@lesscap/baton-cli 0.9.6 → 0.9.8

package/dist/baton.mjs

@@ -5376,10 +5376,10 @@ var toJson = (data) => JSON.stringify(data, null, 2);
 var fmtWorkspace = (w) => `${w.id}  ${w.name}`;
 var fmtWorkerTemplate = (t) => `${t.id}  ${t.name}  [${t.available ? "available" : "unavailable"}]  ${t.agentKinds.join(", ")}`;
 var fmtWorkerCreation = (c) => `${c.id}  [${c.status}/${c.step ?? "pending"}]  ${c.name}  ${c.agentKind}${c.workerId === null ? "" : `  W-${c.workerId}`}${c.error ? `  ${c.error}` : ""}`;
+var fmtHost = (h) => `${h.id}  ${h.name}  [${h.online ? "online" : "offline"}]  workspaces: ${h.workspaceIds.join(",") || "-"}`;
+var fmtHostCredential = ({ host: host2, token }) => `${host2.id}  ${host2.name}
+token: ${token}`;
 var fmtProject = (p) => `${p.id}  ${p.name}`;
-var fmtRequirement = (r) => `${r.code}  [${r.status}]  ${r.title}`;
-var fmtTask = (t) => `${t.code}  [${t.status}]  ${t.title}`;
-var fmtComment = (c) => `${c.workerId !== void 0 ? `worker#${c.workerId}` : "you"}  ${c.body}`;
 var fmtSession = (s) => `${s.id}  ${s.name}  ${s.attached ? "[active]" : "[inactive]"}  ${s.cwd ?? "(pending)"}`;
 var fmtWorker = (w) => {
   const offline = w.connected === false ? "  [offline]" : "";
@@ -5509,6 +5509,15 @@ var filesClient = (baseUrl) => {
   };
 };
 
+// src/client/hosts.ts
+var hostsClient = (baseUrl) => ({
+  create: (name) => request(`${baseUrl}/hosts`, { method: "POST", body: { name } }),
+  list: () => request(`${baseUrl}/hosts`, { method: "GET" }),
+  rotate: (id) => request(`${baseUrl}/hosts/${id}/token`, { method: "POST", body: {} }),
+  assign: (id, workspaceId) => request(`${baseUrl}/hosts/${id}/workspaces/${workspaceId}`, { method: "PUT" }),
+  unassign: (id, workspaceId) => request(`${baseUrl}/hosts/${id}/workspaces/${workspaceId}`, { method: "DELETE" })
+});
+
 // src/client/loops.ts
 var loopsClient = (baseUrl) => {
   const u = (p) => `${baseUrl}${p}`;
@@ -5535,30 +5544,6 @@ var projectClient = (baseUrl) => {
   };
 };
 
-// src/client/items.ts
-var fetchItemByCode = async (baseUrl, projectId, code, expectKind) => {
-  const r = await request(
-    `${baseUrl}/projects/${projectId}/items/${encodeURIComponent(code)}`,
-    { method: "GET" }
-  );
-  if (r.kind !== expectKind) throw new Error(`expected ${expectKind} but got ${r.kind} for ${code}`);
-  return r.item;
-};
-
-// src/client/requirements.ts
-var requirementClient = (baseUrl) => {
-  const u = (p) => `${baseUrl}${p}`;
-  return {
-    create: (input) => request(u("/requirements"), { method: "POST", body: input }),
-    listByProject: (projectId) => request(u(`/projects/${projectId}/requirements`), { method: "GET" }),
-    get: (id) => request(u(`/requirements/${id}`), { method: "GET" }),
-    getByCode: (projectId, code) => fetchItemByCode(baseUrl, projectId, code, "requirement"),
-    update: (id, patch) => request(u(`/requirements/${id}`), { method: "PATCH", body: patch }),
-    setStatus: (id, status) => request(u(`/requirements/${id}`), { method: "PATCH", body: { status } }),
-    remove: (id) => request(u(`/requirements/${id}`), { method: "DELETE" })
-  };
-};
-
 // src/client/services.ts
 var servicesClient = (baseUrl) => {
   const u = (path) => `${baseUrl}${path}`;
@@ -5693,24 +5678,9 @@ var sessionsClient = (baseUrl) => {
   };
 };
 
-// src/client/tasks.ts
-var taskClient = (baseUrl) => {
-  const u = (p) => `${baseUrl}${p}`;
-  return {
-    create: (input) => request(u("/tasks"), { method: "POST", body: input }),
-    listByRequirement: (requirementId) => request(u(`/requirements/${requirementId}/tasks`), { method: "GET" }),
-    get: (id) => request(u(`/tasks/${id}`), { method: "GET" }),
-    getByCode: (projectId, code) => fetchItemByCode(baseUrl, projectId, code, "task"),
-    update: (id, patch) => request(u(`/tasks/${id}`), { method: "PATCH", body: patch }),
-    setStatus: (id, status) => request(u(`/tasks/${id}`), { method: "PATCH", body: { status } }),
-    remove: (id) => request(u(`/tasks/${id}`), { method: "DELETE" }),
-    listComments: (id) => request(u(`/tasks/${id}/comments`), { method: "GET" }),
-    addComment: (id, body, workerId) => request(u(`/tasks/${id}/comments`), { method: "POST", body: { body, workerId } })
-  };
-};
-
 // src/client/worker-creations.ts
 var workerCreationsClient = (baseUrl) => ({
+  hosts: (projectId) => request(`${baseUrl}/projects/${projectId}/hosts`, { method: "GET" }),
   templates: (projectId) => request(`${baseUrl}/projects/${projectId}/worker-templates`, { method: "GET" }),
   create: (projectId, input) => request(`${baseUrl}/projects/${projectId}/worker-creations`, { method: "POST", body: input }),
   listByProject: (projectId) => request(`${baseUrl}/projects/${projectId}/worker-creations`, { method: "GET" }),
@@ -5758,11 +5728,10 @@ var createClient = (baseUrl, opts) => {
 };
 var clientFromBase = (baseUrl) => ({
   workerCreations: workerCreationsClient(baseUrl),
+  hosts: hostsClient(baseUrl),
   artifacts: artifactsClient(baseUrl),
   workspaces: workspaceClient(baseUrl),
   projects: projectClient(baseUrl),
-  requirements: requirementClient(baseUrl),
-  tasks: taskClient(baseUrl),
   sessions: sessionsClient(baseUrl),
   services: servicesClient(baseUrl),
   files: filesClient(baseUrl),
@@ -5883,11 +5852,6 @@ var clientFor = (args) => {
   const auth = resolveAuth(process.env, fileToken);
   return createClient(baseUrl, auth && auth !== "cookie" ? auth : void 0);
 };
-var resolveBearer = () => {
-  const fileToken = loadProjectConfigOrNull(projectConfigPath())?.worker?.apiToken;
-  const auth = resolveAuth(process.env, fileToken);
-  return auth && auth !== "cookie" ? auth.bearer : void 0;
-};
 var resolveProjectId = (args) => {
   if (args.project !== void 0 && args.project !== "") return Number(args.project);
   if (process.env.BATON_PROJECT_ID !== void 0)
@@ -5908,7 +5872,6 @@ var parseWorkerHandle = (handle) => {
   const m = handle.trim().match(/^(?:[wW]-)?(\d+)$/);
   return m ? Number(m[1]) : null;
 };
-var splitCsv = (s) => s ? s.split(",").map((x) => x.trim()).filter(Boolean) : void 0;
 var parseDuration = (s) => {
   const m = s.trim().match(/^(\d+)\s*([smhd]?)$/);
   if (!m) throw new Error(`bad interval "${s}" \u2014 use e.g. 90s, 30m, 2h, 1d`);
@@ -5990,758 +5953,412 @@ var artifact = defineCommand({
   subCommands: { publish: publishCommand, ls: listCommand, rm: removeCommand }
 });
 
-// ../../node_modules/.pnpm/eventsource-parser@3.1.0/node_modules/eventsource-parser/dist/index.js
-var ParseError = class extends Error {
-  constructor(message, options) {
-    super(message), this.name = "ParseError", this.type = options.type, this.field = options.field, this.value = options.value, this.line = options.line;
-  }
+// src/commands/host.ts
+var findHost = (hosts, handle) => {
+  const host2 = hosts.find((item) => item.name === handle || String(item.id) === handle);
+  if (!host2) throw new Error(`host not found: ${handle}`);
+  return host2;
 };
-var LF = 10;
-var CR = 13;
-var SPACE = 32;
-function noop(_arg) {
-}
-function createParser(config) {
-  if (typeof config == "function")
-    throw new TypeError(
-      "`config` must be an object, got a function instead. Did you mean `createParser({onEvent: fn})`?"
-    );
-  const { onEvent = noop, onError = noop, onRetry = noop, onComment, maxBufferSize } = config, pendingFragments = [];
-  let pendingFragmentsLength = 0, isFirstChunk = true, id, data = "", dataLines = 0, eventType, terminated = false;
-  function feed(chunk) {
-    if (terminated)
-      throw new Error(
-        "Cannot feed parser: it was terminated after exceeding the configured max buffer size. Call `reset()` to resume parsing."
-      );
-    if (isFirstChunk && (isFirstChunk = false, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.length === 0) {
-      const trailing2 = processLines(chunk);
-      trailing2 !== "" && (pendingFragments.push(trailing2), pendingFragmentsLength = trailing2.length), checkBufferSize();
-      return;
-    }
-    if (chunk.indexOf(`
-`) === -1 && chunk.indexOf("\r") === -1) {
-      pendingFragments.push(chunk), pendingFragmentsLength += chunk.length, checkBufferSize();
-      return;
-    }
-    pendingFragments.push(chunk);
-    const input = pendingFragments.join("");
-    pendingFragments.length = 0, pendingFragmentsLength = 0;
-    const trailing = processLines(input);
-    trailing !== "" && (pendingFragments.push(trailing), pendingFragmentsLength = trailing.length), checkBufferSize();
-  }
-  function checkBufferSize() {
-    maxBufferSize !== void 0 && (pendingFragmentsLength + data.length <= maxBufferSize || (terminated = true, pendingFragments.length = 0, pendingFragmentsLength = 0, id = void 0, data = "", dataLines = 0, eventType = void 0, onError(
-      new ParseError(`Buffered data exceeded max buffer size of ${maxBufferSize} characters`, {
-        type: "max-buffer-size-exceeded"
-      })
-    )));
-  }
-  function processLines(chunk) {
-    let searchIndex = 0;
-    if (chunk.indexOf("\r") === -1) {
-      let lfIndex = chunk.indexOf(`
-`, searchIndex);
-      for (; lfIndex !== -1; ) {
-        if (searchIndex === lfIndex) {
-          dataLines > 0 && onEvent({ id, event: eventType, data }), id = void 0, data = "", dataLines = 0, eventType = void 0, searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
-`, searchIndex);
-          continue;
-        }
-        const firstCharCode = chunk.charCodeAt(searchIndex);
-        if (isDataPrefix(chunk, searchIndex, firstCharCode)) {
-          const valueStart = chunk.charCodeAt(searchIndex + 5) === SPACE ? searchIndex + 6 : searchIndex + 5, value = chunk.slice(valueStart, lfIndex);
-          if (dataLines === 0 && chunk.charCodeAt(lfIndex + 1) === LF) {
-            onEvent({ id, event: eventType, data: value }), id = void 0, data = "", eventType = void 0, searchIndex = lfIndex + 2, lfIndex = chunk.indexOf(`
-`, searchIndex);
-            continue;
-          }
-          data = dataLines === 0 ? value : `${data}
-${value}`, dataLines++;
-        } else isEventPrefix(chunk, searchIndex, firstCharCode) ? eventType = chunk.slice(
-          chunk.charCodeAt(searchIndex + 6) === SPACE ? searchIndex + 7 : searchIndex + 6,
-          lfIndex
-        ) || void 0 : parseLine(chunk, searchIndex, lfIndex);
-        searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
-`, searchIndex);
+var adminHost = async (c, handle) => findHost(await c.hosts.list(), handle);
+var positiveId = (raw) => {
+  const id = Number(raw);
+  if (!Number.isSafeInteger(id) || id <= 0) throw new Error("workspace must be a positive id");
+  return id;
+};
+var hostArg = {
+  host: { type: "positional", required: true, description: "host name or id" }
+};
+var workspaceArg = {
+  workspace: { type: "string", required: true, description: "workspace id" }
+};
+var host = defineCommand({
+  meta: { name: "host", description: "manage machines and which workspaces can use them (admin)" },
+  subCommands: {
+    add: defineCommand({
+      meta: { name: "add", description: "add a host; prints its Provisioner token once" },
+      args: {
+        name: { type: "positional", required: true, description: "host name" },
+        workspace: { type: "string", description: "also assign it to this workspace id" },
+        ...common
+      },
+      run: async ({ args }) => {
+        const c = clientFor(args);
+        const workspaceId = args.workspace === void 0 ? null : positiveId(args.workspace);
+        const credential = await c.hosts.create(args.name);
+        console.log(renderOne(credential, fmtHostCredential, Boolean(args.json)));
+        if (workspaceId !== null) await c.hosts.assign(credential.host.id, workspaceId);
       }
-      return chunk.slice(searchIndex);
-    }
-    for (; searchIndex < chunk.length; ) {
-      const crIndex = chunk.indexOf("\r", searchIndex), lfIndex = chunk.indexOf(`
-`, searchIndex);
-      let lineEnd = -1;
-      if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = crIndex < lfIndex ? crIndex : lfIndex : crIndex !== -1 ? crIndex === chunk.length - 1 ? lineEnd = -1 : lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1)
-        break;
-      parseLine(chunk, searchIndex, lineEnd), searchIndex = lineEnd + 1, chunk.charCodeAt(searchIndex - 1) === CR && chunk.charCodeAt(searchIndex) === LF && searchIndex++;
-    }
-    return chunk.slice(searchIndex);
-  }
-  function parseLine(chunk, start, end) {
-    if (start === end) {
-      dispatchEvent();
-      return;
-    }
-    const firstCharCode = chunk.charCodeAt(start);
-    if (isDataPrefix(chunk, start, firstCharCode)) {
-      const valueStart = chunk.charCodeAt(start + 5) === SPACE ? start + 6 : start + 5, value2 = chunk.slice(valueStart, end);
-      data = dataLines === 0 ? value2 : `${data}
-${value2}`, dataLines++;
-      return;
-    }
-    if (isEventPrefix(chunk, start, firstCharCode)) {
-      eventType = chunk.slice(chunk.charCodeAt(start + 6) === SPACE ? start + 7 : start + 6, end) || void 0;
-      return;
-    }
-    if (firstCharCode === 105 && chunk.charCodeAt(start + 1) === 100 && chunk.charCodeAt(start + 2) === 58) {
-      const value2 = chunk.slice(chunk.charCodeAt(start + 3) === SPACE ? start + 4 : start + 3, end);
-      id = value2.includes("\0") ? void 0 : value2;
-      return;
-    }
-    if (firstCharCode === 58) {
-      if (onComment) {
-        const line2 = chunk.slice(start, end);
-        onComment(line2.slice(chunk.charCodeAt(start + 1) === SPACE ? 2 : 1));
+    }),
+    ls: defineCommand({
+      meta: {
+        name: "ls",
+        description: "list hosts, whether they are online, and their workspaces"
+      },
+      args: { ...common },
+      run: async ({ args }) => {
+        console.log(renderList(await clientFor(args).hosts.list(), fmtHost, Boolean(args.json)));
       }
-      return;
-    }
-    const line = chunk.slice(start, end), fieldSeparatorIndex = line.indexOf(":");
-    if (fieldSeparatorIndex === -1) {
-      processField(line, "", line);
-      return;
-    }
-    const field = line.slice(0, fieldSeparatorIndex), offset = line.charCodeAt(fieldSeparatorIndex + 1) === SPACE ? 2 : 1, value = line.slice(fieldSeparatorIndex + offset);
-    processField(field, value, line);
-  }
-  function processField(field, value, line) {
-    switch (field) {
-      case "event":
-        eventType = value || void 0;
-        break;
-      case "data":
-        data = dataLines === 0 ? value : `${data}
-${value}`, dataLines++;
-        break;
-      case "id":
-        id = value.includes("\0") ? void 0 : value;
-        break;
-      case "retry":
-        /^\d+$/.test(value) ? onRetry(parseInt(value, 10)) : onError(
-          new ParseError(`Invalid \`retry\` value: "${value}"`, {
-            type: "invalid-retry",
-            value,
-            line
-          })
-        );
-        break;
-      default:
-        onError(
-          new ParseError(
-            `Unknown field "${field.length > 20 ? `${field.slice(0, 20)}\u2026` : field}"`,
-            { type: "unknown-field", field, value, line }
-          )
-        );
-        break;
-    }
-  }
-  function dispatchEvent() {
-    dataLines > 0 && onEvent({
-      id,
-      event: eventType,
-      data
-    }), id = void 0, data = "", dataLines = 0, eventType = void 0;
-  }
-  function reset(options = {}) {
-    if (options.consume && pendingFragments.length > 0) {
-      const incompleteLine = pendingFragments.join("");
-      parseLine(incompleteLine, 0, incompleteLine.length);
-    }
-    isFirstChunk = true, id = void 0, data = "", dataLines = 0, eventType = void 0, pendingFragments.length = 0, pendingFragmentsLength = 0, terminated = false;
+    }),
+    assign: defineCommand({
+      meta: { name: "assign", description: "let a workspace create Workers on this host" },
+      args: { ...hostArg, ...workspaceArg, ...common },
+      run: async ({ args }) => {
+        const c = clientFor(args);
+        const { id, name } = await adminHost(c, args.host);
+        await c.hosts.assign(id, positiveId(args.workspace));
+        console.log(`assigned ${name} to workspace ${args.workspace}`);
+      }
+    }),
+    unassign: defineCommand({
+      meta: {
+        name: "unassign",
+        description: "stop new Workers on this host for a workspace; existing ones keep running"
+      },
+      args: { ...hostArg, ...workspaceArg, ...common },
+      run: async ({ args }) => {
+        const c = clientFor(args);
+        const { id, name } = await adminHost(c, args.host);
+        await c.hosts.unassign(id, positiveId(args.workspace));
+        console.log(`unassigned ${name} from workspace ${args.workspace}`);
+      }
+    }),
+    rotate: defineCommand({
+      meta: { name: "rotate", description: "replace a host token; the old one stops working" },
+      args: { ...hostArg, ...common },
+      run: async ({ args }) => {
+        const c = clientFor(args);
+        const { id } = await adminHost(c, args.host);
+        console.log(renderOne(await c.hosts.rotate(id), fmtHostCredential, Boolean(args.json)));
+      }
+    })
   }
-  return { feed, reset };
-}
-function isDataPrefix(chunk, i, firstCharCode) {
-  return firstCharCode === 100 && chunk.charCodeAt(i + 1) === 97 && chunk.charCodeAt(i + 2) === 116 && chunk.charCodeAt(i + 3) === 97 && chunk.charCodeAt(i + 4) === 58;
-}
-function isEventPrefix(chunk, i, firstCharCode) {
-  return firstCharCode === 101 && chunk.charCodeAt(i + 1) === 118 && chunk.charCodeAt(i + 2) === 101 && chunk.charCodeAt(i + 3) === 110 && chunk.charCodeAt(i + 4) === 116 && chunk.charCodeAt(i + 5) === 58;
-}
+});
 
