@qawolf/cli 1.24.0 → 1.25.0

package/dist/cli.js

@@ -8390,11 +8390,82 @@ function extractMissingPackage(text) {
   return specifier;
 }
 
+// src/core/pluralize.ts
+function pluralize(count, singular, plural = `${singular}s`) {
+  return `${String(count)} ${count === 1 ? singular : plural}`;
+}
+
 // src/core/formatSeconds.ts
 function formatSeconds(ms) {
   return `${Math.round(ms / 1000)}s`;
 }
 
+// src/core/messages/authErrors.ts
+var authErrorMessages = {
+  identity: {
+    invalidOrUnauthorized: "API key is invalid or unauthorized",
+    unexpectedFormat: "Could not verify API key: unexpected response format",
+    couldNotVerify: (detail, status) => `Could not verify API key: ${detail || `HTTP ${status}`}`,
+    couldNotVerifyNetwork: (cause) => `Could not verify API key: ${cause}`,
+    timedOut: (timeoutMs) => `Could not verify API key: the QA Wolf API did not answer within ${formatSeconds(timeoutMs)}.`
+  },
+  request: {
+    rejected401: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 401). Check your API key.`,
+    rejected402: (noun) => `QA Wolf API refused the${noun ? ` ${noun}` : ""} request (HTTP 402): billing prevented it.`,
+    rejected403: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 403). Check that your API key has access to this environment.`,
+    notFound404: (noun) => `QA Wolf API could not find ${noun ? `${noun} for that environment` : "that environment"} (HTTP 404). Check the --env value.`,
+    failedWithStatus: (status, noun) => `QA Wolf API${noun ? ` ${noun}` : ""} request failed (HTTP ${status}).`,
+    networkUnreachable: (baseUrl, noun) => `Could not reach the QA Wolf API at ${baseUrl}${noun ? ` to fetch ${noun}` : ""}. Check your network connection and QAWOLF_HOST_URL.`,
+    timedOut: (timeoutMs, noun) => `The QA Wolf API${noun ? ` ${noun}` : ""} request timed out after ${formatSeconds(timeoutMs)}. The work may still be finishing on the platform.`,
+    unexpectedResponse: (noun) => `Unexpected${noun ? ` ${noun}` : ""} response from the QA Wolf API.`
+  },
+  workos: {
+    unexpectedResponse: "WorkOS returned an unexpected response",
+    unexpectedResponseWithStatus: (status) => `WorkOS returned an unexpected response (HTTP ${status})`,
+    unreachable: (detail) => `Could not reach WorkOS: ${detail}`,
+    redirected: "WorkOS answered with a redirect, which the CLI does not follow for a sign-in request",
+    noClientForSession: "This session names no WorkOS client"
+  },
+  bundle: {
+    linkExpired: "The flow bundle download link has expired. Please run `qawolf flows pull` again to refresh.",
+    failedWithStatus: (status) => `Could not download the flow bundle (HTTP ${status}).`,
+    networkUnreachable: "Could not reach the flow bundle storage. Check your network connection and try again.",
+    timedOut: (timeoutMs) => `Downloading the flow bundle stalled — no data arrived for ${formatSeconds(timeoutMs)}. Please try again.`,
+    malformed: "The flow bundle download was malformed. Please run `qawolf flows pull` again."
+  }
+};
+
+// src/core/messages/whoami.ts
+var whoamiMessages = {
+  source: (source) => `Source: ${source}`,
+  authFailed: (source, error) => `Authentication failed (source: ${source}): ${error}`,
+  authenticatedAs: (teamName, source) => `Authenticated as ${teamName} (source: ${source})`,
+  teamNote: (input) => [
+    `Workspace: ${input.team.name}`,
+    `ID:        ${input.team.id}`,
+    input.team.slug ? `Slug:      ${input.team.slug}` : undefined,
+    input.teamUrl ? `URL:       ${input.teamUrl}` : undefined,
+    `Source:    ${input.source}`
+  ].filter((line) => Boolean(line)).join(`
+`),
+  organizationNote: (input) => [
+    `Organization: ${input.organization.name}`,
+    `ID:           ${input.organization.id}`,
+    `Source:       ${input.source}`
+  ].join(`
+`),
+  activeWorkspace: (workspaceId, found) => found ? `${found.workspace} (${found.organization})` : `${workspaceId} — no longer in reach; run 'qawolf auth switch'`,
+  userNote: (input) => [
+    `User:         ${input.user.email}`,
+    `ID:           ${input.user.id}`,
+    `Organization: ${input.organization.name}`,
+    input.activeWorkspace ? `Workspace:    ${input.activeWorkspace}` : undefined,
+    input.organizations.length > 0 ? `Workspaces:   ${input.organizations.map((o) => `${o.name}: ${o.workspaces.map((w) => w.name).join(", ")}`).join(" | ")}` : undefined,
+    `Source:       ${input.source}`
+  ].filter((line) => Boolean(line)).join(`
+`)
+};
+
 // src/core/messages/auth.ts
 var authMessages = {
   title: "QA Wolf Authentication",
@@ -8412,7 +8483,47 @@ var authMessages = {
   whoamiFailed: "Not authenticated",
   login: {
     nonInteractive: "auth login requires an interactive terminal. Set the QAWOLF_API_KEY environment variable for CI authentication.",
-    reAuthPrompt: "You are already authenticated. Re-authenticate?"
+    reAuthPrompt: "You are already authenticated. Re-authenticate?",
+    chooseMethod: "How do you want to sign in?",
+    methodBrowser: "Browser",
+    methodBrowserHint: "Sign in with your QA Wolf account",
+    methodApiKey: "API key",
+    methodApiKeyHint: "Paste a team key — needed for flows pull and flows run",
+    apiKeyPrecedence: {
+      env: "QAWOLF_API_KEY is set, and an API key takes precedence over a browser session. Commands continue to use that key until you unset the variable.",
+      stored: "A stored API key takes precedence over a browser session. Commands continue to use that key until you run 'qawolf auth logout' and sign in again."
+    }
+  },
+  device: {
+    unavailable: "This QA Wolf deployment does not offer browser sign-in. Run 'qawolf auth login' again and choose 'API key'.",
+    configUnreachable: "Could not ask this QA Wolf deployment whether it offers browser sign-in. Check your connection, then try again.",
+    confirmCode: (userCode) => `Your code is ${userCode}`,
+    visitUrl: (url) => `Confirm it at ${url}`,
+    visitUrlPlain: (url) => `Or go to ${url} and enter the code`,
+    openFailed: (url) => `Could not open a browser automatically. Open ${url} yourself to continue.`,
+    waiting: "Waiting for you to finish in the browser",
+    signedIn: (email) => `Signed in as ${email}.`,
+    failed: {
+      "access-denied": "The sign-in request was rejected.",
+      expired: "The sign-in request expired. Run 'qawolf auth login' to retry.",
+      timeout: "The sign-in request timed out. Run 'qawolf auth login' to retry.",
+      network: "Could not reach WorkOS to complete sign-in.",
+      unavailable: "Could not start browser sign-in.",
+      cancelled: "Sign-in cancelled."
+    }
+  },
+  workspace: {
+    chooseOrganization: "Which organization do you want to work in?",
+    choose: "Which workspace do you want to use?",
+    workspaceCount: (count) => pluralize(count, "workspace"),
+    working: (organization, workspace) => `Working in ${workspace} (${organization}).`,
+    none: "This account reaches no organizations yet.",
+    cancelled: "Workspace not changed.",
+    notSignedIn: "Workspace switching needs a browser sign-in. Run 'qawolf auth login' and choose Browser.",
+    sessionExpired: "Your session could not be renewed. Run 'qawolf auth login' to sign in again.",
+    nonInteractive: "auth switch needs an interactive terminal, or set QAWOLF_WORKSPACE to name a workspace.",
+    sessionChanged: "The stored sign-in changed while you made your choice. Run the command again.",
+    saveFailed: (detail) => `Could not save the workspace choice: ${detail}`
   },
   logout: {
     title: "Log Out",
@@ -8424,58 +8535,8 @@ var authMessages = {
     success: "Logged out successfully.",
     cancelled: "Logout cancelled."
   },
-  errors: {
-    identity: {
-      invalidOrUnauthorized: "API key is invalid or unauthorized",
-      unexpectedFormat: "Could not verify API key: unexpected response format",
-      couldNotVerify: (detail, status) => `Could not verify API key: ${detail || `HTTP ${status}`}`,
-      couldNotVerifyNetwork: (cause) => `Could not verify API key: ${cause}`,
-      timedOut: (timeoutMs) => `Could not verify API key: the QA Wolf API did not answer within ${formatSeconds(timeoutMs)}.`
-    },
-    request: {
-      rejected401: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 401). Check your API key.`,
-      rejected402: (noun) => `QA Wolf API refused the${noun ? ` ${noun}` : ""} request (HTTP 402): billing prevented it.`,
-      rejected403: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 403). Check that your API key has access to this environment.`,
-      notFound404: (noun) => `QA Wolf API could not find ${noun ? `${noun} for that environment` : "that environment"} (HTTP 404). Check the --env value.`,
-      failedWithStatus: (status, noun) => `QA Wolf API${noun ? ` ${noun}` : ""} request failed (HTTP ${status}).`,
-      networkUnreachable: (baseUrl, noun) => `Could not reach the QA Wolf API at ${baseUrl}${noun ? ` to fetch ${noun}` : ""}. Check your network connection and QAWOLF_HOST_URL.`,
-      timedOut: (timeoutMs, noun) => `The QA Wolf API${noun ? ` ${noun}` : ""} request timed out after ${formatSeconds(timeoutMs)}. The work may still be finishing on the platform.`,
-      unexpectedResponse: (noun) => `Unexpected${noun ? ` ${noun}` : ""} response from the QA Wolf API.`
-    },
-    bundle: {
-      linkExpired: "The flow bundle download link has expired. Please run `qawolf flows pull` again to refresh.",
-      failedWithStatus: (status) => `Could not download the flow bundle (HTTP ${status}).`,
-      networkUnreachable: "Could not reach the flow bundle storage. Check your network connection and try again.",
-      timedOut: (timeoutMs) => `Downloading the flow bundle stalled — no data arrived for ${formatSeconds(timeoutMs)}. Please try again.`,
-      malformed: "The flow bundle download was malformed. Please run `qawolf flows pull` again."
-    }
-  },
-  whoami: {
-    source: (source) => `Source: ${source}`,
-    authFailed: (source, error) => `Authentication failed (source: ${source}): ${error}`,
-    authenticatedAs: (teamName, source) => `Authenticated as ${teamName} (source: ${source})`,
-    teamNote: (input) => [
-      `Team:   ${input.team.name}`,
-      `ID:     ${input.team.id}`,
-      input.team.slug ? `Slug:   ${input.team.slug}` : undefined,
-      input.teamUrl ? `URL:    ${input.teamUrl}` : undefined,
-      `Source: ${input.source}`
-    ].filter((line) => Boolean(line)).join(`
-`),
-    organizationNote: (input) => [
-      `Organization: ${input.organization.name}`,
-      `ID:           ${input.organization.id}`,
-      `Source:       ${input.source}`
-    ].join(`
-`),
-    userNote: (input) => [
-      `User:         ${input.user.email}`,
-      `ID:           ${input.user.id}`,
-      `Organization: ${input.organization.name}`,
-      `Source:       ${input.source}`
-    ].join(`
-`)
-  }
+  errors: authErrorMessages,
+  whoami: whoamiMessages
 };
 // src/core/messages/toolNotFound.ts
 var installRemedy = "Run `qawolf install` to install the runtime dependencies.";
@@ -8568,11 +8629,6 @@ var environmentsMessages = {
   usingPulledEnv: (env) => `Could not reach the platform to resolve environment ${env}; using the copy pulled into .qawolf/${env}.`,
   tooManyPages: (pages) => `Stopped listing environments after ${pages} pages. Pass --env explicitly.`
 };
-// src/core/pluralize.ts
-function pluralize(count, singular, plural = `${singular}s`) {
-  return `${String(count)} ${count === 1 ? singular : plural}`;
-}
-
 // src/core/messages/flows.ts
 var flowsMessages = {
   title: "Flows",
@@ -9161,43 +9217,30 @@ function resolveHostUrl(env) {
 }
 
 // src/domains/auth/resolve.ts
-import { Entry as Entry3 } from "@napi-rs/keyring";
-
-// src/domains/auth/store/delete.ts
-import { join as join2 } from "node:path";
-import { Entry } from "@napi-rs/keyring";
-
-// src/domains/auth/store/constants.ts
-var service = "qawolf-cli";
-var account = "api-key";
-var credentialsFile = "credentials.json";
+import { Entry as Entry5 } from "@napi-rs/keyring";
 
-// src/domains/auth/store/delete.ts
-function deleteFromKeychain() {
-  try {
-    new Entry(service, account).deletePassword();
-    return "deleted";
-  } catch {
-    return "unavailable";
-  }
-}
-async function deleteFromFile(configDir, fs) {
+// src/core/deviceAuth/tokenExpiry.ts
+function readAccessTokenExpiry(accessToken) {
+  const segments = accessToken.split(".");
+  if (segments.length !== 3)
+    return;
+  const [, payload] = segments;
+  if (!payload)
+    return;
+  let claims;
   try {
-    await fs.unlink(join2(configDir, credentialsFile));
-    return "deleted";
+    claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
   } catch {
-    return "not-found";
+    return;
   }
+  if (typeof claims !== "object" || claims === null)
+    return;
+  const exp = claims.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp))
+    return;
+  const expiresAtMs = exp * 1000;
+  return Number.isFinite(expiresAtMs) ? expiresAtMs : undefined;
 }
-async function deleteApiKey(configDir, fs) {
-  const [keychain, file] = await Promise.all([
-    Promise.resolve(deleteFromKeychain()),
-    deleteFromFile(configDir, fs)
-  ]);
-  return { keychain, file };
-}
-// src/domains/auth/store/load.ts
-import { join as join3 } from "node:path";
 
 // node_modules/zod/v4/core/core.js
 var _a;
@@ -14424,10 +14467,229 @@ function date4(params) {
 
 // node_modules/zod/v4/classic/external.js
 config(en_default());
+// src/shell/workos/types.ts
+var defaultWorkosBaseUrl = "https://api.workos.com";
+var defaultIntervalSec = 5;
+var deviceAuthorizationBody = object({
+  device_code: string2().min(1),
+  user_code: string2().min(1),
+  verification_uri: string2().min(1),
+  verification_uri_complete: string2().min(1).optional(),
+  expires_in: number2().int().positive(),
+  interval: number2().int().positive().optional()
+});
+var deviceTokenBody = object({
+  access_token: string2().min(1),
+  refresh_token: string2().min(1),
+  user: object({ email: string2().min(1) }),
+  organization_id: string2().min(1).optional()
+});
+var oauthErrorBody = object({
+  error: string2().min(1),
+  error_description: string2().min(1).optional()
+});
+var authenticationErrorBody = object({
+  code: string2().min(1),
+  message: string2().min(1).optional()
+});
+
+// src/shell/workos/send.ts
+var timeoutMs = 15000;
+var unexpectedResponse = authErrorMessages.workos.unexpectedResponse;
+function isTransientStatus(status) {
+  return status >= 500 || status === 429 || status === 408;
+}
+async function sendWorkosRequest(url, init, fetchFn) {
+  let response;
+  try {
+    response = await fetchFn(url, {
+      method: "POST",
+      headers: init.headers,
+      body: init.body,
+      redirect: "manual",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (err) {
+    return {
+      kind: "failure",
+      detail: authErrorMessages.workos.unreachable(errorMessage(err)),
+      retryable: true
+    };
+  }
+  if (response.status >= 300 && response.status < 400) {
+    return {
+      kind: "failure",
+      detail: authErrorMessages.workos.redirected,
+      retryable: false
+    };
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch {
+    return {
+      kind: "failure",
+      detail: authErrorMessages.workos.unexpectedResponseWithStatus(response.status),
+      retryable: response.ok || isTransientStatus(response.status)
+    };
+  }
+  if (response.ok)
+    return { kind: "json", json };
+  if (isTransientStatus(response.status)) {
+    return {
+      kind: "failure",
+      detail: authErrorMessages.workos.unexpectedResponseWithStatus(response.status),
+      retryable: true
+    };
+  }
+  const parsed = oauthErrorBody.safeParse(json);
+  if (parsed.success) {
+    return {
+      kind: "oauth-error",
+      code: parsed.data.error,
+      description: parsed.data.error_description
+    };
+  }
+  const authError = authenticationErrorBody.safeParse(json);
+  if (authError.success) {
+    return {
+      kind: "oauth-error",
+      code: authError.data.code,
+      description: authError.data.message
+    };
+  }
+  return {
+    kind: "failure",
+    detail: authErrorMessages.workos.unexpectedResponseWithStatus(response.status),
+    retryable: false
+  };
+}
+
+// src/shell/workos/refreshAccessToken.ts
+async function refreshAccessToken(refreshToken, organizationId, deps) {
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: deps.clientId
+  });
+  if (organizationId)
+    params.set("organization_id", organizationId);
+  const outcome = await sendWorkosRequest(`${deps.baseUrl}/user_management/authenticate`, {
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: params.toString()
+  }, deps.fetch);
+  if (outcome.kind === "failure") {
+    return { ok: false, error: outcome.detail, retryable: outcome.retryable };
+  }
+  if (outcome.kind === "oauth-error") {
+    return {
+      ok: false,
+      error: outcome.description ?? outcome.code,
+      retryable: false
+    };
+  }
+  const parsed = deviceTokenBody.safeParse(outcome.json);
+  if (!parsed.success) {
+    return { ok: false, error: unexpectedResponse, retryable: false };
+  }
+  return {
+    ok: true,
+    value: {
+      accessToken: parsed.data.access_token,
+      refreshToken: parsed.data.refresh_token,
+      expiresAt: readAccessTokenExpiry(parsed.data.access_token),
+      email: parsed.data.user.email,
+      organizationId: parsed.data.organization_id
+    }
+  };
+}
+
+// src/shell/workos/config.ts
+function resolveWorkosConfig(publishedClientId) {
+  const clientId = publishedClientId?.trim();
+  if (!clientId)
+    return { configured: false };
+  return { configured: true, clientId, baseUrl: defaultWorkosBaseUrl };
+}
+
+// src/domains/auth/store/delete.ts
+import { join as join2 } from "node:path";
+import { Entry } from "@napi-rs/keyring";
+
+// src/domains/auth/store/constants.ts
+var service = "qawolf-cli";
+var account = "api-key";
+var credentialsFile = "credentials.json";
+var tokensAccount = "oauth-tokens";
+var tokensFile = "tokens.json";
+
+// src/domains/auth/store/delete.ts
+function deleteFromKeychain() {
+  try {
+    new Entry(service, account).deletePassword();
+    return "deleted";
+  } catch {
+    return "unavailable";
+  }
+}
+async function deleteFromFile(configDir, fs) {
+  try {
+    await fs.unlink(join2(configDir, credentialsFile));
+    return "deleted";
+  } catch (err) {
+    if (isNoEntError(err))
+      return "not-found";
+    throw err;
+  }
+}
+async function deleteApiKey(configDir, fs) {
+  const [keychain, file] = await Promise.all([
+    Promise.resolve(deleteFromKeychain()),
+    deleteFromFile(configDir, fs)
+  ]);
+  return { keychain, file };
+}
+// src/domains/auth/store/hasStoredCredentials.ts
+import { join as join3 } from "node:path";
+import { Entry as Entry2 } from "@napi-rs/keyring";
+async function fileExists(path, fs) {
+  try {
+    await fs.readFile(path);
+    return true;
+  } catch (err) {
+    return !isNoEntError(err);
+  }
+}
+function keychainHolds(entryAccount) {
+  try {
+    return Boolean(new Entry2(service, entryAccount).getPassword());
+  } catch {
+    return false;
+  }
+}
+async function hasStoredCredentials(configDir, fs) {
+  const [apiKeyFile, tokenFile] = await Promise.all([
+    fileExists(join3(configDir, credentialsFile), fs),
+    fileExists(join3(configDir, tokensFile), fs)
+  ]);
+  return apiKeyFile || tokenFile || keychainHolds(account) || keychainHolds(tokensAccount);
+}
+// src/domains/auth/store/load.ts
+import { join as join4 } from "node:path";
+
 // src/domains/auth/store/types.ts
 var credentialsFileSchema = object({
   apiKey: string2().min(1)
 });
+var oauthTokensSchema = object({
+  accessToken: string2().min(1),
+  refreshToken: string2().min(1),
+  expiresAt: number2().int().optional(),
+  email: string2().min(1),
+  organizationId: string2().min(1).optional(),
+  workspaceId: string2().min(1).optional(),
+  clientId: string2().min(1).optional()
+});
 
