@opengeni/react 3.3.2 → 3.4.0

package/dist/{chunk-YVCHAQZY.js → chunk-NKMYZFHA.js}

@@ -1,18 +1,21 @@
+"use client";
+import {
+  machineScopeLabel
+} from "./chunk-CSX5FFKZ.js";
 import {
   useMutationRunner,
   usePageLiveActivity
-} from "./chunk-KZ73RL76.js";
+} from "./chunk-QHUE7E4N.js";
 import {
-  OpenGeniContext,
   useOpenGeni
-} from "./chunk-NEXLLTP4.js";
+} from "./chunk-G76LSA76.js";
 import {
   formatBytes,
   formatRelativeTime
-} from "./chunk-VTOREEXF.js";
+} from "./chunk-BLL56F7R.js";
 import {
   cn
-} from "./chunk-22KP6LR5.js";
+} from "./chunk-TXS65BB2.js";
 
 // src/types/machines.ts
 function connectionStatusForState(state) {
@@ -286,12 +289,9 @@ import {
   AlertTriangleIcon,
   ArrowRightIcon,
   CpuIcon,
-  CircleCheckIcon,
-  DownloadIcon,
   LaptopIcon,
   MonitorIcon,
   MonitorOffIcon,
-  LoaderCircleIcon,
   ServerIcon,
   UsersIcon
 } from "lucide-react";
@@ -430,8 +430,195 @@ function MachineHealthPill({
   ] });
 }
 
+// src/components/machines/agent-status-icon.tsx
+import {
+  CircleAlertIcon,
+  CircleCheckIcon,
+  ClockIcon,
+  DownloadIcon,
+  LoaderCircleIcon,
+  TriangleAlertIcon
+} from "lucide-react";
+import { jsx as jsx4 } from "react/jsx-runtime";
+function AgentStatusIcon({ tone, className }) {
+  const size = cn("size-3.5 shrink-0", className);
+  switch (tone) {
+    case "ok":
+      return /* @__PURE__ */ jsx4(CircleCheckIcon, { className: cn(size, "text-og-status-idle"), "aria-hidden": true });
+    case "progress":
+      return /* @__PURE__ */ jsx4(LoaderCircleIcon, { className: cn(size, "animate-og-spin text-og-accent"), "aria-hidden": true });
+    case "waiting":
+      return /* @__PURE__ */ jsx4(ClockIcon, { className: cn(size, "text-og-fg-subtle"), "aria-hidden": true });
+    case "attention":
+      return /* @__PURE__ */ jsx4(TriangleAlertIcon, { className: cn(size, "text-og-status-waiting"), "aria-hidden": true });
+    case "failed":
+      return /* @__PURE__ */ jsx4(CircleAlertIcon, { className: cn(size, "text-og-status-failed"), "aria-hidden": true });
+    default:
+      return /* @__PURE__ */ jsx4(DownloadIcon, { className: cn(size, "text-og-fg-subtle"), "aria-hidden": true });
+  }
+}
+
+// src/components/machines/machine-status.ts
+var UPDATE_CONFIRMATION_GRACE_MS = 3e4;
+function isPostponedUpdate(errorCode) {
+  return typeof errorCode === "string" && errorCode.startsWith("update_busy");
+}
+var FAILURE_REASON = {
+  update_state_unavailable: "the agent couldn't check whether the machine was idle",
+  agent_offline: "the machine was offline",
+  update_dispatch_rejected: "the agent refused the request",
+  invalid_agent_response: "the agent sent an unexpected reply"
+};
+function failureReason(code) {
+  if (!code) return null;
+  return FAILURE_REASON[code] ?? code.replaceAll("_", " ");
+}
+var ACTIVE_STATUSES = /* @__PURE__ */ new Set([
+  "requested",
+  "accepted",
+  "waiting_for_idle",
+  "downloading",
+  "verifying",
+  "applying",
+  "restarting"
+]);
+function describeAgentRuntime(runtime, now) {
+  const installed = runtime.installedVersion;
+  const title = installed ? `Agent v${installed}` : "Agent version unknown";
+  const blocked = runtime.updateBlockedReason?.trim() || null;
+  const update = runtime.update;
+  const target = update ? `v${update.targetVersion}` : null;
+  const alreadyInstalled = update !== null && (update.targetVersion === installed || runtime.versionState === "current" || runtime.versionState === "ahead");
+  if (update && ACTIVE_STATUSES.has(update.status) && !alreadyInstalled) {
+    const base = { title, tone: "progress", note: null, action: null };
+    switch (update.status) {
+      case "requested": {
+        const stalled = now - new Date(update.updatedAt).getTime() >= UPDATE_CONFIRMATION_GRACE_MS;
+        return stalled ? {
+          title,
+          status: `The agent hasn't confirmed the update to ${target}`,
+          tone: "attention",
+          note: null,
+          action: { kind: "resend", label: "Send again" }
+        } : { ...base, status: `Sending the update to ${target}\u2026` };
+      }
+      case "accepted":
+        return { ...base, status: `Updating to ${target}\u2026` };
+      case "waiting_for_idle":
+        return {
+          ...base,
+          tone: "waiting",
+          status: `Updates to ${target} when current work finishes`
+        };
+      case "downloading":
+        return { ...base, status: `Downloading ${target}\u2026` };
+      case "verifying":
+        return { ...base, status: `Verifying ${target}\u2026` };
+      case "applying":
+        return { ...base, status: `Installing ${target}\u2026` };
+      default:
+        return { ...base, status: "Restarting the agent\u2026" };
+    }
+  }
+  if (update?.status === "failed" && !alreadyInstalled) {
+    if (isPostponedUpdate(update.errorCode)) {
+      const browsersWouldClose = update.errorCode === "update_busy_browsers";
+      return {
+        title,
+        status: browsersWouldClose ? `Update to ${target} postponed: open browsers would close` : `Update to ${target} postponed while the machine was busy`,
+        tone: "waiting",
+        note: blocked ?? (browsersWouldClose ? "The installed agent closes its browsers when it restarts. Updating now closes them." : null),
+        action: blocked ? null : { kind: "update", label: "Update now" }
+      };
+    }
+    const reason = failureReason(update.errorCode);
+    const retry = update.retryable && !blocked ? { kind: "retry", label: "Try again" } : null;
+    if (update.rolledBack) {
+      return {
+        title,
+        status: `Couldn't update to ${target}, so the current version was kept`,
+        tone: "attention",
+        note: blocked ?? (reason ? `Reason: ${reason}.` : null),
+        action: retry
+      };
+    }
+    return {
+      title,
+      status: `Update to ${target} failed`,
+      tone: "failed",
+      note: blocked ?? (reason ? `Reason: ${reason}.` : null),
+      action: retry
+    };
+  }
+  const desired = runtime.desiredVersion;
+  switch (runtime.versionState) {
+    case "current":
+      return {
+        title,
+        status: runtime.updateChannel === "beta" ? "Up to date \xB7 beta" : "Up to date",
+        tone: "ok",
+        note: null,
+        action: null
+      };
+    case "ahead":
+      return {
+        title,
+        status: desired ? `Newer than the released v${desired}` : "Newer than the release",
+        tone: "muted",
+        note: null,
+        action: null
+      };
+    case "unknown":
+      return {
+        title,
+        status: desired ? `Latest is v${desired}` : "No release configured",
+        tone: "muted",
+        note: blocked,
+        action: null
+      };
+    default:
+      if (!desired || desired === installed) {
+        return { title, status: "Up to date", tone: "ok", note: null, action: null };
+      }
+      return {
+        title,
+        status: `v${desired} available`,
+        tone: "waiting",
+        note: blocked,
+        action: blocked ? null : { kind: "update", label: "Update" }
+      };
+  }
+}
+var RUNNER_CONFLICT_ACTIVE_MS = 2 * 6e4;
+function runnerConflict(authority, now) {
+  if (authority.duplicateRunnerDeniedCount <= 0) return null;
+  const lastAt = authority.duplicateRunnerDeniedAt;
+  const last = lastAt ? new Date(lastAt).getTime() : Number.NaN;
+  return {
+    active: Number.isFinite(last) && now - last < RUNNER_CONFLICT_ACTIVE_MS,
+    count: authority.duplicateRunnerDeniedCount,
+    lastAt
+  };
+}
+function describeAgentConnection(authority) {
+  const label = authority.state === "active" ? "Agent connected" : authority.state === "expired" ? "Agent connection lapsed" : "Agent not connected yet";
+  const n = authority.supersededCount;
+  return {
+    label,
+    detail: n > 0 ? `Reconnected ${n} ${n === 1 ? "time" : "times"} since setup` : null
+  };
+}
+var STATUS_TONE_TEXT = {
+  ok: "text-og-status-idle",
+  progress: "text-og-accent",
+  waiting: "text-og-fg-muted",
+  attention: "text-og-status-waiting",
+  failed: "text-og-status-failed",
+  muted: "text-og-fg-subtle"
+};
+
 // src/components/machines/metric-sparkline.tsx
-import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+import { jsx as jsx5, jsxs as jsxs4 } from "react/jsx-runtime";
 var VW = 120;
 function MetricSparkline({
   points,
@@ -444,7 +631,7 @@ function MetricSparkline({
     (p) => p.v != null && Number.isFinite(p.v)
   );
   if (valued.length < 2) {
-    return /* @__PURE__ */ jsx4("div", { className, style: { height }, "aria-hidden": true });
+    return /* @__PURE__ */ jsx5("div", { className, style: { height }, "aria-hidden": true });
   }
   const vh = height;
   const top = yMax === "auto" ? Math.max(1, ...valued.map((p) => p.v)) * 1.1 : yMax;
@@ -473,12 +660,12 @@ function MetricSparkline({
       style: { height, width: "100%" },
       "aria-hidden": true,
       children: [
-        /* @__PURE__ */ jsx4("defs", { children: /* @__PURE__ */ jsxs4("linearGradient", { id: gid, x1: "0", y1: "0", x2: "0", y2: "1", children: [
-          /* @__PURE__ */ jsx4("stop", { offset: "0%", stopColor: color, stopOpacity: "0.22" }),
-          /* @__PURE__ */ jsx4("stop", { offset: "100%", stopColor: color, stopOpacity: "0" })
+        /* @__PURE__ */ jsx5("defs", { children: /* @__PURE__ */ jsxs4("linearGradient", { id: gid, x1: "0", y1: "0", x2: "0", y2: "1", children: [
+          /* @__PURE__ */ jsx5("stop", { offset: "0%", stopColor: color, stopOpacity: "0.22" }),
+          /* @__PURE__ */ jsx5("stop", { offset: "100%", stopColor: color, stopOpacity: "0" })
         ] }) }),
-        /* @__PURE__ */ jsx4("path", { d: `${d} L${last.x},${vh} L${xy[0].x},${vh} Z`, fill: `url(#${gid})` }),
-        /* @__PURE__ */ jsx4(
+        /* @__PURE__ */ jsx5("path", { d: `${d} L${last.x},${vh} L${xy[0].x},${vh} Z`, fill: `url(#${gid})` }),
+        /* @__PURE__ */ jsx5(
           "path",
           {
             d,
@@ -490,19 +677,21 @@ function MetricSparkline({
             vectorEffect: "non-scaling-stroke"
           }
         ),
-        /* @__PURE__ */ jsx4("circle", { cx: last.x, cy: last.y, r: 1.6, fill: color, vectorEffect: "non-scaling-stroke" })
+        /* @__PURE__ */ jsx5("circle", { cx: last.x, cy: last.y, r: 1.6, fill: color, vectorEffect: "non-scaling-stroke" })
       ]
     }
   );
 }
 
