@opengeni/react 1.0.1 → 2.2.0-canary.0

package/dist/{chunk-HA46CYQK.js → chunk-XXWH2JLC.js}

@@ -1,12 +1,11 @@
 import {
   useMutationRunner,
-  usePageLiveActivity,
-  usePolledValue
+  usePageLiveActivity
 } from "./chunk-KZ73RL76.js";
 import {
   OpenGeniContext,
   useOpenGeni
-} from "./chunk-C5ZPSSS5.js";
+} from "./chunk-NEXLLTP4.js";
 import {
   formatBytes,
   formatRelativeTime
@@ -284,11 +283,15 @@ function MachineMetrics({ metrics, density = "compact", className }) {
 
 // src/components/machine-card.tsx
 import {
+  AlertTriangleIcon,
   ArrowRightIcon,
   CpuIcon,
+  CircleCheckIcon,
+  DownloadIcon,
   LaptopIcon,
   MonitorIcon,
   MonitorOffIcon,
+  LoaderCircleIcon,
   ServerIcon,
   UsersIcon
 } from "lucide-react";
@@ -505,6 +508,8 @@ function MachineCard({
   machine,
   onAttach,
   attaching,
+  onUpdateAgent,
+  updatingAgent,
   series,
   onOpenDetail,
   now,
@@ -517,6 +522,34 @@ function MachineCard({
   const sampledAgo = machine.metrics ? formatRelativeTime(machine.metrics.sampledAt, new Date(clockNow)) : null;
   const cpuPts = (series ?? []).map((s) => ({ t: new Date(s.sampledAt).getTime(), v: s.cpuPct }));
   const openable = Boolean(onOpenDetail);
+  const runtime = machine.runtime;
+  const updateRunning = runtime?.versionState === "updating";
+  const dispatchConfirmationStalled = runtime?.update?.status === "requested" && clockNow - new Date(runtime.update.updatedAt).getTime() >= 3e4;
+  const canUpdate = Boolean(machine.enrollmentId && onUpdateAgent) && !offline && (runtime?.versionState === "outdated" || runtime?.versionState === "update_failed" || dispatchConfirmationStalled);
+  const updateLabel = (() => {
+    const update = runtime?.update;
+    if (!update) return null;
+    switch (update.status) {
+      case "requested":
+        return dispatchConfirmationStalled ? "Agent confirmation delayed" : "Confirming with agent";
+      case "accepted":
+        return "Update accepted";
+      case "waiting_for_idle":
+        return "Waiting for current work";
+      case "downloading":
+      case "verifying":
+      case "applying":
+        return `${update.status}\u2026`;
+      case "restarting":
+        return "Restarting agent";
+      case "succeeded":
+        return `Updated \xB7 v${update.targetVersion}`;
+      case "failed": {
+        const detail = update.errorCode?.replaceAll("_", " ");
+        return update.rolledBack ? `Update rolled back safely${detail ? ` \xB7 ${detail}` : ""}` : `Update failed${detail ? ` \xB7 ${detail}` : ""}`;
+      }
+    }
+  })();
   return /* @__PURE__ */ jsxs5(
     "div",
     {
@@ -556,6 +589,8 @@ function MachineCard({
                 ) : null
               ] }),
               /* @__PURE__ */ jsxs5("div", { className: "mt-0.5 flex flex-wrap items-center gap-x-2 gap-y-0.5 text-og-xs text-og-fg-subtle", children: [
+                /* @__PURE__ */ jsx5("span", { "data-machine-scope": machine.scope, className: "capitalize", children: machine.scope === "user" ? "personal" : machine.scope }),
+                /* @__PURE__ */ jsx5("span", { "aria-hidden": true, children: "\xB7" }),
                 /* @__PURE__ */ jsx5("span", { className: "capitalize", children: machine.isSessionGroup ? "session sandbox" : machine.kind }),
                 /* @__PURE__ */ jsx5("span", { "aria-hidden": true, children: "\xB7" }),
                 /* @__PURE__ */ jsxs5("span", { className: "font-og-mono", children: [
@@ -595,6 +630,51 @@ function MachineCard({
             ]
           }
         ) : null,
+        machine.connectionAuthority.duplicateRunnerDeniedCount > 0 ? /* @__PURE__ */ jsxs5(
+          "p",
+          {
+            "data-runner-conflict": true,
+            className: "flex items-center gap-1.5 rounded-og-md border border-og-status-failed/30 bg-og-status-failed/5 px-2.5 py-1.5 text-og-xs text-og-status-failed",
+            children: [
+              /* @__PURE__ */ jsx5(AlertTriangleIcon, { className: "size-3.5 shrink-0", "aria-hidden": true }),
+              "Competing agent process blocked. Open diagnostics for details."
+            ]
+          }
+        ) : null,
+        runtime ? /* @__PURE__ */ jsxs5(
+          "div",
+          {
+            "data-agent-runtime": true,
+            className: "flex items-center justify-between gap-3 rounded-og-md border border-og-border/70 bg-og-surface-2/35 px-2.5 py-2 text-og-xs",
+            children: [
+              /* @__PURE__ */ jsxs5("div", { className: "min-w-0", children: [
+                /* @__PURE__ */ jsxs5("div", { className: "flex items-center gap-1.5 text-og-fg-muted", children: [
+                  runtime.versionState === "current" ? /* @__PURE__ */ jsx5(CircleCheckIcon, { className: "size-3.5 text-og-status-idle", "aria-hidden": true }) : updateRunning ? /* @__PURE__ */ jsx5(LoaderCircleIcon, { className: "size-3.5 animate-og-spin text-og-accent", "aria-hidden": true }) : /* @__PURE__ */ jsx5(DownloadIcon, { className: "size-3.5", "aria-hidden": true }),
+                  /* @__PURE__ */ jsxs5("span", { className: "truncate", children: [
+                    "Agent",
+                    " ",
+                    runtime.installedVersion ? `v${runtime.installedVersion}` : "version unknown"
+                  ] })
+                ] }),
+                /* @__PURE__ */ jsx5("p", { className: "mt-0.5 truncate text-og-fg-subtle", children: updateLabel ?? (runtime.versionState === "current" ? `Current \xB7 ${runtime.updateChannel ?? "channel unknown"}` : runtime.desiredVersion ? `Promoted v${runtime.desiredVersion}` : "No promoted version configured") })
+              ] }),
+              canUpdate ? /* @__PURE__ */ jsx5(
+                "button",
+                {
+                  type: "button",
+                  "data-update-agent": true,
+                  disabled: updatingAgent,
+                  onClick: (event) => {
+                    event.stopPropagation();
+                    onUpdateAgent?.(machine);
+                  },
+                  className: "shrink-0 rounded-og-sm border border-og-border px-2 py-1 font-medium text-og-fg-muted transition-colors hover:border-og-border-strong hover:text-og-fg disabled:cursor-not-allowed disabled:opacity-50 pointer-coarse:min-h-11",
+                  children: updatingAgent ? "Starting\u2026" : dispatchConfirmationStalled ? "Retry delivery" : runtime.versionState === "update_failed" ? "Retry" : "Update"
+                }
+              ) : null
+            ]
+          }
+        ) : null,
         /* @__PURE__ */ jsx5(MachineMetrics, { metrics: machine.metrics }),
         cpuPts.length > 1 ? /* @__PURE__ */ jsxs5("div", { className: "flex flex-col gap-1 rounded-og-md bg-og-surface-2/40 p-2.5", children: [
           /* @__PURE__ */ jsxs5("div", { className: "flex items-center justify-between text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: [
@@ -888,6 +968,7 @@ function MetricHistoryChart({
 
 // src/components/machines/machine-detail.tsx
 import {
+  AlertTriangleIcon as AlertTriangleIcon3,
   ArrowLeftIcon,
   CpuIcon as CpuIcon2,
   LaptopIcon as LaptopIcon2,
@@ -979,12 +1060,177 @@ function pointsFor(def, samples) {
   return ptsFrom(samples, def.pick);
 }
 
-// src/components/machines/machine-detail.tsx
+// src/components/machines/machine-operation-policy.tsx
+import { AlertTriangleIcon as AlertTriangleIcon2, Loader2Icon } from "lucide-react";
+import { useEffect, useState as useState2 } from "react";
 import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+function fieldValue(value) {
+  return value === null ? "" : String(value);
+}
+function parseByteCount(label, value) {
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  if (!/^\d+$/.test(trimmed)) {
+    throw new Error(`${label} must be a whole number of bytes or blank`);
+  }
+  const parsed = Number(trimmed);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    throw new Error(`${label} must be a positive safe-integer byte count or blank`);
+  }
+  return parsed;
+}
+function parseCpuMillicores(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  if (!/^\d+$/.test(trimmed)) {
+    throw new Error("CPU maximum must be a whole number of millicores or blank");
+  }
+  const parsed = Number(trimmed);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0 || parsed > 4294967295) {
+    throw new Error("CPU maximum must be between 1 and 4294967295 millicores or blank");
+  }
+  return parsed;
+}
+function MachineOperationPolicyEditor({
+  policy,
+  memorySupported,
+  cpuSupported,
+  saving = false,
+  onSave
+}) {
+  const [memoryMaxBytes, setMemoryMaxBytes] = useState2(fieldValue(policy.memoryMaxBytes));
+  const [memoryHighBytes, setMemoryHighBytes] = useState2(fieldValue(policy.memoryHighBytes));
+  const [cpuMaxMillicores, setCpuMaxMillicores] = useState2(fieldValue(policy.cpuMaxMillicores));
+  const [validationError, setValidationError] = useState2(null);
+  useEffect(() => {
+    setMemoryMaxBytes(fieldValue(policy.memoryMaxBytes));
+    setMemoryHighBytes(fieldValue(policy.memoryHighBytes));
+    setCpuMaxMillicores(fieldValue(policy.cpuMaxMillicores));
+    setValidationError(null);
+  }, [policy.memoryMaxBytes, policy.memoryHighBytes, policy.cpuMaxMillicores, policy.revision]);
+  const submit = async (event) => {
+    event.preventDefault();
+    try {
+      const max = parseByteCount("Hard ceiling", memoryMaxBytes);
+      const high = parseByteCount("Reclaim threshold", memoryHighBytes);
+      if (max !== null && high !== null && high > max) {
+        throw new Error("Reclaim threshold cannot exceed the hard ceiling");
+      }
+      const cpuMax = parseCpuMillicores(cpuMaxMillicores);
+      setValidationError(null);
+      await onSave({
+        memoryMaxBytes: max,
+        memoryHighBytes: high,
+        cpuMaxMillicores: cpuMax,
+        expectedRevision: policy.revision
+      });
+    } catch (error) {
+      setValidationError(error instanceof Error ? error.message : String(error));
+    }
+  };
+  const configured = policy.memoryMaxBytes !== null || policy.memoryHighBytes !== null || policy.cpuMaxMillicores !== null;
+  const memoryConfigured = policy.memoryMaxBytes !== null || policy.memoryHighBytes !== null;
+  const unsupportedMemory = memoryConfigured && !memorySupported;
+  const unsupportedCpu = policy.cpuMaxMillicores !== null && (!memorySupported || !cpuSupported);
+  return /* @__PURE__ */ jsxs7(
+    "section",
+    {
+      "data-machine-operation-policy": true,
+      className: "rounded-og-lg border border-og-border bg-og-surface-1 p-4 shadow-og-sm",
+      children: [
+        /* @__PURE__ */ jsxs7("div", { className: "flex flex-col gap-1", children: [
+          /* @__PURE__ */ jsx7("h2", { className: "text-og-sm font-semibold text-og-fg", children: "Per-command resource policy" }),
+          /* @__PURE__ */ jsx7("p", { className: "text-og-xs leading-relaxed text-og-fg-muted", children: "Optional limits applied separately to each newly admitted exec and Git command. Running commands keep their admitted policy. Blank means unrestricted. The runner or host may apply a stricter explicit policy; browser, computer-use, and terminal capabilities remain unchanged." })
+        ] }),
+        configured && (unsupportedMemory || unsupportedCpu) ? /* @__PURE__ */ jsxs7("div", { className: "mt-3 flex gap-2 rounded-og-md border border-og-status-failed/40 bg-og-status-failed/5 p-3 text-og-xs text-og-status-failed", children: [
+          /* @__PURE__ */ jsx7(AlertTriangleIcon2, { className: "mt-0.5 size-3.5 shrink-0", "aria-hidden": true }),
+          /* @__PURE__ */ jsxs7("span", { children: [
+            unsupportedCpu ? "This runner cannot enforce the configured CPU limit." : "This runner cannot enforce the configured memory limit.",
+            " ",
+            "Command execution fails closed until the current runner, OS, and service configuration can enforce it, or the unsupported limit is cleared. You can still save limits now for later enforcement."