 // src/domains/auth/store/load.ts
 async function loadApiKey(configDir, deps) {
@@ -14441,7 +14703,7 @@ async function loadApiKey(configDir, deps) {
     errors.keychain = errorMessage(err);
   }
   try {
-    const content = await deps.fs.readFile(join3(configDir, credentialsFile));
+    const content = await deps.fs.readFile(join4(configDir, credentialsFile));
     const parsed = credentialsFileSchema.safeParse(JSON.parse(content));
     if (parsed.success) {
       return { found: true, key: parsed.data.apiKey, source: "file" };
@@ -14453,16 +14715,16 @@ async function loadApiKey(configDir, deps) {
   return { found: false, errors };
 }
 // src/domains/auth/store/save.ts
-import { join as join4 } from "node:path";
-import { Entry as Entry2 } from "@napi-rs/keyring";
+import { join as join5 } from "node:path";
+import { Entry as Entry3 } from "@napi-rs/keyring";
 async function saveToFile(configDir, key, fs) {
   const payload = { apiKey: key };
   await fs.mkdir(configDir, { recursive: true, mode: 448 });
-  await fs.writeFile(join4(configDir, credentialsFile), JSON.stringify(payload, undefined, 2), { mode: 384 });
+  await fs.writeFile(join5(configDir, credentialsFile), JSON.stringify(payload, undefined, 2), { mode: 384 });
 }
 async function saveApiKey(configDir, key, fs) {
   try {
-    const entry = new Entry2(service, account);
+    const entry = new Entry3(service, account);
     entry.setPassword(key);
     return { stored: "keychain" };
   } catch (err) {
@@ -14470,10 +14732,159 @@ async function saveApiKey(configDir, key, fs) {
     return { stored: "file", keychainError: errorMessage(err) };
   }
 }
+// src/domains/auth/store/loadTokens.ts
+import { join as join6 } from "node:path";
+var invalidPayload = "Invalid stored token format";
+function parseTokens(raw) {
+  const parsed = oauthTokensSchema.safeParse(JSON.parse(raw));
+  if (!parsed.success)
+    return;
+  return {
+    accessToken: parsed.data.accessToken,
+    refreshToken: parsed.data.refreshToken,
+    expiresAt: parsed.data.expiresAt,
+    email: parsed.data.email,
+    organizationId: parsed.data.organizationId,
+    workspaceId: parsed.data.workspaceId,
+    clientId: parsed.data.clientId
+  };
+}
+async function loadTokens(configDir, deps) {
+  const errors = {};
+  try {
+    const raw = new deps.EntryClass(service, tokensAccount).getPassword();
+    if (raw) {
+      const tokens = parseTokens(raw);
+      if (tokens)
+        return { found: true, tokens, source: "keychain" };
+      errors.keychain = invalidPayload;
+    }
+  } catch (err) {
+    errors.keychain = errorMessage(err);
+  }
+  try {
+    const raw = await deps.fs.readFile(join6(configDir, tokensFile));
+    const tokens = parseTokens(raw);
+    if (tokens)
+      return { found: true, tokens, source: "file" };
+    errors.file = invalidPayload;
+  } catch (err) {
+    errors.file = errorMessage(err);
+  }
+  return { found: false, errors };
+}
+
+// src/domains/auth/store/saveTokens.ts
+import { randomUUID } from "node:crypto";
+import { join as join7 } from "node:path";
+import { Entry as Entry4 } from "@napi-rs/keyring";
+async function saveToFile2(configDir, tokens, fs) {
+  await fs.mkdir(configDir, { recursive: true, mode: 448 });
+  const target = join7(configDir, tokensFile);
+  const staging = `${target}.${randomUUID()}.tmp`;
+  try {
+    await fs.writeFile(staging, JSON.stringify(tokens, undefined, 2), {
+      mode: 384
+    });
+    await fs.rename(staging, target);
+  } catch (err) {
+    await fs.unlink(staging).catch(() => {});
+    throw err;
+  }
+}
+async function saveTokens(configDir, tokens, fs) {
+  try {
+    new Entry4(service, tokensAccount).setPassword(JSON.stringify(tokens));
+    return { stored: "keychain" };
+  } catch (err) {
+    try {
+      new Entry4(service, tokensAccount).deletePassword();
+    } catch {}
+    await saveToFile2(configDir, tokens, fs);
+    return { stored: "file", keychainError: errorMessage(err) };
+  }
+}
+
+// src/domains/auth/resolveOauthToken.ts
+var expiryMarginMs = 30000;
+async function resolveOauthToken(configDir, deps) {
+  const stored = await deps.loadTokens(configDir);
+  if (!stored.found)
+    return;
+  const { tokens } = stored;
+  const expiresAt = tokens.expiresAt;
+  const isFresh = expiresAt !== undefined && expiresAt - expiryMarginMs > deps.now();
+  if (isFresh) {
+    return {
+      key: tokens.accessToken,
+      email: tokens.email,
+      workspaceId: tokens.workspaceId
+    };
+  }
+  const refreshed = await deps.refreshTokens({
+    refreshToken: tokens.refreshToken,
+    organizationId: tokens.organizationId,
+    clientId: tokens.clientId
+  });
+  if (!refreshed.ok) {
+    if (refreshed.retryable && expiresAt !== undefined && expiresAt > deps.now()) {
+      return {
+        key: tokens.accessToken,
+        email: tokens.email,
+        workspaceId: tokens.workspaceId
+      };
+    }
+    const current = await deps.loadTokens(configDir);
+    if (current.found && current.tokens.refreshToken !== tokens.refreshToken && current.tokens.email === tokens.email && current.tokens.organizationId === tokens.organizationId && current.tokens.clientId === tokens.clientId && current.tokens.expiresAt !== undefined && current.tokens.expiresAt > deps.now()) {
+      return {
+        key: current.tokens.accessToken,
+        email: current.tokens.email,
+        workspaceId: current.tokens.workspaceId
+      };
+    }
+    return;
+  }
+  try {
+    await deps.saveTokens(configDir, {
+      ...refreshed.value,
+      workspaceId: tokens.workspaceId,
+      clientId: tokens.clientId
+    });
+  } catch {}
+  return {
+    key: refreshed.value.accessToken,
+    email: refreshed.value.email,
+    workspaceId: tokens.workspaceId
+  };
+}
+
 // src/domains/auth/resolve.ts
+function makeOauthDeps(fs) {
+  return {
+    loadTokens: (configDir) => loadTokens(configDir, { EntryClass: Entry5, fs }),
+    refreshTokens: async ({ refreshToken, organizationId, clientId }) => {
+      const config = resolveWorkosConfig(clientId);
+      if (!config.configured) {
+        return {
+          ok: false,
+          error: authErrorMessages.workos.noClientForSession,
+          retryable: false
+        };
+      }
+      return refreshAccessToken(refreshToken, organizationId, {
+        fetch: globalThis.fetch,
+        baseUrl: config.baseUrl,
+        clientId: config.clientId
+      });
+    },
+    saveTokens: (configDir, tokens) => saveTokens(configDir, tokens, fs),
+    now: () => Date.now()
+  };
+}
 function makeDefaultDeps(fs) {
   return {
-    loadApiKey: (configDir) => loadApiKey(configDir, { EntryClass: Entry3, fs }),
+    loadApiKey: (configDir) => loadApiKey(configDir, { EntryClass: Entry5, fs }),
+    resolveOauth: (configDir) => resolveOauthToken(configDir, makeOauthDeps(fs)),
     env: process.env
   };
 }
@@ -14481,11 +14892,19 @@ async function resolveApiKey(configDir, fs, deps) {
   const resolvedDeps = deps ?? makeDefaultDeps(fs);
   const envKey = resolvedDeps.env["QAWOLF_API_KEY"];
   if (envKey?.trim()) {
-    return { key: envKey.trim(), source: "env" };
+    return { key: envKey.trim(), source: "env", workspaceId: undefined };
   }
   const stored = await resolvedDeps.loadApiKey(configDir);
   if (stored.found) {
-    return { key: stored.key, source: stored.source };
+    return { key: stored.key, source: stored.source, workspaceId: undefined };
+  }
+  const oauth = await resolvedDeps.resolveOauth(configDir);
+  if (oauth) {
+    return {
+      key: oauth.key,
+      source: "browser",
+      workspaceId: oauth.workspaceId
+    };
   }
   return;
 }
@@ -14507,9 +14926,9 @@ async function validateApiKey(deps) {
 // src/shell/logger.ts
 var import_pino = __toESM(require_pino(), 1);
 import { mkdirSync as mkdirSync2, openSync } from "node:fs";
-import { dirname, join as join5 } from "node:path";
+import { dirname, join as join8 } from "node:path";
 function defaultLogPath() {
-  return join5(envPaths("qawolf", { suffix: "" }).log, "cli.log");
+  return join8(envPaths("qawolf", { suffix: "" }).log, "cli.log");
 }
 function resolveStderrLevel(env, verbose) {
   if (verbose)
@@ -14577,14 +14996,184 @@ function createLoggingSystem(opts) {
   };
 }
 
-// src/shell/platform/parseErrorBody.ts
-var defaultMaxLength = 1024;
-function asRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
-}
-function asString(value) {
-  return typeof value === "string" ? value : undefined;
-}
+// src/core/publicApi/flagKind.ts
+function flagKind(schema) {
+  if (schema.type === "string")
+    return { ok: true, kind: "string" };
+  if (schema.type === "number" || schema.type === "integer") {
+    return { ok: true, kind: "number" };
+  }
+  if (schema.type === "boolean")
+    return { ok: true, kind: "boolean" };
+  if (schema.type === "array") {
+    if (schema.items?.type !== "string") {
+      return {
+        ok: false,
+        reason: "only string arrays can be expressed as flags"
+      };
+    }
+    return { ok: true, kind: "string-array" };
+  }
+  if (schema.type === "object") {
+    if (schema.properties) {
+      return {
+        ok: false,
+        reason: "nested objects cannot be expressed as flags"
+      };
+    }
+    if (typeof schema.additionalProperties === "object" && schema.additionalProperties.type === "string") {
+      return { ok: true, kind: "key-value-record" };
+    }
+    return { ok: false, reason: "nested objects cannot be expressed as flags" };
+  }
+  return {
+    ok: false,
+    reason: `type ${schema.type ?? "unknown"} cannot be expressed as a flag`
+  };
+}
+
+// src/core/publicApi/objectShape.ts
+var asObjectShape = (schema) => schema.type === "object" && schema.properties ? { properties: schema.properties, required: new Set(schema.required) } : undefined;
+function mergeIntersection(members) {
+  const shape = { properties: {}, required: new Set };
+  for (const member of members) {
+    const memberShape = asObjectShape(member);
+    if (!memberShape) {
+      return {
+        ok: false,
+        field: "",
+        reason: "intersection members must be object schemas"
+      };
+    }
+    for (const [field, fieldSchema] of Object.entries(memberShape.properties)) {
+      if (field in shape.properties) {
+        return {
+          ok: false,
+          field,
+          reason: "field appears in multiple intersection members"
+        };
+      }
+      shape.properties[field] = fieldSchema;
+      if (memberShape.required.has(field))
+        shape.required.add(field);
+    }
+  }
+  return { ok: true, shape };
+}
+function mergeUnion(branches) {
+  const shapes = [];
+  for (const branch of branches) {
+    const branchShape = asObjectShape(branch);
+    if (!branchShape) {
+      return {
+        ok: false,
+        field: "",
+        reason: "union branches must be object schemas"
+      };
+    }
+    shapes.push(branchShape);
+  }
+  const shape = { properties: {}, required: new Set };
+  for (const branchShape of shapes) {
+    for (const [field, fieldSchema] of Object.entries(branchShape.properties)) {
+      const existing = shape.properties[field];
+      if (!existing) {
+        shape.properties[field] = { ...fieldSchema };
+        continue;
+      }
+      const kinds = [flagKind(existing), flagKind(fieldSchema)];
+      if (kinds[0]?.ok && kinds[1]?.ok) {
+        if (kinds[0].kind !== kinds[1].kind) {
+          return {
+            ok: false,
+            field,
+            reason: "field has conflicting types across union branches"
+          };
+        }
+      } else if (JSON.stringify({ ...existing, description: undefined }) !== JSON.stringify({ ...fieldSchema, description: undefined })) {
+        return {
+          ok: false,
+          field,
+          reason: "field has conflicting object schemas across union branches"
+        };
+      }
+      if (!existing.description && fieldSchema.description) {
+        existing.description = fieldSchema.description;
+      }
+    }
+  }
+  const discriminator = Object.keys(shape.properties).find((field) => {
+    const values = shapes.map((branch) => branch.properties[field]?.const);
+    return values.every((value) => typeof value === "string") && new Set(values).size === shapes.length && shapes.every((branch) => branch.required.has(field));
+  });
+  for (const [field, fieldSchema] of Object.entries(shape.properties)) {
+    const occurrences = shapes.filter((branch) => (field in branch.properties));
+    if (occurrences.length === shapes.length && occurrences.every((branch) => branch.required.has(field))) {
+      shape.required.add(field);
+    }
+    if (field === discriminator) {
+      const values = shapes.map((branch) => branch.properties[field]?.const);
+      fieldSchema.description = `One of: ${values.join(", ")}`;
+    }
+  }
+  return { ok: true, shape };
+}
+function toObjectShape(schema) {
+  if (schema.allOf)
+    return mergeIntersection(schema.allOf);
+  const branches = schema.oneOf ?? schema.anyOf;
+  if (branches)
+    return mergeUnion(branches);
+  const shape = asObjectShape(schema);
+  if (shape)
+    return { ok: true, shape };
+  return {
+    ok: false,
+    field: "",
+    reason: "contract input must be an object schema"
+  };
+}
+
+// src/shell/platform/applyWorkspaceId.ts
+var acceptsWorkspace = new WeakMap;
+function takesWorkspaceId(inputSchema) {
+  const cached = acceptsWorkspace.get(inputSchema);
+  if (cached !== undefined)
+    return cached;
+  let accepted = false;
+  try {
+    const jsonSchema = toJSONSchema(inputSchema, {
+      io: "input"
+    });
+    const shape = toObjectShape(jsonSchema);
+    accepted = shape.ok && "workspaceId" in shape.shape.properties;
+  } catch {
+    accepted = false;
+  }
+  acceptsWorkspace.set(inputSchema, accepted);
+  return accepted;
+}
+function applyWorkspaceId(inputSchema, input, workspaceId) {
+  if (!workspaceId)
+    return input;
+  if (typeof input !== "object" || input === null)
+    return input;
+  const existing = input.workspaceId;
+  if (existing !== undefined)
+    return input;
+  if (!takesWorkspaceId(inputSchema))
+    return input;
+  return { ...input, workspaceId };
+}
+
+// src/shell/platform/parseErrorBody.ts
+var defaultMaxLength = 1024;
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+}
+function asString(value) {
+  return typeof value === "string" ? value : undefined;
+}
 function extractMessage(parsed) {
   const root = asRecord(parsed);
   if (!root)
@@ -14743,7 +15332,7 @@ function callPublicApi(trpc, contract, input, options) {
 }
 function makeCallPublicApiMethod(trpc, deps, readBackoffMs) {
   return async (contract, input, options) => requestWithRetry({
-    call: () => callPublicApi(trpc, contract, input, options),
+    call: () => callPublicApi(trpc, contract, applyWorkspaceId(contract.input, input, deps.workspaceId), options),
     backoffMs: contract.kind === "read" ? readBackoffMs : [],
     describe: (err) => describeRequestError(err, deps.baseUrl, contract.name),
     sleep: deps.sleep
@@ -15646,7 +16235,7 @@ function summarize(error) {
 // src/shell/platform/downloadBundle.ts
 import { randomBytes } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join9 } from "node:path";
 
 // src/shell/platform/fetchSignedUrl.ts
 var defaultStallTimeoutMs = 30000;
@@ -15734,7 +16323,7 @@ async function fetchSignedUrl(args, deps = { fetch: globalThis.fetch }) {
 
 // src/shell/platform/downloadBundle.ts
 async function downloadBundle(signedUrl, deps) {
-  const tmpArchive = join6(tmpdir2(), `qawolf-pull-${randomBytes(8).toString("hex")}.tar.gz`);
+  const tmpArchive = join9(tmpdir2(), `qawolf-pull-${randomBytes(8).toString("hex")}.tar.gz`);
   const result = await fetchSignedUrl({ url: signedUrl, dest: tmpArchive }, { fetch: deps.fetch, fs: deps.fs });
   if (!result.ok) {
     await deps.fs.unlink(tmpArchive).catch(() => {});
@@ -15838,6 +16427,10 @@ var identityResponse = union([
     user: never().optional()
   }).transform(({ organization }) => ({ organization }))
 ]);
+// node_modules/@qawolf/api-contracts/dist/v1/identity/organizations.js
+var identityOrganizationsResponse = object({
+  organizations: array(identityOrganization)
+});
 // node_modules/@qawolf/api-contracts/dist/v1/ids.js
 var defaultIdSchemas = {
   aiTask: string2().min(1).describe("The id of the AI task."),
@@ -17537,19 +18130,70 @@ var makeContractsV1 = (ids) => {
 };
 var publicContractsV1 = makeContractsV1(defaultIdSchemas);
 
+// src/shell/platform/organizations.ts
+function parseOrganizationsResponse(json) {
+  const parsed = identityOrganizationsResponse.safeParse(json);
+  return parsed.success ? parsed.data.organizations : undefined;
+}
+
+// src/shell/platform/getAccessibleOrganizations.ts
+var timeoutMs2 = 1e4;
+async function getAccessibleOrganizations(apiKey, deps) {
+  const url = `${deps.baseUrl}/api/v0/identity/organizations`;
+  let response;
+  try {
+    response = await deps.fetch(url, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(timeoutMs2)
+    });
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs2 } };
+    }
+    return { ok: false, error: { kind: "network", cause: toError(error) } };
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    return {
+      ok: false,
+      error: { kind: "http", status: response.status, body }
+    };
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs2 } };
+    }
+    json = undefined;
+  }
+  const organizations = parseOrganizationsResponse(json);
+  if (!organizations) {
+    return {
+      ok: false,
+      error: {
+        kind: "parse",
+        cause: Error("organizations response did not match the contract")
+      }
+    };
+  }
+  return { ok: true, data: organizations };
+}
+
 // src/shell/platform/getIdentity.ts
-var timeoutMs = 1e4;
+var timeoutMs3 = 1e4;
 async function getIdentity(apiKey, deps) {
   const url = `${deps.baseUrl}/api/v0/identity`;
   let response;
   try {
     response = await deps.fetch(url, {
       headers: { Authorization: `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(timeoutMs)
+      signal: AbortSignal.timeout(timeoutMs3)
     });
   } catch (error) {
     if (isTimeoutError(error)) {
-      return { ok: false, error: { kind: "timeout", timeoutMs } };
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs3 } };
     }
     return {
       ok: false,
@@ -17568,7 +18212,7 @@ async function getIdentity(apiKey, deps) {
     json = await response.json();
   } catch (error) {
     if (isTimeoutError(error)) {
-      return { ok: false, error: { kind: "timeout", timeoutMs } };
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs3 } };
     }
     json = undefined;
   }
@@ -17579,6 +18223,24 @@ async function getIdentity(apiKey, deps) {
   return { ok: true, data: parsed.data };
 }
 
+// src/shell/platform/identityMethods.ts
+function createIdentityMethods(apiKey, deps, backoffMs) {
+  return {
+    getIdentity: () => requestWithRetry({
+      call: () => getIdentity(apiKey, deps),
+      backoffMs,
+      describe: describeIdentityError,
+      sleep: deps.sleep
+    }),
+    getAccessibleOrganizations: () => requestWithRetry({
+      call: () => getAccessibleOrganizations(apiKey, deps),
+      backoffMs,
+      describe: describeIdentityError,
+      sleep: deps.sleep
+    })
+  };
+}
+
 // src/shell/platform/types.ts
 var environmentListItemSchema = object({
   envId: string2(),
@@ -17706,7 +18368,7 @@ function isUnsafeSegment(segment) {
 
 // src/shell/platform/teamStorageAssetSnapshot.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { join as join7, sep as sep2 } from "node:path";
+import { join as join10, sep as sep2 } from "node:path";
 function mintAssetSnapshotPath(assetsAbs, label) {
   return `${assetsAbs}.${label}-${randomBytes2(8).toString("hex")}`;
 }
@@ -17756,9 +18418,9 @@ function expectedEntries(filePaths) {
   return entries;
 }
 async function collectEntries(root, relDir, out, fs) {
-  const current = relDir ? join7(root, relDir) : root;
+  const current = relDir ? join10(root, relDir) : root;
   for (const entry of await fs.readdirWithTypes(current)) {
-    const relPath = relDir ? join7(relDir, entry.name) : entry.name;
+    const relPath = relDir ? join10(relDir, entry.name) : entry.name;
     out.add(relPath);
     if (entry.isDirectory()) {
       await collectEntries(root, relPath, out, fs);
@@ -17772,7 +18434,7 @@ function setsEqual(left, right) {
 }
 
