@sealant/mend 0.32.1 → 0.34.2

package/dist/main.js

@@ -4,6 +4,7 @@ import {
   LIVE_STATUSES,
   agentIsLive,
   agentOutcome,
+  captureLineOf,
   claudeGrantFacts,
   createSseParser,
   cwdFacts,
@@ -27,15 +28,15 @@ import {
   servicesHoldOf,
   sessionDisplayName,
   trackBracketedPaste
-} from "./chunk-J3TR4UAG.js";
+} from "./chunk-JJ66V76Y.js";
 
 // src/main.ts
-import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
-import * as fs14 from "node:fs";
+import { spawn as spawn3, spawnSync as spawnSync5 } from "node:child_process";
+import * as fs15 from "node:fs";
 import { createRequire } from "node:module";
 import * as net4 from "node:net";
-import * as os9 from "node:os";
-import * as path15 from "node:path";
+import * as os10 from "node:os";
+import * as path16 from "node:path";
 
 // src/agent-share.ts
 import * as net from "node:net";
@@ -1139,7 +1140,7 @@ var COMMANDS = [
     summary: "check this machine's setup, or bundle it for a bug report",
     synopsis: ["", "--bundle [--out <path>] [--tail <n>]"],
     description: [
-      "Read-only. One line per fact: the server, the sign-in, the platform connection, the provider accounts, the git key. Each unfinished line ends with the command that fixes it.",
+      "Read-only. One line per fact: the server, the sign-in, the platform connection, the provider accounts, the git key, and where docker is on PATH its daemon's shutdown-timeout against the capture grace. Each unfinished line ends with the command that fixes it.",
       "--bundle collects what a maintainer asks for one output at a time into one tar.gz: this CLI and its environment, the doctor lines, the server's health, the local server's configuration (its compose file and the names of its .env keys, never their values), docker version, info, contexts, the Mend and workspace containers with their inspect facts, the local server's container logs, the running workspace containers' logs, every session with its processes, exit codes and argv, the recorded terminal output of each, the connected accounts, and the versions and paths of claude, codex, gh, git and docker on this machine.",
       "Each part is collected on its own: one that fails leaves a <name>.error.txt in the bundle instead of stopping it. One redactor runs over every file before it is written: bearer and header values, Slack, OpenAI, GitHub and AWS token shapes, JWTs, passwords in URLs, and any password, secret or token value. The archive is written with mode 0600. It still contains logs and configuration; read it before you share it."
     ],
@@ -2505,8 +2506,333 @@ var doctorBundleCommand = async (args, deps) => {
 };
 