+          ] })
+        ] }) : null,
+        /* @__PURE__ */ jsxs7("form", { className: "mt-4 grid gap-3 sm:grid-cols-2", onSubmit: submit, children: [
+          /* @__PURE__ */ jsxs7("label", { className: "flex flex-col gap-1.5 text-og-xs text-og-fg-muted", children: [
+            "Hard ceiling (bytes)",
+            /* @__PURE__ */ jsx7(
+              "input",
+              {
+                inputMode: "numeric",
+                pattern: "[0-9]*",
+                value: memoryMaxBytes,
+                onChange: (event) => setMemoryMaxBytes(event.target.value),
+                placeholder: "Unlimited",
+                disabled: saving,
+                className: "min-h-9 rounded-og-sm border border-og-border bg-og-bg px-2.5 font-og-mono text-og-sm text-og-fg outline-hidden focus-visible:ring-2 focus-visible:ring-og-accent/50 disabled:opacity-60"
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxs7("label", { className: "flex flex-col gap-1.5 text-og-xs text-og-fg-muted", children: [
+            "Reclaim threshold (bytes)",
+            /* @__PURE__ */ jsx7(
+              "input",
+              {
+                inputMode: "numeric",
+                pattern: "[0-9]*",
+                value: memoryHighBytes,
+                onChange: (event) => setMemoryHighBytes(event.target.value),
+                placeholder: "Unlimited",
+                disabled: saving,
+                className: "min-h-9 rounded-og-sm border border-og-border bg-og-bg px-2.5 font-og-mono text-og-sm text-og-fg outline-hidden focus-visible:ring-2 focus-visible:ring-og-accent/50 disabled:opacity-60"
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsxs7("label", { className: "flex flex-col gap-1.5 text-og-xs text-og-fg-muted", children: [
+            "CPU maximum (millicores)",
+            /* @__PURE__ */ jsx7(
+              "input",
+              {
+                inputMode: "numeric",
+                pattern: "[0-9]*",
+                value: cpuMaxMillicores,
+                onChange: (event) => setCpuMaxMillicores(event.target.value),
+                placeholder: "Unlimited",
+                disabled: saving,
+                className: "min-h-9 rounded-og-sm border border-og-border bg-og-bg px-2.5 font-og-mono text-og-sm text-og-fg outline-hidden focus-visible:ring-2 focus-visible:ring-og-accent/50 disabled:opacity-60"
+              }
+            ),
+            /* @__PURE__ */ jsx7("span", { children: "1000 millicores = one CPU core. Blank is unlimited." })
+          ] }),
+          /* @__PURE__ */ jsxs7("div", { className: "flex min-h-9 items-center justify-between gap-3 sm:col-span-2", children: [
+            /* @__PURE__ */ jsx7(
+              "span",
+              {
+                role: validationError ? "alert" : void 0,
+                className: "text-og-xs text-og-status-failed",
+                children: validationError
+              }
+            ),
+            /* @__PURE__ */ jsxs7(
+              "button",
+              {
+                type: "submit",
+                disabled: saving,
+                className: "inline-flex min-h-9 items-center gap-1.5 rounded-og-sm bg-og-accent px-3 py-1.5 text-og-xs font-medium text-og-accent-fg transition-colors hover:bg-og-accent-strong disabled:cursor-not-allowed disabled:opacity-60",
+                children: [
+                  saving ? /* @__PURE__ */ jsx7(Loader2Icon, { className: "size-3.5 animate-spin", "aria-hidden": true }) : null,
+                  "Save policy"
+                ]
+              }
+            )
+          ] })
+        ] })
+      ]
+    }
+  );
+}
+
+// src/components/machines/machine-detail.tsx
+import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
 function KindIcon2({ kind, session }) {
-  if (session) return /* @__PURE__ */ jsx7(ServerIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
-  if (kind === "modal") return /* @__PURE__ */ jsx7(CpuIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
-  return /* @__PURE__ */ jsx7(LaptopIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  if (session) return /* @__PURE__ */ jsx8(ServerIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  if (kind === "modal") return /* @__PURE__ */ jsx8(CpuIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  return /* @__PURE__ */ jsx8(LaptopIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
 }
 function MachineDetail({
   machine,
@@ -994,6 +1240,8 @@ function MachineDetail({
   loadingSeries,
   onBack,
   onRemove,
+  onUpdateOperationPolicy,
+  updatingOperationPolicy,
   now = Date.now(),
   className
 }) {
@@ -1001,31 +1249,33 @@ function MachineDetail({
   const tone = HEALTH_TOKEN[health.level];
   const latest = machine.metrics;
   const sampledAgo = latest ? formatRelativeTime(latest.sampledAt, new Date(now)) : null;
+  const authority = machine.connectionAuthority;
+  const duplicateDeniedAgo = authority.duplicateRunnerDeniedAt ? formatRelativeTime(authority.duplicateRunnerDeniedAt, new Date(now)) : null;
   const visible = METRICS.filter((m) => !(m.key === "gpu" && latest?.gpuUtilPct == null));
   const tileCols = visible.length >= 5 ? "grid-cols-2 sm:grid-cols-3 lg:grid-cols-5" : "grid-cols-2 sm:grid-cols-4";
-  return /* @__PURE__ */ jsxs7("div", { className: cn("og-root mx-auto flex w-full max-w-5xl flex-col gap-5", className), children: [
-    /* @__PURE__ */ jsxs7("div", { className: "flex items-center justify-between gap-3", children: [
-      /* @__PURE__ */ jsxs7("div", { className: "flex min-w-0 items-center gap-2.5", children: [
-        onBack && /* @__PURE__ */ jsx7(
+  return /* @__PURE__ */ jsxs8("div", { className: cn("og-root mx-auto flex w-full max-w-5xl flex-col gap-5", className), children: [
+    /* @__PURE__ */ jsxs8("div", { className: "flex items-center justify-between gap-3", children: [
+      /* @__PURE__ */ jsxs8("div", { className: "flex min-w-0 items-center gap-2.5", children: [
+        onBack && /* @__PURE__ */ jsx8(
           "button",
           {
             type: "button",
             onClick: onBack,
             className: "flex size-7 shrink-0 items-center justify-center rounded-og-sm border border-og-border bg-og-surface-1 text-og-fg-muted transition-colors hover:bg-og-surface-2 hover:text-og-fg",
             "aria-label": "Back to machines",
-            children: /* @__PURE__ */ jsx7(ArrowLeftIcon, { className: "size-3.5", "aria-hidden": true })
+            children: /* @__PURE__ */ jsx8(ArrowLeftIcon, { className: "size-3.5", "aria-hidden": true })
           }
         ),
-        /* @__PURE__ */ jsx7(KindIcon2, { kind: machine.kind, session: machine.isSessionGroup }),
-        /* @__PURE__ */ jsx7("h1", { className: "truncate text-og-md font-semibold text-og-fg", children: machine.name }),
-        /* @__PURE__ */ jsxs7("span", { className: "hidden shrink-0 rounded-og-sm border border-og-border bg-og-surface-1 px-1.5 py-0.5 font-og-mono text-og-xs text-og-fg-subtle sm:inline", children: [
+        /* @__PURE__ */ jsx8(KindIcon2, { kind: machine.kind, session: machine.isSessionGroup }),
+        /* @__PURE__ */ jsx8("h1", { className: "truncate text-og-md font-semibold text-og-fg", children: machine.name }),
+        /* @__PURE__ */ jsxs8("span", { className: "hidden shrink-0 rounded-og-sm border border-og-border bg-og-surface-1 px-1.5 py-0.5 font-og-mono text-og-xs text-og-fg-subtle sm:inline", children: [
           machine.os,
           " \xB7 ",
           machine.arch
         ] })
       ] }),
-      /* @__PURE__ */ jsxs7("div", { className: "flex shrink-0 items-center gap-2", children: [
-        onRemove && machine.enrollmentId && !machine.isSessionGroup ? /* @__PURE__ */ jsxs7(
+      /* @__PURE__ */ jsxs8("div", { className: "flex shrink-0 items-center gap-2", children: [
+        onRemove && machine.enrollmentId && !machine.isSessionGroup ? /* @__PURE__ */ jsxs8(
           "button",
           {
             type: "button",
@@ -1034,12 +1284,12 @@ function MachineDetail({
             onClick: () => onRemove(machine),
             className: "inline-flex min-h-9 items-center gap-1.5 rounded-og-sm border border-og-status-failed/40 px-2.5 py-1 font-medium text-og-xs text-og-status-failed transition-colors hover:bg-og-status-failed/10 focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-og-status-failed/50 pointer-coarse:min-h-11",
             children: [
-              /* @__PURE__ */ jsx7(Trash2Icon, { className: "size-3.5", "aria-hidden": true }),
-              /* @__PURE__ */ jsx7("span", { className: "hidden sm:inline", children: "Remove machine" })
+              /* @__PURE__ */ jsx8(Trash2Icon, { className: "size-3.5", "aria-hidden": true }),
+              /* @__PURE__ */ jsx8("span", { className: "hidden sm:inline", children: "Remove machine" })
             ]
           }
         ) : null,
-        /* @__PURE__ */ jsx7("div", { className: "flex items-center gap-0.5 rounded-og-md border border-og-border bg-og-surface-1 p-0.5", children: METRIC_WINDOWS.map((w) => /* @__PURE__ */ jsx7(
+        /* @__PURE__ */ jsx8("div", { className: "flex items-center gap-0.5 rounded-og-md border border-og-border bg-og-surface-1 p-0.5", children: METRIC_WINDOWS.map((w) => /* @__PURE__ */ jsx8(
           "button",
           {
             type: "button",
@@ -1055,7 +1305,7 @@ function MachineDetail({
         )) })
       ] })
     ] }),
-    /* @__PURE__ */ jsxs7(
+    /* @__PURE__ */ jsxs8(
       "div",
       {
         className: cn(
@@ -1063,11 +1313,11 @@ function MachineDetail({
           tone.soft
         ),
         children: [
-          /* @__PURE__ */ jsx7("span", { "aria-hidden": true, className: cn("absolute inset-y-0 left-0 w-1", tone.dot) }),
-          /* @__PURE__ */ jsxs7("div", { className: "flex flex-wrap items-center justify-between gap-3 pl-1", children: [
-            /* @__PURE__ */ jsxs7("div", { className: "flex items-center gap-3", children: [
-              /* @__PURE__ */ jsxs7("span", { className: "relative flex size-3", children: [
-                healthPulses(health.level) && /* @__PURE__ */ jsx7(
+          /* @__PURE__ */ jsx8("span", { "aria-hidden": true, className: cn("absolute inset-y-0 left-0 w-1", tone.dot) }),
