@openape/apes 0.27.0 → 0.29.0

package/dist/cli.js

@@ -63,7 +63,7 @@ import {
 } from "./chunk-IDPV5SNB.js";
 
 // src/cli.ts
-import consola36 from "consola";
+import consola37 from "consola";
 
 // src/ape-shell.ts
 import path from "path";
@@ -93,7 +93,7 @@ function rewriteApeShellArgs(argv, argv0) {
 }
 
 // src/cli.ts
-import { defineCommand as defineCommand44, runMain } from "citty";
+import { defineCommand as defineCommand45, runMain } from "citty";
 
 // src/commands/auth/login.ts
 import { Buffer as Buffer2 } from "buffer";
@@ -1743,13 +1743,10 @@ var adminCommand = defineCommand19({
 });
 
 // src/commands/agents/index.ts
-import { defineCommand as defineCommand24 } from "citty";
+import { defineCommand as defineCommand25 } from "citty";
 
-// src/commands/agents/destroy.ts
+// src/commands/agents/allow.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { mkdtempSync, rmSync, writeFileSync } from "fs";
-import { tmpdir, userInfo } from "os";
-import { join as join2 } from "path";
 import { defineCommand as defineCommand20 } from "citty";
 import consola18 from "consola";
 
@@ -2010,7 +2007,8 @@ function buildAgentAuthJson(input) {
     idp: input.idp,
     access_token: input.accessToken,
     email: input.email,
-    expires_at: input.expiresAt
+    expires_at: input.expiresAt,
+    owner_email: input.ownerEmail
   }, null, 2)}
 `;
 }
@@ -2097,6 +2095,84 @@ function isShellRegistered(shellPath) {
   return content.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).includes(shellPath);
 }
 
+// src/commands/agents/allow.ts
+var allowAgentCommand = defineCommand20({
+  meta: {
+    name: "allow",
+    description: "Add a peer to the agent's contact-allowlist so the bridge auto-accepts that peer's contact request."
+  },
+  args: {
+    agent: {
+      type: "positional",
+      required: true,
+      description: "Agent name (the macOS short username spawn created)"
+    },
+    email: {
+      type: "positional",
+      required: true,
+      description: "Peer email to allow (the address that will send the contact request)"
+    }
+  },
+  async run({ args }) {
+    const agent = args.agent;
+    const email = args.email.trim().toLowerCase();
+    if (!AGENT_NAME_REGEX.test(agent)) {
+      throw new CliError(`Invalid agent name "${agent}".`);
+    }
+    if (!email.includes("@")) {
+      throw new CliError(`Invalid email "${email}".`);
+    }
+    if (!isDarwin()) {
+      throw new CliError("`apes agents allow` is currently macOS-only.");
+    }
+    if (!readMacOSUser(agent)) {
+      throw new CliError(`No macOS user "${agent}" \u2014 has the agent been spawned?`);
+    }
+    const apes = whichBinary("apes");
+    if (!apes) throw new CliError("`apes` not found on PATH.");
+    const script = `set -eu
+mkdir -p "$HOME/.config/openape"
+F="$HOME/.config/openape/bridge-allowlist.json"
+EMAIL=${shQuote2(email)}
+python3 - "$F" "$EMAIL" <<'PY'
+import json, os, sys
+path, email = sys.argv[1], sys.argv[2].lower()
+data = {"emails": []}
+if os.path.exists(path):
+    try:
+        with open(path) as f:
+            data = json.load(f)
+        if not isinstance(data, dict) or not isinstance(data.get("emails"), list):
+            data = {"emails": []}
+    except Exception:
+        data = {"emails": []}
+emails = {e.lower() for e in data["emails"] if isinstance(e, str)}
+emails.add(email)
+data["emails"] = sorted(emails)
+with open(path, "w") as f:
+    json.dump(data, f, indent=2)
+    f.write("\\n")
+print("ok")
+PY
+chmod 600 "$F"
+`;
+    consola18.start(`Adding ${email} to ${agent}'s allowlist\u2026`);
+    execFileSync3(apes, ["run", "--as", agent, "--wait", "--", "bash", "-c", script], { stdio: "inherit" });
+    consola18.success(`${agent} will auto-accept future contact requests from ${email} (within ~30s of next bridge connect).`);
+  }
+});
+function shQuote2(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+
+// src/commands/agents/destroy.ts
+import { execFileSync as execFileSync4 } from "child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir, userInfo } from "os";
+import { join as join2 } from "path";
+import { defineCommand as defineCommand21 } from "citty";
+import consola19 from "consola";
+
 // src/lib/silent-password.ts
 function readPasswordSilent(prompt) {
   if (!process.stdin.isTTY) {
@@ -2152,7 +2228,7 @@ function readPasswordSilent(prompt) {
 }
 
 // src/commands/agents/destroy.ts
-var destroyAgentCommand = defineCommand20({
+var destroyAgentCommand = defineCommand21({
   meta: {
     name: "destroy",
     description: "Tear down an agent: remove macOS user, hard-delete IdP agent, drop all SSH keys"
@@ -2196,7 +2272,7 @@ var destroyAgentCommand = defineCommand20({
     const idpExists = idpAgent !== void 0;
     const osUserExists = !args["keep-os-user"] && isDarwin() && readMacOSUser(name) !== null;
     if (!idpExists && !osUserExists) {
-      consola18.info(`Nothing to destroy: no IdP agent and no OS user named "${name}".`);
+      consola19.info(`Nothing to destroy: no IdP agent and no OS user named "${name}".`);
       return;
     }
     if (!args.force) {
@@ -2205,14 +2281,14 @@ var destroyAgentCommand = defineCommand20({
       if (idpExists) {
         consequences.push(args.soft ? `\u2022 Deactivate IdP agent ${idpAgent.email} (PATCH isActive=false)` : `\u2022 Hard-delete IdP agent ${idpAgent.email} and all its SSH keys`);
       }
-      consola18.warn(`About to destroy "${name}":
+      consola19.warn(`About to destroy "${name}":
 ${consequences.join("\n")}`);
       if (!process.stdin.isTTY) {
         throw new CliError(
           "No TTY available for the interactive confirmation. Re-run with --force to skip the prompt (this is the same flag CI uses)."
         );
       }
-      const confirmed = await consola18.prompt("Proceed?", { type: "confirm", initial: false });
+      const confirmed = await consola19.prompt("Proceed?", { type: "confirm", initial: false });
       if (typeof confirmed === "symbol" || !confirmed) {
         throw new CliExit(0);
       }
@@ -2221,13 +2297,13 @@ ${consequences.join("\n")}`);
       const id = encodeURIComponent(idpAgent.email);
       if (args.soft) {
         await apiFetch(`/api/my-agents/${id}`, { method: "PATCH", body: { isActive: false }, idp });
-        consola18.success(`Deactivated IdP agent ${idpAgent.email}`);
+        consola19.success(`Deactivated IdP agent ${idpAgent.email}`);
       } else {
         await apiFetch(`/api/my-agents/${id}`, { method: "DELETE", idp });
-        consola18.success(`Deleted IdP agent ${idpAgent.email}`);
+        consola19.success(`Deleted IdP agent ${idpAgent.email}`);
       }
     } else {
-      consola18.info("No IdP agent to remove (skipped).");
+      consola19.info("No IdP agent to remove (skipped).");
     }
     if (osUserExists) {
       const sudo = whichBinary("sudo");
@@ -2241,8 +2317,8 @@ ${consequences.join("\n")}`);
       try {
         const script = buildDestroyTeardownScript({ name, homeDir: `/Users/${name}`, adminUser });
         writeFileSync(scriptPath, script, { mode: 448 });
-        consola18.start("Running teardown via sudo\u2026");
-        execFileSync3(sudo, ["-S", "--prompt=", "--", "bash", scriptPath], {
+        consola19.start("Running teardown via sudo\u2026");
+        execFileSync4(sudo, ["-S", "--prompt=", "--", "bash", scriptPath], {
           input: `${adminPassword}
 ${adminPassword}
 `,
@@ -2252,9 +2328,9 @@ ${adminPassword}
         rmSync(scratch, { recursive: true, force: true });
       }
     } else if (!args["keep-os-user"] && isDarwin()) {
-      consola18.info("No macOS user to remove (skipped).");
+      consola19.info("No macOS user to remove (skipped).");
     }
-    consola18.success(`Destroyed ${name}.`);
+    consola19.success(`Destroyed ${name}.`);
   }
 });
 async function collectAdminPassword(opts) {
@@ -2268,9 +2344,9 @@ async function collectAdminPassword(opts) {
 }
 
