@sealant/mend 0.25.0 → 0.27.2

package/dist/main.js

@@ -17,15 +17,15 @@ import {
   repositoryCloneUrlIssue,
   sessionDisplayName,
   trackBracketedPaste
-} from "./chunk-4MX7ZC34.js";
+} from "./chunk-TBMOGB3T.js";
 
 // src/main.ts
 import { spawn as spawn3, spawnSync as spawnSync2 } from "node:child_process";
-import * as fs8 from "node:fs";
+import * as fs9 from "node:fs";
 import { createRequire } from "node:module";
 import * as net3 from "node:net";
 import * as os6 from "node:os";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 
 // src/agent-share.ts
 import * as net from "node:net";
@@ -1112,7 +1112,7 @@ var COMMANDS = [
   {
     name: "server stop",
     section: "this machine",
-    summary: "stop Mend and Postgres without deleting data",
+    summary: "stop Mend, Postgres and Garage without deleting data",
     synopsis: [""],
     description: [
       "Stops only the installation's Compose services. Connections are interrupted. Workspace containers and volumes remain, but active work may lose connectivity and need reconnection. No volume deletion or Docker prune is performed."
@@ -1125,7 +1125,7 @@ var COMMANDS = [
     summary: "restart Mend using the same generation and pin",
     synopsis: ["[--offline]"],
     description: [
-      "Checks preloaded images before stopping Mend, then starts the saved generation and verifies exact-version health. Postgres stays running. Connections are interrupted; workspace containers and data remain, but active work may need reconnection."
+      "Checks preloaded images before stopping Mend, then starts the saved generation and verifies exact-version health. Postgres and Garage stay running. Connections are interrupted; workspace containers and data remain, but active work may need reconnection."
     ],
     options: [{ flag: "--offline", text: "use local release images and assets" }],
     see: ["server status", "server logs"]
@@ -1213,6 +1213,30 @@ var COMMANDS = [
     description: ["Other terminals and devices keep their own tokens."],
     see: ["login"]
   },
+  {
+    name: "uninstall",
+    section: "this machine",
+    summary: "remove the server, this machine's Mend files, or both",
+    synopsis: ["[--all | --server | --home] [--yes]"],
+    description: [
+      "Asks which scope to remove when none is given, prints exactly what will go, and requires the word delete before the server is touched. The server scope removes the local Compose installation: its containers, every volume it owns (repositories, worktrees, the database), its release image, and the private configuration with its generations and backups. The home scope revokes this terminal's device token, then removes cli.json, the workspace SSH key, and the managed block in ~/.ssh/config.",
+      "Nothing else under the configuration directory is touched; a host-run store or keys root is listed and left in place. Workspace containers carry no label Mend can filter on, so they are named with the command that removes them, never removed."
+    ],
+    options: [
+      { flag: "--all", text: "the server and this machine's Mend files" },
+      { flag: "--server", text: "only the local server installation" },
+      { flag: "--home", text: "only this machine's sign-in, ssh key and config block" },
+      { flag: "--yes", text: "skip the confirmation; required without a terminal" }
+    ],
+    examples: [
+      { command: "mend uninstall", text: "choose a scope, then confirm" },
+      {
+        command: "mend uninstall --home --yes",
+        text: "forget this machine's sign-in without asking"
+      }
+    ],
+    see: ["server stop", "logout"]
+  },
   {
     name: "completions",
     section: "this machine",
@@ -1735,7 +1759,7 @@ var loginCommand = async (args, deps) => {
 };
 
 // src/server-setup.ts
-import { randomBytes } from "node:crypto";
+import { createHmac, randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import * as net2 from "node:net";
 import * as os3 from "node:os";
@@ -1748,6 +1772,11 @@ var MEND_DOCKER_NAMESPACE = {
   store: "mend-store",
   control: "mend-control"
 };
+var MEND_DOCKER_NAMESPACE_WITH_GARAGE = {
+  ...MEND_DOCKER_NAMESPACE,
+  garage: "mend-garage"
+};
+var secondaryVolumesOf = (namespace) => namespace.garage === void 0 ? [namespace.control] : [namespace.control, namespace.garage];
 var SERVER_VOLUME_OWNER_LABEL = "dev.sealant.mend.installation";
 var ServerVolumeOwnershipError = class extends Error {
   /** Stable error discriminator. */
@@ -1839,9 +1868,10 @@ var inProjectNamespace = (name, project2) => ["-", "_"].some(
   (separator) => name.startsWith(`${project2}${separator}`) && name.length > project2.length + 1
 );
 var reservedResourceName = (name, kind, namespace) => {
-  if ([namespace.project, namespace.store, namespace.control].includes(name)) return true;
+  if ([namespace.project, namespace.store, namespace.control, namespace.garage ?? ""].includes(name))
+    return true;
   return ["-", "_"].some(
-    (separator) => (kind === "container" ? ["mend", "postgres"] : ["default"]).some((service) => {
+    (separator) => (kind === "container" ? ["mend", "postgres", "garage"] : ["default"]).some((service) => {
       const reserved = `${namespace.project}${separator}${service}`;
       return name === reserved || kind === "container" && name.startsWith(reserved) && /^[-_](?:[0-9]+|run[-_][a-f0-9]+)$/.test(name.slice(reserved.length));
     })
@@ -1877,7 +1907,9 @@ var inspectForeignProject = async (runtime, context, kind, name, project2) => {
   }
 };
 var refuseOldData = async (runtime, context, namespace, volumes) => {
-  if (volumes.some((name) => name === namespace.control || name.startsWith(`${namespace.project}_`)))
+  if (volumes.some(
+    (name) => secondaryVolumesOf(namespace).includes(name) || name.startsWith(`${namespace.project}_`)
+  ))
     return fail3("unowned-data", "existing volumes without anchor");
