@mifune/agro 0.9.0 → 0.11.0

package/dist/agro.js

@@ -2,20 +2,246 @@
 
 // src/cli.ts
 import { fileURLToPath } from "node:url";
-import { dirname as dirname6, join as join10, resolve as resolve8 } from "node:path";
+import { dirname as dirname8, join as join10, resolve as resolve10 } from "node:path";
 import { existsSync as existsSync16, mkdtempSync as mkdtempSync3, readFileSync as readFileSync11, rmSync as rmSync3 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 
 // src/commands/update.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import path3 from "node:path";
+
+// src/lib/compat.ts
 import {
-  existsSync as existsSync2,
-  statSync,
-  readFileSync as readFileSync2
+  existsSync,
+  lstatSync,
+  readdirSync,
+  readFileSync,
+  readlinkSync,
+  statSync
 } from "node:fs";
-import path3 from "node:path";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+var GENERATIONS = {
+  legacy: {
+    controlDir: ".oh",
+    configFile: "oh.json",
+    envPrefix: "OH_",
+    userStateDir: ".oh",
+    seedDir: "/opt/oh-seed"
+  },
+  agro: {
+    controlDir: ".agro",
+    configFile: "agro.json",
+    envPrefix: "AGRO_",
+    userStateDir: ".agro",
+    seedDir: "/opt/agro-seed"
+  }
+};
+var LEGACY_CHECKOUT_DIR = ".openharness";
+var DEFAULT_GENERATION = "agro";
+var DEFAULT_SANDBOX_NAME = "agro";
+var CompatConflictError = class extends Error {
+  legacyPath;
+  agroPath;
+  differences;
+  constructor(legacyPath, agroPath, differences) {
+    super(
+      `${legacyPath} and ${agroPath} both exist and differ \u2014 resolve the conflict before continuing (keep exactly one, or make them identical); differences: ${differences.join("; ")}`
+    );
+    this.name = "CompatConflictError";
+    this.legacyPath = legacyPath;
+    this.agroPath = agroPath;
+    this.differences = differences;
+  }
+};
+function entryType(stats) {
+  if (stats.isSymbolicLink()) return "symlink";
+  if (stats.isDirectory()) return "directory";
+  if (stats.isFile()) return "file";
+  return "other";
+}
+function lstatOrUndefined(path4) {
+  return lstatSync(path4, { throwIfNoEntry: false });
+}
+function statOrUndefined(path4) {
+  try {
+    return statSync(path4, { throwIfNoEntry: false });
+  } catch {
+    return void 0;
+  }
+}
+function sameBytes(a, b) {
+  const left = readFileSync(a);
+  const right = readFileSync(b);
+  return left.equals(right);
+}
+function octal(mode) {
+  return (mode & 511).toString(8).padStart(3, "0");
+}
+function contentDifference(type, legacy, agro, left, right) {
+  switch (type) {
+    case "symlink":
+      return readlinkSync(legacy) !== readlinkSync(agro) ? "symlink target differs" : void 0;
+    case "file":
+      return left.size !== right.size || !sameBytes(legacy, agro) ? "content differs" : void 0;
+    case "other":
+      return "unsupported entry type";
+    default:
+      return void 0;
+  }
+}
+function entryDifferences(label, legacy, agro, left, right) {
+  const type = entryType(left);
+  if (type !== entryType(right)) return [`${label}: type ${type} vs ${entryType(right)}`];
+  const differences = [];
+  if ((left.mode & 511) !== (right.mode & 511)) {
+    differences.push(`${label}: mode ${octal(left.mode)} vs ${octal(right.mode)}`);
+  }
+  const content = contentDifference(type, legacy, agro, left, right);
+  if (content !== void 0) differences.push(`${label}: ${content}`);
+  return differences;
+}
+function compareTrees(legacy, agro, rel = "") {
+  const label = rel === "" ? "." : rel;
+  const left = lstatOrUndefined(legacy);
+  const right = lstatOrUndefined(agro);
+  if (left === void 0 && right === void 0) return [];
+  if (left === void 0) return [`${label}: only in ${agro}`];
+  if (right === void 0) return [`${label}: only in ${legacy}`];
+  const differences = entryDifferences(label, legacy, agro, left, right);
+  if (!left.isDirectory() || !right.isDirectory()) return differences;
+  const names = /* @__PURE__ */ new Set([...readdirSync(legacy), ...readdirSync(agro)]);
+  for (const name of [...names].sort()) {
+    const childRel = rel === "" ? name : `${rel}/${name}`;
+    differences.push(...compareTrees(join(legacy, name), join(agro, name), childRel));
+  }
+  return differences;
+}
+function resolvePair(legacyPath, agroPath, present) {
+  const legacyExists = present(legacyPath);
+  const agroExists = present(agroPath);
+  const base = { legacyPath, agroPath };
+  if (!legacyExists && !agroExists) {
+    const path4 = DEFAULT_GENERATION === "agro" ? agroPath : legacyPath;
+    return { ...base, kind: "absent", generation: DEFAULT_GENERATION, path: path4 };
+  }
+  if (legacyExists && !agroExists) {
+    return { ...base, kind: "legacy-only", generation: "legacy", path: legacyPath };
+  }
+  if (!legacyExists && agroExists) {
+    return { ...base, kind: "agro-only", generation: "agro", path: agroPath };
+  }
+  const differences = compareTrees(legacyPath, agroPath);
+  if (differences.length > 0) throw new CompatConflictError(legacyPath, agroPath, differences);
+  return { ...base, kind: "both-equivalent", generation: "agro", path: agroPath };
+}
+function isDirectoryAt(path4) {
+  return statOrUndefined(path4)?.isDirectory() === true;
+}
+function isFileAt(path4) {
+  return statOrUndefined(path4)?.isFile() === true;
+}
+function resolveControlDir(root) {
+  const dir = resolve(root);
+  return resolvePair(
+    join(dir, GENERATIONS.legacy.controlDir),
+    join(dir, GENERATIONS.agro.controlDir),
+    isDirectoryAt
+  );
+}
+function resolveConfigFile(root) {
+  const dir = resolve(root);
+  return resolvePair(
+    join(dir, GENERATIONS.legacy.configFile),
+    join(dir, GENERATIONS.agro.configFile),
+    isFileAt
+  );
+}
+function resolveProjectLayout(root) {
+  const dir = resolve(root);
+  const control = resolveControlDir(dir);
+  const config = resolveConfigFile(dir);
+  const generation = control.kind !== "absent" ? control.generation : config.kind !== "absent" ? config.generation : DEFAULT_GENERATION;
+  const names = GENERATIONS[generation];
+  return {
+    generation,
+    root: dir,
+    controlDir: join(dir, names.controlDir),
+    configFile: join(dir, names.configFile)
+  };
+}
+function controlDirCandidates() {
+  return [GENERATIONS.agro.controlDir, GENERATIONS.legacy.controlDir];
+}
+function remoteControlDirScript(root, rel, args) {
+  const candidates = controlDirCandidates().join(" ");
+  const script = `root="$1"; shift; rel="$1"; shift; for name in ${candidates}; do if [ -d "$root/$name" ]; then exec bash "$root/$name/$rel" "$@"; fi; done; printf 'no control plane (%s) under %s\\n' '${candidates}' "$root" >&2; exit 1`;
+  return ["bash", "-c", script, "control-dir", root, rel, ...args];
+}
+function envValue(env, key) {
+  const value = env[key];
+  return value !== void 0 && value !== "" ? value : void 0;
+}
+function resolveAliasedEnv(env, suffix) {
+  const agroKey = `${GENERATIONS.agro.envPrefix}${suffix}`;
+  const legacyKey = `${GENERATIONS.legacy.envPrefix}${suffix}`;
+  const agro = envValue(env, agroKey);
+  const legacy = envValue(env, legacyKey);
+  const conflict = agro !== void 0 && legacy !== void 0 && agro !== legacy;
+  if (agro !== void 0) {
+    return { key: suffix, agroKey, legacyKey, value: agro, source: "agro", conflict };
+  }
+  if (legacy !== void 0) {
+    return { key: suffix, agroKey, legacyKey, value: legacy, source: "legacy", conflict: false };
+  }
+  return { key: suffix, agroKey, legacyKey, value: void 0, source: "none", conflict: false };
+}
+function aliasConflictWarning(resolved2) {
+  if (!resolved2.conflict) return void 0;
+  return `compat: ${resolved2.agroKey} and ${resolved2.legacyKey} are both set and differ \u2014 using ${resolved2.agroKey}`;
+}
+function aliasedEnvPair(suffix, value) {
+  return {
+    [`${GENERATIONS.agro.envPrefix}${suffix}`]: value,
+    [`${GENERATIONS.legacy.envPrefix}${suffix}`]: value
+  };
+}
+function aliasedEnvValue(env, suffix, warn = (message) => process.stderr.write(`${message}
+`)) {
+  const resolved2 = resolveAliasedEnv(env, suffix);
+  const warning = aliasConflictWarning(resolved2);
+  if (warning !== void 0) warn(warning);
+  return resolved2.value;
+}
+var REGISTRY_SUBDIR = "sandboxes";
+function discoverUserState(home = homedir()) {
+  const probe = (name) => {
+    const path4 = join(home, name);
+    return { path: path4, exists: isDirectoryAt(path4) };
+  };
+  return {
+    agroHome: probe(GENERATIONS.agro.userStateDir),
+    legacyHome: probe(GENERATIONS.legacy.userStateDir),
+    legacyCheckout: probe(LEGACY_CHECKOUT_DIR)
+  };
+}
+function resolveRegistryHome(env = process.env, home = homedir(), warn) {
+  const configured = aliasedEnvValue(env, "HOME", warn);
+  if (configured !== void 0) return { path: resolve(configured), configured: true };
+  return { path: home, configured: false };
+}
+function resolveUserStateHome(env = process.env, home = homedir(), warn) {
+  const configured = aliasedEnvValue(env, "HOME", warn);
+  if (configured !== void 0) return resolve(configured);
+  const discovered = discoverUserState(home);
+  const legacyRegistry = join(discovered.legacyHome.path, REGISTRY_SUBDIR);
+  const agroRegistry = join(discovered.agroHome.path, REGISTRY_SUBDIR);
+  const resolution = resolvePair(legacyRegistry, agroRegistry, isDirectoryAt);
+  return resolution.generation === "agro" ? discovered.agroHome.path : discovered.legacyHome.path;
+}
 
 // src/lib/manifest.ts
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 import path from "node:path";
 var REGEX_SPECIAL = /* @__PURE__ */ new Set([".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]", "\\"]);
 function globToRegExp(glob) {
@@ -66,7 +292,7 @@ function rootPayloadDirs(manifest) {
 function loadManifest(fromOh) {
   try {
     const manifestPath = path.resolve(fromOh, "manifest.json");
-    const parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+    const parsed = JSON.parse(readFileSync2(manifestPath, "utf8"));
     if (!parsed || !Array.isArray(parsed.include) || parsed.include.length === 0) {
       return null;
     }
@@ -82,30 +308,66 @@ function loadManifest(fromOh) {
 
 // src/lib/vendor.ts
 import {
-  existsSync,
-  lstatSync,
+  existsSync as existsSync2,
+  lstatSync as lstatSync2,
   mkdirSync,
-  readdirSync,
+  readdirSync as readdirSync2,
   copyFileSync
 } from "node:fs";
 import path2 from "node:path";
-function assertDestInTarget(dest, targetOh, sep4) {
-  if (dest === targetOh || dest.startsWith(targetOh + sep4)) {
+
+// src/lib/product.ts
+import { basename } from "node:path";
+var AGRO_PRODUCT = {
+  name: "agro",
+  bin: "agro",
+  title: "AGRO CLI",
+  packageName: "@mifune/agro",
+  generation: "agro"
+};
+var LEGACY_PRODUCT = {
+  name: "oh",
+  bin: "oh",
+  title: "Open Harness CLI",
+  packageName: "@mifune/openharness",
+  generation: "legacy"
+};
+var FILE_EXTENSION = /\.[^.]*$/;
+function invokedName(argv1) {
+  if (argv1 === void 0) return "";
+  return basename(argv1.replace(/\\/g, "/")).replace(FILE_EXTENSION, "");
+}
+function resolveProduct(argv1) {
+  return invokedName(argv1) === LEGACY_PRODUCT.bin ? LEGACY_PRODUCT : AGRO_PRODUCT;
+}
+function activeBin() {
+  return resolveProduct(process.argv[1]).bin;
+}
+function productFor(bin) {
+  return bin === LEGACY_PRODUCT.bin ? LEGACY_PRODUCT : AGRO_PRODUCT;
+}
+function stateNames(bin) {
+  return GENERATIONS[productFor(bin).generation];
+}
+
+// src/lib/vendor.ts
+function assertDestInTarget(dest, targetOh, sep5) {
+  if (dest === targetOh || dest.startsWith(targetOh + sep5)) {
     return;
   }
-  throw new Error("oh: refusing to write outside target .oh: " + dest);
+  throw new Error(`${activeBin()}: refusing to write outside target .oh: ` + dest);
 }
-function assertDestInRoot(dest, targetRoot, sep4) {
-  if (dest === targetRoot || dest.startsWith(targetRoot + sep4)) {
+function assertDestInRoot(dest, targetRoot, sep5) {
+  if (dest === targetRoot || dest.startsWith(targetRoot + sep5)) {
     return;
   }
-  throw new Error("oh: refusing to write outside target root: " + dest);
+  throw new Error(`${activeBin()}: refusing to write outside target root: ` + dest);
 }
 function walkFiles(root, dir, acc) {
-  const entries = readdirSync(dir, { withFileTypes: true });
+  const entries = readdirSync2(dir, { withFileTypes: true });
   for (const entry of entries) {
     const abs = path2.resolve(dir, entry.name);
-    const st = lstatSync(abs);
+    const st = lstatSync2(abs);
     if (st.isSymbolicLink()) {
       continue;
     }
@@ -142,7 +404,7 @@ function copyOhPayload(fromOh, targetOh, manifest, opts, report) {
     }
     const dest = path2.join(targetOh, rel);
     assertDestInTarget(dest, targetOh, path2.sep);
-    const exists = existsSync(dest);
+    const exists = existsSync2(dest);
     if (exists && skipExisting && !force) {
       report?.("skip-exists", rel);
       skipped++;
@@ -168,7 +430,7 @@ function copyRootPayload(fromRoot, targetRoot, manifest, opts, report) {
   const relpaths = [];
   for (const dir of rootPayloadDirs(manifest)) {
     const abs = path2.join(fromRoot, dir);
-    if (!existsSync(abs) || !lstatSync(abs).isDirectory()) {
+    if (!existsSync2(abs) || !lstatSync2(abs).isDirectory()) {
       continue;
     }
     walkFiles(fromRoot, abs, relpaths);
@@ -190,7 +452,7 @@ function copyRootPayload(fromRoot, targetRoot, manifest, opts, report) {
     }
     const dest = path2.join(targetRoot, rel);
     assertDestInRoot(dest, targetRoot, path2.sep);
-    const exists = existsSync(dest);
+    const exists = existsSync2(dest);
     if (exists && skipExisting && !force) {
       report?.("skip-exists", rel);
       skipped++;
@@ -232,7 +494,7 @@ function compareVersions(a, b) {
 function readCliVersion(ohDir) {
   const pkgPath = path3.resolve(ohDir, "cli", "package.json");
   try {
-    const parsed = JSON.parse(readFileSync2(pkgPath, "utf8"));
+    const parsed = JSON.parse(readFileSync3(pkgPath, "utf8"));
     if (parsed && typeof parsed.version === "string") {
       return parsed.version;
     }
@@ -241,46 +503,50 @@ function readCliVersion(ohDir) {
   return "0.0.0";
 }
 async function runUpdate(opts, io) {
-  const { targetDir, fromDir, force, dryRun } = opts;
+  const { bin, targetDir, fromDir, force, dryRun } = opts;
   const dryPrefix = dryRun ? "[dry-run] " : "";
-  const fromOh = path3.resolve(fromDir, ".oh");
-  if (!existsSync2(fromOh) || !statSync(fromOh).isDirectory()) {
+  const source = resolveControlDir(fromDir);
+  if (source.kind === "absent") {
     io.stderr(
-      "oh update: update source not found at " + fromOh + ". Pass --from <built-OpenHarness-checkout> or --from-remote [--ref <ref>].\n"
+      bin + " update: update source not found at " + source.agroPath + " or " + source.legacyPath + ". Pass --from <built-AGRO-checkout> or --from-remote [--ref <ref>].\n"
     );
     return 1;
   }
-  const targetOh = path3.resolve(targetDir, ".oh");
+  const fromOh = source.path;
+  const controlName = path3.basename(fromOh);
+  const target = resolveControlDir(targetDir);
+  const targetOh = target.kind === "absent" ? path3.resolve(targetDir, controlName) : target.path;
+  const targetName = path3.basename(targetOh);
   if (fromOh === targetOh) {
-    io.stderr("oh update: source and target are the same .oh; nothing to update.\n");
+    io.stderr(bin + " update: source and target are the same " + targetName + "; nothing to update.\n");
     return 1;
   }
   const available = readCliVersion(fromOh);
   const current = readCliVersion(targetOh);
   const cmp = compareVersions(available, current);
   if (cmp > 0) {
-    io.stdout(dryPrefix + "updating .oh: " + current + " -> " + available + "\n");
+    io.stdout(dryPrefix + "updating " + targetName + ": " + current + " -> " + available + "\n");
   } else if (cmp === 0) {
     if (!force) {
-      io.stdout(dryPrefix + "oh update: already up to date (v" + current + ")\n");
+      io.stdout(dryPrefix + bin + " update: already up to date (v" + current + ")\n");
       return 0;
     }
-    io.stdout(dryPrefix + "oh update: re-overlay (v" + current + ", --force)\n");
+    io.stdout(dryPrefix + bin + " update: re-overlay (v" + current + ", --force)\n");
   } else {
     if (!force) {
       io.stderr(
-        "oh update: refusing downgrade (current v" + current + " > source v" + available + "); pass --force to override\n"
+        bin + " update: refusing downgrade (current v" + current + " > source v" + available + "); pass --force to override\n"
       );
       return 1;
     }
     io.stdout(
-      dryPrefix + "oh update: downgrading .oh: " + current + " -> " + available + " (--force)\n"
+      dryPrefix + bin + " update: downgrading " + targetName + ": " + current + " -> " + available + " (--force)\n"
     );
   }
   const manifest = loadManifest(fromOh);
   if (manifest === null) {
     io.stdout(
-      dryPrefix + "oh update: no .oh/manifest.json in source; overlaying all of .oh/ (legacy mode)\n"
+      dryPrefix + bin + " update: no " + controlName + "/manifest.json in source; overlaying all of " + controlName + "/ (legacy mode)\n"
     );
   }
   let created = 0;
@@ -315,15 +581,15 @@ async function runUpdate(opts, io) {
     report
   );
   for (const dir of rootPayloadDirs(manifest ?? { include: [], exclude: [] })) {
-    const stranded = path3.resolve(targetDir, ".oh", dir);
-    if (existsSync2(stranded)) {
+    const stranded = path3.join(targetOh, dir);
+    if (existsSync3(stranded)) {
       io.stdout(
-        dryPrefix + "oh update: " + path3.join(".oh", dir) + " still exists from a pre-move install and is no longer read; move any local edits into " + dir + "/ and delete it\n"
+        dryPrefix + bin + " update: " + path3.join(targetName, dir) + " still exists from a pre-move install and is no longer read; move any local edits into " + dir + "/ and delete it\n"
       );
     }
   }
   io.stdout(
-    dryPrefix + "oh update: " + created + " created, " + overwritten + " overwritten, " + (skipped + rootResult.skipped) + " skipped\n"
+    dryPrefix + bin + " update: " + created + " created, " + overwritten + " overwritten, " + (skipped + rootResult.skipped) + " skipped\n"
   );
   return 0;
 }
@@ -336,232 +602,12 @@ import {
   readFileSync as readFileSync4,
   realpathSync,
   renameSync,
-  statSync as statSync3,
+  statSync as statSync2,
   unlinkSync,
   writeFileSync
 } from "node:fs";
 import { basename as basename2, delimiter, dirname, extname, join as join2 } from "node:path";
-
-// src/lib/compat.ts
-import {
-  existsSync as existsSync3,
-  lstatSync as lstatSync2,
-  readdirSync as readdirSync2,
-  readFileSync as readFileSync3,
-  readlinkSync,
-  statSync as statSync2
-} from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-var GENERATIONS = {
-  legacy: {
-    controlDir: ".oh",
-    configFile: "oh.json",
-    envPrefix: "OH_",
-    userStateDir: ".oh",
-    seedDir: "/opt/oh-seed"
-  },
-  agro: {
-    controlDir: ".agro",
-    configFile: "agro.json",
-    envPrefix: "AGRO_",
-    userStateDir: ".agro",
-    seedDir: "/opt/agro-seed"
-  }
-};
-var LEGACY_CHECKOUT_DIR = ".openharness";
-var CompatConflictError = class extends Error {
-  legacyPath;
-  agroPath;
-  differences;
-  constructor(legacyPath, agroPath, differences) {
-    super(
-      `${legacyPath} and ${agroPath} both exist and differ \u2014 resolve the conflict before continuing (keep exactly one, or make them identical); differences: ${differences.join("; ")}`
-    );
-    this.name = "CompatConflictError";
-    this.legacyPath = legacyPath;
-    this.agroPath = agroPath;
-    this.differences = differences;
-  }
-};
-function entryType(stats) {
-  if (stats.isSymbolicLink()) return "symlink";
-  if (stats.isDirectory()) return "directory";
-  if (stats.isFile()) return "file";
-  return "other";
-}
-function lstatOrUndefined(path4) {
-  return lstatSync2(path4, { throwIfNoEntry: false });
-}
-function statOrUndefined(path4) {
-  try {
-    return statSync2(path4, { throwIfNoEntry: false });
-  } catch {
-    return void 0;
-  }
-}
-function sameBytes(a, b) {
-  const left = readFileSync3(a);
-  const right = readFileSync3(b);
-  return left.equals(right);
-}
-function octal(mode) {
-  return (mode & 511).toString(8).padStart(3, "0");
-}
-function contentDifference(type, legacy, agro, left, right) {
-  switch (type) {
-    case "symlink":
-      return readlinkSync(legacy) !== readlinkSync(agro) ? "symlink target differs" : void 0;
-    case "file":
-      return left.size !== right.size || !sameBytes(legacy, agro) ? "content differs" : void 0;
-    case "other":
-      return "unsupported entry type";
-    default:
-      return void 0;
-  }
-}
-function entryDifferences(label, legacy, agro, left, right) {
-  const type = entryType(left);
-  if (type !== entryType(right)) return [`${label}: type ${type} vs ${entryType(right)}`];
-  const differences = [];
-  if ((left.mode & 511) !== (right.mode & 511)) {
-    differences.push(`${label}: mode ${octal(left.mode)} vs ${octal(right.mode)}`);
-  }
-  const content = contentDifference(type, legacy, agro, left, right);
-  if (content !== void 0) differences.push(`${label}: ${content}`);
-  return differences;
-}
-function compareTrees(legacy, agro, rel = "") {
-  const label = rel === "" ? "." : rel;
-  const left = lstatOrUndefined(legacy);
-  const right = lstatOrUndefined(agro);
-  if (left === void 0 && right === void 0) return [];
-  if (left === void 0) return [`${label}: only in ${agro}`];
-  if (right === void 0) return [`${label}: only in ${legacy}`];
-  const differences = entryDifferences(label, legacy, agro, left, right);
-  if (!left.isDirectory() || !right.isDirectory()) return differences;
-  const names = /* @__PURE__ */ new Set([...readdirSync2(legacy), ...readdirSync2(agro)]);
-  for (const name of [...names].sort()) {
-    const childRel = rel === "" ? name : `${rel}/${name}`;
-    differences.push(...compareTrees(join(legacy, name), join(agro, name), childRel));
-  }
-  return differences;
-}
-function resolvePair(legacyPath, agroPath, present) {
-  const legacyExists = present(legacyPath);
-  const agroExists = present(agroPath);
-  const base = { legacyPath, agroPath };
-  if (!legacyExists && !agroExists) {
-    return { ...base, kind: "absent", generation: void 0, path: void 0 };
-  }
-  if (legacyExists && !agroExists) {
-    return { ...base, kind: "legacy-only", generation: "legacy", path: legacyPath };
-  }
-  if (!legacyExists && agroExists) {
-    return { ...base, kind: "agro-only", generation: "agro", path: agroPath };
-  }
-  const differences = compareTrees(legacyPath, agroPath);
-  if (differences.length > 0) throw new CompatConflictError(legacyPath, agroPath, differences);
-  return { ...base, kind: "both-equivalent", generation: "agro", path: agroPath };
-}
-function isDirectoryAt(path4) {
-  return statOrUndefined(path4)?.isDirectory() === true;
-}
-function isFileAt(path4) {
-  return statOrUndefined(path4)?.isFile() === true;
-}
-function resolveControlDir(root) {
-  const dir = resolve(root);
-  return resolvePair(
-    join(dir, GENERATIONS.legacy.controlDir),
-    join(dir, GENERATIONS.agro.controlDir),
-    isDirectoryAt
-  );
-}
-function resolveConfigFile(root) {
-  const dir = resolve(root);
-  return resolvePair(
-    join(dir, GENERATIONS.legacy.configFile),
-    join(dir, GENERATIONS.agro.configFile),
-    isFileAt
-  );
-}
-function envValue(env, key) {
-  const value = env[key];
-  return value !== void 0 && value !== "" ? value : void 0;
-}
-function resolveAliasedEnv(env, suffix) {
-  const agroKey = `${GENERATIONS.agro.envPrefix}${suffix}`;
-  const legacyKey = `${GENERATIONS.legacy.envPrefix}${suffix}`;
-  const agro = envValue(env, agroKey);
-  const legacy = envValue(env, legacyKey);
-  const conflict = agro !== void 0 && legacy !== void 0 && agro !== legacy;
-  if (agro !== void 0) {
-    return { key: suffix, agroKey, legacyKey, value: agro, source: "agro", conflict };
-  }
-  if (legacy !== void 0) {
-    return { key: suffix, agroKey, legacyKey, value: legacy, source: "legacy", conflict: false };
-  }
-  return { key: suffix, agroKey, legacyKey, value: void 0, source: "none", conflict: false };
-}
-function aliasConflictWarning(resolved) {
-  if (!resolved.conflict) return void 0;
-  return `compat: ${resolved.agroKey} and ${resolved.legacyKey} are both set and differ \u2014 using ${resolved.agroKey}`;
-}
-function aliasedEnvValue(env, suffix, warn = (message) => process.stderr.write(`${message}
-`)) {
-  const resolved = resolveAliasedEnv(env, suffix);
-  const warning = aliasConflictWarning(resolved);
-  if (warning !== void 0) warn(warning);
-  return resolved.value;
-}
-var REGISTRY_SUBDIR = "sandboxes";
-function discoverUserState(home = homedir()) {
-  const probe = (name) => {
-    const path4 = join(home, name);
-    return { path: path4, exists: isDirectoryAt(path4) };
-  };
-  return {
-    agroHome: probe(GENERATIONS.agro.userStateDir),
-    legacyHome: probe(GENERATIONS.legacy.userStateDir),
-    legacyCheckout: probe(LEGACY_CHECKOUT_DIR)
-  };
-}
-function resolveUserStateHome(env = process.env, home = homedir(), warn) {
-  const configured = aliasedEnvValue(env, "HOME", warn);
-  if (configured !== void 0) return resolve(configured);
-  const discovered = discoverUserState(home);
-  const legacyRegistry = join(discovered.legacyHome.path, REGISTRY_SUBDIR);
-  const agroRegistry = join(discovered.agroHome.path, REGISTRY_SUBDIR);
-  const resolution = resolvePair(legacyRegistry, agroRegistry, isDirectoryAt);
-  return resolution.generation === "agro" ? discovered.agroHome.path : discovered.legacyHome.path;
-}
-
-// src/lib/product.ts
-import { basename } from "node:path";
-var AGRO_PRODUCT = {
-  name: "agro",
-  bin: "agro",
-  title: "AGRO CLI",
-  packageName: "@mifune/agro"
-};
-var LEGACY_PRODUCT = {
-  name: "oh",
-  bin: "oh",
-  title: "Open Harness CLI",
-  packageName: "@mifune/openharness"
-};
-var FILE_EXTENSION = /\.[^.]*$/;
-function invokedName(argv1) {
-  if (argv1 === void 0) return "";
-  return basename(argv1.replace(/\\/g, "/")).replace(FILE_EXTENSION, "");
-}
-function resolveProduct(argv1) {
-  return invokedName(argv1) === LEGACY_PRODUCT.bin ? LEGACY_PRODUCT : AGRO_PRODUCT;
-}
-
-// src/commands/self-upgrade.ts
-var DEFAULT_ARTIFACT_URL = "https://github.com/mifunedev/openharness/releases/latest/download/agro.js";
+var DEFAULT_ARTIFACT_URL = "https://github.com/mifunedev/agro/releases/latest/download/agro.js";
 var PREFIX = `${AGRO_PRODUCT.bin} update`;
 var PACKAGE = AGRO_PRODUCT.packageName;
 var IMAGE_ROOT = "/opt/oh/";
@@ -609,9 +655,9 @@ function kindOfTarget(target, deps) {
 function classifyInstallation(argv1, deps) {
   const invoked = argv1 ?? "";
   if (invoked === "") return { kind: "unknown", target: "", invoked, reason: "no executable path (argv[1] is empty)" };
-  const resolved = resolveTarget(invoked, deps);
-  if (resolved.reason !== void 0) return { kind: "unknown", target: resolved.target, invoked, reason: resolved.reason };
-  return { ...kindOfTarget(resolved.target, deps), target: resolved.target, invoked };
+  const resolved2 = resolveTarget(invoked, deps);
+  if (resolved2.reason !== void 0) return { kind: "unknown", target: resolved2.target, invoked, reason: resolved2.reason };
+  return { ...kindOfTarget(resolved2.target, deps), target: resolved2.target, invoked };
 }
 function parseSemver(input) {
   const m = SEMVER.exec(input.trim());
@@ -658,16 +704,16 @@ function compareSemver(a, b) {
 function versionOf(result) {
   return result.status === 0 ? result.stdout.trim() : "";
 }
-function refuseUnsupported(installation) {
+function refuseUnsupported(installation, bin) {
   const { kind, target, reason } = installation;
   const at = `${kind} installation at ${target}`;
   switch (kind) {
     case "image":
       return new Error(
-        `${at} \u2014 the sandbox image ships this CLI; pull a newer image on the host (oh/agro stop, then agro sandbox install docker --name <name>)`
+        `${at} \u2014 the sandbox image ships this CLI; pull a newer image on the host (${bin} stop, then ${bin} sandbox install docker --name <name>)`
       );
     case "source":
-      return new Error(`${at} \u2014 rebuild from the checkout: npm --prefix .oh/cli run build`);
+      return new Error(`${at} \u2014 rebuild from the checkout: npm --prefix .agro/cli run build`);
     case "legacy-package":
       return new Error(`${at} \u2014 install the canonical package: npm install -g ${PACKAGE}`);
     default:
@@ -679,13 +725,13 @@ function refuseUnsupported(installation) {
 function assertOnlyAgroOnPath(installation, deps) {
   const found = deps.which(AGRO_PRODUCT.bin);
   if (found === void 0) return;
-  let resolved;
+  let resolved2;
   try {
-    resolved = deps.realpath(found);
+    resolved2 = deps.realpath(found);
   } catch {
-    resolved = found;
+    resolved2 = found;
   }
-  if (resolved !== installation.target) {
+  if (resolved2 !== installation.target) {
     throw new Error(
       `another ${AGRO_PRODUCT.bin} is earlier on PATH (${found}); upgrading ${installation.target} would not change what runs \u2014 remove or reorder it first`
     );
@@ -847,7 +893,7 @@ async function runSelfUpgrade(opts, deps, io) {
   try {
     const installation = classifyInstallation(opts.argv1, deps);
     if (installation.kind !== "npm" && installation.kind !== "standalone") {
-      throw refuseUnsupported(installation);
+      throw refuseUnsupported(installation, resolveProduct(opts.argv1).bin);
     }
     io.stdout(`${PREFIX}: ${installation.kind} installation at ${installation.target}
 `);
@@ -863,14 +909,14 @@ async function runSelfUpgrade(opts, deps, io) {
 }
 function whichOnPath(name, env, platform) {
   const win32 = platform === "win32";
-  const sep4 = win32 ? ";" : delimiter;
-  const dirs = (env.PATH ?? "").split(sep4).filter((d) => d !== "");
+  const sep5 = win32 ? ";" : delimiter;
+  const dirs = (env.PATH ?? "").split(sep5).filter((d) => d !== "");
   const exts = win32 ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";")] : [""];
   for (const dir of dirs) {
     for (const ext of exts) {
       const candidate = join2(dir, `${name}${ext}`);
       try {
-        if (statSync3(candidate).isFile()) {
+        if (statSync2(candidate).isFile()) {
           if (!win32) accessSync(candidate, constants.X_OK);
           return candidate;
         }
@@ -897,7 +943,7 @@ function defaultDeps(currentVersion) {
   return {
     env: process.env,
     realpath: (path4) => realpathSync(path4),
-    stat: (path4) => statSync3(path4),
+    stat: (path4) => statSync2(path4),
     access: (path4, mode) => accessSync(path4, mode),
     readFile: (path4) => readFileSync4(path4),
     writeFile: (path4, data, mode) => writeFileSync(path4, data, { mode }),
@@ -912,212 +958,614 @@ function defaultDeps(currentVersion) {
   };
 }
 
