SUFFIX}`
+  );
+  const content = `${JSON.stringify({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() })}
+`;
+  await writeFile3(lockFile, content, {
+    encoding: "utf8",
+    flag: "wx",
+    mode: 384
+  });
+  try {
+    const contenders = await activeLeaseFiles(directory, UPDATE_SUFFIX);
+    if (contenders.some((file2) => file2 !== lockFile)) {
+      throw new Error("Another Glossa update is already running.");
+    }
+    return lockFile;
+  } catch (error46) {
+    await rm2(lockFile, { force: true });
+    throw error46;
+  }
+}
+async function withUpdateLease(action, directory = updateRuntimeDirectory()) {
+  const lockFile = await createUpdateLock(directory);
+  try {
+    if ((await activeSessionFiles(directory)).length > 0) {
+      throw new Error("Disconnect every running Glossa workspace before updating.");
+    }
+    return await action();
+  } finally {
+    await rm2(lockFile, { force: true });
+  }
+}
+async function withWorkspaceLease(action, directory = updateRuntimeDirectory()) {
+  await mkdir3(directory, { recursive: true, mode: 448 });
+  if (await updateLockIsActive(directory)) {
+    throw new Error("Glossa is updating. Run this workspace again after the update finishes.");
+  }
+  const leaseFile = path5.join(
+    directory,
+    `${process.pid}-${randomUUID()}${SESSION_SUFFIX}`
+  );
+  await writeFile3(
+    leaseFile,
+    `${JSON.stringify({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() })}
+`,
+    { encoding: "utf8", flag: "wx", mode: 384 }
+  );
+  try {
+    if (await updateLockIsActive(directory)) {
+      throw new Error("Glossa is updating. Run this workspace again after the update finishes.");
+    }
+    return await action();
+  } finally {
+    await rm2(leaseFile, { force: true });
+  }
+}
+
+// src/device-pairing-lock.ts
+var DEVICE_PAIRING_LOCK = "device-pairing.lock";
+var DEVICE_PAIRING_LOCK_GUARD = "device-pairing.lock.guard";
+var DEVICE_PAIRING_LOCK_POLL_MS = 100;
+var DEVICE_PAIRING_LOCK_MAX_AGE_MS = 6 * 6e4;
+var DEVICE_PAIRING_GUARD_MAX_AGE_MS = 3e4;
+function lockPath(directory) {
+  return path6.join(directory, DEVICE_PAIRING_LOCK);
+}
+function guardPath(directory) {
+  return path6.join(directory, DEVICE_PAIRING_LOCK_GUARD);
+}
+function newOwner() {
+  return {
+    pid: process.pid,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    token: randomUUID2()
+  };
+}
+async function readOwner(file2) {
+  try {
+    const value = JSON.parse(await readFile3(file2, "utf8"));
+    if (!Number.isSafeInteger(value.pid) || typeof value.startedAt !== "string" || !Number.isFinite(Date.parse(value.startedAt)) || typeof value.token !== "string" || value.token.length === 0) {
+      return void 0;
+    }
+    return value;
+  } catch (error46) {
+    if (error46.code === "ENOENT") return void 0;
+    return void 0;
+  }
+}
+async function lockIsStale(file2, maxAgeMs) {
+  const owner = await readOwner(file2);
+  if (!owner) {
+    try {
+      const metadata = await stat(file2);
+      return Date.now() - metadata.mtimeMs > maxAgeMs;
+    } catch (error46) {
+      if (error46.code === "ENOENT") return false;
+      return true;
+    }
+  }
+  const ageMs = Date.now() - Date.parse(owner.startedAt);
+  return ageMs > maxAgeMs || !processIsAlive(owner.pid);
+}
+async function acquireGuard(directory, signal) {
+  const file2 = guardPath(directory);
+  for (; ; ) {
+    signal?.throwIfAborted();
+    const owner = newOwner();
+    try {
+      await writeFile4(file2, `${JSON.stringify(owner)}
+`, {
+        encoding: "utf8",
+        flag: "wx",
+        mode: 384
+      });
+      return { file: file2, token: owner.token };
+    } catch (error46) {
+      if (error46.code !== "EEXIST") throw error46;
+    }
+    if (await lockIsStale(file2, DEVICE_PAIRING_GUARD_MAX_AGE_MS)) {
+      await rm3(file2, { force: true });
+      continue;
+    }
+    await delay2(
+      DEVICE_PAIRING_LOCK_POLL_MS,
+      void 0,
+      signal ? { signal } : void 0
+    );
+  }
+}
+async function removeOwnedLock(file2, token) {
+  const owner = await readOwner(file2);
+  if (owner?.token === token) await rm3(file2, { force: true });
+}
+async function withGuard(directory, action, signal) {
+  const guard = await acquireGuard(directory, signal);
+  try {
+    return await action();
+  } finally {
+    await removeOwnedLock(guard.file, guard.token);
+  }
+}
+async function acquireDevicePairingLock(directory, signal) {
+  await mkdir4(directory, { recursive: true, mode: 448 });
+  const file2 = lockPath(directory);
+  for (; ; ) {
+    signal?.throwIfAborted();
+    const owner = newOwner();
+    try {
+      await writeFile4(file2, `${JSON.stringify(owner)}
+`, {
+        encoding: "utf8",
+        flag: "wx",
+        mode: 384
+      });
+      return { file: file2, token: owner.token };
+    } catch (error46) {
+      if (error46.code !== "EEXIST") throw error46;
+    }
+    const reclaimed = await withGuard(
+      directory,
+      async () => {
+        if (!await lockIsStale(file2, DEVICE_PAIRING_LOCK_MAX_AGE_MS)) {
+          return false;
+        }
+        await rm3(file2, { force: true });
+        return true;
+      },
+      signal
+    );
+    if (reclaimed) continue;
+    await delay2(
+      DEVICE_PAIRING_LOCK_POLL_MS,
+      void 0,
+      signal ? { signal } : void 0
+    );
+  }
+}
+async function withDevicePairingLease(action, signal, directory = updateRuntimeDirectory()) {
+  const lock = await acquireDevicePairingLock(directory, signal);
+  try {
+    return await action();
+  } finally {
+    await withGuard(directory, async () => await removeOwnedLock(lock.file, lock.token));
+  }
+}
+
+// src/device-pairing.ts
+function canceledError2() {
+  return new Error("Pairing canceled.");
+}
+function pairingScope(scope) {
+  return scope.split(/\s+/).filter((value) => value && value !== "offline_access").join(" ");
+}
+async function pairDevice(endpoints, signal, dependencies = {}) {
+  const authorize = dependencies.authorizeWithDeviceFlow ?? authorizeWithDeviceFlow;
+  const enroll = dependencies.enrollDevice ?? enrollDevice;
+  const authConfig = dependencies.loadAuthConfig ?? loadAuthConfig;
+  const name = dependencies.defaultDeviceName ?? defaultDeviceName;
+  const log = dependencies.log ?? console.log;
+  const baseFetch = dependencies.fetch ?? fetch;
+  const fetchRequest = signal ? async (input, init) => await baseFetch(input, { ...init, signal }) : baseFetch;
+  try {
+    signal?.throwIfAborted();
+    log("This computer needs to be paired with Glossa.");
+    const auth = authConfig();
+    const credentials = await authorize(
+      {
+        ...auth,
+        scope: pairingScope(auth.scope),
+        ...signal ? { signal } : {}
+      },
+      { fetch: fetchRequest, log }
+    );
+    signal?.throwIfAborted();
+    const paired = await enroll(endpoints, credentials, name(), fetchRequest);
+    log(`Paired with Glossa as ${paired.deviceName}.`);
+    return paired;
+  } catch (error46) {
+    if (signal?.aborted || error46 instanceof Error && error46.name === "AbortError") {
+      throw canceledError2();
+    }
+    throw error46;
+  }
+}
+
 // src/worker/command-service.ts
 import { spawn as spawn2 } from "node:child_process";
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID3 } from "node:crypto";
 import { StringDecoder } from "node:string_decoder";
-import { setTimeout as delay2 } from "node:timers/promises";
+import { setTimeout as delay3 } from "node:timers/promises";
 
 // src/worker/errors.ts
 var WorkerError = class extends Error {
@@ -49964,7 +50248,7 @@ async function waitForChange(record2, afterSequence, waitMs) {
   try {
     await Promise.race([
       change,
-      delay2(waitMs, void 0, { signal: waitController.signal })
+      delay3(waitMs, void 0, { signal: waitController.signal })
     ]);
   } finally {
     record2.changeWaiters.delete(changed);
@@ -50135,7 +50419,7 @@ async function terminateProcessTree(child) {
   } catch {
     child.kill("SIGTERM");
   }
-  await delay2(2e3);
+  await delay3(2e3);
   if (child.exitCode === null) {
     try {
       process.kill(-child.pid, "SIGKILL");
@@ -50228,7 +50512,7 @@ var CommandService = class {
     const completion = new Promise((resolve) => {
       complete = resolve;
     });
-    const id = randomUUID();
+    const id = randomUUID3();
     const record2 = {
       id,
       child,
@@ -50300,7 +50584,7 @@ var CommandService = class {
       try {
         await Promise.race([
           record2.completion,
-          delay2(waitMs, void 0, { signal: waitController.signal })
+          delay3(waitMs, void 0, { signal: waitController.signal })
         ]);
       } finally {
         waitController.abort();
@@ -50326,7 +50610,7 @@ var CommandService = class {
         try {
           await Promise.race([
             record2.completion,
-            delay2(waitMs, void 0, { signal: waitController.signal })
+            delay3(waitMs, void 0, { signal: waitController.signal })
           ]);
         } finally {
           waitController.abort();
@@ -50428,29 +50712,29 @@ var CommandService = class {