 // src/commands/agents/list.ts
-import { defineCommand as defineCommand21 } from "citty";
-import consola19 from "consola";
-var listAgentsCommand = defineCommand21({
+import { defineCommand as defineCommand22 } from "citty";
+import consola20 from "consola";
+var listAgentsCommand = defineCommand22({
   meta: {
     name: "list",
     description: "List agents owned by the current user, with local OS-user status"
@@ -2311,7 +2387,7 @@ var listAgentsCommand = defineCommand21({
       return;
     }
     if (rows.length === 0) {
-      consola19.info(args["include-inactive"] ? "No agents found." : "No active agents found. Use --include-inactive to show deactivated.");
+      consola20.info(args["include-inactive"] ? "No agents found." : "No active agents found. Use --include-inactive to show deactivated.");
       return;
     }
     const nameW = Math.max(4, ...rows.map((r) => r.name.length));
@@ -2330,9 +2406,9 @@ var listAgentsCommand = defineCommand21({
 
 // src/commands/agents/register.ts
 import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { defineCommand as defineCommand22 } from "citty";
-import consola20 from "consola";
-var registerAgentCommand = defineCommand22({
+import { defineCommand as defineCommand23 } from "citty";
+import consola21 from "consola";
+var registerAgentCommand = defineCommand23({
   meta: {
     name: "register",
     description: "Register an agent at the IdP using a supplied public key"
@@ -2402,7 +2478,7 @@ var registerAgentCommand = defineCommand22({
 `);
       return;
     }
-    consola20.success("Agent registered.");
+    consola21.success("Agent registered.");
     console.log(`  Name:     ${result.name}`);
     console.log(`  Email:    ${result.email}`);
     console.log(`  IdP:      ${idp}`);
@@ -2415,62 +2491,12 @@ var registerAgentCommand = defineCommand22({
 });
 
 // src/commands/agents/spawn.ts
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join4 } from "path";
-import { defineCommand as defineCommand23 } from "citty";
-import consola21 from "consola";
-
-// src/lib/chat-room.ts
-var DEFAULT_CHAT_ENDPOINT = "https://chat.openape.ai";
-function chatEndpoint() {
-  return (process.env.APE_CHAT_ENDPOINT ?? DEFAULT_CHAT_ENDPOINT).replace(/\/$/, "");
-}
-async function chatFetch(bearer, path2, init) {
-  const url = `${chatEndpoint()}${path2}`;
-  const res = await fetch(url, {
-    method: init?.method ?? "GET",
-    headers: {
-      Authorization: `Bearer ${bearer}`,
-      "Content-Type": "application/json"
-    },
-    body: init?.body !== void 0 ? JSON.stringify(init.body) : void 0
-  });
-  if (!res.ok) {
-    const detail = await res.text().catch(() => "");
-    throw new Error(`chat.openape.ai ${init?.method ?? "GET"} ${path2} \u2192 ${res.status}: ${detail.slice(0, 200)}`);
-  }
-  return await res.json();
-}
-async function listRooms(bearer) {
-  return chatFetch(bearer, "/api/rooms");
-}
-async function listMembers(bearer, roomId) {
-  return chatFetch(bearer, `/api/rooms/${encodeURIComponent(roomId)}/members`);
-}
-async function findExistingDm(bearer, callerEmail, peerEmail) {
-  const rooms = await listRooms(bearer);
-  for (const room of rooms) {
-    if (room.kind !== "dm") continue;
-    const members = await listMembers(bearer, room.id);
-    if (members.length !== 2) continue;
-    const emails = new Set(members.map((m) => m.userEmail.toLowerCase()));
-    if (emails.has(callerEmail.toLowerCase()) && emails.has(peerEmail.toLowerCase())) {
-      return room;
-    }
-  }
-  return null;
-}
-async function ensureDmWith(opts) {
-  const existing = await findExistingDm(opts.callerBearer, opts.callerEmail, opts.peerEmail);
-  if (existing) return { roomId: existing.id, created: false };
-  const room = await chatFetch(opts.callerBearer, "/api/rooms", {
-    method: "POST",
-    body: { name: opts.peerEmail, kind: "dm", members: [opts.peerEmail] }
-  });
-  return { roomId: room.id, created: true };
-}
+import { defineCommand as defineCommand24 } from "citty";
+import consola22 from "consola";
 
 // src/lib/keygen.ts
 import { Buffer as Buffer4 } from "buffer";
@@ -2688,7 +2714,7 @@ function buildBridgePlist(agentName, homeDir) {
 }
 
 // src/commands/agents/spawn.ts
-var spawnAgentCommand = defineCommand23({
+var spawnAgentCommand = defineCommand24({
   meta: {
     name: "spawn",
     description: "Provision a local macOS agent end-to-end (OS user, keypair, IdP agent, Claude hook)"
@@ -2774,12 +2800,12 @@ and try again.`
     const scratch = mkdtempSync2(join4(tmpdir2(), `apes-spawn-${name}-`));
     const scriptPath = join4(scratch, "setup.sh");
     try {
-      consola21.start(`Generating keypair for ${name}\u2026`);
+      consola22.start(`Generating keypair for ${name}\u2026`);
       const { privatePem, publicSshLine } = generateKeyPairInMemory();
-      consola21.start(`Registering agent at ${idp}\u2026`);
+      consola22.start(`Registering agent at ${idp}\u2026`);
       const registration = await registerAgentAtIdp({ name, publicKey: publicSshLine, idp });
-      consola21.success(`Registered as ${registration.email}`);
-      consola21.start("Issuing agent access token\u2026");
+      consola22.success(`Registered as ${registration.email}`);
+      consola22.start("Issuing agent access token\u2026");
       const { token, expiresIn } = await issueAgentToken({
         idp,
         agentEmail: registration.email,
@@ -2789,7 +2815,8 @@ and try again.`
         idp,
         accessToken: token,
         email: registration.email,
-        expiresAt: Math.floor(Date.now() / 1e3) + expiresIn
+        expiresAt: Math.floor(Date.now() / 1e3) + expiresIn,
+        ownerEmail: auth.email
       });
       const includeClaudeHook = !args["no-claude-hook"];
       const claudeOauthToken = await resolveClaudeToken({
@@ -2822,25 +2849,13 @@ and try again.`
         bridge
       });
       writeFileSync3(scriptPath, script, { mode: 448 });
-      consola21.start("Running privileged setup as root via `apes run --as root --wait`\u2026");
-      consola21.info("You will be asked to approve the as=root grant in your DDISA inbox; this command blocks until you do.");
-      execFileSync4(apes, ["run", "--as", "root", "--wait", "--", "bash", scriptPath], { stdio: "inherit" });
-      consola21.success(`Agent ${name} spawned.`);
+      consola22.start("Running privileged setup as root via `apes run --as root --wait`\u2026");
+      consola22.info("You will be asked to approve the as=root grant in your DDISA inbox; this command blocks until you do.");
+      execFileSync5(apes, ["run", "--as", "root", "--wait", "--", "bash", scriptPath], { stdio: "inherit" });
+      consola22.success(`Agent ${name} spawned.`);
       if (args.bridge) {
-        try {
-          consola21.start("Setting up direct chat with the agent\u2026");
-          const result = await ensureDmWith({
-            callerBearer: auth.access_token,
-            callerEmail: auth.email,
-            peerEmail: registration.email
-          });
-          consola21.success(
-            result.created ? `Created direct chat with ${registration.email}` : `Direct chat with ${registration.email} already existed`
-          );
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          consola21.warn(`Could not auto-create direct chat: ${msg}`);
-        }
+        consola22.info(`On first boot, the bridge will send you a contact request from ${registration.email}.`);
+        consola22.info("Open chat.openape.ai and accept it to start chatting with the agent.");
       }
       console.log("");
       console.log("Run as the agent with:");
@@ -2874,29 +2889,30 @@ async function resolveClaudeToken(opts) {
 }
 
