@scp-dev/cli 0.7.0 → 0.8.0

package/dist/{chunk-3SOIVANO.js → chunk-6S3V5ZGU.js}

@@ -431,6 +431,7 @@ function relayIdentity(input) {
     process: harnessProcess,
     labels: labelsFor(input.env),
     ...input.env.SCP_PARENT ? { parent: input.env.SCP_PARENT } : {},
+    ...input.env.SCP_UNDER ? { under: input.env.SCP_UNDER } : {},
     ...keys.length ? { lineage: keys } : {},
     ...grant ? { grant } : {},
     ...harnessSession ? { harness_session: harnessSession } : {}
@@ -510,7 +511,14 @@ var OPTIONS = {
   endpoint: { type: "string" },
   "take-over": { type: "boolean" },
   live: { type: "boolean" },
-  parent: { type: "string" }
+  parent: { type: "string" },
+  via: { type: "string" },
+  wake: { type: "string" },
+  eta: { type: "string" },
+  ref: { type: "string" },
+  gone: { type: "boolean" },
+  "secret-env": { type: "string" },
+  clear: { type: "boolean" }
 };
 var SPAWN_OPTIONS = [
   "as",
@@ -531,7 +539,8 @@ var SPAWN_OPTIONS = [
   "handback-bytes",
   "no-push",
   "bg",
-  "fg"
+  "fg",
+  "via"
 ];
 var OBSERVE = /* @__PURE__ */ new Set([
   "list",
@@ -634,7 +643,7 @@ async function open(verb, values, cwd, bodyFromStdin, walk) {
         `${CLI_NAME2} ${verb} needs an identity: --as HANDLE (or $SCP_NAME) for an agent, or --human for your own inbox me/ (no terminal is attached, so me/ is not assumed)`
       );
     }
-    const { machineName, openCloud } = await import("./remote-YO5B2HQI.js");
+    const { machineName, openCloud } = await import("./remote-VRVONVET.js");
     const handle2 = named ? localHandle(named) : void 0;
     const claim = handle2 ? {
       handle: handle2,
@@ -677,6 +686,7 @@ async function open(verb, values, cwd, bodyFromStdin, walk) {
           harness: claimHarness(values, process.env, here),
           cwd,
           ...process.env.SCP_PARENT ? { parent: process.env.SCP_PARENT } : {},
+          ...process.env.SCP_UNDER ? { under: process.env.SCP_UNDER } : {},
           labels: labelsFor(process.env),
           ...lineageClaim,
           ...grant ? { grant } : {}
@@ -892,7 +902,7 @@ function relayVerb(positionals, asJson, env = process.env) {
 }
 async function loginMain(positionals, values) {
   if (positionals.length) throw new RelayUsage(`${CLI_NAME3} login takes only flags`);
-  return (await import("./login-DCNCC3RS.js")).login(values);
+  return (await import("./login-22BLC7KI.js")).login(values);
 }
 function logoutMain(positionals, asJson, env = process.env) {
   if (positionals.length) throw new RelayUsage(`${CLI_NAME3} logout takes no arguments`);
@@ -914,6 +924,8 @@ export {
   hookHarness,
   gitToplevel,
   deriveHandle,
+  parseLabels,
+  labelsFor,
   processKey,
   sessionKey,
   psStart,

package/dist/{chunk-SNW53KT3.js → chunk-77NUOWQ4.js}

@@ -1,6 +1,6 @@
 import {
   hooksTarget
-} from "./chunk-LRQP25RI.js";
+} from "./chunk-MHBWDAXO.js";
 import {
   AGY_HOOK_SET,
   BLOCK_STOP,
@@ -12,12 +12,12 @@ import {
   mergeHooks,
   musePlugin,
   opencodePlugin
-} from "./chunk-277BAY7J.js";
+} from "./chunk-UUFTEXDU.js";
 import {
   RelayUsage,
   gitToplevel,
   setJoinMode
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 
 // src/setup.ts
 import { spawnSync } from "child_process";

package/dist/{chunk-KN7WEIE4.js → chunk-FPNFRDXG.js}

@@ -16,6 +16,7 @@ var SPAWN_HELP = `${CLI_NAME} spawn [flags] [--] <harness cmd...>: run a worker
   --peek local          peekable from its start
   --scope P --rules S --in S --out S --allow S --group G --under EP --ttl S --labels K=V,...
                         its scope and grant, as for ${CLI_NAME} spawn-env (default scope: parent)
+  --via R               start it on another machine through runner R (runners.json, see help --all)
 The command starts after -- or at the first word that is not one of these flags.
 
 It returns at once, printing the worker's name and its runner's pid: do not background it (no &, no

package/dist/{chunk-LUDLDWH2.js → chunk-GTU3EWEY.js}

@@ -5,7 +5,7 @@ import {
   configDir,
   relayCredential,
   writePrivateJson
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import {
   note,
   printTable

package/dist/{chunk-LRQP25RI.js → chunk-MHBWDAXO.js}

@@ -10,11 +10,11 @@ import {
   mergeHooks,
   musePlugin,
   opencodePlugin
-} from "./chunk-277BAY7J.js";
+} from "./chunk-UUFTEXDU.js";
 import {
   RelayUsage,
   gitToplevel
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 
 // src/install.ts
 import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";

package/dist/{chunk-LWMTZH36.js → chunk-S5KEVIGO.js}

@@ -3,13 +3,13 @@ import {
   codexMount,
   codexOverrides,
   toml
-} from "./chunk-RZUQ422C.js";
+} from "./chunk-ZEWZBRVM.js";
 import {
   RelayUsage,
   readPsTable,
   relayIdentity,
   startDaemon
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import {
   SELF
 } from "./chunk-MNTIEWKF.js";

package/dist/{chunk-277BAY7J.js → chunk-UUFTEXDU.js}

@@ -13,7 +13,7 @@ import {
   psStart,
   relayIdentity,
   sessionKey
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 
 // src/hooks.ts
 import { Readable } from "stream";

