@lazehq/cli 0.1.48 → 0.1.50

package/dist/laze.mjs

@@ -18733,7 +18733,7 @@ var require_snapshot_utils = __commonJS({
 var require_snapshot_recorder = __commonJS({
   "../../node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
-    var { writeFile: writeFile23, readFile: readFile40, mkdir: mkdir22 } = __require("node:fs/promises");
+    var { writeFile: writeFile24, readFile: readFile40, mkdir: mkdir23 } = __require("node:fs/promises");
     var { dirname: dirname24, resolve: resolve19 } = __require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
@@ -18980,12 +18980,12 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         const resolvedPath = resolve19(path);
-        await mkdir22(dirname24(resolvedPath), { recursive: true });
+        await mkdir23(dirname24(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
           snapshot
         }));
-        await writeFile23(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
+        await writeFile24(resolvedPath, JSON.stringify(data, null, 2), { flush: true });
       }
       /**
        * Clears all recorded snapshots
@@ -30914,6 +30914,14 @@ function isLazeIdText(text2) {
 var REDACTION_MARKER = "[SECRET]";
 var MAX_SCAN_LENGTH = 25e4;
 var NAME_LOOKBACK = 200;
+var VENDOR_FORMAT_RULE_IDS = /* @__PURE__ */ new Set([
+  "github_token",
+  "provider_api_key",
+  "stripe_secret_key",
+  "slack_token",
+  "google_api_key",
+  "vendor_api_key"
+]);
 function charClasses(value) {
   let lower = 0;
   let upper = 0;
@@ -31482,13 +31490,49 @@ function findSecrets({
   );
 }
 
+// ../../packages/secret-guard/src/detector/one-time-links.ts
+var URL_PATTERN = /https?:\/\/[^\s<>"'`)\]]+/g;
+var ONE_TIME_WORDS = /(?:^|[^a-z])(?:magic|verify|verification|confirm|login|log-in|signin|sign-in|sign_in|auth|2fa|mfa|otp|token|code|reset|invite|passwordless|one-time|onetime|callback)(?:$|[^a-z])/i;
+var KEPT_IN_LINKS = /* @__PURE__ */ new Set([
+  ...VENDOR_FORMAT_RULE_IDS,
+  "aws_access_key_id",
+  "url_credentials",
+  "pem_private_key"
+]);
+function isOneTime(url2) {
+  try {
+    const parsed = new URL(url2);
+    const names = [...parsed.searchParams.keys()].join(" ");
+    return ONE_TIME_WORDS.test(`${parsed.pathname} ${names} ${parsed.hash}`);
+  } catch {
+    return false;
+  }
+}
+function oneTimeLinksIn({ text: text2 }) {
+  return [...text2.matchAll(URL_PATTERN)].flatMap((match) => {
+    const url2 = match[0].replace(/[.,;:!?]+$/, "");
+    return isOneTime(url2) ? [{ url: url2, start: match.index, end: match.index + url2.length }] : [];
+  });
+}
+function withoutOneTimeLinkTokens({
+  text: text2,
+  secrets
+}) {
+  const links = oneTimeLinksIn({ text: text2 });
+  if (links.length === 0) return [...secrets];
+  return secrets.filter(
+    (secret) => KEPT_IN_LINKS.has(secret.kind) || !links.some((link) => secret.start >= link.start && secret.end <= link.end)
+  );
+}
+
 // ../../packages/secret-guard/src/detector/draft-secrets.ts
 var MESSAGE_TOKEN = /<@(?:person|agent):[A-Za-z0-9_-]{1,64}>|<!(?:channel|here)>|<file:[A-Za-z0-9_-]{1,64}>/g;
 function withoutMessageTokens(text2) {
   return text2.replace(MESSAGE_TOKEN, (token2) => " ".repeat(token2.length));
 }
 function draftSecretsIn({ text: text2 }) {
-  return findSecrets({ text: withoutMessageTokens(text2) });
+  const scanned = withoutMessageTokens(text2);
+  return withoutOneTimeLinkTokens({ text: scanned, secrets: findSecrets({ text: scanned }) });
 }
 
 // ../../packages/secret-guard/src/detector/vault-reference.ts
@@ -31523,6 +31567,19 @@ function applySavedProposals({
   );
 }
 
+// ../../packages/secret-guard/src/fields/identifier-fields.ts
+var IDENTIFIER_WORDS = /(?:^|[^A-Z])(?:USER|USERNAME|USER_NAME|EMAIL|E_MAIL|MAIL|LOGIN|ACCOUNT)(?:$|[^A-Z])/;
+var SECRET_WORDS = /PASS|SECRET|TOKEN|KEY|PIN|OTP|CREDENTIAL|PRIVATE/;
+function isIdentifierField({ name: name3 }) {
+  const upper = name3.toUpperCase();
+  return IDENTIFIER_WORDS.test(upper) && !SECRET_WORDS.test(upper);
+}
+function secretValuesOf({
+  fields
+}) {
+  return Object.entries(fields).filter(([name3]) => !isIdentifierField({ name: name3 })).map(([, value]) => value);
+}
+
 // ../../packages/secret-guard/src/redaction/redactor.ts
 var REDACTED = "****";
 var MIN_REDACTED_LENGTH = 4;
@@ -35718,7 +35775,7 @@ function flagText({
 }
 
 // src/rules/cli-version.rules.ts
-var STAMPED = "0.1.48";
+var STAMPED = "0.1.50";
 function cliVersionOf({ stamped = STAMPED } = {}) {
   return stamped.startsWith("__") ? "dev" : stamped;
 }
@@ -57814,6 +57871,29 @@ var deviceGrantSummarySchema = deviceGrantSummarySchemaDefinition;
 var ApiKeyApi = moduleApi()("api-key");
 var apiKeyTrpc = defineTrpcContract("apiKey").mutation("create").withInput(createApiKeyInputSchema).withOutput(createdApiKeySchema).query("list").withInput(external_exports.object({ workspaceId: external_exports.string().min(1) })).withOutput(external_exports.array(apiKeySummarySchema)).mutation("revoke").withInput(revokeApiKeyInputSchema).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listMine").withInput(external_exports.object({ workspaceId: external_exports.string().min(1) })).withOutput(external_exports.array(personalApiKeySchema)).mutation("revokeMine").withInput(revokeApiKeyInputSchema).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("deviceGrant").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), userCode: external_exports.string().min(1).max(20) })).withOutput(deviceGrantSummarySchema).mutation("approveDevice").withInput(decideDeviceGrantInputSchema).withOutput(external_exports.object({ approved: external_exports.literal(true) })).mutation("denyDevice").withInput(decideDeviceGrantInputSchema).withOutput(external_exports.object({ denied: external_exports.literal(true) })).build();
 
+// ../../modules/chat/contract/src/chat.gifs.ts
+var GIF_QUERY_MAX = 100;
+var searchGifsInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  query: external_exports.string().trim().min(1).max(GIF_QUERY_MAX),
+  page: external_exports.number().int().min(1).max(50).default(1)
+});
+var searchGifsInputSchema = searchGifsInputSchemaDefinition;
+var gifSchemaDefinition = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string(),
+  /** The animated GIF a sent message shows. */
+  url: external_exports.string().url(),
+  width: external_exports.number().int().nonnegative(),
+  height: external_exports.number().int().nonnegative()
+});
+var gifSchema = gifSchemaDefinition;
+var gifResultsSchemaDefinition = external_exports.object({
+  gifs: external_exports.array(gifSchema),
+  hasNext: external_exports.boolean()
+});
+var gifResultsSchema = gifResultsSchemaDefinition;
+
 // ../../modules/chat/contract/src/chat.layout.ts
 var LAYOUT_BLOCKS_MAX = 50;
 var LAYOUT_TEXT_MAX = 3e3;
@@ -58229,6 +58309,8 @@ var attentionCardSchemaDefinition = external_exports.object({
   canAlwaysAllow: external_exports.boolean(),
   /** How long "Allow for this agent" lasts, shown on the button; null when not known. */
   alwaysLeaseSeconds: external_exports.number().int().positive().nullable().default(null),
+  /** A vault card whose Allow covers the rest of the agent's turn: "Allow for this task". */
+  allowCoversTask: external_exports.boolean().optional(),
   /** The vault's request id when the card is a vault approval; null for a harness question. */
   vaultRequestId: external_exports.string().nullable().default(null),
   /** A vault approval whose Allow goes through the owner's device passkey. */
@@ -58582,7 +58664,9 @@ var directoryEntrySchemaDefinition = external_exports.object({
   removedAt: external_exports.iso.datetime().nullable().default(null),
   removedByName: external_exports.string().nullable().default(null),
   /** An agent that runs outside Laze: what it reads leaves Laze. False for people. */
-  runsOutside: external_exports.boolean().default(false)
+  runsOutside: external_exports.boolean().default(false),
+  /** Other names a person goes by, such as "Drew" or their Slack name; mentions match them. */
+  aliases: external_exports.array(external_exports.string()).optional()
 });
 var chatOverviewSchemaDefinition = external_exports.object({
   viewer: chatActorSchemaDefinition,
@@ -59448,7 +59532,7 @@ var ChatApi = moduleApi()("chat");
 var chatConversationsTrpc = defineTrpcContract("chat").query("overview").withInput(workspaceInputSchema).withOutput(chatOverviewSchema).query("unreadSummary").withInput(external_exports.object({})).withOutput(external_exports.array(workspaceUnreadSchema)).query("browse").withInput(workspaceInputSchema).withOutput(external_exports.array(browsableChannelSchema)).mutation("createChannel").withInput(createChannelInputSchema).withOutput(conversationSchema).mutation("join").withInput(channelInputSchema).withOutput(conversationSchema).mutation("leave").withInput(channelInputSchema).withOutput(external_exports.object({ left: external_exports.literal(true) })).mutation("updateChannel").withInput(updateChannelInputSchema).withOutput(conversationSchema).mutation("setDefaultAgent").withInput(setDefaultAgentInputSchema).withOutput(conversationSchema).query("logChannelHint").withInput(channelInputSchema).withOutput(logChannelHintSchema).mutation("dismissLogChannelHint").withInput(channelInputSchema).withOutput(external_exports.object({ dismissed: external_exports.literal(true) })).mutation("archiveChannel").withInput(channelInputSchema).withOutput(conversationSchema).mutation("unarchiveChannel").withInput(channelInputSchema).withOutput(conversationSchema).mutation("addMembers").withInput(addMembersInputSchema).withOutput(conversationSchema).mutation("removeMember").withInput(removeMemberInputSchema).withOutput(conversationSchema).mutation("openDirect").withInput(openDirectInputSchema).withOutput(conversationSchema).query("conversation").withInput(channelInputSchema).withOutput(conversationSchema).build();
 var chatChannelRolesTrpc = defineTrpcContract("chat").mutation("setChannelRole").withInput(setChannelRoleInputSchema).withOutput(conversationSchema).mutation("extendChannel").withInput(extendChannelInputSchema).withOutput(conversationSchema).build();
 var chatMessagesTrpc = defineTrpcContract("chat").query("history").withInput(historyInputSchema).withOutput(historyPageSchema).query("thread").withInput(messageInputSchema).withOutput(threadSchema).mutation("post").withInput(postMessageInputSchema).withOutput(messageSchema).mutation("forward").withInput(forwardMessageInputSchema).withOutput(messageSchema).mutation("addMentioned").withInput(addMentionedInputSchema).withOutput(messageSchema).mutation("edit").withInput(editMessageInputSchema).withOutput(messageSchema).mutation("delete").withInput(messageInputSchema).withOutput(messageSchema).mutation("remove").withInput(messageInputSchema).withOutput(messageSchema).mutation("react").withInput(reactInputSchema).withOutput(messageSchema).mutation("signalTyping").withInput(signalTypingInputSchema).withOutput(external_exports.object({ sent: external_exports.literal(true) })).mutation("markRead").withInput(markReadInputSchema).withOutput(external_exports.object({ lastReadSeq: external_exports.number().int().nonnegative() })).mutation("markUnread").withInput(markUnreadInputSchema).withOutput(external_exports.object({ lastReadSeq: external_exports.number().int().nonnegative() })).query("search").withInput(searchInputSchema).withOutput(searchResultSchema).build();
-var chatFilesTrpc = defineTrpcContract("chat").mutation("startUpload").withInput(startUploadInputSchema).withOutput(uploadTicketSchema).mutation("completeUpload").withInput(completeUploadInputSchema).withOutput(attachmentSchema).mutation("abortUpload").withInput(fileInputSchema).withOutput(external_exports.object({ aborted: external_exports.literal(true) })).query("fileLink").withInput(fileLinkInputSchema).withOutput(fileLinkSchema).query("channelFiles").withInput(channelFilesInputSchema).withOutput(channelFilesSchema).mutation("renameAttachment").withInput(renameAttachmentInputSchema).withOutput(attachmentSchema).mutation("hideUnfurl").withInput(hideUnfurlInputSchema).withOutput(messageSchema).query("unfurlImage").withInput(hideUnfurlInputSchema).withOutput(fileLinkSchema).build();
+var chatFilesTrpc = defineTrpcContract("chat").mutation("startUpload").withInput(startUploadInputSchema).withOutput(uploadTicketSchema).mutation("completeUpload").withInput(completeUploadInputSchema).withOutput(attachmentSchema).mutation("abortUpload").withInput(fileInputSchema).withOutput(external_exports.object({ aborted: external_exports.literal(true) })).query("fileLink").withInput(fileLinkInputSchema).withOutput(fileLinkSchema).query("channelFiles").withInput(channelFilesInputSchema).withOutput(channelFilesSchema).mutation("renameAttachment").withInput(renameAttachmentInputSchema).withOutput(attachmentSchema).mutation("hideUnfurl").withInput(hideUnfurlInputSchema).withOutput(messageSchema).query("unfurlImage").withInput(hideUnfurlInputSchema).withOutput(fileLinkSchema).query("searchGifs").withInput(searchGifsInputSchema).withOutput(gifResultsSchema).build();
 var chatFollowingTrpc = defineTrpcContract("chat").mutation("setNotify").withInput(setNotifyInputSchema).withOutput(conversationSummarySchema).mutation("hideConversation").withInput(channelInputSchema).withOutput(external_exports.object({ hidden: external_exports.literal(true) })).mutation("followThread").withInput(followThreadInputSchema).withOutput(threadFollowSchema).query("threadFollow").withInput(messageInputSchema).withOutput(threadFollowSchema).query("threads").withInput(threadsInputSchema).withOutput(threadsPageSchema).query("threadsUnread").withInput(workspaceInputSchema).withOutput(threadsUnreadSchema).query("notificationCount").withInput(workspaceInputSchema).withOutput(external_exports.object({ count: external_exports.number().int().nonnegative() })).mutation("markThreadRead").withInput(messageInputSchema).withOutput(external_exports.object({ read: external_exports.literal(true) })).mutation("pin").withInput(pinMessageInputSchema).withOutput(messageSchema).query("pins").withInput(channelInputSchema).withOutput(pinsPageSchema).query("saved").withInput(savedInputSchema).withOutput(savedPageSchema).query("savedMarks").withInput(workspaceInputSchema).withOutput(savedMarksSchema).mutation("saveMessage").withInput(saveMessageInputSchema).withOutput(savedStatusSchema).mutation("markSavedDone").withInput(markSavedDoneInputSchema).withOutput(savedStatusSchema).mutation("setReminder").withInput(setReminderInputSchema).withOutput(savedStatusSchema).query("activity").withInput(activityInputSchema).withOutput(activityPageSchema).mutation("markActivityRead").withInput(markActivityReadInputSchema).withOutput(external_exports.object({ read: external_exports.literal(true) })).build();
 var chatSessionTrpc = defineTrpcContract("chat").mutation("realtimeToken").withInput(workspaceInputSchema).withOutput(realtimeTokenSchema).query("drafts").withInput(workspaceInputSchema).withOutput(draftListSchema).mutation("saveDraft").withInput(saveDraftInputSchema).withOutput(draftSavedSchema).mutation("deleteDraft").withInput(deleteDraftInputSchema).withOutput(draftSavedSchema).query("sent").withInput(listSentInputSchema).withOutput(sentPageSchema).query("sidebarLayout").withInput(workspaceInputSchema).withOutput(sidebarLayoutSchema).mutation("editSidebar").withInput(editSidebarInputSchema).withOutput(sidebarLayoutSchema).mutation("star").withInput(starInputSchema).withOutput(starStatusSchema).query("starred").withInput(workspaceInputSchema).withOutput(starredListSchema).mutation("scrubSecrets").withInput(scrubChatInputSchema).withOutput(chatScrubReportSchema).mutation("restoreScrubbed").withInput(messageInputSchema).withOutput(messageSchema).build();
 var chatScheduledTrpc = defineTrpcContract("chat").mutation("scheduleMessage").withInput(scheduleMessageInputSchema).withOutput(scheduledMessageSchema).query("scheduled").withInput(listScheduledInputSchema).withOutput(scheduledListSchema).mutation("editScheduled").withInput(editScheduledInputSchema).withOutput(scheduledMessageSchema).mutation("sendScheduledNow").withInput(scheduledInputSchema).withOutput(scheduledMessageSchema).mutation("cancelScheduled").withInput(scheduledInputSchema).withOutput(scheduledMessageSchema).build();
@@ -60582,8 +60666,21 @@ var finishVaultDeviceEnrolmentInputSchemaDefinition = external_exports.object({
     /** P-256 SPKI DER; signs approvals of later devices. */
     signingPublicKey: base64Url,
     /** DER ECDSA over nativeSignedMessage({ purpose: "enrol", challenge }). */
-    signature: base64Url
-  }).optional()
+    signature: base64Url,
+    /** The same for one install of the app, through Face ID changes; named on a re-enrol. */
+    installId: external_exports.string().min(8).max(128).optional(),
+    /** Required for ios_secure_enclave: DCAppAttestService over appAttestClientData(...). */
+    appAttest: external_exports.object({
+      /** The App Attest key id as iOS returns it (standard base64 of the key's SHA-256). */
+      keyId: external_exports.string().min(1).max(64),
+      /** The CBOR attestation object, base64url. */
+      attestation: base64Url
+    }).optional()
+  }).optional(),
+  /** A re-enrol from the same install: the device it replaces, retired when this one is stored. */
+  replacesDeviceId: external_exports.string().min(1).optional(),
+  /** A fresh reauth proof; required with replacesDeviceId and spent by it. */
+  reauthToken: external_exports.string().min(1).optional()
 });
 var finishVaultDeviceEnrolmentInputSchema = finishVaultDeviceEnrolmentInputSchemaDefinition;
 var sealedRecipientSchema = external_exports.object({
@@ -60673,7 +60770,9 @@ var answerSealedApprovalInputSchemaDefinition = external_exports.object({
   release: external_exports.object({ epk: base64Url, ciphertext: base64Url }),
   via: external_exports.enum(["feed", "channel", "ios", "desktop", "web"]).default("web"),
   /** Allow for this agent for this long: runs with the same key reuse the release until then. */
-  durationSeconds: external_exports.number().int().positive().optional()
+  durationSeconds: external_exports.number().int().positive().optional(),
+  /** The active device that opened the secret; removing it ends this release and its lease. */
+  approverDeviceId: external_exports.string().min(1).optional()
 });
 var answerSealedApprovalInputSchema = answerSealedApprovalInputSchemaDefinition;
 var vaultRunSealedReleaseSchemaDefinition = external_exports.object({
@@ -61199,6 +61298,8 @@ var vaultApprovalStateSchema = external_exports.enum([
   "denied",
   "expired"
 ]);
+var vaultApprovalListStateSchemaDefinition = external_exports.union([vaultApprovalStateSchema, external_exports.literal("withdrawn")]).transform((state) => state === "withdrawn" ? "expired" : state);
+var vaultApprovalListStateSchema = vaultApprovalListStateSchemaDefinition;
 var vaultAnswerViaSchema = external_exports.enum(["feed", "channel", "ios", "desktop", "web"]);
 var vaultApprovalRequestSchemaDefinition = external_exports.object({
   id: external_exports.string(),
@@ -61228,7 +61329,9 @@ var vaultApprovalRequestSchemaDefinition = external_exports.object({
   /** The connection's title, so an approver who cannot list it still knows what is asked. */
   connectionTitle: external_exports.string().nullable().default(null),
   /** The longest lease Allow for this agent offers; null offers only once and deny. */
-  maxLeaseSeconds: external_exports.number().int().positive().nullable().default(null)
+  maxLeaseSeconds: external_exports.number().int().positive().nullable().default(null),
+  /** Allow covers the rest of the agent's turn ("Allow for this task"), not one command. */
+  coversTask: external_exports.boolean().optional()
 });
 var vaultApprovalRequestSchema = vaultApprovalRequestSchemaDefinition;
 var answerVaultApprovalInputSchemaDefinition = external_exports.object({
@@ -61446,7 +61549,7 @@ var vaultTrpc = defineTrpcContract("vault").mutation("createConnection").withInp
     reason: external_exports.string().trim().min(1).max(200),
     reauthToken: external_exports.string().min(1).max(200).optional()
   })
-).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("beginReauth").withInput(workspaceInput).withOutput(vaultReauthChallengeSchema).mutation("confirmReauth").withInput(confirmVaultReauthInputSchema).withOutput(vaultReauthProofSchema).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(revokeVaultGrantInputSchema).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).mutation("shareConnection").withInput(shareVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("approveShare").withInput(approveVaultShareInputSchema).withOutput(vaultGrantSchema).mutation("sealConnection").withInput(sealVaultConnectionInputSchema).withOutput(vaultConnectionSchema).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(vaultAuditReadInputSchema).withOutput(vaultAuditPageSchema).query("listActivity").withInput(vaultAuditReadInputSchema).withOutput(external_exports.array(vaultAuditEntrySchema)).query("listLeases").withInput(workspaceInput).withOutput(external_exports.array(vaultLeaseSchema)).mutation("endLease").withInput(endVaultLeaseInputSchema).withOutput(external_exports.object({ ended: external_exports.literal(true) })).query("mostAsked").withInput(vaultMostAskedInputSchema).withOutput(vaultMostAskedSchema).query("judgeStatus").withInput(workspaceInput).withOutput(vaultJudgeStatusSchema).query("listLevelLimits").withInput(workspaceInput).withOutput(external_exports.array(vaultLevelLimitSchema)).mutation("setLevelLimit").withInput(setVaultLevelLimitInputSchema).withOutput(external_exports.array(vaultLevelLimitSchema)).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(
+).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("beginReauth").withInput(workspaceInput).withOutput(vaultReauthChallengeSchema).mutation("confirmReauth").withInput(confirmVaultReauthInputSchema).withOutput(vaultReauthProofSchema).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(revokeVaultGrantInputSchema).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).mutation("shareConnection").withInput(shareVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("approveShare").withInput(approveVaultShareInputSchema).withOutput(vaultGrantSchema).mutation("sealConnection").withInput(sealVaultConnectionInputSchema).withOutput(vaultConnectionSchema).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalListStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(vaultAuditReadInputSchema).withOutput(vaultAuditPageSchema).query("listActivity").withInput(vaultAuditReadInputSchema).withOutput(external_exports.array(vaultAuditEntrySchema)).query("listLeases").withInput(workspaceInput).withOutput(external_exports.array(vaultLeaseSchema)).mutation("endLease").withInput(endVaultLeaseInputSchema).withOutput(external_exports.object({ ended: external_exports.literal(true) })).query("mostAsked").withInput(vaultMostAskedInputSchema).withOutput(vaultMostAskedSchema).query("judgeStatus").withInput(workspaceInput).withOutput(vaultJudgeStatusSchema).query("listLevelLimits").withInput(workspaceInput).withOutput(external_exports.array(vaultLevelLimitSchema)).mutation("setLevelLimit").withInput(setVaultLevelLimitInputSchema).withOutput(external_exports.array(vaultLevelLimitSchema)).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(
   external_exports.object({
     ...connectionInput.shape,
     reason: external_exports.string().trim().min(1).max(200),
@@ -61478,6 +61581,8 @@ var vaultConfig = Config.define((c) => ({
     "VAULT_PREVIOUS_KEY_GRACE_MINUTES",
     external_exports.coerce.number().int().min(0).default(30)
   ),
+  /** iPhone enrolment without App Attest (simulator); applies only off a public origin. */
+  appAttestDev: c.env("VAULT_APP_ATTEST_DEV", environmentBooleanSchema.default(false)),
   /** The origin passkeys are made on; unset accepts any localhost origin, for development. */
   publicBaseUrl,
   /** A file each audit chain head is appended to as a JSON line; unset only logs the heads. */
@@ -61561,7 +61666,9 @@ var vaultApprovalRequestedPayloadSchemaDefinition = external_exports.object({
   /** Sealed to the owner's devices: Allow goes through the device's passkey, deny does not. */
   sealed: external_exports.boolean().default(false),
   /** For a send, the message it would send, read from the provider. */
-  draft: vaultDraftPreviewSchema.nullable().default(null)
+  draft: vaultDraftPreviewSchema.nullable().default(null),
+  /** Allow covers the rest of the agent's turn ("Allow for this task"), not one command. */
+  coversTask: external_exports.boolean().optional()
 });
 var vaultApprovalResolvedPayloadSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
@@ -61580,6 +61687,10 @@ var vaultApprovalResolvedPayloadSchemaDefinition = external_exports.object({
   answeredByName: external_exports.string().default(""),
   /** A deny or a timeout: until when the same action is refused without a new card. */
   blockedUntil: external_exports.iso.datetime().nullable().default(null),
+  /** An expired card closed because the agent's turn that asked ended; nothing is blocked. */
+  endedWithTurn: external_exports.boolean().optional(),
+  /** A task card: its Allow covered the rest of the agent's turn. */
+  coversTask: external_exports.boolean().optional(),
   /** Who decides the card, so their open approvals lists refresh. */
   approverUserIds: external_exports.array(external_exports.string()).readonly().default([])
 });
@@ -65445,6 +65556,11 @@ var callerSchemaDefinition = external_exports.object({
   /** The person's time zone, or the agent owner's (IANA; UTC while Laze does not know it). */
   timeZone: external_exports.string().optional()
 });
+var agentGuideFilesSchemaDefinition = external_exports.object({
+  "work/SOUL.md": external_exports.string(),
+  "work/AGENTS.md": external_exports.string(),
+  "work/CLAUDE.md": external_exports.string()
+});
 var agentChannelLevelSchema = external_exports.enum(["everything", "mentions"]);
 var callerChannelSchemaDefinition = external_exports.object({
   id: idSchema15,
@@ -65668,6 +65784,15 @@ var AgentHopLimitNoticeSlot = agentUi.component("hopLimitNotice");
 var AgentRetryTurnSlot = agentUi.component("retryTurn");
 var AgentHeldNoticeSlot = agentUi.component("heldNotice");
 
