@autohq/cli 0.1.129 → 0.1.131

package/dist/index.js

@@ -16052,7 +16052,7 @@ var init_zod = __esm({
 });
 
 // ../../packages/schemas/src/ids.ts
-var OpaqueIdSchema, ProfileIdSchema, EnvironmentIdSchema, ConnectionIdSchema, ExternalAccountIdSchema, OrganizationIdSchema, ProjectIdSchema, ProviderGrantIdSchema, ServiceAccountIdSchema, SessionIdSchema, SessionRunIdSchema, SessionRunCommandIdSchema, RuntimeIdSchema, RuntimeBridgeLeaseIdSchema, EnvironmentSetupSnapshotIdSchema, ToolIdSchema, UserIdSchema;
+var OpaqueIdSchema, ProfileIdSchema, EnvironmentIdSchema, IdentityIdSchema, ConnectionIdSchema, ExternalAccountIdSchema, OrganizationIdSchema, ProjectIdSchema, ProviderGrantIdSchema, ServiceAccountIdSchema, SessionIdSchema, SessionRunIdSchema, SessionRunCommandIdSchema, RuntimeIdSchema, RuntimeBridgeLeaseIdSchema, EnvironmentSetupSnapshotIdSchema, ToolIdSchema, UserIdSchema;
 var init_ids = __esm({
   "../../packages/schemas/src/ids.ts"() {
     "use strict";
@@ -16060,6 +16060,7 @@ var init_ids = __esm({
     OpaqueIdSchema = external_exports.string().trim().min(1);
     ProfileIdSchema = OpaqueIdSchema.brand();
     EnvironmentIdSchema = OpaqueIdSchema.brand();
+    IdentityIdSchema = OpaqueIdSchema.brand();
     ConnectionIdSchema = OpaqueIdSchema.brand();
     ExternalAccountIdSchema = OpaqueIdSchema.brand();
     OrganizationIdSchema = OpaqueIdSchema.brand();
@@ -17431,193 +17432,6 @@ var init_github_mcp_catalog = __esm({
   }
 });
 
-// ../../packages/schemas/src/secrets.ts
-var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretSetRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema;
-var init_secrets = __esm({
-  "../../packages/schemas/src/secrets.ts"() {
-    "use strict";
-    init_zod();
-    init_resources();
-    SECRET_ENCRYPTION_ALGORITHM = "AES-256-GCM";
-    SecretEnvNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
-    SecretCiphertextFieldSchema = external_exports.string().trim().min(1).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
-    SecretAesGcmIvSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{16}$/);
-    SecretAesGcmAuthTagSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{22}==$/);
-    SecretEnvValueSchema = external_exports.union([
-      external_exports.string(),
-      external_exports.object({
-        $secret: ResourceNameSchema,
-        optional: external_exports.boolean().optional()
-      })
-    ]);
-    SecretEnvSchema = external_exports.record(
-      SecretEnvNameSchema,
-      SecretEnvValueSchema
-    );
-    EncryptedSecretValueSchema = external_exports.object({
-      keyVersion: external_exports.string().trim().min(1),
-      algorithm: external_exports.literal(SECRET_ENCRYPTION_ALGORITHM),
-      ciphertext: SecretCiphertextFieldSchema,
-      valueIv: SecretAesGcmIvSchema,
-      valueAuthTag: SecretAesGcmAuthTagSchema,
-      encryptedDek: SecretCiphertextFieldSchema,
-      dekIv: SecretAesGcmIvSchema,
-      dekAuthTag: SecretAesGcmAuthTagSchema
-    });
-    SecretSetRequestSchema = external_exports.object({
-      value: external_exports.string()
-    });
-    SecretMetadataSchema = external_exports.object({
-      id: external_exports.string().trim().min(1),
-      organizationId: external_exports.string().trim().min(1),
-      projectId: external_exports.string().trim().min(1).nullable(),
-      name: ResourceNameSchema,
-      createdAt: external_exports.string().datetime(),
-      updatedAt: external_exports.string().datetime()
-    });
-    SecretSetResponseSchema = external_exports.object({
-      secret: SecretMetadataSchema
-    });
-    SecretListResponseSchema = external_exports.object({
-      secrets: external_exports.array(SecretMetadataSchema)
-    });
-    SecretDeleteResponseSchema = external_exports.object({
-      secret: SecretMetadataSchema
-    });
-  }
-});
-
-// ../../packages/schemas/src/environments.ts
-function environmentSetupSchema(cachePathSchema) {
-  return external_exports.object({
-    name: ResourceNameSchema,
-    commands: external_exports.array(external_exports.string().trim().min(1)).min(1),
-    cache: external_exports.object({
-      key: ResourceNameSchema.optional(),
-      files: external_exports.array(
-        external_exports.string().trim().refine(isSafeRelativePath, {
-          message: "Expected a relative path without traversal"
-        })
-      ).default([]),
-      paths: external_exports.array(cachePathSchema).default([])
-    }).strict().default({ files: [], paths: [] })
-  }).strict();
-}
-function environmentSpecSchema(setupSchema) {
-  return external_exports.object({
-    image: EnvironmentImageSchema,
-    env: SecretEnvSchema.default({}),
-    resources: EnvironmentResourcesSchema.optional(),
-    steps: external_exports.array(external_exports.string()).default([]),
-    setup: external_exports.array(setupSchema).default([]),
-    setupCache: EnvironmentSetupCacheSchema.optional()
-  }).strict();
-}
-function isSafeSandboxUserHomePath(value, options = {}) {
-  return (options.allowedHomes ?? [CURRENT_SANDBOX_USER_HOME]).some(
-    (home) => isSafePathUnderHome(value, home)
-  );
-}
-function isSafePathUnderHome(value, home) {
-  const prefix = `${home}/`;
-  if (!value.startsWith(prefix)) {
-    return false;
-  }
-  const relative = value.slice(prefix.length);
-  return relative.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isSafeRelativePath(value) {
-  if (!value || value.startsWith("/")) {
-    return false;
-  }
-  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isSetupCacheTtl(value) {
-  return /^[1-9][0-9]*(s|m|h|d)$/.test(value);
-}
-var RESOURCE_KIND_ENVIRONMENT, CURRENT_SANDBOX_USER_HOME, LEGACY_SANDBOX_USER_HOMES, STORED_SANDBOX_USER_HOMES, EnvironmentSetupCachePathSchema, StoredEnvironmentSetupCachePathSchema, EnvironmentImageSchema, EnvironmentSetupSchema, EnvironmentApplySetupSchema, EnvironmentSetupCacheSchema, EnvironmentResourcesSchema, EnvironmentSpecSchema, EnvironmentApplySpecSchema, EnvironmentResourceSchema, EnvironmentApplyRequestSchema;
-var init_environments = __esm({
-  "../../packages/schemas/src/environments.ts"() {
-    "use strict";
-    init_zod();
-    init_resources();
-    init_secrets();
-    RESOURCE_KIND_ENVIRONMENT = "environment";
-    CURRENT_SANDBOX_USER_HOME = "/home/user";
-    LEGACY_SANDBOX_USER_HOMES = ["/home/auto", "/home/node"];
-    STORED_SANDBOX_USER_HOMES = [
-      CURRENT_SANDBOX_USER_HOME,
-      ...LEGACY_SANDBOX_USER_HOMES
-    ];
-    EnvironmentSetupCachePathSchema = external_exports.string().trim().refine((value) => isSafeSandboxUserHomePath(value), {
-      message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
-    });
-    StoredEnvironmentSetupCachePathSchema = external_exports.string().trim().refine(
-      (value) => isSafeSandboxUserHomePath(value, {