package/dist/{chunk-RZUQ422C.js → chunk-ZEWZBRVM.js}

@@ -3,10 +3,10 @@ import {
   agySettingsFile,
   mcpFile,
   mountedEntry
-} from "./chunk-SNW53KT3.js";
+} from "./chunk-77NUOWQ4.js";
 import {
   steerPrompt
-} from "./chunk-277BAY7J.js";
+} from "./chunk-UUFTEXDU.js";
 import {
   OPTIONS,
   RelayUsage,
@@ -18,7 +18,7 @@ import {
   selectorList,
   spawnerKey,
   walkNow
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import {
   SELF,
   note
@@ -44,8 +44,8 @@ import {
 } from "@scp-dev/core";
 var SERVER = "scp";
 var SPAWN_RUNNER = "SCP_SPAWN_RUNNER";
-var SPAWNER_IDENTITY = ["SCP_NAME", "SCP_SESSION", "SCP_GRANT", "SCP_PARENT", "SCP_HARNESS", "SCP_SHIM_BINDING", "SCP_HARNESS_PID", SPAWN_RUNNER];
-var SHIM_ENV = ["SCP_GRANT", "SCP_NAME", "SCP_LABELS", "SCP_DIR", "XDG_STATE_HOME", "SCP_SHIM_BINDING"];
+var SPAWNER_IDENTITY = ["SCP_NAME", "SCP_SESSION", "SCP_GRANT", "SCP_PARENT", "SCP_UNDER", "SCP_HARNESS", "SCP_SHIM_BINDING", "SCP_HARNESS_PID", SPAWN_RUNNER];
+var SHIM_ENV = ["SCP_GRANT", "SCP_NAME", "SCP_UNDER", "SCP_LABELS", "SCP_DIR", "XDG_STATE_HOME", "SCP_SHIM_BINDING"];
 function spawnEnvironment(parent, grant, labels) {
   const env = {};
   for (const [key, value] of Object.entries(parent)) if (value !== void 0 && !SPAWNER_IDENTITY.includes(key)) env[key] = value;
@@ -728,6 +728,7 @@ async function spawnCommand(args, cwd) {
   const bytes = values["handback-bytes"] === void 0 ? void 0 : handbackBytes(values["handback-bytes"]);
   const runner = process.env[SPAWN_RUNNER];
   delete process.env[SPAWN_RUNNER];
+  if (typeof values.via === "string") return (await import("./remote-spawn-7Z2FLG33.js")).viaSpawn(values, command, cwd);
   if (runner === void 0 && (values.bg === true || values.fg !== true && (process.stdout.isTTY !== true || process.stdin.isTTY !== true && agentShell(process.env))))
     return detachSpawn(args, cwd);
   const channel = runner === void 0 ? void 0 : handshakeChannel();
@@ -739,6 +740,21 @@ async function spawnCommand(args, cwd) {
     } catch {
     }
   });
+  if (typeof values.under === "string") {
+    const remote = await import("./remote-spawn-7Z2FLG33.js");
+    let plan;
+    try {
+      plan = await remote.linkedPlan(values, command);
+    } catch (error) {
+      handshake?.({ error: error instanceof Error ? error.message : String(error), ...error instanceof RelayUsage ? { usage: true } : {} });
+      throw error;
+    }
+    if (plan) {
+      const name2 = plan.name;
+      const started2 = handshake && ((failed) => handshake(failed ? { error: failed.message, code: failed.code } : { name: name2, pid: process.pid }));
+      return remote.linkedSpawn(plan, command, cwd, { group: runner !== void 0, ...started2 ? { started: started2 } : {}, ...bytes !== void 0 ? { bytes } : {} });
+    }
+  }
   const bound = spawnerKey();
   const prompt = values.peek === void 0 ? void 0 : spawnPrompt(command)?.slice(0, PEEK.rawChars);
   const walk = runner === void 0 ? walkNow() : JSON.parse(runner);
@@ -801,7 +817,8 @@ function parseSpawn(args) {
     throw new RelayUsage(error instanceof Error ? error.message : String(error));
   }
   if (values.help) return { values, command: split.command };
-  for (const key of Object.keys(values)) if (!SPAWN_OPTIONS.includes(key)) throw new RelayUsage(`${CLI_NAME} spawn does not take --${key}`);
+  for (const key of Object.keys(values))
+    if (!SPAWN_OPTIONS.includes(key) && !(key === "json" && values.via !== void 0)) throw new RelayUsage(`${CLI_NAME} spawn does not take --${key}`);
   if (values.bg && values.fg) throw new RelayUsage("--bg and --fg: pick one");
   const command = split.command;
   if (!command.length)

package/dist/{claude-WEHOLJ26.js → claude-7BA4PGK3.js}

@@ -3,16 +3,16 @@ import {
   mcpFile,
   mountedEntry,
   whichOnPath
-} from "./chunk-SNW53KT3.js";
-import "./chunk-LRQP25RI.js";
-import "./chunk-277BAY7J.js";
+} from "./chunk-77NUOWQ4.js";
+import "./chunk-MHBWDAXO.js";
+import "./chunk-UUFTEXDU.js";
 import "./chunk-YYSLYVNZ.js";
 import {
   CHANNELS_ENV,
   RelayUsage,
   deriveHandle,
   joinMode
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import {
   SELF
 } from "./chunk-MNTIEWKF.js";
@@ -59,7 +59,17 @@ function claudeLaunchArgs(args, added) {
   const channels = optionsOf(args).some((arg) => arg === "server:scp" || arg === `${CHANNEL_FLAGS[0]}=server:scp`) ? [] : CHANNEL_FLAGS;
   return beforeDashes(args, [...channels, ...added]);
 }
-var LAUNCHER_IDENTITY = ["SCP_NAME", "SCP_GRANT", "SCP_SESSION", "SCP_PARENT", "SCP_HARNESS", "SCP_SHIM_BINDING", "SCP_SPAWN_RUNNER", CHANNELS_ENV];
+var LAUNCHER_IDENTITY = [
+  "SCP_NAME",
+  "SCP_GRANT",
+  "SCP_SESSION",
+  "SCP_PARENT",
+  "SCP_UNDER",
+  "SCP_HARNESS",
+  "SCP_SHIM_BINDING",
+  "SCP_SPAWN_RUNNER",
+  CHANNELS_ENV
+];
 var SHIM_VARS = ["SCP_LABELS", "SCP_DIR", "XDG_STATE_HOME"];
 var bgDir = (env) => join(relayDir(env), "claude-bg");
 function bgMount(env, name) {
@@ -233,7 +243,7 @@ async function renameBackground(target, to, env, err, bin, deps) {
 `, { mode: 384 });
 }
 async function renameEndpoint(from, to) {
-  return (await import("./main-CDLW3MV5.js")).relayMain(["name", "--endpoint", `me/${from}`, to]);
+  return (await import("./main-6BPNG53C.js")).relayMain(["name", "--endpoint", `me/${from}`, to]);
 }
 async function claudeCommand(argv, env = process.env, err = (line) => void process.stderr.write(`${line}
 `), cwd = process.cwd(), deps = {}) {

package/dist/cli.js

@@ -17,6 +17,6 @@ function quietSqliteWarning() {
 // src/cli.ts
 if (!await subagentFastPath(process.argv.slice(2))) {
   quietSqliteWarning();
-  const { run } = await import("./main-CDLW3MV5.js");
+  const { run } = await import("./main-6BPNG53C.js");
   await run(process.argv.slice(2));
 }

package/dist/{codex-54UWPDY5.js → codex-KQNXVGTE.js}

@@ -6,14 +6,14 @@ import {
   codexLaunch,
   connectCodexChannel,
   serverOptions
-} from "./chunk-LWMTZH36.js";
-import "./chunk-RZUQ422C.js";
-import "./chunk-KN7WEIE4.js";
-import "./chunk-SNW53KT3.js";
-import "./chunk-LRQP25RI.js";
-import "./chunk-277BAY7J.js";
+} from "./chunk-S5KEVIGO.js";
+import "./chunk-ZEWZBRVM.js";
+import "./chunk-FPNFRDXG.js";
+import "./chunk-77NUOWQ4.js";
+import "./chunk-MHBWDAXO.js";
+import "./chunk-UUFTEXDU.js";
 import "./chunk-YYSLYVNZ.js";
-import "./chunk-3SOIVANO.js";
+import "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 export {
   CODEX_HELP,