+// ../../modules/agent/contract/src/laze-changes.ts
+var lazeChangeSchemaDefinition = external_exports.object({
+  /** The day it reached prod, YYYY-MM-DD. */
+  date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  /** The refusal codes it lifted; empty when the refusal had no code of its own. */
+  codes: external_exports.array(external_exports.string()),
+  text: external_exports.string().min(1)
+});
+
 // ../../modules/agent/contract/src/agent.config.ts
 var positiveInt3 = external_exports.coerce.number().int().positive();
 var agentConfig = Config.define((c) => ({
@@ -66117,7 +66242,9 @@ var callerWorkspaceMemberSchemaDefinition = external_exports.object({
   email: external_exports.string(),
   name: external_exports.string(),
   role: roleSchema,
-  joinedAt: external_exports.iso.datetime()
+  joinedAt: external_exports.iso.datetime(),
+  /** Other names they go by in the workspace; absent or empty without any. */
+  aliases: external_exports.array(external_exports.string()).optional()
 });
 var callerWorkspaceInviteSchemaDefinition = external_exports.object({
   id: external_exports.string().min(1),
@@ -66159,6 +66286,9 @@ var decideRequestAsCallerInputSchemaDefinition = external_exports.object({
   requestId: external_exports.string().trim().min(1).max(80),
   decision: external_exports.enum(["approved", "denied"])
 });
+var setAliasesAsCallerInputSchemaDefinition = external_exports.object({
+  aliases: external_exports.array(external_exports.string().trim().max(40)).max(5)
+});
 var renameWorkspaceAsCallerInputSchemaDefinition = external_exports.object({
   name: external_exports.string().trim().min(1).max(80)
 });
@@ -67226,6 +67356,10 @@ var slackProfilesSchemaDefinition = external_exports.object({
   profiles: external_exports.array(slackProfileSchemaDefinition)
 });
 var slackProfilesSchema = slackProfilesSchemaDefinition;
+var slackLinkedNamesSchemaDefinition = external_exports.object({
+  people: external_exports.array(external_exports.object({ personId: external_exports.string().min(1), names: external_exports.array(external_exports.string()) }))
+});
+var slackLinkedNamesSchema = slackLinkedNamesSchemaDefinition;
 
 // ../../modules/slack/contract/src/slack-setup.ts
 var workspaceIdSchema13 = external_exports.string().min(1);
@@ -67594,7 +67728,7 @@ var slackSearchAnswerSchemaDefinition = external_exports.object({
 var slackSearchAnswerSchema = slackSearchAnswerSchemaDefinition;
 var SlackApi = moduleApi()("slack");
 var workspaceInput3 = external_exports.object({ workspaceId: workspaceIdSchema14 });
-var slackTrpc = defineTrpcContract("slack").query("overview").withInput(workspaceInput3).withOutput(slackOverviewSchema).mutation("startSetup").withInput(startSlackSetupInputSchema).withOutput(startedSlackAuthorizeSchema).mutation("beginSetup").withInput(beginSlackSetupInputSchema).withOutput(slackSetupSchema).mutation("saveAppCredentials").withInput(saveSlackAppCredentialsInputSchema).withOutput(startedSlackAuthorizeSchema).mutation("installApp").withInput(installSlackAppInputSchema).withOutput(startedSlackAuthorizeSchema).mutation("startInstall").withInput(startSlackInstallInputSchema).withOutput(startedSlackAuthorizeSchema).mutation("startLink").withInput(startSlackLinkInputSchema).withOutput(startedSlackAuthorizeSchema).query("channels").withInput(slackTeamInputSchema).withOutput(external_exports.array(slackChannelViewSchema)).mutation("setMirror").withInput(setSlackMirrorInputSchema).withOutput(slackConnectionViewSchema).mutation("updateConnection").withInput(updateSlackConnectionInputSchema).withOutput(slackConnectionViewSchema).mutation("disconnect").withInput(slackTeamInputSchema).withOutput(external_exports.object({ disconnected: external_exports.literal(true) })).mutation("unlink").withInput(slackTeamInputSchema).withOutput(slackConnectionViewSchema).query("linkPrompts").withInput(workspaceInput3).withOutput(slackLinkPromptsSchema).mutation("dismissLinkPrompt").withInput(dismissSlackLinkPromptInputSchema).withOutput(slackLinkPromptsSchema).query("people").withInput(slackPeopleInputSchema).withOutput(slackPeopleSchema).query("bookmarks").withInput(slackBookmarksInputSchema).withOutput(slackBookmarksSchema).query("profiles").withInput(slackProfilesInputSchema).withOutput(slackProfilesSchema).mutation("openDirect").withInput(openSlackDirectInputSchema).withOutput(openedSlackDirectSchema).mutation("updateApp").withInput(updateSlackAppInputSchema).withOutput(external_exports.object({ updated: external_exports.literal(true) })).query("history").withInput(slackHistoryInputSchema).withOutput(slackHistoryPageSchema).query("search").withInput(slackSearchInputSchema).withOutput(slackSearchAnswerSchema).query("movePreview").withInput(slackMoveChannelInputSchema).withOutput(slackMovePreviewSchema).mutation("startMoves").withInput(startSlackMovesInputSchema).withOutput(startedSlackMovesSchema).mutation("cancelMove").withInput(slackMoveInputSchema).withOutput(slackMoveViewSchema).query("moves").withInput(workspaceInput3).withOutput(slackMovesSchema).build();
+var slackTrpc = defineTrpcContract("slack").query("overview").withInput(workspaceInput3).withOutput(slackOverviewSchema).mutation("startSetup").withInput(startSlackSetupInputSchema).withOutput(startedSlackAuthorizeSchema).mutation("beginSetup").withInput(beginSlackSetupInputSchema).withOutput(slackSetupSchema).mutation("saveAppCredentials").withInput(saveSlackAppCredentialsInputSchema).withOutput(startedSlackAuthorizeSchema).mutation("installApp").withInput(installSlackAppInputSchema).withOutput(startedSlackAuthorizeSchema).mutation("startInstall").withInput(startSlackInstallInputSchema).withOutput(startedSlackAuthorizeSchema).mutation("startLink").withInput(startSlackLinkInputSchema).withOutput(startedSlackAuthorizeSchema).query("channels").withInput(slackTeamInputSchema).withOutput(external_exports.array(slackChannelViewSchema)).mutation("setMirror").withInput(setSlackMirrorInputSchema).withOutput(slackConnectionViewSchema).mutation("updateConnection").withInput(updateSlackConnectionInputSchema).withOutput(slackConnectionViewSchema).mutation("disconnect").withInput(slackTeamInputSchema).withOutput(external_exports.object({ disconnected: external_exports.literal(true) })).mutation("unlink").withInput(slackTeamInputSchema).withOutput(slackConnectionViewSchema).query("linkPrompts").withInput(workspaceInput3).withOutput(slackLinkPromptsSchema).mutation("dismissLinkPrompt").withInput(dismissSlackLinkPromptInputSchema).withOutput(slackLinkPromptsSchema).query("people").withInput(slackPeopleInputSchema).withOutput(slackPeopleSchema).query("bookmarks").withInput(slackBookmarksInputSchema).withOutput(slackBookmarksSchema).query("profiles").withInput(slackProfilesInputSchema).withOutput(slackProfilesSchema).query("linkedNames").withInput(external_exports.object({ workspaceId: external_exports.string().min(1) })).withOutput(slackLinkedNamesSchema).mutation("openDirect").withInput(openSlackDirectInputSchema).withOutput(openedSlackDirectSchema).mutation("updateApp").withInput(updateSlackAppInputSchema).withOutput(external_exports.object({ updated: external_exports.literal(true) })).query("history").withInput(slackHistoryInputSchema).withOutput(slackHistoryPageSchema).query("search").withInput(slackSearchInputSchema).withOutput(slackSearchAnswerSchema).query("movePreview").withInput(slackMoveChannelInputSchema).withOutput(slackMovePreviewSchema).mutation("startMoves").withInput(startSlackMovesInputSchema).withOutput(startedSlackMovesSchema).mutation("cancelMove").withInput(slackMoveInputSchema).withOutput(slackMoveViewSchema).query("moves").withInput(workspaceInput3).withOutput(slackMovesSchema).build();
 
 // ../../modules/slack/contract/src/slack-keys.ts
 var SLACK_KEY_PATHS = {
@@ -71048,6 +71182,23 @@ are waiting, if you think one was missed.
   with \`laze app pull --app <app>\` (its files: page, plan, code) and
   \`laze app records list <collection> --app <app>\` (its data).
 
