@sailorbridge/client 0.2.3 → 0.2.4

package/dist/src/cli.js

@@ -2,10 +2,10 @@
 import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// .dist-releases/1784888160293-2271563/src/cli.js
+// .dist-releases/1784894032002-2676534/src/cli.js
 import { hostname as hostname3 } from "node:os";
 import { writeSync } from "node:fs";
-// .dist-releases/1784888160293-2271563/src/auth/host-pairing.js
+// .dist-releases/1784894032002-2676534/src/auth/host-pairing.js
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir, hostname, platform } from "node:os";
 import path from "node:path";
@@ -220,7 +220,7 @@ function _assertObject(value) {
     throw new Error("host pairing response must be an object");
   return value;
 }
-// .dist-releases/1784888160293-2271563/src/host/repo-tip-reporter.js
+// .dist-releases/1784894032002-2676534/src/host/repo-tip-reporter.js
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
@@ -402,10 +402,10 @@ ${error.message}`));
     proc.on("close", (code) => finish(code ?? 1));
   });
 }
-// .dist-releases/1784888160293-2271563/src/host/request-consumer.js
+// .dist-releases/1784894032002-2676534/src/host/request-consumer.js
 import { hostname as hostname2 } from "node:os";
 
-// .dist-releases/1784888160293-2271563/src/driver/secrets.js
+// .dist-releases/1784894032002-2676534/src/driver/secrets.js
 function redactSensitiveText(text, env = {}, explicitSecrets = []) {
   let redacted = text;
   for (const [key, value] of Object.entries(env)) {
@@ -424,16 +424,16 @@ function isSensitiveEnvKey(key) {
   return /(TOKEN|KEY|SECRET|AUTHORIZATION|PASSWORD)/i.test(key);
 }
 
-// .dist-releases/1784888160293-2271563/src/version.js
-var CLIENT_VERSION = "0.2.3";
-var CLIENT_GIT_SHA = "ed59f81313f2-dirty";
-var CLIENT_BUILD_DIRTY = true;
+// .dist-releases/1784894032002-2676534/src/version.js
+var CLIENT_VERSION = "0.2.4";
+var CLIENT_GIT_SHA = "22d3b8376a97";
+var CLIENT_BUILD_DIRTY = false;
 var CLIENT_VERSION_LABEL = formatClientVersion(CLIENT_VERSION, CLIENT_GIT_SHA);
 function formatClientVersion(version, gitSha) {
   return `${version}+git.${gitSha}`;
 }
 
-// .dist-releases/1784888160293-2271563/src/host/request-consumer.js
+// .dist-releases/1784894032002-2676534/src/host/request-consumer.js
 var MAX_ERROR_LENGTH = 500;
 function defaultHostIdentity(config) {
   const captainId = config.captainId?.trim();
@@ -489,7 +489,7 @@ function limitErrorMessage(error, explicitSecrets) {
   const trimmed = redactSensitiveText(message, process.env, explicitSecrets).trim() || "host request starter failed";
   return trimmed.length <= MAX_ERROR_LENGTH ? trimmed : `${trimmed.slice(0, MAX_ERROR_LENGTH - 3)}...`;
 }
-// .dist-releases/1784888160293-2271563/src/product/start-request.js
+// .dist-releases/1784894032002-2676534/src/product/start-request.js
 async function createAgentStartRequest(options) {
   const apiUrl = _required(options.apiUrl, "product API URL").replace(/\/+$/u, "");
   const accessToken = _required(options.accessToken, "product API bearer token");
@@ -549,7 +549,7 @@ function _string(value, label) {
     throw new Error(`${label} must be a non-empty string`);
   return value;
 }
-// .dist-releases/1784888160293-2271563/src/product/pair.js
+// .dist-releases/1784894032002-2676534/src/product/pair.js
 async function createPair(options) {
   const apiUrl = _required2(options.apiUrl, "product API URL").replace(/\/+$/u, "");
   const accessToken = _required2(options.accessToken, "product API bearer token");
@@ -626,7 +626,7 @@ function _string2(value, label) {
     throw new Error(`${label} must be a non-empty string`);
   return value;
 }
-// .dist-releases/1784888160293-2271563/src/product/worker.js
+// .dist-releases/1784894032002-2676534/src/product/worker.js
 async function createWorker(options) {
   const apiUrl = _required3(options.apiUrl, "product API URL").replace(/\/+$/u, "");
   const accessToken = _required3(options.accessToken, "product API bearer token");
@@ -690,7 +690,7 @@ function _string3(value, label) {
     throw new Error(`${label} must be a non-empty string`);
   return value;
 }
-// .dist-releases/1784888160293-2271563/src/driver/events.js
+// .dist-releases/1784894032002-2676534/src/driver/events.js
 class DriverEventEmitter {
   callbacks = new Map;
   on(type, callback) {
@@ -705,7 +705,7 @@ class DriverEventEmitter {
     }
   }
 }
-// .dist-releases/1784888160293-2271563/src/driver/async-queue.js
+// .dist-releases/1784894032002-2676534/src/driver/async-queue.js
 class AsyncQueue {
   values = [];
   waiters = [];
@@ -744,7 +744,7 @@ class AsyncQueue {
   }
 }
 
-// .dist-releases/1784888160293-2271563/src/driver/types.js
+// .dist-releases/1784894032002-2676534/src/driver/types.js
 class DriverUnsupportedError extends Error {
   constructor(message) {
     super(message);
@@ -759,7 +759,7 @@ class DriverTargetNotReadyError extends Error {
   }
 }
 
-// .dist-releases/1784888160293-2271563/src/driver/sdk-loader.js
+// .dist-releases/1784894032002-2676534/src/driver/sdk-loader.js
 async function loadSdk(loader, packageName, env = {}, installHint = `Install the optional SDK dependency ${packageName} and its peers for this transport.`) {
   try {
     return await loader();
@@ -769,7 +769,7 @@ async function loadSdk(loader, packageName, env = {}, installHint = `Install the
   }
 }
 
