@divergeai/cli 0.1.27 → 0.1.28

package/dist/diverge.mjs

@@ -114,17 +114,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path18) {
-      const ctrl = callVisitor(key, node, visitor, path18);
+    function visit_(key, node, visitor, path20) {
+      const ctrl = callVisitor(key, node, visitor, path20);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path18, ctrl);
-        return visit_(key, ctrl, visitor, path18);
+        replaceNode(key, path20, ctrl);
+        return visit_(key, ctrl, visitor, path20);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path18 = Object.freeze(path18.concat(node));
+          path20 = Object.freeze(path20.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path18);
+            const ci = visit_(i, node.items[i], visitor, path20);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -135,13 +135,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path18 = Object.freeze(path18.concat(node));
-          const ck = visit_("key", node.key, visitor, path18);
+          path20 = Object.freeze(path20.concat(node));
+          const ck = visit_("key", node.key, visitor, path20);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path18);
+          const cv = visit_("value", node.value, visitor, path20);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -162,17 +162,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path18) {
-      const ctrl = await callVisitor(key, node, visitor, path18);
+    async function visitAsync_(key, node, visitor, path20) {
+      const ctrl = await callVisitor(key, node, visitor, path20);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path18, ctrl);
-        return visitAsync_(key, ctrl, visitor, path18);
+        replaceNode(key, path20, ctrl);
+        return visitAsync_(key, ctrl, visitor, path20);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path18 = Object.freeze(path18.concat(node));
+          path20 = Object.freeze(path20.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path18);
+            const ci = await visitAsync_(i, node.items[i], visitor, path20);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -183,13 +183,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path18 = Object.freeze(path18.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path18);
+          path20 = Object.freeze(path20.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path20);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path18);
+          const cv = await visitAsync_("value", node.value, visitor, path20);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -216,23 +216,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path18) {
+    function callVisitor(key, node, visitor, path20) {
       if (typeof visitor === "function")
-        return visitor(key, node, path18);
+        return visitor(key, node, path20);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path18);
+        return visitor.Map?.(key, node, path20);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path18);
+        return visitor.Seq?.(key, node, path20);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path18);
+        return visitor.Pair?.(key, node, path20);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path18);
+        return visitor.Scalar?.(key, node, path20);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path18);
+        return visitor.Alias?.(key, node, path20);
       return void 0;
     }
-    function replaceNode(key, path18, node) {
-      const parent = path18[path18.length - 1];
+    function replaceNode(key, path20, node) {
+      const parent = path20[path20.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -844,10 +844,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path18, value) {
+    function collectionFromPath(schema, path20, value) {
       let v = value;
-      for (let i = path18.length - 1; i >= 0; --i) {
-        const k = path18[i];
+      for (let i = path20.length - 1; i >= 0; --i) {
+        const k = path20[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -866,7 +866,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path18) => path18 == null || typeof path18 === "object" && !!path18[Symbol.iterator]().next().done;
+    var isEmptyPath = (path20) => path20 == null || typeof path20 === "object" && !!path20[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -896,11 +896,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path18, value) {
-        if (isEmptyPath(path18))
+      addIn(path20, value) {
+        if (isEmptyPath(path20))
           this.add(value);
         else {
-          const [key, ...rest] = path18;
+          const [key, ...rest] = path20;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -914,8 +914,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path18) {
-        const [key, ...rest] = path18;
+      deleteIn(path20) {
+        const [key, ...rest] = path20;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -929,8 +929,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path18, keepScalar) {
-        const [key, ...rest] = path18;
+      getIn(path20, keepScalar) {
+        const [key, ...rest] = path20;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -948,8 +948,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path18) {
-        const [key, ...rest] = path18;
+      hasIn(path20) {
+        const [key, ...rest] = path20;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -959,8 +959,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path18, value) {
-        const [key, ...rest] = path18;
+      setIn(path20, value) {
+        const [key, ...rest] = path20;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -3475,9 +3475,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path18, value) {
+      addIn(path20, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path18, value);
+          this.contents.addIn(path20, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -3552,14 +3552,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path18) {
-        if (Collection.isEmptyPath(path18)) {
+      deleteIn(path20) {
+        if (Collection.isEmptyPath(path20)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path18) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path20) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -3574,10 +3574,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path18, keepScalar) {
-        if (Collection.isEmptyPath(path18))
+      getIn(path20, keepScalar) {
+        if (Collection.isEmptyPath(path20))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path18, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path20, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -3588,10 +3588,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path18) {
-        if (Collection.isEmptyPath(path18))
+      hasIn(path20) {
+        if (Collection.isEmptyPath(path20))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path18) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path20) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -3608,13 +3608,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path18, value) {
-        if (Collection.isEmptyPath(path18)) {
+      setIn(path20, value) {
+        if (Collection.isEmptyPath(path20)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path18), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path20), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path18, value);
+          this.contents.setIn(path20, value);
         }
       }
       /**
@@ -5575,9 +5575,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path18) => {
+    visit.itemAtPath = (cst, path20) => {
       let item = cst;
-      for (const [field, index] of path18) {
+      for (const [field, index] of path20) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -5586,23 +5586,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path18) => {
-      const parent = visit.itemAtPath(cst, path18.slice(0, -1));
-      const field = path18[path18.length - 1][0];
+    visit.parentCollection = (cst, path20) => {
+      const parent = visit.itemAtPath(cst, path20.slice(0, -1));
+      const field = path20[path20.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path18, item, visitor) {
-      let ctrl = visitor(item, path18);
+    function _visit(path20, item, visitor) {
+      let ctrl = visitor(item, path20);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path18.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path20.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -5613,10 +5613,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path18);
+            ctrl = ctrl(item, path20);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path18) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path20) : ctrl;
     }
     exports.visit = visit;
   }
@@ -6918,14 +6918,14 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs16 = this.flowScalar(this.type);
+              const fs19 = this.flowScalar(this.type);
               if (atNextItem || it.value) {
-                map.items.push({ start, key: fs16, sep: [] });
+                map.items.push({ start, key: fs19, sep: [] });
                 this.onKeyLine = true;
               } else if (it.sep) {
-                this.stack.push(fs16);
+                this.stack.push(fs19);
               } else {
-                Object.assign(it, { key: fs16, sep: [] });
+                Object.assign(it, { key: fs19, sep: [] });
                 this.onKeyLine = true;
               }
               return;
@@ -7053,13 +7053,13 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs16 = this.flowScalar(this.type);
+              const fs19 = this.flowScalar(this.type);
               if (!it || it.value)
-                fc.items.push({ start: [], key: fs16, sep: [] });
+                fc.items.push({ start: [], key: fs19, sep: [] });
               else if (it.sep)
-                this.stack.push(fs16);
+                this.stack.push(fs19);
               else
-                Object.assign(it, { key: fs16, sep: [] });
+                Object.assign(it, { key: fs19, sep: [] });
               return;
             }
             case "flow-map-end":
@@ -7392,10 +7392,7 @@ var NotGrantedError = class extends CliError {
 };
 
 // src/commands/agents.ts
-import { randomUUID } from "node:crypto";
-import fs11 from "node:fs";
-import os8 from "node:os";
-import path14 from "node:path";
+import fs8 from "node:fs";
 import { parseArgs as parseArgs3 } from "node:util";
 
 // src/auth/oauth-client.ts
@@ -7556,7 +7553,7 @@ function tokenSource(env, baseUrl) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.27" : "dev";
+var VERSION = true ? "0.1.28" : "dev";
 var USER_AGENT = `diverge/${VERSION}`;
 
 // src/http.ts
@@ -7939,11 +7936,11 @@ function verbPath(usage2, args) {
 function groupOptions(usage2) {
   return usage2.split("\n", 1)[0].match(/\[--[^\]]+\]/g) ?? [];
 }
-function verbUsage(command, usage2, path18) {
-  const lines = usageEntries(usage2).filter((entry) => startsWith(entry.verbs, path18)).flatMap((entry) => entry.lines);
-  if (path18.length === 0 || lines.length === 0) return usage2;
+function verbUsage(command, usage2, path20) {
+  const lines = usageEntries(usage2).filter((entry) => startsWith(entry.verbs, path20)).flatMap((entry) => entry.lines);
+  if (path20.length === 0 || lines.length === 0) return usage2;
   const shared = groupOptions(usage2);
-  return [`diverge ${command} ${path18.join(" ")} ...`, "", ...lines, ...shared.length ? ["", `Every ${command} command also takes ${shared.join(" ")}.`] : []].join("\n");
+  return [`diverge ${command} ${path20.join(" ")} ...`, "", ...lines, ...shared.length ? ["", `Every ${command} command also takes ${shared.join(" ")}.`] : []].join("\n");
 }
 var COMMON_WORDS = /* @__PURE__ */ new Set(["the", "and", "you", "for", "its", "with", "not", "one", "are", "all", "any", "from", "that", "this", "own", "per", "into", "out", "else", "each", "what", "when", "your"]);
 function distance(a, b) {
@@ -7995,12 +7992,12 @@ function didYouMean(matches) {
   return ` Did you mean one of:
 ${matches.map((match) => `  ${shown(match)}`).join("\n")}`;
 }
-function verbCandidates(command, usage2, path18) {
+function verbCandidates(command, usage2, path20) {
   const byName = /* @__PURE__ */ new Map();
   for (const entry of usageEntries(usage2)) {
-    if (!startsWith(entry.verbs, path18)) continue;
-    const name = entry.verbs[path18.length] ?? "";
-    const invocation = ["diverge", command, ...path18, ...name ? [name] : []].join(" ");
+    if (!startsWith(entry.verbs, path20)) continue;
+    const name = entry.verbs[path20.length] ?? "";
+    const invocation = ["diverge", command, ...path20, ...name ? [name] : []].join(" ");
     const lines = [entry.summary, ...entry.lines.slice(1).map((line) => line.trim())].filter(Boolean);
     const known = byName.get(name);
     if (known) known.lines.push(...lines);
@@ -8008,9 +8005,9 @@ function verbCandidates(command, usage2, path18) {
   }
   return [...byName.values()];
 }
-function unknownVerb(command, usage2, path18, verb, rest = []) {
-  const candidates = verbCandidates(command, usage2, path18);
-  const where = [command, ...path18].join(" ");
+function unknownVerb(command, usage2, path20, verb, rest = []) {
+  const candidates = verbCandidates(command, usage2, path20);
+  const where = [command, ...path20].join(" ");
   if (!verb) return new CliError(`${where} needs one of: ${candidates.map((candidate) => candidate.name).filter(Boolean).join(", ")}
 
 ${usage2}`);
@@ -8018,10 +8015,10 @@ ${usage2}`);
 
 ${usage2}`);
 }
-function optionCandidates(usage2, path18) {
+function optionCandidates(usage2, path20) {
   const entries = usageEntries(usage2);
   const [header = "", ...body] = usage2.split("\n");
-  const described = entries.length === 0 || path18.length === 0 ? body : entries.filter((entry) => startsWith(entry.verbs, path18)).flatMap((entry) => entry.lines);
+  const described = entries.length === 0 || path20.length === 0 ? body : entries.filter((entry) => startsWith(entry.verbs, path20)).flatMap((entry) => entry.lines);
   const byName = /* @__PURE__ */ new Map();
   const add = (line, describes) => {
     for (const [flag] of line.matchAll(/--[a-z][a-z-]*/g)) {
@@ -8038,8 +8035,8 @@ function unknownOption(error, usage2, args) {
   if (!(error instanceof Error) || error.name !== "TypeError") return null;
   const option = /^Unknown option '([^']+)'/.exec(error.message)?.[1];
   if (!option) return null;
-  const path18 = verbPath(usage2, args);
-  return `Unknown option: ${option}.${didYouMean(closest(option, optionCandidates(usage2, path18)))}`;
+  const path20 = verbPath(usage2, args);
+  return `Unknown option: ${option}.${didYouMean(closest(option, optionCandidates(usage2, path20)))}`;
 }
 
 // src/commands/login.ts
@@ -8158,19 +8155,23 @@ unwraps the platform's envelope and nothing inside. Its shape is the tool's
 own and differs by tool and plugin \u2014 one returns its records under \`data\`,
 another at the top level \u2014 so read a tool's shape from its own answer, not
 from the last tool's. Parse stdout alone; stderr only carries the scope and
-identity lines. Without \`--json\`, errors are text on stderr.
+identity lines. A shell tool that shows both streams in one view prints those
+two lines above the JSON, but a pipe or \`$(...)\` never sees them: pipe
+straight to \`jq\` and strip nothing. Without \`--json\`, errors are text on
+stderr.
 
 ## Several related writes: one set, one decision
 
-When two or more writes serve one intent \u2014 assign a role to several groups,
-deactivate several users, set several notification routes \u2014 raise them as
-one set, never one call per write: the person approves the set once instead
-of clicking through one card each.
+When two or more writes serve one intent \u2014 deactivate several users, set
+several notification routes \u2014 raise them as one set, never one call per
+write: the person approves the set once instead of clicking through one card
+each. A change to one thing's access is already one call: a role's holders,
+a group's members, a person's groups.
 
 \`\`\`bash
-diverge tools set - --summary "Coordinators get the field role" --json <<'JSON'
-[{"tool": "rbac_assign_role_to_group", "args": {"roleId": "r1", "groupId": "g1"}},
- {"tool": "rbac_assign_role_to_group", "args": {"roleId": "r1", "groupId": "g2"}}]
+diverge tools set - --summary "Coordinators who left" --json <<'JSON'
+[{"tool": "rbac_deactivate_user", "args": {"userId": "u1"}},
+ {"tool": "rbac_deactivate_user", "args": {"userId": "u2"}}]
 JSON
 \`\`\`
 
@@ -8276,7 +8277,7 @@ var DRIVE_CHROME_SKILL = {
     "tool call connects; there is nothing to restart.",
     "",
     "If no `mcp__chrome-devtools__` tool is listed at all, dsh was started without",
-    "the Divergent overlay: `diverge agents run dsh` starts it with one.",
+    "the Divergent overlay: `diverge dsh` starts it with one.",
     ""
   ].join("\n")
 };
@@ -8292,7 +8293,6 @@ import path5 from "node:path";
 // src/agents/dsh.ts
 var import_yaml = __toESM(require_dist(), 1);
 import fs5 from "node:fs";
-import { createRequire } from "node:module";
 import os2 from "node:os";
 import path4 from "node:path";
 