 // src/components/machine-card.tsx
-import { Fragment, jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+import { Fragment, jsx as jsx6, jsxs as jsxs5 } from "react/jsx-runtime";
 function KindIcon({ machine }) {
-  if (machine.isSessionGroup)
-    return /* @__PURE__ */ jsx5(ServerIcon, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
-  if (machine.kind === "modal") return /* @__PURE__ */ jsx5(CpuIcon, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
-  return /* @__PURE__ */ jsx5(LaptopIcon, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  if (machine.kind === "local" || machine.kind === "selfhosted")
+    return /* @__PURE__ */ jsx6(LaptopIcon, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  if (machine.kind === "docker" || machine.isSessionGroup)
+    return /* @__PURE__ */ jsx6(ServerIcon, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  if (machine.kind === "modal") return /* @__PURE__ */ jsx6(CpuIcon, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  return /* @__PURE__ */ jsx6(ServerIcon, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
 }
 function MachineCard({
   machine,
@@ -523,33 +712,9 @@ function MachineCard({
   const cpuPts = (series ?? []).map((s) => ({ t: new Date(s.sampledAt).getTime(), v: s.cpuPct }));
   const openable = Boolean(onOpenDetail);
   const runtime = machine.runtime;
-  const updateRunning = runtime?.versionState === "updating";
-  const dispatchConfirmationStalled = runtime?.update?.status === "requested" && clockNow - new Date(runtime.update.updatedAt).getTime() >= 3e4;
-  const canUpdate = Boolean(machine.enrollmentId && onUpdateAgent) && !offline && (runtime?.versionState === "outdated" || runtime?.versionState === "update_failed" || dispatchConfirmationStalled);
-  const updateLabel = (() => {
-    const update = runtime?.update;
-    if (!update) return null;
-    switch (update.status) {
-      case "requested":
-        return dispatchConfirmationStalled ? "Agent confirmation delayed" : "Confirming with agent";
-      case "accepted":
-        return "Update accepted";
-      case "waiting_for_idle":
-        return "Waiting for current work";
-      case "downloading":
-      case "verifying":
-      case "applying":
-        return `${update.status}\u2026`;
-      case "restarting":
-        return "Restarting agent";
-      case "succeeded":
-        return `Updated \xB7 v${update.targetVersion}`;
-      case "failed": {
-        const detail = update.errorCode?.replaceAll("_", " ");
-        return update.rolledBack ? `Update rolled back safely${detail ? ` \xB7 ${detail}` : ""}` : `Update failed${detail ? ` \xB7 ${detail}` : ""}`;
-      }
-    }
-  })();
+  const agent = runtime ? describeAgentRuntime(runtime, clockNow) : null;
+  const updateAction = agent?.action && machine.enrollmentId && onUpdateAgent && !offline ? agent.action : null;
+  const conflict = runnerConflict(machine.connectionAuthority, clockNow);
   return /* @__PURE__ */ jsxs5(
     "div",
     {
@@ -572,14 +737,14 @@ function MachineCard({
         className
       ),
       children: [
-        machine.active ? /* @__PURE__ */ jsx5("span", { "aria-hidden": true, className: "absolute inset-y-0 left-0 w-0.5 bg-og-accent" }) : null,
+        machine.active ? /* @__PURE__ */ jsx6("span", { "aria-hidden": true, className: "absolute inset-y-0 left-0 w-0.5 bg-og-accent" }) : null,
         /* @__PURE__ */ jsxs5("div", { className: "flex items-start justify-between gap-3", children: [
           /* @__PURE__ */ jsxs5("div", { className: "flex min-w-0 items-start gap-2.5", children: [
-            /* @__PURE__ */ jsx5("span", { className: "mt-0.5 shrink-0", children: /* @__PURE__ */ jsx5(KindIcon, { machine }) }),
+            /* @__PURE__ */ jsx6("span", { className: "mt-0.5 shrink-0", children: /* @__PURE__ */ jsx6(KindIcon, { machine }) }),
             /* @__PURE__ */ jsxs5("div", { className: "min-w-0", children: [
               /* @__PURE__ */ jsxs5("div", { className: "flex items-center gap-2", children: [
-                /* @__PURE__ */ jsx5("span", { className: "truncate text-og-base font-medium text-og-fg", children: machine.name }),
-                machine.active ? /* @__PURE__ */ jsx5(
+                /* @__PURE__ */ jsx6("span", { className: "truncate text-og-base font-medium text-og-fg", children: machine.name }),
+                machine.active ? /* @__PURE__ */ jsx6(
                   "span",
                   {
                     "data-active-marker": true,
@@ -589,24 +754,24 @@ function MachineCard({
                 ) : null
               ] }),
               /* @__PURE__ */ jsxs5("div", { className: "mt-0.5 flex flex-wrap items-center gap-x-2 gap-y-0.5 text-og-xs text-og-fg-subtle", children: [
-                /* @__PURE__ */ jsx5("span", { "data-machine-scope": machine.scope, className: "capitalize", children: machine.scope === "user" ? "personal" : machine.scope }),
-                /* @__PURE__ */ jsx5("span", { "aria-hidden": true, children: "\xB7" }),
-                /* @__PURE__ */ jsx5("span", { className: "capitalize", children: machine.isSessionGroup ? "session sandbox" : machine.kind }),
-                /* @__PURE__ */ jsx5("span", { "aria-hidden": true, children: "\xB7" }),
+                /* @__PURE__ */ jsx6("span", { "data-machine-scope": machine.scope, children: machineScopeLabel(machine.scope) }),
+                /* @__PURE__ */ jsx6("span", { "aria-hidden": true, children: "\xB7" }),
+                /* @__PURE__ */ jsx6("span", { className: "capitalize", children: machine.kind }),
+                /* @__PURE__ */ jsx6("span", { "aria-hidden": true, children: "\xB7" }),
                 /* @__PURE__ */ jsxs5("span", { className: "font-og-mono", children: [
                   machine.os,
                   "/",
                   machine.arch
                 ] }),
-                /* @__PURE__ */ jsx5("span", { "aria-hidden": true, children: "\xB7" }),
+                /* @__PURE__ */ jsx6("span", { "aria-hidden": true, children: "\xB7" }),
                 /* @__PURE__ */ jsxs5("span", { className: "inline-flex items-center gap-1", children: [
-                  machine.hasDisplay ? /* @__PURE__ */ jsx5(MonitorIcon, { className: "size-3", "aria-hidden": true }) : /* @__PURE__ */ jsx5(MonitorOffIcon, { className: "size-3", "aria-hidden": true }),
+                  machine.hasDisplay ? /* @__PURE__ */ jsx6(MonitorIcon, { className: "size-3", "aria-hidden": true }) : /* @__PURE__ */ jsx6(MonitorOffIcon, { className: "size-3", "aria-hidden": true }),
                   machine.hasDisplay ? "display" : "headless"
                 ] })
               ] })
             ] })
           ] }),
-          /* @__PURE__ */ jsx5(
+          /* @__PURE__ */ jsx6(
             MachineHealthPill,
             {
               state: machine.state,
@@ -623,25 +788,31 @@ function MachineCard({
             "data-shared-disclosure": true,
             className: "flex items-center gap-1.5 rounded-og-md border border-og-accent/25 bg-og-accent-soft px-2.5 py-1.5 text-og-xs text-og-fg-muted",
             children: [
-              /* @__PURE__ */ jsx5(UsersIcon, { className: "size-3.5 shrink-0 text-og-accent", "aria-hidden": true }),
+              /* @__PURE__ */ jsx6(UsersIcon, { className: "size-3.5 shrink-0 text-og-accent", "aria-hidden": true }),
               "Shared \u2014 ",
               machine.sharedSessionCount,
               " sessions are on this machine."
             ]
           }
         ) : null,
-        machine.connectionAuthority.duplicateRunnerDeniedCount > 0 ? /* @__PURE__ */ jsxs5(
+        conflict?.active ? /* @__PURE__ */ jsxs5(
           "p",
           {
             "data-runner-conflict": true,
-            className: "flex items-center gap-1.5 rounded-og-md border border-og-status-failed/30 bg-og-status-failed/5 px-2.5 py-1.5 text-og-xs text-og-status-failed",
+            className: "flex items-start gap-1.5 rounded-og-md border border-og-status-waiting/30 bg-og-status-waiting/5 px-2.5 py-1.5 text-og-xs text-og-fg-muted",
             children: [
-              /* @__PURE__ */ jsx5(AlertTriangleIcon, { className: "size-3.5 shrink-0", "aria-hidden": true }),
-              "Competing agent process blocked. Open diagnostics for details."
+              /* @__PURE__ */ jsx6(
+                AlertTriangleIcon,
+                {
+                  className: "mt-px size-3.5 shrink-0 text-og-status-waiting",
+                  "aria-hidden": true
+                }
+              ),
+              /* @__PURE__ */ jsx6("span", { children: "A second copy of the agent is running on this machine. It's kept out, so work isn't affected. Stop the extra copy." })
             ]
           }
         ) : null,
-        runtime ? /* @__PURE__ */ jsxs5(
+        agent ? /* @__PURE__ */ jsxs5(
           "div",
           {
             "data-agent-runtime": true,
@@ -649,46 +820,51 @@ function MachineCard({
             children: [
               /* @__PURE__ */ jsxs5("div", { className: "min-w-0", children: [
                 /* @__PURE__ */ jsxs5("div", { className: "flex items-center gap-1.5 text-og-fg-muted", children: [
-                  runtime.versionState === "current" ? /* @__PURE__ */ jsx5(CircleCheckIcon, { className: "size-3.5 text-og-status-idle", "aria-hidden": true }) : updateRunning ? /* @__PURE__ */ jsx5(LoaderCircleIcon, { className: "size-3.5 animate-og-spin text-og-accent", "aria-hidden": true }) : /* @__PURE__ */ jsx5(DownloadIcon, { className: "size-3.5", "aria-hidden": true }),
-                  /* @__PURE__ */ jsxs5("span", { className: "truncate", children: [
-                    "Agent",
-                    " ",
-                    runtime.installedVersion ? `v${runtime.installedVersion}` : "version unknown"
-                  ] })
+                  /* @__PURE__ */ jsx6(AgentStatusIcon, { tone: agent.tone }),
+                  /* @__PURE__ */ jsx6("span", { className: "truncate", children: agent.title })
                 ] }),
-                /* @__PURE__ */ jsx5("p", { className: "mt-0.5 truncate text-og-fg-subtle", children: updateLabel ?? (runtime.versionState === "current" ? `Current \xB7 ${runtime.updateChannel ?? "channel unknown"}` : runtime.desiredVersion ? `Promoted v${runtime.desiredVersion}` : "No promoted version configured") })
+                /* @__PURE__ */ jsx6(
+                  "p",
+                  {
+                    "data-agent-status": agent.tone,
+                    className: cn("mt-0.5", STATUS_TONE_TEXT[agent.tone]),
+                    children: agent.status
+                  }
+                ),
+                agent.note ? /* @__PURE__ */ jsx6("p", { className: "mt-1 text-og-fg-muted", children: agent.note }) : null
               ] }),
-              canUpdate ? /* @__PURE__ */ jsx5(
+              updateAction ? /* @__PURE__ */ jsx6(
                 "button",
                 {
                   type: "button",
                   "data-update-agent": true,
+                  "data-update-action": updateAction.kind,
                   disabled: updatingAgent,
                   onClick: (event) => {
                     event.stopPropagation();
                     onUpdateAgent?.(machine);
                   },
                   className: "shrink-0 rounded-og-sm border border-og-border px-2 py-1 font-medium text-og-fg-muted transition-colors hover:border-og-border-strong hover:text-og-fg disabled:cursor-not-allowed disabled:opacity-50 pointer-coarse:min-h-11",
-                  children: updatingAgent ? "Starting\u2026" : dispatchConfirmationStalled ? "Retry delivery" : runtime.versionState === "update_failed" ? "Retry" : "Update"
+                  children: updatingAgent ? "Starting\u2026" : updateAction.label
                 }
               ) : null
             ]
           }
         ) : null,
-        /* @__PURE__ */ jsx5(MachineMetrics, { metrics: machine.metrics }),
+        /* @__PURE__ */ jsx6(MachineMetrics, { metrics: machine.metrics }),
         cpuPts.length > 1 ? /* @__PURE__ */ jsxs5("div", { className: "flex flex-col gap-1 rounded-og-md bg-og-surface-2/40 p-2.5", children: [
           /* @__PURE__ */ jsxs5("div", { className: "flex items-center justify-between text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: [
-            /* @__PURE__ */ jsx5("span", { children: "CPU \xB7 last 15m" }),
+            /* @__PURE__ */ jsx6("span", { children: "CPU \xB7 last 15m" }),
             openable ? /* @__PURE__ */ jsxs5("span", { className: "flex items-center gap-0.5 opacity-0 transition-opacity group-hover:opacity-100", children: [
               "Telemetry ",
-              /* @__PURE__ */ jsx5(ArrowRightIcon, { className: "size-2.5", "aria-hidden": true })
+              /* @__PURE__ */ jsx6(ArrowRightIcon, { className: "size-2.5", "aria-hidden": true })
             ] }) : null
           ] }),
-          /* @__PURE__ */ jsx5(MetricSparkline, { points: cpuPts, color: "var(--og-color-accent)", yMax: 100, height: 26 })
+          /* @__PURE__ */ jsx6(MetricSparkline, { points: cpuPts, color: "var(--og-color-accent)", yMax: 100, height: 26 })
         ] }) : null,
         /* @__PURE__ */ jsxs5("div", { className: "mt-1 flex items-center justify-between gap-3 text-og-xs text-og-fg-subtle", children: [
-          /* @__PURE__ */ jsx5("span", { className: "inline-flex items-center gap-1.5", children: sampledAgo ? /* @__PURE__ */ jsxs5(Fragment, { children: [
-            /* @__PURE__ */ jsx5(
+          /* @__PURE__ */ jsx6("span", { className: "inline-flex items-center gap-1.5", children: sampledAgo ? /* @__PURE__ */ jsxs5(Fragment, { children: [
+            /* @__PURE__ */ jsx6(
               "span",
               {
                 className: cn(
@@ -703,7 +879,7 @@ function MachineCard({
             "Last seen ",
             formatRelativeTime(machine.lastSeenAt, new Date(clockNow))
           ] }) : "Never connected" }),
-          machine.active ? /* @__PURE__ */ jsx5("span", { className: "text-og-accent", children: "Routing here" }) : attachable ? /* @__PURE__ */ jsx5(
+          machine.active ? /* @__PURE__ */ jsx6("span", { className: "text-og-accent", children: "Routing here" }) : attachable ? /* @__PURE__ */ jsx6(
             "button",
             {
               type: "button",
@@ -719,7 +895,7 @@ function MachineCard({
               ),
               children: attaching ? "Switching\u2026" : "Attach"
             }
-          ) : /* @__PURE__ */ jsx5("span", { className: "text-og-fg-subtle/70", children: offline ? "Unavailable" : "\u2014" })
+          ) : /* @__PURE__ */ jsx6("span", { className: "text-og-fg-subtle/70", children: offline ? "Unavailable" : "\u2014" })
         ] })
       ]
     }
@@ -728,7 +904,7 @@ function MachineCard({
 