-// .dist-releases/1784888160293-2271563/src/driver/claude/driver.js
+// .dist-releases/1784894032002-2676534/src/driver/claude/driver.js
 class ClaudeAgentSdkDriver {
   options;
   capabilities = { structured: true, resume: true, attach: false };
@@ -945,7 +945,7 @@ function asRecord(value) {
 function stringValue(value) {
   return typeof value === "string" ? value : undefined;
 }
-// .dist-releases/1784888160293-2271563/src/driver/codex/driver.js
+// .dist-releases/1784894032002-2676534/src/driver/codex/driver.js
 class CodexSdkDriver {
   options;
   capabilities = { structured: true, resume: true, attach: false };
@@ -1126,7 +1126,7 @@ function asRecord2(value) {
 function stringValue2(value) {
   return typeof value === "string" ? value : undefined;
 }
-// .dist-releases/1784888160293-2271563/src/driver/liveness-heuristics.js
+// .dist-releases/1784894032002-2676534/src/driver/liveness-heuristics.js
 var BUSY_MARKERS = ["Working (", "Waiting for background", "Pasted Content", "tab to queue"];
 var ANSI_PATTERN = /\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1B\\)|[PX^_][\s\S]*?\x1B\\)/g;
 function stripAnsi(text) {
@@ -1153,7 +1153,7 @@ function classifyInteractiveOutput(input) {
 function isOutputStable(now, lastOutputAt, idleStableMs) {
   return Boolean(lastOutputAt && now.getTime() - lastOutputAt.getTime() >= idleStableMs);
 }
-// .dist-releases/1784888160293-2271563/src/driver/pty/loader.js
+// .dist-releases/1784894032002-2676534/src/driver/pty/loader.js
 async function loadNodePty(loader = defaultNodePtyLoader) {
   try {
     return await loader();
@@ -1179,7 +1179,7 @@ async function defaultNodePtyLoader() {
   return loaded;
 }
 
-// .dist-releases/1784888160293-2271563/src/driver/pty/driver.js
+// .dist-releases/1784894032002-2676534/src/driver/pty/driver.js
 class PtyDriver {
   options;
   capabilities = { structured: false, resume: false, attach: false };
@@ -1331,12 +1331,12 @@ function tail(text, lines) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-// .dist-releases/1784888160293-2271563/src/driver/tmux/driver.js
+// .dist-releases/1784894032002-2676534/src/driver/tmux/driver.js
 import { mkdtemp, rm, writeFile as writeFile2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-// .dist-releases/1784888160293-2271563/src/driver/tmux/launch.js
+// .dist-releases/1784894032002-2676534/src/driver/tmux/launch.js
 var ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var PANE_BOOTSTRAP_COMMAND = 'tmux set-option -t "$TMUX_PANE" remain-on-exit on >/dev/null 2>&1 || true; tmux wait-for -S "$1"; shift; exec "$@"';
 function buildTmuxNewSessionArgs(input) {
@@ -1359,7 +1359,7 @@ function validateEnv(env) {
   }
 }
 
-// .dist-releases/1784888160293-2271563/src/driver/tmux/paste.js
+// .dist-releases/1784894032002-2676534/src/driver/tmux/paste.js
 function buildDispatchPlan(text, useTyping) {
   return {
     mode: useTyping ? "type-literal" : "paste-buffer",
@@ -1383,7 +1383,7 @@ function arraysEqual(left, right) {
   return left.length === right.length && left.every((item, index) => item === right[index]);
 }
 
-// .dist-releases/1784888160293-2271563/src/driver/tmux/liveness.js
+// .dist-releases/1784894032002-2676534/src/driver/tmux/liveness.js
 var SHELL_COMMANDS = new Set(["", "bash", "zsh", "sh", "fish", "pwsh", "powershell"]);
 function classifyTmuxLiveness(input) {
   if (!input.hasSession) {
@@ -1403,7 +1403,7 @@ function isTmuxProcessAlive(command, runningCommands) {
   return !SHELL_COMMANDS.has(command);
 }
 
-// .dist-releases/1784888160293-2271563/src/driver/tmux/runner.js
+// .dist-releases/1784894032002-2676534/src/driver/tmux/runner.js
 import { spawn as spawn2 } from "node:child_process";
 var DEFAULT_TIMEOUT_MS = 15000;
 
@@ -1528,7 +1528,7 @@ class TmuxClient {
   }
 }
 
-// .dist-releases/1784888160293-2271563/src/driver/tmux/driver.js
+// .dist-releases/1784894032002-2676534/src/driver/tmux/driver.js
 var ATTACHED_STOP_GRACE_MS = 1e4;
 var DEFAULT_STOP_TIMEOUT_MS = 15000;
 var DEFAULT_READY_TIMEOUT_MS = 90000;
@@ -1923,12 +1923,12 @@ function isMissingTmuxSessionError(error) {
 ${error.result.stderr}`.toLowerCase();
   return text.includes("can't find session") || text.includes("cannot find session") || text.includes("no such session") || text.includes("session not found");
 }
-// .dist-releases/1784888160293-2271563/src/relay/client.js
+// .dist-releases/1784894032002-2676534/src/relay/client.js
 import { Buffer as Buffer2 } from "node:buffer";
 import http from "node:http";
 import https from "node:https";
 
-// .dist-releases/1784888160293-2271563/src/relay/errors.js
+// .dist-releases/1784894032002-2676534/src/relay/errors.js
 class RelayError extends Error {
   method;
   path;
@@ -1965,7 +1965,7 @@ class RelayProtocolError extends RelayError {
   }
 }
 
-// .dist-releases/1784888160293-2271563/src/worker/protocol.js
+// .dist-releases/1784894032002-2676534/src/worker/protocol.js
 var DEFAULT_RELAY_URL = DEFAULT_PRODUCT_API_URL;
 var DEFAULT_WORKER = "host";
 var DEFAULT_WORKDIR = "~/sailorbridge-workdir";
@@ -1995,7 +1995,7 @@ function effectiveJobKind(kind, spec) {
   return kind === "stream" || spec.stream === true ? "stream" : kind;
 }
 