+          /* @__PURE__ */ jsxs8("div", { className: "flex flex-wrap items-center justify-between gap-3 pl-1", children: [
+            /* @__PURE__ */ jsxs8("div", { className: "flex items-center gap-3", children: [
+              /* @__PURE__ */ jsxs8("span", { className: "relative flex size-3", children: [
+                healthPulses(health.level) && /* @__PURE__ */ jsx8(
                   "span",
                   {
                     className: cn(
@@ -1076,18 +1326,18 @@ function MachineDetail({
                     )
                   }
                 ),
-                /* @__PURE__ */ jsx7("span", { className: cn("relative inline-flex size-3 rounded-full", tone.dot) })
+                /* @__PURE__ */ jsx8("span", { className: cn("relative inline-flex size-3 rounded-full", tone.dot) })
               ] }),
-              /* @__PURE__ */ jsxs7("div", { className: "flex flex-col", children: [
-                /* @__PURE__ */ jsx7("span", { className: cn("text-og-md font-semibold", tone.text), children: health.label }),
-                /* @__PURE__ */ jsx7("span", { className: "text-og-sm text-og-fg-muted", children: health.reason })
+              /* @__PURE__ */ jsxs8("div", { className: "flex flex-col", children: [
+                /* @__PURE__ */ jsx8("span", { className: cn("text-og-md font-semibold", tone.text), children: health.label }),
+                /* @__PURE__ */ jsx8("span", { className: "text-og-sm text-og-fg-muted", children: health.reason })
               ] })
             ] }),
-            /* @__PURE__ */ jsxs7("div", { className: "flex items-start gap-5 pr-1", children: [
-              sampledAgo && /* @__PURE__ */ jsxs7("div", { className: "flex flex-col items-end gap-0.5", children: [
-                /* @__PURE__ */ jsx7("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "Sampled" }),
-                /* @__PURE__ */ jsxs7("span", { className: "flex items-center gap-1 font-og-mono text-og-sm tabular-nums text-og-fg", children: [
-                  /* @__PURE__ */ jsx7(
+            /* @__PURE__ */ jsxs8("div", { className: "flex items-start gap-5 pr-1", children: [
+              sampledAgo && /* @__PURE__ */ jsxs8("div", { className: "flex flex-col items-end gap-0.5", children: [
+                /* @__PURE__ */ jsx8("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "Sampled" }),
+                /* @__PURE__ */ jsxs8("span", { className: "flex items-center gap-1 font-og-mono text-og-sm tabular-nums text-og-fg", children: [
+                  /* @__PURE__ */ jsx8(
                     RadioIcon,
                     {
                       className: cn("size-3", health.stale ? "text-og-fg-subtle" : tone.text),
@@ -1097,13 +1347,13 @@ function MachineDetail({
                   sampledAgo === "now" ? "live" : `${sampledAgo} ago`
                 ] })
               ] }),
-              machine.lastSeenAt && /* @__PURE__ */ jsxs7("div", { className: "hidden flex-col items-end gap-0.5 sm:flex", children: [
-                /* @__PURE__ */ jsx7("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "Last seen" }),
-                /* @__PURE__ */ jsx7("span", { className: "font-og-mono text-og-sm tabular-nums text-og-fg-muted", children: formatRelativeTime(machine.lastSeenAt, new Date(now)) })
+              machine.lastSeenAt && /* @__PURE__ */ jsxs8("div", { className: "hidden flex-col items-end gap-0.5 sm:flex", children: [
+                /* @__PURE__ */ jsx8("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "Last seen" }),
+                /* @__PURE__ */ jsx8("span", { className: "font-og-mono text-og-sm tabular-nums text-og-fg-muted", children: formatRelativeTime(machine.lastSeenAt, new Date(now)) })
               ] })
             ] })
           ] }),
-          latest && /* @__PURE__ */ jsx7(
+          latest && /* @__PURE__ */ jsx8(
             "div",
             {
               className: cn(
@@ -1112,30 +1362,64 @@ function MachineDetail({
               ),
               children: visible.map((m) => {
                 const pts = pointsFor(m, series);
-                return /* @__PURE__ */ jsxs7("div", { className: "flex flex-col gap-1.5 bg-og-surface-1 p-3", children: [
-                  /* @__PURE__ */ jsx7("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: m.title }),
-                  /* @__PURE__ */ jsx7("span", { className: "font-og-mono text-og-md font-medium tabular-nums text-og-fg", children: m.current(latest) }),
-                  /* @__PURE__ */ jsx7(MetricSparkline, { points: pts, color: m.color, yMax: m.yMax, height: 22 }),
-                  m.sub && /* @__PURE__ */ jsx7("span", { className: "truncate font-og-mono text-[10px] text-og-fg-subtle", children: m.sub(latest) })
+                return /* @__PURE__ */ jsxs8("div", { className: "flex flex-col gap-1.5 bg-og-surface-1 p-3", children: [
+                  /* @__PURE__ */ jsx8("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: m.title }),
+                  /* @__PURE__ */ jsx8("span", { className: "font-og-mono text-og-md font-medium tabular-nums text-og-fg", children: m.current(latest) }),
+                  /* @__PURE__ */ jsx8(MetricSparkline, { points: pts, color: m.color, yMax: m.yMax, height: 22 }),
+                  m.sub && /* @__PURE__ */ jsx8("span", { className: "truncate font-og-mono text-[10px] text-og-fg-subtle", children: m.sub(latest) })
                 ] }, m.key);
               })
             }
-          )
+          ),
+          authority.state !== "not_applicable" ? /* @__PURE__ */ jsxs8(
+            "div",
+            {
+              "data-connection-authority": authority.state,
+              className: "flex flex-wrap items-center justify-between gap-2 rounded-og-md border border-og-border bg-og-surface-1/75 px-3 py-2 text-og-xs",
+              children: [
+                /* @__PURE__ */ jsxs8("span", { className: "text-og-fg-muted", children: [
+                  "Runner ",
+                  authority.state.replace("_", " "),
+                  " \xB7 generation ",
+                  authority.generation,
+                  authority.supersededCount > 0 ? ` \xB7 ${authority.supersededCount} earlier ${authority.supersededCount === 1 ? "runner" : "runners"} fenced` : ""
+                ] }),
+                authority.duplicateRunnerDeniedCount > 0 ? /* @__PURE__ */ jsxs8("span", { className: "inline-flex items-center gap-1.5 text-og-status-failed", children: [
+                  /* @__PURE__ */ jsx8(AlertTriangleIcon3, { className: "size-3.5", "aria-hidden": true }),
+                  "Blocked ",
+                  authority.duplicateRunnerDeniedCount,
+                  " competing runner",
+                  authority.duplicateRunnerDeniedCount === 1 ? "" : "s",
+                  duplicateDeniedAgo ? ` \xB7 ${duplicateDeniedAgo === "now" ? "now" : `${duplicateDeniedAgo} ago`}` : ""
+                ] }) : null
+              ]
+            }
+          ) : null
         ]
       }
     ),
-    /* @__PURE__ */ jsx7("div", { className: "grid grid-cols-1 gap-3 lg:grid-cols-2", children: visible.map((m) => {
+    onUpdateOperationPolicy && machine.enrollmentId && machine.operationPolicy ? /* @__PURE__ */ jsx8(
+      MachineOperationPolicyEditor,
+      {
+        policy: machine.operationPolicy,
+        memorySupported: machine.runtime?.capabilities.operationResourcePolicy === true,
+        cpuSupported: machine.runtime?.capabilities.operationCpuQuota === true,
+        saving: updatingOperationPolicy,
+        onSave: (request) => onUpdateOperationPolicy(machine, request)
+      }
+    ) : null,
+    /* @__PURE__ */ jsx8("div", { className: "grid grid-cols-1 gap-3 lg:grid-cols-2", children: visible.map((m) => {
       const pts = pointsFor(m, series);
-      return /* @__PURE__ */ jsxs7(
+      return /* @__PURE__ */ jsxs8(
         "div",
         {
           className: "flex flex-col gap-3 rounded-og-lg border border-og-border bg-og-surface-1 p-4 shadow-og-sm",
           children: [
-            /* @__PURE__ */ jsxs7("div", { className: "flex items-baseline justify-between", children: [
-              /* @__PURE__ */ jsx7("span", { className: "text-og-sm font-medium text-og-fg", children: m.title }),
-              latest && /* @__PURE__ */ jsx7("span", { className: "font-og-mono text-og-sm tabular-nums text-og-fg-muted", children: m.current(latest) })
+            /* @__PURE__ */ jsxs8("div", { className: "flex items-baseline justify-between", children: [
+              /* @__PURE__ */ jsx8("span", { className: "text-og-sm font-medium text-og-fg", children: m.title }),
+              latest && /* @__PURE__ */ jsx8("span", { className: "font-og-mono text-og-sm tabular-nums text-og-fg-muted", children: m.current(latest) })
             ] }),
-            /* @__PURE__ */ jsx7(
+            /* @__PURE__ */ jsx8(
               MetricHistoryChart,
               {
                 points: pts,
@@ -1158,20 +1442,20 @@ function MachineDetail({
 
 // src/components/machines-dashboard.tsx
 import { LaptopIcon as LaptopIcon3, PlusIcon, RefreshCwIcon } from "lucide-react";
-import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
 function EmptyState({ onEnroll }) {
-  return /* @__PURE__ */ jsxs8(
+  return /* @__PURE__ */ jsxs9(
     "div",
     {
       "data-machines-empty": true,
       className: "flex flex-col items-center justify-center gap-3 rounded-og-lg border border-dashed border-og-border bg-og-surface-1 px-6 py-12 text-center",
       children: [
-        /* @__PURE__ */ jsx8("span", { className: "flex size-10 items-center justify-center rounded-full bg-og-surface-2 text-og-fg-subtle", children: /* @__PURE__ */ jsx8(LaptopIcon3, { className: "size-5", "aria-hidden": true }) }),
-        /* @__PURE__ */ jsxs8("div", { className: "space-y-1", children: [
-          /* @__PURE__ */ jsx8("p", { className: "text-og-base font-medium text-og-fg", children: "No machines yet" }),
-          /* @__PURE__ */ jsx8("p", { className: "max-w-xs text-og-sm text-og-fg-muted", children: "Connect your own computer to run the agent on it \u2014 your files, your terminal, your desktop." })
