@lazehq/cli 0.1.27 → 0.1.29

package/dist/laze.mjs

@@ -18733,8 +18733,8 @@ var require_snapshot_utils = __commonJS({
 var require_snapshot_recorder = __commonJS({
   "../../node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
-    var { writeFile: writeFile22, readFile: readFile37, mkdir: mkdir20 } = __require("node:fs/promises");
-    var { dirname: dirname20, resolve: resolve17 } = __require("node:path");
+    var { writeFile: writeFile23, readFile: readFile38, mkdir: mkdir21 } = __require("node:fs/promises");
+    var { dirname: dirname21, resolve: resolve17 } = __require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -18950,7 +18950,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile37(resolve17(path), "utf8");
+          const data = await readFile38(resolve17(path), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -18980,12 +18980,12 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         const resolvedPath = resolve17(path);
-        await mkdir20(dirname20(resolvedPath), { recursive: true });
+        await mkdir21(dirname21(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
           snapshot
         }));
-        await writeFile22(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
+        await writeFile23(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
       }
       /**
        * Clears all recorded snapshots
@@ -35506,6 +35506,8 @@ function cliEnvironment({
 } = {}) {
   return {
     configPath: env.LAZE_CLI_CONFIG || join(homedir(), ".laze", "config.json"),
+    // Claude Code names a subagent's commands `claude-code_<version>_agent`.
+    subagent: /^claude-code_.+_agent$/.test(env.AI_AGENT ?? ""),
     profile: env.LAZE_PROFILE || void 0,
     url: env.LAZE_URL || void 0,
     opsToken: env.LAZE_OPS_TOKEN || void 0,
@@ -35611,12 +35613,12 @@ var ConfigStore = class _ConfigStore {
 };
 function chooseProfile({
   config: config2,
-  flag,
+  flag: flag2,
   environment,
   cwd
 }) {
   const bound = boundProfileOf({ bindings: config2.bindings, cwd });
-  const name2 = flag || environment || bound || config2.current;
+  const name2 = flag2 || environment || bound || config2.current;
   const profile = name2 ? config2.profiles[name2] : void 0;
   return name2 && profile ? { name: name2, profile } : { name: void 0, profile: void 0 };
 }
@@ -35705,7 +35707,7 @@ function flagText({
 }
 
 // src/rules/cli-version.rules.ts
-var STAMPED = "0.1.27";
+var STAMPED = "0.1.29";
 function cliVersionOf({ stamped = STAMPED } = {}) {
   return stamped.startsWith("__") ? "dev" : stamped;
 }
@@ -61862,6 +61864,13 @@ var VAULT_GMAIL_SEND_PATHS = [
   "/upload/gmail/v1/users/*/drafts/send"
 ];
 var VAULT_MAX_LEASE_SECONDS = 2 * 86400;
+var VAULT_LEASE_CHOICES = [
+  15 * 60,
+  3600,
+  8 * 3600,
+  86400,
+  VAULT_MAX_LEASE_SECONDS
+];
 var vaultConnectionSchemaDefinition = external_exports.object({
   id: external_exports.string().min(1),
   workspaceId: external_exports.string().min(1),
@@ -61874,7 +61883,7 @@ var vaultConnectionSchemaDefinition = external_exports.object({
   rules: external_exports.string(),
   /** Who answers an ask on a workspace or agent keychain; a personal one asks its owner. */
   approverUserIds: external_exports.array(external_exports.string().min(1)),
-  /** The longest lease an approver may give, set by an admin. */
+  /** How long an approval lasts for the agent; null takes the deployment's default, 2 days. */
   maxLeaseSeconds: external_exports.number().int().positive().nullable(),
   /** Every use asks a person: no lease is offered and none covers it. */
   everyUseAsks: external_exports.boolean().default(false),
@@ -62190,16 +62199,28 @@ var vaultMostAskedSchemaDefinition = external_exports.object({
   )
 });
 var vaultMostAskedSchema = vaultMostAskedSchemaDefinition;
+var vaultUseOriginSchema = external_exports.enum(["computer", "connected"]);
 var vaultConnectionUseSchemaDefinition = external_exports.object({
   at: external_exports.iso.datetime(),
   action: external_exports.string(),
   outcome: external_exports.string(),
+  /** Who used it: a person (`user`), an agent, or Laze itself (`system`). */
+  actorKind: external_exports.enum(["user", "agent", "system"]).default("system"),
+  actorId: external_exports.string().nullable().default(null),
   agentId: external_exports.string().nullable(),
   requesterUserId: external_exports.string().nullable(),
   channelId: external_exports.string().nullable(),
   reason: external_exports.string().nullable(),
   /** The command or tool, as the use named it. */
-  command: external_exports.array(external_exports.string())
+  command: external_exports.array(external_exports.string()),
+  /** What let it through, such as `approval`, `lease`, `judge` or `sensitivity`. */
+  decider: external_exports.string().nullable().default(null),
+  /** The approval card the use came under; uses under one lease share it. */
+  requestId: external_exports.string().nullable().default(null),
+  leaseId: external_exports.string().nullable().default(null),
+  origin: vaultUseOriginSchema.nullable().default(null),
+  /** How a person's read happened: `page` (Reveal) or `own_secret` (the CLI or Laze for them). */
+  via: external_exports.string().nullable().default(null)
 });
 var vaultConnectionUseSchema = vaultConnectionUseSchemaDefinition;
 var vaultRevokeAtProviderSchema = external_exports.enum(["revoked", "failed", "not_supported"]);
@@ -62334,6 +62355,39 @@ var vaultConfig = Config.define((c) => ({
   auditHeadFile: c.env("VAULT_AUDIT_HEAD_FILE", external_exports.string().min(1).optional())
 }));
 
+// ../../modules/vault/contract/src/vault-levels.ts
+var LEVEL_LABELS = {
+  auto: "Allow",
+  checked: "Auto",
+  ask: "Always ask",
+  human_only: "Human only"
+};
+function vaultLevelLabel(level) {
+  return LEVEL_LABELS[level];
+}
+var CLI_LEVELS = {
+  auto: "allow",
+  checked: "auto",
+  ask: "always-ask",
+  human_only: "human-only"
+};
+var VAULT_CLI_LEVEL_NAMES = [
+  "allow",
+  "auto",
+  "always-ask",
+  "human-only"
+];
+function vaultCliLevelOf(level) {
+  return CLI_LEVELS[level];
+}
+function vaultLevelOfCliName(name2) {
+  const wanted = name2.toLowerCase();
+  const found = Object.keys(CLI_LEVELS).find(
+    (level) => CLI_LEVELS[level] === wanted
+  );
+  return found ?? "unknown";
+}
+
 // ../../modules/vault/contract/src/vault.errors.ts
 var VaultSealMismatchError = class extends HandledError {
   constructor() {
@@ -64106,6 +64160,11 @@ var setAgentHostInputSchemaDefinition = external_exports.object({
   agentId: idSchema14,
   host: agentHostSchemaDefinition.nullable()
 });
+var setAgentComputerKeyInputSchemaDefinition = external_exports.object({
+  workspaceId: workspaceIdSchema10,
+  agentId: idSchema14,
+  computerKey: external_exports.string().min(1).max(200).nullable()
+});
 var agentSchemaDefinition = external_exports.object({
   id: idSchema14,
   workspaceId: workspaceIdSchema10,
@@ -64136,6 +64195,8 @@ var agentSchemaDefinition = external_exports.object({
   pauseReason: external_exports.string().nullable().default(null),
   /** The owner's own machine the agent's turns run on; null for a Laze sandbox. */
   host: agentHostSchemaDefinition.nullable().default(null),
+  /** The Laze computer it runs on, as compute names it; null for its owner's default computer. */
+  computerKey: external_exports.string().nullable().default(null),
   /** The login pool a Claude Code or Codex agent draws from; null for its owner's own logins. */
   loginPoolId: external_exports.string().nullable().default(null),
   /** The login it runs on now, "On Work Max"; null before its first turn and on other harnesses. */
@@ -66918,6 +66979,12 @@ async function liveElsewhere({
   }
   return false;
 }
+function refuseInSubagent({ context, args }) {
+  if (!context.environment.subagent || flagText({ args, name: "session" })) return;
+  throw new CliUsageError(
+    "This runs inside a Claude Code subagent, which shares its parent's session: it would take that session. Run it in the session itself, or pass --session <id>."
+  );
+}
 function notBoundText({
   meta: meta3,
   agent: agent2,
@@ -67709,8 +67776,8 @@ async function takeLock({
   const self2 = context.processes.pid;
   if (holder && holder.pid !== self2 && context.processes.alive(holder.pid)) {
     const served = await holderClaudeOf({ context, holder });
-    const mine3 = preempt && served === claudePid && !holder.monitor;
-    if (served && context.processes.alive(served) && !mine3) return false;
+    const mine4 = preempt && served === claudePid && !holder.monitor;
+    if (served && context.processes.alive(served) && !mine4) return false;
     context.processes.stop(holder.pid);
   }
   await mkdir6(dirname6(path), { recursive: true, mode: 448 });
@@ -69432,6 +69499,7 @@ async function linkCodexSession({
 
 // src/services/laze-plugin.service.ts
 import { mkdir as mkdir11, readFile as readFile11, writeFile as writeFile11 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
 import { dirname as dirname11, join as join13 } from "node:path";
 
 // src/rules/laze-plugin.rules.ts
@@ -69572,15 +69640,7 @@ async function writeLazePlugin({ context }) {
   }
   return folder;
 }
-async function registerWithClaude({ context, folder }) {
-  const quiet = ">/dev/null 2>&1 </dev/null";
-  const script = [
-    `claude plugin marketplace add ${quote2(folder)} --scope user ${quiet}`,
-    `claude plugin marketplace update ${LAZE_PLUGIN} ${quiet}`,
-    // install is a no-op for a plugin Claude Code already has; update refreshes its cached copy.
-    `{ claude plugin install ${LAZE_PLUGIN}@${LAZE_PLUGIN} --scope user ${quiet} || true; }`,
-    `claude plugin update ${LAZE_PLUGIN}@${LAZE_PLUGIN} ${quiet}`
-  ].join("; ");
+async function claudeScript({ context, script }) {
   const stop3 = new AbortController();
   const command = ["sh", "-c", script];
   const run4 = context.runCommand({ command, env: {}, signal: stop3.signal }).catch(() => 1);
@@ -69591,6 +69651,44 @@ async function registerWithClaude({ context, folder }) {
   stop3.abort();
   return code === 0;
 }
+var QUIET = ">/dev/null 2>&1 </dev/null";
+async function registerWithClaude({ context, folder }) {
+  const script = [
+    `claude plugin marketplace add ${quote2(folder)} --scope user ${QUIET}`,
+    `claude plugin marketplace update ${LAZE_PLUGIN} ${QUIET}`,
+    // install is a no-op for a plugin Claude Code already has; update refreshes its cached copy.
+    `{ claude plugin install ${LAZE_PLUGIN}@${LAZE_PLUGIN} --scope user ${QUIET} || true; }`,
+    `claude plugin update ${LAZE_PLUGIN}@${LAZE_PLUGIN} ${QUIET}`
+  ].join("; ");
+  return claudeScript({ context, script });
+}
+var RUN_FILES = ["hooks/hooks.json", "monitors/monitors.json"];
+async function cachedPluginOf({ context }) {
+  const inherited = context.environment.inherited;
+  const home = inherited.HOME || homedir3();
+  const claude = inherited.CLAUDE_CONFIG_DIR || join13(home, ".claude");
+  const listed = await readFile11(join13(claude, "plugins", "installed_plugins.json"), "utf8").then(
+    (text2) => JSON.parse(text2),
+    () => void 0
+  );
+  return listed?.plugins?.[`${LAZE_PLUGIN}@${LAZE_PLUGIN}`]?.[0]?.installPath;
+}
+async function refreshStaleCache({ context, folder }) {
+  const cached2 = await cachedPluginOf({ context });
+  if (!cached2) return true;
+  const read3 = (path) => readFile11(path, "utf8").catch(() => "");
+  for (const file3 of RUN_FILES) {
+    const ours = await read3(join13(folder, LAZE_PLUGIN, file3));
+    if (ours === await read3(join13(cached2, file3))) continue;
+    const plugin2 = `${LAZE_PLUGIN}@${LAZE_PLUGIN}`;
+    const script = [
+      `claude plugin uninstall ${plugin2} --scope user ${QUIET}`,
+      `claude plugin install ${plugin2} --scope user ${QUIET}`
+    ].join("; ");
+    return claudeScript({ context, script });
+  }
+  return true;
+}
 function registeredMarkOf({ context }) {
   return join13(pluginFolderOf({ context }), "registered");
 }
@@ -69602,7 +69700,7 @@ async function pluginRegistered({ context }) {
 }
 async function installLazePlugin({ context }) {
   const folder = await writeLazePlugin({ context });
-  const registered = await registerWithClaude({ context, folder });
+  const registered = await registerWithClaude({ context, folder }) && await refreshStaleCache({ context, folder });
   if (registered) await writeFile11(registeredMarkOf({ context }), cliVersionOf());
   return { folder, registered };
 }
@@ -69885,8 +69983,8 @@ async function registerMcp({
   directory,
   profile
 }) {
-  const add3 = mcpAddCommandOf({ context, profile });
-  const script = `cd ${quote3(directory)} && { claude mcp remove --scope local ${LAZE_MCP_SERVER} >/dev/null 2>&1 </dev/null; ${add3} >/dev/null 2>&1 </dev/null; }`;
+  const add4 = mcpAddCommandOf({ context, profile });
+  const script = `cd ${quote3(directory)} && { claude mcp remove --scope local ${LAZE_MCP_SERVER} >/dev/null 2>&1 </dev/null; ${add4} >/dev/null 2>&1 </dev/null; }`;
   const run4 = context.runCommand({ command: ["sh", "-c", script], env: {} }).catch(() => 1);
   const done = new AbortController();
   const gaveUp = context.sleep(MCP_REGISTER_LIMIT_MS, done.signal).then(() => -1);
@@ -69951,6 +70049,7 @@ function sandboxed({ context, error: error62 }) {
 async function linkAgent({ context, args }) {
   const token2 = flagText({ args, name: "token" });
   if (!token2) throw new CliUsageError("Usage: laze agent link --token <token>");
+  refuseInSubagent({ context, args });
   const url2 = serverUrlOf({ context, args });
   const { harness, pid } = await harnessOf2({ context, args });
   const client = LazeClient.create({ baseUrl: url2, fetcher: context.fetcher });
@@ -70542,7 +70641,7 @@ async function loginValueOf({
   args,
   usage
 }) {
-  if (SECRET_FLAGS.some((flag) => args.flags[flag] !== void 0)) {
+  if (SECRET_FLAGS.some((flag2) => args.flags[flag2] !== void 0)) {
     throw new CliUsageError(
       "laze: a login token is read from stdin or --from-vault only, never from an argument, so it stays out of your shell history."
     );
@@ -70661,7 +70760,7 @@ var LOGIN_ACTIONS = {
     words: 1,
     run: async (step) => {
       const login2 = loginNamed({ logins: await loginsOf(step.client), wanted: step.first });
-      if (SECRET_FLAGS.some((flag) => step.args.flags[flag] !== void 0)) {
+      if (SECRET_FLAGS.some((flag2) => step.args.flags[flag2] !== void 0)) {
         throw new CliUsageError(LOGIN_SIGN_IN_USAGE);
       }
       const secret = await secretOnStdin({ context: step.context });
@@ -70846,6 +70945,7 @@ async function bindAgentSession({
   context,
   args
 }) {
+  refuseInSubagent({ context, args });
   const session = await currentSessionOf({ context, args });
   if (!session) throw new CliUsageError(NO_SESSION);
   const key = sessionKeyOf({ session });
@@ -72027,7 +72127,9 @@ var appPinSchemaDefinition = external_exports.object({
   pinnedByName: external_exports.string().nullable(),
   pinnedAt: external_exports.iso.datetime(),
   /** Set for a browser tab, null for an app. */
-  browser: browserPinSchemaDefinition.nullable()
+  browser: browserPinSchemaDefinition.nullable(),
+  /** Whether the reader may unpin it; a browser tab only its owner, their agents or an Admin. */
+  canUnpin: external_exports.boolean().default(true)
 });
 var appPinViewSchemaDefinition = external_exports.object({
   activeAppId: external_exports.string().nullable(),
@@ -72533,6 +72635,7 @@ var AppNavSlot = appUi.component("nav");
 var AppPanelSlot = appUi.component("panel");
 var AppCardSlot = appUi.component("card");
 var AppPinStripSlot = appUi.component("pin-strip");
+var AppPinListSlot = appUi.component("pin-list");
 
