@autohq/cli 0.1.128 → 0.1.130

package/dist/index.js

@@ -16052,7 +16052,7 @@ var init_zod = __esm({
 });
 
 // ../../packages/schemas/src/ids.ts
-var OpaqueIdSchema, ProfileIdSchema, EnvironmentIdSchema, ConnectionIdSchema, ExternalAccountIdSchema, OrganizationIdSchema, ProjectIdSchema, ProviderGrantIdSchema, ServiceAccountIdSchema, SessionIdSchema, SessionRunIdSchema, SessionRunCommandIdSchema, RuntimeIdSchema, RuntimeBridgeLeaseIdSchema, EnvironmentSetupSnapshotIdSchema, ToolIdSchema, UserIdSchema;
+var OpaqueIdSchema, ProfileIdSchema, EnvironmentIdSchema, IdentityIdSchema, ConnectionIdSchema, ExternalAccountIdSchema, OrganizationIdSchema, ProjectIdSchema, ProviderGrantIdSchema, ServiceAccountIdSchema, SessionIdSchema, SessionRunIdSchema, SessionRunCommandIdSchema, RuntimeIdSchema, RuntimeBridgeLeaseIdSchema, EnvironmentSetupSnapshotIdSchema, ToolIdSchema, UserIdSchema;
 var init_ids = __esm({
   "../../packages/schemas/src/ids.ts"() {
     "use strict";
@@ -16060,6 +16060,7 @@ var init_ids = __esm({
     OpaqueIdSchema = external_exports.string().trim().min(1);
     ProfileIdSchema = OpaqueIdSchema.brand();
     EnvironmentIdSchema = OpaqueIdSchema.brand();
+    IdentityIdSchema = OpaqueIdSchema.brand();
     ConnectionIdSchema = OpaqueIdSchema.brand();
     ExternalAccountIdSchema = OpaqueIdSchema.brand();
     OrganizationIdSchema = OpaqueIdSchema.brand();
@@ -17431,193 +17432,6 @@ var init_github_mcp_catalog = __esm({
   }
 });
 
-// ../../packages/schemas/src/secrets.ts
-var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretSetRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema;
-var init_secrets = __esm({
-  "../../packages/schemas/src/secrets.ts"() {
-    "use strict";
-    init_zod();
-    init_resources();
-    SECRET_ENCRYPTION_ALGORITHM = "AES-256-GCM";
-    SecretEnvNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
-    SecretCiphertextFieldSchema = external_exports.string().trim().min(1).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
-    SecretAesGcmIvSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{16}$/);
-    SecretAesGcmAuthTagSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{22}==$/);
-    SecretEnvValueSchema = external_exports.union([
-      external_exports.string(),
-      external_exports.object({
-        $secret: ResourceNameSchema,
-        optional: external_exports.boolean().optional()
-      })
-    ]);
-    SecretEnvSchema = external_exports.record(
-      SecretEnvNameSchema,
-      SecretEnvValueSchema
-    );
-    EncryptedSecretValueSchema = external_exports.object({
-      keyVersion: external_exports.string().trim().min(1),
-      algorithm: external_exports.literal(SECRET_ENCRYPTION_ALGORITHM),
-      ciphertext: SecretCiphertextFieldSchema,
-      valueIv: SecretAesGcmIvSchema,
-      valueAuthTag: SecretAesGcmAuthTagSchema,
-      encryptedDek: SecretCiphertextFieldSchema,
-      dekIv: SecretAesGcmIvSchema,
-      dekAuthTag: SecretAesGcmAuthTagSchema
-    });
-    SecretSetRequestSchema = external_exports.object({
-      value: external_exports.string()
-    });
-    SecretMetadataSchema = external_exports.object({
-      id: external_exports.string().trim().min(1),
-      organizationId: external_exports.string().trim().min(1),
-      projectId: external_exports.string().trim().min(1).nullable(),
-      name: ResourceNameSchema,
-      createdAt: external_exports.string().datetime(),
-      updatedAt: external_exports.string().datetime()
-    });
-    SecretSetResponseSchema = external_exports.object({
-      secret: SecretMetadataSchema
-    });
-    SecretListResponseSchema = external_exports.object({
-      secrets: external_exports.array(SecretMetadataSchema)
-    });
-    SecretDeleteResponseSchema = external_exports.object({
-      secret: SecretMetadataSchema
-    });
-  }
-});
-
-// ../../packages/schemas/src/environments.ts
-function environmentSetupSchema(cachePathSchema) {
-  return external_exports.object({
-    name: ResourceNameSchema,
-    commands: external_exports.array(external_exports.string().trim().min(1)).min(1),
-    cache: external_exports.object({
-      key: ResourceNameSchema.optional(),
-      files: external_exports.array(
-        external_exports.string().trim().refine(isSafeRelativePath, {
-          message: "Expected a relative path without traversal"
-        })
-      ).default([]),
-      paths: external_exports.array(cachePathSchema).default([])
-    }).strict().default({ files: [], paths: [] })
-  }).strict();
-}
-function environmentSpecSchema(setupSchema) {
-  return external_exports.object({
-    image: EnvironmentImageSchema,
-    env: SecretEnvSchema.default({}),
-    resources: EnvironmentResourcesSchema.optional(),
-    steps: external_exports.array(external_exports.string()).default([]),
-    setup: external_exports.array(setupSchema).default([]),
-    setupCache: EnvironmentSetupCacheSchema.optional()
-  }).strict();
-}
-function isSafeSandboxUserHomePath(value, options = {}) {
-  return (options.allowedHomes ?? [CURRENT_SANDBOX_USER_HOME]).some(
-    (home) => isSafePathUnderHome(value, home)
-  );
-}
-function isSafePathUnderHome(value, home) {
-  const prefix = `${home}/`;
-  if (!value.startsWith(prefix)) {
-    return false;
-  }
-  const relative = value.slice(prefix.length);
-  return relative.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isSafeRelativePath(value) {
-  if (!value || value.startsWith("/")) {
-    return false;
-  }
-  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isSetupCacheTtl(value) {
-  return /^[1-9][0-9]*(s|m|h|d)$/.test(value);
-}
-var RESOURCE_KIND_ENVIRONMENT, CURRENT_SANDBOX_USER_HOME, LEGACY_SANDBOX_USER_HOMES, STORED_SANDBOX_USER_HOMES, EnvironmentSetupCachePathSchema, StoredEnvironmentSetupCachePathSchema, EnvironmentImageSchema, EnvironmentSetupSchema, EnvironmentApplySetupSchema, EnvironmentSetupCacheSchema, EnvironmentResourcesSchema, EnvironmentSpecSchema, EnvironmentApplySpecSchema, EnvironmentResourceSchema, EnvironmentApplyRequestSchema;
-var init_environments = __esm({
-  "../../packages/schemas/src/environments.ts"() {
-    "use strict";
-    init_zod();
-    init_resources();
-    init_secrets();
-    RESOURCE_KIND_ENVIRONMENT = "environment";
-    CURRENT_SANDBOX_USER_HOME = "/home/user";
-    LEGACY_SANDBOX_USER_HOMES = ["/home/auto", "/home/node"];
-    STORED_SANDBOX_USER_HOMES = [
-      CURRENT_SANDBOX_USER_HOME,
-      ...LEGACY_SANDBOX_USER_HOMES
-    ];
-    EnvironmentSetupCachePathSchema = external_exports.string().trim().refine((value) => isSafeSandboxUserHomePath(value), {
-      message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
-    });
-    StoredEnvironmentSetupCachePathSchema = external_exports.string().trim().refine(
-      (value) => isSafeSandboxUserHomePath(value, {
-        allowedHomes: STORED_SANDBOX_USER_HOMES
-      }),
-      {
-        message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
-      }
-    );
-    EnvironmentImageSchema = external_exports.object({
-      kind: external_exports.literal("preset"),
-      name: ResourceNameSchema
-    }).strict();
-    EnvironmentSetupSchema = environmentSetupSchema(
-      StoredEnvironmentSetupCachePathSchema
-    );
-    EnvironmentApplySetupSchema = environmentSetupSchema(
-      EnvironmentSetupCachePathSchema
-    );
-    EnvironmentSetupCacheSchema = external_exports.object({
-      ttl: external_exports.string().trim().refine(isSetupCacheTtl, {
-        message: "Expected a positive setup cache TTL such as 30m, 24h, or 7d"
-      })
-    }).strict();
-    EnvironmentResourcesSchema = external_exports.object({
-      cpuCount: external_exports.number().int().min(1).optional(),
-      memoryMB: external_exports.number().int().min(128).optional()
-    }).strict().refine(
-      (resources) => resources.cpuCount !== void 0 || resources.memoryMB !== void 0,
-      {
-        message: "Expected at least one runtime resource setting"
-      }
-    );
-    EnvironmentSpecSchema = environmentSpecSchema(
-      EnvironmentSetupSchema
-    );
-    EnvironmentApplySpecSchema = environmentSpecSchema(
-      EnvironmentApplySetupSchema
-    );
-    EnvironmentResourceSchema = resourceEnvelopeSchema(
-      EnvironmentSpecSchema
-    );
-    EnvironmentApplyRequestSchema = resourceApplySchema(
-      EnvironmentApplySpecSchema
-    );
-  }
-});
-
-// ../../packages/schemas/src/mcp.ts
