@sealant/mend 0.28.0 → 0.29.0

package/dist/main.js

@@ -4,6 +4,7 @@ import {
   LIVE_STATUSES,
   agentIsLive,
   agentOutcome,
+  claudeGrantFacts,
   cwdFacts,
   gitCurrentBranch,
   gitOriginUrl,
@@ -11,32 +12,27 @@ import {
   isDetachChunk,
   isPasteChunk,
   matchProjectByCwd,
+  narrowCredential,
   normalizeProjectName,
   parseLaunchArgs,
   pasteBytes,
   repositoryCloneUrlIssue,
+  sameGrant,
   sessionDisplayName,
   trackBracketedPaste
-} from "./chunk-7JPOKREB.js";
+} from "./chunk-F6AJNFVE.js";
 
 // src/main.ts
-import { spawn as spawn3, spawnSync as spawnSync2 } from "node:child_process";
-import * as fs9 from "node:fs";
+import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
+import * as fs11 from "node:fs";
 import { createRequire } from "node:module";
 import * as net3 from "node:net";
-import * as os6 from "node:os";
-import * as path10 from "node:path";
+import * as os7 from "node:os";
+import * as path12 from "node:path";
 
 // src/agent-share.ts
 import * as net from "node:net";
 import { setTimeout as delay } from "node:timers/promises";
-var bridgeUrlOf = (serverUrl, token, host) => {
-  const url = new URL(`${serverUrl}/api/keys/bridge/ws`);
-  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  url.searchParams.set("host", host);
-  if (token !== null) url.searchParams.set("token", token);
-  return url;
-};
 var retryDelayMs = (attempt2) => Math.min(3e4, 1e3 * 2 ** Math.min(Math.max(attempt2 - 1, 0), 5));
 var SSH_AGENTC_REQUEST_IDENTITIES = 11;
 var SSH_AGENTC_SIGN_REQUEST = 13;
@@ -71,7 +67,17 @@ var shareAgent = async (options) => {
   let chain = Promise.resolve();
   let attempt2 = 0;
   while (!signal.aborted) {
-    const ws = new WebSocket(url);
+    let target;
+    try {
+      target = await url();
+    } catch {
+      attempt2 += 1;
+      const retryMs2 = retryDelayMs(attempt2);
+      onEvent({ kind: "disconnected", retryMs: retryMs2 });
+      await sleep(retryMs2, signal);
+      continue;
+    }
+    const ws = new WebSocket(target);
     const onAbort = () => ws.close();
     signal.addEventListener("abort", onAbort, { once: true });
     const closed = new Promise((resolve4) => {
@@ -157,6 +163,75 @@ var startAgentShare = (options) => {
   };
 };
 
+// src/claude-grant.ts
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+var claudeGrantDir = (home) => path.join(home, "claude-grant");
+var personalClaudeDir = (environment = process.env) => {
+  const configured = environment["CLAUDE_CONFIG_DIR"];
+  return configured === void 0 || configured === "" ? path.join(os.homedir(), ".claude") : configured;
+};
+var keychainService = (configDir) => {
+  const suffix = createHash("sha256").update(configDir).digest("hex").slice(0, 8);
+  return `Claude Code-credentials-${suffix}`;
+};
+var claudeCli = (environment = process.env) => ({
+  bin: environment["MEND_CLAUDE_BIN"] ?? "claude",
+  env: environment
+});
+var grantStatus = (cli, configDir) => {
+  const result = spawnSync(cli.bin, ["auth", "status", "--json"], {
+    encoding: "utf8",
+    env: { ...cli.env, CLAUDE_CONFIG_DIR: configDir },
+    timeout: 6e4
+  });
+  if (result.error !== void 0 || typeof result.stdout !== "string") return null;
+  const start = result.stdout.indexOf("{");
+  if (start === -1) return null;
+  try {
+    const parsed = JSON.parse(result.stdout.slice(start));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const record = { ...parsed };
+    const text = (key) => typeof record[key] === "string" ? record[key] : null;
+    return {
+      loggedIn: record["loggedIn"] === true,
+      authMethod: text("authMethod"),
+      configDirectory: text("configDirectory"),
+      email: text("email"),
+      subscriptionType: text("subscriptionType")
+    };
+  } catch {
+    return null;
+  }
+};
+var runClaudeLogin = (cli, configDir) => {
+  fs.mkdirSync(configDir, { recursive: true, mode: 448 });
+  const result = spawnSync(cli.bin, ["auth", "login", "--claudeai"], {
+    stdio: "inherit",
+    env: { ...cli.env, CLAUDE_CONFIG_DIR: configDir }
+  });
+  return result.error === void 0 && result.status === 0;
+};
+var readGrant = (configDir, platform = process.platform) => {
+  const file = path.join(configDir, ".credentials.json");
+  if (fs.existsSync(file)) {
+    const secret2 = fs.readFileSync(file, "utf8").trim();
+    if (secret2 !== "") return { kind: "file", secret: secret2, path: file };
+  }
+  if (platform !== "darwin") return { kind: "missing", triedPath: file, triedService: null };
+  const service = keychainService(configDir);
+  const result = spawnSync(
+    "security",
+    ["find-generic-password", "-a", os.userInfo().username, "-w", "-s", service],
+    { encoding: "utf8", timeout: 6e4 }
+  );
+  const secret = typeof result.stdout === "string" ? result.stdout.trim() : "";
+  return result.status === 0 && secret !== "" ? { kind: "keychain", secret, service } : { kind: "missing", triedPath: file, triedService: service };
+};
+
 // src/clipboard.ts
 import { execFile } from "node:child_process";
 var IMAGE_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp"];
@@ -215,12 +290,13 @@ var readClipboardImage = async (platform = process.platform, env = process.env)
 };
 
 // src/doctor.ts
-import * as fs from "node:fs";
-import * as path from "node:path";
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
 var TIMEOUT_MS = 3e3;
 var MARKS = { ok: "\u2713", todo: "\u25CB", failed: "\u2717" };
 var LABEL_WIDTH = 11;
-var formatCheck = (check, paint4 = (_state, mark) => mark) => `${paint4(check.state, MARKS[check.state])} ${check.label.padEnd(LABEL_WIDTH)} ${check.detail}${check.fix === null ? "" : ` \u2192 ${check.fix}`}`;
+var day = (at) => at.toISOString().slice(0, 10);
+var formatCheck = (check, paint5 = (_state, mark) => mark) => `${paint5(check.state, MARKS[check.state])} ${check.label.padEnd(LABEL_WIDTH)} ${check.detail}${check.fix === null ? "" : ` \u2192 ${check.fix}`}`;
 var getJson = async (config, route) => {
   try {
     const response = await fetch(`${config.url}/api${route}`, {
@@ -233,6 +309,23 @@ var getJson = async (config, route) => {
     return { value: null, status: null };
   }
 };
+var exposureCheck = (exposure) => {
+  const beyondMachine = exposure.declared !== "loopback" && exposure.originOnMachine !== true;
+  const gateOpen = beyondMachine ? exposure.gateOpen : 0;
+  const facts = [
+    `declared ${exposure.declared}`,
+    `${exposure.originScheme} origin`,
+    ...exposure.arrivedVia === "trusted-proxy" ? ["arrived via a trusted proxy"] : [],
+    ...gateOpen === 0 ? [] : [`${gateOpen} gate items open`]
+  ].join(" \xB7 ");
+  const plainBeyondMachine = beyondMachine && exposure.originScheme === "http";
+  return {
+    label: "exposure",
+    state: plainBeyondMachine ? "todo" : "ok",
+    detail: facts,
+    fix: plainBeyondMachine ? "serve it over https and set APP_URL to that origin" : gateOpen === 0 ? null : "mend operator exposure"
+  };
+};
 var LOGIN_COMMANDS = {
   claude: "claude setup-token",
   codex: "codex login",
@@ -354,6 +447,39 @@ var runChecks = async (config, probes) => {
       }
     );
   }
+  const grant = probes.claudeGrant();
+  if (grant !== null) {
+    const facts = claudeGrantFacts(grant);
+    if (facts === null) {
+      checks.push({
+        label: "grant",
+        state: "failed",
+        detail: "unreadable",
+        fix: "mend connect claude"
+      });
+    } else if (!facts.hasRefreshToken) {
+      checks.push({
+        label: "grant",
+        state: "failed",
+        detail: "signed out",
+        fix: "mend connect claude"
+      });
+    } else if (facts.refreshExpiresAt !== null && facts.refreshExpiresAt.getTime() <= Date.now()) {
+      checks.push({
+        label: "grant",
+        state: "todo",
+        detail: `expired ${day(facts.refreshExpiresAt)}`,
+        fix: "mend connect claude"
+      });
+    } else {
+      checks.push({
+        label: "grant",
+        state: "ok",
+        detail: facts.refreshExpiresAt === null ? "Mend's own" : `Mend's own \xB7 expires ${day(facts.refreshExpiresAt)}`,
+        fix: null
+      });
+    }
+  }
   const adopted = projects === null ? null : projects.value;
   if (adopted === null) checks.push(notChecked("projects"));
   else if (adopted.length === 0) {
@@ -378,20 +504,15 @@ var runChecks = async (config, probes) => {
     );
   }
   const machine = signedIn ? await getJson(config, "/machine") : null;
-  const tailnet = machine === null || machine.value === null ? null : machine.value.tailnet;
-  if (tailnet === null) checks.push(notChecked("tailnet"));
-  else if (tailnet.status === "reachable" && tailnet.address !== null) {
-    checks.push({ label: "tailnet", state: "ok", detail: tailnet.address, fix: null });
-  } else {
-    checks.push({ label: "tailnet", state: "todo", detail: "not detected", fix: null });
-  }
+  const exposure = machine === null || machine.value === null ? void 0 : machine.value.exposure;
+  checks.push(exposure === void 0 ? notChecked("exposure") : exposureCheck(exposure));
   return checks;
 };
 var onPath = (command) => {
-  for (const directory of (process.env["PATH"] ?? "").split(path.delimiter)) {
+  for (const directory of (process.env["PATH"] ?? "").split(path2.delimiter)) {
     if (directory === "") continue;
     try {
-      fs.accessSync(path.join(directory, command), fs.constants.X_OK);
+      fs2.accessSync(path2.join(directory, command), fs2.constants.X_OK);
       return true;
     } catch {
     }
@@ -403,16 +524,16 @@ var paintMark = (state, mark) => {
   const code = state === "ok" ? "32" : state === "todo" ? "33" : "31";
   return `\x1B[${code}m${mark}\x1B[0m`;
 };
-var doctorCommand = async (config, localCredential2) => {
-  const checks = await runChecks(config, { localCredential: localCredential2, onPath });
+var doctorCommand = async (config, localCredential2, claudeGrant2) => {
+  const checks = await runChecks(config, { localCredential: localCredential2, claudeGrant: claudeGrant2, onPath });
   for (const check of checks) process.stdout.write(`${formatCheck(check, paintMark)}
 `);
   if (checks.some((check) => check.state === "failed")) process.exitCode = 1;
 };
 
 // src/dotfiles.ts
-import * as fs2 from "node:fs";
-import * as path2 from "node:path";
+import * as fs3 from "node:fs";
+import * as path3 from "node:path";
 var DOTFILE_CANDIDATES = [
   {
     group: "shell",
@@ -455,7 +576,7 @@ var DOTFILE_CANDIDATES = [
 var MAX_FILE_BYTES = 1024 * 1024;
 var statFile = (home, relative3) => {
   try {
-    const stat = fs2.statSync(path2.join(home, relative3));
+    const stat = fs3.statSync(path3.join(home, relative3));
     return stat.isFile() ? stat : null;
   } catch {
     return null;
@@ -479,7 +600,7 @@ var readSyncFiles = (home, paths_) => {
     }
     files.push({
       path: relative3,
-      contentsBase64: fs2.readFileSync(path2.join(home, relative3)).toString("base64"),
+      contentsBase64: fs3.readFileSync(path3.join(home, relative3)).toString("base64"),
       // eslint-disable-next-line no-bitwise -- permission bits are the point
       mode: (stat.mode & 511).toString(8)
     });
@@ -488,7 +609,7 @@ var readSyncFiles = (home, paths_) => {
 };
 
 // src/env.ts
-var formatLoadReport = (report, paint4) => {
+var formatLoadReport = (report, paint5) => {
   const width = Math.max(
     0,
     ...report.loaded.map((entry) => entry.name.length),
@@ -497,12 +618,12 @@ var formatLoadReport = (report, paint4) => {
   const lines = [];
   for (const entry of report.loaded) {
     lines.push(
-      `  ${entry.name.padEnd(width)}  ${entry.lane === "secret" ? "secret" : "configuration"} ${paint4.dim(`\xB7 ${entry.action}${entry.lane === "configuration" ? " \xB7 plaintext" : ""}`)}`
+      `  ${entry.name.padEnd(width)}  ${entry.lane === "secret" ? "secret" : "configuration"} ${paint5.dim(`\xB7 ${entry.action}${entry.lane === "configuration" ? " \xB7 plaintext" : ""}`)}`
     );
   }
   for (const entry of report.rejected) {
     lines.push(
-      `  ${entry.name.padEnd(width)}  ${paint4.warn("rejected")} ${paint4.dim(`\xB7 ${entry.reason}`)}`
+      `  ${entry.name.padEnd(width)}  ${paint5.warn("rejected")} ${paint5.dim(`\xB7 ${entry.reason}`)}`
     );
   }
   return lines;
@@ -514,6 +635,7 @@ var SECTIONS = [
   "sessions",
   "services",
   "project setup",
+  "organization",
   "this machine"
 ];
 var project = (what = "the project") => ({
@@ -546,16 +668,21 @@ var COMMANDS = [
     name: "connect",
     section: "start",
     summary: "send this machine's provider credential to the platform",
-    synopsis: ["<claude|codex|github> [--from-stdin] [--remove]"],
+    synopsis: ["<claude|codex|github> [--use-my-login] [--from-stdin] [--remove]"],
     description: [
-      "Sessions run on the platform, so the platform needs your provider login. This reads the file the provider's own CLI wrote when you logged in (claude, codex) or asks gh for its token (github) and stores it under your own user. Nothing is shared with other users."
+      "Sessions run on the platform, so the platform needs your provider login. This reads the file the provider's own CLI wrote when you logged in (codex) or asks gh for its token (github) and stores it under your own user. Nothing is shared with other users.",
+      "Claude is different: Mend gets a login of its own. Claude rotates its refresh token, so two copies of one login fight and the one that refreshes second is signed out, and Mend refreshes on a schedule. So this logs in once against a directory Mend keeps, and your own Claude login stays as it is. Run it again whenever Mend says the grant expired."
     ],
     options: [
+      {
+        flag: "--use-my-login",
+        text: "claude: send the login this machine already uses; both sides then share one grant"
+      },
       { flag: "--from-stdin", text: "paste a credential instead of reading the provider's file" },
       { flag: "--remove", text: "disconnect the provider" }
     ],
     examples: [
-      { command: "mend connect claude", text: "after `claude login` on this machine" },
+      { command: "mend connect claude", text: "a Claude login of Mend's own, through the browser" },
       { command: "mend connect github --remove", text: "" }
     ],
     see: ["accounts"]
@@ -564,14 +691,19 @@ var COMMANDS = [
     name: "adopt",
     section: "start",
     summary: "adopt a repository into the store",
-    synopsis: ["[git-url] [--name <name>] [--auth ambient|mend-key|bridge]"],
+    synopsis: ["[git-url] [--name <name>] [--auth ambient|mend-key|bridge] [--private|--shared]"],
     description: [
       "Clones a network Git repository into Mend's store. Every session then gets its own worktree of it. With no argument, Mend uses the current checkout's origin URL. HTTP(S), SSH, git://, and SCP-style URLs work; local paths and file:// URLs do not.",
       "--auth says how the store fetches from the remote. Default: your mode from mend keys mode. mend-key signs with your Mend key on the server (see mend keys). bridge relays this machine's ssh-agent while a mend command runs here, so hardware keys stay on your desk. ambient uses the server's own credentials."
     ],
     options: [
       { flag: "--name <name>", text: "the project's name in Mend. Default: the repository's" },
-      { flag: "--auth <mode>", text: "mend-key, bridge, or ambient. Default: mend keys mode" }
+      { flag: "--auth <mode>", text: "mend-key, bridge, or ambient. Default: mend keys mode" },
+      { flag: "--private", text: "only you see the project. Default" },
+      {
+        flag: "--shared",
+        text: "everyone in your organization sees it and can start sessions in it"
+      }
     ],
     examples: [
       { command: "mend adopt", text: "the current repository's origin URL" },
@@ -1015,7 +1147,166 @@ var COMMANDS = [
     ],
     see: ["keys mode", "adopt"]
   },
+  // ── organization ───────────────────────────────────────────────────────
+  {
+    name: "members",
+    section: "organization",
+    summary: "who belongs to your organization, and their roles",
+    synopsis: [],
+    description: [
+      "Prints the organization's name and one row per member: name, email, role and the day they joined. The row marked with an arrow is you. Owners change roles and remove members in Settings on the web."
+    ],
+    see: ["invite"]
+  },
+  {
+    name: "invite",
+    section: "organization",
+    summary: "print a one-time link that adds someone to your organization",
+    synopsis: ["[--role member|owner] [--email <address>] [--days <n>]"],
+    description: [
+      "Owners only. Prints a link that works once. Whoever opens it creates an account and joins with the role you pick. Mend sends no email: you share the link yourself. Bind it to an email when it must not be forwarded."
+    ],
+    options: [
+      { flag: "--role <role>", text: "member or owner. Default: member" },
+      { flag: "--email <address>", text: "only an account with this email may accept it" },
+      { flag: "--days <n>", text: "days until the link expires. Default: 7, at most 30" }
+    ],
+    examples: [{ command: "mend invite --email sam@acme.dev", text: "a member link for Sam only" }],
+    see: ["members"]
+  },
+  {
+    name: "folder list",
+    section: "organization",
+    summary: "list your organization's folders",
+    synopsis: [],
+    description: [
+      "Folders are directories Mend keeps for the organization. A project mounts the ones it selects at /workspace/home/<name>, read-only unless chosen otherwise, for its next sessions."
+    ],
+    see: ["folder create", "folder push"]
+  },
+  {
+    name: "folder create",
+    section: "organization",
+    summary: "create an organization folder",
+    synopsis: ["<name>"],
+    description: [
+      "Owners only. Names use lowercase letters, digits, dots, underscores and dashes. A project picks the folder in its setup on the web."
+    ],
+    see: ["folder push", "folder list"]
+  },
+  {
+    name: "folder push",
+    section: "organization",
+    summary: "upload a local directory into a folder",
+    synopsis: ["<name> <dir> [--replace]"],
+    description: [
+      "Owners only. Sends every file under <dir>, keeping paths relative to it. .git and node_modules directories, symlinks and files over 1 MiB are skipped and counted. Without --replace the files are added beside what the folder holds."
+    ],
+    options: [{ flag: "--replace", text: "empty the folder first, so it holds exactly <dir>" }],
+    examples: [{ command: "mend folder push fixtures ./test/fixtures --replace", text: "" }],
+    see: ["folder create", "folder rm"]
+  },
+  {
+    name: "folder rm",
+    section: "organization",
+    summary: "remove an organization folder",
+    synopsis: ["<name>"],
+    description: [
+      "Owners only. A folder a project still mounts is refused: deselect it in that project's setup first."
+    ],
+    see: ["folder list"]
+  },
+  {
+    name: "session share",
+    section: "organization",
+    summary: "let everyone who can see a session steer it, or stop",
+    synopsis: ["<session> on|off"],
+    description: [
+      "The session's owner turns shared control on or off; an organization owner may turn it off. While it is on, anyone who can see the project sends turns, answers approvals, interrupts and types in the terminal, using your provider logins and Git access. Every act is recorded with who did it. A prefix of the session id is enough."
+    ],
+    examples: [{ command: "mend session share 3f2a on", text: "" }],
+    see: ["sessions"]
+  },
   // ── this machine ───────────────────────────────────────────────────────
+  {
+    name: "operator org list",
+    section: "this machine",
+    summary: "list organizations with their member and owner counts",
+    synopsis: [],
+    description: [
+      "Operator only. One line per organization. An organization with no owner says so: bring one in with mend operator org invite-owner or mend operator grant-owner. The operator administers the instance and reads no organization content."
+    ],
+    see: ["operator org invite-owner", "operator grant-owner"]
+  },
+  {
+    name: "operator exposure",
+    section: "this machine",
+    summary: "how this instance is exposed, as declared and as observed",
+    synopsis: [],
+    description: [
+      "Operator only. States MEND_EXPOSURE as declared (loopback, private or public) and one line per item of the public exposure gate, with how it was established: observed (this server read it), carried (this build contains it, and the server cannot see it in effect), declared (you stated it and the server cannot check it), or open. MEND_EXPOSURE=public refuses to start while an item the server can observe is open. Items it cannot observe say what would verify them; once you have verified core-private or edge-tls from outside, name it in MEND_EXPOSURE_DECLARED. The report is what was observed; it is not a statement that the instance is fit to expose."
+    ],
+    see: ["operator gate", "doctor"]
+  },
+  {
+    name: "operator gate",
+    section: "this machine",
+    summary: "what MEND_TENANCY=multi still needs on this instance",
+    synopsis: [],
+    description: [
+      "Operator only. One line per item of the multi mode gate: what this instance shows, and what would satisfy an open item. Multi tenancy refuses to start while any item is open."
+    ],
+    see: ["operator org list"]
+  },
+  {
+    name: "operator org create",
+    section: "this machine",
+    summary: "create an organization (multi tenancy only)",
+    synopsis: ["<name>"],
+    description: [
+      "Operator only, and only when MEND_TENANCY=multi. The organization starts empty: invite its first owner next."
+    ],
+    see: ["operator org invite-owner"]
+  },
+  {
+    name: "operator org rename",
+    section: "this machine",
+    summary: "rename an organization",
+    synopsis: ["<org> <name>"],
+    description: ["Operator only. Recorded in the organization's audit log."],
+    see: ["operator org list"]
+  },
+  {
+    name: "operator org invite-owner",
+    section: "this machine",
+    summary: "print a one-time owner invitation for an organization",
+    synopsis: ["<org> [--email <address>]"],
+    description: [
+      "Operator only. Prints a link that works once and makes whoever opens it an owner of the organization. Recorded in its audit log."
+    ],
+    options: [{ flag: "--email <address>", text: "only an account with this email may accept it" }],
+    see: ["operator grant-owner"]
+  },
+  {
+    name: "operator grant-owner",
+    section: "this machine",
+    summary: "make an existing member an owner",
+    synopsis: ["<org> <email>"],
+    description: [
+      "Operator only. For an organization whose owners are gone or locked out. The account must already be a member. Recorded in the organization's audit log."
+    ],
+    see: ["operator org invite-owner"]
+  },
+  {
+    name: "operator reset-link",
+    section: "this machine",
+    summary: "print a one-time password reset link for an account",
+    synopsis: ["<email>"],
+    description: [
+      "Operator only. Mend sends no email, so you hand the link over. It works once, expires after a day, and setting a password with it signs the account out everywhere. Owners reset their members' passwords from Settings."
+    ],
+    see: ["operator grant-owner"]
+  },
   {
     name: "server",
     section: "this machine",
@@ -1081,7 +1372,7 @@ var COMMANDS = [
       { command: "mend server setup", text: "localhost, using the current local Docker context" },
       {
         command: "mend server setup --context orbstack --bind 0.0.0.0 --url http://100.70.80.90:3105",
-        text: "explicit tailnet exposure"
+        text: "explicit private-network exposure (a tailnet, a LAN, a VPN)"
       },
       {
         command: "mend server setup --version 0.25.0 --assets-dir ./release-assets --offline",
@@ -1518,7 +1809,7 @@ var manFileName = (doc) => doc === null ? "mend.1" : `mend-${doc.name.replace(/
 
 // src/login.ts
 import { spawn } from "node:child_process";
-import * as os from "node:os";
+import * as os2 from "node:os";
 
 // src/pair.ts
 var paint = (code) => (text) => process.stdout.isTTY === true ? `\x1B[${code}m${text}\x1B[0m` : text;
@@ -1710,7 +2001,7 @@ var resolveServerUrl = async (args, deps) => {
 };
 var loginCommand = async (args, deps) => {
   const base = await resolveServerUrl(args, deps);
-  const started = await post(`${base}/api/cli/auth`, { name: os.hostname() });
+  const started = await post(`${base}/api/cli/auth`, { name: os2.hostname() });
   if (started.status === 429) {
     return fail2(
       `the server asked for a pause \u2014 try again in ${retryAfterSecondsOf(started.json)}s`
@@ -1760,15 +2051,338 @@ var loginCommand = async (args, deps) => {
   return fail2("the authorize request expired before anyone approved \u2014 run mend login again");
 };
 