 // ../../modules/app/contract/src/app.config.ts
 var appConfig = Config.define((c) => ({
@@ -73096,10 +73199,9 @@ var USAGE2 = `Usage:
   laze app connections
   laze app connection allow <connection>
   laze app connection revoke <connection>`;
-var LEVELS3 = { auto: "Auto", checked: "Checked", ask: "Ask", human_only: "Human only" };
 function connectionLine(connection) {
   const whose = connection.ownerUserId ? `${connection.ownerName}'s keychain` : "workspace keychain";
-  return `${connection.name}  ${connection.label}, ${whose}, ${LEVELS3[connection.sensitivity]}
+  return `${connection.name}  ${connection.label}, ${whose}, ${vaultLevelLabel(connection.sensitivity)}
     used by ${connection.functions.join(", ")}; ${stateOf(connection)}
 `;
 }
@@ -75673,7 +75775,7 @@ function filterOf({ args }) {
     ["mentions", "mention"],
     ["threads", "thread_reply"],
     ["reactions", "reaction"]
-  ].filter(([flag]) => args.flags[flag] !== void 0);
+  ].filter(([flag2]) => args.flags[flag2] !== void 0);
   if (picked.length > 1) throw new CliUsageError(ACTIVITY_USAGE);
   return picked[0]?.[1] ?? "all";
 }
@@ -75706,7 +75808,7 @@ async function activityRead({ context, args }) {
 
 // src/services/channel-config-commands.service.ts
 var AGENT_HINT2 = "Roles, archiving and removing others are a channel admin's change: ask one.\n";
-var LEVELS4 = ["default", "all", "mentions", "nothing", "mute", "unmute"];
+var LEVELS3 = ["default", "all", "mentions", "nothing", "mute", "unmute"];
 async function changing2({
   context,
   profile,
@@ -75892,7 +75994,7 @@ function instantOf({ until }) {
 }
 function notifyBodyOf({ args }) {
   const [, , channel, word3] = args.words;
-  const level = LEVELS4.find((candidate) => candidate === word3);
+  const level = LEVELS3.find((candidate) => candidate === word3);
   if (!channel || !level) throw new CliUsageError(NOTIFY_USAGE);
   if (level === "unmute") return { channel, muted: false };
   if (level !== "mute") return { channel, level };
@@ -76449,8 +76551,8 @@ async function deliverOnce({
   profile
 }) {
   const lock = statePathOf({ context, kind: "waiters", profile });
-  const mine3 = (await holderOf({ path: lock }))?.pid === context.processes.pid;
-  if (!mine3 && !await takeLock({ context, path: lock, claudePid, preempt: true })) {
+  const mine4 = (await holderOf({ path: lock }))?.pid === context.processes.pid;
+  if (!mine4 && !await takeLock({ context, path: lock, claudePid, preempt: true })) {
     return "outranked";
   }
   const named = { ...args, flags: { ...args.flags, profile } };
@@ -77039,6 +77141,12 @@ var computeGuardSweepStateDefinition = external_exports.object({ lastSweepAt: ex
 var computeGuardSweepIntentDefinition = external_exports.object({ scheduledFor: external_exports.number() });
 