+## When Laze refused something
+
+A refusal is about Laze as it was then; Laze ships fixes several times a day. Before telling
+someone an action cannot be done because Laze refused it earlier, run \`laze changes\` and try it
+again. When a change lifts a refusal you hit in a conversation, tell the people there once that
+it works now.
+
+## Browser tabs and sign-ins
+
+- \`laze browser tabs\` lists the live browser tabs of your conversations. You drive every tab
+  your owner owns from this session (\`laze browser goto|read|cdp <tab>\`); you need no Laze
+  computer and no helper agent. Reuse an open tab by its title instead of opening another.
+- A site needs a sign-in: \`laze browser ask <tab> "Sign in to <site>"\`. The person signs in on
+  the tab's screen and presses Done, which reaches you as a message (\`--wait\` waits for it).
+- Only when the person says to use a saved key: \`laze browser login <tab> --vault <connection>\`.
+  Never ask for a password and never write scripts that type one.
+
 If \`laze\` is not on the PATH, run the same commands through \`npx -y @lazehq/cli@latest\`.
 Never print or repeat your Laze key.
 `;
@@ -72806,6 +72957,9 @@ var appSchemaDefinition = external_exports.object({
   publishedUrl: external_exports.string(),
   /** The live version; null before the first push or while the app is taken offline. */
   publishedVersion: appVersionIdSchema.nullable(),
+  /** Pages loaded before apps were trunk-based still require these: the origin and live version. */
+  draftUrl: external_exports.string().optional(),
+  draftVersion: appVersionIdSchema.nullable().optional(),
   pendingPublish: publishRequestSchema.nullable(),
   /** The standing approval for public publishes; absent or null when every one asks. */
   publishLease: publishLeaseSchema.nullable().optional(),
@@ -76423,6 +76577,18 @@ async function workspaces({ context, args }) {
     );
   }
 }
+async function changes({ context, args }) {
+  const { client } = await signedIn({ context, args });
+  const list10 = await client.get("/api/agents/me/changes");
+  if (args.flags.json) return context.out(`${JSON.stringify(list10, null, 2)}
+`);
+  if (list10.length === 0) return context.out("No recent changes.\n");
+  for (const change2 of list10) {
+    const lifted = change2.codes.length > 0 ? ` (lifts ${change2.codes.join(", ")})` : "";
+    context.out(`${change2.date}${lifted}: ${change2.text}
+`);
+  }
+}
 
 // src/services/billing-commands.service.ts
 var BILLING_USAGE = `Usage:
@@ -76584,8 +76750,370 @@ async function billing({ context, args }) {
 
 // src/services/browser-commands.service.ts
 import { randomBytes } from "node:crypto";
-import { mkdir as mkdir17, readFile as readFile17, writeFile as writeFile17 } from "node:fs/promises";
+import { mkdir as mkdir19, readFile as readFile18, writeFile as writeFile19 } from "node:fs/promises";
+import { dirname as dirname18, join as join21 } from "node:path";
+
+// src/services/browser-tab-commands.service.ts
+import { mkdir as mkdir18, writeFile as writeFile18 } from "node:fs/promises";
+import { tmpdir as tmpdir3 } from "node:os";
+import { join as join20 } from "node:path";
+
+// src/rules/browser-login.rules.ts
+var PASSWORD_NAME = /pass|pwd/i;
+var USER_NAME = /user|email|e-mail|login|account|name|^id$|_id$/i;
+function loginValuesOf({
+  connection,
+  values,
+  userField,
+  passField
+}) {
+  const names = Object.keys(values).toSorted();
+  const listed = names.join(", ") || "no fields";
+  const refusal = (why) => ({
+    refusal: `laze browser login: ${why}; ${connection} holds ${listed}. Pass --user-field <field> and --pass-field <field>.`
+  });
+  if (userField && values[userField] === void 0)
+    return refusal(`${connection} has no field ${userField}`);
+  if (passField && values[passField] === void 0)
+    return refusal(`${connection} has no field ${passField}`);
+  const passName = passField ?? names.find((name3) => PASSWORD_NAME.test(name3)) ?? (names.length === 1 ? names[0] : void 0);
+  if (passName === void 0) return refusal("no field reads as the password");
+  const userName = userField ?? names.find((name3) => name3 !== passName && USER_NAME.test(name3)) ?? void 0;
+  const password = values[passName] ?? "";
+  if (!password) return refusal(`${passName} is empty`);
+  const username = userName === void 0 ? void 0 : values[userName];
+  return username ? { username, password } : { password };
+}
+
+// src/services/vault-commands.service.ts
+import { createHash as createHash2 } from "node:crypto";
+import { mkdir as mkdir17, readFile as readFile17, rm as rm9, writeFile as writeFile17 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname17, join as join19 } from "node:path";
+var USAGE6 = `Usage: laze vault run <connection> --reason "<one plain sentence>" [--wait <s>] -- <command> [args...]
+Runs the command with the connection's values in its environment, on a Laze agent's computer,
+on a machine it runs on, or where a connected agent runs, with its own key.
+  --channel <id>   the conversation whose turn it runs in, when the agent answers in several`;
+var POLL_MS = 3e3;
+var RESTART_WAIT_MS = 12e4;
+var RESTART_BACKOFF_MS = [1e3, 2e3, 4e3, 8e3, 1e4];
+var P2562 = { name: "ECDH", namedCurve: "P-256" };
+var ServerGoneError = class extends Error {
+};
+function proxyOf({ env }) {
+  const raw = env.LAZE_VAULT_PROXY || env.HTTP_PROXY || env.http_proxy;
+  if (!raw) return null;
+  const url2 = new URL(raw);
+  const user = decodeURIComponent(url2.username);
+  const password = decodeURIComponent(url2.password);
+  return {
+    origin: url2.origin,
+    authorization: `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`
+  };
+}
+function turnFileOf({
+  env
+}) {
+  return env.LAZE_TURN_FILE || void 0;
+}
+async function turnTokenOf2({
+  env,
+  turnFile,
+  command = "laze vault run"
+}) {
+  const pinned = env.LAZE_TURN_TOKEN?.trim();
+  if (pinned) return pinned;
+  if (!turnFile) throw new CliUsageError(`${command} works only during an agent's turn`);
+  try {
+    return (await readFile17(turnFile, "utf8")).trim();
+  } catch {
+    throw new CliUsageError(`${command} works only during an agent's turn`);
+  }
+}
+function runKeyPathOf({
+  turnFile,
+  connection,
+  profile = ""
+}) {
+  const name3 = createHash2("sha256").update(connection).digest("hex");
+  const base = turnFile ? dirname17(turnFile) : join19(tmpdir2(), "laze-vault", profile);
+  return join19(base, "vault-run-keys", `${name3}.json`);
+}
+async function runKeyAt({ path }) {
+  const saved3 = await readFile17(path, "utf8").then(
+    (text2) => JSON.parse(text2),
+    () => void 0
+  );
+  if (saved3 && typeof saved3.publicKey === "string" && saved3.privateKey) {
+    const privateKey = await globalThis.crypto.subtle.importKey("jwk", saved3.privateKey, P2562, false, ["deriveBits"]).catch(() => void 0);
+    if (privateKey) return { privateKey, publicKey: saved3.publicKey };
+  }
+  const fresh = await generateEcdhKeys();
+  const jwk = await globalThis.crypto.subtle.exportKey("jwk", fresh.privateKey);
+  await mkdir17(dirname17(path), { recursive: true, mode: 448 });
+  await writeFile17(path, JSON.stringify({ publicKey: fresh.publicKey, privateKey: jwk }), {
+    mode: 384
+  });
+  return fresh;
+}
+function connectionRefused(error62) {
+  const cause = error62.cause;
+  if (cause?.code === "ECONNREFUSED") return true;
+  return cause?.errors?.some((inner) => inner.code === "ECONNREFUSED") ?? false;
+}
+async function sendOnce({
+  context,
+  url: url2,
+  init
+}) {
+  let response;
+  try {
+    response = await context.fetcher(url2, init);
+  } catch (error62) {
+    const wasRefused = connectionRefused(error62);
+    if (init.method === "POST" && !wasRefused) throw error62;
+    return { restarting: wasRefused ? "connection refused" : String(error62) };
+  }
+  if (response.status !== 502 && response.status !== 503) return { response };
+  const code = codeOf(await response.clone().text());
+  const neverReached = response.status === 503 && code === "vault_not_answering";
+  if (init.method === "POST" && !neverReached) return { response };
+  return { restarting: `status ${response.status}${code ? ` ${code}` : ""}` };
+}
+async function reach(input2) {
+  const { context } = input2;
+  const started = context.nowMs();
+  for (let attempt = 0; ; attempt += 1) {
+    const sent = await sendOnce(input2);
+    if ("response" in sent) return sent.response;
+    if (context.nowMs() - started >= RESTART_WAIT_MS) {
+      throw new ServerGoneError(
+        `laze vault: the Laze server did not come back (${sent.restarting})`
+      );
+    }
+    if (attempt === 0) {
+      context.err(
+        `laze vault: the Laze server is not answering (${sent.restarting}), probably restarting; waiting up to 2 min...
+`
+      );
+    }
+    await context.sleep(RESTART_BACKOFF_MS[Math.min(attempt, RESTART_BACKOFF_MS.length - 1)] ?? 0);
+  }
+}
+function codeOf(text2) {
+  return /"code"\s*:\s*"([^"]+)"/.exec(text2)?.[1];
+}
+async function releaseOf({ response }) {
+  const text2 = await response.text();
+  if (!response.ok) {
+    return {
+      outcome: "deny",
+      exitCode: 1,
+      message: `laze vault: the release was refused (${codeOf(text2) ?? `status ${response.status}`})`
+    };
+  }
+  return JSON.parse(text2);
+}
+async function envOf({
+  release: release2,
+  run: run4
+}) {
+  if (!release2.sealed) return release2.env;
+  const sealed = await openRunRelease({
+    release: release2.sealed,
+    runPrivateKey: run4.privateKey,
+    runPublicKey: run4.publicKey,
+    requestId: release2.sealed.requestId
+  });
+  return { ...release2.env, ...sealed };
+}
+function deadlineOf({ args, nowMs }) {
+  const wait = flagText({ args, name: "wait" }) || (args.flags.wait === true ? args.words[3] : "");
+  if (!wait) return Infinity;
+  if (!(Number(wait) >= 0)) throw new CliUsageError(`--wait takes a number of seconds
+${USAGE6}`);
+  return nowMs + Number(wait) * 1e3;
+}
+async function untilAnswered({
+  context,
+  first,
+  next,
+  deadline
+}) {
+  let release2 = first;
+  while (release2.outcome === "ask") {
+    if (context.nowMs() + POLL_MS > deadline) {
+      context.err(`${release2.message}. Not approved yet; ask again later.
+`);
+      return "capped";
+    }
+    if (release2 === first) {
+      context.err(`${release2.message}. Waiting for an answer (cards expire after 12 hours)...
+`);
+    }
+    await context.sleep(POLL_MS);
+    release2 = await next(release2.requestId);
+  }
+  return release2;
+}
+function leaseHolds({
+  release: release2,
+  nowMs
+}) {
+  const ends = release2.sealed?.leaseEndsAt;
+  return ends !== void 0 && Temporal3.Instant.from(ends).epochMilliseconds > nowMs;
+}
+async function vaultRelease({
+  context,
+  args,
+  connection,
+  reason,
+  command
+}) {
+  const deadline = deadlineOf({ args, nowMs: context.nowMs() });
+  const env = context.environment.inherited;
+  const proxy = proxyOf({ env });
+  if (!proxy) return keyRelease({ context, args, connection, reason, command, deadline });
+  const turnFile = turnFileOf({ env });
+  const headers = {
+    "proxy-authorization": proxy.authorization,
+    "x-laze-turn": await turnTokenOf2({ env, turnFile })
+  };
+  const keyPath = runKeyPathOf({ turnFile, connection });
+  const run4 = await runKeyAt({ path: keyPath });
+  const body = JSON.stringify({ connection, reason, command, recipient: run4.publicKey });
+  let release2;
+  try {
+    const first = await releaseOf({
+      response: await reach({
+        context,
+        url: `${proxy.origin}/vault/release`,
+        init: { method: "POST", headers: { ...headers, "content-type": "application/json" }, body }
+      })
+    });
+    const next = async (requestId) => releaseOf({
+      response: await reach({
+        context,
+        url: `${proxy.origin}/vault/release/${encodeURIComponent(requestId)}`,
+        init: { method: "GET", headers }
+      })
+    });
+    release2 = await untilAnswered({ context, first, next, deadline });
+  } catch (error62) {
+    if (!(error62 instanceof ServerGoneError)) throw error62;
+    context.err(`${error62.message}. Run the command again to keep waiting.
+`);
+    return { exitCode: 75 };
+  }
+  return settled({ context, release: release2, run: run4, keyPath });
+}
+async function settled({
+  context,
+  release: release2,
+  run: run4,
+  keyPath
+}) {
+  if (release2 === "capped") return { exitCode: 75 };
+  if (release2.outcome === "deny") {
+    await rm9(keyPath, { force: true });
+    context.err(`${release2.message}
+`);
+    return { exitCode: release2.exitCode || 1 };
+  }
+  const values = await envOf({ release: release2, run: run4 });
+  if (!leaseHolds({ release: release2, nowMs: context.nowMs() })) await rm9(keyPath, { force: true });
+  if (release2.message) context.err(`${release2.message}
+`);
+  return { env: values };
+}
+function refusedRelease(error62) {
+  if (!(error62 instanceof LazeApiError)) throw error62;
+  return {
+    outcome: "deny",
+    exitCode: 1,
+    message: `laze vault: the release was refused: ${error62.message} (${error62.code})`
+  };
+}
+async function keyRelease({
+  context,
+  args,
+  connection,
+  reason,
+  command,
+  deadline
+}) {
+  const where = new CliUsageError(
+    "laze vault run works only on a Laze agent's computer, on a machine it runs on, or signed in as a connected agent"
+  );
+  const signed2 = await signedIn({ context, args }).catch(() => null);
+  if (signed2?.profile.kind !== "agent") throw where;
+  const { client, name: name3 } = signed2;
+  const channelId = flagText({ args, name: "channel" }) || null;
+  const keyPath = runKeyPathOf({ turnFile: void 0, connection, profile: name3 });
+  const run4 = await runKeyAt({ path: keyPath });
+  const first = await client.post("/api/agents/me/vault/release", {
+    connection,
+    reason,
+    command,
+    recipient: run4.publicKey,
+    channelId
+  }).catch(refusedRelease);
+  const next = (requestId) => client.post("/api/agents/me/vault/release-status", { requestId, channelId }).catch(refusedRelease);
+  const release2 = await untilAnswered({ context, first, next, deadline });
+  return settled({ context, release: release2, run: run4, keyPath });
+}
+async function vaultRun({
+  context,
+  args
+}) {
+  const connection = args.words[2];
+  const reason = flagText({ args, name: "reason" });
+  if (!connection || args.rest.length === 0) throw new CliUsageError(USAGE6);
+  if (!reason) throw new CliUsageError(`Say why with --reason "<one plain sentence>"
+${USAGE6}`);
+  const foreign = commandReferenceNames({ command: args.rest }).find(
+    (name3) => vaultReferenceConnectionName({ name: name3 }) !== connection
+  );
+  if (foreign !== void 0) {
+    const named = vaultReferenceConnectionName({ name: foreign });
+    context.err(
+      `laze vault: the command names {{vault:${foreign}}}, but this run releases only ${connection}, not ${named}. Nothing was asked and the command did not run.
+`
+    );
+    return 1;
+  }
+  const released = await vaultRelease({ context, args, connection, reason, command: args.rest });
+  if ("exitCode" in released) return released.exitCode;
+  const prepared = preparedCommand({
+    command: args.rest,
+    released: /* @__PURE__ */ new Map([[connection, released.env]])
+  });
+  if ("refusal" in prepared) {
+    context.err(`${prepared.refusal}
+`);
+    return 1;
+  }
+  const redact = secretValuesOf({ fields: released.env });
+  return context.runCommand({ command: prepared.command, env: released.env, redact });
+}
+function preparedCommand({
+  command,
+  released
+}) {
+  for (const [name3, fields] of released) {
+    const [problem] = unusableFieldProblems({ fields });
+    if (problem !== void 0) {
+      return {
+        refusal: `laze vault: ${name3}: ${problem}, so the command did not run. Ask its owner to save the real value on the vault page.`
+      };
+    }
+  }
+  const filled = fillCommandReferences({ command, released });
+  if ("refusal" in filled) {
+    return { refusal: `laze vault: ${filled.refusal}. The command did not run.` };
+  }
+  return filled;
+}
 