 };
 
 // src/worker/file-service.ts
-import { createHash, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash, randomUUID as randomUUID4 } from "node:crypto";
 import {
   chmod as chmod2,
   link as link2,
   lstat as lstat2,
-  mkdir as mkdir3,
+  mkdir as mkdir5,
   opendir,
   open,
-  readFile as readFile3,
+  readFile as readFile4,
   rename,
-  rm as rm2,
+  rm as rm4,
   rmdir,
-  stat as stat2,
-  writeFile as writeFile3
+  stat as stat3,
+  writeFile as writeFile5
 } from "node:fs/promises";
-import path6 from "node:path";
+import path8 from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
 import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 
 // src/worker/path-policy.ts
-import { lstat, realpath, stat } from "node:fs/promises";
+import { lstat, realpath, stat as stat2 } from "node:fs/promises";
 import os5 from "node:os";
-import path5 from "node:path";
+import path7 from "node:path";
 function samePath(left, right) {
   return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
@@ -50462,15 +50746,15 @@ function accountHomeDirectory() {
   }
 }
 function isWithin(root, candidate) {
-  const relative = path5.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path5.sep}`) && relative !== ".." && !path5.isAbsolute(relative);
+  const relative = path7.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path7.sep}`) && relative !== ".." && !path7.isAbsolute(relative);
 }
 function validateRelativePath(value) {
   if (value.includes("\0")) {
     throw new WorkerError("invalid_path", "Paths cannot contain null bytes.");
   }
   const explicitNativePosixPath = process.platform !== "win32" && value.startsWith("./");
-  if (path5.isAbsolute(value) || path5.posix.isAbsolute(value) || !explicitNativePosixPath && path5.win32.isAbsolute(value)) {
+  if (path7.isAbsolute(value) || path7.posix.isAbsolute(value) || !explicitNativePosixPath && path7.win32.isAbsolute(value)) {
     throw new WorkerError("absolute_path", "Absolute paths are not allowed.");
   }
   const segments = explicitNativePosixPath ? value.split(/\/+/).filter(Boolean) : value.split(/[\\/]+/);
@@ -50480,20 +50764,20 @@ function validateRelativePath(value) {
   return value === "" ? "." : value;
 }
 async function canonicalizeRoot(candidate) {
-  const root = await realpath(path5.resolve(candidate)).catch((error46) => {
+  const root = await realpath(path7.resolve(candidate)).catch((error46) => {
     if (error46.code === "ENOENT") {
       throw new WorkerError("root_not_found", "The workspace directory does not exist.");
     }
     throw error46;
   });
-  const rootStat = await stat(root);
+  const rootStat = await stat2(root);
   if (!rootStat.isDirectory()) {
     throw new WorkerError("root_not_directory", "The exposed root must be a directory.");
   }
-  const filesystemRoot = path5.parse(root).root;
+  const filesystemRoot = path7.parse(root).root;
   const homes = await Promise.all(
     [os5.homedir(), accountHomeDirectory()].map(
-      async (home) => await realpath(home).catch(() => path5.resolve(home))
+      async (home) => await realpath(home).catch(() => path7.resolve(home))
     )
   );
   const isHomeDirectory = homes.some((home) => samePath(root, home));
@@ -50529,7 +50813,7 @@ var PathPolicy = class _PathPolicy {
     return canonical;
   }
   async resolveDiscoveredExisting(candidate) {
-    const lexical = path5.resolve(candidate);
+    const lexical = path7.resolve(candidate);
     if (!isWithin(this.root, lexical)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
@@ -50547,7 +50831,7 @@ var PathPolicy = class _PathPolicy {
   }
   async resolveWritableFile(relativePath) {
     const lexical = this.resolveLexical(relativePath);
-    const parent = path5.dirname(lexical);
+    const parent = path7.dirname(lexical);
     await this.rejectLinkedComponents(parent);
     const canonicalParent = await realpath(parent).catch((error46) => {
       if (error46.code === "ENOENT") {
@@ -50558,7 +50842,7 @@ var PathPolicy = class _PathPolicy {
     if (!isWithin(this.root, canonicalParent)) {
       throw new WorkerError("path_escape", "The destination escapes the exposed root.");
     }
-    if (!(await stat(canonicalParent)).isDirectory()) {
+    if (!(await stat2(canonicalParent)).isDirectory()) {
       throw new WorkerError("not_directory", "The destination parent is not a directory.");
     }
     try {
@@ -50578,7 +50862,7 @@ var PathPolicy = class _PathPolicy {
       if (error46 instanceof WorkerError) throw error46;
       if (error46.code !== "ENOENT") throw error46;
     }
-    return path5.join(canonicalParent, path5.basename(lexical));
+    return path7.join(canonicalParent, path7.basename(lexical));
   }
   async resolveWritableDirectory(relativePath, recursive) {
     const lexical = this.resolveLexical(relativePath);
@@ -50601,7 +50885,7 @@ var PathPolicy = class _PathPolicy {
       if (error46.code !== "ENOENT") throw error46;
     }
     if (!recursive) {
-      const parent = path5.dirname(lexical);
+      const parent = path7.dirname(lexical);
       await this.rejectLinkedComponents(parent);
       const canonicalParent = await realpath(parent).catch(
         (error46) => {
@@ -50617,15 +50901,15 @@ var PathPolicy = class _PathPolicy {
       if (!isWithin(this.root, canonicalParent)) {
         throw new WorkerError("path_escape", "The destination escapes the exposed root.");
       }
-      if (!(await stat(canonicalParent)).isDirectory()) {
+      if (!(await stat2(canonicalParent)).isDirectory()) {
         throw new WorkerError("not_directory", "The destination parent is not a directory.");
       }
       return {
-        target: path5.join(canonicalParent, path5.basename(lexical)),
+        target: path7.join(canonicalParent, path7.basename(lexical)),
         exists: false
       };
     }
-    let existingAncestor = path5.dirname(lexical);
+    let existingAncestor = path7.dirname(lexical);
     while (!samePath(existingAncestor, this.root)) {
       try {
         await this.rejectLinkedComponents(existingAncestor);
@@ -50633,13 +50917,13 @@ var PathPolicy = class _PathPolicy {
         if (!isWithin(this.root, canonicalAncestor)) {
           throw new WorkerError("path_escape", "The destination escapes the exposed root.");
         }
-        if (!(await stat(canonicalAncestor)).isDirectory()) {
+        if (!(await stat2(canonicalAncestor)).isDirectory()) {
           throw new WorkerError("not_directory", "The destination parent is not a directory.");
         }
         return {
-          target: path5.join(
+          target: path7.join(
             canonicalAncestor,
-            path5.relative(existingAncestor, lexical)
+            path7.relative(existingAncestor, lexical)
           ),
           exists: false
         };
@@ -50647,13 +50931,13 @@ var PathPolicy = class _PathPolicy {
         if (error46 instanceof WorkerError) throw error46;
         if (error46.code !== "ENOENT") throw error46;
       }
-      existingAncestor = path5.dirname(existingAncestor);
+      existingAncestor = path7.dirname(existingAncestor);
     }
     return { target: lexical, exists: false };
   }
   async resolveVacantPath(relativePath) {
     const lexical = this.resolveLexical(relativePath);
-    const parent = path5.dirname(lexical);
+    const parent = path7.dirname(lexical);
     await this.rejectLinkedComponents(parent);
     const canonicalParent = await realpath(parent).catch(
       (error46) => {
@@ -50669,7 +50953,7 @@ var PathPolicy = class _PathPolicy {
     if (!isWithin(this.root, canonicalParent)) {
       throw new WorkerError("path_escape", "The destination escapes the exposed root.");
     }
-    if (!(await stat(canonicalParent)).isDirectory()) {
+    if (!(await stat2(canonicalParent)).isDirectory()) {
       throw new WorkerError("not_directory", "The destination parent is not a directory.");
     }
     try {
@@ -50682,11 +50966,11 @@ var PathPolicy = class _PathPolicy {
       if (error46 instanceof WorkerError) throw error46;
       if (error46.code !== "ENOENT") throw error46;
     }
-    return path5.join(canonicalParent, path5.basename(lexical));
+    return path7.join(canonicalParent, path7.basename(lexical));
   }
   resolveLexical(relativePath) {
     const validated = validateRelativePath(relativePath);
-    const candidate = path5.resolve(this.root, validated);
+    const candidate = path7.resolve(this.root, validated);
     if (!isWithin(this.root, candidate)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
@@ -50696,11 +50980,11 @@ var PathPolicy = class _PathPolicy {
     if (!isWithin(this.root, candidate)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
-    const relative = path5.relative(this.root, candidate);
+    const relative = path7.relative(this.root, candidate);
     if (!relative) return;
     let current = this.root;
-    for (const segment of relative.split(path5.sep)) {
-      current = path5.join(current, segment);
+    for (const segment of relative.split(path7.sep)) {
+      current = path7.join(current, segment);
       try {
         const currentStat = await lstat(current);