 // src/doctor.ts
+import * as fs6 from "node:fs";
+import * as path6 from "node:path";
+
+// src/docker-shutdown.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
 import * as fs5 from "node:fs";
+import * as os3 from "node:os";
 import * as path5 from "node:path";
+var DOCKER_CAPTURE_STOP_GRACE_SECONDS = 3600;
+var DOCKERD_DEFAULT_SHUTDOWN_TIMEOUT_SECONDS = 15;
+var flagValue = (argv, name) => {
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index] ?? "";
+    if (arg.startsWith(`${name}=`)) return arg.slice(name.length + 1);
+    if (arg === name) return argv[index + 1] ?? "";
+  }
+  return null;
+};
+var seconds = (value) => {
+  if (typeof value === "number" && Number.isInteger(value) && value >= 0) return value;
+  if (typeof value === "string" && /^\d+$/.test(value.trim())) return Number(value.trim());
+  return null;
+};
+var daemonKindOf = (info) => {
+  if (/docker desktop/i.test(info.operatingSystem)) return "desktop";
+  if (/orbstack/i.test(info.operatingSystem)) return "orbstack";
+  if (info.securityOptions.some((option) => option.includes("name=rootless"))) return "rootless";
+  return "dockerd";
+};
+var defaultConfigPath = (facts, daemon) => {
+  switch (daemon) {
+    case "desktop":
+      return path5.join(facts.home, ".docker", "daemon.json");
+    case "orbstack":
+      return path5.join(facts.home, ".orbstack", "config", "docker.json");
+    case "rootless":
+      return path5.join(
+        facts.xdgConfigHome ?? path5.join(facts.home, ".config"),
+        "docker",
+        "daemon.json"
+      );
+    case "dockerd":
+      return "/etc/docker/daemon.json";
+  }
+};
+var readShutdownTimeout = (facts) => {
+  if (facts.info === null) return { kind: "unknown", why: "docker info did not answer" };
+  const daemon = daemonKindOf(facts.info);
+  const managed = daemon === "desktop" || daemon === "orbstack";
+  const argv = managed ? null : facts.dockerdArgv;
+  const unresolved = facts.dockerdUnresolved ?? null;
+  if (argv === null && !managed && unresolved !== null) return { kind: "unknown", why: unresolved };
+  const configPath = (argv === null ? null : flagValue(argv, "--config-file")) ?? defaultConfigPath(facts, daemon);
+  if (argv !== null) {
+    const flag = flagValue(argv, "--shutdown-timeout");
+    if (flag !== null) {
+      const value = seconds(flag);
+      return value === null ? { kind: "unknown", why: `dockerd --shutdown-timeout ${flag} unreadable` } : {
+        kind: "observed",
+        seconds: value,
+        source: "dockerd --shutdown-timeout",
+        daemon,
+        configPath,
+        fromFlag: true
+      };
+    }
+  }
+  const file = facts.readFile(configPath);
+  if (file.kind === "unreadable") return { kind: "unknown", why: `${configPath} unreadable` };
+  if (file.kind === "read") {
+    let parsed;
+    try {
+      parsed = JSON.parse(file.text);
+    } catch {
+      return { kind: "unknown", why: `${configPath} is not JSON` };
+    }
+    const configured = typeof parsed === "object" && parsed !== null && "shutdown-timeout" in parsed ? parsed["shutdown-timeout"] : void 0;
+    if (configured !== void 0) {
+      const value = seconds(configured);
+      return value === null ? { kind: "unknown", why: `shutdown-timeout in ${configPath} unreadable` } : {
+        kind: "observed",
+        seconds: value,
+        source: configPath,
+        daemon,
+        configPath,
+        fromFlag: false
+      };
+    }
+  }
+  if (argv === null && !managed) {
+    return {
+      kind: "unknown",
+      why: `no dockerd process observed here \xB7 not set in ${configPath}`
+    };
+  }
+  return {
+    kind: "observed",
+    seconds: DOCKERD_DEFAULT_SHUTDOWN_TIMEOUT_SECONDS,
+    source: `dockerd default \xB7 not set in ${configPath}`,
+    daemon,
+    configPath,
+    fromFlag: false
+  };
+};
+var restartWords = (daemon) => {
+  switch (daemon) {
+    case "desktop":
+      return "restart Docker Desktop";
+    case "orbstack":
+      return "restart OrbStack";
+    case "rootless":
+      return "systemctl --user restart docker";
+    case "dockerd":
+      return "restart dockerd";
+  }
+};
+var raiseShutdownTimeoutWords = (reading, grace) => reading.fromFlag ? `raise dockerd --shutdown-timeout to ${grace}, then ${restartWords(reading.daemon)}` : `set "shutdown-timeout": ${grace} in ${reading.configPath}, then ${restartWords(reading.daemon)}`;
+var dockerShutdownCheck = (reading, grace = DOCKER_CAPTURE_STOP_GRACE_SECONDS) => {
+  if (reading.kind === "unknown") {
+    return {
+      label: "docker",
+      state: "todo",
+      detail: `shutdown-timeout not observed \xB7 ${reading.why}`,
+      fix: null
+    };
+  }
+  if (reading.seconds >= grace) {
+    return {
+      label: "docker",
+      state: "ok",
+      detail: `shutdown-timeout ${reading.seconds} s \xB7 ${reading.source} \xB7 covers the ${grace} s capture grace`,
+      fix: null
+    };
+  }
+  return {
+    label: "docker",
+    state: "todo",
+    detail: `shutdown-timeout ${reading.seconds} s \xB7 ${reading.source} \xB7 below the ${grace} s capture grace`,
+    fix: raiseShutdownTimeoutWords(reading, grace)
+  };
+};
+var dockerShutdownSetupLine = (reading, grace = DOCKER_CAPTURE_STOP_GRACE_SECONDS) => {
+  if (reading.kind === "unknown") {
+    return `Docker shutdown-timeout not observed (${reading.why}); a daemon shutdown below ${grace} s kills capture workspaces before they save. See docs/SELF-HOSTING.md.`;
+  }
+  if (reading.seconds >= grace) return null;
+  return `Docker shutdown-timeout is ${reading.seconds} s (${reading.source}), below the ${grace} s capture grace: a host restart or daemon stop kills capture workspaces after ${reading.seconds} s, before they save. To raise it: ${raiseShutdownTimeoutWords(reading, grace)}.`;
+};
+var parseDockerInfo = (stdout) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null || !("OperatingSystem" in parsed)) return null;
+  const operatingSystem = parsed.OperatingSystem;
+  if (typeof operatingSystem !== "string") return null;
+  const options = "SecurityOptions" in parsed ? parsed.SecurityOptions : [];
+  return {
+    operatingSystem,
+    securityOptions: Array.isArray(options) ? options.filter((option) => typeof option === "string") : []
+  };
+};
+var readHostFile = (file) => {
+  try {
+    return { kind: "read", text: fs5.readFileSync(file, "utf8") };
+  } catch (cause) {
+    return cause instanceof Error && "code" in cause && cause.code === "ENOENT" ? { kind: "absent" } : { kind: "unreadable" };
+  }
+};
+var hostProcView = {
+  list: (dir) => {
+    try {
+      return fs5.readdirSync(dir);
+    } catch {
+      return null;
+    }
+  },
+  read: (file) => {
+    try {
+      return fs5.readFileSync(file, "utf8");
+    } catch {
+      return null;
+    }
+  },
+  link: (file) => {
+    try {
+      return fs5.readlinkSync(file);
+    } catch {
+      return null;
+    }
+  }
+};
+var DOCKER_DEFAULT_HOST = "unix:///var/run/docker.sock";
+var socketPath = (file) => file.replace(/^\/var\/run\//, "/run/");
+var unixSocketOf = (host) => host.startsWith("unix://") && host.length > "unix://".length ? socketPath(host.slice("unix://".length)) : null;
+var hostFlags = (argv) => {
+  const hosts = [];
+  for (let index = 1; index < argv.length; index += 1) {
+    const arg = argv[index] ?? "";
+    for (const name of ["-H", "--host"]) {
+      if (arg === name) hosts.push(argv[index + 1] ?? "");
+      else if (arg.startsWith(`${name}=`)) hosts.push(arg.slice(name.length + 1));
+    }
+  }
+  return hosts;
+};
+var listeningInodes = (table, socket) => {
+  const inodes = /* @__PURE__ */ new Set();
+  for (const line of table.split("\n").slice(1)) {
+    const fields = line.trim().split(/\s+/);
+    const flags = fields[3];
+    const inode = fields[6];
+    const bound = fields.slice(7).join(" ");
+    if (flags === void 0 || inode === void 0 || bound === "") continue;
+    if ((Number.parseInt(flags, 16) & 65536) === 0) continue;
+    if (socketPath(bound) === socket) inodes.add(inode);
+  }
+  return inodes;
+};
+var observeDockerd = (proc, host) => {
+  const daemons = [];
+  for (const entry of proc.list("/proc") ?? []) {
+    if (!/^\d+$/.test(entry)) continue;
+    const cmdline = proc.read(`/proc/${entry}/cmdline`);
+    if (cmdline === null) continue;
+    const argv = cmdline.split("\0").filter((arg) => arg !== "");
+    if (path5.basename(argv[0] ?? "") === "dockerd") daemons.push({ pid: entry, argv });
+  }
+  if (daemons.length === 0) return { kind: "none" };
+  const socket = unixSocketOf(host);
+  if (socket === null) {
+    return {
+      kind: "unresolved",
+      why: `docker talks to ${host} \xB7 not a socket on this machine`
+    };
+  }
+  const selfTable = proc.read("/proc/self/net/unix");
+  const seenHere = selfTable === null ? /* @__PURE__ */ new Set() : listeningInodes(selfTable, socket);
+  const candidates = [];
+  for (const daemon of daemons) {
+    const hosts = hostFlags(daemon.argv);
+    const named = hosts.some((value) => unixSocketOf(value) === socket);
+    const activated = hosts.some((value) => value.startsWith("fd://"));
+    if (hosts.length > 0 && !named && !activated) continue;
+    const table = proc.read(`/proc/${daemon.pid}/net/unix`);
+    const listening = table === null ? null : listeningInodes(table, socket);
+    if (listening !== null) {
+      if (listening.size === 0) continue;
+      if (seenHere.size > 0 && ![...listening].some((inode) => seenHere.has(inode))) continue;
+    }
+    const fds = proc.list(`/proc/${daemon.pid}/fd`);
+    const held = fds === null || listening === null ? null : fds.some((fd) => {
+      const target = proc.link(`/proc/${daemon.pid}/fd/${fd}`);
+      const inode = target?.match(/^socket:\[(\d+)\]$/)?.[1];
+      return inode !== void 0 && listening.has(inode);
+    });
+    if (held === false) continue;
+    const nsPids = proc.read(`/proc/${daemon.pid}/status`)?.split("\n").find((line) => line.startsWith("NSpid:"))?.slice("NSpid:".length).trim().split(/\s+/);
+    candidates.push({
+      ...daemon,
+      owns: held === true,
+      named,
+      nested: nsPids !== void 0 && nsPids.length > 1
+    });
+  }
+  const narrowed = [
+    (candidate) => candidate.owns,
+    (candidate) => candidate.named,
+    (candidate) => !candidate.nested
+  ].reduce((left, prefer) => {
+    const preferred = left.filter(prefer);
+    return preferred.length > 0 ? preferred : left;
+  }, candidates);
+  const [only, ...others] = narrowed;
+  if (only !== void 0 && others.length === 0) {
+    return { kind: "observed", pid: only.pid, argv: only.argv };
+  }
+  const seen = `${daemons.length} dockerd process${daemons.length === 1 ? "" : "es"}`;
+  return {
+    kind: "unresolved",
+    why: only === void 0 ? `${seen} \xB7 none observed serving ${socket}` : `${seen} \xB7 could not tell which serves ${socket}`
+  };
+};
+var hostDockerEndpoint = () => {
+  const fromEnv = process.env["DOCKER_HOST"];
+  if (fromEnv !== void 0 && fromEnv.trim() !== "") return fromEnv.trim();
+  const context = spawnSync2(
+    "docker",
+    ["context", "inspect", "--format", "{{.Endpoints.docker.Host}}"],
+    {
+      encoding: "utf8",
+      timeout: 3e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }
+  );
+  const endpoint = context.status === 0 ? context.stdout.trim() : "";
+  return endpoint === "" ? DOCKER_DEFAULT_HOST : endpoint;
+};
+var dockerdFactsOf = (observation) => {
+  switch (observation.kind) {
+    case "observed":
+      return { dockerdArgv: observation.argv, dockerdUnresolved: null };
+    case "none":
+      return { dockerdArgv: null, dockerdUnresolved: null };
+    case "unresolved":
+      return { dockerdArgv: null, dockerdUnresolved: observation.why };
+  }
+};
+var hostDockerDaemonFacts = (infoStdout) => ({
+  info: infoStdout === null ? null : parseDockerInfo(infoStdout),
+  ...dockerdFactsOf(observeDockerd(hostProcView, hostDockerEndpoint())),
+  readFile: readHostFile,
+  home: os3.homedir(),
+  xdgConfigHome: process.env["XDG_CONFIG_HOME"] ?? null
+});
+var observeHostShutdownTimeout = () => {
+  const info = spawnSync2("docker", ["info", "--format", "{{json .}}"], {
+    encoding: "utf8",
+    timeout: 3e3,
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  return readShutdownTimeout(hostDockerDaemonFacts(info.status === 0 ? info.stdout : null));
+};
+
+// src/doctor.ts
 var TIMEOUT_MS = 3e3;
 var MARKS = { ok: "\u2713", todo: "\u25CB", failed: "\u2717" };
 var LABEL_WIDTH = 11;
@@ -2721,13 +3047,16 @@ var runChecks = async (config, probes) => {
   const machine = signedIn ? await getJson(config, "/machine") : null;
   const exposure = machine === null || machine.value === null ? void 0 : machine.value.exposure;
   checks.push(exposure === void 0 ? notChecked("exposure") : exposureCheck(exposure));
+  if (probes.dockerShutdown !== void 0 && probes.onPath("docker")) {
+    checks.push(dockerShutdownCheck(probes.dockerShutdown()));
+  }
   return checks;
 };
 var onPath = (command) => {
-  for (const directory of (process.env["PATH"] ?? "").split(path5.delimiter)) {
+  for (const directory of (process.env["PATH"] ?? "").split(path6.delimiter)) {
     if (directory === "") continue;
     try {
-      fs5.accessSync(path5.join(directory, command), fs5.constants.X_OK);
+      fs6.accessSync(path6.join(directory, command), fs6.constants.X_OK);
       return true;
     } catch {
     }
@@ -2740,15 +3069,20 @@ var paintMark = (state, mark) => {
   return `\x1B[${code}m${mark}\x1B[0m`;
 };
 var doctorCommand = async (config, localCredential2, claudeGrant2) => {
-  const checks = await runChecks(config, { localCredential: localCredential2, claudeGrant: claudeGrant2, onPath });
+  const checks = await runChecks(config, {
+    localCredential: localCredential2,
+    claudeGrant: claudeGrant2,
+    onPath,
+    dockerShutdown: observeHostShutdownTimeout
+  });
   for (const check of checks) process.stdout.write(`${formatCheck(check, paintMark)}
 `);
   if (checks.some((check) => check.state === "failed")) process.exitCode = 1;
 };
 
 // src/dotfiles.ts
-import * as fs6 from "node:fs";
-import * as path6 from "node:path";
+import * as fs7 from "node:fs";
+import * as path7 from "node:path";
 var DOTFILE_CANDIDATES = [
   {
     group: "shell",
@@ -2791,7 +3125,7 @@ var DOTFILE_CANDIDATES = [
 var MAX_FILE_BYTES = 1024 * 1024;
 var statFile = (home, relative4) => {
   try {
-    const stat = fs6.statSync(path6.join(home, relative4));
+    const stat = fs7.statSync(path7.join(home, relative4));
     return stat.isFile() ? stat : null;
   } catch {
     return null;
@@ -2804,9 +3138,9 @@ var scanDotfileCandidates = (home) => DOTFILE_CANDIDATES.flatMap(
   })
 );
 var homeRelativePath = (home, requested) => {
-  const relative4 = path6.relative(home, path6.resolve(home, requested));
-  const outside = relative4 === "" || relative4 === ".." || relative4.startsWith(`..${path6.sep}`) || path6.isAbsolute(relative4);
-  return outside ? null : relative4.split(path6.sep).join("/");
+  const relative4 = path7.relative(home, path7.resolve(home, requested));
+  const outside = relative4 === "" || relative4 === ".." || relative4.startsWith(`..${path7.sep}`) || path7.isAbsolute(relative4);
+  return outside ? null : relative4.split(path7.sep).join("/");
 };
 var readSyncFiles = (home, paths_) => {
   const files = [];
@@ -2826,7 +3160,7 @@ var readSyncFiles = (home, paths_) => {
     }
     files.push({
       path: relative4,
-      contentsBase64: fs6.readFileSync(path6.join(home, relative4)).toString("base64"),
+      contentsBase64: fs7.readFileSync(path7.join(home, relative4)).toString("base64"),
       // eslint-disable-next-line no-bitwise -- permission bits are the point
       mode: (stat.mode & 511).toString(8)
     });
@@ -2925,10 +3259,10 @@ var parseGitAuthorArgs = (args) => {
 var gitAuthorLine = (author) => `${author.name} <${author.email}> \xB7 ${author.source === "setting" ? "your setting" : "your account's name and email"}`;
 
