@ariobarin/glossa 0.2.1 → 0.2.3-beta.1

package/dist/app.js

@@ -10436,10 +10436,10 @@ var require_react_reconciler_development = __commonJS({
           fiber = fiber.next, id--;
         return fiber;
       }
-      function copyWithSetImpl(obj, path14, index, value) {
-        if (index >= path14.length) return value;
-        var key = path14[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
-        updated[key] = copyWithSetImpl(obj[key], path14, index + 1, value);
+      function copyWithSetImpl(obj, path12, index, value) {
+        if (index >= path12.length) return value;
+        var key = path12[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
+        updated[key] = copyWithSetImpl(obj[key], path12, index + 1, value);
         return updated;
       }
       function copyWithRename(obj, oldPath, newPath) {
@@ -10466,11 +10466,11 @@ var require_react_reconciler_development = __commonJS({
         );
         return updated;
       }
-      function copyWithDeleteImpl(obj, path14, index) {
-        var key = path14[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
-        if (index + 1 === path14.length)
+      function copyWithDeleteImpl(obj, path12, index) {
+        var key = path12[index], updated = isArrayImpl(obj) ? obj.slice() : assign({}, obj);
+        if (index + 1 === path12.length)
           return isArrayImpl(updated) ? updated.splice(key, 1) : delete updated[key], updated;
-        updated[key] = copyWithDeleteImpl(obj[key], path14, index + 1);
+        updated[key] = copyWithDeleteImpl(obj[key], path12, index + 1);
         return updated;
       }
       function shouldSuspendImpl() {
@@ -23747,29 +23747,29 @@ var require_react_reconciler_development = __commonJS({
       var didWarnAboutNestedUpdates = false;
       var didWarnAboutFindNodeInStrictMode = {};
       var overrideHookState = null, overrideHookStateDeletePath = null, overrideHookStateRenamePath = null, overrideProps = null, overridePropsDeletePath = null, overridePropsRenamePath = null, scheduleUpdate = null, scheduleRetry = null, setErrorHandler = null, setSuspenseHandler = null;
-      overrideHookState = function(fiber, id, path14, value) {
+      overrideHookState = function(fiber, id, path12, value) {
         id = findHook(fiber, id);
-        null !== id && (path14 = copyWithSetImpl(id.memoizedState, path14, 0, value), id.memoizedState = path14, id.baseState = path14, fiber.memoizedProps = assign({}, fiber.memoizedProps), path14 = enqueueConcurrentRenderForLane(fiber, 2), null !== path14 && scheduleUpdateOnFiber(path14, fiber, 2));
+        null !== id && (path12 = copyWithSetImpl(id.memoizedState, path12, 0, value), id.memoizedState = path12, id.baseState = path12, fiber.memoizedProps = assign({}, fiber.memoizedProps), path12 = enqueueConcurrentRenderForLane(fiber, 2), null !== path12 && scheduleUpdateOnFiber(path12, fiber, 2));
       };
-      overrideHookStateDeletePath = function(fiber, id, path14) {
+      overrideHookStateDeletePath = function(fiber, id, path12) {
         id = findHook(fiber, id);
-        null !== id && (path14 = copyWithDeleteImpl(id.memoizedState, path14, 0), id.memoizedState = path14, id.baseState = path14, fiber.memoizedProps = assign({}, fiber.memoizedProps), path14 = enqueueConcurrentRenderForLane(fiber, 2), null !== path14 && scheduleUpdateOnFiber(path14, fiber, 2));
+        null !== id && (path12 = copyWithDeleteImpl(id.memoizedState, path12, 0), id.memoizedState = path12, id.baseState = path12, fiber.memoizedProps = assign({}, fiber.memoizedProps), path12 = enqueueConcurrentRenderForLane(fiber, 2), null !== path12 && scheduleUpdateOnFiber(path12, fiber, 2));
       };
       overrideHookStateRenamePath = function(fiber, id, oldPath, newPath) {
         id = findHook(fiber, id);
         null !== id && (oldPath = copyWithRename(id.memoizedState, oldPath, newPath), id.memoizedState = oldPath, id.baseState = oldPath, fiber.memoizedProps = assign({}, fiber.memoizedProps), oldPath = enqueueConcurrentRenderForLane(fiber, 2), null !== oldPath && scheduleUpdateOnFiber(oldPath, fiber, 2));
       };
-      overrideProps = function(fiber, path14, value) {
-        fiber.pendingProps = copyWithSetImpl(fiber.memoizedProps, path14, 0, value);
+      overrideProps = function(fiber, path12, value) {
+        fiber.pendingProps = copyWithSetImpl(fiber.memoizedProps, path12, 0, value);
         fiber.alternate && (fiber.alternate.pendingProps = fiber.pendingProps);
-        path14 = enqueueConcurrentRenderForLane(fiber, 2);
-        null !== path14 && scheduleUpdateOnFiber(path14, fiber, 2);
+        path12 = enqueueConcurrentRenderForLane(fiber, 2);
+        null !== path12 && scheduleUpdateOnFiber(path12, fiber, 2);
       };
-      overridePropsDeletePath = function(fiber, path14) {
-        fiber.pendingProps = copyWithDeleteImpl(fiber.memoizedProps, path14, 0);
+      overridePropsDeletePath = function(fiber, path12) {
+        fiber.pendingProps = copyWithDeleteImpl(fiber.memoizedProps, path12, 0);
         fiber.alternate && (fiber.alternate.pendingProps = fiber.pendingProps);
-        path14 = enqueueConcurrentRenderForLane(fiber, 2);
-        null !== path14 && scheduleUpdateOnFiber(path14, fiber, 2);
+        path12 = enqueueConcurrentRenderForLane(fiber, 2);
+        null !== path12 && scheduleUpdateOnFiber(path12, fiber, 2);
       };
       overridePropsRenamePath = function(fiber, oldPath, newPath) {
         fiber.pendingProps = copyWithRename(
@@ -26745,536 +26745,6 @@ var require_semver2 = __commonJS({
   }
 });
 