-// ../../node_modules/.pnpm/eventsource@4.1.0/node_modules/eventsource/dist/index.js
-var ErrorEvent = class extends Event {
-  /**
-   * Constructs a new `ErrorEvent` instance. This is typically not called directly,
-   * but rather emitted by the `EventSource` object when an error occurs.
-   *
-   * @param type - The type of the event (should be "error")
-   * @param errorEventInitDict - Optional properties to include in the error event
-   */
-  constructor(type, errorEventInitDict) {
-    var _a, _b;
-    super(type), this.code = (_a = errorEventInitDict == null ? void 0 : errorEventInitDict.code) != null ? _a : void 0, this.message = (_b = errorEventInitDict == null ? void 0 : errorEventInitDict.message) != null ? _b : void 0;
+// src/commands/init.ts
+import { existsSync as existsSync2 } from "node:fs";
+import * as readline from "node:readline/promises";
+var promptPick = async (label, items) => {
+  if (items.length === 0) throw new Error(`no ${label}s found on server`);
+  console.log(`${label}s:`);
+  items.forEach((it, i) => {
+    console.log(`  [${i + 1}] #${it.id}  ${it.name}`);
+  });
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const ans = (await rl.question(`pick a ${label} (1-${items.length}): `)).trim();
+    const idx = Number(ans) - 1;
+    const picked = items[idx];
+    if (!picked) throw new Error(`invalid choice: ${ans}`);
+    return picked;
+  } finally {
+    rl.close();
   }
-  /**
-   * Node.js "hides" the `message` and `code` properties of the `ErrorEvent` instance,
-   * when it is `console.log`'ed. This makes it harder to debug errors. To ease debugging,
-   * we explicitly include the properties in the `inspect` method.
-   *
-   * This is automatically called by Node.js when you `console.log` an instance of this class.
-   *
-   * @param _depth - The current depth
-   * @param options - The options passed to `util.inspect`
-   * @param inspect - The inspect function to use (prevents having to import it from `util`)
-   * @returns A string representation of the error
-   */
-  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")](_depth, options, inspect) {
-    return inspect(inspectableError(this), options);
-  }
-  /**
-   * Deno "hides" the `message` and `code` properties of the `ErrorEvent` instance,
-   * when it is `console.log`'ed. This makes it harder to debug errors. To ease debugging,
-   * we explicitly include the properties in the `inspect` method.
-   *
-   * This is automatically called by Deno when you `console.log` an instance of this class.
-   *
-   * @param inspect - The inspect function to use (prevents having to import it from `util`)
-   * @param options - The options passed to `Deno.inspect`
-   * @returns A string representation of the error
-   */
-  [/* @__PURE__ */ Symbol.for("Deno.customInspect")](inspect, options) {
-    return inspect(inspectableError(this), options);
-  }
-};
-function syntaxError(message) {
-  const DomException = globalThis.DOMException;
-  return typeof DomException == "function" ? new DomException(message, "SyntaxError") : new SyntaxError(message);
-}
-function flattenError(err) {
-  return err instanceof Error ? "errors" in err && Array.isArray(err.errors) ? err.errors.map(flattenError).join(", ") : "cause" in err && err.cause instanceof Error ? `${err}: ${flattenError(err.cause)}` : err.message : `${err}`;
-}
-function inspectableError(err) {
-  return {
-    type: err.type,
-    message: err.message,
-    code: err.code,
-    defaultPrevented: err.defaultPrevented,
-    cancelable: err.cancelable,
-    timeStamp: err.timeStamp
-  };
-}
-var __typeError = (msg) => {
-  throw TypeError(msg);
-};
-var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
-var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
-var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
-var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
-var _readyState;
-var _url;
-var _redirectUrl;
-var _withCredentials;
-var _fetch;
-var _reconnectInterval;
-var _reconnectTimer;
-var _lastEventId;
-var _controller;
-var _parser;
-var _onError;
-var _onMessage;
-var _onOpen;
-var _EventSource_instances;
-var connect_fn;
-var _onFetchResponse;
-var _onFetchError;
-var getRequestOptions_fn;
-var _onEvent;
-var _onRetryChange;
-var failConnection_fn;
-var scheduleReconnect_fn;
-var _reconnect;
-var EventSource = class extends EventTarget {
-  constructor(url, eventSourceInitDict) {
-    var _a, _b;
-    super(), __privateAdd(this, _EventSource_instances), this.CONNECTING = 0, this.OPEN = 1, this.CLOSED = 2, __privateAdd(this, _readyState), __privateAdd(this, _url), __privateAdd(this, _redirectUrl), __privateAdd(this, _withCredentials), __privateAdd(this, _fetch), __privateAdd(this, _reconnectInterval), __privateAdd(this, _reconnectTimer), __privateAdd(this, _lastEventId, null), __privateAdd(this, _controller), __privateAdd(this, _parser), __privateAdd(this, _onError, null), __privateAdd(this, _onMessage, null), __privateAdd(this, _onOpen, null), __privateAdd(this, _onFetchResponse, async (response) => {
-      var _a2;
-      __privateGet(this, _parser).reset();
-      const { body, redirected, status, headers } = response;
-      if (status === 204) {
-        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, "Server sent HTTP 204, not reconnecting", 204), this.close();
-        return;
-      }
-      if (redirected ? __privateSet(this, _redirectUrl, new URL(response.url)) : __privateSet(this, _redirectUrl, void 0), status !== 200) {
-        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, `Non-200 status code (${status})`, status);
-        return;
-      }
-      if (!(headers.get("content-type") || "").startsWith("text/event-stream")) {
-        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, 'Invalid content type, expected "text/event-stream"', status);
-        return;
-      }
-      if (__privateGet(this, _readyState) === this.CLOSED)
-        return;
-      __privateSet(this, _readyState, this.OPEN);
-      const openEvent = new Event("open");
-      if ((_a2 = __privateGet(this, _onOpen)) == null || _a2.call(this, openEvent), this.dispatchEvent(openEvent), typeof body != "object" || !body || !("getReader" in body)) {
-        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, "Invalid response body, expected a web ReadableStream", status), this.close();
-        return;
-      }
-      const decoder = new TextDecoder(), reader = body.getReader();
-      let open3 = true;
-      do {
-        const { done, value } = await reader.read();
-        value && __privateGet(this, _parser).feed(decoder.decode(value, { stream: !done })), done && (open3 = false, __privateGet(this, _parser).reset(), __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this));
-      } while (open3);
-    }), __privateAdd(this, _onFetchError, (err) => {
-      __privateSet(this, _controller, void 0), !(err.name === "AbortError" || err.type === "aborted") && __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this, flattenError(err));
-    }), __privateAdd(this, _onEvent, (event) => {
-      typeof event.id == "string" && __privateSet(this, _lastEventId, event.id);
-      const messageEvent = new MessageEvent(event.event || "message", {
-        data: event.data,
-        origin: __privateGet(this, _redirectUrl) ? __privateGet(this, _redirectUrl).origin : __privateGet(this, _url).origin,
-        lastEventId: event.id || ""
-      });
-      __privateGet(this, _onMessage) && (!event.event || event.event === "message") && __privateGet(this, _onMessage).call(this, messageEvent), this.dispatchEvent(messageEvent);
-    }), __privateAdd(this, _onRetryChange, (value) => {
-      __privateSet(this, _reconnectInterval, value);
-    }), __privateAdd(this, _reconnect, () => {
-      __privateSet(this, _reconnectTimer, void 0), __privateGet(this, _readyState) === this.CONNECTING && __privateMethod(this, _EventSource_instances, connect_fn).call(this);
-    });
-    try {
-      if (url instanceof URL)
-        __privateSet(this, _url, url);
-      else if (typeof url == "string")
-        __privateSet(this, _url, new URL(url, getBaseURL()));
-      else
-        throw new Error("Invalid URL");
-    } catch {
-      throw syntaxError("An invalid or illegal string was specified");
-    }
-    __privateSet(this, _parser, createParser({
-      onEvent: __privateGet(this, _onEvent),
-      onRetry: __privateGet(this, _onRetryChange)
-    })), __privateSet(this, _readyState, this.CONNECTING), __privateSet(this, _reconnectInterval, 3e3), __privateSet(this, _fetch, (_a = eventSourceInitDict == null ? void 0 : eventSourceInitDict.fetch) != null ? _a : globalThis.fetch), __privateSet(this, _withCredentials, (_b = eventSourceInitDict == null ? void 0 : eventSourceInitDict.withCredentials) != null ? _b : false), __privateMethod(this, _EventSource_instances, connect_fn).call(this);
-  }
-  /**
-   * Returns the state of this EventSource object's connection. It can have the values described below.
-   *
-   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/readyState)
-   *
-   * Note: typed as `number` instead of `0 | 1 | 2` for compatibility with the `EventSource` interface,
-   * defined in the TypeScript `dom` library.
-   *
-   * @public
-   */
-  get readyState() {
-    return __privateGet(this, _readyState);
-  }
-  /**
-   * Returns the URL providing the event stream.
-   *
-   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/url)
-   *
-   * @public
-   */
-  get url() {
-    return __privateGet(this, _url).href;
-  }
-  /**
-   * Returns true if the credentials mode for connection requests to the URL providing the event stream is set to "include", and false otherwise.
-   *
-   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/withCredentials)
-   */
-  get withCredentials() {
-    return __privateGet(this, _withCredentials);
-  }
-  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/error_event) */
-  get onerror() {
-    return __privateGet(this, _onError);
-  }
-  set onerror(value) {
-    __privateSet(this, _onError, value);
-  }
-  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/message_event) */
-  get onmessage() {
-    return __privateGet(this, _onMessage);
-  }
-  set onmessage(value) {
-    __privateSet(this, _onMessage, value);
-  }
-  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/open_event) */
-  get onopen() {
-    return __privateGet(this, _onOpen);
-  }
-  set onopen(value) {
-    __privateSet(this, _onOpen, value);
-  }
-  addEventListener(type, listener, options) {
-    const listen = listener;
-    super.addEventListener(type, listen, options);
-  }
-  removeEventListener(type, listener, options) {
-    const listen = listener;
-    super.removeEventListener(type, listen, options);
-  }
-  /**
-   * Aborts any instances of the fetch algorithm started for this EventSource object, and sets the readyState attribute to CLOSED.
-   *
-   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/close)
-   *
-   * @public
-   */
-  close() {
-    __privateGet(this, _reconnectTimer) && clearTimeout(__privateGet(this, _reconnectTimer)), __privateGet(this, _readyState) !== this.CLOSED && (__privateGet(this, _controller) && __privateGet(this, _controller).abort(), __privateSet(this, _readyState, this.CLOSED), __privateSet(this, _controller, void 0));
-  }
-};
-_readyState = /* @__PURE__ */ new WeakMap(), _url = /* @__PURE__ */ new WeakMap(), _redirectUrl = /* @__PURE__ */ new WeakMap(), _withCredentials = /* @__PURE__ */ new WeakMap(), _fetch = /* @__PURE__ */ new WeakMap(), _reconnectInterval = /* @__PURE__ */ new WeakMap(), _reconnectTimer = /* @__PURE__ */ new WeakMap(), _lastEventId = /* @__PURE__ */ new WeakMap(), _controller = /* @__PURE__ */ new WeakMap(), _parser = /* @__PURE__ */ new WeakMap(), _onError = /* @__PURE__ */ new WeakMap(), _onMessage = /* @__PURE__ */ new WeakMap(), _onOpen = /* @__PURE__ */ new WeakMap(), _EventSource_instances = /* @__PURE__ */ new WeakSet(), /**
-* Connect to the given URL and start receiving events
-*
-* @internal
-*/
-connect_fn = function() {
-  __privateSet(this, _readyState, this.CONNECTING), __privateSet(this, _controller, new AbortController()), __privateGet(this, _fetch)(__privateGet(this, _url), __privateMethod(this, _EventSource_instances, getRequestOptions_fn).call(this)).then(__privateGet(this, _onFetchResponse)).catch(__privateGet(this, _onFetchError));
-}, _onFetchResponse = /* @__PURE__ */ new WeakMap(), _onFetchError = /* @__PURE__ */ new WeakMap(), /**
-* Get request options for the `fetch()` request
-*
-* @returns The request options
-* @internal
-*/
-getRequestOptions_fn = function() {
-  var _a;
-  const init2 = {
-    // [spec] Let `corsAttributeState` be `Anonymous`…
-    // [spec] …will have their mode set to "cors"…
-    mode: "cors",
-    redirect: "follow",
-    headers: { Accept: "text/event-stream", ...__privateGet(this, _lastEventId) ? { "Last-Event-ID": __privateGet(this, _lastEventId) } : void 0 },
-    cache: "no-store",
-    signal: (_a = __privateGet(this, _controller)) == null ? void 0 : _a.signal
-  };
-  return "window" in globalThis && (init2.credentials = this.withCredentials ? "include" : "same-origin"), init2;
-}, _onEvent = /* @__PURE__ */ new WeakMap(), _onRetryChange = /* @__PURE__ */ new WeakMap(), /**
-* Handles the process referred to in the EventSource specification as "failing a connection".
-*
-* @param error - The error causing the connection to fail
-* @param code - The HTTP status code, if available
-* @internal
-*/
-failConnection_fn = function(message, code) {
-  var _a;
-  __privateGet(this, _readyState) !== this.CLOSED && __privateSet(this, _readyState, this.CLOSED);
-  const errorEvent = new ErrorEvent("error", { code, message });
-  (_a = __privateGet(this, _onError)) == null || _a.call(this, errorEvent), this.dispatchEvent(errorEvent);
-}, /**
-* Schedules a reconnection attempt against the EventSource endpoint.
-*
-* @param message - The error causing the connection to fail
-* @param code - The HTTP status code, if available
-* @internal
-*/
-scheduleReconnect_fn = function(message, code) {
-  var _a;
-  if (__privateGet(this, _readyState) === this.CLOSED)
-    return;
-  __privateSet(this, _readyState, this.CONNECTING);
-  const errorEvent = new ErrorEvent("error", { code, message });
-  (_a = __privateGet(this, _onError)) == null || _a.call(this, errorEvent), this.dispatchEvent(errorEvent), __privateSet(this, _reconnectTimer, setTimeout(__privateGet(this, _reconnect), __privateGet(this, _reconnectInterval)));
-}, _reconnect = /* @__PURE__ */ new WeakMap(), /**
-* ReadyState representing an EventSource currently trying to connect
-*
-* @public
-*/
-EventSource.CONNECTING = 0, /**
-* ReadyState representing an EventSource connection that is open (eg connected)
-*
-* @public
-*/
-EventSource.OPEN = 1, /**
-* ReadyState representing an EventSource connection that is closed (eg disconnected)
-*
-* @public
-*/
-EventSource.CLOSED = 2;
-Object.defineProperty(EventSource, /* @__PURE__ */ Symbol.for("eventsource.supports-fetch-override"), {
-  value: true,
-  writable: false,
-  configurable: false,
-  enumerable: false
-});
-function getBaseURL() {
-  const doc = "document" in globalThis ? globalThis.document : void 0;
-  return doc && typeof doc == "object" && "baseURI" in doc && typeof doc.baseURI == "string" ? doc.baseURI : void 0;
-}
-
-// src/client/channel.ts
-var channelClient = (baseUrl) => {
-  const u = (p) => `${baseUrl}${p}`;
-  const JSON_CT = { "content-type": "application/json" };
-  const member = (channelId, name) => u(`/channels/${channelId}/members/${encodeURIComponent(name)}`);
-  return {
-    create: async (workspaceId, title, description, token) => {
-      const res = await fetch(u(`/workspaces/${workspaceId}/channels`), {
-        method: "POST",
-        headers: { ...JSON_CT, ...token ? { authorization: `Bearer ${token}` } : {} },
-        body: JSON.stringify({
-          ...title ? { title } : {},
-          ...description ? { description } : {}
-        })
-      });
-      if (!res.ok)
-        throw new Error(
-          `POST /workspaces/${workspaceId}/channels \u2192 ${res.status}: ${await res.text()}`
-        );
-      return await res.json();
-    },
-    manifest: async (channelId) => {
-      const res = await fetch(u(`/channels/${channelId}`));
-      if (!res.ok) throw new Error(`GET channel \u2192 ${res.status}: ${await res.text()}`);
-      return await res.json();
-    },
-    update: async (channelId, patch) => {
-      const res = await fetch(u(`/channels/${channelId}`), {
-        method: "PATCH",
-        headers: JSON_CT,
-        body: JSON.stringify(patch)
-      });
-      if (!res.ok) throw new Error(`PATCH channel \u2192 ${res.status}: ${await res.text()}`);
-      return await res.json();
-    },
-    help: async () => {
-      const res = await fetch(u("/channels/help"));
-      if (!res.ok) throw new Error(`GET /channels/help \u2192 ${res.status}: ${await res.text()}`);
-      return await res.text();
-    },
-    destroy: async (channelId) => {
-      const res = await fetch(u(`/channels/${channelId}`), { method: "DELETE" });
-      if (!res.ok) throw new Error(`DELETE channel \u2192 ${res.status}: ${await res.text()}`);
-    },
-    join: async (channelId, name, kind) => {
-      const res = await fetch(member(channelId, name), {
-        method: "PUT",
-        headers: JSON_CT,
-        body: JSON.stringify({ kind: kind ?? "agent" })
-      });
-      if (!res.ok) throw new Error(`join channel \u2192 ${res.status}: ${await res.text()}`);
-      return (await res.json()).members;
-    },
-    leave: async (channelId, name) => {
-      const res = await fetch(member(channelId, name), { method: "DELETE" });
-      if (!res.ok) throw new Error(`leave channel \u2192 ${res.status}: ${await res.text()}`);
-    },
-    members: async (channelId) => {
-      const res = await fetch(u(`/channels/${channelId}/members`));
-      if (!res.ok) throw new Error(`GET members \u2192 ${res.status}: ${await res.text()}`);
-      return (await res.json()).members;
-    },
-    send: async (channelId, msg) => {
-      const res = await fetch(u(`/channels/${channelId}/messages`), {
-        method: "POST",
-        headers: JSON_CT,
-        body: JSON.stringify(msg)
-      });
-      if (!res.ok) throw new Error(`POST channel message \u2192 ${res.status}: ${await res.text()}`);
-      return await res.json();
-    },
-    uploadAttachment: async (channelId, input) => {
-      const res = await fetch(
-        u(`/channels/${channelId}/attachments?filename=${encodeURIComponent(input.filename)}`),
-        { method: "POST", headers: { "content-type": input.contentType }, body: input.body }
-      );
-      if (!res.ok) throw new Error(`upload attachment \u2192 ${res.status}: ${await res.text()}`);
-      return await res.json();
-    },
-    downloadAttachment: async (channelId, attId) => {
-      const res = await fetch(u(`/channels/${channelId}/attachments/${attId}`));
-      if (!res.ok) throw new Error(`download attachment \u2192 ${res.status}: ${await res.text()}`);
-      return res;
-    },
-    read: async (channelId, opts) => {
-      const params = new URLSearchParams({ since: String(opts?.since ?? 0) });
-      if (opts?.for) params.set("for", opts.for);
-      const res = await fetch(u(`/channels/${channelId}/messages?${params}`));
-      if (!res.ok) throw new Error(`GET messages \u2192 ${res.status}: ${await res.text()}`);
-      return (await res.json()).messages;
-    },
-    listen: (channelId, opts) => {
-      let cursor = opts.since ?? 0;
-      const params = new URLSearchParams({ since: String(cursor) });
-      if (opts.for) params.set("for", opts.for);
-      if (opts.as) params.set("as", opts.as);
-      const es = new EventSource(u(`/channels/${channelId}/stream?${params}`));
-      es.onmessage = (e) => {
-        try {
-          const m = JSON.parse(e.data);
-          if (m.seq <= cursor) return;
-          cursor = m.seq;
-          opts.onMessage(m);
-        } catch (err) {
-          opts.onError?.(err);
-        }
-      };
-      es.onerror = (err) => opts.onError?.(err);
-      return () => es.close();
-    }
-  };
 };
-
-// src/commands/channel/close.ts
-var closeCommand = defineCommand({
-  meta: { name: "close", description: "delete a channel (removes the room and all its messages)" },
+var init = defineCommand({
+  meta: {
+    name: "init",
+    description: `write ${PROJECT_CONFIG_NAME} in the current directory (local state, gitignored)`
+  },
   args: {
-    channel: { type: "positional", required: true, description: "channel id" },
+    workspace: { type: "string", description: "workspace id (skip prompt)" },
+    project: { type: "string", description: "project id (skip prompt)" },
+    force: { type: "boolean", description: `overwrite existing ${PROJECT_CONFIG_NAME}` },
     ...common
   },
   run: async ({ args }) => {
-    await channelClient(resolveBaseUrl(args.url)).destroy(args.channel);
-    console.log(args.json ? toJson({ ok: true, deleted: args.channel }) : `closed ${args.channel}`);
+    const server = resolveBaseUrl(args.url);
+    const cfgPath = projectConfigPath();
+    if (existsSync2(cfgPath) && !args.force)
+      throw new Error(`${PROJECT_CONFIG_NAME} already exists. use --force to overwrite.`);
+    const c = createClient(server);
+    let project2;
+    let workspace2;
+    if (args.project) {
+      project2 = await c.projects.get(Number(args.project));
+      workspace2 = await c.workspaces.get(project2.workspaceId);
+    } else {
+      const wsList = await c.workspaces.list();
+      workspace2 = args.workspace ? wsList.find((w) => w.id === Number(args.workspace)) ?? (() => {
+        throw new Error(`workspace ${args.workspace} not found`);
+      })() : await promptPick("workspace", wsList);
+      const projects = await c.projects.listByWorkspace(workspace2.id);
+      project2 = await promptPick("project", projects);
+    }
+    const cfg = {
+      server,
+      workspace: workspace2.id,
+      project: project2.id,
+      name: project2.name
+    };
+    saveProjectConfig(cfgPath, cfg);
+    console.log(`wrote ${cfgPath}`);
+    console.log(`  server:    ${server}`);
+    console.log(`  workspace: #${workspace2.id}  ${workspace2.name}`);
+    console.log(`  project:   #${project2.id}  ${project2.name}`);
   }
 });
 
-// src/commands/channel/shared.ts
-var readStdin = async () => {
-  const chunks = [];
-  for await (const c of process.stdin) chunks.push(c);
-  return Buffer.concat(chunks).toString("utf8");
-};
-var renderRoster = (members) => members.length ? members.map((m) => `  ${m.name} (${m.kind})`).join("\n") : "  (nobody online)";
-var webLink = (url, channelId) => {
-  const origin = url.replace(/\/api\/?$/, "");
-  return origin === url ? null : `${origin}/channel/${channelId}`;
-};
-var inviteBlock = (url, channelId) => {
-  const web = webLink(url, channelId);
-  return [
-    "\u2500\u2500 Share this to invite anyone into the room \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
-    ...web ? [`Humans \u2014 open in a browser:  ${web}`, ""] : [],
-    "Agents \u2014 two curl steps:",
-    `  1) see the room:  curl -sS "${url}/channels/${channelId}"`,
-    `  2) read protocol: curl -sS "${url}/channels/help"  (then join / listen / send, pick your own NAME)`,
-    "",
-    `connection: url=${url} channel=${channelId}`,
-    "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
-  ].join("\n");
+// src/commands/session/shared.ts
+var resolveSession = async (client, projectId, handle) => {
+  const asInt = Number(handle);
+  if (Number.isInteger(asInt) && asInt > 0) {
+    const byId = await client.sessions.get(asInt).catch(() => null);
+    if (byId) return { id: byId.id, name: byId.name };
+  }
+  const byName = await client.sessions.findByName(projectId, handle);
+  if (byName) return { id: byName.id, name: byName.name };
+  throw new Error(`session "${handle}" not found in project ${projectId}`);
 };
 
