@qawolf/cli 1.24.0 → 1.26.0

package/dist/cli.js

@@ -8390,11 +8390,82 @@ function extractMissingPackage(text) {
   return specifier;
 }
 
+// src/core/pluralize.ts
+function pluralize(count, singular, plural = `${singular}s`) {
+  return `${String(count)} ${count === 1 ? singular : plural}`;
+}
+
 // src/core/formatSeconds.ts
 function formatSeconds(ms) {
   return `${Math.round(ms / 1000)}s`;
 }
 
+// src/core/messages/authErrors.ts
+var authErrorMessages = {
+  identity: {
+    invalidOrUnauthorized: "API key is invalid or unauthorized",
+    unexpectedFormat: "Could not verify API key: unexpected response format",
+    couldNotVerify: (detail, status) => `Could not verify API key: ${detail || `HTTP ${status}`}`,
+    couldNotVerifyNetwork: (cause) => `Could not verify API key: ${cause}`,
+    timedOut: (timeoutMs) => `Could not verify API key: the QA Wolf API did not answer within ${formatSeconds(timeoutMs)}.`
+  },
+  request: {
+    rejected401: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 401). Check your API key.`,
+    rejected402: (noun) => `QA Wolf API refused the${noun ? ` ${noun}` : ""} request (HTTP 402): billing prevented it.`,
+    rejected403: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 403). Check that your API key has access to this environment.`,
+    notFound404: (noun) => `QA Wolf API could not find ${noun ? `${noun} for that environment` : "that environment"} (HTTP 404). Check the --env value.`,
+    failedWithStatus: (status, noun) => `QA Wolf API${noun ? ` ${noun}` : ""} request failed (HTTP ${status}).`,
+    networkUnreachable: (baseUrl, noun) => `Could not reach the QA Wolf API at ${baseUrl}${noun ? ` to fetch ${noun}` : ""}. Check your network connection and QAWOLF_HOST_URL.`,
+    timedOut: (timeoutMs, noun) => `The QA Wolf API${noun ? ` ${noun}` : ""} request timed out after ${formatSeconds(timeoutMs)}. The work may still be finishing on the platform.`,
+    unexpectedResponse: (noun) => `Unexpected${noun ? ` ${noun}` : ""} response from the QA Wolf API.`
+  },
+  workos: {
+    unexpectedResponse: "WorkOS returned an unexpected response",
+    unexpectedResponseWithStatus: (status) => `WorkOS returned an unexpected response (HTTP ${status})`,
+    unreachable: (detail) => `Could not reach WorkOS: ${detail}`,
+    redirected: "WorkOS answered with a redirect, which the CLI does not follow for a sign-in request",
+    noClientForSession: "This session names no WorkOS client"
+  },
+  bundle: {
+    linkExpired: "The flow bundle download link has expired. Please run `qawolf flows pull` again to refresh.",
+    failedWithStatus: (status) => `Could not download the flow bundle (HTTP ${status}).`,
+    networkUnreachable: "Could not reach the flow bundle storage. Check your network connection and try again.",
+    timedOut: (timeoutMs) => `Downloading the flow bundle stalled — no data arrived for ${formatSeconds(timeoutMs)}. Please try again.`,
+    malformed: "The flow bundle download was malformed. Please run `qawolf flows pull` again."
+  }
+};
+
+// src/core/messages/whoami.ts
+var whoamiMessages = {
+  source: (source) => `Source: ${source}`,
+  authFailed: (source, error) => `Authentication failed (source: ${source}): ${error}`,
+  authenticatedAs: (teamName, source) => `Authenticated as ${teamName} (source: ${source})`,
+  teamNote: (input) => [
+    `Workspace: ${input.team.name}`,
+    `ID:        ${input.team.id}`,
+    input.team.slug ? `Slug:      ${input.team.slug}` : undefined,
+    input.teamUrl ? `URL:       ${input.teamUrl}` : undefined,
+    `Source:    ${input.source}`
+  ].filter((line) => Boolean(line)).join(`
+`),
+  organizationNote: (input) => [
+    `Organization: ${input.organization.name}`,
+    `ID:           ${input.organization.id}`,
+    `Source:       ${input.source}`
+  ].join(`
+`),
+  activeWorkspace: (workspaceId, found) => found ? `${found.workspace} (${found.organization})` : `${workspaceId} — no longer in reach; run 'qawolf auth switch'`,
+  userNote: (input) => [
+    `User:         ${input.user.email}`,
+    `ID:           ${input.user.id}`,
+    `Organization: ${input.organization.name}`,
+    input.activeWorkspace ? `Workspace:    ${input.activeWorkspace}` : undefined,
+    input.organizations.length > 0 ? `Workspaces:   ${input.organizations.map((o) => `${o.name}: ${o.workspaces.map((w) => w.name).join(", ")}`).join(" | ")}` : undefined,
+    `Source:       ${input.source}`
+  ].filter((line) => Boolean(line)).join(`
+`)
+};
+
 // src/core/messages/auth.ts
 var authMessages = {
   title: "QA Wolf Authentication",
@@ -8412,7 +8483,47 @@ var authMessages = {
   whoamiFailed: "Not authenticated",
   login: {
     nonInteractive: "auth login requires an interactive terminal. Set the QAWOLF_API_KEY environment variable for CI authentication.",
-    reAuthPrompt: "You are already authenticated. Re-authenticate?"
+    reAuthPrompt: "You are already authenticated. Re-authenticate?",
+    chooseMethod: "How do you want to sign in?",
+    methodBrowser: "Browser",
+    methodBrowserHint: "Sign in with your QA Wolf account",
+    methodApiKey: "API key",
+    methodApiKeyHint: "Paste a team key — needed for flows pull and flows run",
+    apiKeyPrecedence: {
+      env: "QAWOLF_API_KEY is set, and an API key takes precedence over a browser session. Commands continue to use that key until you unset the variable.",
+      stored: "A stored API key takes precedence over a browser session. Commands continue to use that key until you run 'qawolf auth logout' and sign in again."
+    }
+  },
+  device: {
+    unavailable: "This QA Wolf deployment does not offer browser sign-in. Run 'qawolf auth login' again and choose 'API key'.",
+    configUnreachable: "Could not ask this QA Wolf deployment whether it offers browser sign-in. Check your connection, then try again.",
+    confirmCode: (userCode) => `Your code is ${userCode}`,
+    visitUrl: (url) => `Confirm it at ${url}`,
+    visitUrlPlain: (url) => `Or go to ${url} and enter the code`,
+    openFailed: (url) => `Could not open a browser automatically. Open ${url} yourself to continue.`,
+    waiting: "Waiting for you to finish in the browser",
+    signedIn: (email) => `Signed in as ${email}.`,
+    failed: {
+      "access-denied": "The sign-in request was rejected.",
+      expired: "The sign-in request expired. Run 'qawolf auth login' to retry.",
+      timeout: "The sign-in request timed out. Run 'qawolf auth login' to retry.",
+      network: "Could not reach WorkOS to complete sign-in.",
+      unavailable: "Could not start browser sign-in.",
+      cancelled: "Sign-in cancelled."
+    }
+  },
+  workspace: {
+    chooseOrganization: "Which organization do you want to work in?",
+    choose: "Which workspace do you want to use?",
+    workspaceCount: (count) => pluralize(count, "workspace"),
+    working: (organization, workspace) => `Working in ${workspace} (${organization}).`,
+    none: "This account reaches no organizations yet.",
+    cancelled: "Workspace not changed.",
+    notSignedIn: "Workspace switching needs a browser sign-in. Run 'qawolf auth login' and choose Browser.",
+    sessionExpired: "Your session could not be renewed. Run 'qawolf auth login' to sign in again.",
+    nonInteractive: "auth switch needs an interactive terminal, or set QAWOLF_WORKSPACE to name a workspace.",
+    sessionChanged: "The stored sign-in changed while you made your choice. Run the command again.",
+    saveFailed: (detail) => `Could not save the workspace choice: ${detail}`
   },
   logout: {
     title: "Log Out",
@@ -8424,58 +8535,8 @@ var authMessages = {
     success: "Logged out successfully.",
     cancelled: "Logout cancelled."
   },
-  errors: {
-    identity: {
-      invalidOrUnauthorized: "API key is invalid or unauthorized",
-      unexpectedFormat: "Could not verify API key: unexpected response format",
-      couldNotVerify: (detail, status) => `Could not verify API key: ${detail || `HTTP ${status}`}`,
-      couldNotVerifyNetwork: (cause) => `Could not verify API key: ${cause}`,
-      timedOut: (timeoutMs) => `Could not verify API key: the QA Wolf API did not answer within ${formatSeconds(timeoutMs)}.`
-    },
-    request: {
-      rejected401: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 401). Check your API key.`,
-      rejected402: (noun) => `QA Wolf API refused the${noun ? ` ${noun}` : ""} request (HTTP 402): billing prevented it.`,
-      rejected403: (noun) => `QA Wolf API rejected the${noun ? ` ${noun}` : ""} request (HTTP 403). Check that your API key has access to this environment.`,
-      notFound404: (noun) => `QA Wolf API could not find ${noun ? `${noun} for that environment` : "that environment"} (HTTP 404). Check the --env value.`,
-      failedWithStatus: (status, noun) => `QA Wolf API${noun ? ` ${noun}` : ""} request failed (HTTP ${status}).`,
-      networkUnreachable: (baseUrl, noun) => `Could not reach the QA Wolf API at ${baseUrl}${noun ? ` to fetch ${noun}` : ""}. Check your network connection and QAWOLF_HOST_URL.`,
-      timedOut: (timeoutMs, noun) => `The QA Wolf API${noun ? ` ${noun}` : ""} request timed out after ${formatSeconds(timeoutMs)}. The work may still be finishing on the platform.`,
-      unexpectedResponse: (noun) => `Unexpected${noun ? ` ${noun}` : ""} response from the QA Wolf API.`
-    },
-    bundle: {
-      linkExpired: "The flow bundle download link has expired. Please run `qawolf flows pull` again to refresh.",
-      failedWithStatus: (status) => `Could not download the flow bundle (HTTP ${status}).`,
-      networkUnreachable: "Could not reach the flow bundle storage. Check your network connection and try again.",
-      timedOut: (timeoutMs) => `Downloading the flow bundle stalled — no data arrived for ${formatSeconds(timeoutMs)}. Please try again.`,
-      malformed: "The flow bundle download was malformed. Please run `qawolf flows pull` again."
-    }
-  },
-  whoami: {
-    source: (source) => `Source: ${source}`,
-    authFailed: (source, error) => `Authentication failed (source: ${source}): ${error}`,
-    authenticatedAs: (teamName, source) => `Authenticated as ${teamName} (source: ${source})`,
-    teamNote: (input) => [
-      `Team:   ${input.team.name}`,
-      `ID:     ${input.team.id}`,
-      input.team.slug ? `Slug:   ${input.team.slug}` : undefined,
-      input.teamUrl ? `URL:    ${input.teamUrl}` : undefined,
-      `Source: ${input.source}`
-    ].filter((line) => Boolean(line)).join(`
-`),
-    organizationNote: (input) => [
-      `Organization: ${input.organization.name}`,
-      `ID:           ${input.organization.id}`,
-      `Source:       ${input.source}`
-    ].join(`
-`),
-    userNote: (input) => [
-      `User:         ${input.user.email}`,
-      `ID:           ${input.user.id}`,
-      `Organization: ${input.organization.name}`,
-      `Source:       ${input.source}`
-    ].join(`
-`)
-  }
+  errors: authErrorMessages,
+  whoami: whoamiMessages
 };
 // src/core/messages/toolNotFound.ts
 var installRemedy = "Run `qawolf install` to install the runtime dependencies.";
@@ -8568,11 +8629,6 @@ var environmentsMessages = {
   usingPulledEnv: (env) => `Could not reach the platform to resolve environment ${env}; using the copy pulled into .qawolf/${env}.`,
   tooManyPages: (pages) => `Stopped listing environments after ${pages} pages. Pass --env explicitly.`
 };
-// src/core/pluralize.ts
-function pluralize(count, singular, plural = `${singular}s`) {
-  return `${String(count)} ${count === 1 ? singular : plural}`;
-}
-
 // src/core/messages/flows.ts
 var flowsMessages = {
   title: "Flows",
@@ -9027,25 +9083,32 @@ function exit(code, message, proc = process) {
   }
   return proc.exit(code);
 }
-function flushAndExit(code, proc = process, scheduleBackstop = (fn) => {
-  setTimeout(fn, 2000).unref();
+var backstopMs = 2000;
+function exitWhenIdle(code, proc = process, scheduleBackstop = (fn) => {
+  setTimeout(fn, backstopMs).unref();
 }) {
-  let exited = false;
-  const exitOnce = () => {
-    if (exited)
-      return;
-    exited = true;
-    proc.exit(code);
-  };
-  let pending = 2;
-  const onFlushed = () => {
-    pending -= 1;
-    if (pending === 0)
-      exitOnce();
+  proc.exitCode = code;
+  scheduleBackstop(() => proc.exit(code));
+}
+var signalExitCodes = {
+  SIGINT: 130,
+  SIGTERM: 143
+};
+var signalGraceMs = 150;
+function scheduleSignalGrace(fn) {
+  return setTimeout(fn, signalGraceMs);
+}
+function createSignalExit(deps) {
+  const proc = deps.proc ?? process;
+  const scheduleGrace = deps.scheduleGrace ?? scheduleSignalGrace;
+  let signalled = false;
+  return (signal) => () => {
+    const code = signalExitCodes[signal];
+    if (signalled)
+      proc.exit(code);
+    signalled = true;
+    deps.shutdown(signal).catch(() => {}).finally(() => exitWhenIdle(code, proc, scheduleGrace));
   };
-  proc.stdout.write("", onFlushed);
-  proc.stderr.write("", onFlushed);
-  scheduleBackstop(exitOnce);
 }
 
 // src/shell/fs.ts
@@ -9161,43 +9224,30 @@ function resolveHostUrl(env) {
 }
 
 // src/domains/auth/resolve.ts
-import { Entry as Entry3 } from "@napi-rs/keyring";
-
-// src/domains/auth/store/delete.ts
-import { join as join2 } from "node:path";
-import { Entry } from "@napi-rs/keyring";
-
-// src/domains/auth/store/constants.ts
-var service = "qawolf-cli";
-var account = "api-key";
-var credentialsFile = "credentials.json";
+import { Entry as Entry5 } from "@napi-rs/keyring";
 
-// src/domains/auth/store/delete.ts
-function deleteFromKeychain() {
-  try {
-    new Entry(service, account).deletePassword();
-    return "deleted";
-  } catch {
-    return "unavailable";
-  }
-}
-async function deleteFromFile(configDir, fs) {
+// src/core/deviceAuth/tokenExpiry.ts
+function readAccessTokenExpiry(accessToken) {
+  const segments = accessToken.split(".");
+  if (segments.length !== 3)
+    return;
+  const [, payload] = segments;
+  if (!payload)
+    return;
+  let claims;
   try {
-    await fs.unlink(join2(configDir, credentialsFile));
-    return "deleted";
+    claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
   } catch {
-    return "not-found";
+    return;
   }
+  if (typeof claims !== "object" || claims === null)
+    return;
+  const exp = claims.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp))
+    return;
+  const expiresAtMs = exp * 1000;
+  return Number.isFinite(expiresAtMs) ? expiresAtMs : undefined;
 }
-async function deleteApiKey(configDir, fs) {
-  const [keychain, file] = await Promise.all([
-    Promise.resolve(deleteFromKeychain()),
-    deleteFromFile(configDir, fs)
-  ]);
-  return { keychain, file };
-}
-// src/domains/auth/store/load.ts
-import { join as join3 } from "node:path";
 
 // node_modules/zod/v4/core/core.js
 var _a;
@@ -14424,10 +14474,229 @@ function date4(params) {
 
 // node_modules/zod/v4/classic/external.js
 config(en_default());
+// src/shell/workos/types.ts
+var defaultWorkosBaseUrl = "https://api.workos.com";
+var defaultIntervalSec = 5;
+var deviceAuthorizationBody = object({
+  device_code: string2().min(1),
+  user_code: string2().min(1),
+  verification_uri: string2().min(1),
+  verification_uri_complete: string2().min(1).optional(),
+  expires_in: number2().int().positive(),
+  interval: number2().int().positive().optional()
+});
+var deviceTokenBody = object({
+  access_token: string2().min(1),
+  refresh_token: string2().min(1),
+  user: object({ email: string2().min(1) }),
+  organization_id: string2().min(1).optional()
+});
+var oauthErrorBody = object({
+  error: string2().min(1),
+  error_description: string2().min(1).optional()
+});
+var authenticationErrorBody = object({
+  code: string2().min(1),
+  message: string2().min(1).optional()
+});
+
+// src/shell/workos/send.ts
+var timeoutMs = 15000;
+var unexpectedResponse = authErrorMessages.workos.unexpectedResponse;
+function isTransientStatus(status) {
+  return status >= 500 || status === 429 || status === 408;
+}
+async function sendWorkosRequest(url, init, fetchFn) {
+  let response;
+  try {
+    response = await fetchFn(url, {
+      method: "POST",
+      headers: init.headers,
+      body: init.body,
+      redirect: "manual",
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (err) {
+    return {
+      kind: "failure",
+      detail: authErrorMessages.workos.unreachable(errorMessage(err)),
+      retryable: true
+    };
+  }
+  if (response.status >= 300 && response.status < 400) {
+    return {
+      kind: "failure",
+      detail: authErrorMessages.workos.redirected,
+      retryable: false
+    };
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch {
+    return {
+      kind: "failure",
+      detail: authErrorMessages.workos.unexpectedResponseWithStatus(response.status),
+      retryable: response.ok || isTransientStatus(response.status)
+    };
+  }
+  if (response.ok)
+    return { kind: "json", json };
+  if (isTransientStatus(response.status)) {
+    return {
+      kind: "failure",
+      detail: authErrorMessages.workos.unexpectedResponseWithStatus(response.status),
+      retryable: true
+    };
+  }
+  const parsed = oauthErrorBody.safeParse(json);
+  if (parsed.success) {
+    return {
+      kind: "oauth-error",
+      code: parsed.data.error,
+      description: parsed.data.error_description
+    };
+  }
+  const authError = authenticationErrorBody.safeParse(json);
+  if (authError.success) {
+    return {
+      kind: "oauth-error",
+      code: authError.data.code,
+      description: authError.data.message
+    };
+  }
+  return {
+    kind: "failure",
+    detail: authErrorMessages.workos.unexpectedResponseWithStatus(response.status),
+    retryable: false
+  };
+}
+
+// src/shell/workos/refreshAccessToken.ts
+async function refreshAccessToken(refreshToken, organizationId, deps) {
+  const params = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: deps.clientId
+  });
+  if (organizationId)
+    params.set("organization_id", organizationId);
+  const outcome = await sendWorkosRequest(`${deps.baseUrl}/user_management/authenticate`, {
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: params.toString()
+  }, deps.fetch);
+  if (outcome.kind === "failure") {
+    return { ok: false, error: outcome.detail, retryable: outcome.retryable };
+  }
+  if (outcome.kind === "oauth-error") {
+    return {
+      ok: false,
+      error: outcome.description ?? outcome.code,
+      retryable: false
+    };
+  }
+  const parsed = deviceTokenBody.safeParse(outcome.json);
+  if (!parsed.success) {
+    return { ok: false, error: unexpectedResponse, retryable: false };
+  }
+  return {
+    ok: true,
+    value: {
+      accessToken: parsed.data.access_token,
+      refreshToken: parsed.data.refresh_token,
+      expiresAt: readAccessTokenExpiry(parsed.data.access_token),
+      email: parsed.data.user.email,
+      organizationId: parsed.data.organization_id
+    }
+  };
+}
+
+// src/shell/workos/config.ts
+function resolveWorkosConfig(publishedClientId) {
+  const clientId = publishedClientId?.trim();
+  if (!clientId)
+    return { configured: false };
+  return { configured: true, clientId, baseUrl: defaultWorkosBaseUrl };
+}
+
+// src/domains/auth/store/delete.ts
+import { join as join2 } from "node:path";
+import { Entry } from "@napi-rs/keyring";
+
+// src/domains/auth/store/constants.ts
+var service = "qawolf-cli";
+var account = "api-key";
+var credentialsFile = "credentials.json";
+var tokensAccount = "oauth-tokens";
+var tokensFile = "tokens.json";
+
+// src/domains/auth/store/delete.ts
+function deleteFromKeychain() {
+  try {
+    new Entry(service, account).deletePassword();
+    return "deleted";
+  } catch {
+    return "unavailable";
+  }
+}
+async function deleteFromFile(configDir, fs) {
+  try {
+    await fs.unlink(join2(configDir, credentialsFile));
+    return "deleted";
+  } catch (err) {
+    if (isNoEntError(err))
+      return "not-found";
+    throw err;
+  }
+}
+async function deleteApiKey(configDir, fs) {
+  const [keychain, file] = await Promise.all([
+    Promise.resolve(deleteFromKeychain()),
+    deleteFromFile(configDir, fs)
+  ]);
+  return { keychain, file };
+}
+// src/domains/auth/store/hasStoredCredentials.ts
+import { join as join3 } from "node:path";
+import { Entry as Entry2 } from "@napi-rs/keyring";
+async function fileExists(path, fs) {
+  try {
+    await fs.readFile(path);
+    return true;
+  } catch (err) {
+    return !isNoEntError(err);
+  }
+}
+function keychainHolds(entryAccount) {
+  try {
+    return Boolean(new Entry2(service, entryAccount).getPassword());
+  } catch {
+    return false;
+  }
+}
+async function hasStoredCredentials(configDir, fs) {
+  const [apiKeyFile, tokenFile] = await Promise.all([
+    fileExists(join3(configDir, credentialsFile), fs),
+    fileExists(join3(configDir, tokensFile), fs)
+  ]);
+  return apiKeyFile || tokenFile || keychainHolds(account) || keychainHolds(tokensAccount);
+}
+// src/domains/auth/store/load.ts
+import { join as join4 } from "node:path";
+
 // src/domains/auth/store/types.ts
 var credentialsFileSchema = object({
   apiKey: string2().min(1)
 });
+var oauthTokensSchema = object({
+  accessToken: string2().min(1),
+  refreshToken: string2().min(1),
+  expiresAt: number2().int().optional(),
+  email: string2().min(1),
+  organizationId: string2().min(1).optional(),
+  workspaceId: string2().min(1).optional(),
+  clientId: string2().min(1).optional()
+});
 