   for (const kind of ["volume", "container", "network"]) {
     const labelled = await listNames(runtime, context, kind, namespace.project);
@@ -1906,9 +1938,9 @@ var refuseOldData = async (runtime, context, namespace, volumes) => {
 };
 var parseOwnershipInput = (input) => {
   const namespace = input.namespace ?? MEND_DOCKER_NAMESPACE;
-  if (!input.dockerContext.trim() || input.identityBytes.byteLength === 0 || !/^[a-z0-9][a-z0-9_-]*$/.test(namespace.project) || ![namespace.store, namespace.control].every(
+  if (!input.dockerContext.trim() || input.identityBytes.byteLength === 0 || !/^[a-z0-9][a-z0-9_-]*$/.test(namespace.project) || ![namespace.store, ...secondaryVolumesOf(namespace)].every(
     (name) => /^[a-zA-Z0-9][a-zA-Z0-9_.-]+$/.test(name)
-  ) || namespace.store === namespace.control)
+  ) || (/* @__PURE__ */ new Set([namespace.store, ...secondaryVolumesOf(namespace)])).size !== 1 + secondaryVolumesOf(namespace).length)
     return fail3("invalid-input", "ownership inputs");
   const owner = createHash("sha256").update(input.identityBytes).digest("hex");
   return { _tag: "ok", value: { owner, namespace } };
@@ -1931,13 +1963,16 @@ var ownership = async (runtime, input, mode) => {
   }
   const current = await listNames(runtime, input.dockerContext, "volume");
   if (current._tag === "error") return current;
-  if (current.value.includes(namespace.control)) {
-    const control = await inspectOwner(runtime, input.dockerContext, namespace.control, owner);
-    if (control._tag === "error") return control;
-  } else {
-    if (mode === "verify") return fail3("missing", "control");
-    const control = await ensureVolume(runtime, input.dockerContext, namespace.control, owner);
-    if (control._tag === "error") return control;
+  for (const name of secondaryVolumesOf(namespace)) {
+    const role = name === namespace.control ? "control" : "garage";
+    if (current.value.includes(name)) {
+      const owned = await inspectOwner(runtime, input.dockerContext, name, owner);
+      if (owned._tag === "error") return owned;
+    } else {
+      if (mode === "verify") return fail3("missing", role);
+      const created = await ensureVolume(runtime, input.dockerContext, name, owner);
+      if (created._tag === "error") return created;
+    }
   }
   return { _tag: "ok", value: { owner, namespace } };
 };
@@ -2447,6 +2482,8 @@ var COMPOSE_ASSET = "compose.v2.yaml";
 var POSTGRES_INIT_ASSET = "postgres-init.sh";
 var RELEASE_BASE = "https://github.com/sealant-sh/Mend/releases/download";
 var LATEST_RELEASE_URL = "https://api.github.com/repos/sealant-sh/Mend/releases/latest";
+var GARAGE_IMAGE = "dxflrs/garage:v2.4.1";
+var GARAGE_BUCKET = "mend";
 var ServerSetupError = class extends Error {
   _tag = "ServerSetupError";
 };
@@ -2462,6 +2499,12 @@ var requiredString = (fields, key) => {
   }
   return value;
 };
+var requiredBucket = (fields) => {
+  const value = fields.get("bucket");
+  if (value !== "garage")
+    throw setupError("Server config is corrupt: bucket must be garage when present.");
+  return value;
+};
 var requiredInteger = (fields, key) => {
   const value = fields.get(key);
   if (typeof value !== "number" || !Number.isInteger(value)) {
@@ -2644,7 +2687,8 @@ var parseServerConfig = (raw) => {
     ),
     appPort: requiredInteger(fields, "appPort"),
     sshPort: requiredInteger(fields, "sshPort"),
-    ...fields.has("registryPort") ? { registryPort: requiredInteger(fields, "registryPort") } : {}
+    ...fields.has("registryPort") ? { registryPort: requiredInteger(fields, "registryPort") } : {},
+    ...fields.has("bucket") ? { bucket: requiredBucket(fields) } : {}
   };
   if (config.schemaVersion !== CONFIG_SCHEMA_VERSION || config.assetContract !== ASSET_CONTRACT && !LEGACY_ASSET_CONTRACTS.has(config.assetContract)) {
     throw setupError(
@@ -2869,10 +2913,15 @@ var resolveLatestVersion = async (runtime) => {
   if (version === "latest") throw setupError("GitHub returned an invalid latest release tag.");
   return version;
 };
-var validateComposeAsset = (body) => {
+var composeServiceNames = (body) => {
   const [, afterServices = ""] = body.split(/^services:\s*$/m);
   const [servicesBlock = ""] = afterServices.split(/^\S/m);
-  const serviceNames = [...servicesBlock.matchAll(/^ {2}([0-9A-Za-z_-]+):\s*$/gm)].map((match) => match[1]).filter((name) => name !== void 0).toSorted((left, right) => left.localeCompare(right));
+  return [...servicesBlock.matchAll(/^ {2}([0-9A-Za-z_-]+):\s*$/gm)].map((match) => match[1]).filter((name) => name !== void 0).toSorted((left, right) => left.localeCompare(right));
+};
+var composeBucket = (body) => composeServiceNames(body).includes("garage") ? "garage" : void 0;
+var validateComposeAsset = (body) => {
+  const serviceNames = composeServiceNames(body);
+  const withGarage = serviceNames.includes("garage");
   const volumeSections = body.split(/^volumes:[ \t]*$/m);
   const volumeBlock = (volumeSections[1] ?? "").split(/^\S/m)[0] ?? "";
   const volumeDeclarations = [
@@ -2880,7 +2929,8 @@ var validateComposeAsset = (body) => {
   ];
   for (const [name, variable] of [
     ["mend-store", "MEND_STORE_VOLUME_NAME"],
-    ["mend-control", "MEND_CONTROL_VOLUME_NAME"]
+    ["mend-control", "MEND_CONTROL_VOLUME_NAME"],
+    ...withGarage ? [["mend-garage", "MEND_GARAGE_VOLUME_NAME"]] : []
   ]) {
     const declarations = volumeDeclarations.filter((match) => match[1] === name);
     const properties = (declarations[0]?.[2] ?? "").split("\n").map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("#"));
@@ -2906,9 +2956,22 @@ var validateComposeAsset = (body) => {
     "mend-ssh:",
     "mend-postgres:",
     "/var/lib/mend/store",
-    "/run/sealant/sockets"
+    "/run/sealant/sockets",
+    // The capture store's bucket (a release since the capture store); an older release's asset
+    // has none and is still a valid v2 bundle.
