@kitman-sh/cli 0.7.4 → 0.8.0

package/dist/index.js

@@ -1,11 +1,6 @@
 #!/usr/bin/env bun
 // @bun
 import {
-  identity,
-  isUndefined,
-  isNotUndefined,
-  isNotNull,
-  isNullish,
   toJsonValue,
   isOneOf,
   toJsonObject,
@@ -14,34 +9,19 @@ import {
   isObject,
   isJsonObject,
   isString2,
-  match,
   getOrElse,
-  fromUndefinedOr,
   getOrUndefined,
-  Service,
   Reference,
-  of,
-  toMillis,
   TaggedError,
   squash,
-  Done,
-  done,
-  UnknownError,
-  succeed2,
-  fail2,
-  makeUnsafe,
+  make5,
   _await,
-  isDone,
-  isDoneUnsafe,
-  doneUnsafe,
-  addFinalizer,
-  succeed4,
-  effect,
-  mergeAll,
+  fail3,
   provide2,
   provideMerge,
-  catchDone,
-  findFirst,
+  min,
+  exponential,
+  spaced,
   forEach,
   promise,
   tryPromise,
@@ -50,7 +30,6 @@ import {
   sync,
   void_2,
   undefined_,
-  callback,
   gen,
   fail4,
   try_,
@@ -61,102 +40,88 @@ import {
   as,
   asVoid,
   catch_,
+  catchTag,
   catchIf,
   mapError,
+  tapError,
   tapCause,
+  retry,
   ignore,
   orElseSucceed,
+  timeoutOrElse,
   sleep,
   raceFirst,
   filterOrFail,
   context,
   provide3,
   provideContext,
+  service,
   provideService,
+  scope,
   scoped,
   acquireRelease,
-  addFinalizer2,
   ensuring,
-  uninterruptible,
-  forever,
+  onError,
+  forkIn,
   forkScoped,
-  fnUntraced,
   logWarning,
   logError,
   runMain,
-  systemError,
-  badArgument,
-  makeUnsafe3,
-  make8,
-  make9,
-  offerUnsafe,
-  endUnsafe,
   take,
-  poll,
-  fromTransform,
-  mapDone,
-  isSink,
-  fromChannel,
-  drain,
-  make10,
-  get2,
-  isStream,
-  fromChannel2,
-  empty2,
-  unwrap,
-  merge2,
-  transduce,
+  tap2,
+  mapError2,
   decodeText,
   run,
   mkString,
   FileSystem,
   Path,
   encode,
-  ExitCode,
-  ProcessId,
-  makeHandle,
-  make12,
   ChildProcessSpawner,
-  make13,
-  parseFdName,
-  fdName,
-  handleErrnoException,
+  make8,
   Crypto,
+  Stdio,
+  is,
+  decodeUnknownEffect,
+  String2,
+  Struct,
+  ArraySchema,
+  isPattern,
+  Terminal,
   layer,
-  layer2,
-  layer3,
-  tag,
-  Error2,
   error,
   log,
   guard,
   toIso,
   currentDate,
-  ProposalStatuses,
-  ProposalTargetTypes,
+  redactDurableSurface,
+  AgentHarnessIds,
+  RepoBindingProviders,
+  RepoBindingCredentialProviderTypes,
   ContextPackModes,
   DefaultContextPackMode,
+  ProposalStatuses,
+  ProposalTargetTypes,
+  RunDisplayStates,
+  defaultRunnerCapabilities,
+  isSyncKitHashValid,
+  isSyncKitSafe,
+  resolveSyncKit,
+  KitKinds,
+  KitInstallationScopes,
+  KitCreate,
+  KitUpdate,
   MemoryStatuses,
   MemoryScopes,
   MaxMemoryListLimit,
-  RepoBindingProviders,
-  RepoBindingCredentialProviderTypes,
-  AgentHarnessIds,
-  redactDurableSurface,
-  RunStatuses,
-  KitmanAgentCapabilityNames,
   DecisionStatuses,
   FixFlowRecoveryActions,
-  createId,
-  KitKinds,
-  KitInstallationScopes,
-  KitCreate,
-  KitUpdate,
+  KitmanAgentCapabilityNames,
+  isRunFileRefusalReason,
+  runFileRefusalWords,
   repositoryKey,
-  defaultRunnerCapabilities,
-  isSyncKitHashValid,
-  isSyncKitSafe,
-  resolveSyncKit,
+  createId,
+  digestSha256,
+  sha256Hasher,
   decodeJsonString,
   decodeJsonStringOption,
   encodeJsonStringSync,
@@ -164,6 +129,17 @@ import {
   encodeUnknownJsonStringSync,
   option2,
   String3,
+  raw,
+  make9,
+  get2,
+  put,
+  HttpClient,
+  execute,
+  Fetch,
+  layer2,
+  runDisplayLabels,
+  KitmanClientError,
+  KitmanEffectClient,
   CliError,
   DefaultApiUrl,
   resolveConfig,
@@ -182,15 +158,12 @@ import {
   removeAllSessions,
   agentCredentialForApi,
   storeAgentCredential,
-  raw,
-  make14,
-  get3,
-  put,
-  execute,
-  Fetch,
-  layer4,
-  KitmanEffectClient,
-  digestSha256,
+  removeAgentCredential,
+  normalizeApiUrl,
+  isStoredAgentCredential,
+  RpcClientError,
+  RunnerHeaders,
+  RunnerRpcError,
   parseCallbackUrl,
   revokeToken,
   toStoredSession,
@@ -201,941 +174,286 @@ import {
   refreshSession,
   createAgentAuthBearerToken,
   createAgentAuthSignedFetch,
-  RunnerHeaders,
   setupMcpAgentCredential,
   generateAgentKeyPair,
+  CommandFailed2,
   runCommand2,
   detectHarnesses2,
   herdrRunnerCapabilities2
-} from "./chunk-jd09xfx0.js";
-
-// node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeChildProcessSpawner.js
-import * as NodeChildProcess from "child_process";
-import { PassThrough } from "stream";
-
-// node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/internal/nodeChildProcessSpawner.js
-var buildSpawnOptions = (options, base, platform) => {
-  const detached = options.detached ?? platform !== "win32";
-  return {
-    ...base,
-    detached,
-    shell: options.shell,
-    windowsHide: options.windowsHide ?? !detached
-  };
-};
-
-// node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeSink.js
-var fromWritable = (options) => fromChannel(mapDone(fromWritableChannel(options), (_) => [_]));
-var fromWritableChannel = (options) => fromTransform((pull) => {
-  const writable = options.evaluate();
-  return succeed5(pullIntoWritable({
-    ...options,
-    writable,
-    pull
-  }));
-});
-var pullIntoWritable = (options) => options.pull.pipe(flatMap2((chunk) => {
-  let i = 0;
-  return callback((resume) => {
-    let cancelled = false;
-    const loop = () => {
-      for (;i < chunk.length; ) {
-        if (cancelled) {
-          return;
-        }
-        const success = options.writable.write(chunk[i++], options.encoding);
-        if (!success) {
-          if (!cancelled) {
-            options.writable.once("drain", loop);
-          }
-          return;
-        }
-      }
-      if (!cancelled) {
-        resume(void_2);
-      }
-    };
-    loop();
-    return sync(() => {
-      cancelled = true;
-      options.writable.off("drain", loop);
-    });
-  });
-}), forever({
-  disableYield: true
-}), options.endOnDone !== false ? catchDone((_) => {
-  if ("closed" in options.writable && options.writable.closed) {
-    return done(_);
-  }
-  return callback((resume) => {
-    const onFinish = () => resume(done(_));
-    options.writable.once("finish", onFinish);
-    options.writable.end();
-    return sync(() => {
-      options.writable.off("finish", onFinish);
-    });
-  });
-}) : identity, raceFirst(callback((resume) => {
-  const onError = (error) => resume(fail4(options.onError(error)));
-  options.writable.once("error", onError);
-  return sync(() => {
-    options.writable.off("error", onError);
+} from "./chunk-fpyy4rpd.js";
+// apps/cli/src/herdr-runner-credential.ts
+function herdrRunnerCredentialName(runnerId) {
+  return `herdr-runner:${runnerId}`;
+}
+function storedHerdrRunnerCredential(apiUrl, runnerId) {
+  return map3(readAuthStore(), (auth) => agentCredentialForApi(auth, apiUrl, herdrRunnerCredentialName(runnerId)));
+}
+function writeRunnerCredentialFile(path, file) {
+  return gen(function* () {
+    const fs = yield* FileSystem;
+    yield* fs.makeDirectory((yield* Path).dirname(path), { recursive: true, mode: 448 });
+    yield* fs.writeFileString(path, `${encodeJsonStringSync(file)}
+`, { mode: 384 });
+    yield* fs.chmod(path, 384);
   });
-})));
-
-// node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeStream.js
-var fromReadable = (options) => fromChannel2(fromReadableChannel(options));
-var fromReadableChannel = (options) => fromTransform((_, scope) => readableToPullUnsafe({
-  scope,
-  readable: options.evaluate(),
-  onError: options.onError ?? defaultOnError,
-  chunkSize: options.chunkSize,
-  closeOnDone: options.closeOnDone
-}));
-var readableToPullUnsafe = (options) => {
-  const readable = options.readable;
-  const closeOnDone = options.closeOnDone ?? true;
-  const exit = options.exit ?? make8(undefined);
-  const latch = options.latch ?? makeUnsafe3(false);
-  function onReadable() {
-    latch.openUnsafe();
-  }
-  function onError(error) {
-    exit.current = fail2(options.onError(error));
-    latch.openUnsafe();
-  }
-  function onEnd() {
-    exit.current = fail2(Done());
-    latch.openUnsafe();
-  }
-  readable.on("readable", onReadable);
-  readable.once("error", onError);
-  readable.once("end", onEnd);
-  const pull = suspend(function loop() {
-    let item = options.readable.read(options.chunkSize);
-    if (item === null) {
-      if (exit.current) {
-        return exit.current;
-      }
-      if (readable.readableEnded) {
-        return fail4(Done());
-      }
-      latch.closeUnsafe();
-      return flatMap2(latch.await, loop);
-    }
-    const chunk = of(item);
-    while (true) {
-      item = options.readable.read(options.chunkSize);
-      if (item === null)
-        break;
-      chunk.push(item);
-    }
-    return succeed5(chunk);
+}
+function readRunnerCredentialFile(path) {
+  return gen(function* () {
+    const text = yield* flatMap2(FileSystem, (fs) => fs.readFileString(path));
+    const file = yield* decodeJsonString(text);
+    if (!isJsonObject(file) || !isStoredAgentCredential(file) || !isString2(file.apiUrl) || !isString2(file.runnerId) || file.hostId === undefined)
+      return yield* new CliError({ message: `${path} holds no Runner credential; pair again with --credential-file` });
+    return { apiUrl: file.apiUrl, runnerId: file.runnerId, credential: file };
   });
-  return as(addFinalizer(options.scope, sync(() => {
-    readable.off("readable", onReadable);
-    readable.off("error", onError);
-    readable.off("end", onEnd);
-    if (closeOnDone && "closed" in options.readable && !options.readable.closed) {
-      options.readable.destroy();
-    }
-  })), pull);
-};
-var defaultOnError = (error) => new UnknownError(error);
-
-// node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeChildProcessSpawner.js
-var toError = (error) => error instanceof globalThis.Error ? error : new globalThis.Error(String(error));
-var toPlatformError = (method, error, command) => {
-  const {
-    commands
-  } = flattenCommand(command);
-  const commandStr = commands.reduce((acc, curr) => {
-    const cmd = `${curr.command} ${curr.args.join(" ")}`;
-    return acc.length === 0 ? cmd : `${acc} | ${cmd}`;
-  }, "");
-  return handleErrnoException("ChildProcess", method)(error, [commandStr]);
-};
-var processGroupGraceMillis = 1000;
-var processGroupPollIntervalMillis = 10;
-var handleInputErrors = (writable) => {
-  const onError = () => {};
-  writable.on("error", onError);
-  writable.once("close", () => writable.off("error", onError));
-};
-var isProcessAlive = (childProcess, exitSignal) => {
-  if (!isDoneUnsafe(exitSignal)) {
-    return true;
-  }
-  if (globalThis.process.platform === "win32") {
-    return false;
-  }
-  try {
-    globalThis.process.kill(-childProcess.pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-};
-var taskkill = (childProcess, onExit = () => {}) => {
-  if (childProcess.exitCode !== null || childProcess.signalCode !== null) {
-    onExit(null);
-    return;
-  }
-  NodeChildProcess.execFile("taskkill", ["/pid", String(childProcess.pid), "/T", "/F"], {
-    windowsHide: true
-  }, onExit);
-};
-var make = /* @__PURE__ */ gen(function* () {
-  const fs = yield* FileSystem;
-  const path = yield* Path;
-  const resolveWorkingDirectory = fnUntraced(function* (options) {
-    if (isUndefined(options.cwd))
-      return;
-    yield* fs.access(options.cwd);
-    return path.resolve(options.cwd);
+}
+function herdrRunnerCredentialCheck(apiUrl, runnerId) {
+  return gen(function* () {
+    const credential = yield* storedHerdrRunnerCredential(apiUrl, runnerId);
+    if (credential === undefined)
+      return "missing";
+    const { client } = yield* createHerdrRunnerClient({ apiUrl, runnerId, credential });
+    return yield* client.heartbeatRunner(runnerId, {}).pipe(as("accepted"), catchIf((error) => error.status === 401 || error.status === 403, () => succeed5("refused")));
   });
-  const resolveEnvironment = (options) => {
-    return options.extendEnv ? {
-      ...globalThis.process.env,
-      ...options.env
-    } : options.env;
-  };
-  const inputToStdioOption = (input) => isStream(input) ? "pipe" : input;
-  const outputToStdioOption = (input) => isSink(input) ? "pipe" : input;
-  const resolveStdinOption = (options) => {
-    const defaultConfig = {
-      stream: "pipe",
-      encoding: "utf-8",
-      endOnDone: true
-    };
-    if (isUndefined(options.stdin)) {
-      return defaultConfig;
-    }
-    if (typeof options.stdin === "string") {
-      return {
-        ...defaultConfig,
-        stream: options.stdin
-      };
-    }
-    if (isStream(options.stdin)) {
-      return {
-        ...defaultConfig,
-        stream: options.stdin
-      };
-    }
-    return {
-      stream: options.stdin.stream,
-      encoding: options.stdin.encoding ?? defaultConfig.encoding,
-      endOnDone: options.stdin.endOnDone ?? defaultConfig.endOnDone
-    };
-  };
-  const resolveOutputOption = (options, streamName) => {
-    const option = options[streamName];
-    if (isUndefined(option)) {
-      return {
-        stream: "pipe"
-      };
-    }
-    if (typeof option === "string") {
-      return {
-        stream: option
-      };
-    }
-    if (isSink(option)) {
-      return {
-        stream: option
-      };
-    }
-    return {
-      stream: option.stream
-    };
-  };
-  const resolveAdditionalFds = (options) => {
-    if (isUndefined(options.additionalFds)) {
-      return [];
-    }
-    const result = [];
-    for (const [name, config] of Object.entries(options.additionalFds)) {
-      const fd = parseFdName(name);
-      if (isNotUndefined(fd)) {
-        result.push({
-          fd,
-          config
-        });
-      }
-    }
-    return result.sort((a, b) => a.fd - b.fd);
-  };
-  const buildStdioArray = (stdinConfig, stdoutConfig, stderrConfig, additionalFds) => {
-    const stdio = [inputToStdioOption(stdinConfig.stream), outputToStdioOption(stdoutConfig.stream), outputToStdioOption(stderrConfig.stream)];
-    if (additionalFds.length === 0) {
-      return stdio;
-    }
-    const maxFd = additionalFds.reduce((max, {
-      fd
-    }) => Math.max(max, fd), 2);
-    for (let i = 3;i <= maxFd; i++) {
-      stdio[i] = "ignore";
-    }
-    for (const {
-      fd
-    } of additionalFds) {
-      stdio[fd] = "pipe";
-    }
-    return stdio;
-  };
-  const setupAdditionalFds = fnUntraced(function* (command, childProcess, additionalFds) {
-    if (additionalFds.length === 0) {
-      return {
-        getInputFd: () => drain,
-        getOutputFd: () => empty2
-      };
-    }
-    const inputSinks = new Map;
-    const outputStreams = new Map;
-    for (const {
-      config,
-      fd
-    } of additionalFds) {
-      const nodeStream = childProcess.stdio[fd];
-      switch (config.type) {
-        case "input": {
-          let sink = drain;
-          if (nodeStream && "write" in nodeStream) {
-            handleInputErrors(nodeStream);
-            sink = fromWritable({
-              evaluate: () => nodeStream,
-              onError: (error) => toPlatformError(`fromWritable(fd${fd})`, toError(error), command)
-            });
-          }
-          if (config.stream) {
-            yield* forkScoped(run(config.stream, sink));
-          }
-          inputSinks.set(fd, sink);
-          break;
-        }
-        case "output": {
-          let stream = empty2;
-          if (nodeStream && "read" in nodeStream) {
-            const passThrough = new PassThrough;
-            nodeStream.on("error", (error) => passThrough.destroy(error));
-            nodeStream.pipe(passThrough);
-            stream = fromReadable({
-              evaluate: () => passThrough,
-              onError: (error) => toPlatformError(`fromReadable(fd${fd})`, toError(error), command)
-            });
-          }
-          if (config.sink) {
-            stream = transduce(stream, config.sink);
-          }
-          outputStreams.set(fd, stream);
-          break;
-        }
-      }
-    }
-    return {
-      getInputFd: (fd) => inputSinks.get(fd) ?? drain,
-      getOutputFd: (fd) => outputStreams.get(fd) ?? empty2
+}
+function provisionHerdrRunnerCredential(input) {
+  return gen(function* () {
+    const keyPair = yield* generateAgentKeyPair;
+    const client = yield* createSdkClient({
+      apiUrl: input.apiUrl,
+      session: { accessToken: input.accessToken },
+      ...input.fetch === undefined ? undefined : { fetch: input.fetch }
+    });
+    const provisioned = yield* client.provisionRunnerCredential(input.runner.id, {
+      publicKey: keyPair.publicKeyJwk
+    }).pipe(mapError(() => new CliError({ message: "herdr_runner_credential_unavailable" })));
+    if (provisioned.credentialHostId === undefined)
+      return yield* new CliError({ message: "herdr_runner_credential_unavailable" });
+    const credential = {
+      agentId: provisioned.agentIdentityId,
+      hostId: provisioned.credentialHostId,
+      privateKeyJwk: keyPair.privateKeyJwk,
+      publicKeyJwk: keyPair.publicKeyJwk
     };
+    yield* storeAgentCredential(input.apiUrl, herdrRunnerCredentialName(input.runner.id), credential, input.authPath);
+    return credential;
   });
-  const setupChildStdin = (command, childProcess, config) => suspend(() => {
-    let sink = drain;
-    if (isNotNull(childProcess.stdin)) {
-      handleInputErrors(childProcess.stdin);
-      sink = fromWritable({
-        evaluate: () => childProcess.stdin,
-        onError: (error) => toPlatformError("fromWritable(stdin)", toError(error), command),
-        endOnDone: config.endOnDone,
-        encoding: config.encoding
-      });
-    }
-    if (isStream(config.stream)) {
-      return as(forkScoped(run(config.stream, sink)), sink);
-    }
-    return succeed5(sink);
-  });
-  const setupChildOutputStreams = (command, childProcess, stdoutConfig, stderrConfig) => {
-    let stdout = childProcess.stdout ? (() => {
-      const passThrough = new PassThrough;
-      childProcess.stdout.on("error", (error) => passThrough.destroy(error));
-      childProcess.stdout.pipe(passThrough);
-      return fromReadable({
-        evaluate: () => passThrough,
-        onError: (error) => toPlatformError("fromReadable(stdout)", toError(error), command)
-      });
-    })() : empty2;
-    let stderr = childProcess.stderr ? (() => {
-      const passThrough = new PassThrough;
-      childProcess.stderr.on("error", (error) => passThrough.destroy(error));
-      childProcess.stderr.pipe(passThrough);
-      return fromReadable({
-        evaluate: () => passThrough,
-        onError: (error) => toPlatformError("fromReadable(stderr)", toError(error), command)
-      });
-    })() : empty2;
-    if (isSink(stdoutConfig.stream)) {
-      stdout = transduce(stdout, stdoutConfig.stream);
-    }
-    if (isSink(stderrConfig.stream)) {
-      stderr = transduce(stderr, stderrConfig.stream);
-    }
-    const all = merge2(stdout, stderr);
-    return {
-      stdout,
-      stderr,
-      all
-    };
-  };
-  const spawn2 = (command, spawnOptions) => callback((resume) => {
-    const deferred = makeUnsafe();
-    const handle = NodeChildProcess.spawn(command.command, command.args, spawnOptions);
-    handle.on("error", (error) => {
-      resume(fail4(toPlatformError("spawn", error, command)));
-    });
-    handle.on("exit", (...args) => {
-      doneUnsafe(deferred, succeed2(args));
-    });
-    handle.on("spawn", () => {
-      resume(succeed5([handle, deferred]));
+}
+function createHerdrRunnerClient(input) {
+  return gen(function* () {
+    const credential = input.credential;
+    const signedFetch = createAgentAuthSignedFetch({
+      apiUrl: input.apiUrl,
+      credential,
+      fetch: input.fetch ?? (yield* Fetch)
     });
-    return sync(() => {
-      handle.kill("SIGTERM");
+    const runnerFetch = (requestInput, init) => {
+      const request = new Request(requestInput, init);
+      request.headers.set(RunnerHeaders.runnerId, input.runnerId);
+      return signedFetch(request);
+    };
+    const client = yield* createSdkClient({
+      apiUrl: input.apiUrl,
+      fetch: runnerFetch,
+      session: { accessToken: "runner-agent-auth" }
     });
-  });
-  const killProcessGroup = (command, childProcess, signal) => {
-    if (globalThis.process.platform === "win32") {
-      return callback((resume) => {
-        taskkill(childProcess, (error) => {
-          if (error) {
-            resume(fail4(toPlatformError("kill", toError(error), command)));
-          } else {
-            resume(void_2);
-          }
-        });
-      });
-    }
-    return try_({
-      try: () => {
-        globalThis.process.kill(-childProcess.pid, signal);
-      },
-      catch: (error) => toPlatformError("kill", toError(error), command)
+    const rpcBearer = createAgentAuthBearerToken({
+      credential,
+      audience: new URL("/v1/runners/rpc", input.apiUrl).toString(),
+      capabilities: ["kitman_api"]
     });
-  };
-  const killProcessGroupOnExit = (childProcess, signal) => {
-    if (globalThis.process.platform === "win32") {
-      taskkill(childProcess);
-      return;
-    }
-    try {
-      globalThis.process.kill(-childProcess.pid, signal);
-    } catch {}
-  };
-  const killProcess = (command, childProcess, signal) => suspend(() => {
-    const killed = childProcess.kill(signal);
-    if (!killed) {
-      const error = new globalThis.Error("Failed to kill child process");
-      return fail4(toPlatformError("kill", error, command));
-    }
-    return void_2;
-  });
-  const awaitProcessExit = (childProcess, exitSignal, timeoutMillis) => callback((resume) => {
-    const deadline = Date.now() + timeoutMillis;
-    let timer;
-    const stop = () => {
-      clearTimeout(timer);
-      childProcess.removeListener("exit", poll);
-    };
-    const poll = () => {
-      clearTimeout(timer);
-      if (Date.now() >= deadline || !isProcessAlive(childProcess, exitSignal)) {
-        stop();
-        resume(void_2);
-        return;
-      }
-      timer = setTimeout(poll, processGroupPollIntervalMillis);
-    };
-    childProcess.on("exit", poll);
-    poll();
-    return sync(stop);
-  });
-  const terminateProcessGroup = fnUntraced(function* (command, childProcess, exitSignal, options) {
-    const signalGroup = (signal) => killProcessGroup(command, childProcess, signal).pipe(catch_(() => killProcess(command, childProcess, signal)));
-    yield* signalGroup(options?.killSignal ?? "SIGTERM");
