@sealant/mend 0.34.5 → 0.35.1

package/dist/main.js

@@ -34,15 +34,15 @@ import {
   sessionDisplayName,
   spoken,
   trackBracketedPaste
-} from "./chunk-5DORQXQT.js";
+} from "./chunk-SMH65F6Z.js";
 
 // src/main.ts
-import { spawn as spawn3, spawnSync as spawnSync5 } from "node:child_process";
-import * as fs15 from "node:fs";
+import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
+import * as fs17 from "node:fs";
 import { createRequire } from "node:module";
 import * as net4 from "node:net";
-import * as os10 from "node:os";
-import * as path16 from "node:path";
+import * as os11 from "node:os";
+import * as path18 from "node:path";
 
 // src/agent-share.ts
 import * as net from "node:net";
@@ -223,6 +223,15 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 var claudeGrantDir = (home) => path.join(home, "claude-grant");
+var forgetGrant = (configDir, platform = process.platform) => {
+  fs.rmSync(configDir, { recursive: true, force: true });
+  if (platform !== "darwin") return;
+  spawnSync(
+    "security",
+    ["delete-generic-password", "-a", os.userInfo().username, "-s", keychainService(configDir)],
+    { stdio: "ignore", timeout: 6e4 }
+  );
+};
 var personalClaudeDir = (environment = process.env) => {
   const configured = environment["CLAUDE_CONFIG_DIR"];
   return configured === void 0 || configured === "" ? path.join(os.homedir(), ".claude") : configured;
@@ -342,15 +351,94 @@ var readClipboardImage = async (platform = process.platform, env = process.env)
   return null;
 };
 
-// src/doctor-bundle-collectors.ts
+// src/codex-grant.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
 import * as fs3 from "node:fs";
 import * as os2 from "node:os";
 import * as path3 from "node:path";
 
-// src/server-runtime.ts
-import { spawn } from "node:child_process";
+// src/login-dir.ts
 import * as fs2 from "node:fs";
 import * as path2 from "node:path";
+var throwawayLoginDir = (parent, prefix) => {
+  fs2.mkdirSync(parent, { recursive: true, mode: 448 });
+  const dir = fs2.mkdtempSync(path2.join(parent, prefix));
+  fs2.chmodSync(dir, 448);
+  return dir;
+};
+
+// src/codex-grant.ts
+var codexCli = (environment = process.env) => ({
+  bin: environment["MEND_CODEX_BIN"] ?? "codex",
+  env: environment
+});
+var personalCodexHome = (environment = process.env) => {
+  const configured = environment["CODEX_HOME"];
+  return configured === void 0 || configured === "" ? path3.join(os2.homedir(), ".codex") : configured;
+};
+var runCodexDeviceLogin = (cli, codexHome) => {
+  const result = spawnSync2(cli.bin, ["login", "--device-auth"], {
+    stdio: "inherit",
+    env: { ...cli.env, CODEX_HOME: codexHome }
+  });
+  return result.error === void 0 && result.status === 0;
+};
+var refreshTokenOf = (authJson) => {
+  try {
+    const parsed = JSON.parse(authJson);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const tokens = parsed.tokens;
+    if (typeof tokens !== "object" || tokens === null) return null;
+    const refreshToken = tokens.refresh_token;
+    return typeof refreshToken === "string" && refreshToken !== "" ? refreshToken : null;
+  } catch {
+    return null;
+  }
+};
+var sameCodexLogin = (a, b) => {
+  const first = refreshTokenOf(a);
+  return first !== null && first === refreshTokenOf(b);
+};
+var codexGrant = (input) => {
+  const home = throwawayLoginDir(input.parent, "codex-login-");
+  try {
+    input.say("  Mend needs its own Codex login; it is sent to your server and not kept here");
+    input.say("  your own Codex login stays as it is");
+    if (!runCodexDeviceLogin(input.cli, home)) {
+      return { kind: "failed", reason: "codex: the login did not complete" };
+    }
+    const file = path3.join(home, "auth.json");
+    if (!fs3.existsSync(file)) {
+      return { kind: "failed", reason: `codex: logged in, but no auth.json appeared in ${home}` };
+    }
+    const secret = fs3.readFileSync(file, "utf8").trim();
+    if (refreshTokenOf(secret) === null) {
+      return {
+        kind: "failed",
+        reason: "codex: the login wrote no ChatGPT session (an API key login has nothing to refresh)"
+      };
+    }
+    if (input.personalAuthJson !== null && sameCodexLogin(secret, input.personalAuthJson)) {
+      return {
+        kind: "failed",
+        reason: "codex: that is the same login this machine's Codex holds, so both sides would race on refresh \u2014 connect it deliberately with --use-my-login"
+      };
+    }
+    return { kind: "grant", secret };
+  } finally {
+    fs3.rmSync(home, { recursive: true, force: true });
+  }
+};
+
+// src/doctor-bundle-collectors.ts
+import * as fs5 from "node:fs";
+import * as os3 from "node:os";
+import * as path5 from "node:path";
+
+// src/server-runtime.ts
+import { spawn } from "node:child_process";
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
 var serverProcessDeadlines = {
   ordinary: 3e4,
   pull: 10 * 6e4,
@@ -396,7 +484,7 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
   return new Promise((resolve7) => {
     let fd;
     try {
-      if (options.stdoutFile !== void 0) fd = fs2.openSync(options.stdoutFile, "wx", 384);
+      if (options.stdoutFile !== void 0) fd = fs4.openSync(options.stdoutFile, "wx", 384);
       const child = spawn(command, [...args], {
         env,
         detached: process.platform !== "win32",
@@ -447,12 +535,12 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
       child.once("close", (status) => {
         globalThis.clearTimeout(timer);
         try {
-          if (fd !== void 0) fs2.fsyncSync(fd);
+          if (fd !== void 0) fs4.fsyncSync(fd);
         } catch {
           failure2 ??= "Could not durably write process output.";
         } finally {
           try {
-            if (fd !== void 0) fs2.closeSync(fd);
+            if (fd !== void 0) fs4.closeSync(fd);
           } catch {
             failure2 ??= "Could not close process output file.";
           }
@@ -466,7 +554,7 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
       });
     } catch (cause) {
       try {
-        if (fd !== void 0) fs2.closeSync(fd);
+        if (fd !== void 0) fs4.closeSync(fd);
       } catch {
       }
       resolve7({
@@ -487,9 +575,9 @@ var serverComposeArgs = (installation, command) => [
   "--project-directory",
   installation.directory,
   "--env-file",
-  path2.join(installation.directory, "server.env"),
+  path4.join(installation.directory, "server.env"),
   "-f",
-  path2.join(installation.directory, "compose.yaml"),
+  path4.join(installation.directory, "compose.yaml"),
   ...command
 ];
 
@@ -535,11 +623,11 @@ var mapLimit = async (items, limit, work) => {
   return results;
 };
 var pathOf = (command, env = process.env) => {
-  for (const directory of (env["PATH"] ?? "").split(path3.delimiter)) {
+  for (const directory of (env["PATH"] ?? "").split(path5.delimiter)) {
     if (directory === "") continue;
-    const candidate = path3.join(directory, command);
+    const candidate = path5.join(directory, command);
     try {
-      fs3.accessSync(candidate, fs3.constants.X_OK);
+      fs5.accessSync(candidate, fs5.constants.X_OK);
       return candidate;
     } catch {
     }
@@ -557,9 +645,9 @@ var cliCollector = (deps) => ({
         node: process.versions.node,
         platform: process.platform,
         arch: process.arch,
-        osType: os2.type(),
-        osRelease: os2.release(),
-        hostname: os2.hostname(),
+        osType: os3.type(),
+        osRelease: os3.release(),
+        hostname: os3.hostname(),
         term: deps.env["TERM"] ?? null,
         shell: deps.env["SHELL"] ?? null,
         lang: deps.env["LANG"] ?? null,
@@ -1029,8 +1117,8 @@ var bundleCollectors = (deps) => {
 };
 
 // src/doctor-bundle.ts
-import * as fs4 from "node:fs";
-import * as path4 from "node:path";
+import * as fs6 from "node:fs";
+import * as path6 from "node:path";
 import { gzipSync } from "node:zlib";
 
