@rosthq/cli 0.6.7 → 0.7.0

package/dist/index.js

@@ -472,13 +472,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path4, preserveJsx) {
-  if (typeof path4 === "string" && /^\.\.?\//.test(path4)) {
-    return path4.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path5, preserveJsx) {
+  if (typeof path5 === "string" && /^\.\.?\//.test(path5)) {
+    return path5.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path4;
+  return path5;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -13257,7 +13257,7 @@ var require_main3 = __commonJS({
 });
 
 // src/index.ts
-import { realpathSync } from "node:fs";
+import { realpathSync as realpathSync2 } from "node:fs";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "node:url";
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
@@ -14026,10 +14026,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path4) {
-  if (!path4)
+function getElementAtPath(obj, path5) {
+  if (!path5)
     return obj;
-  return path4.reduce((acc, key) => acc?.[key], obj);
+  return path5.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14438,11 +14438,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path4, issues) {
+function prefixIssues(path5, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path4);
+    iss.path.unshift(path5);
     return iss;
   });
 }
@@ -14589,16 +14589,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path4 = []) => {
+  const processError = (error52, path5 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else {
-        const fullpath = [...path4, ...issue2.path];
+        const fullpath = [...path5, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -14625,17 +14625,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path4 = []) => {
+  const processError = (error52, path5 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path4, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path4, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
       } else {
-        const fullpath = [...path4, ...issue2.path];
+        const fullpath = [...path5, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -14667,8 +14667,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path4 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path4) {
+  const path5 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path5) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -27360,13 +27360,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path4 = ref.slice(1).split("/").filter(Boolean);
-  if (path4.length === 0) {
+  const path5 = ref.slice(1).split("/").filter(Boolean);
+  if (path5.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path4[0] === defsKey) {
-    const key = path4[1];
+  if (path5[0] === defsKey) {
+    const key = path5[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -27828,7 +27828,7 @@ var CommandClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
   }
   async execute(commandId, body = {}, options = {}) {
-    const path4 = `/api/commands/${encodeURIComponent(commandId)}`;
+    const path5 = `/api/commands/${encodeURIComponent(commandId)}`;
     const headers = {
       authorization: `Bearer ${this.token}`,
       "content-type": "application/json"
@@ -27836,7 +27836,7 @@ var CommandClient = class {
     if (options.targetSeatId !== void 0 && options.targetSeatId.length > 0) {
       headers["x-rost-seat"] = options.targetSeatId;
     }
-    const response = await this.fetchImpl(`${this.appUrl}${path4}`, {
+    const response = await this.fetchImpl(`${this.appUrl}${path5}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body)
@@ -27849,7 +27849,7 @@ var CommandClient = class {
       const snippet = redactSecrets(text.replace(/\s+/g, " ").trim()).slice(0, 200);
       throw new CommandClientError(
         response.status,
-        `server returned HTTP ${response.status} (non-JSON) from ${path4}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
+        `server returned HTTP ${response.status} (non-JSON) from ${path5}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
       );
     }
     const parsed = commandResponseSchema.parse(raw);
@@ -33056,8 +33056,8 @@ var IcebergError = class extends Error {
     return this.status === 419;
   }
 };
-function buildUrl(baseUrl, path4, query) {
-  const url2 = new URL(path4, baseUrl);
+function buildUrl(baseUrl, path5, query) {
+  const url2 = new URL(path5, baseUrl);
   if (query) {
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) {
@@ -33087,12 +33087,12 @@ function createFetchClient(options) {
   return {
     async request({
       method,
-      path: path4,
+      path: path5,
       query,
       body,
       headers
     }) {
-      const url2 = buildUrl(options.baseUrl, path4, query);
+      const url2 = buildUrl(options.baseUrl, path5, query);
       const authHeaders = await buildAuthHeaders(options.auth);
       const res = await fetchFn(url2, {
         method,
@@ -33954,7 +33954,7 @@ var StorageFileApi = class extends BaseApiClient {
   * @param path The relative file path. Should be of the format `folder/subfolder/filename.png`. The bucket must already exist before attempting to upload.
   * @param fileBody The body of the file to be stored in the bucket.
   */
-  async uploadOrUpdate(method, path4, fileBody, fileOptions) {
+  async uploadOrUpdate(method, path5, fileBody, fileOptions) {
     var _this = this;
     return _this.handleOperation(async () => {
       let body;
@@ -33978,7 +33978,7 @@ var StorageFileApi = class extends BaseApiClient {
         if ((typeof ReadableStream !== "undefined" && body instanceof ReadableStream || body && typeof body === "object" && "pipe" in body && typeof body.pipe === "function") && !options.duplex) options.duplex = "half";
       }
       if (fileOptions === null || fileOptions === void 0 ? void 0 : fileOptions.headers) for (const [key, value] of Object.entries(fileOptions.headers)) headers = setHeader(headers, key, value);
-      const cleanPath = _this._removeEmptyFolders(path4);
+      const cleanPath = _this._removeEmptyFolders(path5);
       const _path = _this._getFinalPath(cleanPath);
       const data = await (method == "PUT" ? put : post)(_this.fetch, `${_this.url}/object/${_path}`, body, _objectSpread22({ headers }, (options === null || options === void 0 ? void 0 : options.duplex) ? { duplex: options.duplex } : {}));
       return {
@@ -34055,8 +34055,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Upload file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async upload(path4, fileBody, fileOptions) {
-    return this.uploadOrUpdate("POST", path4, fileBody, fileOptions);
+  async upload(path5, fileBody, fileOptions) {
+    return this.uploadOrUpdate("POST", path5, fileBody, fileOptions);
   }
   /**
   * Upload a file with a token generated from `createSignedUploadUrl`.
@@ -34096,9 +34096,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async uploadToSignedUrl(path4, token, fileBody, fileOptions) {
+  async uploadToSignedUrl(path5, token, fileBody, fileOptions) {
     var _this3 = this;
-    const cleanPath = _this3._removeEmptyFolders(path4);
+    const cleanPath = _this3._removeEmptyFolders(path5);
     const _path = _this3._getFinalPath(cleanPath);
     const url2 = new URL(_this3.url + `/object/upload/sign/${_path}`);
     url2.searchParams.set("token", token);
@@ -34167,10 +34167,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `insert`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUploadUrl(path4, options) {
+  async createSignedUploadUrl(path5, options) {
     var _this4 = this;
     return _this4.handleOperation(async () => {
-      let _path = _this4._getFinalPath(path4);
+      let _path = _this4._getFinalPath(path5);
       const headers = _objectSpread22({}, _this4.headers);
       if (options === null || options === void 0 ? void 0 : options.upsert) headers["x-upsert"] = "true";
       const data = await post(_this4.fetch, `${_this4.url}/object/upload/sign/${_path}`, {}, { headers });
@@ -34179,7 +34179,7 @@ var StorageFileApi = class extends BaseApiClient {
       if (!token) throw new StorageError("No token returned by API");
       return {
         signedUrl: url2.toString(),
-        path: path4,
+        path: path5,
         token
       };
     });
@@ -34239,8 +34239,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Update file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async update(path4, fileBody, fileOptions) {
-    return this.uploadOrUpdate("PUT", path4, fileBody, fileOptions);
+  async update(path5, fileBody, fileOptions) {
+    return this.uploadOrUpdate("PUT", path5, fileBody, fileOptions);
   }
   /**
   * Moves an existing file to a new path in the same bucket.
@@ -34391,10 +34391,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUrl(path4, expiresIn, options) {
+  async createSignedUrl(path5, expiresIn, options) {
     var _this8 = this;
     return _this8.handleOperation(async () => {
-      let _path = _this8._getFinalPath(path4);
+      let _path = _this8._getFinalPath(path5);
       const hasTransform = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0;
       let data = await post(_this8.fetch, `${_this8.url}/object/sign/${_path}`, _objectSpread22({ expiresIn }, hasTransform ? { transform: options.transform } : {}), { headers: _this8.headers });
       const query = new URLSearchParams();
@@ -34530,13 +34530,13 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  download(path4, options, parameters) {
+  download(path5, options, parameters) {
     const renderPath = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0 ? "render/image/authenticated" : "object";
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
     if ((options === null || options === void 0 ? void 0 : options.cacheNonce) != null) query.set("cacheNonce", String(options.cacheNonce));
     const queryString = query.toString();
-    const _path = this._getFinalPath(path4);
+    const _path = this._getFinalPath(path5);
     const downloadFn = () => get(this.fetch, `${this.url}/${renderPath}/${_path}${queryString ? `?${queryString}` : ""}`, {
       headers: this.headers,
       noResolveJson: true
@@ -34567,9 +34567,9 @@ var StorageFileApi = class extends BaseApiClient {
   * }
   * ```
   */
-  async info(path4) {
+  async info(path5) {
     var _this10 = this;
-    const _path = _this10._getFinalPath(path4);
+    const _path = _this10._getFinalPath(path5);
     return _this10.handleOperation(async () => {
       return recursiveToCamel(await get(_this10.fetch, `${_this10.url}/object/info/${_path}`, { headers: _this10.headers }));
     });
@@ -34590,9 +34590,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   .exists('folder/avatar1.png')
   * ```
   */
-  async exists(path4) {
+  async exists(path5) {
     var _this11 = this;
-    const _path = _this11._getFinalPath(path4);
+    const _path = _this11._getFinalPath(path5);
     try {
       await head(_this11.fetch, `${_this11.url}/object/${_path}`, { headers: _this11.headers });
       return {
@@ -34671,8 +34671,8 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  getPublicUrl(path4, options) {
-    const _path = this._getFinalPath(path4);
+  getPublicUrl(path5, options) {
+    const _path = this._getFinalPath(path5);
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.download) query.set("download", options.download === true ? "" : options.download);
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
@@ -34811,10 +34811,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async list(path4, options, parameters) {
+  async list(path5, options, parameters) {
     var _this13 = this;
     return _this13.handleOperation(async () => {
-      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path4 || "" });
+      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path5 || "" });
       return await post(_this13.fetch, `${_this13.url}/object/list/${_this13.bucketId}`, body, { headers: _this13.headers }, parameters);
     });
   }