+// src/organization.ts
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
+var paint3 = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}[0m` : text;
+var dim3 = paint3("2");
+var green3 = paint3("32");
+var say3 = (line) => process.stdout.write(`${line}
+`);
+var fail3 = (message) => {
+  process.stderr.write(`mend: ${message}
+`);
+  process.exit(1);
+};
+var takeFlagValue3 = (args, flag) => {
+  const at = args.indexOf(flag);
+  return at !== -1 && args[at + 1] !== void 0 ? String(args[at + 1]) : null;
+};
+var day2 = (iso) => iso.slice(0, 10);
+var organizationOf = (api2) => api2("GET", "/organization");
+var renderMembers = (view, members) => {
+  const nameWidth = Math.max(4, ...members.map((member) => member.name.length));
+  const emailWidth = Math.max(5, ...members.map((member) => member.email.length));
+  return [
+    `${view.organization.name} \xB7 ${members.length} ${members.length === 1 ? "member" : "members"}`,
+    ...members.map(
+      (member) => `${member.userId === view.userId ? "\u25B8" : " "} ${member.name.padEnd(nameWidth)}  ${member.email.padEnd(emailWidth)}  ${member.role.padEnd(6)}  joined ${day2(member.joinedAt)}`
+    )
+  ];
+};
+var membersCommand = async (api2) => {
+  const view = await organizationOf(api2);
+  const members = await api2("GET", "/organization/members");
+  for (const line of renderMembers(view, members)) say3(line);
+};
+var inviteCommand = async (api2, baseUrl, args) => {
+  const role = takeFlagValue3(args, "--role") ?? "member";
+  if (role !== "member" && role !== "owner") {
+    return fail3(`--role takes "member" or "owner", not "${role}"`);
+  }
+  const email = takeFlagValue3(args, "--email");
+  const daysValue = takeFlagValue3(args, "--days");
+  const days = daysValue === null ? null : Number.parseInt(daysValue, 10);
+  if (days !== null && (Number.isNaN(days) || days < 1)) {
+    return fail3(`--days takes a whole number of days, not "${daysValue}"`);
+  }
+  const view = await organizationOf(api2);
+  if (view.role !== "owner") return fail3("only an owner can invite; mend members shows who");
+  const created = await api2("POST", "/organization/invitations", {
+    role,
+    ...email === null ? {} : { email },
+    ...days === null ? {} : { expiresInDays: days }
+  });
+  say3(`${baseUrl.replace(/\/+$/, "")}${created.path}`);
+  say3(
+    dim3(
+      `works once \xB7 ${role}${email === null ? "" : ` \xB7 for ${email}`} \xB7 expires ${day2(created.invitation.expiresAt)}`
+    )
+  );
+};
+var FOLDER_FILE_BYTES = 1024 * 1024;
+var FOLDER_REQUEST_BYTES = 4 * 1024 * 1024;
+var SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules"]);
+var scanFolder = (dir) => {
+  const files = [];
+  const skipped = [];
+  const walk = (relative3) => {
+    const entries = fs4.readdirSync(path4.join(dir, relative3), { withFileTypes: true }).toSorted((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const child = relative3 === "" ? entry.name : `${relative3}/${entry.name}`;
+      if (entry.isSymbolicLink()) {
+        skipped.push({ path: child, reason: "symlink" });
+      } else if (entry.isDirectory()) {
+        if (SKIPPED_DIRECTORIES.has(entry.name)) skipped.push({ path: child, reason: "skipped" });
+        else walk(child);
+      } else if (entry.isFile()) {
+        const size = fs4.statSync(path4.join(dir, child)).size;
+        if (size > FOLDER_FILE_BYTES) skipped.push({ path: child, reason: "over 1 MiB" });
+        else files.push({ path: child, size });
+      }
+    }
+  };
+  walk("");
+  return { files, skipped };
+};
+var uploadBatches = (files, cap = FOLDER_REQUEST_BYTES) => {
+  const batches = [];
+  let current = [];
+  let size = 0;
+  for (const file of files) {
+    if (current.length > 0 && size + file.size > cap) {
+      batches.push(current);
+      current = [];
+      size = 0;
+    }
+    current.push(file);
+    size += file.size;
+  }
+  if (current.length > 0) batches.push(current);
+  return batches;
+};
+var folderNamed = async (api2, name) => {
+  if (name === void 0) return fail3("name the folder \xB7 mend folder list shows them");
+  const folders = await api2("GET", "/organization/folders");
+  const folder = folders.find((candidate) => candidate.name === name);
+  return folder ?? fail3(`no folder named "${name}" \xB7 mend folder list shows them`);
+};
+var folderCommand = async (api2, args) => {
+  const [verb, name, dir] = args.filter((arg) => !arg.startsWith("--"));
+  switch (verb) {
+    case void 0:
+    case "list": {
+      const folders = await api2("GET", "/organization/folders");
+      if (folders.length === 0) {
+        say3(dim3("no folders yet \xB7 an owner creates one with mend folder create <name>"));
+        return;
+      }
+      for (const folder of folders)
+        say3(`${folder.name}  ${dim3(`created ${day2(folder.createdAt)}`)}`);
+      return;
+    }
+    case "create": {
+      if (name === void 0) return fail3("usage: mend folder create <name>");
+      const folder = await api2("POST", "/organization/folders", { name });
+      say3(`${green3("\u2713")} created folder ${folder.name}`);
+      return;
+    }
+    case "push": {
+      if (dir === void 0) return fail3("usage: mend folder push <name> <dir> [--replace]");
+      if (!fs4.existsSync(dir) || !fs4.statSync(dir).isDirectory()) {
+        return fail3(`${dir} is not a directory`);
+      }
+      const folder = await folderNamed(api2, name);
+      const scanned = scanFolder(dir);
+      const replace = args.includes("--replace");
+      const batches = uploadBatches(scanned.files);
+      if (batches.length === 0 && replace) {
+        await api2("POST", `/organization/folders/${folder.id}/files`, { files: [], merge: false });
+      }
+      for (const [index, batch] of batches.entries()) {
+        await api2("POST", `/organization/folders/${folder.id}/files`, {
+          files: batch.map((file) => ({
+            path: file.path,
+            // Read one batch at a time, so a large tree never sits in memory at once.
+            contentsBase64: fs4.readFileSync(path4.join(dir, file.path)).toString("base64")
+          })),
+          // --replace empties the folder with the first batch; the rest add to it.
+          merge: !(replace && index === 0)
+        });
+      }
+      const reasons = [...new Set(scanned.skipped.map((entry) => entry.reason))];
+      say3(
+        `${green3("\u2713")} pushed ${scanned.files.length} ${scanned.files.length === 1 ? "file" : "files"} to ${folder.name}${scanned.skipped.length === 0 ? "" : dim3(` \xB7 ${scanned.skipped.length} skipped (${reasons.join(", ")})`)}`
+      );
+      return;
+    }
+    case "rm": {
+      const folder = await folderNamed(api2, name);
+      await api2("DELETE", `/organization/folders/${folder.id}`);
+      say3(`${green3("\u2713")} removed folder ${folder.name}`);
+      return;
+    }
+    default:
+      return fail3(`unknown folder command "${verb}" \xB7 mend help folder`);
+  }
+};
+var sessionShareCommand = async (api2, args) => {
+  const [prefix, state] = args.filter((arg) => !arg.startsWith("--"));
+  if (prefix === void 0 || state !== "on" && state !== "off") {
+    return fail3("usage: mend session share <session> on|off");
+  }
+  const sessions = await api2(
+    "GET",
+    "/sessions?retained=1"
+  );
+  const matches = sessions.filter((session2) => session2.id.startsWith(prefix));
+  if (matches.length === 0) return fail3(`no live session starts with "${prefix}"`);
+  if (matches.length > 1)
+    return fail3(`"${prefix}" matches ${matches.length} sessions; type more of the id`);
+  const [session] = matches;
+  if (session === void 0) return fail3(`no live session starts with "${prefix}"`);
+  await api2("PUT", `/sessions/${session.id}/shared-control`, { enabled: state === "on" });
+  say3(
+    state === "on" ? `${green3("\u2713")} shared control on \xB7 ${session.harness} ${dim3(session.id.slice(0, 8))} \xB7 everyone who can see the project steers it on your credentials` : `${green3("\u2713")} shared control off \xB7 ${session.harness} ${dim3(session.id.slice(0, 8))}`
+  );
+};
+var renderGate = (items) => {
+  const width = Math.max(...items.map((item) => item.id.length));
+  const open = items.filter((item) => !item.ok).length;
+  return [
+    ...items.map(
+      (item) => `${item.ok ? green3("\u2713") : "\xB7"} ${item.id.padEnd(width)}  ${item.detail}${item.fix === null ? "" : dim3(` \xB7 ${item.fix}`)}`
+    ),
+    open === 0 ? "every item is in place; MEND_TENANCY=multi may start" : `${open} of ${items.length} items open; MEND_TENANCY=multi refuses to start`
+  ];
+};
+var EXPOSURE_WORDS = {
+  loopback: "reached from this machine only",
+  private: "reached over a network you control admission to",
+  public: "reachable from the Internet"
+};
+var renderExposure = (report) => {
+  const width = Math.max(...report.items.map((item) => item.id.length));
+  const marks = {
+    observed: "\u25CF",
+    carried: "\u25D0",
+    declared: "\u25CB",
+    open: "\xB7"
+  };
+  const mark = (item) => marks[item.established];
+  const open = report.items.filter((item) => item.established === "open");
+  const blocking = open.filter((item) => item.blocksStart).length;
+  const unobservable = open.length - blocking;
+  return [
+    `exposure \xB7 declared ${report.declared} \xB7 ${EXPOSURE_WORDS[report.declared]}`,
+    ...report.items.map(
+      (item) => `${mark(item)} ${item.id.padEnd(width)}  ${item.established.padEnd(8)}  ${item.detail}${item.fix === null ? "" : dim3(` \xB7 ${item.fix}`)}`
+    ),
+    open.length === 0 ? "nothing open \xB7 every item was observed here, is carried by this build, or was declared by the operator" : `${open.length} of ${report.items.length} items open \xB7 ${blocking} this build can observe${blocking === 0 ? "" : "; MEND_EXPOSURE=public refuses to start"} \xB7 ${unobservable} it cannot`
+  ];
+};
+var renderOrganizations = (rows) => {
+  if (rows.length === 0) return ["no organizations"];
+  const width = Math.max(...rows.map((row) => row.organization.name.length));
+  return rows.map(
+    (row) => `${row.organization.name.padEnd(width)}  ${row.memberCount} ${row.memberCount === 1 ? "member" : "members"} \xB7 ${row.ownerCount === 0 ? "no owner" : `${row.ownerCount} ${row.ownerCount === 1 ? "owner" : "owners"}`}`
+  );
+};
+var printLink = (baseUrl, link, what) => {
+  say3(`${baseUrl.replace(/\/+$/, "")}${link.path}`);
+  say3(dim3(`${what} \xB7 works once \xB7 expires ${day2(link.expiresAt)}`));
+};
+var operatorCommand = async (api2, tryApi, baseUrl, args) => {
+  const words = args.filter((arg, index) => !arg.startsWith("--") && args[index - 1] !== "--email");
+  const refused = await tryApi("GET", "/operator/organizations").then(
+    () => null,
+    (error) => error instanceof Error ? error.message : String(error)
+  );
+  if (refused !== null) {
+    return fail3(
+      refused.endsWith("\u2192 404") ? "this account is not the operator of this Mend" : refused
+    );
+  }
+  const organizationNamed = async (name) => {
+    if (name === void 0)
+      return fail3("name the organization \xB7 mend operator org list shows them");
+    const rows = await api2("GET", "/operator/organizations");
+    const row = rows.find((candidate) => candidate.organization.name === name);
+    return row?.organization ?? fail3(`no organization named "${name}"`);
+  };
+  const [first, second, third, fourth] = words;
+  if (first === "org") {
+    switch (second) {
+      case void 0:
+      case "list": {
+        const rows = await api2(
+          "GET",
+          "/operator/organizations"
+        );
+        for (const line of renderOrganizations(rows)) say3(line);
+        return;
+      }
+      case "create": {
+        if (third === void 0) return fail3("usage: mend operator org create <name>");
+        const created = await api2("POST", "/operator/organizations", {
+          name: third
+        });
+        say3(
+          `${green3("\u2713")} created ${created.name} \xB7 mend operator org invite-owner ${created.name}`
+        );
+        return;
+      }
+      case "rename": {
+        if (fourth === void 0) return fail3("usage: mend operator org rename <org> <name>");
+        const organization = await organizationNamed(third);
+        await api2("PUT", `/operator/organizations/${organization.id}/name`, { name: fourth });
+        say3(`${green3("\u2713")} renamed ${organization.name} to ${fourth}`);
+        return;
+      }
+      case "invite-owner": {
+        const organization = await organizationNamed(third);
+        const email = takeFlagValue3(args, "--email");
+        const link = await api2(
+          "POST",
+          `/operator/organizations/${organization.id}/invitations`,
+          email === null ? {} : { email }
+        );
+        printLink(
+          baseUrl,
+          link,
+          `owner of ${organization.name}${email === null ? "" : ` \xB7 for ${email}`}`
+        );
+        return;
+      }
+      default:
+        return fail3(`unknown operator org command "${second}" \xB7 mend help operator org list`);
+    }
+  }
+  if (first === "exposure") {
+    const report = await api2("GET", "/operator/exposure");
+    for (const line of renderExposure(report)) say3(line);
+    return;
+  }
+  if (first === "gate") {
+    const items = await api2("GET", "/operator/gate");
+    for (const line of renderGate(items)) say3(line);
+    return;
+  }
+  if (first === "grant-owner") {
+    if (third === void 0) return fail3("usage: mend operator grant-owner <org> <email>");
+    const organization = await organizationNamed(second);
+    await api2("POST", `/operator/organizations/${organization.id}/owners`, { email: third });
+    say3(`${green3("\u2713")} ${third} is an owner of ${organization.name}`);
+    return;
+  }
+  if (first === "reset-link") {
+    if (second === void 0) return fail3("usage: mend operator reset-link <email>");
+    const link = await api2("POST", "/operator/password-resets", { email: second });
+    printLink(baseUrl, link, `password reset for ${second}`);
+    return;
+  }
+  return fail3(`unknown operator command "${first ?? ""}" \xB7 mend help operator org list`);
+};
+
 // src/server-setup.ts
 import { createHmac, randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import * as net2 from "node:net";
-import * as os3 from "node:os";
-import * as path5 from "node:path";
+import * as os4 from "node:os";
+import * as path7 from "node:path";
 
 // src/server-docker-volumes.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 var MEND_DOCKER_NAMESPACE = {
   project: "mend",
   store: "mend-store",
@@ -1796,15 +2410,15 @@ var ServerVolumeOwnershipError = class extends Error {
     this.operation = operation;
   }
 };
-var fail3 = (reason, operation) => ({ _tag: "error", error: new ServerVolumeOwnershipError(reason, operation) });
+var fail4 = (reason, operation) => ({ _tag: "error", error: new ServerVolumeOwnershipError(reason, operation) });
 var docker = async (runtime, context, args) => {
   try {
     const output = await runtime.run("docker", ["--context", context, ...args]);
     if (output.status !== 0 || output.error !== void 0)
-      return fail3("docker", args.slice(0, 2).join(" "));
+      return fail4("docker", args.slice(0, 2).join(" "));
     return { _tag: "ok", value: output.stdout };
   } catch {
-    return fail3("docker", args.slice(0, 2).join(" "));
+    return fail4("docker", args.slice(0, 2).join(" "));
   }
 };
 var listNames = async (runtime, context, kind, project2) => {
@@ -1823,11 +2437,11 @@ var listNames = async (runtime, context, kind, project2) => {
     for (const line of output.value.trim().split("\n").filter(Boolean)) {
       const value = JSON.parse(line);
       if (typeof value !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(value))
-        return fail3("inspection", `${kind} list`);
+        return fail4("inspection", `${kind} list`);
       names.push(value);
     }
   } catch {
-    return fail3("inspection", `${kind} list`);
+    return fail4("inspection", `${kind} list`);
   }
   return { _tag: "ok", value: names };
 };
@@ -1843,16 +2457,16 @@ var inspectOwner = async (runtime, context, name, owner) => {
   try {
     const volume = JSON.parse(output.value);
     if (typeof volume !== "object" || volume === null || !("Name" in volume) || volume.Name !== name || !("Labels" in volume))
-      return fail3("inspection", "volume inspect");
+      return fail4("inspection", "volume inspect");
     const labels = volume.Labels;
-    if (labels === null) return fail3("conflict", "volume owner");
+    if (labels === null) return fail4("conflict", "volume owner");
     if (typeof labels !== "object" || Array.isArray(labels) || !Object.values(labels).every((v) => typeof v === "string"))
-      return fail3("inspection", "volume labels");
+      return fail4("inspection", "volume labels");
     if (!(SERVER_VOLUME_OWNER_LABEL in labels) || labels[SERVER_VOLUME_OWNER_LABEL] !== owner)
-      return fail3("conflict", "volume owner");
+      return fail4("conflict", "volume owner");
     return { _tag: "ok", value: void 0 };
   } catch {
-    return fail3("inspection", "volume inspect");
+    return fail4("inspection", "volume inspect");
   }
 };
 var ensureVolume = async (runtime, context, name, owner) => {
@@ -1891,38 +2505,38 @@ var inspectForeignProject = async (runtime, context, kind, name, project2) => {
   try {
     const resource = JSON.parse(output.value);
     if (typeof resource !== "object" || resource === null || !("Name" in resource) || resource.Name !== (kind === "container" ? `/${name}` : name) || !("Labels" in resource))
-      return fail3("inspection", `${kind} inspect`);
+      return fail4("inspection", `${kind} inspect`);
     const labels = resource.Labels;
-    if (labels === null) return fail3("unowned-data", `existing ${kind} without anchor`);
+    if (labels === null) return fail4("unowned-data", `existing ${kind} without anchor`);
     if (typeof labels !== "object" || Array.isArray(labels) || !Object.values(labels).every((value) => typeof value === "string"))
-      return fail3("inspection", `${kind} labels`);
+      return fail4("inspection", `${kind} labels`);
     if (!("com.docker.compose.project" in labels))
-      return fail3("unowned-data", `existing ${kind} without anchor`);
+      return fail4("unowned-data", `existing ${kind} without anchor`);
     const foreignProject = labels["com.docker.compose.project"];
     if (typeof foreignProject !== "string" || !/^[a-z0-9][a-z0-9_-]*$/.test(foreignProject))
-      return fail3("inspection", `${kind} project label`);
+      return fail4("inspection", `${kind} project label`);
     if (foreignProject === project2 || !inProjectNamespace(name, foreignProject))
-      return fail3("unowned-data", `existing ${kind} without anchor`);
+      return fail4("unowned-data", `existing ${kind} without anchor`);
     return { _tag: "ok", value: void 0 };
   } catch {
-    return fail3("inspection", `${kind} inspect`);
+    return fail4("inspection", `${kind} inspect`);
   }
 };
 var refuseOldData = async (runtime, context, namespace, volumes) => {
   if (volumes.some(
     (name) => secondaryVolumesOf(namespace).includes(name) || name.startsWith(`${namespace.project}_`)
   ))
-    return fail3("unowned-data", "existing volumes without anchor");
+    return fail4("unowned-data", "existing volumes without anchor");
   for (const kind of ["volume", "container", "network"]) {
     const labelled = await listNames(runtime, context, kind, namespace.project);
     if (labelled._tag === "error") return labelled;
-    if (labelled.value.length > 0) return fail3("unowned-data", `existing ${kind} without anchor`);
+    if (labelled.value.length > 0) return fail4("unowned-data", `existing ${kind} without anchor`);
     if (kind !== "volume") {
       const named = await listNames(runtime, context, kind);
       if (named._tag === "error") return named;
       for (const name of named.value) {
         if (reservedResourceName(name, kind, namespace))
-          return fail3("unowned-data", `existing ${kind} without anchor`);
+          return fail4("unowned-data", `existing ${kind} without anchor`);
         if (name.startsWith(`${namespace.project}_`) || name.startsWith(`${namespace.project}-`)) {
           const foreign = await inspectForeignProject(
             runtime,
@@ -1943,8 +2557,8 @@ var parseOwnershipInput = (input) => {
   if (!input.dockerContext.trim() || input.identityBytes.byteLength === 0 || !/^[a-z0-9][a-z0-9_-]*$/.test(namespace.project) || ![namespace.store, ...secondaryVolumesOf(namespace)].every(
     (name) => /^[a-zA-Z0-9][a-zA-Z0-9_.-]+$/.test(name)
   ) || (/* @__PURE__ */ new Set([namespace.store, ...secondaryVolumesOf(namespace)])).size !== 1 + secondaryVolumesOf(namespace).length)
-    return fail3("invalid-input", "ownership inputs");
-  const owner = createHash("sha256").update(input.identityBytes).digest("hex");
+    return fail4("invalid-input", "ownership inputs");
+  const owner = createHash2("sha256").update(input.identityBytes).digest("hex");
   return { _tag: "ok", value: { owner, namespace } };
 };
 var ownership = async (runtime, input, mode) => {
@@ -1957,7 +2571,7 @@ var ownership = async (runtime, input, mode) => {
     const anchor = await inspectOwner(runtime, input.dockerContext, namespace.store, owner);
     if (anchor._tag === "error") return anchor;
   } else {
-    if (mode === "verify") return fail3("missing", "anchor");
+    if (mode === "verify") return fail4("missing", "anchor");
     const empty = await refuseOldData(runtime, input.dockerContext, namespace, volumes.value);
     if (empty._tag === "error") return empty;
     const anchor = await ensureVolume(runtime, input.dockerContext, namespace.store, owner);
@@ -1971,7 +2585,7 @@ var ownership = async (runtime, input, mode) => {
       const owned = await inspectOwner(runtime, input.dockerContext, name, owner);
       if (owned._tag === "error") return owned;
     } else {
-      if (mode === "verify") return fail3("missing", role);
+      if (mode === "verify") return fail4("missing", role);
       const created = await ensureVolume(runtime, input.dockerContext, name, owner);
       if (created._tag === "error") return created;
     }
@@ -1983,8 +2597,8 @@ var verifyServerDockerVolumes = (runtime, input) => ownership(runtime, input, "v
 
 // src/server-runtime.ts
 import { spawn as spawn2 } from "node:child_process";
-import * as fs3 from "node:fs";
-import * as path3 from "node:path";
+import * as fs5 from "node:fs";
+import * as path5 from "node:path";
 var serverProcessDeadlines = {
   ordinary: 3e4,
   pull: 10 * 6e4,
@@ -2030,7 +2644,7 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
   return new Promise((resolve4) => {
     let fd;
     try {
-      if (options.stdoutFile !== void 0) fd = fs3.openSync(options.stdoutFile, "wx", 384);
+      if (options.stdoutFile !== void 0) fd = fs5.openSync(options.stdoutFile, "wx", 384);
       const child = spawn2(command, [...args], {
         env,
         detached: process.platform !== "win32",
@@ -2081,12 +2695,12 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
       child.once("close", (status) => {
         globalThis.clearTimeout(timer);
         try {
-          if (fd !== void 0) fs3.fsyncSync(fd);
+          if (fd !== void 0) fs5.fsyncSync(fd);
         } catch {
           failure2 ??= "Could not durably write process output.";
         } finally {
           try {
-            if (fd !== void 0) fs3.closeSync(fd);
+            if (fd !== void 0) fs5.closeSync(fd);
           } catch {
             failure2 ??= "Could not close process output file.";
           }
@@ -2100,7 +2714,7 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
       });
     } catch (cause) {
       try {
-        if (fd !== void 0) fs3.closeSync(fd);
+        if (fd !== void 0) fs5.closeSync(fd);
       } catch {
       }
       resolve4({
@@ -2121,17 +2735,17 @@ var serverComposeArgs = (installation, command) => [
   "--project-directory",
   installation.directory,
   "--env-file",
-  path3.join(installation.directory, "server.env"),
+  path5.join(installation.directory, "server.env"),
   "-f",
-  path3.join(installation.directory, "compose.yaml"),
+  path5.join(installation.directory, "compose.yaml"),
   ...command
 ];
 