 // src/components/machines/metric-history-chart.tsx
 import { useLayoutEffect, useRef, useState } from "react";
-import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+import { jsx as jsx7, jsxs as jsxs6 } from "react/jsx-runtime";
 var PAD = { top: 10, right: 12, bottom: 18, left: 40 };
 function niceCeil(v) {
   if (v <= 0) return 1;
@@ -813,7 +989,7 @@ function MetricHistoryChart({
       style: { height: H },
       "data-metric-chart": true,
       children: [
-        valued.length === 0 ? /* @__PURE__ */ jsx6("div", { className: "absolute inset-0 flex items-center justify-center", children: /* @__PURE__ */ jsxs6("span", { className: "text-og-xs text-og-fg-subtle", children: [
+        valued.length === 0 ? /* @__PURE__ */ jsx7("div", { className: "absolute inset-0 flex items-center justify-center", children: /* @__PURE__ */ jsxs6("span", { className: "text-og-xs text-og-fg-subtle", children: [
           "No samples ",
           rangeLabel
         ] }) }) : /* @__PURE__ */ jsxs6(
@@ -839,14 +1015,14 @@ function MetricHistoryChart({
               setHover(best);
             },
             children: [
-              /* @__PURE__ */ jsx6("defs", { children: /* @__PURE__ */ jsxs6("linearGradient", { id: gid, x1: "0", y1: "0", x2: "0", y2: "1", children: [
-                /* @__PURE__ */ jsx6("stop", { offset: "0%", stopColor: color, stopOpacity: "0.26" }),
-                /* @__PURE__ */ jsx6("stop", { offset: "100%", stopColor: color, stopOpacity: "0" })
+              /* @__PURE__ */ jsx7("defs", { children: /* @__PURE__ */ jsxs6("linearGradient", { id: gid, x1: "0", y1: "0", x2: "0", y2: "1", children: [
+                /* @__PURE__ */ jsx7("stop", { offset: "0%", stopColor: color, stopOpacity: "0.26" }),
+                /* @__PURE__ */ jsx7("stop", { offset: "100%", stopColor: color, stopOpacity: "0" })
               ] }) }),
               yTicks.map((v, i) => {
                 const y = yOf(v);
                 return /* @__PURE__ */ jsxs6("g", { children: [
-                  /* @__PURE__ */ jsx6(
+                  /* @__PURE__ */ jsx7(
                     "line",
                     {
                       x1: PAD.left,
@@ -858,7 +1034,7 @@ function MetricHistoryChart({
                       strokeWidth: 1
                     }
                   ),
-                  /* @__PURE__ */ jsx6(
+                  /* @__PURE__ */ jsx7(
                     "text",
                     {
                       x: PAD.left - 8,
@@ -877,7 +1053,7 @@ function MetricHistoryChart({
                 if (tv == null || tv > top) return null;
                 const y = yOf(tv);
                 const stroke = k === "crit" ? "var(--og-color-status-failed)" : "var(--og-color-status-waiting)";
-                return /* @__PURE__ */ jsx6(
+                return /* @__PURE__ */ jsx7(
                   "line",
                   {
                     x1: PAD.left,
@@ -892,7 +1068,7 @@ function MetricHistoryChart({
                   k
                 );
               }),
-              valued.length > 1 && [tMin, tMax].map((t, i) => /* @__PURE__ */ jsx6(
+              valued.length > 1 && [tMin, tMax].map((t, i) => /* @__PURE__ */ jsx7(
                 "text",
                 {
                   x: i === 0 ? PAD.left : w - PAD.right,
@@ -905,8 +1081,8 @@ function MetricHistoryChart({
                 },
                 i === 0 ? "x-start" : "x-end"
               )),
-              area && /* @__PURE__ */ jsx6("path", { d: area, fill: `url(#${gid})` }),
-              /* @__PURE__ */ jsx6(
+              area && /* @__PURE__ */ jsx7("path", { d: area, fill: `url(#${gid})` }),
+              /* @__PURE__ */ jsx7(
                 "path",
                 {
                   d: line,
@@ -919,9 +1095,9 @@ function MetricHistoryChart({
                   className: "og-mh-draw"
                 }
               ),
-              sparse && pxPts.map((p) => /* @__PURE__ */ jsx6("circle", { cx: p.x, cy: p.y, r: 2.5, fill: color }, `m-${p.t}`)),
+              sparse && pxPts.map((p) => /* @__PURE__ */ jsx7("circle", { cx: p.x, cy: p.y, r: 2.5, fill: color }, `m-${p.t}`)),
               hoverPt && /* @__PURE__ */ jsxs6("g", { pointerEvents: "none", children: [
-                /* @__PURE__ */ jsx6(
+                /* @__PURE__ */ jsx7(
                   "line",
                   {
                     x1: hoverPt.x,
@@ -932,7 +1108,7 @@ function MetricHistoryChart({
                     strokeWidth: 1
                   }
                 ),
-                /* @__PURE__ */ jsx6(
+                /* @__PURE__ */ jsx7(
                   "circle",
                   {
                     cx: hoverPt.x,
@@ -956,8 +1132,8 @@ function MetricHistoryChart({
               top: Math.max(hoverPt.y - 42, 0)
             },
             children: [
-              /* @__PURE__ */ jsx6("span", { className: "font-og-mono text-og-sm font-medium tabular-nums text-og-fg", children: fmt(hoverPt.v) }),
-              /* @__PURE__ */ jsx6("span", { className: "font-og-mono text-[10px] tabular-nums text-og-fg-subtle", children: fmtClock(hoverPt.t) })
+              /* @__PURE__ */ jsx7("span", { className: "font-og-mono text-og-sm font-medium tabular-nums text-og-fg", children: fmt(hoverPt.v) }),
+              /* @__PURE__ */ jsx7("span", { className: "font-og-mono text-[10px] tabular-nums text-og-fg-subtle", children: fmtClock(hoverPt.t) })
             ]
           }
         )
@@ -968,13 +1144,18 @@ function MetricHistoryChart({
 
 // src/components/machines/machine-detail.tsx
 import {
-  AlertTriangleIcon as AlertTriangleIcon3,
   ArrowLeftIcon,
+  BuildingIcon,
+  ChevronRightIcon,
   CpuIcon as CpuIcon2,
   LaptopIcon as LaptopIcon2,
+  PlugIcon,
   RadioIcon,
   ServerIcon as ServerIcon2,
-  Trash2Icon
+  TriangleAlertIcon as TriangleAlertIcon2,
+  Trash2Icon,
+  UserIcon,
+  UsersIcon as UsersIcon2
 } from "lucide-react";
 
 // src/components/machines/series.ts
@@ -1063,7 +1244,7 @@ function pointsFor(def, samples) {
 // src/components/machines/machine-operation-policy.tsx
 import { AlertTriangleIcon as AlertTriangleIcon2, Loader2Icon } from "lucide-react";
 import { useEffect, useState as useState2 } from "react";
-import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+import { jsx as jsx8, jsxs as jsxs7 } from "react/jsx-runtime";
 function fieldValue(value) {
   return value === null ? "" : String(value);
 }
@@ -1139,11 +1320,11 @@ function MachineOperationPolicyEditor({
       className: "rounded-og-lg border border-og-border bg-og-surface-1 p-4 shadow-og-sm",
       children: [
         /* @__PURE__ */ jsxs7("div", { className: "flex flex-col gap-1", children: [
-          /* @__PURE__ */ jsx7("h2", { className: "text-og-sm font-semibold text-og-fg", children: "Per-command resource policy" }),
-          /* @__PURE__ */ jsx7("p", { className: "text-og-xs leading-relaxed text-og-fg-muted", children: "Optional limits applied separately to each newly admitted exec and Git command. Running commands keep their admitted policy. Blank means unrestricted. The runner or host may apply a stricter explicit policy; browser, computer-use, and terminal capabilities remain unchanged." })
+          /* @__PURE__ */ jsx8("h2", { className: "text-og-sm font-semibold text-og-fg", children: "Per-command resource policy" }),
+          /* @__PURE__ */ jsx8("p", { className: "text-og-xs leading-relaxed text-og-fg-muted", children: "Optional limits applied separately to each newly admitted exec and Git command. Running commands keep their admitted policy. Blank means unrestricted. The runner or host may apply a stricter explicit policy; browser, computer-use, and terminal capabilities remain unchanged." })
         ] }),
         configured && (unsupportedMemory || unsupportedCpu) ? /* @__PURE__ */ jsxs7("div", { className: "mt-3 flex gap-2 rounded-og-md border border-og-status-failed/40 bg-og-status-failed/5 p-3 text-og-xs text-og-status-failed", children: [
-          /* @__PURE__ */ jsx7(AlertTriangleIcon2, { className: "mt-0.5 size-3.5 shrink-0", "aria-hidden": true }),
+          /* @__PURE__ */ jsx8(AlertTriangleIcon2, { className: "mt-0.5 size-3.5 shrink-0", "aria-hidden": true }),
           /* @__PURE__ */ jsxs7("span", { children: [
             unsupportedCpu ? "This runner cannot enforce the configured CPU limit." : "This runner cannot enforce the configured memory limit.",
             " ",
@@ -1153,7 +1334,7 @@ function MachineOperationPolicyEditor({
         /* @__PURE__ */ jsxs7("form", { className: "mt-4 grid gap-3 sm:grid-cols-2", onSubmit: submit, children: [
           /* @__PURE__ */ jsxs7("label", { className: "flex flex-col gap-1.5 text-og-xs text-og-fg-muted", children: [
             "Hard ceiling (bytes)",
-            /* @__PURE__ */ jsx7(
+            /* @__PURE__ */ jsx8(
               "input",
               {
                 inputMode: "numeric",
@@ -1168,7 +1349,7 @@ function MachineOperationPolicyEditor({
           ] }),
           /* @__PURE__ */ jsxs7("label", { className: "flex flex-col gap-1.5 text-og-xs text-og-fg-muted", children: [
             "Reclaim threshold (bytes)",
-            /* @__PURE__ */ jsx7(
+            /* @__PURE__ */ jsx8(
               "input",
               {
                 inputMode: "numeric",
@@ -1183,7 +1364,7 @@ function MachineOperationPolicyEditor({
           ] }),
           /* @__PURE__ */ jsxs7("label", { className: "flex flex-col gap-1.5 text-og-xs text-og-fg-muted", children: [
             "CPU maximum (millicores)",
-            /* @__PURE__ */ jsx7(
+            /* @__PURE__ */ jsx8(
               "input",
               {
                 inputMode: "numeric",
@@ -1195,10 +1376,10 @@ function MachineOperationPolicyEditor({
                 className: "min-h-9 rounded-og-sm border border-og-border bg-og-bg px-2.5 font-og-mono text-og-sm text-og-fg outline-hidden focus-visible:ring-2 focus-visible:ring-og-accent/50 disabled:opacity-60"
               }
             ),
-            /* @__PURE__ */ jsx7("span", { children: "1000 millicores = one CPU core. Blank is unlimited." })
+            /* @__PURE__ */ jsx8("span", { children: "1000 millicores = one CPU core. Blank is unlimited." })
           ] }),
           /* @__PURE__ */ jsxs7("div", { className: "flex min-h-9 items-center justify-between gap-3 sm:col-span-2", children: [
-            /* @__PURE__ */ jsx7(
+            /* @__PURE__ */ jsx8(
               "span",
               {
                 role: validationError ? "alert" : void 0,
@@ -1211,9 +1392,9 @@ function MachineOperationPolicyEditor({
               {
                 type: "submit",
                 disabled: saving,
-                className: "inline-flex min-h-9 items-center gap-1.5 rounded-og-sm bg-og-accent px-3 py-1.5 text-og-xs font-medium text-og-accent-fg transition-colors hover:bg-og-accent-strong disabled:cursor-not-allowed disabled:opacity-60",
+                className: "inline-flex min-h-9 items-center gap-1.5 rounded-og-sm border border-og-primary-border bg-og-primary text-og-primary-fg px-3 py-1.5 text-og-xs font-medium transition-colors hover:bg-og-primary-hover disabled:cursor-not-allowed disabled:opacity-60",
                 children: [
-                  saving ? /* @__PURE__ */ jsx7(Loader2Icon, { className: "size-3.5 animate-spin", "aria-hidden": true }) : null,
+                  saving ? /* @__PURE__ */ jsx8(Loader2Icon, { className: "size-3.5 animate-spin", "aria-hidden": true }) : null,
                   "Save policy"
                 ]
               }
@@ -1226,22 +1407,162 @@ function MachineOperationPolicyEditor({
 }
 