 // src/shell/platform/teamStorageAssetReuse.ts
-import { join as join8 } from "node:path";
+import { join as join11 } from "node:path";
 async function reusableAssetPaths(assetsAbs, safeFiles, manifest, fs) {
   const reusable = new Set;
   for (const { file, relativePath } of safeFiles) {
@@ -17788,20 +18450,20 @@ async function canReuseAsset(assetsAbs, relativePath, file, manifest, fs) {
   const previous = manifest.get(relativePath);
   if (previous?.etag !== file.etag)
     return false;
-  return fs.pathExists(join8(assetsAbs, relativePath));
+  return fs.pathExists(join11(assetsAbs, relativePath));
 }
 
 // src/shell/platform/writeAssetSnapshot.ts
-import { dirname as dirname3, join as join9 } from "node:path";
+import { dirname as dirname3, join as join12 } from "node:path";
 async function writeAssetSnapshot(args) {
   let downloadedCount = 0;
   const total = args.safeFiles.filter(({ relativePath }) => !args.reusable.has(relativePath)).length;
   await args.deps.fs.mkdir(args.tmpAssets, { recursive: true });
   for (const { file, relativePath } of args.safeFiles) {
-    const dest = join9(args.tmpAssets, relativePath);
+    const dest = join12(args.tmpAssets, relativePath);
     await args.deps.fs.mkdir(dirname3(dest), { recursive: true });
     if (args.reusable.has(relativePath)) {
-      await args.deps.fs.copyFile(join9(args.assetsAbs, relativePath), dest);
+      await args.deps.fs.copyFile(join12(args.assetsAbs, relativePath), dest);
       continue;
     }
     args.deps.onProgress?.({ current: downloadedCount + 1, total });
@@ -17878,14 +18540,7 @@ function createPlatformClient(apiKey, deps) {
     return { ok: true, value: { signedUrl: result.value.url } };
   }
   return {
-    async getIdentity() {
-      return requestWithRetry({
-        call: () => getIdentity(apiKey, deps),
-        backoffMs: requestBackoffMs2,
-        describe: describeIdentityError,
-        sleep: deps.sleep
-      });
-    },
+    ...createIdentityMethods(apiKey, deps, requestBackoffMs2),
     getFlowsBundleUrl: getFlowsBundleUrlImpl,
     callPublicApi: makeCallPublicApiMethod(trpc, deps, requestBackoffMs2),
     async getEnvVars(envId) {
@@ -18584,6 +19239,86 @@ class V {
     }
   }
 }
+function p$1(l, e) {
+  if (l === undefined || e.length === 0)
+    return 0;
+  const i = e.findIndex((s) => s.value === l);
+  return i !== -1 ? i : 0;
+}
+function g(l, e) {
+  return (e.label ?? String(e.value)).toLowerCase().includes(l.toLowerCase());
+}
+function m2(l, e) {
+  if (e)
+    return l ? e : e[0];
+}
+var T$1 = class T extends V {
+  filteredOptions;
+  multiple;
+  isNavigating = false;
+  selectedValues = [];
+  focusedValue;
+  #e = 0;
+  #s = "";
+  #t;
+  #i;
+  #n;
+  get cursor() {
+    return this.#e;
+  }
+  get userInputWithCursor() {
+    if (!this.userInput)
+      return styleText(["inverse", "hidden"], "_");
+    if (this._cursor >= this.userInput.length)
+      return `${this.userInput}█`;
+    const e = this.userInput.slice(0, this._cursor), [t, ...i] = this.userInput.slice(this._cursor);
+    return `${e}${styleText("inverse", t)}${i.join("")}`;
+  }
+  get options() {
+    return typeof this.#i == "function" ? this.#i() : this.#i;
+  }
+  constructor(e) {
+    super(e), this.#i = e.options, this.#n = e.placeholder;
+    const t = this.options;
+    this.filteredOptions = [...t], this.multiple = e.multiple === true, this.#t = typeof e.options == "function" ? e.filter : e.filter ?? g;
+    let i;
+    if (e.initialValue && Array.isArray(e.initialValue) ? this.multiple ? i = e.initialValue : i = e.initialValue.slice(0, 1) : !this.multiple && this.options.length > 0 && (i = [this.options[0].value]), i)
+      for (const s of i) {
+        const n = t.findIndex((o) => o.value === s);
+        n !== -1 && (this.toggleSelected(s), this.#e = n);
+      }
+    this.focusedValue = this.options[this.#e]?.value, this.on("key", (s, n) => this.#l(s, n)), this.on("userInput", (s) => this.#u(s));
+  }
+  _isActionKey(e, t) {
+    return e === "\t" || this.multiple && this.isNavigating && t.name === "space" && e !== undefined && e !== "";
+  }
+  #l(e, t) {
+    const i = t.name === "up", s = t.name === "down", n = t.name === "return", o = this.userInput === "" || this.userInput === "\t", u = this.#n, h = this.options, f = u !== undefined && u !== "" && h.some((r) => !r.disabled && (this.#t ? this.#t(u, r) : true));
+    if (t.name === "tab" && o && f) {
+      this.userInput === "\t" && this._clearUserInput(), this._setUserInput(u, true), this.isNavigating = false;
+      return;
+    }
+    i || s ? (this.#e = findCursor(this.#e, i ? -1 : 1, this.filteredOptions), this.focusedValue = this.filteredOptions[this.#e]?.value, this.multiple || (this.selectedValues = [this.focusedValue]), this.isNavigating = true) : n ? this.value = m2(this.multiple, this.selectedValues) : this.multiple ? this.focusedValue !== undefined && (t.name === "tab" || this.isNavigating && t.name === "space") ? this.toggleSelected(this.focusedValue) : this.isNavigating = false : (this.focusedValue && (this.selectedValues = [this.focusedValue]), this.isNavigating = false);
+  }
+  deselectAll() {
+    this.selectedValues = [];
+  }
+  toggleSelected(e) {
+    this.filteredOptions.length !== 0 && (this.multiple ? this.selectedValues.includes(e) ? this.selectedValues = this.selectedValues.filter((t) => t !== e) : this.selectedValues = [...this.selectedValues, e] : this.selectedValues = [e]);
+  }
+  #u(e) {
+    if (e !== this.#s) {
+      this.#s = e;
+      const t = this.options;
+      e && this.#t ? this.filteredOptions = t.filter((n) => this.#t?.(e, n)) : this.filteredOptions = [...t];
+      const i = p$1(this.focusedValue, this.filteredOptions);
+      this.#e = findCursor(i, 0, this.filteredOptions);
+      const s = this.filteredOptions[this.#e];
+      s && !s.disabled ? this.focusedValue = s.value : this.focusedValue = undefined, this.multiple || (this.focusedValue !== undefined ? this.toggleSelected(this.focusedValue) : this.deselectAll());
+    }
+  }
+};
+
 class r extends V {
   get cursor() {
     return this.value ? 0 : 1;
@@ -18770,6 +19505,89 @@ var limitOptions = ({
       b.push(n);
   return u && b.push(C), b;
 };
+function P(t) {
+  return t.label ?? String(t.value ?? "");
+}
+function E(t, c) {
+  if (!t)
+    return true;
+  const n = (c.label ?? String(c.value ?? "")).toLowerCase(), i = (c.hint ?? "").toLowerCase(), l = String(c.value).toLowerCase(), o = t.toLowerCase();
+  return n.includes(o) || i.includes(o) || l.includes(o);
+}
+function N(t, c) {
+  const n = [];
+  for (const i of c)
+    t.includes(i.value) && n.push(i);
+  return n;
+}
+var autocomplete = (t) => new T$1({
+  options: t.options,
+  initialValue: t.initialValue ? [t.initialValue] : undefined,
+  initialUserInput: t.initialUserInput,
+  placeholder: t.placeholder,
+  filter: t.filter ?? ((n, i) => E(n, i)),
+  signal: t.signal,
+  input: t.input,
+  output: t.output,
+  validate: t.validate,
+  render() {
+    const n = t.withGuide ?? settings.withGuide, i = n ? [`${styleText2("gray", S_BAR)}`, `${symbol(this.state)}  ${t.message}`] : [`${symbol(this.state)}  ${t.message}`], l = this.userInput, o = this.options, m = t.placeholder, p = l === "" && m !== undefined, $ = (r, s) => {
+      const a = P(r), u = r.hint && r.value === this.focusedValue ? styleText2("dim", ` (${r.hint})`) : "";
+      switch (s) {
+        case "active":
+          return `${styleText2("green", S_RADIO_ACTIVE)} ${a}${u}`;
+        case "inactive":
+          return `${styleText2("dim", S_RADIO_INACTIVE)} ${styleText2("dim", a)}`;
+        case "disabled":
+          return `${styleText2("gray", S_RADIO_INACTIVE)} ${styleText2(["strikethrough", "gray"], a)}`;
+      }
+    };
+    switch (this.state) {
+      case "submit": {
+        const r = N(this.selectedValues, o), s = r.length > 0 ? `  ${styleText2("dim", r.map(P).join(", "))}` : "", a = n ? styleText2("gray", S_BAR) : "";
+        return `${i.join(`
+`)}
+${a}${s}`;
+      }
+      case "cancel": {
+        const r = l ? `  ${styleText2(["strikethrough", "dim"], l)}` : "", s = n ? styleText2("gray", S_BAR) : "";
+        return `${i.join(`
+`)}
+${s}${r}`;
+      }
+      default: {
+        const r = this.state === "error" ? "yellow" : "cyan", s = n ? `${styleText2(r, S_BAR)}  ` : "", a = n ? styleText2(r, S_BAR_END) : "";
+        let u = "";
+        if (this.isNavigating || p) {
+          const d = p ? m : l;
+          u = d !== "" ? ` ${styleText2("dim", d)}` : "";
+        } else
+          u = ` ${this.userInputWithCursor}`;
+        const V = this.filteredOptions.length !== o.length ? styleText2("dim", ` (${this.filteredOptions.length} match${this.filteredOptions.length === 1 ? "" : "es"})`) : "", y = this.filteredOptions.length === 0 && l ? [`${s}${styleText2("yellow", "No matches found")}`] : [], b = this.state === "error" ? [`${s}${styleText2("yellow", this.error)}`] : [];
+        n && i.push(`${s.trimEnd()}`), i.push(`${s}${styleText2("dim", "Search:")}${u}${V}`, ...y, ...b);
+        const v = [
+          `${styleText2("dim", "↑/↓")} to select`,
+          `${styleText2("dim", "Enter:")} confirm`,
+          `${styleText2("dim", "Type:")} to search`
+        ], g = [`${s}${v.join(" • ")}`, a], O = this.filteredOptions.length === 0 ? [] : limitOptions({
+          cursor: this.cursor,
+          options: this.filteredOptions,
+          columnPadding: n ? 3 : 0,
+          rowPadding: i.length + g.length,
+          style: (d, f) => $(d, d.disabled ? "disabled" : f ? "active" : "inactive"),
+          maxItems: t.maxItems,
+          output: t.output
+        });
+        return [
+          ...i,
+          ...O.map((d) => `${s}${d}`),
+          ...g
+        ].join(`
+`);
+      }
+    }
+  }
+}).prompt();
 var confirm = (i) => {
   const a = i.active ?? "Yes", s = i.inactive ?? "No";
   return new r({
@@ -19200,6 +20018,7 @@ function createStyledClack() {
     cancel,
     confirm,
     password,
+    autocomplete,
     select,
     isCancel,
     spinner,
@@ -19459,13 +20278,52 @@ function createPassword({
   };
 }
 
-// src/shell/ui/renderers/select.ts
-function createSelect({ mode, clack }) {
-  return async (message, options) => {
-    assertHumanMode(mode, "select");
-    const value = await clack.select({ message, options: [...options] });
-    if (clack.isCancel(value))
-      return { ok: false };
+// src/core/textSearch.ts
+function normalizeForSearch(value) {
+  return value.toLowerCase().replace(/[-_\s]+/g, " ").trim();
+}
+function matchesSearchTerm(search, fields) {
+  const needle = normalizeForSearch(search);
+  if (!needle)
+    return true;
+  return fields.some((field) => field !== undefined && normalizeForSearch(field).includes(needle));
+}
+function createSearchIndex(items, fieldsOf) {
+  const indexed = new Map;
+  for (const item of items) {
+    indexed.set(item, fieldsOf(item).flatMap((field) => field === undefined ? [] : [normalizeForSearch(field)]));
+  }
+  let lastSearch;
+  let needle = "";
+  return (search, item) => {
+    if (search !== lastSearch) {
+      lastSearch = search;
+      needle = normalizeForSearch(search);
+    }
+    if (!needle)
+      return true;
+    const fields = indexed.get(item);
+    return fields ? fields.some((field) => field.includes(needle)) : matchesSearchTerm(search, fieldsOf(item));
+  };
+}
+
+// src/shell/ui/renderers/select.ts
+var searchThreshold = 8;
+var searchPlaceholder = "Type to filter";
+function searchableFields(option) {
+  return [option.label, option.hint, option.value];
+}
+function createSelect({ mode, clack }) {
+  return async (message, options) => {
+    assertHumanMode(mode, "select");
+    const value = options.length > searchThreshold ? await clack.autocomplete({
+      message,
+      options: [...options],
+      placeholder: searchPlaceholder,
+      filter: createSearchIndex([...options], searchableFields)
+    }) : await clack.select({ message, options: [...options] });
+    if (clack.isCancel(value))
+      return { ok: false };
     return { ok: true, value };
   };
 }
@@ -19511,12 +20369,12 @@ function createVerboseContext(outputMode, isVerbose) {
 
 // src/shell/npmRegistry.ts
 var registryUrl = "https://registry.npmjs.org";
-var timeoutMs2 = 3000;
+var timeoutMs4 = 3000;
 async function fetchLatestVersion(packageName, deps = {}) {
   const fetchFn = deps.fetchFn ?? globalThis.fetch;
   try {
     const response = await fetchFn(`${registryUrl}/${packageName}/latest`, {
-      signal: AbortSignal.timeout(timeoutMs2)
+      signal: AbortSignal.timeout(timeoutMs4)
     });
     if (!response.ok)
       return;
@@ -19531,7 +20389,7 @@ async function fetchLatestVersion(packageName, deps = {}) {
 }
 
 // src/domains/updateCheck/updateCheck.ts
-import { join as join10 } from "node:path";
+import { join as join13 } from "node:path";
 
 // src/core/version.ts
 function parseRelease(version) {
@@ -19577,7 +20435,7 @@ function startUpdateCheck(deps) {
         return;
       if (!isNewerVersion(deps.currentVersion, latest))
         return;
-      const noticePath = join10(deps.configDir, noticeFile);
+      const noticePath = join13(deps.configDir, noticeFile);
       try {
         const notified = (await deps.fs.readFile(noticePath)).trim();
         if (notified === latest)
@@ -19599,7 +20457,7 @@ function startUpdateCheck(deps) {
 // package.json
 var package_default = {
   name: "@qawolf/cli",
-  version: "1.24.0",
+  version: "1.25.0",
   description: "Run and manage QA Wolf flows from the terminal, CI, or an AI agent",
   keywords: [
     "automation",
@@ -19789,7 +20647,12 @@ function withAuthContext(signals, fn, deps = {}) {
       await updateNotifier.notifyIfOutdated();
       return;
     }
-    const platformClient = (deps.createPlatform ?? createPlatformClient)(resolved.key, { baseUrl: apiBaseUrl, fetch: globalThis.fetch, logger: ctx.log("trpc") });
+    const platformClient = (deps.createPlatform ?? createPlatformClient)(resolved.key, {
+      baseUrl: apiBaseUrl,
+      fetch: globalThis.fetch,
+      logger: ctx.log("trpc"),
+      workspaceId: resolved.workspaceId
+    });
     try {
       const result = await fn({
         ...ctx,
@@ -19810,28 +20673,15 @@ function withAuthContext(signals, fn, deps = {}) {
   };
 }
 
-// src/commands/auth/login.ts
-async function handleLogin(ctx) {
-  if (ctx.ui.mode !== "human") {
-    ctx.ui.error(authMessages.login.nonInteractive);
-    return { error: "non-interactive" };
-  }
-  const existing = await resolveApiKey(ctx.configDir, ctx.fs);
-  if (existing) {
-    const reauth = await ctx.ui.confirm(authMessages.login.reAuthPrompt);
-    if (!reauth.ok || !reauth.value) {
-      ctx.ui.info(authMessages.alreadyConfigured);
-      return;
-    }
-  }
-  ctx.ui.gap();
-  ctx.ui.intro(authMessages.title);
+// src/commands/auth/loginApiKey.ts
+async function loginWithApiKey(ctx) {
   const result = await ctx.ui.password(authMessages.promptApiKey, "Set QAWOLF_API_KEY to authenticate in non-interactive environments.");
   if (!result.ok) {
     ctx.ui.cancel(authMessages.cancelled);
     return;
   }
-  if (!result.value.trim()) {
+  const apiKey = result.value.trim();
+  if (!apiKey) {
     ctx.ui.cancel(authMessages.cancelled);
     return;
   }
@@ -19840,7 +20690,7 @@ async function handleLogin(ctx) {
       message: authMessages.verifying,
       task: async () => {
         const v = await validateApiKey({
-          platformClient: createPlatformClient(result.value, {
+          platformClient: createPlatformClient(apiKey, {
             baseUrl: ctx.apiBaseUrl,
             fetch: globalThis.fetch
           })
@@ -19851,7 +20701,7 @@ async function handleLogin(ctx) {
     },
     {
       message: authMessages.storing,
-      task: async () => saveApiKey(ctx.configDir, result.value, ctx.fs)
+      task: async () => saveApiKey(ctx.configDir, apiKey, ctx.fs)
     }
   ], ([, saveResult]) => {
     return saveResult.stored === "file" ? authMessages.storedFile : authMessages.storedKeychain;
@@ -19859,14 +20709,632 @@ async function handleLogin(ctx) {
   ctx.ui.outro(authMessages.outroSuccess);
 }
 