-// src/commands/cloud.ts
-import { readFile } from "node:fs/promises";
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "node:fs";
-import { join as join3 } from "node:path";
-
-// src/lib/prompt.ts
-import { createInterface } from "node:readline";
-var COLORS = {
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m",
-  green: "\x1B[32m",
-  yellow: "\x1B[33m",
-  red: "\x1B[31m",
-  cyan: "\x1B[36m"
-};
-function header(msg) {
-  process.stdout.write(`
-${COLORS.bold}${msg}${COLORS.reset}
+// src/commands/migrate.ts
+import { lstatSync as lstatSync4 } from "node:fs";
+import { dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
 
+// src/lib/migrate.ts
+import {
+  closeSync,
+  existsSync as existsSync4,
+  fsyncSync,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync2,
+  openSync,
+  readFileSync as readFileSync5,
+  readlinkSync as readlinkSync2,
+  realpathSync as realpathSync2,
+  renameSync as renameSync2,
+  symlinkSync,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { dirname as dirname2, isAbsolute, relative, resolve as resolve2, sep } from "node:path";
+var MIGRATION_PLAN_VERSION = 1;
+var RETIRED_SUFFIX = ".migrated";
+var LOCK_FILE = ".agro-migrate.lock";
+function snapshot(path4) {
+  const stats = lstatSync3(path4, { throwIfNoEntry: false });
+  if (stats === void 0) return void 0;
+  return {
+    type: stats.isSymbolicLink() ? "symlink" : stats.isDirectory() ? "directory" : "file",
+    mode: stats.mode & 511,
+    ino: stats.ino,
+    mtimeMs: stats.mtimeMs,
+    size: stats.size
+  };
+}
+function presentAs(path4, kind) {
+  let stats;
+  try {
+    stats = lstatSync3(path4, { throwIfNoEntry: false });
+  } catch {
+    return false;
+  }
+  if (stats === void 0) return false;
+  if (stats.isSymbolicLink()) return true;
+  return kind === "dir" ? stats.isDirectory() : stats.isFile();
+}
+function nearestExistingAncestor(path4) {
+  let cursor = path4;
+  while (!existsSync4(cursor)) {
+    const parent = dirname2(cursor);
+    if (parent === cursor) return cursor;
+    cursor = parent;
+  }
+  return cursor;
+}
+function insideRoot(root, candidate) {
+  const realRoot = realpathSync2(root);
+  const anchor = nearestExistingAncestor(dirname2(candidate));
+  const realAnchor = realpathSync2(anchor);
+  const rel = relative(realRoot, realAnchor);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function assertInsideRoot(root, path4, label) {
+  if (!isAbsolute(path4)) throw new Error(`migration ${label} must be absolute: ${path4}`);
+  const absolute = resolve2(path4);
+  if (!insideRoot(root, absolute)) {
+    throw new Error(`refusing migration ${label} outside ${root}: ${absolute}`);
+  }
+  return absolute;
+}
+function sameSnapshot(a, b) {
+  return b !== void 0 && a.type === b.type && a.mode === b.mode && a.ino === b.ino && a.mtimeMs === b.mtimeMs && a.size === b.size;
+}
+function planPair(root, pair) {
+  const legacy = assertInsideRoot(root, pair.legacy, "source");
+  const agro = assertInsideRoot(root, pair.agro, "destination");
+  const legacyPresent = presentAs(legacy, pair.kind);
+  const agroPresent = presentAs(agro, pair.kind);
+  if (!legacyPresent) {
+    return { kind: "noop", path: agro, reason: agroPresent ? "already migrated" : "absent in both generations" };
+  }
+  if (!agroPresent) {
+    if (lstatSync3(agro, { throwIfNoEntry: false }) !== void 0) {
+      return { path: agro, reason: `destination exists but is not a ${pair.kind}` };
+    }
+    return {
+      kind: "rename",
+      from: legacy,
+      to: agro,
+      snapshot: snapshot(legacy),
+      createsParent: !existsSync4(dirname2(agro))
+    };
+  }
+  const differences = compareTrees(legacy, agro);
+  if (differences.length > 0) {
+    return { path: agro, reason: "both generations exist and differ", differences };
+  }
+  const retired = `${legacy}${RETIRED_SUFFIX}`;
+  if (lstatSync3(retired, { throwIfNoEntry: false }) !== void 0) {
+    return { path: retired, reason: "retired copy already exists" };
+  }
+  return { kind: "retire", from: legacy, to: retired, snapshot: snapshot(legacy) };
+}
+function planRewrite(root, rewrite) {
+  const path4 = assertInsideRoot(root, rewrite.path, "rewrite target");
+  const current = snapshot(path4);
+  if (current === void 0 || current.type !== "file") {
+    return { kind: "noop", path: path4, reason: "rewrite target is not a regular file" };
+  }
+  const content = readFileSync5(path4, "utf8");
+  const changed = rewrite.replacements.some((r) => r.from !== "" && content.includes(r.from));
+  if (!changed) return { kind: "noop", path: path4, reason: "rewrite already applied" };
+  return { kind: "rewrite", path: path4, replacements: rewrite.replacements, snapshot: current };
+}
+function planRelink(root, relink) {
+  const path4 = assertInsideRoot(root, relink.path, "relink target");
+  const current = snapshot(path4);
+  if (current === void 0) return { kind: "noop", path: path4, reason: "link absent" };
+  if (current.type !== "symlink") return { kind: "noop", path: path4, reason: "not a symlink" };
+  const target = readlinkSync2(path4);
+  if (target === relink.to) return { kind: "noop", path: path4, reason: "link already points at the AGRO target" };
+  if (target !== relink.from) return { kind: "noop", path: path4, reason: `link points at ${target}, not ${relink.from}` };
+  return { kind: "relink", path: path4, from: relink.from, to: relink.to, snapshot: current };
+}
+function resolved(path4) {
+  try {
+    return realpathSync2(path4);
+  } catch {
+    return void 0;
+  }
+}
+function resolvesToPack(path4, packs) {
+  const target = resolved(path4);
+  if (target === void 0) return false;
+  return packs.some((pack) => resolved(pack) === target);
+}
+function replacementSurvives(retire) {
+  const current = snapshot(retire.replacement);
+  if (current === void 0 || current.type !== "symlink") return false;
+  if (!retire.replacementTargets.includes(readlinkSync2(retire.replacement))) return false;
+  return resolvesToPack(retire.replacement, retire.packs);
+}
+function preserveRetiredLink(root, retire, reason) {
+  const step = planRelink(root, { path: retire.path, ...retire.preserve });
+  return step.kind === "relink" ? step : { kind: "noop", path: resolve2(retire.path), reason };
+}
+function planRetireLink(root, retire) {
+  const path4 = assertInsideRoot(root, retire.path, "retired link");
+  const current = snapshot(path4);
+  if (current === void 0) return { kind: "noop", path: path4, reason: "link absent" };
+  if (current.type !== "symlink") return { kind: "noop", path: path4, reason: "not a symlink" };
+  if (!resolvesToPack(path4, retire.packs)) {
+    return preserveRetiredLink(root, retire, "link does not resolve to the Open Harness skill pack");
+  }
+  if (!replacementSurvives(retire)) {
+    return preserveRetiredLink(
+      root,
+      retire,
+      `${retire.replacement} is not an independent skill-pack link that survives the migration`
+    );
+  }
+  const retired = `${path4}${RETIRED_SUFFIX}`;
+  if (lstatSync3(retired, { throwIfNoEntry: false }) !== void 0) {
+    return { path: retired, reason: "retired copy already exists" };
+  }
+  return { kind: "retire", from: path4, to: retired, snapshot: current };
+}
+function isStep(entry) {
+  return "kind" in entry;
+}
+function planMigration(spec) {
+  const root = resolve2(spec.root);
+  if (!existsSync4(root)) throw new Error(`migration root does not exist: ${root}`);
+  const steps = [];
+  const conflicts = [];
+  for (const pair of spec.pairs) {
+    const planned = planPair(root, pair);
+    if (isStep(planned)) steps.push(planned);
+    else conflicts.push(planned);
+  }
+  for (const retired of spec.retireLinks ?? []) {
+    const planned = planRetireLink(root, retired);
+    if (isStep(planned)) steps.push(planned);
+    else conflicts.push(planned);
+  }
+  for (const rewrite of spec.rewrites ?? []) steps.push(planRewrite(root, rewrite));
+  for (const relink of spec.relinks ?? []) steps.push(planRelink(root, relink));
+  const mutating = steps.some((step) => step.kind !== "noop");
+  const status = conflicts.length > 0 ? "conflict" : mutating ? "ready" : "noop";
+  return { version: MIGRATION_PLAN_VERSION, root, status, steps, conflicts };
+}
+function acquireLock(root) {
+  const lock = resolve2(root, LOCK_FILE);
+  let fd;
+  try {
+    fd = openSync(lock, "wx", 384);
+  } catch (error) {
+    const code = error.code;
+    if (code === "EEXIST") return void 0;
+    throw error;
+  }
+  writeFileSync2(fd, `${process.pid}
 `);
+  closeSync(fd);
+  return () => {
+    try {
+      unlinkSync2(lock);
+    } catch {
+    }
+  };
 }
-function bold(s) {
-  return `${COLORS.bold}${s}${COLORS.reset}`;
+function revalidateInPlace(step) {
+  if (!sameSnapshot(step.snapshot, snapshot(step.path))) return `${step.path} changed since the plan was made`;
+  if (step.kind === "relink" && readlinkSync2(step.path) !== step.from) {
+    return `${step.path} changed since the plan was made`;
+  }
+  return void 0;
 }
-function redact(token) {
-  if (token.length <= 8) return "****";
-  return token.slice(0, 5) + "*".repeat(token.length - 5);
+function revalidate(step) {
+  if (step.kind === "noop") return void 0;
+  if (step.kind === "rewrite" || step.kind === "relink") return revalidateInPlace(step);
+  if (!sameSnapshot(step.snapshot, snapshot(step.from))) {
+    return `${step.from} changed since the plan was made`;
+  }
+  if (lstatSync3(step.to, { throwIfNoEntry: false }) !== void 0) {
+    return `${step.to} appeared since the plan was made`;
+  }
+  return void 0;
 }
-async function ask(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+function applyRewrite(step) {
+  let content = readFileSync5(step.path, "utf8");
+  for (const { from, to } of step.replacements) {
+    if (from === "") continue;
+    content = content.split(from).join(to);
+  }
+  const tmp = `${step.path}.tmp.${process.pid}`;
+  const fd = openSync(tmp, "w", step.snapshot.mode);
   try {
-    return await new Promise((resolve9) => {
-      rl.question(`  ${question} `, (answer) => resolve9(answer.trim()));
-    });
+    writeFileSync2(fd, content, "utf8");
+    fsyncSync(fd);
   } finally {
-    rl.close();
+    closeSync(fd);
   }
+  renameSync2(tmp, step.path);
 }
-async function askSecret(question) {
-  if (!process.stdin.isTTY) return askSecretPiped(question);
-  process.stdout.write(`  ${question} `);
-  process.stdin.setRawMode(true);
-  process.stdin.resume();
-  const bytes = [];
-  return await new Promise((resolve9) => {
-    const cleanup = () => {
-      try {
-        process.stdin.setRawMode(false);
-      } catch {
-      }
-      process.stdin.pause();
-      process.stdin.removeListener("data", onData);
-    };
-    const onData = (data) => {
-      for (const byte of data) {
-        if (byte === 3) {
-          cleanup();
-          process.stdout.write("\n");
-          process.exit(130);
-        } else if (byte === 13 || byte === 10) {
-          cleanup();
-          process.stdout.write("\n");
-          resolve9(Buffer.from(bytes).toString("utf8").trim());
-          return;
-        } else if (byte === 127 || byte === 8) {
-          if (bytes.length > 0) {
-            bytes.pop();
-            process.stdout.write("\b \b");
-          }
-        } else if (byte === 21) {
-          while (bytes.length > 0) {
-            bytes.pop();
-            process.stdout.write("\b \b");
-          }
-        } else if (byte >= 32) {
-          bytes.push(byte);
-          process.stdout.write("\u25CF");
-        }
-      }
-    };
-    process.stdin.on("data", onData);
-  });
+function applyRelink(step) {
+  const tmp = `${step.path}.tmp.${process.pid}`;
+  symlinkSync(step.to, tmp);
+  try {
+    renameSync2(tmp, step.path);
+  } catch (error) {
+    unlinkSync2(tmp);
+    throw error;
+  }
 }
-async function askSecretPiped(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  const stdoutWrite = process.stdout.write.bind(process.stdout);
-  let prompted = false;
-  const patched = (chunk) => {
-    if (!prompted) {
-      prompted = true;
-      return stdoutWrite(chunk);
+function pendingResults(plan) {
+  return plan.steps.map((step) => ({ ...step, outcome: step.kind === "noop" ? "skipped" : "pending" }));
+}
+function refusal(plan) {
+  if (plan.version !== MIGRATION_PLAN_VERSION) return `unsupported plan version ${plan.version}`;
+  if (plan.status === "conflict") {
+    return plan.conflicts.map((c) => `${c.path}: ${c.reason}`).join("; ");
+  }
+  return void 0;
+}
+function revalidatePlan(root, plan) {
+  for (const step of plan.steps) {
+    const stale = revalidate(step);
+    if (stale !== void 0) return stale;
+    if (step.kind === "rename" || step.kind === "retire") {
+      assertInsideRoot(root, step.from, "source");
+      assertInsideRoot(root, step.to, "destination");
     }
-    return true;
-  };
-  process.stdout.write = patched;
-  let restored = false;
-  const restore = () => {
-    if (restored) return;
-    restored = true;
-    process.stdout.write = stdoutWrite;
+  }
+  return void 0;
+}
+function applyStep(step) {
+  if (step.kind === "noop") return;
+  if (step.kind === "rewrite") {
+    applyRewrite(step);
+    return;
+  }
+  if (step.kind === "relink") {
+    applyRelink(step);
+    return;
+  }
+  if (step.kind === "rename" && step.createsParent) mkdirSync2(dirname2(step.to), { recursive: true });
+  renameSync2(step.from, step.to);
+}
+function applySteps(root, plan) {
+  const results = pendingResults(plan);
+  for (let i = 0; i < plan.steps.length; i += 1) {
+    const step = plan.steps[i];
+    if (step.kind === "noop") continue;
     try {
-      rl.close();
-    } catch {
+      applyStep(step);
+      results[i] = { ...step, outcome: "done" };
+    } catch (error) {
+      results[i] = { ...step, outcome: "failed", error: error instanceof Error ? error.message : String(error) };
+      return {
+        status: "failed",
+        root,
+        reason: `step ${i + 1} failed; completed steps are recoverable by reversing them in order`,
+        steps: results
+      };
     }
-  };
-  const onSigint = () => {
-    restore();
-    process.stdout.write("\n");
-    process.exit(130);
-  };
-  process.on("SIGINT", onSigint);
+  }
+  return { status: "applied", root, steps: results };
+}
+function applyMigration(plan) {
+  const root = resolve2(plan.root);
+  const refused = refusal(plan);
+  if (refused !== void 0) return { status: "refused", root, reason: refused, steps: pendingResults(plan) };
+  if (plan.status === "noop") return { status: "noop", root, steps: pendingResults(plan) };
+  const release = acquireLock(root);
+  if (release === void 0) {
+    return {
+      status: "refused",
+      root,
+      reason: `another migration holds ${resolve2(root, LOCK_FILE)}`,
+      steps: pendingResults(plan)
+    };
+  }
   try {
-    return await new Promise((resolve9) => {
-      rl.question(`  ${question} `, (answer) => {
-        process.stdout.write("\n");
-        resolve9(answer.trim());
-      });
-    });
+    const stale = revalidatePlan(root, plan);
+    if (stale !== void 0) return { status: "refused", root, reason: stale, steps: pendingResults(plan) };
+    return applySteps(root, plan);
   } finally {
-    process.removeListener("SIGINT", onSigint);
-    restore();
+    release();
   }
 }
-async function confirm(question, defaultYes = true) {
-  const suffix = defaultYes ? "[Y/n]" : "[y/N]";
-  const answer = (await ask(`${question} ${suffix}`)).toLowerCase();
-  if (answer === "") return defaultYes;
-  return /^y/.test(answer);
+var PROVIDER_LINKS = [
+  { link: ".claude/skills", target: "skills" },
+  { link: ".claude/hooks", target: "hooks" },
+  { link: ".agents/skills", target: "skills" }
+];
+var CANONICAL_SKILL_PACKS = [".oh/skills", ".agro/skills"];
+var SURVIVING_SKILL_LINK_TARGETS = ["../.oh/skills", "../.agro/skills"];
+var RETIRED_PROVIDER_LINKS = [
+  {
+    link: ".pi/skills",
+    replacement: ".agents/skills",
+    preserve: { from: "../.oh/skills", to: "../.agro/skills" }
+  },
+  {
+    link: ".codex/skills",
+    replacement: ".agents/skills",
+    preserve: { from: "../.oh/skills", to: "../.agro/skills" }
+  }
+];
+function providerRelinks(root) {
+  const dir = resolve2(root);
+  return PROVIDER_LINKS.map(({ link, target }) => ({
+    path: resolve2(dir, ...link.split("/")),
+    from: `../.oh/${target}`,
+    to: `../.agro/${target}`
+  }));
+}
+function retiredProviderLinks(root) {
+  const dir = resolve2(root);
+  const packs = CANONICAL_SKILL_PACKS.map((pack) => resolve2(dir, ...pack.split("/")));
+  return RETIRED_PROVIDER_LINKS.map(({ link, replacement, preserve }) => ({
+    path: resolve2(dir, ...link.split("/")),
+    packs,
+    replacement: resolve2(dir, ...replacement.split("/")),
+    replacementTargets: [...SURVIVING_SKILL_LINK_TARGETS],
+    preserve
+  }));
+}
+function projectMigrationSpec(root) {
+  const dir = resolve2(root);
+  return {
+    root: dir,
+    pairs: [
+      { legacy: `${dir}${sep}.oh`, agro: `${dir}${sep}.agro`, kind: "dir" },
+      { legacy: `${dir}${sep}oh.json`, agro: `${dir}${sep}agro.json`, kind: "file" }
+    ],
+    retireLinks: retiredProviderLinks(dir),
+    relinks: providerRelinks(dir)
+  };
+}
+function userStateMigrationSpec(home) {
+  const dir = resolve2(home);
+  return {
+    root: dir,
+    pairs: [
+      {
+        legacy: `${dir}${sep}.oh${sep}sandboxes`,
+        agro: `${dir}${sep}.agro${sep}sandboxes`,
+        kind: "dir"
+      }
+    ]
+  };
 }
 