-        allowedHomes: STORED_SANDBOX_USER_HOMES
-      }),
-      {
-        message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
-      }
-    );
-    EnvironmentImageSchema = external_exports.object({
-      kind: external_exports.literal("preset"),
-      name: ResourceNameSchema
-    }).strict();
-    EnvironmentSetupSchema = environmentSetupSchema(
-      StoredEnvironmentSetupCachePathSchema
-    );
-    EnvironmentApplySetupSchema = environmentSetupSchema(
-      EnvironmentSetupCachePathSchema
-    );
-    EnvironmentSetupCacheSchema = external_exports.object({
-      ttl: external_exports.string().trim().refine(isSetupCacheTtl, {
-        message: "Expected a positive setup cache TTL such as 30m, 24h, or 7d"
-      })
-    }).strict();
-    EnvironmentResourcesSchema = external_exports.object({
-      cpuCount: external_exports.number().int().min(1).optional(),
-      memoryMB: external_exports.number().int().min(128).optional()
-    }).strict().refine(
-      (resources) => resources.cpuCount !== void 0 || resources.memoryMB !== void 0,
-      {
-        message: "Expected at least one runtime resource setting"
-      }
-    );
-    EnvironmentSpecSchema = environmentSpecSchema(
-      EnvironmentSetupSchema
-    );
-    EnvironmentApplySpecSchema = environmentSpecSchema(
-      EnvironmentApplySetupSchema
-    );
-    EnvironmentResourceSchema = resourceEnvelopeSchema(
-      EnvironmentSpecSchema
-    );
-    EnvironmentApplyRequestSchema = resourceApplySchema(
-      EnvironmentApplySpecSchema
-    );
-  }
-});
-
-// ../../packages/schemas/src/mcp.ts
-var McpToolCallMessageSchema, McpJsonRpcMessageSchema, McpPostBodySchema;
-var init_mcp = __esm({
-  "../../packages/schemas/src/mcp.ts"() {
-    "use strict";
-    init_zod();
-    McpToolCallMessageSchema = external_exports.object({
-      method: external_exports.literal("tools/call"),
-      params: external_exports.object({
-        name: external_exports.string().trim().min(1)
-      })
-    });
-    McpJsonRpcMessageSchema = external_exports.object({
-      method: external_exports.string().optional()
-    }).passthrough();
-    McpPostBodySchema = external_exports.union([McpJsonRpcMessageSchema, external_exports.array(McpJsonRpcMessageSchema)]).transform((body) => Array.isArray(body) ? body : [body]);
-  }
-});
-
 // ../../packages/schemas/src/mounts.ts
 var AbsoluteMountPathSchema, GITHUB_MOUNT_CAPABILITY_LEVELS, GithubMountCapabilityLevelSchema, GITHUB_MOUNT_MERGE_CAPABILITY_LEVELS, GithubMountMergeCapabilityLevelSchema, DEFAULT_GITHUB_MOUNT_CAPABILITIES, GitMountAuthSchema, GitMountSchema, SessionMountSchema;
 var init_mounts = __esm({
@@ -17696,43 +17510,58 @@ var init_mounts = __esm({
   }
 });
 
-// ../../packages/schemas/src/project-service-accounts.ts
-var ProjectServiceAccountSchema, ProjectServiceAccountCreateRequestSchema, ProjectServiceAccountUpdateRequestSchema, ProjectServiceAccountTokenResponseSchema, ProjectServiceAccountUpdateResponseSchema, ProjectServiceAccountRemoveResponseSchema, ProjectServiceAccountListResponseSchema;
-var init_project_service_accounts = __esm({
-  "../../packages/schemas/src/project-service-accounts.ts"() {
+// ../../packages/schemas/src/secrets.ts
+var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretSetRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema;
+var init_secrets = __esm({
+  "../../packages/schemas/src/secrets.ts"() {
     "use strict";
     init_zod();
-    init_auth();
-    init_ids();
     init_resources();
-    ProjectServiceAccountSchema = external_exports.object({
-      id: ServiceAccountIdSchema,
-      organizationId: OrganizationIdSchema,
-      projectId: ProjectIdSchema,
-      name: ResourceNameSchema,
-      scopes: external_exports.array(AuthScopeSchema),
-      createdAt: external_exports.string().datetime()
-    });
-    ProjectServiceAccountCreateRequestSchema = external_exports.object({
-      name: ResourceNameSchema,
-      scopes: external_exports.array(AuthScopeSchema).min(1)
+    SECRET_ENCRYPTION_ALGORITHM = "AES-256-GCM";
+    SecretEnvNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
+    SecretCiphertextFieldSchema = external_exports.string().trim().min(1).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
+    SecretAesGcmIvSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{16}$/);
+    SecretAesGcmAuthTagSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{22}==$/);
+    SecretEnvValueSchema = external_exports.union([
+      external_exports.string(),
+      external_exports.object({
+        $secret: ResourceNameSchema,
+        optional: external_exports.boolean().optional()
+      })
+    ]);
+    SecretEnvSchema = external_exports.record(
+      SecretEnvNameSchema,
+      SecretEnvValueSchema
+    );
+    EncryptedSecretValueSchema = external_exports.object({
+      keyVersion: external_exports.string().trim().min(1),
+      algorithm: external_exports.literal(SECRET_ENCRYPTION_ALGORITHM),
+      ciphertext: SecretCiphertextFieldSchema,
+      valueIv: SecretAesGcmIvSchema,
+      valueAuthTag: SecretAesGcmAuthTagSchema,
+      encryptedDek: SecretCiphertextFieldSchema,
+      dekIv: SecretAesGcmIvSchema,
+      dekAuthTag: SecretAesGcmAuthTagSchema
     });
-    ProjectServiceAccountUpdateRequestSchema = external_exports.object({
-      scopes: external_exports.array(AuthScopeSchema).min(1)
+    SecretSetRequestSchema = external_exports.object({
+      value: external_exports.string()
     });
-    ProjectServiceAccountTokenResponseSchema = external_exports.object({
-      serviceAccount: ProjectServiceAccountSchema,
-      token: external_exports.string().min(1)
+    SecretMetadataSchema = external_exports.object({
+      id: external_exports.string().trim().min(1),
+      organizationId: external_exports.string().trim().min(1),
+      projectId: external_exports.string().trim().min(1).nullable(),
+      name: ResourceNameSchema,
+      createdAt: external_exports.string().datetime(),
+      updatedAt: external_exports.string().datetime()
     });
-    ProjectServiceAccountUpdateResponseSchema = external_exports.object({
-      serviceAccount: ProjectServiceAccountSchema
+    SecretSetResponseSchema = external_exports.object({
+      secret: SecretMetadataSchema
     });
-    ProjectServiceAccountRemoveResponseSchema = external_exports.object({
-      serviceAccount: ProjectServiceAccountSchema,
-      removed: external_exports.literal(true)
+    SecretListResponseSchema = external_exports.object({
+      secrets: external_exports.array(SecretMetadataSchema)
     });
-    ProjectServiceAccountListResponseSchema = external_exports.object({
-      serviceAccounts: external_exports.array(ProjectServiceAccountSchema)
+    SecretDeleteResponseSchema = external_exports.object({
+      secret: SecretMetadataSchema
