@lazehq/cli 0.1.33 → 0.1.35

package/dist/laze.mjs

@@ -35708,7 +35708,7 @@ function flagText({
 }
 
 // src/rules/cli-version.rules.ts
-var STAMPED = "0.1.33";
+var STAMPED = "0.1.35";
 function cliVersionOf({ stamped = STAMPED } = {}) {
   return stamped.startsWith("__") ? "dev" : stamped;
 }
@@ -59189,6 +59189,18 @@ var saveDraftInputSchemaDefinition = external_exports.object({
 var saveDraftInputSchema = saveDraftInputSchemaDefinition;
 var draftSavedSchemaDefinition = external_exports.object({ saved: external_exports.boolean() });
 var draftSavedSchema = draftSavedSchemaDefinition;
+var draftsParamsSchemaDefinition = external_exports.object({ workspaceId: workspaceIdSchema });
+var draftPlaceParamsSchemaDefinition = external_exports.object({
+  workspaceId: workspaceIdSchema,
+  channelId: idSchema4
+});
+var draftThreadQuerySchemaDefinition = external_exports.object({ threadRootId: idSchema4.optional() });
+var draftBodySchemaDefinition = saveDraftInputSchemaDefinition.pick({
+  text: true,
+  picks: true,
+  files: true,
+  savedAt: true
+});
 var SIDEBAR_SECTIONS_MAX = 50;
 var SIDEBAR_STARRED_MAX = 200;
 var sidebarFilterSchemaDefinition = external_exports.enum(["active", "unreads", "mentions", "all"]);
@@ -60370,12 +60382,27 @@ var liveStepSchemaDefinition = external_exports.object({
   steps: external_exports.number().int().nonnegative().optional()
 });
 var liveStepSchema = liveStepSchemaDefinition;
+var harnessModelSchemaDefinition = external_exports.object({
+  /** What the harness's `--model` takes, such as `gpt-6-sol` or `opus`. */
+  id: external_exports.string().min(1).max(200),
+  name: external_exports.string().max(200),
+  description: external_exports.string().max(500).default(""),
+  /** The model's own window in tokens, when the harness says it. */
+  contextWindow: external_exports.number().int().positive().nullable().default(null),
+  /** The thinking levels the model takes, lowest first; empty when it takes none. */
+  efforts: external_exports.array(external_exports.string().min(1).max(40)).max(20).default([]),
+  defaultEffort: external_exports.string().max(40).nullable().default(null)
+});
+var harnessModelSchema = harnessModelSchemaDefinition;
 var lazeAgentEventSchemaDefinition = external_exports.discriminatedUnion("type", [
   external_exports.object({
     type: external_exports.literal("harness_started"),
     harness: harnessKindSchema,
     resumed: external_exports.boolean(),
-    sessionRef: external_exports.string().optional()
+    sessionRef: external_exports.string().optional(),
+    /** The model and thinking effort the session runs on, when the supervisor knows them. */
+    model: external_exports.string().max(200).optional(),
+    effort: external_exports.string().max(40).optional()
   }),
   external_exports.object({
     type: external_exports.literal("turn_started"),
@@ -60463,6 +60490,17 @@ var lazeAgentEventSchemaDefinition = external_exports.discriminatedUnion("type",
     message: external_exports.string(),
     retryable: external_exports.boolean()
   }),
+  /** What the harness lists for its login, read as it starts: its default model first. */
+  external_exports.object({
+    type: external_exports.literal("harness_models"),
+    models: external_exports.array(harnessModelSchemaDefinition).max(100),
+    defaultModel: external_exports.string().max(200).nullable()
+  }),
+  /** The login no longer lists the agent's chosen model: the harness started on its default. */
+  external_exports.object({
+    type: external_exports.literal("model_gone"),
+    model: external_exports.string().min(1).max(200)
+  }),
   external_exports.object({ type: external_exports.literal("idle_stopping"), idleMs: external_exports.number().int().nonnegative() }),
   /** A running turn has said nothing, with no tool running, for `silentMs`. */
   external_exports.object({ type: external_exports.literal("stalled"), silentMs: external_exports.number().int().nonnegative() }),
@@ -60552,6 +60590,8 @@ var agentSandboxSpecSchemaDefinition = external_exports.object({
   harness: harnessKindSchema,
   /** Claude Code or Codex model name. */
   model: external_exports.string().min(1).optional(),
+  /** The thinking effort the harness runs at, such as `high`; absent for the model's default. */
+  effort: external_exports.string().min(1).max(40).optional(),
   /** Claude Code on a Laze model: the gateway through the relay connection, and its models. */
   claudeGateway: external_exports.object({ connectionId: external_exports.string().min(1), models: claudeGatewayModelsSchema }).optional(),
   /** The harness model's context window, when Laze knows it: compaction is set against it. */
@@ -60739,6 +60779,8 @@ var supervisorLaunchSchemaDefinition = external_exports.object({
     marginTokens: external_exports.number().int().nonnegative()
   }),
   model: external_exports.string().optional(),
+  /** The thinking effort the harness runs at; absent for the model's default. */
+  effort: external_exports.string().optional(),
   /** The harness model's context window, when Laze knows it: compaction is set against it. */
   contextWindow: external_exports.number().int().positive().optional(),
   /** Claude Code on a Laze model: the relay as its API, a placeholder as its token. */
@@ -61964,7 +62006,9 @@ var updateVaultConnectionInputSchemaDefinition = external_exports.object({
   maxLeaseSeconds: external_exports.number().int().positive().max(VAULT_MAX_LEASE_SECONDS).nullable().optional(),
   everyUseAsks: external_exports.boolean().optional(),
   secret: vaultSecretBundleSchema.optional(),
-  egress: vaultEgressTargetSchema.nullable().optional()
+  egress: vaultEgressTargetSchema.nullable().optional(),
+  /** A fresh passkey or Face ID proof, needed to lower a key from Always ask or Human only. */
+  reauthToken: external_exports.string().min(1).optional()
 });
 var updateVaultConnectionInputSchema = updateVaultConnectionInputSchemaDefinition;
 var vaultGrantSubjectSchemaDefinition = external_exports.object({
@@ -61981,7 +62025,9 @@ var vaultGrantSchemaDefinition = external_exports.object({
   lend: external_exports.boolean(),
   grantedByUserId: external_exports.string(),
   expiresAt: external_exports.iso.datetime().nullable(),
-  createdAt: external_exports.iso.datetime()
+  createdAt: external_exports.iso.datetime(),
+  /** A share asked from the CLI or by an agent: nothing reaches it until the owner's passkey. */
+  awaitingOwner: external_exports.boolean().optional()
 });
 var vaultGrantSchema = vaultGrantSchemaDefinition;
 var grantVaultConnectionInputSchemaDefinition = external_exports.object({
@@ -61999,6 +62045,33 @@ var lendVaultConnectionInputSchemaDefinition = external_exports.object({
   durationSeconds: external_exports.number().int().positive().nullable().default(null)
 });
 var lendVaultConnectionInputSchema = lendVaultConnectionInputSchemaDefinition;
+var shareVaultConnectionInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  connectionId: external_exports.string().min(1),
+  /** The teammate whose own agents may use the key; they never see its value. */
+  userId: external_exports.string().min(1),
+  durationSeconds: external_exports.number().int().positive().nullable().default(null),
+  /** A fresh passkey or Face ID proof makes the share live; without one it waits for the owner. */
+  reauthToken: external_exports.string().min(1).optional()
+});
+var shareVaultConnectionInputSchema = shareVaultConnectionInputSchemaDefinition;
+var approveVaultShareInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  grantId: external_exports.string().min(1),
+  reauthToken: external_exports.string().min(1)
+});
+var approveVaultShareInputSchema = approveVaultShareInputSchemaDefinition;
+var requestVaultShareInputSchemaDefinition = external_exports.object({
+  turnToken: external_exports.string().min(1),
+  connection: external_exports.string().min(1),
+  userId: external_exports.string().min(1),
+  durationSeconds: external_exports.number().int().positive().nullable().default(null)
+});
+var setVaultLevelInTurnInputSchemaDefinition = external_exports.object({
+  turnToken: external_exports.string().min(1),
+  connection: external_exports.string().min(1),
+  sensitivity: vaultSensitivitySchema
+});
 var vaultAgentKindSchema = external_exports.enum(["personal", "team"]);
 var openVaultTurnInputSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
@@ -62256,7 +62329,14 @@ var vaultConnectionUseSchemaDefinition = external_exports.object({
   leaseId: external_exports.string().nullable().default(null),
   origin: vaultUseOriginSchema.nullable().default(null),
   /** How a person's read happened: `page` (Reveal) or `own_secret` (the CLI or Laze for them). */
-  via: external_exports.string().nullable().default(null)
+  via: external_exports.string().nullable().default(null),
+  /** On a share or a tier change: the person it named, the new tier, and the proof used. */
+  change: external_exports.object({
+    subjectUserId: external_exports.string().nullable(),
+    to: vaultSensitivitySchema.nullable(),
+    direction: external_exports.enum(["raised", "lowered"]).nullable(),
+    method: external_exports.string().nullable()
+  }).nullable().optional()
 });
 var vaultConnectionUseSchema = vaultConnectionUseSchemaDefinition;
 var vaultRevokeAtProviderSchema = external_exports.enum(["revoked", "failed", "not_supported"]);
@@ -62353,7 +62433,7 @@ var vaultTrpc = defineTrpcContract("vault").mutation("createConnection").withInp
     reason: external_exports.string().trim().min(1).max(200),
     reauthToken: external_exports.string().min(1).max(200).optional()
   })
-).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("beginReauth").withInput(workspaceInput).withOutput(vaultReauthChallengeSchema).mutation("confirmReauth").withInput(confirmVaultReauthInputSchema).withOutput(vaultReauthProofSchema).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), grantId: external_exports.string().min(1) })).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(vaultAuditReadInputSchema).withOutput(vaultAuditPageSchema).query("listActivity").withInput(vaultAuditReadInputSchema).withOutput(external_exports.array(vaultAuditEntrySchema)).query("listLeases").withInput(workspaceInput).withOutput(external_exports.array(vaultLeaseSchema)).mutation("endLease").withInput(endVaultLeaseInputSchema).withOutput(external_exports.object({ ended: external_exports.literal(true) })).query("mostAsked").withInput(vaultMostAskedInputSchema).withOutput(vaultMostAskedSchema).query("judgeStatus").withInput(workspaceInput).withOutput(vaultJudgeStatusSchema).query("listLevelLimits").withInput(workspaceInput).withOutput(external_exports.array(vaultLevelLimitSchema)).mutation("setLevelLimit").withInput(setVaultLevelLimitInputSchema).withOutput(external_exports.array(vaultLevelLimitSchema)).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(
+).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("beginReauth").withInput(workspaceInput).withOutput(vaultReauthChallengeSchema).mutation("confirmReauth").withInput(confirmVaultReauthInputSchema).withOutput(vaultReauthProofSchema).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), grantId: external_exports.string().min(1) })).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).mutation("shareConnection").withInput(shareVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("approveShare").withInput(approveVaultShareInputSchema).withOutput(vaultGrantSchema).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(vaultAuditReadInputSchema).withOutput(vaultAuditPageSchema).query("listActivity").withInput(vaultAuditReadInputSchema).withOutput(external_exports.array(vaultAuditEntrySchema)).query("listLeases").withInput(workspaceInput).withOutput(external_exports.array(vaultLeaseSchema)).mutation("endLease").withInput(endVaultLeaseInputSchema).withOutput(external_exports.object({ ended: external_exports.literal(true) })).query("mostAsked").withInput(vaultMostAskedInputSchema).withOutput(vaultMostAskedSchema).query("judgeStatus").withInput(workspaceInput).withOutput(vaultJudgeStatusSchema).query("listLevelLimits").withInput(workspaceInput).withOutput(external_exports.array(vaultLevelLimitSchema)).mutation("setLevelLimit").withInput(setVaultLevelLimitInputSchema).withOutput(external_exports.array(vaultLevelLimitSchema)).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(
   external_exports.object({
     ...connectionInput.shape,
     reason: external_exports.string().trim().min(1).max(200),
@@ -64019,6 +64099,79 @@ var harnessSignInPollSchemaDefinition = external_exports.discriminatedUnion("sta
 ]);
 var harnessSignInPollSchema = harnessSignInPollSchemaDefinition;
 