+// src/core/deviceAuth/pollState.ts
+var slowDownIncrementMs = 5000;
+var unreachableBackoffFactor = 2;
+function capToLifetime(delayMs, state, nowMs) {
+  return Math.min(delayMs, Math.max(1, state.deadlineMs - nowMs));
+}
+function nextPollStep(state, response, nowMs) {
+  if (response.kind === "tokens") {
+    return { action: "done", tokens: response.tokens };
+  }
+  if (nowMs > state.deadlineMs) {
+    return { action: "fail", reason: "timeout", detail: undefined };
+  }
+  switch (response.kind) {
+    case "pending":
+      return {
+        action: "poll",
+        delayMs: capToLifetime(state.intervalMs, state, nowMs),
+        state
+      };
+    case "slow-down": {
+      const slowed = {
+        intervalMs: state.intervalMs + slowDownIncrementMs,
+        deadlineMs: state.deadlineMs
+      };
+      return {
+        action: "poll",
+        delayMs: capToLifetime(slowed.intervalMs, slowed, nowMs),
+        state: slowed
+      };
+    }
+    case "denied":
+      return { action: "fail", reason: "access-denied", detail: undefined };
+    case "expired":
+      return { action: "fail", reason: "expired", detail: undefined };
+    case "unreachable": {
+      const backedOff = {
+        intervalMs: state.intervalMs * unreachableBackoffFactor,
+        deadlineMs: state.deadlineMs
+      };
+      return {
+        action: "poll",
+        delayMs: capToLifetime(backedOff.intervalMs, backedOff, nowMs),
+        state: backedOff
+      };
+    }
+    case "error":
+      return { action: "fail", reason: "network", detail: response.detail };
+  }
+}
+
+// src/domains/auth/deviceLogin.ts
+var cancelled = {
+  ok: false,
+  reason: "cancelled",
+  detail: undefined
+};
+async function deviceLogin(deps) {
+  if (deps.isCancelled())
+    return cancelled;
+  const authorization = await deps.requestAuthorization();
+  if (!authorization.ok) {
+    return { ok: false, reason: "unavailable", detail: authorization.error };
+  }
+  await deps.onPrompt(authorization.value);
+  let state = {
+    intervalMs: authorization.value.intervalSec * 1000,
+    deadlineMs: deps.now() + authorization.value.expiresInSec * 1000
+  };
+  for (;; ) {
+    if (deps.isCancelled())
+      return cancelled;
+    const response = await deps.pollToken(authorization.value.deviceCode);
+    const step = nextPollStep(state, response, deps.now());
+    if (step.action === "done")
+      return { ok: true, tokens: step.tokens };
+    if (step.action === "fail") {
+      return { ok: false, reason: step.reason, detail: step.detail };
+    }
+    state = step.state;
+    await deps.sleep(step.delayMs);
+  }
+}
+
+// src/shell/openBrowser.ts
+var launchTimeoutMs = 2000;
+function launcher(url, platform) {
+  if (platform === "darwin")
+    return { cmd: "open", args: [url] };
+  if (platform === "win32") {
+    return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+  }
+  return { cmd: "xdg-open", args: [url] };
+}
+async function openBrowser(url, deps) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    return false;
+  }
+  const { cmd, args } = launcher(url, deps.platform);
+  const launched = deps.spawn(cmd, args, { platform: deps.platform }).then((result) => result.exitCode === 0).catch(() => false);
+  return Promise.race([launched, deps.sleep(launchTimeoutMs).then(() => true)]);
+}
+
+// src/shell/spawn.ts
+import { spawn } from "node:child_process";
+
+// src/core/cmdEscape.ts
+var metaChars = /([()\][%!^"`<>&|;, *?])/g;
+function escapeCommand(command) {
+  return command.replace(metaChars, "^$1");
+}
+function escapeArgument(arg) {
+  const escaped = arg.replace(/(?=(\\+?)?)\1"/g, "$1$1\\\"").replace(/(?=(\\+?)?)\1$/, "$1$1");
+  return `"${escaped}"`.replace(metaChars, "^$1").replace(metaChars, "^$1");
+}
+
+// src/shell/spawn.ts
+function buildSpawnCommand(cmd, args, platform, env) {
+  const options = {};
+  if (env)
+    options.env = env;
+  if (platform !== "win32" || !/\.(cmd|bat)$/i.test(cmd)) {
+    return { cmd, args, options };
+  }
+  const line = [escapeCommand(cmd), ...args.map(escapeArgument)].join(" ");
+  return {
+    cmd: process.env["ComSpec"] ?? "cmd.exe",
+    args: ["/d", "/s", "/c", `"${line}"`],
+    options: { ...options, windowsVerbatimArguments: true }
+  };
+}
+var defaultSpawn = (cmd, args, opts) => new Promise((resolve) => {
+  const env = opts.env ? { ...process.env, ...opts.env } : undefined;
+  const built = buildSpawnCommand(cmd, args, opts.platform, env);
+  const child = spawn(built.cmd, built.args, built.options);
+  let stdout = "";
+  let stderr = "";
+  child.stdout?.on("data", (chunk) => {
+    stdout += String(chunk);
+  });
+  child.stderr?.on("data", (chunk) => {
+    stderr += String(chunk);
+  });
+  if (opts?.stdin !== undefined) {
+    child.stdin?.write(opts.stdin);
+    child.stdin?.end();
+  }
+  child.on("error", (err) => resolve({ exitCode: -1, stdout, stderr: stderr || err.message }));
+  child.on("close", (code) => resolve({ exitCode: code ?? -1, stdout, stderr }));
+});
+
+// src/shell/platform/getAuthConfig.ts
+var timeoutMs5 = 1e4;
+var authConfigBody = object({
+  workOsClientId: string2().trim().min(1)
+});
+async function getAuthConfig(deps) {
+  let response;
+  try {
+    response = await deps.fetch(`${deps.baseUrl}/api/v0/auth/config`, {
+      signal: AbortSignal.timeout(timeoutMs5)
+    });
+  } catch (err) {
+    return { kind: "unreachable", detail: errorMessage(err) };
+  }
+  if (response.status === 404)
+    return { kind: "unconfigured" };
+  if (!response.ok) {
+    return { kind: "unreachable", detail: `HTTP ${response.status}` };
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch (err) {
+    return { kind: "unreachable", detail: errorMessage(err) };
+  }
+  const parsed = authConfigBody.safeParse(json);
+  return parsed.success ? { kind: "configured", clientId: parsed.data.workOsClientId } : { kind: "unconfigured" };
+}
+
+// src/shell/workos/pollDeviceToken.ts
+var deviceCodeGrantType = "urn:ietf:params:oauth:grant-type:device_code";
+async function pollDeviceToken(deviceCode, deps) {
+  const outcome = await sendWorkosRequest(`${deps.baseUrl}/user_management/authenticate`, {
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: deviceCodeGrantType,
+      device_code: deviceCode,
+      client_id: deps.clientId
+    }).toString()
+  }, deps.fetch);
+  if (outcome.kind === "failure") {
+    return outcome.retryable ? { kind: "unreachable", detail: outcome.detail } : { kind: "error", detail: outcome.detail };
+  }
+  if (outcome.kind === "oauth-error") {
+    switch (outcome.code) {
+      case "authorization_pending":
+        return { kind: "pending" };
+      case "slow_down":
+        return { kind: "slow-down" };
+      case "access_denied":
+        return { kind: "denied" };
+      case "expired_token":
+      case "invalid_grant":
+        return { kind: "expired" };
+      default:
+        return {
+          kind: "error",
+          detail: outcome.description ?? outcome.code
+        };
+    }
+  }
+  const parsed = deviceTokenBody.safeParse(outcome.json);
+  if (!parsed.success) {
+    return { kind: "error", detail: unexpectedResponse };
+  }
+  return {
+    kind: "tokens",
+    tokens: {
+      accessToken: parsed.data.access_token,
+      refreshToken: parsed.data.refresh_token,
+      expiresAt: readAccessTokenExpiry(parsed.data.access_token),
+      email: parsed.data.user.email,
+      organizationId: parsed.data.organization_id
+    }
+  };
+}
+
+// src/shell/workos/requestDeviceAuthorization.ts
+async function requestDeviceAuthorization(deps) {
+  const outcome = await sendWorkosRequest(`${deps.baseUrl}/user_management/authorize/device`, {
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: deps.clientId }).toString()
+  }, deps.fetch);
+  if (outcome.kind === "failure") {
+    return { ok: false, error: outcome.detail, retryable: outcome.retryable };
+  }
+  if (outcome.kind === "oauth-error") {
+    return {
+      ok: false,
+      error: outcome.description ?? outcome.code,
+      retryable: false
+    };
+  }
+  const parsed = deviceAuthorizationBody.safeParse(outcome.json);
+  if (!parsed.success) {
+    return { ok: false, error: unexpectedResponse, retryable: false };
+  }
+  return {
+    ok: true,
+    value: {
+      deviceCode: parsed.data.device_code,
+      userCode: parsed.data.user_code,
+      verificationUri: parsed.data.verification_uri,
+      verificationUriComplete: parsed.data.verification_uri_complete,
+      expiresInSec: parsed.data.expires_in,
+      intervalSec: parsed.data.interval ?? defaultIntervalSec
+    }
+  };
+}
+
+// src/domains/auth/nameMatching.ts
+function matches(candidate, wanted) {
+  return candidate.toLowerCase() === wanted.trim().toLowerCase();
+}
+function findOrganization(organizations, wanted) {
+  return organizations.find((organization) => matches(organization.name, wanted) || matches(organization.id, wanted) || matches(organization.workOsOrganizationId, wanted));
+}
+function findWorkspace(workspaces, wanted) {
+  return workspaces.find((workspace) => matches(workspace.name, wanted) || matches(workspace.id, wanted) || workspace.slug !== undefined && matches(workspace.slug, wanted));
+}
+function findWorkspaceAcross(organizations, wanted) {
+  const hits = organizations.flatMap((organization) => {
+    const workspace = findWorkspace(organization.workspaces, wanted);
+    return workspace ? [{ organization, workspace }] : [];
+  });
+  const [only] = hits;
+  if (!only)
+    return { kind: "none" };
+  if (hits.length > 1) {
+    return {
+      kind: "ambiguous",
+      organizations: hits.map((h) => h.organization)
+    };
+  }
+  return {
+    kind: "found",
+    organization: only.organization,
+    workspace: only.workspace
+  };
+}
+function nameList(items) {
+  return items.map((item) => item.slug ?? item.name).join(", ");
+}
+
+// src/domains/auth/selectWorkspace.ts
+async function selectWorkspace(deps) {
+  const { organizations } = deps;
+  if (organizations.length === 0)
+    return { outcome: "none" };
+  let organization;
+  if (deps.preferredOrganization) {
+    organization = findOrganization(organizations, deps.preferredOrganization);
+    if (!organization) {
+      return {
+        outcome: "failed",
+        error: `No organization matches '${deps.preferredOrganization}'. Available: ${nameList(organizations)}.`
+      };
+    }
+  } else if (organizations.length === 1) {
+    organization = organizations[0];
+  } else if (deps.preferredWorkspace) {
+    const match = findWorkspaceAcross(organizations, deps.preferredWorkspace);
+    if (match.kind === "none") {
+      return {
+        outcome: "failed",
+        error: `No workspace matches '${deps.preferredWorkspace}'. Available: ${nameList(organizations.flatMap((o) => o.workspaces))}.`
+      };
+    }
+    if (match.kind === "ambiguous") {
+      return {
+        outcome: "failed",
+        error: `More than one organization has a workspace matching '${deps.preferredWorkspace}': ${nameList(match.organizations)}. Set QAWOLF_ORGANIZATION to choose between them.`
+      };
+    }
+    organization = match.organization;
+  } else {
+    organization = await deps.chooseOrganization(organizations);
+    if (!organization)
+      return { outcome: "cancelled" };
+  }
+  if (!organization)
+    throw Error("organization was not settled");
+  const { workspaces } = organization;
+  if (workspaces.length === 0) {
+    return {
+      outcome: "failed",
+      error: `Organization '${organization.name}' has no workspaces.`
+    };
+  }
+  let workspace;
+  if (deps.preferredWorkspace) {
+    workspace = findWorkspace(workspaces, deps.preferredWorkspace);
+    if (!workspace) {
+      return {
+        outcome: "failed",
+        error: `No workspace matches '${deps.preferredWorkspace}' in ${organization.name}. Available: ${nameList(workspaces)}.`
+      };
+    }
+  } else if (workspaces.length === 1) {
+    workspace = workspaces[0];
+  } else {
+    workspace = await deps.chooseWorkspace(workspaces);
+    if (!workspace)
+      return { outcome: "cancelled" };
+  }
+  if (!workspace)
+    throw Error("workspace was not settled");
+  try {
+    await deps.saveWorkspace(workspace.id);
+  } catch (err) {
+    return {
+      outcome: "failed",
+      error: authMessages.workspace.saveFailed(errorMessage(err))
+    };
+  }
+  return { outcome: "selected", organization, workspace };
+}
+
+// src/domains/auth/store/saveWorkspaceId.ts
+import { Entry as Entry6 } from "@napi-rs/keyring";
+function makeSaveWorkspaceIdDeps(configDir, fs) {
+  return {
+    loadTokens: () => loadTokens(configDir, { EntryClass: Entry6, fs }),
+    saveTokens: (session) => saveTokens(configDir, session, fs)
+  };
+}
+async function saveWorkspaceId(session, workspaceId, deps) {
+  const current = await deps.loadTokens();
+  if (!current.found || !isSameSession(current.tokens, session)) {
+    throw Error(authMessages.workspace.sessionChanged);
+  }
+  return deps.saveTokens({ ...current.tokens, workspaceId });
+}
+function isSameSession(stored, captured) {
+  return stored.email === captured.email && stored.organizationId === captured.organizationId;
+}
+
+// src/commands/auth/chooseWorkspace.ts
+async function chooseWorkspace(ctx, args) {
+  const client = createPlatformClient(args.session.accessToken, {
+    baseUrl: ctx.apiBaseUrl,
+    fetch: globalThis.fetch,
+    logger: ctx.log("trpc")
+  });
+  const [identity, discovered] = await Promise.all([
+    client.getIdentity(),
+    client.getAccessibleOrganizations()
+  ]);
+  let organizations;
+  if (discovered.ok) {
+    organizations = discovered.value;
+  } else if (identity.ok) {
+    organizations = "user" in identity.value ? identity.value.organizations : [];
+  } else {
+    return { outcome: "failed", error: identity.error };
+  }
+  return selectWorkspace({
+    organizations,
+    preferredOrganization: args.env["QAWOLF_ORGANIZATION"]?.trim(),
+    preferredWorkspace: args.env["QAWOLF_WORKSPACE"]?.trim(),
+    chooseOrganization: async (organizations) => {
+      if (ctx.ui.mode !== "human")
+        return;
+      const picked = await ctx.ui.select(authMessages.workspace.chooseOrganization, organizations.map((organization) => ({
+        value: organization.workOsOrganizationId,
+        label: organization.name,
+        hint: authMessages.workspace.workspaceCount(organization.workspaces.length)
+      })));
+      if (!picked.ok)
+        return;
+      return organizations.find((organization) => organization.workOsOrganizationId === picked.value);
+    },
+    chooseWorkspace: async (workspaces) => {
+      if (ctx.ui.mode !== "human")
+        return;
+      const picked = await ctx.ui.select(authMessages.workspace.choose, workspaces.map((workspace) => ({
+        value: workspace.id,
+        label: workspace.name,
+        ...workspace.slug ? { hint: workspace.slug } : {}
+      })));
+      if (!picked.ok)
+        return;
+      return workspaces.find((workspace) => workspace.id === picked.value);
+    },
+    saveWorkspace: (workspaceId) => saveWorkspaceId(args.session, workspaceId, makeSaveWorkspaceIdDeps(ctx.configDir, ctx.fs))
+  });
+}
+function reportWorkspace(ctx, result) {
+  switch (result.outcome) {
+    case "selected":
+      ctx.ui.info(authMessages.workspace.working(result.organization.name, result.workspace.name));
+      return;
+    case "none":
+      ctx.ui.info(authMessages.workspace.none);
+      return;
+    case "cancelled":
+      if (ctx.ui.mode !== "human") {
+        return { error: authMessages.workspace.nonInteractive };
+      }
+      ctx.ui.info(authMessages.workspace.cancelled);
+      return;
+    case "failed":
+      return { error: result.error };
+  }
+}
+
+// src/commands/auth/loginDevice.ts
+async function loginWithDevice(ctx, deps = {}) {
+  const authConfig = await getAuthConfig({
+    baseUrl: ctx.apiBaseUrl,
+    fetch: globalThis.fetch
+  });
+  if (authConfig.kind === "unreachable") {
+    ctx.log("auth").debug(`auth config unreachable: ${authConfig.detail}`);
+    return {
+      error: authMessages.device.configUnreachable,
+      errorBody: authConfig.detail
+    };
+  }
+  const config = resolveWorkosConfig(authConfig.kind === "configured" ? authConfig.clientId : undefined);
+  if (!config.configured) {
+    return { error: authMessages.device.unavailable };
+  }
+  const workos = {
+    fetch: globalThis.fetch,
+    baseUrl: config.baseUrl,
+    clientId: config.clientId
+  };
+  let cancelled = false;
+  const unregister = ctx.signals.register(() => {
+    cancelled = true;
+  });
+  const showCode = async (authorization) => {
+    const url = authorization.verificationUriComplete ?? authorization.verificationUri;
+    ctx.ui.note([
+      authMessages.device.confirmCode(authorization.userCode),
+      authMessages.device.visitUrl(url),
+      url === authorization.verificationUri ? undefined : authMessages.device.visitUrlPlain(authorization.verificationUri)
+    ].filter((line) => Boolean(line)).join(`
+`), authMessages.title);
+    const opened = await openBrowser(url, {
+      sleep,
+      spawn: defaultSpawn,
+      platform: deps.platform ?? process.platform
+    });
+    if (!opened)
+      ctx.ui.info(authMessages.device.openFailed(url));
+    ctx.ui.step(authMessages.device.waiting);
+  };
+  try {
+    const result = await deviceLogin({
+      requestAuthorization: () => requestDeviceAuthorization(workos),
+      pollToken: (deviceCode) => pollDeviceToken(deviceCode, workos),
+      onPrompt: showCode,
+      sleep,
+      now: () => Date.now(),
+      isCancelled: () => cancelled
+    });
+    if (!result.ok) {
+      return {
+        error: authMessages.device.failed[result.reason],
+        ...result.detail ? { errorBody: result.detail } : {}
+      };
+    }
+    const session = {
+      ...result.tokens,
+      workspaceId: undefined,
+      clientId: config.clientId
+    };
+    await saveTokens(ctx.configDir, session, ctx.fs);
+    const workspace = await chooseWorkspace(ctx, {
+      session,
+      env: deps.env ?? process.env
+    });
+    const failure = reportWorkspace(ctx, workspace);
+    if (failure)
+      return failure;
+    ctx.ui.outro(authMessages.device.signedIn(result.tokens.email));
+    return;
+  } finally {
+    unregister();
+  }
+}
+
+// src/commands/auth/login.ts
+var browserMethod = "browser";
+async function handleLogin(ctx, deps = {}) {
+  if (ctx.ui.mode !== "human") {
+    ctx.ui.error(authMessages.login.nonInteractive);
+    return { error: "non-interactive" };
+  }
+  const resolveApiKey2 = deps.resolveApiKey ?? resolveApiKey;
+  const existing = await resolveApiKey2(ctx.configDir, ctx.fs);
+  if (existing) {
+    const reauth = await ctx.ui.confirm(authMessages.login.reAuthPrompt);
+    if (!reauth.ok || !reauth.value) {
+      ctx.ui.info(authMessages.alreadyConfigured);
+      return;
+    }
+  }
+  ctx.ui.gap();
+  ctx.ui.intro(authMessages.title);
+  const method = await ctx.ui.select(authMessages.login.chooseMethod, [
+    {
+      value: browserMethod,
+      label: authMessages.login.methodBrowser,
+      hint: authMessages.login.methodBrowserHint
+    },
+    {
+      value: "api-key",
+      label: authMessages.login.methodApiKey,
+      hint: authMessages.login.methodApiKeyHint
+    }
+  ]);
+  if (!method.ok) {
+    ctx.ui.cancel(authMessages.cancelled);
+    return;
+  }
+  if (method.value !== browserMethod) {
+    return (deps.loginWithApiKey ?? loginWithApiKey)(ctx);
+  }
+  if (existing && existing.source !== "browser") {
+    ctx.ui.warn(existing.source === "env" ? authMessages.login.apiKeyPrecedence.env : authMessages.login.apiKeyPrecedence.stored);
+  }
+  return (deps.loginWithDevice ?? loginWithDevice)(ctx);
+}
+
+// src/domains/auth/store/deleteTokens.ts
+import { join as join14 } from "node:path";
+import { Entry as Entry7 } from "@napi-rs/keyring";
+function deleteFromKeychain2() {
+  try {
+    new Entry7(service, tokensAccount).deletePassword();
+    return "deleted";
+  } catch {
+    return "unavailable";
+  }
+}
+async function deleteFromFile2(configDir, fs) {
+  try {
+    await fs.unlink(join14(configDir, tokensFile));
+    return "deleted";
+  } catch (err) {
+    if (isNoEntError(err))
+      return "not-found";
+    throw err;
+  }
+}
+async function deleteTokens(configDir, fs) {
+  const [keychain, file] = await Promise.all([
+    Promise.resolve(deleteFromKeychain2()),
+    deleteFromFile2(configDir, fs)
+  ]);
+  return { keychain, file };
+}
+
 // src/commands/auth/logout.ts
-async function handleLogout(ctx) {
-  const resolved = await resolveApiKey(ctx.configDir, ctx.fs);
-  if (!resolved) {
+async function handleLogout(ctx, deps = {}) {
+  const hasStoredCredentials2 = deps.hasStoredCredentials ?? hasStoredCredentials;
+  const deleteApiKey2 = deps.deleteApiKey ?? deleteApiKey;
+  const deleteTokens2 = deps.deleteTokens ?? deleteTokens;
+  const env = deps.env ?? process.env;
+  const envKey = env["QAWOLF_API_KEY"]?.trim();
+  const stored = await hasStoredCredentials2(ctx.configDir, ctx.fs);
+  if (!envKey && !stored) {
     ctx.ui.info(authMessages.logout.notAuthenticated);
     return;
   }
-  if (resolved.source === "env") {
+  if (envKey) {
     ctx.ui.warn(authMessages.logout.envVarWarning);
   }
   if (ctx.ui.mode === "human") {
@@ -19881,7 +21349,12 @@ async function handleLogout(ctx) {
   await ctx.ui.withProgress([
     {
       message: authMessages.logout.deleting,
-      task: () => deleteApiKey(ctx.configDir, ctx.fs)
+      task: async () => {
+        await Promise.all([
+          deleteApiKey2(ctx.configDir, ctx.fs),
+          deleteTokens2(ctx.configDir, ctx.fs)
+        ]);
+      }
     }
   ], () => authMessages.logout.credentialsRemoved);
   if (ctx.ui.mode === "human") {
@@ -19891,6 +21364,76 @@ async function handleLogout(ctx) {
   }
 }
 