 // src/landing.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import * as fs7 from "node:fs";
-import * as os3 from "node:os";
-import * as path7 from "node:path";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import * as fs8 from "node:fs";
+import * as os4 from "node:os";
+import * as path8 from "node:path";
 var paint = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}[0m` : text;
 var dim = paint("2");
 var green = paint("32");
@@ -3143,7 +3477,7 @@ var landCommand = async (api2, args) => {
   if (!landingSucceeded(report)) process.exitCode = 1;
 };
 var git = (cwd, args) => {
-  const result = spawnSync2("git", args, { cwd, encoding: "utf8" });
+  const result = spawnSync3("git", args, { cwd, encoding: "utf8" });
   return {
     status: result.status ?? 1,
     stdout: result.stdout ?? "",
@@ -3166,9 +3500,9 @@ var gitRemotes = (cwd) => {
 var remoteForOrigin = (remotes, originUrl, cwd) => {
   if (originUrl === null) return null;
   const origin = normalizeRemoteUrl(originUrl);
-  const originPath = origin === null ? path7.resolve(originUrl.replace(/^file:\/\//, "")) : null;
+  const originPath = origin === null ? path8.resolve(originUrl.replace(/^file:\/\//, "")) : null;
   return remotes.find(
-    (remote) => origin === null ? path7.resolve(cwd, remote.url.replace(/^file:\/\//, "")) === originPath : normalizeRemoteUrl(remote.url) === origin
+    (remote) => origin === null ? path8.resolve(cwd, remote.url.replace(/^file:\/\//, "")) === originPath : normalizeRemoteUrl(remote.url) === origin
   ) ?? null;
 };
 var LOG_LINES = 10;
@@ -3191,10 +3525,10 @@ var fetchBundle = (cwd, bundle) => {
   const before = git(cwd, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]);
   const previous = before.status === 0 ? before.stdout.trim() : null;
   if (previous !== bundle.tip) {
-    const dir = fs7.mkdtempSync(path7.join(os3.tmpdir(), "mend-pull-"));
+    const dir = fs8.mkdtempSync(path8.join(os4.tmpdir(), "mend-pull-"));
     try {
-      const file = path7.join(dir, "change.bundle");
-      fs7.writeFileSync(file, bundle.bytes, { mode: 384 });
+      const file = path8.join(dir, "change.bundle");
+      fs8.writeFileSync(file, bundle.bytes, { mode: 384 });
       const fetched = git(cwd, [
         "fetch",
         "--no-tags",
@@ -3204,7 +3538,7 @@ var fetchBundle = (cwd, bundle) => {
       ]);
       if (fetched.status !== 0) return refusedWith(gitWords(fetched));
     } finally {
-      fs7.rmSync(dir, { recursive: true, force: true });
+      fs8.rmSync(dir, { recursive: true, force: true });
     }
   }
   const after = git(cwd, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).stdout.trim();
@@ -3323,7 +3657,7 @@ var pullCommand = async (api2, download2, args, cwd = process.cwd()) => {
 
 // src/login.ts
 import { spawn as spawn2 } from "node:child_process";
-import * as os4 from "node:os";
+import * as os5 from "node:os";
 
 // src/pair.ts
 var paint2 = (code) => (text) => process.stdout.isTTY === true ? `\x1B[${code}m${text}\x1B[0m` : text;
@@ -3492,8 +3826,8 @@ var post = async (url, body) => {
 };
 var retryAfterSecondsOf = (json2) => {
   if (typeof json2 === "object" && json2 !== null && "retryAfterSeconds" in json2) {
-    const seconds = Number(json2.retryAfterSeconds);
-    if (Number.isFinite(seconds) && seconds > 0) return seconds;
+    const seconds2 = Number(json2.retryAfterSeconds);
+    if (Number.isFinite(seconds2) && seconds2 > 0) return seconds2;
   }
   return 5;
 };
@@ -3515,7 +3849,7 @@ var resolveServerUrl = async (args, deps) => {
 };
 var loginCommand = async (args, deps) => {
   const base = await resolveServerUrl(args, deps);
-  const started = await post(`${base}/api/cli/auth`, { name: os4.hostname() });
+  const started = await post(`${base}/api/cli/auth`, { name: os5.hostname() });
   if (started.status === 429) {
     return fail3(
       `the server asked for a pause \u2014 try again in ${retryAfterSecondsOf(started.json)}s`
@@ -3566,8 +3900,8 @@ var loginCommand = async (args, deps) => {
 };
 
 // src/organization.ts
-import * as fs8 from "node:fs";
-import * as path8 from "node:path";
+import * as fs9 from "node:fs";
+import * as path9 from "node:path";
 var paint4 = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}[0m` : text;
 var dim4 = paint4("2");
 var green4 = paint4("32");
@@ -3631,7 +3965,7 @@ var scanFolder = (dir) => {
   const files = [];
   const skipped = [];
   const walk = (relative4) => {
-    const entries = fs8.readdirSync(path8.join(dir, relative4), { withFileTypes: true }).toSorted((a, b) => a.name.localeCompare(b.name));
+    const entries = fs9.readdirSync(path9.join(dir, relative4), { withFileTypes: true }).toSorted((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       const child = relative4 === "" ? entry.name : `${relative4}/${entry.name}`;
       if (entry.isSymbolicLink()) {
@@ -3640,7 +3974,7 @@ var scanFolder = (dir) => {
         if (SKIPPED_DIRECTORIES.has(entry.name)) skipped.push({ path: child, reason: "skipped" });
         else walk(child);
       } else if (entry.isFile()) {
-        const size = fs8.statSync(path8.join(dir, child)).size;
+        const size = fs9.statSync(path9.join(dir, child)).size;
         if (size > FOLDER_FILE_BYTES) skipped.push({ path: child, reason: "over 1 MiB" });
         else files.push({ path: child, size });
       }
@@ -3693,7 +4027,7 @@ var folderCommand = async (api2, args) => {
     }
     case "push": {
       if (dir === void 0) return fail4("usage: mend folder push <name> <dir> [--replace]");
-      if (!fs8.existsSync(dir) || !fs8.statSync(dir).isDirectory()) {
+      if (!fs9.existsSync(dir) || !fs9.statSync(dir).isDirectory()) {
         return fail4(`${dir} is not a directory`);
       }
       const folder = await folderNamed(api2, name);
@@ -3708,7 +4042,7 @@ var folderCommand = async (api2, args) => {
           files: batch.map((file) => ({
             path: file.path,
             // Read one batch at a time, so a large tree never sits in memory at once.
-            contentsBase64: fs8.readFileSync(path8.join(dir, file.path)).toString("base64")
+            contentsBase64: fs9.readFileSync(path9.join(dir, file.path)).toString("base64")
           })),
           // --replace empties the folder with the first batch; the rest add to it.
           merge: !(replace && index === 0)
@@ -3892,8 +4226,8 @@ var operatorCommand = async (api2, tryApi, baseUrl, args) => {
 import { createHmac, randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import * as net2 from "node:net";
-import * as os6 from "node:os";
-import * as path10 from "node:path";
+import * as os7 from "node:os";
+import * as path11 from "node:path";
 
 // src/server-docker-volumes.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -4111,9 +4445,9 @@ var verifyServerDockerVolumes = (runtime, input) => ownership(runtime, input, "v
 