-// src/commands/channel/create.ts
-var createCommand = defineCommand({
-  meta: {
-    name: "create",
-    description: "open a channel (chat room) in a workspace and print an invite"
-  },
+// src/commands/loop/create.ts
+var loopCreateCommand = defineCommand({
+  meta: { name: "create", description: "create a recurring scheduled message on a session" },
   args: {
-    workspace: {
+    session: { type: "positional", required: true, description: "session int id or name" },
+    message: {
       type: "string",
-      description: "owning workspace id (or the cwd .baton.json workspace)"
+      required: true,
+      description: "message sent to the session each beat"
     },
-    name: { type: "string", description: "room title (optional)" },
-    desc: {
+    every: {
       type: "string",
-      description: "room self-description: purpose / topic / how to participate"
+      required: true,
+      description: "interval: 90s / 30m / 2h / 1d (min 30s)"
     },
+    name: { type: "string", description: "optional label" },
+    off: { type: "boolean", description: "create paused (disabled)" },
+    project: { type: "string", description: "project id (overrides .baton.json)" },
     ...common
   },
   run: async ({ args }) => {
-    const url = resolveBaseUrl(args.url);
-    const workspaceId = resolveWorkspaceId(args);
-    const { channelId } = await channelClient(url).create(
-      workspaceId,
-      args.name,
-      args.desc,
-      resolveBearer()
-    );
-    if (args.json) {
-      console.log(toJson({ channelId, url, workspaceId, name: args.name, description: args.desc }));
-      return;
-    }
-    console.log(`channel ${channelId} opened in workspace ${workspaceId}
-`);
-    console.log(inviteBlock(url, channelId));
+    const c = clientFor(args);
+    const session2 = await resolveSession(c, resolveProjectId(args), args.session);
+    const loop2 = await c.loops.create(session2.id, {
+      message: args.message,
+      intervalSec: parseDuration(args.every),
+      name: args.name,
+      enabled: !args.off
+    });
+    console.log(renderOne(loop2, fmtLoop, Boolean(args.json)));
   }
 });
 
-// src/commands/channel/download.ts
-import { writeFileSync as writeFileSync2 } from "node:fs";
-var downloadCommand = defineCommand({
-  meta: { name: "download", description: "download a channel attachment to a file" },
+// src/commands/loop/disable.ts
+var loopDisableCommand = defineCommand({
+  meta: { name: "disable", description: "disable (pause) a loop" },
   args: {
-    channel: { type: "positional", required: true, description: "channel id" },
-    att: { type: "positional", required: true, description: "attachment id (from a message ref)" },
-    out: { type: "string", alias: "o", description: "output file path (default: ./<attId>)" },
+    loop: { type: "positional", required: true, description: "loop int id" },
     ...common
   },
   run: async ({ args }) => {
-    const url = resolveBaseUrl(args.url);
-    const res = await channelClient(url).downloadAttachment(args.channel, args.att);
-    const out = args.out ?? args.att;
-    writeFileSync2(out, Buffer.from(await res.arrayBuffer()));
-    console.log(`saved \u2192 ${out}`);
+    const c = clientFor(args);
+    const loop2 = await c.loops.update(Number(args.loop), { enabled: false });
+    console.log(renderOne(loop2, fmtLoop, Boolean(args.json)));
   }
 });
 
-// src/commands/channel/info.ts
-var aboutCommand = defineCommand({
-  meta: { name: "about", description: "show a channel's manifest (description + online roster)" },
+// src/commands/loop/enable.ts
+var loopEnableCommand = defineCommand({
+  meta: { name: "enable", description: "enable (resume) a loop" },
   args: {
-    channel: { type: "positional", required: true, description: "channel id" },
+    loop: { type: "positional", required: true, description: "loop int id" },
     ...common
   },
   run: async ({ args }) => {
-    const url = resolveBaseUrl(args.url);
-    const m = await channelClient(url).manifest(args.channel);
-    if (args.json) {
-      console.log(toJson(m));
-      return;
-    }
-    console.log(`${m.title ?? "(untitled)"}  [${m.id}]`);
-    if (m.description) console.log(m.description);
-    console.log(`
-online (${m.members.length}):
-${renderRoster(m.members)}`);
-    console.log(`
-protocol: curl -sS "${url}${m.help}"`);
+    const c = clientFor(args);
+    const loop2 = await c.loops.update(Number(args.loop), { enabled: true });
+    console.log(renderOne(loop2, fmtLoop, Boolean(args.json)));
   }
 });
-var helpCommand = defineCommand({
-  meta: { name: "help", description: "print the channel protocol doc" },
-  args: { ...common },
+
+// src/commands/loop/get.ts
+var loopGetCommand = defineCommand({
+  meta: { name: "get", description: "show one loop" },
+  args: {
+    loop: { type: "positional", required: true, description: "loop int id" },
+    ...common
+  },
   run: async ({ args }) => {
-    console.log(await channelClient(resolveBaseUrl(args.url)).help());
+    const c = clientFor(args);
+    const loop2 = await c.loops.get(Number(args.loop));
+    console.log(renderOne(loop2, fmtLoop, Boolean(args.json)));
   }
 });
-var membersCommand = defineCommand({
-  meta: { name: "members", description: "list the channel's online roster" },
+
+// src/commands/loop/ls.ts
+var loopLsCommand = defineCommand({
+  meta: { name: "ls", description: "list a session's loops" },
   args: {
-    channel: { type: "positional", required: true, description: "channel id" },
+    session: { type: "positional", required: true, description: "session int id or name" },
+    project: { type: "string", description: "project id (overrides .baton.json)" },
     ...common
   },
   run: async ({ args }) => {
-    const url = resolveBaseUrl(args.url);
-    const members = await channelClient(url).members(args.channel);
-    console.log(args.json ? toJson(members) : renderRoster(members));
+    const c = clientFor(args);
+    const session2 = await resolveSession(c, resolveProjectId(args), args.session);
+    const loops = await c.loops.listBySession(session2.id);
+    console.log(renderList(loops, fmtLoop, Boolean(args.json)));
   }
 });
-var updateCommand = defineCommand({
-  meta: { name: "update", description: "update a channel's title / description (topic + rules)" },
+
+// src/commands/loop/rm.ts
+var loopRmCommand = defineCommand({
+  meta: { name: "rm", description: "delete a loop" },
   args: {
-    channel: { type: "positional", required: true, description: "channel id" },
-    title: { type: "string", description: "new title" },
-    desc: { type: "string", description: "new description (purpose / topic / rules)" },
+    loop: { type: "positional", required: true, description: "loop int id" },
     ...common
   },
   run: async ({ args }) => {
-    if (args.title === void 0 && args.desc === void 0)
-      throw new Error("nothing to update: pass --title and/or --desc");
-    const url = resolveBaseUrl(args.url);
-    const ch = await channelClient(url).update(args.channel, {
-      title: args.title,
-      description: args.desc
-    });
-    console.log(args.json ? toJson(ch) : `updated ${ch.id}${ch.title ? ` \u2014 ${ch.title}` : ""}`);
+    const c = clientFor(args);
+    const id = Number(args.loop);
+    await c.loops.remove(id);
+    console.log(removed("loop", id, Boolean(args.json)));
+  }
+});
+
+// src/commands/loop/set.ts
+var loopSetCommand = defineCommand({
+  meta: { name: "set", description: "update a loop (message / interval / name)" },
+  args: {
+    loop: { type: "positional", required: true, description: "loop int id" },
+    message: { type: "string", description: "new message" },
+    every: { type: "string", description: "new interval: 90s / 30m / 2h / 1d" },
+    name: { type: "string", description: "new label" },
+    ...common
+  },
+  run: async ({ args }) => {
+    const c = clientFor(args);
+    const patch = {};
+    if (args.message !== void 0) patch.message = args.message;
+    if (args.every !== void 0 && args.every !== "") patch.intervalSec = parseDuration(args.every);
+    if (args.name !== void 0) patch.name = args.name;
+    const loop2 = await c.loops.update(Number(args.loop), patch);
+    console.log(renderOne(loop2, fmtLoop, Boolean(args.json)));
+  }
+});
+
+// src/commands/loop.ts
+var loop = defineCommand({
+  meta: { name: "loop", description: "recurring scheduled messages that wake a session" },
+  subCommands: {
+    create: loopCreateCommand,
+    ls: loopLsCommand,
+    get: loopGetCommand,
+    set: loopSetCommand,
+    enable: loopEnableCommand,
+    disable: loopDisableCommand,
+    rm: loopRmCommand
+  }
+});
+
+// src/commands/notify.ts
+var describe = (result) => {
+  if (result.status === "sent") return `notified ${result.devices} device(s)`;
+  if (result.status === "throttled")
+    return `throttled: this session can notify again in ${result.retryAfterSec}s`;
+  return "nobody to notify: no human has messaged this session, or they have not enabled notifications";
+};
+var notify = defineCommand({
+  meta: {
+    name: "notify",
+    description: "Push a phone notification to the person working with this session. Use it only when a human needs to act now: something is wrong, a decision is needed, or the work is blocked. Do not use it for routine progress, and not to announce that a turn finished (that is already pushed). At most one notification per session every 10 minutes; text is cut at 200 characters."
+  },
+  args: {
+    text: { type: "positional", required: true, description: "one short line for the lock screen" },
+    ...common
+  },
+  run: async ({ args }) => {
+    const raw = process.env.BATON_SESSION_ID;
+    if (raw === void 0)
+      throw new Error("baton notify only works inside a baton session (BATON_SESSION_ID is unset)");
+    const sessionId = Number(raw);
+    if (!Number.isSafeInteger(sessionId) || sessionId <= 0)
+      throw new Error("invalid BATON_SESSION_ID");
+    const result = await clientFor(args).sessions.notify(sessionId, args.text);
+    console.log(args.json ? toJson(result) : describe(result));
+  }
+});
+
+// src/commands/project.ts
+var createProject = (c, input, json) => c.projects.create(input).then((p) => renderOne(p, fmtProject, json));
+var listProjects = (c, workspaceId, json) => c.projects.listByWorkspace(workspaceId).then((ps) => renderList(ps, fmtProject, json));
+var getProject = (c, id, json) => c.projects.get(id).then((p) => renderOne(p, fmtProject, json));
+var updateProject = (c, id, patch, json) => c.projects.update(id, patch).then((p) => renderOne(p, fmtProject, json));
+var removeProject = (c, id, json) => c.projects.remove(id).then(() => removed("project", id, json));
+var project = defineCommand({
+  meta: { name: "project", description: "manage projects" },
+  subCommands: {
+    create: defineCommand({
+      meta: { name: "create", description: "create a project" },
+      args: {
+        name: { type: "positional", required: true },
+        workspace: { type: "string", description: "workspace id (overrides .baton.json)" },
+        desc: { type: "string", description: "description" },
+        ...common
+      },
+      run: async ({ args }) => {
+        const out = await createProject(
+          clientFor(args),
+          { workspaceId: resolveWorkspaceId(args), name: args.name, description: args.desc },
+          Boolean(args.json)
+        );
+        console.log(out);
+      }
+    }),
+    ls: defineCommand({
+      meta: { name: "ls", description: "list projects in a workspace" },
+      args: {
+        workspace: { type: "string", description: "workspace id (overrides .baton.json)" },
+        ...common
+      },
+      run: async ({ args }) => {
+        console.log(
+          await listProjects(clientFor(args), resolveWorkspaceId(args), Boolean(args.json))
+        );
+      }
+    }),
+    get: defineCommand({
+      meta: { name: "get", description: "get a project" },
+      args: { id: { type: "positional", required: true }, ...common },
+      run: async ({ args }) => {
+        console.log(await getProject(clientFor(args), Number(args.id), Boolean(args.json)));
+      }
+    }),
+    update: defineCommand({
+      meta: { name: "update", description: "rename a project / set its description" },
+      args: {
+        id: { type: "positional", required: true },
+        name: { type: "string", description: "new name" },
+        desc: { type: "string", description: "new description" },
+        ...common
+      },
+      run: async ({ args }) => {
+        const patch = {
+          ...args.name !== void 0 ? { name: args.name } : {},
+          ...args.desc !== void 0 ? { description: args.desc } : {}
+        };
+        if (Object.keys(patch).length === 0) throw new Error("pass --name and/or --desc");
+        console.log(
+          await updateProject(clientFor(args), Number(args.id), patch, Boolean(args.json))
+        );
+      }
+    }),
+    rm: defineCommand({
+      meta: { name: "rm", description: "delete a project" },
+      args: { id: { type: "positional", required: true }, ...common },
+      run: async ({ args }) => {
+        console.log(await removeProject(clientFor(args), Number(args.id), Boolean(args.json)));
+      }
+    })
   }
 });
 
-// src/commands/channel/listen.ts
-import { mkdirSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { tmpdir } from "node:os";
-import { join as join2 } from "node:path";
+// src/provisioner/config.ts
+import { execFile } from "node:child_process";
+import { constants } from "node:fs";
+import { access, readFile, stat as stat2 } from "node:fs/promises";
+import { isAbsolute } from "node:path";
+import { promisify } from "node:util";
 
 // ../shared/src/domain/attachment.ts
 var labelAttachments = (attachments) => {
@@ -6753,9 +6370,6 @@ var labelAttachments = (attachments) => {
   });
 };
 