package/dist/{hooks-ULKKUHPF.js → hooks-DRIUG546.js}

@@ -42,11 +42,11 @@ import {
   tldrEvery,
   transcriptTitle,
   unreadPointer
-} from "./chunk-277BAY7J.js";
+} from "./chunk-UUFTEXDU.js";
 import {
   SUBAGENT
 } from "./chunk-YYSLYVNZ.js";
-import "./chunk-3SOIVANO.js";
+import "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 export {
   AGY_CONVERSATION,

package/dist/{install-5A3ETGF6.js → install-MZC4PAIC.js}

@@ -2,10 +2,10 @@ import {
   hooksTarget,
   installHooks,
   mcpInstall
-} from "./chunk-LRQP25RI.js";
-import "./chunk-277BAY7J.js";
+} from "./chunk-MHBWDAXO.js";
+import "./chunk-UUFTEXDU.js";
 import "./chunk-YYSLYVNZ.js";
-import "./chunk-3SOIVANO.js";
+import "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 export {
   hooksTarget,

package/dist/{join-FFT7RQRW.js → join-JW7C2IDC.js}

@@ -7,7 +7,7 @@ import {
   sessionKey,
   startDaemon,
   walkNow
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 
 // src/join.ts

package/dist/{login-DCNCC3RS.js → login-22BLC7KI.js}

@@ -1,11 +1,11 @@
 import {
   machineName
-} from "./chunk-LUDLDWH2.js";
+} from "./chunk-GTU3EWEY.js";
 import {
   RelayUsage,
   activeRelay,
   saveCredential
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import {
   note
 } from "./chunk-MNTIEWKF.js";

package/dist/{main-CDLW3MV5.js → main-6BPNG53C.js}

@@ -1,6 +1,6 @@
 import {
   SPAWN_HELP
-} from "./chunk-KN7WEIE4.js";
+} from "./chunk-FPNFRDXG.js";
 import {
   OPTIONS,
   RelayUsage,
@@ -16,7 +16,7 @@ import {
   startDaemon,
   terminalAttached,
   time
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import {
   FAILED,
   exitFlushed,
@@ -35,7 +35,7 @@ import { parseArgs } from "util";
 // package.json
 var package_default = {
   name: "@scp-dev/cli",
-  version: "0.7.0",
+  version: "0.8.0",
   description: "The swarm command line tool.",
   license: "Apache-2.0",
   homepage: "https://scp.dev",
@@ -238,6 +238,14 @@ scopes (selectors are comma-separated, e.g. tree:parent,tree:children,group:team
                                                  messages with the relay MCP tools (relay_send, relay_inbox, relay_reply). A
                                                  ${CLI_NAME} command from codex's workspace-write sandbox also needs
                                                  -c sandbox_workspace_write.network_access=true (the relay socket counts as network)
+  ${CLI_NAME} spawn --via R [--name N] [--title T] [--labels K=V,...] [--json] [--] <harness cmd...>
+                                                 hands the spawn to runner R of ~/.config/scp/runners.json ($SCP_RUNNERS_FILE):
+                                                 it gets the spawn as one JSON line on stdin and starts the worker on another
+                                                 machine logged in to your account, whose ${CLI_NAME} spawn --under me/<this
+                                                 machine>/<you> runs it linked under you, without a grant; it hands back as a
+                                                 relay message. Needs this broker linked to a hub; returns once the runner exits 0,
+                                                 naming the worker's address and attach command when the runner prints them
+                                                 (--json: as JSON)
   ${CLI_NAME} pi [--name N] [--] [pi args...]    runs pi with the bundled SCP extension: the relay tools, and each new
                                                  message as a turn (steering a running one, waking an idle session)
   ${CLI_NAME} codex [--name N] [--headless] [--] [codex args...]
@@ -322,6 +330,15 @@ agent sessions:
                                                  (a cycle) is refused; both are audited, as adopt and unlink
   ${CLI_NAME} leave [--endpoint EP]              take this session off the relay: offline, no messages pushed, mail kept until
                                                  ${CLI_NAME} join; a spawned worker stays joined while it runs
+  ${CLI_NAME} hibernate --wake <provider> [--ref R] [<endpoint>]   mark this session (or, for the human, <endpoint>) hibernated:
+                                                 suspended but wakeable. A message to it runs the provider's wake hook from
+                                                 ~/.config/scp/wakers.json with R and the message's metadata (never its body),
+                                                 at most once a minute; the session drains its queue once it is back
+  ${CLI_NAME} hibernate --wake none [<endpoint>] the session resumed or is gone: hibernation clears (--gone is the same); it also
+                                                 clears when the session claims its endpoint again
+  ${CLI_NAME} hibernate --all --wake <provider> [--ref R] [--eta S]   the human marks every live agent of this machine hibernated
+                                                 (--eta: how long a wake takes, shown to senders); it waits until the hub has it
+                                                 ("the hub has it"), so the machine can be suspended right after
   With setup --join manual a session stays off the relay until it runs ${CLI_NAME} join; the default, auto, joins every
   hooked session when it starts.
 
@@ -333,6 +350,9 @@ relay:
   ${CLI_NAME} logout                             remove the stored credential for the active relay
   ${CLI_NAME} cloud enable [--machine NAME] | disable | status   link the local broker to the hub, or inspect its link
   ${CLI_NAME} machines [rm NAME]                 list the hub's machines, or release one
+  ${CLI_NAME} machine wake-url <url> [--secret-env VAR] | --clear   the URL the hub POSTs to, signed with the secret in $VAR
+                                                 (default $SCP_MACHINE_WAKE_SECRET), when a message reaches a hibernated agent of
+                                                 this machine while its broker is not linked; for the human
   --cloud (or $SCP_TRANSPORT=cloud) sends messaging commands directly to the hub using the active relay's login.
   --machine NAME ($SCP_MACHINE, else the short hostname) names this machine on the hub; it requires --cloud.
 