-// src/lib/oh-config.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync5, renameSync as renameSync2, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { basename as basename3, dirname as dirname2, resolve as resolve3 } from "node:path";
-
-// src/lib/env-file.ts
-import { existsSync as existsSync4 } from "node:fs";
-import { resolve as resolve2, sep } from "node:path";
-function assertInRoot(dest, root) {
-  if (!(dest === root || dest.startsWith(root + sep))) {
-    throw new Error(`refusing to write outside the project root: ${dest}`);
-  }
+// src/commands/migrate.ts
+var ROOT_MARKERS = [".oh", ".agro", "oh.json", "agro.json"];
+var HELP_FLAGS = ["-h", "--help", "help"];
+function defaultMigrateDeps() {
+  const registry = resolveRegistryHome();
+  return {
+    cwd: () => process.cwd(),
+    home: () => registry.path,
+    homeConfigured: () => registry.configured
+  };
 }
-function stripQuotes(s) {
-  if (s.length >= 2 && (s[0] === '"' && s.endsWith('"') || s[0] === "'" && s.endsWith("'"))) {
-    return s.slice(1, -1);
+function parseMigrateArgs(argv, bin) {
+  const args = { bin, help: false, check: false, home: false, json: false };
+  for (const arg of argv) {
+    if (HELP_FLAGS.includes(arg)) return { ok: true, args: { ...args, help: true } };
+    if (arg === "--check") args.check = true;
+    else if (arg === "--home") args.home = true;
+    else if (arg === "--json") args.json = true;
+    else return { ok: false, error: `${bin} migrate: unexpected argument "${arg}"`, showHelp: true };
   }
-  return s;
+  return { ok: true, args };
 }
-var CONFIG_FIELD_BY_ENV_KEY = {
-  DOCKER_SOCKET: "access.dockerSocket"
-};
-function setEnvValue(root, key, value) {
-  const path4 = CONFIG_FIELD_BY_ENV_KEY[key];
-  if (path4 === void 0) {
-    throw new Error(
-      `${key} is not a settable oh.json field \u2014 run \`oh config set\` for a non-secret, \`oh secret set\` for a credential`
-    );
-  }
-  return setConfigField(root, path4, value);
+function migrateHelpText(bin) {
+  return `${bin} migrate \u2014 Move a legacy .oh/ project or ~/.oh registry to AGRO names
+
+Usage:
+  ${bin} migrate [--check] [--home] [--json]
+
+Project mode (default) finds the nearest ancestor of the current directory that
+holds .oh/, .agro/, oh.json or agro.json and renames .oh/ -> .agro/ and
+oh.json -> agro.json wholesale. Provider links (.claude/skills, .claude/hooks,
+.agents/skills) that point at ../.oh/... are re-pointed at ../.agro/....
+Retired links (.pi/skills, .codex/skills) move to <path>.migrated only when each
+resolves to the Open Harness skill pack and .agents/skills independently links
+to that pack. Otherwise each retired link stays in place, re-pointed at
+../.agro/skills when it named the legacy pack. Other links stay unchanged.
+
+Flags:
+  --check   Print the plan and change nothing.
+  --home    Migrate the sandbox registry ~/.oh/sandboxes -> ~/.agro/sandboxes instead.
+  --json    Emit the plan (--check) or {plan, result} as JSON on stdout.
+
+Byte-identical legacy and AGRO copies retire the legacy one to <name>.migrated;
+divergent copies are refused and nothing is merged or deleted. ~/.openharness,
+.env and .git are never touched.
+
+Exit codes: 0 applied or nothing to do, 2 refused (conflict or lock), 1 failure.
+`;
 }
-function setConfigField(root, path4, value) {
-  const file = ohConfigPath(root);
-  assertInRoot(file, resolve2(root));
-  const config = readOhConfig(file);
-  const before = getOhConfigValue(config, path4);
-  const next = setOhConfigValue(config, path4, value);
-  const after = getOhConfigValue(next, path4);
-  if (existsSync4(file) && JSON.stringify(before) === JSON.stringify(after)) {
-    return "already-set";
-  }
-  writeOhConfig(root, next);
-  return before === void 0 ? "added" : "updated";
+function printMigrateHelp(bin) {
+  process.stdout.write(migrateHelpText(bin));
+}
+function hasMarker(dir) {
+  return ROOT_MARKERS.some((marker) => lstatSync4(join3(dir, marker), { throwIfNoEntry: false }) !== void 0);
+}
+function findProjectRoot(cwd) {
+  const start = resolve3(cwd);
+  let cursor = start;
+  while (true) {
+    if (hasMarker(cursor)) return cursor;
+    const parent = dirname3(cursor);
+    if (parent === cursor) return start;
+    cursor = parent;
+  }
+}
+function specFor(args, deps) {
+  return args.home ? userStateMigrationSpec(deps.home()) : projectMigrationSpec(findProjectRoot(deps.cwd()));
+}
+function describeStep(step) {
+  switch (step.kind) {
+    case "rename":
+      return `rename  ${step.from} -> ${step.to}`;
+    case "retire":
+      return `retire  ${step.from} -> ${step.to}`;
+    case "rewrite":
+      return `rewrite ${step.path} (${step.replacements.length} replacement${step.replacements.length === 1 ? "" : "s"})`;
+    case "relink":
+      return `relink  ${step.path}: ${step.from} -> ${step.to}`;
+    case "noop":
+      return `noop    ${step.path} (${step.reason})`;
+  }
+}
+function describeConflict(conflict) {
+  const lines = [`  ${conflict.path}: ${conflict.reason}`];
+  for (const difference of conflict.differences ?? []) lines.push(`    - ${difference}`);
+  return lines;
+}
+function planSummary(bin, plan) {
+  const lines = [`${bin} migrate: plan for ${plan.root}`];
+  for (const step of plan.steps) lines.push(`  ${describeStep(step)}`);
+  if (plan.conflicts.length > 0) {
+    lines.push("conflicts:");
+    for (const conflict of plan.conflicts) lines.push(...describeConflict(conflict));
+  }
+  lines.push(`status: ${plan.status}`);
+  return `${lines.join("\n")}
+`;
 }
-function setKeyInEnv(content, key, value) {
-  const lines = content.split("\n");
-  const live = new RegExp(`^${escapeRegExp(key)}=(.*)$`);
-  const commented = new RegExp(`^[ \\t]*#[ \\t]*${escapeRegExp(key)}=(.*)$`);
-  for (let i = 0; i < lines.length; i++) {
-    const m = live.exec(lines[i]);
-    if (m) {
-      if (stripQuotes(m[1].trim()) === value) return { content, outcome: "already-set" };
-      lines[i] = `${key}=${value}`;
-      return { content: lines.join("\n"), outcome: "updated" };
-    }
+function describeOutcome(step) {
+  const suffix = step.error === void 0 ? "" : ` \u2014 ${step.error}`;
+  return `  ${step.outcome.padEnd(7)} ${describeStep(step)}${suffix}`;
+}
+function resultSummary(bin, result) {
+  const lines = [`${bin} migrate: ${result.status}${result.reason === void 0 ? "" : ` \u2014 ${result.reason}`}`];
+  for (const step of result.steps) lines.push(describeOutcome(step));
+  return `${lines.join("\n")}
+`;
+}
+function planExitCode(plan) {
+  return plan.status === "conflict" ? 2 : 0;
+}
+function resultExitCode(result) {
+  if (result.status === "applied" || result.status === "noop") return 0;
+  return result.status === "refused" ? 2 : 1;
+}
+function emitJson(io, value) {
+  io.stdout(`${JSON.stringify(value, null, 2)}
+`);
+}
+function check(args, plan, io) {
+  if (args.json) emitJson(io, plan);
+  else io.stdout(planSummary(args.bin, plan));
+  return planExitCode(plan);
+}
+function apply(args, plan, io) {
+  const result = applyMigration(plan);
+  if (args.json) {
+    emitJson(io, { plan, result });
+  } else {
+    io.stdout(planSummary(args.bin, plan));
+    io.stdout(resultSummary(args.bin, result));
   }
-  for (let i = 0; i < lines.length; i++) {
-    if (commented.test(lines[i])) {
-      lines[i] = `${key}=${value}`;
-      return { content: lines.join("\n"), outcome: "uncommented" };
+  return resultExitCode(result);
+}
+function runMigrate(args, io, deps = defaultMigrateDeps()) {
+  try {
+    if (args.home && deps.homeConfigured?.() === true) {
+      io.stdout(
+        `${args.bin} migrate: the registry home is set explicitly to ${deps.home()}, so it holds no .oh or .agro directory to rename
+`
+      );
+      io.stdout(`${args.bin} migrate: noop
+`);
+      return 0;
     }
+    const plan = planMigration(specFor(args, deps));
+    return args.check ? check(args, plan, io) : apply(args, plan, io);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    io.stderr(`${args.bin} migrate: ${message}
+`);
+    return 1;
   }
-  const body = content.replace(/\n+$/, "");
+}
+
+// src/lib/execution/runner.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync5 } from "node:fs";
+import { basename as basename3, join as join4 } from "node:path";
+var spawnRunner = (cmd, args, opts) => {
+  const common = {
+    env: opts.env,
+    ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {},
+    ...opts.timeoutMs !== void 0 ? { timeout: opts.timeoutMs } : {}
+  };
+  const r = opts.stdio === "capture" ? spawnSync2(cmd, args, { ...common, stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }) : spawnSync2(cmd, args, { ...common, stdio: "inherit" });
+  const err = r.error;
   return {
-    content: body === "" ? `${key}=${value}
-` : `${body}
-${key}=${value}
-`,
-    outcome: "added"
+    status: r.status,
+    error: err ? { code: err.code, message: err.message } : void 0,
+    stdout: typeof r.stdout === "string" ? r.stdout : void 0,
+    stderr: typeof r.stderr === "string" ? r.stderr : void 0
   };
+};
+var ExecutionSpawnError = class extends Error {
+  code;
+  constructor(what, error) {
+    super(`failed to run ${what}${error?.message ? ` (${error.message})` : ""}`);
+    this.name = "ExecutionSpawnError";
+    this.code = error?.code;
+  }
+};
+var ExecutionExitError = class extends Error {
+  exitCode;
+  constructor(what, exitCode) {
+    super(`${what} exited ${exitCode}`);
+    this.name = "ExecutionExitError";
+    this.exitCode = exitCode;
+  }
+};
+function assertSpawned(r, what) {
+  if (r.error) {
+    throw new ExecutionSpawnError(what, r.error);
+  }
 }
-function escapeRegExp(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function requireLifecycleScript(root, rel) {
+  const { controlDir } = resolveProjectLayout(root);
+  const script = join4(controlDir, "scripts", rel);
+  if (!existsSync5(script)) {
+    throw new Error(
+      `missing lifecycle script ${script} \u2014 the vendored ${basename3(controlDir)}/ payload looks incomplete; run \`${activeBin()} update\` to re-vendor it`
+    );
+  }
+  return script;
 }
 
+// src/lib/env-file.ts
+import { existsSync as existsSync7 } from "node:fs";
+import { resolve as resolve5, sep as sep2 } from "node:path";
+
 // src/lib/oh-config.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync as renameSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { basename as basename4, dirname as dirname4, resolve as resolve4 } from "node:path";
 var OH_CONFIG_FILE = GENERATIONS.legacy.configFile;
 var OH_CONFIG_MODE = 420;
 var RESERVED_HOME_PATHS = [
@@ -1146,9 +1594,12 @@ var LANGFUSE_PRIVACY_PRESETS = [
   "full-debug"
 ];
 var SANDBOX_RUNTIMES = ["docker"];
+function configCheckout(config) {
+  const value = config.checkout ?? config.repo;
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
 function ohConfigPath(root) {
-  const resolved = resolveConfigFile(root);
-  return resolved.generation === "agro" ? resolve3(root, GENERATIONS.agro.configFile) : resolve3(root, OH_CONFIG_FILE);
+  return resolveProjectLayout(root).configFile;
 }
 function defaultOhConfig(name) {
   return {
@@ -1167,16 +1618,15 @@ function defaultOhConfig(name) {
     cron: { agentBin: "claude" },
     build: { skipPnpmInstall: false },
     image: { mode: "build", pullPolicy: "missing" },
-    cloud: {},
     langfuse: {},
     composeOverrides: []
   };
 }
 function readOhConfig(path4) {
-  if (!existsSync5(path4)) return defaultOhConfig(basename3(dirname2(resolve3(path4))));
+  if (!existsSync6(path4)) return defaultOhConfig(basename4(dirname4(resolve4(path4))));
   let raw;
   try {
-    raw = readFileSync5(path4, "utf8");
+    raw = readFileSync6(path4, "utf8");
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     throw new Error(`could not read ${path4}: ${detail}`);
@@ -1185,24 +1635,24 @@ function readOhConfig(path4) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`${OH_CONFIG_FILE} is not valid JSON: ${path4}`);
+    throw new Error(`${basename4(path4)} is not valid JSON: ${path4}`);
   }
   return validateOhConfig(parsed);
 }
 function writeOhConfig(root, config) {
   const path4 = ohConfigPath(root);
-  assertInRoot(path4, resolve3(root));
+  assertInRoot(path4, resolve4(root));
   const validated = validateOhConfig({ ...config, version: 1 });
   const body = `${JSON.stringify(validated, null, 2)}
 `;
   const tmp = `${path4}.tmp.${process.pid}`;
-  mkdirSync2(dirname2(path4), { recursive: true });
+  mkdirSync3(dirname4(path4), { recursive: true });
   try {
-    writeFileSync2(tmp, body, { mode: OH_CONFIG_MODE, encoding: "utf8" });
-    renameSync2(tmp, path4);
+    writeFileSync3(tmp, body, { mode: OH_CONFIG_MODE, encoding: "utf8" });
+    renameSync3(tmp, path4);
   } catch (error) {
     try {
-      unlinkSync2(tmp);
+      unlinkSync3(tmp);
     } catch {
     }
     throw error;
@@ -1216,6 +1666,7 @@ function validateOhConfig(value) {
   expectString(record, "name");
   expectEnum(record, "runtime", "", SANDBOX_RUNTIMES);
   expectString(record, "repo");
+  expectString(record, "checkout");
   expectString(record, "timezone");
   const storage = expectSection(record, "storage");
   if (storage) {
@@ -1262,8 +1713,6 @@ function validateOhConfig(value) {
     expectEnum(image, "mode", "image.", ["build", "image"]);
     expectEnum(image, "pullPolicy", "image.", ["missing", "always", "never"]);
   }
-  const cloud = expectSection(record, "cloud");
-  if (cloud) expectString(cloud, "apiUrl", "cloud.");
   const langfuse = expectSection(record, "langfuse");
   if (langfuse) {
     expectString(langfuse, "baseUrl", "langfuse.");
@@ -1324,6 +1773,7 @@ var OH_CONFIG_FIELDS = [
   { path: "name", type: "string" },
   { path: "runtime", type: "enum", values: SANDBOX_RUNTIMES },
   { path: "repo", type: "string" },
+  { path: "checkout", type: "string" },
   { path: "timezone", type: "string" },
   { path: "git.userName", type: "string" },
   { path: "git.userEmail", type: "string" },
@@ -1340,7 +1790,6 @@ var OH_CONFIG_FIELDS = [
   { path: "image.mode", type: "enum", values: ["build", "image"] },
   { path: "image.pullPolicy", type: "enum", values: ["missing", "always", "never"] },
   { path: "storage.homePath", type: "string" },
-  { path: "cloud.apiUrl", type: "string" },
   { path: "langfuse.baseUrl", type: "string" },
   { path: "langfuse.privacyPreset", type: "enum", values: LANGFUSE_PRIVACY_PRESETS },
   { path: "composeOverrides", type: "list" }
@@ -1401,649 +1850,231 @@ function coerceFieldValue(field, raw) {
   return raw;
 }
 
