@sealant/mend 0.31.0 → 0.32.1

package/dist/main.js

@@ -31,11 +31,11 @@ import {
 
 // src/main.ts
 import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
-import * as fs12 from "node:fs";
+import * as fs14 from "node:fs";
 import { createRequire } from "node:module";
 import * as net4 from "node:net";
-import * as os8 from "node:os";
-import * as path13 from "node:path";
+import * as os9 from "node:os";
+import * as path15 from "node:path";
 
 // src/agent-share.ts
 import * as net from "node:net";
@@ -43,7 +43,7 @@ import { setTimeout as delay } from "node:timers/promises";
 var retryDelayMs = (attempt2) => Math.min(3e4, 1e3 * 2 ** Math.min(Math.max(attempt2 - 1, 0), 5));
 var SSH_AGENTC_REQUEST_IDENTITIES = 11;
 var SSH_AGENTC_SIGN_REQUEST = 13;
-var askLocalAgent = (agentSock, payload) => new Promise((resolve6, reject) => {
+var askLocalAgent = (agentSock, payload) => new Promise((resolve7, reject) => {
   const connection = net.connect(agentSock, () => {
     connection.write(payload);
   });
@@ -57,7 +57,7 @@ var askLocalAgent = (agentSock, payload) => new Promise((resolve6, reject) => {
     if (pending.length >= 4 && pending.length >= 4 + pending.readUInt32BE(0)) {
       clearTimeout(timer);
       connection.end();
-      resolve6(pending.subarray(0, 4 + pending.readUInt32BE(0)));
+      resolve7(pending.subarray(0, 4 + pending.readUInt32BE(0)));
     }
   });
   connection.on("error", (error) => {
@@ -87,12 +87,12 @@ var shareAgent = async (options) => {
     const ws = new WebSocket(target);
     const onAbort = () => ws.close();
     signal.addEventListener("abort", onAbort, { once: true });
-    const closed = new Promise((resolve6) => {
-      ws.addEventListener("close", () => resolve6(), { once: true });
+    const closed = new Promise((resolve7) => {
+      ws.addEventListener("close", () => resolve7(), { once: true });
     });
-    const opened = await new Promise((resolve6) => {
-      ws.addEventListener("open", () => resolve6(true), { once: true });
-      ws.addEventListener("error", () => resolve6(false), { once: true });
+    const opened = await new Promise((resolve7) => {
+      ws.addEventListener("open", () => resolve7(true), { once: true });
+      ws.addEventListener("error", () => resolve7(false), { once: true });
     });
     if (opened) {
       attempt2 = 0;
@@ -110,19 +110,19 @@ var shareAgent = async (options) => {
         }
         const id = frame.id;
         const payload = Buffer.from(frame.payload, "base64");
-        const type = payload[4];
+        const type2 = payload[4];
         const context = typeof frame.context === "string" ? frame.context : "mend";
         chain = chain.then(async () => {
           const started = Date.now();
-          if (type === SSH_AGENTC_SIGN_REQUEST) onEvent({ kind: "sign-requested", context });
-          else if (type === SSH_AGENTC_REQUEST_IDENTITIES) {
+          if (type2 === SSH_AGENTC_SIGN_REQUEST) onEvent({ kind: "sign-requested", context });
+          else if (type2 === SSH_AGENTC_REQUEST_IDENTITIES) {
             onEvent({ kind: "identities-requested", context });
           }
           try {
             const response = await askLocalAgent(agentSock, payload);
             if (ws.readyState !== WebSocket.OPEN) return null;
             ws.send(JSON.stringify({ t: "res", id, payload: response.toString("base64") }));
-            if (type === SSH_AGENTC_SIGN_REQUEST) {
+            if (type2 === SSH_AGENTC_SIGN_REQUEST) {
               onEvent({ kind: "signed", context, seconds: (Date.now() - started) / 1e3 });
             }
           } catch (error) {
@@ -130,7 +130,7 @@ var shareAgent = async (options) => {
             if (ws.readyState === WebSocket.OPEN) {
               ws.send(JSON.stringify({ t: "err", id, message }));
             }
-            if (type === SSH_AGENTC_SIGN_REQUEST) onEvent({ kind: "not-signed", context, message });
+            if (type2 === SSH_AGENTC_SIGN_REQUEST) onEvent({ kind: "not-signed", context, message });
           }
           return null;
         });
@@ -243,8 +243,8 @@ var readGrant = (configDir, platform = process.platform) => {
 import { execFile } from "node:child_process";
 var IMAGE_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp"];
 var pickImageType = (offered) => {
-  const types = offered.split(/\s+/).map((type) => type.trim().toLowerCase());
-  for (const type of IMAGE_TYPES) if (types.includes(type)) return type;
+  const types = offered.split(/\s+/).map((type2) => type2.trim().toLowerCase());
+  for (const type2 of IMAGE_TYPES) if (types.includes(type2)) return type2;
   return null;
 };
 var parsePngfHex = (output) => {
@@ -253,13 +253,13 @@ var parsePngfHex = (output) => {
   return Buffer.from(match[1], "hex");
 };
 var MAX_BYTES = 32 * 1024 * 1024;
-var run = (command, args) => new Promise((resolve6) => {
+var run = (command, args) => new Promise((resolve7) => {
   execFile(
     command,
     [...args],
     { encoding: "buffer", maxBuffer: MAX_BYTES, timeout: 3e3 },
     (error, stdout) => {
-      resolve6(error === null ? stdout : null);
+      resolve7(error === null ? stdout : null);
     }
   );
 });
@@ -296,465 +296,736 @@ var readClipboardImage = async (platform = process.platform, env = process.env)
   return null;
 };
 