 // src/help.ts
@@ -1079,19 +1167,20 @@ var COMMANDS = [
     summary: "send this machine's provider credential to the platform",
     synopsis: ["<claude|codex|github> [--use-my-login] [--from-stdin] [--remove]"],
     description: [
-      "Sessions run on the platform, so the platform needs your provider login. This reads the file the provider's own CLI wrote when you logged in (codex) or asks gh for its token (github) and stores it under your own user. Nothing is shared with other users.",
-      "Claude is different: Mend gets a login of its own. Claude rotates its refresh token, so two copies of one login fight and the one that refreshes second is signed out, and Mend refreshes on a schedule. So this logs in once against a directory Mend keeps, and your own Claude login stays as it is. Run it again whenever Mend says the grant expired."
+      "Sessions run on the platform, so the platform needs your provider login. It is stored under your own user and used only for your work. Nothing is shared with other users.",
+      "Claude and Codex get a login of Mend's own. Both rotate their refresh token, so two copies of one login fight and the one that refreshes second is signed out, and Mend's server refreshes on a schedule. So this logs in through the provider's own flow and your own login stays as it is: Claude in the browser, Codex with a device code, both sent and not kept here. Run it again whenever Mend says a login needs reconnecting. GitHub sends gh's token."
     ],
     options: [
       {
         flag: "--use-my-login",
-        text: "claude: send the login this machine already uses; both sides then share one grant"
+        text: "claude, codex: send the login this machine already uses; both sides then share it"
       },
       { flag: "--from-stdin", text: "paste a credential instead of reading the provider's file" },
       { flag: "--remove", text: "disconnect the provider" }
     ],
     examples: [
       { command: "mend connect claude", text: "a Claude login of Mend's own, through the browser" },
+      { command: "mend connect codex", text: "a Codex login of Mend's own, with a device code" },
       { command: "mend connect github --remove", text: "" }
     ],
     see: ["accounts"]
@@ -2470,9 +2559,9 @@ var collectBundle = async (collectors) => {
 };
 var bundleFileName = (now) => `mend-bundle-${now.toISOString().replace(/\.\d{3}Z$/, "Z").replace(/:/g, "-")}.tgz`;
 var writeBundle = (files, outPath, now) => {
-  const directory = path4.dirname(outPath);
-  fs4.mkdirSync(directory, { recursive: true, mode: 448 });
-  const root = path4.basename(outPath).replace(/\.(?:tgz|tar\.gz)$/, "");
+  const directory = path6.dirname(outPath);
+  fs6.mkdirSync(directory, { recursive: true, mode: 448 });
+  const root = path6.basename(outPath).replace(/\.(?:tgz|tar\.gz)$/, "");
   const entries = files.map((file) => ({
     path: file.path,
     content: Buffer.from(file.content, "utf8")
@@ -2481,8 +2570,8 @@ var writeBundle = (files, outPath, now) => {
     entries.map((entry) => ({ path: `${root}/${entry.path}`, content: entry.content })),
     now
   );
-  fs4.writeFileSync(outPath, bytes, { mode: 384 });
-  fs4.chmodSync(outPath, 384);
+  fs6.writeFileSync(outPath, bytes, { mode: 384 });
+  fs6.chmodSync(outPath, 384);
   return {
     path: outPath,
     bytes: bytes.length,
@@ -2543,7 +2632,7 @@ var doctorBundleCommand = async (args, deps) => {
     return;
   }
   const now = deps.now();
-  const outPath = path4.resolve(parsed.args.out ?? path4.join(deps.defaultDir, bundleFileName(now)));
+  const outPath = path6.resolve(parsed.args.out ?? path6.join(deps.defaultDir, bundleFileName(now)));
   deps.warn("collecting \xB7 this can take a minute");
   const files = await collectBundle(deps.collectors(parsed.args.tail));
   const written = writeBundle(files, outPath, now);
@@ -2551,14 +2640,14 @@ var doctorBundleCommand = async (args, deps) => {
 };
 
 // src/doctor.ts
-import * as fs6 from "node:fs";
-import * as path6 from "node:path";
+import * as fs8 from "node:fs";
+import * as path8 from "node:path";
 
 // src/docker-shutdown.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import * as fs5 from "node:fs";
-import * as os3 from "node:os";
-import * as path5 from "node:path";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import * as fs7 from "node:fs";
+import * as os4 from "node:os";
+import * as path7 from "node:path";
 var DOCKER_CAPTURE_STOP_GRACE_SECONDS = 3600;
 var DOCKERD_DEFAULT_SHUTDOWN_TIMEOUT_SECONDS = 15;
 var flagValue = (argv, name) => {
@@ -2583,12 +2672,12 @@ var daemonKindOf = (info) => {
 var defaultConfigPath = (facts, daemon) => {
   switch (daemon) {
     case "desktop":
-      return path5.join(facts.home, ".docker", "daemon.json");
+      return path7.join(facts.home, ".docker", "daemon.json");
     case "orbstack":
-      return path5.join(facts.home, ".orbstack", "config", "docker.json");
+      return path7.join(facts.home, ".orbstack", "config", "docker.json");
     case "rootless":
-      return path5.join(
-        facts.xdgConfigHome ?? path5.join(facts.home, ".config"),
+      return path7.join(
+        facts.xdgConfigHome ?? path7.join(facts.home, ".config"),
         "docker",
         "daemon.json"
       );
@@ -2717,7 +2806,7 @@ var parseDockerInfo = (stdout) => {
 };
 var readHostFile = (file) => {
   try {
-    return { kind: "read", text: fs5.readFileSync(file, "utf8") };
+    return { kind: "read", text: fs7.readFileSync(file, "utf8") };
   } catch (cause) {
     return cause instanceof Error && "code" in cause && cause.code === "ENOENT" ? { kind: "absent" } : { kind: "unreadable" };
   }
@@ -2725,21 +2814,21 @@ var readHostFile = (file) => {
 var hostProcView = {
   list: (dir) => {
     try {
-      return fs5.readdirSync(dir);
+      return fs7.readdirSync(dir);
     } catch {
       return null;
     }
   },
   read: (file) => {
     try {
-      return fs5.readFileSync(file, "utf8");
+      return fs7.readFileSync(file, "utf8");
     } catch {
       return null;
     }
   },
   link: (file) => {
     try {
-      return fs5.readlinkSync(file);
+      return fs7.readlinkSync(file);
     } catch {
       return null;
     }
@@ -2779,7 +2868,7 @@ var observeDockerd = (proc, host) => {
     const cmdline = proc.read(`/proc/${entry}/cmdline`);
     if (cmdline === null) continue;
     const argv = cmdline.split("\0").filter((arg) => arg !== "");
-    if (path5.basename(argv[0] ?? "") === "dockerd") daemons.push({ pid: entry, argv });
+    if (path7.basename(argv[0] ?? "") === "dockerd") daemons.push({ pid: entry, argv });
   }
   if (daemons.length === 0) return { kind: "none" };
   const socket = unixSocketOf(host);
@@ -2839,7 +2928,7 @@ var observeDockerd = (proc, host) => {
 var hostDockerEndpoint = () => {
   const fromEnv = process.env["DOCKER_HOST"];
   if (fromEnv !== void 0 && fromEnv.trim() !== "") return fromEnv.trim();
-  const context = spawnSync2(
+  const context = spawnSync3(
     "docker",
     ["context", "inspect", "--format", "{{.Endpoints.docker.Host}}"],
     {
@@ -2865,11 +2954,11 @@ var hostDockerDaemonFacts = (infoStdout) => ({
   info: infoStdout === null ? null : parseDockerInfo(infoStdout),
   ...dockerdFactsOf(observeDockerd(hostProcView, hostDockerEndpoint())),
   readFile: readHostFile,
-  home: os3.homedir(),
+  home: os4.homedir(),
   xdgConfigHome: process.env["XDG_CONFIG_HOME"] ?? null
 });
 var observeHostShutdownTimeout = () => {
-  const info = spawnSync2("docker", ["info", "--format", "{{json .}}"], {
+  const info = spawnSync3("docker", ["info", "--format", "{{json .}}"], {
     encoding: "utf8",
     timeout: 3e3,
     stdio: ["ignore", "pipe", "ignore"]
@@ -3028,7 +3117,8 @@ var runChecks = async (config, probes) => {
       } : {
         label: provider,
         state: "todo",
-        detail: account.status,
+        // A refused refresh ends the login (docs/adr/0008): say what happened, not the enum.
+        detail: account.status === "invalid" ? "reconnect needed \xB7 the provider refused the login" : account.status,
         fix: `mend connect ${provider}`
       }
     );
@@ -3098,10 +3188,10 @@ var runChecks = async (config, probes) => {
   return checks;
 };
 var onPath = (command) => {
-  for (const directory of (process.env["PATH"] ?? "").split(path6.delimiter)) {
+  for (const directory of (process.env["PATH"] ?? "").split(path8.delimiter)) {
     if (directory === "") continue;
     try {
-      fs6.accessSync(path6.join(directory, command), fs6.constants.X_OK);
+      fs8.accessSync(path8.join(directory, command), fs8.constants.X_OK);
       return true;
     } catch {
     }
@@ -3126,8 +3216,8 @@ var doctorCommand = async (config, localCredential2, claudeGrant2) => {
 };
 
 // src/dotfiles.ts
-import * as fs7 from "node:fs";
-import * as path7 from "node:path";
+import * as fs9 from "node:fs";
+import * as path9 from "node:path";
 var DOTFILE_CANDIDATES = [
   {
     group: "shell",
@@ -3170,7 +3260,7 @@ var DOTFILE_CANDIDATES = [
 var MAX_FILE_BYTES = 1024 * 1024;
 var statFile = (home, relative4) => {
   try {
-    const stat = fs7.statSync(path7.join(home, relative4));
+    const stat = fs9.statSync(path9.join(home, relative4));
     return stat.isFile() ? stat : null;
   } catch {
     return null;
@@ -3183,9 +3273,9 @@ var scanDotfileCandidates = (home) => DOTFILE_CANDIDATES.flatMap(
   })
 );
 var homeRelativePath = (home, requested) => {
-  const relative4 = path7.relative(home, path7.resolve(home, requested));
-  const outside = relative4 === "" || relative4 === ".." || relative4.startsWith(`..${path7.sep}`) || path7.isAbsolute(relative4);
-  return outside ? null : relative4.split(path7.sep).join("/");
+  const relative4 = path9.relative(home, path9.resolve(home, requested));
+  const outside = relative4 === "" || relative4 === ".." || relative4.startsWith(`..${path9.sep}`) || path9.isAbsolute(relative4);
+  return outside ? null : relative4.split(path9.sep).join("/");
 };
 var readSyncFiles = (home, paths_) => {
   const files = [];
@@ -3205,7 +3295,7 @@ var readSyncFiles = (home, paths_) => {
     }
     files.push({
       path: relative4,
-      contentsBase64: fs7.readFileSync(path7.join(home, relative4)).toString("base64"),
+      contentsBase64: fs9.readFileSync(path9.join(home, relative4)).toString("base64"),
       // eslint-disable-next-line no-bitwise -- permission bits are the point
       mode: (stat.mode & 511).toString(8)
     });
@@ -3303,11 +3393,18 @@ var parseGitAuthorArgs = (args) => {
 };
 var gitAuthorLine = (author) => `${author.name} <${author.email}> \xB7 ${author.source === "setting" ? "your setting" : "your account's name and email"}`;
 