 // src/components/machines/machine-detail.tsx
-import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+import { Fragment as Fragment2, jsx as jsx9, jsxs as jsxs8 } from "react/jsx-runtime";
+var AUDIENCE = {
+  user: { label: "Only me", description: "Only its owner can run chats on it.", Icon: UserIcon },
+  workspace: {
+    label: "This workspace",
+    description: "Everyone in this workspace can run chats on it.",
+    Icon: UsersIcon2
+  },
+  organization: {
+    label: "Whole organization",
+    description: "Every workspace in the organization can use it.",
+    Icon: BuildingIcon
+  }
+};
+function MachineAudienceRow({
+  machine,
+  onChange
+}) {
+  const audience = AUDIENCE[machine.scope];
+  const changeable = onChange !== void 0 && machine.scope !== "organization";
+  const content = /* @__PURE__ */ jsxs8(Fragment2, { children: [
+    /* @__PURE__ */ jsx9(audience.Icon, { className: "size-4 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
+    /* @__PURE__ */ jsxs8("span", { className: "flex min-w-0 flex-1 flex-col gap-0.5 text-left", children: [
+      /* @__PURE__ */ jsx9("span", { className: "text-og-sm font-medium text-og-fg", children: "Who can use it?" }),
+      /* @__PURE__ */ jsx9("span", { className: "text-og-xs text-og-fg-muted", children: audience.description })
+    ] }),
+    /* @__PURE__ */ jsx9("span", { className: "shrink-0 text-og-sm text-og-fg-muted", children: audience.label }),
+    changeable ? /* @__PURE__ */ jsx9(ChevronRightIcon, { className: "size-4 shrink-0 text-og-fg-subtle", "aria-hidden": true }) : null
+  ] });
+  const frame = "flex w-full min-h-14 items-center gap-3 rounded-og-lg border border-og-border bg-og-surface-1 px-4 py-3 shadow-og-sm";
+  return changeable ? /* @__PURE__ */ jsx9(
+    "button",
+    {
+      type: "button",
+      "data-machine-audience": machine.scope,
+      onClick: () => onChange(machine),
+      "aria-label": `Who can use ${machine.name}: ${audience.label}. Change`,
+      className: cn(
+        frame,
+        "transition-colors hover:bg-og-surface-2 focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-og-accent/50"
+      ),
+      children: content
+    }
+  ) : /* @__PURE__ */ jsx9("div", { "data-machine-audience": machine.scope, className: frame, children: content });
+}
 function KindIcon2({ kind, session }) {
-  if (session) return /* @__PURE__ */ jsx8(ServerIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
-  if (kind === "modal") return /* @__PURE__ */ jsx8(CpuIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
-  return /* @__PURE__ */ jsx8(LaptopIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  if (kind === "local" || kind === "selfhosted")
+    return /* @__PURE__ */ jsx9(LaptopIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  if (kind === "docker" || session)
+    return /* @__PURE__ */ jsx9(ServerIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  if (kind === "modal") return /* @__PURE__ */ jsx9(CpuIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+  return /* @__PURE__ */ jsx9(ServerIcon2, { className: "size-4 text-og-fg-subtle", "aria-hidden": true });
+}
+function MachineAgentPanel({
+  machine,
+  now,
+  onUpdateAgent,
+  updatingAgent
+}) {
+  const authority = machine.connectionAuthority;
+  const runtime = machine.runtime;
+  if (!runtime && authority.state === "not_applicable") return null;
+  const agent = runtime ? describeAgentRuntime(runtime, now) : null;
+  const action = agent?.action && machine.enrollmentId && onUpdateAgent && machine.state !== "offline" ? agent.action : null;
+  const connection = authority.state === "not_applicable" ? null : describeAgentConnection(authority);
+  const conflict = runnerConflict(authority, now);
+  const conflictAgo = conflict?.lastAt ? formatRelativeTime(conflict.lastAt, new Date(now)) : null;
+  return /* @__PURE__ */ jsxs8(
+    "section",
+    {
+      "data-machine-agent": true,
+      "aria-label": "Agent",
+      className: "flex flex-col divide-y divide-og-border rounded-og-lg border border-og-border bg-og-surface-1 shadow-og-sm",
+      children: [
+        agent ? /* @__PURE__ */ jsxs8("div", { "data-agent-runtime": true, className: "flex min-h-14 items-center gap-3 px-4 py-3", children: [
+          /* @__PURE__ */ jsx9(AgentStatusIcon, { tone: agent.tone, className: "size-4" }),
+          /* @__PURE__ */ jsxs8("div", { className: "flex min-w-0 flex-1 flex-col gap-0.5", children: [
+            /* @__PURE__ */ jsx9("span", { className: "text-og-sm font-medium text-og-fg", children: agent.title }),
+            /* @__PURE__ */ jsx9(
+              "span",
+              {
+                "data-agent-status": agent.tone,
+                className: cn("text-og-xs", STATUS_TONE_TEXT[agent.tone]),
+                children: agent.status
+              }
+            ),
+            agent.note ? /* @__PURE__ */ jsx9("span", { className: "text-og-xs text-og-fg-muted", children: agent.note }) : null
+          ] }),
+          action ? /* @__PURE__ */ jsx9(
+            "button",
+            {
+              type: "button",
+              "data-update-agent": true,
+              "data-update-action": action.kind,
+              disabled: updatingAgent,
+              onClick: () => onUpdateAgent?.(machine),
+              className: "inline-flex min-h-9 shrink-0 items-center rounded-og-sm border border-og-border px-3 py-1 text-og-xs font-medium text-og-fg-muted transition-colors hover:border-og-border-strong hover:text-og-fg focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-og-accent/50 disabled:cursor-not-allowed disabled:opacity-50 pointer-coarse:min-h-11",
+              children: updatingAgent ? "Starting\u2026" : action.label
+            }
+          ) : null
+        ] }) : null,
+        connection ? /* @__PURE__ */ jsxs8(
+          "div",
+          {
+            "data-connection-authority": authority.state,
+            className: "flex min-h-14 items-start gap-3 px-4 py-3",
+            children: [
+              /* @__PURE__ */ jsx9(PlugIcon, { className: "mt-0.5 size-4 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
+              /* @__PURE__ */ jsxs8("div", { className: "flex min-w-0 flex-1 flex-col gap-0.5", children: [
+                /* @__PURE__ */ jsx9("span", { className: "text-og-sm font-medium text-og-fg", children: connection.label }),
+                connection.detail ? /* @__PURE__ */ jsx9("span", { className: "text-og-xs text-og-fg-muted", children: connection.detail }) : null,
+                conflict?.active ? /* @__PURE__ */ jsxs8(
+                  "span",
+                  {
+                    "data-runner-conflict": "active",
+                    className: "mt-1 flex items-start gap-1.5 text-og-xs text-og-fg-muted",
+                    children: [
+                      /* @__PURE__ */ jsx9(
+                        TriangleAlertIcon2,
+                        {
+                          className: "mt-px size-3.5 shrink-0 text-og-status-waiting",
+                          "aria-hidden": true
+                        }
+                      ),
+                      "A second copy of the agent is running on this machine. It's kept out, so work isn't affected. Stop the extra copy."
+                    ]
+                  }
+                ) : conflict ? /* @__PURE__ */ jsxs8("span", { "data-runner-conflict": "past", className: "text-og-xs text-og-fg-subtle", children: [
+                  "Kept out ",
+                  conflict.count,
+                  " extra ",
+                  conflict.count === 1 ? "copy" : "copies",
+                  " of the agent",
+                  conflictAgo ? `, most recently ${conflictAgo === "now" ? "just now" : `${conflictAgo} ago`}` : ""
+                ] }) : null
+              ] })
+            ]
+          }
+        ) : null
+      ]
+    }
+  );
 }
 function MachineDetail({
   machine,
   series,
-  window: window2,
+  window,
   onWindowChange,
   loadingSeries,
   onBack,
   onRemove,
   onUpdateOperationPolicy,
   updatingOperationPolicy,
+  onChangeAudience,
+  onUpdateAgent,
+  updatingAgent,
   now = Date.now(),
   className
 }) {
@@ -1249,25 +1570,23 @@ function MachineDetail({
   const tone = HEALTH_TOKEN[health.level];
   const latest = machine.metrics;
   const sampledAgo = latest ? formatRelativeTime(latest.sampledAt, new Date(now)) : null;
-  const authority = machine.connectionAuthority;
-  const duplicateDeniedAgo = authority.duplicateRunnerDeniedAt ? formatRelativeTime(authority.duplicateRunnerDeniedAt, new Date(now)) : null;
   const visible = METRICS.filter((m) => !(m.key === "gpu" && latest?.gpuUtilPct == null));
   const tileCols = visible.length >= 5 ? "grid-cols-2 sm:grid-cols-3 lg:grid-cols-5" : "grid-cols-2 sm:grid-cols-4";
   return /* @__PURE__ */ jsxs8("div", { className: cn("og-root mx-auto flex w-full max-w-5xl flex-col gap-5", className), children: [
     /* @__PURE__ */ jsxs8("div", { className: "flex items-center justify-between gap-3", children: [
       /* @__PURE__ */ jsxs8("div", { className: "flex min-w-0 items-center gap-2.5", children: [
-        onBack && /* @__PURE__ */ jsx8(
+        onBack && /* @__PURE__ */ jsx9(
           "button",
           {
             type: "button",
             onClick: onBack,
             className: "flex size-7 shrink-0 items-center justify-center rounded-og-sm border border-og-border bg-og-surface-1 text-og-fg-muted transition-colors hover:bg-og-surface-2 hover:text-og-fg",
             "aria-label": "Back to machines",
-            children: /* @__PURE__ */ jsx8(ArrowLeftIcon, { className: "size-3.5", "aria-hidden": true })
+            children: /* @__PURE__ */ jsx9(ArrowLeftIcon, { className: "size-3.5", "aria-hidden": true })
           }
         ),
-        /* @__PURE__ */ jsx8(KindIcon2, { kind: machine.kind, session: machine.isSessionGroup }),
-        /* @__PURE__ */ jsx8("h1", { className: "truncate text-og-md font-semibold text-og-fg", children: machine.name }),
+        /* @__PURE__ */ jsx9(KindIcon2, { kind: machine.kind, session: machine.isSessionGroup }),
+        /* @__PURE__ */ jsx9("h1", { className: "truncate text-og-md font-semibold text-og-fg", children: machine.name }),
         /* @__PURE__ */ jsxs8("span", { className: "hidden shrink-0 rounded-og-sm border border-og-border bg-og-surface-1 px-1.5 py-0.5 font-og-mono text-og-xs text-og-fg-subtle sm:inline", children: [
           machine.os,
           " \xB7 ",
@@ -1284,20 +1603,20 @@ function MachineDetail({
             onClick: () => onRemove(machine),
             className: "inline-flex min-h-9 items-center gap-1.5 rounded-og-sm border border-og-status-failed/40 px-2.5 py-1 font-medium text-og-xs text-og-status-failed transition-colors hover:bg-og-status-failed/10 focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-og-status-failed/50 pointer-coarse:min-h-11",
             children: [
-              /* @__PURE__ */ jsx8(Trash2Icon, { className: "size-3.5", "aria-hidden": true }),
-              /* @__PURE__ */ jsx8("span", { className: "hidden sm:inline", children: "Remove machine" })
+              /* @__PURE__ */ jsx9(Trash2Icon, { className: "size-3.5", "aria-hidden": true }),
+              /* @__PURE__ */ jsx9("span", { className: "hidden sm:inline", children: "Remove machine" })
             ]
           }
         ) : null,
-        /* @__PURE__ */ jsx8("div", { className: "flex items-center gap-0.5 rounded-og-md border border-og-border bg-og-surface-1 p-0.5", children: METRIC_WINDOWS.map((w) => /* @__PURE__ */ jsx8(
+        /* @__PURE__ */ jsx9("div", { className: "flex items-center gap-0.5 rounded-og-md border border-og-border bg-og-surface-1 p-0.5", children: METRIC_WINDOWS.map((w) => /* @__PURE__ */ jsx9(
           "button",
           {
             type: "button",
             onClick: () => onWindowChange(w),
-            "data-active": w === window2,
+            "data-active": w === window,
             className: cn(
               "rounded-og-sm px-2 py-1 font-og-mono text-og-xs transition-colors",
-              w === window2 ? "bg-og-surface-3 text-og-fg shadow-og-sm" : "text-og-fg-subtle hover:text-og-fg-muted"
+              w === window ? "bg-og-surface-3 text-og-fg shadow-og-sm" : "text-og-fg-subtle hover:text-og-fg-muted"
             ),
             children: w
           },
@@ -1313,11 +1632,11 @@ function MachineDetail({
           tone.soft
         ),
         children: [
-          /* @__PURE__ */ jsx8("span", { "aria-hidden": true, className: cn("absolute inset-y-0 left-0 w-1", tone.dot) }),
+          /* @__PURE__ */ jsx9("span", { "aria-hidden": true, className: cn("absolute inset-y-0 left-0 w-1", tone.dot) }),
           /* @__PURE__ */ jsxs8("div", { className: "flex flex-wrap items-center justify-between gap-3 pl-1", children: [
             /* @__PURE__ */ jsxs8("div", { className: "flex items-center gap-3", children: [
               /* @__PURE__ */ jsxs8("span", { className: "relative flex size-3", children: [
-                healthPulses(health.level) && /* @__PURE__ */ jsx8(
+                healthPulses(health.level) && /* @__PURE__ */ jsx9(
                   "span",
                   {
                     className: cn(
@@ -1326,18 +1645,18 @@ function MachineDetail({
                     )
                   }
                 ),
-                /* @__PURE__ */ jsx8("span", { className: cn("relative inline-flex size-3 rounded-full", tone.dot) })
+                /* @__PURE__ */ jsx9("span", { className: cn("relative inline-flex size-3 rounded-full", tone.dot) })
               ] }),
               /* @__PURE__ */ jsxs8("div", { className: "flex flex-col", children: [
-                /* @__PURE__ */ jsx8("span", { className: cn("text-og-md font-semibold", tone.text), children: health.label }),
-                /* @__PURE__ */ jsx8("span", { className: "text-og-sm text-og-fg-muted", children: health.reason })
+                /* @__PURE__ */ jsx9("span", { className: cn("text-og-md font-semibold", tone.text), children: health.label }),
+                /* @__PURE__ */ jsx9("span", { className: "text-og-sm text-og-fg-muted", children: health.reason })
               ] })
             ] }),
             /* @__PURE__ */ jsxs8("div", { className: "flex items-start gap-5 pr-1", children: [
               sampledAgo && /* @__PURE__ */ jsxs8("div", { className: "flex flex-col items-end gap-0.5", children: [
-                /* @__PURE__ */ jsx8("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "Sampled" }),
+                /* @__PURE__ */ jsx9("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "Sampled" }),
                 /* @__PURE__ */ jsxs8("span", { className: "flex items-center gap-1 font-og-mono text-og-sm tabular-nums text-og-fg", children: [
-                  /* @__PURE__ */ jsx8(
+                  /* @__PURE__ */ jsx9(
                     RadioIcon,
                     {
                       className: cn("size-3", health.stale ? "text-og-fg-subtle" : tone.text),
@@ -1348,12 +1667,12 @@ function MachineDetail({
                 ] })
               ] }),
               machine.lastSeenAt && /* @__PURE__ */ jsxs8("div", { className: "hidden flex-col items-end gap-0.5 sm:flex", children: [
-                /* @__PURE__ */ jsx8("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "Last seen" }),
-                /* @__PURE__ */ jsx8("span", { className: "font-og-mono text-og-sm tabular-nums text-og-fg-muted", children: formatRelativeTime(machine.lastSeenAt, new Date(now)) })
+                /* @__PURE__ */ jsx9("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "Last seen" }),
+                /* @__PURE__ */ jsx9("span", { className: "font-og-mono text-og-sm tabular-nums text-og-fg-muted", children: formatRelativeTime(machine.lastSeenAt, new Date(now)) })
               ] })
             ] })
           ] }),
-          latest && /* @__PURE__ */ jsx8(
+          latest && /* @__PURE__ */ jsx9(
             "div",
             {
               className: cn(
@@ -1363,42 +1682,28 @@ function MachineDetail({
               children: visible.map((m) => {
                 const pts = pointsFor(m, series);
                 return /* @__PURE__ */ jsxs8("div", { className: "flex flex-col gap-1.5 bg-og-surface-1 p-3", children: [
-                  /* @__PURE__ */ jsx8("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: m.title }),
-                  /* @__PURE__ */ jsx8("span", { className: "font-og-mono text-og-md font-medium tabular-nums text-og-fg", children: m.current(latest) }),
-                  /* @__PURE__ */ jsx8(MetricSparkline, { points: pts, color: m.color, yMax: m.yMax, height: 22 }),
-                  m.sub && /* @__PURE__ */ jsx8("span", { className: "truncate font-og-mono text-[10px] text-og-fg-subtle", children: m.sub(latest) })
+                  /* @__PURE__ */ jsx9("span", { className: "text-[10px] font-medium uppercase tracking-wide text-og-fg-subtle", children: m.title }),
+                  /* @__PURE__ */ jsx9("span", { className: "font-og-mono text-og-md font-medium tabular-nums text-og-fg", children: m.current(latest) }),
+                  /* @__PURE__ */ jsx9(MetricSparkline, { points: pts, color: m.color, yMax: m.yMax, height: 22 }),
+                  m.sub && /* @__PURE__ */ jsx9("span", { className: "truncate font-og-mono text-[10px] text-og-fg-subtle", children: m.sub(latest) })
                 ] }, m.key);
               })
             }
-          ),
-          authority.state !== "not_applicable" ? /* @__PURE__ */ jsxs8(
-            "div",
-            {
-              "data-connection-authority": authority.state,
-              className: "flex flex-wrap items-center justify-between gap-2 rounded-og-md border border-og-border bg-og-surface-1/75 px-3 py-2 text-og-xs",
-              children: [
-                /* @__PURE__ */ jsxs8("span", { className: "text-og-fg-muted", children: [
-                  "Runner ",
-                  authority.state.replace("_", " "),
-                  " \xB7 generation ",
-                  authority.generation,
-                  authority.supersededCount > 0 ? ` \xB7 ${authority.supersededCount} earlier ${authority.supersededCount === 1 ? "runner" : "runners"} fenced` : ""
-                ] }),
-                authority.duplicateRunnerDeniedCount > 0 ? /* @__PURE__ */ jsxs8("span", { className: "inline-flex items-center gap-1.5 text-og-status-failed", children: [
-                  /* @__PURE__ */ jsx8(AlertTriangleIcon3, { className: "size-3.5", "aria-hidden": true }),
-                  "Blocked ",
-                  authority.duplicateRunnerDeniedCount,
-                  " competing runner",
-                  authority.duplicateRunnerDeniedCount === 1 ? "" : "s",
-                  duplicateDeniedAgo ? ` \xB7 ${duplicateDeniedAgo === "now" ? "now" : `${duplicateDeniedAgo} ago`}` : ""
-                ] }) : null
-              ]
-            }
-          ) : null
+          )
         ]
       }
     ),
-    onUpdateOperationPolicy && machine.enrollmentId && machine.operationPolicy ? /* @__PURE__ */ jsx8(
+    /* @__PURE__ */ jsx9(
+      MachineAgentPanel,
+      {
+        machine,
+        now,
+        onUpdateAgent,
+        updatingAgent
+      }
+    ),
+    machine.enrollmentId && !machine.isSessionGroup ? /* @__PURE__ */ jsx9(MachineAudienceRow, { machine, onChange: onChangeAudience }) : null,
+    onUpdateOperationPolicy && machine.enrollmentId && machine.operationPolicy ? /* @__PURE__ */ jsx9(
       MachineOperationPolicyEditor,
       {
         policy: machine.operationPolicy,
@@ -1408,7 +1713,7 @@ function MachineDetail({
         onSave: (request) => onUpdateOperationPolicy(machine, request)
       }
     ) : null,
-    /* @__PURE__ */ jsx8("div", { className: "grid grid-cols-1 gap-3 lg:grid-cols-2", children: visible.map((m) => {
+    /* @__PURE__ */ jsx9("div", { className: "grid grid-cols-1 gap-3 lg:grid-cols-2", children: visible.map((m) => {
       const pts = pointsFor(m, series);
       return /* @__PURE__ */ jsxs8(
         "div",
@@ -1416,10 +1721,10 @@ function MachineDetail({
           className: "flex flex-col gap-3 rounded-og-lg border border-og-border bg-og-surface-1 p-4 shadow-og-sm",
           children: [
             /* @__PURE__ */ jsxs8("div", { className: "flex items-baseline justify-between", children: [
-              /* @__PURE__ */ jsx8("span", { className: "text-og-sm font-medium text-og-fg", children: m.title }),
-              latest && /* @__PURE__ */ jsx8("span", { className: "font-og-mono text-og-sm tabular-nums text-og-fg-muted", children: m.current(latest) })
+              /* @__PURE__ */ jsx9("span", { className: "text-og-sm font-medium text-og-fg", children: m.title }),
+              latest && /* @__PURE__ */ jsx9("span", { className: "font-og-mono text-og-sm tabular-nums text-og-fg-muted", children: m.current(latest) })
             ] }),
-            /* @__PURE__ */ jsx8(
+            /* @__PURE__ */ jsx9(
               MetricHistoryChart,
               {
                 points: pts,
@@ -1427,7 +1732,7 @@ function MachineDetail({
                 unit: m.unit,
                 color: m.color,
                 thresholds: m.thresholds,
-                rangeLabel: WINDOW_LABEL[window2],
+                rangeLabel: WINDOW_LABEL[window],
                 height: 128,
                 className: cn(loadingSeries && "opacity-50 transition-opacity")
               }
@@ -1442,7 +1747,7 @@ function MachineDetail({
 