+// ../../modules/agent/contract/src/agent-run-config.ts
+var harnessModelsSchemaDefinition = external_exports.object({
+  models: external_exports.array(harnessModelSchema).max(100),
+  /** The model the harness runs when Laze names none; null when it did not say. */
+  defaultModel: external_exports.string().max(200).nullable(),
+  readAt: external_exports.iso.datetime()
+});
+var harnessModelsSchema = harnessModelsSchemaDefinition;
+var runModelInputSchema = external_exports.string().trim().min(1).max(200).nullable();
+var runEffortInputSchema = external_exports.string().trim().min(1).max(40).regex(/^[a-z]+$/).nullable();
+var EFFORT_LABELS = {
+  minimal: "Minimal",
+  low: "Low",
+  medium: "Medium",
+  high: "High",
+  xhigh: "Extra high",
+  max: "Max",
+  ultra: "Ultra"
+};
+function effortLabelOf({ effort }) {
+  return EFFORT_LABELS[effort] ?? `${effort.charAt(0).toUpperCase()}${effort.slice(1)}`;
+}
+function tokensLabelOf({ tokens }) {
+  if (tokens >= 1e6) return `${Math.round(tokens / 1e5) / 10}M`;
+  return `${Math.round(tokens / 1e3)}k`;
+}
+function pickRunningModel({ agent: agent2 }) {
+  if (agent2.harness === "laze-models") return null;
+  const listed = agent2.harnessModels?.models ?? [];
+  const wanted = agent2.model ?? agent2.harnessModels?.defaultModel ?? null;
+  return listed.find((one) => one.id === wanted) ?? (agent2.model ? null : listed[0] ?? null);
+}
+function contextCapOf({ agent: agent2 }) {
+  if (agent2.harness === "laze-models") return { tokens: AGENT_CONTEXT_WINDOW.max, known: true };
+  const window2 = pickRunningModel({ agent: agent2 })?.contextWindow ?? null;
+  return window2 ? { tokens: window2, known: true } : { tokens: AGENT_CONTEXT_WINDOW.max, known: false };
+}
+var LEVEL_NAMES = { fast: "Laze Fast", frontier: "Laze Frontier" };
+function modelLineOf({ agent: agent2 }) {
+  if (agent2.harness === "laze-models") return LEVEL_NAMES[agent2.modelLevel ?? "fast"];
+  const running = pickRunningModel({ agent: agent2 });
+  if (agent2.model) return running?.name || agent2.model;
+  return running ? `Default (${running.name || running.id})` : "Default";
+}
+function describeEffort({ agent: agent2 }) {
+  const running = pickRunningModel({ agent: agent2 });
+  if (agent2.effort) return effortLabelOf({ effort: agent2.effort });
+  if (running && running.efforts.length === 0) return null;
+  const fallback = running?.defaultEffort;
+  return fallback ? `Default (${effortLabelOf({ effort: fallback })})` : "Default";
+}
+function contextLineOf({ agent: agent2 }) {
+  const cap = contextCapOf({ agent: agent2 });
+  if (agent2.harness === "laze-models") {
+    const tokens = agent2.contextWindow ?? AGENT_CONTEXT_WINDOW.default;
+    return `${tokensLabelOf({ tokens })}, up to ${tokensLabelOf({ tokens: cap.tokens })}`;
+  }
+  if (!cap.known) {
+    return agent2.contextWindow ? `${tokensLabelOf({ tokens: agent2.contextWindow })}, or the model's window if smaller` : "The model's own window";
+  }
+  const set2 = agent2.contextWindow ? Math.min(agent2.contextWindow, cap.tokens) : null;
+  if (!set2 || set2 === cap.tokens)
+    return `${tokensLabelOf({ tokens: cap.tokens })}, the most this model takes`;
+  return `${tokensLabelOf({ tokens: set2 })} of the ${tokensLabelOf({ tokens: cap.tokens })} this model takes`;
+}
+function agentRunSummaryOf({ agent: agent2 }) {
+  return {
+    model: modelLineOf({ agent: agent2 }),
+    effort: describeEffort({ agent: agent2 }),
+    context: contextLineOf({ agent: agent2 })
+  };
+}
+
 // ../../modules/agent/contract/src/agent-manage.ts
 var hostedHarnessSchema = external_exports.enum(["laze-models", "claude-code", "codex"]);
 var nameSchema = external_exports.string().trim().min(1).max(80);
@@ -64048,8 +64201,12 @@ var updateAgentAsCallerInputSchemaDefinition = external_exports.object({
   name: nameSchema.optional(),
   description: descriptionSchema.optional(),
   avatar: agentAvatarInputSchema.optional(),
-  /** The context window of an agent Laze runs, in tokens, 100k to 1M. */
-  contextWindow: contextWindowInputSchema.optional(),
+  /** The max context of an agent Laze runs, in tokens, 100k to 1M; null for its default. */
+  contextWindow: contextWindowInputSchema.nullable().optional(),
+  /** The model its login lists, or null for the harness's default. */
+  model: runModelInputSchema.optional(),
+  /** The thinking level its model lists, or null for the model's default. */
+  effort: runEffortInputSchema.optional(),
   /** Pauses or resumes an agent Laze runs. */
   paused: external_exports.boolean().optional(),
   pauseReason: external_exports.string().trim().max(200).optional()
@@ -64278,8 +64435,14 @@ var agentSchemaDefinition = external_exports.object({
   /** A Laze agent's SOUL.md. */
   instructions: external_exports.string().default(""),
   modelLevel: agentModelLevelSchema.nullable().default(null),
-  /** The context window of an agent Laze runs, in tokens; null on a connected agent. */
+  /** The max context of an agent Laze runs, in tokens; null for its default or a connected one. */
   contextWindow: external_exports.number().int().positive().nullable().default(null),
+  /** The model a Claude Code or Codex agent runs; null for its harness's default. */
+  model: external_exports.string().nullable().default(null),
+  /** The thinking effort it runs at; null for its model's default. */
+  effort: external_exports.string().nullable().default(null),
+  /** The models its harness listed for its login when it last started; null before then. */
+  harnessModels: harnessModelsSchema.nullable().default(null),
   /** The GitHub identity a Laze agent works as; null when it has none. */
   github: agentGithubSchema.nullable().default(null),
   /** Out of usage (its login or its Laze models budget) until this time; null when it can work. */
@@ -64336,8 +64499,12 @@ var updateAgentInputSchemaDefinition = external_exports.object({
   name: agentNameSchema.optional(),
   avatar: agentAvatarInputSchema.optional(),
   modelLevel: agentModelLevelSchema.optional(),
-  /** Agents Laze runs only; a connected agent refuses it. */
-  contextWindow: contextWindowInputSchema.optional(),
+  /** Agents Laze runs only; a connected agent refuses it. Null puts back the default. */
+  contextWindow: contextWindowInputSchema.nullable().optional(),
+  /** A model its login lists, or null for the harness's default; Claude Code and Codex only. */
+  model: runModelInputSchema.optional(),
+  /** A thinking level its model lists, or null for the model's default. */
+  effort: runEffortInputSchema.optional(),
   instructions: instructionsSchema.optional(),
   /** The whole set: channels left out are left. */
   channelIds: external_exports.array(idSchema14).max(50).optional(),
@@ -64718,8 +64885,6 @@ var agentConfig = Config.define((c) => ({
     "AGENT_CLAUDE_GATEWAY_THINKING",
     external_exports.enum(["on", "off"]).default("on")
   ),
-  /** The Codex model's window, which caps a Codex agent's context window setting. */
-  codexContextWindow: c.env("AGENT_CODEX_CONTEXT", positiveInt3.default(4e5)),
   /** A harness prompt or question no one answers is denied or dismissed after this long. */
   attentionTimeoutMinutes: c.env("AGENT_ATTENTION_TIMEOUT_MINUTES", positiveInt3.default(30)),
   /** Where a GitHub signature links back; the origin the connect command fetches the CLI from. */
@@ -65357,6 +65522,11 @@ var requestConnectionInputSchemaDefinition = external_exports.object({
   name: external_exports.string().trim().max(80).optional()
 });
 
+// ../../modules/agent/contract/src/agent-profile.ui.ts
+var agentProfileUi = uiTokens("agent");
+var AgentProfileSlot = agentProfileUi.component("profile");
+var AgentOwnedListSlot = agentProfileUi.component("ownedList");
+
 // src/services/laze-client.service.ts
 var CLI_VERSION_HEADER = "x-laze-cli-version";
 var LazeApiError = class extends Error {
@@ -65727,6 +65897,7 @@ function agentProfileOf({
   baseUrl
 }) {
   const owner = ownerName || "its owner";
+  const run4 = agent2.hosting === "laze" ? agentRunSummaryOf({ agent: agent2 }) : null;
   return {
     id: agent2.id,
     name: agent2.name,
@@ -65735,6 +65906,9 @@ function agentProfileOf({
     intelligence: intelligenceOf({ agent: agent2, owner }),
     status: statusOf({ agent: agent2 }),
     login: loginOf({ agent: agent2 }),
+    model: run4?.model ?? null,
+    effort: run4?.effort ?? null,
+    maxContext: run4?.context ?? null,
     createdAt: agent2.createdAt.slice(0, 10),
     channels: agent2.channels.filter((channel) => channel.kind === "public" || channel.kind === "private").map((channel) => `#${channel.name}`),
     link: `${baseUrl.replace(/\/$/, "")}/workspaces/${agent2.workspaceId}/agents`
@@ -65747,6 +65921,9 @@ function formatAgentProfile({ profile }) {
     ["Intelligence", profile.intelligence],
     ["Status", profile.status],
     ["Login", profile.login],
+    ["Model", profile.model],
+    ["Thinking effort", profile.effort],
+    ["Max context", profile.maxContext],
     ["Created", profile.createdAt],
     ["Channels", profile.channels.length > 0 ? profile.channels.join(", ") : "none"],
     ["Profile", profile.link]
@@ -66015,7 +66192,7 @@ var slackBookmarksSchema = slackBookmarksSchemaDefinition;
 // ../../modules/slack/contract/src/slack-direct.ts
 var slackPeopleInputSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
-  /** Part of a name; empty lists the first people. */
+  /** Part of a Slack name, full name or email; empty lists the first people. */
   query: external_exports.string().trim().max(80).default("")
 });
 var slackPeopleInputSchema = slackPeopleInputSchemaDefinition;
@@ -66024,6 +66201,10 @@ var slackPersonSchemaDefinition = external_exports.object({
   teamName: external_exports.string(),
   slackUserId: external_exports.string(),
   name: external_exports.string(),
+  /** Their full name in Slack, empty when it is the same as `name` or Slack gave none. */
+  realName: external_exports.string().default(""),
+  /** Their Slack profile email; null when Slack does not share it. */
+  email: external_exports.string().nullable().default(null),
   avatarUrl: external_exports.string().nullable()
 });
 var slackPeopleSchemaDefinition = external_exports.object({ people: external_exports.array(slackPersonSchemaDefinition) });
@@ -69831,6 +70012,9 @@ are waiting, if you think one was missed.
 - \`laze history <channel>\` and \`laze thread <id>\` read a conversation.
 - \`laze search "words"\` searches messages.
 - \`laze channels list\` lists the conversations you are in.
+- \`laze channel info <channel>\` shows its members and the apps pinned there. Read a pinned app
+  with \`laze app pull --app <app>\` (its files: page, plan, code) and
+  \`laze app records list <collection> --app <app>\` (its data).
 