@@ -409,6 +429,8 @@ var VERBS = {
   link: IDENTITY,
   unlink: IDENTITY,
   leave: [...IDENTITY, "endpoint"],
+  hibernate: [...IDENTITY, "wake", "ref", "gone", "all", "eta"],
+  machine: [...IDENTITY, "secret-env", "clear"],
   name: [...IDENTITY, "endpoint", "take-over"],
   inbox: [...IDENTITY, "wait", "ack", "keep"],
   reply: IDENTITY,
@@ -582,16 +604,16 @@ async function relayMain(argv, cwd = process.cwd()) {
     out(cliVersion());
     return 0;
   }
-  if (verb === "hook") return (await import("./hooks-ULKKUHPF.js")).relayHookCommand(rest, startDaemon);
-  if (verb === "setup") return (await import("./setup-U7CWN5QP.js")).relaySetupCommand(rest, cwd, out);
-  if (verb === "claude") return (await import("./claude-WEHOLJ26.js")).claudeCommand(rest);
-  if (verb === "pi") return (await import("./pi-5IPU6GA4.js")).piCommand(rest);
-  if (verb === "codex") return (await import("./codex-54UWPDY5.js")).codexCommand(rest);
-  if (verb === "muse") return (await import("./muse-S7FPY4CL.js")).museCommand(rest);
-  if (verb === "opencode") return (await import("./opencode-WFMQYCI2.js")).opencodeCommand(rest, process.env, void 0, cwd);
-  if (verb === "agy" || verb === "grok") return (await import("./resume-3ZRDXSTX.js")).resumeCommand(verb, rest, process.env, cwd);
+  if (verb === "hook") return (await import("./hooks-DRIUG546.js")).relayHookCommand(rest, startDaemon);
+  if (verb === "setup") return (await import("./setup-NK2HRFZN.js")).relaySetupCommand(rest, cwd, out);
+  if (verb === "claude") return (await import("./claude-7BA4PGK3.js")).claudeCommand(rest);
+  if (verb === "pi") return (await import("./pi-QUW4MSVZ.js")).piCommand(rest);
+  if (verb === "codex") return (await import("./codex-KQNXVGTE.js")).codexCommand(rest);
+  if (verb === "muse") return (await import("./muse-QWCI627T.js")).museCommand(rest);
+  if (verb === "opencode") return (await import("./opencode-7XYA7E3Q.js")).opencodeCommand(rest, process.env, void 0, cwd);
+  if (verb === "agy" || verb === "grok") return (await import("./resume-B5BOZO2G.js")).resumeCommand(verb, rest, process.env, cwd);
   if (verb === "spawn") {
-    const { splitSpawn, spawnCommand } = await import("./spawn-VZK5MD3R.js");
+    const { splitSpawn, spawnCommand } = await import("./spawn-3IYGUBG6.js");
     const { flags } = splitSpawn(rest);
     if (flags.includes("--help") || flags.includes("-h")) {
       out(flags.includes("--all") ? RELAY_HELP : SPAWN_HELP);
@@ -599,7 +621,7 @@ async function relayMain(argv, cwd = process.cwd()) {
     }
     return spawnCommand(rest, cwd);
   }
-  if (verb === "mesh") return (await import("./mesh-TDOVAHZ3.js")).meshCommand(rest);
+  if (verb === "mesh") return (await import("./mesh-P3EQXYLH.js")).meshCommand(rest);
   const allowed = VERBS[verb];
   if (!allowed) throw new RelayUsage(`unknown command "${verb}"`);
   let parsed;
@@ -619,11 +641,11 @@ async function relayMain(argv, cwd = process.cwd()) {
     return daemon(values.idle, values.policy);
   }
   if (verb === "mcp")
-    return (await import("./mcp-7GB35CTY.js")).relayMcpCommand(values, positionals);
+    return (await import("./mcp-4VAPXGF6.js")).relayMcpCommand(values, positionals);
   if (verb === "hooks") {
     if (positionals[0] !== "install" || positionals.length > 1) throw new RelayUsage(`${CLI_NAME} hooks takes install --harness claude|codex|opencode|agy|muse`);
     if (values.write && values.print) throw new RelayUsage("--print and --write: pick one");
-    return (await import("./install-5A3ETGF6.js")).installHooks({
+    return (await import("./install-MZC4PAIC.js")).installHooks({
       harness: values.harness,
       scope: values.scope,
       write: values.write === true,
@@ -634,27 +656,27 @@ async function relayMain(argv, cwd = process.cwd()) {
       out
     });
   }
-  if (verb === "relay") return (await import("./relay-7WBNUACH.js")).relayVerb(positionals, values.json === true);
-  if (verb === "up") return (await import("./up-S4KJBWI6.js")).up(positionals, values, cwd, relinkBroker);
+  if (verb === "relay") return (await import("./relay-7VBBQCFB.js")).relayVerb(positionals, values.json === true);
+  if (verb === "up") return (await import("./up-QL3FLYUK.js")).up(positionals, values, cwd, relinkBroker);
   if (verb === "login") {
-    const code = await (await import("./relay-7WBNUACH.js")).loginMain(positionals, values);
+    const code = await (await import("./relay-7VBBQCFB.js")).loginMain(positionals, values);
     if (code === 0) await relinkRunning();
     return code;
   }
-  if (verb === "logout") return (await import("./relay-7WBNUACH.js")).logoutMain(positionals, values.json === true);
+  if (verb === "logout") return (await import("./relay-7VBBQCFB.js")).logoutMain(positionals, values.json === true);
   if (verb === "cloud") {
-    const code = await (await import("./remote-YO5B2HQI.js")).cloudMain(positionals, values, cloudStatus);
+    const code = await (await import("./remote-VRVONVET.js")).cloudMain(positionals, values, cloudStatus);
     if (code === 0 && positionals[0] === "enable") await relinkRunning();
     return code;
   }
-  if (verb === "join") return (await import("./join-FFT7RQRW.js")).joinCommand(values, positionals, cwd, out);
+  if (verb === "join") return (await import("./join-JW7C2IDC.js")).joinCommand(values, positionals, cwd, out);
   if (verb === "holds") holdsArgs(values, positionals);
   const bodyFromStdin = (verb === "send" || verb === "ask" || verb === "reply") && (positionals[1] === void 0 || positionals[1] === "-");
   const humanAdopt = verb === "adopt" && values.parent !== void 0 && values.as === void 0 && terminalAttached(process, false);
   const opened = humanAdopt ? await openAdoptHuman(cwd, values) : await open(verb, values, cwd, bodyFromStdin);
   const { client } = opened;
   try {
-    if (verb === "machines") return await (await import("./remote-YO5B2HQI.js")).machinesVerb(client, positionals, values.json === true);
+    if (verb === "machines") return await (await import("./remote-VRVONVET.js")).machinesVerb(client, positionals, values.json === true);
     return await runVerb(opened, verb, values, positionals, cwd);
   } finally {
     client.close();
@@ -662,7 +684,7 @@ async function relayMain(argv, cwd = process.cwd()) {
 }
 async function openAdoptHuman(cwd, values) {
   if (values.cloud || process.env.SCP_TRANSPORT === "cloud") {
-    const { openCloud } = await import("./remote-YO5B2HQI.js");
+    const { openCloud } = await import("./remote-VRVONVET.js");
     return { ...await openCloud({ tty: true, ...values.machine !== void 0 ? { machine: values.machine } : {} }), broker: null, bound: "human" };
   }
   if (values.machine !== void 0) throw new RelayUsage("--machine names the machine of the cloud transport: add --cloud");
@@ -847,9 +869,9 @@ async function runVerb({ client, me, broker, where, bound, harnessPid }, verb, v
       return 0;
     }
     case "peek":
-      return (await import("./peek-X4QQFMQJ.js")).peekCommand(localClient(client, broker, verb), values, positionals);
+      return (await import("./peek-G6RLQGKO.js")).peekCommand(localClient(client, broker, verb), values, positionals);
     case "set-peek":
-      return (await import("./peek-X4QQFMQJ.js")).setPeekCommand(localClient(client, broker, verb), values, positionals);
+      return (await import("./peek-G6RLQGKO.js")).setPeekCommand(localClient(client, broker, verb), values, positionals);
     case "why": {
       const [from, to] = positionals;
       if (!from || !to || positionals.length > 2) throw new RelayUsage(`${CLI_NAME} why takes <from> <to>`);
@@ -1112,6 +1134,47 @@ async function runVerb({ client, me, broker, where, bound, harnessPid }, verb, v
       else out(`${result.endpoint.address} is a root again (was under ${result.parent})`);
       return 0;
     }
+    case "hibernate": {
+      if (positionals.length > 1) throw new RelayUsage(`${CLI_NAME} hibernate takes at most one endpoint`);
+      if (values.gone === true && values.wake !== void 0) throw new RelayUsage("--gone and --wake: pick one");
+      const wake = values.gone === true ? "none" : values.wake;
+      if (wake === void 0) throw new RelayUsage(`${CLI_NAME} hibernate takes --wake <provider>, or --wake none (--gone) to clear it`);
+      if (wake === "none" && (values.ref !== void 0 || values.eta !== void 0))
+        throw new RelayUsage("--ref and --eta go with a provider, not with --wake none");
+      if (values.all === true && positionals.length) throw new RelayUsage(`${CLI_NAME} hibernate --all names no endpoint`);
+      const eta = values.eta === void 0 ? void 0 : Math.round(parseSeconds(values.eta, "--eta"));
+      const result = await client.request("hibernate", {
+        ...values.all === true ? { all: true } : positionals.length ? { endpoint: positionals[0] } : {},
+        wake,
+        ...values.ref !== void 0 ? { ref: values.ref } : {},
+        ...eta !== void 0 ? { eta_s: eta } : {}
+      });
+      if (asJson) json(result);
+      else {
+        for (const e of result.endpoints ?? (result.endpoint ? [result.endpoint] : []))
+          out(`${e.address} ${presenceText(e)}${e.presence === "hibernated" ? `, woken by ${wakeText(e)}` : ""}`);
+        if (result.mirrored) note("the hub has it: the machine may be suspended now");
+      }
+      return 0;
+    }
+    case "machine": {
+      if (positionals[0] !== "wake-url") throw new RelayUsage(`${CLI_NAME} machine takes wake-url <url> [--secret-env VAR] | wake-url --clear`);
+      if (values.clear === true) {
+        if (positionals.length > 1 || values["secret-env"] !== void 0) throw new RelayUsage(`${CLI_NAME} machine wake-url --clear takes no url`);
+        const result2 = await client.request("machine_wake", { url: null });
+        if (asJson) json(result2);
+        else out("machine waker cleared");
+        return 0;
+      }
+      if (positionals.length !== 2) throw new RelayUsage(`${CLI_NAME} machine wake-url takes one url, or --clear`);
+      const name = values["secret-env"] ?? "SCP_MACHINE_WAKE_SECRET";
+      const secret = process.env[name];
+      if (!secret) throw new RelayUsage(`set $${name} to the waker's secret (16 to 256 characters); it is never read from the command line`);
+      const result = await client.request("machine_wake", { url: positionals[1], secret });
+      if (asJson) json(result);
+      else out("machine waker set; the hub signs each call with the secret");
+      return 0;
+    }
     case "leave": {
       if (positionals.length) throw new RelayUsage(`${CLI_NAME} leave takes no arguments (--endpoint EP for the human at a terminal)`);
       const endpoint = values.endpoint;
@@ -1346,7 +1409,8 @@ function printSummary(snapshot, me, all) {
   const agents = snapshot.endpoints.filter((e) => e.kind !== "human");
   const count = (presence) => agents.filter((e) => e.presence === presence).length;
   out();
-  out(`agents: ${count("online")} online, ${count("idle")} idle, ${count("offline")} offline`);
+  const hibernated = count("hibernated");
+  out(`agents: ${count("online")} online, ${count("idle")} idle, ${hibernated ? `${hibernated} hibernated, ` : ""}${count("offline")} offline`);
   const counted = all ? agents : agents.filter((e) => e.presence !== "offline");
   const harnesses = /* @__PURE__ */ new Map();
   for (const e of counted) harnesses.set(e.harness ?? "?", [...harnesses.get(e.harness ?? "?") ?? [], e]);
@@ -1473,11 +1537,11 @@ async function daemon(idle, policyFile) {
   });
   let broker;
   try {
-    const { daemonBridge } = await import("./remote-YO5B2HQI.js");
+    const { daemonBridge } = await import("./remote-VRVONVET.js");
     const bridge = await daemonBridge();
     broker = await startBroker({
       dir: relayDir(),
-      ...bridge ? { bridge } : await (await import("./mesh-TDOVAHZ3.js")).meshBrokerOptions(),
+      ...bridge ? { bridge } : await (await import("./mesh-P3EQXYLH.js")).meshBrokerOptions(),
       bridgeConfig: () => daemonBridge(),
       ...idleMs !== void 0 ? { idleMs } : {},
       ...policyFile ? { policyPath: resolve(policyFile) } : {}