-    if (isUndefined(options?.forceKillAfter)) {
-      yield* awaitProcessExit(childProcess, exitSignal, processGroupGraceMillis);
-    } else {
-      yield* awaitProcessExit(childProcess, exitSignal, toMillis(options.forceKillAfter));
-      if (isProcessAlive(childProcess, exitSignal)) {
-        yield* signalGroup("SIGKILL");
-        yield* awaitProcessExit(childProcess, exitSignal, processGroupGraceMillis);
-      }
-    }
-    yield* _await(exitSignal);
-  });
-  const getSourceStream = (handle, from) => {
-    const fromOption = from ?? "stdout";
-    switch (fromOption) {
-      case "stdout":
-        return handle.stdout;
-      case "stderr":
-        return handle.stderr;
-      case "all":
-        return handle.all;
-      default: {
-        const fd = parseFdName(fromOption);
-        if (isNotUndefined(fd)) {
-          return handle.getOutputFd(fd);
-        }
-        return handle.stdout;
-      }
-    }
-  };
-  const spawnCommand = fnUntraced(function* (cmd) {
-    switch (cmd._tag) {
-      case "StandardCommand": {
-        const stdinConfig = resolveStdinOption(cmd.options);
-        const stdoutConfig = resolveOutputOption(cmd.options, "stdout");
-        const stderrConfig = resolveOutputOption(cmd.options, "stderr");
-        const resolvedAdditionalFds = resolveAdditionalFds(cmd.options);
-        let isReferenced = true;
-        const cwd = yield* resolveWorkingDirectory(cmd.options);
-        const env = resolveEnvironment(cmd.options);
-        const stdio = buildStdioArray(stdinConfig, stdoutConfig, stderrConfig, resolvedAdditionalFds);
-        const [childProcess, exitSignal] = yield* acquireRelease(spawn2(cmd, buildSpawnOptions(cmd.options, {
-          cwd,
-          env,
-          stdio
-        }, process.platform)), fnUntraced(function* ([childProcess, exitSignal]) {
-          const exited = yield* isDone(exitSignal);
-          if (exited) {
-            const [code] = yield* _await(exitSignal);
-            if (code !== 0 && isNotNull(code)) {
-              yield* ignore(terminateProcessGroup(cmd, childProcess, exitSignal, cmd.options));
-            } else if (isReferenced && process.platform !== "win32" && cmd.options.detached !== false) {
-              yield* ignore(terminateProcessGroup(cmd, childProcess, exitSignal, cmd.options));
-            }
-            return;
-          }
-          if (!isReferenced) {
-            return;
-          }
-          yield* ignore(terminateProcessGroup(cmd, childProcess, exitSignal, cmd.options));
-        }));
-        const pid = ProcessId(childProcess.pid);
-        childProcess.on("exit", (code) => {
-          if (code !== 0 && isNotNull(code)) {
-            killProcessGroupOnExit(childProcess, cmd.options.killSignal ?? "SIGTERM");
-          }
-        });
-        const reref = sync(() => {
-          if (!isReferenced) {
-            childProcess.ref();
-            isReferenced = true;
-          }
-        });
-        const unref = sync(() => {
-          if (isReferenced) {
-            childProcess.unref();
-            isReferenced = false;
-          }
-          return reref;
-        });
-        const stdin = yield* setupChildStdin(cmd, childProcess, stdinConfig);
-        const {
-          all,
-          stderr,
-          stdout
-        } = setupChildOutputStreams(cmd, childProcess, stdoutConfig, stderrConfig);
-        const {
-          getInputFd,
-          getOutputFd
-        } = yield* setupAdditionalFds(cmd, childProcess, resolvedAdditionalFds);
-        const isRunning = map3(isDone(exitSignal), (done) => !done);
-        const exitCode = flatMap2(_await(exitSignal), ([code, signal]) => {
-          if (isNotNull(code)) {
-            return succeed5(ExitCode(code));
-          }
-          const error = new globalThis.Error(`Process interrupted due to receipt of signal: '${signal}'`);
-          return fail4(toPlatformError("exitCode", error, cmd));
-        });
-        const kill = (options) => terminateProcessGroup(cmd, childProcess, exitSignal, options);
-        return makeHandle({
-          pid,
-          exitCode,
-          isRunning,
-          kill,
-          stdin,
-          stdout,
-          stderr,
-          all,
-          getInputFd,
-          getOutputFd,
-          unref
-        });
-      }
-      case "PipedCommand": {
-        const {
-          commands,
-          pipeOptions
-        } = flattenCommand(cmd);
-        const [root, ...pipeline] = commands;
-        const handles = [yield* spawnCommand(root)];
-        for (let i = 0;i < pipeline.length; i++) {
-          const command = pipeline[i];
-          const options = pipeOptions[i] ?? {};
-          const stdinConfig = resolveStdinOption(command.options);
-          const sourceStream = unwrap(succeed5(getSourceStream(handles[handles.length - 1], options.from)));
-          const toOption = options.to ?? "stdin";
-          if (toOption === "stdin") {
-            handles.push(yield* spawnCommand(make13(command.command, command.args, {
-              ...command.options,
-              stdin: {
-                ...stdinConfig,
-                stream: sourceStream
-              }
-            })));
-          } else {
-            const fd = parseFdName(toOption);
-            if (isNotUndefined(fd)) {
-              const fdName2 = fdName(fd);
-              const existingFds = command.options.additionalFds ?? {};
-              handles.push(yield* spawnCommand(make13(command.command, command.args, {
-                ...command.options,
-                additionalFds: {
-                  ...existingFds,
-                  [fdName2]: {
-                    type: "input",
-                    stream: sourceStream
-                  }
-                }
-              })));
-            } else {
-              handles.push(yield* spawnCommand(make13(command.command, command.args, {
-                ...command.options,
-                stdin: {
-                  ...stdinConfig,
-                  stream: sourceStream
-                }
-              })));
-            }
-          }
-        }
-        const handle = handles[handles.length - 1];
-        const kill = (options) => forEach([...handles].reverse(), (handle) => ignore(handle.kill(options)), {
-          discard: true
-        });
-        const unref = gen(function* () {
-          const rerefs = [];
-          for (const handle of handles) {
-            rerefs.push(yield* handle.unref);
-          }
-          return forEach([...rerefs].reverse(), (reref) => reref, {
-            discard: true
-          });
-        });
-        return makeHandle({
-          pid: handle.pid,
-          exitCode: handle.exitCode,
-          isRunning: handle.isRunning,
-          kill,
-          stdin: handles[0].stdin,
-          stdout: handle.stdout,
-          stderr: handle.stderr,
-          all: handle.all,
-          getInputFd: handle.getInputFd,
-          getOutputFd: handle.getOutputFd,
-          unref
-        });
-      }
-    }
+    return { client, rpcBearer };
   });
-  return make12(spawnCommand);
+}
+
+// apps/cli/src/kitman-version.ts
+var kitmanVersion = undefined;
+
+// apps/cli/src/runner-startup.ts
+class RunnerStopped extends TaggedError("RunnerStopped") {
+}
+var pairFix = "Run `kitman pair` on this machine. Not signed in there? Mint a Pairing Code on the Runners page and run the command it shows.";
+var credentialMissing = (runnerId) => ({
+  code: "credential_missing",
+  message: `This machine holds no credential for Runner ${runnerId}.`,
+  fix: pairFix
 });
-var layer5 = /* @__PURE__ */ effect(ChildProcessSpawner, make);
-var flattenCommand = (command) => {
-  const commands = [];
-  const pipeOptions = [];
-  const flatten = (cmd) => {
-    switch (cmd._tag) {
-      case "StandardCommand": {
-        commands.push(cmd);
-        break;
-      }
-      case "PipedCommand": {
-        flatten(cmd.left);
-        pipeOptions.push(cmd.options);
-        flatten(cmd.right);
-        break;
-      }
-    }
-  };
-  flatten(command);
-  if (commands.length === 0) {
-    throw new Error("flattenCommand produced empty commands array");
-  }
-  const [first, ...rest] = commands;
-  const nonEmptyCommands = [first, ...rest];
-  return {
-    commands: nonEmptyCommands,
-    pipeOptions
-  };
+var credentialRefused = {
+  code: "credential_refused",
+  message: "Kitman refused this Runner's credential.",
+  fix: pairFix
 };
-
-// node_modules/.bun/effect@4.0.4/node_modules/effect/dist/Stdio.js
-var TypeId = "~effect/Stdio";
-var Stdio = /* @__PURE__ */ Service(TypeId);
-var make2 = (options) => ({
-  [TypeId]: TypeId,
-  stdinIsTerminal: succeed5(false),
-  stdoutIsTerminal: succeed5(false),
-  stderrIsTerminal: succeed5(false),
-  ...options
+var runnerRemoved = {
+  code: "runner_removed",
+  message: "This Runner no longer exists in Kitman.",
+  fix: "Run `kitman pair` to set it up again, or `kitman runner remove` to clean up this machine."
+};
+var sandboxInstall = {
+  srt: process.platform === "darwin" ? "Install what it needs with `brew install ripgrep`" : "Install what it needs with `sudo apt install bubblewrap socat ripgrep` (or your distribution\u2019s packages)",
+  docker: "Install and start Docker (https://docs.docker.com/engine/install/), and set KITMAN_RUNNER_DOCKER_IMAGE to an image pinned by digest"
+};
+var sandboxMissing = (sandbox, missing) => ({
+  code: "sandbox_missing",
+  message: `\`${sandbox}\` is not available on this host: ${missing.join("; ")}.`.slice(0, 500),
+  fix: `${sandboxInstall[sandbox]}, or unset KITMAN_RUNNER_SANDBOX to run agents on the host.`
 });
+var stopOnRefusal = (call) => mapError(call, (error) => {
+  if (!(error instanceof KitmanClientError) && !is(RunnerRpcError)(error))
+    return error;
+  if (error.status === 401 || error.status === 403)
+    return new RunnerStopped({ problem: credentialRefused });
+  return error.status === 404 ? new RunnerStopped({ problem: runnerRemoved }) : error;
+});
+var stopWhenRefused = (replica) => mapError(replica, (error) => error.kind === "unauthorized" ? new RunnerStopped({ problem: credentialRefused }) : error);
+var unreachable = (error) => error instanceof KitmanClientError && (error.status === undefined || error.status >= 500) || is(RunnerRpcError)(error) && error.status >= 500 || is(RpcClientError)(error);
+var backoff = min([exponential("1 second"), spaced("1 minute")]);
 
-// node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeStdio.js
-var layer6 = /* @__PURE__ */ succeed4(Stdio, /* @__PURE__ */ make2({
-  args: /* @__PURE__ */ sync(() => process.argv.slice(2)),
-  stdinIsTerminal: /* @__PURE__ */ sync(() => process.stdin.isTTY === true),
-  stdoutIsTerminal: /* @__PURE__ */ sync(() => process.stdout.isTTY === true),
-  stderrIsTerminal: /* @__PURE__ */ sync(() => process.stderr.isTTY === true),
-  stdout: (options) => fromWritable({
-    evaluate: () => process.stdout,
-    onError: (cause) => systemError({
-      module: "Stdio",
-      method: "stdout",
-      _tag: "Unknown",
-      cause
-    }),
-    endOnDone: options?.endOnDone ?? false
-  }),
-  stderr: (options) => fromWritable({
-    evaluate: () => process.stderr,
-    onError: (cause) => systemError({
-      module: "Stdio",
-      method: "stderr",
-      _tag: "Unknown",
-      cause
-    }),
-    endOnDone: options?.endOnDone ?? false
-  }),
-  stdin: /* @__PURE__ */ fromReadable({
-    evaluate: () => process.stdin,
-    onError: (cause) => systemError({
-      module: "Stdio",
-      method: "stdin",
-      _tag: "Unknown",
-      cause
-    }),
-    closeOnDone: false
-  })
+class StepTimedOut extends TaggedError("StepTimedOut") {
+}
+var startupStep = (step, bound, attempt) => attempt.pipe(timeoutOrElse({ duration: bound, orElse: () => fail4(new StepTimedOut) }), tapError((error2) => unreachable(error2) ? error(`Runner start: ${step} failed, trying again: ${error2.message}`) : void_2), retry({ schedule: backoff, while: unreachable }), mapError((error) => {
+  if (error instanceof RunnerStopped)
+    return error;
+  if (error instanceof StepTimedOut)
+    return new CliError({ message: `Runner start: ${step} did not finish within ${bound}` });
+  return new CliError({
+    message: `Runner start: ${step} failed: ${error instanceof Error ? error.message : String(error)}`
+  });
 }));
 
-// node_modules/.bun/@effect+platform-bun@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-bun/dist/BunStdio.js
-var layer7 = layer6;
-
-// node_modules/.bun/effect@4.0.4/node_modules/effect/dist/Terminal.js
-var TypeId2 = "~effect/Terminal";
-var QuitErrorTypeId = "~effect/Terminal/QuitError";
-
-class QuitError extends (/* @__PURE__ */ Error2("QuitError")({
-  _tag: /* @__PURE__ */ tag("QuitError")
-})) {
-  [QuitErrorTypeId] = QuitErrorTypeId;
-}
-var Terminal = /* @__PURE__ */ Service("effect/Terminal");
-var make3 = (impl) => Terminal.of({
-  ...impl,
-  [TypeId2]: TypeId2
+// apps/cli/src/managed-install.ts
+var RunnerReleaseManifest = Struct({
+  version: String2.check(isPattern(/^[\w.+-]+$/u)),
+  platforms: ArraySchema(Struct({ os: String2, architecture: String2, sha256: String2, url: String2 }))
 });
-
-// node_modules/.bun/@effect+platform-node-shared@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-node-shared/dist/NodeTerminal.js
-import * as readline from "readline";
-var make4 = /* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit) {
-  const stdin = process.stdin;
-  const stdout = process.stdout;
-  const lines = yield* make9();
-  let inputEnded = stdin.readableEnded;
-  let readlineActive = false;
-  const onStdinEnd = () => {
-    inputEnded = true;
-    if (!readlineActive) {
-      endUnsafe(lines);
-    }
-  };
-  stdin.once("end", onStdinEnd);
-  yield* addFinalizer2(() => sync(() => stdin.off("end", onStdinEnd)));
-  const rlRef = yield* make10({
-    acquire: acquireRelease(sync(() => {
-      const rl = readline.createInterface({
-        input: stdin,
-        escapeCodeTimeout: 50
-      });
-      const onLine = (line) => offerUnsafe(lines, line);
-      const onClose = () => {
-        readlineActive = false;
-        endUnsafe(lines);
-      };
-      readlineActive = true;
-      readline.emitKeypressEvents(stdin, rl);
-      rl.on("line", onLine);
-      rl.once("close", onClose);
-      if (stdin.isTTY) {
-        stdin.setRawMode(true);
-      }
-      return {
-        rl,
-        onClose,
-        onLine
-      };
-    }), ({
-      rl,
-      onClose,
-      onLine
-    }) => sync(() => {
-      readlineActive = false;
-      rl.off("line", onLine);
-      rl.off("close", onClose);
-      if (stdin.isTTY) {
-        stdin.setRawMode(false);
-      }
-      rl.close();
-      if (inputEnded) {
-        endUnsafe(lines);
-      }
-    })),
-    idleTimeToLive: "10 millis"
-  });
-  const columns = sync(() => stdout.columns ?? 0);
-  const rows = sync(() => stdout.rows ?? 0);
-  const readInput = gen(function* () {
-    const queue = yield* make9();
-    const handleKeypress = (s, k) => {
-      const userInput = {
-        input: fromUndefinedOr(s),
-        key: {
-          name: k.name ?? "",
-          ctrl: !!k.ctrl,
-          meta: !!k.meta,
-          shift: !!k.shift
-        }
-      };
-      offerUnsafe(queue, userInput);
-      if (shouldQuit(userInput)) {
-        endUnsafe(queue);
-      }
-    };
-    const keepAlive = setInterval(() => {}, 2147483647);
-    const handleEnd = () => {
-      clearInterval(keepAlive);
-      endUnsafe(queue);
-    };
-    yield* addFinalizer2(() => sync(() => {
-      clearInterval(keepAlive);
-      stdin.off("keypress", handleKeypress);
-      stdin.off("end", handleEnd);
-    }));
-    stdin.on("keypress", handleKeypress);
-    if (inputEnded) {
-      handleEnd();
-    } else {
-      yield* get2(rlRef);
-      stdin.once("end", handleEnd);
-    }
-    return queue;
-  });
-  const readLine = suspend(() => poll(lines).pipe(flatMap2(match({
-    onNone: () => scoped(andThen(get2(rlRef), take(lines))),
-    onSome: succeed5
-  })), mapError(() => new QuitError({}))));
-  const display = (prompt2) => uninterruptible(callback((resume) => {
-    stdout.write(prompt2, (err) => isNullish(err) ? resume(void_2) : resume(fail4(badArgument({
-      module: "Terminal",
-      method: "display",
-      description: "Failed to write prompt to stdout",
-      cause: err
-    }))));
+var versionsDirectory = (platform) => gen(function* () {
+  const path = yield* Path;
+  const home = yield* String3("HOME");
+  const xdgData = getOrUndefined(yield* option2(String3("XDG_DATA_HOME")));
+  const data = platform === "darwin" ? path.join(home, "Library", "Application Support") : xdgData ?? path.join(home, ".local", "share");
+  return path.join(data, "kitman", "versions");
+});
+var managedKitmanPath = gen(function* () {
+  const path = yield* Path;
+  return path.join(yield* String3("HOME"), ".local", "bin", "kitman");
+});
+var installedKitmanVersion = gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  return yield* fs.readLink(yield* managedKitmanPath).pipe(map3((target) => path.basename(path.dirname(target))), orElseSucceed(() => {
+    return;
   }));
-  return make3({
-    columns,
-    rows,
-    readInput,
-    readLine,
-    display
+});
+var runningManagedInstall = (platform) => gen(function* () {
+  if (process.argv[1]?.startsWith("/$bunfs/") !== true)
+    return false;
+  const fs = yield* FileSystem;
+  const versions = yield* versionsDirectory(platform);
+  const executable = yield* fs.realPath(process.execPath).pipe(orElseSucceed(() => process.execPath));
+  return executable.startsWith(`${versions}/`);
+});
+var downloadManagedKitman = (apiUrl, platform) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const fetch = yield* Fetch;
+  const get = (url) => tryPromise({
+    try: () => fetch(url),
+    catch: (error) => new CliError({ message: `Fetching ${url} failed: ${String(error)}` })
   });
+  const answer = yield* get(new URL("/v1/runner-release", apiUrl).toString());
+  if (answer.status === 404)
+    return;
+  if (!answer.ok)
+    return yield* new CliError({ message: `${apiUrl} answered ${answer.status} for its kitman release` });
+  const manifest = yield* tryPromise(() => answer.json()).pipe(flatMap2(decodeUnknownEffect(RunnerReleaseManifest)), mapError(() => new CliError({ message: `${apiUrl} served a kitman release this kitman cannot read` })));
+  const os = platform === "darwin" ? "darwin" : "linux";
+  const architecture = process.arch === "x64" ? "amd64" : process.arch;
+  const release = manifest.platforms.find((entry) => entry.os === os && entry.architecture === architecture && entry.sha256 !== "");
+  if (release === undefined)
+    return yield* new CliError({ message: `${apiUrl} serves no kitman for ${os}/${architecture}` });
+  const versions = yield* versionsDirectory(platform);
+  const kitman = path.join(versions, manifest.version, "kitman");
+  const installed = !(yield* fs.exists(kitman));
+  if (installed) {
+    const binary = yield* get(release.url).pipe(filterOrFail((downloaded) => downloaded.ok, (downloaded) => new CliError({ message: `Downloading kitman ${manifest.version} answered ${downloaded.status}` })), flatMap2((downloaded) => tryPromise({
+      try: () => downloaded.arrayBuffer(),
+      catch: (error) => new CliError({ message: `Downloading kitman ${manifest.version} failed: ${String(error)}` })
+    })), map3((bytes) => new Uint8Array(bytes)));
+    if (digestSha256(binary, "hex") !== release.sha256)
+      return yield* new CliError({
+        message: `The downloaded kitman ${manifest.version} for ${os}/${architecture} does not match its sha256; nothing was installed`
+      });
+    const download = path.join(versions, `.kitman-${manifest.version}.download`);
+    yield* fs.makeDirectory(path.dirname(kitman), { recursive: true });
+    yield* fs.writeFile(download, binary, { mode: 493 });
+    yield* fs.rename(download, kitman);
+  }
+  return { version: manifest.version, kitman, installed };
+});
+var linkManagedKitman = (kitman) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const link = yield* managedKitmanPath;
+  const nextLink = `${link}.next`;
+  yield* fs.makeDirectory(path.dirname(link), { recursive: true });
+  yield* ignore(fs.remove(nextLink));
+  yield* fs.symlink(kitman, nextLink);
+  yield* fs.rename(nextLink, link);
 });
-var layer8 = /* @__PURE__ */ effect(Terminal, /* @__PURE__ */ make4(defaultShouldQuit));
-function defaultShouldQuit(input) {
-  const key = input.key;
-  return key.name === "escape" || key.ctrl && (key.name === "c" || key.name === "d");
+var installManagedKitman = (apiUrl, platform) => gen(function* () {
+  const downloaded = yield* downloadManagedKitman(apiUrl, platform);
+  if (downloaded === undefined)
+    return;
+  yield* linkManagedKitman(downloaded.kitman);
+  return { version: downloaded.version, installed: downloaded.installed };
+});
+
+// apps/cli/src/runner-update.ts
+class RunnerUpdated extends TaggedError("RunnerUpdated") {
+  get message() {
+    return `Updated to kitman ${this.version}; exiting so the Runner service restarts on it`;
+  }
 }
 
-// node_modules/.bun/@effect+platform-bun@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-bun/dist/BunTerminal.js
-var layer9 = layer8;
-
-// node_modules/.bun/@effect+platform-bun@4.0.4+b8cbb99ebc524863/node_modules/@effect/platform-bun/dist/BunServices.js
-var layer10 = /* @__PURE__ */ layer5.pipe(/* @__PURE__ */ provideMerge(/* @__PURE__ */ mergeAll(layer2, layer, layer3, layer7, layer9)));
-// apps/cli/src/herdr-runner-credential.ts
-function herdrRunnerCredentialName(runnerId) {
-  return `herdr-runner:${runnerId}`;
-}
-function ensureHerdrRunnerCredential(input) {
-  return gen(function* () {
-    const hostId = input.runner.credentialHostId;
-    if (hostId === undefined)
-      return yield* new CliError({ message: "herdr_runner_credential_unavailable" });
-    const credentialName = herdrRunnerCredentialName(input.runner.id);
-    const auth = yield* readAuthStore(input.authPath);
-    const existing = agentCredentialForApi(auth, input.apiUrl, credentialName);
-    const credential = existing ?? (yield* newCredential(input.runner.agentIdentityId, hostId));
-    if (credential.agentId !== input.runner.agentIdentityId || credential.hostId !== hostId)