-// src/auth-config.ts
-var DEFAULT_AUTH_CONFIG = {
-  issuer: "https://dev-fl2h5xhp6umeh74m.us.auth0.com/",
-  clientId: "9mwnK9nTAd8q1kxnKIZxC1wodxzfWHg5",
-  audience: "https://mcp.glossa.sh/",
-  scope: "openid profile offline_access glossa:device"
-};
-function configuredValue(environment, name, fallback) {
-  const value = environment[name]?.trim();
-  return value || fallback;
-}
-function loadAuthConfig(environment = process.env) {
-  return {
-    issuer: configuredValue(environment, "GLOSSA_AUTH0_ISSUER", DEFAULT_AUTH_CONFIG.issuer),
-    clientId: configuredValue(
-      environment,
-      "GLOSSA_AUTH0_CLI_CLIENT_ID",
-      DEFAULT_AUTH_CONFIG.clientId
-    ),
-    audience: configuredValue(
-      environment,
-      "GLOSSA_AUTH0_AUDIENCE",
-      DEFAULT_AUTH_CONFIG.audience
-    ),
-    scope: DEFAULT_AUTH_CONFIG.scope
-  };
-}
-
-// src/config-store.ts
-import path2 from "node:path";
-
-// src/secure-store.ts
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-var KEYRING_SERVICE = "Glossa";
-function configDirectory() {
-  if (process.platform === "win32") {
-    return path.join(process.env.APPDATA ?? os.homedir(), "Glossa");
-  }
-  return path.join(
-    process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), ".config"),
-    "glossa"
-  );
-}
-var SecureStore = class {
-  #options;
-  #warned = false;
-  constructor(options) {
-    this.#options = options;
-  }
-  async save(value) {
-    const serialized = JSON.stringify(value);
-    const entry = await this.#entry();
-    if (entry) {
-      try {
-        await this.#writeEntry(entry, serialized);
-        await rm(this.#options.file, { force: true });
-        return "keyring";
-      } catch {
-      }
-    }
-    this.#warn();
-    await mkdir(path.dirname(this.#options.file), {
-      recursive: true,
-      mode: 448
-    });
-    await writeFile(
-      this.#options.file,
-      `${JSON.stringify(value, null, 2)}
-`,
-      { encoding: "utf8", mode: 384 }
-    );
-    if (process.platform !== "win32") {
-      await chmod(this.#options.file, 384);
-    }
-    return "file";
-  }
-  async load() {
-    const entry = await this.#entry();
-    if (entry) {
-      const value2 = await this.#readEntry(entry, true);
-      if (value2 != null) return { value: value2, backend: "keyring" };
-    }
-    let value;
-    try {
-      value = this.#options.parse(await readFile(this.#options.file, "utf8"));
-    } catch (error46) {
-      if (error46.code === "ENOENT") return null;
-      throw error46;
-    }
-    if (entry) {
-      try {
-        await this.#writeEntry(entry, JSON.stringify(value));
-        await rm(this.#options.file, { force: true });
-        return { value, backend: "keyring" };
-      } catch {
-      }
-    }
-    this.#warn();
-    return { value, backend: "file" };
-  }
-  async peek() {
-    const entry = await this.#entry();
-    if (entry) {
-      const value = await this.#readEntry(entry, false);
-      if (value != null) return { value, backend: "keyring" };
-    }
-    try {
-      return {
-        value: this.#options.parse(await readFile(this.#options.file, "utf8")),
-        backend: "file"
-      };
-    } catch (error46) {
-      if (error46.code === "ENOENT") return null;
-      throw error46;
-    }
-  }
-  async delete() {
-    const entry = await this.#entry();
-    let keyringDeleteFailed = false;
-    if (entry) {
-      try {
-        const deleted = await entry.deleteCredential();
-        if (!deleted && await entry.getSecret() != null) {
-          keyringDeleteFailed = true;
-        }
-      } catch {
-        keyringDeleteFailed = true;
-      }
-    }
-    await rm(this.#options.file, { force: true });
-    if (keyringDeleteFailed) {
-      throw new Error(
-        "The operating-system credential store could not remove the Glossa credential."
-      );
-    }
-  }
-  async #entry() {
-    if (this.#options.entryProvider) {
-      try {
-        return await this.#options.entryProvider();
-      } catch {
-        return null;
-      }
-    }
-    try {
-      const { AsyncEntry } = await import("@napi-rs/keyring");
-      return new AsyncEntry(KEYRING_SERVICE, this.#options.account);
-    } catch {
-      return null;
-    }
-  }
-  async #readEntry(entry, migrateLegacy) {
-    let found = false;
-    try {
-      const secret = await entry.getSecret();
-      if (secret != null) {
-        found = true;
-        try {
-          const bytes = secret instanceof Uint8Array ? secret : Uint8Array.from(secret);
-          return this.#options.parse(
-            new TextDecoder("utf-8", { fatal: true }).decode(bytes)
-          );
-        } catch {
-        }
-      }
-    } catch {
-    }
-    try {
-      const serialized = await entry.getPassword();
-      if (serialized != null) {
-        found = true;
-        const value = this.#options.parse(serialized);
-        if (migrateLegacy) {
-          try {
-            await this.#writeEntry(entry, serialized);
-          } catch {
-          }
-        }
-        return value;
-      }
-    } catch {
-    }
-    if (found && migrateLegacy) {
-      try {
-        await entry.deleteCredential();
-      } catch {
-      }
-    }
-    return null;
-  }
-  async #writeEntry(entry, serialized) {
-    await entry.setSecret(new TextEncoder().encode(serialized));
-  }
-  #warn() {
-    if (this.#warned) return;
-    this.#warned = true;
-    (this.#options.warn ?? console.warn)(this.#options.warning);
-  }
-};
-
-// src/config-store.ts
-var FILE_CREDENTIAL_WARNING = "Warning: the operating-system credential store is unavailable. Glossa is using a mode-0600 credential file.";
-function parseCredentials(value) {
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    throw new Error("Stored Glossa credentials are invalid.");
-  }
-  if (typeof parsed.issuer !== "string" || typeof parsed.clientId !== "string" || typeof parsed.audience !== "string" || typeof parsed.accessToken !== "string" || typeof parsed.expiresAt !== "string" || !Number.isFinite(Date.parse(parsed.expiresAt)) || typeof parsed.tokenType !== "string" || parsed.refreshToken !== void 0 && typeof parsed.refreshToken !== "string" || parsed.scope !== void 0 && typeof parsed.scope !== "string" || parsed.requestedScope !== void 0 && typeof parsed.requestedScope !== "string") {
-    throw new Error("Stored Glossa credentials are invalid.");
-  }
-  return parsed;
-}
-var store = new SecureStore({
-  account: "oauth",
-  file: path2.join(configDirectory(), "credentials.json"),
-  warning: FILE_CREDENTIAL_WARNING,
-  parse: parseCredentials
-});
-async function saveCredentials(credentials) {
-  return await store.save(credentials);
-}
-async function loadCredentials() {
-  const loaded = await store.load();
-  return loaded ? { credentials: loaded.value, backend: loaded.backend } : null;
-}
-async function peekCredentials() {
-  const loaded = await store.peek();
-  return loaded ? { credentials: loaded.value, backend: loaded.backend } : null;
-}
-async function deleteCredentials() {
-  await store.delete();
-}
-
-// src/auth-scopes.ts
-function normalizedScopes(value) {
-  return [...new Set(value?.trim().split(/\s+/).filter(Boolean) ?? [])].sort();
-}
-function scopesMatch(left, right) {
-  return JSON.stringify(normalizedScopes(left)) === JSON.stringify(normalizedScopes(right));
-}
-function grantedScopesSatisfyRequest(granted, requested, hasRefreshToken) {
-  const grantedSet = new Set(normalizedScopes(granted));
-  return normalizedScopes(requested).every(
-    (scope) => grantedSet.has(scope) || scope === "offline_access" && hasRefreshToken
-  );
-}
-
-// src/auth-session.ts
-var EXPIRY_BUFFER_MS = 6e4;
-function endpoint(issuer, pathname) {
-  return new URL(pathname, issuer.endsWith("/") ? issuer : `${issuer}/`).toString();
-}
-var SessionExpiredError = class extends Error {
-  constructor() {
-    super("Session expired. Run Glossa again to sign in.");
-    this.name = "SessionExpiredError";
-  }
-};
-function sessionExpiredError() {
-  return new SessionExpiredError();
-}
-function oauthMessage(data, status) {
-  return data.error_description ?? data.error ?? `HTTP ${status}`;
-}
-function isTokenResponse(data) {
-  return "access_token" in data;
-}
-function accessTokenNeedsRefresh(credentials, now = Date.now()) {
-  return Date.parse(credentials.expiresAt) <= now + EXPIRY_BUFFER_MS;
-}
-async function refreshCredentials(credentials, dependencies = {}) {
-  if (!credentials.refreshToken) throw sessionExpiredError();
-  const fetchRequest = dependencies.fetch ?? fetch;
-  const remove = dependencies.deleteCredentials ?? deleteCredentials;
-  const save = dependencies.saveCredentials ?? saveCredentials;
-  const now = dependencies.now ?? Date.now;
-  const response = await fetchRequest(endpoint(credentials.issuer, "oauth/token"), {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "refresh_token",
-      client_id: credentials.clientId,
-      refresh_token: credentials.refreshToken
-    }),
-    ...dependencies.signal ? { signal: dependencies.signal } : {}
-  });
-  const data = await response.json();
-  if (!response.ok || !isTokenResponse(data)) {
-    const oauth = data;
-    if (oauth.error === "invalid_grant") {
-      await remove();
-      throw sessionExpiredError();
-    }
-    throw new Error(oauthMessage(oauth, response.status));
-  }
-  const grantedScope = data.scope ?? credentials.scope;
-  if (credentials.requestedScope && !grantedScopesSatisfyRequest(
-    grantedScope,
-    credentials.requestedScope,
-    Boolean(data.refresh_token ?? credentials.refreshToken)
-  )) {
-    await remove();
-    throw sessionExpiredError();
-  }
-  const refreshed = {
-    ...credentials,
-    accessToken: data.access_token,
-    refreshToken: data.refresh_token ?? credentials.refreshToken,
-    expiresAt: new Date(now() + data.expires_in * 1e3).toISOString(),
-    tokenType: data.token_type,
-    ...grantedScope ? { scope: grantedScope } : {}
-  };
-  await save(refreshed);
-  return refreshed;
-}
-async function validCredentials(credentials, dependencies = {}) {
-  const now = dependencies.now ?? Date.now;
-  if (!accessTokenNeedsRefresh(credentials, now())) return credentials;
-  return await refreshCredentials(credentials, dependencies);
-}
-function parseProfile(value) {
-  if (!value || typeof value !== "object") {
-    throw new Error("Auth0 returned an invalid user profile.");
-  }
-  const profile = value;
-  if (typeof profile.sub !== "string" || profile.name !== void 0 && typeof profile.name !== "string" || profile.email !== void 0 && typeof profile.email !== "string") {
-    throw new Error("Auth0 returned an invalid user profile.");
-  }
-  return profile;
-}
-async function requestProfile(credentials, fetchRequest, signal) {
-  return await fetchRequest(endpoint(credentials.issuer, "userinfo"), {
-    headers: { authorization: `${credentials.tokenType} ${credentials.accessToken}` },
-    ...signal ? { signal } : {}
-  });
-}
-async function loadUserProfile(credentials, dependencies = {}) {
-  const fetchRequest = dependencies.fetch ?? fetch;
-  let current = await validCredentials(credentials, dependencies);
-  let response = await requestProfile(current, fetchRequest, dependencies.signal);
-  if (response.status === 401 && current.refreshToken) {
-    current = await refreshCredentials(current, dependencies);
-    response = await requestProfile(current, fetchRequest, dependencies.signal);
-  }
-  if (!response.ok) {
-    throw new Error(`Auth0 profile request failed with HTTP ${response.status}.`);
-  }
-  return { credentials: current, profile: parseProfile(await response.json()) };
-}
-
-// src/device-flow.ts
-import { setTimeout as delay } from "node:timers/promises";
-
-// src/open-browser.ts
-import { spawn } from "node:child_process";
-async function openBrowser(url2) {
-  const command = process.platform === "darwin" ? { file: "open", args: [url2] } : process.platform === "win32" ? { file: "cmd", args: ["/c", "start", "", url2] } : { file: "xdg-open", args: [url2] };
-  return await new Promise((resolve) => {
-    const child = spawn(command.file, command.args, {
-      detached: true,
-      stdio: "ignore",
-      windowsHide: true
-    });
-    child.once("error", () => resolve(false));
-    child.once("spawn", () => {
-      child.unref();
-      resolve(true);
-    });
-  });
-}
-
-// src/device-flow.ts
-function endpoint2(issuer, pathname) {
-  return new URL(pathname, issuer.endsWith("/") ? issuer : `${issuer}/`).toString();
-}
-function canceledError() {
-  return new Error("Login canceled.");
-}
-function assertActive(signal) {
-  if (signal?.aborted) throw canceledError();
-}
-async function defaultDelay(milliseconds, signal) {
-  await delay(milliseconds, void 0, signal ? { signal } : void 0);
-}
-async function postForm(fetchRequest, url2, values, signal) {
-  const response = await fetchRequest(url2, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams(values),
-    ...signal ? { signal } : {}
-  });
-  const data = await response.json();
-  if (!response.ok) {
-    const oauth = data;
-    throw new Error(oauth.error_description ?? oauth.error ?? `HTTP ${response.status}`);
-  }
-  return data;
-}
-async function authorizeWithDeviceFlow(options, dependencies = {}) {
-  const fetchRequest = dependencies.fetch ?? fetch;
-  const wait = dependencies.delay ?? defaultDelay;
-  const browse = dependencies.openBrowser ?? openBrowser;
-  const now = dependencies.now ?? Date.now;
-  const log = dependencies.log ?? console.log;
-  try {
-    assertActive(options.signal);
-    const code = await postForm(
-      fetchRequest,
-      endpoint2(options.issuer, "oauth/device/code"),
-      {
-        client_id: options.clientId,
-        audience: options.audience,
-        scope: options.scope
-      },
-      options.signal
-    );
-    const verificationUrl = code.verification_uri_complete ?? code.verification_uri;
-    const opened = await browse(verificationUrl);
-    log(opened ? "Opened your browser for Glossa login." : "Open this URL to sign in:");
-    log(verificationUrl);
-    if (!code.verification_uri_complete) log(`Code: ${code.user_code}`);
-    const startedAt = now();
-    let intervalSeconds = Math.max(code.interval ?? 5, 1);
-    while (now() - startedAt < code.expires_in * 1e3) {
-      assertActive(options.signal);
-      await wait(intervalSeconds * 1e3, options.signal);
-      assertActive(options.signal);
-      const response = await fetchRequest(endpoint2(options.issuer, "oauth/token"), {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-          device_code: code.device_code,
-          client_id: options.clientId
-        }),
-        ...options.signal ? { signal: options.signal } : {}
-      });
-      const data = await response.json();
-      if (response.ok && "access_token" in data) {
-        const grantedScope = data.scope ?? options.scope;
-        if (!grantedScopesSatisfyRequest(
-          grantedScope,
-          options.scope,
-          Boolean(data.refresh_token)
-        )) {
-          throw new Error("Auth0 did not grant the permissions Glossa requires.");
-        }
-        return {
-          issuer: options.issuer,
-          clientId: options.clientId,
-          audience: options.audience,
-          accessToken: data.access_token,
-          ...data.refresh_token ? { refreshToken: data.refresh_token } : {},
-          expiresAt: new Date(now() + data.expires_in * 1e3).toISOString(),
-          tokenType: data.token_type,
-          scope: grantedScope,
-          requestedScope: options.scope
-        };
-      }
-      const error46 = data;
-      if (error46.error === "authorization_pending") continue;
-      if (error46.error === "slow_down") {
-        intervalSeconds += 5;
-        continue;
-      }
-      if (error46.error === "access_denied") throw new Error("Login was denied.");
-      if (error46.error === "expired_token") throw new Error("The login code expired.");
-      throw new Error(error46.error_description ?? error46.error);
-    }
-    throw new Error("The login code expired.");
-  } catch (error46) {
-    if (options.signal?.aborted || error46 instanceof Error && error46.name === "AbortError") {
-      throw canceledError();
-    }
-    throw error46;
-  }
-}
-async function loginWithDeviceFlow(options, dependencies = {}) {
-  const credentials = await authorizeWithDeviceFlow(options, dependencies);
-  if (!credentials.refreshToken) {
-    throw new Error("Auth0 did not issue a refresh token.");
-  }
-  const save = dependencies.saveCredentials ?? saveCredentials;
-  await save(credentials);
-  (dependencies.log ?? console.log)("Signed in to Glossa.");
-}
-
-// src/auth-login.ts
-function normalizedIssuer(value) {
-  return value.replace(/\/+$/, "");
-}
-function credentialsMatchLoginOptions(credentials, options) {
-  return normalizedIssuer(credentials.issuer) === normalizedIssuer(options.issuer) && credentials.clientId === options.clientId && credentials.audience === options.audience && scopesMatch(credentials.requestedScope, options.scope) && grantedScopesSatisfyRequest(
-    credentials.scope,
-    options.scope,
-    Boolean(credentials.refreshToken)
-  );
-}
-async function signedInSession(options, dependencies = {}) {
-  const load = dependencies.loadCredentials ?? loadCredentials;
-  const validate2 = dependencies.validCredentials ?? validCredentials;
-  const login = dependencies.loginWithDeviceFlow ?? loginWithDeviceFlow;
-  const loaded = await load();
-  if (loaded && credentialsMatchLoginOptions(loaded.credentials, options)) {
-    try {
-      const credentials = await validate2(
-        loaded.credentials,
-        options.signal ? { signal: options.signal } : {}
-      );
-      return { credentials, loginPerformed: false };
-    } catch (error46) {
-      if (!(error46 instanceof SessionExpiredError)) throw error46;
-    }
-  }
-  await login(options);
-  const completed = await load();
-  if (!completed) throw new Error("Glossa could not load the completed login.");
-  return {
-    credentials: await validate2(
-      completed.credentials,
-      options.signal ? { signal: options.signal } : {}
-    ),
-    loginPerformed: true
-  };
-}
-
 // ../../node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -28006,10 +27476,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path14) {
-  if (!path14)
+function getElementAtPath(obj, path12) {
+  if (!path12)
     return obj;
-  return path14.reduce((acc, key) => acc?.[key], obj);
+  return path12.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -28370,11 +27840,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path14, issues) {
+function prefixIssues(path12, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path14);
+    iss.path.unshift(path12);
     return iss;
   });
 }
@@ -28536,7 +28006,7 @@ function formatError(error46, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error46, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error47, path14 = []) => {
+  const processError = (error47, path12 = []) => {
     var _a, _b;
     for (const issue2 of error47.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
@@ -28546,7 +28016,7 @@ function treeifyError(error46, mapper = (issue2) => issue2.message) {
       } else if (issue2.code === "invalid_element") {
         processError({ issues: issue2.issues }, issue2.path);
       } else {
-        const fullpath = [...path14, ...issue2.path];
+        const fullpath = [...path12, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -28578,8 +28048,8 @@ function treeifyError(error46, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path14 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path14) {
+  const path12 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path12) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -39910,6 +39380,7 @@ function containsRestrictedAuthenticationData(value) {
 
 // ../protocol/dist/index.js
 var MAX_TEXT_BYTES = 1024 * 1024;
+var MAX_IMAGE_BYTES = 4 * 1024 * 1024;
 var MAX_EDIT_DIFF_BYTES = 128 * 1024;
 var MAX_EDIT_OPERATIONS = 100;
 var MAX_COMMAND_OUTPUT_BYTES = 12 * 1024;
@@ -39958,6 +39429,13 @@ var readFileJobSchema = readFileRequestSchema.extend({
   type: external_exports.literal("read_file"),
   requestId: external_exports.string().uuid()
 });
+var viewImageRequestSchema = external_exports.object({
+  path: relativePathSchema
+}).strict();
+var viewImageJobSchema = viewImageRequestSchema.extend({
+  type: external_exports.literal("view_image"),
+  requestId: external_exports.string().uuid()
+});
 var structuredReadTimeoutSchema = external_exports.number().int().min(1).max(MAX_STRUCTURED_READ_TIMEOUT_MS);
 var listFilesCursorSchema = external_exports.string().max(4096).describe("Opaque cursor returned by an earlier list_files result.");
 var listFilesRequestSchema = external_exports.object({
@@ -40100,6 +39578,7 @@ var cancelCommandJobSchema = cancelCommandRequestSchema.extend({
 });
 var workerJobSchema = external_exports.discriminatedUnion("type", [
   readFileJobSchema,
+  viewImageJobSchema,
   listFilesJobSchema,
   searchTextJobSchema,
   readFileRangeJobSchema,
@@ -40129,9 +39608,12 @@ var UsageError = class extends Error {
 };
 var retiredCommands = /* @__PURE__ */ new Set([
   "completions",
+  "devices",
   "doctor",
   "login",
-  "start"
+  "logout",
+  "start",
+  "status"
 ]);
 function parseWorkspace(args) {
   let selectedPath;
@@ -40189,12 +39671,6 @@ function parseWorkspace(args) {
     accessProfile
   };
 }
-function parseDevices(args) {
-  if (args[0] === "revoke" && args.length === 2) {
-    return { command: "devices", action: "revoke", deviceId: args[1] };
-  }
-  throw new UsageError("Use: glossa devices revoke <id>.");
-}
 function parseUpdate(args) {
   if (args.length === 0) return { command: "update", action: "install" };
   let check3 = false;
@@ -40254,15 +39730,6 @@ function parseInvocation(args) {
     return { command: "version" };
   }
   if (command === "--") return parseWorkspace(args);
-  if (command === "status") {
-    noOptions("Status", options);
-    return { command };
-  }
-  if (command === "devices") return parseDevices(options);
-  if (command === "logout") {
-    noOptions("Logout", options);
-    return { command };
-  }
   if (command === "unpair") {
     noOptions("Unpair", options);
     return { command };
@@ -40291,47 +39758,9 @@ function formatRelativeTime(iso, now = Date.now()) {
   const days = Math.round(hours / 24);
   return `${days}d ago`;
 }
-function formatDeviceRow(device, now = Date.now()) {
-  const platform2 = device.platform ?? "unknown platform";
-  return `${device.id}  ${device.name}  ${platform2}  last seen ${formatRelativeTime(device.lastSeenAt, now)}  ${deviceStatus(device)}`;
-}
-
-// src/logout.ts
-function browserLogoutUrl(issuer) {
-  return new URL(
-    "v2/logout",
-    issuer.endsWith("/") ? issuer : `${issuer}/`
-  ).toString();
-}
-async function logoutFromGlossa(dependencies = {}) {
-  const remove = dependencies.deleteCredentials ?? deleteCredentials;
-  const peek = dependencies.peekCredentials ?? peekCredentials;
-  const browse = dependencies.openBrowser ?? openBrowser;
-  const log = dependencies.log ?? console.log;
-  let stored = null;
-  let present = true;
-  try {
-    stored = await peek();
-    present = stored !== null;
-  } catch {
-  }
-  const issuer = dependencies.issuer ?? stored?.credentials.issuer;
-  await remove();
-  log(
-    present ? "Signed out of the Glossa account. Computer pairing stays active." : "Already signed out of the Glossa account. Computer pairing stays active."
-  );
-  const url2 = browserLogoutUrl(issuer ?? loadAuthConfig().issuer);
-  const opened = await browse(url2);
-  if (opened) {
-    log("Opened Glossa browser sign-out.");
-  } else {
-    log("Open this URL to finish signing out in your browser:");
-    log(url2);
-  }
-}
 