 // src/commands/agents/index.ts
-var agentsCommand = defineCommand24({
+var agentsCommand = defineCommand25({
   meta: {
     name: "agents",
-    description: "Manage owned agents (register, spawn, list, destroy)"
+    description: "Manage owned agents (register, spawn, list, destroy, allow)"
   },
   subCommands: {
     register: registerAgentCommand,
     spawn: spawnAgentCommand,
     list: listAgentsCommand,
-    destroy: destroyAgentCommand
+    destroy: destroyAgentCommand,
+    allow: allowAgentCommand
   }
 });
 
 // src/commands/adapter/index.ts
-import { defineCommand as defineCommand25 } from "citty";
-import consola22 from "consola";
-var adapterCommand = defineCommand25({
+import { defineCommand as defineCommand26 } from "citty";
+import consola23 from "consola";
+var adapterCommand = defineCommand26({
   meta: {
     name: "adapter",
     description: "Manage CLI adapters"
   },
   subCommands: {
-    list: defineCommand25({
+    list: defineCommand26({
       meta: {
         name: "list",
         description: "List available adapters"
@@ -2927,7 +2943,7 @@ var adapterCommand = defineCommand25({
 `);
             return;
           }
-          consola22.info(`Registry: ${index2.adapters.length} adapters (${index2.generated_at})`);
+          consola23.info(`Registry: ${index2.adapters.length} adapters (${index2.generated_at})`);
           for (const a of index2.adapters) {
             const installed = isInstalled(a.id, false) ? " [installed]" : "";
             console.log(`  ${a.id.padEnd(12)} ${a.name.padEnd(24)} ${a.category}${installed}`);
@@ -2949,7 +2965,7 @@ var adapterCommand = defineCommand25({
           return;
         }
         if (local.length === 0) {
-          consola22.info("No adapters installed. Use `apes adapter list --remote` to see available adapters.");
+          consola23.info("No adapters installed. Use `apes adapter list --remote` to see available adapters.");
           return;
         }
         for (const a of local) {
@@ -2957,7 +2973,7 @@ var adapterCommand = defineCommand25({
         }
       }
     }),
-    install: defineCommand25({
+    install: defineCommand26({
       meta: {
         name: "install",
         description: "Install an adapter from the registry"
@@ -2986,24 +3002,24 @@ var adapterCommand = defineCommand25({
         for (const id of ids) {
           const entry = findAdapter(index, id);
           if (!entry) {
-            consola22.error(`Adapter "${id}" not found in registry. Use \`apes adapter search ${id}\` to search.`);
+            consola23.error(`Adapter "${id}" not found in registry. Use \`apes adapter search ${id}\` to search.`);
             continue;
           }
           const conflicts = findConflictingAdapters(entry.executable, id);
           if (conflicts.length > 0) {
             for (const c of conflicts) {
-              consola22.warn(`Conflicting adapter found: ${c.path} (id: ${c.adapterId}, executable: ${c.executable})`);
-              consola22.warn(`  Remove it with: apes adapter remove ${c.adapterId}`);
+              consola23.warn(`Conflicting adapter found: ${c.path} (id: ${c.adapterId}, executable: ${c.executable})`);
+              consola23.warn(`  Remove it with: apes adapter remove ${c.adapterId}`);
             }
           }
           const result = await installAdapter(entry, { local });
           const verb = result.updated ? "Updated" : "Installed";
-          consola22.success(`${verb} ${result.id} \u2192 ${result.path}`);
-          consola22.info(`Digest: ${result.digest}`);
+          consola23.success(`${verb} ${result.id} \u2192 ${result.path}`);
+          consola23.info(`Digest: ${result.digest}`);
         }
       }
     }),
-    remove: defineCommand25({
+    remove: defineCommand26({
       meta: {
         name: "remove",
         description: "Remove an installed adapter"
@@ -3026,9 +3042,9 @@ var adapterCommand = defineCommand25({
         let failed = false;
         for (const id of ids) {
           if (removeAdapter(id, local)) {
-            consola22.success(`Removed adapter: ${id}`);
+            consola23.success(`Removed adapter: ${id}`);
           } else {
-            consola22.error(`Adapter "${id}" is not installed${local ? " locally" : ""}`);
+            consola23.error(`Adapter "${id}" is not installed${local ? " locally" : ""}`);
             failed = true;
           }
         }
@@ -3036,7 +3052,7 @@ var adapterCommand = defineCommand25({
           throw new CliError("Some adapters could not be removed");
       }
     }),
-    info: defineCommand25({
+    info: defineCommand26({
       meta: {
         name: "info",
         description: "Show detailed adapter information"
@@ -3078,7 +3094,7 @@ var adapterCommand = defineCommand25({
         }
       }
     }),
-    search: defineCommand25({
+    search: defineCommand26({
       meta: {
         name: "search",
         description: "Search adapters in the registry"
@@ -3110,7 +3126,7 @@ var adapterCommand = defineCommand25({
           return;
         }
         if (results.length === 0) {
-          consola22.info(`No adapters matching "${query}"`);
+          consola23.info(`No adapters matching "${query}"`);
           return;
         }
         for (const a of results) {
@@ -3119,7 +3135,7 @@ var adapterCommand = defineCommand25({
         }
       }
     }),
-    update: defineCommand25({
+    update: defineCommand26({
       meta: {
         name: "update",
         description: "Update installed adapters"
@@ -3145,33 +3161,33 @@ var adapterCommand = defineCommand25({
         const targetId = args.id ? String(args.id) : void 0;
         const targets = targetId ? [targetId] : index.adapters.map((a) => a.id).filter((id) => isInstalled(id, false));
         if (targets.length === 0) {
-          consola22.info("No adapters installed to update.");
+          consola23.info("No adapters installed to update.");
           return;
         }
         for (const id of targets) {
           const entry = findAdapter(index, id);
           if (!entry) {
-            consola22.warn(`${id}: not found in registry, skipping`);
+            consola23.warn(`${id}: not found in registry, skipping`);
             continue;
           }
           const localDigest = getInstalledDigest(id, false);
           if (localDigest === entry.digest) {
-            consola22.info(`${id}: already up to date`);
+            consola23.info(`${id}: already up to date`);
             continue;
           }
           if (localDigest && !args.yes) {
-            consola22.warn(`${id}: digest will change \u2014 existing grants for this adapter will be invalidated`);
-            consola22.info(`  Old: ${localDigest}`);
-            consola22.info(`  New: ${entry.digest}`);
-            consola22.info("  Use --yes to confirm");
+            consola23.warn(`${id}: digest will change \u2014 existing grants for this adapter will be invalidated`);
+            consola23.info(`  Old: ${localDigest}`);
+            consola23.info(`  New: ${entry.digest}`);
+            consola23.info("  Use --yes to confirm");
             continue;
           }
           const result = await installAdapter(entry);
-          consola22.success(`Updated ${result.id} \u2192 ${result.path}`);
+          consola23.success(`Updated ${result.id} \u2192 ${result.path}`);
         }
       }
     }),
-    verify: defineCommand25({
+    verify: defineCommand26({
       meta: {
         name: "verify",
         description: "Verify installed adapter against registry digest"
@@ -3204,7 +3220,7 @@ var adapterCommand = defineCommand25({
         if (!localDigest)
           throw new Error(`Adapter "${id}" is not installed${local ? " locally" : ""}`);
         if (localDigest === entry.digest) {
-          consola22.success(`${id}: digest matches registry`);
+          consola23.success(`${id}: digest matches registry`);
         } else {
           console.log(`  Local:    ${localDigest}`);
           console.log(`  Registry: ${entry.digest}`);
@@ -3216,11 +3232,11 @@ var adapterCommand = defineCommand25({
 });
 