-      return yield* new CliError({ message: "herdr_runner_credential_mismatch" });
-    if (existing === undefined)
-      yield* storeAgentCredential(input.apiUrl, credentialName, credential, input.authPath);
-    const client = yield* createSdkClient({
-      apiUrl: input.apiUrl,
-      session: { accessToken: input.accessToken },
-      ...input.fetch === undefined ? undefined : { fetch: input.fetch }
-    });
-    yield* client.provisionRunnerCredential(input.runner.id, {
-      publicKey: credential.publicKeyJwk
-    }).pipe(mapError(() => new CliError({ message: "herdr_runner_credential_unavailable" })));
-    return credential;
+class UpdateStepFailed extends TaggedError("UpdateStepFailed") {
+}
+var step = (name) => (effect) => mapError(effect, (error) => new UpdateStepFailed({ step: name, reason: error.message }));
+var runnerUpdater = (input) => {
+  let claiming = true;
+  let updating = false;
+  let problems = [];
+  const failed = new Set;
+  const attempt = gen(function* () {
+    const downloaded = yield* downloadManagedKitman(input.apiUrl, input.platform).pipe(filterOrFail((found) => found !== undefined, () => new UpdateStepFailed({ step: "download", reason: `${input.apiUrl} serves no kitman` })), step("download"));
+    const reported = (yield* runCommand2(downloaded.kitman, ["--version"], { timeout: "30 seconds" }).pipe(step("start"))).trim();
+    if (reported !== downloaded.version)
+      return yield* new UpdateStepFailed({ step: "start", reason: `it reported version ${reported || "none"}` });
+    claiming = false;
+    while ((yield* input.inFlight) > 0)
+      yield* sleep("1 second");
+    yield* linkManagedKitman(downloaded.kitman).pipe(step("switch"));
+    return yield* new RunnerUpdated({ version: downloaded.version });
   });
-}
-function createHerdrRunnerClient(input) {
-  return gen(function* () {
-    const credential = input.credential;
-    const signedFetch = createAgentAuthSignedFetch({
-      apiUrl: input.apiUrl,
-      credential,
-      ...input.fetch === undefined ? undefined : { fetch: input.fetch }
-    });
-    const runnerFetch = (requestInput, init) => {
-      const request = new Request(requestInput, init);
-      request.headers.set(RunnerHeaders.runnerId, input.runnerId);
-      return signedFetch(request);
-    };
-    const client = yield* createSdkClient({
-      apiUrl: input.apiUrl,
-      fetch: runnerFetch,
-      session: { accessToken: "runner-agent-auth" }
-    });
-    const rpcBearer = createAgentAuthBearerToken({
-      credential,
-      audience: new URL("/v1/runners/rpc", input.apiUrl).toString(),
-      capabilities: ["kitman_api"]
-    });
-    return { client, rpcBearer };
+  const update = (version) => suspend(() => {
+    if (updating || failed.has(version))
+      return void_2;
+    updating = true;
+    return attempt.pipe(catchTag("UpdateStepFailed", ({ step: failedStep, reason }) => sync(() => {
+      failed.add(version);
+      claiming = true;
+      problems = [
+        {
+          code: "update_failed",
+          message: `Updating kitman to ${version} failed at the ${failedStep} step: ${reason}`.slice(0, 500),
+          fix: `It keeps running its current version. Check that this machine reaches ${input.apiUrl}, then run \`kitman runner restart ${input.runnerId}\` here to try again.`.slice(0, 500)
+        }
+      ];
+    })), ensuring(sync(() => updating = false)));
   });
-}
-function newCredential(agentId, hostId) {
-  return generateAgentKeyPair.pipe(map3((keyPair) => ({
-    agentId,
-    hostId,
-    privateKeyJwk: keyPair.privateKeyJwk,
-    publicKeyJwk: keyPair.publicKeyJwk
-  })));
-}
+  return {
+    claiming: () => claiming,
+    problems: () => problems,
+    update
+  };
+};
 
 // apps/cli/src/harness-sync.ts
 function buildHarnessSyncPlan(input) {
@@ -1144,11 +462,11 @@ function buildHarnessSyncPlan(input) {
     version: 1,
     apiUrl: input.apiUrl,
     workspaceId: input.workspaceId,
-    ...input.projectId === undefined ? undefined : { projectId: input.projectId },
+    ...input.teamId === undefined ? undefined : { teamId: input.teamId },
     harnesses: harnesses.map((harness) => ({ harness, configScope: "user", managedBy: "kitman" })),
     sources: [
       { kind: "workspace", id: input.workspaceId },
-      ...input.projectId === undefined ? [] : [{ kind: "project", id: input.projectId }],
+      ...input.teamId === undefined ? [] : [{ kind: "team", id: input.teamId }],
       { kind: "user-preferences", id: "default" }
     ],
     materialization: (input.materializationPlans ?? []).map(renderMaterializationPlan),
@@ -1231,7 +549,7 @@ function hashIdentity(value) {
 
 // apps/cli/src/assets.ts
 function send(request, failure) {
-  return execute(request).pipe(mapError((error) => failure(error.cause ?? error)), provide3(layer4));
+  return execute(request).pipe(mapError((error) => failure(error.cause ?? error)), provide3(layer2));
 }
 function putPresignedAsset(upload, bytes) {
   return gen(function* () {
@@ -1244,6 +562,30 @@ function putPresignedAsset(upload, bytes) {
       return yield* new CliError({ message: `Asset upload failed with ${response.status}` });
   });
 }
+var localFileName = (name, fallback) => {
+  const last = name.split(/[\\/]/u).at(-1) ?? "";
+  return last === "" || last === "." || last === ".." ? fallback : last;
+};
+function downloadVerified(url, path, sha256) {
+  return gen(function* () {
+    const fs = yield* FileSystem;
+    const failed = (cause) => new CliError({ message: `Download failed: ${String(cause)}` });
+    const response = yield* send(get2(url), failed);
+    if (response.status < 200 || response.status >= 300)
+      return yield* new CliError({ message: `Download failed with ${response.status}` });
+    const partial = `${path}.partial`;
+    const hash = sha256Hasher();
+    yield* response.stream.pipe(tap2((chunk) => sync(() => hash.update(chunk))), mapError2((error) => failed(error.message)), run(fs.sink(partial)), onError(() => ignore(fs.remove(partial))));
+    const actual = hash.digest("hex");
+    if (actual !== sha256) {
+      yield* fs.remove(partial);
+      return yield* new CliError({
+        message: `The download's SHA-256 is ${actual}, not the ${sha256} Kitman recorded; nothing was kept`
+      });
+    }
+    yield* fs.rename(partial, path);
+  });
+}
 
 // apps/cli/src/output.ts
 function printJson(value) {
@@ -1381,6 +723,162 @@ function declaredChecks(manifest, rootFiles) {
 // apps/cli/src/init.ts
 import { hostname } from "os";
 
+// apps/cli/src/machine-runners.ts
+var serviceFilePattern = (platform) => platform === "darwin" ? /^dev\.kitman\.kitman-runner-(.+)\.plist$/u : /^kitman-runner-(.+)\.service$/u;
+var unescapeXml = (text) => text.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+var serviceCommand = (platform, definition) => {
+  if (platform === "darwin") {
+    const programArguments = /<key>ProgramArguments<\/key>\s*<array>(.*?)<\/array>/su.exec(definition)?.[1] ?? "";
+    return Array.from(programArguments.matchAll(/<string>(.*?)<\/string>/gsu), ([, word = ""]) => unescapeXml(word));
+  }
+  const execStart = /^ExecStart=(.*)$/mu.exec(definition)?.[1] ?? "";
+  return Array.from(execStart.matchAll(/"([^"]*)"|(\S+)/gu), ([, quoted, word]) => quoted ?? word ?? "");
+};
+var machineRunnerServices = gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const { platform } = yield* ServiceManager;
+  const directory = path.dirname(yield* runnerServiceFile(platform, runnerServiceName("")));
+  const pattern = serviceFilePattern(platform);
+  const files = yield* fs.readDirectory(directory).pipe(orElseSucceed(() => []));
+  return yield* forEach(files.flatMap((file) => {
+    const runnerId = pattern.exec(file)?.[1];
+    return runnerId === undefined ? [] : [{ runnerId, file: path.join(directory, file) }];
+  }), ({ runnerId, file }) => map3(fs.readFileString(file), (definition) => ({
+    runnerId,
+    command: serviceCommand(platform, definition)
+  })));
+});
+var serviceApiUrl = (service, fallback) => {
+  const index = service.command.indexOf("--api-url");
+  return normalizeApiUrl((index < 0 ? undefined : service.command[index + 1]) ?? fallback);
+};
+var ownersRunners = (apiUrl) => gen(function* () {
+  const session = yield* sessionForApiWithRefresh(apiUrl);
+  if (session === undefined)
+    return;
+  const client = yield* clientFor(apiUrl, session);
+  const workspaces = (yield* client.listWorkspaces()).items;
+  const lists = yield* forEach(workspaces, (workspace) => map3(client.listRunners(workspace.id), (list) => list.items));
+  return new Map(lists.flat().map((runner) => [runner.id, runner]));
+}).pipe(orElseSucceed(() => {
+  return;
+}));
+var runnerAsItself = (apiUrl, runnerId) => gen(function* () {
+  const credential = yield* storedHerdrRunnerCredential(apiUrl, runnerId);
+  if (credential === undefined)
+    return;
+  const { client } = yield* createHerdrRunnerClient({ apiUrl, runnerId, credential });
+  return yield* client.getRunner(runnerId).pipe(catchIf((error) => error instanceof KitmanClientError && [401, 403, 404].includes(error.status ?? 0), () => succeed5("gone")));
+}).pipe(orElseSucceed(() => {
+  return;
+}));
+var removeAsItself = (apiUrl, runnerId) => gen(function* () {
+  const credential = yield* storedHerdrRunnerCredential(apiUrl, runnerId);
+  if (credential === undefined)
+    return;
+  const { client } = yield* createHerdrRunnerClient({ apiUrl, runnerId, credential });
+  return yield* client.removeRunner(runnerId).pipe(as("removed"), catchIf((error) => error.status === 404, () => succeed5("removed")), catchIf((error) => error.status === 401 || error.status === 403, () => succeed5("refused")));
+});
+var adoptRunnerServices = (apiUrl) => gen(function* () {
+  const fs = yield* FileSystem;
+  const services = yield* machineRunnerServices;
+  const managed = yield* managedKitmanPath;
+  const installed = yield* fs.exists(managed);
+  const known = new Map;
+  for (const service of services) {
+    const url = serviceApiUrl(service, apiUrl);
+    if (!known.has(url))
+      known.set(url, yield* ownersRunners(url));
+  }
+  const everyListRead = Array.from(known.values()).every((runners) => runners !== undefined);
+  for (const service of services) {
+    const url = serviceApiUrl(service, apiUrl);
+    const runners = known.get(url);
+    const name = runnerServiceName(service.runnerId);
+    if (everyListRead && runners?.has(service.runnerId) === false) {
+      yield* removeRunnerService(name);
+      yield* removeAgentCredential(url, `herdr-runner:${service.runnerId}`);
+      yield* log(`Runner service: removed ${name} (Kitman no longer has Runner ${service.runnerId})`);
+    } else if (installed && service.command[0] !== managed && (yield* storedHerdrRunnerCredential(url, service.runnerId)) !== undefined) {
+      yield* runnerService(yield* managedRunnerService(service.runnerId, url));
+      yield* log(`Runner service: moved ${name} onto ${managed}`);
+    }
+  }
+  return known.get(normalizeApiUrl(apiUrl)) ?? (yield* ownersRunners(apiUrl));
+});
+var stateText = (state) => {
+  if (state.kind === "needs_attention")
+    return "needs attention";
+  return state.kind === "offline" && state.since !== undefined ? `offline since ${state.since}` : state.kind;
+};
+var chosenService = (services, runnerId) => {
+  if (runnerId !== undefined)
+    return succeed5(services.find((service) => service.runnerId === runnerId));
+  const [only, ...others] = services;
+  if (only === undefined)
+    return fail4(new CliError({ message: "No Runner service runs on this machine" }));
+  if (others.length > 0)
+    return fail4(new CliError({
+      message: `This machine runs several Runners; choose one with ${services.map((service) => `--runner ${service.runnerId}`).join(" or ")}`
+    }));
+  return succeed5(only);
+};
+var serviceFor = (runnerId) => gen(function* () {
+  const service = yield* chosenService(yield* machineRunnerServices, runnerId);
+  if (service === undefined)
+    return yield* new CliError({ message: `No service for Runner ${runnerId} runs on this machine` });
+  return service;
+});
+var machineRunnerCommand = (action, apiUrl, options) => gen(function* () {
+  if (action === "logs")
+    return yield* showRunnerServiceLog(runnerServiceName((yield* serviceFor(options.runnerId)).runnerId), options.follow);
+  if (action === "restart") {
+    const { runnerId } = yield* serviceFor(options.runnerId);
+    yield* restartRunnerService(runnerServiceName(runnerId));
+    return yield* log(`Restarted Runner ${runnerId}`);
+  }
+  if (action === "remove") {
+    const service = yield* chosenService(yield* machineRunnerServices, options.runnerId);
+    const runnerId = options.runnerId ?? service?.runnerId;
+    if (runnerId === undefined)
+      return yield* new CliError({ message: "runner remove requires --runner <runner-id>" });
+    const url = service === undefined ? normalizeApiUrl(apiUrl) : serviceApiUrl(service, apiUrl);
+    const session = yield* sessionForApiWithRefresh(url);
+    const removal = session === undefined ? yield* removeAsItself(url, runnerId) : yield* (yield* clientFor(url, session)).removeRunner(runnerId).pipe(as("removed"), catchIf((error) => error instanceof KitmanClientError && error.status === 404, () => succeed5("removed")));
+    if (removal === undefined)
+      return yield* new CliError({
+        message: `This machine holds no credential for Runner ${runnerId}, and nobody is signed in to ${url} here to remove it. Remove it on the Runners page, or sign in with \`kitman login --api-url ${url}\`, then run this again.`
+      });
+    if (service !== undefined)
+      yield* removeRunnerService(runnerServiceName(runnerId));
+    yield* removeAgentCredential(url, `herdr-runner:${runnerId}`);
+    if (removal === "refused")
+      return yield* log(`Removed Runner ${runnerId} from this machine. Kitman refused this machine's credential for it, so it may still exist: if the Runners page lists it, remove it there.`);
+    return yield* log(`Removed Runner ${runnerId} from Kitman and this machine`);
+  }
+  const runners = yield* adoptRunnerServices(apiUrl);
+  const services = yield* machineRunnerServices;
+  if (services.length === 0)
+    return yield* log("No Runner service runs on this machine. Pair one with the command the Runners page shows.");
+  const version = yield* installedKitmanVersion;
+  for (const service of services) {
+    const { runnerId } = service;
+    const shown = runners?.get(runnerId) ?? (yield* runnerAsItself(serviceApiUrl(service, apiUrl), runnerId));
+    const runner = shown === "gone" ? undefined : shown;
+    const problems = runner?.state.kind === "needs_attention" ? runner.state.problems : [];
+    const state = shown === "gone" ? "Kitman refuses its credential; run `kitman pair` here, or `kitman runner remove` to clean up" : runner === undefined ? "unknown; Kitman could not be asked" : stateText(runner.state);
+    yield* log([
+      `${runner?.name ?? "Runner"} (${runnerId})`,
+      `  state: ${state}`,
+      ...problems.flatMap((problem) => [`  ${problem.code}: ${problem.message}`, `    fix: ${problem.fix}`]),
+      `  kitman: ${version ?? "not installed"}`,
+      `  service: ${(yield* runnerServiceState(runnerServiceName(runnerId))) ?? "unsupported"}`
+    ].join(`
+`));
+  }
+});
+
 // apps/cli/src/repo-binding-setup.ts
 var Git = Reference("kitman/cli/Git", {
   defaultValue: () => (args) => runCommand2("git", args).pipe(map3((stdout) => stdout.trim()))
@@ -1493,7 +991,17 @@ function stripPathSuffix(value) {
 
 // apps/cli/src/init.ts
 var ServiceManager = Reference("kitman/cli/ServiceManager", {
-  defaultValue: () => ({ platform: process.platform, run: (command, args) => runCommand2(command, args) })
+  defaultValue: () => ({
+    platform: process.platform,
+    run: (command, args) => runCommand2(command, args),
+    attach: (command, args) => gen(function* () {
+      const spawner = yield* ChildProcessSpawner;
+      const handle = yield* spawner.spawn(make8(command, args, { stdin: "inherit", stdout: "inherit", stderr: "inherit" }));
+      const exitCode = yield* handle.exitCode;
+      if (exitCode !== 0)
+        return yield* new CommandFailed2({ command, reason: `exit code ${exitCode}` });
+    }).pipe(scoped)
+  })
 });
 var Login = Reference("kitman/cli/Login", {
   defaultValue: () => browserSession
@@ -1535,52 +1043,103 @@ function initCommand(args) {
       return yield* new CliError({ message: "No Workspace to use" });
     yield* writeUserConfig({ ...user, apiUrl, activeWorkspaceId: workspace.id });
     yield* step("Workspace", current === undefined ? "set_up" : "already", workspace.name);
-    const project = yield* projectFor(client, workspace.id, remoteUrl, remote.name, local?.activeProjectId);
-    yield* writeUserConfig({ ...local, apiUrl, activeWorkspaceId: workspace.id, activeProjectId: project.id }, yield* localConfigPath);
-    yield* step("Project", project.outcome, project.name);
-    const bindings = (yield* client.listRepoBindings(project.id)).items;
+    yield* writeUserConfig({ ...local, apiUrl, activeWorkspaceId: workspace.id }, yield* localConfigPath);
+    const bindings = (yield* client.listRepoBindings(workspace.id)).items;
     const bound = bindings.find((binding) => matchesRemote(binding, remoteUrl));
-    const binding = bound ?? (yield* client.createRepoBinding(project.id, yield* repoBindingInputFromCurrentRepo));
-    yield* step("Repository", bound === undefined ? project.outcome === "already" ? "repaired" : "set_up" : "already", `${remote.owner}/${remote.name}`);
+    const binding = bound ?? (yield* client.createRepoBinding(workspace.id, yield* repoBindingInputFromCurrentRepo));
+    yield* step("Repository", bound === undefined ? current === undefined ? "set_up" : "repaired" : "already", `${remote.owner}/${remote.name}`);
     yield* runnerStep(client, { apiUrl, session, workspaceId: workspace.id, userId: me.userId }, step);
     const syncPath = yield* userHarnessSyncPath;
     const before = yield* readText(syncPath);
     yield* harnessSync(["sync"]);
     const after = yield* readText(syncPath);
     yield* step("Harness", before === undefined ? "set_up" : before === after ? "already" : "repaired", "synced");
-    yield* verificationStep(client, project.id, binding, confirm, step);
+    yield* verificationStep(client, workspace.id, binding, confirm, step);
     const changed = steps.filter((entry) => entry.outcome === "set_up" || entry.outcome === "repaired");
     yield* log(changed.length === 0 ? "Nothing to change: Kitman is already set up here." : `Set up ${changed.map((entry) => entry.name).join(", ")}. Start work with kitman run start build "<what to build>".`);
   });
 }
 function pairCommand(args) {
   return gen(function* () {
-    const [code, ...rest] = args;
-    if (code === undefined || code.startsWith("-"))
-      return yield* new CliError({ message: "Usage: kitman pair <pairing code> [--api-url <url>]" });
+    const code = args[0]?.startsWith("-") === false ? args[0] : undefined;
+    const { credentialFile, rest } = credentialFileFlag(code === undefined ? args : args.slice(1));
     const flags = parseInitFlags(rest);
     const apiUrl = yield* resolveApiUrl(flags.apiUrl);
     const step = (name, outcome, detail) => log(`${name}: ${outcomeLabel[outcome]} (${detail})`);
+    if (code === undefined) {
+      if (credentialFile !== undefined)
+        return yield* new CliError({ message: "--credential-file needs a Pairing Code minted for a Runner" });
+      return yield* pairAsOwner(apiUrl, yield* storedPairing(apiUrl), "already", step);
+    }
+    const keys = yield* generateAgentKeyPair;
     const anonymous = new KitmanEffectClient({ baseUrl: apiUrl, fetch: yield* Fetch });
-    const credentials = yield* anonymous.redeemPairingCode({ code });
-    const session = toStoredSession({
-      access_token: credentials.accessToken,
-      ...credentials.refreshToken === undefined ? undefined : { refresh_token: credentials.refreshToken },
-      ...credentials.expiresIn === undefined ? undefined : { expires_in: credentials.expiresIn }
+    const redeemed = yield* anonymous.redeemPairingCode({
+      code,
+      publicKey: keys.publicKeyJwk
     });
-    yield* storeSession(apiUrl, session);
-    yield* writeUserConfig({ ...yield* readUserConfig(), apiUrl, activeWorkspaceId: credentials.workspaceId });
-    yield* step("Login", "set_up", apiUrl);
-    const client = yield* clientFor(apiUrl, session);
-    yield* runnerStep(client, { apiUrl, session, workspaceId: credentials.workspaceId, userId: credentials.userId }, step);
-    const detected = yield* detectHarnesses2;
-    if (detected.harnesses.length === 0)
-      return yield* step("Harness", "skipped", `none logged in: ${detected.unavailable.map((harness) => harness.missing.join(", ")).join("; ")}`);
-    const harnesses = detected.harnesses.map((harness) => harness === "claude" ? "claude-code" : harness);
-    yield* harnessSync(["sync", ...harnesses]);
-    yield* step("Harness", "set_up", `${harnesses.join(", ")} synced`);
+    if ("runnerId" in redeemed) {
+      const credential = { agentId: redeemed.agentIdentityId, hostId: redeemed.credentialHostId, ...keys };
+      if (credentialFile !== undefined) {
+        yield* writeRunnerCredentialFile(credentialFile, { apiUrl, runnerId: redeemed.runnerId, ...credential });
+        return yield* step("Runner credential", "set_up", `${credentialFile}; start each replica with kitman runner start --credential-file ${credentialFile}`);
+      }
+      yield* storeAgentCredential(apiUrl, herdrRunnerCredentialName(redeemed.runnerId), credential);
+      yield* writeUserConfig({ ...yield* readUserConfig(), apiUrl });
+      yield* step("Runner", "set_up", redeemed.runnerId);
+      return yield* runnerServiceStep(apiUrl, redeemed.runnerId, { fresh: true, keyed: true }, step);
+    }
+    const pairing = yield* storeRedeemedSession(apiUrl, redeemed);
+    if (credentialFile !== undefined)
+      return yield* new CliError({
+        message: "This Pairing Code signed you in here and pairs no Runner, so there is no Runner credential to write. Run kitman pair to pair this machine as you, or mint a code with Pair a shared Runner."