 // src/relay-client.ts
-import os2 from "node:os";
+import os from "node:os";
 var DEFAULT_RELAY_ORIGIN = "https://mcp.glossa.sh";
 function isLoopback(hostname3) {
   return hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "[::1]";
@@ -40375,10 +39804,61 @@ function loadRelayEndpoints(environment = process.env) {
   return { relayOrigin, workerOrigin };
 }
 function defaultDeviceName() {
-  return deviceNameSchema.parse(os2.hostname());
+  return deviceNameSchema.parse(os.hostname());
+}
+var PairingCodeExpiredError = class extends Error {
+};
+function pairingHttpError(status) {
+  if (status === 429) {
+    return new Error("Glossa pairing is rate limited. Try again later.");
+  }
+  return new Error(`The Glossa relay returned HTTP ${status}.`);
+}
+async function createPairing(endpoints, deviceName, platform2, fetchRequest = fetch) {
+  const response = await fetchRequest(`${endpoints.relayOrigin}/v1/pairings`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ name: deviceNameSchema.parse(deviceName), platform: platform2 })
+  });
+  let data = {};
+  try {
+    data = await response.json();
+  } catch {
+  }
+  if (!response.ok) throw pairingHttpError(response.status);
+  if (typeof data.code !== "string" || typeof data.expiresAt !== "string" || Number.isNaN(Date.parse(data.expiresAt))) {
+    throw new Error("The Glossa relay returned an invalid pairing response.");
+  }
+  return { code: data.code, expiresAt: data.expiresAt };
+}
+async function redeemPairing(endpoints, code, fetchRequest = fetch) {
+  const response = await fetchRequest(`${endpoints.relayOrigin}/v1/pairings/redeem`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ code })
+  });
+  let data = {};
+  try {
+    data = await response.json();
+  } catch {
+  }
+  if (response.status === 202) return "pending";
+  if (response.status === 404) {
+    throw new PairingCodeExpiredError(
+      "The pairing code expired. Glossa will show a fresh one."
+    );
+  }
+  if (!response.ok) throw pairingHttpError(response.status);
+  if (typeof data.device?.id !== "string" || typeof data.device.name !== "string" || typeof data.device_token !== "string") {
+    throw new Error("The Glossa relay returned an invalid pairing response.");
+  }
+  return {
+    device: { id: data.device.id, name: data.device.name },
+    token: data.device_token
+  };
 }
-function relayError(status, data) {
-  if (status === 401) return new Error("Glossa login was rejected. Sign in again when prompted.");
+function relayError(status, data, unauthorized) {
+  if (status === 401) return new Error(unauthorized);
   if (status === 403 && data.error === "account_disabled") {
     return new Error("This Glossa account is disabled.");
   }
@@ -40401,7 +39881,7 @@ function relayError(status, data) {
 function validNullableString(value) {
   return value === null || typeof value === "string";
 }
-function parseDevices2(value) {
+function parseDevices(value) {
   if (!Array.isArray(value)) {
     throw new Error("The Glossa relay returned an invalid device list response.");
   }
@@ -40416,63 +39896,18 @@ function parseDevices2(value) {
     activeWorkers: device.activeWorkers ?? null
   }));
 }
-async function listDevices(endpoints, credentials, fetchRequest = fetch) {
+var PAIRING_REJECTED = "This computer's pairing is no longer valid. Run Glossa again to pair it.";
+async function listDevices(endpoints, authorization, fetchRequest = fetch) {
   const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices`, {
-    headers: {
-      authorization: `${credentials.tokenType} ${credentials.accessToken}`
-    }
+    headers: { authorization }
   });
   let data = {};
   try {
     data = await response.json();
   } catch {
   }
-  if (!response.ok) throw relayError(response.status, data);
-  return parseDevices2(data.devices);
-}
-async function enrollDevice(endpoints, credentials, deviceName, fetchRequest = fetch) {
-  const baseName = deviceNameSchema.parse(deviceName);
-  let name = baseName;
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/enroll`, {
-      method: "POST",
-      headers: {
-        authorization: `${credentials.tokenType} ${credentials.accessToken}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({ name, platform: `${process.platform}-${process.arch}` })
-    });
-    let data = {};
-    try {
-      data = await response.json();
-    } catch {
-    }
-    if (response.status === 409 && data.error === "device_name_conflict" && attempt < 2) {
-      const activeNames = new Set(
-        (await listDevices(endpoints, credentials, fetchRequest)).filter((device) => device.revokedAt === null).map((device) => device.name)
-      );
-      for (let suffix = 2; ; suffix += 1) {
-        const ending = `-${suffix}`;
-        const candidate = `${baseName.slice(0, 80 - ending.length)}${ending}`;
-        if (!activeNames.has(candidate)) {
-          name = deviceNameSchema.parse(candidate);
-          break;
-        }
-      }
-      continue;
-    }
-    if (!response.ok) throw relayError(response.status, data);
-    if (typeof data.device?.id !== "string" || typeof data.device.name !== "string" || typeof data.device_token !== "string") {
-      throw new Error("The Glossa relay returned an invalid device enrollment response.");
-    }
-    return {
-      relayOrigin: endpoints.relayOrigin,
-      deviceId: data.device.id,
-      deviceName: data.device.name,
-      token: data.device_token
-    };
-  }
-  throw new Error("Glossa could not enroll this computer.");
+  if (!response.ok) throw relayError(response.status, data, PAIRING_REJECTED);
+  return parseDevices(data.devices);
 }
 async function revokePairedDevice(endpoints, device, fetchRequest = fetch) {
   const response = await fetchRequest(`${endpoints.relayOrigin}/device`, {
@@ -40485,103 +39920,17 @@ async function revokePairedDevice(endpoints, device, fetchRequest = fetch) {
   }
   throw new Error(`The Glossa relay returned HTTP ${response.status}.`);
 }
-async function revokeDevice(endpoints, credentials, deviceId, fetchRequest = fetch) {
+async function revokeDevice(endpoints, authorization, deviceId, fetchRequest = fetch) {
   const response = await fetchRequest(`${endpoints.relayOrigin}/v1/devices/${encodeURIComponent(deviceId)}`, {
     method: "DELETE",
-    headers: {
-      authorization: `${credentials.tokenType} ${credentials.accessToken}`
-    }
+    headers: { authorization }
   });
   if (!response.ok) {
     const data = await response.json().catch(() => ({}));
-    throw relayError(response.status, data);
+    throw relayError(response.status, data, PAIRING_REJECTED);
   }
 }
 
-// src/status-display.ts
-function formatStatus(status) {
-  const lines = [
-    `Signed in as ${status.account}.`,
-    `Relay connected: ${status.relay}`
-  ];
-  if (status.activeWorkers === null) {
-    lines.push("Active workspaces: unavailable");
-  } else if (status.activeWorkers === 0) {
-    lines.push("No active workspaces. Run glossa from the project folder you want to expose.");
-  } else {
-    lines.push(`Active workspaces: ${status.activeWorkers}`);
-  }
-  if (status.devices.length === 0) lines.push("No active devices.");
-  else lines.push(...status.devices.map((device) => formatDeviceRow(device)));
-  return lines;
-}
-
-// src/status-service.ts
-function accountLabel(profile) {
-  return profile.email ?? profile.name ?? profile.sub;
-}
-function activeWorkerCount(devices) {
-  if (devices.some((device) => device.activeWorkers === null)) return null;
-  return devices.reduce((sum, device) => sum + device.activeWorkers, 0);
-}
-var WorkspaceStatusService = class {
-  constructor(credentials, endpoints, dependencies = {}) {
-    this.endpoints = endpoints;
-    this.dependencies = dependencies;
-    this.#credentials = credentials;
-  }
-  endpoints;
-  dependencies;
-  #credentials;
-  #inFlight;
-  async refresh(signal) {
-    if (this.#inFlight) return await this.#inFlight;
-    const pending = this.#load(signal);
-    this.#inFlight = pending;
-    try {
-      return await pending;
-    } finally {
-      if (this.#inFlight === pending) this.#inFlight = void 0;
-    }
-  }
-  async #load(signal) {
-    const validate2 = this.dependencies.validCredentials ?? validCredentials;
-    const devicesForAccount = this.dependencies.listDevices ?? listDevices;
-    const profileForAccount = this.dependencies.loadUserProfile ?? loadUserProfile;
-    const baseFetch = this.dependencies.fetch ?? fetch;
-    const fetchRequest = signal ? async (input, init) => await baseFetch(input, { ...init, signal }) : baseFetch;
-    this.#credentials = await validate2(
-      this.#credentials,
-      signal ? { signal } : {}
-    );
-    const requestCredentials = this.#credentials;
-    const profileRequest = profileForAccount(
-      requestCredentials,
-      signal ? { signal, fetch: fetchRequest } : { fetch: fetchRequest }
-    ).catch((error46) => {
-      if (signal?.aborted) throw error46;
-      return null;
-    });
-    const devicesRequest = devicesForAccount(
-      this.endpoints,
-      requestCredentials,
-      fetchRequest
-    );
-    const [profile, devices] = await Promise.all([
-      profileRequest,
-      devicesRequest
-    ]);
-    if (profile) this.#credentials = profile.credentials;
-    const activeDevices = devices.filter((device) => device.revokedAt === null);
-    return {
-      account: profile ? accountLabel(profile.profile) : "Account unavailable",
-      relay: this.endpoints.relayOrigin,
-      activeWorkers: activeWorkerCount(activeDevices),
-      devices: activeDevices
-    };
-  }
-};
-
 // src/ui-hud.tsx
 var import_react34 = __toESM(require_react(), 1);
 
@@ -40735,7 +40084,7 @@ __export(base_exports, {
   synchronizedOutput: () => synchronizedOutput
 });
 import process2 from "node:process";
-import os3 from "node:os";
+import os2 from "node:os";
 
 // ../../node_modules/environment/index.js
 var isBrowser = globalThis.window?.document !== void 0;
@@ -40834,7 +40183,7 @@ var isOldWindows = () => {
   if (isBrowser || !isWindows2) {
     return false;
   }
-  const parts = os3.release().split(".");
+  const parts = os2.release().split(".");
   const major = Number(parts[0]);
   const build = Number(parts[2] ?? 0);
   if (major < 10) {
@@ -45830,7 +45179,7 @@ var ansi_styles_default2 = ansiStyles2;
 
 // ../../node_modules/chalk/source/vendor/supports-color/index.js
 import process5 from "node:process";
-import os4 from "node:os";
+import os3 from "node:os";
 import tty2 from "node:tty";
 function hasFlag(flag, argv = globalThis.Deno ? globalThis.Deno.args : process5.argv) {
   const prefix = flag.startsWith("-") ? "" : flag.length === 1 ? "-" : "--";
@@ -45895,7 +45244,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return min;
   }
   if (process5.platform === "win32") {
-    const osRelease = os4.release().split(".");
+    const osRelease = os3.release().split(".");
     if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
       return Number(osRelease[2]) >= 14931 ? 3 : 2;
     }
@@ -47671,8 +47020,8 @@ function Text({ color, backgroundColor, dimColor = false, bold = false, italic =
 }
 
 // ../../node_modules/ink/build/components/ErrorOverview.js
-var cleanupPath = (path14) => {
-  return path14?.replace(`file://${cwd()}/`, "");
+var cleanupPath = (path12) => {
+  return path12?.replace(`file://${cwd()}/`, "");
 };
 var stackUtils = new import_stack_utils.default({
   cwd: cwd(),
@@ -49774,14 +49123,136 @@ var import_react33 = __toESM(require_react(), 1);
 
 // src/first-run.ts
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
-import path3 from "node:path";
+import path2 from "node:path";
+
+// src/secure-store.ts
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import os4 from "node:os";
+import path from "node:path";
+var KEYRING_SERVICE = "Glossa";
+function configDirectory() {
+  if (process.platform === "win32") {
+    return path.join(process.env.APPDATA ?? os4.homedir(), "Glossa");
+  }
+  return path.join(
+    process.env.XDG_CONFIG_HOME ?? path.join(os4.homedir(), ".config"),
+    "glossa"
+  );
+}
+var SecureStore = class {
+  #options;
+  #warned = false;
+  constructor(options) {
+    this.#options = options;
+  }
+  async save(value) {
+    const serialized = JSON.stringify(value);
+    const entry = await this.#entry();
+    if (entry) {
+      try {
+        await this.#writeEntry(entry, serialized);
+        await rm(this.#options.file, { force: true });
+        return "keyring";
+      } catch {
+      }
+    }
+    this.#warn();
+    await mkdir(path.dirname(this.#options.file), {
+      recursive: true,
+      mode: 448
+    });
+    await writeFile(
+      this.#options.file,
+      `${JSON.stringify(value, null, 2)}
+`,
+      { encoding: "utf8", mode: 384 }
+    );
+    if (process.platform !== "win32") {
+      await chmod(this.#options.file, 384);
+    }
+    return "file";
+  }
+  async load() {
+    const entry = await this.#entry();
+    if (entry) {
+      const value2 = await this.#readEntry(entry);
+      if (value2 != null) return { value: value2, backend: "keyring" };
+    }
+    let value;
+    try {
+      value = this.#options.parse(await readFile(this.#options.file, "utf8"));
+    } catch (error46) {
+      if (error46.code === "ENOENT") return null;
+      throw error46;
+    }
+    this.#warn();
+    return { value, backend: "file" };
+  }
+  async delete() {
+    const entry = await this.#entry();
+    let keyringDeleteFailed = false;
+    if (entry) {
+      try {
+        const deleted = await entry.deleteCredential();
+        if (!deleted && await entry.getSecret() != null) {
+          keyringDeleteFailed = true;
+        }
+      } catch {
+        keyringDeleteFailed = true;
+      }
+    }
+    await rm(this.#options.file, { force: true });
+    if (keyringDeleteFailed) {
+      throw new Error(
+        "The operating-system credential store could not remove the Glossa credential."
+      );
+    }
+  }
+  async #entry() {
+    if (this.#options.entryProvider) {
+      try {
+        return await this.#options.entryProvider();
+      } catch {
+        return null;
+      }
+    }
+    try {
+      const { AsyncEntry } = await import("@napi-rs/keyring");
+      return new AsyncEntry(KEYRING_SERVICE, this.#options.account);
+    } catch {
+      return null;
+    }
+  }
+  async #readEntry(entry) {
+    try {
+      const secret = await entry.getSecret();
+      if (secret == null) return null;
+      const bytes = secret instanceof Uint8Array ? secret : Uint8Array.from(secret);
+      return this.#options.parse(
+        new TextDecoder("utf-8", { fatal: true }).decode(bytes)
+      );
+    } catch {
+      return null;
+    }
+  }
+  async #writeEntry(entry, serialized) {
+    await entry.setSecret(new TextEncoder().encode(serialized));
+  }
+  #warn() {
+    if (this.#warned) return;
+    this.#warned = true;
+    (this.#options.warn ?? console.warn)(this.#options.warning);
+  }
+};
+
+// src/first-run.ts
 var CONNECT_HINT_FILE = "connect-hint-shown";
 var CONNECT_HINT_URL = "https://glossa.sh/docs/quickstart";
 function shouldShowConnectHint(relayOrigin) {
   return relayOrigin === DEFAULT_RELAY_ORIGIN;
 }
 function connectHintStore(directory = configDirectory()) {
-  const file2 = path3.join(directory, CONNECT_HINT_FILE);
+  const file2 = path2.join(directory, CONNECT_HINT_FILE);
   return {
     async exists() {
       try {
@@ -49798,15 +49269,15 @@ function connectHintStore(directory = configDirectory()) {
     }
   };
 }
-async function announceConnectHint(store3, log) {
-  if (await store3.exists()) return false;
+async function announceConnectHint(store2, log) {
+  if (await store2.exists()) return false;
   log(`Next: return to ChatGPT and use Glossa. If it is not connected yet, follow ${CONNECT_HINT_URL}.`);
-  await store3.mark();
+  await store2.mark();
   return true;
 }
 