+// src/http-client.ts
+import { Agent, setGlobalDispatcher } from "undici";
+var cliDispatcher = (connect2) => new Agent({ allowH2: false, ...connect2 === void 0 ? {} : { connect: connect2 } });
+var useHttp1 = () => {
+  setGlobalDispatcher(cliDispatcher());
+};
+
 // src/landing.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import * as fs8 from "node:fs";
-import * as os4 from "node:os";
-import * as path8 from "node:path";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import * as fs10 from "node:fs";
+import * as os5 from "node:os";
+import * as path10 from "node:path";
 var paint = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}[0m` : text;
 var dim = paint("2");
 var green = paint("32");
@@ -3522,7 +3619,7 @@ var landCommand = async (api2, args) => {
   if (!landingSucceeded(report)) process.exitCode = 1;
 };
 var git = (cwd, args) => {
-  const result = spawnSync3("git", args, { cwd, encoding: "utf8" });
+  const result = spawnSync4("git", args, { cwd, encoding: "utf8" });
   return {
     status: result.status ?? 1,
     stdout: result.stdout ?? "",
@@ -3545,9 +3642,9 @@ var gitRemotes = (cwd) => {
 var remoteForOrigin = (remotes, originUrl, cwd) => {
   if (originUrl === null) return null;
   const origin = normalizeRemoteUrl(originUrl);
-  const originPath = origin === null ? path8.resolve(originUrl.replace(/^file:\/\//, "")) : null;
+  const originPath = origin === null ? path10.resolve(originUrl.replace(/^file:\/\//, "")) : null;
   return remotes.find(
-    (remote) => origin === null ? path8.resolve(cwd, remote.url.replace(/^file:\/\//, "")) === originPath : normalizeRemoteUrl(remote.url) === origin
+    (remote) => origin === null ? path10.resolve(cwd, remote.url.replace(/^file:\/\//, "")) === originPath : normalizeRemoteUrl(remote.url) === origin
   ) ?? null;
 };
 var LOG_LINES = 10;
@@ -3570,10 +3667,10 @@ var fetchBundle = (cwd, bundle) => {
   const before = git(cwd, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]);
   const previous = before.status === 0 ? before.stdout.trim() : null;
   if (previous !== bundle.tip) {
-    const dir = fs8.mkdtempSync(path8.join(os4.tmpdir(), "mend-pull-"));
+    const dir = fs10.mkdtempSync(path10.join(os5.tmpdir(), "mend-pull-"));
     try {
-      const file = path8.join(dir, "change.bundle");
-      fs8.writeFileSync(file, bundle.bytes, { mode: 384 });
+      const file = path10.join(dir, "change.bundle");
+      fs10.writeFileSync(file, bundle.bytes, { mode: 384 });
       const fetched = git(cwd, [
         "fetch",
         "--no-tags",
@@ -3583,7 +3680,7 @@ var fetchBundle = (cwd, bundle) => {
       ]);
       if (fetched.status !== 0) return refusedWith(gitWords(fetched));
     } finally {
-      fs8.rmSync(dir, { recursive: true, force: true });
+      fs10.rmSync(dir, { recursive: true, force: true });
     }
   }
   const after = git(cwd, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).stdout.trim();
@@ -3774,7 +3871,7 @@ var followStart = async (options) => {
 
 // src/login.ts
 import { spawn as spawn2 } from "node:child_process";
-import * as os5 from "node:os";
+import * as os6 from "node:os";
 
 // src/pair.ts
 var paint2 = (code) => (text) => process.stdout.isTTY === true ? `\x1B[${code}m${text}\x1B[0m` : text;
@@ -3966,7 +4063,7 @@ var resolveServerUrl = async (args, deps) => {
 };
 var loginCommand = async (args, deps) => {
   const base = await resolveServerUrl(args, deps);
-  const started = await post(`${base}/api/cli/auth`, { name: os5.hostname() });
+  const started = await post(`${base}/api/cli/auth`, { name: os6.hostname() });
   if (started.status === 429) {
     return fail3(
       `the server asked for a pause \u2014 try again in ${retryAfterSecondsOf(started.json)}s`
@@ -4017,8 +4114,8 @@ var loginCommand = async (args, deps) => {
 };
 
 // src/organization.ts
-import * as fs9 from "node:fs";
-import * as path9 from "node:path";
+import * as fs11 from "node:fs";
+import * as path11 from "node:path";
 var paint4 = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}[0m` : text;
 var dim4 = paint4("2");
 var green4 = paint4("32");
@@ -4082,7 +4179,7 @@ var scanFolder = (dir) => {
   const files = [];
   const skipped = [];
   const walk = (relative4) => {
-    const entries = fs9.readdirSync(path9.join(dir, relative4), { withFileTypes: true }).toSorted((a, b) => a.name.localeCompare(b.name));
+    const entries = fs11.readdirSync(path11.join(dir, relative4), { withFileTypes: true }).toSorted((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       const child = relative4 === "" ? entry.name : `${relative4}/${entry.name}`;
       if (entry.isSymbolicLink()) {
@@ -4091,7 +4188,7 @@ var scanFolder = (dir) => {
         if (SKIPPED_DIRECTORIES.has(entry.name)) skipped.push({ path: child, reason: "skipped" });
         else walk(child);
       } else if (entry.isFile()) {
-        const size = fs9.statSync(path9.join(dir, child)).size;
+        const size = fs11.statSync(path11.join(dir, child)).size;
         if (size > FOLDER_FILE_BYTES) skipped.push({ path: child, reason: "over 1 MiB" });
         else files.push({ path: child, size });
       }
@@ -4144,7 +4241,7 @@ var folderCommand = async (api2, args) => {
     }
     case "push": {
       if (dir === void 0) return fail4("usage: mend folder push <name> <dir> [--replace]");
-      if (!fs9.existsSync(dir) || !fs9.statSync(dir).isDirectory()) {
+      if (!fs11.existsSync(dir) || !fs11.statSync(dir).isDirectory()) {
         return fail4(`${dir} is not a directory`);
       }
       const folder = await folderNamed(api2, name);
@@ -4159,7 +4256,7 @@ var folderCommand = async (api2, args) => {
           files: batch.map((file) => ({
             path: file.path,
             // Read one batch at a time, so a large tree never sits in memory at once.
-            contentsBase64: fs9.readFileSync(path9.join(dir, file.path)).toString("base64")
+            contentsBase64: fs11.readFileSync(path11.join(dir, file.path)).toString("base64")
           })),
           // --replace empties the folder with the first batch; the rest add to it.
           merge: !(replace && index === 0)
@@ -4343,8 +4440,8 @@ var operatorCommand = async (api2, tryApi, baseUrl, args) => {
 import { createHmac, randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import * as net2 from "node:net";
-import * as os7 from "node:os";
-import * as path11 from "node:path";
+import * as os8 from "node:os";
+import * as path13 from "node:path";
 
 // src/server-docker-volumes.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -4562,9 +4659,9 @@ var verifyServerDockerVolumes = (runtime, input) => ownership(runtime, input, "v
 