 // ../../modules/compute/contract/src/computer.ts
+var computerKindSchema = external_exports.enum(["default", "personal", "shared"]);
+var computerCreatorsDefinition = external_exports.object({
+  /** Every Member, present and future; Owners and Admins always may. */
+  everyone: external_exports.boolean(),
+  userIds: external_exports.array(external_exports.string())
+});
 var sizeTermsDefinition = external_exports.object({
   id: computerSizeSchema,
   label: external_exports.string(),
@@ -77056,7 +77164,9 @@ var computerAgentDefinition = external_exports.object({
   state: external_exports.enum(["working", "idle", "asleep"]),
   /** CPUs busy, 1 = one vCPU fully busy. */
   cpuBusy: external_exports.number().nonnegative(),
-  memoryGb: external_exports.number().nonnegative()
+  memoryGb: external_exports.number().nonnegative(),
+  /** Whose agent it is, on a shared computer; null on a person's own. */
+  ownerName: external_exports.string().nullable().default(null)
 });
 var memoryStopDefinition = external_exports.object({
   agentId: external_exports.string(),
@@ -77101,6 +77211,12 @@ var computerRequestDefinition = external_exports.object({
 var computerRequestSchema = computerRequestDefinition;
 var computerStatusDefinition = external_exports.object({
   workspaceId: external_exports.string(),
+  /** `default` is the person's included computer; more computers have their own ids. */
+  computerId: external_exports.string().default("default"),
+  kind: computerKindSchema.default("default"),
+  /** Who may put agents on a shared computer; null on a person's own. */
+  creators: computerCreatorsDefinition.nullable().default(null),
+  canDelete: external_exports.boolean().default(false),
   /** The person whose computer this is; an agent reads its owner's. */
   ownerUserId: external_exports.string(),
   ownerName: external_exports.string(),
@@ -77143,7 +77259,9 @@ var computerStatusDefinition = external_exports.object({
 var computerStatusSchema = computerStatusDefinition;
 var setComputerSizeInputDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
-  size: external_exports.string().trim().toLowerCase().min(1).max(32)
+  size: external_exports.string().trim().toLowerCase().min(1).max(32),
+  /** Another computer of the caller's, or a shared one; absent for the default computer. */
+  computerId: external_exports.string().min(1).max(64).optional()
 });
 var setComputerSizeInputSchema = setComputerSizeInputDefinition;
 var computerSizeAnswerDefinition = external_exports.object({
@@ -77193,7 +77311,69 @@ var restRestartComputerInputDefinition = restartComputerInputDefinition.omit({
 });
 var restComputerSizeInputDefinition = setComputerSizeInputDefinition.omit({ workspaceId: true });
 var restComputerRequestRefDefinition = computerRequestRefDefinition.omit({ workspaceId: true });
+var myComputersDefinition = external_exports.object({
+  currency: currencySchema,
+  computers: external_exports.array(computerStatusDefinition),
+  /** Whether the caller may add a computer at once; otherwise adding files a request. */
+  canAdd: external_exports.boolean(),
+  canAddShared: external_exports.boolean()
+});
+var myComputersSchema = myComputersDefinition;
+var createComputerInputDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  name: external_exports.string().trim().min(1).max(40),
+  size: computerSizeSchema,
+  kind: external_exports.enum(["personal", "shared"]),
+  creators: computerCreatorsDefinition.nullable().default(null)
+});
+var createComputerInputSchema = createComputerInputDefinition;
+var computerRefDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  computerId: external_exports.string().min(1).max(64)
+});
+var deleteComputerInputDefinition = external_exports.object({
+  ...computerRefDefinition.shape,
+  moveTo: external_exports.string().min(1).max(64).nullable().default(null)
+});
+var deleteComputerInputSchema = deleteComputerInputDefinition;
+var deleteComputerAnswerDefinition = external_exports.object({
+  computerId: external_exports.string(),
+  /** The agents moved to `moveTo` before the delete. */
+  moved: external_exports.array(external_exports.string()),
+  message: external_exports.string()
+});
+var deleteComputerAnswerSchema = deleteComputerAnswerDefinition;
+var setComputerCreatorsInputDefinition = external_exports.object({
+  ...computerRefDefinition.shape,
+  creators: computerCreatorsDefinition
+});
+var setComputerCreatorsInputSchema = setComputerCreatorsInputDefinition;
+var setAgentComputerInputDefinition = external_exports.object({
+  ...computerRefDefinition.shape,
+  agentId: external_exports.string().min(1)
+});
+var setAgentComputerInputSchema = setAgentComputerInputDefinition;
+var agentComputerAnswerDefinition = external_exports.object({
+  agentId: external_exports.string(),
+  computerId: external_exports.string(),
+  message: external_exports.string()
+});
+var agentComputerAnswerSchema = agentComputerAnswerDefinition;
+var restCreateComputerInputDefinition = createComputerInputDefinition.omit({
+  workspaceId: true
+});
+var restDeleteComputerInputDefinition = deleteComputerInputDefinition.omit({ workspaceId: true });
+var restSetComputerCreatorsInputDefinition = setComputerCreatorsInputDefinition.omit({
+  workspaceId: true
+});
+var restSetAgentComputerInputDefinition = setAgentComputerInputDefinition.omit({
+  workspaceId: true
+});
 var computerListEntryDefinition = external_exports.object({
+  computerId: external_exports.string().default("default"),
+  kind: computerKindSchema.default("default"),
+  /** Set on a person's extra computers and on shared ones; null on a default computer. */
+  name: external_exports.string().nullable().default(null),
   ownerUserId: external_exports.string(),
   ownerName: external_exports.string(),
   size: computerSizeSchema,
@@ -77215,7 +77395,12 @@ var COMPUTER_REST_PATHS = {
   size: "/api/compute/computer/size",
   requests: "/api/compute/computer/requests",
   cancelRequest: "/api/compute/computer/requests/cancel",
-  restart: "/api/compute/computer/restart"
+  restart: "/api/compute/computer/restart",
+  mine: "/api/compute/computers/mine",
+  create: "/api/compute/computers",
+  remove: "/api/compute/computers/remove",
+  creators: "/api/compute/computers/creators",
+  agent: "/api/compute/computers/agent"
 };
 var computerWatchStateDefinition = external_exports.object({
   nextWakeAt: external_exports.number().nullable(),
@@ -77788,7 +77973,9 @@ var ownMachineSshConnectDefinition = external_exports.object({
 var ownMachineSshConnectSchema = ownMachineSshConnectDefinition;
 var reconcileDefinition = external_exports.object({ workspaceId: workspaceIdSchema18, machineId: idSchema19 });
 var ComputeApi = moduleApi()("compute");
-var computeTrpc = defineTrpcContract("compute").query("status").withInput(computeWorkspaceInputSchema).withOutput(computeStatusSchema).query("browserTabs").withInput(browserTabListInputSchema).withOutput(browserTabListSchema).query("browserTab").withInput(browserTabInputSchema).withOutput(browserTabSchema).mutation("openBrowserTab").withInput(openBrowserTabInputSchema).withOutput(browserTabSchema).mutation("browserTabScreen").withInput(browserTabInputSchema).withOutput(browserTabScreenSchema).mutation("gotoBrowserTab").withInput(browserTabGotoInputSchema).withOutput(browserTabPageSchema).mutation("doneOnBrowserTab").withInput(browserTabInputSchema).withOutput(browserTabSchema).mutation("shareBrowserTab").withInput(browserTabShareInputSchema).withOutput(browserTabSchema).mutation("closeBrowserTab").withInput(browserTabInputSchema).withOutput(external_exports.object({ closed: external_exports.literal(true) })).query("computer").withInput(computeWorkspaceInputSchema).withOutput(computerStatusSchema).mutation("setComputerSize").withInput(setComputerSizeInputSchema).withOutput(computerSizeAnswerSchema).mutation("requestComputerSize").withInput(setComputerSizeInputSchema).withOutput(computerRequestSchema).mutation("cancelComputerRequest").withInput(computerRequestRefSchema).withOutput(computerRequestSchema).mutation("restartComputer").withInput(restartComputerInputSchema).withOutput(computerRestartAnswerSchema).query("computers").withInput(computeWorkspaceInputSchema).withOutput(computerListSchema).query("dedicatedIp").withInput(computeWorkspaceInputSchema).withOutput(dedicatedIpStatusSchema).mutation("setDedicatedIp").withInput(setDedicatedIpInputSchema).withOutput(dedicatedIpAnswerSchema).mutation("turnOffDedicatedIp").withInput(computeWorkspaceInputSchema).withOutput(dedicatedIpAnswerSchema).mutation("setDedicatedIpDomains").withInput(setDedicatedIpDomainsInputSchema).withOutput(dedicatedIpAnswerSchema).query("dedicatedIps").withInput(computeWorkspaceInputSchema).withOutput(dedicatedIpListSchema).query("dedicatedIpCountries").withInput(computeWorkspaceInputSchema).withOutput(dedicatedIpCountriesSchema).query("dedicatedIpOffer").withInput(dedicatedIpOfferInputSchema).withOutput(dedicatedIpOfferSchema).query("list").withInput(computeWorkspaceInputSchema).withOutput(external_exports.array(machineSchema)).query("get").withInput(machineRefSchema).withOutput(machineSchema).mutation("setupBrowser").withInput(setupBrowserInputSchema).withOutput(machineSchema).mutation("sleep").withInput(machineRefSchema).withOutput(machineSchema).mutation("wake").withInput(machineRefSchema).withOutput(machineSchema).mutation("delete").withInput(machineRefSchema).withOutput(machineSchema).mutation("rename").withInput(renameMachineInputSchema).withOutput(machineSchema).mutation("grant").withInput(machineGrantInputSchema).withOutput(machineSchema).mutation("revokeGrant").withInput(machineGrantInputSchema).withOutput(machineSchema).mutation("setBudget").withInput(setMachineBudgetInputSchema).withOutput(machineSchema).mutation("openScreen").withInput(openScreenInputSchema).withOutput(screenSessionSchema).mutation("finishScreen").withInput(screenRefSchema).withOutput(machineSchema).mutation("connectOwn").withInput(connectOwnMachineInputSchema).withOutput(ownMachineConnectSchema).mutation("newConnectCommand").withInput(machineRefSchema).withOutput(ownMachineConnectSchema).mutation("connectSsh").withInput(connectSshMachineInputSchema).withOutput(ownMachineSshConnectSchema).mutation("trustHostKey").withInput(trustHostKeyInputSchema).withOutput(machineSchema).mutation("checkHealth").withInput(machineRefSchema).withOutput(machineSchema).mutation("hostAgent").withInput(hostAgentInputSchema).withOutput(machineSchema).mutation("unhostAgent").withInput(unhostAgentInputSchema).withOutput(external_exports.object({ agentId: external_exports.string() })).mutation("pairWhatsapp").withInput(machineRefSchema).withOutput(whatsappPairingSchema).query("whatsappPairing").withInput(whatsappPairingRefSchema).withOutput(whatsappPairingSchema).mutation("cancelWhatsappPairing").withInput(whatsappPairingRefSchema).withOutput(whatsappPairingSchema).mutation("unpairWhatsapp").withInput(machineRefSchema).withOutput(machineSchema).build();
+var computeCoreTrpc = defineTrpcContract("compute").query("status").withInput(computeWorkspaceInputSchema).withOutput(computeStatusSchema).query("browserTabs").withInput(browserTabListInputSchema).withOutput(browserTabListSchema).query("browserTab").withInput(browserTabInputSchema).withOutput(browserTabSchema).mutation("openBrowserTab").withInput(openBrowserTabInputSchema).withOutput(browserTabSchema).mutation("browserTabScreen").withInput(browserTabInputSchema).withOutput(browserTabScreenSchema).mutation("gotoBrowserTab").withInput(browserTabGotoInputSchema).withOutput(browserTabPageSchema).mutation("doneOnBrowserTab").withInput(browserTabInputSchema).withOutput(browserTabSchema).mutation("shareBrowserTab").withInput(browserTabShareInputSchema).withOutput(browserTabSchema).mutation("closeBrowserTab").withInput(browserTabInputSchema).withOutput(external_exports.object({ closed: external_exports.literal(true) })).query("computer").withInput(computeWorkspaceInputSchema).withOutput(computerStatusSchema).mutation("setComputerSize").withInput(setComputerSizeInputSchema).withOutput(computerSizeAnswerSchema).mutation("requestComputerSize").withInput(setComputerSizeInputSchema).withOutput(computerRequestSchema).mutation("cancelComputerRequest").withInput(computerRequestRefSchema).withOutput(computerRequestSchema).mutation("restartComputer").withInput(restartComputerInputSchema).withOutput(computerRestartAnswerSchema).query("computers").withInput(computeWorkspaceInputSchema).withOutput(computerListSchema).query("dedicatedIp").withInput(computeWorkspaceInputSchema).withOutput(dedicatedIpStatusSchema).mutation("setDedicatedIp").withInput(setDedicatedIpInputSchema).withOutput(dedicatedIpAnswerSchema).mutation("turnOffDedicatedIp").withInput(computeWorkspaceInputSchema).withOutput(dedicatedIpAnswerSchema).mutation("setDedicatedIpDomains").withInput(setDedicatedIpDomainsInputSchema).withOutput(dedicatedIpAnswerSchema).query("dedicatedIps").withInput(computeWorkspaceInputSchema).withOutput(dedicatedIpListSchema).query("dedicatedIpCountries").withInput(computeWorkspaceInputSchema).withOutput(dedicatedIpCountriesSchema).query("dedicatedIpOffer").withInput(dedicatedIpOfferInputSchema).withOutput(dedicatedIpOfferSchema).query("list").withInput(computeWorkspaceInputSchema).withOutput(external_exports.array(machineSchema)).query("get").withInput(machineRefSchema).withOutput(machineSchema).mutation("setupBrowser").withInput(setupBrowserInputSchema).withOutput(machineSchema).mutation("sleep").withInput(machineRefSchema).withOutput(machineSchema).mutation("wake").withInput(machineRefSchema).withOutput(machineSchema).mutation("delete").withInput(machineRefSchema).withOutput(machineSchema).mutation("rename").withInput(renameMachineInputSchema).withOutput(machineSchema).mutation("grant").withInput(machineGrantInputSchema).withOutput(machineSchema).mutation("revokeGrant").withInput(machineGrantInputSchema).withOutput(machineSchema).mutation("setBudget").withInput(setMachineBudgetInputSchema).withOutput(machineSchema).mutation("openScreen").withInput(openScreenInputSchema).withOutput(screenSessionSchema).mutation("finishScreen").withInput(screenRefSchema).withOutput(machineSchema).mutation("connectOwn").withInput(connectOwnMachineInputSchema).withOutput(ownMachineConnectSchema).mutation("newConnectCommand").withInput(machineRefSchema).withOutput(ownMachineConnectSchema).mutation("connectSsh").withInput(connectSshMachineInputSchema).withOutput(ownMachineSshConnectSchema).mutation("trustHostKey").withInput(trustHostKeyInputSchema).withOutput(machineSchema).mutation("checkHealth").withInput(machineRefSchema).withOutput(machineSchema).mutation("hostAgent").withInput(hostAgentInputSchema).withOutput(machineSchema).mutation("unhostAgent").withInput(unhostAgentInputSchema).withOutput(external_exports.object({ agentId: external_exports.string() })).mutation("pairWhatsapp").withInput(machineRefSchema).withOutput(whatsappPairingSchema).query("whatsappPairing").withInput(whatsappPairingRefSchema).withOutput(whatsappPairingSchema).mutation("cancelWhatsappPairing").withInput(whatsappPairingRefSchema).withOutput(whatsappPairingSchema).mutation("unpairWhatsapp").withInput(machineRefSchema).withOutput(machineSchema).build();
+var computeFleetTrpc = defineTrpcContract("compute").query("myComputers").withInput(computeWorkspaceInputSchema).withOutput(myComputersSchema).mutation("createComputer").withInput(createComputerInputSchema).withOutput(computerStatusSchema).mutation("deleteComputer").withInput(deleteComputerInputSchema).withOutput(deleteComputerAnswerSchema).mutation("setComputerCreators").withInput(setComputerCreatorsInputSchema).withOutput(computerStatusSchema).mutation("setAgentComputer").withInput(setAgentComputerInputSchema).withOutput(agentComputerAnswerSchema).build();
+var computeTrpc = joinTrpcContracts("compute", computeCoreTrpc, computeFleetTrpc);
 var restMachineInputDefinition = external_exports.object({ machine: external_exports.string().min(1).max(64) });
 var restRenameInputDefinition = external_exports.object({
   machine: external_exports.string().min(1).max(64),
@@ -77858,6 +78045,96 @@ var computeUi = uiTokens("compute");
 var ComputeBrowserTabSlot = computeUi.component("browser-tab");
 var ComputeOpenBrowserSlot = computeUi.component("open-browser");
 