-var McpToolCallMessageSchema, McpJsonRpcMessageSchema, McpPostBodySchema;
-var init_mcp = __esm({
-  "../../packages/schemas/src/mcp.ts"() {
-    "use strict";
-    init_zod();
-    McpToolCallMessageSchema = external_exports.object({
-      method: external_exports.literal("tools/call"),
-      params: external_exports.object({
-        name: external_exports.string().trim().min(1)
-      })
-    });
-    McpJsonRpcMessageSchema = external_exports.object({
-      method: external_exports.string().optional()
-    }).passthrough();
-    McpPostBodySchema = external_exports.union([McpJsonRpcMessageSchema, external_exports.array(McpJsonRpcMessageSchema)]).transform((body) => Array.isArray(body) ? body : [body]);
-  }
-});
-
 // ../../packages/schemas/src/mounts.ts
 var AbsoluteMountPathSchema, GITHUB_MOUNT_CAPABILITY_LEVELS, GithubMountCapabilityLevelSchema, GITHUB_MOUNT_MERGE_CAPABILITY_LEVELS, GithubMountMergeCapabilityLevelSchema, DEFAULT_GITHUB_MOUNT_CAPABILITIES, GitMountAuthSchema, GitMountSchema, SessionMountSchema;
 var init_mounts = __esm({
@@ -17696,43 +17510,58 @@ var init_mounts = __esm({
   }
 });
 
-// ../../packages/schemas/src/project-service-accounts.ts
-var ProjectServiceAccountSchema, ProjectServiceAccountCreateRequestSchema, ProjectServiceAccountUpdateRequestSchema, ProjectServiceAccountTokenResponseSchema, ProjectServiceAccountUpdateResponseSchema, ProjectServiceAccountRemoveResponseSchema, ProjectServiceAccountListResponseSchema;
-var init_project_service_accounts = __esm({
-  "../../packages/schemas/src/project-service-accounts.ts"() {
+// ../../packages/schemas/src/secrets.ts
+var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretSetRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema;
+var init_secrets = __esm({
+  "../../packages/schemas/src/secrets.ts"() {
     "use strict";
     init_zod();
-    init_auth();
-    init_ids();
     init_resources();
-    ProjectServiceAccountSchema = external_exports.object({
-      id: ServiceAccountIdSchema,
-      organizationId: OrganizationIdSchema,
-      projectId: ProjectIdSchema,
-      name: ResourceNameSchema,
-      scopes: external_exports.array(AuthScopeSchema),
-      createdAt: external_exports.string().datetime()
-    });
-    ProjectServiceAccountCreateRequestSchema = external_exports.object({
-      name: ResourceNameSchema,
-      scopes: external_exports.array(AuthScopeSchema).min(1)
+    SECRET_ENCRYPTION_ALGORITHM = "AES-256-GCM";
+    SecretEnvNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
+    SecretCiphertextFieldSchema = external_exports.string().trim().min(1).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
+    SecretAesGcmIvSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{16}$/);
+    SecretAesGcmAuthTagSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{22}==$/);
+    SecretEnvValueSchema = external_exports.union([
+      external_exports.string(),
+      external_exports.object({
+        $secret: ResourceNameSchema,
+        optional: external_exports.boolean().optional()
+      })
+    ]);
+    SecretEnvSchema = external_exports.record(
+      SecretEnvNameSchema,
+      SecretEnvValueSchema
+    );
+    EncryptedSecretValueSchema = external_exports.object({
+      keyVersion: external_exports.string().trim().min(1),
+      algorithm: external_exports.literal(SECRET_ENCRYPTION_ALGORITHM),
+      ciphertext: SecretCiphertextFieldSchema,
+      valueIv: SecretAesGcmIvSchema,
+      valueAuthTag: SecretAesGcmAuthTagSchema,
+      encryptedDek: SecretCiphertextFieldSchema,
+      dekIv: SecretAesGcmIvSchema,
+      dekAuthTag: SecretAesGcmAuthTagSchema
     });
-    ProjectServiceAccountUpdateRequestSchema = external_exports.object({
-      scopes: external_exports.array(AuthScopeSchema).min(1)
+    SecretSetRequestSchema = external_exports.object({
+      value: external_exports.string()
     });
-    ProjectServiceAccountTokenResponseSchema = external_exports.object({
-      serviceAccount: ProjectServiceAccountSchema,
-      token: external_exports.string().min(1)
+    SecretMetadataSchema = external_exports.object({
+      id: external_exports.string().trim().min(1),
+      organizationId: external_exports.string().trim().min(1),
+      projectId: external_exports.string().trim().min(1).nullable(),
+      name: ResourceNameSchema,
+      createdAt: external_exports.string().datetime(),
+      updatedAt: external_exports.string().datetime()
     });
-    ProjectServiceAccountUpdateResponseSchema = external_exports.object({
-      serviceAccount: ProjectServiceAccountSchema
+    SecretSetResponseSchema = external_exports.object({
+      secret: SecretMetadataSchema
     });
-    ProjectServiceAccountRemoveResponseSchema = external_exports.object({
-      serviceAccount: ProjectServiceAccountSchema,
-      removed: external_exports.literal(true)
+    SecretListResponseSchema = external_exports.object({
+      secrets: external_exports.array(SecretMetadataSchema)
     });
-    ProjectServiceAccountListResponseSchema = external_exports.object({
-      serviceAccounts: external_exports.array(ProjectServiceAccountSchema)
+    SecretDeleteResponseSchema = external_exports.object({
+      secret: SecretMetadataSchema
     });
   }
 });
@@ -18436,13 +18265,13 @@ var init_sessions = __esm({
         }
       ).optional()
     }).strict().refine((identity2) => Object.keys(identity2).length > 0, {
-      message: "Session identity requires at least one field"
+      message: "Identity requires at least one field"
     });
     SessionSpecFieldsSchema = external_exports.object({
       harness: external_exports.enum(SESSION_HARNESSES).optional(),
       systemPrompt: external_exports.string().trim().min(1).max(1e5).optional(),
       environment: ResourceNameSchema.optional(),
-      identity: SessionIdentitySchema.optional(),
+      identity: external_exports.union([ResourceNameSchema, SessionIdentitySchema]).optional(),
       initialPrompt: external_exports.string().trim().min(1).max(2e4).optional(),
       env: SecretEnvSchema.default({}),
       mounts: external_exports.array(SessionMountSchema).default([]),
@@ -18467,124 +18296,311 @@ var init_sessions = __esm({
     SessionApplyRequestSchema = resourceApplySchema(
       SessionApplySpecSchema
     );
-    SessionApplyTriggerReceiptSchema = external_exports.object({
-      event: external_exports.string().trim().min(1),
-      endpoint: external_exports.string().trim().min(1),
-      ingestUrl: external_exports.string().trim().min(1),
-      status: external_exports.literal("ready")
-    });
-    SessionApplyResponseSchema = external_exports.union([
-      SessionResourceSchema,
-      external_exports.object({
-        resource: SessionResourceSchema,
-        triggers: external_exports.array(SessionApplyTriggerReceiptSchema)
+    SessionApplyTriggerReceiptSchema = external_exports.object({
+      event: external_exports.string().trim().min(1),
+      endpoint: external_exports.string().trim().min(1),
+      ingestUrl: external_exports.string().trim().min(1),
+      status: external_exports.literal("ready")
+    });
+    SessionApplyResponseSchema = external_exports.union([
+      SessionResourceSchema,
+      external_exports.object({
+        resource: SessionResourceSchema,
+        triggers: external_exports.array(SessionApplyTriggerReceiptSchema)
+      })
+    ]);
+    SESSION_TELEGRAM_IDENTITY_STATUSES = [
+      "pending",
+      "realized",
+      "broken",
+      "retired"
+    ];
+    SessionTelegramIdentityStatusSchema = external_exports.enum(
+      SESSION_TELEGRAM_IDENTITY_STATUSES
+    );
+    SessionPresenceIdentitySchema = external_exports.object({
+      identityId: external_exports.string().trim().min(1),
+      provider: external_exports.string().trim().min(1),
+      connection: external_exports.string().trim().min(1),
+      workspace: external_exports.string().trim().min(1),
+      realized: external_exports.boolean(),
+      appId: external_exports.string().trim().min(1).optional(),
+      botUserId: external_exports.string().trim().min(1).optional(),
+      teamId: external_exports.string().trim().min(1).optional(),
+      // Telegram-realized identities: the persona bot's @username and lifecycle
+      // state (creation is human-confirmed in Telegram, so identities can sit
+      // `pending` between the connect step and the managed_bot webhook).