         if (currentStat.isSymbolicLink()) {
@@ -50723,12 +51007,12 @@ function sha256(content) {
   return createHash("sha256").update(content).digest("hex");
 }
 function isPathWithin(root, candidate) {
-  const relative = path6.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path6.sep}`) && relative !== ".." && !path6.isAbsolute(relative);
+  const relative = path8.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path8.sep}`) && relative !== ".." && !path8.isAbsolute(relative);
 }
 var fileWriteTails = /* @__PURE__ */ new Map();
 async function withFileWriteLock(target, operation) {
-  const normalized = path6.normalize(target);
+  const normalized = path8.normalize(target);
   const key = process.platform === "win32" ? normalized.toLowerCase() : normalized;
   const predecessor = fileWriteTails.get(key);
   let release;
@@ -50745,7 +51029,7 @@ async function withFileWriteLock(target, operation) {
   }
 }
 async function withFileWriteLocks(targets, operation) {
-  const unique = [...new Set(targets.map((target) => path6.normalize(target)))].sort(
+  const unique = [...new Set(targets.map((target) => path8.normalize(target)))].sort(
     (left, right) => left.localeCompare(right)
   );
   const run = async (index) => {
@@ -50757,7 +51041,7 @@ async function withFileWriteLocks(targets, operation) {
 async function requireRevision(target, expectedSha256) {
   let actual = null;
   try {
-    actual = sha256(await readFile3(target));
+    actual = sha256(await readFile4(target));
   } catch (error46) {
     if (error46.code !== "ENOENT") throw error46;
   }
@@ -50781,7 +51065,7 @@ function compareNames(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
 function relativeSortKey(root, target) {
-  const relative = path6.relative(root, target);
+  const relative = path8.relative(root, target);
   if (!relative) return ".";
   return process.platform === "win32" ? relative.replaceAll("\\", "/") : relative;
 }
@@ -51093,7 +51377,7 @@ var FileService = class {
   }
   async #readResolvedText(target, maximumBytes = MAX_TEXT_BYTES) {
     const boundedMaximum = Math.min(maximumBytes, MAX_TEXT_BYTES);
-    const targetStat = await stat2(target);
+    const targetStat = await stat3(target);
     if (!targetStat.isFile()) {
       throw new WorkerError("not_file", "The requested path is not a file.");
     }
@@ -51136,7 +51420,7 @@ var FileService = class {
       this.policy.resolveExisting(startPath),
       deadlineAt
     );
-    const startStat = await this.#withinDeadline(stat2(start), deadlineAt);
+    const startStat = await this.#withinDeadline(stat3(start), deadlineAt);
     if (!startStat.isDirectory()) {
       throw new WorkerError("not_directory", "The requested path is not a directory.");
     }
@@ -51165,7 +51449,7 @@ var FileService = class {
       if (batch.overflow) throw scanLimitError();
       scannedEntries += batch.children.length;
       for (const child of batch.children) {
-        const target = path6.join(directory, child.name);
+        const target = path8.join(directory, child.name);
         heapPush(frontier, {
           target,
           sortKey: relativeSortKey(this.policy.root, target),
@@ -51189,7 +51473,7 @@ var FileService = class {
             throw scanLimitError();
           }
           scannedEntries += 1;
-          const target = path6.join(directory, child.name);
+          const target = path8.join(directory, child.name);
           let childStat;
           try {
             childStat = await this.#withinDeadline(
@@ -51341,7 +51625,7 @@ var FileService = class {
       if (!patterns) return false;
       const normalized = relativePath.replaceAll("\\", "/");
       try {
-        return patterns.some((pattern) => path6.posix.matchesGlob(normalized, pattern));
+        return patterns.some((pattern) => path8.posix.matchesGlob(normalized, pattern));
       } catch {
         throw new WorkerError("invalid_search", "Search glob pattern is invalid.");
       }
@@ -51359,7 +51643,7 @@ var FileService = class {
       this.policy.resolveExisting(options.path ?? "."),
       deadlineAt
     );
-    const startStat = await this.#withinDeadline(stat2(start), deadlineAt);
+    const startStat = await this.#withinDeadline(stat3(start), deadlineAt);
     const matches = [];
     let scannedEntries = 0;
     let scannedFiles = 0;
@@ -51370,7 +51654,7 @@ var FileService = class {
     const searchFile = async (target) => {
       const relative = displayPath(this.policy.root, target);
       if (extensions && !extensions.some(
-        (extension) => path6.basename(target).toLowerCase().endsWith(extension)
+        (extension) => path8.basename(target).toLowerCase().endsWith(extension)
       )) {
         return false;
       }
@@ -51465,7 +51749,7 @@ var FileService = class {
       scannedEntries += batch.children.length;
       for (const child of batch.children) {
         this.#assertBeforeDeadline(deadlineAt);
-        const target = path6.join(directory, child.name);
+        const target = path8.join(directory, child.name);
         let targetType;
         if (this.#trustDirectoryEntryTypes) {
           if (child.isSymbolicLink()) {
@@ -51613,12 +51897,12 @@ var FileService = class {
       );
       if (current.exists) return { created: false };
       try {
-        await mkdir3(current.target, { recursive });
+        await mkdir5(current.target, { recursive });
       } catch (error46) {
         if (error46.code !== "EEXIST") throw error46;
       }
       const resolved = await this.policy.resolveExisting(relativePath);
-      if (!(await stat2(resolved)).isDirectory()) {
+      if (!(await stat3(resolved)).isDirectory()) {
         throw new WorkerError("not_directory", "The destination is not a directory.");
       }
       return { created: true };
@@ -51650,12 +51934,12 @@ var FileService = class {
       try {
         if (targetStat.isDirectory()) {
           if (recursive) {
-            await rm2(target, { recursive: true, force: false });
+            await rm4(target, { recursive: true, force: false });
           } else {
             await rmdir(target);
           }
         } else {
-          await rm2(target, { force: false });
+          await rm4(target, { force: false });
         }
       } catch (error46) {
         const code = error46.code;
@@ -51763,7 +52047,7 @@ var FileService = class {
     return await withFileWriteLock(target, async () => {
       let existingMode;
       try {
-        const existingStat = await stat2(target);
+        const existingStat = await stat3(target);
         if (existingStat.isFile()) existingMode = existingStat.mode & 4095;
       } catch (error46) {
         if (error46.code !== "ENOENT") throw error46;
@@ -51775,9 +52059,9 @@ var FileService = class {
         );
       }
       if (expectedSha256) await requireRevision(target, expectedSha256);
-      const temporary = path6.join(path6.dirname(target), `.glossa-${randomUUID2()}.tmp`);
+      const temporary = path8.join(path8.dirname(target), `.glossa-${randomUUID4()}.tmp`);
       try {
-        await writeFile3(temporary, bytes, { flag: "wx", mode: 384 });
+        await writeFile5(temporary, bytes, { flag: "wx", mode: 384 });
         target = await this.policy.resolveWritableFile(relativePath);
         const tempStat = await lstat2(temporary);
         if (!tempStat.isFile() || tempStat.isSymbolicLink()) {
@@ -51803,7 +52087,7 @@ var FileService = class {
           }
         }
       } finally {
-        await rm2(temporary, { force: true });
+        await rm4(temporary, { force: true });
       }
       return { sha256: sha256(bytes), bytes: bytes.byteLength };
     });
@@ -51830,7 +52114,9 @@ function jobInputContainsRestrictedData(job) {
       return containsRestrictedAuthenticationData({
         query: job.query,
         path: job.path,
-        extensions: job.extensions
+        extensions: job.extensions,
+        includeGlobs: job.includeGlobs,
+        excludeGlobs: job.excludeGlobs
       });
     case "read_file_range":
       return containsRestrictedAuthenticationData(job.path);
@@ -52013,7 +52299,7 @@ var LocalWorker = class _LocalWorker {
 };
 
 // src/worker/remote-worker.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var WORKER_REQUEST_TIMEOUT_MS = 19e3;
 var DEFAULT_RECONNECT_BASE_MS = 500;
 var DEFAULT_RECONNECT_MAX_MS = 1e4;
@@ -52133,7 +52419,7 @@ var RemoteWorker = class {
   #reconnectBaseMs;
   #reconnectMaxMs;
   #heartbeatMs;
-  #workerId = randomUUID3();
+  #workerId = randomUUID5();
   #onStatus;
   constructor(options) {
     this.#origin = new URL(options.origin);
@@ -52177,7 +52463,7 @@ var RemoteWorker = class {
           if (error46 instanceof DeviceRejectedError || error46 instanceof RelayAccessProfileUnsupportedError) {
             throw error46;
           }
-          const delay4 = reconnectDelayMs(
+          const delay5 = reconnectDelayMs(
             failures,
             this.#random,
             this.#reconnectBaseMs,
@@ -52187,10 +52473,10 @@ var RemoteWorker = class {
           this.#onStatus({