+      });
+    yield* pairAsOwner(apiUrl, pairing, "set_up", step);
   });
 }
+var pairAsOwner = (apiUrl, pairing, login, step) => gen(function* () {
+  yield* step("Login", login, apiUrl);
+  yield* runnerStep(yield* clientFor(apiUrl, pairing.session), { apiUrl, ...pairing }, step);
+  yield* adoptRunnerServices(apiUrl);
+  const detected = yield* detectHarnesses2;
+  if (detected.harnesses.length === 0)
+    return yield* step("Harness", "skipped", `none logged in: ${detected.unavailable.map((harness) => harness.missing.join(", ")).join("; ")}`);
+  const harnesses = detected.harnesses.map((harness) => harness === "claude" ? "claude-code" : harness);
+  yield* harnessSync(["sync", ...harnesses]);
+  yield* step("Harness", "set_up", `${harnesses.join(", ")} synced`);
+});
+var credentialFileFlag = (args) => {
+  const at = args.indexOf("--credential-file");
+  if (at === -1)
+    return { credentialFile: undefined, rest: args };
+  const credentialFile = args[at + 1];
+  if (!credentialFile)
+    throw new Error("--credential-file requires a path");
+  return { credentialFile, rest: [...args.slice(0, at), ...args.slice(at + 2)] };
+};
+var storeRedeemedSession = (apiUrl, credentials) => gen(function* () {
+  const session = toStoredSession({
+    access_token: credentials.accessToken,
+    ...credentials.refreshToken === undefined ? undefined : { refresh_token: credentials.refreshToken },
+    ...credentials.expiresIn === undefined ? undefined : { expires_in: credentials.expiresIn }
+  });
+  yield* storeSession(apiUrl, session);
+  yield* writeUserConfig({ ...yield* readUserConfig(), apiUrl, activeWorkspaceId: credentials.workspaceId });
+  return { session, workspaceId: credentials.workspaceId, userId: credentials.userId };
+});
+var storedPairing = (apiUrl) => gen(function* () {
+  const session = yield* sessionForApiWithRefresh(apiUrl);
+  if (session === undefined)
+    return yield* new CliError({
+      message: `kitman pair needs a Pairing Code: nobody is signed in to ${apiUrl} here. Copy the pairing command from the Runners page in Kitman; it carries a new code.`
+    });
+  const me = yield* (yield* clientFor(apiUrl, session)).whoami();
+  if (me.actorType !== "human")
+    return yield* new CliError({ message: "kitman pair needs a person signed in" });
+  const workspaceId = (yield* readUserConfig())?.activeWorkspaceId ?? me.activeWorkspaceId ?? me.workspaceId;
+  if (workspaceId === undefined)
+    return yield* new CliError({ message: "No active Workspace. Run kitman workspace use <workspace>." });
+  return { session, workspaceId, userId: me.userId };
+});
 var parseInitFlags = (args) => {
   const flags = { yes: false };
   for (let index = 0;index < args.length; index += 1) {
@@ -1605,54 +1164,59 @@ var pickWorkspace = (workspaces, ask) => gen(function* () {
   return workspaces.find((workspace) => workspace.slug === answer || workspace.name === answer) ?? first;
 });
 var matchesRemote = (binding, remoteUrl) => binding.status === "active" && repositoryKey(binding.repositoryUrl ?? `https://${binding.host}/${binding.owner}/${binding.name}`) === repositoryKey(remoteUrl);
-var projectFor = (client, workspaceId, remoteUrl, repositoryName, configured) => gen(function* () {
-  const projects = (yield* client.listProjects(workspaceId)).items;
-  const known = projects.find((project) => project.id === configured);
-  if (known !== undefined)
-    return { id: known.id, name: known.name, outcome: "already" };
-  const boundHere = yield* findFirst(projects, (project) => client.listRepoBindings(project.id).pipe(map3((bindings) => bindings.items.some((binding) => matchesRemote(binding, remoteUrl))), orElseSucceed(() => false)));
-  const found = getOrUndefined(boundHere) ?? projects.find((project) => project.slug === repositoryName || project.name === repositoryName);
-  if (found === undefined) {
-    const created = yield* client.createProject(workspaceId, { name: repositoryName });
-    return { id: created.id, name: created.name, outcome: "set_up" };
-  }
-  return { id: found.id, name: found.name, outcome: "set_up" };
-});
 var runnerStep = (client, input, step) => gen(function* () {
   const name = yield* machineName;
   const runners = (yield* client.listRunners(input.workspaceId)).items;
-  const existing = runners.find((runner) => runner.ownership.kind === "personal" && runner.ownership.ownerUserId === input.userId && runner.name === name && runner.status === "active");
-  const runner = existing ?? (yield* client.registerRunner(input.workspaceId, {
+  const listed = runners.find((runner) => runner.ownership.kind === "personal" && runner.ownership.ownerUserId === input.userId && runner.name === name && runner.status === "active");
+  const check = listed === undefined ? undefined : yield* herdrRunnerCredentialCheck(input.apiUrl, listed.id);
+  const runner = listed ?? (yield* client.registerRunner(input.workspaceId, {
     name,
     capabilities: herdrRunnerCapabilities2({ harnesses: yield* detectHarnesses2 }),
     labels: ["kitman-runner", "kitman-loop", "herdr"]
   })).runner;
-  const credentialMissing = agentCredentialForApi(yield* readAuthStore(), input.apiUrl, `herdr-runner:${runner.id}`) === undefined;
-  if (credentialMissing)
-    yield* ensureHerdrRunnerCredential({ apiUrl: input.apiUrl, accessToken: input.session.accessToken, runner });
-  yield* step("Runner", existing === undefined ? "set_up" : credentialMissing ? "repaired" : "already", `${name}${credentialMissing && existing !== undefined ? ", credential restored" : ""}`);
-  const home = yield* String3("HOME");
-  const service = yield* runnerService({
-    name: runnerServiceName(runner.id),
-    command: [...kitmanCommand(), "runner", "start", runner.id, "--api-url", input.apiUrl],
-    workingDirectory: home,
-    path: getOrElse(yield* option2(String3("PATH")), () => "/usr/local/bin:/usr/bin:/bin")
-  });
+  const keyed = check !== "accepted";
+  if (keyed)
+    yield* provisionHerdrRunnerCredential({ apiUrl: input.apiUrl, accessToken: input.session.accessToken, runner });
+  yield* step("Runner", check === undefined ? "set_up" : keyed ? "repaired" : "already", `${name}${check === undefined ? "" : credentialNote[check]}`);
+  yield* runnerServiceStep(input.apiUrl, runner.id, { fresh: listed === undefined, keyed }, step);
+});
+var runnerServiceStep = (apiUrl, runnerId, change, step) => gen(function* () {
+  const manager = yield* ServiceManager;
+  if (manager.platform === "linux" || manager.platform === "darwin") {
+    const managed = (yield* runningManagedInstall(manager.platform)) ? "running" : yield* installManagedKitman(apiUrl, manager.platform);
+    if (managed === undefined)
+      return yield* step("Runner service", "skipped", `${apiUrl} serves no kitman to install; start it yourself with kitman runner start --runner ${runnerId}`);
+    if (managed !== "running")
+      yield* step("kitman", managed.installed ? "set_up" : "already", managed.version);
+  }
+  const spec = yield* managedRunnerService(runnerId, apiUrl);
+  const service = yield* runnerService(spec);
   if (service === "unsupported")
-    yield* step("Runner service", "skipped", `start it yourself with kitman runner start ${runner.id}`);
-  else
-    yield* step("Runner service", service === "running" ? "already" : existing === undefined ? "set_up" : "repaired", service === "running" ? "running" : "started");
+    return yield* step("Runner service", "skipped", `start it yourself with kitman runner start ${runnerId}`);
+  if (service === "running" && !change.keyed)
+    return yield* step("Runner service", "already", "running");
+  if (service === "running")
+    yield* restartRunnerService(spec.name);
+  yield* step("Runner service", change.fresh ? "set_up" : "repaired", "started");
 });
+var credentialNote = { missing: ", credential restored", refused: ", credential re-keyed", accepted: "" };
 var machineName = map3(option2(String3("KITMAN_RUNNER_NAME")), (name) => getOrElse(name, () => hostname()));
-var kitmanCommand = () => {
-  const [runtime, script] = process.argv;
-  return script === undefined || script.startsWith("/$bunfs/") ? [process.execPath] : [runtime ?? process.execPath, script];
-};
+var managedRunnerService = (runnerId, apiUrl) => gen(function* () {
+  const kitman = yield* managedKitmanPath;
+  const bin = (yield* Path).dirname(kitman);
+  const path = getOrElse(yield* option2(String3("PATH")), () => "/usr/local/bin:/usr/bin:/bin");
+  return {
+    name: runnerServiceName(runnerId),
+    command: [kitman, "runner", "start", "--runner", runnerId, "--api-url", apiUrl],
+    workingDirectory: yield* String3("HOME"),
+    path: [bin, ...path.split(":").filter((entry) => entry !== bin)].join(":")
+  };
+});
 var readText = (path) => flatMap2(FileSystem, (fs) => fs.readFileString(path)).pipe(orElseSucceed(() => {
   return;
 }));
-var verificationStep = (client, projectId, binding, confirm, step) => gen(function* () {
-  const approved = (yield* client.listApprovedVerifications(projectId, binding.id)).items;
+var verificationStep = (client, workspaceId, binding, confirm, step) => gen(function* () {
+  const approved = (yield* client.listApprovedVerifications(workspaceId, binding.id)).items;
   const suggested = (yield* scriptChecks).filter((check) => !approved.some((entry) => entry.name === check.name));
   if (suggested.length === 0)
     return yield* step("Verifications", approved.length === 0 ? "skipped" : "already", approved.length === 0 ? "no check scripts found; add one with kitman verify add" : approved.map((check) => check.name).join(", "));
@@ -1661,7 +1225,7 @@ var verificationStep = (client, projectId, binding, confirm, step) => gen(functi
   if (!(yield* confirm("Approve these verifications as evidence for every Run", true)))
     return yield* step("Verifications", "skipped", "not approved; run kitman init again or kitman verify add");
   for (const check of suggested)
-    yield* client.approveVerification(projectId, binding.id, check);
+    yield* client.approveVerification(workspaceId, binding.id, check);
   yield* step("Verifications", "set_up", suggested.map((check) => check.name).join(", "));
 });
 var scriptChecks = gen(function* () {
@@ -1683,13 +1247,15 @@ var systemdUnit = (spec) => [
   `Environment="PATH=${spec.path}"`,
   "Restart=on-failure",
   "RestartSec=5",
+  "RestartSteps=10",
+  "RestartMaxDelaySec=300",
   "",
   "[Install]",
   "WantedBy=default.target",
   ""
 ].join(`
 `);
-var launchdPlist = (label, spec) => [
+var launchdPlist = (label, spec, log) => [
   '<?xml version="1.0" encoding="UTF-8"?>',
   '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
   '<plist version="1.0"><dict>',
@@ -1697,8 +1263,10 @@ var launchdPlist = (label, spec) => [
   `<key>ProgramArguments</key><array>${spec.command.map((word) => `<string>${escapeXml(word)}</string>`).join("")}</array>`,
   `<key>WorkingDirectory</key><string>${escapeXml(spec.workingDirectory)}</string>`,
   `<key>EnvironmentVariables</key><dict><key>PATH</key><string>${escapeXml(spec.path)}</string></dict>`,
+  `<key>StandardOutPath</key><string>${escapeXml(log)}</string>`,
+  `<key>StandardErrorPath</key><string>${escapeXml(log)}</string>`,
   "<key>RunAtLoad</key><true/>",
-  "<key>KeepAlive</key><true/>",
+  "<key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>",
   "</dict></plist>",
   ""
 ].join(`
@@ -1706,6 +1274,44 @@ var launchdPlist = (label, spec) => [
 var escapeXml = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 var runnerServiceName = (runnerId) => `kitman-runner-${runnerId}`;
 var launchdLabel = (name) => `dev.kitman.${name}`;
+var runnerServiceFile = (platform, name) => gen(function* () {
+  const path = yield* Path;
+  const home = yield* String3("HOME");
+  return platform === "darwin" ? path.join(home, "Library", "LaunchAgents", `${launchdLabel(name)}.plist`) : path.join(home, ".config", "systemd", "user", `${name}.service`);
+});
+var runnerServiceLog = (name) => gen(function* () {
+  const path = yield* Path;
+  return path.join(yield* String3("HOME"), "Library", "Logs", "kitman", `${name}.log`);
+});
+var restartRunnerService = (name) => gen(function* () {
+  const manager = yield* ServiceManager;
+  if (manager.platform === "darwin")
+    return yield* manager.run("launchctl", ["kickstart", "-k", `${yield* launchdDomain}/${launchdLabel(name)}`]);
+  return yield* manager.run("systemctl", ["--user", "restart", `${name}.service`]);
+});
+var showRunnerServiceLog = (name, follow) => gen(function* () {
+  const manager = yield* ServiceManager;
+  if (manager.platform === "darwin")
+    return yield* manager.attach("tail", ["-n", "200", ...follow ? ["-f"] : [], yield* runnerServiceLog(name)]);
+  return yield* manager.attach("journalctl", [
+    "--user",
+    "--unit",
+    `${name}.service`,
+    ...follow ? ["--follow"] : ["--no-pager"]
+  ]);
+});
+var removeRunnerService = (name) => gen(function* () {
+  const fs = yield* FileSystem;
+  const manager = yield* ServiceManager;
+  const file = yield* runnerServiceFile(manager.platform, name);
+  if (manager.platform === "darwin")
+    yield* ignore(manager.run("launchctl", ["bootout", `${yield* launchdDomain}/${launchdLabel(name)}`]));
+  else
+    yield* ignore(manager.run("systemctl", ["--user", "disable", "--now", `${name}.service`]));
+  yield* fs.remove(file, { force: true });
+  if (manager.platform !== "darwin")
+    yield* ignore(manager.run("systemctl", ["--user", "daemon-reload"]));
+});
 var launchdDomain = gen(function* () {
   const manager = yield* ServiceManager;
   return `gui/${(yield* manager.run("id", ["-u"])).trim()}`;
@@ -1725,7 +1331,6 @@ function runnerService(spec) {
     const fs = yield* FileSystem;
     const path = yield* Path;
     const manager = yield* ServiceManager;
-    const home = yield* String3("HOME");
     const define = (file, content) => gen(function* () {
       if ((yield* readText(file)) === content)
         return false;
@@ -1735,7 +1340,7 @@ function runnerService(spec) {
     });
     if (manager.platform === "linux") {
       const unit = `${spec.name}.service`;
-      const changed = yield* define(path.join(home, ".config", "systemd", "user", unit), systemdUnit(spec));
+      const changed = yield* define(yield* runnerServiceFile(manager.platform, spec.name), systemdUnit(spec));
       if (!changed && (yield* runnerServiceState(spec.name)) === "systemd: active")
         return "running";
       yield* manager.run("systemctl", ["--user", "daemon-reload"]);
@@ -1745,8 +1350,10 @@ function runnerService(spec) {
     }
     if (manager.platform === "darwin") {
       const label = launchdLabel(spec.name);
-      const file = path.join(home, "Library", "LaunchAgents", `${label}.plist`);
-      const changed = yield* define(file, launchdPlist(label, spec));
+      const file = yield* runnerServiceFile(manager.platform, spec.name);
+      const log = yield* runnerServiceLog(spec.name);
+      yield* fs.makeDirectory(path.dirname(log), { recursive: true });
+      const changed = yield* define(file, launchdPlist(label, spec, log));
       if (!changed && (yield* runnerServiceState(spec.name)) === "launchd: running")
         return "running";
       const domain = yield* launchdDomain;
@@ -1787,7 +1394,7 @@ var package_default = {
 };
 
 // apps/cli/src/scaffold.ts
-var cliVersion = "0.7.4";
+var cliVersion = "0.8.0";
 var packageJson = (name, scaffold) => `${JSON.stringify({
   name,
   private: true,
@@ -1897,7 +1504,7 @@ var readme = (name, scaffold) => [
   "1. `bun install`, then `bun test`.",
   "2. `bunx kitman deploy --plan` shows what deploying would change.",
   "3. Push this repository to GitLab, then let its CI deploy the default branch: a Workspace owner or admin runs",
-  "   `bunx kitman deploy bind --branch main` (add `--project <project>` to deploy to one Project).",
+  "   `bunx kitman deploy bind --branch main` (add `--team <team>` to deploy to one Team).",
   "4. Merge requests print the plan, and merging deploys. `.gitlab-ci.yml` names the Workspace to deploy to.",
   ""
 ].join(`
@@ -1907,7 +1514,7 @@ var scaffoldPackage = (directory, scaffold = {}) => gen(function* () {
   const path = yield* Path;
   const root = path.resolve(directory);
   if (scaffold.fork !== undefined) {
-    const { shippedLoops } = yield* promise(() => import("./chunk-jwtkec1w.js"));
+    const { shippedLoops } = yield* promise(() => import("./chunk-64et31rh.js"));
     if (!(scaffold.fork in shippedLoops))
       return yield* new CliError({
         message: `Kitman ships no Loop ${scaffold.fork}; fork one of ${Object.keys(shippedLoops).join(", ")}`
@@ -1939,30 +1546,38 @@ var scaffoldPackage = (directory, scaffold = {}) => gen(function* () {
 // apps/cli/src/commands.ts
 var ClientId = "kitman-cli";
 var Usage = [
-  "Usage: kitman <init|pair|run|inbox|loop|agent|deploy|package|verify|secret|constraint|mcp|sync|whoami|config|kit|task|memory|proposal|decision|context|schedule|delivery|reconcile|lifecycle|logout> [options]",
+  "Usage: kitman <init|pair|run|inbox|loop|agent|deploy|package|verify|secret|team|repo|constraint|mcp|sync|whoami|config|kit|task|memory|proposal|decision|context|schedule|delivery|reconcile|lifecycle|logout> [options]",
   "",
   "Set up, in a repository (run it again to repair what is missing):",
   "  kitman init [--yes] [--api-url <url>]",
-  "  kitman pair <pairing code> [--api-url <url>]   (what the command the web shows runs)",
+  "  kitman pair [<pairing code>] [--api-url <url>]   (what the command the web shows runs; no code finishes or re-keys with your session)",
+  "  kitman pair <runner pairing code> --credential-file <path>   (writes a shared Runner's credential for a container or its replicas to mount)",
+  "  kitman runner start --credential-file <path>   (or KITMAN_RUNNER_CREDENTIAL_FILE; starts the Runner the file holds)",
   "",
   "Runs:",
-  '  kitman run start <loop> "<words>" [--input <json>] [--project <project>] [--type <task type>] [--constraint <text>]...',
+  '  kitman run start <loop> "<words>" [--input <json>] [--team <team>] [--type <task type>] [--constraint <text>]...',
   "  kitman run show <run>",
   "  kitman run intent <run> [--set-goal <text>] [--add-constraint <text>] [--remove-constraint <id>] [--corrections on|off]",
   "  kitman run drift <run> [--dismiss <constraint> --reason <text>]",
-  "  kitman run list [--status <status>] [--limit <n>]",
+  "  kitman run files <run> [--step <step>]",
+  "  kitman run file get <run> <id> [--out <path>]",
+  "  kitman run list [--team <id>] [--loop <loop>] [--state <state>[,<state>\u2026]] [--limit <n>]",
   "  kitman run wait <run> [--until attention|finished]",
   '  kitman run answer <run> "<option or words>" [--question <name>]',
   '  kitman run steer <run> "<note for the agent>"',
+  "  kitman run follow <run>   (prints its agents' Transcripts as they grow, until the Run settles)",
+  "  kitman transcript <run> [--step <step>] [--attempt <n>]",
   "  kitman run stop <run>",
   "  kitman run resume <run>",
   "  kitman run close <run> --complete|--abandoned [--reason <text>]",
   "  kitman run actions <run>",
   "  kitman run action <run> <action>",
+  "  kitman task assign <task> --to <person>   (by email, name or id)",
+  "  kitman task assign <task> --loop <loop>   (starts a Run of the Loop on the Task; you stay its owner)",
   "  kitman inbox [--unread|--snoozed|--done]",
-  "  kitman inbox my-teams [--project <project>]",
-  "  kitman inbox read|unread|done|undone|unsnooze <task:id|run:id|proposal:id>...",
-  "  kitman inbox snooze <task:id|run:id|proposal:id>... --until <time>",
+  "  kitman inbox my-teams [--team <team>]",
+  "  kitman inbox read|unread|done|undone|unsnooze <task:id|run:id|proposal:id|project_update:id>...",
+  "  kitman inbox snooze <task:id|run:id|proposal:id|project_update:id>... --until <time>",
   "  kitman inbox unsubscribe <task>...",
   "",
   "",
@@ -1984,24 +1599,37 @@ var Usage = [
   '  kitman constraint add "<constraint>"',
   "  kitman constraint remove <constraint>",
   "",
-  "Secrets, for the Workspace or with --project for one Project; values are write-only:",
-  "  <command> | kitman secret set <name> [--project <project>]   (reads the value from stdin)",
-  "  kitman secret delete <name> [--project <project>]",
-  "  kitman secret list [--project <project>]",
+  "Secrets, for the Workspace or with --team for one Team; values are write-only:",
+  "  <command> | kitman secret set <name> [--team <team>]   (reads the value from stdin)",
+  "  kitman secret delete <name> [--team <team>]",
+  "  kitman secret list [--team <team>]",
+  "  kitman secret move <name> [--team <team>] --to <team>|workspace",
+  "",
+  "A private Team, and all it holds, is seen by its members alone:",
+  "  kitman team private <team>",
+  "  kitman team open <team>",
+  "  kitman team invite <team> <person>",
   "",
-  "Packages, built from the current directory and deployed to the Workspace or with --project to one Project:",
-  "  kitman deploy [--plan] [--project <project>]   (--plan prints what would change; deploying needs a clean tree)",
-  '  kitman dev <loop> "<words>" [--input <json>] [--project <project>]   (runs the working tree on your personal Runner)',
-  "  kitman package list [--project <project>]",
-  "  kitman package show <name> [--project <project>]",
-  "  kitman package remove <name> [--project <project>] [--yes]   (prints the plan; removes only with --yes)",
+  "Repositories, Memory and Decisions belong to the Workspace or one Team:",
+  "  kitman repo list",
+  "  kitman repo add [--from-current-repo] [--team <team>]",
+  "  kitman repo move <repository> --to <team>|workspace",
+  "  kitman memory move <memory> --to <team>|workspace",
+  "  kitman decision move <decision> --to <team>|workspace",
+  "",
+  "Packages, built from the current directory and deployed to the Workspace or with --team to one Team:",
+  "  kitman deploy [--plan] [--team <team>]   (--plan prints what would change; deploying needs a clean tree)",
+  '  kitman dev <loop> "<words>" [--input <json>] [--team <team>]   (runs the working tree on your personal Runner)',
+  "  kitman package list [--team <team>]",
+  "  kitman package show <name> [--team <team>]",
+  "  kitman package remove <name> [--team <team>] [--yes]   (prints the plan; removes only with --yes)",
   "",
   "Every run, loop, agent, verify, constraint, secret, deploy, dev and package command takes --json."
 ].join(`
 `);
 var KitCreateValidator = guard(KitCreate);
 var KitUpdateValidator = guard(KitUpdate);
-var agentRuntime = promise(() => import("./chunk-s92k78ef.js"));
+var agentRuntime = promise(() => import("./chunk-m6yymqfr.js"));
 var TuiLauncher = Reference("kitman/cli/TuiLauncher", {
   defaultValue: () => gen(function* () {
     const tui = yield* tryPromise({
@@ -2023,6 +1651,8 @@ function runEffect(args) {
       yield* log(Usage);
       return;
     }
+    if (args[0] === "--version")
+      return yield* log(kitmanVersion ?? "dev");
     const [command, ...rest] = args;
     if (command === "init" && rest[0] === "--package")
       return yield* scaffoldPackage(rest[1] ?? ".");
@@ -2040,8 +1670,10 @@ function runEffect(args) {
       return yield* configCommand(args);
     if (command === "workspace")
       return yield* workspaceCommand(args);
-    if (command === "project")
-      return yield* projectCommand(args);
+    if (command === "team")
+      return yield* teamCommand(args);
+    if (command === "repo")
+      return yield* repoCommand(args);
     if (command === "runner")
       return yield* runnerCommand(args);
     if (command === "mcp")
@@ -2064,6 +1696,8 @@ function runEffect(args) {
       return yield* agentCommand(args);
     if (command === "run")
       return yield* runCommand(args);
+    if (command === "transcript")
+      return yield* transcriptCommand(["transcript", "read", ...rest]);
     if (command === "inbox")
       return yield* inboxCommand(args);
     if (command === "verify")
@@ -2099,6 +1733,10 @@ var isInteractiveTty = gen(function* () {
 });
 var tuiModulePath = "./tui/index";
 var solidTransformModulePath = "@opentui/solid/preload";
+var renamedOptions = new Map([
+  ["--project", "--team"],
+  ["--project-access", "--team-access"]
+]);
 function parseCommand(args) {
   const group = args[0];
   const action = args[1];
@@ -2179,18 +1817,16 @@ function parseCommand(args) {
       if (flags.closure !== undefined && flags.closure !== kind)
         throw new Error("run close takes one of --complete or --abandoned");
       flags.closure = kind;
-    } else if (arg === "--project" && group === "sync")
-      flags.projectScope = true;
-    else if (arg === "--runner") {
+    } else if (arg === "--team" && group === "sync")
+      flags.teamScope = true;
+    else if (arg === "--runner" || arg === "--credential-file") {
       const value = args[++index];
       if (!value)
         throw new Error(`${arg} requires a value`);
-      flags.runnerId = value;
-    } else if (arg === "--agent-identity") {
-      const value = args[++index];
-      if (!value)
-        throw new Error("--agent-identity requires a value");
-      flags.agentIdentityId = value;
+      if (arg === "--runner")
+        flags.runnerId = value;
+      else
+        flags.credentialFile = value;
     } else if (arg === "--iterations") {
       if (group === "runner" && action === "start")
         throw new Error("runner start accepts only a Runner identity");
@@ -2198,6 +1834,11 @@ function parseCommand(args) {
       if (!value)
         throw new Error("--iterations requires a value");
       flags.iterations = parsePositiveIntegerFlag("--iterations", value);
+    } else if (arg === "--attempt") {
+      const value = args[++index];
+      if (!value)
+        throw new Error("--attempt requires a value");
+      flags.attempt = parsePositiveIntegerFlag("--attempt", value);
     } else if (arg === "--poll-interval-ms") {
       if (group === "runner" && action === "start")
         throw new Error("runner start accepts only a Runner identity");
@@ -2268,7 +1909,7 @@ function parseCommand(args) {
       if (!value)
         throw new Error("--capabilities requires a value");
       flags.capabilities = validateAgentCapabilities(value);
-    } else if (arg === "--name" || arg === "--title" || arg === "--description" || arg === "--summary" || arg === "--rationale" || arg === "--kind" || arg === "--content" || arg === "--source" || arg === "--content-type" || arg === "--filename" || arg === "--session" || arg === "--project" || arg === "--workspace" || arg === "--branch" || arg === "--team" || arg === "--type" || arg === "--status" || arg === "--reason" || arg === "--dismiss" || arg === "--action" || arg === "--step-key" || arg === "--risk" || arg === "--target-type" || arg === "--scope-type" || arg === "--scope-id" || arg === "--project-access" || arg === "--provider" || arg === "--task" || arg === "--input" || arg === "--idempotency-key" || arg === "--key" || arg === "--after" || arg === "--version" || arg === "--alias" || arg === "--profile" || arg === "--event" || arg === "--cascade" || arg === "--run" || arg === "--run-id" || arg === "--replica" || arg === "--work-unit-kind" || arg === "--host" || arg === "--owner" || arg === "--repository-url" || arg === "--default-branch" || arg === "--expected-branch" || arg === "--expected-commit-sha" || arg === "--credential") {
+    } else if (arg === "--name" || arg === "--title" || arg === "--description" || arg === "--summary" || arg === "--rationale" || arg === "--kind" || arg === "--content" || arg === "--source" || arg === "--content-type" || arg === "--filename" || arg === "--session" || arg === "--team" || arg === "--workspace" || arg === "--branch" || arg === "--team" || arg === "--type" || arg === "--status" || arg === "--loop" || arg === "--state" || arg === "--reason" || arg === "--dismiss" || arg === "--action" || arg === "--step-key" || arg === "--step" || arg === "--risk" || arg === "--target-type" || arg === "--scope-type" || arg === "--scope-id" || arg === "--team-access" || arg === "--provider" || arg === "--task" || arg === "--input" || arg === "--idempotency-key" || arg === "--key" || arg === "--after" || arg === "--version" || arg === "--alias" || arg === "--profile" || arg === "--event" || arg === "--cascade" || arg === "--run" || arg === "--run-id" || arg === "--out" || arg === "--replica" || arg === "--work-unit-kind" || arg === "--host" || arg === "--owner" || arg === "--repository-url" || arg === "--default-branch" || arg === "--expected-branch" || arg === "--expected-commit-sha" || arg === "--credential" || arg === "--to") {
       const value = args[++index];
       if (!value)
         throw new Error(`${arg} requires a value`);
@@ -2294,25 +1935,27 @@ function parseCommand(args) {
         flags.filename = value;
       else if (arg === "--session")
         flags.sessionId = value;
-      else if (arg === "--project")
-        flags.project = value;
+      else if (arg === "--team")
+        flags.team = value;
       else if (arg === "--workspace")
         flags.workspace = value;
       else if (arg === "--branch")
         flags.branch = value;
-      else if (arg === "--team")
-        flags.team = value;
       else if (arg === "--type")
         flags.taskType = value;
       else if (arg === "--status")
         flags.status = value;
+      else if (arg === "--loop")
+        flags.loop = value;
+      else if (arg === "--state")
+        flags.states = validateRunDisplayStates(value);
       else if (arg === "--reason")
         flags.reason = value;
       else if (arg === "--dismiss")
         flags.dismiss = value;
       else if (arg === "--action")
         flags.fixFlowAction = validateFixFlowAction(value);
-      else if (arg === "--step-key")
+      else if (arg === "--step-key" || arg === "--step")
         flags.stepKey = value;
       else if (arg === "--target-type")
         flags.targetType = validateProposalTargetType(value);
@@ -2320,10 +1963,10 @@ function parseCommand(args) {
         flags.scopeType = value;
       else if (arg === "--scope-id")
         flags.scopeId = value;
-      else if (arg === "--project-access") {
+      else if (arg === "--team-access") {
         if (value !== "all" && value !== "selected")
-          throw new Error("--project-access must be all or selected");
-        flags.projectAccess = value;
+          throw new Error("--team-access must be all or selected");
+        flags.teamAccess = value;
       } else if (arg === "--provider")
         flags.provider = validateRepoBindingProvider(value);
       else if (arg === "--task")
@@ -2348,6 +1991,8 @@ function parseCommand(args) {
         flags.runId = value;
       else if (arg === "--run-id")
         flags.runId = value;
+      else if (arg === "--out")
+        flags.out = value;
       else if (arg === "--replica")
         flags.replicaId = value;
       else if (arg === "--work-unit-kind")
@@ -2364,9 +2009,13 @@ function parseCommand(args) {
         flags.expectedBranch = value;
       else if (arg === "--expected-commit-sha")
         flags.expectedCommitSha = value;
+      else if (arg === "--to")
+        flags.to = value;
       else
         flags.credentialRefs = [...flags.credentialRefs ?? [], parseRepoBindingCredentialRef(value)];
-    } else if (arg?.startsWith("--"))
+    } else if (arg !== undefined && renamedOptions.has(arg))
+      throw new Error(`${arg} is now ${renamedOptions.get(arg)}`);
+    else if (arg?.startsWith("--"))
       throw new Error(`Unknown option: ${arg}`);
     else if (arg)
       values.push(arg);
@@ -2382,7 +2031,7 @@ function syncCommand(args) {
       materializationPlans,
       configPlans,
       userConfigPlans,
-      projectConfigPlans,
+      teamConfigPlans,
       syncKits,
       outputPath,
       applied: shouldApply
@@ -2399,8 +2048,8 @@ function syncCommand(args) {
     else {
       yield* log(`Harness sync ${shouldApply ? "applied" : "preview"}.`);
       yield* log(`Workspace: ${plan.workspaceId}`);
-      if (plan.projectId)
-        yield* log(`Project: ${plan.projectId}`);
+      if (plan.teamId)
+        yield* log(`Team: ${plan.teamId}`);
       yield* log(`Harnesses: ${plan.harnesses.map((item) => item.harness).join(", ")}`);
       yield* log(`Secrets: ${plan.secrets}`);
       yield* log(`Plan path: ${outputPath}`);
@@ -2412,43 +2061,45 @@ function syncCommand(args) {
       for (const configPlan of userConfigPlans) {
         yield* log(`${configPlan.harness} user writes: ${configPlan.operations.map((operation) => operation.path).join(", ") || "none"}`);
       }
-      for (const configPlan of projectConfigPlans) {
-        yield* log(`${configPlan.harness} project writes: ${configPlan.operations.map((operation) => operation.path).join(", ") || "none"}`);
+      for (const configPlan of teamConfigPlans) {
+        yield* log(`${configPlan.harness} team writes: ${configPlan.operations.map((operation) => operation.path).join(", ") || "none"}`);
       }
     }
   });
 }
-function harnessSync(args) {
+function harnessSync(args, runnerClient) {
   const command = parseSyncCommand(args);
   return gen(function* () {
     const { applyAgentEnvironmentPlans, composeAgentEnvironmentSyncPlan, resolveAgentEnvironmentFromSources } = yield* agentRuntime;
     const { config } = yield* resolveCommandConfig(command.flags);
     if (!config.activeWorkspaceId)
       return yield* new CliError({ message: "No active workspace. Run kitman workspace use <workspace>." });
-    if (command.flags.projectScope && !config.activeProjectId)
+    if (command.flags.teamScope && !config.activeTeamId)
       return yield* new CliError({
-        message: "No active project. Run kitman project use <project> before project sync."