 // src/device-store.ts
-import path4 from "node:path";
+import path3 from "node:path";
 var FILE_DEVICE_WARNING = "Warning: the operating-system credential store is unavailable. Glossa is using a mode-0600 device credential file.";
 function parseDeviceCredential(value) {
   let parsed;
@@ -49830,36 +49301,36 @@ function parseDeviceCredential(value) {
   }
   return parsed;
 }
-var store2 = new SecureStore({
+var store = new SecureStore({
   account: "device",
-  file: path4.join(configDirectory(), "device.json"),
+  file: path3.join(configDirectory(), "device.json"),
   warning: FILE_DEVICE_WARNING,
   parse: parseDeviceCredential
 });
 async function loadDeviceCredential() {
-  return (await store2.load())?.value ?? null;
+  return (await store.load())?.value ?? null;
 }
 async function saveDeviceCredential(credential) {
-  await store2.save(credential);
+  await store.save(credential);
 }
 async function deleteDeviceCredential() {
-  await store2.delete();
+  await store.delete();
 }
 
 // src/device-pairing-lock.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { mkdir as mkdir4, readFile as readFile3, rm as rm3, stat, writeFile as writeFile4 } from "node:fs/promises";
-import path6 from "node:path";
-import { setTimeout as delay2 } from "node:timers/promises";
+import path5 from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 
 // src/update-lock.ts
 import { randomUUID } from "node:crypto";
 import { mkdir as mkdir3, readdir, rm as rm2, writeFile as writeFile3 } from "node:fs/promises";
-import path5 from "node:path";
+import path4 from "node:path";
 var UPDATE_SUFFIX = ".update";
 var SESSION_SUFFIX = ".session";
 function updateRuntimeDirectory() {
-  return path5.join(configDirectory(), "runtime");
+  return path4.join(configDirectory(), "runtime");
 }
 function processIsAlive(pid) {
   if (!Number.isSafeInteger(pid) || pid <= 0) return false;
@@ -49889,7 +49360,7 @@ async function activeLeaseFiles(directory, suffix) {
   for (const entry of entries) {
     if (!entry.isFile() || !entry.name.endsWith(suffix)) continue;
     const pid = leasePid(entry.name, suffix);
-    const file2 = path5.join(directory, entry.name);
+    const file2 = path4.join(directory, entry.name);
     if (pid !== null && processIsAlive(pid)) active.push(file2);
     else await rm2(file2, { force: true });
   }
@@ -49903,7 +49374,7 @@ async function activeSessionFiles(directory) {
 }
 async function createUpdateLock(directory) {
   await mkdir3(directory, { recursive: true, mode: 448 });
-  const lockFile = path5.join(
+  const lockFile = path4.join(
     directory,
     `${process.pid}-${randomUUID()}${UPDATE_SUFFIX}`
   );
@@ -49941,7 +49412,7 @@ async function withWorkspaceLease(action, directory = updateRuntimeDirectory())
   if (await updateLockIsActive(directory)) {
     throw new Error("Glossa is updating. Run this workspace again after the update finishes.");
   }
-  const leaseFile = path5.join(
+  const leaseFile = path4.join(
     directory,
     `${process.pid}-${randomUUID()}${SESSION_SUFFIX}`
   );
@@ -49968,10 +49439,10 @@ var DEVICE_PAIRING_LOCK_POLL_MS = 100;
 var DEVICE_PAIRING_LOCK_MAX_AGE_MS = 6 * 6e4;
 var DEVICE_PAIRING_GUARD_MAX_AGE_MS = 3e4;
 function lockPath(directory) {
-  return path6.join(directory, DEVICE_PAIRING_LOCK);
+  return path5.join(directory, DEVICE_PAIRING_LOCK);
 }
 function guardPath(directory) {
-  return path6.join(directory, DEVICE_PAIRING_LOCK_GUARD);
+  return path5.join(directory, DEVICE_PAIRING_LOCK_GUARD);
 }
 function newOwner() {
   return {
@@ -50026,7 +49497,7 @@ async function acquireGuard(directory, signal) {
       await rm3(file2, { force: true });
       continue;
     }
-    await delay2(
+    await delay(
       DEVICE_PAIRING_LOCK_POLL_MS,
       void 0,
       signal ? { signal } : void 0
@@ -50074,7 +49545,7 @@ async function acquireDevicePairingLock(directory, signal) {
       signal
     );
     if (reclaimed) continue;
-    await delay2(
+    await delay(
       DEVICE_PAIRING_LOCK_POLL_MS,
       void 0,
       signal ? { signal } : void 0
@@ -50091,46 +49562,69 @@ async function withDevicePairingLease(action, signal, directory = updateRuntimeD
 }
 
 // src/device-pairing.ts
-function canceledError2() {
+import { setTimeout as delay2 } from "node:timers/promises";
+var MAX_PAIRING_CODES = 3;
+var POLL_INTERVAL_MS = 2e3;
+function canceledError() {
   return new Error("Pairing canceled.");
 }
-function pairingScope(scope) {
-  return scope.split(/\s+/).filter((value) => value && value !== "offline_access").join(" ");
+async function defaultDelay(milliseconds, signal) {
+  await delay2(milliseconds, void 0, signal ? { signal } : void 0);
 }
 async function pairDevice(endpoints, signal, dependencies = {}) {
-  const authorize = dependencies.authorizeWithDeviceFlow ?? authorizeWithDeviceFlow;
-  const enroll = dependencies.enrollDevice ?? enrollDevice;
-  const authConfig = dependencies.loadAuthConfig ?? loadAuthConfig;
+  const create3 = dependencies.createPairing ?? createPairing;
+  const redeem = dependencies.redeemPairing ?? redeemPairing;
   const name = dependencies.defaultDeviceName ?? defaultDeviceName;
+  const wait = dependencies.delay ?? defaultDelay;
+  const now = dependencies.now ?? Date.now;
   const log = dependencies.log ?? console.log;
   const baseFetch = dependencies.fetch ?? fetch;
   const fetchRequest = signal ? async (input, init) => await baseFetch(input, { ...init, signal }) : baseFetch;
   try {
     signal?.throwIfAborted();
     log("This computer needs to be paired with Glossa.");
-    const auth = authConfig();
-    const credentials = await authorize(
-      {
-        ...auth,
-        scope: pairingScope(auth.scope),
-        ...signal ? { signal } : {}
-      },
-      { fetch: fetchRequest, log }
-    );
-    signal?.throwIfAborted();
-    const paired = await enroll(endpoints, credentials, name(), fetchRequest);
-    log(`Paired with Glossa as ${paired.deviceName}.`);
-    return paired;
+    const deviceName = name();
+    const platform2 = `${process.platform}-${process.arch}`;
+    for (let attempt = 0; attempt < MAX_PAIRING_CODES; attempt += 1) {
+      signal?.throwIfAborted();
+      const pairing = await create3(endpoints, deviceName, platform2, fetchRequest);
+      log("");
+      log(`Pairing code: ${pairing.code} (valid for 10 minutes)`);
+      log("");
+      log(`Enter it at ${endpoints.relayOrigin}/panel`);
+      const expiresAt = Date.parse(pairing.expiresAt);
+      while (now() < expiresAt) {
+        signal?.throwIfAborted();
+        await wait(POLL_INTERVAL_MS, signal);
+        signal?.throwIfAborted();
+        try {
+          const redeemed = await redeem(endpoints, pairing.code, fetchRequest);
+          if (redeemed === "pending") continue;
+          log(`Paired with Glossa as ${redeemed.device.name}.`);
+          return {
+            relayOrigin: endpoints.relayOrigin,
+            deviceId: redeemed.device.id,
+            deviceName: redeemed.device.name,
+            token: redeemed.token
+          };
+        } catch (error46) {
+          if (!(error46 instanceof PairingCodeExpiredError)) throw error46;
+          log(error46.message);
+          break;
+        }
+      }
+    }
+    throw new Error("Pairing timed out. Run Glossa again to retry.");
   } catch (error46) {
     if (signal?.aborted || error46 instanceof Error && error46.name === "AbortError") {
-      throw canceledError2();
+      throw canceledError();
     }
     throw error46;
   }
 }
 
 // src/worker/command-service.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn } from "node:child_process";
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { StringDecoder } from "node:string_decoder";
 import { setTimeout as delay3 } from "node:timers/promises";
@@ -50405,7 +49899,7 @@ async function terminateProcessTree(child) {
   if (!child.pid || child.exitCode !== null) return;
   if (process.platform === "win32") {
     await new Promise((resolve) => {
-      const killer = spawn2("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
+      const killer = spawn("taskkill", ["/pid", String(child.pid), "/t", "/f"], {
         stdio: "ignore",
         windowsHide: true
       });
@@ -50495,7 +49989,7 @@ var CommandService = class {
     const invocation = options.argv ? { file: options.argv[0], args: options.argv.slice(1) } : shellInvocation(options.shellCommand);
     let child;
     try {
-      child = spawn2(invocation.file, invocation.args, {
+      child = spawn(invocation.file, invocation.args, {
         cwd: cwd2,
         env: process.env,
         detached: process.platform !== "win32",
@@ -50727,14 +50221,14 @@ import {
   stat as stat3,
   writeFile as writeFile5
 } from "node:fs/promises";
-import path8 from "node:path";
+import path7 from "node:path";
 import { performance as performance2 } from "node:perf_hooks";
 import { StringDecoder as StringDecoder2 } from "node:string_decoder";
 