+      botUsername: external_exports.string().trim().min(1).optional(),
+      telegramStatus: SessionTelegramIdentityStatusSchema.optional(),
+      /**
+       * Telegram privacy-mode state verified during connect: true means privacy
+       * mode is disabled and the persona sees all group messages. Not writable
+       * via the Bot API — flipping it is a BotFather step (/setprivacy), or add
+       * the persona as a group admin.
+       */
+      canReadAllGroupMessages: external_exports.boolean().optional(),
+      // Avatar drift surface: the session's desired avatar hash + public URL, and
+      // the hash last confirmed applied to the provider app icon. Providers offer
+      // no API for app icons, so application is a guided manual step recorded via
+      // the presence icon endpoint.
+      avatarSha256: external_exports.string().regex(SHA256_HEX_PATTERN).optional(),
+      avatarUrl: external_exports.string().trim().min(1).optional(),
+      appliedIconSha256: external_exports.string().regex(SHA256_HEX_PATTERN).optional(),
+      /**
+       * Scopes the current agent-app scope set requests that this realized
+       * identity's install never granted. Computed at read time; non-empty means
+       * the install predates a scope addition and `auto sessions connect
+       * <session> --reconnect` refreshes it.
+       */
+      missingScopes: external_exports.array(external_exports.string().trim().min(1)).optional()
+    });
+    SessionPresenceResponseSchema = external_exports.object({
+      session: ResourceNameSchema,
+      identities: external_exports.array(SessionPresenceIdentitySchema)
+    });
+    SessionPresenceConnectRequestSchema = external_exports.object({
+      /**
+       * Re-run the install OAuth for already-realized identities too. The repair
+       * path for a stranded bot token (e.g. the single-use refresh token was
+       * consumed but the rotated pair failed to persist): the stored app
+       * credentials are reused, so this never creates a new Slack app.
+       */
+      reconnect: external_exports.boolean().default(false)
+    });
+    SessionPresenceConnectPendingSchema = external_exports.object({
+      identityId: external_exports.string().trim().min(1),
+      connection: external_exports.string().trim().min(1),
+      workspace: external_exports.string().trim().min(1),
+      /**
+       * The URL the operator opens to realize this identity: the Slack install
+       * authorize URL, or the Telegram managed-bot creation deep link.
+       */
+      authorizationUrl: external_exports.string().trim().url(),
+      /**
+       * Telegram only: the pre-filled bot username in the creation dialog. The
+       * user can edit it there, so it is a suggestion, not the final identity.
+       */
+      suggestedUsername: external_exports.string().trim().min(1).optional()
+    });
+    SessionPresenceConnectResponseSchema = external_exports.object({
+      session: ResourceNameSchema,
+      pending: external_exports.array(SessionPresenceConnectPendingSchema),
+      realized: external_exports.array(SessionPresenceIdentitySchema),
+      message: external_exports.string().trim().min(1)
+    });
+    SessionPresenceIconRequestSchema = external_exports.object({
+      sha256: external_exports.string().regex(SHA256_HEX_PATTERN)
+    });
+    SessionPresenceIconResponseSchema = external_exports.object({
+      session: ResourceNameSchema,
+      identityId: external_exports.string().trim().min(1),
+      appliedIconSha256: external_exports.string().regex(SHA256_HEX_PATTERN)
+    });
+    SessionPresenceCompleteResponseSchema = external_exports.object({
+      status: external_exports.literal("connected"),
+      session: ResourceNameSchema,
+      connection: external_exports.string().trim().min(1),
+      workspace: external_exports.string().trim().min(1),
+      organizationId: external_exports.string().trim().min(1),
+      botUserId: external_exports.string().trim().min(1)
+    });
+  }
+});
+
+// ../../packages/schemas/src/identities.ts
+var RESOURCE_KIND_IDENTITY, IdentitySpecSchema, IdentityResourceSchema, IdentityApplyRequestSchema;
+var init_identities = __esm({
+  "../../packages/schemas/src/identities.ts"() {
+    "use strict";
+    init_resources();
+    init_sessions();
+    RESOURCE_KIND_IDENTITY = "identity";
+    IdentitySpecSchema = SessionIdentitySchema;
+    IdentityResourceSchema = resourceEnvelopeSchema(IdentitySpecSchema);
+    IdentityApplyRequestSchema = resourceApplySchema(IdentitySpecSchema);
+  }
+});
+
+// ../../packages/schemas/src/environments.ts
+function environmentSetupSchema(cachePathSchema) {
+  return external_exports.object({
+    name: ResourceNameSchema,
+    commands: external_exports.array(external_exports.string().trim().min(1)).min(1),
+    cache: external_exports.object({
+      key: ResourceNameSchema.optional(),
+      files: external_exports.array(
+        external_exports.string().trim().refine(isSafeRelativePath, {
+          message: "Expected a relative path without traversal"
+        })
+      ).default([]),
+      paths: external_exports.array(cachePathSchema).default([])
+    }).strict().default({ files: [], paths: [] })
+  }).strict();
+}
+function environmentSpecSchema(setupSchema) {
+  return external_exports.object({
+    image: EnvironmentImageSchema,
+    env: SecretEnvSchema.default({}),
+    resources: EnvironmentResourcesSchema.optional(),
+    steps: external_exports.array(external_exports.string()).default([]),
+    setup: external_exports.array(setupSchema).default([]),
+    setupCache: EnvironmentSetupCacheSchema.optional()
+  }).strict();
+}
+function isSafeSandboxUserHomePath(value, options = {}) {
+  return (options.allowedHomes ?? [CURRENT_SANDBOX_USER_HOME]).some(
+    (home) => isSafePathUnderHome(value, home)
+  );
+}
+function isSafePathUnderHome(value, home) {
+  const prefix = `${home}/`;
+  if (!value.startsWith(prefix)) {
+    return false;
+  }
+  const relative = value.slice(prefix.length);
+  return relative.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function isSafeRelativePath(value) {
+  if (!value || value.startsWith("/")) {
+    return false;
+  }
+  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function isSetupCacheTtl(value) {
+  return /^[1-9][0-9]*(s|m|h|d)$/.test(value);
+}
+var RESOURCE_KIND_ENVIRONMENT, CURRENT_SANDBOX_USER_HOME, LEGACY_SANDBOX_USER_HOMES, STORED_SANDBOX_USER_HOMES, EnvironmentSetupCachePathSchema, StoredEnvironmentSetupCachePathSchema, EnvironmentImageSchema, EnvironmentSetupSchema, EnvironmentApplySetupSchema, EnvironmentSetupCacheSchema, EnvironmentResourcesSchema, EnvironmentSpecSchema, EnvironmentApplySpecSchema, EnvironmentResourceSchema, EnvironmentApplyRequestSchema;
+var init_environments = __esm({
+  "../../packages/schemas/src/environments.ts"() {
+    "use strict";
+    init_zod();