-// .dist-releases/1784888160293-2271563/src/relay/client.js
+// .dist-releases/1784894032002-2676534/src/relay/client.js
 var JSON_CONTENT_TYPE = "application/json";
 var MAX_MAILBOX_LIMIT = 16;
 var MAX_WAIT_TIMEOUT_SEC = 120;
@@ -4061,7 +4061,7 @@ function redact(value, token) {
 function bytesToBase64(bytes) {
   return Buffer2.from(bytes).toString("base64");
 }
-// .dist-releases/1784888160293-2271563/src/relay/config.js
+// .dist-releases/1784894032002-2676534/src/relay/config.js
 import { existsSync as existsSync2, readFileSync } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import path3 from "node:path";
@@ -4079,6 +4079,7 @@ function loadRelayConfig(env = process.env) {
   const captainId = optionalCaptainId(env.SAILORBRIDGE_CAPTAIN_ID) ?? stored?.captain_id;
   const hostId = nonEmpty(env.SAILORBRIDGE_HOST_ID) ?? stored?.host_id;
   const hostDisplayName = nonEmpty(env.SAILORBRIDGE_HOST_DISPLAY_NAME);
+  const keyScope = !envBearerToken && stored ? "host" : undefined;
   return {
     relayUrl,
     bearerToken,
@@ -4086,7 +4087,8 @@ function loadRelayConfig(env = process.env) {
     ...session ? { session } : {},
     ...captainId ? { captainId } : {},
     ...hostId ? { hostId } : {},
-    ...hostDisplayName ? { hostDisplayName } : {}
+    ...hostDisplayName ? { hostDisplayName } : {},
+    ...keyScope ? { keyScope } : {}
   };
 }
 function loadStoredHostCredential(env, options = {}) {
@@ -4136,7 +4138,7 @@ function storedCaptainId(value) {
   }
   return;
 }
-// .dist-releases/1784888160293-2271563/src/supervisor/retirement.js
+// .dist-releases/1784894032002-2676534/src/supervisor/retirement.js
 var DEFAULT_THRESHOLD = 3;
 var DEFAULT_WINDOW_MS = 30000;
 var DEFAULT_COOLDOWN_MS = 1000;
@@ -4211,7 +4213,7 @@ function isAuthoritativeRetirementReason(reason) {
   return reason === "monitor_fetch" || reason === "agent_session_patch";
 }
 
-// .dist-releases/1784888160293-2271563/src/supervisor/wait.js
+// .dist-releases/1784894032002-2676534/src/supervisor/wait.js
 async function waitForWakeableTimeout(ms, setWake, sleep3) {
   if (sleep3) {
     await Promise.race([
@@ -4242,7 +4244,7 @@ async function waitForWakeableTimeout(ms, setWake, sleep3) {
   setWake(null);
 }
 
-// .dist-releases/1784888160293-2271563/src/supervisor/mailbox.js
+// .dist-releases/1784894032002-2676534/src/supervisor/mailbox.js
 var CLEAR_TAG = "CLEAR";
 var REFRESH_TAG = "WORKFLOW-REFRESH";
 var SYNC_TAG = "SYNC";
@@ -4425,7 +4427,7 @@ class MailboxSupervisor {
     if (this.stopped && !deliver)
       return 0;
     try {
-      await this.deliverRefreshCue();
+      await this.deliverRefreshCue(refreshNotices(pending));
     } catch (error) {
       await this.recordSurfaceBatch(pending, { status: "failed", error: this.redact(errorMessage2(error)) });
       return 0;
@@ -4437,8 +4439,8 @@ class MailboxSupervisor {
     await this.claimDeliveredControls(messages);
     return pending.length;
   }
-  async deliverRefreshCue() {
-    const text = refreshCue(this.options.cli);
+  async deliverRefreshCue(notices = []) {
+    const text = refreshCue(this.options.cli, notices);
     await this.options.driver.send(text, { verifyText: REFRESH_TAG });
   }
   async handleSyncMessages(messages, deliver = false) {
@@ -4722,7 +4724,7 @@ function formatWorkDoorbell(input, toDisplay) {
     throw new Error("cannot format an empty work doorbell");
   const sender = message.sender_agent_name ?? message.sender_role ?? "unknown";
   const tag = canonicalDoorbellTag(tagOf(message));
-  return `[${sender}->${toDisplay}] ${tag} ${doorbellToken(message.id)} \uD83D\uDCEC ${messages.length} new message(s). Read and claim: sail mailbox claim; complete obligation tags; direct workflows use the returned lease token.`;
+  return `[${sender}->${toDisplay}] ${tag} ${doorbellToken(message.id)} \uD83D\uDCEC ${messages.length} new message(s). Read: sail mailbox claim. Conversational tags: answer with one sail reply — no ack owed. Obligation tags: complete them; their claim output prints the ack line.`;
 }
 function canonicalDoorbellTag(tag) {
   const printable = Array.from(tag, (char) => char >= " " && char <= "~" ? char : " ").join("");
@@ -4735,10 +4737,27 @@ function unsurfaced(messages) {
 function doorbellToken(messageId) {
   return `#${messageId}#`;
 }
-function refreshCue(_cli) {
-  return `${REFRESH_TAG}
+function refreshCue(_cli, notices = []) {
+  return [
+    REFRESH_TAG,
+    ...notices,
+    "Run `sail refresh` now to reload your role and instructions, then continue."
+  ].join(`
 
-Run \`sail refresh\` now to reload your role and instructions, then continue.`;
+`);
+}
+function refreshNotices(messages) {
+  const notices = [];
+  for (const message of messages) {
+    const payload = message.payload_json;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload))
+      continue;
+    const notice = payload.notice;
+    if (typeof notice === "string" && notice.trim() && !notices.includes(notice.trim())) {
+      notices.push(notice.trim());
+    }
+  }
+  return notices;
 }
 function saveContextCue(agentName, checkpointId) {
   return [
@@ -4780,19 +4799,19 @@ function ordinaryDeliveryAttempt(error) {
 function _isMissingModerator(error) {
   return error instanceof RelayHttpError && error.status === 400 && error.body.includes("no agents match");
 }
-// .dist-releases/1784888160293-2271563/src/supervisor/runtime.js
+// .dist-releases/1784894032002-2676534/src/supervisor/runtime.js
 import path9 from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
-// .dist-releases/1784888160293-2271563/src/host/managed-materialization.js
+// .dist-releases/1784894032002-2676534/src/host/managed-materialization.js
 import { createHash as createHash2, randomBytes } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { lstat, mkdir as mkdir3, open, readdir, rename, rm as rm2 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import path5 from "node:path";
 