 // src/domains/auth/store/load.ts
 async function loadApiKey(configDir, deps) {
@@ -14441,7 +14710,7 @@ async function loadApiKey(configDir, deps) {
     errors.keychain = errorMessage(err);
   }
   try {
-    const content = await deps.fs.readFile(join3(configDir, credentialsFile));
+    const content = await deps.fs.readFile(join4(configDir, credentialsFile));
     const parsed = credentialsFileSchema.safeParse(JSON.parse(content));
     if (parsed.success) {
       return { found: true, key: parsed.data.apiKey, source: "file" };
@@ -14453,16 +14722,16 @@ async function loadApiKey(configDir, deps) {
   return { found: false, errors };
 }
 // src/domains/auth/store/save.ts
-import { join as join4 } from "node:path";
-import { Entry as Entry2 } from "@napi-rs/keyring";
+import { join as join5 } from "node:path";
+import { Entry as Entry3 } from "@napi-rs/keyring";
 async function saveToFile(configDir, key, fs) {
   const payload = { apiKey: key };
   await fs.mkdir(configDir, { recursive: true, mode: 448 });
-  await fs.writeFile(join4(configDir, credentialsFile), JSON.stringify(payload, undefined, 2), { mode: 384 });
+  await fs.writeFile(join5(configDir, credentialsFile), JSON.stringify(payload, undefined, 2), { mode: 384 });
 }
 async function saveApiKey(configDir, key, fs) {
   try {
-    const entry = new Entry2(service, account);
+    const entry = new Entry3(service, account);
     entry.setPassword(key);
     return { stored: "keychain" };
   } catch (err) {
@@ -14470,10 +14739,159 @@ async function saveApiKey(configDir, key, fs) {
     return { stored: "file", keychainError: errorMessage(err) };
   }
 }
+// src/domains/auth/store/loadTokens.ts
+import { join as join6 } from "node:path";
+var invalidPayload = "Invalid stored token format";
+function parseTokens(raw) {
+  const parsed = oauthTokensSchema.safeParse(JSON.parse(raw));
+  if (!parsed.success)
+    return;
+  return {
+    accessToken: parsed.data.accessToken,
+    refreshToken: parsed.data.refreshToken,
+    expiresAt: parsed.data.expiresAt,
+    email: parsed.data.email,
+    organizationId: parsed.data.organizationId,
+    workspaceId: parsed.data.workspaceId,
+    clientId: parsed.data.clientId
+  };
+}
+async function loadTokens(configDir, deps) {
+  const errors = {};
+  try {
+    const raw = new deps.EntryClass(service, tokensAccount).getPassword();
+    if (raw) {
+      const tokens = parseTokens(raw);
+      if (tokens)
+        return { found: true, tokens, source: "keychain" };
+      errors.keychain = invalidPayload;
+    }
+  } catch (err) {
+    errors.keychain = errorMessage(err);
+  }
+  try {
+    const raw = await deps.fs.readFile(join6(configDir, tokensFile));
+    const tokens = parseTokens(raw);
+    if (tokens)
+      return { found: true, tokens, source: "file" };
+    errors.file = invalidPayload;
+  } catch (err) {
+    errors.file = errorMessage(err);
+  }
+  return { found: false, errors };
+}
+
+// src/domains/auth/store/saveTokens.ts
+import { randomUUID } from "node:crypto";
+import { join as join7 } from "node:path";
+import { Entry as Entry4 } from "@napi-rs/keyring";
+async function saveToFile2(configDir, tokens, fs) {
+  await fs.mkdir(configDir, { recursive: true, mode: 448 });
+  const target = join7(configDir, tokensFile);
+  const staging = `${target}.${randomUUID()}.tmp`;
+  try {
+    await fs.writeFile(staging, JSON.stringify(tokens, undefined, 2), {
+      mode: 384
+    });
+    await fs.rename(staging, target);
+  } catch (err) {
+    await fs.unlink(staging).catch(() => {});
+    throw err;
+  }
+}
+async function saveTokens(configDir, tokens, fs) {
+  try {
+    new Entry4(service, tokensAccount).setPassword(JSON.stringify(tokens));
+    return { stored: "keychain" };
+  } catch (err) {
+    try {
+      new Entry4(service, tokensAccount).deletePassword();
+    } catch {}
+    await saveToFile2(configDir, tokens, fs);
+    return { stored: "file", keychainError: errorMessage(err) };
+  }
+}
+
+// src/domains/auth/resolveOauthToken.ts
+var expiryMarginMs = 30000;
+async function resolveOauthToken(configDir, deps) {
+  const stored = await deps.loadTokens(configDir);
+  if (!stored.found)
+    return;
+  const { tokens } = stored;
+  const expiresAt = tokens.expiresAt;
+  const isFresh = expiresAt !== undefined && expiresAt - expiryMarginMs > deps.now();
+  if (isFresh) {
+    return {
+      key: tokens.accessToken,
+      email: tokens.email,
+      workspaceId: tokens.workspaceId
+    };
+  }
+  const refreshed = await deps.refreshTokens({
+    refreshToken: tokens.refreshToken,
+    organizationId: tokens.organizationId,
+    clientId: tokens.clientId
+  });
+  if (!refreshed.ok) {
+    if (refreshed.retryable && expiresAt !== undefined && expiresAt > deps.now()) {
+      return {
+        key: tokens.accessToken,
+        email: tokens.email,
+        workspaceId: tokens.workspaceId
+      };
+    }
+    const current = await deps.loadTokens(configDir);
+    if (current.found && current.tokens.refreshToken !== tokens.refreshToken && current.tokens.email === tokens.email && current.tokens.organizationId === tokens.organizationId && current.tokens.clientId === tokens.clientId && current.tokens.expiresAt !== undefined && current.tokens.expiresAt > deps.now()) {
+      return {
+        key: current.tokens.accessToken,
+        email: current.tokens.email,
+        workspaceId: current.tokens.workspaceId
+      };
+    }
+    return;
+  }
+  try {
+    await deps.saveTokens(configDir, {
+      ...refreshed.value,
+      workspaceId: tokens.workspaceId,
+      clientId: tokens.clientId
+    });
+  } catch {}
+  return {
+    key: refreshed.value.accessToken,
+    email: refreshed.value.email,
+    workspaceId: tokens.workspaceId
+  };
+}
+
 // src/domains/auth/resolve.ts
+function makeOauthDeps(fs) {
+  return {
+    loadTokens: (configDir) => loadTokens(configDir, { EntryClass: Entry5, fs }),
+    refreshTokens: async ({ refreshToken, organizationId, clientId }) => {
+      const config = resolveWorkosConfig(clientId);
+      if (!config.configured) {
+        return {
+          ok: false,
+          error: authErrorMessages.workos.noClientForSession,
+          retryable: false
+        };
+      }
+      return refreshAccessToken(refreshToken, organizationId, {
+        fetch: globalThis.fetch,
+        baseUrl: config.baseUrl,
+        clientId: config.clientId
+      });
+    },
+    saveTokens: (configDir, tokens) => saveTokens(configDir, tokens, fs),
+    now: () => Date.now()
+  };
+}
 function makeDefaultDeps(fs) {
   return {
-    loadApiKey: (configDir) => loadApiKey(configDir, { EntryClass: Entry3, fs }),
+    loadApiKey: (configDir) => loadApiKey(configDir, { EntryClass: Entry5, fs }),
+    resolveOauth: (configDir) => resolveOauthToken(configDir, makeOauthDeps(fs)),
     env: process.env
   };
 }
@@ -14481,11 +14899,19 @@ async function resolveApiKey(configDir, fs, deps) {
   const resolvedDeps = deps ?? makeDefaultDeps(fs);
   const envKey = resolvedDeps.env["QAWOLF_API_KEY"];
   if (envKey?.trim()) {
-    return { key: envKey.trim(), source: "env" };
+    return { key: envKey.trim(), source: "env", workspaceId: undefined };
   }
   const stored = await resolvedDeps.loadApiKey(configDir);
   if (stored.found) {
-    return { key: stored.key, source: stored.source };
+    return { key: stored.key, source: stored.source, workspaceId: undefined };
+  }
+  const oauth = await resolvedDeps.resolveOauth(configDir);
+  if (oauth) {
+    return {
+      key: oauth.key,
+      source: "browser",
+      workspaceId: oauth.workspaceId
+    };
   }
   return;
 }
@@ -14507,9 +14933,9 @@ async function validateApiKey(deps) {
 // src/shell/logger.ts
 var import_pino = __toESM(require_pino(), 1);
 import { mkdirSync as mkdirSync2, openSync } from "node:fs";
-import { dirname, join as join5 } from "node:path";
+import { dirname, join as join8 } from "node:path";
 function defaultLogPath() {
-  return join5(envPaths("qawolf", { suffix: "" }).log, "cli.log");
+  return join8(envPaths("qawolf", { suffix: "" }).log, "cli.log");
 }
 function resolveStderrLevel(env, verbose) {
   if (verbose)
@@ -14577,9 +15003,179 @@ function createLoggingSystem(opts) {
   };
 }
 
-// src/shell/platform/parseErrorBody.ts
-var defaultMaxLength = 1024;
-function asRecord(value) {
+// src/core/publicApi/flagKind.ts
+function flagKind(schema) {
+  if (schema.type === "string")
+    return { ok: true, kind: "string" };
+  if (schema.type === "number" || schema.type === "integer") {
+    return { ok: true, kind: "number" };
+  }
+  if (schema.type === "boolean")
+    return { ok: true, kind: "boolean" };
+  if (schema.type === "array") {
+    if (schema.items?.type !== "string") {
+      return {
+        ok: false,
+        reason: "only string arrays can be expressed as flags"
+      };
+    }
+    return { ok: true, kind: "string-array" };
+  }
+  if (schema.type === "object") {
+    if (schema.properties) {
+      return {
+        ok: false,
+        reason: "nested objects cannot be expressed as flags"
+      };
+    }
+    if (typeof schema.additionalProperties === "object" && schema.additionalProperties.type === "string") {
+      return { ok: true, kind: "key-value-record" };
+    }
+    return { ok: false, reason: "nested objects cannot be expressed as flags" };
+  }
+  return {
+    ok: false,
+    reason: `type ${schema.type ?? "unknown"} cannot be expressed as a flag`
+  };
+}
+
+// src/core/publicApi/objectShape.ts
+var asObjectShape = (schema) => schema.type === "object" && schema.properties ? { properties: schema.properties, required: new Set(schema.required) } : undefined;
+function mergeIntersection(members) {
+  const shape = { properties: {}, required: new Set };
+  for (const member of members) {
+    const memberShape = asObjectShape(member);
+    if (!memberShape) {
+      return {
+        ok: false,
+        field: "",
+        reason: "intersection members must be object schemas"
+      };
+    }
+    for (const [field, fieldSchema] of Object.entries(memberShape.properties)) {
+      if (field in shape.properties) {
+        return {
+          ok: false,
+          field,
+          reason: "field appears in multiple intersection members"
+        };
+      }
+      shape.properties[field] = fieldSchema;
+      if (memberShape.required.has(field))
+        shape.required.add(field);
+    }
+  }
+  return { ok: true, shape };
+}
+function mergeUnion(branches) {
+  const shapes = [];
+  for (const branch of branches) {
+    const branchShape = asObjectShape(branch);
+    if (!branchShape) {
+      return {
+        ok: false,
+        field: "",
+        reason: "union branches must be object schemas"
+      };
+    }
+    shapes.push(branchShape);
+  }
+  const shape = { properties: {}, required: new Set };
+  for (const branchShape of shapes) {
+    for (const [field, fieldSchema] of Object.entries(branchShape.properties)) {
+      const existing = shape.properties[field];
+      if (!existing) {
+        shape.properties[field] = { ...fieldSchema };
+        continue;
+      }
+      const kinds = [flagKind(existing), flagKind(fieldSchema)];
+      if (kinds[0]?.ok && kinds[1]?.ok) {
+        if (kinds[0].kind !== kinds[1].kind) {
+          return {
+            ok: false,
+            field,
+            reason: "field has conflicting types across union branches"
+          };
+        }
+      } else if (JSON.stringify({ ...existing, description: undefined }) !== JSON.stringify({ ...fieldSchema, description: undefined })) {
+        return {
+          ok: false,
+          field,
+          reason: "field has conflicting object schemas across union branches"
+        };
+      }
+      if (!existing.description && fieldSchema.description) {
+        existing.description = fieldSchema.description;
+      }
+    }
+  }
+  const discriminator = Object.keys(shape.properties).find((field) => {
+    const values = shapes.map((branch) => branch.properties[field]?.const);
+    return values.every((value) => typeof value === "string") && new Set(values).size === shapes.length && shapes.every((branch) => branch.required.has(field));
+  });
+  for (const [field, fieldSchema] of Object.entries(shape.properties)) {
+    const occurrences = shapes.filter((branch) => (field in branch.properties));
+    if (occurrences.length === shapes.length && occurrences.every((branch) => branch.required.has(field))) {
+      shape.required.add(field);
+    }
+    if (field === discriminator) {
+      const values = shapes.map((branch) => branch.properties[field]?.const);
+      fieldSchema.description = `One of: ${values.join(", ")}`;
+    }
+  }
+  return { ok: true, shape };
+}
+function toObjectShape(schema) {
+  if (schema.allOf)
+    return mergeIntersection(schema.allOf);
+  const branches = schema.oneOf ?? schema.anyOf;
+  if (branches)
+    return mergeUnion(branches);
+  const shape = asObjectShape(schema);
+  if (shape)
+    return { ok: true, shape };
+  return {
+    ok: false,
+    field: "",
+    reason: "contract input must be an object schema"
+  };
+}
+
+// src/shell/platform/applyWorkspaceId.ts
+var acceptsWorkspace = new WeakMap;
+function takesWorkspaceId(inputSchema) {
+  const cached = acceptsWorkspace.get(inputSchema);
+  if (cached !== undefined)
+    return cached;
+  let accepted = false;
+  try {
+    const jsonSchema = toJSONSchema(inputSchema, {
+      io: "input"
+    });
+    const shape = toObjectShape(jsonSchema);
+    accepted = shape.ok && "workspaceId" in shape.shape.properties;
+  } catch {
+    accepted = false;
+  }
+  acceptsWorkspace.set(inputSchema, accepted);
+  return accepted;
+}
+function applyWorkspaceId(inputSchema, input, workspaceId) {
+  if (!workspaceId)
+    return input;
+  if (typeof input !== "object" || input === null)
+    return input;
+  const existing = input.workspaceId;
+  if (existing !== undefined)
+    return input;
+  if (!takesWorkspaceId(inputSchema))
+    return input;
+  return { ...input, workspaceId };
+}
+
+// src/shell/platform/parseErrorBody.ts
+var defaultMaxLength = 1024;
+function asRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
 }
 function asString(value) {
@@ -14743,7 +15339,7 @@ function callPublicApi(trpc, contract, input, options) {
 }
 function makeCallPublicApiMethod(trpc, deps, readBackoffMs) {
   return async (contract, input, options) => requestWithRetry({
-    call: () => callPublicApi(trpc, contract, input, options),
+    call: () => callPublicApi(trpc, contract, applyWorkspaceId(contract.input, input, deps.workspaceId), options),
     backoffMs: contract.kind === "read" ? readBackoffMs : [],
     describe: (err) => describeRequestError(err, deps.baseUrl, contract.name),
     sleep: deps.sleep
@@ -15646,7 +16242,7 @@ function summarize(error) {
 // src/shell/platform/downloadBundle.ts
 import { randomBytes } from "node:crypto";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join6 } from "node:path";
+import { join as join9 } from "node:path";
 
 // src/shell/platform/fetchSignedUrl.ts
 var defaultStallTimeoutMs = 30000;
@@ -15734,7 +16330,7 @@ async function fetchSignedUrl(args, deps = { fetch: globalThis.fetch }) {
 
 // src/shell/platform/downloadBundle.ts
 async function downloadBundle(signedUrl, deps) {
-  const tmpArchive = join6(tmpdir2(), `qawolf-pull-${randomBytes(8).toString("hex")}.tar.gz`);
+  const tmpArchive = join9(tmpdir2(), `qawolf-pull-${randomBytes(8).toString("hex")}.tar.gz`);
   const result = await fetchSignedUrl({ url: signedUrl, dest: tmpArchive }, { fetch: deps.fetch, fs: deps.fs });
   if (!result.ok) {
     await deps.fs.unlink(tmpArchive).catch(() => {});
@@ -15795,6 +16391,10 @@ var makeEmailResourceSchema = () => resource({
   replyTo: array(namedAddressSchema).optional(),
   text: string2().optional().describe("The plain text body.")
 }, { urlFieldDescription: emailUrlFieldDescription });
+var makeEmailAddressResourceSchema = () => resource({
+  address: string2().describe("The inbox address. Mail sent to any plus-suffixed form, such as inbox+abc@example.com, lands in the same inbox."),
+  isDefault: boolean2().describe("Whether this is the workspace's default inbox address.")
+}, { urlFieldDescription: emailUrlFieldDescription });
 
 // node_modules/@qawolf/api-contracts/dist/v1/identity/organization.js
 var identityOrganization = object({
@@ -15838,6 +16438,10 @@ var identityResponse = union([
     user: never().optional()
   }).transform(({ organization }) => ({ organization }))
 ]);
+// node_modules/@qawolf/api-contracts/dist/v1/identity/organizations.js
+var identityOrganizationsResponse = object({
+  organizations: array(identityOrganization)
+});
 // node_modules/@qawolf/api-contracts/dist/v1/ids.js
 var defaultIdSchemas = {
   aiTask: string2().min(1).describe("The id of the AI task."),
@@ -16014,6 +16618,8 @@ var runnerNameSchema = _enum([
   "android",
   "ios"
 ]);
+var runnerWorkspaceRequirement = "Required when the credential is not bound to a single workspace, such as a user API key or an OAuth connection whose organization owns several.";
+var runnerWorkspaceIdDescription = `The workspace the runner belongs to. ${runnerWorkspaceRequirement}`;
 var runnerIdSchema = string2().min(1).max(63).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, "A runner id may contain only lowercase letters, digits and dashes, and must start and end with a letter or digit.");
 var makeRunnerSchema = () => object({
   gpuAccelerated: boolean2().describe("Whether the runner was placed on GPU hardware. Chosen by QA Wolf from the team's configuration and what the fleet can provide, not requested."),
@@ -16041,10 +16647,11 @@ var inspectRequestSchema = discriminatedUnion("what", [
     what: literal("variable")
   })
 ]);
-var makeInspectOnRunnerContract = () => {
+var makeInspectOnRunnerContract = (ids) => {
   const input = object({
     id: runnerIdSchema.describe("Id of the runner to inspect."),
-    request: inspectRequestSchema
+    request: inspectRequestSchema,
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({
@@ -16191,10 +16798,11 @@ var inspectMobileAnswerSchema = discriminatedUnion("what", [
     what: literal("elements")
   })
 ]);
-var makeInspectMobileOnRunnerContract = () => {
+var makeInspectMobileOnRunnerContract = (ids) => {
   const input = object({
     id: runnerIdSchema.describe("Id of the runner to inspect."),
-    request: inspectMobileRequestSchema
+    request: inspectMobileRequestSchema,
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     inspectMobileAnswerSchema,
@@ -16278,20 +16886,26 @@ var screenFailureReasons = [
 var screenNotReadyDescription = "`screen-not-ready` if the runner has a screen that cannot serve this instant. Retry in a second or two: the desktop restarts when a run changes the display size, and it serves one see-or-act request at a time, so a screenshot or action already in flight is the usual reason. Do not submit a run to clear this — a run may restart the display and discard what is on it.";
 var screenNeedsARunDescription = "`screen-needs-a-run` if the runner's virtual desktop has never started. Waiting will not change this and retrying is pointless — call `runner.runFlow` with a flow that opens a browser, then ask for the screen again. On a runner image with a browser that has never run anything, any `runner.performAction` also starts the browser itself. Evaluating a snippet does not start the desktop.";
 var runnerHasNoScreenDescription = "`runner-has-no-screen` if this runner is not one that runs a browser on a virtual desktop. Nothing about it can be seen or driven, and retrying will never help — launch a `playwright` runner instead.";
+var screenshotImageSchema = string2().min(1).describe("The screenshot, as a base64-encoded JPEG. Decode it and write the bytes to a `.jpg` file — writing this string to the file leaves you with base64 text rather than an image.");
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/performAction.js
 var unreachableDescription = "`runner-unreachable` if the runner could not be reached: it may still be starting, it may have terminated after inactivity, or it may have stopped answering mid-action. This does not mean the action was not performed — take a screenshot before repeating it.";
 var notSupportedOnMobileDescription = "`action-not-supported-on-mobile` if the runner is a mobile device and this action has no touchscreen equivalent: `double_click`, `scroll`, `move`, `keypress` and `navigate`, and a `click` whose `button` is not `left`, are all pointer-device concepts a touchscreen has nothing to offer for. `click` taps, `drag` swipes between its path's first and last point, and `type` types into whatever the last tap focused.";
+var withScreenshotDescription = "With `withScreenshot: true`, the answer also carries `imageJpegBase64`: a screenshot taken after the action, once the screen has changed from just before it or half a second has passed, whichever comes first. One call instead of `runner.performAction` followed by `runner.takeScreenshot`, with no fixed wait in between. Anything animating on the page counts as a change. The action itself is performed exactly as without the option; if the screen could serve no frame after it — a display restart, or a `navigate` on a desktop that is still starting — the action's result comes back without `imageJpegBase64`, so take a screenshot separately rather than repeating the action. On a mobile runner the screenshot is the device's own, taken right after a performed action.";
 var maxActionErrorMessageLength = 1000;
-var makePerformActionOnRunnerContract = () => {
+var makePerformActionOnRunnerContract = (ids) => {
   const input = object({
     action: browserActionSchema.describe("The action to perform. Coordinates are pixels on the screenshot's own coordinate space."),
-    id: runnerIdSchema.describe("Id of the runner to act on.")
+    id: runnerIdSchema.describe("Id of the runner to act on."),
+    withScreenshot: boolean2().optional().describe("Also answer with a screenshot taken after the action, once the screen has changed or half a second has passed. Saves the separate `runner.takeScreenshot` call and its fixed wait."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
+  const screenshotAfterAction = screenshotImageSchema.optional();
   const failure = discriminatedUnion("failureReason", [
     object({
       errorMessage: string2().max(maxActionErrorMessageLength).describe("What stopped the action from taking effect."),
       failureReason: literal("action-failed"),
+      imageJpegBase64: screenshotAfterAction,
       outcome: literal("failure")
     }),
     makeRunnerFailureSchema([
@@ -16301,11 +16915,14 @@ var makePerformActionOnRunnerContract = () => {
     ])
   ]);
   const output = discriminatedUnion("outcome", [
-    object({ outcome: literal("success") }),
+    object({
+      imageJpegBase64: screenshotAfterAction,
+      outcome: literal("success")
+    }),
     failure
   ]);
   return {
-    description: `Perform one raw browser action on an interactive runner: click, double_click, move, drag, scroll, keypress, type, or navigate. Coordinates are whole pixels on the runner's virtual desktop, in the same space as \`runner.takeScreenshot\`. One action per request, and the runner serves one at a time. The action shapes follow the computer-use vocabulary, minus \`screenshot\` (use \`runner.takeScreenshot\`) and \`wait\` (delay on the caller's side). A success means the action took effect. \`action-failed\`, with a reason, if it reached the runner and did not take effect. On a runner image with a browser, the first action on a runner that has never run anything starts its browser and waits for it, so it can take up to a minute to answer — no \`runner.runFlow\` is needed before acting; if the browser is still starting when the wait runs out, the answer is \`screen-not-ready\` and retrying converges. On a mobile runner, the same \`screen-needs-a-run\` and \`screen-not-ready\` outcomes mean no Appium session has started yet, or it did not answer this instant; \`runner.runFlow\` is what starts one, same as a browser. \`screen-needs-a-run\` if the browser could not be started that way — usually a runner whose runs all finished without starting its desktop; call \`runner.runFlow\` with a flow that opens a browser. ${screenNotReadyDescription} A \`navigate\` does not go through the screen, so a screen that is not ready does not stop it. ${runnerHasNoScreenDescription} ${notSupportedOnMobileDescription} ${unreachableDescription}`,
+    description: `Perform one raw browser action on an interactive runner: click, double_click, move, drag, scroll, keypress, type, or navigate. Coordinates are whole pixels on the runner's virtual desktop, in the same space as \`runner.takeScreenshot\`. One action per request, and the runner serves one at a time. The action shapes follow the computer-use vocabulary, minus \`screenshot\` (use \`runner.takeScreenshot\`) and \`wait\` (delay on the caller's side). A success means the action took effect. \`action-failed\`, with a reason, if it reached the runner and did not take effect. On a runner image with a browser, the first action on a runner that has never run anything starts its browser and waits for it, so it can take up to a minute to answer — no \`runner.runFlow\` is needed before acting; if the browser is still starting when the wait runs out, the answer is \`screen-not-ready\` and retrying converges. On a mobile runner, the same \`screen-needs-a-run\` and \`screen-not-ready\` outcomes mean no Appium session has started yet, or it did not answer this instant; \`runner.runFlow\` is what starts one, same as a browser. \`screen-needs-a-run\` if the browser could not be started that way — usually a runner whose runs all finished without starting its desktop; call \`runner.runFlow\` with a flow that opens a browser. ${screenNotReadyDescription} A \`navigate\` does not go through the screen, so a screen that is not ready does not stop it. ${runnerHasNoScreenDescription} ${notSupportedOnMobileDescription} ${withScreenshotDescription} ${unreachableDescription}`,
     input,
     kind: "write",
     name: "runner.performAction",
@@ -16331,9 +16948,11 @@ var makeAgentGetContract = (ids) => {
     replies: array(agentReplySchema).describe("Everything the AI has said so far, oldest first. A reply carrying choices is a question the work is blocked on."),
     sessionId: ids.chatSession,
     status: agentSessionStatusSchema
-  }, { urlFieldDescription: "Absolute URL of the session in the QA Wolf app." });
+  }, {
+    urlFieldDescription: "Absolute URL of the live session in the QA Wolf app."
+  });
   return {
-    description: 'Read what the QA Wolf AI has said and whether it is still working. Poll this after agent.send until the status settles. A status of "waiting-for-you" means the last reply is a question the work is blocked on, and answering it with agent.send is what unblocks it. Replies accumulate, so a caller that polls repeatedly sees the earlier ones again.',
+    description: 'Monitor a QA Wolf AI session by reading its status and replies. After agent.send, share the returned session URL before monitoring. Wait 30 to 60 seconds between checks; do not call this in a tight loop. Replies accumulate, so compare them with what you have already seen. Continue monitoring silently when the status and replies are unchanged; do not narrate waiting, announce the next check, or ask whether to keep monitoring. Report only substantive new progress, questions, blockers, or the final outcome. A status of "waiting-for-you" means the last reply is a question the work is blocked on, and answering it with agent.send is what unblocks it. Surface an explicit request for user input even if the status still says "working". Include the session URL when reporting a blocker or final outcome. On "completed", stop status checks and verify the requested result before claiming success. For new flows, validation, publication in the target environment, and readiness are separate checks; a Git push or final reply does not prove the flow is active. If every requested result is verified but status remains "working", report the mismatch and stop monitoring. Stop on "failed" or "cancelled" and report any confirmed partial result.',
     input,
     kind: "read",
     name: "agent.get",
@@ -16352,9 +16971,11 @@ var makeAgentSendContract = (ids) => {
   const output = resource({
     sessionId: ids.chatSession.describe("Follow the work by passing this to agent.get."),
     status: agentSessionStatusSchema
-  }, { urlFieldDescription: "Absolute URL of the session in the QA Wolf app." });
+  }, {
+    urlFieldDescription: "Absolute URL of the live session in the QA Wolf app."
+  });
   return {
-    description: "Ask the QA Wolf AI to do a piece of work in plain language, such as covering a user journey, investigating a failing run, or fixing a broken flow. This is the one verb that starts work from nothing: every other write acts on a flow, run or issue that already exists. Answers as soon as the request is accepted, with the id to follow it by, because the work runs for minutes to tens of minutes. Poll agent.get for progress, and send here again to answer a question or add context to work already running.",
+    description: "Start or continue work with the QA Wolf AI and return a live session URL to share with the user. Use it to cover a user journey, investigate a failing run, or fix a broken flow. This is the one verb that starts work from nothing: every other write acts on a flow, run or issue that already exists. Returns sessionId, status, and url as soon as the request is accepted; work can take minutes to tens of minutes. After each send, make the next action a normal user-visible assistant message containing the exact returned url, before any tool call or wait. Tool output and internal reasoning do not count as sharing the link. Do not run a timer or monitoring call alongside this send. Acceptance does not mean the work is complete. Then monitor the session with agent.get, reporting new progress, blockers, and the final outcome rather than unchanged status. Send here again to answer a question or add context to the same session.",
     input,
     kind: "write",
     name: "agent.send",
@@ -16457,10 +17078,7 @@ var makeListEmailAddressesContract = (ids) => {
     ...makePaginationInputFields({ defaultLimit: 20, maxLimit: 50 })
   });
   const output = object({
-    addresses: array(resource({
-      address: string2().describe("The inbox address. Mail sent to any plus-suffixed form, such as inbox+abc@example.com, lands in the same inbox."),
-      isDefault: boolean2().describe("Whether this is the workspace's default inbox address.")
-    }, { urlFieldDescription: emailUrlFieldDescription })).describe("The workspace's permanent inbox addresses, alphabetical."),
+    addresses: array(makeEmailAddressResourceSchema()).describe("The workspace's permanent inbox addresses, alphabetical."),
     nextCursor: nextCursorSchema
   });
   return {
@@ -16472,6 +17090,28 @@ var makeListEmailAddressesContract = (ids) => {
   };
 };
 