+        /* @__PURE__ */ jsx9("span", { className: "flex size-10 items-center justify-center rounded-full bg-og-surface-2 text-og-fg-subtle", children: /* @__PURE__ */ jsx9(LaptopIcon3, { className: "size-5", "aria-hidden": true }) }),
+        /* @__PURE__ */ jsxs9("div", { className: "space-y-1", children: [
+          /* @__PURE__ */ jsx9("p", { className: "text-og-base font-medium text-og-fg", children: "No machines yet" }),
+          /* @__PURE__ */ jsx9("p", { className: "max-w-xs text-og-sm text-og-fg-muted", children: "Connect your own computer to run the agent on it \u2014 your files, your terminal, your desktop." })
         ] }),
-        onEnroll ? /* @__PURE__ */ jsxs8(
+        onEnroll ? /* @__PURE__ */ jsxs9(
           "button",
           {
             type: "button",
@@ -1179,7 +1463,7 @@ function EmptyState({ onEnroll }) {
             onClick: onEnroll,
             className: "inline-flex items-center gap-1.5 rounded-og-sm bg-og-accent px-3 py-1.5 text-og-sm font-medium text-og-accent-fg transition-colors hover:bg-og-accent-strong pointer-coarse:min-h-11",
             children: [
-              /* @__PURE__ */ jsx8(PlusIcon, { className: "size-3.5", "aria-hidden": true }),
+              /* @__PURE__ */ jsx9(PlusIcon, { className: "size-3.5", "aria-hidden": true }),
               "Connect a machine"
             ]
           }
@@ -1194,13 +1478,13 @@ function Header({
   onRefresh,
   loading
 }) {
-  return /* @__PURE__ */ jsxs8("div", { className: "flex items-center justify-between gap-3", children: [
-    /* @__PURE__ */ jsxs8("div", { className: "flex items-baseline gap-2", children: [
-      /* @__PURE__ */ jsx8("h2", { className: "text-og-base font-semibold text-og-fg", children: "Machines" }),
-      /* @__PURE__ */ jsx8("span", { className: "font-og-mono text-og-xs text-og-fg-subtle", children: count })
+  return /* @__PURE__ */ jsxs9("div", { className: "flex items-center justify-between gap-3", children: [
+    /* @__PURE__ */ jsxs9("div", { className: "flex items-baseline gap-2", children: [
+      /* @__PURE__ */ jsx9("h2", { className: "text-og-base font-semibold text-og-fg", children: "Machines" }),
+      /* @__PURE__ */ jsx9("span", { className: "font-og-mono text-og-xs text-og-fg-subtle", children: count })
     ] }),
-    /* @__PURE__ */ jsxs8("div", { className: "flex items-center gap-1.5", children: [
-      onRefresh ? /* @__PURE__ */ jsx8(
+    /* @__PURE__ */ jsxs9("div", { className: "flex items-center gap-1.5", children: [
+      onRefresh ? /* @__PURE__ */ jsx9(
         "button",
         {
           type: "button",
@@ -1208,10 +1492,10 @@ function Header({
           onClick: onRefresh,
           title: "Refresh",
           className: "rounded-og-sm p-1.5 text-og-fg-subtle transition-colors hover:bg-og-surface-2 hover:text-og-fg",
-          children: /* @__PURE__ */ jsx8(RefreshCwIcon, { className: cn("size-3.5", loading && "animate-og-spin"), "aria-hidden": true })
+          children: /* @__PURE__ */ jsx9(RefreshCwIcon, { className: cn("size-3.5", loading && "animate-og-spin"), "aria-hidden": true })
         }
       ) : null,
-      onEnroll ? /* @__PURE__ */ jsxs8(
+      onEnroll ? /* @__PURE__ */ jsxs9(
         "button",
         {
           type: "button",
@@ -1219,7 +1503,7 @@ function Header({
           onClick: onEnroll,
           className: "inline-flex items-center gap-1.5 rounded-og-sm border border-og-border px-2.5 py-1 text-og-sm font-medium text-og-fg-muted transition-colors hover:border-og-border-strong hover:text-og-fg pointer-coarse:min-h-11",
           children: [
-            /* @__PURE__ */ jsx8(PlusIcon, { className: "size-3.5", "aria-hidden": true }),
+            /* @__PURE__ */ jsx9(PlusIcon, { className: "size-3.5", "aria-hidden": true }),
             "Connect a machine"
           ]
         }
@@ -1234,6 +1518,8 @@ function MachinesDashboard({
   error,
   onAttach,
   attachingSandboxId,
+  onUpdateAgent,
+  updatingEnrollmentId,
   seriesByMachine,
   onOpenDetail,
   now,
@@ -1242,19 +1528,19 @@ function MachinesDashboard({
   className
 }) {
   const isEmpty = !loading && !error && machines.length === 0;
-  return /* @__PURE__ */ jsxs8("section", { "data-machines-dashboard": true, className: cn("og-root flex flex-col gap-3", className), children: [
-    /* @__PURE__ */ jsx8(Header, { count: machines.length, onEnroll, onRefresh, loading }),
-    error ? /* @__PURE__ */ jsxs8(
+  return /* @__PURE__ */ jsxs9("section", { "data-machines-dashboard": true, className: cn("og-root flex flex-col gap-3", className), children: [
+    /* @__PURE__ */ jsx9(Header, { count: machines.length, onEnroll, onRefresh, loading }),
+    error ? /* @__PURE__ */ jsxs9(
       "div",
       {
         "data-machines-error": true,
         className: "flex flex-wrap items-center justify-between gap-2 rounded-og-md border border-og-status-failed/30 bg-og-status-failed/10 px-3 py-2 text-og-sm text-og-status-failed",
         children: [
-          /* @__PURE__ */ jsxs8("span", { children: [
+          /* @__PURE__ */ jsxs9("span", { children: [
             "Could not load machines: ",
             error.message
           ] }),
-          onRefresh ? /* @__PURE__ */ jsxs8(
+          onRefresh ? /* @__PURE__ */ jsxs9(
             "button",
             {
               type: "button",
@@ -1263,7 +1549,7 @@ function MachinesDashboard({
               disabled: loading,
               className: "inline-flex items-center gap-1.5 rounded-og-sm border border-og-status-failed/30 px-2 py-1 text-og-xs font-medium transition-colors hover:border-og-status-failed/50 disabled:cursor-not-allowed disabled:opacity-60 pointer-coarse:min-h-11",
               children: [
-                /* @__PURE__ */ jsx8(RefreshCwIcon, { className: cn("size-3.5", loading && "animate-og-spin"), "aria-hidden": true }),
+                /* @__PURE__ */ jsx9(RefreshCwIcon, { className: cn("size-3.5", loading && "animate-og-spin"), "aria-hidden": true }),
                 loading ? "Retrying\u2026" : "Retry"
               ]
             }
@@ -1271,13 +1557,13 @@ function MachinesDashboard({
         ]
       }
     ) : null,
-    loading && machines.length === 0 ? /* @__PURE__ */ jsx8("div", { "data-machines-loading": true, className: "grid gap-3 sm:grid-cols-2", children: [0, 1].map((i) => /* @__PURE__ */ jsx8(
+    loading && machines.length === 0 ? /* @__PURE__ */ jsx9("div", { "data-machines-loading": true, className: "grid gap-3 sm:grid-cols-2", children: [0, 1].map((i) => /* @__PURE__ */ jsx9(
       "div",
       {
         className: "h-36 animate-og-pulse rounded-og-lg border border-og-border bg-og-surface-1"
       },
       i
-    )) }) : isEmpty ? /* @__PURE__ */ jsx8(EmptyState, { onEnroll }) : /* @__PURE__ */ jsx8("div", { className: "grid gap-3 sm:grid-cols-2 xl:grid-cols-3", "data-machines-grid": true, children: machines.map((machine) => /* @__PURE__ */ jsx8(
+    )) }) : isEmpty ? /* @__PURE__ */ jsx9(EmptyState, { onEnroll }) : /* @__PURE__ */ jsx9("div", { className: "grid gap-3 sm:grid-cols-2 xl:grid-cols-3", "data-machines-grid": true, children: machines.map((machine) => /* @__PURE__ */ jsx9(
       MachineCard,
       {
         machine: {
@@ -1286,6 +1572,8 @@ function MachinesDashboard({
         },
         onAttach,
         attaching: attachingSandboxId === machine.sandboxId,
+        onUpdateAgent,
+        updatingAgent: updatingEnrollmentId === machine.enrollmentId,
         series: seriesByMachine?.[machine.sandboxId],
         onOpenDetail,
         now
@@ -1297,11 +1585,11 @@ function MachinesDashboard({
 
 // src/components/machine-dock-bar.tsx
 import { LaptopIcon as LaptopIcon4, CpuIcon as CpuIcon3, UsersIcon as UsersIcon2 } from "lucide-react";
-import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
+import { jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
 function MachineDockBar({ name, kind, state, className }) {
   const Icon = kind === "selfhosted" ? LaptopIcon4 : CpuIcon3;
   const stateBadge = MACHINE_STATE_BADGE_META[state];
-  return /* @__PURE__ */ jsxs9(
+  return /* @__PURE__ */ jsxs10(
     "div",
     {
       "data-machine-dock-bar": true,
@@ -1310,10 +1598,10 @@ function MachineDockBar({ name, kind, state, className }) {
         className
       ),
       children: [
-        /* @__PURE__ */ jsxs9("div", { className: "flex min-w-0 items-center gap-1.5", children: [
-          /* @__PURE__ */ jsx9(Icon, { className: "size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
-          /* @__PURE__ */ jsx9("span", { className: "truncate text-[11px] font-medium text-og-fg", children: name }),
-          stateBadge ? /* @__PURE__ */ jsx9(
+        /* @__PURE__ */ jsxs10("div", { className: "flex min-w-0 items-center gap-1.5", children: [
+          /* @__PURE__ */ jsx10(Icon, { className: "size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
+          /* @__PURE__ */ jsx10("span", { className: "truncate text-[11px] font-medium text-og-fg", children: name }),
+          stateBadge ? /* @__PURE__ */ jsx10(
             "span",
             {
               "data-state-badge": state,
@@ -1325,7 +1613,7 @@ function MachineDockBar({ name, kind, state, className }) {
             }
           ) : null
         ] }),
-        /* @__PURE__ */ jsx9(
+        /* @__PURE__ */ jsx10(
           ConnectionStatusPill,
           {
             status: connectionStatusForState(state),
@@ -1343,7 +1631,7 @@ function SharedMachineDisclosure({
   className
 }) {
   const others = Math.max(0, sharedSessionCount - 1);
-  return /* @__PURE__ */ jsxs9(
+  return /* @__PURE__ */ jsxs10(
     "div",
     {
       "data-shared-disclosure": true,
@@ -1353,8 +1641,8 @@ function SharedMachineDisclosure({
         className
       ),
       children: [
-        /* @__PURE__ */ jsx9(UsersIcon2, { className: "size-3.5 shrink-0 text-og-accent", "aria-hidden": true }),
-        /* @__PURE__ */ jsxs9("span", { children: [
+        /* @__PURE__ */ jsx10(UsersIcon2, { className: "size-3.5 shrink-0 text-og-accent", "aria-hidden": true }),
+        /* @__PURE__ */ jsxs10("span", { children: [
           "Shared \u2014 ",
           others === 1 ? "another session is" : `${others} other sessions are`,
           " on this machine. They see the same terminal, files, and desktop."