-// .dist-releases/1784888160293-2271563/src/host/memory-stub.js
+// .dist-releases/1784894032002-2676534/src/host/memory-stub.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import path4 from "node:path";
@@ -4939,7 +4958,7 @@ function _safePathLabel(value, field) {
   return trimmed;
 }
 
-// .dist-releases/1784888160293-2271563/src/host/managed-materialization.js
+// .dist-releases/1784894032002-2676534/src/host/managed-materialization.js
 var MANIFEST_FILE = ".sailorbridge-managed-manifest.json";
 var BANNER_PREFIX = "# SailorBridge managed file";
 var HASH_RE = /^sha256:[a-f0-9]{64}$/u;
@@ -5465,7 +5484,7 @@ function _expandHome2(value) {
   return value;
 }
 
-// .dist-releases/1784888160293-2271563/src/host/credential-guardian.js
+// .dist-releases/1784894032002-2676534/src/host/credential-guardian.js
 import { lstat as lstat2, readFile as readFile3, rename as rename2, symlink, unlink, writeFile as writeFile4 } from "node:fs/promises";
 import path6 from "node:path";
 var DEFAULT_CREDENTIAL_SWEEP_INTERVAL_MS = 60000;
@@ -5611,7 +5630,7 @@ function _tmpSibling(filePath) {
   return path6.join(path6.dirname(filePath), `.${path6.basename(filePath)}.sb-guardian.${process.pid}.${tmpSequence}.tmp`);
 }
 
-// .dist-releases/1784888160293-2271563/src/supervisor/resolve.js
+// .dist-releases/1784894032002-2676534/src/supervisor/resolve.js
 var DEFAULT_CAPTURE_LINES = 200;
 var MAX_CAPTURE_LINES = 1000;
 
@@ -5817,7 +5836,7 @@ function defaultSleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-// .dist-releases/1784888160293-2271563/src/supervisor/transcript-backfill.js
+// .dist-releases/1784894032002-2676534/src/supervisor/transcript-backfill.js
 import { createHash as createHash3 } from "node:crypto";
 import {
   closeSync,
@@ -6486,7 +6505,7 @@ function errorMessage4(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
-// .dist-releases/1784888160293-2271563/src/supervisor/usage-collector.js
+// .dist-releases/1784894032002-2676534/src/supervisor/usage-collector.js
 import { statSync as statSync2 } from "node:fs";
 import path8 from "node:path";
 var SUPPORTED_USAGE_ENGINES = new Set(["claude", "codex"]);
@@ -6895,7 +6914,7 @@ function sourceUnreadableReason(source) {
   }
 }
 
-// .dist-releases/1784888160293-2271563/src/supervisor/runtime.js
+// .dist-releases/1784894032002-2676534/src/supervisor/runtime.js
 var RESOLVE_CAPTURE_LINES = 200;
 var SHORT_LIVED_EXIT_MS = 5000;
 var STARTUP_OBSERVATION_MS = 1e4;
@@ -7565,7 +7584,7 @@ function errorMessage5(error) {
 function formatRestartCommand(command) {
   return command.map((part) => /^[A-Za-z0-9_./:=@%+-]+$/.test(part) ? part : `'${part.replaceAll("'", "'\\''")}'`).join(" ");
 }
-// .dist-releases/1784888160293-2271563/src/supervisor/transport.js
+// .dist-releases/1784894032002-2676534/src/supervisor/transport.js
 var SUPPORTED_PHASE1_CLI_KINDS = ["claude", "codex"];
 var PHASE1_ENGINE_GATE_MESSAGE = "Only claude and codex engines are available in this release; opencode and custom CLI engines will open in the next release.";
 var PHASE1_TRANSPORT_GATE_MESSAGE = "Only tmux transport is available in this release; sdk, headless, and pty transports will open in the next release.";
@@ -7773,7 +7792,7 @@ function hasCodexSafetyDriverOptions(options) {
   return options?.codex?.sandboxMode !== undefined || options?.codex?.approvalPolicy !== undefined || options?.codex?.yolo !== undefined;
 }
 
-// .dist-releases/1784888160293-2271563/src/supervisor/cli-options.js
+// .dist-releases/1784894032002-2676534/src/supervisor/cli-options.js
 function parseSuperviseArgs(argv) {
   const split = argv.indexOf("--");
   const flagArgs = split >= 0 ? argv.slice(0, split) : argv;
@@ -7925,7 +7944,7 @@ function optionalBoolean(value, label) {
     return false;
   throw new Error(`${label} must be true or false`);
 }
-// .dist-releases/1784888160293-2271563/src/supervisor/tmux-availability.js
+// .dist-releases/1784894032002-2676534/src/supervisor/tmux-availability.js
 import { spawn as spawn3 } from "node:child_process";
 import { createInterface } from "node:readline";
 function isTmuxAvailable(spawnFn = spawn3) {
@@ -8042,7 +8061,7 @@ function _tmuxMissingMessage(platform2) {
   const how = platform2 === "darwin" ? "brew install tmux" : platform2 === "linux" ? "install tmux via your package manager (e.g. sudo apt-get install -y tmux)" : "install tmux";
   return `tmux is required in this release but was not found. Install tmux (${how}) and re-run.`;
 }
-// .dist-releases/1784888160293-2271563/src/output-format.js
+// .dist-releases/1784894032002-2676534/src/output-format.js
 function parseOutputArgs(argv) {
   const separator = argv.indexOf("--");
   const localArgv = separator < 0 ? argv : argv.slice(0, separator);
@@ -8135,7 +8154,7 @@ ${normalized.split(`
 `)}`;
 }
 