 // src/commands/run.ts
-import { execFileSync as execFileSync5 } from "child_process";
+import { execFileSync as execFileSync6 } from "child_process";
 import { hostname as hostname3 } from "os";
 import { basename } from "path";
-import { defineCommand as defineCommand26 } from "citty";
-import consola23 from "consola";
+import { defineCommand as defineCommand27 } from "citty";
+import consola24 from "consola";
 function shouldWaitForGrant(args) {
   return args.wait === true || process.env.APE_WAIT === "1";
 }
@@ -3257,7 +3273,7 @@ function printPendingGrantInfo(grant, idp) {
   const statusCmd = `apes grants status ${grant.id}`;
   const executeCmd = `apes grants run ${grant.id}`;
   if (mode === "human") {
-    consola23.success(`Grant ${grant.id} created \u2014 awaiting your approval`);
+    consola24.success(`Grant ${grant.id} created \u2014 awaiting your approval`);
     console.log(`  Approve in browser:  ${approveUrl}`);
     console.log(`  Check status:        ${statusCmd}`);
     console.log(`  Run after approval:  ${executeCmd}`);
@@ -3267,7 +3283,7 @@ function printPendingGrantInfo(grant, idp) {
     return;
   }
   const maxMin = getPollMaxMinutes();
-  consola23.success(`Grant ${grant.id} created (pending approval)`);
+  consola24.success(`Grant ${grant.id} created (pending approval)`);
   console.log(`  Approve:   ${approveUrl}`);
   console.log(`  Status:    ${statusCmd} [--json]`);
   console.log(`  Execute:   ${executeCmd} --wait`);
@@ -3289,7 +3305,7 @@ function printPendingGrantInfo(grant, idp) {
   console.log('  Tip: Approve as "timed" or "always" in the browser to let this');
   console.log("  grant be reused on subsequent invocations without re-approval.");
 }
-var runCommand = defineCommand26({
+var runCommand = defineCommand27({
   meta: {
     name: "run",
     description: "Execute a grant-secured command"
@@ -3392,7 +3408,7 @@ async function runShellMode(command, args) {
     }
   } catch {
   }
-  consola23.info(`Requesting ape-shell session grant on ${targetHost}`);
+  consola24.info(`Requesting ape-shell session grant on ${targetHost}`);
   const grant = await apiFetch(grantsUrl, {
     method: "POST",
     body: {
@@ -3412,8 +3428,8 @@ async function runShellMode(command, args) {
     host: targetHost
   });
   if (shouldWaitForGrant(args)) {
-    consola23.info(`Grant requested: ${grant.id}`);
-    consola23.info("Waiting for approval...");
+    consola24.info(`Grant requested: ${grant.id}`);
+    consola24.info("Waiting for approval...");
     const maxWait = 3e5;
     const interval = 3e3;
     const start = Date.now();
@@ -3444,13 +3460,13 @@ async function tryAdapterModeFromShell(command, idp, args) {
   try {
     resolved = await resolveCommand(loaded, [normalizedExecutable, ...parsed.argv]);
   } catch (err) {
-    consola23.debug(`ape-shell: adapter resolve failed for "${parsed.raw}":`, err);
+    consola24.debug(`ape-shell: adapter resolve failed for "${parsed.raw}":`, err);
     return false;
   }
   try {
     const existingGrantId = await findExistingGrant(resolved, idp);
     if (existingGrantId) {
-      consola23.info(`Reusing grant ${existingGrantId} for: ${resolved.detail.display}`);
+      consola24.info(`Reusing grant ${existingGrantId} for: ${resolved.detail.display}`);
       const token = await fetchGrantToken(idp, existingGrantId);
       await verifyAndExecute(token, resolved, existingGrantId);
       return true;
@@ -3458,7 +3474,7 @@ async function tryAdapterModeFromShell(command, idp, args) {
   } catch {
   }
   const approval = args.approval ?? "once";
-  consola23.info(`Requesting grant for: ${resolved.detail.display}`);
+  consola24.info(`Requesting grant for: ${resolved.detail.display}`);
   const grant = await createShapesGrant(resolved, {
     idp,
     approval,
@@ -3466,8 +3482,8 @@ async function tryAdapterModeFromShell(command, idp, args) {
   });
   if (grant.similar_grants?.similar_grants?.length) {
     const n = grant.similar_grants.similar_grants.length;
-    consola23.info("");
-    consola23.info(`  Similar grant(s) found (${n}). Your approver can extend an existing grant to cover this request.`);
+    consola24.info("");
+    consola24.info(`  Similar grant(s) found (${n}). Your approver can extend an existing grant to cover this request.`);
   }
   notifyGrantPending({
     grantId: grant.id,
@@ -3477,8 +3493,8 @@ async function tryAdapterModeFromShell(command, idp, args) {
     host: args.host || hostname3()
   });
   if (shouldWaitForGrant(args)) {
-    consola23.info(`Grant requested: ${grant.id}`);
-    consola23.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
+    consola24.info(`Grant requested: ${grant.id}`);
+    consola24.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
     const status = await waitForGrantStatus(idp, grant.id);
     if (status !== "approved")
       throw new CliError(`Grant ${status}`);
@@ -3494,7 +3510,7 @@ function execShellCommand(command) {
     throw new CliError("No command to execute");
   try {
     const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-    execFileSync5(command[0], command.slice(1), {
+    execFileSync6(command[0], command.slice(1), {
       stdio: "inherit",
       env: inheritedEnv
     });
@@ -3552,7 +3568,7 @@ async function runAdapterMode(command, rawArgs, args) {
   try {
     const existingGrantId = await findExistingGrant(resolved, idp);
     if (existingGrantId) {
-      consola23.info(`Reusing existing grant: ${existingGrantId}`);
+      consola24.info(`Reusing existing grant: ${existingGrantId}`);
       const token = await fetchGrantToken(idp, existingGrantId);
       await verifyAndExecute(token, resolved, existingGrantId);
       return;
@@ -3566,17 +3582,17 @@ async function runAdapterMode(command, rawArgs, args) {
   });
   if (grant.similar_grants?.similar_grants?.length) {
     const n = grant.similar_grants.similar_grants.length;
-    consola23.info("");
-    consola23.info(`  Similar grant(s) found (${n}). Your approver can extend an existing grant to cover this request.`);
+    consola24.info("");
+    consola24.info(`  Similar grant(s) found (${n}). Your approver can extend an existing grant to cover this request.`);
     if (grant.similar_grants.widened_details?.length) {
       const wider = grant.similar_grants.widened_details.map((d) => d.permission).join(", ");
-      consola23.info(`  Broader scope: ${wider}`);
+      consola24.info(`  Broader scope: ${wider}`);
     }
-    consola23.info("");
+    consola24.info("");
   }
   if (shouldWaitForGrant(args)) {
-    consola23.info(`Grant requested: ${grant.id}`);
-    consola23.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
+    consola24.info(`Grant requested: ${grant.id}`);
+    consola24.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
     const status = await waitForGrantStatus(idp, grant.id);
     if (status !== "approved")
       throw new Error(`Grant ${status}`);
@@ -3596,7 +3612,7 @@ async function runAudienceMode(audience, action, args) {
   const grantsUrl = await getGrantsEndpoint(idp);
   const command = action.split(" ");
   const targetHost = args.host || hostname3();
-  consola23.info(`Requesting ${audience} grant on ${targetHost}: ${command.join(" ")}`);
+  consola24.info(`Requesting ${audience} grant on ${targetHost}: ${command.join(" ")}`);
   const grant = await apiFetch(grantsUrl, {
     method: "POST",
     body: {
@@ -3613,9 +3629,9 @@ async function runAudienceMode(audience, action, args) {
     printPendingGrantInfo(grant, idp);
     throw new CliExit(getAsyncExitCode());
   }
-  consola23.success(`Grant requested: ${grant.id}`);
-  consola23.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
-  consola23.info("Waiting for approval...");
+  consola24.success(`Grant requested: ${grant.id}`);
+  consola24.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`);
+  consola24.info("Waiting for approval...");
   const maxWait = 15 * 60 * 1e3;
   const interval = 3e3;
   const start = Date.now();
@@ -3623,7 +3639,7 @@ async function runAudienceMode(audience, action, args) {
   while (Date.now() - start < maxWait) {
     const status = await apiFetch(`${grantsUrl}/${grant.id}`);
     if (status.status === "approved") {
-      consola23.success("Grant approved!");
+      consola24.success("Grant approved!");
       approved = true;
       break;
     }
@@ -3638,15 +3654,15 @@ async function runAudienceMode(audience, action, args) {
       `Grant approval timed out after ${minutes} min (still pending). Check your DDISA inbox at ${idp}/grant-approval?grant_id=${grant.id} \u2014 if approved later, re-run the same \`apes run\` command and it will reuse the grant.`
     );
   }
-  consola23.info("Fetching grant token...");
+  consola24.info("Fetching grant token...");
   const { authz_jwt } = await apiFetch(`${grantsUrl}/${grant.id}/token`, {
     method: "POST"
   });
   if (audience === "escapes") {
-    consola23.info(`Executing: ${command.join(" ")}`);
+    consola24.info(`Executing: ${command.join(" ")}`);
     try {
       const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-      execFileSync5(args["escapes-path"] || "escapes", ["--grant", authz_jwt, "--", ...command], {
+      execFileSync6(args["escapes-path"] || "escapes", ["--grant", authz_jwt, "--", ...command], {
         stdio: "inherit",
         env: inheritedEnv
       });
@@ -3661,8 +3677,8 @@ async function runAudienceMode(audience, action, args) {
 
