@corenel/sidecar 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -1,181 +1,231 @@
-# Changelog
-
-## 0.3.1
-
-This package is Corenel's, and now says so in its defaults. 0.3.0 pointed its
-gateway, and the app it opens, at the sibling product.
-
-The direction is the fix: prompd.app is a CONSUMER of these APIs, so it names
-its own origin (`--app-url https://prompd.app/studio`, `--endpoint <its own>`)
-and corenel.ai is what you get without asking.
-
-### Added
-- `sessions` subcommand: `corenel-sidecar sessions [list | show <id>]`, also
-  reachable as `corenel sessions`. Read-only, and read from the SANDBOXES rather
-  than from a daemon -- a subcommand runs in a new process and cannot see a
-  running daemon's SessionManager, so anything derived from it would be a guess.
-  Asking msb gets the same answer the daemon gets when it adopts at boot, and it
-  works with nothing running.
-
-### Changed
-- `--app-url` defaults to `https://corenel.ai`, and the open URL no longer has
-  `/studio` appended to it. That is a prompd route; corenel serves its app at
-  `/`, so the old shape would have opened a page that does not exist and lost
-  the pairing fragment on the redirect. `--app-url` is now the app URL in full,
-  path included -- prompd pairs at `https://prompd.app/studio`.
-
-### Fixed
-- The daemon called `https://api.prompd.app` for every model run -- the sibling
-  product's gateway, with a token minted against this one. The default endpoint
-  is now `https://api.corenel.ai/api`.
-- That default was also missing the `/api` prefix the gateway is mounted behind.
-  `setGatewayBase` appends `/v1`, so a bare origin composed
-  `https://host/v1/chat/completions` and 404'd -- surfacing as "the run failed",
-  nowhere near the flag responsible. A bare origin now has the prefix added, and
-  any endpoint carrying a path is left exactly as given.
-- `--allow-lan` did not do what it says. It widened the CORS origin allowlist
-  while the socket stayed bound to `127.0.0.1`, so nothing on the network could
-  connect and the banner still printed a loopback URL. It now binds all
-  interfaces and serves `wss://` with the self-signed cert (which already
-  covered the LAN IPs for exactly this). Both halves defer to anything
-  explicit: `--host` keeps its address, a supplied `--tls-cert` is not replaced.
-
-  This is the only way LAN pairing can work from the product: the app is served
-  over https, and a browser on an https page refuses a `ws://` connection to a
-  LAN address.
-
-## 0.3.0
-
-The isolation release. 0.2.0 could expose a machine's files and shell to a
-session and run crew agents unattended; it always did that work in its own
-process, on the host, with whatever reach the host had. This release puts a
-boundary around a run and lets an external coding agent be governed by it.
-
-Everything is additive and off by default. A 0.2.0 setup behaves exactly as it
-did unless you pass one of the new flags.
-
-### Sessions in a sandbox
-- `--isolation <none|microvm>` chooses how a session confines a run. `none` is
-  the old behaviour and stays the default; `microvm` boots a sandbox per session.
-- `--msb <path>` locates the microsandbox binary, and `--guest-image <ref>` picks
-  what a session boots. Pin the image by digest for anything you snapshot -- a
-  floating tag means a restored snapshot is not the thing that was captured.
-
-### Proxying an external agent
-- `--acp <target>` runs an external coding agent (`claude-code`) under our
-  policy rather than beside it. Needs `--root`.
-- `--acp-policy <standard|read-only|autonomous>` governs what the proxied agent
-  may do, and `--acp-auth <subscription|api-key|inherit>` selects the credential
-  it uses.
-- `--agent <name>` names the crew agent an `acp-agent` session drives.
-
-### Boundaries the operator sets
-- `--clone-under <dir>` lets a session clone a repository, and nothing more. The
-  clone runs on the host with your own git credentials; they never enter the
-  session.
-- `--keep-transcripts` PERMITS a run to keep its words rather than only its
-  metadata. It is a ceiling, not a switch: each run still has to ask, and no run
-  can ask past an operator who did not pass this.
-- `--allow-add-under <dir>` lets a client add working directories beneath a
-  subtree during a session. This grants directory-name enumeration over that
-  subtree, and added roots last only until the sidecar exits.
-
-### Fixed
-- `hosts list` -- the spelling `--help` documents -- was rejected as an unknown
-  argument; only a bare `hosts` worked. Both now do.
-
-### Naming
-- The `corenel` binary this package briefly declared is gone; it collided with
-  `@corenel/cli`, which owns that name. This package installs `corenel-sidecar`,
-  and `corenel sidecar …` reaches the same program through the CLI. `--help`
-  now reports whichever name you invoked.
-
-## 0.2.0
-
-Ships `--help`, and moves onto the workspace's shared version line — every
-`@corenel/*` package is now 0.2.0, so a compatible set is obvious at a glance.
-
-- `--help` / `-h` print usage and exit 0. They were previously rejected as
-  unknown arguments, which printed a bare flag list and exited 1 — the first
-  thing anyone types against an unfamiliar binary. The text is generated from the
-  same table the parser validates against, so a flag cannot be added without
-  appearing in `--help`. This landed just after 0.1.6 was published, so it has
-  not been in a release until now.
-
-No behaviour changes to the daemon, tunnels, or host sync. Upgrading from 0.1.6
-is safe; everything in the 0.1.6 notes below still applies.
-
-## 0.1.6
-
-The daemon release. `@corenel/sidecar` could already expose a machine's files and
-shell to a browser session; it can now also **run crew agents on its own** —
-on a schedule, when files change, or when another run finishes — with budgets,
-permissions and per-owner isolation enforced node-side.
-
-Everything below is additive. An existing `pd sidecar` setup behaves as it did in
-0.1.5 unless you pass `--daemon`.
-
-### Daemon core
-- `--daemon` starts an always-on core: an interruptible clock (sleep-until-next-wake,
-  wake signal, max-sleep cap) driving a trigger dispatcher over a shared runner.
-- Node run executor built on `runAgent`, with session recording to disk.
-- Per-agent run queue — one live run per agent, so a slow run cannot stack.
-- Node gateway client (absolute endpoint, node auth); daemon-origin requests are
-  tagged so entitlement metering can tell them from browser traffic.
-- `--default-model` fallback; a crew agent with no model fails fast rather than
-  starting an unrunnable run.
-
-### Triggers
-- Minimal 5-field UTC cron matcher with per-agent trigger state (`lastFired`,
-  `nextWake`), persisted and serialized so concurrent writes cannot clobber it.