-// .dist-releases/1784888160293-2271563/src/plain-output-fields.js
+// .dist-releases/1784894032002-2676534/src/plain-output-fields.js
 var PREVIEW_LIMIT = 20;
 var UNSAFE_DISPLAY_CODE_POINT = /[\u007f-\u009f\u2028-\u202e\u2066-\u2069]/gu;
 function renderTaskPlain(command, value) {
@@ -8543,7 +8562,7 @@ function _omissionLine(total) {
   return total > PREVIEW_LIMIT ? `Omitted ${total - PREVIEW_LIMIT}; rerun with --format json for the complete response.` : undefined;
 }
 
-// .dist-releases/1784888160293-2271563/src/host/cli.js
+// .dist-releases/1784894032002-2676534/src/host/cli.js
 var HOST_RELAY_SUBCOMMANDS = new Set(["consume", "heartbeat", "list", "register"]);
 async function runHostCommandFromCli(client, argv, config, io) {
   const sub = argv[0] ?? "list";
@@ -8781,7 +8800,7 @@ function optionalDisplayName(value) {
   const trimmed = value?.trim();
   return trimmed || undefined;
 }
-// .dist-releases/1784888160293-2271563/src/host/service.js
+// .dist-releases/1784894032002-2676534/src/host/service.js
 import { execFile as execFileCb } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
@@ -9302,7 +9321,7 @@ function writeServiceLog(io, event, fields) {
   io.stderr.write(`${JSON.stringify({ ts: new Date().toISOString(), event, ...fields ?? {} })}
 `);
 }
-// .dist-releases/1784888160293-2271563/src/host/git-remote.js
+// .dist-releases/1784894032002-2676534/src/host/git-remote.js
 var GIT_SECRET_PATH_MARKERS = [
   "token",
   "credential",
@@ -9394,7 +9413,7 @@ function looksLikeCredential(segment2) {
   return value.length >= 32 && /^[A-Za-z0-9_-]+$/u.test(value);
 }
 
-// .dist-releases/1784888160293-2271563/src/host/start-spec.js
+// .dist-releases/1784894032002-2676534/src/host/start-spec.js
 var TRANSPORTS = ["auto", "sdk", "pty", "tmux", "headless"];
 var SUPPORTED_PHASE1_ENGINES = ["claude", "codex"];
 var ENGINE_PATTERN = /^[a-z][a-z0-9._-]{0,63}$/u;
@@ -9644,7 +9663,7 @@ function _trimmed(value, label) {
     throw new Error(`${label} must not be empty`);
   return trimmed;
 }
-// .dist-releases/1784888160293-2271563/src/host/workspace.js
+// .dist-releases/1784894032002-2676534/src/host/workspace.js
 import { spawn as spawn4 } from "node:child_process";
 import { existsSync as existsSync4 } from "node:fs";
 import { mkdir as mkdir5, readdir as readdir2, rename as rename4, stat } from "node:fs/promises";
@@ -9875,7 +9894,7 @@ function _safeSegment(value) {
     throw new Error("workspace path segment is empty after sanitizing");
   return segment2;
 }
-// .dist-releases/1784888160293-2271563/src/host/workspace-inventory.js
+// .dist-releases/1784894032002-2676534/src/host/workspace-inventory.js
 import { access as access2 } from "node:fs/promises";
 import { constants } from "node:fs";
 import { execFile as execFile2 } from "node:child_process";
@@ -9967,7 +9986,7 @@ async function canAccess(path12, mode, deps) {
     return false;
   }
 }
-// .dist-releases/1784888160293-2271563/src/upgrade.js
+// .dist-releases/1784894032002-2676534/src/upgrade.js
 import { spawn as spawn5 } from "node:child_process";
 import { execFile as execFileCb2 } from "node:child_process";
 import { readFile as readFile5 } from "node:fs/promises";
@@ -10025,7 +10044,7 @@ function _writeUpgradeResult(output, before, after, service) {
 `);
 }
 
-// .dist-releases/1784888160293-2271563/src/host/auto-update.js
+// .dist-releases/1784894032002-2676534/src/host/auto-update.js
 var AUTO_UPDATE_HARD_DEADLINE_MS = 24 * 60 * 60 * 1000;
 var AUTO_UPDATE_ATTEMPT_COOLDOWN_MS = 60 * 1000;
 var MAX_UPDATE_ERROR_LENGTH = 500;
@@ -10121,7 +10140,7 @@ function _releaseTuple(value) {
     return null;
   return [Number(match[1]), Number(match[2]), Number(match[3])];
 }
-// .dist-releases/1784888160293-2271563/src/host/host-config.js
+// .dist-releases/1784894032002-2676534/src/host/host-config.js
 import { chmod as chmod3, mkdir as mkdir6, readFile as readFile6, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
 import path13 from "node:path";
@@ -10213,7 +10232,7 @@ function _parseHostConfig(text, configPath) {
     ...record.auto_update === undefined ? {} : { auto_update: record.auto_update }
   };
 }
-// .dist-releases/1784888160293-2271563/src/host/host-workspace-cli.js
+// .dist-releases/1784894032002-2676534/src/host/host-workspace-cli.js
 async function runHostWorkspaceCommandFromCli(argv, io, deps = {}) {
   const configPath = deps.configPath ?? defaultHostConfigPath();
   const sub = argv[0] ?? "list";
@@ -10257,7 +10276,7 @@ function _renderAddPlain(result) {
   return result.note ? `${status} ${result.path}
 ${result.note}` : `${status} ${result.path}`;
 }
-// .dist-releases/1784888160293-2271563/src/host/agent-env.js
+// .dist-releases/1784894032002-2676534/src/host/agent-env.js
 var RUNTIME_NATIVE_HOME_ENV = new Set(["CLAUDE_CONFIG_DIR", "CODEX_HOME"]);
 function buildAgentEnv(options) {
   const env = {};
@@ -10286,15 +10305,15 @@ function buildAgentEnv(options) {
   }
   return env;
 }
-// .dist-releases/1784888160293-2271563/src/host/runtime-env.js
+// .dist-releases/1784894032002-2676534/src/host/runtime-env.js
 import path17 from "node:path";
 