-// src/lib/project.ts
-import { dirname as dirname3, resolve as resolve4 } from "node:path";
-function resolveProjectRoot(startDir = process.cwd()) {
-  let dir = resolve4(startDir);
-  for (; ; ) {
-    if (resolveControlDir(dir).kind !== "absent") return dir;
-    const parent = dirname3(dir);
-    if (parent === dir) {
-      throw new Error("not an OpenHarness-equipped repo \u2014 run `oh update` first");
-    }
-    dir = parent;
+// src/lib/env-file.ts
+function assertInRoot(dest, root) {
+  if (!(dest === root || dest.startsWith(root + sep2))) {
+    throw new Error(`refusing to write outside the project root: ${dest}`);
   }
 }
-
-// src/lib/secrets.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "node:fs";
-import { resolve as resolve5 } from "node:path";
-
-// src/lib/env.ts
-import {
-  readFileSync as readFileSync6,
-  writeFileSync as writeFileSync3,
-  existsSync as existsSync6,
-  fsyncSync,
-  renameSync as renameSync3,
-  unlinkSync as unlinkSync3,
-  openSync,
-  closeSync
-} from "node:fs";
-function loadEnvInto(envPath, env) {
-  if (!existsSync6(envPath)) return;
-  const content = readFileSync6(envPath, "utf8");
-  for (const rawLine of content.split("\n")) {
-    const line = rawLine.trimEnd();
-    if (line === "" || /^\s*#/.test(line)) continue;
-    const eqIdx = line.indexOf("=");
-    if (eqIdx < 1) continue;
-    const key = line.slice(0, eqIdx).trim();
-    const value = line.slice(eqIdx + 1);
-    if (key === "") continue;
-    if (env[key] === void 0) env[key] = value;
-  }
-}
-function writeEnvFile(envPath, content) {
-  const tmpPath = `${envPath}.tmp.${process.pid}`;
-  let fd;
-  try {
-    fd = openSync(tmpPath, "w", 384);
-    writeFileSync3(tmpPath, content, "utf8");
-    fsyncSync(fd);
-    closeSync(fd);
-    fd = void 0;
-    renameSync3(tmpPath, envPath);
-  } catch (err) {
-    if (fd !== void 0) {
-      try {
-        closeSync(fd);
-      } catch {
-      }
-    }
-    try {
-      unlinkSync3(tmpPath);
-    } catch {
-    }
-    throw err;
-  }
-}
-
-// src/lib/secrets.ts
-var SECRETS_FILE = ".env";
-var SECRET_KEYS = [
-  "GH_TOKEN",
-  "XAI_API_KEY",
-  "META_API_KEY",
-  "SANDBOX_PASSWORD",
-  "PI_SLACK_APP_TOKEN",
-  "PI_SLACK_BOT_TOKEN",
-  "LANGFUSE_PUBLIC_KEY",
-  "LANGFUSE_SECRET_KEY",
-  "OH_CLOUD_PROVISION_KEY"
-];
-var ALLOWED = new Set(SECRET_KEYS);
-function secretsFilePath(root) {
-  return resolve5(root, SECRETS_FILE);
-}
-function isSecretKey(key) {
-  return ALLOWED.has(key);
-}
-function assertSecretKey(key) {
-  if (ALLOWED.has(key)) return;
-  throw new Error(
-    `${key} is not a secret \u2014 non-secret settings live in oh.json; use \`oh config set\` instead`
-  );
-}
-function readSecret(root, key) {
-  assertSecretKey(key);
-  const file = secretsFilePath(root);
-  if (!existsSync7(file)) return void 0;
-  const env = {};
-  loadEnvInto(file, env);
-  const value = env[key]?.trim();
-  return value === void 0 || value === "" ? void 0 : stripQuotes2(value);
-}
-function setSecret(root, key, value) {
-  assertSecretKey(key);
-  if (/[\r\n]/.test(value)) {
-    throw new Error(`${key} value must not contain a newline`);
-  }
-  const file = secretsFilePath(root);
-  assertInRoot(file, resolve5(root));
-  const original = existsSync7(file) ? readFileSync7(file, "utf8") : "";
-  const { content } = setKeyInEnv(original, key, value);
-  writeEnvFile(file, content);
-}
-function listSecretKeys(root) {
-  const file = secretsFilePath(root);
-  if (!existsSync7(file)) return [];
-  const env = {};
-  loadEnvInto(file, env);
-  return SECRET_KEYS.filter((key) => {
-    const value = env[key]?.trim();
-    return value !== void 0 && value !== "";
-  });
-}
-function stripQuotes2(s) {
+function stripQuotes(s) {
   if (s.length >= 2 && (s[0] === '"' && s.endsWith('"') || s[0] === "'" && s.endsWith("'"))) {
     return s.slice(1, -1);
   }
   return s;
 }
-
-// src/commands/cloud.ts
-var DEFAULT_API_URL = "http://127.0.0.1:3000";
-var DEFAULT_TERMINAL_STATUSES = ["running", "failed", "destroyed"];
-var PROVISION_KEY_SECRET = "OH_CLOUD_PROVISION_KEY";
-var CLOUD_HELP = `oh cloud \u2014 Manage OpenHarness Cloud nodes
-
-Usage:
-  oh cloud config [--api-url <url>] [--provision-key <key>]
-  oh cloud config show
-  oh cloud [global options] nodes list
-  oh cloud [global options] nodes get <node-id>
-  oh cloud [global options] nodes create --ssh-key-id <id> [--name <name>]
-  oh cloud [global options] nodes events <node-id>
-  oh cloud [global options] nodes watch <node-id> [--interval <seconds>] [--until <statuses>]
-  oh cloud [global options] nodes destroy <node-id>
-  oh cloud [global options] nodes restart <node-id>
-  oh cloud [global options] nodes rebuild <node-id>
-  oh cloud [global options] ssh-keys list
-  oh cloud [global options] ssh-keys create --name <name> (--public-key <key> | --public-key-file <path>)
-
-Global options:
-  --api-url <url>          API base URL (default: OH_CLOUD_API_URL, OH_API_URL,
-                           oh.json cloud.apiUrl, or http://127.0.0.1:3000)
-  --provision-key <key>    Admin key (default: OH_CLOUD_PROVISION_KEY in the
-                           environment or in the root .env)
-  --output <field>         Print one top-level response field instead of JSON
-  -h, --help               Show this help
-
-Configuration:
-  oh cloud config writes cloud.apiUrl to the repository oh.json and securely
-  prompts for the current provisioner key, which it stores as
-  ${PROVISION_KEY_SECRET} in the gitignored root .env. This is the temporary
-  credential model until OpenHarness Cloud issues user API tokens.
-
-  Both settings are repository-local, so oh cloud runs inside an
-  OpenHarness-equipped repo. Outside one, pass --api-url and --provision-key.
-
-Environment:
-  OH_CLOUD_API_URL         Override the OpenHarness Cloud API base URL
-  OH_CLOUD_PROVISION_KEY   Override the stored key (OH_PROVISION_KEY and
-                           PROVISION_KEY are also accepted)
-
-Examples:
-  oh cloud config
-  oh cloud ssh-keys create --name laptop --public-key-file ~/.ssh/openharness_node.pub
-  oh cloud nodes create --name smoke-1 --ssh-key-id <ssh-key-id>
-  oh cloud nodes watch <node-id>
-`;
-var CloudCliError = class extends Error {
-  status;
-  payload;
-  constructor(message, options = {}) {
-    super(message);
-    this.name = "CloudCliError";
-    this.status = options.status;
-    this.payload = options.payload;
-  }
+var CONFIG_FIELD_BY_ENV_KEY = {
+  DOCKER_SOCKET: "access.dockerSocket"
 };
-function takeOption(args, name, alias) {
-  const names = alias ? [name, alias] : [name];
-  for (const candidate of names) {
-    const index = args.indexOf(candidate);
-    if (index === -1) continue;
-    const value = args[index + 1];
-    if (value === void 0 || value.startsWith("-")) {
-      throw new CloudCliError(`${candidate} requires a value`);
-    }
-    args.splice(index, 2);
-    return value;
-  }
-  return void 0;
-}
-function requireOption(value, name) {
-  if (!value) throw new CloudCliError(`${name} is required`);
-  return value;
-}
-function requirePositional(value, name) {
-  if (!value || value.startsWith("-")) throw new CloudCliError(`${name} is required`);
-  return value;
-}
-function assertNoExtraArgs(args) {
-  if (args.length > 0) {
-    throw new CloudCliError(
-      `unexpected argument${args.length === 1 ? "" : "s"}: ${args.join(" ")}`
+function setEnvValue(root, key, value, bin) {
+  const path4 = CONFIG_FIELD_BY_ENV_KEY[key];
+  if (path4 === void 0) {
+    throw new Error(
+      `${key} is not a settable oh.json field \u2014 run \`${bin} config set\` for a non-secret, \`${bin} secret set\` for a credential`
     );
   }
+  return setConfigField(root, path4, value);
 }
-function normalizeApiUrl(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new CloudCliError(`invalid API URL: ${value}`);
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new CloudCliError(`API URL must use http or https: ${value}`);
+function setConfigField(root, path4, value) {
+  const file = ohConfigPath(root);
+  assertInRoot(file, resolve5(root));
+  const config = readOhConfig(file);
+  const before = getOhConfigValue(config, path4);
+  const next = setOhConfigValue(config, path4, value);
+  const after = getOhConfigValue(next, path4);
+  if (existsSync7(file) && JSON.stringify(before) === JSON.stringify(after)) {
+    return "already-set";
   }
-  return url.toString().replace(/\/$/, "");
-}
-function formatJson(value) {
-  return `${JSON.stringify(value, null, 2)}
-`;
-}
-function bodyPreview(body) {
-  const compact = body.replace(/\s+/g, " ").trim();
-  return compact.length > 180 ? `${compact.slice(0, 177)}...` : compact;
-}
-function responseKind(contentType) {
-  return contentType?.split(";", 1)[0]?.trim() || "non-JSON content";
+  writeOhConfig(root, next);
+  return before === void 0 ? "added" : "updated";
 }
-function formatApiFailure(status, payload, contentType) {
-  if (payload && typeof payload === "object") {
-    const record = payload;
-    const message = record.error ?? record.message;
-    const code = typeof record.code === "string" ? ` (${record.code})` : "";
-    if (typeof message === "string") {
-      return `API request failed with ${status}${code}: ${message}`;
+function setKeyInEnv(content, key, value) {
+  const lines = content.split("\n");
+  const live = new RegExp(`^${escapeRegExp(key)}=(.*)$`);
+  const commented = new RegExp(`^[ \\t]*#[ \\t]*${escapeRegExp(key)}=(.*)$`);
+  for (let i = 0; i < lines.length; i++) {
+    const m = live.exec(lines[i]);
+    if (m) {
+      if (stripQuotes(m[1].trim()) === value) return { content, outcome: "already-set" };
+      lines[i] = `${key}=${value}`;
+      return { content: lines.join("\n"), outcome: "updated" };
     }
   }
-  if (typeof payload === "string" && payload.length > 0) {
-    return `API request failed with ${status}: server returned ${responseKind(contentType)} instead of JSON (${bodyPreview(payload)})`;
-  }
-  return `API request failed with ${status}`;
-}
-async function parseResponse(response) {
-  const text = await response.text();
-  const contentType = response.headers.get("content-type");
-  if (!text) return { payload: null, isJson: true, contentType };
-  try {
-    return { payload: JSON.parse(text), isJson: true, contentType };
-  } catch {
-    return { payload: text, isJson: false, contentType };
-  }
-}
-function createCloudApiClient(options) {
-  const fetchImpl = options.fetch ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") {
-    throw new CloudCliError(
-      "the cloud CLI requires Node.js 20 or newer (global fetch is unavailable)"
-    );
-  }
-  return async (method, pathname, body) => {
-    let response;
-    try {
-      response = await fetchImpl(`${options.apiUrl}${pathname}`, {
-        method,
-        headers: {
-          "x-provision-key": options.provisionKey,
-          ...body === void 0 ? {} : { "content-type": "application/json" }
-        },
-        ...body === void 0 ? {} : { body: JSON.stringify(body) }
-      });
-    } catch (error) {
-      const detail = error instanceof Error ? error.message : String(error);
-      throw new CloudCliError(`could not reach ${options.apiUrl}: ${detail}`);
-    }
-    const parsed = await parseResponse(response);
-    if (!response.ok) {
-      throw new CloudCliError(
-        formatApiFailure(response.status, parsed.payload, parsed.contentType),
-        {
-          status: response.status,
-          payload: parsed.payload
-        }
-      );
-    }
-    if (!parsed.isJson) {
-      throw new CloudCliError(
-        `API returned ${response.status} ${responseKind(parsed.contentType)}; expected JSON (${bodyPreview(parsed.payload)})`,
-        { status: response.status, payload: parsed.payload }
-      );
+  for (let i = 0; i < lines.length; i++) {
+    if (commented.test(lines[i])) {
+      lines[i] = `${key}=${value}`;
+      return { content: lines.join("\n"), outcome: "uncommented" };
     }
-    return parsed.payload;
+  }
+  const body = content.replace(/\n+$/, "");
+  return {
+    content: body === "" ? `${key}=${value}
+` : `${body}
+${key}=${value}
+`,
+    outcome: "added"
   };
 }
-function nodePath(nodeId, suffix = "") {
-  return `/api/nodes/${encodeURIComponent(nodeId)}${suffix}`;
-}
-async function readPublicKey(args, readFileImpl) {
-  const inline = takeOption(args, "--public-key");
-  const file = takeOption(args, "--public-key-file");
-  if (inline && file) {
-    throw new CloudCliError("use only one of --public-key or --public-key-file");
-  }
-  if (!inline && !file) {
-    throw new CloudCliError("--public-key or --public-key-file is required");
-  }
-  if (inline) return inline.trim();
-  try {
-    const value = (await readFileImpl(file, "utf8")).trim();
-    if (!value) throw new CloudCliError(`SSH public key file is empty: ${file}`);
-    return value;
-  } catch (error) {
-    if (error instanceof CloudCliError) throw error;
-    const detail = error instanceof Error ? error.message : String(error);
-    throw new CloudCliError(`could not read SSH public key file ${file}: ${detail}`);
-  }
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-async function dispatch(args, options) {
-  const resource = args.shift();
-  const action = args.shift();
-  if (!resource || !action) {
-    throw new CloudCliError("a resource and action are required. Run `oh cloud --help` for usage.");
-  }
-  if (resource === "ssh-keys") {
-    if (action === "list") {
-      assertNoExtraArgs(args);
-      return options.request("GET", "/api/ssh-keys");
-    }
-    if (action === "create") {
-      const name = requireOption(takeOption(args, "--name"), "--name");
-      const publicKey = await readPublicKey(args, options.readFile);
-      assertNoExtraArgs(args);
-      return options.request("POST", "/api/ssh-keys", { name, publicKey });
-    }
-    throw new CloudCliError(`unknown ssh-keys action: ${action}`);
-  }
-  if (resource !== "nodes") throw new CloudCliError(`unknown resource: ${resource}`);
-  if (action === "list") {
-    assertNoExtraArgs(args);
-    return options.request("GET", "/api/nodes");
-  }
-  if (action === "create") {
-    const name = takeOption(args, "--name");
-    const sshKeyId = requireOption(takeOption(args, "--ssh-key-id"), "--ssh-key-id");
-    assertNoExtraArgs(args);
-    return options.request("POST", "/api/nodes", {
-      ...name ? { name } : {},
-      sshKeyId
-    });
-  }
-  const nodeIdActions = ["get", "events", "destroy", "restart", "rebuild", "watch"];
-  if (!nodeIdActions.includes(action)) {
-    throw new CloudCliError(`unknown nodes action: ${action}`);
-  }
-  const nodeId = requirePositional(args.shift(), "<node-id>");
-  if (action === "get") {
-    assertNoExtraArgs(args);
-    return options.request("GET", nodePath(nodeId));
-  }
-  if (action === "events") {
-    assertNoExtraArgs(args);
-    return options.request("GET", nodePath(nodeId, "/events"));
-  }
-  if (action === "destroy") {
-    assertNoExtraArgs(args);
-    return options.request("DELETE", nodePath(nodeId));
-  }
-  if (action === "restart" || action === "rebuild") {
-    assertNoExtraArgs(args);
-    return options.request("POST", nodePath(nodeId, `/${action}`));
-  }
-  if (action === "watch") {
-    const intervalValue = takeOption(args, "--interval") ?? "5";
-    const intervalSeconds = Number(intervalValue);
-    if (!Number.isFinite(intervalSeconds) || intervalSeconds < 0) {
-      throw new CloudCliError(`--interval must be a non-negative number: ${intervalValue}`);
-    }
-    const untilValue = takeOption(args, "--until");
-    const terminalStatuses = new Set(
-      (untilValue ? untilValue.split(",") : DEFAULT_TERMINAL_STATUSES).map((status) => status.trim()).filter(Boolean)
-    );
-    if (terminalStatuses.size === 0) {
-      throw new CloudCliError("--until must contain at least one status");
-    }
-    assertNoExtraArgs(args);
-    let lastStatus;
-    while (true) {
-      const node = await options.request("GET", nodePath(nodeId));
-      if (!node || typeof node !== "object" || typeof node.status !== "string") {
-        throw new CloudCliError("node response did not include a status");
-      }
-      const status = node.status;
-      if (status !== lastStatus) {
-        options.write(node);
-        lastStatus = status;
-      }
-      if (terminalStatuses.has(status)) return void 0;
-      await options.sleep(intervalSeconds * 1e3);
+
+// src/lib/project.ts
+import { dirname as dirname5, resolve as resolve6 } from "node:path";
+function resolveProjectRoot(startDir = process.cwd()) {
+  let dir = resolve6(startDir);
+  for (; ; ) {
+    if (resolveControlDir(dir).kind !== "absent") return dir;
+    const parent = dirname5(dir);
+    if (parent === dir) {
+      throw new Error(`not an OpenHarness-equipped repo \u2014 run \`${activeBin()} update\` first`);
     }
+    dir = parent;
   }
-  throw new CloudCliError(`unknown nodes action: ${action}`);
-}
-var OUTSIDE_REPO_HINT = "; pass --api-url and --provision-key to run `oh cloud` outside a repo";
-function requireRoot(io) {
-  try {
-    return resolveProjectRoot(io.cwd);
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    throw new CloudCliError(`${detail}${OUTSIDE_REPO_HINT}`);
-  }
-}
-function legacyCloudConfigPath(env) {
-  const home = env.HOME ?? env.USERPROFILE;
-  if (!home) return void 0;
-  return join3(home, ".config", "openharness", "cloud.json");
-}
-function readLegacyCloudConfig(path4) {
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync8(path4, "utf8"));
-  } catch {
-    return void 0;
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
-  const record = parsed;
-  return {
-    ...typeof record.apiUrl === "string" ? { apiUrl: record.apiUrl } : {},
-    ...typeof record.provisionKey === "string" ? { provisionKey: record.provisionKey } : {}
-  };
 }
-function migrateLegacyCloudConfig(root, io, env) {
-  const path4 = legacyCloudConfigPath(env);
-  if (!path4 || !existsSync8(path4)) return;
-  const config = readOhConfig(ohConfigPath(root));
-  if (config.cloud?.apiUrl !== void 0) return;
-  if (readSecret(root, PROVISION_KEY_SECRET) !== void 0) return;
-  const legacy = readLegacyCloudConfig(path4);
-  if (!legacy || !legacy.apiUrl && !legacy.provisionKey) return;
-  if (legacy.apiUrl) {
-    const next = {
-      ...config,
-      cloud: { ...config.cloud, apiUrl: normalizeApiUrl(legacy.apiUrl) }
-    };
-    writeOhConfig(root, next);
-  }
-  if (legacy.provisionKey) setSecret(root, PROVISION_KEY_SECRET, legacy.provisionKey);
-  io.stdout(`Migrated OpenHarness Cloud settings out of ${path4}
-`);
-  if (legacy.apiUrl) io.stdout(`  cloud.apiUrl -> ${ohConfigPath(root)}
-`);
-  if (legacy.provisionKey) io.stdout(`  ${PROVISION_KEY_SECRET} -> ${join3(root, ".env")}
-`);
-  io.stdout(`${path4} is no longer read; delete it when you no longer need the copy.
+
+// src/lib/prompt.ts
+import { createInterface } from "node:readline";
+var COLORS = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  green: "\x1B[32m",
+  yellow: "\x1B[33m",
+  red: "\x1B[31m",
+  cyan: "\x1B[36m"
+};
+function header(msg) {
+  process.stdout.write(`
+${COLORS.bold}${msg}${COLORS.reset}
+
 `);
 }
-function loadCloudSettings(root, io, env) {
-  migrateLegacyCloudConfig(root, io, env);
-  const config = readOhConfig(ohConfigPath(root));
-  return {
-    ...config.cloud?.apiUrl ? { apiUrl: config.cloud.apiUrl } : {},
-    ...(() => {
-      const key = readSecret(root, PROVISION_KEY_SECRET);
-      return key ? { provisionKey: key } : {};
-    })()
-  };
+function bold(s) {
+  return `${COLORS.bold}${s}${COLORS.reset}`;
 }
-function envProvisionKey(env) {
-  return env.OH_CLOUD_PROVISION_KEY ?? env.OH_PROVISION_KEY ?? env.PROVISION_KEY;
+function redact(token) {
+  if (token.length <= 8) return "****";
+  return token.slice(0, 5) + "*".repeat(token.length - 5);
 }
-async function configureCloud(args, io, env) {
-  const root = requireRoot(io);
-  const current = loadCloudSettings(root, io, env);
-  if (args[0] === "show") {
-    args.shift();
-    assertNoExtraArgs(args);
-    io.stdout(`Config: ${ohConfigPath(root)}
-`);
-    io.stdout(`Secrets: ${join3(root, ".env")}
-`);
-    io.stdout(`API URL: ${current.apiUrl ?? DEFAULT_API_URL}
-`);
-    io.stdout(
-      `Provision credential: ${current.provisionKey ? redact(current.provisionKey) : "not configured"}
-`
-    );
-    return;
+async function ask(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await new Promise((resolve11) => {
+      rl.question(`  ${question} `, (answer) => resolve11(answer.trim()));
+    });
+  } finally {
+    rl.close();
   }
-  const apiUrl = normalizeApiUrl(
-    takeOption(args, "--api-url") ?? current.apiUrl ?? env.OH_CLOUD_API_URL ?? env.OH_API_URL ?? DEFAULT_API_URL
-  );
-  const providedKey = takeOption(args, "--provision-key");
-  assertNoExtraArgs(args);
-  const provisionKey = (providedKey ?? await (io.askSecret ?? askSecret)("OpenHarness Cloud provisioner key:")).trim();
-  if (!provisionKey) throw new CloudCliError("provisioner key cannot be empty");
-  const config = readOhConfig(ohConfigPath(root));
-  writeOhConfig(root, { ...config, cloud: { ...config.cloud, apiUrl } });
-  setSecret(root, PROVISION_KEY_SECRET, provisionKey);
-  io.stdout(`Saved cloud.apiUrl to ${ohConfigPath(root)}
-`);
-  io.stdout(`Saved ${PROVISION_KEY_SECRET} to ${join3(root, ".env")}
-`);
-  io.stdout("Provision credential: configured\n");
 }
-async function executeCloud(argv, io) {
-  const args = [...argv];
-  const env = io.env ?? process.env;
-  if (args.includes("--help") || args.includes("-h") || args[0] === "help") {
-    io.stdout(CLOUD_HELP);
-    return;
-  }
-  if (args[0] === "config") {
-    args.shift();
-    await configureCloud(args, io, env);
-    return;
-  }
-  const flagApiUrl = takeOption(args, "--api-url");
-  const flagProvisionKey = takeOption(args, "--provision-key");
-  const stored = flagProvisionKey && flagApiUrl ? {} : loadCloudSettings(requireRoot(io), io, env);
-  const apiUrl = normalizeApiUrl(
-    flagApiUrl ?? env.OH_CLOUD_API_URL ?? env.OH_API_URL ?? stored.apiUrl ?? DEFAULT_API_URL
-  );
-  const provisionKey = flagProvisionKey ?? envProvisionKey(env) ?? stored.provisionKey;
-  if (!provisionKey) {
-    throw new CloudCliError(
-      `no provision credential found. Run \`oh cloud config\`, set ${PROVISION_KEY_SECRET}, or pass --api-url and --provision-key.`
-    );
-  }
-  const outputField = takeOption(args, "--output");
-  const request = createCloudApiClient({
-    apiUrl,
-    provisionKey,
-    fetch: io.fetch
-  });
-  const write = (value) => io.stdout(formatJson(value));
-  const result = await dispatch(args, {
-    request,
-    readFile: io.readFile ?? readFile,
-    sleep: io.sleep ?? ((milliseconds) => new Promise((resolve9) => setTimeout(resolve9, milliseconds))),
-    write
-  });
-  if (result === void 0) return;
-  if (outputField) {
-    if (!result || typeof result !== "object" || !(outputField in result)) {
-      throw new CloudCliError(`response does not contain top-level field: ${outputField}`);
-    }
-    const value = result[outputField];
-    io.stdout(typeof value === "object" ? formatJson(value) : `${String(value)}
-`);
-    return;
-  }
-  write(result);
-}
-async function runCloud(argv, io) {
-  try {
-    await executeCloud(argv, io);
-    return 0;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    io.stderr(`oh cloud: ${message}
-`);
-    return 1;
-  }
+async function askSecret(question) {
+  if (!process.stdin.isTTY) return askSecretPiped(question);
+  process.stdout.write(`  ${question} `);
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+  const bytes = [];
+  return await new Promise((resolve11) => {
+    const cleanup = () => {
+      try {
+        process.stdin.setRawMode(false);
+      } catch {
+      }
+      process.stdin.pause();
+      process.stdin.removeListener("data", onData);
+    };
+    const onData = (data) => {
+      for (const byte of data) {
+        if (byte === 3) {
+          cleanup();
+          process.stdout.write("\n");
+          process.exit(130);
+        } else if (byte === 13 || byte === 10) {
+          cleanup();
+          process.stdout.write("\n");
+          resolve11(Buffer.from(bytes).toString("utf8").trim());
+          return;
+        } else if (byte === 127 || byte === 8) {
+          if (bytes.length > 0) {
+            bytes.pop();
+            process.stdout.write("\b \b");
+          }
+        } else if (byte === 21) {
+          while (bytes.length > 0) {
+            bytes.pop();
+            process.stdout.write("\b \b");
+          }
+        } else if (byte >= 32) {
+          bytes.push(byte);
+          process.stdout.write("\u25CF");
+        }
+      }
+    };
+    process.stdin.on("data", onData);
+  });
 }
-
-// src/lib/execution/runner.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync9 } from "node:fs";
-import { join as join4 } from "node:path";
-var spawnRunner = (cmd, args, opts) => {
-  const common = {
-    env: opts.env,
-    ...opts.cwd !== void 0 ? { cwd: opts.cwd } : {},
-    ...opts.timeoutMs !== void 0 ? { timeout: opts.timeoutMs } : {}
+async function askSecretPiped(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const stdoutWrite = process.stdout.write.bind(process.stdout);
+  let prompted = false;
+  const patched = (chunk) => {
+    if (!prompted) {
+      prompted = true;
+      return stdoutWrite(chunk);
+    }
+    return true;
   };
-  const r = opts.stdio === "capture" ? spawnSync2(cmd, args, { ...common, stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" }) : spawnSync2(cmd, args, { ...common, stdio: "inherit" });
-  const err = r.error;
-  return {
-    status: r.status,
-    error: err ? { code: err.code, message: err.message } : void 0,
-    stdout: typeof r.stdout === "string" ? r.stdout : void 0,
-    stderr: typeof r.stderr === "string" ? r.stderr : void 0
+  process.stdout.write = patched;
+  let restored = false;
+  const restore = () => {
+    if (restored) return;
+    restored = true;
+    process.stdout.write = stdoutWrite;
+    try {
+      rl.close();
+    } catch {
+    }
   };
-};
-var ExecutionSpawnError = class extends Error {
-  code;
-  constructor(what, error) {
-    super(`failed to run ${what}${error?.message ? ` (${error.message})` : ""}`);
-    this.name = "ExecutionSpawnError";
-    this.code = error?.code;
-  }
-};
-var ExecutionExitError = class extends Error {
-  exitCode;
-  constructor(what, exitCode) {
-    super(`${what} exited ${exitCode}`);
-    this.name = "ExecutionExitError";
-    this.exitCode = exitCode;
-  }
-};
-function assertSpawned(r, what) {
-  if (r.error) {
-    throw new ExecutionSpawnError(what, r.error);
+  const onSigint = () => {
+    restore();
+    process.stdout.write("\n");
+    process.exit(130);
+  };
+  process.on("SIGINT", onSigint);
+  try {
+    return await new Promise((resolve11) => {
+      rl.question(`  ${question} `, (answer) => {
+        process.stdout.write("\n");
+        resolve11(answer.trim());
+      });
+    });
+  } finally {
+    process.removeListener("SIGINT", onSigint);
+    restore();
   }
 }
-function requireLifecycleScript(root, rel) {
-  const script = join4(root, ".oh", "scripts", rel);
-  if (!existsSync9(script)) {
-    throw new Error(
-      `missing lifecycle script ${script} \u2014 the vendored .oh/ payload looks incomplete; run \`oh update\` to re-vendor it`
-    );
-  }
-  return script;
+async function confirm(question, defaultYes = true) {
+  const suffix = defaultYes ? "[Y/n]" : "[y/N]";
+  const answer = (await ask(`${question} ${suffix}`)).toLowerCase();
+  if (answer === "") return defaultYes;
+  return /^y/.test(answer);
 }
 
 // src/lib/registry.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname4, join as join5, resolve as resolve6, sep as sep2 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname6, join as join5, resolve as resolve7, sep as sep3 } from "node:path";
 
-// oh-asset:/home/runner/work/openharness/openharness/.devcontainer/docker-compose.yml
-var docker_compose_default = 'name: ${SANDBOX_NAME:-openharness}\n\nservices:\n  sandbox:\n    image: ${OH_SANDBOX_IMAGE:-sandbox-${SANDBOX_NAME:-openharness}}\n    pull_policy: ${OH_PULL_POLICY:-missing}\n    container_name: ${SANDBOX_NAME:-openharness}\n    build:\n      context: ${OH_REPO_DIR:-..}\n      dockerfile: .devcontainer/Dockerfile\n    volumes:\n      - ${OH_HOME_MOUNT:-workspace}:/home/sandbox\n      - ${OH_REPO_DIR:-..}:/home/sandbox/harness\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-openharness}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "/home/sandbox/harness/.oh/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
+// oh-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.yml
+var docker_compose_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-${OH_SANDBOX_IMAGE:-sandbox-${SANDBOX_NAME:-agro}}}\n    pull_policy: ${AGRO_PULL_POLICY:-${OH_PULL_POLICY:-missing}}\n    container_name: ${SANDBOX_NAME:-agro}\n    build:\n      context: ${AGRO_REPO_DIR:-${OH_REPO_DIR:-..}}\n      dockerfile: .devcontainer/Dockerfile\n    volumes:\n      - ${AGRO_HOME_MOUNT:-${OH_HOME_MOUNT:-workspace}}:/home/sandbox\n      - ${AGRO_REPO_DIR:-${OH_REPO_DIR:-..}}:/home/sandbox/harness\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "if [ -d /home/sandbox/harness/.agro ]; then exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh; fi; exec bash /home/sandbox/harness/.oh/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
 
-// oh-asset:/home/runner/work/openharness/openharness/.devcontainer/docker-compose.image-only.yml
-var docker_compose_image_only_default = 'name: ${SANDBOX_NAME:-openharness}\n\nservices:\n  sandbox:\n    image: ${OH_SANDBOX_IMAGE:-ghcr.io/mifunedev/openharness:latest}\n    pull_policy: ${OH_PULL_POLICY:-always}\n    container_name: ${SANDBOX_NAME:-openharness}\n    volumes:\n      - ${OH_HOME_MOUNT:-workspace}:/home/sandbox\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-openharness}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "/home/sandbox/harness/.oh/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
+// oh-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.image-only.yml
+var docker_compose_image_only_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-${OH_SANDBOX_IMAGE:-ghcr.io/mifunedev/agro:latest}}\n    pull_policy: ${AGRO_PULL_POLICY:-${OH_PULL_POLICY:-always}}\n    container_name: ${SANDBOX_NAME:-agro}\n    volumes:\n      - ${AGRO_HOME_MOUNT:-${OH_HOME_MOUNT:-workspace}}:/home/sandbox\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "if [ -d /home/sandbox/harness/.agro ]; then exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh; fi; exec bash /home/sandbox/harness/.oh/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
 
-// oh-asset:/home/runner/work/openharness/openharness/.devcontainer/docker-compose.ssh.yml
+// oh-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.ssh.yml
 var docker_compose_ssh_default = 'services:\n  sandbox:\n    ports:\n      - "127.0.0.1:${SANDBOX_SSH_PORT:-2222}:22"\n';
 
-// oh-asset:/home/runner/work/openharness/openharness/.devcontainer/docker-compose.docker-sock.yml
+// oh-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.docker-sock.yml
 var docker_compose_docker_sock_default = "services:\n  sandbox:\n    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock\n";
 
-// oh-asset:/home/runner/work/openharness/openharness/.oh/scripts/docker-compose.sh
+// oh-asset:/home/runner/work/agro/agro/.agro/scripts/docker-compose.sh
 var docker_compose_default2 = `#!/usr/bin/env bash
 
 set -euo pipefail
@@ -2059,10 +2090,10 @@ Usage: scripts/docker-compose.sh [--repo-dir DIR] [--extra-env-file FILE]
                                  [--print-argv] <docker-compose-args...>
 
 Builds the harness docker compose argv from the repository dotenv and the
-composeOverrides[] list in oh.json, then executes \`docker compose ...\` with the
+composeOverrides[] list in agro.json, then executes \`docker compose ...\` with the
 provided args.
 --extra-env-file adds a lower-precedence --env-file ahead of the dotenv; \`oh\`
-renders the non-secret settings of oh.json into that file.
+renders the non-secret settings of agro.json into that file.
 --print-argv prints one argv entry per line instead of executing; useful for
 safe diagnostics and tests.
 EOF
@@ -2102,7 +2133,7 @@ done
 
 COMPAT="$SCRIPT_DIR/compat.sh"
 if [ ! -f "$COMPAT" ]; then
-  printf 'error: %s is missing \u2014 the vendored .oh/scripts payload is incomplete; run \`oh update\`\\n' "$COMPAT" >&2
+  printf 'error: %s is missing \u2014 the vendored .agro/scripts payload is incomplete; run \`oh update\`\\n' "$COMPAT" >&2
   exit 2
 fi
 # shellcheck source=compat.sh
@@ -2166,7 +2197,7 @@ fi
 
 CONFIG_JSON="$(compat_selected_path compat_config_file "$REPO_DIR")" || exit 2
 
-if [ -z "$EXTRA_ENV_FILE" ] && [ -n "$CONFIG_JSON" ]; then
+if [ -z "$EXTRA_ENV_FILE" ] && [ -f "$CONFIG_JSON" ]; then
   printf 'note: non-secret config comes from %s via \`oh\`; this direct run uses only %s and the compose-file defaults\\n' \\
     "\${CONFIG_JSON#"$REPO_DIR"/}" "\${ENV_FILE#"$REPO_DIR"/}" >&2
 fi
@@ -2199,7 +2230,7 @@ if truthy "$ssh_value"; then
     port_check="$SCRIPT_DIR/check-host-port.sh"
     if [ -x "$port_check" ] || [ -f "$port_check" ]; then
       sandbox_name=\${SANDBOX_NAME:-$(read_env_value SANDBOX_NAME)}
-      [ -n "$sandbox_name" ] || sandbox_name=openharness
+      sandbox_name="$(compat_sandbox_name "$sandbox_name")"
       own_port=0
       if command -v docker >/dev/null 2>&1; then
         docker ps --format '{{.Names}}\\t{{.Ports}}' 2>/dev/null \\
@@ -2219,7 +2250,7 @@ if truthy "$ssh_value"; then
   fi
 fi
 
-[ -n "$CONFIG_JSON" ] || CONFIG_JSON="$REPO_DIR/.oh/config.json"
+[ -f "$CONFIG_JSON" ] || CONFIG_JSON="$REPO_DIR/.agro/config.json"
 [ -f "$CONFIG_JSON" ] || CONFIG_JSON="$REPO_DIR/config.json"
 if command -v jq >/dev/null 2>&1 && [ -f "$CONFIG_JSON" ]; then
   while IFS= read -r override; do
@@ -2235,11 +2266,11 @@ fi
 exec docker compose "\${args[@]}" "$@"
 `;
 
-// oh-asset:/home/runner/work/openharness/openharness/.oh/scripts/compat.sh
+// oh-asset:/home/runner/work/agro/agro/.agro/scripts/compat.sh
 var compat_default = `#!/usr/bin/env bash
 # Boot-safe dual-generation resolution: bash + coreutils only, no node, no jq.
-# The TypeScript contract is .oh/cli/src/lib/compat.ts; both consume the same
-# vectors in .oh/cli/src/lib/__tests__/fixtures/compat-vectors.json.
+# The TypeScript contract is .agro/cli/src/lib/compat.ts; both consume the same
+# vectors in .agro/cli/src/lib/__tests__/fixtures/compat-vectors.json.
 