@@ -1366,7 +1654,7 @@ function SharedMachineDisclosure({
 
 // src/components/enrollment-device-flow.tsx
 import { CopyIcon, ExternalLinkIcon, LaptopIcon as LaptopIcon5, TerminalIcon } from "lucide-react";
-import { Fragment as Fragment2, jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
+import { Fragment as Fragment2, jsx as jsx11, jsxs as jsxs11 } from "react/jsx-runtime";
 var PHASE_TO_STATE = {
   pending: "enrolling",
   authorized: "online",
@@ -1382,7 +1670,7 @@ function PhaseLabel({ phase }) {
     expired: "Code expired",
     disabled: "Enrollment disabled"
   };
-  return /* @__PURE__ */ jsx10("span", { children: text[phase] });
+  return /* @__PURE__ */ jsx11("span", { children: text[phase] });
 }
 function EnrollmentDeviceFlow({
   userCode,
@@ -1399,7 +1687,7 @@ function EnrollmentDeviceFlow({
   const href = verificationUriComplete ?? verificationUri;
   const codeIsPlaceholder = !/[A-Za-z0-9]/.test(userCode);
   const awaitingCode = phase === "pending" && codeIsPlaceholder;
-  return /* @__PURE__ */ jsxs10(
+  return /* @__PURE__ */ jsxs11(
     "div",
     {
       "data-enrollment-device-flow": true,
@@ -1408,28 +1696,28 @@ function EnrollmentDeviceFlow({
         className
       ),
       children: [
-        /* @__PURE__ */ jsxs10("div", { className: "flex items-center justify-between gap-3", children: [
-          /* @__PURE__ */ jsxs10("div", { className: "flex items-center gap-2", children: [
-            /* @__PURE__ */ jsx10("span", { className: "flex size-7 items-center justify-center rounded-full bg-og-surface-2 text-og-fg-muted", children: /* @__PURE__ */ jsx10(LaptopIcon5, { className: "size-4", "aria-hidden": true }) }),
-            /* @__PURE__ */ jsx10("h2", { className: "text-og-menu font-semibold text-og-fg", children: "Connect a machine" })
+        /* @__PURE__ */ jsxs11("div", { className: "flex items-center justify-between gap-3", children: [
+          /* @__PURE__ */ jsxs11("div", { className: "flex items-center gap-2", children: [
+            /* @__PURE__ */ jsx11("span", { className: "flex size-7 items-center justify-center rounded-full bg-og-surface-2 text-og-fg-muted", children: /* @__PURE__ */ jsx11(LaptopIcon5, { className: "size-4", "aria-hidden": true }) }),
+            /* @__PURE__ */ jsx11("h2", { className: "text-og-menu font-semibold text-og-fg", children: "Connect a machine" })
           ] }),
-          /* @__PURE__ */ jsx10(
+          /* @__PURE__ */ jsx11(
             ConnectionStatusPill,
             {
               status: PHASE_TO_STATE[phase] === "online" ? "online" : PHASE_TO_STATE[phase] === "offline" ? "offline" : "reconnecting",
-              label: /* @__PURE__ */ jsx10(PhaseLabel, { phase }),
+              label: /* @__PURE__ */ jsx11(PhaseLabel, { phase }),
               size: "sm"
             }
           )
         ] }),
-        installCommand ? /* @__PURE__ */ jsxs10("div", { className: "flex flex-col gap-1.5", children: [
-          /* @__PURE__ */ jsx10("span", { className: "text-[11px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "1 \xB7 Run on the machine" }),
-          /* @__PURE__ */ jsxs10("div", { className: "flex items-center justify-between gap-2 overflow-hidden rounded-og-md border border-og-border bg-og-bg px-2.5 py-1.5", children: [
-            /* @__PURE__ */ jsxs10("code", { className: "flex min-w-0 items-center gap-2 overflow-x-auto font-og-mono text-[12px] text-og-fg", children: [
-              /* @__PURE__ */ jsx10(TerminalIcon, { className: "size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
+        installCommand ? /* @__PURE__ */ jsxs11("div", { className: "flex flex-col gap-1.5", children: [
+          /* @__PURE__ */ jsx11("span", { className: "text-[11px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "1 \xB7 Run on the machine" }),
+          /* @__PURE__ */ jsxs11("div", { className: "flex items-center justify-between gap-2 overflow-hidden rounded-og-md border border-og-border bg-og-bg px-2.5 py-1.5", children: [
+            /* @__PURE__ */ jsxs11("code", { className: "flex min-w-0 items-center gap-2 overflow-x-auto font-og-mono text-[12px] text-og-fg", children: [
+              /* @__PURE__ */ jsx11(TerminalIcon, { className: "size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
               installCommand
             ] }),
-            /* @__PURE__ */ jsx10(
+            /* @__PURE__ */ jsx11(
               "button",
               {
                 type: "button",
@@ -1437,15 +1725,15 @@ function EnrollmentDeviceFlow({
                 onClick: onCopyInstall,
                 title: "Copy command",
                 className: "shrink-0 rounded-og-sm p-1.5 text-og-fg-subtle transition-colors hover:bg-og-surface-2 hover:text-og-fg",
-                children: /* @__PURE__ */ jsx10(CopyIcon, { className: "size-4", "aria-hidden": true })
+                children: /* @__PURE__ */ jsx11(CopyIcon, { className: "size-4", "aria-hidden": true })
               }
             )
           ] })
         ] }) : null,
-        /* @__PURE__ */ jsxs10("div", { className: "flex flex-col gap-1.5", children: [
-          /* @__PURE__ */ jsx10("span", { className: "text-[11px] font-medium uppercase tracking-wide text-og-fg-subtle", children: installCommand ? "2 \xB7 Approve the machine" : "Approve the machine" }),
-          /* @__PURE__ */ jsxs10("div", { className: "flex items-center justify-between gap-3 rounded-og-md border border-og-border bg-og-bg px-3 py-2.5", children: [
-            awaitingCode ? /* @__PURE__ */ jsx10("span", { "data-user-code": true, className: "font-og-mono text-[13px] text-og-fg-subtle", children: "Run the command above \u2014 your code appears here" }) : /* @__PURE__ */ jsx10(
+        /* @__PURE__ */ jsxs11("div", { className: "flex flex-col gap-1.5", children: [
+          /* @__PURE__ */ jsx11("span", { className: "text-[11px] font-medium uppercase tracking-wide text-og-fg-subtle", children: installCommand ? "2 \xB7 Approve the machine" : "Approve the machine" }),
+          /* @__PURE__ */ jsxs11("div", { className: "flex items-center justify-between gap-3 rounded-og-md border border-og-border bg-og-bg px-3 py-2.5", children: [
+            awaitingCode ? /* @__PURE__ */ jsx11("span", { "data-user-code": true, className: "font-og-mono text-[13px] text-og-fg-subtle", children: "Run the command above \u2014 your code appears here" }) : /* @__PURE__ */ jsx11(
               "span",
               {
                 "data-user-code": true,
@@ -1453,7 +1741,7 @@ function EnrollmentDeviceFlow({
                 children: userCode
               }
             ),
-            /* @__PURE__ */ jsx10(
+            /* @__PURE__ */ jsx11(
               "button",
               {
                 type: "button",
@@ -1462,12 +1750,12 @@ function EnrollmentDeviceFlow({
                 disabled: awaitingCode,
                 title: "Copy code",
                 className: "shrink-0 rounded-og-sm p-1.5 text-og-fg-subtle transition-colors hover:bg-og-surface-2 hover:text-og-fg disabled:cursor-not-allowed disabled:opacity-40 disabled:hover:bg-transparent disabled:hover:text-og-fg-subtle",
-                children: /* @__PURE__ */ jsx10(CopyIcon, { className: "size-4", "aria-hidden": true })
+                children: /* @__PURE__ */ jsx11(CopyIcon, { className: "size-4", "aria-hidden": true })
               }
             )
           ] })
         ] }),
-        /* @__PURE__ */ jsxs10(
+        /* @__PURE__ */ jsxs11(
           "a",
           {
             href,
@@ -1478,23 +1766,23 @@ function EnrollmentDeviceFlow({
             className: "inline-flex items-center justify-center gap-1.5 rounded-og-sm bg-og-accent px-3 py-2 text-og-menu font-medium text-og-accent-fg transition-colors hover:bg-og-accent-strong",
             children: [
               "Open approval page",
-              /* @__PURE__ */ jsx10(ExternalLinkIcon, { className: "size-3.5", "aria-hidden": true })
+              /* @__PURE__ */ jsx11(ExternalLinkIcon, { className: "size-3.5", "aria-hidden": true })
             ]
           }
         ),
-        /* @__PURE__ */ jsx10("p", { className: "text-center text-[11px] text-og-fg-subtle", children: awaitingCode ? /* @__PURE__ */ jsxs10(Fragment2, { children: [
+        /* @__PURE__ */ jsx11("p", { className: "text-center text-[11px] text-og-fg-subtle", children: awaitingCode ? /* @__PURE__ */ jsxs11(Fragment2, { children: [
           "The one-liner prints a short code. Open",
           " ",
-          /* @__PURE__ */ jsx10("span", { className: "font-og-mono text-og-fg-muted", children: verificationUri }),
+          /* @__PURE__ */ jsx11("span", { className: "font-og-mono text-og-fg-muted", children: verificationUri }),
           " and confirm the code shown there matches."
-        ] }) : /* @__PURE__ */ jsxs10(Fragment2, { children: [
+        ] }) : /* @__PURE__ */ jsxs11(Fragment2, { children: [
           "Confirm code ",
-          /* @__PURE__ */ jsx10("span", { className: "font-og-mono text-og-fg-muted", children: userCode }),
+          /* @__PURE__ */ jsx11("span", { className: "font-og-mono text-og-fg-muted", children: userCode }),
           " \u2014 the one printed by the one-liner \u2014 at",
           " ",
-          /* @__PURE__ */ jsx10("span", { className: "font-og-mono text-og-fg-muted", children: verificationUri }),
+          /* @__PURE__ */ jsx11("span", { className: "font-og-mono text-og-fg-muted", children: verificationUri }),
           ".",
-          typeof expiresInSeconds === "number" ? /* @__PURE__ */ jsxs10(Fragment2, { children: [
+          typeof expiresInSeconds === "number" ? /* @__PURE__ */ jsxs11(Fragment2, { children: [
             " Expires in ",
             Math.max(0, Math.round(expiresInSeconds / 60)),
             " min."
@@ -1506,7 +1794,7 @@ function EnrollmentDeviceFlow({
 }
 
 // src/components/enrollment-consent.tsx
-import { useState as useState2 } from "react";
+import { useState as useState3 } from "react";
 import {
   CircleAlertIcon,
   LaptopIcon as LaptopIcon6,
@@ -1516,13 +1804,13 @@ import {
   TerminalIcon as TerminalIcon2,
   UsersIcon as UsersIcon3
 } from "lucide-react";
-import { jsx as jsx11, jsxs as jsxs11 } from "react/jsx-runtime";
+import { jsx as jsx12, jsxs as jsxs12 } from "react/jsx-runtime";
 function Capability({ icon, title, body }) {
-  return /* @__PURE__ */ jsxs11("li", { className: "flex items-start gap-2.5", children: [
-    /* @__PURE__ */ jsx11("span", { className: "mt-0.5 shrink-0 text-og-status-failed", children: icon }),
-    /* @__PURE__ */ jsxs11("span", { className: "min-w-0", children: [
-      /* @__PURE__ */ jsx11("span", { className: "block text-og-base font-medium text-og-fg", children: title }),
-      /* @__PURE__ */ jsx11("span", { className: "block text-og-sm text-og-fg-muted", children: body })
+  return /* @__PURE__ */ jsxs12("li", { className: "flex items-start gap-2.5", children: [
+    /* @__PURE__ */ jsx12("span", { className: "mt-0.5 shrink-0 text-og-status-failed", children: icon }),
+    /* @__PURE__ */ jsxs12("span", { className: "min-w-0", children: [
+      /* @__PURE__ */ jsx12("span", { className: "block text-og-base font-medium text-og-fg", children: title }),
+      /* @__PURE__ */ jsx12("span", { className: "block text-og-sm text-og-fg-muted", children: body })
     ] })
   ] });
 }
@@ -1530,26 +1818,42 @@ function EnrollmentConsent({
   userCode,
   machine,
   phase = "review",
+  allowOrganizationScope = false,
   onApprove,
   onDeny,
   errorMessage,
   className
 }) {
-  const [allowScreenControl, setAllowScreenControl] = useState2(machine.requestsScreenControl);
+  const [allowScreenControl, setAllowScreenControl] = useState3(machine.requestsScreenControl);
+  const [scope, setScope] = useState3("user");
   const busy = phase === "approving";
+  const scopeCopy = {
+    user: {
+      label: "Personal",
+      body: "Only you can use this machine, from any workspace you can access in this organization."
+    },
+    workspace: {
+      label: "Workspace",
+      body: "Everyone with access to this workspace can use this machine."
+    },
+    organization: {
+      label: "Organization",
+      body: "Members of this organization can use this machine from their workspaces."