-// ../shared/src/domain/channel.ts
-var isMessageFor = (msg, name) => !msg.to || msg.to.length === 0 || msg.to.includes(name);
-
 // ../shared/src/domain/file.ts
 var FILE_TEXT_MAX_BYTES = 5 * 1024 * 1024;
 var FILE_DIRECTORY_MAX_ENTRIES = 2e3;
@@ -6799,738 +6413,650 @@ var normalizeFilePath = (value, allowRoot = false) => {
 var SENSITIVE_SEGMENTS = /* @__PURE__ */ new Set([".git", ".ssh", ".aws", ".kube", ".gnupg"]);
 var SENSITIVE_NAMES = /* @__PURE__ */ new Set([
   ".baton.json",
-  ".envrc",
-  ".npmrc",
-  ".netrc",
-  ".pypirc",
-  ".git-credentials",
-  ".pgpass",
-  ".htpasswd",
-  ".credentials.json"
-]);
-var SENSITIVE_EXTENSIONS = [".pem", ".key", ".p12", ".pfx", ".jks", ".keystore"];
-var isSensitiveName = (name) => SENSITIVE_NAMES.has(name) || /^\.env(\..+)?$/.test(name) && !/\.(example|sample|template)$/.test(name) || /^id_(rsa|dsa|ecdsa|ed25519)$/.test(name) || SENSITIVE_EXTENSIONS.some((extension2) => name.endsWith(extension2));
-var isSensitiveFilePath = (path) => {
-  const segments = path.toLowerCase().split("/");
-  return segments.some((segment) => SENSITIVE_SEGMENTS.has(segment)) || isSensitiveName(segments.at(-1) ?? "");
-};
-var EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".pnpm-store",
-  "dist",
-  "build",
-  "coverage",
-  ".next",
-  ".turbo",
-  ".cache",
-  ".venv",
-  "__pycache__",
-  "target"
-]);
-var isExcludedDirectoryName = (name) => EXCLUDED_DIRECTORIES.has(name);
-
-// ../shared/src/domain/service.ts
-var SERVICE_PUBLIC_URL_MAX_LENGTH = 2048;
-var SERVICE_NOTE_MAX_LENGTH = 500;
-var isServicePublicUrl = (value) => {
-  if (value.length === 0 || value.length > SERVICE_PUBLIC_URL_MAX_LENGTH) return false;
-  try {
-    const url = new URL(value);
-    return url.protocol === "http:" || url.protocol === "https:";
-  } catch {
-    return false;
-  }
-};
-var isServiceNote = (value) => value.length > 0 && value.length <= SERVICE_NOTE_MAX_LENGTH;
-
-// ../shared/src/domain/session.ts
-var AGENT_KINDS = ["claude-code", "codex", "pi"];
-var isAgentKind = (v) => typeof v === "string" && AGENT_KINDS.includes(v);
-var EFFORTS = ["low", "medium", "high", "xhigh", "max", "ultra"];
-var isAgentEffort = (v) => typeof v === "string" && EFFORTS.includes(v);
-
-// ../shared/src/domain/session-event.ts
-var agentMessageText = (payload) => {
-  if (typeof payload !== "object" || payload === null) return null;
-  const event = payload;
-  if (!["item.started", "item.updated", "item.completed"].includes(String(event.type))) return null;
-  const item = event.item;
-  if (typeof item !== "object" || item === null) return null;
-  const { type, id, text } = item;
-  if (type !== "agent_message" || typeof id !== "string" || typeof text !== "string") return null;
-  const trimmed = text.trim();
-  return trimmed ? { id, text: trimmed } : null;
-};
-
-// ../shared/src/domain/worker-creation.ts
-var WORKER_TEMPLATES = [
-  { id: "mini-glm-codeplan", name: "GLM Code Plan", agentKinds: ["claude-code", "pi"] },
-  { id: "mini-dashscope-codeplan", name: "DashScope Code Plan", agentKinds: ["claude-code", "pi"] },
-  { id: "mini-codex", name: "\u672C\u673A Codex", agentKinds: ["codex"] }
-];
-var workerTemplateAgentKinds = (id) => id === "mini-local" ? AGENT_KINDS : WORKER_TEMPLATES.find((template) => template.id === id)?.agentKinds ?? [];
-var isWorkerTemplateId = (value) => typeof value === "string" && workerTemplateAgentKinds(value).length > 0;
-
-// src/commands/channel/listen.ts
-var PREVIEW = 280;
-var describe = (e) => {
-  const ev = e;
-  return ev?.code ? `${ev.code}${ev.message ? ` ${ev.message}` : ""}` : String(e);
-};
-var runListen = async (o) => {
-  const emit = (x) => {
-    process.stdout.write(`${JSON.stringify(x)}
-`);
-  };
-  const spillDir = join2(tmpdir(), "channel", o.channel);
-  mkdirSync(spillDir, { recursive: true });
-  const surface = (m) => {
-    const text = typeof m.text === "string" ? m.text : "";
-    const file = join2(spillDir, `${m.seq}.txt`);
-    writeFileSync3(file, text);
-    const truncated = text.length > PREVIEW;
-    emit({
-      type: "channel.message",
-      seq: m.seq,
-      from: m.from,
-      senderKind: m.senderKind,
-      to: m.to,
-      mine: o.from ? isMessageFor(m, o.from) : void 0,
-      ts: m.ts,
-      chars: text.length,
-      truncated,
-      preview: truncated ? `${text.slice(0, PREVIEW)} \u2026` : text,
-      // BASE-prefixed urls so the subscribing agent can fetch directly.
-      attachments: m.attachments?.length ? m.attachments.map((a) => ({
-        filename: a.filename,
-        contentType: a.contentType,
-        size: a.size,
-        url: `${o.url}${a.url}`
-      })) : void 0,
-      file
-    });
-  };
-  const close = channelClient(o.url).listen(o.channel, {
-    since: o.since,
-    for: o.for,
-    as: o.from,
-    // Skip our own messages (they echo back over the same channel).
-    onMessage: (m) => {
-      if (m.from !== o.from) surface(m);
-    },
-    onError: (e) => emit({ type: "channel.error", error: describe(e) })
-  });
-  emit({ type: "channel.listening", channel: o.channel, from: o.from, url: o.url });
-  await new Promise((resolve4) => {
-    const stop = () => {
-      close();
-      resolve4();
-    };
-    process.on("SIGINT", stop);
-    process.on("SIGTERM", stop);
-  });
-};
-var listenCommand = defineCommand({
-  meta: {
-    name: "listen",
-    description: "stream a channel: one JSON line per message (for a background subscriber)"
-  },
-  args: {
-    channel: { type: "positional", required: true, description: "channel id" },
-    from: {
-      type: "string",
-      description: "your name; your own messages skipped, presence kept fresh"
-    },
-    since: { type: "string", description: "replay messages after this seq (default 0 = full)" },
-    for: { type: "string", description: "only broadcasts + messages addressed to this name" },
-    ...common
-  },
-  run: async ({ args }) => {
-    await runListen({
-      url: resolveBaseUrl(args.url),
-      channel: args.channel,
-      from: args.from ?? "",
-      since: args.since ? Number(args.since) : 0,
-      for: args.for
-    });
-  }
-});
-
-// src/commands/channel/join.ts
-var joinCommand = defineCommand({
-  meta: {
-    name: "join",
-    description: "join a channel (register presence); --listen to also stream"
-  },
-  args: {
-    channel: { type: "positional", required: true, description: "channel id" },
-    from: { type: "string", required: true, description: "your participant name" },
-    kind: { type: "string", description: "your kind: agent (default) | human" },
-    listen: {
-      type: "boolean",
-      description: "after joining, stream messages (background subscriber)"
-    },
-    since: { type: "string", description: "with --listen: replay after this seq (default 0)" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const url = resolveBaseUrl(args.url);
-    const kind = args.kind === "human" ? "human" : "agent";
-    const members = await channelClient(url).join(args.channel, args.from, kind);
-    if (!args.listen) {
-      if (args.json) console.log(toJson({ joined: args.from, members }));
-      else
-        console.log(`joined as ${args.from} (${members.length} online)
-${renderRoster(members)}`);
-      return;
-    }
-    await runListen({
-      url,
-      channel: args.channel,
-      from: args.from,
-      since: args.since ? Number(args.since) : 0
-    });
-  }
-});
-
-// src/commands/channel/read.ts
-var fmtMessage = (m, base) => {
-  const head = `${m.seq}  ${m.from}  ${m.text}`;
-  const atts = (m.attachments ?? []).map((a) => `
-    \u{1F4CE} ${a.filename} \u2192 ${base}${a.url}`).join("");
-  return head + atts;
-};
-var readCommand = defineCommand({
-  meta: { name: "read", description: "poll channel messages once (curl-style, since a cursor)" },
-  args: {
-    channel: { type: "positional", required: true, description: "channel id" },
-    since: { type: "string", description: "only messages after this seq (default 0)" },
-    from: { type: "string", description: "skip messages from this name (no echo)" },
-    for: { type: "string", description: "only broadcasts + messages addressed to this name" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const url = resolveBaseUrl(args.url);
-    const msgs = await channelClient(url).read(args.channel, {
-      since: args.since ? Number(args.since) : 0,
-      for: args.for
-    });
-    const out = args.from ? msgs.filter((m) => m.from !== args.from) : msgs;
-    if (args.json) console.log(toJson(out));
-    else console.log(out.length ? out.map((m) => fmtMessage(m, url)).join("\n") : "(none)");
-  }
-});
-
-// src/commands/channel/send.ts
-import { openAsBlob as openAsBlob3, readFileSync as readFileSync2 } from "node:fs";
-import { basename as basename3 } from "node:path";
-
-// src/commands/attach.ts
-import { openAsBlob as openAsBlob2 } from "node:fs";
-import { basename as basename2 } from "node:path";
-var attachPaths = (raw) => (raw === void 0 ? [] : Array.isArray(raw) ? raw : [raw]).flatMap((p) => p.split(",")).map((p) => p.trim()).filter(Boolean);
-var uploadAttachments = async (client, sessionId, paths) => {
-  const out = [];
-  for (const path of paths) {
-    const body = await openAsBlob2(path, { type: contentTypeForPath(path) });
-    out.push(
-      await client.sessions.uploadAttachment(sessionId, {
-        filename: basename2(path),
-        contentType: contentTypeForPath(path),
-        body
-      })
-    );
-  }
-  return out;
-};
-
-// src/commands/channel/send.ts
-var sendCommand = defineCommand({
-  meta: { name: "send", description: "post one message to a channel" },
-  args: {
-    channel: { type: "positional", required: true, description: "channel id" },
-    text: { type: "positional", required: false, description: "message text (short one-liner)" },
-    from: { type: "string", description: "your participant name (default: peer)" },
-    to: {
-      type: "string",
-      description: "direct it at these names (comma-separated); omit = broadcast"
-    },
-    file: { type: "string", description: "read message body from this file (for large content)" },
-    attach: {
-      type: "string",
-      description: "attach file(s) (comma-separated paths); uploaded + carried on the message"
-    },
-    ...common
-  },
-  run: async ({ args }) => {
-    const url = resolveBaseUrl(args.url);
-    const client = channelClient(url);
-    let text = args.text;
-    if (text === void 0 && args.file) text = readFileSync2(args.file, "utf8");
-    if (text === void 0 && !process.stdin.isTTY) text = await readStdin();
-    const attachments = [];
-    for (const path of attachPaths(args.attach)) {
-      attachments.push(
-        await client.uploadAttachment(args.channel, {
-          filename: basename3(path),
-          contentType: contentTypeForPath(path),
-          body: await openAsBlob3(path, { type: contentTypeForPath(path) })
-        })
-      );
-    }
-    if (!text && attachments.length === 0)
-      throw new Error(
-        "nothing to send: provide text, --file <path>, --attach <file>, or pipe stdin"
-      );
-    const msg = await client.send(args.channel, {
-      from: args.from ?? "peer",
-      text: text ?? "",
-      to: splitCsv(args.to),
-      attachments: attachments.length ? attachments : void 0
-    });
-    if (args.json) console.log(toJson(msg));
-    else console.log(`sent (seq ${msg.seq})`);
-  }
-});
-
-// src/commands/channel.ts
-var channel = defineCommand({
-  meta: {
-    name: "channel",
-    description: "multi-agent chat room: create / about / update / help / join / members / send / read / listen / download / close"
-  },
-  subCommands: {
-    create: createCommand,
-    about: aboutCommand,
-    update: updateCommand,
-    help: helpCommand,
-    join: joinCommand,
-    members: membersCommand,
-    send: sendCommand,
-    read: readCommand,
-    listen: listenCommand,
-    download: downloadCommand,
-    close: closeCommand
-  }
-});
-
-// src/commands/init.ts
-import { existsSync as existsSync2 } from "node:fs";
-import * as readline from "node:readline/promises";
-var promptPick = async (label, items) => {
-  if (items.length === 0) throw new Error(`no ${label}s found on server`);
-  console.log(`${label}s:`);
-  items.forEach((it, i) => {
-    console.log(`  [${i + 1}] #${it.id}  ${it.name}`);
-  });
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    const ans = (await rl.question(`pick a ${label} (1-${items.length}): `)).trim();
-    const idx = Number(ans) - 1;
-    const picked = items[idx];
-    if (!picked) throw new Error(`invalid choice: ${ans}`);
-    return picked;
-  } finally {
-    rl.close();
-  }
-};
-var init = defineCommand({
-  meta: {
-    name: "init",
-    description: `write ${PROJECT_CONFIG_NAME} in the current directory (local state, gitignored)`
-  },
-  args: {
-    workspace: { type: "string", description: "workspace id (skip prompt)" },
-    project: { type: "string", description: "project id (skip prompt)" },
-    force: { type: "boolean", description: `overwrite existing ${PROJECT_CONFIG_NAME}` },
-    ...common
-  },
-  run: async ({ args }) => {
-    const server = resolveBaseUrl(args.url);
-    const cfgPath = projectConfigPath();
-    if (existsSync2(cfgPath) && !args.force)
-      throw new Error(`${PROJECT_CONFIG_NAME} already exists. use --force to overwrite.`);
-    const c = createClient(server);
-    let project2;
-    let workspace2;
-    if (args.project) {
-      project2 = await c.projects.get(Number(args.project));
-      workspace2 = await c.workspaces.get(project2.workspaceId);
-    } else {
-      const wsList = await c.workspaces.list();
-      workspace2 = args.workspace ? wsList.find((w) => w.id === Number(args.workspace)) ?? (() => {
-        throw new Error(`workspace ${args.workspace} not found`);
-      })() : await promptPick("workspace", wsList);
-      const projects = await c.projects.listByWorkspace(workspace2.id);
-      project2 = await promptPick("project", projects);
-    }
-    const cfg = {
-      server,
-      workspace: workspace2.id,
-      project: project2.id,
-      name: project2.name
-    };
-    saveProjectConfig(cfgPath, cfg);
-    console.log(`wrote ${cfgPath}`);
-    console.log(`  server:    ${server}`);
-    console.log(`  workspace: #${workspace2.id}  ${workspace2.name}`);
-    console.log(`  project:   #${project2.id}  ${project2.name}`);
-  }
-});
-
-// src/commands/session/shared.ts
-var resolveSession = async (client, projectId, handle) => {
-  const asInt = Number(handle);
-  if (Number.isInteger(asInt) && asInt > 0) {
-    const byId = await client.sessions.get(asInt).catch(() => null);
-    if (byId) return { id: byId.id, name: byId.name };
-  }
-  const byName = await client.sessions.findByName(projectId, handle);
-  if (byName) return { id: byName.id, name: byName.name };
-  throw new Error(`session "${handle}" not found in project ${projectId}`);
+  ".envrc",
+  ".npmrc",
+  ".netrc",
+  ".pypirc",
+  ".git-credentials",
+  ".pgpass",
+  ".htpasswd",
+  ".credentials.json"
+]);
+var SENSITIVE_EXTENSIONS = [".pem", ".key", ".p12", ".pfx", ".jks", ".keystore"];
+var isSensitiveName = (name) => SENSITIVE_NAMES.has(name) || /^\.env(\..+)?$/.test(name) && !/\.(example|sample|template)$/.test(name) || /^id_(rsa|dsa|ecdsa|ed25519)$/.test(name) || SENSITIVE_EXTENSIONS.some((extension2) => name.endsWith(extension2));
+var isSensitiveFilePath = (path) => {
+  const segments = path.toLowerCase().split("/");
+  return segments.some((segment) => SENSITIVE_SEGMENTS.has(segment)) || isSensitiveName(segments.at(-1) ?? "");
 };
+var EXCLUDED_DIRECTORIES = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".pnpm-store",
+  "dist",
+  "build",
+  "coverage",
+  ".next",
+  ".turbo",
+  ".cache",
+  ".venv",
+  "__pycache__",
+  "target"
+]);
+var isExcludedDirectoryName = (name) => EXCLUDED_DIRECTORIES.has(name);
 
-// src/commands/loop/create.ts
-var loopCreateCommand = defineCommand({
-  meta: { name: "create", description: "create a recurring scheduled message on a session" },
-  args: {
-    session: { type: "positional", required: true, description: "session int id or name" },
-    message: {
-      type: "string",
-      required: true,
-      description: "message sent to the session each beat"
-    },
-    every: {
-      type: "string",
-      required: true,
-      description: "interval: 90s / 30m / 2h / 1d (min 30s)"
-    },
-    name: { type: "string", description: "optional label" },
-    off: { type: "boolean", description: "create paused (disabled)" },
-    project: { type: "string", description: "project id (overrides .baton.json)" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const c = clientFor(args);
-    const session2 = await resolveSession(c, resolveProjectId(args), args.session);
-    const loop2 = await c.loops.create(session2.id, {
-      message: args.message,
-      intervalSec: parseDuration(args.every),
-      name: args.name,
-      enabled: !args.off
-    });
-    console.log(renderOne(loop2, fmtLoop, Boolean(args.json)));
-  }
-});
-
-// src/commands/loop/disable.ts
-var loopDisableCommand = defineCommand({
-  meta: { name: "disable", description: "disable (pause) a loop" },
-  args: {
-    loop: { type: "positional", required: true, description: "loop int id" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const c = clientFor(args);
-    const loop2 = await c.loops.update(Number(args.loop), { enabled: false });
-    console.log(renderOne(loop2, fmtLoop, Boolean(args.json)));
-  }
-});
-
-// src/commands/loop/enable.ts
-var loopEnableCommand = defineCommand({
-  meta: { name: "enable", description: "enable (resume) a loop" },
-  args: {
-    loop: { type: "positional", required: true, description: "loop int id" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const c = clientFor(args);
-    const loop2 = await c.loops.update(Number(args.loop), { enabled: true });
-    console.log(renderOne(loop2, fmtLoop, Boolean(args.json)));
+// ../shared/src/domain/service.ts
+var SERVICE_PUBLIC_URL_MAX_LENGTH = 2048;
+var SERVICE_NOTE_MAX_LENGTH = 500;
+var isServicePublicUrl = (value) => {
+  if (value.length === 0 || value.length > SERVICE_PUBLIC_URL_MAX_LENGTH) return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
   }
-});
+};
+var isServiceNote = (value) => value.length > 0 && value.length <= SERVICE_NOTE_MAX_LENGTH;
 
-// src/commands/loop/get.ts
-var loopGetCommand = defineCommand({
-  meta: { name: "get", description: "show one loop" },
-  args: {
-    loop: { type: "positional", required: true, description: "loop int id" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const c = clientFor(args);
-    const loop2 = await c.loops.get(Number(args.loop));
-    console.log(renderOne(loop2, fmtLoop, Boolean(args.json)));
-  }
-});
+// ../shared/src/domain/session.ts
+var AGENT_KINDS = ["claude-code", "codex", "pi"];
+var isAgentKind = (v) => typeof v === "string" && AGENT_KINDS.includes(v);
+var EFFORTS = ["low", "medium", "high", "xhigh", "max", "ultra"];
+var isAgentEffort = (v) => typeof v === "string" && EFFORTS.includes(v);
 
-// src/commands/loop/ls.ts
-var loopLsCommand = defineCommand({
-  meta: { name: "ls", description: "list a session's loops" },
-  args: {
-    session: { type: "positional", required: true, description: "session int id or name" },
-    project: { type: "string", description: "project id (overrides .baton.json)" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const c = clientFor(args);
-    const session2 = await resolveSession(c, resolveProjectId(args), args.session);
-    const loops = await c.loops.listBySession(session2.id);
-    console.log(renderList(loops, fmtLoop, Boolean(args.json)));
-  }
-});
+// ../shared/src/domain/session-event.ts
+var agentMessageText = (payload) => {
+  if (typeof payload !== "object" || payload === null) return null;
+  const event = payload;
+  if (!["item.started", "item.updated", "item.completed"].includes(String(event.type))) return null;
+  const item = event.item;
+  if (typeof item !== "object" || item === null) return null;
+  const { type, id, text } = item;
+  if (type !== "agent_message" || typeof id !== "string" || typeof text !== "string") return null;
+  const trimmed = text.trim();
+  return trimmed ? { id, text: trimmed } : null;
+};
 
-// src/commands/loop/rm.ts
-var loopRmCommand = defineCommand({
-  meta: { name: "rm", description: "delete a loop" },
-  args: {
-    loop: { type: "positional", required: true, description: "loop int id" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const c = clientFor(args);
-    const id = Number(args.loop);
-    await c.loops.remove(id);
-    console.log(removed("loop", id, Boolean(args.json)));
-  }
-});
+// ../shared/src/domain/worker-creation.ts
+var WORKER_TEMPLATES = [
+  { id: "mini-glm-codeplan", name: "GLM Code Plan", agentKinds: ["claude-code", "pi"] },
+  { id: "mini-dashscope-codeplan", name: "DashScope Code Plan", agentKinds: ["claude-code", "pi"] },
+  { id: "mini-codex", name: "\u672C\u673A Codex", agentKinds: ["codex"] }
+];
+var workerTemplateAgentKinds = (id) => id === "mini-local" ? AGENT_KINDS : WORKER_TEMPLATES.find((template) => template.id === id)?.agentKinds ?? [];
+var isWorkerTemplateId = (value) => typeof value === "string" && workerTemplateAgentKinds(value).length > 0;
 
-// src/commands/loop/set.ts
-var loopSetCommand = defineCommand({
-  meta: { name: "set", description: "update a loop (message / interval / name)" },
-  args: {
-    loop: { type: "positional", required: true, description: "loop int id" },
-    message: { type: "string", description: "new message" },
-    every: { type: "string", description: "new interval: 90s / 30m / 2h / 1d" },
-    name: { type: "string", description: "new label" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const c = clientFor(args);
-    const patch = {};
-    if (args.message !== void 0) patch.message = args.message;
-    if (args.every !== void 0 && args.every !== "") patch.intervalSec = parseDuration(args.every);
-    if (args.name !== void 0) patch.name = args.name;
-    const loop2 = await c.loops.update(Number(args.loop), patch);
-    console.log(renderOne(loop2, fmtLoop, Boolean(args.json)));
-  }
+// src/provisioner/config.ts
+var forbiddenEnv = /* @__PURE__ */ new Set([
+  "BATON_PROVISIONER_TOKEN",
+  "BATON_TOKEN",
+  "BATON_WORKER_TOKEN",
+  "BATON_USER",
+  "BATON_PASS",
+  "HOME",
+  "XDG_DATA_HOME"
+]);
+var object = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var absolutePath = (value, field) => {
+  if (typeof value !== "string" || !isAbsolute(value) || value.includes("\0"))
+    throw new Error(`${field} must be an absolute path`);
+  return value;
+};
+var environment = (value) => {
+  if (!object(value)) throw new Error("workerEnv must be an object");
+  return Object.fromEntries(
+    Object.entries(value).map(([key, entry]) => {
+      if (forbiddenEnv.has(key) || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || typeof entry !== "string" || entry.includes("\0"))
+        throw new Error(`invalid worker environment key: ${key}`);
+      return [key, entry];
+    })
+  );
+};
+var templates = (value) => {
+  if (!object(value)) throw new Error("templates must be an object");
+  return Object.fromEntries(
+    WORKER_TEMPLATES.filter((template) => value[template.id] !== void 0).map((template) => {
+      const raw = value[template.id];
+      if (!object(raw)) throw new Error(`template ${template.id} must be an object`);
+      const workerEnv2 = environment(raw.workerEnv);
+      if (template.id === "mini-codex") {
+        if (raw.pi !== void 0) throw new Error("mini-codex does not support pi");
+        return [template.id, { workerEnv: workerEnv2 }];
+      }
+      const provider = template.id === "mini-glm-codeplan" ? "zai-coding-cn" : "qwen-token-plan-cn";
+      const apiKey = template.id === "mini-glm-codeplan" ? "ZAI_CODING_CN_API_KEY" : "QWEN_TOKEN_PLAN_CN_API_KEY";
+      if (!workerEnv2.ANTHROPIC_BASE_URL || !(workerEnv2.ANTHROPIC_AUTH_TOKEN || workerEnv2.ANTHROPIC_API_KEY) || !workerEnv2[apiKey])
+        throw new Error(`template ${template.id} requires Claude and Pi credentials`);
+      if (!object(raw.pi) || raw.pi.provider !== provider || typeof raw.pi.model !== "string" || !raw.pi.model.trim())
+        throw new Error(`template ${template.id} requires its Pi provider and model`);
+      return [template.id, { workerEnv: workerEnv2, pi: { provider, model: raw.pi.model.trim() } }];
+    })
+  );
+};
+var commandEnvironment = (config) => ({
+  ...process.env,
+  PATH: config.workerEnv.PATH ?? process.env.PATH ?? "/usr/bin:/bin"
 });
-
-// src/commands/loop.ts
-var loop = defineCommand({
-  meta: { name: "loop", description: "recurring scheduled messages that wake a session" },
-  subCommands: {
-    create: loopCreateCommand,
-    ls: loopLsCommand,
-    get: loopGetCommand,
-    set: loopSetCommand,
-    enable: loopEnableCommand,
-    disable: loopDisableCommand,
-    rm: loopRmCommand
+var loadProvisionerConfig = async (path) => {
+  if (process.platform !== "darwin") throw new Error("provisioner requires macOS");
+  absolutePath(path, "config");
+  if ((await stat2(path)).mode & 63) throw new Error("config must be private: chmod 600 <config>");
+  const text = await readFile(path, "utf8");
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (error) {
+    if (!(error instanceof SyntaxError)) throw error;
+    throw new Error("invalid provisioner JSON config");
   }
-});
+  if (!object(raw) || typeof raw.server !== "string" || typeof raw.token !== "string")
+    throw new Error("server and token required");
+  let server;
+  try {
+    server = new URL(raw.server);
+  } catch (error) {
+    if (!(error instanceof TypeError)) throw error;
+    throw new Error("server must be a valid HTTP(S) URL");
+  }
+  if (!["http:", "https:"].includes(server.protocol) || server.username || server.password || server.search || server.hash)
+    throw new Error("server must be an HTTP(S) URL without credentials, query, or fragment");
+  if (!raw.token.trim() || /[\r\n]/.test(raw.token))
+    throw new Error("valid provisioner token required");
+  const config = {
+    server: server.toString().replace(/\/$/, ""),
+    token: raw.token.trim(),
+    projectsRoot: absolutePath(raw.projectsRoot, "projectsRoot"),
+    cliPath: absolutePath(raw.cliPath, "cliPath"),
+    nodePath: absolutePath(raw.nodePath ?? process.execPath, "nodePath"),
+    workerEnv: environment(raw.workerEnv),
+    templates: templates(raw.templates)
+  };
+  await access(config.cliPath, constants.R_OK);
+  await access(config.nodePath ?? process.execPath, constants.X_OK);
+  const env = commandEnvironment(config);
+  await promisify(execFile)("git", ["--version"], { env, timeout: 1e4 });
+  await promisify(execFile)("launchctl", ["help"], { env, timeout: 1e4 });
+  await promisify(execFile)("/usr/bin/plutil", ["-help"], { timeout: 1e4 });
+  return config;
+};
 