 // src/server-store.ts
 import { randomUUID } from "node:crypto";
-import * as fs10 from "node:fs";
-import * as os6 from "node:os";
-import * as path10 from "node:path";
+import * as fs12 from "node:fs";
+import * as os7 from "node:os";
+import * as path12 from "node:path";
 var ServerStoreError = class extends Error {
   _tag = "ServerStoreError";
 };
@@ -4585,28 +4682,28 @@ var attempt = (operation) => {
 var hasCode = (cause, code) => cause instanceof Error && "code" in cause && cause.code === code;
 var readOptional = (file) => {
   try {
-    return fs10.readFileSync(file, "utf8");
+    return fs12.readFileSync(file, "utf8");
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
   }
 };
 var syncDirectory = (directory) => {
-  const fd = fs10.openSync(directory, "r");
+  const fd = fs12.openSync(directory, "r");
   try {
-    fs10.fsyncSync(fd);
+    fs12.fsyncSync(fd);
   } finally {
-    fs10.closeSync(fd);
+    fs12.closeSync(fd);
   }
 };
 var writeDurable = (file, content, mode = 384) => {
-  const fd = fs10.openSync(file, "wx", mode);
+  const fd = fs12.openSync(file, "wx", mode);
   try {
-    fs10.writeFileSync(fd, content, "utf8");
-    fs10.fchmodSync(fd, mode);
-    fs10.fsyncSync(fd);
+    fs12.writeFileSync(fd, content, "utf8");
+    fs12.fchmodSync(fd, mode);
+    fs12.fsyncSync(fd);
   } finally {
-    fs10.closeSync(fd);
+    fs12.closeSync(fd);
   }
 };
 var fileKeys = ["identity", "config", "env", "compose", "postgresInit"];
@@ -4626,11 +4723,11 @@ var parseLockOwner = (raw) => {
 };
 var describeOwner = (lockDir) => {
   try {
-    const raw = JSON.parse(fs10.readFileSync(path10.join(lockDir, "owner.json"), "utf8"));
+    const raw = JSON.parse(fs12.readFileSync(path12.join(lockDir, "owner.json"), "utf8"));
     const owner = parseLockOwner(raw);
     if (owner === null) return "owner metadata is invalid";
     const label = `PID ${owner.pid} on ${owner.hostname}`;
-    if (owner.hostname !== os6.hostname()) return label;
+    if (owner.hostname !== os7.hostname()) return label;
     try {
       process.kill(owner.pid, 0);
       return `${label} is still live`;
@@ -4646,28 +4743,28 @@ var lockGuidance = (lockDir) => new ServerStoreError(
 );
 var acquireLock = (configDir, create) => {
   if (create) {
-    fs10.mkdirSync(configDir, { recursive: true, mode: 448 });
-    fs10.chmodSync(configDir, 448);
-  } else if (!fs10.existsSync(configDir)) {
+    fs12.mkdirSync(configDir, { recursive: true, mode: 448 });
+    fs12.chmodSync(configDir, 448);
+  } else if (!fs12.existsSync(configDir)) {
     throw new ServerStoreError(
       "No Mend server is configured. Run mend server setup explicitly to install one."
     );
   }
-  const lockDir = path10.join(configDir, "server.lock");
+  const lockDir = path12.join(configDir, "server.lock");
   try {
-    fs10.mkdirSync(lockDir, { mode: 448 });
+    fs12.mkdirSync(lockDir, { mode: 448 });
   } catch (cause) {
     if (hasCode(cause, "EEXIST")) throw lockGuidance(lockDir);
     throw cause;
   }
-  const owned = fs10.statSync(lockDir);
-  const ownerFile = path10.join(lockDir, "owner.json");
-  const owner = `${JSON.stringify({ pid: process.pid, hostname: os6.hostname(), token: randomUUID() })}
+  const owned = fs12.statSync(lockDir);
+  const ownerFile = path12.join(lockDir, "owner.json");
+  const owner = `${JSON.stringify({ pid: process.pid, hostname: os7.hostname(), token: randomUUID() })}
 `;
   let open = true;
   const assertOwned = () => {
-    const current = fs10.statSync(lockDir);
-    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs10.readFileSync(ownerFile, "utf8") !== owner) {
+    const current = fs12.statSync(lockDir);
+    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs12.readFileSync(ownerFile, "utf8") !== owner) {
       throw new ServerStoreError(
         "Server lock ownership was lost. Stop and check for another server command before retrying."
       );
@@ -4683,8 +4780,8 @@ var acquireLock = (configDir, create) => {
     release: () => {
       const result = attempt(() => {
         assertOwned();
-        fs10.unlinkSync(ownerFile);
-        fs10.rmdirSync(lockDir);
+        fs12.unlinkSync(ownerFile);
+        fs12.rmdirSync(lockDir);
       });
       open = false;
       return result;
@@ -4693,7 +4790,7 @@ var acquireLock = (configDir, create) => {
 };
 var readIdentity = (paths) => {
   const identity = readOptional(paths.identity);
-  if (identity === null && (fs10.existsSync(paths.active) || fs10.existsSync(paths.generations) && fs10.readdirSync(paths.generations).length > 0)) {
+  if (identity === null && (fs12.existsSync(paths.active) || fs12.existsSync(paths.generations) && fs12.readdirSync(paths.generations).length > 0)) {
     throw new ServerStoreError(
       "Server identity.env is missing. Restore it from a retained generation or backup; refusing to generate replacement credentials."
     );
@@ -4703,7 +4800,7 @@ var readIdentity = (paths) => {
 var readActive = (paths) => {
   let target;
   try {
-    target = fs10.readlinkSync(paths.active);
+    target = fs12.readlinkSync(paths.active);
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
@@ -4713,13 +4810,13 @@ var readActive = (paths) => {
       "Server active pointer is invalid. Restore the symlink to a retained generation before retrying."
     );
   }
-  const directory = path10.join(paths.configDir, target);
+  const directory = path12.join(paths.configDir, target);
   const files = {
-    identity: fs10.readFileSync(path10.join(directory, fileNames.identity), "utf8"),
-    config: fs10.readFileSync(path10.join(directory, fileNames.config), "utf8"),
-    env: fs10.readFileSync(path10.join(directory, fileNames.env), "utf8"),
-    compose: fs10.readFileSync(path10.join(directory, fileNames.compose), "utf8"),
-    postgresInit: fs10.readFileSync(path10.join(directory, fileNames.postgresInit), "utf8")
+    identity: fs12.readFileSync(path12.join(directory, fileNames.identity), "utf8"),
+    config: fs12.readFileSync(path12.join(directory, fileNames.config), "utf8"),
+    env: fs12.readFileSync(path12.join(directory, fileNames.env), "utf8"),
+    compose: fs12.readFileSync(path12.join(directory, fileNames.compose), "utf8"),
+    postgresInit: fs12.readFileSync(path12.join(directory, fileNames.postgresInit), "utf8")
   };
   if (readIdentity(paths) !== files.identity) {
     throw new ServerStoreError(
@@ -4729,20 +4826,20 @@ var readActive = (paths) => {
   return { directory, files };
 };
 var publishIdentity = (paths, identity) => {
-  const temporary = path10.join(paths.configDir, `.identity-${randomUUID()}`);
+  const temporary = path12.join(paths.configDir, `.identity-${randomUUID()}`);
   writeDurable(temporary, identity);
-  fs10.linkSync(temporary, paths.identity);
+  fs12.linkSync(temporary, paths.identity);
   syncDirectory(paths.configDir);
-  fs10.unlinkSync(temporary);
+  fs12.unlinkSync(temporary);
 };
 var prepareGeneration = (paths, files) => {
-  fs10.mkdirSync(paths.generations, { recursive: true, mode: 448 });
+  fs12.mkdirSync(paths.generations, { recursive: true, mode: 448 });
   const generationName = `gen-${randomUUID()}`;
-  const directory = path10.join(paths.generations, generationName);
-  fs10.mkdirSync(directory, { mode: 448 });
+  const directory = path12.join(paths.generations, generationName);
+  fs12.mkdirSync(directory, { mode: 448 });
   for (const key of fileKeys) {
     writeDurable(
-      path10.join(directory, fileNames[key]),
+      path12.join(directory, fileNames[key]),
       files[key],
       key === "postgresInit" ? 493 : 384
     );
@@ -4753,18 +4850,18 @@ var prepareGeneration = (paths, files) => {
   return { directory, files };
 };
 var activateGeneration = (paths, generation) => {
-  const relative4 = path10.relative(paths.configDir, generation.directory);
-  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative4) || readIdentity(paths) !== fs10.readFileSync(path10.join(generation.directory, "identity.env"), "utf8")) {
+  const relative4 = path12.relative(paths.configDir, generation.directory);
+  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative4) || readIdentity(paths) !== fs12.readFileSync(path12.join(generation.directory, "identity.env"), "utf8")) {
     throw new ServerStoreError("Cannot activate a generation outside this installation identity.");
   }
   for (const key of fileKeys) {
-    if (fs10.readFileSync(path10.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
+    if (fs12.readFileSync(path12.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
       throw new ServerStoreError("Cannot activate an incomplete or changed server generation.");
     }
   }
-  const pointer = path10.join(paths.configDir, `.active-${randomUUID()}`);
-  fs10.symlinkSync(relative4, pointer);
-  fs10.renameSync(pointer, paths.active);
+  const pointer = path12.join(paths.configDir, `.active-${randomUUID()}`);
+  fs12.symlinkSync(relative4, pointer);
+  fs12.renameSync(pointer, paths.active);
   syncDirectory(paths.configDir);
 };
 var prepareFiles = (paths, files) => {
@@ -4773,7 +4870,7 @@ var prepareFiles = (paths, files) => {
     throw new ServerStoreError("Server identity already exists; refusing to replace credentials.");
   }
   const active = readActive(paths);
-  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs10.statSync(path10.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
+  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs12.statSync(path12.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
     return active;
   if (identity === null) publishIdentity(paths, files.identity);
   return prepareGeneration(paths, files);
@@ -4786,9 +4883,9 @@ var commitGeneration = (paths, files) => {
 var createStore = (configDir, lock) => {
   const paths = {
     configDir,
-    identity: path10.join(configDir, "identity.env"),
-    generations: path10.join(configDir, "generations"),
-    active: path10.join(configDir, "active")
+    identity: path12.join(configDir, "identity.env"),
+    generations: path12.join(configDir, "generations"),
+    active: path12.join(configDir, "active")
   };
   const whileOwned = (operation) => attempt(() => {
     lock.assertOwned();
@@ -4801,13 +4898,13 @@ var createStore = (configDir, lock) => {
     prepare: (files) => whileOwned(() => prepareFiles(paths, files)),
     activate: (generation) => whileOwned(() => activateGeneration(paths, generation)),
     createBackup: (previous, target) => whileOwned(() => {
-      const backups = path10.join(configDir, "backups");
-      fs10.mkdirSync(backups, { recursive: true, mode: 448 });
-      fs10.chmodSync(backups, 448);
-      const directory = path10.join(backups, `upgrade-${randomUUID()}`);
-      fs10.mkdirSync(directory, { mode: 448 });
+      const backups = path12.join(configDir, "backups");
+      fs12.mkdirSync(backups, { recursive: true, mode: 448 });
+      fs12.chmodSync(backups, 448);
+      const directory = path12.join(backups, `upgrade-${randomUUID()}`);
+      fs12.mkdirSync(directory, { mode: 448 });
       writeDurable(
-        path10.join(directory, "recovery.json"),
+        path12.join(directory, "recovery.json"),
         `${JSON.stringify(
           {
             previousGeneration: previous.directory,
@@ -4823,21 +4920,21 @@ var createStore = (configDir, lock) => {
       syncDirectory(directory);
       syncDirectory(backups);
       syncDirectory(configDir);
-      const partialFile = path10.join(directory, "database.sql.partial");
+      const partialFile = path12.join(directory, "database.sql.partial");
       return {
         directory,
         partialFile,
         complete: () => whileOwned(() => {
-          if (fs10.statSync(partialFile).size === 0)
+          if (fs12.statSync(partialFile).size === 0)
             throw new ServerStoreError("Database backup is empty; refusing target startup.");
-          const fd = fs10.openSync(partialFile, "r");
+          const fd = fs12.openSync(partialFile, "r");
           try {
-            fs10.fchmodSync(fd, 384);
-            fs10.fsyncSync(fd);
+            fs12.fchmodSync(fd, 384);
+            fs12.fsyncSync(fd);
           } finally {
-            fs10.closeSync(fd);
+            fs12.closeSync(fd);
           }
-          fs10.renameSync(partialFile, path10.join(directory, "database.sql"));
+          fs12.renameSync(partialFile, path12.join(directory, "database.sql"));
           syncDirectory(directory);
         })
       };
@@ -4846,7 +4943,7 @@ var createStore = (configDir, lock) => {
 };
 var refuseFlatLayout = (configDir) => {
   if (["server.json", "server.env", "compose.yaml", "postgres-init.sh"].some(
-    (name) => fs10.existsSync(path10.join(configDir, name))
+    (name) => fs12.existsSync(path12.join(configDir, name))
   )) {
     throw new ServerStoreError(
       "Unreleased flat server configuration found. Preserve its credentials and volumes; migrate it to the generation layout before retrying. Setup will not replace this identity."
@@ -4854,7 +4951,7 @@ var refuseFlatLayout = (configDir) => {
   }
 };
 var withServerStore = async (directory, operation, options = {}) => {
-  const configDir = path10.resolve(directory);
+  const configDir = path12.resolve(directory);
   let lock;
   let result;
   try {
@@ -4871,9 +4968,9 @@ var withServerStore = async (directory, operation, options = {}) => {
 };
 