+// src/services/computer-fleet-commands.service.ts
+var COMPUTER_FLEET_USAGE = `  laze computer mine [--json]        every Laze computer your agents may run on, your default one first
+  laze computer add <name> --size <size> [--shared [--everyone | --people <id,id>]]
+                                     add a computer of your own or a shared one, at its full price (Owners and Admins)
+  laze computer remove <computer> [--to <computer>]
+                                     delete a computer; its agents move to --to first (default: their owner's default)
+  laze computer creators <computer> --everyone | --people <id,id>
+                                     who may put agents on a shared computer (Owners and Admins)
+  laze computer move <agent> <computer|default>
+                                     move an agent with its home to a Laze computer its owner may use`;
+var printJson2 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
+`);
+function flag(args, name2) {
+  const value = args.flags[name2];
+  if (value === true) throw new CliUsageError(COMPUTER_FLEET_USAGE);
+  return value ?? null;
+}
+function creatorsOf(args) {
+  const people2 = flag(args, "people");
+  const userIds = (people2 ?? "").split(",").map((one) => one.trim()).filter(Boolean);
+  return { everyone: args.flags.everyone === true, userIds };
+}
+function lineOf3(computer2) {
+  const money2 = `${computer2.monthlyCharge} ${computer2.currency.toUpperCase()} a month`;
+  const agents = `${computer2.agents.length} agent(s)`;
+  return `  ${computer2.computerId}	${computer2.name}	${computer2.kind}	${computer2.size}	${money2}	${agents}	${computer2.state}`;
+}
+async function mine({ context, args }) {
+  const client = await computeClient({ context, args });
+  const answer4 = await client.get(COMPUTER_REST_PATHS.mine);
+  if (args.flags.json) return printJson2(context, answer4);
+  context.out(`Your Laze computers:
+${answer4.computers.map(lineOf3).join("\n")}
+`);
+}
+async function add2({ context, args }) {
+  const name2 = args.words[2];
+  const size = flag(args, "size");
+  if (!name2 || !size) throw new CliUsageError(COMPUTER_FLEET_USAGE);
+  const shared = args.flags.shared === true;
+  const client = await computeClient({ context, args });
+  const answer4 = await client.post(COMPUTER_REST_PATHS.create, {
+    name: name2,
+    size,
+    kind: shared ? "shared" : "personal",
+    creators: shared ? creatorsOf(args) : null
+  });
+  if (args.flags.json) return printJson2(context, answer4);
+  context.out(`${answer4.name} (${answer4.computerId}) is ready, ${answer4.monthlyCharge} a month.
+`);
+}
+async function remove3({ context, args }) {
+  const computerId = args.words[2];
+  if (!computerId) throw new CliUsageError(COMPUTER_FLEET_USAGE);
+  const client = await computeClient({ context, args });
+  const answer4 = await client.post(COMPUTER_REST_PATHS.remove, {
+    computerId,
+    moveTo: flag(args, "to")
+  });
+  if (args.flags.json) return printJson2(context, answer4);
+  context.out(`${answer4.message}
+`);
+}
+async function creators({ context, args }) {
+  const computerId = args.words[2];
+  if (!computerId) throw new CliUsageError(COMPUTER_FLEET_USAGE);
+  const client = await computeClient({ context, args });
+  const answer4 = await client.post(COMPUTER_REST_PATHS.creators, {
+    computerId,
+    creators: creatorsOf(args)
+  });
+  if (args.flags.json) return printJson2(context, answer4);
+  const who = answer4.creators?.everyone ? "everyone" : `${answer4.creators?.userIds.length ?? 0} people`;
+  context.out(`${answer4.name}: ${who} may add agents, and Owners and Admins.
+`);
+}
+async function move({ context, args }) {
+  const [, , agentId, computerId] = args.words;
+  if (!agentId || !computerId) throw new CliUsageError(COMPUTER_FLEET_USAGE);
+  const client = await computeClient({ context, args });
+  const answer4 = await client.post(COMPUTER_REST_PATHS.agent, {
+    agentId,
+    computerId
+  });
+  if (args.flags.json) return printJson2(context, answer4);
+  context.out(`${answer4.message}
+`);
+}
+var COMPUTER_FLEET_COMMANDS = { mine, add: add2, remove: remove3, creators, move };
+
 // src/services/computer-commands.service.ts
 var COMPUTER_USAGE = `Usage:
   laze computer status [--json]      your computer: size, CPU, memory and disk in use, your agents, the sizes
@@ -77866,11 +78143,12 @@ var COMPUTER_USAGE = `Usage:
                                      Admins); anyone else gets a message to forward and the admins a card
   laze computer request <size>       ask the admins for a size for your computer
   laze computer cancel <request>     withdraw your request
-  laze computer restart [--person <user id>]
+  laze computer restart [--person <user id>] [--computer <computer>]
                                      stop and start your computer, or a person's (Owners and Admins);
                                      its agents start again on their next message
-  laze computer list [--json]        everyone's computers with size and monthly cost (Owners and Admins)`;
-var printJson2 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
+  laze computer list [--json]        everyone's computers with size and monthly cost (Owners and Admins)
+${COMPUTER_FLEET_USAGE}`;
+var printJson3 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
 `);
 var gb = (value) => `${Number(value.toFixed(1))} GB`;
 var DISK_STATE_TEXT = {
@@ -77939,13 +78217,13 @@ function printStatus({ context }, status8) {
 async function status3({ context, args }) {
   const client = await computeClient({ context, args });
   const answer4 = await client.get(COMPUTER_REST_PATHS.computer);
-  if (args.flags.json) return printJson2(context, answer4);
+  if (args.flags.json) return printJson3(context, answer4);
   printStatus({ context, args }, answer4);
 }
 async function sizes({ context, args }) {
   const client = await computeClient({ context, args });
   const answer4 = await client.get(COMPUTER_REST_PATHS.computer);
-  if (args.flags.json) return printJson2(context, answer4.sizes);
+  if (args.flags.json) return printJson3(context, answer4.sizes);
   context.out(`${sizeLines(answer4).join("\n")}
 Settings: ${answer4.settingsUrl}
 `);
@@ -77959,7 +78237,7 @@ async function upgrade({ context, args }) {
   const size = sizeArg({ args });
   const client = await computeClient({ context, args });
   const answer4 = await client.post(COMPUTER_REST_PATHS.size, { size });
-  if (args.flags.json) return printJson2(context, answer4);
+  if (args.flags.json) return printJson3(context, answer4);
   context.out(`${answer4.message}
 `);
 }
@@ -77967,7 +78245,7 @@ async function request({ context, args }) {
   const size = sizeArg({ args });
   const client = await computeClient({ context, args });
   const answer4 = await client.post(COMPUTER_REST_PATHS.requests, { size });
-  if (args.flags.json) return printJson2(context, answer4);
+  if (args.flags.json) return printJson3(context, answer4);
   context.out(
     `Asked the admins (request ${answer4.id}); they get a card in the feed.
 Message to forward: ${answer4.message}
@@ -77981,7 +78259,7 @@ async function cancel({ context, args }) {
   const answer4 = await client.post(COMPUTER_REST_PATHS.cancelRequest, {
     requestId
   });
-  if (args.flags.json) return printJson2(context, answer4);
+  if (args.flags.json) return printJson3(context, answer4);
   context.out(`Request ${answer4.id} is ${answer4.state}.
 `);
 }
@@ -77989,20 +78267,23 @@ async function restart({ context, args }) {
   const person = args.flags.person;
   if (person === true) throw new CliUsageError(COMPUTER_USAGE);
   const client = await computeClient({ context, args });
+  const computerId = args.flags.computer;
+  if (computerId === true) throw new CliUsageError(COMPUTER_USAGE);
   const answer4 = await client.post(COMPUTER_REST_PATHS.restart, {
-    ownerUserId: person ?? null
+    ownerUserId: person ?? null,
+    ...computerId ? { computerId } : {}
   });
-  if (args.flags.json) return printJson2(context, answer4);
+  if (args.flags.json) return printJson3(context, answer4);
   context.out(`${answer4.message}
 `);
 }
 async function list2({ context, args }) {
   const client = await computeClient({ context, args });
   const answer4 = await client.get(COMPUTER_REST_PATHS.all);
-  if (args.flags.json) return printJson2(context, answer4);
+  if (args.flags.json) return printJson3(context, answer4);
   const money2 = (amount) => `${amount} ${answer4.currency.toUpperCase()}`;
   const lines = answer4.computers.map(
-    (one) => `  ${one.ownerName}	${one.size}	${money2(one.monthlyCharge)} a month	${one.agents} agent(s)	${one.state}`
+    (one) => `  ${one.name ?? one.ownerName}	${one.size}	${money2(one.monthlyCharge)} a month	${one.agents} agent(s)	${one.state}`
   );
   context.out(
     `Everyone's computers (${answer4.includedSize} included per person):
@@ -78010,7 +78291,16 @@ ${lines.join("\n")}
 `
   );
 }
-var COMPUTER_COMMANDS = { status: status3, sizes, upgrade, request, cancel, restart, list: list2 };
+var COMPUTER_COMMANDS = {
+  status: status3,
+  sizes,
+  upgrade,
+  request,
+  cancel,
+  restart,
+  list: list2,
+  ...COMPUTER_FLEET_COMMANDS
+};
 async function computer({ context, args }) {
   const name2 = args.words[1];
   if (name2 === void 0) return status3({ context, args });
@@ -78262,7 +78552,7 @@ function keychainLabel(keychain) {
 