     });
   }
 });
@@ -17774,7 +17603,7 @@ function remoteMcpToolSchema(input) {
     ]).default({ kind: "none" })
   });
 }
-var RESOURCE_KIND_TOOL, REMOTE_MCP_TRANSPORTS, LOCAL_TOOL_IMPLEMENTATIONS, SecretReferenceSchema, NoToolAuthSchema, McpOAuthToolAuthSchema, ConnectionToolAuthSchema, ConnectionsToolAuthSchema, ToolAliasSchema, RemoteMcpToolSchema, LocalAutoToolSchema, LocalPingToolSchema, LocalChatToolSchema, LocalToolSchema, GithubToolSchema, ToolSpecSchema, ToolResourceSchema, ToolApplyRequestSchema, ToolConnectRequestSchema, ToolConnectResponseSchema, ToolConnectCompleteResponseSchema, ReferencedSessionToolRefSchema, ReferencedSessionToolRefsSchema, InlineSessionToolSchema, SessionToolRefSchema, SessionToolsSchema;
+var REMOTE_MCP_TRANSPORTS, LOCAL_TOOL_IMPLEMENTATIONS, SecretReferenceSchema, NoToolAuthSchema, McpOAuthToolAuthSchema, ConnectionToolAuthSchema, ConnectionsToolAuthSchema, ToolAliasSchema, RemoteMcpToolSchema, LocalAutoToolSchema, LocalPingToolSchema, LocalChatToolSchema, LocalToolSchema, GithubToolSchema, ToolSpecSchema, ToolResourceSchema, ToolApplyRequestSchema, ToolConnectRequestSchema, ToolConnectResponseSchema, ToolConnectCompleteResponseSchema, InlineSessionToolSchema, SessionToolRefSchema, SessionToolsSchema;
 var init_tools = __esm({
   "../../packages/schemas/src/tools.ts"() {
     "use strict";
@@ -17783,7 +17612,6 @@ var init_tools = __esm({
     init_github_mcp_catalog();
     init_ids();
     init_resources();
-    RESOURCE_KIND_TOOL = "tool";
     REMOTE_MCP_TRANSPORTS = ["streamable_http"];
     LOCAL_TOOL_IMPLEMENTATIONS = ["auto", "chat", "ping"];
     SecretReferenceSchema = external_exports.object({
@@ -17878,12 +17706,6 @@ var init_tools = __esm({
       connection: ResourceNameSchema,
       projectId: ProjectIdSchema
     });
-    ReferencedSessionToolRefSchema = external_exports.object({
-      ref: ResourceNameSchema
-    }).strict();
-    ReferencedSessionToolRefsSchema = external_exports.object({
-      refs: external_exports.array(ResourceNameSchema).min(1)
-    }).strict();
     InlineSessionToolSchema = RemoteMcpToolSchema.extend({
       disabled: external_exports.boolean().optional()
     }).or(
@@ -17897,9 +17719,7 @@ var init_tools = __esm({
         disabled: external_exports.boolean().optional()
       })
     );
-    SessionToolRefSchema = InlineSessionToolSchema.or(
-      ReferencedSessionToolRefSchema
-    ).or(ReferencedSessionToolRefsSchema);
+    SessionToolRefSchema = InlineSessionToolSchema;
     SessionToolsSchema = external_exports.record(
       ToolAliasSchema,
       SessionToolRefSchema
@@ -18436,13 +18256,13 @@ var init_sessions = __esm({
         }
       ).optional()
     }).strict().refine((identity2) => Object.keys(identity2).length > 0, {
-      message: "Session identity requires at least one field"
+      message: "Identity requires at least one field"
     });
     SessionSpecFieldsSchema = external_exports.object({
       harness: external_exports.enum(SESSION_HARNESSES).optional(),
       systemPrompt: external_exports.string().trim().min(1).max(1e5).optional(),
       environment: ResourceNameSchema.optional(),
-      identity: SessionIdentitySchema.optional(),
+      identity: external_exports.union([ResourceNameSchema, SessionIdentitySchema]).optional(),
       initialPrompt: external_exports.string().trim().min(1).max(2e4).optional(),
       env: SecretEnvSchema.default({}),
       mounts: external_exports.array(SessionMountSchema).default([]),
@@ -18578,23 +18398,209 @@ var init_sessions = __esm({
   }
 });
 
+// ../../packages/schemas/src/identities.ts
+var RESOURCE_KIND_IDENTITY, IdentitySpecSchema, IdentityResourceSchema, IdentityApplyRequestSchema;
+var init_identities = __esm({
+  "../../packages/schemas/src/identities.ts"() {
+    "use strict";
+    init_resources();
+    init_sessions();
+    RESOURCE_KIND_IDENTITY = "identity";
+    IdentitySpecSchema = SessionIdentitySchema;
+    IdentityResourceSchema = resourceEnvelopeSchema(IdentitySpecSchema);
+    IdentityApplyRequestSchema = resourceApplySchema(IdentitySpecSchema);
+  }
+});
+
+// ../../packages/schemas/src/environments.ts
+function environmentSetupSchema(cachePathSchema) {
+  return external_exports.object({
+    name: ResourceNameSchema,
+    commands: external_exports.array(external_exports.string().trim().min(1)).min(1),
+    cache: external_exports.object({
+      key: ResourceNameSchema.optional(),
+      files: external_exports.array(
+        external_exports.string().trim().refine(isSafeRelativePath, {
+          message: "Expected a relative path without traversal"
+        })
+      ).default([]),
+      paths: external_exports.array(cachePathSchema).default([])
+    }).strict().default({ files: [], paths: [] })
+  }).strict();
+}
+function environmentSpecSchema(setupSchema) {
+  return external_exports.object({
+    image: EnvironmentImageSchema,
+    env: SecretEnvSchema.default({}),
+    resources: EnvironmentResourcesSchema.optional(),
+    steps: external_exports.array(external_exports.string()).default([]),
+    setup: external_exports.array(setupSchema).default([]),
+    setupCache: EnvironmentSetupCacheSchema.optional()
+  }).strict();
+}
+function isSafeSandboxUserHomePath(value, options = {}) {
+  return (options.allowedHomes ?? [CURRENT_SANDBOX_USER_HOME]).some(
+    (home) => isSafePathUnderHome(value, home)
+  );
+}
+function isSafePathUnderHome(value, home) {
+  const prefix = `${home}/`;
+  if (!value.startsWith(prefix)) {
+    return false;
+  }
+  const relative = value.slice(prefix.length);
+  return relative.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function isSafeRelativePath(value) {
+  if (!value || value.startsWith("/")) {
+    return false;
+  }
+  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function isSetupCacheTtl(value) {
+  return /^[1-9][0-9]*(s|m|h|d)$/.test(value);
+}
+var RESOURCE_KIND_ENVIRONMENT, CURRENT_SANDBOX_USER_HOME, LEGACY_SANDBOX_USER_HOMES, STORED_SANDBOX_USER_HOMES, EnvironmentSetupCachePathSchema, StoredEnvironmentSetupCachePathSchema, EnvironmentImageSchema, EnvironmentSetupSchema, EnvironmentApplySetupSchema, EnvironmentSetupCacheSchema, EnvironmentResourcesSchema, EnvironmentSpecSchema, EnvironmentApplySpecSchema, EnvironmentResourceSchema, EnvironmentApplyRequestSchema;
+var init_environments = __esm({
+  "../../packages/schemas/src/environments.ts"() {
+    "use strict";
+    init_zod();
+    init_resources();
+    init_secrets();
+    RESOURCE_KIND_ENVIRONMENT = "environment";
+    CURRENT_SANDBOX_USER_HOME = "/home/user";
+    LEGACY_SANDBOX_USER_HOMES = ["/home/auto", "/home/node"];
+    STORED_SANDBOX_USER_HOMES = [
+      CURRENT_SANDBOX_USER_HOME,
+      ...LEGACY_SANDBOX_USER_HOMES
+    ];