+    init_resources();
+    init_secrets();
+    RESOURCE_KIND_ENVIRONMENT = "environment";
+    CURRENT_SANDBOX_USER_HOME = "/home/user";
+    LEGACY_SANDBOX_USER_HOMES = ["/home/auto", "/home/node"];
+    STORED_SANDBOX_USER_HOMES = [
+      CURRENT_SANDBOX_USER_HOME,
+      ...LEGACY_SANDBOX_USER_HOMES
+    ];
+    EnvironmentSetupCachePathSchema = external_exports.string().trim().refine((value) => isSafeSandboxUserHomePath(value), {
+      message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
+    });
+    StoredEnvironmentSetupCachePathSchema = external_exports.string().trim().refine(
+      (value) => isSafeSandboxUserHomePath(value, {
+        allowedHomes: STORED_SANDBOX_USER_HOMES
+      }),
+      {
+        message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
+      }
+    );
+    EnvironmentImageSchema = external_exports.object({
+      kind: external_exports.literal("preset"),
+      name: ResourceNameSchema
+    }).strict();
+    EnvironmentSetupSchema = environmentSetupSchema(
+      StoredEnvironmentSetupCachePathSchema
+    );
+    EnvironmentApplySetupSchema = environmentSetupSchema(
+      EnvironmentSetupCachePathSchema
+    );
+    EnvironmentSetupCacheSchema = external_exports.object({
+      ttl: external_exports.string().trim().refine(isSetupCacheTtl, {
+        message: "Expected a positive setup cache TTL such as 30m, 24h, or 7d"
       })
-    ]);
-    SESSION_TELEGRAM_IDENTITY_STATUSES = [
-      "pending",
-      "realized",
-      "broken",
-      "retired"
-    ];
-    SessionTelegramIdentityStatusSchema = external_exports.enum(
-      SESSION_TELEGRAM_IDENTITY_STATUSES
+    }).strict();
+    EnvironmentResourcesSchema = external_exports.object({
+      cpuCount: external_exports.number().int().min(1).optional(),
+      memoryMB: external_exports.number().int().min(128).optional()
+    }).strict().refine(
+      (resources) => resources.cpuCount !== void 0 || resources.memoryMB !== void 0,
+      {
+        message: "Expected at least one runtime resource setting"
+      }
     );
-    SessionPresenceIdentitySchema = external_exports.object({
-      identityId: external_exports.string().trim().min(1),
-      provider: external_exports.string().trim().min(1),
-      connection: external_exports.string().trim().min(1),
-      workspace: external_exports.string().trim().min(1),
-      realized: external_exports.boolean(),
-      appId: external_exports.string().trim().min(1).optional(),
-      botUserId: external_exports.string().trim().min(1).optional(),
-      teamId: external_exports.string().trim().min(1).optional(),
-      // Telegram-realized identities: the persona bot's @username and lifecycle
-      // state (creation is human-confirmed in Telegram, so identities can sit
-      // `pending` between the connect step and the managed_bot webhook).
-      botUsername: external_exports.string().trim().min(1).optional(),
-      telegramStatus: SessionTelegramIdentityStatusSchema.optional(),
-      /**
-       * Telegram privacy-mode state verified during connect: true means privacy
-       * mode is disabled and the persona sees all group messages. Not writable
-       * via the Bot API — flipping it is a BotFather step (/setprivacy), or add
-       * the persona as a group admin.
-       */
-      canReadAllGroupMessages: external_exports.boolean().optional(),
-      // Avatar drift surface: the session's desired avatar hash + public URL, and
-      // the hash last confirmed applied to the provider app icon. Providers offer
-      // no API for app icons, so application is a guided manual step recorded via
-      // the presence icon endpoint.
-      avatarSha256: external_exports.string().regex(SHA256_HEX_PATTERN).optional(),
-      avatarUrl: external_exports.string().trim().min(1).optional(),
-      appliedIconSha256: external_exports.string().regex(SHA256_HEX_PATTERN).optional(),
-      /**
-       * Scopes the current agent-app scope set requests that this realized
-       * identity's install never granted. Computed at read time; non-empty means
-       * the install predates a scope addition and `auto sessions connect
-       * <session> --reconnect` refreshes it.
-       */
-      missingScopes: external_exports.array(external_exports.string().trim().min(1)).optional()
+    EnvironmentSpecSchema = environmentSpecSchema(
+      EnvironmentSetupSchema
+    );
+    EnvironmentApplySpecSchema = environmentSpecSchema(
+      EnvironmentApplySetupSchema
+    );
+    EnvironmentResourceSchema = resourceEnvelopeSchema(
+      EnvironmentSpecSchema
+    );
+    EnvironmentApplyRequestSchema = resourceApplySchema(
+      EnvironmentApplySpecSchema
+    );
+  }
+});
+
+// ../../packages/schemas/src/mcp.ts
+var McpToolCallMessageSchema, McpJsonRpcMessageSchema, McpPostBodySchema;
+var init_mcp = __esm({
+  "../../packages/schemas/src/mcp.ts"() {
+    "use strict";
+    init_zod();
+    McpToolCallMessageSchema = external_exports.object({
+      method: external_exports.literal("tools/call"),
+      params: external_exports.object({
+        name: external_exports.string().trim().min(1)
+      })
     });
-    SessionPresenceResponseSchema = external_exports.object({
-      session: ResourceNameSchema,
-      identities: external_exports.array(SessionPresenceIdentitySchema)
+    McpJsonRpcMessageSchema = external_exports.object({
+      method: external_exports.string().optional()
+    }).passthrough();
+    McpPostBodySchema = external_exports.union([McpJsonRpcMessageSchema, external_exports.array(McpJsonRpcMessageSchema)]).transform((body) => Array.isArray(body) ? body : [body]);
+  }
+});
+
+// ../../packages/schemas/src/project-service-accounts.ts
+var ProjectServiceAccountSchema, ProjectServiceAccountCreateRequestSchema, ProjectServiceAccountUpdateRequestSchema, ProjectServiceAccountTokenResponseSchema, ProjectServiceAccountUpdateResponseSchema, ProjectServiceAccountRemoveResponseSchema, ProjectServiceAccountListResponseSchema;
+var init_project_service_accounts = __esm({
+  "../../packages/schemas/src/project-service-accounts.ts"() {
+    "use strict";
+    init_zod();
+    init_auth();
+    init_ids();
+    init_resources();
+    ProjectServiceAccountSchema = external_exports.object({
+      id: ServiceAccountIdSchema,
+      organizationId: OrganizationIdSchema,
+      projectId: ProjectIdSchema,
+      name: ResourceNameSchema,
+      scopes: external_exports.array(AuthScopeSchema),
+      createdAt: external_exports.string().datetime()
     });
-    SessionPresenceConnectRequestSchema = external_exports.object({
-      /**
-       * Re-run the install OAuth for already-realized identities too. The repair
-       * path for a stranded bot token (e.g. the single-use refresh token was
-       * consumed but the rotated pair failed to persist): the stored app
-       * credentials are reused, so this never creates a new Slack app.