+    ...withGarage ? [
+      `image: ${GARAGE_IMAGE}`,
+      "  garage:",
+      "mend-garage:",
+      "MEND_GARAGE_RPC_SECRET",
+      "MEND_GARAGE_ADMIN_TOKEN",
+      "MEND_GARAGE_KEY_ID",
+      "MEND_GARAGE_KEY_SECRET",
+      "MEND_BLOB_STORE",
+      "MEND_SESSION_ENDPOINT_URL"
+    ] : []
   ];
-  if (requiredFragments.some((fragment) => !body.includes(fragment)) || serviceNames.join(",") !== "mend,postgres") {
+  if (requiredFragments.some((fragment) => !body.includes(fragment)) || serviceNames.join(",") !== "mend,postgres" && serviceNames.join(",") !== "garage,mend,postgres") {
     throw setupError(`Downloaded ${COMPOSE_ASSET} does not implement ${ASSET_CONTRACT}.`);
   }
 };
@@ -2938,6 +3001,27 @@ var renderIdentity = (secrets) => [
   `WORKSPACE_SSH_GATEWAY_TOKEN=${secrets.workspaceSshGatewayToken}`,
   ""
 ].join("\n");
+var garageSecrets = (secrets) => {
+  const derive = (label) => createHmac("sha256", Buffer.from(secrets.betterAuthSecret, "hex")).update(label).digest("hex");
+  return {
+    rpcSecret: derive("mend-garage-rpc-secret"),
+    adminToken: derive("mend-garage-admin-token"),
+    keyId: `GK${derive("mend-garage-key-id").slice(0, 24)}`,
+    keySecret: derive("mend-garage-key-secret")
+  };
+};
+var renderGarage = (secrets, config) => {
+  if (config.bucket !== "garage") return [];
+  const garage = garageSecrets(secrets);
+  return [
+    `MEND_GARAGE_RPC_SECRET=${garage.rpcSecret}`,
+    `MEND_GARAGE_ADMIN_TOKEN=${garage.adminToken}`,
+    `MEND_GARAGE_KEY_ID=${garage.keyId}`,
+    `MEND_GARAGE_KEY_SECRET=${garage.keySecret}`,
+    "MEND_GARAGE_VOLUME_NAME=mend-garage"
+  ];
+};
+var namespaceOf = (config) => config.bucket === "garage" ? MEND_DOCKER_NAMESPACE_WITH_GARAGE : MEND_DOCKER_NAMESPACE;
 var renderSecrets = (secrets, config) => {
   const sshHost = parseUrl(config.appUrl, "Server config appUrl").hostname.replace(/^\[|\]$/g, "");
   const composeBind = net2.isIP(config.bind) === 6 ? `[${config.bind}]` : config.bind;
@@ -2954,6 +3038,7 @@ var renderSecrets = (secrets, config) => {
     `SEALANT_SSH_HOST=${sshHost}`,
     "MEND_STORE_VOLUME_NAME=mend-store",
     "MEND_CONTROL_VOLUME_NAME=mend-control",
+    ...renderGarage(secrets, config),
     `DOCKER_SOCKET_PATH=${config.dockerSocket}`,
     ""
   ].join("\n");
@@ -3123,6 +3208,17 @@ var checkLocalImages = async (runtime, config, policy = "local") => {
   );
   if (postgres.status !== 0)
     throw commandFailure("Preload postgres:17-alpine before continuing", postgres);
+  if (config.bucket === "garage") {
+    const garage = await inspectImage(
+      runtime,
+      config.dockerContext,
+      GARAGE_IMAGE,
+      "{{.Id}}",
+      policy
+    );
+    if (garage.status !== 0)
+      throw commandFailure(`Preload ${GARAGE_IMAGE} before continuing`, garage);
+  }
 };
 var checkComposeImages = async (runtime, installation) => {
   const output = await runtime.run(
@@ -3136,14 +3232,50 @@ var checkComposeImages = async (runtime, installation) => {
   const images = output.stdout.trim().split(/\s+/).toSorted();
   const expected = [
     `ghcr.io/sealant-sh/mend:${installation.config.serverVersion}`,
-    "postgres:17-alpine"
+    "postgres:17-alpine",
+    ...installation.config.bucket === "garage" ? [GARAGE_IMAGE] : []
   ].toSorted();
   if (images.join("\n") !== expected.join("\n")) {
     throw setupError(
-      "Compose must use only the canonical pinned Mend image and official postgres:17-alpine."
+      `Compose must use only the canonical pinned Mend image, official postgres:17-alpine${installation.config.bucket === "garage" ? ` and ${GARAGE_IMAGE}` : ""}.`
     );
   }
 };
+var initGarage = async (runtime, installation, secrets) => {
+  if (installation.config.bucket !== "garage") return;
+  const garage = garageSecrets(secrets);
+  const exec = (args) => runtime.run(
+    "docker",
+    serverComposeArgs(
+      { directory: installation.directory, dockerContext: installation.config.dockerContext },
+      ["exec", "-T", "garage", "/garage", "-c", "/etc/garage.toml", ...args]
+    ),
+    { timeoutMs: serverProcessDeadlines.ordinary }
+  );
+  const status = await exec(["status"]);
+  if (status.status !== 0 || status.error !== void 0)
+    throw commandFailure("Garage did not answer its status", status);
+  const node = status.stdout.match(/^([0-9a-f]{16})\s/m)?.[1];
+  if (node === void 0) throw setupError("Garage reported no node in `garage status`.");
+  await exec(["layout", "assign", "-z", "mend", "-c", "1GB", node]);
+  await exec(["layout", "apply", "--version", "1"]);
+  await exec(["bucket", "create", GARAGE_BUCKET]);
+  await exec(["key", "import", "--yes", "-n", GARAGE_BUCKET, garage.keyId, garage.keySecret]);
+  await exec([
+    "bucket",
+    "allow",
+    "--read",
+    "--write",
+    "--owner",
+    GARAGE_BUCKET,
+    "--key",
+    GARAGE_BUCKET
+  ]);
+  const info = await exec(["bucket", "info", GARAGE_BUCKET]);
+  if (info.status !== 0 || info.error !== void 0 || !info.stdout.includes(garage.keyId))
+    throw commandFailure(`Garage bucket ${GARAGE_BUCKET} is not readable by Mend's key`, info);
+  runtime.writeLine(`Capture store bucket ${GARAGE_BUCKET} is laid out in Garage`);
+};
 var startingNotice = (runtime, version) => runtime.writeLine(
   `Starting Mend ${version} containers; Docker waits up to ${serverProcessDeadlines.composeWaitSeconds}s for them to report healthy`
 );
@@ -3190,7 +3322,7 @@ var setupServer = async (args, runtime, store) => {
   const operatingSystem = await checkDocker(runtime, selectedContext.name);
   runtime.writeLine(`Using Docker context "${selectedContext.name}" (${selectedContext.endpoint})`);
   const serverVersion = await resolveServerVersion(runtime, options, existing?.config ?? null);
-  const config = {
+  const configWithoutBucket = {
     schemaVersion: CONFIG_SCHEMA_VERSION,
     assetContract: ASSET_CONTRACT,
     serverVersion,
@@ -3203,17 +3335,24 @@ var setupServer = async (args, runtime, store) => {
     ...validateExposure(existing?.config ?? null, options)
   };
   const assets = await resolveAssets(runtime, serverVersion, existing, store, options);
+  const bucket = composeBucket(assets.compose);
+  const config = {
+    ...configWithoutBucket,
+    ...bucket === void 0 ? {} : { bucket }
+  };
   const secrets = savedSecrets ?? createSecrets(runtime);
   const generation = persistSetup(store, config, secrets, assets);
   await checkComposeImages(runtime, { directory: generation.directory, config });
   const ownership2 = await claimServerDockerVolumes(runtime, {
     dockerContext: config.dockerContext,
-    identityBytes: Buffer.from(generation.files.identity)
+    identityBytes: Buffer.from(generation.files.identity),
+    namespace: namespaceOf(config)
   });
   if (ownership2._tag === "error") throw setupError(ownership2.error.message);
   await checkLocalImages(runtime, config, options.offline ? "local" : "pull-missing");
   storeValue(store.activate(generation));
   await startCompose(runtime, config, generation);
+  await initGarage(runtime, { directory: generation.directory, config }, secrets);
   await probeHealth(runtime, config.appUrl, config.serverVersion);
   runtime.writeLine(`Mend ${config.serverVersion} is reachable at ${config.appUrl}`);
   runtime.writeLine(
@@ -3278,7 +3417,7 @@ var composeCommand = async (runtime, installation, args) => {
 var interruptionNotice = (runtime) => runtime.writeLine(
   "Connections will be interrupted. Workspace containers and data are retained, but active work can lose connectivity and may need reconnection. Mend does not stop workspace containers."