@@ -34879,11 +34879,11 @@ var StorageFileApi = class extends BaseApiClient {
     if (typeof Buffer !== "undefined") return Buffer.from(data).toString("base64");
     return btoa(data);
   }
-  _getFinalPath(path4) {
-    return `${this.bucketId}/${path4.replace(/^\/+/, "")}`;
+  _getFinalPath(path5) {
+    return `${this.bucketId}/${path5.replace(/^\/+/, "")}`;
   }
-  _removeEmptyFolders(path4) {
-    return path4.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
+  _removeEmptyFolders(path5) {
+    return path5.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
   }
   /** Modifies the `query`, appending values the from `transform` */
   applyTransformOptsToQuery(query, transform2) {
@@ -37273,17 +37273,30 @@ import { constants as fsConstants } from "node:fs";
 import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import path from "node:path";
-import { promisify as promisify2 } from "node:util";
-var execFile2 = promisify2(execFileCallback);
 var sessionSchema = external_exports.object({
   accessToken: external_exports.string().min(1),
   refreshToken: external_exports.string().min(1).optional(),
   expiresAt: external_exports.string().datetime({ offset: true }).optional()
 }).strict();
+var runExecFile = (file2, args, options) => new Promise((resolve2, reject) => {
+  const child = execFileCallback(file2, [...args], (error51, stdout, stderr) => {
+    if (error51) {
+      reject(error51);
+      return;
+    }
+    resolve2({ stdout, stderr });
+  });
+  const { stdin } = child;
+  if (stdin) {
+    stdin.on("error", () => {
+    });
+    stdin.end(options?.input ?? "");
+  }
+});
 var serviceName = `${cliBrand.binName}-cli`;
 var accountName = "session";
 var KeychainTokenStore = class {
-  constructor(run2 = execFile2) {
+  constructor(run2 = runExecFile) {
     this.run = run2;
   }
   run;
@@ -37304,16 +37317,14 @@ var KeychainTokenStore = class {
   }
   async write(session) {
     sessionSchema.parse(session);
-    await this.run("security", [
-      "add-generic-password",
-      "-U",
-      "-s",
-      serviceName,
-      "-a",
-      accountName,
-      "-w",
-      JSON.stringify(session)
-    ]);
+    const secret = JSON.stringify(session);
+    await this.run(
+      "security",
+      ["add-generic-password", "-U", "-s", serviceName, "-a", accountName, "-w"],
+      { input: `${secret}
+${secret}
+` }
+    );
   }
   async clear() {
     try {
@@ -37326,6 +37337,122 @@ var KeychainTokenStore = class {
     return "macOS Keychain";
   }
 };
+var DarwinTokenStore = class extends KeychainTokenStore {
+  constructor(run2 = runExecFile, filePath) {
+    super(run2);
+    this.filePath = filePath;
+  }
+  filePath;
+  backend = null;
+  fileStore = null;
+  async read() {
+    return await this.selectBackend() === "file" ? this.file().read() : super.read();
+  }
+  async write(session) {
+    if (await this.selectBackend() === "file") {
+      await this.file().write(session);
+      return;
+    }
+    await super.write(session);
+  }
+  async clear() {
+    if (await this.selectBackend() === "file") {
+      await this.file().clear();
+      return;
+    }
+    await super.clear();
+  }
+  describe() {
+    return this.backend === "file" ? "owner-only file store (no usable macOS keychain)" : super.describe();
+  }
+  file() {
+    return this.fileStore ??= new FileTokenStore(this.filePath);
+  }
+  async selectBackend() {
+    if (this.backend) {
+      return this.backend;
+    }
+    try {
+      await this.run("security", ["find-generic-password", "-s", serviceName, "-a", accountName, "-w"]);
+      this.backend = "keychain";
+    } catch (error51) {
+      this.backend = isKeychainUnusableError(error51) ? "file" : "keychain";
+    }
+    return this.backend;
+  }
+};
+var WindowsCredentialTokenStore = class {
+  constructor(run2 = runExecFile) {
+    this.run = run2;
+  }
+  run;
+  async read() {
+    try {
+      const { stdout } = await this.run("powershell", powershellArgs(windowsReadScript(windowsCredentialTarget)));
+      const trimmed = stdout.trim();
+      if (trimmed === "") {
+        return null;
+      }
+      return sessionSchema.parse(JSON.parse(trimmed));
+    } catch {
+      return null;
+    }
+  }
+  async write(session) {
+    sessionSchema.parse(session);
+    await this.run(
+      "powershell",
+      powershellArgs(windowsWriteScript(windowsCredentialTarget)),
+      { input: JSON.stringify(session) }
+    );
+  }
+  async clear() {
+    try {
+      await this.run("powershell", powershellArgs(windowsClearScript(windowsCredentialTarget)));
+    } catch {
+      return;
+    }
+  }
+  describe() {
+    return "Windows Credential Manager";
+  }
+};
+var SecretServiceTokenStore = class {
+  constructor(run2 = runExecFile) {
+    this.run = run2;
+  }
+  run;
+  async read() {
+    try {
+      const { stdout } = await this.run("secret-tool", ["lookup", "service", serviceName, "account", accountName]);
+      const trimmed = stdout.trim();
+      if (trimmed === "") {
+        return null;
+      }
+      return sessionSchema.parse(JSON.parse(trimmed));
+    } catch {
+      return null;
+    }
+  }
+  async write(session) {
+    sessionSchema.parse(session);
+    await this.run(
+      "secret-tool",
+      ["store", `--label=${cliBrand.name} CLI session`, "service", serviceName, "account", accountName],
+      { input: JSON.stringify(session) }
+    );
+  }
+  async clear() {
+    try {
+      await this.run("secret-tool", ["clear", "service", serviceName, "account", accountName]);
+    } catch {
+      return;
+    }
+  }
+  describe() {
+    return "Secret Service";
+  }
+};
 var FileTokenStore = class {
   constructor(filePath = defaultTokenPath()) {
     this.filePath = filePath;
@@ -37366,6 +37493,7 @@ var FileTokenStore = class {
 function createTokenStore(options = {}) {
   const env = options.env ?? process.env;
   const allowFileStoreKey = brandEnvKey2("CLI_ALLOW_FILE_TOKEN_STORE");
+  const tokenPath = env[brandEnvKey2("CLI_TOKEN_PATH")];
   if (env[allowFileStoreKey] === "1") {
     const warning = [
       "WARNING: using the development-only plain-file CLI token store.",
@@ -37373,17 +37501,23 @@ function createTokenStore(options = {}) {
     ].join(" ");
     (options.stderr ?? process.stderr).write(`${warning}
 `);
-    return new FileTokenStore(env[brandEnvKey2("CLI_TOKEN_PATH")]);
+    return new FileTokenStore(tokenPath);
   }
   const platform = options.platform ?? process.platform;
   if (platform === "darwin") {
-    return new KeychainTokenStore(options.execFile);
+    return new DarwinTokenStore(options.execFile, tokenPath);
+  }
+  if (platform === "win32") {
+    return new WindowsCredentialTokenStore(options.execFile);
+  }
+  if (platform === "linux" && env[brandEnvKey2("CLI_USE_SECRET_SERVICE")] === "1") {
+    return new SecretServiceTokenStore(options.execFile);
   }
   throw new Error(
     [
-      "No OS credential store is available (the CLI uses the macOS Keychain by default; there is no Windows or Linux keychain integration).",
-      `For headless Linux, CI runners, or any no-keychain host, export ${allowFileStoreKey}=1 (set it for every invocation) to opt into the development-only plain-file token store.`,
-      "It is not encrypted: it writes an owner-only file (directory 0700, file 0600) holding only CLI session tokens \u2014 never tenant secrets, API keys, or vault refs."
+      "No OS credential store is available (the CLI uses the macOS Keychain by default, Windows Credential Manager on Windows, and the Linux Secret Service when enabled).",
+      `For headless Linux, export ${brandEnvKey2("CLI_USE_SECRET_SERVICE")}=1 to use the Secret Service, or ${allowFileStoreKey}=1 (set it for every invocation) to opt into the development-only plain-file token store.`,
+      "The file store is not encrypted: it writes an owner-only file (directory 0700, file 0600) holding only CLI session tokens \u2014 never tenant secrets, API keys, or vault refs."
     ].join(" ")
   );
 }
@@ -37393,6 +37527,105 @@ function defaultTokenPath() {
 function brandEnvKey2(suffix) {
   return `${cliBrand.envPrefix}_${suffix}`;
 }
+function isKeychainUnusableError(error51) {
+  if (isKeychainItemMissing(error51)) {
+    return false;
+  }
+  return true;
+}
+function isKeychainItemMissing(error51) {
+  if (!error51 || typeof error51 !== "object") {
+    return false;
+  }
+  if (error51.code === 44) {
+    return true;
+  }
+  return /could not be found|SecKeychainSearchCopyNext/i.test(errorText(error51));
+}
+function errorText(error51) {
+  if (!error51 || typeof error51 !== "object") {
+    return String(error51 ?? "");
+  }
+  const record2 = error51;
+  const parts = [];
+  for (const key of ["message", "stderr", "stdout"]) {
+    const value = record2[key];
+    if (typeof value === "string") {
+      parts.push(value);
+    }
+  }
+  return parts.join("\n");
+}
+var windowsCredentialTarget = `${serviceName}/${accountName}`;
+function powershellArgs(script) {
+  return ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script];
+}
+function psQuote(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+var WINDOWS_CRED_MODULE = [
+  "$ErrorActionPreference = 'Stop'",
+  "Add-Type -TypeDefinition @'",
+  "using System;",
+  "using System.Runtime.InteropServices;",
+  "public static class RostCred {",
+  "  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]",
+  "  public struct CREDENTIAL {",
+  "    public uint Flags; public uint Type;",
+  "    [MarshalAs(UnmanagedType.LPWStr)] public string TargetName;",
+  "    [MarshalAs(UnmanagedType.LPWStr)] public string Comment;",
+  "    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;",
+  "    public uint CredentialBlobSize; public IntPtr CredentialBlob;",
+  "    public uint Persist; public uint AttributeCount; public IntPtr Attributes;",
+  "    [MarshalAs(UnmanagedType.LPWStr)] public string TargetAlias;",
+  "    [MarshalAs(UnmanagedType.LPWStr)] public string UserName;",
+  "  }",
+  '  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]',
+  "  public static extern bool CredWriteW(ref CREDENTIAL cred, uint flags);",
+  '  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]',
+  "  public static extern bool CredReadW(string target, uint type, uint flags, out IntPtr cred);",
+  '  [DllImport("advapi32.dll")] public static extern void CredFree(IntPtr cred);',
+  '  [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]',
+  "  public static extern bool CredDeleteW(string target, uint type, uint flags);",
+  "}",
+  "'@"
+].join("\n");
+function windowsWriteScript(target) {
+  return [
+    WINDOWS_CRED_MODULE,
+    "$secret = [Console]::In.ReadToEnd()",
+    "$bytes = [System.Text.Encoding]::Unicode.GetBytes($secret)",
+    "$blob = [Runtime.InteropServices.Marshal]::AllocHGlobal($bytes.Length)",
+    "[Runtime.InteropServices.Marshal]::Copy($bytes, 0, $blob, $bytes.Length)",
+    "$cred = New-Object RostCred+CREDENTIAL",
+    "$cred.Type = 1",
+    `$cred.TargetName = ${psQuote(target)}`,
+    "$cred.UserName = 'session'",
+    "$cred.CredentialBlobSize = $bytes.Length",
+    "$cred.CredentialBlob = $blob",
+    "$cred.Persist = 2",
+    "$ok = [RostCred]::CredWriteW([ref]$cred, 0)",
+    "[Runtime.InteropServices.Marshal]::FreeHGlobal($blob)",
+    "if (-not $ok) { exit 1 }"
+  ].join("\n");
+}
+function windowsReadScript(target) {
+  return [
+    WINDOWS_CRED_MODULE,
+    "$ptr = [IntPtr]::Zero",
+    `if (-not [RostCred]::CredReadW(${psQuote(target)}, 1, 0, [ref]$ptr)) { exit 0 }`,
+    "$cred = [Runtime.InteropServices.Marshal]::PtrToStructure($ptr, [Type][RostCred+CREDENTIAL])",
+    "$secret = [Runtime.InteropServices.Marshal]::PtrToStringUni($cred.CredentialBlob, [int]($cred.CredentialBlobSize / 2))",
+    "[RostCred]::CredFree($ptr)",
+    "[Console]::Out.Write($secret)"
+  ].join("\n");
+}
+function windowsClearScript(target) {
+  return [
+    WINDOWS_CRED_MODULE,
+    `[void][RostCred]::CredDeleteW(${psQuote(target)}, 1, 0)`
+  ].join("\n");
+}
 