 // src/components/machines-dashboard.tsx
 import { LaptopIcon as LaptopIcon3, PlusIcon, RefreshCwIcon } from "lucide-react";
-import { jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
+import { jsx as jsx10, jsxs as jsxs9 } from "react/jsx-runtime";
 function EmptyState({ onEnroll }) {
   return /* @__PURE__ */ jsxs9(
     "div",
@@ -1450,10 +1755,10 @@ function EmptyState({ onEnroll }) {
       "data-machines-empty": true,
       className: "flex flex-col items-center justify-center gap-3 rounded-og-lg border border-dashed border-og-border bg-og-surface-1 px-6 py-12 text-center",
       children: [
-        /* @__PURE__ */ jsx9("span", { className: "flex size-10 items-center justify-center rounded-full bg-og-surface-2 text-og-fg-subtle", children: /* @__PURE__ */ jsx9(LaptopIcon3, { className: "size-5", "aria-hidden": true }) }),
+        /* @__PURE__ */ jsx10("span", { className: "flex size-10 items-center justify-center rounded-full bg-og-surface-2 text-og-fg-subtle", children: /* @__PURE__ */ jsx10(LaptopIcon3, { className: "size-5", "aria-hidden": true }) }),
         /* @__PURE__ */ jsxs9("div", { className: "space-y-1", children: [
-          /* @__PURE__ */ jsx9("p", { className: "text-og-base font-medium text-og-fg", children: "No machines yet" }),
-          /* @__PURE__ */ jsx9("p", { className: "max-w-xs text-og-sm text-og-fg-muted", children: "Connect your own computer to run the agent on it \u2014 your files, your terminal, your desktop." })
+          /* @__PURE__ */ jsx10("p", { className: "text-og-base font-medium text-og-fg", children: "No machines yet" }),
+          /* @__PURE__ */ jsx10("p", { className: "max-w-xs text-og-sm text-og-fg-muted", children: "Connect your own computer to run the agent on it \u2014 your files, your terminal, your desktop." })
         ] }),
         onEnroll ? /* @__PURE__ */ jsxs9(
           "button",
@@ -1461,9 +1766,9 @@ function EmptyState({ onEnroll }) {
             type: "button",
             "data-enroll-cta": true,
             onClick: onEnroll,
-            className: "inline-flex items-center gap-1.5 rounded-og-sm bg-og-accent px-3 py-1.5 text-og-sm font-medium text-og-accent-fg transition-colors hover:bg-og-accent-strong pointer-coarse:min-h-11",
+            className: "inline-flex items-center gap-1.5 rounded-og-sm border border-og-primary-border bg-og-primary text-og-primary-fg px-3 py-1.5 text-og-sm font-medium transition-colors hover:bg-og-primary-hover pointer-coarse:min-h-11",
             children: [
-              /* @__PURE__ */ jsx9(PlusIcon, { className: "size-3.5", "aria-hidden": true }),
+              /* @__PURE__ */ jsx10(PlusIcon, { className: "size-3.5", "aria-hidden": true }),
               "Connect a machine"
             ]
           }
@@ -1474,41 +1779,26 @@ function EmptyState({ onEnroll }) {
 }
 function Header({
   count,
-  onEnroll,
-  onRefresh,
-  loading
+  onEnroll
 }) {
   return /* @__PURE__ */ jsxs9("div", { className: "flex items-center justify-between gap-3", children: [
     /* @__PURE__ */ jsxs9("div", { className: "flex items-baseline gap-2", children: [
-      /* @__PURE__ */ jsx9("h2", { className: "text-og-base font-semibold text-og-fg", children: "Machines" }),
-      /* @__PURE__ */ jsx9("span", { className: "font-og-mono text-og-xs text-og-fg-subtle", children: count })
+      /* @__PURE__ */ jsx10("h2", { className: "text-og-base font-semibold text-og-fg", children: "Machines" }),
+      /* @__PURE__ */ jsx10("span", { className: "font-og-mono text-og-xs text-og-fg-subtle", children: count })
     ] }),
-    /* @__PURE__ */ jsxs9("div", { className: "flex items-center gap-1.5", children: [
-      onRefresh ? /* @__PURE__ */ jsx9(
-        "button",
-        {
-          type: "button",
-          "data-refresh": true,
-          onClick: onRefresh,
-          title: "Refresh",
-          className: "rounded-og-sm p-1.5 text-og-fg-subtle transition-colors hover:bg-og-surface-2 hover:text-og-fg",
-          children: /* @__PURE__ */ jsx9(RefreshCwIcon, { className: cn("size-3.5", loading && "animate-og-spin"), "aria-hidden": true })
-        }
-      ) : null,
-      onEnroll ? /* @__PURE__ */ jsxs9(
-        "button",
-        {
-          type: "button",
-          "data-enroll-cta": true,
-          onClick: onEnroll,
-          className: "inline-flex items-center gap-1.5 rounded-og-sm border border-og-border px-2.5 py-1 text-og-sm font-medium text-og-fg-muted transition-colors hover:border-og-border-strong hover:text-og-fg pointer-coarse:min-h-11",
-          children: [
-            /* @__PURE__ */ jsx9(PlusIcon, { className: "size-3.5", "aria-hidden": true }),
-            "Connect a machine"
-          ]
-        }
-      ) : null
-    ] })
+    /* @__PURE__ */ jsx10("div", { className: "flex items-center gap-1.5", children: onEnroll ? /* @__PURE__ */ jsxs9(
+      "button",
+      {
+        type: "button",
+        "data-enroll-cta": true,
+        onClick: onEnroll,
+        className: "inline-flex items-center gap-1.5 rounded-og-sm border border-og-border px-2.5 py-1 text-og-sm font-medium text-og-fg-muted transition-colors hover:border-og-border-strong hover:text-og-fg pointer-coarse:min-h-11",
+        children: [
+          /* @__PURE__ */ jsx10(PlusIcon, { className: "size-3.5", "aria-hidden": true }),
+          "Connect a machine"
+        ]
+      }
+    ) : null })
   ] });
 }
 function MachinesDashboard({
@@ -1529,7 +1819,7 @@ function MachinesDashboard({
 }) {
   const isEmpty = !loading && !error && machines.length === 0;
   return /* @__PURE__ */ jsxs9("section", { "data-machines-dashboard": true, className: cn("og-root flex flex-col gap-3", className), children: [
-    /* @__PURE__ */ jsx9(Header, { count: machines.length, onEnroll, onRefresh, loading }),
+    /* @__PURE__ */ jsx10(Header, { count: machines.length, onEnroll }),
     error ? /* @__PURE__ */ jsxs9(
       "div",
       {
@@ -1549,7 +1839,7 @@ function MachinesDashboard({
               disabled: loading,
               className: "inline-flex items-center gap-1.5 rounded-og-sm border border-og-status-failed/30 px-2 py-1 text-og-xs font-medium transition-colors hover:border-og-status-failed/50 disabled:cursor-not-allowed disabled:opacity-60 pointer-coarse:min-h-11",
               children: [
-                /* @__PURE__ */ jsx9(RefreshCwIcon, { className: cn("size-3.5", loading && "animate-og-spin"), "aria-hidden": true }),
+                /* @__PURE__ */ jsx10(RefreshCwIcon, { className: cn("size-3.5", loading && "animate-og-spin"), "aria-hidden": true }),
                 loading ? "Retrying\u2026" : "Retry"
               ]
             }
@@ -1557,13 +1847,13 @@ function MachinesDashboard({
         ]
       }
     ) : null,
-    loading && machines.length === 0 ? /* @__PURE__ */ jsx9("div", { "data-machines-loading": true, className: "grid gap-3 sm:grid-cols-2", children: [0, 1].map((i) => /* @__PURE__ */ jsx9(
+    loading && machines.length === 0 ? /* @__PURE__ */ jsx10("div", { "data-machines-loading": true, className: "grid gap-3 sm:grid-cols-2", children: [0, 1].map((i) => /* @__PURE__ */ jsx10(
       "div",
       {
         className: "h-36 animate-og-pulse rounded-og-lg border border-og-border bg-og-surface-1"
       },
       i
-    )) }) : isEmpty ? /* @__PURE__ */ jsx9(EmptyState, { onEnroll }) : /* @__PURE__ */ jsx9("div", { className: "grid gap-3 sm:grid-cols-2 xl:grid-cols-3", "data-machines-grid": true, children: machines.map((machine) => /* @__PURE__ */ jsx9(
+    )) }) : isEmpty ? /* @__PURE__ */ jsx10(EmptyState, { onEnroll }) : /* @__PURE__ */ jsx10("div", { className: "grid gap-3 sm:grid-cols-2 xl:grid-cols-3", "data-machines-grid": true, children: machines.map((machine) => /* @__PURE__ */ jsx10(
       MachineCard,
       {
         machine: {
@@ -1584,10 +1874,10 @@ function MachinesDashboard({
 }
 
 // src/components/machine-dock-bar.tsx
-import { LaptopIcon as LaptopIcon4, CpuIcon as CpuIcon3, UsersIcon as UsersIcon2 } from "lucide-react";
-import { jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
+import { LaptopIcon as LaptopIcon4, CpuIcon as CpuIcon3, UsersIcon as UsersIcon3 } from "lucide-react";
+import { jsx as jsx11, jsxs as jsxs10 } from "react/jsx-runtime";
 function MachineDockBar({ name, kind, state, className }) {
-  const Icon = kind === "selfhosted" ? LaptopIcon4 : CpuIcon3;
+  const Icon = kind === "selfhosted" || kind === "local" ? LaptopIcon4 : CpuIcon3;
   const stateBadge = MACHINE_STATE_BADGE_META[state];
   return /* @__PURE__ */ jsxs10(
     "div",
@@ -1599,9 +1889,9 @@ function MachineDockBar({ name, kind, state, className }) {
       ),
       children: [
         /* @__PURE__ */ jsxs10("div", { className: "flex min-w-0 items-center gap-1.5", children: [
-          /* @__PURE__ */ jsx10(Icon, { className: "size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
-          /* @__PURE__ */ jsx10("span", { className: "truncate text-[11px] font-medium text-og-fg", children: name }),
-          stateBadge ? /* @__PURE__ */ jsx10(
+          /* @__PURE__ */ jsx11(Icon, { className: "size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
+          /* @__PURE__ */ jsx11("span", { className: "truncate text-[11px] font-medium text-og-fg", children: name }),
+          stateBadge ? /* @__PURE__ */ jsx11(
             "span",
             {
               "data-state-badge": state,
@@ -1613,7 +1903,7 @@ function MachineDockBar({ name, kind, state, className }) {
             }
           ) : null
         ] }),
-        /* @__PURE__ */ jsx10(
+        /* @__PURE__ */ jsx11(
           ConnectionStatusPill,
           {
             status: connectionStatusForState(state),
@@ -1641,7 +1931,7 @@ function SharedMachineDisclosure({
         className
       ),
       children: [
-        /* @__PURE__ */ jsx10(UsersIcon2, { className: "size-3.5 shrink-0 text-og-accent", "aria-hidden": true }),
+        /* @__PURE__ */ jsx11(UsersIcon3, { className: "size-3.5 shrink-0 text-og-accent", "aria-hidden": true }),
         /* @__PURE__ */ jsxs10("span", { children: [
           "Shared \u2014 ",
           others === 1 ? "another session is" : `${others} other sessions are`,
@@ -1654,7 +1944,7 @@ function SharedMachineDisclosure({
 