+// node_modules/@qawolf/api-contracts/dist/v1/email/registerAddress.js
+var hasNoPlusSuffix = (address) => {
+  const [localPart] = address.split("@");
+  return localPart !== undefined && !localPart.includes("+");
+};
+var makeRegisterEmailAddressContract = (ids) => {
+  const input = object({
+    address: email2().refine(hasNoPlusSuffix, {
+      message: "Register the base address. Mail to a plus-suffixed form lands in the base inbox."
+    }).describe("The inbox address to register. Its domain must be one QA Wolf serves for the workspace."),
+    workspaceId: ids.workspace.optional().describe("The workspace to register the address in. Required when authenticating with an organization or user API key.")
+  });
+  const output = makeEmailAddressResourceSchema();
+  return {
+    description: "Register an inbox address for the workspace. Registering an address the workspace already has changes nothing. A refusal names the domains the workspace can use.",
+    input,
+    kind: "write",
+    name: "email.registerAddress",
+    output
+  };
+};
+
 // node_modules/@qawolf/api-contracts/dist/v1/email/send.js
 var recipientsSchema = array(email2()).max(50);
 var maxAttachments = 10;
@@ -17112,14 +17752,31 @@ var makeReattemptRunContract = (ids) => {
   };
 };
 
+// node_modules/@qawolf/api-contracts/dist/v1/run/stop.js
+var makeStopRunContract = (ids) => {
+  const input = object({ runId: ids.run });
+  const output = resource({
+    runId: ids.run,
+    status: _enum(["accepted", "already-finished", "execution-not-found"]).describe('"accepted" means stopping was requested; poll run.get for the final result. "already-finished" means the run has already finished and its result is unchanged. "execution-not-found" means the run exists but no execution was found to stop; it may still be starting or may no longer be available. No stop request was accepted in that case.')
+  }, { urlFieldDescription: "Absolute URL of the run page." });
+  return {
+    description: "Stop a run, including its queued flows and automatic retries. Stopping is asynchronous. Repeated requests are safe, and finished runs keep their results. A run that is still being created returns not found; retry once run.get returns the run. If run.get returns a different runId, use that ID. Poll run.get for results.",
+    input,
+    kind: "write",
+    name: "run.stop",
+    output
+  };
+};
+
 // node_modules/@qawolf/api-contracts/dist/v1/runner/evaluateSnippet.js
 var maxSnippetCodeLength = 64 * 1024;
-var makeEvaluateSnippetOnRunnerContract = () => {
+var makeEvaluateSnippetOnRunnerContract = (ids) => {
   const input = object({
     code: string2().min(1).max(maxSnippetCodeLength).describe("The code to evaluate against the runner's live page, in the scope of `filePath` when one is given."),
     filePath: runFilePathSchema.optional().describe("Path of the file the snippet is evaluated in the scope of. Omit to evaluate a snippet that imports nothing of yours."),
     files: runFilesSchema.optional().describe("The file named by `filePath` and everything it imports. A runner holds no copy of your project, so a snippet's scope has to travel with it."),
-    id: runnerIdSchema.describe("Id of the runner to evaluate the snippet on.")
+    id: runnerIdSchema.describe("Id of the runner to evaluate the snippet on."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   }).refine((request) => request.filePath === undefined || Object.hasOwn(request.files ?? {}, request.filePath), {
     error: "A snippet naming a file must carry that file in files.",
     path: ["files"]
@@ -17145,9 +17802,10 @@ var makeEvaluateSnippetOnRunnerContract = () => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/get.js
-var makeGetRunnerContract = () => {
+var makeGetRunnerContract = (ids) => {
   const input = object({
-    id: runnerIdSchema.describe("Id of the runner to look up.")
+    id: runnerIdSchema.describe("Id of the runner to look up."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = object({
     id: runnerIdSchema.describe("Id of the runner the call addressed."),
@@ -17165,10 +17823,11 @@ var makeGetRunnerContract = () => {
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/highlightSelector.js
 var maxHighlightSelectorLength = 2000;
-var makeHighlightSelectorOnRunnerContract = () => {
+var makeHighlightSelectorOnRunnerContract = (ids) => {
   const input = object({
     id: runnerIdSchema.describe("Id of the runner to highlight on."),
-    selector: string2().max(maxHighlightSelectorLength).describe("The selector to highlight. An empty string clears whatever is highlighted.")
+    selector: string2().max(maxHighlightSelectorLength).describe("The selector to highlight. An empty string clears whatever is highlighted."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({
@@ -17203,12 +17862,13 @@ var makeHighlightSelectorOnRunnerContract = () => {
 // node_modules/@qawolf/api-contracts/dist/v1/runner/importPackage.js
 var maxPackageNameLength = 214;
 var maxPackageVersionLength = 256;
-var makeImportPackageOnRunnerContract = () => {
+var makeImportPackageOnRunnerContract = (ids) => {
   const input = object({
     id: runnerIdSchema.describe("Id of the runner to install into."),
     npmDependencies: record(string2(), string2()).describe("The run's current npm dependencies, so the install resolves against them."),
     packageName: string2().min(1).max(maxPackageNameLength),
-    packageVersion: string2().min(1).max(maxPackageVersionLength)
+    packageVersion: string2().min(1).max(maxPackageVersionLength),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({ outcome: literal("success") }),
@@ -17228,10 +17888,11 @@ var makeImportPackageOnRunnerContract = () => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/index.js
-var makeLaunchRunnerContract = () => {
+var makeLaunchRunnerContract = (ids) => {
   const input = object({
     id: runnerIdSchema.describe("Id to launch the runner under, chosen by the caller. Launching the same id again returns the runner already running under it."),
-    runnerName: runnerNameSchema.optional().describe("The runner family to launch. Defaults to the standard web family, playwright.")
+    runnerName: runnerNameSchema.optional().describe("The runner family to launch. Defaults to the standard web family, playwright."),
+    workspaceId: ids.workspace.optional().describe(`The workspace to launch the runner in. ${runnerWorkspaceRequirement}`)
   });
   const output = makeRunnerSchema().extend({
     alreadyRunning: boolean2().describe("True when a runner was already running under this id and was returned unchanged, so no second runner was started and nothing new is billed. Not an error either way."),
@@ -17245,9 +17906,10 @@ var makeLaunchRunnerContract = () => {
     output
   };
 };
-var makeTerminateRunnerContract = () => {
+var makeTerminateRunnerContract = (ids) => {
   const input = object({
-    id: runnerIdSchema.describe("Id of the runner to terminate.")
+    id: runnerIdSchema.describe("Id of the runner to terminate."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = object({
     id: runnerIdSchema.describe("Id of the runner the call addressed."),
@@ -17264,14 +17926,16 @@ var makeTerminateRunnerContract = () => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/list.js
-var makeListRunnersContract = () => {
-  const input = object({});
+var makeListRunnersContract = (ids) => {
+  const input = object({
+    workspaceId: ids.workspace.optional().describe(`The workspace whose runners to list. ${runnerWorkspaceRequirement}`)
+  });
   const output = object({
     outcome: literal("success"),
     runners: array(makeRunnerSchema()).describe("The runners running right now, in no particular order. Each entry carries the same fields a launch reports, so any of them can be addressed like a runner you launched yourself.")
   });
   return {
-    description: "List the runners running on the caller's team right now. Takes no arguments: the API key already names the team. A runner that was terminated, or that terminated on its own after inactivity, is not listed, because the run system keeps no record of a runner once it is gone. This is a lookup: it never starts a runner, and it does not reset a runner's inactivity clock the way reading its journal does. It is how to find a runner launched from another machine or in an earlier session, when the id it was launched under is no longer at hand.",
+    description: "List the runners running on the caller's team right now. A team API key already names the team and sends nothing; a credential bound to no single workspace names one in `workspaceId`. A runner that was terminated, or that terminated on its own after inactivity, is not listed, because the run system keeps no record of a runner once it is gone. This is a lookup: it never starts a runner, and it does not reset a runner's inactivity clock the way reading its journal does. It is how to find a runner launched from another machine or in an earlier session, when the id it was launched under is no longer at hand.",
     input,
     kind: "read",
     name: "runner.list",
@@ -17281,11 +17945,12 @@ var makeListRunnersContract = () => {
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/promoteSnapshot.js
 var maxSnapshotPathLength = 1024;
-var makePromoteSnapshotOnRunnerContract = () => {
+var makePromoteSnapshotOnRunnerContract = (ids) => {
   const input = object({
     baselinePath: string2().min(1).max(maxSnapshotPathLength).describe("The baseline to replace, as named in the image diff."),
     id: runnerIdSchema.describe("Id of the runner holding the screenshot."),
-    screenshotPath: string2().min(1).max(maxSnapshotPathLength).describe("The screenshot to promote, as named in the image diff.")
+    screenshotPath: string2().min(1).max(maxSnapshotPathLength).describe("The screenshot to promote, as named in the image diff."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({ outcome: literal("success") }),
@@ -17308,10 +17973,11 @@ var makePromoteSnapshotOnRunnerContract = () => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/readJournal.js
-var makeReadRunnerJournalContract = () => {
+var makeReadRunnerJournalContract = (ids) => {
   const input = readJournalRequestSchema.extend({
     id: runnerIdSchema.describe("Id of the runner to read the journal of."),
-    stream: journalStreamSchema.describe(`The stream to read. QA Wolf writes ${knownJournalStreams.join(", ")}; an unwritten stream reads as empty rather than as an error.`)
+    stream: journalStreamSchema.describe(`The stream to read. QA Wolf writes ${knownJournalStreams.join(", ")}; an unwritten stream reads as empty rather than as an error.`),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     readJournalResponseSchema.extend({ outcome: literal("success") }),
@@ -17346,7 +18012,8 @@ var makeRunFlowOnRunnerContract = (ids) => {
     files: runFilesSchema.describe("Every file the run needs keyed by its path — the flow file, everything it imports, package.json and tsconfig.json. A runner holds no copy of your project, so what runs is exactly what is sent here."),
     id: runnerIdSchema.describe("Id of the runner to run the flow on."),
     selection: runSelectionSchema.optional().describe("Run only these lines, inside the page the runner is already on, instead of running the whole flow from a fresh browser. Omit to run the whole entry point."),
-    unchangedFiles: unchangedFilesSchema.optional().describe("Files this runner already holds from an earlier run, keyed by path with a hex SHA-256 of the content it should hold. Send this to make `files` only what changed. The runner refuses with `needs-full-sync` if it holds none of a referenced path, so it never runs something other than what was asked for. Omit it to send every file.")
+    unchangedFiles: unchangedFilesSchema.optional().describe("Files this runner already holds from an earlier run, keyed by path with a hex SHA-256 of the content it should hold. Send this to make `files` only what changed. The runner refuses with `needs-full-sync` if it holds none of a referenced path, so it never runs something other than what was asked for. Omit it to send every file."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   }).refine((request) => request.env === undefined || request.environmentId === undefined, {
     error: "Send env or environmentId, not both. An environment's variables are taken as they are stored, so there is no order in which the two would combine.",
     path: ["environmentId"]
@@ -17398,9 +18065,10 @@ var makeRunFlowOnRunnerContract = (ids) => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/stopRun.js
-var makeStopRunOnRunnerContract = () => {
+var makeStopRunOnRunnerContract = (ids) => {
   const input = object({
-    id: runnerIdSchema.describe("Id of the runner to stop the run on.")
+    id: runnerIdSchema.describe("Id of the runner to stop the run on."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({
@@ -17419,13 +18087,14 @@ var makeStopRunOnRunnerContract = () => {
 };
 
 // node_modules/@qawolf/api-contracts/dist/v1/runner/takeScreenshot.js
-var makeTakeScreenshotOnRunnerContract = () => {
+var makeTakeScreenshotOnRunnerContract = (ids) => {
   const input = object({
-    id: runnerIdSchema.describe("Id of the runner to take a screenshot of.")
+    id: runnerIdSchema.describe("Id of the runner to take a screenshot of."),
+    workspaceId: ids.workspace.optional().describe(runnerWorkspaceIdDescription)
   });
   const output = discriminatedUnion("outcome", [
     object({
-      imageJpegBase64: string2().min(1).describe("The screenshot, as a base64-encoded JPEG. Decode it and write the bytes to a `.jpg` file — writing this string to the file leaves you with base64 text rather than an image."),
+      imageJpegBase64: screenshotImageSchema,
       outcome: literal("success")
     }),
     makeRunnerFailureSchema([
@@ -17479,6 +18148,7 @@ var makeContractsV1 = (ids) => {
       get: makeGetEmailContract(resolvedIds),
       getAttachment: makeGetEmailAttachmentContract(resolvedIds),
       listAddresses: makeListEmailAddressesContract(resolvedIds),
+      registerAddress: makeRegisterEmailAddressContract(resolvedIds),
       send: makeSendEmailContract(resolvedIds)
     },
     environment: {
@@ -17510,24 +18180,25 @@ var makeContractsV1 = (ids) => {
       diagnose: makeDiagnoseRunContract(resolvedIds),
       find: makeFindRunsContract(resolvedIds),
       get: makeGetRunContract(resolvedIds),
-      reattempt: makeReattemptRunContract(resolvedIds)
+      reattempt: makeReattemptRunContract(resolvedIds),
+      stop: makeStopRunContract(resolvedIds)
     },
     runner: {
-      evaluateSnippet: makeEvaluateSnippetOnRunnerContract(),
-      get: makeGetRunnerContract(),
-      highlightSelector: makeHighlightSelectorOnRunnerContract(),
-      importPackage: makeImportPackageOnRunnerContract(),
-      inspect: makeInspectOnRunnerContract(),
-      inspectMobile: makeInspectMobileOnRunnerContract(),
-      launch: makeLaunchRunnerContract(),
-      list: makeListRunnersContract(),
-      performAction: makePerformActionOnRunnerContract(),
-      promoteSnapshot: makePromoteSnapshotOnRunnerContract(),
-      readJournal: makeReadRunnerJournalContract(),
+      evaluateSnippet: makeEvaluateSnippetOnRunnerContract(resolvedIds),
+      get: makeGetRunnerContract(resolvedIds),
+      highlightSelector: makeHighlightSelectorOnRunnerContract(resolvedIds),
+      importPackage: makeImportPackageOnRunnerContract(resolvedIds),
+      inspect: makeInspectOnRunnerContract(resolvedIds),
+      inspectMobile: makeInspectMobileOnRunnerContract(resolvedIds),
+      launch: makeLaunchRunnerContract(resolvedIds),
+      list: makeListRunnersContract(resolvedIds),
+      performAction: makePerformActionOnRunnerContract(resolvedIds),
+      promoteSnapshot: makePromoteSnapshotOnRunnerContract(resolvedIds),
+      readJournal: makeReadRunnerJournalContract(resolvedIds),
       runFlow: makeRunFlowOnRunnerContract(resolvedIds),
-      stopRun: makeStopRunOnRunnerContract(),
-      takeScreenshot: makeTakeScreenshotOnRunnerContract(),
-      terminate: makeTerminateRunnerContract()
+      stopRun: makeStopRunOnRunnerContract(resolvedIds),
+      takeScreenshot: makeTakeScreenshotOnRunnerContract(resolvedIds),
+      terminate: makeTerminateRunnerContract(resolvedIds)
     },
     tag: {
       create: makeCreateTagContract(resolvedIds),
@@ -17537,19 +18208,70 @@ var makeContractsV1 = (ids) => {
 };
 var publicContractsV1 = makeContractsV1(defaultIdSchemas);
 
+// src/shell/platform/organizations.ts
+function parseOrganizationsResponse(json) {
+  const parsed = identityOrganizationsResponse.safeParse(json);
+  return parsed.success ? parsed.data.organizations : undefined;
+}
+
+// src/shell/platform/getAccessibleOrganizations.ts
+var timeoutMs2 = 1e4;
+async function getAccessibleOrganizations(apiKey, deps) {
+  const url = `${deps.baseUrl}/api/v0/identity/organizations`;
+  let response;
+  try {
+    response = await deps.fetch(url, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(timeoutMs2)
+    });
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs2 } };
+    }
+    return { ok: false, error: { kind: "network", cause: toError(error) } };
+  }
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    return {
+      ok: false,
+      error: { kind: "http", status: response.status, body }
+    };
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs2 } };
+    }
+    json = undefined;
+  }
+  const organizations = parseOrganizationsResponse(json);
+  if (!organizations) {
+    return {
+      ok: false,
+      error: {
+        kind: "parse",
+        cause: Error("organizations response did not match the contract")
+      }
+    };
+  }
+  return { ok: true, data: organizations };
+}
+
 // src/shell/platform/getIdentity.ts
-var timeoutMs = 1e4;
+var timeoutMs3 = 1e4;
 async function getIdentity(apiKey, deps) {
   const url = `${deps.baseUrl}/api/v0/identity`;
   let response;
   try {
     response = await deps.fetch(url, {
       headers: { Authorization: `Bearer ${apiKey}` },
-      signal: AbortSignal.timeout(timeoutMs)
+      signal: AbortSignal.timeout(timeoutMs3)
     });
   } catch (error) {
     if (isTimeoutError(error)) {
-      return { ok: false, error: { kind: "timeout", timeoutMs } };
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs3 } };
     }
     return {
       ok: false,
@@ -17568,7 +18290,7 @@ async function getIdentity(apiKey, deps) {
     json = await response.json();
   } catch (error) {
     if (isTimeoutError(error)) {
-      return { ok: false, error: { kind: "timeout", timeoutMs } };
+      return { ok: false, error: { kind: "timeout", timeoutMs: timeoutMs3 } };
     }
     json = undefined;
   }
@@ -17579,6 +18301,24 @@ async function getIdentity(apiKey, deps) {
   return { ok: true, data: parsed.data };
 }
 
+// src/shell/platform/identityMethods.ts
+function createIdentityMethods(apiKey, deps, backoffMs) {
+  return {
+    getIdentity: () => requestWithRetry({
+      call: () => getIdentity(apiKey, deps),
+      backoffMs,
+      describe: describeIdentityError,
+      sleep: deps.sleep
+    }),
+    getAccessibleOrganizations: () => requestWithRetry({
+      call: () => getAccessibleOrganizations(apiKey, deps),
+      backoffMs,
+      describe: describeIdentityError,
+      sleep: deps.sleep
+    })
+  };
+}
+
 // src/shell/platform/types.ts
 var environmentListItemSchema = object({
   envId: string2(),
@@ -17706,7 +18446,7 @@ function isUnsafeSegment(segment) {
 
 // src/shell/platform/teamStorageAssetSnapshot.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { join as join7, sep as sep2 } from "node:path";
+import { join as join10, sep as sep2 } from "node:path";
 function mintAssetSnapshotPath(assetsAbs, label) {
   return `${assetsAbs}.${label}-${randomBytes2(8).toString("hex")}`;
 }
@@ -17756,9 +18496,9 @@ function expectedEntries(filePaths) {
   return entries;
 }
 async function collectEntries(root, relDir, out, fs) {
-  const current = relDir ? join7(root, relDir) : root;
+  const current = relDir ? join10(root, relDir) : root;
   for (const entry of await fs.readdirWithTypes(current)) {
-    const relPath = relDir ? join7(relDir, entry.name) : entry.name;
+    const relPath = relDir ? join10(relDir, entry.name) : entry.name;
     out.add(relPath);
     if (entry.isDirectory()) {
       await collectEntries(root, relPath, out, fs);
@@ -17772,7 +18512,7 @@ function setsEqual(left, right) {
 }
 
 // src/shell/platform/teamStorageAssetReuse.ts
-import { join as join8 } from "node:path";
+import { join as join11 } from "node:path";
 async function reusableAssetPaths(assetsAbs, safeFiles, manifest, fs) {
   const reusable = new Set;
   for (const { file, relativePath } of safeFiles) {
@@ -17788,20 +18528,20 @@ async function canReuseAsset(assetsAbs, relativePath, file, manifest, fs) {
   const previous = manifest.get(relativePath);
   if (previous?.etag !== file.etag)
     return false;
-  return fs.pathExists(join8(assetsAbs, relativePath));
+  return fs.pathExists(join11(assetsAbs, relativePath));
 }
 
 // src/shell/platform/writeAssetSnapshot.ts
-import { dirname as dirname3, join as join9 } from "node:path";
+import { dirname as dirname3, join as join12 } from "node:path";
 async function writeAssetSnapshot(args) {
   let downloadedCount = 0;
   const total = args.safeFiles.filter(({ relativePath }) => !args.reusable.has(relativePath)).length;
   await args.deps.fs.mkdir(args.tmpAssets, { recursive: true });
   for (const { file, relativePath } of args.safeFiles) {
-    const dest = join9(args.tmpAssets, relativePath);
+    const dest = join12(args.tmpAssets, relativePath);
     await args.deps.fs.mkdir(dirname3(dest), { recursive: true });
     if (args.reusable.has(relativePath)) {
-      await args.deps.fs.copyFile(join9(args.assetsAbs, relativePath), dest);
+      await args.deps.fs.copyFile(join12(args.assetsAbs, relativePath), dest);
       continue;
     }
     args.deps.onProgress?.({ current: downloadedCount + 1, total });
@@ -17861,6 +18601,34 @@ async function writeTeamStorageAssets(args, deps) {
   }
 }
 