@@ -8361,18 +8361,24 @@ function describeToolExecution(env = process.env) {
 }
 
 // src/tools/client.ts
-var AUTHORITY_CHANGE_CODE = "REMOTE_PLUGIN_AUTHORITY_CHANGE";
 var INVOCATION_SET_TOOL = "functions_invocation_set";
 var PENDING_INVOCATION_STATUSES = ["pending", "approved", "executing"];
-function parseJson(text2) {
+function isPending(result) {
+  return !!result && typeof result === "object" && result.status === "pending_approval";
+}
+function devTaskContinuation(env) {
+  const raw = env.DIVERGENT_DEV_TASK?.trim();
+  if (!raw) return void 0;
+  let task;
   try {
-    return JSON.parse(text2);
+    task = JSON.parse(raw);
   } catch {
-    return void 0;
+    throw new CliError('DIVERGENT_DEV_TASK is not JSON; the launcher writes {"organizationId","host","worktreePath"}');
   }
-}
-function isPending(result) {
-  return !!result && typeof result === "object" && result.status === "pending_approval";
+  if (!task || typeof task !== "object" || Array.isArray(task)) {
+    throw new CliError('DIVERGENT_DEV_TASK names no task; the launcher writes {"organizationId","host","worktreePath"}');
+  }
+  return { kind: "forge.dev-board.task-resume", payload: task };
 }
 var REQUEST_TIMEOUT_MS = 63e4;
 var TOKEN_REFRESH_MARGIN_SECONDS = 60;
@@ -8420,10 +8426,10 @@ var ToolsClient = class {
     if (this.settings.mode === "service") headers["x-divergent-user-id"] = this.settings.delegatedUserId;
     return headers;
   }
-  scoped(path18) {
+  scoped(path20) {
     const query = new URLSearchParams({ organizationId: this.settings.organizationId });
     if (this.settings.projectId) query.set("projectId", this.settings.projectId);
-    return `${this.settings.apiUrl}${path18}?${query.toString()}`;
+    return `${this.settings.apiUrl}${path20}?${query.toString()}`;
   }
   async send(method, url, body) {
     return this.request(method, url, body, void 0);
@@ -8495,7 +8501,12 @@ var ToolsClient = class {
    * unwrapped here, once — a pending approval passes through as it is.
    */
   async callTool(name, args) {
-    const body = await this.send("POST", this.scoped("/api/plugins/functions/tools/execute"), { toolName: name, arguments: args ?? {} });
+    const continuation = devTaskContinuation(this.env);
+    const body = await this.send("POST", this.scoped("/api/plugins/functions/tools/execute"), {
+      toolName: name,
+      arguments: args ?? {},
+      ...continuation ? { continuation } : {}
+    });
     const outcome = body.result;
     if (outcome?.status !== "succeeded") return body;
     return { ...body, result: outcome.result };
@@ -8507,9 +8518,11 @@ var ToolsClient = class {
    * carries every call's outcome in `result.calls`.
    */
   async callSet(calls, summary) {
+    const continuation = devTaskContinuation(this.env);
     const body = await this.send("POST", this.scoped("/api/plugins/functions/tools/sets"), {
       ...summary ? { summary } : {},
-      calls: calls.map((call2) => ({ toolName: call2.tool, arguments: call2.args ?? {} }))
+      calls: calls.map((call2) => ({ toolName: call2.tool, arguments: call2.args ?? {} })),
+      ...continuation ? { continuation } : {}
     });
     const outcome = body.result;
     if (outcome?.status !== "succeeded") return body;
@@ -8520,36 +8533,16 @@ var ToolsClient = class {
     return this.send("GET", this.scoped(`/api/plugins/functions/tools/invocations/${encodeURIComponent(invocationId)}`));
   }
   // ── Tenant plugins (RFC: Tenant Plugins) ──────────────────────────────
-  descriptorsUrl(pluginId) {
-    const base = `${this.settings.apiUrl}/api/plugins/forge/plugins/descriptors${pluginId ? `/${encodeURIComponent(pluginId)}` : ""}`;
-    return `${base}?${new URLSearchParams({ targetOrganizationId: this.settings.organizationId }).toString()}`;
-  }
-  /** Validate (dryRun) or publish a manifest for the organization the login is issued to. */
-  publishPlugin(manifest, options) {
-    return this.request(
-      "POST",
-      this.descriptorsUrl(),
-      { targetOrganizationId: this.settings.organizationId, manifest, dryRun: options.dryRun },
-      (status2, text2) => {
-        if (status2 === 403) {
-          const parsed2 = parseJson(text2);
-          return parsed2?.code === AUTHORITY_CHANGE_CODE && Array.isArray(parsed2.details) ? { ok: false, details: parsed2.details.map(String), authorityChange: true } : void 0;
-        }
-        if (status2 !== 400) return void 0;
-        const parsed = parseJson(text2);
-        if (Array.isArray(parsed?.details)) return { ok: false, details: parsed.details.map(String) };
-        return { ok: false, details: [parsed?.error ?? text2] };
-      }
-    ).then((outcome) => "ok" in outcome ? outcome : { ok: true, result: outcome });
-  }
+  /**
+   * The descriptors the organization published: the one read the CLI makes
+   * outside Functions. Validating, publishing, reshaping and retiring are
+   * tool invocations through `callTool` (ADR 0124).
+   */
   async listPlugins() {
-    const body = await this.send("GET", this.descriptorsUrl());
+    const query = new URLSearchParams({ targetOrganizationId: this.settings.organizationId });
+    const body = await this.send("GET", `${this.settings.apiUrl}/api/plugins/forge/plugins/descriptors?${query.toString()}`);
     return body.plugins ?? [];
   }
-  async retirePlugin(pluginId) {
-    const body = await this.send("DELETE", this.descriptorsUrl(pluginId), { targetOrganizationId: this.settings.organizationId });
-    return body.plugin;
-  }
 };
 
 // src/agents/dsh.ts
@@ -8567,8 +8560,7 @@ function dshPatchYaml(options) {
   const api = options.surface === "openai" ? "openai-completions" : "anthropic-messages";
   const endpoint = options.surface === "openai" ? `${options.baseUrl}/v1` : options.baseUrl;
   return [
-    "# Divergent gateway overlay for dsh; written by `diverge agents setup dsh`.",
-    `# Boot with: ${tokenEnv}="$(diverge token)" dsh --profile <profile> --patch <this file>`,
+    "# Divergent gateway overlay for dsh; written by `diverge dsh` on every launch.",
     "- id: llm-pi-ai",
     "  config:",
     "    providers:",
@@ -8589,6 +8581,7 @@ function dshPatchYaml(options) {
     "  config:",
     `    provider: ${route}`,
     `    model: ${JSON.stringify(options.defaultModel)}`,
+    ...options.reasoningEffort ? [`    reasoningEffort: ${JSON.stringify(options.reasoningEffort)}`] : [],
     // dsh's native DeepSeek adapter needs a vendor key nobody here holds and,
     // where one exists, would send the organization's code straight to the
     // vendor past the gateway, its ledger, budget and policy. Its session
@@ -8599,6 +8592,11 @@ function dshPatchYaml(options) {
     "  disabled: true",
     "- id: session-telemetry-otel",
     "  disabled: true",
+    // The headless profile turns dsh's credential store off, for a job given a
+    // key in its environment. A launch keeps its token fresh in that file, so
+    // it stays on in every profile.
+    "- id: credentials",
+    "  disabled: false",
     ...dshSearchRows(),
     ...dshShellRows(),
     ...dshBrowserRows(),
@@ -8614,16 +8612,6 @@ function dshLaunchHeaderRows(launch) {
     `          ${DSH_LAUNCH_ID_HEADER}: ${JSON.stringify(launch.id)}`
   ];
 }
-function dshVersionOf(binary) {
-  const dir = dshPackageDir(binary);
-  if (!dir) return null;
-  try {
-    const version = JSON.parse(fs5.readFileSync(path4.join(dir, "package.json"), "utf8")).version;
-    return typeof version === "string" && version.length > 0 ? version : null;
-  } catch {
-    return null;
-  }
-}
 function dshShellRows() {
   return ["bash-sandbox", "pwsh-sandbox"].flatMap((id) => [
     `- id: ${id}`,
@@ -8657,11 +8645,6 @@ function dshSearchRows() {
     "    searchTimeoutMs: 60000"
   ];
 }
-function servedIds(overlay) {
-  const rows = (0, import_yaml.parse)(overlay) ?? [];
-  const route = rows.find((row) => row.id === "llm-pi-ai");
-  return Object.values(route?.config?.providers ?? {}).flatMap((provider) => (provider.models ?? []).map((entry) => entry.id));
-}
 function mergeDshCredentials(existing, token, ref = "DIVERGENT_TOKEN") {
   const parsed = existing?.trim() ? (0, import_yaml.parse)(existing) : null;
   let document = {};
@@ -8676,95 +8659,41 @@ function mergeDshCredentials(existing, token, ref = "DIVERGENT_TOKEN") {
   if (document.records && Object.keys(document.records).length > 0) ordered.records = document.records;
   return (0, import_yaml.stringify)(ordered, { lineWidth: 0 });
 }
-function dshSettingsDefaultModel(settingsText, surface) {
-  if (!settingsText?.trim()) return null;
-  const settings = (0, import_yaml.parse)(settingsText);
-  if (!settings || typeof settings !== "object") return null;
-  const pinned = settings["agent-default-model"];
-  if (!pinned || typeof pinned !== "object") return null;
-  const record = pinned;
-  if (record.provider !== `divergent-${surface}`) return null;
-  return record.model ? String(record.model) : null;
-}
-function stalePinMessage(settingsPath, pinned, surface, served) {
-  return `${settingsPath} pins ${pinned} on divergent-${surface}, which the gateway does not serve; set agent-default-model.model there to one of: ${served.join(", ")} (or remove it to use ${served[0]})`;
-}
-var DIVERGENT_PRESET_ID = "divergent";
-var DSH_USER_PRESETS_DIR = ".agent-presets";
-function dshPackageDir(binary) {
-  if (/\.(cmd|bat)$/i.test(binary)) {
-    const dir2 = path4.join(path4.dirname(binary), "node_modules", "@deepseek-ai", "dsh");
-    return fs5.existsSync(path4.join(dir2, "package.json")) ? dir2 : null;
-  }
-  let dir;
-  try {
-    dir = path4.dirname(fs5.realpathSync(binary));
-  } catch {
-    return null;
-  }
-  for (; ; ) {
-    try {
-      if (JSON.parse(fs5.readFileSync(path4.join(dir, "package.json"), "utf8")).name === "@deepseek-ai/dsh") return dir;
-    } catch {
-    }
-    const parent = path4.dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-function shippedPresetDir(packageDir, id = "standard") {
-  try {
-    const require2 = createRequire(path4.join(packageDir, "package.json"));
-    const dir = path4.join(path4.dirname(require2.resolve("@deepseek-ai/dsh-agent-presets/package.json")), "presets", id);
-    return fs5.existsSync(path4.join(dir, "agent.cordis.yml")) ? dir : null;
-  } catch {
-    return null;
-  }
-}
-function divergentPreset(shippedComposition) {
-  const lines = shippedComposition.split("\n");
-  const start = lines.findIndex((line) => /^- id: ['"]?tool-web['"]?\s*$/.test(line));
-  if (start === -1) throw new Error("the shipped preset composes no tool-web row");
-  let end = lines.findIndex((line, index) => index > start && /^- /.test(line));
-  if (end === -1) end = lines.length;
-  const row = lines.slice(start, end);
-  const search = row.findIndex((line) => /^\s+search:/.test(line));
+function dshSavedModel(patchText, surface) {
+  if (!patchText?.trim()) return null;
+  const rows = (0, import_yaml.parse)(patchText, { logLevel: "silent" });
+  if (!Array.isArray(rows)) return null;
+  const row = rows.find((entry) => entry?.id === "agent-default-model");
+  const config = row?.config;
+  if (config?.provider !== `divergent-${surface}` || !config.model) return null;
+  return { model: String(config.model), ...config.reasoningEffort ? { reasoningEffort: String(config.reasoningEffort) } : {} };
+}
+var dshPresetsDir = (prefix) => path4.join(prefix, "node_modules", "@deepseek-ai", "dsh-web-app", "presets");
+function dshPresetOverride(shipped) {
+  const lines = shipped.split("\n");
+  const insert = lines.indexOf("- insert:");
+  if (insert === -1) throw new Error("a shipped preset is not one inserted row");
+  const row = lines.slice(insert + 1).map((line) => line.replace(/^ {4}/, ""));
+  const start = row.findIndex((line) => /^\s+- id: ['"]?tool-web['"]?\s*$/.test(line));
+  if (start === -1) return null;
+  const indent = row[start].indexOf("-");
+  const body = " ".repeat(indent + 2);
+  let end = row.findIndex((line, index) => index > start && line.trim() !== "" && line.search(/\S/) <= indent);
+  if (end === -1) end = row.length;
+  const block = row.slice(start, end);
+  const search = block.findIndex((line) => line.startsWith(`${body}  search:`));
   if (search !== -1) {
-    row[search] = row[search].replace(/:.*$/, ": false");
+    block[search] = `${body}  search: false`;
   } else {
-    const config = row.findIndex((line) => /^  config:\s*$/.test(line));
-    if (config !== -1) row.splice(config + 1, 0, "    search: false");
-    else row.splice(1, 0, "  config:", "    search: false");
+    const config = block.indexOf(`${body}config:`);
+    if (config !== -1) block.splice(config + 1, 0, `${body}  search: false`);
+    else block.splice(1, 0, `${body}config:`, `${body}  search: false`);
   }
-  return [
-    `# The Divergent agent preset: dsh's shipped "standard" preset with the vendor web`,
-    "# search left out of the model's tools; platform tools, search included, are reached",
-    "# from the shell through `diverge tools`. Derived from the installed dsh by `diverge agents",
-    "# setup dsh` and `diverge agents run dsh` on every run; edits do not survive.",
-    ...lines.slice(0, start),
-    ...row,
-    ...lines.slice(end)
-  ].join("\n");
+  return [...row.slice(0, start), ...block, ...row.slice(end)].join("\n").trimEnd() + "\n";
 }
-var DIVERGENT_PRESET_METADATA = [
-  "name: Divergent",
-  "description: The standard coding agent, searching the web through the platform's search_online tool instead of a vendor key.",
-  "order: 0",
-  ""
-].join("\n");
-function writeDivergentPreset(home, shippedDir) {
-  const dir = path4.join(home, DSH_USER_PRESETS_DIR, DIVERGENT_PRESET_ID);
-  writeTextAtomic(path4.join(dir, "agent.cordis.yml"), divergentPreset(fs5.readFileSync(path4.join(shippedDir, "agent.cordis.yml"), "utf8")), 420);
-  writeTextAtomic(path4.join(dir, "preset.yml"), DIVERGENT_PRESET_METADATA, 420);
-  return dir;
-}
-function withDivergentPresetDefault(settingsText) {
-  const parsed = settingsText?.trim() ? (0, import_yaml.parse)(settingsText) : null;
-  const settings = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? { ...parsed } : {};
-  const presets = settings["agent-presets"];
-  if (presets && typeof presets === "object" && presets.default) return null;
-  settings["agent-presets"] = { ...presets ?? {}, default: DIVERGENT_PRESET_ID };
-  return (0, import_yaml.stringify)(settings, { lineWidth: 0 });
+function dshPresetOverrides(prefix) {
+  const dir = dshPresetsDir(prefix);
+  return fs5.readdirSync(dir).filter((name) => name.endsWith(".patch.yml")).sort().flatMap((name) => dshPresetOverride(fs5.readFileSync(path4.join(dir, name), "utf8")) ?? []).join("");
 }
 
 // src/skills/install.ts
@@ -9121,7 +9050,9 @@ Signing in also installs the login's skills \u2014 every organization it can act
 in, side by side \u2014 into the coding-agent harnesses on this machine.
 --as <email> names the account: the platform signs that account in instead of
 reusing whatever session the browser holds, and issues nothing to any other.
-Without --as, the account of the last login is used; switching is explicit.
+Without --as, the account of the last login is used; a browser that signs in
+any account but the expected one (the --as one, else the last login's) is
+refused and changes nothing, so this host's shared login switches only by --as.
 Without --scopes, the login asks for the scopes the platform registers for
 this CLI \u2014 everything it and forge use \u2014 and holds what your roles grant; a
 scope the platform adds later reaches this login on its next refresh.
@@ -9139,6 +9070,16 @@ function resolveLoginHint(flag, previous) {
   const remembered = previous.account?.trim().toLowerCase();
   return remembered || void 0;
 }
+function refuseAnotherAccount(signedIn, expected, context) {
+  const account = signedIn.trim().toLowerCase();
+  if (account === expected) return;
+  const asked = context.named ? `You asked to sign in as ${expected}` : `This host's login for ${context.apiUrl} is ${expected}`;
+  throw new CliError(
+    `${asked}, but the browser signed in ${account}; nothing was changed.
+  To replace this host's login, for every session on it: diverge login --as ${account}
+  To keep a second identity beside it: DIVERGE_HOME=<another directory> diverge login --as ${account}`
+  );
+}
 async function runLogin(args, io) {
   refuseInSession(io.env, "login");
   const { values } = parseArgs2({
@@ -9174,6 +9115,7 @@ async function runLogin(args, io) {
   } catch (error) {
     throw new CliError(`Signed in, but the platform could not say who or where (${error instanceof Error ? error.message : String(error)}); run: diverge login`);
   }
+  if (loginHint) refuseAnotherAccount(info.email, loginHint, { named: Boolean(values.as), apiUrl });
   io.stdout(`Signed in as: ${info.email}`);
   const organizationId = await chooseDefaultOrganization(io, values["organization-id"], previous?.organization, info);
   const issued = await issueToken(source, { base_url: source.baseUrl, refresh_token: signIn.refreshToken, account: info.email }, organizationId);
@@ -9365,219 +9307,423 @@ function mergeOpencodeConfig(existing, options) {
   return config;
 }
 