 // src/server-store.ts
 import { randomUUID } from "node:crypto";
-import * as fs9 from "node:fs";
-import * as os5 from "node:os";
-import * as path9 from "node:path";
+import * as fs10 from "node:fs";
+import * as os6 from "node:os";
+import * as path10 from "node:path";
 var ServerStoreError = class extends Error {
   _tag = "ServerStoreError";
 };
@@ -4134,28 +4468,28 @@ var attempt = (operation) => {
 var hasCode = (cause, code) => cause instanceof Error && "code" in cause && cause.code === code;
 var readOptional = (file) => {
   try {
-    return fs9.readFileSync(file, "utf8");
+    return fs10.readFileSync(file, "utf8");
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
   }
 };
 var syncDirectory = (directory) => {
-  const fd = fs9.openSync(directory, "r");
+  const fd = fs10.openSync(directory, "r");
   try {
-    fs9.fsyncSync(fd);
+    fs10.fsyncSync(fd);
   } finally {
-    fs9.closeSync(fd);
+    fs10.closeSync(fd);
   }
 };
 var writeDurable = (file, content, mode = 384) => {
-  const fd = fs9.openSync(file, "wx", mode);
+  const fd = fs10.openSync(file, "wx", mode);
   try {
-    fs9.writeFileSync(fd, content, "utf8");
-    fs9.fchmodSync(fd, mode);
-    fs9.fsyncSync(fd);
+    fs10.writeFileSync(fd, content, "utf8");
+    fs10.fchmodSync(fd, mode);
+    fs10.fsyncSync(fd);
   } finally {
-    fs9.closeSync(fd);
+    fs10.closeSync(fd);
   }
 };
 var fileKeys = ["identity", "config", "env", "compose", "postgresInit"];
@@ -4175,11 +4509,11 @@ var parseLockOwner = (raw) => {
 };
 var describeOwner = (lockDir) => {
   try {
-    const raw = JSON.parse(fs9.readFileSync(path9.join(lockDir, "owner.json"), "utf8"));
+    const raw = JSON.parse(fs10.readFileSync(path10.join(lockDir, "owner.json"), "utf8"));
     const owner = parseLockOwner(raw);
     if (owner === null) return "owner metadata is invalid";
     const label = `PID ${owner.pid} on ${owner.hostname}`;
-    if (owner.hostname !== os5.hostname()) return label;
+    if (owner.hostname !== os6.hostname()) return label;
     try {
       process.kill(owner.pid, 0);
       return `${label} is still live`;
@@ -4195,28 +4529,28 @@ var lockGuidance = (lockDir) => new ServerStoreError(
 );
 var acquireLock = (configDir, create) => {
   if (create) {
-    fs9.mkdirSync(configDir, { recursive: true, mode: 448 });
-    fs9.chmodSync(configDir, 448);
-  } else if (!fs9.existsSync(configDir)) {
+    fs10.mkdirSync(configDir, { recursive: true, mode: 448 });
+    fs10.chmodSync(configDir, 448);
+  } else if (!fs10.existsSync(configDir)) {
     throw new ServerStoreError(
       "No Mend server is configured. Run mend server setup explicitly to install one."
     );
   }
-  const lockDir = path9.join(configDir, "server.lock");
+  const lockDir = path10.join(configDir, "server.lock");
   try {
-    fs9.mkdirSync(lockDir, { mode: 448 });
+    fs10.mkdirSync(lockDir, { mode: 448 });
   } catch (cause) {
     if (hasCode(cause, "EEXIST")) throw lockGuidance(lockDir);
     throw cause;
   }
-  const owned = fs9.statSync(lockDir);
-  const ownerFile = path9.join(lockDir, "owner.json");
-  const owner = `${JSON.stringify({ pid: process.pid, hostname: os5.hostname(), token: randomUUID() })}
+  const owned = fs10.statSync(lockDir);
+  const ownerFile = path10.join(lockDir, "owner.json");
+  const owner = `${JSON.stringify({ pid: process.pid, hostname: os6.hostname(), token: randomUUID() })}
 `;
   let open = true;
   const assertOwned = () => {
-    const current = fs9.statSync(lockDir);
-    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs9.readFileSync(ownerFile, "utf8") !== owner) {
+    const current = fs10.statSync(lockDir);
+    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs10.readFileSync(ownerFile, "utf8") !== owner) {
       throw new ServerStoreError(
         "Server lock ownership was lost. Stop and check for another server command before retrying."
       );
@@ -4232,8 +4566,8 @@ var acquireLock = (configDir, create) => {
     release: () => {
       const result = attempt(() => {
         assertOwned();
-        fs9.unlinkSync(ownerFile);
-        fs9.rmdirSync(lockDir);
+        fs10.unlinkSync(ownerFile);
+        fs10.rmdirSync(lockDir);
       });
       open = false;
       return result;
@@ -4242,7 +4576,7 @@ var acquireLock = (configDir, create) => {
 };
 var readIdentity = (paths) => {
   const identity = readOptional(paths.identity);
-  if (identity === null && (fs9.existsSync(paths.active) || fs9.existsSync(paths.generations) && fs9.readdirSync(paths.generations).length > 0)) {
+  if (identity === null && (fs10.existsSync(paths.active) || fs10.existsSync(paths.generations) && fs10.readdirSync(paths.generations).length > 0)) {
     throw new ServerStoreError(
       "Server identity.env is missing. Restore it from a retained generation or backup; refusing to generate replacement credentials."
     );
@@ -4252,7 +4586,7 @@ var readIdentity = (paths) => {
 var readActive = (paths) => {
   let target;
   try {
-    target = fs9.readlinkSync(paths.active);
+    target = fs10.readlinkSync(paths.active);
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
@@ -4262,13 +4596,13 @@ var readActive = (paths) => {
       "Server active pointer is invalid. Restore the symlink to a retained generation before retrying."
     );
   }
-  const directory = path9.join(paths.configDir, target);
+  const directory = path10.join(paths.configDir, target);
   const files = {
-    identity: fs9.readFileSync(path9.join(directory, fileNames.identity), "utf8"),
-    config: fs9.readFileSync(path9.join(directory, fileNames.config), "utf8"),
-    env: fs9.readFileSync(path9.join(directory, fileNames.env), "utf8"),
-    compose: fs9.readFileSync(path9.join(directory, fileNames.compose), "utf8"),
-    postgresInit: fs9.readFileSync(path9.join(directory, fileNames.postgresInit), "utf8")
+    identity: fs10.readFileSync(path10.join(directory, fileNames.identity), "utf8"),
+    config: fs10.readFileSync(path10.join(directory, fileNames.config), "utf8"),
+    env: fs10.readFileSync(path10.join(directory, fileNames.env), "utf8"),
+    compose: fs10.readFileSync(path10.join(directory, fileNames.compose), "utf8"),
+    postgresInit: fs10.readFileSync(path10.join(directory, fileNames.postgresInit), "utf8")
   };
   if (readIdentity(paths) !== files.identity) {
     throw new ServerStoreError(
@@ -4278,20 +4612,20 @@ var readActive = (paths) => {
   return { directory, files };
 };
 var publishIdentity = (paths, identity) => {
-  const temporary = path9.join(paths.configDir, `.identity-${randomUUID()}`);
+  const temporary = path10.join(paths.configDir, `.identity-${randomUUID()}`);
   writeDurable(temporary, identity);
-  fs9.linkSync(temporary, paths.identity);
+  fs10.linkSync(temporary, paths.identity);
   syncDirectory(paths.configDir);
-  fs9.unlinkSync(temporary);
+  fs10.unlinkSync(temporary);
 };
 var prepareGeneration = (paths, files) => {
-  fs9.mkdirSync(paths.generations, { recursive: true, mode: 448 });
+  fs10.mkdirSync(paths.generations, { recursive: true, mode: 448 });
   const generationName = `gen-${randomUUID()}`;
-  const directory = path9.join(paths.generations, generationName);
-  fs9.mkdirSync(directory, { mode: 448 });
+  const directory = path10.join(paths.generations, generationName);
+  fs10.mkdirSync(directory, { mode: 448 });
   for (const key of fileKeys) {
     writeDurable(
-      path9.join(directory, fileNames[key]),
+      path10.join(directory, fileNames[key]),
       files[key],
       key === "postgresInit" ? 493 : 384
     );
@@ -4302,18 +4636,18 @@ var prepareGeneration = (paths, files) => {
   return { directory, files };
 };
 var activateGeneration = (paths, generation) => {
-  const relative4 = path9.relative(paths.configDir, generation.directory);
-  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative4) || readIdentity(paths) !== fs9.readFileSync(path9.join(generation.directory, "identity.env"), "utf8")) {
+  const relative4 = path10.relative(paths.configDir, generation.directory);
+  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative4) || readIdentity(paths) !== fs10.readFileSync(path10.join(generation.directory, "identity.env"), "utf8")) {
     throw new ServerStoreError("Cannot activate a generation outside this installation identity.");
   }
   for (const key of fileKeys) {
-    if (fs9.readFileSync(path9.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
+    if (fs10.readFileSync(path10.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
       throw new ServerStoreError("Cannot activate an incomplete or changed server generation.");
     }
   }
-  const pointer = path9.join(paths.configDir, `.active-${randomUUID()}`);
-  fs9.symlinkSync(relative4, pointer);
-  fs9.renameSync(pointer, paths.active);
+  const pointer = path10.join(paths.configDir, `.active-${randomUUID()}`);
+  fs10.symlinkSync(relative4, pointer);
+  fs10.renameSync(pointer, paths.active);
   syncDirectory(paths.configDir);
 };
 var prepareFiles = (paths, files) => {
@@ -4322,7 +4656,7 @@ var prepareFiles = (paths, files) => {
     throw new ServerStoreError("Server identity already exists; refusing to replace credentials.");
   }
   const active = readActive(paths);
-  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs9.statSync(path9.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
+  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs10.statSync(path10.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
     return active;
   if (identity === null) publishIdentity(paths, files.identity);
   return prepareGeneration(paths, files);
@@ -4335,9 +4669,9 @@ var commitGeneration = (paths, files) => {
 var createStore = (configDir, lock) => {
   const paths = {
     configDir,
-    identity: path9.join(configDir, "identity.env"),
-    generations: path9.join(configDir, "generations"),
-    active: path9.join(configDir, "active")
+    identity: path10.join(configDir, "identity.env"),
+    generations: path10.join(configDir, "generations"),
+    active: path10.join(configDir, "active")
   };
   const whileOwned = (operation) => attempt(() => {
     lock.assertOwned();
@@ -4350,13 +4684,13 @@ var createStore = (configDir, lock) => {
     prepare: (files) => whileOwned(() => prepareFiles(paths, files)),
     activate: (generation) => whileOwned(() => activateGeneration(paths, generation)),
     createBackup: (previous, target) => whileOwned(() => {
-      const backups = path9.join(configDir, "backups");
-      fs9.mkdirSync(backups, { recursive: true, mode: 448 });
-      fs9.chmodSync(backups, 448);
-      const directory = path9.join(backups, `upgrade-${randomUUID()}`);
-      fs9.mkdirSync(directory, { mode: 448 });
+      const backups = path10.join(configDir, "backups");
+      fs10.mkdirSync(backups, { recursive: true, mode: 448 });
+      fs10.chmodSync(backups, 448);
+      const directory = path10.join(backups, `upgrade-${randomUUID()}`);
+      fs10.mkdirSync(directory, { mode: 448 });
       writeDurable(
-        path9.join(directory, "recovery.json"),
+        path10.join(directory, "recovery.json"),
         `${JSON.stringify(
           {
             previousGeneration: previous.directory,
@@ -4372,21 +4706,21 @@ var createStore = (configDir, lock) => {
       syncDirectory(directory);
       syncDirectory(backups);
       syncDirectory(configDir);
-      const partialFile = path9.join(directory, "database.sql.partial");
+      const partialFile = path10.join(directory, "database.sql.partial");
       return {
         directory,
         partialFile,
         complete: () => whileOwned(() => {
-          if (fs9.statSync(partialFile).size === 0)
+          if (fs10.statSync(partialFile).size === 0)
             throw new ServerStoreError("Database backup is empty; refusing target startup.");
-          const fd = fs9.openSync(partialFile, "r");
+          const fd = fs10.openSync(partialFile, "r");
           try {
-            fs9.fchmodSync(fd, 384);
-            fs9.fsyncSync(fd);
+            fs10.fchmodSync(fd, 384);
+            fs10.fsyncSync(fd);
           } finally {
-            fs9.closeSync(fd);
+            fs10.closeSync(fd);
           }
-          fs9.renameSync(partialFile, path9.join(directory, "database.sql"));
+          fs10.renameSync(partialFile, path10.join(directory, "database.sql"));
           syncDirectory(directory);
         })
       };
@@ -4395,7 +4729,7 @@ var createStore = (configDir, lock) => {
 };
 var refuseFlatLayout = (configDir) => {
   if (["server.json", "server.env", "compose.yaml", "postgres-init.sh"].some(
-    (name) => fs9.existsSync(path9.join(configDir, name))
+    (name) => fs10.existsSync(path10.join(configDir, name))
   )) {
     throw new ServerStoreError(
       "Unreleased flat server configuration found. Preserve its credentials and volumes; migrate it to the generation layout before retrying. Setup will not replace this identity."
@@ -4403,7 +4737,7 @@ var refuseFlatLayout = (configDir) => {
   }
 };
 var withServerStore = async (directory, operation, options = {}) => {
-  const configDir = path9.resolve(directory);
+  const configDir = path10.resolve(directory);
   let lock;
   let result;
   try {
@@ -4420,9 +4754,9 @@ var withServerStore = async (directory, operation, options = {}) => {
 };
 