-// src/doctor.ts
+// src/doctor-bundle-collectors.ts
+import * as fs3 from "node:fs";
+import * as os2 from "node:os";
+import * as path3 from "node:path";
+
+// src/server-runtime.ts
+import { spawn } from "node:child_process";
 import * as fs2 from "node:fs";
 import * as path2 from "node:path";
-var TIMEOUT_MS = 3e3;
-var MARKS = { ok: "\u2713", todo: "\u25CB", failed: "\u2717" };
-var LABEL_WIDTH = 11;
-var day = (at) => at.toISOString().slice(0, 10);
-var formatCheck = (check, paint6 = (_state, mark) => mark) => `${paint6(check.state, MARKS[check.state])} ${check.label.padEnd(LABEL_WIDTH)} ${check.detail}${check.fix === null ? "" : ` \u2192 ${check.fix}`}`;
-var getJson = async (config, route) => {
-  try {
-    const response = await fetch(`${config.url}/api${route}`, {
-      headers: config.token === null ? {} : { authorization: `Bearer ${config.token}` },
-      signal: AbortSignal.timeout(TIMEOUT_MS)
+var serverProcessDeadlines = {
+  ordinary: 3e4,
+  pull: 10 * 6e4,
+  startup: 3 * 6e4,
+  stop: 9e4,
+  dump: 15 * 6e4,
+  composeWaitSeconds: 120
+};
+var runServerProcess = (command, args, parentEnvironment, options = {}) => {
+  const timeoutMs = options?.timeoutMs ?? serverProcessDeadlines.ordinary;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647) {
+    return Promise.resolve({
+      status: null,
+      stdout: "",
+      stderr: "",
+      error: "Invalid process timeout"
     });
-    if (!response.ok) return { value: null, status: response.status };
-    return { value: await response.json(), status: response.status };
-  } catch {
-    return { value: null, status: null };
   }
+  if (options.stdoutFile !== void 0 && options.stdout === "inherit") {
+    return Promise.resolve({
+      status: null,
+      stdout: "",
+      stderr: "",
+      error: "Invalid process output options"
+    });
+  }
+  const env = {};
+  for (const key of [
+    "PATH",
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "XDG_CONFIG_HOME",
+    "XDG_RUNTIME_DIR",
+    "DOCKER_CONFIG",
+    "SSH_AUTH_SOCK",
+    "TMPDIR",
+    "TMP",
+    "TEMP"
+  ]) {
+    if (parentEnvironment[key] !== void 0) env[key] = parentEnvironment[key];
+  }
+  return new Promise((resolve7) => {
+    let fd;
+    try {
+      if (options.stdoutFile !== void 0) fd = fs2.openSync(options.stdoutFile, "wx", 384);
+      const child = spawn(command, [...args], {
+        env,
+        detached: process.platform !== "win32",
+        stdio: ["ignore", fd ?? (options.stdout === "inherit" ? "inherit" : "pipe"), "pipe"]
+      });
+      let stdout = "";
+      let stderr = "";
+      let stdoutBytes = 0;
+      let stderrBytes = 0;
+      let failure2;
+      const terminate = () => {
+        if (process.platform === "win32" || child.pid === void 0) {
+          child.kill("SIGKILL");
+          return;
+        }
+        try {
+          process.kill(-child.pid, "SIGKILL");
+        } catch (cause) {
+          if (!(cause instanceof Error && "code" in cause && cause.code === "ESRCH")) {
+            failure2 = "Could not terminate the process group; retain the installation lock until its processes stop.";
+            child.kill("SIGKILL");
+          }
+        }
+      };
+      child.stdout?.on("data", (chunk) => {
+        stdoutBytes += chunk.length;
+        if (stdoutBytes <= 4 * 1024 * 1024) stdout += chunk.toString();
+        else {
+          failure2 ??= "Process output exceeded the capture limit. Request fewer log lines.";
+          terminate();
+        }
+      });
+      child.stderr?.on("data", (chunk) => {
+        stderrBytes += chunk.length;
+        if (stderrBytes <= 64 * 1024) stderr += chunk.toString();
+        else {
+          failure2 ??= "Process output exceeded the capture limit. Request fewer log lines.";
+          terminate();
+        }
+      });
+      const timer = setTimeout(() => {
+        failure2 ??= `Process timed out after ${timeoutMs}ms`;
+        terminate();
+      }, timeoutMs);
+      child.once("error", (error) => {
+        failure2 ??= error.message;
+      });
+      child.once("close", (status) => {
+        globalThis.clearTimeout(timer);
+        try {
+          if (fd !== void 0) fs2.fsyncSync(fd);
+        } catch {
+          failure2 ??= "Could not durably write process output.";
+        } finally {
+          try {
+            if (fd !== void 0) fs2.closeSync(fd);
+          } catch {
+            failure2 ??= "Could not close process output file.";
+          }
+        }
+        resolve7({
+          status: failure2 === void 0 ? status : null,
+          stdout,
+          stderr,
+          ...failure2 === void 0 ? {} : { error: failure2 }
+        });
+      });
+    } catch (cause) {
+      try {
+        if (fd !== void 0) fs2.closeSync(fd);
+      } catch {
+      }
+      resolve7({
+        status: null,
+        stdout: "",
+        stderr: "",
+        error: cause instanceof Error ? cause.message : "Could not start process."
+      });
+    }
+  });
 };
-var exposureCheck = (exposure) => {
-  const beyondMachine = exposure.declared !== "loopback" && exposure.originOnMachine !== true;
-  const gateOpen = beyondMachine ? exposure.gateOpen : 0;
-  const facts = [
-    `declared ${exposure.declared}`,
-    `${exposure.originScheme} origin`,
-    ...exposure.arrivedVia === "trusted-proxy" ? ["arrived via a trusted proxy"] : [],
-    ...gateOpen === 0 ? [] : [`${gateOpen} gate items open`]
-  ].join(" \xB7 ");
-  const plainBeyondMachine = beyondMachine && exposure.originScheme === "http";
-  return {
-    label: "exposure",
-    state: plainBeyondMachine ? "todo" : "ok",
-    detail: facts,
-    fix: plainBeyondMachine ? "serve it over https and set APP_URL to that origin" : gateOpen === 0 ? null : "mend operator exposure"
+var serverComposeArgs = (installation, command) => [
+  "--context",
+  installation.dockerContext,
+  "compose",
+  "--project-name",
+  "mend",
+  "--project-directory",
+  installation.directory,
+  "--env-file",
+  path2.join(installation.directory, "server.env"),
+  "-f",
+  path2.join(installation.directory, "compose.yaml"),
+  ...command
+];
+
+// src/doctor-bundle-collectors.ts
+var json = (value) => `${JSON.stringify(value, null, 2)}
+`;
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var field = (value, key) => isRecord(value) ? value[key] : void 0;
+var stringField = (value, key) => {
+  const found = field(value, key);
+  return typeof found === "string" ? found : null;
+};
+var stringList = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+var outputOrFailure = (output) => {
+  if (output.error !== void 0) return `failed: ${output.error}`;
+  if (output.status !== 0)
+    return `exit ${output.status ?? "unknown"}
+${output.stderr.trim() || output.stdout.trim()}`;
+  return output.stdout.trimEnd();
+};
+var failedOutput = (output, what) => new Error(
+  `${what}: ${output.error ?? `exit ${output.status ?? "unknown"}`}${output.stderr.trim() === "" ? "" : `
+${output.stderr.trim()}`}`
+);
+var lastLines = (text, count) => {
+  const lines = text.split("\n");
+  return lines.length <= count ? text : lines.slice(lines.length - count).join("\n");
+};
+var mapLimit = async (items, limit, work) => {
+  const results = [];
+  let next = 0;
+  const worker = async () => {
+    for (; ; ) {
+      const index = next;
+      next += 1;
+      if (index >= items.length) return;
+      const item = items[index];
+      if (item === void 0) return;
+      results[index] = await work(item);
+    }
   };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return results;
 };
-var LOGIN_COMMANDS = {
-  claude: "claude setup-token",
-  codex: "codex login",
-  github: "gh auth login"
-};
-var HARNESS_CLIS = [
-  { command: "claude", provider: "claude" },
-  { command: "codex", provider: "codex" },
-  { command: "gh", provider: "github" }
-];
-var notChecked = (label) => ({
-  label,
-  state: "todo",
-  detail: "not checked",
-  fix: null
-});
-var identityOf = (account) => {
-  const meta = account.metadata;
-  for (const key of ["login", "email", "accountEmail", "accountId"]) {
-    const value = meta[key];
-    if (typeof value === "string" && value !== "") return value;
+var pathOf = (command, env = process.env) => {
+  for (const directory of (env["PATH"] ?? "").split(path3.delimiter)) {
+    if (directory === "") continue;
+    const candidate = path3.join(directory, command);
+    try {
+      fs3.accessSync(candidate, fs3.constants.X_OK);
+      return candidate;
+    } catch {
+    }
   }
   return null;
 };
-var runChecks = async (config, probes) => {
-  const checks = [];
-  const health = await getJson(config, "/health");
-  checks.push(
-    health.value === null ? {
-      label: "server",
-      state: "failed",
-      detail: `cannot reach ${config.url}`,
-      fix: "start the Mend server"
-    } : {
-      label: "server",
-      state: "ok",
-      detail: `${config.url} \xB7 mend ${health.value.version}`,
-      fix: null
+var cliCollector = (deps) => ({
+  name: "cli",
+  collect: async () => [
+    {
+      path: "cli.json",
+      content: json({
+        collectedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        cliVersion: deps.cliVersion,
+        node: process.versions.node,
+        platform: process.platform,
+        arch: process.arch,
+        osType: os2.type(),
+        osRelease: os2.release(),
+        hostname: os2.hostname(),
+        term: deps.env["TERM"] ?? null,
+        shell: deps.env["SHELL"] ?? null,
+        lang: deps.env["LANG"] ?? null,
+        stdinTty: deps.stdinTty,
+        stdoutTty: deps.stdoutTty,
+        serverUrl: deps.serverUrl,
+        configuredUrl: deps.configuredUrl,
+        deviceId: deps.deviceId,
+        tokenSaved: deps.tokenSaved,
+        mendEnvNames: Object.keys(deps.env).filter((name) => name.startsWith("MEND_")).toSorted()
+      })
     }
-  );
-  const projects = health.value !== null && config.token !== null ? await getJson(config, "/projects") : null;
-  if (health.value === null) checks.push(notChecked("signed in"));
-  else if (config.token === null) {
-    checks.push({
-      label: "signed in",
-      state: "failed",
-      detail: "no token saved",
-      fix: "mend login"
-    });
-  } else if (projects !== null && projects.value !== null) {
-    checks.push({ label: "signed in", state: "ok", detail: "token accepted", fix: null });
-  } else {
-    const status = projects === null ? null : projects.status;
-    checks.push(
-      status === 401 || status === 403 ? { label: "signed in", state: "failed", detail: "token rejected", fix: "mend login" } : {
-        label: "signed in",
-        state: "failed",
-        detail: `GET /projects \u2192 ${status ?? "no answer"}`,
-        fix: null
-      }
+  ]
+});
+var doctorCollector = (deps) => ({
+  name: "doctor",
+  collect: async () => [{ path: "doctor.txt", content: await deps.doctor() }]
+});
+var serverHealthCollector = (deps) => ({
+  name: "server-health",
+  collect: async () => [
+    { path: "server-health.json", content: json(await deps.get("/health")) }
+  ]
+});
+var NO_SERVER = "no Mend server is installed on this machine (mend server setup installs one)";
+var serverFactsOnce = (deps) => {
+  let pending = null;
+  return () => {
+    pending ??= deps.readServer();
+    return pending;
+  };
+};
+var serverConfigCollector = (facts) => ({
+  name: "server-config",
+  collect: async () => {
+    const server = await facts();
+    if (server === null) throw new Error(NO_SERVER);
+    return [
+      {
+        path: "server-config.json",
+        content: json({
+          directory: server.directory,
+          config: server.config,
+          envKeys: server.envKeys
+        })
+      },
+      { path: "server-compose.yaml", content: server.compose }
+    ];
+  }
+});
+var COMPOSE_TIMEOUT_MS = 3e4;
+var serverLogsCollector = (deps, facts) => ({
+  name: "server-logs",
+  collect: async () => {
+    const server = await facts();
+    if (server === null) throw new Error(NO_SERVER);
+    const installation = {
+      directory: server.directory,
+      dockerContext: server.config.dockerContext
+    };
+    const listed = await deps.run(
+      "docker",
+      serverComposeArgs(installation, ["ps", "--all", "--services"]),
+      COMPOSE_TIMEOUT_MS
     );
+    if (listed.status !== 0 || listed.error !== void 0)
+      throw failedOutput(listed, "docker compose ps failed");
+    const services = listed.stdout.split(/\s+/).filter((name) => name !== "");
+    if (services.length === 0) throw new Error("no Compose containers found (mend server start)");
+    const files = [];
+    for (const service of services) {
+      const logs = await deps.run(
+        "docker",
+        serverComposeArgs(installation, [
+          "logs",
+          "--no-color",
+          "--tail",
+          String(deps.tail),
+          service
+        ]),
+        COMPOSE_TIMEOUT_MS
+      );
+      const text = logs.error !== void 0 || logs.status !== 0 ? outputOrFailure(logs) : `${logs.stdout.trimEnd()}${logs.stderr.trim() === "" ? "" : `
+--- stderr ---
+${logs.stderr.trimEnd()}`}`;
+      files.push({ path: `server-logs/${service}.log`, content: `${text}
+` });
+    }
+    return files;
   }
-  const signedIn = projects !== null && projects.value !== null;
-  const connection = signedIn ? await getJson(config, "/sealant/connection") : null;
-  if (connection === null) checks.push(notChecked("sealant"));
-  else if (connection.value === null) {
-    checks.push(
-      connection.status === 404 ? notChecked("sealant") : {
-        label: "sealant",
-        state: "failed",
-        detail: `GET /sealant/connection \u2192 ${connection.status ?? "no answer"}`,
-        fix: null
-      }
-    );
-  } else if (connection.value.status === "connected") {
-    checks.push({
-      label: "sealant",
-      state: "ok",
-      detail: `connected \xB7 ${connection.value.baseUrl}`,
-      fix: null
-    });
-  } else {
-    checks.push({
-      label: "sealant",
-      state: "failed",
-      detail: `${connection.value.status} \xB7 ${connection.value.detail ?? connection.value.baseUrl}`,
-      fix: null
-    });
+});
+var DOCKER_TIMEOUT_MS = 2e4;
+var CONTAINER_FILTERS = [
+  ["--filter", "label=com.docker.compose.project=mend"],
+  ["--filter", "name=sealant-"],
+  ["--filter", "label=sealant.workspace"]
+];
+var parseContainerRows = (stdout) => stdout.split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return [];
   }
-  const identity = signedIn ? await getJson(config, "/me/sealant") : null;
-  const platform = identity === null ? null : identity.value;
-  for (const { provider } of HARNESS_CLIS) {
-    if (platform === null) {
-      checks.push(notChecked(provider));
-      continue;
+  const id = stringField(parsed, "ID");
+  if (id === null) return [];
+  return [
+    {
+      id,
+      name: stringField(parsed, "Names") ?? id,
+      image: stringField(parsed, "Image") ?? "",
+      state: stringField(parsed, "State") ?? "",
+      status: stringField(parsed, "Status") ?? "",
+      labels: stringField(parsed, "Labels") ?? ""
     }
-    const account = platform.accounts.find((row) => row.provider === provider && row.name === "default") ?? platform.accounts.find((row) => row.provider === provider);
-    if (account === void 0) {
-      checks.push({
-        label: provider,
-        state: "todo",
-        detail: "not connected",
-        fix: `mend connect ${provider}`
-      });
-      continue;
+  ];
+});
+var dockerFactsOnce = (deps, facts) => {
+  let pending = null;
+  const read = async () => {
+    let context = [];
+    const notes = [];
+    try {
+      const server = await facts();
+      if (server !== null) context = ["--context", server.config.dockerContext];
+    } catch (error) {
+      notes.push(`server config: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const version = await deps.run("docker", [...context, "version"], DOCKER_TIMEOUT_MS);
+    if (version.error !== void 0 || version.status !== 0)
+      throw failedOutput(version, "docker version failed");
+    const info = await deps.run("docker", [...context, "info"], DOCKER_TIMEOUT_MS);
+    const contexts = await deps.run("docker", ["context", "ls"], DOCKER_TIMEOUT_MS);
+    const byId = /* @__PURE__ */ new Map();
+    for (const filter of CONTAINER_FILTERS) {
+      const listed = await deps.run(
+        "docker",
+        [...context, "ps", "--all", "--no-trunc", "--format", "{{json .}}", ...filter],
+        DOCKER_TIMEOUT_MS
+      );
+      if (listed.error !== void 0 || listed.status !== 0) {
+        notes.push(`docker ps ${filter.join(" ")}: ${outputOrFailure(listed)}`);
+        continue;
+      }
+      for (const row of parseContainerRows(listed.stdout)) byId.set(row.id, row);
     }
-    const who = identityOf(account);
-    checks.push(
-      account.status === "active" ? {
-        label: provider,
-        state: "ok",
-        detail: who === null ? "connected" : `connected \xB7 ${who}`,
-        fix: null
-      } : {
-        label: provider,
-        state: "todo",
-        detail: account.status,
-        fix: `mend connect ${provider}`
+    return {
+      context,
+      version: outputOrFailure(version),
+      info: outputOrFailure(info),
+      contexts: outputOrFailure(contexts),
+      containers: [...byId.values()].toSorted((a, b) => a.name.localeCompare(b.name)),
+      notes
+    };
+  };
+  return () => {
+    pending ??= read();
+    return pending;
+  };
+};
+var summarizeInspect = (container) => {
+  const config = field(container, "Config");
+  const hostConfig = field(container, "HostConfig");
+  const state = field(container, "State");
+  const mounts = field(container, "Mounts");
+  return {
+    id: stringField(container, "Id"),
+    name: stringField(container, "Name"),
+    created: stringField(container, "Created"),
+    image: stringField(config, "Image"),
+    imageId: stringField(container, "Image"),
+    state: isRecord(state) ? {
+      status: state["Status"],
+      exitCode: state["ExitCode"],
+      oomKilled: state["OOMKilled"],
+      startedAt: state["StartedAt"],
+      finishedAt: state["FinishedAt"],
+      error: state["Error"]
+    } : null,
+    privileged: field(hostConfig, "Privileged"),
+    runtime: field(hostConfig, "Runtime"),
+    networkMode: field(hostConfig, "NetworkMode"),
+    restartPolicy: field(hostConfig, "RestartPolicy"),
+    portBindings: field(hostConfig, "PortBindings"),
+    mounts: Array.isArray(mounts) ? mounts.map((mount) => ({
+      type: field(mount, "Type"),
+      source: field(mount, "Source"),
+      destination: field(mount, "Destination"),
+      mode: field(mount, "Mode"),
+      rw: field(mount, "RW")
+    })) : null,
+    envNames: stringList(field(config, "Env")).map((entry) => entry.split("=")[0] ?? entry),
+    labels: field(config, "Labels")
+  };
+};
+var dockerCollector = (deps, docker2) => ({
+  name: "docker",
+  collect: async () => {
+    const found = await docker2();
+    const sections = [
+      `# docker version${found.context.length === 0 ? "" : ` (${found.context.join(" ")})`}`,
+      found.version,
+      "",
+      "# docker info",
+      found.info,
+      "",
+      "# docker context ls",
+      found.contexts,
+      "",
+      "# docker ps -a (Compose project mend \xB7 names sealant-* \xB7 label sealant.workspace)",
+      found.containers.length === 0 ? "none" : found.containers.map((row) => `${row.id.slice(0, 12)}  ${row.name}  ${row.image}  ${row.status}`).join("\n")
+    ];
+    if (found.notes.length > 0) sections.push("", "# notes", ...found.notes);
+    if (found.containers.length > 0) {
+      const inspected = await deps.run(
+        "docker",
+        [...found.context, "inspect", ...found.containers.map((row) => row.id)],
+        DOCKER_TIMEOUT_MS
+      );
+      sections.push("", "# docker inspect (Env as names only)");
+      if (inspected.error !== void 0 || inspected.status !== 0) {
+        sections.push(outputOrFailure(inspected));
+      } else {
+        let parsed = null;
+        try {
+          parsed = JSON.parse(inspected.stdout);
+        } catch {
+          sections.push("docker inspect returned invalid JSON");
+        }
+        if (Array.isArray(parsed)) sections.push(json(parsed.map(summarizeInspect)).trimEnd());
       }
-    );
-  }
-  const grant = probes.claudeGrant();
-  if (grant !== null) {
-    const facts = claudeGrantFacts(grant);
-    if (facts === null) {
-      checks.push({
-        label: "grant",
-        state: "failed",
-        detail: "unreadable",
-        fix: "mend connect claude"
-      });
-    } else if (!facts.hasRefreshToken) {
-      checks.push({
-        label: "grant",
-        state: "failed",
-        detail: "signed out",
-        fix: "mend connect claude"
-      });
-    } else if (facts.refreshExpiresAt !== null && facts.refreshExpiresAt.getTime() <= Date.now()) {
-      checks.push({
-        label: "grant",
-        state: "todo",
-        detail: `expired ${day(facts.refreshExpiresAt)}`,
-        fix: "mend connect claude"
-      });
-    } else {
-      checks.push({
-        label: "grant",
-        state: "ok",
-        detail: facts.refreshExpiresAt === null ? "Mend's own" : `Mend's own \xB7 expires ${day(facts.refreshExpiresAt)}`,
-        fix: null
-      });
     }
+    return [{ path: "docker.txt", content: `${sections.join("\n")}
+` }];
   }
-  const adopted = projects === null ? null : projects.value;
-  if (adopted === null) checks.push(notChecked("projects"));
-  else if (adopted.length === 0) {
-    checks.push({ label: "projects", state: "todo", detail: "none adopted", fix: "mend adopt" });
-  } else {
-    checks.push({ label: "projects", state: "ok", detail: `${adopted.length} adopted`, fix: null });
-  }
-  for (const { command, provider } of HARNESS_CLIS) {
-    const label = `${command} cli`;
-    if (!probes.onPath(command)) {
-      checks.push({ label, state: "todo", detail: "not on PATH", fix: null });
-      continue;
+});
+var isWorkspaceContainer = (row) => row.name.startsWith("sealant-") || row.labels.includes("sealant.workspace=");
+var workspaceLogsCollector = (deps, docker2) => ({
+  name: "workspace-logs",
+  collect: async () => {
+    const found = await docker2();
+    const running = found.containers.filter(
+      (row) => isWorkspaceContainer(row) && row.state === "running"
+    );
+    if (running.length === 0) {
+      return [
+        {
+          path: "workspace-logs.txt",
+          content: "no running workspace container observed (names sealant-* or label sealant.workspace)\n"
+        }
+      ];
     }
-    const credential = probes.localCredential(provider);
-    checks.push(
-      credential === null ? {
-        label,
-        state: "todo",
-        detail: "on PATH \xB7 no credential here",
-        fix: LOGIN_COMMANDS[provider]
-      } : { label, state: "ok", detail: "on PATH \xB7 credential present", fix: null }
-    );
+    const files = [];
+    for (const row of running) {
+      const logs = await deps.run(
+        "docker",
+        [...found.context, "logs", "--tail", String(deps.tail), row.id],
+        DOCKER_TIMEOUT_MS
+      );
+      const text = logs.error !== void 0 || logs.status !== 0 ? outputOrFailure(logs) : `${logs.stdout.trimEnd()}${logs.stderr.trim() === "" ? "" : `
+--- stderr ---
+${logs.stderr.trimEnd()}`}`;
+      files.push({ path: `workspace-logs/${row.name}.log`, content: `${text}
+` });
+    }
+    return files;
   }
-  const machine = signedIn ? await getJson(config, "/machine") : null;
-  const exposure = machine === null || machine.value === null ? void 0 : machine.value.exposure;
-  checks.push(exposure === void 0 ? notChecked("exposure") : exposureCheck(exposure));
-  return checks;
-};
-var onPath = (command) => {
-  for (const directory of (process.env["PATH"] ?? "").split(path2.delimiter)) {
-    if (directory === "") continue;
-    try {
-      fs2.accessSync(path2.join(directory, command), fs2.constants.X_OK);
-      return true;
-    } catch {
+});
+var RECORD_PAGE_LIMIT = 1e3;
+var RECORD_MAX_PAGES = 200;
+var RECORD_TIME_BUDGET_MS = 3e4;
+var SESSION_CONCURRENCY = 4;
+var readRecordTail = async (deps, processId) => {
+  let cursor = "0";
+  let text = "";
+  let chunks = 0;
+  let pages = 0;
+  let status = null;
+  const deadline = Date.now() + RECORD_TIME_BUDGET_MS;
+  try {
+    for (; ; ) {
+      const page = await deps.get(
+        `/processes/${processId}/logs?from=${encodeURIComponent(cursor)}&limit=${RECORD_PAGE_LIMIT}`
+      );
+      pages += 1;
+      status = page.status;
+      for (const chunk of page.chunks)
+        text += Buffer.from(chunk.dataBase64, "base64").toString("utf8");
+      chunks += page.chunks.length;
+      text = lastLines(text, deps.tail + 1);
+      const advanced = page.nextFrom !== cursor;
+      cursor = page.nextFrom;
+      if (!advanced) return { text, chunks, pages, complete: true, status, failure: null };
+      if (pages >= RECORD_MAX_PAGES || Date.now() > deadline)
+        return { text, chunks, pages, complete: false, status, failure: null };
     }
+  } catch (error) {
+    return {
+      text,
+      chunks,
+      pages,
+      complete: false,
+      status,
+      failure: error instanceof Error ? error.message : String(error)
+    };
   }
-  return false;
 };
-var paintMark = (state, mark) => {
-  if (process.stdout.isTTY !== true) return mark;
-  const code = state === "ok" ? "32" : state === "todo" ? "33" : "31";
-  return `\x1B[${code}m${mark}\x1B[0m`;
+var processLine = (row) => [
+  row.id,
+  row.kind,
+  row.label ?? row.harness ?? "",
+  row.status,
+  row.exitCode === null ? "" : `exit ${row.exitCode}`,
+  row.argv.length === 0 ? "" : `argv: ${row.argv.join(" ")}`
+].filter((part) => part !== "").join(" \xB7 ");
+var recordFile = async (deps, detail) => {
+  const recorded = detail.processes.filter((row) => row.sealantSessionId !== null);
+  if (recorded.length === 0) return null;
+  const sections = [
+    `# session ${detail.session.id} \xB7 ${recorded.length} recorded process(es) \xB7 last ${deps.tail} lines of each, raw PTY output as UTF-8`
+  ];
+  for (const row of recorded) {
+    const tail = await readRecordTail(deps, row.id);
+    const facts = [
+      `${tail.chunks} chunks in ${tail.pages} page(s)`,
+      tail.status === null ? null : `record ${tail.status}`,
+      tail.complete ? null : `the read stopped at the page budget (${RECORD_MAX_PAGES} pages / ${RECORD_TIME_BUDGET_MS / 1e3} s) before the record ended, so these are the last lines READ, not the last lines recorded`,
+      tail.failure === null ? null : `read failed: ${tail.failure}`
+    ].filter((fact) => fact !== null);
+    sections.push("", `== ${processLine(row)}`, `(${facts.join(" \xB7 ")})`, tail.text.trimEnd());
+  }
+  return `${sections.join("\n")}
+`;
 };
-var doctorCommand = async (config, localCredential2, claudeGrant2) => {
-  const checks = await runChecks(config, { localCredential: localCredential2, claudeGrant: claudeGrant2, onPath });
-  for (const check of checks) process.stdout.write(`${formatCheck(check, paintMark)}
-`);
-  if (checks.some((check) => check.state === "failed")) process.exitCode = 1;
+var sessionsCollector = (deps) => ({
+  name: "sessions",
+  collect: async () => {
+    const projects = await deps.get("/projects");
+    const details = await mapLimit(
+      projects,
+      SESSION_CONCURRENCY,
+      (project2) => deps.get(`/projects/${project2.id}?deadEnds=include`)
+    );
+    const rows = details.flatMap(
+      (detail) => detail.sessions.map((session) => ({ session, projectName: detail.project.name }))
+    ).toSorted((a, b) => b.session.createdAt.localeCompare(a.session.createdAt));
+    const collected = await mapLimit(
+      rows,
+      SESSION_CONCURRENCY,
+      async ({ session, projectName }) => {
+        const files2 = [];
+        let detail;
+        try {
+          detail = await deps.get(`/sessions/${session.id}`);
+        } catch (error) {
+          files2.push({
+            path: `sessions/${session.id}.error.txt`,
+            content: `${error instanceof Error ? error.message : String(error)}
+`
+          });
+          return {
+            files: files2,
+            summary: {
+              id: session.id,
+              project: projectName,
+              harness: session.harness,
+              label: session.label,
+              status: session.status,
+              createdAt: session.createdAt,
+              updatedAt: session.updatedAt ?? null,
+              detail: `sessions/${session.id}.error.txt`
+            }
+          };
+        }
+        files2.push({ path: `sessions/${session.id}.json`, content: json(detail) });
+        const record = await recordFile(deps, detail);
+        if (record !== null)
+          files2.push({ path: `sessions/${session.id}-record.txt`, content: record });
+        const services = new Set(
+          detail.processes.flatMap((row) => row.serviceId === null ? [] : [row.serviceId])
+        );
+        return {
+          files: files2,
+          summary: {
+            id: session.id,
+            project: projectName,
+            harness: session.harness,
+            label: session.label,
+            status: session.status,
+            worktree: session.worktree,
+            branch: session.branch,
+            createdAt: session.createdAt,
+            updatedAt: session.updatedAt ?? null,
+            processes: detail.processes.map((row) => ({
+              id: row.id,
+              kind: row.kind,
+              label: row.label,
+              harness: row.harness,
+              status: row.status,
+              exitCode: row.exitCode,
+              argv: row.argv,
+              createdAt: row.createdAt,
+              exitedAt: row.exitedAt,
+              recorded: row.sealantSessionId !== null
+            })),
+            services: services.size,
+            liveServices: detail.liveServices ?? null,
+            detail: `sessions/${session.id}.json`,
+            record: record === null ? null : `sessions/${session.id}-record.txt`
+          }
+        };
+      }
+    );
+    const summaries = collected.map((item) => item.summary);
+    const files = collected.flatMap((item) => item.files);
+    files.unshift({
+      path: "sessions.json",
+      content: json({
+        projects: projects.length,
+        sessions: rows.length,
+        recordTailLines: deps.tail,
+        rows: summaries
+      })
+    });
+    return files;
+  }
+});
+var accountsCollector = (deps) => ({
+  name: "accounts",
+  collect: async () => [{ path: "accounts.txt", content: await deps.accounts() }]
+});
+var TOOLS = ["claude", "codex", "gh", "git", "docker"];
+var TOOL_TIMEOUT_MS = 15e3;
+var toolsCollector = (deps) => ({
+  name: "tools",
+  collect: async () => {
+    const lines = [];
+    for (const tool of TOOLS) {
+      const found = deps.pathOf(tool);
+      if (found === null) {
+        lines.push(`${tool.padEnd(8)} not on PATH`);
+        continue;
+      }
+      const output = await deps.run(tool, ["--version"], TOOL_TIMEOUT_MS);
+      const version = output.error !== void 0 || output.status !== 0 ? `--version ${outputOrFailure(output).split("\n")[0] ?? ""}` : output.stdout.trim().split("\n")[0] ?? "";
+      lines.push(`${tool.padEnd(8)} ${found} \xB7 ${version}`);
+    }
+    return [{ path: "tools.txt", content: `${lines.join("\n")}
+` }];
+  }
+});
+var bundleCollectors = (deps) => {
+  const server = serverFactsOnce(deps);
+  const docker2 = dockerFactsOnce(deps, server);
+  return [
+    cliCollector(deps),
+    doctorCollector(deps),
+    serverHealthCollector(deps),
+    serverConfigCollector(server),
+    dockerCollector(deps, docker2),
+    serverLogsCollector(deps, server),
+    workspaceLogsCollector(deps, docker2),
+    sessionsCollector(deps),
+    accountsCollector(deps),
+    toolsCollector(deps)
+  ];
 };
 