 );
-var startInstallation = async (runtime, installation) => {
+var startInstallation = async (runtime, installation, secrets) => {
   startingNotice(runtime, installation.config.serverVersion);
   await composeCommand(runtime, installation, [
     "up",
@@ -3288,6 +3427,7 @@ var startInstallation = async (runtime, installation) => {
     "never",
     "--no-build"
   ]);
+  await initGarage(runtime, installation, secrets);
   await probeHealth(runtime, installation.config.appUrl, installation.config.serverVersion);
   runtime.writeLine(
     `Mend ${installation.config.serverVersion} is reachable at ${installation.config.appUrl}`
@@ -3325,11 +3465,17 @@ var upgradeServer = async (args, runtime, store, existing) => {
   const previous = storeValue(store.readActive());
   if (previous === null) throw setupError("The active server generation is missing.");
   const assets = await resolveAssets(runtime, version, existing, store, options);
-  const { registryPort: _legacyRegistryPort, ...carried } = existing.config;
+  const {
+    registryPort: _legacyRegistryPort,
+    bucket: _previousBucket,
+    ...carried
+  } = existing.config;
+  const bucket = composeBucket(assets.compose);
   const config = {
     ...carried,
     assetContract: ASSET_CONTRACT,
-    serverVersion: version
+    serverVersion: version,
+    ...bucket === void 0 ? {} : { bucket }
   };
   const secrets = parseSecrets(previous.files.identity);
   const files = {
@@ -3347,6 +3493,14 @@ var upgradeServer = async (args, runtime, store, existing) => {
   const target = storeValue(store.prepare(files));
   const installation = { directory: target.directory, config };
   await checkComposeImages(runtime, installation);
+  if (config.bucket === "garage" && existing.config.bucket !== "garage") {
+    const ownership2 = await claimServerDockerVolumes(runtime, {
+      dockerContext: config.dockerContext,
+      identityBytes: Buffer.from(previous.files.identity),
+      namespace: namespaceOf(config)
+    });
+    if (ownership2._tag === "error") throw setupError(ownership2.error.message);
+  }
   const running = await composeCommand(runtime, existing, [
     "ps",
     "--status",
@@ -3394,7 +3548,7 @@ var upgradeServer = async (args, runtime, store, existing) => {
       recovery = "Could not reselect the previous generation. Inspect active before retrying any command.";
     else if (appWasRunning) {
       try {
-        await startInstallation(runtime, existing);
+        await startInstallation(runtime, existing, secrets);
         recovery = "Previous pin and app recovered.";
       } catch {
         recovery = "Previous pin retained, but the old app could not recover. Run mend server start after fixing Docker.";
@@ -3406,7 +3560,7 @@ var upgradeServer = async (args, runtime, store, existing) => {
     );
   }
   try {
-    await startInstallation(runtime, installation);
+    await startInstallation(runtime, installation, secrets);
   } catch {
     throw setupError(
       `Mend ${version} startup, exact-version health or registry verification failed; migrations may have begun. The target pin remains active. Do NOT downgrade or restore the database automatically. Run mend server logs --tail 100 and mend server status; fix the target, then mend server start --offline. Previous generation: ${previous.directory}. Target generation: ${target.directory}. Database backup and recovery record: ${backup.directory}.`
@@ -3456,9 +3610,11 @@ var manageServer = async (command, args, runtime, store) => {
   if (identity === null) throw setupError("The persisted server identity is missing.");
   const ownership2 = await verifyServerDockerVolumes(runtime, {
     dockerContext: installation.config.dockerContext,
-    identityBytes: Buffer.from(identity)
+    identityBytes: Buffer.from(identity),
+    namespace: namespaceOf(installation.config)
   });
   if (ownership2._tag === "error") throw setupError(ownership2.error.message);
+  const secrets = parseSecrets(identity);
   if (command === "upgrade") return upgradeServer(args, runtime, store, installation);
   if (command === "logs") {
     let tail = 100;
@@ -3488,7 +3644,7 @@ var manageServer = async (command, args, runtime, store) => {
     interruptionNotice(runtime);
     await composeCommand(runtime, installation, ["stop", "--timeout", "30"]);
     runtime.writeLine(
-      "Mend and Postgres stopped. Volumes, configuration and workspace containers are retained."
+      `Mend, Postgres${installation.config.bucket === "garage" ? " and Garage" : ""} stopped. Volumes, configuration and workspace containers are retained.`
     );
     return;
   }
@@ -3497,7 +3653,7 @@ var manageServer = async (command, args, runtime, store) => {
     interruptionNotice(runtime);
     await composeCommand(runtime, installation, ["stop", "--timeout", "30", "mend"]);
   }
-  await startInstallation(runtime, installation);
+  await startInstallation(runtime, installation, secrets);
 };
 var nodeServerRuntime = () => {
   const environment = { ...process.env };
@@ -4009,6 +4165,26 @@ var removeManagedBlock = (config, beginMarker, endMarker) => {
   }
   return success(`${config.slice(0, begin)}${after}`);
 };
+var stripManagedWorkspaceSshBlocks = (existing) => {
+  let config = existing;
+  let removed = 0;
+  const aliases = [
+    ...config.matchAll(/^# >>> mend workspace ssh (mend-ws-[a-z0-9-]+) \(managed\) >>>$/gm)
+  ].map((match) => match[1]).filter((alias) => alias !== void 0);
+  for (const alias of new Set(aliases)) {
+    const stripped = removeManagedBlock(config, blockBegin(alias), blockEnd(alias));
+    if (!stripped.ok) return stripped;
+    config = stripped.value;
+    removed += 1;
+  }
+  if (config.includes(LEGACY_BLOCK_BEGIN)) {
+    const stripped = removeManagedBlock(config, LEGACY_BLOCK_BEGIN, LEGACY_BLOCK_END);
+    if (!stripped.ok) return stripped;
+    config = stripped.value;
+    removed += 1;
+  }
+  return success({ config, removed });
+};
 var containsExactHost = (config, alias) => config.split("\n").some((line) => {
   const match = /^\s*Host\s+(.+?)\s*$/i.exec(line);
   return match?.[1]?.split(/\s+/).includes(alias) === true;
@@ -4353,22 +4529,308 @@ var sshCommand = async (args, api2, cliHome, serverUrl) => {
   }
 };
 
+// src/uninstall.ts
+import * as fs8 from "node:fs";
+import * as path9 from "node:path";
+var UNINSTALL_USAGE = "usage: mend uninstall [--all | --server | --home] [--yes]";