-- File-change triggers: a self-contained glob matcher, a bounded change buffer,
-  and an idempotent re-scan.
-- Run-complete triggers: an evaluator carrying owner, stop reason and run
-  generation, with a chain-depth cap (`--max-chain-depth`, validated so a bad
-  value cannot disable the cap) to stop runs triggering each other forever.
-- `schedule_self` tool for self-directed wakes.
-
-### Budgets
-- Run budgets enforced node-side (stop / degrade), failing **closed** on an
-  unpriceable run rather than proceeding unmetered.
-- A continuous trigger cannot become due without a budget cap.
-- Pure usage pricing extracted to the harness; the node side hydrates a price table.
-
-### Permissions and attendance
-- Unattended prompt resolver: deny, park (bounded by the real budget remainder),
-  or allow — an abort resolves to null rather than a silent deny.
-- Attendance registry: asks are broadcast to attached clients, first answer wins,
-  and replay on attach means reconnecting does not lose a pending ask.
-- Pending-ask records with boot reconciliation (audit-only) and permission audit lines.
-- Stall watchdog aborts hung runs while leaving parked ones alone.
-
-### Multi-owner isolation
-- Per-owner run state and owner-qualified dispatch keys; a multi-root schedule
-  enumerates the daemon's own crew plus every `hosts/<dir>/crew`.
-- `call_agent` is confined to the caller's owner, and an attended run resolves its
-  owner from the authenticated identity rather than a client-supplied value.
-
-### Hosts and sync
-- Durable `sidecarId` with friendly-name resolution; the CLI advertises id and name.
-- `hosts.json` manifest: sanitized frozen `dirName`, null-prototype parsing,
-  per-record validation, atomic writes and serialized read-modify-write.
-- `pd sidecar hosts list` / `forget`; boot logs manifest drift.
-- Host-sync service with daemon-derived destinations. Writes to a synced tree go
-  through `syncWrite`/`syncRemove` only — the exposed surface has no `write`/`remove`
-  to bypass, and path confinement is reused from `NodeFileService` rather than
-  reimplemented.
-- A materialized directory is never reclaimed by eviction.
-
-### Also
-- `--help` / `-h` now print usage and exit 0. They were previously rejected as
-  unknown arguments, which printed a bare flag list and exited 1. The help text is
-  generated from the same table the parser validates against, so a flag cannot be
-  added without appearing in `--help`.
-- `fs_delete` tool, wired to `SidecarFileService.remove`.
-- Quieter cloudflared output.
-- A second `hello` is ignored once authenticated.
-
-### Housekeeping
-- The package's own `typecheck` now passes. It shares modules with the browser
-  harness (which guards its browser bits at runtime), so the tsconfig lacked the
-  DOM *types* and reported a dozen phantom errors against correct code.
+# Changelog
+
+## 0.3.2
+
+Sessions stop being something you can only list. This release gives the sandbox
+a full lifecycle from the command line, and the verbs are the port's own --
+create/destroy, not add/remove: you add an entry to a list, you create and
+destroy a thing that boots and holds memory.
+
+Everything goes through the SAME backend the daemon uses. Two ways to make a
+sandbox would stamp labels two ways and drift on limits.
+
+### Added
+- Session lifecycle: `corenel sessions create [--root <dir>]`, `run <id>
+  "<prompt>"`, and `pause|resume|destroy <id>`. `corenel run --session <id>`
+  forwards to the same place. `stop` is deliberately absent -- the port has
+  pause (stop admitting work, bounded drain, and it reports whether it drained)
+  and destroy, and a third word over two real concepts is a translation nobody
+  asked for.
+- `exec` takes an optional env, threaded to `msb exec -e`. Without it the CLI
+  inside the guest answers "not signed in" -- the image ships no token and
+  create injects none -- so the sandbox was a box nothing useful could happen
+  in. It carries the HOST's identity: a session isolates the filesystem and the
+  process, not the wallet.
+
+### Fixed
+Running against a real hypervisor found five defects that reading the code did
+not:
+
+- `create` always allocated `sess_1`. The id counter lives in the backend and
+  starts at zero, so the second create on a machine collided with the first.
+  Adoption is what advances it past what already exists -- the daemon does this
+  at boot and a one-shot command needs it for the same reason. The same fix is
+  what made `run` work at all.
+- `sessions create --root X` silently used the CWD. The dispatcher stripped
+  flags before the subcommand could read them, so the value was dropped without
+  a word. The whole argv is passed through now, and the verbs are the non-flag
+  words.
+- A created session reported `created 1787430794235` -- the label stores epoch
+  millis and nothing rendered it.
+- A STOPPED session vanished from the list: `msb inspect` returns no labels for
+  one, so there was nothing to read. It is recovered from the sandbox name,
+  which the backend reserves for exactly this.
+- ...and was therefore unrecoverable, since resume and destroy both look it up
+  first. `adopt()` also refuses a session whose workdir label it cannot read, so
+  the backend declined too and destroy reported success having done nothing.
+  There is now a direct-to-sandbox path used only after the backend declines,
+  and destroy VERIFIES the session is gone instead of assuming.
+
+Verified end to end against real microVMs: create -> list -> show -> pause ->
+resume -> destroy, and a run reaching the guest's own CLI.
+
+## 0.3.1
+
+This package is Corenel's, and now says so in its defaults. 0.3.0 pointed its
+gateway, and the app it opens, at the sibling product.
+
+The direction is the fix: prompd.app is a CONSUMER of these APIs, so it names
+its own origin (`--app-url https://prompd.app/studio`, `--endpoint <its own>`)
+and corenel.ai is what you get without asking.
+
+### Added
+- `sessions` subcommand: `corenel-sidecar sessions [list | show <id>]`, also
+  reachable as `corenel sessions`. Read-only, and read from the SANDBOXES rather
+  than from a daemon -- a subcommand runs in a new process and cannot see a
+  running daemon's SessionManager, so anything derived from it would be a guess.
+  Asking msb gets the same answer the daemon gets when it adopts at boot, and it
+  works with nothing running.
+
+### Changed
+- `--app-url` defaults to `https://corenel.ai`, and the open URL no longer has
+  `/studio` appended to it. That is a prompd route; corenel serves its app at
+  `/`, so the old shape would have opened a page that does not exist and lost
+  the pairing fragment on the redirect. `--app-url` is now the app URL in full,
+  path included -- prompd pairs at `https://prompd.app/studio`.
+
+### Fixed
+- The daemon called `https://api.prompd.app` for every model run -- the sibling
+  product's gateway, with a token minted against this one. The default endpoint
+  is now `https://api.corenel.ai/api`.