 // src/server-store.ts
 import { randomUUID } from "node:crypto";
-import * as fs4 from "node:fs";
-import * as os2 from "node:os";
-import * as path4 from "node:path";
+import * as fs6 from "node:fs";
+import * as os3 from "node:os";
+import * as path6 from "node:path";
 var ServerStoreError = class extends Error {
   _tag = "ServerStoreError";
 };
@@ -2152,28 +2766,28 @@ var attempt = (operation) => {
 var hasCode = (cause, code) => cause instanceof Error && "code" in cause && cause.code === code;
 var readOptional = (file) => {
   try {
-    return fs4.readFileSync(file, "utf8");
+    return fs6.readFileSync(file, "utf8");
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
   }
 };
 var syncDirectory = (directory) => {
-  const fd = fs4.openSync(directory, "r");
+  const fd = fs6.openSync(directory, "r");
   try {
-    fs4.fsyncSync(fd);
+    fs6.fsyncSync(fd);
   } finally {
-    fs4.closeSync(fd);
+    fs6.closeSync(fd);
   }
 };
 var writeDurable = (file, content, mode = 384) => {
-  const fd = fs4.openSync(file, "wx", mode);
+  const fd = fs6.openSync(file, "wx", mode);
   try {
-    fs4.writeFileSync(fd, content, "utf8");
-    fs4.fchmodSync(fd, mode);
-    fs4.fsyncSync(fd);
+    fs6.writeFileSync(fd, content, "utf8");
+    fs6.fchmodSync(fd, mode);
+    fs6.fsyncSync(fd);
   } finally {
-    fs4.closeSync(fd);
+    fs6.closeSync(fd);
   }
 };
 var fileKeys = ["identity", "config", "env", "compose", "postgresInit"];
@@ -2193,11 +2807,11 @@ var parseLockOwner = (raw) => {
 };
 var describeOwner = (lockDir) => {
   try {
-    const raw = JSON.parse(fs4.readFileSync(path4.join(lockDir, "owner.json"), "utf8"));
+    const raw = JSON.parse(fs6.readFileSync(path6.join(lockDir, "owner.json"), "utf8"));
     const owner = parseLockOwner(raw);
     if (owner === null) return "owner metadata is invalid";
     const label = `PID ${owner.pid} on ${owner.hostname}`;
-    if (owner.hostname !== os2.hostname()) return label;
+    if (owner.hostname !== os3.hostname()) return label;
     try {
       process.kill(owner.pid, 0);
       return `${label} is still live`;
@@ -2213,28 +2827,28 @@ var lockGuidance = (lockDir) => new ServerStoreError(
 );
 var acquireLock = (configDir, create) => {
   if (create) {
-    fs4.mkdirSync(configDir, { recursive: true, mode: 448 });
-    fs4.chmodSync(configDir, 448);
-  } else if (!fs4.existsSync(configDir)) {
+    fs6.mkdirSync(configDir, { recursive: true, mode: 448 });
+    fs6.chmodSync(configDir, 448);
+  } else if (!fs6.existsSync(configDir)) {
     throw new ServerStoreError(
       "No Mend server is configured. Run mend server setup explicitly to install one."
     );
   }
-  const lockDir = path4.join(configDir, "server.lock");
+  const lockDir = path6.join(configDir, "server.lock");
   try {
-    fs4.mkdirSync(lockDir, { mode: 448 });
+    fs6.mkdirSync(lockDir, { mode: 448 });
   } catch (cause) {
     if (hasCode(cause, "EEXIST")) throw lockGuidance(lockDir);
     throw cause;
   }
-  const owned = fs4.statSync(lockDir);
-  const ownerFile = path4.join(lockDir, "owner.json");
-  const owner = `${JSON.stringify({ pid: process.pid, hostname: os2.hostname(), token: randomUUID() })}
+  const owned = fs6.statSync(lockDir);
+  const ownerFile = path6.join(lockDir, "owner.json");
+  const owner = `${JSON.stringify({ pid: process.pid, hostname: os3.hostname(), token: randomUUID() })}
 `;
   let open = true;
   const assertOwned = () => {
-    const current = fs4.statSync(lockDir);
-    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs4.readFileSync(ownerFile, "utf8") !== owner) {
+    const current = fs6.statSync(lockDir);
+    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs6.readFileSync(ownerFile, "utf8") !== owner) {
       throw new ServerStoreError(
         "Server lock ownership was lost. Stop and check for another server command before retrying."
       );
@@ -2250,8 +2864,8 @@ var acquireLock = (configDir, create) => {
     release: () => {
       const result = attempt(() => {
         assertOwned();
-        fs4.unlinkSync(ownerFile);
-        fs4.rmdirSync(lockDir);
+        fs6.unlinkSync(ownerFile);
+        fs6.rmdirSync(lockDir);
       });
       open = false;
       return result;
@@ -2260,7 +2874,7 @@ var acquireLock = (configDir, create) => {
 };
 var readIdentity = (paths) => {
   const identity = readOptional(paths.identity);
-  if (identity === null && (fs4.existsSync(paths.active) || fs4.existsSync(paths.generations) && fs4.readdirSync(paths.generations).length > 0)) {
+  if (identity === null && (fs6.existsSync(paths.active) || fs6.existsSync(paths.generations) && fs6.readdirSync(paths.generations).length > 0)) {
     throw new ServerStoreError(
       "Server identity.env is missing. Restore it from a retained generation or backup; refusing to generate replacement credentials."
     );
@@ -2270,7 +2884,7 @@ var readIdentity = (paths) => {
 var readActive = (paths) => {
   let target;
   try {
-    target = fs4.readlinkSync(paths.active);
+    target = fs6.readlinkSync(paths.active);
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
@@ -2280,13 +2894,13 @@ var readActive = (paths) => {
       "Server active pointer is invalid. Restore the symlink to a retained generation before retrying."
     );
   }
-  const directory = path4.join(paths.configDir, target);
+  const directory = path6.join(paths.configDir, target);
   const files = {
-    identity: fs4.readFileSync(path4.join(directory, fileNames.identity), "utf8"),
-    config: fs4.readFileSync(path4.join(directory, fileNames.config), "utf8"),
-    env: fs4.readFileSync(path4.join(directory, fileNames.env), "utf8"),
-    compose: fs4.readFileSync(path4.join(directory, fileNames.compose), "utf8"),
-    postgresInit: fs4.readFileSync(path4.join(directory, fileNames.postgresInit), "utf8")
+    identity: fs6.readFileSync(path6.join(directory, fileNames.identity), "utf8"),
+    config: fs6.readFileSync(path6.join(directory, fileNames.config), "utf8"),
+    env: fs6.readFileSync(path6.join(directory, fileNames.env), "utf8"),
+    compose: fs6.readFileSync(path6.join(directory, fileNames.compose), "utf8"),
+    postgresInit: fs6.readFileSync(path6.join(directory, fileNames.postgresInit), "utf8")
   };
   if (readIdentity(paths) !== files.identity) {
     throw new ServerStoreError(
@@ -2296,20 +2910,20 @@ var readActive = (paths) => {
   return { directory, files };
 };
 var publishIdentity = (paths, identity) => {
-  const temporary = path4.join(paths.configDir, `.identity-${randomUUID()}`);
+  const temporary = path6.join(paths.configDir, `.identity-${randomUUID()}`);
   writeDurable(temporary, identity);
-  fs4.linkSync(temporary, paths.identity);
+  fs6.linkSync(temporary, paths.identity);
   syncDirectory(paths.configDir);
-  fs4.unlinkSync(temporary);
+  fs6.unlinkSync(temporary);
 };
 var prepareGeneration = (paths, files) => {
-  fs4.mkdirSync(paths.generations, { recursive: true, mode: 448 });
+  fs6.mkdirSync(paths.generations, { recursive: true, mode: 448 });
   const generationName = `gen-${randomUUID()}`;
-  const directory = path4.join(paths.generations, generationName);
-  fs4.mkdirSync(directory, { mode: 448 });
+  const directory = path6.join(paths.generations, generationName);
+  fs6.mkdirSync(directory, { mode: 448 });
   for (const key of fileKeys) {
     writeDurable(
-      path4.join(directory, fileNames[key]),
+      path6.join(directory, fileNames[key]),
       files[key],
       key === "postgresInit" ? 493 : 384
     );
@@ -2320,18 +2934,18 @@ var prepareGeneration = (paths, files) => {
   return { directory, files };
 };
 var activateGeneration = (paths, generation) => {
-  const relative3 = path4.relative(paths.configDir, generation.directory);
-  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative3) || readIdentity(paths) !== fs4.readFileSync(path4.join(generation.directory, "identity.env"), "utf8")) {
+  const relative3 = path6.relative(paths.configDir, generation.directory);
+  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative3) || readIdentity(paths) !== fs6.readFileSync(path6.join(generation.directory, "identity.env"), "utf8")) {
     throw new ServerStoreError("Cannot activate a generation outside this installation identity.");
   }
   for (const key of fileKeys) {
-    if (fs4.readFileSync(path4.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
+    if (fs6.readFileSync(path6.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
       throw new ServerStoreError("Cannot activate an incomplete or changed server generation.");
     }
   }
-  const pointer = path4.join(paths.configDir, `.active-${randomUUID()}`);
-  fs4.symlinkSync(relative3, pointer);
-  fs4.renameSync(pointer, paths.active);
+  const pointer = path6.join(paths.configDir, `.active-${randomUUID()}`);
+  fs6.symlinkSync(relative3, pointer);
+  fs6.renameSync(pointer, paths.active);
   syncDirectory(paths.configDir);
 };
 var prepareFiles = (paths, files) => {
@@ -2340,7 +2954,7 @@ var prepareFiles = (paths, files) => {
     throw new ServerStoreError("Server identity already exists; refusing to replace credentials.");
   }
   const active = readActive(paths);
-  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs4.statSync(path4.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
+  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs6.statSync(path6.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
     return active;
   if (identity === null) publishIdentity(paths, files.identity);
   return prepareGeneration(paths, files);
@@ -2353,9 +2967,9 @@ var commitGeneration = (paths, files) => {
 var createStore = (configDir, lock) => {
   const paths = {
     configDir,
-    identity: path4.join(configDir, "identity.env"),
-    generations: path4.join(configDir, "generations"),
-    active: path4.join(configDir, "active")
+    identity: path6.join(configDir, "identity.env"),
+    generations: path6.join(configDir, "generations"),
+    active: path6.join(configDir, "active")
   };
   const whileOwned = (operation) => attempt(() => {
     lock.assertOwned();
@@ -2368,13 +2982,13 @@ var createStore = (configDir, lock) => {
     prepare: (files) => whileOwned(() => prepareFiles(paths, files)),
     activate: (generation) => whileOwned(() => activateGeneration(paths, generation)),
     createBackup: (previous, target) => whileOwned(() => {
-      const backups = path4.join(configDir, "backups");
-      fs4.mkdirSync(backups, { recursive: true, mode: 448 });
-      fs4.chmodSync(backups, 448);
-      const directory = path4.join(backups, `upgrade-${randomUUID()}`);
-      fs4.mkdirSync(directory, { mode: 448 });
+      const backups = path6.join(configDir, "backups");
+      fs6.mkdirSync(backups, { recursive: true, mode: 448 });
+      fs6.chmodSync(backups, 448);
+      const directory = path6.join(backups, `upgrade-${randomUUID()}`);
+      fs6.mkdirSync(directory, { mode: 448 });
       writeDurable(
-        path4.join(directory, "recovery.json"),
+        path6.join(directory, "recovery.json"),
         `${JSON.stringify(
           {
             previousGeneration: previous.directory,
@@ -2390,21 +3004,21 @@ var createStore = (configDir, lock) => {
       syncDirectory(directory);
       syncDirectory(backups);
       syncDirectory(configDir);
-      const partialFile = path4.join(directory, "database.sql.partial");
+      const partialFile = path6.join(directory, "database.sql.partial");
       return {
         directory,
         partialFile,
         complete: () => whileOwned(() => {
-          if (fs4.statSync(partialFile).size === 0)
+          if (fs6.statSync(partialFile).size === 0)
             throw new ServerStoreError("Database backup is empty; refusing target startup.");
-          const fd = fs4.openSync(partialFile, "r");
+          const fd = fs6.openSync(partialFile, "r");
           try {
-            fs4.fchmodSync(fd, 384);
-            fs4.fsyncSync(fd);
+            fs6.fchmodSync(fd, 384);
+            fs6.fsyncSync(fd);
           } finally {
-            fs4.closeSync(fd);
+            fs6.closeSync(fd);
           }
-          fs4.renameSync(partialFile, path4.join(directory, "database.sql"));
+          fs6.renameSync(partialFile, path6.join(directory, "database.sql"));
           syncDirectory(directory);
         })
       };
@@ -2413,7 +3027,7 @@ var createStore = (configDir, lock) => {
 };
 var refuseFlatLayout = (configDir) => {
   if (["server.json", "server.env", "compose.yaml", "postgres-init.sh"].some(
-    (name) => fs4.existsSync(path4.join(configDir, name))
+    (name) => fs6.existsSync(path6.join(configDir, name))
   )) {
     throw new ServerStoreError(
       "Unreleased flat server configuration found. Preserve its credentials and volumes; migrate it to the generation layout before retrying. Setup will not replace this identity."
@@ -2421,7 +3035,7 @@ var refuseFlatLayout = (configDir) => {
   }
 };
 var withServerStore = async (directory, operation, options = {}) => {
-  const configDir = path4.resolve(directory);
+  const configDir = path6.resolve(directory);
   let lock;
   let result;
   try {
@@ -2438,9 +3052,9 @@ var withServerStore = async (directory, operation, options = {}) => {
 };
 
 // src/version.ts
-import * as fs5 from "node:fs";
+import * as fs7 from "node:fs";
 var cliVersion = () => {
-  const raw = fs5.readFileSync(new URL("../package.json", import.meta.url), "utf8");
+  const raw = fs7.readFileSync(new URL("../package.json", import.meta.url), "utf8");
   const parsed = JSON.parse(raw);
   if (typeof parsed === "object" && parsed !== null && "version" in parsed) {
     const version = parsed.version;
@@ -3119,7 +3733,7 @@ var resolveServerVersion = async (runtime, options, existing) => {
   return version;
 };
 var parseDockerSocketPath = (socket) => {
-  if (!path5.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
+  if (!path7.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
     throw setupError(
       "--docker-socket must be an absolute path without line breaks or Compose interpolation characters."
     );
@@ -3145,8 +3759,8 @@ var resolveAssets = async (runtime, serverVersion, existing, store, options) =>
   if (options.assetsDir !== void 0) {
     try {
       const [compose2, postgresInit2] = await Promise.all([
-        readFile(path5.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
-        readFile(path5.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
+        readFile(path7.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
+        readFile(path7.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
       ]);
       validateComposeAsset(compose2);
       validatePostgresAsset(postgresInit2);
@@ -3659,10 +4273,10 @@ var manageServer = async (command, args, runtime, store) => {
 };
 var nodeServerRuntime = () => {
   const environment = { ...process.env };
-  const home = os3.homedir();
-  const configHome = environment["XDG_CONFIG_HOME"] ?? path5.join(home, ".config");
+  const home = os4.homedir();
+  const configHome = environment["XDG_CONFIG_HOME"] ?? path7.join(home, ".config");
   return {
-    configDir: path5.join(configHome, "mend"),
+    configDir: path7.join(configHome, "mend"),
     platform: process.platform,
     cliVersion: cliVersion(),
     run: (command, args, options) => runServerProcess(command, args, environment, options),
@@ -3888,8 +4502,8 @@ var renderMendToml = (proposals) => {
 };
 
 // src/skills.ts
-import * as fs6 from "node:fs";
-import * as path6 from "node:path";
+import * as fs8 from "node:fs";
+import * as path8 from "node:path";
 var DEFAULT_SKILLS_DIR = ".agents/skills";
 var MAX_SKILL_FILES = 64;
 var MAX_SKILL_FILE_BYTES = 512 * 1024;
@@ -3912,12 +4526,12 @@ var readFrontmatterDescription = (contents) => {
 var walkFiles = (root) => {
   const found = [];
   const visit = (dir) => {
-    for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs8.readdirSync(dir, { withFileTypes: true })) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const absolute = path6.join(dir, entry.name);
+      const absolute = path8.join(dir, entry.name);
       let stat;
       try {
-        stat = fs6.statSync(absolute);
+        stat = fs8.statSync(absolute);
       } catch {
         continue;
       }
@@ -3931,7 +4545,7 @@ var walkFiles = (root) => {
 var scanSkillLibrary = (root) => {
   let entries;
   try {
-    entries = fs6.readdirSync(root, { withFileTypes: true });
+    entries = fs8.readdirSync(root, { withFileTypes: true });
   } catch {
     return { error: `${root} is not a readable directory` };
   }
@@ -3939,23 +4553,23 @@ var scanSkillLibrary = (root) => {
   const notes = [];
   for (const entry of entries.toSorted((a, b) => a.name.localeCompare(b.name))) {
     if (entry.name.startsWith(".")) continue;
-    const skillDir = path6.join(root, entry.name);
+    const skillDir = path8.join(root, entry.name);
     let stat;
     try {
-      stat = fs6.statSync(skillDir);
+      stat = fs8.statSync(skillDir);
     } catch {
       continue;
     }
     if (!stat.isDirectory()) continue;
-    if (!fs6.existsSync(path6.join(skillDir, "SKILL.md"))) {
+    if (!fs8.existsSync(path8.join(skillDir, "SKILL.md"))) {
       notes.push({ skill: entry.name, message: "no SKILL.md \u2014 skipped" });
       continue;
     }
     const files = [];
     let bytes = 0;
     for (const absolute of walkFiles(skillDir)) {
-      const relative3 = path6.relative(skillDir, absolute).split(path6.sep).join("/");
-      const buffer = fs6.readFileSync(absolute);
+      const relative3 = path8.relative(skillDir, absolute).split(path8.sep).join("/");
+      const buffer = fs8.readFileSync(absolute);
       if (buffer.byteLength > MAX_SKILL_FILE_BYTES) {
         notes.push({ skill: entry.name, message: `${relative3} is over 512KB \u2014 skipped` });
         continue;
@@ -3990,16 +4604,16 @@ var scanSkillLibrary = (root) => {
 };
 
 // src/ssh-setup.ts
-import * as os5 from "node:os";
-import * as path8 from "node:path";
+import * as os6 from "node:os";
+import * as path10 from "node:path";
 
 // ../../packages/workspace-ssh/src/index.ts
-import { spawnSync } from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
-import * as fs7 from "node:fs";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { createHash as createHash3 } from "node:crypto";
+import * as fs9 from "node:fs";
 import { isIP as isIP2 } from "node:net";
-import * as os4 from "node:os";
-import * as path7 from "node:path";
+import * as os5 from "node:os";
+import * as path9 from "node:path";
 var LEGACY_BLOCK_BEGIN = "# >>> mend workspace ssh (managed by `mend ssh setup`) >>>";
 var LEGACY_BLOCK_END = "# <<< mend workspace ssh <<<";
 var WorkspaceSshError = class extends Error {
@@ -4017,7 +4631,7 @@ var WorkspaceSshError = class extends Error {
 var success = (value) => ({ ok: true, value });
 var failure = (error) => ({ ok: false, error });
 var stripIpv6Brackets = (hostname6) => hostname6.startsWith("[") && hostname6.endsWith("]") ? hostname6.slice(1, -1) : hostname6;
-var hashIdentity = (identity) => createHash2("sha256").update(identity).digest("hex").slice(0, 24);
+var hashIdentity = (identity) => createHash3("sha256").update(identity).digest("hex").slice(0, 24);
 var aliasLabel = (hostname6) => {
   const label = hostname6.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 24);
   return label === "" ? "server" : label;
@@ -4086,8 +4700,8 @@ var blockBegin = (alias) => `# >>> mend workspace ssh ${alias} (managed) >>>`;
 var blockEnd = (alias) => `# <<< mend workspace ssh ${alias} <<<`;
 var hasControls = (value) => /[\p{Cc}\p{Zl}\p{Zp}]/u.test(value);
 var parseIdentityPath = (value) => {
-  const resolved = path7.resolve(
-    value.startsWith("~/") ? path7.join(os4.homedir(), value.slice(2)) : value
+  const resolved = path9.resolve(
+    value.startsWith("~/") ? path9.join(os5.homedir(), value.slice(2)) : value
   );
   if (value === "" || hasControls(value) || hasControls(resolved) || value.includes("${") || resolved.includes("${")) {
     return failure(
@@ -4222,7 +4836,7 @@ var workspaceSshPublicKeyFingerprint = (publicKey) => {
     return failure(new WorkspaceSshError("key", "SSH public key has no encoded key data."));
   }
   try {
-    const digest = createHash2("sha256").update(Buffer.from(encoded, "base64")).digest("base64");
+    const digest = createHash3("sha256").update(Buffer.from(encoded, "base64")).digest("base64");
     return success(`SHA256:${digest.replace(/=+$/, "")}`);
   } catch (cause) {
     return failure(
@@ -4233,7 +4847,7 @@ var workspaceSshPublicKeyFingerprint = (publicKey) => {
 var publicKeyIdentity = (publicKey) => publicKey.trim().split(/\s+/).slice(0, 2).join(" ");
 var agentKeys = () => {
   if (!process.env["SSH_AUTH_SOCK"]) return [];
-  const listed = spawnSync("ssh-add", ["-L"], {
+  const listed = spawnSync2("ssh-add", ["-L"], {
     encoding: "utf8",
     timeout: 3e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -4243,7 +4857,7 @@ var agentKeys = () => {
 };
 var readText = (file) => {
   try {
-    return success(fs7.readFileSync(file, "utf8"));
+    return success(fs9.readFileSync(file, "utf8"));
   } catch (cause) {
     const error = cause instanceof Error && "code" in cause ? cause.code : void 0;
     return error === "ENOENT" ? success("") : failure(new WorkspaceSshError("key", `Could not read ${file}.`, cause));
@@ -4270,7 +4884,7 @@ var readRequiredKey = (keyPath, source) => {
   const privatePath = publicPath.slice(0, -".pub".length);
   const read = readText(publicPath);
   if (!read.ok) return read;
-  const derived = spawnSync("ssh-keygen", ["-y", "-P", "", "-f", privatePath], {
+  const derived = spawnSync2("ssh-keygen", ["-y", "-P", "", "-f", privatePath], {
     encoding: "utf8",
     timeout: 3e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -4301,19 +4915,19 @@ var readRequiredKey = (keyPath, source) => {
 var readOptionalKey = (keyPath) => {
   const parsed = parseIdentityPath(keyPath);
   if (!parsed.ok) return parsed;
-  if (!fs7.existsSync(parsed.value) && !fs7.existsSync(publicKeyPath(parsed.value)))
+  if (!fs9.existsSync(parsed.value) && !fs9.existsSync(publicKeyPath(parsed.value)))
     return success(null);
   return readRequiredKey(parsed.value, "existing");
 };
 var pinAgentKey = (configHome, publicKey) => {
-  const identityFile = path7.resolve(
+  const identityFile = path9.resolve(
     configHome,
     "ssh",
     `agent-${hashIdentity(publicKeyIdentity(publicKey))}.pub`
   );
   try {
-    fs7.mkdirSync(path7.dirname(identityFile), { recursive: true, mode: 448 });
-    fs7.writeFileSync(identityFile, `${publicKey}
+    fs9.mkdirSync(path9.dirname(identityFile), { recursive: true, mode: 448 });
+    fs9.writeFileSync(identityFile, `${publicKey}
 `, { mode: 384 });
     return success({ publicKey, identityFile, source: "agent" });
   } catch (cause) {
@@ -4324,15 +4938,15 @@ var pinAgentKey = (configHome, publicKey) => {
 };
 var generateDedicatedKey = (privatePath) => {
   try {
-    fs7.mkdirSync(path7.dirname(privatePath), { recursive: true, mode: 448 });
+    fs9.mkdirSync(path9.dirname(privatePath), { recursive: true, mode: 448 });
   } catch (cause) {
     return failure(
-      new WorkspaceSshError("key", `Could not create ${path7.dirname(privatePath)}.`, cause)
+      new WorkspaceSshError("key", `Could not create ${path9.dirname(privatePath)}.`, cause)
     );
   }
-  const generated = spawnSync(
+  const generated = spawnSync2(
     "ssh-keygen",
-    ["-t", "ed25519", "-f", privatePath, "-N", "", "-C", `mend-${os4.hostname()}`],
+    ["-t", "ed25519", "-f", privatePath, "-N", "", "-C", `mend-${os5.hostname()}`],
     { encoding: "utf8", timeout: 3e3, stdio: ["ignore", "pipe", "pipe"] }
   );
   if (generated.status !== 0) {
@@ -4356,7 +4970,7 @@ var generateDedicatedKey = (privatePath) => {
   return fresh;
 };
 var dedicatedKey = (configHome, create) => {
-  const privatePath = path7.join(configHome, "ssh", "id_ed25519");
+  const privatePath = path9.join(configHome, "ssh", "id_ed25519");
   const existing = readOptionalKey(privatePath);
   if (existing.ok === false) return failure(existing.error);
   if (existing.value !== null || !create) return existing;
@@ -4404,10 +5018,10 @@ var writeWorkspaceSshConfig = (configFile, target, identityFile) => {
   const reconciled = reconcileWorkspaceSshConfig(before.value, target, identityFile);
   if (reconciled.ok === false) return failure(reconciled.error);
   try {
-    fs7.mkdirSync(path7.dirname(configFile), { recursive: true, mode: 448 });
-    fs7.chmodSync(path7.dirname(configFile), 448);
-    fs7.writeFileSync(configFile, reconciled.value, { mode: 384 });
-    fs7.chmodSync(configFile, 384);
+    fs9.mkdirSync(path9.dirname(configFile), { recursive: true, mode: 448 });
+    fs9.chmodSync(path9.dirname(configFile), 448);
+    fs9.writeFileSync(configFile, reconciled.value, { mode: 384 });
+    fs9.chmodSync(configFile, 384);
     return success(void 0);
   } catch (cause) {
     return failure(new WorkspaceSshError("config", `Could not write ${configFile}.`, cause));
@@ -4416,23 +5030,23 @@ var writeWorkspaceSshConfig = (configFile, target, identityFile) => {
 