+    }
+  };
   if (phase === "approved") {
-    return /* @__PURE__ */ jsx11(
+    return /* @__PURE__ */ jsx12(
       ConsentResult,
       {
         className,
         tone: "ok",
         title: "Machine connected",
-        body: `${machine.machineName} is now enrolled in this workspace. You can close this page \u2014 it will appear in your Machines dashboard.`
+        body: `${machine.machineName} is now connected with ${scopeCopy[scope].label.toLowerCase()} access. You can close this page \u2014 it will appear in your Machines dashboard.`
       }
     );
   }
   if (phase === "denied") {
-    return /* @__PURE__ */ jsx11(
+    return /* @__PURE__ */ jsx12(
       ConsentResult,
       {
         className,
@@ -1560,7 +1864,7 @@ function EnrollmentConsent({
     );
   }
   if (phase === "error") {
-    return /* @__PURE__ */ jsx11(
+    return /* @__PURE__ */ jsx12(
       ConsentResult,
       {
         className,
@@ -1570,7 +1874,7 @@ function EnrollmentConsent({
       }
     );
   }
-  return /* @__PURE__ */ jsxs11(
+  return /* @__PURE__ */ jsxs12(
     "div",
     {
       "data-enrollment-consent": true,
@@ -1579,65 +1883,104 @@ function EnrollmentConsent({
         className
       ),
       children: [
-        /* @__PURE__ */ jsxs11("div", { className: "flex items-start gap-3", children: [
-          /* @__PURE__ */ jsx11("span", { className: "flex size-9 shrink-0 items-center justify-center rounded-full bg-og-status-failed/15 text-og-status-failed", children: /* @__PURE__ */ jsx11(ShieldAlertIcon, { className: "size-5", "aria-hidden": true }) }),
-          /* @__PURE__ */ jsxs11("div", { className: "min-w-0", children: [
-            /* @__PURE__ */ jsx11("h1", { className: "text-og-md font-semibold text-og-fg", children: "Give the agent your whole machine?" }),
-            /* @__PURE__ */ jsxs11("p", { className: "mt-1 text-og-base text-og-fg-muted", children: [
+        /* @__PURE__ */ jsxs12("div", { className: "flex items-start gap-3", children: [
+          /* @__PURE__ */ jsx12("span", { className: "flex size-9 shrink-0 items-center justify-center rounded-full bg-og-status-failed/15 text-og-status-failed", children: /* @__PURE__ */ jsx12(ShieldAlertIcon, { className: "size-5", "aria-hidden": true }) }),
+          /* @__PURE__ */ jsxs12("div", { className: "min-w-0", children: [
+            /* @__PURE__ */ jsx12("h1", { className: "text-og-md font-semibold text-og-fg", children: "Give the agent your whole machine?" }),
+            /* @__PURE__ */ jsxs12("p", { className: "mt-1 text-og-base text-og-fg-muted", children: [
               "Approving lets the OpenGeni agent run on",
               " ",
-              /* @__PURE__ */ jsx11("span", { className: "font-medium text-og-fg", children: machine.machineName }),
+              /* @__PURE__ */ jsx12("span", { className: "font-medium text-og-fg", children: machine.machineName }),
               " with full access. This is your real computer \u2014 not a sandbox."
             ] })
           ] })
         ] }),
-        /* @__PURE__ */ jsxs11("div", { className: "flex flex-wrap items-center gap-2 rounded-og-md border border-og-border bg-og-surface-2 px-3 py-2 text-og-sm", children: [
-          /* @__PURE__ */ jsx11(LaptopIcon6, { className: "size-4 text-og-fg-subtle", "aria-hidden": true }),
-          /* @__PURE__ */ jsx11("span", { className: "font-medium text-og-fg", children: machine.machineName }),
-          /* @__PURE__ */ jsxs11("span", { className: "font-og-mono text-og-fg-subtle", children: [
+        /* @__PURE__ */ jsxs12("div", { className: "flex flex-wrap items-center gap-2 rounded-og-md border border-og-border bg-og-surface-2 px-3 py-2 text-og-sm", children: [
+          /* @__PURE__ */ jsx12(LaptopIcon6, { className: "size-4 text-og-fg-subtle", "aria-hidden": true }),
+          /* @__PURE__ */ jsx12("span", { className: "font-medium text-og-fg", children: machine.machineName }),
+          /* @__PURE__ */ jsxs12("span", { className: "font-og-mono text-og-fg-subtle", children: [
             machine.os,
             "/",
             machine.arch
           ] }),
-          /* @__PURE__ */ jsx11("span", { "aria-hidden": true, className: "text-og-fg-subtle", children: "\xB7" }),
-          /* @__PURE__ */ jsxs11("span", { className: "text-og-fg-subtle", children: [
+          /* @__PURE__ */ jsx12("span", { "aria-hidden": true, className: "text-og-fg-subtle", children: "\xB7" }),
+          /* @__PURE__ */ jsxs12("span", { className: "text-og-fg-subtle", children: [
             "code ",
-            /* @__PURE__ */ jsx11("span", { className: "font-og-mono font-medium text-og-fg", children: userCode })
+            /* @__PURE__ */ jsx12("span", { className: "font-og-mono font-medium text-og-fg", children: userCode })
           ] })
         ] }),
-        /* @__PURE__ */ jsxs11("ul", { className: "flex flex-col gap-3", children: [
-          /* @__PURE__ */ jsx11(
+        /* @__PURE__ */ jsxs12("ul", { className: "flex flex-col gap-3", children: [
+          /* @__PURE__ */ jsx12(
             Capability,
             {
-              icon: /* @__PURE__ */ jsx11(TerminalIcon2, { className: "size-4", "aria-hidden": true }),
+              icon: /* @__PURE__ */ jsx12(TerminalIcon2, { className: "size-4", "aria-hidden": true }),
               title: "Read, write & run anything",
               body: "The agent can read and modify any file, run any command, and use your git credentials \u2014 as if it were you at the keyboard."
             }
           ),
-          machine.canOfferDisplay ? /* @__PURE__ */ jsx11(
+          machine.canOfferDisplay ? /* @__PURE__ */ jsx12(
             Capability,
             {
-              icon: /* @__PURE__ */ jsx11(MonitorIcon2, { className: "size-4", "aria-hidden": true }),
+              icon: /* @__PURE__ */ jsx12(MonitorIcon2, { className: "size-4", "aria-hidden": true }),
               title: "See your screen",
               body: "The agent can capture this machine's display to watch what it is doing."
             }
           ) : null,
-          /* @__PURE__ */ jsx11(
+          /* @__PURE__ */ jsx12(
             Capability,
             {
-              icon: /* @__PURE__ */ jsx11(UsersIcon3, { className: "size-4", "aria-hidden": true }),
-              title: "Shared while connected",
-              body: "Any session in this workspace can use this machine while it is online. Disconnect the agent to revoke access instantly."
+              icon: /* @__PURE__ */ jsx12(UsersIcon3, { className: "size-4", "aria-hidden": true }),
+              title: `${scopeCopy[scope].label} access while connected`,
+              body: `${scopeCopy[scope].body} Disconnect the agent to revoke access instantly.`
             }
           )
         ] }),
-        machine.canOfferDisplay ? /* @__PURE__ */ jsxs11(
+        /* @__PURE__ */ jsxs12("fieldset", { className: "flex flex-col gap-2", disabled: busy, children: [
+          /* @__PURE__ */ jsx12("legend", { className: "mb-1 text-og-sm font-medium text-og-fg", children: "Who can use this machine?" }),
+          ["user", "workspace", "organization"].map((candidate) => {
+            const disabled = candidate === "organization" && !allowOrganizationScope;
+            return /* @__PURE__ */ jsxs12(
+              "label",
+              {
+                "data-enrollment-scope": candidate,
+                "data-disabled": disabled ? "true" : "false",
+                className: cn(
+                  "flex items-start gap-2.5 rounded-og-md border border-og-border bg-og-bg px-3 py-2.5",
+                  disabled ? "cursor-not-allowed opacity-50" : "cursor-pointer"
+                ),
+                children: [
+                  /* @__PURE__ */ jsx12(
+                    "input",
+                    {
+                      type: "radio",
+                      name: "enrollment-scope",
+                      value: candidate,
+                      checked: scope === candidate,
+                      disabled: disabled || busy,
+                      onChange: () => setScope(candidate),
+                      className: "mt-0.5 size-4 accent-og-accent"
+                    }
+                  ),
+                  /* @__PURE__ */ jsxs12("span", { className: "min-w-0", children: [
+                    /* @__PURE__ */ jsxs12("span", { className: "block text-og-base font-medium text-og-fg", children: [
+                      scopeCopy[candidate].label,
+                      disabled ? " \xB7 organization admin required" : ""
+                    ] }),
+                    /* @__PURE__ */ jsx12("span", { className: "block text-og-sm text-og-fg-muted", children: scopeCopy[candidate].body })
+                  ] })
+                ]
+              },
+              candidate
+            );
+          })
+        ] }),
+        machine.canOfferDisplay ? /* @__PURE__ */ jsxs12(
           "label",
           {
             "data-screen-control-toggle": true,
             className: "flex cursor-pointer items-start gap-3 rounded-og-md border border-og-border bg-og-bg px-3 py-2.5",
             children: [
-              /* @__PURE__ */ jsx11(
+              /* @__PURE__ */ jsx12(
                 "input",
                 {
                   type: "checkbox",
@@ -1647,21 +1990,21 @@ function EnrollmentConsent({
                   className: "mt-0.5 size-4 accent-og-accent"
                 }
               ),
-              /* @__PURE__ */ jsxs11("span", { className: "min-w-0", children: [
-                /* @__PURE__ */ jsxs11("span", { className: "flex items-center gap-1.5 text-og-base font-medium text-og-fg", children: [
-                  /* @__PURE__ */ jsx11(ScreenShareIcon, { className: "size-3.5 text-og-fg-muted", "aria-hidden": true }),
+              /* @__PURE__ */ jsxs12("span", { className: "min-w-0", children: [
+                /* @__PURE__ */ jsxs12("span", { className: "flex items-center gap-1.5 text-og-base font-medium text-og-fg", children: [
+                  /* @__PURE__ */ jsx12(ScreenShareIcon, { className: "size-3.5 text-og-fg-muted", "aria-hidden": true }),
                   "Also let the agent control my mouse & keyboard"
                 ] }),
-                /* @__PURE__ */ jsx11("span", { className: "mt-0.5 block text-og-sm text-og-fg-muted", children: "Optional. Enables computer-use \u2014 the agent can move the pointer, type, and click on this machine's desktop. Leave off to let it only watch." })
+                /* @__PURE__ */ jsx12("span", { className: "mt-0.5 block text-og-sm text-og-fg-muted", children: "Optional. Enables computer-use \u2014 the agent can move the pointer, type, and click on this machine's desktop. Leave off to let it only watch." })
               ] })
             ]
           }
-        ) : /* @__PURE__ */ jsxs11("p", { className: "flex items-start gap-2 rounded-og-md border border-og-border bg-og-bg px-3 py-2 text-og-sm text-og-fg-muted", children: [
-          /* @__PURE__ */ jsx11(CircleAlertIcon, { className: "mt-px size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
+        ) : /* @__PURE__ */ jsxs12("p", { className: "flex items-start gap-2 rounded-og-md border border-og-border bg-og-bg px-3 py-2 text-og-sm text-og-fg-muted", children: [
+          /* @__PURE__ */ jsx12(CircleAlertIcon, { className: "mt-px size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
           "This machine has no display, so screen control isn't available \u2014 files, terminal, and git only."