 COMPAT_LEGACY_CONTROL_DIR=".oh"
 COMPAT_AGRO_CONTROL_DIR=".agro"
@@ -2247,6 +2278,8 @@ COMPAT_LEGACY_CONFIG_FILE="oh.json"
 COMPAT_AGRO_CONFIG_FILE="agro.json"
 COMPAT_LEGACY_SEED_DIR="/opt/oh-seed"
 COMPAT_AGRO_SEED_DIR="/opt/agro-seed"
+COMPAT_DEFAULT_GENERATION=agro
+COMPAT_DEFAULT_SANDBOX_NAME=agro
 COMPAT_CONFLICT_STATUS=3
 
 compat_tree_manifest() {
@@ -2294,6 +2327,14 @@ compat_tree_diff() {
   return "$rc"
 }
 
+compat_sandbox_name() {
+  if [ -n "\${1:-}" ]; then
+    printf '%s\\n' "$1"
+  else
+    printf '%s\\n' "$COMPAT_DEFAULT_SANDBOX_NAME"
+  fi
+}
+
 compat_present() {
   case "$1" in
     dir) [ -d "$2" ] ;;
@@ -2308,7 +2349,11 @@ compat_resolve_pair() {
   compat_present "$entry_kind" "$legacy" || legacy_present=0
   compat_present "$entry_kind" "$agro" || agro_present=0
   if [ "$legacy_present" = 0 ] && [ "$agro_present" = 0 ]; then
-    printf 'absent\\t\\n'
+    if [ "$COMPAT_DEFAULT_GENERATION" = agro ]; then
+      printf 'absent\\t%s\\n' "$agro"
+    else
+      printf 'absent\\t%s\\n' "$legacy"
+    fi
     return 0
   fi
   if [ "$legacy_present" = 1 ] && [ "$agro_present" = 0 ]; then
@@ -2374,10 +2419,10 @@ compat_seed_src() {
     printf '%s\\n' "$configured"
     return 0
   fi
-  if [ -d "$prefix$COMPAT_AGRO_SEED_DIR" ] && [ ! -d "$prefix$COMPAT_LEGACY_SEED_DIR" ]; then
-    printf '%s\\n' "$prefix$COMPAT_AGRO_SEED_DIR"
-  else
+  if [ -d "$prefix$COMPAT_LEGACY_SEED_DIR" ]; then
     printf '%s\\n' "$prefix$COMPAT_LEGACY_SEED_DIR"
+  else
+    printf '%s\\n' "$prefix$COMPAT_AGRO_SEED_DIR"
   fi
 }
 
@@ -2385,12 +2430,11 @@ compat_marker_file() {
   local root="$1" line dir
   line="$(compat_control_dir "$root")" || return $?
   dir="\${line#*	}"
-  [ -n "$dir" ] || return 1
   printf '%s\\n' "$dir/.image-seeded"
 }
 `;
 
-// oh-asset:/home/runner/work/openharness/openharness/.oh/scripts/check-host-port.sh
+// oh-asset:/home/runner/work/agro/agro/.agro/scripts/check-host-port.sh
 var check_host_port_default = `#!/usr/bin/env bash
 
 set -eu
@@ -2476,7 +2520,7 @@ exit 0
 
 // src/lib/registry.ts
 var SANDBOX_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
-var DEFAULT_NAME_PREFIX = "oh-sbx-";
+var DEFAULT_NAME_PREFIX = "agro-sbx-";
 function ohHome() {
   return resolveUserStateHome(process.env);
 }
@@ -2495,17 +2539,17 @@ function entryRoot(name) {
   return join5(registryRoot(), name);
 }
 function isDirectory(path4) {
-  return statSync4(path4, { throwIfNoEntry: false })?.isDirectory() === true;
+  return statSync3(path4, { throwIfNoEntry: false })?.isDirectory() === true;
 }
 function listEntries() {
   const root = registryRoot();
   if (!isDirectory(root)) return [];
-  return readdirSync3(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((name) => SANDBOX_NAME_PATTERN.test(name)).filter((name) => existsSync10(ohConfigPath(join5(root, name)))).sort();
+  return readdirSync3(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).filter((name) => SANDBOX_NAME_PATTERN.test(name)).filter((name) => existsSync8(ohConfigPath(join5(root, name)))).sort();
 }
 function entryRepo(name) {
   const config = readOhConfig(ohConfigPath(entryRoot(name)));
-  const repo = config.repo;
-  return typeof repo === "string" && repo !== "" ? resolve6(repo) : void 0;
+  const checkout = configCheckout(config);
+  return checkout === void 0 ? void 0 : resolve7(checkout);
 }
 function runningContainerNames(run) {
   const names = /* @__PURE__ */ new Set();
@@ -2531,25 +2575,26 @@ function nextDefaultName(run = spawnRunner) {
   }
 }
 function materialize(root, opts = {}) {
-  const entry = resolve6(root);
+  const entry = resolve7(root);
+  const scripts = join5(resolveProjectLayout(entry).controlDir, "scripts");
   const files = [
     {
-      rel: ".devcontainer/docker-compose.yml",
-      body: opts.repo === void 0 ? docker_compose_image_only_default : docker_compose_default,
+      dest: join5(entry, ".devcontainer", "docker-compose.yml"),
+      body: (opts.checkout ?? opts.repo) === void 0 ? docker_compose_image_only_default : docker_compose_default,
       mode: 420
     },
-    { rel: ".devcontainer/docker-compose.ssh.yml", body: docker_compose_ssh_default, mode: 420 },
-    { rel: ".devcontainer/docker-compose.docker-sock.yml", body: docker_compose_docker_sock_default, mode: 420 },
-    { rel: ".oh/scripts/docker-compose.sh", body: docker_compose_default2, mode: 493 },
-    { rel: ".oh/scripts/compat.sh", body: compat_default, mode: 420 },
-    { rel: ".oh/scripts/check-host-port.sh", body: check_host_port_default, mode: 493 }
+    { dest: join5(entry, ".devcontainer", "docker-compose.ssh.yml"), body: docker_compose_ssh_default, mode: 420 },
+    { dest: join5(entry, ".devcontainer", "docker-compose.docker-sock.yml"), body: docker_compose_docker_sock_default, mode: 420 },
+    { dest: join5(scripts, "docker-compose.sh"), body: docker_compose_default2, mode: 493 },
+    { dest: join5(scripts, "compat.sh"), body: compat_default, mode: 420 },
+    { dest: join5(scripts, "check-host-port.sh"), body: check_host_port_default, mode: 493 }
   ];
   for (const file of files) {
-    const dest = resolve6(entry, file.rel);
-    if (!dest.startsWith(entry + sep2)) {
+    const dest = resolve7(file.dest);
+    if (!dest.startsWith(entry + sep3)) {
       throw new Error(`refusing to materialize outside the sandbox entry: ${dest}`);
     }
-    mkdirSync3(dirname4(dest), { recursive: true });
+    mkdirSync4(dirname6(dest), { recursive: true });
     writeFileSync4(dest, file.body, { mode: file.mode, encoding: "utf8" });
   }
 }
@@ -2558,23 +2603,23 @@ function resolveSandboxRoot(opts = {}) {
     const root = entryRoot(opts.name);
     if (!isDirectory(root)) {
       throw new Error(
-        `no sandbox named \`${opts.name}\` in ${registryRoot()} \u2014 create one with \`oh sandbox install docker --name ${opts.name}\``
+        `no sandbox named \`${opts.name}\` in ${registryRoot()} \u2014 create one with \`${activeBin()} sandbox install docker --name ${opts.name}\``
       );
     }
     return root;
   }
   const names = listEntries();
   if (names.length === 1) return entryRoot(names[0]);
-  const cwd = resolve6(opts.cwd ?? process.cwd());
+  const cwd = resolve7(opts.cwd ?? process.cwd());
   for (const name of names) {
     const repo = entryRepo(name);
-    if (repo !== void 0 && (cwd === repo || cwd.startsWith(repo + sep2))) {
+    if (repo !== void 0 && (cwd === repo || cwd.startsWith(repo + sep3))) {
       return entryRoot(name);
     }
   }
   if (names.length === 0) {
     throw new Error(
-      `no sandbox is registered in ${registryRoot()} \u2014 create one with \`oh sandbox install docker\``
+      `no sandbox is registered in ${registryRoot()} \u2014 create one with \`${activeBin()} sandbox install docker\``
     );
   }
   throw new Error(
@@ -2582,333 +2627,131 @@ function resolveSandboxRoot(opts = {}) {
   );
 }
 
-// src/commands/config.ts
-function configRoot(opts) {
-  return opts.sandbox === void 0 ? resolveProjectRoot(opts.cwd) : resolveSandboxRoot({ name: opts.sandbox });
-}
-function configFieldList() {
-  return ohConfigFieldPaths().map((path4) => `  ${path4}`).join("\n");
-}
-async function runConfigShow(opts, io) {
-  const root = configRoot(opts);
-  const config = readOhConfig(ohConfigPath(root));
-  io.stdout(`${JSON.stringify(config, null, 2)}
-`);
-  return 0;
-}
-async function runConfigSet(key, value, opts, io) {
-  if (isSecretKey(key) || isSecretKey(key.toUpperCase())) {
-    io.stderr(
-      `oh config set: ${key.toUpperCase()} is a secret \u2014 oh.json is tracked by git.
-Set it with \`oh secret set ${key.toUpperCase()}\` instead.
-`
-    );
-    return 1;
-  }
-  if (!findOhConfigField(key)) {
-    io.stderr(`oh config set: unknown field "${key}"
+// src/lib/secrets.ts
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
+import { resolve as resolve8 } from "node:path";
 
-Fields:
-${configFieldList()}
-`);
-    return 1;
+// src/lib/env.ts
+import {
+  readFileSync as readFileSync7,
+  writeFileSync as writeFileSync5,
+  existsSync as existsSync9,
+  fsyncSync as fsyncSync2,
+  renameSync as renameSync4,
+  unlinkSync as unlinkSync4,
+  openSync as openSync2,
+  closeSync as closeSync2
+} from "node:fs";
+function loadEnvInto(envPath, env) {
+  if (!existsSync9(envPath)) return;
+  const content = readFileSync7(envPath, "utf8");
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trimEnd();
+    if (line === "" || /^\s*#/.test(line)) continue;
+    const eqIdx = line.indexOf("=");
+    if (eqIdx < 1) continue;
+    const key = line.slice(0, eqIdx).trim();
+    const value = line.slice(eqIdx + 1);
+    if (key === "") continue;
+    if (env[key] === void 0) env[key] = value;
   }
-  const root = configRoot(opts);
-  let outcome;
+}
+function writeEnvFile(envPath, content) {
+  const tmpPath = `${envPath}.tmp.${process.pid}`;
+  let fd;
   try {
-    outcome = setConfigField(root, key, value);
-  } catch (error) {
-    io.stderr(`oh config set: ${error instanceof Error ? error.message : String(error)}
-`);
-    return 1;
+    fd = openSync2(tmpPath, "w", 384);
+    writeFileSync5(tmpPath, content, "utf8");
+    fsyncSync2(fd);
+    closeSync2(fd);
+    fd = void 0;
+    renameSync4(tmpPath, envPath);
+  } catch (err) {
+    if (fd !== void 0) {
+      try {
+        closeSync2(fd);
+      } catch {
+      }
+    }
+    try {
+      unlinkSync4(tmpPath);
+    } catch {
+    }
+    throw err;
   }
-  io.stdout(
-    outcome === "already-set" ? `oh.json: ${key} already ${value}
-` : `oh.json: set ${key}=${value} (${outcome})
-`
-  );
-  return 0;
 }
-var UPSTREAM_REMOTE = "openharness";
-function repoUrl(owner, name) {
-  return `git@github.com:${owner}/${name}.git`;
+
+// src/lib/secrets.ts
+var SECRETS_FILE = ".env";
+var SECRET_KEYS = [
+  "GH_TOKEN",
+  "XAI_API_KEY",
+  "META_API_KEY",
+  "SANDBOX_PASSWORD",
+  "PI_SLACK_APP_TOKEN",
+  "PI_SLACK_BOT_TOKEN",
+  "LANGFUSE_PUBLIC_KEY",
+  "LANGFUSE_SECRET_KEY"
+];
+var ALLOWED = new Set(SECRET_KEYS);
+function secretsFilePath(root) {
+  return resolve8(root, SECRETS_FILE);
 }
-function shellLine(step) {
-  return `${step.cmd} ${step.args.join(" ")}`;
+function isSecretKey(key) {
+  return ALLOWED.has(key);
 }
-function manualSteps(owner, name, visibility) {
-  return [
-    { cmd: "gh", args: ["repo", "create", `${owner}/${name}`, `--${visibility}`] },
-    { cmd: "git", args: ["remote", "rename", "origin", UPSTREAM_REMOTE] },
-    { cmd: "git", args: ["remote", "add", "origin", repoUrl(owner, name)] },
-    { cmd: "git", args: ["push", "-u", "origin", "HEAD"] }
-  ];
+function assertSecretKey(key) {
+  if (ALLOWED.has(key)) return;
+  throw new Error(
+    `${key} is not a secret \u2014 non-secret settings live in oh.json; use \`${activeBin()} config set\` instead`
+  );
 }
-function printManual(io, steps, lead) {
-  io.stdout(`
-${lead}
-
-`);
-  for (const step of steps) io.stdout(`    ${shellLine(step)}
-`);
-  io.stdout("\n");
+function readSecret(root, key) {
+  assertSecretKey(key);
+  const file = secretsFilePath(root);
+  if (!existsSync10(file)) return void 0;
+  const env = {};
+  loadEnvInto(file, env);
+  const value = env[key]?.trim();
+  return value === void 0 || value === "" ? void 0 : stripQuotes2(value);
 }
-function validateSegment(kind, value) {
-  if (value === "") return `${kind} is required`;
-  if (value.startsWith("-")) return `invalid ${kind} "${value}" (must not start with "-")`;
-  if (!/^[A-Za-z0-9._-]+$/.test(value)) {
-    return `invalid ${kind} "${value}" (use letters, digits, ".", "_" or "-")`;
-  }
-  return void 0;
-}
-async function askOn(io, question) {
-  const askFn = io.ask ?? ask;
-  return (await askFn(question)).trim();
-}
-async function confirmOn(io, question, defaultYes) {
-  const answer = (await askOn(io, `${question} ${defaultYes ? "[Y/n]" : "[y/N]"}`)).toLowerCase();
-  if (answer === "") return defaultYes;
-  return /^y/.test(answer);
-}
-async function askVisibility(io) {
-  io.stdout("  Repository visibility\n    1) private (recommended)\n    2) public\n");
-  for (; ; ) {
-    const answer = await askOn(io, "Choose [1-2] (default 1):");
-    if (answer === "" || answer === "1") return "private";
-    if (answer === "2") return "public";
-    io.stderr("  Invalid choice. Pick 1 or 2.\n");
-  }
-}
-async function runConfigRepo(opts, io) {
-  const run = opts.run ?? spawnRunner;
-  const isTTY = io.isTTY ?? process.stdin.isTTY === true;
-  if (!isTTY) {
-    io.stderr(
-      "oh config repo: creating a repo on your GitHub account needs an interactive terminal; re-run it from a TTY.\n"
-    );
-    return 1;
-  }
-  io.stdout(`
-${bold("Version this harness in your own repo")}
-`);
-  io.stdout(
-    `  Creates a repo on your GitHub account, keeps the upstream you cloned from
-  as the "${UPSTREAM_REMOTE}" remote, and pushes this branch to yours.
-`
-  );
-  if (!await confirmOn(io, "Version this harness in your own repo?", false)) {
-    printManual(
-      io,
-      manualSteps("<your-user>", "<repo>", "private"),
-      "Skipped \u2014 nothing was created and no remote was touched. To do it later, run `oh config repo`, or by hand:"
-    );
-    return 0;
-  }
-  const owner = await askOn(io, "GitHub owner (user or org):");
-  const ownerError = validateSegment("GitHub owner", owner);
-  if (ownerError) {
-    io.stderr(`oh config repo: ${ownerError}
-`);
-    return 1;
-  }
-  const name = await askOn(io, "Repository name [openharness]:");
-  const repoName = name === "" ? "openharness" : name;
-  const nameError = validateSegment("repository name", repoName);
-  if (nameError) {
-    io.stderr(`oh config repo: ${nameError}
-`);
-    return 1;
-  }
-  const visibility = await askVisibility(io);
-  const url = repoUrl(owner, repoName);
-  const manual = manualSteps(owner, repoName, visibility);
-  let root;
-  try {
-    root = resolveProjectRoot(opts.cwd);
-  } catch (error) {
-    io.stderr(`oh config repo: ${error instanceof Error ? error.message : String(error)}
-`);
-    printManual(io, manual, "Nothing was changed. Finish this by hand from your checkout:");
-    return 1;
-  }
-  const capture2 = { stdio: "capture", cwd: root };
-  const auth = run("gh", ["auth", "status"], capture2);
-  if (auth.error?.code === "ENOENT") {
-    printManual(io, manual, "gh is not on PATH \u2014 finish this by hand:");
-    return 0;
-  }
-  assertSpawned(auth, "gh auth status");
-  if (auth.status !== 0) {
-    printManual(
-      io,
-      manual,
-      "gh is not authenticated (`gh auth login`) \u2014 finish this by hand once it is:"
-    );
-    return 0;
-  }
-  const remotesResult = run("git", ["remote"], capture2);
-  assertSpawned(remotesResult, "git remote");
-  if (remotesResult.status !== 0) {
-    printManual(io, manual, "`git remote` failed \u2014 is this a git repo? Finish this by hand:");
-    return 0;
-  }
-  const remotes = (remotesResult.stdout ?? "").split("\n").map((line) => line.trim()).filter((line) => line !== "");
-  let originUrl = "";
-  if (remotes.includes("origin")) {
-    const shown = run("git", ["remote", "get-url", "origin"], capture2);
-    assertSpawned(shown, "git remote get-url origin");
-    originUrl = (shown.stdout ?? "").trim();
-  }
-  const originIsTarget = originUrl !== "" && sameRemote(originUrl, owner, repoName);
-  if (!originIsTarget && remotes.includes("origin") && remotes.includes(UPSTREAM_REMOTE)) {
-    io.stderr(
-      `oh config repo: origin already points at ${originUrl} and a "${UPSTREAM_REMOTE}" remote already exists \u2014 nothing was changed. Sort the remotes out by hand:
-`
-    );
-    printManual(io, manual.slice(2), "Remaining steps:");
-    return 1;
-  }
-  const steps = [];
-  const exists = run("gh", ["repo", "view", `${owner}/${repoName}`], capture2);
-  assertSpawned(exists, "gh repo view");
-  if (exists.status === 0) {
-    io.stdout(`  ${owner}/${repoName} already exists \u2014 skipping creation.
-`);
-  } else {
-    steps.push(manual[0]);
-  }
-  if (originIsTarget) {
-    io.stdout("  origin already points at your repo \u2014 leaving the remotes alone.\n");
-  } else {
-    if (remotes.includes("origin")) steps.push(manual[1]);
-    steps.push(manual[2]);
-  }
-  steps.push(manual[3]);
-  for (let i = 0; i < steps.length; i++) {
-    const step = steps[i];
-    io.stdout(`  $ ${shellLine(step)}
-`);
-    const result = run(step.cmd, step.args, { stdio: "inherit", cwd: root });
-    if (result.error || result.status !== 0) {
-      const detail = result.error?.message ?? `exit ${result.status}`;
-      io.stderr(`oh config repo: ${shellLine(step)} failed (${detail}) \u2014 stopping here.
-`);
-      const remaining = steps.slice(i + 1);
-      if (remaining.length > 0) {
-        printManual(io, remaining, "Not run. Finish by hand once the failure is fixed:");
-      }
-      return 1;
-    }
-  }
-  io.stdout(
-    `
-  Done \u2014 origin is ${url}${remotes.includes("origin") && !originIsTarget ? `, upstream kept as "${UPSTREAM_REMOTE}"` : ""}.
-`
-  );
-  return 0;
-}
-function sameRemote(url, owner, name) {
-  const normalized = url.replace(/\.git$/, "").toLowerCase();
-  const slug = `${owner}/${name}`.toLowerCase();
-  return normalized.endsWith(`:${slug}`) || normalized.endsWith(`/${slug}`);
-}
-
-// src/commands/secret.ts
-import { existsSync as existsSync12 } from "node:fs";
-import { join as join7 } from "node:path";
-
-// src/lib/gitignore.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname5, join as join6 } from "node:path";
-function appendGitignoreLines(root, lines) {
-  const target = join6(root, ".gitignore");
-  const existing = existsSync11(target) ? readFileSync9(target, "utf8") : "";
-  const present = new Set(existing.split("\n").map((line) => line.trimEnd()));
-  const added = [];
-  for (const line of lines) {
-    const key = line.trimEnd();
-    if (key === "" || present.has(key)) continue;
-    present.add(key);
-    added.push(line);
+function setSecret(root, key, value) {
+  assertSecretKey(key);
+  if (/[\r\n]/.test(value)) {
+    throw new Error(`${key} value must not contain a newline`);
   }
-  if (added.length === 0) return added;
-  let output = existing;
-  if (output.length > 0 && !output.endsWith("\n")) output += "\n";
-  output += `${added.join("\n")}
-`;
-  mkdirSync4(dirname5(target), { recursive: true });
-  writeFileSync5(target, output, "utf8");
-  return added;
-}
-
-// src/commands/secret.ts
-function secretsRoot(opts) {
-  return opts.sandbox === void 0 ? resolveProjectRoot(opts.cwd) : resolveSandboxRoot({ name: opts.sandbox });
-}
-function ignoreSecretsFile(root) {
-  if (!existsSync12(join7(root, ".git"))) return;
-  appendGitignoreLines(root, [".env"]);
-}
-function secretKeyList() {
-  return SECRET_KEYS.map((key) => `  ${key}`).join("\n");
+  const file = secretsFilePath(root);
+  assertInRoot(file, resolve8(root));
+  const original = existsSync10(file) ? readFileSync8(file, "utf8") : "";
+  const { content } = setKeyInEnv(original, key, value);
+  writeEnvFile(file, content);
 }
-async function runSecretSet(key, opts, io) {
-  if (!isSecretKey(key)) {
-    io.stderr(
-      `oh secret set: ${key} is not a secret \u2014 non-secret settings live in oh.json.
-Set it with \`oh config set ${key}\` instead.
-
-Keys:
-${secretKeyList()}
-`
-    );
-    return 1;
-  }
-  const root = secretsRoot(opts);
-  const askSecret2 = io.askSecret ?? askSecret;
-  const value = (await askSecret2(`Value for ${bold(key)} (input hidden):`)).trim();
-  if (value === "") {
-    io.stderr(`oh secret set: no value entered \u2014 ${key} unchanged
-`);
-    return 1;
-  }
-  try {
-    setSecret(root, key, value);
-    ignoreSecretsFile(root);
-  } catch (error) {
-    io.stderr(`oh secret set: ${error instanceof Error ? error.message : String(error)}
-`);
-    return 1;
-  }
-  io.stdout(`.env: set ${key}=${redact(value)}
-`);
-  return 0;
+function listSecretKeys(root) {
+  const file = secretsFilePath(root);
+  if (!existsSync10(file)) return [];
+  const env = {};
+  loadEnvInto(file, env);
+  return SECRET_KEYS.filter((key) => {
+    const value = env[key]?.trim();
+    return value !== void 0 && value !== "";
+  });
 }
-async function runSecretList(opts, io) {
-  const root = secretsRoot(opts);
-  const keys = listSecretKeys(root);
-  if (keys.length === 0) {
-    io.stdout("no secrets set \u2014 write one with `oh secret set <KEY>`\n");
-    return 0;
-  }
-  const width = Math.max(...keys.map((key) => key.length));
-  for (const key of keys) {
-    const value = readSecret(root, key);
-    io.stdout(`${key.padEnd(width)}  ${value === void 0 ? "\u2014" : redact(value)}
-`);
+function stripQuotes2(s) {
+  if (s.length >= 2 && (s[0] === '"' && s.endsWith('"') || s[0] === "'" && s.endsWith("'"))) {
+    return s.slice(1, -1);
   }
-  return 0;
+  return s;
 }
 
 // src/commands/lifecycle.ts
-import { existsSync as existsSync14, mkdtempSync, readFileSync as readFileSync10, rmSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync12, mkdtempSync, readFileSync as readFileSync9, rmSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename as basename4, join as join8, sep as sep3 } from "node:path";
+import { basename as basename5, join as join6, sep as sep4 } from "node:path";
 