 // src/ssh-setup.ts
 var ansi = (code) => (text) => process.stdout.isTTY === true ? `\x1B[${code}m${text}\x1B[0m` : text;
-var dim3 = ansi("2");
-var green3 = ansi("32");
+var dim4 = ansi("2");
+var green4 = ansi("32");
 var warn = ansi("33");
-var say3 = (line) => console.log(line);
-var sshConfigPath = () => path8.join(os5.homedir(), ".ssh", "config");
+var say4 = (line) => console.log(line);
+var sshConfigPath = () => path10.join(os6.homedir(), ".ssh", "config");
 var flagValue = (args, flag) => {
   const index = args.indexOf(flag);
   return index === -1 || args[index + 1] === void 0 ? null : String(args[index + 1]);
 };
 var showFailure = (message) => {
-  say3(`mend: ${message}`);
+  say4(`mend: ${message}`);
   process.exitCode = 1;
 };
 var showStatus = async (api2, cliHome, serverUrl, args) => {
   const view = await api2("GET", "/workspace-ssh");
   if (view.gateway === null) {
-    say3(`workspace ssh   ${warn("no gateway")} ${dim3("\xB7 this deployment exposes none")}`);
+    say4(`workspace ssh   ${warn("no gateway")} ${dim4("\xB7 this deployment exposes none")}`);
     return;
   }
   const parsedTarget = parseWorkspaceSshTarget({
@@ -4455,16 +5069,16 @@ var showStatus = async (api2, cliHome, serverUrl, args) => {
     key: picked.value,
     registeredFingerprints: view.keys.map((key) => key.fingerprint)
   });
-  say3(
-    `gateway         ${parsedTarget.value.hostname}:${parsedTarget.value.port} ${dim3(`\xB7 published for ${serverUrl}`)}`
+  say4(
+    `gateway         ${parsedTarget.value.hostname}:${parsedTarget.value.port} ${dim4(`\xB7 published for ${serverUrl}`)}`
   );
-  say3(
-    picked.value === null ? `client key      ${warn("none available")} ${dim3("\xB7 run: mend ssh setup")}` : readiness.keyRegistered ? `client key      ${green3("\u25CF")} ${picked.value.fingerprint} ${dim3("\xB7 registered")}` : `client key      ${warn("not registered")} ${dim3(`\xB7 ${picked.value.fingerprint}`)}`
+  say4(
+    picked.value === null ? `client key      ${warn("none available")} ${dim4("\xB7 run: mend ssh setup")}` : readiness.keyRegistered ? `client key      ${green4("\u25CF")} ${picked.value.fingerprint} ${dim4("\xB7 registered")}` : `client key      ${warn("not registered")} ${dim4(`\xB7 ${picked.value.fingerprint}`)}`
   );
-  say3(
-    readiness.configReady ? `ssh config      ${green3("\u25CF")} Host ${parsedTarget.value.alias} ${dim3(`\xB7 ${sshConfigPath()}`)}` : `ssh config      ${warn("missing or stale")} ${dim3("\xB7 run: mend ssh setup")}`
+  say4(
+    readiness.configReady ? `ssh config      ${green4("\u25CF")} Host ${parsedTarget.value.alias} ${dim4(`\xB7 ${sshConfigPath()}`)}` : `ssh config      ${warn("missing or stale")} ${dim4("\xB7 run: mend ssh setup")}`
   );
-  say3(
+  say4(
     "host trust      not checked \xB7 status checks config and client-key registration, not an SSH connection"
   );
 };
@@ -4490,7 +5104,7 @@ var setup = async (api2, cliHome, serverUrl, args) => {
   if (picked.value === null) return showFailure("No workspace SSH key is available.");
   const registered = await api2("POST", "/workspace-ssh/keys", {
     publicKey: picked.value.publicKey,
-    name: os5.hostname()
+    name: os6.hostname()
   });
   const sourceLabel = {
     explicit: "from --key",
@@ -4498,22 +5112,22 @@ var setup = async (api2, cliHome, serverUrl, args) => {
     existing: "existing selected key",
     generated: "generated dedicated key"
   }[picked.value.source];
-  say3(`key             ${green3("\u25CF")} ${registered.fingerprint} ${dim3(`\xB7 ${sourceLabel}`)}`);
+  say4(`key             ${green4("\u25CF")} ${registered.fingerprint} ${dim4(`\xB7 ${sourceLabel}`)}`);
   const written = writeWorkspaceSshConfig(
     sshConfigPath(),
     parsedTarget.value,
     picked.value.identityFile
   );
   if (written.ok === false) return showFailure(written.error.message);
-  say3(
-    `ssh config      ${green3("\u25CF")} Host ${parsedTarget.value.alias} ${dim3(`\xB7 ${sshConfigPath()}`)}`
+  say4(
+    `ssh config      ${green4("\u25CF")} Host ${parsedTarget.value.alias} ${dim4(`\xB7 ${sshConfigPath()}`)}`
   );
-  say3(
+  say4(
     "host trust      not checked \xB7 SSH verifies the gateway when you connect; setup does not replace known_hosts entries"
   );
-  say3("");
-  say3(
-    `connect with    ssh ${view.gateway.usernamePrefix}-<workspace-id>@${parsedTarget.value.alias} ${dim3("\xB7 the VS Code extension uses this automatically")}`
+  say4("");
+  say4(
+    `connect with    ssh ${view.gateway.usernamePrefix}-<workspace-id>@${parsedTarget.value.alias} ${dim4("\xB7 the VS Code extension uses this automatically")}`
   );
 };
 var sshCommand = async (args, api2, cliHome, serverUrl) => {
@@ -4532,8 +5146,8 @@ var sshCommand = async (args, api2, cliHome, serverUrl) => {
 };
 
 // src/uninstall.ts
-import * as fs8 from "node:fs";
-import * as path9 from "node:path";
+import * as fs10 from "node:fs";
+import * as path11 from "node:path";
 var UNINSTALL_USAGE = "usage: mend uninstall [--all | --server | --home] [--yes]";
 var parseUninstallArgs = (args) => {
   let scope = null;
@@ -4555,14 +5169,14 @@ var parseUninstallArgs = (args) => {
 var SERVER_FILES = ["identity.env", "active", "generations", "backups"];
 var countEntries = (directory) => {
   try {
-    return fs8.readdirSync(directory).length;
+    return fs10.readdirSync(directory).length;
   } catch {
     return 0;
   }
 };
 var exists = (file) => {
   try {
-    fs8.lstatSync(file);
+    fs10.lstatSync(file);
     return true;
   } catch {
     return false;
@@ -4571,7 +5185,7 @@ var exists = (file) => {
 var managedBlockCount = (sshConfigFile) => {
   let config;
   try {
-    config = fs8.readFileSync(sshConfigFile, "utf8");
+    config = fs10.readFileSync(sshConfigFile, "utf8");
   } catch {
     return 0;
   }
@@ -4595,27 +5209,27 @@ var describeUninstall = async (runtime, scope) => {
       if (!read.error.message.startsWith("No Mend server is configured")) throw read.error;
       server = "none";
     } else if (read.value === null) {
-      server = exists(path9.join(configDir, "identity.env")) ? {
+      server = exists(path11.join(configDir, "identity.env")) ? {
         version: "(no active generation)",
         appUrl: "",
         dockerContext: "",
-        generations: countEntries(path9.join(configDir, "generations")),
-        backups: countEntries(path9.join(configDir, "backups"))
+        generations: countEntries(path11.join(configDir, "generations")),
+        backups: countEntries(path11.join(configDir, "backups"))
       } : "none";
     } else {
       server = {
         version: read.value.config.serverVersion,
         appUrl: read.value.config.appUrl,
         dockerContext: read.value.config.dockerContext,
-        generations: countEntries(path9.join(configDir, "generations")),
-        backups: countEntries(path9.join(configDir, "backups"))
+        generations: countEntries(path11.join(configDir, "generations")),
+        backups: countEntries(path11.join(configDir, "backups"))
       };
     }
   }
   let home = null;
   if (scope !== "server") {
-    const cliConfig = path9.join(runtime.cliHome, "cli.json");
-    const sshDirectory = path9.join(runtime.cliHome, "ssh");
+    const cliConfig = path11.join(runtime.cliHome, "cli.json");
+    const sshDirectory = path11.join(runtime.cliHome, "ssh");
     home = {
       cliConfig: exists(cliConfig) ? cliConfig : null,
       sshDirectory: exists(sshDirectory) ? sshDirectory : null,
@@ -4747,7 +5361,7 @@ var removeServer = async (runtime, failures, leftovers) => {
         }
       }
       for (const name of SERVER_FILES) {
-        fs8.rmSync(path9.join(configDir, name), { recursive: true, force: true });
+        fs10.rmSync(path11.join(configDir, name), { recursive: true, force: true });
       }
       server.writeLine(`removed ${configDir}/{identity.env, active, generations, backups}`);
     },
@@ -4758,20 +5372,20 @@ var removeServer = async (runtime, failures, leftovers) => {
 var removeHome = async (runtime, plan, failures, leftovers) => {
   const { server } = runtime;
   if (plan.cliConfig !== null) {
-    fs8.rmSync(plan.cliConfig, { force: true });
+    fs10.rmSync(plan.cliConfig, { force: true });
     server.writeLine(`removed ${plan.cliConfig}`);
   }
   if (plan.sshDirectory !== null) {
-    fs8.rmSync(plan.sshDirectory, { recursive: true, force: true });
+    fs10.rmSync(plan.sshDirectory, { recursive: true, force: true });
     server.writeLine(`removed ${plan.sshDirectory}`);
   }
   if (plan.managedSshBlocks > 0) {
     try {
-      const before = fs8.readFileSync(runtime.sshConfigFile, "utf8");
+      const before = fs10.readFileSync(runtime.sshConfigFile, "utf8");
       const stripped = stripManagedWorkspaceSshBlocks(before);
       if (!stripped.ok) throw stripped.error;
       if (stripped.value.removed > 0) {
-        fs8.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
+        fs10.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
         server.writeLine(
           `removed ${plural(stripped.value.removed, "managed block")} from ${runtime.sshConfigFile}`
         );
@@ -4784,12 +5398,12 @@ var removeHome = async (runtime, plan, failures, leftovers) => {
   }
   let remaining = [];
   try {
-    remaining = fs8.readdirSync(runtime.cliHome);
+    remaining = fs10.readdirSync(runtime.cliHome);
   } catch {
     return;
   }
   if (remaining.length === 0) {
-    fs8.rmdirSync(runtime.cliHome);
+    fs10.rmdirSync(runtime.cliHome);
     server.writeLine(`removed ${runtime.cliHome}`);
   } else {
     leftovers.push(
@@ -4817,24 +5431,57 @@ var executeUninstall = async (runtime, plan) => {
   return { failures, leftovers };
 };
 