 // src/version.ts
-import * as fs10 from "node:fs";
+import * as fs11 from "node:fs";
 var cliVersion = () => {
-  const raw = fs10.readFileSync(new URL("../package.json", import.meta.url), "utf8");
+  const raw = fs11.readFileSync(new URL("../package.json", import.meta.url), "utf8");
   const parsed = JSON.parse(raw);
   if (typeof parsed === "object" && parsed !== null && "version" in parsed) {
     const version = parsed.version;
@@ -4554,21 +4888,21 @@ var parseSetupOptions = (args) => {
     previous.push(value);
     values.set(flag, previous);
   }
-  const flagValue2 = (flag) => values.get(flag)?.[0];
-  const version = flagValue2("--version");
-  const appPort = flagValue2("--port");
-  const sshPort = flagValue2("--ssh-port");
+  const flagValue3 = (flag) => values.get(flag)?.[0];
+  const version = flagValue3("--version");
+  const appPort = flagValue3("--port");
+  const sshPort = flagValue3("--ssh-port");
   const origins = values.get("--origin");
   return {
-    context: flagValue2("--context"),
+    context: flagValue3("--context"),
     version: version === void 0 ? void 0 : parseVersion(version),
-    bind: flagValue2("--bind"),
-    url: flagValue2("--url"),
+    bind: flagValue3("--bind"),
+    url: flagValue3("--url"),
     origins: origins === void 0 ? void 0 : origins,
     appPort: appPort === void 0 ? void 0 : parsePort(appPort, "--port"),
     sshPort: sshPort === void 0 ? void 0 : parsePort(sshPort, "--ssh-port"),
-    dockerSocket: flagValue2("--docker-socket"),
-    assetsDir: flagValue2("--assets-dir"),
+    dockerSocket: flagValue3("--docker-socket"),
+    assetsDir: flagValue3("--assets-dir"),
     offline: values.has("--offline")
   };
 };
@@ -5125,7 +5459,7 @@ var resolveServerVersion = async (runtime, options, existing) => {
   return version;
 };
 var parseDockerSocketPath = (socket) => {
-  if (!path10.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
+  if (!path11.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
     throw setupError(
       "--docker-socket must be an absolute path without line breaks or Compose interpolation characters."
     );
@@ -5151,8 +5485,8 @@ var resolveAssets = async (runtime, serverVersion, existing, store, options) =>
   if (options.assetsDir !== void 0) {
     try {
       const [compose2, postgresInit2] = await Promise.all([
-        readFile(path10.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
-        readFile(path10.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
+        readFile(path11.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
+        readFile(path11.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
       ]);
       validateComposeAsset(compose2);
       validatePostgresAsset(postgresInit2);
@@ -5344,6 +5678,19 @@ var setupServer = async (args, runtime, store) => {
   };
   const assets = await resolveAssets(runtime, serverVersion, existing, store, options);
   const bucket = composeBucket(assets.compose);
+  if (bucket !== void 0 && runtime.dockerDaemonFacts !== void 0) {
+    const info = await runtime.run("docker", [
+      "--context",
+      selectedContext.name,
+      "info",
+      "--format",
+      "{{json .}}"
+    ]);
+    const line = dockerShutdownSetupLine(
+      readShutdownTimeout(runtime.dockerDaemonFacts(info.status === 0 ? info.stdout : null))
+    );
+    if (line !== null) runtime.writeLine(line);
+  }
   const config = {
     ...configWithoutBucket,
     ...bucket === void 0 ? {} : { bucket }
@@ -5665,10 +6012,10 @@ var manageServer = async (command, args, runtime, store) => {
 };
 var nodeServerRuntime = () => {
   const environment = { ...process.env };
-  const home = os6.homedir();
-  const configHome = environment["XDG_CONFIG_HOME"] ?? path10.join(home, ".config");
+  const home = os7.homedir();
+  const configHome = environment["XDG_CONFIG_HOME"] ?? path11.join(home, ".config");
   return {
-    configDir: path10.join(configHome, "mend"),
+    configDir: path11.join(configHome, "mend"),
     platform: process.platform,
     cliVersion: cliVersion(),
     run: (command, args, options) => runServerProcess(command, args, environment, options),
@@ -5687,7 +6034,8 @@ var nodeServerRuntime = () => {
     randomBytes,
     sleep: (milliseconds) => new Promise((resolve7) => setTimeout(resolve7, milliseconds)),
     writeLine: (line) => process.stdout.write(`${line}
-`)
+`),
+    dockerDaemonFacts: hostDockerDaemonFacts
   };
 };
 var serverCommand = async (args, runtime = nodeServerRuntime()) => {
@@ -6120,8 +6468,8 @@ var createServiceTunnels = (options) => {
 };
 
 // src/skills.ts
-import * as fs11 from "node:fs";
-import * as path11 from "node:path";
+import * as fs12 from "node:fs";
+import * as path12 from "node:path";
 var DEFAULT_SKILLS_DIR = ".agents/skills";
 var MAX_SKILL_FILES = 64;
 var MAX_SKILL_FILE_BYTES = 512 * 1024;
@@ -6144,12 +6492,12 @@ var readFrontmatterDescription = (contents) => {
 var walkFiles = (root) => {
   const found = [];
   const visit = (dir) => {
-    for (const entry of fs11.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs12.readdirSync(dir, { withFileTypes: true })) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const absolute = path11.join(dir, entry.name);
+      const absolute = path12.join(dir, entry.name);
       let stat;
       try {
-        stat = fs11.statSync(absolute);
+        stat = fs12.statSync(absolute);
       } catch {
         continue;
       }
@@ -6163,7 +6511,7 @@ var walkFiles = (root) => {
 var scanSkillLibrary = (root) => {
   let entries;
   try {
-    entries = fs11.readdirSync(root, { withFileTypes: true });
+    entries = fs12.readdirSync(root, { withFileTypes: true });
   } catch {
     return { error: `${root} is not a readable directory` };
   }
@@ -6171,23 +6519,23 @@ var scanSkillLibrary = (root) => {
   const notes = [];
   for (const entry of entries.toSorted((a, b) => a.name.localeCompare(b.name))) {
     if (entry.name.startsWith(".")) continue;
-    const skillDir = path11.join(root, entry.name);
+    const skillDir = path12.join(root, entry.name);
     let stat;
     try {
-      stat = fs11.statSync(skillDir);
+      stat = fs12.statSync(skillDir);
     } catch {
       continue;
     }
     if (!stat.isDirectory()) continue;
-    if (!fs11.existsSync(path11.join(skillDir, "SKILL.md"))) {
+    if (!fs12.existsSync(path12.join(skillDir, "SKILL.md"))) {
       notes.push({ skill: entry.name, message: "no SKILL.md \u2014 skipped" });
       continue;
     }
     const files = [];
     let bytes = 0;
     for (const absolute of walkFiles(skillDir)) {
-      const relative4 = path11.relative(skillDir, absolute).split(path11.sep).join("/");
-      const buffer = fs11.readFileSync(absolute);
+      const relative4 = path12.relative(skillDir, absolute).split(path12.sep).join("/");
+      const buffer = fs12.readFileSync(absolute);
       if (buffer.byteLength > MAX_SKILL_FILE_BYTES) {
         notes.push({ skill: entry.name, message: `${relative4} is over 512KB \u2014 skipped` });
         continue;
@@ -6222,16 +6570,16 @@ var scanSkillLibrary = (root) => {
 };
 
 // src/ssh-setup.ts
-import * as os8 from "node:os";
-import * as path13 from "node:path";
+import * as os9 from "node:os";
+import * as path14 from "node:path";
 