+var parseUninstallArgs = (args) => {
+  let scope = null;
+  let yes = false;
+  for (const arg of args) {
+    if (arg === "--yes" || arg === "-y") {
+      yes = true;
+      continue;
+    }
+    const next = arg === "--all" ? "all" : arg === "--server" ? "server" : arg === "--home" ? "home" : null;
+    if (next === null) return { error: `${UNINSTALL_USAGE} \xB7 "${arg}" is not an option` };
+    if (scope !== null && scope !== next) {
+      return { error: `${UNINSTALL_USAGE} \xB7 pick one scope` };
+    }
+    scope = next;
+  }
+  return { scope, yes };
+};
+var SERVER_FILES = ["identity.env", "active", "generations", "backups"];
+var countEntries = (directory) => {
+  try {
+    return fs8.readdirSync(directory).length;
+  } catch {
+    return 0;
+  }
+};
+var exists = (file) => {
+  try {
+    fs8.lstatSync(file);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var managedBlockCount = (sshConfigFile) => {
+  let config;
+  try {
+    config = fs8.readFileSync(sshConfigFile, "utf8");
+  } catch {
+    return 0;
+  }
+  const stripped = stripManagedWorkspaceSshBlocks(config);
+  return stripped.ok ? stripped.value.removed : 0;
+};
+var describeUninstall = async (runtime, scope) => {
+  let server = null;
+  if (scope !== "home") {
+    const configDir = runtime.server.configDir;
+    const read = await withServerStore(
+      configDir,
+      async (store) => {
+        const installation = readServerInstallation(store);
+        if (installation._tag === "error") throw installation.error;
+        return installation.value;
+      },
+      { create: false }
+    );
+    if (read._tag === "error") {
+      if (!read.error.message.startsWith("No Mend server is configured")) throw read.error;
+      server = "none";
+    } else if (read.value === null) {
+      server = exists(path9.join(configDir, "identity.env")) ? {
+        version: "(no active generation)",
+        appUrl: "",
+        dockerContext: "",
+        generations: countEntries(path9.join(configDir, "generations")),
+        backups: countEntries(path9.join(configDir, "backups"))
+      } : "none";
+    } else {
+      server = {
+        version: read.value.config.serverVersion,
+        appUrl: read.value.config.appUrl,
+        dockerContext: read.value.config.dockerContext,
+        generations: countEntries(path9.join(configDir, "generations")),
+        backups: countEntries(path9.join(configDir, "backups"))
+      };
+    }
+  }
+  let home = null;
+  if (scope !== "server") {
+    const cliConfig = path9.join(runtime.cliHome, "cli.json");
+    const sshDirectory = path9.join(runtime.cliHome, "ssh");
+    home = {
+      cliConfig: exists(cliConfig) ? cliConfig : null,
+      sshDirectory: exists(sshDirectory) ? sshDirectory : null,
+      managedSshBlocks: managedBlockCount(runtime.sshConfigFile),
+      signedIn: runtime.signedIn
+    };
+  }
+  return { scope, server, home };
+};
+var plural = (count, noun) => `${count} ${noun}${count === 1 ? "" : "s"}`;
+var planLines = (plan, configDir) => {
+  const lines = [];
+  if (plan.server === "none") {
+    lines.push(`server   none installed under ${configDir}`);
+  } else if (plan.server !== null) {
+    const { version, appUrl, dockerContext, generations, backups } = plan.server;
+    lines.push(
+      `server   Mend ${version}${appUrl === "" ? "" : ` at ${appUrl}`}${dockerContext === "" ? "" : ` \xB7 docker context ${dockerContext}`}`
+    );
+    if (dockerContext !== "") {
+      lines.push(
+        `         containers mend, postgres, garage \xB7 volumes ${[MEND_DOCKER_NAMESPACE_WITH_GARAGE.store, ...secondaryVolumesOf(MEND_DOCKER_NAMESPACE_WITH_GARAGE), "mend-config", "mend-ssh", "mend-postgres"].join(", ")} \xB7 image ghcr.io/sealant-sh/mend:${version}`
+      );
+    }
+    lines.push(
+      `         ${configDir}: identity.env, active, ${plural(generations, "generation")}, ${plural(backups, "backup")}`
+    );
+  }
+  if (plan.home !== null) {
+    const parts = [];
+    if (plan.home.cliConfig !== null) {
+      parts.push(
+        plan.home.signedIn === null ? plan.home.cliConfig : `${plan.home.cliConfig} (signed in to ${plan.home.signedIn.url})`
+      );
+    }
+    if (plan.home.sshDirectory !== null) parts.push(plan.home.sshDirectory);
+    if (plan.home.managedSshBlocks > 0) {
+      parts.push(`${plural(plan.home.managedSshBlocks, "managed block")} in ~/.ssh/config`);
+    }
+    lines.push(parts.length === 0 ? "home     nothing of Mend's here" : `home     ${parts[0]}`);
+    for (const part of parts.slice(1)) lines.push(`         ${part}`);
+  }
+  return lines;
+};
+var planDeletesData = (plan) => plan.server !== null && plan.server !== "none";
+var dockerArgs = (context, ...rest) => [
+  "--context",
+  context,
+  ...rest
+];
+var removeServer = async (runtime, failures, leftovers) => {
+  const { server } = runtime;
+  const configDir = server.configDir;
+  const result = await withServerStore(
+    configDir,
+    async (store) => {
+      const read = readServerInstallation(store);
+      if (read._tag === "error") throw read.error;
+      const installation = read.value;
+      if (installation !== null) {
+        const context = installation.config.dockerContext;
+        const down = await server.run(
+          "docker",
+          serverComposeArgs({ directory: installation.directory, dockerContext: context }, [
+            "down",
+            "--volumes",
+            "--remove-orphans",
+            "--timeout",
+            "30"
+          ]),
+          { timeoutMs: serverProcessDeadlines.stop }
+        );
+        if (down.status !== 0) {
+          throw new Error(
+            `docker compose down failed: ${(down.error ?? down.stderr.trim()) || "no output"}. Containers and files are retained; fix Docker and run mend uninstall again.`
+          );
+        }
+        server.writeLine("removed containers mend, postgres, garage and the Compose-owned volumes");
+        const namespace = installation.config.bucket === "garage" ? MEND_DOCKER_NAMESPACE_WITH_GARAGE : MEND_DOCKER_NAMESPACE;
+        const dataVolumes = [namespace.store, ...secondaryVolumesOf(namespace)];
+        const identity = store.readIdentity();
+        if (identity._tag === "error") throw identity.error;
+        const owned = identity.value === null ? null : await verifyServerDockerVolumes(server, {
+          dockerContext: context,
+          identityBytes: Buffer.from(identity.value),