-// .dist-releases/1784888160293-2271563/src/host/agent-defaults.js
+// .dist-releases/1784894032002-2676534/src/host/agent-defaults.js
 import { chmod as chmod4, mkdir as mkdir7, readFile as readFile8, stat as stat2, writeFile as writeFile7 } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
 import path15 from "node:path";
 
-// .dist-releases/1784888160293-2271563/src/host/claude-settings.js
+// .dist-releases/1784894032002-2676534/src/host/claude-settings.js
 import { readFile as readFile7 } from "node:fs/promises";
 import path14 from "node:path";
 async function readHostClaudeSettings(claudeConfigDir) {
@@ -10335,7 +10354,7 @@ function _nonEmptyString(value) {
   return typeof value === "string" && value.trim() ? value : null;
 }
 
-// .dist-releases/1784888160293-2271563/src/host/agent-defaults.js
+// .dist-releases/1784894032002-2676534/src/host/agent-defaults.js
 var CODEX_BLOCK_BEGIN = "# sailorbridge-terse-defaults:begin";
 var CODEX_BLOCK_END = "# sailorbridge-terse-defaults:end";
 var CODEX_MODEL_BLOCK_BEGIN = "# sailorbridge-host-model-settings:begin";
@@ -11465,7 +11484,7 @@ function _escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 }
 
-// .dist-releases/1784888160293-2271563/src/host/engine-auth.js
+// .dist-releases/1784894032002-2676534/src/host/engine-auth.js
 import { lstat as lstat4, mkdir as mkdir8, readlink, realpath, stat as stat3, symlink as symlink2, unlink as unlink2 } from "node:fs/promises";
 import { homedir as homedir12 } from "node:os";
 import path16 from "node:path";
@@ -11555,7 +11574,7 @@ async function _ensureSymlink(linkPath, targetPath, sharedTargetPath) {
   await symlink2(targetPath, linkPath);
 }
 
-// .dist-releases/1784888160293-2271563/src/host/runtime-env.js
+// .dist-releases/1784894032002-2676534/src/host/runtime-env.js
 async function materializeAgentRuntimeEnv(options) {
   const env = buildAgentEnv({
     hostEnv: options.hostEnv,
@@ -11595,7 +11614,7 @@ function _ensureRootSandboxEscape(env, engine, uid) {
 function _currentUid() {
   return typeof process.getuid === "function" ? process.getuid() : null;
 }
-// .dist-releases/1784888160293-2271563/src/host/context-statusline.js
+// .dist-releases/1784894032002-2676534/src/host/context-statusline.js
 function renderClaudeContextStatusLine(payload) {
   const percent = _usedPercentage(payload);
   if (percent === null)
@@ -11633,7 +11652,7 @@ function _bar(percent) {
   const filled = Math.min(10, Math.max(0, Math.trunc(percent / 10)));
   return "█".repeat(filled) + "░".repeat(10 - filled);
 }
-// .dist-releases/1784888160293-2271563/src/host/scratch-sweeper.js
+// .dist-releases/1784894032002-2676534/src/host/scratch-sweeper.js
 import { execFile as execFile3 } from "node:child_process";
 import { lstat as lstat5, readdir as readdir3, realpath as realpath2, unlink as unlink3 } from "node:fs/promises";
 import path18 from "node:path";
@@ -11776,7 +11795,7 @@ function _errno(error) {
     return String(error.code);
   return error instanceof Error ? error.message : String(error);
 }
-// .dist-releases/1784888160293-2271563/src/host/launcher.js
+// .dist-releases/1784894032002-2676534/src/host/launcher.js
 var MAX_TMUX_SESSION_SUFFIX = 100;
 async function launchSupervisedAgent(input, deps = {}) {
   const spec = parseAgentStartSpec(input.spec);
@@ -11927,7 +11946,7 @@ async function _tmuxSessionExists(session) {
     throw error;
   }
 }
-// .dist-releases/1784888160293-2271563/src/worker/capability.js
+// .dist-releases/1784894032002-2676534/src/worker/capability.js
 import { accessSync, constants as constants2, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
 import os from "node:os";
 import path19 from "node:path";
@@ -12070,7 +12089,7 @@ function commandPath(command) {
   return null;
 }
 
-// .dist-releases/1784888160293-2271563/src/host/worker-start-spec.js
+// .dist-releases/1784894032002-2676534/src/host/worker-start-spec.js
 var MAX_TAGS = 32;
 var TAG_PATTERN = /^[a-z0-9][a-z0-9=._:/-]{0,63}$/iu;
 var RESERVED_TAG_KEYS = new Set(["os", "kernel", "arch", "gpu", "mode", "role", "tool"]);
@@ -12130,16 +12149,16 @@ function _trimmed2(value, label) {
   return trimmed;
 }
 
-// .dist-releases/1784888160293-2271563/src/host/worker-launcher.js
+// .dist-releases/1784894032002-2676534/src/host/worker-launcher.js
 import { statSync as statSync3 } from "node:fs";
 import os4 from "node:os";
 import path22 from "node:path";
-// .dist-releases/1784888160293-2271563/src/worker/client.js
+// .dist-releases/1784894032002-2676534/src/worker/client.js
 import { readFileSync as readFileSync5 } from "node:fs";
 import os3 from "node:os";
 import path21 from "node:path";
 
-// .dist-releases/1784888160293-2271563/src/worker/errors.js
+// .dist-releases/1784894032002-2676534/src/worker/errors.js
 class LeaseFencingRejected extends Error {
   status;
   constructor(status, message) {
@@ -12203,7 +12222,7 @@ function countsTowardWorkerSessionRebuild(path20) {
   return true;
 }
 