         ] }),
-        /* @__PURE__ */ jsxs11("div", { className: "flex items-center gap-2", children: [
-          /* @__PURE__ */ jsx11(
+        /* @__PURE__ */ jsxs12("div", { className: "flex items-center gap-2", children: [
+          /* @__PURE__ */ jsx12(
             "button",
             {
               type: "button",
@@ -1672,13 +2015,13 @@ function EnrollmentConsent({
               children: "Cancel"
             }
           ),
-          /* @__PURE__ */ jsx11(
+          /* @__PURE__ */ jsx12(
             "button",
             {
               type: "button",
               "data-approve": true,
               disabled: busy,
-              onClick: () => onApprove?.(allowScreenControl),
+              onClick: () => onApprove?.(allowScreenControl, scope),
               className: "flex-1 rounded-og-sm bg-og-status-failed px-3 py-2 text-og-sm font-semibold text-og-accent-fg transition-colors hover:opacity-90 disabled:opacity-50 pointer-coarse:min-h-11",
               children: busy ? "Connecting\u2026" : "Grant full access"
             }
@@ -1696,7 +2039,7 @@ function ConsentResult({
 }) {
   const ring = tone === "ok" ? "border-og-status-running/30" : tone === "danger" ? "border-og-status-failed/30" : "border-og-border";
   const iconClass = tone === "ok" ? "text-og-status-running" : tone === "danger" ? "text-og-status-failed" : "text-og-fg-subtle";
-  return /* @__PURE__ */ jsxs11(
+  return /* @__PURE__ */ jsxs12(
     "div",
     {
       "data-enrollment-result": tone,
@@ -1706,33 +2049,33 @@ function ConsentResult({
         className
       ),
       children: [
-        /* @__PURE__ */ jsx11(
+        /* @__PURE__ */ jsx12(
           "span",
           {
             className: cn(
               "flex size-10 items-center justify-center rounded-full bg-og-surface-2",
               iconClass
             ),
-            children: /* @__PURE__ */ jsx11(LaptopIcon6, { className: "size-5", "aria-hidden": true })
+            children: /* @__PURE__ */ jsx12(LaptopIcon6, { className: "size-5", "aria-hidden": true })
           }
         ),
-        /* @__PURE__ */ jsx11("h1", { className: "text-og-md font-semibold text-og-fg", children: title }),
-        /* @__PURE__ */ jsx11("p", { className: "max-w-sm text-og-base text-og-fg-muted", children: body })
+        /* @__PURE__ */ jsx12("h1", { className: "text-og-md font-semibold text-og-fg", children: title }),
+        /* @__PURE__ */ jsx12("p", { className: "max-w-sm text-og-base text-og-fg-muted", children: body })
       ]
     }
   );
 }
 
 // src/hooks/use-machines.ts
-import { useCallback as useCallback2, useRef as useRef3, useState as useState4 } from "react";
+import { useCallback as useCallback3, useRef as useRef3, useState as useState6 } from "react";
 
 // src/provider.tsx
 import {
   OpenGeniApiContractMismatchError,
   OPENGENI_API_CONTRACT_REVISION
 } from "@opengeni/sdk";
-import { useCallback, useEffect, useMemo, useRef as useRef2, useState as useState3 } from "react";
-import { jsx as jsx12, jsxs as jsxs12 } from "react/jsx-runtime";
+import { useCallback, useEffect as useEffect2, useMemo, useRef as useRef2, useState as useState4 } from "react";
+import { jsx as jsx13, jsxs as jsxs13 } from "react/jsx-runtime";
 var CONTRACT_RELOAD_STORAGE_PREFIX = "opengeni.reloadForApiContract:";
 function OpenGeniProvider({
   client,
@@ -1741,13 +2084,13 @@ function OpenGeniProvider({
   onWorkspaceInteractionEvent,
   children
 }) {
-  const [workspaceControlEvent, setWorkspaceControlEvent] = useState3(
+  const [workspaceControlEvent, setWorkspaceControlEvent] = useState4(
     null
   );
-  const [workspaceControlConnectionState, setWorkspaceControlConnectionState] = useState3("idle");
-  const [workspaceInteractionEvent, setWorkspaceInteractionEvent] = useState3(null);
-  const [workspaceInteractionConnectionState, setWorkspaceInteractionConnectionState] = useState3("idle");
-  const [contractMismatch, setContractMismatch] = useState3(
+  const [workspaceControlConnectionState, setWorkspaceControlConnectionState] = useState4("idle");
+  const [workspaceInteractionEvent, setWorkspaceInteractionEvent] = useState4(null);
+  const [workspaceInteractionConnectionState, setWorkspaceInteractionConnectionState] = useState4("idle");
+  const [contractMismatch, setContractMismatch] = useState4(
     null
   );
   const callbackRef = useRef2(onWorkspaceControlEvent);
@@ -1778,9 +2121,9 @@ function OpenGeniProvider({
     }
   }, [client]);
   const registerSessionReconciler = useMemo(
-    () => (sessionId, key, reconcile) => {
+    () => (sessionId, key, reconcile2) => {
       const sessionReconcilers = reconcilersRef.current.get(sessionId) ?? /* @__PURE__ */ new Map();
-      sessionReconcilers.set(key, reconcile);
+      sessionReconcilers.set(key, reconcile2);
       reconcilersRef.current.set(sessionId, sessionReconcilers);
       return () => {
         const current = reconcilersRef.current.get(sessionId);
@@ -1798,7 +2141,7 @@ function OpenGeniProvider({
         await withTimeout(verifyApiContract(), 1e4, "API contract reconciliation");
         const callbacks = [...reconcilersRef.current.get(sessionId)?.values() ?? []];
         await withTimeout(
-          Promise.all(callbacks.map((reconcile) => reconcile())).then(() => void 0),
+          Promise.all(callbacks.map((reconcile2) => reconcile2())).then(() => void 0),
           15e3,
           "session reconciliation"
         );
@@ -1812,7 +2155,7 @@ function OpenGeniProvider({
     },
     [verifyApiContract]
   );
-  useEffect(() => {
+  useEffect2(() => {
     if (!supportsWorkspaceLiveStream) return;
     const openLiveStream = client.streamWorkspaceLiveEvents;
     setWorkspaceControlEvent(null);
@@ -1882,7 +2225,7 @@ function OpenGeniProvider({
     })();
     return () => controller.abort();
   }, [client, pageLive, supportsWorkspaceLiveStream, verifyApiContract, workspaceId]);
-  useEffect(() => {
+  useEffect2(() => {
     if (supportsWorkspaceLiveStream) return;
     if (!pageLive) {
       setWorkspaceControlConnectionState("idle");
@@ -1925,7 +2268,7 @@ function OpenGeniProvider({
     })();
     return () => controller.abort();
   }, [client, pageLive, supportsWorkspaceLiveStream, verifyApiContract, workspaceId]);
-  useEffect(() => {
+  useEffect2(() => {
     if (supportsWorkspaceLiveStream) return;
     setWorkspaceInteractionEvent(null);
     if (!pageLive) {
@@ -1989,9 +2332,9 @@ function OpenGeniProvider({
       reconcileSession
     ]
   );
-  return /* @__PURE__ */ jsxs12(OpenGeniContext.Provider, { value, children: [
+  return /* @__PURE__ */ jsxs13(OpenGeniContext.Provider, { value, children: [
     children,
-    contractMismatch ? /* @__PURE__ */ jsx12(ApiContractMismatchScreen, { mismatch: contractMismatch }) : null
+    contractMismatch ? /* @__PURE__ */ jsx13(ApiContractMismatchScreen, { mismatch: contractMismatch }) : null
   ] });
 }
 function withTimeout(promise, timeoutMs, label) {
@@ -2009,23 +2352,23 @@ function withTimeout(promise, timeoutMs, label) {
   });
 }
 function ApiContractMismatchScreen({ mismatch }) {
-  return /* @__PURE__ */ jsx12(
+  return /* @__PURE__ */ jsx13(
     "div",
     {
       className: "og-root fixed inset-0 z-[2147483647] grid place-items-center bg-og-bg/95 p-6 backdrop-blur-sm",
       role: "alert",
       "aria-live": "assertive",
       "data-opengeni-api-contract-mismatch": true,
-      children: /* @__PURE__ */ jsxs12("div", { className: "w-full max-w-md rounded-xl border border-og-border bg-og-surface p-6 shadow-2xl", children: [
-        /* @__PURE__ */ jsx12("p", { className: "text-og-menu font-semibold text-og-fg", children: "OpenGeni updated" }),
-        /* @__PURE__ */ jsx12("p", { className: "mt-2 text-og-menu leading-6 text-og-muted", children: "This tab cannot safely continue with the new server version. Reload it before sending or controlling work." }),
-        /* @__PURE__ */ jsxs12("p", { className: "mt-3 font-mono text-og-control text-og-subtle", children: [
+      children: /* @__PURE__ */ jsxs13("div", { className: "w-full max-w-md rounded-xl border border-og-border bg-og-surface p-6 shadow-2xl", children: [
+        /* @__PURE__ */ jsx13("p", { className: "text-og-menu font-semibold text-og-fg", children: "OpenGeni updated" }),
+        /* @__PURE__ */ jsx13("p", { className: "mt-2 text-og-menu leading-6 text-og-muted", children: "This tab cannot safely continue with the new server version. Reload it before sending or controlling work." }),
+        /* @__PURE__ */ jsxs13("p", { className: "mt-3 font-mono text-og-control text-og-subtle", children: [
           "Client ",
           mismatch.expected,
           " \xB7 API ",
           mismatch.actual
         ] }),
-        /* @__PURE__ */ jsx12(
+        /* @__PURE__ */ jsx13(
           "button",
           {
             type: "button",
@@ -2046,8 +2389,205 @@ function reloadForContractMismatchOnce(mismatch) {
   window.setTimeout(() => window.location.reload(), 150);
 }
 
+// src/hooks/shared-machines-list.ts
+import { useCallback as useCallback2, useEffect as useEffect3, useState as useState5 } from "react";
+var EMPTY_MACHINES = {
+  activeSandboxId: null,
+  activeEpoch: 0,
+  machines: []
+};
+var shares = /* @__PURE__ */ new Map();
+function emit(share) {
+  for (const subscriber of share.subscribers) {
+    subscriber.onChange();
+  }
+}
+function effective(share) {
+  let enabled = false;
+  let pollIntervalMs;
+  for (const subscriber of share.subscribers) {
+    if (!subscriber.enabled || !subscriber.pageLive) continue;
+    enabled = true;
+    if (subscriber.pollIntervalMs !== void 0 && subscriber.pollIntervalMs > 0) {
+      pollIntervalMs = pollIntervalMs === void 0 ? subscriber.pollIntervalMs : Math.min(pollIntervalMs, subscriber.pollIntervalMs);
+    }
+  }
+  return { enabled, pollIntervalMs };
+}
+function latestLoad(share) {
+  let load = null;
+  for (const subscriber of share.subscribers) {
+    if (subscriber.enabled && subscriber.pageLive) load = subscriber.load;
+  }
+  return load;
+}
+function stopTimer(share) {
+  if (share.timer !== null) {
+    clearTimeout(share.timer);
+    share.timer = null;
+  }
+}
+function cancelDispose(share) {
+  if (share.disposeTimer !== null) {
+    clearTimeout(share.disposeTimer);
+    share.disposeTimer = null;
+  }
+}
+function arm(share) {
+  stopTimer(share);
+  const { enabled, pollIntervalMs } = effective(share);
+  if (!enabled || pollIntervalMs === void 0) return;
+  share.timer = setTimeout(() => {
+    share.timer = null;
+    void run(share).finally(() => arm(share));
+  }, pollIntervalMs);
+}
+async function runFresh(share) {
+  const load = latestLoad(share);
+  if (!load) return;
+  const ticket = ++share.generation;
+  const abort = new AbortController();
+  share.abort = abort;
+  try {
+    const data = await load(abort.signal);
+    if (ticket !== share.generation || abort.signal.aborted) return;
+    share.snapshot = { data, loading: false, error: null };
+    emit(share);
+  } catch (cause) {
+    if (ticket !== share.generation || abort.signal.aborted) return;
+    share.snapshot = {
+      data: share.snapshot.data,
+      loading: false,