-       */
-      reconnect: external_exports.boolean().default(false)
+    ProjectServiceAccountCreateRequestSchema = external_exports.object({
+      name: ResourceNameSchema,
+      scopes: external_exports.array(AuthScopeSchema).min(1)
     });
-    SessionPresenceConnectPendingSchema = external_exports.object({
-      identityId: external_exports.string().trim().min(1),
-      connection: external_exports.string().trim().min(1),
-      workspace: external_exports.string().trim().min(1),
-      /**
-       * The URL the operator opens to realize this identity: the Slack install
-       * authorize URL, or the Telegram managed-bot creation deep link.
-       */
-      authorizationUrl: external_exports.string().trim().url(),
-      /**
-       * Telegram only: the pre-filled bot username in the creation dialog. The
-       * user can edit it there, so it is a suggestion, not the final identity.
-       */
-      suggestedUsername: external_exports.string().trim().min(1).optional()
+    ProjectServiceAccountUpdateRequestSchema = external_exports.object({
+      scopes: external_exports.array(AuthScopeSchema).min(1)
     });
-    SessionPresenceConnectResponseSchema = external_exports.object({
-      session: ResourceNameSchema,
-      pending: external_exports.array(SessionPresenceConnectPendingSchema),
-      realized: external_exports.array(SessionPresenceIdentitySchema),
-      message: external_exports.string().trim().min(1)
+    ProjectServiceAccountTokenResponseSchema = external_exports.object({
+      serviceAccount: ProjectServiceAccountSchema,
+      token: external_exports.string().min(1)
     });
-    SessionPresenceIconRequestSchema = external_exports.object({
-      sha256: external_exports.string().regex(SHA256_HEX_PATTERN)
+    ProjectServiceAccountUpdateResponseSchema = external_exports.object({
+      serviceAccount: ProjectServiceAccountSchema
     });
-    SessionPresenceIconResponseSchema = external_exports.object({
-      session: ResourceNameSchema,
-      identityId: external_exports.string().trim().min(1),
-      appliedIconSha256: external_exports.string().regex(SHA256_HEX_PATTERN)
+    ProjectServiceAccountRemoveResponseSchema = external_exports.object({
+      serviceAccount: ProjectServiceAccountSchema,
+      removed: external_exports.literal(true)
     });
-    SessionPresenceCompleteResponseSchema = external_exports.object({
-      status: external_exports.literal("connected"),
-      session: ResourceNameSchema,
-      connection: external_exports.string().trim().min(1),
-      workspace: external_exports.string().trim().min(1),
-      organizationId: external_exports.string().trim().min(1),
-      botUserId: external_exports.string().trim().min(1)
+    ProjectServiceAccountListResponseSchema = external_exports.object({
+      serviceAccounts: external_exports.array(ProjectServiceAccountSchema)
     });
   }
 });
 
 // ../../packages/schemas/src/project-resources.ts
-var EnvironmentApplyDocumentSchema, ToolApplyDocumentSchema, SessionApplyDocumentSchema, ProjectApplyResourceSchema, PROJECT_RESOURCE_APPLY_ORDER, PROJECT_RESOURCE_KINDS, ProjectDeleteResourceSchema, AVATAR_ASSET_CONTENT_TYPES, MAX_AVATAR_ASSET_BASE64_LENGTH, ProjectApplyAssetSchema, ProjectApplyAssetsSchema, AvatarAssetUploadRequestSchema, AvatarAssetUploadResponseSchema, ProjectApplyRequestSchema, ProjectApplySystemConfigSchema, ProjectAppliedResourceSchema, ProjectApplyDiagnosticSchema, ProjectApplyResponseSchema;
+var EnvironmentApplyDocumentSchema, IdentityApplyDocumentSchema, ToolApplyDocumentSchema, SessionApplyDocumentSchema, ProjectApplyResourceSchema, PROJECT_RESOURCE_APPLY_ORDER, PROJECT_RESOURCE_KINDS, ProjectDeleteResourceSchema, AVATAR_ASSET_CONTENT_TYPES, MAX_AVATAR_ASSET_BASE64_LENGTH, ProjectApplyAssetSchema, ProjectApplyAssetsSchema, AvatarAssetUploadRequestSchema, AvatarAssetUploadResponseSchema, ProjectApplyRequestSchema, ProjectApplySystemConfigSchema, ProjectAppliedResourceSchema, ProjectApplyDiagnosticSchema, ProjectApplyResponseSchema;
 var init_project_resources = __esm({
   "../../packages/schemas/src/project-resources.ts"() {
     "use strict";
     init_zod();
     init_environments();
+    init_identities();
     init_resources();
     init_sessions();
     init_tools();
@@ -18592,6 +18608,10 @@ var init_project_resources = __esm({
       RESOURCE_KIND_ENVIRONMENT,
       EnvironmentApplyRequestSchema.shape.spec
     );
+    IdentityApplyDocumentSchema = resourceApplyDocumentSchema(
+      RESOURCE_KIND_IDENTITY,
+      IdentityApplyRequestSchema.shape.spec
+    );
     ToolApplyDocumentSchema = resourceApplyDocumentSchema(
       RESOURCE_KIND_TOOL,
       ToolApplyRequestSchema.shape.spec
@@ -18602,11 +18622,13 @@ var init_project_resources = __esm({
     );
     ProjectApplyResourceSchema = external_exports.discriminatedUnion("kind", [
       EnvironmentApplyDocumentSchema,
+      IdentityApplyDocumentSchema,
       ToolApplyDocumentSchema,
       SessionApplyDocumentSchema
     ]);
     PROJECT_RESOURCE_APPLY_ORDER = [
       RESOURCE_KIND_ENVIRONMENT,
+      RESOURCE_KIND_IDENTITY,
       RESOURCE_KIND_TOOL,
       RESOURCE_KIND_SESSION
     ];
@@ -18652,6 +18674,7 @@ var init_project_resources = __esm({
     });
     ProjectAppliedResourceSchema = external_exports.union([
       EnvironmentResourceSchema,
+      IdentityResourceSchema,
       ToolResourceSchema,
       SessionResourceSchema
     ]);
@@ -18663,6 +18686,7 @@ var init_project_resources = __esm({
       action: external_exports.enum(["create", "update", "unchanged"]),
       kind: external_exports.enum([
         RESOURCE_KIND_ENVIRONMENT,
+        RESOURCE_KIND_IDENTITY,
         RESOURCE_KIND_TOOL,
         RESOURCE_KIND_SESSION
       ]),
@@ -18678,6 +18702,7 @@ var init_project_resources = __esm({
           action: external_exports.enum(["create", "update", "unchanged", "archive"]),
           kind: external_exports.enum([
             RESOURCE_KIND_ENVIRONMENT,
+            RESOURCE_KIND_IDENTITY,
             RESOURCE_KIND_TOOL,
             RESOURCE_KIND_SESSION
           ]),
@@ -18689,6 +18714,7 @@ var init_project_resources = __esm({
         external_exports.object({
           kind: external_exports.enum([
             RESOURCE_KIND_ENVIRONMENT,
+            RESOURCE_KIND_IDENTITY,
             RESOURCE_KIND_TOOL,
             RESOURCE_KIND_SESSION
           ]),
@@ -18700,25 +18726,6 @@ var init_project_resources = __esm({
   }
 });
 
-// ../../packages/schemas/src/profiles.ts
-var LEGACY_PROFILE_HARNESSES, LegacyProfileSpecSchema, LegacyProfileResourceSchema;
-var init_profiles2 = __esm({
-  "../../packages/schemas/src/profiles.ts"() {
-    "use strict";
-    init_zod();
-    init_resources();
-    LEGACY_PROFILE_HARNESSES = ["claude-code"];
-    LegacyProfileSpecSchema = external_exports.object({
-      harness: external_exports.enum(LEGACY_PROFILE_HARNESSES),
-      instructions: external_exports.string().trim().min(1).max(1e5).optional(),
-      environment: ResourceNameSchema
-    }).strict();
-    LegacyProfileResourceSchema = resourceEnvelopeSchema(
-      LegacyProfileSpecSchema
-    );
-  }
-});
-