-// src/commands/notify.ts
-var describe2 = (result) => {
-  if (result.status === "sent") return `notified ${result.devices} device(s)`;
-  if (result.status === "throttled")
-    return `throttled: this session can notify again in ${result.retryAfterSec}s`;
-  return "nobody to notify: no human has messaged this session, or they have not enabled notifications";
+// ../../node_modules/.pnpm/eventsource-parser@3.1.0/node_modules/eventsource-parser/dist/index.js
+var ParseError = class extends Error {
+  constructor(message, options) {
+    super(message), this.name = "ParseError", this.type = options.type, this.field = options.field, this.value = options.value, this.line = options.line;
+  }
 };
-var notify = defineCommand({
-  meta: {
-    name: "notify",
-    description: "Push a phone notification to the person working with this session. Use it only when a human needs to act now: something is wrong, a decision is needed, or the work is blocked. Do not use it for routine progress, and not to announce that a turn finished (that is already pushed). At most one notification per session every 10 minutes; text is cut at 200 characters."
-  },
-  args: {
-    text: { type: "positional", required: true, description: "one short line for the lock screen" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const raw = process.env.BATON_SESSION_ID;
-    if (raw === void 0)
-      throw new Error("baton notify only works inside a baton session (BATON_SESSION_ID is unset)");
-    const sessionId = Number(raw);
-    if (!Number.isSafeInteger(sessionId) || sessionId <= 0)
-      throw new Error("invalid BATON_SESSION_ID");
-    const result = await clientFor(args).sessions.notify(sessionId, args.text);
-    console.log(args.json ? toJson(result) : describe2(result));
+var LF = 10;
+var CR = 13;
+var SPACE = 32;
+function noop(_arg) {
+}
+function createParser(config) {
+  if (typeof config == "function")
+    throw new TypeError(
+      "`config` must be an object, got a function instead. Did you mean `createParser({onEvent: fn})`?"
+    );
+  const { onEvent = noop, onError = noop, onRetry = noop, onComment, maxBufferSize } = config, pendingFragments = [];
+  let pendingFragmentsLength = 0, isFirstChunk = true, id, data = "", dataLines = 0, eventType, terminated = false;
+  function feed(chunk) {
+    if (terminated)
+      throw new Error(
+        "Cannot feed parser: it was terminated after exceeding the configured max buffer size. Call `reset()` to resume parsing."
+      );
+    if (isFirstChunk && (isFirstChunk = false, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.length === 0) {
+      const trailing2 = processLines(chunk);
+      trailing2 !== "" && (pendingFragments.push(trailing2), pendingFragmentsLength = trailing2.length), checkBufferSize();
+      return;
+    }
+    if (chunk.indexOf(`
+`) === -1 && chunk.indexOf("\r") === -1) {
+      pendingFragments.push(chunk), pendingFragmentsLength += chunk.length, checkBufferSize();
+      return;
+    }
+    pendingFragments.push(chunk);
+    const input = pendingFragments.join("");
+    pendingFragments.length = 0, pendingFragmentsLength = 0;
+    const trailing = processLines(input);
+    trailing !== "" && (pendingFragments.push(trailing), pendingFragmentsLength = trailing.length), checkBufferSize();
   }
-});
-
-// src/commands/project.ts
-var createProject = (c, input, json) => c.projects.create(input).then((p) => renderOne(p, fmtProject, json));
-var listProjects = (c, workspaceId, json) => c.projects.listByWorkspace(workspaceId).then((ps) => renderList(ps, fmtProject, json));
-var getProject = (c, id, json) => c.projects.get(id).then((p) => renderOne(p, fmtProject, json));
-var updateProject = (c, id, patch, json) => c.projects.update(id, patch).then((p) => renderOne(p, fmtProject, json));
-var removeProject = (c, id, json) => c.projects.remove(id).then(() => removed("project", id, json));
-var project = defineCommand({
-  meta: { name: "project", description: "manage projects" },
-  subCommands: {
-    create: defineCommand({
-      meta: { name: "create", description: "create a project" },
-      args: {
-        name: { type: "positional", required: true },
-        workspace: { type: "string", description: "workspace id (overrides .baton.json)" },
-        desc: { type: "string", description: "description" },
-        ...common
-      },
-      run: async ({ args }) => {
-        const out = await createProject(
-          clientFor(args),
-          { workspaceId: resolveWorkspaceId(args), name: args.name, description: args.desc },
-          Boolean(args.json)
-        );
-        console.log(out);
-      }
-    }),
-    ls: defineCommand({
-      meta: { name: "ls", description: "list projects in a workspace" },
-      args: {
-        workspace: { type: "string", description: "workspace id (overrides .baton.json)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        console.log(
-          await listProjects(clientFor(args), resolveWorkspaceId(args), Boolean(args.json))
-        );
+  function checkBufferSize() {
+    maxBufferSize !== void 0 && (pendingFragmentsLength + data.length <= maxBufferSize || (terminated = true, pendingFragments.length = 0, pendingFragmentsLength = 0, id = void 0, data = "", dataLines = 0, eventType = void 0, onError(
+      new ParseError(`Buffered data exceeded max buffer size of ${maxBufferSize} characters`, {
+        type: "max-buffer-size-exceeded"
+      })
+    )));
+  }
+  function processLines(chunk) {
+    let searchIndex = 0;
+    if (chunk.indexOf("\r") === -1) {
+      let lfIndex = chunk.indexOf(`
+`, searchIndex);
+      for (; lfIndex !== -1; ) {
+        if (searchIndex === lfIndex) {
+          dataLines > 0 && onEvent({ id, event: eventType, data }), id = void 0, data = "", dataLines = 0, eventType = void 0, searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+          continue;
+        }
+        const firstCharCode = chunk.charCodeAt(searchIndex);
+        if (isDataPrefix(chunk, searchIndex, firstCharCode)) {
+          const valueStart = chunk.charCodeAt(searchIndex + 5) === SPACE ? searchIndex + 6 : searchIndex + 5, value = chunk.slice(valueStart, lfIndex);
+          if (dataLines === 0 && chunk.charCodeAt(lfIndex + 1) === LF) {
+            onEvent({ id, event: eventType, data: value }), id = void 0, data = "", eventType = void 0, searchIndex = lfIndex + 2, lfIndex = chunk.indexOf(`
+`, searchIndex);
+            continue;
+          }
+          data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        } else isEventPrefix(chunk, searchIndex, firstCharCode) ? eventType = chunk.slice(
+          chunk.charCodeAt(searchIndex + 6) === SPACE ? searchIndex + 7 : searchIndex + 6,
+          lfIndex
+        ) || void 0 : parseLine(chunk, searchIndex, lfIndex);
+        searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
       }
-    }),
-    get: defineCommand({
-      meta: { name: "get", description: "get a project" },
-      args: { id: { type: "positional", required: true }, ...common },
-      run: async ({ args }) => {
-        console.log(await getProject(clientFor(args), Number(args.id), Boolean(args.json)));
+      return chunk.slice(searchIndex);
+    }
+    for (; searchIndex < chunk.length; ) {
+      const crIndex = chunk.indexOf("\r", searchIndex), lfIndex = chunk.indexOf(`
+`, searchIndex);
+      let lineEnd = -1;
+      if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = crIndex < lfIndex ? crIndex : lfIndex : crIndex !== -1 ? crIndex === chunk.length - 1 ? lineEnd = -1 : lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1)
+        break;
+      parseLine(chunk, searchIndex, lineEnd), searchIndex = lineEnd + 1, chunk.charCodeAt(searchIndex - 1) === CR && chunk.charCodeAt(searchIndex) === LF && searchIndex++;
+    }
+    return chunk.slice(searchIndex);
+  }
+  function parseLine(chunk, start, end) {
+    if (start === end) {
+      dispatchEvent();
+      return;
+    }
+    const firstCharCode = chunk.charCodeAt(start);
+    if (isDataPrefix(chunk, start, firstCharCode)) {
+      const valueStart = chunk.charCodeAt(start + 5) === SPACE ? start + 6 : start + 5, value2 = chunk.slice(valueStart, end);
+      data = dataLines === 0 ? value2 : `${data}
+${value2}`, dataLines++;
+      return;
+    }
+    if (isEventPrefix(chunk, start, firstCharCode)) {
+      eventType = chunk.slice(chunk.charCodeAt(start + 6) === SPACE ? start + 7 : start + 6, end) || void 0;
+      return;
+    }
+    if (firstCharCode === 105 && chunk.charCodeAt(start + 1) === 100 && chunk.charCodeAt(start + 2) === 58) {
+      const value2 = chunk.slice(chunk.charCodeAt(start + 3) === SPACE ? start + 4 : start + 3, end);
+      id = value2.includes("\0") ? void 0 : value2;
+      return;
+    }
+    if (firstCharCode === 58) {
+      if (onComment) {
+        const line2 = chunk.slice(start, end);
+        onComment(line2.slice(chunk.charCodeAt(start + 1) === SPACE ? 2 : 1));
       }
-    }),
-    update: defineCommand({
-      meta: { name: "update", description: "rename a project / set its description" },
-      args: {
-        id: { type: "positional", required: true },
-        name: { type: "string", description: "new name" },
-        desc: { type: "string", description: "new description" },
-        ...common
-      },
-      run: async ({ args }) => {
-        const patch = {
-          ...args.name !== void 0 ? { name: args.name } : {},
-          ...args.desc !== void 0 ? { description: args.desc } : {}
-        };
-        if (Object.keys(patch).length === 0) throw new Error("pass --name and/or --desc");
-        console.log(
-          await updateProject(clientFor(args), Number(args.id), patch, Boolean(args.json))
+      return;
+    }
+    const line = chunk.slice(start, end), fieldSeparatorIndex = line.indexOf(":");
+    if (fieldSeparatorIndex === -1) {
+      processField(line, "", line);
+      return;
+    }
+    const field = line.slice(0, fieldSeparatorIndex), offset = line.charCodeAt(fieldSeparatorIndex + 1) === SPACE ? 2 : 1, value = line.slice(fieldSeparatorIndex + offset);
+    processField(field, value, line);
+  }
+  function processField(field, value, line) {
+    switch (field) {
+      case "event":
+        eventType = value || void 0;
+        break;
+      case "data":
+        data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        break;
+      case "id":
+        id = value.includes("\0") ? void 0 : value;
+        break;
+      case "retry":
+        /^\d+$/.test(value) ? onRetry(parseInt(value, 10)) : onError(
+          new ParseError(`Invalid \`retry\` value: "${value}"`, {
+            type: "invalid-retry",
+            value,
+            line
+          })
+        );
+        break;
+      default:
+        onError(
+          new ParseError(
+            `Unknown field "${field.length > 20 ? `${field.slice(0, 20)}\u2026` : field}"`,
+            { type: "unknown-field", field, value, line }
+          )
         );
-      }
-    }),
-    rm: defineCommand({
-      meta: { name: "rm", description: "delete a project" },
-      args: { id: { type: "positional", required: true }, ...common },
-      run: async ({ args }) => {
-        console.log(await removeProject(clientFor(args), Number(args.id), Boolean(args.json)));
-      }
-    })
+        break;
+    }
   }
-});
+  function dispatchEvent() {
+    dataLines > 0 && onEvent({
+      id,
+      event: eventType,
+      data
+    }), id = void 0, data = "", dataLines = 0, eventType = void 0;
+  }
+  function reset(options = {}) {
+    if (options.consume && pendingFragments.length > 0) {
+      const incompleteLine = pendingFragments.join("");
+      parseLine(incompleteLine, 0, incompleteLine.length);
+    }
+    isFirstChunk = true, id = void 0, data = "", dataLines = 0, eventType = void 0, pendingFragments.length = 0, pendingFragmentsLength = 0, terminated = false;
+  }
+  return { feed, reset };
+}
+function isDataPrefix(chunk, i, firstCharCode) {
+  return firstCharCode === 100 && chunk.charCodeAt(i + 1) === 97 && chunk.charCodeAt(i + 2) === 116 && chunk.charCodeAt(i + 3) === 97 && chunk.charCodeAt(i + 4) === 58;
+}
+function isEventPrefix(chunk, i, firstCharCode) {
+  return firstCharCode === 101 && chunk.charCodeAt(i + 1) === 118 && chunk.charCodeAt(i + 2) === 101 && chunk.charCodeAt(i + 3) === 110 && chunk.charCodeAt(i + 4) === 116 && chunk.charCodeAt(i + 5) === 58;
+}
 
-// src/provisioner/config.ts
-import { execFile } from "node:child_process";
-import { constants } from "node:fs";
-import { access, readFile, stat as stat2 } from "node:fs/promises";
-import { isAbsolute } from "node:path";
-import { promisify } from "node:util";
-var forbiddenEnv = /* @__PURE__ */ new Set([
-  "BATON_PROVISIONER_TOKEN",
-  "BATON_TOKEN",
-  "BATON_WORKER_TOKEN",
-  "BATON_USER",
-  "BATON_PASS",
-  "HOME",
-  "XDG_DATA_HOME"
-]);
-var object = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var absolutePath = (value, field) => {
-  if (typeof value !== "string" || !isAbsolute(value) || value.includes("\0"))
-    throw new Error(`${field} must be an absolute path`);
-  return value;
+// ../../node_modules/.pnpm/eventsource@4.1.0/node_modules/eventsource/dist/index.js
+var ErrorEvent = class extends Event {
+  /**
+   * Constructs a new `ErrorEvent` instance. This is typically not called directly,
+   * but rather emitted by the `EventSource` object when an error occurs.
+   *
+   * @param type - The type of the event (should be "error")
+   * @param errorEventInitDict - Optional properties to include in the error event
+   */
+  constructor(type, errorEventInitDict) {
+    var _a, _b;
+    super(type), this.code = (_a = errorEventInitDict == null ? void 0 : errorEventInitDict.code) != null ? _a : void 0, this.message = (_b = errorEventInitDict == null ? void 0 : errorEventInitDict.message) != null ? _b : void 0;
+  }
+  /**
+   * Node.js "hides" the `message` and `code` properties of the `ErrorEvent` instance,
+   * when it is `console.log`'ed. This makes it harder to debug errors. To ease debugging,
+   * we explicitly include the properties in the `inspect` method.
+   *
+   * This is automatically called by Node.js when you `console.log` an instance of this class.
+   *
+   * @param _depth - The current depth
+   * @param options - The options passed to `util.inspect`
+   * @param inspect - The inspect function to use (prevents having to import it from `util`)
+   * @returns A string representation of the error
+   */
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")](_depth, options, inspect) {
+    return inspect(inspectableError(this), options);
+  }
+  /**
+   * Deno "hides" the `message` and `code` properties of the `ErrorEvent` instance,
+   * when it is `console.log`'ed. This makes it harder to debug errors. To ease debugging,
+   * we explicitly include the properties in the `inspect` method.
+   *
+   * This is automatically called by Deno when you `console.log` an instance of this class.
+   *
+   * @param inspect - The inspect function to use (prevents having to import it from `util`)
+   * @param options - The options passed to `Deno.inspect`
+   * @returns A string representation of the error
+   */
+  [/* @__PURE__ */ Symbol.for("Deno.customInspect")](inspect, options) {
+    return inspect(inspectableError(this), options);
+  }
 };
-var environment = (value) => {
-  if (!object(value)) throw new Error("workerEnv must be an object");
-  return Object.fromEntries(
-    Object.entries(value).map(([key, entry]) => {
-      if (forbiddenEnv.has(key) || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || typeof entry !== "string" || entry.includes("\0"))
-        throw new Error(`invalid worker environment key: ${key}`);
-      return [key, entry];
-    })
-  );
+function syntaxError(message) {
+  const DomException = globalThis.DOMException;
+  return typeof DomException == "function" ? new DomException(message, "SyntaxError") : new SyntaxError(message);
+}
+function flattenError(err) {
+  return err instanceof Error ? "errors" in err && Array.isArray(err.errors) ? err.errors.map(flattenError).join(", ") : "cause" in err && err.cause instanceof Error ? `${err}: ${flattenError(err.cause)}` : err.message : `${err}`;
+}
+function inspectableError(err) {
+  return {
+    type: err.type,
+    message: err.message,
+    code: err.code,
+    defaultPrevented: err.defaultPrevented,
+    cancelable: err.cancelable,
+    timeStamp: err.timeStamp
+  };
+}
+var __typeError = (msg) => {
+  throw TypeError(msg);
 };
-var templates = (value) => {
-  if (!object(value)) throw new Error("templates must be an object");
-  return Object.fromEntries(
-    WORKER_TEMPLATES.map((template) => {
-      const raw = value[template.id];
-      if (!object(raw)) throw new Error(`template ${template.id} must be configured`);
-      const workerEnv2 = environment(raw.workerEnv);
-      if (template.id === "mini-codex") {
-        if (raw.pi !== void 0) throw new Error("mini-codex does not support pi");
-        return [template.id, { workerEnv: workerEnv2 }];
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
+var _readyState;
+var _url;
+var _redirectUrl;
+var _withCredentials;
+var _fetch;
+var _reconnectInterval;
+var _reconnectTimer;
+var _lastEventId;
+var _controller;
+var _parser;
+var _onError;
+var _onMessage;
+var _onOpen;
+var _EventSource_instances;
+var connect_fn;
+var _onFetchResponse;
+var _onFetchError;
+var getRequestOptions_fn;
+var _onEvent;
+var _onRetryChange;
+var failConnection_fn;
+var scheduleReconnect_fn;
+var _reconnect;
+var EventSource = class extends EventTarget {
+  constructor(url, eventSourceInitDict) {
+    var _a, _b;
+    super(), __privateAdd(this, _EventSource_instances), this.CONNECTING = 0, this.OPEN = 1, this.CLOSED = 2, __privateAdd(this, _readyState), __privateAdd(this, _url), __privateAdd(this, _redirectUrl), __privateAdd(this, _withCredentials), __privateAdd(this, _fetch), __privateAdd(this, _reconnectInterval), __privateAdd(this, _reconnectTimer), __privateAdd(this, _lastEventId, null), __privateAdd(this, _controller), __privateAdd(this, _parser), __privateAdd(this, _onError, null), __privateAdd(this, _onMessage, null), __privateAdd(this, _onOpen, null), __privateAdd(this, _onFetchResponse, async (response) => {
+      var _a2;
+      __privateGet(this, _parser).reset();
+      const { body, redirected, status, headers } = response;
+      if (status === 204) {
+        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, "Server sent HTTP 204, not reconnecting", 204), this.close();
+        return;
       }
-      const provider = template.id === "mini-glm-codeplan" ? "zai-coding-cn" : "qwen-token-plan-cn";
-      const apiKey = template.id === "mini-glm-codeplan" ? "ZAI_CODING_CN_API_KEY" : "QWEN_TOKEN_PLAN_CN_API_KEY";
-      if (!workerEnv2.ANTHROPIC_BASE_URL || !(workerEnv2.ANTHROPIC_AUTH_TOKEN || workerEnv2.ANTHROPIC_API_KEY) || !workerEnv2[apiKey])
-        throw new Error(`template ${template.id} requires Claude and Pi credentials`);
-      if (!object(raw.pi) || raw.pi.provider !== provider || typeof raw.pi.model !== "string" || !raw.pi.model.trim())
-        throw new Error(`template ${template.id} requires its Pi provider and model`);
-      return [template.id, { workerEnv: workerEnv2, pi: { provider, model: raw.pi.model.trim() } }];
-    })
-  );
-};
-var commandEnvironment = (config) => ({
-  ...process.env,
-  PATH: config.workerEnv.PATH ?? process.env.PATH ?? "/usr/bin:/bin"
-});
-var loadProvisionerConfig = async (path) => {
-  if (process.platform !== "darwin") throw new Error("provisioner requires macOS");
-  absolutePath(path, "config");
-  if ((await stat2(path)).mode & 63) throw new Error("config must be private: chmod 600 <config>");
-  const text = await readFile(path, "utf8");
-  let raw;
-  try {
-    raw = JSON.parse(text);
-  } catch (error) {
-    if (!(error instanceof SyntaxError)) throw error;
-    throw new Error("invalid provisioner JSON config");
+      if (redirected ? __privateSet(this, _redirectUrl, new URL(response.url)) : __privateSet(this, _redirectUrl, void 0), status !== 200) {
+        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, `Non-200 status code (${status})`, status);
+        return;
+      }
+      if (!(headers.get("content-type") || "").startsWith("text/event-stream")) {
+        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, 'Invalid content type, expected "text/event-stream"', status);
+        return;
+      }
+      if (__privateGet(this, _readyState) === this.CLOSED)
+        return;
+      __privateSet(this, _readyState, this.OPEN);
+      const openEvent = new Event("open");
+      if ((_a2 = __privateGet(this, _onOpen)) == null || _a2.call(this, openEvent), this.dispatchEvent(openEvent), typeof body != "object" || !body || !("getReader" in body)) {
+        __privateMethod(this, _EventSource_instances, failConnection_fn).call(this, "Invalid response body, expected a web ReadableStream", status), this.close();
+        return;
+      }
+      const decoder = new TextDecoder(), reader = body.getReader();
+      let open3 = true;
+      do {
+        const { done, value } = await reader.read();
+        value && __privateGet(this, _parser).feed(decoder.decode(value, { stream: !done })), done && (open3 = false, __privateGet(this, _parser).reset(), __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this));
+      } while (open3);
+    }), __privateAdd(this, _onFetchError, (err) => {
+      __privateSet(this, _controller, void 0), !(err.name === "AbortError" || err.type === "aborted") && __privateMethod(this, _EventSource_instances, scheduleReconnect_fn).call(this, flattenError(err));
+    }), __privateAdd(this, _onEvent, (event) => {
+      typeof event.id == "string" && __privateSet(this, _lastEventId, event.id);
+      const messageEvent = new MessageEvent(event.event || "message", {
+        data: event.data,
+        origin: __privateGet(this, _redirectUrl) ? __privateGet(this, _redirectUrl).origin : __privateGet(this, _url).origin,
+        lastEventId: event.id || ""
+      });
+      __privateGet(this, _onMessage) && (!event.event || event.event === "message") && __privateGet(this, _onMessage).call(this, messageEvent), this.dispatchEvent(messageEvent);
+    }), __privateAdd(this, _onRetryChange, (value) => {
+      __privateSet(this, _reconnectInterval, value);
+    }), __privateAdd(this, _reconnect, () => {
+      __privateSet(this, _reconnectTimer, void 0), __privateGet(this, _readyState) === this.CONNECTING && __privateMethod(this, _EventSource_instances, connect_fn).call(this);
+    });
+    try {
+      if (url instanceof URL)
+        __privateSet(this, _url, url);
+      else if (typeof url == "string")
+        __privateSet(this, _url, new URL(url, getBaseURL()));
+      else
+        throw new Error("Invalid URL");
+    } catch {
+      throw syntaxError("An invalid or illegal string was specified");
+    }
+    __privateSet(this, _parser, createParser({
+      onEvent: __privateGet(this, _onEvent),
+      onRetry: __privateGet(this, _onRetryChange)
+    })), __privateSet(this, _readyState, this.CONNECTING), __privateSet(this, _reconnectInterval, 3e3), __privateSet(this, _fetch, (_a = eventSourceInitDict == null ? void 0 : eventSourceInitDict.fetch) != null ? _a : globalThis.fetch), __privateSet(this, _withCredentials, (_b = eventSourceInitDict == null ? void 0 : eventSourceInitDict.withCredentials) != null ? _b : false), __privateMethod(this, _EventSource_instances, connect_fn).call(this);
+  }
+  /**
+   * Returns the state of this EventSource object's connection. It can have the values described below.
+   *
+   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/readyState)
+   *
+   * Note: typed as `number` instead of `0 | 1 | 2` for compatibility with the `EventSource` interface,
+   * defined in the TypeScript `dom` library.
+   *
+   * @public
+   */
+  get readyState() {
+    return __privateGet(this, _readyState);
   }
-  if (!object(raw) || typeof raw.server !== "string" || typeof raw.token !== "string")
-    throw new Error("server and token required");
-  let server;
-  try {
-    server = new URL(raw.server);
-  } catch (error) {
-    if (!(error instanceof TypeError)) throw error;
-    throw new Error("server must be a valid HTTP(S) URL");
+  /**
+   * Returns the URL providing the event stream.
+   *
+   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/url)
+   *
+   * @public
+   */
+  get url() {
+    return __privateGet(this, _url).href;
+  }
+  /**
+   * Returns true if the credentials mode for connection requests to the URL providing the event stream is set to "include", and false otherwise.
+   *
+   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/withCredentials)
+   */
+  get withCredentials() {
+    return __privateGet(this, _withCredentials);
+  }
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/error_event) */
+  get onerror() {
+    return __privateGet(this, _onError);
+  }
+  set onerror(value) {
+    __privateSet(this, _onError, value);
+  }
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/message_event) */
+  get onmessage() {
+    return __privateGet(this, _onMessage);
+  }
+  set onmessage(value) {
+    __privateSet(this, _onMessage, value);
+  }
+  /** [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/open_event) */
+  get onopen() {
+    return __privateGet(this, _onOpen);
+  }
+  set onopen(value) {
+    __privateSet(this, _onOpen, value);
+  }
+  addEventListener(type, listener, options) {
+    const listen = listener;
+    super.addEventListener(type, listen, options);
+  }
+  removeEventListener(type, listener, options) {
+    const listen = listener;
+    super.removeEventListener(type, listen, options);
+  }
+  /**
+   * Aborts any instances of the fetch algorithm started for this EventSource object, and sets the readyState attribute to CLOSED.
+   *
+   * [MDN Reference](https://developer.mozilla.org/docs/Web/API/EventSource/close)
+   *
+   * @public
+   */
+  close() {
+    __privateGet(this, _reconnectTimer) && clearTimeout(__privateGet(this, _reconnectTimer)), __privateGet(this, _readyState) !== this.CLOSED && (__privateGet(this, _controller) && __privateGet(this, _controller).abort(), __privateSet(this, _readyState, this.CLOSED), __privateSet(this, _controller, void 0));
   }
-  if (!["http:", "https:"].includes(server.protocol) || server.username || server.password || server.search || server.hash)
-    throw new Error("server must be an HTTP(S) URL without credentials, query, or fragment");
-  if (!raw.token.trim() || /[\r\n]/.test(raw.token))
-    throw new Error("valid provisioner token required");
-  const config = {
-    server: server.toString().replace(/\/$/, ""),
-    token: raw.token.trim(),
-    projectsRoot: absolutePath(raw.projectsRoot, "projectsRoot"),
-    cliPath: absolutePath(raw.cliPath, "cliPath"),
-    nodePath: absolutePath(raw.nodePath ?? process.execPath, "nodePath"),
-    workerEnv: environment(raw.workerEnv),
-    templates: templates(raw.templates)
-  };
-  await access(config.cliPath, constants.R_OK);
-  await access(config.nodePath ?? process.execPath, constants.X_OK);
-  const env = commandEnvironment(config);
-  await promisify(execFile)("git", ["--version"], { env, timeout: 1e4 });
-  await promisify(execFile)("launchctl", ["help"], { env, timeout: 1e4 });
-  await promisify(execFile)("/usr/bin/plutil", ["-help"], { timeout: 1e4 });
-  return config;
 };
+_readyState = /* @__PURE__ */ new WeakMap(), _url = /* @__PURE__ */ new WeakMap(), _redirectUrl = /* @__PURE__ */ new WeakMap(), _withCredentials = /* @__PURE__ */ new WeakMap(), _fetch = /* @__PURE__ */ new WeakMap(), _reconnectInterval = /* @__PURE__ */ new WeakMap(), _reconnectTimer = /* @__PURE__ */ new WeakMap(), _lastEventId = /* @__PURE__ */ new WeakMap(), _controller = /* @__PURE__ */ new WeakMap(), _parser = /* @__PURE__ */ new WeakMap(), _onError = /* @__PURE__ */ new WeakMap(), _onMessage = /* @__PURE__ */ new WeakMap(), _onOpen = /* @__PURE__ */ new WeakMap(), _EventSource_instances = /* @__PURE__ */ new WeakSet(), /**
+* Connect to the given URL and start receiving events
+*
+* @internal
+*/
+connect_fn = function() {
+  __privateSet(this, _readyState, this.CONNECTING), __privateSet(this, _controller, new AbortController()), __privateGet(this, _fetch)(__privateGet(this, _url), __privateMethod(this, _EventSource_instances, getRequestOptions_fn).call(this)).then(__privateGet(this, _onFetchResponse)).catch(__privateGet(this, _onFetchError));
+}, _onFetchResponse = /* @__PURE__ */ new WeakMap(), _onFetchError = /* @__PURE__ */ new WeakMap(), /**
+* Get request options for the `fetch()` request
+*
+* @returns The request options
+* @internal
+*/
+getRequestOptions_fn = function() {
+  var _a;
+  const init2 = {
+    // [spec] Let `corsAttributeState` be `Anonymous`…
+    // [spec] …will have their mode set to "cors"…
+    mode: "cors",
+    redirect: "follow",
+    headers: { Accept: "text/event-stream", ...__privateGet(this, _lastEventId) ? { "Last-Event-ID": __privateGet(this, _lastEventId) } : void 0 },
+    cache: "no-store",
+    signal: (_a = __privateGet(this, _controller)) == null ? void 0 : _a.signal
+  };
+  return "window" in globalThis && (init2.credentials = this.withCredentials ? "include" : "same-origin"), init2;
+}, _onEvent = /* @__PURE__ */ new WeakMap(), _onRetryChange = /* @__PURE__ */ new WeakMap(), /**
+* Handles the process referred to in the EventSource specification as "failing a connection".
+*
+* @param error - The error causing the connection to fail
+* @param code - The HTTP status code, if available
+* @internal
+*/
+failConnection_fn = function(message, code) {
+  var _a;
+  __privateGet(this, _readyState) !== this.CLOSED && __privateSet(this, _readyState, this.CLOSED);
+  const errorEvent = new ErrorEvent("error", { code, message });
+  (_a = __privateGet(this, _onError)) == null || _a.call(this, errorEvent), this.dispatchEvent(errorEvent);
+}, /**
+* Schedules a reconnection attempt against the EventSource endpoint.
+*
+* @param message - The error causing the connection to fail
+* @param code - The HTTP status code, if available
+* @internal
+*/
+scheduleReconnect_fn = function(message, code) {
+  var _a;
+  if (__privateGet(this, _readyState) === this.CLOSED)
+    return;
+  __privateSet(this, _readyState, this.CONNECTING);
+  const errorEvent = new ErrorEvent("error", { code, message });
+  (_a = __privateGet(this, _onError)) == null || _a.call(this, errorEvent), this.dispatchEvent(errorEvent), __privateSet(this, _reconnectTimer, setTimeout(__privateGet(this, _reconnect), __privateGet(this, _reconnectInterval)));
+}, _reconnect = /* @__PURE__ */ new WeakMap(), /**
+* ReadyState representing an EventSource currently trying to connect
+*
+* @public
+*/
+EventSource.CONNECTING = 0, /**
+* ReadyState representing an EventSource connection that is open (eg connected)
+*
+* @public
+*/
+EventSource.OPEN = 1, /**
+* ReadyState representing an EventSource connection that is closed (eg disconnected)
+*
+* @public
+*/
+EventSource.CLOSED = 2;
+Object.defineProperty(EventSource, /* @__PURE__ */ Symbol.for("eventsource.supports-fetch-override"), {
+  value: true,
+  writable: false,
+  configurable: false,
+  enumerable: false
+});
+function getBaseURL() {
+  const doc = "document" in globalThis ? globalThis.document : void 0;
+  return doc && typeof doc == "object" && "baseURI" in doc && typeof doc.baseURI == "string" ? doc.baseURI : void 0;
+}
 