 // src/components/enrollment-device-flow.tsx
 import { CopyIcon, ExternalLinkIcon, LaptopIcon as LaptopIcon5, TerminalIcon } from "lucide-react";
-import { Fragment as Fragment2, jsx as jsx11, jsxs as jsxs11 } from "react/jsx-runtime";
+import { Fragment as Fragment3, jsx as jsx12, jsxs as jsxs11 } from "react/jsx-runtime";
 var PHASE_TO_STATE = {
   pending: "enrolling",
   authorized: "online",
@@ -1670,7 +1960,7 @@ function PhaseLabel({ phase }) {
     expired: "Code expired",
     disabled: "Enrollment disabled"
   };
-  return /* @__PURE__ */ jsx11("span", { children: text[phase] });
+  return /* @__PURE__ */ jsx12("span", { children: text[phase] });
 }
 function EnrollmentDeviceFlow({
   userCode,
@@ -1698,26 +1988,26 @@ function EnrollmentDeviceFlow({
       children: [
         /* @__PURE__ */ jsxs11("div", { className: "flex items-center justify-between gap-3", children: [
           /* @__PURE__ */ jsxs11("div", { className: "flex items-center gap-2", children: [
-            /* @__PURE__ */ jsx11("span", { className: "flex size-7 items-center justify-center rounded-full bg-og-surface-2 text-og-fg-muted", children: /* @__PURE__ */ jsx11(LaptopIcon5, { className: "size-4", "aria-hidden": true }) }),
-            /* @__PURE__ */ jsx11("h2", { className: "text-og-menu font-semibold text-og-fg", children: "Connect a machine" })
+            /* @__PURE__ */ jsx12("span", { className: "flex size-7 items-center justify-center rounded-full bg-og-surface-2 text-og-fg-muted", children: /* @__PURE__ */ jsx12(LaptopIcon5, { className: "size-4", "aria-hidden": true }) }),
+            /* @__PURE__ */ jsx12("h2", { className: "text-og-menu font-semibold text-og-fg", children: "Connect a machine" })
           ] }),
-          /* @__PURE__ */ jsx11(
+          /* @__PURE__ */ jsx12(
             ConnectionStatusPill,
             {
               status: PHASE_TO_STATE[phase] === "online" ? "online" : PHASE_TO_STATE[phase] === "offline" ? "offline" : "reconnecting",
-              label: /* @__PURE__ */ jsx11(PhaseLabel, { phase }),
+              label: /* @__PURE__ */ jsx12(PhaseLabel, { phase }),
               size: "sm"
             }
           )
         ] }),
         installCommand ? /* @__PURE__ */ jsxs11("div", { className: "flex flex-col gap-1.5", children: [
-          /* @__PURE__ */ jsx11("span", { className: "text-[11px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "1 \xB7 Run on the machine" }),
+          /* @__PURE__ */ jsx12("span", { className: "text-[11px] font-medium uppercase tracking-wide text-og-fg-subtle", children: "1 \xB7 Run on the machine" }),
           /* @__PURE__ */ jsxs11("div", { className: "flex items-center justify-between gap-2 overflow-hidden rounded-og-md border border-og-border bg-og-bg px-2.5 py-1.5", children: [
             /* @__PURE__ */ jsxs11("code", { className: "flex min-w-0 items-center gap-2 overflow-x-auto font-og-mono text-[12px] text-og-fg", children: [
-              /* @__PURE__ */ jsx11(TerminalIcon, { className: "size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
+              /* @__PURE__ */ jsx12(TerminalIcon, { className: "size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
               installCommand
             ] }),
-            /* @__PURE__ */ jsx11(
+            /* @__PURE__ */ jsx12(
               "button",
               {
                 type: "button",
@@ -1725,15 +2015,15 @@ function EnrollmentDeviceFlow({
                 onClick: onCopyInstall,
                 title: "Copy command",
                 className: "shrink-0 rounded-og-sm p-1.5 text-og-fg-subtle transition-colors hover:bg-og-surface-2 hover:text-og-fg",
-                children: /* @__PURE__ */ jsx11(CopyIcon, { className: "size-4", "aria-hidden": true })
+                children: /* @__PURE__ */ jsx12(CopyIcon, { className: "size-4", "aria-hidden": true })
               }
             )
           ] })
         ] }) : null,
         /* @__PURE__ */ jsxs11("div", { className: "flex flex-col gap-1.5", children: [
-          /* @__PURE__ */ jsx11("span", { className: "text-[11px] font-medium uppercase tracking-wide text-og-fg-subtle", children: installCommand ? "2 \xB7 Approve the machine" : "Approve the machine" }),
+          /* @__PURE__ */ jsx12("span", { className: "text-[11px] font-medium uppercase tracking-wide text-og-fg-subtle", children: installCommand ? "2 \xB7 Approve the machine" : "Approve the machine" }),
           /* @__PURE__ */ jsxs11("div", { className: "flex items-center justify-between gap-3 rounded-og-md border border-og-border bg-og-bg px-3 py-2.5", children: [
-            awaitingCode ? /* @__PURE__ */ jsx11("span", { "data-user-code": true, className: "font-og-mono text-[13px] text-og-fg-subtle", children: "Run the command above \u2014 your code appears here" }) : /* @__PURE__ */ jsx11(
+            awaitingCode ? /* @__PURE__ */ jsx12("span", { "data-user-code": true, className: "font-og-mono text-[13px] text-og-fg-subtle", children: "Run the command above \u2014 your code appears here" }) : /* @__PURE__ */ jsx12(
               "span",
               {
                 "data-user-code": true,
@@ -1741,7 +2031,7 @@ function EnrollmentDeviceFlow({
                 children: userCode
               }
             ),
-            /* @__PURE__ */ jsx11(
+            /* @__PURE__ */ jsx12(
               "button",
               {
                 type: "button",
@@ -1750,7 +2040,7 @@ function EnrollmentDeviceFlow({
                 disabled: awaitingCode,
                 title: "Copy code",
                 className: "shrink-0 rounded-og-sm p-1.5 text-og-fg-subtle transition-colors hover:bg-og-surface-2 hover:text-og-fg disabled:cursor-not-allowed disabled:opacity-40 disabled:hover:bg-transparent disabled:hover:text-og-fg-subtle",
-                children: /* @__PURE__ */ jsx11(CopyIcon, { className: "size-4", "aria-hidden": true })
+                children: /* @__PURE__ */ jsx12(CopyIcon, { className: "size-4", "aria-hidden": true })
               }
             )
           ] })
@@ -1763,26 +2053,26 @@ function EnrollmentDeviceFlow({
             target: "_blank",
             rel: "noreferrer",
             onClick: onOpenVerification,
-            className: "inline-flex items-center justify-center gap-1.5 rounded-og-sm bg-og-accent px-3 py-2 text-og-menu font-medium text-og-accent-fg transition-colors hover:bg-og-accent-strong",
+            className: "inline-flex items-center justify-center gap-1.5 rounded-og-sm border border-og-primary-border bg-og-primary text-og-primary-fg px-3 py-2 text-og-menu font-medium transition-colors hover:bg-og-primary-hover",
             children: [
               "Open approval page",
-              /* @__PURE__ */ jsx11(ExternalLinkIcon, { className: "size-3.5", "aria-hidden": true })
+              /* @__PURE__ */ jsx12(ExternalLinkIcon, { className: "size-3.5", "aria-hidden": true })
             ]
           }
         ),
-        /* @__PURE__ */ jsx11("p", { className: "text-center text-[11px] text-og-fg-subtle", children: awaitingCode ? /* @__PURE__ */ jsxs11(Fragment2, { children: [
+        /* @__PURE__ */ jsx12("p", { className: "text-center text-[11px] text-og-fg-subtle", children: awaitingCode ? /* @__PURE__ */ jsxs11(Fragment3, { children: [
           "The one-liner prints a short code. Open",
           " ",
-          /* @__PURE__ */ jsx11("span", { className: "font-og-mono text-og-fg-muted", children: verificationUri }),
+          /* @__PURE__ */ jsx12("span", { className: "font-og-mono text-og-fg-muted", children: verificationUri }),
           " and confirm the code shown there matches."
-        ] }) : /* @__PURE__ */ jsxs11(Fragment2, { children: [
+        ] }) : /* @__PURE__ */ jsxs11(Fragment3, { children: [
           "Confirm code ",
-          /* @__PURE__ */ jsx11("span", { className: "font-og-mono text-og-fg-muted", children: userCode }),
+          /* @__PURE__ */ jsx12("span", { className: "font-og-mono text-og-fg-muted", children: userCode }),
           " \u2014 the one printed by the one-liner \u2014 at",
           " ",
-          /* @__PURE__ */ jsx11("span", { className: "font-og-mono text-og-fg-muted", children: verificationUri }),
+          /* @__PURE__ */ jsx12("span", { className: "font-og-mono text-og-fg-muted", children: verificationUri }),
           ".",
-          typeof expiresInSeconds === "number" ? /* @__PURE__ */ jsxs11(Fragment2, { children: [
+          typeof expiresInSeconds === "number" ? /* @__PURE__ */ jsxs11(Fragment3, { children: [
             " Expires in ",
             Math.max(0, Math.round(expiresInSeconds / 60)),
             " min."
@@ -1796,21 +2086,21 @@ function EnrollmentDeviceFlow({
 // src/components/enrollment-consent.tsx
 import { useState as useState3 } from "react";
 import {
-  CircleAlertIcon,
+  CircleAlertIcon as CircleAlertIcon2,
   LaptopIcon as LaptopIcon6,
   MonitorIcon as MonitorIcon2,
   ScreenShareIcon,
   ShieldAlertIcon,
   TerminalIcon as TerminalIcon2,
-  UsersIcon as UsersIcon3
+  UsersIcon as UsersIcon4
 } from "lucide-react";
-import { jsx as jsx12, jsxs as jsxs12 } from "react/jsx-runtime";
+import { jsx as jsx13, jsxs as jsxs12 } from "react/jsx-runtime";
 function Capability({ icon, title, body }) {
   return /* @__PURE__ */ jsxs12("li", { className: "flex items-start gap-2.5", children: [
-    /* @__PURE__ */ jsx12("span", { className: "mt-0.5 shrink-0 text-og-status-failed", children: icon }),
+    /* @__PURE__ */ jsx13("span", { className: "mt-0.5 shrink-0 text-og-status-failed", children: icon }),
     /* @__PURE__ */ jsxs12("span", { className: "min-w-0", children: [
-      /* @__PURE__ */ jsx12("span", { className: "block text-og-base font-medium text-og-fg", children: title }),
-      /* @__PURE__ */ jsx12("span", { className: "block text-og-sm text-og-fg-muted", children: body })
+      /* @__PURE__ */ jsx13("span", { className: "block text-og-base font-medium text-og-fg", children: title }),
+      /* @__PURE__ */ jsx13("span", { className: "block text-og-sm text-og-fg-muted", children: body })
     ] })
   ] });
 }
@@ -1842,7 +2132,7 @@ function EnrollmentConsent({
     }
   };
   if (phase === "approved") {
-    return /* @__PURE__ */ jsx12(
+    return /* @__PURE__ */ jsx13(
       ConsentResult,
       {
         className,
@@ -1853,7 +2143,7 @@ function EnrollmentConsent({
     );
   }
   if (phase === "denied") {
-    return /* @__PURE__ */ jsx12(
+    return /* @__PURE__ */ jsx13(
       ConsentResult,
       {
         className,
@@ -1864,7 +2154,7 @@ function EnrollmentConsent({
     );
   }
   if (phase === "error") {
-    return /* @__PURE__ */ jsx12(
+    return /* @__PURE__ */ jsx13(
       ConsentResult,
       {
         className,
@@ -1884,59 +2174,59 @@ function EnrollmentConsent({
       ),
       children: [
         /* @__PURE__ */ jsxs12("div", { className: "flex items-start gap-3", children: [
-          /* @__PURE__ */ jsx12("span", { className: "flex size-9 shrink-0 items-center justify-center rounded-full bg-og-status-failed/15 text-og-status-failed", children: /* @__PURE__ */ jsx12(ShieldAlertIcon, { className: "size-5", "aria-hidden": true }) }),
+          /* @__PURE__ */ jsx13("span", { className: "flex size-9 shrink-0 items-center justify-center rounded-full bg-og-status-failed/15 text-og-status-failed", children: /* @__PURE__ */ jsx13(ShieldAlertIcon, { className: "size-5", "aria-hidden": true }) }),
           /* @__PURE__ */ jsxs12("div", { className: "min-w-0", children: [
-            /* @__PURE__ */ jsx12("h1", { className: "text-og-md font-semibold text-og-fg", children: "Give the agent your whole machine?" }),
+            /* @__PURE__ */ jsx13("h1", { className: "text-og-md font-semibold text-og-fg", children: "Give the agent your whole machine?" }),
             /* @__PURE__ */ jsxs12("p", { className: "mt-1 text-og-base text-og-fg-muted", children: [
-              "Approving lets the OpenGeni agent run on",
+              "Approving lets the Opengeni agent run on",
               " ",
-              /* @__PURE__ */ jsx12("span", { className: "font-medium text-og-fg", children: machine.machineName }),
+              /* @__PURE__ */ jsx13("span", { className: "font-medium text-og-fg", children: machine.machineName }),
               " with full access. This is your real computer \u2014 not a sandbox."
             ] })
           ] })
         ] }),
         /* @__PURE__ */ jsxs12("div", { className: "flex flex-wrap items-center gap-2 rounded-og-md border border-og-border bg-og-surface-2 px-3 py-2 text-og-sm", children: [
-          /* @__PURE__ */ jsx12(LaptopIcon6, { className: "size-4 text-og-fg-subtle", "aria-hidden": true }),
-          /* @__PURE__ */ jsx12("span", { className: "font-medium text-og-fg", children: machine.machineName }),
+          /* @__PURE__ */ jsx13(LaptopIcon6, { className: "size-4 text-og-fg-subtle", "aria-hidden": true }),
+          /* @__PURE__ */ jsx13("span", { className: "font-medium text-og-fg", children: machine.machineName }),
           /* @__PURE__ */ jsxs12("span", { className: "font-og-mono text-og-fg-subtle", children: [
             machine.os,
             "/",
             machine.arch
           ] }),
-          /* @__PURE__ */ jsx12("span", { "aria-hidden": true, className: "text-og-fg-subtle", children: "\xB7" }),
+          /* @__PURE__ */ jsx13("span", { "aria-hidden": true, className: "text-og-fg-subtle", children: "\xB7" }),
           /* @__PURE__ */ jsxs12("span", { className: "text-og-fg-subtle", children: [
             "code ",
-            /* @__PURE__ */ jsx12("span", { className: "font-og-mono font-medium text-og-fg", children: userCode })
+            /* @__PURE__ */ jsx13("span", { className: "font-og-mono font-medium text-og-fg", children: userCode })
           ] })
         ] }),
         /* @__PURE__ */ jsxs12("ul", { className: "flex flex-col gap-3", children: [
-          /* @__PURE__ */ jsx12(
+          /* @__PURE__ */ jsx13(
             Capability,
             {
-              icon: /* @__PURE__ */ jsx12(TerminalIcon2, { className: "size-4", "aria-hidden": true }),
+              icon: /* @__PURE__ */ jsx13(TerminalIcon2, { className: "size-4", "aria-hidden": true }),
               title: "Read, write & run anything",
               body: "The agent can read and modify any file, run any command, and use your git credentials \u2014 as if it were you at the keyboard."
             }
           ),
-          machine.canOfferDisplay ? /* @__PURE__ */ jsx12(
+          machine.canOfferDisplay ? /* @__PURE__ */ jsx13(
             Capability,
             {
-              icon: /* @__PURE__ */ jsx12(MonitorIcon2, { className: "size-4", "aria-hidden": true }),
+              icon: /* @__PURE__ */ jsx13(MonitorIcon2, { className: "size-4", "aria-hidden": true }),
               title: "See your screen",
               body: "The agent can capture this machine's display to watch what it is doing."
             }
           ) : null,
-          /* @__PURE__ */ jsx12(
+          /* @__PURE__ */ jsx13(
             Capability,
             {
-              icon: /* @__PURE__ */ jsx12(UsersIcon3, { className: "size-4", "aria-hidden": true }),
+              icon: /* @__PURE__ */ jsx13(UsersIcon4, { className: "size-4", "aria-hidden": true }),
               title: `${scopeCopy[scope].label} access while connected`,
               body: `${scopeCopy[scope].body} Disconnect the agent to revoke access instantly.`
             }
           )
         ] }),
         /* @__PURE__ */ jsxs12("fieldset", { className: "flex flex-col gap-2", disabled: busy, children: [
-          /* @__PURE__ */ jsx12("legend", { className: "mb-1 text-og-sm font-medium text-og-fg", children: "Who can use this machine?" }),
+          /* @__PURE__ */ jsx13("legend", { className: "mb-1 text-og-sm font-medium text-og-fg", children: "Who can use this machine?" }),
           ["user", "workspace", "organization"].map((candidate) => {
             const disabled = candidate === "organization" && !allowOrganizationScope;
             return /* @__PURE__ */ jsxs12(
@@ -1949,7 +2239,7 @@ function EnrollmentConsent({
                   disabled ? "cursor-not-allowed opacity-50" : "cursor-pointer"
                 ),
                 children: [
-                  /* @__PURE__ */ jsx12(
+                  /* @__PURE__ */ jsx13(
                     "input",
                     {
                       type: "radio",
@@ -1966,7 +2256,7 @@ function EnrollmentConsent({
                       scopeCopy[candidate].label,
                       disabled ? " \xB7 organization admin required" : ""
                     ] }),
-                    /* @__PURE__ */ jsx12("span", { className: "block text-og-sm text-og-fg-muted", children: scopeCopy[candidate].body })
+                    /* @__PURE__ */ jsx13("span", { className: "block text-og-sm text-og-fg-muted", children: scopeCopy[candidate].body })
                   ] })
                 ]
               },
@@ -1980,7 +2270,7 @@ function EnrollmentConsent({
             "data-screen-control-toggle": true,
             className: "flex cursor-pointer items-start gap-3 rounded-og-md border border-og-border bg-og-bg px-3 py-2.5",
             children: [
-              /* @__PURE__ */ jsx12(
+              /* @__PURE__ */ jsx13(
                 "input",
                 {
                   type: "checkbox",
@@ -1992,19 +2282,19 @@ function EnrollmentConsent({
               ),
               /* @__PURE__ */ jsxs12("span", { className: "min-w-0", children: [
                 /* @__PURE__ */ jsxs12("span", { className: "flex items-center gap-1.5 text-og-base font-medium text-og-fg", children: [
-                  /* @__PURE__ */ jsx12(ScreenShareIcon, { className: "size-3.5 text-og-fg-muted", "aria-hidden": true }),
+                  /* @__PURE__ */ jsx13(ScreenShareIcon, { className: "size-3.5 text-og-fg-muted", "aria-hidden": true }),
                   "Also let the agent control my mouse & keyboard"
                 ] }),
-                /* @__PURE__ */ jsx12("span", { className: "mt-0.5 block text-og-sm text-og-fg-muted", children: "Optional. Enables computer-use \u2014 the agent can move the pointer, type, and click on this machine's desktop. Leave off to let it only watch." })
+                /* @__PURE__ */ jsx13("span", { className: "mt-0.5 block text-og-sm text-og-fg-muted", children: "Optional. Enables computer-use \u2014 the agent can move the pointer, type, and click on this machine's desktop. Leave off to let it only watch." })
               ] })
             ]
           }
         ) : /* @__PURE__ */ jsxs12("p", { className: "flex items-start gap-2 rounded-og-md border border-og-border bg-og-bg px-3 py-2 text-og-sm text-og-fg-muted", children: [
-          /* @__PURE__ */ jsx12(CircleAlertIcon, { className: "mt-px size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
+          /* @__PURE__ */ jsx13(CircleAlertIcon2, { className: "mt-px size-3.5 shrink-0 text-og-fg-subtle", "aria-hidden": true }),
           "This machine has no display, so screen control isn't available \u2014 files, terminal, and git only."
         ] }),
         /* @__PURE__ */ jsxs12("div", { className: "flex items-center gap-2", children: [
-          /* @__PURE__ */ jsx12(
+          /* @__PURE__ */ jsx13(
             "button",
             {
               type: "button",
@@ -2015,7 +2305,7 @@ function EnrollmentConsent({
               children: "Cancel"
             }
           ),
-          /* @__PURE__ */ jsx12(
+          /* @__PURE__ */ jsx13(
             "button",
             {
               type: "button",
@@ -2049,354 +2339,39 @@ function ConsentResult({
         className
       ),
       children: [
-        /* @__PURE__ */ jsx12(
+        /* @__PURE__ */ jsx13(
           "span",
           {
             className: cn(
               "flex size-10 items-center justify-center rounded-full bg-og-surface-2",
               iconClass
             ),
-            children: /* @__PURE__ */ jsx12(LaptopIcon6, { className: "size-5", "aria-hidden": true })
+            children: /* @__PURE__ */ jsx13(LaptopIcon6, { className: "size-5", "aria-hidden": true })
           }
         ),
-        /* @__PURE__ */ jsx12("h1", { className: "text-og-md font-semibold text-og-fg", children: title }),
-        /* @__PURE__ */ jsx12("p", { className: "max-w-sm text-og-base text-og-fg-muted", children: body })
+        /* @__PURE__ */ jsx13("h1", { className: "text-og-md font-semibold text-og-fg", children: title }),
+        /* @__PURE__ */ jsx13("p", { className: "max-w-sm text-og-base text-og-fg-muted", children: body })
       ]
     }
   );
 }
 