+- That default was also missing the `/api` prefix the gateway is mounted behind.
+  `setGatewayBase` appends `/v1`, so a bare origin composed
+  `https://host/v1/chat/completions` and 404'd -- surfacing as "the run failed",
+  nowhere near the flag responsible. A bare origin now has the prefix added, and
+  any endpoint carrying a path is left exactly as given.
+- `--allow-lan` did not do what it says. It widened the CORS origin allowlist
+  while the socket stayed bound to `127.0.0.1`, so nothing on the network could
+  connect and the banner still printed a loopback URL. It now binds all
+  interfaces and serves `wss://` with the self-signed cert (which already
+  covered the LAN IPs for exactly this). Both halves defer to anything
+  explicit: `--host` keeps its address, a supplied `--tls-cert` is not replaced.
+
+  This is the only way LAN pairing can work from the product: the app is served
+  over https, and a browser on an https page refuses a `ws://` connection to a
+  LAN address.
+
+## 0.3.0
+
+The isolation release. 0.2.0 could expose a machine's files and shell to a
+session and run crew agents unattended; it always did that work in its own
+process, on the host, with whatever reach the host had. This release puts a
+boundary around a run and lets an external coding agent be governed by it.
+
+Everything is additive and off by default. A 0.2.0 setup behaves exactly as it
+did unless you pass one of the new flags.
+
+### Sessions in a sandbox
+- `--isolation <none|microvm>` chooses how a session confines a run. `none` is
+  the old behaviour and stays the default; `microvm` boots a sandbox per session.
+- `--msb <path>` locates the microsandbox binary, and `--guest-image <ref>` picks
+  what a session boots. Pin the image by digest for anything you snapshot -- a
+  floating tag means a restored snapshot is not the thing that was captured.
+
+### Proxying an external agent
+- `--acp <target>` runs an external coding agent (`claude-code`) under our
+  policy rather than beside it. Needs `--root`.
+- `--acp-policy <standard|read-only|autonomous>` governs what the proxied agent
+  may do, and `--acp-auth <subscription|api-key|inherit>` selects the credential
+  it uses.
+- `--agent <name>` names the crew agent an `acp-agent` session drives.
+
+### Boundaries the operator sets
+- `--clone-under <dir>` lets a session clone a repository, and nothing more. The
+  clone runs on the host with your own git credentials; they never enter the
+  session.
+- `--keep-transcripts` PERMITS a run to keep its words rather than only its
+  metadata. It is a ceiling, not a switch: each run still has to ask, and no run
+  can ask past an operator who did not pass this.
+- `--allow-add-under <dir>` lets a client add working directories beneath a
+  subtree during a session. This grants directory-name enumeration over that
+  subtree, and added roots last only until the sidecar exits.
+
+### Fixed
+- `hosts list` -- the spelling `--help` documents -- was rejected as an unknown
+  argument; only a bare `hosts` worked. Both now do.
+
+### Naming
+- The `corenel` binary this package briefly declared is gone; it collided with
+  `@corenel/cli`, which owns that name. This package installs `corenel-sidecar`,
+  and `corenel sidecar …` reaches the same program through the CLI. `--help`
+  now reports whichever name you invoked.
+
+## 0.2.0
+
+Ships `--help`, and moves onto the workspace's shared version line — every
+`@corenel/*` package is now 0.2.0, so a compatible set is obvious at a glance.
+
+- `--help` / `-h` print usage and exit 0. They were previously rejected as
+  unknown arguments, which printed a bare flag list and exited 1 — the first
+  thing anyone types against an unfamiliar binary. The text is generated from the
+  same table the parser validates against, so a flag cannot be added without
+  appearing in `--help`. This landed just after 0.1.6 was published, so it has
+  not been in a release until now.
+
+No behaviour changes to the daemon, tunnels, or host sync. Upgrading from 0.1.6
+is safe; everything in the 0.1.6 notes below still applies.
+
+## 0.1.6
+
+The daemon release. `@corenel/sidecar` could already expose a machine's files and
+shell to a browser session; it can now also **run crew agents on its own** —
+on a schedule, when files change, or when another run finishes — with budgets,
+permissions and per-owner isolation enforced node-side.
+
+Everything below is additive. An existing `pd sidecar` setup behaves as it did in
+0.1.5 unless you pass `--daemon`.
+
+### Daemon core
+- `--daemon` starts an always-on core: an interruptible clock (sleep-until-next-wake,
+  wake signal, max-sleep cap) driving a trigger dispatcher over a shared runner.
+- Node run executor built on `runAgent`, with session recording to disk.
+- Per-agent run queue — one live run per agent, so a slow run cannot stack.
+- Node gateway client (absolute endpoint, node auth); daemon-origin requests are
+  tagged so entitlement metering can tell them from browser traffic.
+- `--default-model` fallback; a crew agent with no model fails fast rather than
+  starting an unrunnable run.
+
+### Triggers
+- Minimal 5-field UTC cron matcher with per-agent trigger state (`lastFired`,
+  `nextWake`), persisted and serialized so concurrent writes cannot clobber it.
+- File-change triggers: a self-contained glob matcher, a bounded change buffer,
+  and an idempotent re-scan.
+- Run-complete triggers: an evaluator carrying owner, stop reason and run
+  generation, with a chain-depth cap (`--max-chain-depth`, validated so a bad
+  value cannot disable the cap) to stop runs triggering each other forever.
+- `schedule_self` tool for self-directed wakes.
+
+### Budgets
+- Run budgets enforced node-side (stop / degrade), failing **closed** on an
+  unpriceable run rather than proceeding unmetered.
+- A continuous trigger cannot become due without a budget cap.
+- Pure usage pricing extracted to the harness; the node side hydrates a price table.
+
+### Permissions and attendance
+- Unattended prompt resolver: deny, park (bounded by the real budget remainder),
+  or allow — an abort resolves to null rather than a silent deny.
+- Attendance registry: asks are broadcast to attached clients, first answer wins,
+  and replay on attach means reconnecting does not lose a pending ask.
+- Pending-ask records with boot reconciliation (audit-only) and permission audit lines.
+- Stall watchdog aborts hung runs while leaving parked ones alone.
+
+### Multi-owner isolation
+- Per-owner run state and owner-qualified dispatch keys; a multi-root schedule
+  enumerates the daemon's own crew plus every `hosts/<dir>/crew`.
+- `call_agent` is confined to the caller's owner, and an attended run resolves its
+  owner from the authenticated identity rather than a client-supplied value.