+          namespace
+        });
+        if (owned !== null && owned._tag === "ok") {
+          const removed = await server.run(
+            "docker",
+            dockerArgs(context, "volume", "rm", ...dataVolumes)
+          );
+          if (removed.status === 0) {
+            server.writeLine(`removed volumes ${dataVolumes.join(", ")}`);
+          } else {
+            failures.push(
+              `could not remove volumes ${dataVolumes.join(", ")}: ${(removed.error ?? removed.stderr.trim()) || "no output"}`
+            );
+          }
+        } else if (owned !== null && owned.error.reason === "missing") {
+          server.writeLine(`volumes ${dataVolumes.join(", ")} were already gone`);
+        } else {
+          leftovers.push(
+            `volumes ${dataVolumes.join(", ")}: ownership could not be confirmed for this installation, so they stay (docker --context ${context} volume ls)`
+          );
+        }
+        const image = `ghcr.io/sealant-sh/mend:${installation.config.serverVersion}`;
+        const untagged = await server.run("docker", dockerArgs(context, "image", "rm", image));
+        if (untagged.status === 0) server.writeLine(`removed image ${image}`);
+        else leftovers.push(`image ${image}: not removed (${untagged.stderr.trim() || "absent"})`);
+        const workspaces = await server.run(
+          "docker",
+          dockerArgs(
+            context,
+            "container",
+            "ls",
+            "--all",
+            "--filter",
+            "name=^sealant-",
+            "--format",
+            "{{.Names}}"
+          )
+        );
+        const names = workspaces.stdout.split(/\s+/).filter((name) => name !== "");
+        if (workspaces.status === 0 && names.length > 0) {
+          leftovers.push(
+            `${plural(names.length, "workspace container")} left on docker context ${context} (${names.slice(0, 3).join(", ")}${names.length > 3 ? ", \u2026" : ""}): docker --context ${context} rm -f ${names.join(" ")}`
+          );
+        }
+      }
+      for (const name of SERVER_FILES) {
+        fs8.rmSync(path9.join(configDir, name), { recursive: true, force: true });
+      }
+      server.writeLine(`removed ${configDir}/{identity.env, active, generations, backups}`);
+    },
+    { create: false }
+  );
+  if (result._tag === "error") failures.push(result.error.message);
+};
+var removeHome = async (runtime, plan, failures, leftovers) => {
+  const { server } = runtime;
+  if (plan.cliConfig !== null) {
+    fs8.rmSync(plan.cliConfig, { force: true });
+    server.writeLine(`removed ${plan.cliConfig}`);
+  }
+  if (plan.sshDirectory !== null) {
+    fs8.rmSync(plan.sshDirectory, { recursive: true, force: true });
+    server.writeLine(`removed ${plan.sshDirectory}`);
+  }
+  if (plan.managedSshBlocks > 0) {
+    try {
+      const before = fs8.readFileSync(runtime.sshConfigFile, "utf8");
+      const stripped = stripManagedWorkspaceSshBlocks(before);
+      if (!stripped.ok) throw stripped.error;
+      if (stripped.value.removed > 0) {
+        fs8.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
+        server.writeLine(
+          `removed ${plural(stripped.value.removed, "managed block")} from ${runtime.sshConfigFile}`
+        );
+      }
+    } catch (cause) {
+      failures.push(
+        `${runtime.sshConfigFile}: ${cause instanceof Error ? cause.message : String(cause)}`
+      );
+    }
+  }
+  let remaining = [];
+  try {
+    remaining = fs8.readdirSync(runtime.cliHome);
+  } catch {
+    return;
+  }
+  if (remaining.length === 0) {
+    fs8.rmdirSync(runtime.cliHome);
+    server.writeLine(`removed ${runtime.cliHome}`);
+  } else {
+    leftovers.push(
+      `${runtime.cliHome} kept: ${remaining.join(", ")} ${remaining.length === 1 ? "is" : "are"} not this CLI's (a host-run server's store or keys, or another tool's files)`
+    );
+  }
+};
+var executeUninstall = async (runtime, plan) => {
+  const failures = [];
+  const leftovers = [];
+  if (plan.home?.signedIn !== null && plan.home?.signedIn?.deviceId != null) {
+    const failure2 = await runtime.revokeDevice();
+    if (failure2 === null) {
+      runtime.server.writeLine(`revoked this terminal's device on ${plan.home.signedIn.url}`);
+    } else {
+      leftovers.push(
+        `device token on ${plan.home.signedIn.url}: ${failure2} (end it under Settings \u2192 Devices)`
+      );
+    }
+  }
+  if (plan.server !== null && plan.server !== "none") {
+    await removeServer(runtime, failures, leftovers);
+  }
+  if (plan.home !== null) await removeHome(runtime, plan.home, failures, leftovers);
+  return { failures, leftovers };
+};
+
 // src/main.ts
 var mendCliHome = () => {
   const xdg = process.env["XDG_CONFIG_HOME"];
-  const preferred = path9.join(
-    xdg === void 0 || xdg === "" ? path9.join(os6.homedir(), ".config") : xdg,
+  const preferred = path10.join(
+    xdg === void 0 || xdg === "" ? path10.join(os6.homedir(), ".config") : xdg,
     "mend"
   );
-  const legacy = path9.join(os6.homedir(), ".mend");
-  return !fs8.existsSync(preferred) && fs8.existsSync(legacy) ? legacy : preferred;
+  const legacy = path10.join(os6.homedir(), ".mend");
+  return !fs9.existsSync(preferred) && fs9.existsSync(legacy) ? legacy : preferred;
 };
-var CONFIG_PATH = path9.join(mendCliHome(), "cli.json");
+var CONFIG_PATH = path10.join(mendCliHome(), "cli.json");
 var loadConfig = () => {
   let fileConfig = {};
-  if (fs8.existsSync(CONFIG_PATH)) {
+  if (fs9.existsSync(CONFIG_PATH)) {
     try {
-      fileConfig = JSON.parse(fs8.readFileSync(CONFIG_PATH, "utf8"));
+      fileConfig = JSON.parse(fs9.readFileSync(CONFIG_PATH, "utf8"));
     } catch {
       fail4(`could not parse ${CONFIG_PATH}`);
     }
@@ -4505,7 +4967,7 @@ var adopt = async (config, args) => {
   }
   const sourceIssue = repositoryCloneUrlIssue(source);
   if (sourceIssue !== null) return fail4(sourceIssue);
-  const projectName = name ?? normalizeProjectName(path9.basename(source, ".git"));
+  const projectName = name ?? normalizeProjectName(path10.basename(source, ".git"));
   const auth = authFlagIndex !== -1 && args[authFlagIndex + 1] !== void 0 ? String(args[authFlagIndex + 1]) : null;
   if (auth !== null && auth !== "ambient" && auth !== "mend-key" && auth !== "bridge") {
     return fail4(`--auth takes "ambient", "mend-key", or "bridge", not "${auth}"`);
@@ -4550,7 +5012,7 @@ var findProject = async (config, explicit, adoptCwd = false) => {