+    EnvironmentSetupCachePathSchema = external_exports.string().trim().refine((value) => isSafeSandboxUserHomePath(value), {
+      message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
+    });
+    StoredEnvironmentSetupCachePathSchema = external_exports.string().trim().refine(
+      (value) => isSafeSandboxUserHomePath(value, {
+        allowedHomes: STORED_SANDBOX_USER_HOMES
+      }),
+      {
+        message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
+      }
+    );
+    EnvironmentImageSchema = external_exports.object({
+      kind: external_exports.literal("preset"),
+      name: ResourceNameSchema
+    }).strict();
+    EnvironmentSetupSchema = environmentSetupSchema(
+      StoredEnvironmentSetupCachePathSchema
+    );
+    EnvironmentApplySetupSchema = environmentSetupSchema(
+      EnvironmentSetupCachePathSchema
+    );
+    EnvironmentSetupCacheSchema = external_exports.object({
+      ttl: external_exports.string().trim().refine(isSetupCacheTtl, {
+        message: "Expected a positive setup cache TTL such as 30m, 24h, or 7d"
+      })
+    }).strict();
+    EnvironmentResourcesSchema = external_exports.object({
+      cpuCount: external_exports.number().int().min(1).optional(),
+      memoryMB: external_exports.number().int().min(128).optional()
+    }).strict().refine(
+      (resources) => resources.cpuCount !== void 0 || resources.memoryMB !== void 0,
+      {
+        message: "Expected at least one runtime resource setting"
+      }
+    );
+    EnvironmentSpecSchema = environmentSpecSchema(
+      EnvironmentSetupSchema
+    );
+    EnvironmentApplySpecSchema = environmentSpecSchema(
+      EnvironmentApplySetupSchema
+    );
+    EnvironmentResourceSchema = resourceEnvelopeSchema(
+      EnvironmentSpecSchema
+    );
+    EnvironmentApplyRequestSchema = resourceApplySchema(
+      EnvironmentApplySpecSchema
+    );
+  }
+});
+
+// ../../packages/schemas/src/mcp.ts
+var McpToolCallMessageSchema, McpJsonRpcMessageSchema, McpPostBodySchema;
+var init_mcp = __esm({
+  "../../packages/schemas/src/mcp.ts"() {
+    "use strict";
+    init_zod();
+    McpToolCallMessageSchema = external_exports.object({
+      method: external_exports.literal("tools/call"),
+      params: external_exports.object({
+        name: external_exports.string().trim().min(1)
+      })
+    });
+    McpJsonRpcMessageSchema = external_exports.object({
+      method: external_exports.string().optional()
+    }).passthrough();
+    McpPostBodySchema = external_exports.union([McpJsonRpcMessageSchema, external_exports.array(McpJsonRpcMessageSchema)]).transform((body) => Array.isArray(body) ? body : [body]);
+  }
+});
+
+// ../../packages/schemas/src/project-service-accounts.ts
+var ProjectServiceAccountSchema, ProjectServiceAccountCreateRequestSchema, ProjectServiceAccountUpdateRequestSchema, ProjectServiceAccountTokenResponseSchema, ProjectServiceAccountUpdateResponseSchema, ProjectServiceAccountRemoveResponseSchema, ProjectServiceAccountListResponseSchema;
+var init_project_service_accounts = __esm({
+  "../../packages/schemas/src/project-service-accounts.ts"() {
+    "use strict";
+    init_zod();
+    init_auth();
+    init_ids();
+    init_resources();
+    ProjectServiceAccountSchema = external_exports.object({
+      id: ServiceAccountIdSchema,
+      organizationId: OrganizationIdSchema,
+      projectId: ProjectIdSchema,
+      name: ResourceNameSchema,
+      scopes: external_exports.array(AuthScopeSchema),
+      createdAt: external_exports.string().datetime()
+    });
+    ProjectServiceAccountCreateRequestSchema = external_exports.object({
+      name: ResourceNameSchema,
+      scopes: external_exports.array(AuthScopeSchema).min(1)
+    });
+    ProjectServiceAccountUpdateRequestSchema = external_exports.object({
+      scopes: external_exports.array(AuthScopeSchema).min(1)
+    });
+    ProjectServiceAccountTokenResponseSchema = external_exports.object({
+      serviceAccount: ProjectServiceAccountSchema,
+      token: external_exports.string().min(1)
+    });
+    ProjectServiceAccountUpdateResponseSchema = external_exports.object({
+      serviceAccount: ProjectServiceAccountSchema
+    });
+    ProjectServiceAccountRemoveResponseSchema = external_exports.object({
+      serviceAccount: ProjectServiceAccountSchema,
+      removed: external_exports.literal(true)
+    });
+    ProjectServiceAccountListResponseSchema = external_exports.object({
+      serviceAccounts: external_exports.array(ProjectServiceAccountSchema)
+    });
+  }
+});
+
 // ../../packages/schemas/src/project-resources.ts
-var EnvironmentApplyDocumentSchema, ToolApplyDocumentSchema, SessionApplyDocumentSchema, ProjectApplyResourceSchema, PROJECT_RESOURCE_APPLY_ORDER, PROJECT_RESOURCE_KINDS, ProjectDeleteResourceSchema, AVATAR_ASSET_CONTENT_TYPES, MAX_AVATAR_ASSET_BASE64_LENGTH, ProjectApplyAssetSchema, ProjectApplyAssetsSchema, AvatarAssetUploadRequestSchema, AvatarAssetUploadResponseSchema, ProjectApplyRequestSchema, ProjectApplySystemConfigSchema, ProjectAppliedResourceSchema, ProjectApplyDiagnosticSchema, ProjectApplyResponseSchema;
+var EnvironmentApplyDocumentSchema, IdentityApplyDocumentSchema, SessionApplyDocumentSchema, ProjectApplyResourceSchema, PROJECT_RESOURCE_APPLY_ORDER, PROJECT_RESOURCE_KINDS, ProjectDeleteResourceSchema, AVATAR_ASSET_CONTENT_TYPES, MAX_AVATAR_ASSET_BASE64_LENGTH, ProjectApplyAssetSchema, ProjectApplyAssetsSchema, AvatarAssetUploadRequestSchema, AvatarAssetUploadResponseSchema, ProjectApplyRequestSchema, ProjectApplySystemConfigSchema, ProjectAppliedResourceSchema, ProjectApplyDiagnosticSchema, ProjectApplyResponseSchema;
 var init_project_resources = __esm({
   "../../packages/schemas/src/project-resources.ts"() {
     "use strict";
     init_zod();
     init_environments();
+    init_identities();
     init_resources();
     init_sessions();
-    init_tools();
     EnvironmentApplyDocumentSchema = resourceApplyDocumentSchema(
       RESOURCE_KIND_ENVIRONMENT,
       EnvironmentApplyRequestSchema.shape.spec
     );
-    ToolApplyDocumentSchema = resourceApplyDocumentSchema(
-      RESOURCE_KIND_TOOL,
-      ToolApplyRequestSchema.shape.spec
+    IdentityApplyDocumentSchema = resourceApplyDocumentSchema(
+      RESOURCE_KIND_IDENTITY,
+      IdentityApplyRequestSchema.shape.spec
     );
     SessionApplyDocumentSchema = resourceApplyDocumentSchema(
       RESOURCE_KIND_SESSION,
@@ -18602,12 +18608,12 @@ var init_project_resources = __esm({
     );
     ProjectApplyResourceSchema = external_exports.discriminatedUnion("kind", [
       EnvironmentApplyDocumentSchema,
-      ToolApplyDocumentSchema,
+      IdentityApplyDocumentSchema,
       SessionApplyDocumentSchema
     ]);
     PROJECT_RESOURCE_APPLY_ORDER = [
       RESOURCE_KIND_ENVIRONMENT,
-      RESOURCE_KIND_TOOL,
+      RESOURCE_KIND_IDENTITY,