-// src/agents/run-dsh.ts
-import { spawn as spawn2 } from "node:child_process";
-import fs7 from "node:fs";
+// src/agents/rotate.ts
+import os7 from "node:os";
 import path9 from "node:path";
-function writeDshToken(credentialsPath, accessToken) {
-  const existing = fs7.existsSync(credentialsPath) ? fs7.readFileSync(credentialsPath, "utf8") : null;
-  let merged;
-  try {
-    merged = mergeDshCredentials(existing, accessToken);
-  } catch (error) {
-    throw new CliError(`${credentialsPath}: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  writeTextAtomic(credentialsPath, merged, 384);
-}
-function writeDivergeShim(binDir, cli, sessionTokenPath, platform = process.platform) {
-  if (platform === "win32") {
-    const file2 = path9.join(binDir, "diverge.cmd");
-    const run3 = [cli.command, ...cli.args].map((part) => `"${part}"`).join(" ");
-    writeTextAtomic(file2, `@setlocal\r
-@set "${SESSION_TOKEN_VARIABLE}=${sessionTokenPath}"\r
-@${run3} %*\r
-`, 493);
-    return file2;
-  }
-  const quote = (part) => `'${part.replace(/'/g, `'\\''`)}'`;
-  const file = path9.join(binDir, "diverge");
-  writeTextAtomic(file, `#!/bin/sh
-${SESSION_TOKEN_VARIABLE}=${quote(sessionTokenPath)}
-export ${SESSION_TOKEN_VARIABLE}
-exec ${[cli.command, ...cli.args].map(quote).join(" ")} "$@"
-`, 493);
-  return file;
-}
-function dshEnv(env, binDir) {
-  const out = {};
-  for (const [key, value] of Object.entries(env)) {
-    if (value !== void 0 && key !== "DIVERGENT_TOKEN" && key !== "DIVERGENT_ORG_ID") out[key] = value;
-  }
-  out.PATH = env.PATH ? `${binDir}${path9.delimiter}${env.PATH}` : binDir;
-  return out;
-}
-function dshArgs(overlayPath, args) {
-  const rest = args.includes("--profile") ? args : args.length === 0 ? ["--profile", "web"] : ["--profile", "headless", ...args];
-  return ["--patch", overlayPath, ...rest];
+function defaultTokenFilePath() {
+  return path9.join(os7.homedir(), ".divergent", "token");
 }
-function dshLaunch(binary, args, platform = process.platform, execPath = process.execPath) {
-  if (platform !== "win32" || !/\.(cmd|bat)$/i.test(binary)) return { command: binary, args };
-  const packageDir = path9.join(path9.dirname(binary), "node_modules", "@deepseek-ai", "dsh");
-  let bin;
-  try {
-    bin = JSON.parse(fs7.readFileSync(path9.join(packageDir, "package.json"), "utf8")).bin;
-  } catch {
-    throw new CliError(`${binary} is not an npm shim for @deepseek-ai/dsh (no ${packageDir}); reinstall: npm install -g @deepseek-ai/dsh`);
+var MIN_ROTATE_INTERVAL_SECONDS = 60;
+async function rotateTokenFile(loop) {
+  const write = loop.write ?? ((file, token) => writeTextAtomic(file, token, 384));
+  const interval = Math.max(loop.intervalSeconds, MIN_ROTATE_INTERVAL_SECONDS) * 1e3;
+  for (; ; ) {
+    write(loop.tokenFile, await loop.freshToken());
+    loop.report(`${(loop.now ?? (() => /* @__PURE__ */ new Date()))().toISOString().slice(11, 19)} token written to ${loop.tokenFile}`);
+    if (loop.once) return 0;
+    await loop.sleep(interval);
   }
-  const script = typeof bin === "string" ? bin : typeof bin === "object" && bin !== null ? bin.dsh : void 0;
-  if (typeof script !== "string") throw new CliError(`${packageDir}/package.json declares no dsh entry; reinstall: npm install -g @deepseek-ai/dsh`);
-  return { command: execPath, args: [path9.join(packageDir, script), ...args] };
 }
-async function keepTokenFresh(loop) {
-  let written = null;
-  while (loop.isRunning()) {
-    const token = await loop.freshToken();
-    if (token && token !== written) {
-      loop.write(token);
-      written = token;
-    }
-    for (let i = 0; i < 30; i += 1) {
-      if (!loop.isRunning()) return;
-      await loop.sleep(1e3);
+
+// src/agents/self-command.ts
+import fs7 from "node:fs";
+import path10 from "node:path";
+function resolveSelfCommand(argv = process.argv, platform = process.platform, execPath = process.execPath) {
+  const script = argv[1];
+  if (!script) return { command: execPath, args: [] };
+  if (platform !== "win32") {
+    try {
+      fs7.accessSync(script, fs7.constants.X_OK);
+      return { command: path10.resolve(script), args: [] };
+    } catch {
     }
   }
+  return { command: execPath, args: [fs7.realpathSync(script)] };
 }
-function runDsh(options) {
-  const writeToken = (token) => {
-    writeDshToken(options.credentialsPath, token);
-    writeTextAtomic(options.sessionTokenPath, `${token}
-`, 384);
-  };
-  writeToken(options.initialToken);
-  writeDivergeShim(options.binDir, options.cli, options.sessionTokenPath);
-  const env = dshEnv(options.env, options.binDir);
-  const launch = dshLaunch(options.binary, dshArgs(options.overlayPath, options.args));
-  const child = spawn2(launch.command, launch.args, { env, stdio: "inherit" });
-  let exited = false;
-  let wake = null;
-  const finish = () => {
-    exited = true;
-    wake?.();
-  };
-  const done = new Promise((resolve, reject) => {
-    child.on("error", (error) => {
-      finish();
-      reject(error);
-    });
-    child.on("exit", (code2, signal) => {
-      finish();
-      resolve(code2 ?? (signal ? 128 + 15 : 1));
-    });
-  });
-  const ignore = () => {
-  };
-  process.on("SIGINT", ignore);
-  const terminate = () => child.kill("SIGTERM");
-  process.on("SIGTERM", terminate);
-  const loop = keepTokenFresh({
-    freshToken: options.freshToken,
-    write: writeToken,
-    isRunning: () => !exited,
-    sleep: (ms) => new Promise((resolve) => {
-      const timer = setTimeout(() => {
-        wake = null;
-        resolve();
-      }, ms);
-      wake = () => {
-        clearTimeout(timer);
-        wake = null;
-        resolve();
-      };
-    })
-  });
-  return done.finally(async () => {
-    process.off("SIGINT", ignore);
-    process.off("SIGTERM", terminate);
-    await loop;
-  });
+function shellCommand(self, ...trailing) {
+  return [self.command, ...self.args, ...trailing].map((part) => /[\s"]/.test(part) ? `"${part.replace(/"/g, '\\"')}"` : part).join(" ");
 }
 
-// src/agents/dsh-session-publisher.ts
-import fs8 from "node:fs";
-import path10 from "node:path";
+// src/commands/agents.ts
+var agentsUsage = `diverge agents <setup|rotate|status> ...
 