 // ../../packages/prompts/src/index.ts
 import { readFileSync } from "node:fs";
@@ -37569,10 +37802,10 @@ var util;
   function assertIs2(_arg) {
   }
   util2.assertIs = assertIs2;
-  function assertNever2(_x) {
+  function assertNever3(_x) {
     throw new Error();
   }
-  util2.assertNever = assertNever2;
+  util2.assertNever = assertNever3;
   util2.arrayToEnum = (items) => {
     const obj = {};
     for (const item of items) {
@@ -37927,8 +38160,8 @@ function getErrorMap2() {
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path4, errorMaps, issueData } = params;
-  const fullPath = [...path4, ...issueData.path || []];
+  const { data, path: path5, errorMaps, issueData } = params;
+  const fullPath = [...path5, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -38044,11 +38277,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path4, key) {
+  constructor(parent, value, path5, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path4;
+    this._path = path5;
     this._key = key;
   }
   get path() {
@@ -41638,6 +41871,78 @@ The Compass is drafted, then activated by a human through supersession.
 ## When to stop for confirmation
 
 \`onboarding.finish\`, \`compass.approve_version\`, \`compass.reject_draft\`, and \`compass.set\` are \`human_required\`. \`onboarding.advance_step\`, \`onboarding.create_invite\`, \`onboarding.attach_reference\`, \`compass.answer_gap\`, and drafting a Compass are \`none\` \u2014 none of them returns a pending confirmation. \`none\` is not the same as "agent-callable", though: \`onboarding.create_invite\` and \`compass.answer_gap\` record the human who ran them, so they run as a person, not from an agent session, while advancing a step, attaching a reference, and drafting a Compass are safe for an agent. Approving a version (a supersession) is a human act. The agent drafts and surfaces the approve link. See the confirmations guide.`
+  },
+  {
+    slug: "aicos-chat-guide",
+    order: 15,
+    title: "AICOS chat guide",
+    summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
+    version: "2026-07-02.3",
+    public: true,
+    audiences: ["human", "in_app_agent"],
+    stages: ["company_setup", "operating_rhythm"],
+    relatedCommandIds: ["confirmation.approve", "onboarding.status", "graph.get", "seat.get"],
+    legal: {
+      publicRisk: "low",
+      notes: [
+        "Describes the authenticated AICOS chat surface without promising autonomous action.",
+        "Keeps authority, lane, and confirmation language aligned with the platform governance model."
+      ]
+    },
+    sources: [
+      {
+        label: "AICOS Company Chief of Staff plan",
+        internalPath: "docs/plans/2026-07-01-003-feat-aicos-company-chief-of-staff-plan.md",
+        note: "Defines the AICOS product contract, lane portability, and governance boundaries."
+      },
+      {
+        label: "MVP implementation plan",
+        internalPath: "docs/specs/MVP-implementation-plan.md",
+        note: "FR-10.6 records the AICOS extension and chat harness rollout."
+      }
+    ],
+    body: `# AICOS chat guide
+
+AICOS is the AI Chief of Staff for an authenticated {{brand}} tenant. It is a governed agent seat in the Responsibility Graph, not an anonymous public chatbot and not a hidden superuser.
+
+## Where AICOS appears
+
+In the authenticated app shell, AICOS opens from the floating assistant control. The panel is available across normal app pages and keeps the same thread while you move through the product. Full-bleed public, login, onboarding, docs, invite, and demo routes do not receive the authenticated shell.
+
+Each thread has a purpose:
+
+- **Onboarding** \u2014 setup help and page-aware setup context.
+- **Seat** \u2014 seat and agent setup context.
+- **General** \u2014 company operating help.
+
+You can reopen prior threads or start a new one. Session history is stored in tenant-scoped conversation tables so chat history is not reconstructed from analytics, events, or run logs.
+
+## What context AICOS receives
+
+Each turn carries server-normalized page context: route template, current path, safe search state, selected seat or object ids when authorized, and onboarding state when relevant. The server derives tenant and user authority from the authenticated session. Client-supplied tenant context is never accepted as authority.
+
+The current chat harness shows the effective lane and model. The initial lane is cloud, with a deterministic harness response while live model execution, action execution, and runner execution waves land. The contract is intentionally backend-neutral: future cloud and runner turns use the same sessions, messages, lane labels, sources, and linked artifacts.
+
+Model behavior is now explicit in the AICOS session contract. A thread can run in **Auto** or use a pinned compatible model from the guided catalog. Auto chooses a fast tier for short low-risk turns, the balanced default for normal operating help, and a higher-reasoning tier for onboarding synthesis or large context. The panel shows the effective model, disables lower-context choices once the active thread outgrows them, and tells the user to start a new session for those models. Session context is estimated and compacted into a durable summary when it crosses the configured threshold; raw messages remain in history, but future model calls can use the summary rather than resending the whole thread. Platform allowance and BYOK state are checked before routing; an exhausted included allowance keeps AICOS in guided mode and points the user toward BYOK/manual continuation. Because the DER-1068 implementation still uses the deterministic harness, it does not create fake llm_calls rows or settle fake allowance usage; reservation/settlement belongs to the real provider call path.
+
+AICOS grounds answers from two source classes before producing user-visible setup or operating guidance:
+
+- **Reference documents** \u2014 public {{brand}} guides such as this chat guide, onboarding guidance, the Responsibility Graph playbook, tool-access guidance, and confirmation guidance. AICOS retrieves the narrowest relevant guide before setup, Charter, Signal, Friction, Cascade, Sync, tool-access, or onboarding advice.
+- **Tenant read models** \u2014 bounded summaries of tenant operating state, including onboarding status, graph/setup readiness, Compass/Charter readiness, operating health, agent/system health, approvals/inbox, and selected Seat context. These read models expose counts and short observations rather than raw database dumps.
+
+Assistant messages can carry source counts and persisted source metadata so a thread can later show which reference docs or read models informed the answer.
+
+## Governance boundary
+
+AICOS can preserve context and explain what it is ready to do, but durable operating changes still use the same {{brand}} controls:
+
+- Tenant isolation is enforced by RLS and server-side tenant context.
+- Raw secrets, vault refs, hidden tool arguments, storage refs, provider payloads, agent custom prompts, and secret-shaped text are not stored in chat history or read-model context.
+- Durable decisions remain human decisions.
+- Action execution must route through command guards and confirmation when required.
+- Expanding authority, approving Charters or Compass versions, going live, credentials, external sends, money, destructive operations, and policy changes stay human-gated.
+
+Treat AICOS as a coordinator over the operating system. It can become more useful as model grounding, read tools, draft actions, and runner execution are enabled, but it does not bypass the Responsibility Graph, Seat Steward accountability, command guards, or confirmations.`
   },
   {
     slug: "responsibility-graph-playbook",
@@ -42157,7 +42462,7 @@ Decisions should be recorded as human decisions. Handoffs should attach to seats
     order: 45,
     title: "How agents work",
     summary: "How {{brand}} agents operate inside seats, use Charters, report work, and escalate beyond authority.",
-    version: "2026-06-30.1",
+    version: "2026-07-02.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -42255,7 +42560,7 @@ Beyond each seat's own manifest, the company can set one ceiling on how much an
 
 ## What humans should review
 
-The Agents page shows fleet health first: live state, work evidence, failed runs, open held actions, cost, and the next operator action. Work evidence distinguishes fresh real runs, stale runs, no completed run yet, queued or running work orders, and recent failures. A failure link opens the failed run itself; queued or stale rows route the operator to the seat's agent operations instead of pretending there is a hidden run to inspect. The page also shows configuration completeness for each staffed agent seat: Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state, each with a remediation link when incomplete. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, loaded Skill versions, and held confirmations or escalations. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason. For a live agent, the seat page's agent operations panel can queue one immediate governed run through the same \`agent.run_now\` command path used by CLI and MCP; it does not expand authority or change the saved schedule.
+The Agents page shows fleet health first: live state, work evidence, failed runs, open held actions, cost, and the next operator action. Work evidence distinguishes fresh real runs, stale runs, no completed run yet, queued or running work orders, and recent failures. A failure link opens the failed run itself; queued or stale rows route the operator to the seat's agent operations instead of pretending there is a hidden run to inspect. The page also shows configuration completeness for each staffed agent seat: Steward chain, lane or runtime substrate, vaulted credentials, granted tools, model config, sandbox dry run, and go-live state, each with a remediation link when incomplete. A seat's Trust Card drills into the same facts: run history, one-run detail, tool-call outcomes, product-visible errors, transcript references, loaded Skill versions, and held confirmations or escalations. Open confirmations stay visible until they are decided or expire, even when they are older than the default activity window. Approving or rejecting a held confirmation from the seat page is scoped to that seat; rejection can include a short reason. For a live agent, the seat page's agent operations panel can queue one immediate governed run through the same \`agent.run_now\` command path used by CLI and MCP; it does not expand authority or change the saved schedule. Seat pages render legacy Charter manifest scope text with customer-safe labels when old setup data used internal placeholder wording.
 
 Review the first dry runs, fleet overview, tool-call audit rows, escalations, deliverables, and Signal impact. A seat's completed-work area combines explicit deliverables, work-log evidence, and successful run summaries into one operator-facing trail with safe links labelled as internal, Linear, GitHub, or external. The fleet view at \`/agents\` shows every staffed agent seat at a glance; the agent-native equivalents are \`{{cli}} command agent.list_fleet --json '{}'\` / \`rost_list_agent_fleet\` for the compact overview, and \`{{cli}} agent fleet-digest --json\` / \`agent.fleet_digest\` / \`rost_get_dogfood_fleet_health_digest\` for the daily dogfood evidence bundle. The digest returns live/idle state, 24h/7d turns, 7d/30d spend, recent failed runs, unresolved product errors, failed notifications, and a next action per seat.
 
@@ -42310,7 +42615,7 @@ Connecting a tool is a human-controlled step. The agent can recommend a tool, ex
 
 ## Generic REST connector
 
-For an API with no dedicated connector, the generic REST tool lets a seat read an HTTPS endpoint with a credential you paste through the vault \u2014 no {{brand}}-owned app. The agent-facing tool is GET-only. It is escalate-by-default: the agent may only call a host and explicit path prefix a steward has signed onto the allowlist; any other host or path is refused and escalated, with no request made. Mutating methods and request bodies fail before credential binding. A path prefix of \`/\` means the steward intentionally approved every path. The connector sets the Authorization header from the vaulted credential itself \u2014 the agent never sees the token, and the secret is redacted from the response before it reaches the agent, the audit row, or the logs. The token is only ever sent over HTTPS, only to the signed host and scoped path, and a redirect is never followed \u2014 so an allowlisted endpoint cannot bounce the call (and the token) to another host. A sandbox dry run of a REST tool makes no real request.
+For an API with no dedicated connector, the generic REST tool lets a seat read an HTTPS endpoint with a credential you paste through the vault \u2014 no {{brand}}-owned app. The agent-facing tool is GET-only. It is escalate-by-default: the agent may only call a host and explicit path prefix a steward has signed onto the allowlist; any other host or path is refused and escalated, with no request made. Mutating methods and request bodies fail before credential binding. A path prefix of \`/\` means the steward intentionally approved every path. The connector sets the Authorization header from the vaulted credential itself \u2014 the agent never sees the token, and the secret is redacted from the response before it reaches the agent, the audit row, or the logs. The token is only ever sent over HTTPS, only to the signed host and scoped path, and a redirect is never followed \u2014 so an allowlisted endpoint cannot bounce the call (and the token) to another host. Signal-source pulls also resolve the host at execution time, reject private or reserved addresses, and pin the outbound socket to the validated address so DNS rebinding cannot move the request after approval. A sandbox dry run of a REST tool makes no real request.
 