 // src/worker/path-policy.ts
 import { lstat, realpath, stat as stat2 } from "node:fs/promises";
 import os5 from "node:os";
-import path7 from "node:path";
+import path6 from "node:path";
 function samePath(left, right) {
   return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
@@ -50746,15 +50240,15 @@ function accountHomeDirectory() {
   }
 }
 function isWithin(root, candidate) {
-  const relative = path7.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path7.sep}`) && relative !== ".." && !path7.isAbsolute(relative);
+  const relative = path6.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path6.sep}`) && relative !== ".." && !path6.isAbsolute(relative);
 }
 function validateRelativePath(value) {
   if (value.includes("\0")) {
     throw new WorkerError("invalid_path", "Paths cannot contain null bytes.");
   }
   const explicitNativePosixPath = process.platform !== "win32" && value.startsWith("./");
-  if (path7.isAbsolute(value) || path7.posix.isAbsolute(value) || !explicitNativePosixPath && path7.win32.isAbsolute(value)) {
+  if (path6.isAbsolute(value) || path6.posix.isAbsolute(value) || !explicitNativePosixPath && path6.win32.isAbsolute(value)) {
     throw new WorkerError("absolute_path", "Absolute paths are not allowed.");
   }
   const segments = explicitNativePosixPath ? value.split(/\/+/).filter(Boolean) : value.split(/[\\/]+/);
@@ -50764,7 +50258,7 @@ function validateRelativePath(value) {
   return value === "" ? "." : value;
 }
 async function canonicalizeRoot(candidate) {
-  const root = await realpath(path7.resolve(candidate)).catch((error46) => {
+  const root = await realpath(path6.resolve(candidate)).catch((error46) => {
     if (error46.code === "ENOENT") {
       throw new WorkerError("root_not_found", "The workspace directory does not exist.");
     }
@@ -50774,10 +50268,10 @@ async function canonicalizeRoot(candidate) {
   if (!rootStat.isDirectory()) {
     throw new WorkerError("root_not_directory", "The exposed root must be a directory.");
   }
-  const filesystemRoot = path7.parse(root).root;
+  const filesystemRoot = path6.parse(root).root;
   const homes = await Promise.all(
     [os5.homedir(), accountHomeDirectory()].map(
-      async (home) => await realpath(home).catch(() => path7.resolve(home))
+      async (home) => await realpath(home).catch(() => path6.resolve(home))
     )
   );
   const isHomeDirectory = homes.some((home) => samePath(root, home));
@@ -50813,7 +50307,7 @@ var PathPolicy = class _PathPolicy {
     return canonical;
   }
   async resolveDiscoveredExisting(candidate) {
-    const lexical = path7.resolve(candidate);
+    const lexical = path6.resolve(candidate);
     if (!isWithin(this.root, lexical)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
@@ -50831,7 +50325,7 @@ var PathPolicy = class _PathPolicy {
   }
   async resolveWritableFile(relativePath) {
     const lexical = this.resolveLexical(relativePath);
-    const parent = path7.dirname(lexical);
+    const parent = path6.dirname(lexical);
     await this.rejectLinkedComponents(parent);
     const canonicalParent = await realpath(parent).catch((error46) => {
       if (error46.code === "ENOENT") {
@@ -50862,7 +50356,7 @@ var PathPolicy = class _PathPolicy {
       if (error46 instanceof WorkerError) throw error46;
       if (error46.code !== "ENOENT") throw error46;
     }
-    return path7.join(canonicalParent, path7.basename(lexical));
+    return path6.join(canonicalParent, path6.basename(lexical));
   }
   async resolveWritableDirectory(relativePath, recursive) {
     const lexical = this.resolveLexical(relativePath);
@@ -50885,7 +50379,7 @@ var PathPolicy = class _PathPolicy {
       if (error46.code !== "ENOENT") throw error46;
     }
     if (!recursive) {
-      const parent = path7.dirname(lexical);
+      const parent = path6.dirname(lexical);
       await this.rejectLinkedComponents(parent);
       const canonicalParent = await realpath(parent).catch(
         (error46) => {
@@ -50905,11 +50399,11 @@ var PathPolicy = class _PathPolicy {
         throw new WorkerError("not_directory", "The destination parent is not a directory.");
       }
       return {
-        target: path7.join(canonicalParent, path7.basename(lexical)),
+        target: path6.join(canonicalParent, path6.basename(lexical)),
         exists: false
       };
     }
-    let existingAncestor = path7.dirname(lexical);
+    let existingAncestor = path6.dirname(lexical);
     while (!samePath(existingAncestor, this.root)) {
       try {
         await this.rejectLinkedComponents(existingAncestor);
@@ -50921,9 +50415,9 @@ var PathPolicy = class _PathPolicy {
           throw new WorkerError("not_directory", "The destination parent is not a directory.");
         }
         return {
-          target: path7.join(
+          target: path6.join(
             canonicalAncestor,
-            path7.relative(existingAncestor, lexical)
+            path6.relative(existingAncestor, lexical)
           ),
           exists: false
         };
@@ -50931,13 +50425,13 @@ var PathPolicy = class _PathPolicy {
         if (error46 instanceof WorkerError) throw error46;
         if (error46.code !== "ENOENT") throw error46;
       }
-      existingAncestor = path7.dirname(existingAncestor);
+      existingAncestor = path6.dirname(existingAncestor);
     }
     return { target: lexical, exists: false };
   }
   async resolveVacantPath(relativePath) {
     const lexical = this.resolveLexical(relativePath);
-    const parent = path7.dirname(lexical);
+    const parent = path6.dirname(lexical);
     await this.rejectLinkedComponents(parent);
     const canonicalParent = await realpath(parent).catch(
       (error46) => {
@@ -50966,11 +50460,11 @@ var PathPolicy = class _PathPolicy {
       if (error46 instanceof WorkerError) throw error46;
       if (error46.code !== "ENOENT") throw error46;
     }
-    return path7.join(canonicalParent, path7.basename(lexical));
+    return path6.join(canonicalParent, path6.basename(lexical));
   }
   resolveLexical(relativePath) {
     const validated = validateRelativePath(relativePath);
-    const candidate = path7.resolve(this.root, validated);
+    const candidate = path6.resolve(this.root, validated);
     if (!isWithin(this.root, candidate)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
@@ -50980,11 +50474,11 @@ var PathPolicy = class _PathPolicy {
     if (!isWithin(this.root, candidate)) {
       throw new WorkerError("path_escape", "The requested path escapes the exposed root.");
     }
-    const relative = path7.relative(this.root, candidate);
+    const relative = path6.relative(this.root, candidate);
     if (!relative) return;
     let current = this.root;
-    for (const segment of relative.split(path7.sep)) {
-      current = path7.join(current, segment);
+    for (const segment of relative.split(path6.sep)) {
+      current = path6.join(current, segment);
       try {
         const currentStat = await lstat(current);
         if (currentStat.isSymbolicLink()) {
@@ -51006,13 +50500,25 @@ var PathPolicy = class _PathPolicy {
 function sha256(content) {
   return createHash("sha256").update(content).digest("hex");
 }
+function imageMimeType(content) {
+  if (content.byteLength >= 8 && content[0] === 137 && content[1] === 80 && content[2] === 78 && content[3] === 71 && content[4] === 13 && content[5] === 10 && content[6] === 26 && content[7] === 10) {
+    return "image/png";
+  }
+  if (content.byteLength >= 3 && content[0] === 255 && content[1] === 216 && content[2] === 255) {
+    return "image/jpeg";
+  }
+  if (content.byteLength >= 12 && content[0] === 82 && content[1] === 73 && content[2] === 70 && content[3] === 70 && content[8] === 87 && content[9] === 69 && content[10] === 66 && content[11] === 80) {
+    return "image/webp";
+  }
+  return void 0;
+}
 function isPathWithin(root, candidate) {
-  const relative = path8.relative(root, candidate);
-  return relative === "" || !relative.startsWith(`..${path8.sep}`) && relative !== ".." && !path8.isAbsolute(relative);
+  const relative = path7.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path7.sep}`) && relative !== ".." && !path7.isAbsolute(relative);
 }
 var fileWriteTails = /* @__PURE__ */ new Map();
 async function withFileWriteLock(target, operation) {
-  const normalized = path8.normalize(target);
+  const normalized = path7.normalize(target);
   const key = process.platform === "win32" ? normalized.toLowerCase() : normalized;
   const predecessor = fileWriteTails.get(key);
   let release;
@@ -51029,7 +50535,7 @@ async function withFileWriteLock(target, operation) {
   }
 }
 async function withFileWriteLocks(targets, operation) {
-  const unique = [...new Set(targets.map((target) => path8.normalize(target)))].sort(
+  const unique = [...new Set(targets.map((target) => path7.normalize(target)))].sort(
     (left, right) => left.localeCompare(right)
   );
   const run = async (index) => {
@@ -51065,7 +50571,7 @@ function compareNames(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
 function relativeSortKey(root, target) {
-  const relative = path8.relative(root, target);
+  const relative = path7.relative(root, target);
   if (!relative) return ".";
   return process.platform === "win32" ? relative.replaceAll("\\", "/") : relative;
 }
@@ -51413,6 +50919,43 @@ var FileService = class {
     const target = await this.policy.resolveExisting(relativePath);
     return await this.#readResolvedText(target);
   }
+  async readImage(relativePath) {
+    const target = await this.policy.resolveExisting(relativePath);
+    const targetStat = await stat3(target);
+    if (!targetStat.isFile()) {
+      throw new WorkerError("not_file", "The requested path is not a file.");
+    }
+    if (targetStat.size > MAX_IMAGE_BYTES) {
+      throw new WorkerError(
+        "image_too_large",
+        "The image exceeds the 4 MiB image limit."
+      );
+    }
+    const content = await this.#readFileBytes(
+      target,
+      MAX_IMAGE_BYTES,
+      targetStat.size
+    );
+    if (content.byteLength > MAX_IMAGE_BYTES) {
+      throw new WorkerError(
+        "image_too_large",
+        "The image exceeds the 4 MiB image limit."
+      );
+    }
+    const mimeType = imageMimeType(content);
+    if (!mimeType) {
+      throw new WorkerError(
+        "unsupported_image",
+        "Only PNG, JPEG, and WebP images are supported."
+      );
+    }
+    return {
+      data: content.toString("base64"),
+      mimeType,
+      sha256: sha256(content),
+      bytes: content.byteLength
+    };
+  }
   async listFiles(options = {}) {
     const deadlineAt = this.#scanDeadline(options.timeoutMs);
     const startPath = options.path ?? ".";
@@ -51449,7 +50992,7 @@ var FileService = class {
       if (batch.overflow) throw scanLimitError();
       scannedEntries += batch.children.length;
       for (const child of batch.children) {
-        const target = path8.join(directory, child.name);
+        const target = path7.join(directory, child.name);
         heapPush(frontier, {
           target,
           sortKey: relativeSortKey(this.policy.root, target),
@@ -51473,7 +51016,7 @@ var FileService = class {
             throw scanLimitError();
           }
           scannedEntries += 1;
-          const target = path8.join(directory, child.name);
+          const target = path7.join(directory, child.name);
           let childStat;
           try {
             childStat = await this.#withinDeadline(
@@ -51625,7 +51168,7 @@ var FileService = class {
       if (!patterns) return false;
       const normalized = relativePath.replaceAll("\\", "/");
       try {
-        return patterns.some((pattern) => path8.posix.matchesGlob(normalized, pattern));
+        return patterns.some((pattern) => path7.posix.matchesGlob(normalized, pattern));
       } catch {
         throw new WorkerError("invalid_search", "Search glob pattern is invalid.");
       }
@@ -51654,7 +51197,7 @@ var FileService = class {
     const searchFile = async (target) => {
       const relative = displayPath(this.policy.root, target);
       if (extensions && !extensions.some(
-        (extension) => path8.basename(target).toLowerCase().endsWith(extension)
+        (extension) => path7.basename(target).toLowerCase().endsWith(extension)
       )) {
         return false;
       }
@@ -51749,7 +51292,7 @@ var FileService = class {
       scannedEntries += batch.children.length;
       for (const child of batch.children) {
         this.#assertBeforeDeadline(deadlineAt);
-        const target = path8.join(directory, child.name);
+        const target = path7.join(directory, child.name);
         let targetType;
         if (this.#trustDirectoryEntryTypes) {
           if (child.isSymbolicLink()) {
@@ -52059,7 +51602,7 @@ var FileService = class {
         );
       }
       if (expectedSha256) await requireRevision(target, expectedSha256);
-      const temporary = path8.join(path8.dirname(target), `.glossa-${randomUUID4()}.tmp`);
+      const temporary = path7.join(path7.dirname(target), `.glossa-${randomUUID4()}.tmp`);
       try {
         await writeFile5(temporary, bytes, { flag: "wx", mode: 384 });
         target = await this.policy.resolveWritableFile(relativePath);
@@ -52104,6 +51647,7 @@ function restrictedDataError2() {
 function jobInputContainsRestrictedData(job) {
   switch (job.type) {
     case "read_file":
+    case "view_image":
       return containsRestrictedAuthenticationData(job.path);
     case "list_files":
       return containsRestrictedAuthenticationData({
@@ -52194,6 +51738,9 @@ var LocalWorker = class _LocalWorker {
         case "read_file":
           value = await this.files.readText(job.path);
           break;
+        case "view_image":
+          value = await this.files.readImage(job.path);
+          break;
         case "list_files":
           value = await this.files.listFiles({
             ...job.path ? { path: job.path } : {},
@@ -52307,18 +51854,29 @@ var DEFAULT_HEARTBEAT_MS = 15e3;
 var CAPACITY_REFRESH_POLL_MS = 1;
 var MAX_CONCURRENT_JOBS = 5;
 var WORKER_TOKEN_PATTERN = /^glw_[A-Za-z0-9_-]{43}$/;
+var LEGACY_WORKER_CAPABILITIES = {
+  commandProgress: true,
+  concurrentJobs: true,
+  structuredReads: true,
+  structuredMutations: true,
+  commandOutputRanges: true
+};
+var WORKER_CAPABILITIES = {
+  ...LEGACY_WORKER_CAPABILITIES,
+  imageReads: true
+};
 var DeviceRejectedError = class extends Error {
   constructor() {
     super("The relay rejected the device credential.");
     this.name = "DeviceRejectedError";
   }
 };
-var RelayAccessProfileUnsupportedError = class extends Error {
-  constructor(profile) {
+var RelayProtocolUnsupportedError = class extends Error {
+  constructor() {
     super(
-      `The relay needs an update before it can represent ${profile} access. Update the relay before reconnecting this workspace.`
+      "The relay does not support this Glossa worker protocol. Update the relay before reconnecting this workspace."
     );
-    this.name = "RelayAccessProfileUnsupportedError";
+    this.name = "RelayProtocolUnsupportedError";
   }
 };
 var RelayResponseError = class extends Error {
@@ -52329,19 +51887,24 @@ var RelayResponseError = class extends Error {
   }
   status;
 };
-function optionalWorkerToken(value) {
-  if (value === void 0) return void 0;
+function requiredWorkerToken(value) {
   if (typeof value !== "string" || !WORKER_TOKEN_PATTERN.test(value)) {
     throw new Error("The relay returned an invalid worker credential.");
   }
   return value;
 }
-function supportsCapability(value, capability) {
+function acceptsCapabilities(value, requireImageReads) {
   if (typeof value !== "object" || value === null) return false;
   if (!("capabilities" in value)) return false;
   const capabilities = value.capabilities;
   if (typeof capabilities !== "object" || capabilities === null) return false;
-  return capabilities[capability] === true;
+  const required2 = Object.keys(LEGACY_WORKER_CAPABILITIES);
+  if (!required2.every(
+    (capability) => capabilities[capability] === true
+  )) {
+    return false;
+  }
+  return !requireImageReads || capabilities.imageReads === true;
 }
 function jobLane(job) {
   switch (job.type) {
@@ -52351,6 +51914,7 @@ function jobLane(job) {
     case "cancel_command":
       return "cancel";
     case "read_file":
+    case "view_image":
     case "list_files":
     case "search_text":
     case "read_file_range":
@@ -52364,25 +51928,27 @@ function jobLane(job) {
       return "mutation";
   }
 }
-function acceptedJobTypes(counts, total, structuredReads, structuredMutations, commandOutputRanges) {
+function acceptedJobTypes(counts, total, imageReads) {
   if (total >= MAX_CONCURRENT_JOBS) return [];
   const accepted = [];
   if (counts.status < 1) {
-    accepted.push("get_command");
-    if (commandOutputRanges) accepted.push("read_command_output");
+    accepted.push("get_command", "read_command_output");
   }
   if (counts.cancel < 1) accepted.push("cancel_command");
   if (counts.read < 2) {
     accepted.push("read_file");
-    if (structuredReads) {
-      accepted.push("list_files", "search_text", "read_file_range");
-    }
+    if (imageReads) accepted.push("view_image");
+    accepted.push("list_files", "search_text", "read_file_range");
   }
   if (counts.mutation < 1) {
-    accepted.push("write_file", "edit_file", "run_command");
-    if (structuredMutations) {
-      accepted.push("make_directory", "delete_path", "move_path");
-    }
+    accepted.push(
+      "write_file",
+      "edit_file",
+      "make_directory",
+      "delete_path",
+      "move_path",
+      "run_command"
+    );
   }
   return accepted;
 }
@@ -52424,7 +51990,7 @@ var RemoteWorker = class {
   constructor(options) {
     this.#origin = new URL(options.origin);
     this.#deviceToken = options.deviceToken;
-    this.#accessProfile = options.accessProfile;
+    this.#accessProfile = options.accessProfile ?? "workspace";
     this.#workspaceLabel = options.workspaceLabel;
     this.#workerVersion = options.workerVersion;
     this.#worker = options.worker;
@@ -52450,17 +52016,14 @@ var RemoteWorker = class {
           registeredSession = session;
           this.#onStatus({
             state: "connected",
-            reconnected: connectedBefore,
-            legacyRelay: session.legacyRelay,
-            accessProfileAccepted: session.accessProfileAccepted,
-            workspaceLabelAccepted: session.workspaceLabelAccepted
+            reconnected: connectedBefore
           });
           connectedBefore = true;
           failures = 0;
           await this.#pollGeneration(session);
         } catch (error46) {
           if (this.#signal.aborted) return;
-          if (error46 instanceof DeviceRejectedError || error46 instanceof RelayAccessProfileUnsupportedError) {
+          if (error46 instanceof DeviceRejectedError || error46 instanceof RelayProtocolUnsupportedError) {
             throw error46;
           }
           const delay5 = reconnectDelayMs(
@@ -52489,153 +52052,50 @@ var RemoteWorker = class {
     }
   }
   async #register() {
-    const currentBody = {
+    const registrationBody = (capabilities) => ({
       workerId: this.#workerId,
-      capabilities: {
-        commandProgress: true,
-        concurrentJobs: true,
-        structuredReads: true,
-        structuredMutations: true,
-        commandOutputRanges: true
-      }
-    };
-    const mutationBody = {
-      workerId: this.#workerId,
-      capabilities: {
-        commandProgress: true,
-        concurrentJobs: true,
-        structuredReads: true,
-        structuredMutations: true
-      }
-    };
-    const structuredBody = {
-      workerId: this.#workerId,
-      capabilities: {
-        commandProgress: true,
-        concurrentJobs: true,
-        structuredReads: true
-      }
-    };
-    const concurrentBody = {
-      workerId: this.#workerId,
-      capabilities: { commandProgress: true, concurrentJobs: true }
-    };
-    const capabilityBodies = [
-      currentBody,
-      mutationBody,
-      structuredBody,
-      concurrentBody,
-      {
-        workerId: this.#workerId,
-        capabilities: { commandProgress: true }
-      },
-      { workerId: this.#workerId }
-    ];
-    const metadataPhases = [
-      {
-        includeVersion: Boolean(this.#workerVersion),
-        includeLabel: Boolean(this.#workspaceLabel)
-      },
-      ...this.#workspaceLabel ? [{
-        includeVersion: Boolean(this.#workerVersion),
-        includeLabel: false
-      }] : [],
-      ...this.#workerVersion && this.#workspaceLabel ? [{ includeVersion: false, includeLabel: true }] : [],
-      { includeVersion: false, includeLabel: false }
-    ];
-    const attempts = [];
-    const seenAttempts = /* @__PURE__ */ new Set();
-    const pushAttempt = (base, includeProfile, includeVersion, includeLabel, legacyRelay = false) => {
-      const body = {
-        ...base,
-        ...includeProfile && this.#accessProfile ? { accessProfile: this.#accessProfile } : {},
-        ...includeVersion && this.#workerVersion ? { workerVersion: this.#workerVersion } : {},
-        ...includeLabel && this.#workspaceLabel ? { workspaceLabel: this.#workspaceLabel } : {}
-      };
-      const key = JSON.stringify(body);
-      if (seenAttempts.has(key)) return;
-      seenAttempts.add(key);
-      attempts.push({ body, legacyRelay });
-    };
-    if (this.#accessProfile) {
-      for (const metadata of metadataPhases) {
-        for (const body of capabilityBodies) {
-          pushAttempt(
-            body,
-            true,
-            metadata.includeVersion,
-            metadata.includeLabel
-          );
-        }
-      }
-    }
-    if (this.#accessProfile === void 0 || this.#accessProfile === "system") {
-      for (const metadata of metadataPhases) {
-        for (const body of capabilityBodies) {
-          pushAttempt(
-            body,
-            false,
-            metadata.includeVersion,
-            metadata.includeLabel
-          );
-        }
+      accessProfile: this.#accessProfile,
+      ...this.#workerVersion ? { workerVersion: this.#workerVersion } : {},
+      ...this.#workspaceLabel ? { workspaceLabel: this.#workspaceLabel } : {},
+      capabilities
+    });
+    let response;
+    let imageReads = true;
+    try {
+      response = await this.#post(
+        "/device/register",
+        registrationBody(WORKER_CAPABILITIES)
+      );
+    } catch (error46) {
+      if (!(error46 instanceof RelayResponseError) || error46.status !== 400) {
+        throw error46;
       }
-      attempts.push({ body: {}, legacyRelay: true });
-    }
-    for (const attempt of attempts) {
-      let response;
+      imageReads = false;
       try {
-        response = await this.#post("/device/register", attempt.body);
-      } catch (error46) {
-        if (error46 instanceof RelayResponseError && error46.status === 400) {
-          continue;
+        response = await this.#post(
+          "/device/register",
+          registrationBody(LEGACY_WORKER_CAPABILITIES)
+        );
+      } catch (legacyError) {
+        if (legacyError instanceof RelayResponseError && legacyError.status === 400) {
+          throw new RelayProtocolUnsupportedError();
         }
-        throw error46;
-      }
-      const value = await response.json();
-      if (typeof value !== "object" || value === null || !("generation" in value) || typeof value.generation !== "string") {
-        throw new Error("The relay returned an invalid registration response.");
-      }
-      if (!attempt.legacyRelay && (!("workerId" in value) || value.workerId !== this.#workerId)) {
-        throw new Error("The relay returned an invalid registration response.");
-      }
-      const workerToken = "workerToken" in value ? optionalWorkerToken(value.workerToken) : void 0;
-      const accessProfileAccepted = this.#accessProfile === void 0 || this.#accessProfile === "system" || "accessProfile" in value && value.accessProfile === this.#accessProfile;
-      const session = {
-        generation: value.generation,
-        legacyRelay: attempt.legacyRelay,
-        concurrentJobs: !attempt.legacyRelay && supportsCapability(value, "concurrentJobs"),
-        structuredReads: !attempt.legacyRelay && supportsCapability(value, "structuredReads"),
-        structuredMutations: !attempt.legacyRelay && supportsCapability(value, "structuredMutations"),
-        commandOutputRanges: !attempt.legacyRelay && supportsCapability(value, "commandOutputRanges"),
-        accessProfileAccepted,
-        workspaceLabelAccepted: this.#workspaceLabel === void 0 || "workspaceLabel" in value && value.workspaceLabel === this.#workspaceLabel,
-        ...workerToken ? { workerToken } : {}
-      };
-      if (!accessProfileAccepted && this.#accessProfile) {
-        throw new RelayAccessProfileUnsupportedError(this.#accessProfile);
+        throw legacyError;
       }
-      return session;
     }
-    if (this.#accessProfile && this.#accessProfile !== "system") {
-      throw new RelayAccessProfileUnsupportedError(this.#accessProfile);
+    const value = await response.json();
+    if (typeof value !== "object" || value === null || !("generation" in value) || typeof value.generation !== "string" || !("workerId" in value) || value.workerId !== this.#workerId || !("workerToken" in value) || !("accessProfile" in value) || value.accessProfile !== this.#accessProfile || !acceptsCapabilities(value, imageReads) || this.#workspaceLabel !== void 0 && (!("workspaceLabel" in value) || value.workspaceLabel !== this.#workspaceLabel)) {
+      throw new RelayProtocolUnsupportedError();
     }
-    throw new Error("The relay rejected every supported registration shape.");
+    return {
+      generation: value.generation,
+      workerToken: requiredWorkerToken(value.workerToken),
+      imageReads
+    };
   }
   async #pollGeneration(session) {
-    if (session.legacyRelay || !session.concurrentJobs) {
-      await this.#pollSequentially(session);
-      return;
-    }
     await this.#pollConcurrently(session);
   }
-  async #pollSequentially(session) {
-    while (!this.#signal.aborted) {
-      const job = await this.#pollForJob(session);
-      if (!job) continue;
-      await this.#handleAndPost(session, job, true);
-    }
-  }
   async #pollConcurrently(session) {
     const counts = {
       status: 0,
@@ -52693,7 +52153,7 @@ var RemoteWorker = class {
       counts[lane] += 1;
       ensureHeartbeat();
       let task;
-      task = this.#handleAndPost(session, job, false).catch((error46) => {
+      task = this.#handleAndPost(session, job).catch((error46) => {
         failure ??= error46;
       }).finally(() => {
         counts[lane] -= 1;
@@ -52709,9 +52169,7 @@ var RemoteWorker = class {
         const acceptedTypes = acceptedJobTypes(
           counts,
           inFlight.size,
-          session.structuredReads,
-          session.structuredMutations,
-          session.commandOutputRanges
+          session.imageReads
         );
         if (acceptedTypes.length === 0) {
           await Promise.race(inFlight);
@@ -52741,9 +52199,7 @@ var RemoteWorker = class {
           const refreshedTypes = acceptedJobTypes(
             counts,
             inFlight.size,
-            session.structuredReads,
-            session.structuredMutations,
-            session.commandOutputRanges
+            session.imageReads
           );
           const newlyAcceptedTypes = refreshedTypes.filter(
             (type) => !acceptedTypes.includes(type)
@@ -52783,7 +52239,7 @@ var RemoteWorker = class {
   async #pollForJob(session, acceptedTypes, waitMs) {
     const response = await this.#post(
       "/device/poll",
-      session.legacyRelay ? { generation: session.generation } : {
+      {
         workerId: this.#workerId,
         generation: session.generation,
         ...acceptedTypes ? { acceptedTypes } : {},
@@ -52801,26 +52257,12 @@ var RemoteWorker = class {
     }
     return parsed.data;
   }
-  async #handleAndPost(session, job, heartbeatWhileRunning) {
-    const heartbeat = heartbeatWhileRunning && !session.legacyRelay ? setInterval(() => {
-      void this.#post(
-        "/device/heartbeat",
-        { workerId: this.#workerId, generation: session.generation },
-        session.workerToken
-      ).catch(() => {
-      });
-    }, this.#heartbeatMs) : void 0;
-    heartbeat?.unref();
-    let result;
-    try {
-      result = await this.#worker.handle(job);
-    } finally {
-      if (heartbeat) clearInterval(heartbeat);
-    }
+  async #handleAndPost(session, job) {
+    const result = await this.#worker.handle(job);
     try {
       await this.#post(
         "/device/result",
-        session.legacyRelay ? result : { workerId: this.#workerId, result },
+        { workerId: this.#workerId, result },
         session.workerToken
       );
     } catch (error46) {
@@ -52829,39 +52271,24 @@ var RemoteWorker = class {
     }
   }
   async #unregister(session) {
-    const unregister = async (authorization) => {
-      try {
-        const response = await this.#fetcher(
-          new URL("/device/unregister", this.#origin),
-          {
-            method: "POST",
-            headers: {
-              authorization,
-              "content-type": "application/json"
-            },
-            body: JSON.stringify({ workerId: this.#workerId }),
-            signal: AbortSignal.timeout(3e3)
-          }
-        );
-        if (response.ok) return "accepted";
-        return [400, 401, 404, 409].includes(response.status) ? "rejected" : "unreachable";
-      } catch {
-        return "unreachable";
-      }
-    };
-    if (!session?.workerToken) {
-      await unregister(`Device ${this.#deviceToken}`);
-      return;
-    }
-    const result = await unregister(`Worker ${session.workerToken}`);
-    if (result === "rejected") {
-      await unregister(`Device ${this.#deviceToken}`);
+    if (!session) return;
+    try {
+      await this.#fetcher(new URL("/device/unregister", this.#origin), {
+        method: "POST",
+        headers: {
+          authorization: `Worker ${session.workerToken}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({ workerId: this.#workerId }),
+        signal: AbortSignal.timeout(3e3)
+      });
+    } catch {
     }
   }
-  async #post(path14, body, workerToken) {
+  async #post(path12, body, workerToken) {
     const timeout = AbortSignal.timeout(WORKER_REQUEST_TIMEOUT_MS);
     const signal = AbortSignal.any([this.#signal, timeout]);
-    const response = await this.#fetcher(new URL(path14, this.#origin), {
+    const response = await this.#fetcher(new URL(path12, this.#origin), {
       method: "POST",
       headers: {
         authorization: workerToken ? `Worker ${workerToken}` : `Device ${this.#deviceToken}`,
@@ -52892,6 +52319,7 @@ function activitySafeJob(job) {
   if (!containsRestrictedAuthenticationData(job)) return job;
   switch (job.type) {
     case "read_file":
+    case "view_image":
       return { ...job, path: "[restricted input blocked]" };
     case "list_files":
       return {
@@ -53018,27 +52446,6 @@ function accessProfileSummary(accessProfile) {
       return "System access: clients can modify files and run commands with this account's full environment, permissions, credentials, and network access.";
   }
 }
-function accessProfileNotice(status, requestedProfile) {
-  if (status.state !== "connected" || !requestedProfile || status.accessProfileAccepted !== false) {
-    return void 0;
-  }
-  return "The relay needs an update before this access profile can be shown to connected clients. Local profile enforcement remains active.";
-}
-function workspaceLabelNotice(status, requestedLabel) {
-  if (status.state !== "connected" || !requestedLabel || status.workspaceLabelAccepted !== false) {
-    return void 0;
-  }
-  return "The relay needs an update before workspace labels are available. This workspace is online without the requested label.";
-}
-var legacyRelayNotice = "The relay needs an update before this computer can expose several workspaces at once.";
-function combinedCompatibilityNotice(labelNotice, profileNotice, includeLegacyRelayNotice) {
-  const messages = [
-    labelNotice,
-    profileNotice,
-    includeLegacyRelayNotice ? legacyRelayNotice : void 0
-  ].filter((message) => Boolean(message));
-  return messages.length > 0 ? messages.join(" ") : void 0;
-}
 function statusMessage(status, connectedBefore) {
   if (status.state === "connecting") return "Connecting to Glossa...";
   if (status.state === "connected") {
@@ -53053,15 +52460,12 @@ function statusMessage(status, connectedBefore) {
 async function connectRemoteWorker(endpoints, device, worker, options, signal, onConnected) {
   let connectionState;
   let connectedBefore = false;
-  let labelNoticeShown = false;
-  let profileNoticeShown = false;
-  let legacyNoticeShown = false;
   let connectHintTask;
   const remoteWorker = new RemoteWorker({
     origin: endpoints.workerOrigin,
     deviceToken: device.token,
     ...options.workerVersion ? { workerVersion: options.workerVersion } : {},
-    ...options.accessProfile ? { accessProfile: options.accessProfile } : {},
+    accessProfile: options.accessProfile ?? DEFAULT_WORKER_ACCESS_PROFILE,
     ...options.workspaceLabel ? { workspaceLabel: options.workspaceLabel } : {},
     worker: visibleWorker(worker, options),
     signal,
@@ -53075,25 +52479,7 @@ async function connectRemoteWorker(endpoints, device, worker, options, signal, o
       } else {
         options.onEvent?.({ type: "status", status });
       }
-      const labelNotice = labelNoticeShown ? void 0 : workspaceLabelNotice(status, options.workspaceLabel);
-      const profileNotice = profileNoticeShown ? void 0 : accessProfileNotice(status, options.accessProfile);
-      const includeLegacyNotice = status.state === "connected" && status.legacyRelay && !legacyNoticeShown;
-      const compatibilityNotice = combinedCompatibilityNotice(
-        labelNotice,
-        profileNotice,
-        includeLegacyNotice
-      );
-      if (labelNotice) labelNoticeShown = true;
-      if (profileNotice) profileNoticeShown = true;
-      if (includeLegacyNotice) legacyNoticeShown = true;
-      if (compatibilityNotice) {
-        report(
-          options,
-          { type: "notice", message: compatibilityNotice },
-          compatibilityNotice
-        );
-      }
-      if (status.state === "connected" && !status.reconnected && !compatibilityNotice && shouldShowConnectHint(endpoints.relayOrigin) && !connectHintTask) {
+      if (status.state === "connected" && !status.reconnected && shouldShowConnectHint(endpoints.relayOrigin) && !connectHintTask) {
         connectHintTask = announceConnectHint(
           connectHintStore(),
           (message) => {
@@ -53197,7 +52583,7 @@ function initialHudState(workspace) {
     notice: void 0
   };
 }
-var MAX_STORED_ACTIVITIES = 999;
+var MAX_STORED_ACTIVITIES = 9999;
 var MAX_STORED_ACTIVITY_TARGET_CHARS = 512;
 function truncate(value, width) {
   if (width <= 0) return "";
@@ -53258,12 +52644,12 @@ function formatByteCount(value) {
   }
   return `${(kibibytes / 1024).toFixed(1)} MiB`;
 }
-function workspacePath(path14) {
-  return path14 || ".";
+function workspacePath(path12) {
+  return path12 || ".";
 }
-function pathSummary(path14, details = []) {
+function pathSummary(path12, details = []) {
   return {
-    target: `path ${quoteActivityInput(path14)}`,
+    target: `path ${quoteActivityInput(path12)}`,
     details,
     truncation: "middle"
   };
@@ -53274,6 +52660,7 @@ function assertNever2(_value) {
 function summarizeJob(job) {
   switch (job.type) {
     case "read_file":
+    case "view_image":
       return pathSummary(job.path);
     case "list_files":
       return pathSummary(workspacePath(job.path), [
@@ -53555,7 +52942,6 @@ function primaryFooterHints() {
     { key: "W", label: "Workspace" },
     { key: "D", label: "Devices" },
     { key: "?", label: "Help" },
-    { key: "L", label: "Account sign out", tone: COLORS.coral },
     { key: "Q", label: "Quit", tone: COLORS.coral }
   ];
 }
@@ -53626,12 +53012,6 @@ function buildFooterRows(state, usable) {
 function promptText(state) {
   if (state.busy) return { message: "Working\u2026" };
   if (!state.prompt) return void 0;
-  if (state.prompt.type === "logout") {
-    return {
-      message: "Sign out the CLI account and disconnect? Computer pairing stays active.",
-      choices: "Y confirm  N cancel"
-    };
-  }
   if (state.prompt.type === "access-confirm") {
     const detail = state.prompt.accessProfile === "system" ? "Commands will inherit this OS account's permissions." : "This allows guarded file writes.";
     return {
@@ -53918,7 +53298,7 @@ function DevicesView({ state, usable, bodyBudget, color }) {
   const devices = state.status?.devices.slice(window2.start, window2.end) ?? [];
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, { height: bodyBudget, flexDirection: "column", flexShrink: 0, overflow: "hidden", children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, children: "Account" }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, children: "Paired" }),
     state.statusLoading ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, children: "Loading devices\u2026" })
@@ -53926,7 +53306,7 @@ function DevicesView({ state, usable, bodyBudget, color }) {
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, children: "Devices are not loaded." })
     ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.ink : void 0, wrap: "truncate", children: state.status.account }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.ink : void 0, wrap: "truncate", children: state.deviceName ?? "This computer" }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text2, { color: color ? COLORS.muted : void 0, wrap: "truncate", children: state.status.relay }),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, children: "Overview" }),
@@ -53978,7 +53358,6 @@ function HelpView({ bodyBudget, color }) {
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, tone: COLORS.coral, children: "Manage" }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "\u2190/\u2192", label: "Change workspace access", color, tone: COLORS.coral }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "Enter/R", label: "Revoke selected device", color, tone: COLORS.coral }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "L", label: "Account sign out", color, tone: COLORS.coral }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Blank, {}),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SectionTitle, { color, children: "App" }),
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HelpRow, { keyLabel: "Q", label: "Disconnect and quit", color, tone: COLORS.coral }),
@@ -54067,9 +53446,9 @@ function HudScreen({ state, columns, rows, color = true, now = Date.now() }) {
   ] });
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, { width: Math.max(8, columns), height: Math.max(6, rows), flexDirection: "column", children: margin > 0 ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Box_default, { marginLeft: margin, children: inner }) : inner });
 }
-async function loadDevices(store3, actions, signal) {
-  const current = store3.getSnapshot();
-  store3.update((state) => ({
+async function loadDevices(store2, actions, signal) {
+  const current = store2.getSnapshot();
+  store2.update((state) => ({
     ...state,
     view: "devices",
     prompt: void 0,
@@ -54077,20 +53456,20 @@ async function loadDevices(store3, actions, signal) {
   }));
   if (current.statusLoading) return;
   if (current.connection !== "connected" && current.connection !== "retrying") {
-    store3.update((state) => ({
+    store2.update((state) => ({
       ...state,
       notice: "Devices are available after Glossa connects."
     }));
     return;
   }
-  store3.update((state) => ({
+  store2.update((state) => ({
     ...state,
     statusLoading: true
   }));
   try {
     const status = await actions.loadStatus(signal);
     if (signal.aborted) return;
-    store3.update((state) => ({
+    store2.update((state) => ({
       ...state,
       status,
       deviceSelection: Math.min(
@@ -54101,24 +53480,24 @@ async function loadDevices(store3, actions, signal) {
     }));
   } catch (error46) {
     if (signal.aborted) return;
-    store3.update((state) => ({
+    store2.update((state) => ({
       ...state,
       statusLoading: false,
       notice: error46 instanceof Error ? error46.message : String(error46)
     }));
   }
 }
-function beginAccessChange(store3, actions, accessProfile) {
+function beginAccessChange(store2, actions, accessProfile) {
   actions.changeAccessProfile(accessProfile);
-  store3.update((state) => ({
+  store2.update((state) => ({
     ...state,
     pendingAccessProfile: accessProfile,
     prompt: void 0,
     notice: void 0
   }));
 }
-function HudRuntime({ store: store3, actions, signal, stop }) {
-  const state = (0, import_react34.useSyncExternalStore)(store3.subscribe, store3.getSnapshot, store3.getSnapshot);
+function HudRuntime({ store: store2, actions, signal, stop }) {
+  const state = (0, import_react34.useSyncExternalStore)(store2.subscribe, store2.getSnapshot, store2.getSnapshot);
   const { columns, rows } = use_window_size_default();
   const [, setClock] = (0, import_react34.useState)(0);
   (0, import_react34.useEffect)(() => {
@@ -54127,7 +53506,7 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
     return () => clearInterval(timer);
   }, [state.view, state.activities.length]);
   (0, import_react34.useEffect)(() => {
-    store3.update((current) => {
+    store2.update((current) => {
       let next = current;
       const metrics = screenMetrics(current, columns, rows);
       if (current.view === "activity") {
@@ -54149,9 +53528,9 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
       }
       return next;
     });
-  }, [columns, rows, store3]);
+  }, [columns, rows, store2]);
   use_input_default((input, key) => {
-    const current = store3.getSnapshot();
+    const current = store2.getSnapshot();
     const value = input.toLowerCase();
     if (key.ctrl && value === "c" || value === "q") {
       stop();
@@ -54160,21 +53539,17 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
     if (current.busy) return;
     if (current.prompt) {
       if (key.escape || value === "n") {
-        store3.update((state2) => ({ ...state2, prompt: void 0, notice: void 0 }));
+        store2.update((state2) => ({ ...state2, prompt: void 0, notice: void 0 }));
         return;
       }
       if (value !== "y") return;
-      if (current.prompt.type === "logout") {
-        stop("logout");
-        return;
-      }
       if (current.prompt.type === "access-confirm") {
-        beginAccessChange(store3, actions, current.prompt.accessProfile);
+        beginAccessChange(store2, actions, current.prompt.accessProfile);
         return;
       }
       const device = current.status?.devices[current.prompt.deviceIndex];
       if (!device) return;
-      store3.update((state2) => ({
+      store2.update((state2) => ({
         ...state2,
         busy: true,
         prompt: void 0,
@@ -54182,13 +53557,13 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
       }));
       void actions.revokeDevice(device.id, signal).then(async () => {
         if (signal.aborted) return;
-        store3.update((state2) => ({ ...state2, busy: false }));
-        await loadDevices(store3, actions, signal);
+        store2.update((state2) => ({ ...state2, busy: false }));
+        await loadDevices(store2, actions, signal);
         if (signal.aborted) return;
-        store3.update((state2) => ({ ...state2, notice: `Revoked ${device.name}.` }));
+        store2.update((state2) => ({ ...state2, notice: `Revoked ${device.name}.` }));
       }).catch((error46) => {
         if (signal.aborted) return;
-        store3.update((state2) => ({
+        store2.update((state2) => ({
           ...state2,
           busy: false,
           notice: error46 instanceof Error ? error46.message : String(error46)
@@ -54202,7 +53577,7 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
       const maxPage = activityMaxPage(current.activities.length, capacity);
       const page = key.upArrow ? Math.min(maxPage, current.activityPage + 1) : Math.max(0, current.activityPage - 1);
       if (page !== current.activityPage) {
-        store3.update((state2) => ({ ...state2, activityPage: page }));
+        store2.update((state2) => ({ ...state2, activityPage: page }));
       }
       return;
     }
@@ -54214,7 +53589,7 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
       }
       const selection = key.upArrow ? Math.max(0, current.deviceSelection - 1) : Math.min(total - 1, current.deviceSelection + 1);
       if (selection !== current.deviceSelection) {
-        store3.update((state2) => ({ ...state2, deviceSelection: selection, notice: void 0 }));
+        store2.update((state2) => ({ ...state2, deviceSelection: selection, notice: void 0 }));
       }
       return;
     }
@@ -54223,9 +53598,9 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
       const accessProfile = adjacentAccessProfile(current.accessProfile, direction);
       if (!accessProfile) return;
       if (direction < 0) {
-        beginAccessChange(store3, actions, accessProfile);
+        beginAccessChange(store2, actions, accessProfile);
       } else {
-        store3.update((state2) => ({
+        store2.update((state2) => ({
           ...state2,
           prompt: { type: "access-confirm", accessProfile },
           notice: void 0
@@ -54234,11 +53609,11 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
       return;
     }
     if (key.escape) {
-      store3.update((state2) => ({ ...state2, view: "workspace", notice: void 0 }));
+      store2.update((state2) => ({ ...state2, view: "workspace", notice: void 0 }));
       return;
     }
     if (value === "a") {
-      store3.update((state2) => ({
+      store2.update((state2) => ({
         ...state2,
         view: "activity",
         activityPage: current.view === "activity" ? state2.activityPage : 0,
@@ -54247,7 +53622,7 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
       return;
     }
     if (value === "w") {
-      store3.update((state2) => ({
+      store2.update((state2) => ({
         ...state2,
         view: "workspace",
         prompt: void 0,
@@ -54257,27 +53632,27 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
     }
     if (value === "d") {
       if (current.status) {
-        store3.update((state2) => ({
+        store2.update((state2) => ({
           ...state2,
           view: "devices",
           prompt: void 0,
           notice: void 0
         }));
       } else {
-        void loadDevices(store3, actions, signal);
+        void loadDevices(store2, actions, signal);
       }
       return;
     }
     if ((key.return || input === "\r" || input === "\n" || value === "r") && current.view === "devices") {
       const count = current.status?.devices.length ?? 0;
       if (count === 0) {
-        store3.update((state2) => ({ ...state2, notice: "There are no devices to revoke." }));
+        store2.update((state2) => ({ ...state2, notice: "There are no devices to revoke." }));
         return;
       }
       const metrics = screenMetrics(current, columns, rows);
       const capacity = statusDeviceCapacity(current, metrics.bodyBudget, metrics.usable);
       const selection = Math.min(current.deviceSelection, count - 1);
-      store3.update((state2) => capacity === 0 ? { ...state2, notice: "Increase the terminal height to choose a device." } : {
+      store2.update((state2) => capacity === 0 ? { ...state2, notice: "Increase the terminal height to choose a device." } : {
         ...state2,
         deviceSelection: selection,
         prompt: { type: "revoke-confirm", deviceIndex: selection },
@@ -54285,16 +53660,8 @@ function HudRuntime({ store: store3, actions, signal, stop }) {
       });
       return;
     }
-    if (value === "l") {
-      store3.update((state2) => ({
-        ...state2,
-        prompt: { type: "logout" },
-        notice: void 0
-      }));
-      return;
-    }
     if (input === "?") {
-      store3.update((state2) => ({
+      store2.update((state2) => ({
         ...state2,
         view: "help",
         notice: void 0
@@ -54317,11 +53684,9 @@ async function runSessionHud(actions, input = process.stdin, output = process.st
     throw new Error("Glossa requires an interactive terminal.");
   }
   const controller = new AbortController();
-  const store3 = new HudStore(actions.workspace);
-  let exitAction = "quit";
+  const store2 = new HudStore(actions.workspace);
   let instance;
-  const stop = (action = "quit") => {
-    exitAction = action;
+  const stop = () => {
     controller.abort();
     instance?.unmount();
   };
@@ -54333,7 +53698,7 @@ async function runSessionHud(actions, input = process.stdin, output = process.st
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
       HudRuntime,
       {
-        store: store3,
+        store: store2,
         actions,
         signal: controller.signal,
         stop
@@ -54350,13 +53715,13 @@ async function runSessionHud(actions, input = process.stdin, output = process.st
       maxFps: 30
     }
   );
-  const session = actions.run(controller.signal, (event) => store3.event(event)).then(() => {
+  const session = actions.run(controller.signal, (event) => store2.event(event)).then(() => {
     if (!controller.signal.aborted) {
-      store3.update((state) => ({ ...state, connection: "disconnected" }));
+      store2.update((state) => ({ ...state, connection: "disconnected" }));
     }
   }).catch((error46) => {
     if (!controller.signal.aborted) {
-      store3.update((state) => ({
+      store2.update((state) => ({
         ...state,
         connection: "error",
         message: error46 instanceof Error ? error46.message : String(error46)
@@ -54369,7 +53734,6 @@ async function runSessionHud(actions, input = process.stdin, output = process.st
   try {
     await instance.waitUntilExit();
     await session;
-    return exitAction;
   } finally {
     controller.abort();
     process.removeListener("SIGINT", stopFromSignal);
@@ -54379,10 +53743,10 @@ async function runSessionHud(actions, input = process.stdin, output = process.st
 