-// src/agents/dsh-session-log.ts
-import zlib from "node:zlib";
-var DSH_SESSION_LOG_FILE = "session.jsonl.zstd";
-var DSH_DELTA_RECORD_TYPES = /* @__PURE__ */ new Set(["assistant/chunk", "reasoning-chunks", "text-chunks", "tool-call-chunks"]);
-function dshProjectKey(cwd) {
-  if (cwd.length === 0) throw new Error("cannot encode an empty project path");
-  let readable = "";
-  let separatorRun = false;
-  for (let i = 0; i < cwd.length; i += 1) {
-    const code2 = cwd.charCodeAt(i);
-    const ch = String.fromCharCode(code2);
-    if (ch === "/" || ch === "\\" || ch === ":") {
-      if (!separatorRun) readable += "-";
-      separatorRun = true;
-    } else if (ch !== "~" && /^[A-Za-z0-9._-]$/.test(ch)) {
-      readable += ch;
-      separatorRun = false;
-    } else {
-      readable += `~${code2.toString(16).toUpperCase().padStart(4, "0")}`;
-      separatorRun = false;
-    }
-  }
-  return `--${(readable.replace(/^-+/, "") || "root").slice(0, 251)}--`;
+  setup claude   [--scope user|project] [--project-id <id>] [--model-discovery] [--organization-id <id>]
+  setup opencode [--surface anthropic|openai] [--config <path>] [--organization-id <id>]
+  setup codex    [--project-id <id>] [--config <path>] [--print] [--organization-id <id>]
+  rotate         [--into <path>] [--interval <seconds>] [--once] [--organization-id <id>]
+                 keep a token file fresh for a client that reads a file, not a helper (default ~/.divergent/token, every 600 s)
+  status         [--organization-id <id>]
+
+Point a coding agent at the platform's model gateway. A sign-in is started
+when the cached login does not serve the gateway for the organization. dsh
+needs no setup: diverge dsh starts it on the gateway.`;
+function surfaceOf(value, fallback) {
+  if (value === void 0) return fallback;
+  if (SURFACES.includes(value)) return value;
+  throw new CliError(`--surface must be one of: ${SURFACES.join(", ")}`);
 }
-function zstdAvailable() {
-  return typeof zlib.zstdDecompressSync === "function";
+function readJson(file) {
+  if (!fs8.existsSync(file)) return null;
+  return JSON.parse(fs8.readFileSync(file, "utf8"));
 }
-var ZSTD_MAGIC = 4247762216;
-var SKIPPABLE_MAGIC_LOW = 407710288;
-var SKIPPABLE_MAGIC_HIGH = 407710303;
-function zstdFrameEnd(buffer, start) {
-  if (buffer.length - start < 4) return null;
-  const magic = buffer.readUInt32LE(start);
-  if (magic >= SKIPPABLE_MAGIC_LOW && magic <= SKIPPABLE_MAGIC_HIGH) {
-    if (buffer.length - start < 8) return null;
-    const end = start + 8 + buffer.readUInt32LE(start + 4);
-    return end <= buffer.length ? end : null;
-  }
-  if (magic !== ZSTD_MAGIC) return null;
-  if (buffer.length - start < 5) return null;
-  const descriptor = buffer[start + 4];
-  const contentSizeFlag = descriptor >> 6;
-  const singleSegment = descriptor >> 5 & 1;
-  const checksum = descriptor >> 2 & 1;
-  const dictionaryFlag = descriptor & 3;
-  let pos = start + 5;
-  if (!singleSegment) pos += 1;
-  pos += [0, 1, 2, 4][dictionaryFlag];
-  pos += contentSizeFlag === 0 ? singleSegment : [0, 2, 4, 8][contentSizeFlag];
-  for (; ; ) {
-    if (pos + 3 > buffer.length) return null;
-    const header = buffer[pos] | buffer[pos + 1] << 8 | buffer[pos + 2] << 16;
-    const last = header & 1;
-    const type = header >> 1 & 3;
-    const size = header >> 3;
-    if (type === 3) return null;
-    pos += 3 + (type === 1 ? 1 : size);
-    if (pos > buffer.length) return null;
-    if (last) break;
-  }
-  if (checksum) pos += 4;
-  return pos <= buffer.length ? pos : null;
+async function servedModels(apiUrl, token, surface) {
+  return (await listModels(apiUrl, token.access_token, surface)).map(servedModel);
 }
-function decodeZstdFrames(buffer) {
-  const parts = [];
-  let offset = 0;
-  while (offset < buffer.length) {
-    const end = zstdFrameEnd(buffer, offset);
-    if (end === null) break;
-    if (buffer.readUInt32LE(offset) === ZSTD_MAGIC) {
-      try {
-        parts.push(zlib.zstdDecompressSync(buffer.subarray(offset, end)));
-      } catch (error) {
-        return { text: Buffer.concat(parts).toString("utf8"), consumed: offset, failed: { at: offset, error: error instanceof Error ? error.message : String(error) } };
-      }
-    }
-    offset = end;
+async function skillsFor(io, apiUrl, harness, organizationId) {
+  try {
+    const skills = await loginSkillSet(apiUrl, io.env, organizationId?.trim() || void 0);
+    const result = installForHarness(io, harness, skills, apiUrl);
+    for (const note of [...skills.notes, ...skippedNote([result])]) io.stderr(`warning: ${note}`);
+  } catch (error) {
+    io.stderr(`warning: skills not installed (${error instanceof Error ? error.message : String(error)}); run: diverge skills install`);
   }
-  return { text: Buffer.concat(parts).toString("utf8"), consumed: offset };
 }
-function text(value) {
-  return typeof value === "string" && value.length > 0 ? value : null;
+function organizationArgs(organizationId) {
+  const trimmed = organizationId?.trim();
+  return trimmed ? ["--organization-id", trimmed] : [];
+}
+async function setup(args, io) {
+  const [agent, ...rest] = args;
+  const apiUrl = resolveApiUrl(void 0, io.env);
+  switch (agent) {
+    case "claude": {
+      const { values } = parseArgs3({ args: rest, options: { scope: { type: "string", default: "user" }, "project-id": { type: "string" }, "organization-id": { type: "string" }, "model-discovery": { type: "boolean", default: false } }, strict: true });
+      if (values.scope !== "user" && values.scope !== "project") throw new CliError("--scope must be user or project");
+      const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
+      const file = claudeSettingsPath(values.scope);
+      const { settings, warnings } = mergeClaudeSettings(readJson(file), {
+        baseUrl: anthropicBaseUrl(apiUrl),
+        tokenHelper: shellCommand(resolveSelfCommand(), "token", ...organizationArgs(values["organization-id"])),
+        projectId: values["project-id"],
+        modelDiscovery: values["model-discovery"],
+        // Claude Code scans its skill folder when a session starts, so that is when the login's skills are brought current.
+        skillsRefresh: values.scope === "user" ? shellCommand(resolveSelfCommand(), "skills", "refresh") : void 0
+      });
+      writeJsonAtomic(file, settings);
+      io.stdout(`Claude Code \u2192 ${anthropicBaseUrl(apiUrl)} as you, organization ${tokenClaims(token.access_token).organizationId}. Wrote ${file}.`);
+      for (const warning of warnings) io.stderr(`warning: ${warning}`);
+      await skillsFor(io, apiUrl, "claude", values["organization-id"]);
+      return ExitCode.Ok;
+    }
+    case "opencode": {
+      const { values } = parseArgs3({ args: rest, options: { surface: { type: "string" }, "organization-id": { type: "string" }, config: { type: "string" } }, strict: true });
+      const surface = surfaceOf(values.surface, "anthropic");
+      const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
+      const baseUrl = surfaceBaseUrl(apiUrl, surface);
+      let models = [];
+      try {
+        models = await servedModels(apiUrl, token, surface);
+      } catch (error) {
+        io.stderr(`warning: ${error instanceof Error ? error.message : String(error)}; writing the provider without a model list`);
+      }
+      const file = values.config ?? opencodeConfigPath();
+      writeJsonAtomic(file, mergeOpencodeConfig(readJson(file), { baseUrl, surface, models }));
+      io.stdout(`OpenCode provider divergent-${surface} \u2192 ${baseUrl}. Wrote ${file}.`);
+      io.stdout("Keep DIVERGENT_TOKEN fresh for the session (user tokens expire; the login refreshes):");
+      io.stdout(`  export DIVERGENT_TOKEN="$(${["diverge", "token", ...organizationArgs(values["organization-id"])].join(" ")})"`);
+      return ExitCode.Ok;
+    }
+    case "codex": {
+      const { values } = parseArgs3({ args: rest, options: { "project-id": { type: "string" }, "organization-id": { type: "string" }, config: { type: "string" }, print: { type: "boolean", default: false } }, strict: true });
+      const block = codexProviderToml({ openaiBaseUrl: openaiBaseUrl(apiUrl), self: resolveSelfCommand(), projectId: values["project-id"], organizationId: values["organization-id"] });
+      if (values.print) {
+        io.stdout(block.trimEnd());
+        return ExitCode.Ok;
+      }
+      const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
+      const file = values.config ?? codexConfigPath();
+      const existing = fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : null;
+      writeTextAtomic(file, mergeCodexConfig(existing, block));
+      io.stdout(`Codex provider divergent \u2192 ${openaiBaseUrl(apiUrl)} as you, organization ${tokenClaims(token.access_token).organizationId}. Wrote ${file}.`);
+      io.stdout('Select it per run with: codex -c model_provider=divergent   (or set model_provider = "divergent" in the config)');
+      await skillsFor(io, apiUrl, "codex", values["organization-id"]);
+      return ExitCode.Ok;
+    }
+    default:
+      throw unknownVerb("agents", agentsUsage, ["setup"], agent, rest);
+  }
+}
+async function status(args, io) {
+  const { values } = parseArgs3({ args, options: { "organization-id": { type: "string" } }, strict: true });
+  const apiUrl = resolveApiUrl(void 0, io.env);
+  const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
+  const claims = tokenClaims(token.access_token);
+  io.stdout(`Gateway: ${apiUrl}/api/plugins/inference/{anthropic,openai}`);
+  io.stdout(`Organization: ${claims.organizationId}`);
+  io.stdout(`Scopes: ${(claims.scopes ?? []).join(" ")}`);
+  for (const surface of SURFACES) {
+    const models = (await servedModels(apiUrl, token, surface)).map((model) => model.id);
+    io.stdout(`Models (${surface}): ${models.length ? models.join(", ") : "(none served on this surface)"}`);
+  }
+  return ExitCode.Ok;
+}
+async function rotate(args, io) {
+  const { values } = parseArgs3({ args, options: { into: { type: "string" }, interval: { type: "string", default: "600" }, once: { type: "boolean", default: false }, "organization-id": { type: "string" } }, strict: true });
+  const interval = Number(values.interval);
+  if (!Number.isFinite(interval) || interval <= 0) throw new CliError("--interval must be a positive number of seconds");
+  const apiUrl = resolveApiUrl(void 0, io.env);
+  const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
+  const source = tokenSource(io.env, apiUrl);
+  const tokenFilePath = values.into ?? defaultTokenFilePath();
+  io.stderr(`Keeping ${tokenFilePath} fresh as you (organization ${tokenClaims(token.access_token).organizationId})`);
+  return rotateTokenFile({
+    tokenFile: tokenFilePath,
+    intervalSeconds: interval,
+    once: values.once,
+    freshToken: async () => (await getUserToken(source, { freshForSeconds: Math.max(interval, 60) + 60, organizationId: values["organization-id"] })).access_token,
+    report: (line) => io.stderr(line),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+  });
+}
+async function runAgents(args, io) {
+  const [verb, ...rest] = args;
+  switch (verb) {
+    case "setup":
+      return setup(rest, io);
+    case "rotate":
+      return rotate(rest, io);
+    case "status":
+      return status(rest, io);
+    default:
+      throw unknownVerb("agents", agentsUsage, [], verb, rest);
+  }
+}
+
+// src/commands/dsh.ts
+import { spawn as spawn5 } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import fs15 from "node:fs";
+import os8 from "node:os";
+import path18 from "node:path";
+import { parseArgs as parseArgs4 } from "node:util";
+
+// src/agents/dsh-install.ts
+import fs10 from "node:fs";
+import path13 from "node:path";
+
+// src/npm.ts
+import { spawn as spawn2 } from "node:child_process";
+import path12 from "node:path";
+
+// src/fs/path.ts
+import fs9 from "node:fs";
+import path11 from "node:path";
+function findOnPath(name, env = process.env, platform = process.platform) {
+  const dirs = (env.PATH ?? "").split(path11.delimiter).filter(Boolean);
+  const extensions = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  const candidates = platform === "win32" ? extensions.map((extension) => `${name}${extension.toLowerCase()}`) : [name];
+  for (const dir of dirs) {
+    for (const candidate of candidates) {
+      const full = path11.join(dir, candidate);
+      try {
+        fs9.accessSync(full, fs9.constants.X_OK);
+        if (fs9.statSync(full).isFile()) return full;
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+
+// src/npm.ts
+function runNpm(args, env = process.env, platform = process.platform, stdio = "inherit") {
+  let command = "npm";
+  const argv = [...args];
+  if (platform === "win32") {
+    const npm = findOnPath("npm", env, platform);
+    if (!npm) throw new CliError("npm was not found on PATH; install Node.js with npm and try again.");
+    command = npm;
+    if (/\.(cmd|bat)$/i.test(npm)) {
+      command = process.execPath;
+      argv.unshift(path12.join(path12.dirname(npm), "node_modules", "npm", "bin", "npm-cli.js"));
+    }
+  }
+  return new Promise((resolve, reject) => {
+    const child = spawn2(command, argv, { env, stdio });
+    child.on("error", reject);
+    child.on("exit", (code2) => resolve(code2 ?? 1));
+  });
+}
+
+// src/agents/dsh-version.ts
+var TESTED_DSH_VERSION = "0.2.1-rc.5";
+
+// src/agents/dsh-install.ts
+var DSH_PACKAGE = "@deepseek-ai/dsh";
+var REGISTRY = "https://registry.npmjs.org";
+var RETIRED_AFTER_MS = 7 * 24 * 60 * 60 * 1e3;
+function dshInstallRoot(env) {
+  return path13.join(configDir(env), "harness", "dsh");
+}
+function dshPackageIn(prefix) {
+  return path13.join(prefix, "node_modules", "@deepseek-ai", "dsh");
+}
+function readManifest(prefix) {
+  try {
+    return JSON.parse(fs10.readFileSync(path13.join(dshPackageIn(prefix), "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function nodeSatisfies(range, nodeVersion) {
+  const floor = /^>=\s*(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(range?.trim() ?? "");
+  if (!floor) return true;
+  const have = nodeVersion.replace(/^v/, "").split(".").map(Number);
+  for (let i = 0; i < 3; i += 1) {
+    const want = Number(floor[i + 1] ?? 0);
+    if ((have[i] ?? 0) !== want) return (have[i] ?? 0) > want;
+  }
+  return true;
+}
+function requireNode(version, range, nodeVersion) {
+  if (!nodeSatisfies(range, nodeVersion)) {
+    throw new CliError(`dsh ${version} needs Node ${range}; this is Node ${nodeVersion}. Install a newer Node, then run diverge dsh again.`);
+  }
+}
+var realDeps = (env) => ({
+  // npm 11 runs only the install scripts a project approves. dsh's own restores
+  // the executable bit on node-pty's helper, without which a macOS shell cannot
+  // start; the rest check prebuilt binaries or print a notice. An older npm
+  // ignores the field and runs them all. stdout goes to stderr: a headless
+  // run's stdout is the answer.
+  npmInstall: (prefix, spec) => {
+    fs10.writeFileSync(path13.join(prefix, "package.json"), JSON.stringify({ private: true, allowScripts: { "@deepseek-ai/dsh-subprocess-local": true } }));
+    return runNpm(["install", "--prefix", prefix, "--no-audit", "--no-fund", "--loglevel=error", spec], env, process.platform, ["ignore", 2, 2]);
+  },
+  engines: async (version) => (await fetchJson(`${REGISTRY}/${DSH_PACKAGE}/${version}`, { timeoutMs: 15e3 })).engines?.node,
+  nodeVersion: process.version,
+  now: Date.now
+});
+async function ensureDsh(io, version = TESTED_DSH_VERSION, deps = realDeps(io.env)) {
+  const root = dshInstallRoot(io.env);
+  const prefix = path13.join(root, version);
+  let manifest = readManifest(prefix);
+  if (manifest) {
+    requireNode(version, manifest.engines?.node, deps.nodeVersion);
+  } else {
+    let engines;
+    try {
+      engines = await deps.engines(version);
+    } catch {
+    }
+    requireNode(version, engines, deps.nodeVersion);
+    io.stderr(`Installing dsh ${version} (about a minute and nearly 1 GB, once per dsh release)\u2026`);
+    const staging = `${prefix}.installing-${process.pid}`;
+    fs10.mkdirSync(staging, { recursive: true });
+    try {
+      const code2 = await deps.npmInstall(staging, `${DSH_PACKAGE}@${version}`);
+      if (code2 !== 0) throw new CliError(`Installing dsh ${version} failed: npm exited with ${code2}. Check the network and run diverge dsh again.`);
+      try {
+        fs10.renameSync(staging, prefix);
+      } catch (error) {
+        if (!readManifest(prefix)) throw error;
+      }
+    } finally {
+      fs10.rmSync(staging, { recursive: true, force: true });
+    }
+    manifest = readManifest(prefix);
+    if (!manifest) throw new CliError(`Installing dsh ${version} left no package at ${dshPackageIn(prefix)}`);
+  }
+  const bin = typeof manifest.bin === "string" ? manifest.bin : manifest.bin?.dsh;
+  if (!bin) throw new CliError(`dsh ${version} declares no entry script`);
+  retireOldVersions(root, version, deps.now());
+  return { command: process.execPath, args: [path13.join(dshPackageIn(prefix), bin)] };
+}
+function retireOldVersions(root, current, now) {
+  try {
+    const moment = new Date(now);
+    fs10.utimesSync(path13.join(root, current), moment, moment);
+    for (const name of fs10.readdirSync(root)) {
+      if (name === current) continue;
+      const dir = path13.join(root, name);
+      if (now - fs10.statSync(dir).mtimeMs > RETIRED_AFTER_MS) fs10.rmSync(dir, { recursive: true, force: true });
+    }
+  } catch {
+  }
+}
+
+// src/agents/dsh-session-publisher.ts
+import fs12 from "node:fs";
+import path15 from "node:path";
+
+// src/agents/dsh-session-log.ts
+import fs11 from "node:fs";
+import path14 from "node:path";
+import zlib from "node:zlib";
+var DSH_SESSION_LOG_FILE = /^session\.v(\d+)\.jsonl\.zstd$/;
+function dshSessionLogFile(dir) {
+  let names;
+  try {
+    names = fs11.readdirSync(dir);
+  } catch {
+    return null;
+  }
+  let newest = null;
+  for (const name of names) {
+    const format = Number(DSH_SESSION_LOG_FILE.exec(name)?.[1]);
+    if (!Number.isNaN(format) && (!newest || format > newest.format)) newest = { name, format };
+  }
+  return newest && path14.join(dir, newest.name);
+}
+var DSH_DELTA_RECORD_TYPES = /* @__PURE__ */ new Set(["assistant/chunk", "reasoning-chunks", "text-chunks", "tool-call-chunks"]);
+function zstdAvailable() {
+  return typeof zlib.zstdDecompressSync === "function";
+}
+var ZSTD_MAGIC = 4247762216;
+var SKIPPABLE_MAGIC_LOW = 407710288;
+var SKIPPABLE_MAGIC_HIGH = 407710303;
+function zstdFrameEnd(buffer, start) {
+  if (buffer.length - start < 4) return null;
+  const magic = buffer.readUInt32LE(start);
+  if (magic >= SKIPPABLE_MAGIC_LOW && magic <= SKIPPABLE_MAGIC_HIGH) {
+    if (buffer.length - start < 8) return null;
+    const end = start + 8 + buffer.readUInt32LE(start + 4);
+    return end <= buffer.length ? end : null;
+  }
+  if (magic !== ZSTD_MAGIC) return null;
+  if (buffer.length - start < 5) return null;
+  const descriptor = buffer[start + 4];
+  const contentSizeFlag = descriptor >> 6;
+  const singleSegment = descriptor >> 5 & 1;
+  const checksum = descriptor >> 2 & 1;
+  const dictionaryFlag = descriptor & 3;
+  let pos = start + 5;
+  if (!singleSegment) pos += 1;
+  pos += [0, 1, 2, 4][dictionaryFlag];
+  pos += contentSizeFlag === 0 ? singleSegment : [0, 2, 4, 8][contentSizeFlag];
+  for (; ; ) {
+    if (pos + 3 > buffer.length) return null;
+    const header = buffer[pos] | buffer[pos + 1] << 8 | buffer[pos + 2] << 16;
+    const last = header & 1;
+    const type = header >> 1 & 3;
+    const size = header >> 3;
+    if (type === 3) return null;
+    pos += 3 + (type === 1 ? 1 : size);
+    if (pos > buffer.length) return null;
+    if (last) break;
+  }
+  if (checksum) pos += 4;
+  return pos <= buffer.length ? pos : null;
+}
+function decodeZstdFrames(buffer) {
+  const parts = [];
+  let offset = 0;
+  while (offset < buffer.length) {
+    const end = zstdFrameEnd(buffer, offset);
+    if (end === null) break;
+    if (buffer.readUInt32LE(offset) === ZSTD_MAGIC) {
+      try {
+        parts.push(zlib.zstdDecompressSync(buffer.subarray(offset, end)));
+      } catch (error) {
+        return { text: Buffer.concat(parts).toString("utf8"), consumed: offset, failed: { at: offset, error: error instanceof Error ? error.message : String(error) } };
+      }
+    }
+    offset = end;
+  }
+  return { text: Buffer.concat(parts).toString("utf8"), consumed: offset };
+}
+function text(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
 }
 function instant(value, fallback) {
   const ms = typeof value === "number" && Number.isFinite(value) ? value : fallback;
@@ -9634,6 +9780,13 @@ var CAPTURE_NOTICES = {
   metadata: "Recorded: metadata only \u2014 which tools ran and how many failed, tokens, models and timing; no prompt, reply, tool argument or result.",
   conversation: "Recorded: the whole conversation \u2014 every prompt, reply, tool call and its result. Yours to read; anyone else in the organization needs the Agent Conversations role, and every such read is recorded on the session."
 };
+function readDirectories(dir) {
+  try {
+    return fs12.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => entry.isDirectory() ? [entry.name] : []);
+  } catch {
+    return [];
+  }
+}
 function eventBytes(event) {
   return Buffer.byteLength(JSON.stringify(event), "utf8");
 }
@@ -9665,10 +9818,6 @@ var DshSessionPublisher = class {
   /** The level the person was last told. */
   announced = null;
   ticking = null;
-  /** The directory dsh writes this launch's sessions under. */
-  get projectDir() {
-    return path10.join(this.deps.sessionsRoot, dshProjectKey(this.deps.cwd));
-  }
   start() {
     if (this.running) return;
     if (!zstdAvailable()) {
@@ -9721,54 +9870,63 @@ var DshSessionPublisher = class {
       await this.flush(session);
     }
   }
+  /**
+   * Every session this launch opened or continued, in any project: dsh files a
+   * session under its workspace, and the web UI's workspace is the person's
+   * choice (its default is a folder of dsh's own), not where the launch was
+   * started; and it reopens the last conversation, which is older than the
+   * launch and writes to its log again. dsh's home holds one launch's sessions
+   * at a time in practice; a second launch on the same home would record the
+   * first one's as well.
+   */
   discover() {
-    let entries;
-    try {
-      entries = fs8.readdirSync(this.projectDir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (!entry.isDirectory() || this.sessions.has(entry.name)) continue;
-      const dir = path10.join(this.projectDir, entry.name);
-      const file = path10.join(dir, DSH_SESSION_LOG_FILE);
-      let stat;
-      try {
-        stat = fs8.statSync(dir);
-      } catch {
-        continue;
+    const cutoff = this.deps.launchedAt - LAUNCH_SLACK_MS;
+    for (const project of readDirectories(this.deps.sessionsRoot)) {
+      const projectDir = path15.join(this.deps.sessionsRoot, project);
+      for (const name of readDirectories(projectDir)) {
+        if (this.sessions.has(name)) continue;
+        const dir = path15.join(projectDir, name);
+        const log = dshSessionLogFile(dir);
+        let touched;
+        try {
+          const stat = fs12.statSync(dir);
+          touched = Math.max(Math.min(stat.birthtimeMs || Number.POSITIVE_INFINITY, stat.mtimeMs), log ? fs12.statSync(log).mtimeMs : 0);
+        } catch {
+          continue;
+        }
+        if (touched < cutoff) continue;
+        this.sessions.set(name, {
+          dir,
+          file: null,
+          offset: 0,
+          header: null,
+          pending: [],
+          opened: false,
+          lastSeq: -1,
+          reportedFailure: null,
+          unreadableReported: false,
+          stalledAt: 0,
+          stalledTicks: 0,
+          dead: false
+        });
       }
-      const born = Math.min(stat.birthtimeMs || Number.POSITIVE_INFINITY, stat.mtimeMs);
-      if (born < this.deps.launchedAt - LAUNCH_SLACK_MS) continue;
-      this.sessions.set(entry.name, {
-        dir,
-        file,
-        offset: 0,
-        header: null,
-        pending: [],
-        opened: false,
-        lastSeq: -1,
-        reportedFailure: null,
-        unreadableReported: false,
-        stalledAt: 0,
-        stalledTicks: 0,
-        dead: false
-      });
     }
   }
   read(session) {
     if (session.dead) return;
+    session.file ??= dshSessionLogFile(session.dir);
+    if (!session.file) return;
     let fd;
     try {
-      fd = fs8.openSync(session.file, "r");
+      fd = fs12.openSync(session.file, "r");
     } catch {
       return;
     }
     try {
-      const size = fs8.fstatSync(fd).size;
+      const size = fs12.fstatSync(fd).size;
       if (size <= session.offset) return;
       const buffer = Buffer.alloc(size - session.offset);
-      const read = fs8.readSync(fd, buffer, 0, buffer.length, session.offset);
+      const read = fs12.readSync(fd, buffer, 0, buffer.length, session.offset);
       const decoded = decodeZstdFrames(buffer.subarray(0, read));
       if (decoded.failed) {
         this.giveUp(session, `the frame at byte ${session.offset + decoded.failed.at} does not decode: ${decoded.failed.error}`);
@@ -9796,7 +9954,7 @@ var DshSessionPublisher = class {
         this.deps.report(`warning: the platform has not taken ${session.file} for a while; ${dropped} oldest unsent event(s) were dropped`);
       }
     } finally {
-      fs8.closeSync(fd);
+      fs12.closeSync(fd);
     }
   }
   /** The rest of this session's log cannot be read; what was sent stands, and the person is told once. */
@@ -9810,7 +9968,7 @@ var DshSessionPublisher = class {
       harnessSessionId: header.id,
       ...this.deps.harnessVersion ? { harnessVersion: this.deps.harnessVersion } : {},
       host: this.deps.host,
-      workingDirectory: header.cwd ?? this.deps.cwd,
+      workingDirectory: header.cwd ?? void 0,
       ...header.createdAt !== null ? { startedAt: new Date(header.createdAt).toISOString() } : {},
       launchId: this.deps.launchId,
       ...header.parentSession ? { parentHarnessSessionId: header.parentSession } : {},
@@ -9846,256 +10004,338 @@ var DshSessionPublisher = class {
       session.pending.splice(0, batch.length);
     }
   }
-};
-
-// src/agents/dsh-session-tools.ts
-var AGENT_SESSION_APPEND_TOOL = "forge_append_agent_session_events";
-var AGENT_SESSION_LIST_TOOL = "forge_list_agent_sessions";
+};
+
+// src/agents/dsh-session-tools.ts
+var AGENT_SESSION_APPEND_TOOL = "forge_append_agent_session_events";
+var AGENT_SESSION_LIST_TOOL = "forge_list_agent_sessions";
+
+// src/agents/run-dsh.ts
+import { spawn as spawn3 } from "node:child_process";
+import fs13 from "node:fs";
+import path16 from "node:path";
+function writeDshToken(credentialsPath, accessToken) {
+  const existing = fs13.existsSync(credentialsPath) ? fs13.readFileSync(credentialsPath, "utf8") : null;
+  let merged;
+  try {
+    merged = mergeDshCredentials(existing, accessToken);
+  } catch (error) {
+    throw new CliError(`${credentialsPath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  writeTextAtomic(credentialsPath, merged, 384);
+}
+function writeDivergeShim(binDir, cli, sessionTokenPath, platform = process.platform) {
+  if (platform === "win32") {
+    const file2 = path16.join(binDir, "diverge.cmd");
+    const run2 = [cli.command, ...cli.args].map((part) => `"${part}"`).join(" ");
+    writeTextAtomic(file2, `@setlocal\r
+@set "${SESSION_TOKEN_VARIABLE}=${sessionTokenPath}"\r
+@${run2} %*\r
+`, 493);
+    return file2;
+  }
+  const quote = (part) => `'${part.replace(/'/g, `'\\''`)}'`;
+  const file = path16.join(binDir, "diverge");
+  writeTextAtomic(file, `#!/bin/sh
+${SESSION_TOKEN_VARIABLE}=${quote(sessionTokenPath)}
+export ${SESSION_TOKEN_VARIABLE}
+exec ${[cli.command, ...cli.args].map(quote).join(" ")} "$@"
+`, 493);
+  return file;
+}
+function dshEnv(env, binDir) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== void 0 && key !== "DIVERGENT_TOKEN" && key !== "DIVERGENT_ORG_ID") out[key] = value;
+  }
+  out.PATH = env.PATH ? `${binDir}${path16.delimiter}${env.PATH}` : binDir;
+  return out;
+}
+function dshArgs(overlayPath, args) {
+  const rest = args.includes("--profile") ? args : args.length === 0 ? ["--profile", "web"] : ["--profile", "headless", ...args];
+  return ["--patch", overlayPath, ...rest];
+}
+async function keepTokenFresh(loop) {
+  let written = null;
+  while (loop.isRunning()) {
+    const token = await loop.freshToken();
+    if (token && token !== written) {
+      loop.write(token);
+      written = token;
+    }
+    for (let i = 0; i < 30; i += 1) {
+      if (!loop.isRunning()) return;
+      await loop.sleep(1e3);
+    }
+  }
+}
+function runDsh(options) {
+  const writeToken = (token) => {
+    writeDshToken(options.credentialsPath, token);
+    writeTextAtomic(options.sessionTokenPath, `${token}
+`, 384);
+  };
+  writeToken(options.initialToken);
+  writeDivergeShim(options.binDir, options.cli, options.sessionTokenPath);
+  const env = dshEnv(options.env, options.binDir);
+  const child = spawn3(options.dsh.command, [...options.dsh.args, ...dshArgs(options.overlayPath, options.args)], { env, stdio: "inherit" });
+  let exited = false;
+  let wake = null;
+  const finish = () => {
+    exited = true;
+    wake?.();
+  };
+  const done = new Promise((resolve, reject) => {
+    child.on("error", (error) => {
+      finish();
+      reject(error);
+    });
+    child.on("exit", (code2, signal) => {
+      finish();
+      resolve(code2 ?? (signal ? 128 + 15 : 1));
+    });
+  });
+  const ignore = () => {
+  };
+  process.on("SIGINT", ignore);
+  const terminate = () => child.kill("SIGTERM");
+  process.on("SIGTERM", terminate);
+  const loop = keepTokenFresh({
+    freshToken: options.freshToken,
+    write: writeToken,
+    isRunning: () => !exited,
+    sleep: (ms) => new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        wake = null;
+        resolve();
+      }, ms);
+      wake = () => {
+        clearTimeout(timer);
+        wake = null;
+        resolve();
+      };
+    })
+  });
+  return done.finally(async () => {
+    process.off("SIGINT", ignore);
+    process.off("SIGTERM", terminate);
+    await loop;
+  });
+}
 