 ## Slack post connector
 
@@ -42359,7 +42664,7 @@ There is exactly one way to give a connected tool its credential, and it is the
     order: 47,
     title: "Available tools guide",
     summary: "How to think about tool categories available to seats and what each category should be used for.",
-    version: "2026-07-02.1",
+    version: "2026-06-30.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -42412,7 +42717,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-02.3",
+    version: "2026-07-02.6",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -42869,12 +43174,13 @@ The signed-in app exposes the same Skill command surface under **Skills** in the
 | \`{{cli}} error list|resolve|supersede\` | \`error_log.list\`, \`error_log.resolve\`, \`error_log.supersede\` | List active, acknowledged, resolved, or superseded product error logs and let a human acknowledge, resolve, or supersede stale errors with evidence links. | Tenant | \`{{cli}} error list --resolved active --json\`; \`{{cli}} error resolve --error-log-id <id> --reason "Fixed in PR #123"\` |
 | \`{{cli}} sync brief|compile|complete\` | \`sync.brief.get\`, \`sync.brief.compile\`, \`sync.run.complete\` | Compile, read, and complete a weekly Sync. | Tenant | \`{{cli}} sync brief --json\` |
 | \`{{cli}} runner list|status|diagnose|repair|work-orders|revoke|serve\` | \`runner.list\`, \`runner.status\`, \`runner.diagnose\`, \`runner.repair\`, \`work_order.list\`, \`runner.revoke\`, runner endpoint APIs | Inspect heartbeat and execute-readiness evidence, inspect work orders, diagnose offline runners, get repair guidance, revoke a runner, or run the headless local runner loop. | Tenant | \`{{cli}} runner diagnose --runner-id <id> --json\`; \`{{cli}} runner serve --once\` |
+| \`{{cli}} runner install-service|start|stop|restart|status|logs|uninstall --name <name>\` | launchd/service manager (macOS today) + \`{{cli}} runner serve\` | Install and manage an always-on local runner service that keeps the runner online across reboots; the service shells out to \`{{cli}} runner serve --execute\` and stores no secret in the service definition, its arguments, or logs. Non-macOS emits an explicit unsupported message. | Tenant (local machine) | \`{{cli}} runner install-service --name mac-mini --execute\`; \`{{cli}} runner logs --name mac-mini\` |
 | \`{{cli}} notification settings|test|errors\` | \`notification.settings.get\`, \`notification.test\`, \`notification.list_errors\` | Read notification settings, send a test, and list failed deliveries with linked product error source, seat id, and run id when available. | Tenant | \`{{cli}} notification errors --limit 10 --json\` |
 | \`{{cli}} integration list|readiness|status|test\` / credential flow for Baserow REST connect | \`integration.connect_rest\`, \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | Create a vault-backed Baserow REST integration through the credential flow, list connector metadata, read setup-readiness, read one connector's health, and run provider-specific tests without exposing credentials. | Tenant-admin for connect; tenant for reads/tests | \`{{cli}} integration readiness --provider google --json\` |
 | \`{{cli}} system health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | \`{{cli}} system health --json\`; \`{{cli}} system health --seat <id> --json\` |
 | \`{{cli}} command usage.report|usage.snapshot\` | \`usage.report\`, \`usage.snapshot\` | Read the AI-workforce ROI report (per-period agent turns, token/run cost, human-accepted value, exceptions, approvals) from immutable usage snapshots, and freeze a period's totals into a new snapshot (insert-only, idempotent). | Tenant | \`{{cli}} command usage.report --json\`; \`{{cli}} command usage.snapshot --json\` |
 | \`{{cli}} settings get|update|product-learning|agent-policy|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`settings.agent_policy.get\`, \`settings.agent_policy.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, read or set the company autonomy ceiling, and rename the company. Budget, product-learning, and policy updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings agent-policy get --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
-| \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
+| \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members; execution requires an owner or admin membership. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Human CLI dry-runs print the rehearsal transcript and, when present, the per-tool preview labels (\`Would run\`, \`Blocked\`, \`Escalated\`) before go-live. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
 | \`{{cli}} skills list|get|file|assigned|check-dependencies\` | \`skill.list\`, \`skill.get\`, \`skill.file.get\`, \`skill.assigned.list\`, \`skill.check_dependencies\` | Discover reusable Skills, read descriptors and stored package files, list approved Seat assignments, and compare required/optional tool dependencies with a Seat's signed Charter manifest. Skills are instructions, not authority. | Tenant-admin; seat-scoped reads for assigned Skills | \`{{cli}} skills list --json\`; \`{{cli}} skills file --slug invoice-review --path SKILL.md\` |
@@ -43046,9 +43352,9 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_check_integration_readiness\` | \`integration.readiness\` | Return the connector setup checklist: OAuth env/callback, tenant connection, scopes, latest test state, external verification/CASA, handler availability, and DER-coded next actions. | Tenant | Call with \`{"provider":"google"}\`; metadata only, no secrets or vault refs. |
 | \`rost_get_integration_status\` | \`integration.status\` | Read one integration's metadata by provider or integration id. | Tenant | Call with \`{"provider":"google"}\` or \`{"integration_id":"<id>"}\`. |
 | \`rost_test_integration_connection\` | \`integration.test\` | Run the provider-specific connection test and update integration health. | Tenant | Call with \`{"provider":"google"}\`; result is bounded metadata only. |
-| \`rost_invite_member\` | \`member.invite\` | Create a pending tenant invite for a human teammate. | Tenant | Call with \`email\` and \`role\`. |
-| \`rost_update_member_role\` | \`member.update\` | Change a tenant member's role. | Tenant | Call with \`member_id\` and \`role\`; expect human confirmation. |
-| \`rost_remove_member\` | \`member.remove\` | Remove a tenant member. | Tenant | Call with \`member_id\`; blocked if it would orphan an agent steward chain. |
+| \`rost_invite_member\` | \`member.invite\` | Create a pending tenant invite for a human teammate. | Tenant | Owner/admin only; call with \`email\` and \`role\`. |
+| \`rost_update_member_role\` | \`member.update\` | Change a tenant member's role. | Tenant | Owner/admin only; call with \`member_id\` and \`role\`; expect human confirmation. |
+| \`rost_remove_member\` | \`member.remove\` | Remove a tenant member. | Tenant | Owner/admin only; call with \`member_id\`; blocked if it would orphan an agent steward chain. |
 | \`rost_get_tenant_settings\` | \`settings.get\` | Read tenant operating settings and integration status. | Tenant | Call with \`{}\`; metadata only. |
 | \`rost_update_tenant_settings\` | \`settings.update\` | Update tenant AI budget caps. | Tenant | Call with \`soft_cap_usd\` or \`hard_cap_usd\`; expect human confirmation. |
 | \`rost_rename_company\` | \`tenant.rename\` | Rename the current company. | Tenant-admin | Call with \`company_name\`; expect human confirmation. |
@@ -43461,7 +43767,7 @@ Set \`ROST_SKILL_INSTALL_ROOT\` only for a sandbox or CI override. Local copies
     order: 55,
     title: "Agent reference map",
     summary: "Where CLI sessions, MCP clients, and in-app agents should retrieve {{brand}} guidance before recommending setup changes.",
-    version: "2026-07-02.2",
+    version: "2026-07-02.3",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -43525,28 +43831,29 @@ Agents that run on {{brand}}-managed inference draw against a tenant inference b
 
 1. rost-implementation-method
 2. compass-authoring-guide
-3. responsibility-graph-playbook
-4. charter-design-playbook
-5. charter-authoring-deep-dive
-6. agent-staffing-playbook
-7. add-agents-guide
-8. custom-agents-guide
-9. agent-builder-guide
-10. how-agents-work
-11. tool-access-and-vault
-12. available-tools-guide
-13. mcp-and-cli-guide
-14. skill-builder-guide
-15. agent-skill-authoring-guide
-16. agent-skill-setup-guide
-17. ai-model-data-handling-guide
-18. cascade-guide
-19. signal-guide
-20. friction-guide
-21. confirmations-guide
-22. steward-queue-guide
-23. sync-rhythm-playbook
-24. billing-and-pricing-guide
+3. aicos-chat-guide
+4. responsibility-graph-playbook
+5. charter-design-playbook
+6. charter-authoring-deep-dive
+7. agent-staffing-playbook
+8. add-agents-guide
+9. custom-agents-guide
+10. agent-builder-guide
+11. how-agents-work
+12. tool-access-and-vault
+13. available-tools-guide
+14. mcp-and-cli-guide
+15. skill-builder-guide
+16. agent-skill-authoring-guide
+17. agent-skill-setup-guide
+18. ai-model-data-handling-guide
+19. cascade-guide
+20. signal-guide
+21. friction-guide
+22. confirmations-guide
+23. steward-queue-guide
+24. sync-rhythm-playbook
+25. billing-and-pricing-guide
 
 ## Workflow to guide map
 
@@ -43554,6 +43861,7 @@ Read the listed guide before recommending or running each workflow. Every workfl
 
 - Connect a local agent (CLI login, MCP token, client registration): mcp-and-cli-guide, then agent-reference-map.
 - Company onboarding (context, Compass draft, finish): rost-implementation-method, then settings-members-and-invites-guide for invites.
+- Use the in-app AI Chief of Staff chat or explain its current authority boundary: aicos-chat-guide, then confirmations-guide for any durable change.
 - Author a strong Compass directly (attach references, draft, answer gaps, approve): compass-authoring-guide \u2014 it shows the full JSON contract, what good vs weak looks like per field, and worked examples. Attaching reference docs (onboarding.attach_reference) is reference-only; you author the Compass, the server does not build it for you.
 - Design the graph (create, rename, reparent, set type): responsibility-graph-playbook.
 - Write Charters (draft, edit, approve, sign manifest): charter-design-playbook for the narrative, then charter-authoring-deep-dive for the full document contract field by field (decision_authority, escalation_rules, measurables, budget, permission_manifest, seat-type), then tool-access-and-vault for permissions. Submit the finished Charter directly with charter.update_draft or charter.set.
@@ -43577,11 +43885,11 @@ Read the listed guide before recommending or running each workflow. Every workfl
 
 ## Stage map
 
-- Company setup: rost-implementation-method, compass-authoring-guide, settings-guide, settings-members-and-invites-guide
+- Company setup: rost-implementation-method, compass-authoring-guide, aicos-chat-guide, settings-guide, settings-members-and-invites-guide
 - Graph design: responsibility-graph-playbook
 - Charter design: charter-design-playbook, charter-authoring-deep-dive
 - Staffing: agent-staffing-playbook, add-agents-guide, custom-agents-guide, agent-builder-guide, how-agents-work, tool-access-and-vault, available-tools-guide, skill-builder-guide, agent-skill-authoring-guide, agent-skill-setup-guide, mcp-and-cli-guide, stock-agents-guide
-- Operating rhythm: cascade-guide, signal-guide, friction-guide, confirmations-guide, steward-queue-guide, sync-rhythm-playbook, notifications-guide
+- Operating rhythm: aicos-chat-guide, cascade-guide, signal-guide, friction-guide, confirmations-guide, steward-queue-guide, sync-rhythm-playbook, notifications-guide
 - Local agents and runners: mcp-and-cli-guide, runner-guide, agent-reference-map
 - Security and troubleshooting: ai-model-data-handling-guide, security-model-guide, troubleshooting-guide
 
@@ -43700,7 +44008,7 @@ Agents can suggest commitments and report progress. They should not create a new
     order: 61,
     title: "Signal guide",
     summary: "How to define and read measurables so the company runs on evidence instead of status theater.",
-    version: "2026-07-02.3",
+    version: "2026-07-02.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -43784,12 +44092,14 @@ Once a measurable's number lives in a connected system, you can teach {{brand}}
 - \`signal.bind\` persists the validated recipe as an inert \`draft\` binding. It requires the \`preview_token\` from a preview of the same recipe, so nothing is bound that was not first seen working.
 - \`signal.bind_confirm\` is human-only. It activates the binding (\`draft -> active\`); an agent that calls it produces a pending confirmation instead. Only after a human confirms does the scheduled pull begin writing confirmed readings.
 