+// src/domains/auth/refreshStoredSession.ts
+import { Entry as Entry8 } from "@napi-rs/keyring";
+function makeDefaultDeps2(fs) {
+  return {
+    loadTokens: (configDir) => loadTokens(configDir, { EntryClass: Entry8, fs }),
+    resolveOauth: (configDir) => resolveOauthToken(configDir, makeOauthDeps(fs))
+  };
+}
+async function refreshStoredSession(configDir, fs, deps) {
+  const resolvedDeps = deps ?? makeDefaultDeps2(fs);
+  const before = await resolvedDeps.loadTokens(configDir);
+  if (!before.found)
+    return { kind: "not-signed-in" };
+  const renewed = await resolvedDeps.resolveOauth(configDir);
+  if (!renewed)
+    return { kind: "refresh-failed" };
+  const after = await resolvedDeps.loadTokens(configDir);
+  if (!after.found)
+    return { kind: "refresh-failed" };
+  if (after.tokens.accessToken !== renewed.key) {
+    return { kind: "refresh-failed" };
+  }
+  return { kind: "session", session: after.tokens };
+}
+
+// src/commands/auth/switchWorkspace.ts
+async function handleSwitchWorkspace(ctx, deps = {}) {
+  const env = deps.env ?? process.env;
+  const refreshStoredSession2 = deps.refreshStoredSession ?? refreshStoredSession;
+  const preferred = env["QAWOLF_WORKSPACE"]?.trim() || env["QAWOLF_ORGANIZATION"]?.trim();
+  if (ctx.ui.mode !== "human" && !preferred) {
+    return { error: authMessages.workspace.nonInteractive };
+  }
+  const stored = await refreshStoredSession2(ctx.configDir, ctx.fs);
+  if (stored.kind === "not-signed-in") {
+    return { error: authMessages.workspace.notSignedIn };
+  }
+  if (stored.kind === "refresh-failed") {
+    return { error: authMessages.workspace.sessionExpired };
+  }
+  ctx.ui.gap();
+  ctx.ui.intro(authMessages.title);
+  const result = await chooseWorkspace(ctx, {
+    session: stored.session,
+    env
+  });
+  const failure = reportWorkspace(ctx, result);
+  if (failure)
+    return failure;
+  ctx.ui.outro(authMessages.outroReady);
+  return;
+}
+
+// src/commands/auth/whoamiTeam.ts
+function reportTeamIdentity(ctx, value, source) {
+  const { team } = value;
+  const teamUrl = team.slug ? new URL("/" + encodeURIComponent(team.slug), ctx.apiBaseUrl).toString() : undefined;
+  if (ctx.ui.mode === "human") {
+    ctx.ui.note(authMessages.whoami.teamNote({ team, teamUrl, source }), authMessages.whoamiAuthenticated);
+    ctx.ui.outro(authMessages.outroReady);
+  } else {
+    ctx.ui.output({
+      authenticated: true,
+      source,
+      team,
+      teamUrl
+    }, authMessages.whoami.authenticatedAs(team.name, source));
+  }
+}
+
 // src/commands/auth/whoami.ts
 async function handleWhoami(ctx, deps = {}) {
   ctx.ui.gap();
@@ -19932,11 +21475,19 @@ async function handleWhoami(ctx, deps = {}) {
   const { value } = identity;
   if ("user" in value) {
     const { organization, user } = value;
+    const found = value.organizations.flatMap((candidate) => candidate.workspaces.map((workspace) => ({
+      organization: candidate.name,
+      workspace: workspace.name,
+      id: workspace.id
+    }))).find((entry) => entry.id === resolved.workspaceId);
+    const activeWorkspace = resolved.workspaceId ? authMessages.whoami.activeWorkspace(resolved.workspaceId, found) : undefined;
     if (ctx.ui.mode === "human") {
       ctx.ui.note(authMessages.whoami.userNote({
         organization,
         source: resolved.source,
-        user
+        user,
+        activeWorkspace,
+        organizations: value.organizations
       }), authMessages.whoamiAuthenticated);
       ctx.ui.outro(authMessages.outroReady);
     } else {
@@ -19944,7 +21495,9 @@ async function handleWhoami(ctx, deps = {}) {
         authenticated: true,
         organization,
         source: resolved.source,
-        user
+        user,
+        workspaceId: resolved.workspaceId,
+        organizations: value.organizations
       }, authMessages.whoami.authenticatedAs(user.email, resolved.source));
     }
     return;
@@ -19966,26 +21519,15 @@ async function handleWhoami(ctx, deps = {}) {
     }
     return;
   }
-  const { team } = value;
-  const teamUrl = team.slug ? new URL("/" + encodeURIComponent(team.slug), ctx.apiBaseUrl).toString() : undefined;
-  if (ctx.ui.mode === "human") {
-    ctx.ui.note(authMessages.whoami.teamNote({ team, teamUrl, source: resolved.source }), authMessages.whoamiAuthenticated);
-    ctx.ui.outro(authMessages.outroReady);
-  } else {
-    ctx.ui.output({
-      authenticated: true,
-      source: resolved.source,
-      team,
-      teamUrl
-    }, authMessages.whoami.authenticatedAs(team.name, resolved.source));
-  }
+  reportTeamIdentity(ctx, value, resolved.source);
 }
 
 // src/commands/auth/index.ts
 function registerAuthCommand(program, signals) {
   const auth = program.command("auth").description("Manage authentication with QA Wolf");
-  declareCommandKind(auth.command("login"), "local").description("Authenticate with your QA Wolf API key").action(withContext(signals, handleLogin));
+  declareCommandKind(auth.command("login"), "local").description("Authenticate with QA Wolf in a browser or with an API key").action(withContext(signals, handleLogin));
   declareCommandKind(auth.command("logout"), "local").description("Remove stored credentials").action(withContext(signals, handleLogout));
+  declareCommandKind(auth.command("switch"), "local").description("Choose which workspace to work in").action(withContext(signals, handleSwitchWorkspace));
   declareCommandKind(auth.command("whoami"), "read").description("Show authentication status").action(withContext(signals, handleWhoami));
 }
 
@@ -20035,11 +21577,11 @@ async function* batchMap(items, fn, size) {
 }
 
 // src/core/nodeModulesBins.ts
-import { join as join11 } from "node:path";
+import { join as join15 } from "node:path";
 function nodeModulesBinCandidates(envDir, name, platform) {
-  const binDir = join11(envDir, "node_modules", ".bin");
+  const binDir = join15(envDir, "node_modules", ".bin");
   const names = platform === "win32" ? [`${name}.cmd`, `${name}.exe`] : [name];
-  return names.map((shim) => join11(binDir, shim));
+  return names.map((shim) => join15(binDir, shim));
 }
 function appiumCliCandidates(envDir, platform) {
   return nodeModulesBinCandidates(envDir, "appium", platform);
@@ -20096,21 +21638,21 @@ async function checkUiautomator2(spawn, appiumBin, platform) {
 }
 
 // src/core/androidBins.ts
-import { join as join12 } from "node:path";
+import { join as join16 } from "node:path";
 function withExeSuffix(name, platform) {
   return platform === "win32" ? `${name}.exe` : name;
 }
 function emulatorBin(home, platform) {
   const name = withExeSuffix("emulator", platform);
-  return home ? join12(home, "emulator", name) : name;
+  return home ? join16(home, "emulator", name) : name;
 }
 function adbBin(home, platform) {
   const name = withExeSuffix("adb", platform);
-  return home ? join12(home, "platform-tools", name) : name;
+  return home ? join16(home, "platform-tools", name) : name;
 }
 function cmdlineToolsBin(home, name, platform) {
   const file = platform === "win32" ? `${name}.bat` : name;
-  return join12(home, "cmdline-tools", "latest", "bin", file);
+  return join16(home, "cmdline-tools", "latest", "bin", file);
 }
 function sdkManagerBin(home, platform) {
   return cmdlineToolsBin(home, "sdkmanager", platform);
@@ -20407,9 +21949,9 @@ async function checkNpmRegistry(deps) {
 }
 
 // src/core/playwrightCli.ts
-import { join as join13 } from "node:path";
+import { join as join17 } from "node:path";
 function playwrightCliJsPath(envDir) {
-  return join13(envDir, "node_modules", "playwright", "cli.js");
+  return join17(envDir, "node_modules", "playwright", "cli.js");
 }
 function playwrightCliInvocation(args) {
   return {
@@ -20559,11 +22101,11 @@ function renderResults(ui, results) {
 }
 
 // src/domains/flows/ensureDeps.ts
-import { dirname as dirname4, join as join14 } from "node:path";
+import { dirname as dirname4, join as join18 } from "node:path";
 function findEnvDir(flowPath, fs) {
   let dir = dirname4(flowPath);
   while (true) {
-    if (fs.existsSync(join14(dir, "package.json")))
+    if (fs.existsSync(join18(dir, "package.json")))
       return dir;
     const parent = dirname4(dir);
     if (parent === dir)
@@ -20589,7 +22131,7 @@ function resolveProjectDirSafe(files, fs) {
 }
 
 // src/domains/flows/expand.ts
-import { join as join15, resolve as resolve3 } from "node:path";
+import { join as join19, resolve as resolve3 } from "node:path";
 
 // node_modules/tinyglobby/dist/index.mjs
 import { readdir, readdirSync, realpath, realpathSync, stat, statSync } from "fs";
@@ -21578,11 +23120,11 @@ function makePeekFlowMeta(fs) {
   };
 }
 async function resolveGlobRoots(cwd, fs) {
-  const qawolfPath = join15(cwd, ".qawolf");
+  const qawolfPath = join19(cwd, ".qawolf");
   let envDirs = [];
   try {
     const entries = await fs.readdirWithTypes(qawolfPath);
-    envDirs = entries.filter((e) => e.isDirectory()).map((e) => join15(qawolfPath, e.name));
+    envDirs = entries.filter((e) => e.isDirectory()).map((e) => join19(qawolfPath, e.name));
   } catch {}
   return [cwd, ...envDirs];
 }
@@ -21608,11 +23150,11 @@ async function expandPatterns(patterns, cwd, logger, fs) {
 }
 
 // src/domains/runtimeEnv/clearRuntimeEnv.ts
-import { join as join17 } from "node:path";
+import { join as join21 } from "node:path";
 
 // src/domains/runtimeEnv/managedEnvDir.ts
 import { createHash } from "node:crypto";
-import { join as join16, resolve as resolve4 } from "node:path";
+import { join as join20, resolve as resolve4 } from "node:path";
 
 // src/domains/runtimeEnv/pinnedPackages.ts
 var pinnedPackages = [
@@ -21643,19 +23185,19 @@ function managedEnvBaseDir() {
   const override = process.env["QAWOLF_RUNTIME_DIR"]?.trim();
   if (override)
     return resolve4(override);
-  return join16(getDataDir(), "runtime");
+  return join20(getDataDir(), "runtime");
 }
 function runStagingRoot() {
   return `${managedEnvBaseDir()}-runs`;
 }
 function managedEnvDir() {
-  return join16(managedEnvBaseDir(), managedEnvHash());
+  return join20(managedEnvBaseDir(), managedEnvHash());
 }
 async function scaffoldManagedEnv(dir, fs) {
   await fs.mkdir(dir, { recursive: true });
   const dependencies = Object.fromEntries(pinnedPackages.map(({ name, version }) => [name, version]));
-  await fs.writeFile(join16(dir, "package.json"), JSON.stringify({ name: "qawolf-runtime", private: true, dependencies }, undefined, 2));
-  await fs.writeFile(join16(dir, ".npmrc"), `@qawolf:registry=https://registry.npmjs.org/
+  await fs.writeFile(join20(dir, "package.json"), JSON.stringify({ name: "qawolf-runtime", private: true, dependencies }, undefined, 2));
+  await fs.writeFile(join20(dir, ".npmrc"), `@qawolf:registry=https://registry.npmjs.org/
 `);
 }
 
@@ -21677,67 +23219,19 @@ async function isManagedRuntimeBase(dir, fs) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       return false;
-    if (!await hasRuntimeSentinel(join17(dir, entry.name), fs))
+    if (!await hasRuntimeSentinel(join21(dir, entry.name), fs))
       return false;
   }
   return true;
 }
 async function hasRuntimeSentinel(hashDir, fs) {
   try {
-    const pkg = JSON.parse(await fs.readFile(join17(hashDir, "package.json")));
+    const pkg = JSON.parse(await fs.readFile(join21(hashDir, "package.json")));
     return pkg.name === runtimeSentinel;
   } catch {
     return false;
   }
 }
-// src/shell/spawn.ts
-import { spawn } from "node:child_process";
-
-// src/core/cmdEscape.ts
-var metaChars = /([()\][%!^"`<>&|;, *?])/g;
-function escapeCommand(command) {
-  return command.replace(metaChars, "^$1");
-}
-function escapeArgument(arg) {
-  const escaped = arg.replace(/(?=(\\+?)?)\1"/g, "$1$1\\\"").replace(/(?=(\\+?)?)\1$/, "$1$1");
-  return `"${escaped}"`.replace(metaChars, "^$1").replace(metaChars, "^$1");
-}
-
-// src/shell/spawn.ts
-function buildSpawnCommand(cmd, args, platform, env) {
-  const options = {};
-  if (env)
-    options.env = env;
-  if (platform !== "win32" || !/\.(cmd|bat)$/i.test(cmd)) {
-    return { cmd, args, options };
-  }
-  const line = [escapeCommand(cmd), ...args.map(escapeArgument)].join(" ");
-  return {
-    cmd: process.env["ComSpec"] ?? "cmd.exe",
-    args: ["/d", "/s", "/c", `"${line}"`],
-    options: { ...options, windowsVerbatimArguments: true }
-  };
-}
-var defaultSpawn = (cmd, args, opts) => new Promise((resolve) => {
-  const env = opts.env ? { ...process.env, ...opts.env } : undefined;
-  const built = buildSpawnCommand(cmd, args, opts.platform, env);
-  const child = spawn(built.cmd, built.args, built.options);
-  let stdout = "";
-  let stderr = "";
-  child.stdout?.on("data", (chunk) => {
-    stdout += String(chunk);
-  });
-  child.stderr?.on("data", (chunk) => {
-    stderr += String(chunk);
-  });
-  if (opts?.stdin !== undefined) {
-    child.stdin?.write(opts.stdin);
-    child.stdin?.end();
-  }
-  child.on("error", (err) => resolve({ exitCode: -1, stdout, stderr: stderr || err.message }));
-  child.on("close", (code) => resolve({ exitCode: code ?? -1, stdout, stderr }));
-});
-
 // src/domains/runtimeEnv/npmInstall.ts
 function buildNpmInstallSpawn(cwd, platform) {
   const built = buildSpawnCommand(resolveNpmCommand(platform), ["install", "--legacy-peer-deps"], platform, undefined);
@@ -21758,10 +23252,10 @@ function spawnNpmInstall(cwd, spawn2 = spawn) {
 }
 
 // src/domains/runtimeEnv/resolvePinned.ts
-import { join as join18 } from "node:path";
+import { join as join22 } from "node:path";
 function readInstalledVersion(dir, pkgName, fs) {
   try {
-    const pkgPath = join18(dir, "node_modules", ...pkgName.split("/"), "package.json");
+    const pkgPath = join22(dir, "node_modules", ...pkgName.split("/"), "package.json");
     const raw = JSON.parse(fs.readFileSync(pkgPath));
     const { version } = raw;
     return typeof version === "string" ? version : undefined;
@@ -21809,10 +23303,10 @@ function allPinnedResolved(dir, fs, platform) {
 }
 
 // src/domains/runtimeEnv/shimDeps.ts
-import { join as join20 } from "node:path";
+import { join as join24 } from "node:path";
 
 // src/shell/resolveExport.ts
-import { join as join19 } from "node:path";
+import { join as join23 } from "node:path";
 function pickPath(entry, preference) {
   if (typeof entry === "string")
     return entry;
@@ -21844,28 +23338,28 @@ function resolveFromEnvDir(envDir, specifier, preference = "esm", fs = makeDefau
   const pkgName = parts.slice(0, pkgPartCount).join("/");
   const rest = parts.slice(pkgPartCount);
   const subpath = rest.length > 0 ? "./" + rest.join("/") : ".";
-  const pkgDir = join19(envDir, "node_modules", ...pkgName.split("/"));
+  const pkgDir = join23(envDir, "node_modules", ...pkgName.split("/"));
   let pkg;
   try {
-    pkg = JSON.parse(fs.readFileSync(join19(pkgDir, "package.json")));
+    pkg = JSON.parse(fs.readFileSync(join23(pkgDir, "package.json")));
   } catch (err) {
     if (isNoEntError(err))
-      throw new Error(`Package '${pkgName}' not found in ${join19(envDir, "node_modules")}`, { cause: err });
+      throw new Error(`Package '${pkgName}' not found in ${join23(envDir, "node_modules")}`, { cause: err });
     throw err;
   }
   const exportsMap = normalizeExports(pkg.exports);
   const entry = exportsMap?.[subpath];
   const relative = pickPath(entry, preference) ?? (subpath === "." ? pkg.module ?? pkg.main : undefined);
   if (!relative) {
-    throw new Error(`No entry for "${subpath}" in exports of ${join19(pkgDir, "package.json")}`);
+    throw new Error(`No entry for "${subpath}" in exports of ${join23(pkgDir, "package.json")}`);
   }
-  return join19(pkgDir, relative);
+  return join23(pkgDir, relative);
 }
 
 // src/domains/runtimeEnv/shimDeps.ts
 function readShimMarker(shimDir, fs) {
   try {
-    const pkg = JSON.parse(fs.readFileSync(join20(shimDir, "package.json")));
+    const pkg = JSON.parse(fs.readFileSync(join24(shimDir, "package.json")));
     if (pkg._qawolf_format) {
       return {
         _qawolf_version: pkg._qawolf_version ?? "",
@@ -21881,11 +23375,11 @@ function resolveBunBuild(bunBuild) {
   return bunBuild === false ? undefined : { build: bunBuild };
 }
 async function removeStaleShims(flowsDir, flowsDeps, fs) {
-  const shimsDir = join20(flowsDir, "node_modules");
+  const shimsDir = join24(flowsDir, "node_modules");
   if (!fs.existsSync(shimsDir))
     return;
   for (const dep of flowsDeps) {
-    const shimDepDir = join20(shimsDir, ...dep.split("/"));
+    const shimDepDir = join24(shimsDir, ...dep.split("/"));
     if (readShimMarker(shimDepDir, fs)) {
       await fs.rm(shimDepDir, { recursive: true, force: true });
     }
@@ -21894,17 +23388,17 @@ async function removeStaleShims(flowsDir, flowsDeps, fs) {
 async function buildDepShim(args) {
   const { envDir, flowsDir, dep, fs, build } = args;
   const depParts = dep.split("/");
-  const depDir = join20(envDir, "node_modules", ...depParts);
+  const depDir = join24(envDir, "node_modules", ...depParts);
   if (!fs.existsSync(depDir))
     return;
   let depVersion;
   try {
-    const pkg = JSON.parse(fs.readFileSync(join20(depDir, "package.json")));
+    const pkg = JSON.parse(fs.readFileSync(join24(depDir, "package.json")));
     depVersion = pkg.version ?? "unknown";
   } catch {
     depVersion = "unknown";
   }
-  const shimDir = join20(flowsDir, "node_modules", ...depParts);
+  const shimDir = join24(flowsDir, "node_modules", ...depParts);
   if (fs.existsSync(shimDir)) {
     const marker = readShimMarker(shimDir, fs);
     if (!marker)
@@ -21931,20 +23425,20 @@ async function buildDepShim(args) {
   }
   const shimCode = await output.text();
   await fs.mkdir(shimDir, { recursive: true });
-  await fs.writeFile(join20(shimDir, "package.json"), JSON.stringify({
+  await fs.writeFile(join24(shimDir, "package.json"), JSON.stringify({
     name: dep,
     _qawolf_version: depVersion,
     _qawolf_format: "bun-build-v1"
   }));
-  await fs.writeFile(join20(shimDir, "index.js"), shimCode);
+  await fs.writeFile(join24(shimDir, "index.js"), shimCode);
 }
 async function shimFlowsDeps(envDir, fs = makeDefaultFs(), bunBuild) {
-  const flowsDir = join20(envDir, "node_modules", "@qawolf", "flows");
+  const flowsDir = join24(envDir, "node_modules", "@qawolf", "flows");
   if (!fs.existsSync(flowsDir))
     return;
   let flowsDeps;
   try {
-    const flowsPkg = JSON.parse(fs.readFileSync(join20(flowsDir, "package.json")));
+    const flowsPkg = JSON.parse(fs.readFileSync(join24(flowsDir, "package.json")));
     flowsDeps = Object.keys(flowsPkg.dependencies ?? {});
   } catch {
     return;
@@ -22125,11 +23619,11 @@ function collectValue(value, previous) {
 }
 
 // src/shell/manifest/pulledEnv.ts
-import { join as join22 } from "node:path";
+import { join as join26 } from "node:path";
 