-// src/dotfiles.ts
-import * as fs3 from "node:fs";
-import * as path3 from "node:path";
-var DOTFILE_CANDIDATES = [
-  {
-    group: "shell",
-    paths: [
-      ".zshrc",
-      ".zshenv",
-      ".zprofile",
-      ".bashrc",
-      ".bash_profile",
-      ".profile",
-      ".aliases",
-      ".config/fish/config.fish",
-      ".config/starship.toml"
-    ]
-  },
-  {
-    group: "git",
-    paths: [".gitconfig", ".gitignore_global", ".config/git/config", ".config/git/ignore"]
-  },
+// src/doctor-bundle.ts
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
+import { gzipSync } from "node:zlib";
+
+// src/help.ts
+var SECTIONS = [
+  "start",
+  "sessions",
+  "services",
+  "project setup",
+  "organization",
+  "this machine"
+];
+var project = (what = "the project") => ({
+  flag: "--project <p>",
+  text: `${what} by name, when the current directory is not inside it`
+});
+var sessionArg = "With no id, the one live session is taken; with several, a picker opens. A prefix of the id is enough.";
+var tunnelText = "On a server that is not this machine, the session's live Services declared --http or --https are tunneled to this machine's loopback while this terminal is attached, on the Service's own port when it is free and on a free one when it is not. One line per tunnel says where it opens, for example web \u2192 http://localhost:5173. A Service that stops closes its tunnel, and detaching closes them all. The Services keep running.";
+var noTunnel = {
+  flag: "--no-tunnel",
+  text: "do not tunnel the session's Services to this machine"
+};
+var COMMANDS = [
+  // ── start ──────────────────────────────────────────────────────────────
   {
-    group: "editors",
-    paths: [".vimrc", ".ideavimrc", ".editorconfig", ".config/helix/config.toml"]
-  },
-  {
-    group: "terminal",
-    paths: [".tmux.conf", ".config/tmux/tmux.conf", ".inputrc", ".dir_colors"]
-  },
-  {
-    group: "tools",
-    paths: [
-      ".ripgreprc",
-      ".config/bat/config",
-      ".config/lazygit/config.yml",
-      ".config/mise/config.toml",
-      ".config/atuin/config.toml",
-      ".config/zellij/config.kdl"
-    ]
-  }
-];
-var MAX_FILE_BYTES = 1024 * 1024;
-var statFile = (home, relative4) => {
-  try {
-    const stat = fs3.statSync(path3.join(home, relative4));
-    return stat.isFile() ? stat : null;
-  } catch {
-    return null;
-  }
-};
-var scanDotfileCandidates = (home) => DOTFILE_CANDIDATES.flatMap(
-  ({ group, paths }) => paths.flatMap((relative4) => {
-    const stat = statFile(home, relative4);
-    return stat === null ? [] : [{ path: relative4, group, bytes: stat.size }];
-  })
-);
-var homeRelativePath = (home, requested) => {
-  const relative4 = path3.relative(home, path3.resolve(home, requested));
-  const outside = relative4 === "" || relative4 === ".." || relative4.startsWith(`..${path3.sep}`) || path3.isAbsolute(relative4);
-  return outside ? null : relative4.split(path3.sep).join("/");
-};
-var readSyncFiles = (home, paths_) => {
-  const files = [];
-  for (const requested of paths_) {
-    const relative4 = homeRelativePath(home, requested);
-    if (relative4 === null) {
-      return {
-        error: `${requested} is not under ${home} \u2014 only files in your home directory sync`
-      };
-    }
-    const stat = statFile(home, relative4);
-    if (stat === null) {
-      return { error: `${relative4} is not a file under ${home}` };
-    }
-    if (stat.size > MAX_FILE_BYTES) {
-      return { error: `${relative4} is over 1MB \u2014 dotfiles are text; trim the selection` };
-    }
-    files.push({
-      path: relative4,
-      contentsBase64: fs3.readFileSync(path3.join(home, relative4)).toString("base64"),
-      // eslint-disable-next-line no-bitwise -- permission bits are the point
-      mode: (stat.mode & 511).toString(8)
-    });
-  }
-  return { files };
-};
-var DOTFILES_MANAGERS = ["auto", "copy", "stow", "chezmoi"];
-var VALUE_FLAGS = ["--ref", "--subdirectory", "--manager"];
-var parseDotfilesRepoArgs = (args) => {
-  if (args.includes("--clear")) {
-    return args.length === 1 ? { kind: "clear" } : { kind: "error", error: "--clear takes no URL or other options" };
-  }
-  let url = null;
-  const values = /* @__PURE__ */ new Map();
-  let bootstrap = true;
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
-    if (arg === "--no-bootstrap") {
-      bootstrap = false;
-      continue;
-    }
-    const flag = VALUE_FLAGS.find((candidate) => candidate === arg);
-    if (flag !== void 0) {
-      const value = args[index + 1];
-      if (value === void 0 || value.trim() === "" || value.startsWith("--")) {
-        return { kind: "error", error: `${flag} needs a value` };
-      }
-      values.set(flag, value.trim());
-      index += 1;
-      continue;
-    }
-    if (arg.startsWith("-")) return { kind: "error", error: `unknown flag ${arg}` };
-    if (url !== null) return { kind: "error", error: "one repository URL only" };
-    url = arg.trim();
-  }
-  if (url === null || url === "") {
-    return { kind: "error", error: "name the repository URL, or --clear to remove it" };
-  }
-  const requested = values.get("--manager") ?? "auto";
-  const manager = DOTFILES_MANAGERS.find((candidate) => candidate === requested);
-  if (manager === void 0) {
-    return { kind: "error", error: `--manager must be one of ${DOTFILES_MANAGERS.join(", ")}` };
-  }
-  return {
-    kind: "set",
-    repository: {
-      url,
-      ref: values.get("--ref") ?? null,
-      subdirectory: values.get("--subdirectory") ?? null,
-      manager,
-      bootstrap
-    }
-  };
-};
-var dotfilesRepositoryFacts = (repository) => [
-  repository.ref ?? "default branch",
-  ...repository.subdirectory === null ? [] : [`${repository.subdirectory}/`],
-  `manager ${repository.manager}`,
-  repository.bootstrap ? "install.sh on" : "install.sh off"
-].join(" \xB7 ");
-
-// src/env.ts
-var formatLoadReport = (report, paint6) => {
-  const width = Math.max(
-    0,
-    ...report.loaded.map((entry) => entry.name.length),
-    ...report.rejected.map((entry) => entry.name.length)
-  );
-  const lines = [];
-  for (const entry of report.loaded) {
-    lines.push(
-      `  ${entry.name.padEnd(width)}  ${entry.lane === "secret" ? "secret" : "configuration"} ${paint6.dim(`\xB7 ${entry.action}${entry.lane === "configuration" ? " \xB7 plaintext" : ""}`)}`
-    );
-  }
-  for (const entry of report.rejected) {
-    lines.push(
-      `  ${entry.name.padEnd(width)}  ${paint6.warn("rejected")} ${paint6.dim(`\xB7 ${entry.reason}`)}`
-    );
-  }
-  return lines;
-};
-
-// src/git-author.ts
-var parseGitAuthorArgs = (args) => {
-  const clear = args.includes("--clear");
-  const words = args.filter((arg) => !arg.startsWith("--"));
-  if (clear) return words.length === 0 ? { kind: "clear" } : { kind: "usage" };
-  if (words.length === 0) return { kind: "show" };
-  const [name, email] = words;
-  if (words.length !== 2 || name === void 0 || email === void 0) return { kind: "usage" };
-  const issue = gitAuthorIssue({ name, email });
-  if (issue !== null) return { kind: "invalid", message: `git author not saved \xB7 ${issue}` };
-  const author = normalizeGitAuthor({ name, email });
-  return { kind: "set", name: author.name, email: author.email };
-};
-var gitAuthorLine = (author) => `${author.name} <${author.email}> \xB7 ${author.source === "setting" ? "your setting" : "your account's name and email"}`;
-
-// src/help.ts
-var SECTIONS = [
-  "start",
-  "sessions",
-  "services",
-  "project setup",
-  "organization",
-  "this machine"
-];
-var project = (what = "the project") => ({
-  flag: "--project <p>",
-  text: `${what} by name, when the current directory is not inside it`
-});
-var sessionArg = "With no id, the one live session is taken; with several, a picker opens. A prefix of the id is enough.";
-var tunnelText = "On a server that is not this machine, the session's live Services declared --http or --https are tunneled to this machine's loopback while this terminal is attached, on the Service's own port when it is free and on a free one when it is not. One line per tunnel says where it opens, for example web \u2192 http://localhost:5173. A Service that stops closes its tunnel, and detaching closes them all. The Services keep running.";
-var noTunnel = {
-  flag: "--no-tunnel",
-  text: "do not tunnel the session's Services to this machine"
-};
-var COMMANDS = [
-  // ── start ──────────────────────────────────────────────────────────────
-  {
-    name: "login",
-    section: "start",
-    summary: "sign this terminal in through the browser",
-    synopsis: ["[--url <server>]"],
-    description: [
-      "Opens <server>/authorize in your browser. You press Authorize there. The CLI saves a device token to ~/.config/mend/cli.json with mode 0600. No password is typed in the terminal, and the token can be revoked from the server at any time."
-    ],
-    options: [
-      {
-        flag: "--url <server>",
-        text: "the Mend server. Default: MEND_URL, then http://localhost:3105"
-      }
-    ],
-    examples: [
-      { command: "mend login --url http://10.0.0.216:3105", text: "sign in to a LAN server" }
-    ],
-    see: ["logout", "pair", "doctor"]
+    name: "login",
+    section: "start",
+    summary: "sign this terminal in through the browser",
+    synopsis: ["[--url <server>]"],
+    description: [
+      "Opens <server>/authorize in your browser. You press Authorize there. The CLI saves a device token to ~/.config/mend/cli.json with mode 0600. No password is typed in the terminal, and the token can be revoked from the server at any time."
+    ],
+    options: [
+      {
+        flag: "--url <server>",
+        text: "the Mend server. Default: MEND_URL, then http://localhost:3105"
+      }
+    ],
+    examples: [
+      { command: "mend login --url http://10.0.0.216:3105", text: "sign in to a LAN server" }
+    ],
+    see: ["logout", "pair", "doctor"]
   },
   {
     name: "connect",
@@ -865,12 +1136,29 @@ var COMMANDS = [
   {
     name: "doctor",
     section: "start",
-    summary: "check this machine's setup",
-    synopsis: [],
+    summary: "check this machine's setup, or bundle it for a bug report",
+    synopsis: ["", "--bundle [--out <path>] [--tail <n>]"],
     description: [
-      "Read-only. One line per fact: the server, the sign-in, the platform connection, the provider accounts, the git key. Each unfinished line ends with the command that fixes it."
+      "Read-only. One line per fact: the server, the sign-in, the platform connection, the provider accounts, the git key. Each unfinished line ends with the command that fixes it.",
+      "--bundle collects what a maintainer asks for one output at a time into one tar.gz: this CLI and its environment, the doctor lines, the server's health, the local server's configuration (its compose file and the names of its .env keys, never their values), docker version, info, contexts, the Mend and workspace containers with their inspect facts, the local server's container logs, the running workspace containers' logs, every session with its processes, exit codes and argv, the recorded terminal output of each, the connected accounts, and the versions and paths of claude, codex, gh, git and docker on this machine.",
+      "Each part is collected on its own: one that fails leaves a <name>.error.txt in the bundle instead of stopping it. One redactor runs over every file before it is written: bearer and header values, Slack, OpenAI, GitHub and AWS token shapes, JWTs, passwords in URLs, and any password, secret or token value. The archive is written with mode 0600. It still contains logs and configuration; read it before you share it."
+    ],
+    options: [
+      { flag: "--bundle", text: "write the diagnostic archive instead of printing the checklist" },
+      {
+        flag: "--out <path>",
+        text: "where the archive goes. Default: ~/.config/mend/bundles/mend-bundle-<time>.tgz"
+      },
+      {
+        flag: "--tail <n>",
+        text: "lines per container log and per recorded process, 1..2000. Default: 500"
+      }
+    ],
+    examples: [
+      { command: "mend doctor", text: "the checklist" },
+      { command: "mend doctor --bundle", text: "one archive to attach to a bug report" }
     ],
-    see: ["login", "connect", "keys init"]
+    see: ["login", "connect", "keys init", "server logs"]
   },
   // ── sessions ───────────────────────────────────────────────────────────
   {
@@ -2036,16 +2324,611 @@ var renderManIndex = (version) => {
       COMMANDS.filter((d) => !d.hidden).map((d) => `mend-${d.name.replace(/ /g, "-")}(1)`).join(", ")
     )
   );
-  return `${out.join("\n")}
-`;
+  return `${out.join("\n")}
+`;
+};
+var manFileName = (doc) => doc === null ? "mend.1" : `mend-${doc.name.replace(/ /g, "-")}.1`;
+
+// src/doctor-bundle.ts
+var REDACTED = "[redacted]";
+var KEY_WORDS = "password|passwd|secret|token|api[_-]?key|private[_-]?key|credential";
+var blank = () => REDACTED;
+var RULES = [
+  [
+    /\b(authorization|proxy-authorization|x-api-key|cookie|set-cookie)(\s*[:=]\s*)[^\r\n]+/gi,
+    (_match, header, separator) => `${header}${separator}${REDACTED}`
+  ],
+  [/\bBearer\s+[A-Za-z0-9._~+/=-]+/g, () => `Bearer ${REDACTED}`],
+  [/\b(?:xox[abops]|xapp)-[A-Za-z0-9-]+/g, blank],
+  [/\bsk-[A-Za-z0-9_-]{8,}/g, blank],
+  [/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{6,}/g, blank],
+  [/\bgithub_pat_[A-Za-z0-9_]{6,}/g, blank],
+  [/\beyJ[A-Za-z0-9_-]{8,}(?:\.[A-Za-z0-9_-]+)*/g, blank],
+  [/\bAKIA[0-9A-Z]{16}\b/g, blank],
+  [
+    /\b([a-z][a-z0-9+.-]*:\/\/[^:/\s@]+):[^@\s/]+@/gi,
+    (_match, prefix) => `${prefix}:${REDACTED}@`
+  ],
+  [
+    new RegExp(
+      `\\b([A-Za-z0-9_.-]*(?:${KEY_WORDS})[A-Za-z0-9_.-]*)("?\\s*[=:]\\s*"?)([^"\\s,;&]+)`,
+      "gi"
+    ),
+    (_match, key, separator, value) => /^(?:true|false|null)$/i.test(value) ? `${key}${separator}${value}` : `${key}${separator}${REDACTED}`
+  ],
+  [/^(\s*(?:export\s+)?[A-Z][A-Z0-9_]*=)(.+)$/gm, (_match, key) => `${key}${REDACTED}`]
+];
+var redact = (text) => {
+  let out = text;
+  for (const [pattern, replacer] of RULES) out = out.replace(pattern, replacer);
+  return out;
+};
+var octal = (value, width) => `${value.toString(8).padStart(width - 1, "0")}\0`;
+var splitName = (name) => {
+  if (Buffer.byteLength(name) <= 100) return { name, prefix: "" };
+  let cut = name.lastIndexOf("/");
+  while (cut > 0 && Buffer.byteLength(name.slice(cut + 1)) > 100)
+    cut = name.lastIndexOf("/", cut - 1);
+  if (cut <= 0 || Buffer.byteLength(name.slice(0, cut)) > 155)
+    throw new Error(`tar entry name too long: ${name}`);
+  return { name: name.slice(cut + 1), prefix: name.slice(0, cut) };
+};
+var tarHeader = (entry, mtime) => {
+  const header = Buffer.alloc(512, 0);
+  const { name, prefix } = splitName(entry.path);
+  header.write(name, 0, 100, "utf8");
+  header.write(octal(420, 8), 100, 8, "ascii");
+  header.write(octal(0, 8), 108, 8, "ascii");
+  header.write(octal(0, 8), 116, 8, "ascii");
+  header.write(octal(entry.content.length, 12), 124, 12, "ascii");
+  header.write(octal(mtime, 12), 136, 12, "ascii");
+  header.write("        ", 148, 8, "ascii");
+  header.write("0", 156, 1, "ascii");
+  header.write("ustar\0", 257, 6, "ascii");
+  header.write("00", 263, 2, "ascii");
+  header.write("mend", 265, 32, "ascii");
+  header.write("mend", 297, 32, "ascii");
+  header.write(octal(0, 8), 329, 8, "ascii");
+  header.write(octal(0, 8), 337, 8, "ascii");
+  header.write(prefix, 345, 155, "utf8");
+  let sum = 0;
+  for (const byte of header) sum += byte;
+  header.write(`${sum.toString(8).padStart(6, "0")}\0 `, 148, 8, "ascii");
+  return header;
+};
+var tarGz = (entries, now) => {
+  const mtime = Math.floor(now.getTime() / 1e3);
+  const blocks = [];
+  for (const entry of entries) {
+    blocks.push(tarHeader(entry, mtime), entry.content);
+    const remainder = entry.content.length % 512;
+    if (remainder !== 0) blocks.push(Buffer.alloc(512 - remainder, 0));
+  }
+  blocks.push(Buffer.alloc(1024, 0));
+  return gzipSync(Buffer.concat(blocks));
+};
+var describeError = (error) => `${error instanceof Error ? error.message : String(error)}
+`;
+var collectBundle = async (collectors) => {
+  const files = [];
+  for (const collector of collectors) {
+    try {
+      for (const file of await collector.collect()) {
+        files.push({ path: file.path, content: redact(file.content) });
+      }
+    } catch (error) {
+      files.push({ path: `${collector.name}.error.txt`, content: redact(describeError(error)) });
+    }
+  }
+  return files;
+};
+var bundleFileName = (now) => `mend-bundle-${now.toISOString().replace(/\.\d{3}Z$/, "Z").replace(/:/g, "-")}.tgz`;
+var writeBundle = (files, outPath, now) => {
+  const directory = path4.dirname(outPath);
+  fs4.mkdirSync(directory, { recursive: true, mode: 448 });
+  const root = path4.basename(outPath).replace(/\.(?:tgz|tar\.gz)$/, "");
+  const entries = files.map((file) => ({
+    path: file.path,
+    content: Buffer.from(file.content, "utf8")
+  }));
+  const bytes = tarGz(
+    entries.map((entry) => ({ path: `${root}/${entry.path}`, content: entry.content })),
+    now
+  );
+  fs4.writeFileSync(outPath, bytes, { mode: 384 });
+  fs4.chmodSync(outPath, 384);
+  return {
+    path: outPath,
+    bytes: bytes.length,
+    entries: entries.map((entry) => ({ path: entry.path, bytes: entry.content.length }))
+  };
+};
+var formatBytes = (bytes) => {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} kB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+};
+var NOTICE = "Contains logs and configuration; secrets are redacted, but read it before sharing.";
+var bundleReport = (written) => {
+  const width = Math.max(...written.entries.map((entry) => entry.path.length), 0);
+  return [
+    `${written.path} \xB7 ${formatBytes(written.bytes)}`,
+    ...written.entries.map((entry) => `  ${entry.path.padEnd(width)}  ${formatBytes(entry.bytes)}`),
+    NOTICE
+  ];
+};
+var DEFAULT_TAIL = 500;
+var MAX_TAIL = 2e3;
+var usage = (message) => ({
+  kind: "usage",
+  message: `${message}
+${usageOf("doctor")}`
+});
+var parseBundleArgs = (args) => {
+  let out = null;
+  let tail = DEFAULT_TAIL;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--bundle") continue;
+    if (arg === "--out") {
+      const value = args[index + 1];
+      if (value === void 0 || value.startsWith("--")) return usage("--out needs a path");
+      out = value;
+      index += 1;
+      continue;
+    }
+    if (arg === "--tail") {
+      const value = args[index + 1];
+      if (value === void 0 || !/^\d+$/.test(value)) return usage("--tail needs a number");
+      tail = Number(value);
+      if (tail < 1 || tail > MAX_TAIL) return usage(`--tail is 1..${MAX_TAIL}`);
+      index += 1;
+      continue;
+    }
+    return usage(`unknown option "${arg ?? ""}"`);
+  }
+  return { kind: "ok", args: { out, tail } };
+};
+var doctorBundleCommand = async (args, deps) => {
+  const parsed = parseBundleArgs(args);
+  if (parsed.kind === "usage") {
+    deps.warn(`mend: ${parsed.message}`);
+    process.exitCode = 1;
+    return;
+  }
+  const now = deps.now();
+  const outPath = path4.resolve(parsed.args.out ?? path4.join(deps.defaultDir, bundleFileName(now)));
+  deps.warn("collecting \xB7 this can take a minute");
+  const files = await collectBundle(deps.collectors(parsed.args.tail));
+  const written = writeBundle(files, outPath, now);
+  for (const line of bundleReport(written)) deps.say(line);
+};
+
+// src/doctor.ts
+import * as fs5 from "node:fs";
+import * as path5 from "node:path";
+var TIMEOUT_MS = 3e3;
+var MARKS = { ok: "\u2713", todo: "\u25CB", failed: "\u2717" };
+var LABEL_WIDTH = 11;
+var day = (at) => at.toISOString().slice(0, 10);
+var formatCheck = (check, paint6 = (_state, mark) => mark) => `${paint6(check.state, MARKS[check.state])} ${check.label.padEnd(LABEL_WIDTH)} ${check.detail}${check.fix === null ? "" : ` \u2192 ${check.fix}`}`;
+var getJson = async (config, route) => {
+  try {
+    const response = await fetch(`${config.url}/api${route}`, {
+      headers: config.token === null ? {} : { authorization: `Bearer ${config.token}` },
+      signal: AbortSignal.timeout(TIMEOUT_MS)
+    });
+    if (!response.ok) return { value: null, status: response.status };
+    return { value: await response.json(), status: response.status };
+  } catch {
+    return { value: null, status: null };
+  }
+};
+var exposureCheck = (exposure) => {
+  const beyondMachine = exposure.declared !== "loopback" && exposure.originOnMachine !== true;
+  const gateOpen = beyondMachine ? exposure.gateOpen : 0;
+  const facts = [
+    `declared ${exposure.declared}`,
+    `${exposure.originScheme} origin`,
+    ...exposure.arrivedVia === "trusted-proxy" ? ["arrived via a trusted proxy"] : [],
+    ...gateOpen === 0 ? [] : [`${gateOpen} gate items open`]
+  ].join(" \xB7 ");
+  const plainBeyondMachine = beyondMachine && exposure.originScheme === "http";
+  return {
+    label: "exposure",
+    state: plainBeyondMachine ? "todo" : "ok",
+    detail: facts,
+    fix: plainBeyondMachine ? "serve it over https and set APP_URL to that origin" : gateOpen === 0 ? null : "mend operator exposure"
+  };
+};
+var LOGIN_COMMANDS = {
+  claude: "claude setup-token",
+  codex: "codex login",
+  github: "gh auth login"
+};
+var HARNESS_CLIS = [
+  { command: "claude", provider: "claude" },
+  { command: "codex", provider: "codex" },
+  { command: "gh", provider: "github" }
+];
+var notChecked = (label) => ({
+  label,
+  state: "todo",
+  detail: "not checked",
+  fix: null
+});
+var identityOf = (account) => {
+  const meta = account.metadata;
+  for (const key of ["login", "email", "accountEmail", "accountId"]) {
+    const value = meta[key];
+    if (typeof value === "string" && value !== "") return value;
+  }
+  return null;
+};
+var runChecks = async (config, probes) => {
+  const checks = [];
+  const health = await getJson(config, "/health");
+  checks.push(
+    health.value === null ? {
+      label: "server",
+      state: "failed",
+      detail: `cannot reach ${config.url}`,
+      fix: "start the Mend server"
+    } : {
+      label: "server",
+      state: "ok",
+      detail: `${config.url} \xB7 mend ${health.value.version}`,
+      fix: null
+    }
+  );
+  const projects = health.value !== null && config.token !== null ? await getJson(config, "/projects") : null;
+  if (health.value === null) checks.push(notChecked("signed in"));
+  else if (config.token === null) {
+    checks.push({
+      label: "signed in",
+      state: "failed",
+      detail: "no token saved",
+      fix: "mend login"
+    });
+  } else if (projects !== null && projects.value !== null) {
+    checks.push({ label: "signed in", state: "ok", detail: "token accepted", fix: null });
+  } else {
+    const status = projects === null ? null : projects.status;
+    checks.push(
+      status === 401 || status === 403 ? { label: "signed in", state: "failed", detail: "token rejected", fix: "mend login" } : {
+        label: "signed in",
+        state: "failed",
+        detail: `GET /projects \u2192 ${status ?? "no answer"}`,
+        fix: null
+      }
+    );
+  }
+  const signedIn = projects !== null && projects.value !== null;
+  const connection = signedIn ? await getJson(config, "/sealant/connection") : null;
+  if (connection === null) checks.push(notChecked("sealant"));
+  else if (connection.value === null) {
+    checks.push(
+      connection.status === 404 ? notChecked("sealant") : {
+        label: "sealant",
+        state: "failed",
+        detail: `GET /sealant/connection \u2192 ${connection.status ?? "no answer"}`,
+        fix: null
+      }
+    );
+  } else if (connection.value.status === "connected") {
+    checks.push({
+      label: "sealant",
+      state: "ok",
+      detail: `connected \xB7 ${connection.value.baseUrl}`,
+      fix: null
+    });
+  } else {
+    checks.push({
+      label: "sealant",
+      state: "failed",
+      detail: `${connection.value.status} \xB7 ${connection.value.detail ?? connection.value.baseUrl}`,
+      fix: null
+    });
+  }
+  const identity = signedIn ? await getJson(config, "/me/sealant") : null;
+  const platform = identity === null ? null : identity.value;
+  for (const { provider } of HARNESS_CLIS) {
+    if (platform === null) {
+      checks.push(notChecked(provider));
+      continue;
+    }
+    const account = platform.accounts.find((row) => row.provider === provider && row.name === "default") ?? platform.accounts.find((row) => row.provider === provider);
+    if (account === void 0) {
+      checks.push({
+        label: provider,
+        state: "todo",
+        detail: "not connected",
+        fix: `mend connect ${provider}`
+      });
+      continue;
+    }
+    const who = identityOf(account);
+    checks.push(
+      account.status === "active" ? {
+        label: provider,
+        state: "ok",
+        detail: who === null ? "connected" : `connected \xB7 ${who}`,
+        fix: null
+      } : {
+        label: provider,
+        state: "todo",
+        detail: account.status,
+        fix: `mend connect ${provider}`
+      }
+    );
+  }
+  const grant = probes.claudeGrant();
+  if (grant !== null) {
+    const facts = claudeGrantFacts(grant);
+    if (facts === null) {
+      checks.push({
+        label: "grant",
+        state: "failed",
+        detail: "unreadable",
+        fix: "mend connect claude"
+      });
+    } else if (!facts.hasRefreshToken) {
+      checks.push({
+        label: "grant",
+        state: "failed",
+        detail: "signed out",
+        fix: "mend connect claude"
+      });
+    } else if (facts.refreshExpiresAt !== null && facts.refreshExpiresAt.getTime() <= Date.now()) {
+      checks.push({
+        label: "grant",
+        state: "todo",
+        detail: `expired ${day(facts.refreshExpiresAt)}`,
+        fix: "mend connect claude"
+      });
+    } else {
+      checks.push({
+        label: "grant",
+        state: "ok",
+        detail: facts.refreshExpiresAt === null ? "Mend's own" : `Mend's own \xB7 expires ${day(facts.refreshExpiresAt)}`,
+        fix: null
+      });
+    }
+  }
+  const adopted = projects === null ? null : projects.value;
+  if (adopted === null) checks.push(notChecked("projects"));
+  else if (adopted.length === 0) {
+    checks.push({ label: "projects", state: "todo", detail: "none adopted", fix: "mend adopt" });
+  } else {
+    checks.push({ label: "projects", state: "ok", detail: `${adopted.length} adopted`, fix: null });
+  }
+  for (const { command, provider } of HARNESS_CLIS) {
+    const label = `${command} cli`;
+    if (!probes.onPath(command)) {
+      checks.push({ label, state: "todo", detail: "not on PATH", fix: null });
+      continue;
+    }
+    const credential = probes.localCredential(provider);
+    checks.push(
+      credential === null ? {
+        label,
+        state: "todo",
+        detail: "on PATH \xB7 no credential here",
+        fix: LOGIN_COMMANDS[provider]
+      } : { label, state: "ok", detail: "on PATH \xB7 credential present", fix: null }
+    );
+  }
+  const machine = signedIn ? await getJson(config, "/machine") : null;
+  const exposure = machine === null || machine.value === null ? void 0 : machine.value.exposure;
+  checks.push(exposure === void 0 ? notChecked("exposure") : exposureCheck(exposure));
+  return checks;
+};
+var onPath = (command) => {
+  for (const directory of (process.env["PATH"] ?? "").split(path5.delimiter)) {
+    if (directory === "") continue;
+    try {
+      fs5.accessSync(path5.join(directory, command), fs5.constants.X_OK);
+      return true;
+    } catch {
+    }
+  }
+  return false;
+};
+var paintMark = (state, mark) => {
+  if (process.stdout.isTTY !== true) return mark;
+  const code = state === "ok" ? "32" : state === "todo" ? "33" : "31";
+  return `\x1B[${code}m${mark}\x1B[0m`;
+};
+var doctorCommand = async (config, localCredential2, claudeGrant2) => {
+  const checks = await runChecks(config, { localCredential: localCredential2, claudeGrant: claudeGrant2, onPath });
+  for (const check of checks) process.stdout.write(`${formatCheck(check, paintMark)}
+`);
+  if (checks.some((check) => check.state === "failed")) process.exitCode = 1;
+};
+
+// src/dotfiles.ts
+import * as fs6 from "node:fs";
+import * as path6 from "node:path";
+var DOTFILE_CANDIDATES = [
+  {
+    group: "shell",
+    paths: [
+      ".zshrc",
+      ".zshenv",
+      ".zprofile",
+      ".bashrc",
+      ".bash_profile",
+      ".profile",
+      ".aliases",
+      ".config/fish/config.fish",
+      ".config/starship.toml"
+    ]
+  },
+  {
+    group: "git",
+    paths: [".gitconfig", ".gitignore_global", ".config/git/config", ".config/git/ignore"]
+  },
+  {
+    group: "editors",
+    paths: [".vimrc", ".ideavimrc", ".editorconfig", ".config/helix/config.toml"]
+  },
+  {
+    group: "terminal",
+    paths: [".tmux.conf", ".config/tmux/tmux.conf", ".inputrc", ".dir_colors"]
+  },
+  {
+    group: "tools",
+    paths: [
+      ".ripgreprc",
+      ".config/bat/config",
+      ".config/lazygit/config.yml",
+      ".config/mise/config.toml",
+      ".config/atuin/config.toml",
+      ".config/zellij/config.kdl"
+    ]
+  }
+];
+var MAX_FILE_BYTES = 1024 * 1024;
+var statFile = (home, relative4) => {
+  try {
+    const stat = fs6.statSync(path6.join(home, relative4));
+    return stat.isFile() ? stat : null;
+  } catch {
+    return null;
+  }
+};
+var scanDotfileCandidates = (home) => DOTFILE_CANDIDATES.flatMap(
+  ({ group, paths }) => paths.flatMap((relative4) => {
+    const stat = statFile(home, relative4);
+    return stat === null ? [] : [{ path: relative4, group, bytes: stat.size }];
+  })
+);
+var homeRelativePath = (home, requested) => {
+  const relative4 = path6.relative(home, path6.resolve(home, requested));
+  const outside = relative4 === "" || relative4 === ".." || relative4.startsWith(`..${path6.sep}`) || path6.isAbsolute(relative4);
+  return outside ? null : relative4.split(path6.sep).join("/");
+};
+var readSyncFiles = (home, paths_) => {
+  const files = [];
+  for (const requested of paths_) {
+    const relative4 = homeRelativePath(home, requested);
+    if (relative4 === null) {
+      return {
+        error: `${requested} is not under ${home} \u2014 only files in your home directory sync`
+      };
+    }
+    const stat = statFile(home, relative4);
+    if (stat === null) {
+      return { error: `${relative4} is not a file under ${home}` };
+    }
+    if (stat.size > MAX_FILE_BYTES) {
+      return { error: `${relative4} is over 1MB \u2014 dotfiles are text; trim the selection` };
+    }
+    files.push({
+      path: relative4,
+      contentsBase64: fs6.readFileSync(path6.join(home, relative4)).toString("base64"),
+      // eslint-disable-next-line no-bitwise -- permission bits are the point
+      mode: (stat.mode & 511).toString(8)
+    });
+  }
+  return { files };
+};
+var DOTFILES_MANAGERS = ["auto", "copy", "stow", "chezmoi"];
+var VALUE_FLAGS = ["--ref", "--subdirectory", "--manager"];
+var parseDotfilesRepoArgs = (args) => {
+  if (args.includes("--clear")) {
+    return args.length === 1 ? { kind: "clear" } : { kind: "error", error: "--clear takes no URL or other options" };
+  }
+  let url = null;
+  const values = /* @__PURE__ */ new Map();
+  let bootstrap = true;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
+    if (arg === "--no-bootstrap") {
+      bootstrap = false;
+      continue;
+    }
+    const flag = VALUE_FLAGS.find((candidate) => candidate === arg);
+    if (flag !== void 0) {
+      const value = args[index + 1];
+      if (value === void 0 || value.trim() === "" || value.startsWith("--")) {
+        return { kind: "error", error: `${flag} needs a value` };
+      }
+      values.set(flag, value.trim());
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("-")) return { kind: "error", error: `unknown flag ${arg}` };
+    if (url !== null) return { kind: "error", error: "one repository URL only" };
+    url = arg.trim();
+  }
+  if (url === null || url === "") {
+    return { kind: "error", error: "name the repository URL, or --clear to remove it" };
+  }
+  const requested = values.get("--manager") ?? "auto";
+  const manager = DOTFILES_MANAGERS.find((candidate) => candidate === requested);
+  if (manager === void 0) {
+    return { kind: "error", error: `--manager must be one of ${DOTFILES_MANAGERS.join(", ")}` };
+  }
+  return {
+    kind: "set",
+    repository: {
+      url,
+      ref: values.get("--ref") ?? null,
+      subdirectory: values.get("--subdirectory") ?? null,
+      manager,
+      bootstrap
+    }
+  };
+};
+var dotfilesRepositoryFacts = (repository) => [
+  repository.ref ?? "default branch",
+  ...repository.subdirectory === null ? [] : [`${repository.subdirectory}/`],
+  `manager ${repository.manager}`,
+  repository.bootstrap ? "install.sh on" : "install.sh off"
+].join(" \xB7 ");
+
+// src/env.ts
+var formatLoadReport = (report, paint6) => {
+  const width = Math.max(
+    0,
+    ...report.loaded.map((entry) => entry.name.length),
+    ...report.rejected.map((entry) => entry.name.length)
+  );
+  const lines = [];
+  for (const entry of report.loaded) {
+    lines.push(
+      `  ${entry.name.padEnd(width)}  ${entry.lane === "secret" ? "secret" : "configuration"} ${paint6.dim(`\xB7 ${entry.action}${entry.lane === "configuration" ? " \xB7 plaintext" : ""}`)}`
+    );
+  }
+  for (const entry of report.rejected) {
+    lines.push(
+      `  ${entry.name.padEnd(width)}  ${paint6.warn("rejected")} ${paint6.dim(`\xB7 ${entry.reason}`)}`
+    );
+  }
+  return lines;
 };
-var manFileName = (doc) => doc === null ? "mend.1" : `mend-${doc.name.replace(/ /g, "-")}.1`;
+
+// src/git-author.ts
+var parseGitAuthorArgs = (args) => {
+  const clear = args.includes("--clear");
+  const words = args.filter((arg) => !arg.startsWith("--"));
+  if (clear) return words.length === 0 ? { kind: "clear" } : { kind: "usage" };
+  if (words.length === 0) return { kind: "show" };
+  const [name, email] = words;
+  if (words.length !== 2 || name === void 0 || email === void 0) return { kind: "usage" };
+  const issue = gitAuthorIssue({ name, email });
+  if (issue !== null) return { kind: "invalid", message: `git author not saved \xB7 ${issue}` };
+  const author = normalizeGitAuthor({ name, email });
+  return { kind: "set", name: author.name, email: author.email };
+};
+var gitAuthorLine = (author) => `${author.name} <${author.email}> \xB7 ${author.source === "setting" ? "your setting" : "your account's name and email"}`;
 