+        message: "No active team. Run kitman team use <team> before team sync."
       });
-    const activeProjectId = command.flags.projectScope ? config.activeProjectId : undefined;
-    const session = yield* sessionForApiWithRefresh(config.apiUrl);
-    if (!session)
-      return yield* new CliError({ message: `Not logged in for ${config.apiUrl}. Run kitman login.` });
-    const client = yield* clientFor(config.apiUrl, session);
+    const activeTeamId = command.flags.teamScope ? config.activeTeamId : undefined;
+    const client = runnerClient ?? (yield* gen(function* () {
+      const session = yield* sessionForApiWithRefresh(config.apiUrl);
+      if (!session)
+        return yield* new CliError({ message: `Not logged in for ${config.apiUrl}. Run kitman login.` });
+      return yield* clientFor(config.apiUrl, session);
+    }));
     const outputPath = yield* userHarnessSyncPath;
     const workspaceId = config.activeWorkspaceId;
     const selectedHarnesses = syncTargetHarnesses(command, config);
     const workspaceKits = yield* client.listKits(workspaceId).pipe(catchIf((error) => error.status === 404, () => succeed5({ items: Array() })));
-    const projectKits = activeProjectId === undefined ? { items: Array() } : yield* client.listProjectKits(activeProjectId, { workspaceId });
+    const teamKits = activeTeamId === undefined ? { items: Array() } : yield* client.listTeamKits(activeTeamId, { workspaceId });
     const userPreferences = config.userAgentPreferences;
     const syncKits = selectedHarnesses.map((harness) => resolveSyncKit({
       defaultHarness: harness,
       activeKits: syncKitActiveKits({
         workspaceId,
-        ...activeProjectId === undefined ? undefined : { projectId: activeProjectId },
+        ...activeTeamId === undefined ? undefined : { teamId: activeTeamId },
         ...userPreferences === undefined ? undefined : { userPreferences },
         harnesses: [harness],
         workspaceKits: workspaceKits.items,
-        projectKits: projectKits.items
+        teamKits: teamKits.items
       })
     }));
     const blockedSyncKit = syncKits.find((syncKit) => syncKit.status === "blocked");
@@ -2456,13 +2107,13 @@ function harnessSync(args) {
       return yield* new CliError({ message: `Sync Kit is blocked: ${blockedSyncKit.blockers.join("; ")}` });
     const fragments = syncFragments({
       workspaceId,
-      ...activeProjectId === undefined ? undefined : { projectId: activeProjectId },
+      ...activeTeamId === undefined ? undefined : { teamId: activeTeamId },
       userId: "default",
       workspaceKits: workspaceKits.items,
-      projectKits: projectKits.items
+      teamKits: teamKits.items
     });
-    const syncProfile = syncProfileForCommand(command, config, workspaceId, activeProjectId);
-    const projectContext = activeProjectId === undefined ? undefined : { workspaceId, projectId: activeProjectId };
+    const syncProfile = syncProfileForCommand(command, config, workspaceId, activeTeamId);
+    const teamContext = activeTeamId === undefined ? undefined : { workspaceId, teamId: activeTeamId };
     const environments = selectedHarnesses.map((harness) => {
       const environment = resolveAgentEnvironmentFromSources({
         userId: "default",
@@ -2470,27 +2121,27 @@ function harnessSync(args) {
         ...userPreferences === undefined ? undefined : { userPreferences },
         syncProfile,
         fragments,
-        ...projectContext === undefined ? undefined : { projectContext }
+        ...teamContext === undefined ? undefined : { teamContext }
       });
       return {
         ...environment,
         warnings: [
           ...environment.warnings,
-          ...(projectKits.policyOptOuts ?? []).map((optOut) => `Workspace-default Kit ${optOut.kitId} revision ${optOut.policyRevision} is opted out for this Project.`)
+          ...(teamKits.policyOptOuts ?? []).map((optOut) => `Workspace-default Kit ${optOut.kitId} revision ${optOut.policyRevision} is opted out for this Team.`)
         ]
       };
     });
-    const projectRoot = command.flags.projectScope ? yield* resolveProjectWriteRoot : undefined;
-    const targetPlans = yield* previewEnvironmentPlans(environments, command, projectRoot, config.mcpCredentialName, syncKits, (yield* readUserConfig()) ?? {});
+    const teamRoot = command.flags.teamScope ? yield* resolveTeamWriteRoot : undefined;
+    const targetPlans = yield* previewEnvironmentPlans(environments, command, teamRoot, config.mcpCredentialName, syncKits, (yield* readUserConfig()) ?? {});
     const environmentPlan = composeAgentEnvironmentSyncPlan(targetPlans);
     const materializationPlans = targetPlans.map((target) => target.skills);
-    const userConfigPlans = command.flags.projectScope ? [] : targetPlans.map((target) => target.harnessConfig);
-    const projectConfigPlans = projectRoot === undefined ? [] : targetPlans.map((target) => target.harnessConfig);
-    const configPlans = [...userConfigPlans, ...projectConfigPlans];
+    const userConfigPlans = command.flags.teamScope ? [] : targetPlans.map((target) => target.harnessConfig);
+    const teamConfigPlans = teamRoot === undefined ? [] : targetPlans.map((target) => target.harnessConfig);
+    const configPlans = [...userConfigPlans, ...teamConfigPlans];
     const plan = buildHarnessSyncPlan({
       apiUrl: config.apiUrl,
       workspaceId,
-      ...activeProjectId === undefined ? undefined : { projectId: activeProjectId },
+      ...activeTeamId === undefined ? undefined : { teamId: activeTeamId },
       harnesses: selectedHarnesses,
       outputPath,
       materializationPlans,
@@ -2508,7 +2159,7 @@ function harnessSync(args) {
       materializationPlans: resultPlan.targets.map((target) => target.skills),
       configPlans,
       userConfigPlans,
-      projectConfigPlans,
+      teamConfigPlans,
       syncKits,
       outputPath,
       applied
@@ -2541,12 +2192,12 @@ function syncTargetHarnesses(command, config) {
     return [config.userAgentPreferences.defaultHarness];
   return AgentHarnessIds;
 }
-function syncProfileForCommand(command, config, workspaceId, projectId) {
+function syncProfileForCommand(command, config, workspaceId, teamId) {
   const harnesses = [...syncTargetHarnesses(command, config)];
   const existing = config.agentSyncProfile;
   const sources = existing?.sources ?? [
     { kind: "personal_kit_defaults", enabled: true },
-    ...projectId === undefined ? [] : [{ kind: "project_kits", projectId, enabled: true }]
+    ...teamId === undefined ? [] : [{ kind: "team_kits", teamId, enabled: true }]
   ];
   return {
     id: existing?.id ?? "default",
@@ -2559,7 +2210,7 @@ function syncProfileForCommand(command, config, workspaceId, projectId) {
 }
 function syncKitActiveKits(input) {
   const legacyKit = (kit, scope, index) => {
-    const active = scope === "project" ? true : isInstallDefaultKit(kit) || input.harnesses.some((harness) => kitEnabledForHarness(input.userPreferences, harness, kit.id));
+    const active = scope === "team" ? true : isInstallDefaultKit(kit) || input.harnesses.some((harness) => kitEnabledForHarness(input.userPreferences, harness, kit.id));
     const metadata = kit.metadata ?? {};
     const version = isString2(metadata.version) && metadata.version.length > 0 ? metadata.version : "legacy";
     return {
@@ -2568,11 +2219,11 @@ function syncKitActiveKits(input) {
         kitRef: `kit:${kit.slug}`,
         version,
         sha256: digestSha256(encodeUnknownJsonStringSync(kit), "hex"),
-        precedence: scope === "project" ? 20 + index : 10 + index
+        precedence: scope === "team" ? 20 + index : 10 + index
       },
       activation: {
         activationId: `legacy:${kit.id}:${scope}`,
-        activationType: scope === "project" ? "project_attachment" : "personal_default"
+        activationType: scope === "team" ? "team_attachment" : "personal_default"
       },
       enabled: active,
       gates: kit.agentEnvironment === undefined ? [] : [
@@ -2586,7 +2237,7 @@ function syncKitActiveKits(input) {
   };
   return [
     ...input.workspaceKits.map((kit, index) => legacyKit(kit, "workspace", index)),
-    ...input.projectId === undefined ? [] : input.projectKits.map((kit, index) => legacyKit(kit, "project", index))
+    ...input.teamId === undefined ? [] : input.teamKits.map((kit, index) => legacyKit(kit, "team", index))
   ];
 }
 function syncFragments(input) {
@@ -2607,27 +2258,27 @@ function syncFragments(input) {
       fragment: kit.agentEnvironment
     });
   }
-  for (const kit of input.projectKits) {
-    if (kit.agentEnvironment === undefined || input.projectId === undefined)
+  for (const kit of input.teamKits) {
+    if (kit.agentEnvironment === undefined || input.teamId === undefined)
       continue;
     fragments.push({
-      sourceKind: "project_kit",
+      sourceKind: "team_kit",
       workspaceId: input.workspaceId,
-      projectId: input.projectId,
+      teamId: input.teamId,
       source: {
-        kind: "project_kit",
+        kind: "team_kit",
         kitId: kit.id,
         label: kit.name,
-        ...projectKitPolicyMetadata(kit),
-        ...kitSourceMetadata(kit, "project_attachment")
+        ...teamKitPolicyMetadata(kit),
+        ...kitSourceMetadata(kit, "team_attachment")
       },
       fragment: kit.agentEnvironment
     });
   }
   return fragments;
 }
-function projectKitPolicyMetadata(kit) {
-  const attachment = kit.projectAttachment;
+function teamKitPolicyMetadata(kit) {
+  const attachment = kit.teamAttachment;
   if (attachment === undefined)
     return {};
   return {
@@ -2652,14 +2303,14 @@ function isInstallDefaultKit(kit) {
   const rollout = isObject(marketplace) && marketplace !== null && "rollout" in marketplace ? marketplace.rollout : undefined;
   return isObject(rollout) && rollout !== null && "installDefault" in rollout && rollout.installDefault === true;
 }
-function previewEnvironmentPlans(environments, command, projectRoot, mcpCredentialName, syncKits = [], userConfig = {}) {
+function previewEnvironmentPlans(environments, command, teamRoot, mcpCredentialName, syncKits = [], userConfig = {}) {
   const previews = forEach(environments, (environment, index) => gen(function* () {
-    const rootDir = command.flags.projectScope ? projectRoot : getOrUndefined(yield* option2(String3("HOME")));
+    const rootDir = command.flags.teamScope ? teamRoot : getOrUndefined(yield* option2(String3("HOME")));
     const { previewAgentEnvironmentPlan } = yield* agentRuntime;
     return yield* previewAgentEnvironmentPlan({
       environment,
       ...syncKits[index] === undefined ? undefined : { syncKit: syncKits[index] },
-      scope: command.flags.projectScope ? "project" : "user",
+      scope: command.flags.teamScope ? "project" : "user",
       ...rootDir === undefined ? undefined : { rootDir },
       ...command.flags.noInstall === undefined ? undefined : { noInstall: command.flags.noInstall },
       ...userConfig.approvedSkillSources === undefined ? undefined : { approvedSkillSources: userConfig.approvedSkillSources },
@@ -2806,14 +2457,14 @@ function mixedKitState(kit, harnesses, preferences) {
     return "disabled";
   return "mixed";
 }
-var resolveProjectWriteRoot = gen(function* () {
+var resolveTeamWriteRoot = gen(function* () {
   const fs = yield* FileSystem;
   const path = yield* Path;
   const cwd = path.resolve(".");
   if ((yield* fs.exists(path.join(cwd, ".git"))) || (yield* fs.exists(path.join(cwd, ".kitman/config.json"))))
     return cwd;
   return yield* new CliError({
-    message: "Project sync requires a repo root or local project config in the current working directory."
+    message: "Team sync requires a repo root or local team config in the current working directory."
   });
 });
 function parseHarnesses(values) {
@@ -2940,7 +2591,7 @@ function whoami(args) {
       user: "userId" in me ? me.userId : me.actorId,
       apiUrl,
       activeWorkspace: me.activeWorkspaceId ?? config.activeWorkspaceId ?? me.workspaceId ?? null,
-      activeProject: config.activeProjectId ?? null,
+      activeTeam: config.activeTeamId ?? null,
       workspaceRole: me.workspaceRole ?? null,
       credentialType: me.credentialType,
       tokenExpires: session.expiresAt ?? null
@@ -2952,7 +2603,7 @@ function whoami(args) {
     yield* log(`User: ${output.user}`);
     yield* log(`API URL: ${output.apiUrl}`);
     yield* log(`Active workspace: ${output.activeWorkspace ?? "none"}`);
-    yield* log(`Active project: ${output.activeProject ?? "none"}`);
+    yield* log(`Active team: ${output.activeTeam ?? "none"}`);
     yield* log(`Workspace role: ${output.workspaceRole ?? "unknown"}`);
     yield* log(`Credential type: ${output.credentialType}`);
     yield* log(`Token expires: ${output.tokenExpires ?? "unknown"}`);
@@ -2968,7 +2619,7 @@ function configCommand(args) {
     const output = {
       apiUrl: normalizeResolvedApiUrl(config.apiUrl),
       activeWorkspace: config.activeWorkspaceId ?? null,
-      activeProject: config.activeProjectId ?? null,
+      activeTeam: config.activeTeamId ?? null,
       sources: resolved.sources,
       userConfigPath: resolved.userConfigPath,
       ...resolved.localConfigPath ? { localConfigPath: resolved.localConfigPath } : undefined
@@ -2982,8 +2633,8 @@ function configCommand(args) {
         "API URL": output.apiUrl,
         "Active workspace": output.activeWorkspace ?? "none",
         "Active workspace source": output.sources.activeWorkspace,
-        "Active project": output.activeProject ?? "none",
-        "Active project source": output.sources.activeProject,
+        "Active team": output.activeTeam ?? "none",
+        "Active team source": output.sources.activeTeam,
         "API URL source": output.sources.apiUrl,
         "User config path": output.userConfigPath,
         ...output.localConfigPath ? { "Local config path": output.localConfigPath } : undefined
@@ -3028,52 +2679,80 @@ function workspaceCommand(args) {
     return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
   });
 }
-function projectCommand(args) {
+function teamCommand(args) {
   return gen(function* () {
     const command = parseCommand(args);
     const apiUrl = yield* resolveApiUrl(command.flags.apiUrl);
-    const session = yield* requiredSessionForApi(apiUrl);
-    const client = yield* clientFor(apiUrl, session);
-    if (command.action === "list") {
-      const workspaceId = yield* activeWorkspaceId(command.flags);
-      const projects = yield* client.listProjects(workspaceId);
-      return yield* printRows(projects.items.map(projectRow), command.flags.json);
-    }
-    if (command.action === "create") {
-      const workspaceId = yield* activeWorkspaceId(command.flags);
-      const name = requiredArg(command, "project name");
-      const project = yield* client.createProject(workspaceId, { name });
-      yield* writeActiveProject(apiUrl, project.workspaceId, project.id);
-      return yield* printRows([projectRow(project)], command.flags.json);
-    }
-    if (command.action === "show") {
-      const projectRef = requiredArg(command, "project");
-      const workspaceId = yield* optionalActiveWorkspaceId(command.flags);
-      const project = yield* client.getProject(projectRef, workspaceId ? { workspaceId } : undefined);
-      return yield* printRows([projectRow(project)], command.flags.json);
-    }
+    const client = yield* clientFor(apiUrl, yield* requiredSessionForApi(apiUrl));
+    const workspaceId = yield* activeWorkspaceId(command.flags);
+    if (command.action === "list")
+      return yield* printRows((yield* client.listTeams(workspaceId)).items.map(teamRow), command.flags.json);
     if (command.action === "use") {
-      const projectRef = requiredArg(command, "project");
-      const workspaceId = yield* optionalActiveWorkspaceId(command.flags);
-      const project = yield* client.getProject(projectRef, workspaceId ? { workspaceId } : undefined);
-      yield* writeActiveProject(apiUrl, project.workspaceId, project.id, command.flags.local);
+      const team = yield* teamNamed(client, workspaceId, requiredArg(command, "team"));
+      yield* writeActiveTeam(apiUrl, workspaceId, team.id, command.flags.local);
       if (command.flags.json)
-        return yield* printRows([projectRow(project)], true);
-      yield* log(`Active project: ${project.name}`);
+        return yield* printRows([teamRow(team)], true);
+      yield* log(`Active team: ${team.name}`);
       return;
     }
-    if (command.action === "repo-bindings") {
-      const projectRef = command.args[0] ?? (yield* activeProjectId(command.flags));
-      const repoBindings = yield* client.listRepoBindings(projectRef);
+    if (command.action === "private" || command.action === "open") {
+      const team = yield* teamNamed(client, workspaceId, requiredArg(command, "team"));
+      const visibility = command.action === "private" ? "private" : "workspace";
+      yield* client.updateTeam(workspaceId, team.id, { visibility });
+      return yield* log(visibility === "private" ? `${team.key} is private: only its members see it` : `${team.key} is open to the Workspace`);
+    }
+    if (command.action === "invite") {
+      const team = yield* teamNamed(client, workspaceId, requiredArg(command, "team"));
+      const userId = command.args[1];
+      if (userId === undefined)
+        return yield* new CliError({ message: "team invite requires <team> <person>" });
+      yield* client.addTeamMember(workspaceId, team.id, { userId });
+      return yield* log(`Invited ${userId} to ${team.key}`);
+    }
+    return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
+  });
+}
+var teamIn = (teams, ref) => {
+  const team = teams.find((candidate) => candidate.id === ref || candidate.key === ref.toUpperCase());
+  return team === undefined ? fail4(new CliError({ message: `No Team ${ref} in the Workspace` })) : succeed5(team);
+};
+var teamNamed = (client, workspaceId, ref) => flatMap2(client.listTeams(workspaceId), (teams) => teamIn(teams.items, ref));
+var ownerTo = (client, workspaceId, command) => gen(function* () {
+  const to = command.flags.to;
+  if (to === undefined)
+    return yield* new CliError({ message: `${command.group} move requires --to <team> or --to workspace` });
+  if (to === "workspace")
+    return { change: { team: null }, label: "the Workspace" };
+  const team = yield* teamNamed(client, workspaceId, to);
+  return { change: { team: team.id }, label: team.key };
+});
+var printMoved = (command, moved, label) => command.flags.json ? printJson(moved) : log(`Moved ${moved.id} to ${label}`);
+function repoCommand(args) {
+  return gen(function* () {
+    const command = parseCommand(args);
+    const apiUrl = yield* resolveApiUrl(command.flags.apiUrl);
+    const client = yield* clientFor(apiUrl, yield* requiredSessionForApi(apiUrl));
+    const workspaceId = yield* activeWorkspaceId(command.flags);
+    const teams = (yield* client.listTeams(workspaceId)).items;
+    const ownerOf = (teamId) => teams.find((team) => team.id === teamId)?.key ?? "Workspace";
+    if (command.action === "list") {
+      const repoBindings = yield* client.listRepoBindings(workspaceId);
       if (command.flags.json)
         return yield* printJson(repoBindings);
-      return yield* printRows(repoBindings.items.map(repoBindingRow), false);
+      return yield* printRows(repoBindings.items.map((binding) => ({ ...repoBindingRow(binding), team: ownerOf(binding.teamId) })), false);
     }
-    if (command.action === "add-repo-binding") {
-      const projectRef = command.args[0] ?? (yield* activeProjectId(command.flags));
+    if (command.action === "add") {
+      const team = command.flags.team === undefined ? undefined : yield* teamIn(teams, command.flags.team);
       const input = command.flags.fromCurrentRepo === true ? yield* repoBindingInputFromCurrentRepo : repoBindingInput2(command);
-      const repoBinding = yield* client.createRepoBinding(projectRef, input);
-      return yield* printRows([repoBindingRow(repoBinding)], command.flags.json);
+      const repoBinding = yield* client.createRepoBinding(workspaceId, {
+        ...input,
+        ...team === undefined ? undefined : { teamId: team.id }
+      });
+      return yield* printRows([{ ...repoBindingRow(repoBinding), team: ownerOf(repoBinding.teamId) }], command.flags.json);
+    }
+    if (command.action === "move") {
+      const owner = yield* ownerTo(client, workspaceId, command);
+      return yield* printMoved(command, yield* client.moveRepoBinding(workspaceId, requiredArg(command, "a repository"), owner.change), owner.label);
     }
     return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
   });
@@ -3104,7 +2783,30 @@ function runnerCommand(args) {
         yield* log(`Runner bootstrap prepared for ${output.profile}; no canonical state was created.`);
       return;
     }
+    if (command.action === "start") {
+      if (command.flags.backend !== undefined)
+        return yield* new CliError({ message: "runner start accepts only a Runner identity" });
+      const teamId = command.flags.team === undefined ? undefined : { teamId: command.flags.team };
+      const credentialFile = command.flags.credentialFile ?? getOrUndefined(yield* option2(String3("KITMAN_RUNNER_CREDENTIAL_FILE")));
+      if (credentialFile !== undefined)
+        return yield* startCanonicalHerdrRunnerCommand({
+          ...yield* readRunnerCredentialFile(credentialFile),
+          ...teamId
+        });
+      return yield* startCanonicalHerdrRunnerCommand({
+        apiUrl: yield* resolveApiUrl(command.flags.apiUrl),
+        runnerId: command.flags.runnerId ?? requiredArg(command, "Runner"),
+        ...teamId
+      });
+    }
     const apiUrl = yield* resolveApiUrl(command.flags.apiUrl);
+    if (command.action === "status" || command.action === "logs" || command.action === "restart" || command.action === "remove") {
+      const runnerId = command.flags.runnerId ?? command.args[0];
+      return yield* machineRunnerCommand(command.action, apiUrl, {
+        follow: command.flags.follow === true,
+        ...runnerId === undefined ? undefined : { runnerId }
+      });
+    }
     const session = yield* requiredSessionForApi(apiUrl);
     const workspaceId = yield* activeWorkspaceId(command.flags);
     const client = yield* clientFor(apiUrl, session);
@@ -3144,21 +2846,21 @@ function runnerCommand(args) {
         return yield* new CliError({ message: "runner grant requires add, list, or remove and --runner <runner-id>" });
       const runner = yield* resolveRunnerForCommand(client, workspaceId, runnerRef);
       if (grantAction === "list") {
-        const response = yield* client.listRunnerProjectGrants(runner.id);
+        const response = yield* client.listRunnerTeamGrants(runner.id);
         return yield* printRows(response.items.map((grant) => ({
           id: grant.id,
           runnerId: grant.runnerId,
           workspaceId: grant.workspaceId,
-          projectId: grant.projectId,
+          teamId: grant.teamId,
           createdAt: grant.createdAt
         })), command.flags.json);
       }
       if (grantAction === "add" || grantAction === "remove") {
-        const projectId = command.flags.project ?? command.flags.scopeId ?? command.args[2];
-        if (!projectId)
-          return yield* new CliError({ message: `runner grant ${grantAction} requires --project <project-id>` });
+        const teamId = command.flags.team ?? command.flags.scopeId ?? command.args[2];
+        if (!teamId)
+          return yield* new CliError({ message: `runner grant ${grantAction} requires --team <team-id>` });
         if (grantAction === "add") {
-          const response = yield* client.addRunnerProjectGrant(runner.id, { projectId });
+          const response = yield* client.addRunnerTeamGrant(runner.id, { teamId });
           if (command.flags.json)
             return yield* printJson(response);
           return yield* printRows([
@@ -3166,15 +2868,15 @@ function runnerCommand(args) {
               id: response.id,
               runnerId: response.runnerId,
               workspaceId: response.workspaceId,
-              projectId: response.projectId,
+              teamId: response.teamId,
               status: "granted"
             }
           ], false);
         }
-        const response = yield* client.removeRunnerProjectGrant(runner.id, projectId);
+        const response = yield* client.removeRunnerTeamGrant(runner.id, teamId);
         if (command.flags.json)
           return yield* printJson(response);
-        return yield* printRows([{ runnerId: runner.id, projectId, status: response.removed ? "removed" : "not_found" }], false);