+// src/upgrade-url.ts
+var PATHS = {
+  tty: "/api/tty",
+  "service-tunnel": "/api/service-tunnel",
+  "keys-bridge": "/api/keys/bridge/ws"
+};
+var upgradeBaseUrl = (serverUrl, target, params, extra = {}) => {
+  const url = new URL(`${serverUrl.replace(/\/$/, "")}${PATHS[target]}`);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  for (const [key, value] of Object.entries({ ...params, ...extra })) {
+    if (typeof value === "string" && value !== "") url.searchParams.set(key, value);
+  }
+  return url;
+};
+var mintRefusedInTransit = async (serverUrl, send = fetch) => {
+  try {
+    const response = await send(`${serverUrl.replace(/\/$/, "")}/api/health`);
+    if (!response.ok) return false;
+    const health = await response.json();
+    return typeof health === "object" && health !== null && "upgradeTickets" in health && health.upgradeTickets === true;
+  } catch {
+    return false;
+  }
+};
+var MINT_REFUSED_IN_TRANSIT = "POST /api/upgrade-tickets answered 404, but this server mints upgrade tickets: something between this client and Mend is refusing it. The saved token was not put in a URL.";
+var upgradeUrl = async (input) => {
+  const url = upgradeBaseUrl(input.serverUrl, input.target, input.params, input.extra);
+  const minted = await input.mint(input.target, input.params);
+  if (minted.kind === "ticket") url.searchParams.set("ticket", minted.ticket);
+  else if (input.legacyToken !== null) url.searchParams.set("token", input.legacyToken);
+  return url;
+};
+
 // src/main.ts
 var mendCliHome = () => {
   const xdg = process.env["XDG_CONFIG_HOME"];
-  const preferred = path10.join(
-    xdg === void 0 || xdg === "" ? path10.join(os6.homedir(), ".config") : xdg,
+  const preferred = path12.join(
+    xdg === void 0 || xdg === "" ? path12.join(os7.homedir(), ".config") : xdg,
     "mend"
   );
-  const legacy = path10.join(os6.homedir(), ".mend");
-  return !fs9.existsSync(preferred) && fs9.existsSync(legacy) ? legacy : preferred;
+  const legacy = path12.join(os7.homedir(), ".mend");
+  return !fs11.existsSync(preferred) && fs11.existsSync(legacy) ? legacy : preferred;
 };
-var CONFIG_PATH = path10.join(mendCliHome(), "cli.json");
+var CONFIG_PATH = path12.join(mendCliHome(), "cli.json");
 var loadConfig = () => {
   let fileConfig = {};
-  if (fs9.existsSync(CONFIG_PATH)) {
+  if (fs11.existsSync(CONFIG_PATH)) {
     try {
-      fileConfig = JSON.parse(fs9.readFileSync(CONFIG_PATH, "utf8"));
+      fileConfig = JSON.parse(fs11.readFileSync(CONFIG_PATH, "utf8"));
     } catch {
-      fail4(`could not parse ${CONFIG_PATH}`);
+      fail5(`could not parse ${CONFIG_PATH}`);
     }
   }
   const configuredUrl = process.env["MEND_URL"] ?? fileConfig.url ?? null;
@@ -4845,7 +5492,7 @@ var loadConfig = () => {
     deviceId: fileConfig.deviceId ?? null
   };
 };
-var fail4 = (message) => {
+var fail5 = (message) => {
   process.stderr.write(`mend: ${message}
 `);
   process.exit(1);
@@ -4854,18 +5501,18 @@ var parseMendUrl = (value) => {
   try {
     return new URL(value);
   } catch {
-    return fail4(`"${value}" is not a valid Mend URL`);
+    return fail5(`"${value}" is not a valid Mend URL`);
   }
 };
-var paint3 = (code) => (text) => process.stdout.isTTY ? `\x1B[${code}m${text}\x1B[0m` : text;
-var dim4 = paint3("2");
-var green4 = paint3("32");
-var amber = paint3("33");
-var cobalt2 = paint3("34");
-var say4 = (line) => process.stdout.write(`${line}
+var paint4 = (code) => (text) => process.stdout.isTTY ? `\x1B[${code}m${text}\x1B[0m` : text;
+var dim5 = paint4("2");
+var green5 = paint4("32");
+var amber = paint4("33");
+var cobalt2 = paint4("34");
+var say5 = (line) => process.stdout.write(`${line}
 `);
 var detachKeyEnabled = process.env["MEND_DETACH_KEY"] !== "none";
-var detachHint = () => detachKeyEnabled ? ` \xB7 detach: ${dim4("Ctrl+]")}` : "";
+var detachHint = () => detachKeyEnabled ? ` \xB7 detach: ${dim5("Ctrl+]")}` : "";
 var herdrAgentOf = (harness) => {
   if (harness === "codex" || harness === "claude" || harness === "opencode") return harness;
   return null;
@@ -4933,9 +5580,42 @@ var api = async (config, method, route, body) => {
   try {
     return await request(config, method, route, body);
   } catch (error) {
-    return fail4(error instanceof Error ? error.message : String(error));
+    return fail5(error instanceof Error ? error.message : String(error));
   }
 };
+var warnedLegacyBearer = false;
+var mintTicket = (config) => async (target, params) => {
+  const headers = { "content-type": "application/json" };
+  if (config.token !== null) headers["authorization"] = `Bearer ${config.token}`;
+  const response = await fetch(`${config.url}/api/upgrade-tickets`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ target, ...params })
+  });
+  if (response.status === 404) {
+    if (await mintRefusedInTransit(config.url)) throw new Error(MINT_REFUSED_IN_TRANSIT);
+    if (config.token !== null && !warnedLegacyBearer) {
+      warnedLegacyBearer = true;
+      console.error(
+        "mend: this server predates upgrade tickets, so the saved token rides the socket's URL. Upgrade the server to stop that."
+      );
+    }
+    return { kind: "unsupported" };
+  }
+  if (!response.ok) throw new Error(`upgrade ticket refused (${response.status})`);
+  const minted = await response.json();
+  if (typeof minted.ticket !== "string")
+    throw new Error("upgrade ticket missing from the answer");
+  return { kind: "ticket", ticket: minted.ticket };
+};
+var socketUrl = (config, target, params, extra) => upgradeUrl({
+  serverUrl: parseMendUrl(config.url).toString(),
+  target,
+  params,
+  ...extra === void 0 ? {} : { extra },
+  mint: mintTicket(config),
+  legacyToken: config.token
+});
 var boundApi = (config) => (method, route, body) => api(config, method, route, body);
 var withSpinner = async (label, work) => {
   if (process.stdout.isTTY !== true) return work;
@@ -4944,7 +5624,7 @@ var withSpinner = async (label, work) => {
   let frame = 0;
   const timer = setInterval(() => {
     const seconds = Math.round((Date.now() - started) / 1e3);
-    process.stdout.write(`\r  ${frames[frame % frames.length]} ${label} ${dim4(`${seconds}s`)} `);
+    process.stdout.write(`\r  ${frames[frame % frames.length]} ${label} ${dim5(`${seconds}s`)} `);
     frame += 1;
   }, 120);
   try {
@@ -4958,66 +5638,74 @@ var adopt = async (config, args) => {
   const nameFlag = args.indexOf("--name");
   const name = nameFlag !== -1 && args[nameFlag + 1] !== void 0 ? String(args[nameFlag + 1]) : null;
   const authFlagIndex = args.indexOf("--auth");
+  if (args.includes("--private") && args.includes("--shared")) {
+    return fail5("--private and --shared pick one visibility; pass one of them");
+  }
+  const visibility = args.includes("--shared") ? "shared" : "private";
   const positional = args.filter(
     (a, i) => !a.startsWith("--") && (nameFlag === -1 || i !== nameFlag + 1) && (authFlagIndex === -1 || i !== authFlagIndex + 1)
   );
   const source = positional[0] ?? gitOriginUrl(process.cwd());
   if (source === null) {
-    return fail4(
+    return fail5(
       "No Git URL was given and this repository has no origin. Run mend adopt <git-url>."
     );
   }
   const sourceIssue = repositoryCloneUrlIssue(source);
-  if (sourceIssue !== null) return fail4(sourceIssue);
-  const projectName = name ?? normalizeProjectName(path10.basename(source, ".git"));
+  if (sourceIssue !== null) return fail5(sourceIssue);
+  const projectName = name ?? normalizeProjectName(path12.basename(source, ".git"));
   const auth = authFlagIndex !== -1 && args[authFlagIndex + 1] !== void 0 ? String(args[authFlagIndex + 1]) : null;
   if (auth !== null && auth !== "ambient" && auth !== "mend-key" && auth !== "bridge") {
-    return fail4(`--auth takes "ambient", "mend-key", or "bridge", not "${auth}"`);
+    return fail5(`--auth takes "ambient", "mend-key", or "bridge", not "${auth}"`);
   }
   const project2 = await api(config, "POST", "/projects", {
     name: projectName,
     source,
+    visibility,
     ...auth === null ? {} : { gitAuthMode: auth }
   });
-  say4(`${green4("\u2713")} adopted \xB7 ${project2.name} \xB7 ${dim4(project2.storePath)}`);
-  say4(`${dim4("  default branch")} ${project2.defaultBranch}`);
+  say5(`${green5("\u2713")} adopted \xB7 ${project2.name} \xB7 ${dim5(project2.storePath)}`);
+  say5(`${dim5("  default branch")} ${project2.defaultBranch}`);
+  say5(
+    `${dim5("  visible to")} ${visibility === "private" ? "only you" : "everyone in the organization"}`
+  );
   if (project2.gitAuthMode === "mend-key") {
-    say4(`${dim4("  git auth")} mend key ${dim4("(your Mend key signed this clone)")}`);
+    say5(`${dim5("  git auth")} mend key ${dim5("(your Mend key signed this clone)")}`);
   } else if (project2.gitAuthMode === "bridge") {
-    say4(`${dim4("  git auth")} bridge ${dim4("(signed through the connected `mend keys share`)")}`);
+    say5(`${dim5("  git auth")} bridge ${dim5("(signed through the connected `mend keys share`)")}`);
   }
-  say4(
-    `${dim4("  sessions start with:")} mend codex ${dim4("(from anywhere \u2014")} --project ${project2.name}${dim4(")")}`
+  say5(
+    `${dim5("  sessions start with:")} mend codex ${dim5("(from anywhere \u2014")} --project ${project2.name}${dim5(")")}`
   );
 };
 var findProject = async (config, explicit, adoptCwd = false) => {
   const projects = await api(config, "GET", "/projects");
   if (explicit !== null) {
     const named = projects.find((p) => p.name === explicit);
-    if (named === void 0) return fail4(`no adopted project named "${explicit}"`);
+    if (named === void 0) return fail5(`no adopted project named "${explicit}"`);
     return named;
   }
   const cwd = process.cwd();
   const project2 = matchProjectByCwd(projects, cwdFacts(cwd));
   if (project2 !== void 0) return project2;
   if (!adoptCwd) {
-    return fail4(
+    return fail5(
       `no adopted project matches ${cwd} \u2014 run "mend adopt" here first, or name one with --project`
     );
   }
   const facts = cwdFacts(cwd);
   if (facts.repoRoot === null || facts.originUrl === null) {
-    return fail4(
+    return fail5(
       `${cwd} does not match an adopted project with a Git origin \u2014 run "mend adopt <git-url>" first`
     );
   }
   const sourceIssue = repositoryCloneUrlIssue(facts.originUrl);
-  if (sourceIssue !== null) return fail4(sourceIssue);
+  if (sourceIssue !== null) return fail5(sourceIssue);
   const adopted = await api(config, "POST", "/projects", {
-    name: normalizeProjectName(path10.basename(facts.repoRoot)),
+    name: normalizeProjectName(path12.basename(facts.repoRoot)),
     source: facts.originUrl
   });
-  say4(`${green4("\u2713")} adopted \xB7 ${adopted.name} \xB7 ${dim4(adopted.storePath)}`);
+  say5(`${green5("\u2713")} adopted \xB7 ${adopted.name} \xB7 ${dim5(adopted.storePath)}`);
   return adopted;
 };
 var resolvedBackgroundSessions = async (config, project2) => {
@@ -5039,7 +5727,7 @@ var askWorktreeName = async () => {
   const readline = await import("node:readline/promises");
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   try {
-    const answer = (await rl.question(`  worktree name ${dim4("(enter for auto)")}: `)).trim();
+    const answer = (await rl.question(`  worktree name ${dim5("(enter for auto)")}: `)).trim();
     return answer === "" ? null : normalizeProjectName(answer);
   } finally {
     rl.close();
@@ -5047,35 +5735,35 @@ var askWorktreeName = async () => {
 };
 var launch = async (config, harness, args) => {
   const parsed = parseLaunchArgs(args);
-  if (parsed.error !== null) return fail4(parsed.error);
+  if (parsed.error !== null) return fail5(parsed.error);
   const structured = parsed.prompt !== null || parsed.model !== null || parsed.effort !== null || parsed.ask || parsed.fast;
   if (harness === "run" && structured) {
-    return fail4(`mend run takes no prompt or harness flags \xB7 ${usageOf("run")}`);
+    return fail5(`mend run takes no prompt or harness flags \xB7 ${usageOf("run")}`);
   }
   if (harness === "run" && (parsed.detach || parsed.foreground)) {
-    return fail4(
+    return fail5(
       "mend run takes no lifecycle flags \u2014 it tails the record; Ctrl+C stops watching, not the command"
     );
   }
   const argv = harness === "run" ? parsed.custom : HARNESS_COMMANDS[harness] ?? [];
   if (argv.length === 0) {
-    return fail4(harness === "run" ? usageOf("run") : `unknown harness ${harness}`);
+    return fail5(harness === "run" ? usageOf("run") : `unknown harness ${harness}`);
   }
   const project2 = await findProject(config, parsed.project, true);
-  say4(
-    `${green4("\u2713")} project ${project2.name} ${dim4(`\xB7 ${project2.defaultBranch}${parsed.project === null ? " \xB7 from cwd" : ""}`)}`
+  say5(
+    `${green5("\u2713")} project ${project2.name} ${dim5(`\xB7 ${project2.defaultBranch}${parsed.project === null ? " \xB7 from cwd" : ""}`)}`
   );
   let worktreeName;
   if (parsed.worktree !== null) {
     const detail = await api(config, "GET", `/projects/${project2.id}`);
     const existing = detail.worktrees ?? [];
     if (detail.worktrees === void 0) {
-      return fail4("this server predates shared worktrees \u2014 use --name instead");
+      return fail5("this server predates shared worktrees \u2014 use --name instead");
     }
     const match = existing.find((worktree) => worktree.name === parsed.worktree) ?? (existing.filter((worktree) => worktree.name.startsWith(parsed.worktree ?? "")).length === 1 ? existing.find((worktree) => worktree.name.startsWith(parsed.worktree ?? "")) : void 0);
     if (match === void 0) {
       const names = existing.map((worktree) => worktree.name).join(", ");
-      return fail4(
+      return fail5(
         `no worktree matches "${parsed.worktree}" in ${project2.name}${names === "" ? "" : ` \u2014 have: ${names}`}`
       );
     }
@@ -5092,8 +5780,8 @@ var launch = async (config, harness, args) => {
       const members = (detail?.sessions ?? []).filter(
         (candidate) => candidate.worktreeId === joined.id
       ).length;
-      say4(
-        `${green4("\u2713")} joins worktree ${joined.name} ${dim4(`\xB7 ${members} session${members === 1 ? "" : "s"} \xB7 branch ${joined.branch}`)}`
+      say5(
+        `${green5("\u2713")} joins worktree ${joined.name} ${dim5(`\xB7 ${members} session${members === 1 ? "" : "s"} \xB7 branch ${joined.branch}`)}`
       );
     }
   }
@@ -5118,12 +5806,12 @@ var launch = async (config, harness, args) => {
     base: parsed.base
   });
   createdSessionId = session.id;
-  say4(`${green4("\u2713")} worktree ${session.worktree} ${dim4(`\xB7 branch ${session.branch}`)}`);
+  say5(`${green5("\u2713")} worktree ${session.worktree} ${dim5(`\xB7 branch ${session.branch}`)}`);
   const baseWord = session.baseRef === null ? "" : `${session.baseRef} `;
-  say4(
-    `${green4("\u2713")} base ${baseWord}${dim4(session.baseSha.slice(0, 12))} \xB7 session ${dim4(session.id.slice(0, 8))}`
+  say5(
+    `${green5("\u2713")} base ${baseWord}${dim5(session.baseSha.slice(0, 12))} \xB7 session ${dim5(session.id.slice(0, 8))}`
   );
-  say4(`${cobalt2("  watch")} \xB7 ${config.url}/sessions/${session.id}`);
+  say5(`${cobalt2("  watch")} \xB7 ${config.url}/sessions/${session.id}`);
   if (harness === "run") {
     return supervisedRun(config, session, argv);
   }
@@ -5139,23 +5827,28 @@ var launch = async (config, harness, args) => {
     api(config, "POST", `/sessions/${session.id}/launch`, launchBody)
   );
   if (lifecycle === "detach") {
-    say4(`${green4("\u2713 recording")} \xB7 running detached`);
-    say4(`${cobalt2("  attach")} \xB7 mend attach ${session.id.slice(0, 8)}`);
+    say5(`${green5("\u2713 recording")} \xB7 running detached`);
+    say5(`${cobalt2("  attach")} \xB7 mend attach ${session.id.slice(0, 8)}`);
     return;
   }
-  say4(`${green4("\u2713 recording")} \xB7 workspace mounts the worktree${detachHint()}`);
-  say4("");
+  say5(`${green5("\u2713 recording")} \xB7 workspace mounts the worktree${detachHint()}`);
+  say5("");
   attachOwnsSignals = true;
   await attachOrExit(config, session.id, session.harness, lifecycle);
   exitAfterSessionEnd(config, session.id);
 };
 var attachTty = async (config, sessionId, harness, from, processId, options) => {
-  const url = parseMendUrl(`${config.url}/api/tty`);
-  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  if (processId === void 0) url.searchParams.set("session", sessionId);
-  else url.searchParams.set("process", processId);
-  url.searchParams.set("from", from.toString());
-  if (config.token !== null) url.searchParams.set("token", config.token);
+  let url;
+  try {
+    url = await socketUrl(
+      config,
+      "tty",
+      processId === void 0 ? { session: sessionId } : { process: processId },
+      { from: from.toString() }
+    );
+  } catch {
+    return "unavailable";
+  }
   const ws = new WebSocket(url);
   ws.binaryType = "arraybuffer";
   try {
@@ -5299,44 +5992,44 @@ var stopSessionQuickly = async (config, sessionId) => {
 var stopAndExit = async (config, sessionId) => {
   const id8 = sessionId.slice(0, 8);
   if (await stopSessionQuickly(config, sessionId)) {
-    say4(`${green4("\u2713")} stopped \xB7 ${id8}`);
-    say4(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${sessionId}`);
+    say5(`${green5("\u2713")} stopped \xB7 ${id8}`);
+    say5(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${sessionId}`);
     process.exit(0);
   }
-  say4(`${amber("could not stop")} \u2014 the session may still run \xB7 mend stop ${id8}`);
+  say5(`${amber("could not stop")} \u2014 the session may still run \xB7 mend stop ${id8}`);
   process.exit(1);
 };
 var finishAttach = async (config, sessionId, outcome, mode = "background") => {
   const id8 = sessionId.slice(0, 8);
   if (outcome === "unavailable") {
-    return fail4(`tty attach unavailable: could not connect to ${config.url}`);
+    return fail5(`tty attach unavailable: could not connect to ${config.url}`);
   }
   if (outcome === "detached") {
-    say4("");
-    say4(`${amber("detached")} \u2014 the session keeps running; reattach: mend attach ${id8}`);
+    say5("");
+    say5(`${amber("detached")} \u2014 the session keeps running; reattach: mend attach ${id8}`);
     process.exit(0);
   }
   if (outcome === "interrupted") {
-    say4("");
+    say5("");
     if (mode === "foreground") return stopAndExit(config, sessionId);
-    say4(`${amber("detached")} \u2014 the session keeps running; reattach: mend attach ${id8}`);
+    say5(`${amber("detached")} \u2014 the session keeps running; reattach: mend attach ${id8}`);
     process.exit(0);
   }
   if (outcome === "dropped") {
-    say4("");
+    say5("");
     if (mode === "foreground") {
       let live;
       try {
         const detail = await request(config, "GET", `/sessions/${sessionId}`);
         live = agentIsLive(detail.session, detail.currentAgent);
       } catch {
-        say4(`${amber("could not stop")} \u2014 the session may still run \xB7 mend stop ${id8}`);
+        say5(`${amber("could not stop")} \u2014 the session may still run \xB7 mend stop ${id8}`);
         process.exit(1);
       }
       if (!live) return;
       return stopAndExit(config, sessionId);
     }
-    say4(`${amber("disconnected")} \u2014 the session keeps running; reattach: mend attach ${id8}`);
+    say5(`${amber("disconnected")} \u2014 the session keeps running; reattach: mend attach ${id8}`);
     process.exit(0);
   }
 };
@@ -5347,9 +6040,9 @@ var attachOrExit = async (config, sessionId, harness, mode = "background") => fi
   mode
 );
 var exitAfterSessionEnd = (config, sessionId) => {
-  say4("");
-  say4(`${green4("\u2713")} session ended`);
-  say4(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${sessionId}`);
+  say5("");
+  say5(`${green5("\u2713")} session ended`);
+  say5(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${sessionId}`);
   process.exit(0);
 };
 var attach = async (config, args) => {
@@ -5360,26 +6053,26 @@ var attach = async (config, args) => {
   }
   const sessions = await api(config, "GET", "/sessions");
   const match = sessions.find((s) => s.id.startsWith(prefix));
-  if (match === void 0) return fail4(`no active session matches "${prefix}"`);
+  if (match === void 0) return fail5(`no active session matches "${prefix}"`);
   return attachPicked(config, match);
 };
 var attachPicked = async (config, session) => {
-  say4(
-    `${green4("\u2713")} attaching to ${sessionDisplayName(session)} \xB7 ${session.harness} ${dim4(session.id.slice(0, 8))}${detachHint()}`
+  say5(
+    `${green5("\u2713")} attaching to ${sessionDisplayName(session)} \xB7 ${session.harness} ${dim5(session.id.slice(0, 8))}${detachHint()}`
   );
-  say4("");
+  say5("");
   const outcome = await attachTty(config, session.id, session.harness, 0n, void 0, {
     handleSignals: true
   });
   if (outcome === "unavailable") {
     const detail = await api(config, "GET", `/sessions/${session.id}`);
     if (detail.currentAgent?.kind === "agent-protocol" && agentIsLive(detail.session, detail.currentAgent)) {
-      say4(`${amber("taking over")} from the protocol session`);
+      say5(`${amber("taking over")} from the protocol session`);
       await withSpinner(
         "reopening as a terminal \u2014 same conversation\u2026",
         api(config, "POST", `/sessions/${session.id}/handoff`, { to: "pty" })
       );
-      say4("");
+      say5("");
       await attachOrExit(config, session.id, session.harness);
       return exitAfterSessionEnd(config, session.id);
     }
@@ -5398,7 +6091,7 @@ var stopCommand = async (config, args) => {
     return;
   }
   if (!all && prefix === void 0) {
-    return fail4(usageOf("stop"));
+    return fail5(usageOf("stop"));
   }
   const [sessions, projects] = await Promise.all([
     api(config, "GET", "/sessions"),
@@ -5407,21 +6100,21 @@ var stopCommand = async (config, args) => {
   let scoped = sessions;
   if (projectName !== null) {
     const project2 = projects.find((p) => p.name === projectName);
-    if (project2 === void 0) return fail4(`no project named "${projectName}"`);
+    if (project2 === void 0) return fail5(`no project named "${projectName}"`);
     scoped = sessions.filter((s) => s.projectId === project2.id);
   }
   let targets;
   if (all) {
     targets = scoped;
     if (targets.length === 0) {
-      say4("no active sessions");
+      say5("no active sessions");
       return;
     }
   } else {
     const matches = scoped.filter((s) => s.id.startsWith(prefix ?? ""));
-    if (matches.length === 0) return fail4(`no active session matches "${prefix}"`);
+    if (matches.length === 0) return fail5(`no active session matches "${prefix}"`);
     if (matches.length > 1) {
-      return fail4(`session prefix "${prefix}" is ambiguous \u2014 use more of the id`);
+      return fail5(`session prefix "${prefix}" is ambiguous \u2014 use more of the id`);
     }
     targets = matches;
   }
@@ -5430,20 +6123,20 @@ var stopCommand = async (config, args) => {
 var stopSessions = async (config, targets, summarise) => {
   for (const session of targets) {
     await api(config, "POST", `/sessions/${session.id}/stop`);
-    say4(
-      `${green4("\u2713")} stopped \xB7 ${session.harness} \xB7 ${dim4(session.id.slice(0, 8))} \xB7 ${session.branch}`
+    say5(
+      `${green5("\u2713")} stopped \xB7 ${session.harness} \xB7 ${dim5(session.id.slice(0, 8))} \xB7 ${session.branch}`
     );
-    say4(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${session.id}`);
+    say5(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${session.id}`);
   }
   if (summarise) {
-    say4(`${green4("\u2713")} stopped ${targets.length} session${targets.length === 1 ? "" : "s"}`);
+    say5(`${green5("\u2713")} stopped ${targets.length} session${targets.length === 1 ? "" : "s"}`);
   }
 };
 var pickSessionInteractively = async (rows) => {
-  say4(dim4("more than one live session \u2014 pick one:"));
+  say5(dim5("more than one live session \u2014 pick one:"));
   rows.forEach((row, index) => {
-    say4(
-      `  ${index + 1}. ${row.session.harness.padEnd(8)} ${dim4(row.session.id.slice(0, 8))}  ${row.projectName}  ${dim4(row.session.branch)}  ${dim4(row.session.status)}`
+    say5(
+      `  ${index + 1}. ${row.session.harness.padEnd(8)} ${dim5(row.session.id.slice(0, 8))}  ${row.projectName}  ${dim5(row.session.branch)}  ${dim5(row.session.status)}`
     );
   });
   const readline = await import("node:readline/promises");
@@ -5451,17 +6144,17 @@ var pickSessionInteractively = async (rows) => {
   const answer = await rl.question("  session #: ");
   rl.close();
   const chosen = rows[Number(answer.trim()) - 1];
-  if (chosen === void 0) return fail4(`"${answer.trim()}" is not one of the choices`);
+  if (chosen === void 0) return fail5(`"${answer.trim()}" is not one of the choices`);
   return chosen.session;
 };
 var resolveLiveSession = async (config, prefix, command) => {
   const sessions = await api(config, "GET", "/sessions?retained=1");
   if (prefix !== void 0) {
     const matches = sessions.filter((s) => s.id.startsWith(prefix));
-    if (matches.length === 0) return fail4(`no live or retained session matches "${prefix}"`);
+    if (matches.length === 0) return fail5(`no live or retained session matches "${prefix}"`);
     const exact = matches[0];
     if (matches.length > 1 || exact === void 0) {
-      return fail4(`session prefix "${prefix}" is ambiguous \u2014 use more of the id`);
+      return fail5(`session prefix "${prefix}" is ambiguous \u2014 use more of the id`);
     }
     return exact;
   }
@@ -5470,11 +6163,11 @@ var resolveLiveSession = async (config, prefix, command) => {
   const candidates = project2 === void 0 ? sessions : sessions.filter((s) => s.projectId === project2.id);
   const only = candidates[0];
   if (only === void 0) {
-    return fail4("no live or retained session \u2014 start one with mend codex|claude|opencode");
+    return fail5("no live or retained session \u2014 start one with mend codex|claude|opencode");
   }
   if (candidates.length === 1) return only;
   if (process.stdin.isTTY !== true) {
-    return fail4(`several live sessions \u2014 name one: mend ${command} <session-id-prefix>`);
+    return fail5(`several live sessions \u2014 name one: mend ${command} <session-id-prefix>`);
   }
   const nameById = new Map(projects.map((p) => [p.id, p.name]));
   return pickSessionInteractively(
@@ -5487,26 +6180,26 @@ var resolveLiveSession = async (config, prefix, command) => {
 var shellCommand = async (config, args) => {
   const prefix = args.find((a) => !a.startsWith("--"));
   const session = await resolveLiveSession(config, prefix, "shell");
-  say4(
-    `${green4("\u2713")} shell in ${session.harness} session ${dim4(session.id.slice(0, 8))} \xB7 ${dim4(session.branch)}${detachHint()}`
+  say5(
+    `${green5("\u2713")} shell in ${session.harness} session ${dim5(session.id.slice(0, 8))} \xB7 ${dim5(session.branch)}${detachHint()}`
   );
   const shellProcess = await withSpinner(
     "opening a shell in the session workspace\u2026",
     api(config, "POST", `/sessions/${session.id}/shell`)
   );
-  say4("");
+  say5("");
   const outcome = await attachTty(config, session.id, "shell", 0n, shellProcess.id, {
     handleSignals: true
   });
   if (outcome === "unavailable") {
-    return fail4(`tty attach unavailable: could not connect to ${config.url}`);
+    return fail5(`tty attach unavailable: could not connect to ${config.url}`);
   }
-  say4("");
+  say5("");
   if (outcome === "detached" || outcome === "interrupted" || outcome === "dropped") {
-    say4(`${amber("detached")} \u2014 the shell keeps running and holds the workspace open`);
+    say5(`${amber("detached")} \u2014 the shell keeps running and holds the workspace open`);
     process.exit(0);
   }
-  say4(`${green4("\u2713")} shell ended`);
+  say5(`${green5("\u2713")} shell ended`);
   process.exit(0);
 };
 var flattenService = (view) => {