 // src/shell/manifest/io.ts
 import { createHash as createHash2 } from "node:crypto";
-import { join as join21 } from "node:path";
+import { join as join25 } from "node:path";
 var manifestFilename = ".manifest.json";
 var flowEntrySchema = object({
   path: string2(),
@@ -22151,7 +23645,7 @@ var manifestSchema = object({
 async function readManifest(envDir, fs = makeDefaultFs()) {
   let raw;
   try {
-    raw = await fs.readFile(join21(envDir, manifestFilename));
+    raw = await fs.readFile(join25(envDir, manifestFilename));
   } catch (err) {
     if (isNoEntError(err))
       return "missing";
@@ -22185,7 +23679,7 @@ async function readManifest(envDir, fs = makeDefaultFs()) {
 }
 async function writeManifest(envDir, manifest, fs = makeDefaultFs()) {
   const body = JSON.stringify(manifest, undefined, 2);
-  await fs.writeFile(join21(envDir, manifestFilename), `${body}
+  await fs.writeFile(join25(envDir, manifestFilename), `${body}
 `);
 }
 function hashFile(absPath, fs = makeDefaultFs()) {
@@ -22211,7 +23705,7 @@ async function findPulledEnv(ref, cwd, fs = makeDefaultFs()) {
   return;
 }
 async function listPulledEnvDirs(cwd, fs = makeDefaultFs()) {
-  const root = join22(cwd, ".qawolf");
+  const root = join26(cwd, ".qawolf");
   let entries;
   try {
     entries = await fs.readdirWithTypes(root);
@@ -22224,7 +23718,7 @@ async function listPulledEnvDirs(cwd, fs = makeDefaultFs()) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const envDir = join22(root, entry.name);
+    const envDir = join26(root, entry.name);
     const manifest = await readManifest(envDir, fs);
     if (typeof manifest === "string")
       continue;
@@ -22278,9 +23772,6 @@ async function readEnvLabels(files, readEnvLabel) {
 }
 
 // src/core/suggestNearMiss.ts
-function normalize3(value) {
-  return value.toLowerCase().replace(/[-_\s]+/g, " ").trim();
-}
 function editDistance(a, b) {
   let row = Array.from({ length: b.length + 1 }, (_, j) => j);
   for (let i = 1;i <= a.length; i += 1) {
@@ -22302,14 +23793,14 @@ function suggestNearMiss(input, candidates) {
   if (candidates.includes(input))
     return;
   const sorted = [...candidates].sort();
-  const normalizedInput = normalize3(input);
-  const presentationMatch = sorted.find((candidate) => normalize3(candidate) === normalizedInput);
+  const normalizedInput = normalizeForSearch(input);
+  const presentationMatch = sorted.find((candidate) => normalizeForSearch(candidate) === normalizedInput);
   if (presentationMatch !== undefined)
     return presentationMatch;
   let best;
   let bestDistance = Number.POSITIVE_INFINITY;
   for (const candidate of sorted) {
-    const distance = editDistance(normalizedInput, normalize3(candidate));
+    const distance = editDistance(normalizedInput, normalizeForSearch(candidate));
     if (distance < bestDistance) {
       bestDistance = distance;
       best = candidate;
@@ -22619,7 +24110,7 @@ async function flowsListRemote(ctx, pattern, options) {
 }
 
 // src/domains/flows/pull/handler.ts
-import { dirname as dirname8, join as join27, resolve as resolve8 } from "node:path";
+import { dirname as dirname8, join as join31, resolve as resolve8 } from "node:path";
 
 // src/domains/flows/pull/fetchPhase.ts
 async function fetchTags(ctx, envId) {
@@ -22763,7 +24254,7 @@ async function checkSafety(args) {
 }
 
 // src/domains/flows/pull/reportPull.ts
-import { join as join23 } from "node:path";
+import { join as join27 } from "node:path";
 function reportPullResult(ui, args) {
   if (ui.mode !== "json")
     return;
@@ -22778,12 +24269,12 @@ function reportPullResult(ui, args) {
     assetDownloadedCount: args.assets.downloadedCount,
     assetReusedCount: args.assets.reusedCount,
     assetSkippedCount: args.assets.skippedCount,
-    manifestPath: join23(args.stage.envDir, manifestFilename)
+    manifestPath: join27(args.stage.envDir, manifestFilename)
   }, "");
 }
 
 // src/domains/flows/pull/bundle.ts
-import { join as join24, relative as relative6 } from "node:path";
+import { join as join28, relative as relative6 } from "node:path";
 async function flattenSingleWrapper(dir, fs = makeDefaultFs()) {
   const entries = await fs.readdir(dir);
   if (entries.length !== 1)
@@ -22791,12 +24282,12 @@ async function flattenSingleWrapper(dir, fs = makeDefaultFs()) {
   const innerName = entries[0];
   if (!innerName)
     return;
-  const inner = join24(dir, innerName);
+  const inner = join28(dir, innerName);
   const innerStat = await fs.stat(inner);
   if (!innerStat.isDirectory())
     return;
   for (const e of await fs.readdir(inner)) {
-    await fs.rename(join24(inner, e), join24(dir, e));
+    await fs.rename(join28(inner, e), join28(dir, e));
   }
   const leftovers = await fs.readdir(inner);
   if (leftovers.length > 0) {
@@ -22815,7 +24306,7 @@ async function buildManifest(args, fs = makeDefaultFs()) {
   const flowPaths = await walkForFlows(args.bundleDir, fs);
   const flows = await Promise.all(flowPaths.map(async (rel) => ({
     path: toPosix(rel),
-    contentHash: await hashFile(join24(args.bundleDir, rel), fs),
+    contentHash: await hashFile(join28(args.bundleDir, rel), fs),
     tags: args.tags?.byPath.get(toPosix(rel))
   })));
   return {
@@ -22839,7 +24330,7 @@ async function walkForFlows(root, fs) {
 async function walk(current, root, out, fs) {
   const entries = await fs.readdirWithTypes(current);
   for (const e of entries) {
-    const abs = join24(current, e.name);
+    const abs = join28(current, e.name);
     if (e.isDirectory()) {
       await walk(abs, root, out, fs);
     } else if (e.isFile() && flowExtensions.some((ext) => e.name.endsWith(ext))) {
@@ -22852,11 +24343,11 @@ async function sampleQawolfCommittedAt(bundleDir, fs = makeDefaultFs()) {
   const sample = flowPaths[0];
   if (!sample)
     return;
-  return (await fs.stat(join24(bundleDir, sample))).mtime.toISOString();
+  return (await fs.stat(join28(bundleDir, sample))).mtime.toISOString();
 }
 
 // src/domains/flows/pull/applyTeamStorageRewrite.ts
-import { join as join25, relative as relative7 } from "node:path";
+import { join as join29, relative as relative7 } from "node:path";
 
 // src/domains/flows/pull/rewriteTeamStorage.ts
 var runnerMountPrefix = "/home/wolf/team-storage/";
@@ -22892,7 +24383,7 @@ function isFlowFile(name) {
 async function walk2(dir, out, fs) {
   const entries = await fs.readdirWithTypes(dir);
   for (const e of entries) {
-    const abs = join25(dir, e.name);
+    const abs = join29(dir, e.name);
     if (e.isDirectory()) {
       await walk2(abs, out, fs);
     } else if (e.isFile() && isSourceFile(e.name)) {
@@ -22920,7 +24411,7 @@ async function applyTeamStorageRewrite(rootDir, fs = makeDefaultFs()) {
 }
 
 // src/domains/flows/pull/envVars.ts
-import { join as join26 } from "node:path";
+import { join as join30 } from "node:path";
 
 // src/core/dotenv.ts
 var bareKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -22985,7 +24476,7 @@ function unquote(escaped) {
 async function writeEnvFile(envDir, vars, fs = makeDefaultFs()) {
   if (Object.keys(vars).length === 0)
     return;
-  await fs.writeFile(join26(envDir, ".env"), serializeDotenv(vars), {
+  await fs.writeFile(join30(envDir, ".env"), serializeDotenv(vars), {
     mode: 384
   });
 }
@@ -23049,11 +24540,11 @@ var Ae = Symbol("flush");
 var As = Symbol("flushChunk");
 var z = Symbol("encoding");
 var Mt = Symbol("decoder");
-var g = Symbol("flowing");
+var g2 = Symbol("flowing");
 var Qt = Symbol("paused");
 var Bt = Symbol("resume");
 var b = Symbol("buffer");
-var N = Symbol("pipes");
+var N2 = Symbol("pipes");
 var _ = Symbol("bufferLength");
 var bi = Symbol("bufferPush");
 var Ie = Symbol("bufferShift");
@@ -23101,9 +24592,9 @@ var Li = class extends Fe {
 var Xr = (s) => !!s.objectMode;
 var qr = (s) => !s.objectMode && !!s.encoding && s.encoding !== "buffer";
 var A2 = class extends Di {
-  [g] = false;
+  [g2] = false;
   [Qt] = false;
-  [N] = [];
+  [N2] = [];
   [b] = [];
   [L];
   [z];
@@ -23126,7 +24617,7 @@ var A2 = class extends Di {
     let e = t[0] || {};
     if (super(), e.objectMode && typeof e.encoding == "string")
       throw new TypeError("Encoding and objectMode may not be used together");
-    Xr(e) ? (this[L] = true, this[z] = null) : qr(e) ? (this[z] = e.encoding, this[L] = false) : (this[L] = false, this[z] = null), this[Z] = !!e.async, this[Mt] = this[z] ? new Hr(this[z]) : null, e && e.debugExposeBuffer === true && Object.defineProperty(this, "buffer", { get: () => this[b] }), e && e.debugExposePipes === true && Object.defineProperty(this, "pipes", { get: () => this[N] });
+    Xr(e) ? (this[L] = true, this[z] = null) : qr(e) ? (this[z] = e.encoding, this[L] = false) : (this[L] = false, this[z] = null), this[Z] = !!e.async, this[Mt] = this[z] ? new Hr(this[z]) : null, e && e.debugExposeBuffer === true && Object.defineProperty(this, "buffer", { get: () => this[b] }), e && e.debugExposePipes === true && Object.defineProperty(this, "pipes", { get: () => this[N2] });
     let { signal: i } = e;
     i && (this[Jt] = i, i.aborted ? this[xi]() : i.addEventListener("abort", () => this[xi]()));
   }
@@ -23178,7 +24669,7 @@ var A2 = class extends Di {
       else if (typeof t != "string")
         throw new Error("Non-contiguous data written to non-objectMode stream");
     }
-    return this[L] ? (this[g] && this[_] !== 0 && this[Ae](true), this[g] ? this.emit("data", t) : this[bi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g]) : t.length ? (typeof t == "string" && !(e === this[z] && !this[Mt]?.lastNeed) && (t = Buffer.from(t, e)), Buffer.isBuffer(t) && this[z] && (t = this[Mt].write(t)), this[g] && this[_] !== 0 && this[Ae](true), this[g] ? this.emit("data", t) : this[bi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g]) : (this[_] !== 0 && this.emit("readable"), i && r(i), this[g]);
+    return this[L] ? (this[g2] && this[_] !== 0 && this[Ae](true), this[g2] ? this.emit("data", t) : this[bi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g2]) : t.length ? (typeof t == "string" && !(e === this[z] && !this[Mt]?.lastNeed) && (t = Buffer.from(t, e)), Buffer.isBuffer(t) && this[z] && (t = this[Mt].write(t)), this[g2] && this[_] !== 0 && this[Ae](true), this[g2] ? this.emit("data", t) : this[bi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g2]) : (this[_] !== 0 && this.emit("readable"), i && r(i), this[g2]);
   }
   read(t) {
     if (this[S])
@@ -23199,22 +24690,22 @@ var A2 = class extends Di {
     return this.emit("data", e), !this[b].length && !this[Q] && this.emit("drain"), e;
   }
   end(t, e, i) {
-    return typeof t == "function" && (i = t, t = undefined), typeof e == "function" && (i = e, e = "utf8"), t !== undefined && this.write(t, e), i && this.once("end", i), this[Q] = true, this.writable = false, (this[g] || !this[Qt]) && this[J](), this;
+    return typeof t == "function" && (i = t, t = undefined), typeof e == "function" && (i = e, e = "utf8"), t !== undefined && this.write(t, e), i && this.once("end", i), this[Q] = true, this.writable = false, (this[g2] || !this[Qt]) && this[J](), this;
   }
   [Bt]() {
-    this[S] || (!this[Rt] && !this[N].length && (this[C2] = true), this[Qt] = false, this[g] = true, this.emit("resume"), this[b].length ? this[Ae]() : this[Q] ? this[J]() : this.emit("drain"));
+    this[S] || (!this[Rt] && !this[N2].length && (this[C2] = true), this[Qt] = false, this[g2] = true, this.emit("resume"), this[b].length ? this[Ae]() : this[Q] ? this[J]() : this.emit("drain"));
   }
   resume() {
     return this[Bt]();
   }
   pause() {
-    this[g] = false, this[Qt] = true, this[C2] = false;
+    this[g2] = false, this[Qt] = true, this[C2] = false;
   }
   get destroyed() {
     return this[S];
   }
   get flowing() {
-    return this[g];
+    return this[g2];
   }
   get paused() {
     return this[Qt];
@@ -23232,18 +24723,18 @@ var A2 = class extends Di {
     !t && !this[b].length && !this[Q] && this.emit("drain");
   }
   [As](t) {
-    return this.emit("data", t), this[g];
+    return this.emit("data", t), this[g2];
   }
   pipe(t, e) {
     if (this[S])
       return t;
     this[C2] = false;
     let i = this[nt];
-    return e = e || {}, t === Ds.stdout || t === Ds.stderr ? e.end = false : e.end = e.end !== false, e.proxyErrors = !!e.proxyErrors, i ? e.end && t.end() : (this[N].push(e.proxyErrors ? new Li(this, t, e) : new Fe(this, t, e)), this[Z] ? jt(() => this[Bt]()) : this[Bt]()), t;
+    return e = e || {}, t === Ds.stdout || t === Ds.stderr ? e.end = false : e.end = e.end !== false, e.proxyErrors = !!e.proxyErrors, i ? e.end && t.end() : (this[N2].push(e.proxyErrors ? new Li(this, t, e) : new Fe(this, t, e)), this[Z] ? jt(() => this[Bt]()) : this[Bt]()), t;
   }
   unpipe(t) {
-    let e = this[N].find((i) => i.dest === t);
-    e && (this[N].length === 1 ? (this[g] && this[Rt] === 0 && (this[g] = false), this[N] = []) : this[N].splice(this[N].indexOf(e), 1), e.unpipe());
+    let e = this[N2].find((i) => i.dest === t);
+    e && (this[N2].length === 1 ? (this[g2] && this[Rt] === 0 && (this[g2] = false), this[N2] = []) : this[N2].splice(this[N2].indexOf(e), 1), e.unpipe());
   }
   addListener(t, e) {
     return this.on(t, e);
@@ -23251,7 +24742,7 @@ var A2 = class extends Di {
   on(t, e) {
     let i = super.on(t, e);
     if (t === "data")
-      this[C2] = false, this[Rt]++, !this[N].length && !this[g] && this[Bt]();
+      this[C2] = false, this[Rt]++, !this[N2].length && !this[g2] && this[Bt]();
     else if (t === "readable" && this[_] !== 0)
       super.emit("readable");
     else if (Kr(t) && this[nt])
@@ -23267,11 +24758,11 @@ var A2 = class extends Di {
   }
   off(t, e) {
     let i = super.off(t, e);
-    return t === "data" && (this[Rt] = this.listeners("data").length, this[Rt] === 0 && !this[C2] && !this[N].length && (this[g] = false)), i;
+    return t === "data" && (this[Rt] = this.listeners("data").length, this[Rt] === 0 && !this[C2] && !this[N2].length && (this[g2] = false)), i;
   }
   removeAllListeners(t) {
     let e = super.removeAllListeners(t);
-    return (t === "data" || t === undefined) && (this[Rt] = 0, !this[C2] && !this[N].length && (this[g] = false)), e;
+    return (t === "data" || t === undefined) && (this[Rt] = 0, !this[C2] && !this[N2].length && (this[g2] = false)), e;
   }
   get emittedEnd() {
     return this[nt];
@@ -23307,7 +24798,7 @@ var A2 = class extends Di {
     return this[J](), r;
   }
   [Oi](t) {
-    for (let i of this[N])
+    for (let i of this[N2])
       i.dest.write(t) === false && this.pause();
     let e = this[C2] ? false : super.emit("data", t);
     return this[J](), e;
@@ -23319,12 +24810,12 @@ var A2 = class extends Di {
     if (this[Mt]) {
       let e = this[Mt].end();
       if (e) {
-        for (let i of this[N])
+        for (let i of this[N2])
           i.dest.write(e);
         this[C2] || super.emit("data", e);
       }
     }
-    for (let e of this[N])
+    for (let e of this[N2])
       e.end();
     let t = super.emit("end");
     return this.removeAllListeners("end"), t;
@@ -23400,7 +24891,7 @@ var Jr = I.writev;
 var ht = Symbol("_autoClose");
 var H = Symbol("_close");
 var te = Symbol("_ended");
-var m2 = Symbol("_fd");
+var m3 = Symbol("_fd");
 var Ni = Symbol("_finished");
 var tt = Symbol("_flags");
 var Ai = Symbol("_flush");
@@ -23427,7 +24918,7 @@ var Me = Symbol("_defaultFlag");
 var bt = Symbol("_errored");
 var _t = class extends A2 {
   [bt] = false;
-  [m2];
+  [m3];
   [U2];
   [Ci];
   [j] = false;
@@ -23437,10 +24928,10 @@ var _t = class extends A2 {
   constructor(t, e) {
     if (e = e || {}, super(e), this.readable = true, this.writable = false, typeof t != "string")
       throw new TypeError("path must be a string");
-    this[bt] = false, this[m2] = typeof e.fd == "number" ? e.fd : undefined, this[U2] = t, this[Ci] = e.readSize || 16 * 1024 * 1024, this[j] = false, this[Fi] = typeof e.size == "number" ? e.size : 1 / 0, this[ee] = this[Fi], this[ht] = typeof e.autoClose == "boolean" ? e.autoClose : true, typeof this[m2] == "number" ? this[zt]() : this[at]();
+    this[bt] = false, this[m3] = typeof e.fd == "number" ? e.fd : undefined, this[U2] = t, this[Ci] = e.readSize || 16 * 1024 * 1024, this[j] = false, this[Fi] = typeof e.size == "number" ? e.size : 1 / 0, this[ee] = this[Fi], this[ht] = typeof e.autoClose == "boolean" ? e.autoClose : true, typeof this[m3] == "number" ? this[zt]() : this[at]();
   }
   get fd() {
-    return this[m2];
+    return this[m3];
   }
   get path() {
     return this[U2];
@@ -23455,7 +24946,7 @@ var _t = class extends A2 {
     I.open(this[U2], "r", (t, e) => this[Ht](t, e));
   }
   [Ht](t, e) {
-    t ? this[Ut](t) : (this[m2] = e, this.emit("open", e), this[zt]());
+    t ? this[Ut](t) : (this[m3] = e, this.emit("open", e), this[zt]());
   }
   [vi]() {
     return Buffer.allocUnsafe(Math.min(this[Ci], this[ee]));
@@ -23466,16 +24957,16 @@ var _t = class extends A2 {
       let t = this[vi]();
       if (t.length === 0)
         return process.nextTick(() => this[Ii](null, 0, t));
-      I.read(this[m2], t, 0, t.length, null, (e, i, r) => this[Ii](e, i, r));
+      I.read(this[m3], t, 0, t.length, null, (e, i, r) => this[Ii](e, i, r));
     }
   }
   [Ii](t, e, i) {
     this[j] = false, t ? this[Ut](t) : this[ki](e, i) && this[zt]();
   }
   [H]() {
-    if (this[ht] && typeof this[m2] == "number") {
-      let t = this[m2];
-      this[m2] = undefined, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
+    if (this[ht] && typeof this[m3] == "number") {
+      let t = this[m3];
+      this[m3] = undefined, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
     }
   }
   [Ut](t) {
@@ -23491,7 +24982,7 @@ var _t = class extends A2 {
       case "finish":
         return false;
       case "drain":
-        return typeof this[m2] == "number" && this[zt](), false;
+        return typeof this[m3] == "number" && this[zt](), false;
       case "error":
         return this[bt] ? false : (this[bt] = true, super.emit(t, ...e));
       default:
@@ -23514,7 +25005,7 @@ var Be = class extends _t {
       if (!this[j]) {
         this[j] = true;
         do {
-          let e = this[vi](), i = e.length === 0 ? 0 : I.readSync(this[m2], e, 0, e.length, null);
+          let e = this[vi](), i = e.length === 0 ? 0 : I.readSync(this[m3], e, 0, e.length, null);
           if (!this[ki](i, e))
             break;
         } while (true);
@@ -23526,9 +25017,9 @@ var Be = class extends _t {
     }
   }
   [H]() {
-    if (this[ht] && typeof this[m2] == "number") {
-      let t = this[m2];
-      this[m2] = undefined, I.closeSync(t), this.emit("close");
+    if (this[ht] && typeof this[m3] == "number") {
+      let t = this[m3];
+      this[m3] = undefined, I.closeSync(t), this.emit("close");
     }
   }
 };
@@ -23543,15 +25034,15 @@ var et = class extends Qr {
   [U2];
   [ie];
   [ht];
-  [m2];
+  [m3];
   [Me];
   [tt];
   [Ni] = false;
   [ot];
   constructor(t, e) {
-    e = e || {}, super(e), this[U2] = t, this[m2] = typeof e.fd == "number" ? e.fd : undefined, this[ie] = e.mode === undefined ? 438 : e.mode, this[ot] = typeof e.start == "number" ? e.start : undefined, this[ht] = typeof e.autoClose == "boolean" ? e.autoClose : true;
+    e = e || {}, super(e), this[U2] = t, this[m3] = typeof e.fd == "number" ? e.fd : undefined, this[ie] = e.mode === undefined ? 438 : e.mode, this[ot] = typeof e.start == "number" ? e.start : undefined, this[ht] = typeof e.autoClose == "boolean" ? e.autoClose : true;
     let i = this[ot] !== undefined ? "r+" : "w";
-    this[Me] = e.flags === undefined, this[tt] = e.flags === undefined ? i : e.flags, this[m2] === undefined && this[at]();
+    this[Me] = e.flags === undefined, this[tt] = e.flags === undefined ? i : e.flags, this[m3] === undefined && this[at]();
   }
   emit(t, ...e) {
     if (t === "error") {
@@ -23562,7 +25053,7 @@ var et = class extends Qr {
     return super.emit(t, ...e);
   }
   get fd() {
-    return this[m2];
+    return this[m3];
   }
   get path() {
     return this[U2];
@@ -23574,16 +25065,16 @@ var et = class extends Qr {
     I.open(this[U2], this[tt], this[ie], (t, e) => this[Ht](t, e));
   }
   [Ht](t, e) {
-    this[Me] && this[tt] === "r+" && t && t.code === "ENOENT" ? (this[tt] = "w", this[at]()) : t ? this[Ut](t) : (this[m2] = e, this.emit("open", e), this[gt] || this[Ai]());
+    this[Me] && this[tt] === "r+" && t && t.code === "ENOENT" ? (this[tt] = "w", this[at]()) : t ? this[Ut](t) : (this[m3] = e, this.emit("open", e), this[gt] || this[Ai]());
   }
   end(t, e) {
-    return t && this.write(t, e), this[te] = true, !this[gt] && !this[Y].length && typeof this[m2] == "number" && this[Pt](null, 0), this;
+    return t && this.write(t, e), this[te] = true, !this[gt] && !this[Y].length && typeof this[m3] == "number" && this[Pt](null, 0), this;
   }
   write(t, e) {
-    return typeof t == "string" && (t = Buffer.from(t, e)), this[te] ? (this.emit("error", new Error("write() after end()")), false) : this[m2] === undefined || this[gt] || this[Y].length ? (this[Y].push(t), this[ke] = true, false) : (this[gt] = true, this[ve](t), true);
+    return typeof t == "string" && (t = Buffer.from(t, e)), this[te] ? (this.emit("error", new Error("write() after end()")), false) : this[m3] === undefined || this[gt] || this[Y].length ? (this[Y].push(t), this[ke] = true, false) : (this[gt] = true, this[ve](t), true);
   }
   [ve](t) {
-    I.write(this[m2], t, 0, t.length, this[ot], (e, i) => this[Pt](e, i));
+    I.write(this[m3], t, 0, t.length, this[ot], (e, i) => this[Pt](e, i));
   }
   [Pt](t, e) {
     t ? this[Ut](t) : (this[ot] !== undefined && typeof e == "number" && (this[ot] += e), this[Y].length ? this[Ai]() : (this[gt] = false, this[te] && !this[Ni] ? (this[Ni] = true, this[H](), this.emit("finish")) : this[ke] && (this[ke] = false, this.emit("drain"))));
@@ -23595,13 +25086,13 @@ var et = class extends Qr {
       this[ve](this[Y].pop());
     else {
       let t = this[Y];
-      this[Y] = [], Jr(this[m2], t, this[ot], (e, i) => this[Pt](e, i));
+      this[Y] = [], Jr(this[m3], t, this[ot], (e, i) => this[Pt](e, i));
     }
   }
   [H]() {
-    if (this[ht] && typeof this[m2] == "number") {
-      let t = this[m2];
-      this[m2] = undefined, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
+    if (this[ht] && typeof this[m3] == "number") {
+      let t = this[m3];
+      this[m3] = undefined, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
     }
   }
 };
@@ -23621,15 +25112,15 @@ var Wt = class extends et {
     this[Ht](null, t);
   }
   [H]() {
-    if (this[ht] && typeof this[m2] == "number") {
-      let t = this[m2];
-      this[m2] = undefined, I.closeSync(t), this.emit("close");
+    if (this[ht] && typeof this[m3] == "number") {
+      let t = this[m3];
+      this[m3] = undefined, I.closeSync(t), this.emit("close");
     }
   }
   [ve](t) {
     let e = true;
     try {
-      this[Pt](null, I.writeSync(this[m2], t, 0, t.length, this[ot])), e = false;
+      this[Pt](null, I.writeSync(this[m3], t, 0, t.length, this[ot])), e = false;
     } finally {
       if (e)
         try {
@@ -25607,7 +27098,7 @@ var Dr = Symbol("onEntry");
 var _s = Symbol("checkFs");
 var Nr = Symbol("checkFs2");
 var Os = Symbol("isReusable");
-var P = Symbol("makeFs");
+var P2 = Symbol("makeFs");
 var Ts = Symbol("file");
 var xs = Symbol("directory");
 var gi = Symbol("link");
@@ -25895,23 +27386,23 @@ var Xt = class extends rt {
           return;
         }
         if (h || this[Os](t, a))
-          return this[P](null, t, i);
+          return this[P2](null, t, i);
         if (a.isDirectory()) {
           if (t.type === "Directory") {
-            let l = this.chmod && t.mode && (a.mode & 4095) !== t.mode, c = (d) => this[P](d ?? null, t, i);
+            let l = this.chmod && t.mode && (a.mode & 4095) !== t.mode, c = (d) => this[P2](d ?? null, t, i);
             return l ? u3.chmod(String(t.absolute), Number(t.mode), c) : c();
           }
           if (t.absolute !== this.cwd)
-            return u3.rmdir(String(t.absolute), (l) => this[P](l ?? null, t, i));
+            return u3.rmdir(String(t.absolute), (l) => this[P2](l ?? null, t, i));
         }
         if (t.absolute === this.cwd)
-          return this[P](null, t, i);
-        mo(String(t.absolute), (l) => this[P](l ?? null, t, i));
+          return this[P2](null, t, i);
+        mo(String(t.absolute), (l) => this[P2](l ?? null, t, i));
       });
     };
     this[Oe] ? n() : r();
   }
-  [P](t, e, i) {
+  [P2](t, e, i) {
     if (t) {
       this[O](t, e), i();
       return;
@@ -25945,8 +27436,8 @@ var ye = (s) => {
 };
 var xe = class extends Xt {
   sync = true;
-  [P](t, e) {
-    return super[P](t, e, () => {});
+  [P2](t, e) {
+    return super[P2](t, e, () => {});
   }
   [_s](t) {
     if (!this[Oe]) {
@@ -25967,19 +27458,19 @@ var xe = class extends Xt {
     if (i && (this.keep || this.newer && i.mtime > (t.mtime ?? i.mtime)))
       return this[Ls](t);
     if (e || this[Os](t, i))
-      return this[P](null, t);
+      return this[P2](null, t);
     if (i.isDirectory()) {
       if (t.type === "Directory") {
         let o = this.chmod && t.mode && (i.mode & 4095) !== t.mode, [h] = o ? ye(() => {
           u3.chmodSync(String(t.absolute), Number(t.mode));
         }) : [];
-        return this[P](h, t);
+        return this[P2](h, t);
       }
       let [n] = ye(() => u3.rmdirSync(String(t.absolute)));
-      this[P](n, t);
+      this[P2](n, t);
     }
     let [r] = t.absolute === this.cwd ? [] : ye(() => po(String(t.absolute)));
-    this[P](r, t);
+    this[P2](r, t);
   }
   [Ts](t, e) {
     let i = typeof t.mode == "number" ? t.mode & 4095 : this.fmode, r = (h) => {
@@ -26427,8 +27918,8 @@ async function handleFlowsPull(ctx, opts, deps) {
     ctx.ui.error(validation.error);
     return { error: validation.error };
   }
-  const destAbs = resolve8(opts.out ?? join27(".qawolf", opts.env));
-  const assetsAbs = join27(dirname8(destAbs), "assets");
+  const destAbs = resolve8(opts.out ?? join31(".qawolf", opts.env));
+  const assetsAbs = join31(dirname8(destAbs), "assets");
   await resolvedDeps.fs.mkdir(assetsAbs, { recursive: true });
   const yes = opts.yes ?? false;
   let archive;
@@ -27303,15 +28794,15 @@ async function defaultRunWebFlowDeps(envDir = process.cwd(), signals) {
 