 // src/services/vault-admin-commands.service.ts
 var SUBJECTS = ["person", "group", "channel", "agent"];
-function printJson3({ context, data }) {
+function printJson4({ context, data }) {
   context.out(`${JSON.stringify(data, null, 2)}
 `);
 }
@@ -78308,7 +78598,7 @@ var grantTo = async ({ context, args }) => {
     subject: { kind: subject, id },
     ...durationOf(args)
   });
-  if (args.flags.json) return printJson3({ context, data: grant });
+  if (args.flags.json) return printJson4({ context, data: grant });
   printGrant({ context, grant });
 };
 var lendTo = async ({ context, args }) => {
@@ -78321,7 +78611,7 @@ var lendTo = async ({ context, args }) => {
     channelId,
     ...durationOf(args)
   });
-  if (args.flags.json) return printJson3({ context, data: grant });
+  if (args.flags.json) return printJson4({ context, data: grant });
   printGrant({ context, grant });
 };
 var grantsOf = async ({ context, args }) => {
@@ -78330,7 +78620,7 @@ var grantsOf = async ({ context, args }) => {
   const grants = await client.post("/api/vault/grants/list", {
     connectionId: target.id
   });
-  if (args.flags.json) return printJson3({ context, data: grants });
+  if (args.flags.json) return printJson4({ context, data: grants });
   if (grants.length === 0) return context.out(`${target.name} is shared with no one.
 `);
   for (const grant of grants) printGrant({ context, grant });
@@ -78340,14 +78630,14 @@ var revokeGrant = async ({ context, args }) => {
   if (!grantId) throw new CliUsageError("Usage: laze vault ungrant <grantId>");
   const { client } = await signedIn({ context, args });
   const answer4 = await client.post("/api/vault/grants/revoke", { grantId });
-  if (args.flags.json) return printJson3({ context, data: answer4 });
+  if (args.flags.json) return printJson4({ context, data: answer4 });
   context.out(`Ended grant ${grantId}.
 `);
 };
 var listLeases = async ({ context, args }) => {
   const { client } = await signedIn({ context, args });
   const leases = await client.get("/api/vault/leases");
-  if (args.flags.json) return printJson3({ context, data: leases });
+  if (args.flags.json) return printJson4({ context, data: leases });
   if (leases.length === 0) return context.out("No live leases.\n");
   for (const lease of leases) {
     context.out(
@@ -78361,7 +78651,7 @@ var endLease = async ({ context, args }) => {
   if (!leaseId) throw new CliUsageError("Usage: laze vault end-lease <leaseId>");
   const { client } = await signedIn({ context, args });
   const answer4 = await client.post("/api/vault/leases/end", { leaseId });
-  if (args.flags.json) return printJson3({ context, data: answer4 });
+  if (args.flags.json) return printJson4({ context, data: answer4 });
   context.out(`Ended lease ${leaseId}.
 `);
 };
@@ -78371,14 +78661,16 @@ function printLimits({ context, limits }) {
     const lease = limit.maxLeaseSeconds ? ` lease<=${limit.maxLeaseSeconds}s` : "";
     const blocked = limit.blocked ? " blocked" : "";
     const approve = limit.approveNew ? " approve-new" : "";
-    context.out(`${limit.subject}	most ${limit.most}${lease}${blocked}${approve}
-`);
+    context.out(
+      `${limit.subject}	most ${vaultCliLevelOf(limit.most)}${lease}${blocked}${approve}
+`
+    );
   }
 }
 var listLimits = async ({ context, args }) => {
   const { client } = await signedIn({ context, args });
   const limits = await client.get("/api/vault/limits");
-  if (args.flags.json) return printJson3({ context, data: limits });
+  if (args.flags.json) return printJson4({ context, data: limits });
   printLimits({ context, limits });
 };
 var setLimit = async ({ context, args }) => {
@@ -78386,21 +78678,25 @@ var setLimit = async ({ context, args }) => {
   const most = flagText({ args, name: "most" });
   if (!subject || !most) {
     throw new CliUsageError(
-      "Usage: laze vault set-limit <subject> --most checked|ask|human_only|none [--max-lease 1h|none]"
+      "Usage: laze vault set-limit <subject> --most auto|always-ask|human-only|none [--max-lease 1h|none]"
     );
   }
+  const level = most === "none" ? null : vaultLevelOfCliName(most);
+  if (level === "unknown" || level === "auto") {
+    throw new CliUsageError("--most is one of auto, always-ask, human-only or none.");
+  }
   const lease = flagText({ args, name: "max-lease" });
   const blocked = yesNoOf({ args, name: "blocked" });
   const approveNew = yesNoOf({ args, name: "approve-new" });
   const { client } = await signedIn({ context, args });
   const limits = await client.post("/api/vault/limits", {
     subject,
-    most: most === "none" ? null : most,
+    most: level,
     ...lease && { maxLeaseSeconds: lease === "none" ? null : secondsOf(lease) },
     ...blocked !== void 0 && { blocked },
     ...approveNew !== void 0 && { approveNew }
   });
-  if (args.flags.json) return printJson3({ context, data: limits });
+  if (args.flags.json) return printJson4({ context, data: limits });
   printLimits({ context, limits });
 };
 function readOf(args) {
@@ -78422,12 +78718,12 @@ var listAudit = async ({ context, args }) => {
   const { client } = await signedIn({ context, args });
   if (args.words[1] === "activity") {
     const entries = await client.post("/api/vault/activity", readOf(args));
-    if (args.flags.json) return printJson3({ context, data: entries });
+    if (args.flags.json) return printJson4({ context, data: entries });
     for (const entry of entries) printEntry({ context, entry });
     return;
   }
   const page = await client.post("/api/vault/audit", readOf(args));
-  if (args.flags.json) return printJson3({ context, data: page });
+  if (args.flags.json) return printJson4({ context, data: page });
   for (const entry of page.entries) printEntry({ context, entry });
   const chain = page.chain.intact ? "intact" : `broken at ${page.chain.brokenAtSeq}`;
   context.out(`Chain ${chain}.${page.nextCursor ? ` Older: --before ${page.nextCursor}` : ""}
@@ -78439,7 +78735,7 @@ var mostAsked = async ({ context, args }) => {
   const answer4 = await client.post("/api/vault/most-asked", {
     ...days && { days: Number(days) }
   });
-  if (args.flags.json) return printJson3({ context, data: answer4 });
+  if (args.flags.json) return printJson4({ context, data: answer4 });
   for (const row of answer4.connections) {
     context.out(
       `${row.connectionId}	${row.cards} cards	${row.asks} asks	${row.denied} denied
@@ -78453,7 +78749,7 @@ var listApprovals = async ({ context, args }) => {
   const cards = await client.post("/api/vault/approvals", {
     ...state && { state }
   });
-  if (args.flags.json) return printJson3({ context, data: cards });
+  if (args.flags.json) return printJson4({ context, data: cards });
   if (cards.length === 0) return context.out("No approval cards.\n");
   for (const card2 of cards) {
     context.out(`${card2.id}	${card2.state}	${card2.action}	${card2.agentId}	${card2.reason}
@@ -78464,7 +78760,7 @@ var listApprovals = async ({ context, args }) => {
 var judgeStatus = async ({ context, args }) => {
   const { client } = await signedIn({ context, args });
   const status8 = await client.get("/api/vault/judge");
-  if (args.flags.json) return printJson3({ context, data: status8 });
+  if (args.flags.json) return printJson4({ context, data: status8 });
   context.out(
     status8.configured ? "The judge is set up: Checked uses are decided by it.\n" : "No judge is set up: every Checked use asks a person.\n"
   );
@@ -78472,8 +78768,9 @@ var judgeStatus = async ({ context, args }) => {
 var listDevices = async ({ context, args }) => {
   const { client } = await signedIn({ context, args });
   const devices = await client.get("/api/vault/devices");
-  if (args.flags.json) return printJson3({ context, data: devices });
-  if (devices.length === 0) return context.out("No devices. Enrol one in Laze, under Keychains.\n");
+  if (args.flags.json) return printJson4({ context, data: devices });
+  if (devices.length === 0)
+    return context.out("No devices. Enrol one in Laze, under Settings, Vault, Passkeys.\n");
   for (const device of devices) {
     context.out(
       `${device.id}	${device.label}	${device.kind}	${device.state}	${device.fingerprint}
@@ -78486,39 +78783,43 @@ var listDevices = async ({ context, args }) => {
 var VAULT_USAGE = `Usage (your own key; an agent's key is refused, values are never printed):
   laze vault list [--json]                          connections you manage or see: names, fields, levels
   laze vault add <name> --label <text> [--keychain personal|workspace|agent:<id>]
-      [--level auto|checked|ask|human_only] [--rules <text>] [--approver <userId>]...
-      [--max-lease 1h|2d] [--every-use-asks] [--field <FIELD>] [--from-file <path>]
+      [--level allow|auto|always-ask|human-only] [--rules <text>] [--approver <userId>]...
+      [--lease 15m|1h|8h|1d|2d] [--every-use-asks] [--field <FIELD>] [--from-file <path>]
+      levels as the page names them: allow (agents use it), auto (the automatic check reads
+      each use against --rules), always-ask (a person approves), human-only (agents never do)
+      --lease (or --max-lease) is how long an approval lasts for the agent, 2 days by default
       the value comes from stdin or --from-file, never a flag: KEY=value lines, one value
       with --field, or a JSON secret bundle ({"kind":"api_key_set","fields":{...}})
-  laze vault update <connection> [--label] [--level] [--rules] [--approver]... [--max-lease 1h|none]
+  laze vault update <connection> [--label] [--level] [--rules] [--approver]... [--lease 1h|none]
       [--every-use-asks yes|no]
   laze vault replace <connection> [--field <FIELD>] [--from-file <path>]   a new value, from stdin
   laze vault compare <name> [--field <FIELD>] [--from-file <path>]   is this value already held
   laze vault rm|revoke <connection>                 delete it; revoke also takes it back at the provider
-  laze vault uses <connection> [--limit <n>]        who used it lately
+  laze vault uses <connection> [--limit <n>]        who used it, how, where, under which approval
   laze vault grant <connection> --to person|group|channel|agent:<id> [--for 1h]
   laze vault lend <connection> --channel <channelId> [--for 1h]
   laze vault grants <connection> | laze vault ungrant <grantId>
   laze vault leases | laze vault end-lease <leaseId>
-  laze vault limits | laze vault set-limit <subject> [--most checked|ask|human_only|none]
+  laze vault limits | laze vault set-limit <subject> [--most auto|always-ask|human-only|none]
       [--max-lease 1h|none] [--blocked yes|no] [--approve-new yes|no]   (admins)
   laze vault audit|activity [--connection <c>] [--limit <n>] [--before <seq>]   (audit: admins)
   laze vault most-asked [--days <n>]                (admins)
   laze vault approvals [--state pending]            cards you answer; answer them in Laze
   laze vault judge | laze vault devices`;
-var LEVELS5 = ["auto", "checked", "ask", "human_only"];
 function levelOf(args) {
   const level = flagText({ args, name: "level" });
   if (!level) return void 0;
-  const known = LEVELS5.find((one) => one === level);
-  if (!known) throw new CliUsageError(`--level is one of ${LEVELS5.join(", ")}.`);
+  const known = vaultLevelOfCliName(level);
+  if (known === "unknown") {
+    throw new CliUsageError(`--level is one of ${VAULT_CLI_LEVEL_NAMES.join(", ")}.`);
+  }
   return known;
 }
 function printConnection({ context, row }) {
   const waiting = row.waitingApproval ? " (waiting for an admin)" : "";
   const status8 = row.status === "active" ? "" : ` ${row.status}`;
   context.out(
-    `${row.id}	${row.name}	${row.label}	${keychainLabel(row.keychain)}	${row.sensitivity}	${row.fieldNames.join(",")}${status8}${waiting}
+    `${row.id}	${row.name}	${row.label}	${keychainLabel(row.keychain)}	${vaultCliLevelOf(row.sensitivity)}	${row.fieldNames.join(",")}${status8}${waiting}
 `
   );
 }
@@ -78544,7 +78845,7 @@ async function keychainOf2({ client, args }) {
   return { kind: "personal", ownerUserId: me.id };
 }
 function settingsOf(args) {
-  const lease = flagText({ args, name: "max-lease" });
+  const lease = flagText({ args, name: "lease" }) || flagText({ args, name: "max-lease" });
   const approvers = args.lists.approver;
   const everyUseAsks = yesNoOf({ args, name: "every-use-asks" });
   const label2 = flagText({ args, name: "label" });
@@ -78561,11 +78862,11 @@ function settingsOf(args) {
 var list3 = async ({ context, args }) => {
   const { client } = await signedIn({ context, args });
   const rows = await client.get("/api/vault/connections");
-  if (args.flags.json) return printJson3({ context, data: rows });
+  if (args.flags.json) return printJson4({ context, data: rows });
   if (rows.length === 0) return context.out("No connections yet. Add one with laze vault add.\n");
   for (const row of rows) printConnection({ context, row });
 };
-var add2 = async ({ context, args }) => {
+var add3 = async ({ context, args }) => {
   const name2 = args.words[2];
   const label2 = flagText({ args, name: "label" });
   if (!name2 || !label2) throw new CliUsageError(VAULT_USAGE);
@@ -78581,9 +78882,11 @@ var add2 = async ({ context, args }) => {
     ...settingsOf(args),
     secret
   });
-  if (args.flags.json) return printJson3({ context, data: created });
-  context.out(`Added ${created.name} (${created.id}) at ${created.sensitivity}.
-`);
+  if (args.flags.json) return printJson4({ context, data: created });
+  context.out(
+    `Added ${created.name} (${created.id}) at ${vaultLevelLabel(created.sensitivity)}.
+`
+  );
 };
 var update = async ({ context, args }) => {
   const { client } = await signedIn({ context, args });
@@ -78594,7 +78897,7 @@ var update = async ({ context, args }) => {
     connectionId: target.id,
     ...settings2
   });
-  if (args.flags.json) return printJson3({ context, data: updated });
+  if (args.flags.json) return printJson4({ context, data: updated });
   printConnection({ context, row: updated });
 };
 var replace = async ({ context, args }) => {
@@ -78607,7 +78910,7 @@ var replace = async ({ context, args }) => {
     ...field && { field },
     value
   });
-  if (args.flags.json) return printJson3({ context, data: updated });
+  if (args.flags.json) return printJson4({ context, data: updated });
   context.out(`Replaced the value of ${updated.name}.
 `);
 };
@@ -78622,7 +78925,7 @@ var compare = async ({ context, args }) => {
     ...field && { field },
     value
   });
-  if (args.flags.json) return printJson3({ context, data: answer4 });
+  if (args.flags.json) return printJson4({ context, data: answer4 });
   const said = {
     absent: `You hold no connection named ${name2}.`,
     same: `${name2} already holds this value.`,
@@ -78639,12 +78942,17 @@ function removal(path) {
       `/api/vault/connections/${path}`,
       { connectionId: target.id }
     );
-    if (args.flags.json) return printJson3({ context, data: answer4 });
+    if (args.flags.json) return printJson4({ context, data: answer4 });
     const provider = "atProvider" in answer4 ? ` (at the provider: ${answer4.atProvider})` : "";
     context.out(`Deleted ${target.name}${provider}.
 `);
   };
 }
+function usedBy(row) {
+  if (row.agentId) return `agent ${row.agentId}`;
+  if (row.actorKind === "user") return `person ${row.actorId ?? ""}`;
+  return "laze";
+}
 var uses = async ({ context, args }) => {
   const { client } = await signedIn({ context, args });
   const target = await connectionOf({ client, args, word: args.words[2] });
@@ -78653,18 +78961,22 @@ var uses = async ({ context, args }) => {
     connectionId: target.id,
     ...limit && { limit: Number(limit) }
   });
-  if (args.flags.json) return printJson3({ context, data: rows });
+  if (args.flags.json) return printJson4({ context, data: rows });
   if (rows.length === 0) return context.out(`No one used ${target.name} yet.
 `);
   for (const row of rows) {
-    const who = row.agentId ?? row.requesterUserId ?? "";
-    context.out(`${row.at}	${row.action}	${row.outcome}	${who}	${row.reason ?? ""}
-`);
+    const who = usedBy(row);
+    const where = row.origin ?? row.via ?? "-";
+    const approval = row.requestId ?? "-";
+    context.out(
+      `${row.at}	${row.action}	${row.outcome}	${who}	${where}	${approval}	${row.reason ?? ""}
+`
+    );
   }
 };
 var VAULT_COMMANDS = {
   list: list3,
-  add: add2,
+  add: add3,
   update,
   replace,
   compare,
@@ -78704,6 +79016,7 @@ var CONNECTOR_USAGE = `Usage (a person's key; an agent runs laze connect suggest
       [--level <level>] [--again <connectionId>]  a server with no key, or with its own sign-in
   laze connect mcp refresh <connectionId>        read its tools again
   laze connect mcp tool-level <connectionId> <tool> <level|default>
+      levels: allow, auto (the automatic check), always-ask, human-only
   laze connect mcp-key <https url> --name <name> --label <label> [--header Authorization]
       [--prefix "Bearer "] [--keychain ...] [--level <level>]   the key from stdin or --from-file
   laze connect github                            the GitHub App and its installations
@@ -78723,7 +79036,7 @@ function wordAt2(args, index) {
 }
 var KEY_FLAGS = ["key", "value", "token"];
 async function keyText({ context, args }) {
-  if (KEY_FLAGS.some((flag) => args.flags[flag] !== void 0)) {
+  if (KEY_FLAGS.some((flag2) => args.flags[flag2] !== void 0)) {
     throw new CliUsageError("A key never goes in a flag: pipe it on stdin or use --from-file.");
   }
   const file3 = flagText({ args, name: "from-file" });
@@ -78749,8 +79062,10 @@ var providers = async ({ context, args, client }) => {
   if (json2({ context, args, data: rows })) return;
   for (const row of rows) {
     const ready = row.configured ? "" : "	not set up here";
-    context.out(`${row.id}	${row.label}	${row.category}	${row.sensitivity}${ready}
-`);
+    context.out(
+      `${row.id}	${row.label}	${row.category}	${vaultCliLevelOf(row.sensitivity)}${ready}
+`
+    );
   }
 };
 var start = async ({ context, args, client }) => {
@@ -78839,10 +79154,14 @@ var mcpRefresh = async ({ context, args, client }) => {
 };
 var mcpToolLevel = async ({ context, args, client }) => {
   const level = wordAt2(args, 5);
+  const sensitivity = level === "default" ? null : vaultLevelOfCliName(level);
+  if (sensitivity === "unknown") {
+    throw new CliUsageError(`The level is one of ${VAULT_CLI_LEVEL_NAMES.join(", ")} or default.`);
+  }
   const server = await client.post(CONNECTOR_KEY_PATHS.mcpToolLevel, {
     connectionId: wordAt2(args, 3),
     tool: wordAt2(args, 4),
-    sensitivity: level === "default" ? null : level
+    sensitivity
   });
   if (json2({ context, args, data: server })) return;
   context.out(`${args.words[4]} is now ${level}.
@@ -79110,17 +79429,17 @@ async function dnd({ context, args }) {
 var DOMAINS_USAGE = `Usage:
   laze domains list                               proven domains, with auto-join (admins)
   laze domains auto-join <domain> on|off          people on the domain join without asking`;
-var printJson4 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
+var printJson5 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
 `);
 function printDomain(context, row) {
-  const join21 = row.autoJoin ? "auto-join on" : "auto-join off";
-  context.out(`${row.domain}	${join21}${row.enforced ? "	single sign-on enforced" : ""}
+  const join22 = row.autoJoin ? "auto-join on" : "auto-join off";
+  context.out(`${row.domain}	${join22}${row.enforced ? "	single sign-on enforced" : ""}
 `);
 }
 async function list4({ context, args }) {
   const { client } = await signedIn({ context, args });
   const rows = await client.get("/api/join-domains");
-  if (args.flags.json) return printJson4(context, rows);
+  if (args.flags.json) return printJson5(context, rows);
   if (rows.length === 0) {
     return context.out("No proven domains yet. laze sso claim <domain> starts proving one.\n");
   }
@@ -79134,7 +79453,7 @@ async function autoJoin({ context, args }) {
     domain: domain2,
     autoJoin: state === "on"
   });
-  if (args.flags.json) return printJson4(context, row);
+  if (args.flags.json) return printJson5(context, row);
   printDomain(context, row);
 }
 var DOMAIN_COMMANDS = { list: list4, "auto-join": autoJoin };
@@ -79201,10 +79520,10 @@ var FEED_WRITING = `Write for a person deciding on a phone in a few seconds:
 The server pushes back with feed_hard_to_read when the text reads like a log;
 rewrite it, or pass --force to post it as written.`;
 var FEED_NO_BODY = "feed cards have no body: put the point in the title and one --summary line, text to send in --draft, sources in --link";
-function pairOf({ value, flag }) {
+function pairOf({ value, flag: flag2 }) {
   const at = value.indexOf("=");
   if (at <= 0 || at === value.length - 1) {
-    throw new Error(`--${flag} takes <label>=<value>, got "${value}"`);
+    throw new Error(`--${flag2} takes <label>=<value>, got "${value}"`);
   }
   return [value.slice(0, at), value.slice(at + 1)];
 }
@@ -79223,8 +79542,8 @@ function snoozeOf(args) {
 }
 function textsOf(args) {
   const texts = {};
-  for (const [flag, field] of Object.entries(TEXT_FLAGS)) {
-    const value = flagText({ args, name: flag });
+  for (const [flag2, field] of Object.entries(TEXT_FLAGS)) {
+    const value = flagText({ args, name: flag2 });
     if (value) texts[field] = sourceOf(value);
   }
   return texts;
@@ -79256,7 +79575,7 @@ function feedFlagsOf({ args }) {
   if (header) fields.draftHeader = header.replaceAll("\\n", "\n");
   const doneLabel = flagText({ args, name: "done-label" });
   if (doneLabel) fields.doneLabel = doneLabel;
-  for (const flag of ["urgent", "force"]) if (args.flags[flag]) fields[flag] = true;
+  for (const flag2 of ["urgent", "force"]) if (args.flags[flag2]) fields[flag2] = true;
   const showAt = flagText({ args, name: "show-at" });
   if (showAt) fields.showAt = dateOf(showAt);
   const group = flagText({ args, name: "group" });
@@ -79738,6 +80057,7 @@ var feedFileLinkSchema = feedFileLinkSchemaDefinition;
 var feedTrpc = defineTrpcContract("feed").query("channelItems").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), channelId: external_exports.string().min(1) })).withOutput(external_exports.array(feedAgentItemSchema)).query("list").withInput(listFeedInputSchema).withOutput(feedViewSchema).query("card").withInput(itemRef).withOutput(feedCardViewSchema).query("fileLink").withInput(feedFileLinkInputSchema).withOutput(feedFileLinkSchema).query("count").withInput(external_exports.object({ workspaceId: external_exports.string().min(1) })).withOutput(external_exports.object({ count: external_exports.number().int().nonnegative() })).mutation("act").withInput(actFeedItemInputSchema).withOutput(feedItemSchema).mutation("comment").withInput(commentFeedItemInputSchema).withOutput(feedItemSchema).mutation("done").withInput(itemRef).withOutput(feedItemSchema).mutation("stopAutoSend").withInput(itemRef).withOutput(feedItemSchema).mutation("putBack").withInput(putBackFeedItemInputSchema).withOutput(feedItemSchema).mutation("snooze").withInput(snoozeFeedItemInputSchema).withOutput(feedItemSchema).mutation("unsnooze").withInput(itemRef).withOutput(feedItemSchema).mutation("saveDraft").withInput(saveFeedDraftInputSchema).withOutput(feedItemSchema).mutation("editItem").withInput(editFeedItemInputSchema).withOutput(feedItemSchema).mutation("saveMessage").withInput(saveFeedMessageInputSchema).withOutput(feedItemSchema).mutation("answerApproval").withInput(answerFeedApprovalInputSchema).withOutput(feedItemSchema).mutation("decidePublish").withInput(decideFeedPublishInputSchema).withOutput(feedItemSchema).mutation("decideAccess").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideServer").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideAppAccess").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideComputer").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).mutation("decideAgentJoin").withInput(decideFeedRequestInputSchema).withOutput(feedItemSchema).build();
 var feedUi = uiTokens("feed");
 var FeedNavSlot = feedUi.component("nav");
+var FeedCountHooksToken = feedUi.hooks("count");
 var FeedChannelCardSlot = feedUi.component("channel-card");
 var FeedSearchSlot = feedUi.component("search");
 