 If \`laze\` is not on the PATH, run the same commands through \`npx -y @lazehq/cli@latest\`.
 Never print or repeat your Laze key.
@@ -70652,7 +70836,7 @@ function formatLoginActivity({ activity: activity2 }) {
 
 // src/services/agent-manage-commands.service.ts
 var CREATE_USAGE = "Usage: laze agent create --name <name> [--description <text>] [--harness laze-models|claude-code|codex] [--team] [--pool <pool>] [--avatar <file>]";
-var UPDATE_USAGE = "Usage: laze agent update <agent> [--name <name>] [--description <text>] [--avatar <file>] [--context-window <tokens, such as 400k or 1M>]";
+var UPDATE_USAGE = "Usage: laze agent update <agent> [--name <name>] [--description <text>] [--avatar <file>] [--model <model>|default] [--effort <level>|default] [--max-context <tokens, such as 200k>|default]";
 var ARCHIVE_USAGE = "Usage: laze agent archive <agent>";
 var PAUSE_USAGE = 'Usage: laze agent pause <agent> [--reason "<why>"] | laze agent resume <agent>';
 var TRANSFER_USAGE = "Usage: laze agent transfer <agent> <member: user id, email or name>";
@@ -70685,13 +70869,40 @@ async function avatarOf({
   return uploaded.avatar;
 }
 function contextWindowOf2({ args }) {
-  const value = args.flags["context-window"];
+  const value = args.flags["max-context"] ?? args.flags["context-window"];
   if (value === void 0) return void 0;
+  if (value === "default") return null;
   const match = typeof value === "string" ? /^(\d+(?:\.\d+)?)([kKmM]?)$/.exec(value.trim()) : null;
   if (!match) throw new CliUsageError(UPDATE_USAGE);
   const unit = { k: 1e3, m: 1e6 }[match[2]?.toLowerCase() ?? ""] ?? 1;
   return Math.round(Number(match[1]) * unit);
 }
+function runFlagOf({ args, name: name2 }) {
+  const value = args.flags[name2];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !value.trim()) throw new CliUsageError(UPDATE_USAGE);
+  return value.trim() === "default" ? null : value.trim();
+}
+function runChangesOf({ args }) {
+  const contextWindow = contextWindowOf2({ args });
+  const model = runFlagOf({ args, name: "model" });
+  const effort = runFlagOf({ args, name: "effort" });
+  return {
+    ...contextWindow !== void 0 && { contextWindow },
+    ...model !== void 0 && { model },
+    ...effort !== void 0 && { effort }
+  };
+}
+function runLinesOf({ agent: agent2 }) {
+  if (agent2.hosting !== "laze") return [];
+  const summary = agentRunSummaryOf({ agent: agent2 });
+  return [
+    `Model: ${summary.model}.`,
+    ...summary.effort ? [`Thinking effort: ${summary.effort}.`] : [],
+    `Max context: ${summary.context}.`,
+    "It takes effect on its next turn."
+  ];
+}
 function descriptionOf({ args }) {
   const value = args.flags.description;
   return typeof value === "string" ? value : void 0;
@@ -70773,9 +70984,9 @@ async function updateAgent({
   const agent2 = args.words[2];
   const name2 = flagText({ args, name: "name" }).trim();
   const description = descriptionOf({ args });
-  const contextWindow = contextWindowOf2({ args });
+  const run4 = runChangesOf({ args });
   const nothing = !name2 && description === void 0 && !args.flags.avatar;
-  if (!agent2 || nothing && contextWindow === void 0) throw new CliUsageError(UPDATE_USAGE);
+  if (!agent2 || nothing && Object.keys(run4).length === 0) throw new CliUsageError(UPDATE_USAGE);
   const { client } = await signedIn({ context, args });
   const avatar = await avatarOf({ context, args, client });
   const updated = await client.post("/api/agents/update", {
@@ -70783,14 +70994,14 @@ async function updateAgent({
     ...name2 && { name: name2 },
     ...description !== void 0 && { description },
     ...avatar !== void 0 && { avatar },
-    ...contextWindow !== void 0 && { contextWindow }
+    ...run4
   });
   if (args.flags.json) return context.out(`${JSON.stringify(updated, null, 2)}
 `);
   context.out(
     [
       `Updated ${updated.name}.`,
-      ...updated.contextWindow ? [`Its context window is ${updated.contextWindow.toLocaleString("en-GB")} tokens.`] : [],
+      ...runLinesOf({ agent: updated }),
       ...mentionLinesOf({ agentId: updated.id, name: updated.name }),
       ""
     ].join("\n")
@@ -71783,6 +71994,13 @@ var appPreviewSchemaDefinition = external_exports.object({
   /** The site's own origin; opening it signs the person in through Laze. */
   url: external_exports.string()
 });
+var appPullSchemaDefinition = external_exports.object({
+  app: external_exports.object({ id: external_exports.string(), name: external_exports.string(), slug: external_exports.string() }),
+  site: appSiteSchema,
+  version: appVersionIdSchema,
+  files: external_exports.array(appFileSchema),
+  collections: external_exports.array(collectionSchema)
+});
 var exportRecordsInputSchemaDefinition = external_exports.object({
   ...siteRefSchemaDefinition.shape,
   collection: collectionNameSchema,
@@ -72031,6 +72249,27 @@ var appAccessRequestSchemaDefinition = external_exports.object({
   decidedAt: external_exports.iso.datetime().nullable()
 });
 var appAccessRequestSchema = appAccessRequestSchemaDefinition;
+var appMemberSourceSchemaDefinition = external_exports.object({
+  kind: external_exports.enum(["owner", "admin", "direct", "channel", "workspace", "agent-owner"]),
+  /** The channel, for `channel`: a pin there, a share with it, or the app's own channel. */
+  channelId: external_exports.string().nullable(),
+  channelName: external_exports.string().nullable(),
+  /** The person an agent holds the app through, for `agent-owner`. */
+  ownerName: external_exports.string().nullable()
+});
+var appMemberSchemaDefinition = external_exports.object({
+  member: external_exports.object({ type: external_exports.enum(["user", "agent"]), id: external_exports.string().min(1) }),
+  name: external_exports.string(),
+  role: appRoleSchema,
+  sources: external_exports.array(appMemberSourceSchemaDefinition).min(1),
+  /** Whether a Builder can take this access away here: only a direct share is removable. */
+  removable: external_exports.boolean()
+});
+var appMembersSchemaDefinition = external_exports.object({
+  appId: external_exports.string().min(1),
+  members: external_exports.array(appMemberSchemaDefinition)
+});
+var appMembersSchema = appMembersSchemaDefinition;
 var appAccessSchemaDefinition = external_exports.object({
   appId: external_exports.string().min(1),
   visibility: appVisibilitySchema,
@@ -72510,7 +72749,7 @@ var appBackupCheckAlertsSchemaDefinition = external_exports.object({
 });
 