 // src/services/browser-tab-commands.service.ts
 var BROWSER_TAB_PATHS = {
@@ -76597,19 +77125,30 @@ var BROWSER_TAB_PATHS = {
   ask: "/api/compute/browser-tabs/ask",
   share: "/api/compute/browser-tabs/share",
   close: "/api/compute/browser-tabs/close",
-  cdp: "/api/compute/browser-tabs/cdp"
+  cdp: "/api/compute/browser-tabs/cdp",
+  login: "/api/compute/browser-tabs/login"
 };
+var ASK_WAIT_SECONDS = 15 * 60;
+var ASK_POLL_MS = 3e3;
 var BROWSER_TAB_USAGE = [
   "Usage: laze browser open <url> [--title <title>] [--channel <channel>]   a live browser tab in the conversation",
   "       laze browser tabs [--channel <channel>]          the conversation's browser tabs",
   "       laze browser tab <tab>                            one tab: its owner, sharing and page",
   "       laze browser goto <tab> <url>                     send the tab to another page",
   "       laze browser read <tab>                           the page's address, title and text",
-  "       laze browser ask <tab> <what>                     ask the person you work for to sign in or click something there",
+  "       laze browser ask <tab> <what> [--wait[=<seconds>]]   ask the person you work for to sign in or click something there",
+  "       laze browser login <tab> --vault <connection> [--reason <why>] [--user-field <field> --pass-field <field>]",
+  "                          [--user-input <css> --pass-input <css>]   type a saved sign-in into the page and submit it",
   "       laze browser cdp <tab>                            a CDP address on the tab's browser",
   "       laze browser share <tab> private|watch|use        who sees the screen and who types into it",
   "       laze browser close <tab>                          unpin the tab and close its browser",
-  "A tab is named by its id or its title."
+  "A tab is named by its id or its title. Opening a title that is already open reuses that tab.",
+  "Any agent working for the tab's owner drives it, connected agents (Claude Code, Codex) from",
+  "their own session included; no Laze computer is needed. Another person's agent cannot.",
+  "Sign-ins: ask the person in the tab first (`laze browser ask`); they sign in on the screen and",
+  "press Done, which reaches you at once. Use `laze browser login --vault` only when the person",
+  "says to use a saved key; a code or emailed link it meets becomes a request to them in the tab.",
+  "Never write scripts that type passwords."
 ].join("\n");
 var SHARING = /* @__PURE__ */ new Set(["private", "watch", "use"]);
 function channelOf({ context, args }) {
@@ -76641,6 +77180,12 @@ async function openTab({ args, client, channel, print: print9 }) {
     ...title ? { title } : {},
     ...channel
   });
+  if (tab.reused)
+    return print9(
+      tab,
+      `Reused ${tab.title} (${tab.id}), ${tab.ownerName}'s browser tab already open, and sent it to ${tab.url}
+`
+    );
   print9(
     tab,
     `Opened ${tab.title} (${tab.id}) in ${tab.ownerName}'s browser, pinned as a tab of the conversation.
@@ -76678,17 +77223,134 @@ async function readTab({ args, client, channel, print: print9 }) {
   });
   print9(page, pageText({ page }));
 }
-async function askOnTab({ args, client, channel, print: print9 }) {
+async function askOnTab(run4) {
+  const { args, client, channel, print: print9 } = run4;
   const tab = word({ args, at: 2 });
   const text2 = args.words.slice(3).join(" ").trim();
   if (!text2) throw new CliUsageError(BROWSER_TAB_USAGE);
   const asked = await client.post(BROWSER_TAB_PATHS.ask, { tab, text: text2, ...channel });
-  print9(
-    asked,
-    `Asked ${asked.ask?.userName ?? asked.ownerName} in the conversation; the tab shows them your request with Done.
+  const who = asked.ask?.userName ?? asked.ownerName;
+  if (args.flags.wait === void 0)
+    return print9(
+      asked,
+      `Asked ${who} in the conversation; the tab shows them your request full screen with "Done, hand back".
 Wait for their "Done" message before you go on in ${asked.title}.
+`
+    );
+  run4.context.err(`Asked ${who} in the conversation; waiting for their Done...
+`);
+  return waitForDone({ run: run4, tab: asked, who });
+}
+async function waitForDone({
+  run: run4,
+  tab,
+  who
+}) {
+  const { context, args, client, channel, print: print9 } = run4;
+  const seconds = Number(flagText({ args, name: "wait" }) || ASK_WAIT_SECONDS);
+  if (!(seconds > 0)) throw new CliUsageError(BROWSER_TAB_USAGE);
+  const deadline = context.nowMs() + seconds * 1e3;
+  while (context.nowMs() < deadline) {
+    await context.sleep(Math.min(ASK_POLL_MS, Math.max(0, deadline - context.nowMs())));
+    const now = await client.post(BROWSER_TAB_PATHS.get, { tab: tab.id, ...channel });
+    if (!now.ask) return print9(now, `${who} pressed Done. ${now.title} shows ${now.url}
+`);
+  }
+  print9(
+    tab,
+    `${who} has not pressed Done yet; the request stays open. Wait for their "Done" message.
 `
   );
+  return 75;
+}
+async function loginOnTab(run4) {
+  const { context, args, client, channel, json: json5 } = run4;
+  const tab = word({ args, at: 2 });
+  const connection = flagText({ args, name: "vault" });
+  if (!connection)
+    throw new CliUsageError(
+      `Name the saved sign-in with --vault <connection>
+${BROWSER_TAB_USAGE}`
+    );
+  const reason = flagText({ args, name: "reason" }) || `Sign in on the ${tab} browser tab of the conversation`;
+  const released = await vaultRelease({
+    context,
+    args,
+    connection,
+    reason,
+    command: ["laze", "browser", "login", tab]
+  });
+  if ("exitCode" in released) return released.exitCode;
+  const [problem] = unusableFieldProblems({ fields: released.env });
+  if (problem !== void 0) {
+    context.err(`laze browser login: ${connection}: ${problem}. Nothing was typed.
+`);
+    return 1;
+  }
+  const values = loginValuesOf({
+    connection,
+    values: released.env,
+    userField: flagText({ args, name: "user-field" }) || void 0,
+    passField: flagText({ args, name: "pass-field" }) || void 0
+  });
+  if ("refusal" in values) {
+    context.err(`${values.refusal}
+`);
+    return 1;
+  }
+  const userInput = flagText({ args, name: "user-input" });
+  const passInput = flagText({ args, name: "pass-input" });
+  const answer4 = await client.post(BROWSER_TAB_PATHS.login, {
+    tab,
+    ...values,
+    ...userInput ? { userInput } : {},
+    ...passInput ? { passInput } : {},
+    ...channel
+  });
+  const screenshotPath = answer4.screenshot ? await savedScreenshot({
+    tabId: answer4.tabId,
+    data: answer4.screenshot,
+    nowMs: context.nowMs()
+  }) : null;
+  const { screenshot: _shown, ...rest } = answer4;
+  if (json5) context.out(`${JSON.stringify({ ...rest, screenshotPath }, null, 2)}
+`);
+  else context.out(loginText({ answer: answer4, tab, screenshotPath }));
+  return answer4.state === "refused" || answer4.state === "still_on_form" ? 1 : 0;
+}
+function loginText({
+  answer: answer4,
+  tab,
+  screenshotPath
+}) {
+  const page = `${answer4.title || "(no title)"}
+${answer4.url}
+`;
+  const shot = screenshotPath ? `Screenshot: ${screenshotPath}
+` : "";
+  if (answer4.state === "signed_in") return `Signed in.
+${page}${shot}`;
+  if (answer4.state === "second_step")
+    return `The site asks for a second step (a code or an emailed link). Asked ${answer4.askedUserName ?? "the person"} in the conversation to finish it in the tab;
+wait for their "Done" message before you go on.
+${page}${shot}`;
+  if (answer4.state === "refused")
+    return `The site refused the sign-in: ${answer4.error ?? "no reason shown"}
+${page}${shot}`;
+  return `Still on the sign-in page after submitting. Look at the screenshot, then ask the person in the tab:
+laze browser ask ${tab} "Finish signing in"
+${page}${shot}`;
+}
+async function savedScreenshot({
+  tabId,
+  data,
+  nowMs
+}) {
+  const folder = join20(tmpdir3(), "laze-browser");
+  await mkdir18(folder, { recursive: true, mode: 448 });
+  const path = join20(folder, `${tabId.replace(/[^a-zA-Z0-9_-]/g, "_")}-login-${nowMs}.jpg`);
+  await writeFile18(path, Buffer.from(data, "base64"), { mode: 384 });
+  return path;
 }
 async function shareTab({ args, client, channel, print: print9 }) {
   const tab = word({ args, at: 2 });
@@ -76714,6 +77376,7 @@ var TAB_RUNS = {
   goto: gotoTab,
   read: readTab,
   ask: askOnTab,
+  login: loginOnTab,
   share: shareTab,
   close: closeTab
 };
@@ -76727,7 +77390,7 @@ async function browserTab({
   const json5 = Boolean(args.flags.json);
   const print9 = (value, text2) => context.out(json5 ? `${JSON.stringify(value, null, 2)}
 ` : text2);
-  await handler({ context, args, client, channel: channelOf({ context, args }), json: json5, print: print9 });
+  return handler({ context, args, client, channel: channelOf({ context, args }), json: json5, print: print9 });
 }
 async function browserTabCdp({
   context,
@@ -77142,7 +77805,7 @@ var PATHS2 = {
   wake: "/api/compute/machines/wake",
   delete: "/api/compute/machines/delete"
 };
-var USAGE6 = [
+var BROWSER_USAGE = [
   "Usage: laze browser setup <site> [--name <machine>]   a machine with Chrome a person signs in on",
   "       laze browser setup <site> --on <machine>       the same on a person's own machine (laze machine list)",
   "       laze browser cdp <machine>                     a CDP address for this turn (Playwright connectOverCDP)",
@@ -77152,7 +77815,7 @@ var USAGE6 = [
   "",
   BROWSER_TAB_USAGE
 ].join("\n");
-async function turnTokenOf2({
+async function turnTokenOf3({
   context,
   args,
   client,
@@ -77162,7 +77825,7 @@ async function turnTokenOf2({
   const pinned = env.LAZE_TURN_TOKEN?.trim();
   if (pinned) return pinned;
   if (env.LAZE_TURN_FILE) {
-    return readFile17(env.LAZE_TURN_FILE, "utf8").then(
+    return readFile18(env.LAZE_TURN_FILE, "utf8").then(
       (text2) => text2.trim(),
       () => ""
     );
@@ -77175,7 +77838,7 @@ async function computeClient({
   args
 }) {
   const { client, profile } = await signedIn({ context, args });
-  const turn = await turnTokenOf2({ context, args, client, agent: profile.kind === "agent" });
+  const turn = await turnTokenOf3({ context, args, client, agent: profile.kind === "agent" });
   return turn ? client.withHeaders({ "x-laze-turn": turn }) : client;
 }
 function siteLine(machine2) {
@@ -77189,12 +77852,12 @@ function statusLine(machine2) {
 }
 function machineArg({ args }) {
   const machine2 = args.words[2];
-  if (!machine2) throw new CliUsageError(USAGE6);
+  if (!machine2) throw new CliUsageError(BROWSER_USAGE);
   return machine2;
 }
 async function setup({ context, args }) {
   const site = args.words[2];
-  if (!site) throw new CliUsageError(USAGE6);
+  if (!site) throw new CliUsageError(BROWSER_USAGE);
   const name3 = flagText({ args, name: "name" }) || void 0;
   const on = flagText({ args, name: "on" }) || void 0;
   const client = await computeClient({ context, args });
@@ -77252,7 +77915,7 @@ async function answering({
 }
 function bridgeStatePath({ context, machine: machine2 }) {
   const safe = machine2.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join19(dirname17(context.environment.configPath), "bridges", `${safe}.json`);
+  return join21(dirname18(context.environment.configPath), "bridges", `${safe}.json`);
 }
 async function bridgePort({
   context,
@@ -77260,7 +77923,7 @@ async function bridgePort({
   access
 }) {
   const path = bridgeStatePath({ context, machine: machine2 });
-  const live = await readFile17(path, "utf8").then(
+  const live = await readFile18(path, "utf8").then(
     (text2) => JSON.parse(text2),
     () => void 0
   );
@@ -77273,15 +77936,15 @@ async function bridgePort({
     key,
     ...target
   });
-  await mkdir17(dirname17(path), { recursive: true, mode: 448 });
-  await writeFile17(path, JSON.stringify({ port, key }), { mode: 384 });
+  await mkdir19(dirname18(path), { recursive: true, mode: 448 });
+  await writeFile19(path, JSON.stringify({ port, key }), { mode: 384 });
   return port;
 }
 async function bridge({ context }) {
   const env = context.environment.inherited;
   const target = env.LAZE_CDP_TARGET;
   const expiresAt = env.LAZE_CDP_EXPIRES_AT;
-  if (!target || !expiresAt) throw new CliUsageError(USAGE6);
+  if (!target || !expiresAt) throw new CliUsageError(BROWSER_USAGE);
   let until = Temporal3.Instant.from(expiresAt).epochMilliseconds;
   const running = await startCdpBridge({
     target,
@@ -77338,8 +78001,21 @@ async function change({
 `);
   context.out(statusLine(machine2));
 }
-var TAB_COMMANDS = /* @__PURE__ */ new Set(["open", "tabs", "tab", "goto", "read", "ask", "share", "close"]);
-async function browser({ context, args }) {
+var TAB_COMMANDS = /* @__PURE__ */ new Set([
+  "open",
+  "tabs",
+  "tab",
+  "goto",
+  "read",
+  "ask",
+  "login",
+  "share",
+  "close"
+]);
+async function browser({
+  context,
+  args
+}) {
   const command = args.words[1];
   if (command && TAB_COMMANDS.has(command))
     return browserTab({ context, args, client: await computeClient({ context, args }) });
@@ -77350,7 +78026,7 @@ async function browser({ context, args }) {
   if (command === "status") return status3({ context, args });
   if (command === "sleep" || command === "wake" || command === "delete")
     return change({ context, args, path: PATHS2[command] });
-  throw new CliUsageError(USAGE6);
+  throw new CliUsageError(BROWSER_USAGE);
 }
 
 // src/rules/channel-format.rules.ts
@@ -77922,7 +78598,7 @@ async function channelSettings({ context, args }) {
 }
 
 // src/services/chat-actions-commands.service.ts
-import { readFile as readFile18 } from "node:fs/promises";
+import { readFile as readFile19 } from "node:fs/promises";
 import { basename as basename3, isAbsolute as isAbsolute2, relative as relative4, resolve as resolve7 } from "node:path";
 
 // src/rules/file-types.rules.ts
@@ -78004,7 +78680,7 @@ async function uploadFile({
 
 // src/services/thread-wait-commands.service.ts
 var USAGE7 = "Usage: laze thread <message-id> --wait-reply [--timeout <1-3600 seconds>]";
-var POLL_MS = 3e3;
+var POLL_MS2 = 3e3;
 function timeoutOf({ args }) {
   const seconds = Number(flagText({ args, name: "timeout", fallback: "600" }));
   if (!Number.isInteger(seconds) || seconds < 1 || seconds > 3600) throw new CliUsageError(USAGE7);
@@ -78021,8 +78697,8 @@ async function threadWaitReply({
   const read3 = () => client.post(CHAT_KEY_PATHS.thread, { messageId });
   const seen = new Set((await read3()).replies.map((reply2) => reply2.id));
   const isNew = (reply2) => reply2.author.kind === "person" && !seen.has(reply2.id);
-  for (let waited = 0; waited < seconds * 1e3; waited += POLL_MS) {
-    await context.sleep(POLL_MS);
+  for (let waited = 0; waited < seconds * 1e3; waited += POLL_MS2) {
+    await context.sleep(POLL_MS2);
     const reply2 = (await read3()).replies.find(isNew);
     if (!reply2) continue;
     const line = `${reply2.seq}	${reply2.id}	person ${reply2.author.id}	${reply2.body}
@@ -78260,7 +78936,7 @@ function uploadNameOf({ cwd, path }) {
 }
 var fileUpload = async ({ context, args, client }) => {
   const path = resolve7(context.cwd, wordAt(args, 3));
-  const bytes = new Uint8Array(await readFile18(path));
+  const bytes = new Uint8Array(await readFile19(path));
   const answer4 = await uploadFile({
     context,
     client,
@@ -78433,7 +79109,7 @@ async function chatActions({
 }
 