             state: "retrying",
             error: error46 instanceof Error ? error46 : new Error(String(error46)),
-            retryInMs: delay4
+            retryInMs: delay5
           });
           try {
-            await this.#sleep(delay4, this.#signal);
+            await this.#sleep(delay5, this.#signal);
           } catch (sleepError) {
             if (this.#signal.aborted) return;
             throw sleepError;
@@ -52269,7 +52555,7 @@ var RemoteWorker = class {
       const key = JSON.stringify(body);
       if (seenAttempts.has(key)) return;
       seenAttempts.add(key);
-      attempts.push({ body, legacyRelay, profileIncluded: includeProfile });
+      attempts.push({ body, legacyRelay });
     };
     if (this.#accessProfile) {
       for (const metadata of metadataPhases) {
@@ -52294,7 +52580,7 @@ var RemoteWorker = class {
           );
         }
       }
-      attempts.push({ body: {}, legacyRelay: true, profileIncluded: false });
+      attempts.push({ body: {}, legacyRelay: true });
     }
     for (const attempt of attempts) {
       let response;
@@ -52314,17 +52600,22 @@ var RemoteWorker = class {
         throw new Error("The relay returned an invalid registration response.");
       }
       const workerToken = "workerToken" in value ? optionalWorkerToken(value.workerToken) : void 0;
-      return {
+      const accessProfileAccepted = this.#accessProfile === void 0 || this.#accessProfile === "system" || "accessProfile" in value && value.accessProfile === this.#accessProfile;
+      const session = {
         generation: value.generation,
         legacyRelay: attempt.legacyRelay,
         concurrentJobs: !attempt.legacyRelay && supportsCapability(value, "concurrentJobs"),
         structuredReads: !attempt.legacyRelay && supportsCapability(value, "structuredReads"),
         structuredMutations: !attempt.legacyRelay && supportsCapability(value, "structuredMutations"),
         commandOutputRanges: !attempt.legacyRelay && supportsCapability(value, "commandOutputRanges"),
-        accessProfileAccepted: this.#accessProfile === void 0 || "accessProfile" in value && value.accessProfile === this.#accessProfile || this.#accessProfile === "system" && !attempt.profileIncluded,
+        accessProfileAccepted,
         workspaceLabelAccepted: this.#workspaceLabel === void 0 || "workspaceLabel" in value && value.workspaceLabel === this.#workspaceLabel,
         ...workerToken ? { workerToken } : {}
       };
+      if (!accessProfileAccepted && this.#accessProfile) {
+        throw new RelayAccessProfileUnsupportedError(this.#accessProfile);
+      }
+      return session;
     }
     if (this.#accessProfile && this.#accessProfile !== "system") {
       throw new RelayAccessProfileUnsupportedError(this.#accessProfile);
@@ -52567,10 +52858,10 @@ var RemoteWorker = class {
       await unregister(`Device ${this.#deviceToken}`);
     }
   }
-  async #post(path13, body, workerToken) {
+  async #post(path14, body, workerToken) {
     const timeout = AbortSignal.timeout(WORKER_REQUEST_TIMEOUT_MS);
     const signal = AbortSignal.any([this.#signal, timeout]);
-    const response = await this.#fetcher(new URL(path13, this.#origin), {
+    const response = await this.#fetcher(new URL(path14, this.#origin), {
       method: "POST",
       headers: {
         authorization: workerToken ? `Worker ${workerToken}` : `Device ${this.#deviceToken}`,
@@ -52691,56 +52982,27 @@ function visibleWorker(worker, options) {
 }
 async function deviceForSession(endpoints, dependencies = {}, signal) {
   const loadDevice = dependencies.loadDeviceCredential ?? loadDeviceCredential;
-  const loadLogin = dependencies.loadCredentials ?? loadCredentials;
-  const validate2 = dependencies.validCredentials ?? validCredentials;
-  const subjectFor = dependencies.accessTokenSubject ?? accessTokenSubject;
   const removeDevice = dependencies.deleteDeviceCredential ?? deleteDeviceCredential;
-  const enroll = dependencies.enrollDevice ?? enrollDevice;
   const saveDevice = dependencies.saveDeviceCredential ?? saveDeviceCredential;
-  const ownsDevice = dependencies.accountOwnsDevice ?? accountOwnsDevice;
-  const name = dependencies.defaultDeviceName ?? defaultDeviceName;
-  const baseFetch = dependencies.fetch ?? fetch;
-  const fetchRequest = signal ? async (input, init) => await baseFetch(input, { ...init, signal }) : baseFetch;
+  const pair = dependencies.pairDevice ?? pairDevice;
+  const revoke = dependencies.revokePairedDevice ?? revokePairedDevice;
+  const withPairingLease = dependencies.withDevicePairingLease ?? withDevicePairingLease;
   signal?.throwIfAborted();
   const stored = await loadDevice();
-  let credentials = dependencies.credentials;
-  const currentCredentials = async () => {
-    if (credentials) return credentials;
-    const loaded = await loadLogin();
-    if (!loaded) throw new Error("Not signed in. Run Glossa again to sign in.");
-    credentials = await validate2(loaded.credentials, { fetch: fetchRequest });
-    return credentials;
-  };
-  if (stored?.relayOrigin === endpoints.relayOrigin) {
-    const current2 = await currentCredentials();
-    const accountSubject = subjectFor(current2);
-    if (stored.accountSubject === accountSubject) return stored;
-    if (stored.accountSubject === void 0 && await ownsDevice(endpoints, current2, stored.deviceId, fetchRequest)) {
-      const migrated = { ...stored, accountSubject };
-      await saveDevice(migrated);
-      return migrated;
-    }
-    await removeDevice();
-  }
-  signal?.throwIfAborted();
-  const current = await currentCredentials();
-  const enrolled = await enroll(
-    endpoints,
-    current,
-    name(),
-    fetchRequest
-  );
-  const bound = {
-    ...enrolled,
-    accountSubject: subjectFor(current)
-  };
-  await saveDevice(bound);
-  return bound;
-}
-async function reenrollRejectedDevice(endpoints, dependencies = {}, signal) {
-  const remove = dependencies.deleteDeviceCredential ?? deleteDeviceCredential;
-  await remove();
-  return await deviceForSession(endpoints, dependencies, signal);
+  if (stored?.relayOrigin === endpoints.relayOrigin) return stored;
+  return await withPairingLease(async () => {
+    signal?.throwIfAborted();
+    const current = await loadDevice();
+    if (current?.relayOrigin === endpoints.relayOrigin) return current;
+    if (current) {
+      await revoke({ relayOrigin: current.relayOrigin }, current);
+      await removeDevice();
+    }
+    signal?.throwIfAborted();
+    const paired = await pair(endpoints, signal);
+    await saveDevice(paired);
+    return paired;
+  }, signal);
 }
 function retryMessage(retryInMs) {
   const seconds = Math.max(1, Math.ceil(retryInMs / 1e3));
@@ -52852,9 +53114,6 @@ async function connectRemoteWorker(endpoints, device, worker, options, signal, o
     await connectHintTask;
   }
 }
-function shouldRecoverRejectedDevice(error46, recoveredRejectedDevice, connected) {
-  return error46 instanceof DeviceRejectedError && !recoveredRejectedDevice && !connected;
-}
 async function runManagedSession(root, endpoints, options = {}) {
   const controller = new AbortController();
   const stop = () => controller.abort();
@@ -52869,9 +53128,9 @@ async function runManagedSession(root, endpoints, options = {}) {
   try {
     const accessProfile = options.accessProfile ?? DEFAULT_WORKER_ACCESS_PROFILE;
     const sessionOptions = { ...options, accessProfile };
-    let device = await deviceForSession(
+    const device = options.device ?? await deviceForSession(
       endpoints,
-      options.credentials ? { credentials: options.credentials } : {},
+      {},
       controller.signal
     );
     controller.signal.throwIfAborted();
@@ -52892,41 +53151,18 @@ async function runManagedSession(root, endpoints, options = {}) {
       console.error(accessProfileSummary(accessProfile));
       console.error("Press Ctrl+C to disconnect.");
     }
-    let recoveredRejectedDevice = false;
-    while (!controller.signal.aborted) {
-      let connected = false;
-      try {
-        await connectRemoteWorker(
-          endpoints,
-          device,
-          worker,
-          sessionOptions,
-          controller.signal,
-          () => {
-            connected = true;
-          }
-        );
-        break;
-      } catch (error46) {
-        if (!shouldRecoverRejectedDevice(
-          error46,
-          recoveredRejectedDevice,
-          connected
-        )) {
-          throw error46;
-        }
-        recoveredRejectedDevice = true;
-        device = await reenrollRejectedDevice(
-          endpoints,
-          options.credentials ? { credentials: options.credentials } : {},
-          controller.signal
-        );
-      }
-    }
+    await connectRemoteWorker(
+      endpoints,
+      device,
+      worker,
+      sessionOptions,
+      controller.signal,
+      () => void 0
+    );
   } catch (error46) {
     if (error46 instanceof DeviceRejectedError) {
       await deleteDeviceCredential();
-      throw new Error("The relay rejected this device. Run Glossa again to reenroll it.");