 // ../../modules/app/contract/src/app.trpc.ts
-var appMainTrpc = defineTrpcContract("app").query("list").withInput(listAppsInputSchema).withOutput(external_exports.array(appSchema)).query("get").withInput(appRefSchema).withOutput(appSchema).mutation("create").withInput(createAppInputSchema).withOutput(appSchema).mutation("rename").withInput(renameAppInputSchema).withOutput(appSchema).mutation("archive").withInput(appRefSchema).withOutput(appSchema).mutation("unarchive").withInput(appRefSchema).withOutput(appSchema).mutation("delete").withInput(deleteAppInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).query("versions").withInput(appRefSchema).withOutput(external_exports.array(appVersionSchema)).mutation("revert").withInput(revertInputSchema).withOutput(appVersionSchema).mutation("publish").withInput(publishInputSchema).withOutput(publishOutcomeSchema).query("collections").withInput(siteRefSchema).withOutput(external_exports.array(collectionSchema)).query("records").withInput(listRecordsInputSchema).withOutput(recordPageSchema).mutation("writeRecord").withInput(writeRecordInputSchema).withOutput(appRecordSchema).mutation("deleteRecord").withInput(deleteRecordInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).query("views").withInput(siteRefSchema).withOutput(external_exports.array(appViewSchema)).mutation("saveView").withInput(saveViewInputSchema).withOutput(appViewSchema).mutation("deleteView").withInput(deleteViewInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).mutation("chooseCardRows").withInput(chooseCardRowsInputSchema).withOutput(appCardChoiceSchema).query("exportRecords").withInput(exportRecordsInputSchema).withOutput(recordExportSchema).mutation("importRecords").withInput(importRecordsInputSchema).withOutput(recordImportSchema).mutation("decidePublish").withInput(decidePublishInputSchema).withOutput(publishOutcomeSchema).mutation("nameVersion").withInput(nameVersionInputSchema).withOutput(appVersionSchema).mutation("makeInternal").withInput(appRefSchema).withOutput(appSchema).mutation("revokePublishLease").withInput(appRefSchema).withOutput(appSchema).mutation("signInHandoff").withInput(signInHandoffInputSchema).withOutput(signInHandoffSchema).query("functionLogs").withInput(listFunctionLogsInputSchema).withOutput(external_exports.array(appFunctionLogEntrySchema)).query("functionSettings").withInput(appWorkspaceRefSchema).withOutput(appFunctionSettingsSchema).query("access").withInput(appRefSchema).withOutput(appAccessSchema).mutation("grantAccess").withInput(grantAppAccessInputSchema).withOutput(appAccessSchema).mutation("revokeAccess").withInput(revokeAppAccessInputSchema).withOutput(appAccessSchema).mutation("setVisibility").withInput(setAppVisibilityInputSchema).withOutput(visibilityOutcomeSchema).mutation("setMemberRole").withInput(setMemberRoleInputSchema).withOutput(appAccessSchema).mutation("unpublish").withInput(appRefSchema).withOutput(appSchema).query("door").withInput(appRefSchema).withOutput(appDoorSchema).mutation("requestAccess").withInput(appRefSchema).withOutput(appDoorSchema).mutation("decideAccess").withInput(decideAppAccessInputSchema).withOutput(appAccessRequestSchema).query("users").withInput(appRefSchema).withOutput(appUsersSchema).mutation("blockUser").withInput(blockAppUserInputSchema).withOutput(appUsersSchema).mutation("deleteUser").withInput(deleteAppUserInputSchema).withOutput(deletedAppUserSchema).mutation("setFunctionsEnabled").withInput(setFunctionsEnabledInputSchema).withOutput(appFunctionSettingsSchema).query("backups").withInput(appRefSchema).withOutput(appBackupStatusSchema).mutation("restoreData").withInput(restoreAppDataInputSchema).withOutput(appRestoreSchema).query("cost").withInput(appRefSchema).withOutput(appCostSchema).mutation("setBudget").withInput(setAppBudgetInputSchema).withOutput(appCostSchema).query("triggers").withInput(appRefSchema).withOutput(appTriggersSchema).mutation("setTriggerPaused").withInput(setAppTriggerPausedInputSchema).withOutput(appTriggerSchema).mutation("removeTrigger").withInput(appTriggerRefSchema).withOutput(external_exports.object({ removed: external_exports.literal(true) })).build();
+var appMainTrpc = defineTrpcContract("app").query("list").withInput(listAppsInputSchema).withOutput(external_exports.array(appSchema)).query("get").withInput(appRefSchema).withOutput(appSchema).mutation("create").withInput(createAppInputSchema).withOutput(appSchema).mutation("rename").withInput(renameAppInputSchema).withOutput(appSchema).mutation("archive").withInput(appRefSchema).withOutput(appSchema).mutation("unarchive").withInput(appRefSchema).withOutput(appSchema).mutation("delete").withInput(deleteAppInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).query("versions").withInput(appRefSchema).withOutput(external_exports.array(appVersionSchema)).mutation("revert").withInput(revertInputSchema).withOutput(appVersionSchema).mutation("publish").withInput(publishInputSchema).withOutput(publishOutcomeSchema).query("collections").withInput(siteRefSchema).withOutput(external_exports.array(collectionSchema)).query("records").withInput(listRecordsInputSchema).withOutput(recordPageSchema).mutation("writeRecord").withInput(writeRecordInputSchema).withOutput(appRecordSchema).mutation("deleteRecord").withInput(deleteRecordInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).query("views").withInput(siteRefSchema).withOutput(external_exports.array(appViewSchema)).mutation("saveView").withInput(saveViewInputSchema).withOutput(appViewSchema).mutation("deleteView").withInput(deleteViewInputSchema).withOutput(external_exports.object({ deleted: external_exports.literal(true) })).mutation("chooseCardRows").withInput(chooseCardRowsInputSchema).withOutput(appCardChoiceSchema).query("exportRecords").withInput(exportRecordsInputSchema).withOutput(recordExportSchema).mutation("importRecords").withInput(importRecordsInputSchema).withOutput(recordImportSchema).mutation("decidePublish").withInput(decidePublishInputSchema).withOutput(publishOutcomeSchema).mutation("nameVersion").withInput(nameVersionInputSchema).withOutput(appVersionSchema).mutation("makeInternal").withInput(appRefSchema).withOutput(appSchema).mutation("revokePublishLease").withInput(appRefSchema).withOutput(appSchema).mutation("signInHandoff").withInput(signInHandoffInputSchema).withOutput(signInHandoffSchema).query("functionLogs").withInput(listFunctionLogsInputSchema).withOutput(external_exports.array(appFunctionLogEntrySchema)).query("functionSettings").withInput(appWorkspaceRefSchema).withOutput(appFunctionSettingsSchema).query("access").withInput(appRefSchema).withOutput(appAccessSchema).query("members").withInput(appRefSchema).withOutput(appMembersSchema).mutation("grantAccess").withInput(grantAppAccessInputSchema).withOutput(appAccessSchema).mutation("revokeAccess").withInput(revokeAppAccessInputSchema).withOutput(appAccessSchema).mutation("setVisibility").withInput(setAppVisibilityInputSchema).withOutput(visibilityOutcomeSchema).mutation("setMemberRole").withInput(setMemberRoleInputSchema).withOutput(appAccessSchema).mutation("unpublish").withInput(appRefSchema).withOutput(appSchema).query("door").withInput(appRefSchema).withOutput(appDoorSchema).mutation("requestAccess").withInput(appRefSchema).withOutput(appDoorSchema).mutation("decideAccess").withInput(decideAppAccessInputSchema).withOutput(appAccessRequestSchema).query("users").withInput(appRefSchema).withOutput(appUsersSchema).mutation("blockUser").withInput(blockAppUserInputSchema).withOutput(appUsersSchema).mutation("deleteUser").withInput(deleteAppUserInputSchema).withOutput(deletedAppUserSchema).mutation("setFunctionsEnabled").withInput(setFunctionsEnabledInputSchema).withOutput(appFunctionSettingsSchema).query("backups").withInput(appRefSchema).withOutput(appBackupStatusSchema).mutation("restoreData").withInput(restoreAppDataInputSchema).withOutput(appRestoreSchema).query("cost").withInput(appRefSchema).withOutput(appCostSchema).mutation("setBudget").withInput(setAppBudgetInputSchema).withOutput(appCostSchema).query("triggers").withInput(appRefSchema).withOutput(appTriggersSchema).mutation("setTriggerPaused").withInput(setAppTriggerPausedInputSchema).withOutput(appTriggerSchema).mutation("removeTrigger").withInput(appTriggerRefSchema).withOutput(external_exports.object({ removed: external_exports.literal(true) })).build();
 var appConnectionsTrpc = defineTrpcContract("app").query("connections").withInput(appRefSchema).withOutput(appConnectionsSchema).mutation("allowConnection").withInput(appConnectionRefSchema).withOutput(appConnectionsSchema).mutation("revokeConnection").withInput(appConnectionRefSchema).withOutput(appConnectionsSchema).build();