 // src/landing.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import * as fs4 from "node:fs";
-import * as os2 from "node:os";
-import * as path4 from "node:path";
+import * as fs7 from "node:fs";
+import * as os3 from "node:os";
+import * as path7 from "node:path";
 var paint = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}[0m` : text;
 var dim = paint("2");
 var green = paint("32");
@@ -2283,9 +3166,9 @@ var gitRemotes = (cwd) => {
 var remoteForOrigin = (remotes, originUrl, cwd) => {
   if (originUrl === null) return null;
   const origin = normalizeRemoteUrl(originUrl);
-  const originPath = origin === null ? path4.resolve(originUrl.replace(/^file:\/\//, "")) : null;
+  const originPath = origin === null ? path7.resolve(originUrl.replace(/^file:\/\//, "")) : null;
   return remotes.find(
-    (remote) => origin === null ? path4.resolve(cwd, remote.url.replace(/^file:\/\//, "")) === originPath : normalizeRemoteUrl(remote.url) === origin
+    (remote) => origin === null ? path7.resolve(cwd, remote.url.replace(/^file:\/\//, "")) === originPath : normalizeRemoteUrl(remote.url) === origin
   ) ?? null;
 };
 var LOG_LINES = 10;
@@ -2308,10 +3191,10 @@ var fetchBundle = (cwd, bundle) => {
   const before = git(cwd, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]);
   const previous = before.status === 0 ? before.stdout.trim() : null;
   if (previous !== bundle.tip) {
-    const dir = fs4.mkdtempSync(path4.join(os2.tmpdir(), "mend-pull-"));
+    const dir = fs7.mkdtempSync(path7.join(os3.tmpdir(), "mend-pull-"));
     try {
-      const file = path4.join(dir, "change.bundle");
-      fs4.writeFileSync(file, bundle.bytes, { mode: 384 });
+      const file = path7.join(dir, "change.bundle");
+      fs7.writeFileSync(file, bundle.bytes, { mode: 384 });
       const fetched = git(cwd, [
         "fetch",
         "--no-tags",
@@ -2321,7 +3204,7 @@ var fetchBundle = (cwd, bundle) => {
       ]);
       if (fetched.status !== 0) return refusedWith(gitWords(fetched));
     } finally {
-      fs4.rmSync(dir, { recursive: true, force: true });
+      fs7.rmSync(dir, { recursive: true, force: true });
     }
   }
   const after = git(cwd, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).stdout.trim();
@@ -2359,7 +3242,7 @@ var fetchedLines = (fetched) => {
   lines.push(`${dim("  switch to it")} git switch ${fetched.branch}`);
   return lines;
 };
-var formatBytes = (bytes) => {
+var formatBytes2 = (bytes) => {
   if (bytes < 1024) return `${bytes} bytes`;
   const units = ["KiB", "MiB", "GiB"];
   let value = bytes / 1024;
@@ -2372,13 +3255,13 @@ var formatBytes = (bytes) => {
 };
 var numberField = (value, key) => {
   if (typeof value !== "object" || value === null || !(key in value)) return null;
-  const field = Reflect.get(value, key);
-  return typeof field === "number" ? field : null;
+  const field2 = Reflect.get(value, key);
+  return typeof field2 === "number" ? field2 : null;
 };
-var stringField = (value, key) => {
+var stringField2 = (value, key) => {
   if (typeof value !== "object" || value === null || !(key in value)) return null;
-  const field = Reflect.get(value, key);
-  return typeof field === "string" ? field : null;
+  const field2 = Reflect.get(value, key);
+  return typeof field2 === "string" ? field2 : null;
 };
 var parseJson = (bytes) => {
   try {
@@ -2392,9 +3275,9 @@ var bundleRefusal = (downloaded) => {
   const size = numberField(body, "size");
   const limit = numberField(body, "limit");
   if (downloaded.status === 413 && size !== null && limit !== null) {
-    return `bundle not sent \xB7 ${formatBytes(size)} (${size} bytes) \xB7 the server's limit is ${formatBytes(limit)} (MEND_BUDGET_BUNDLE_BYTES) \xB7 nothing was fetched`;
+    return `bundle not sent \xB7 ${formatBytes2(size)} (${size} bytes) \xB7 the server's limit is ${formatBytes2(limit)} (MEND_BUDGET_BUNDLE_BYTES) \xB7 nothing was fetched`;
   }
-  return stringField(body, "message") ?? `the bundle request answered ${downloaded.status}`;
+  return stringField2(body, "message") ?? `the bundle request answered ${downloaded.status}`;
 };
 var bundleFactsOf = (downloaded) => {
   const branch = downloaded.header(BUNDLE_HEADERS.branch);
@@ -2439,8 +3322,8 @@ var pullCommand = async (api2, download2, args, cwd = process.cwd()) => {
 };
 