 // src/services/claude-monitor.service.ts
-import { readFile as readFile19, rm as rm9 } from "node:fs/promises";
+import { readFile as readFile20, rm as rm10 } from "node:fs/promises";
 var MONITOR_IDLE_MS = 3e4;
 var MONITOR_OUTRANKED_MS = 3e3;
 async function deliverOnce({
@@ -78495,7 +79171,7 @@ async function monitorRound(turn) {
 async function release({ context, profile }) {
   const lock = statePathOf({ context, kind: "waiters", profile });
   if ((await holderOf({ path: lock }))?.pid === context.processes.pid)
-    await rm9(lock, { force: true });
+    await rm10(lock, { force: true });
 }
 async function monitorHook({ context, args }) {
   const claudePid = await claudePidOf({ context });
@@ -78534,7 +79210,7 @@ async function monitorSessionOf({
   const fromEnv = sessionOf({ context, harness: "claude-code", sessionId });
   if (fromEnv || !claudePid) return fromEnv;
   const path = statePathOf({ context, kind: "sessions", profile: String(claudePid) });
-  return readFile19(path, "utf8").then(
+  return readFile20(path, "utf8").then(
     (text2) => JSON.parse(text2),
     () => void 0
   );
@@ -78571,6 +79247,8 @@ var browserTabDefinition = external_exports.object({
   /** What an agent asked a person to do in the tab, until someone who may answer presses Done. */
   ask: browserTabAskDefinition.nullable(),
   createdAt: external_exports.iso.datetime(),
+  /** Only on an open: an open tab of that title was reused instead of making a second one. */
+  reused: external_exports.boolean().optional(),
   /** What the reader may do: see the screen, type into it, change the tab; asked: the open
    *  request names them. */
   you: external_exports.object({
@@ -78618,6 +79296,31 @@ var shareDefinition = external_exports.object({
   sharing: browserTabSharingSchema
 });
 var browserTabShareInputSchema = shareDefinition;
+var loginDefinition = external_exports.object({
+  ...browserTabRefDefinition.shape,
+  username: external_exports.string().min(1).max(1e3).optional(),
+  password: external_exports.string().min(1).max(1e3),
+  userInput: external_exports.string().trim().min(1).max(300).optional(),
+  passInput: external_exports.string().trim().min(1).max(300).optional()
+});
+var browserLoginStateSchema = external_exports.enum([
+  "signed_in",
+  "second_step",
+  "refused",
+  "still_on_form"
+]);
+var loginAnswerDefinition = external_exports.object({
+  tabId: external_exports.string().min(1),
+  url: external_exports.string(),
+  title: external_exports.string(),
+  state: browserLoginStateSchema,
+  /** The page's error line when it refused the sign-in. */
+  error: external_exports.string().nullable(),
+  /** The screen after submitting, a JPEG in base64; null when the browser gave none. */
+  screenshot: external_exports.string().nullable(),
+  /** On a second step: the person the tab now asks to finish it. */
+  askedUserName: external_exports.string().nullable()
+});
 var browserTabPageDefinition = external_exports.object({
   tabId: external_exports.string().min(1),
   url: external_exports.string(),
@@ -78657,6 +79360,7 @@ var restBrowserTabInputDefinition = browserTabRefDefinition.omit({ workspaceId:
 var restBrowserTabGotoInputDefinition = gotoDefinition.omit({ workspaceId: true });
 var restBrowserTabAskInputDefinition = askDefinition.omit({ workspaceId: true });
 var restBrowserTabShareInputDefinition = shareDefinition.omit({ workspaceId: true });
+var restBrowserTabLoginInputDefinition = loginDefinition.omit({ workspaceId: true });
 
 // ../../modules/compute/contract/src/compute.config.ts
 var computeConfig = Config.define((c) => ({
@@ -79969,6 +80673,7 @@ var machineWatchStateDefinition = external_exports.object({
 var computeUi = uiTokens("compute");
 var ComputeBrowserTabSlot = computeUi.component("browser-tab");
 var ComputeOpenBrowserSlot = computeUi.component("open-browser");
+var ComputeBrowserLinkOfferSlot = computeUi.component("browser-link-offer");
 
 // src/services/computer-fleet-commands.service.ts
 var COMPUTER_FLEET_USAGE = `  laze computer mine [--json]        every Laze computer your agents may run on, your default one first
@@ -80242,10 +80947,10 @@ async function computer({ context, args }) {
 }
 
 // src/services/connect-commands.service.ts
-import { readFile as readFile21 } from "node:fs/promises";
+import { readFile as readFile22 } from "node:fs/promises";
 
 // src/services/mcp-gateway.service.ts
-import { readFile as readFile20 } from "node:fs/promises";
+import { readFile as readFile21 } from "node:fs/promises";
 import { createInterface as createInterface3 } from "node:readline";
 var TURN_HEADER = "x-laze-turn";
 function serveMcpGateway({
@@ -80288,7 +80993,7 @@ async function relayMcpLines({
   const github3 = env.LAZE_GITHUB_CONNECTION;
   const url2 = `${profile.url.replace(/\/+$/, "")}/api/connectors/mcp/${encodeURIComponent(profile.agentId)}${github3 ? `?github=${encodeURIComponent(github3)}` : ""}`;
   const turnFile = env.LAZE_TURN_FILE;
-  const readTurn = () => readFile20(turnFile, "utf8").then(
+  const readTurn = () => readFile21(turnFile, "utf8").then(
     (text2) => text2.trim(),
     () => ""
   );
@@ -80378,7 +81083,7 @@ async function turnOf({ context }) {
   const pinned = env.LAZE_TURN_TOKEN?.trim();
   if (pinned) return pinned;
   const file3 = env.LAZE_TURN_FILE;
-  const turn = file3 ? await readFile21(file3, "utf8").then(
+  const turn = file3 ? await readFile22(file3, "utf8").then(
     (text2) => text2.trim(),
     () => ""
   ) : "";
@@ -80711,335 +81416,6 @@ var listDevices = async ({ context, args }) => {
   }
 };
 
-// src/services/vault-commands.service.ts
-import { createHash as createHash2 } from "node:crypto";
-import { mkdir as mkdir18, readFile as readFile22, rm as rm10, writeFile as writeFile18 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname18, join as join20 } from "node:path";
-var USAGE8 = `Usage: laze vault run <connection> --reason "<one plain sentence>" [--wait <s>] -- <command> [args...]
-Runs the command with the connection's values in its environment, on a Laze agent's computer,
-on a machine it runs on, or where a connected agent runs, with its own key.
-  --channel <id>   the conversation whose turn it runs in, when the agent answers in several`;
-var POLL_MS2 = 3e3;
-var RESTART_WAIT_MS = 12e4;
-var RESTART_BACKOFF_MS = [1e3, 2e3, 4e3, 8e3, 1e4];
-var P2562 = { name: "ECDH", namedCurve: "P-256" };
-var ServerGoneError = class extends Error {
-};
-function proxyOf({ env }) {
-  const raw = env.LAZE_VAULT_PROXY || env.HTTP_PROXY || env.http_proxy;
-  if (!raw) return null;
-  const url2 = new URL(raw);
-  const user = decodeURIComponent(url2.username);
-  const password = decodeURIComponent(url2.password);
-  return {
-    origin: url2.origin,
-    authorization: `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`
-  };
-}
-function turnFileOf({
-  env
-}) {
-  return env.LAZE_TURN_FILE || void 0;
-}
-async function turnTokenOf3({
-  env,
-  turnFile,
-  command = "laze vault run"
-}) {
-  const pinned = env.LAZE_TURN_TOKEN?.trim();
-  if (pinned) return pinned;
-  if (!turnFile) throw new CliUsageError(`${command} works only during an agent's turn`);
-  try {
-    return (await readFile22(turnFile, "utf8")).trim();
-  } catch {
-    throw new CliUsageError(`${command} works only during an agent's turn`);
-  }
-}
-function runKeyPathOf({
-  turnFile,
-  connection,
-  profile = ""
-}) {
-  const name3 = createHash2("sha256").update(connection).digest("hex");
-  const base = turnFile ? dirname18(turnFile) : join20(tmpdir2(), "laze-vault", profile);
-  return join20(base, "vault-run-keys", `${name3}.json`);
-}
-async function runKeyAt({ path }) {
-  const saved3 = await readFile22(path, "utf8").then(
-    (text2) => JSON.parse(text2),
-    () => void 0
-  );
-  if (saved3 && typeof saved3.publicKey === "string" && saved3.privateKey) {
-    const privateKey = await globalThis.crypto.subtle.importKey("jwk", saved3.privateKey, P2562, false, ["deriveBits"]).catch(() => void 0);
-    if (privateKey) return { privateKey, publicKey: saved3.publicKey };
-  }
-  const fresh = await generateEcdhKeys();
-  const jwk = await globalThis.crypto.subtle.exportKey("jwk", fresh.privateKey);
-  await mkdir18(dirname18(path), { recursive: true, mode: 448 });
-  await writeFile18(path, JSON.stringify({ publicKey: fresh.publicKey, privateKey: jwk }), {
-    mode: 384
-  });
-  return fresh;
-}
-function connectionRefused(error62) {
-  const cause = error62.cause;
-  if (cause?.code === "ECONNREFUSED") return true;
-  return cause?.errors?.some((inner) => inner.code === "ECONNREFUSED") ?? false;
-}
-async function sendOnce({
-  context,
-  url: url2,
-  init
-}) {
-  let response;
-  try {
-    response = await context.fetcher(url2, init);
-  } catch (error62) {
-    const wasRefused = connectionRefused(error62);
-    if (init.method === "POST" && !wasRefused) throw error62;
-    return { restarting: wasRefused ? "connection refused" : String(error62) };
-  }
-  if (response.status !== 502 && response.status !== 503) return { response };
-  const code = codeOf(await response.clone().text());
-  const neverReached = response.status === 503 && code === "vault_not_answering";
-  if (init.method === "POST" && !neverReached) return { response };
-  return { restarting: `status ${response.status}${code ? ` ${code}` : ""}` };
-}
-async function reach(input2) {
-  const { context } = input2;
-  const started = context.nowMs();
-  for (let attempt = 0; ; attempt += 1) {
-    const sent = await sendOnce(input2);
-    if ("response" in sent) return sent.response;
-    if (context.nowMs() - started >= RESTART_WAIT_MS) {
-      throw new ServerGoneError(
-        `laze vault: the Laze server did not come back (${sent.restarting})`
-      );
-    }
-    if (attempt === 0) {
-      context.err(
-        `laze vault: the Laze server is not answering (${sent.restarting}), probably restarting; waiting up to 2 min...
-`
-      );
-    }
-    await context.sleep(RESTART_BACKOFF_MS[Math.min(attempt, RESTART_BACKOFF_MS.length - 1)] ?? 0);
-  }
-}
-function codeOf(text2) {
-  return /"code"\s*:\s*"([^"]+)"/.exec(text2)?.[1];
-}
-async function releaseOf({ response }) {
-  const text2 = await response.text();
-  if (!response.ok) {
-    return {
-      outcome: "deny",
-      exitCode: 1,
-      message: `laze vault: the release was refused (${codeOf(text2) ?? `status ${response.status}`})`
-    };
-  }
-  return JSON.parse(text2);
-}
-async function envOf({
-  release: release2,
-  run: run4
-}) {
-  if (!release2.sealed) return release2.env;
-  const sealed = await openRunRelease({
-    release: release2.sealed,
-    runPrivateKey: run4.privateKey,
-    runPublicKey: run4.publicKey,
-    requestId: release2.sealed.requestId
-  });
-  return { ...release2.env, ...sealed };
-}
-function deadlineOf({ args, nowMs }) {
-  const wait = flagText({ args, name: "wait" }) || (args.flags.wait === true ? args.words[3] : "");
-  if (!wait) return Infinity;
-  if (!(Number(wait) >= 0)) throw new CliUsageError(`--wait takes a number of seconds
-${USAGE8}`);
-  return nowMs + Number(wait) * 1e3;
-}
-async function untilAnswered({
-  context,
-  first,
-  next,
-  deadline
-}) {
-  let release2 = first;
-  while (release2.outcome === "ask") {
-    if (context.nowMs() + POLL_MS2 > deadline) {
-      context.err(`${release2.message}. Not approved yet; ask again later.
-`);
-      return "capped";
-    }
-    if (release2 === first) {
-      context.err(`${release2.message}. Waiting for an answer (cards expire after 12 hours)...
-`);
-    }
-    await context.sleep(POLL_MS2);
-    release2 = await next(release2.requestId);
-  }
-  return release2;
-}
-function leaseHolds({
-  release: release2,
-  nowMs
-}) {
-  const ends = release2.sealed?.leaseEndsAt;
-  return ends !== void 0 && Temporal3.Instant.from(ends).epochMilliseconds > nowMs;
-}
-async function vaultRelease({
-  context,
-  args,
-  connection,
-  reason,
-  command
-}) {
-  const deadline = deadlineOf({ args, nowMs: context.nowMs() });
-  const env = context.environment.inherited;
-  const proxy = proxyOf({ env });
-  if (!proxy) return keyRelease({ context, args, connection, reason, command, deadline });
-  const turnFile = turnFileOf({ env });
-  const headers = {
-    "proxy-authorization": proxy.authorization,
-    "x-laze-turn": await turnTokenOf3({ env, turnFile })
-  };
-  const keyPath = runKeyPathOf({ turnFile, connection });
-  const run4 = await runKeyAt({ path: keyPath });
-  const body = JSON.stringify({ connection, reason, command, recipient: run4.publicKey });
-  let release2;
-  try {
-    const first = await releaseOf({
-      response: await reach({
-        context,
-        url: `${proxy.origin}/vault/release`,
-        init: { method: "POST", headers: { ...headers, "content-type": "application/json" }, body }
-      })
-    });
-    const next = async (requestId) => releaseOf({
-      response: await reach({
-        context,
-        url: `${proxy.origin}/vault/release/${encodeURIComponent(requestId)}`,
-        init: { method: "GET", headers }
-      })
-    });
-    release2 = await untilAnswered({ context, first, next, deadline });
-  } catch (error62) {
-    if (!(error62 instanceof ServerGoneError)) throw error62;
-    context.err(`${error62.message}. Run the command again to keep waiting.
-`);
-    return { exitCode: 75 };
-  }
-  return settled({ context, release: release2, run: run4, keyPath });
-}
-async function settled({
-  context,
-  release: release2,
-  run: run4,
-  keyPath
-}) {
-  if (release2 === "capped") return { exitCode: 75 };
-  if (release2.outcome === "deny") {
-    await rm10(keyPath, { force: true });
-    context.err(`${release2.message}
-`);
-    return { exitCode: release2.exitCode || 1 };
-  }
-  const values = await envOf({ release: release2, run: run4 });
-  if (!leaseHolds({ release: release2, nowMs: context.nowMs() })) await rm10(keyPath, { force: true });
-  if (release2.message) context.err(`${release2.message}
-`);
-  return { env: values };
-}
-function refusedRelease(error62) {
-  if (!(error62 instanceof LazeApiError)) throw error62;
-  return {
-    outcome: "deny",
-    exitCode: 1,
-    message: `laze vault: the release was refused: ${error62.message} (${error62.code})`
-  };
-}
-async function keyRelease({
-  context,
-  args,
-  connection,
-  reason,
-  command,
-  deadline
-}) {
-  const where = new CliUsageError(
-    "laze vault run works only on a Laze agent's computer, on a machine it runs on, or signed in as a connected agent"
-  );
-  const signed2 = await signedIn({ context, args }).catch(() => null);
-  if (signed2?.profile.kind !== "agent") throw where;
-  const { client, name: name3 } = signed2;
-  const channelId = flagText({ args, name: "channel" }) || null;
-  const keyPath = runKeyPathOf({ turnFile: void 0, connection, profile: name3 });
-  const run4 = await runKeyAt({ path: keyPath });
-  const first = await client.post("/api/agents/me/vault/release", {
-    connection,
-    reason,
-    command,
-    recipient: run4.publicKey,
-    channelId
-  }).catch(refusedRelease);
-  const next = (requestId) => client.post("/api/agents/me/vault/release-status", { requestId, channelId }).catch(refusedRelease);
-  const release2 = await untilAnswered({ context, first, next, deadline });
-  return settled({ context, release: release2, run: run4, keyPath });
-}
-async function vaultRun({
-  context,
-  args
-}) {
-  const connection = args.words[2];
-  const reason = flagText({ args, name: "reason" });
-  if (!connection || args.rest.length === 0) throw new CliUsageError(USAGE8);
-  if (!reason) throw new CliUsageError(`Say why with --reason "<one plain sentence>"
-${USAGE8}`);
-  const foreign = commandReferenceNames({ command: args.rest }).find(
-    (name3) => vaultReferenceConnectionName({ name: name3 }) !== connection
-  );
-  if (foreign !== void 0) {
-    const named = vaultReferenceConnectionName({ name: foreign });
-    context.err(
-      `laze vault: the command names {{vault:${foreign}}}, but this run releases only ${connection}, not ${named}. Nothing was asked and the command did not run.
-`
-    );
-    return 1;
-  }
-  const released = await vaultRelease({ context, args, connection, reason, command: args.rest });
-  if ("exitCode" in released) return released.exitCode;
-  const prepared = preparedCommand({
-    command: args.rest,
-    released: /* @__PURE__ */ new Map([[connection, released.env]])
-  });
-  if ("refusal" in prepared) {
-    context.err(`${prepared.refusal}
-`);
-    return 1;
-  }
-  return context.runCommand({ command: prepared.command, env: released.env });
-}
-function preparedCommand({
-  command,
-  released
-}) {
-  for (const [name3, fields] of released) {
-    const [problem] = unusableFieldProblems({ fields });
-    if (problem !== void 0) {
-      return {
-        refusal: `laze vault: ${name3}: ${problem}, so the command did not run. Ask its owner to save the real value on the vault page.`
-      };
-    }
-  }
-  const filled = fillCommandReferences({ command, released });
-  if ("refusal" in filled) {
-    return { refusal: `laze vault: ${filled.refusal}. The command did not run.` };
-  }
-  return filled;
-}
-
 // src/services/vault-share-commands.service.ts
 var SHARE_USAGE2 = "Usage: laze vault share <connection> --with <email|userId> [--for 1h]";
 var WAITING_LINE = "It waits for the owner's approval with a passkey or Face ID, in Settings > Vault.";
@@ -81058,7 +81434,7 @@ async function inTurn({
   command
 }) {
   const env = context.environment.inherited;
-  const turn = await turnTokenOf3({ env, turnFile: turnFileOf({ env }), command });
+  const turn = await turnTokenOf2({ env, turnFile: turnFileOf({ env }), command });
   return client.withHeaders({ "x-laze-turn": turn });
 }
 function printShare({ context, grant }) {
@@ -81742,16 +82118,16 @@ function dndLine({ pausedUntil }) {
 }
 