-// .dist-releases/1784888160293-2271563/src/worker/executor.js
+// .dist-releases/1784894032002-2676534/src/worker/executor.js
 import { spawn as spawn6 } from "node:child_process";
 import { mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync2, readFileSync as readFileSync4, realpathSync, rmSync as rmSync2, statfsSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir as tmpdir2, loadavg } from "node:os";
@@ -12211,7 +12230,7 @@ import os2 from "node:os";
 import path20 from "node:path";
 import { TextDecoder } from "node:util";
 
-// .dist-releases/1784888160293-2271563/src/worker/async-queue.js
+// .dist-releases/1784894032002-2676534/src/worker/async-queue.js
 class AsyncByteQueue {
   maxSize;
   values = [];
@@ -12271,7 +12290,7 @@ class AsyncByteQueue {
   }
 }
 
-// .dist-releases/1784888160293-2271563/src/worker/http.js
+// .dist-releases/1784894032002-2676534/src/worker/http.js
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { URLSearchParams as URLSearchParams2 } from "node:url";
@@ -12465,7 +12484,7 @@ function pathOnly(path20) {
   return path20.split("?", 1)[0] || path20;
 }
 
-// .dist-releases/1784888160293-2271563/src/worker/stream-upload.js
+// .dist-releases/1784894032002-2676534/src/worker/stream-upload.js
 async function uploadStream(session, jobId, stream, leaseToken, chunks, workerId) {
   if (!leaseToken.trim())
     throw new Error("lease_token is required");
@@ -12475,7 +12494,7 @@ async function uploadStream(session, jobId, stream, leaseToken, chunks, workerId
   await session.http.postBytes(`/api/v1/jobs/${encodeURIComponent(jobId)}/stream-upload?${query.toString()}`, chunks, { "X-Lease-Token": leaseToken }, UPLOAD_TIMEOUTS);
 }
 
-// .dist-releases/1784888160293-2271563/src/worker/executor.js
+// .dist-releases/1784894032002-2676534/src/worker/executor.js
 class StreamingProcessFailure extends Error {
   exitCode;
   stdout;
@@ -13007,7 +13026,7 @@ function errorMessage6(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
-// .dist-releases/1784888160293-2271563/src/worker/client.js
+// .dist-releases/1784894032002-2676534/src/worker/client.js
 var TOKEN_FILES = [
   "~/.config/sailorbridge/token",
   "/etc/sailorbridge/token"
@@ -13404,7 +13423,7 @@ function errorName2(error) {
 function errorMessage7(error) {
   return error instanceof Error ? error.message : String(error);
 }
-// .dist-releases/1784888160293-2271563/src/host/worker-launcher.js
+// .dist-releases/1784894032002-2676534/src/host/worker-launcher.js
 var DEFAULT_WORKER_READY_TIMEOUT_MS = 60000;
 async function launchSupervisedWorker(input, deps = {}) {
   const logger = input.logger ?? (() => {});
@@ -13501,7 +13520,7 @@ function _assertWorkdir(workdir) {
   return workdir;
 }
 
-// .dist-releases/1784888160293-2271563/src/host/daemon.js
+// .dist-releases/1784894032002-2676534/src/host/daemon.js
 async function runHostDaemon(options) {
   const logger = options.logger ?? (() => {});
   const sleep3 = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
@@ -13865,7 +13884,7 @@ async function _drainOnce(options, identity, starter, logger, redactSecrets, aut
     return false;
   }
 }
-// .dist-releases/1784888160293-2271563/src/host/enrollment-redeem.js
+// .dist-releases/1784894032002-2676534/src/host/enrollment-redeem.js
 var DEFAULT_NOT_FOUND_RETRIES = 3;
 var NOT_FOUND_RETRY_DELAY_MS = 500;
 function createEnrollmentRedeemer(options) {
@@ -14002,7 +14021,7 @@ function _role2(enrollment) {
   }
   return _string4(enrollment.roles[0], "roles[0]").trim();
 }
-// .dist-releases/1784888160293-2271563/src/host/tutorial.js
+// .dist-releases/1784894032002-2676534/src/host/tutorial.js
 function buildTutorialSteps(state) {
   const paired = state.hasCredential;
   return [
@@ -14073,7 +14092,7 @@ async function runTutorial(options) {
   }
   return steps;
 }
-// .dist-releases/1784888160293-2271563/src/events.js
+// .dist-releases/1784894032002-2676534/src/events.js
 var EVENT_COMMANDS = new Set(["add", "list", "enable", "disable", "rm"]);
 var EVENT_FLAGS = new Set(["at", "days", "message", "run-date", "session", "tag", "tz"]);
 var PRODUCT_DAYS_MODES = new Set(["once", "daily", "weekday"]);
@@ -14163,7 +14182,7 @@ function _assertListArgs(args) {
   }
 }
 
-// .dist-releases/1784888160293-2271563/src/text-input.js
+// .dist-releases/1784894032002-2676534/src/text-input.js
 import { readFile as readFile9 } from "node:fs/promises";
 var _readUtf8File = async (file) => await readFile9(file, "utf8");
 async function readTextInput(input) {
@@ -14207,7 +14226,7 @@ async function readTextFileOrStdin(path23, input, unusedInputMessage, readUtf8Fi
   return await readTextFile(path23, readUtf8File2);
 }
 
-// .dist-releases/1784888160293-2271563/src/ask.js
+// .dist-releases/1784894032002-2676534/src/ask.js
 var ASK_FLAGS = new Set(["body-file", "option", "reason", "recommend", "session", "title"]);
 async function runAskFromCli(client2, argv, config, input) {
   const args = _parseAskArgs(argv);
@@ -14322,7 +14341,7 @@ function _singleAskValue(values, name) {
   return entries[0];
 }
 
-// .dist-releases/1784888160293-2271563/src/task.js
+// .dist-releases/1784894032002-2676534/src/task.js
 import { readFile as readFile10 } from "node:fs/promises";
 import { basename } from "node:path";
 var TASK_FLAGS = new Set(["after", "all", "artifact-id", "before", "body-file", "commit", "depends", "description", "description-file", "draft", "findings", "image", "level", "limit", "owner-of-resume", "pair", "priority", "query", "reason", "resume-condition", "resume-dependency", "session", "status", "type", "version"]);
@@ -14812,7 +14831,7 @@ function _taskListFooter(shown, returned, total, hasMore, cursor) {
   return `Shown ${shown} of ${total}${local}${next}`;
 }
 