-Discovery always returns a \`recipe_presets\` array; it is empty when {{brand}} does not recognize a safe source type. Today those presets cover Baserow row fields and the generic REST JSON fallback. Google Sheets uses OAuth JSON credentials and is withheld from REST presets until the pull executor extracts and refreshes the Google access token instead of treating the stored credential blob as a bearer token. A preset includes a label, cadence, required metadata, a draft \`rest_for_signals\` recipe, and the host allowlist to preview with. The human still fills in the real Baserow table/row/field or exact REST URL and value path before running \`signal.preview\`; presets are starter recipes, not secret stores.
+Discovery always returns a \`recipe_presets\` array; it is empty when {{brand}} does not recognize a safe source type. Today the proven self-filling path is Baserow REST through \`integration.connect_rest\`: a tenant admin creates or rotates the Baserow connection through the command/vault path, then Signal runs \`integration.discover -> signal.preview -> signal.bind -> signal.bind_confirm\` against that connected source. Baserow row-field recipes and custom filtered-count recipes are supported when the human supplies the real table, field, filter, host, and value path. A first-class filtered-count preset is still a follow-up; do not imply every filtered count appears as a one-click preset. Google Sheets Signal pulls are not live yet: Google uses OAuth JSON credentials and remains withheld from REST presets until the pull executor extracts and refreshes the Google access token instead of treating the stored credential blob as a bearer token. A preset includes a label, cadence, required metadata, a draft \`rest_for_signals\` recipe, and the host allowlist to preview with. The human still fills in the real Baserow table/row/field or exact REST URL and value path before running \`signal.preview\`; presets are starter recipes, not secret stores.
 
 Recipes are validated data, never code: a read-only GET, a closed set of non-secret headers, and a restricted scalar path to the value. Every fetch passes one SSRF guard (HTTPS only, a steward-confirmed host allowlist set at bind, and a runtime check that the host does not resolve to a private address). The preset output never contains \`nango://\` handles, vault refs, tokens, or static credential headers. Deterministic pulls write \`integration\`-sourced readings on the measurable's cadence.
 
 In the web app, the same workflow lives on \`/signal\` in the "Connect a self-filling source" panel. It shows each measurable's setup state \u2014 manual, agent draft, source draft, or auto-filled \u2014 plus the latest safe pull outcome when one exists. Choose a connected source, discover its non-secret metadata, preview a GET URL and value path, bind the working preview as a draft, then confirm the draft before scheduled pulls can write readings. The UI never displays credential material, vault refs, raw response bodies, or recipe secrets; if no connected source exists, connect one from Settings first.
 
+A source binding can inform a measurable without automatically changing a Cascade goal. The proven Leiluna Baserow binding uses \`informs\`. Use \`drives_status\` only after a second business anchor confirms that this exact measurable should compute a childless goal's status; otherwise the Signal should stay visible as evidence and exception context, not an automatic goal-status driver.
+
 ## Collect a Signal by judgment (the Signal agent)
 
 Some measurables cannot be a deterministic pull \u2014 the number lives in a PDF, in messy records that need reconciling, or is a judgment estimate of progress. For those, mark the measurable \`agent\`-sourced and let a per-seat Signal agent read it. The agent proposes each reading with \`signal.report\` (scope: seat): one draft reading for one of its OWN seat's agent-sourced measurables, with a \`value\` and a short \`note\` citing the source. The reading lands unconfirmed, exactly like a deterministic draft \u2014 a human clears it with \`signal.confirm_reading\`. \`signal.report\` refuses any measurable not owned by the acting seat and any measurable whose source is not \`agent\`, and it never confirms its own reading. Deliver it as the \`stock/signal-collector\` template (a read-only agent whose only durable grant is \`signal.report\`) or run the \`collect-seat-signals\` how-to from an occupant agent. When the agent cannot read a number confidently \u2014 ambiguous or conflicting sources \u2014 it escalates instead of guessing.
@@ -44115,7 +44425,7 @@ Do not claim that a live charge happened unless Stripe test/live evidence proves
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-07-02.2",
+    version: "2026-07-02.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -44201,6 +44511,7 @@ The company autonomy ceiling is a single tenant-wide dial that caps how much ANY
 
 - Read it with \`settings.agent_policy.get\` (CLI: \`{{cli}} settings agent-policy get\`).
 - Set it with \`settings.agent_policy.update\` (CLI: \`{{cli}} settings agent-policy set --profile locked_down\`). Owner-only and human-gated.
+- In the signed-in app, tenant owners manage the same policy from **Settings \u2192 Company guardrails**. Non-owners can see the current posture but cannot change it.
 - Profiles are named ceilings: \`locked_down\` (agents autonomously read/draft only; every write/send escalates), \`balanced\` (the default; read/draft autonomous, writes escalate), \`high_autonomy\` (approval-marked write tools may run autonomously; only full-access escalates), and \`custom\` + \`max_autonomous_risk\` (\`low\`, \`medium\`, \`high\`, \`critical\`).
 - An explicitly set ceiling is ENFORCED by default. Enforcement has two modes: \`enforce\` blocks an over-ceiling autonomous call and routes it to the steward (it is never a dead-end deny \u2014 a human can still approve), and \`observe\` allows the call but logs it. The platform default for a company that never set a policy is balanced + observe, so existing live agents are never retro-bricked.
 - When enforcement is on, signing a manifest or taking an agent live is REFUSED if the manifest grants always_allow to a tool whose risk exceeds the ceiling; the error names the exact ceiling, tool, and risk in its \`details\`. Lower that tool to always_ask, or raise the ceiling, then retry.
@@ -44214,7 +44525,7 @@ Agents may explain which setting is needed and why. They should not ask users to
     order: 73,
     title: "Members and invites guide",
     summary: "How to invite humans into the company without confusing user access with seat accountability.",
-    version: "2026-06-13.1",
+    version: "2026-07-02.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -44239,6 +44550,8 @@ Invite the person as a tenant member. Then assign them to one or more seats only
 
 Tenant roles control app access. Seats control operating accountability. Do not attach goals, tasks, or measurables directly to a user when the work belongs to a seat.
 
+Owners and admins can invite people and manage member roles. Use \`external_implementer\` plus setup-limited access for a temporary implementation partner helping configure onboarding, Responsibility Graph, Compass, Charters, and agent setup. Do not grant external implementers sensitive run history, hidden tool arguments, credentials, Memory, or company-operating data unless an owner explicitly expands their profile.
+
 ## Agent guidance
 
 When a user asks to add a person, clarify whether they mean app access, seat occupancy, or both. Use invites for access and staffing commands for occupancies.`
@@ -44287,7 +44600,7 @@ Every notification should include the seat, cause, evidence, and requested decis
     order: 75,
     title: "Local runner guide",
     summary: "How local agent sessions and runner surfaces should operate through {{brand}} without bypassing Charters or audit.",
-    version: "2026-06-30.1",
+    version: "2026-07-02.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -44313,6 +44626,26 @@ The local runner is for human-controlled local agent work. It should retrieve {{
 5. Record work, Friction, handoffs, and escalations.
 6. Revoke access when the session ends.
 
+## Install a local Runner
+
+Use Local Runner when a Seat should run on a machine you control. Install it from the public CLI \u2014 no repository checkout and no desktop app are required. A signed desktop app is planned; until verified installers ship, Settings > Runners shows no desktop download link.
+
+Recommended paths:
+
+- **Always-on host:** \`{{cli}} runner install-service --name <runner-name> --execute\` installs a background service (macOS launchd user agent) that keeps the runner online across reboots. Manage it with \`{{cli}} runner start|stop|restart|status|logs|uninstall --name <runner-name>\`.
+- **Manual smoke:** \`{{cli}} runner serve --once\` heartbeats once and exits; \`{{cli}} runner serve --execute\` claims and executes runner work orders while it runs.
+
+Two ways to authenticate and pair \u2014 both first-class, an agent can drive either entirely from the terminal:
+
+- **CLI-native (agent):** \`{{cli}} login --device\` prints a code for one human OAuth approval; after that the session is stored locally and the agent runs unattended ("approve once, then autonomous"). Then \`{{cli}} runner serve\`/\`install-service\` pairs against your active company \u2014 an authenticated CLI can also self-issue a pairing code with \`runner.pairing.start\` and claim it.
+- **Web-guided (human):** issue a pairing code from Settings > Runners > Add a Runner, then on the host run \`{{cli}} runner serve --user-code <code>\`. The host stores only the runner bearer secret in an owner-only file and never logs in.
+
+Headless and service accounts are supported first-class: when no usable OS keychain exists (for example a service or SSH account), the CLI stores the session in an owner-only file (directory 0700, file 0600) automatically \u2014 no development flag. That file holds only the CLI session token, never tenant secrets, API keys, or vault refs.
+
+Choose the local runtime with \`--runtime auto|claude|codex\` (default \`auto\`). The same short-lived seat-scoped MCP token and server-side guard apply regardless of runtime; results are tagged \`claude-cli\` or \`codex-cli\`.
+
+The runner bearer secret is stored locally and is never displayed. Each claimed turn receives a short-lived seat-scoped MCP token from {{brand}}, and server-side guards still decide what tools the Seat may use.
+
 ## Inspect and control runners from CLI or MCP
 