@@ -80255,9 +80575,9 @@ async function signedGhArgs({
   let bodied = false;
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index] ?? "";
-    const [flag = "", inline] = arg.startsWith("--") ? arg.split(/=(.*)/s, 2) : [arg];
-    const isBody = BODY_FLAGS.has(flag);
-    const isFile = BODY_FILE_FLAGS.has(flag);
+    const [flag2 = "", inline] = arg.startsWith("--") ? arg.split(/=(.*)/s, 2) : [arg];
+    const isBody = BODY_FLAGS.has(flag2);
+    const isFile = BODY_FILE_FLAGS.has(flag2);
     if (!isBody && !isFile) {
       out.push(arg);
       continue;
@@ -80575,7 +80895,7 @@ var IP_USAGE = `Usage:
   laze ip domains add|remove <domain>...    change them; laze ip domains reset brings the defaults back
   laze ip offer [--site <domain>]           the plain offer to pass on when a site blocks the shared address
   laze ip list                              who has one, its country and price (Owners and Admins)`;
-var printJson5 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
+var printJson6 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
 `);
 var OFF_REASONS = {
   credits: ", turned off because the credits ran out",
@@ -80607,12 +80927,12 @@ function ipLines(status8) {
 async function status4({ context, args }) {
   const client = await computeClient({ context, args });
   const answer4 = await client.get(DEDICATED_IP_REST_PATHS.mine);
-  if (args.flags.json) return printJson5(context, answer4);
+  if (args.flags.json) return printJson6(context, answer4);
   context.out(`${ipLines(answer4).join("\n")}
 `);
 }
 async function printAnswer({ context, args }, answer4) {
-  if (args.flags.json) return printJson5(context, answer4);
+  if (args.flags.json) return printJson6(context, answer4);
   context.out(`${answer4.message}
 `);
 }
@@ -80632,7 +80952,7 @@ async function turnOff(run4) {
 async function countries({ context, args }) {
   const client = await computeClient({ context, args });
   const answer4 = await client.get(DEDICATED_IP_REST_PATHS.countries);
-  if (args.flags.json) return printJson5(context, answer4);
+  if (args.flags.json) return printJson6(context, answer4);
   const lines = answer4.countries.map((one) => `  ${one.code}	${one.name}`);
   context.out(`Countries on sale:
 ${lines.join("\n")}
@@ -80653,7 +80973,7 @@ async function domains2(run4) {
   if (!action) {
     const client2 = await computeClient(run4);
     const answer4 = await client2.get(DEDICATED_IP_REST_PATHS.mine);
-    if (run4.args.flags.json) return printJson5(run4.context, answer4.domains);
+    if (run4.args.flags.json) return printJson6(run4.context, answer4.domains);
     return run4.context.out(`${answer4.domains.join("\n")}
 `);
   }
@@ -80672,14 +80992,14 @@ async function offer({ context, args }) {
     DEDICATED_IP_REST_PATHS.offer,
     site ? { site } : {}
   );
-  if (args.flags.json) return printJson5(context, answer4);
+  if (args.flags.json) return printJson6(context, answer4);
   context.out(`${answer4.message}
 `);
 }
 async function list5({ context, args }) {
   const client = await computeClient({ context, args });
   const answer4 = await client.get(DEDICATED_IP_REST_PATHS.all);
-  if (args.flags.json) return printJson5(context, answer4);
+  if (args.flags.json) return printJson6(context, answer4);
   if (answer4.ips.length === 0) return context.out("No one has a dedicated IP.\n");
   const money2 = (amount) => `${amount} ${answer4.currency.toUpperCase()}`;
   const lines = answer4.ips.map(
@@ -80859,13 +81179,13 @@ var KEYS_USAGE = `Usage:
       printed once, or with --to-vault saved to your personal keychain and never printed
   laze keys revoke <id>                           revoke one of your own keys
   laze keys revoke <id> --any                     revoke any key of the workspace (admins)`;
-var printJson6 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
+var printJson7 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
 `);
 var lastUsed = (at) => at ? `last used ${at}` : "never used";
-async function mine({ context, args }) {
+async function mine2({ context, args }) {
   const { client } = await signedIn({ context, args });
   const keys2 = await client.get("/api/api-keys/mine");
-  if (args.flags.json) return printJson6(context, keys2);
+  if (args.flags.json) return printJson7(context, keys2);
   if (keys2.length === 0)
     return context.out("No keys yet. laze login or laze keys create make one.\n");
   for (const key of keys2) {
@@ -80879,7 +81199,7 @@ async function mine({ context, args }) {
 async function list6({ context, args }) {
   const { client } = await signedIn({ context, args });
   const keys2 = await client.get("/api/api-keys");
-  if (args.flags.json) return printJson6(context, keys2);
+  if (args.flags.json) return printJson7(context, keys2);
   if (keys2.length === 0) return context.out("The workspace has no live keys.\n");
   for (const key of keys2) {
     const held = `${key.permissions.length} permissions`;
@@ -80921,13 +81241,13 @@ async function create({ context, args }) {
   const created = await client.post("/api/api-keys", { name: name2, permissions });
   if (connection) {
     await keepInVault({ client, created, connection });
-    if (args.flags.json) return printJson6(context, { key: created.key, vault: connection });
+    if (args.flags.json) return printJson7(context, { key: created.key, vault: connection });
     return context.out(
       `Created ${created.key.name} (${created.key.id}), kept in your vault as ${connection}.
 `
     );
   }
-  if (args.flags.json) return printJson6(context, created);
+  if (args.flags.json) return printJson7(context, created);
   context.out(`Created ${created.key.name} (${created.key.id}). Its token, shown once:
 `);
   context.out(`${created.token}
@@ -80939,11 +81259,11 @@ async function revoke({ context, args }) {
   const { client } = await signedIn({ context, args });
   const path = args.flags.any ? "/api/api-keys/revoke" : "/api/api-keys/mine/revoke";
   await client.post(path, { apiKeyId });
-  if (args.flags.json) return printJson6(context, { revoked: true, apiKeyId });
+  if (args.flags.json) return printJson7(context, { revoked: true, apiKeyId });
   context.out(`Revoked ${apiKeyId}.
 `);
 }
-var KEY_COMMANDS = { mine, list: list6, create, revoke };
+var KEY_COMMANDS = { mine: mine2, list: list6, create, revoke };
 async function keys({ context, args }) {
   const name2 = args.words[1] ?? "mine";
   const command = Object.hasOwn(KEY_COMMANDS, name2) ? KEY_COMMANDS[name2] : void 0;
@@ -81518,7 +81838,7 @@ async function unhost({ context, args }) {
   context.out(`${agent2} runs on your computer again.
 `);
 }
-async function remove3({ context, args }) {
+async function remove4({ context, args }) {
   const client = await computeClient({ context, args });
   const machine2 = await client.post(COMPUTE_REST_PATHS.remove, {
     machine: machineArg2({ args })
@@ -81541,7 +81861,7 @@ async function machine({ context, args }) {
   if (command === "list" || command === "ls") return list7({ context, args });
   if (command === "health") return health({ context, args });
   if (command === "exec") return exec({ context, args });
-  if (command === "remove") return remove3({ context, args });
+  if (command === "remove") return remove4({ context, args });
   if (command === "trust-host-key") return trustHostKey({ context, args });
   if (command === "host") return host({ context, args });
   if (command === "unhost") return unhost({ context, args });
@@ -81631,7 +81951,7 @@ function secretRefusal({
   const rule = command === void 0 ? void 0 : rules[command];
   if (!command || !rule) return void 0;
   const vaultFlag = rule.vaultFlag ?? "from-vault";
-  const raw = (rule.secretFlags ?? []).find((flag) => flag in flags2);
+  const raw = (rule.secretFlags ?? []).find((flag2) => flag2 in flags2);
   if (raw)
     return `laze ${command} takes no --${raw} over MCP; name a vault connection with --${vaultFlag}.`;
   if (rule.vaultFlag && typeof flags2[rule.vaultFlag] === "string") return void 0;
@@ -82454,6 +82774,10 @@ ${OPS_USAGE}`);
 `);
 }
 
+// src/services/release-watch.service.ts
+import { mkdir as mkdir20, readFile as readFile30, realpath, writeFile as writeFile21 } from "node:fs/promises";
+import { dirname as dirname19, join as join20 } from "node:path";
+
 // src/rules/cli-update.rules.ts
 var CLI_PACKAGE_LATEST = "@lazehq/cli@latest";
 var MANAGERS = [
@@ -82493,10 +82817,10 @@ function releaseAgeRetryOf({
 var CLI_RELEASE_HEADER = "x-laze-cli-release";
 var STAMP = /^(\d+)\.(\d+)\.(\d+)(?:-g([0-9a-f]+))?$/;
 function releaseSkewOf({
-  mine: mine3,
+  mine: mine4,
   server
 }) {
-  const have = STAMP.exec(mine3);
+  const have = STAMP.exec(mine4);
   const ships = STAMP.exec(server);
   if (!have || !ships) return null;
   for (const part of [1, 2, 3]) {
@@ -82506,32 +82830,69 @@ function releaseSkewOf({
   return have[4] && ships[4] && have[4] !== ships[4] ? "other_build" : null;
 }
 function releaseWarningOf({
-  mine: mine3,
+  mine: mine4,
   server,
   sandbox
 }) {
-  const skew = releaseSkewOf({ mine: mine3, server });
+  const skew = releaseSkewOf({ mine: mine4, server });
   if (!skew) return null;
   if (sandbox) {
-    return `laze: this CLI is ${mine3}, but the server ships ${server}. Laze updates the computer's CLI each time the agent connects, so restart the agent if this stays.
+    return `laze: this CLI is ${mine4}, but the server ships ${server}. Laze updates the computer's CLI each time the agent connects, so restart the agent if this stays.
 `;
   }
   if (skew === "newer") {
-    return `laze: this CLI is ${mine3}, newer than the server's ${server}; a command the server does not have yet fails.
+    return `laze: this CLI is ${mine4}, newer than the server's ${server}; a command the server does not have yet fails.
 `;
   }
   const how = `Update it with npm i -g ${CLI_PACKAGE_LATEST} (or laze update).`;
   if (skew === "older")
-    return `laze: this CLI is ${mine3}, older than the server's ${server}. ${how}
+    return `laze: this CLI is ${mine4}, older than the server's ${server}. ${how}
+`;
+  return `laze: this CLI is ${mine4}, a different build from the server's ${server}. ${how}
 `;
-  return `laze: this CLI is ${mine3}, a different build from the server's ${server}. ${how}
+}
+function selfUpdateLineOf({
+  mine: mine4,
+  server,
+  manager
+}) {
+  return `laze: this CLI is ${mine4}, older than the server's ${server}. Updating it in the background with ${manager}; the next command runs the new one (LAZE_AUTO_UPDATE=0 turns this off).
 `;
 }
 