   const sourceIssue = repositoryCloneUrlIssue(facts.originUrl);
   if (sourceIssue !== null) return fail4(sourceIssue);
   const adopted = await api(config, "POST", "/projects", {
-    name: normalizeProjectName(path9.basename(facts.repoRoot)),
+    name: normalizeProjectName(path10.basename(facts.repoRoot)),
     source: facts.originUrl
   });
   say4(`${green4("\u2713")} adopted \xB7 ${adopted.name} \xB7 ${dim4(adopted.storePath)}`);
@@ -5341,13 +5803,13 @@ var serviceRestart = async (config, args) => {
 };
 var serviceInit = async (args) => {
   const root = gitTopLevel(process.cwd()) ?? process.cwd();
-  const target = path9.join(root, "mend.toml");
-  if (fs8.existsSync(target)) {
+  const target = path10.join(root, "mend.toml");
+  if (fs9.existsSync(target)) {
     return fail4(`${target} already exists \u2014 edit it directly (init never merges)`);
   }
-  const rootFiles = fs8.readdirSync(root);
+  const rootFiles = fs9.readdirSync(root);
   const proposals = [];
-  const readRoot = (name) => fs8.readFileSync(path9.join(root, name), "utf8");
+  const readRoot = (name) => fs9.readFileSync(path10.join(root, name), "utf8");
   if (rootFiles.includes("package.json")) {
     proposals.push(...proposeFromPackageJson(readRoot("package.json"), rootFiles));
   }
@@ -5357,13 +5819,13 @@ var serviceInit = async (args) => {
   );
   for (const glob of globs) {
     const parent = glob.replace(/\/?\*+$/, "");
-    const dirs = glob.endsWith("*") ? fs8.existsSync(path9.join(root, parent)) ? fs8.readdirSync(path9.join(root, parent)).map((dir) => path9.join(parent, dir)) : [] : [glob];
+    const dirs = glob.endsWith("*") ? fs9.existsSync(path10.join(root, parent)) ? fs9.readdirSync(path10.join(root, parent)).map((dir) => path10.join(parent, dir)) : [] : [glob];
     for (const dir of dirs) {
-      const manifest = path9.join(root, dir, "package.json");
-      if (!fs8.existsSync(manifest)) continue;
+      const manifest = path10.join(root, dir, "package.json");
+      if (!fs9.existsSync(manifest)) continue;
       for (const proposal of proposeFromWorkspacePackage(
-        path9.basename(dir),
-        fs8.readFileSync(manifest, "utf8"),
+        path10.basename(dir),
+        fs9.readFileSync(manifest, "utf8"),
         rootFiles
       )) {
         if (!proposals.some((existing) => existing.name === proposal.name)) {
@@ -5407,7 +5869,7 @@ var serviceInit = async (args) => {
       return;
     }
   }
-  fs8.writeFileSync(target, toml);
+  fs9.writeFileSync(target, toml);
   say4(`${green4("\u2713")} wrote ${target} \u2014 commit it, then: mend service run ${proposals[0]?.name}`);
 };
 var tunnelServices = async (config, services, portOverride) => {
@@ -5500,18 +5962,18 @@ var serviceCommand = async (config, args) => {
   }
 };
 var isProvider = (value) => value === "claude" || value === "codex" || value === "github";
-var readIfExists = (file) => fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : null;
+var readIfExists = (file) => fs9.existsSync(file) ? fs9.readFileSync(file, "utf8") : null;
 var localCredential = (provider) => {
   const home = os6.homedir();
   switch (provider) {
     case "codex":
       return readIfExists(
-        path9.join(process.env["CODEX_HOME"] ?? path9.join(home, ".codex"), "auth.json")
+        path10.join(process.env["CODEX_HOME"] ?? path10.join(home, ".codex"), "auth.json")
       );
     case "claude":
       return readIfExists(
-        path9.join(
-          process.env["CLAUDE_CONFIG_DIR"] ?? path9.join(home, ".claude"),
+        path10.join(
+          process.env["CLAUDE_CONFIG_DIR"] ?? path10.join(home, ".claude"),
           ".credentials.json"
         )
       );
@@ -5565,7 +6027,7 @@ var connectCommand = async (config, args) => {
   }
   let secret;
   if (flags.includes("--from-stdin")) {
-    secret = fs8.readFileSync(0, "utf8").trim();
+    secret = fs9.readFileSync(0, "utf8").trim();
     if (secret === "") return fail4("nothing on stdin");
   } else {
     secret = localCredential(provider);
@@ -5586,14 +6048,14 @@ var takeFlagValue3 = (args, flag) => {
   return at !== -1 && args[at + 1] !== void 0 ? String(args[at + 1]) : null;
 };
 var saveCliConfig = (next) => {
-  fs8.mkdirSync(path9.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
-  fs8.writeFileSync(
+  fs9.mkdirSync(path10.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
+  fs9.writeFileSync(
     CONFIG_PATH,
     `${JSON.stringify({ url: next.url, token: next.token, deviceId: next.deviceId }, null, 2)}
 `,
     { mode: 384 }
   );
-  fs8.chmodSync(CONFIG_PATH, 384);
+  fs9.chmodSync(CONFIG_PATH, 384);
 };
 var login = async (config, args) => {
   await loginCommand(args, {
@@ -5606,7 +6068,7 @@ var login = async (config, args) => {
   });
 };
 var logout = async (config) => {
-  if (!fs8.existsSync(CONFIG_PATH) && config.token === null) {
+  if (!fs9.existsSync(CONFIG_PATH) && config.token === null) {
     say4(dim4("nothing saved \u2014 already signed out"));
     return;
   }
@@ -5621,6 +6083,80 @@ var logout = async (config) => {
   saveCliConfig({ ...config, token: null, deviceId: null });
   say4(`${green4("\u2713")} signed out \xB7 ${dim4(`token removed from ${CONFIG_PATH}`)}`);
 };
+var UNINSTALL_CHOICES = [
+  { scope: "all", text: "everything \xB7 the server on this machine and this machine's Mend files" },
+  { scope: "server", text: "the server only \xB7 containers, volumes, configuration, backups" },
+  {
+    scope: "home",
+    text: "this machine's files only \xB7 sign-in, workspace ssh key, ~/.ssh/config block"
+  }
+];
+var askUninstallScope = async () => {
+  if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
+    return fail4(`${UNINSTALL_USAGE} \xB7 no terminal to ask on`);
+  }
+  say4("what should go?");
+  UNINSTALL_CHOICES.forEach((choice, index) => say4(`  ${index + 1}. ${choice.text}`));
+  const readline = await import("node:readline/promises");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = (await rl.question("  1, 2 or 3: ")).trim();
+  rl.close();
+  const chosen = UNINSTALL_CHOICES[Number(answer) - 1];
+  if (chosen === void 0) return fail4(`"${answer}" is not one of the choices`);
+  return chosen.scope;
+};
+var confirmUninstall = async (word) => {
+  if (process.stdin.isTTY !== true) return fail4("non-interactive \u2014 pass --yes to remove");