 - Pair a new runner: \`runner.pairing.start\` / \`rost_start_runner_pairing\` with \`name\` and \`platform\` returns a human pairing code. This is owner/admin-only because it mints a short-lived runner pairing session that leads to machine credentials.
@@ -46168,9 +46501,9 @@ var COMMAND_MANIFEST = [
   { "id": "measurable_template.adopt", "namespace": "measurable_template", "action": "adopt", "title": "Adopt a measurable template", "description": "Create a seat measurable from a catalog template (unit/direction/cadence from the template; target optionally overridden). The seat owns it; readings attach afterward.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "template_id", "flag": "template-id", "type": "string", "required": true }, { "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "target", "flag": "target", "type": "number", "required": false }], "hasComplexInput": false, "help": "Create a seat measurable from a catalog template (unit/direction/cadence from the template; target optionally overridden). Adoption is a human act \u2014 source is human." },
   { "id": "measurable_template.list", "namespace": "measurable_template", "action": "list", "title": "List measurable templates", "description": "List the measurable template catalog (Sales/Finance/Ops/Marketing/HR) with unit, direction, cadence, and a suggested target. Adopt one with measurable_template.adopt.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "function", "flag": "function", "type": "enum", "required": false, "enumValues": ["sales", "finance", "operations", "marketing", "hr"] }], "hasComplexInput": false, "help": "List the measurable template catalog by function (Sales/Finance/Ops/Marketing/HR); adopt one with measurable_template.adopt to create a seat measurable." },
   { "id": "measurable.create", "namespace": "measurable", "action": "create", "title": "Add a measurable", "description": "Create a measurable (a Signal a seat owns) with its target, unit, direction, and cadence. The seat owns it; readings attach to the measurable. Source is 'human' \u2014 a human-defined measurable a human logs.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "name", "flag": "name", "type": "string", "required": true }, { "name": "unit", "flag": "unit", "type": "string", "required": true }, { "name": "direction", "flag": "direction", "type": "enum", "required": true, "enumValues": ["up_good", "down_good"] }, { "name": "target", "flag": "target", "type": "number", "required": true }, { "name": "cadence", "flag": "cadence", "type": "enum", "required": true, "enumValues": ["daily", "weekly", "monthly", "quarterly", "annual"] }], "hasComplexInput": false, "help": "Add a measurable a seat owns (name, unit, direction, target, cadence) before recording readings against it." },
-  { "id": "member.invite", "namespace": "member", "action": "invite", "title": "Invite member", "description": "Create a pending tenant invite for a human teammate. The acceptance link is delivered out of band, not in the command result.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "email", "flag": "email", "type": "string", "required": true }, { "name": "role", "flag": "role", "type": "enum", "required": true, "enumValues": ["owner", "steward", "member"] }, { "name": "byo_key", "flag": "byo-key", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Invite humans to the company by seat-aware role; the invite token is never returned over CLI or MCP." },
+  { "id": "member.invite", "namespace": "member", "action": "invite", "title": "Invite member", "description": "Create a pending tenant invite for a human teammate. The acceptance link is delivered out of band, not in the command result.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "email", "flag": "email", "type": "string", "required": true }, { "name": "role", "flag": "role", "type": "enum", "required": true, "enumValues": ["owner", "admin", "steward", "member"] }, { "name": "member_type", "flag": "member-type", "type": "enum", "required": false, "enumValues": ["internal", "external_implementer"] }, { "name": "access_profile", "flag": "access-profile", "type": "enum", "required": false, "enumValues": ["full_setup", "setup_limited", "seat_scoped", "custom"] }, { "name": "aicos_access_scope", "flag": "aicos-access-scope", "type": "enum", "required": false, "enumValues": ["none", "own_scope", "setup", "company_read", "company_operate"] }, { "name": "byo_key", "flag": "byo-key", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Invite humans to the company by seat-aware role; the invite token is never returned over CLI or MCP." },
   { "id": "member.remove", "namespace": "member", "action": "remove", "title": "Remove member", "description": "Remove a tenant member. Blocked when it would orphan an agent steward chain.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "member_id", "flag": "member-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Remove a member; the no-orphan-agent guard blocks removing the only steward in an agent chain." },
-  { "id": "member.update", "namespace": "member", "action": "update", "title": "Update member role", "description": "Change a tenant member's role.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "member_id", "flag": "member-id", "type": "string", "required": true }, { "name": "role", "flag": "role", "type": "enum", "required": true, "enumValues": ["owner", "steward", "member"] }], "hasComplexInput": false, "help": "Change a member's role; role changes are human-gated." },
+  { "id": "member.update", "namespace": "member", "action": "update", "title": "Update member role", "description": "Change a tenant member's role.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "member_id", "flag": "member-id", "type": "string", "required": true }, { "name": "role", "flag": "role", "type": "enum", "required": true, "enumValues": ["owner", "admin", "steward", "member"] }], "hasComplexInput": false, "help": "Change a member's role; role changes are human-gated." },
   { "id": "model.catalog", "namespace": "model", "action": "catalog", "title": "List model catalog", "description": "List the guided model tiers the agent builder reads \u2014 recommendation, token prices, cost band, effort, model id, and when to choose or avoid each tier.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List guided model tiers with recommendations, token prices, cost bands, best-fit work, and model ids before choosing --model for an agent." },
   { "id": "notification.list_errors", "namespace": "notification", "action": "list_errors", "title": "List notification errors", "description": "List recent failed notification deliveries for the tenant.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List recent failed notification deliveries when diagnosing missed escalations or briefs." },
   { "id": "notification.settings.get", "namespace": "notification", "action": "settings.get", "title": "Get notification settings", "description": "Read tenant notification preferences (escalations, Sync brief, default channel).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read notification preferences before changing escalation or Sync brief delivery." },
@@ -46178,7 +46511,7 @@ var COMMAND_MANIFEST = [
   { "id": "notification.test", "namespace": "notification", "action": "test", "title": "Send test notification", "description": "Emit an in-app test notification to the acting human to verify delivery is wired.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Send an in-app test notification to confirm the delivery path is wired." },
   { "id": "onboarding.advance_step", "namespace": "onboarding", "action": "advance_step", "title": "Advance onboarding step", "description": "Persist the current onboarding step after server-side validation.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "step", "flag": "step", "type": "string", "required": true }, { "name": "completed", "flag": "completed", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Advance onboarding only after the current setup step is represented in the tenant state." },
   { "id": "onboarding.attach_reference", "namespace": "onboarding", "action": "attach_reference", "title": "Attach reference document", "description": "Attach a company reference document (text/markdown) so Compass and Charters can cite it. Reference-only \u2014 it does not build a Compass; convert each meaningful doc to markdown and attach it with a title, kind, and source.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "text", "flag": "text", "type": "string", "required": true }, { "name": "filename", "flag": "filename", "type": "string", "required": false }, { "name": "mime_type", "flag": "mime-type", "type": "enum", "required": false, "enumValues": ["text/plain", "text/markdown", "text/csv"] }, { "name": "title", "flag": "title", "type": "string", "required": false }, { "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["plan", "financial", "org_chart", "process"] }, { "name": "source", "flag": "source", "type": "string", "required": false }], "hasComplexInput": false, "help": "Convert each meaningful company doc to markdown and attach it as a reference (title, kind, source) so Compass and Charters can cite it; this attaches a reference, it does not build a Compass \u2014 author Compass directly.", "example": { "text": "# Company handbook\n\nWe build precision components for the aerospace supply chain.", "filename": "handbook.md", "mime_type": "text/markdown", "title": "Company handbook", "kind": "plan", "source": "handbook/overview.md" } },
-  { "id": "onboarding.create_invite", "namespace": "onboarding", "action": "create_invite", "title": "Create onboarding invite", "description": "Create a pending invite for an onboarding team member.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "email", "flag": "email", "type": "string", "required": true }, { "name": "role", "flag": "role", "type": "enum", "required": false, "enumValues": ["owner", "steward", "member"] }], "hasComplexInput": true, "help": "Invites should give humans access to the company without assigning work directly to people instead of seats." },
+  { "id": "onboarding.create_invite", "namespace": "onboarding", "action": "create_invite", "title": "Create onboarding invite", "description": "Create a pending invite for an onboarding team member.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "email", "flag": "email", "type": "string", "required": true }, { "name": "role", "flag": "role", "type": "enum", "required": false, "enumValues": ["owner", "admin", "steward", "member"] }], "hasComplexInput": true, "help": "Invites should give humans access to the company without assigning work directly to people instead of seats." },
   { "id": "onboarding.finish", "namespace": "onboarding", "action": "finish", "title": "Finish onboarding", "description": "Mark onboarding complete after the existing onboarding requirements pass.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Finish onboarding when the graph, at least one Charter, and the first operating rhythm are clear." },
   { "id": "onboarding.status", "namespace": "onboarding", "action": "status", "title": "Onboard status", "description": "Return current onboarding progress, graph summary, and the next recommended actions.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Start by checking onboarding status, then use the implementation method guide to choose the next setup step." },