+
+### Hosts and sync
+- Durable `sidecarId` with friendly-name resolution; the CLI advertises id and name.
+- `hosts.json` manifest: sanitized frozen `dirName`, null-prototype parsing,
+  per-record validation, atomic writes and serialized read-modify-write.
+- `pd sidecar hosts list` / `forget`; boot logs manifest drift.
+- Host-sync service with daemon-derived destinations. Writes to a synced tree go
+  through `syncWrite`/`syncRemove` only — the exposed surface has no `write`/`remove`
+  to bypass, and path confinement is reused from `NodeFileService` rather than
+  reimplemented.
+- A materialized directory is never reclaimed by eviction.
+
+### Also
+- `--help` / `-h` now print usage and exit 0. They were previously rejected as
+  unknown arguments, which printed a bare flag list and exited 1. The help text is
+  generated from the same table the parser validates against, so a flag cannot be
+  added without appearing in `--help`.
+- `fs_delete` tool, wired to `SidecarFileService.remove`.
+- Quieter cloudflared output.
+- A second `hello` is ignored once authenticated.
+
+### Housekeeping
+- The package's own `typecheck` now passes. It shares modules with the browser
+  harness (which guards its browser bits at runtime), so the tsconfig lacked the
+  DOM *types* and reported a dozen phantom errors against correct code.

package/dist/cli.js

@@ -11908,7 +11908,7 @@ var require_runtime = __commonJS({
         }
         return p2 && p2.lookup(name);
       };
-      _proto.resolve = function resolve9(name, forWrite) {
+      _proto.resolve = function resolve10(name, forWrite) {
         var p2 = forWrite && this.isolateWrites ? void 0 : this.parent;
         var val = this.variables[name];
         if (val !== void 0) {
@@ -13638,7 +13638,7 @@ var require_loader = __commonJS({
         return _EmitterObj.apply(this, arguments) || this;
       }
       var _proto = Loader2.prototype;
-      _proto.resolve = function resolve9(from, to) {
+      _proto.resolve = function resolve10(from, to) {
         return path.resolve(path.dirname(from), to);
       };
       _proto.isRelative = function isRelative(filename) {
@@ -17098,7 +17098,7 @@ var require_lib3 = __commonJS({
       let accum = [];
       let accumBytes = 0;
       let abort = false;
-      return new Body.Promise(function(resolve9, reject) {
+      return new Body.Promise(function(resolve10, reject) {
         let resTimeout;
         if (_this4.timeout) {
           resTimeout = setTimeout(function() {
@@ -17132,7 +17132,7 @@ var require_lib3 = __commonJS({
           }
           clearTimeout(resTimeout);
           try {
-            resolve9(Buffer.concat(accum, accumBytes));
+            resolve10(Buffer.concat(accum, accumBytes));
           } catch (err) {
             reject(new FetchError(`Could not create Buffer from response body for ${_this4.url}: ${err.message}`, "system", err));
           }
@@ -17807,7 +17807,7 @@ var require_lib3 = __commonJS({
         throw new Error("native promise missing, set fetch.Promise to your favorite alternative");
       }
       Body.Promise = fetch3.Promise;
-      return new fetch3.Promise(function(resolve9, reject) {
+      return new fetch3.Promise(function(resolve10, reject) {
         const request = new Request3(url, opts);
         const options = getNodeRequestOptions(request);
         const send = (options.protocol === "https:" ? https : http).request;
@@ -17940,7 +17940,7 @@ var require_lib3 = __commonJS({
                   requestOpts.body = void 0;
                   requestOpts.headers.delete("content-length");
                 }
-                resolve9(fetch3(new Request3(locationURL, requestOpts)));
+                resolve10(fetch3(new Request3(locationURL, requestOpts)));
                 finalize();
                 return;
             }
@@ -17961,7 +17961,7 @@ var require_lib3 = __commonJS({
           const codings = headers.get("Content-Encoding");
           if (!request.compress || request.method === "HEAD" || codings === null || res.statusCode === 204 || res.statusCode === 304) {
             response = new Response3(body, response_options);
-            resolve9(response);
+            resolve10(response);
             return;
           }
           const zlibOptions = {
@@ -17971,7 +17971,7 @@ var require_lib3 = __commonJS({
           if (codings == "gzip" || codings == "x-gzip") {
             body = body.pipe(zlib.createGunzip(zlibOptions));
             response = new Response3(body, response_options);
-            resolve9(response);
+            resolve10(response);
             return;
           }
           if (codings == "deflate" || codings == "x-deflate") {
@@ -17983,12 +17983,12 @@ var require_lib3 = __commonJS({
                 body = body.pipe(zlib.createInflateRaw());
               }
               response = new Response3(body, response_options);
-              resolve9(response);
+              resolve10(response);
             });
             raw.on("end", function() {
               if (!response) {
                 response = new Response3(body, response_options);
-                resolve9(response);
+                resolve10(response);
               }
             });
             return;
@@ -17996,11 +17996,11 @@ var require_lib3 = __commonJS({
           if (codings == "br" && typeof zlib.createBrotliDecompress === "function") {
             body = body.pipe(zlib.createBrotliDecompress());
             response = new Response3(body, response_options);
-            resolve9(response);
+            resolve10(response);
             return;
           }
           response = new Response3(body, response_options);
-          resolve9(response);
+          resolve10(response);
         });
         writeToStream(req, request);
       });
@@ -22281,8 +22281,8 @@ var SidecarServer = class {
   }
   hostCall(provider, method, args) {
     const id = ++this.hostSeq;
-    return new Promise((resolve9, reject) => {
-      this.hostPending.set(id, { resolve: resolve9, reject });
+    return new Promise((resolve10, reject) => {
+      this.hostPending.set(id, { resolve: resolve10, reject });
       this.ch.send({ t: "host-call", id, provider, method, args });