 // ../../packages/schemas/src/realtime.ts
 var RunRealtimeEventSchema;
 var init_realtime = __esm({
@@ -18806,7 +18813,6 @@ var init_session_runs = __esm({
     init_environments();
     init_ids();
     init_primitives();
-    init_profiles2();
     init_sessions();
     init_tools();
     SESSION_RUN_STATUSES = [
@@ -18858,7 +18864,6 @@ var init_session_runs = __esm({
       displayTitle: SessionRunDisplayTitleSchema,
       starterActor: AuthActorSchema.nullable(),
       sessionSnapshot: SessionResourceSchema,
-      profileSnapshot: LegacyProfileResourceSchema,
       environmentSnapshot: EnvironmentResourceSchema,
       toolSnapshots: external_exports.array(
         external_exports.discriminatedUnion("source", [
@@ -19029,7 +19034,6 @@ var init_run_introspection = __esm({
       run: external_exports.object({
         id: SessionRunIdSchema,
         sessionName: external_exports.string(),
-        profileName: external_exports.string(),
         displayTitle: external_exports.string(),
         status: SessionRunStatusSchema,
         error: JsonValueSchema.nullable(),
@@ -19438,6 +19442,7 @@ var init_src = __esm({
     init_connections();
     init_github_credentials();
     init_github_mcp_catalog();
+    init_identities();
     init_ids();
     init_environments();
     init_mcp();
@@ -19445,7 +19450,6 @@ var init_src = __esm({
     init_provider_grants();
     init_project_service_accounts();
     init_project_resources();
-    init_profiles2();
     init_primitives();
     init_realtime();
     init_resources();
@@ -19654,6 +19658,13 @@ function createResourceApi(context) {
     path: "/tools",
     applyResponseSchema: ToolResourceSchema
   });
+  const identities = projectResource(
+    context,
+    {
+      path: "/identities",
+      applyResponseSchema: IdentityResourceSchema
+    }
+  );
   return {
     applyEnvironmentResource: environments.apply,
     hasAvatarAsset: (request, options) => hasAvatarAsset(context, request, options ?? {}),
@@ -19668,6 +19679,7 @@ function createResourceApi(context) {
     createProjectServiceAccount: (request, options) => createProjectServiceAccount(context, request, options ?? {}),
     deleteProjectResource: (request, options) => deleteProjectResource(context, request, options ?? {}),
     listEnvironments: environments.list,
+    listIdentities: identities.list,
     listProjectServiceAccounts: (options) => listProjectServiceAccounts(context, options ?? {}),
     listSessions: sessions.list,
     listTools: tools.list,
@@ -21213,7 +21225,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.128",
+      version: "0.1.130",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -21460,28 +21472,39 @@ async function uploadAvatarAsset2(client, asset, apiBaseUrl) {
   }
 }
 function stampAvatarSha256(resource, assets) {
-  if (resource.kind !== "session") {
-    return resource;
-  }
-  const identity2 = resource.spec.identity;
-  const avatar = identity2?.avatar;
-  if (!identity2 || !avatar) {
-    return resource;
-  }
-  const asset = assets[avatar.asset];
-  if (!asset) {
-    return resource;
-  }
-  return {
-    ...resource,
-    spec: {
-      ...resource.spec,
-      identity: {
-        ...identity2,
+  if (resource.kind === "identity") {
+    const avatar = resource.spec.avatar;
+    const asset = avatar ? assets[avatar.asset] : void 0;
+    if (!avatar || !asset) {
+      return resource;
+    }
+    return {
+      ...resource,
+      spec: {
+        ...resource.spec,
         avatar: { asset: avatar.asset, sha256: asset.sha256 }
       }
+    };
+  }
+  if (resource.kind === "session" && typeof resource.spec.identity === "object" && resource.spec.identity !== null && !Array.isArray(resource.spec.identity)) {
+    const identity2 = resource.spec.identity;
+    const avatar = identity2.avatar;
+    const asset = avatar ? assets[avatar.asset] : void 0;
+    if (!avatar || !asset) {
+      return resource;
     }
-  };
+    return {
+      ...resource,
+      spec: {
+        ...resource.spec,
+        identity: {
+          ...identity2,
+          avatar: { asset: avatar.asset, sha256: asset.sha256 }
+        }
+      }
+    };
+  }
+  return resource;
 }
 function formatMegabytes(bytes) {
   return (bytes / (1024 * 1024)).toFixed(1);
@@ -21647,26 +21670,23 @@ function readApplyDocument(document) {
 function readApplyAssets(resources, projectRoot) {
   const assets = {};
   for (const resource of resources) {
-    if (resource.kind !== RESOURCE_KIND_SESSION) {
-      continue;
-    }
-    const avatarAsset = resource.spec.identity?.avatar?.asset;
-    if (!avatarAsset || assets[avatarAsset]) {
+    const target = avatarAssetTarget(resource);
+    if (!target || assets[target.asset]) {
       continue;
     }
     const resolvedPath = validateSessionAvatarAsset({
-      asset: avatarAsset,
-      resourceName: resource.metadata.name,
+      asset: target.asset,
+      resourceName: target.resourceName,
       projectRoot
     });
     const bytes = readFileSync3(resolvedPath);
     const dimensionsProblem = avatarAssetDimensionsProblem(bytes);
     if (dimensionsProblem) {
       throw new Error(
-        `Invalid session identity avatar asset for "${resource.metadata.name}": ${dimensionsProblem}`
+        `Invalid identity avatar asset for "${target.resourceName}": ${dimensionsProblem}`
       );
     }
-    assets[avatarAsset] = {
+    assets[target.asset] = {
       sha256: createHash3("sha256").update(bytes).digest("hex"),
       contentType: extname(resolvedPath).toLowerCase() === ".png" ? "image/png" : "image/jpeg",
       dataBase64: bytes.toString("base64")
@@ -21674,16 +21694,27 @@ function readApplyAssets(resources, projectRoot) {
   }
   return assets;
 }
+function avatarAssetTarget(resource) {
+  if (resource.kind === RESOURCE_KIND_IDENTITY) {
+    const asset = resource.spec.avatar?.asset;
+    return asset ? { asset, resourceName: resource.metadata.name } : void 0;
+  }
+  if (resource.kind === RESOURCE_KIND_SESSION && typeof resource.spec.identity === "object" && resource.spec.identity !== null && !Array.isArray(resource.spec.identity)) {
+    const asset = resource.spec.identity.avatar?.asset;
+    return asset ? { asset, resourceName: resource.metadata.name } : void 0;
+  }
+  return void 0;
+}
 function validateSessionAvatarAsset(input) {
   if (isAbsolute(input.asset)) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset path must be relative`
+      `Invalid identity avatar asset for "${input.resourceName}": asset path must be relative`
     );
   }
   const relativeAssetPath = input.asset.replaceAll("\\", "/");
   if (!relativeAssetPath.startsWith(".auto/assets/") && relativeAssetPath !== ".auto/assets") {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset path must be under .auto/assets`
+      `Invalid identity avatar asset for "${input.resourceName}": asset path must be under .auto/assets`
     );
   }
   const projectRoot = realpathSync(input.projectRoot);
@@ -21693,7 +21724,7 @@ function validateSessionAvatarAsset(input) {
     assetsRoot = realpathSync(resolve(projectRoot, ".auto", "assets"));