package/dist/{mcp-7GB35CTY.js → mcp-4VAPXGF6.js}

@@ -1,12 +1,12 @@
 import {
   spawnDetached
-} from "./chunk-RZUQ422C.js";
-import "./chunk-KN7WEIE4.js";
-import "./chunk-SNW53KT3.js";
+} from "./chunk-ZEWZBRVM.js";
+import "./chunk-FPNFRDXG.js";
+import "./chunk-77NUOWQ4.js";
 import {
   mcpInstall
-} from "./chunk-LRQP25RI.js";
-import "./chunk-277BAY7J.js";
+} from "./chunk-MHBWDAXO.js";
+import "./chunk-UUFTEXDU.js";
 import "./chunk-YYSLYVNZ.js";
 import {
   CHANNELS_ENV,
@@ -19,7 +19,7 @@ import {
   relayIdentity,
   startDaemon,
   writeShimBinding
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 
 // src/mcp.ts

package/dist/{mesh-TDOVAHZ3.js → mesh-P3EQXYLH.js}

@@ -1,6 +1,6 @@
 import {
   RelayUsage
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 
 // src/mesh.ts

package/dist/{muse-S7FPY4CL.js → muse-QWCI627T.js}

@@ -1,18 +1,18 @@
 import {
   connectCodexChannel
-} from "./chunk-LWMTZH36.js";
+} from "./chunk-S5KEVIGO.js";
 import {
   MUSE_MODE,
   MUSE_MODES_ALLOWED,
   museModes
-} from "./chunk-RZUQ422C.js";
-import "./chunk-KN7WEIE4.js";
+} from "./chunk-ZEWZBRVM.js";
+import "./chunk-FPNFRDXG.js";
 import {
   mcpFile,
   mountedEntry
-} from "./chunk-SNW53KT3.js";
-import "./chunk-LRQP25RI.js";
-import "./chunk-277BAY7J.js";
+} from "./chunk-77NUOWQ4.js";
+import "./chunk-MHBWDAXO.js";
+import "./chunk-UUFTEXDU.js";
 import "./chunk-YYSLYVNZ.js";
 import {
   RelayUsage,
@@ -20,7 +20,7 @@ import {
   relayIdentity,
   startDaemon,
   writeMuseLaunch
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 
 // src/muse.ts

package/dist/{opencode-WFMQYCI2.js → opencode-7XYA7E3Q.js}

@@ -2,18 +2,18 @@ import {
   mcpFile,
   mountedEntry,
   whichOnPath
-} from "./chunk-SNW53KT3.js";
+} from "./chunk-77NUOWQ4.js";
 import {
   hooksTarget
-} from "./chunk-LRQP25RI.js";
+} from "./chunk-MHBWDAXO.js";
 import {
   opencodePlugin
-} from "./chunk-277BAY7J.js";
+} from "./chunk-UUFTEXDU.js";
 import "./chunk-YYSLYVNZ.js";
 import {
   RelayUsage,
   gitToplevel
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 
 // src/opencode.ts