+      error: cause instanceof Error ? cause : new Error(String(cause))
+    };
+    emit(share);
+  } finally {
+    if (share.abort === abort) share.abort = null;
+  }
+}
+function run(share, force = false) {
+  if (!force && share.inFlight) return share.inFlight;
+  if (force && share.inFlight) {
+    if (share.trailing) return share.trailing;
+    let trailing;
+    trailing = share.inFlight.then(async () => {
+      if (!effective(share).enabled) return;
+      await run(share);
+    }).finally(() => {
+      if (share.trailing === trailing) share.trailing = null;
+    });
+    share.trailing = trailing;
+    return trailing;
+  }
+  let promise;
+  promise = runFresh(share).finally(() => {
+    if (share.inFlight === promise) share.inFlight = null;
+  });
+  share.inFlight = promise;
+  return promise;
+}
+function reconcile(share) {
+  const { enabled } = effective(share);
+  if (!enabled) {
+    share.generation += 1;
+    share.abort?.abort();
+    share.abort = null;
+    share.inFlight = null;
+    stopTimer(share);
+    if (share.snapshot.loading) {
+      share.snapshot = { ...share.snapshot, loading: false };
+      emit(share);
+    }
+    return;
+  }
+  if (share.snapshot.data !== null || share.snapshot.error) {
+    arm(share);
+    return;
+  }
+  share.snapshot = { ...share.snapshot, loading: true };
+  emit(share);
+  void run(share).finally(() => arm(share));
+}
+function getOrCreate(shareKey) {
+  const existing = shares.get(shareKey);
+  if (existing) {
+    cancelDispose(existing);
+    return existing;
+  }
+  const created = {
+    snapshot: { data: null, loading: true, error: null },
+    subscribers: /* @__PURE__ */ new Set(),
+    timer: null,
+    disposeTimer: null,
+    abort: null,
+    inFlight: null,
+    trailing: null,
+    generation: 0
+  };
+  shares.set(shareKey, created);
+  return created;
+}
+async function refreshSharedMachinesList(shareKey) {
+  const share = shares.get(shareKey);
+  if (!share) return;
+  await run(share, true);
+}
+function useSharedMachinesList(shareKey, load, options = {}) {
+  const enabled = options.enabled ?? true;
+  const pageLive = usePageLiveActivity();
+  const [, setRevision] = useState5(0);
+  const live = shares.get(shareKey)?.snapshot;
+  const view = live ?? { data: null, loading: enabled && pageLive, error: null };
+  useEffect3(() => {
+    const share = getOrCreate(shareKey);
+    const subscriber = {
+      load,
+      pollIntervalMs: options.pollIntervalMs,
+      enabled,
+      pageLive,
+      onChange: () => setRevision((revision) => revision + 1)
+    };
+    share.subscribers.add(subscriber);
+    setRevision((revision) => revision + 1);
+    reconcile(share);
+    return () => {
+      share.subscribers.delete(subscriber);
+      if (share.subscribers.size > 0) {
+        reconcile(share);
+        return;
+      }
+      share.generation += 1;
+      share.abort?.abort();
+      share.abort = null;
+      share.inFlight = null;
+      share.trailing = null;
+      stopTimer(share);
+      cancelDispose(share);
+      share.disposeTimer = setTimeout(() => {
+        share.disposeTimer = null;
+        if (share.subscribers.size === 0 && shares.get(shareKey) === share) {
+          shares.delete(shareKey);
+        }
+      }, 0);
+    };
+  }, [shareKey, load, options.pollIntervalMs, enabled, pageLive]);
+  const refresh = useCallback2(() => refreshSharedMachinesList(shareKey), [shareKey]);
+  return { ...view, refresh };
+}
+
 // src/hooks/use-machines.ts
-var EMPTY = { activeSandboxId: null, activeEpoch: 0, machines: [] };
+var MACHINES_DASHBOARD_POLL_MS = 1e4;
+var MACHINES_SESSION_POLL_MS = 15e3;
+var MACHINES_COMPOSER_POLL_MS = 3e4;
+var machinesClientIds = /* @__PURE__ */ new WeakMap();
+var nextMachinesClientId = 1;
+function machinesClientId(client) {
+  const existing = machinesClientIds.get(client);
+  if (existing !== void 0) return existing;
+  const id = nextMachinesClientId++;
+  machinesClientIds.set(client, id);
+  return id;
+}
 function swapFailureMessage(result) {
   if (result.reason?.trim()) return result.reason;
   switch (result.code) {
@@ -2069,10 +2609,10 @@ function useMachines(options = {}) {
   const { client, workspaceId } = useOpenGeni(options);
   const machinesClient = options.machinesClient ?? client;
   const sessionId = options.sessionId;
-  const identityKey = `${workspaceId}\0${sessionId ?? ""}`;
+  const identityKey = `${workspaceId}\0${sessionId ?? ""}\0${machinesClientId(machinesClient)}`;
   const identityRef = useRef3(identityKey);
   identityRef.current = identityKey;
-  const load = useCallback2(
+  const load = useCallback3(
     async (signal) => {
       return await machinesClient.listMachines(workspaceId, {
         ...sessionId ? { sessionId } : {},
@@ -2086,26 +2626,32 @@ function useMachines(options = {}) {
     loading,
     error,
     refresh
-  } = usePolledValue(load, {
+  } = useSharedMachinesList(identityKey, load, {
     pollIntervalMs: options.pollIntervalMs,
     enabled: options.enabled
   });
-  const { run, mutating, mutationError, clearMutationError } = useMutationRunner(identityKey);
-  const [attachState, setAttachState] = useState4(() => ({ identity: identityKey, sandboxId: null }));
+  const { run: run2, mutating, mutationError, clearMutationError } = useMutationRunner(identityKey);
+  const [attachState, setAttachState] = useState6(() => ({ identity: identityKey, sandboxId: null }));
   const attachingSandboxId = attachState.identity === identityKey ? attachState.sandboxId : null;
-  const [removeState, setRemoveState] = useState4(() => ({ identity: identityKey, enrollmentId: null }));
+  const [removeState, setRemoveState] = useState6(() => ({ identity: identityKey, enrollmentId: null }));
   const removingEnrollmentId = removeState.identity === identityKey ? removeState.enrollmentId : null;
-  const data = loadedData ?? EMPTY;
+  const [updateState, setUpdateState] = useState6(() => ({ identity: identityKey, enrollmentId: null }));
+  const updatingEnrollmentId = updateState.identity === identityKey ? updateState.enrollmentId : null;
+  const [operationPolicyState, setOperationPolicyState] = useState6(() => ({ identity: identityKey, enrollmentId: null }));
+  const updatingOperationPolicyEnrollmentId = operationPolicyState.identity === identityKey ? operationPolicyState.enrollmentId : null;
+  const data = loadedData ?? EMPTY_MACHINES;
   const canAttach = sessionId !== void 0 && (typeof machinesClient.attachMachine === "function" || typeof machinesClient.swapActiveSandbox === "function");
   const canRemove = typeof machinesClient.removeEnrollment === "function";
-  const attach = useCallback2(
+  const canUpdateAgent = typeof machinesClient.updateMachineAgent === "function";
+  const canUpdateOperationPolicy = typeof machinesClient.updateMachineOperationPolicy === "function";
+  const attach = useCallback3(
     async (sandboxId) => {
       if (sessionId === void 0) return false;
       const runSwap = machinesClient.attachMachine ? () => machinesClient.attachMachine(workspaceId, sessionId, sandboxId) : machinesClient.swapActiveSandbox ? () => machinesClient.swapActiveSandbox(workspaceId, sessionId, { target: sandboxId }) : null;
       if (!runSwap) return false;
       const ownedIdentity = identityKey;
       setAttachState({ identity: ownedIdentity, sandboxId });
-      const result = await run(async () => {
+      const result = await run2(async () => {
         const response = await runSwap();
         if (response && typeof response === "object" && "swapped" in response && response.swapped === false) {
           throw new Error(swapFailureMessage(response));
@@ -2118,21 +2664,21 @@ function useMachines(options = {}) {
       }
       return result === true;
     },
-    [machinesClient, workspaceId, sessionId, identityKey, run, refresh]
+    [machinesClient, workspaceId, sessionId, identityKey, run2, refresh]
   );
-  const fetchSeries = useCallback2(
+  const fetchSeries = useCallback3(
     async (enrollmentId, window2 = "1h") => {
       if (!machinesClient.machineMetricsSeries) return [];
       return await machinesClient.machineMetricsSeries(workspaceId, enrollmentId, { window: window2 });
     },
     [machinesClient, workspaceId]
   );
-  const remove = useCallback2(
+  const remove = useCallback3(
     async (enrollmentId, request = {}) => {
       if (!machinesClient.removeEnrollment) return null;
       const ownedIdentity = identityKey;
       setRemoveState({ identity: ownedIdentity, enrollmentId });
-      const result = await run(
+      const result = await run2(
         () => machinesClient.removeEnrollment(workspaceId, enrollmentId, request)
       );
       if (identityRef.current === ownedIdentity) {
@@ -2143,7 +2689,37 @@ function useMachines(options = {}) {
       }
       return result;
     },
-    [machinesClient, workspaceId, identityKey, run, refresh]
+    [machinesClient, workspaceId, identityKey, run2, refresh]
+  );
+  const updateAgent = useCallback3(
+    async (enrollmentId) => {
+      if (!machinesClient.updateMachineAgent) return null;
+      const ownedIdentity = identityKey;
+      setUpdateState({ identity: ownedIdentity, enrollmentId });
+      const result = await run2(() => machinesClient.updateMachineAgent(workspaceId, enrollmentId));
+      if (identityRef.current === ownedIdentity) {
+        setUpdateState({ identity: ownedIdentity, enrollmentId: null });
+        await refresh();
+      }
+      return result;
+    },
+    [machinesClient, workspaceId, identityKey, run2, refresh]
+  );
+  const updateOperationPolicy = useCallback3(
+    async (enrollmentId, request) => {
+      if (!machinesClient.updateMachineOperationPolicy) return null;
+      const ownedIdentity = identityKey;
+      setOperationPolicyState({ identity: ownedIdentity, enrollmentId });
+      const result = await run2(
+        () => machinesClient.updateMachineOperationPolicy(workspaceId, enrollmentId, request)
+      );
+      if (identityRef.current === ownedIdentity) {
+        setOperationPolicyState({ identity: ownedIdentity, enrollmentId: null });
+        if (result) await refresh();
+      }
+      return result;
+    },
+    [machinesClient, workspaceId, identityKey, run2, refresh]
   );
   return {
     machines: data.machines,
@@ -2160,6 +2736,12 @@ function useMachines(options = {}) {
     remove,
     canRemove,
     removingEnrollmentId,
+    updateAgent,
+    canUpdateAgent,
+    updatingEnrollmentId,
+    updateOperationPolicy,
+    canUpdateOperationPolicy,
+    updatingOperationPolicyEnrollmentId,
     mutationError,
     clearMutationError
   };
@@ -2168,6 +2750,9 @@ function useMachines(options = {}) {
 export {
   OpenGeniProvider,
   connectionStatusForState,
+  MACHINES_DASHBOARD_POLL_MS,
+  MACHINES_SESSION_POLL_MS,
+  MACHINES_COMPOSER_POLL_MS,
   useMachines,
   CONNECTION_STATUS_META,
   MACHINE_STATE_BADGE_META,
@@ -2186,6 +2771,7 @@ export {
   WINDOW_LABEL,
   METRICS,
   pointsFor,
+  MachineOperationPolicyEditor,
   MachineDetail,
   MachinesDashboard,
   MachineDockBar,
@@ -2193,4 +2779,4 @@ export {
   EnrollmentDeviceFlow,
   EnrollmentConsent
 };
-//# sourceMappingURL=chunk-HA46CYQK.js.map
+//# sourceMappingURL=chunk-XXWH2JLC.js.map