 // src/commands/proxy.ts
 import { spawn as spawn2 } from "child_process";
-import { defineCommand as defineCommand27 } from "citty";
-import consola24 from "consola";
+import { defineCommand as defineCommand28 } from "citty";
+import consola25 from "consola";
 
 // src/proxy/config.ts
 function buildDefaultProxyConfigToml(opts) {
@@ -3805,10 +3821,10 @@ function resolveProxyConfigOptions() {
       77
     );
   }
-  consola24.info(`[apes proxy] IdP-mediated mode \u2014 agent=${auth.email}, idp=${auth.idp}`);
+  consola25.info(`[apes proxy] IdP-mediated mode \u2014 agent=${auth.email}, idp=${auth.idp}`);
   return { agentEmail: auth.email, idpUrl: auth.idp, mediated: true };
 }
-var proxyCommand = defineCommand27({
+var proxyCommand = defineCommand28({
   meta: {
     name: "proxy",
     description: "Run a command with HTTPS_PROXY routed through the OpenApe egress proxy."
@@ -3830,12 +3846,12 @@ var proxyCommand = defineCommand27({
     let close = null;
     if (reuseUrl) {
       proxyUrl = reuseUrl;
-      consola24.info(`[apes proxy] reusing existing proxy at ${proxyUrl}`);
+      consola25.info(`[apes proxy] reusing existing proxy at ${proxyUrl}`);
     } else {
       const ephemeral = await startEphemeralProxy(buildDefaultProxyConfigToml(resolveProxyConfigOptions()));
       proxyUrl = ephemeral.url;
       close = ephemeral.close;
-      consola24.info(`[apes proxy] started ephemeral proxy at ${proxyUrl}`);
+      consola25.info(`[apes proxy] started ephemeral proxy at ${proxyUrl}`);
     }
     const noProxy = process.env.NO_PROXY ?? process.env.no_proxy ?? "127.0.0.1,localhost";
     const childEnv = {
@@ -3867,7 +3883,7 @@ var proxyCommand = defineCommand27({
         else resolveExit(code ?? 0);
       });
       child.once("error", (err) => {
-        consola24.error(`[apes proxy] failed to spawn '${wrapped[0]}':`, err.message);
+        consola25.error(`[apes proxy] failed to spawn '${wrapped[0]}':`, err.message);
         resolveExit(127);
       });
     });
@@ -3881,8 +3897,8 @@ function signalNumber(signal) {
 }
 
 // src/commands/explain.ts
-import { defineCommand as defineCommand28 } from "citty";
-var explainCommand = defineCommand28({
+import { defineCommand as defineCommand29 } from "citty";
+var explainCommand = defineCommand29({
   meta: {
     name: "explain",
     description: "Show what permission a command would need"
@@ -3920,9 +3936,9 @@ var explainCommand = defineCommand28({
 });
 
 // src/commands/config/get.ts
-import { defineCommand as defineCommand29 } from "citty";
-import consola25 from "consola";
-var configGetCommand = defineCommand29({
+import { defineCommand as defineCommand30 } from "citty";
+import consola26 from "consola";
+var configGetCommand = defineCommand30({
   meta: {
     name: "get",
     description: "Get a configuration value"
@@ -3942,7 +3958,7 @@ var configGetCommand = defineCommand29({
         if (idp)
           console.log(idp);
         else
-          consola25.info("No IdP configured.");
+          consola26.info("No IdP configured.");
         break;
       }
       case "email": {
@@ -3950,7 +3966,7 @@ var configGetCommand = defineCommand29({
         if (auth?.email)
           console.log(auth.email);
         else
-          consola25.info("Not logged in.");
+          consola26.info("Not logged in.");
         break;
       }
       default: {
@@ -3963,7 +3979,7 @@ var configGetCommand = defineCommand29({
           if (sectionObj && field in sectionObj) {
             console.log(sectionObj[field]);
           } else {
-            consola25.info(`Key "${key}" not set.`);
+            consola26.info(`Key "${key}" not set.`);
           }
         } else {
           throw new CliError(`Unknown key: "${key}". Use: idp, email, defaults.idp, defaults.approval, agent.key, agent.email`);
@@ -3974,9 +3990,9 @@ var configGetCommand = defineCommand29({
 });
 
 // src/commands/config/set.ts
-import { defineCommand as defineCommand30 } from "citty";
-import consola26 from "consola";
-var configSetCommand = defineCommand30({
+import { defineCommand as defineCommand31 } from "citty";
+import consola27 from "consola";
+var configSetCommand = defineCommand31({
   meta: {
     name: "set",
     description: "Set a configuration value"
@@ -4012,12 +4028,12 @@ var configSetCommand = defineCommand30({
       throw new CliError(`Unknown section: "${section}". Use: defaults, agent`);
     }
     saveConfig(config);
-    consola26.success(`Set ${key} = ${value}`);
+    consola27.success(`Set ${key} = ${value}`);
   }
 });
 
 // src/commands/fetch/index.ts
-import { defineCommand as defineCommand31 } from "citty";
+import { defineCommand as defineCommand32 } from "citty";
 async function doRequest(method, url, body, contentType, raw, showHeaders) {
   const token = getAuthToken();
   if (!token) {
@@ -4053,13 +4069,13 @@ async function doRequest(method, url, body, contentType, raw, showHeaders) {
     throw new CliError(`HTTP ${response.status} ${response.statusText}`);
   }
 }
-var fetchCommand = defineCommand31({
+var fetchCommand = defineCommand32({
   meta: {
     name: "fetch",
     description: "Make authenticated HTTP requests"
   },
   subCommands: {
-    get: defineCommand31({
+    get: defineCommand32({
       meta: {
         name: "get",
         description: "GET request with auth token"
@@ -4085,7 +4101,7 @@ var fetchCommand = defineCommand31({
         await doRequest("GET", String(args.url), void 0, "application/json", Boolean(args.raw), Boolean(args.headers));
       }
     }),
-    post: defineCommand31({
+    post: defineCommand32({
       meta: {
         name: "post",
         description: "POST request with auth token"
@@ -4124,8 +4140,8 @@ var fetchCommand = defineCommand31({
 });
 