 // src/services/release-watch.service.ts
+var RETRY_AFTER_MS = 6 * 60 * 60 * 1e3;
+async function scriptOf(context) {
+  const script = context.program.at(-1) ?? "";
+  try {
+    return await realpath(script);
+  } catch {
+    return script;
+  }
+}
+async function startedUpdate({
+  context,
+  server
+}) {
+  if (context.environment.inherited.LAZE_AUTO_UPDATE === "0") return null;
+  const plan2 = updatePlanOf({ script: await scriptOf(context) });
+  if (plan2.kind !== "install") return null;
+  const folder = dirname19(context.environment.configPath);
+  const stamp = join20(folder, "auto-update.json");
+  const last = await readFile30(stamp, "utf8").then((text2) => JSON.parse(text2)).catch(() => null);
+  const now = context.nowMs();
+  if (last?.server === server && now - last.atMs < RETRY_AFTER_MS) return null;
+  await mkdir20(folder, { recursive: true, mode: 448 });
+  await writeFile21(stamp, JSON.stringify({ server, atMs: now }), { mode: 384 });
+  context.processes.spawnDetached({
+    argv: [...context.program, "update"],
+    logPath: join20(folder, "auto-update.log")
+  });
+  return { manager: plan2.manager };
+}
 function watchingRelease({
   context,
-  mine: mine3 = cliVersionOf()
+  mine: mine4 = cliVersionOf()
 }) {
   const sandbox = context.program.at(-1) === SANDBOX_CLI_PATH;
   let warned = false;
@@ -82541,10 +82902,12 @@ function watchingRelease({
       const response = await context.fetcher(input2, init);
       const server = response.headers.get(CLI_RELEASE_HEADER);
       if (!warned && server) {
-        const warning = releaseWarningOf({ mine: mine3, server, sandbox });
+        const warning = releaseWarningOf({ mine: mine4, server, sandbox });
         if (warning) {
           warned = true;
-          context.err(warning);
+          const older = !sandbox && releaseSkewOf({ mine: mine4, server }) === "older";
+          const started = older ? await startedUpdate({ context, server }) : null;
+          context.err(started ? selfUpdateLineOf({ mine: mine4, server, ...started }) : warning);
         }
       }
       return response;
@@ -82553,7 +82916,7 @@ function watchingRelease({
 }
 
 // src/services/rush-guard.service.ts
-import { readFile as readFile30, rm as rm13 } from "node:fs/promises";
+import { readFile as readFile31, rm as rm13 } from "node:fs/promises";
 var WATCH_MS3 = 2e3;
 var RETRY_MS2 = 3e4;
 async function guardRound({ context, client, name: name2, lock, claudePid, session, rush }) {
@@ -82589,7 +82952,7 @@ async function rushWakeHook({ context, args }) {
     while (context.processes.alive(claudePid)) await context.sleep(WATCH_MS3);
     const { client, name: name2 } = await signedIn({ context, args });
     const noted = statePathOf({ context, kind: "sessions", profile: String(claudePid) });
-    const session = await readFile30(noted, "utf8").then(
+    const session = await readFile31(noted, "utf8").then(
       (text2) => JSON.parse(text2),
       () => void 0
     );
@@ -82668,13 +83031,13 @@ function changesOf2(args) {
   const changes = {};
   const timed = ["cron", "rrule", "at"].some((name2) => flagText({ args, name: name2 }));
   if (timed) changes.timing = timingOf(args);
-  for (const [flag, field] of [
+  for (const [flag2, field] of [
     ["name", "name"],
     ["prompt", "prompt"],
     ["tz", "timezone"],
     ["agent", "agentId"]
   ]) {
-    const value = flagText({ args, name: flag });
+    const value = flagText({ args, name: flag2 });
     if (value) changes[field] = value;
   }
   const channel = flagText({ args, name: "channel" });
@@ -82755,8 +83118,8 @@ async function schedule({ context, args }) {
 }
 
 // src/services/skill-commands.service.ts
-import { readdir as readdir6, readFile as readFile31 } from "node:fs/promises";
-import { join as join20, relative as relative6, resolve as resolve12 } from "node:path";
+import { readdir as readdir6, readFile as readFile32 } from "node:fs/promises";
+import { join as join21, relative as relative6, resolve as resolve12 } from "node:path";
 var USAGE16 = `Usage:
   laze skill list [--agent <agentId>]
   laze skill install <catalogue-id> [--as <name>] [--agent <agentId>]
@@ -82777,8 +83140,8 @@ async function folderFiles({ root }) {
   const files2 = [];
   for (const entry of entries) {
     if (!entry.isFile()) continue;
-    const full = join20(entry.parentPath, entry.name);
-    files2.push({ path: relative6(root, full), content: await readFile31(full, "utf8") });
+    const full = join21(entry.parentPath, entry.name);
+    files2.push({ path: relative6(root, full), content: await readFile32(full, "utf8") });
   }
   return files2.toSorted((a, b) => a.path.localeCompare(b.path));
 }
@@ -82876,7 +83239,7 @@ async function skillUpdate({ context, args }) {
   if (!name2 || !newName && description === void 0 && !skillMdFile) {
     throw new CliUsageError(USAGE16);
   }
-  const skillMd = skillMdFile ? await readFile31(resolve12(context.cwd, skillMdFile), "utf8") : void 0;
+  const skillMd = skillMdFile ? await readFile32(resolve12(context.cwd, skillMdFile), "utf8") : void 0;
   const { client } = await signedIn({ context, args });
   const updated = await client.post("/api/skills/update", {
     name: name2,
@@ -82922,7 +83285,7 @@ async function skill({ context, args }) {
 }
 
 // src/services/slack-commands.service.ts
-import { readFile as readFile32 } from "node:fs/promises";
+import { readFile as readFile33 } from "node:fs/promises";
 import { resolve as resolve13 } from "node:path";
 var SLACK_USAGE = `Usage (a person's key; Slack stays the source, the bot joins no channel by itself):
   laze slack overview                            connected Slack workspaces, mirrors, your link
@@ -82966,11 +83329,11 @@ function wordAt5(args, index) {
   return word3;
 }
 async function secretLines({ context, args }) {
-  if (SECRET_FLAGS2.some((flag) => args.flags[flag] !== void 0)) {
+  if (SECRET_FLAGS2.some((flag2) => args.flags[flag2] !== void 0)) {
     throw new CliUsageError("A secret never goes in a flag: pipe it on stdin or use --from-file.");
   }
   const file3 = flagText({ args, name: "from-file" });
-  const text2 = file3 ? await readFile32(resolve13(context.cwd, file3), "utf8") : await context.readStdin();
+  const text2 = file3 ? await readFile33(resolve13(context.cwd, file3), "utf8") : await context.readStdin();
   return text2.split("\n").map((line) => line.trim()).filter(Boolean);
 }
 async function secretsOf({
@@ -83168,16 +83531,16 @@ var disconnect2 = async ({ context, args, client }) => {
   context.out(`Disconnected ${teamId}.
 `);
 };
-function printMove({ context, move: move2 }) {
-  const problem = move2.problem ? `	${move2.problem.message}` : "";
-  context.out(`${move2.moveId}	#${move2.slackName} -> #${move2.name}	${move2.state}${problem}
+function printMove({ context, move: move3 }) {
+  const problem = move3.problem ? `	${move3.problem.message}` : "";
+  context.out(`${move3.moveId}	#${move3.slackName} -> #${move3.name}	${move3.state}${problem}
 `);
 }
 var moves = async ({ context, args, client }) => {
   const answer4 = await client.get(SLACK_KEY_PATHS.moves);
   if (json3({ context, args, data: answer4 })) return;
   if (answer4.moves.length === 0) context.out("No moves yet.\n");
-  for (const move2 of answer4.moves) printMove({ context, move: move2 });
+  for (const move3 of answer4.moves) printMove({ context, move: move3 });
 };
 var movePreview = async ({ context, args, client }) => {
   const preview = await client.post(SLACK_KEY_PATHS.movePreview, {
@@ -83212,7 +83575,7 @@ function moveBody(args) {
     }))
   };
 }
-var move = async ({ context, args, client }) => {
+var move2 = async ({ context, args, client }) => {
   const answer4 = await client.post(SLACK_KEY_PATHS.startMoves, moveBody(args));
   if (json3({ context, args, data: answer4 })) return;
   for (const one of answer4.started) {
@@ -83259,7 +83622,7 @@ var RUNS4 = {
   disconnect: disconnect2,
   moves,
   "move-preview": movePreview,
-  move,
+  move: move2,
   "cancel-move": cancelMove
 };
 async function slack({
@@ -83274,7 +83637,7 @@ async function slack({
 }
 
 // src/services/sso-commands.service.ts
-import { readFile as readFile33 } from "node:fs/promises";
+import { readFile as readFile34 } from "node:fs/promises";
 var SSO_USAGE = `Usage:
   laze sso domains                                claimed domains and how each signs in (admins)
   laze sso claim <domain>                         the TXT record that proves the domain
@@ -83292,7 +83655,7 @@ var SCIM_USAGE = `Usage:
   laze scim create-token <name> [--to-vault <name>]   a token for the identity provider; printed
       once, or with --to-vault kept in your personal keychain and never printed
   laze scim revoke-token <id>                     the directory is refused at once`;
-var printJson7 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
+var printJson8 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
 `);
 function stateOf2(claim3) {
   if (!claim3.verified) return "not verified";
@@ -83324,13 +83687,13 @@ async function claimCall({
 }) {
   const { client } = await signedIn({ context, args });
   const claim3 = await client.post(path, body);
-  if (args.flags.json) return printJson7(context, claim3);
+  if (args.flags.json) return printJson8(context, claim3);
   printClaim(context, claim3);
 }
 async function domains3({ context, args }) {
   const { client } = await signedIn({ context, args });
   const claims = await client.get("/api/sso/domains");
-  if (args.flags.json) return printJson7(context, claims);
+  if (args.flags.json) return printJson8(context, claims);
   if (claims.length === 0) return context.out("No claimed domains yet. laze sso claim <domain>.\n");
   for (const claim3 of claims) printClaim(context, claim3);
 }
@@ -83353,7 +83716,7 @@ var connectGoogle = ({ context, args }) => claimCall({
   body: { domain: domainOf({ args, usage: SSO_USAGE }) }
 });
 function refuseSecretFlags({ args }) {
-  if (["client-secret", "secret"].some((flag) => args.flags[flag] !== void 0)) {
+  if (["client-secret", "secret"].some((flag2) => args.flags[flag2] !== void 0)) {
     throw new CliUsageError(
       "A client secret never goes in a flag (shell history keeps it): pipe it on stdin or use --from-file."
     );
@@ -83361,7 +83724,7 @@ function refuseSecretFlags({ args }) {
 }
 async function clientSecretOf({ context, args }) {
   const file3 = flagText({ args, name: "from-file" });
-  const text2 = file3 ? await readFile33(file3, "utf8") : await context.readStdin();
+  const text2 = file3 ? await readFile34(file3, "utf8") : await context.readStdin();
   const secret = text2.trim();
   if (!secret) throw new CliUsageError("No client secret: pipe it on stdin or use --from-file.");
   return secret;
@@ -83391,7 +83754,7 @@ async function enforce({ context, args }) {
       "/api/sso/enforce",
       { domain: domain2, enforced: state === "on" }
     );
-    if (args.flags.json) return printJson7(context, outcome);
+    if (args.flags.json) return printJson8(context, outcome);
     printClaim(context, outcome.claim);
     if (outcome.endedSessions > 0) {
       context.out(`Ended ${outcome.endedSessions} sessions that signed in another way.
@@ -83412,7 +83775,7 @@ async function domainAction({ context, args, path }) {
   const domain2 = domainOf({ args, usage: SSO_USAGE });
   const { client } = await signedIn({ context, args });
   const answer4 = await client.post(path, { domain: domain2 });
-  if (args.flags.json) return printJson7(context, answer4);
+  if (args.flags.json) return printJson8(context, answer4);
   context.out(`${path.endsWith("remove") ? "Removed" : "Disconnected"} ${domain2}.
 `);
 }
@@ -83435,7 +83798,7 @@ async function sso({ context, args }) {
 async function scimTokens({ context, args }) {
   const { client } = await signedIn({ context, args });
   const tokens = await client.get("/api/scim-tokens");
-  if (args.flags.json) return printJson7(context, tokens);
+  if (args.flags.json) return printJson8(context, tokens);
   if (tokens.length === 0) return context.out("No SCIM tokens. laze scim create-token <name>.\n");
   for (const token2 of tokens) {
     context.out(`${token2.id}	${token2.name}	by ${token2.createdByUserId}	${token2.createdAt}
@@ -83474,7 +83837,7 @@ async function scimCreateToken({ context, args }) {
   if (connection) {
     await keepScimToken({ client, minted, connection });
     if (args.flags.json) {
-      return printJson7(context, {
+      return printJson8(context, {
         token: minted.token,
         baseUrl: minted.baseUrl,
         vault: connection
@@ -83487,7 +83850,7 @@ async function scimCreateToken({ context, args }) {
     return context.out(`SCIM base URL for your identity provider: ${minted.baseUrl}
 `);
   }
-  if (args.flags.json) return printJson7(context, minted);
+  if (args.flags.json) return printJson8(context, minted);
   context.out(`Created ${minted.token.name} (${minted.token.id}). Its token, shown once:
 `);
   context.out(`${minted.secret}
@@ -83500,7 +83863,7 @@ async function scimRevokeToken({ context, args }) {
   if (!tokenId) throw new CliUsageError(SCIM_USAGE);
   const { client } = await signedIn({ context, args });
   await client.post("/api/scim-tokens/revoke", { tokenId });
-  if (args.flags.json) return printJson7(context, { revoked: true, tokenId });
+  if (args.flags.json) return printJson8(context, { revoked: true, tokenId });
   context.out(`Revoked ${tokenId}.
 `);
 }
@@ -83574,12 +83937,12 @@ async function statusUsage() {
 }
 