       RESOURCE_KIND_SESSION
     ];
     PROJECT_RESOURCE_KINDS = PROJECT_RESOURCE_APPLY_ORDER;
@@ -18652,7 +18658,7 @@ var init_project_resources = __esm({
     });
     ProjectAppliedResourceSchema = external_exports.union([
       EnvironmentResourceSchema,
-      ToolResourceSchema,
+      IdentityResourceSchema,
       SessionResourceSchema
     ]);
     ProjectApplyDiagnosticSchema = external_exports.object({
@@ -18663,7 +18669,7 @@ var init_project_resources = __esm({
       action: external_exports.enum(["create", "update", "unchanged"]),
       kind: external_exports.enum([
         RESOURCE_KIND_ENVIRONMENT,
-        RESOURCE_KIND_TOOL,
+        RESOURCE_KIND_IDENTITY,
         RESOURCE_KIND_SESSION
       ]),
       name: external_exports.string().min(1)
@@ -18678,7 +18684,7 @@ var init_project_resources = __esm({
           action: external_exports.enum(["create", "update", "unchanged", "archive"]),
           kind: external_exports.enum([
             RESOURCE_KIND_ENVIRONMENT,
-            RESOURCE_KIND_TOOL,
+            RESOURCE_KIND_IDENTITY,
             RESOURCE_KIND_SESSION
           ]),
           name: external_exports.string().min(1),
@@ -18689,7 +18695,7 @@ var init_project_resources = __esm({
         external_exports.object({
           kind: external_exports.enum([
             RESOURCE_KIND_ENVIRONMENT,
-            RESOURCE_KIND_TOOL,
+            RESOURCE_KIND_IDENTITY,
             RESOURCE_KIND_SESSION
           ]),
           name: external_exports.string().min(1),
@@ -19416,6 +19422,7 @@ var init_src = __esm({
     init_connections();
     init_github_credentials();
     init_github_mcp_catalog();
+    init_identities();
     init_ids();
     init_environments();
     init_mcp();
@@ -19631,6 +19638,13 @@ function createResourceApi(context) {
     path: "/tools",
     applyResponseSchema: ToolResourceSchema
   });
+  const identities = projectResource(
+    context,
+    {
+      path: "/identities",
+      applyResponseSchema: IdentityResourceSchema
+    }
+  );
   return {
     applyEnvironmentResource: environments.apply,
     hasAvatarAsset: (request, options) => hasAvatarAsset(context, request, options ?? {}),
@@ -19645,6 +19659,7 @@ function createResourceApi(context) {
     createProjectServiceAccount: (request, options) => createProjectServiceAccount(context, request, options ?? {}),
     deleteProjectResource: (request, options) => deleteProjectResource(context, request, options ?? {}),
     listEnvironments: environments.list,
+    listIdentities: identities.list,
     listProjectServiceAccounts: (options) => listProjectServiceAccounts(context, options ?? {}),
     listSessions: sessions.list,
     listTools: tools.list,
@@ -21190,7 +21205,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.129",
+      version: "0.1.131",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -21437,28 +21452,39 @@ async function uploadAvatarAsset2(client, asset, apiBaseUrl) {
   }
 }
 function stampAvatarSha256(resource, assets) {
-  if (resource.kind !== "session") {
-    return resource;
-  }
-  const identity2 = resource.spec.identity;
-  const avatar = identity2?.avatar;
-  if (!identity2 || !avatar) {
-    return resource;
-  }
-  const asset = assets[avatar.asset];
-  if (!asset) {
-    return resource;
-  }
-  return {
-    ...resource,
-    spec: {
-      ...resource.spec,
-      identity: {
-        ...identity2,
+  if (resource.kind === "identity") {
+    const avatar = resource.spec.avatar;
+    const asset = avatar ? assets[avatar.asset] : void 0;
+    if (!avatar || !asset) {
+      return resource;
+    }
+    return {
+      ...resource,
+      spec: {
+        ...resource.spec,
         avatar: { asset: avatar.asset, sha256: asset.sha256 }
       }
+    };
+  }
+  if (resource.kind === "session" && typeof resource.spec.identity === "object" && resource.spec.identity !== null && !Array.isArray(resource.spec.identity)) {
+    const identity2 = resource.spec.identity;
+    const avatar = identity2.avatar;
+    const asset = avatar ? assets[avatar.asset] : void 0;
+    if (!avatar || !asset) {
+      return resource;
     }
-  };
+    return {
+      ...resource,
+      spec: {
+        ...resource.spec,
+        identity: {
+          ...identity2,
+          avatar: { asset: avatar.asset, sha256: asset.sha256 }
+        }
+      }
+    };
+  }
+  return resource;
 }
 function formatMegabytes(bytes) {
   return (bytes / (1024 * 1024)).toFixed(1);
@@ -21534,30 +21560,14 @@ function appliedResourceKind(request, response, index) {
   return kind;
 }
 function mcpOAuthToolConnectionsFromApplyRequest(request) {
-  return request.resources.filter((resource) => resource.kind === RESOURCE_KIND_TOOL).flatMap((resource) => {
-    if (resource.spec.kind !== "mcp_remote" || resource.spec.auth.kind !== "mcp_oauth") {
-      return [];
-    }
-    return [
-      {
-        tool: resource.metadata.name,
-        connection: resource.spec.auth.connection
-      }
-    ];
+  return request.resources.filter((resource) => resource.kind === RESOURCE_KIND_SESSION).flatMap((resource) => {
+    return mcpOAuthToolConnectionsFromSessionTools(resource.spec.tools);
   });
 }
 function mcpOAuthToolConnectionsFromAppliedResources(resources) {
-  return resources.filter((item) => item.kind === RESOURCE_KIND_TOOL).flatMap((item) => {
+  return resources.filter((item) => item.kind === RESOURCE_KIND_SESSION).flatMap((item) => {
     const resource = item.resource;
-    if (resource.spec.kind !== "mcp_remote" || resource.spec.auth.kind !== "mcp_oauth") {
-      return [];
-    }
-    return [
-      {
-        tool: resource.metadata.name,
-        connection: resource.spec.auth.connection
-      }
-    ];
+    return mcpOAuthToolConnectionsFromSessionTools(resource.spec.tools);
   });
 }
 function applyFiles(root) {
@@ -21580,6 +21590,14 @@ function applyFiles(root) {
   }
   return files;
 }
+function mcpOAuthToolConnectionsFromSessionTools(tools) {
+  return Object.entries(tools).flatMap(([alias, tool]) => {
+    if (tool.kind !== "mcp_remote" || tool.disabled || tool.auth.kind !== "mcp_oauth") {
+      return [];
+    }
+    return [{ tool: alias, connection: tool.auth.connection }];
+  });
+}
 function readApplyDocumentFile(path2) {
   const source = readFileSync3(path2, "utf8");
   let documents;
@@ -21624,26 +21642,23 @@ function readApplyDocument(document) {
 function readApplyAssets(resources, projectRoot) {
   const assets = {};
   for (const resource of resources) {
-    if (resource.kind !== RESOURCE_KIND_SESSION) {
-      continue;
-    }
-    const avatarAsset = resource.spec.identity?.avatar?.asset;
-    if (!avatarAsset || assets[avatarAsset]) {
+    const target = avatarAssetTarget(resource);
+    if (!target || assets[target.asset]) {
       continue;