   } catch {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": .auto/assets directory does not exist`
+      `Invalid identity avatar asset for "${input.resourceName}": .auto/assets directory does not exist`
     );
   }
   let resolvedAssetPath;
@@ -21703,28 +21734,28 @@ function validateSessionAvatarAsset(input) {
     stat = statSync(resolvedAssetPath);
   } catch {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": ${input.asset} does not exist`
+      `Invalid identity avatar asset for "${input.resourceName}": ${input.asset} does not exist`
     );
   }
   if (!(resolvedAssetPath === assetsRoot || isInside(resolvedAssetPath, assetsRoot))) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset path must stay inside .auto/assets`
+      `Invalid identity avatar asset for "${input.resourceName}": asset path must stay inside .auto/assets`
     );
   }
   if (!stat.isFile()) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset must be a file`
+      `Invalid identity avatar asset for "${input.resourceName}": asset must be a file`
     );
   }
   if (stat.size > MAX_AVATAR_ASSET_BYTES) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset must be ${MAX_AVATAR_ASSET_BYTES} bytes or smaller`
+      `Invalid identity avatar asset for "${input.resourceName}": asset must be ${MAX_AVATAR_ASSET_BYTES} bytes or smaller`
     );
   }
   const extension = extname(resolvedAssetPath).toLowerCase();
   if (!ALLOWED_AVATAR_EXTENSIONS.has(extension)) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset must be a PNG or JPEG image`
+      `Invalid identity avatar asset for "${input.resourceName}": asset must be a PNG or JPEG image`
     );
   }
   return resolvedAssetPath;
@@ -21793,11 +21824,13 @@ var init_files = __esm({
     init_src();
     APPLY_DIRECTORIES = {
       environment: "environments",
+      identity: "identities",
       tool: "tools",
       session: "sessions"
     };
     APPLY_SCHEMAS = {
       environment: EnvironmentApplyRequestSchema,
+      identity: IdentityApplyRequestSchema,
       tool: ToolApplyRequestSchema,
       session: SessionApplyRequestSchema
     };
@@ -21969,6 +22002,8 @@ async function listProjectResources2(client, kind, options) {
   switch (kind) {
     case RESOURCE_KIND_ENVIRONMENT:
       return (await client.listEnvironments(options)).environments;
+    case RESOURCE_KIND_IDENTITY:
+      return (await client.listIdentities(options)).identities;
     case RESOURCE_KIND_TOOL:
       return (await client.listTools(options)).tools;
     case RESOURCE_KIND_SESSION:
@@ -22003,6 +22038,12 @@ var init_resources3 = __esm({
         label: "Tool",
         pluralLabel: "Tools"
       },
+      [RESOURCE_KIND_IDENTITY]: {
+        kind: RESOURCE_KIND_IDENTITY,
+        section: "identities",
+        label: "Identity",
+        pluralLabel: "Identities"
+      },
       [RESOURCE_KIND_SESSION]: {
         kind: RESOURCE_KIND_SESSION,
         section: "sessions",
@@ -22012,6 +22053,7 @@ var init_resources3 = __esm({
     };
     PROJECT_RESOURCE_TUI_ORDER = [
       RESOURCE_KIND_SESSION,
+      RESOURCE_KIND_IDENTITY,
       RESOURCE_KIND_ENVIRONMENT,
       RESOURCE_KIND_TOOL
     ];
@@ -24466,6 +24508,32 @@ function ToolsView({
     }
   );
 }
+function IdentitiesView({
+  resources,
+  selectedIndex,
+  error: error51
+}) {
+  return /* @__PURE__ */ jsx9(
+    ResourceTable,
+    {
+      rows: resources.map((identity2) => ({
+        id: identity2.metadata.uid,
+        name: identity2.metadata.name,
+        kind: identity2.spec.displayName ?? "",
+        target: identity2.spec.username ?? "",
+        detail: identity2.spec.avatar?.asset ?? identity2.spec.description ?? "",
+        updatedAt: identity2.metadata.updatedAt
+      })),
+      selectedIndex,
+      error: error51,
+      empty: "no identities found",
+      kindHeader: "DISPLAY",
+      targetHeader: "USERNAME",
+      detailHeader: "AVATAR / DESCRIPTION",
+      flexColumn: "detail"
+    }
+  );
+}
 function ServiceAccountsView({
   resources,
   selectedIndex,
@@ -24650,6 +24718,10 @@ function useEnvironments(apiUrl) {
   const client = useApiClient();
   return useQuery(environmentsQueryOptions(client, apiUrl));
 }
+function useIdentities(apiUrl) {
+  const client = useApiClient();
+  return useQuery(identitiesQueryOptions(client, apiUrl));
+}
 function useTools(apiUrl) {
   const client = useApiClient();
   return useQuery(toolsQueryOptions(client, apiUrl));
@@ -24927,6 +24999,14 @@ function environmentsQueryOptions(client, apiUrl) {
     staleTime: Number.POSITIVE_INFINITY
   });
 }
+function identitiesQueryOptions(client, apiUrl) {
+  return queryOptions({
+    queryKey: queryKeys.identities(apiUrl),
+    queryFn: async () => (await client.listIdentities({ apiBaseUrl: apiUrl })).identities,
+    select: sortByName,
+    staleTime: Number.POSITIVE_INFINITY
+  });
+}
 function sessionsQueryOptions(client, apiUrl) {
   return queryOptions({
     queryKey: queryKeys.sessions(apiUrl),
@@ -25022,6 +25102,7 @@ var init_queries = __esm({
     TUI_RUN_LIST_LIMIT = 200;
     queryKeys = {
       environments: (apiUrl) => ["environments", apiUrl],
+      identities: (apiUrl) => ["identities", apiUrl],
       sessions: (apiUrl) => ["sessions", apiUrl],
       tools: (apiUrl) => ["tools", apiUrl],
       projects: (apiUrl) => ["projects", apiUrl],
@@ -25486,6 +25567,8 @@ function selectedNamedResourceForSection(input) {
   switch (input.activeSection) {
     case "environments":
       return input.selectedEnvironment ?? null;
+    case "identities":
+      return input.selectedIdentity ?? null;
     case "sessions":
       return input.selectedSession ?? null;
     case "tools":
@@ -25528,6 +25611,7 @@ function HomeView({ apiUrl, notice, returnToSession }) {
   );
   const [sessionIndex, setSessionIndex] = useState3(0);
   const [environmentIndex, setEnvironmentIndex] = useState3(0);
+  const [identityIndex, setIdentityIndex] = useState3(0);
   const [toolIndex, setToolIndex] = useState3(0);
   const [projectIndex, setProjectIndex] = useState3(0);
   const [serviceAccountIndex, setServiceAccountIndex] = useState3(0);
@@ -25563,6 +25647,11 @@ function HomeView({ apiUrl, notice, returnToSession }) {
     isLoading: isEnvironmentsLoading,
     error: environmentsError
   } = useEnvironments(apiUrl);
+  const {
+    data: identities = [],
+    isLoading: isIdentitiesLoading,
+    error: identitiesError
+  } = useIdentities(apiUrl);
   const {
     data: tools = [],
     isLoading: isToolsLoading,
@@ -25655,11 +25744,13 @@ function HomeView({ apiUrl, notice, returnToSession }) {
   const selectedServiceAccount = serviceAccounts[serviceAccountIndex];
   const selectedSession = sessions[sessionIndex];
   const selectedEnvironment = environments[environmentIndex];
+  const selectedIdentity = identities[identityIndex];
   const selectedTool = tools[toolIndex];
   const selectedInspectableResource = useMemo3(() => {
     const selectedEditable = editableResourceForSelection({
       activeSection,
       selectedEnvironment,
+      selectedIdentity,
       selectedSession,
       selectedTool
     });
@@ -25679,6 +25770,12 @@ function HomeView({ apiUrl, notice, returnToSession }) {