 var appPinsTrpc = defineTrpcContract("app").query("pins").withInput(channelPinsInputSchema).withOutput(channelAppPinsSchema).mutation("pin").withInput(pinAppInputSchema).withOutput(channelAppPinsSchema).mutation("unpin").withInput(pinAppInputSchema).withOutput(channelAppPinsSchema).mutation("setPinView").withInput(setPinViewInputSchema).withOutput(channelAppPinsSchema).mutation("reorderPins").withInput(reorderPinsInputSchema).withOutput(channelAppPinsSchema).build();
 var appTrpc = joinTrpcContracts("app", appMainTrpc, appConnectionsTrpc, appPinsTrpc);
@@ -72624,6 +72863,12 @@ var appCliCommands = [
     arguments: ["--site draft|published"],
     summary: "Print the address of the draft preview (or the published app)"
   },
+  {
+    command: "laze app pull",
+    operation: "pullFiles",
+    arguments: ["[dir]", "--site published|draft"],
+    summary: "Download the app's files and a laze.app.json into a folder (default ./<slug>), to read its page, plan or code; anyone who may open the app can pull it"
+  },
   {
     command: "laze app publish",
     operation: "requestPublish",
@@ -72642,6 +72887,12 @@ var appCliCommands = [
     arguments: [],
     summary: "Take the published address offline at once; the data stays"
   },
+  {
+    command: "laze app members",
+    operation: "listMembers",
+    arguments: ["[app]"],
+    summary: "Everyone who can open the app, people and agents, each with how: Owner, Shared directly, via #channel or the workspace"
+  },
   {
     command: "laze app access",
     operation: "getAccess",
@@ -73722,6 +73973,16 @@ function print3({
   context.out(args.flags.json ? `${JSON.stringify(value, null, 2)}
 ` : text2);
 }
+function readLineOf(pin) {
+  if (pin.kind === "browser") return `  read it: laze browser read ${pin.appId}
+`;
+  if (pin.role === null) {
+    return `  you cannot open it: ask ${pin.pinnedByName ?? "whoever pinned it"} to give you access
+`;
+  }
+  return `  read it: laze app pull --app ${pin.appId} (its files), laze app records list <collection> --app ${pin.appId} (its data)
+`;
+}
 function pinsText({ channel, listed }) {
   if (listed.pins.length === 0) {
     return `No apps are pinned to ${channel}. laze app pin --channel ${channel} pins one.
@@ -73729,7 +73990,7 @@ function pinsText({ channel, listed }) {
   }
   const lines = listed.pins.map(
     (pin) => `${pin.name}  ${pin.appId}  pinned by ${pin.pinnedByName ?? pin.pinnedBy.id} ${pin.pinnedAt.slice(0, 10)}
-`
+` + readLineOf(pin)
   );
   return `Pinned to ${channel}:
 ${lines.join("")}`;
@@ -74211,6 +74472,85 @@ var appPreview = async ({ context, args }) => {
   print5({ context, args, value: preview, text: `${preview.url}
 ` });
 };
+async function folderClaim({
+  folder,
+  appId
+}) {
+  const entries = await readdir6(folder).catch(() => []);
+  if (entries.length === 0) return "empty";
+  const manifest = await readManifest(folder).catch(() => void 0);
+  if (!manifest) return "other-files";
+  return manifest.app.id === appId ? "same" : "other-app";
+}
+var appPull = async ({ context, args }) => {
+  const client = await appClient({ context, args });
+  const word3 = args.words[2];
+  const appId = await appIdOf({ client, args, folder: folderOf({ context, word: word3 }) });
+  const site = siteOf(args, "published");
+  let pulled;
+  try {
+    pulled = await client.post("/api/apps/pull", { appId, site });
+  } catch (error62) {
+    if (error62 instanceof LazeApiError && error62.code === "app_has_no_version") {
+      throw new CliUsageError(
+        "Nothing is published yet; `laze app pull --site draft` pulls the draft preview (app_has_no_version)"
+      );
+    }
+    throw error62;
+  }
+  const folder = folderOf({
+    context,
+    word: word3 ?? (flagText({ args, name: "app" }) ? pulled.app.slug : void 0)
+  });
+  const claim3 = await folderClaim({ folder, appId: pulled.app.id });
+  if (claim3 === "other-app") {
+    throw new CliUsageError(
+      `${folder} holds another app's ${APP_MANIFEST_FILE}; pull into an empty folder. Nothing was written.`
+    );
+  }
+  if (claim3 === "other-files" && !args.flags.force) {
+    throw new CliUsageError(
+      `${folder} already holds files that are not this app's; pull into an empty folder, or pass --force. Nothing was written.`
+    );
+  }
+  for (const file3 of pulled.files) {
+    const target = join17(folder, ...file3.path.split("/"));
+    await mkdir15(dirname15(target), { recursive: true });
+    await writeFile16(
+      target,
+      file3.encoding === "base64" ? Buffer.from(file3.content, "base64") : file3.content
+    );
+  }
+  const manifest = {
+    app: pulled.app,
+    collections: Object.fromEntries(
+      pulled.collections.map((collection) => [
+        collection.name,
+        {
+          fields: collection.schema.fields,
+          ...collection.schema.rules ? { rules: collection.schema.rules } : {}
+        }
+      ])
+    )
+  };
+  await writeFile16(join17(folder, APP_MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
+`);
+  const names = pulled.collections.map((collection) => collection.name);
+  const where = relative3(context.cwd, folder) || ".";
+  print5({
+    context,
+    args,
+    value: { ...pulled, folder },
+    text: `Pulled ${pulled.files.length} files of ${pulled.app.name} (${site} version ${pulled.version.slice(0, 7)}) into ${where}
+` + recordsHint({ names, slug: pulled.app.slug })
+  });
+};
+function recordsHint({ names, slug }) {
+  if (names.length === 0) return "It keeps no records.\n";
+  const which = names.length === 1 ? names[0] : `<${names.join("|")}>`;
+  return `Its data: laze app records list ${which} --app ${slug}
+`;
+}
 var appPublish = async ({ context, args }) => {
   const client = await appClient({ context, args });
   const appId = await appIdOf({ client, args, folder: folderOf({ context, word: void 0 }) });
@@ -74661,6 +75001,40 @@ var ACCESS_ACTIONS = {
   approve: ({ client, appId, first, second }) => decideAsk({ client, appId, requestId: first, decision: "granted", role: second }),
   decline: ({ client, appId, first }) => decideAsk({ client, appId, requestId: first, decision: "declined", role: void 0 })
 };
+function sourceText(source) {
+  switch (source.kind) {
+    case "owner":
+      return "Owner";
+    case "admin":
+      return "Workspace admin";
+    case "direct":
+      return "Shared directly";
+    case "channel":
+      return `via #${source.channelName ?? source.channelId}`;
+    case "workspace":
+      return "Everyone in the workspace";
+    case "agent-owner":
+      return `through its owner ${source.ownerName ?? ""}`.trim();
+  }
+}
+var appMembers = async ({ context, args }) => {
+  const { client, appId, name: name2 } = await appOfWord({ context, args, word: args.words[2] });
+  const listed = await client.post("/api/apps/members", { appId });
+  const lines = listed.members.map(
+    (member) => `${member.name}	${member.member.type === "user" ? "person" : "agent"}	${member.role}	${member.sources.map(sourceText).join(", ")}
+`
+  );
+  const viaChannel = listed.members.some(
+    (member) => !member.removable && member.sources.some((source) => source.kind === "channel")
+  );
+  print5({
+    context,
+    args,
+    value: listed,
+    text: `${name2}: ${listed.members.length} with access
+${lines.join("")}` + (viaChannel ? "Access via a channel follows the channel: unpin the app there (laze app unpin --channel <c>) to take it away.\n" : "")
+  });
+};
 var appAccess = async ({ context, args }) => {
   const client = await appClient({ context, args });
   const appId = await appIdOf({ client, args, folder: folderOf({ context, word: void 0 }) });
@@ -74753,10 +75127,12 @@ var APP_COMMANDS = {
   list: appList,
   push: appPush,
   preview: appPreview,
+  pull: appPull,
   publish: appPublish,
   "make-internal": appMakeInternal,
   unpublish: appUnpublish,
   access: appAccess,
+  members: appMembers,
   name: appName,
   versions: appVersions,
   log: appVersions,
@@ -75969,15 +76345,19 @@ async function channelInfo({ context, args }) {
   const own2 = profile.kind === "agent" ? (await client.get("/api/agents/me/channels")).find(
     (each) => each.id === detail.id
   ) ?? null : null;
+  const pinned = await client.post("/api/apps/pins", { channel: detail.id }).catch(() => null);
   if (args.flags.json) {
-    return context.out(`${JSON.stringify({ ...detail, setting: own2 }, null, 2)}
-`);
+    return context.out(
+      `${JSON.stringify({ ...detail, setting: own2, pins: pinned?.pins ?? [] }, null, 2)}
+`
+    );
   }
   const topic = detail.topic ? `Topic: ${detail.topic}
 ` : "";
   const setting = own2 ? `Your setting here: ${settingTextOf({ channel: own2 })}
 ` : "";
-  context.out(`${topic}${formatMembers({ detail })}${setting}`);
+  const tabs = pinned?.pins.length ? pinsText({ channel, listed: pinned }) : "";
+  context.out(`${topic}${formatMembers({ detail })}${setting}${tabs}`);
 }
 async function channelRole({
   context,
@@ -78832,11 +79212,11 @@ async function connect({
 }
 