 // ../../packages/workspace-ssh/src/index.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import { createHash as createHash3 } from "node:crypto";
-import * as fs12 from "node:fs";
+import * as fs13 from "node:fs";
 import { isIP as isIP2 } from "node:net";
-import * as os7 from "node:os";
-import * as path12 from "node:path";
+import * as os8 from "node:os";
+import * as path13 from "node:path";
 var LEGACY_BLOCK_BEGIN = "# >>> mend workspace ssh (managed by `mend ssh setup`) >>>";
 var LEGACY_BLOCK_END = "# <<< mend workspace ssh <<<";
 var WorkspaceSshError = class extends Error {
@@ -6318,8 +6666,8 @@ var blockBegin = (alias) => `# >>> mend workspace ssh ${alias} (managed) >>>`;
 var blockEnd = (alias) => `# <<< mend workspace ssh ${alias} <<<`;
 var hasControls = (value) => /[\p{Cc}\p{Zl}\p{Zp}]/u.test(value);
 var parseIdentityPath = (value) => {
-  const resolved = path12.resolve(
-    value.startsWith("~/") ? path12.join(os7.homedir(), value.slice(2)) : value
+  const resolved = path13.resolve(
+    value.startsWith("~/") ? path13.join(os8.homedir(), value.slice(2)) : value
   );
   if (value === "" || hasControls(value) || hasControls(resolved) || value.includes("${") || resolved.includes("${")) {
     return failure(
@@ -6465,7 +6813,7 @@ var workspaceSshPublicKeyFingerprint = (publicKey) => {
 var publicKeyIdentity = (publicKey) => publicKey.trim().split(/\s+/).slice(0, 2).join(" ");
 var agentKeys = () => {
   if (!process.env["SSH_AUTH_SOCK"]) return [];
-  const listed = spawnSync3("ssh-add", ["-L"], {
+  const listed = spawnSync4("ssh-add", ["-L"], {
     encoding: "utf8",
     timeout: 3e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -6475,7 +6823,7 @@ var agentKeys = () => {
 };
 var readText = (file) => {
   try {
-    return success(fs12.readFileSync(file, "utf8"));
+    return success(fs13.readFileSync(file, "utf8"));
   } catch (cause) {
     const error = cause instanceof Error && "code" in cause ? cause.code : void 0;
     return error === "ENOENT" ? success("") : failure(new WorkspaceSshError("key", `Could not read ${file}.`, cause));
@@ -6502,7 +6850,7 @@ var readRequiredKey = (keyPath, source) => {
   const privatePath = publicPath.slice(0, -".pub".length);
   const read = readText(publicPath);
   if (!read.ok) return read;
-  const derived = spawnSync3("ssh-keygen", ["-y", "-P", "", "-f", privatePath], {
+  const derived = spawnSync4("ssh-keygen", ["-y", "-P", "", "-f", privatePath], {
     encoding: "utf8",
     timeout: 3e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -6533,19 +6881,19 @@ var readRequiredKey = (keyPath, source) => {
 var readOptionalKey = (keyPath) => {
   const parsed = parseIdentityPath(keyPath);
   if (!parsed.ok) return parsed;
-  if (!fs12.existsSync(parsed.value) && !fs12.existsSync(publicKeyPath(parsed.value)))
+  if (!fs13.existsSync(parsed.value) && !fs13.existsSync(publicKeyPath(parsed.value)))
     return success(null);
   return readRequiredKey(parsed.value, "existing");
 };
 var pinAgentKey = (configHome, publicKey) => {
-  const identityFile = path12.resolve(
+  const identityFile = path13.resolve(
     configHome,
     "ssh",
     `agent-${hashIdentity(publicKeyIdentity(publicKey))}.pub`
   );
   try {
-    fs12.mkdirSync(path12.dirname(identityFile), { recursive: true, mode: 448 });
-    fs12.writeFileSync(identityFile, `${publicKey}
+    fs13.mkdirSync(path13.dirname(identityFile), { recursive: true, mode: 448 });
+    fs13.writeFileSync(identityFile, `${publicKey}
 `, { mode: 384 });
     return success({ publicKey, identityFile, source: "agent" });
   } catch (cause) {
@@ -6556,15 +6904,15 @@ var pinAgentKey = (configHome, publicKey) => {
 };
 var generateDedicatedKey = (privatePath) => {
   try {
-    fs12.mkdirSync(path12.dirname(privatePath), { recursive: true, mode: 448 });
+    fs13.mkdirSync(path13.dirname(privatePath), { recursive: true, mode: 448 });
   } catch (cause) {
     return failure(
-      new WorkspaceSshError("key", `Could not create ${path12.dirname(privatePath)}.`, cause)
+      new WorkspaceSshError("key", `Could not create ${path13.dirname(privatePath)}.`, cause)
     );
   }
-  const generated = spawnSync3(
+  const generated = spawnSync4(
     "ssh-keygen",
-    ["-t", "ed25519", "-f", privatePath, "-N", "", "-C", `mend-${os7.hostname()}`],
+    ["-t", "ed25519", "-f", privatePath, "-N", "", "-C", `mend-${os8.hostname()}`],
     { encoding: "utf8", timeout: 3e3, stdio: ["ignore", "pipe", "pipe"] }
   );
   if (generated.status !== 0) {
@@ -6588,7 +6936,7 @@ var generateDedicatedKey = (privatePath) => {
   return fresh;
 };
 var dedicatedKey = (configHome, create) => {
-  const privatePath = path12.join(configHome, "ssh", "id_ed25519");
+  const privatePath = path13.join(configHome, "ssh", "id_ed25519");
   const existing = readOptionalKey(privatePath);
   if (existing.ok === false) return failure(existing.error);
   if (existing.value !== null || !create) return existing;
@@ -6636,10 +6984,10 @@ var writeWorkspaceSshConfig = (configFile, target, identityFile) => {
   const reconciled = reconcileWorkspaceSshConfig(before.value, target, identityFile);
   if (reconciled.ok === false) return failure(reconciled.error);
   try {
-    fs12.mkdirSync(path12.dirname(configFile), { recursive: true, mode: 448 });
-    fs12.chmodSync(path12.dirname(configFile), 448);
-    fs12.writeFileSync(configFile, reconciled.value, { mode: 384 });
-    fs12.chmodSync(configFile, 384);
+    fs13.mkdirSync(path13.dirname(configFile), { recursive: true, mode: 448 });
+    fs13.chmodSync(path13.dirname(configFile), 448);
+    fs13.writeFileSync(configFile, reconciled.value, { mode: 384 });
+    fs13.chmodSync(configFile, 384);
     return success(void 0);
   } catch (cause) {
     return failure(new WorkspaceSshError("config", `Could not write ${configFile}.`, cause));
@@ -6652,8 +7000,8 @@ var dim5 = ansi("2");
 var green5 = ansi("32");
 var warn = ansi("33");
 var say5 = (line) => console.log(line);
-var sshConfigPath = () => path13.join(os8.homedir(), ".ssh", "config");
-var flagValue = (args, flag) => {
+var sshConfigPath = () => path14.join(os9.homedir(), ".ssh", "config");
+var flagValue2 = (args, flag) => {
   const index = args.indexOf(flag);
   return index === -1 || args[index + 1] === void 0 ? null : String(args[index + 1]);
 };
@@ -6670,7 +7018,7 @@ var showStatus = async (api2, cliHome, serverUrl, args) => {
   const parsedTarget = parseWorkspaceSshTarget({
     serverUrl,
     publishedPort: view.gateway.port,
-    hostnameOverride: flagValue(args, "--host")
+    hostnameOverride: flagValue2(args, "--host")
   });
   if (parsedTarget.ok === false) return showFailure(parsedTarget.error.message);
   const config = readWorkspaceSshConfig(sshConfigPath());
@@ -6707,14 +7055,14 @@ var setup = async (api2, cliHome, serverUrl, args) => {
   const parsedTarget = parseWorkspaceSshTarget({
     serverUrl,
     publishedPort: view.gateway.port,
-    hostnameOverride: flagValue(args, "--host")
+    hostnameOverride: flagValue2(args, "--host")
   });
   if (parsedTarget.ok === false) return showFailure(parsedTarget.error.message);
   const config = readWorkspaceSshConfig(sshConfigPath());
   if (config.ok === false) return showFailure(config.error.message);
   const picked = pickWorkspaceSshKey({
     configHome: cliHome,
-    explicitKeyPath: flagValue(args, "--key"),
+    explicitKeyPath: flagValue2(args, "--key"),
     configuredIdentityFile: configuredWorkspaceSshIdentityFile(config.value, parsedTarget.value),
     create: true
   });
@@ -6722,7 +7070,7 @@ var setup = async (api2, cliHome, serverUrl, args) => {
   if (picked.value === null) return showFailure("No workspace SSH key is available.");
   const registered = await api2("POST", "/workspace-ssh/keys", {
     publicKey: picked.value.publicKey,
-    name: os8.hostname()
+    name: os9.hostname()
   });
   const sourceLabel = {
     explicit: "from --key",
@@ -6764,8 +7112,8 @@ var sshCommand = async (args, api2, cliHome, serverUrl) => {
 };
 