+      throw new Error("The relay rejected this paired computer. Run Glossa again to pair it with your account.");
     }
     throw error46;
   } finally {
@@ -52951,7 +53187,7 @@ function initialHudState(workspace) {
     message: void 0,
     activities: [],
     activityPage: 0,
-    view: "activity",
+    view: "workspace",
     status: void 0,
     deviceSelection: 0,
     pendingAccessProfile: void 0,
@@ -53022,12 +53258,12 @@ function formatByteCount(value) {
   }
   return `${(kibibytes / 1024).toFixed(1)} MiB`;
 }
-function workspacePath(path13) {
-  return path13 || ".";
+function workspacePath(path14) {
+  return path14 || ".";
 }
-function pathSummary(path13, details = []) {
+function pathSummary(path14, details = []) {
   return {
-    target: `path ${quoteActivityInput(path13)}`,
+    target: `path ${quoteActivityInput(path14)}`,
     details,
     truncation: "middle"
   };
@@ -53226,6 +53462,7 @@ var COLORS = {
   muted: "#aaa4b5",
   purple: "#8054ff",
   purpleReadable: "#ad98ff",
+  success: "#65d6a6",
   coral: "#ff665f",
   line: "#5c556e"
 };
@@ -53233,7 +53470,9 @@ function Text2({ color, ...props }) {
   return color === void 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { ...props }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { ...props, color });
 }
 var ACTIVITY_REFRESH_INTERVAL_MS = 1e4;
+var ACTIVITY_STATUS_COLUMN_WIDTH = 2;
 var ACTIVITY_TOOL_COLUMN_WIDTH = 15;
+var ACTIVITY_AGE_COLUMN_WIDTH = 10;
 var ACTIVITY_PREAMBLE_LINES = 1;
 var HudStore = class {
   #state;
@@ -53279,10 +53518,10 @@ function activityAge(updatedAt, working, now) {
   if (elapsedMs < 864e5) return `${Math.floor(elapsedMs / 36e5)}h ago`;
   return `${Math.floor(elapsedMs / 864e5)}d ago`;
 }
-function activityColor(activity) {
-  if (activity.state === "working") return COLORS.ink;
-  if (activity.state === "failed") return COLORS.coral;
-  return COLORS.purpleReadable;
+function activityStatus(activity) {
+  if (activity.state === "failed") return { symbol: "\xD7", tone: COLORS.coral };
+  if (activity.state === "working") return { symbol: "\u25CB", tone: COLORS.purpleReadable };
+  return { symbol: "\u2713", tone: COLORS.success };
 }
 function activitySummary(activity) {
   return [activity.summary.target, ...activity.summary.details].join(" \xB7 ");
@@ -53298,31 +53537,28 @@ function adjacentAccessProfile(accessProfile, direction) {
   const index = ACCESS_PROFILES.indexOf(accessProfile);
   return ACCESS_PROFILES[index + direction];
 }
-function AccessProfileLadder({ accessProfile, color }) {
-  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { bold: true, children: ACCESS_PROFILES.map((profile, index) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_react34.default.Fragment, { children: [
-    index > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.line : void 0, children: "  \u2500  " }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
-      Text2,
-      {
-        color: color ? profile === accessProfile ? COLORS.coral : COLORS.muted : void 0,
-        children: profile === accessProfile ? `[ ${accessProfileLabel(profile)} ]` : accessProfileLabel(profile)
-      }
-    )
-  ] }, profile)) });
-}
-function accessProfileCapability(accessProfile) {
-  if (accessProfile === "read-only") return "Read files only \xB7 no changes \xB7 no commands";
-  if (accessProfile === "workspace") return "Read + write files \xB7 commands disabled";
-  return "Read + write files + commands \xB7 inherits this OS account's permissions";
-}
-var PRIMARY_FOOTER_HINTS = [
-  { key: "A", label: "Activity" },
-  { key: "W", label: "Workspace" },
-  { key: "D", label: "Devices" },
-  { key: "?", label: "Help" },
-  { key: "L", label: "Sign out", tone: COLORS.coral },
-  { key: "Q", label: "Quit", tone: COLORS.coral }
-];
+function accessProfileCapabilities(accessProfile) {
+  if (accessProfile === "read-only") {
+    return { summary: "Read files only", detail: "No changes \xB7 no commands" };
+  }
+  if (accessProfile === "workspace") {
+    return { summary: "Read + write files", detail: "Commands disabled" };
+  }
+  return {
+    summary: "Read + write files + commands",
+    detail: "OS account permissions apply"
+  };
+}
+function primaryFooterHints() {
+  return [
+    { key: "A", label: "Activity" },
+    { key: "W", label: "Workspace" },
+    { key: "D", label: "Devices" },
+    { key: "?", label: "Help" },
+    { key: "L", label: "Account sign out", tone: COLORS.coral },
+    { key: "Q", label: "Quit", tone: COLORS.coral }
+  ];
+}
 function contextualFooterHints(state) {
   if (state.view === "activity") {
     return [
@@ -53370,7 +53606,7 @@ function splitFooterHints(hints, usable) {
   return rows;
 }
 function buildFooterRows(state, usable) {
-  const rows = splitFooterHints(PRIMARY_FOOTER_HINTS, usable).map((left) => ({
+  const rows = splitFooterHints(primaryFooterHints(), usable).map((left) => ({
     left,
     right: []
   }));
@@ -53391,7 +53627,10 @@ function promptText(state) {
   if (state.busy) return { message: "Working\u2026" };
   if (!state.prompt) return void 0;
   if (state.prompt.type === "logout") {
-    return { message: "Sign out and disconnect?", choices: "Y confirm  N cancel" };
+    return {
+      message: "Sign out the CLI account and disconnect? Computer pairing stays active.",
+      choices: "Y confirm  N cancel"
+    };
   }
   if (state.prompt.type === "access-confirm") {
     const detail = state.prompt.accessProfile === "system" ? "Commands will inherit this OS account's permissions." : "This allows guarded file writes.";
@@ -53462,7 +53701,7 @@ function Line({ usable, color }) {
 }
 function Header({ state, usable, bodyBudget, color }) {
   const statusColor = state.connection === "error" ? COLORS.coral : COLORS.purpleReadable;
-  const pageTitle = state.view === "activity" ? "Recent Activity" : state.view === "devices" ? "Devices" : state.view === "workspace" ? "Workspace" : state.view === "help" ? "Help" : void 0;
+  const pageTitle = state.view === "activity" ? "Activity" : state.view === "devices" ? "Devices" : state.view === "workspace" ? "Workspace" : state.view === "help" ? "Help" : void 0;
   const activityPage = state.view === "activity" ? activityPageInfo(state, bodyBudget) : void 0;
   const activityRange = activityPage && activityPage.maxPage > 0 ? ` (${activityPage.rangeStart}-${activityPage.rangeEnd}/${state.activities.length})` : "";
   const deviceWindow = state.view === "devices" ? deviceListWindow(state, bodyBudget, usable) : void 0;
@@ -53488,46 +53727,118 @@ function SectionTitle({ children, color, tone = COLORS.purpleReadable }) {
 function Blank() {
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, { height: 1 });
 }
-function WorkspaceView({ state, bodyBudget, color }) {
+function ActivityPreviewHeader({ usable, color }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, { width: usable, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, { flexGrow: 1, flexShrink: 1, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, children: "Activity" }) }),
+    usable >= 24 ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, { marginLeft: 1, flexShrink: 0, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { bold: true, color: color ? COLORS.purpleReadable : void 0, children: "A" }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, children: " View all" })
+    ] }) : null
+  ] });
+}
+function AccessSectionTitle({ accessProfile, usable, color }) {
+  const lower = adjacentAccessProfile(accessProfile, -1);
+  const higher = adjacentAccessProfile(accessProfile, 1);
+  const key = lower && higher ? "\u2190/\u2192" : lower ? "\u2190" : "\u2192";
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, { width: usable, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, children: "Access" }),
+    usable >= 24 ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, { marginLeft: 3, flexShrink: 0, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { bold: true, color: color ? COLORS.purpleReadable : void 0, children: key }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, children: " Switch" })
+    ] }) : null
+  ] });
+}
+function activityLayout(usable) {
+  const toolWidth = Math.min(
+    ACTIVITY_TOOL_COLUMN_WIDTH,
+    Math.max(0, usable - ACTIVITY_STATUS_COLUMN_WIDTH)
+  );
+  return {
+    toolWidth,
+    showSummary: usable >= ACTIVITY_STATUS_COLUMN_WIDTH + toolWidth + 5,
+    showAge: usable >= ACTIVITY_STATUS_COLUMN_WIDTH + toolWidth + ACTIVITY_AGE_COLUMN_WIDTH + 10
+  };
+}
+function WorkspaceView({ state, usable, bodyBudget, color, now }) {
   const displayedAccessProfile = state.pendingAccessProfile ?? state.accessProfile;
+  const showConnectionMessage = Boolean(
+    state.message && (state.connection === "retrying" || state.connection === "error")
+  );
+  let fixedLines = 3;
+  if (displayedAccessProfile) fixedLines += 5;
+  if (state.deviceName) fixedLines += 3;
+  if (showConnectionMessage) fixedLines += 2;
+  const activityCapacity = Math.min(3, Math.max(0, bodyBudget - fixedLines - 2));
+  const activityPreview = activityCapacity > 0 ? state.activities.slice(-activityCapacity) : [];