 // src/services/connector-commands.service.ts
-import { readFile as readFile23 } from "node:fs/promises";
+import { readFile as readFile24 } from "node:fs/promises";
 import { resolve as resolve8 } from "node:path";
 
 // src/services/vault-keychain-commands.service.ts
-import { readFile as readFile22 } from "node:fs/promises";
+import { readFile as readFile23 } from "node:fs/promises";
 
 // src/rules/vault-input.rules.ts
 function secondsOf(text2) {
@@ -79107,6 +79487,298 @@ var listDevices = async ({ context, args }) => {
   }
 };
 
+// src/services/vault-commands.service.ts
+import { createHash as createHash2 } from "node:crypto";
+import { mkdir as mkdir17, readFile as readFile22, rm as rm10, writeFile as writeFile18 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname17, join as join19 } from "node:path";
+var USAGE8 = `Usage: laze vault run <connection> --reason "<one plain sentence>" [--wait <s>] -- <command> [args...]
+Runs the command with the connection's values in its environment, on a Laze agent's computer
+or on a machine it runs on.`;
+var POLL_MS2 = 3e3;
+var RESTART_WAIT_MS = 12e4;
+var RESTART_BACKOFF_MS = [1e3, 2e3, 4e3, 8e3, 1e4];
+var P2562 = { name: "ECDH", namedCurve: "P-256" };
+var ServerGoneError = class extends Error {
+};
+function proxyOf({ env }) {
+  const raw = env.LAZE_VAULT_PROXY || env.HTTP_PROXY || env.http_proxy;
+  if (!raw) {
+    throw new CliUsageError(
+      "laze vault run works only on a Laze agent's computer or on a machine it runs on"
+    );
+  }
+  const url2 = new URL(raw);
+  const user = decodeURIComponent(url2.username);
+  const password = decodeURIComponent(url2.password);
+  return {
+    origin: url2.origin,
+    authorization: `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`
+  };
+}
+function turnFileOf({
+  env
+}) {
+  return env.LAZE_TURN_FILE || void 0;
+}
+async function turnTokenOf3({
+  env,
+  turnFile,
+  command = "laze vault run"
+}) {
+  const pinned = env.LAZE_TURN_TOKEN?.trim();
+  if (pinned) return pinned;
+  if (!turnFile) throw new CliUsageError(`${command} works only during an agent's turn`);
+  try {
+    return (await readFile22(turnFile, "utf8")).trim();
+  } catch {
+    throw new CliUsageError(`${command} works only during an agent's turn`);
+  }
+}
+function runKeyPathOf({
+  turnFile,
+  connection
+}) {
+  const name2 = createHash2("sha256").update(connection).digest("hex");
+  const base = turnFile ? dirname17(turnFile) : join19(tmpdir2(), "laze-vault");
+  return join19(base, "vault-run-keys", `${name2}.json`);
+}
+async function runKeyAt({ path }) {
+  const saved3 = await readFile22(path, "utf8").then(
+    (text2) => JSON.parse(text2),
+    () => void 0
+  );
+  if (saved3 && typeof saved3.publicKey === "string" && saved3.privateKey) {
+    const privateKey = await globalThis.crypto.subtle.importKey("jwk", saved3.privateKey, P2562, false, ["deriveBits"]).catch(() => void 0);
+    if (privateKey) return { privateKey, publicKey: saved3.publicKey };
+  }
+  const fresh = await generateEcdhKeys();
+  const jwk = await globalThis.crypto.subtle.exportKey("jwk", fresh.privateKey);
+  await mkdir17(dirname17(path), { recursive: true, mode: 448 });
+  await writeFile18(path, JSON.stringify({ publicKey: fresh.publicKey, privateKey: jwk }), {
+    mode: 384
+  });
+  return fresh;
+}
+function connectionRefused(error62) {
+  const cause = error62.cause;
+  if (cause?.code === "ECONNREFUSED") return true;
+  return cause?.errors?.some((inner) => inner.code === "ECONNREFUSED") ?? false;
+}
+async function sendOnce({
+  context,
+  url: url2,
+  init
+}) {
+  let response;
+  try {
+    response = await context.fetcher(url2, init);
+  } catch (error62) {
+    const wasRefused = connectionRefused(error62);
+    if (init.method === "POST" && !wasRefused) throw error62;
+    return { restarting: wasRefused ? "connection refused" : String(error62) };
+  }
+  if (response.status !== 502 && response.status !== 503) return { response };
+  const code = codeOf(await response.clone().text());
+  const neverReached = response.status === 503 && code === "vault_not_answering";
+  if (init.method === "POST" && !neverReached) return { response };
+  return { restarting: `status ${response.status}${code ? ` ${code}` : ""}` };
+}
+async function reach(input2) {
+  const { context } = input2;
+  const started = context.nowMs();
+  for (let attempt = 0; ; attempt += 1) {
+    const sent = await sendOnce(input2);
+    if ("response" in sent) return sent.response;
+    if (context.nowMs() - started >= RESTART_WAIT_MS) {
+      throw new ServerGoneError(
+        `laze vault: the Laze server did not come back (${sent.restarting})`
+      );
+    }
+    if (attempt === 0) {
+      context.err(
+        `laze vault: the Laze server is not answering (${sent.restarting}), probably restarting; waiting up to 2 min...
+`
+      );
+    }
+    await context.sleep(RESTART_BACKOFF_MS[Math.min(attempt, RESTART_BACKOFF_MS.length - 1)] ?? 0);
+  }
+}
+function codeOf(text2) {
+  return /"code"\s*:\s*"([^"]+)"/.exec(text2)?.[1];
+}
+async function releaseOf({ response }) {
+  const text2 = await response.text();
+  if (!response.ok) {
+    return {
+      outcome: "deny",
+      exitCode: 1,
+      message: `laze vault: the release was refused (${codeOf(text2) ?? `status ${response.status}`})`
+    };
+  }
+  return JSON.parse(text2);
+}
+async function envOf({
+  release: release2,
+  run: run4
+}) {
+  if (!release2.sealed) return release2.env;
+  const sealed = await openRunRelease({
+    release: release2.sealed,
+    runPrivateKey: run4.privateKey,
+    runPublicKey: run4.publicKey,
+    requestId: release2.sealed.requestId
+  });
+  return { ...release2.env, ...sealed };
+}
+function deadlineOf({ args, nowMs }) {
+  const wait = flagText({ args, name: "wait" }) || (args.flags.wait === true ? args.words[3] : "");
+  if (!wait) return Infinity;
+  if (!(Number(wait) >= 0)) throw new CliUsageError(`--wait takes a number of seconds
+${USAGE8}`);
+  return nowMs + Number(wait) * 1e3;
+}
+async function untilAnswered({
+  context,
+  first,
+  origin,
+  headers,
+  deadline
+}) {
+  let release2 = first;
+  while (release2.outcome === "ask") {
+    if (context.nowMs() + POLL_MS2 > deadline) {
+      context.err(`${release2.message}. Not approved yet; ask again later.
+`);
+      return "capped";
+    }
+    if (release2 === first) {
+      context.err(`${release2.message}. Waiting for an answer (cards expire after 12 hours)...
+`);
+    }
+    await context.sleep(POLL_MS2);
+    const url2 = `${origin}/vault/release/${encodeURIComponent(release2.requestId)}`;
+    release2 = await releaseOf({
+      response: await reach({ context, url: url2, init: { method: "GET", headers } })
+    });
+  }
+  return release2;
+}
+async function vaultRelease({
+  context,
+  args,
+  connection,
+  reason,
+  command
+}) {
+  const deadline = deadlineOf({ args, nowMs: context.nowMs() });
+  const env = context.environment.inherited;
+  const proxy = proxyOf({ env });
+  const turnFile = turnFileOf({ env });
+  const headers = {
+    "proxy-authorization": proxy.authorization,
+    "x-laze-turn": await turnTokenOf3({ env, turnFile })
+  };
+  const keyPath = runKeyPathOf({ turnFile, connection });
+  const run4 = await runKeyAt({ path: keyPath });
+  const body = JSON.stringify({ connection, reason, command, recipient: run4.publicKey });
+  let release2;
+  try {
+    const first = await releaseOf({
+      response: await reach({
+        context,
+        url: `${proxy.origin}/vault/release`,
+        init: { method: "POST", headers: { ...headers, "content-type": "application/json" }, body }
+      })
+    });
+    release2 = await untilAnswered({ context, first, origin: proxy.origin, headers, deadline });
+  } catch (error62) {
+    if (!(error62 instanceof ServerGoneError)) throw error62;
+    context.err(`${error62.message}. Run the command again to keep waiting.
+`);
+    return { exitCode: 75 };
+  }
+  if (release2 === "capped") return { exitCode: 75 };
+  if (release2.outcome === "deny") {
+    await rm10(keyPath, { force: true });
+    context.err(`${release2.message}
+`);
+    return { exitCode: release2.exitCode || 1 };
+  }
+  const values = await envOf({ release: release2, run: run4 });
+  await rm10(keyPath, { force: true });
+  if (release2.message) context.err(`${release2.message}
+`);
+  return { env: values };
+}
+async function vaultRun({
+  context,
+  args
+}) {
+  const connection = args.words[2];
+  const reason = flagText({ args, name: "reason" });
+  if (!connection || args.rest.length === 0) throw new CliUsageError(USAGE8);
+  if (!reason) throw new CliUsageError(`Say why with --reason "<one plain sentence>"
+${USAGE8}`);
+  const released = await vaultRelease({ context, args, connection, reason, command: args.rest });
+  if ("exitCode" in released) return released.exitCode;
+  return context.runCommand({ command: args.rest, env: released.env });
+}
+
+// src/services/vault-share-commands.service.ts
+var SHARE_USAGE2 = "Usage: laze vault share <connection> --with <email|userId> [--for 1h]";
+var WAITING_LINE = "It waits for the owner's approval with a passkey or Face ID, in Settings > Vault.";
+async function personOf({ client, who }) {
+  const members3 = await client.get("/api/workspaces/current/members");
+  const wanted = who.toLowerCase();
+  const found = members3.find(
+    (member) => member.userId === who || member.email.toLowerCase() === wanted
+  );
+  if (!found) throw new CliUsageError(`No one in this workspace is ${who}.`);
+  return found.userId;
+}
+async function inTurn({
+  context,
+  client,
+  command
+}) {
+  const env = context.environment.inherited;
+  const turn = await turnTokenOf3({ env, turnFile: turnFileOf({ env }), command });
+  return client.withHeaders({ "x-laze-turn": turn });
+}
+function printShare({ context, grant }) {
+  printGrant({ context, grant });
+  if (grant.awaitingOwner) context.out(`${WAITING_LINE}
+`);
+}
+var shareWith = async ({ context, args }) => {
+  const word3 = args.words[2];
+  const who = flagText({ args, name: "with" });
+  if (!word3 || !who) throw new CliUsageError(SHARE_USAGE2);
+  const { client, profile } = await signedIn({ context, args });
+  const userId = await personOf({ client, who });
+  const grant = profile.kind === "agent" ? await (await inTurn({ context, client, command: "laze vault share" })).post("/api/vault/turn/share", {
+    connection: word3,
+    userId,
+    ...durationOf(args)
+  }) : await client.post("/api/vault/shares", {
+    connectionId: (await connectionOf({ client, args, word: word3 })).id,
+    userId,
+    ...durationOf(args)
+  });
+  if (args.flags.json) return printJson4({ context, data: grant });
+  printShare({ context, grant });
+};
+async function setLevelInTurn({
+  context,
+  client,
+  connection,
+  sensitivity
+}) {
+  const turned = await inTurn({ context, client, command: "laze vault update --level" });
+  return turned.post("/api/vault/turn/level", { connection, sensitivity });
+}
+
 // src/services/vault-keychain-commands.service.ts
 var VAULT_USAGE = `Usage (your own key; an agent's key is refused, values are never printed):
   laze vault list [--json]                          connections you manage or see: names, fields, levels
@@ -79125,6 +79797,9 @@ var VAULT_USAGE = `Usage (your own key; an agent's key is refused, values are ne
   laze vault rm|revoke <connection>                 delete it; revoke also takes it back at the provider
   laze vault uses <connection> [--limit <n>]        who used it, how, where, under which approval
   laze vault grant <connection> --to person|group|channel|agent:<id> [--for 1h]
+  laze vault share <connection> --with <email|userId> [--for 1h]   your own key, with one teammate:
+      it waits for your passkey in Settings > Vault; Always ask and Human only keys are shared
+      only from there. Lowering a key's level is done only there too; raising works anywhere
   laze vault lend <connection> --channel <channelId> [--for 1h]
   laze vault grants <connection> | laze vault ungrant <grantId>
   laze vault leases | laze vault end-lease <leaseId>
@@ -79158,7 +79833,7 @@ async function secretText({ context, args }) {
     );
   }
   const file3 = flagText({ args, name: "from-file" });
-  const text2 = file3 ? await readFile22(file3, "utf8") : await context.readStdin();
+  const text2 = file3 ? await readFile23(file3, "utf8") : await context.readStdin();
   const trimmed = text2.replace(/\r?\n$/, "");
   if (!trimmed.trim()) throw new CliUsageError("No value: pipe it on stdin or use --from-file.");
   return trimmed;
@@ -79217,10 +79892,21 @@ var add3 = async ({ context, args }) => {
   );
 };
 var update = async ({ context, args }) => {
-  const { client } = await signedIn({ context, args });
-  const target = await connectionOf({ client, args, word: args.words[2] });
+  const { client, profile } = await signedIn({ context, args });
   const settings2 = settingsOf(args);
   if (Object.keys(settings2).length === 0) throw new CliUsageError(VAULT_USAGE);
+  const word3 = args.words[2];
+  if (profile.kind === "agent" && word3 && settings2.sensitivity && Object.keys(settings2).length === 1) {
+    const raised = await setLevelInTurn({
+      context,
+      client,
+      connection: word3,
+      sensitivity: settings2.sensitivity
+    });
+    if (args.flags.json) return printJson4({ context, data: raised });
+    return printConnection({ context, row: raised });
+  }
+  const target = await connectionOf({ client, args, word: word3 });
   const updated = await client.post("/api/vault/connections/update", {
     connectionId: target.id,
     ...settings2
@@ -79312,6 +79998,7 @@ var VAULT_COMMANDS = {
   revoke: removal("revoke"),
   uses,
   grant: grantTo,
+  share: shareWith,
   lend: lendTo,
   grants: grantsOf,
   ungrant: revokeGrant,
@@ -79368,7 +80055,7 @@ async function keyText({ context, args }) {
     throw new CliUsageError("A key never goes in a flag: pipe it on stdin or use --from-file.");
   }
   const file3 = flagText({ args, name: "from-file" });
-  const text2 = file3 ? await readFile23(resolve8(context.cwd, file3), "utf8") : await context.readStdin();
+  const text2 = file3 ? await readFile24(resolve8(context.cwd, file3), "utf8") : await context.readStdin();
   const trimmed = text2.trim();
   if (!trimmed) throw new CliUsageError("No key: pipe it on stdin or use --from-file.");
   return trimmed;
@@ -79732,16 +80419,16 @@ function dndLine({ pausedUntil }) {
 }
 
 // src/services/dnd-commands.service.ts
-var USAGE8 = "Usage: laze dnd 30m|1h|2h|until <HH:mm|ISO time> [--tz <zone>], laze dnd off";
+var USAGE9 = "Usage: laze dnd 30m|1h|2h|until <HH:mm|ISO time> [--tz <zone>], laze dnd off";
 async function dnd({ context, args }) {
   const timeZone = flagText({ args, name: "tz" }) || Intl.DateTimeFormat().resolvedOptions().timeZone;
   let input2;
   try {
     input2 = dndInputOf({ words: args.words.slice(1), now: nowInstant(), timeZone });
   } catch {
-    throw new CliUsageError(USAGE8);
+    throw new CliUsageError(USAGE9);
   }
-  if (!input2) throw new CliUsageError(USAGE8);
+  if (!input2) throw new CliUsageError(USAGE9);
   const { client } = await signedIn({ context, args });
   const settings2 = await client.post(
     "/api/agents/me/notifications/snooze",
@@ -79793,7 +80480,7 @@ async function domains({ context, args }) {
 }
 
 // src/services/feed-commands.service.ts
-import { readFile as readFile25 } from "node:fs/promises";
+import { readFile as readFile26 } from "node:fs/promises";
 import { resolve as resolve10 } from "node:path";
 
 // src/rules/feed-input.rules.ts
@@ -79918,7 +80605,7 @@ function feedFlagsOf({ args }) {
 }
 
 // src/services/feed-files.service.ts
-import { readFile as readFile24 } from "node:fs/promises";
+import { readFile as readFile25 } from "node:fs/promises";
 import { basename as basename4, resolve as resolve9 } from "node:path";
 
 // ../../modules/feed/contract/src/feed.ts
@@ -80493,7 +81180,7 @@ async function local({ context, path }) {
   return {
     fileName,
     contentType: contentTypeOf(fileName),
-    bytes: new Uint8Array(await readFile24(full))
+    bytes: new Uint8Array(await readFile25(full))
   };
 }
 async function directWith({ client, to }) {
@@ -80531,7 +81218,7 @@ async function feedAttachmentIdsOf({
 }
 