 // src/version.ts
-import * as fs11 from "node:fs";
+import * as fs13 from "node:fs";
 var cliVersion = () => {
-  const raw = fs11.readFileSync(new URL("../package.json", import.meta.url), "utf8");
+  const raw = fs13.readFileSync(new URL("../package.json", import.meta.url), "utf8");
   const parsed = JSON.parse(raw);
   if (typeof parsed === "object" && parsed !== null && "version" in parsed) {
     const version = parsed.version;
@@ -5576,7 +5673,7 @@ var resolveServerVersion = async (runtime, options, existing) => {
   return version;
 };
 var parseDockerSocketPath = (socket) => {
-  if (!path11.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
+  if (!path13.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
     throw setupError(
       "--docker-socket must be an absolute path without line breaks or Compose interpolation characters."
     );
@@ -5602,8 +5699,8 @@ var resolveAssets = async (runtime, serverVersion, existing, store, options) =>
   if (options.assetsDir !== void 0) {
     try {
       const [compose2, postgresInit2] = await Promise.all([
-        readFile(path11.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
-        readFile(path11.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
+        readFile(path13.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
+        readFile(path13.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
       ]);
       validateComposeAsset(compose2);
       validatePostgresAsset(postgresInit2);
@@ -6129,10 +6226,10 @@ var manageServer = async (command, args, runtime, store) => {
 };
 var nodeServerRuntime = () => {
   const environment = { ...process.env };
-  const home = os7.homedir();
-  const configHome = environment["XDG_CONFIG_HOME"] ?? path11.join(home, ".config");
+  const home = os8.homedir();
+  const configHome = environment["XDG_CONFIG_HOME"] ?? path13.join(home, ".config");
   return {
-    configDir: path11.join(configHome, "mend"),
+    configDir: path13.join(configHome, "mend"),
     platform: process.platform,
     cliVersion: cliVersion(),
     run: (command, args, options) => runServerProcess(command, args, environment, options),
@@ -6585,8 +6682,8 @@ var createServiceTunnels = (options) => {
 };
 
 // src/skills.ts
-import * as fs12 from "node:fs";
-import * as path12 from "node:path";
+import * as fs14 from "node:fs";
+import * as path14 from "node:path";
 var DEFAULT_SKILLS_DIR = ".agents/skills";
 var MAX_SKILL_FILES = 64;
 var MAX_SKILL_FILE_BYTES = 512 * 1024;
@@ -6609,12 +6706,12 @@ var readFrontmatterDescription = (contents) => {
 var walkFiles = (root) => {
   const found = [];
   const visit = (dir) => {
-    for (const entry of fs12.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs14.readdirSync(dir, { withFileTypes: true })) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const absolute = path12.join(dir, entry.name);
+      const absolute = path14.join(dir, entry.name);
       let stat;
       try {
-        stat = fs12.statSync(absolute);
+        stat = fs14.statSync(absolute);
       } catch {
         continue;
       }
@@ -6628,7 +6725,7 @@ var walkFiles = (root) => {
 var scanSkillLibrary = (root) => {
   let entries;
   try {
-    entries = fs12.readdirSync(root, { withFileTypes: true });
+    entries = fs14.readdirSync(root, { withFileTypes: true });
   } catch {
     return { error: `${root} is not a readable directory` };
   }
@@ -6636,23 +6733,23 @@ var scanSkillLibrary = (root) => {
   const notes = [];
   for (const entry of entries.toSorted((a, b) => a.name.localeCompare(b.name))) {
     if (entry.name.startsWith(".")) continue;
-    const skillDir = path12.join(root, entry.name);
+    const skillDir = path14.join(root, entry.name);
     let stat;
     try {
-      stat = fs12.statSync(skillDir);
+      stat = fs14.statSync(skillDir);
     } catch {
       continue;
     }
     if (!stat.isDirectory()) continue;
-    if (!fs12.existsSync(path12.join(skillDir, "SKILL.md"))) {
+    if (!fs14.existsSync(path14.join(skillDir, "SKILL.md"))) {
       notes.push({ skill: entry.name, message: "no SKILL.md \u2014 skipped" });
       continue;
     }
     const files = [];
     let bytes = 0;
     for (const absolute of walkFiles(skillDir)) {
-      const relative4 = path12.relative(skillDir, absolute).split(path12.sep).join("/");
-      const buffer = fs12.readFileSync(absolute);
+      const relative4 = path14.relative(skillDir, absolute).split(path14.sep).join("/");
+      const buffer = fs14.readFileSync(absolute);
       if (buffer.byteLength > MAX_SKILL_FILE_BYTES) {
         notes.push({ skill: entry.name, message: `${relative4} is over 512KB \u2014 skipped` });
         continue;
@@ -6687,16 +6784,16 @@ var scanSkillLibrary = (root) => {
 };
 
 // src/ssh-setup.ts
-import * as os9 from "node:os";
-import * as path14 from "node:path";
+import * as os10 from "node:os";
+import * as path16 from "node:path";
 
 // ../../packages/workspace-ssh/src/index.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 import { createHash as createHash3 } from "node:crypto";
-import * as fs13 from "node:fs";
+import * as fs15 from "node:fs";
 import { isIP as isIP2 } from "node:net";
-import * as os8 from "node:os";
-import * as path13 from "node:path";
+import * as os9 from "node:os";
+import * as path15 from "node:path";
 var LEGACY_BLOCK_BEGIN = "# >>> mend workspace ssh (managed by `mend ssh setup`) >>>";
 var LEGACY_BLOCK_END = "# <<< mend workspace ssh <<<";
 var WorkspaceSshError = class extends Error {
@@ -6783,8 +6880,8 @@ var blockBegin = (alias) => `# >>> mend workspace ssh ${alias} (managed) >>>`;
 var blockEnd = (alias) => `# <<< mend workspace ssh ${alias} <<<`;
 var hasControls = (value) => /[\p{Cc}\p{Zl}\p{Zp}]/u.test(value);
 var parseIdentityPath = (value) => {
-  const resolved = path13.resolve(
-    value.startsWith("~/") ? path13.join(os8.homedir(), value.slice(2)) : value
+  const resolved = path15.resolve(
+    value.startsWith("~/") ? path15.join(os9.homedir(), value.slice(2)) : value
   );
   if (value === "" || hasControls(value) || hasControls(resolved) || value.includes("${") || resolved.includes("${")) {
     return failure(
@@ -6930,7 +7027,7 @@ var workspaceSshPublicKeyFingerprint = (publicKey) => {
 var publicKeyIdentity = (publicKey) => publicKey.trim().split(/\s+/).slice(0, 2).join(" ");
 var agentKeys = () => {
   if (!process.env["SSH_AUTH_SOCK"]) return [];
-  const listed = spawnSync4("ssh-add", ["-L"], {
+  const listed = spawnSync5("ssh-add", ["-L"], {
     encoding: "utf8",
     timeout: 3e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -6940,7 +7037,7 @@ var agentKeys = () => {
 };
 var readText = (file) => {
   try {
-    return success(fs13.readFileSync(file, "utf8"));
+    return success(fs15.readFileSync(file, "utf8"));
   } catch (cause) {
     const error = cause instanceof Error && "code" in cause ? cause.code : void 0;
     return error === "ENOENT" ? success("") : failure(new WorkspaceSshError("key", `Could not read ${file}.`, cause));
@@ -6967,7 +7064,7 @@ var readRequiredKey = (keyPath, source) => {
   const privatePath = publicPath.slice(0, -".pub".length);
   const read = readText(publicPath);
   if (!read.ok) return read;
-  const derived = spawnSync4("ssh-keygen", ["-y", "-P", "", "-f", privatePath], {
+  const derived = spawnSync5("ssh-keygen", ["-y", "-P", "", "-f", privatePath], {
     encoding: "utf8",
     timeout: 3e3,
     stdio: ["ignore", "pipe", "pipe"],
@@ -6998,19 +7095,19 @@ var readRequiredKey = (keyPath, source) => {
 var readOptionalKey = (keyPath) => {
   const parsed = parseIdentityPath(keyPath);
   if (!parsed.ok) return parsed;
-  if (!fs13.existsSync(parsed.value) && !fs13.existsSync(publicKeyPath(parsed.value)))
+  if (!fs15.existsSync(parsed.value) && !fs15.existsSync(publicKeyPath(parsed.value)))
     return success(null);
   return readRequiredKey(parsed.value, "existing");
 };
 var pinAgentKey = (configHome, publicKey) => {
-  const identityFile = path13.resolve(
+  const identityFile = path15.resolve(
     configHome,
     "ssh",
     `agent-${hashIdentity(publicKeyIdentity(publicKey))}.pub`
   );
   try {
-    fs13.mkdirSync(path13.dirname(identityFile), { recursive: true, mode: 448 });
-    fs13.writeFileSync(identityFile, `${publicKey}
+    fs15.mkdirSync(path15.dirname(identityFile), { recursive: true, mode: 448 });
+    fs15.writeFileSync(identityFile, `${publicKey}
 `, { mode: 384 });
     return success({ publicKey, identityFile, source: "agent" });
   } catch (cause) {
@@ -7021,15 +7118,15 @@ var pinAgentKey = (configHome, publicKey) => {
 };
 var generateDedicatedKey = (privatePath) => {
   try {
-    fs13.mkdirSync(path13.dirname(privatePath), { recursive: true, mode: 448 });
+    fs15.mkdirSync(path15.dirname(privatePath), { recursive: true, mode: 448 });
   } catch (cause) {
     return failure(
-      new WorkspaceSshError("key", `Could not create ${path13.dirname(privatePath)}.`, cause)
+      new WorkspaceSshError("key", `Could not create ${path15.dirname(privatePath)}.`, cause)
     );
   }
-  const generated = spawnSync4(
+  const generated = spawnSync5(
     "ssh-keygen",
-    ["-t", "ed25519", "-f", privatePath, "-N", "", "-C", `mend-${os8.hostname()}`],
+    ["-t", "ed25519", "-f", privatePath, "-N", "", "-C", `mend-${os9.hostname()}`],
     { encoding: "utf8", timeout: 3e3, stdio: ["ignore", "pipe", "pipe"] }
   );
   if (generated.status !== 0) {
@@ -7053,7 +7150,7 @@ var generateDedicatedKey = (privatePath) => {
   return fresh;
 };
 var dedicatedKey = (configHome, create) => {
-  const privatePath = path13.join(configHome, "ssh", "id_ed25519");
+  const privatePath = path15.join(configHome, "ssh", "id_ed25519");
   const existing = readOptionalKey(privatePath);
   if (existing.ok === false) return failure(existing.error);
   if (existing.value !== null || !create) return existing;
@@ -7101,10 +7198,10 @@ var writeWorkspaceSshConfig = (configFile, target, identityFile) => {
   const reconciled = reconcileWorkspaceSshConfig(before.value, target, identityFile);
   if (reconciled.ok === false) return failure(reconciled.error);
   try {
-    fs13.mkdirSync(path13.dirname(configFile), { recursive: true, mode: 448 });
-    fs13.chmodSync(path13.dirname(configFile), 448);
-    fs13.writeFileSync(configFile, reconciled.value, { mode: 384 });
-    fs13.chmodSync(configFile, 384);
+    fs15.mkdirSync(path15.dirname(configFile), { recursive: true, mode: 448 });
+    fs15.chmodSync(path15.dirname(configFile), 448);
+    fs15.writeFileSync(configFile, reconciled.value, { mode: 384 });
+    fs15.chmodSync(configFile, 384);
     return success(void 0);
   } catch (cause) {
     return failure(new WorkspaceSshError("config", `Could not write ${configFile}.`, cause));
@@ -7117,7 +7214,7 @@ var dim5 = ansi("2");
 var green5 = ansi("32");
 var warn = ansi("33");
 var say5 = (line) => console.log(line);
-var sshConfigPath = () => path14.join(os9.homedir(), ".ssh", "config");
+var sshConfigPath = () => path16.join(os10.homedir(), ".ssh", "config");
 var flagValue2 = (args, flag) => {
   const index = args.indexOf(flag);
   return index === -1 || args[index + 1] === void 0 ? null : String(args[index + 1]);
@@ -7187,7 +7284,7 @@ var setup = async (api2, cliHome, serverUrl, args) => {
   if (picked.value === null) return showFailure("No workspace SSH key is available.");
   const registered = await api2("POST", "/workspace-ssh/keys", {
     publicKey: picked.value.publicKey,
-    name: os9.hostname()
+    name: os10.hostname()
   });
   const sourceLabel = {
     explicit: "from --key",
@@ -7229,8 +7326,8 @@ var sshCommand = async (args, api2, cliHome, serverUrl) => {
 };
 