+// src/shell/platform/teamStorageMethods.ts
+function createTeamStorageMethods(trpc, deps, fs, getIdentity) {
+  async function list() {
+    if (deps.workspaceId !== undefined) {
+      return listTeamStorageFiles(trpc, { teamId: deps.workspaceId }, deps);
+    }
+    const identity = await getIdentity();
+    if (!identity.ok)
+      return identity;
+    if (!("team" in identity.value)) {
+      return {
+        ok: false,
+        error: flowsMessages.pull.teamStorageRequiresTeamKey
+      };
+    }
+    return listTeamStorageFiles(trpc, { teamId: identity.value.team.id }, deps);
+  }
+  return {
+    listTeamStorageFiles: list,
+    async syncTeamStorageAssets(assetsAbs, opts) {
+      const files = await list();
+      if (!files.ok)
+        return files;
+      return downloadTeamStorageAssets({ assetsAbs, files: files.value }, { fetch: deps.fetch, fs, onProgress: opts?.onProgress });
+    }
+  };
+}
+
 // src/shell/platform/createPlatformClient.ts
 var requestBackoffMs2 = [500, 1500];
 function createPlatformClient(apiKey, deps) {
@@ -17877,15 +18645,10 @@ function createPlatformClient(apiKey, deps) {
       return result;
     return { ok: true, value: { signedUrl: result.value.url } };
   }
+  const identityMethods = createIdentityMethods(apiKey, deps, requestBackoffMs2);
   return {
-    async getIdentity() {
-      return requestWithRetry({
-        call: () => getIdentity(apiKey, deps),
-        backoffMs: requestBackoffMs2,
-        describe: describeIdentityError,
-        sleep: deps.sleep
-      });
-    },
+    ...identityMethods,
+    ...createTeamStorageMethods(trpc, deps, fs, identityMethods.getIdentity),
     getFlowsBundleUrl: getFlowsBundleUrlImpl,
     callPublicApi: makeCallPublicApiMethod(trpc, deps, requestBackoffMs2),
     async getEnvVars(envId) {
@@ -17899,24 +18662,6 @@ function createPlatformClient(apiKey, deps) {
         return result;
       return { ok: true, value: result.value.environmentVariables };
     },
-    async listTeamStorageFiles() {
-      const identity = await this.getIdentity();
-      if (!identity.ok)
-        return identity;
-      if (!("team" in identity.value)) {
-        return {
-          ok: false,
-          error: flowsMessages.pull.teamStorageRequiresTeamKey
-        };
-      }
-      return listTeamStorageFiles(trpc, { teamId: identity.value.team.id }, deps);
-    },
-    async syncTeamStorageAssets(assetsAbs, opts) {
-      const files = await this.listTeamStorageFiles();
-      if (!files.ok)
-        return files;
-      return downloadTeamStorageAssets({ assetsAbs, files: files.value }, { fetch: deps.fetch, fs, onProgress: opts?.onProgress });
-    },
     async downloadBundle(envId) {
       const urlResult = await getFlowsBundleUrlImpl(envId);
       if (!urlResult.ok)
@@ -18584,8 +19329,88 @@ class V {
     }
   }
 }
-class r extends V {
-  get cursor() {
+function p$1(l, e) {
+  if (l === undefined || e.length === 0)
+    return 0;
+  const i = e.findIndex((s) => s.value === l);
+  return i !== -1 ? i : 0;
+}
+function g(l, e) {
+  return (e.label ?? String(e.value)).toLowerCase().includes(l.toLowerCase());
+}
+function m2(l, e) {
+  if (e)
+    return l ? e : e[0];
+}
+var T$1 = class T extends V {
+  filteredOptions;
+  multiple;
+  isNavigating = false;
+  selectedValues = [];
+  focusedValue;
+  #e = 0;
+  #s = "";
+  #t;
+  #i;
+  #n;
+  get cursor() {
+    return this.#e;
+  }
+  get userInputWithCursor() {
+    if (!this.userInput)
+      return styleText(["inverse", "hidden"], "_");
+    if (this._cursor >= this.userInput.length)
+      return `${this.userInput}█`;
+    const e = this.userInput.slice(0, this._cursor), [t, ...i] = this.userInput.slice(this._cursor);
+    return `${e}${styleText("inverse", t)}${i.join("")}`;
+  }
+  get options() {
+    return typeof this.#i == "function" ? this.#i() : this.#i;
+  }
+  constructor(e) {
+    super(e), this.#i = e.options, this.#n = e.placeholder;
+    const t = this.options;
+    this.filteredOptions = [...t], this.multiple = e.multiple === true, this.#t = typeof e.options == "function" ? e.filter : e.filter ?? g;
+    let i;
+    if (e.initialValue && Array.isArray(e.initialValue) ? this.multiple ? i = e.initialValue : i = e.initialValue.slice(0, 1) : !this.multiple && this.options.length > 0 && (i = [this.options[0].value]), i)
+      for (const s of i) {
+        const n = t.findIndex((o) => o.value === s);
+        n !== -1 && (this.toggleSelected(s), this.#e = n);
+      }
+    this.focusedValue = this.options[this.#e]?.value, this.on("key", (s, n) => this.#l(s, n)), this.on("userInput", (s) => this.#u(s));
+  }
+  _isActionKey(e, t) {
+    return e === "\t" || this.multiple && this.isNavigating && t.name === "space" && e !== undefined && e !== "";
+  }
+  #l(e, t) {
+    const i = t.name === "up", s = t.name === "down", n = t.name === "return", o = this.userInput === "" || this.userInput === "\t", u = this.#n, h = this.options, f = u !== undefined && u !== "" && h.some((r) => !r.disabled && (this.#t ? this.#t(u, r) : true));
+    if (t.name === "tab" && o && f) {
+      this.userInput === "\t" && this._clearUserInput(), this._setUserInput(u, true), this.isNavigating = false;
+      return;
+    }
+    i || s ? (this.#e = findCursor(this.#e, i ? -1 : 1, this.filteredOptions), this.focusedValue = this.filteredOptions[this.#e]?.value, this.multiple || (this.selectedValues = [this.focusedValue]), this.isNavigating = true) : n ? this.value = m2(this.multiple, this.selectedValues) : this.multiple ? this.focusedValue !== undefined && (t.name === "tab" || this.isNavigating && t.name === "space") ? this.toggleSelected(this.focusedValue) : this.isNavigating = false : (this.focusedValue && (this.selectedValues = [this.focusedValue]), this.isNavigating = false);
+  }
+  deselectAll() {
+    this.selectedValues = [];
+  }
+  toggleSelected(e) {
+    this.filteredOptions.length !== 0 && (this.multiple ? this.selectedValues.includes(e) ? this.selectedValues = this.selectedValues.filter((t) => t !== e) : this.selectedValues = [...this.selectedValues, e] : this.selectedValues = [e]);
+  }
+  #u(e) {
+    if (e !== this.#s) {
+      this.#s = e;
+      const t = this.options;
+      e && this.#t ? this.filteredOptions = t.filter((n) => this.#t?.(e, n)) : this.filteredOptions = [...t];
+      const i = p$1(this.focusedValue, this.filteredOptions);
+      this.#e = findCursor(i, 0, this.filteredOptions);
+      const s = this.filteredOptions[this.#e];
+      s && !s.disabled ? this.focusedValue = s.value : this.focusedValue = undefined, this.multiple || (this.focusedValue !== undefined ? this.toggleSelected(this.focusedValue) : this.deselectAll());
+    }
+  }
+};
+
+class r extends V {
+  get cursor() {
     return this.value ? 0 : 1;
   }
   get _value() {
@@ -18770,6 +19595,89 @@ var limitOptions = ({
       b.push(n);
   return u && b.push(C), b;
 };
+function P(t) {
+  return t.label ?? String(t.value ?? "");
+}
+function E(t, c) {
+  if (!t)
+    return true;
+  const n = (c.label ?? String(c.value ?? "")).toLowerCase(), i = (c.hint ?? "").toLowerCase(), l = String(c.value).toLowerCase(), o = t.toLowerCase();
+  return n.includes(o) || i.includes(o) || l.includes(o);
+}
+function N(t, c) {
+  const n = [];
+  for (const i of c)
+    t.includes(i.value) && n.push(i);
+  return n;
+}
+var autocomplete = (t) => new T$1({
+  options: t.options,
+  initialValue: t.initialValue ? [t.initialValue] : undefined,
+  initialUserInput: t.initialUserInput,
+  placeholder: t.placeholder,
+  filter: t.filter ?? ((n, i) => E(n, i)),
+  signal: t.signal,
+  input: t.input,
+  output: t.output,
+  validate: t.validate,
+  render() {
+    const n = t.withGuide ?? settings.withGuide, i = n ? [`${styleText2("gray", S_BAR)}`, `${symbol(this.state)}  ${t.message}`] : [`${symbol(this.state)}  ${t.message}`], l = this.userInput, o = this.options, m = t.placeholder, p = l === "" && m !== undefined, $ = (r, s) => {
+      const a = P(r), u = r.hint && r.value === this.focusedValue ? styleText2("dim", ` (${r.hint})`) : "";
+      switch (s) {
+        case "active":
+          return `${styleText2("green", S_RADIO_ACTIVE)} ${a}${u}`;
+        case "inactive":
+          return `${styleText2("dim", S_RADIO_INACTIVE)} ${styleText2("dim", a)}`;
+        case "disabled":
+          return `${styleText2("gray", S_RADIO_INACTIVE)} ${styleText2(["strikethrough", "gray"], a)}`;
+      }
+    };
+    switch (this.state) {
+      case "submit": {
+        const r = N(this.selectedValues, o), s = r.length > 0 ? `  ${styleText2("dim", r.map(P).join(", "))}` : "", a = n ? styleText2("gray", S_BAR) : "";
+        return `${i.join(`
+`)}
+${a}${s}`;
+      }
+      case "cancel": {
+        const r = l ? `  ${styleText2(["strikethrough", "dim"], l)}` : "", s = n ? styleText2("gray", S_BAR) : "";
+        return `${i.join(`
+`)}
+${s}${r}`;
+      }
+      default: {
+        const r = this.state === "error" ? "yellow" : "cyan", s = n ? `${styleText2(r, S_BAR)}  ` : "", a = n ? styleText2(r, S_BAR_END) : "";
+        let u = "";
+        if (this.isNavigating || p) {
+          const d = p ? m : l;
+          u = d !== "" ? ` ${styleText2("dim", d)}` : "";
+        } else
+          u = ` ${this.userInputWithCursor}`;
+        const V = this.filteredOptions.length !== o.length ? styleText2("dim", ` (${this.filteredOptions.length} match${this.filteredOptions.length === 1 ? "" : "es"})`) : "", y = this.filteredOptions.length === 0 && l ? [`${s}${styleText2("yellow", "No matches found")}`] : [], b = this.state === "error" ? [`${s}${styleText2("yellow", this.error)}`] : [];
+        n && i.push(`${s.trimEnd()}`), i.push(`${s}${styleText2("dim", "Search:")}${u}${V}`, ...y, ...b);
+        const v = [
+          `${styleText2("dim", "↑/↓")} to select`,
+          `${styleText2("dim", "Enter:")} confirm`,
+          `${styleText2("dim", "Type:")} to search`
+        ], g = [`${s}${v.join(" • ")}`, a], O = this.filteredOptions.length === 0 ? [] : limitOptions({
+          cursor: this.cursor,
+          options: this.filteredOptions,
+          columnPadding: n ? 3 : 0,
+          rowPadding: i.length + g.length,
+          style: (d, f) => $(d, d.disabled ? "disabled" : f ? "active" : "inactive"),
+          maxItems: t.maxItems,
+          output: t.output
+        });
+        return [
+          ...i,
+          ...O.map((d) => `${s}${d}`),
+          ...g
+        ].join(`
+`);
+      }
+    }
+  }
+}).prompt();
 var confirm = (i) => {
   const a = i.active ?? "Yes", s = i.inactive ?? "No";
   return new r({
@@ -19200,6 +20108,7 @@ function createStyledClack() {
     cancel,
     confirm,
     password,
+    autocomplete,
     select,
     isCancel,
     spinner,
@@ -19459,11 +20368,50 @@ function createPassword({
   };
 }
 
+// src/core/textSearch.ts
+function normalizeForSearch(value) {
+  return value.toLowerCase().replace(/[-_\s]+/g, " ").trim();
+}
+function matchesSearchTerm(search, fields) {
+  const needle = normalizeForSearch(search);
+  if (!needle)
+    return true;
+  return fields.some((field) => field !== undefined && normalizeForSearch(field).includes(needle));
+}
+function createSearchIndex(items, fieldsOf) {
+  const indexed = new Map;
+  for (const item of items) {
+    indexed.set(item, fieldsOf(item).flatMap((field) => field === undefined ? [] : [normalizeForSearch(field)]));
+  }
+  let lastSearch;
+  let needle = "";
+  return (search, item) => {
+    if (search !== lastSearch) {
+      lastSearch = search;
+      needle = normalizeForSearch(search);
+    }
+    if (!needle)
+      return true;
+    const fields = indexed.get(item);
+    return fields ? fields.some((field) => field.includes(needle)) : matchesSearchTerm(search, fieldsOf(item));
+  };
+}
+
 // src/shell/ui/renderers/select.ts
+var searchThreshold = 8;
+var searchPlaceholder = "Type to filter";
+function searchableFields(option) {
+  return [option.label, option.hint, option.value];
+}
 function createSelect({ mode, clack }) {
   return async (message, options) => {
     assertHumanMode(mode, "select");
-    const value = await clack.select({ message, options: [...options] });
+    const value = options.length > searchThreshold ? await clack.autocomplete({
+      message,
+      options: [...options],
+      placeholder: searchPlaceholder,
+      filter: createSearchIndex([...options], searchableFields)
+    }) : await clack.select({ message, options: [...options] });
     if (clack.isCancel(value))
       return { ok: false };
     return { ok: true, value };
@@ -19511,12 +20459,14 @@ function createVerboseContext(outputMode, isVerbose) {
 
 // src/shell/npmRegistry.ts
 var registryUrl = "https://registry.npmjs.org";
-var timeoutMs2 = 3000;
+var timeoutMs4 = 3000;
 async function fetchLatestVersion(packageName, deps = {}) {
   const fetchFn = deps.fetchFn ?? globalThis.fetch;
+  const deadline = AbortSignal.timeout(timeoutMs4);
+  const signal = deps.signal ? AbortSignal.any([deps.signal, deadline]) : deadline;
   try {
     const response = await fetchFn(`${registryUrl}/${packageName}/latest`, {
-      signal: AbortSignal.timeout(timeoutMs2)
+      signal
     });
     if (!response.ok)
       return;
@@ -19531,7 +20481,7 @@ async function fetchLatestVersion(packageName, deps = {}) {
 }
 
 // src/domains/updateCheck/updateCheck.ts
-import { join as join10 } from "node:path";
+import { join as join13 } from "node:path";
 
 // src/core/version.ts
 function parseRelease(version) {
@@ -19565,19 +20515,21 @@ function startUpdateCheck(deps) {
   if (deps.env["QAWOLF_NO_UPDATE_CHECK"]) {
     return noopNotifier;
   }
+  const controller = new AbortController;
   let latest;
-  deps.fetchLatestVersion().then((version) => {
+  deps.fetchLatestVersion(controller.signal).then((version) => {
     latest = version;
   }, () => {
     return;
   });
   return {
     async notifyIfOutdated() {
+      controller.abort();
       if (latest === undefined)
         return;
       if (!isNewerVersion(deps.currentVersion, latest))
         return;
-      const noticePath = join10(deps.configDir, noticeFile);
+      const noticePath = join13(deps.configDir, noticeFile);
       try {
         const notified = (await deps.fs.readFile(noticePath)).trim();
         if (notified === latest)
@@ -19599,7 +20551,7 @@ function startUpdateCheck(deps) {
 // package.json
 var package_default = {
   name: "@qawolf/cli",
-  version: "1.24.0",
+  version: "1.26.0",
   description: "Run and manage QA Wolf flows from the terminal, CI, or an AI agent",
   keywords: [
     "automation",
@@ -19670,7 +20622,7 @@ var package_default = {
     "@clack/prompts": "1.5.1",
     "@napi-rs/keyring": "1.3.0",
     "@oxc-node/core": "0.1.0",
-    "@qawolf/api-contracts": "0.47.0",
+    "@qawolf/api-contracts": "0.52.0",
     "@qawolf/emails": "1.1.1",
     "@qawolf/flow-targets": "1.0.0",
     "@qawolf/flows": "0.1.4",
@@ -19736,7 +20688,7 @@ function buildBaseContext(command, signals) {
     currentVersion: package_default.version,
     configDir: getConfigDir(),
     fs,
-    fetchLatestVersion: () => fetchLatestVersion(package_default.name),
+    fetchLatestVersion: (signal) => fetchLatestVersion(package_default.name, { signal }),
     renderNotice: (body, title) => ui.note(body, title)
   });
   return {
@@ -19789,7 +20741,12 @@ function withAuthContext(signals, fn, deps = {}) {
       await updateNotifier.notifyIfOutdated();
       return;
     }
-    const platformClient = (deps.createPlatform ?? createPlatformClient)(resolved.key, { baseUrl: apiBaseUrl, fetch: globalThis.fetch, logger: ctx.log("trpc") });
+    const platformClient = (deps.createPlatform ?? createPlatformClient)(resolved.key, {
+      baseUrl: apiBaseUrl,
+      fetch: globalThis.fetch,
+      logger: ctx.log("trpc"),
+      workspaceId: resolved.workspaceId
+    });
     try {
       const result = await fn({
         ...ctx,
@@ -19810,28 +20767,15 @@ function withAuthContext(signals, fn, deps = {}) {
   };
 }
 
-// src/commands/auth/login.ts
-async function handleLogin(ctx) {
-  if (ctx.ui.mode !== "human") {
-    ctx.ui.error(authMessages.login.nonInteractive);
-    return { error: "non-interactive" };
-  }
-  const existing = await resolveApiKey(ctx.configDir, ctx.fs);
-  if (existing) {
-    const reauth = await ctx.ui.confirm(authMessages.login.reAuthPrompt);
-    if (!reauth.ok || !reauth.value) {
-      ctx.ui.info(authMessages.alreadyConfigured);
-      return;
-    }
-  }
-  ctx.ui.gap();
-  ctx.ui.intro(authMessages.title);
+// src/commands/auth/loginApiKey.ts
+async function loginWithApiKey(ctx) {
   const result = await ctx.ui.password(authMessages.promptApiKey, "Set QAWOLF_API_KEY to authenticate in non-interactive environments.");
   if (!result.ok) {
     ctx.ui.cancel(authMessages.cancelled);
     return;
   }
-  if (!result.value.trim()) {
+  const apiKey = result.value.trim();
+  if (!apiKey) {
     ctx.ui.cancel(authMessages.cancelled);
     return;
   }
@@ -19840,7 +20784,7 @@ async function handleLogin(ctx) {
       message: authMessages.verifying,
       task: async () => {
         const v = await validateApiKey({
-          platformClient: createPlatformClient(result.value, {
+          platformClient: createPlatformClient(apiKey, {
             baseUrl: ctx.apiBaseUrl,
             fetch: globalThis.fetch
           })
@@ -19851,7 +20795,7 @@ async function handleLogin(ctx) {
     },
     {
       message: authMessages.storing,
-      task: async () => saveApiKey(ctx.configDir, result.value, ctx.fs)
+      task: async () => saveApiKey(ctx.configDir, apiKey, ctx.fs)
     }
   ], ([, saveResult]) => {
     return saveResult.stored === "file" ? authMessages.storedFile : authMessages.storedKeychain;
@@ -19859,14 +20803,632 @@ async function handleLogin(ctx) {
   ctx.ui.outro(authMessages.outroSuccess);
 }
 