-// src/fs/path.ts
-import fs9 from "node:fs";
-import path11 from "node:path";
-function findOnPath(name, env = process.env, platform = process.platform) {
-  const dirs = (env.PATH ?? "").split(path11.delimiter).filter(Boolean);
-  const extensions = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
-  const candidates = platform === "win32" ? extensions.map((extension) => `${name}${extension.toLowerCase()}`) : [name];
-  for (const dir of dirs) {
-    for (const candidate of candidates) {
-      const full = path11.join(dir, candidate);
-      try {
-        fs9.accessSync(full, fs9.constants.X_OK);
-        if (fs9.statSync(full).isFile()) return full;
-      } catch {
-      }
-    }
+// src/update-notice.ts
+import { spawn as spawn4 } from "node:child_process";
+import fs14 from "node:fs";
+import path17 from "node:path";
+var UPDATE_CHECK_FILE = "update-check.json";
+var UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+function updateCheckFile(env) {
+  return path17.join(configDir(env), UPDATE_CHECK_FILE);
+}
+function readUpdateCheck(env) {
+  try {
+    const parsed = JSON.parse(fs14.readFileSync(updateCheckFile(env), "utf8"));
+    if (parsed && typeof parsed === "object" && typeof parsed.checkedAt === "number" && typeof parsed.latest === "string") return parsed;
+  } catch {
   }
   return null;
 }
-
-// src/agents/rotate.ts
-import os7 from "node:os";
-import path12 from "node:path";
-function defaultTokenFilePath() {
-  return path12.join(os7.homedir(), ".divergent", "token");
+function writeUpdateCheck(env, check) {
+  writeJsonAtomic(updateCheckFile(env), check);
 }
-var MIN_ROTATE_INTERVAL_SECONDS = 60;
-async function rotateTokenFile(loop) {
-  const write = loop.write ?? ((file, token) => writeTextAtomic(file, token, 384));
-  const interval = Math.max(loop.intervalSeconds, MIN_ROTATE_INTERVAL_SECONDS) * 1e3;
-  for (; ; ) {
-    write(loop.tokenFile, await loop.freshToken());
-    loop.report(`${(loop.now ?? (() => /* @__PURE__ */ new Date()))().toISOString().slice(11, 19)} token written to ${loop.tokenFile}`);
-    if (loop.once) return 0;
-    await loop.sleep(interval);
+function noticeFor(check, version = VERSION) {
+  if (!check || !isNewer(check.latest, version)) return null;
+  return `diverge ${check.latest} is available (this is ${version}). Update with: diverge update   (or run npx @divergeai/cli@latest)`;
+}
+function noticeApplies(argv, io, version = VERSION) {
+  if (version === "dev" || !io.interactive) return false;
+  if (io.env.DIVERGE_NO_UPDATE_CHECK?.trim() || io.env.CI?.trim() || sessionTokenFile(io.env)) return false;
+  if (argv[0] === "update") return false;
+  if (argv[0] === "tools" && argv[1] === "bridge") return false;
+  return true;
+}
+function scheduleUpdateCheck(spawnImpl = spawn4) {
+  try {
+    const child = spawnImpl(process.execPath, [process.argv[1], "update", "--record"], { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
   }
 }
+function updateNotice(argv, io, deps = { now: Date.now, schedule: scheduleUpdateCheck, read: readUpdateCheck, version: VERSION }) {
+  if (!noticeApplies(argv, io, deps.version)) return;
+  const check = deps.read(io.env);
+  const notice = noticeFor(check, deps.version);
+  if (notice) io.stderr(notice);
+  if (!check || deps.now() - check.checkedAt > UPDATE_CHECK_INTERVAL_MS) deps.schedule();
+}
 
-// src/agents/self-command.ts
-import fs10 from "node:fs";
-import path13 from "node:path";
-function resolveSelfCommand(argv = process.argv, platform = process.platform, execPath = process.execPath) {
-  const script = argv[1];
-  if (!script) return { command: execPath, args: [] };
-  if (platform !== "win32") {
+// src/commands/update.ts
+var PACKAGE_NAME = "@divergeai/cli";
+var updateUsage = "diverge update\n\nInstall the latest release with the npm that installed this one.";
+async function latestVersion(registry = "https://registry.npmjs.org", timeoutMs) {
+  const body = await fetchJson(`${registry}/${PACKAGE_NAME}/latest`, { timeoutMs });
+  if (!body.version) throw new CliError("The registry answered without a version");
+  return body.version;
+}
+function isNewer(a, b) {
+  const parse = (v) => {
+    const [core, pre] = v.split("-", 2);
+    return { nums: core.split(".").map((n) => Number(n) || 0), pre: pre ?? "" };
+  };
+  const x = parse(a);
+  const y = parse(b);
+  for (let i = 0; i < 3; i += 1) {
+    const dx = x.nums[i] ?? 0;
+    const dy = y.nums[i] ?? 0;
+    if (dx !== dy) return dx > dy;
+  }
+  if (x.pre === y.pre) return false;
+  if (!x.pre) return true;
+  if (!y.pre) return false;
+  return x.pre > y.pre;
+}
+async function runUpdate(args, io, deps = { latestVersion, install: installLatest, record: writeUpdateCheck, now: Date.now }) {
+  refuseInSession(io.env, "update");
+  if (args[0] === "--record") {
     try {
-      fs10.accessSync(script, fs10.constants.X_OK);
-      return { command: path13.resolve(script), args: [] };
+      deps.record(io.env, { checkedAt: deps.now(), latest: await deps.latestVersion() });
     } catch {
     }
+    return ExitCode.Ok;
+  }
+  if (VERSION === "dev") throw new CliError("This is a source checkout, not an installed release; pull the repository instead.");
+  const latest = await deps.latestVersion();
+  if (!isNewer(latest, VERSION)) {
+    io.stdout(`diverge ${VERSION} is up to date.`);
+    return ExitCode.Ok;
   }
-  return { command: execPath, args: [fs10.realpathSync(script)] };
+  io.stdout(`Updating diverge ${VERSION} \u2192 ${latest}\u2026`);
+  const code2 = await deps.install(latest);
+  if (code2 !== 0) throw new CliError(`npm install exited with ${code2}`);
+  io.stdout(`diverge ${latest} installed.`);
+  return ExitCode.Ok;
 }
-function shellCommand(self, ...trailing) {
-  return [self.command, ...self.args, ...trailing].map((part) => /[\s"]/.test(part) ? `"${part.replace(/"/g, '\\"')}"` : part).join(" ");
+function installLatest(version, env = process.env, platform = process.platform, stdio = "inherit") {
+  return runNpm(["install", "-g", `${PACKAGE_NAME}@${version}`], env, platform, stdio);
 }
 
-// src/commands/agents.ts
-var agentsUsage = `diverge agents <setup|run|rotate|status> ...
+// src/commands/dsh.ts
+var dshUsage = `diverge dsh [--surface anthropic|openai] [--model <id>] [--organization-id <id>] [-- <dsh args>]
 
-  setup claude   [--scope user|project] [--project-id <id>] [--model-discovery] [--organization-id <id>]
-  setup opencode [--surface anthropic|openai] [--config <path>] [--organization-id <id>]
-  setup codex    [--project-id <id>] [--config <path>] [--print] [--organization-id <id>]
-  setup dsh      [--surface anthropic|openai] [--model <id>] [--into <path>] [--print] [--organization-id <id>]
-  run dsh        [--surface anthropic|openai] [--model <id>] [--organization-id <id>] [-- <dsh args>]
-                 nothing after --: the interactive web UI; a task after --: one headless run
-  rotate         [--into <path>] [--interval <seconds>] [--once] [--organization-id <id>]
-                 keep a token file fresh for a client that reads a file, not a helper (default ~/.divergent/token, every 600 s)
-  status         [--organization-id <id>]
+Start DeepSeek Harness on the organization's model gateway. Nothing after --
+opens the web UI; a task after -- answers it headless and exits; any other dsh
+arguments go after -- as given.
 