     }
     const resolvedPath = validateSessionAvatarAsset({
-      asset: avatarAsset,
-      resourceName: resource.metadata.name,
+      asset: target.asset,
+      resourceName: target.resourceName,
       projectRoot
     });
     const bytes = readFileSync3(resolvedPath);
     const dimensionsProblem = avatarAssetDimensionsProblem(bytes);
     if (dimensionsProblem) {
       throw new Error(
-        `Invalid session identity avatar asset for "${resource.metadata.name}": ${dimensionsProblem}`
+        `Invalid identity avatar asset for "${target.resourceName}": ${dimensionsProblem}`
       );
     }
-    assets[avatarAsset] = {
+    assets[target.asset] = {
       sha256: createHash3("sha256").update(bytes).digest("hex"),
       contentType: extname(resolvedPath).toLowerCase() === ".png" ? "image/png" : "image/jpeg",
       dataBase64: bytes.toString("base64")
@@ -21651,16 +21666,27 @@ function readApplyAssets(resources, projectRoot) {
   }
   return assets;
 }
+function avatarAssetTarget(resource) {
+  if (resource.kind === RESOURCE_KIND_IDENTITY) {
+    const asset = resource.spec.avatar?.asset;
+    return asset ? { asset, resourceName: resource.metadata.name } : void 0;
+  }
+  if (resource.kind === RESOURCE_KIND_SESSION && typeof resource.spec.identity === "object" && resource.spec.identity !== null && !Array.isArray(resource.spec.identity)) {
+    const asset = resource.spec.identity.avatar?.asset;
+    return asset ? { asset, resourceName: resource.metadata.name } : void 0;
+  }
+  return void 0;
+}
 function validateSessionAvatarAsset(input) {
   if (isAbsolute(input.asset)) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset path must be relative`
+      `Invalid identity avatar asset for "${input.resourceName}": asset path must be relative`
     );
   }
   const relativeAssetPath = input.asset.replaceAll("\\", "/");
   if (!relativeAssetPath.startsWith(".auto/assets/") && relativeAssetPath !== ".auto/assets") {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset path must be under .auto/assets`
+      `Invalid identity avatar asset for "${input.resourceName}": asset path must be under .auto/assets`
     );
   }
   const projectRoot = realpathSync(input.projectRoot);
@@ -21670,7 +21696,7 @@ function validateSessionAvatarAsset(input) {
     assetsRoot = realpathSync(resolve(projectRoot, ".auto", "assets"));
   } catch {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": .auto/assets directory does not exist`
+      `Invalid identity avatar asset for "${input.resourceName}": .auto/assets directory does not exist`
     );
   }
   let resolvedAssetPath;
@@ -21680,28 +21706,28 @@ function validateSessionAvatarAsset(input) {
     stat = statSync(resolvedAssetPath);
   } catch {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": ${input.asset} does not exist`
+      `Invalid identity avatar asset for "${input.resourceName}": ${input.asset} does not exist`
     );
   }
   if (!(resolvedAssetPath === assetsRoot || isInside(resolvedAssetPath, assetsRoot))) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset path must stay inside .auto/assets`
+      `Invalid identity avatar asset for "${input.resourceName}": asset path must stay inside .auto/assets`
     );
   }
   if (!stat.isFile()) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset must be a file`
+      `Invalid identity avatar asset for "${input.resourceName}": asset must be a file`
     );
   }
   if (stat.size > MAX_AVATAR_ASSET_BYTES) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset must be ${MAX_AVATAR_ASSET_BYTES} bytes or smaller`
+      `Invalid identity avatar asset for "${input.resourceName}": asset must be ${MAX_AVATAR_ASSET_BYTES} bytes or smaller`
     );
   }
   const extension = extname(resolvedAssetPath).toLowerCase();
   if (!ALLOWED_AVATAR_EXTENSIONS.has(extension)) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset must be a PNG or JPEG image`
+      `Invalid identity avatar asset for "${input.resourceName}": asset must be a PNG or JPEG image`
     );
   }
   return resolvedAssetPath;
@@ -21770,12 +21796,12 @@ var init_files = __esm({
     init_src();
     APPLY_DIRECTORIES = {
       environment: "environments",
-      tool: "tools",
+      identity: "identities",
       session: "sessions"
     };
     APPLY_SCHEMAS = {
       environment: EnvironmentApplyRequestSchema,
-      tool: ToolApplyRequestSchema,
+      identity: IdentityApplyRequestSchema,
       session: SessionApplyRequestSchema
     };
     ALLOWED_AVATAR_EXTENSIONS = /* @__PURE__ */ new Set([".jpg", ".jpeg", ".png"]);
@@ -21946,8 +21972,8 @@ async function listProjectResources2(client, kind, options) {
   switch (kind) {
     case RESOURCE_KIND_ENVIRONMENT:
       return (await client.listEnvironments(options)).environments;
-    case RESOURCE_KIND_TOOL:
-      return (await client.listTools(options)).tools;
+    case RESOURCE_KIND_IDENTITY:
+      return (await client.listIdentities(options)).identities;
     case RESOURCE_KIND_SESSION:
       return (await client.listSessions(options)).sessions;
   }
@@ -21974,11 +22000,11 @@ var init_resources3 = __esm({
         label: "Environment",
         pluralLabel: "Environments"
       },
-      [RESOURCE_KIND_TOOL]: {
-        kind: RESOURCE_KIND_TOOL,
-        section: "tools",
-        label: "Tool",
-        pluralLabel: "Tools"
+      [RESOURCE_KIND_IDENTITY]: {
+        kind: RESOURCE_KIND_IDENTITY,
+        section: "identities",
+        label: "Identity",
+        pluralLabel: "Identities"
       },
       [RESOURCE_KIND_SESSION]: {
         kind: RESOURCE_KIND_SESSION,
@@ -21989,8 +22015,8 @@ var init_resources3 = __esm({
     };
     PROJECT_RESOURCE_TUI_ORDER = [
       RESOURCE_KIND_SESSION,
-      RESOURCE_KIND_ENVIRONMENT,
-      RESOURCE_KIND_TOOL
+      RESOURCE_KIND_IDENTITY,
+      RESOURCE_KIND_ENVIRONMENT
     ];
     PROJECT_RESOURCE_TUI_DEFINITIONS = PROJECT_RESOURCE_TUI_ORDER.map(
       (kind) => PROJECT_RESOURCE_TUI_DEFINITION_BY_KIND[kind]
@@ -24411,35 +24437,29 @@ function EnvironmentsView({
     }
   );
 }
-function ToolsView({
+function IdentitiesView({
   resources,
   selectedIndex,
-  selectedSession,
   error: error51
 }) {
   return /* @__PURE__ */ jsx9(
     ResourceTable,
     {
-      rows: resources.map((tool) => {
-        const aliases = sessionToolAliases(selectedSession, tool.metadata.name);
-        return {
-          id: tool.metadata.uid,
-          name: tool.metadata.name,
-          kind: toolKind(tool),
-          target: toolTarget(tool),
-          detail: [
-            toolAuth(tool),
-            aliases.length ? `alias:${aliases.join(",")}` : ""
-          ].filter(Boolean).join(" "),
-          updatedAt: tool.metadata.updatedAt
-        };
-      }),
+      rows: resources.map((identity2) => ({