     });
   }
@@ -22463,13 +22463,13 @@ function probeAddress(bindHost) {
   return h2;
 }
 function portInUse(host, port, timeoutMs = 500) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let settled = false;
     const done = (busy) => {
       if (settled) return;
       settled = true;
       socket.destroy();
-      resolve9(busy);
+      resolve10(busy);
     };
     const socket = connect({ host, port });
     socket.setTimeout(timeoutMs);
@@ -24361,8 +24361,9 @@ function inspectArgs(name) {
 function snapshotListArgs() {
   return ["snapshot", "list", "--format", "json"];
 }
-function execArgs(name, command) {
-  return ["exec", name, "--", ...command];
+function execArgs(name, command, env) {
+  const e2 = env ? Object.entries(env).flatMap(([k2, v2]) => ["-e", `${k2}=${v2}`]) : [];
+  return ["exec", name, ...e2, "--", ...command];
 }
 function wslHostPath(p2) {
   const m2 = /^([A-Za-z]):[\\/](.*)$/.exec(p2);
@@ -24730,7 +24731,7 @@ function makeMicrovmBackend(deps) {
         throw new SessionUnavailable(id, "paused");
       }
       if (command.length === 0) throw new Error("exec needs a command");
-      const r2 = await deps.run(execArgs(sandboxName(id), command), opts);
+      const r2 = await deps.run(execArgs(sandboxName(id), command, opts?.env), opts);
       return { code: r2.code, stdout: r2.stdout, stderr: r2.stderr };
     },
     /**
@@ -27289,10 +27290,10 @@ ${content}` : parentData.content;
       });
       this.registerFiltersOnEnv(env);
       const renderTimeout = 5e3;
-      const renderPromise = new Promise((resolve9, reject) => {
+      const renderPromise = new Promise((resolve10, reject) => {
         try {
           const result = env.renderString(content, context.parameters);
-          resolve9(result);
+          resolve10(result);
         } catch (error) {
           reject(error);
         }
@@ -29328,7 +29329,7 @@ ${err}`;
     }
     const outcome = ctx.signal.aborted ? null : await Promise.race([
       ctx.reviewEdit(ctx.callId),
-      new Promise((resolve9) => ctx.signal.addEventListener("abort", () => resolve9(null), { once: true }))
+      new Promise((resolve10) => ctx.signal.addEventListener("abort", () => resolve10(null), { once: true }))
     ]);
     if (!outcome) return "The run ended before the user reviewed this proposal. Do NOT assume the edit was applied.";
     if (outcome.decision === "applied") {
@@ -31455,8 +31456,8 @@ function _addRequestID(value, response) {
 }
 var APIPromise = class _APIPromise extends Promise {
   constructor(responsePromise, parseResponse2 = defaultParseResponse) {
-    super((resolve9) => {
-      resolve9(null);
+    super((resolve10) => {
+      resolve10(null);
     });
     this.responsePromise = responsePromise;
     this.parseResponse = parseResponse2;
@@ -32031,7 +32032,7 @@ var startsWithSchemeRegexp = /^[a-z][a-z0-9+.-]*:/i;
 var isAbsoluteURL = (url) => {
   return startsWithSchemeRegexp.test(url);
 };
-var sleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
+var sleep = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
 var validatePositiveInteger = (name, n2) => {
   if (typeof n2 !== "number" || !Number.isInteger(n2)) {
     throw new OpenAIError(`${name} must be an integer`);
@@ -32464,12 +32465,12 @@ var EventStream = class {
     _EventStream_errored.set(this, false);
     _EventStream_aborted.set(this, false);
     _EventStream_catchingPromiseCreated.set(this, false);
-    __classPrivateFieldSet7(this, _EventStream_connectedPromise, new Promise((resolve9, reject) => {
-      __classPrivateFieldSet7(this, _EventStream_resolveConnectedPromise, resolve9, "f");
+    __classPrivateFieldSet7(this, _EventStream_connectedPromise, new Promise((resolve10, reject) => {
+      __classPrivateFieldSet7(this, _EventStream_resolveConnectedPromise, resolve10, "f");
       __classPrivateFieldSet7(this, _EventStream_rejectConnectedPromise, reject, "f");
     }), "f");
-    __classPrivateFieldSet7(this, _EventStream_endPromise, new Promise((resolve9, reject) => {
-      __classPrivateFieldSet7(this, _EventStream_resolveEndPromise, resolve9, "f");
+    __classPrivateFieldSet7(this, _EventStream_endPromise, new Promise((resolve10, reject) => {
+      __classPrivateFieldSet7(this, _EventStream_resolveEndPromise, resolve10, "f");
       __classPrivateFieldSet7(this, _EventStream_rejectEndPromise, reject, "f");
     }), "f");
     __classPrivateFieldGet8(this, _EventStream_connectedPromise, "f").catch(() => {
@@ -32553,11 +32554,11 @@ var EventStream = class {
    *   const message = await stream.emitted('message') // rejects if the stream errors
    */
   emitted(event) {
-    return new Promise((resolve9, reject) => {
+    return new Promise((resolve10, reject) => {
       __classPrivateFieldSet7(this, _EventStream_catchingPromiseCreated, true, "f");
       if (event !== "error")
         this.once("error", reject);
-      this.once(event, resolve9);
+      this.once(event, resolve10);
     });
   }
   async done() {
@@ -32710,7 +32711,7 @@ var AssistantStream = class _AssistantStream extends EventStream {
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve9, reject) => readQueue.push({ resolve: resolve9, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve10, reject) => readQueue.push({ resolve: resolve10, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
         }
         const chunk = pushQueue.shift();
         return { value: chunk, done: false };
@@ -34328,7 +34329,7 @@ var ChatCompletionStream = class _ChatCompletionStream extends AbstractChatCompl
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve9, reject) => readQueue.push({ resolve: resolve9, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve10, reject) => readQueue.push({ resolve: resolve10, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
         }
         const chunk = pushQueue.shift();
         return { value: chunk, done: false };
@@ -35977,7 +35978,7 @@ var ResponseStream = class _ResponseStream extends EventStream {
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve9, reject) => readQueue.push({ resolve: resolve9, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve10, reject) => readQueue.push({ resolve: resolve10, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