 // src/commands/mcp/index.ts
-import { defineCommand as defineCommand32 } from "citty";
-var mcpCommand = defineCommand32({
+import { defineCommand as defineCommand33 } from "citty";
+var mcpCommand = defineCommand33({
   meta: {
     name: "mcp",
     description: "Start MCP server for AI agents"
@@ -4148,7 +4164,7 @@ var mcpCommand = defineCommand32({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-TNWUMXYI.js");
+    const { startMcpServer } = await import("./server-QGV3ED6I.js");
     await startMcpServer(transport, port);
   }
 });
@@ -4156,10 +4172,10 @@ var mcpCommand = defineCommand32({
 // src/commands/init/index.ts
 import { existsSync as existsSync7, copyFileSync, writeFileSync as writeFileSync5 } from "fs";
 import { randomBytes } from "crypto";
-import { execFileSync as execFileSync6 } from "child_process";
+import { execFileSync as execFileSync7 } from "child_process";
 import { join as join6 } from "path";
-import { defineCommand as defineCommand33 } from "citty";
-import consola27 from "consola";
+import { defineCommand as defineCommand34 } from "citty";
+import consola28 from "consola";
 var DEFAULT_IDP_URL = "https://id.openape.at";
 async function downloadTemplate(repo, targetDir) {
   const { downloadTemplate: gigetDownload } = await import("giget");
@@ -4168,28 +4184,28 @@ async function downloadTemplate(repo, targetDir) {
 function installDeps(dir) {
   const hasLockFile = (name) => existsSync7(join6(dir, name));
   if (hasLockFile("pnpm-lock.yaml")) {
-    execFileSync6("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync7("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
   } else if (hasLockFile("bun.lockb")) {
-    execFileSync6("bun", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync7("bun", ["install"], { cwd: dir, stdio: "inherit" });
   } else {
-    execFileSync6("npm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync7("npm", ["install"], { cwd: dir, stdio: "inherit" });
   }
 }
 async function promptChoice(message, choices) {
-  const result = await consola27.prompt(message, { type: "select", options: choices });
+  const result = await consola28.prompt(message, { type: "select", options: choices });
   if (typeof result === "symbol") {
     throw new CliExit(0);
   }
   return result;
 }
 async function promptText(message, defaultValue) {
-  const result = await consola27.prompt(message, { type: "text", default: defaultValue, placeholder: defaultValue });
+  const result = await consola28.prompt(message, { type: "text", default: defaultValue, placeholder: defaultValue });
   if (typeof result === "symbol") {
     throw new CliExit(0);
   }
   return result || defaultValue || "";
 }
-var initCommand = defineCommand33({
+var initCommand = defineCommand34({
   meta: {
     name: "init",
     description: "Scaffold a new OpenApe project"
@@ -4234,20 +4250,20 @@ async function initSP(targetDir) {
   if (existsSync7(join6(dir, "package.json"))) {
     throw new CliError(`Directory "${dir}" already contains a project.`);
   }
-  consola27.start("Scaffolding SP starter...");
+  consola28.start("Scaffolding SP starter...");
   await downloadTemplate("openape-ai/openape-sp-starter", dir);
-  consola27.success("Scaffolded from openape-sp-starter");
-  consola27.start("Installing dependencies...");
+  consola28.success("Scaffolded from openape-sp-starter");
+  consola28.start("Installing dependencies...");
   installDeps(dir);
-  consola27.success("Dependencies installed");
+  consola28.success("Dependencies installed");
   const envExample = join6(dir, ".env.example");
   const envFile = join6(dir, ".env");
   if (existsSync7(envExample) && !existsSync7(envFile)) {
     copyFileSync(envExample, envFile);
-    consola27.success(`\`.env\` created (using Free IdP at ${DEFAULT_IDP_URL})`);
+    consola28.success(`\`.env\` created (using Free IdP at ${DEFAULT_IDP_URL})`);
   }
   console.log("");
-  consola27.box([
+  consola28.box([
     `cd ${dir}`,
     "npm run dev",
     "",
@@ -4266,15 +4282,15 @@ async function initIdP(targetDir) {
     "s3 (S3-compatible)"
   ]);
   const adminEmail = await promptText("Admin email");
-  consola27.start("Scaffolding IdP starter...");
+  consola28.start("Scaffolding IdP starter...");
   await downloadTemplate("openape-ai/openape-idp-starter", dir);
-  consola27.success("Scaffolded from openape-idp-starter");
-  consola27.start("Installing dependencies...");
+  consola28.success("Scaffolded from openape-idp-starter");
+  consola28.start("Installing dependencies...");
   installDeps(dir);
-  consola27.success("Dependencies installed");
+  consola28.success("Dependencies installed");
   const sessionSecret = randomBytes(32).toString("hex");
   const managementToken = randomBytes(32).toString("hex");
-  consola27.success("Secrets generated");
+  consola28.success("Secrets generated");
   const isLocalhost = domain === "localhost";
   const origin = isLocalhost ? "http://localhost:3000" : `https://${domain}`;
   const envContent = [
@@ -4290,9 +4306,9 @@ async function initIdP(targetDir) {
   ].join("\n");
   writeFileSync5(join6(dir, ".env"), `${envContent}
 `, { mode: 384 });
-  consola27.success(".env created");
+  consola28.success(".env created");
   console.log("");
-  consola27.box([
+  consola28.box([
     `cd ${dir}`,
     "npm run dev",
     "",
@@ -4312,8 +4328,8 @@ import { Buffer as Buffer5 } from "buffer";
 import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
 import { execFile as execFile2 } from "child_process";
 import { sign as sign2 } from "crypto";
-import { defineCommand as defineCommand34 } from "citty";
-import consola28 from "consola";
+import { defineCommand as defineCommand35 } from "citty";
+import consola29 from "consola";
 var DEFAULT_IDP_URL2 = "https://id.openape.at";
 var DEFAULT_KEY_PATH = "~/.ssh/id_ed25519";
 var POLL_INTERVAL = 3e3;
@@ -4356,7 +4372,7 @@ async function pollForEnrollment(idp, agentEmail, keyPath) {
   }
   throw new Error("Enrollment timed out. Please check the browser and try again.");
 }
-var enrollCommand = defineCommand34({
+var enrollCommand = defineCommand35({
   meta: {
     name: "enroll",
     description: "Enroll an agent with an Identity Provider"
@@ -4376,18 +4392,18 @@ var enrollCommand = defineCommand34({
     }
   },
   async run({ args }) {
-    const idp = args.idp || await consola28.prompt("IdP URL", { type: "text", default: DEFAULT_IDP_URL2, placeholder: DEFAULT_IDP_URL2 }).then((r) => {
+    const idp = args.idp || await consola29.prompt("IdP URL", { type: "text", default: DEFAULT_IDP_URL2, placeholder: DEFAULT_IDP_URL2 }).then((r) => {
       if (typeof r === "symbol") throw new CliExit(0);
       return r;
     }) || DEFAULT_IDP_URL2;
-    const agentName = args.name || await consola28.prompt("Agent name", { type: "text", placeholder: "deploy-bot" }).then((r) => {
+    const agentName = args.name || await consola29.prompt("Agent name", { type: "text", placeholder: "deploy-bot" }).then((r) => {
       if (typeof r === "symbol") throw new CliExit(0);
       return r;
     });
     if (!agentName) {
       throw new CliError("Agent name is required.");
     }
-    const keyPath = args.key || await consola28.prompt("Ed25519 key", { type: "text", default: DEFAULT_KEY_PATH, placeholder: DEFAULT_KEY_PATH }).then((r) => {
+    const keyPath = args.key || await consola29.prompt("Ed25519 key", { type: "text", default: DEFAULT_KEY_PATH, placeholder: DEFAULT_KEY_PATH }).then((r) => {
       if (typeof r === "symbol") throw new CliExit(0);
       return r;
     }) || DEFAULT_KEY_PATH;
@@ -4395,19 +4411,19 @@ var enrollCommand = defineCommand34({
     let publicKey;
     if (existsSync8(resolvedKey)) {
       publicKey = readPublicKey(resolvedKey);
-      consola28.success(`Using existing key ${keyPath}`);
+      consola29.success(`Using existing key ${keyPath}`);
     } else {
-      consola28.start(`Generating Ed25519 key pair at ${keyPath}...`);
+      consola29.start(`Generating Ed25519 key pair at ${keyPath}...`);
       publicKey = generateAndSaveKey(keyPath);
-      consola28.success(`Key pair generated at ${keyPath}`);
+      consola29.success(`Key pair generated at ${keyPath}`);
     }
     const encodedKey = encodeURIComponent(publicKey);
     const enrollUrl = `${idp}/enroll?name=${encodeURIComponent(agentName)}&key=${encodedKey}`;
-    consola28.info("Opening browser for enrollment...");
-    consola28.info(`\u2192 ${idp}/enroll`);
+    consola29.info("Opening browser for enrollment...");
+    consola29.info(`\u2192 ${idp}/enroll`);
     openBrowser2(enrollUrl);
     console.log("");
-    const agentEmail = await consola28.prompt(
+    const agentEmail = await consola29.prompt(
       "Agent email (shown in browser after enrollment)",
       { type: "text", placeholder: `agent+${agentName}@...` }
     ).then((r) => {
@@ -4417,7 +4433,7 @@ var enrollCommand = defineCommand34({
     if (!agentEmail) {
       throw new CliError("Agent email is required to verify enrollment.");
     }
-    consola28.start("Verifying enrollment...");
+    consola29.start("Verifying enrollment...");
     const { token, expiresIn } = await pollForEnrollment(idp, agentEmail, keyPath);
     saveAuth({
       idp,
@@ -4429,18 +4445,18 @@ var enrollCommand = defineCommand34({
     config.defaults = { ...config.defaults, idp };
     config.agent = { key: keyPath, email: agentEmail };
     saveConfig(config);
-    consola28.success(`Agent enrolled as ${agentEmail}`);
-    consola28.success("Config saved to ~/.config/apes/");
+    consola29.success(`Agent enrolled as ${agentEmail}`);
+    consola29.success("Config saved to ~/.config/apes/");
     console.log("");
-    consola28.info("Verify with: apes whoami");
+    consola29.info("Verify with: apes whoami");
   }
 });
 