+// src/core/deviceAuth/pollState.ts
+var slowDownIncrementMs = 5000;
+var unreachableBackoffFactor = 2;
+function capToLifetime(delayMs, state, nowMs) {
+  return Math.min(delayMs, Math.max(1, state.deadlineMs - nowMs));
+}
+function nextPollStep(state, response, nowMs) {
+  if (response.kind === "tokens") {
+    return { action: "done", tokens: response.tokens };
+  }
+  if (nowMs > state.deadlineMs) {
+    return { action: "fail", reason: "timeout", detail: undefined };
+  }
+  switch (response.kind) {
+    case "pending":
+      return {
+        action: "poll",
+        delayMs: capToLifetime(state.intervalMs, state, nowMs),
+        state
+      };
+    case "slow-down": {
+      const slowed = {
+        intervalMs: state.intervalMs + slowDownIncrementMs,
+        deadlineMs: state.deadlineMs
+      };
+      return {
+        action: "poll",
+        delayMs: capToLifetime(slowed.intervalMs, slowed, nowMs),
+        state: slowed
+      };
+    }
+    case "denied":
+      return { action: "fail", reason: "access-denied", detail: undefined };
+    case "expired":
+      return { action: "fail", reason: "expired", detail: undefined };
+    case "unreachable": {
+      const backedOff = {
+        intervalMs: state.intervalMs * unreachableBackoffFactor,
+        deadlineMs: state.deadlineMs
+      };
+      return {
+        action: "poll",
+        delayMs: capToLifetime(backedOff.intervalMs, backedOff, nowMs),
+        state: backedOff
+      };
+    }
+    case "error":
+      return { action: "fail", reason: "network", detail: response.detail };
+  }
+}
+
+// src/domains/auth/deviceLogin.ts
+var cancelled = {
+  ok: false,
+  reason: "cancelled",
+  detail: undefined
+};
+async function deviceLogin(deps) {
+  if (deps.isCancelled())
+    return cancelled;
+  const authorization = await deps.requestAuthorization();
+  if (!authorization.ok) {
+    return { ok: false, reason: "unavailable", detail: authorization.error };
+  }
+  await deps.onPrompt(authorization.value);
+  let state = {
+    intervalMs: authorization.value.intervalSec * 1000,
+    deadlineMs: deps.now() + authorization.value.expiresInSec * 1000
+  };
+  for (;; ) {
+    if (deps.isCancelled())
+      return cancelled;
+    const response = await deps.pollToken(authorization.value.deviceCode);
+    const step = nextPollStep(state, response, deps.now());
+    if (step.action === "done")
+      return { ok: true, tokens: step.tokens };
+    if (step.action === "fail") {
+      return { ok: false, reason: step.reason, detail: step.detail };
+    }
+    state = step.state;
+    await deps.sleep(step.delayMs);
+  }
+}
+
+// src/shell/openBrowser.ts
+var launchTimeoutMs = 2000;
+function launcher(url, platform) {
+  if (platform === "darwin")
+    return { cmd: "open", args: [url] };
+  if (platform === "win32") {
+    return { cmd: "rundll32", args: ["url.dll,FileProtocolHandler", url] };
+  }
+  return { cmd: "xdg-open", args: [url] };
+}
+async function openBrowser(url, deps) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    return false;
+  }
+  const { cmd, args } = launcher(url, deps.platform);
+  const launched = deps.spawn(cmd, args, { platform: deps.platform }).then((result) => result.exitCode === 0).catch(() => false);
+  return Promise.race([launched, deps.sleep(launchTimeoutMs).then(() => true)]);
+}
+
+// src/shell/spawn.ts
+import { spawn } from "node:child_process";
+
+// src/core/cmdEscape.ts
+var metaChars = /([()\][%!^"`<>&|;, *?])/g;
+function escapeCommand(command) {
+  return command.replace(metaChars, "^$1");
+}
+function escapeArgument(arg) {
+  const escaped = arg.replace(/(?=(\\+?)?)\1"/g, "$1$1\\\"").replace(/(?=(\\+?)?)\1$/, "$1$1");
+  return `"${escaped}"`.replace(metaChars, "^$1").replace(metaChars, "^$1");
+}
+
+// src/shell/spawn.ts
+function buildSpawnCommand(cmd, args, platform, env) {
+  const options = {};
+  if (env)
+    options.env = env;
+  if (platform !== "win32" || !/\.(cmd|bat)$/i.test(cmd)) {
+    return { cmd, args, options };
+  }
+  const line = [escapeCommand(cmd), ...args.map(escapeArgument)].join(" ");
+  return {
+    cmd: process.env["ComSpec"] ?? "cmd.exe",
+    args: ["/d", "/s", "/c", `"${line}"`],
+    options: { ...options, windowsVerbatimArguments: true }
+  };
+}
+var defaultSpawn = (cmd, args, opts) => new Promise((resolve) => {
+  const env = opts.env ? { ...process.env, ...opts.env } : undefined;
+  const built = buildSpawnCommand(cmd, args, opts.platform, env);
+  const child = spawn(built.cmd, built.args, built.options);
+  let stdout = "";
+  let stderr = "";
+  child.stdout?.on("data", (chunk) => {
+    stdout += String(chunk);
+  });
+  child.stderr?.on("data", (chunk) => {
+    stderr += String(chunk);
+  });
+  if (opts?.stdin !== undefined) {
+    child.stdin?.write(opts.stdin);
+    child.stdin?.end();
+  }
+  child.on("error", (err) => resolve({ exitCode: -1, stdout, stderr: stderr || err.message }));
+  child.on("close", (code) => resolve({ exitCode: code ?? -1, stdout, stderr }));
+});
+
+// src/shell/platform/getAuthConfig.ts
+var timeoutMs5 = 1e4;
+var authConfigBody = object({
+  workOsClientId: string2().trim().min(1)
+});
+async function getAuthConfig(deps) {
+  let response;
+  try {
+    response = await deps.fetch(`${deps.baseUrl}/api/v0/auth/config`, {
+      signal: AbortSignal.timeout(timeoutMs5)
+    });
+  } catch (err) {
+    return { kind: "unreachable", detail: errorMessage(err) };
+  }
+  if (response.status === 404)
+    return { kind: "unconfigured" };
+  if (!response.ok) {
+    return { kind: "unreachable", detail: `HTTP ${response.status}` };
+  }
+  let json;
+  try {
+    json = await response.json();
+  } catch (err) {
+    return { kind: "unreachable", detail: errorMessage(err) };
+  }
+  const parsed = authConfigBody.safeParse(json);
+  return parsed.success ? { kind: "configured", clientId: parsed.data.workOsClientId } : { kind: "unconfigured" };
+}
+
+// src/shell/workos/pollDeviceToken.ts
+var deviceCodeGrantType = "urn:ietf:params:oauth:grant-type:device_code";
+async function pollDeviceToken(deviceCode, deps) {
+  const outcome = await sendWorkosRequest(`${deps.baseUrl}/user_management/authenticate`, {
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: deviceCodeGrantType,
+      device_code: deviceCode,
+      client_id: deps.clientId
+    }).toString()
+  }, deps.fetch);
+  if (outcome.kind === "failure") {
+    return outcome.retryable ? { kind: "unreachable", detail: outcome.detail } : { kind: "error", detail: outcome.detail };
+  }
+  if (outcome.kind === "oauth-error") {
+    switch (outcome.code) {
+      case "authorization_pending":
+        return { kind: "pending" };
+      case "slow_down":
+        return { kind: "slow-down" };
+      case "access_denied":
+        return { kind: "denied" };
+      case "expired_token":
+      case "invalid_grant":
+        return { kind: "expired" };
+      default:
+        return {
+          kind: "error",
+          detail: outcome.description ?? outcome.code
+        };
+    }
+  }
+  const parsed = deviceTokenBody.safeParse(outcome.json);
+  if (!parsed.success) {
+    return { kind: "error", detail: unexpectedResponse };
+  }
+  return {
+    kind: "tokens",
+    tokens: {
+      accessToken: parsed.data.access_token,
+      refreshToken: parsed.data.refresh_token,
+      expiresAt: readAccessTokenExpiry(parsed.data.access_token),
+      email: parsed.data.user.email,
+      organizationId: parsed.data.organization_id
+    }
+  };
+}
+
+// src/shell/workos/requestDeviceAuthorization.ts
+async function requestDeviceAuthorization(deps) {
+  const outcome = await sendWorkosRequest(`${deps.baseUrl}/user_management/authorize/device`, {
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ client_id: deps.clientId }).toString()
+  }, deps.fetch);
+  if (outcome.kind === "failure") {
+    return { ok: false, error: outcome.detail, retryable: outcome.retryable };
+  }
+  if (outcome.kind === "oauth-error") {
+    return {
+      ok: false,
+      error: outcome.description ?? outcome.code,
+      retryable: false
+    };
+  }
+  const parsed = deviceAuthorizationBody.safeParse(outcome.json);
+  if (!parsed.success) {
+    return { ok: false, error: unexpectedResponse, retryable: false };
+  }
+  return {
+    ok: true,
+    value: {
+      deviceCode: parsed.data.device_code,
+      userCode: parsed.data.user_code,
+      verificationUri: parsed.data.verification_uri,
+      verificationUriComplete: parsed.data.verification_uri_complete,
+      expiresInSec: parsed.data.expires_in,
+      intervalSec: parsed.data.interval ?? defaultIntervalSec
+    }
+  };
+}
+
+// src/domains/auth/nameMatching.ts
+function matches(candidate, wanted) {
+  return candidate.toLowerCase() === wanted.trim().toLowerCase();
+}
+function findOrganization(organizations, wanted) {
+  return organizations.find((organization) => matches(organization.name, wanted) || matches(organization.id, wanted) || matches(organization.workOsOrganizationId, wanted));
+}
+function findWorkspace(workspaces, wanted) {
+  return workspaces.find((workspace) => matches(workspace.name, wanted) || matches(workspace.id, wanted) || workspace.slug !== undefined && matches(workspace.slug, wanted));
+}
+function findWorkspaceAcross(organizations, wanted) {
+  const hits = organizations.flatMap((organization) => {
+    const workspace = findWorkspace(organization.workspaces, wanted);
+    return workspace ? [{ organization, workspace }] : [];
+  });
+  const [only] = hits;
+  if (!only)
+    return { kind: "none" };
+  if (hits.length > 1) {
+    return {
+      kind: "ambiguous",
+      organizations: hits.map((h) => h.organization)
+    };
+  }
+  return {
+    kind: "found",
+    organization: only.organization,
+    workspace: only.workspace
+  };
+}
+function nameList(items) {
+  return items.map((item) => item.slug ?? item.name).join(", ");
+}
+
+// src/domains/auth/selectWorkspace.ts
+async function selectWorkspace(deps) {
+  const { organizations } = deps;
+  if (organizations.length === 0)
+    return { outcome: "none" };
+  let organization;
+  if (deps.preferredOrganization) {
+    organization = findOrganization(organizations, deps.preferredOrganization);
+    if (!organization) {
+      return {
+        outcome: "failed",
+        error: `No organization matches '${deps.preferredOrganization}'. Available: ${nameList(organizations)}.`
+      };
+    }
+  } else if (organizations.length === 1) {
+    organization = organizations[0];
+  } else if (deps.preferredWorkspace) {
+    const match = findWorkspaceAcross(organizations, deps.preferredWorkspace);
+    if (match.kind === "none") {
+      return {
+        outcome: "failed",
+        error: `No workspace matches '${deps.preferredWorkspace}'. Available: ${nameList(organizations.flatMap((o) => o.workspaces))}.`
+      };
+    }
+    if (match.kind === "ambiguous") {
+      return {
+        outcome: "failed",
+        error: `More than one organization has a workspace matching '${deps.preferredWorkspace}': ${nameList(match.organizations)}. Set QAWOLF_ORGANIZATION to choose between them.`
+      };
+    }
+    organization = match.organization;
+  } else {
+    organization = await deps.chooseOrganization(organizations);
+    if (!organization)
+      return { outcome: "cancelled" };
+  }
+  if (!organization)
+    throw Error("organization was not settled");
+  const { workspaces } = organization;
+  if (workspaces.length === 0) {
+    return {
+      outcome: "failed",
+      error: `Organization '${organization.name}' has no workspaces.`
+    };
+  }
+  let workspace;
+  if (deps.preferredWorkspace) {
+    workspace = findWorkspace(workspaces, deps.preferredWorkspace);
+    if (!workspace) {
+      return {
+        outcome: "failed",
+        error: `No workspace matches '${deps.preferredWorkspace}' in ${organization.name}. Available: ${nameList(workspaces)}.`
+      };
+    }
+  } else if (workspaces.length === 1) {
+    workspace = workspaces[0];
+  } else {
+    workspace = await deps.chooseWorkspace(workspaces);
+    if (!workspace)
+      return { outcome: "cancelled" };
+  }
+  if (!workspace)
+    throw Error("workspace was not settled");
+  try {
+    await deps.saveWorkspace(workspace.id);
+  } catch (err) {
+    return {
+      outcome: "failed",
+      error: authMessages.workspace.saveFailed(errorMessage(err))
+    };
+  }
+  return { outcome: "selected", organization, workspace };
+}
+
+// src/domains/auth/store/saveWorkspaceId.ts
+import { Entry as Entry6 } from "@napi-rs/keyring";
+function makeSaveWorkspaceIdDeps(configDir, fs) {
+  return {
+    loadTokens: () => loadTokens(configDir, { EntryClass: Entry6, fs }),
+    saveTokens: (session) => saveTokens(configDir, session, fs)
+  };
+}
+async function saveWorkspaceId(session, workspaceId, deps) {
+  const current = await deps.loadTokens();
+  if (!current.found || !isSameSession(current.tokens, session)) {
+    throw Error(authMessages.workspace.sessionChanged);
+  }
+  return deps.saveTokens({ ...current.tokens, workspaceId });
+}
+function isSameSession(stored, captured) {
+  return stored.email === captured.email && stored.organizationId === captured.organizationId;
+}
+
+// src/commands/auth/chooseWorkspace.ts
+async function chooseWorkspace(ctx, args) {
+  const client = createPlatformClient(args.session.accessToken, {
+    baseUrl: ctx.apiBaseUrl,
+    fetch: globalThis.fetch,
+    logger: ctx.log("trpc")
+  });
+  const [identity, discovered] = await Promise.all([
+    client.getIdentity(),
+    client.getAccessibleOrganizations()
+  ]);
+  let organizations;
+  if (discovered.ok) {
+    organizations = discovered.value;
+  } else if (identity.ok) {
+    organizations = "user" in identity.value ? identity.value.organizations : [];
+  } else {
+    return { outcome: "failed", error: identity.error };
+  }
+  return selectWorkspace({
+    organizations,
+    preferredOrganization: args.env["QAWOLF_ORGANIZATION"]?.trim(),
+    preferredWorkspace: args.env["QAWOLF_WORKSPACE"]?.trim(),
+    chooseOrganization: async (organizations) => {
+      if (ctx.ui.mode !== "human")
+        return;
+      const picked = await ctx.ui.select(authMessages.workspace.chooseOrganization, organizations.map((organization) => ({
+        value: organization.workOsOrganizationId,
+        label: organization.name,
+        hint: authMessages.workspace.workspaceCount(organization.workspaces.length)
+      })));
+      if (!picked.ok)
+        return;
+      return organizations.find((organization) => organization.workOsOrganizationId === picked.value);
+    },
+    chooseWorkspace: async (workspaces) => {
+      if (ctx.ui.mode !== "human")
+        return;
+      const picked = await ctx.ui.select(authMessages.workspace.choose, workspaces.map((workspace) => ({
+        value: workspace.id,
+        label: workspace.name,
+        ...workspace.slug ? { hint: workspace.slug } : {}
+      })));
+      if (!picked.ok)
+        return;
+      return workspaces.find((workspace) => workspace.id === picked.value);
+    },
+    saveWorkspace: (workspaceId) => saveWorkspaceId(args.session, workspaceId, makeSaveWorkspaceIdDeps(ctx.configDir, ctx.fs))
+  });
+}
+function reportWorkspace(ctx, result) {
+  switch (result.outcome) {
+    case "selected":
+      ctx.ui.info(authMessages.workspace.working(result.organization.name, result.workspace.name));
+      return;
+    case "none":
+      ctx.ui.info(authMessages.workspace.none);
+      return;
+    case "cancelled":
+      if (ctx.ui.mode !== "human") {
+        return { error: authMessages.workspace.nonInteractive };
+      }
+      ctx.ui.info(authMessages.workspace.cancelled);
+      return;
+    case "failed":
+      return { error: result.error };
+  }
+}
+
+// src/commands/auth/loginDevice.ts
+async function loginWithDevice(ctx, deps = {}) {
+  const authConfig = await getAuthConfig({
+    baseUrl: ctx.apiBaseUrl,
+    fetch: globalThis.fetch
+  });
+  if (authConfig.kind === "unreachable") {
+    ctx.log("auth").debug(`auth config unreachable: ${authConfig.detail}`);
+    return {
+      error: authMessages.device.configUnreachable,
+      errorBody: authConfig.detail
+    };
+  }
+  const config = resolveWorkosConfig(authConfig.kind === "configured" ? authConfig.clientId : undefined);
+  if (!config.configured) {
+    return { error: authMessages.device.unavailable };
+  }
+  const workos = {
+    fetch: globalThis.fetch,
+    baseUrl: config.baseUrl,
+    clientId: config.clientId
+  };
+  let cancelled = false;
+  const unregister = ctx.signals.register(() => {
+    cancelled = true;
+  });
+  const showCode = async (authorization) => {
+    const url = authorization.verificationUriComplete ?? authorization.verificationUri;
+    ctx.ui.note([
+      authMessages.device.confirmCode(authorization.userCode),
+      authMessages.device.visitUrl(url),
+      url === authorization.verificationUri ? undefined : authMessages.device.visitUrlPlain(authorization.verificationUri)
+    ].filter((line) => Boolean(line)).join(`
+`), authMessages.title);
+    const opened = await openBrowser(url, {
+      sleep,
+      spawn: defaultSpawn,
+      platform: deps.platform ?? process.platform
+    });
+    if (!opened)
+      ctx.ui.info(authMessages.device.openFailed(url));
+    ctx.ui.step(authMessages.device.waiting);
+  };
+  try {
+    const result = await deviceLogin({
+      requestAuthorization: () => requestDeviceAuthorization(workos),
+      pollToken: (deviceCode) => pollDeviceToken(deviceCode, workos),
+      onPrompt: showCode,
+      sleep,
+      now: () => Date.now(),
+      isCancelled: () => cancelled
+    });
+    if (!result.ok) {
+      return {
+        error: authMessages.device.failed[result.reason],
+        ...result.detail ? { errorBody: result.detail } : {}
+      };
+    }
+    const session = {
+      ...result.tokens,
+      workspaceId: undefined,
+      clientId: config.clientId
+    };
+    await saveTokens(ctx.configDir, session, ctx.fs);
+    const workspace = await chooseWorkspace(ctx, {
+      session,
+      env: deps.env ?? process.env
+    });
+    const failure = reportWorkspace(ctx, workspace);
+    if (failure)
+      return failure;
+    ctx.ui.outro(authMessages.device.signedIn(result.tokens.email));
+    return;
+  } finally {
+    unregister();
+  }
+}
+
+// src/commands/auth/login.ts
+var browserMethod = "browser";
+async function handleLogin(ctx, deps = {}) {
+  if (ctx.ui.mode !== "human") {
+    ctx.ui.error(authMessages.login.nonInteractive);
+    return { error: "non-interactive" };
+  }
+  const resolveApiKey2 = deps.resolveApiKey ?? resolveApiKey;
+  const existing = await resolveApiKey2(ctx.configDir, ctx.fs);
+  if (existing) {
+    const reauth = await ctx.ui.confirm(authMessages.login.reAuthPrompt);
+    if (!reauth.ok || !reauth.value) {
+      ctx.ui.info(authMessages.alreadyConfigured);
+      return;
+    }
+  }
+  ctx.ui.gap();
+  ctx.ui.intro(authMessages.title);
+  const method = await ctx.ui.select(authMessages.login.chooseMethod, [
+    {
+      value: browserMethod,
+      label: authMessages.login.methodBrowser,
+      hint: authMessages.login.methodBrowserHint
+    },
+    {
+      value: "api-key",
+      label: authMessages.login.methodApiKey,
+      hint: authMessages.login.methodApiKeyHint
+    }
+  ]);
+  if (!method.ok) {
+    ctx.ui.cancel(authMessages.cancelled);
+    return;
+  }
+  if (method.value !== browserMethod) {
+    return (deps.loginWithApiKey ?? loginWithApiKey)(ctx);
+  }
+  if (existing && existing.source !== "browser") {
+    ctx.ui.warn(existing.source === "env" ? authMessages.login.apiKeyPrecedence.env : authMessages.login.apiKeyPrecedence.stored);
+  }
+  return (deps.loginWithDevice ?? loginWithDevice)(ctx);
+}
+
+// src/domains/auth/store/deleteTokens.ts
+import { join as join14 } from "node:path";
+import { Entry as Entry7 } from "@napi-rs/keyring";
+function deleteFromKeychain2() {
+  try {
+    new Entry7(service, tokensAccount).deletePassword();
+    return "deleted";
+  } catch {
+    return "unavailable";
+  }
+}
+async function deleteFromFile2(configDir, fs) {
+  try {
+    await fs.unlink(join14(configDir, tokensFile));
+    return "deleted";
+  } catch (err) {
+    if (isNoEntError(err))
+      return "not-found";
+    throw err;
+  }
+}
+async function deleteTokens(configDir, fs) {
+  const [keychain, file] = await Promise.all([
+    Promise.resolve(deleteFromKeychain2()),
+    deleteFromFile2(configDir, fs)
+  ]);
+  return { keychain, file };
+}
+
 // src/commands/auth/logout.ts
-async function handleLogout(ctx) {
-  const resolved = await resolveApiKey(ctx.configDir, ctx.fs);
-  if (!resolved) {
+async function handleLogout(ctx, deps = {}) {
+  const hasStoredCredentials2 = deps.hasStoredCredentials ?? hasStoredCredentials;
+  const deleteApiKey2 = deps.deleteApiKey ?? deleteApiKey;
+  const deleteTokens2 = deps.deleteTokens ?? deleteTokens;
+  const env = deps.env ?? process.env;
+  const envKey = env["QAWOLF_API_KEY"]?.trim();
+  const stored = await hasStoredCredentials2(ctx.configDir, ctx.fs);
+  if (!envKey && !stored) {
     ctx.ui.info(authMessages.logout.notAuthenticated);
     return;
   }
-  if (resolved.source === "env") {
+  if (envKey) {
     ctx.ui.warn(authMessages.logout.envVarWarning);
   }
   if (ctx.ui.mode === "human") {
@@ -19881,7 +21443,12 @@ async function handleLogout(ctx) {
   await ctx.ui.withProgress([
     {
       message: authMessages.logout.deleting,
-      task: () => deleteApiKey(ctx.configDir, ctx.fs)
+      task: async () => {
+        await Promise.all([
+          deleteApiKey2(ctx.configDir, ctx.fs),
+          deleteTokens2(ctx.configDir, ctx.fs)
+        ]);
+      }
     }
   ], () => authMessages.logout.credentialsRemoved);
   if (ctx.ui.mode === "human") {
@@ -19891,6 +21458,76 @@ async function handleLogout(ctx) {
   }
 }
 
+// src/domains/auth/refreshStoredSession.ts
+import { Entry as Entry8 } from "@napi-rs/keyring";
+function makeDefaultDeps2(fs) {
+  return {
+    loadTokens: (configDir) => loadTokens(configDir, { EntryClass: Entry8, fs }),
+    resolveOauth: (configDir) => resolveOauthToken(configDir, makeOauthDeps(fs))
+  };
+}
+async function refreshStoredSession(configDir, fs, deps) {
+  const resolvedDeps = deps ?? makeDefaultDeps2(fs);
+  const before = await resolvedDeps.loadTokens(configDir);
+  if (!before.found)
+    return { kind: "not-signed-in" };
+  const renewed = await resolvedDeps.resolveOauth(configDir);
+  if (!renewed)
+    return { kind: "refresh-failed" };
+  const after = await resolvedDeps.loadTokens(configDir);
+  if (!after.found)
+    return { kind: "refresh-failed" };
+  if (after.tokens.accessToken !== renewed.key) {
+    return { kind: "refresh-failed" };
+  }
+  return { kind: "session", session: after.tokens };
+}
+
+// src/commands/auth/switchWorkspace.ts
+async function handleSwitchWorkspace(ctx, deps = {}) {
+  const env = deps.env ?? process.env;
+  const refreshStoredSession2 = deps.refreshStoredSession ?? refreshStoredSession;
+  const preferred = env["QAWOLF_WORKSPACE"]?.trim() || env["QAWOLF_ORGANIZATION"]?.trim();
+  if (ctx.ui.mode !== "human" && !preferred) {
+    return { error: authMessages.workspace.nonInteractive };
+  }
+  const stored = await refreshStoredSession2(ctx.configDir, ctx.fs);
+  if (stored.kind === "not-signed-in") {
+    return { error: authMessages.workspace.notSignedIn };
+  }
+  if (stored.kind === "refresh-failed") {
+    return { error: authMessages.workspace.sessionExpired };
+  }
+  ctx.ui.gap();
+  ctx.ui.intro(authMessages.title);
+  const result = await chooseWorkspace(ctx, {
+    session: stored.session,
+    env
+  });
+  const failure = reportWorkspace(ctx, result);
+  if (failure)
+    return failure;
+  ctx.ui.outro(authMessages.outroReady);
+  return;
+}
+
+// src/commands/auth/whoamiTeam.ts
+function reportTeamIdentity(ctx, value, source) {
+  const { team } = value;
+  const teamUrl = team.slug ? new URL("/" + encodeURIComponent(team.slug), ctx.apiBaseUrl).toString() : undefined;
+  if (ctx.ui.mode === "human") {
+    ctx.ui.note(authMessages.whoami.teamNote({ team, teamUrl, source }), authMessages.whoamiAuthenticated);
+    ctx.ui.outro(authMessages.outroReady);
+  } else {
+    ctx.ui.output({
+      authenticated: true,
+      source,
+      team,
+      teamUrl
+    }, authMessages.whoami.authenticatedAs(team.name, source));
+  }
+}
+
 // src/commands/auth/whoami.ts
 async function handleWhoami(ctx, deps = {}) {
   ctx.ui.gap();
@@ -19932,11 +21569,19 @@ async function handleWhoami(ctx, deps = {}) {
   const { value } = identity;
   if ("user" in value) {
     const { organization, user } = value;
+    const found = value.organizations.flatMap((candidate) => candidate.workspaces.map((workspace) => ({
+      organization: candidate.name,
+      workspace: workspace.name,
+      id: workspace.id
+    }))).find((entry) => entry.id === resolved.workspaceId);
+    const activeWorkspace = resolved.workspaceId ? authMessages.whoami.activeWorkspace(resolved.workspaceId, found) : undefined;
     if (ctx.ui.mode === "human") {
       ctx.ui.note(authMessages.whoami.userNote({
         organization,
         source: resolved.source,
-        user
+        user,
+        activeWorkspace,
+        organizations: value.organizations
       }), authMessages.whoamiAuthenticated);
       ctx.ui.outro(authMessages.outroReady);
     } else {
@@ -19944,7 +21589,9 @@ async function handleWhoami(ctx, deps = {}) {
         authenticated: true,
         organization,
         source: resolved.source,
-        user
+        user,
+        workspaceId: resolved.workspaceId,
+        organizations: value.organizations
       }, authMessages.whoami.authenticatedAs(user.email, resolved.source));
     }
     return;
@@ -19966,26 +21613,15 @@ async function handleWhoami(ctx, deps = {}) {
     }
     return;
   }
-  const { team } = value;
-  const teamUrl = team.slug ? new URL("/" + encodeURIComponent(team.slug), ctx.apiBaseUrl).toString() : undefined;
-  if (ctx.ui.mode === "human") {
-    ctx.ui.note(authMessages.whoami.teamNote({ team, teamUrl, source: resolved.source }), authMessages.whoamiAuthenticated);
-    ctx.ui.outro(authMessages.outroReady);
-  } else {
-    ctx.ui.output({
-      authenticated: true,
-      source: resolved.source,
-      team,
-      teamUrl
-    }, authMessages.whoami.authenticatedAs(team.name, resolved.source));
-  }
+  reportTeamIdentity(ctx, value, resolved.source);
 }
 
 // src/commands/auth/index.ts
 function registerAuthCommand(program, signals) {
   const auth = program.command("auth").description("Manage authentication with QA Wolf");
-  declareCommandKind(auth.command("login"), "local").description("Authenticate with your QA Wolf API key").action(withContext(signals, handleLogin));
+  declareCommandKind(auth.command("login"), "local").description("Authenticate with QA Wolf in a browser or with an API key").action(withContext(signals, handleLogin));
   declareCommandKind(auth.command("logout"), "local").description("Remove stored credentials").action(withContext(signals, handleLogout));
+  declareCommandKind(auth.command("switch"), "local").description("Choose which workspace to work in").action(withContext(signals, handleSwitchWorkspace));
   declareCommandKind(auth.command("whoami"), "read").description("Show authentication status").action(withContext(signals, handleWhoami));
 }
 
@@ -20035,11 +21671,11 @@ async function* batchMap(items, fn, size) {
 }
 
 // src/core/nodeModulesBins.ts
-import { join as join11 } from "node:path";
+import { join as join15 } from "node:path";
 function nodeModulesBinCandidates(envDir, name, platform) {
-  const binDir = join11(envDir, "node_modules", ".bin");
+  const binDir = join15(envDir, "node_modules", ".bin");
   const names = platform === "win32" ? [`${name}.cmd`, `${name}.exe`] : [name];
-  return names.map((shim) => join11(binDir, shim));
+  return names.map((shim) => join15(binDir, shim));
 }
 function appiumCliCandidates(envDir, platform) {
   return nodeModulesBinCandidates(envDir, "appium", platform);
@@ -20096,21 +21732,21 @@ async function checkUiautomator2(spawn, appiumBin, platform) {
 }
 
 // src/core/androidBins.ts
-import { join as join12 } from "node:path";
+import { join as join16 } from "node:path";
 function withExeSuffix(name, platform) {
   return platform === "win32" ? `${name}.exe` : name;
 }
 function emulatorBin(home, platform) {
   const name = withExeSuffix("emulator", platform);
-  return home ? join12(home, "emulator", name) : name;
+  return home ? join16(home, "emulator", name) : name;
 }
 function adbBin(home, platform) {
   const name = withExeSuffix("adb", platform);
-  return home ? join12(home, "platform-tools", name) : name;
+  return home ? join16(home, "platform-tools", name) : name;
 }
 function cmdlineToolsBin(home, name, platform) {
   const file = platform === "win32" ? `${name}.bat` : name;
-  return join12(home, "cmdline-tools", "latest", "bin", file);
+  return join16(home, "cmdline-tools", "latest", "bin", file);
 }
 function sdkManagerBin(home, platform) {
   return cmdlineToolsBin(home, "sdkmanager", platform);
@@ -20407,9 +22043,9 @@ async function checkNpmRegistry(deps) {
 }
 
 // src/core/playwrightCli.ts
-import { join as join13 } from "node:path";
+import { join as join17 } from "node:path";
 function playwrightCliJsPath(envDir) {
-  return join13(envDir, "node_modules", "playwright", "cli.js");
+  return join17(envDir, "node_modules", "playwright", "cli.js");
 }
 function playwrightCliInvocation(args) {
   return {
@@ -20559,11 +22195,11 @@ function renderResults(ui, results) {
 }
 
 // src/domains/flows/ensureDeps.ts
-import { dirname as dirname4, join as join14 } from "node:path";
+import { dirname as dirname4, join as join18 } from "node:path";
 function findEnvDir(flowPath, fs) {
   let dir = dirname4(flowPath);
   while (true) {
-    if (fs.existsSync(join14(dir, "package.json")))
+    if (fs.existsSync(join18(dir, "package.json")))
       return dir;
     const parent = dirname4(dir);
     if (parent === dir)
@@ -20589,7 +22225,7 @@ function resolveProjectDirSafe(files, fs) {
 }
 
 // src/domains/flows/expand.ts
-import { join as join15, resolve as resolve3 } from "node:path";
+import { join as join19, resolve as resolve3 } from "node:path";
 