 // src/provisioner/client.ts
 var createProvisionerClient = (config) => {
@@ -7563,7 +7089,7 @@ var createProvisionerClient = (config) => {
 import { execFile as execFile3 } from "node:child_process";
 import { lstat, mkdir as mkdir3, realpath, writeFile as writeFile2 } from "node:fs/promises";
 import { hostname } from "node:os";
-import { dirname as dirname2, join as join5 } from "node:path";
+import { dirname as dirname2, join as join4 } from "node:path";
 import { setTimeout as setTimeout2 } from "node:timers/promises";
 import { promisify as promisify3 } from "node:util";
 
@@ -7571,18 +7097,18 @@ import { promisify as promisify3 } from "node:util";
 import { execFile as execFile2 } from "node:child_process";
 import { mkdir, open } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join as join3 } from "node:path";
+import { dirname, join as join2 } from "node:path";
 import { promisify as promisify2 } from "node:util";
-var workerStatePath = (config, creation) => join3(
+var workerStatePath = (config, creation) => join2(
   config.projectsRoot,
   ".worker-state",
   `project-${creation.projectId}`,
   `creation-${creation.id}`
 );
-var workerLogPath = (creation) => join3(homedir(), "Library/Logs", `baton-worker-creation-${creation.id}.log`);
+var workerLogPath = (creation) => join2(homedir(), "Library/Logs", `baton-worker-creation-${creation.id}.log`);
 var startAgent = async (config, agent, signal) => {
   signal?.throwIfAborted();
-  const plist = join3(homedir(), "Library/LaunchAgents", `${agent.label}.plist`);
+  const plist = join2(homedir(), "Library/LaunchAgents", `${agent.label}.plist`);
   await mkdir(dirname(plist), { recursive: true });
   await mkdir(dirname(agent.log), { recursive: true });
   const domain = `gui/${process.getuid?.()}`;
@@ -7668,24 +7194,29 @@ var installProvisionerAgent = async (config, configPath) => startAgent(config, {
   ],
   cwd: dirname(configPath),
   env: { HOME: homedir(), PATH: config.workerEnv.PATH ?? process.env.PATH ?? "/usr/bin:/bin" },
-  log: join3(homedir(), "Library/Logs/baton-provisioner.log")
+  log: join2(homedir(), "Library/Logs/baton-provisioner.log")
 });
 
 // src/provisioner/worker-template.ts
 import { mkdir as mkdir2, writeFile } from "node:fs/promises";
-import { join as join4 } from "node:path";
-var workerTemplateEnvironment = async (config, creation, state) => {
+import { join as join3 } from "node:path";
+var requireWorkerTemplate = (config, creation) => {
   if (!workerTemplateAgentKinds(creation.templateId).includes(creation.agentKind))
     throw new Error("agentKind is not supported by this template");
-  if (creation.templateId === "mini-local") return config.workerEnv;
+  if (creation.templateId === "mini-local") return null;
   const profile = config.templates[creation.templateId];
-  if (!profile) throw new Error(`template ${creation.templateId} is not configured`);
+  if (!profile) throw new Error(`template ${creation.templateId} is not configured on this host`);
+  return profile;
+};
+var workerTemplateEnvironment = async (config, creation, state) => {
+  const profile = requireWorkerTemplate(config, creation);
+  if (!profile) return config.workerEnv;
   if (creation.agentKind !== "pi") return profile.workerEnv;
   if (!profile.pi) throw new Error("Pi provider and model are not configured");
-  const agentDir = join4(state, "pi");
+  const agentDir = join3(state, "pi");
   await mkdir2(agentDir, { mode: 448 });
   await writeFile(
-    join4(agentDir, "settings.json"),
+    join3(agentDir, "settings.json"),
     JSON.stringify({
       defaultProvider: profile.pi.provider,
       defaultModel: profile.pi.model
@@ -7723,13 +7254,13 @@ var initRepository = async (config, creation, repoPath, progress, signal) => {
   signal.throwIfAborted();
   await mkdir3(config.projectsRoot, { recursive: true, mode: 448 });
   const root = await realpath(config.projectsRoot);
-  await directory(join5(root, `project-${creation.projectId}`));
-  await mkdir3(join5(root, `project-${creation.projectId}`, `creation-${creation.id}`), {
+  await directory(join4(root, `project-${creation.projectId}`));
+  await mkdir3(join4(root, `project-${creation.projectId}`, `creation-${creation.id}`), {
     mode: 448
   });
   await progress("git");
   await gitIn(config, repoPath, ["init", "-b", "main"], signal);
-  await writeFile2(join5(repoPath, ".git/info/exclude"), "\n.baton.json\n", { flag: "a" });
+  await writeFile2(join4(repoPath, ".git/info/exclude"), "\n.baton.json\n", { flag: "a" });
   await gitIn(
     config,
     repoPath,
@@ -7750,7 +7281,7 @@ var adoptRepository = async (config, creation, repoPath, progress, signal) => {
   await progress("directory");
   signal.throwIfAborted();
   const real = await realpath(repoPath);
-  const project2 = join5(await realpath(config.projectsRoot), `project-${creation.projectId}`);
+  const project2 = join4(await realpath(config.projectsRoot), `project-${creation.projectId}`);
   if (dirname2(real) !== project2 || !(await lstat(real)).isDirectory())
     throw new Error(`unsafe directory: ${repoPath}`);
   await progress("git");
@@ -7765,19 +7296,20 @@ var adoptRepository = async (config, creation, repoPath, progress, signal) => {
     throw new Error(`not the root of a Git work tree: ${repoPath}`);
 };
 var provisionWorker = async (config, creation, client, signal) => {
+  requireWorkerTemplate(config, creation);
   const shared = creation.repoPath !== null;
-  const repoPath = creation.repoPath ?? join5(config.projectsRoot, `project-${creation.projectId}`, `creation-${creation.id}`);
+  const repoPath = creation.repoPath ?? join4(config.projectsRoot, `project-${creation.projectId}`, `creation-${creation.id}`);
   const progress = (step) => client.report(creation.id, { status: "running", step, repoPath }, signal);
   await (shared ? adoptRepository : initRepository)(config, creation, repoPath, progress, signal);
   await progress("register");
   const result = await client.register(creation.id, hostname(), signal);
   const state = workerStatePath(config, creation);
   const root = await realpath(config.projectsRoot);
-  await directory(join5(root, ".worker-state"));
-  await directory(join5(root, ".worker-state", `project-${creation.projectId}`));
+  await directory(join4(root, ".worker-state"));
+  await directory(join4(root, ".worker-state", `project-${creation.projectId}`));
   await mkdir3(state, { mode: 448 });
-  await mkdir3(join5(state, "baton"), { mode: 448 });
-  await writeFile2(join5(state, "baton/machine-id"), `${creation.machineId}
+  await mkdir3(join4(state, "baton"), { mode: 448 });
+  await writeFile2(join4(state, "baton/machine-id"), `${creation.machineId}
 `, {
     flag: "wx",
     mode: 384
@@ -7791,7 +7323,7 @@ var provisionWorker = async (config, creation, client, signal) => {
     machineId: result.worker.machineId,
     apiToken: result.apiToken
   });
-  const configPath = shared ? join5(state, "worker.json") : join5(repoPath, ".baton.json");
+  const configPath = shared ? join4(state, "worker.json") : join4(repoPath, ".baton.json");
   await writeFile2(configPath, `${JSON.stringify(cfg, null, 2)}
 `, { flag: "wx", mode: 384 });
   await progress("start");
@@ -7916,346 +7448,57 @@ var runProvisioner = async (config, signal) => {
       console.error(`[provisioner] stream disconnected (${event.code ?? "network"}); reconnecting`);
   };
   signal.addEventListener("abort", stop, { once: true });
-  if (signal.aborted) stop();
-  console.log("[provisioner] waiting for worker creation requests");
-  try {
-    await ended;
-    await tail;
-  } finally {
-    stop();
-    signal.removeEventListener("abort", stop);
-  }
-  if (fatal !== void 0) throw new Error(taskError(fatal, config));
-};
-
-// src/commands/provisioner.ts
-var configArg = {
-  config: {
-    type: "string",
-    required: true,
-    description: "absolute path to private provisioner JSON config"
-  }
-};
-var provisioner = defineCommand({
-  meta: {
-    name: "provisioner",
-    description: "prepare local repositories and launch workers on macOS"
-  },
-  subCommands: {
-    run: defineCommand({
-      args: configArg,
-      run: async ({ args }) => {
-        const config = await loadProvisionerConfig(args.config);
-        const abort = new AbortController();
-        const stop = () => abort.abort();
-        process.on("SIGINT", stop);
-        process.on("SIGTERM", stop);
-        try {
-          await runProvisioner(config, abort.signal);
-        } finally {
-          process.off("SIGINT", stop);
-          process.off("SIGTERM", stop);
-        }
-      }
-    }),
-    install: defineCommand({
-      args: configArg,
-      run: async ({ args }) => {
-        const config = await loadProvisionerConfig(args.config);
-        await installProvisionerAgent(config, args.config);
-        console.log(
-          "installed dev.fmap.baton-provisioner; inspect ~/Library/Logs/baton-provisioner.log"
-        );
-      }
-    })
-  }
-});
-
-// src/commands/relay.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join6 } from "node:path";
-
-// src/client/relay.ts
-var relayClient = (baseUrl) => {
-  const u = (p) => `${baseUrl}${p}`;
-  const authed = (token) => ({ authorization: `Bearer ${token}` });
-  return {
-    create: async () => {
-      const res = await fetch(u("/relay/channels"), { method: "POST" });
-      if (!res.ok) throw new Error(`POST /relay/channels \u2192 ${res.status}: ${await res.text()}`);
-      return await res.json();
-    },
-    send: async (channelId, token, msg) => {
-      const res = await fetch(u(`/relay/channels/${channelId}/messages`), {
-        method: "POST",
-        headers: { "content-type": "application/json", ...authed(token) },
-        body: JSON.stringify(msg)
-      });
-      if (!res.ok) throw new Error(`POST relay message \u2192 ${res.status}: ${await res.text()}`);
-      return await res.json();
-    },
-    listen: (channelId, token, opts) => {
-      let cursor = opts.since ?? 0;
-      const es = new EventSource(u(`/relay/channels/${channelId}/stream?since=${cursor}`), {
-        fetch: (url, init2) => fetch(url, {
-          ...init2,
-          headers: { ...init2?.headers, ...authed(token) }
-        })
-      });
-      es.onmessage = (e) => {
-        try {
-          const m = JSON.parse(e.data);
-          if (m.seq <= cursor) return;
-          cursor = m.seq;
-          opts.onMessage(m);
-        } catch (err) {
-          opts.onError?.(err);
-        }
-      };
-      es.onerror = (err) => opts.onError?.(err);
-      return () => es.close();
-    }
-  };
-};
-
-// src/commands/relay.ts
-var PREVIEW2 = 280;
-var readStdin2 = async () => {
-  const chunks = [];
-  for await (const c of process.stdin) chunks.push(c);
-  return Buffer.concat(chunks).toString("utf8");
-};
-var inviteBlock2 = (url, channelId, token) => [
-  "\u2500\u2500 Copy everything below to your peer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500",
-  "You're invited to a live Claude\u2194Claude channel. Use the `hotline` skill in",
-  "join mode, or run these two commands directly (pick your own NAME):",
-  "",
-  `  baton relay listen ${channelId} --token ${token} --from NAME --url ${url}`,
-  `  baton relay send   ${channelId} --token ${token} --from NAME --text "..." --url ${url}`,
-  "",
-  `connection: url=${url} channel=${channelId} token=${token}`,
-  "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"
-].join("\n");
-var hostCommand = defineCommand({
-  meta: { name: "host", description: "open a relay channel and print an invite for a peer" },
-  args: {
-    name: { type: "string", description: "your participant name (default: host)" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const url = resolveBaseUrl(args.url);
-    const { channelId, token } = await relayClient(url).create();
-    if (args.json) {
-      console.log(toJson({ channelId, token, url, host: args.name ?? "host" }));
-      return;
-    }
-    console.log(`channel ${channelId} opened
-`);
-    console.log(inviteBlock2(url, channelId, token));
+  if (signal.aborted) stop();
+  console.log("[provisioner] waiting for worker creation requests");
+  try {
+    await ended;
+    await tail;
+  } finally {
+    stop();
+    signal.removeEventListener("abort", stop);
   }
-});
-var sendCommand2 = defineCommand({
-  meta: { name: "send", description: "post one message to a relay channel" },
-  args: {
-    channel: { type: "positional", required: true, description: "channel id" },
-    text: { type: "positional", required: false, description: "message text (short one-liner)" },
-    token: { type: "string", required: true, description: "channel token" },
-    from: { type: "string", description: "your participant name (default: peer)" },
-    file: { type: "string", description: "read message body from this file (for large content)" },
-    ...common
-  },
-  run: async ({ args }) => {
-    const url = resolveBaseUrl(args.url);
-    let text = args.text;
-    if (text === void 0 && args.file) text = readFileSync3(args.file, "utf8");
-    if (text === void 0 && !process.stdin.isTTY) text = await readStdin2();
-    if (text === void 0 || text === "")
-      throw new Error("nothing to send: provide text, --file <path>, or pipe stdin");
-    const msg = await relayClient(url).send(args.channel, args.token, {
-      from: args.from ?? "peer",
-      text
-    });
-    if (args.json) console.log(toJson(msg));
-    else console.log(`sent (seq ${msg.seq})`);
+  if (fatal !== void 0) throw new Error(taskError(fatal, config));
+};
+
+// src/commands/provisioner.ts
+var configArg = {
+  config: {
+    type: "string",
+    required: true,
+    description: "absolute path to private provisioner JSON config"
   }
-});
-var listenCommand2 = defineCommand({
+};
+var provisioner = defineCommand({
   meta: {
-    name: "listen",
-    description: "stream a channel: one JSON line per peer message (for a background subscriber)"
-  },
-  args: {
-    channel: { type: "positional", required: true, description: "channel id" },
-    token: { type: "string", required: true, description: "channel token" },
-    from: {
-      type: "string",
-      description: "your name; messages from this name are skipped (no echo)"
-    },
-    since: { type: "string", description: "replay messages after this seq (default 0 = full)" },
-    ...common
+    name: "provisioner",
+    description: "prepare local repositories and launch workers on macOS"
   },
-  run: async ({ args }) => {
-    const url = resolveBaseUrl(args.url);
-    const me = args.from ?? "";
-    const emit = (o) => {
-      process.stdout.write(`${JSON.stringify(o)}
-`);
-    };
-    const spillDir = join6(tmpdir2(), "hotline", args.channel);
-    mkdirSync2(spillDir, { recursive: true });
-    const surface = (m) => {
-      const text = typeof m.text === "string" ? m.text : "";
-      const file = join6(spillDir, `${m.seq}.txt`);
-      writeFileSync4(file, text);
-      const truncated = text.length > PREVIEW2;
-      emit({
-        type: "relay.message",
-        seq: m.seq,
-        from: m.from,
-        ts: m.ts,
-        chars: text.length,
-        truncated,
-        preview: truncated ? `${text.slice(0, PREVIEW2)} \u2026` : text,
-        file
-      });
-    };
-    const describe3 = (e) => {
-      const ev = e;
-      return ev?.code ? `${ev.code}${ev.message ? ` ${ev.message}` : ""}` : String(e);
-    };
-    const close = relayClient(url).listen(args.channel, args.token, {
-      since: args.since ? Number(args.since) : 0,
-      // Skip our own messages (they come back over the same channel).
-      onMessage: (m) => {
-        if (m.from !== me) surface(m);
-      },
-      onError: (e) => emit({ type: "relay.error", error: describe3(e) })
-    });
-    emit({ type: "relay.listening", channel: args.channel, from: me, url });
-    await new Promise((resolve4) => {
-      const stop = () => {
-        close();
-        resolve4();
-      };
-      process.on("SIGINT", stop);
-      process.on("SIGTERM", stop);
-    });
-  }
-});
-var relay = defineCommand({
-  meta: { name: "relay", description: "Claude\u2194Claude live channel: host / listen / send" },
-  subCommands: { host: hostCommand, listen: listenCommand2, send: sendCommand2 }
-});
-
-// src/commands/requirement.ts
-var createRequirement = (c, input, json) => c.requirements.create(input).then((r) => renderOne(r, fmtRequirement, json));
-var updateRequirement = (c, id, patch, json) => c.requirements.update(id, patch).then((r) => renderOne(r, fmtRequirement, json));
-var listRequirements = (c, projectId, json) => c.requirements.listByProject(projectId).then((rs) => renderList(rs, fmtRequirement, json));
-var getRequirement = (c, id, json) => c.requirements.get(id).then((r) => renderOne(r, fmtRequirement, json));
-var setRequirementStatus = (c, id, status, json) => c.requirements.setStatus(id, status).then((r) => renderOne(r, fmtRequirement, json));
-var removeRequirement = (c, id, label, json) => c.requirements.remove(id).then(() => removed("requirement", label, json));
-var resolveByCode = async (c, projectId, code) => (await c.requirements.getByCode(projectId, code)).id;
-var requirement = defineCommand({
-  meta: { name: "requirement", description: "manage requirements" },
   subCommands: {
-    create: defineCommand({
-      meta: { name: "create", description: "create a requirement" },
-      args: {
-        title: { type: "positional", required: true },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        desc: { type: "string", description: "description" },
-        body: { type: "string", description: "requirement body (markdown)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        console.log(
-          await createRequirement(
-            clientFor(args),
-            {
-              projectId: resolveProjectId(args),
-              title: args.title,
-              description: args.desc,
-              body: args.body
-            },
-            Boolean(args.json)
-          )
-        );
-      }
-    }),
-    update: defineCommand({
-      meta: { name: "update", description: "update a requirement title / body" },
-      args: {
-        code: { type: "positional", required: true, description: "requirement code (R-N)" },
-        title: { type: "string", description: "new title" },
-        body: { type: "string", description: "new body (markdown)" },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        const patch = {
-          ...args.title !== void 0 ? { title: args.title } : {},
-          ...args.body !== void 0 ? { body: args.body } : {}
-        };
-        if (Object.keys(patch).length === 0) throw new Error("pass --title and/or --body");
-        const c = clientFor(args);
-        const id = await resolveByCode(c, resolveProjectId(args), args.code);
-        console.log(await updateRequirement(c, id, patch, Boolean(args.json)));
-      }
-    }),
-    ls: defineCommand({
-      meta: { name: "ls", description: "list requirements in a project" },
-      args: {
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        console.log(
-          await listRequirements(clientFor(args), resolveProjectId(args), Boolean(args.json))
-        );
-      }
-    }),
-    get: defineCommand({
-      meta: { name: "get", description: "get a requirement by code (R-N)" },
-      args: {
-        code: { type: "positional", required: true, description: "requirement code, e.g. R-1" },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        ...common
-      },
+    run: defineCommand({
+      args: configArg,
       run: async ({ args }) => {
-        const c = clientFor(args);
-        const id = await resolveByCode(c, resolveProjectId(args), args.code);
-        console.log(await getRequirement(c, id, Boolean(args.json)));
+        const config = await loadProvisionerConfig(args.config);
+        const abort = new AbortController();
+        const stop = () => abort.abort();
+        process.on("SIGINT", stop);
+        process.on("SIGTERM", stop);
+        try {
+          await runProvisioner(config, abort.signal);
+        } finally {
+          process.off("SIGINT", stop);
+          process.off("SIGTERM", stop);
+        }
       }
     }),
-    "set-status": defineCommand({
-      meta: { name: "set-status", description: "set requirement status (active|done|cancelled)" },
-      args: {
-        code: { type: "positional", required: true, description: "requirement code (R-N)" },
-        status: { type: "positional", required: true },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        ...common
-      },
+    install: defineCommand({
+      args: configArg,
       run: async ({ args }) => {
-        const c = clientFor(args);
-        const id = await resolveByCode(c, resolveProjectId(args), args.code);
+        const config = await loadProvisionerConfig(args.config);
+        await installProvisionerAgent(config, args.config);
         console.log(
-          await setRequirementStatus(c, id, args.status, Boolean(args.json))
+          "installed dev.fmap.baton-provisioner; inspect ~/Library/Logs/baton-provisioner.log"
         );
       }
-    }),
-    rm: defineCommand({
-      meta: { name: "rm", description: "delete a requirement by code" },
-      args: {
-        code: { type: "positional", required: true },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        const c = clientFor(args);
-        const id = await resolveByCode(c, resolveProjectId(args), args.code);
-        console.log(await removeRequirement(c, id, args.code, Boolean(args.json)));
-      }
     })
   }
 });
@@ -8579,14 +7822,14 @@ import { randomUUID } from "node:crypto";
 import { query } from "@anthropic-ai/claude-agent-sdk";
 