+        return yield* printRows([{ runnerId: runner.id, teamId, status: response.removed ? "removed" : "not_found" }], false);
       }
       return yield* new CliError({ message: `Unknown runner grant action: ${grantAction}` });
     }
@@ -3187,9 +2889,8 @@ function runnerCommand(args) {
       const ownership = runnerOwnershipFromCommand(command, false);
       const response = yield* client.registerRunner(workspaceId, {
         name,
-        ...command.flags.agentIdentityId === undefined ? undefined : { agentIdentityId: command.flags.agentIdentityId },
         ...ownership === undefined ? undefined : { ownership },
-        ...command.flags.project === undefined ? undefined : { projectId: command.flags.project },
+        ...command.flags.team === undefined ? undefined : { teamId: command.flags.team },
         capabilities: herdr ? (yield* agentRuntime).herdrRunnerCapabilities({ harnesses: yield* (yield* agentRuntime).detectHarnesses }) : loopRunnerCapabilities(),
         labels: herdr ? ["kitman-runner", "kitman-loop", "herdr"] : ["kitman-runner", "kitman-loop"]
       });
@@ -3213,26 +2914,11 @@ function runnerCommand(args) {
       const runnerRef = command.flags.runnerId ?? requiredArg(command, "Runner");
       const runner = yield* resolveRunnerForCommand(client, workspaceId, runnerRef);
       const response = yield* client.heartbeatRunner(runner.id, {
-        healthStatus: "healthy",
         capabilities: runner.capabilities,
         labels: runner.labels
       });
       return yield* printRows([runnerRow(response)], command.flags.json);
     }
-    if (command.action === "start") {
-      if (command.flags.backend !== undefined)
-        return yield* new CliError({ message: "runner start accepts only a Runner identity" });
-      const runnerRef = command.flags.runnerId ?? requiredArg(command, "Runner");
-      const runner = yield* resolveRunnerForCommand(client, workspaceId, runnerRef);
-      return yield* startCanonicalHerdrRunnerCommand({
-        apiUrl,
-        accessToken: session.accessToken,
-        workspaceId,
-        ...command.flags.project === undefined ? undefined : { projectId: command.flags.project },
-        runner,
-        client
-      });
-    }
     if (command.action === "doctor") {
       const runners = yield* client.listRunners(workspaceId);
       if (command.flags.runnerId === undefined && command.args.length === 0 && command.flags.backend === undefined)
@@ -3256,6 +2942,16 @@ function runnerCommand(args) {
 var SandboxHostProbe = Reference("kitman/cli/SandboxHostProbe", {
   defaultValue: () => flatMap2(agentRuntime, (runtime) => runtime.commandHostProbe)
 });
+var OpenRunnerRpc = Reference("kitman/cli/OpenRunnerRpc", {
+  defaultValue: () => (options) => gen(function* () {
+    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-nmgr9w6v.js"));
+    return yield* makeRunnerRpcClient({
+      runnerId: options.runnerId,
+      bearer: options.bearer,
+      protocol: runnerWebSocketProtocol(runnerRpcUrl(options.apiUrl))
+    });
+  })
+});
 var runnerSettings = gen(function* () {
   const optional = (name) => String3(name).pipe(option2, map3((value) => getOrUndefined(value)?.trim()));
   const concurrency = Number(yield* optional("KITMAN_RUNNER_CONCURRENCY")) || 1;
@@ -3310,27 +3006,40 @@ function startCanonicalHerdrRunnerCommand(input) {
       superviseReplica,
       verificationExecutor
     } = yield* agentRuntime;
-    const { makeRunnerRpcClient, runnerRpcUrl, runnerWebSocketProtocol } = yield* promise(() => import("./chunk-5cc3fb7y.js"));
+    const openRunnerRpc = yield* OpenRunnerRpc;
     const settings = yield* runnerSettings;
     const { concurrency, fullAccess, sshAgentAvailable } = settings;
-    const personal = input.runner.ownership.kind === "personal";
-    const host = yield* probeSandboxHost(yield* yield* SandboxHostProbe, undefined, settings.dockerImage === undefined ? {} : { dockerImage: settings.dockerImage });
+    const fs = yield* FileSystem;
+    const container = input.credential !== undefined || (yield* fs.exists("/.dockerenv").pipe(orElseSucceed(() => false))) || (yield* fs.exists("/run/.containerenv").pipe(orElseSucceed(() => false)));
+    const reported = { ...kitmanVersion === undefined ? undefined : { version: kitmanVersion }, container };
+    const credential = input.credential ?? (yield* startupStep("load the Runner credential", "10 seconds", storedHerdrRunnerCredential(input.apiUrl, input.runnerId)));
+    if (credential === undefined)
+      return yield* new RunnerStopped({ problem: credentialMissing(input.runnerId) });
+    const controlPlane = yield* createHerdrRunnerClient({ apiUrl: input.apiUrl, runnerId: input.runnerId, credential });
+    const runner = yield* startupStep("first heartbeat", "30 seconds", stopOnRefusal(controlPlane.client.heartbeatRunner(input.runnerId, reported)));
+    const personal = runner.ownership.kind === "personal";
+    const host = yield* startupStep("check the sandbox", "30 seconds", probeSandboxHost(yield* yield* SandboxHostProbe, undefined, settings.dockerImage === undefined ? {} : { dockerImage: settings.dockerImage }));
     const sandbox = personal ? settings.sandbox : host.backends.includes("docker") ? "docker" : "srt";
-    if (personal && !host.backends.includes(sandbox))
-      return yield* new CliError({
-        message: `\`${sandbox}\` is not available on this host (${host.unavailable.find((entry) => entry.backend === sandbox)?.missing.join("; ") ?? "unsupported"}); unset KITMAN_RUNNER_SANDBOX to run agents on the host.`
-      });
-    const repoBinding = input.projectId === undefined ? undefined : (yield* input.client.listRepoBindings(input.projectId)).items.find((binding) => binding.status === "active");
+    if (personal && sandbox !== "host" && !host.backends.includes(sandbox)) {
+      const problem = sandboxMissing(sandbox, host.unavailable.find((entry) => entry.backend === sandbox)?.missing ?? ["unsupported"]);
+      yield* startupStep("report the Runner Problem", "30 seconds", stopOnRefusal(controlPlane.client.heartbeatRunner(input.runnerId, { ...reported, problems: [problem] })));
+      return yield* new RunnerStopped({ problem });
+    }
+    const teamId = input.teamId;
+    const repoBinding = teamId === undefined ? undefined : (yield* startupStep("read the repo binding", "30 seconds", controlPlane.client.listRepoBindings(runner.workspaceId))).items.find((binding) => binding.status === "active" && binding.teamId === teamId);
     const harnesses = yield* detectHarnesses;
     if (harnesses.harnesses.length > 0)
       yield* harnessSync([
         "sync",
         ...harnesses.harnesses.map((harness) => harness === "claude" ? "claude-code" : harness),
         "--workspace",
-        input.workspaceId,
+        runner.workspaceId,
         "--api-url",
         input.apiUrl
-      ]).pipe(catch_((error2) => error(`Harness sync failed; the Runner starts on the previous one: ${error2.message}`)));
+      ], controlPlane.client).pipe(timeoutOrElse({
+        duration: "60 seconds",
+        orElse: () => fail4(new CliError({ message: "harness sync did not finish within 60 seconds" }))
+      }), catch_((error2) => error(`Harness sync failed; the Runner starts on the previous one: ${error2.message}`)));
     const advertisedCapabilities = repoBinding === undefined ? herdrRunnerCapabilities({ harnesses, fullAccess, sandbox: host, shared: !personal }) : herdrRunnerCapabilitiesForRepoBinding(repoBinding, {
       harnesses,
       fullAccess,
@@ -3343,23 +3052,16 @@ function startCanonicalHerdrRunnerCommand(input) {
       resourceLimits: { ...advertisedCapabilities.resourceLimits, maxConcurrentRuns: concurrency }
     };
     assertHerdrRunnerCapability(capabilities);
-    const credential = yield* ensureHerdrRunnerCredential({
-      apiUrl: input.apiUrl,
-      accessToken: input.accessToken,
-      runner: input.runner
-    });
-    const controlPlane = yield* createHerdrRunnerClient({ apiUrl: input.apiUrl, runnerId: input.runner.id, credential });
-    const fs = yield* FileSystem;
     const path = yield* Path;
     const runnerRootDir = yield* herdrRunnerRootDir;
     yield* fs.makeDirectory(path.join(runnerRootDir, ".kitman", "worktrees"), { recursive: true });
     yield* fs.makeDirectory(bundleCacheDir, { recursive: true });
-    const replica = yield* controlPlane.client.registerRunnerReplica(input.runner.id, {
+    const replica = yield* startupStep("register the replica", "30 seconds", stopOnRefusal(controlPlane.client.registerRunnerReplica(input.runnerId, {
       name: `replica-${createId()}`,
       capacity: { maxConcurrentRuns: concurrency },
       telemetry: { activeWorkUnits: 0 }
-    });
-    const backend = herdrExecutorSurface({ runnerId: input.runner.id, session: personal ? "default" : "own" });
+    })));
+    const backend = herdrExecutorSurface({ runnerId: input.runnerId, session: personal ? "default" : "own" });
     const uid = process.getuid?.();
     const gid = process.getgid?.();
     const docker = host.backends.includes("docker") && settings.dockerImage !== undefined ? {
@@ -3370,41 +3072,46 @@ function startCanonicalHerdrRunnerCommand(input) {
     const root = herdrAgentBackendLayer({
       client: () => backend.executionClient,
       sandboxBackends: host.backends,
-      ...docker === undefined ? undefined : { docker: { ...docker, runnerId: input.runner.id } }
-    }).pipe(provide2(herdrHarnessLayer({ client: () => backend.executionClient })), provide2(layer10));
+      ...docker === undefined ? undefined : { docker: { ...docker, runnerId: input.runnerId } }
+    }).pipe(provide2(herdrHarnessLayer({ client: () => backend.executionClient })), provide2(layer));
     const activeSlots = new Set;
+    let claimsInFlight = 0;
+    const updater = runnerUpdater({
+      apiUrl: input.apiUrl,
+      runnerId: input.runnerId,
+      platform: process.platform,
+      inFlight: sync(() => activeSlots.size + claimsInFlight)
+    });
     return yield* gen(function* () {
       const agentBackend = yield* AgentBackend;
       const spawner = yield* ChildProcessSpawner;
-      yield* controlPlane.client.heartbeatRunner(input.runner.id, {
-        healthStatus: "healthy",
-        capabilities,
-        labels: input.runner.labels
-      });
-      yield* controlPlane.client.heartbeatRunnerReplica(input.runner.id, replica.id, {
+      yield* startupStep("heartbeat", "30 seconds", stopOnRefusal(controlPlane.client.heartbeatRunner(input.runnerId, { ...reported, problems: [], capabilities, labels: runner.labels }).pipe(andThen(controlPlane.client.heartbeatRunnerReplica(input.runnerId, replica.id, {
         healthStatus: "healthy",
         drainState: "accepting",
         capacity: { maxConcurrentRuns: concurrency },
         telemetry: { activeWorkUnits: 0 }
-      });
+      })))));
       return yield* scoped(gen(function* () {
-        const rpc = yield* makeRunnerRpcClient({
-          runnerId: input.runner.id,
-          bearer: controlPlane.rpcBearer.pipe(provideService(Crypto, yield* Crypto)),
-          protocol: runnerWebSocketProtocol(runnerRpcUrl(input.apiUrl))
-        });
+        const rpc = yield* startupStep("open the Runner RPC", "30 seconds", stopOnRefusal(openRunnerRpc({
+          apiUrl: input.apiUrl,
+          runnerId: input.runnerId,
+          bearer: controlPlane.rpcBearer.pipe(provideService(Crypto, yield* Crypto))
+        }).pipe(tap((opened) => opened.settledRuns([])))));
         const signals = yield* makeReplicaSignals;
         const bundles = yield* kitmanBundles({
           fetch: (digest) => rpc.bundle(digest).pipe(map3((found) => found.bundle))
         });
         const checkouts = runCheckouts(path.join(runnerRootDir, ".kitman"));
         const platform = yield* context();
+        const updated = yield* make5();
+        const scope2 = yield* scope;
         yield* listenForSignals({
           rpc,
           runnerReplicaId: replica.id,
           signals,
           checkouts,
-          reconnectAfter: "2 seconds"
+          reconnectAfter: "2 seconds",
+          update: (version) => container ? void_2 : updater.update(version).pipe(catch_((error) => fail3(updated, error)), provideContext(platform), forkIn(scope2), asVoid)
         }).pipe(forkScoped);
         const authStore = yield* userAuthPath;
         const runnerState = {
@@ -3415,7 +3122,7 @@ function startCanonicalHerdrRunnerCommand(input) {
         };
         const sharedSandbox = personal ? undefined : {
           runner: runnerState,
-          ...docker !== undefined ? { backend: "docker", docker, runnerId: input.runner.id } : { backend: host.backends.includes("srt") ? "srt" : undefined }
+          ...docker !== undefined ? { backend: "docker", docker, runnerId: input.runnerId } : { backend: host.backends.includes("srt") ? "srt" : undefined }
         };
         const runPackageProgram = programProcessExecutor({
           bundles,
@@ -3430,12 +3137,14 @@ function startCanonicalHerdrRunnerCommand(input) {
           preflight: (mcp) => kitmanMcpPreflight(mcp).pipe(provideService(ChildProcessSpawner, spawner))
         });
         const heartbeatOf = (work) => rpc.heartbeat({ workUnitId: work.id, lease: leaseOf(work) });
+        const storage = yield* provide3(service(HttpClient), layer2);
         const runAgentStep = agentStepExecutor({
           rootDir: path.join(runnerRootDir, ".kitman"),
           heartbeat: heartbeatOf,
-          checkpoints: rpcStepCheckpoints(rpc, signals),
-          runAgent: (work, worktree, session) => agentBackend.execute({
-            runnerId: input.runner.id,
+          checkpoints: rpcStepCheckpoints(rpc, signals, storage),
+          transcripts: (work, entries) => rpc.appendTranscript({ workUnitId: work.id, entries }),
+          runAgent: (work, worktree, session, steered) => agentBackend.execute({
+            runnerId: input.runnerId,
             sharedRunner: !personal,
             attempt: runnerStepAttemptFromAgentStep(work),
             workspace: { path: worktree },
@@ -3451,38 +3160,49 @@ function startCanonicalHerdrRunnerCommand(input) {
             settled: heartbeatOf(work).pipe(map3((state) => state.settled || state.outputSubmitted === true)),
             steering: {
               ...signals.steers(work.id),
-              report: (note, delivered) => rpc.reportSteer({ workUnitId: work.id, messageId: note.messageId, delivered }).pipe(catch_((error) => logWarning("runner_steer_report_failed", error.message)))
+              report: (note, delivered) => andThen(delivered ? steered(note) : void_2, rpc.reportSteer({ workUnitId: work.id, messageId: note.messageId, delivered }).pipe(catch_((error) => logWarning("runner_steer_report_failed", error.message))))
             }
           }).pipe(catch_((refusal) => succeed5({ status: "failed", reason: refusal.reason, summary: refusal.summary })), map3(agentStepRunOutcome))
         });
         const runVerification = verificationExecutor({
           rootDir: path.join(runnerRootDir, ".kitman"),
           known: rpcKnownEvidence(rpc),
+          runFiles: { client: rpc, storage },
           ...sharedSandbox === undefined ? undefined : { sandbox: { ...sharedSandbox, apiUrl: input.apiUrl } }
         });
         yield* acquireRelease(backend.start(), () => backend.stop());
         const control = (capacitySlot) => ({
-          claim: () => rpc.claim({
-            ...input.projectId === undefined ? undefined : { projectId: input.projectId },
-            runnerReplicaId: replica.id,
-            capacitySlot,
-            idempotencyKey: `${replica.id}:${createId()}`
-          }).pipe(tap((result) => sync(() => result.workUnit === undefined ? activeSlots.delete(capacitySlot) : activeSlots.add(capacitySlot)))),
-          heartbeatReplica: () => controlPlane.client.heartbeatRunner(input.runner.id, {
-            healthStatus: "healthy",
+          claim: () => suspend(() => {
+            if (!updater.claiming())
+              return succeed5({});
+            claimsInFlight += 1;
+            return rpc.claim({
+              ...input.teamId === undefined ? undefined : { teamId: input.teamId },
+              runnerReplicaId: replica.id,
+              capacitySlot,
+              idempotencyKey: `${replica.id}:${createId()}`
+            }).pipe(tap((result) => sync(() => {
+              if (result.workUnit !== undefined)
+                activeSlots.add(capacitySlot);
+            })), ensuring(sync(() => claimsInFlight -= 1)));
+          }),
+          finished: () => sync(() => activeSlots.delete(capacitySlot)),
+          heartbeatReplica: () => controlPlane.client.heartbeatRunner(input.runnerId, {
+            ...reported,
+            problems: updater.problems(),
             capabilities,
-            labels: input.runner.labels
-          }).pipe(flatMap2(() => controlPlane.client.heartbeatRunnerReplica(input.runner.id, replica.id, {
+            labels: runner.labels
+          }).pipe(flatMap2(() => controlPlane.client.heartbeatRunnerReplica(input.runnerId, replica.id, {
             healthStatus: "healthy",
-            drainState: "accepting",
+            drainState: updater.claiming() ? "accepting" : "draining",
             capacity: { maxConcurrentRuns: concurrency },
             telemetry: { activeWorkUnits: activeSlots.size }
           }).pipe(asVoid))),
           heartbeatWork: (workUnitId, lease) => rpc.heartbeat({ workUnitId, lease }),
-          complete: (completion) => rpc.complete(completion).pipe(tap(() => sync(() => activeSlots.delete(completion.lease.capacitySlot)))),
-          release: (workUnitId, lease) => rpc.release({ workUnitId, lease }).pipe(tap(() => sync(() => activeSlots.delete(lease.capacitySlot))))
+          complete: (completion) => rpc.complete(completion),
+          release: (workUnitId, lease) => rpc.release({ workUnitId, lease })
         });
-        return yield* superviseReplica({
+        const supervised = superviseReplica({
           slots: Array.from({ length: concurrency }, (_, index) => `slot-${index + 1}`),
           control,
           executor: {
@@ -3505,9 +3225,11 @@ function startCanonicalHerdrRunnerCommand(input) {
           },
           signals
         });
-      }).pipe(ensuring(controlPlane.client.stopRunnerReplica(input.runner.id, replica.id).pipe(catch_(() => void_2), asVoid))));
-    }).pipe(provide3(provideMerge(root, layer10)));
-  });
+        return yield* raceFirst(stopWhenRefused(supervised), _await(updated));
+      }));
+    }).pipe(ensuring(ignore(controlPlane.client.stopRunnerReplica(input.runnerId, replica.id))), provide3(provideMerge(root, layer)));
+  }).pipe(catchTag("RunnerStopped", ({ problem }) => error(`Runner stopped (${problem.code}): ${problem.message}
+Fix: ${problem.fix}`)));
 }
 function checkHerdrRunnerReadiness(runner) {
   const notReady = (code) => ({ backend: "herdr", status: "not_ready", code, runnerId: runner.id });
@@ -3537,7 +3259,7 @@ function mcpCommand(args) {
     if (command.action === "run") {
       if (command.args.length > 0)
         return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
-      const { runMcpServerCommand } = yield* promise(() => import("./chunk-120n71cv.js"));
+      const { runMcpServerCommand } = yield* promise(() => import("./chunk-m1086bf9.js"));
       return yield* runMcpServerCommand({ flags: command.flags });
     }
     if (command.action !== "setup")
@@ -3736,7 +3458,7 @@ function kitCommand(args) {
       const source = requiredArg(command, "kit source");
       const version = command.args[1];
       const scopeType = kitInstallScope(command.flags.scopeType);
-      const scopeId = command.flags.scopeId ?? (scopeType === "project" ? yield* activeProjectId(command.flags) : undefined);
+      const scopeId = command.flags.scopeId ?? (scopeType === "team" ? yield* activeTeamId(command.flags) : undefined);
       if ((scopeType === "user" || scopeType === "team") && scopeId === undefined)
         return yield* new CliError({ message: `kit install --scope-type ${scopeType} requires --scope-id` });
       const install = yield* client.installKit(workspaceId, {
@@ -3773,32 +3495,57 @@ function kitCommand(args) {
       return;
     }
     if (command.action === "attach") {
-      const projectRef = requiredArg(command, "project");
+      const teamRef = requiredArg(command, "team");
       const kitRef = command.args[1];
       if (!kitRef)
         return yield* new CliError({ message: "kit attach requires kit" });
       const workspaceId = yield* optionalActiveWorkspaceId(command.flags);
-      const result = yield* client.attachKit(projectRef, kitRef, workspaceId ? { workspaceId } : undefined);
+      const result = yield* client.attachKit(teamRef, kitRef, workspaceId ? { workspaceId } : undefined);
       if (command.flags.json)
-        return yield* printRows([{ projectId: result.projectId, kitId: result.kitId, status: result.status }], true);
-      yield* log(`Kit attached: ${result.kitId} to ${result.projectId}`);
+        return yield* printRows([{ teamId: result.teamId, kitId: result.kitId, status: result.status }], true);
+      yield* log(`Kit attached: ${result.kitId} to ${result.teamId}`);
       return;
     }
     if (command.action === "detach") {
-      const projectRef = requiredArg(command, "project");
+      const teamRef = requiredArg(command, "team");
       const kitRef = command.args[1];
       if (!kitRef)
         return yield* new CliError({ message: "kit detach requires kit" });
       const workspaceId = yield* optionalActiveWorkspaceId(command.flags);
-      const result = yield* client.detachKit(projectRef, kitRef, workspaceId ? { workspaceId } : undefined);
+      const result = yield* client.detachKit(teamRef, kitRef, workspaceId ? { workspaceId } : undefined);
       if (command.flags.json)
-        return yield* printRows([{ projectId: result.projectId, kitId: result.kitId, status: result.status }], true);
-      yield* log(`Kit detached: ${result.kitId} from ${result.projectId}`);
+        return yield* printRows([{ teamId: result.teamId, kitId: result.kitId, status: result.status }], true);
+      yield* log(`Kit detached: ${result.kitId} from ${result.teamId}`);
       return;
     }
     return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
   });
 }
+function assignTask(client, command) {
+  return gen(function* () {
+    const { to, loop, json } = command.flags;
+    if (to === undefined === (loop === undefined))
+      return yield* new CliError({ message: "task assign takes one of --to <person> or --loop <loop>" });
+    const workspaceId = yield* activeWorkspaceId(command.flags);
+    const task = yield* client.getTeamTask(workspaceId, requiredArg(command, "task"));
+    if (loop !== undefined) {
+      const loops = yield* client.listProgramLoops(workspaceId, { teamId: task.team.id });
+      if (!loops.items.some((candidate) => candidate.id === loop))
+        return yield* new CliError({
+          message: `${task.key}'s Team has no Loop ${loop}. Its Loops: ${loops.items.map((candidate) => candidate.id).join(", ") || "none"}`
+        });
+      const started = yield* client.assignTaskLoop(workspaceId, task.id, { loop });
+      return yield* json ? printJson(started) : log(`Started Run ${started.run.id} of ${loop} for ${task.key}`);
+    }
+    const team = yield* client.getTeam(workspaceId, task.team.id);
+    const named = (to ?? "").toLowerCase();
+    const person = [...team.members, ...team.nonMembers].find((candidate) => candidate.id === to || candidate.email.toLowerCase() === named || candidate.name.toLowerCase() === named);
+    if (person === undefined)
+      return yield* new CliError({ message: `${to} is not a member of this Workspace` });
+    const assigned = yield* client.assignTeamTask(workspaceId, task.id, { assigneeId: person.id });
+    return yield* json ? printJson(assigned) : log(`Assigned ${task.key} to ${person.name}`);
+  });
+}
 function taskCommand(args) {
   return gen(function* () {
     const command = parseCommand(args);
@@ -3806,16 +3553,18 @@ function taskCommand(args) {
     const session = yield* requiredSessionForApi(apiUrl);
     const client = yield* clientFor(apiUrl, session);
     if (command.action === "list") {
-      const projectId = yield* activeProjectId(command.flags);
+      const teamId = yield* activeTeamId(command.flags);
       const tasks = [];
-      let page = yield* client.listTasks(projectId);
+      let page = yield* client.listTasks(teamId);
       tasks.push(...page.items);
       while (command.flags.status !== undefined && page.nextCursor !== undefined) {