 // node_modules/tinyglobby/dist/index.mjs
 import { readdir, readdirSync, realpath, realpathSync, stat, statSync } from "fs";
@@ -21578,11 +23214,11 @@ function makePeekFlowMeta(fs) {
   };
 }
 async function resolveGlobRoots(cwd, fs) {
-  const qawolfPath = join15(cwd, ".qawolf");
+  const qawolfPath = join19(cwd, ".qawolf");
   let envDirs = [];
   try {
     const entries = await fs.readdirWithTypes(qawolfPath);
-    envDirs = entries.filter((e) => e.isDirectory()).map((e) => join15(qawolfPath, e.name));
+    envDirs = entries.filter((e) => e.isDirectory()).map((e) => join19(qawolfPath, e.name));
   } catch {}
   return [cwd, ...envDirs];
 }
@@ -21608,11 +23244,11 @@ async function expandPatterns(patterns, cwd, logger, fs) {
 }
 
 // src/domains/runtimeEnv/clearRuntimeEnv.ts
-import { join as join17 } from "node:path";
+import { join as join21 } from "node:path";
 
 // src/domains/runtimeEnv/managedEnvDir.ts
 import { createHash } from "node:crypto";
-import { join as join16, resolve as resolve4 } from "node:path";
+import { join as join20, resolve as resolve4 } from "node:path";
 
 // src/domains/runtimeEnv/pinnedPackages.ts
 var pinnedPackages = [
@@ -21643,19 +23279,19 @@ function managedEnvBaseDir() {
   const override = process.env["QAWOLF_RUNTIME_DIR"]?.trim();
   if (override)
     return resolve4(override);
-  return join16(getDataDir(), "runtime");
+  return join20(getDataDir(), "runtime");
 }
 function runStagingRoot() {
   return `${managedEnvBaseDir()}-runs`;
 }
 function managedEnvDir() {
-  return join16(managedEnvBaseDir(), managedEnvHash());
+  return join20(managedEnvBaseDir(), managedEnvHash());
 }
 async function scaffoldManagedEnv(dir, fs) {
   await fs.mkdir(dir, { recursive: true });
   const dependencies = Object.fromEntries(pinnedPackages.map(({ name, version }) => [name, version]));
-  await fs.writeFile(join16(dir, "package.json"), JSON.stringify({ name: "qawolf-runtime", private: true, dependencies }, undefined, 2));
-  await fs.writeFile(join16(dir, ".npmrc"), `@qawolf:registry=https://registry.npmjs.org/
+  await fs.writeFile(join20(dir, "package.json"), JSON.stringify({ name: "qawolf-runtime", private: true, dependencies }, undefined, 2));
+  await fs.writeFile(join20(dir, ".npmrc"), `@qawolf:registry=https://registry.npmjs.org/
 `);
 }
 
@@ -21677,67 +23313,19 @@ async function isManagedRuntimeBase(dir, fs) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       return false;
-    if (!await hasRuntimeSentinel(join17(dir, entry.name), fs))
+    if (!await hasRuntimeSentinel(join21(dir, entry.name), fs))
       return false;
   }
   return true;
 }
 async function hasRuntimeSentinel(hashDir, fs) {
   try {
-    const pkg = JSON.parse(await fs.readFile(join17(hashDir, "package.json")));
+    const pkg = JSON.parse(await fs.readFile(join21(hashDir, "package.json")));
     return pkg.name === runtimeSentinel;
   } catch {
     return false;
   }
 }
-// src/shell/spawn.ts
-import { spawn } from "node:child_process";
-
-// src/core/cmdEscape.ts
-var metaChars = /([()\][%!^"`<>&|;, *?])/g;
-function escapeCommand(command) {
-  return command.replace(metaChars, "^$1");
-}
-function escapeArgument(arg) {
-  const escaped = arg.replace(/(?=(\\+?)?)\1"/g, "$1$1\\\"").replace(/(?=(\\+?)?)\1$/, "$1$1");
-  return `"${escaped}"`.replace(metaChars, "^$1").replace(metaChars, "^$1");
-}
-
-// src/shell/spawn.ts
-function buildSpawnCommand(cmd, args, platform, env) {
-  const options = {};
-  if (env)
-    options.env = env;
-  if (platform !== "win32" || !/\.(cmd|bat)$/i.test(cmd)) {
-    return { cmd, args, options };
-  }
-  const line = [escapeCommand(cmd), ...args.map(escapeArgument)].join(" ");
-  return {
-    cmd: process.env["ComSpec"] ?? "cmd.exe",
-    args: ["/d", "/s", "/c", `"${line}"`],
-    options: { ...options, windowsVerbatimArguments: true }
-  };
-}
-var defaultSpawn = (cmd, args, opts) => new Promise((resolve) => {
-  const env = opts.env ? { ...process.env, ...opts.env } : undefined;
-  const built = buildSpawnCommand(cmd, args, opts.platform, env);
-  const child = spawn(built.cmd, built.args, built.options);
-  let stdout = "";
-  let stderr = "";
-  child.stdout?.on("data", (chunk) => {
-    stdout += String(chunk);
-  });
-  child.stderr?.on("data", (chunk) => {
-    stderr += String(chunk);
-  });
-  if (opts?.stdin !== undefined) {
-    child.stdin?.write(opts.stdin);
-    child.stdin?.end();
-  }
-  child.on("error", (err) => resolve({ exitCode: -1, stdout, stderr: stderr || err.message }));
-  child.on("close", (code) => resolve({ exitCode: code ?? -1, stdout, stderr }));
-});
-
 // src/domains/runtimeEnv/npmInstall.ts
 function buildNpmInstallSpawn(cwd, platform) {
   const built = buildSpawnCommand(resolveNpmCommand(platform), ["install", "--legacy-peer-deps"], platform, undefined);
@@ -21758,10 +23346,10 @@ function spawnNpmInstall(cwd, spawn2 = spawn) {
 }
 
 // src/domains/runtimeEnv/resolvePinned.ts
-import { join as join18 } from "node:path";
+import { join as join22 } from "node:path";
 function readInstalledVersion(dir, pkgName, fs) {
   try {
-    const pkgPath = join18(dir, "node_modules", ...pkgName.split("/"), "package.json");
+    const pkgPath = join22(dir, "node_modules", ...pkgName.split("/"), "package.json");
     const raw = JSON.parse(fs.readFileSync(pkgPath));
     const { version } = raw;
     return typeof version === "string" ? version : undefined;
@@ -21809,10 +23397,10 @@ function allPinnedResolved(dir, fs, platform) {
 }
 
 // src/domains/runtimeEnv/shimDeps.ts
-import { join as join20 } from "node:path";
+import { join as join24 } from "node:path";
 
 // src/shell/resolveExport.ts
-import { join as join19 } from "node:path";
+import { join as join23 } from "node:path";
 function pickPath(entry, preference) {
   if (typeof entry === "string")
     return entry;
@@ -21844,28 +23432,28 @@ function resolveFromEnvDir(envDir, specifier, preference = "esm", fs = makeDefau
   const pkgName = parts.slice(0, pkgPartCount).join("/");
   const rest = parts.slice(pkgPartCount);
   const subpath = rest.length > 0 ? "./" + rest.join("/") : ".";
-  const pkgDir = join19(envDir, "node_modules", ...pkgName.split("/"));
+  const pkgDir = join23(envDir, "node_modules", ...pkgName.split("/"));
   let pkg;
   try {
-    pkg = JSON.parse(fs.readFileSync(join19(pkgDir, "package.json")));
+    pkg = JSON.parse(fs.readFileSync(join23(pkgDir, "package.json")));
   } catch (err) {
     if (isNoEntError(err))
-      throw new Error(`Package '${pkgName}' not found in ${join19(envDir, "node_modules")}`, { cause: err });
+      throw new Error(`Package '${pkgName}' not found in ${join23(envDir, "node_modules")}`, { cause: err });
     throw err;
   }
   const exportsMap = normalizeExports(pkg.exports);
   const entry = exportsMap?.[subpath];
   const relative = pickPath(entry, preference) ?? (subpath === "." ? pkg.module ?? pkg.main : undefined);
   if (!relative) {
-    throw new Error(`No entry for "${subpath}" in exports of ${join19(pkgDir, "package.json")}`);
+    throw new Error(`No entry for "${subpath}" in exports of ${join23(pkgDir, "package.json")}`);
   }
-  return join19(pkgDir, relative);
+  return join23(pkgDir, relative);
 }
 
 // src/domains/runtimeEnv/shimDeps.ts
 function readShimMarker(shimDir, fs) {
   try {
-    const pkg = JSON.parse(fs.readFileSync(join20(shimDir, "package.json")));
+    const pkg = JSON.parse(fs.readFileSync(join24(shimDir, "package.json")));
     if (pkg._qawolf_format) {
       return {
         _qawolf_version: pkg._qawolf_version ?? "",
@@ -21881,11 +23469,11 @@ function resolveBunBuild(bunBuild) {
   return bunBuild === false ? undefined : { build: bunBuild };
 }
 async function removeStaleShims(flowsDir, flowsDeps, fs) {
-  const shimsDir = join20(flowsDir, "node_modules");
+  const shimsDir = join24(flowsDir, "node_modules");
   if (!fs.existsSync(shimsDir))
     return;
   for (const dep of flowsDeps) {
-    const shimDepDir = join20(shimsDir, ...dep.split("/"));
+    const shimDepDir = join24(shimsDir, ...dep.split("/"));
     if (readShimMarker(shimDepDir, fs)) {
       await fs.rm(shimDepDir, { recursive: true, force: true });
     }
@@ -21894,17 +23482,17 @@ async function removeStaleShims(flowsDir, flowsDeps, fs) {
 async function buildDepShim(args) {
   const { envDir, flowsDir, dep, fs, build } = args;
   const depParts = dep.split("/");
-  const depDir = join20(envDir, "node_modules", ...depParts);
+  const depDir = join24(envDir, "node_modules", ...depParts);
   if (!fs.existsSync(depDir))
     return;
   let depVersion;
   try {
-    const pkg = JSON.parse(fs.readFileSync(join20(depDir, "package.json")));
+    const pkg = JSON.parse(fs.readFileSync(join24(depDir, "package.json")));
     depVersion = pkg.version ?? "unknown";
   } catch {
     depVersion = "unknown";
   }
-  const shimDir = join20(flowsDir, "node_modules", ...depParts);
+  const shimDir = join24(flowsDir, "node_modules", ...depParts);
   if (fs.existsSync(shimDir)) {
     const marker = readShimMarker(shimDir, fs);
     if (!marker)
@@ -21931,20 +23519,20 @@ async function buildDepShim(args) {
   }
   const shimCode = await output.text();
   await fs.mkdir(shimDir, { recursive: true });
-  await fs.writeFile(join20(shimDir, "package.json"), JSON.stringify({
+  await fs.writeFile(join24(shimDir, "package.json"), JSON.stringify({
     name: dep,
     _qawolf_version: depVersion,
     _qawolf_format: "bun-build-v1"
   }));
-  await fs.writeFile(join20(shimDir, "index.js"), shimCode);
+  await fs.writeFile(join24(shimDir, "index.js"), shimCode);
 }
 async function shimFlowsDeps(envDir, fs = makeDefaultFs(), bunBuild) {
-  const flowsDir = join20(envDir, "node_modules", "@qawolf", "flows");
+  const flowsDir = join24(envDir, "node_modules", "@qawolf", "flows");
   if (!fs.existsSync(flowsDir))
     return;
   let flowsDeps;
   try {
-    const flowsPkg = JSON.parse(fs.readFileSync(join20(flowsDir, "package.json")));
+    const flowsPkg = JSON.parse(fs.readFileSync(join24(flowsDir, "package.json")));
     flowsDeps = Object.keys(flowsPkg.dependencies ?? {});
   } catch {
     return;
@@ -22125,11 +23713,11 @@ function collectValue(value, previous) {
 }
 
 // src/shell/manifest/pulledEnv.ts
-import { join as join22 } from "node:path";
+import { join as join26 } from "node:path";
 
 // src/shell/manifest/io.ts
 import { createHash as createHash2 } from "node:crypto";
-import { join as join21 } from "node:path";
+import { join as join25 } from "node:path";
 var manifestFilename = ".manifest.json";
 var flowEntrySchema = object({
   path: string2(),
@@ -22151,7 +23739,7 @@ var manifestSchema = object({
 async function readManifest(envDir, fs = makeDefaultFs()) {
   let raw;
   try {
-    raw = await fs.readFile(join21(envDir, manifestFilename));
+    raw = await fs.readFile(join25(envDir, manifestFilename));
   } catch (err) {
     if (isNoEntError(err))
       return "missing";
@@ -22185,7 +23773,7 @@ async function readManifest(envDir, fs = makeDefaultFs()) {
 }
 async function writeManifest(envDir, manifest, fs = makeDefaultFs()) {
   const body = JSON.stringify(manifest, undefined, 2);
-  await fs.writeFile(join21(envDir, manifestFilename), `${body}
+  await fs.writeFile(join25(envDir, manifestFilename), `${body}
 `);
 }
 function hashFile(absPath, fs = makeDefaultFs()) {
@@ -22211,7 +23799,7 @@ async function findPulledEnv(ref, cwd, fs = makeDefaultFs()) {
   return;
 }
 async function listPulledEnvDirs(cwd, fs = makeDefaultFs()) {
-  const root = join22(cwd, ".qawolf");
+  const root = join26(cwd, ".qawolf");
   let entries;
   try {
     entries = await fs.readdirWithTypes(root);
@@ -22224,7 +23812,7 @@ async function listPulledEnvDirs(cwd, fs = makeDefaultFs()) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const envDir = join22(root, entry.name);
+    const envDir = join26(root, entry.name);
     const manifest = await readManifest(envDir, fs);
     if (typeof manifest === "string")
       continue;
@@ -22278,9 +23866,6 @@ async function readEnvLabels(files, readEnvLabel) {
 }
 
 // src/core/suggestNearMiss.ts
-function normalize3(value) {
-  return value.toLowerCase().replace(/[-_\s]+/g, " ").trim();
-}
 function editDistance(a, b) {
   let row = Array.from({ length: b.length + 1 }, (_, j) => j);
   for (let i = 1;i <= a.length; i += 1) {
@@ -22302,14 +23887,14 @@ function suggestNearMiss(input, candidates) {
   if (candidates.includes(input))
     return;
   const sorted = [...candidates].sort();
-  const normalizedInput = normalize3(input);
-  const presentationMatch = sorted.find((candidate) => normalize3(candidate) === normalizedInput);
+  const normalizedInput = normalizeForSearch(input);
+  const presentationMatch = sorted.find((candidate) => normalizeForSearch(candidate) === normalizedInput);
   if (presentationMatch !== undefined)
     return presentationMatch;
   let best;
   let bestDistance = Number.POSITIVE_INFINITY;
   for (const candidate of sorted) {
-    const distance = editDistance(normalizedInput, normalize3(candidate));
+    const distance = editDistance(normalizedInput, normalizeForSearch(candidate));
     if (distance < bestDistance) {
       bestDistance = distance;
       best = candidate;
@@ -22619,7 +24204,7 @@ async function flowsListRemote(ctx, pattern, options) {
 }
 
 // src/domains/flows/pull/handler.ts
-import { dirname as dirname8, join as join27, resolve as resolve8 } from "node:path";
+import { dirname as dirname8, join as join31, resolve as resolve8 } from "node:path";
 
 // src/domains/flows/pull/fetchPhase.ts
 async function fetchTags(ctx, envId) {
@@ -22763,7 +24348,7 @@ async function checkSafety(args) {
 }
 
 // src/domains/flows/pull/reportPull.ts
-import { join as join23 } from "node:path";
+import { join as join27 } from "node:path";
 function reportPullResult(ui, args) {
   if (ui.mode !== "json")
     return;
@@ -22778,12 +24363,12 @@ function reportPullResult(ui, args) {
     assetDownloadedCount: args.assets.downloadedCount,
     assetReusedCount: args.assets.reusedCount,
     assetSkippedCount: args.assets.skippedCount,
-    manifestPath: join23(args.stage.envDir, manifestFilename)
+    manifestPath: join27(args.stage.envDir, manifestFilename)
   }, "");
 }
 
 // src/domains/flows/pull/bundle.ts
-import { join as join24, relative as relative6 } from "node:path";
+import { join as join28, relative as relative6 } from "node:path";
 async function flattenSingleWrapper(dir, fs = makeDefaultFs()) {
   const entries = await fs.readdir(dir);
   if (entries.length !== 1)
@@ -22791,12 +24376,12 @@ async function flattenSingleWrapper(dir, fs = makeDefaultFs()) {
   const innerName = entries[0];
   if (!innerName)
     return;
-  const inner = join24(dir, innerName);
+  const inner = join28(dir, innerName);
   const innerStat = await fs.stat(inner);
   if (!innerStat.isDirectory())
     return;
   for (const e of await fs.readdir(inner)) {
-    await fs.rename(join24(inner, e), join24(dir, e));
+    await fs.rename(join28(inner, e), join28(dir, e));
   }
   const leftovers = await fs.readdir(inner);
   if (leftovers.length > 0) {
@@ -22815,7 +24400,7 @@ async function buildManifest(args, fs = makeDefaultFs()) {
   const flowPaths = await walkForFlows(args.bundleDir, fs);
   const flows = await Promise.all(flowPaths.map(async (rel) => ({
     path: toPosix(rel),
-    contentHash: await hashFile(join24(args.bundleDir, rel), fs),
+    contentHash: await hashFile(join28(args.bundleDir, rel), fs),
     tags: args.tags?.byPath.get(toPosix(rel))
   })));
   return {
@@ -22839,7 +24424,7 @@ async function walkForFlows(root, fs) {
 async function walk(current, root, out, fs) {
   const entries = await fs.readdirWithTypes(current);
   for (const e of entries) {
-    const abs = join24(current, e.name);
+    const abs = join28(current, e.name);
     if (e.isDirectory()) {
       await walk(abs, root, out, fs);
     } else if (e.isFile() && flowExtensions.some((ext) => e.name.endsWith(ext))) {
@@ -22852,11 +24437,11 @@ async function sampleQawolfCommittedAt(bundleDir, fs = makeDefaultFs()) {
   const sample = flowPaths[0];
   if (!sample)
     return;
-  return (await fs.stat(join24(bundleDir, sample))).mtime.toISOString();
+  return (await fs.stat(join28(bundleDir, sample))).mtime.toISOString();
 }
 
 // src/domains/flows/pull/applyTeamStorageRewrite.ts
-import { join as join25, relative as relative7 } from "node:path";
+import { join as join29, relative as relative7 } from "node:path";
 
 // src/domains/flows/pull/rewriteTeamStorage.ts
 var runnerMountPrefix = "/home/wolf/team-storage/";
@@ -22892,7 +24477,7 @@ function isFlowFile(name) {
 async function walk2(dir, out, fs) {
   const entries = await fs.readdirWithTypes(dir);
   for (const e of entries) {
-    const abs = join25(dir, e.name);
+    const abs = join29(dir, e.name);
     if (e.isDirectory()) {
       await walk2(abs, out, fs);
     } else if (e.isFile() && isSourceFile(e.name)) {
@@ -22920,7 +24505,7 @@ async function applyTeamStorageRewrite(rootDir, fs = makeDefaultFs()) {
 }
 
 // src/domains/flows/pull/envVars.ts
-import { join as join26 } from "node:path";
+import { join as join30 } from "node:path";
 