+  const readline = await import("node:readline/promises");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = (await rl.question(word === "y" ? "remove? [y/N] " : `type ${word} to remove: `)).trim().toLowerCase();
+  rl.close();
+  return answer === word;
+};
+var uninstallCommand = async (config, args) => {
+  const parsed = parseUninstallArgs(args);
+  if ("error" in parsed) return fail4(parsed.error);
+  const scope = parsed.scope ?? await askUninstallScope();
+  const server = nodeServerRuntime();
+  const runtime = {
+    server,
+    cliHome: mendCliHome(),
+    sshConfigFile: path10.join(os6.homedir(), ".ssh", "config"),
+    signedIn: config.token === null || !fs9.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
+    revokeDevice: async () => {
+      if (config.deviceId === null) return "no device id saved";
+      try {
+        await request(config, "DELETE", `/me/devices/${config.deviceId}`);
+        return null;
+      } catch (error) {
+        return error instanceof Error ? error.message : String(error);
+      }
+    }
+  };
+  const plan = await describeUninstall(runtime, scope);
+  say4(dim4(`mend uninstall \xB7 ${scope === "all" ? "everything" : scope}`));
+  for (const line of planLines(plan, server.configDir)) say4(`  ${line}`);
+  const nothing = (plan.server === null || plan.server === "none") && (plan.home === null || plan.home.cliConfig === null && plan.home.sshDirectory === null && plan.home.managedSshBlocks === 0);
+  if (nothing) {
+    say4(dim4("nothing to remove"));
+    return;
+  }
+  if (planDeletesData(plan)) {
+    say4("repositories, worktrees, the database and its backups are deleted with the server");
+  }
+  if (!parsed.yes && !await confirmUninstall(planDeletesData(plan) ? "delete" : "y")) {
+    say4(dim4("nothing removed"));
+    return;
+  }
+  const outcome = await executeUninstall(runtime, plan);
+  for (const line of outcome.leftovers) say4(dim4(`  kept \xB7 ${line}`));
+  if (outcome.failures.length > 0) {
+    return fail4(outcome.failures.join("\n"));
+  }
+  say4(
+    `${green4("\u2713")} ${scope === "all" ? "Mend is gone from this machine" : scope === "server" ? "the server is gone from this machine" : "this machine no longer holds Mend files"}`
+  );
+};
 var printGitKey = (key) => {
   if (key.publicKey === null) return;
   say4(key.publicKey);
@@ -5795,10 +6331,10 @@ var envLoad = async (config, args) => {
   const positional = args.filter(
     (arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project" && !consumed.has(i)
   );
-  const file = path9.resolve(positional[0] ?? ".env");
+  const file = path10.resolve(positional[0] ?? ".env");
   let contents;
   try {
-    contents = fs8.readFileSync(file, "utf8");
+    contents = fs9.readFileSync(file, "utf8");
   } catch {
     return fail4(`cannot read ${file} \u2014 pass a path: mend env load path/to/.env`);
   }
@@ -5814,10 +6350,10 @@ var envLoad = async (config, args) => {
     { contents, allSecret, secretNames }
   );
   if (report.loaded.length === 0 && report.rejected.length === 0 && report.malformedLines.length === 0) {
-    say4(dim4(`${path9.basename(file)} has no variables`));
+    say4(dim4(`${path10.basename(file)} has no variables`));
     return;
   }
-  say4(`${green4("\u2713")} loaded ${path9.basename(file)} into ${project2.name}`);
+  say4(`${green4("\u2713")} loaded ${path10.basename(file)} into ${project2.name}`);
   for (const line of formatLoadReport(report, { dim: dim4, warn: amber })) say4(line);
   const plaintextUrls = report.loaded.filter(
     (entry) => entry.lane === "configuration" && /_(URL|URI|DSN)$/.test(entry.name)
@@ -6006,7 +6542,7 @@ var skillsList = async (config, args) => {
 };
 var skillsPush = async (config, args) => {
   const dirFlag = takeFlagValue3(args, "--dir");
-  const root = dirFlag === null ? path9.join(os6.homedir(), DEFAULT_SKILLS_DIR) : path9.resolve(dirFlag);
+  const root = dirFlag === null ? path10.join(os6.homedir(), DEFAULT_SKILLS_DIR) : path10.resolve(dirFlag);
   const scanned = scanSkillLibrary(root);
   if ("error" in scanned) return fail4(scanned.error);
   for (const note of scanned.notes) say4(dim4(`  ${note.skill}: ${note.message}`));
@@ -6076,6 +6612,7 @@ _mend() {
     'shell:open a shell in a live session workspace'
     'service:reachable ports \u2014 add, list, stop'
     'server:local server setup, lifecycle and upgrades'
+    'uninstall:remove the server, local Mend files, or both'
     'keys:the machine Mend deploy key \u2014 init, show, share'
     'skills:skill libraries \u2014 list, push'
     'accounts:your connected accounts on the platform'
@@ -6115,7 +6652,7 @@ _mend "$@"
 var BASH_COMPLETIONS = `_mend() {
   local cur=\${COMP_WORDS[COMP_CWORD]}
   if [ "$COMP_CWORD" -eq 1 ]; then
-    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach stop shell service server keys skills pair doctor continue resume rejoin refresh projects sessions status ui help" -- "$cur") )
+    COMPREPLY=( $(compgen -W "adopt codex claude opencode run attach stop shell service server uninstall keys skills pair doctor continue resume rejoin refresh projects sessions status ui help" -- "$cur") )
     return
   fi
   case \${COMP_WORDS[1]} in
@@ -6650,7 +7187,7 @@ var dashboard = async (config) => {
     );
     process.exit(rerun.status ?? 0);
   }
-  const { runDashboard } = await import("./dashboard-JIWYW3EM.js");
+  const { runDashboard } = await import("./dashboard-5CBGTPSJ.js");
   const agentShare = await startShareIfBridge(config);
   try {
     await runDashboard({
@@ -6720,10 +7257,10 @@ var manCommand = (words) => {
   }
   const version = cliVersion();
   const page = doc === null ? renderManIndex(version) : renderManPage(doc, version);
-  const file = path9.join(os6.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
-  fs8.writeFileSync(file, page);
+  const file = path10.join(os6.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
+  fs9.writeFileSync(file, page);
   const result = spawnSync2("man", ["-l", file], { stdio: "inherit" });
-  fs8.rmSync(file, { force: true });
+  fs9.rmSync(file, { force: true });
   if (result.error !== void 0 || result.status !== 0) {
     say4(doc === null ? renderIndex() : renderCommand(doc));
   }
@@ -6760,6 +7297,8 @@ var main = async () => {
       return login(config, rest);
     case "logout":
       return logout(config);
+    case "uninstall":
+      return uninstallCommand(config, rest);
     case "keys":
       return keysCommand(config, rest);
     case "dotfiles":