 // src/domains/runtimeEnv/prepareRunDir.ts
 import { createHash as createHash4 } from "node:crypto";
-import { join as join35, resolve as resolve9 } from "node:path";
+import { join as join39, resolve as resolve9 } from "node:path";
 
 // src/domains/runtimeEnv/execSubpathImports.ts
-import { join as join28 } from "node:path";
+import { join as join32 } from "node:path";
 var flowSubpathImports = { "#playwright": "playwright" };
 var packageJsonSchema = looseObject({ imports: record(string2(), unknown()).catch({}) }).catch({ imports: {} });
 async function writeExecSubpathImports(args) {
   const { execDir, fs } = args;
-  const pkgPath = join28(execDir, "package.json");
+  const pkgPath = join32(execDir, "package.json");
   const pkg = packageJsonSchema.parse(await readPackageJson(pkgPath, fs));
   const merged = { ...pkg, imports: { ...pkg.imports, ...flowSubpathImports } };
   await fs.writeFile(pkgPath, JSON.stringify(merged, undefined, 2));
@@ -27333,10 +28824,10 @@ async function readPackageJson(pkgPath, fs) {
 }
 
 // src/domains/runtimeEnv/innerHop.ts
-import { join as join30 } from "node:path";
+import { join as join34 } from "node:path";
 
 // src/domains/runtimeEnv/linkPinnedPackages.ts
-import { dirname as dirname9, join as join29 } from "node:path";
+import { dirname as dirname9, join as join33 } from "node:path";
 
 // src/domains/runtimeEnv/symlinkDir.ts
 import { symlink } from "node:fs/promises";
@@ -27348,16 +28839,16 @@ async function createDirSymlink(source, target) {
 // src/domains/runtimeEnv/linkPinnedPackages.ts
 async function linkPinnedPackages(args) {
   const { depsRoot, nodeModulesDir, fs } = args;
-  const managedModules = join29(depsRoot, "node_modules");
+  const managedModules = join33(depsRoot, "node_modules");
   await fs.mkdir(nodeModulesDir, { recursive: true });
   for (const { name } of pinnedPackages) {
     const segments = name.split("/");
-    const target = join29(nodeModulesDir, ...segments);
+    const target = join33(nodeModulesDir, ...segments);
     if (segments.length > 1) {
       await fs.mkdir(dirname9(target), { recursive: true });
     }
     await fs.rm(target, { recursive: true, force: true });
-    await createDirSymlink(join29(managedModules, ...segments), target);
+    await createDirSymlink(join33(managedModules, ...segments), target);
   }
 }
 
@@ -27366,18 +28857,18 @@ async function populateInnerHop(args) {
   const { depsRoot, execDir, fs } = args;
   await linkPinnedPackages({
     depsRoot,
-    nodeModulesDir: join30(execDir, "node_modules"),
+    nodeModulesDir: join34(execDir, "node_modules"),
     fs
   });
 }
 
 // src/domains/runtimeEnv/outerHop.ts
 import { lstat as lstat2 } from "node:fs/promises";
-import { dirname as dirname11, join as join32 } from "node:path";
+import { dirname as dirname11, join as join36 } from "node:path";
 
 // src/domains/runtimeEnv/carryOverPackages.ts
 import { lstat } from "node:fs/promises";
-import { dirname as dirname10, join as join31 } from "node:path";
+import { dirname as dirname10, join as join35 } from "node:path";
 
 // src/domains/runtimeEnv/carryOverPlan.ts
 var executorPackageNames = new Set(pinnedPackages.map((p) => p.name));
@@ -27399,12 +28890,12 @@ async function carryOverPackages(args) {
   const linked = [];
   for (const name of names) {
     const segments = name.split("/");
-    const target = join31(nodeModulesDir, ...segments);
+    const target = join35(nodeModulesDir, ...segments);
     if (await pathOccupied(target))
       continue;
     if (segments.length > 1)
       await fs.mkdir(dirname10(target), { recursive: true });
-    await createDirSymlink(join31(projectModulesDir, ...segments), target);
+    await createDirSymlink(join35(projectModulesDir, ...segments), target);
     linked.push(name);
   }
   return linked;
@@ -27427,18 +28918,18 @@ async function listPackageNames(dir, fs) {
   const names = [];
   for (const entry of entries) {
     if (!entry.startsWith("@")) {
-      if (fs.existsSync(join31(dir, entry, "package.json")))
+      if (fs.existsSync(join35(dir, entry, "package.json")))
         names.push(entry);
       continue;
     }
     let scoped;
     try {
-      scoped = await fs.readdir(join31(dir, entry));
+      scoped = await fs.readdir(join35(dir, entry));
     } catch {
       continue;
     }
     for (const inner of scoped) {
-      if (fs.existsSync(join31(dir, entry, inner, "package.json"))) {
+      if (fs.existsSync(join35(dir, entry, inner, "package.json"))) {
         names.push(`${entry}/${inner}`);
       }
     }
@@ -27456,7 +28947,7 @@ async function populateOuterHop(args) {
   const depNames = Object.keys(installableDeps);
   const { satisfying, rejected } = await findSatisfyingNodeModulesDir(projectDir, depNames, fs);
   if (satisfying !== undefined) {
-    await createDirSymlink(satisfying, join32(runDir, "node_modules"));
+    await createDirSymlink(satisfying, join36(runDir, "node_modules"));
     return { mode: "symlink", nodeModulesDir: satisfying };
   }
   if (depNames.length === 0)
@@ -27465,12 +28956,12 @@ async function populateOuterHop(args) {
   await installOuterDeps(runDir, installableDeps, fs, args.install ?? spawnNpmInstall);
   await linkPinnedPackages({
     depsRoot: args.depsRoot,
-    nodeModulesDir: join32(runDir, "node_modules"),
+    nodeModulesDir: join36(runDir, "node_modules"),
     fs
   });
   const carriedOver = await carryOverPackages({
-    projectModulesDir: join32(projectDir, "node_modules"),
-    nodeModulesDir: join32(runDir, "node_modules"),
+    projectModulesDir: join36(projectDir, "node_modules"),
+    nodeModulesDir: join36(runDir, "node_modules"),
     fs
   });
   return { mode: "install", depCount: depNames.length, rejected, carriedOver };
@@ -27479,10 +28970,10 @@ async function findSatisfyingNodeModulesDir(startDir, depNames, fs) {
   const rejected = [];
   let dir = startDir;
   while (true) {
-    const candidate = join32(dir, "node_modules");
+    const candidate = join36(dir, "node_modules");
     const stats = await lstatSafe(candidate);
     if (stats !== undefined && stats.isDirectory() && !stats.isSymbolicLink()) {
-      const missing = depNames.filter((name) => !fs.existsSync(join32(candidate, name, "package.json")));
+      const missing = depNames.filter((name) => !fs.existsSync(join36(candidate, name, "package.json")));
       if (missing.length === 0)
         return { satisfying: candidate, rejected };
       rejected.push({ dir: candidate, missing });
@@ -27503,7 +28994,7 @@ async function lstatSafe(path) {
 async function readInstallableDeps(projectDir, fs) {
   let content;
   try {
-    content = await fs.readFile(join32(projectDir, "package.json"));
+    content = await fs.readFile(join36(projectDir, "package.json"));
   } catch {
     return {};
   }
@@ -27521,8 +29012,8 @@ async function readInstallableDeps(projectDir, fs) {
   return Object.fromEntries(Object.entries(rawDeps).filter(([name]) => !executorPackageNames2.has(name)).filter((entry) => typeof entry[1] === "string"));
 }
 async function installOuterDeps(runDir, deps, fs, install) {
-  await fs.writeFile(join32(runDir, "package.json"), JSON.stringify({ name: "qawolf-run", private: true, dependencies: deps }, undefined, 2));
-  await fs.writeFile(join32(runDir, ".npmrc"), `@qawolf:registry=https://registry.npmjs.org/
+  await fs.writeFile(join36(runDir, "package.json"), JSON.stringify({ name: "qawolf-run", private: true, dependencies: deps }, undefined, 2));
+  await fs.writeFile(join36(runDir, ".npmrc"), `@qawolf:registry=https://registry.npmjs.org/
 `);
   const result = await install(runDir);
   if (result.exitCode !== 0) {
@@ -27532,14 +29023,14 @@ async function installOuterDeps(runDir, deps, fs, install) {
 
 // src/domains/runtimeEnv/stageFlowFiles.ts
 import { createHash as createHash3 } from "node:crypto";
-import { basename as basename6, dirname as dirname12, join as join34, sep as sep4 } from "node:path";
+import { basename as basename6, dirname as dirname12, join as join38, sep as sep4 } from "node:path";
 
 // src/shell/copyDir.ts
 import { cp, readdir as readdir2 } from "node:fs/promises";
-import { basename as basename5, join as join33 } from "node:path";
+import { basename as basename5, join as join37 } from "node:path";
 async function copyDirExcluding(source, destination, excludedNames) {
   const entries = await readdir2(source, { withFileTypes: true });
-  await Promise.all(entries.filter((entry) => !excludedNames.has(entry.name)).map((entry) => cp(join33(source, entry.name), join33(destination, entry.name), {
+  await Promise.all(entries.filter((entry) => !excludedNames.has(entry.name)).map((entry) => cp(join37(source, entry.name), join37(destination, entry.name), {
     recursive: true,
     filter: (path) => !excludedNames.has(basename5(path))
   })));
@@ -27556,14 +29047,14 @@ async function stageFlowFiles(args) {
   if (files.length > 1) {
     return Promise.all(files.map((f) => stageOneFile(f, execDir, fs)));
   }
-  await Promise.all(files.map((f) => fs.copyFile(f, join34(execDir, basename6(f)))));
-  return files.map((f) => join34(execDir, basename6(f)));
+  await Promise.all(files.map((f) => fs.copyFile(f, join38(execDir, basename6(f)))));
+  return files.map((f) => join38(execDir, basename6(f)));
 }
 async function stageOneFile(file, execDir, fs) {
   const dirHash = createHash3("sha256").update(dirname12(file)).digest("hex").slice(0, 8);
-  const subDir = join34(execDir, dirHash);
+  const subDir = join38(execDir, dirHash);
   await fs.mkdir(subDir, { recursive: true });
-  const dest = join34(subDir, basename6(file));
+  const dest = join38(subDir, basename6(file));
   await fs.copyFile(file, dest);
   return dest;
 }
@@ -27571,7 +29062,7 @@ function remapPath(file, projectDir, execDir) {
   if (file === projectDir)
     return execDir;
   if (file.startsWith(projectDir + sep4)) {
-    return join34(execDir, file.slice(projectDir.length + 1));
+    return join38(execDir, file.slice(projectDir.length + 1));
   }
   return;
 }
@@ -27581,10 +29072,10 @@ async function prepareRunDir(args) {
   const { files, projectDir, depsRoot, runRoot } = args;
   const fs = args.fs ?? makeDefaultFs();
   const runId = buildRunId(projectDir, files);
-  const runDir = join35(runRoot, runId);
+  const runDir = join39(runRoot, runId);
   await fs.rm(runDir, { recursive: true, force: true });
   await fs.mkdir(runDir, { recursive: true });
-  const execDir = join35(runDir, "exec");
+  const execDir = join39(runDir, "exec");
   await fs.mkdir(execDir, { recursive: true });
   await populateInnerHop({ depsRoot, execDir, fs });
   const stagedFiles = await stageFlowFiles({ files, projectDir, execDir, fs });
@@ -27615,17 +29106,17 @@ function buildRunId(projectDir, files) {
 }
 
 // src/shell/testkit.ts
-import { join as join36 } from "node:path";
+import { join as join40 } from "node:path";
 function notAvailableLocally(name) {
   throw new Error(runnerMessages.notAvailableLocally(name));
 }
 async function loadSdkDeps(cwd) {
-  const testkitDir = join36(cwd, "node_modules", "@qawolf", "testkit");
+  const testkitDir = join40(cwd, "node_modules", "@qawolf", "testkit");
   try {
     const clientMod = await importFromPath(resolveFromEnvDir(cwd, "@qawolf/testkit/client"));
     if (typeof clientMod.createTestkitClient !== "function")
       throw new Error("createTestkitClient is not a function");
-    const scopeMod = await importFromPath(join36(testkitDir, "dist", "clientScope.js"));
+    const scopeMod = await importFromPath(join40(testkitDir, "dist", "clientScope.js"));
     if (typeof scopeMod.configureTestkitClient !== "function")
       throw new Error("configureTestkitClient is not a function");
     return {
@@ -27683,9 +29174,9 @@ async function registerLazyEmailsClient(getInbox, cwd, deps) {
 }
 