package/dist/{peek-X4QQFMQJ.js → peek-G6RLQGKO.js}

@@ -2,7 +2,7 @@ import {
   RelayUsage,
   peekGrant,
   stamp
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import {
   note
 } from "./chunk-MNTIEWKF.js";

package/dist/{pi-5IPU6GA4.js → pi-QUW4MSVZ.js}

@@ -1,6 +1,6 @@
 import {
   RelayUsage
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 
 // src/pi.ts

package/dist/{relay-7WBNUACH.js → relay-7VBBQCFB.js}

@@ -13,7 +13,7 @@ import {
   saveCredential,
   setJoinMode,
   writePrivateJson
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 export {
   DEFAULT_RELAY,

package/dist/{remote-YO5B2HQI.js → remote-VRVONVET.js}

@@ -9,8 +9,8 @@ import {
   machinesVerb,
   openCloud,
   readCloudFile
-} from "./chunk-LUDLDWH2.js";
-import "./chunk-3SOIVANO.js";
+} from "./chunk-GTU3EWEY.js";
+import "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 export {
   CloudRelayClient,

package/dist/remote-spawn-7Z2FLG33.js

@@ -0,0 +1,309 @@
+import {
+  STDIN_WAIT_MS,
+  agentShell,
+  closedStdin,
+  harnessArgv,
+  harnessOutput,
+  harnessStdin,
+  programAt,
+  runHarness,
+  spawnEnvironment,
+  spawnTitle,
+  stderrOutput,
+  workerName
+} from "./chunk-ZEWZBRVM.js";
+import "./chunk-FPNFRDXG.js";
+import "./chunk-77NUOWQ4.js";
+import "./chunk-MHBWDAXO.js";
+import "./chunk-UUFTEXDU.js";
+import "./chunk-YYSLYVNZ.js";
+import {
+  RelayUsage,
+  labelsFor,
+  localClient,
+  normalizeHarness,
+  open,
+  parseLabels,
+  startDaemon
+} from "./chunk-6S3V5ZGU.js";
+import {
+  note
+} from "./chunk-MNTIEWKF.js";
+
+// src/remote-spawn.ts
+import { spawn } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { basename, dirname, join } from "path";
+import { constants } from "os";
+import { CLI_NAME, findSecret, handbackOutput, LIMITS, validHandle } from "@scp-dev/core";
+import { connectBroker, policyPath, relayDir } from "@scp-dev/broker";
+var RUNNER_NAME = /^[a-z0-9][a-z0-9-]{0,31}$/;
+var RUNNER_TIMEOUT_S = 60;
+var RUNNER_TIMEOUT_MAX_S = 3600;
+var RUNNER_STDERR_BYTES = 2048;
+var RUNNER_STDOUT_BYTES = 4096;
+var RUNNER_REF = /^[\x21-\x7e]{1,256}$/;
+var RUNNER_ATTACH = /^[^\u0000-\u001f\u007f-\u009f]{1,1024}$/;
+var RUNNER_DRAIN_MS = 500;
+var TITLE_CHARS = 64;
+var MACHINE = "[a-z0-9][a-z0-9-]{0,31}";
+var MACHINE_ADDRESS = new RegExp(`^me/(${MACHINE})/([^/]+)$`);
+var STDERR_LABEL = `stderr (last ${LIMITS.stderrBytes / 1024} KB):`;
+var VIA_FLAGS = ["as", "harness", "name", "title", "labels", "bg", "json", "via"];
+var GRANT_FLAGS = ["scope", "rules", "in", "out", "allow", "group", "ttl", "peek", "no-push", "as", "human", "harness"];
+function runnersPath(env = process.env) {
+  return env.SCP_RUNNERS_FILE || join(dirname(policyPath()), "runners.json");
+}
+var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function parseRunners(text, path) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw new RelayUsage(`${path} is not JSON`);
+  }
+  if (!isObject(value)) throw new RelayUsage(`${path} maps runner names to {command, timeout_s?}`);
+  const runners = {};
+  for (const [name, entry] of Object.entries(value)) {
+    if (!RUNNER_NAME.test(name))
+      throw new RelayUsage(`${path}: runner ${JSON.stringify(name)} is not a valid name: lowercase letters, digits and -, at most 32`);
+    const command = isObject(entry) ? entry.command : void 0;
+    if (!Array.isArray(command) || !command.length || !command.every((word) => typeof word === "string" && word.length > 0))
+      throw new RelayUsage(`${path}: runner ${name} needs command, a non-empty list of words`);
+    const timeout = entry.timeout_s ?? RUNNER_TIMEOUT_S;
+    if (typeof timeout !== "number" || !Number.isInteger(timeout) || timeout < 1 || timeout > RUNNER_TIMEOUT_MAX_S)
+      throw new RelayUsage(`${path}: runner ${name}'s timeout_s is whole seconds, 1 to ${RUNNER_TIMEOUT_MAX_S}`);
+    runners[name] = { command: [...command], timeout_s: timeout };
+  }
+  return runners;
+}
+function readRunners(path = runnersPath()) {
+  return existsSync(path) ? parseRunners(readFileSync(path, "utf8"), path) : {};
+}
+function runnerFor(name, runners, path) {
+  const runner = Object.hasOwn(runners, name) ? runners[name] : void 0;
+  if (runner) return runner;
+  const known = Object.keys(runners);
+  throw new RelayUsage(`no runner ${JSON.stringify(name)} in ${path}: ${known.length ? `configured: ${known.join(", ")}` : "none is configured"}`);
+}
+function spawnRequest(o) {
+  return {
+    scp: 1,
+    event: "spawn",
+    name: o.name,
+    title: o.title,
+    cmd: o.command,
+    cwd: o.cwd,
+    parent: o.parent,
+    labels: o.labels,
+    join: { under: o.parent, name: o.name, mode: "account" }
+  };
+}
+function tail(from, bytes) {
+  let kept = Buffer.alloc(0);
+  let cut = false;
+  from.on("data", (chunk) => {
+    kept = Buffer.concat([kept, chunk]);
+    if (kept.length > bytes) {
+      kept = kept.subarray(kept.length - bytes);
+      cut = true;
+    }
+  });
+  return { text: () => kept.toString("utf8"), cut: () => cut };
+}
+function runRunner(runner, request, env) {
+  return new Promise((resolve) => {
+    const child = spawn(runner.command[0], runner.command.slice(1), { detached: true, stdio: ["pipe", "pipe", "pipe"], env, cwd: request.cwd });
+    const out = tail(child.stdout, RUNNER_STDOUT_BYTES);
+    const err = tail(child.stderr, RUNNER_STDERR_BYTES);
+    const pipes = [child.stdout, child.stderr];
+    let settled = false;
+    const finish = (code, timedOut = false, message) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      const done = () => {
+        for (const pipe of pipes) pipe.destroy();
+        child.unref();
+        const stderr = message ?? handbackOutput(err.text(), err.cut(), RUNNER_STDERR_BYTES);
+        resolve({ code, timedOut, stdout: out.cut() ? "" : out.text(), stderr });
+      };
+      const open2 = pipes.filter((pipe) => !pipe.readableEnded);
+      if (!open2.length || message) return done();
+      const drain = setTimeout(done, RUNNER_DRAIN_MS);
+      let left = open2.length;
+      for (const pipe of open2)
+        pipe.once("end", () => {
+          if (--left > 0) return;
+          clearTimeout(drain);
+          done();
+        });
+    };
+    const timer = setTimeout(() => {
+      try {
+        process.kill(-child.pid, "SIGTERM");
+      } catch {
+      }
+      finish(124, true);
+    }, runner.timeout_s * 1e3);
+    child.once(
+      "error",
+      (error) => finish(error.code === "ENOENT" ? 127 : 126, false, `${runner.command[0]}: ${error.code === "ENOENT" ? "command not found" : error.message}`)
+    );
+    child.once("exit", (code, signal) => finish(code ?? 128 + (signal ? constants.signals[signal] ?? 0 : 0)));
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(`${JSON.stringify(request)}
+`);
+  });
+}
+function runnerReply(stdout, name) {
+  let value;
+  try {
+    value = JSON.parse(stdout.trim());
+  } catch {
+    return void 0;
+  }
+  if (!isObject(value) || typeof value.machine !== "string" || typeof value.address !== "string") return void 0;
+  const address = MACHINE_ADDRESS.exec(value.address);
+  if (!address || address[1] !== value.machine || address[2] !== name) return void 0;