@@ -5547,30 +6240,30 @@ var serviceUrl = (service) => service.browserUrl ?? (service.authority === null
 var printServiceAccess = (config, service, tunneling = false) => {
   const gate = "no Mend sign-in on this port \u2014 network reach is the only gate";
   if (serverIsLocal(config)) {
-    if (service.authority !== null) say4(`  ${cobalt2(serviceUrl(service))}  ${dim4(gate)}`);
+    if (service.authority !== null) say5(`  ${cobalt2(serviceUrl(service))}  ${dim5(gate)}`);
     return;
   }
   if (service.protocol === "udp") {
     if (service.authority !== null) {
-      say4(`  ${cobalt2(serviceUrl(service))} ${dim4(`on the server's network \xB7 ${gate}`)}`);
+      say5(`  ${cobalt2(serviceUrl(service))} ${dim5(`on the server's network \xB7 ${gate}`)}`);
     }
     return;
   }
   if (!tunneling) {
     const local = service.hostPort ?? service.workspacePort;
-    say4(
-      `  ${cobalt2(`mend service connect ${service.label}`)} ${dim4(`\u2192 127.0.0.1:${local} on this machine, authenticated as you`)}`
+    say5(
+      `  ${cobalt2(`mend service connect ${service.label}`)} ${dim5(`\u2192 127.0.0.1:${local} on this machine, authenticated as you`)}`
     );
   }
   if (service.authority !== null) {
-    say4(`  ${dim4(`server-side listener ${service.authority} \xB7 ${gate}`)}`);
+    say5(`  ${dim5(`server-side listener ${service.authority} \xB7 ${gate}`)}`);
   }
 };
 var printWorkspaceTtlFailure = (service) => {
   if (service.workspaceTtlRenewalError === null) return;
-  say4(amber(`  workspace TTL renewal failed \xB7 ${service.workspaceTtlRenewalError}`));
-  say4(
-    dim4(
+  say5(amber(`  workspace TTL renewal failed \xB7 ${service.workspaceTtlRenewalError}`));
+  say5(
+    dim5(
       `  last renewed ${service.workspaceTtlRenewedAt ?? "unknown"} \xB7 known expiry ${service.workspaceExpiresAt ?? "unknown"} \xB7 failed ${service.workspaceTtlRenewalFailedAt ?? "unknown"}`
     )
   );
@@ -5580,11 +6273,11 @@ var printServiceEndpoint = (config, service, tunneling = false) => {
   printWorkspaceTtlFailure(service);
 };
 var printService = (config, service) => {
-  const status = service.status === "reachable" ? green4(service.status) : amber(service.status);
+  const status = service.status === "reachable" ? green5(service.status) : amber(service.status);
   const port = `:${service.workspacePort ?? "?"}${service.protocol === "udp" ? "/udp" : ""}`;
   const statusPad = " ".repeat(Math.max(1, 12 - service.status.length));
-  say4(
-    `${(service.label ?? service.id.slice(0, 8)).padEnd(14)} ${status}${statusPad}${dim4(port.padEnd(7))} ${dim4(service.id.slice(0, 8))}`
+  say5(
+    `${(service.label ?? service.id.slice(0, 8)).padEnd(14)} ${status}${statusPad}${dim5(port.padEnd(7))} ${dim5(service.id.slice(0, 8))}`
   );
   printServiceAccess(config, service);
   printWorkspaceTtlFailure(service);
@@ -5595,21 +6288,21 @@ var serviceAdd = async (config, args) => {
   const protocol = args.includes("--udp") ? "udp" : "tcp";
   const http = args.includes("--http");
   const https = args.includes("--https");
-  if (http && https) return fail4("Choose either --http or --https, not both.");
+  if (http && https) return fail5("Choose either --http or --https, not both.");
   const browserScheme = https ? "https" : http ? "http" : null;
   if (protocol === "udp" && browserScheme !== null) {
-    return fail4("UDP Services cannot use --http or --https");
+    return fail5("UDP Services cannot use --http or --https");
   }
   const positional = args.filter(
     (a, i) => !a.startsWith("--") && (nameFlag === -1 || i !== nameFlag + 1)
   );
   const portRaw = positional.find((a) => /^\d+$/.test(a));
   if (portRaw === void 0) {
-    return fail4(usageOf("service add"));
+    return fail5(usageOf("service add"));
   }
   const port = Number(portRaw);
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
-    return fail4(`"${portRaw}" is not a port`);
+    return fail5(`"${portRaw}" is not a port`);
   }
   const prefix = positional.find((a) => a !== portRaw);
   const session = await resolveLiveSession(config, prefix, "service add");
@@ -5619,52 +6312,52 @@ var serviceAdd = async (config, args) => {
     protocol,
     browserScheme
   });
-  say4(`${green4("\u2713")} Service ${service.label ?? ""} \xB7 ${service.status}`);
+  say5(`${green5("\u2713")} Service ${service.label ?? ""} \xB7 ${service.status}`);
   printServiceEndpoint(config, service);
   if (protocol === "udp") {
-    say4(dim4(`  udp \u2014 a reply is the only reachability signal; silence just relays`));
+    say5(dim5(`  udp \u2014 a reply is the only reachability signal; silence just relays`));
   } else if (service.status !== "reachable") {
-    say4(dim4(`  nothing answered on :${port} yet \u2014 the URL goes live when something listens`));
+    say5(dim5(`  nothing answered on :${port} yet \u2014 the URL goes live when something listens`));
   }
 };
 var serviceList = async (config) => {
   const services = await fetchServices(config);
   if (services.length === 0) {
-    say4(dim4("no live services \u2014 mend service add <port> adopts a listening one"));
+    say5(dim5("no live services \u2014 mend service add <port> adopts a listening one"));
     return;
   }
   for (const service of services) printService(config, service);
 };
 var serviceStop = async (config, args) => {
   const needle = args.find((a) => !a.startsWith("--"));
-  if (needle === void 0) return fail4(usageOf("service stop"));
+  if (needle === void 0) return fail5(usageOf("service stop"));
   const services = await fetchServices(config);
   const matches = services.filter(
     (service) => service.label === needle || service.id.startsWith(needle)
   );
-  if (matches.length === 0) return fail4(`no live service matches "${needle}"`);
+  if (matches.length === 0) return fail5(`no live service matches "${needle}"`);
   const match = matches[0];
   if (matches.length > 1 || match === void 0) {
-    return fail4(`"${needle}" is ambiguous \u2014 use more of the id`);
+    return fail5(`"${needle}" is ambiguous \u2014 use more of the id`);
   }
   const stoppedService = await mutateService(config, "POST", `/services/${match.id}/stop`);
-  say4(`${green4("\u2713")} stopped \xB7 ${stoppedService.label ?? stoppedService.id.slice(0, 8)}`);
+  say5(`${green5("\u2713")} stopped \xB7 ${stoppedService.label ?? stoppedService.id.slice(0, 8)}`);
 };
 var findLiveService = async (config, needle) => {
   const services = await fetchServices(config);
   const matches = services.filter(
     (service) => service.label === needle || service.id.startsWith(needle)
   );
-  if (matches.length === 0) return fail4(`no live service matches "${needle}"`);
+  if (matches.length === 0) return fail5(`no live service matches "${needle}"`);
   const match = matches[0];
   if (matches.length > 1 || match === void 0) {
-    return fail4(`"${needle}" is ambiguous \u2014 use more of the id`);
+    return fail5(`"${needle}" is ambiguous \u2014 use more of the id`);
   }
   return match;
 };
 var willAutoConnect = (config, service, optOut) => !optOut && !serverIsLocal(config) && service.protocol !== "udp";
 var autoConnect = async (config, service) => {
-  say4(dim4("  remote server \u2014 tunneling the port here \xB7 Ctrl-C stops the tunnel, not the Service"));
+  say5(dim5("  remote server \u2014 tunneling the port here \xB7 Ctrl-C stops the tunnel, not the Service"));
   await tunnelServices(config, [service], null);
 };
 var serviceRun = async (config, args) => {
@@ -5673,7 +6366,7 @@ var serviceRun = async (config, args) => {
   if (dashdash === -1) {
     const positionals = args.filter((a) => !a.startsWith("--"));
     const name2 = positionals.at(-1);
-    if (name2 === void 0) return fail4(usage);
+    if (name2 === void 0) return fail5(usage);
     const prefix2 = positionals.length > 1 ? positionals[0] : void 0;
     const session2 = await resolveLiveSession(config, prefix2, "service run");
     const recipes = await api(
@@ -5684,7 +6377,7 @@ var serviceRun = async (config, args) => {
     const recipe = recipes.find((entry) => entry.name === name2);
     if (recipe === void 0) {
       const known = recipes.map((entry) => entry.name).join(", ");
-      return fail4(
+      return fail5(
         recipes.length === 0 ? `no mend.toml recipes in this worktree \u2014 declare [service.${name2}] first` : `no recipe named "${name2}" \u2014 declared: ${known}`
       );
     }
@@ -5695,26 +6388,26 @@ var serviceRun = async (config, args) => {
       })
     );
     const tunneling2 = willAutoConnect(config, service2, args.includes("--no-connect"));
-    say4(`${green4("\u2713")} Service ${service2.label ?? ""} \xB7 ${service2.status}`);
+    say5(`${green5("\u2713")} Service ${service2.label ?? ""} \xB7 ${service2.status}`);
     printServiceEndpoint(config, service2, tunneling2);
-    say4(dim4(`  logs: mend service logs ${service2.label ?? service2.id.slice(0, 8)}`));
+    say5(dim5(`  logs: mend service logs ${service2.label ?? service2.id.slice(0, 8)}`));
     if (tunneling2) await autoConnect(config, service2);
     return;
   }
   const argv = args.slice(dashdash + 1);
-  if (argv.length === 0) return fail4(usage);
+  if (argv.length === 0) return fail5(usage);
   const head = args.slice(0, dashdash);
   const portFlag = head.indexOf("--port");
   const port = portFlag === -1 ? Number.NaN : Number(head[portFlag + 1]);
-  if (!Number.isInteger(port) || port < 1 || port > 65535) return fail4(usage);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return fail5(usage);
   const nameFlag = head.indexOf("--name");
   const name = nameFlag !== -1 && head[nameFlag + 1] !== void 0 ? String(head[nameFlag + 1]) : null;
   const protocol = head.includes("--udp") ? "udp" : "tcp";
   const http = head.includes("--http");
   const https = head.includes("--https");
-  if (http && https) return fail4(usage);
+  if (http && https) return fail5(usage);
   const browserScheme = https ? "https" : http ? "http" : null;
-  if (protocol === "udp" && browserScheme !== null) return fail4(usage);
+  if (protocol === "udp" && browserScheme !== null) return fail5(usage);
   const prefix = head.find(
     (a, i) => !a.startsWith("--") && i !== portFlag + 1 && i !== nameFlag + 1
   );
@@ -5730,9 +6423,9 @@ var serviceRun = async (config, args) => {
     })
   );
   const tunneling = willAutoConnect(config, service, head.includes("--no-connect"));
-  say4(`${green4("\u2713")} Service ${service.label ?? ""} \xB7 ${service.status}`);
+  say5(`${green5("\u2713")} Service ${service.label ?? ""} \xB7 ${service.status}`);
   printServiceEndpoint(config, service, tunneling);
-  say4(dim4(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
+  say5(dim5(`  logs: mend service logs ${service.label ?? service.id.slice(0, 8)}`));
   if (tunneling) await autoConnect(config, service);
 };
 var serviceLogs = async (config, args) => {
@@ -5742,32 +6435,32 @@ var serviceLogs = async (config, args) => {
     (argument, index) => !argument.startsWith("--") && index !== fromFlag + 1
   );
   if (needle === void 0 || from === void 0 || !/^(0|[1-9]\d*)$/.test(from)) {
-    return fail4(usageOf("service logs"));
+    return fail5(usageOf("service logs"));
   }
   const everything = await fetchServiceViews(config, true);
   const matches = everything.filter(
     (view2) => view2.service.name === needle || view2.service.id.startsWith(needle) || view2.attempts.some((attempt3) => attempt3.id.startsWith(needle))
   );
-  if (matches.length === 0) return fail4(`no service matches "${needle}"`);
+  if (matches.length === 0) return fail5(`no service matches "${needle}"`);
   const view = matches.find((candidate) => {
     const current = candidate.service.currentAttemptId === null ? null : candidate.attempts.find((attempt3) => attempt3.id === candidate.service.currentAttemptId);
     return current !== null && current !== void 0 && current.exitedAt === null;
   }) ?? matches[0];
-  if (view === void 0) return fail4(`no service matches "${needle}"`);
+  if (view === void 0) return fail5(`no service matches "${needle}"`);
   const currentAttempt = view.service.currentAttemptId === null ? null : view.attempts.find((candidate) => candidate.id === view.service.currentAttemptId) ?? null;
   const attempt2 = view.attempts.find((candidate) => candidate.id.startsWith(needle)) ?? currentAttempt ?? view.attempts.findLast((candidate) => candidate.sealantSessionId !== null) ?? null;
   if (attempt2?.sealantSessionId === null || attempt2 === null) {
-    return fail4(
+    return fail5(
       `"${needle}" is an adopted port \u2014 no process of Mend's, no logs. mend service run supervises.`
     );
   }
   const label = view.service.name;
-  say4(
-    dim4(
+  say5(
+    dim5(
       attempt2.exitedAt === null ? `following ${label} from sequence ${from} \u2014 Ctrl+C detaches, the Service keeps running` : `${label} \xB7 ${attempt2.status} \u2014 recorded output from sequence ${from}`
     )
   );
-  say4("");
+  say5("");
   let cursor = from;
   let telemetryReported = false;
   for (; ; ) {
@@ -5777,7 +6470,7 @@ var serviceLogs = async (config, args) => {
       `/processes/${attempt2.id}/logs?from=${encodeURIComponent(cursor)}&limit=256`
     );
     if (!telemetryReported) {
-      say4(dim4(`telemetry loss: ${page.telemetryLoss} \xB7 ${page.telemetryNote}`));
+      say5(dim5(`telemetry loss: ${page.telemetryLoss} \xB7 ${page.telemetryNote}`));
       telemetryReported = true;
     }
     for (const chunk of page.chunks) {
@@ -5789,29 +6482,29 @@ var serviceLogs = async (config, args) => {
     if (ended && !advanced) break;
     if (!advanced) await new Promise((resolve4) => setTimeout(resolve4, 250));
   }
-  say4("");
-  say4(dim4(`stream ended \xB7 next sequence ${cursor}`));
+  say5("");
+  say5(dim5(`stream ended \xB7 next sequence ${cursor}`));
 };
 var serviceRestart = async (config, args) => {
   const needle = args.find((a) => !a.startsWith("--"));
-  if (needle === void 0) return fail4(usageOf("service restart"));
+  if (needle === void 0) return fail5(usageOf("service restart"));
   const service = await findLiveService(config, needle);
   const restarted = await withSpinner(
     `restarting ${service.label ?? service.id.slice(0, 8)}\u2026`,
     mutateService(config, "POST", `/services/${service.id}/restart`)
   );
-  say4(`${green4("\u2713")} restarted \xB7 ${restarted.status}`);
+  say5(`${green5("\u2713")} restarted \xB7 ${restarted.status}`);
   printServiceEndpoint(config, restarted);
 };
 var serviceInit = async (args) => {
   const root = gitTopLevel(process.cwd()) ?? process.cwd();
-  const target = path10.join(root, "mend.toml");
-  if (fs9.existsSync(target)) {
-    return fail4(`${target} already exists \u2014 edit it directly (init never merges)`);
+  const target = path12.join(root, "mend.toml");
+  if (fs11.existsSync(target)) {
+    return fail5(`${target} already exists \u2014 edit it directly (init never merges)`);
   }
-  const rootFiles = fs9.readdirSync(root);
+  const rootFiles = fs11.readdirSync(root);
   const proposals = [];
-  const readRoot = (name) => fs9.readFileSync(path10.join(root, name), "utf8");
+  const readRoot = (name) => fs11.readFileSync(path12.join(root, name), "utf8");
   if (rootFiles.includes("package.json")) {
     proposals.push(...proposeFromPackageJson(readRoot("package.json"), rootFiles));
   }
@@ -5821,13 +6514,13 @@ var serviceInit = async (args) => {
   );
   for (const glob of globs) {
     const parent = glob.replace(/\/?\*+$/, "");
-    const dirs = glob.endsWith("*") ? fs9.existsSync(path10.join(root, parent)) ? fs9.readdirSync(path10.join(root, parent)).map((dir) => path10.join(parent, dir)) : [] : [glob];
+    const dirs = glob.endsWith("*") ? fs11.existsSync(path12.join(root, parent)) ? fs11.readdirSync(path12.join(root, parent)).map((dir) => path12.join(parent, dir)) : [] : [glob];
     for (const dir of dirs) {
-      const manifest = path10.join(root, dir, "package.json");
-      if (!fs9.existsSync(manifest)) continue;
+      const manifest = path12.join(root, dir, "package.json");
+      if (!fs11.existsSync(manifest)) continue;
       for (const proposal of proposeFromWorkspacePackage(
-        path10.basename(dir),
-        fs9.readFileSync(manifest, "utf8"),
+        path12.basename(dir),
+        fs11.readFileSync(manifest, "utf8"),
         rootFiles
       )) {
         if (!proposals.some((existing) => existing.name === proposal.name)) {
@@ -5849,58 +6542,60 @@ var serviceInit = async (args) => {
     }
   }
   if (proposals.length === 0) {
-    return fail4(
+    return fail5(
       "nothing to propose \u2014 no server-ish package.json script with a nameable port, no compose ports"
     );
   }
   const toml = renderMendToml(proposals);
-  say4(dim4(`proposed ${target}:`));
-  say4("");
+  say5(dim5(`proposed ${target}:`));
+  say5("");
   process.stdout.write(toml);
-  say4("");
+  say5("");
   if (!args.includes("--yes")) {
     if (process.stdin.isTTY !== true) {
-      return fail4("non-interactive \u2014 pass --yes to write the file");
+      return fail5("non-interactive \u2014 pass --yes to write the file");
     }
     const readline = await import("node:readline/promises");
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const answer = await rl.question("write it? [y/N] ");
     rl.close();
     if (answer.trim().toLowerCase() !== "y") {
-      say4(dim4("nothing written"));
+      say5(dim5("nothing written"));
       return;
     }
   }
-  fs9.writeFileSync(target, toml);
-  say4(`${green4("\u2713")} wrote ${target} \u2014 commit it, then: mend service run ${proposals[0]?.name}`);
+  fs11.writeFileSync(target, toml);
+  say5(`${green5("\u2713")} wrote ${target} \u2014 commit it, then: mend service run ${proposals[0]?.name}`);
 };
 var tunnelServices = async (config, services, portOverride) => {
-  const tunnelUrl = (serviceId) => {
-    const url = parseMendUrl(`${config.url}/api/service-tunnel`);
-    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-    url.searchParams.set("service", serviceId);
-    if (config.token !== null) url.searchParams.set("token", config.token);
-    return url;
-  };
+  const tunnelUrl = (serviceId) => socketUrl(config, "service-tunnel", { service: serviceId });
   for (const service of services) {
     const port = portOverride ?? service.hostPort ?? service.workspacePort;
     const server = net3.createServer((socket) => {
       socket.pause();
-      const ws = new WebSocket(tunnelUrl(service.id));
-      ws.binaryType = "arraybuffer";
-      ws.addEventListener("open", () => socket.resume(), { once: true });
-      ws.addEventListener("message", (event) => {
-        if (typeof event.data === "string") return;
-        socket.write(Buffer.from(event.data));
-      });
-      ws.addEventListener("close", () => socket.end(), { once: true });
-      ws.addEventListener("error", () => socket.destroy(), { once: true });
-      socket.on("data", (chunk) => ws.send(new Uint8Array(chunk)));
-      socket.on("end", () => {
-        if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ t: "eof" }));
-      });
-      socket.on("close", () => ws.close());
-      socket.on("error", () => ws.close());
+      void tunnelUrl(service.id).then(
+        (url) => {
+          if (socket.destroyed) return null;
+          const ws = new WebSocket(url);
+          ws.binaryType = "arraybuffer";
+          ws.addEventListener("open", () => socket.resume(), { once: true });
+          ws.addEventListener("message", (event) => {
+            if (typeof event.data === "string") return;
+            socket.write(Buffer.from(event.data));
+          });
+          ws.addEventListener("close", () => socket.end(), { once: true });
+          ws.addEventListener("error", () => socket.destroy(), { once: true });
+          socket.on("data", (chunk) => ws.send(new Uint8Array(chunk)));
+          socket.on("end", () => {
+            if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify({ t: "eof" }));
+          });
+          socket.on("close", () => ws.close());
+          socket.on("error", () => ws.close());
+          return null;
+        },
+        // No ticket, no tunnel: the local connection ends the way a refused one would.
+        () => socket.destroy()
+      );
     });
     await new Promise((resolve4, reject) => {
       server.once("error", (error) => {
@@ -5911,12 +6606,12 @@ var tunnelServices = async (config, services, portOverride) => {
         );
       });
       server.listen(port, "127.0.0.1", () => resolve4());
-    }).catch((error) => fail4(error.message));
-    say4(
-      `${green4("\u25CF")} ${service.label ?? service.id.slice(0, 8)} \u2192 127.0.0.1:${port} ${dim4(`(tunnel to ${config.url})`)}`
+    }).catch((error) => fail5(error.message));
+    say5(
+      `${green5("\u25CF")} ${service.label ?? service.id.slice(0, 8)} \u2192 127.0.0.1:${port} ${dim5(`(tunnel to ${config.url})`)}`
     );
   }
-  say4(dim4("  connections are authenticated as you \xB7 Ctrl-C stops"));
+  say5(dim5("  connections are authenticated as you \xB7 Ctrl-C stops"));
   await new Promise(() => {
   });
 };
@@ -5924,18 +6619,18 @@ var serviceConnect = async (config, args) => {
   const portFlag = args.indexOf("--port");
   const portOverride = portFlag === -1 ? null : Number(args[portFlag + 1]);
   if (portOverride !== null && !Number.isInteger(portOverride)) {
-    return fail4("--port takes a port number");
+    return fail5("--port takes a port number");
   }
   const names = args.filter((a, i) => !a.startsWith("--") && i !== portFlag + 1);
   const live = (await fetchServices(config)).filter((s) => s.protocol === "tcp");
   const picked = names.length === 0 ? live : live.filter((s) => names.some((n) => s.label === n || s.id.startsWith(n)));
   if (picked.length === 0) {
-    return fail4(
+    return fail5(
       names.length === 0 ? "no live TCP services \u2014 mend service run starts one" : `no live TCP service matches "${names.join('", "')}"`
     );
   }
   if (portOverride !== null && picked.length !== 1) {
-    return fail4("--port applies to exactly one service \u2014 name it");
+    return fail5("--port applies to exactly one service \u2014 name it");
   }
   await tunnelServices(config, picked, portOverride);
 };
@@ -5964,23 +6659,23 @@ var serviceCommand = async (config, args) => {
   }
 };
 var isProvider = (value) => value === "claude" || value === "codex" || value === "github";
-var readIfExists = (file) => fs9.existsSync(file) ? fs9.readFileSync(file, "utf8") : null;
+var readIfExists = (file) => fs11.existsSync(file) ? fs11.readFileSync(file, "utf8") : null;
 var localCredential = (provider) => {
-  const home = os6.homedir();
+  const home = os7.homedir();
   switch (provider) {
     case "codex":
       return readIfExists(
-        path10.join(process.env["CODEX_HOME"] ?? path10.join(home, ".codex"), "auth.json")
+        path12.join(process.env["CODEX_HOME"] ?? path12.join(home, ".codex"), "auth.json")
       );
     case "claude":
       return readIfExists(
-        path10.join(
-          process.env["CLAUDE_CONFIG_DIR"] ?? path10.join(home, ".claude"),
+        path12.join(
+          process.env["CLAUDE_CONFIG_DIR"] ?? path12.join(home, ".claude"),
           ".credentials.json"
         )
       );
     case "github": {
-      const result = spawnSync2("gh", ["auth", "token"], { encoding: "utf8" });
+      const result = spawnSync3("gh", ["auth", "token"], { encoding: "utf8" });
       const token = result.status === 0 ? result.stdout.trim() : "";
       return token === "" ? null : token;
     }
@@ -6012,16 +6707,94 @@ var accountsCommand = async (config) => {
     );
   }
 };
+var minuteOrUnknown = (at) => at === null ? "unknown" : at.toISOString().slice(0, 16);
+var staleGrantReason = (secret) => {
+  const facts = claudeGrantFacts(secret);
+  if (facts === null) return null;
+  if (!facts.hasRefreshToken) return "signed out";
+  return facts.refreshExpiresAt !== null && facts.refreshExpiresAt.getTime() <= Date.now() ? `expired ${facts.refreshExpiresAt.toISOString().slice(0, 10)}` : null;
+};
+var claudeGrant = async () => {
+  const cli = claudeCli();
+  const dir = claudeGrantDir(mendCliHome());
+  const personal = personalClaudeDir();
+  const personalBefore = grantStatus(cli, personal);
+  let status = grantStatus(cli, dir);
+  if (status === null) {
+    fail5(
+      "claude: could not run `claude auth status` \u2014 install Claude Code, set MEND_CLAUDE_BIN, or paste a credential: mend connect claude --from-stdin"
+    );
+    return null;
+  }
+  if (!status.loggedIn) {
+    say5(`  Mend needs its own Claude login, kept in ${dir}`);
+    say5(dim5("  your own Claude login stays as it is"));
+    if (!runClaudeLogin(cli, dir)) {
+      fail5("claude: the login did not complete");
+      return null;
+    }
+    status = grantStatus(cli, dir) ?? status;
+    if (!status.loggedIn) {
+      fail5("claude: the login completed but Claude still reports no grant in Mend's directory");
+      return null;
+    }
+  }
+  if (status.configDirectory !== null && path12.resolve(status.configDirectory) !== path12.resolve(dir)) {
+    fail5(
+      `claude: this Claude read ${status.configDirectory} instead of ${dir}, so a separate grant is not possible \u2014 connect the shared one deliberately with --use-my-login`
+    );
+    return null;
+  }
+  let read = readGrant(dir);
+  if (read.kind !== "missing") {
+    const why = staleGrantReason(read.secret);
+    if (why !== null) {
+      say5(`  Mend's Claude grant is ${why}; logging in again`);
+      if (!runClaudeLogin(cli, dir)) {
+        fail5("claude: the login did not complete");
+        return null;
+      }
+      read = readGrant(dir);
+      const still = read.kind === "missing" ? "missing" : staleGrantReason(read.secret);
+      if (still !== null) {
+        fail5(`claude: the grant is still ${still} after logging in`);
+        return null;
+      }
+    }
+  }
+  if (read.kind === "missing") {
+    const where = read.triedService === null ? read.triedPath : `${read.triedPath} or the Keychain item ${read.triedService}`;
+    fail5(`claude: logged in, but no credential to read \u2014 looked in ${where}`);
+    return null;
+  }
+  const mine = localCredential("claude");
+  if (mine !== null && sameGrant(read.secret, mine)) {
+    fail5(
+      "claude: that is the same grant this machine's Claude holds, so both sides would race on refresh \u2014 remove Mend's directory and log in again, or accept the race with --use-my-login"
+    );
+    return null;
+  }
+  const personalAfter = grantStatus(cli, personal);
+  if (personalBefore?.loggedIn === true && personalAfter?.loggedIn === false) {
+    say5(
+      `  your own Claude login was signed out by this one \u2014 this account allows one grant at a time. Run \`claude auth login\` to get it back, and connect the shared grant with --use-my-login instead.`
+    );
+  } else if (personalAfter?.loggedIn === true) {
+    say5(dim5("  your own Claude login still works \xB7 verified"));
+  }
+  say5(dim5(`  grant ${read.kind === "file" ? read.path : `keychain ${read.service}`}`));
+  return read.secret;
+};
 var connectCommand = async (config, args) => {
   const [providerArg, ...flags] = args;
   if (!isProvider(providerArg)) {
-    return fail4(usageOf("connect"));
+    return fail5(usageOf("connect"));
   }
   const provider = providerArg;
   if (flags.includes("--remove")) {
     const identity = await api(config, "GET", "/me/sealant");
     const account2 = identity.accounts.find((row) => row.provider === provider);
-    if (account2 === void 0) return fail4(`${provider}: nothing connected`);
+    if (account2 === void 0) return fail5(`${provider}: nothing connected`);
     await api(config, "DELETE", `/me/sealant/accounts/${account2.id}`);
     process.stdout.write(`${provider}: disconnected
 `);
@@ -6029,35 +6802,60 @@ var connectCommand = async (config, args) => {
   }
   let secret;