 // src/core/dotenv.ts
 var bareKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -22985,7 +24570,7 @@ function unquote(escaped) {
 async function writeEnvFile(envDir, vars, fs = makeDefaultFs()) {
   if (Object.keys(vars).length === 0)
     return;
-  await fs.writeFile(join26(envDir, ".env"), serializeDotenv(vars), {
+  await fs.writeFile(join30(envDir, ".env"), serializeDotenv(vars), {
     mode: 384
   });
 }
@@ -23049,11 +24634,11 @@ var Ae = Symbol("flush");
 var As = Symbol("flushChunk");
 var z = Symbol("encoding");
 var Mt = Symbol("decoder");
-var g = Symbol("flowing");
+var g2 = Symbol("flowing");
 var Qt = Symbol("paused");
 var Bt = Symbol("resume");
 var b = Symbol("buffer");
-var N = Symbol("pipes");
+var N2 = Symbol("pipes");
 var _ = Symbol("bufferLength");
 var bi = Symbol("bufferPush");
 var Ie = Symbol("bufferShift");
@@ -23101,9 +24686,9 @@ var Li = class extends Fe {
 var Xr = (s) => !!s.objectMode;
 var qr = (s) => !s.objectMode && !!s.encoding && s.encoding !== "buffer";
 var A2 = class extends Di {
-  [g] = false;
+  [g2] = false;
   [Qt] = false;
-  [N] = [];
+  [N2] = [];
   [b] = [];
   [L];
   [z];
@@ -23126,7 +24711,7 @@ var A2 = class extends Di {
     let e = t[0] || {};
     if (super(), e.objectMode && typeof e.encoding == "string")
       throw new TypeError("Encoding and objectMode may not be used together");
-    Xr(e) ? (this[L] = true, this[z] = null) : qr(e) ? (this[z] = e.encoding, this[L] = false) : (this[L] = false, this[z] = null), this[Z] = !!e.async, this[Mt] = this[z] ? new Hr(this[z]) : null, e && e.debugExposeBuffer === true && Object.defineProperty(this, "buffer", { get: () => this[b] }), e && e.debugExposePipes === true && Object.defineProperty(this, "pipes", { get: () => this[N] });
+    Xr(e) ? (this[L] = true, this[z] = null) : qr(e) ? (this[z] = e.encoding, this[L] = false) : (this[L] = false, this[z] = null), this[Z] = !!e.async, this[Mt] = this[z] ? new Hr(this[z]) : null, e && e.debugExposeBuffer === true && Object.defineProperty(this, "buffer", { get: () => this[b] }), e && e.debugExposePipes === true && Object.defineProperty(this, "pipes", { get: () => this[N2] });
     let { signal: i } = e;
     i && (this[Jt] = i, i.aborted ? this[xi]() : i.addEventListener("abort", () => this[xi]()));
   }
@@ -23178,7 +24763,7 @@ var A2 = class extends Di {
       else if (typeof t != "string")
         throw new Error("Non-contiguous data written to non-objectMode stream");
     }
-    return this[L] ? (this[g] && this[_] !== 0 && this[Ae](true), this[g] ? this.emit("data", t) : this[bi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g]) : t.length ? (typeof t == "string" && !(e === this[z] && !this[Mt]?.lastNeed) && (t = Buffer.from(t, e)), Buffer.isBuffer(t) && this[z] && (t = this[Mt].write(t)), this[g] && this[_] !== 0 && this[Ae](true), this[g] ? this.emit("data", t) : this[bi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g]) : (this[_] !== 0 && this.emit("readable"), i && r(i), this[g]);
+    return this[L] ? (this[g2] && this[_] !== 0 && this[Ae](true), this[g2] ? this.emit("data", t) : this[bi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g2]) : t.length ? (typeof t == "string" && !(e === this[z] && !this[Mt]?.lastNeed) && (t = Buffer.from(t, e)), Buffer.isBuffer(t) && this[z] && (t = this[Mt].write(t)), this[g2] && this[_] !== 0 && this[Ae](true), this[g2] ? this.emit("data", t) : this[bi](t), this[_] !== 0 && this.emit("readable"), i && r(i), this[g2]) : (this[_] !== 0 && this.emit("readable"), i && r(i), this[g2]);
   }
   read(t) {
     if (this[S])
@@ -23199,22 +24784,22 @@ var A2 = class extends Di {
     return this.emit("data", e), !this[b].length && !this[Q] && this.emit("drain"), e;
   }
   end(t, e, i) {
-    return typeof t == "function" && (i = t, t = undefined), typeof e == "function" && (i = e, e = "utf8"), t !== undefined && this.write(t, e), i && this.once("end", i), this[Q] = true, this.writable = false, (this[g] || !this[Qt]) && this[J](), this;
+    return typeof t == "function" && (i = t, t = undefined), typeof e == "function" && (i = e, e = "utf8"), t !== undefined && this.write(t, e), i && this.once("end", i), this[Q] = true, this.writable = false, (this[g2] || !this[Qt]) && this[J](), this;
   }
   [Bt]() {
-    this[S] || (!this[Rt] && !this[N].length && (this[C2] = true), this[Qt] = false, this[g] = true, this.emit("resume"), this[b].length ? this[Ae]() : this[Q] ? this[J]() : this.emit("drain"));
+    this[S] || (!this[Rt] && !this[N2].length && (this[C2] = true), this[Qt] = false, this[g2] = true, this.emit("resume"), this[b].length ? this[Ae]() : this[Q] ? this[J]() : this.emit("drain"));
   }
   resume() {
     return this[Bt]();
   }
   pause() {
-    this[g] = false, this[Qt] = true, this[C2] = false;
+    this[g2] = false, this[Qt] = true, this[C2] = false;
   }
   get destroyed() {
     return this[S];
   }
   get flowing() {
-    return this[g];
+    return this[g2];
   }
   get paused() {
     return this[Qt];
@@ -23232,18 +24817,18 @@ var A2 = class extends Di {
     !t && !this[b].length && !this[Q] && this.emit("drain");
   }
   [As](t) {
-    return this.emit("data", t), this[g];
+    return this.emit("data", t), this[g2];
   }
   pipe(t, e) {
     if (this[S])
       return t;
     this[C2] = false;
     let i = this[nt];
-    return e = e || {}, t === Ds.stdout || t === Ds.stderr ? e.end = false : e.end = e.end !== false, e.proxyErrors = !!e.proxyErrors, i ? e.end && t.end() : (this[N].push(e.proxyErrors ? new Li(this, t, e) : new Fe(this, t, e)), this[Z] ? jt(() => this[Bt]()) : this[Bt]()), t;
+    return e = e || {}, t === Ds.stdout || t === Ds.stderr ? e.end = false : e.end = e.end !== false, e.proxyErrors = !!e.proxyErrors, i ? e.end && t.end() : (this[N2].push(e.proxyErrors ? new Li(this, t, e) : new Fe(this, t, e)), this[Z] ? jt(() => this[Bt]()) : this[Bt]()), t;
   }
   unpipe(t) {
-    let e = this[N].find((i) => i.dest === t);
-    e && (this[N].length === 1 ? (this[g] && this[Rt] === 0 && (this[g] = false), this[N] = []) : this[N].splice(this[N].indexOf(e), 1), e.unpipe());
+    let e = this[N2].find((i) => i.dest === t);
+    e && (this[N2].length === 1 ? (this[g2] && this[Rt] === 0 && (this[g2] = false), this[N2] = []) : this[N2].splice(this[N2].indexOf(e), 1), e.unpipe());
   }
   addListener(t, e) {
     return this.on(t, e);
@@ -23251,7 +24836,7 @@ var A2 = class extends Di {
   on(t, e) {
     let i = super.on(t, e);
     if (t === "data")
-      this[C2] = false, this[Rt]++, !this[N].length && !this[g] && this[Bt]();
+      this[C2] = false, this[Rt]++, !this[N2].length && !this[g2] && this[Bt]();
     else if (t === "readable" && this[_] !== 0)
       super.emit("readable");
     else if (Kr(t) && this[nt])
@@ -23267,11 +24852,11 @@ var A2 = class extends Di {
   }
   off(t, e) {
     let i = super.off(t, e);
-    return t === "data" && (this[Rt] = this.listeners("data").length, this[Rt] === 0 && !this[C2] && !this[N].length && (this[g] = false)), i;
+    return t === "data" && (this[Rt] = this.listeners("data").length, this[Rt] === 0 && !this[C2] && !this[N2].length && (this[g2] = false)), i;
   }
   removeAllListeners(t) {
     let e = super.removeAllListeners(t);
-    return (t === "data" || t === undefined) && (this[Rt] = 0, !this[C2] && !this[N].length && (this[g] = false)), e;
+    return (t === "data" || t === undefined) && (this[Rt] = 0, !this[C2] && !this[N2].length && (this[g2] = false)), e;
   }
   get emittedEnd() {
     return this[nt];
@@ -23307,7 +24892,7 @@ var A2 = class extends Di {
     return this[J](), r;
   }
   [Oi](t) {
-    for (let i of this[N])
+    for (let i of this[N2])
       i.dest.write(t) === false && this.pause();
     let e = this[C2] ? false : super.emit("data", t);
     return this[J](), e;
@@ -23319,12 +24904,12 @@ var A2 = class extends Di {
     if (this[Mt]) {
       let e = this[Mt].end();
       if (e) {
-        for (let i of this[N])
+        for (let i of this[N2])
           i.dest.write(e);
         this[C2] || super.emit("data", e);
       }
     }
-    for (let e of this[N])
+    for (let e of this[N2])
       e.end();
     let t = super.emit("end");
     return this.removeAllListeners("end"), t;
@@ -23400,7 +24985,7 @@ var Jr = I.writev;
 var ht = Symbol("_autoClose");
 var H = Symbol("_close");
 var te = Symbol("_ended");
-var m2 = Symbol("_fd");
+var m3 = Symbol("_fd");
 var Ni = Symbol("_finished");
 var tt = Symbol("_flags");
 var Ai = Symbol("_flush");
@@ -23427,7 +25012,7 @@ var Me = Symbol("_defaultFlag");
 var bt = Symbol("_errored");
 var _t = class extends A2 {
   [bt] = false;
-  [m2];
+  [m3];
   [U2];
   [Ci];
   [j] = false;
@@ -23437,10 +25022,10 @@ var _t = class extends A2 {
   constructor(t, e) {
     if (e = e || {}, super(e), this.readable = true, this.writable = false, typeof t != "string")
       throw new TypeError("path must be a string");
-    this[bt] = false, this[m2] = typeof e.fd == "number" ? e.fd : undefined, this[U2] = t, this[Ci] = e.readSize || 16 * 1024 * 1024, this[j] = false, this[Fi] = typeof e.size == "number" ? e.size : 1 / 0, this[ee] = this[Fi], this[ht] = typeof e.autoClose == "boolean" ? e.autoClose : true, typeof this[m2] == "number" ? this[zt]() : this[at]();
+    this[bt] = false, this[m3] = typeof e.fd == "number" ? e.fd : undefined, this[U2] = t, this[Ci] = e.readSize || 16 * 1024 * 1024, this[j] = false, this[Fi] = typeof e.size == "number" ? e.size : 1 / 0, this[ee] = this[Fi], this[ht] = typeof e.autoClose == "boolean" ? e.autoClose : true, typeof this[m3] == "number" ? this[zt]() : this[at]();
   }
   get fd() {
-    return this[m2];
+    return this[m3];
   }
   get path() {
     return this[U2];
@@ -23455,7 +25040,7 @@ var _t = class extends A2 {
     I.open(this[U2], "r", (t, e) => this[Ht](t, e));
   }
   [Ht](t, e) {
-    t ? this[Ut](t) : (this[m2] = e, this.emit("open", e), this[zt]());
+    t ? this[Ut](t) : (this[m3] = e, this.emit("open", e), this[zt]());
   }
   [vi]() {
     return Buffer.allocUnsafe(Math.min(this[Ci], this[ee]));
@@ -23466,16 +25051,16 @@ var _t = class extends A2 {
       let t = this[vi]();
       if (t.length === 0)
         return process.nextTick(() => this[Ii](null, 0, t));
-      I.read(this[m2], t, 0, t.length, null, (e, i, r) => this[Ii](e, i, r));
+      I.read(this[m3], t, 0, t.length, null, (e, i, r) => this[Ii](e, i, r));
     }
   }
   [Ii](t, e, i) {
     this[j] = false, t ? this[Ut](t) : this[ki](e, i) && this[zt]();
   }
   [H]() {
-    if (this[ht] && typeof this[m2] == "number") {
-      let t = this[m2];
-      this[m2] = undefined, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
+    if (this[ht] && typeof this[m3] == "number") {
+      let t = this[m3];
+      this[m3] = undefined, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
     }
   }
   [Ut](t) {
@@ -23491,7 +25076,7 @@ var _t = class extends A2 {
       case "finish":
         return false;
       case "drain":
-        return typeof this[m2] == "number" && this[zt](), false;
+        return typeof this[m3] == "number" && this[zt](), false;
       case "error":
         return this[bt] ? false : (this[bt] = true, super.emit(t, ...e));
       default:
@@ -23514,7 +25099,7 @@ var Be = class extends _t {
       if (!this[j]) {
         this[j] = true;
         do {
-          let e = this[vi](), i = e.length === 0 ? 0 : I.readSync(this[m2], e, 0, e.length, null);
+          let e = this[vi](), i = e.length === 0 ? 0 : I.readSync(this[m3], e, 0, e.length, null);
           if (!this[ki](i, e))
             break;
         } while (true);
@@ -23526,9 +25111,9 @@ var Be = class extends _t {
     }
   }
   [H]() {
-    if (this[ht] && typeof this[m2] == "number") {
-      let t = this[m2];
-      this[m2] = undefined, I.closeSync(t), this.emit("close");
+    if (this[ht] && typeof this[m3] == "number") {
+      let t = this[m3];
+      this[m3] = undefined, I.closeSync(t), this.emit("close");
     }
   }
 };
@@ -23543,15 +25128,15 @@ var et = class extends Qr {
   [U2];
   [ie];
   [ht];
-  [m2];
+  [m3];
   [Me];
   [tt];
   [Ni] = false;
   [ot];
   constructor(t, e) {
-    e = e || {}, super(e), this[U2] = t, this[m2] = typeof e.fd == "number" ? e.fd : undefined, this[ie] = e.mode === undefined ? 438 : e.mode, this[ot] = typeof e.start == "number" ? e.start : undefined, this[ht] = typeof e.autoClose == "boolean" ? e.autoClose : true;
+    e = e || {}, super(e), this[U2] = t, this[m3] = typeof e.fd == "number" ? e.fd : undefined, this[ie] = e.mode === undefined ? 438 : e.mode, this[ot] = typeof e.start == "number" ? e.start : undefined, this[ht] = typeof e.autoClose == "boolean" ? e.autoClose : true;
     let i = this[ot] !== undefined ? "r+" : "w";
-    this[Me] = e.flags === undefined, this[tt] = e.flags === undefined ? i : e.flags, this[m2] === undefined && this[at]();
+    this[Me] = e.flags === undefined, this[tt] = e.flags === undefined ? i : e.flags, this[m3] === undefined && this[at]();
   }
   emit(t, ...e) {
     if (t === "error") {
@@ -23562,7 +25147,7 @@ var et = class extends Qr {
     return super.emit(t, ...e);
   }
   get fd() {
-    return this[m2];
+    return this[m3];
   }
   get path() {
     return this[U2];
@@ -23574,16 +25159,16 @@ var et = class extends Qr {
     I.open(this[U2], this[tt], this[ie], (t, e) => this[Ht](t, e));
   }
   [Ht](t, e) {
-    this[Me] && this[tt] === "r+" && t && t.code === "ENOENT" ? (this[tt] = "w", this[at]()) : t ? this[Ut](t) : (this[m2] = e, this.emit("open", e), this[gt] || this[Ai]());
+    this[Me] && this[tt] === "r+" && t && t.code === "ENOENT" ? (this[tt] = "w", this[at]()) : t ? this[Ut](t) : (this[m3] = e, this.emit("open", e), this[gt] || this[Ai]());
   }
   end(t, e) {
-    return t && this.write(t, e), this[te] = true, !this[gt] && !this[Y].length && typeof this[m2] == "number" && this[Pt](null, 0), this;
+    return t && this.write(t, e), this[te] = true, !this[gt] && !this[Y].length && typeof this[m3] == "number" && this[Pt](null, 0), this;
   }
   write(t, e) {
-    return typeof t == "string" && (t = Buffer.from(t, e)), this[te] ? (this.emit("error", new Error("write() after end()")), false) : this[m2] === undefined || this[gt] || this[Y].length ? (this[Y].push(t), this[ke] = true, false) : (this[gt] = true, this[ve](t), true);
+    return typeof t == "string" && (t = Buffer.from(t, e)), this[te] ? (this.emit("error", new Error("write() after end()")), false) : this[m3] === undefined || this[gt] || this[Y].length ? (this[Y].push(t), this[ke] = true, false) : (this[gt] = true, this[ve](t), true);
   }
   [ve](t) {
-    I.write(this[m2], t, 0, t.length, this[ot], (e, i) => this[Pt](e, i));
+    I.write(this[m3], t, 0, t.length, this[ot], (e, i) => this[Pt](e, i));
   }
   [Pt](t, e) {
     t ? this[Ut](t) : (this[ot] !== undefined && typeof e == "number" && (this[ot] += e), this[Y].length ? this[Ai]() : (this[gt] = false, this[te] && !this[Ni] ? (this[Ni] = true, this[H](), this.emit("finish")) : this[ke] && (this[ke] = false, this.emit("drain"))));
@@ -23595,13 +25180,13 @@ var et = class extends Qr {
       this[ve](this[Y].pop());
     else {
       let t = this[Y];
-      this[Y] = [], Jr(this[m2], t, this[ot], (e, i) => this[Pt](e, i));
+      this[Y] = [], Jr(this[m3], t, this[ot], (e, i) => this[Pt](e, i));
     }
   }
   [H]() {
-    if (this[ht] && typeof this[m2] == "number") {
-      let t = this[m2];
-      this[m2] = undefined, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
+    if (this[ht] && typeof this[m3] == "number") {
+      let t = this[m3];
+      this[m3] = undefined, I.close(t, (e) => e ? this.emit("error", e) : this.emit("close"));
     }
   }
 };
@@ -23621,15 +25206,15 @@ var Wt = class extends et {
     this[Ht](null, t);
   }
   [H]() {
-    if (this[ht] && typeof this[m2] == "number") {
-      let t = this[m2];
-      this[m2] = undefined, I.closeSync(t), this.emit("close");
+    if (this[ht] && typeof this[m3] == "number") {
+      let t = this[m3];
+      this[m3] = undefined, I.closeSync(t), this.emit("close");
     }
   }
   [ve](t) {
     let e = true;
     try {
-      this[Pt](null, I.writeSync(this[m2], t, 0, t.length, this[ot])), e = false;
+      this[Pt](null, I.writeSync(this[m3], t, 0, t.length, this[ot])), e = false;
     } finally {
       if (e)
         try {
@@ -25607,7 +27192,7 @@ var Dr = Symbol("onEntry");
 var _s = Symbol("checkFs");
 var Nr = Symbol("checkFs2");
 var Os = Symbol("isReusable");
-var P = Symbol("makeFs");
+var P2 = Symbol("makeFs");
 var Ts = Symbol("file");
 var xs = Symbol("directory");
 var gi = Symbol("link");
@@ -25895,23 +27480,23 @@ var Xt = class extends rt {
           return;
         }
         if (h || this[Os](t, a))
-          return this[P](null, t, i);
+          return this[P2](null, t, i);
         if (a.isDirectory()) {
           if (t.type === "Directory") {
-            let l = this.chmod && t.mode && (a.mode & 4095) !== t.mode, c = (d) => this[P](d ?? null, t, i);
+            let l = this.chmod && t.mode && (a.mode & 4095) !== t.mode, c = (d) => this[P2](d ?? null, t, i);
             return l ? u3.chmod(String(t.absolute), Number(t.mode), c) : c();
           }
           if (t.absolute !== this.cwd)
-            return u3.rmdir(String(t.absolute), (l) => this[P](l ?? null, t, i));
+            return u3.rmdir(String(t.absolute), (l) => this[P2](l ?? null, t, i));
         }
         if (t.absolute === this.cwd)
-          return this[P](null, t, i);
-        mo(String(t.absolute), (l) => this[P](l ?? null, t, i));
+          return this[P2](null, t, i);
+        mo(String(t.absolute), (l) => this[P2](l ?? null, t, i));
       });
     };
     this[Oe] ? n() : r();
   }
-  [P](t, e, i) {
+  [P2](t, e, i) {
     if (t) {
       this[O](t, e), i();
       return;
@@ -25945,8 +27530,8 @@ var ye = (s) => {
 };
 var xe = class extends Xt {
   sync = true;
-  [P](t, e) {
-    return super[P](t, e, () => {});
+  [P2](t, e) {
+    return super[P2](t, e, () => {});
   }
   [_s](t) {
     if (!this[Oe]) {
@@ -25967,19 +27552,19 @@ var xe = class extends Xt {
     if (i && (this.keep || this.newer && i.mtime > (t.mtime ?? i.mtime)))
       return this[Ls](t);
     if (e || this[Os](t, i))
-      return this[P](null, t);
+      return this[P2](null, t);
     if (i.isDirectory()) {
       if (t.type === "Directory") {
         let o = this.chmod && t.mode && (i.mode & 4095) !== t.mode, [h] = o ? ye(() => {
           u3.chmodSync(String(t.absolute), Number(t.mode));
         }) : [];
-        return this[P](h, t);
+        return this[P2](h, t);
       }
       let [n] = ye(() => u3.rmdirSync(String(t.absolute)));
-      this[P](n, t);
+      this[P2](n, t);
     }
     let [r] = t.absolute === this.cwd ? [] : ye(() => po(String(t.absolute)));
-    this[P](r, t);
+    this[P2](r, t);
   }
   [Ts](t, e) {
     let i = typeof t.mode == "number" ? t.mode & 4095 : this.fmode, r = (h) => {
@@ -26427,8 +28012,8 @@ async function handleFlowsPull(ctx, opts, deps) {
     ctx.ui.error(validation.error);
     return { error: validation.error };
   }
-  const destAbs = resolve8(opts.out ?? join27(".qawolf", opts.env));
-  const assetsAbs = join27(dirname8(destAbs), "assets");
+  const destAbs = resolve8(opts.out ?? join31(".qawolf", opts.env));
+  const assetsAbs = join31(dirname8(destAbs), "assets");
   await resolvedDeps.fs.mkdir(assetsAbs, { recursive: true });
   const yes = opts.yes ?? false;
   let archive;
@@ -27303,15 +28888,15 @@ async function defaultRunWebFlowDeps(envDir = process.cwd(), signals) {
 
 // src/domains/runtimeEnv/prepareRunDir.ts
 import { createHash as createHash4 } from "node:crypto";
-import { join as join35, resolve as resolve9 } from "node:path";
+import { join as join39, resolve as resolve9 } from "node:path";
 
 // src/domains/runtimeEnv/execSubpathImports.ts
-import { join as join28 } from "node:path";
+import { join as join32 } from "node:path";
 var flowSubpathImports = { "#playwright": "playwright" };
 var packageJsonSchema = looseObject({ imports: record(string2(), unknown()).catch({}) }).catch({ imports: {} });
 async function writeExecSubpathImports(args) {
   const { execDir, fs } = args;
-  const pkgPath = join28(execDir, "package.json");
+  const pkgPath = join32(execDir, "package.json");
   const pkg = packageJsonSchema.parse(await readPackageJson(pkgPath, fs));
   const merged = { ...pkg, imports: { ...pkg.imports, ...flowSubpathImports } };
   await fs.writeFile(pkgPath, JSON.stringify(merged, undefined, 2));
@@ -27333,10 +28918,10 @@ async function readPackageJson(pkgPath, fs) {
 }
 
 // src/domains/runtimeEnv/innerHop.ts
-import { join as join30 } from "node:path";
+import { join as join34 } from "node:path";
 
 // src/domains/runtimeEnv/linkPinnedPackages.ts
-import { dirname as dirname9, join as join29 } from "node:path";
+import { dirname as dirname9, join as join33 } from "node:path";
 
 // src/domains/runtimeEnv/symlinkDir.ts
 import { symlink } from "node:fs/promises";
@@ -27348,16 +28933,16 @@ async function createDirSymlink(source, target) {
 // src/domains/runtimeEnv/linkPinnedPackages.ts
 async function linkPinnedPackages(args) {
   const { depsRoot, nodeModulesDir, fs } = args;
-  const managedModules = join29(depsRoot, "node_modules");
+  const managedModules = join33(depsRoot, "node_modules");
   await fs.mkdir(nodeModulesDir, { recursive: true });
   for (const { name } of pinnedPackages) {
     const segments = name.split("/");
-    const target = join29(nodeModulesDir, ...segments);
+    const target = join33(nodeModulesDir, ...segments);
     if (segments.length > 1) {
       await fs.mkdir(dirname9(target), { recursive: true });
     }
     await fs.rm(target, { recursive: true, force: true });
-    await createDirSymlink(join29(managedModules, ...segments), target);
+    await createDirSymlink(join33(managedModules, ...segments), target);
   }
 }
 
@@ -27366,18 +28951,18 @@ async function populateInnerHop(args) {
   const { depsRoot, execDir, fs } = args;
   await linkPinnedPackages({
     depsRoot,
-    nodeModulesDir: join30(execDir, "node_modules"),
+    nodeModulesDir: join34(execDir, "node_modules"),
     fs
   });
 }
 
 // src/domains/runtimeEnv/outerHop.ts
 import { lstat as lstat2 } from "node:fs/promises";
-import { dirname as dirname11, join as join32 } from "node:path";
+import { dirname as dirname11, join as join36 } from "node:path";
 
 // src/domains/runtimeEnv/carryOverPackages.ts
 import { lstat } from "node:fs/promises";
-import { dirname as dirname10, join as join31 } from "node:path";
+import { dirname as dirname10, join as join35 } from "node:path";
 
 // src/domains/runtimeEnv/carryOverPlan.ts
 var executorPackageNames = new Set(pinnedPackages.map((p) => p.name));
@@ -27399,12 +28984,12 @@ async function carryOverPackages(args) {
   const linked = [];
   for (const name of names) {
     const segments = name.split("/");
-    const target = join31(nodeModulesDir, ...segments);
+    const target = join35(nodeModulesDir, ...segments);
     if (await pathOccupied(target))
       continue;
     if (segments.length > 1)
       await fs.mkdir(dirname10(target), { recursive: true });
-    await createDirSymlink(join31(projectModulesDir, ...segments), target);
+    await createDirSymlink(join35(projectModulesDir, ...segments), target);
     linked.push(name);
   }
   return linked;
@@ -27427,18 +29012,18 @@ async function listPackageNames(dir, fs) {
   const names = [];
   for (const entry of entries) {
     if (!entry.startsWith("@")) {
-      if (fs.existsSync(join31(dir, entry, "package.json")))
+      if (fs.existsSync(join35(dir, entry, "package.json")))
         names.push(entry);
       continue;
     }
     let scoped;
     try {
-      scoped = await fs.readdir(join31(dir, entry));
+      scoped = await fs.readdir(join35(dir, entry));
     } catch {
       continue;
     }
     for (const inner of scoped) {
-      if (fs.existsSync(join31(dir, entry, inner, "package.json"))) {
+      if (fs.existsSync(join35(dir, entry, inner, "package.json"))) {
         names.push(`${entry}/${inner}`);
       }
     }
@@ -27456,7 +29041,7 @@ async function populateOuterHop(args) {
   const depNames = Object.keys(installableDeps);
   const { satisfying, rejected } = await findSatisfyingNodeModulesDir(projectDir, depNames, fs);
   if (satisfying !== undefined) {
-    await createDirSymlink(satisfying, join32(runDir, "node_modules"));
+    await createDirSymlink(satisfying, join36(runDir, "node_modules"));
     return { mode: "symlink", nodeModulesDir: satisfying };
   }
   if (depNames.length === 0)
@@ -27465,12 +29050,12 @@ async function populateOuterHop(args) {
   await installOuterDeps(runDir, installableDeps, fs, args.install ?? spawnNpmInstall);
   await linkPinnedPackages({
     depsRoot: args.depsRoot,
-    nodeModulesDir: join32(runDir, "node_modules"),
+    nodeModulesDir: join36(runDir, "node_modules"),
     fs
   });
   const carriedOver = await carryOverPackages({
-    projectModulesDir: join32(projectDir, "node_modules"),
-    nodeModulesDir: join32(runDir, "node_modules"),
+    projectModulesDir: join36(projectDir, "node_modules"),
+    nodeModulesDir: join36(runDir, "node_modules"),
     fs
   });
   return { mode: "install", depCount: depNames.length, rejected, carriedOver };
@@ -27479,10 +29064,10 @@ async function findSatisfyingNodeModulesDir(startDir, depNames, fs) {
   const rejected = [];
   let dir = startDir;
   while (true) {
-    const candidate = join32(dir, "node_modules");
+    const candidate = join36(dir, "node_modules");
     const stats = await lstatSafe(candidate);
     if (stats !== undefined && stats.isDirectory() && !stats.isSymbolicLink()) {
-      const missing = depNames.filter((name) => !fs.existsSync(join32(candidate, name, "package.json")));
+      const missing = depNames.filter((name) => !fs.existsSync(join36(candidate, name, "package.json")));
       if (missing.length === 0)
         return { satisfying: candidate, rejected };
       rejected.push({ dir: candidate, missing });
@@ -27503,7 +29088,7 @@ async function lstatSafe(path) {
 async function readInstallableDeps(projectDir, fs) {
   let content;
   try {
-    content = await fs.readFile(join32(projectDir, "package.json"));
+    content = await fs.readFile(join36(projectDir, "package.json"));
   } catch {
     return {};
   }
@@ -27521,8 +29106,8 @@ async function readInstallableDeps(projectDir, fs) {
   return Object.fromEntries(Object.entries(rawDeps).filter(([name]) => !executorPackageNames2.has(name)).filter((entry) => typeof entry[1] === "string"));
 }
 async function installOuterDeps(runDir, deps, fs, install) {
-  await fs.writeFile(join32(runDir, "package.json"), JSON.stringify({ name: "qawolf-run", private: true, dependencies: deps }, undefined, 2));
-  await fs.writeFile(join32(runDir, ".npmrc"), `@qawolf:registry=https://registry.npmjs.org/
+  await fs.writeFile(join36(runDir, "package.json"), JSON.stringify({ name: "qawolf-run", private: true, dependencies: deps }, undefined, 2));
+  await fs.writeFile(join36(runDir, ".npmrc"), `@qawolf:registry=https://registry.npmjs.org/
 `);
   const result = await install(runDir);
   if (result.exitCode !== 0) {
@@ -27532,14 +29117,14 @@ async function installOuterDeps(runDir, deps, fs, install) {
 
 // src/domains/runtimeEnv/stageFlowFiles.ts
 import { createHash as createHash3 } from "node:crypto";
-import { basename as basename6, dirname as dirname12, join as join34, sep as sep4 } from "node:path";
+import { basename as basename6, dirname as dirname12, join as join38, sep as sep4 } from "node:path";
 