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, { height: bodyBudget, flexDirection: "column", flexShrink: 0, overflow: "hidden", children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, children: "Workspace" }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.ink : void 0, wrap: "truncate-middle", children: state.workspace }),
     displayedAccessProfile ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, children: "Access" }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AccessProfileLadder, { accessProfile: displayedAccessProfile, color }),
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, wrap: "truncate", children: accessProfileCapability(displayedAccessProfile) })
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        AccessSectionTitle,
+        {
+          accessProfile: displayedAccessProfile,
+          usable,
+          color
+        }
+      ),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { bold: true, color: color ? COLORS.ink : void 0, wrap: "truncate", children: accessProfileLabel(displayedAccessProfile) }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, wrap: "truncate", children: accessProfileCapabilities(displayedAccessProfile).summary }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, wrap: "truncate", children: accessProfileCapabilities(displayedAccessProfile).detail })
     ] }) : null,
     state.deviceName ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, children: "Device" }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.ink : void 0, wrap: "truncate", children: state.deviceName })
     ] }) : null,
-    state.message && (state.connection === "retrying" || state.connection === "error") ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+    activityCapacity > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ActivityPreviewHeader, { usable, color }),
+      state.activities.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, children: "No activity yet." }) : activityPreview.map((activity) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        ActivityRow,
+        {
+          activity,
+          usable,
+          color,
+          now
+        },
+        activity.requestId
+      ))
+    ] }) : null,
+    showConnectionMessage ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.coral : void 0, wrap: "truncate", children: state.message })
     ] }) : null
   ] });
 }
 function ActivityRow({ activity, usable, color, now }) {
-  const toolWidth = Math.min(ACTIVITY_TOOL_COLUMN_WIDTH, usable);
+  const { toolWidth, showSummary, showAge } = activityLayout(usable);
   const age = activityAge(activity.updatedAt, activity.state === "working", now);
-  const showAge = usable >= toolWidth + age.length + 10;
-  const showSummary = usable >= toolWidth + 5;
+  const status = activityStatus(activity);
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, { width: usable, height: 1, flexShrink: 0, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, { width: ACTIVITY_STATUS_COLUMN_WIDTH, flexShrink: 0, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { bold: true, color: color ? status.tone : void 0, children: status.symbol }) }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, { width: toolWidth, flexShrink: 0, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
       Text2,
       {
         bold: true,
-        color: color ? activityColor(activity) : void 0,
+        color: color ? COLORS.ink : void 0,
         wrap: "truncate",
         children: activity.tool
       }
     ) }),
     showSummary ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, { marginLeft: 2, flexGrow: 1, flexShrink: 1, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, wrap: "truncate-middle", children: activitySummary(activity) }) }) : null,
-    showAge ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, { marginLeft: 2, flexShrink: 0, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, children: age }) }) : null
+    showAge ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+      Box_default,
+      {
+        width: ACTIVITY_AGE_COLUMN_WIDTH,
+        marginLeft: 2,
+        flexShrink: 0,
+        justifyContent: "flex-end",
+        children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, children: age })
+      }
+    ) : null
   ] });
 }
 function ActivityView({ state, usable, bodyBudget, color, now }) {
@@ -53662,12 +53973,12 @@ function HelpView({ bodyBudget, color }) {
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "W", label: "Workspace", color }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "D", label: "Devices", color }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "?", label: "Help", color }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "Esc", label: "Activity", color }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "Esc", label: "Workspace", color }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, tone: COLORS.coral, children: "Manage" }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "\u2190/\u2192", label: "Change workspace access", color, tone: COLORS.coral }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "Enter/R", label: "Revoke selected device", color, tone: COLORS.coral }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "L", label: "Sign out", color, tone: COLORS.coral }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "L", label: "Account sign out", color, tone: COLORS.coral }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, children: "App" }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "Q", label: "Disconnect and quit", color, tone: COLORS.coral }),
@@ -53741,7 +54052,16 @@ function HudScreen({ state, columns, rows, color = true, now = Date.now() }) {
         bodyBudget: metrics.bodyBudget,
         color
       }
-    ) : state.view === "workspace" ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(WorkspaceView, { state, bodyBudget: metrics.bodyBudget, color }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpView, { bodyBudget: metrics.bodyBudget, color }),
+    ) : state.view === "workspace" ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+      WorkspaceView,
+      {
+        state,
+        usable: metrics.usable,
+        bodyBudget: metrics.bodyBudget,
+        color,
+        now
+      }
+    ) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpView, { bodyBudget: metrics.bodyBudget, color }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Overlay, { state, usable: metrics.usable, color }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Footer, { rows: metrics.footerRows, usable: metrics.usable, color })
   ] });
@@ -53802,7 +54122,7 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
   const { columns, rows } = use_window_size_default();
   const [, setClock] = (0, import_react34.useState)(0);
   (0, import_react34.useEffect)(() => {
-    if (state.view !== "activity" || state.activities.length === 0) return;
+    if (state.view !== "activity" && state.view !== "workspace" || state.activities.length === 0) return;
     const timer = setInterval(() => setClock((value) => value + 1), ACTIVITY_REFRESH_INTERVAL_MS);
     return () => clearInterval(timer);
   }, [state.view, state.activities.length]);
@@ -53914,7 +54234,7 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
       return;
     }
     if (key.escape) {
-      store3.update((state2) => ({ ...state2, view: "activity", notice: void 0 }));
+      store3.update((state2) => ({ ...state2, view: "workspace", notice: void 0 }));
       return;
     }
     if (value === "a") {
@@ -54061,119 +54381,8 @@ async function runSessionHud(actions, input = process.stdin, output = process.st
 var import_semver = __toESM(require_semver2(), 1);
 import { spawn as spawn3 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { chmod as chmod3, readdir as readdir2, rename as rename2, rm as rm4, writeFile as writeFile5 } from "node:fs/promises";
-import path8 from "node:path";
-
-// src/update-lock.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
-import { mkdir as mkdir4, readdir, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";
-import path7 from "node:path";
-var UPDATE_SUFFIX = ".update";
-var SESSION_SUFFIX = ".session";
-function updateRuntimeDirectory() {
-  return path7.join(configDirectory(), "runtime");
-}
-function processIsAlive(pid) {
-  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error46) {
-    return error46.code === "EPERM";
-  }
-}
-function leasePid(name, suffix) {
-  if (!name.endsWith(suffix)) return null;
-  const separator = name.indexOf("-");
-  if (separator <= 0) return null;
-  const pid = Number(name.slice(0, separator));
-  return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
-}
-async function activeLeaseFiles(directory, suffix) {
-  let entries;
-  try {
-    entries = await readdir(directory, { withFileTypes: true });
-  } catch (error46) {
-    if (error46.code === "ENOENT") return [];
-    throw error46;
-  }
-  const active = [];
-  for (const entry of entries) {
-    if (!entry.isFile() || !entry.name.endsWith(suffix)) continue;