 // src/lib/execution/detect.ts
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 var SANDBOX_MARKER_FILE = "/.dockerenv";
-function runningInsideSandbox(env = process.env, fileExists = existsSync13) {
+function runningInsideSandbox(env = process.env, fileExists = existsSync11) {
   const override = resolveAliasedEnv(env, "EXECUTION_TARGET").value;
   if (override === "local") return true;
   if (override === "docker-compose") return false;
@@ -3065,10 +2908,10 @@ var LocalExecutionTarget = class {
     this.workspace = { hostRoot: opts.projectRoot, targetRoot: opts.projectRoot };
   }
   async provision() {
-    throw new HostOnlyError("`oh sandbox`");
+    throw new HostOnlyError(`\`${activeBin()} sandbox\``);
   }
   async destroy() {
-    throw new HostOnlyError("`oh destroy`");
+    throw new HostOnlyError(`\`${activeBin()} destroy\``);
   }
   async status() {
     return "ready";
@@ -3151,6 +2994,7 @@ var RETIRED_KEYS = [
   "PROJECTS_DIR",
   "CRONS_DIR",
   "OH_PROJECT_ROOT",
+  "AGRO_PROJECT_ROOT",
   "INSTALL_DEEPAGENTS",
   "INSTALL_OPENCODE",
   "INSTALL_GROK_BUILD",
@@ -3174,24 +3018,24 @@ function renderComposeVars(config) {
   };
   put("SANDBOX_NAME", config.name);
   put("TZ", config.timezone);
-  put("OH_HOME_MOUNT", config.storage?.homePath);
-  put("OH_REPO_DIR", config.repo);
+  put("AGRO_HOME_MOUNT", config.storage?.homePath);
+  put("AGRO_REPO_DIR", configCheckout(config));
   put("GIT_USER_NAME", config.git?.userName);
   put("GIT_USER_EMAIL", config.git?.userEmail);
   put("DOCKER_SOCKET", config.access?.dockerSocket);
   put("SANDBOX_SSH", config.access?.ssh);
   put("SANDBOX_SSH_PORT", config.access?.sshPort);
-  put("OH_SANDBOX_IMAGE", config.image?.ref);
-  put("OH_PULL_POLICY", config.image?.pullPolicy);
+  put("AGRO_SANDBOX_IMAGE", config.image?.ref);
+  put("AGRO_PULL_POLICY", config.image?.pullPolicy);
   for (const { key, value } of out) {
     if (isSecretKey(key)) {
-      throw new Error(`refusing to render secret ${key} from oh.json`);
+      throw new Error(`refusing to render secret ${key} from the sandbox config`);
     }
     if (RETIRED_KEYS.includes(key)) {
       throw new Error(`refusing to render retired variable ${key}`);
     }
     if (/[\r\n]/.test(value)) {
-      throw new Error(`oh.json value for ${key} must not contain a newline`);
+      throw new Error(`config value for ${key} must not contain a newline`);
     }
   }
   return out;
@@ -3205,10 +3049,10 @@ function renderComposeEnv(config) {
 // src/commands/lifecycle.ts
 var COMPOSE_ENV_DIR_PREFIX = "oh-compose-env-";
 function composeEnvDir() {
-  return mkdtempSync(join8(tmpdir(), COMPOSE_ENV_DIR_PREFIX));
+  return mkdtempSync(join6(tmpdir(), COMPOSE_ENV_DIR_PREFIX));
 }
 function writeComposeEnv(root, dir) {
-  const file = join8(dir, "compose.env");
+  const file = join6(dir, "compose.env");
   writeFileSync6(file, renderComposeEnv(readOhConfig(ohConfigPath(root))), {
     mode: 384,
     encoding: "utf8"
@@ -3216,7 +3060,7 @@ function writeComposeEnv(root, dir) {
   return file;
 }
 function withComposeEnvFile(root, fn) {
-  if (!existsSync14(ohConfigPath(root))) return fn([]);
+  if (!existsSync12(ohConfigPath(root))) return fn([]);
   const dir = composeEnvDir();
   try {
     return fn(["--extra-env-file", writeComposeEnv(root, dir)]);
@@ -3225,7 +3069,7 @@ function withComposeEnvFile(root, fn) {
   }
 }
 async function withComposeEnvFileAsync(root, fn) {
-  if (!existsSync14(ohConfigPath(root))) return await fn([]);
+  if (!existsSync12(ohConfigPath(root))) return await fn([]);
   const dir = composeEnvDir();
   try {
     return await fn(["--extra-env-file", writeComposeEnv(root, dir)]);
@@ -3235,17 +3079,17 @@ async function withComposeEnvFileAsync(root, fn) {
 }
 function sandboxRoot(opts) {
   const root = resolveSandboxRoot({ name: opts.name, cwd: opts.cwd });
-  if (existsSync14(ohConfigPath(root))) {
+  if (existsSync12(ohConfigPath(root))) {
     const repo = configuredString(root, "repo");
     materialize(root, repo === void 0 ? {} : { repo });
   }
   return root;
 }
-var DEFAULT_CONTAINER_NAME = "openharness";
-var DEFAULT_SANDBOX_IMAGE = "ghcr.io/mifunedev/openharness:latest";
+var DEFAULT_CONTAINER_NAME = DEFAULT_SANDBOX_NAME;
+var DEFAULT_SANDBOX_IMAGE = "ghcr.io/mifunedev/agro:latest";
 function configuredField(root, path4) {
   const file = ohConfigPath(root);
-  if (!existsSync14(file)) return void 0;
+  if (!existsSync12(file)) return void 0;
   try {
     return getOhConfigValue(readOhConfig(file), path4);
   } catch {
@@ -3263,18 +3107,18 @@ function fromProcessEnv(key) {
 function dockerSocketConfigured(root) {
   return configuredField(root, "access.dockerSocket") !== void 0;
 }
-async function maybePromptDockerSocket(root, io) {
+async function maybePromptDockerSocket(root, io, bin) {
   if (dockerSocketConfigured(root)) return;
   const interactive = process.stdin.isTTY === true || io.ask !== void 0;
   if (!interactive) return;
-  const envDir = join8(root, ".devcontainer");
-  if (!existsSync14(envDir)) return;
+  const envDir = join6(root, ".devcontainer");
+  if (!existsSync12(envDir)) return;
   const askFn = io.ask ?? ask;
   const answer = (await askFn(
     "Mount host Docker socket into the sandbox? (effectively host root \u2014 enable only if the agent must drive Docker) [y/N]"
   )).trim().toLowerCase();
   const enabled = answer === "y" || answer === "yes";
-  setEnvValue(root, "DOCKER_SOCKET", enabled ? "true" : "false");
+  setEnvValue(root, "DOCKER_SOCKET", enabled ? "true" : "false", bin);
   io.stdout(
     enabled ? "DOCKER_SOCKET=true \u2014 host Docker socket will be mounted\n" : "DOCKER_SOCKET=false \u2014 host Docker socket stays unmounted\n"
   );
@@ -3288,7 +3132,7 @@ async function runSandbox(opts, io) {
   const useImage = opts.image === true || opts.imageRef !== void 0;
   const useNoBuild = useImage || opts.noBuild === true;
   const imageRef = useImage ? opts.imageRef ?? configuredImage(root) ?? DEFAULT_SANDBOX_IMAGE : void 0;
-  const env = imageRef === void 0 ? void 0 : { ...process.env, OH_SANDBOX_IMAGE: imageRef };
+  const env = imageRef === void 0 ? void 0 : { ...process.env, ...aliasedEnvPair("SANDBOX_IMAGE", imageRef) };
   if (opts.printArgv === true) {
     const script = requireLifecycleScript(root, "docker-compose.sh");
     return withComposeEnvFile(root, (extraArgs) => {
@@ -3311,11 +3155,11 @@ async function runSandbox(opts, io) {
     });
   }
   if (runningInsideSandbox()) {
-    io.stderr(`${new HostOnlyError("`oh sandbox`").message}
+    io.stderr(`${new HostOnlyError(`\`${opts.bin} sandbox\``).message}
 `);
     return 1;
   }
-  await maybePromptDockerSocket(root, io);
+  await maybePromptDockerSocket(root, io, opts.bin);
   requireLifecycleScript(root, "docker-compose.sh");
   if (imageRef !== void 0) {
     io.stdout(`image mode: ${imageRef} (skipping local build)
@@ -3358,142 +3202,487 @@ function runShell(opts, io) {
     code = target.attach({ argv: ["zsh"], user: "sandbox" });
   } catch (err) {
     if (err instanceof ExecutionSpawnError && err.code === "ENOENT") {
-      throw new Error("docker is required for `oh shell` but was not found on PATH");
+      throw new Error(`docker is required for \`${opts.bin} shell\` but was not found on PATH`);
+    }
+    throw err;
+  }
+  if (code !== 0) {
+    io.stderr(
+      `container \`${name}\` not running? start it with \`${opts.bin} sandbox install docker\`
+`
+    );
+  }
+  return code;
+}
+var COMPOSE_VERBS = Object.freeze({
+  stop: Object.freeze(["stop"]),
+  restart: Object.freeze(["restart"]),
+  logs: Object.freeze(["logs", "-f"]),
+  ps: Object.freeze(["ps"]),
+  destroy: Object.freeze(["down", "-v"])
+});
+function composeVerbs() {
+  return Object.keys(COMPOSE_VERBS);
+}
+function runComposeVerb(verb, opts, extra = []) {
+  const run = opts.run ?? spawnRunner;
+  const root = sandboxRoot(opts);
+  const script = requireLifecycleScript(root, "docker-compose.sh");
+  return withComposeEnvFile(root, (extraArgs) => {
+    const r = run("bash", [script, ...extraArgs, ...COMPOSE_VERBS[verb], ...extra], {
+      stdio: "inherit"
+    });
+    assertSpawned(r, `bash ${script} ${verb}`);
+    return r.status ?? 1;
+  });
+}
+function runComposeConfig(opts, extra = []) {
+  const run = opts.run ?? spawnRunner;
+  const root = sandboxRoot(opts);
+  const script = requireLifecycleScript(root, "docker-compose.sh");
+  return withComposeEnvFile(root, (extraArgs) => {
+    const r = run("bash", [script, ...extraArgs, "config", ...extra], { stdio: "inherit" });
+    assertSpawned(r, `bash ${script} config`);
+    return r.status ?? 1;
+  });
+}
+function namedVolumes(root) {
+  let text;
+  try {
+    text = readFileSync9(join6(root, ".devcontainer", "docker-compose.yml"), "utf8");
+  } catch {
+    return [];
+  }
+  const lines = text.split("\n");
+  const start = lines.findIndex((line) => /^volumes:\s*$/.test(line));
+  if (start === -1) return [];
+  const names = [];
+  for (const line of lines.slice(start + 1)) {
+    if (/^\S/.test(line)) break;
+    const match = /^ {2}([A-Za-z0-9][A-Za-z0-9_.-]*):\s*$/.exec(line);
+    if (match) names.push(match[1]);
+  }
+  return names;
+}
+function destroyConfirmationPhrase(root) {
+  return configuredContainerName(root) ?? DEFAULT_CONTAINER_NAME;
+}
+async function runDestroy(opts, io) {
+  const root = sandboxRoot(opts);
+  const name = destroyConfirmationPhrase(root);
+  if (opts.yes !== true) {
+    const interactive = process.stdin.isTTY === true || io.ask !== void 0;
+    if (!interactive) {
+      io.stderr(
+        `${opts.bin} destroy: refusing to destroy \`${name}\` without a terminal \u2014 re-run with --yes to confirm non-interactively
+`
+      );
+      return 1;
+    }
+    const homePath = readOhConfig(ohConfigPath(root)).storage?.homePath;
+    io.stdout(`
+${bold(`${opts.bin} destroy \u2014 ${name}`)}
+
+`);
+    if (homePath !== void 0 && homePath !== "") {
+      io.stdout("`docker compose down -v` removes the containers.\n");
+      io.stdout(
+        `This sandbox keeps its home on a host bind at ${homePath}, which \`down -v\`
+does not touch \u2014 every agent CLI login, the gh CLI token, and the SSH keys
+stay there. Delete that directory yourself if you also want them gone.
+
+`
+      );
+    } else {
+      const volumes = namedVolumes(root).map((volume) => `${name}_${volume}`);
+      io.stdout("`docker compose down -v` removes the containers and deletes\n");
+      io.stdout(
+        volumes.length > 0 ? `these named volumes with everything in them:
+
+  ${volumes.join("\n  ")}
+
+` : "every named volume this project owns, with everything in them.\n\n"
+      );
+      io.stdout(
+        "That is the provider authentication those volumes hold \u2014 every agent CLI\nlogin, the gh CLI token, and the SSH keys. Sign-in starts over.\n\n"
+      );
+    }
+    const askFn = io.ask ?? ask;
+    const answer = (await askFn(`Type the sandbox name \`${name}\` to destroy it:`)).trim();
+    if (answer !== name) {
+      io.stderr(`${opts.bin} destroy: aborted \u2014 nothing was removed
+`);
+      return 1;
+    }
+  }
+  const code = runComposeVerb("destroy", { ...opts, name: basename5(root) });
+  if (code === 0 && root.startsWith(registryRoot() + sep4)) {
+    rmSync(root, { recursive: true, force: true });
+    io.stdout(`removed the sandbox entry ${root}
+`);
+  }
+  return code;
+}
+function runGateway(args, opts) {
+  const run = opts.run ?? spawnRunner;
+  const root = resolveProjectRoot(opts.cwd);
+  const script = requireLifecycleScript(root, "gateway.sh");
+  const r = run("bash", [script, ...args], {
+    stdio: "inherit",
+    env: { ...process.env, ...aliasedEnvPair("PROJECT_ROOT", root) }
+  });
+  assertSpawned(r, `bash ${script}`);
+  return r.status ?? 1;
+}
+
+// src/commands/config.ts
+var HOME_PATH_FIELD = "storage.homePath";
+function currentHomePath(root) {
+  return readOhConfig(ohConfigPath(root)).storage?.homePath;
+}
+function existingNamedVolume(root, run) {
+  const project = destroyConfirmationPhrase(root);
+  for (const volume of namedVolumes(root).map((name) => `${project}_${name}`)) {
+    const result = run("docker", ["volume", "inspect", volume], { stdio: "capture" });
+    if (result.error === void 0 && result.status === 0) return volume;
+  }
+  return void 0;
+}
+function configRoot(opts) {
+  return opts.sandbox === void 0 ? resolveProjectRoot(opts.cwd) : resolveSandboxRoot({ name: opts.sandbox });
+}
+function configFieldList() {
+  return ohConfigFieldPaths().map((path4) => `  ${path4}`).join("\n");
+}
+async function runConfigShow(opts, io) {
+  const root = configRoot(opts);
+  const config = readOhConfig(ohConfigPath(root));
+  io.stdout(`${JSON.stringify(config, null, 2)}
+`);
+  return 0;
+}
+async function runConfigSet(key, value, opts, io) {
+  if (isSecretKey(key) || isSecretKey(key.toUpperCase())) {
+    io.stderr(
+      `${opts.bin} config set: ${key.toUpperCase()} is a secret \u2014 oh.json is tracked by git.
+Set it with \`${opts.bin} secret set ${key.toUpperCase()}\` instead.
+`
+    );
+    return 1;
+  }
+  if (!findOhConfigField(key)) {
+    io.stderr(`${opts.bin} config set: unknown field "${key}"
+
+Fields:
+${configFieldList()}
+`);
+    return 1;
+  }
+  const root = configRoot(opts);
+  if (key === HOME_PATH_FIELD && opts.force !== true && currentHomePath(root) !== value) {
+    const volume = existingNamedVolume(root, opts.run ?? spawnRunner);
+    if (volume !== void 0) {
+      io.stderr(
+        `${opts.bin} config set: ${HOME_PATH_FIELD} refused \u2014 the named volume ${volume} already exists.
+The next start would mount ${value} at /home/sandbox instead, and every file already in ${volume} would be orphaned there, invisible to the sandbox.
+Pass --force to change it anyway.
+`
+      );
+      return 1;
+    }
+  }
+  let outcome;
+  try {
+    outcome = setConfigField(root, key, value);
+  } catch (error) {
+    io.stderr(`${opts.bin} config set: ${error instanceof Error ? error.message : String(error)}
+`);
+    return 1;
+  }
+  io.stdout(
+    outcome === "already-set" ? `oh.json: ${key} already ${value}
+` : `oh.json: set ${key}=${value} (${outcome})
+`
+  );
+  return 0;
+}
+var UPSTREAM_REMOTE = "openharness";
+function repoUrl(owner, name) {
+  return `git@github.com:${owner}/${name}.git`;
+}
+function shellLine(step) {
+  return `${step.cmd} ${step.args.join(" ")}`;
+}
+function manualSteps(owner, name, visibility) {
+  return [
+    { cmd: "gh", args: ["repo", "create", `${owner}/${name}`, `--${visibility}`] },
+    { cmd: "git", args: ["remote", "rename", "origin", UPSTREAM_REMOTE] },
+    { cmd: "git", args: ["remote", "add", "origin", repoUrl(owner, name)] },
+    { cmd: "git", args: ["push", "-u", "origin", "HEAD"] }
+  ];
+}
+function printManual(io, steps, lead) {
+  io.stdout(`
+${lead}
+
+`);
+  for (const step of steps) io.stdout(`    ${shellLine(step)}
+`);
+  io.stdout("\n");
+}
+function validateSegment(kind, value) {
+  if (value === "") return `${kind} is required`;
+  if (value.startsWith("-")) return `invalid ${kind} "${value}" (must not start with "-")`;
+  if (!/^[A-Za-z0-9._-]+$/.test(value)) {
+    return `invalid ${kind} "${value}" (use letters, digits, ".", "_" or "-")`;
+  }
+  return void 0;
+}
+async function askOn(io, question) {
+  const askFn = io.ask ?? ask;
+  return (await askFn(question)).trim();
+}
+async function confirmOn(io, question, defaultYes) {
+  const answer = (await askOn(io, `${question} ${defaultYes ? "[Y/n]" : "[y/N]"}`)).toLowerCase();
+  if (answer === "") return defaultYes;
+  return /^y/.test(answer);
+}
+async function askVisibility(io) {
+  io.stdout("  Repository visibility\n    1) private (recommended)\n    2) public\n");
+  for (; ; ) {
+    const answer = await askOn(io, "Choose [1-2] (default 1):");
+    if (answer === "" || answer === "1") return "private";
+    if (answer === "2") return "public";
+    io.stderr("  Invalid choice. Pick 1 or 2.\n");
+  }
+}
+async function runConfigRepo(opts, io) {
+  const run = opts.run ?? spawnRunner;
+  const isTTY = io.isTTY ?? process.stdin.isTTY === true;
+  if (!isTTY) {
+    io.stderr(
+      `${opts.bin} config repo: creating a repo on your GitHub account needs an interactive terminal; re-run it from a TTY.
+`
+    );
+    return 1;
+  }
+  io.stdout(`
+${bold("Version this harness in your own repo")}
+`);
+  io.stdout(
+    `  Creates a repo on your GitHub account, keeps the upstream you cloned from
+  as the "${UPSTREAM_REMOTE}" remote, and pushes this branch to yours.
+`
+  );
+  if (!await confirmOn(io, "Version this harness in your own repo?", false)) {
+    printManual(
+      io,
+      manualSteps("<your-user>", "<repo>", "private"),
+      `Skipped \u2014 nothing was created and no remote was touched. To do it later, run \`${opts.bin} config repo\`, or by hand:`
+    );
+    return 0;
+  }
+  const owner = await askOn(io, "GitHub owner (user or org):");
+  const ownerError = validateSegment("GitHub owner", owner);
+  if (ownerError) {
+    io.stderr(`${opts.bin} config repo: ${ownerError}
+`);
+    return 1;
+  }
+  const name = await askOn(io, "Repository name [openharness]:");
+  const repoName = name === "" ? "openharness" : name;
+  const nameError = validateSegment("repository name", repoName);
+  if (nameError) {
+    io.stderr(`${opts.bin} config repo: ${nameError}
+`);
+    return 1;
+  }
+  const visibility = await askVisibility(io);
+  const url = repoUrl(owner, repoName);
+  const manual = manualSteps(owner, repoName, visibility);
+  let root;
+  try {
+    root = resolveProjectRoot(opts.cwd);
+  } catch (error) {
+    io.stderr(`${opts.bin} config repo: ${error instanceof Error ? error.message : String(error)}
+`);
+    printManual(io, manual, "Nothing was changed. Finish this by hand from your checkout:");
+    return 1;
+  }
+  const capture2 = { stdio: "capture", cwd: root };
+  const auth = run("gh", ["auth", "status"], capture2);
+  if (auth.error?.code === "ENOENT") {
+    printManual(io, manual, "gh is not on PATH \u2014 finish this by hand:");
+    return 0;
+  }
+  assertSpawned(auth, "gh auth status");
+  if (auth.status !== 0) {
+    printManual(
+      io,
+      manual,
+      "gh is not authenticated (`gh auth login`) \u2014 finish this by hand once it is:"
+    );
+    return 0;
+  }
+  const remotesResult = run("git", ["remote"], capture2);
+  assertSpawned(remotesResult, "git remote");
+  if (remotesResult.status !== 0) {
+    printManual(io, manual, "`git remote` failed \u2014 is this a git repo? Finish this by hand:");
+    return 0;
+  }
+  const remotes = (remotesResult.stdout ?? "").split("\n").map((line) => line.trim()).filter((line) => line !== "");
+  let originUrl = "";
+  if (remotes.includes("origin")) {
+    const shown = run("git", ["remote", "get-url", "origin"], capture2);
+    assertSpawned(shown, "git remote get-url origin");
+    originUrl = (shown.stdout ?? "").trim();
+  }
+  const originIsTarget = originUrl !== "" && sameRemote(originUrl, owner, repoName);
+  if (!originIsTarget && remotes.includes("origin") && remotes.includes(UPSTREAM_REMOTE)) {
+    io.stderr(
+      `${opts.bin} config repo: origin already points at ${originUrl} and a "${UPSTREAM_REMOTE}" remote already exists \u2014 nothing was changed. Sort the remotes out by hand:
+`
+    );
+    printManual(io, manual.slice(2), "Remaining steps:");
+    return 1;
+  }
+  const steps = [];
+  const exists = run("gh", ["repo", "view", `${owner}/${repoName}`], capture2);
+  assertSpawned(exists, "gh repo view");
+  if (exists.status === 0) {
+    io.stdout(`  ${owner}/${repoName} already exists \u2014 skipping creation.
+`);
+  } else {
+    steps.push(manual[0]);
+  }
+  if (originIsTarget) {
+    io.stdout("  origin already points at your repo \u2014 leaving the remotes alone.\n");
+  } else {
+    if (remotes.includes("origin")) steps.push(manual[1]);
+    steps.push(manual[2]);
+  }
+  steps.push(manual[3]);
+  for (let i = 0; i < steps.length; i++) {
+    const step = steps[i];
+    io.stdout(`  $ ${shellLine(step)}
+`);
+    const result = run(step.cmd, step.args, { stdio: "inherit", cwd: root });
+    if (result.error || result.status !== 0) {
+      const detail = result.error?.message ?? `exit ${result.status}`;
+      io.stderr(`${opts.bin} config repo: ${shellLine(step)} failed (${detail}) \u2014 stopping here.
+`);
+      const remaining = steps.slice(i + 1);
+      if (remaining.length > 0) {
+        printManual(io, remaining, "Not run. Finish by hand once the failure is fixed:");
+      }
+      return 1;
     }
-    throw err;
   }
-  if (code !== 0) {
-    io.stderr(
-      `container \`${name}\` not running? start it with \`oh sandbox install docker\`
+  io.stdout(
+    `
+  Done \u2014 origin is ${url}${remotes.includes("origin") && !originIsTarget ? `, upstream kept as "${UPSTREAM_REMOTE}"` : ""}.
 `
-    );
-  }
-  return code;
+  );
+  return 0;
 }
-var COMPOSE_VERBS = Object.freeze({
-  stop: Object.freeze(["stop"]),
-  restart: Object.freeze(["restart"]),
-  logs: Object.freeze(["logs", "-f"]),
-  ps: Object.freeze(["ps"]),
-  destroy: Object.freeze(["down", "-v"])
-});
-function composeVerbs() {
-  return Object.keys(COMPOSE_VERBS);
+function sameRemote(url, owner, name) {
+  const normalized = url.replace(/\.git$/, "").toLowerCase();
+  const slug = `${owner}/${name}`.toLowerCase();
+  return normalized.endsWith(`:${slug}`) || normalized.endsWith(`/${slug}`);
 }
-function runComposeVerb(verb, opts, extra = []) {
-  const run = opts.run ?? spawnRunner;
-  const root = sandboxRoot(opts);
-  const script = requireLifecycleScript(root, "docker-compose.sh");
-  return withComposeEnvFile(root, (extraArgs) => {
-    const r = run("bash", [script, ...extraArgs, ...COMPOSE_VERBS[verb], ...extra], {
-      stdio: "inherit"
-    });
-    assertSpawned(r, `bash ${script} ${verb}`);
-    return r.status ?? 1;
-  });
+
+// src/commands/secret.ts
+import { existsSync as existsSync14 } from "node:fs";
+import { join as join8 } from "node:path";
+
+// src/lib/gitignore.ts
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname7, join as join7 } from "node:path";
+function appendGitignoreLines(root, lines) {
+  const target = join7(root, ".gitignore");
+  const existing = existsSync13(target) ? readFileSync10(target, "utf8") : "";
+  const present = new Set(existing.split("\n").map((line) => line.trimEnd()));
+  const added = [];
+  for (const line of lines) {
+    const key = line.trimEnd();
+    if (key === "" || present.has(key)) continue;
+    present.add(key);
+    added.push(line);
+  }
+  if (added.length === 0) return added;
+  let output = existing;
+  if (output.length > 0 && !output.endsWith("\n")) output += "\n";
+  output += `${added.join("\n")}
+`;
+  mkdirSync5(dirname7(target), { recursive: true });
+  writeFileSync7(target, output, "utf8");
+  return added;
 }
-function runComposeConfig(opts, extra = []) {
-  const run = opts.run ?? spawnRunner;
-  const root = sandboxRoot(opts);
-  const script = requireLifecycleScript(root, "docker-compose.sh");
-  return withComposeEnvFile(root, (extraArgs) => {
-    const r = run("bash", [script, ...extraArgs, "config", ...extra], { stdio: "inherit" });
-    assertSpawned(r, `bash ${script} config`);
-    return r.status ?? 1;
-  });
+
+// src/commands/secret.ts
+function secretsRoot(opts) {
+  return opts.sandbox === void 0 ? resolveProjectRoot(opts.cwd) : resolveSandboxRoot({ name: opts.sandbox });
 }
-function namedVolumes(root) {
-  let text;
-  try {
-    text = readFileSync10(join8(root, ".devcontainer", "docker-compose.yml"), "utf8");
-  } catch {
-    return [];
-  }
-  const lines = text.split("\n");
-  const start = lines.findIndex((line) => /^volumes:\s*$/.test(line));
-  if (start === -1) return [];
-  const names = [];
-  for (const line of lines.slice(start + 1)) {
-    if (/^\S/.test(line)) break;
-    const match = /^ {2}([A-Za-z0-9][A-Za-z0-9_.-]*):\s*$/.exec(line);
-    if (match) names.push(match[1]);
-  }
-  return names;
+function ignoreSecretsFile(root) {
+  if (!existsSync14(join8(root, ".git"))) return;
+  appendGitignoreLines(root, [".env"]);
 }
-function destroyConfirmationPhrase(root) {
-  return configuredContainerName(root) ?? DEFAULT_CONTAINER_NAME;
+function secretKeyList() {
+  return SECRET_KEYS.map((key) => `  ${key}`).join("\n");
 }
-async function runDestroy(opts, io) {
-  const root = sandboxRoot(opts);
-  const name = destroyConfirmationPhrase(root);
-  if (opts.yes !== true) {
-    const interactive = process.stdin.isTTY === true || io.ask !== void 0;
-    if (!interactive) {
-      io.stderr(
-        `oh destroy: refusing to destroy \`${name}\` without a terminal \u2014 re-run with --yes to confirm non-interactively
-`
-      );
-      return 1;
-    }
-    const homePath = readOhConfig(ohConfigPath(root)).storage?.homePath;
-    io.stdout(`
-${bold(`oh destroy \u2014 ${name}`)}
-
-`);
-    if (homePath !== void 0 && homePath !== "") {
-      io.stdout("`docker compose down -v` removes the containers.\n");
-      io.stdout(
-        `This sandbox keeps its home on a host bind at ${homePath}, which \`down -v\`
-does not touch \u2014 every agent CLI login, the gh CLI token, and the SSH keys
-stay there. Delete that directory yourself if you also want them gone.
+async function runSecretSet(key, opts, io) {
+  if (!isSecretKey(key)) {
+    io.stderr(
+      `${opts.bin} secret set: ${key} is not a secret \u2014 non-secret settings live in oh.json.
+Set it with \`${opts.bin} config set ${key}\` instead.
 