 // src/services/dnd-commands.service.ts
-var USAGE9 = "Usage: laze dnd 30m|1h|2h|until <HH:mm|ISO time> [--tz <zone>], laze dnd off";
+var USAGE8 = "Usage: laze dnd 30m|1h|2h|until <HH:mm|ISO time> [--tz <zone>], laze dnd off";
 async function dnd({ context, args }) {
   const timeZone = flagText({ args, name: "tz" }) || Intl.DateTimeFormat().resolvedOptions().timeZone;
   let input2;
   try {
     input2 = dndInputOf({ words: args.words.slice(1), now: nowInstant(), timeZone });
   } catch {
-    throw new CliUsageError(USAGE9);
+    throw new CliUsageError(USAGE8);
   }
-  if (!input2) throw new CliUsageError(USAGE9);
+  if (!input2) throw new CliUsageError(USAGE8);
   const { client } = await signedIn({ context, args });
   const settings2 = await client.post(
     "/api/agents/me/notifications/snooze",
@@ -81770,8 +82146,8 @@ var DOMAINS_USAGE = `Usage:
 var printJson5 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
 `);
 function printDomain(context, row) {
-  const join25 = row.autoJoin ? "auto-join on" : "auto-join off";
-  context.out(`${row.domain}	${join25}${row.enforced ? "	single sign-on enforced" : ""}
+  const join26 = row.autoJoin ? "auto-join on" : "auto-join off";
+  context.out(`${row.domain}	${join26}${row.enforced ? "	single sign-on enforced" : ""}
 `);
 }
 async function list4({ context, args }) {
@@ -82000,6 +82376,8 @@ var feedApprovalSchemaDefinition = external_exports.object({
   why: external_exports.string(),
   /** The longest lease Allow for this agent may give; null offers only once and deny. */
   maxLeaseSeconds: external_exports.number().int().positive().nullable(),
+  /** A vault card whose Allow covers the rest of the agent's turn: "Allow for this task". */
+  coversTask: external_exports.boolean().optional(),
   /** The card's timeout; a publish waits without one. */
   expiresAt: external_exports.iso.datetime().nullable(),
   state: feedApprovalStateSchema,
@@ -82576,7 +82954,7 @@ async function feedAttachmentIdsOf({
 }
 
 // src/services/feed-commands.service.ts
-var USAGE10 = `Usage:
+var USAGE9 = `Usage:
   laze feed post <title> [--channel <channel>] [--tag <tag>] [--summary <line>]
     [--draft <text|@file>] [--draft-header "To: ...\\nRe: ..."]
     [--metric <json|@file.json> | --table <csv|@file.csv>]
@@ -82647,7 +83025,7 @@ function printItem({
 }
 async function feedPost({ context, args }) {
   const title = args.words.slice(2).join(" ").trim();
-  if (!title) throw new CliUsageError(USAGE10);
+  if (!title) throw new CliUsageError(USAGE9);
   const flags2 = flagsOf(args);
   const { client } = await signedIn({ context, args });
   const channel = flagText({ args, name: "channel" });
@@ -82669,7 +83047,7 @@ async function feedPost({ context, args }) {
 }
 async function feedUpdate({ context, args }) {
   const itemId = args.words[2];
-  if (!itemId) throw new CliUsageError(USAGE10);
+  if (!itemId) throw new CliUsageError(USAGE9);
   const flags2 = flagsOf(args);
   const { client } = await signedIn({ context, args });
   const body = await bodyOf2({ context, flags: flags2 });
@@ -82685,7 +83063,7 @@ async function feedUpdate({ context, args }) {
 async function feedReply({ context, args }) {
   const itemId = args.words[2];
   const text2 = args.words.slice(3).join(" ").trim();
-  if (!itemId || !text2) throw new CliUsageError(USAGE10);
+  if (!itemId || !text2) throw new CliUsageError(USAGE9);
   const { client } = await signedIn({ context, args });
   const replied = await client.post("/api/feed/items/reply", {
     itemId,
@@ -82698,7 +83076,7 @@ async function feedReply({ context, args }) {
 }
 async function feedRead({ context, args }) {
   const itemId = args.words[2];
-  if (!itemId) throw new CliUsageError(USAGE10);
+  if (!itemId) throw new CliUsageError(USAGE9);
   const { client } = await signedIn({ context, args });
   const read3 = await client.post("/api/feed/items/read", { itemId });
   printItem({ context, args, item: read3 });
@@ -82717,7 +83095,7 @@ async function feedClose({ context, args }) {
   const itemId = args.words[2];
   const loop = flagText({ args, name: "loop" });
   const note = flagText({ args, name: "note" });
-  if (!note || Boolean(itemId) === Boolean(loop)) throw new CliUsageError(USAGE10);
+  if (!note || Boolean(itemId) === Boolean(loop)) throw new CliUsageError(USAGE9);
   const { client } = await signedIn({ context, args });
   const closed = await client.post("/api/feed/items/close", {
     ...itemId ? { itemId } : { loop },
@@ -82743,7 +83121,7 @@ async function feedLoops({ context, args }) {
 }
 async function feedGroupSummary({ context, args }) {
   const group = args.words.slice(2).join(" ").trim();
-  if (!group) throw new CliUsageError(USAGE10);
+  if (!group) throw new CliUsageError(USAGE9);
   const { client } = await signedIn({ context, args });
   const pointer = await client.post("/api/feed/group-summary", { group });
   if (args.flags.json) return context.out(`${JSON.stringify(pointer, null, 2)}
@@ -82823,7 +83201,7 @@ async function feedDecisions({ context, args }) {
 }
 async function feedAct({ context, args }) {
   const [itemId, actionId] = [args.words[2], args.words[3]];
-  if (!itemId || !actionId) throw new CliUsageError(USAGE10);
+  if (!itemId || !actionId) throw new CliUsageError(USAGE9);
   const draft = await textFlag({ context, args, name: "draft" });
   const { client } = await signedIn({ context, args });
   const item = await client.post("/api/feed/mine/act", {
@@ -82836,7 +83214,7 @@ async function feedAct({ context, args }) {
 async function feedComment({ context, args }) {
   const itemId = args.words[2];
   const text2 = args.words.slice(3).join(" ").trim();
-  if (!itemId || !text2) throw new CliUsageError(USAGE10);
+  if (!itemId || !text2) throw new CliUsageError(USAGE9);
   const draft = await textFlag({ context, args, name: "draft" });
   const { client } = await signedIn({ context, args });
   const item = await client.post("/api/feed/mine/comment", {
@@ -82850,7 +83228,7 @@ async function feedComment({ context, args }) {
 function moveItem(path) {
   return async ({ context, args }) => {
     const itemId = args.words[2];
-    if (!itemId) throw new CliUsageError(USAGE10);
+    if (!itemId) throw new CliUsageError(USAGE9);
     const { client } = await signedIn({ context, args });
     const item = await client.post(`/api/feed/mine/${path}`, { itemId });
     printMoved({ context, args, item });
@@ -82859,14 +83237,14 @@ function moveItem(path) {
 async function feedSnooze({ context, args }) {
   const itemId = args.words[2];
   const until = flagText({ args, name: "until" });
-  if (!itemId || !until) throw new CliUsageError(USAGE10);
+  if (!itemId || !until) throw new CliUsageError(USAGE9);
   const { client } = await signedIn({ context, args });
   const item = await client.post("/api/feed/mine/snooze", { itemId, until });
   printMoved({ context, args, item });
 }
 async function feedChannel({ context, args }) {
   const channelId = args.words[2];
-  if (!channelId) throw new CliUsageError(USAGE10);
+  if (!channelId) throw new CliUsageError(USAGE9);
   const { client } = await signedIn({ context, args });
   const items = await client.post("/api/feed/channel", { channelId });
   if (args.flags.json) return context.out(`${JSON.stringify(items, null, 2)}
@@ -82897,7 +83275,7 @@ var FEED_COMMANDS = {
 async function feed({ context, args }) {
   const name3 = args.words[1] ?? "";
   const command = Object.hasOwn(FEED_COMMANDS, name3) ? FEED_COMMANDS[name3] : void 0;
-  if (!command) throw new CliUsageError(USAGE10);
+  if (!command) throw new CliUsageError(USAGE9);
   await command({ context, args });
 }
 
@@ -83393,12 +83771,12 @@ async function ip({ context, args }) {
 }
 
 // src/services/join-commands.service.ts
-import { mkdir as mkdir19, readFile as readFile29, rename as rename5, rm as rm11, writeFile as writeFile19 } from "node:fs/promises";
-import { dirname as dirname19, join as join21 } from "node:path";
+import { mkdir as mkdir20, readFile as readFile29, rename as rename5, rm as rm11, writeFile as writeFile20 } from "node:fs/promises";
+import { dirname as dirname19, join as join22 } from "node:path";
 var DEFAULT_WAIT_SECONDS2 = 100;
 var JOIN_USAGE = "Usage: laze join [--workspace <name|id|invite link>] [--for <email>] [--name <name>] [--note <text>] [--timeout <seconds>] [--project <folder>]";
 function pendingPathOf({ context }) {
-  return join21(dirname19(context.environment.configPath), "join", "pending.json");
+  return join22(dirname19(context.environment.configPath), "join", "pending.json");
 }
 async function readPending({
   context,
@@ -83415,9 +83793,9 @@ async function readPending({
 }
 async function keepPending({ context, pending }) {
   const path = pendingPathOf({ context });
-  await mkdir19(dirname19(path), { recursive: true, mode: 448 });
+  await mkdir20(dirname19(path), { recursive: true, mode: 448 });
   const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile19(temporary, JSON.stringify(pending), { mode: 384 });
+  await writeFile20(temporary, JSON.stringify(pending), { mode: 384 });
   await rename5(temporary, path);
 }
 async function dropPending({ context }) {
@@ -83734,7 +84112,7 @@ function machineAccessCommand(name3) {
 }
 
 // src/services/machine-commands.service.ts
-var USAGE11 = [
+var USAGE10 = [
   "Usage: laze machine connect <name>                       the command to run on your own machine (people)",
   "       laze machine connect <name> --again              a new command for a machine you connected; the old code stops working",
   "       laze machine connect <name> --ssh <user>@<host>[:port]   a machine that cannot run the connector, over SSH (people)",
@@ -83780,7 +84158,7 @@ function listLine(machine2) {
 var EXEC_ENV_MAX = 32;
 function machineArg2({ args }) {
   const machine2 = args.words[2];
-  if (!machine2) throw new CliUsageError(USAGE11);
+  if (!machine2) throw new CliUsageError(USAGE10);
   return machine2;
 }
 async function connect2({ context, args }) {
@@ -83806,7 +84184,7 @@ async function connectSsh({
 }) {
   const ssh = flagText({ args, name: "ssh" });
   if (!ssh) throw new CliUsageError(`--ssh takes <user>@<host>[:port]
-${USAGE11}`);
+${USAGE10}`);
   const client = await computeClient({ context, args });
   const made = await client.post(COMPUTE_REST_PATHS.connectSsh, {
     name: name3,
@@ -83882,11 +84260,11 @@ async function exec({
 }) {
   const machine2 = machineArg2({ args });
   const command = commandText({ rest: args.rest });
-  if (!command.trim()) throw new CliUsageError(USAGE11);
+  if (!command.trim()) throw new CliUsageError(USAGE10);
   const timeout = flagText({ args, name: "timeout" });
   if (timeout && !(Number(timeout) >= 1))
     throw new CliUsageError(`--timeout takes a number of seconds
-${USAGE11}`);
+${USAGE10}`);
   const released = await vaultEnv({ context, args });
   if ("exitCode" in released) return released.exitCode;
   const client = await computeClient({ context, args });
@@ -83914,11 +84292,11 @@ async function vaultEnv({
   const connections = args.lists.vault ?? [];
   if (args.flags.vault === true)
     throw new CliUsageError(`--vault takes a connection name
-${USAGE11}`);
+${USAGE10}`);
   if (connections.length === 0) return {};
   const reason = flagText({ args, name: "reason" });
   if (!reason) throw new CliUsageError(`Say why with --reason "<one plain sentence>"
-${USAGE11}`);
+${USAGE10}`);
   const env = {};
   for (const connection of new Set(connections)) {
     const released = await vaultRelease({ context, args, connection, reason, command: args.rest });
@@ -83938,11 +84316,11 @@ ${USAGE11}`);
 async function host({ context, args }) {
   const machineName = args.words[2];
   const agent2 = args.words[3];
-  if (!machineName || !agent2) throw new CliUsageError(USAGE11);
+  if (!machineName || !agent2) throw new CliUsageError(USAGE10);
   const whenOffline = flagText({ args, name: "when-offline", fallback: "wait" });
   if (whenOffline !== "wait" && whenOffline !== "computer" && whenOffline !== "sandbox")
     throw new CliUsageError(`--when-offline takes wait or computer
-${USAGE11}`);
+${USAGE10}`);
   const client = await computeClient({ context, args });
   const machine2 = await client.post(COMPUTE_REST_PATHS.host, {
     machine: machineName,
@@ -83959,7 +84337,7 @@ ${USAGE11}`);
 }
 async function unhost({ context, args }) {
   const agent2 = args.words[2];
-  if (!agent2) throw new CliUsageError(USAGE11);
+  if (!agent2) throw new CliUsageError(USAGE10);
   const client = await computeClient({ context, args });
   const done = await client.post(COMPUTE_REST_PATHS.unhost, { agent: agent2 });
   if (args.flags.json) return context.out(`${JSON.stringify(done, null, 2)}
@@ -83996,7 +84374,7 @@ async function machine({ context, args }) {
   if (command === "unhost") return unhost({ context, args });
   const access = machineAccessCommand(command);
   if (access) return access({ context, args });
-  throw new CliUsageError(USAGE11);
+  throw new CliUsageError(USAGE10);
 }
 
 // src/services/mcp-server.service.ts
@@ -84235,7 +84613,7 @@ async function serveMcp({
 }
 
 // src/services/mount-files.service.ts
-import { mkdir as mkdir20, readFile as readFile30, rm as rm12, writeFile as writeFile20 } from "node:fs/promises";
+import { mkdir as mkdir21, readFile as readFile30, rm as rm12, writeFile as writeFile21 } from "node:fs/promises";
 import { dirname as dirname20, relative as relative5, resolve as resolve11 } from "node:path";
 async function textArgument({
   context,
@@ -84256,20 +84634,20 @@ async function writeMount({
 }) {
   const root = resolve11(context.cwd, flagText({ args, name: "dir", fallback: ".laze" }), folder);
   await rm12(root, { recursive: true, force: true });
-  await mkdir20(root, { recursive: true });
+  await mkdir21(root, { recursive: true });
   for (const file3 of files2) {
     const target = resolve11(root, file3.path);
     const inside = relative5(root, target);
     if (!inside || inside.startsWith(".."))
       throw new Error(`Refusing to write outside ${root}: ${file3.path}`);
-    await mkdir20(dirname20(target), { recursive: true });
-    await writeFile20(target, file3.content);
+    await mkdir21(dirname20(target), { recursive: true });
+    await writeFile21(target, file3.content);
   }
   return root;
 }
 