-Point a coding agent at the platform's model gateway. A sign-in is started
-when the cached login does not serve the gateway for the organization.`;
-function surfaceOf(value, fallback) {
-  if (value === void 0) return fallback;
-  if (SURFACES.includes(value)) return value;
-  throw new CliError(`--surface must be one of: ${SURFACES.join(", ")}`);
-}
-function readJson(file) {
-  if (!fs11.existsSync(file)) return null;
-  return JSON.parse(fs11.readFileSync(file, "utf8"));
-}
-async function servedModels(apiUrl, token, surface) {
-  return (await listModels(apiUrl, token.access_token, surface)).map(servedModel);
-}
-function syncDivergentPreset(io, binary, home) {
-  if (!binary) {
-    io.stderr("dsh is not on PATH; the Divergent agent preset is derived when `diverge agents run dsh` first runs.");
-    return;
+Every launch brings the CLI, the dsh release it is tested with and your skills
+up to date first. DIVERGE_NO_UPDATE_CHECK skips the CLI's update.`;
+var RELAUNCHED = "DIVERGE_DSH_RELAUNCHED";
+var LATEST_TIMEOUT_MS = 5e3;
+async function updateThenRelaunch(io, deps) {
+  const env = io.env;
+  if (deps.version === "dev" || env[RELAUNCHED] || env.DIVERGE_NO_UPDATE_CHECK?.trim() || env.CI?.trim() || sessionTokenFile(env)) return null;
+  let latest;
+  try {
+    latest = await deps.latest();
+  } catch {
+    return null;
   }
-  const packageDir = dshPackageDir(binary);
-  const shipped = packageDir ? shippedPresetDir(packageDir) : null;
-  if (!shipped) {
-    io.stderr(`warning: no shipped "standard" preset found behind ${binary}; dsh's own web_search stays in its web sessions and fails without a vendor key`);
-    return;
+  if (!isNewer(latest, deps.version)) return null;
+  io.stderr(`Updating diverge ${deps.version} \u2192 ${latest}\u2026`);
+  let code2;
+  try {
+    code2 = await deps.install(latest);
+  } catch (error) {
+    io.stderr(`warning: could not update diverge (${error instanceof Error ? error.message : String(error)}); going on with ${deps.version}. To retry: diverge update`);
+    return null;
   }
-  const dir = writeDivergentPreset(home, shipped);
-  const settingsPath = path14.join(home, "settings.yaml");
-  const settings = withDivergentPresetDefault(fs11.existsSync(settingsPath) ? fs11.readFileSync(settingsPath, "utf8") : null);
-  if (settings !== null) writeTextAtomic(settingsPath, settings);
-  io.stderr(`Agent preset "${DIVERGENT_PRESET_ID}" (${dir}): web sessions search through the platform${settings !== null ? "; set as the default preset in settings.yaml" : ""}.`);
+  if (code2 !== 0) {
+    io.stderr(`warning: could not update diverge (npm exited with ${code2}); going on with ${deps.version}. To retry: diverge update`);
+    return null;
+  }
+  return deps.relaunch();
+}
+function relaunch(args, env) {
+  return new Promise((resolve, reject) => {
+    const child = spawn5(process.execPath, [process.argv[1], "dsh", ...args], { env: { ...env, [RELAUNCHED]: "1" }, stdio: "inherit" });
+    const ignore = () => {
+    };
+    const terminate = () => child.kill("SIGTERM");
+    process.on("SIGINT", ignore);
+    process.on("SIGTERM", terminate);
+    const settle = () => {
+      process.off("SIGINT", ignore);
+      process.off("SIGTERM", terminate);
+    };
+    child.on("error", (error) => {
+      settle();
+      reject(error);
+    });
+    child.on("exit", (code2, signal) => {
+      settle();
+      resolve(code2 ?? (signal ? 128 + 15 : 1));
+    });
+  });
+}
+function surfaceOf2(value) {
+  if (value === void 0) return "openai";
+  if (SURFACES.includes(value)) return value;
+  throw new CliError(`--surface must be one of: ${SURFACES.join(", ")}`);
 }
-async function skillsFor(io, apiUrl, harness, organizationId) {
+function savedModel(home, surface) {
+  const file = path18.join(home, "profiles", "web", "cordis.patch.yml");
   try {
-    const skills = await loginSkillSet(apiUrl, io.env, organizationId?.trim() || void 0);
-    const result = installForHarness(io, harness, skills, apiUrl);
-    for (const note of [...skills.notes, ...skippedNote([result])]) io.stderr(`warning: ${note}`);
+    return dshSavedModel(fs15.existsSync(file) ? fs15.readFileSync(file, "utf8") : null, surface);
   } catch (error) {
-    io.stderr(`warning: skills not installed (${error instanceof Error ? error.message : String(error)}); run: diverge skills install`);
+    throw new CliError(`${file}: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-async function overlayAndDefault(apiUrl, token, surface, io, requested, launch) {
-  const served = await servedModels(apiUrl, token, surface);
+async function overlayAndDefault(io, apiUrl, token, surface, requested, saved, launch) {
+  const served = (await listModels(apiUrl, token.access_token, surface)).map(servedModel);
   const models = served.map((model) => model.id);
   if (models.length === 0) throw new CliError(`the gateway serves no models on the ${surface} surface for this organization`);
   if (requested && !models.includes(requested)) throw new CliError(`${requested} is not served on the ${surface} surface; choose one of: ${models.join(", ")}`);
-  const defaultModel = dshDefaultModel(models, requested);
-  return { overlay: dshPatchYaml({ baseUrl: surfaceBaseUrl(apiUrl, surface), surface, models: served, defaultModel, launch }), defaultModel, models };
-}
-function organizationArgs(organizationId) {
-  const trimmed = organizationId?.trim();
-  return trimmed ? ["--organization-id", trimmed] : [];
-}
-async function setup(args, io) {
-  const [agent, ...rest] = args;
-  const apiUrl = resolveApiUrl(void 0, io.env);
-  switch (agent) {
-    case "claude": {
-      const { values } = parseArgs3({ args: rest, options: { scope: { type: "string", default: "user" }, "project-id": { type: "string" }, "organization-id": { type: "string" }, "model-discovery": { type: "boolean", default: false } }, strict: true });
-      if (values.scope !== "user" && values.scope !== "project") throw new CliError("--scope must be user or project");
-      const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
-      const file = claudeSettingsPath(values.scope);
-      const { settings, warnings } = mergeClaudeSettings(readJson(file), {
-        baseUrl: anthropicBaseUrl(apiUrl),
-        tokenHelper: shellCommand(resolveSelfCommand(), "token", ...organizationArgs(values["organization-id"])),
-        projectId: values["project-id"],
-        modelDiscovery: values["model-discovery"],
-        // Claude Code scans its skill folder when a session starts, so that is when the login's skills are brought current.
-        skillsRefresh: values.scope === "user" ? shellCommand(resolveSelfCommand(), "skills", "refresh") : void 0
-      });
-      writeJsonAtomic(file, settings);
-      io.stdout(`Claude Code \u2192 ${anthropicBaseUrl(apiUrl)} as you, organization ${tokenClaims(token.access_token).organizationId}. Wrote ${file}.`);
-      for (const warning of warnings) io.stderr(`warning: ${warning}`);
-      await skillsFor(io, apiUrl, "claude", values["organization-id"]);
-      return ExitCode.Ok;
-    }
-    case "opencode": {
-      const { values } = parseArgs3({ args: rest, options: { surface: { type: "string" }, "organization-id": { type: "string" }, config: { type: "string" } }, strict: true });
-      const surface = surfaceOf(values.surface, "anthropic");
-      const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
-      const baseUrl = surfaceBaseUrl(apiUrl, surface);
-      let models = [];
-      try {
-        models = await servedModels(apiUrl, token, surface);
-      } catch (error) {
-        io.stderr(`warning: ${error instanceof Error ? error.message : String(error)}; writing the provider without a model list`);
-      }
-      const file = values.config ?? opencodeConfigPath();
-      writeJsonAtomic(file, mergeOpencodeConfig(readJson(file), { baseUrl, surface, models }));
-      io.stdout(`OpenCode provider divergent-${surface} \u2192 ${baseUrl}. Wrote ${file}.`);
-      io.stdout("Keep DIVERGENT_TOKEN fresh for the session (user tokens expire; the login refreshes):");
-      io.stdout(`  export DIVERGENT_TOKEN="$(${["diverge", "token", ...organizationArgs(values["organization-id"])].join(" ")})"`);
-      return ExitCode.Ok;
-    }
-    case "codex": {
-      const { values } = parseArgs3({ args: rest, options: { "project-id": { type: "string" }, "organization-id": { type: "string" }, config: { type: "string" }, print: { type: "boolean", default: false } }, strict: true });
-      const block = codexProviderToml({ openaiBaseUrl: openaiBaseUrl(apiUrl), self: resolveSelfCommand(), projectId: values["project-id"], organizationId: values["organization-id"] });
-      if (values.print) {
-        io.stdout(block.trimEnd());
-        return ExitCode.Ok;
-      }
-      const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
-      const file = values.config ?? codexConfigPath();
-      const existing = fs11.existsSync(file) ? fs11.readFileSync(file, "utf8") : null;
-      writeTextAtomic(file, mergeCodexConfig(existing, block));
-      io.stdout(`Codex provider divergent \u2192 ${openaiBaseUrl(apiUrl)} as you, organization ${tokenClaims(token.access_token).organizationId}. Wrote ${file}.`);
-      io.stdout('Select it per run with: codex -c model_provider=divergent   (or set model_provider = "divergent" in the config)');
-      await skillsFor(io, apiUrl, "codex", values["organization-id"]);
-      return ExitCode.Ok;
-    }
-    case "dsh": {
-      const { values } = parseArgs3({ args: rest, options: { surface: { type: "string" }, model: { type: "string" }, "organization-id": { type: "string" }, into: { type: "string" }, print: { type: "boolean", default: false } }, strict: true });
-      const surface = surfaceOf(values.surface, "openai");
-      const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
-      if (!values.print) await skillsFor(io, apiUrl, "dsh", values["organization-id"]);
-      const { overlay, defaultModel } = await overlayAndDefault(apiUrl, token, surface, io, values.model);
-      if (values.print) {
-        io.stdout(overlay.trimEnd());
-        return ExitCode.Ok;
-      }
-      const file = values.into ?? path14.join(dshHome(io.env), `divergent-${surface}.yml`);
-      writeTextAtomic(file, overlay);
-      io.stdout(`dsh route divergent-${surface} \u2192 ${surfaceBaseUrl(apiUrl, surface)} as you, organization ${tokenClaims(token.access_token).organizationId}, default model ${defaultModel}. Wrote ${file}.`);
-      io.stdout("Platform tools, web search included, are reached from dsh's shell through `diverge tools`; the installed skills say when and how. dsh's DeepSeek search is off.");
-      syncDivergentPreset(io, findOnPath("dsh", io.env), dshHome(io.env));
-      io.stdout("Boot a profile with the overlay and the token in its environment (user tokens expire; the login refreshes):");
-      io.stdout(`  DIVERGENT_TOKEN="$(${["diverge", "token", ...organizationArgs(values["organization-id"])].join(" ")})" dsh --profile headless --patch ${file} "<task>"`);
-      io.stdout(`or let the CLI keep the token fresh for the whole session:  diverge agents run dsh --surface ${surface} -- --profile web --port 3131 --no-open`);
-      return ExitCode.Ok;
-    }
-    default:
-      throw unknownVerb("agents", agentsUsage, ["setup"], agent, rest);
-  }
-}
-async function run(args, io) {
-  const [agent, ...rest] = args;
-  if (agent !== "dsh") throw unknownVerb("agents", agentsUsage, ["run"], agent, rest);
-  const terminator = rest.indexOf("--");
-  const flags = terminator === -1 ? rest : rest.slice(0, terminator);
-  const passthrough = terminator === -1 ? [] : rest.slice(terminator + 1);
-  const { values } = parseArgs3({ args: flags, options: { surface: { type: "string" }, model: { type: "string" }, "organization-id": { type: "string" } }, strict: true });
-  const surface = surfaceOf(values.surface, "openai");
+  const usable = !requested && saved && models.includes(saved.model) ? saved : null;
+  const defaultModel = dshDefaultModel(models, requested ?? usable?.model);
+  if (!requested && saved && !usable) io.stderr(`The model you last chose, ${saved.model}, is no longer served here; using ${defaultModel}.`);
+  return { overlay: dshPatchYaml({ baseUrl: surfaceBaseUrl(apiUrl, surface), surface, models: served, defaultModel, reasoningEffort: usable?.reasoningEffort, launch }), defaultModel };
+}
+async function runDshCommand(args, io) {
+  const terminator = args.indexOf("--");
+  const flags = terminator === -1 ? args : args.slice(0, terminator);
+  const passthrough = terminator === -1 ? [] : args.slice(terminator + 1);
+  const { values } = parseArgs4({ args: flags, options: { surface: { type: "string" }, model: { type: "string" }, "organization-id": { type: "string" } }, strict: true });
+  const surface = surfaceOf2(values.surface);
+  const relaunched = await updateThenRelaunch(io, {
+    version: VERSION,
+    latest: () => latestVersion(void 0, LATEST_TIMEOUT_MS),
+    install: (version) => installLatest(version, io.env, process.platform, ["ignore", 2, 2]),
+    relaunch: () => relaunch(args, io.env)
+  });
+  if (relaunched !== null) return relaunched;
   const apiUrl = resolveApiUrl(void 0, io.env);
   const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
-  const binary = findOnPath("dsh", io.env);
-  if (!binary) throw new CliError("dsh is not on PATH (install: npm install -g @deepseek-ai/dsh)");
+  const dsh = await ensureDsh(io);
+  const prefix = path18.join(dshInstallRoot(io.env), TESTED_DSH_VERSION);
   await skillsFor(io, apiUrl, "dsh", values["organization-id"]);
-  const launch = { id: randomUUID(), client: `dsh/${dshVersionOf(binary) ?? "unknown"}` };
-  const { overlay, defaultModel } = await overlayAndDefault(apiUrl, token, surface, io, values.model, launch);
+  const launch = { id: randomUUID(), client: `dsh/${TESTED_DSH_VERSION}` };
   const home = dshHome(io.env);
-  const settingsPath = path14.join(home, "settings.yaml");
-  let pinned;
-  try {
-    pinned = dshSettingsDefaultModel(fs11.existsSync(settingsPath) ? fs11.readFileSync(settingsPath, "utf8") : null, surface);
-  } catch (error) {
-    throw new CliError(`${settingsPath}: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  const served = servedIds(overlay);
-  if (pinned && !served.includes(pinned)) throw new CliError(stalePinMessage(settingsPath, pinned, surface, served));
-  const overlayPath = path14.join(home, `divergent-${surface}.yml`);
-  writeTextAtomic(overlayPath, overlay);
-  syncDivergentPreset(io, binary, home);
-  io.stderr(`dsh on divergent-${surface} as you (organization ${tokenClaims(token.access_token).organizationId}), default model ${defaultModel}`);
-  if (passthrough.length === 0) io.stderr('Starting the web UI; open the URL dsh prints. For one task without the UI: diverge agents run dsh -- "<task>"');
+  const { overlay, defaultModel } = await overlayAndDefault(io, apiUrl, token, surface, values.model, savedModel(home, surface), launch);
+  const overlayPath = path18.join(home, `divergent-${surface}.yml`);
+  writeTextAtomic(overlayPath, `${overlay}${dshPresetOverrides(prefix)}`);
+  io.stderr(`dsh ${TESTED_DSH_VERSION} on divergent-${surface} as you (organization ${tokenClaims(token.access_token).organizationId}), default model ${defaultModel}`);
+  if (passthrough.length === 0) io.stderr('Starting the web UI; open the URL dsh prints. For one task without the UI: diverge dsh -- "<task>"');
   const source = tokenSource(io.env, apiUrl);
   const organizationId = tokenClaims(token.access_token).organizationId ?? values["organization-id"];
   if (!organizationId) throw new CliError("the gateway token names no organization; pass --organization-id");
   io.stderr(`This session is organization ${organizationId}'s own record at the level its administrators set \u2014 off, metadata (tools, tokens, models; no content) or the whole conversation \u2014 named once its record opens. Yours to read: diverge tools call ${AGENT_SESSION_LIST_TOOL} (ADR 0121).`);
   const tools = new ToolsClient({ apiUrl, organizationId, mode: "operator", clientId: clientId(io.env) }, io.env);
   const publisher = new DshSessionPublisher({
-    sessionsRoot: path14.join(home, "sessions"),
-    cwd: process.cwd(),
+    sessionsRoot: path18.join(home, "sessions"),
     launchedAt: Date.now(),
     launchId: launch.id,
-    harnessVersion: dshVersionOf(binary),
+    harnessVersion: TESTED_DSH_VERSION,
     host: os8.hostname(),
     append: (input) => appendSession(tools, input),
     report: (line) => io.stderr(line),
@@ -10104,12 +10344,12 @@ async function run(args, io) {
   publisher.start();
   try {
     return await runDsh({
-      binary,
+      dsh,
       overlayPath,
-      credentialsPath: path14.join(home, ".credentials.yaml"),
-      sessionTokenPath: path14.join(home, "session-token"),
-      binDir: path14.join(home, "bin"),
-      cli: { command: process.execPath, args: [path14.resolve(process.argv[1])] },
+      credentialsPath: path18.join(home, ".credentials.yaml"),
+      sessionTokenPath: path18.join(home, "session-token"),
+      binDir: path18.join(home, "bin"),
+      cli: { command: process.execPath, args: [path18.resolve(process.argv[1])] },
       args: passthrough,
       env: io.env,
       initialToken: token.access_token,
@@ -10136,56 +10376,9 @@ async function appendSession(tools, input) {
   }
   return { capture: result.capture, sessionId: result.sessionId ?? null, stored: result.stored ?? 0, skipped: result.skipped ?? 0, lastSeq: typeof result.lastSeq === "number" ? result.lastSeq : -1 };
 }
-async function status(args, io) {
-  const { values } = parseArgs3({ args, options: { "organization-id": { type: "string" } }, strict: true });
-  const apiUrl = resolveApiUrl(void 0, io.env);
-  const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
-  const claims = tokenClaims(token.access_token);
-  io.stdout(`Gateway: ${apiUrl}/api/plugins/inference/{anthropic,openai}`);
-  io.stdout(`Organization: ${claims.organizationId}`);
-  io.stdout(`Scopes: ${(claims.scopes ?? []).join(" ")}`);
-  for (const surface of SURFACES) {
-    const models = (await servedModels(apiUrl, token, surface)).map((model) => model.id);
-    io.stdout(`Models (${surface}): ${models.length ? models.join(", ") : "(none served on this surface)"}`);
-  }
-  return ExitCode.Ok;
-}
-async function rotate(args, io) {
-  const { values } = parseArgs3({ args, options: { into: { type: "string" }, interval: { type: "string", default: "600" }, once: { type: "boolean", default: false }, "organization-id": { type: "string" } }, strict: true });
-  const interval = Number(values.interval);
-  if (!Number.isFinite(interval) || interval <= 0) throw new CliError("--interval must be a positive number of seconds");
-  const apiUrl = resolveApiUrl(void 0, io.env);
-  const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
-  const source = tokenSource(io.env, apiUrl);
-  const tokenFilePath = values.into ?? defaultTokenFilePath();
-  io.stderr(`Keeping ${tokenFilePath} fresh as you (organization ${tokenClaims(token.access_token).organizationId})`);
-  return rotateTokenFile({
-    tokenFile: tokenFilePath,
-    intervalSeconds: interval,
-    once: values.once,
-    freshToken: async () => (await getUserToken(source, { freshForSeconds: Math.max(interval, 60) + 60, organizationId: values["organization-id"] })).access_token,
-    report: (line) => io.stderr(line),
-    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
-  });
-}
-async function runAgents(args, io) {
-  const [verb, ...rest] = args;
-  switch (verb) {
-    case "setup":
-      return setup(rest, io);
-    case "run":
-      return run(rest, io);
-    case "rotate":
-      return rotate(rest, io);
-    case "status":
-      return status(rest, io);
-    default:
-      throw unknownVerb("agents", agentsUsage, [], verb, rest);
-  }
-}
 