-    const pid = leasePid(entry.name, suffix);
-    const file2 = path7.join(directory, entry.name);
-    if (pid !== null && processIsAlive(pid)) active.push(file2);
-    else await rm3(file2, { force: true });
-  }
-  return active;
-}
-async function updateLockIsActive(directory) {
-  return (await activeLeaseFiles(directory, UPDATE_SUFFIX)).length > 0;
-}
-async function activeSessionFiles(directory) {
-  return await activeLeaseFiles(directory, SESSION_SUFFIX);
-}
-async function createUpdateLock(directory) {
-  await mkdir4(directory, { recursive: true, mode: 448 });
-  const lockFile = path7.join(
-    directory,
-    `${process.pid}-${randomUUID4()}${UPDATE_SUFFIX}`
-  );
-  const content = `${JSON.stringify({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() })}
-`;
-  await writeFile4(lockFile, content, {
-    encoding: "utf8",
-    flag: "wx",
-    mode: 384
-  });
-  try {
-    const contenders = await activeLeaseFiles(directory, UPDATE_SUFFIX);
-    if (contenders.some((file2) => file2 !== lockFile)) {
-      throw new Error("Another Glossa update is already running.");
-    }
-    return lockFile;
-  } catch (error46) {
-    await rm3(lockFile, { force: true });
-    throw error46;
-  }
-}
-async function withUpdateLease(action, directory = updateRuntimeDirectory()) {
-  const lockFile = await createUpdateLock(directory);
-  try {
-    if ((await activeSessionFiles(directory)).length > 0) {
-      throw new Error("Disconnect every running Glossa workspace before updating.");
-    }
-    return await action();
-  } finally {
-    await rm3(lockFile, { force: true });
-  }
-}
-async function withWorkspaceLease(action, directory = updateRuntimeDirectory()) {
-  await mkdir4(directory, { recursive: true, mode: 448 });
-  if (await updateLockIsActive(directory)) {
-    throw new Error("Glossa is updating. Run this workspace again after the update finishes.");
-  }
-  const leaseFile = path7.join(
-    directory,
-    `${process.pid}-${randomUUID4()}${SESSION_SUFFIX}`
-  );
-  await writeFile4(
-    leaseFile,
-    `${JSON.stringify({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() })}
-`,
-    { encoding: "utf8", flag: "wx", mode: 384 }
-  );
-  try {
-    if (await updateLockIsActive(directory)) {
-      throw new Error("Glossa is updating. Run this workspace again after the update finishes.");
-    }
-    return await action();
-  } finally {
-    await rm3(leaseFile, { force: true });
-  }
-}
-
-// src/update-service.ts
+import { chmod as chmod3, readdir as readdir2, rename as rename2, rm as rm5, writeFile as writeFile6 } from "node:fs/promises";
+import path9 from "node:path";
 var PACKAGE_NAME = "@ariobarin/glossa";
 var DEFAULT_REGISTRY_URL = "https://registry.npmjs.org/@ariobarin%2Fglossa";
 var DEFAULT_RELEASE_BASE_URL = "https://github.com/ariobarin/glossa/releases/download";
@@ -54250,8 +54459,8 @@ async function cleanupUpdateBackups(distribution, options = {}) {
   const platform2 = options.platform ?? process.platform;
   if (distribution !== "standalone" || platform2 !== "win32") return;
   const executable = options.executablePath ?? process.execPath;
-  const directory = path8.dirname(executable);
-  const prefix = `${path8.basename(executable)}.old-`;
+  const directory = path9.dirname(executable);
+  const prefix = `${path9.basename(executable)}.old-`;
   let entries;
   try {
     entries = await readdir2(directory, { withFileTypes: true });
@@ -54264,7 +54473,7 @@ async function cleanupUpdateBackups(distribution, options = {}) {
       const ownerPid = backupOwnerPid(entry.name, prefix);
       return ownerPid !== null && !processIsAlive(ownerPid);
     }).map(async (entry) => {
-      await rm4(path8.join(directory, entry.name), { force: true }).catch(() => void 0);
+      await rm5(path9.join(directory, entry.name), { force: true }).catch(() => void 0);
     })
   );
 }
@@ -54340,12 +54549,12 @@ async function installStandaloneUpdate(info, options) {
   if (actual !== expected) {
     throw new Error("Glossa refused to update because the SHA-256 checksum did not match.");
   }
-  const download = path8.join(
-    path8.dirname(destination),
-    `${path8.basename(destination)}.download-${process.pid}`
+  const download = path9.join(
+    path9.dirname(destination),
+    `${path9.basename(destination)}.download-${process.pid}`
   );
   try {
-    await writeFile5(download, binary, { mode: 493 });
+    await writeFile6(download, binary, { mode: 493 });
     if (platform2 === "win32") {
       await replaceWindowsExecutable(download, destination);
     } else {
@@ -54354,7 +54563,7 @@ async function installStandaloneUpdate(info, options) {
     }
     return "installed";
   } catch (error46) {
-    await rm4(download, { force: true });
+    await rm5(download, { force: true });
     throw error46;
   }
 }
@@ -54368,14 +54577,14 @@ async function installUpdate(info, distribution, options = {}) {
 }
 
 // src/update-state.ts
-import { chmod as chmod4, mkdir as mkdir5, readFile as readFile4, rename as rename3, rm as rm5, writeFile as writeFile6 } from "node:fs/promises";
-import path9 from "node:path";
+import { chmod as chmod4, mkdir as mkdir6, readFile as readFile5, rename as rename3, rm as rm6, writeFile as writeFile7 } from "node:fs/promises";
+import path10 from "node:path";
 var UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 function defaultUpdateChannel(version2) {
   return version2.includes("-") ? "beta" : "stable";
 }
 function updateStateFile() {
-  return path9.join(configDirectory(), "updates.json");
+  return path10.join(configDirectory(), "updates.json");
 }
 function isPolicy(value) {
   return value === "notify" || value === "auto" || value === "off";
@@ -54392,7 +54601,7 @@ async function loadUpdateState(currentVersion, file2 = updateStateFile()) {
     channel: defaultUpdateChannel(currentVersion)
   };
   try {
-    const parsed = JSON.parse(await readFile4(file2, "utf8"));
+    const parsed = JSON.parse(await readFile5(file2, "utf8"));
     const lastCheckedAt = optionalString(parsed.lastCheckedAt);
     const latestVersion = optionalString(parsed.latestVersion);
     return {
@@ -54409,11 +54618,11 @@ async function loadUpdateState(currentVersion, file2 = updateStateFile()) {
   }
 }
 async function saveUpdateState(state, file2 = updateStateFile()) {
-  const directory = path9.dirname(file2);
+  const directory = path10.dirname(file2);
   const temporary = `${file2}.${process.pid}.tmp`;
-  await mkdir5(directory, { recursive: true, mode: 448 });
+  await mkdir6(directory, { recursive: true, mode: 448 });
   try {
-    await writeFile6(temporary, `${JSON.stringify(state, null, 2)}
+    await writeFile7(temporary, `${JSON.stringify(state, null, 2)}
 `, {
       encoding: "utf8",
       mode: 384
@@ -54421,7 +54630,7 @@ async function saveUpdateState(state, file2 = updateStateFile()) {
     if (process.platform !== "win32") await chmod4(temporary, 384);
     await rename3(temporary, file2);
   } finally {
-    await rm5(temporary, { force: true });
+    await rm6(temporary, { force: true });
   }
 }
 async function configureUpdates(currentVersion, changes, file2 = updateStateFile()) {
@@ -54448,15 +54657,31 @@ function isUpdateCheckDue(lastCheckedAt, now = Date.now()) {
   return !Number.isFinite(checkedAt) || now - checkedAt >= UPDATE_CHECK_INTERVAL_MS;
 }
 
+// src/unpair.ts
+async function unpairComputer(dependencies = {}) {
+  const load = dependencies.loadDeviceCredential ?? loadDeviceCredential;
+  const remove = dependencies.deleteDeviceCredential ?? deleteDeviceCredential;
+  const revoke = dependencies.revokePairedDevice ?? revokePairedDevice;
+  const log = dependencies.log ?? console.log;
+  const device = await load();
+  if (!device) {
+    log("This computer is not paired with Glossa.");
+    return;
+  }
+  await revoke({ relayOrigin: device.relayOrigin }, device);
+  await remove();
+  log("Unpaired this computer from Glossa.");
+}
+
 // src/usage-store.ts
-import { appendFile, chmod as chmod5, mkdir as mkdir6, readFile as readFile5 } from "node:fs/promises";
-import path10 from "node:path";
+import { appendFile, chmod as chmod5, mkdir as mkdir7, readFile as readFile6 } from "node:fs/promises";
+import path11 from "node:path";
 function usageFile() {
-  return path10.join(configDirectory(), "usage.jsonl");
+  return path11.join(configDirectory(), "usage.jsonl");
 }
 async function recordUsageEvent(event, file2 = usageFile()) {
-  const directory = path10.dirname(file2);
-  await mkdir6(directory, { recursive: true, mode: 448 });
+  const directory = path11.dirname(file2);
+  await mkdir7(directory, { recursive: true, mode: 448 });
   await appendFile(file2, `${JSON.stringify(event)}
 `, {
     encoding: "utf8",
@@ -54474,15 +54699,15 @@ async function recordToolUsage(tool, ok, at = /* @__PURE__ */ new Date(), file2
 // src/worker/root-selection.ts
 import { realpath as realpath2 } from "node:fs/promises";
 import os6 from "node:os";
-import path11 from "node:path";
+import path12 from "node:path";
 function containsPath(root, candidate) {
-  const relative = path11.relative(root, candidate);