         }
         const event = pushQueue.shift();
         return { value: event, done: false };
@@ -36782,14 +36783,14 @@ function classifyStreamError(message, status) {
 }
 function abortableSleep(ms, signal) {
   if (signal?.aborted) return Promise.resolve(false);
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const onAbort = () => {
       clearTimeout(t2);
-      resolve9(false);
+      resolve10(false);
     };
     const t2 = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve9(true);
+      resolve10(true);
     }, ms);
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -37734,12 +37735,12 @@ function makeScheduleSelfTool(opts) {
 var PARK_TIMEOUT_MS = 30 * 60 * 1e3;
 var PARK_POLL_MS = 250;
 function defaultSleep(ms, signal) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let timer;
     const onAbort = () => {
       if (timer !== void 0) clearTimeout(timer);
       signal.removeEventListener("abort", onAbort);
-      resolve9();
+      resolve10();
     };
     if (signal.aborted) {
       onAbort();
@@ -37747,7 +37748,7 @@ function defaultSleep(ms, signal) {
     }
     timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve9();
+      resolve10();
     }, ms);
     signal.addEventListener("abort", onAbort);
   });
@@ -38492,12 +38493,12 @@ function makeDispatcher(opts) {
 // src/runner/clock.ts
 var MAX_SLEEP_MS = 15 * 60 * 1e3;
 function defaultSleep2(ms, signal) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     let timer;
     const onAbort = () => {
       if (timer !== void 0) clearTimeout(timer);
       signal.removeEventListener("abort", onAbort);
-      resolve9();
+      resolve10();
     };
     if (signal.aborted) {
       onAbort();
@@ -38505,7 +38506,7 @@ function defaultSleep2(ms, signal) {
     }
     timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve9();
+      resolve10();
     }, ms);
     signal.addEventListener("abort", onAbort);
   });
@@ -38869,7 +38870,7 @@ function makeAttendanceRegistry(opts) {
       if (clients.size === 0) {
         return Promise.resolve(null);
       }
-      return new Promise((resolve9) => {
+      return new Promise((resolve10) => {
         let cleanupAbort;
         const settleNull = () => {
           const entry = outstanding.get(ask.id);
@@ -38881,7 +38882,7 @@ function makeAttendanceRegistry(opts) {
           ask,
           resolve: (decision) => {
             cleanupAbort?.();
-            resolve9(decision);
+            resolve10(decision);
           }
         });
         for (const c2 of clients) {
@@ -39375,6 +39376,23 @@ async function runHostsCli(argv) {
 }
 
 // src/sessionsCli.ts
+import { resolve as resolve6 } from "node:path";
+async function sandboxLifecycle(run, verb, name) {
+  const call = async (args) => {
+    const r2 = await run(args).catch((e2) => ({ code: 1, stdout: "", stderr: String(e2) }));
+    return { ok: r2.code === 0, detail: (r2.stderr || r2.stdout).trim().split("\n").slice(-2).join("; ") };
+  };
+  if (verb === "pause") return call(["stop", name]);
+  if (verb === "resume") return call(["start", name]);
+  await call(["stop", name]);
+  return call(["remove", name]);
+}
+function humanTime(v2) {
+  if (!v2) return "";
+  const n2 = Number(v2);
+  if (!Number.isFinite(n2) || n2 <= 0) return v2;
+  return new Date(n2).toISOString().replace("T", " ").replace(/\.\d+Z$/, "Z");
+}
 async function listSessions(run) {
   const listed = await run(listArgs()).catch(() => null);
   if (!listed || listed.code !== 0) return [];
@@ -39382,7 +39400,7 @@ async function listSessions(run) {
   for (const box of parseSandboxList(listed.stdout)) {
     const inspected = await run(inspectArgs(box.name)).catch(() => null);
     const labels = inspected && inspected.code === 0 ? parseSandboxLabels(inspected.stdout) : {};
-    const id = labels[LABEL_SESSION];
+    const id = labels[LABEL_SESSION] ?? idFromSandboxName(box.name);
     if (!id) continue;
     const url = labels[LABEL_REPO_URL];
     const ref = labels[LABEL_REPO_REF];
@@ -39392,7 +39410,9 @@ async function listSessions(run) {
       status: box.status || "unknown",
       workdir: labels[LABEL_WORKDIR] ?? "",
       owner: labels[LABEL_OWNER] ?? "",
-      created: labels[LABEL_CREATED] ?? (box.createdAt ? new Date(box.createdAt).toISOString() : ""),
+      // The label stores epoch millis; a bare 1787430794235 in a terminal is a
+      // number nobody can read as a time.
+      created: humanTime(labels[LABEL_CREATED]) || (box.createdAt ? new Date(box.createdAt).toISOString() : ""),
       ...url ? { repo: ref ? `${url}#${ref}` : url } : {}
     });
   }
@@ -39428,11 +39448,28 @@ function formatSession(r2) {
     ...r2.repo ? [`repo     ${r2.repo}`] : []
   ].join("\n");
 }
+var DEFAULT_GUEST_IMAGE = "corenel-guest:dev";
+function backendFor(deps, roots, run) {
+  return makeMicrovmBackend({
+    roots: () => roots,
+    run,
+    image: deps.image ?? DEFAULT_GUEST_IMAGE,
+    // On Windows msb lives inside WSL, where C:\git\proj means nothing. The
+    // daemon maps host paths the same way.
+    ...deps.wsl ? { hostPath: wslHostPath } : {}
+  });
+}
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["--root", "--msb", "--image"]);
+function rootFrom(argv, cwd) {
+  const at2 = argv.indexOf("--root");
+  return resolve6(at2 >= 0 && argv[at2 + 1] ? argv[at2 + 1] : cwd);
+}
 async function runSessionsCli(argv, deps) {
   const out = deps.out ?? ((s2) => process.stdout.write(s2));
   const err = deps.err ?? ((s2) => process.stderr.write(s2));
   const run = deps.run ?? makeMsbRunner(deps.msbBin, deps.wsl ? wslMsb(deps.msbBin) : void 0);
-  const [verb, ...rest] = argv;
+  const verbs = argv.filter((a2, i2) => !a2.startsWith("--") && !(i2 > 0 && VALUE_FLAGS.has(argv[i2 - 1])));
+  const [verb, ...rest] = verbs;
   if (verb === void 0 || verb === "list") {
     if (rest.length) {
       err(`corenel sessions list: unexpected argument "${rest[0]}"
@@ -39459,15 +39496,143 @@ async function runSessionsCli(argv, deps) {
 `);
     return 0;
   }
+  if (verb === "create") {
+    const root = rootFrom(argv, process.cwd());