 // src/session/runner/transcript.ts
-import { readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
+import { readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join7 } from "node:path";
+import { join as join5 } from "node:path";
 var findTranscriptPath = (agentSessionId) => {
-  const root = join7(homedir2(), ".claude", "projects");
+  const root = join5(homedir2(), ".claude", "projects");
   try {
     for (const dir of readdirSync(root)) {
-      const candidate = join7(root, dir, `${agentSessionId}.jsonl`);
+      const candidate = join5(root, dir, `${agentSessionId}.jsonl`);
       try {
         if (statSync(candidate).isFile()) return candidate;
       } catch {
@@ -8657,7 +7900,7 @@ var readFirstExchange = (agentSessionId) => {
   const path = findTranscriptPath(agentSessionId);
   if (!path) return null;
   try {
-    return parseFirstExchange(readFileSync4(path, "utf8"));
+    return parseFirstExchange(readFileSync2(path, "utf8"));
   } catch {
     return null;
   }
@@ -8665,12 +7908,12 @@ var readFirstExchange = (agentSessionId) => {
 
 // src/session/runner/turn.ts
 import { mkdir as mkdir5, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join10 } from "node:path";
 
 // src/session/runner/attachments.ts
 import { createWriteStream } from "node:fs";
 import { mkdir as mkdir4 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { join as join6 } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 var dedupe = (name, taken) => {
@@ -8700,8 +7943,8 @@ var materializeAttachments = async (opts) => {
     const name = dedupe(att.filename, taken);
     const res = await fetchImpl(`${opts.serverBase}${att.url}`);
     if (!res.ok || !res.body) throw new Error(`attachment ${att.id} \u2192 ${res.status}`);
-    await pipeline(Readable.fromWeb(res.body), createWriteStream(join8(dir, name)));
-    paths.push(join8(dir, name));
+    await pipeline(Readable.fromWeb(res.body), createWriteStream(join6(dir, name)));
+    paths.push(join6(dir, name));
   }
   return paths;
 };
@@ -8717,7 +7960,7 @@ ${text}` : header;
 };
 
 // src/session/runner/codex.ts
-import { join as join9 } from "node:path";
+import { join as join7 } from "node:path";
 import { Codex } from "@openai/codex-sdk";
 
 // src/session/runner/sdk-env.ts
@@ -8879,7 +8122,7 @@ async function* startCodexEvents(config, input, worker2, opts) {
   const env = compactEnv(buildSdkEnv(opts.envOverlay));
   const codex = new Codex(env ? { env } : void 0);
   const resuming = !config.agentSessionId.startsWith("pending:");
-  const addDirs = additionalDirs([join9(config.runtimeDir, "attachments")]);
+  const addDirs = additionalDirs([join7(config.runtimeDir, "attachments")]);
   const sandboxMode = codexSandboxMode(opts.planMode ?? false);
   const approvalPolicy = codexApprovalPolicy();
   const networkAccessEnabled = codexNetworkAccess();
@@ -8920,7 +8163,7 @@ async function* startCodexEvents(config, input, worker2, opts) {
 // src/session/runner/pi.ts
 import { readFile as readFile2 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join8 } from "node:path";
 var newPiTurnState = (startedAt = Date.now()) => ({
   startedAt,
   usage: {},
@@ -9065,7 +8308,7 @@ async function* startPiEvents(config, input, opts) {
     agentDir,
     // pi discovers .pi/ and .agents/ skills natively; Baton workers deploy theirs
     // under .claude/skills (project and user level).
-    additionalSkillPaths: [join10(config.cwd, ".claude/skills"), join10(homedir3(), ".claude/skills")]
+    additionalSkillPaths: [join8(config.cwd, ".claude/skills"), join8(homedir3(), ".claude/skills")]
   });
   await resourceLoader.reload();
   const existing = pi.SessionManager.findById(config.cwd, config.agentSessionId);
@@ -9140,11 +8383,11 @@ async function* startPiEvents(config, input, opts) {
 }
 
 // src/session/runner/query.ts
-import { join as join11 } from "node:path";
+import { join as join9 } from "node:path";
 var startQuery = (config, text, resuming, queryFn, abortController, log, { envOverlay, planMode = false, model, effort } = {}) => {
   const env = buildSdkEnv(envOverlay);
   const exe = claudeExecutable();
-  const addDirs = additionalDirs([join11(config.runtimeDir, "attachments")]);
+  const addDirs = additionalDirs([join9(config.runtimeDir, "attachments")]);
   const level = claudeEffort(effort);
   if (addDirs) log(`[add-dir] ${addDirs.join(", ")}`);
   if (planMode) log("[plan] read-only planning turn");
@@ -9395,7 +8638,7 @@ var UnsettledExecution = class extends Error {
 var materializeImages = async (config, execution) => {
   const images = execution.message.payload.images ?? [];
   if (!images.length) return [];
-  const directory2 = join12(
+  const directory2 = join10(
     config.runtimeDir,
     "attachments",
     `message-${execution.message.id}`,
@@ -9406,7 +8649,7 @@ var materializeImages = async (config, execution) => {
     images.map(async (image, index) => {
       const match = /^data:image\/(png|jpeg|webp|gif);base64,([A-Za-z0-9+/=\r\n]+)$/.exec(image);
       if (!match) throw new Error("unsupported pasted image");
-      const path = join12(directory2, `pasted-${index + 1}.${match[1]}`);
+      const path = join10(directory2, `pasted-${index + 1}.${match[1]}`);
       await writeFile3(path, Buffer.from(match[2] ?? "", "base64"));
       return path;
     })
@@ -9415,7 +8658,7 @@ var materializeImages = async (config, execution) => {
 var buildPrompt = async (config, execution, fetchImpl) => {
   const { text: rawText, attachments = [] } = execution.message.payload;
   const paths = attachments.length ? await materializeAttachments({
-    directory: join12(
+    directory: join10(
       config.runtimeDir,
       "attachments",
       `message-${execution.message.id}`,
@@ -9672,15 +8915,15 @@ var runDaemon = async (config, deps, signal) => {
 // src/worker/runtime-paths.ts
 import { createHash } from "node:crypto";
 import { homedir as homedir4 } from "node:os";
-import { join as join13 } from "node:path";
-var workerRuntimeDir = (owner, env = process.env) => join13(
-  env.XDG_DATA_HOME ?? join13(env.HOME ?? homedir4(), ".local/share"),
+import { join as join11 } from "node:path";
+var workerRuntimeDir = (owner, env = process.env) => join11(
+  env.XDG_DATA_HOME ?? join11(env.HOME ?? homedir4(), ".local/share"),
   "baton",
   "runtime",
   createHash("sha256").update(owner.server).digest("hex"),
   `worker-${owner.workerId}`
 );
-var sessionRuntimeDir = (owner, sessionId, env = process.env) => join13(workerRuntimeDir(owner, env), "sessions", String(sessionId));
+var sessionRuntimeDir = (owner, sessionId, env = process.env) => join11(workerRuntimeDir(owner, env), "sessions", String(sessionId));
 
 // src/commands/session/run.ts
 var bearerFetch = (token) => (input, init2) => fetch(input, {
@@ -9775,6 +9018,25 @@ var sessionRunCommand = defineCommand({
   }
 });
 
+// src/commands/attach.ts
+import { openAsBlob as openAsBlob2 } from "node:fs";
+import { basename as basename2 } from "node:path";
+var attachPaths = (raw) => (raw === void 0 ? [] : Array.isArray(raw) ? raw : [raw]).flatMap((p) => p.split(",")).map((p) => p.trim()).filter(Boolean);
+var uploadAttachments = async (client, sessionId, paths) => {
+  const out = [];
+  for (const path of paths) {
+    const body = await openAsBlob2(path, { type: contentTypeForPath(path) });
+    out.push(
+      await client.sessions.uploadAttachment(sessionId, {
+        filename: basename2(path),
+        contentType: contentTypeForPath(path),
+        body
+      })
+    );
+  }
+  return out;
+};
+
 // src/commands/session/send.ts
 var sessionSendCommand = defineCommand({
   meta: { name: "send", description: "post a chat message into a session (no streaming reply)" },
@@ -9822,6 +9084,60 @@ var sessionStopCommand = defineCommand({
   }
 });
 
+// src/commands/session/tell.ts
+var TELL_LOOP_LIMIT = 10;
+var TELL_HEADER = /^\[Message from baton session #\d+ /gm;
+var renderTell = (from, body) => [
+  `[Message from baton session #${from.id} ${JSON.stringify(from.name)}]`,
+  `To reply, run: baton session tell ${from.id} "<your reply>"`,
+  "Reply only if a response is actually needed.",
+  "",
+  body
+].join("\n");
+var headerCount = (event) => {
+  const text = event.payload?.text ?? "";
+  return text.match(TELL_HEADER)?.length ?? 0;
+};
+var countConsecutiveTells = (events) => {
+  const newestFirst = events.filter((event) => event.type === "user_message").map(headerCount).reverse();
+  const end = newestFirst.indexOf(0);
+  return (end < 0 ? newestFirst : newestFirst.slice(0, end)).reduce((sum, n) => sum + n, 0);
+};
+var sendTell = async (c, { fromId, toId, body }) => {
+  if (body.trim() === "") throw new Error("nothing to send: message text is empty");
+  if (toId === fromId) throw new Error("cannot tell your own session");
+  const [from, events] = await Promise.all([c.sessions.get(fromId), c.sessions.listEvents(fromId)]);
+  const received = countConsecutiveTells(events);
+  if (received >= TELL_LOOP_LIMIT)
+    throw new Error(
+      `not sent: this session received ${received} agent messages in a row. Stop and ask a human; a message from them resets the count.`
+    );
+  return c.sessions.sendMessage(toId, renderTell(from, body));
+};
+var parseId = (raw) => raw !== void 0 && /^[1-9]\d*$/.test(raw) ? Number(raw) : null;
+var sessionTellCommand = defineCommand({
+  meta: {
+    name: "tell",
+    description: "Send a message to another agent session in this workspace. It includes who sent it and how to reply, and wakes the target if needed. Delivery is fire-and-forget: end your turn, and any reply arrives as a new message. You cannot read another session; ask it instead."
+  },
+  args: {
+    session: { type: "positional", required: true, description: "target session int id" },
+    text: { type: "positional", required: true, description: "message text" },
+    ...common
+  },
+  run: async ({ args }) => {
+    const fromId = parseId(process.env.BATON_SESSION_ID);
+    const bearer = process.env.BATON_WORKER_TOKEN;
+    if (fromId === null || !bearer)
+      throw new Error("baton session tell only works inside a baton session");
+    const toId = parseId(args.session);
+    if (toId === null) throw new Error(`invalid session "${args.session}": pass the session id`);
+    const client = createClient(resolveBaseUrl(args.url), { bearer });
+    const result = await sendTell(client, { fromId, toId, body: args.text });
+    console.log(args.json ? toJson(result) : `told session #${toId} (input ${result.input.id})`);
+  }
+});
+
 // src/commands/session/terminal.ts
 var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
 var sessionTerminalCommand = defineCommand({
@@ -9870,6 +9186,7 @@ var session = defineCommand({
     rename: sessionRenameCommand,
     rm: sessionRmCommand,
     send: sessionSendCommand,
+    tell: sessionTellCommand,
     ls: sessionLsCommand,
     get: sessionGetCommand,
     run: sessionRunCommand,
@@ -9877,177 +9194,18 @@ var session = defineCommand({
   }
 });
 