+  if (value.ref !== void 0 && (typeof value.ref !== "string" || !RUNNER_REF.test(value.ref))) return void 0;
+  if (value.attach !== void 0 && (typeof value.attach !== "string" || !RUNNER_ATTACH.test(value.attach))) return void 0;
+  const ref = typeof value.ref === "string" && !findSecret(value.ref) ? value.ref : void 0;
+  const attach = typeof value.attach === "string" && !findSecret(value.attach) ? value.attach : void 0;
+  return { address: value.address, machine: value.machine, ...ref ? { ref } : {}, ...attach ? { attach } : {} };
+}
+function viaStarted(o) {
+  if (o.json) return [JSON.stringify({ name: o.name, runner: o.runner, parent: o.parent, ...o.reply })];
+  const where = o.reply ? `on machine ${o.reply.machine} and shows under you as ${o.reply.address}` : `on another machine and shows under you as me/<machine>/${o.name}`;
+  return [
+    `${o.name} handed to runner ${o.runner}: it starts ${where}; its result arrives as a relay message by itself`,
+    ...o.reply?.attach ? [`attach: ${o.reply.attach}`] : []
+  ];
+}
+function spawnName(values, command) {
+  const name = typeof values.name === "string" ? values.name.replace(/^me\//, "") : workerName(command);
+  if (!validHandle(name)) throw new RelayUsage(`--name ${JSON.stringify(name)} is not a valid agent handle: lowercase letters, digits, . _ -`);
+  return name;
+}
+async function hubMachine(client, why) {
+  const bridge = await client.request("cloud_status");
+  if (!bridge.enabled || !bridge.machine)
+    throw new RelayUsage(`${why}, but this relay broker is not linked to a hub (${CLI_NAME} login, then ${CLI_NAME} cloud enable)`);
+  return bridge.machine;
+}
+async function viaSpawn(values, command, cwd, out = (line) => console.log(line)) {
+  const via = values.via;
+  const extra = Object.keys(values).find((key) => !VIA_FLAGS.includes(key));
+  if (extra)
+    throw new RelayUsage(
+      `--via starts the worker on another machine under you, without a local grant: it takes --name, --title, --labels and --json, not --${extra}`
+    );
+  const path = runnersPath();
+  const runner = runnerFor(via, readRunners(path), path);
+  const name = spawnName(values, command);
+  const title = typeof values.title === "string" ? values.title : spawnTitle(command) ?? null;
+  if (title !== null && title.length > TITLE_CHARS) throw new RelayUsage(`--title is longer than ${TITLE_CHARS} characters`);
+  const opened = await open("spawn", values, cwd, false);
+  const client = localClient(opened.client, opened.broker, "spawn");
+  let parent;
+  try {
+    const me = opened.me;
+    if (me?.kind !== "agent" || !me.address.startsWith("me/"))
+      throw new RelayUsage(`${CLI_NAME} spawn --via starts a worker under you: run it from an agent's session, or name the agent with --as`);
+    parent = `me/${await hubMachine(client, `${CLI_NAME} spawn --via shows the worker under you through the hub`)}/${me.address.slice(3)}`;
+  } finally {
+    client.close();
+  }
+  const request = spawnRequest({ name, title, command, cwd, parent, labels: parseLabels(values.labels) });
+  const result = await runRunner(runner, request, spawnEnvironment(process.env, {}));
+  if (result.code === 0) {
+    for (const line of viaStarted({ name, runner: via, parent, reply: runnerReply(result.stdout, name), json: values.json === true })) out(line);
+    return 0;
+  }
+  const failed = result.timedOut ? `did not finish within ${runner.timeout_s} s` : `failed (exit ${result.code})`;
+  note(`${CLI_NAME} spawn: runner ${via} ${failed}${result.stderr ? `:
+${result.stderr}` : ""}`);
+  return result.code;
+}
+async function linkedPlan(values, command) {
+  const under = typeof values.under === "string" ? values.under : void 0;
+  const remote = under === void 0 ? null : MACHINE_ADDRESS.exec(under);
+  if (!under || !remote) return null;
+  const dir = relayDir();
+  const client = await connectBroker(dir, () => startDaemon(dir));
+  let machine;
+  try {
+    await client.hello({ observe: true });
+    machine = await hubMachine(client, `--under ${under} names an agent on machine ${remote[1]}`);
+  } finally {
+    client.close();
+  }
+  if (machine === remote[1]) return null;
+  if (values.via !== void 0) throw new RelayUsage("--via and --under an agent on another machine: the runner already starts this spawn there");
+  const granted = Object.keys(values).find((key) => GRANT_FLAGS.includes(key));
+  if (granted) throw new RelayUsage(`a worker under an agent on another machine runs without a grant: --${granted} does not apply`);
+  return {
+    parent: under,
+    machine,
+    name: spawnName(values, command),
+    ...typeof values.title === "string" ? { title: values.title } : {},
+    ...typeof values.labels === "string" ? { labels: values.labels } : {}
+  };
+}
+function linkedHandbackBody(address, code, output, stderr) {
+  const tail2 = code !== 0 && stderr ? `${STDERR_LABEL}
+${stderr}` : "";
+  const kept = tail2 && output ? handbackOutput(output, false, LIMITS.handbackBytes - Buffer.byteLength(tail2) - 2) : output;
+  const head = kept ? `worker ${address} finished (exit ${code})` : `worker ${address} exited without replying (exit ${code})`;
+  return [head, kept, tail2].filter(Boolean).join("\n\n");
+}
+async function linkedSpawn(plan, command, cwd, options) {
+  const env = spawnEnvironment(process.env, { SCP_NAME: plan.name, SCP_UNDER: plan.parent }, plan.labels);
+  const argv = harnessArgv(command, env);
+  const stdin = closedStdin(command) ? await harnessStdin(agentShell(process.env) ? STDIN_WAIT_MS : void 0) : void 0;
+  const run = await runHarness(argv, env, {
+    group: options.group,
+    ...closedStdin(argv) ? { stdin: "ignore" } : {},
+    ...options.started ? { started: options.started } : {},
+    ...stdin ? { stdin } : {}
+  });
+  if (run.started) await linkedHandback(plan, command, cwd, env, run, options.bytes);
+  return run.code;
+}
+async function linkedHandback(plan, command, cwd, env, run, bytes) {
+  const harness = normalizeHarness(basename(command[programAt(command)] ?? ""), "cli");
+  const dir = relayDir();
+  try {
+    const client = await connectBroker(dir, () => startDaemon(dir));
+    try {
+      const hello = await client.hello({ claim: { handle: plan.name, exact: true, harness, cwd, under: plan.parent, labels: labelsFor(env) } });
+      const me = hello.endpoint;
+      const address = `me/${plan.machine}/${me.address.slice(3)}`;
+      if (plan.title && !me.title) await client.request("title", { text: plan.title });
+      const code = Math.min(run.code, 255);
+      await client.request("send", { to: plan.parent, kind: "message", body: linkedHandbackBody(address, code, harnessOutput(run, bytes), stderrOutput(run)) });
+      await client.request("status", { state: "done", note: `exited ${code}` });
+    } finally {
+      client.close();
+    }
+  } catch (error) {
+    note(`${CLI_NAME} spawn: could not hand ${plan.name}'s result back to ${plan.parent}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+export {
+  RUNNER_NAME,
+  RUNNER_TIMEOUT_S,
+  linkedHandbackBody,
+  linkedPlan,
+  linkedSpawn,
+  parseRunners,
+  readRunners,
+  runRunner,
+  runnerFor,
+  runnerReply,
+  runnersPath,
+  spawnRequest,
+  viaSpawn,
+  viaStarted
+};