 // src/services/memory-commands.service.ts
-var USAGE12 = `Usage:
+var USAGE11 = `Usage:
   laze memory get SOUL.md|AGENTS.md|MEMORY.md [--channel <channel>]
   laze memory set <file> <text|@file|-> [--channel <channel>] [--base <version>]
   laze memory append MEMORY.md <text|@file|-> [--channel <channel>]
@@ -84281,7 +84659,7 @@ MEMORY.md is the file of the turn's channel (LAZE_CHANNEL), or of --channel when
 var FILES = /* @__PURE__ */ new Set(["SOUL.md", "AGENTS.md", "MEMORY.md"]);
 function fileRef({ context, args }) {
   const file3 = args.words[2] ?? "";
-  if (!FILES.has(file3)) throw new CliUsageError(USAGE12);
+  if (!FILES.has(file3)) throw new CliUsageError(USAGE11);
   const channel = turnChannel({ context, args });
   return { file: file3, ...channel ? { channel } : {} };
 }
@@ -84320,7 +84698,7 @@ async function memoryHistory({ context, args }) {
 async function memorySet({ context, args }) {
   const ref = fileRef({ context, args });
   const value = args.words.slice(3).join(" ");
-  if (!value) throw new CliUsageError(USAGE12);
+  if (!value) throw new CliUsageError(USAGE11);
   const content = await textArgument({ context, value });
   const base = args.flags.base;
   const { client } = await signedIn({ context, args });
@@ -84336,7 +84714,7 @@ async function memorySet({ context, args }) {
 async function memoryAppend({ context, args }) {
   const ref = fileRef({ context, args });
   const value = args.words.slice(3).join(" ");
-  if (!value) throw new CliUsageError(USAGE12);
+  if (!value) throw new CliUsageError(USAGE11);
   const text2 = await textArgument({ context, value });
   const { client } = await signedIn({ context, args });
   const saved3 = await client.post("/api/memory/append", { ...ref, text: text2 });
@@ -84346,7 +84724,7 @@ async function memoryAppend({ context, args }) {
 }
 async function memorySearch({ context, args }) {
   const query = args.words.slice(2).join(" ").trim();
-  if (!query) throw new CliUsageError(USAGE12);
+  if (!query) throw new CliUsageError(USAGE11);
   const { client } = await signedIn({ context, args });
   const hits = await client.post("/api/memory/search", { query });
   if (args.flags.json) return context.out(`${JSON.stringify(hits, null, 2)}
@@ -84380,13 +84758,13 @@ var MEMORY_COMMANDS = {
 async function memory({ context, args }) {
   const name3 = args.words[1] ?? "";
   const command = Object.hasOwn(MEMORY_COMMANDS, name3) ? MEMORY_COMMANDS[name3] : void 0;
-  if (!command) throw new CliUsageError(USAGE12);
+  if (!command) throw new CliUsageError(USAGE11);
   await command({ context, args });
 }
 
 // src/services/models-commands.service.ts
 var WINDOWS = ["day", "week", "month"];
-var USAGE13 = `Usage:
+var USAGE12 = `Usage:
   laze models policy                             whether Laze models are on, the default budget and the cap
   laze models set-policy [on|off] [--default-day <usd|none>] [--cap-day <usd|none>] ...   (admins)
       --default-week, --default-month, --cap-week and --cap-month set the other windows
@@ -84411,7 +84789,7 @@ function limitsFrom({
     const value = text2 === "none" ? null : Number(text2);
     if (value !== null && (!Number.isFinite(value) || value < 0))
       throw new CliUsageError(`--${prefix}${window2} takes an amount in USD or none.
-${USAGE13}`);
+${USAGE12}`);
     next[window2] = value;
     changed = true;
   }
@@ -84436,12 +84814,12 @@ async function showPolicy({ context, args }) {
 }
 async function setPolicy({ context, args }) {
   const state = args.words[2];
-  if (state !== void 0 && state !== "on" && state !== "off") throw new CliUsageError(USAGE13);
+  if (state !== void 0 && state !== "on" && state !== "off") throw new CliUsageError(USAGE12);
   const { client } = await signedIn({ context, args });
   const current2 = await client.get("/api/models/policy");
   const defaultBudget = limitsFrom({ args, prefix: "default-", current: current2.defaultBudget });
   const cap = limitsFrom({ args, prefix: "cap-", current: current2.cap });
-  if (!state && !defaultBudget && !cap) throw new CliUsageError(USAGE13);
+  if (!state && !defaultBudget && !cap) throw new CliUsageError(USAGE12);
   const updated = await client.post("/api/models/policy", {
     ...state ? { lazeModels: state === "on" } : {},
     ...defaultBudget ? { defaultBudget } : {},
@@ -84482,11 +84860,11 @@ async function agentNamed({ client, name: name3 }) {
 }
 async function setBudget({ context, args }) {
   const name3 = args.words[2];
-  if (!name3) throw new CliUsageError(USAGE13);
+  if (!name3) throw new CliUsageError(USAGE12);
   const { client } = await signedIn({ context, args });
   const agent2 = await agentNamed({ client, name: name3 });
   const next = limitsFrom({ args, prefix: "", current: agent2.budget });
-  if (!next) throw new CliUsageError(USAGE13);
+  if (!next) throw new CliUsageError(USAGE12);
   const updated = await client.post("/api/models/agents/budget", {
     agentId: agent2.agentId,
     budget: next
@@ -84519,7 +84897,7 @@ var MODEL_COMMANDS = {
 async function models({ context, args }) {
   const name3 = args.words[1] ?? "policy";
   const command = Object.hasOwn(MODEL_COMMANDS, name3) ? MODEL_COMMANDS[name3] : void 0;
-  if (!command) throw new CliUsageError(USAGE13);
+  if (!command) throw new CliUsageError(USAGE12);
   await command({ context, args });
 }
 
@@ -84597,7 +84975,7 @@ var monitorResume = stateRun("/api/agents/monitors/resume", "resume");
 var monitorRemove = stateRun("/api/agents/monitors/remove", "rm");
 
 // src/services/notification-commands.service.ts
-var USAGE14 = `Usage:
+var USAGE13 = `Usage:
   laze notifications [show]                      your notification settings (people)
   laze notifications set [--channels all|mentions|nothing] [--keywords a,b] [--dnd on|off]
       [--dnd-from 22:00] [--dnd-to 08:00] [--tz <IANA zone>] [--push on|off] [--email on|off]
@@ -84626,17 +85004,17 @@ function switchOf({ args, name: name3 }) {
   if (!text2) return void 0;
   if (text2 !== "on" && text2 !== "off")
     throw new CliUsageError(`--${name3} takes on or off.
-${USAGE14}`);
+${USAGE13}`);
   return text2 === "on";
 }
 function changesOf(args) {
   const channels2 = flagText({ args, name: "channels" });
   if (channels2 && !["all", "mentions", "nothing"].includes(channels2))
     throw new CliUsageError(`--channels takes all, mentions or nothing.
-${USAGE14}`);
+${USAGE13}`);
   const keywords = typeof args.flags.keywords === "string" ? args.flags.keywords : void 0;
   const emailAfter = flagText({ args, name: "email-after" });
-  const changes = {
+  const changes2 = {
     channelDefault: channels2 || void 0,
     keywords: keywords?.split(",").map((word3) => word3.trim()).filter(Boolean),
     dndEnabled: switchOf({ args, name: "dnd" }),
@@ -84647,26 +85025,26 @@ ${USAGE14}`);
     emailEnabled: switchOf({ args, name: "email" }),
     emailDelayMinutes: emailAfter ? Number(emailAfter) : void 0
   };
-  return Object.fromEntries(Object.entries(changes).filter(([, value]) => value !== void 0));
+  return Object.fromEntries(Object.entries(changes2).filter(([, value]) => value !== void 0));
 }
 async function showSettings({ context, args }) {
   const { client } = await signedIn({ context, args });
   print7({ context, args, settings: await client.get("/api/agents/me/notifications") });
 }
 async function setSettings({ context, args }) {
-  const changes = changesOf(args);
-  if (Object.keys(changes).length === 0) throw new CliUsageError(USAGE14);
+  const changes2 = changesOf(args);
+  if (Object.keys(changes2).length === 0) throw new CliUsageError(USAGE13);
   const { client } = await signedIn({ context, args });
   print7({
     context,
     args,
-    settings: await client.post("/api/agents/me/notifications", changes)
+    settings: await client.post("/api/agents/me/notifications", changes2)
   });
 }
 async function snoozeFor({ context, args }) {
   const word3 = args.words[2];
   const minutes = word3 === "off" ? 0 : Number(word3);
-  if (!word3 || !Number.isInteger(minutes) || minutes < 0) throw new CliUsageError(USAGE14);
+  if (!word3 || !Number.isInteger(minutes) || minutes < 0) throw new CliUsageError(USAGE13);
   const { client } = await signedIn({ context, args });
   print7({
     context,
@@ -84684,7 +85062,7 @@ var NOTIFICATION_COMMANDS = {
 async function notifications({ context, args }) {
   const name3 = args.words[1] ?? "show";
   const command = Object.hasOwn(NOTIFICATION_COMMANDS, name3) ? NOTIFICATION_COMMANDS[name3] : void 0;
-  if (!command) throw new CliUsageError(USAGE14);
+  if (!command) throw new CliUsageError(USAGE13);
   await command({ context, args });
 }
 
@@ -84921,8 +85299,8 @@ ${OPS_USAGE}`);
 }
 
 // src/services/release-watch.service.ts
-import { mkdir as mkdir21, readFile as readFile31, realpath, writeFile as writeFile21 } from "node:fs/promises";
-import { dirname as dirname21, join as join22 } from "node:path";
+import { mkdir as mkdir22, readFile as readFile31, realpath, writeFile as writeFile22 } from "node:fs/promises";
+import { dirname as dirname21, join as join23 } from "node:path";
 
 // src/rules/cli-update.rules.ts
 var CLI_PACKAGE = "@lazehq/cli";
@@ -85069,15 +85447,15 @@ async function startedUpdate({
   const plan2 = updatePlanOf({ script: await scriptOf(context) });
   if (plan2.kind !== "install") return null;
   const folder = dirname21(context.environment.configPath);
-  const stamp = join22(folder, "auto-update.json");
+  const stamp = join23(folder, "auto-update.json");
   const last = await readFile31(stamp, "utf8").then((text2) => JSON.parse(text2)).catch(() => null);
   const now = context.nowMs();
   if (last?.server === server && now - last.atMs < RETRY_AFTER_MS) return null;
-  await mkdir21(folder, { recursive: true, mode: 448 });
-  await writeFile21(stamp, JSON.stringify({ server, atMs: now }), { mode: 384 });
+  await mkdir22(folder, { recursive: true, mode: 448 });
+  await writeFile22(stamp, JSON.stringify({ server, atMs: now }), { mode: 384 });
   context.processes.spawnDetached({
     argv: [...context.program, "update"],
-    logPath: join22(folder, "auto-update.log")
+    logPath: join23(folder, "auto-update.log")
   });
   return { manager: plan2.manager };
 }
@@ -85188,7 +85566,7 @@ async function rushWakeHook({ context, args }) {
 }
 
 // src/services/schedule-commands.service.ts
-var USAGE15 = `Usage:
+var USAGE14 = `Usage:
   laze schedule add <name> --prompt <text> (--cron "<m h dom mon dow>" | --rrule "<RRULE>" | --at <local time>)
     [--tz <IANA zone>] [--channel <channelId>] [--agent <agentId>]
   laze schedule list
@@ -85203,7 +85581,7 @@ function timingOf(args) {
   const given = [cron, rrule, at].filter(Boolean);
   if (given.length !== 1)
     throw new CliUsageError(`Give exactly one of --cron, --rrule or --at.
-${USAGE15}`);
+${USAGE14}`);
   if (cron) return { kind: "cron", cron };
   if (rrule) return { kind: "rrule", rrule };
   return { kind: "once", at };
@@ -85218,7 +85596,7 @@ function printSchedule({ context, schedule: schedule2 }) {
 async function scheduleAdd({ context, args }) {
   const name3 = args.words.slice(2).join(" ").trim();
   const prompt = flagText({ args, name: "prompt" });
-  if (!name3 || !prompt) throw new CliUsageError(USAGE15);
+  if (!name3 || !prompt) throw new CliUsageError(USAGE14);
   const timing = timingOf(args);
   const { client } = await signedIn({ context, args });
   const channelId = flagText({ args, name: "channel" });
@@ -85236,9 +85614,9 @@ async function scheduleAdd({ context, args }) {
   printSchedule({ context, schedule: schedule2 });
 }
 function changesOf2(args) {
-  const changes = {};
+  const changes2 = {};
   const timed = ["cron", "rrule", "at"].some((name3) => flagText({ args, name: name3 }));
-  if (timed) changes.timing = timingOf(args);
+  if (timed) changes2.timing = timingOf(args);
   for (const [flag2, field] of [
     ["name", "name"],
     ["prompt", "prompt"],
@@ -85246,18 +85624,18 @@ function changesOf2(args) {
     ["agent", "agentId"]
   ]) {
     const value = flagText({ args, name: flag2 });
-    if (value) changes[field] = value;
+    if (value) changes2[field] = value;
   }
   const channel = flagText({ args, name: "channel" });
-  if (channel) changes.channelId = channel === "none" ? null : channel;
-  return changes;
+  if (channel) changes2.channelId = channel === "none" ? null : channel;
+  return changes2;
 }
 async function scheduleUpdate({ context, args }) {
   const scheduleId = args.words[2];
-  const changes = changesOf2(args);
-  if (!scheduleId || Object.keys(changes).length === 0) throw new CliUsageError(USAGE15);
+  const changes2 = changesOf2(args);
+  if (!scheduleId || Object.keys(changes2).length === 0) throw new CliUsageError(USAGE14);
   const { client } = await signedIn({ context, args });
-  const schedule2 = await client.post("/api/schedules/update", { scheduleId, ...changes });
+  const schedule2 = await client.post("/api/schedules/update", { scheduleId, ...changes2 });
   if (args.flags.json) return context.out(`${JSON.stringify(schedule2, null, 2)}
 `);
   printSchedule({ context, schedule: schedule2 });
@@ -85272,7 +85650,7 @@ async function scheduleList({ context, args }) {
 function byId(path) {
   return async ({ context, args }) => {
     const scheduleId = args.words[2];
-    if (!scheduleId) throw new CliUsageError(USAGE15);
+    if (!scheduleId) throw new CliUsageError(USAGE14);
     const { client } = await signedIn({ context, args });
     const answer4 = await client.post(`/api/schedules/${path}`, {
       scheduleId
@@ -85286,7 +85664,7 @@ function byId(path) {
 }
 async function scheduleRuns({ context, args }) {
   const scheduleId = args.words[2];
-  if (!scheduleId) throw new CliUsageError(USAGE15);
+  if (!scheduleId) throw new CliUsageError(USAGE14);
   const { client } = await signedIn({ context, args });
   const runs = await client.post("/api/schedules/runs", { scheduleId });
   if (args.flags.json) return context.out(`${JSON.stringify(runs, null, 2)}
@@ -85300,7 +85678,7 @@ async function scheduleRuns({ context, args }) {
 }
 async function scheduleRun({ context, args }) {
   const scheduleId = args.words[2];
-  if (!scheduleId) throw new CliUsageError(USAGE15);
+  if (!scheduleId) throw new CliUsageError(USAGE14);
   const { client } = await signedIn({ context, args });
   const run4 = await client.post("/api/schedules/run", { scheduleId });
   if (args.flags.json) return context.out(`${JSON.stringify(run4, null, 2)}
@@ -85321,14 +85699,14 @@ var SCHEDULE_COMMANDS = {
 async function schedule({ context, args }) {
   const name3 = args.words[1] ?? "";
   const command = Object.hasOwn(SCHEDULE_COMMANDS, name3) ? SCHEDULE_COMMANDS[name3] : void 0;
-  if (!command) throw new CliUsageError(USAGE15);
+  if (!command) throw new CliUsageError(USAGE14);
   await command({ context, args });
 }
 
 // src/services/skill-commands.service.ts
 import { readdir as readdir7, readFile as readFile33 } from "node:fs/promises";
-import { join as join23, relative as relative6, resolve as resolve13 } from "node:path";
-var USAGE16 = `Usage:
+import { join as join24, relative as relative6, resolve as resolve13 } from "node:path";
+var USAGE15 = `Usage:
   laze skill list [--agent <agentId>]
   laze skill install <catalogue-id> [--as <name>] [--agent <agentId>]
   laze skill install --from <folder> [--as <name>] [--agent <agentId>]   a folder with a SKILL.md
@@ -85348,7 +85726,7 @@ async function folderFiles({ root }) {
   const files2 = [];
   for (const entry of entries) {
     if (!entry.isFile()) continue;
-    const full = join23(entry.parentPath, entry.name);
+    const full = join24(entry.parentPath, entry.name);
     files2.push({ path: relative6(root, full), content: await readFile33(full, "utf8") });
   }
   return files2.toSorted((a, b) => a.path.localeCompare(b.path));
@@ -85377,7 +85755,7 @@ async function skillList({ context, args }) {
 async function skillInstall({ context, args }) {
   const catalogueId = args.words[2];
   const from = flagText({ args, name: "from" });
-  if (!catalogueId === !from) throw new CliUsageError(USAGE16);
+  if (!catalogueId === !from) throw new CliUsageError(USAGE15);
   const name3 = flagText({ args, name: "as" });
   const agent2 = flagText({ args, name: "agent" });
   const files2 = from ? await folderFiles({ root: resolve13(context.cwd, from) }) : void 0;
@@ -85395,7 +85773,7 @@ async function skillInstall({ context, args }) {
 }
 async function skillShow({ context, args }) {
   const name3 = args.words[2];
-  if (!name3) throw new CliUsageError(USAGE16);
+  if (!name3) throw new CliUsageError(USAGE15);
   const agent2 = flagText({ args, name: "agent" });
   const { client } = await signedIn({ context, args });
   const skill2 = await client.post("/api/skills/show", {
@@ -85428,7 +85806,7 @@ function agentFlag(args) {
 }
 async function skillRemove({ context, args }) {
   const name3 = args.words[2];
-  if (!name3) throw new CliUsageError(USAGE16);
+  if (!name3) throw new CliUsageError(USAGE15);
   const { client } = await signedIn({ context, args });
   const removed = await client.post("/api/skills/remove", {
     name: name3,
@@ -85445,7 +85823,7 @@ async function skillUpdate({ context, args }) {
   const description = typeof args.flags.description === "string" ? args.flags.description : void 0;
   const skillMdFile = flagText({ args, name: "skill-md" });
   if (!name3 || !newName && description === void 0 && !skillMdFile) {
-    throw new CliUsageError(USAGE16);
+    throw new CliUsageError(USAGE15);
   }
   const skillMd = skillMdFile ? await readFile33(resolve13(context.cwd, skillMdFile), "utf8") : void 0;
   const { client } = await signedIn({ context, args });
@@ -85464,7 +85842,7 @@ async function skillUpdate({ context, args }) {
 function pinning({ unpin }) {
   return async ({ context, args }) => {
     const name3 = args.words[2];
-    if (!name3) throw new CliUsageError(USAGE16);
+    if (!name3) throw new CliUsageError(USAGE15);
     const { client } = await signedIn({ context, args });
     const path = unpin ? "/api/skills/unpin" : "/api/skills/pin";
     const skill2 = await client.post(path, { name: name3, ...agentFlag(args) });
@@ -85488,7 +85866,7 @@ var SKILL_COMMANDS = {
 async function skill({ context, args }) {
   const name3 = args.words[1] ?? "";
   const command = Object.hasOwn(SKILL_COMMANDS, name3) ? SKILL_COMMANDS[name3] : void 0;
-  if (!command) throw new CliUsageError(USAGE16);
+  if (!command) throw new CliUsageError(USAGE15);
   await command({ context, args });
 }
 