   { "id": "onboarding.upload_context", "namespace": "onboarding", "action": "upload_context", "title": "Upload org context", "description": "Compatibility alias for onboarding.attach_reference: attach a company reference document (text/markdown) that Compass and Charters can cite. Reference-only \u2014 it does not build a Compass.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "text", "flag": "text", "type": "string", "required": true }, { "name": "filename", "flag": "filename", "type": "string", "required": false }, { "name": "mime_type", "flag": "mime-type", "type": "enum", "required": false, "enumValues": ["text/plain", "text/markdown", "text/csv"] }, { "name": "title", "flag": "title", "type": "string", "required": false }, { "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["plan", "financial", "org_chart", "process"] }, { "name": "source", "flag": "source", "type": "string", "required": false }], "hasComplexInput": false, "help": "Compatibility alias for onboarding.attach_reference: attach a company reference document so Compass and Charters can cite it. It does not build a Compass.", "example": { "text": "# Company handbook\n\nWe build precision components for the aerospace supply chain.", "filename": "handbook.md", "mime_type": "text/markdown", "title": "Company handbook", "kind": "plan", "source": "handbook/overview.md" } },
@@ -47950,6 +48283,9 @@ function operationUsageLines(bin) {
     `${bin} error list|resolve|supersede`,
     `${bin} sync brief|compile|complete`,
     `${bin} runner list|status|diagnose|repair|work-orders|revoke|serve`,
+    // Local runner service lifecycle (DER-1142). The orchestrator mirrors this
+    // exact line into the mcp-and-cli-guide so the help/guide parity gate passes.
+    `${bin} runner install-service|start|stop|restart|status|logs|uninstall --name <name>`,
     `${bin} notification settings|test|errors`,
     `${bin} settings get|update|product-learning|agent-policy|rename`,
     `${bin} member invite|update|remove`,
@@ -48524,8 +48860,8 @@ function pendingConfirmationFromError(error51) {
 import { execFile as execFileCallback2 } from "node:child_process";
 import { access, readFile as readFile3 } from "node:fs/promises";
 import { delimiter } from "node:path";
-import { promisify as promisify3 } from "node:util";
-var execFile3 = promisify3(execFileCallback2);
+import { promisify as promisify2 } from "node:util";
+var execFile2 = promisify2(execFileCallback2);
 async function runDoctor(options) {
   const env = options.env ?? process.env;
   const store = options.store ?? createTokenStore();
@@ -48573,7 +48909,7 @@ async function checkPath(env) {
 }
 async function probeCli(command) {
   try {
-    const { stdout, stderr } = await execFile3(command, ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile2(command, ["--version"], { timeout: 1500 });
     const version4 = (stdout || stderr).trim().split("\n")[0]?.trim();
     return version4 ? `installed (${version4})` : "installed";
   } catch {
@@ -48648,8 +48984,8 @@ import { chmod, mkdir as mkdir2, readFile as readFile4, rm as rm2, writeFile as
 import { hostname as hostname3, tmpdir } from "node:os";
 import path3 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
-import { promisify as promisify4 } from "node:util";
-var execFile4 = promisify4(execFileCallback3);
+import { promisify as promisify3 } from "node:util";
+var execFile3 = promisify3(execFileCallback3);
 async function runRunnerServe(options) {
   const env = options.env ?? process.env;
   const fetchImpl = options.fetchImpl ?? fetch;
@@ -48688,8 +49024,11 @@ ${usage()}
         options.io.stdout.write(`heartbeat ok #${beat} runner_id=${state.runner_id} claude=${capabilities.claude.installed} codex=${capabilities.codex.installed}
 `);
       }
-      if (config2.execute && capabilities.claude.installed) {
-        await claimAndExecute(fetchImpl, options.appUrl, state, options.io);
+      if (config2.execute) {
+        const localRuntime = effectiveExecutionRuntime(config2.runtime, capabilities);
+        if (localRuntime) {
+          await claimAndExecute(fetchImpl, options.appUrl, state, options.io, localRuntime);
+        }
       }
     } catch (error51) {
       failed = true;
@@ -48709,6 +49048,7 @@ function parseServeArgs(args, appUrl2, env) {
   let heartbeatMs = Number(env.RUNNER_HEARTBEAT_MS ?? 3e4);
   let execute2 = env.RUNNER_EXECUTE === "1";
   let once = false;
+  let runtime = parseRuntime(env.RUNNER_RUNTIME ?? "auto");
   let userCode = env.RUNNER_USER_CODE;
   for (let index = 0; index < args.length; index += 1) {
     const token = args[index];
@@ -48724,6 +49064,9 @@ function parseServeArgs(args, appUrl2, env) {
     } else if (token === "--user-code") {
       userCode = requiredValue(args, index);
       index += 1;
+    } else if (token === "--runtime") {
+      runtime = parseRuntime(requiredValue(args, index));
+      index += 1;
     } else if (token === "--execute") {
       execute2 = true;
     } else if (token === "--once") {
@@ -48735,7 +49078,19 @@ function parseServeArgs(args, appUrl2, env) {
   if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1e3) {
     throw new Error("--heartbeat-ms must be an integer >= 1000.");
   }
-  return { name, stateFile, heartbeatMs, execute: execute2, once, ...userCode ? { userCode } : {} };
+  return { name, stateFile, heartbeatMs, execute: execute2, once, runtime, ...userCode ? { userCode } : {} };
+}
+function parseRuntime(value) {
+  if (value === "auto" || value === "claude" || value === "codex") {
+    return value;
+  }
+  throw new Error(`--runtime must be one of auto, claude, codex (got ${value}).`);
+}
+function effectiveExecutionRuntime(runtime, capabilities) {
+  if (runtime === "codex") {
+    return capabilities.codex.installed ? "codex" : null;
+  }
+  return capabilities.claude.installed ? "claude" : null;
 }
 function requiredValue(args, index) {
   const value = args[index + 1];
@@ -48825,7 +49180,7 @@ async function detectCapabilities() {
 }
 async function probe(command) {
   try {
-    const { stdout, stderr } = await execFile4(command, ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile3(command, ["--version"], { timeout: 1500 });
     return { installed: true, version: (stdout || stderr).trim() || null, auth_state: "ready" };
   } catch {
     return { installed: false, version: null, auth_state: "unknown" };
@@ -48850,7 +49205,7 @@ async function post2(fetchImpl, appUrl2, pathName, body, token) {
   }
   return { status: response.status, json: json2 };
 }
-async function claimAndExecute(fetchImpl, appUrl2, state, io) {
+async function claimAndExecute(fetchImpl, appUrl2, state, io, runtime) {
   const claimed = await post2(fetchImpl, appUrl2, "/api/runner/work-orders/claim", {}, state.runner_secret);
   const workOrder = claimed.json.work_order;
   if (claimed.status !== 200 || !workOrder || typeof workOrder !== "object") {
@@ -48864,12 +49219,12 @@ async function claimAndExecute(fetchImpl, appUrl2, state, io) {
   if (started.status !== 200) {
     throw new Error(`work order start failed ${started.status}: ${redactForLog(JSON.stringify(started.json))}`);
   }
-  const result = await runClaudeTurn(appUrl2, workOrder);
+  const result = await runLocalTurn(appUrl2, workOrder, runtime);
   const reported = await post2(fetchImpl, appUrl2, `/api/runner/work-orders/${encodeURIComponent(workOrderId)}/result`, {
     status: result.ok ? "succeeded" : "failed",
     summary: result.summary,
     log_ref: `runner-local:${workOrderId}`,
-    model: "claude-cli"
+    model: runtime === "codex" ? "codex-cli" : "claude-cli"
   }, state.runner_secret);
   if (reported.status !== 200) {
     throw new Error(`work order result failed ${reported.status}: ${redactForLog(JSON.stringify(reported.json))}`);
@@ -48877,7 +49232,28 @@ async function claimAndExecute(fetchImpl, appUrl2, state, io) {
   io.stdout.write(`work_order_id=${workOrderId} status=${result.ok ? "succeeded" : "failed"}
 `);
 }
-async function runClaudeTurn(appUrl2, workOrder) {
+function runLocalTurn(appUrl2, workOrder, runtime) {
+  return runtime === "codex" ? runCodexTurn(appUrl2, workOrder) : runClaudeTurn(appUrl2, workOrder);
+}
+function runClaudeTurn(appUrl2, workOrder) {
+  return spawnRunnerTurn(appUrl2, workOrder, "claude");
+}
+function runCodexTurn(appUrl2, workOrder) {
+  return spawnRunnerTurn(appUrl2, workOrder, "codex");
+}
+function buildTurnCommand(runtime, prompt, configPath) {
+  if (runtime === "codex") {
+    return {
+      command: "codex",
+      args: ["exec", prompt, "--mcp-config", configPath, "--sandbox", "read-only", "--skip-git-repo-check"]
+    };
+  }
+  return {
+    command: "claude",
+    args: ["-p", prompt, "--mcp-config", configPath, "--strict-mcp-config", "--output-format", "text"]
+  };
+}
+async function spawnRunnerTurn(appUrl2, workOrder, runtime) {
   const mcp = typeof workOrder.mcp === "object" && workOrder.mcp !== null ? workOrder.mcp : {};
   const token = typeof mcp.token === "string" ? mcp.token : "";
   const url2 = typeof mcp.url === "string" ? `${appUrl2.replace(/\/+$/, "")}${mcp.url}` : `${appUrl2.replace(/\/+$/, "")}/mcp`;
@@ -48898,6 +49274,7 @@ async function runClaudeTurn(appUrl2, workOrder) {
   await writeFile2(configPath, `${mcpConfig}
 `, { mode: 384 });
   await chmod(configPath, 384);
+  const { command, args } = buildTurnCommand(runtime, prompt, configPath);
   return new Promise((resolve2) => {
     let settled = false;
     const finish = (result) => {
@@ -48908,7 +49285,7 @@ async function runClaudeTurn(appUrl2, workOrder) {
       void rm2(configPath, { force: true });
       resolve2(result);
     };
-    const child = spawn("claude", ["-p", prompt, "--mcp-config", configPath, "--strict-mcp-config", "--output-format", "text"], {
+    const child = spawn(command, args, {
       cwd: tmpdir(),
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -48935,7 +49312,431 @@ async function runClaudeTurn(appUrl2, workOrder) {
   });
 }
 function usage() {
-  return "Usage: rost runner serve [--name <text>] [--state-file <path>] [--heartbeat-ms <n>] [--user-code <code>] [--once] [--execute]";
+  return "Usage: rost runner serve [--name <text>] [--state-file <path>] [--heartbeat-ms <n>] [--user-code <code>] [--runtime auto|claude|codex] [--once] [--execute]";
+}
+
+// src/runner-service.ts
+import { execFile as execFileCallback4 } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { access as access2, mkdir as mkdir3, readFile as readFile5, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import path4 from "node:path";
+import { promisify as promisify4 } from "node:util";
+var execFile4 = promisify4(execFileCallback4);
+var SERVICE_VERBS = ["install-service", "start", "stop", "restart", "status", "logs", "uninstall"];
+function isServiceVerb(value) {
+  return value !== void 0 && SERVICE_VERBS.includes(value);
+}
+function isRunnerServiceInvocation(args) {
+  const verb = args[0];
+  if (verb === "status") {
+    return args.includes("--name");
+  }
+  return isServiceVerb(verb);
+}
+function runnerServicePaths(homeDir, runnerName) {
+  const safeName = safeRunnerName(runnerName);
+  return {
+    launchAgentPath: path4.join(homeDir, "Library", "LaunchAgents", `${serviceLabel(safeName)}.plist`),
+    stateFile: path4.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-${safeName}.json`),
+    logDir: path4.join(homeDir, "Library", "Logs", cliBrand.name, "runner", safeName)
+  };
+}
+function renderLaunchdPlist(config2) {
+  const programArgs = [
+    config2.binPath,
+    "runner",
+    "serve",
+    ...config2.execute ? ["--execute"] : [],
+    "--name",
+    config2.runnerName,
+    "--state-file",
+    config2.stateFile
+  ];
+  const programArgsXml = programArgs.map((arg) => `    <string>${escapePlist(arg)}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${escapePlist(serviceLabel(config2.runnerName))}</string>
+  <key>ProgramArguments</key>
+  <array>
+${programArgsXml}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>${cliBrand.envPrefix}_APP_URL</key>
+    <string>${escapePlist(config2.appUrl)}</string>
+  </dict>
+  <key>KeepAlive</key>
+  <true/>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${escapePlist(path4.join(config2.logDir, "stdout.log"))}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapePlist(path4.join(config2.logDir, "stderr.log"))}</string>
+</dict>
+</plist>
+`;
+}
+async function runRunnerService(options) {
+  const verb = options.args[0];
+  if (!isServiceVerb(verb)) {
+    options.io.stderr.write(`Unknown runner service command: ${verb ?? ""}
+${serviceUsage()}
+`);
+    return 1;
+  }
+  if (options.args.includes("--help") || options.args.includes("-h")) {
+    options.io.stdout.write(`${serviceUsage()}
+`);
+    return 0;
+  }
+  let parsed;
+  try {