 // src/commands/register-user.ts
 import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
-import { defineCommand as defineCommand35 } from "citty";
-import consola29 from "consola";
-var registerUserCommand = defineCommand35({
+import { defineCommand as defineCommand36 } from "citty";
+import consola30 from "consola";
+var registerUserCommand = defineCommand36({
   meta: {
     name: "register-user",
     description: "Register a sub-user with SSH key"
@@ -4495,18 +4511,18 @@ var registerUserCommand = defineCommand35({
         ...userType ? { type: userType } : {}
       }
     });
-    consola29.success(`User registered: ${result.email} (type: ${result.type}, owner: ${result.owner})`);
+    consola30.success(`User registered: ${result.email} (type: ${result.type}, owner: ${result.owner})`);
   }
 });
 
 // src/commands/utils/index.ts
-import { defineCommand as defineCommand37 } from "citty";
+import { defineCommand as defineCommand38 } from "citty";
 
 // src/commands/utils/dig.ts
-import { defineCommand as defineCommand36 } from "citty";
-import consola30 from "consola";
+import { defineCommand as defineCommand37 } from "citty";
+import consola31 from "consola";
 import { resolveDDISA as resolveDDISA2 } from "@openape/core";
-var digCommand = defineCommand36({
+var digCommand = defineCommand37({
   meta: {
     name: "dig",
     description: "Resolve DDISA IdP for a domain or email (admin/diag tool)"
@@ -4579,12 +4595,12 @@ var digCommand = defineCommand36({
     console.log(`  domain: ${domain}`);
     console.log("");
     if (!result.ddisa.found) {
-      consola30.warn(`No DDISA record at _ddisa.${domain}`);
+      consola31.warn(`No DDISA record at _ddisa.${domain}`);
       if (result.hint) console.log(`
 ${result.hint}`);
       throw new CliError(`No DDISA record found for ${domain}`);
     }
-    consola30.success(`_ddisa.${domain} \u2192 ${result.ddisa.idp}`);
+    consola31.success(`_ddisa.${domain} \u2192 ${result.ddisa.idp}`);
     console.log(`  Version:  ${result.ddisa.version || "ddisa1"}`);
     console.log(`  IdP URL:  ${result.ddisa.idp}`);
     if (result.ddisa.mode) console.log(`  Mode:     ${result.ddisa.mode}`);
@@ -4594,13 +4610,13 @@ ${result.hint}`);
       return;
     }
     if (result.idpDiscovery.ok) {
-      consola30.success(`IdP reachable (${result.idpDiscovery.status ?? 200})`);
+      consola31.success(`IdP reachable (${result.idpDiscovery.status ?? 200})`);
       if (result.idpDiscovery.issuer) console.log(`  Issuer:   ${result.idpDiscovery.issuer}`);
       if (result.idpDiscovery.ddisaVersion) console.log(`  DDISA:    v${result.idpDiscovery.ddisaVersion}`);
       if (result.idpDiscovery.authMethods?.length) console.log(`  Auth:     ${result.idpDiscovery.authMethods.join(", ")}`);
       if (result.idpDiscovery.grantTypes?.length) console.log(`  Grants:   ${result.idpDiscovery.grantTypes.join(", ")}`);
     } else {
-      consola30.warn(`IdP discovery failed${result.idpDiscovery.status ? ` (HTTP ${result.idpDiscovery.status})` : ""}`);
+      consola31.warn(`IdP discovery failed${result.idpDiscovery.status ? ` (HTTP ${result.idpDiscovery.status})` : ""}`);
       if (result.hint) console.log(`
 ${result.hint}`);
       throw new CliError(`IdP at ${result.ddisa.idp} not reachable`);
@@ -4609,7 +4625,7 @@ ${result.hint}`);
 });
 
 // src/commands/utils/index.ts
-var utilsCommand = defineCommand37({
+var utilsCommand = defineCommand38({
   meta: {
     name: "utils",
     description: "Admin/diagnostic utilities (dig, \u2026)"
@@ -4620,12 +4636,12 @@ var utilsCommand = defineCommand37({
 });
 
 // src/commands/sessions/index.ts
-import { defineCommand as defineCommand40 } from "citty";
+import { defineCommand as defineCommand41 } from "citty";
 
 // src/commands/sessions/list.ts
-import { defineCommand as defineCommand38 } from "citty";
-import consola31 from "consola";
-var sessionsListCommand = defineCommand38({
+import { defineCommand as defineCommand39 } from "citty";
+import consola32 from "consola";
+var sessionsListCommand = defineCommand39({
   meta: {
     name: "list",
     description: "List your active refresh-token families (one per logged-in device)."
@@ -4643,7 +4659,7 @@ var sessionsListCommand = defineCommand38({
       return;
     }
     if (result.data.length === 0) {
-      consola31.info("No active sessions.");
+      consola32.info("No active sessions.");
       return;
     }
     for (const f of result.data) {
@@ -4655,9 +4671,9 @@ var sessionsListCommand = defineCommand38({
 });
 