-        page = yield* client.listTasks(projectId, { cursor: page.nextCursor, limit: 100 });
+        page = yield* client.listTasks(teamId, { cursor: page.nextCursor, limit: 100 });
         tasks.push(...page.items);
       }
       return yield* printRows(tasks.flatMap((task) => inState(task, command.flags.status) ? [taskRow(task)] : []), command.flags.json);
     }
+    if (command.action === "assign")
+      return yield* assignTask(client, command);
     if (command.action === "show") {
       const taskRef = requiredArg(command, "task");
       const task = yield* client.getTask(taskRef);
@@ -3970,6 +3719,11 @@ function memoryCommand(args) {
       yield* log(`Memory ${memoryTransitionPastTense(command.action)}: ${response.memory.id}`);
       return;
     }
+    if (command.action === "move") {
+      const workspaceId = yield* activeWorkspaceId(command.flags);
+      const owner = yield* ownerTo(client, workspaceId, command);
+      return yield* printMoved(command, yield* client.moveMemory(workspaceId, requiredArg(command, "memory"), owner.change), owner.label);
+    }
     return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
   });
 }
@@ -3980,8 +3734,8 @@ function proposalCommand(args) {
     const session = yield* requiredSessionForApi(apiUrl);
     const client = yield* clientFor(apiUrl, session);
     if (command.action === "list") {
-      const projectId = command.flags.project ?? (yield* activeProjectId(command.flags));
-      const response = yield* client.listProposals(projectId, {
+      const teamId = command.flags.team ?? (yield* activeTeamId(command.flags));
+      const response = yield* client.listProposals(teamId, {
         ...command.flags.status === undefined ? undefined : { status: validateProposalStatus(command.flags.status) },
         ...command.flags.targetType === undefined ? undefined : { targetType: command.flags.targetType },
         ...command.flags.limit === undefined ? undefined : { limit: command.flags.limit }
@@ -4019,8 +3773,8 @@ function decisionCommand(args) {
     const session = yield* requiredSessionForApi(apiUrl);
     const client = yield* clientFor(apiUrl, session);
     if (command.action === "list") {
-      const projectId = command.flags.project ?? (yield* activeProjectId(command.flags));
-      const response = yield* client.listDecisions("project", projectId, {
+      const teamId = command.flags.team ?? (yield* activeTeamId(command.flags));
+      const response = yield* client.listDecisions("team", teamId, {
         status: command.flags.status === undefined ? "active" : validateDecisionStatus(command.flags.status),
         ...command.flags.limit === undefined ? undefined : { limit: command.flags.limit }
       });
@@ -4031,6 +3785,11 @@ function decisionCommand(args) {
       const decision = yield* client.getDecision(decisionId);
       return yield* printRows([decisionRow(decision)], command.flags.json);
     }
+    if (command.action === "move") {
+      const workspaceId = yield* activeWorkspaceId(command.flags);
+      const owner = yield* ownerTo(client, workspaceId, command);
+      return yield* printMoved(command, yield* client.moveDecision(workspaceId, requiredArg(command, "decision"), owner.change), owner.label);
+    }
     return yield* new CliError({ message: `Unknown command: ${args.join(" ")}` });
   });
 }
@@ -4066,18 +3825,18 @@ function programLoopCommand(command) {
     const client = yield* loopClientFor(yield* resolveApiUrl(command.flags.apiUrl));
     const print = (value, lines) => command.flags.json ? printJson(value) : forEach(lines(value), (line) => log(line), { discard: true });
     if (command.action === "list") {
-      const projectId = yield* optionalActiveProjectId(command.flags);
-      const listed = yield* client.listProgramLoops(yield* activeWorkspaceId(command.flags), projectId === undefined ? {} : { projectId });
+      const teamId = yield* optionalActiveTeamId(command.flags);
+      const listed = yield* client.listProgramLoops(yield* activeWorkspaceId(command.flags), teamId === undefined ? {} : { teamId });
       return yield* print(listed, (value) => value.items.flatMap(programLoopLines));
     }
     if (command.action === "starts") {
-      const started = yield* client.listAutomaticStarts(yield* activeProjectId(command.flags), command.flags.limit === undefined ? {} : { limit: command.flags.limit });
+      const started = yield* client.listAutomaticStarts(yield* activeTeamId(command.flags), command.flags.limit === undefined ? {} : { limit: command.flags.limit });
       return yield* print(started, (value) => value.items.length === 0 ? ["No Event has started a Loop here yet"] : value.items.map((start) => `${start.at}  ${start.eventType} -> ${start.loop}: ${start.runId === undefined ? `not started: ${start.rejection ?? "unknown"}` : `Run ${start.runId}`}`));
     }
     if (command.action === "show") {
       const loop = requiredArg(command, "a Loop");
-      const projectId = yield* optionalActiveProjectId(command.flags);
-      const shown = yield* client.showProgramLoop(yield* activeWorkspaceId(command.flags), loop, projectId === undefined ? {} : { projectId });
+      const teamId = yield* optionalActiveTeamId(command.flags);
+      const shown = yield* client.showProgramLoop(yield* activeWorkspaceId(command.flags), loop, teamId === undefined ? {} : { teamId });
       return yield* print(shown, (value) => value.resolved === undefined ? [`${loop} resolves to nothing here`] : programLoopLines(value.resolved));
     }
     return yield* new CliError({ message: `Unknown loop command: ${command.action}` });
@@ -4103,8 +3862,8 @@ function agentCommand(args) {
       resolvedField(agent, "effort")
     ].filter((field) => field !== "").join("  ");
     if (command.action === "list") {
-      const projectId = yield* optionalActiveProjectId(command.flags);
-      const listed = yield* client.listProgramAgents(yield* activeWorkspaceId(command.flags), projectId === undefined ? {} : { projectId });
+      const teamId = yield* optionalActiveTeamId(command.flags);
+      const listed = yield* client.listProgramAgents(yield* activeWorkspaceId(command.flags), teamId === undefined ? {} : { teamId });
       return yield* print(listed, (value) => value.items.map(agentLine));
     }
     return yield* new CliError({ message: `Unknown agent command: ${command.action}. Use kitman agent list.` });
@@ -4127,21 +3886,21 @@ function loopCatalogCommand(args) {
     const command = parseCommand(args);
     const apiUrl = yield* resolveApiUrl(command.flags.apiUrl);
     const client = yield* loopClientFor(apiUrl);
-    const projectId = yield* activeProjectId(command.flags);
+    const teamId = yield* activeTeamId(command.flags);
     if (command.action === "list" || command.action === "catalog") {
-      const response = yield* client.requestJson("listLoops", `/loops${loopListQuery(projectId, command.flags.limit)}`);
+      const response = yield* client.requestJson("listLoops", `/loops${loopListQuery(teamId, command.flags.limit)}`);
       return yield* printOperationalResult(command, response);
     }
     const loopRef = requiredArg(command, "Loop");
     if (command.action === "show") {
-      const response = yield* client.requestJson("getLoop", `/loops/${encodeURIComponent(loopRef)}?projectId=${encodeURIComponent(projectId)}`);
+      const response = yield* client.requestJson("getLoop", `/loops/${encodeURIComponent(loopRef)}?teamId=${encodeURIComponent(teamId)}`);
       return yield* printOperationalResult(command, response);
     }
     if (command.action === "validate" || command.action === "test") {
       const input = yield* operationalInput(command, `loop ${command.action}`);
       const response = yield* client.requestJson(`loop${capitalize(command.action)}`, `/loops/${encodeURIComponent(loopRef)}/${command.action}`, {
         method: "POST",
-        body: { projectId, loopRef, ...input }
+        body: { teamId, loopRef, ...input }
       });
       return yield* printOperationalResult(command, response);
     }
@@ -4159,9 +3918,9 @@ var launchContext = (flags) => gen(function* () {
   const read = (args) => git(args).pipe(orElseSucceed(() => ""));
   const remoteUrl = yield* read(["remote", "get-url", "origin"]);
   const branch = yield* read(["branch", "--show-current"]);
-  const projectId = yield* optionalActiveProjectId(flags);
+  const teamId = yield* optionalActiveTeamId(flags);
   return {
-    ...projectId === undefined ? undefined : { projectId },
+    ...teamId === undefined ? undefined : { teamId },
     ...remoteUrl === "" ? undefined : { remoteUrl },
     ...branch === "" ? undefined : { branch }
   };
@@ -4217,8 +3976,28 @@ var driftLines = (drift) => [
   ...drift.reports.length === 0 ? ["No Drift Reports", ...judgementLines(drift)] : shownDriftLines(drift),
   ...drift.boundaries.flatMap((boundary) => boundary.uncheckedReason === undefined ? [] : [`Unchecked at ${boundary.stepKey}: ${boundary.uncheckedReason}`])
 ];
+var graphNodeText = (node) => `${node.name} ${node.kind} ${runDisplayLabels[node.status]}${node.attempts.length > 1 ? `, ${node.attempts.length} attempts` : ""}`;
+var displayGlyphs = {
+  queued: "\u25CB",
+  running: "\u25D0",
+  needs_you: "?",
+  blocked: "\u25B2",
+  failed: "\u2717",
+  stopped: "\u25A0",
+  succeeded: "\u2713",
+  partial: "\u25D1"
+};
+var runListLine = (item) => [
+  `${runDisplayLabels[item.display.state]}${item.display.retried ? " \xB7 Retried" : ""}`,
+  item.miniGraph.map((state) => displayGlyphs[state]).join(""),
+  item.task === undefined ? item.loop.title : `${item.task.key} ${item.task.title}`,
+  item.display.summary ?? "",
+  item.run.id
+].filter((part) => part !== "").join("  ");
 var runShowLines = (shown) => [
-  `Run ${shown.run.id}: ${shown.run.status}`,
+  `Run ${shown.run.id}: ${runDisplayLabels[shown.display.state]}${shown.display.retried ? " \xB7 Retried" : ""}`,
+  ...shown.display.summary === undefined ? [] : [`Now: ${shown.display.summary}`],
+  ...shown.graph.columns.map((column, index) => `${index + 1}. ${column.map(graphNodeText).join(" \xB7 ")}`),
   ...shown.closures.map((closure, index) => index === 0 ? closureLine(closure) : `Earlier: ${closureLine(closure)}`),
   ...alignmentLines(shown.run.alignment),
   ...shown.run.loopDigest === undefined ? [] : [`Loop from the ${shown.run.loopLayer ?? "shipped"} layer, digest ${shown.run.loopDigest}`],
@@ -4251,7 +4030,7 @@ var myTeamsCardLine = (card) => {
     ...card.questions.map((question) => `asks: ${question.prompt}`),
     ...card.changeRequests.map((changeRequest) => `review ${changeRequest.url}`),
     ...card.proposals.map((proposal) => `decide: ${proposal.title}`),
-    ...card.noEligibleRunner ? ["no eligible Runner online"] : []
+    ...latest === undefined ? [] : [runDisplayLabels[latest.display.state]]
   ].join(" \xB7 ");
 };
 var inboxActionLabel = {
@@ -4272,12 +4051,14 @@ var inboxItemLine = (item) => {
     `${item.subject.kind}:${item.subject.id}`
   ].join(" ");
 };
-var inboxSubjectKinds = ["task", "run", "proposal"];
+var inboxSubjectKinds = ["task", "run", "proposal", "memory", "project_update", "runner"];
 var inboxSubjectOf = (ref) => {
   const separator = ref.indexOf(":");
   const kind = inboxSubjectKinds.find((known) => known === ref.slice(0, separator));
   const id = ref.slice(separator + 1);
-  return kind !== undefined && id !== "" ? succeed5({ kind, id }) : fail4(new CliError({ message: `${ref} is not an Inbox item; name it as task:<id>, run:<id> or proposal:<id>` }));
+  return kind !== undefined && id !== "" ? succeed5({ kind, id }) : fail4(new CliError({
+    message: `${ref} is not an Inbox item; name it as task:<id>, run:<id>, proposal:<id> or project_update:<id>`
+  }));
 };
 var inboxActions = new Set([
   "list",
@@ -4297,7 +4078,7 @@ function inboxCommand(args) {
     const client = yield* loopClientFor(yield* resolveApiUrl(command.flags.apiUrl));
     const workspaceId = yield* activeWorkspaceId(command.flags);
     if (command.action === "my-teams") {
-      const view = yield* client.showMyTeams(workspaceId, command.flags.project === undefined ? {} : { projectId: command.flags.project });
+      const view = yield* client.showMyTeams(workspaceId, command.flags.team === undefined ? {} : { teamId: command.flags.team });
       if (command.flags.json)
         return yield* printJson(view);
       return yield* forEach(myTeamsSections.flatMap(([section, title]) => [
@@ -4340,6 +4121,93 @@ function inboxCommand(args) {
     return yield* command.flags.json ? printJson(counts) : log(`${counts.items} in your Inbox, ${counts.unread} unread`);
   });
 }
+var transcriptEventLine = (event) => {
+  switch (event.kind) {
+    case "message":
+      return `${event.role}: ${event.text}`;
+    case "tool_call":
+      return `tool ${event.name} ${encodeJsonStringSync(event.arguments)}`;
+    case "tool_result":
+      return `${event.isError === true ? "tool error" : "tool result"}: ${event.output}`;
+    case "file":
+      return `${event.change} ${event.path}`;
+    case "question":
+    case "answer":
+    case "steer":
+      return `${event.kind}: ${event.text}`;
+    case "lifecycle":
+      return `session ${event.state}`;
+  }
+};
+var transcriptLine = (entry) => `${entry.sequence} ${transcriptEventLine(entry.event)}`;
+var transcriptAfter = (client, runId, stepAttemptId, after) => gen(function* () {
+  const entries = [];
+  for (let cursor = after;cursor !== undefined; ) {
+    const page = yield* client.readTranscript(runId, stepAttemptId, cursor === 0 ? {} : { after: cursor });
+    entries.push(...page.items);
+    cursor = page.next;
+  }
+  return entries;
+});
+var askedAttempts = (attempts, step, attempt) => {
+  const latest = new Map;
+  for (const candidate of attempts)
+    if ((step === undefined || candidate.stepKey === step) && (attempt === undefined || candidate.attempt === attempt) && candidate.attempt >= (latest.get(candidate.stepKey)?.attempt ?? 0))
+      latest.set(candidate.stepKey, candidate);
+  return [...latest.values()].sort((left, right) => left.sequence - right.sequence);
+};
+function transcriptCommand(args) {
+  return gen(function* () {
+    const command = parseCommand(args);
+    const runId = requiredArg(command, "a Run");
+    const client = yield* loopClientFor(yield* resolveApiUrl(command.flags.apiUrl));
+    const { stepKey, attempt } = command.flags;
+    const asked = askedAttempts((yield* client.listStepAttempts(runId)).items, stepKey, attempt);
+    if (asked.length === 0)
+      return yield* new CliError({
+        message: `Run ${runId} has no ${stepKey === undefined ? "Step attempts" : `attempt of ${stepKey}`}${attempt === undefined ? "" : ` numbered ${attempt}`}`
+      });
+    const items = yield* forEach(asked, (found) => map3(transcriptAfter(client, runId, found.id, 0), (entries) => ({
+      stepKey: found.stepKey,
+      attempt: found.attempt,
+      stepAttemptId: found.id,
+      entries
+    })));
+    if (command.flags.json)
+      return yield* log(encodeJsonStringSync({ items }));
+    for (const item of items) {
+      yield* log(`Step ${item.stepKey}, attempt ${item.attempt}`);
+      yield* forEach(item.entries, (entry) => log(transcriptLine(entry)), { discard: true });
+    }
+  });
+}
+var settledRunStatuses = new Set(["completed", "failed", "canceled", "expired"]);
+var followTranscripts = (client, runId, options) => gen(function* () {
+  const read = new Map;
+  const refused = new Set;
+  let status;
+  const show = (value, line) => log(options.json ? encodeJsonStringSync(value) : line);
+  for (;; ) {
+    const run = yield* client.getRun(runId);
+    if (run.status !== status) {
+      status = run.status;
+      yield* show({ run: { id: run.id, status: run.status } }, `Run ${run.id}: ${run.status}`);
+    }
+    for (const attempt of (yield* client.listStepAttempts(runId)).items) {
+      if (refused.has(attempt.id))
+        continue;
+      const step = { stepKey: attempt.stepKey, attempt: attempt.attempt };
+      const entries = yield* transcriptAfter(client, runId, attempt.id, read.get(attempt.id) ?? 0).pipe(catchIf((error) => error instanceof KitmanClientError && error.status === 403, (error) => as(andThen(sync(() => refused.add(attempt.id)), show({ ...step, stepAttemptId: attempt.id, refused: error.responseMessage ?? error.message }, `${attempt.stepKey} #${attempt.attempt}: ${error.responseMessage ?? error.message}`)), [])));
+      for (const entry of entries) {
+        read.set(attempt.id, entry.sequence);
+        yield* show({ ...step, ...entry }, `${attempt.stepKey} #${attempt.attempt} ${transcriptLine(entry)}`);
+      }
+    }
+    if (settledRunStatuses.has(run.status))
+      return;
+    yield* sleep(options.pollIntervalMs);
+  }
+});
 function runCommand(args) {
   return gen(function* () {
     const command = parseCommand(args);
@@ -4371,22 +4239,35 @@ function runCommand(args) {
       ]);
     }
     if (command.action === "list") {
-      const listed = yield* client.listRuns(yield* activeProjectId(command.flags), {
-        ...command.flags.status === undefined ? undefined : { status: validateRunStatus(command.flags.status) },
-        ...command.flags.limit === undefined ? undefined : { limit: command.flags.limit }
+      const { team, loop, states, limit } = command.flags;
+      const listed = yield* client.listRuns(yield* activeWorkspaceId(command.flags), {
+        ...team === undefined ? undefined : { teamId: team },
+        ...loop === undefined ? undefined : { loop },
+        ...states === undefined ? undefined : { states },
+        ...limit === undefined ? undefined : { limit }
       });
-      return yield* print(listed, (value) => [
-        table(value.items.map((item) => ({
-          run: item.id,
-          status: item.status,
-          closed: item.closure?.kind,
-          task: item.taskId,
-          created: item.createdAt
-        })))
-      ]);
+      return yield* print(listed, (value) => value.items.length === 0 ? ["No Runs"] : value.items.map(runListLine));
+    }
+    if (command.action === "file") {
+      const [verb, fileRunId, fileId] = command.args;
+      if (verb !== "get" || fileRunId === undefined || fileId === undefined)
+        return yield* new CliError({ message: "Usage: kitman run file get <run> <id> [--out path]" });
+      const listed = yield* client.listRunFiles(fileRunId);
+      const file = "files" in listed ? listed.files.find((candidate) => candidate.id === fileId) : undefined;
+      if (file === undefined)
+        return yield* new CliError({ message: `Run ${fileRunId} has no file ${fileId} you can read` });
+      const { urls } = yield* client.runFileUrls(fileRunId, { ids: [fileId], use: "download" });
+      const url = urls.find((candidate) => candidate.id === fileId)?.url;
+      if (url === undefined)
+        return yield* new CliError({ message: `Kitman gave no link to file ${fileId}` });
+      const out = command.flags.out ?? localFileName(file.name, file.id);
+      yield* downloadVerified(url, out, file.sha256);
+      return yield* print({ id: file.id, path: out }, (value) => [`Wrote ${value.id} to ${value.path}`]);
     }
     const runId = requiredArg(command, "a Run");
     switch (command.action) {
+      case "files":
+        return yield* print(yield* client.listRunFiles(runId, command.flags.stepKey === undefined ? {} : { step: command.flags.stepKey }), runFileLines);
       case "show": {
         const shown = {
           ...yield* client.showRun(runId),
@@ -4441,6 +4322,11 @@ function runCommand(args) {
         });
         return yield* print(answered, (question) => [`Answered ${question.stepKey}: ${value}`]);
       }
+      case "follow":
+        return yield* followTranscripts(client, runId, {
+          json: command.flags.json === true,
+          pollIntervalMs: command.flags.pollIntervalMs ?? 1000
+        });
       case "steer": {
         const text = command.args.slice(1).join(" ");
         if (text === "")
@@ -4486,38 +4372,56 @@ function runCommand(args) {
     }
   });
 }
-var currentRepoBinding = (client, projectId) => gen(function* () {
+var byteSize = (bytes) => {
+  const units = ["B", "KiB", "MiB", "GiB"];
+  const exponent = Math.min(units.length - 1, Math.floor(Math.log(Math.max(bytes, 1)) / Math.log(1024)));
+  return exponent === 0 ? `${bytes} B` : `${(bytes / 1024 ** exponent).toFixed(1)} ${units[exponent]}`;
+};
+var runFileLines = (listed) => {
+  if (!("files" in listed))
+    return [`${listed.count} files; reading them needs access to the content of the Run's repositories`];
+  if (listed.files.length === 0)
+    return ["No files"];
+  return listed.files.map((file) => [
+    file.id,
+    file.name,
+    file.madeBy,
+    file.kind,
+    byteSize(file.byteSize),
+    file.reason === undefined ? file.status : `${file.status}: ${file.status === "refused" && isRunFileRefusalReason(file.reason) ? runFileRefusalWords({ ...file, reason: file.reason }) : file.reason}`
+  ].join("  "));
+};
+var currentRepoBinding = (client, workspaceId) => gen(function* () {
   const remote = yield* (yield* Git)(["remote", "get-url", "origin"]).pipe(orElseSucceed(() => ""));
   if (remote === "")
     return yield* new CliError({ message: "Run this inside a git checkout with an origin" });
-  const bindings = yield* client.listRepoBindings(projectId);
-  const binding = bindings.items.find((candidate) => repositoryKey(candidate.repositoryUrl ?? `https://${candidate.host}/${candidate.owner}/${candidate.name}`) === repositoryKey(remote));
+  const binding = (yield* client.listRepoBindings(workspaceId)).items.find((candidate) => candidate.status === "active" && repositoryKey(candidate.repositoryUrl ?? `https://${candidate.host}/${candidate.owner}/${candidate.name}`) === repositoryKey(remote));
   if (binding === undefined)
-    return yield* new CliError({ message: `No repository of the Project matches ${remote.trim()}` });
+    return yield* new CliError({ message: `No repository of the Workspace matches ${remote.trim()}` });
   return binding;
 });
 function verifyCommand(args) {
   return gen(function* () {
     const command = parseCommand(args.length === 1 ? [...args, "list"] : args);
     const client = yield* loopClientFor(yield* resolveApiUrl(command.flags.apiUrl));
-    const projectId = yield* activeProjectId(command.flags);
-    const binding = yield* currentRepoBinding(client, projectId);
+    const workspaceId = yield* activeWorkspaceId(command.flags);
+    const binding = yield* currentRepoBinding(client, workspaceId);
     const print = (value, lines) => command.flags.json ? printJson(value) : forEach(lines(value), (line) => log(line), { discard: true });
     switch (command.action) {
       case "list":
-        return yield* print(yield* client.listApprovedVerifications(projectId, binding.id), (listed) => listed.items.length === 0 ? [`No approved verifications for ${binding.owner}/${binding.name}`] : listed.items.map((check) => `${check.name}: ${check.command}${check.workingDirectory === undefined ? "" : ` (in ${check.workingDirectory})`}`));
+        return yield* print(yield* client.listApprovedVerifications(workspaceId, binding.id), (listed) => listed.items.length === 0 ? [`No approved verifications for ${binding.owner}/${binding.name}`] : listed.items.map((check) => `${check.name}: ${check.command}${check.workingDirectory === undefined ? "" : ` (in ${check.workingDirectory})`}`));
       case "add": {
         const [name, ...words] = command.args;
         if (name === undefined || words.length === 0)
           return yield* new CliError({ message: "verify add requires a name and a command" });
-        return yield* print(yield* client.approveVerification(projectId, binding.id, {
+        return yield* print(yield* client.approveVerification(workspaceId, binding.id, {
           name,
           command: words.join(" "),
           ...command.flags.workingDirectory === undefined ? undefined : { workingDirectory: command.flags.workingDirectory }
         }), (check) => [`Approved ${check.name}: ${check.command}`]);
       }
       case "remove":
-        return yield* print(yield* client.removeVerification(projectId, binding.id, requiredArg(command, "a verification")), (removed) => [`Removed ${removed.removed}`]);
+        return yield* print(yield* client.removeVerification(workspaceId, binding.id, requiredArg(command, "a verification")), (removed) => [`Removed ${removed.removed}`]);
       default:
         return yield* new CliError({ message: `Unknown verify command: ${command.action}` });
     }
@@ -4529,13 +4433,13 @@ function secretCommand(args) {
     const command = parseCommand(args.length === 1 ? [...args, "list"] : args);