 // src/commands/org.ts
-import { parseArgs as parseArgs4 } from "node:util";
+import { parseArgs as parseArgs5 } from "node:util";
 var orgUsage = `diverge org [use <id|name>]
 
   (no verb)      list the organizations you may act in, the default marked
@@ -10198,7 +10391,7 @@ there, which proves you may act in it. For one command, pass
 act in, and so sees, every organization.`;
 async function runOrg(args, io) {
   refuseInSession(io.env, "org");
-  const { positionals } = parseArgs4({ args, options: {}, strict: true, allowPositionals: true });
+  const { positionals } = parseArgs5({ args, options: {}, strict: true, allowPositionals: true });
   const verb = positionals[0];
   if (verb && verb !== "use") throw unknownVerb("org", orgUsage, [], verb, positionals.slice(1));
   const source = tokenSource(io.env, resolveApiUrl(void 0, io.env));
@@ -10245,7 +10438,7 @@ async function runLogout(_args, io) {
 }
 
 // src/commands/status.ts
-import path15 from "node:path";
+import path19 from "node:path";
 var statusUsage = "diverge status\n\nShow the deployment, the cached login (or the session token), whose account it is, what it carries, and who a tool call would run as. One request: the account behind the login.";
 async function runStatus(_args, io) {
   const apiUrl = resolveApiUrl(void 0, io.env);
@@ -10261,7 +10454,7 @@ async function runStatus(_args, io) {
     io.stdout(describeToolExecution(io.env));
     return 0;
   }
-  io.stdout(`State: ${path15.dirname(source.loginFile)}`);
+  io.stdout(`State: ${path19.dirname(source.loginFile)}`);
   const record = loadLogin(source);
   if (!record) {
     io.stdout(`Not logged in. Run: diverge login${apiUrl === DEFAULT_API_URL ? "" : ` --api-url ${apiUrl}`}`);
@@ -10309,7 +10502,7 @@ function describeSignIn(record, nowMs = Date.now()) {
 }
 
 // src/commands/token.ts
-import { parseArgs as parseArgs5 } from "node:util";
+import { parseArgs as parseArgs6 } from "node:util";
 var tokenUsage = `diverge token [--organization-id <id>]
 
 Print a fresh access token and nothing else: the credential helper for Claude
@@ -10318,7 +10511,7 @@ Code, Codex and forge. The token is for the organization named by
 DIVERGENT_TOKEN_FILE set, it prints the session token in that file, and an
 organization other than the token's is refused.`;
 async function runToken(args, io) {
-  const { values } = parseArgs5({ args, options: { "organization-id": { type: "string" } }, strict: true, allowPositionals: false });
+  const { values } = parseArgs6({ args, options: { "organization-id": { type: "string" } }, strict: true, allowPositionals: false });
   const organizationId = values["organization-id"]?.trim() || io.env.DIVERGENT_ORG_ID?.trim() || void 0;
   const token = await getUserToken(tokenSource(io.env, resolveApiUrl(void 0, io.env)), { organizationId });
   io.stdout(token.access_token);
@@ -10326,7 +10519,7 @@ async function runToken(args, io) {
 }
 
 // src/commands/tools.ts
-import { parseArgs as parseArgs6 } from "node:util";
+import { parseArgs as parseArgs7 } from "node:util";
 
 // src/mcp/bridge.ts
 import readline2 from "node:readline";
@@ -10553,7 +10746,7 @@ async function waitForInvocation(id, options, deps) {
 }
 
 // src/tools/call-args.ts
-import fs12 from "node:fs";
+import fs16 from "node:fs";
 async function resolveCallArgs(options, stdin = readStdin) {
   if (options.argsJson !== void 0 && options.argsJson !== "{}" && options.argsFile !== void 0) {
     throw new CliError("give the arguments once: --args-json or --args-file");
@@ -10563,7 +10756,7 @@ async function resolveCallArgs(options, stdin = readStdin) {
   if (options.argsFile !== void 0) {
     source = `--args-file ${options.argsFile}`;
     try {
-      text2 = fs12.readFileSync(options.argsFile, "utf8");
+      text2 = fs16.readFileSync(options.argsFile, "utf8");
     } catch (error) {
       throw new CliError(`${source}: ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -10655,7 +10848,7 @@ function worstExitCode(outcomes) {
 }
 
 // src/commands/tools.ts
-import fs13 from "node:fs";
+import fs17 from "node:fs";
 
 // src/tools/print.ts
 function matchesCapability(selector, capability) {
@@ -10780,7 +10973,7 @@ async function call(rest, io) {
   let waited = "";
   let outcome;
   try {
-    const { values, positionals } = parseArgs6({ args: rest, options: CALL_OPTIONS, strict: true, allowPositionals: true });
+    const { values, positionals } = parseArgs7({ args: rest, options: CALL_OPTIONS, strict: true, allowPositionals: true });
     tool = positionals[0] ?? "";
     if (!tool) throw new CliError("call needs a tool name");
     const args = await resolveCallArgs({ argsJson: values["args-json"], argsFile: values["args-file"] });
@@ -10807,12 +11000,12 @@ async function set(rest, io) {
   let waited = "";
   let outcome;
   try {
-    const { values, positionals } = parseArgs6({ args: rest, options: SET_OPTIONS, strict: true, allowPositionals: true });
+    const { values, positionals } = parseArgs7({ args: rest, options: SET_OPTIONS, strict: true, allowPositionals: true });
     const file = positionals[0];
     if (!file) throw new CliError("set needs a file of calls, or - for stdin");
     let entries;
     try {
-      entries = parseBatch(file === "-" ? await readStdin() : fs13.readFileSync(file, "utf8"));
+      entries = parseBatch(file === "-" ? await readStdin() : fs17.readFileSync(file, "utf8"));
     } catch (error) {
       throw new CliError(`${file}: ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -10856,7 +11049,7 @@ async function runTools(args, io) {
   const [verb, ...rest] = args;
   switch (verb) {
     case "list": {
-      const { values } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, filter: { type: "string" }, capability: { type: "string" }, json: { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS, filter: { type: "string" }, capability: { type: "string" }, json: { type: "boolean", default: false } }, strict: true });
       const { client: tools } = await client(values, io);
       let list = await tools.listTools();
       if (values.filter) list = list.filter((tool) => matchesFilter(values.filter, tool));
@@ -10866,7 +11059,7 @@ async function runTools(args, io) {
       return ExitCode.Ok;
     }
     case "capabilities": {
-      const { values } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true });
       const { client: tools } = await client(values, io);
       const list = await tools.listTools();
       if (values.json) io.stdout(JSON.stringify(capabilityClusters(list), null, 2));
@@ -10874,7 +11067,7 @@ async function runTools(args, io) {
       return ExitCode.Ok;
     }
     case "describe": {
-      const { values, positionals } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
+      const { values, positionals } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
       const name = positionals[0];
       if (!name) throw new CliError("describe needs a tool name");
       const { settings, client: tools } = await client(values, io);
@@ -10894,12 +11087,12 @@ async function runTools(args, io) {
     case "set":
       return set(rest, io);
     case "run": {
-      const { values, positionals } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" } }, strict: true, allowPositionals: true });
+      const { values, positionals } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" } }, strict: true, allowPositionals: true });
       const file = positionals[0];
       if (!file) throw new CliError("run needs a file of calls, or - for stdin");
       let entries;
       try {
-        entries = parseBatch(file === "-" ? await readStdin() : fs13.readFileSync(file, "utf8"));
+        entries = parseBatch(file === "-" ? await readStdin() : fs17.readFileSync(file, "utf8"));
       } catch (error) {
         throw new CliError(`${file}: ${error instanceof Error ? error.message : String(error)}`);
       }
@@ -10914,7 +11107,7 @@ async function runTools(args, io) {
       return exitCode;
     }
     case "invocation": {
-      const { values, positionals } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" }, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
+      const { values, positionals } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" }, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
       const id = positionals[0];
       if (!id) throw new CliError("invocation needs an id");
       const { client: tools } = await client(values, io);
@@ -10932,7 +11125,7 @@ async function runTools(args, io) {
       return worstExitCode([outcome]);
     }
     case "bridge": {
-      const { values } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, tools: { type: "string" } }, strict: true });
+      const { values } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS, tools: { type: "string" } }, strict: true });
       const { client: tools } = await client(values, io);
       const allow = (values.tools ?? "").split(",").map((name) => name.trim()).filter(Boolean);
       return serveBridge(new BridgeServer(tools, { tools: allow }), process.stdin, process.stdout);
@@ -10943,26 +11136,30 @@ async function runTools(args, io) {
 }
 
 // src/commands/plugins.ts
-import fs14 from "node:fs";
-import { parseArgs as parseArgs7 } from "node:util";
+import fs18 from "node:fs";
+import { parseArgs as parseArgs8 } from "node:util";
 var pluginsUsage = `diverge plugins <validate|publish|list|retire> [--organization-id <id>] ...
 
-  validate <manifest.json>            (dry run: the platform's full validation, nothing stored)
-  publish  <manifest.json> [--json]   (forge_plugins:create in the signed-in organization;
-                                       a version that changes authority waits on a decision)
+  validate <manifest.json> [--json]   (forge_validate_plugin: the platform's full check, nothing stored;
+                                       says whether publishing needs a person's decision)
+  publish  <manifest.json> [--json]   (forge_publish_plugin: raised as you, decided in Compass;
+                                       exits 3 while it waits)
   list     [--json]
-  retire   <pluginId>
+  retire   <pluginId> [--json]        (forge_retire_plugin: raised as you, decided in Compass;
+                                       exits 3 while it waits)
 
 Register a tenant plugin: a plugin whose code runs in your organization's own
 runtime and never inside the platform. The manifest lists the tools the
 platform registers, pinned; a change is a new version published again.
 