 // src/uninstall.ts
-import * as fs14 from "node:fs";
-import * as path15 from "node:path";
+import * as fs16 from "node:fs";
+import * as path17 from "node:path";
 var UNINSTALL_USAGE = "usage: mend uninstall [--all | --server | --home] [--yes]";
 var parseUninstallArgs = (args) => {
   let scope = null;
@@ -7252,14 +7349,14 @@ var parseUninstallArgs = (args) => {
 var SERVER_FILES = ["identity.env", "active", "generations", "backups"];
 var countEntries = (directory) => {
   try {
-    return fs14.readdirSync(directory).length;
+    return fs16.readdirSync(directory).length;
   } catch {
     return 0;
   }
 };
 var exists = (file) => {
   try {
-    fs14.lstatSync(file);
+    fs16.lstatSync(file);
     return true;
   } catch {
     return false;
@@ -7268,7 +7365,7 @@ var exists = (file) => {
 var managedBlockCount = (sshConfigFile) => {
   let config;
   try {
-    config = fs14.readFileSync(sshConfigFile, "utf8");
+    config = fs16.readFileSync(sshConfigFile, "utf8");
   } catch {
     return 0;
   }
@@ -7292,27 +7389,27 @@ var describeUninstall = async (runtime, scope) => {
       if (!read.error.message.startsWith("No Mend server is configured")) throw read.error;
       server = "none";
     } else if (read.value === null) {
-      server = exists(path15.join(configDir, "identity.env")) ? {
+      server = exists(path17.join(configDir, "identity.env")) ? {
         version: "(no active generation)",
         appUrl: "",
         dockerContext: "",
-        generations: countEntries(path15.join(configDir, "generations")),
-        backups: countEntries(path15.join(configDir, "backups"))
+        generations: countEntries(path17.join(configDir, "generations")),
+        backups: countEntries(path17.join(configDir, "backups"))
       } : "none";
     } else {
       server = {
         version: read.value.config.serverVersion,
         appUrl: read.value.config.appUrl,
         dockerContext: read.value.config.dockerContext,
-        generations: countEntries(path15.join(configDir, "generations")),
-        backups: countEntries(path15.join(configDir, "backups"))
+        generations: countEntries(path17.join(configDir, "generations")),
+        backups: countEntries(path17.join(configDir, "backups"))
       };
     }
   }
   let home = null;
   if (scope !== "server") {
-    const cliConfig = path15.join(runtime.cliHome, "cli.json");
-    const sshDirectory = path15.join(runtime.cliHome, "ssh");
+    const cliConfig = path17.join(runtime.cliHome, "cli.json");
+    const sshDirectory = path17.join(runtime.cliHome, "ssh");
     home = {
       cliConfig: exists(cliConfig) ? cliConfig : null,
       sshDirectory: exists(sshDirectory) ? sshDirectory : null,
@@ -7444,7 +7541,7 @@ var removeServer = async (runtime, failures, leftovers) => {
         }
       }
       for (const name of SERVER_FILES) {
-        fs14.rmSync(path15.join(configDir, name), { recursive: true, force: true });
+        fs16.rmSync(path17.join(configDir, name), { recursive: true, force: true });
       }
       server.writeLine(`removed ${configDir}/{identity.env, active, generations, backups}`);
     },
@@ -7455,20 +7552,20 @@ var removeServer = async (runtime, failures, leftovers) => {
 var removeHome = async (runtime, plan, failures, leftovers) => {
   const { server } = runtime;
   if (plan.cliConfig !== null) {
-    fs14.rmSync(plan.cliConfig, { force: true });
+    fs16.rmSync(plan.cliConfig, { force: true });
     server.writeLine(`removed ${plan.cliConfig}`);
   }
   if (plan.sshDirectory !== null) {
-    fs14.rmSync(plan.sshDirectory, { recursive: true, force: true });
+    fs16.rmSync(plan.sshDirectory, { recursive: true, force: true });
     server.writeLine(`removed ${plan.sshDirectory}`);
   }
   if (plan.managedSshBlocks > 0) {
     try {
-      const before = fs14.readFileSync(runtime.sshConfigFile, "utf8");
+      const before = fs16.readFileSync(runtime.sshConfigFile, "utf8");
       const stripped = stripManagedWorkspaceSshBlocks(before);
       if (!stripped.ok) throw stripped.error;
       if (stripped.value.removed > 0) {
-        fs14.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
+        fs16.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
         server.writeLine(
           `removed ${plural(stripped.value.removed, "managed block")} from ${runtime.sshConfigFile}`
         );
@@ -7481,12 +7578,12 @@ var removeHome = async (runtime, plan, failures, leftovers) => {
   }
   let remaining = [];
   try {
-    remaining = fs14.readdirSync(runtime.cliHome);
+    remaining = fs16.readdirSync(runtime.cliHome);
   } catch {
     return;
   }
   if (remaining.length === 0) {
-    fs14.rmdirSync(runtime.cliHome);
+    fs16.rmdirSync(runtime.cliHome);
     server.writeLine(`removed ${runtime.cliHome}`);
   } else {
     leftovers.push(
@@ -7550,19 +7647,19 @@ var upgradeUrl = async (input) => {
 // src/main.ts
 var mendCliHome = () => {
   const xdg = process.env["XDG_CONFIG_HOME"];
-  const preferred = path16.join(
-    xdg === void 0 || xdg === "" ? path16.join(os10.homedir(), ".config") : xdg,
+  const preferred = path18.join(
+    xdg === void 0 || xdg === "" ? path18.join(os11.homedir(), ".config") : xdg,
     "mend"
   );
-  const legacy = path16.join(os10.homedir(), ".mend");
-  return !fs15.existsSync(preferred) && fs15.existsSync(legacy) ? legacy : preferred;
+  const legacy = path18.join(os11.homedir(), ".mend");
+  return !fs17.existsSync(preferred) && fs17.existsSync(legacy) ? legacy : preferred;
 };
-var CONFIG_PATH = path16.join(mendCliHome(), "cli.json");
+var CONFIG_PATH = path18.join(mendCliHome(), "cli.json");
 var loadConfig = () => {
   let fileConfig = {};
-  if (fs15.existsSync(CONFIG_PATH)) {
+  if (fs17.existsSync(CONFIG_PATH)) {
     try {
-      fileConfig = JSON.parse(fs15.readFileSync(CONFIG_PATH, "utf8"));
+      fileConfig = JSON.parse(fs17.readFileSync(CONFIG_PATH, "utf8"));
     } catch {
       fail6(`could not parse ${CONFIG_PATH}`);
     }
@@ -7814,7 +7911,7 @@ var adopt = async (config, args) => {
   }
   const sourceIssue = repositoryCloneUrlIssue(source);
   if (sourceIssue !== null) return fail6(sourceIssue);
-  const projectName = name ?? normalizeProjectName(path16.basename(source, ".git"));
+  const projectName = name ?? normalizeProjectName(path18.basename(source, ".git"));
   const auth = authFlagIndex !== -1 && args[authFlagIndex + 1] !== void 0 ? String(args[authFlagIndex + 1]) : null;
   if (auth !== null && auth !== "ambient" && auth !== "mend-key" && auth !== "bridge") {
     return fail6(`--auth takes "ambient", "mend-key", or "bridge", not "${auth}"`);
@@ -7863,7 +7960,7 @@ var findProject = async (config, explicit, adoptCwd = false) => {
   const sourceIssue = repositoryCloneUrlIssue(facts.originUrl);
   if (sourceIssue !== null) return fail6(sourceIssue);
   const adopted = await api(config, "POST", "/projects", {
-    name: normalizeProjectName(path16.basename(facts.repoRoot)),
+    name: normalizeProjectName(path18.basename(facts.repoRoot)),
     source: facts.originUrl
   });
   say6(`${green6("\u2713")} adopted \xB7 ${adopted.name} \xB7 ${dim6(adopted.storePath)}`);
@@ -8824,13 +8921,13 @@ var serviceRestart = async (config, args) => {
 };
 var serviceInit = async (args) => {
   const root = gitTopLevel(process.cwd()) ?? process.cwd();
-  const target = path16.join(root, "mend.toml");
-  if (fs15.existsSync(target)) {
+  const target = path18.join(root, "mend.toml");
+  if (fs17.existsSync(target)) {
     return fail6(`${target} already exists \u2014 edit it directly (init never merges)`);
   }
-  const rootFiles = fs15.readdirSync(root);
+  const rootFiles = fs17.readdirSync(root);
   const proposals = [];
-  const readRoot = (name) => fs15.readFileSync(path16.join(root, name), "utf8");
+  const readRoot = (name) => fs17.readFileSync(path18.join(root, name), "utf8");
   if (rootFiles.includes("package.json")) {
     proposals.push(...proposeFromPackageJson(readRoot("package.json"), rootFiles));
   }
@@ -8840,13 +8937,13 @@ var serviceInit = async (args) => {
   );
   for (const glob of globs) {
     const parent = glob.replace(/\/?\*+$/, "");
-    const dirs = glob.endsWith("*") ? fs15.existsSync(path16.join(root, parent)) ? fs15.readdirSync(path16.join(root, parent)).map((dir) => path16.join(parent, dir)) : [] : [glob];
+    const dirs = glob.endsWith("*") ? fs17.existsSync(path18.join(root, parent)) ? fs17.readdirSync(path18.join(root, parent)).map((dir) => path18.join(parent, dir)) : [] : [glob];
     for (const dir of dirs) {
-      const manifest = path16.join(root, dir, "package.json");
-      if (!fs15.existsSync(manifest)) continue;
+      const manifest = path18.join(root, dir, "package.json");
+      if (!fs17.existsSync(manifest)) continue;