           name: selectedEditable.name,
           spec: selectedEnvironment.spec
         } : null;
+      case "identities":
+        return selectedIdentity ? {
+          kind: selectedEditable.kind,
+          name: selectedEditable.name,
+          spec: selectedIdentity.spec
+        } : null;
       case "tools":
         return selectedTool ? {
           kind: selectedEditable.kind,
@@ -25688,15 +25785,28 @@ function HomeView({ apiUrl, notice, returnToSession }) {
       default:
         return null;
     }
-  }, [activeSection, selectedEnvironment, selectedSession, selectedTool]);
+  }, [
+    activeSection,
+    selectedEnvironment,
+    selectedIdentity,
+    selectedSession,
+    selectedTool
+  ]);
   const selectedEditableResource = useMemo3(
     () => editableResourceForSelection({
       activeSection,
       selectedEnvironment,
+      selectedIdentity,
       selectedSession,
       selectedTool
     }),
-    [activeSection, selectedEnvironment, selectedSession, selectedTool]
+    [
+      activeSection,
+      selectedEnvironment,
+      selectedIdentity,
+      selectedSession,
+      selectedTool
+    ]
   );
   const inspectPanelHeight = Math.max(1, termHeight - 12);
   const scopedSession = runScopeSessionName ? sessions.find((session) => session.metadata.name === runScopeSessionName) : void 0;
@@ -26290,6 +26400,16 @@ function HomeView({ apiUrl, notice, returnToSession }) {
         return;
       }
     }
+    if (activeSection === "identities") {
+      if (key.upArrow) {
+        setIdentityIndex((i) => Math.max(0, i - 1));
+        return;
+      }
+      if (key.downArrow) {
+        setIdentityIndex((i) => clampListIndex(i + 1, identities.length));
+        return;
+      }
+    }
     if (activeSection === "tools") {
       if (key.upArrow) {
         setToolIndex((i) => Math.max(0, i - 1));
@@ -26580,9 +26700,10 @@ function HomeView({ apiUrl, notice, returnToSession }) {
       sectionTitle = `Service Accounts[${serviceAccounts.length}]`;
       break;
     case "environments":
+    case "identities":
     case "tools": {
       const definition = PROJECT_RESOURCE_TUI_DEFINITIONS_BY_SECTION.get(activeSection);
-      const count = activeSection === "environments" ? environments.length : tools.length;
+      const count = activeSection === "environments" ? environments.length : activeSection === "identities" ? identities.length : tools.length;
       sectionTitle = `${definition?.pluralLabel ?? activeSection}[${count}]`;
       break;
     }
@@ -26761,6 +26882,13 @@ function HomeView({ apiUrl, notice, returnToSession }) {
             selectedSession,
             error: toolsError instanceof Error ? toolsError.message : toolsError ? String(toolsError) : null
           }
+        ) : activeSection === "identities" ? isIdentitiesLoading ? /* @__PURE__ */ jsx14(Box13, { padding: 2, children: /* @__PURE__ */ jsx14(Spinner, { label: "loading identities\u2026" }) }) : /* @__PURE__ */ jsx14(
+          IdentitiesView,
+          {
+            resources: identities,
+            selectedIndex: identityIndex,
+            error: identitiesError instanceof Error ? identitiesError.message : identitiesError ? String(identitiesError) : null
+          }
         ) : activeSection === "sessions" ? /* @__PURE__ */ jsx14(
           SessionsView,
           {
@@ -26865,7 +26993,7 @@ function HomeView({ apiUrl, notice, returnToSession }) {
         /* @__PURE__ */ jsx14(Text14, { dimColor: true, children: ` ${inspectedResource.name} ` }),
         /* @__PURE__ */ jsx14(Text14, { dimColor: true, children: "\u203A" }),
         /* @__PURE__ */ jsx14(Text14, { backgroundColor: "cyan", color: "black", children: " inspect " })
-      ] }) : (activeSection === "projects" || activeSection === "environments" || activeSection === "tools" || activeSection === "serviceAccounts" || activeSection === "connections") && /* @__PURE__ */ jsx14(
+      ] }) : (activeSection === "projects" || activeSection === "environments" || activeSection === "identities" || activeSection === "tools" || activeSection === "serviceAccounts" || activeSection === "connections") && /* @__PURE__ */ jsx14(
         Text14,
         {
           backgroundColor: "cyan",
@@ -27105,10 +27233,11 @@ var init_HomeView = __esm({
       resourceNavItem({ k: "1", section: "sessions" }),
       { k: "2", label: "Runs", activeSection: "runs" },
       resourceNavItem({ k: "3", section: "environments" }),
-      resourceNavItem({ k: "4", section: "tools" }),
-      { k: "5", label: "Projects", activeSection: "projects" },
-      { k: "6", label: "Service Accounts", activeSection: "serviceAccounts" },
-      { k: "7", label: "Connections", activeSection: "connections" }
+      resourceNavItem({ k: "4", section: "identities" }),
+      resourceNavItem({ k: "5", section: "tools" }),
+      { k: "6", label: "Projects", activeSection: "projects" },
+      { k: "7", label: "Service Accounts", activeSection: "serviceAccounts" },
+      { k: "8", label: "Connections", activeSection: "connections" }
     ];
     RESOURCES_PER_COLUMN = 4;
   }
@@ -27217,6 +27346,7 @@ async function launch(opts) {
   });
   const prefetchP = Promise.allSettled([
     apiClient.listSessions({ apiBaseUrl: apiUrl }),
+    apiClient.listIdentities({ apiBaseUrl: apiUrl }),
     apiClient.listProjects({ apiBaseUrl: apiUrl }),
     apiClient.listProjectServiceAccounts({ apiBaseUrl: apiUrl }),
     apiClient.listConnections({ apiBaseUrl: apiUrl }),
@@ -27229,6 +27359,7 @@ async function launch(opts) {
   const [, prefetchResult] = await Promise.all([waitSplash(), prefetchP]);
   const [
     sessionsResult,
+    identitiesResult,
     projectsResult,
     serviceAccountsResult,
     connectionsResult,
@@ -27240,6 +27371,12 @@ async function launch(opts) {
       sortSessions(sessionsResult.value.sessions)
     );
   }
+  if (identitiesResult.status === "fulfilled") {
+    queryClient.setQueryData(
+      queryKeys.identities(apiUrl),
+      sortByResourceName(identitiesResult.value.identities)
+    );
+  }
   if (projectsResult.status === "fulfilled") {
     queryClient.setQueryData(
       queryKeys.projects(apiUrl),
@@ -27371,6 +27508,13 @@ var init_launcher = __esm({
         queryKey: queryKeys.tools,
         sort: sortByResourceName
       },
+      [RESOURCE_KIND_IDENTITY]: {
+        async list({ apiClient, apiUrl }) {
+          return (await apiClient.listIdentities({ apiBaseUrl: apiUrl })).identities;
+        },
+        queryKey: queryKeys.identities,
+        sort: sortByResourceName
+      },
       [RESOURCE_KIND_SESSION]: {
         async list({ apiClient, apiUrl }) {
           return (await apiClient.listSessions({ apiBaseUrl: apiUrl })).sessions;
@@ -31948,7 +32092,7 @@ function formatRunShowText(result, writeLine, style) {
   const { summary } = result;
   writeLine(
     `${style.id(summary.run.id)} ${styleRunStatus(style, summary.run.status)} ${style.dim(
-      `session=${summary.run.sessionName} profile=${summary.run.profileName}`
+      `session=${summary.run.sessionName}`
     )}`
   );
   if (summary.run.displayTitle) {