     const client = yield* loopClientFor(yield* resolveApiUrl(command.flags.apiUrl));
     const workspaceId = yield* activeWorkspaceId(command.flags);
-    const projectId = command.flags.project === undefined ? undefined : (yield* client.getProject(command.flags.project, { workspaceId })).id;
-    const scope = projectId === undefined ? {} : { projectId };
-    const where = projectId === undefined ? "the Workspace" : `Project ${command.flags.project}`;
+    const teamId = command.flags.team === undefined ? undefined : (yield* teamNamed(client, workspaceId, command.flags.team)).id;
+    const scope = teamId === undefined ? {} : { teamId };
+    const where = teamId === undefined ? "the Workspace" : `Team ${command.flags.team}`;
     const print = (value, lines) => command.flags.json ? printJson(value) : forEach(lines(value), (line) => log(line), { discard: true });
     switch (command.action) {
       case "list":
-        return yield* print(yield* client.listSecrets(workspaceId, scope), (listed) => listed.items.length === 0 ? [`No Secrets in ${where}`] : listed.items.map((secret) => `${secret.name}  ${secret.scope === "workspace" ? "workspace" : `project ${secret.projectId}`}  set by ${secret.setByActorId} at ${secret.setAt}`));
+        return yield* print(yield* client.listSecrets(workspaceId, scope), (listed) => listed.items.length === 0 ? [`No Secrets in ${where}`] : listed.items.map((secret) => `${secret.name}  ${secret.scope === "workspace" ? "workspace" : `team ${secret.teamId}`}  set by ${secret.setByActorId} at ${secret.setAt}`));
       case "set": {
         const name = requiredArg(command, "a Secret name");
         if (command.args.length > 1)
@@ -4551,13 +4455,17 @@ function secretCommand(args) {
       }
       case "delete":
         return yield* print(yield* client.deleteSecret(workspaceId, requiredArg(command, "a Secret name"), scope), (removed) => [`Deleted ${removed.removed} from ${where}`]);
+      case "move": {
+        const owner = yield* ownerTo(client, workspaceId, command);
+        return yield* printMoved(command, yield* client.moveSecret(workspaceId, requiredArg(command, "a Secret name"), owner.change, scope), owner.label);
+      }
       default:
         return yield* new CliError({ message: `Unknown secret command: ${command.action}` });
     }
   });
 }
 var PackageBuilder = Reference("kitman/cli/PackageBuilder", {
-  defaultValue: () => (directory) => flatMap2(promise(() => import("./chunk-gew1a5p6.js")), (build) => build.buildPackage(directory))
+  defaultValue: () => (directory) => flatMap2(promise(() => import("./chunk-djtdn35f.js")), (build) => build.buildPackage(directory))
 });
 var optionalEnv = (name) => String3(name).pipe(option2, map3(getOrUndefined));
 var ciIdToken = (apiUrl) => gen(function* () {
@@ -4571,7 +4479,7 @@ var ciIdToken = (apiUrl) => gen(function* () {
   const url = new URL(requestUrl);
   const refused = (reason) => new CliError({ message: `GitHub Actions issued no ID token: ${reason}` });
   url.searchParams.set("audience", apiUrl.replace(/\/+$/, ""));
-  const response = yield* send(get3(url, { headers: { authorization: `Bearer ${requestToken}` } }), (cause) => refused(String(cause)));
+  const response = yield* send(get2(url, { headers: { authorization: `Bearer ${requestToken}` } }), (cause) => refused(String(cause)));
   if (response.status < 200 || response.status >= 300)
     return yield* refused(`${response.status}; does the job have id-token: write?`);
   const body = yield* response.text.pipe(mapError((error) => refused(error.message)));
@@ -4584,12 +4492,12 @@ var packageScope = (command, options = {}) => gen(function* () {
   const token = options.ci === true ? yield* ciIdToken(apiUrl) : undefined;
   const client = token === undefined ? yield* loopClientFor(apiUrl) : yield* createSdkClient({ apiUrl, session: { accessToken: token }, clientId: ClientId });
   const workspaceId = yield* activeWorkspaceId(command.flags);
-  const projectId = command.flags.project === undefined || token !== undefined ? command.flags.project : (yield* client.getProject(command.flags.project, { workspaceId })).id;
+  const teamId = command.flags.team === undefined || token !== undefined ? command.flags.team : (yield* teamNamed(client, workspaceId, command.flags.team)).id;
   return {
     client,
     workspaceId,
-    scope: projectId === undefined ? {} : { projectId },
-    where: projectId !== undefined ? `Project ${command.flags.project}` : token === undefined ? "the Workspace" : "the Deploy Binding's layer"
+    scope: teamId === undefined ? {} : { teamId },
+    where: teamId !== undefined ? `Team ${command.flags.team}` : token === undefined ? "the Workspace" : "the Deploy Binding's layer"
   };
 });
 var changeLines = (resource, changes) => [
@@ -4598,9 +4506,9 @@ var changeLines = (resource, changes) => [
   ...changes.removed.map((id) => `  - ${resource} ${id}`)
 ];
 var scheduleProblems = {
-  missing: "names no Project, which a Workspace Package must",
-  not_allowed: "names a Project, though a Project Package's Schedules run in its own",
-  unknown: "names a Project this Workspace does not have"
+  missing: "names no Team, which a Workspace Package must",
+  not_allowed: "names a Team, though a Team Package's Schedules run in its own",
+  unknown: "names a Team this Workspace does not have"
 };
 var removedKitRecords = (shown, kind) => ({
   created: [],
@@ -4617,9 +4525,9 @@ var conflictLine = (conflict) => {
   switch (conflict.kind) {
     case "id_taken":
       return `  conflict: ${conflict.resource} ${conflict.id} is declared by Package ${conflict.package} in this layer`;
-    case "not_for_project":
-      return `  conflict: a Project Package cannot declare ${conflict.declaration}`;
-    case "schedule_project":
+    case "not_for_team":
+      return `  conflict: a Team Package cannot declare ${conflict.declaration}`;
+    case "schedule_team":
       return `  conflict: schedule ${conflict.key} ${scheduleProblems[conflict.problem]}`;
     case "loop_unresolved":
       return `  conflict: schedule ${conflict.key} starts Loop ${conflict.loop}, which will not resolve after this deploy`;
@@ -4629,8 +4537,8 @@ var conflictLine = (conflict) => {
       return `  conflict: kit ${conflict.key} ${kitSourceProblems[conflict.problem]}`;
     case "kit_policy_disabled":
       return `  conflict: kit assignment ${conflict.key} sets Workspace policy, which this Workspace's rollout does not allow`;
-    case "kit_project_unknown":
-      return `  conflict: kit assignment ${conflict.key} names Project ${conflict.project}, which this Workspace does not have`;
+    case "kit_team_unknown":
+      return `  conflict: kit assignment ${conflict.key} names Team ${conflict.team}, which this Workspace does not have`;
   }
 };
 var driftValue = (drift, side) => encodeJsonStringSync(toJsonValue(drift[side]));
@@ -4747,19 +4655,6 @@ function devCommand(args) {
       return yield* new CliError({ message: `Run ${settled.run.id} ${settled.reason}` });
   });
 }
-var workspaceRepoBinding = (client, workspaceId, projectId) => gen(function* () {
-  const remote = yield* (yield* Git)(["remote", "get-url", "origin"]).pipe(orElseSucceed(() => ""));
-  if (remote === "")
-    return yield* new CliError({ message: "Run kitman deploy bind inside a git checkout with an origin" });
-  const projects = (yield* client.listProjects(workspaceId)).items.map((project) => project.id);
-  const ordered = projectId === undefined ? projects : [projectId, ...projects.filter((id) => id !== projectId)];
-  for (const id of ordered) {
-    const binding = (yield* client.listRepoBindings(id)).items.find((candidate) => repositoryKey(candidate.repositoryUrl ?? `https://${candidate.host}/${candidate.owner}/${candidate.name}`) === repositoryKey(remote));
-    if (binding !== undefined)
-      return binding;
-  }
-  return yield* new CliError({ message: `No repository of the Workspace matches ${remote.trim()}` });
-});
 function deployBindingCommand(args) {
   return gen(function* () {
     const command = parseCommand(args);
@@ -4767,12 +4662,12 @@ function deployBindingCommand(args) {
     const print = (value, lines) => command.flags.json ? printJson(value) : forEach(lines(value), (line) => log(line), { discard: true });
     switch (command.action) {
       case "bindings":
-        return yield* print(yield* client.listDeployBindings(workspaceId), (listed) => listed.items.length === 0 ? ["No Deploy Bindings in the Workspace"] : listed.items.map((binding) => `${binding.id}  ${binding.packageName}  ${binding.layer === "workspace" ? "workspace" : `project ${binding.projectId}`}  ${binding.repository} ${binding.branch}  by ${binding.createdByUserId}`));
+        return yield* print(yield* client.listDeployBindings(workspaceId), (listed) => listed.items.length === 0 ? ["No Deploy Bindings in the Workspace"] : listed.items.map((binding) => `${binding.id}  ${binding.packageName}  ${binding.layer === "workspace" ? "workspace" : `team ${binding.teamId}`}  ${binding.repository} ${binding.branch}  by ${binding.createdByUserId}`));
       case "bind": {
         const branch = command.flags.branch;
         if (branch === undefined)
           return yield* new CliError({ message: "deploy bind requires --branch <branch>" });
-        const repoBinding = yield* workspaceRepoBinding(client, workspaceId, scope.projectId);
+        const repoBinding = yield* currentRepoBinding(client, workspaceId);
         const built = yield* (yield* PackageBuilder)(".");
         return yield* print(yield* client.createDeployBinding(workspaceId, {
           repoBindingId: repoBinding.id,
@@ -4848,31 +4743,32 @@ function constraintCommand(args) {
   return gen(function* () {
     const command = parseCommand(args.length === 1 ? [...args, "list"] : args);
     const client = yield* loopClientFor(yield* resolveApiUrl(command.flags.apiUrl));
-    const projectId = yield* activeProjectId(command.flags);
-    const binding = yield* currentRepoBinding(client, projectId);
+    const workspaceId = yield* activeWorkspaceId(command.flags);
+    const binding = yield* currentRepoBinding(client, workspaceId);
     const print = (value, lines) => command.flags.json ? printJson(value) : forEach(lines(value), (line) => log(line), { discard: true });
     switch (command.action) {
       case "list":
-        return yield* print(yield* client.listStandingConstraints(projectId, binding.id), (listed) => listed.items.length === 0 ? [`No standing constraints for ${binding.owner}/${binding.name}`] : listed.items.map((constraint) => `${constraint.id}: ${constraint.text}`));
+        return yield* print(yield* client.listStandingConstraints(workspaceId, binding.id), (listed) => listed.items.length === 0 ? [`No standing constraints for ${binding.owner}/${binding.name}`] : listed.items.map((constraint) => `${constraint.id}: ${constraint.text}`));
       case "add": {
         const text = command.args.join(" ");
         if (text.trim() === "")
           return yield* new CliError({ message: "constraint add requires a constraint" });
-        return yield* print(yield* client.addStandingConstraint(projectId, binding.id, text), (added) => [
+        return yield* print(yield* client.addStandingConstraint(workspaceId, binding.id, text), (added) => [
           `Added ${added.id}: ${added.text}`
         ]);
       }
       case "remove":
-        return yield* print(yield* client.removeStandingConstraint(projectId, binding.id, requiredArg(command, "a constraint")), (removed) => [`Removed ${removed.removed}`]);
+        return yield* print(yield* client.removeStandingConstraint(workspaceId, binding.id, requiredArg(command, "a constraint")), (removed) => [`Removed ${removed.removed}`]);
       default:
         return yield* new CliError({ message: `Unknown constraint command: ${command.action}` });
     }
   });
 }
-var validateRunStatus = (status) => {
-  if (!isOneOf(RunStatuses, status))
-    throw new Error(`--status must be one of: ${RunStatuses.join(", ")}`);
-  return status;
+var validateRunDisplayStates = (value) => {
+  const states = value.split(",").flatMap((named) => RunDisplayStates.filter((known) => known === named));
+  if (states.length !== value.split(",").length)
+    throw new Error(`--state must be one or more of: ${RunDisplayStates.join(", ")}`);
+  return states;
 };
 function triggerCommand(args) {
   return gen(function* () {
@@ -4894,10 +4790,10 @@ function scheduleCommand(args) {
     const apiUrl = yield* resolveApiUrl(command.flags.apiUrl);
     const client = yield* loopClientFor(apiUrl);
     const operational = createOperationalCliClient(client);
-    const projectId = yield* optionalActiveProjectId(command.flags);
+    const teamId = yield* optionalActiveTeamId(command.flags);
     const response = yield* operational.publishSchedule(scheduleId, {
       workspaceId: yield* activeWorkspaceId(command.flags),
-      ...projectId === undefined ? undefined : { projectId },
+      ...teamId === undefined ? undefined : { teamId },
       ...yield* operationalInput(command, "schedule")
     }, yield* idempotencyKey(command.flags.idempotencyKey, "schedule-publish"));
     return yield* printOperationalResult(command, response);
@@ -5015,8 +4911,8 @@ function readString(value, keys) {
 function readNumber(value, keys) {
   return fieldValues(value, keys).find(isNumber);
 }
-function loopListQuery(projectId, limit) {
-  const query = new URLSearchParams({ projectId });
+function loopListQuery(teamId, limit) {
+  const query = new URLSearchParams({ teamId });
   if (limit !== undefined)
     query.set("limit", String(limit));
   return `?${query.toString()}`;
@@ -5041,30 +4937,30 @@ function runnerOwnershipFromCommand(command, required) {
   if (scopeType === undefined) {
     if (required)
       throw new Error("runner rescope requires --scope-type");
-    if (command.flags.scopeId !== undefined || command.flags.projectAccess !== undefined)
-      throw new Error("--scope-id and --project-access require --scope-type");
+    if (command.flags.scopeId !== undefined || command.flags.teamAccess !== undefined)
+      throw new Error("--scope-id and --team-access require --scope-type");
     return;
   }
   if (scopeType === "workspace") {
     if (command.flags.scopeId !== undefined)
-      throw new Error("workspace runner scope does not accept --scope-id; use --project-access selected and grants");
-    return { kind: "workspace", projectAccess: command.flags.projectAccess ?? "all" };
+      throw new Error("workspace runner scope does not accept --scope-id; use --team-access selected and grants");
+    return { kind: "workspace", teamAccess: command.flags.teamAccess ?? "all" };
   }
-  if (scopeType === "project") {
-    const projectId = command.flags.scopeId ?? command.flags.project;
-    if (!projectId)
-      throw new Error("project runner scope requires --scope-id <project-id>");
-    if (command.flags.projectAccess !== undefined)
-      throw new Error("project runner scope does not accept --project-access");
-    return { kind: "project", projectId };
+  if (scopeType === "team") {
+    const teamId = command.flags.scopeId ?? command.flags.team;
+    if (!teamId)
+      throw new Error("team runner scope requires --scope-id <team-id>");
+    if (command.flags.teamAccess !== undefined)
+      throw new Error("team runner scope does not accept --team-access");
+    return { kind: "team", teamId };
   }
   if (scopeType === "personal") {
     const ownerUserId = command.flags.scopeId;
     if (!ownerUserId)
       throw new Error("personal runner scope requires --scope-id <owner-user-id>");
-    return { kind: "personal", ownerUserId, projectAccess: command.flags.projectAccess ?? "all" };
+    return { kind: "personal", ownerUserId, teamAccess: command.flags.teamAccess ?? "all" };
   }
-  throw new Error("--scope-type must be workspace, project, or personal");
+  throw new Error("--scope-type must be workspace, team, or personal");
 }
 function loopRunnerCapabilities() {
   const capabilities = defaultRunnerCapabilities();
@@ -5125,7 +5021,7 @@ function resolveCommandConfig(flags = {}) {
     const localConfig = yield* readUserConfig(localConfigPathValue);
     const configFlags = {
       ...flags.apiUrl ? { apiUrl: flags.apiUrl } : undefined,
-      ...flags.project ? { project: flags.project } : undefined,
+      ...flags.team ? { team: flags.team } : undefined,
       ...flags.workspace ? { workspace: flags.workspace } : undefined
     };
     const envApiUrl = yield* apiUrlFromEnv;
@@ -5148,10 +5044,10 @@ function resolveCommandConfig(flags = {}) {
           ["localConfig", localConfig?.activeWorkspaceId],
           ["userConfig", userConfig?.activeWorkspaceId]
         ], "none"),
-        activeProject: firstConfigSource([
-          ["flag", flags.project],
-          ["localConfig", localConfig?.activeProjectId],
-          ["userConfig", userConfig?.activeProjectId]
+        activeTeam: firstConfigSource([
+          ["flag", flags.team],
+          ["localConfig", localConfig?.activeTeamId],
+          ["userConfig", userConfig?.activeTeamId]
         ], "none")
       },
       userConfigPath: yield* userConfigPath,
@@ -5176,36 +5072,36 @@ function optionalActiveWorkspaceId(flags) {
     return config.activeWorkspaceId;
   });
 }
-function activeProjectId(flags) {
+function activeTeamId(flags) {
   return gen(function* () {
     const { config } = yield* resolveCommandConfig(flags);
-    if (!config.activeProjectId) {
+    if (!config.activeTeamId) {
       return yield* new CliError({
-        message: "No active Project. Run kitman project use <project> or pass --project <project>."
+        message: "No active Team. Run kitman team use <team> or pass --team <team>."
       });
     }
-    return config.activeProjectId;
+    return config.activeTeamId;
   });
 }
-function optionalActiveProjectId(flags) {
+function optionalActiveTeamId(flags) {
   return gen(function* () {
     const { config } = yield* resolveCommandConfig(flags);
-    return config.activeProjectId;
+    return config.activeTeamId;
   });
 }
 function writeActiveWorkspace(apiUrl, workspaceId, local) {
   return gen(function* () {
     const path = local ? yield* localConfigPath : undefined;
     const existing = yield* readUserConfig(path);
-    const { activeProjectId: _activeProjectId, ...rest } = existing ?? {};
+    const { activeTeamId: _activeTeamId, ...rest } = existing ?? {};
     yield* writeUserConfig({ ...rest, apiUrl, activeWorkspaceId: workspaceId }, path);
   });
 }
-function writeActiveProject(apiUrl, workspaceId, projectId, local) {
+function writeActiveTeam(apiUrl, workspaceId, teamId, local) {
   return gen(function* () {
     const path = local ? yield* localConfigPath : undefined;
     const existing = yield* readUserConfig(path);
-    yield* writeUserConfig({ ...existing, apiUrl, activeWorkspaceId: workspaceId, activeProjectId: projectId }, path);
+    yield* writeUserConfig({ ...existing, apiUrl, activeWorkspaceId: workspaceId, activeTeamId: teamId }, path);
   });
 }
 function resolveWorkspace(client, workspaceRef) {
@@ -5223,14 +5119,8 @@ function requiredArg(command, name) {
     throw new Error(`${command.group} ${command.action} requires ${name}`);
   return value;
 }
-function projectRow(project) {
-  return {
-    id: project.id,
-    name: project.name,
-    slug: project.slug,
-    open: project.openTaskCount,
-    blocked: project.blockedTaskCount
-  };
+function teamRow(team) {
+  return { id: team.id, key: team.key, name: team.name, members: team.memberCount };
 }
 function kitRow(kit) {
   return { id: kit.id, name: kit.name, slug: kit.slug, kind: kit.kind, description: kit.description };
@@ -5317,18 +5207,19 @@ function repoBindingCredentialRefLabel(ref) {
 }
 function runnerRow(runner) {
   const ownership = runner.ownership;
-  let effectiveProjectAccess;
-  if (ownership.kind === "project")
-    effectiveProjectAccess = `project:${ownership.projectId}`;
-  else if (ownership.projectAccess === "selected")
-    effectiveProjectAccess = runner.projectGrantIds.join(",") || "selected_none";
+  let effectiveTeamAccess;
+  if (ownership.kind === "team")
+    effectiveTeamAccess = `team:${ownership.teamId}`;
+  else if (ownership.teamAccess === "selected")
+    effectiveTeamAccess = runner.teamGrantIds.join(",") || "selected_none";
   else
-    effectiveProjectAccess = ownership.kind === "workspace" ? "workspace_all" : `personal:${ownership.ownerUserId}`;
+    effectiveTeamAccess = ownership.kind === "workspace" ? "workspace_all" : `personal:${ownership.ownerUserId}`;
   return {
     id: runner.id,
     name: runner.name,
     status: runner.status,
-    health: runner.healthStatus,
+    state: runner.state.kind,
+    credentialStatus: runner.credentialStatus,
     agentIdentityId: runner.agentIdentityId,
     harnesses: runner.capabilities.harnesses.join(","),
     defaultHarness: runner.capabilities.defaultHarness ?? "",
@@ -5337,10 +5228,10 @@ function runnerRow(runner) {
     sandboxes: runner.capabilities.sandboxBackends.join(","),
     labels: runner.labels.join(","),
     ownership: ownership.kind,
-    projectAccess: ownership.kind === "project" ? undefined : ownership.projectAccess,
+    teamAccess: ownership.kind === "team" ? undefined : ownership.teamAccess,
     ownerUserId: ownership.kind === "personal" ? ownership.ownerUserId : undefined,
-    scopedProjectId: ownership.kind === "project" ? ownership.projectId : undefined,
-    effectiveProjectAccess,
+    scopedTeamId: ownership.kind === "team" ? ownership.teamId : undefined,
+    effectiveTeamAccess,
     managementBoundary: "workspace_operator_only",
     schedulingBoundary: "scope_and_identity_gated",
     lastHeartbeatAt: runner.lastHeartbeatAt
@@ -5363,7 +5254,8 @@ function runnerDoctorRow(runner) {
     id: runner.id,
     name: runner.name,
     status: runner.status,
-    health: runner.healthStatus,
+    state: runner.state.kind,
+    credentialStatus: runner.credentialStatus,
     runs: runner.capabilities.runs?.supported === true,
     harnesses: runner.capabilities.harnesses.join(","),
     defaultHarness: runner.capabilities.defaultHarness ?? "",
@@ -5427,8 +5319,8 @@ function sessionUpdateRow(update) {
 function dependencyTaskLabel(task) {
   if (task.redacted) {
     const taskId = task.taskId ?? "hidden-task";
-    const project = task.projectId === undefined ? "" : ` (${task.projectId})`;
-    return `[redacted] ${taskId}${project}`;
+    const team = task.teamId === undefined ? "" : ` (${task.teamId})`;
+    return `[redacted] ${taskId}${team}`;
   }
   return `${task.taskKey} ${task.title} [${task.state.name}]`;
 }
@@ -5456,7 +5348,7 @@ function downloadPresignedAsset(download, outputPath) {
   return gen(function* () {
     const fs = yield* FileSystem;
     const failed = (cause) => new CliError({ message: `Asset download failed: ${String(cause)}` });
-    const response = yield* send(make14(download.method)(download.url), failed);
+    const response = yield* send(make9(download.method)(download.url), failed);
     if (response.status < 200 || response.status >= 300)
       return yield* new CliError({ message: `Asset download failed with ${response.status}` });
     const body = yield* response.arrayBuffer.pipe(mapError((error) => failed(error.message)));
@@ -5613,15 +5505,15 @@ function parseRepoBindingCredentialRef(value) {
 }
 function repoBindingInput2(command) {
   if (!command.flags.provider)
-    throw new Error("project add-repo-binding requires --provider");
+    throw new Error("repo add requires --provider");
   if (!command.flags.host)
-    throw new Error("project add-repo-binding requires --host");
+    throw new Error("repo add requires --host");
   if (!command.flags.owner)
-    throw new Error("project add-repo-binding requires --owner");
+    throw new Error("repo add requires --owner");
   if (!command.flags.name)
-    throw new Error("project add-repo-binding requires --name");
+    throw new Error("repo add requires --name");
   if (!command.flags.defaultBranch)
-    throw new Error("project add-repo-binding requires --default-branch");
+    throw new Error("repo add requires --default-branch");
   return {
     provider: command.flags.provider,
     host: command.flags.host,
@@ -5848,5 +5740,5 @@ function cliErrorJson(error) {
 var program = runEffect(args).pipe(tapCause((cause) => {
   const error2 = squash(cause);
   return args.includes("--json") ? printJson(cliErrorJson(error2)) : error(error2 instanceof Error ? error2.message : String(error2));
-}), provide3(layer10));
+}), provide3(layer));
 runMain(program, { disableErrorReporting: true });