+    const backend = deps.backend ?? backendFor(deps, [root], run);
+    if (backend.adopt) await backend.adopt().catch(() => void 0);
+    try {
+      const handle = await backend.create({ workdir: root, owner: process.env.USERNAME || process.env.USER || "cli" });
+      out(`${handle.id}
+`);
+      err(`created ${handle.id} on ${handle.workdir}
+`);
+      return 0;
+    } catch (e2) {
+      err(`corenel sessions create: ${e2 instanceof Error ? e2.message : String(e2)}
+`);
+      return 1;
+    }
+  }
+  if (verb === "run") {
+    const id = rest[0];
+    const prompt = rest.slice(1).filter((a2) => !a2.startsWith("--")).join(" ").trim();
+    if (!id) {
+      err("corenel sessions run: missing <id>\n");
+      return 1;
+    }
+    if (!prompt) {
+      err('corenel sessions run: missing prompt\n  usage: corenel sessions run <id> "<prompt>"\n');
+      return 1;
+    }
+    const found = (await listSessions(run)).find((r2) => r2.id === id || r2.sandbox === id);
+    if (!found) {
+      err(`corenel sessions: no session "${id}" on this machine
+`);
+      return 1;
+    }
+    const backend = deps.backend ?? backendFor(deps, [found.workdir], run);
+    if (!backend.exec) {
+      err("corenel sessions run: this backend cannot execute inside a session\n");
+      return 1;
+    }
+    if (backend.adopt) await backend.adopt().catch(() => void 0);
+    try {
+      const token = await readAuthToken() ?? process.env.CORENEL_TOKEN ?? null;
+      if (!token) {
+        err("corenel sessions run: not signed in on this host.\n  Run `corenel login` first \u2014 the session uses the host's credential.\n");
+        return 1;
+      }
+      const r2 = await backend.exec(found.id, ["corenel", "run", prompt], { env: { CORENEL_TOKEN: token } });
+      if (r2.stdout) out(r2.stdout.endsWith("\n") ? r2.stdout : `${r2.stdout}
+`);
+      if (r2.stderr.trim()) err(r2.stderr.endsWith("\n") ? r2.stderr : `${r2.stderr}
+`);
+      return r2.code ?? 1;
+    } catch (e2) {
+      err(`corenel sessions run: ${e2 instanceof Error ? e2.message : String(e2)}
+`);
+      return 1;
+    }
+  }
+  if (verb === "pause" || verb === "resume" || verb === "destroy") {
+    const id = rest[0];
+    if (!id) {
+      err(`corenel sessions ${verb}: missing <id>
+`);
+      return 1;
+    }
+    const found = (await listSessions(run)).find((r2) => r2.id === id || r2.sandbox === id);
+    if (!found) {
+      err(`corenel sessions: no session "${id}" on this machine
+`);
+      return 1;
+    }
+    const backend = deps.backend ?? backendFor(deps, [found.workdir], run);
+    if (backend.adopt) await backend.adopt().catch(() => void 0);
+    const known = !!backend.get?.(found.id);
+    if (!known) {
+      const r2 = await sandboxLifecycle(run, verb, found.sandbox);
+      if (!r2.ok) {
+        err(`corenel sessions ${verb}: ${r2.detail || "msb refused"}
+`);
+        return 1;
+      }
+      if (verb === "destroy") {
+        const still = (await listSessions(run)).find((x2) => x2.id === found.id);
+        if (still) {
+          err(`corenel sessions destroy: ${found.id} is still present (status ${still.status})
+`);
+          return 1;
+        }
+      }
+      out(`${verb === "destroy" ? "destroyed" : verb === "pause" ? "paused" : "resumed"} ${found.id}
+`);
+      return 0;
+    }
+    try {
+      if (verb === "pause") {
+        const r2 = await backend.pause(found.id);
+        if (r2 && !r2.drained) {
+          err(`paused ${found.id}, but ${r2.remaining.length} call(s) were STILL RUNNING when the drain gave up
+`);
+          return 1;
+        }
+        out(`paused ${found.id}
+`);
+        return 0;
+      }
+      if (verb === "resume") {
+        await backend.resume(found.id);
+        out(`resumed ${found.id}
+`);
+        return 0;
+      }
+      await backend.destroy(found.id);
+      const still = (await listSessions(run)).find((r2) => r2.id === found.id);
+      if (still) {
+        err(`corenel sessions destroy: ${found.id} is still present (status ${still.status})
+`);
+        return 1;
+      }
+      out(`destroyed ${found.id}
+`);
+      return 0;
+    } catch (e2) {
+      err(`corenel sessions ${verb}: ${e2 instanceof Error ? e2.message : String(e2)}
+`);
+      return 1;
+    }
+  }
   err(`corenel sessions: unknown subcommand "${verb}"
-  usage: corenel sessions [list | show <id>]
+  usage: corenel sessions [list | show <id> | create [--root <dir>] | run <id> "<prompt>"
+                          | pause <id> | resume <id> | destroy <id>]
 `);
   return 1;
 }
 
 // src/args.ts
 import { statSync as statSync2 } from "node:fs";
-import { resolve as resolve6 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 
 // src/flags.ts
 var FLAGS = [
@@ -39651,9 +39816,9 @@ function parseArgs(argv) {
     else if (a2 === "--host") {
       out.host = argv[++i2];
       hostSet = true;
-    } else if (a2 === "--root") out.roots.push(resolve6(argv[++i2]));
-    else if (a2 === "--allow-add-under") out.addUnder.push(resolve6(argv[++i2]));
-    else if (a2 === "--clone-under") out.cloneUnder.push(resolve6(argv[++i2]));
+    } else if (a2 === "--root") out.roots.push(resolve7(argv[++i2]));
+    else if (a2 === "--allow-add-under") out.addUnder.push(resolve7(argv[++i2]));
+    else if (a2 === "--clone-under") out.cloneUnder.push(resolve7(argv[++i2]));
     else if (a2 === "--allow-origin") out.allowOrigins.push(argv[++i2]);
     else if (a2 === "--keep-transcripts") out.keepTranscripts = true;
     else if (a2 === "--allow-shell") out.allowShell = true;
@@ -39664,8 +39829,8 @@ function parseArgs(argv) {
     } else if (a2 === "--msb") out.msbBin = argv[++i2];
     else if (a2 === "--guest-image") out.guestImage = argv[++i2];
     else if (a2 === "--allow-lan") out.allowLan = true;
-    else if (a2 === "--tls-cert") out.tlsCert = resolve6(argv[++i2]);
-    else if (a2 === "--tls-key") out.tlsKey = resolve6(argv[++i2]);
+    else if (a2 === "--tls-cert") out.tlsCert = resolve7(argv[++i2]);
+    else if (a2 === "--tls-key") out.tlsKey = resolve7(argv[++i2]);
     else if (a2 === "--self-signed") out.selfSigned = true;
     else if (a2 === "--tunnel") out.tunnel = argv[++i2];
     else if (a2 === "--tunnel-name") out.tunnelName = argv[++i2];