       for (const proposal of proposeFromWorkspacePackage(
-        path16.basename(dir),
-        fs15.readFileSync(manifest, "utf8"),
+        path18.basename(dir),
+        fs17.readFileSync(manifest, "utf8"),
         rootFiles
       )) {
         if (!proposals.some((existing) => existing.name === proposal.name)) {
@@ -8890,7 +8987,7 @@ var serviceInit = async (args) => {
       return;
     }
   }
-  fs15.writeFileSync(target, toml);
+  fs17.writeFileSync(target, toml);
   say6(`${green6("\u2713")} wrote ${target} \u2014 commit it, then: mend service run ${proposals[0]?.name}`);
 };
 var tunnelServices = async (config, services, portOverride) => {
@@ -8994,23 +9091,23 @@ var serviceCommand = async (config, args) => {
   }
 };
 var isProvider = (value) => value === "claude" || value === "codex" || value === "github";
-var readIfExists = (file) => fs15.existsSync(file) ? fs15.readFileSync(file, "utf8") : null;
+var readIfExists = (file) => fs17.existsSync(file) ? fs17.readFileSync(file, "utf8") : null;
 var localCredential = (provider) => {
-  const home = os10.homedir();
+  const home = os11.homedir();
   switch (provider) {
     case "codex":
       return readIfExists(
-        path16.join(process.env["CODEX_HOME"] ?? path16.join(home, ".codex"), "auth.json")
+        path18.join(process.env["CODEX_HOME"] ?? path18.join(home, ".codex"), "auth.json")
       );
     case "claude":
       return readIfExists(
-        path16.join(
-          process.env["CLAUDE_CONFIG_DIR"] ?? path16.join(home, ".claude"),
+        path18.join(
+          process.env["CLAUDE_CONFIG_DIR"] ?? path18.join(home, ".claude"),
           ".credentials.json"
         )
       );
     case "github": {
-      const result = spawnSync5("gh", ["auth", "token"], { encoding: "utf8" });
+      const result = spawnSync6("gh", ["auth", "token"], { encoding: "utf8" });
       const token = result.status === 0 ? result.stdout.trim() : "";
       return token === "" ? null : token;
     }
@@ -9022,7 +9119,7 @@ var accountLine = (account) => {
   const identity = pick("login") ?? pick("email") ?? pick("accountEmail") ?? pick("accountId");
   const suffix = pick("tokenSuffix");
   const facts = [
-    account.status === "active" ? "connected" : account.status,
+    account.status === "active" ? "connected" : account.status === "invalid" ? "reconnect needed \xB7 the provider refused the login" : account.status,
     identity,
     suffix === null ? null : `\u2026${suffix}`,
     `since ${account.connectedAt.slice(0, 10)}`
@@ -9055,7 +9152,7 @@ var claudeGrantSecret = () => {
   return read.kind === "missing" ? null : read.secret;
 };
 var doctorBundle = (config, args) => doctorBundleCommand(args, {
-  defaultDir: path16.join(mendCliHome(), "bundles"),
+  defaultDir: path18.join(mendCliHome(), "bundles"),
   now: () => /* @__PURE__ */ new Date(),
   say: say6,
   warn: (line) => process.stderr.write(`${line}
@@ -9096,74 +9193,69 @@ var staleGrantReason = (secret) => {
 };
 var claudeGrant = async () => {
   const cli = claudeCli();
-  const dir = claudeGrantDir(mendCliHome());
+  const home = mendCliHome();
   const personal = personalClaudeDir();
   const personalBefore = grantStatus(cli, personal);
-  let status = grantStatus(cli, dir);
-  if (status === null) {
-    fail6(
-      "claude: could not run `claude auth status` \u2014 install Claude Code, set MEND_CLAUDE_BIN, or paste a credential: mend connect claude --from-stdin"
-    );
-    return null;
-  }
-  if (!status.loggedIn) {
-    say6(`  Mend needs its own Claude login, kept in ${dir}`);
+  const dir = throwawayLoginDir(home, "claude-login-");
+  try {
+    if (grantStatus(cli, dir) === null) {
+      fail6(
+        "claude: could not run `claude auth status` \u2014 install Claude Code, set MEND_CLAUDE_BIN, or paste a credential: mend connect claude --from-stdin"
+      );
+      return null;
+    }
+    say6("  Mend needs its own Claude login; it is sent to your server and not kept here");
     say6(dim6("  your own Claude login stays as it is"));
     if (!runClaudeLogin(cli, dir)) {
       fail6("claude: the login did not complete");
       return null;
     }
-    status = grantStatus(cli, dir) ?? status;
-    if (!status.loggedIn) {
+    const status = grantStatus(cli, dir);
+    if (status === null || !status.loggedIn) {
       fail6("claude: the login completed but Claude still reports no grant in Mend's directory");
       return null;
     }
-  }
-  if (status.configDirectory !== null && path16.resolve(status.configDirectory) !== path16.resolve(dir)) {
-    fail6(
-      `claude: this Claude read ${status.configDirectory} instead of ${dir}, so a separate grant is not possible \u2014 connect the shared one deliberately with --use-my-login`
-    );
-    return null;
-  }
-  let read = readGrant(dir);
-  if (read.kind !== "missing") {
+    if (status.configDirectory !== null && path18.resolve(status.configDirectory) !== path18.resolve(dir)) {
+      fail6(
+        `claude: this Claude read ${status.configDirectory} instead of ${dir}, so a separate grant is not possible \u2014 connect the shared one deliberately with --use-my-login`
+      );
+      return null;
+    }
+    const read = readGrant(dir);
+    if (read.kind === "missing") {
+      const where = read.triedService === null ? read.triedPath : `${read.triedPath} or the Keychain item ${read.triedService}`;
+      fail6(`claude: logged in, but no credential to read \u2014 looked in ${where}`);
+      return null;
+    }
     const why = staleGrantReason(read.secret);
     if (why !== null) {
-      say6(`  Mend's Claude grant is ${why}; logging in again`);
-      if (!runClaudeLogin(cli, dir)) {
-        fail6("claude: the login did not complete");
-        return null;
-      }
-      read = readGrant(dir);
-      const still = read.kind === "missing" ? "missing" : staleGrantReason(read.secret);
-      if (still !== null) {
-        fail6(`claude: the grant is still ${still} after logging in`);
-        return null;
-      }
+      fail6(`claude: the new login is already ${why}`);
+      return null;
     }
+    const mine = localCredential("claude");
+    if (mine !== null && sameGrant(read.secret, mine)) {
+      fail6(
+        "claude: that is the same grant this machine's Claude holds, so both sides would race on refresh \u2014 connect it deliberately with --use-my-login"
+      );
+      return null;
+    }
+    const personalAfter = grantStatus(cli, personal);
+    if (personalBefore?.loggedIn === true && personalAfter?.loggedIn === false) {
+      say6(
+        `  your own Claude login was signed out by this one \u2014 this account allows one grant at a time. Run \`claude auth login\` to get it back, and connect the shared grant with --use-my-login instead.`
+      );
+    } else if (personalAfter?.loggedIn === true) {
+      say6(dim6("  your own Claude login still works \xB7 verified"));
+    }
+    const kept = claudeGrantDir(home);
+    if (fs17.existsSync(kept)) {
+      forgetGrant(kept);
+      say6(dim6(`  removed the copy an older mend kept in ${kept} \xB7 the server refreshes the login`));
+    }
+    return read.secret;
+  } finally {
+    forgetGrant(dir);
   }
-  if (read.kind === "missing") {
-    const where = read.triedService === null ? read.triedPath : `${read.triedPath} or the Keychain item ${read.triedService}`;
-    fail6(`claude: logged in, but no credential to read \u2014 looked in ${where}`);
-    return null;
-  }
-  const mine = localCredential("claude");
-  if (mine !== null && sameGrant(read.secret, mine)) {
-    fail6(
-      "claude: that is the same grant this machine's Claude holds, so both sides would race on refresh \u2014 remove Mend's directory and log in again, or accept the race with --use-my-login"
-    );
-    return null;
-  }
-  const personalAfter = grantStatus(cli, personal);
-  if (personalBefore?.loggedIn === true && personalAfter?.loggedIn === false) {
-    say6(
-      `  your own Claude login was signed out by this one \u2014 this account allows one grant at a time. Run \`claude auth login\` to get it back, and connect the shared grant with --use-my-login instead.`
-    );
-  } else if (personalAfter?.loggedIn === true) {
-    say6(dim6("  your own Claude login still works \xB7 verified"));
-  }
-  say6(dim6(`  grant ${read.kind === "file" ? read.path : `keychain ${read.service}`}`));
-  return read.secret;
 };
 var connectCommand = async (config, args) => {
   const [providerArg, ...flags] = args;
@@ -9182,8 +9274,17 @@ var connectCommand = async (config, args) => {
   }
   let secret;
   if (flags.includes("--from-stdin")) {
-    secret = fs15.readFileSync(0, "utf8").trim();
+    secret = fs17.readFileSync(0, "utf8").trim();