-// src/commands/task.ts
-var createTask = (c, input, json) => c.tasks.create(input).then((t) => renderOne(t, fmtTask, json));
-var updateTask = (c, id, patch, json) => c.tasks.update(id, patch).then((t) => renderOne(t, fmtTask, json));
-var listTasks = (c, requirementId, json) => c.tasks.listByRequirement(requirementId).then((ts) => renderList(ts, fmtTask, json));
-var getTask = (c, id, json) => c.tasks.get(id).then((t) => renderOne(t, fmtTask, json));
-var setTaskStatus = (c, id, status, json) => c.tasks.setStatus(id, status).then((t) => renderOne(t, fmtTask, json));
-var removeTask = (c, id, label, json) => c.tasks.remove(id).then(() => removed("task", label, json));
-var addTaskComment = (c, taskId, body, workerId, json) => c.tasks.addComment(taskId, body, workerId).then((x) => renderOne(x, fmtComment, json));
-var listTaskComments = (c, taskId, json) => c.tasks.listComments(taskId).then((xs) => renderList(xs, fmtComment, json));
-var resolveReqByCode = async (c, projectId, code) => (await c.requirements.getByCode(projectId, code)).id;
-var resolveTaskByCode = async (c, projectId, code) => (await c.tasks.getByCode(projectId, code)).id;
-var task = defineCommand({
-  meta: { name: "task", description: "manage tasks" },
-  subCommands: {
-    create: defineCommand({
-      meta: { name: "create", description: "create a task" },
-      args: {
-        title: { type: "positional", required: true },
-        requirement: { type: "string", required: true, description: "requirement code (R-N)" },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        body: { type: "string", description: "task body (markdown)" },
-        deps: { type: "string", description: "comma-separated dependency task codes (T-N,T-N)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        const c = clientFor(args);
-        const projectId = resolveProjectId(args);
-        const requirementId = await resolveReqByCode(c, projectId, args.requirement);
-        const depCodes = splitCsv(args.deps) ?? [];
-        const dependsOn = await Promise.all(
-          depCodes.map((code) => resolveTaskByCode(c, projectId, code))
-        );
-        console.log(
-          await createTask(
-            c,
-            {
-              requirementId,
-              title: args.title,
-              body: args.body,
-              dependsOn: dependsOn.length ? dependsOn : void 0
-            },
-            Boolean(args.json)
-          )
-        );
-      }
-    }),
-    update: defineCommand({
-      meta: { name: "update", description: "update a task title / body" },
-      args: {
-        code: { type: "positional", required: true, description: "task code (T-N)" },
-        title: { type: "string", description: "new title" },
-        body: { type: "string", description: "new body (markdown)" },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        const patch = {
-          ...args.title !== void 0 ? { title: args.title } : {},
-          ...args.body !== void 0 ? { body: args.body } : {}
-        };
-        if (Object.keys(patch).length === 0) throw new Error("pass --title and/or --body");
-        const c = clientFor(args);
-        const id = await resolveTaskByCode(c, resolveProjectId(args), args.code);
-        console.log(await updateTask(c, id, patch, Boolean(args.json)));
-      }
-    }),
-    ls: defineCommand({
-      meta: { name: "ls", description: "list tasks in a requirement" },
-      args: {
-        requirement: { type: "string", required: true, description: "requirement code (R-N)" },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        const c = clientFor(args);
-        const reqId = await resolveReqByCode(c, resolveProjectId(args), args.requirement);
-        console.log(await listTasks(c, reqId, Boolean(args.json)));
-      }
-    }),
-    get: defineCommand({
-      meta: { name: "get", description: "get a task by code (T-N)" },
-      args: {
-        code: { type: "positional", required: true },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        const c = clientFor(args);
-        const id = await resolveTaskByCode(c, resolveProjectId(args), args.code);
-        console.log(await getTask(c, id, Boolean(args.json)));
-      }
-    }),
-    "set-status": defineCommand({
-      meta: {
-        name: "set-status",
-        description: "set task status (todo|in_progress|blocked|done|failed|cancelled)"
-      },
-      args: {
-        code: { type: "positional", required: true, description: "task code (T-N)" },
-        status: { type: "positional", required: true },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        const c = clientFor(args);
-        const id = await resolveTaskByCode(c, resolveProjectId(args), args.code);
-        console.log(await setTaskStatus(c, id, args.status, Boolean(args.json)));
-      }
-    }),
-    rm: defineCommand({
-      meta: { name: "rm", description: "delete a task by code" },
-      args: {
-        code: { type: "positional", required: true },
-        project: { type: "string", description: "project id (overrides .baton.json)" },
-        ...common
-      },
-      run: async ({ args }) => {
-        const c = clientFor(args);
-        const id = await resolveTaskByCode(c, resolveProjectId(args), args.code);
-        console.log(await removeTask(c, id, args.code, Boolean(args.json)));
-      }
-    }),
-    comment: defineCommand({
-      meta: { name: "comment", description: "append-only task comments" },
-      subCommands: {
-        add: defineCommand({
-          meta: { name: "add", description: "add a comment to a task" },
-          args: {
-            code: { type: "positional", required: true, description: "task code (T-N)" },
-            body: { type: "positional", required: true, description: "comment text (markdown)" },
-            worker: { type: "string", description: "attribute to a worker id (omit = human)" },
-            project: { type: "string", description: "project id (overrides .baton.json)" },
-            ...common
-          },
-          run: async ({ args }) => {
-            const c = clientFor(args);
-            const id = await resolveTaskByCode(c, resolveProjectId(args), args.code);
-            const workerId = args.worker ? Number(args.worker) : void 0;
-            console.log(await addTaskComment(c, id, args.body, workerId, Boolean(args.json)));
-          }
-        }),
-        ls: defineCommand({
-          meta: { name: "ls", description: "list a task\u2019s comments in order" },
-          args: {
-            code: { type: "positional", required: true, description: "task code (T-N)" },
-            project: { type: "string", description: "project id (overrides .baton.json)" },
-            ...common
-          },
-          run: async ({ args }) => {
-            const c = clientFor(args);
-            const id = await resolveTaskByCode(c, resolveProjectId(args), args.code);
-            console.log(await listTaskComments(c, id, Boolean(args.json)));
-          }
-        })
-      }
-    })
-  }
-});
-
 // src/commands/worker/index.ts
 import { hostname as osHostname } from "node:os";
 
 // src/worker/bundled-skills.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { cpSync, existsSync as existsSync5 } from "node:fs";
-import { dirname as dirname4, join as join14 } from "node:path";
+import { dirname as dirname4, join as join12 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // src/worker/git-exclude.ts
 import { spawnSync } from "node:child_process";
-import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync5 } from "node:fs";
+import { appendFileSync, existsSync as existsSync4, mkdirSync, readFileSync as readFileSync3 } from "node:fs";
 import { dirname as dirname3, isAbsolute as isAbsolute3, resolve as resolve3 } from "node:path";
 var ensureExcluded = (cwd, pattern) => {
   const result = spawnSync("git", ["-C", cwd, "rev-parse", "--git-path", "info/exclude"], {
@@ -10061,9 +9219,9 @@ var ensureExcluded = (cwd, pattern) => {
   }
   const location = result.stdout.trim();
   const path = isAbsolute3(location) ? location : resolve3(cwd, location);
-  const current = existsSync4(path) ? readFileSync5(path, "utf8") : "";
+  const current = existsSync4(path) ? readFileSync3(path, "utf8") : "";
   if (current.split("\n").includes(pattern)) return;
-  mkdirSync3(dirname3(path), { recursive: true });
+  mkdirSync(dirname3(path), { recursive: true });
   appendFileSync(path, `${current && !current.endsWith("\n") ? "\n" : ""}${pattern}
 `);
 };
@@ -10074,8 +9232,8 @@ var TARGETS = [`.claude/skills/${SKILL_NAME}`, `.agents/skills/${SKILL_NAME}`];
 var bundledSkillPath = () => {
   const here = dirname4(fileURLToPath(import.meta.url));
   const candidates = [
-    join14(here, "..", "skills", SKILL_NAME),
-    join14(here, "..", "..", "skills", SKILL_NAME)
+    join12(here, "..", "skills", SKILL_NAME),
+    join12(here, "..", "..", "skills", SKILL_NAME)
   ];
   const found = candidates.find(existsSync5);
   if (!found) throw new Error(`bundled skill missing: ${SKILL_NAME}`);
@@ -10092,7 +9250,7 @@ var syncBundledArtifactSkill = (cwd) => {
   const source = bundledSkillPath();
   TARGETS.filter((target) => !isTracked(cwd, target)).forEach((target) => {
     ensureExcluded(cwd, `${target}/`);
-    cpSync(source, join14(cwd, target), { recursive: true, force: true });
+    cpSync(source, join12(cwd, target), { recursive: true, force: true });
   });
 };
 
@@ -10363,7 +9521,7 @@ var openCommitDownload = async (repo, commit, path, signal) => {
 // src/worker/files/disk.ts
 import { constants as constants2 } from "node:fs";
 import { open as open2, readdir, realpath as realpath3, stat as stat3 } from "node:fs/promises";
-import { isAbsolute as isAbsolute4, join as join15, relative, sep } from "node:path";
+import { isAbsolute as isAbsolute4, join as join13, relative, sep } from "node:path";
 import { Readable as Readable3 } from "node:stream";
 var isMissing = (error) => ["ENOENT", "ENOTDIR", "ELOOP"].includes(error.code ?? "");
 var childPath = (parent, name) => parent ? `${parent}/${name}` : name;
@@ -10376,7 +9534,7 @@ var resolveInside = async (root, path, allowRoot) => {
   const rel = checkedPath(path, allowRoot);
   let real;
   try {
-    real = await realpath3(join15(root, rel));
+    real = await realpath3(join13(root, rel));
   } catch (error) {
     if (isMissing(error)) throw notFound(rel);
     throw error;
@@ -10406,7 +9564,7 @@ var toEntry = async (root, dir, dirent) => {
   if (dirent.isDirectory())
     return isExcludedDirectoryName(dirent.name) ? null : { name: dirent.name, path, kind: "directory" };
   if (dirent.isFile()) return { name: dirent.name, path, kind: "file" };
-  return dirent.isSymbolicLink() ? symlinkEntry(root, join15(dir.real, dirent.name), dirent.name, path) : null;
+  return dirent.isSymbolicLink() ? symlinkEntry(root, join13(dir.real, dirent.name), dirent.name, path) : null;
 };
 var listDirectory = async (root, path) => {
   const dir = await resolveInside(root, path, true);
@@ -10429,7 +9587,7 @@ var searchFiles = async (root, query3, now = Date.now) => {
     const dir = pending[index] ?? "";
     let dirents;
     try {
-      dirents = await readdir(join15(root, dir), { withFileTypes: true });
+      dirents = await readdir(join13(root, dir), { withFileTypes: true });
     } catch (error) {
       console.warn(`[files] search skipped unreadable directory ${dir || "."}`, error);
       continue;
@@ -10673,14 +9831,14 @@ var createLiveness = (deps) => {
 };
 
 // src/worker/service-supervisor.ts
-import { mkdirSync as mkdirSync4 } from "node:fs";
+import { mkdirSync as mkdirSync2 } from "node:fs";
 import { stat as stat4 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { join as join15 } from "node:path";
 
 // src/worker/service-process.ts
 import { spawn as spawn3 } from "node:child_process";
 import { closeSync, existsSync as existsSync6, openSync } from "node:fs";
-import { dirname as dirname5, join as join16 } from "node:path";
+import { dirname as dirname5, join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var START_TIMEOUT_MS = 1e4;
 var isWrapperMessage = (message) => {
@@ -10691,7 +9849,7 @@ var isWrapperMessage = (message) => {
 };
 var binPath = () => {
   const here = dirname5(fileURLToPath2(import.meta.url));
-  const devShim = join16(here, "..", "..", "bin", "baton.mjs");
+  const devShim = join14(here, "..", "..", "bin", "baton.mjs");
   return existsSync6(devShim) ? devShim : fileURLToPath2(import.meta.url);
 };
 var startServiceProcess = (input) => {
@@ -10785,9 +9943,9 @@ var createServiceSupervisor = (deps) => {
       if (code !== "ENOENT" && code !== "ENOTDIR") throw error;
       return report({ requestId, ok: false, error: `directory not found: ${cwd}`, status: 400 });
     }
-    const logDir = join17(workerRuntimeDir(cfg), "services");
-    const logPath = join17(logDir, `${name}.log`);
-    mkdirSync4(logDir, { recursive: true, mode: 448 });
+    const logDir = join15(workerRuntimeDir(cfg), "services");
+    const logPath = join15(logDir, `${name}.log`);
+    mkdirSync2(logDir, { recursive: true, mode: 448 });
     if (entries.has(name))
       return report({
         requestId,
@@ -10852,7 +10010,7 @@ import { spawn as spawn4 } from "node:child_process";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { existsSync as existsSync7 } from "node:fs";
 import { mkdir as mkdir6, rm as rm3, stat as stat5 } from "node:fs/promises";
-import { dirname as dirname6, join as join21 } from "node:path";
+import { dirname as dirname6, join as join19 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { query as query2 } from "@anthropic-ai/claude-agent-sdk";
 
@@ -10945,8 +10103,8 @@ var generateTitle = async (input) => {
 
 // src/session/runner/title-codex.ts
 import { mkdtemp, rm } from "node:fs/promises";
-import { tmpdir as tmpdir3 } from "node:os";
-import { join as join18 } from "node:path";
+import { tmpdir } from "node:os";
+import { join as join16 } from "node:path";
 import { Codex as Codex2 } from "@openai/codex-sdk";
 var generateTitleWithCodex = async (input) => {
   const { userText, assistantText } = input;
@@ -10955,7 +10113,7 @@ var generateTitleWithCodex = async (input) => {
   const timer = setTimeout(() => abort.abort(), TITLE_TIMEOUT_MS);
   let cwd = "";
   try {
-    cwd = await mkdtemp(join18(tmpdir3(), "baton-title-"));
+    cwd = await mkdtemp(join16(tmpdir(), "baton-title-"));
     const client = input.client ?? new Codex2();
     const thread = client.startThread({
       workingDirectory: cwd,
@@ -10983,8 +10141,8 @@ var generateTitleWithCodex = async (input) => {
 
 // src/session/runner/title-pi.ts
 import { mkdtemp as mkdtemp2, rm as rm2 } from "node:fs/promises";
-import { tmpdir as tmpdir4 } from "node:os";
-import { join as join19 } from "node:path";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join17 } from "node:path";
 var generateTitleWithPi = async (input) => {
   const { userText, assistantText } = input;
   if (`${userText}${assistantText}`.trim().length < 4) return { kind: "declined" };
@@ -10992,7 +10150,7 @@ var generateTitleWithPi = async (input) => {
   let timedOut = false;
   let timer;
   try {
-    cwd = await mkdtemp2(join19(tmpdir4(), "baton-title-"));
+    cwd = await mkdtemp2(join17(tmpdir2(), "baton-title-"));
     const pi = await import("@earendil-works/pi-coding-agent");
     const agentDir = pi.getAgentDir();
     const resourceLoader = new pi.DefaultResourceLoader({
@@ -11044,11 +10202,11 @@ var generateTitleWithPi = async (input) => {
 // src/worker/session-process.ts
 import { execFile as execFile5 } from "node:child_process";
 import { readFile as readFile3, rename, writeFile as writeFile4 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { join as join18 } from "node:path";
 import { promisify as promisify5 } from "node:util";
 var run3 = promisify5(execFile5);
 var RUNNER_RECORD = ".baton-runner.json";
-var recordPath = (cwd) => join20(cwd, RUNNER_RECORD);
+var recordPath = (cwd) => join18(cwd, RUNNER_RECORD);
 var codeOf = (error) => typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
 var readRunnerRecord = async (cwd) => {
   let raw;
@@ -11116,7 +10274,7 @@ var stopRecordedRunner = async (record, expected, graceMs = 5e3) => {
 // src/worker/session-supervisor.ts
 var binPath2 = () => {
   const here = dirname6(fileURLToPath3(import.meta.url));
-  const devShim = join21(here, "..", "..", "bin", "baton.mjs");
+  const devShim = join19(here, "..", "..", "bin", "baton.mjs");
   return existsSync7(devShim) ? devShim : fileURLToPath3(import.meta.url);
 };
 var createSessionSupervisor = (deps) => {
@@ -11361,7 +10519,7 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 import { existsSync as existsSync8, readdirSync as readdirSync2 } from "node:fs";
 import { createRequire as createModuleRequire } from "node:module";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname7, join as join22 } from "node:path";
+import { dirname as dirname7, join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var MAX_TERMINALS = 10;
 var claudePtyCommand = (agentSessionId, hasJsonl, env = process.env) => ({
@@ -11382,13 +10540,13 @@ var piPtyCommand = (agentSessionId, env = process.env) => {
   const override = env.BATON_PI_BIN?.trim();
   if (override) return { file: override, args };
   const entry = fileURLToPath4(import.meta.resolve("@earendil-works/pi-coding-agent"));
-  return { file: process.execPath, args: [join22(dirname7(entry), "bundle", "cli.js"), ...args] };
+  return { file: process.execPath, args: [join20(dirname7(entry), "bundle", "cli.js"), ...args] };
 };
 var hasSessionJsonl = (agentSessionId) => {
-  const root = join22(homedir5(), ".claude", "projects");
+  const root = join20(homedir5(), ".claude", "projects");
   if (!existsSync8(root)) return false;
   for (const dir of readdirSync2(root))
-    if (existsSync8(join22(root, dir, `${agentSessionId}.jsonl`))) return true;
+    if (existsSync8(join20(root, dir, `${agentSessionId}.jsonl`))) return true;
   return false;
 };
 var ptyCommand = (kind, agentSessionId) => ({
@@ -11585,18 +10743,18 @@ var runWorkerDaemon = async (cfg, client, signal) => {
 
 // src/worker/machine-id.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname8, join as join23 } from "node:path";
-var machineIdPath = (env = process.env) => join23(env.XDG_DATA_HOME ?? join23(env.HOME ?? homedir6(), ".local/share"), "baton", "machine-id");
+import { dirname as dirname8, join as join21 } from "node:path";
+var machineIdPath = (env = process.env) => join21(env.XDG_DATA_HOME ?? join21(env.HOME ?? homedir6(), ".local/share"), "baton", "machine-id");
 var readOrCreateMachineId = (path = machineIdPath()) => {
   if (existsSync9(path)) {
-    const s = readFileSync6(path, "utf8").trim();
+    const s = readFileSync4(path, "utf8").trim();
     if (s) return s;
   }
   const id = randomUUID3();
-  mkdirSync5(dirname8(path), { recursive: true });
-  writeFileSync5(path, `${id}
+  mkdirSync3(dirname8(path), { recursive: true });
+  writeFileSync2(path, `${id}
 `, "utf8");
   return id;
 };
@@ -11605,7 +10763,7 @@ var readOrCreateMachineId = (path = machineIdPath()) => {
 var projectArg = {
   project: { type: "string", description: "project id (overrides .baton.json)" }
 };
-var positiveId = (raw) => {
+var positiveId2 = (raw) => {
   const id = Number(raw);
   if (!Number.isSafeInteger(id) || id <= 0) throw new Error("positive id required");
   return id;
@@ -11614,12 +10772,12 @@ var workerTemplatesCommand = defineCommand({
   meta: { name: "templates", description: "list worker creation templates for a project" },
   args: { ...projectArg, ...common },
   run: async ({ args }) => {
-    const list = await clientFor(args).workerCreations.templates(positiveId(resolveProjectId(args)));
+    const list = await clientFor(args).workerCreations.templates(positiveId2(resolveProjectId(args)));
     console.log(renderList(list, fmtWorkerTemplate, Boolean(args.json)));
   }
 });
 var workerCreateCommand = defineCommand({
-  meta: { name: "create", description: "request a worker from the mini template (asynchronous)" },
+  meta: { name: "create", description: "request a worker from a template (asynchronous)" },
   args: {
     ...projectArg,
     ...common,
@@ -11633,6 +10791,10 @@ var workerCreateCommand = defineCommand({
     repoPath: {
       type: "string",
       description: "share an existing worker's directory in this project (default: a new one)"
+    },
+    host: {
+      type: "string",
+      description: "host name or id (default: the workspace's only host)"
     }
   },
   run: async ({ args }) => {
@@ -11643,15 +10805,16 @@ var workerCreateCommand = defineCommand({
       throw new Error("agentKind is not supported by this template");
     const name = args.name.trim();
     if (!name) throw new Error("worker name required");
-    const creation = await clientFor(args).workerCreations.create(
-      positiveId(resolveProjectId(args)),
-      {
-        templateId: args.template,
-        name,
-        agentKind,
-        ...args.repoPath ? { repoPath: args.repoPath } : {}
-      }
-    );
+    const client = clientFor(args);
+    const projectId = positiveId2(resolveProjectId(args));
+    const host2 = args.host ? findHost(await client.workerCreations.hosts(projectId), args.host) : null;
+    const creation = await client.workerCreations.create(projectId, {
+      templateId: args.template,
+      name,
+      agentKind,
+      ...args.repoPath ? { repoPath: args.repoPath } : {},
+      ...host2 ? { hostId: host2.id } : {}
+    });
     console.log(renderOne(creation, fmtWorkerCreation, Boolean(args.json)));
   }
 });
@@ -11662,7 +10825,7 @@ var workerCreationCommand = defineCommand({
       args: { ...projectArg, ...common },
       run: async ({ args }) => {
         const list = await clientFor(args).workerCreations.listByProject(
-          positiveId(resolveProjectId(args))
+          positiveId2(resolveProjectId(args))
         );
         console.log(renderList(list, fmtWorkerCreation, Boolean(args.json)));
       }
@@ -11670,7 +10833,7 @@ var workerCreationCommand = defineCommand({
     get: defineCommand({
       args: { ...common, id: { type: "positional", required: true } },
       run: async ({ args }) => {
-        const creation = await clientFor(args).workerCreations.get(positiveId(args.id));
+        const creation = await clientFor(args).workerCreations.get(positiveId2(args.id));
         console.log(renderOne(creation, fmtWorkerCreation, Boolean(args.json)));
       }
     })
@@ -11962,24 +11125,21 @@ var workspace = defineCommand({
 var main = defineCommand({
   meta: {
     name: "baton",
-    description: "baton \u2014 run a worker daemon; manage projects / requirements / tasks / sessions"
+    description: "baton \u2014 run a worker daemon; manage projects / sessions"
   },
   // Order matters: high-level verbs first so --help shows them on top.
   subCommands: {
     init,
     worker,
     provisioner,
+    host,
     session,
     service,
     artifact,
     loop,
     notify,
-    relay,
-    channel,
     workspace,
-    project,
-    requirement,
-    task
+    project
   }
 });
 runMain(main);