 // src/commands/flows/envVarDeps.ts
-import { join as join37 } from "node:path";
+import { join as join41 } from "node:path";
 function envFilePath(envDir) {
-  return join37(envDir, ".env");
+  return join41(envDir, ".env");
 }
 async function readEnv(envDir, fs) {
   try {
@@ -27809,7 +29300,7 @@ async function selectRunByTag(args) {
 }
 
 // src/commands/flows/runStagedFlows.ts
-import { join as join41 } from "node:path";
+import { join as join45 } from "node:path";
 
 // src/shell/appium/createAppiumServer.ts
 import { existsSync as existsSync2 } from "node:fs";
@@ -29115,14 +30606,14 @@ async function runWebFlow({
 
 // src/shell/embeddedWorkerCli.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { basename as basename7, join as join38 } from "node:path";
+import { basename as basename7, join as join42 } from "node:path";
 var embeddedCliPathEnv = "QAWOLF_EMBEDDED_CLI_PATH";
 function extractEmbeddedWorkerCli() {
   const assetPath = process.env[embeddedCliPathEnv];
   if (assetPath === undefined || assetPath === "")
     return;
-  const dir = join38(getDataDir(), "worker");
-  const dest = join38(dir, basename7(assetPath));
+  const dir = join42(getDataDir(), "worker");
+  const dest = join42(dir, basename7(assetPath));
   if (existsSync3(dest))
     return dest;
   mkdirSync3(dir, { recursive: true });
@@ -29360,7 +30851,7 @@ ${styleText3("dim", "─".repeat(width))}
   };
 }
 // src/shell/reporter/createJUnitReporter.ts
-import { join as join39 } from "node:path";
+import { join as join43 } from "node:path";
 
 // src/shell/reporter/junitXml.ts
 function escapeXml(str) {
@@ -29399,7 +30890,7 @@ ${suites}`;
 
 // src/shell/reporter/createJUnitReporter.ts
 function resolveJUnitOutputPath(junit, outputDir) {
-  return typeof junit === "string" && junit.trim() !== "" ? junit : join39(outputDir, "junit-report.xml");
+  return typeof junit === "string" && junit.trim() !== "" ? junit : join43(outputDir, "junit-report.xml");
 }
 function createJUnitReporter(deps) {
   const flows = [];
@@ -29490,11 +30981,11 @@ function buildFlowsRunDeps(args) {
 
 // src/commands/flows/loadEnvFile.ts
 import { readFile } from "node:fs/promises";
-import { join as join40 } from "node:path";
+import { join as join44 } from "node:path";
 async function loadEnvFile(envDir) {
   let content;
   try {
-    content = await readFile(join40(envDir, ".env"), "utf8");
+    content = await readFile(join44(envDir, ".env"), "utf8");
   } catch (err) {
     if (isNoEntError(err))
       return;
@@ -29539,7 +31030,7 @@ async function runStagedFlows(args) {
     for (const candidate of staged.outerHop.rejected) {
       log.debug(runnerMessages.outerHopCandidateRejected(candidate.dir, candidate.missing));
     }
-    const ownModules = projectDir === undefined ? undefined : join41(projectDir, "node_modules");
+    const ownModules = projectDir === undefined ? undefined : join45(projectDir, "node_modules");
     const own = staged.outerHop.rejected.find((c) => c.dir === ownModules);
     if (own !== undefined) {
       ctx.ui.warn(runnerMessages.outerHopFallbackNotice(own.dir, own.missing));
@@ -29574,7 +31065,7 @@ async function runStagedFlows(args) {
 }
 
 // src/commands/flows/runDefaults.ts
-function makeDefaultDeps2(fs) {
+function makeDefaultDeps3(fs) {
   return {
     expandPatterns: (patterns, cwd, logger) => expandPatterns(patterns, cwd, logger, fs),
     resolveDepsRoot: (args) => resolveDepsRoot({ ...args, fs }),
@@ -29586,7 +31077,7 @@ function makeDefaultDeps2(fs) {
   };
 }
 async function handleFlowsRun(ctx, pattern, flags, deps, selectors = { tags: [] }, allEnvs = false) {
-  const resolvedDeps = deps ?? makeDefaultDeps2(ctx.fs);
+  const resolvedDeps = deps ?? makeDefaultDeps3(ctx.fs);
   const cwd = process.cwd();
   const expandedFiles = await resolvedDeps.expandPatterns(buildPatternArgs(pattern), cwd, ctx.log("flows"));
   ctx.log("flows").debug(`discovered ${pluralize(expandedFiles.length, "flow")}`);
@@ -29635,7 +31126,7 @@ async function chooseEnv(ctx, files, allEnvs) {
 }
 
 // src/commands/flows/hybridRunDefaults.ts
-import { join as join42, resolve as resolve10 } from "node:path";
+import { join as join46, resolve as resolve10 } from "node:path";
 
 // src/core/selectFlowFiles.ts
 function selectFlowFiles(args) {
@@ -29740,7 +31231,7 @@ async function handleHybridFlowsRun(ctx, pattern, flags, options = {}) {
   if (validation !== "ok") {
     return { error: validation.error, exitCode: 2 };
   }
-  const envDir = resolve10(join42(".qawolf", flags.env));
+  const envDir = resolve10(join46(".qawolf", flags.env));
   const patternArgs = buildPatternArgs(pattern);
   const globFlows = () => resolvedDeps.expandPatterns(patternArgs, envDir, ctx.log("flows"));
   let files = await globFlows();
@@ -29936,12 +31427,12 @@ function registerFlowsCommand(program, signals, deps = { withResolvedEnv }) {
 }
 
 // src/domains/init/init.ts
-import { dirname as dirname14, join as join44, relative as relative9 } from "node:path";
+import { dirname as dirname14, join as join48, relative as relative9 } from "node:path";
 
 // src/domains/init/ensurePackageJson.ts
-import { join as join43 } from "node:path";
+import { join as join47 } from "node:path";
 async function ensurePackageJson(ctx, yes, deps) {
-  const pkgPath = join43(deps.cwd, "package.json");
+  const pkgPath = join47(deps.cwd, "package.json");
   if (!await deps.fs.pathExists(pkgPath)) {
     const confirmed = await ctx.ui.confirm(initMessages.createPackageJsonPrompt, { yes });
     if (!confirmed.ok || !confirmed.value) {
@@ -30067,9 +31558,9 @@ function makeDefaultInitDeps() {
 async function handleInit(ctx, opts, deps = makeDefaultInitDeps()) {
   ctx.ui.gap();
   ctx.ui.intro(initMessages.title);
-  const configPath = join44(deps.cwd, "qawolf.config.ts");
-  const flowPath = join44(deps.cwd, "src", "flows", "example.flow.ts");
-  const gitignorePath = join44(deps.cwd, ".qawolf", ".gitignore");
+  const configPath = join48(deps.cwd, "qawolf.config.ts");
+  const flowPath = join48(deps.cwd, "src", "flows", "example.flow.ts");
+  const gitignorePath = join48(deps.cwd, ".qawolf", ".gitignore");
   await writeWithPrompt(ctx, configPath, qawolfConfigTs, opts.yes, deps);
   await writeWithPrompt(ctx, flowPath, exampleFlowTs, opts.yes, deps);
   await writeWithPrompt(ctx, gitignorePath, qawolfGitignore, opts.yes, deps);
@@ -30107,7 +31598,7 @@ Examples:
 import { parseExecutionTarget as parseExecutionTarget4 } from "@qawolf/flow-targets";
 
 // src/domains/install/android/avd.ts
-import { join as join45 } from "node:path";
+import { join as join49 } from "node:path";
 async function installAvds(ctx, specs, deps) {
   const sdkManagerPath = sdkManagerBin(deps.androidHome, deps.platform);
   const avdManagerPath = avdManagerBin(deps.androidHome, deps.platform);
@@ -30117,7 +31608,7 @@ async function installAvds(ctx, specs, deps) {
   if (versionResult.exitCode !== 0) {
     throw new Error(installMessages.android.sdkmanagerNotFound(sdkManagerPath));
   }
-  const licenseFile = join45(deps.androidHome, "licenses", "android-sdk-license");
+  const licenseFile = join49(deps.androidHome, "licenses", "android-sdk-license");
   if (deps.checkExists(licenseFile)) {
     ctx.ui.info(installMessages.android.licensesAlreadyAccepted);
   } else {
@@ -30132,7 +31623,7 @@ async function installAvds(ctx, specs, deps) {
   for (const spec of specs) {
     if (installedImages.has(spec.systemImage))
       continue;
-    const systemImg = join45(deps.androidHome, ...spec.systemImage.split(";"), "system.img");
+    const systemImg = join49(deps.androidHome, ...spec.systemImage.split(";"), "system.img");
     if (deps.checkExists(systemImg)) {
       ctx.ui.info(installMessages.android.systemImageAlreadyInstalled(spec.systemImage));
       installedImages.add(spec.systemImage);
@@ -30430,42 +31921,6 @@ Examples:
   });
 }
 
-// src/core/publicApi/flagKind.ts
-function flagKind(schema) {
-  if (schema.type === "string")
-    return { ok: true, kind: "string" };
-  if (schema.type === "number" || schema.type === "integer") {
-    return { ok: true, kind: "number" };
-  }
-  if (schema.type === "boolean")
-    return { ok: true, kind: "boolean" };
-  if (schema.type === "array") {
-    if (schema.items?.type !== "string") {
-      return {
-        ok: false,
-        reason: "only string arrays can be expressed as flags"
-      };
-    }
-    return { ok: true, kind: "string-array" };
-  }
-  if (schema.type === "object") {
-    if (schema.properties) {
-      return {
-        ok: false,
-        reason: "nested objects cannot be expressed as flags"
-      };
-    }
-    if (typeof schema.additionalProperties === "object" && schema.additionalProperties.type === "string") {
-      return { ok: true, kind: "key-value-record" };
-    }
-    return { ok: false, reason: "nested objects cannot be expressed as flags" };
-  }
-  return {
-    ok: false,
-    reason: `type ${schema.type ?? "unknown"} cannot be expressed as a flag`
-  };
-}
-
 // src/core/publicApi/flagNames.ts
 var kebabCase = (segment) => segment.replace(/[A-Z]/g, (char) => `-${char.toLowerCase()}`);
 var capitalize = (segment) => `${segment.slice(0, 1).toUpperCase()}${segment.slice(1)}`;
@@ -30484,108 +31939,6 @@ function flagUsage(path, kind) {
   return `${name} <value>`;
 }
 
-// src/core/publicApi/objectShape.ts
-var asObjectShape = (schema) => schema.type === "object" && schema.properties ? { properties: schema.properties, required: new Set(schema.required) } : undefined;
-function mergeIntersection(members) {
-  const shape = { properties: {}, required: new Set };
-  for (const member of members) {
-    const memberShape = asObjectShape(member);
-    if (!memberShape) {
-      return {
-        ok: false,
-        field: "",
-        reason: "intersection members must be object schemas"
-      };
-    }
-    for (const [field, fieldSchema] of Object.entries(memberShape.properties)) {
-      if (field in shape.properties) {
-        return {
-          ok: false,
-          field,
-          reason: "field appears in multiple intersection members"
-        };
-      }
-      shape.properties[field] = fieldSchema;
-      if (memberShape.required.has(field))
-        shape.required.add(field);
-    }
-  }
-  return { ok: true, shape };
-}
-function mergeUnion(branches) {
-  const shapes = [];
-  for (const branch of branches) {
-    const branchShape = asObjectShape(branch);
-    if (!branchShape) {
-      return {
-        ok: false,
-        field: "",
-        reason: "union branches must be object schemas"
-      };
-    }
-    shapes.push(branchShape);
-  }
-  const shape = { properties: {}, required: new Set };
-  for (const branchShape of shapes) {
-    for (const [field, fieldSchema] of Object.entries(branchShape.properties)) {
-      const existing = shape.properties[field];
-      if (!existing) {
-        shape.properties[field] = { ...fieldSchema };
-        continue;
-      }
-      const kinds = [flagKind(existing), flagKind(fieldSchema)];
-      if (kinds[0]?.ok && kinds[1]?.ok) {
-        if (kinds[0].kind !== kinds[1].kind) {
-          return {
-            ok: false,
-            field,
-            reason: "field has conflicting types across union branches"
-          };
-        }
-      } else if (JSON.stringify({ ...existing, description: undefined }) !== JSON.stringify({ ...fieldSchema, description: undefined })) {
-        return {
-          ok: false,
-          field,
-          reason: "field has conflicting object schemas across union branches"
-        };
-      }
-      if (!existing.description && fieldSchema.description) {
-        existing.description = fieldSchema.description;
-      }
-    }
-  }
-  const discriminator = Object.keys(shape.properties).find((field) => {
-    const values = shapes.map((branch) => branch.properties[field]?.const);
-    return values.every((value) => typeof value === "string") && new Set(values).size === shapes.length && shapes.every((branch) => branch.required.has(field));
-  });
-  for (const [field, fieldSchema] of Object.entries(shape.properties)) {
-    const occurrences = shapes.filter((branch) => (field in branch.properties));
-    if (occurrences.length === shapes.length && occurrences.every((branch) => branch.required.has(field))) {
-      shape.required.add(field);
-    }
-    if (field === discriminator) {
-      const values = shapes.map((branch) => branch.properties[field]?.const);
-      fieldSchema.description = `One of: ${values.join(", ")}`;
-    }
-  }
-  return { ok: true, shape };
-}
-function toObjectShape(schema) {
-  if (schema.allOf)
-    return mergeIntersection(schema.allOf);
-  const branches = schema.oneOf ?? schema.anyOf;
-  if (branches)
-    return mergeUnion(branches);
-  const shape = asObjectShape(schema);
-  if (shape)
-    return { ok: true, shape };
-  return {
-    ok: false,
-    field: "",
-    reason: "contract input must be an object schema"
-  };
-}
-
 // src/core/publicApi/flagSpecs.ts
 function describeFlag(schema) {
   const description = schema.description ?? "";
@@ -31039,7 +32392,7 @@ function describeFailure(failureReason) {
 }
 
 // src/shell/interactiveRunner/collectRunFiles.ts
-import { join as join47 } from "node:path";
+import { join as join51 } from "node:path";
 
 // src/core/interactiveRunner/getImports.ts
 function getImports(options) {
@@ -31078,7 +32431,7 @@ function isPathAlias(importPath, paths) {
 }
 
 // src/core/interactiveRunner/resolveImportPath.ts
-import { dirname as dirname15, join as join46, normalize as normalize4 } from "node:path/posix";
+import { dirname as dirname15, join as join50, normalize as normalize3 } from "node:path/posix";
 
 // src/core/interactiveRunner/tsconfigPaths.ts
 function isRecord4(value) {
@@ -31131,7 +32484,7 @@ function candidatesForExplicitExtension(options) {
 }
 function resolveImportPath(options) {
   const aliasTarget = resolvePathAlias(options.importPath, options.tsconfigPaths);
-  const resolvedPath = aliasTarget === undefined ? normalize4(join46(dirname15(options.importingFilePath), options.importPath)) : normalize4(aliasTarget);
+  const resolvedPath = aliasTarget === undefined ? normalize3(join50(dirname15(options.importingFilePath), options.importPath)) : normalize3(aliasTarget);
   const hasExplicitExtension = supportedExtensions.some((extension) => options.importPath.endsWith(extension));
   const candidates = hasExplicitExtension ? candidatesForExplicitExtension({
     importPath: options.importPath,
@@ -31155,7 +32508,7 @@ function resolveImportPath(options) {
 var tsconfigPath = "tsconfig.json";
 async function collectRunFiles(options) {
   const held = await listShippablePaths(options);
-  const readFile = (path) => options.fs.readFile(join47(options.cwd, path));
+  const readFile = (path) => options.fs.readFile(join51(options.cwd, path));
   const tsconfigContent = held.has(tsconfigPath) ? await readFile(tsconfigPath).catch(() => {
     return;
   }) : undefined;
@@ -31232,13 +32585,13 @@ async function walkImportGraph(options) {
 }
 
 // src/shell/interactiveRunner/makeRunnerId.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 function makeRunnerId() {
-  return `cli-${randomUUID().replaceAll("-", "").slice(0, 12)}`;
+  return `cli-${randomUUID2().replaceAll("-", "").slice(0, 12)}`;
 }
 
 // src/shell/interactiveRunner/runFilesManifest.ts
-import { join as join48 } from "node:path";
+import { join as join52 } from "node:path";
 var manifestFileName = "runner-files.json";
 var manifestSchema2 = object({
   files: array(object({ contentHash: string2(), path: string2() })),
@@ -31246,8 +32599,8 @@ var manifestSchema2 = object({
   version: literal(1)
 });
 function makeRunFilesManifestStore(options) {
-  const directory = join48(options.cwd, qawolfDir);
-  const path = join48(directory, manifestFileName);
+  const directory = join52(options.cwd, qawolfDir);
+  const path = join52(directory, manifestFileName);
   let pendingWrites = 0;
   return {
     async read() {
@@ -31277,7 +32630,7 @@ function parseJson(text) {
 }
 
 // src/shell/interactiveRunner/runnerStore.ts
-import { join as join49 } from "node:path";
+import { join as join53 } from "node:path";
 var storeFileName = "runner.json";
 var runnersDirName = "runners";
 var storedRunnerSchema = object({
@@ -31296,11 +32649,11 @@ function parseJson2(text) {
 }
 var pendingWrites = 0;
 function makeRunnerStore(options) {
-  const directory = join49(options.cwd, qawolfDir);
-  const path = join49(directory, storeFileName);
-  const runnersDir = join49(directory, runnersDirName);
+  const directory = join53(options.cwd, qawolfDir);
+  const path = join53(directory, storeFileName);
+  const runnersDir = join53(directory, runnersDirName);
   const nextPendingPath = (target) => `${target}.${process.pid}.${++pendingWrites}.tmp`;
-  const runnerPath = (runnerId) => join49(runnersDir, `${encodeURIComponent(runnerId)}.json`);
+  const runnerPath = (runnerId) => join53(runnersDir, `${encodeURIComponent(runnerId)}.json`);
   const writeAtomically = async (target, contents) => {
     const pendingPath = nextPendingPath(target);
     await options.fs.writeFile(pendingPath, `${JSON.stringify(contents, undefined, 2)}
@@ -31337,7 +32690,7 @@ function makeRunnerStore(options) {
     readDefaultRunnerId,
     async readRunners() {
       const runners = await Promise.all((await readRunnerFileNames()).map(async (name) => {
-        const contents = await options.fs.readFile(join49(runnersDir, name)).catch(() => {
+        const contents = await options.fs.readFile(join53(runnersDir, name)).catch(() => {
           return;
         });
         if (contents === undefined)
@@ -31356,7 +32709,7 @@ function makeRunnerStore(options) {
       await Promise.all(runnerIds.map((runnerId) => options.fs.rm(runnerPath(runnerId), { force: true })));
       const names = await readRunnerFileNames();
       await Promise.all(names.map(async (name) => {
-        const runnerFile = join49(runnersDir, name);
+        const runnerFile = join53(runnersDir, name);
         const contents = await options.fs.readFile(runnerFile).catch(() => {
           return;
         });
@@ -31440,7 +32793,7 @@ function registerRunnerHighlightSelectorCommand(runner, signals) {
 }
 
 // src/domains/interactiveRunner/importPackage.ts
-import { join as join50 } from "node:path";
+import { join as join54 } from "node:path";
 
 // src/core/interactiveRunner/npmDependencies.ts
 var sectionsInPrecedenceOrder = ["dependencies", "devDependencies"];
@@ -31481,7 +32834,7 @@ function readNpmDependencies(packageJsonContent) {
 // src/domains/interactiveRunner/importPackage.ts
 var defaultPackageVersion = "latest";
 async function handleRunnerImportPackage(ctx, options, deps) {
-  const content = await deps.readFile(join50(deps.cwd, runPackageJsonPath)).catch(() => {
+  const content = await deps.readFile(join54(deps.cwd, runPackageJsonPath)).catch(() => {
     return;
   });
   if (content === undefined) {
@@ -33205,4 +34558,4 @@ createProgram({ signals }).parseAsync().catch(() => {
     process.exitCode = 1;
 }).finally(() => flushAndExit(typeof process.exitCode === "number" ? process.exitCode : 0));
 
-//# debugId=599EFC31E23F426D64756E2164756E21
+//# debugId=DA8D4A9E373CFE5C64756E2164756E21