-  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path11.sep}`) && !path11.isAbsolute(relative);
+  const relative = path12.relative(root, candidate);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path12.sep}`) && !path12.isAbsolute(relative);
 }
 async function rejectImplicitHomeAncestor(root) {
   const homes = await Promise.all(
     [os6.homedir(), accountHomeDirectory()].map(
-      async (home) => await realpath2(home).catch(() => path11.resolve(home))
+      async (home) => await realpath2(home).catch(() => path12.resolve(home))
     )
   );
   if (homes.some((home) => containsPath(root, home))) {
@@ -54500,10 +54725,10 @@ async function selectExposureRoot(explicitPath, cwd2 = process.cwd()) {
 
 // src/worker/workspace-lease.ts
 import { createHash as createHash3 } from "node:crypto";
-import { lstat as lstat3, mkdir as mkdir7, rm as rm6, stat as stat3 } from "node:fs/promises";
+import { lstat as lstat3, mkdir as mkdir8, rm as rm7, stat as stat4 } from "node:fs/promises";
 import net from "node:net";
-import path12 from "node:path";
-import { setTimeout as delay3 } from "node:timers/promises";
+import path13 from "node:path";
+import { setTimeout as delay4 } from "node:timers/promises";
 var GUARD_STALE_MS = 5e3;
 var GUARD_RETRY_MS = 10;
 var GUARD_TIMEOUT_MS = 1e4;
@@ -54526,12 +54751,12 @@ function workspaceIdentity(root) {
 }
 function defaultLeaseDirectory() {
   if (typeof process.getuid === "function") {
-    return path12.join("/tmp", `glossa-workspaces-${process.getuid()}`);
+    return path13.join("/tmp", `glossa-workspaces-${process.getuid()}`);
   }
-  return path12.join(accountHomeDirectory(), ".glossa-workspace-leases");
+  return path13.join(accountHomeDirectory(), ".glossa-workspace-leases");
 }
 async function ensureLeaseDirectory(directory) {
-  await mkdir7(directory, { recursive: true, mode: 448 });
+  await mkdir8(directory, { recursive: true, mode: 448 });
   const directoryStat = await lstat3(directory);
   if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory()) {
     throw new Error("The Glossa workspace lease location is not a private directory.");
@@ -54548,26 +54773,26 @@ function endpointFor(identity, directory) {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\glossa-workspace-${identity}`;
   }
-  return path12.join(directory, `${identity}.sock`);
+  return path13.join(directory, `${identity}.sock`);
 }
-async function acquireGuard(directory, identity) {
-  const guard = path12.join(directory, `${identity}.guard`);
+async function acquireGuard2(directory, identity) {
+  const guard = path13.join(directory, `${identity}.guard`);
   const deadline = Date.now() + GUARD_TIMEOUT_MS;
   while (true) {
     try {
-      await mkdir7(guard, { mode: 448 });
-      return async () => await rm6(guard, { recursive: true, force: true });
+      await mkdir8(guard, { mode: 448 });
+      return async () => await rm7(guard, { recursive: true, force: true });
     } catch (error46) {
       if (error46.code !== "EEXIST") throw error46;
       let stale = false;
       try {
-        stale = Date.now() - (await stat3(guard)).mtimeMs >= GUARD_STALE_MS;
+        stale = Date.now() - (await stat4(guard)).mtimeMs >= GUARD_STALE_MS;
       } catch (statError) {
         if (statError.code === "ENOENT") continue;
         throw statError;
       }
       if (stale) {
-        await rm6(guard, { recursive: true, force: true });
+        await rm7(guard, { recursive: true, force: true });
         continue;
       }
       if (Date.now() >= deadline) {
@@ -54575,7 +54800,7 @@ async function acquireGuard(directory, identity) {
           "Timed out while checking whether this workspace is already active."
         );
       }
-      await delay3(GUARD_RETRY_MS);
+      await delay4(GUARD_RETRY_MS);
     }
   }
 }
@@ -54623,7 +54848,7 @@ async function acquireWorkspaceLease(root, options = {}) {
   await ensureLeaseDirectory(userDirectory);
   const identity = workspaceIdentity(root);
   const endpoint3 = endpointFor(identity, userDirectory);
-  const releaseGuard = await acquireGuard(userDirectory, identity);
+  const releaseGuard = await acquireGuard2(userDirectory, identity);
   let server;
   try {
     for (let attempt = 0; attempt < 2; attempt += 1) {
@@ -54637,11 +54862,11 @@ async function acquireWorkspaceLease(root, options = {}) {
             if (released) return;
             released = true;
             await ensureLeaseDirectory(userDirectory);
-            const releaseGuard2 = await acquireGuard(userDirectory, identity);
+            const releaseGuard2 = await acquireGuard2(userDirectory, identity);
             try {
               await closeServer(server);
               if (process.platform !== "win32") {
-                await rm6(endpoint3, { force: true });
+                await rm7(endpoint3, { force: true });
               }
             } finally {
               await releaseGuard2();
@@ -54654,7 +54879,7 @@ async function acquireWorkspaceLease(root, options = {}) {
           throw new WorkspaceAlreadyActiveError();
         }
         if (error46.code !== "EADDRINUSE") throw error46;
-        if (process.platform !== "win32") await rm6(endpoint3, { force: true });
+        if (process.platform !== "win32") await rm7(endpoint3, { force: true });
       }
     }
     throw new Error("Could not reserve this workspace for the current Glossa process.");
@@ -54664,7 +54889,7 @@ async function acquireWorkspaceLease(root, options = {}) {
 }
 
 // src/main.ts
-var VERSION = "0.2.0-beta.2";
+var VERSION = "0.2.1";
 var DISTRIBUTION = "npm";
 var HELP = `Glossa ${VERSION}
 
@@ -54673,6 +54898,7 @@ Usage:
   glossa status
   glossa devices revoke <id>
   glossa logout
+  glossa unpair
   glossa update [--check]
   glossa update --policy <notify|auto|off>
   glossa update --channel <beta|stable>
@@ -54692,8 +54918,8 @@ Keys:
   \u2191\u2193 select or browse
   \u2190\u2192 change workspace access
   Enter/r  revoke selected device
-  Esc  activity
-  l  sign out
+  Esc  workspace
+  l  account sign out
   ?  help
   q  disconnect and quit`;
 async function withLoginSignal(action) {
@@ -54740,8 +54966,8 @@ async function revokeKnownDevice(deviceId) {
   const credentials = await authenticatedCredentials();
   await revokeDevice(loadRelayEndpoints(), credentials, deviceId);
 }
-async function runWorkspaceSession(path13, label, accessProfile) {
-  const root = await selectExposureRoot(path13);
+async function runWorkspaceSession(path14, label, accessProfile) {
+  const root = await selectExposureRoot(path14);
   const lease = await acquireWorkspaceLease(root);
   let usageWrites = Promise.resolve();
   const queueUsage = (write) => {
@@ -54749,8 +54975,7 @@ async function runWorkspaceSession(path13, label, accessProfile) {
   };
   try {
     const endpoints = loadRelayEndpoints();
-    let credentials = (await authenticatedSession()).credentials;
-    const statusService = new WorkspaceStatusService(credentials, endpoints);
+    const device = await deviceForSession(endpoints);
     let postExitNotice;
     let requestedAccessProfile = accessProfile;
     let activeSessionController;
@@ -54768,7 +54993,7 @@ async function runWorkspaceSession(path13, label, accessProfile) {
           else signal.addEventListener("abort", stopSession, { once: true });
           try {
             await runManagedSession(root, endpoints, {
-              credentials,
+              device,
               workerVersion: VERSION,
               accessProfile: sessionAccessProfile,
               ...label ? { workspaceLabel: label } : {},
@@ -54799,10 +55024,13 @@ async function runWorkspaceSession(path13, label, accessProfile) {
         }
       },
       loadStatus: async (signal) => {
-        return hudStatus(await statusService.refresh(signal));
+        const credentials = await authenticatedCredentials(signal);
+        return hudStatus(
+          await new WorkspaceStatusService(credentials, endpoints).refresh(signal)
+        );
       },
       revokeDevice: async (deviceId, signal) => {
-        credentials = await validCredentials(credentials, { signal });
+        const credentials = await authenticatedCredentials(signal);
         await revokeDevice(
           endpoints,
           credentials,
@@ -54823,9 +55051,9 @@ async function runWorkspaceSession(path13, label, accessProfile) {
     await lease.release();
   }
 }
-async function runWorkspace(path13, label, accessProfile) {
+async function runWorkspace(path14, label, accessProfile) {
   await withWorkspaceLease(
-    async () => await runWorkspaceSession(path13, label, accessProfile)
+    async () => await runWorkspaceSession(path14, label, accessProfile)
   );
 }
 async function refreshUpdateInfo(timeoutMs) {
@@ -54928,6 +55156,8 @@ async function main() {
     await showStatus();
   } else if (invocation.command === "logout") {
     await logoutFromGlossa();
+  } else if (invocation.command === "unpair") {
+    await unpairComputer();
   } else if (invocation.command === "update") {
     await runUpdateCommand(invocation);
   } else {