+Keys:
+${secretKeyList()}
 `
-      );
-    } else {
-      const volumes = namedVolumes(root).map((volume) => `${name}_${volume}`);
-      io.stdout("`docker compose down -v` removes the containers and deletes\n");
-      io.stdout(
-        volumes.length > 0 ? `these named volumes with everything in them:
-
-  ${volumes.join("\n  ")}
-
-` : "every named volume this project owns, with everything in them.\n\n"
-      );
-      io.stdout(
-        "That is the provider authentication those volumes hold \u2014 every agent CLI\nlogin, the gh CLI token, and the SSH keys. Sign-in starts over.\n\n"
-      );
-    }
-    const askFn = io.ask ?? ask;
-    const answer = (await askFn(`Type the sandbox name \`${name}\` to destroy it:`)).trim();
-    if (answer !== name) {
-      io.stderr("oh destroy: aborted \u2014 nothing was removed\n");
-      return 1;
-    }
+    );
+    return 1;
   }
-  const code = runComposeVerb("destroy", { ...opts, name: basename4(root) });
-  if (code === 0 && root.startsWith(registryRoot() + sep3)) {
-    rmSync(root, { recursive: true, force: true });
-    io.stdout(`removed the sandbox entry ${root}
+  const root = secretsRoot(opts);
+  const askSecret2 = io.askSecret ?? askSecret;
+  const value = (await askSecret2(`Value for ${bold(key)} (input hidden):`)).trim();
+  if (value === "") {
+    io.stderr(`${opts.bin} secret set: no value entered \u2014 ${key} unchanged
 `);
+    return 1;
   }
-  return code;
+  try {
+    setSecret(root, key, value);
+    ignoreSecretsFile(root);
+  } catch (error) {
+    io.stderr(`${opts.bin} secret set: ${error instanceof Error ? error.message : String(error)}
+`);
+    return 1;
+  }
+  io.stdout(`.env: set ${key}=${redact(value)}
+`);
+  return 0;
 }
-function runGateway(args, opts) {
-  const run = opts.run ?? spawnRunner;
-  const root = resolveProjectRoot(opts.cwd);
-  const script = requireLifecycleScript(root, "gateway.sh");
-  const r = run("bash", [script, ...args], {
-    stdio: "inherit",
-    env: { ...process.env, OH_PROJECT_ROOT: root }
-  });
-  assertSpawned(r, `bash ${script}`);
-  return r.status ?? 1;
+async function runSecretList(opts, io) {
+  const root = secretsRoot(opts);
+  const keys = listSecretKeys(root);
+  if (keys.length === 0) {
+    io.stdout(`no secrets set \u2014 write one with \`${opts.bin} secret set <KEY>\`
+`);
+    return 0;
+  }
+  const width = Math.max(...keys.map((key) => key.length));
+  for (const key of keys) {
+    const value = readSecret(root, key);
+    io.stdout(`${key.padEnd(width)}  ${value === void 0 ? "\u2014" : redact(value)}
+`);
+  }
+  return 0;
 }
 
 // src/commands/sandbox.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "node:fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync2, rmSync as rmSync2, statSync as statSync4 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join9, resolve as resolve7 } from "node:path";
+import { join as join9, resolve as resolve9 } from "node:path";
 
 // src/lib/runtimes/catalog.ts
 var RUNTIME_CATALOG = Object.freeze([
@@ -3511,7 +3700,7 @@ var RUNTIME_CATALOG = Object.freeze([
     tier: "microvm",
     state: "planned",
     provisionable: false,
-    notProvisionableReason: "microsandbox is not a provisionable runtime yet; see docs/rfcs/rfc-runtime-support.md. Inside a sandbox run `oh tool install microsandbox`.",
+    notProvisionableReason: (bin) => `microsandbox is not a provisionable runtime yet; see docs/rfcs/rfc-runtime-support.md. Inside a sandbox run \`${bin} tool install microsandbox\`.`,
     docsPath: "docs/runtimes/microsandbox.md"
   })
 ]);
@@ -3537,26 +3726,70 @@ function gitIdentity(run, key) {
   if (result.error || result.status !== 0) return "";
   return (result.stdout ?? "").trim();
 }
+function isBuildCapable(repo) {
+  return repo !== void 0 && existsSync15(join9(repo, ".devcontainer", "Dockerfile"));
+}
+function prepareHomeMount(value) {
+  const path4 = resolve9(value);
+  if (existsSync15(path4)) {
+    if (!statSync4(path4).isDirectory()) {
+      throw new Error(`--home-mount path exists and is not a directory: ${path4}`);
+    }
+    return path4;
+  }
+  mkdirSync6(path4, { recursive: true });
+  return path4;
+}
 function readSeedConfig(repo) {
   if (repo === void 0) return void 0;
   const file = ohConfigPath(repo);
   return existsSync15(file) ? readOhConfig(file) : void 0;
 }
-function seedConfig(name, repo, seed, run) {
-  const config = defaultOhConfig(name);
+function readEntryConfig(name) {
+  const file = ohConfigPath(entryRoot(name));
+  return existsSync15(file) ? readOhConfig(file) : void 0;
+}
+function assignSetting(target, path4, value) {
+  const segments = path4.split(".");
+  let cursor = target;
+  for (const segment of segments.slice(0, -1)) {
+    const section = cursor[segment];
+    if (!section || typeof section !== "object" || Array.isArray(section)) cursor[segment] = {};
+    cursor = cursor[segment];
+  }
+  cursor[segments[segments.length - 1]] = value;
+}
+function overlaySettings(target, source) {
+  if (source === void 0) return target;
+  for (const field of OH_CONFIG_FIELDS) {
+    const value = getOhConfigValue(source, field.path);
+    if (value !== void 0) assignSetting(target, field.path, value);
+  }
+  return target;
+}
+function mergeSettings(...sources) {
+  const present = sources.filter((source) => source !== void 0);
+  if (present.length === 0) return void 0;
+  const merged = { version: 1 };
+  for (const source of present) overlaySettings(merged, source);
+  return merged;
+}
+function nonEmpty(value) {
+  return value === void 0 || value === "" ? void 0 : value;
+}
+function seedConfig(name, checkout, seed, run) {
+  const config = overlaySettings(defaultOhConfig(name), seed);
+  config.name = name;
   config.runtime = "docker";
-  if (repo !== void 0) config.repo = repo;
-  config.timezone = seed?.timezone ?? hostTimezone();
+  if (checkout !== void 0) config.checkout = checkout;
+  config.timezone = nonEmpty(seed?.timezone) ?? hostTimezone();
   config.git = {
-    userName: seed?.git?.userName ?? gitIdentity(run, "user.name"),
-    userEmail: seed?.git?.userEmail ?? gitIdentity(run, "user.email")
+    userName: nonEmpty(seed?.git?.userName) ?? gitIdentity(run, "user.name"),
+    userEmail: nonEmpty(seed?.git?.userEmail) ?? gitIdentity(run, "user.email")
   };
-  if (seed?.storage?.homePath !== void 0) config.storage = { homePath: seed.storage.homePath };
-  config.access = { ...config.access, ...seed?.access ?? {} };
   config.image = {
     ...config.image,
-    ...seed?.image ?? {},
-    mode: seed?.image?.mode ?? (repo === void 0 ? "image" : "build")
+    mode: seed?.image?.mode ?? (isBuildCapable(configCheckout(config)) ? "build" : "image")
   };
   return config;
 }
@@ -3596,48 +3829,89 @@ async function runWizard(config, io) {
     config.access?.dockerSocket === true
   );
   config.access = access;
+  const homePath = await askDefaulted(
+    ask2,
+    "Host path for /home/sandbox (blank keeps the Docker-managed volume)",
+    config.storage?.homePath ?? ""
+  );
+  if (homePath !== "") config.storage = { ...config.storage, homePath: resolve9(homePath) };
 }
 async function runSandboxInstall(opts, io) {
   const run = opts.run ?? spawnRunner;
   const runtime = findRuntime(opts.runtime);
   if (runtime === void 0) {
     io.stderr(
-      `oh sandbox install: unknown runtime "${opts.runtime}" \u2014 known runtimes: ${runtimeIds().join(", ")}
+      `${opts.bin} sandbox install: unknown runtime "${opts.runtime}" \u2014 known runtimes: ${runtimeIds().join(", ")}
 `
     );
     return 1;
   }
   if (!runtime.provisionable) {
-    io.stderr(`oh sandbox install: ${runtime.notProvisionableReason}
+    io.stderr(`${opts.bin} sandbox install: ${runtime.notProvisionableReason?.(opts.bin) ?? ""}
 `);
     return 1;
   }
-  const repo = opts.repo === void 0 ? void 0 : resolve7(opts.repo);
-  if (repo !== void 0 && !existsSync15(repo)) {
-    io.stderr(`oh sandbox install: --repo directory does not exist: ${repo}
+  const checkout = opts.checkout === void 0 ? void 0 : resolve9(opts.checkout);
+  if (checkout !== void 0 && !existsSync15(checkout)) {
+    io.stderr(`${opts.bin} sandbox install: --checkout directory does not exist: ${checkout}
 `);
     return 1;
   }
-  const seed = readSeedConfig(repo);
-  const name = opts.name ?? seed?.name ?? nextDefaultName(run);
+  const repoSeed = readSeedConfig(checkout);
+  const name = opts.name ?? repoSeed?.name ?? nextDefaultName(run);
   try {
     assertSandboxName(name);
   } catch (error) {
-    io.stderr(`oh sandbox install: ${error instanceof Error ? error.message : String(error)}
+    io.stderr(`${opts.bin} sandbox install: ${error instanceof Error ? error.message : String(error)}
 `);
     return 1;
   }
-  const config = seedConfig(name, repo, seed, run);
+  const config = seedConfig(name, checkout, mergeSettings(readEntryConfig(name), repoSeed), run);
+  const buildRequested = config.image?.mode === "build" && opts.noBuild !== true && opts.image !== true && opts.imageRef === void 0;
+  if (buildRequested && !isBuildCapable(configCheckout(config))) {
+    const target = configCheckout(config) ?? resolve9(opts.checkout ?? ".");
+    io.stderr(
+      `${opts.bin} sandbox install: image.mode is "build" but ${join9(target, ".devcontainer", "Dockerfile")} does not exist \u2014 point --checkout <dir> at a harness checkout that has .devcontainer/Dockerfile, or set image.mode to "image" to run the prebuilt image
+`
+    );
+    return 1;
+  }
+  if (opts.homeMount !== void 0) {
+    try {
+      config.storage = { ...config.storage, homePath: prepareHomeMount(opts.homeMount) };
+    } catch (error) {
+      io.stderr(`${opts.bin} sandbox install: ${error instanceof Error ? error.message : String(error)}
+`);
+      return 1;
+    }
+  }
   const interactive = opts.yes !== true && (process.stdin.isTTY === true || io.ask !== void 0);
+  const homePathBeforeWizard = config.storage?.homePath;
   if (interactive) {
     header("Configure the sandbox  (press Enter to accept the shown default)");
     await runWizard(config, io);
+    const chosen = config.storage?.homePath;
+    if (chosen !== void 0 && chosen !== homePathBeforeWizard) {
+      try {
+        config.storage = { ...config.storage, homePath: prepareHomeMount(chosen) };
+      } catch (error) {
+        io.stderr(
+          `${opts.bin} sandbox install: ${error instanceof Error ? error.message : String(error)}
+`
+        );
+        return 1;
+      }
+    }
   }
   if (opts.imageRef !== void 0) {
     config.image = { ...config.image, ref: opts.imageRef, mode: "image" };
   }
-  const useNoBuild = opts.noBuild === true || !(config.repo !== void 0 && config.image?.mode === "build");
+  if (configCheckout(config) !== void 0 && config.image?.mode === "image" && nonEmpty(config.image?.ref) === void 0) {
+    config.image = { ...config.image, ref: DEFAULT_SANDBOX_IMAGE };
+  }
+  const useNoBuild = opts.noBuild === true || !(configCheckout(config) !== void 0 && config.image?.mode === "build");
   const sandboxOpts = {
+    bin: opts.bin,
     run,
     ...opts.image === true ? { image: true } : {},
     ...opts.imageRef !== void 0 ? { imageRef: opts.imageRef } : {},
@@ -3647,18 +3921,18 @@ async function runSandboxInstall(opts, io) {
     const preview = mkdtempSync2(join9(tmpdir2(), "oh-sandbox-preview-"));
     try {
       writeOhConfig(preview, config);
-      materialize(preview, { ...config.repo !== void 0 ? { repo: config.repo } : {} });
+      materialize(preview, { ...configCheckout(config) !== void 0 ? { checkout: configCheckout(config) } : {} });
       return await runSandbox({ ...sandboxOpts, cwd: preview, printArgv: true }, io);
     } finally {
       rmSync2(preview, { recursive: true, force: true });
     }
   }
   const root = entryRoot(config.name);
-  mkdirSync5(root, { recursive: true });
+  mkdirSync6(root, { recursive: true });
   writeOhConfig(root, config);
-  materialize(root, { ...config.repo !== void 0 ? { repo: config.repo } : {} });
+  materialize(root, { ...configCheckout(config) !== void 0 ? { checkout: configCheckout(config) } : {} });
   const code = await runSandbox({ ...sandboxOpts, cwd: root }, io);
-  if (code === 0) io.stdout(`next: oh shell ${config.name}
+  if (code === 0) io.stdout(`next: ${opts.bin} shell ${config.name}
 `);
   return code;
 }
@@ -3676,10 +3950,12 @@ async function runSandboxList(opts, io) {
   for (const name of listEntries()) {
     const root = entryRoot(name);
     const config = readOhConfig(ohConfigPath(root));
+    const checkout = configCheckout(config) ?? "-";
     rows.push({
       name,
       runtime: config.runtime ?? "docker",
-      repo: config.repo ?? "-",
+      checkout,
+      repo: checkout,
       status: await entryStatus(root, name, run)
     });
   }
@@ -3690,7 +3966,7 @@ async function runSandboxList(opts, io) {
   }
   if (rows.length === 0) {
     io.stdout(
-      `no sandbox is registered in ${registryRoot()} \u2014 create one with \`oh sandbox install docker\`
+      `no sandbox is registered in ${registryRoot()} \u2014 create one with \`${opts.bin} sandbox install docker\`
 `
     );
     return 0;
@@ -3701,7 +3977,7 @@ async function runSandboxList(opts, io) {
   const statusWidth = width((row) => row.status);
   for (const row of rows) {
     io.stdout(
-      `${row.name.padEnd(nameWidth)}  ${row.runtime.padEnd(runtimeWidth)}  ${row.status.padEnd(statusWidth)}  ${row.repo}
+      `${row.name.padEnd(nameWidth)}  ${row.runtime.padEnd(runtimeWidth)}  ${row.status.padEnd(statusWidth)}  ${row.checkout}
 `
     );
   }
@@ -3709,7 +3985,7 @@ async function runSandboxList(opts, io) {
 }
 
 // src/lib/docs.ts
-var SOURCE_DOCS_BASE = "https://github.com/mifunedev/openharness/blob/main/";
+var SOURCE_DOCS_BASE = "https://github.com/mifunedev/agro/blob/main/";
 function sourceDocsUrl(docsPath) {
   const segments = docsPath.split("/");
   if (segments[0] !== "docs" || segments.length < 2 || segments.some((segment) => segment === "" || segment === "." || segment === "..") || docsPath.includes("\\") || docsPath.includes("?") || docsPath.includes("#")) {
@@ -3831,6 +4107,20 @@ var HARNESS_CATALOG = [
     docsPath: "docs/harnesses/muse-code.md",
     kind: "installable"
   },
+  {
+    id: "antigravity-cli",
+    title: "Antigravity CLI",
+    binary: "agy",
+    installArgv: [
+      "bash",
+      "-lc",
+      'set -o pipefail; curl -fsSL https://antigravity.google/cli/install.sh | bash -s -- --dir "$HOME/.local/bin"'
+    ],
+    installUser: "sandbox",
+    verifyArgv: ["agy", "--version"],
+    docsPath: "docs/harnesses/antigravity-cli.md",
+    kind: "installable"
+  },
   {
     id: "t3code",
     title: "T3 Code",
@@ -3904,7 +4194,7 @@ function cell(value, absent) {
   if (value === null) return absent;
   return value ? "yes" : "no";
 }
-function renderTable(states, io) {
+function renderTable(states, io, bin) {
   const header2 = ["HARNESS", "KIND", "INSTALLED"];
   const rows = states.map((s) => [s.id, s.kind, cell(s.installed, "?")]);
   const widths = header2.map(
@@ -3914,7 +4204,9 @@ function renderTable(states, io) {
   io.stdout(line(header2));
   for (const row of rows) io.stdout(line(row));
   if (states.some((s) => s.installed === null)) {
-    io.stdout("\nINSTALLED is `?` \u2014 the sandbox is not running. Start it with `oh sandbox`.\n");
+    io.stdout(`
+INSTALLED is \`?\` \u2014 the sandbox is not running. Start it with \`${bin} sandbox\`.
+`);
   }
 }
 async function runHarnessList(opts, io) {
@@ -3925,12 +4217,12 @@ async function runHarnessList(opts, io) {
     io.stdout(`${JSON.stringify(states, null, 2)}
 `);
   } else {
-    renderTable(states, io);
+    renderTable(states, io, opts.bin);
   }
   return 0;
 }
-function unknownHarness(name, io) {
-  io.stderr(`oh harness: unknown harness "${name}"
+function unknownHarness(name, io, bin) {
+  io.stderr(`${bin} harness: unknown harness "${name}"
 
 `);
   io.stderr(`Known harnesses:
@@ -3944,30 +4236,30 @@ async function runHarnessStatus(name, opts, io) {
   let only;
   if (name !== void 0) {
     only = findHarness(name);
-    if (!only) return unknownHarness(name, io);
+    if (!only) return unknownHarness(name, io, opts.bin);
   }
   const states = await collectStates(root, run, opts.env, only ? [only] : void 0);
   if (opts.json) {
     io.stdout(`${JSON.stringify(only ? states[0] : states, null, 2)}
 `);
   } else {
-    renderTable(states, io);
+    renderTable(states, io, opts.bin);
   }
   return 0;
 }
 function hermesTargetRoot(target) {
   return target.kind === "docker-compose" ? "/home/sandbox/harness" : target.workspace.targetRoot;
 }
-async function reconcileHermes(target, io) {
+async function reconcileHermes(target, io, bin) {
   const root = hermesTargetRoot(target);
   const result = await target.exec({
-    argv: ["bash", `${root}/.oh/scripts/link-providers.sh`, "--init", "--hermes-only"],
-    env: { OH_PROJECT_ROOT: root },
+    argv: remoteControlDirScript(root, "scripts/link-providers.sh", ["--init", "--hermes-only"]),
+    env: aliasedEnvPair("PROJECT_ROOT", root),
     user: "sandbox",
     stdio: "inherit"
   });
   if (result.exitCode !== 0) {
-    io.stderr(`oh harness: Hermes integration failed (exit ${result.exitCode}); no installation success reported.
+    io.stderr(`${bin} harness: Hermes integration failed (exit ${result.exitCode}); no installation success reported.
 `);
   }
   return result.exitCode;
@@ -3980,7 +4272,7 @@ async function runHarnessInstall(name, opts, io) {
     name === "hermes" && runningInsideSandbox(env) && projectRoot !== void 0 ? projectRoot : opts.cwd
   );
   const entry = findHarness(name);
-  if (!entry) return unknownHarness(name, io);
+  if (!entry) return unknownHarness(name, io, opts.bin);
   const target = targetFor(root, run, opts.env);
   let status;
   try {
@@ -3994,19 +4286,19 @@ async function runHarnessInstall(name, opts, io) {
   }
   if (!isReachable(status)) {
     io.stderr(
-      `oh harness: the sandbox is not running (${status}).
-Start it with \`oh sandbox\`, then re-run this command.
+      `${opts.bin} harness: the sandbox is not running (${status}).
+Start it with \`${opts.bin} sandbox\`, then re-run this command.
 `
     );
     return 1;
   }
   const hermes = entry.id === "hermes";
   const installEnv = hermes ? {
-    OH_PROJECT_ROOT: hermesTargetRoot(target),
+    ...aliasedEnvPair("PROJECT_ROOT", hermesTargetRoot(target)),
     HERMES_HOME: `${hermesTargetRoot(target)}/.hermes`
   } : void 0;
   if (hermes) {
-    const code = await reconcileHermes(target, io);
+    const code = await reconcileHermes(target, io, opts.bin);
     if (code !== 0) return code;
   }
   const already = await probeInstalled(target, entry, installEnv);
@@ -4028,16 +4320,17 @@ Start it with \`oh sandbox\`, then re-run this command.
     ...installEnv ? { env: installEnv } : {}
   });
   if (r.exitCode !== 0) {
-    io.stderr(`oh harness: installing ${entry.id} failed (exit ${r.exitCode}).
+    io.stderr(`${opts.bin} harness: installing ${entry.id} failed (exit ${r.exitCode}).
 `);
     return r.exitCode;
   }
   if (hermes) {
     if (await probeInstalled(target, entry, installEnv) !== true) {
-      io.stderr("oh harness: Hermes installation finished but executable verification failed.\n");
+      io.stderr(`${opts.bin} harness: Hermes installation finished but executable verification failed.
+`);
       return 1;
     }
-    const code = await reconcileHermes(target, io);
+    const code = await reconcileHermes(target, io, opts.bin);
     if (code !== 0) return code;
   }
   io.stdout(`${entry.id}: installed \u2014 see ${sourceDocsUrl(entry.docsPath)} for authentication
@@ -4158,7 +4451,7 @@ var TOOL_CATALOG = Object.freeze([
     binary: "docker",
     verifyArgv: Object.freeze(["bash", "-lc", "command -v docker >/dev/null"]),
     versionArgv: Object.freeze(["docker", "--version"]),
-    notInstallableReason: "The Docker CLI is installed in the base image. Note that the CLI being present says nothing about whether a daemon is reachable \u2014 `oh ps <name>` answers that.",
+    notInstallableReason: (bin) => `The Docker CLI is installed in the base image. Note that the CLI being present says nothing about whether a daemon is reachable \u2014 \`${bin} ps <name>\` answers that.`,
     docsPath: TOOLS_DOC
   }),
   Object.freeze({
@@ -4168,7 +4461,7 @@ var TOOL_CATALOG = Object.freeze([
     binary: "gh",
     verifyArgv: Object.freeze(["bash", "-lc", "command -v gh >/dev/null"]),
     versionArgv: Object.freeze(["gh", "--version"]),
-    notInstallableReason: "The GitHub CLI is installed in the base image. Run `gh auth login` inside the sandbox to authenticate it.",
+    notInstallableReason: () => "The GitHub CLI is installed in the base image. Run `gh auth login` inside the sandbox to authenticate it.",
     docsPath: TOOLS_DOC
   }),
   Object.freeze({
@@ -4275,7 +4568,7 @@ function cell2(value, absent) {
   if (value === null) return absent;
   return value ? "yes" : "no";
 }
-function renderTable2(rows, io) {
+function renderTable2(rows, io, bin) {
   const header2 = ["TOOL", "KIND", "INSTALLED"];
   const body = rows.map((r) => [r.id, r.kind, cell2(r.installed, "?")]);
   const widths = header2.map(
@@ -4285,11 +4578,13 @@ function renderTable2(rows, io) {
   io.stdout(line(header2));
   for (const row of body) io.stdout(line(row));
   if (rows.some((r) => r.installed === null)) {
-    io.stdout("\nINSTALLED is `?` \u2014 the sandbox is not running. Start it with `oh sandbox`.\n");
+    io.stdout(`
+INSTALLED is \`?\` \u2014 the sandbox is not running. Start it with \`${bin} sandbox\`.
+`);
   }
 }
-function renderDetail(rows, io) {
-  renderTable2(rows, io);
+function renderDetail(rows, io, bin) {
+  renderTable2(rows, io, bin);
   for (const r of rows) {
     io.stdout(`
 ${r.id} \u2014 ${r.title}
@@ -4310,12 +4605,12 @@ async function runToolList(opts, io) {
     io.stdout(`${JSON.stringify(rows, null, 2)}
 `);
   } else {
-    renderTable2(rows, io);
+    renderTable2(rows, io, opts.bin);
   }
   return 0;
 }
-function unknownTool(name, io) {
-  io.stderr(`oh tool: unknown tool "${name}"
+function unknownTool(name, io, bin) {
+  io.stderr(`${bin} tool: unknown tool "${name}"
 
 `);
   io.stderr(`Known tools:
@@ -4329,14 +4624,14 @@ async function runToolStatus(name, opts, io) {
   let only;
   if (name !== void 0) {
     only = findTool(name);
-    if (!only) return unknownTool(name, io);
+    if (!only) return unknownTool(name, io, opts.bin);
   }
   const rows = await collectRows(root, run, opts.env, only ? [only] : void 0);
   if (opts.json) {
     io.stdout(`${JSON.stringify(only ? rows[0] : rows, null, 2)}
 `);
   } else {
-    renderDetail(rows, io);
+    renderDetail(rows, io, opts.bin);
   }
   return 0;
 }
@@ -4357,12 +4652,12 @@ async function runToolInstall(name, opts, io) {
   const run = opts.run ?? spawnRunner;
   const root = resolveProjectRoot(opts.cwd);
   const entry = findTool(name);
-  if (!entry) return unknownTool(name, io);
+  if (!entry) return unknownTool(name, io, opts.bin);
   if (entry.installArgv === void 0) {
-    io.stderr(`oh tool: ${entry.id} cannot be installed by this command.
+    io.stderr(`${opts.bin} tool: ${entry.id} cannot be installed by this command.
 
 `);
-    io.stderr(`${entry.notInstallableReason ?? ""}
+    io.stderr(`${entry.notInstallableReason?.(opts.bin) ?? ""}
 
 `);
     io.stderr(`Installable tools:
@@ -4383,8 +4678,8 @@ ${installableToolIds().map((t) => `  ${t}`).join("\n")}
   }
   if (!isReachable2(status)) {
     io.stderr(
-      `oh tool: the sandbox is not running (${status}).
-Start it with \`oh sandbox\`, then re-run this command.
+      `${opts.bin} tool: the sandbox is not running (${status}).
+Start it with \`${opts.bin} sandbox\`, then re-run this command.
 `
     );
     return 1;
@@ -4408,7 +4703,7 @@ Start it with \`oh sandbox\`, then re-run this command.
     stdio: "inherit"
   });
   if (r.exitCode !== 0) {
-    io.stderr(`oh tool: installing ${entry.id} failed (exit ${r.exitCode}).
+    io.stderr(`${opts.bin} tool: installing ${entry.id} failed (exit ${r.exitCode}).
 `);
     return r.exitCode;
   }
@@ -4419,7 +4714,7 @@ Start it with \`oh sandbox\`, then re-run this command.
 