 // src/uninstall.ts
-import * as fs13 from "node:fs";
-import * as path14 from "node:path";
+import * as fs14 from "node:fs";
+import * as path15 from "node:path";
 var UNINSTALL_USAGE = "usage: mend uninstall [--all | --server | --home] [--yes]";
 var parseUninstallArgs = (args) => {
   let scope = null;
@@ -6787,14 +7135,14 @@ var parseUninstallArgs = (args) => {
 var SERVER_FILES = ["identity.env", "active", "generations", "backups"];
 var countEntries = (directory) => {
   try {
-    return fs13.readdirSync(directory).length;
+    return fs14.readdirSync(directory).length;
   } catch {
     return 0;
   }
 };
 var exists = (file) => {
   try {
-    fs13.lstatSync(file);
+    fs14.lstatSync(file);
     return true;
   } catch {
     return false;
@@ -6803,7 +7151,7 @@ var exists = (file) => {
 var managedBlockCount = (sshConfigFile) => {
   let config;
   try {
-    config = fs13.readFileSync(sshConfigFile, "utf8");
+    config = fs14.readFileSync(sshConfigFile, "utf8");
   } catch {
     return 0;
   }
@@ -6827,27 +7175,27 @@ var describeUninstall = async (runtime, scope) => {
       if (!read.error.message.startsWith("No Mend server is configured")) throw read.error;
       server = "none";
     } else if (read.value === null) {
-      server = exists(path14.join(configDir, "identity.env")) ? {
+      server = exists(path15.join(configDir, "identity.env")) ? {
         version: "(no active generation)",
         appUrl: "",
         dockerContext: "",
-        generations: countEntries(path14.join(configDir, "generations")),
-        backups: countEntries(path14.join(configDir, "backups"))
+        generations: countEntries(path15.join(configDir, "generations")),
+        backups: countEntries(path15.join(configDir, "backups"))
       } : "none";
     } else {
       server = {
         version: read.value.config.serverVersion,
         appUrl: read.value.config.appUrl,
         dockerContext: read.value.config.dockerContext,
-        generations: countEntries(path14.join(configDir, "generations")),
-        backups: countEntries(path14.join(configDir, "backups"))
+        generations: countEntries(path15.join(configDir, "generations")),
+        backups: countEntries(path15.join(configDir, "backups"))
       };
     }
   }
   let home = null;
   if (scope !== "server") {
-    const cliConfig = path14.join(runtime.cliHome, "cli.json");
-    const sshDirectory = path14.join(runtime.cliHome, "ssh");
+    const cliConfig = path15.join(runtime.cliHome, "cli.json");
+    const sshDirectory = path15.join(runtime.cliHome, "ssh");
     home = {
       cliConfig: exists(cliConfig) ? cliConfig : null,
       sshDirectory: exists(sshDirectory) ? sshDirectory : null,
@@ -6979,7 +7327,7 @@ var removeServer = async (runtime, failures, leftovers) => {
         }
       }
       for (const name of SERVER_FILES) {
-        fs13.rmSync(path14.join(configDir, name), { recursive: true, force: true });
+        fs14.rmSync(path15.join(configDir, name), { recursive: true, force: true });
       }
       server.writeLine(`removed ${configDir}/{identity.env, active, generations, backups}`);
     },
@@ -6990,20 +7338,20 @@ var removeServer = async (runtime, failures, leftovers) => {
 var removeHome = async (runtime, plan, failures, leftovers) => {
   const { server } = runtime;
   if (plan.cliConfig !== null) {
-    fs13.rmSync(plan.cliConfig, { force: true });
+    fs14.rmSync(plan.cliConfig, { force: true });
     server.writeLine(`removed ${plan.cliConfig}`);
   }
   if (plan.sshDirectory !== null) {
-    fs13.rmSync(plan.sshDirectory, { recursive: true, force: true });
+    fs14.rmSync(plan.sshDirectory, { recursive: true, force: true });
     server.writeLine(`removed ${plan.sshDirectory}`);
   }
   if (plan.managedSshBlocks > 0) {
     try {
-      const before = fs13.readFileSync(runtime.sshConfigFile, "utf8");
+      const before = fs14.readFileSync(runtime.sshConfigFile, "utf8");
       const stripped = stripManagedWorkspaceSshBlocks(before);
       if (!stripped.ok) throw stripped.error;
       if (stripped.value.removed > 0) {
-        fs13.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
+        fs14.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
         server.writeLine(
           `removed ${plural(stripped.value.removed, "managed block")} from ${runtime.sshConfigFile}`
         );
@@ -7016,12 +7364,12 @@ var removeHome = async (runtime, plan, failures, leftovers) => {
   }
   let remaining = [];
   try {
-    remaining = fs13.readdirSync(runtime.cliHome);
+    remaining = fs14.readdirSync(runtime.cliHome);
   } catch {
     return;
   }
   if (remaining.length === 0) {
-    fs13.rmdirSync(runtime.cliHome);
+    fs14.rmdirSync(runtime.cliHome);
     server.writeLine(`removed ${runtime.cliHome}`);
   } else {
     leftovers.push(
@@ -7085,19 +7433,19 @@ var upgradeUrl = async (input) => {
 // src/main.ts
 var mendCliHome = () => {
   const xdg = process.env["XDG_CONFIG_HOME"];
-  const preferred = path15.join(
-    xdg === void 0 || xdg === "" ? path15.join(os9.homedir(), ".config") : xdg,
+  const preferred = path16.join(
+    xdg === void 0 || xdg === "" ? path16.join(os10.homedir(), ".config") : xdg,
     "mend"
   );
-  const legacy = path15.join(os9.homedir(), ".mend");
-  return !fs14.existsSync(preferred) && fs14.existsSync(legacy) ? legacy : preferred;
+  const legacy = path16.join(os10.homedir(), ".mend");
+  return !fs15.existsSync(preferred) && fs15.existsSync(legacy) ? legacy : preferred;
 };
-var CONFIG_PATH = path15.join(mendCliHome(), "cli.json");
+var CONFIG_PATH = path16.join(mendCliHome(), "cli.json");
 var loadConfig = () => {
   let fileConfig = {};
-  if (fs14.existsSync(CONFIG_PATH)) {
+  if (fs15.existsSync(CONFIG_PATH)) {
     try {
-      fileConfig = JSON.parse(fs14.readFileSync(CONFIG_PATH, "utf8"));
+      fileConfig = JSON.parse(fs15.readFileSync(CONFIG_PATH, "utf8"));
     } catch {
       fail6(`could not parse ${CONFIG_PATH}`);
     }
@@ -7258,8 +7606,8 @@ var withSpinner = async (label, work) => {
   const started = Date.now();
   let frame = 0;
   const timer = setInterval(() => {
-    const seconds = Math.round((Date.now() - started) / 1e3);
-    process.stdout.write(`\r  ${frames[frame % frames.length]} ${label} ${dim6(`${seconds}s`)} `);
+    const seconds2 = Math.round((Date.now() - started) / 1e3);
+    process.stdout.write(`\r  ${frames[frame % frames.length]} ${label} ${dim6(`${seconds2}s`)} `);
     frame += 1;
   }, 120);
   try {
@@ -7288,7 +7636,7 @@ var adopt = async (config, args) => {
   }
   const sourceIssue = repositoryCloneUrlIssue(source);
   if (sourceIssue !== null) return fail6(sourceIssue);
-  const projectName = name ?? normalizeProjectName(path15.basename(source, ".git"));
+  const projectName = name ?? normalizeProjectName(path16.basename(source, ".git"));
   const auth = authFlagIndex !== -1 && args[authFlagIndex + 1] !== void 0 ? String(args[authFlagIndex + 1]) : null;
   if (auth !== null && auth !== "ambient" && auth !== "mend-key" && auth !== "bridge") {
     return fail6(`--auth takes "ambient", "mend-key", or "bridge", not "${auth}"`);
@@ -7337,7 +7685,7 @@ var findProject = async (config, explicit, adoptCwd = false) => {
   const sourceIssue = repositoryCloneUrlIssue(facts.originUrl);
   if (sourceIssue !== null) return fail6(sourceIssue);
   const adopted = await api(config, "POST", "/projects", {
-    name: normalizeProjectName(path15.basename(facts.repoRoot)),
+    name: normalizeProjectName(path16.basename(facts.repoRoot)),
     source: facts.originUrl
   });
   say6(`${green6("\u2713")} adopted \xB7 ${adopted.name} \xB7 ${dim6(adopted.storePath)}`);
@@ -7347,14 +7695,19 @@ var resolvedBackgroundSessions = async (config, project2) => {
   if (project2.backgroundSessions === "on") return true;
   if (project2.backgroundSessions === "off") return false;
   try {
-    const settings = await request(
-      config,
-      "GET",
-      "/settings"
-    );
-    return settings.backgroundSessions !== false;
+    const organization = await request(config, "GET", "/organization/settings");
+    return organization.effective?.backgroundSessions !== false;
   } catch {
-    return true;
+    try {
+      const settings = await request(
+        config,
+        "GET",
+        "/settings"
+      );
+      return settings.backgroundSessions !== false;
+    } catch {
+      return true;
+    }
   }
 };
 var askWorktreeName = async () => {
@@ -7800,6 +8153,10 @@ var stopSessions = async (config, targets, summarise) => {
     if (hold !== null) {
       say6(`${amber2("  " + hold)} \xB7 mend stop --services ${session.id.slice(0, 8)}`);
     }
+    const capture = after === null ? null : captureLineOf(after.session);
+    if (capture !== null) {
+      say6(`${amber2("  " + capture)} \xB7 the workspace stops once nothing is pending`);
+    }
     say6(`${cobalt2("  review")} \xB7 ${config.url}/sessions/${session.id}`);
   }
   if (summarise) {
@@ -8187,13 +8544,13 @@ var serviceRestart = async (config, args) => {
 };
 var serviceInit = async (args) => {
   const root = gitTopLevel(process.cwd()) ?? process.cwd();
-  const target = path15.join(root, "mend.toml");
-  if (fs14.existsSync(target)) {
+  const target = path16.join(root, "mend.toml");
+  if (fs15.existsSync(target)) {
     return fail6(`${target} already exists \u2014 edit it directly (init never merges)`);
   }
-  const rootFiles = fs14.readdirSync(root);
+  const rootFiles = fs15.readdirSync(root);
   const proposals = [];
-  const readRoot = (name) => fs14.readFileSync(path15.join(root, name), "utf8");
+  const readRoot = (name) => fs15.readFileSync(path16.join(root, name), "utf8");
   if (rootFiles.includes("package.json")) {
     proposals.push(...proposeFromPackageJson(readRoot("package.json"), rootFiles));
   }
@@ -8203,13 +8560,13 @@ var serviceInit = async (args) => {
   );
   for (const glob of globs) {
     const parent = glob.replace(/\/?\*+$/, "");
-    const dirs = glob.endsWith("*") ? fs14.existsSync(path15.join(root, parent)) ? fs14.readdirSync(path15.join(root, parent)).map((dir) => path15.join(parent, dir)) : [] : [glob];
+    const dirs = glob.endsWith("*") ? fs15.existsSync(path16.join(root, parent)) ? fs15.readdirSync(path16.join(root, parent)).map((dir) => path16.join(parent, dir)) : [] : [glob];
     for (const dir of dirs) {
-      const manifest = path15.join(root, dir, "package.json");
-      if (!fs14.existsSync(manifest)) continue;
+      const manifest = path16.join(root, dir, "package.json");
+      if (!fs15.existsSync(manifest)) continue;
       for (const proposal of proposeFromWorkspacePackage(
-        path15.basename(dir),
-        fs14.readFileSync(manifest, "utf8"),
+        path16.basename(dir),
+        fs15.readFileSync(manifest, "utf8"),
         rootFiles
       )) {
         if (!proposals.some((existing) => existing.name === proposal.name)) {
@@ -8253,7 +8610,7 @@ var serviceInit = async (args) => {
       return;
     }
   }
-  fs14.writeFileSync(target, toml);
+  fs15.writeFileSync(target, toml);
   say6(`${green6("\u2713")} wrote ${target} \u2014 commit it, then: mend service run ${proposals[0]?.name}`);