   if (flags.includes("--from-stdin")) {
-    secret = fs9.readFileSync(0, "utf8").trim();
-    if (secret === "") return fail4("nothing on stdin");
+    secret = fs11.readFileSync(0, "utf8").trim();
+    if (secret === "") return fail5("nothing on stdin");
+  } else if (provider === "claude" && !flags.includes("--use-my-login")) {
+    secret = await claudeGrant();
+    if (secret === null) return;
   } else {
     secret = localCredential(provider);
     if (secret === null) {
-      const where = provider === "github" ? "`gh auth login` first, or pipe a token: gh auth token | mend connect github --from-stdin" : provider === "codex" ? "`codex login` first, or: mend connect codex --from-stdin < auth.json" : "`claude setup-token` then: mend connect claude --from-stdin";
-      return fail4(`${provider}: no credential on this machine \u2014 ${where}`);
+      const where = provider === "github" ? "`gh auth login` first, or pipe a token: gh auth token | mend connect github --from-stdin" : provider === "codex" ? "`codex login` first, or: mend connect codex --from-stdin < auth.json" : "`claude auth login` first, or: mend connect claude --from-stdin";
+      return fail5(`${provider}: no credential on this machine \u2014 ${where}`);
+    }
+    if (provider === "claude") {
+      say5(
+        dim5(
+          "  --use-my-login: Mend and this machine will share one grant, and whichever refreshes second is signed out"
+        )
+      );
     }
   }
+  const narrowed = narrowCredential(provider, secret);
+  if (narrowed.kind === "narrowed" && narrowed.dropped.length > 0) {
+    say5(dim5(`  keeping ${narrowed.dropped.join(", ")} on this machine`));
+  }
   const account = await withSpinner(
     `connecting ${provider}`,
-    api(config, "POST", "/me/sealant/accounts", { provider, secret })
+    api(config, "POST", "/me/sealant/accounts", {
+      provider,
+      secret: narrowed.secret
+    })
   );
   process.stdout.write(`${accountLine(account)}
 `);
+  const facts = claudeGrantFacts(narrowed.secret);
+  if (facts !== null) {
+    say5(
+      dim5(
+        `  access expires ${minuteOrUnknown(facts.accessExpiresAt)} \xB7 grant expires ${minuteOrUnknown(facts.refreshExpiresAt)}`
+      )
+    );
+  }
 };
-var takeFlagValue3 = (args, flag) => {
+var takeFlagValue4 = (args, flag) => {
   const at = args.indexOf(flag);
   return at !== -1 && args[at + 1] !== void 0 ? String(args[at + 1]) : null;
 };
 var saveCliConfig = (next) => {
-  fs9.mkdirSync(path10.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
-  fs9.writeFileSync(
+  fs11.mkdirSync(path12.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
+  fs11.writeFileSync(
     CONFIG_PATH,
     `${JSON.stringify({ url: next.url, token: next.token, deviceId: next.deviceId }, null, 2)}
 `,
     { mode: 384 }
   );
-  fs9.chmodSync(CONFIG_PATH, 384);
+  fs11.chmodSync(CONFIG_PATH, 384);
 };
 var login = async (config, args) => {
   await loginCommand(args, {
@@ -6065,25 +6863,25 @@ var login = async (config, args) => {
     defaultUrl: config.url,
     save: (next) => {
       saveCliConfig({ url: next.url, token: next.token, deviceId: next.deviceId });
-      say4(dim4(`  token saved to ${CONFIG_PATH} (0600)`));
+      say5(dim5(`  token saved to ${CONFIG_PATH} (0600)`));
     }
   });
 };
 var logout = async (config) => {
-  if (!fs9.existsSync(CONFIG_PATH) && config.token === null) {
-    say4(dim4("nothing saved \u2014 already signed out"));
+  if (!fs11.existsSync(CONFIG_PATH) && config.token === null) {
+    say5(dim5("nothing saved \u2014 already signed out"));
     return;
   }
   if (config.token !== null && config.deviceId !== null) {
     try {
       await request(config, "DELETE", `/me/devices/${config.deviceId}`);
-      say4(`${green4("\u2713")} device revoked on ${config.url}`);
+      say5(`${green5("\u2713")} device revoked on ${config.url}`);
     } catch {
-      say4(dim4("  could not revoke on the server \u2014 end it under Settings \u2192 Devices"));
+      say5(dim5("  could not revoke on the server \u2014 end it under Settings \u2192 Devices"));
     }
   }
   saveCliConfig({ ...config, token: null, deviceId: null });
-  say4(`${green4("\u2713")} signed out \xB7 ${dim4(`token removed from ${CONFIG_PATH}`)}`);
+  say5(`${green5("\u2713")} signed out \xB7 ${dim5(`token removed from ${CONFIG_PATH}`)}`);
 };
 var UNINSTALL_CHOICES = [
   { scope: "all", text: "everything \xB7 the server on this machine and this machine's Mend files" },
@@ -6095,20 +6893,20 @@ var UNINSTALL_CHOICES = [
 ];
 var askUninstallScope = async () => {
   if (process.stdin.isTTY !== true || process.stdout.isTTY !== true) {
-    return fail4(`${UNINSTALL_USAGE} \xB7 no terminal to ask on`);
+    return fail5(`${UNINSTALL_USAGE} \xB7 no terminal to ask on`);
   }
-  say4("what should go?");
-  UNINSTALL_CHOICES.forEach((choice, index) => say4(`  ${index + 1}. ${choice.text}`));
+  say5("what should go?");
+  UNINSTALL_CHOICES.forEach((choice, index) => say5(`  ${index + 1}. ${choice.text}`));
   const readline = await import("node:readline/promises");
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   const answer = (await rl.question("  1, 2 or 3: ")).trim();
   rl.close();
   const chosen = UNINSTALL_CHOICES[Number(answer) - 1];
-  if (chosen === void 0) return fail4(`"${answer}" is not one of the choices`);
+  if (chosen === void 0) return fail5(`"${answer}" is not one of the choices`);
   return chosen.scope;
 };
 var confirmUninstall = async (word) => {
-  if (process.stdin.isTTY !== true) return fail4("non-interactive \u2014 pass --yes to remove");
+  if (process.stdin.isTTY !== true) return fail5("non-interactive \u2014 pass --yes to remove");
   const readline = await import("node:readline/promises");
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   const answer = (await rl.question(word === "y" ? "remove? [y/N] " : `type ${word} to remove: `)).trim().toLowerCase();
@@ -6117,14 +6915,14 @@ var confirmUninstall = async (word) => {
 };
 var uninstallCommand = async (config, args) => {
   const parsed = parseUninstallArgs(args);
-  if ("error" in parsed) return fail4(parsed.error);
+  if ("error" in parsed) return fail5(parsed.error);
   const scope = parsed.scope ?? await askUninstallScope();
   const server = nodeServerRuntime();
   const runtime = {
     server,
     cliHome: mendCliHome(),
-    sshConfigFile: path10.join(os6.homedir(), ".ssh", "config"),
-    signedIn: config.token === null || !fs9.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
+    sshConfigFile: path12.join(os7.homedir(), ".ssh", "config"),
+    signedIn: config.token === null || !fs11.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
     revokeDevice: async () => {
       if (config.deviceId === null) return "no device id saved";
       try {
@@ -6136,42 +6934,42 @@ var uninstallCommand = async (config, args) => {
     }
   };
   const plan = await describeUninstall(runtime, scope);
-  say4(dim4(`mend uninstall \xB7 ${scope === "all" ? "everything" : scope}`));
-  for (const line of planLines(plan, server.configDir)) say4(`  ${line}`);
+  say5(dim5(`mend uninstall \xB7 ${scope === "all" ? "everything" : scope}`));
+  for (const line of planLines(plan, server.configDir)) say5(`  ${line}`);
   const nothing = (plan.server === null || plan.server === "none") && (plan.home === null || plan.home.cliConfig === null && plan.home.sshDirectory === null && plan.home.managedSshBlocks === 0);
   if (nothing) {
-    say4(dim4("nothing to remove"));
+    say5(dim5("nothing to remove"));
     return;
   }
   if (planDeletesData(plan)) {
-    say4("repositories, worktrees, the database and its backups are deleted with the server");
+    say5("repositories, worktrees, the database and its backups are deleted with the server");
   }
   if (!parsed.yes && !await confirmUninstall(planDeletesData(plan) ? "delete" : "y")) {
-    say4(dim4("nothing removed"));
+    say5(dim5("nothing removed"));
     return;
   }
   const outcome = await executeUninstall(runtime, plan);
-  for (const line of outcome.leftovers) say4(dim4(`  kept \xB7 ${line}`));
+  for (const line of outcome.leftovers) say5(dim5(`  kept \xB7 ${line}`));
   if (outcome.failures.length > 0) {
-    return fail4(outcome.failures.join("\n"));
+    return fail5(outcome.failures.join("\n"));
   }
-  say4(
-    `${green4("\u2713")} ${scope === "all" ? "Mend is gone from this machine" : scope === "server" ? "the server is gone from this machine" : "this machine no longer holds Mend files"}`
+  say5(
+    `${green5("\u2713")} ${scope === "all" ? "Mend is gone from this machine" : scope === "server" ? "the server is gone from this machine" : "this machine no longer holds Mend files"}`
   );
 };
 var printGitKey = (key) => {
   if (key.publicKey === null) return;
-  say4(key.publicKey);
-  if (key.fingerprint !== null) say4(dim4(`  ${key.fingerprint}`));
-  say4(dim4("  add this to your git account's SSH keys (GitHub: settings \u2192 SSH keys) so"));
-  say4(dim4("  every repository you can reach works; for one repository only, add it"));
-  say4(dim4("  as that repository's deploy key instead (grant write if sessions push)"));
+  say5(key.publicKey);
+  if (key.fingerprint !== null) say5(dim5(`  ${key.fingerprint}`));
+  say5(dim5("  add this to your git account's SSH keys (GitHub: settings \u2192 SSH keys) so"));
+  say5(dim5("  every repository you can reach works; for one repository only, add it"));
+  say5(dim5("  as that repository's deploy key instead (grant write if sessions push)"));
 };
 var keysShow = async (config) => {
   const key = await api(config, "GET", "/keys/git");
   if (!key.exists) {
-    say4(
-      `no Mend key yet ${dim4("\u2014 mend keys init generates one (ed25519, stays on the server host)")}`
+    say5(
+      `no Mend key yet ${dim5("\u2014 mend keys init generates one (ed25519, stays on the server host)")}`
     );
     return;
   }
@@ -6179,46 +6977,41 @@ var keysShow = async (config) => {
 };
 var keysInit = async (config) => {
   const key = await api(config, "POST", "/keys/git");
-  say4(`${green4("\u2713")} Mend key ready ${dim4("(private half stays on the server host)")}`);
+  say5(`${green5("\u2713")} Mend key ready ${dim5("(private half stays on the server host)")}`);
   printGitKey(key);
 };
 var keysShare = async (config) => {
   const agentSock = process.env["SSH_AUTH_SOCK"];
   if (agentSock === void 0 || agentSock === "") {
-    return fail4("SSH_AUTH_SOCK is not set \u2014 start (or plug in) your ssh-agent first");
+    return fail5("SSH_AUTH_SOCK is not set \u2014 start (or plug in) your ssh-agent first");
   }
-  const url = bridgeUrlOf(
-    parseMendUrl(config.url).toString().replace(/\/$/, ""),
-    config.token,
-    os6.hostname()
-  );
   await shareAgent({
-    url,
+    url: () => socketUrl(config, "keys-bridge", { host: os7.hostname() }),
     agentSock,
     signal: new AbortController().signal,
     onEvent: (event) => {
       switch (event.kind) {
         case "connected":
-          say4(`${green4("\u25CF")} sharing this machine's ssh-agent with ${config.url}`);
-          say4(dim4(`  agent: ${agentSock} \xB7 signature requests print here \xB7 Ctrl-C stops sharing`));
+          say5(`${green5("\u25CF")} sharing this machine's ssh-agent with ${config.url}`);
+          say5(dim5(`  agent: ${agentSock} \xB7 signature requests print here \xB7 Ctrl-C stops sharing`));
           return;
         case "disconnected":
-          say4(
-            dim4(`not connected \u2014 retrying in ${Math.round(event.retryMs / 1e3)}s (Ctrl-C stops)`)
+          say5(
+            dim5(`not connected \u2014 retrying in ${Math.round(event.retryMs / 1e3)}s (Ctrl-C stops)`)
           );
           return;
         case "sign-requested":
-          say4(`${amber("\u270E")} signature requested by mend ${dim4(`(${event.context})`)}`);
-          say4(dim4("  waiting \u2014 touch your key if it blinks (up to 60s)\u2026"));
+          say5(`${amber("\u270E")} signature requested by mend ${dim5(`(${event.context})`)}`);
+          say5(dim5("  waiting \u2014 touch your key if it blinks (up to 60s)\u2026"));
           return;
         case "identities-requested":
-          say4(dim4(`  identities requested (${event.context})`));
+          say5(dim5(`  identities requested (${event.context})`));
           return;
         case "signed":
-          say4(`${green4("\u2713")} signed ${dim4(`(${event.seconds.toFixed(1)}s)`)}`);
+          say5(`${green5("\u2713")} signed ${dim5(`(${event.seconds.toFixed(1)}s)`)}`);
           return;
         case "not-signed":
-          say4(`${amber("\u2717")} not signed \u2014 ${event.message}`);
+          say5(`${amber("\u2717")} not signed \u2014 ${event.message}`);
           return;
       }
     }
@@ -6227,19 +7020,19 @@ var keysShare = async (config) => {
 var keysMode = async (config, args) => {
   const [value] = args;
   if (value !== void 0 && value !== "mend-key" && value !== "bridge") {
-    return fail4(`keys mode takes mend-key or bridge, not "${value}"`);
+    return fail5(`keys mode takes mend-key or bridge, not "${value}"`);
   }
   const access = value === void 0 ? await api(config, "GET", "/me/git-access") : await api(config, "PUT", "/me/git-access", { mode: value });
-  if (value !== void 0) say4(`${green4("\u2713")} git access \xB7 ${value}`);
+  if (value !== void 0) say5(`${green5("\u2713")} git access \xB7 ${value}`);
   if (access.mode === "mend-key") {
-    say4(`mend-key ${dim4("\u2014 your Mend key on the server signs; works whenever the server is up")}`);
+    say5(`mend-key ${dim5("\u2014 your Mend key on the server signs; works whenever the server is up")}`);
     if (access.key.exists) printGitKey(access.key);
-    else say4(dim4("  no key yet \u2014 mend keys init creates it"));
+    else say5(dim5("  no key yet \u2014 mend keys init creates it"));
     return;
   }
-  say4(`bridge ${dim4("\u2014 this machine's ssh-agent signs; only while a mend command runs here")}`);
-  say4(
-    access.bridge.connected ? `${green4("\u25CF")} signer connected \xB7 ${access.bridge.clientName ?? "unknown machine"}` : dim4("  no signer connected \u2014 mend shares the agent whenever it runs (or: mend keys share)")
+  say5(`bridge ${dim5("\u2014 this machine's ssh-agent signs; only while a mend command runs here")}`);
+  say5(
+    access.bridge.connected ? `${green5("\u25CF")} signer connected \xB7 ${access.bridge.clientName ?? "unknown machine"}` : dim5("  no signer connected \u2014 mend shares the agent whenever it runs (or: mend keys share)")
   );
 };
 var keysCommand = async (config, args) => {
@@ -6255,75 +7048,75 @@ var keysCommand = async (config, args) => {
     case void 0:
       return keysShow(config);
     default:
-      return fail4(`unknown keys command "${verb}" \xB7 mend help keys lists them`);
+      return fail5(`unknown keys command "${verb}" \xB7 mend help keys lists them`);
   }
 };
 var formatDotfileBytes = (bytes) => bytes < 1024 ? `${bytes} B` : `${(bytes / 1024).toFixed(1)} KB`;
 var dotfilesShow = async (config) => {
   const dotfiles = await api(config, "GET", "/dotfiles");
   if (dotfiles.repository === null) {
-    say4(`repo      ${dim4("none")}`);
+    say5(`repo      ${dim5("none")}`);
   } else {
     const branch = dotfiles.repository.ref ?? "default branch";
     const subdir = dotfiles.repository.subdirectory === null ? [] : [`${dotfiles.repository.subdirectory}/`];
     const bootstrap = dotfiles.repository.bootstrap ? "install.sh on" : "install.sh off";
-    say4(
-      `repo      ${dotfiles.repository.url} ${dim4(`(${[branch, ...subdir, bootstrap].join(" \xB7 ")})`)}`
+    say5(
+      `repo      ${dotfiles.repository.url} ${dim5(`(${[branch, ...subdir, bootstrap].join(" \xB7 ")})`)}`
     );
   }
   if (dotfiles.snapshot === null) {
-    say4(`snapshot  ${dim4("none \u2014 sync from this machine: mend dotfiles sync --all")}`);
+    say5(`snapshot  ${dim5("none \u2014 sync from this machine: mend dotfiles sync --all")}`);
     return;
   }
   const snapshot = dotfiles.snapshot;
-  say4(
-    `snapshot  ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} \xB7 from ${snapshot.source} \xB7 ${dim4(snapshot.sha.slice(0, 7))}`
+  say5(
+    `snapshot  ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} \xB7 from ${snapshot.source} \xB7 ${dim5(snapshot.sha.slice(0, 7))}`
   );
   for (const file of snapshot.files) {
-    say4(`  ${file.path.padEnd(36)} ${dim4(formatDotfileBytes(file.bytes))}`);
+    say5(`  ${file.path.padEnd(36)} ${dim5(formatDotfileBytes(file.bytes))}`);
   }
 };
 var dotfilesSync = async (config, args) => {
   const all = args.includes("--all");
   const requestedPaths = args.filter((arg) => !arg.startsWith("--"));
-  const home = os6.homedir();
+  const home = os7.homedir();
   if (!all && requestedPaths.length === 0) {
     const found = scanDotfileCandidates(home);
     if (found.length === 0) {
-      say4(dim4("no known config files found under ~"));
+      say5(dim5("no known config files found under ~"));
       return;
     }
     let group = "";
     for (const entry of found) {
       if (entry.group !== group) {
         group = entry.group;
-        say4(dim4(group));
+        say5(dim5(group));
       }
-      say4(`  ${entry.path.padEnd(36)} ${dim4(formatDotfileBytes(entry.bytes))}`);
+      say5(`  ${entry.path.padEnd(36)} ${dim5(formatDotfileBytes(entry.bytes))}`);
     }
-    say4("");
-    say4(
+    say5("");
+    say5(
       `sync everything with ${cobalt2("mend dotfiles sync --all")}, or pick: ${cobalt2("mend dotfiles sync .zshrc .gitconfig")}`
     );
     return;
   }
   const selected = all ? scanDotfileCandidates(home).map((entry) => entry.path) : requestedPaths;
-  if (selected.length === 0) return fail4("nothing to sync \u2014 no known config files found under ~");
+  if (selected.length === 0) return fail5("nothing to sync \u2014 no known config files found under ~");
   const read = readSyncFiles(home, selected);
-  if ("error" in read) return fail4(read.error);
+  if ("error" in read) return fail5(read.error);
   const result = await api(config, "POST", "/dotfiles/snapshot", {
     files: read.files,
-    source: os6.hostname(),
+    source: os7.hostname(),
     merge: false
   });
   const snapshot = result.snapshot;
-  if (snapshot === null) return fail4("the server accepted the sync but reports no snapshot");
-  say4(
-    `${green4("synced")} ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} from ${os6.hostname()} \xB7 ${dim4(snapshot.sha.slice(0, 7))} ${dim4("\u2014 applies from the next session launch")}`
+  if (snapshot === null) return fail5("the server accepted the sync but reports no snapshot");
+  say5(
+    `${green5("synced")} ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} from ${os7.hostname()} \xB7 ${dim5(snapshot.sha.slice(0, 7))} ${dim5("\u2014 applies from the next session launch")}`
   );
 };
 var envLoad = async (config, args) => {
-  const explicitProject = takeFlagValue3(args, "--project");
+  const explicitProject = takeFlagValue4(args, "--project");
   const secretFlag = args.indexOf("--secret");
   const secretArg = secretFlag === -1 ? void 0 : args[secretFlag + 1];
   const secretNames = secretArg !== void 0 && !secretArg.startsWith("--") && !secretArg.includes("/") && !secretArg.includes(".") ? secretArg.split(",").map((s) => s.trim()).filter((s) => s !== "") : [];
@@ -6333,15 +7126,15 @@ var envLoad = async (config, args) => {
   const positional = args.filter(
     (arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project" && !consumed.has(i)
   );
-  const file = path10.resolve(positional[0] ?? ".env");
+  const file = path12.resolve(positional[0] ?? ".env");
   let contents;
   try {
-    contents = fs9.readFileSync(file, "utf8");
+    contents = fs11.readFileSync(file, "utf8");
   } catch {
-    return fail4(`cannot read ${file} \u2014 pass a path: mend env load path/to/.env`);
+    return fail5(`cannot read ${file} \u2014 pass a path: mend env load path/to/.env`);
   }
   if (contents.trim() === "") {
-    say4(dim4(`${file} is empty`));
+    say5(dim5(`${file} is empty`));
     return;
   }
   const project2 = await findProject(config, explicitProject);
@@ -6352,46 +7145,46 @@ var envLoad = async (config, args) => {
     { contents, allSecret, secretNames }
   );
   if (report.loaded.length === 0 && report.rejected.length === 0 && report.malformedLines.length === 0) {
-    say4(dim4(`${path10.basename(file)} has no variables`));
+    say5(dim5(`${path12.basename(file)} has no variables`));
     return;
   }
-  say4(`${green4("\u2713")} loaded ${path10.basename(file)} into ${project2.name}`);
-  for (const line of formatLoadReport(report, { dim: dim4, warn: amber })) say4(line);
+  say5(`${green5("\u2713")} loaded ${path12.basename(file)} into ${project2.name}`);
+  for (const line of formatLoadReport(report, { dim: dim5, warn: amber })) say5(line);
   const plaintextUrls = report.loaded.filter(
     (entry) => entry.lane === "configuration" && /_(URL|URI|DSN)$/.test(entry.name)
   );
   if (plaintextUrls.length > 0) {
-    say4(
+    say5(
       amber(
         `  ${plaintextUrls.map((entry) => entry.name).join(", ")} stored as plaintext configuration \u2014 if a value embeds a password, store it as a secret: mend env load --secret ${plaintextUrls.map((entry) => entry.name).join(",")}`
       )
     );
   }
   if (report.malformedLines.length > 0) {
-    say4(
+    say5(
       amber(
         `  skipped ${report.malformedLines.length} malformed line${report.malformedLines.length === 1 ? "" : "s"}: ${report.malformedLines.join(", ")}`
       )
     );
   }
-  say4(
-    dim4(
+  say5(
+    dim5(
       `  configuration r${report.environmentRevision} \xB7 secrets r${report.secretRevision} \u2014 applies from the next workspace launch, including resume; running workspaces keep what they started with`
     )
   );
 };
 var envShow = async (config, args) => {
-  const project2 = await findProject(config, takeFlagValue3(args, "--project"));
+  const project2 = await findProject(config, takeFlagValue4(args, "--project"));
   const [environment, secrets, cluster] = await Promise.all([
     api(config, "GET", `/projects/${project2.id}/environment`),
     api(config, "GET", `/projects/${project2.id}/secrets`),
     api(config, "GET", `/projects/${project2.id}/cluster-bindings`)
   ]);
-  say4(
-    `${project2.name} ${dim4(`\xB7 configuration r${environment.revision} \xB7 secrets r${secrets.revision} \xB7 cluster r${cluster.revision}`)}`
+  say5(
+    `${project2.name} ${dim5(`\xB7 configuration r${environment.revision} \xB7 secrets r${secrets.revision} \xB7 cluster r${cluster.revision}`)}`
   );
   if (environment.variables.length === 0 && secrets.secrets.length === 0 && cluster.bindings.length === 0 && cluster.serviceAccount === null) {
-    say4(dim4(`  nothing stored \u2014 load a file: ${cobalt2("mend env load")}`));
+    say5(dim5(`  nothing stored \u2014 load a file: ${cobalt2("mend env load")}`));
     return;
   }
   const bindingNames = cluster.bindings.map((b) => `${b.kind}/${b.objectName}`);
@@ -6402,23 +7195,23 @@ var envShow = async (config, args) => {
     ...bindingNames.map((name) => name.length)
   );
   for (const variable of environment.variables) {
-    say4(`  ${variable.name.padEnd(width)}  configuration ${dim4("\xB7 plaintext")}`);
+    say5(`  ${variable.name.padEnd(width)}  configuration ${dim5("\xB7 plaintext")}`);
   }
   for (const secret of secrets.secrets) {
-    say4(`  ${secret.name.padEnd(width)}  secret ${dim4("\xB7 value set, never shown")}`);
+    say5(`  ${secret.name.padEnd(width)}  secret ${dim5("\xB7 value set, never shown")}`);
   }
   for (const name of bindingNames) {
-    say4(
-      `  ${name.padEnd(width)}  cluster binding ${dim4("\xB7 resolved by the platform at launch \xB7 contents unknown to Mend")}`
+    say5(
+      `  ${name.padEnd(width)}  cluster binding ${dim5("\xB7 resolved by the platform at launch \xB7 contents unknown to Mend")}`
     );
   }
   if (cluster.serviceAccount !== null) {
-    say4(
-      `  ${cluster.serviceAccount.padEnd(width)}  service account ${dim4("\xB7 workspace pod identity \xB7 allowlisted by the operator")}`
+    say5(
+      `  ${cluster.serviceAccount.padEnd(width)}  service account ${dim5("\xB7 workspace pod identity \xB7 allowlisted by the operator")}`
     );
   }
   if (!cluster.clusterCapable && (cluster.bindings.length > 0 || cluster.serviceAccount !== null)) {
-    say4(
+    say5(
       amber(
         `  ${cluster.bindings.length} cluster binding${cluster.bindings.length === 1 ? "" : "s"}${cluster.serviceAccount === null ? "" : " \xB7 service account set"} \xB7 local runner \u2014 cluster bindings do not resolve here`
       )
@@ -6426,54 +7219,54 @@ var envShow = async (config, args) => {
   }
 };
 var envCluster = async (config, args) => {
-  const explicitProject = takeFlagValue3(args, "--project");
+  const explicitProject = takeFlagValue4(args, "--project");
   const positional = args.filter((arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project");
   const [verb, ...rest] = positional;
   const usage = usageOf("env cluster");
   const project2 = await findProject(config, explicitProject);
   const route = `/projects/${project2.id}/cluster-bindings`;
-  const appliesLine = () => say4(
-    dim4(
+  const appliesLine = () => say5(
+    dim5(
       "  applies from the next workspace launch; running workspaces keep what they started with"
     )
   );
   if (verb === "add") {
     const [kind, objectName] = rest;
     if (kind !== "secret" && kind !== "configmap" || objectName === void 0) {
-      return fail4(`env cluster add takes a kind and an object name
+      return fail5(`env cluster add takes a kind and an object name
 ${usage}`);
     }
     const result = await api(config, "POST", route, {
       kind,
       objectName
     });
-    say4(`${green4("\u2713")} bound ${kind}/${objectName} ${dim4(`\xB7 cluster r${result.revision}`)}`);
-    say4(dim4("  resolved by the platform at launch \xB7 contents unknown to Mend"));
+    say5(`${green5("\u2713")} bound ${kind}/${objectName} ${dim5(`\xB7 cluster r${result.revision}`)}`);
+    say5(dim5("  resolved by the platform at launch \xB7 contents unknown to Mend"));
     return appliesLine();
   }
   if (verb === "remove") {
     const [ref] = rest;
     const [kind, objectName] = ref?.split("/", 2) ?? [];
     if (kind !== "secret" && kind !== "configmap" || objectName === void 0) {
-      return fail4(`env cluster remove takes <kind>/<name>, e.g. secret/app-env
+      return fail5(`env cluster remove takes <kind>/<name>, e.g. secret/app-env
 ${usage}`);
     }
     const snapshot = await api(config, "GET", route);
     const binding = snapshot.bindings.find((b) => b.kind === kind && b.objectName === objectName);
-    if (binding === void 0) return fail4(`${kind}/${objectName} is not bound on ${project2.name}`);
+    if (binding === void 0) return fail5(`${kind}/${objectName} is not bound on ${project2.name}`);
     const result = await api(
       config,
       "DELETE",
       `${route}/${binding.id}`
     );
-    say4(`${green4("\u2713")} removed ${kind}/${objectName} ${dim4(`\xB7 cluster r${result.revision}`)}`);
+    say5(`${green5("\u2713")} removed ${kind}/${objectName} ${dim5(`\xB7 cluster r${result.revision}`)}`);
     return appliesLine();
   }
   if (verb === "sa") {
     const clear = args.includes("--clear");
     const [name] = rest;
     if (!clear && name === void 0)
-      return fail4(`env cluster sa takes a name or --clear
+      return fail5(`env cluster sa takes a name or --clear
 ${usage}`);
     const result = await api(
       config,
@@ -6481,11 +7274,11 @@ ${usage}`);
       `${route}/service-account`,
       { serviceAccount: clear ? null : name }
     );
-    say4(
-      result.serviceAccount === null ? `${green4("\u2713")} cleared the workspace service account ${dim4(`\xB7 cluster r${result.revision}`)}` : `${green4("\u2713")} service account ${result.serviceAccount} ${dim4(`\xB7 cluster r${result.revision}`)}`