 // src/services/update-commands.service.ts
-import { realpath } from "node:fs/promises";
+import { realpath as realpath2 } from "node:fs/promises";
 var BY_HAND = `npm install -g ${CLI_PACKAGE_LATEST}`;
 async function realScriptOf({ program }) {
   const script = program.at(-1) ?? "";
   try {
-    return await realpath(script);
+    return await realpath2(script);
   } catch {
     return script;
   }
@@ -83711,7 +84074,7 @@ async function vaultSave({ context, args }) {
 }
 
 // src/services/vault-scrub-commands.service.ts
-function lineOf3(channel) {
+function lineOf4(channel) {
   const where = channel.name ? `#${channel.name}` : channel.channelId;
   const found = Object.entries(channel.found).map(([vendor, count4]) => `${vendor} ${count4}`).join(", ");
   const kinds = [`held ${channel.held}`, ...found ? [`found: ${found}`] : []].join("; ");
@@ -83725,7 +84088,7 @@ async function vaultScrub({ context, args }) {
   if (args.flags.json) return context.out(`${JSON.stringify(report3, null, 2)}
 `);
   const changed = report3.channels.filter((channel) => channel.messages > 0);
-  for (const channel of changed) context.out(lineOf3(channel));
+  for (const channel of changed) context.out(lineOf4(channel));
   const total = changed.reduce((sum, channel) => sum + channel.messages, 0);
   context.out(
     report3.dryRun ? `Dry run: ${total} message(s) would change. Nothing was changed.
@@ -83735,7 +84098,7 @@ async function vaultScrub({ context, args }) {
 }
 
 // src/services/whatsapp-business-commands.service.ts
-import { readFile as readFile34 } from "node:fs/promises";
+import { readFile as readFile35 } from "node:fs/promises";
 import { resolve as resolve14 } from "node:path";
 
 // ../../modules/whatsapp-business/contract/src/whatsapp-business.prices.ts
@@ -84147,7 +84510,7 @@ async function settle2({ client, send: send4 }) {
   return current2;
 }
 async function secretsOf2({ context, args }) {
-  if (SECRET_FLAGS3.some((flag) => args.flags[flag] !== void 0)) {
+  if (SECRET_FLAGS3.some((flag2) => args.flags[flag2] !== void 0)) {
     throw new CliUsageError(
       "A secret never goes in a flag: pipe it on stdin, use --from-file or --from-vault."
     );
@@ -84155,7 +84518,7 @@ async function secretsOf2({ context, args }) {
   const fromConnection = flagText({ args, name: "from-vault" });
   if (fromConnection) return { fromConnection };
   const file3 = flagText({ args, name: "from-file" });
-  const text2 = file3 ? await readFile34(resolve14(context.cwd, file3), "utf8") : await context.readStdin();
+  const text2 = file3 ? await readFile35(resolve14(context.cwd, file3), "utf8") : await context.readStdin();
   const lines = text2.split("\n").map((line) => line.trim()).filter(Boolean);
   if (lines.length !== 2) {
     throw new CliUsageError(
@@ -84356,7 +84719,7 @@ async function whatsappBusiness({
 }
 
 // src/services/whatsapp-pairing-commands.service.ts
-import { writeFile as writeFile21 } from "node:fs/promises";
+import { writeFile as writeFile22 } from "node:fs/promises";
 import { resolve as resolve15 } from "node:path";
 var WHATSAPP_PAIRING_USAGE = [
   "       laze whatsapp pair <machine> [--qr <file.svg>]     link WhatsApp on your machine; scan the code (owner)",
@@ -84377,7 +84740,7 @@ function svgOf(dataUrl) {
 }
 async function report({ context, args, pairing: pairing2 }) {
   const qrFile = pairing2.qrSvg ? resolve15(context.cwd, flagText({ args, name: "qr", fallback: "whatsapp-qr.svg" })) : null;
-  if (qrFile && pairing2.qrSvg) await writeFile21(qrFile, svgOf(pairing2.qrSvg), "utf8");
+  if (qrFile && pairing2.qrSvg) await writeFile22(qrFile, svgOf(pairing2.qrSvg), "utf8");
   if (args.flags.json) return context.out(`${JSON.stringify({ ...pairing2, qrFile }, null, 2)}
 `);
   context.out(`${pairing2.pairingId}	${pairing2.state}
@@ -84674,12 +85037,12 @@ async function wiki({ context, args }) {
 var FLAGS_USAGE = `Usage:
   laze flags list
   laze flags set <key> on|off`;
-var printJson8 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
+var printJson9 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
 `);
 async function roles({ context, args }) {
   const { client } = await signedIn({ context, args });
   const catalogue = await client.get("/api/roles");
-  if (args.flags.json) return printJson8(context, catalogue);
+  if (args.flags.json) return printJson9(context, catalogue);
   for (const role2 of catalogue) {
     const count4 = `${role2.permissions.length} permissions`;
     context.out(`${role2.label}	${count4}	${role2.description}
@@ -84695,7 +85058,7 @@ async function audit({ context, args }) {
     throw new CliUsageError("Usage: laze audit [--limit <1-200>]");
   const { client } = await signedIn({ context, args });
   const entries = await client.post("/api/audit-log/list", limit ? { limit } : {});
-  if (args.flags.json) return printJson8(context, entries);
+  if (args.flags.json) return printJson9(context, entries);
   if (entries.length === 0) return context.out("No audited actions yet.\n");
   for (const entry of entries) {
     const actor = `${entry.actorType}${entry.actorId ? ` ${entry.actorId}` : ""}`;
@@ -84710,21 +85073,21 @@ async function audit({ context, args }) {
 async function flagsList({ context, args }) {
   const { client } = await signedIn({ context, args });
   const flags2 = await client.get("/api/feature-flags");
-  if (args.flags.json) return printJson8(context, flags2);
+  if (args.flags.json) return printJson9(context, flags2);
   if (flags2.length === 0) return context.out("No flag was ever set: every flag is off.\n");
-  for (const flag of flags2) context.out(`${flag.key}	${flag.enabled ? "on" : "off"}
+  for (const flag2 of flags2) context.out(`${flag2.key}	${flag2.enabled ? "on" : "off"}
 `);
 }
 async function flagsSet({ context, args }) {
   const [, , key, state] = args.words;
   if (!key || state !== "on" && state !== "off") throw new CliUsageError(FLAGS_USAGE);
   const { client } = await signedIn({ context, args });
-  const flag = await client.post("/api/feature-flags/set", {
+  const flag2 = await client.post("/api/feature-flags/set", {
     key,
     enabled: state === "on"
   });
-  if (args.flags.json) return printJson8(context, flag);
-  context.out(`${flag.key}	${flag.enabled ? "on" : "off"}
+  if (args.flags.json) return printJson9(context, flag2);
+  context.out(`${flag2.key}	${flag2.enabled ? "on" : "off"}
 `);
 }
 var FLAG_COMMANDS = { list: flagsList, set: flagsSet };
@@ -84736,7 +85099,7 @@ async function flags({ context, args }) {
 }
 
 // src/services/workspace-commands.service.ts
-import { readFile as readFile35 } from "node:fs/promises";
+import { readFile as readFile36 } from "node:fs/promises";
 import { resolve as resolve16 } from "node:path";
 var ROLE_NAMES2 = {
   OWNER: "Owner",
@@ -84769,7 +85132,7 @@ ${deleting}`;
     }
   });
 }
-async function mine2({ context, args }) {
+async function mine3({ context, args }) {
   const { client } = await signedIn({ context, args });
   const answer4 = await client.post("/api/agents/me/workspace/mine", {});
   print8({
@@ -84919,7 +85282,7 @@ var LOGO_USAGE = "Usage: laze workspace logo set <file.png|jpg|webp> | laze work
 async function readLogo({ context, file: file3 }) {
   let bytes;
   try {
-    bytes = new Uint8Array(await readFile35(resolve16(context.cwd, file3)));
+    bytes = new Uint8Array(await readFile36(resolve16(context.cwd, file3)));
   } catch {
     throw new CliUsageError(`No file to read at ${file3}.`);
   }
@@ -84958,7 +85321,7 @@ var WORKSPACE_COMMANDS = {
   list: listWorkspaces,
   switch: switchTo,
   logo,
-  mine: mine2,
+  mine: mine3,
   rename: rename7,
   create: create2,
   leave,
@@ -85066,7 +85429,7 @@ async function role({ context, args }) {
 `
   });
 }
-async function remove4({ context, args }) {
+async function remove5({ context, args }) {
   const member = args.words[2];
   if (!member) throw new CliUsageError("Usage: laze members remove <member>");
   const { client } = await signedIn({ context, args });
@@ -85115,7 +85478,7 @@ var MEMBERS_COMMANDS = {
   "revoke-invite": revokeInvite,
   "invite-link": inviteLink,
   role,
-  remove: remove4,
+  remove: remove5,
   requests,
   approve: deciding("approved"),
   deny: deciding("denied")
@@ -85316,6 +85679,9 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze computer request <size> | cancel <request>   ask the admins for a size, or withdraw the ask
   laze computer list                             everyone's computers, size and monthly cost (Owners and Admins)
   laze computer restart [--person <user id>]     stop and start a computer that runs fine (people, not agents)
+  laze computer mine | add <name> --size <size> [--shared]   your Laze computers; add one (Owners and Admins)
+  laze computer remove <computer> [--to <computer>] | move <agent> <computer|default>   delete one, or move an agent
+  laze computer creators <computer> --everyone | --people <id,id>   who may add agents on a shared computer
   laze ip [status|on <country>|off|countries|domains [add|remove|reset]|list]   your dedicated IP for sites that block Laze
   laze ip offer --site <domain>                  when a site blocks the shared address: the offer to pass on, price included
   laze ops suspend|release <workspace> --reason "<why>"   Laze operators only, with LAZE_OPS_TOKEN
@@ -85584,8 +85950,8 @@ async function runCli({
 // src/services/processes.service.ts
 import { execFile as execFile2, spawn as spawn4 } from "node:child_process";
 import { mkdirSync, openSync } from "node:fs";
-import { readFile as readFile36, readlink } from "node:fs/promises";
-import { dirname as dirname19 } from "node:path";
+import { readFile as readFile37, readlink } from "node:fs/promises";
+import { dirname as dirname20 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var run3 = promisify2(execFile2);
 function alive(pid) {
@@ -85598,14 +85964,14 @@ function alive(pid) {
   }
 }
 async function argsOf(pid) {
-  const raw = await readFile36(`/proc/${pid}/cmdline`, "utf8").catch(() => void 0);
+  const raw = await readFile37(`/proc/${pid}/cmdline`, "utf8").catch(() => void 0);
   if (raw) return raw.split("\0").filter(Boolean);
   const listed = await run3("ps", ["-o", "args=", "-p", String(pid)]).catch(() => void 0);
   const line = listed?.stdout.trim();
   return line ? line.split(/\s+/) : void 0;
 }
 async function parentOf(pid) {
-  const stat3 = await readFile36(`/proc/${pid}/stat`, "utf8").catch(() => void 0);
+  const stat3 = await readFile37(`/proc/${pid}/stat`, "utf8").catch(() => void 0);
   const fromStat = stat3 ? Number(stat3.slice(stat3.lastIndexOf(")") + 2).split(" ")[1]) : NaN;
   if (fromStat > 0) return fromStat;
   const listed = await run3("ps", ["-o", "ppid=", "-p", String(pid)]).catch(() => void 0);
@@ -85622,7 +85988,7 @@ async function cwdOf(pid) {
   return line ? line.slice(1) : void 0;
 }
 function spawnDetached({ argv, logPath }) {
-  mkdirSync(dirname19(logPath), { recursive: true, mode: 448 });
+  mkdirSync(dirname20(logPath), { recursive: true, mode: 448 });
   const log = openSync(logPath, "a", 384);
   const [program = "", ...rest] = argv;
   const child = spawn4(program, rest, { detached: true, stdio: ["ignore", log, log] });