 // src/shell/copyDir.ts
 import { cp, readdir as readdir2 } from "node:fs/promises";
-import { basename as basename5, join as join33 } from "node:path";
+import { basename as basename5, join as join37 } from "node:path";
 async function copyDirExcluding(source, destination, excludedNames) {
   const entries = await readdir2(source, { withFileTypes: true });
-  await Promise.all(entries.filter((entry) => !excludedNames.has(entry.name)).map((entry) => cp(join33(source, entry.name), join33(destination, entry.name), {
+  await Promise.all(entries.filter((entry) => !excludedNames.has(entry.name)).map((entry) => cp(join37(source, entry.name), join37(destination, entry.name), {
     recursive: true,
     filter: (path) => !excludedNames.has(basename5(path))
   })));
@@ -27556,14 +29141,14 @@ async function stageFlowFiles(args) {
   if (files.length > 1) {
     return Promise.all(files.map((f) => stageOneFile(f, execDir, fs)));
   }
-  await Promise.all(files.map((f) => fs.copyFile(f, join34(execDir, basename6(f)))));
-  return files.map((f) => join34(execDir, basename6(f)));
+  await Promise.all(files.map((f) => fs.copyFile(f, join38(execDir, basename6(f)))));
+  return files.map((f) => join38(execDir, basename6(f)));
 }
 async function stageOneFile(file, execDir, fs) {
   const dirHash = createHash3("sha256").update(dirname12(file)).digest("hex").slice(0, 8);
-  const subDir = join34(execDir, dirHash);
+  const subDir = join38(execDir, dirHash);
   await fs.mkdir(subDir, { recursive: true });
-  const dest = join34(subDir, basename6(file));
+  const dest = join38(subDir, basename6(file));
   await fs.copyFile(file, dest);
   return dest;
 }
@@ -27571,7 +29156,7 @@ function remapPath(file, projectDir, execDir) {
   if (file === projectDir)
     return execDir;
   if (file.startsWith(projectDir + sep4)) {
-    return join34(execDir, file.slice(projectDir.length + 1));
+    return join38(execDir, file.slice(projectDir.length + 1));
   }
   return;
 }
@@ -27581,10 +29166,10 @@ async function prepareRunDir(args) {
   const { files, projectDir, depsRoot, runRoot } = args;
   const fs = args.fs ?? makeDefaultFs();
   const runId = buildRunId(projectDir, files);
-  const runDir = join35(runRoot, runId);
+  const runDir = join39(runRoot, runId);
   await fs.rm(runDir, { recursive: true, force: true });
   await fs.mkdir(runDir, { recursive: true });
-  const execDir = join35(runDir, "exec");
+  const execDir = join39(runDir, "exec");
   await fs.mkdir(execDir, { recursive: true });
   await populateInnerHop({ depsRoot, execDir, fs });
   const stagedFiles = await stageFlowFiles({ files, projectDir, execDir, fs });
@@ -27615,17 +29200,17 @@ function buildRunId(projectDir, files) {
 }
 
 // src/shell/testkit.ts
-import { join as join36 } from "node:path";
+import { join as join40 } from "node:path";
 function notAvailableLocally(name) {
   throw new Error(runnerMessages.notAvailableLocally(name));
 }
 async function loadSdkDeps(cwd) {
-  const testkitDir = join36(cwd, "node_modules", "@qawolf", "testkit");
+  const testkitDir = join40(cwd, "node_modules", "@qawolf", "testkit");
   try {
     const clientMod = await importFromPath(resolveFromEnvDir(cwd, "@qawolf/testkit/client"));
     if (typeof clientMod.createTestkitClient !== "function")
       throw new Error("createTestkitClient is not a function");
-    const scopeMod = await importFromPath(join36(testkitDir, "dist", "clientScope.js"));
+    const scopeMod = await importFromPath(join40(testkitDir, "dist", "clientScope.js"));
     if (typeof scopeMod.configureTestkitClient !== "function")
       throw new Error("configureTestkitClient is not a function");
     return {
@@ -27683,9 +29268,9 @@ async function registerLazyEmailsClient(getInbox, cwd, deps) {
 }
 
 // src/commands/flows/envVarDeps.ts
-import { join as join37 } from "node:path";
+import { join as join41 } from "node:path";
 function envFilePath(envDir) {
-  return join37(envDir, ".env");
+  return join41(envDir, ".env");
 }
 async function readEnv(envDir, fs) {
   try {
@@ -27809,7 +29394,7 @@ async function selectRunByTag(args) {
 }
 
 // src/commands/flows/runStagedFlows.ts
-import { join as join41 } from "node:path";
+import { join as join45 } from "node:path";
 
 // src/shell/appium/createAppiumServer.ts
 import { existsSync as existsSync2 } from "node:fs";
@@ -29115,14 +30700,14 @@ async function runWebFlow({
 
 // src/shell/embeddedWorkerCli.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { basename as basename7, join as join38 } from "node:path";
+import { basename as basename7, join as join42 } from "node:path";
 var embeddedCliPathEnv = "QAWOLF_EMBEDDED_CLI_PATH";
 function extractEmbeddedWorkerCli() {
   const assetPath = process.env[embeddedCliPathEnv];
   if (assetPath === undefined || assetPath === "")
     return;
-  const dir = join38(getDataDir(), "worker");
-  const dest = join38(dir, basename7(assetPath));
+  const dir = join42(getDataDir(), "worker");
+  const dest = join42(dir, basename7(assetPath));
   if (existsSync3(dest))
     return dest;
   mkdirSync3(dir, { recursive: true });
@@ -29360,7 +30945,7 @@ ${styleText3("dim", "─".repeat(width))}
   };
 }
 // src/shell/reporter/createJUnitReporter.ts
-import { join as join39 } from "node:path";
+import { join as join43 } from "node:path";
 
 // src/shell/reporter/junitXml.ts
 function escapeXml(str) {
@@ -29399,7 +30984,7 @@ ${suites}`;
 
 // src/shell/reporter/createJUnitReporter.ts
 function resolveJUnitOutputPath(junit, outputDir) {
-  return typeof junit === "string" && junit.trim() !== "" ? junit : join39(outputDir, "junit-report.xml");
+  return typeof junit === "string" && junit.trim() !== "" ? junit : join43(outputDir, "junit-report.xml");
 }
 function createJUnitReporter(deps) {
   const flows = [];
@@ -29490,11 +31075,11 @@ function buildFlowsRunDeps(args) {
 
 // src/commands/flows/loadEnvFile.ts
 import { readFile } from "node:fs/promises";
-import { join as join40 } from "node:path";
+import { join as join44 } from "node:path";
 async function loadEnvFile(envDir) {
   let content;
   try {
-    content = await readFile(join40(envDir, ".env"), "utf8");
+    content = await readFile(join44(envDir, ".env"), "utf8");
   } catch (err) {
     if (isNoEntError(err))
       return;
@@ -29539,7 +31124,7 @@ async function runStagedFlows(args) {
     for (const candidate of staged.outerHop.rejected) {
       log.debug(runnerMessages.outerHopCandidateRejected(candidate.dir, candidate.missing));
     }
-    const ownModules = projectDir === undefined ? undefined : join41(projectDir, "node_modules");
+    const ownModules = projectDir === undefined ? undefined : join45(projectDir, "node_modules");
     const own = staged.outerHop.rejected.find((c) => c.dir === ownModules);
     if (own !== undefined) {
       ctx.ui.warn(runnerMessages.outerHopFallbackNotice(own.dir, own.missing));
@@ -29574,7 +31159,7 @@ async function runStagedFlows(args) {
 }
 
 // src/commands/flows/runDefaults.ts
-function makeDefaultDeps2(fs) {
+function makeDefaultDeps3(fs) {
   return {
     expandPatterns: (patterns, cwd, logger) => expandPatterns(patterns, cwd, logger, fs),
     resolveDepsRoot: (args) => resolveDepsRoot({ ...args, fs }),
@@ -29586,7 +31171,7 @@ function makeDefaultDeps2(fs) {
   };
 }
 async function handleFlowsRun(ctx, pattern, flags, deps, selectors = { tags: [] }, allEnvs = false) {
-  const resolvedDeps = deps ?? makeDefaultDeps2(ctx.fs);
+  const resolvedDeps = deps ?? makeDefaultDeps3(ctx.fs);
   const cwd = process.cwd();
   const expandedFiles = await resolvedDeps.expandPatterns(buildPatternArgs(pattern), cwd, ctx.log("flows"));
   ctx.log("flows").debug(`discovered ${pluralize(expandedFiles.length, "flow")}`);
@@ -29635,7 +31220,7 @@ async function chooseEnv(ctx, files, allEnvs) {
 }
 
 // src/commands/flows/hybridRunDefaults.ts
-import { join as join42, resolve as resolve10 } from "node:path";
+import { join as join46, resolve as resolve10 } from "node:path";
 
 // src/core/selectFlowFiles.ts
 function selectFlowFiles(args) {
@@ -29740,7 +31325,7 @@ async function handleHybridFlowsRun(ctx, pattern, flags, options = {}) {
   if (validation !== "ok") {
     return { error: validation.error, exitCode: 2 };
   }
-  const envDir = resolve10(join42(".qawolf", flags.env));
+  const envDir = resolve10(join46(".qawolf", flags.env));
   const patternArgs = buildPatternArgs(pattern);
   const globFlows = () => resolvedDeps.expandPatterns(patternArgs, envDir, ctx.log("flows"));
   let files = await globFlows();
@@ -29936,12 +31521,12 @@ function registerFlowsCommand(program, signals, deps = { withResolvedEnv }) {
 }
 
 // src/domains/init/init.ts
-import { dirname as dirname14, join as join44, relative as relative9 } from "node:path";
+import { dirname as dirname14, join as join48, relative as relative9 } from "node:path";
 
 // src/domains/init/ensurePackageJson.ts
-import { join as join43 } from "node:path";
+import { join as join47 } from "node:path";
 async function ensurePackageJson(ctx, yes, deps) {
-  const pkgPath = join43(deps.cwd, "package.json");
+  const pkgPath = join47(deps.cwd, "package.json");
   if (!await deps.fs.pathExists(pkgPath)) {
     const confirmed = await ctx.ui.confirm(initMessages.createPackageJsonPrompt, { yes });
     if (!confirmed.ok || !confirmed.value) {
@@ -30067,9 +31652,9 @@ function makeDefaultInitDeps() {
 async function handleInit(ctx, opts, deps = makeDefaultInitDeps()) {
   ctx.ui.gap();
   ctx.ui.intro(initMessages.title);
-  const configPath = join44(deps.cwd, "qawolf.config.ts");
-  const flowPath = join44(deps.cwd, "src", "flows", "example.flow.ts");
-  const gitignorePath = join44(deps.cwd, ".qawolf", ".gitignore");
+  const configPath = join48(deps.cwd, "qawolf.config.ts");
+  const flowPath = join48(deps.cwd, "src", "flows", "example.flow.ts");
+  const gitignorePath = join48(deps.cwd, ".qawolf", ".gitignore");
   await writeWithPrompt(ctx, configPath, qawolfConfigTs, opts.yes, deps);
   await writeWithPrompt(ctx, flowPath, exampleFlowTs, opts.yes, deps);
   await writeWithPrompt(ctx, gitignorePath, qawolfGitignore, opts.yes, deps);
@@ -30107,7 +31692,7 @@ Examples:
 import { parseExecutionTarget as parseExecutionTarget4 } from "@qawolf/flow-targets";
 
 // src/domains/install/android/avd.ts
-import { join as join45 } from "node:path";
+import { join as join49 } from "node:path";
 async function installAvds(ctx, specs, deps) {
   const sdkManagerPath = sdkManagerBin(deps.androidHome, deps.platform);
   const avdManagerPath = avdManagerBin(deps.androidHome, deps.platform);
@@ -30117,7 +31702,7 @@ async function installAvds(ctx, specs, deps) {
   if (versionResult.exitCode !== 0) {
     throw new Error(installMessages.android.sdkmanagerNotFound(sdkManagerPath));
   }
-  const licenseFile = join45(deps.androidHome, "licenses", "android-sdk-license");
+  const licenseFile = join49(deps.androidHome, "licenses", "android-sdk-license");
   if (deps.checkExists(licenseFile)) {
     ctx.ui.info(installMessages.android.licensesAlreadyAccepted);
   } else {
@@ -30132,7 +31717,7 @@ async function installAvds(ctx, specs, deps) {
   for (const spec of specs) {
     if (installedImages.has(spec.systemImage))
       continue;
-    const systemImg = join45(deps.androidHome, ...spec.systemImage.split(";"), "system.img");
+    const systemImg = join49(deps.androidHome, ...spec.systemImage.split(";"), "system.img");
     if (deps.checkExists(systemImg)) {
       ctx.ui.info(installMessages.android.systemImageAlreadyInstalled(spec.systemImage));
       installedImages.add(spec.systemImage);
@@ -30430,42 +32015,6 @@ Examples:
   });
 }
 
-// src/core/publicApi/flagKind.ts
-function flagKind(schema) {
-  if (schema.type === "string")
-    return { ok: true, kind: "string" };
-  if (schema.type === "number" || schema.type === "integer") {
-    return { ok: true, kind: "number" };
-  }
-  if (schema.type === "boolean")
-    return { ok: true, kind: "boolean" };
-  if (schema.type === "array") {
-    if (schema.items?.type !== "string") {
-      return {
-        ok: false,
-        reason: "only string arrays can be expressed as flags"
-      };
-    }
-    return { ok: true, kind: "string-array" };
-  }
-  if (schema.type === "object") {
-    if (schema.properties) {
-      return {
-        ok: false,
-        reason: "nested objects cannot be expressed as flags"
-      };
-    }
-    if (typeof schema.additionalProperties === "object" && schema.additionalProperties.type === "string") {
-      return { ok: true, kind: "key-value-record" };
-    }
-    return { ok: false, reason: "nested objects cannot be expressed as flags" };
-  }
-  return {
-    ok: false,
-    reason: `type ${schema.type ?? "unknown"} cannot be expressed as a flag`
-  };
-}
-
 // src/core/publicApi/flagNames.ts
 var kebabCase = (segment) => segment.replace(/[A-Z]/g, (char) => `-${char.toLowerCase()}`);
 var capitalize = (segment) => `${segment.slice(0, 1).toUpperCase()}${segment.slice(1)}`;
@@ -30484,108 +32033,6 @@ function flagUsage(path, kind) {
   return `${name} <value>`;
 }
 
-// src/core/publicApi/objectShape.ts
-var asObjectShape = (schema) => schema.type === "object" && schema.properties ? { properties: schema.properties, required: new Set(schema.required) } : undefined;
-function mergeIntersection(members) {
-  const shape = { properties: {}, required: new Set };
-  for (const member of members) {
-    const memberShape = asObjectShape(member);
-    if (!memberShape) {
-      return {
-        ok: false,
-        field: "",
-        reason: "intersection members must be object schemas"
-      };
-    }
-    for (const [field, fieldSchema] of Object.entries(memberShape.properties)) {
-      if (field in shape.properties) {
-        return {
-          ok: false,
-          field,
-          reason: "field appears in multiple intersection members"
-        };
-      }
-      shape.properties[field] = fieldSchema;
-      if (memberShape.required.has(field))
-        shape.required.add(field);
-    }
-  }
-  return { ok: true, shape };
-}
-function mergeUnion(branches) {
-  const shapes = [];
-  for (const branch of branches) {
-    const branchShape = asObjectShape(branch);
-    if (!branchShape) {
-      return {
-        ok: false,
-        field: "",
-        reason: "union branches must be object schemas"
-      };
-    }
-    shapes.push(branchShape);
-  }
-  const shape = { properties: {}, required: new Set };
-  for (const branchShape of shapes) {
-    for (const [field, fieldSchema] of Object.entries(branchShape.properties)) {
-      const existing = shape.properties[field];
-      if (!existing) {
-        shape.properties[field] = { ...fieldSchema };
-        continue;
-      }
-      const kinds = [flagKind(existing), flagKind(fieldSchema)];
-      if (kinds[0]?.ok && kinds[1]?.ok) {
-        if (kinds[0].kind !== kinds[1].kind) {
-          return {
-            ok: false,
-            field,
-            reason: "field has conflicting types across union branches"
-          };
-        }
-      } else if (JSON.stringify({ ...existing, description: undefined }) !== JSON.stringify({ ...fieldSchema, description: undefined })) {
-        return {
-          ok: false,
-          field,
-          reason: "field has conflicting object schemas across union branches"
-        };
-      }
-      if (!existing.description && fieldSchema.description) {
-        existing.description = fieldSchema.description;
-      }
-    }
-  }
-  const discriminator = Object.keys(shape.properties).find((field) => {
-    const values = shapes.map((branch) => branch.properties[field]?.const);
-    return values.every((value) => typeof value === "string") && new Set(values).size === shapes.length && shapes.every((branch) => branch.required.has(field));
-  });
-  for (const [field, fieldSchema] of Object.entries(shape.properties)) {
-    const occurrences = shapes.filter((branch) => (field in branch.properties));
-    if (occurrences.length === shapes.length && occurrences.every((branch) => branch.required.has(field))) {
-      shape.required.add(field);
-    }
-    if (field === discriminator) {
-      const values = shapes.map((branch) => branch.properties[field]?.const);
-      fieldSchema.description = `One of: ${values.join(", ")}`;
-    }
-  }
-  return { ok: true, shape };
-}
-function toObjectShape(schema) {
-  if (schema.allOf)
-    return mergeIntersection(schema.allOf);
-  const branches = schema.oneOf ?? schema.anyOf;
-  if (branches)
-    return mergeUnion(branches);
-  const shape = asObjectShape(schema);
-  if (shape)
-    return { ok: true, shape };
-  return {
-    ok: false,
-    field: "",
-    reason: "contract input must be an object schema"
-  };
-}
-
 // src/core/publicApi/flagSpecs.ts
 function describeFlag(schema) {
   const description = schema.description ?? "";
@@ -31039,7 +32486,7 @@ function describeFailure(failureReason) {
 }
 
 // src/shell/interactiveRunner/collectRunFiles.ts
-import { join as join47 } from "node:path";
+import { join as join51 } from "node:path";
 
 // src/core/interactiveRunner/getImports.ts
 function getImports(options) {
@@ -31078,7 +32525,7 @@ function isPathAlias(importPath, paths) {
 }
 
 // src/core/interactiveRunner/resolveImportPath.ts
-import { dirname as dirname15, join as join46, normalize as normalize4 } from "node:path/posix";
+import { dirname as dirname15, join as join50, normalize as normalize3 } from "node:path/posix";
 
 // src/core/interactiveRunner/tsconfigPaths.ts
 function isRecord4(value) {
@@ -31131,7 +32578,7 @@ function candidatesForExplicitExtension(options) {
 }
 function resolveImportPath(options) {
   const aliasTarget = resolvePathAlias(options.importPath, options.tsconfigPaths);
-  const resolvedPath = aliasTarget === undefined ? normalize4(join46(dirname15(options.importingFilePath), options.importPath)) : normalize4(aliasTarget);
+  const resolvedPath = aliasTarget === undefined ? normalize3(join50(dirname15(options.importingFilePath), options.importPath)) : normalize3(aliasTarget);
   const hasExplicitExtension = supportedExtensions.some((extension) => options.importPath.endsWith(extension));
   const candidates = hasExplicitExtension ? candidatesForExplicitExtension({
     importPath: options.importPath,
@@ -31155,7 +32602,7 @@ function resolveImportPath(options) {
 var tsconfigPath = "tsconfig.json";
 async function collectRunFiles(options) {
   const held = await listShippablePaths(options);
-  const readFile = (path) => options.fs.readFile(join47(options.cwd, path));
+  const readFile = (path) => options.fs.readFile(join51(options.cwd, path));
   const tsconfigContent = held.has(tsconfigPath) ? await readFile(tsconfigPath).catch(() => {
     return;
   }) : undefined;
@@ -31232,13 +32679,13 @@ async function walkImportGraph(options) {
 }
 
 // src/shell/interactiveRunner/makeRunnerId.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 function makeRunnerId() {
-  return `cli-${randomUUID().replaceAll("-", "").slice(0, 12)}`;
+  return `cli-${randomUUID2().replaceAll("-", "").slice(0, 12)}`;
 }
 
 // src/shell/interactiveRunner/runFilesManifest.ts
-import { join as join48 } from "node:path";
+import { join as join52 } from "node:path";
 var manifestFileName = "runner-files.json";
 var manifestSchema2 = object({
   files: array(object({ contentHash: string2(), path: string2() })),
@@ -31246,8 +32693,8 @@ var manifestSchema2 = object({
   version: literal(1)
 });
 function makeRunFilesManifestStore(options) {
-  const directory = join48(options.cwd, qawolfDir);
-  const path = join48(directory, manifestFileName);
+  const directory = join52(options.cwd, qawolfDir);
+  const path = join52(directory, manifestFileName);
   let pendingWrites = 0;
   return {
     async read() {
@@ -31277,7 +32724,7 @@ function parseJson(text) {
 }
 
 // src/shell/interactiveRunner/runnerStore.ts
-import { join as join49 } from "node:path";
+import { join as join53 } from "node:path";
 var storeFileName = "runner.json";
 var runnersDirName = "runners";
 var storedRunnerSchema = object({
@@ -31296,11 +32743,11 @@ function parseJson2(text) {
 }
 var pendingWrites = 0;
 function makeRunnerStore(options) {
-  const directory = join49(options.cwd, qawolfDir);
-  const path = join49(directory, storeFileName);
-  const runnersDir = join49(directory, runnersDirName);
+  const directory = join53(options.cwd, qawolfDir);
+  const path = join53(directory, storeFileName);
+  const runnersDir = join53(directory, runnersDirName);
   const nextPendingPath = (target) => `${target}.${process.pid}.${++pendingWrites}.tmp`;
-  const runnerPath = (runnerId) => join49(runnersDir, `${encodeURIComponent(runnerId)}.json`);
+  const runnerPath = (runnerId) => join53(runnersDir, `${encodeURIComponent(runnerId)}.json`);
   const writeAtomically = async (target, contents) => {
     const pendingPath = nextPendingPath(target);
     await options.fs.writeFile(pendingPath, `${JSON.stringify(contents, undefined, 2)}
@@ -31337,7 +32784,7 @@ function makeRunnerStore(options) {
     readDefaultRunnerId,
     async readRunners() {
       const runners = await Promise.all((await readRunnerFileNames()).map(async (name) => {
-        const contents = await options.fs.readFile(join49(runnersDir, name)).catch(() => {
+        const contents = await options.fs.readFile(join53(runnersDir, name)).catch(() => {
           return;
         });
         if (contents === undefined)
@@ -31356,7 +32803,7 @@ function makeRunnerStore(options) {
       await Promise.all(runnerIds.map((runnerId) => options.fs.rm(runnerPath(runnerId), { force: true })));
       const names = await readRunnerFileNames();
       await Promise.all(names.map(async (name) => {
-        const runnerFile = join49(runnersDir, name);
+        const runnerFile = join53(runnersDir, name);
         const contents = await options.fs.readFile(runnerFile).catch(() => {
           return;
         });
@@ -31440,7 +32887,7 @@ function registerRunnerHighlightSelectorCommand(runner, signals) {
 }
 
 // src/domains/interactiveRunner/importPackage.ts
-import { join as join50 } from "node:path";
+import { join as join54 } from "node:path";
 
 // src/core/interactiveRunner/npmDependencies.ts
 var sectionsInPrecedenceOrder = ["dependencies", "devDependencies"];
@@ -31481,7 +32928,7 @@ function readNpmDependencies(packageJsonContent) {
 // src/domains/interactiveRunner/importPackage.ts
 var defaultPackageVersion = "latest";
 async function handleRunnerImportPackage(ctx, options, deps) {
-  const content = await deps.readFile(join50(deps.cwd, runPackageJsonPath)).catch(() => {
+  const content = await deps.readFile(join54(deps.cwd, runPackageJsonPath)).catch(() => {
     return;
   });
   if (content === undefined) {
@@ -33188,21 +34635,12 @@ function createProgram({
 
 // src/main.ts
 var signals = createSignalRegistry();
-var forced = false;
-var onSignal = (sig) => () => {
-  const code = sig === "SIGINT" ? 130 : 143;
-  if (forced)
-    process.exit(code);
-  forced = true;
-  signals.shutdown(sig).finally(() => {
-    process.exit(code);
-  });
-};
+var onSignal = createSignalExit({ shutdown: (sig) => signals.shutdown(sig) });
 process.on("SIGINT", onSignal("SIGINT"));
 process.on("SIGTERM", onSignal("SIGTERM"));
 createProgram({ signals }).parseAsync().catch(() => {
   if (process.exitCode === undefined)
     process.exitCode = 1;
-}).finally(() => flushAndExit(typeof process.exitCode === "number" ? process.exitCode : 0));
+}).finally(() => exitWhenIdle(typeof process.exitCode === "number" ? process.exitCode : 0));
 
-//# debugId=599EFC31E23F426D64756E2164756E21
+//# debugId=D197CB13AEBF087464756E2164756E21