 // src/services/feed-commands.service.ts
-var USAGE9 = `Usage:
+var USAGE10 = `Usage:
   laze feed post <title> [--channel <channel>] [--tag <tag>] [--summary <line>]
     [--draft <text|@file>] [--draft-header "To: ...\\nRe: ..."]
     [--metric <json|@file.json> | --table <csv|@file.csv>]
@@ -80571,7 +81258,7 @@ async function bodyOf2({
   flags: flags2
 }) {
   const body = { ...flags2.fields };
-  const read3 = (source) => "file" in source ? readFile25(resolve10(context.cwd, source.file), "utf8") : source.text;
+  const read3 = (source) => "file" in source ? readFile26(resolve10(context.cwd, source.file), "utf8") : source.text;
   for (const [field, source] of Object.entries(flags2.texts)) body[field] = await read3(source);
   if (flags2.rich) {
     const text2 = await read3(flags2.rich.source);
@@ -80600,7 +81287,7 @@ function printItem({
 }
 async function feedPost({ context, args }) {
   const title = args.words.slice(2).join(" ").trim();
-  if (!title) throw new CliUsageError(USAGE9);
+  if (!title) throw new CliUsageError(USAGE10);
   const flags2 = flagsOf(args);
   const { client } = await signedIn({ context, args });
   const channel = flagText({ args, name: "channel" });
@@ -80622,7 +81309,7 @@ async function feedPost({ context, args }) {
 }
 async function feedUpdate({ context, args }) {
   const itemId = args.words[2];
-  if (!itemId) throw new CliUsageError(USAGE9);
+  if (!itemId) throw new CliUsageError(USAGE10);
   const flags2 = flagsOf(args);
   const { client } = await signedIn({ context, args });
   const body = await bodyOf2({ context, flags: flags2 });
@@ -80638,7 +81325,7 @@ async function feedUpdate({ context, args }) {
 async function feedReply({ context, args }) {
   const itemId = args.words[2];
   const text2 = args.words.slice(3).join(" ").trim();
-  if (!itemId || !text2) throw new CliUsageError(USAGE9);
+  if (!itemId || !text2) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const replied = await client.post("/api/feed/items/reply", {
     itemId,
@@ -80650,7 +81337,7 @@ async function feedReply({ context, args }) {
 }
 async function feedRead({ context, args }) {
   const itemId = args.words[2];
-  if (!itemId) throw new CliUsageError(USAGE9);
+  if (!itemId) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const read3 = await client.post("/api/feed/items/read", { itemId });
   printItem({ context, args, item: read3 });
@@ -80669,7 +81356,7 @@ async function feedClose({ context, args }) {
   const itemId = args.words[2];
   const loop = flagText({ args, name: "loop" });
   const note = flagText({ args, name: "note" });
-  if (!note || Boolean(itemId) === Boolean(loop)) throw new CliUsageError(USAGE9);
+  if (!note || Boolean(itemId) === Boolean(loop)) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const closed = await client.post("/api/feed/items/close", {
     ...itemId ? { itemId } : { loop },
@@ -80695,7 +81382,7 @@ async function feedLoops({ context, args }) {
 }
 async function feedGroupSummary({ context, args }) {
   const group = args.words.slice(2).join(" ").trim();
-  if (!group) throw new CliUsageError(USAGE9);
+  if (!group) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const pointer = await client.post("/api/feed/group-summary", { group });
   if (args.flags.json) return context.out(`${JSON.stringify(pointer, null, 2)}
@@ -80733,7 +81420,7 @@ async function textFlag({
 }) {
   const value = flagText({ args, name: name2 });
   if (!value.startsWith("@")) return value;
-  return readFile25(resolve10(context.cwd, value.slice(1)), "utf8");
+  return readFile26(resolve10(context.cwd, value.slice(1)), "utf8");
 }
 async function feedList({ context, args }) {
   const { client } = await signedIn({ context, args });
@@ -80765,7 +81452,7 @@ async function feedCount({ context, args }) {
 }
 async function feedAct({ context, args }) {
   const [itemId, actionId] = [args.words[2], args.words[3]];
-  if (!itemId || !actionId) throw new CliUsageError(USAGE9);
+  if (!itemId || !actionId) throw new CliUsageError(USAGE10);
   const draft = await textFlag({ context, args, name: "draft" });
   const { client } = await signedIn({ context, args });
   const item = await client.post("/api/feed/mine/act", {
@@ -80778,7 +81465,7 @@ async function feedAct({ context, args }) {
 async function feedComment({ context, args }) {
   const itemId = args.words[2];
   const text2 = args.words.slice(3).join(" ").trim();
-  if (!itemId || !text2) throw new CliUsageError(USAGE9);
+  if (!itemId || !text2) throw new CliUsageError(USAGE10);
   const draft = await textFlag({ context, args, name: "draft" });
   const { client } = await signedIn({ context, args });
   const item = await client.post("/api/feed/mine/comment", {
@@ -80792,7 +81479,7 @@ async function feedComment({ context, args }) {
 function moveItem(path) {
   return async ({ context, args }) => {
     const itemId = args.words[2];
-    if (!itemId) throw new CliUsageError(USAGE9);
+    if (!itemId) throw new CliUsageError(USAGE10);
     const { client } = await signedIn({ context, args });
     const item = await client.post(`/api/feed/mine/${path}`, { itemId });
     printMoved({ context, args, item });
@@ -80801,14 +81488,14 @@ function moveItem(path) {
 async function feedSnooze({ context, args }) {
   const itemId = args.words[2];
   const until = flagText({ args, name: "until" });
-  if (!itemId || !until) throw new CliUsageError(USAGE9);
+  if (!itemId || !until) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const item = await client.post("/api/feed/mine/snooze", { itemId, until });
   printMoved({ context, args, item });
 }
 async function feedChannel({ context, args }) {
   const channelId = args.words[2];
-  if (!channelId) throw new CliUsageError(USAGE9);
+  if (!channelId) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const items = await client.post("/api/feed/channel", { channelId });
   if (args.flags.json) return context.out(`${JSON.stringify(items, null, 2)}
@@ -80838,12 +81525,12 @@ var FEED_COMMANDS = {
 async function feed({ context, args }) {
   const name2 = args.words[1] ?? "";
   const command = Object.hasOwn(FEED_COMMANDS, name2) ? FEED_COMMANDS[name2] : void 0;
-  if (!command) throw new CliUsageError(USAGE9);
+  if (!command) throw new CliUsageError(USAGE10);
   await command({ context, args });
 }
 
 // src/services/github-commands.service.ts
-import { readFile as readFile26 } from "node:fs/promises";
+import { readFile as readFile27 } from "node:fs/promises";
 
 // src/rules/github-signature.rules.ts
 var TURN_SEPARATOR = "~";
@@ -80913,7 +81600,7 @@ var REAL_GH = "/usr/bin/gh";
 var NOT_SET = "laze: agent_github_not_set: this agent has no GitHub connection. Its owner sets one on the agent's settings page or with `laze agent set-github <agent> <connection>`.";
 async function turnFileToken({ env }) {
   if (!env.LAZE_TURN_FILE) return "";
-  return readFile26(env.LAZE_TURN_FILE, "utf8").then(
+  return readFile27(env.LAZE_TURN_FILE, "utf8").then(
     (text2) => text2.trim(),
     () => ""
   );
@@ -80947,7 +81634,7 @@ async function githubGh({
     args: args.rest,
     agentName: profile.name ?? "An agent",
     threadUrl: threadUrlOf({ env, workspaceId: profile.workspaceId }),
-    readBodyFile: (path) => path === "-" ? context.readStdin() : readFile26(path, "utf8")
+    readBodyFile: (path) => path === "-" ? context.readStdin() : readFile27(path, "utf8")
   });
   return context.runCommand({
     command: [REAL_GH, ...ghArgs],
@@ -81046,7 +81733,7 @@ async function setAgentGithub({
 }
 
 // src/services/history-commands.service.ts
-import { readFile as readFile27 } from "node:fs/promises";
+import { readFile as readFile28 } from "node:fs/promises";
 
 // src/rules/history-format.rules.ts
 function timeOf2(iso) {
@@ -81137,12 +81824,12 @@ function beforeOf({ args }) {
     throw new CliUsageError(HISTORY_USAGE);
   }
 }
-async function turnTokenOf3({ context }) {
+async function turnTokenOf4({ context }) {
   const env = context.environment.inherited;
   const pinned = env.LAZE_TURN_TOKEN?.trim();
   if (pinned) return pinned;
   if (!env.LAZE_TURN_FILE) return "";
-  return readFile27(env.LAZE_TURN_FILE, "utf8").then(
+  return readFile28(env.LAZE_TURN_FILE, "utf8").then(
     (text2) => text2.trim(),
     () => ""
   );
@@ -81156,7 +81843,7 @@ async function history({
   const limit = limitOf3({ args });
   const before = beforeOf({ args });
   const { client: signed2 } = await signedIn({ context, args });
-  const turn = await turnTokenOf3({ context });
+  const turn = await turnTokenOf4({ context });
   const client = turn ? signed2.withHeaders({ "x-laze-turn": turn }) : signed2;
   const laze = await client.post("/api/agents/me/history", {
     channel,
@@ -81334,19 +82021,19 @@ async function ip({ context, args }) {
 }
 
 // src/services/join-commands.service.ts
-import { mkdir as mkdir17, readFile as readFile28, rename as rename5, rm as rm10, writeFile as writeFile18 } from "node:fs/promises";
-import { dirname as dirname17, join as join19 } from "node:path";
+import { mkdir as mkdir18, readFile as readFile29, rename as rename5, rm as rm11, writeFile as writeFile19 } from "node:fs/promises";
+import { dirname as dirname18, join as join20 } from "node:path";
 var DEFAULT_WAIT_SECONDS2 = 100;
 var JOIN_USAGE = "Usage: laze join [--workspace <name|id|invite link>] [--for <email>] [--name <name>] [--note <text>] [--timeout <seconds>] [--project <folder>]";
 function pendingPathOf({ context }) {
-  return join19(dirname17(context.environment.configPath), "join", "pending.json");
+  return join20(dirname18(context.environment.configPath), "join", "pending.json");
 }
 async function readPending({
   context,
   url: url2,
   args
 }) {
-  const pending = await readFile28(pendingPathOf({ context }), "utf8").then(
+  const pending = await readFile29(pendingPathOf({ context }), "utf8").then(
     (text2) => JSON.parse(text2),
     () => void 0
   );
@@ -81356,13 +82043,13 @@ async function readPending({
 }
 async function keepPending({ context, pending }) {
   const path = pendingPathOf({ context });
-  await mkdir17(dirname17(path), { recursive: true, mode: 448 });
+  await mkdir18(dirname18(path), { recursive: true, mode: 448 });
   const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile18(temporary, JSON.stringify(pending), { mode: 384 });
+  await writeFile19(temporary, JSON.stringify(pending), { mode: 384 });
   await rename5(temporary, path);
 }
 async function dropPending({ context }) {
-  await rm10(pendingPathOf({ context }), { force: true });
+  await rm11(pendingPathOf({ context }), { force: true });
 }
 function waitSecondsOf3({ args }) {
   const raw = flagText({ args, name: "timeout" });
@@ -81674,244 +82361,6 @@ function machineAccessCommand(name2) {
   return name2 && Object.hasOwn(COMMANDS, name2) ? COMMANDS[name2] : void 0;
 }
 