-// .dist-releases/1784888160293-2271563/src/team.js
+// .dist-releases/1784894032002-2676534/src/team.js
 var TEAM_BOOTSTRAP_ENGINES = new Set(["claude", "codex"]);
 var SLOT_SPEC_RE = /^([^=\s]+)=([^:@\s]+):([^:@\s]+)$/;
 var TEAM_PLAIN_LIMIT = 20;
@@ -14967,7 +14986,7 @@ function _slotTable(slots) {
 Shown ${shown.length} of ${slots.length}${omitted ? `; ${omitted} omitted (use --format json)` : ""}`;
 }
 
-// .dist-releases/1784888160293-2271563/src/memory.js
+// .dist-releases/1784894032002-2676534/src/memory.js
 var VALUE_FLAGS = new Set(["file", "source"]);
 var MEMORY_SEARCH_PLAIN_LIMIT = 20;
 async function runMemoryFromCli(client2, argv, config, input, format) {
@@ -15102,7 +15121,7 @@ function _summary(value) {
   return value.replace(/\s+/gu, " ").trim().slice(0, 180);
 }
 
-// .dist-releases/1784888160293-2271563/src/mailbox-send.js
+// .dist-releases/1784894032002-2676534/src/mailbox-send.js
 var SEND_FLAGS = new Set(["body-file", "commit", "session", "tag", "task-id", "task-version", "to-agents", "to-roles", "to-host"]);
 function parseMailboxSendArgs(argv) {
   const parsed = argsFromValues(parseFlagValues(argv));
@@ -15201,7 +15220,7 @@ function splitList(value) {
   return list?.length ? list : undefined;
 }
 
-// .dist-releases/1784888160293-2271563/src/reply.js
+// .dist-releases/1784894032002-2676534/src/reply.js
 var REPLY_FLAGS = new Set(["agent", "body-file", "in-reply-to", "session"]);
 async function sendReplyFromCli(client2, argv, config, io) {
   const args = _parseReplyArgs(argv);
@@ -15258,12 +15277,13 @@ function _requiredReplyValue(values, name) {
   return value;
 }
 
-// .dist-releases/1784888160293-2271563/src/worker-command.js
+// .dist-releases/1784894032002-2676534/src/worker-command.js
 async function runWorkerCommandFromCli(client2, argv, config, io, format = "plain") {
+  const command = argv[0];
+  _requireWorkerCredential(config.keyScope, command);
   const captainId = config.captainId;
   if (!captainId)
     throw new Error("SAILORBRIDGE_CAPTAIN_ID is required for worker commands");
-  const command = argv[0];
   switch (command) {
     case "list":
       return _listWorkers(client2, captainId, _requireSession(config.session), argv.slice(1), io, format);
@@ -15275,6 +15295,14 @@ async function runWorkerCommandFromCli(client2, argv, config, io, format = "plai
       throw new Error("worker command must be job, list, run, or serve");
   }
 }
+function _requireWorkerCredential(keyScope, command) {
+  if (keyScope !== "host")
+    return;
+  if (command === "list") {
+    throw new Error("worker list cannot use a paired host credential. " + "Open this team's Workers page in the SailorBridge console.");
+  }
+  throw new Error("worker run/job requires a member-runtime credential; this command loaded a paired host credential. " + "Retry from a member workspace where SAILORBRIDGE_TOKEN is already set.");
+}
 function _requireSession(session) {
   if (!session)
     throw new Error("SAILORBRIDGE_SESSION is required for worker list and run");
@@ -15439,7 +15467,7 @@ function _writeSignalStatus(remoteCode, localStatus, remoteStderr, io) {
 `);
 }
 
-// .dist-releases/1784888160293-2271563/src/create.js
+// .dist-releases/1784894032002-2676534/src/create.js
 var CREATE_ENGINES = new Set(["claude", "codex"]);
 var DEFAULT_ENGINE = "claude";
 var WORKSPACE_PLAIN_LIMIT = 20;
@@ -15829,7 +15857,7 @@ function _workerPlain(hostId, workdir, result) {
 `);
 }
 
-// .dist-releases/1784888160293-2271563/src/cli.js
+// .dist-releases/1784894032002-2676534/src/cli.js
 var FORMATTED_COMMANDS = new Set([
   "ask",
   "create",
@@ -16509,7 +16537,7 @@ function _usageText() {
   sailorbridge event add --at HH:MM --tz IANA --days once|daily|weekday --message TEXT [--run-date YYYY-MM-DD] [--tag T] [--disabled] [--session S]
   sailorbridge event list [--session S]
   sailorbridge event enable|disable|rm EVENT_ID [--session S]
-  sailorbridge ask --title TITLE --option LABEL::DESCRIPTION --option LABEL::DESCRIPTION --recommend A --reason TEXT [--reason TEXT] [--body-file PATH|-] [--session S]
+  sailorbridge ask --title TITLE --option LABEL::DESCRIPTION --option LABEL::DESCRIPTION --recommend A --reason TEXT [--reason TEXT] --body-file - [--session S]
   sailorbridge ask list [--session S]
   sailorbridge ask get|status DECISION_ID [--session S]
   sailorbridge task create [--description TEXT|-|--body-file PATH|-|--description-file PATH|-] [--pair PAIR] [--draft|--status draft|new] [--type feature|bug|docs|chore] [--priority high|normal|low] [--level d1|d2|d3|d4] [--depends TASK[,TASK]] [--artifact-id ID] [--image PATH] [--session S]
@@ -16599,5 +16627,5 @@ function _looksLikeNetworkFailure(message) {
   return /fetch failed|network|ECONN(?:REFUSED|RESET)|ENOTFOUND|ETIMEDOUT/iu.test(message);
 }
 
-//# debugId=56B72B0801B5CDF264756E2164756E21
+//# debugId=F9747B92FC45FFDB64756E2164756E21
 //# sourceMappingURL=cli.js.map