 // src/update-service.ts
 var import_semver = __toESM(require_semver2(), 1);
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import { chmod as chmod3, readdir as readdir2, rename as rename2, rm as rm5, writeFile as writeFile6 } from "node:fs/promises";
-import path9 from "node:path";
+import path8 from "node:path";
 var PACKAGE_NAME = "@ariobarin/glossa";
 var DEFAULT_REGISTRY_URL = "https://registry.npmjs.org/@ariobarin%2Fglossa";
 var DEFAULT_RELEASE_BASE_URL = "https://github.com/ariobarin/glossa/releases/download";
@@ -54459,8 +53823,8 @@ async function cleanupUpdateBackups(distribution, options = {}) {
   const platform2 = options.platform ?? process.platform;
   if (distribution !== "standalone" || platform2 !== "win32") return;
   const executable = options.executablePath ?? process.execPath;
-  const directory = path9.dirname(executable);
-  const prefix = `${path9.basename(executable)}.old-`;
+  const directory = path8.dirname(executable);
+  const prefix = `${path8.basename(executable)}.old-`;
   let entries;
   try {
     entries = await readdir2(directory, { withFileTypes: true });
@@ -54473,7 +53837,7 @@ async function cleanupUpdateBackups(distribution, options = {}) {
       const ownerPid = backupOwnerPid(entry.name, prefix);
       return ownerPid !== null && !processIsAlive(ownerPid);
     }).map(async (entry) => {
-      await rm5(path9.join(directory, entry.name), { force: true }).catch(() => void 0);
+      await rm5(path8.join(directory, entry.name), { force: true }).catch(() => void 0);
     })
   );
 }
@@ -54514,7 +53878,7 @@ function npmInstallInvocation(version2, platform2 = process.platform, commandShe
 async function runNpmInstall(version2) {
   const { command, args } = npmInstallInvocation(version2);
   await new Promise((resolve, reject) => {
-    const child = spawn3(command, args, { stdio: "inherit" });
+    const child = spawn2(command, args, { stdio: "inherit" });
     child.once("error", reject);
     child.once("close", (status) => {
       if (status === 0) resolve();
@@ -54549,9 +53913,9 @@ async function installStandaloneUpdate(info, options) {
   if (actual !== expected) {
     throw new Error("Glossa refused to update because the SHA-256 checksum did not match.");
   }
-  const download = path9.join(
-    path9.dirname(destination),
-    `${path9.basename(destination)}.download-${process.pid}`
+  const download = path8.join(
+    path8.dirname(destination),
+    `${path8.basename(destination)}.download-${process.pid}`
   );
   try {
     await writeFile6(download, binary, { mode: 493 });
@@ -54578,13 +53942,13 @@ async function installUpdate(info, distribution, options = {}) {
 