 // src/login.ts
-import { spawn } from "node:child_process";
-import * as os3 from "node:os";
+import { spawn as spawn2 } from "node:child_process";
+import * as os4 from "node:os";
 
 // src/pair.ts
 var paint2 = (code) => (text) => process.stdout.isTTY === true ? `\x1B[${code}m${text}\x1B[0m` : text;
@@ -2503,23 +3386,23 @@ var qrCommand = async (args) => {
 };
 
 // src/login.ts
-var parseCliAuthStart = (json) => {
-  if (typeof json !== "object" || json === null) return null;
-  if (!("deviceCode" in json && "code" in json && "verifyPath" in json && "expiresAt" in json && "intervalSeconds" in json)) {
+var parseCliAuthStart = (json2) => {
+  if (typeof json2 !== "object" || json2 === null) return null;
+  if (!("deviceCode" in json2 && "code" in json2 && "verifyPath" in json2 && "expiresAt" in json2 && "intervalSeconds" in json2)) {
     return null;
   }
-  const { deviceCode, code, verifyPath, expiresAt, intervalSeconds } = json;
+  const { deviceCode, code, verifyPath, expiresAt, intervalSeconds } = json2;
   if (typeof deviceCode !== "string" || typeof code !== "string" || typeof verifyPath !== "string" || typeof expiresAt !== "string" || typeof intervalSeconds !== "number") {
     return null;
   }
   return { deviceCode, code, verifyPath, expiresAt, intervalSeconds };
 };
-var parseCliAuthPoll = (json) => {
-  if (typeof json !== "object" || json === null || !("status" in json)) return null;
-  if (json.status === "pending") return { status: "pending" };
-  if (json.status !== "approved") return null;
-  if (!("token" in json && "user" in json && "device" in json)) return null;
-  const { token, user, device } = json;
+var parseCliAuthPoll = (json2) => {
+  if (typeof json2 !== "object" || json2 === null || !("status" in json2)) return null;
+  if (json2.status === "pending") return { status: "pending" };
+  if (json2.status !== "approved") return null;
+  if (!("token" in json2 && "user" in json2 && "device" in json2)) return null;
+  const { token, user, device } = json2;
   if (typeof token !== "string") return null;
   if (typeof user !== "object" || user === null) return null;
   if (!("id" in user && "name" in user && "email" in user)) return null;
@@ -2579,7 +3462,7 @@ var openBrowser = (url) => {
   const opener = browserCommand(process.platform);
   if (opener === null || process.stdout.isTTY !== true) return;
   try {
-    const child = spawn(opener.command, [...opener.args, url], {
+    const child = spawn2(opener.command, [...opener.args, url], {
       stdio: "ignore",
       detached: true
     });
@@ -2600,21 +3483,21 @@ var post = async (url, body) => {
     return fail3(`cannot reach the Mend server at ${new URL(url).origin} \u2014 is it running?`);
   }
   const text = await response.text();
-  let json = null;
+  let json2 = null;
   try {
-    json = JSON.parse(text);
+    json2 = JSON.parse(text);
   } catch {
   }
-  return { status: response.status, json };
+  return { status: response.status, json: json2 };
 };
-var retryAfterSecondsOf = (json) => {
-  if (typeof json === "object" && json !== null && "retryAfterSeconds" in json) {
-    const seconds = Number(json.retryAfterSeconds);
+var retryAfterSecondsOf = (json2) => {
+  if (typeof json2 === "object" && json2 !== null && "retryAfterSeconds" in json2) {
+    const seconds = Number(json2.retryAfterSeconds);
     if (Number.isFinite(seconds) && seconds > 0) return seconds;
   }
   return 5;
 };
-var sleep2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms));
+var sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var resolveServerUrl = async (args, deps) => {
   const given = takeFlagValue2(args, "--url") ?? deps.configuredUrl;
   if (given !== null) {
@@ -2632,7 +3515,7 @@ var resolveServerUrl = async (args, deps) => {
 };
 var loginCommand = async (args, deps) => {
   const base = await resolveServerUrl(args, deps);
-  const started = await post(`${base}/api/cli/auth`, { name: os3.hostname() });
+  const started = await post(`${base}/api/cli/auth`, { name: os4.hostname() });
   if (started.status === 429) {
     return fail3(
       `the server asked for a pause \u2014 try again in ${retryAfterSecondsOf(started.json)}s`
@@ -2683,8 +3566,8 @@ var loginCommand = async (args, deps) => {
 };
 
 // src/organization.ts
-import * as fs5 from "node:fs";
-import * as path5 from "node:path";
+import * as fs8 from "node:fs";
+import * as path8 from "node:path";
 var paint4 = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}[0m` : text;
 var dim4 = paint4("2");
 var green4 = paint4("32");
@@ -2748,7 +3631,7 @@ var scanFolder = (dir) => {
   const files = [];
   const skipped = [];
   const walk = (relative4) => {
-    const entries = fs5.readdirSync(path5.join(dir, relative4), { withFileTypes: true }).toSorted((a, b) => a.name.localeCompare(b.name));
+    const entries = fs8.readdirSync(path8.join(dir, relative4), { withFileTypes: true }).toSorted((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       const child = relative4 === "" ? entry.name : `${relative4}/${entry.name}`;
       if (entry.isSymbolicLink()) {
@@ -2757,7 +3640,7 @@ var scanFolder = (dir) => {
         if (SKIPPED_DIRECTORIES.has(entry.name)) skipped.push({ path: child, reason: "skipped" });
         else walk(child);
       } else if (entry.isFile()) {
-        const size = fs5.statSync(path5.join(dir, child)).size;
+        const size = fs8.statSync(path8.join(dir, child)).size;
         if (size > FOLDER_FILE_BYTES) skipped.push({ path: child, reason: "over 1 MiB" });
         else files.push({ path: child, size });
       }
@@ -2810,7 +3693,7 @@ var folderCommand = async (api2, args) => {
     }
     case "push": {
       if (dir === void 0) return fail4("usage: mend folder push <name> <dir> [--replace]");
-      if (!fs5.existsSync(dir) || !fs5.statSync(dir).isDirectory()) {
+      if (!fs8.existsSync(dir) || !fs8.statSync(dir).isDirectory()) {
         return fail4(`${dir} is not a directory`);
       }
       const folder = await folderNamed(api2, name);
@@ -2825,7 +3708,7 @@ var folderCommand = async (api2, args) => {
           files: batch.map((file) => ({
             path: file.path,
             // Read one batch at a time, so a large tree never sits in memory at once.
-            contentsBase64: fs5.readFileSync(path5.join(dir, file.path)).toString("base64")
+            contentsBase64: fs8.readFileSync(path8.join(dir, file.path)).toString("base64")
           })),
           // --replace empties the folder with the first batch; the rest add to it.
           merge: !(replace && index === 0)
@@ -3009,8 +3892,8 @@ var operatorCommand = async (api2, tryApi, baseUrl, args) => {
 import { createHmac, randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import * as net2 from "node:net";
-import * as os5 from "node:os";
-import * as path8 from "node:path";
+import * as os6 from "node:os";
+import * as path10 from "node:path";
 
 // src/server-docker-volumes.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -3053,14 +3936,14 @@ var docker = async (runtime, context, args) => {
   }
 };
 var listNames = async (runtime, context, kind, project2) => {
-  const field = kind === "container" ? "Names" : "Name";
+  const field2 = kind === "container" ? "Names" : "Name";
   const output = await docker(runtime, context, [
     kind,
     "ls",
     ...kind === "container" ? ["--all"] : [],
     ...project2 === void 0 ? [] : ["--filter", `label=com.docker.compose.project=${project2}`],
     "--format",
-    `{{json .${field}}}`
+    `{{json .${field2}}}`
   ]);
   if (output._tag === "error") return output;
   const names = [];
@@ -3226,157 +4109,11 @@ var ownership = async (runtime, input, mode) => {
 var claimServerDockerVolumes = (runtime, input) => ownership(runtime, input, "claim");
 var verifyServerDockerVolumes = (runtime, input) => ownership(runtime, input, "verify");
 