+    parsed = parseServiceArgs(options.args.slice(1));
+  } catch (error51) {
+    options.io.stderr.write(`${error51 instanceof Error ? error51.message : String(error51)}
+${serviceUsage()}
+`);
+    return 1;
+  }
+  const cmd = {
+    io: options.io,
+    runnerName: parsed.runnerName,
+    appUrl: options.appUrl,
+    execute: parsed.execute,
+    binPath: options.binPath ?? resolveBinPath(),
+    homeDir: options.homeDir ?? homedir2(),
+    platform: options.platform ?? process.platform,
+    exec: options.exec ?? defaultExec,
+    uid: options.uid ?? (process.getuid ? process.getuid() : 0)
+  };
+  switch (verb) {
+    case "install-service":
+      return installService(cmd);
+    case "start":
+      return startService(cmd);
+    case "stop":
+      return stopService(cmd);
+    case "restart":
+      return restartService(cmd);
+    case "status":
+      return statusService(cmd);
+    case "logs":
+      return logsService(cmd);
+    case "uninstall":
+      return uninstallService(cmd);
+    default:
+      return assertNever2(verb);
+  }
+}
+async function installService(options) {
+  if (options.platform !== "darwin") {
+    return unsupportedPlatform(options.io, options.platform);
+  }
+  const safeName = safeRunnerName(options.runnerName);
+  const paths = runnerServicePaths(options.homeDir, safeName);
+  const label = serviceLabel(safeName);
+  await mkdir3(paths.logDir, { recursive: true });
+  await mkdir3(path4.dirname(paths.stateFile), { recursive: true });
+  await mkdir3(path4.dirname(paths.launchAgentPath), { recursive: true });
+  const plist = renderLaunchdPlist({
+    binPath: options.binPath,
+    runnerName: safeName,
+    stateFile: paths.stateFile,
+    logDir: paths.logDir,
+    appUrl: options.appUrl,
+    execute: options.execute
+  });
+  await writeFile3(paths.launchAgentPath, plist, { mode: 420 });
+  await bootoutQuietly(options.exec, options.uid, paths.launchAgentPath);
+  try {
+    await options.exec("launchctl", ["bootstrap", domainTarget(options.uid), paths.launchAgentPath]);
+  } catch (error51) {
+    options.io.stderr.write(
+      `Failed to load the runner service: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`
+    );
+    return 1;
+  }
+  options.io.stdout.write(
+    `${[
+      `Installed runner service ${label}.`,
+      `plist: ${paths.launchAgentPath}`,
+      `state file: ${paths.stateFile}`,
+      `logs: ${paths.logDir}`,
+      `execute: ${options.execute ? "on (claims and runs work orders)" : "off (heartbeat only)"}`,
+      `The runner pairs on first run; its bearer secret is stored locally and never printed.`
+    ].join("\n")}
+`
+  );
+  return 0;
+}
+async function startService(options) {
+  if (options.platform !== "darwin") {
+    return unsupportedPlatform(options.io, options.platform);
+  }
+  const safeName = safeRunnerName(options.runnerName);
+  const paths = runnerServicePaths(options.homeDir, safeName);
+  const label = serviceLabel(safeName);
+  if (!await fileExists(paths.launchAgentPath)) {
+    options.io.stderr.write(
+      `No runner service found for "${safeName}". Run \`${cliBrand.binName} runner install-service --name ${safeName}\` first.
+`
+    );
+    return 1;
+  }
+  try {
+    await options.exec("launchctl", ["bootstrap", domainTarget(options.uid), paths.launchAgentPath]);
+    options.io.stdout.write(`Started runner service ${label}.
+`);
+    return 0;
+  } catch (bootstrapError) {
+    try {
+      await options.exec("launchctl", ["kickstart", "-k", serviceTarget(options.uid, label)]);
+      options.io.stdout.write(`Runner service ${label} was already loaded; restarted it.
+`);
+      return 0;
+    } catch (kickstartError) {
+      options.io.stderr.write(
+        `Failed to start runner service ${label}: ${redactForLog(kickstartError instanceof Error ? kickstartError.message : String(kickstartError))}
+`
+      );
+      return 1;
+    }
+  }
+}
+async function stopService(options) {
+  if (options.platform !== "darwin") {
+    return unsupportedPlatform(options.io, options.platform);
+  }
+  const safeName = safeRunnerName(options.runnerName);
+  const paths = runnerServicePaths(options.homeDir, safeName);
+  const label = serviceLabel(safeName);
+  try {
+    await options.exec("launchctl", ["bootout", domainTarget(options.uid), paths.launchAgentPath]);
+    options.io.stdout.write(`Stopped runner service ${label}.
+`);
+  } catch {
+    options.io.stdout.write(`Runner service ${label} was not running.
+`);
+  }
+  return 0;
+}
+async function restartService(options) {
+  if (options.platform !== "darwin") {
+    return unsupportedPlatform(options.io, options.platform);
+  }
+  const safeName = safeRunnerName(options.runnerName);
+  const label = serviceLabel(safeName);
+  try {
+    await options.exec("launchctl", ["kickstart", "-k", serviceTarget(options.uid, label)]);
+    options.io.stdout.write(`Restarted runner service ${label}.
+`);
+    return 0;
+  } catch (error51) {
+    options.io.stderr.write(
+      `Failed to restart runner service ${label}: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}. Is it installed? Run \`${cliBrand.binName} runner install-service --name ${safeName}\`.
+`
+    );
+    return 1;
+  }
+}
+async function statusService(options) {
+  if (options.platform !== "darwin") {
+    return unsupportedPlatform(options.io, options.platform);
+  }
+  const safeName = safeRunnerName(options.runnerName);
+  const paths = runnerServicePaths(options.homeDir, safeName);
+  const label = serviceLabel(safeName);
+  const installed = await fileExists(paths.launchAgentPath);
+  try {
+    const { stdout } = await options.exec("launchctl", ["print", serviceTarget(options.uid, label)]);
+    const state = extractLaunchdState(stdout);
+    options.io.stdout.write(
+      `${[
+        `runner service: ${label}`,
+        `installed: ${installed ? "yes" : "no"}`,
+        `loaded: yes`,
+        `state: ${state ?? "unknown"}`,
+        `plist: ${paths.launchAgentPath}`,
+        `logs: ${paths.logDir}`
+      ].join("\n")}
+`
+    );
+    return 0;
+  } catch {
+    options.io.stdout.write(
+      `${[
+        `runner service: ${label}`,
+        `installed: ${installed ? "yes" : "no"}`,
+        `loaded: no`,
+        `plist: ${paths.launchAgentPath}`,
+        `logs: ${paths.logDir}`
+      ].join("\n")}
+`
+    );
+    return 1;
+  }
+}
+async function logsService(options) {
+  if (options.platform !== "darwin") {
+    return unsupportedPlatform(options.io, options.platform);
+  }
+  const safeName = safeRunnerName(options.runnerName);
+  const paths = runnerServicePaths(options.homeDir, safeName);
+  const label = serviceLabel(safeName);
+  const stdoutLog = path4.join(paths.logDir, "stdout.log");
+  const stderrLog = path4.join(paths.logDir, "stderr.log");
+  options.io.stdout.write(
+    `${[
+      `runner service logs for ${label}:`,
+      `  stdout: ${stdoutLog}`,
+      `  stderr: ${stderrLog}`,
+      `Follow live with: tail -f ${JSON.stringify(stdoutLog)} ${JSON.stringify(stderrLog)}`
+    ].join("\n")}
+`
+  );
+  for (const [name, file2] of [["stdout", stdoutLog], ["stderr", stderrLog]]) {
+    const tail = await readTail(file2, 4e3);
+    if (tail !== null && tail.trim().length > 0) {
+      options.io.stdout.write(`
+----- ${name} (tail) -----
+${redactForLog(tail)}
+`);
+    }
+  }
+  return 0;
+}
+async function uninstallService(options) {
+  if (options.platform !== "darwin") {
+    return unsupportedPlatform(options.io, options.platform);
+  }
+  const safeName = safeRunnerName(options.runnerName);
+  const paths = runnerServicePaths(options.homeDir, safeName);
+  const label = serviceLabel(safeName);
+  await bootoutQuietly(options.exec, options.uid, paths.launchAgentPath);
+  let removed = false;
+  try {
+    await rm3(paths.launchAgentPath, { force: true });
+    removed = true;
+  } catch (error51) {
+    options.io.stderr.write(
+      `Failed to remove ${paths.launchAgentPath}: ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`
+    );
+  }
+  options.io.stdout.write(
+    `${[
+      `Uninstalled runner service ${label}.`,
+      removed ? `Removed ${paths.launchAgentPath}.` : `Could not remove ${paths.launchAgentPath}; remove it manually.`,
+      `Left the runner state file at ${paths.stateFile} (it holds the local bearer secret).`,
+      `Delete that file to forget this runner locally, and run \`${cliBrand.binName} runner revoke <runner-id>\` to revoke it in ${cliBrand.name}.`
+    ].join("\n")}
+`
+  );
+  return removed ? 0 : 1;
+}
+function parseServiceArgs(args) {
+  let runnerName;
+  let execute2 = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index];
+    if (token === "--name") {
+      const value = args[index + 1];
+      if (value === void 0 || value.startsWith("--")) {
+        throw new Error("--name requires a value.");
+      }
+      runnerName = value;
+      index += 1;
+    } else if (token === "--execute") {
+      execute2 = true;
+    } else {
+      throw new Error(`Unexpected runner service argument: ${token ?? ""}`);
+    }
+  }
+  if (runnerName === void 0 || runnerName.trim().length === 0) {
+    throw new Error("--name <runner-name> is required.");
+  }
+  return { runnerName, execute: execute2 };
+}
+function serviceUsage() {
+  const bin = cliBrand.binName;
+  return [
+    `Usage:`,
+    `  ${bin} runner install-service --name <name> [--execute]`,
+    `  ${bin} runner start|stop|restart|status|logs|uninstall --name <name>`
+  ].join("\n");
+}
+function safeRunnerName(runnerName) {
+  const safe = runnerName.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return safe.length > 0 ? safe : "runner";
+}
+function serviceLabel(safeName) {
+  return `com.${cliBrand.binName}.runner.${safeName}`;
+}
+function domainTarget(uid) {
+  return `gui/${uid}`;
+}
+function serviceTarget(uid, label) {
+  return `gui/${uid}/${label}`;
+}
+async function bootoutQuietly(exec, uid, plistPath) {
+  try {
+    await exec("launchctl", ["bootout", domainTarget(uid), plistPath]);
+  } catch {
+  }
+}
+function unsupportedPlatform(io, platform) {
+  io.stderr.write(
+    `Service install is not supported on ${platform} yet. Run \`${cliBrand.binName} runner serve --execute\` under a process manager (for example systemd, pm2, or nssm) to keep a runner online.
+`
+  );
+  return 1;
+}
+function resolveBinPath() {
+  const entry = process.argv[1];
+  if (entry === void 0 || entry.length === 0) {
+    return cliBrand.binName;
+  }
+  try {
+    return realpathSync(entry);
+  } catch {
+    return entry;
+  }
+}
+function extractLaunchdState(printOutput) {
+  const match = printOutput.match(/state\s*=\s*(\S+)/);
+  return match ? match[1] ?? null : null;
+}
+async function fileExists(file2) {
+  try {
+    await access2(file2);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readTail(file2, maxBytes) {
+  try {
+    const content = await readFile5(file2, "utf8");
+    return content.length > maxBytes ? content.slice(content.length - maxBytes) : content;
+  } catch {
+    return null;
+  }
+}
+function escapePlist(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+var defaultExec = async (file2, args) => {
+  const result = await execFile4(file2, args);
+  return { stdout: String(result.stdout), stderr: String(result.stderr) };
+};
+function assertNever2(value) {
+  throw new Error(`Unhandled runner service verb: ${String(value)}`);
 }
 
 // src/index.ts
@@ -49085,6 +49886,9 @@ async function main(argv = process.argv.slice(2), options = {}) {
       env: process.env
     });
   }
+  if (command === "runner" && isRunnerServiceInvocation(args)) {
+    return runRunnerService({ io, args, appUrl: config2.appUrl });
+  }
   if (!session) {
     io.stderr.write(`Not logged in. Run ${cliBrand.binName} login first.
 `);
@@ -49562,7 +50366,7 @@ function isCliEntrypoint(moduleUrl, argvPath) {
     return false;
   }
   try {
-    return realpathSync(fileURLToPath3(moduleUrl)) === realpathSync(argvPath);
+    return realpathSync2(fileURLToPath3(moduleUrl)) === realpathSync2(argvPath);
   } catch {
     return moduleUrl === pathToFileURL(argvPath).href;
   }