     if (secret === "") return fail6("nothing on stdin");
+  } else if (provider === "codex" && !flags.includes("--use-my-login")) {
+    const grant = codexGrant({
+      cli: codexCli(),
+      personalAuthJson: readIfExists(path18.join(personalCodexHome(), "auth.json")),
+      say: say6,
+      parent: mendCliHome()
+    });
+    if (grant.kind === "failed") return fail6(grant.reason);
+    secret = grant.secret;
   } else if (provider === "claude" && !flags.includes("--use-my-login")) {
     secret = await claudeGrant();
     if (secret === null) return;
@@ -9193,10 +9294,10 @@ var connectCommand = async (config, args) => {
       const where = provider === "github" ? "`gh auth login` first, or pipe a token: gh auth token | mend connect github --from-stdin" : provider === "codex" ? "`codex login` first, or: mend connect codex --from-stdin < auth.json" : "`claude auth login` first, or: mend connect claude --from-stdin";
       return fail6(`${provider}: no credential on this machine \u2014 ${where}`);
     }
-    if (provider === "claude") {
+    if (provider === "claude" || provider === "codex") {
       say6(
         dim6(
-          "  --use-my-login: Mend and this machine will share one grant, and whichever refreshes second is signed out"
+          "  --use-my-login: Mend and this machine will share one login, and whichever refreshes second is signed out"
         )
       );
     }
@@ -9228,14 +9329,14 @@ var takeFlagValue4 = (args, flag) => {
   return at !== -1 && args[at + 1] !== void 0 ? String(args[at + 1]) : null;
 };
 var saveCliConfig = (next) => {
-  fs15.mkdirSync(path16.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
-  fs15.writeFileSync(
+  fs17.mkdirSync(path18.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
+  fs17.writeFileSync(
     CONFIG_PATH,
     `${JSON.stringify({ url: next.url, token: next.token, deviceId: next.deviceId }, null, 2)}
 `,
     { mode: 384 }
   );
-  fs15.chmodSync(CONFIG_PATH, 384);
+  fs17.chmodSync(CONFIG_PATH, 384);
 };
 var login = async (config, args) => {
   await loginCommand(args, {
@@ -9248,7 +9349,7 @@ var login = async (config, args) => {
   });
 };
 var logout = async (config) => {
-  if (!fs15.existsSync(CONFIG_PATH) && config.token === null) {
+  if (!fs17.existsSync(CONFIG_PATH) && config.token === null) {
     say6(dim6("nothing saved \u2014 already signed out"));
     return;
   }
@@ -9301,8 +9402,8 @@ var uninstallCommand = async (config, args) => {
   const runtime = {
     server,
     cliHome: mendCliHome(),
-    sshConfigFile: path16.join(os10.homedir(), ".ssh", "config"),
-    signedIn: config.token === null || !fs15.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
+    sshConfigFile: path18.join(os11.homedir(), ".ssh", "config"),
+    signedIn: config.token === null || !fs17.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
     revokeDevice: async () => {
       if (config.deviceId === null) return "no device id saved";
       try {
@@ -9366,7 +9467,7 @@ var keysShare = async (config) => {
     return fail6("SSH_AUTH_SOCK is not set \u2014 start (or plug in) your ssh-agent first");
   }
   await shareAgent({
-    url: () => socketUrl(config, "keys-bridge", { host: os10.hostname() }),
+    url: () => socketUrl(config, "keys-bridge", { host: os11.hostname() }),
     agentSock,
     signal: new AbortController().signal,
     onEvent: (event) => {
@@ -9496,7 +9597,7 @@ ${usageOf("dotfiles repo")}`);
 var dotfilesSync = async (config, args) => {
   const all = args.includes("--all");
   const requestedPaths = args.filter((arg) => !arg.startsWith("--"));
-  const home = os10.homedir();
+  const home = os11.homedir();
   if (!all && requestedPaths.length === 0) {
     const found = scanDotfileCandidates(home);
     if (found.length === 0) {
@@ -9523,13 +9624,13 @@ var dotfilesSync = async (config, args) => {
   if ("error" in read) return fail6(read.error);
   const result = await api(config, "POST", "/dotfiles/snapshot", {
     files: read.files,
-    source: os10.hostname(),
+    source: os11.hostname(),
     merge: false
   });
   const snapshot = result.snapshot;
   if (snapshot === null) return fail6("the server accepted the sync but reports no snapshot");
   say6(
-    `${green6("synced")} ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} from ${os10.hostname()} \xB7 ${dim6(snapshot.sha.slice(0, 7))} ${dim6("\u2014 applies from the next session launch")}`
+    `${green6("synced")} ${snapshot.files.length} file${snapshot.files.length === 1 ? "" : "s"} from ${os11.hostname()} \xB7 ${dim6(snapshot.sha.slice(0, 7))} ${dim6("\u2014 applies from the next session launch")}`
   );
 };
 var envLoad = async (config, args) => {
@@ -9543,10 +9644,10 @@ var envLoad = async (config, args) => {
   const positional = args.filter(
     (arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project" && !consumed.has(i)
   );
-  const file = path16.resolve(positional[0] ?? ".env");
+  const file = path18.resolve(positional[0] ?? ".env");
   let contents;
   try {
-    contents = fs15.readFileSync(file, "utf8");
+    contents = fs17.readFileSync(file, "utf8");
   } catch {
     return fail6(`cannot read ${file} \u2014 pass a path: mend env load path/to/.env`);
   }
@@ -9562,10 +9663,10 @@ var envLoad = async (config, args) => {
     { contents, allSecret, secretNames }
   );
   if (report.loaded.length === 0 && report.rejected.length === 0 && report.malformedLines.length === 0) {
-    say6(dim6(`${path16.basename(file)} has no variables`));
+    say6(dim6(`${path18.basename(file)} has no variables`));
     return;
   }
-  say6(`${green6("\u2713")} loaded ${path16.basename(file)} into ${project2.name}`);
+  say6(`${green6("\u2713")} loaded ${path18.basename(file)} into ${project2.name}`);
   for (const line of formatLoadReport(report, { dim: dim6, warn: amber2 })) say6(line);
   const plaintextUrls = report.loaded.filter(
     (entry) => entry.lane === "configuration" && /_(URL|URI|DSN)$/.test(entry.name)
@@ -9756,7 +9857,7 @@ var skillsList = async (config, args) => {
 };
 var skillsPush = async (config, args) => {
   const dirFlag = takeFlagValue4(args, "--dir");
-  const root = dirFlag === null ? path16.join(os10.homedir(), DEFAULT_SKILLS_DIR) : path16.resolve(dirFlag);
+  const root = dirFlag === null ? path18.join(os11.homedir(), DEFAULT_SKILLS_DIR) : path18.resolve(dirFlag);
   const scanned = scanSkillLibrary(root);
   if ("error" in scanned) return fail6(scanned.error);
   for (const note of scanned.notes) say6(dim6(`  ${note.skill}: ${note.message}`));
@@ -10431,14 +10532,14 @@ var dashboard = async (config, options = {}) => {
         `the dashboard needs Node >= 26 (node:ffi) \u2014 this is ${process.version}; every other command still works`
       );
     }
-    const rerun = spawnSync5(
+    const rerun = spawnSync6(
       process.execPath,
       ["--experimental-ffi", "--disable-warning=ExperimentalWarning", ...process.argv.slice(1)],
       { stdio: "inherit" }
     );
     process.exit(rerun.status ?? 0);
   }
-  const { runDashboard } = await import("./dashboard-KZ4XGZ6W.js");
+  const { runDashboard } = await import("./dashboard-MGR4YUFD.js");
   const agentShare = await startShareIfBridge(config);
   const tunnels = options.noTunnel === true || serverIsLocal(config) ? null : createServiceTunnels({
     listServices: () => fetchServices(config),
@@ -10472,7 +10573,7 @@ var startShareIfBridge = async (config) => {
   }
   if (access.mode !== "bridge") return null;
   return startAgentShare({
-    url: () => socketUrl(config, "keys-bridge", { host: os10.hostname() }),
+    url: () => socketUrl(config, "keys-bridge", { host: os11.hostname() }),
     agentSock
   });
 };
@@ -10512,15 +10613,16 @@ var manCommand = (words) => {
   }
   const version = cliVersion();
   const page = doc === null ? renderManIndex(version) : renderManPage(doc, version);
-  const file = path16.join(os10.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
-  fs15.writeFileSync(file, page);
-  const result = spawnSync5("man", ["-l", file], { stdio: "inherit" });
-  fs15.rmSync(file, { force: true });
+  const file = path18.join(os11.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
+  fs17.writeFileSync(file, page);
+  const result = spawnSync6("man", ["-l", file], { stdio: "inherit" });
+  fs17.rmSync(file, { force: true });
   if (result.error !== void 0 || result.status !== 0) {
     say6(doc === null ? renderIndex() : renderCommand(doc));
   }
 };
 var main = async () => {
+  useHttp1();
   const [command, ...rest] = process.argv.slice(2);
   const ownArgs = rest.slice(0, rest.indexOf("--") === -1 ? rest.length : rest.indexOf("--"));
   if (command !== void 0 && command !== "help" && ownArgs.some((a) => a === "--help" || a === "-h")) {