-// src/server-runtime.ts
-import { spawn as spawn2 } from "node:child_process";
-import * as fs6 from "node:fs";
-import * as path6 from "node:path";
-var serverProcessDeadlines = {
-  ordinary: 3e4,
-  pull: 10 * 6e4,
-  startup: 3 * 6e4,
-  stop: 9e4,
-  dump: 15 * 6e4,
-  composeWaitSeconds: 120
-};
-var runServerProcess = (command, args, parentEnvironment, options = {}) => {
-  const timeoutMs = options?.timeoutMs ?? serverProcessDeadlines.ordinary;
-  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647) {
-    return Promise.resolve({
-      status: null,
-      stdout: "",
-      stderr: "",
-      error: "Invalid process timeout"
-    });
-  }
-  if (options.stdoutFile !== void 0 && options.stdout === "inherit") {
-    return Promise.resolve({
-      status: null,
-      stdout: "",
-      stderr: "",
-      error: "Invalid process output options"
-    });
-  }
-  const env = {};
-  for (const key of [
-    "PATH",
-    "HOME",
-    "USER",
-    "LOGNAME",
-    "XDG_CONFIG_HOME",
-    "XDG_RUNTIME_DIR",
-    "DOCKER_CONFIG",
-    "SSH_AUTH_SOCK",
-    "TMPDIR",
-    "TMP",
-    "TEMP"
-  ]) {
-    if (parentEnvironment[key] !== void 0) env[key] = parentEnvironment[key];
-  }
-  return new Promise((resolve6) => {
-    let fd;
-    try {
-      if (options.stdoutFile !== void 0) fd = fs6.openSync(options.stdoutFile, "wx", 384);
-      const child = spawn2(command, [...args], {
-        env,
-        detached: process.platform !== "win32",
-        stdio: ["ignore", fd ?? (options.stdout === "inherit" ? "inherit" : "pipe"), "pipe"]
-      });
-      let stdout = "";
-      let stderr = "";
-      let stdoutBytes = 0;
-      let stderrBytes = 0;
-      let failure2;
-      const terminate = () => {
-        if (process.platform === "win32" || child.pid === void 0) {
-          child.kill("SIGKILL");
-          return;
-        }
-        try {
-          process.kill(-child.pid, "SIGKILL");
-        } catch (cause) {
-          if (!(cause instanceof Error && "code" in cause && cause.code === "ESRCH")) {
-            failure2 = "Could not terminate the process group; retain the installation lock until its processes stop.";
-            child.kill("SIGKILL");
-          }
-        }
-      };
-      child.stdout?.on("data", (chunk) => {
-        stdoutBytes += chunk.length;
-        if (stdoutBytes <= 4 * 1024 * 1024) stdout += chunk.toString();
-        else {
-          failure2 ??= "Process output exceeded the capture limit. Request fewer log lines.";
-          terminate();
-        }
-      });
-      child.stderr?.on("data", (chunk) => {
-        stderrBytes += chunk.length;
-        if (stderrBytes <= 64 * 1024) stderr += chunk.toString();
-        else {
-          failure2 ??= "Process output exceeded the capture limit. Request fewer log lines.";
-          terminate();
-        }
-      });
-      const timer = setTimeout(() => {
-        failure2 ??= `Process timed out after ${timeoutMs}ms`;
-        terminate();
-      }, timeoutMs);
-      child.once("error", (error) => {
-        failure2 ??= error.message;
-      });
-      child.once("close", (status) => {
-        globalThis.clearTimeout(timer);
-        try {
-          if (fd !== void 0) fs6.fsyncSync(fd);
-        } catch {
-          failure2 ??= "Could not durably write process output.";
-        } finally {
-          try {
-            if (fd !== void 0) fs6.closeSync(fd);
-          } catch {
-            failure2 ??= "Could not close process output file.";
-          }
-        }
-        resolve6({
-          status: failure2 === void 0 ? status : null,
-          stdout,
-          stderr,
-          ...failure2 === void 0 ? {} : { error: failure2 }
-        });
-      });
-    } catch (cause) {
-      try {
-        if (fd !== void 0) fs6.closeSync(fd);
-      } catch {
-      }
-      resolve6({
-        status: null,
-        stdout: "",
-        stderr: "",
-        error: cause instanceof Error ? cause.message : "Could not start process."
-      });
-    }
-  });
-};
-var serverComposeArgs = (installation, command) => [
-  "--context",
-  installation.dockerContext,
-  "compose",
-  "--project-name",
-  "mend",
-  "--project-directory",
-  installation.directory,
-  "--env-file",
-  path6.join(installation.directory, "server.env"),
-  "-f",
-  path6.join(installation.directory, "compose.yaml"),
-  ...command
-];
-
 // src/server-store.ts
 import { randomUUID } from "node:crypto";
-import * as fs7 from "node:fs";
-import * as os4 from "node:os";
-import * as path7 from "node:path";
+import * as fs9 from "node:fs";
+import * as os5 from "node:os";
+import * as path9 from "node:path";
 var ServerStoreError = class extends Error {
   _tag = "ServerStoreError";
 };
@@ -3397,28 +4134,28 @@ var attempt = (operation) => {
 var hasCode = (cause, code) => cause instanceof Error && "code" in cause && cause.code === code;
 var readOptional = (file) => {
   try {
-    return fs7.readFileSync(file, "utf8");
+    return fs9.readFileSync(file, "utf8");
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
   }
 };
 var syncDirectory = (directory) => {
-  const fd = fs7.openSync(directory, "r");
+  const fd = fs9.openSync(directory, "r");
   try {
-    fs7.fsyncSync(fd);
+    fs9.fsyncSync(fd);
   } finally {
-    fs7.closeSync(fd);
+    fs9.closeSync(fd);
   }
 };
 var writeDurable = (file, content, mode = 384) => {
-  const fd = fs7.openSync(file, "wx", mode);
+  const fd = fs9.openSync(file, "wx", mode);
   try {
-    fs7.writeFileSync(fd, content, "utf8");
-    fs7.fchmodSync(fd, mode);
-    fs7.fsyncSync(fd);
+    fs9.writeFileSync(fd, content, "utf8");
+    fs9.fchmodSync(fd, mode);
+    fs9.fsyncSync(fd);
   } finally {
-    fs7.closeSync(fd);
+    fs9.closeSync(fd);
   }
 };
 var fileKeys = ["identity", "config", "env", "compose", "postgresInit"];
@@ -3438,11 +4175,11 @@ var parseLockOwner = (raw) => {
 };
 var describeOwner = (lockDir) => {
   try {
-    const raw = JSON.parse(fs7.readFileSync(path7.join(lockDir, "owner.json"), "utf8"));
+    const raw = JSON.parse(fs9.readFileSync(path9.join(lockDir, "owner.json"), "utf8"));
     const owner = parseLockOwner(raw);
     if (owner === null) return "owner metadata is invalid";
     const label = `PID ${owner.pid} on ${owner.hostname}`;
-    if (owner.hostname !== os4.hostname()) return label;
+    if (owner.hostname !== os5.hostname()) return label;
     try {
       process.kill(owner.pid, 0);
       return `${label} is still live`;
@@ -3458,28 +4195,28 @@ var lockGuidance = (lockDir) => new ServerStoreError(
 );
 var acquireLock = (configDir, create) => {
   if (create) {
-    fs7.mkdirSync(configDir, { recursive: true, mode: 448 });
-    fs7.chmodSync(configDir, 448);
-  } else if (!fs7.existsSync(configDir)) {
+    fs9.mkdirSync(configDir, { recursive: true, mode: 448 });
+    fs9.chmodSync(configDir, 448);
+  } else if (!fs9.existsSync(configDir)) {
     throw new ServerStoreError(
       "No Mend server is configured. Run mend server setup explicitly to install one."
     );
   }
-  const lockDir = path7.join(configDir, "server.lock");
+  const lockDir = path9.join(configDir, "server.lock");
   try {
-    fs7.mkdirSync(lockDir, { mode: 448 });
+    fs9.mkdirSync(lockDir, { mode: 448 });
   } catch (cause) {
     if (hasCode(cause, "EEXIST")) throw lockGuidance(lockDir);
     throw cause;
   }
-  const owned = fs7.statSync(lockDir);
-  const ownerFile = path7.join(lockDir, "owner.json");
-  const owner = `${JSON.stringify({ pid: process.pid, hostname: os4.hostname(), token: randomUUID() })}
+  const owned = fs9.statSync(lockDir);
+  const ownerFile = path9.join(lockDir, "owner.json");
+  const owner = `${JSON.stringify({ pid: process.pid, hostname: os5.hostname(), token: randomUUID() })}
 `;
   let open = true;
   const assertOwned = () => {
-    const current = fs7.statSync(lockDir);
-    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs7.readFileSync(ownerFile, "utf8") !== owner) {
+    const current = fs9.statSync(lockDir);
+    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs9.readFileSync(ownerFile, "utf8") !== owner) {
       throw new ServerStoreError(
         "Server lock ownership was lost. Stop and check for another server command before retrying."
       );
@@ -3495,8 +4232,8 @@ var acquireLock = (configDir, create) => {
     release: () => {
       const result = attempt(() => {
         assertOwned();
-        fs7.unlinkSync(ownerFile);
-        fs7.rmdirSync(lockDir);
+        fs9.unlinkSync(ownerFile);
+        fs9.rmdirSync(lockDir);
       });
       open = false;
       return result;
@@ -3505,7 +4242,7 @@ var acquireLock = (configDir, create) => {
 };
 var readIdentity = (paths) => {
   const identity = readOptional(paths.identity);
-  if (identity === null && (fs7.existsSync(paths.active) || fs7.existsSync(paths.generations) && fs7.readdirSync(paths.generations).length > 0)) {
+  if (identity === null && (fs9.existsSync(paths.active) || fs9.existsSync(paths.generations) && fs9.readdirSync(paths.generations).length > 0)) {
     throw new ServerStoreError(
       "Server identity.env is missing. Restore it from a retained generation or backup; refusing to generate replacement credentials."
     );
@@ -3515,7 +4252,7 @@ var readIdentity = (paths) => {
 var readActive = (paths) => {
   let target;
   try {
-    target = fs7.readlinkSync(paths.active);
+    target = fs9.readlinkSync(paths.active);
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
@@ -3525,13 +4262,13 @@ var readActive = (paths) => {
       "Server active pointer is invalid. Restore the symlink to a retained generation before retrying."
     );
   }
-  const directory = path7.join(paths.configDir, target);
+  const directory = path9.join(paths.configDir, target);
   const files = {
-    identity: fs7.readFileSync(path7.join(directory, fileNames.identity), "utf8"),
-    config: fs7.readFileSync(path7.join(directory, fileNames.config), "utf8"),
-    env: fs7.readFileSync(path7.join(directory, fileNames.env), "utf8"),
-    compose: fs7.readFileSync(path7.join(directory, fileNames.compose), "utf8"),
-    postgresInit: fs7.readFileSync(path7.join(directory, fileNames.postgresInit), "utf8")
+    identity: fs9.readFileSync(path9.join(directory, fileNames.identity), "utf8"),
+    config: fs9.readFileSync(path9.join(directory, fileNames.config), "utf8"),
+    env: fs9.readFileSync(path9.join(directory, fileNames.env), "utf8"),
+    compose: fs9.readFileSync(path9.join(directory, fileNames.compose), "utf8"),
+    postgresInit: fs9.readFileSync(path9.join(directory, fileNames.postgresInit), "utf8")
   };
   if (readIdentity(paths) !== files.identity) {
     throw new ServerStoreError(
@@ -3541,20 +4278,20 @@ var readActive = (paths) => {
   return { directory, files };
 };
 var publishIdentity = (paths, identity) => {
-  const temporary = path7.join(paths.configDir, `.identity-${randomUUID()}`);
+  const temporary = path9.join(paths.configDir, `.identity-${randomUUID()}`);
   writeDurable(temporary, identity);
-  fs7.linkSync(temporary, paths.identity);
+  fs9.linkSync(temporary, paths.identity);
   syncDirectory(paths.configDir);
-  fs7.unlinkSync(temporary);
+  fs9.unlinkSync(temporary);
 };
 var prepareGeneration = (paths, files) => {
-  fs7.mkdirSync(paths.generations, { recursive: true, mode: 448 });
+  fs9.mkdirSync(paths.generations, { recursive: true, mode: 448 });
   const generationName = `gen-${randomUUID()}`;
-  const directory = path7.join(paths.generations, generationName);
-  fs7.mkdirSync(directory, { mode: 448 });
+  const directory = path9.join(paths.generations, generationName);
+  fs9.mkdirSync(directory, { mode: 448 });
   for (const key of fileKeys) {
     writeDurable(
-      path7.join(directory, fileNames[key]),
+      path9.join(directory, fileNames[key]),
       files[key],
       key === "postgresInit" ? 493 : 384
     );
@@ -3565,18 +4302,18 @@ var prepareGeneration = (paths, files) => {
   return { directory, files };
 };
 var activateGeneration = (paths, generation) => {
-  const relative4 = path7.relative(paths.configDir, generation.directory);
-  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative4) || readIdentity(paths) !== fs7.readFileSync(path7.join(generation.directory, "identity.env"), "utf8")) {
+  const relative4 = path9.relative(paths.configDir, generation.directory);
+  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative4) || readIdentity(paths) !== fs9.readFileSync(path9.join(generation.directory, "identity.env"), "utf8")) {
     throw new ServerStoreError("Cannot activate a generation outside this installation identity.");
   }
   for (const key of fileKeys) {
-    if (fs7.readFileSync(path7.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
+    if (fs9.readFileSync(path9.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
       throw new ServerStoreError("Cannot activate an incomplete or changed server generation.");
     }
   }
-  const pointer = path7.join(paths.configDir, `.active-${randomUUID()}`);
-  fs7.symlinkSync(relative4, pointer);
-  fs7.renameSync(pointer, paths.active);
+  const pointer = path9.join(paths.configDir, `.active-${randomUUID()}`);
+  fs9.symlinkSync(relative4, pointer);
+  fs9.renameSync(pointer, paths.active);
   syncDirectory(paths.configDir);
 };
 var prepareFiles = (paths, files) => {
@@ -3585,7 +4322,7 @@ var prepareFiles = (paths, files) => {
     throw new ServerStoreError("Server identity already exists; refusing to replace credentials.");
   }
   const active = readActive(paths);
-  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs7.statSync(path7.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
+  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs9.statSync(path9.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
     return active;
   if (identity === null) publishIdentity(paths, files.identity);
   return prepareGeneration(paths, files);
@@ -3598,9 +4335,9 @@ var commitGeneration = (paths, files) => {
 var createStore = (configDir, lock) => {
   const paths = {
     configDir,
-    identity: path7.join(configDir, "identity.env"),
-    generations: path7.join(configDir, "generations"),
-    active: path7.join(configDir, "active")
+    identity: path9.join(configDir, "identity.env"),
+    generations: path9.join(configDir, "generations"),
+    active: path9.join(configDir, "active")
   };
   const whileOwned = (operation) => attempt(() => {
     lock.assertOwned();
@@ -3613,13 +4350,13 @@ var createStore = (configDir, lock) => {
     prepare: (files) => whileOwned(() => prepareFiles(paths, files)),
     activate: (generation) => whileOwned(() => activateGeneration(paths, generation)),
     createBackup: (previous, target) => whileOwned(() => {
-      const backups = path7.join(configDir, "backups");
-      fs7.mkdirSync(backups, { recursive: true, mode: 448 });
-      fs7.chmodSync(backups, 448);
-      const directory = path7.join(backups, `upgrade-${randomUUID()}`);
-      fs7.mkdirSync(directory, { mode: 448 });
+      const backups = path9.join(configDir, "backups");
+      fs9.mkdirSync(backups, { recursive: true, mode: 448 });
+      fs9.chmodSync(backups, 448);
+      const directory = path9.join(backups, `upgrade-${randomUUID()}`);
+      fs9.mkdirSync(directory, { mode: 448 });
       writeDurable(
-        path7.join(directory, "recovery.json"),
+        path9.join(directory, "recovery.json"),
         `${JSON.stringify(
           {
             previousGeneration: previous.directory,
@@ -3635,21 +4372,21 @@ var createStore = (configDir, lock) => {
       syncDirectory(directory);
       syncDirectory(backups);
       syncDirectory(configDir);
-      const partialFile = path7.join(directory, "database.sql.partial");
+      const partialFile = path9.join(directory, "database.sql.partial");
       return {
         directory,
         partialFile,
         complete: () => whileOwned(() => {
-          if (fs7.statSync(partialFile).size === 0)
+          if (fs9.statSync(partialFile).size === 0)
             throw new ServerStoreError("Database backup is empty; refusing target startup.");
-          const fd = fs7.openSync(partialFile, "r");
+          const fd = fs9.openSync(partialFile, "r");
           try {
-            fs7.fchmodSync(fd, 384);
-            fs7.fsyncSync(fd);
+            fs9.fchmodSync(fd, 384);
+            fs9.fsyncSync(fd);
           } finally {
-            fs7.closeSync(fd);
+            fs9.closeSync(fd);
           }
-          fs7.renameSync(partialFile, path7.join(directory, "database.sql"));
+          fs9.renameSync(partialFile, path9.join(directory, "database.sql"));
           syncDirectory(directory);
         })
       };
@@ -3658,7 +4395,7 @@ var createStore = (configDir, lock) => {
 };
 var refuseFlatLayout = (configDir) => {
   if (["server.json", "server.env", "compose.yaml", "postgres-init.sh"].some(
-    (name) => fs7.existsSync(path7.join(configDir, name))
+    (name) => fs9.existsSync(path9.join(configDir, name))
   )) {
     throw new ServerStoreError(
       "Unreleased flat server configuration found. Preserve its credentials and volumes; migrate it to the generation layout before retrying. Setup will not replace this identity."
@@ -3666,7 +4403,7 @@ var refuseFlatLayout = (configDir) => {
   }
 };
 var withServerStore = async (directory, operation, options = {}) => {
-  const configDir = path7.resolve(directory);
+  const configDir = path9.resolve(directory);
   let lock;
   let result;
   try {
@@ -3676,16 +4413,16 @@ var withServerStore = async (directory, operation, options = {}) => {
   } catch (cause) {
     result = { _tag: "error", error: storeError(cause) };
   } finally {
-    const release = lock?.release();
-    if (release?._tag === "error") result = release;
+    const release2 = lock?.release();
+    if (release2?._tag === "error") result = release2;
   }
   return result;
 };
 
 // src/version.ts
-import * as fs8 from "node:fs";
+import * as fs10 from "node:fs";
 var cliVersion = () => {
-  const raw = fs8.readFileSync(new URL("../package.json", import.meta.url), "utf8");
+  const raw = fs10.readFileSync(new URL("../package.json", import.meta.url), "utf8");
   const parsed = JSON.parse(raw);
   if (typeof parsed === "object" && parsed !== null && "version" in parsed) {
     const version = parsed.version;
@@ -3855,7 +4592,7 @@ var parseHttpOrigin = (input, label) => {
   return parsed.origin;
 };
 var isLoopbackBind = (bind) => bind === "127.0.0.1" || bind === "::1" || bind.startsWith("127.");
-var isLoopbackHost = (hostname6) => hostname6 === "localhost" || hostname6 === "::1" || hostname6 === "[::1]" || hostname6.startsWith("127.");
+var isLoopbackHost = (hostname7) => hostname7 === "localhost" || hostname7 === "::1" || hostname7 === "[::1]" || hostname7.startsWith("127.");
 var resolveAppUrl = (existing, options, appPort) => {
   const oldLocalUrl = existing === null ? null : `http://localhost:${existing.appPort}`;
   const portChangedOnLocalhost = options.appPort !== void 0 && existing?.appUrl === oldLocalUrl;
@@ -4317,6 +5054,30 @@ var readServerInstallation = (store) => {
     };
   }
 };
+var envKeyNames = (env) => env.split("\n").flatMap((line) => {
+  const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=/.exec(line);
+  return match?.[1] === void 0 ? [] : [match[1]];
+});
+var readServerInstallationFacts = async (configDir) => {
+  const result = await withServerStore(
+    configDir,
+    async (store) => {
+      const installation = storeValue(readServerInstallation(store));
+      if (installation === null) return null;
+      const generation = storeValue(store.readActive());
+      if (generation === null) return null;
+      return {
+        directory: installation.directory,
+        config: installation.config,
+        compose: generation.files.compose,
+        envKeys: envKeyNames(generation.files.env)
+      };
+    },
+    { create: false }
+  );
+  if (result._tag === "error") throw result.error;
+  return result.value;
+};
 var persistSetup = (store, config, secrets, assets) => storeValue(
   store.prepare({
     identity: renderIdentity(secrets),
@@ -4364,7 +5125,7 @@ var resolveServerVersion = async (runtime, options, existing) => {
   return version;
 };
 var parseDockerSocketPath = (socket) => {
-  if (!path8.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
+  if (!path10.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
     throw setupError(
       "--docker-socket must be an absolute path without line breaks or Compose interpolation characters."
     );
@@ -4390,8 +5151,8 @@ var resolveAssets = async (runtime, serverVersion, existing, store, options) =>
   if (options.assetsDir !== void 0) {
     try {
       const [compose2, postgresInit2] = await Promise.all([
-        readFile(path8.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
-        readFile(path8.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
+        readFile(path10.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
+        readFile(path10.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
       ]);
       validateComposeAsset(compose2);
       validatePostgresAsset(postgresInit2);
@@ -4904,10 +5665,10 @@ var manageServer = async (command, args, runtime, store) => {
 };
 var nodeServerRuntime = () => {
   const environment = { ...process.env };
-  const home = os5.homedir();
-  const configHome = environment["XDG_CONFIG_HOME"] ?? path8.join(home, ".config");
+  const home = os6.homedir();
+  const configHome = environment["XDG_CONFIG_HOME"] ?? path10.join(home, ".config");
   return {
-    configDir: path8.join(configHome, "mend"),
+    configDir: path10.join(configHome, "mend"),
     platform: process.platform,
     cliVersion: cliVersion(),
     run: (command, args, options) => runServerProcess(command, args, environment, options),
@@ -4924,7 +5685,7 @@ var nodeServerRuntime = () => {
       }
     },
     randomBytes,
-    sleep: (milliseconds) => new Promise((resolve6) => setTimeout(resolve6, milliseconds)),
+    sleep: (milliseconds) => new Promise((resolve7) => setTimeout(resolve7, milliseconds)),
     writeLine: (line) => process.stdout.write(`${line}
 `)
   };
@@ -5146,9 +5907,9 @@ var touchesSessionServices = (payload, sessionId) => {
     return false;
   }
   if (typeof parsed !== "object" || parsed === null) return false;
-  const type = "type" in parsed ? parsed.type : void 0;
+  const type2 = "type" in parsed ? parsed.type : void 0;
   const session = "sessionId" in parsed ? parsed.sessionId : void 0;
-  return (type === "session-process" || type === "session") && session === sessionId;
+  return (type2 === "session-process" || type2 === "session") && session === sessionId;
 };
 var pumpConnection = (socket, url) => {
   socket.pause();
@@ -5174,7 +5935,7 @@ var pumpConnection = (socket, url) => {
     () => socket.destroy()
   );
 };
-var listenLocal = (server, port, fallback) => new Promise((resolve6, reject) => {
+var listenLocal = (server, port, fallback) => new Promise((resolve7, reject) => {
   const attempt2 = (candidate, lastTry) => {
     const onError = (error) => {
       if (!lastTry) {
@@ -5187,7 +5948,7 @@ var listenLocal = (server, port, fallback) => new Promise((resolve6, reject) =>
     server.listen(candidate, "127.0.0.1", () => {
       server.removeListener("error", onError);
       const address = server.address();
-      resolve6(typeof address === "object" && address !== null ? address.port : candidate);
+      resolve7(typeof address === "object" && address !== null ? address.port : candidate);
     });
   };
   attempt2(port, !fallback || port === 0);
@@ -5216,7 +5977,7 @@ var serverEvents = (config) => async (handlers, signal) => {
       if (signal.aborted) return;
     }
     connected = true;
-    await new Promise((resolve6) => setTimeout(resolve6, 2e3));
+    await new Promise((resolve7) => setTimeout(resolve7, 2e3));
   }
 };
 var createServiceTunnels = (options) => {
@@ -5359,8 +6120,8 @@ var createServiceTunnels = (options) => {
 };
 
 // src/skills.ts
-import * as fs9 from "node:fs";
-import * as path9 from "node:path";
+import * as fs11 from "node:fs";
+import * as path11 from "node:path";
 var DEFAULT_SKILLS_DIR = ".agents/skills";
 var MAX_SKILL_FILES = 64;
 var MAX_SKILL_FILE_BYTES = 512 * 1024;
@@ -5383,12 +6144,12 @@ var readFrontmatterDescription = (contents) => {
 var walkFiles = (root) => {
   const found = [];
   const visit = (dir) => {
-    for (const entry of fs9.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs11.readdirSync(dir, { withFileTypes: true })) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const absolute = path9.join(dir, entry.name);
+      const absolute = path11.join(dir, entry.name);
       let stat;
       try {
-        stat = fs9.statSync(absolute);
+        stat = fs11.statSync(absolute);
       } catch {
         continue;
       }
@@ -5402,7 +6163,7 @@ var walkFiles = (root) => {
 var scanSkillLibrary = (root) => {
   let entries;
   try {
-    entries = fs9.readdirSync(root, { withFileTypes: true });
+    entries = fs11.readdirSync(root, { withFileTypes: true });
   } catch {
     return { error: `${root} is not a readable directory` };
   }
@@ -5410,23 +6171,23 @@ var scanSkillLibrary = (root) => {
   const notes = [];
   for (const entry of entries.toSorted((a, b) => a.name.localeCompare(b.name))) {
     if (entry.name.startsWith(".")) continue;
-    const skillDir = path9.join(root, entry.name);
+    const skillDir = path11.join(root, entry.name);
     let stat;
     try {
-      stat = fs9.statSync(skillDir);
+      stat = fs11.statSync(skillDir);
     } catch {
       continue;
     }
     if (!stat.isDirectory()) continue;
-    if (!fs9.existsSync(path9.join(skillDir, "SKILL.md"))) {
+    if (!fs11.existsSync(path11.join(skillDir, "SKILL.md"))) {
       notes.push({ skill: entry.name, message: "no SKILL.md \u2014 skipped" });
       continue;
     }
     const files = [];
     let bytes = 0;
     for (const absolute of walkFiles(skillDir)) {
-      const relative4 = path9.relative(skillDir, absolute).split(path9.sep).join("/");
-      const buffer = fs9.readFileSync(absolute);
+      const relative4 = path11.relative(skillDir, absolute).split(path11.sep).join("/");
+      const buffer = fs11.readFileSync(absolute);
       if (buffer.byteLength > MAX_SKILL_FILE_BYTES) {
         notes.push({ skill: entry.name, message: `${relative4} is over 512KB \u2014 skipped` });
         continue;
@@ -5461,16 +6222,16 @@ var scanSkillLibrary = (root) => {
 };
 
 // src/ssh-setup.ts
-import * as os7 from "node:os";
-import * as path11 from "node:path";
+import * as os8 from "node:os";
+import * as path13 from "node:path";
 