 // src/update-state.ts
 import { chmod as chmod4, mkdir as mkdir6, readFile as readFile5, rename as rename3, rm as rm6, writeFile as writeFile7 } from "node:fs/promises";
-import path10 from "node:path";
+import path9 from "node:path";
 var UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 function defaultUpdateChannel(version2) {
   return version2.includes("-") ? "beta" : "stable";
 }
 function updateStateFile() {
-  return path10.join(configDirectory(), "updates.json");
+  return path9.join(configDirectory(), "updates.json");
 }
 function isPolicy(value) {
   return value === "notify" || value === "auto" || value === "off";
@@ -54603,12 +53967,10 @@ async function loadUpdateState(currentVersion, file2 = updateStateFile()) {
   try {
     const parsed = JSON.parse(await readFile5(file2, "utf8"));
     const lastCheckedAt = optionalString(parsed.lastCheckedAt);
-    const latestVersion = optionalString(parsed.latestVersion);
     return {
       policy: isPolicy(parsed.policy) ? parsed.policy : defaults.policy,
       channel: isChannel(parsed.channel) ? parsed.channel : defaults.channel,
-      ...lastCheckedAt ? { lastCheckedAt } : {},
-      ...latestVersion ? { latestVersion } : {}
+      ...lastCheckedAt ? { lastCheckedAt } : {}
     };
   } catch (error46) {
     if (error46.code === "ENOENT" || error46 instanceof SyntaxError) {
@@ -54618,7 +53980,7 @@ async function loadUpdateState(currentVersion, file2 = updateStateFile()) {
   }
 }
 async function saveUpdateState(state, file2 = updateStateFile()) {
-  const directory = path10.dirname(file2);
+  const directory = path9.dirname(file2);
   const temporary = `${file2}.${process.pid}.tmp`;
   await mkdir6(directory, { recursive: true, mode: 448 });
   try {
@@ -54642,11 +54004,10 @@ async function configureUpdates(currentVersion, changes, file2 = updateStateFile
   await saveUpdateState(state, file2);
   return state;
 }
-async function recordUpdateCheck(currentVersion, latestVersion, checkedAt = /* @__PURE__ */ new Date(), file2 = updateStateFile()) {
+async function recordUpdateCheck(currentVersion, checkedAt = /* @__PURE__ */ new Date(), file2 = updateStateFile()) {
   const state = {
     ...await loadUpdateState(currentVersion, file2),
-    lastCheckedAt: checkedAt.toISOString(),
-    latestVersion
+    lastCheckedAt: checkedAt.toISOString()
   };
   await saveUpdateState(state, file2);
   return state;
@@ -54673,41 +54034,18 @@ async function unpairComputer(dependencies = {}) {
   log("Unpaired this computer from Glossa.");
 }
 