@@ -86099,11 +86477,11 @@ function statusLine2({ presence: presence2 }) {
 }
 
 // src/services/status-commands.service.ts
-var USAGE17 = "Usage: laze status set <emoji> [text] [--for 30m|1h|4h|today|week|never] [--tz <zone>], laze status clear|away|active";
+var USAGE16 = "Usage: laze status set <emoji> [text] [--for 30m|1h|4h|today|week|never] [--tz <zone>], laze status clear|away|active";
 function clearAfterOf({ args }) {
   const wanted = flagText({ args, name: "for", fallback: "never" });
   const known = STATUS_CLEAR_AFTER.find((candidate) => candidate === wanted);
-  if (!known) throw new CliUsageError(USAGE17);
+  if (!known) throw new CliUsageError(USAGE16);
   return known;
 }
 function answer3({
@@ -86117,7 +86495,7 @@ function answer3({
 }
 async function statusSet({ context, args }) {
   const [, , emoji3, ...words] = args.words;
-  if (!emoji3) throw new CliUsageError(USAGE17);
+  if (!emoji3) throw new CliUsageError(USAGE16);
   const clearAfter = clearAfterOf({ args });
   const timeZone = flagText({ args, name: "tz" }) || Intl.DateTimeFormat().resolvedOptions().timeZone;
   const { client } = await signedIn({ context, args });
@@ -86141,7 +86519,7 @@ async function statusAway({ context, args }) {
   answer3({ context, args, presence: presence2 });
 }
 async function statusUsage() {
-  throw new CliUsageError(USAGE17);
+  throw new CliUsageError(USAGE16);
 }
 
 // src/services/update-commands.service.ts
@@ -86265,7 +86643,7 @@ async function update2({
 
 // src/services/vault-env-commands.service.ts
 import { readFile as readFile36, stat as stat5 } from "node:fs/promises";
-import { dirname as dirname22, join as join24, resolve as resolve15 } from "node:path";
+import { dirname as dirname22, join as join25, resolve as resolve15 } from "node:path";
 
 // src/rules/vault-manifest.rules.ts
 var VARIABLE = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -86374,7 +86752,7 @@ async function doorOf({
     const turnFile = turnFileOf({ env });
     const headers = {
       "proxy-authorization": proxy.authorization,
-      "x-laze-turn": await turnTokenOf3({ env, turnFile, command: "laze vault env" })
+      "x-laze-turn": await turnTokenOf2({ env, turnFile, command: "laze vault env" })
     };
     return {
       keyPath: runKeyPathOf({ turnFile, connection: keyName }),
@@ -86444,14 +86822,14 @@ async function untilAllAnswered({
 `
   );
   while (waiting.size > 0) {
-    if (context.nowMs() + POLL_MS2 > deadline) {
+    if (context.nowMs() + POLL_MS > deadline) {
       context.err(
         `laze vault: ${[...waiting.keys()].join(", ")} not approved yet; ask again later.
 `
       );
       return "capped";
     }
-    await context.sleep(POLL_MS2);
+    await context.sleep(POLL_MS);
     for (const [key, pending] of waiting) {
       const next = await door.status(pending.requestId);
       if (next.outcome === "ask") waiting.set(key, next);
@@ -86606,7 +86984,7 @@ async function manifestPathOf({
   const environment = flagText({ args, name: "env" });
   const file3 = environment ? `.env.${environment}.vault` : ".env.vault";
   for (let dir = resolve15(context.cwd); ; dir = dirname22(dir)) {
-    if (await isFile(join24(dir, file3))) return join24(dir, file3);
+    if (await isFile(join25(dir, file3))) return join25(dir, file3);
     if (dirname22(dir) === dir) break;
   }
   throw new CliUsageError(`laze vault: no ${file3} here or in a parent folder
@@ -86717,7 +87095,7 @@ ${ENV_USAGE}`);
 `);
     return 0;
   }
-  const redact = [...released.values()].flatMap(({ fields }) => Object.values(fields));
+  const redact = [...released.values()].flatMap(({ fields }) => secretValuesOf({ fields }));
   return context.runCommand({ command: prepared.command, env, redact });
 }
 async function vaultAws({
@@ -86766,7 +87144,7 @@ async function postInTurn({
   body
 }) {
   const env = context.environment.inherited;
-  const turn = await turnTokenOf3({
+  const turn = await turnTokenOf2({
     env,
     turnFile: turnFileOf({ env }),
     command: "laze vault save"
@@ -87469,7 +87847,7 @@ async function whatsappBusiness({
 }
 
 // src/services/whatsapp-pairing-commands.service.ts
-import { writeFile as writeFile22 } from "node:fs/promises";
+import { writeFile as writeFile23 } from "node:fs/promises";
 import { resolve as resolve17 } from "node:path";
 var WHATSAPP_PAIRING_USAGE = [
   "       laze whatsapp pair <machine> [--qr <file.svg>]     link WhatsApp on your machine; scan the code (owner)",
@@ -87490,7 +87868,7 @@ function svgOf(dataUrl) {
 }
 async function report({ context, args, pairing: pairing2 }) {
   const qrFile = pairing2.qrSvg ? resolve17(context.cwd, flagText({ args, name: "qr", fallback: "whatsapp-qr.svg" })) : null;
-  if (qrFile && pairing2.qrSvg) await writeFile22(qrFile, svgOf(pairing2.qrSvg), "utf8");
+  if (qrFile && pairing2.qrSvg) await writeFile23(qrFile, svgOf(pairing2.qrSvg), "utf8");
   if (args.flags.json) return context.out(`${JSON.stringify({ ...pairing2, qrFile }, null, 2)}
 `);
   context.out(`${pairing2.pairingId}	${pairing2.state}
@@ -87555,7 +87933,7 @@ var PATHS3 = {
 var STATUS_WAIT_SECONDS2 = 50;
 var STATUS_CALLS2 = 2;
 var SETTLED = /* @__PURE__ */ new Set(["sent", "denied", "expired", "failed"]);
-var USAGE18 = [
+var USAGE17 = [
   "Usage: laze whatsapp chats <machine> [--limit <n>]          the chats on the machine, newest first",
   "       laze whatsapp read <machine> <chat> [--limit <n>]    a chat's last messages, oldest first",
   '       laze whatsapp send <machine> <chat> "<text>"         send as the owner; an agent waits for their approval',
@@ -87565,14 +87943,14 @@ var USAGE18 = [
 ].join("\n");
 function word2({ args, at }) {
   const value = args.words[at];
-  if (!value) throw new CliUsageError(USAGE18);
+  if (!value) throw new CliUsageError(USAGE17);
   return value;
 }
 function limitOf5({ args }) {
   const text2 = flagText({ args, name: "limit" });
   if (!text2) return {};
   const limit = Number(text2);
-  if (!Number.isInteger(limit) || limit < 1) throw new CliUsageError(USAGE18);
+  if (!Number.isInteger(limit) || limit < 1) throw new CliUsageError(USAGE17);
   return { limit };
 }
 async function chats({ context, args }) {
@@ -87634,7 +88012,7 @@ Still waiting. Run \`laze whatsapp status ${send4.id}\` later to see the answer.
 }
 async function send3({ context, args }) {
   const text2 = args.words.slice(4).join(" ") || args.rest.join(" ");
-  if (!text2) throw new CliUsageError(USAGE18);
+  if (!text2) throw new CliUsageError(USAGE17);
   const client = await computeClient({ context, args });
   const asked = await client.post(PATHS3.send, {
     machine: word2({ args, at: 2 }),
@@ -87664,11 +88042,11 @@ async function whatsapp({
   if (command === "status") return status8({ context, args });
   const linking = whatsappPairingCommand(command);
   if (linking) return linking({ context, args });
-  throw new CliUsageError(USAGE18);
+  throw new CliUsageError(USAGE17);
 }
 
 // src/services/wiki-commands.service.ts
-var USAGE19 = `Usage:
+var USAGE18 = `Usage:
   laze wiki list
   laze wiki get <path>
   laze wiki put <path> <markdown|@file|-> [--title <title>] [--channel <channel>] [--base <version>]
@@ -87688,7 +88066,7 @@ async function wikiList({ context, args }) {
 }
 async function wikiGet({ context, args }) {
   const path = args.words[2];
-  if (!path) throw new CliUsageError(USAGE19);
+  if (!path) throw new CliUsageError(USAGE18);
   const { client } = await signedIn({ context, args });
   const page = await client.post("/api/wiki/get", { path });
   if (args.flags.json) return context.out(`${JSON.stringify(page, null, 2)}
@@ -87705,7 +88083,7 @@ Linked from: ${page.backlinks.map((link) => link.path).join(", ")}
 async function wikiPut({ context, args }) {
   const path = args.words[2];
   const value = args.words.slice(3).join(" ");
-  if (!path || !value) throw new CliUsageError(USAGE19);
+  if (!path || !value) throw new CliUsageError(USAGE18);
   const body = await textArgument({ context, value });
   const title = flagText({ args, name: "title" });
   const channel = flagText({ args, name: "channel" });
@@ -87725,7 +88103,7 @@ async function wikiPut({ context, args }) {
 }
 async function wikiSearch({ context, args }) {
   const query = args.words.slice(2).join(" ").trim();
-  if (!query) throw new CliUsageError(USAGE19);
+  if (!query) throw new CliUsageError(USAGE18);
   const { client } = await signedIn({ context, args });
   const hits = await client.post("/api/wiki/search", { query });
   if (args.flags.json) return context.out(`${JSON.stringify(hits, null, 2)}
@@ -87735,7 +88113,7 @@ async function wikiSearch({ context, args }) {
 }
 async function wikiHistory({ context, args }) {
   const path = args.words[2];
-  if (!path) throw new CliUsageError(USAGE19);
+  if (!path) throw new CliUsageError(USAGE18);
   const { client } = await signedIn({ context, args });
   const revisions = await client.post("/api/wiki/history", { path });
   if (args.flags.json) return context.out(`${JSON.stringify(revisions, null, 2)}
@@ -87749,7 +88127,7 @@ async function wikiHistory({ context, args }) {
 }
 async function wikiMove({ context, args }) {
   const [, , path, to] = args.words;
-  if (!path || !to) throw new CliUsageError(USAGE19);
+  if (!path || !to) throw new CliUsageError(USAGE18);
   const { client } = await signedIn({ context, args });
   const page = await client.post("/api/wiki/move", { path, to });
   if (args.flags.json) return context.out(`${JSON.stringify(page, null, 2)}
@@ -87759,7 +88137,7 @@ async function wikiMove({ context, args }) {
 }
 async function wikiRemove({ context, args }) {
   const path = args.words[2];
-  if (!path) throw new CliUsageError(USAGE19);
+  if (!path) throw new CliUsageError(USAGE18);
   const { client } = await signedIn({ context, args });
   const removed = await client.post("/api/wiki/remove", { path });
   if (args.flags.json) return context.out(`${JSON.stringify(removed)}
@@ -87779,7 +88157,7 @@ var WIKI_COMMANDS = {
 async function wiki({ context, args }) {
   const name3 = args.words[1] ?? "";
   const command = Object.hasOwn(WIKI_COMMANDS, name3) ? WIKI_COMMANDS[name3] : void 0;
-  if (!command) throw new CliUsageError(USAGE19);
+  if (!command) throw new CliUsageError(USAGE18);
   await command({ context, args });
 }
 
@@ -88095,8 +88473,27 @@ async function list9({ context, args }) {
     context,
     args,
     answer: answer4,
-    text: (members3) => members3.map((it) => `${ROLE_NAMES2[it.role]}	${it.name}	${it.email}	${it.userId}
-`).join("")
+    text: (members3) => members3.map((it) => {
+      const aka2 = it.aliases?.length ? `	aka ${it.aliases.join(", ")}` : "";
+      return `${ROLE_NAMES2[it.role]}	${it.name}	${it.email}	${it.userId}${aka2}
+`;
+    }).join("")
+  });
+}
+async function aka({ context, args }) {
+  const { client } = await signedIn({ context, args });
+  const names = args.words.slice(2);
+  const clear = Boolean(args.flags.clear);
+  const answer4 = names.length > 0 || clear ? await client.post("/api/agents/me/workspace/aka/set", {
+    aliases: clear ? [] : names
+  }) : await client.post("/api/agents/me/workspace/aka", {});
+  print8({
+    context,
+    args,
+    answer: answer4,
+    text: (it) => it.aliases?.length ? `${it.name}, also known as ${it.aliases.join(", ")}
+` : `${it.name} goes by no other name. Add some with laze members aka <name>...
+`
   });
 }
 async function invite({ context, args }) {
@@ -88228,6 +88625,7 @@ var MEMBERS_COMMANDS = {
   "revoke-invite": revokeInvite,
   "invite-link": inviteLink,
   role,
+  aka,
   remove: remove5,
   requests,
   approve: deciding("approved"),
@@ -88239,7 +88637,7 @@ async function members2({ context, args }) {
   const command = MEMBERS_COMMANDS[sub];
   if (!command) {
     throw new CliUsageError(
-      "Usage: laze members [invite | invites | revoke-invite | invite-link | role | remove | requests | approve | deny]"
+      "Usage: laze members [invite | invites | revoke-invite | invite-link | role | aka | remove | requests | approve | deny]"
     );
   }
   return command({ context, args });
@@ -88276,6 +88674,7 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze update [--dry-run]                        install the latest release (npm, pnpm, bun or yarn)
   laze logout                                    revoke this profile's key and forget it
   laze whoami                                    who this key speaks for
+  laze changes                                   what changed in Laze lately; retry an action it refused before
   laze workspaces                                your signed-in profiles
   laze workspace                                 the workspace this key belongs to
   laze workspace mine                            every workspace you belong to, with your role
@@ -88290,6 +88689,7 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze members invite <email> [--role owner|admin|member|guest]   invite someone (admins)
   laze members invites | revoke-invite <email|id>   invitations waiting, or take one back (admins)
   laze members invite-link <email|id>            a fresh link for an invitation, shown once (admins)
+  laze members aka [<name>...] [--clear]         the other names you go by, such as a nickname
   laze members role <member> owner|admin|member|guest   change a member's role (admins)
   laze members remove <member>                   take someone out of the workspace (admins)
   laze members requests | approve <id> | deny <id>   access requests waiting for an admin
@@ -88421,8 +88821,10 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze connect providers|start|search|mcp|mcp-key|github|card|card-key   connect services as yourself
   laze connect install|status|stop|uninstall     the service that hands linked Codex sessions their messages
   laze openclaw list|connect|agent|agent-key|feed|disconnect   your OpenClaw gateways and their agents
-  laze browser open|tabs|goto|read|ask|cdp|share|close   a live browser tab pinned to the conversation
+  laze browser open|tabs|goto|read|ask|login|cdp|share|close   a live browser tab pinned to the conversation
       Show your work: open pages in a browser tab of the conversation; ask the person you work for to sign in there, never ask for a password
+      Any agent working for the tab's owner drives it, connected agents (Claude Code, Codex) from their own session included
+      laze browser login <tab> --vault <connection> types a saved sign-in only when the person says to use it; laze browser --help for all
   laze browser setup|cdp|screen|status <machine>   a machine with Chrome a person signs in on, for agents
       Sites without an API need a person's login: open a browser tab and ask there, never ask for a password; a browser machine only when the person asks for one
   laze browser setup <site> --on <machine>       the browser on a person's own machine instead, at no Laze compute cost
@@ -88487,6 +88889,7 @@ var COMMANDS3 = {
   join: joinAsAgent,
   logout,
   whoami,
+  changes,
   workspaces,
   workspace,
   members: members2,
@@ -88685,7 +89088,9 @@ async function runCli({
     [openclaw, OPENCLAW_USAGE],
     [chatActions, CHAT_ACTIONS_USAGE],
     [agentLogins, LOGINS_HELP],
-    [agentPools, POOLS_HELP]
+    [agentPools, POOLS_HELP],
+    [browser, `${BROWSER_USAGE}
+`]
   ]);
   if (command && args.flags.help && ownHelp.has(command)) {
     context.out(ownHelp.get(command) ?? HELP);