@@ -39680,7 +39845,7 @@ function parseArgs(argv) {
     else if (a2 === "--acp-auth") out.acpAuth = argv[++i2];
     else if (a2 === "--agent") out.acpAgentName = argv[++i2];
     else if (a2 === "--max-chain-depth") out.maxChainDepth = Number(argv[++i2]);
-    else if (a2 === "--state-dir") out.stateDir = resolve6(argv[++i2]);
+    else if (a2 === "--state-dir") out.stateDir = resolve7(argv[++i2]);
     else if (a2 === "--name") out.name = argv[++i2];
     else if (a2 === "--sidecar" || a2 === "start" || a2 === "--") {
     } else throw new Error(`unknown argument: ${a2}
@@ -39728,12 +39893,12 @@ function assertDirectory(path, flag2) {
 
 // src/roots.ts
 import { promises as fs11 } from "node:fs";
-import { resolve as resolve7 } from "node:path";
+import { resolve as resolve8 } from "node:path";
 var DISABLED = "adding working directories is not enabled (no --allow-add-under)";
 function createRootsController(opts) {
   const roots = opts.roots;
-  const areas = [...new Set(opts.areas.map((a2) => resolve7(a2)))];
-  const cloneAreas = [...new Set((opts.cloneAreas ?? []).map((a2) => resolve7(a2)))];
+  const areas = [...new Set(opts.areas.map((a2) => resolve8(a2)))];
+  const cloneAreas = [...new Set((opts.cloneAreas ?? []).map((a2) => resolve8(a2)))];
   const subs = /* @__PURE__ */ new Set();
   const snapshot = () => ({ root: roots[0], roots: [...roots] });
   async function assertInArea(abs) {
@@ -39761,8 +39926,8 @@ function createRootsController(opts) {
     cloneAreas,
     snapshot,
     async addFromClone(path) {
-      const abs = resolve7(path);
-      if (roots.some((r2) => resolve7(r2) === abs)) return;
+      const abs = resolve8(path);
+      if (roots.some((r2) => resolve8(r2) === abs)) return;
       if (!cloneAreas.length) throw new Error("cloning repositories is not enabled (no --clone-under)");
       if (!cloneAreas.some((a2) => withinRoot(a2, abs))) {
         throw new Error(`checkout is outside every --clone-under directory: ${abs}`);
@@ -39780,14 +39945,14 @@ function createRootsController(opts) {
     async browse(path) {
       if (!areas.length) throw new Error(DISABLED);
       if (path === void 0) return [...areas];
-      const abs = resolve7(path);
+      const abs = resolve8(path);
       await assertInArea(abs);
       const entries = await fs11.readdir(abs, { withFileTypes: true });
       return entries.filter((e2) => e2.isDirectory()).map((e2) => e2.name);
     },
     async add(path) {
-      const abs = resolve7(path);
-      if (roots.some((r2) => resolve7(r2) === abs)) return;
+      const abs = resolve8(path);
+      if (roots.some((r2) => resolve8(r2) === abs)) return;
       await assertInArea(abs);
       const st2 = await fs11.stat(abs);
       if (!st2.isDirectory()) throw new Error(`not a directory: ${abs}`);
@@ -39806,7 +39971,7 @@ function createRootsController(opts) {
 // src/session/gitSource.ts
 import { spawn as spawn6 } from "node:child_process";
 import { promises as fs12 } from "node:fs";
-import { join as join12, resolve as resolve8 } from "node:path";
+import { join as join12, resolve as resolve9 } from "node:path";
 var DEFAULT_TIMEOUT_MS3 = 10 * 6e4;
 var ALLOWED_SCHEMES = ["https://", "ssh://", "git+ssh://"];
 var SCP_LIKE = /^[A-Za-z0-9_.-]+@[A-Za-z0-9_.-]+:[A-Za-z0-9_./~-]+$/;
@@ -39892,7 +40057,7 @@ function failed(what, r2) {
 ${said}` : ""}`);
 }
 function createGitSource(deps) {
-  const areas = [...new Set(deps.areas.map((a2) => resolve8(a2)))];
+  const areas = [...new Set(deps.areas.map((a2) => resolve9(a2)))];
   async function assertInArea(abs) {
     if (!areas.length) throw new Error(DISABLED2);
     if (!areas.some((a2) => withinRoot(a2, abs))) {
@@ -40093,8 +40258,8 @@ var JsonRpcPeer = class {
       return Promise.reject(new RpcError({ code: RPC_TRANSPORT_CLOSED, message: "transport closed" }));
     }
     const id = this.nextId++;
-    return new Promise((resolve9, reject) => {
-      this.pending.set(id, { resolve: resolve9, reject });
+    return new Promise((resolve10, reject) => {
+      this.pending.set(id, { resolve: resolve10, reject });
       this.write({ jsonrpc: "2.0", id, method, ...params !== void 0 ? { params } : {} });
     });
   }
@@ -41202,8 +41367,7 @@ async function main() {
     const rest = rawArgv.slice(1);
     const at2 = rest.indexOf("--msb");
     const msbBin = at2 >= 0 && rest[at2 + 1] ? rest[at2 + 1] : process.env.MSB_BIN ?? "msb";
-    const verbs = rest.filter((a2, i2) => !a2.startsWith("--") && !(i2 > 0 && rest[i2 - 1].startsWith("--")));
-    process.exitCode = await runSessionsCli(verbs, { msbBin, wsl: process.platform === "win32" });
+    process.exitCode = await runSessionsCli(rest, { msbBin, wsl: process.platform === "win32" });
     return;
   }
   if (rawArgv[0] === "login" || rawArgv[0] === "logout" || rawArgv[0] === "auth") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/sidecar",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "type": "module",
   "license": "Elastic-2.0",
   "description": "Prompd sidecar — a local capability server. Run it next to Prompd (prompd.app) so the browser app can reach your machine: local LLMs (Ollama/LM Studio/vLLM) without CORS, your filesystem, and (opt-in) shell.",
@@ -26,26 +26,25 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "node build.mjs",
-    "prepublishOnly": "node build.mjs",
-    "start": "tsx src/cli.ts",
-    "typecheck": "tsc --noEmit",
-    "verify": "tsx src/verify.ts"
-  },
   "dependencies": {
     "selfsigned": "^2.4.1",
     "ws": "^8.18.0"
   },
   "devDependencies": {
-    "@corenel/protocol": "workspace:*",
-    "@corenel/harness": "workspace:*",
-    "@corenel/tools-node": "workspace:*",
-    "@corenel/crew": "workspace:*",
     "@types/node": "^24.13.1",
     "@types/ws": "^8.5.13",
     "esbuild": "^0.21.5",
     "tsx": "^4.19.2",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "@corenel/protocol": "0.3.2",
+    "@corenel/harness": "0.3.2",
+    "@corenel/tools-node": "0.2.0",
+    "@corenel/crew": "0.0.0"
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "start": "tsx src/cli.ts",
+    "typecheck": "tsc --noEmit",
+    "verify": "tsx src/verify.ts"
   }
-}
+}