 // src/hooks/use-machines.ts
-import { useCallback as useCallback3, useRef as useRef3, useState as useState6 } from "react";
-
-// src/provider.tsx
-import {
-  OpenGeniApiContractMismatchError,
-  OPENGENI_API_CONTRACT_REVISION
-} from "@opengeni/sdk";
-import { useCallback, useEffect as useEffect2, useMemo, useRef as useRef2, useState as useState4 } from "react";
-import { jsx as jsx13, jsxs as jsxs13 } from "react/jsx-runtime";
-var CONTRACT_RELOAD_STORAGE_PREFIX = "opengeni.reloadForApiContract:";
-function OpenGeniProvider({
-  client,
-  workspaceId,
-  onWorkspaceControlEvent,
-  onWorkspaceInteractionEvent,
-  children
-}) {
-  const [workspaceControlEvent, setWorkspaceControlEvent] = useState4(
-    null
-  );
-  const [workspaceControlConnectionState, setWorkspaceControlConnectionState] = useState4("idle");
-  const [workspaceInteractionEvent, setWorkspaceInteractionEvent] = useState4(null);
-  const [workspaceInteractionConnectionState, setWorkspaceInteractionConnectionState] = useState4("idle");
-  const [contractMismatch, setContractMismatch] = useState4(
-    null
-  );
-  const callbackRef = useRef2(onWorkspaceControlEvent);
-  const interactionCallbackRef = useRef2(onWorkspaceInteractionEvent);
-  const reconcilersRef = useRef2(/* @__PURE__ */ new Map());
-  const reconcileInFlightRef = useRef2(/* @__PURE__ */ new Map());
-  const workspaceControlSequencesRef = useRef2(/* @__PURE__ */ new Map());
-  const workspaceInteractionSequencesRef = useRef2(/* @__PURE__ */ new Map());
-  const pageLive = usePageLiveActivity();
-  const supportsWorkspaceLiveStream = "streamWorkspaceLiveEvents" in client && typeof client.streamWorkspaceLiveEvents === "function";
-  callbackRef.current = onWorkspaceControlEvent;
-  interactionCallbackRef.current = onWorkspaceInteractionEvent;
-  const verifyApiContract = useCallback(async () => {
-    try {
-      const config = await client.getClientConfig();
-      if (config.apiContractRevision !== OPENGENI_API_CONTRACT_REVISION) {
-        throw new OpenGeniApiContractMismatchError(
-          OPENGENI_API_CONTRACT_REVISION,
-          String(config.apiContractRevision || "(missing)")
-        );
-      }
-    } catch (error) {
-      if (error instanceof OpenGeniApiContractMismatchError) {
-        setContractMismatch(error);
-        reloadForContractMismatchOnce(error);
-      }
-      throw error;
-    }
-  }, [client]);
-  const registerSessionReconciler = useMemo(
-    () => (sessionId, key, reconcile2) => {
-      const sessionReconcilers = reconcilersRef.current.get(sessionId) ?? /* @__PURE__ */ new Map();
-      sessionReconcilers.set(key, reconcile2);
-      reconcilersRef.current.set(sessionId, sessionReconcilers);
-      return () => {
-        const current = reconcilersRef.current.get(sessionId);
-        current?.delete(key);
-        if (current?.size === 0) reconcilersRef.current.delete(sessionId);
-      };
-    },
-    []
-  );
-  const reconcileSession = useMemo(
-    () => (sessionId) => {
-      const existing = reconcileInFlightRef.current.get(sessionId);
-      if (existing) return existing;
-      const promise = (async () => {
-        await withTimeout(verifyApiContract(), 1e4, "API contract reconciliation");
-        const callbacks = [...reconcilersRef.current.get(sessionId)?.values() ?? []];
-        await withTimeout(
-          Promise.all(callbacks.map((reconcile2) => reconcile2())).then(() => void 0),
-          15e3,
-          "session reconciliation"
-        );
-      })().finally(() => {
-        if (reconcileInFlightRef.current.get(sessionId) === promise) {
-          reconcileInFlightRef.current.delete(sessionId);
-        }
-      });
-      reconcileInFlightRef.current.set(sessionId, promise);
-      return promise;
-    },
-    [verifyApiContract]
-  );
-  useEffect2(() => {
-    if (!supportsWorkspaceLiveStream) return;
-    const openLiveStream = client.streamWorkspaceLiveEvents;
-    setWorkspaceControlEvent(null);
-    setWorkspaceInteractionEvent(null);
-    if (!pageLive) {
-      setWorkspaceControlConnectionState("idle");
-      setWorkspaceInteractionConnectionState("idle");
-      return;
-    }
-    const controller = new AbortController();
-    const setConnectionState = (state) => {
-      setWorkspaceControlConnectionState(state);
-      setWorkspaceInteractionConnectionState(state);
-    };
-    setConnectionState("connecting");
-    void (async () => {
-      try {
-        await verifyApiContract();
-        const workspace = await client.getWorkspace(workspaceId);
-        const controlAfter = Math.max(
-          workspaceControlSequencesRef.current.get(workspaceId) ?? 0,
-          workspace.inferenceControl.revision
-        );
-        const interactionAfter = workspaceInteractionSequencesRef.current.get(workspaceId) ?? 0;
-        workspaceControlSequencesRef.current.set(workspaceId, controlAfter);
-        const stream = openLiveStream.call(client, workspaceId, {
-          controlAfter,
-          interactionAfter,
-          signal: controller.signal,
-          onStateChange: setConnectionState
-        });
-        for await (const event of stream) {
-          if (controller.signal.aborted) return;
-          if (event.type === "workspace.control.changed") {
-            workspaceControlSequencesRef.current.set(
-              workspaceId,
-              Math.max(workspaceControlSequencesRef.current.get(workspaceId) ?? 0, event.sequence)
-            );
-            setWorkspaceControlEvent(
-              (current) => !current || event.sequence > current.sequence ? event : current
-            );
-            callbackRef.current?.(event);
-          } else {
-            workspaceInteractionSequencesRef.current.set(
-              workspaceId,
-              Math.max(
-                workspaceInteractionSequencesRef.current.get(workspaceId) ?? 0,
-                event.sequence
-              )
-            );
-            setWorkspaceInteractionEvent(
-              (current) => !current || event.sequence > current.sequence ? event : current
-            );
-            interactionCallbackRef.current?.(event);
-          }
-        }
-      } catch (error) {
-        if (error instanceof OpenGeniApiContractMismatchError) {
-          setContractMismatch(error);
-          reloadForContractMismatchOnce(error);
-        }
-        if (!controller.signal.aborted) {
-          setWorkspaceControlConnectionState("error");
-          setWorkspaceInteractionConnectionState("error");
-        }
-      }
-    })();
-    return () => controller.abort();
-  }, [client, pageLive, supportsWorkspaceLiveStream, verifyApiContract, workspaceId]);
-  useEffect2(() => {
-    if (supportsWorkspaceLiveStream) return;
-    if (!pageLive) {
-      setWorkspaceControlConnectionState("idle");
-      return;
-    }
-    const controller = new AbortController();
-    setWorkspaceControlConnectionState("connecting");
-    void (async () => {
-      try {
-        await verifyApiContract();
-        const workspace = await client.getWorkspace(workspaceId);
-        const resumeAfter = Math.max(
-          workspaceControlSequencesRef.current.get(workspaceId) ?? 0,
-          workspace.inferenceControl.revision
-        );
-        workspaceControlSequencesRef.current.set(workspaceId, resumeAfter);
-        const stream = client.streamWorkspaceControlEvents(workspaceId, {
-          after: resumeAfter,
-          signal: controller.signal,
-          onStateChange: setWorkspaceControlConnectionState
-        });
-        for await (const event of stream) {
-          if (controller.signal.aborted) return;
-          workspaceControlSequencesRef.current.set(
-            workspaceId,
-            Math.max(workspaceControlSequencesRef.current.get(workspaceId) ?? 0, event.sequence)
-          );
-          setWorkspaceControlEvent(
-            (current) => !current || event.sequence > current.sequence ? event : current
-          );
-          callbackRef.current?.(event);
-        }
-      } catch (error) {
-        if (error instanceof OpenGeniApiContractMismatchError) {
-          setContractMismatch(error);
-          reloadForContractMismatchOnce(error);
-        }
-        if (!controller.signal.aborted) setWorkspaceControlConnectionState("error");
-      }
-    })();
-    return () => controller.abort();
-  }, [client, pageLive, supportsWorkspaceLiveStream, verifyApiContract, workspaceId]);
-  useEffect2(() => {
-    if (supportsWorkspaceLiveStream) return;
-    setWorkspaceInteractionEvent(null);
-    if (!pageLive) {
-      setWorkspaceInteractionConnectionState("idle");
-      return;
-    }
-    const controller = new AbortController();
-    setWorkspaceInteractionConnectionState("connecting");
-    void (async () => {
-      try {
-        await verifyApiContract();
-        const resumeAfter = workspaceInteractionSequencesRef.current.get(workspaceId) ?? 0;
-        const stream = client.streamWorkspaceInteractionRevisions(workspaceId, {
-          after: resumeAfter,
-          signal: controller.signal,
-          onStateChange: setWorkspaceInteractionConnectionState
-        });
-        for await (const event of stream) {
-          if (controller.signal.aborted) return;
-          workspaceInteractionSequencesRef.current.set(
-            workspaceId,
-            Math.max(
-              workspaceInteractionSequencesRef.current.get(workspaceId) ?? 0,
-              event.sequence
-            )
-          );
-          setWorkspaceInteractionEvent(
-            (current) => !current || event.sequence > current.sequence ? event : current
-          );
-          interactionCallbackRef.current?.(event);
-        }
-      } catch (error) {
-        if (error instanceof OpenGeniApiContractMismatchError) {
-          setContractMismatch(error);
-          reloadForContractMismatchOnce(error);
-        }
-        if (!controller.signal.aborted) setWorkspaceInteractionConnectionState("error");
-      }
-    })();
-    return () => controller.abort();
-  }, [client, pageLive, supportsWorkspaceLiveStream, verifyApiContract, workspaceId]);
-  const value = useMemo(
-    () => ({
-      client,
-      workspaceId,
-      workspaceControlEvent,
-      workspaceControlConnectionState,
-      workspaceInteractionEvent,
-      workspaceInteractionConnectionState,
-      registerSessionReconciler,
-      reconcileSession
-    }),
-    [
-      client,
-      workspaceId,
-      workspaceControlEvent,
-      workspaceControlConnectionState,
-      workspaceInteractionEvent,
-      workspaceInteractionConnectionState,
-      registerSessionReconciler,
-      reconcileSession
-    ]
-  );
-  return /* @__PURE__ */ jsxs13(OpenGeniContext.Provider, { value, children: [
-    children,
-    contractMismatch ? /* @__PURE__ */ jsx13(ApiContractMismatchScreen, { mismatch: contractMismatch }) : null
-  ] });
-}
-function withTimeout(promise, timeoutMs, label) {
-  let timer;
-  return Promise.race([
-    promise,
-    new Promise((_resolve, reject) => {
-      timer = setTimeout(
-        () => reject(new Error(`${label} timed out after ${timeoutMs}ms`)),
-        timeoutMs
-      );
-    })
-  ]).finally(() => {
-    if (timer !== void 0) clearTimeout(timer);
-  });
-}
-function ApiContractMismatchScreen({ mismatch }) {
-  return /* @__PURE__ */ jsx13(
-    "div",
-    {
-      className: "og-root fixed inset-0 z-[2147483647] grid place-items-center bg-og-bg/95 p-6 backdrop-blur-sm",
-      role: "alert",
-      "aria-live": "assertive",
-      "data-opengeni-api-contract-mismatch": true,
-      children: /* @__PURE__ */ jsxs13("div", { className: "w-full max-w-md rounded-xl border border-og-border bg-og-surface p-6 shadow-2xl", children: [
-        /* @__PURE__ */ jsx13("p", { className: "text-og-menu font-semibold text-og-fg", children: "OpenGeni updated" }),
-        /* @__PURE__ */ jsx13("p", { className: "mt-2 text-og-menu leading-6 text-og-muted", children: "This tab cannot safely continue with the new server version. Reload it before sending or controlling work." }),
-        /* @__PURE__ */ jsxs13("p", { className: "mt-3 font-mono text-og-control text-og-subtle", children: [
-          "Client ",
-          mismatch.expected,
-          " \xB7 API ",
-          mismatch.actual
-        ] }),
-        /* @__PURE__ */ jsx13(
-          "button",
-          {
-            type: "button",
-            className: "mt-5 inline-flex h-9 items-center rounded-md bg-og-fg px-3 text-og-menu font-medium text-og-bg",
-            onClick: () => window.location.reload(),
-            children: "Reload now"
-          }
-        )
-      ] })
-    }
-  );
-}
-function reloadForContractMismatchOnce(mismatch) {
-  if (typeof window === "undefined" || typeof sessionStorage === "undefined") return;
-  const key = `${CONTRACT_RELOAD_STORAGE_PREFIX}${mismatch.actual}`;
-  if (sessionStorage.getItem(key) === OPENGENI_API_CONTRACT_REVISION) return;
-  sessionStorage.setItem(key, OPENGENI_API_CONTRACT_REVISION);
-  window.setTimeout(() => window.location.reload(), 150);
-}
+import { useCallback as useCallback2, useRef as useRef2, useState as useState5 } from "react";
 