+    say5(
+      result.serviceAccount === null ? `${green5("\u2713")} cleared the workspace service account ${dim5(`\xB7 cluster r${result.revision}`)}` : `${green5("\u2713")} service account ${result.serviceAccount} ${dim5(`\xB7 cluster r${result.revision}`)}`
     );
     if (result.serviceAccount !== null) {
-      say4(
+      say5(
         amber(
           "  the session agent holds this role's full permissions for the whole session \u2014 bind a least-privilege role intended for untrusted code; names outside the platform allowlist fail the launch"
         )
@@ -6493,7 +7286,7 @@ ${usage}`);
     }
     return appliesLine();
   }
-  return fail4(`unknown env cluster command "${verb ?? ""}"
+  return fail5(`unknown env cluster command "${verb ?? ""}"
 ${usage}`);
 };
 var envCommand = async (config, args) => {
@@ -6507,7 +7300,7 @@ var envCommand = async (config, args) => {
     case void 0:
       return envShow(config, rest);
     default:
-      return fail4(`unknown env command "${verb}" \xB7 mend help env lists them`);
+      return fail5(`unknown env command "${verb}" \xB7 mend help env lists them`);
   }
 };
 var dotfilesCommand = async (config, args) => {
@@ -6519,12 +7312,12 @@ var dotfilesCommand = async (config, args) => {
     case void 0:
       return dotfilesShow(config);
     default:
-      return fail4(`unknown dotfiles command "${verb}" \xB7 mend help dotfiles lists them`);
+      return fail5(`unknown dotfiles command "${verb}" \xB7 mend help dotfiles lists them`);
   }
 };
 var skillsList = async (config, args) => {
   const forProject = args.includes("--project");
-  const project2 = forProject ? await findProject(config, takeFlagValue3(args, "--project")) : null;
+  const project2 = forProject ? await findProject(config, takeFlagValue4(args, "--project")) : null;
   const skills = await api(
     config,
     "GET",
@@ -6532,25 +7325,25 @@ var skillsList = async (config, args) => {
   );
   const library = project2 === null ? "your library" : project2.name;
   if (skills.length === 0) {
-    say4(dim4(`no skills in ${library} \u2014 push a local one: mend skills push`));
+    say5(dim5(`no skills in ${library} \u2014 push a local one: mend skills push`));
     return;
   }
   for (const skill of skills) {
-    say4(
-      `  ${skill.name.padEnd(28)} ${dim4(`${skill.fileCount} file${skill.fileCount === 1 ? "" : "s"} \xB7 ${formatDotfileBytes(skill.bytes)}`)}`
+    say5(
+      `  ${skill.name.padEnd(28)} ${dim5(`${skill.fileCount} file${skill.fileCount === 1 ? "" : "s"} \xB7 ${formatDotfileBytes(skill.bytes)}`)}`
     );
-    if (skill.description !== "") say4(`    ${dim4(skill.description)}`);
+    if (skill.description !== "") say5(`    ${dim5(skill.description)}`);
   }
 };
 var skillsPush = async (config, args) => {
-  const dirFlag = takeFlagValue3(args, "--dir");
-  const root = dirFlag === null ? path10.join(os6.homedir(), DEFAULT_SKILLS_DIR) : path10.resolve(dirFlag);
+  const dirFlag = takeFlagValue4(args, "--dir");
+  const root = dirFlag === null ? path12.join(os7.homedir(), DEFAULT_SKILLS_DIR) : path12.resolve(dirFlag);
   const scanned = scanSkillLibrary(root);
-  if ("error" in scanned) return fail4(scanned.error);
-  for (const note of scanned.notes) say4(dim4(`  ${note.skill}: ${note.message}`));
-  if (scanned.skills.length === 0) return fail4(`no skills found under ${root}`);
+  if ("error" in scanned) return fail5(scanned.error);
+  for (const note of scanned.notes) say5(dim5(`  ${note.skill}: ${note.message}`));
+  if (scanned.skills.length === 0) return fail5(`no skills found under ${root}`);
   const forProject = args.includes("--project");
-  const project2 = forProject ? await findProject(config, takeFlagValue3(args, "--project")) : null;
+  const project2 = forProject ? await findProject(config, takeFlagValue4(args, "--project")) : null;
   const report = await api(config, "POST", "/skills/sync", {
     scope: project2 === null ? "user" : "project",
     projectId: project2?.id ?? null,
@@ -6568,10 +7361,10 @@ var skillsPush = async (config, args) => {
     `${report.unchanged.length} unchanged`,
     ...report.removed.length > 0 ? [`${report.removed.length} removed`] : []
   ].join(" \xB7 ");
-  say4(
-    `${green4("pushed")} ${scanned.skills.length} skill${scanned.skills.length === 1 ? "" : "s"} from ${root} to ${library} \xB7 ${dim4(counts)}`
+  say5(
+    `${green5("pushed")} ${scanned.skills.length} skill${scanned.skills.length === 1 ? "" : "s"} from ${root} to ${library} \xB7 ${dim5(counts)}`
   );
-  say4(dim4("sessions receive them from the next launch"));
+  say5(dim5("sessions receive them from the next launch"));
 };
 var skillsCommand = async (config, args) => {
   const [verb, ...rest] = args;
@@ -6584,7 +7377,7 @@ var skillsCommand = async (config, args) => {
       return skillsList(config, args);
     default:
       if (verb.startsWith("--")) return skillsList(config, args);
-      return fail4(`unknown skills command "${verb}" \xB7 mend help skills lists them`);
+      return fail5(`unknown skills command "${verb}" \xB7 mend help skills lists them`);
   }
 };
 var completeCommand = async (config, args) => {
@@ -6688,7 +7481,7 @@ var completionsCommand = (args) => {
       process.stdout.write(BASH_COMPLETIONS);
       return;
     default:
-      return fail4(`${usageOf("completions")} \xB7 e.g. mend completions zsh > "$fpath[1]/_mend"`);
+      return fail5(`${usageOf("completions")} \xB7 e.g. mend completions zsh > "$fpath[1]/_mend"`);
   }
 };
 var supervisedRun = async (config, session, argv) => {
@@ -6696,15 +7489,15 @@ var supervisedRun = async (config, session, argv) => {
     "provisioning workspace \u2014 a first launch builds the harness image (can take minutes)\u2026",
     api(config, "POST", `/sessions/${session.id}/launch`, { argv })
   );
-  say4(
-    `${green4("\u2713 recording")} \xB7 run ${dim4(launched.id.slice(0, 8))} \xB7 workspace mounts the worktree`
+  say5(
+    `${green5("\u2713 recording")} \xB7 run ${dim5(launched.id.slice(0, 8))} \xB7 workspace mounts the worktree`
   );
-  say4(dim4(`  ${argv.join(" ")} \u2014 live record:`));
-  say4("");
+  say5(dim5(`  ${argv.join(" ")} \u2014 live record:`));
+  say5("");
   const headers = {};
   if (config.token !== null) headers["authorization"] = `Bearer ${config.token}`;
   const response = await fetch(`${config.url}/api/events`, { headers });
-  if (response.body === null) return fail4("event stream unavailable");
+  if (response.body === null) return fail5("event stream unavailable");
   const reader = response.body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
@@ -6726,7 +7519,7 @@ var supervisedRun = async (config, session, argv) => {
       }
       if (event.sessionId !== session.id) continue;
       if (event.type === "session-progress" && event.line !== void 0) {
-        say4(dim4(`  ${event.line}`));
+        say5(dim5(`  ${event.line}`));
       }
       if (event.type === "session") {
         const detail = await api(config, "GET", `/sessions/${session.id}`);
@@ -6736,9 +7529,9 @@ var supervisedRun = async (config, session, argv) => {
     }
   }
   await reader.cancel().catch(() => void 0);
-  say4("");
-  say4(`${green4("\u2713")} session ${settled ?? "settled"} \xB7 recorded \xB7 checkpoint taken`);
-  say4(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${session.id}`);
+  say5("");
+  say5(`${green5("\u2713")} session ${settled ?? "settled"} \xB7 recorded \xB7 checkpoint taken`);
+  say5(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${session.id}`);
   process.exit(settled === "failed" ? 1 : 0);
 };
 var continueSession = async (config, args) => {
@@ -6761,20 +7554,20 @@ var continueSession = async (config, args) => {
       }
     }
     if (sessionId === null || followUp === null) {
-      return fail4("no session with a pending follow-up \u2014 send one from the review first");
+      return fail5("no session with a pending follow-up \u2014 send one from the review first");
     }
   } else {
     followUp = await api(config, "GET", `/sessions/${sessionId}/follow-up`);
-    if (followUp === null) return fail4(`session ${sessionId} has no pending follow-up`);
+    if (followUp === null) return fail5(`session ${sessionId} has no pending follow-up`);
   }
   const detail = await api(config, "GET", `/sessions/${sessionId}`);
   const session = detail.session;
-  say4(`${green4("\u2713")} follow-up for session ${dim4(session.id.slice(0, 8))} \xB7 ${session.branch}`);
-  say4(dim4("  instruction:"));
-  for (const line of followUp.instruction.split("\n").slice(0, 6)) say4(dim4(`  \u2502 ${line}`));
-  if (followUp.instruction.split("\n").length > 6) say4(dim4("  \u2502 \u2026"));
+  say5(`${green5("\u2713")} follow-up for session ${dim5(session.id.slice(0, 8))} \xB7 ${session.branch}`);
+  say5(dim5("  instruction:"));
+  for (const line of followUp.instruction.split("\n").slice(0, 6)) say5(dim5(`  \u2502 ${line}`));
+  if (followUp.instruction.split("\n").length > 6) say5(dim5("  \u2502 \u2026"));
   if (followUp.reviewSliceId === null || followUp.checkpointAId === null || followUp.checkpointBId === null || followUp.diffDigest === null || followUp.idempotencyKey === null) {
-    return fail4("legacy follow-up \u2014 recreate it from a pinned Review before delivery");
+    return fail5("legacy follow-up \u2014 recreate it from a pinned Review before delivery");
   }
   const delivered = await withSpinner(
     "delivering persisted Review bundle \u2014 retries reconcile one process\u2026",
@@ -6789,16 +7582,16 @@ var continueSession = async (config, args) => {
     })
   );
   if (delivered.status === "pending") {
-    return fail4("the session is active \u2014 the follow-up remains pending");
+    return fail5("the session is active \u2014 the follow-up remains pending");
   }
   if (delivered.status === "delivery_failed") {
-    return fail4(delivered.deliveryError ?? "delivery failed before process membership finalized");
+    return fail5(delivered.deliveryError ?? "delivery failed before process membership finalized");
   }
-  say4(
-    `${green4("\u2713 recording")} \xB7 delivered to run ${delivered.deliverySealantRunId ?? "unknown"}${detachHint()}`
+  say5(
+    `${green5("\u2713 recording")} \xB7 delivered to run ${delivered.deliverySealantRunId ?? "unknown"}${detachHint()}`
   );
-  say4(`${cobalt2("  watch")} \xB7 ${config.url}/sessions/${session.id}`);
-  say4("");
+  say5(`${cobalt2("  watch")} \xB7 ${config.url}/sessions/${session.id}`);
+  say5("");
   await attachOrExit(config, session.id, session.harness);
   exitAfterSessionEnd(config, session.id);
 };
@@ -6815,27 +7608,27 @@ var resumeCommand = async (config, args) => {
   const detail = await api(config, "GET", `/projects/${project2.id}`);
   const match = prefix === void 0 ? detail.sessions.find((s) => !agentLiveIn(detail, s)) : detail.sessions.find((s) => s.id.startsWith(prefix));
   if (match === void 0) {
-    return fail4(
+    return fail5(
       prefix === void 0 ? "no settled session to resume \u2014 mend status lists sessions" : `no session matches "${prefix}"`
     );
   }
   if (agentLiveIn(detail, match)) {
-    return fail4(
+    return fail5(
       `session ${match.id.slice(0, 8)} is live \u2014 attach: mend attach ${match.id.slice(0, 8)}`
     );
   }
-  say4(
-    `${green4("\u2713")} resuming ${match.harness} \xB7 ${dim4(match.id.slice(0, 8))}${withHarness === null ? "" : ` ${dim4("as")} ${withHarness}`}`
+  say5(
+    `${green5("\u2713")} resuming ${match.harness} \xB7 ${dim5(match.id.slice(0, 8))}${withHarness === null ? "" : ` ${dim5("as")} ${withHarness}`}`
   );
-  say4(`${cobalt2("  watch")} \xB7 ${config.url}/sessions/${match.id}`);
+  say5(`${cobalt2("  watch")} \xB7 ${config.url}/sessions/${match.id}`);
   const priorAgent = detail.annotations.find((annotation) => annotation.sessionId === match.id)?.currentAgent ?? null;
   const protocolPrior = priorAgent?.kind === "agent-protocol" && withHarness === null;
   await withSpinner(
     protocolPrior ? "reopening as a terminal \u2014 same conversation\u2026" : "resuming \u2014 a fresh workspace restores the saved session state\u2026",
     protocolPrior ? api(config, "POST", `/sessions/${match.id}/handoff`, { to: "pty" }) : api(config, "POST", `/sessions/${match.id}/resume`, { harness: withHarness })
   );
-  say4(`${green4("\u2713 recording")} \xB7 same worktree, conversation restored${detachHint()}`);
-  say4("");
+  say5(`${green5("\u2713 recording")} \xB7 same worktree, conversation restored${detachHint()}`);
+  say5("");
   await attachOrExit(config, match.id, withHarness ?? match.harness);
   exitAfterSessionEnd(config, match.id);
 };
@@ -6849,7 +7642,7 @@ var resumeForRejoin = async (config, sessionId, label) => {
   } catch (error) {
     const refreshed = await api(config, "GET", `/sessions/${sessionId}`);
     if (agentIsLive(refreshed.session, refreshed.currentAgent)) return false;
-    return fail4(error instanceof Error ? error.message : String(error));
+    return fail5(error instanceof Error ? error.message : String(error));
   }
 };
 var rejoinCommand = async (config, args) => {
@@ -6863,20 +7656,20 @@ var rejoinCommand = async (config, args) => {
   const matches = prefix === void 0 ? newest === void 0 ? [] : [newest] : eligible.filter((session2) => session2.id.startsWith(prefix));
   if (matches.length === 0) {
     const harnessDescription = harness === null ? "" : ` ${harness}`;
-    return fail4(
+    return fail5(
       prefix === void 0 ? `no${harnessDescription} session to rejoin in project ${project2.name}` : `no${harnessDescription} session matches "${prefix}" in project ${project2.name}`
     );
   }
   if (matches.length > 1) {
-    return fail4(`session prefix "${prefix}" is ambiguous \u2014 use more of the id`);
+    return fail5(`session prefix "${prefix}" is ambiguous \u2014 use more of the id`);
   }
   const session = matches[0];
-  if (session === void 0) return fail4("session selection failed");
+  if (session === void 0) return fail5("session selection failed");
   const alreadyLive = agentLiveIn(detail, session);
-  say4(
-    `${green4("\u2713")} rejoining ${sessionDisplayName(session)} \xB7 ${session.harness} ${dim4(session.id.slice(0, 8))} \xB7 ${alreadyLive ? "already live" : "restoring"}`
+  say5(
+    `${green5("\u2713")} rejoining ${sessionDisplayName(session)} \xB7 ${session.harness} ${dim5(session.id.slice(0, 8))} \xB7 ${alreadyLive ? "already live" : "restoring"}`
   );
-  say4(`${cobalt2("  watch")} \xB7 ${config.url}/sessions/${session.id}`);
+  say5(`${cobalt2("  watch")} \xB7 ${config.url}/sessions/${session.id}`);
   let restored = false;
   const currentAgent = detail.annotations.find((annotation) => annotation.sessionId === session.id)?.currentAgent ?? null;
   if (currentAgent?.kind === "agent-protocol") {
@@ -6892,10 +7685,10 @@ var rejoinCommand = async (config, args) => {
       "resuming \u2014 a fresh workspace restores the saved session state\u2026"
     );
   }
-  say4(
-    restored ? `${green4("\u2713 recording")} \xB7 same worktree, conversation restored${detachHint()}` : `${green4("\u2713 recording")} \xB7 attached to the live session${detachHint()}`
+  say5(
+    restored ? `${green5("\u2713 recording")} \xB7 same worktree, conversation restored${detachHint()}` : `${green5("\u2713 recording")} \xB7 attached to the live session${detachHint()}`
   );
-  say4("");
+  say5("");
   let outcome = await attachTty(config, session.id, session.harness, 0n, void 0, {
     handleSignals: true
   });
@@ -6921,7 +7714,7 @@ var projectsCommand = async (config) => {
     api(config, "GET", "/sessions")
   ]);
   if (projects.length === 0) {
-    say4(dim4("no adopted projects \u2014 mend adopt brings one in"));
+    say5(dim5("no adopted projects \u2014 mend adopt brings one in"));
     return;
   }
   const liveByProject = /* @__PURE__ */ new Map();
@@ -6933,30 +7726,30 @@ var projectsCommand = async (config) => {
   const here = matchProjectByCwd(projects, cwdFacts(process.cwd()));
   for (const project2 of projects) {
     const live = liveByProject.get(project2.id) ?? 0;
-    const liveLabel = live > 0 ? green4(`${live} live`) : dim4("\u2014");
+    const liveLabel = live > 0 ? green5(`${live} live`) : dim5("\u2014");
     const marker = project2.id === here?.id ? cobalt2("\u25B8 ") : "  ";
-    say4(
-      `${marker}${project2.name.padEnd(nameWidth)}  ${dim4(project2.defaultBranch.padEnd(branchWidth))}  ${liveLabel}  ${dim4(project2.storePath)}`
+    say5(
+      `${marker}${project2.name.padEnd(nameWidth)}  ${dim5(project2.defaultBranch.padEnd(branchWidth))}  ${liveLabel}  ${dim5(project2.storePath)}`
     );
   }
-  if (here !== void 0) say4(dim4(`  \u25B8 ${here.name} is the cwd's project`));
+  if (here !== void 0) say5(dim5(`  \u25B8 ${here.name} is the cwd's project`));
 };
 var refreshCommand = async (config, args) => {
-  const explicit = args.find((a) => !a.startsWith("--")) ?? takeFlagValue3(args, "--project");
+  const explicit = args.find((a) => !a.startsWith("--")) ?? takeFlagValue4(args, "--project");
   const project2 = await findProject(config, explicit ?? null);
   const branches = await api(
     config,
     "POST",
     `/projects/${project2.id}/refresh`
   );
-  say4(`${green4("\u2713")} refreshed ${project2.name} ${dim4(`\xB7 ${branches.length} branches`)}`);
+  say5(`${green5("\u2713")} refreshed ${project2.name} ${dim5(`\xB7 ${branches.length} branches`)}`);
   for (const branch of branches.slice(0, 12)) {
     const marker = branch.isDefault ? cobalt2("\u25B8 ") : "  ";
-    say4(
-      `${marker}${branch.name}  ${dim4(branch.sha.slice(0, 12))}  ${dim4(branch.committedAt.slice(0, 10))}`
+    say5(
+      `${marker}${branch.name}  ${dim5(branch.sha.slice(0, 12))}  ${dim5(branch.committedAt.slice(0, 10))}`
     );
   }
-  if (branches.length > 12) say4(dim4(`  \u2026 ${branches.length - 12} more`));
+  if (branches.length > 12) say5(dim5(`  \u2026 ${branches.length - 12} more`));
 };
 var printSessionRow = (row) => {
   const { session, annotation } = row;
@@ -6970,8 +7763,8 @@ var printSessionRow = (row) => {
   if (annotation !== void 0 && annotation.pendingFollowUp)
     facts.push(amber("follow-up pending"));
   const base = session.baseRef === null ? session.baseSha.slice(0, 12) : session.baseRef;
-  say4(
-    `${session.harness.padEnd(8)}  ${dim4(session.id.slice(0, 8))}  ${live ? green4(status) : dim4(status)}  ${row.projectName}  ${dim4(`${session.branch} \xB7 base ${base}`)}${facts.length > 0 ? `  ${facts.join(dim4(" \xB7 "))}` : ""}`
+  say5(
+    `${session.harness.padEnd(8)}  ${dim5(session.id.slice(0, 8))}  ${live ? green5(status) : dim5(status)}  ${row.projectName}  ${dim5(`${session.branch} \xB7 base ${base}`)}${facts.length > 0 ? `  ${facts.join(dim5(" \xB7 "))}` : ""}`
   );
 };
 var sessionsCommand = async (config, args) => {
@@ -6979,7 +7772,7 @@ var sessionsCommand = async (config, args) => {
   if (args.includes("--json=v2")) {
     const projectFlag2 = args.indexOf("--project");
     const projectName2 = projectFlag2 !== -1 && args[projectFlag2 + 1] !== void 0 ? String(args[projectFlag2 + 1]) : null;
-    say4(JSON.stringify(await buildWorktreesJson(config, projectName2), null, 2));
+    say5(JSON.stringify(await buildWorktreesJson(config, projectName2), null, 2));
     return;
   }
   const json = args.includes("--json");
@@ -6988,7 +7781,7 @@ var sessionsCommand = async (config, args) => {
   const projects = await api(config, "GET", "/projects");
   const scope = projectName === null ? projects : projects.filter((p) => p.name === projectName);
   if (projectName !== null && scope.length === 0) {
-    return fail4(`no adopted project named "${projectName}"`);
+    return fail5(`no adopted project named "${projectName}"`);
   }
   let rows;
   if (all || projectName !== null) {
@@ -7015,11 +7808,11 @@ var sessionsCommand = async (config, args) => {
   }
   if (rows.length === 0) {
     if (json) {
-      say4(JSON.stringify({ version: 1, sessions: [] }, null, 2));
+      say5(JSON.stringify({ version: 1, sessions: [] }, null, 2));
       return;
     }
-    say4(
-      dim4(all ? "no sessions" : "no active sessions \u2014 mend sessions --all includes settled ones")
+    say5(
+      dim5(all ? "no sessions" : "no active sessions \u2014 mend sessions --all includes settled ones")
     );
     return;
   }
@@ -7053,7 +7846,7 @@ var sessionsCommand = async (config, args) => {
         }
       }))
     };
-    say4(JSON.stringify(payload, null, 2));
+    say5(JSON.stringify(payload, null, 2));
     return;
   }
   for (const row of rows) printSessionRow(row);
@@ -7133,11 +7926,11 @@ var worktreesCommand = async (config, args) => {
   const projectName = projectFlag !== -1 && args[projectFlag + 1] !== void 0 ? String(args[projectFlag + 1]) : null;
   const payload = await buildWorktreesJson(config, projectName);
   if (json) {
-    say4(JSON.stringify(payload, null, 2));
+    say5(JSON.stringify(payload, null, 2));
     return;
   }
   if (payload.worktrees.length === 0) {
-    say4(dim4("no worktrees yet \u2014 mend claude --name <worktree> starts one"));
+    say5(dim5("no worktrees yet \u2014 mend claude --name <worktree> starts one"));
     return;
   }
   for (const worktree of payload.worktrees) {
@@ -7145,19 +7938,19 @@ var worktreesCommand = async (config, args) => {
     const facts = [
       `${worktree.sessions.length} session${worktree.sessions.length === 1 ? "" : "s"}`
     ];
-    if (live > 0) facts.push(green4(`${live} live`));
+    if (live > 0) facts.push(green5(`${live} live`));
     if (worktree.review !== null && worktree.review.openComments > 0) {
       facts.push(amber(`${worktree.review.openComments} open`));
     }
     const base = worktree.baseRef ?? worktree.baseSha.slice(0, 12);
-    say4(
-      `${worktree.name.padEnd(24)}  ${worktree.projectName}  ${dim4(`${worktree.branch} \xB7 base ${base}`)}  ${facts.join(dim4(" \xB7 "))}`
+    say5(
+      `${worktree.name.padEnd(24)}  ${worktree.projectName}  ${dim5(`${worktree.branch} \xB7 base ${base}`)}  ${facts.join(dim5(" \xB7 "))}`
     );
     for (const session of worktree.sessions) {
       const status = session.status.padEnd(9);
       const name = session.label ?? `session ${session.id.slice(0, 8)}`;
-      say4(
-        `  \u2514 ${session.harness.padEnd(8)}  ${dim4(session.id.slice(0, 8))}  ${ACTIVE_STATUSES.has(session.status) ? green4(status) : dim4(status)}  ${name}`
+      say5(
+        `  \u2514 ${session.harness.padEnd(8)}  ${dim5(session.id.slice(0, 8))}  ${ACTIVE_STATUSES.has(session.status) ? green5(status) : dim5(status)}  ${name}`
       );
     }
   }
@@ -7172,24 +7965,24 @@ var hasNodeFfi = () => {
 };
 var dashboard = async (config) => {
   if (process.stdout.isTTY !== true) {
-    say4(renderIndex());
+    say5(renderIndex());
     return;
   }
   if (!hasNodeFfi()) {
     const major = Number(process.versions.node.split(".")[0]);
     if (Number.isNaN(major) || major < 26) {
-      return fail4(
+      return fail5(
         `the dashboard needs Node >= 26 (node:ffi) \u2014 this is ${process.version}; every other command still works`
       );
     }
-    const rerun = spawnSync2(
+    const rerun = spawnSync3(
       process.execPath,
       ["--experimental-ffi", "--disable-warning=ExperimentalWarning", ...process.argv.slice(1)],
       { stdio: "inherit" }
     );
     process.exit(rerun.status ?? 0);
   }
-  const { runDashboard } = await import("./dashboard-4WQC5MZ4.js");
+  const { runDashboard } = await import("./dashboard-ZKCPU2QJ.js");
   const agentShare = await startShareIfBridge(config);
   try {
     await runDashboard({
@@ -7215,11 +8008,7 @@ var startShareIfBridge = async (config) => {
   }
   if (access.mode !== "bridge") return null;
   return startAgentShare({
-    url: bridgeUrlOf(
-      parseMendUrl(config.url).toString().replace(/\/$/, ""),
-      config.token,
-      os6.hostname()
-    ),
+    url: () => socketUrl(config, "keys-bridge", { host: os7.hostname() }),
     agentSock
   });
 };
@@ -7233,38 +8022,38 @@ var withAgentShare = async (config, work) => {
 };
 var helpCommand = (words) => {
   if (words.length === 0) {
-    say4(renderIndex());
+    say5(renderIndex());
     return;
   }
   const doc = findCommand(words);
   if (doc !== null && (doc.name.split(" ").length > 1 || words.length === 1)) {
-    say4(renderCommand(doc));
+    say5(renderCommand(doc));
     return;
   }
   const group = renderGroup(words[0] ?? "");
   if (doc !== null) {
-    say4(renderCommand(doc));
+    say5(renderCommand(doc));
     return;
   }
   if (group !== null) {
-    say4(group);
+    say5(group);
     return;
   }
-  return fail4(`no command "${words.join(" ")}" \xB7 mend help lists them`);
+  return fail5(`no command "${words.join(" ")}" \xB7 mend help lists them`);
 };
 var manCommand = (words) => {
   const doc = words.length === 0 ? null : findCommand(words);
   if (words.length > 0 && doc === null) {
-    return fail4(`no command "${words.join(" ")}" \xB7 mend help lists them`);
+    return fail5(`no command "${words.join(" ")}" \xB7 mend help lists them`);
   }
   const version = cliVersion();
   const page = doc === null ? renderManIndex(version) : renderManPage(doc, version);
-  const file = path10.join(os6.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
-  fs9.writeFileSync(file, page);
-  const result = spawnSync2("man", ["-l", file], { stdio: "inherit" });
-  fs9.rmSync(file, { force: true });
+  const file = path12.join(os7.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
+  fs11.writeFileSync(file, page);
+  const result = spawnSync3("man", ["-l", file], { stdio: "inherit" });
+  fs11.rmSync(file, { force: true });
   if (result.error !== void 0 || result.status !== 0) {
-    say4(doc === null ? renderIndex() : renderCommand(doc));
+    say5(doc === null ? renderIndex() : renderCommand(doc));
   }
 };
 var main = async () => {
@@ -7275,7 +8064,7 @@ var main = async () => {
   }
   if (command === "server") {
     const result = await serverCommand(rest);
-    if (result._tag === "error") return fail4(result.message);
+    if (result._tag === "error") return fail5(result.message);
     return;
   }
   const config = loadConfig();
@@ -7313,11 +8102,30 @@ var main = async () => {
       return connectCommand(config, rest);
     case "pair":
       return pairCommand(rest, boundApi(config));
+    case "invite":
+      return inviteCommand(boundApi(config), config.url, rest);
+    case "members":
+      return membersCommand(boundApi(config));
+    case "folder":
+      return folderCommand(boundApi(config), rest);
+    case "operator":
+      return operatorCommand(
+        boundApi(config),
+        (method, route, body) => request(config, method, route, body),
+        config.url,
+        rest
+      );
+    case "session":
+      if (rest[0] === "share") return sessionShareCommand(boundApi(config), rest.slice(1));
+      return fail5(`unknown session command "${rest[0] ?? ""}" \xB7 mend help session share`);
     // Hidden in the catalog: the installer renders its own QR through this.
     case "qr":
       return qrCommand(rest);
     case "doctor":
-      return doctorCommand(config, localCredential);
+      return doctorCommand(config, localCredential, () => {
+        const read = readGrant(claudeGrantDir(mendCliHome()));
+        return read.kind === "missing" ? null : read.secret;
+      });
     case "env":
       return envCommand(config, rest);
     case "ssh":
@@ -7354,10 +8162,10 @@ var main = async () => {
     case "--version":
     case "-v":
       for (const line of versionLines(cliVersion(), await fetchServerVersion(config.url)))
-        say4(line);
+        say5(line);
       return;
     default:
-      return fail4(`unknown command "${command}" \xB7 mend help lists them`);
+      return fail5(`unknown command "${command}" \xB7 mend help lists them`);
   }
 };
 await main();