 };
 var tunnelServices = async (config, services, portOverride) => {
@@ -8357,23 +8714,23 @@ var serviceCommand = async (config, args) => {
   }
 };
 var isProvider = (value) => value === "claude" || value === "codex" || value === "github";
-var readIfExists = (file) => fs14.existsSync(file) ? fs14.readFileSync(file, "utf8") : null;
+var readIfExists = (file) => fs15.existsSync(file) ? fs15.readFileSync(file, "utf8") : null;
 var localCredential = (provider) => {
-  const home = os9.homedir();
+  const home = os10.homedir();
   switch (provider) {
     case "codex":
       return readIfExists(
-        path15.join(process.env["CODEX_HOME"] ?? path15.join(home, ".codex"), "auth.json")
+        path16.join(process.env["CODEX_HOME"] ?? path16.join(home, ".codex"), "auth.json")
       );
     case "claude":
       return readIfExists(
-        path15.join(
-          process.env["CLAUDE_CONFIG_DIR"] ?? path15.join(home, ".claude"),
+        path16.join(
+          process.env["CLAUDE_CONFIG_DIR"] ?? path16.join(home, ".claude"),
           ".credentials.json"
         )
       );
     case "github": {
-      const result = spawnSync4("gh", ["auth", "token"], { encoding: "utf8" });
+      const result = spawnSync5("gh", ["auth", "token"], { encoding: "utf8" });
       const token = result.status === 0 ? result.stdout.trim() : "";
       return token === "" ? null : token;
     }
@@ -8418,7 +8775,7 @@ var claudeGrantSecret = () => {
   return read.kind === "missing" ? null : read.secret;
 };
 var doctorBundle = (config, args) => doctorBundleCommand(args, {
-  defaultDir: path15.join(mendCliHome(), "bundles"),
+  defaultDir: path16.join(mendCliHome(), "bundles"),
   now: () => /* @__PURE__ */ new Date(),
   say: say6,
   warn: (line) => process.stderr.write(`${line}
@@ -8482,7 +8839,7 @@ var claudeGrant = async () => {
       return null;
     }
   }
-  if (status.configDirectory !== null && path15.resolve(status.configDirectory) !== path15.resolve(dir)) {
+  if (status.configDirectory !== null && path16.resolve(status.configDirectory) !== path16.resolve(dir)) {
     fail6(
       `claude: this Claude read ${status.configDirectory} instead of ${dir}, so a separate grant is not possible \u2014 connect the shared one deliberately with --use-my-login`
     );
@@ -8545,7 +8902,7 @@ var connectCommand = async (config, args) => {
   }
   let secret;
   if (flags.includes("--from-stdin")) {
-    secret = fs14.readFileSync(0, "utf8").trim();
+    secret = fs15.readFileSync(0, "utf8").trim();
     if (secret === "") return fail6("nothing on stdin");
   } else if (provider === "claude" && !flags.includes("--use-my-login")) {
     secret = await claudeGrant();
@@ -8591,14 +8948,14 @@ var takeFlagValue4 = (args, flag) => {
   return at !== -1 && args[at + 1] !== void 0 ? String(args[at + 1]) : null;
 };
 var saveCliConfig = (next) => {
-  fs14.mkdirSync(path15.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
-  fs14.writeFileSync(
+  fs15.mkdirSync(path16.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
+  fs15.writeFileSync(
     CONFIG_PATH,
     `${JSON.stringify({ url: next.url, token: next.token, deviceId: next.deviceId }, null, 2)}
 `,
     { mode: 384 }
   );
-  fs14.chmodSync(CONFIG_PATH, 384);
+  fs15.chmodSync(CONFIG_PATH, 384);
 };
 var login = async (config, args) => {
   await loginCommand(args, {
@@ -8611,7 +8968,7 @@ var login = async (config, args) => {
   });
 };
 var logout = async (config) => {
-  if (!fs14.existsSync(CONFIG_PATH) && config.token === null) {
+  if (!fs15.existsSync(CONFIG_PATH) && config.token === null) {
     say6(dim6("nothing saved \u2014 already signed out"));
     return;
   }
@@ -8664,8 +9021,8 @@ var uninstallCommand = async (config, args) => {
   const runtime = {
     server,
     cliHome: mendCliHome(),
-    sshConfigFile: path15.join(os9.homedir(), ".ssh", "config"),
-    signedIn: config.token === null || !fs14.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
+    sshConfigFile: path16.join(os10.homedir(), ".ssh", "config"),
+    signedIn: config.token === null || !fs15.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
     revokeDevice: async () => {
       if (config.deviceId === null) return "no device id saved";
       try {
@@ -8729,7 +9086,7 @@ var keysShare = async (config) => {
     return fail6("SSH_AUTH_SOCK is not set \u2014 start (or plug in) your ssh-agent first");
   }
   await shareAgent({
-    url: () => socketUrl(config, "keys-bridge", { host: os9.hostname() }),
+    url: () => socketUrl(config, "keys-bridge", { host: os10.hostname() }),
     agentSock,
     signal: new AbortController().signal,
     onEvent: (event) => {
@@ -8859,7 +9216,7 @@ ${usageOf("dotfiles repo")}`);
 var dotfilesSync = async (config, args) => {
   const all = args.includes("--all");
   const requestedPaths = args.filter((arg) => !arg.startsWith("--"));
-  const home = os9.homedir();
+  const home = os10.homedir();
   if (!all && requestedPaths.length === 0) {
     const found = scanDotfileCandidates(home);
     if (found.length === 0) {
@@ -8886,13 +9243,13 @@ var dotfilesSync = async (config, args) => {
   if ("error" in read) return fail6(read.error);
   const result = await api(config, "POST", "/dotfiles/snapshot", {
     files: read.files,
-    source: os9.hostname(),
+    source: os10.hostname(),
     merge: false
   });
   const snapshot = result.snapshot;
   if (snapshot === null) return fail6("the server accepted the sync but reports no snapshot");
   say6(
-    `${green6("synced")} ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} from ${os9.hostname()} \xB7 ${dim6(snapshot.sha.slice(0, 7))} ${dim6("\u2014 applies from the next session launch")}`
+    `${green6("synced")} ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} from ${os10.hostname()} \xB7 ${dim6(snapshot.sha.slice(0, 7))} ${dim6("\u2014 applies from the next session launch")}`
   );
 };
 var envLoad = async (config, args) => {
@@ -8906,10 +9263,10 @@ var envLoad = async (config, args) => {
   const positional = args.filter(
     (arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project" && !consumed.has(i)
   );
-  const file = path15.resolve(positional[0] ?? ".env");
+  const file = path16.resolve(positional[0] ?? ".env");
   let contents;
   try {
-    contents = fs14.readFileSync(file, "utf8");
+    contents = fs15.readFileSync(file, "utf8");
   } catch {
     return fail6(`cannot read ${file} \u2014 pass a path: mend env load path/to/.env`);
   }
@@ -8925,10 +9282,10 @@ var envLoad = async (config, args) => {
     { contents, allSecret, secretNames }
   );
   if (report.loaded.length === 0 && report.rejected.length === 0 && report.malformedLines.length === 0) {
-    say6(dim6(`${path15.basename(file)} has no variables`));
+    say6(dim6(`${path16.basename(file)} has no variables`));
     return;
   }
-  say6(`${green6("\u2713")} loaded ${path15.basename(file)} into ${project2.name}`);
+  say6(`${green6("\u2713")} loaded ${path16.basename(file)} into ${project2.name}`);
   for (const line of formatLoadReport(report, { dim: dim6, warn: amber2 })) say6(line);
   const plaintextUrls = report.loaded.filter(
     (entry) => entry.lane === "configuration" && /_(URL|URI|DSN)$/.test(entry.name)
@@ -9119,7 +9476,7 @@ var skillsList = async (config, args) => {
 };
 var skillsPush = async (config, args) => {
   const dirFlag = takeFlagValue4(args, "--dir");
-  const root = dirFlag === null ? path15.join(os9.homedir(), DEFAULT_SKILLS_DIR) : path15.resolve(dirFlag);
+  const root = dirFlag === null ? path16.join(os10.homedir(), DEFAULT_SKILLS_DIR) : path16.resolve(dirFlag);
   const scanned = scanSkillLibrary(root);
   if ("error" in scanned) return fail6(scanned.error);
   for (const note of scanned.notes) say6(dim6(`  ${note.skill}: ${note.message}`));
@@ -9544,7 +9901,10 @@ var refreshCommand = async (config, args) => {
   }
   if (branches.length > 12) say6(dim6(`  \u2026 ${branches.length - 12} more`));
 };
-var rowHold = (row) => row.annotation === void 0 ? null : servicesHoldOf(row.session, row.annotation.currentAgent, row.annotation.liveServices ?? 0);
+var rowHold = (row) => (
+  // A workspace a stop is still saving (docs/adr/0002) reads what is left, first.
+  captureLineOf(row.session) ?? (row.annotation === void 0 ? null : servicesHoldOf(row.session, row.annotation.currentAgent, row.annotation.liveServices ?? 0))
+);
 var printSessionRow = (row) => {
   const { session, annotation } = row;
   const live = ACTIVE_STATUSES.has(session.status);
@@ -9642,6 +10002,14 @@ var sessionsCommand = async (config, args) => {
           openComments: annotation.openComments,
           totalComments: annotation.totalComments,
           pendingFollowUp: annotation.pendingFollowUp
+        },
+        capture: session.capturePending === void 0 ? null : {
+          pending: session.capturePending ?? null,
+          pendingBytes: session.capturePendingBytes ?? null,
+          refused: session.captureRefused ?? null,
+          drain: session.captureDrain ?? null,
+          notSaved: (session.captureNotSavedAt ?? null) !== null,
+          line: captureLineOf(session)
         }
       }))
     };
@@ -9774,14 +10142,14 @@ var dashboard = async (config, options = {}) => {
         `the dashboard needs Node >= 26 (node:ffi) \u2014 this is ${process.version}; every other command still works`
       );
     }
-    const rerun = spawnSync4(
+    const rerun = spawnSync5(
       process.execPath,
       ["--experimental-ffi", "--disable-warning=ExperimentalWarning", ...process.argv.slice(1)],
       { stdio: "inherit" }
     );
     process.exit(rerun.status ?? 0);
   }
-  const { runDashboard } = await import("./dashboard-3HNFSQZD.js");
+  const { runDashboard } = await import("./dashboard-OADX3PHI.js");
   const agentShare = await startShareIfBridge(config);
   const tunnels = options.noTunnel === true || serverIsLocal(config) ? null : createServiceTunnels({
     listServices: () => fetchServices(config),
@@ -9815,7 +10183,7 @@ var startShareIfBridge = async (config) => {
   }
   if (access.mode !== "bridge") return null;
   return startAgentShare({
-    url: () => socketUrl(config, "keys-bridge", { host: os9.hostname() }),
+    url: () => socketUrl(config, "keys-bridge", { host: os10.hostname() }),
     agentSock
   });
 };
@@ -9855,10 +10223,10 @@ var manCommand = (words) => {
   }
   const version = cliVersion();
   const page = doc === null ? renderManIndex(version) : renderManPage(doc, version);
-  const file = path15.join(os9.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
-  fs14.writeFileSync(file, page);
-  const result = spawnSync4("man", ["-l", file], { stdio: "inherit" });
-  fs14.rmSync(file, { force: true });
+  const file = path16.join(os10.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
+  fs15.writeFileSync(file, page);
+  const result = spawnSync5("man", ["-l", file], { stdio: "inherit" });
+  fs15.rmSync(file, { force: true });
   if (result.error !== void 0 || result.status !== 0) {
     say6(doc === null ? renderIndex() : renderCommand(doc));
   }