 // src/hooks/shared-machines-list.ts
-import { useCallback as useCallback2, useEffect as useEffect3, useState as useState5 } from "react";
+import { useCallback, useEffect as useEffect2, useState as useState4 } from "react";
 var EMPTY_MACHINES = {
   activeSandboxId: null,
   activeEpoch: 0,
   machines: []
 };
 var shares = /* @__PURE__ */ new Map();
+function isMachinesAccessRefusal(cause) {
+  if (!cause || typeof cause !== "object" || !("status" in cause)) return false;
+  const status = cause.status;
+  return status === 401 || status === 403 || status === 404;
+}
 function emit(share) {
   for (const subscriber of share.subscribers) {
     subscriber.onChange();
@@ -2435,6 +2410,7 @@ function cancelDispose(share) {
 }
 function arm(share) {
   stopTimer(share);
+  if (share.halted) return;
   const { enabled, pollIntervalMs } = effective(share);
   if (!enabled || pollIntervalMs === void 0) return;
   share.timer = setTimeout(() => {
@@ -2451,10 +2427,15 @@ async function runFresh(share) {
   try {
     const data = await load(abort.signal);
     if (ticket !== share.generation || abort.signal.aborted) return;
+    share.halted = false;
     share.snapshot = { data, loading: false, error: null };
     emit(share);
   } catch (cause) {
     if (ticket !== share.generation || abort.signal.aborted) return;
+    if (isMachinesAccessRefusal(cause)) {
+      share.halted = true;
+      stopTimer(share);
+    }
     share.snapshot = {
       data: share.snapshot.data,
       loading: false,
@@ -2471,7 +2452,7 @@ function run(share, force = false) {
     if (share.trailing) return share.trailing;
     let trailing;
     trailing = share.inFlight.then(async () => {
-      if (!effective(share).enabled) return;
+      if (!effective(share).enabled || share.halted) return;
       await run(share);
     }).finally(() => {
       if (share.trailing === trailing) share.trailing = null;
@@ -2494,12 +2475,19 @@ function reconcile(share) {
     share.abort = null;
     share.inFlight = null;
     stopTimer(share);
+    if (share.halted) {
+      share.halted = false;
+      share.snapshot = { data: share.snapshot.data, loading: false, error: null };
+      emit(share);
+      return;
+    }
     if (share.snapshot.loading) {
       share.snapshot = { ...share.snapshot, loading: false };
       emit(share);
     }
     return;
   }
+  if (share.halted) return;
   if (share.snapshot.data !== null || share.snapshot.error) {
     arm(share);
     return;
@@ -2522,7 +2510,8 @@ function getOrCreate(shareKey) {
     abort: null,
     inFlight: null,
     trailing: null,
-    generation: 0
+    generation: 0,
+    halted: false
   };
   shares.set(shareKey, created);
   return created;
@@ -2530,15 +2519,18 @@ function getOrCreate(shareKey) {
 async function refreshSharedMachinesList(shareKey) {
   const share = shares.get(shareKey);
   if (!share) return;
+  const wasHalted = share.halted;
+  share.halted = false;
   await run(share, true);
+  if (wasHalted) arm(share);
 }
 function useSharedMachinesList(shareKey, load, options = {}) {
   const enabled = options.enabled ?? true;
   const pageLive = usePageLiveActivity();
-  const [, setRevision] = useState5(0);
+  const [, setRevision] = useState4(0);
   const live = shares.get(shareKey)?.snapshot;
   const view = live ?? { data: null, loading: enabled && pageLive, error: null };
-  useEffect3(() => {
+  useEffect2(() => {
     const share = getOrCreate(shareKey);
     const subscriber = {
       load,
@@ -2571,7 +2563,7 @@ function useSharedMachinesList(shareKey, load, options = {}) {
       }, 0);
     };
   }, [shareKey, load, options.pollIntervalMs, enabled, pageLive]);
-  const refresh = useCallback2(() => refreshSharedMachinesList(shareKey), [shareKey]);
+  const refresh = useCallback(() => refreshSharedMachinesList(shareKey), [shareKey]);
   return { ...view, refresh };
 }
 
@@ -2601,6 +2593,10 @@ function swapFailureMessage(result) {
       return "The selected machine is offline.";
     case "concurrent_swap":
       return "The session route changed concurrently. Refresh and try again.";
+    case "personal_machine_permission_required":
+      return "The machine's owner has not allowed this chat to use it.";
+    case "personal_machine_not_permitted":
+      return "Only the machine's owner can use it in this chat.";
     default:
       return "The session stayed on its current sandbox.";
   }
@@ -2610,9 +2606,9 @@ function useMachines(options = {}) {
   const machinesClient = options.machinesClient ?? client;
   const sessionId = options.sessionId;
   const identityKey = `${workspaceId}\0${sessionId ?? ""}\0${machinesClientId(machinesClient)}`;
-  const identityRef = useRef3(identityKey);
+  const identityRef = useRef2(identityKey);
   identityRef.current = identityKey;
-  const load = useCallback3(
+  const load = useCallback2(
     async (signal) => {
       return await machinesClient.listMachines(workspaceId, {
         ...sessionId ? { sessionId } : {},
@@ -2631,20 +2627,20 @@ function useMachines(options = {}) {
     enabled: options.enabled
   });
   const { run: run2, mutating, mutationError, clearMutationError } = useMutationRunner(identityKey);
-  const [attachState, setAttachState] = useState6(() => ({ identity: identityKey, sandboxId: null }));
+  const [attachState, setAttachState] = useState5(() => ({ identity: identityKey, sandboxId: null }));
   const attachingSandboxId = attachState.identity === identityKey ? attachState.sandboxId : null;
-  const [removeState, setRemoveState] = useState6(() => ({ identity: identityKey, enrollmentId: null }));
+  const [removeState, setRemoveState] = useState5(() => ({ identity: identityKey, enrollmentId: null }));
   const removingEnrollmentId = removeState.identity === identityKey ? removeState.enrollmentId : null;
-  const [updateState, setUpdateState] = useState6(() => ({ identity: identityKey, enrollmentId: null }));
+  const [updateState, setUpdateState] = useState5(() => ({ identity: identityKey, enrollmentId: null }));
   const updatingEnrollmentId = updateState.identity === identityKey ? updateState.enrollmentId : null;
-  const [operationPolicyState, setOperationPolicyState] = useState6(() => ({ identity: identityKey, enrollmentId: null }));
+  const [operationPolicyState, setOperationPolicyState] = useState5(() => ({ identity: identityKey, enrollmentId: null }));
   const updatingOperationPolicyEnrollmentId = operationPolicyState.identity === identityKey ? operationPolicyState.enrollmentId : null;
   const data = loadedData ?? EMPTY_MACHINES;
   const canAttach = sessionId !== void 0 && (typeof machinesClient.attachMachine === "function" || typeof machinesClient.swapActiveSandbox === "function");
   const canRemove = typeof machinesClient.removeEnrollment === "function";
   const canUpdateAgent = typeof machinesClient.updateMachineAgent === "function";
   const canUpdateOperationPolicy = typeof machinesClient.updateMachineOperationPolicy === "function";
-  const attach = useCallback3(
+  const attach = useCallback2(
     async (sandboxId) => {
       if (sessionId === void 0) return false;
       const runSwap = machinesClient.attachMachine ? () => machinesClient.attachMachine(workspaceId, sessionId, sandboxId) : machinesClient.swapActiveSandbox ? () => machinesClient.swapActiveSandbox(workspaceId, sessionId, { target: sandboxId }) : null;
@@ -2666,14 +2662,14 @@ function useMachines(options = {}) {
     },
     [machinesClient, workspaceId, sessionId, identityKey, run2, refresh]
   );
-  const fetchSeries = useCallback3(
-    async (enrollmentId, window2 = "1h") => {
+  const fetchSeries = useCallback2(
+    async (enrollmentId, window = "1h") => {
       if (!machinesClient.machineMetricsSeries) return [];
-      return await machinesClient.machineMetricsSeries(workspaceId, enrollmentId, { window: window2 });
+      return await machinesClient.machineMetricsSeries(workspaceId, enrollmentId, { window });
     },
     [machinesClient, workspaceId]
   );
-  const remove = useCallback3(
+  const remove = useCallback2(
     async (enrollmentId, request = {}) => {
       if (!machinesClient.removeEnrollment) return null;
       const ownedIdentity = identityKey;
@@ -2691,7 +2687,7 @@ function useMachines(options = {}) {
     },
     [machinesClient, workspaceId, identityKey, run2, refresh]
   );
-  const updateAgent = useCallback3(
+  const updateAgent = useCallback2(
     async (enrollmentId) => {
       if (!machinesClient.updateMachineAgent) return null;
       const ownedIdentity = identityKey;
@@ -2705,7 +2701,7 @@ function useMachines(options = {}) {
     },
     [machinesClient, workspaceId, identityKey, run2, refresh]
   );
-  const updateOperationPolicy = useCallback3(
+  const updateOperationPolicy = useCallback2(
     async (enrollmentId, request) => {
       if (!machinesClient.updateMachineOperationPolicy) return null;
       const ownedIdentity = identityKey;
@@ -2748,7 +2744,6 @@ function useMachines(options = {}) {
 }
 
 export {
-  OpenGeniProvider,
   connectionStatusForState,
   MACHINES_DASHBOARD_POLL_MS,
   MACHINES_SESSION_POLL_MS,
@@ -2779,4 +2774,4 @@ export {
   EnrollmentDeviceFlow,
   EnrollmentConsent
 };
-//# sourceMappingURL=chunk-YVCHAQZY.js.map
+//# sourceMappingURL=chunk-NKMYZFHA.js.map