-// src/services/vault-commands.service.ts
-import { createHash as createHash2 } from "node:crypto";
-import { mkdir as mkdir18, readFile as readFile29, rm as rm11, writeFile as writeFile19 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname18, join as join20 } from "node:path";
-var USAGE10 = `Usage: laze vault run <connection> --reason "<one plain sentence>" [--wait <s>] -- <command> [args...]
-Runs the command with the connection's values in its environment, on a Laze agent's computer
-or on a machine it runs on.`;
-var POLL_MS2 = 3e3;
-var RESTART_WAIT_MS = 12e4;
-var RESTART_BACKOFF_MS = [1e3, 2e3, 4e3, 8e3, 1e4];
-var P2562 = { name: "ECDH", namedCurve: "P-256" };
-var ServerGoneError = class extends Error {
-};
-function proxyOf({ env }) {
-  const raw = env.LAZE_VAULT_PROXY || env.HTTP_PROXY || env.http_proxy;
-  if (!raw) {
-    throw new CliUsageError(
-      "laze vault run works only on a Laze agent's computer or on a machine it runs on"
-    );
-  }
-  const url2 = new URL(raw);
-  const user = decodeURIComponent(url2.username);
-  const password = decodeURIComponent(url2.password);
-  return {
-    origin: url2.origin,
-    authorization: `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`
-  };
-}
-function turnFileOf({
-  env
-}) {
-  return env.LAZE_TURN_FILE || void 0;
-}
-async function turnTokenOf4({
-  env,
-  turnFile,
-  command = "laze vault run"
-}) {
-  const pinned = env.LAZE_TURN_TOKEN?.trim();
-  if (pinned) return pinned;
-  if (!turnFile) throw new CliUsageError(`${command} works only during an agent's turn`);
-  try {
-    return (await readFile29(turnFile, "utf8")).trim();
-  } catch {
-    throw new CliUsageError(`${command} works only during an agent's turn`);
-  }
-}
-function runKeyPathOf({
-  turnFile,
-  connection
-}) {
-  const name2 = createHash2("sha256").update(connection).digest("hex");
-  const base = turnFile ? dirname18(turnFile) : join20(tmpdir2(), "laze-vault");
-  return join20(base, "vault-run-keys", `${name2}.json`);
-}
-async function runKeyAt({ path }) {
-  const saved3 = await readFile29(path, "utf8").then(
-    (text2) => JSON.parse(text2),
-    () => void 0
-  );
-  if (saved3 && typeof saved3.publicKey === "string" && saved3.privateKey) {
-    const privateKey = await globalThis.crypto.subtle.importKey("jwk", saved3.privateKey, P2562, false, ["deriveBits"]).catch(() => void 0);
-    if (privateKey) return { privateKey, publicKey: saved3.publicKey };
-  }
-  const fresh = await generateEcdhKeys();
-  const jwk = await globalThis.crypto.subtle.exportKey("jwk", fresh.privateKey);
-  await mkdir18(dirname18(path), { recursive: true, mode: 448 });
-  await writeFile19(path, JSON.stringify({ publicKey: fresh.publicKey, privateKey: jwk }), {
-    mode: 384
-  });
-  return fresh;
-}
-function connectionRefused(error62) {
-  const cause = error62.cause;
-  if (cause?.code === "ECONNREFUSED") return true;
-  return cause?.errors?.some((inner) => inner.code === "ECONNREFUSED") ?? false;
-}
-async function sendOnce({
-  context,
-  url: url2,
-  init
-}) {
-  let response;
-  try {
-    response = await context.fetcher(url2, init);
-  } catch (error62) {
-    const wasRefused = connectionRefused(error62);
-    if (init.method === "POST" && !wasRefused) throw error62;
-    return { restarting: wasRefused ? "connection refused" : String(error62) };
-  }
-  if (response.status !== 502 && response.status !== 503) return { response };
-  const code = codeOf(await response.clone().text());
-  const neverReached = response.status === 503 && code === "vault_not_answering";
-  if (init.method === "POST" && !neverReached) return { response };
-  return { restarting: `status ${response.status}${code ? ` ${code}` : ""}` };
-}
-async function reach(input2) {
-  const { context } = input2;
-  const started = context.nowMs();
-  for (let attempt = 0; ; attempt += 1) {
-    const sent = await sendOnce(input2);
-    if ("response" in sent) return sent.response;
-    if (context.nowMs() - started >= RESTART_WAIT_MS) {
-      throw new ServerGoneError(
-        `laze vault: the Laze server did not come back (${sent.restarting})`
-      );
-    }
-    if (attempt === 0) {
-      context.err(
-        `laze vault: the Laze server is not answering (${sent.restarting}), probably restarting; waiting up to 2 min...
-`
-      );
-    }
-    await context.sleep(RESTART_BACKOFF_MS[Math.min(attempt, RESTART_BACKOFF_MS.length - 1)] ?? 0);
-  }
-}
-function codeOf(text2) {
-  return /"code"\s*:\s*"([^"]+)"/.exec(text2)?.[1];
-}
-async function releaseOf({ response }) {
-  const text2 = await response.text();
-  if (!response.ok) {
-    return {
-      outcome: "deny",
-      exitCode: 1,
-      message: `laze vault: the release was refused (${codeOf(text2) ?? `status ${response.status}`})`
-    };
-  }
-  return JSON.parse(text2);
-}
-async function envOf({
-  release: release2,
-  run: run4
-}) {
-  if (!release2.sealed) return release2.env;
-  const sealed = await openRunRelease({
-    release: release2.sealed,
-    runPrivateKey: run4.privateKey,
-    runPublicKey: run4.publicKey,
-    requestId: release2.sealed.requestId
-  });
-  return { ...release2.env, ...sealed };
-}
-function deadlineOf({ args, nowMs }) {
-  const wait = flagText({ args, name: "wait" }) || (args.flags.wait === true ? args.words[3] : "");
-  if (!wait) return Infinity;
-  if (!(Number(wait) >= 0)) throw new CliUsageError(`--wait takes a number of seconds
-${USAGE10}`);
-  return nowMs + Number(wait) * 1e3;
-}
-async function untilAnswered({
-  context,
-  first,
-  origin,
-  headers,
-  deadline
-}) {
-  let release2 = first;
-  while (release2.outcome === "ask") {
-    if (context.nowMs() + POLL_MS2 > deadline) {
-      context.err(`${release2.message}. Not approved yet; ask again later.
-`);
-      return "capped";
-    }
-    if (release2 === first) {
-      context.err(`${release2.message}. Waiting for an answer (cards expire after 12 hours)...
-`);
-    }
-    await context.sleep(POLL_MS2);
-    const url2 = `${origin}/vault/release/${encodeURIComponent(release2.requestId)}`;
-    release2 = await releaseOf({
-      response: await reach({ context, url: url2, init: { method: "GET", headers } })
-    });
-  }
-  return release2;
-}
-async function vaultRelease({
-  context,
-  args,
-  connection,
-  reason,
-  command
-}) {
-  const deadline = deadlineOf({ args, nowMs: context.nowMs() });
-  const env = context.environment.inherited;
-  const proxy = proxyOf({ env });
-  const turnFile = turnFileOf({ env });
-  const headers = {
-    "proxy-authorization": proxy.authorization,
-    "x-laze-turn": await turnTokenOf4({ env, turnFile })
-  };
-  const keyPath = runKeyPathOf({ turnFile, connection });
-  const run4 = await runKeyAt({ path: keyPath });
-  const body = JSON.stringify({ connection, reason, command, recipient: run4.publicKey });
-  let release2;
-  try {
-    const first = await releaseOf({
-      response: await reach({
-        context,
-        url: `${proxy.origin}/vault/release`,
-        init: { method: "POST", headers: { ...headers, "content-type": "application/json" }, body }
-      })
-    });
-    release2 = await untilAnswered({ context, first, origin: proxy.origin, headers, deadline });
-  } catch (error62) {
-    if (!(error62 instanceof ServerGoneError)) throw error62;
-    context.err(`${error62.message}. Run the command again to keep waiting.
-`);
-    return { exitCode: 75 };
-  }
-  if (release2 === "capped") return { exitCode: 75 };
-  if (release2.outcome === "deny") {
-    await rm11(keyPath, { force: true });
-    context.err(`${release2.message}
-`);
-    return { exitCode: release2.exitCode || 1 };
-  }
-  const values = await envOf({ release: release2, run: run4 });
-  await rm11(keyPath, { force: true });
-  if (release2.message) context.err(`${release2.message}
-`);
-  return { env: values };
-}
-async function vaultRun({
-  context,
-  args
-}) {
-  const connection = args.words[2];
-  const reason = flagText({ args, name: "reason" });
-  if (!connection || args.rest.length === 0) throw new CliUsageError(USAGE10);
-  if (!reason) throw new CliUsageError(`Say why with --reason "<one plain sentence>"
-${USAGE10}`);
-  const released = await vaultRelease({ context, args, connection, reason, command: args.rest });
-  if ("exitCode" in released) return released.exitCode;
-  return context.runCommand({ command: args.rest, env: released.env });
-}
-
 // src/services/machine-commands.service.ts
 var USAGE11 = [
   "Usage: laze machine connect <name>                       the command to run on your own machine (people)",
@@ -84328,7 +84777,7 @@ async function postInTurn({
   body
 }) {
   const env = context.environment.inherited;
-  const turn = await turnTokenOf4({
+  const turn = await turnTokenOf3({
     env,
     turnFile: turnFileOf({ env }),
     command: "laze vault save"
@@ -85936,7 +86385,7 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze agent create --name <name> [--description <text>] [--harness laze-models|claude-code|codex] [--avatar <file>]
       make an agent for your owner (or for you): personal, opened in their direct messages
       --team makes a team agent; on Claude Code or Codex it needs --pool <pool>, a login pool to draw from
-  laze agent update <agent> [--name] [--description] [--avatar] [--context-window]   change an agent your owner owns
+  laze agent update <agent> [--name] [--description] [--avatar] [--model] [--effort] [--max-context]   change an agent your owner owns
   laze agent archive <agent>                     remove an agent your owner owns; kept 30 days
   laze agent archived                            removed agents you may restore, with the day each goes
   laze agent restore|delete <agent>              bring an archived agent back, or delete it for good now
@@ -85964,7 +86413,7 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze vault scrub [--dry-run]                   move secrets found in messages to the vault now (admins)
   laze vault list|add|update|replace|compare|rm|revoke|uses   your keychains with your own key
       a value comes from stdin or --from-file, never a flag; no command prints a value
-  laze vault grant|lend|grants|ungrant|leases|end-lease|limits|set-limit   sharing, leases, limits
+  laze vault grant|share|lend|grants|ungrant|leases|end-lease|limits|set-limit   sharing, leases, limits
   laze vault audit|activity|most-asked|approvals|judge|devices   what happened (audit: admins)
   laze vault                                     every laze vault command, with its flags
   laze connect suggest <service> --reason "<why>"  a connect card for whoever asked (agents)