 // src/commands/sessions/remove.ts
-import { defineCommand as defineCommand39 } from "citty";
-import consola32 from "consola";
-var sessionsRemoveCommand = defineCommand39({
+import { defineCommand as defineCommand40 } from "citty";
+import consola33 from "consola";
+var sessionsRemoveCommand = defineCommand40({
   meta: {
     name: "remove",
     description: "Revoke one of your active refresh-token families by id."
@@ -4673,12 +4689,12 @@ var sessionsRemoveCommand = defineCommand39({
     const id = String(args.familyId).trim();
     if (!id) throw new CliError("familyId required");
     await apiFetch(`/api/me/sessions/${encodeURIComponent(id)}`, { method: "DELETE" });
-    consola32.success(`Session ${id} revoked. The device using it will need to \`apes login\` again on its next refresh.`);
+    consola33.success(`Session ${id} revoked. The device using it will need to \`apes login\` again on its next refresh.`);
   }
 });
 
 // src/commands/sessions/index.ts
-var sessionsCommand = defineCommand40({
+var sessionsCommand = defineCommand41({
   meta: {
     name: "sessions",
     description: "Manage your active refresh-token sessions across devices"
@@ -4690,10 +4706,10 @@ var sessionsCommand = defineCommand40({
 });
 
 // src/commands/dns-check.ts
-import { defineCommand as defineCommand41 } from "citty";
-import consola33 from "consola";
+import { defineCommand as defineCommand42 } from "citty";
+import consola34 from "consola";
 import { resolveDDISA as resolveDDISA3 } from "@openape/core";
-var dnsCheckCommand = defineCommand41({
+var dnsCheckCommand = defineCommand42({
   meta: {
     name: "dns-check",
     description: "Validate DDISA DNS TXT records for a domain"
@@ -4707,7 +4723,7 @@ var dnsCheckCommand = defineCommand41({
   },
   async run({ args }) {
     const domain = args.domain;
-    consola33.start(`Checking _ddisa.${domain}...`);
+    consola34.start(`Checking _ddisa.${domain}...`);
     try {
       const result = await resolveDDISA3(domain);
       if (!result) {
@@ -4716,7 +4732,7 @@ var dnsCheckCommand = defineCommand41({
         console.log(`  _ddisa.${domain} TXT "v=ddisa1 idp=https://id.${domain}"`);
         throw new CliError(`No DDISA record found for ${domain}`);
       }
-      consola33.success(`_ddisa.${domain} \u2192 ${result.idp}`);
+      consola34.success(`_ddisa.${domain} \u2192 ${result.idp}`);
       console.log("");
       console.log(`  Version:  ${result.version || "ddisa1"}`);
       console.log(`  IdP URL:  ${result.idp}`);
@@ -4725,14 +4741,14 @@ var dnsCheckCommand = defineCommand41({
       if (result.priority !== void 0)
         console.log(`  Priority: ${result.priority}`);
       console.log("");
-      consola33.start(`Verifying IdP at ${result.idp}...`);
+      consola34.start(`Verifying IdP at ${result.idp}...`);
       const discoResp = await fetch(`${result.idp}/.well-known/openid-configuration`);
       if (!discoResp.ok) {
-        consola33.warn(`IdP discovery failed (${discoResp.status}). Is the IdP running at ${result.idp}?`);
+        consola34.warn(`IdP discovery failed (${discoResp.status}). Is the IdP running at ${result.idp}?`);
         return;
       }
       const disco = await discoResp.json();
-      consola33.success(`IdP is reachable`);
+      consola34.success(`IdP is reachable`);
       console.log(`  Issuer:   ${disco.issuer}`);
       console.log(`  DDISA:    v${disco.ddisa_version || "?"}`);
       if (disco.ddisa_auth_methods_supported) {
@@ -4750,7 +4766,7 @@ var dnsCheckCommand = defineCommand41({
 // src/commands/health.ts
 import { exec } from "child_process";
 import { promisify } from "util";
-import { defineCommand as defineCommand42 } from "citty";
+import { defineCommand as defineCommand43 } from "citty";
 var execAsync = promisify(exec);
 async function resolveApeShellPath() {
   try {
@@ -4786,7 +4802,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "0.27.0" : "0.0.0";
+  const version = true ? "0.29.0" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -4849,7 +4865,7 @@ async function runHealth(args) {
     throw new CliError(`IdP ${auth.idp} unreachable: ${idpProbe.error}`, 1);
   }
 }
-var healthCommand = defineCommand42({
+var healthCommand = defineCommand43({
   meta: {
     name: "health",
     description: "Report CLI diagnostic state (auth, IdP, grants, binaries)"
@@ -4867,8 +4883,8 @@ var healthCommand = defineCommand42({
 });
 
 // src/commands/workflows.ts
-import { defineCommand as defineCommand43 } from "citty";
-import consola34 from "consola";
+import { defineCommand as defineCommand44 } from "citty";
+import consola35 from "consola";
 
 // src/guides/index.ts
 var guides = [
@@ -4918,7 +4934,7 @@ var guides = [
 ];
 
 // src/commands/workflows.ts
-var workflowsCommand = defineCommand43({
+var workflowsCommand = defineCommand44({
   meta: {
     name: "workflows",
     description: "Discover workflow guides"
@@ -4939,7 +4955,7 @@ var workflowsCommand = defineCommand43({
     if (args.id) {
       const guide = guides.find((g) => g.id === String(args.id));
       if (!guide) {
-        consola34.info(`Available: ${guides.map((g) => g.id).join(", ")}`);
+        consola35.info(`Available: ${guides.map((g) => g.id).join(", ")}`);
         throw new CliError(`Guide not found: ${args.id}`);
       }
       if (args.json) {
@@ -4982,7 +4998,7 @@ var workflowsCommand = defineCommand43({
 import { existsSync as existsSync10, mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join7 } from "path";
-import consola35 from "consola";
+import consola36 from "consola";
 var PACKAGE_NAME = "@openape/apes";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 var CACHE_FILE = join7(homedir6(), ".config", "apes", ".version-check.json");
@@ -5027,7 +5043,7 @@ async function fetchLatestVersion() {
 }
 function warnIfBehind(currentVersion, latest) {
   if (compareSemver(currentVersion, latest) < 0) {
-    consola35.warn(
+    consola36.warn(
       `apes ${currentVersion} is behind latest @openape/apes@${latest}. Run \`npm i -g @openape/apes@latest\` to update. (Suppress with APES_NO_UPDATE_CHECK=1.)`
     );
   }
@@ -5059,10 +5075,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"0.27.0"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"0.29.0"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"0.27.0"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"0.29.0"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -5086,7 +5102,7 @@ if (shellRewrite) {
   }
 }
 var debug = process.argv.includes("--debug");
-var grantsCommand = defineCommand44({
+var grantsCommand = defineCommand45({
   meta: {
     name: "grants",
     description: "Grant management"
@@ -5107,7 +5123,7 @@ var grantsCommand = defineCommand44({
     "delegation-revoke": delegationRevokeCommand
   }
 });
-var configCommand = defineCommand44({
+var configCommand = defineCommand45({
   meta: {
     name: "config",
     description: "Configuration management"
@@ -5117,10 +5133,10 @@ var configCommand = defineCommand44({
     set: configSetCommand
   }
 });
-var main = defineCommand44({
+var main = defineCommand45({
   meta: {
     name: "apes",
-    version: "0.27.0",
+    version: "0.29.0",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {
@@ -5175,20 +5191,20 @@ async function maybeRefreshAuth() {
   }
 }
 await maybeRefreshAuth();
-await maybeWarnStaleVersion("0.27.0").catch(() => {
+await maybeWarnStaleVersion("0.29.0").catch(() => {
 });
 runMain(main).catch((err) => {
   if (err instanceof CliExit) {
     process.exit(err.exitCode);
   }
   if (err instanceof CliError) {
-    consola36.error(err.message);
+    consola37.error(err.message);
     process.exit(err.exitCode);
   }
   if (debug) {
-    consola36.error(err);
+    consola37.error(err);
   } else {
-    consola36.error(err instanceof ApiError ? err.message : err instanceof Error ? err.message : String(err));
+    consola37.error(err instanceof ApiError ? err.message : err instanceof Error ? err.message : String(err));
   }
   process.exit(1);
 });