-// src/usage-store.ts
-import { appendFile, chmod as chmod5, mkdir as mkdir7, readFile as readFile6 } from "node:fs/promises";
-import path11 from "node:path";
-function usageFile() {
-  return path11.join(configDirectory(), "usage.jsonl");
-}
-async function recordUsageEvent(event, file2 = usageFile()) {
-  const directory = path11.dirname(file2);
-  await mkdir7(directory, { recursive: true, mode: 448 });
-  await appendFile(file2, `${JSON.stringify(event)}
-`, {
-    encoding: "utf8",
-    mode: 384
-  });
-  if (process.platform !== "win32") await chmod5(file2, 384);
-}
-async function recordSessionUsage(at = /* @__PURE__ */ new Date(), file2 = usageFile()) {
-  await recordUsageEvent({ v: 1, at: at.toISOString(), kind: "session" }, file2);
-}
-async function recordToolUsage(tool, ok, at = /* @__PURE__ */ new Date(), file2 = usageFile()) {
-  await recordUsageEvent({ v: 1, at: at.toISOString(), kind: "tool", tool, ok }, file2);
-}
-
 // src/worker/root-selection.ts
 import { realpath as realpath2 } from "node:fs/promises";
 import os6 from "node:os";
-import path12 from "node:path";
+import path10 from "node:path";
 function containsPath(root, candidate) {
-  const relative = path12.relative(root, candidate);
-  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path12.sep}`) && !path12.isAbsolute(relative);
+  const relative = path10.relative(root, candidate);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path10.sep}`) && !path10.isAbsolute(relative);
 }
 async function rejectImplicitHomeAncestor(root) {
   const homes = await Promise.all(
     [os6.homedir(), accountHomeDirectory()].map(
-      async (home) => await realpath2(home).catch(() => path12.resolve(home))
+      async (home) => await realpath2(home).catch(() => path10.resolve(home))
     )
   );
   if (homes.some((home) => containsPath(root, home))) {
@@ -54725,9 +54063,9 @@ async function selectExposureRoot(explicitPath, cwd2 = process.cwd()) {
 
 // src/worker/workspace-lease.ts
 import { createHash as createHash3 } from "node:crypto";
-import { lstat as lstat3, mkdir as mkdir8, rm as rm7, stat as stat4 } from "node:fs/promises";
+import { lstat as lstat3, mkdir as mkdir7, rm as rm7, stat as stat4 } from "node:fs/promises";
 import net from "node:net";
-import path13 from "node:path";
+import path11 from "node:path";
 import { setTimeout as delay4 } from "node:timers/promises";
 var GUARD_STALE_MS = 5e3;
 var GUARD_RETRY_MS = 10;
@@ -54751,12 +54089,12 @@ function workspaceIdentity(root) {
 }
 function defaultLeaseDirectory() {
   if (typeof process.getuid === "function") {
-    return path13.join("/tmp", `glossa-workspaces-${process.getuid()}`);
+    return path11.join("/tmp", `glossa-workspaces-${process.getuid()}`);
   }
-  return path13.join(accountHomeDirectory(), ".glossa-workspace-leases");
+  return path11.join(accountHomeDirectory(), ".glossa-workspace-leases");
 }
 async function ensureLeaseDirectory(directory) {
-  await mkdir8(directory, { recursive: true, mode: 448 });
+  await mkdir7(directory, { recursive: true, mode: 448 });
   const directoryStat = await lstat3(directory);
   if (directoryStat.isSymbolicLink() || !directoryStat.isDirectory()) {
     throw new Error("The Glossa workspace lease location is not a private directory.");
@@ -54773,14 +54111,14 @@ function endpointFor(identity, directory) {
   if (process.platform === "win32") {
     return `\\\\.\\pipe\\glossa-workspace-${identity}`;
   }
-  return path13.join(directory, `${identity}.sock`);
+  return path11.join(directory, `${identity}.sock`);
 }
 async function acquireGuard2(directory, identity) {
-  const guard = path13.join(directory, `${identity}.guard`);
+  const guard = path11.join(directory, `${identity}.guard`);
   const deadline = Date.now() + GUARD_TIMEOUT_MS;
   while (true) {
     try {
-      await mkdir8(guard, { mode: 448 });
+      await mkdir7(guard, { mode: 448 });
       return async () => await rm7(guard, { recursive: true, force: true });
     } catch (error46) {
       if (error46.code !== "EEXIST") throw error46;
@@ -54807,7 +54145,7 @@ async function acquireGuard2(directory, identity) {
 function createLeaseServer() {
   return net.createServer((socket) => socket.destroy());
 }
-async function listen(server, endpoint3) {
+async function listen(server, endpoint) {
   await new Promise((resolve, reject) => {
     const onError = (error46) => {
       server.removeListener("listening", onListening);
@@ -54819,12 +54157,12 @@ async function listen(server, endpoint3) {
     };
     server.once("error", onError);
     server.once("listening", onListening);
-    server.listen(endpoint3);
+    server.listen(endpoint);
   });
 }
-async function endpointIsActive(endpoint3) {
+async function endpointIsActive(endpoint) {
   return await new Promise((resolve) => {
-    const socket = net.createConnection(endpoint3);
+    const socket = net.createConnection(endpoint);
     let settled = false;
     const finish = (active) => {
       if (settled) return;
@@ -54847,14 +54185,14 @@ async function acquireWorkspaceLease(root, options = {}) {
   const userDirectory = options.directory ?? defaultLeaseDirectory();
   await ensureLeaseDirectory(userDirectory);
   const identity = workspaceIdentity(root);
-  const endpoint3 = endpointFor(identity, userDirectory);
+  const endpoint = endpointFor(identity, userDirectory);
   const releaseGuard = await acquireGuard2(userDirectory, identity);
   let server;
   try {
     for (let attempt = 0; attempt < 2; attempt += 1) {
       server = createLeaseServer();
       try {
-        await listen(server, endpoint3);
+        await listen(server, endpoint);
         server.unref();
         let released = false;
         return {
@@ -54866,7 +54204,7 @@ async function acquireWorkspaceLease(root, options = {}) {
             try {
               await closeServer(server);
               if (process.platform !== "win32") {
-                await rm7(endpoint3, { force: true });
+                await rm7(endpoint, { force: true });
               }
             } finally {
               await releaseGuard2();
@@ -54875,11 +54213,11 @@ async function acquireWorkspaceLease(root, options = {}) {
         };
       } catch (error46) {
         await closeServer(server);
-        if (await endpointIsActive(endpoint3)) {
+        if (await endpointIsActive(endpoint)) {
           throw new WorkspaceAlreadyActiveError();
         }
         if (error46.code !== "EADDRINUSE") throw error46;
-        if (process.platform !== "win32") await rm7(endpoint3, { force: true });
+        if (process.platform !== "win32") await rm7(endpoint, { force: true });
       }
     }
     throw new Error("Could not reserve this workspace for the current Glossa process.");
@@ -54889,15 +54227,12 @@ async function acquireWorkspaceLease(root, options = {}) {
 }
 
 // src/main.ts
-var VERSION = "0.2.1";
+var VERSION = "0.2.3-beta.1";
 var DISTRIBUTION = "npm";
 var HELP = `Glossa ${VERSION}
 
 Usage:
   glossa [--access <read-only|workspace|system>] [--label <name>] [directory]
-  glossa status
-  glossa devices revoke <id>
-  glossa logout
   glossa unpair
   glossa update [--check]
   glossa update --policy <notify|auto|off>
@@ -54919,68 +54254,18 @@ Keys:
   \u2190\u2192 change workspace access
   Enter/r  revoke selected device
   Esc  workspace
-  l  account sign out
   ?  help
   q  disconnect and quit`;
-async function withLoginSignal(action) {
-  const controller = new AbortController();
-  const cancel = () => controller.abort();
-  process.once("SIGINT", cancel);
-  try {
-    return await action(controller.signal);
-  } finally {
-    process.removeListener("SIGINT", cancel);
-  }
-}
-async function authenticatedSession(signal) {
-  if (signal) return await signedInSession({ ...loadAuthConfig(), signal });
-  return await withLoginSignal(
-    async (loginSignal) => await signedInSession({ ...loadAuthConfig(), signal: loginSignal })
-  );
-}
-async function authenticatedCredentials(signal) {
-  return (await authenticatedSession(signal)).credentials;
-}
-async function showStatus() {
-  const credentials = await authenticatedCredentials();
-  const endpoints = loadRelayEndpoints();
-  const status = await new WorkspaceStatusService(
-    credentials,
-    endpoints
-  ).refresh();
-  for (const line of formatStatus(status)) console.log(line);
-}
-function hudStatus(status) {
-  return {
-    ...status,
-    devices: status.devices.map((device) => ({
-      id: device.id,
-      name: device.name,
-      platform: device.platform ?? "Unknown platform",
-      lastSeen: formatRelativeTime(device.lastSeenAt),
-      status: deviceStatus(device)
-    }))
-  };
-}
-async function revokeKnownDevice(deviceId) {
-  const credentials = await authenticatedCredentials();
-  await revokeDevice(loadRelayEndpoints(), credentials, deviceId);
-}
-async function runWorkspaceSession(path14, label, accessProfile) {
-  const root = await selectExposureRoot(path14);
+async function runWorkspaceSession(path12, label, accessProfile) {
+  const root = await selectExposureRoot(path12);
   const lease = await acquireWorkspaceLease(root);
-  let usageWrites = Promise.resolve();
-  const queueUsage = (write) => {
-    usageWrites = usageWrites.then(write).catch(() => void 0);
-  };
   try {
     const endpoints = loadRelayEndpoints();
     const device = await deviceForSession(endpoints);
     let postExitNotice;
     let requestedAccessProfile = accessProfile;
     let activeSessionController;
-    queueUsage(async () => await recordSessionUsage());
-    const exitAction = await runSessionHud({
+    await runSessionHud({
       workspace: root,
       ...label ? { workspaceLabel: label } : {},
       run: async (signal, onEvent) => {
@@ -55000,9 +54285,6 @@ async function runWorkspaceSession(path14, label, accessProfile) {
               signal: sessionController.signal,
               onEvent: (event) => {
                 postExitNotice = retainPostExitNotice(postExitNotice, event);
-                if (event.type === "activity" && event.phase === "returned") {
-                  queueUsage(async () => await recordToolUsage(event.job.type, event.ok));
-                }
                 onEvent(event);
               },
               quiet: true,
@@ -55024,16 +54306,24 @@ async function runWorkspaceSession(path14, label, accessProfile) {
         }
       },
       loadStatus: async (signal) => {
-        const credentials = await authenticatedCredentials(signal);
-        return hudStatus(
-          await new WorkspaceStatusService(credentials, endpoints).refresh(signal)
-        );
+        const withSignal = async (input, init) => await fetch(input, { ...init, signal });
+        const devices = (await listDevices(endpoints, `Device ${device.token}`, withSignal)).filter((entry) => entry.revokedAt === null);
+        return {
+          relay: endpoints.relayOrigin,
+          activeWorkers: devices.some((entry) => entry.activeWorkers === null) ? null : devices.reduce((total, entry) => total + entry.activeWorkers, 0),
+          devices: devices.map((entry) => ({
+            id: entry.id,
+            name: entry.name,
+            platform: entry.platform ?? "Unknown platform",
+            lastSeen: formatRelativeTime(entry.lastSeenAt),
+            status: deviceStatus(entry)
+          }))
+        };
       },
       revokeDevice: async (deviceId, signal) => {
-        const credentials = await authenticatedCredentials(signal);
         await revokeDevice(
           endpoints,
-          credentials,
+          `Device ${device.token}`,
           deviceId,
           async (input, init) => await fetch(input, { ...init, signal })
         );
@@ -55045,20 +54335,18 @@ async function runWorkspaceSession(path14, label, accessProfile) {
       }
     });
     if (postExitNotice) console.error(postExitNotice);
-    if (exitAction === "logout") await logoutFromGlossa();
   } finally {
-    await usageWrites;
     await lease.release();
   }
 }
-async function runWorkspace(path14, label, accessProfile) {
+async function runWorkspace(path12, label, accessProfile) {
   await withWorkspaceLease(
-    async () => await runWorkspaceSession(path14, label, accessProfile)
+    async () => await runWorkspaceSession(path12, label, accessProfile)
   );
 }
 async function refreshUpdateInfo(timeoutMs) {
   const info = await loadUpdateInfo(timeoutMs);
-  await recordUpdateCheck(VERSION, info.availableVersion);
+  await recordUpdateCheck(VERSION);
   return info;
 }
 async function loadUpdateInfo(timeoutMs) {
@@ -55113,11 +54401,11 @@ async function updateBeforeWorkspace() {
     return false;
   }
   if (!info.updateAvailable) {
-    await recordUpdateCheck(VERSION, info.availableVersion);
+    await recordUpdateCheck(VERSION);
     return false;
   }
   if (state.policy === "notify") {
-    await recordUpdateCheck(VERSION, info.availableVersion);
+    await recordUpdateCheck(VERSION);
     console.error(
       `Glossa ${info.availableVersion} is available. Run glossa update after disconnecting.`
     );
@@ -55152,17 +54440,10 @@ async function main() {
       invocation.label,
       invocation.accessProfile
     );
-  } else if (invocation.command === "status") {
-    await showStatus();
-  } else if (invocation.command === "logout") {
-    await logoutFromGlossa();
   } else if (invocation.command === "unpair") {
     await unpairComputer();
   } else if (invocation.command === "update") {
     await runUpdateCommand(invocation);
-  } else {
-    await revokeKnownDevice(invocation.deviceId);
-    console.log(`Revoked device ${invocation.deviceId}. Running workspaces on it are disconnected.`);
   }
 }
 main().catch((error46) => {