 // src/lib/remote.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-var DEFAULT_REPO_URL = "https://github.com/mifunedev/openharness";
+var DEFAULT_REPO_URL = "https://github.com/mifunedev/agro";
 var DEFAULT_CLONE_TIMEOUT_MS = 12e4;
 var spawnRunner2 = (cmd, args, opts) => {
   const r = spawnSync3(cmd, args, {
@@ -4436,7 +4731,7 @@ var spawnRunner2 = (cmd, args, opts) => {
   };
 };
 function fallbackHint() {
-  return "use --from <dir> to point at a local OpenHarness checkout instead";
+  return "use --from <dir> to point at a local AGRO checkout instead";
 }
 function fetchRemoteSource(opts) {
   const repoUrl2 = opts.repoUrl ?? DEFAULT_REPO_URL;
@@ -4481,9 +4776,9 @@ function fetchRemoteSource(opts) {
 }
 
 // src/cli.ts
-var VERSION = true ? "0.9.0" : "0.0.0-dev";
-var DEFAULT_SOURCE_OH_DIR = resolve8(
-  dirname6(fileURLToPath(import.meta.url)),
+var VERSION = true ? "0.11.0" : "0.0.0-dev";
+var DEFAULT_SOURCE_OH_DIR = resolve10(
+  dirname8(fileURLToPath(import.meta.url)),
   "../.."
 );
 var INTEGRATIONS = {};
@@ -4506,14 +4801,16 @@ function compatibilityNote(product) {
 }
 function printOhHelp(product = LEGACY_PRODUCT) {
   const { bin, title } = product;
+  const updateSummary = bin === AGRO_PRODUCT.bin ? `Upgrade the installed ${bin} CLI` : `Vendor or upgrade the ${stateNames(bin).controlDir}/ control plane`;
   process.stdout.write(`${bin} \u2014 ${title} (v${VERSION})
 
 Usage:
   ${bin} sandbox <args...>      Create and list sandboxes (install|list)
   ${bin} shell [name]           Open a zsh shell in the running sandbox container
-  ${bin} config <args...>       Read and write oh.json (show|set), or run a wizard
+  ${bin} config <args...>       Read and write ${stateNames(bin).configFile} (show|set), or run a wizard
   ${bin} secret <args...>       Read and write the gitignored root .env (set|list)
-  ${bin} update                 Vendor or upgrade the .oh/ control plane
+  ${bin} update                 ${updateSummary}
+  ${bin} migrate                Move a legacy .oh/ project or ~/.oh registry to AGRO names (--check|--home)
   ${bin} stop [name]            Stop the sandbox, preserving volumes
   ${bin} restart [name]         Restart the sandbox service
   ${bin} logs [name]            Tail sandbox logs (follows)
@@ -4523,7 +4820,6 @@ Usage:
   ${bin} harness <args...>      Install and inspect agent CLI harnesses
   ${bin} tool <args...>         Install and inspect sandbox tooling
   ${bin} gateway <args...>      Manage a messaging client session (pi|hermes)
-  ${bin} cloud <args...>        Manage OpenHarness Cloud nodes
   ${bin} --version              Print version
   ${bin} --help                 Show this help
 
@@ -4532,21 +4828,25 @@ ${integrationLines()}
 ${compatibilityNote(product)}`);
 }
 function printConfigHelp(bin = LEGACY_PRODUCT.bin) {
-  process.stdout.write(`${bin} config \u2014 Read and write oh.json, the tracked non-secret settings
+  process.stdout.write(`${bin} config \u2014 Read and write ${stateNames(bin).configFile}, the tracked non-secret settings
 
 Usage:
   ${bin} config show [--sandbox <name>]
-  ${bin} config set <field> <value> [--sandbox <name>]
+  ${bin} config set <field> <value> [--sandbox <name>] [--force]
   ${bin} config repo                  Create your own GitHub repo and point origin at it
   ${bin} config <integration>         Run an integration wizard
   ${bin} config <integration> --help
 
-oh.json holds every non-secret setting and is tracked by git. Credentials live
+${stateNames(bin).configFile} holds every non-secret setting and is tracked by git. Credentials live
 in the gitignored root .env \u2014 write those with \`${bin} secret set <KEY>\`. Apply a
 change with \`${bin} stop <name> && ${bin} sandbox install docker --name <name>\`. Field
 reference:
 ${sourceDocsUrl("docs/configuration.md")}
 
+\`${bin} config set storage.homePath <dir>\` refuses the change when the sandbox's named
+volume already exists, because the next start would orphan every file in it. Pass
+--force to change it anyway.
+
 Fields:
 ${configFieldList()}
 
@@ -4566,7 +4866,7 @@ the registry entry \`${bin} sandbox list\` names.
 
 The value is never read from the command line \u2014 an argument would land in your
 shell history. \`${bin} secret list\` never prints a raw value. .env is mode 0600 and
-gitignored; every non-secret setting belongs in oh.json (\`${bin} config set\`).
+gitignored; every non-secret setting belongs in ${stateNames(bin).configFile} (\`${bin} config set\`).
 
 Keys:
 ${secretKeyList()}
@@ -4579,7 +4879,7 @@ Usage:
   ${bin} update [--dry-run]
 
 Upgrades exactly one thing: the ${bin} executable that is running. It writes no
-project file \u2014 no .oh/, no oh.json, no .env \u2014 and it never asks for sudo.
+project file \u2014 no ${stateNames(bin).controlDir}/, no ${stateNames(bin).configFile}, no .env \u2014 and it never asks for sudo.
 
 The upgrade follows whichever mechanism installed this executable:
   npm-managed    realpath under node_modules/${AGRO_PRODUCT.packageName}/: reads the registry
@@ -4603,7 +4903,7 @@ Flags:
   --dry-run       Report the installation kind, target, and versions without
                   changing anything.
 
-Project payload vendoring (.oh/ + crons/) is \`oh update\` during the
+Project payload vendoring (${stateNames(bin).controlDir}/ + crons/) is \`oh update\` during the
 compatibility window; its --from, --from-remote, --ref and --force flags are
 not accepted here.
 `);
@@ -4613,22 +4913,22 @@ function printUpdateHelp(bin = LEGACY_PRODUCT.bin) {
     printSelfUpgradeHelp(bin);
     return;
   }
-  process.stdout.write(`${bin} update \u2014 Vendor or upgrade the .oh/ control plane
+  process.stdout.write(`${bin} update \u2014 Vendor or upgrade the ${stateNames(bin).controlDir}/ control plane
 
 Usage:
   ${bin} update [--from <dir> | --from-remote [--ref <ref>]] [--dry-run] [--force]
 
-Writes ONLY the .oh/ control plane and crons/ (skills, scripts, CLI) into the
+Writes ONLY the ${stateNames(bin).controlDir}/ control plane and crons/ (skills, scripts, CLI) into the
 current directory. An empty directory is equipped from scratch; everything else
-in your project is left untouched \u2014 it writes no oh.json, .env, AGENTS.md,
+in your project is left untouched \u2014 it writes no ${stateNames(bin).configFile}, .env, AGENTS.md,
 .gitignore or .devcontainer/.
 
 Payload source precedence: --from <dir> > --from-remote > the CLI's own bundled
-.oh/ payload > a remote fetch announced on one line.
+${stateNames(bin).controlDir}/ payload > a remote fetch announced on one line.
 
 Flags:
-  --from <dir>    A built OpenHarness checkout to vendor from.
-  --from-remote   Fetch the source checkout from the public OpenHarness repo
+  --from <dir>    A built AGRO checkout to vendor from.
+  --from-remote   Fetch the source checkout from the public AGRO repo
                   instead (shallow git clone into a temp dir, removed after
                   the run). Conflicts with --from.
   --ref <ref>     Branch or tag for --from-remote (default: the clone's
@@ -4647,28 +4947,38 @@ function printSandboxHelp(bin = LEGACY_PRODUCT.bin) {
   process.stdout.write(`${bin} sandbox \u2014 Create and list sandboxes
 
 Usage:
-  ${bin} sandbox install <runtime> [--name <name>] [--repo <dir>] [--yes]
+  ${bin} sandbox install <runtime> [--name <name>] [--checkout <dir>]
+                               [--home-mount <dir>] [--yes]
                                [--image[=<ref>]] [--no-build] [--print-argv]
   ${bin} sandbox list [--json]
 
-\`install\` writes a sandbox entry under \${OH_HOME:-~/.oh}/sandboxes/<name>/,
+\`install\` writes a sandbox entry under \${${stateNames(bin).envPrefix}HOME:-~/${stateNames(bin).userStateDir}}/sandboxes/<name>/,
 materialises the compose files and the compose wrapper into it, then starts the
 container. It needs no project checkout and runs from any directory. Without
---repo the sandbox runs the prebuilt image; with --repo <dir> that checkout is
-bound at /home/sandbox/harness and can be built locally.
+--checkout the sandbox runs the prebuilt image; with --checkout <dir> that
+checkout is bound at /home/sandbox/harness; the sandbox builds locally only
+when that directory holds .devcontainer/Dockerfile.
 
 On a terminal without --yes it asks for the sandbox name, the timezone, the git
-identity, SSH (with its host port), and the host Docker socket. With --repo it
-seeds those answers from that checkout's oh.json.
+identity, SSH (with its host port), the host Docker socket, and the host path
+for /home/sandbox. With --checkout it seeds those answers from that
+checkout's ${stateNames(bin).configFile}.
 
 Flags:
-  --name <name>    Registry entry name (default: the lowest free oh-sbx-<n>)
-  --repo <dir>     Bind this checkout into the sandbox and seed the defaults
-                   from its oh.json
+  --name <name>    Registry entry name (default: the lowest free ${DEFAULT_NAME_PREFIX}<n>)
+  --checkout <dir> Bind this checkout into the sandbox and seed the defaults
+                   from its ${stateNames(bin).configFile}. The sandbox builds
+                   locally only when that directory holds
+                   .devcontainer/Dockerfile
+  --repo <dir>     Deprecated alias for --checkout
+  --home-mount <dir>
+                   Bind this host directory at /home/sandbox instead of the
+                   Docker-managed volume. Relative paths resolve against the
+                   working directory. The directory is created when absent
   --yes            Non-interactive: keep every default and ask nothing
   --image[=<ref>]  Run the prebuilt image instead of building (implies
                    --no-build). Ref resolves last-wins: --image=<ref> >
-                   oh.json image.ref > ghcr.io/mifunedev/openharness:latest.
+                   ${stateNames(bin).configFile} image.ref > ${DEFAULT_SANDBOX_IMAGE}.
   --no-build       Suppress the local build and reuse an existing image
   --print-argv     Print the docker compose argv that would run, then exit
                    without writing an entry
@@ -4702,7 +5012,7 @@ Usage:
   ${bin} harness status [name]            Show installed state
 
 \`install\` is the only door: it probes the running sandbox, installs the harness
-into the persistent home volume, and reports. It reads and writes no \`oh.json\`
+into the persistent home volume, and reports. It reads and writes no \`${stateNames(bin).configFile}\`
 field, and it never rebuilds or restarts the sandbox. It requires a running
 sandbox \u2014 start one with \`${bin} sandbox\` first.
 
@@ -4723,7 +5033,7 @@ Usage:
   ${bin} gateway status                   show both sessions
 
 Only a LEADING --help/-h is intercepted here; everything else passes through
-verbatim to the vendored .oh/scripts/gateway.sh with OH_PROJECT_ROOT set to
+verbatim to the vendored ${stateNames(bin).controlDir}/scripts/gateway.sh with ${stateNames(bin).envPrefix}PROJECT_ROOT set to
 the equipped project root. Exits with the script's exit code.
 `);
 }
@@ -4751,7 +5061,7 @@ Most tools are baked into the image and are report-only; \`install\` works on:
 ${installableToolIds().map((t) => `  ${t}`).join("\n")}
 
 \`install\` is the only door: it probes the running sandbox, installs the tool
-into the persistent home volume, and reports. It reads and writes no \`oh.json\`
+into the persistent home volume, and reports. It reads and writes no \`${stateNames(bin).configFile}\`
 field, and it never rebuilds or restarts the sandbox. A large download is
 confirmed first, and a non-interactive run without --yes installs nothing.
 
@@ -4776,7 +5086,7 @@ function printComposeVerbHelp(verb, bin = LEGACY_PRODUCT.bin) {
 Usage:
   ${bin} ${verb} [name] [-- <extra docker compose args>]
 
-Runs .oh/scripts/docker-compose.sh inside the sandbox entry, the single
+Runs ${stateNames(bin).controlDir}/scripts/docker-compose.sh inside the sandbox entry, the single
 implementation. \`${bin}\` is the only lifecycle door. [name] is a sandbox entry from
 \`${bin} sandbox list\`; with exactly one registered sandbox it can be omitted.
 
@@ -4789,7 +5099,7 @@ function printDestroyHelp(bin = LEGACY_PRODUCT.bin) {
 Usage:
   ${bin} destroy [name] [--yes]
 
-Runs .oh/scripts/docker-compose.sh with \`down -v\`. This is the one destructive
+Runs ${stateNames(bin).controlDir}/scripts/docker-compose.sh with \`down -v\`. This is the one destructive
 lifecycle verb: \`-v\` deletes the named
 volumes, and those volumes hold every agent CLI login, the gh CLI token, and
 the SSH keys. Use \`${bin} stop\` when you only want the containers gone.
@@ -4812,11 +5122,11 @@ Usage:
   ${bin} compose config [-- <extra docker compose args>]
 
 Subcommands:
-  config   Print the compose configuration .oh/scripts/docker-compose.sh
-           resolves from .devcontainer/.env and .oh/config.json
+  config   Print the compose configuration ${stateNames(bin).controlDir}/scripts/docker-compose.sh
+           resolves from .devcontainer/.env and ${stateNames(bin).controlDir}/config.json
 
 Namespaced under \`${bin} compose\` because \`${bin} config <integration>\` already means
-"run an integration wizard", and \`${bin} config show/set\` reads and writes oh.json.
+"run an integration wizard", and \`${bin} config show/set\` reads and writes ${stateNames(bin).configFile}.
 
 See ${sourceDocsUrl("docs/lifecycle-commands.md")} for every verb.
 `);
@@ -4842,11 +5152,13 @@ var CONFIG_VERBS = ["show", "set", "repo"];
 function parseConfigArgs(input, bin = LEGACY_PRODUCT.bin) {
   const scoped = extractSandboxFlag(`${bin} config`, input);
   if (!scoped.ok) return scoped;
-  const rest = scoped.args.rest;
+  const forced = scoped.args.rest.includes("--force");
+  const rest = scoped.args.rest.filter((arg) => arg !== "--force");
   const args = {
     help: false,
     integrationHelp: false,
-    ...scoped.args.sandbox === void 0 ? {} : { sandbox: scoped.args.sandbox }
+    ...scoped.args.sandbox === void 0 ? {} : { sandbox: scoped.args.sandbox },
+    ...forced ? { force: true } : {}
   };
   if (rest.length === 0 || isHelpFlag(rest[0])) {
     return { ok: true, args: { ...args, help: true } };
@@ -4962,14 +5274,14 @@ function parseComposeArgs(rest, bin = LEGACY_PRODUCT.bin) {
   args.subcommand = "config";
   const tail = rest.slice(1);
   if (isHelpFlag(tail[0])) return { ok: true, args: { ...args, help: true } };
-  const sep4 = tail.indexOf("--");
-  if (sep4 === -1 && tail.length > 0) {
+  const sep5 = tail.indexOf("--");
+  if (sep5 === -1 && tail.length > 0) {
     return {
       ok: false,
       error: `${bin} compose config: unexpected argument "${tail[0]}" \u2014 pass extra docker compose args after \`--\``
     };
   }
-  if (sep4 !== -1) args.passthrough = tail.slice(sep4 + 1);
+  if (sep5 !== -1) args.passthrough = tail.slice(sep5 + 1);
   return { ok: true, args };
 }
 var PAYLOAD_UPDATE_FLAGS = ["--from", "--from-remote", "--ref", "--force"];
@@ -5033,7 +5345,9 @@ function parseUpdateArgs(rest, bin = LEGACY_PRODUCT.bin) {
 }
 var SANDBOX_VALUE_FLAGS = {
   "--name": "name",
-  "--repo": "repo"
+  "--checkout": "checkout",
+  "--repo": "checkout",
+  "--home-mount": "homeMount"
 };
 function parseSandboxArgs(rest, bin = LEGACY_PRODUCT.bin) {
   const args = {
@@ -5058,6 +5372,7 @@ function parseSandboxArgs(rest, bin = LEGACY_PRODUCT.bin) {
   args.subcommand = head;
   if (isHelpFlag(tail[0])) return { ok: true, args: { ...args, help: true } };
   const positionals = [];
+  const checkoutSpellings = /* @__PURE__ */ new Set();
   for (let i = 0; i < tail.length; i++) {
     const token = tail[i];
     const valueFlag = SANDBOX_VALUE_FLAGS[token];
@@ -5066,6 +5381,7 @@ function parseSandboxArgs(rest, bin = LEGACY_PRODUCT.bin) {
       if (value === void 0) {
         return { ok: false, error: `${bin} sandbox ${head}: ${token} requires a value` };
       }
+      if (valueFlag === "checkout") checkoutSpellings.add(token);
       args[valueFlag] = value;
       i++;
     } else if (token === "--yes") {
@@ -5091,6 +5407,12 @@ function parseSandboxArgs(rest, bin = LEGACY_PRODUCT.bin) {
       positionals.push(token);
     }
   }
+  if (checkoutSpellings.has("--checkout") && checkoutSpellings.has("--repo")) {
+    return {
+      ok: false,
+      error: `${bin} sandbox ${head}: --checkout conflicts with --repo \u2014 pass exactly one, and prefer --checkout`
+    };
+  }
   if (head === "list") {
     if (positionals.length > 0) {
       return { ok: false, error: `${bin} sandbox list: unexpected argument "${positionals[0]}"` };
@@ -5209,13 +5531,13 @@ function bundledPayloadExists(bundled, exists = existsSync16) {
 function resolveUpdateSource(args, bundled, bin = LEGACY_PRODUCT.bin) {
   const exists = bundled.exists ?? existsSync16;
   if (args.fromDir !== void 0) {
-    return { kind: "local", fromDir: resolve8(args.fromDir) };
+    return { kind: "local", fromDir: resolve10(args.fromDir) };
   }
   if (args.fromRemote) {
     return { kind: "remote", ref: args.ref };
   }
   if (bundledPayloadExists(bundled, exists)) {
-    return { kind: "local", fromDir: resolve8(bundled.sourceOhDir, "..") };
+    return { kind: "local", fromDir: resolve10(bundled.sourceOhDir, "..") };
   }
   return {
     kind: "remote",
@@ -5227,7 +5549,7 @@ function resolveUpdateSource(args, bundled, bin = LEGACY_PRODUCT.bin) {
 function readPayloadVersion(checkoutDir) {
   try {
     const parsed = JSON.parse(
-      readFileSync11(join10(checkoutDir, ".oh", "cli", "package.json"), "utf8")
+      readFileSync11(join10(resolveControlDir(checkoutDir).path, "cli", "package.json"), "utf8")
     );
     if (parsed && typeof parsed.version === "string") return parsed.version;
   } catch {
@@ -5280,9 +5602,13 @@ async function main(argv) {
         stdout: (s) => process.stdout.write(s),
         stderr: (s) => process.stderr.write(s)
       };
-      const scope = a.sandbox === void 0 ? {} : { sandbox: a.sandbox };
+      const scope = {
+        bin,
+        ...a.sandbox === void 0 ? {} : { sandbox: a.sandbox },
+        ...a.force === true ? { force: true } : {}
+      };
       if (a.verb === "show") return await runConfigShow(scope, io);
-      if (a.verb === "repo") return await runConfigRepo({}, io);
+      if (a.verb === "repo") return await runConfigRepo({ bin }, io);
       return await runConfigSet(a.key, a.value, scope, io);
     }
     const name = a.integration;
@@ -5317,10 +5643,28 @@ async function main(argv) {
       stdout: (s) => process.stdout.write(s),
       stderr: (s) => process.stderr.write(s)
     };
-    const scope = a.sandbox === void 0 ? {} : { sandbox: a.sandbox };
+    const scope = a.sandbox === void 0 ? { bin } : { bin, sandbox: a.sandbox };
     if (a.verb === "list") return await runSecretList(scope, io);
     return await runSecretSet(a.key, scope, io);
   }
+  if (first === "migrate") {
+    const parsed = parseMigrateArgs(argv.slice(1), bin);
+    if (!parsed.ok) {
+      process.stderr.write(`${parsed.error}
+`);
+      if (parsed.showHelp) printMigrateHelp(bin);
+      return 1;
+    }
+    if (parsed.args.help) {
+      printMigrateHelp(bin);
+      return 0;
+    }
+    const io = {
+      stdout: (s) => process.stdout.write(s),
+      stderr: (s) => process.stderr.write(s)
+    };
+    return runMigrate(parsed.args, io);
+  }
   if (first === "update") {
     const parsed = parseUpdateArgs(argv.slice(1), bin);
     if (!parsed.ok) {
@@ -5344,12 +5688,12 @@ async function main(argv) {
     const targetDir = process.cwd();
     const source = resolveUpdateSource(parsed.args, { sourceOhDir: DEFAULT_SOURCE_OH_DIR }, bin);
     if (source.kind === "local") {
-      return await runUpdate({ targetDir, fromDir: source.fromDir, force, dryRun }, io);
+      return await runUpdate({ bin, targetDir, fromDir: source.fromDir, force, dryRun }, io);
     }
     if (source.notice) process.stdout.write(source.notice);
     return await runWithRemoteSource(
       { ref: source.ref },
-      (checkoutDir) => runUpdate({ targetDir, fromDir: checkoutDir, force, dryRun }, io)
+      (checkoutDir) => runUpdate({ bin, targetDir, fromDir: checkoutDir, force, dryRun }, io)
     );
   }
   if (first === "sandbox") {
@@ -5366,12 +5710,14 @@ async function main(argv) {
       return a.subcommand === void 0 ? 1 : 0;
     }
     const io = lifecycleIo();
-    if (a.subcommand === "list") return await runSandboxList({ json: a.json }, io);
+    if (a.subcommand === "list") return await runSandboxList({ bin, json: a.json }, io);
     return await runSandboxInstall(
       {
+        bin,
         runtime: a.runtime,
         ...a.name !== void 0 ? { name: a.name } : {},
-        ...a.repo !== void 0 ? { repo: a.repo } : {},
+        ...a.checkout !== void 0 ? { checkout: a.checkout } : {},
+        ...a.homeMount !== void 0 ? { homeMount: a.homeMount } : {},
         yes: a.yes,
         image: a.image,
         ...a.imageRef !== void 0 ? { imageRef: a.imageRef } : {},
@@ -5393,7 +5739,7 @@ async function main(argv) {
       return 0;
     }
     return runShell(
-      parsed.args.name === void 0 ? {} : { name: parsed.args.name },
+      parsed.args.name === void 0 ? { bin } : { bin, name: parsed.args.name },
       lifecycleIo()
     );
   }
@@ -5410,6 +5756,7 @@ async function main(argv) {
     }
     return await runDestroy(
       {
+        bin,
         yes: parsed.args.yes,
         ...parsed.args.name !== void 0 ? { name: parsed.args.name } : {}
       },
@@ -5428,7 +5775,7 @@ async function main(argv) {
       printComposeHelp(bin);
       return 0;
     }
-    return runComposeConfig({}, parsed.args.passthrough);
+    return runComposeConfig({ bin }, parsed.args.passthrough);
   }
   if (composeVerbs().includes(first)) {
     const verb = first;
@@ -5437,9 +5784,9 @@ async function main(argv) {
       printComposeVerbHelp(verb, bin);
       return 0;
     }
-    const sep4 = rest.indexOf("--");
-    const head = sep4 === -1 ? rest : rest.slice(0, sep4);
-    const extra = sep4 === -1 ? [] : rest.slice(sep4 + 1);
+    const sep5 = rest.indexOf("--");
+    const head = sep5 === -1 ? rest : rest.slice(0, sep5);
+    const extra = sep5 === -1 ? [] : rest.slice(sep5 + 1);
     if (head.length > 0 && head[0].startsWith("-")) {
       process.stderr.write(`${bin} ${verb}: unknown flag "${head[0]}"
 `);
@@ -5452,7 +5799,7 @@ async function main(argv) {
       );
       return 1;
     }
-    return runComposeVerb(verb, head.length === 0 ? {} : { name: head[0] }, extra);
+    return runComposeVerb(verb, head.length === 0 ? { bin } : { bin, name: head[0] }, extra);
   }
   if (first === "harness") {
     const parsed = parseHarnessArgs(argv.slice(1), bin);
@@ -5472,12 +5819,12 @@ async function main(argv) {
       stderr: (s) => process.stderr.write(s)
     };
     if (a.subcommand === "list") {
-      return await runHarnessList({ json: a.json }, io);
+      return await runHarnessList({ bin, json: a.json }, io);
     }
     if (a.subcommand === "status") {
-      return await runHarnessStatus(a.name, { json: a.json }, io);
+      return await runHarnessStatus(a.name, { bin, json: a.json }, io);
     }
-    return await runHarnessInstall(a.name, {}, io);
+    return await runHarnessInstall(a.name, { bin }, io);
   }
   if (first === "tool") {
     const parsed = parseToolArgs(argv.slice(1), bin);
@@ -5497,18 +5844,12 @@ async function main(argv) {
       stderr: (s) => process.stderr.write(s)
     };
     if (a.subcommand === "list") {
-      return await runToolList({ json: a.json }, io);
+      return await runToolList({ bin, json: a.json }, io);
     }
     if (a.subcommand === "status") {
-      return await runToolStatus(a.name, { json: a.json }, io);
+      return await runToolStatus(a.name, { bin, json: a.json }, io);
     }
-    return await runToolInstall(a.name, { yes: a.yes }, io);
-  }
-  if (first === "cloud") {
-    return await runCloud(argv.slice(1), {
-      stdout: (s) => process.stdout.write(s),
-      stderr: (s) => process.stderr.write(s)
-    });
+    return await runToolInstall(a.name, { bin, yes: a.yes }, io);
   }
   if (first === "gateway") {
     const parsed = parseGatewayArgs(argv.slice(1));
@@ -5521,7 +5862,7 @@ async function main(argv) {
       printGatewayHelp(bin);
       return 0;
     }
-    return runGateway(parsed.args.passthrough, {});
+    return runGateway(parsed.args.passthrough, { bin });
   }
   process.stderr.write(`${bin}: unknown command "${first}"