+        id: identity2.metadata.uid,
+        name: identity2.metadata.name,
+        kind: identity2.spec.displayName ?? "",
+        target: identity2.spec.username ?? "",
+        detail: identity2.spec.avatar?.asset ?? identity2.spec.description ?? "",
+        updatedAt: identity2.metadata.updatedAt
+      })),
       selectedIndex,
       error: error51,
-      empty: "no tools found",
-      kindHeader: "KIND",
-      targetHeader: "TARGET",
-      detailHeader: "AUTH / ALIAS"
+      empty: "no identities found",
+      kindHeader: "DISPLAY",
+      targetHeader: "USERNAME",
+      detailHeader: "AVATAR / DESCRIPTION",
+      flexColumn: "detail"
     }
   );
 }
@@ -24556,26 +24576,6 @@ function envValueKind(value) {
   }
   return "unknown";
 }
-function sessionToolAliases(selectedSession, toolName) {
-  if (!selectedSession) return [];
-  return Object.entries(selectedSession.spec.tools).filter(([, value]) => "ref" in value && value.ref === toolName).map(([alias]) => alias).sort();
-}
-function toolKind(tool) {
-  if (tool.spec.kind === "local") return `local/${tool.spec.implementation}`;
-  return tool.spec.kind;
-}
-function toolTarget(tool) {
-  if (tool.spec.kind === "local") return tool.spec.implementation;
-  return tool.spec.url;
-}
-function toolAuth(tool) {
-  const auth = tool.spec.auth;
-  if (auth.kind === "none") return "auth:none";
-  if (auth.kind === "bearer") return "auth:bearer";
-  if (auth.kind === "provider_oauth") return `auth:${auth.provider}`;
-  if (auth.kind === "connection") return `auth:${auth.provider}`;
-  return "auth:unknown";
-}
 var COL_KIND, COL_DETAIL, COL_TARGET, COL_UPDATED, ROW_GAP_COUNT;
 var init_ResourceViews = __esm({
   "src/tui/ResourceViews.tsx"() {
@@ -24627,9 +24627,9 @@ function useEnvironments(apiUrl) {
   const client = useApiClient();
   return useQuery(environmentsQueryOptions(client, apiUrl));
 }
-function useTools(apiUrl) {
+function useIdentities(apiUrl) {
   const client = useApiClient();
-  return useQuery(toolsQueryOptions(client, apiUrl));
+  return useQuery(identitiesQueryOptions(client, apiUrl));
 }
 function useSessionRuns(sessionName, apiUrl, includeArchived = false) {
   const client = useApiClient();
@@ -24904,22 +24904,20 @@ function environmentsQueryOptions(client, apiUrl) {
     staleTime: Number.POSITIVE_INFINITY
   });
 }
-function sessionsQueryOptions(client, apiUrl) {
+function identitiesQueryOptions(client, apiUrl) {
   return queryOptions({
-    queryKey: queryKeys.sessions(apiUrl),
-    queryFn: async () => {
-      const res = await client.listSessions({ apiBaseUrl: apiUrl });
-      return sortSessions(res.sessions);
-    },
+    queryKey: queryKeys.identities(apiUrl),
+    queryFn: async () => (await client.listIdentities({ apiBaseUrl: apiUrl })).identities,
+    select: sortByName,
     staleTime: Number.POSITIVE_INFINITY
   });
 }
-function toolsQueryOptions(client, apiUrl) {
+function sessionsQueryOptions(client, apiUrl) {
   return queryOptions({
-    queryKey: queryKeys.tools(apiUrl),
+    queryKey: queryKeys.sessions(apiUrl),
     queryFn: async () => {
-      const res = await client.listTools({ apiBaseUrl: apiUrl });
-      return sortByName(res.tools);
+      const res = await client.listSessions({ apiBaseUrl: apiUrl });
+      return sortSessions(res.sessions);
     },
     staleTime: Number.POSITIVE_INFINITY
   });
@@ -24999,6 +24997,7 @@ var init_queries = __esm({
     TUI_RUN_LIST_LIMIT = 200;
     queryKeys = {
       environments: (apiUrl) => ["environments", apiUrl],
+      identities: (apiUrl) => ["identities", apiUrl],
       sessions: (apiUrl) => ["sessions", apiUrl],
       tools: (apiUrl) => ["tools", apiUrl],
       projects: (apiUrl) => ["projects", apiUrl],
@@ -25463,10 +25462,10 @@ function selectedNamedResourceForSection(input) {
   switch (input.activeSection) {
     case "environments":
       return input.selectedEnvironment ?? null;
+    case "identities":
+      return input.selectedIdentity ?? null;
     case "sessions":
       return input.selectedSession ?? null;
-    case "tools":
-      return input.selectedTool ?? null;
     default:
       return null;
   }
@@ -25505,7 +25504,7 @@ function HomeView({ apiUrl, notice, returnToSession }) {
   );
   const [sessionIndex, setSessionIndex] = useState3(0);
   const [environmentIndex, setEnvironmentIndex] = useState3(0);
-  const [toolIndex, setToolIndex] = useState3(0);
+  const [identityIndex, setIdentityIndex] = useState3(0);
   const [projectIndex, setProjectIndex] = useState3(0);
   const [serviceAccountIndex, setServiceAccountIndex] = useState3(0);
   const [runIndex, setRunIndex] = useState3(0);
@@ -25541,10 +25540,10 @@ function HomeView({ apiUrl, notice, returnToSession }) {
     error: environmentsError
   } = useEnvironments(apiUrl);
   const {
-    data: tools = [],
-    isLoading: isToolsLoading,
-    error: toolsError
-  } = useTools(apiUrl);
+    data: identities = [],
+    isLoading: isIdentitiesLoading,
+    error: identitiesError
+  } = useIdentities(apiUrl);
   const {
     data: projects = [],
     isLoading: isProjectsLoading,
@@ -25632,13 +25631,13 @@ function HomeView({ apiUrl, notice, returnToSession }) {
   const selectedServiceAccount = serviceAccounts[serviceAccountIndex];
   const selectedSession = sessions[sessionIndex];
   const selectedEnvironment = environments[environmentIndex];
-  const selectedTool = tools[toolIndex];
+  const selectedIdentity = identities[identityIndex];
   const selectedInspectableResource = useMemo3(() => {
     const selectedEditable = editableResourceForSelection({
       activeSection,
       selectedEnvironment,
-      selectedSession,
-      selectedTool
+      selectedIdentity,
+      selectedSession
     });
     if (!selectedEditable) {
       return null;
@@ -25656,24 +25655,24 @@ function HomeView({ apiUrl, notice, returnToSession }) {
           name: selectedEditable.name,
           spec: selectedEnvironment.spec
         } : null;
-      case "tools":
-        return selectedTool ? {
+      case "identities":
+        return selectedIdentity ? {
           kind: selectedEditable.kind,
           name: selectedEditable.name,
-          spec: selectedTool.spec
+          spec: selectedIdentity.spec
         } : null;
       default:
         return null;
     }
-  }, [activeSection, selectedEnvironment, selectedSession, selectedTool]);
+  }, [activeSection, selectedEnvironment, selectedIdentity, selectedSession]);
   const selectedEditableResource = useMemo3(
     () => editableResourceForSelection({
       activeSection,
       selectedEnvironment,
-      selectedSession,
-      selectedTool
+      selectedIdentity,
+      selectedSession
     }),
-    [activeSection, selectedEnvironment, selectedSession, selectedTool]
+    [activeSection, selectedEnvironment, selectedIdentity, selectedSession]