 // ../../packages/workspace-ssh/src/index.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash3 } from "node:crypto";
-import * as fs10 from "node:fs";
+import * as fs12 from "node:fs";
 import { isIP as isIP2 } from "node:net";
-import * as os6 from "node:os";
-import * as path10 from "node:path";
+import * as os7 from "node:os";
+import * as path12 from "node:path";
 var LEGACY_BLOCK_BEGIN = "# >>> mend workspace ssh (managed by `mend ssh setup`) >>>";
 var LEGACY_BLOCK_END = "# <<< mend workspace ssh <<<";
 var WorkspaceSshError = class extends Error {
@@ -5487,16 +6248,16 @@ var WorkspaceSshError = class extends Error {
 };
 var success = (value) => ({ ok: true, value });
 var failure = (error) => ({ ok: false, error });
-var stripIpv6Brackets = (hostname6) => hostname6.startsWith("[") && hostname6.endsWith("]") ? hostname6.slice(1, -1) : hostname6;
+var stripIpv6Brackets = (hostname7) => hostname7.startsWith("[") && hostname7.endsWith("]") ? hostname7.slice(1, -1) : hostname7;
 var hashIdentity = (identity) => createHash3("sha256").update(identity).digest("hex").slice(0, 24);
-var aliasLabel = (hostname6) => {
-  const label = hostname6.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 24);
+var aliasLabel = (hostname7) => {
+  const label = hostname7.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 24);
   return label === "" ? "server" : label;
 };
 var parseHostOverride = (raw) => {
-  const hostname6 = raw.trim();
-  if (hostname6 === "") return failure(new WorkspaceSshError("target", "SSH hostname is empty."));
-  if (hostname6.includes("://") || /[\s/@]/.test(hostname6)) {
+  const hostname7 = raw.trim();
+  if (hostname7 === "") return failure(new WorkspaceSshError("target", "SSH hostname is empty."));
+  if (hostname7.includes("://") || /[\s/@]/.test(hostname7)) {
     return failure(
       new WorkspaceSshError(
         "target",
@@ -5504,7 +6265,7 @@ var parseHostOverride = (raw) => {
       )
     );
   }
-  if (/^[^:]+:\d+$/.test(hostname6)) {
+  if (/^[^:]+:\d+$/.test(hostname7)) {
     return failure(
       new WorkspaceSshError(
         "target",
@@ -5512,11 +6273,11 @@ var parseHostOverride = (raw) => {
       )
     );
   }
-  if ((hostname6.startsWith("[") || hostname6.endsWith("]")) && !/^\[[^\]]+\]$/.test(hostname6)) {
+  if ((hostname7.startsWith("[") || hostname7.endsWith("]")) && !/^\[[^\]]+\]$/.test(hostname7)) {
     return failure(new WorkspaceSshError("target", "SSH hostname contains invalid IPv6 brackets."));
   }
-  const unbracketed = stripIpv6Brackets(hostname6);
-  if ((hostname6.startsWith("[") || unbracketed.includes(":")) && isIP2(unbracketed) !== 6) {
+  const unbracketed = stripIpv6Brackets(hostname7);
+  if ((hostname7.startsWith("[") || unbracketed.includes(":")) && isIP2(unbracketed) !== 6) {
     return failure(
       new WorkspaceSshError("target", "SSH hostname contains an invalid IPv6 address.")
     );
@@ -5557,8 +6318,8 @@ var blockBegin = (alias) => `# >>> mend workspace ssh ${alias} (managed) >>>`;
 var blockEnd = (alias) => `# <<< mend workspace ssh ${alias} <<<`;
 var hasControls = (value) => /[\p{Cc}\p{Zl}\p{Zp}]/u.test(value);
 var parseIdentityPath = (value) => {
-  const resolved = path10.resolve(
-    value.startsWith("~/") ? path10.join(os6.homedir(), value.slice(2)) : value
+  const resolved = path12.resolve(
+    value.startsWith("~/") ? path12.join(os7.homedir(), value.slice(2)) : value
   );
   if (value === "" || hasControls(value) || hasControls(resolved) || value.includes("${") || resolved.includes("${")) {
     return failure(
@@ -5714,7 +6475,7 @@ var agentKeys = () => {
 };
 var readText = (file) => {
   try {
-    return success(fs10.readFileSync(file, "utf8"));
+    return success(fs12.readFileSync(file, "utf8"));
   } catch (cause) {
     const error = cause instanceof Error && "code" in cause ? cause.code : void 0;
     return error === "ENOENT" ? success("") : failure(new WorkspaceSshError("key", `Could not read ${file}.`, cause));
@@ -5772,19 +6533,19 @@ var readRequiredKey = (keyPath, source) => {
 var readOptionalKey = (keyPath) => {
   const parsed = parseIdentityPath(keyPath);
   if (!parsed.ok) return parsed;
-  if (!fs10.existsSync(parsed.value) && !fs10.existsSync(publicKeyPath(parsed.value)))
+  if (!fs12.existsSync(parsed.value) && !fs12.existsSync(publicKeyPath(parsed.value)))
     return success(null);
   return readRequiredKey(parsed.value, "existing");
 };
 var pinAgentKey = (configHome, publicKey) => {
-  const identityFile = path10.resolve(
+  const identityFile = path12.resolve(
     configHome,
     "ssh",
     `agent-${hashIdentity(publicKeyIdentity(publicKey))}.pub`
   );
   try {
-    fs10.mkdirSync(path10.dirname(identityFile), { recursive: true, mode: 448 });
-    fs10.writeFileSync(identityFile, `${publicKey}
+    fs12.mkdirSync(path12.dirname(identityFile), { recursive: true, mode: 448 });
+    fs12.writeFileSync(identityFile, `${publicKey}
 `, { mode: 384 });
     return success({ publicKey, identityFile, source: "agent" });
   } catch (cause) {
@@ -5795,15 +6556,15 @@ var pinAgentKey = (configHome, publicKey) => {
 };
 var generateDedicatedKey = (privatePath) => {
   try {
-    fs10.mkdirSync(path10.dirname(privatePath), { recursive: true, mode: 448 });
+    fs12.mkdirSync(path12.dirname(privatePath), { recursive: true, mode: 448 });
   } catch (cause) {
     return failure(
-      new WorkspaceSshError("key", `Could not create ${path10.dirname(privatePath)}.`, cause)
+      new WorkspaceSshError("key", `Could not create ${path12.dirname(privatePath)}.`, cause)
     );
   }
   const generated = spawnSync3(
     "ssh-keygen",
-    ["-t", "ed25519", "-f", privatePath, "-N", "", "-C", `mend-${os6.hostname()}`],
+    ["-t", "ed25519", "-f", privatePath, "-N", "", "-C", `mend-${os7.hostname()}`],
     { encoding: "utf8", timeout: 3e3, stdio: ["ignore", "pipe", "pipe"] }
   );
   if (generated.status !== 0) {
@@ -5827,7 +6588,7 @@ var generateDedicatedKey = (privatePath) => {
   return fresh;
 };
 var dedicatedKey = (configHome, create) => {
-  const privatePath = path10.join(configHome, "ssh", "id_ed25519");
+  const privatePath = path12.join(configHome, "ssh", "id_ed25519");
   const existing = readOptionalKey(privatePath);
   if (existing.ok === false) return failure(existing.error);
   if (existing.value !== null || !create) return existing;
@@ -5875,10 +6636,10 @@ var writeWorkspaceSshConfig = (configFile, target, identityFile) => {
   const reconciled = reconcileWorkspaceSshConfig(before.value, target, identityFile);
   if (reconciled.ok === false) return failure(reconciled.error);
   try {
-    fs10.mkdirSync(path10.dirname(configFile), { recursive: true, mode: 448 });
-    fs10.chmodSync(path10.dirname(configFile), 448);
-    fs10.writeFileSync(configFile, reconciled.value, { mode: 384 });
-    fs10.chmodSync(configFile, 384);
+    fs12.mkdirSync(path12.dirname(configFile), { recursive: true, mode: 448 });
+    fs12.chmodSync(path12.dirname(configFile), 448);
+    fs12.writeFileSync(configFile, reconciled.value, { mode: 384 });
+    fs12.chmodSync(configFile, 384);
     return success(void 0);
   } catch (cause) {
     return failure(new WorkspaceSshError("config", `Could not write ${configFile}.`, cause));
@@ -5891,7 +6652,7 @@ var dim5 = ansi("2");
 var green5 = ansi("32");
 var warn = ansi("33");
 var say5 = (line) => console.log(line);
-var sshConfigPath = () => path11.join(os7.homedir(), ".ssh", "config");
+var sshConfigPath = () => path13.join(os8.homedir(), ".ssh", "config");
 var flagValue = (args, flag) => {
   const index = args.indexOf(flag);
   return index === -1 || args[index + 1] === void 0 ? null : String(args[index + 1]);
@@ -5961,7 +6722,7 @@ var setup = async (api2, cliHome, serverUrl, args) => {
   if (picked.value === null) return showFailure("No workspace SSH key is available.");
   const registered = await api2("POST", "/workspace-ssh/keys", {
     publicKey: picked.value.publicKey,
-    name: os7.hostname()
+    name: os8.hostname()
   });
   const sourceLabel = {
     explicit: "from --key",
@@ -6003,8 +6764,8 @@ var sshCommand = async (args, api2, cliHome, serverUrl) => {
 };
 