package/dist/{resume-3ZRDXSTX.js → resume-B5BOZO2G.js}

@@ -1,24 +1,24 @@
 import {
   agyNote,
   messagingAllow
-} from "./chunk-RZUQ422C.js";
-import "./chunk-KN7WEIE4.js";
+} from "./chunk-ZEWZBRVM.js";
+import "./chunk-FPNFRDXG.js";
 import {
   whichOnPath
-} from "./chunk-SNW53KT3.js";
+} from "./chunk-77NUOWQ4.js";
 import {
   hooksTarget
-} from "./chunk-LRQP25RI.js";
+} from "./chunk-MHBWDAXO.js";
 import {
   AGY_CONVERSATION,
   AGY_HOOK_SET
-} from "./chunk-277BAY7J.js";
+} from "./chunk-UUFTEXDU.js";
 import "./chunk-YYSLYVNZ.js";
 import {
   RelayUsage,
   relayIdentity,
   startDaemon
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 
 // src/resume.ts

package/dist/{setup-U7CWN5QP.js → setup-NK2HRFZN.js}

@@ -15,11 +15,11 @@ import {
   verifyMount,
   verifyMusePlugin,
   whichOnPath
-} from "./chunk-SNW53KT3.js";
-import "./chunk-LRQP25RI.js";
-import "./chunk-277BAY7J.js";
+} from "./chunk-77NUOWQ4.js";
+import "./chunk-MHBWDAXO.js";
+import "./chunk-UUFTEXDU.js";
 import "./chunk-YYSLYVNZ.js";
-import "./chunk-3SOIVANO.js";
+import "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 export {
   SETUP_HARNESSES,

package/dist/{spawn-VZK5MD3R.js → spawn-3IYGUBG6.js}

@@ -35,15 +35,15 @@ import {
   toml,
   transcriptReplies,
   workerName
-} from "./chunk-RZUQ422C.js";
+} from "./chunk-ZEWZBRVM.js";
 import {
   SPAWN_HELP
-} from "./chunk-KN7WEIE4.js";
-import "./chunk-SNW53KT3.js";
-import "./chunk-LRQP25RI.js";
-import "./chunk-277BAY7J.js";
+} from "./chunk-FPNFRDXG.js";
+import "./chunk-77NUOWQ4.js";
+import "./chunk-MHBWDAXO.js";
+import "./chunk-UUFTEXDU.js";
 import "./chunk-YYSLYVNZ.js";
-import "./chunk-3SOIVANO.js";
+import "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 export {
   CODEX_VALUED,

package/dist/{up-S4KJBWI6.js → up-QL3FLYUK.js}

@@ -2,7 +2,7 @@ import {
   RelayUsage,
   activeRelay,
   relayCredential
-} from "./chunk-3SOIVANO.js";
+} from "./chunk-6S3V5ZGU.js";
 import "./chunk-MNTIEWKF.js";
 
 // src/up.ts
@@ -31,21 +31,21 @@ async function up(positionals, values, cwd, brokerStatus) {
   const { url } = activeRelay(process.env);
   const headless = values.token !== void 0 || Boolean(process.env.SCP_TOKEN?.trim());
   if (headless || !relayCredential(process.env, url).token) {
-    const code = await (await import("./login-DCNCC3RS.js")).login({
+    const code = await (await import("./login-22BLC7KI.js")).login({
       ...values.token !== void 0 ? { token: values.token } : {},
       ...values.label !== void 0 ? { label: values.label } : {},
       ...values["no-browser"] ? { "no-browser": true } : {}
     });
     if (code !== 0) return code;
   } else out(`already logged in to ${url}`);
-  const enabled = await (await import("./remote-YO5B2HQI.js")).cloudMain(["enable"], values.machine !== void 0 ? { machine: values.machine } : {}, brokerStatus);
+  const enabled = await (await import("./remote-VRVONVET.js")).cloudMain(["enable"], values.machine !== void 0 ? { machine: values.machine } : {}, brokerStatus);
   if (enabled !== 0) return enabled;
-  const setup = (await import("./setup-U7CWN5QP.js")).relaySetupCommand(["--write"], cwd, out);
+  const setup = (await import("./setup-NK2HRFZN.js")).relaySetupCommand(["--write"], cwd, out);
   if (setup !== 0) return setup;
   const broker = await brokerStatus();
   if (!broker.enabled) out(`the broker is still local-only; run \`${CLI_NAME} daemon restart\` to link it to ${url}`);
   else out(`broker linked to ${broker.url ?? url}${broker.connected ? "" : " (connecting)"}`);
-  const { detectHarnesses, whichOnPath } = await import("./setup-U7CWN5QP.js");
+  const { detectHarnesses, whichOnPath } = await import("./setup-NK2HRFZN.js");
   const which = (name) => whichOnPath(name, process.env);
   const installed = new Set(detectHarnesses(process.env, which).keys());
   if (which("pi")) installed.add("pi");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scp-dev/cli",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "The swarm command line tool.",
   "license": "Apache-2.0",
   "homepage": "https://scp.dev",
@@ -24,15 +24,15 @@
     "typecheck": "tsc -p ."
   },
   "dependencies": {
-    "@scp-dev/core": "0.4.0",
-    "@scp-dev/broker": "0.4.2",
-    "@scp-dev/hub": "0.6.3",
-    "@scp-dev/mcp": "0.2.2",
+    "@scp-dev/core": "0.5.0",
+    "@scp-dev/broker": "0.5.0",
+    "@scp-dev/hub": "0.7.0",
+    "@scp-dev/mcp": "0.2.3",
     "smol-toml": "^1.9.1"
   },
   "devDependencies": {
     "@openai/codex": "0.159.0",
-    "@scp-dev/mesh": "0.0.9",
+    "@scp-dev/mesh": "0.0.10",
     "opencode-ai": "1.18.34",
     "tsup": "^8.5.1"
   },