-A version that only reshapes or removes the tools already served is stored at
-once. Anything else changes authority: publish raises it as
-forge_publish_plugin, prints the invocation, and exits 3; a person decides it
-in Compass, and diverge tools invocation <id> reads the outcome. Enable
-it with forge plugins (or forge_set_plugin_state) and bind the runtime with a
-Forge bridge binding whose runtimeType matches the manifest's runtime.type.`;
+Every write is a tool invocation decided by your organization's policy: publish
+and retire print the invocation and its Compass link and exit 3 while they
+wait; a person decides there, and diverge tools invocation <id> reads the
+outcome. A version that only reshapes tools already served is what the deploy
+pipeline stores unattended with forge_reshape_plugin; validate says which a
+version needs. Enable the plugin with forge_set_plugin_state and bind the
+runtime with a Forge bridge binding whose runtimeType matches the manifest's
+runtime.type.`;
 var SCOPE_OPTIONS2 = { "organization-id": { type: "string" } };
 async function client2(values, io) {
   const settings = loadToolsSettings({ organizationId: values["organization-id"] }, io.env);
@@ -10975,29 +11172,24 @@ function printProblems(details, io) {
   for (const detail of details) io.stderr(`  - ${detail}`);
   return ExitCode.Failure;
 }
-async function raisePublish(manifest, authorityChanges, context, io) {
+async function raise(entry, context, io) {
   const { settings, tools, json } = context;
-  if (!json) {
-    io.stdout("This version changes authority, so it is stored only once it is decided:");
-    for (const change of authorityChanges) io.stdout(`  - ${change}`);
-  }
-  const outcome = await runOne({ tool: "forge_publish_plugin", args: { manifest } }, {
+  const outcome = await runOne(entry, {
     callTool: (name, args) => tools.callTool(name, args),
     decideAt: (pending) => `${settings.apiUrl}${pending.approvalUrl ?? ""}`,
     ...json ? {} : { onPending: (pending) => formatPending(pending, settings.apiUrl, settings.organizationId).forEach((line) => io.stdout(line)) }
   });
-  if (json) io.stdout(JSON.stringify({ authorityChanges, ...outcome }, null, 2));
-  else if (outcome.status === "executed") io.stdout("Published.");
-  else if (outcome.status === "failed") throw new CliError(`forge_publish_plugin failed: ${outcome.error}`);
-  return worstExitCode([outcome]);
+  if (json) io.stdout(JSON.stringify(outcome, null, 2));
+  else if (outcome.status === "failed") throw new CliError(`${entry.tool} failed: ${outcome.error}`);
+  return outcome;
 }
-function readManifest(file) {
+function readManifest2(file) {
   if (!file) throw new CliError(`A manifest file is required.
 
 ${pluginsUsage}`);
   let text2;
   try {
-    text2 = fs14.readFileSync(file, "utf8");
+    text2 = fs18.readFileSync(file, "utf8");
   } catch (error) {
     throw new CliError(`Cannot read ${file}: ${error instanceof Error ? error.message : String(error)}`);
   }
@@ -11024,42 +11216,44 @@ async function runPlugins(args, io) {
   const [verb, ...rest] = args;
   switch (verb) {
     case "validate": {
-      const { values, positionals } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
-      const manifest = readManifest(positionals[0]);
+      const { values, positionals } = parseArgs8({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
+      const manifest = readManifest2(positionals[0]);
       const { tools } = await client2(values, io);
-      const outcome = await tools.publishPlugin(manifest, { dryRun: true });
-      if (!outcome.ok) return printProblems(outcome.details, io);
-      if (values.json) io.stdout(JSON.stringify(outcome.result, null, 2));
+      const body = await tools.callTool("forge_validate_plugin", { manifest });
+      if (body.success === false) throw new CliError(`forge_validate_plugin failed: ${body.error ?? "unknown error"}`);
+      const result = body.result;
+      if (!result.valid) {
+        if (values.json) io.stdout(JSON.stringify(result, null, 2));
+        return printProblems(result.problems, io);
+      }
+      if (values.json) io.stdout(JSON.stringify(result, null, 2));
       else {
-        io.stdout(`Valid. ${outcome.result.changed ? "Publishing would register" : "Already published at this digest:"}`);
-        for (const line of formatPlugin(outcome.result.plugin)) io.stdout(line);
-        const authority = outcome.result.authorityChanges ?? [];
-        if (authority.length) {
-          io.stdout("Publishing it changes authority, so it waits on a person's decision in Compass:");
-          for (const change of authority) io.stdout(`  - ${change}`);
+        io.stdout(`Valid. ${result.changed ? "Publishing would register" : "Already published at this digest:"}`);
+        for (const line of formatPlugin(result.plugin)) io.stdout(line);
+        if (result.authorityChanges.length) {
+          io.stdout("Publishing it changes authority, so forge_publish_plugin stores it once a person decides in Compass:");
+          for (const change of result.authorityChanges) io.stdout(`  - ${change}`);
+        } else if (result.changed) {
+          io.stdout("It keeps the serving version's authority: forge_reshape_plugin stores it without a decision.");
         }
       }
       return ExitCode.Ok;
     }
     case "publish": {
-      const { values, positionals } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
-      const manifest = readManifest(positionals[0]);
+      const { values, positionals } = parseArgs8({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
+      const manifest = readManifest2(positionals[0]);
       const { settings, tools } = await client2(values, io);
-      const outcome = await tools.publishPlugin(manifest, { dryRun: false });
-      if (!outcome.ok && outcome.authorityChange) {
-        return raisePublish(manifest, outcome.details, { settings, tools, json: values.json }, io);
-      }
-      if (!outcome.ok) return printProblems(outcome.details, io);
-      if (values.json) io.stdout(JSON.stringify(outcome.result, null, 2));
-      else {
-        io.stdout(outcome.result.changed ? "Published." : "Unchanged: this digest was already published.");
-        for (const line of formatPlugin(outcome.result.plugin)) io.stdout(line);
-        io.stdout("Enable it for the organization with forge plugins (or forge_set_plugin_state); the tools run through the bridge binding of the manifest's runtime.type.");
+      const outcome = await raise({ tool: "forge_publish_plugin", args: { manifest } }, { settings, tools, json: values.json }, io);
+      if (!values.json && outcome.status === "executed") {
+        const result = outcome.result;
+        io.stdout(result.changed ? "Published." : "Unchanged: this digest was already published.");
+        for (const line of formatPlugin(result.plugin)) io.stdout(line);
+        io.stdout("Enable it for the organization with forge_set_plugin_state; the tools run through the bridge binding of the manifest's runtime.type.");
       }
-      return ExitCode.Ok;
+      return worstExitCode([outcome]);
     }
     case "list": {
-      const { values } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs8({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, strict: true });
       const { tools } = await client2(values, io);
       const plugins = await tools.listPlugins();
       if (values.json) io.stdout(JSON.stringify(plugins, null, 2));
@@ -11068,138 +11262,24 @@ async function runPlugins(args, io) {
       return ExitCode.Ok;
     }
     case "retire": {
-      const { values, positionals } = parseArgs7({ args: rest, options: SCOPE_OPTIONS2, allowPositionals: true, strict: true });
+      const { values, positionals } = parseArgs8({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
       const pluginId = positionals[0];
       if (!pluginId) throw new CliError(`A plugin id is required.
 
 ${pluginsUsage}`);
-      const { tools } = await client2(values, io);
-      const plugin = await tools.retirePlugin(pluginId);
-      io.stdout(`Retired ${plugin.pluginId}@${plugin.version}; its ${plugin.toolNames.length} tool(s) are gone. Installation records stay for a re-publish.`);
-      return ExitCode.Ok;
+      const { settings, tools } = await client2(values, io);
+      const outcome = await raise({ tool: "forge_retire_plugin", args: { pluginId } }, { settings, tools, json: values.json }, io);
+      if (!values.json && outcome.status === "executed") {
+        const { plugin } = outcome.result;
+        io.stdout(`Retired ${plugin.pluginId}@${plugin.version}; its ${plugin.toolNames.length} tool(s) are gone. Installation records stay for a re-publish.`);
+      }
+      return worstExitCode([outcome]);
     }
     default:
       throw unknownVerb("plugins", pluginsUsage, [], verb, rest);
   }
 }
 
-// src/commands/update.ts
-import { spawn as spawn4 } from "node:child_process";
-import path17 from "node:path";
-
-// src/update-notice.ts
-import { spawn as spawn3 } from "node:child_process";
-import fs15 from "node:fs";
-import path16 from "node:path";
-var UPDATE_CHECK_FILE = "update-check.json";
-var UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-function updateCheckFile(env) {
-  return path16.join(configDir(env), UPDATE_CHECK_FILE);
-}
-function readUpdateCheck(env) {
-  try {
-    const parsed = JSON.parse(fs15.readFileSync(updateCheckFile(env), "utf8"));
-    if (parsed && typeof parsed === "object" && typeof parsed.checkedAt === "number" && typeof parsed.latest === "string") return parsed;
-  } catch {
-  }
-  return null;
-}
-function writeUpdateCheck(env, check) {
-  writeJsonAtomic(updateCheckFile(env), check);
-}
-function noticeFor(check, version = VERSION) {
-  if (!check || !isNewer(check.latest, version)) return null;
-  return `diverge ${check.latest} is available (this is ${version}). Update with: diverge update   (or run npx @divergeai/cli@latest)`;
-}
-function noticeApplies(argv, io, version = VERSION) {
-  if (version === "dev" || !io.interactive) return false;
-  if (io.env.DIVERGE_NO_UPDATE_CHECK?.trim() || io.env.CI?.trim() || sessionTokenFile(io.env)) return false;
-  if (argv[0] === "update") return false;
-  if (argv[0] === "tools" && argv[1] === "bridge") return false;
-  return true;
-}
-function scheduleUpdateCheck(spawnImpl = spawn3) {
-  try {
-    const child = spawnImpl(process.execPath, [process.argv[1], "update", "--record"], { detached: true, stdio: "ignore" });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-function updateNotice(argv, io, deps = { now: Date.now, schedule: scheduleUpdateCheck, read: readUpdateCheck, version: VERSION }) {
-  if (!noticeApplies(argv, io, deps.version)) return;
-  const check = deps.read(io.env);
-  const notice = noticeFor(check, deps.version);
-  if (notice) io.stderr(notice);
-  if (!check || deps.now() - check.checkedAt > UPDATE_CHECK_INTERVAL_MS) deps.schedule();
-}
-
-// src/commands/update.ts
-var PACKAGE_NAME = "@divergeai/cli";
-var updateUsage = "diverge update\n\nInstall the latest release with the npm that installed this one.";
-async function latestVersion(registry = "https://registry.npmjs.org") {
-  const body = await fetchJson(`${registry}/${PACKAGE_NAME}/latest`);
-  if (!body.version) throw new CliError("The registry answered without a version");
-  return body.version;
-}
-function isNewer(a, b) {
-  const parse = (v) => {
-    const [core, pre] = v.split("-", 2);
-    return { nums: core.split(".").map((n) => Number(n) || 0), pre: pre ?? "" };
-  };
-  const x = parse(a);
-  const y = parse(b);
-  for (let i = 0; i < 3; i += 1) {
-    const dx = x.nums[i] ?? 0;
-    const dy = y.nums[i] ?? 0;
-    if (dx !== dy) return dx > dy;
-  }
-  if (x.pre === y.pre) return false;
-  if (!x.pre) return true;
-  if (!y.pre) return false;
-  return x.pre > y.pre;
-}
-async function runUpdate(args, io, deps = { latestVersion, install: installLatest, record: writeUpdateCheck, now: Date.now }) {
-  refuseInSession(io.env, "update");
-  if (args[0] === "--record") {
-    try {
-      deps.record(io.env, { checkedAt: deps.now(), latest: await deps.latestVersion() });
-    } catch {
-    }
-    return ExitCode.Ok;
-  }
-  if (VERSION === "dev") throw new CliError("This is a source checkout, not an installed release; pull the repository instead.");
-  const latest = await deps.latestVersion();
-  if (!isNewer(latest, VERSION)) {
-    io.stdout(`diverge ${VERSION} is up to date.`);
-    return ExitCode.Ok;
-  }
-  io.stdout(`Updating diverge ${VERSION} \u2192 ${latest}\u2026`);
-  const code2 = await deps.install(latest);
-  if (code2 !== 0) throw new CliError(`npm install exited with ${code2}`);
-  io.stdout(`diverge ${latest} installed.`);
-  return ExitCode.Ok;
-}
-function installLatest(version, env = process.env, platform = process.platform) {
-  let command = "npm";
-  const args = ["install", "-g", `${PACKAGE_NAME}@${version}`];
-  if (platform === "win32") {
-    const npm = findOnPath("npm", env, platform);
-    if (!npm) throw new CliError("npm was not found on PATH; install Node.js with npm and try again.");
-    command = npm;
-    if (/\.(cmd|bat)$/i.test(npm)) {
-      command = process.execPath;
-      args.unshift(path17.join(path17.dirname(npm), "node_modules", "npm", "bin", "npm-cli.js"));
-    }
-  }
-  return new Promise((resolve, reject) => {
-    const child = spawn4(command, args, { env, stdio: "inherit" });
-    child.on("error", reject);
-    child.on("exit", (code2) => resolve(code2 ?? 1));
-  });
-}
-
 // src/cli.ts
 var COMMANDS = [
   { name: "login", summary: "Sign in (authenticate) through the browser", usage: loginUsage, run: runLogin },
@@ -11207,7 +11287,8 @@ var COMMANDS = [
   { name: "status", summary: "Show who you are signed in as: the deployment, the account and what the login carries", usage: statusUsage, run: runStatus },
   { name: "org", summary: "Show or switch the organization the login acts in", usage: orgUsage, run: runOrg },
   { name: "token", summary: "Print a fresh access token", usage: tokenUsage, run: runToken },
-  { name: "agents", summary: "Point a coding agent at the model gateway (setup, run, status)", usage: agentsUsage, run: runAgents },
+  { name: "dsh", summary: "Start DeepSeek Harness on the model gateway, up to date, with your skills", usage: dshUsage, run: (args, io) => runDshCommand(args, io) },
+  { name: "agents", summary: "Point a coding agent at the model gateway (setup, status)", usage: agentsUsage, run: runAgents },
   { name: "tools", summary: "Discover and execute platform tools; raise and read approvals", usage: toolsUsage, run: runTools },
   { name: "plugins", summary: "Validate, publish, list and retire tenant plugins for your organization", usage: pluginsUsage, run: runPlugins },
   { name: "skills", summary: "Install the skills of every organization you can act in into Claude Code, Codex and dsh", usage: skillsUsage, run: runSkills },
@@ -11228,7 +11309,7 @@ function usage() {
     "Environment: DIVERGENT_API_URL (deployment; production when unset), DIVERGE_HOME (state directory, default ~/.diverge), DIVERGENT_ORG_ID and DIVERGENT_PROJECT_ID (the organization and project a command acts in), DIVERGENT_TOKEN_FILE (a file holding the token this session runs on, in place of any login)."
   ].join("\n");
 }
-async function run2(argv, io) {
+async function run(argv, io) {
   const [name, ...rest] = argv;
   if (!name || name === "--help" || name === "-h" || name === "help") {
     io.stdout(usage());
@@ -11248,9 +11329,9 @@ ${usage()}`);
   }
   const own = rest.includes("--") ? rest.slice(0, rest.indexOf("--")) : rest;
   if (own.includes("--help") || own.includes("-h")) {
-    const path18 = verbPath(command.usage, own);
-    if (path18.length > 0 || own[0].startsWith("-")) {
-      io.stdout(verbUsage(command.name, command.usage, path18));
+    const path20 = verbPath(command.usage, own);
+    if (path20.length > 0 || own[0].startsWith("-")) {
+      io.stdout(verbUsage(command.name, command.usage, path20));
       return ExitCode.Ok;
     }
   }
@@ -11278,7 +11359,7 @@ ${verbUsage(command.name, command.usage, verbPath(command.usage, rest))}`);
 }
 
 // src/index.ts
-var code = await run2(process.argv.slice(2), {
+var code = await run(process.argv.slice(2), {
   stdout: (line) => process.stdout.write(`${line}
 `),
   stderr: (line) => process.stderr.write(`${line}