 // src/uninstall.ts
-import * as fs11 from "node:fs";
-import * as path12 from "node:path";
+import * as fs13 from "node:fs";
+import * as path14 from "node:path";
 var UNINSTALL_USAGE = "usage: mend uninstall [--all | --server | --home] [--yes]";
 var parseUninstallArgs = (args) => {
   let scope = null;
@@ -6026,14 +6787,14 @@ var parseUninstallArgs = (args) => {
 var SERVER_FILES = ["identity.env", "active", "generations", "backups"];
 var countEntries = (directory) => {
   try {
-    return fs11.readdirSync(directory).length;
+    return fs13.readdirSync(directory).length;
   } catch {
     return 0;
   }
 };
 var exists = (file) => {
   try {
-    fs11.lstatSync(file);
+    fs13.lstatSync(file);
     return true;
   } catch {
     return false;
@@ -6042,7 +6803,7 @@ var exists = (file) => {
 var managedBlockCount = (sshConfigFile) => {
   let config;
   try {
-    config = fs11.readFileSync(sshConfigFile, "utf8");
+    config = fs13.readFileSync(sshConfigFile, "utf8");
   } catch {
     return 0;
   }
@@ -6066,27 +6827,27 @@ var describeUninstall = async (runtime, scope) => {
       if (!read.error.message.startsWith("No Mend server is configured")) throw read.error;
       server = "none";
     } else if (read.value === null) {
-      server = exists(path12.join(configDir, "identity.env")) ? {
+      server = exists(path14.join(configDir, "identity.env")) ? {
         version: "(no active generation)",
         appUrl: "",
         dockerContext: "",
-        generations: countEntries(path12.join(configDir, "generations")),
-        backups: countEntries(path12.join(configDir, "backups"))
+        generations: countEntries(path14.join(configDir, "generations")),
+        backups: countEntries(path14.join(configDir, "backups"))
       } : "none";
     } else {
       server = {
         version: read.value.config.serverVersion,
         appUrl: read.value.config.appUrl,
         dockerContext: read.value.config.dockerContext,
-        generations: countEntries(path12.join(configDir, "generations")),
-        backups: countEntries(path12.join(configDir, "backups"))
+        generations: countEntries(path14.join(configDir, "generations")),
+        backups: countEntries(path14.join(configDir, "backups"))
       };
     }
   }
   let home = null;
   if (scope !== "server") {
-    const cliConfig = path12.join(runtime.cliHome, "cli.json");
-    const sshDirectory = path12.join(runtime.cliHome, "ssh");
+    const cliConfig = path14.join(runtime.cliHome, "cli.json");
+    const sshDirectory = path14.join(runtime.cliHome, "ssh");
     home = {
       cliConfig: exists(cliConfig) ? cliConfig : null,
       sshDirectory: exists(sshDirectory) ? sshDirectory : null,
@@ -6218,7 +6979,7 @@ var removeServer = async (runtime, failures, leftovers) => {
         }
       }
       for (const name of SERVER_FILES) {
-        fs11.rmSync(path12.join(configDir, name), { recursive: true, force: true });
+        fs13.rmSync(path14.join(configDir, name), { recursive: true, force: true });
       }
       server.writeLine(`removed ${configDir}/{identity.env, active, generations, backups}`);
     },
@@ -6229,20 +6990,20 @@ var removeServer = async (runtime, failures, leftovers) => {
 var removeHome = async (runtime, plan, failures, leftovers) => {
   const { server } = runtime;
   if (plan.cliConfig !== null) {
-    fs11.rmSync(plan.cliConfig, { force: true });
+    fs13.rmSync(plan.cliConfig, { force: true });
     server.writeLine(`removed ${plan.cliConfig}`);
   }
   if (plan.sshDirectory !== null) {
-    fs11.rmSync(plan.sshDirectory, { recursive: true, force: true });
+    fs13.rmSync(plan.sshDirectory, { recursive: true, force: true });
     server.writeLine(`removed ${plan.sshDirectory}`);
   }
   if (plan.managedSshBlocks > 0) {
     try {
-      const before = fs11.readFileSync(runtime.sshConfigFile, "utf8");
+      const before = fs13.readFileSync(runtime.sshConfigFile, "utf8");
       const stripped = stripManagedWorkspaceSshBlocks(before);
       if (!stripped.ok) throw stripped.error;
       if (stripped.value.removed > 0) {
-        fs11.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
+        fs13.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
         server.writeLine(
           `removed ${plural(stripped.value.removed, "managed block")} from ${runtime.sshConfigFile}`
         );
@@ -6255,12 +7016,12 @@ var removeHome = async (runtime, plan, failures, leftovers) => {
   }
   let remaining = [];
   try {
-    remaining = fs11.readdirSync(runtime.cliHome);
+    remaining = fs13.readdirSync(runtime.cliHome);
   } catch {
     return;
   }
   if (remaining.length === 0) {
-    fs11.rmdirSync(runtime.cliHome);
+    fs13.rmdirSync(runtime.cliHome);
     server.writeLine(`removed ${runtime.cliHome}`);
   } else {
     leftovers.push(
@@ -6324,19 +7085,19 @@ var upgradeUrl = async (input) => {
 // src/main.ts
 var mendCliHome = () => {
   const xdg = process.env["XDG_CONFIG_HOME"];
-  const preferred = path13.join(
-    xdg === void 0 || xdg === "" ? path13.join(os8.homedir(), ".config") : xdg,
+  const preferred = path15.join(
+    xdg === void 0 || xdg === "" ? path15.join(os9.homedir(), ".config") : xdg,
     "mend"
   );
-  const legacy = path13.join(os8.homedir(), ".mend");
-  return !fs12.existsSync(preferred) && fs12.existsSync(legacy) ? legacy : preferred;
+  const legacy = path15.join(os9.homedir(), ".mend");
+  return !fs14.existsSync(preferred) && fs14.existsSync(legacy) ? legacy : preferred;
 };
-var CONFIG_PATH = path13.join(mendCliHome(), "cli.json");
+var CONFIG_PATH = path15.join(mendCliHome(), "cli.json");
 var loadConfig = () => {
   let fileConfig = {};
-  if (fs12.existsSync(CONFIG_PATH)) {
+  if (fs14.existsSync(CONFIG_PATH)) {
     try {
-      fileConfig = JSON.parse(fs12.readFileSync(CONFIG_PATH, "utf8"));
+      fileConfig = JSON.parse(fs14.readFileSync(CONFIG_PATH, "utf8"));
     } catch {
       fail6(`could not parse ${CONFIG_PATH}`);
     }
@@ -6527,7 +7288,7 @@ var adopt = async (config, args) => {
   }
   const sourceIssue = repositoryCloneUrlIssue(source);
   if (sourceIssue !== null) return fail6(sourceIssue);
-  const projectName = name ?? normalizeProjectName(path13.basename(source, ".git"));
+  const projectName = name ?? normalizeProjectName(path15.basename(source, ".git"));
   const auth = authFlagIndex !== -1 && args[authFlagIndex + 1] !== void 0 ? String(args[authFlagIndex + 1]) : null;
   if (auth !== null && auth !== "ambient" && auth !== "mend-key" && auth !== "bridge") {
     return fail6(`--auth takes "ambient", "mend-key", or "bridge", not "${auth}"`);
@@ -6576,7 +7337,7 @@ var findProject = async (config, explicit, adoptCwd = false) => {
   const sourceIssue = repositoryCloneUrlIssue(facts.originUrl);
   if (sourceIssue !== null) return fail6(sourceIssue);
   const adopted = await api(config, "POST", "/projects", {
-    name: normalizeProjectName(path13.basename(facts.repoRoot)),
+    name: normalizeProjectName(path15.basename(facts.repoRoot)),
     source: facts.originUrl
   });
   say6(`${green6("\u2713")} adopted \xB7 ${adopted.name} \xB7 ${dim6(adopted.storePath)}`);
@@ -6743,8 +7504,8 @@ var attachTty = async (config, sessionId, harness, from, processId, options) =>
   const ws = new WebSocket(url);
   ws.binaryType = "arraybuffer";
   try {
-    await new Promise((resolve6, reject) => {
-      ws.addEventListener("open", () => resolve6(), { once: true });
+    await new Promise((resolve7, reject) => {
+      ws.addEventListener("open", () => resolve7(), { once: true });
       ws.addEventListener("error", () => reject(new Error("could not connect")), { once: true });
     });
   } catch {
@@ -6752,8 +7513,8 @@ var attachTty = async (config, sessionId, harness, from, processId, options) =>
   }
   const stopHerdrHint = hintHerdrAttachment(harness);
   let finishAttachment;
-  const finished = new Promise((resolve6) => {
-    finishAttachment = resolve6;
+  const finished = new Promise((resolve7) => {
+    finishAttachment = resolve7;
   });
   const onClose = () => finishAttachment?.();
   if (ws.readyState === WebSocket.CLOSED) finishAttachment?.();
@@ -7290,11 +8051,11 @@ var autoConnect = async (config, service) => {
 };
 var serviceRun = async (config, args) => {
   const dashdash = args.indexOf("--");
-  const usage = usageOf("service run");
+  const usage2 = usageOf("service run");
   if (dashdash === -1) {
     const positionals = args.filter((a) => !a.startsWith("--"));
     const name2 = positionals.at(-1);
-    if (name2 === void 0) return fail6(usage);
+    if (name2 === void 0) return fail6(usage2);
     const prefix2 = positionals.length > 1 ? positionals[0] : void 0;
     const session2 = await resolveLiveSession(config, prefix2, "service run");
     const recipes = await api(
@@ -7323,19 +8084,19 @@ var serviceRun = async (config, args) => {
     return;
   }
   const argv = args.slice(dashdash + 1);
-  if (argv.length === 0) return fail6(usage);
+  if (argv.length === 0) return fail6(usage2);
   const head = args.slice(0, dashdash);
   const portFlag = head.indexOf("--port");
   const port = portFlag === -1 ? Number.NaN : Number(head[portFlag + 1]);
-  if (!Number.isInteger(port) || port < 1 || port > 65535) return fail6(usage);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return fail6(usage2);
   const nameFlag = head.indexOf("--name");
   const name = nameFlag !== -1 && head[nameFlag + 1] !== void 0 ? String(head[nameFlag + 1]) : null;
   const protocol = head.includes("--udp") ? "udp" : "tcp";
   const http = head.includes("--http");
   const https = head.includes("--https");
-  if (http && https) return fail6(usage);
+  if (http && https) return fail6(usage2);
   const browserScheme = https ? "https" : http ? "http" : null;
-  if (protocol === "udp" && browserScheme !== null) return fail6(usage);
+  if (protocol === "udp" && browserScheme !== null) return fail6(usage2);
   const prefix = head.find(
     (a, i) => !a.startsWith("--") && i !== portFlag + 1 && i !== nameFlag + 1
   );
@@ -7408,7 +8169,7 @@ var serviceLogs = async (config, args) => {
     cursor = page.nextFrom;
     const ended = page.status === "exited" || page.status === "failed";
     if (ended && !advanced) break;
-    if (!advanced) await new Promise((resolve6) => setTimeout(resolve6, 250));
+    if (!advanced) await new Promise((resolve7) => setTimeout(resolve7, 250));
   }
   say6("");
   say6(dim6(`stream ended \xB7 next sequence ${cursor}`));
@@ -7426,13 +8187,13 @@ var serviceRestart = async (config, args) => {
 };
 var serviceInit = async (args) => {
   const root = gitTopLevel(process.cwd()) ?? process.cwd();
-  const target = path13.join(root, "mend.toml");
-  if (fs12.existsSync(target)) {
+  const target = path15.join(root, "mend.toml");
+  if (fs14.existsSync(target)) {
     return fail6(`${target} already exists \u2014 edit it directly (init never merges)`);
   }
-  const rootFiles = fs12.readdirSync(root);
+  const rootFiles = fs14.readdirSync(root);
   const proposals = [];
-  const readRoot = (name) => fs12.readFileSync(path13.join(root, name), "utf8");
+  const readRoot = (name) => fs14.readFileSync(path15.join(root, name), "utf8");
   if (rootFiles.includes("package.json")) {
     proposals.push(...proposeFromPackageJson(readRoot("package.json"), rootFiles));
   }
@@ -7442,13 +8203,13 @@ var serviceInit = async (args) => {
   );
   for (const glob of globs) {
     const parent = glob.replace(/\/?\*+$/, "");
-    const dirs = glob.endsWith("*") ? fs12.existsSync(path13.join(root, parent)) ? fs12.readdirSync(path13.join(root, parent)).map((dir) => path13.join(parent, dir)) : [] : [glob];
+    const dirs = glob.endsWith("*") ? fs14.existsSync(path15.join(root, parent)) ? fs14.readdirSync(path15.join(root, parent)).map((dir) => path15.join(parent, dir)) : [] : [glob];
     for (const dir of dirs) {
-      const manifest = path13.join(root, dir, "package.json");
-      if (!fs12.existsSync(manifest)) continue;
+      const manifest = path15.join(root, dir, "package.json");
+      if (!fs14.existsSync(manifest)) continue;
       for (const proposal of proposeFromWorkspacePackage(
-        path13.basename(dir),
-        fs12.readFileSync(manifest, "utf8"),
+        path15.basename(dir),
+        fs14.readFileSync(manifest, "utf8"),
         rootFiles
       )) {
         if (!proposals.some((existing) => existing.name === proposal.name)) {
@@ -7492,7 +8253,7 @@ var serviceInit = async (args) => {
       return;
     }
   }
-  fs12.writeFileSync(target, toml);
+  fs14.writeFileSync(target, toml);
   say6(`${green6("\u2713")} wrote ${target} \u2014 commit it, then: mend service run ${proposals[0]?.name}`);
 };
 var tunnelServices = async (config, services, portOverride) => {
@@ -7540,7 +8301,7 @@ var attachTunnels = (config, optOut) => {
     start: async (sessionId) => {
       await Promise.race([
         tunnels.focus(sessionId),
-        new Promise((resolve6) => setTimeout(resolve6, 3e3))
+        new Promise((resolve7) => setTimeout(resolve7, 3e3))
       ]);
     },
     attached: (work) => {
@@ -7596,18 +8357,18 @@ var serviceCommand = async (config, args) => {
   }
 };
 var isProvider = (value) => value === "claude" || value === "codex" || value === "github";
-var readIfExists = (file) => fs12.existsSync(file) ? fs12.readFileSync(file, "utf8") : null;
+var readIfExists = (file) => fs14.existsSync(file) ? fs14.readFileSync(file, "utf8") : null;
 var localCredential = (provider) => {
-  const home = os8.homedir();
+  const home = os9.homedir();
   switch (provider) {
     case "codex":
       return readIfExists(
-        path13.join(process.env["CODEX_HOME"] ?? path13.join(home, ".codex"), "auth.json")
+        path15.join(process.env["CODEX_HOME"] ?? path15.join(home, ".codex"), "auth.json")
       );
     case "claude":
       return readIfExists(
-        path13.join(
-          process.env["CLAUDE_CONFIG_DIR"] ?? path13.join(home, ".claude"),
+        path15.join(
+          process.env["CLAUDE_CONFIG_DIR"] ?? path15.join(home, ".claude"),
           ".credentials.json"
         )
       );
@@ -7631,19 +8392,64 @@ var accountLine = (account) => {
   ].filter((fact) => fact !== null);
   return `${account.provider.padEnd(8)} ${facts.join(" \xB7 ")}`;
 };
-var accountsCommand = async (config) => {
-  const identity = await api(config, "GET", "/me/sealant");
-  process.stdout.write(`platform user ${identity.sealantUserId}
-`);
+var accountsLines = async (config) => {
+  const identity = await request(config, "GET", "/me/sealant");
   const providers = ["claude", "codex", "github"];
-  for (const provider of providers) {
-    const account = identity.accounts.find((row) => row.provider === provider && row.name === "default") ?? identity.accounts.find((row) => row.provider === provider);
-    process.stdout.write(
-      `  ${account === void 0 ? `${provider.padEnd(8)} not connected` : accountLine(account)}
-`
-    );
+  return [
+    `platform user ${identity.sealantUserId}`,
+    ...providers.map((provider) => {
+      const account = identity.accounts.find((row) => row.provider === provider && row.name === "default") ?? identity.accounts.find((row) => row.provider === provider);
+      return `  ${account === void 0 ? `${provider.padEnd(8)} not connected` : accountLine(account)}`;
+    })
+  ];
+};
+var accountsCommand = async (config) => {
+  let lines;
+  try {
+    lines = await accountsLines(config);
+  } catch (error) {
+    return fail6(error instanceof Error ? error.message : String(error));
   }
+  for (const line of lines) process.stdout.write(`${line}
+`);
 };
+var claudeGrantSecret = () => {
+  const read = readGrant(claudeGrantDir(mendCliHome()));
+  return read.kind === "missing" ? null : read.secret;
+};
+var doctorBundle = (config, args) => doctorBundleCommand(args, {
+  defaultDir: path15.join(mendCliHome(), "bundles"),
+  now: () => /* @__PURE__ */ new Date(),
+  say: say6,
+  warn: (line) => process.stderr.write(`${line}
+`),
+  collectors: (tail) => bundleCollectors({
+    cliVersion: cliVersion(),
+    serverUrl: config.url,
+    configuredUrl: config.configuredUrl,
+    deviceId: config.deviceId,
+    tokenSaved: config.token !== null,
+    env: process.env,
+    stdinTty: process.stdin.isTTY === true,
+    stdoutTty: process.stdout.isTTY === true,
+    get: (route) => request(config, "GET", route),
+    doctor: async () => {
+      const checks = await runChecks(config, {
+        localCredential,
+        claudeGrant: claudeGrantSecret,
+        onPath
+      });
+      return `${checks.map((check) => formatCheck(check)).join("\n")}
+`;
+    },
+    accounts: async () => `${(await accountsLines(config)).join("\n")}
+`,
+    run: (command, commandArgs, timeoutMs) => runServerProcess(command, commandArgs, process.env, { timeoutMs }),
+    readServer: () => readServerInstallationFacts(nodeServerRuntime().configDir),
+    pathOf,
+    tail
+  })
+});
 var minuteOrUnknown = (at) => at === null ? "unknown" : at.toISOString().slice(0, 16);
 var staleGrantReason = (secret) => {
   const facts = claudeGrantFacts(secret);
@@ -7676,7 +8482,7 @@ var claudeGrant = async () => {
       return null;
     }
   }
-  if (status.configDirectory !== null && path13.resolve(status.configDirectory) !== path13.resolve(dir)) {
+  if (status.configDirectory !== null && path15.resolve(status.configDirectory) !== path15.resolve(dir)) {
     fail6(
       `claude: this Claude read ${status.configDirectory} instead of ${dir}, so a separate grant is not possible \u2014 connect the shared one deliberately with --use-my-login`
     );
@@ -7739,7 +8545,7 @@ var connectCommand = async (config, args) => {
   }
   let secret;
   if (flags.includes("--from-stdin")) {
-    secret = fs12.readFileSync(0, "utf8").trim();
+    secret = fs14.readFileSync(0, "utf8").trim();
     if (secret === "") return fail6("nothing on stdin");
   } else if (provider === "claude" && !flags.includes("--use-my-login")) {
     secret = await claudeGrant();
@@ -7785,14 +8591,14 @@ var takeFlagValue4 = (args, flag) => {
   return at !== -1 && args[at + 1] !== void 0 ? String(args[at + 1]) : null;
 };
 var saveCliConfig = (next) => {
-  fs12.mkdirSync(path13.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
-  fs12.writeFileSync(
+  fs14.mkdirSync(path15.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
+  fs14.writeFileSync(
     CONFIG_PATH,
     `${JSON.stringify({ url: next.url, token: next.token, deviceId: next.deviceId }, null, 2)}
 `,
     { mode: 384 }
   );
-  fs12.chmodSync(CONFIG_PATH, 384);
+  fs14.chmodSync(CONFIG_PATH, 384);
 };
 var login = async (config, args) => {
   await loginCommand(args, {
@@ -7805,7 +8611,7 @@ var login = async (config, args) => {
   });
 };
 var logout = async (config) => {
-  if (!fs12.existsSync(CONFIG_PATH) && config.token === null) {
+  if (!fs14.existsSync(CONFIG_PATH) && config.token === null) {
     say6(dim6("nothing saved \u2014 already signed out"));
     return;
   }
@@ -7858,8 +8664,8 @@ var uninstallCommand = async (config, args) => {
   const runtime = {
     server,
     cliHome: mendCliHome(),
-    sshConfigFile: path13.join(os8.homedir(), ".ssh", "config"),
-    signedIn: config.token === null || !fs12.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
+    sshConfigFile: path15.join(os9.homedir(), ".ssh", "config"),
+    signedIn: config.token === null || !fs14.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
     revokeDevice: async () => {
       if (config.deviceId === null) return "no device id saved";
       try {
@@ -7923,7 +8729,7 @@ var keysShare = async (config) => {
     return fail6("SSH_AUTH_SOCK is not set \u2014 start (or plug in) your ssh-agent first");
   }
   await shareAgent({
-    url: () => socketUrl(config, "keys-bridge", { host: os8.hostname() }),
+    url: () => socketUrl(config, "keys-bridge", { host: os9.hostname() }),
     agentSock,
     signal: new AbortController().signal,
     onEvent: (event) => {
@@ -8053,7 +8859,7 @@ ${usageOf("dotfiles repo")}`);
 var dotfilesSync = async (config, args) => {
   const all = args.includes("--all");
   const requestedPaths = args.filter((arg) => !arg.startsWith("--"));
-  const home = os8.homedir();
+  const home = os9.homedir();
   if (!all && requestedPaths.length === 0) {
     const found = scanDotfileCandidates(home);
     if (found.length === 0) {
@@ -8080,13 +8886,13 @@ var dotfilesSync = async (config, args) => {
   if ("error" in read) return fail6(read.error);
   const result = await api(config, "POST", "/dotfiles/snapshot", {
     files: read.files,
-    source: os8.hostname(),
+    source: os9.hostname(),
     merge: false
   });
   const snapshot = result.snapshot;
   if (snapshot === null) return fail6("the server accepted the sync but reports no snapshot");
   say6(
-    `${green6("synced")} ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} from ${os8.hostname()} \xB7 ${dim6(snapshot.sha.slice(0, 7))} ${dim6("\u2014 applies from the next session launch")}`
+    `${green6("synced")} ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} from ${os9.hostname()} \xB7 ${dim6(snapshot.sha.slice(0, 7))} ${dim6("\u2014 applies from the next session launch")}`
   );
 };
 var envLoad = async (config, args) => {
@@ -8100,10 +8906,10 @@ var envLoad = async (config, args) => {
   const positional = args.filter(
     (arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project" && !consumed.has(i)
   );
-  const file = path13.resolve(positional[0] ?? ".env");
+  const file = path15.resolve(positional[0] ?? ".env");
   let contents;
   try {
-    contents = fs12.readFileSync(file, "utf8");
+    contents = fs14.readFileSync(file, "utf8");
   } catch {
     return fail6(`cannot read ${file} \u2014 pass a path: mend env load path/to/.env`);
   }
@@ -8119,10 +8925,10 @@ var envLoad = async (config, args) => {
     { contents, allSecret, secretNames }
   );
   if (report.loaded.length === 0 && report.rejected.length === 0 && report.malformedLines.length === 0) {
-    say6(dim6(`${path13.basename(file)} has no variables`));
+    say6(dim6(`${path15.basename(file)} has no variables`));
     return;
   }
-  say6(`${green6("\u2713")} loaded ${path13.basename(file)} into ${project2.name}`);
+  say6(`${green6("\u2713")} loaded ${path15.basename(file)} into ${project2.name}`);
   for (const line of formatLoadReport(report, { dim: dim6, warn: amber2 })) say6(line);
   const plaintextUrls = report.loaded.filter(
     (entry) => entry.lane === "configuration" && /_(URL|URI|DSN)$/.test(entry.name)
@@ -8196,7 +9002,7 @@ var envCluster = async (config, args) => {
   const explicitProject = takeFlagValue4(args, "--project");
   const positional = args.filter((arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project");
   const [verb, ...rest] = positional;
-  const usage = usageOf("env cluster");
+  const usage2 = usageOf("env cluster");
   const project2 = await findProject(config, explicitProject);
   const route = `/projects/${project2.id}/cluster-bindings`;
   const appliesLine = () => say6(
@@ -8208,7 +9014,7 @@ var envCluster = async (config, args) => {
     const [kind, objectName] = rest;
     if (kind !== "secret" && kind !== "configmap" || objectName === void 0) {
       return fail6(`env cluster add takes a kind and an object name
-${usage}`);
+${usage2}`);
     }
     const result = await api(config, "POST", route, {
       kind,
@@ -8223,7 +9029,7 @@ ${usage}`);
     const [kind, objectName] = ref?.split("/", 2) ?? [];
     if (kind !== "secret" && kind !== "configmap" || objectName === void 0) {
       return fail6(`env cluster remove takes <kind>/<name>, e.g. secret/app-env
-${usage}`);
+${usage2}`);
     }
     const snapshot = await api(config, "GET", route);
     const binding = snapshot.bindings.find((b) => b.kind === kind && b.objectName === objectName);
@@ -8241,7 +9047,7 @@ ${usage}`);
     const [name] = rest;
     if (!clear && name === void 0)
       return fail6(`env cluster sa takes a name or --clear
-${usage}`);
+${usage2}`);
     const result = await api(
       config,
       "PUT",
@@ -8261,7 +9067,7 @@ ${usage}`);
     return appliesLine();
   }
   return fail6(`unknown env cluster command "${verb ?? ""}"
-${usage}`);
+${usage2}`);
 };
 var envCommand = async (config, args) => {
   const [verb, ...rest] = args;
@@ -8313,7 +9119,7 @@ var skillsList = async (config, args) => {
 };
 var skillsPush = async (config, args) => {
   const dirFlag = takeFlagValue4(args, "--dir");
-  const root = dirFlag === null ? path13.join(os8.homedir(), DEFAULT_SKILLS_DIR) : path13.resolve(dirFlag);
+  const root = dirFlag === null ? path15.join(os9.homedir(), DEFAULT_SKILLS_DIR) : path15.resolve(dirFlag);
   const scanned = scanSkillLibrary(root);
   if ("error" in scanned) return fail6(scanned.error);
   for (const note of scanned.notes) say6(dim6(`  ${note.skill}: ${note.message}`));
@@ -8765,7 +9571,7 @@ var sessionsCommand = async (config, args) => {
     say6(JSON.stringify(await buildWorktreesJson(config, projectName2), null, 2));
     return;
   }
-  const json = args.includes("--json");
+  const json2 = args.includes("--json");
   const projectFlag = args.indexOf("--project");
   const projectName = projectFlag !== -1 && args[projectFlag + 1] !== void 0 ? String(args[projectFlag + 1]) : null;
   const projects = await api(config, "GET", "/projects");
@@ -8774,7 +9580,7 @@ var sessionsCommand = async (config, args) => {
     return fail6(`no adopted project named "${projectName}"`);
   }
   let rows;
-  if (all || projectName !== null || !json) {
+  if (all || projectName !== null || !json2) {
     const details = await Promise.all(
       scope.map(
         (p) => api(config, "GET", `/projects/${p.id}${all ? "?deadEnds=include" : ""}`)
@@ -8800,7 +9606,7 @@ var sessionsCommand = async (config, args) => {
     }));
   }
   if (rows.length === 0) {
-    if (json) {
+    if (json2) {
       say6(JSON.stringify({ version: 1, sessions: [] }, null, 2));
       return;
     }
@@ -8815,7 +9621,7 @@ var sessionsCommand = async (config, args) => {
     if (aLive !== bLive) return bLive - aLive;
     return b.session.createdAt.localeCompare(a.session.createdAt);
   });
-  if (json) {
+  if (json2) {
     const payload = {
       version: 1,
       sessions: rows.map(({ session, projectName: rowProjectName, annotation }) => ({
@@ -8914,11 +9720,11 @@ var buildWorktreesJson = async (config, projectName) => {
   return { version: 2, worktrees };
 };
 var worktreesCommand = async (config, args) => {
-  const json = args.includes("--json");
+  const json2 = args.includes("--json");
   const projectFlag = args.indexOf("--project");
   const projectName = projectFlag !== -1 && args[projectFlag + 1] !== void 0 ? String(args[projectFlag + 1]) : null;
   const payload = await buildWorktreesJson(config, projectName);
-  if (json) {
+  if (json2) {
     say6(JSON.stringify(payload, null, 2));
     return;
   }
@@ -9009,7 +9815,7 @@ var startShareIfBridge = async (config) => {
   }
   if (access.mode !== "bridge") return null;
   return startAgentShare({
-    url: () => socketUrl(config, "keys-bridge", { host: os8.hostname() }),
+    url: () => socketUrl(config, "keys-bridge", { host: os9.hostname() }),
     agentSock
   });
 };
@@ -9049,10 +9855,10 @@ var manCommand = (words) => {
   }
   const version = cliVersion();
   const page = doc === null ? renderManIndex(version) : renderManPage(doc, version);
-  const file = path13.join(os8.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
-  fs12.writeFileSync(file, page);
+  const file = path15.join(os9.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
+  fs14.writeFileSync(file, page);
   const result = spawnSync4("man", ["-l", file], { stdio: "inherit" });
-  fs12.rmSync(file, { force: true });
+  fs14.rmSync(file, { force: true });
   if (result.error !== void 0 || result.status !== 0) {
     say6(doc === null ? renderIndex() : renderCommand(doc));
   }
@@ -9125,10 +9931,8 @@ var main = async () => {
     case "qr":
       return qrCommand(rest);
     case "doctor":
-      return doctorCommand(config, localCredential, () => {
-        const read = readGrant(claudeGrantDir(mendCliHome()));
-        return read.kind === "missing" ? null : read.secret;
-      });
+      if (rest.includes("--bundle")) return doctorBundle(config, rest);
+      return doctorCommand(config, localCredential, claudeGrantSecret);
     case "env":
       return envCommand(config, rest);
     case "ssh":