   );
   const inspectPanelHeight = Math.max(1, termHeight - 12);
   const scopedSession = runScopeSessionName ? sessions.find((session) => session.metadata.name === runScopeSessionName) : void 0;
@@ -25716,22 +25715,6 @@ function HomeView({ apiUrl, notice, returnToSession }) {
     );
     if (index >= 0) setEnvironmentIndex(index);
   }, [environments, selectedSession]);
-  useEffect3(() => {
-    const sessionToolRefs = selectedSession ? Object.values(selectedSession.spec.tools).flatMap((tool) => {
-      if ("ref" in tool) {
-        return [tool.ref];
-      }
-      if ("refs" in tool) {
-        return tool.refs;
-      }
-      return [];
-    }) : [];
-    if (sessionToolRefs.length === 0) return;
-    const index = tools.findIndex(
-      (tool) => sessionToolRefs.includes(tool.metadata.name)
-    );
-    if (index >= 0) setToolIndex(index);
-  }, [tools, selectedSession]);
   const connectionStatus = startConnection.error instanceof Error ? startConnection.error.message : allowConnection.error instanceof Error ? allowConnection.error.message : removeConnection.error instanceof Error ? removeConnection.error.message : connectionNotice;
   const startRun = useCallback2(() => {
     if (!scopedSession || triggerRun.isPending) return;
@@ -26267,13 +26250,13 @@ function HomeView({ apiUrl, notice, returnToSession }) {
         return;
       }
     }
-    if (activeSection === "tools") {
+    if (activeSection === "identities") {
       if (key.upArrow) {
-        setToolIndex((i) => Math.max(0, i - 1));
+        setIdentityIndex((i) => Math.max(0, i - 1));
         return;
       }
       if (key.downArrow) {
-        setToolIndex((i) => clampListIndex(i + 1, tools.length));
+        setIdentityIndex((i) => clampListIndex(i + 1, identities.length));
         return;
       }
     }
@@ -26557,9 +26540,9 @@ function HomeView({ apiUrl, notice, returnToSession }) {
       sectionTitle = `Service Accounts[${serviceAccounts.length}]`;
       break;
     case "environments":
-    case "tools": {
+    case "identities": {
       const definition = PROJECT_RESOURCE_TUI_DEFINITIONS_BY_SECTION.get(activeSection);
-      const count = activeSection === "environments" ? environments.length : tools.length;
+      const count = activeSection === "environments" ? environments.length : identities.length;
       sectionTitle = `${definition?.pluralLabel ?? activeSection}[${count}]`;
       break;
     }
@@ -26730,13 +26713,12 @@ function HomeView({ apiUrl, notice, returnToSession }) {
             selectedSession,
             error: environmentsError instanceof Error ? environmentsError.message : environmentsError ? String(environmentsError) : null
           }
-        ) : activeSection === "tools" ? isToolsLoading ? /* @__PURE__ */ jsx14(Box13, { padding: 2, children: /* @__PURE__ */ jsx14(Spinner, { label: "loading tools\u2026" }) }) : /* @__PURE__ */ jsx14(
-          ToolsView,
+        ) : activeSection === "identities" ? isIdentitiesLoading ? /* @__PURE__ */ jsx14(Box13, { padding: 2, children: /* @__PURE__ */ jsx14(Spinner, { label: "loading identities\u2026" }) }) : /* @__PURE__ */ jsx14(
+          IdentitiesView,
           {
-            resources: tools,
-            selectedIndex: toolIndex,
-            selectedSession,
-            error: toolsError instanceof Error ? toolsError.message : toolsError ? String(toolsError) : null
+            resources: identities,
+            selectedIndex: identityIndex,
+            error: identitiesError instanceof Error ? identitiesError.message : identitiesError ? String(identitiesError) : null
           }
         ) : activeSection === "sessions" ? /* @__PURE__ */ jsx14(
           SessionsView,
@@ -26842,7 +26824,7 @@ function HomeView({ apiUrl, notice, returnToSession }) {
         /* @__PURE__ */ jsx14(Text14, { dimColor: true, children: ` ${inspectedResource.name} ` }),
         /* @__PURE__ */ jsx14(Text14, { dimColor: true, children: "\u203A" }),
         /* @__PURE__ */ jsx14(Text14, { backgroundColor: "cyan", color: "black", children: " inspect " })
-      ] }) : (activeSection === "projects" || activeSection === "environments" || activeSection === "tools" || activeSection === "serviceAccounts" || activeSection === "connections") && /* @__PURE__ */ jsx14(
+      ] }) : (activeSection === "projects" || activeSection === "environments" || activeSection === "identities" || activeSection === "serviceAccounts" || activeSection === "connections") && /* @__PURE__ */ jsx14(
         Text14,
         {
           backgroundColor: "cyan",
@@ -27082,7 +27064,7 @@ var init_HomeView = __esm({
       resourceNavItem({ k: "1", section: "sessions" }),
       { k: "2", label: "Runs", activeSection: "runs" },
       resourceNavItem({ k: "3", section: "environments" }),
-      resourceNavItem({ k: "4", section: "tools" }),
+      resourceNavItem({ k: "4", section: "identities" }),
       { k: "5", label: "Projects", activeSection: "projects" },
       { k: "6", label: "Service Accounts", activeSection: "serviceAccounts" },
       { k: "7", label: "Connections", activeSection: "connections" }
@@ -27194,6 +27176,7 @@ async function launch(opts) {
   });
   const prefetchP = Promise.allSettled([
     apiClient.listSessions({ apiBaseUrl: apiUrl }),
+    apiClient.listIdentities({ apiBaseUrl: apiUrl }),
     apiClient.listProjects({ apiBaseUrl: apiUrl }),
     apiClient.listProjectServiceAccounts({ apiBaseUrl: apiUrl }),
     apiClient.listConnections({ apiBaseUrl: apiUrl }),
@@ -27206,6 +27189,7 @@ async function launch(opts) {
   const [, prefetchResult] = await Promise.all([waitSplash(), prefetchP]);
   const [
     sessionsResult,
+    identitiesResult,
     projectsResult,
     serviceAccountsResult,
     connectionsResult,
@@ -27217,6 +27201,12 @@ async function launch(opts) {
       sortSessions(sessionsResult.value.sessions)
     );
   }
+  if (identitiesResult.status === "fulfilled") {
+    queryClient.setQueryData(
+      queryKeys.identities(apiUrl),
+      sortByResourceName(identitiesResult.value.identities)
+    );
+  }
   if (projectsResult.status === "fulfilled") {
     queryClient.setQueryData(
       queryKeys.projects(apiUrl),
@@ -27341,11 +27331,11 @@ var init_launcher = __esm({
         queryKey: queryKeys.environments,
         sort: sortByResourceName
       },
-      [RESOURCE_KIND_TOOL]: {
+      [RESOURCE_KIND_IDENTITY]: {
         async list({ apiClient, apiUrl }) {
-          return (await apiClient.listTools({ apiBaseUrl: apiUrl })).tools;
+          return (await apiClient.listIdentities({ apiBaseUrl: apiUrl })).identities;
         },
-        queryKey: queryKeys.tools,
+        queryKey: queryKeys.identities,
         sort: sortByResourceName
       },
       [RESOURCE_KIND_SESSION]: {