@sealant/mend 0.35.0 → 0.35.1

package/dist/main.js

@@ -38,11 +38,11 @@ import {
 
 // src/main.ts
 import { spawn as spawn3, spawnSync as spawnSync6 } from "node:child_process";
-import * as fs16 from "node:fs";
+import * as fs17 from "node:fs";
 import { createRequire } from "node:module";
 import * as net4 from "node:net";
 import * as os11 from "node:os";
-import * as path17 from "node:path";
+import * as path18 from "node:path";
 
 // src/agent-share.ts
 import * as net from "node:net";
@@ -223,6 +223,15 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 var claudeGrantDir = (home) => path.join(home, "claude-grant");
+var forgetGrant = (configDir, platform = process.platform) => {
+  fs.rmSync(configDir, { recursive: true, force: true });
+  if (platform !== "darwin") return;
+  spawnSync(
+    "security",
+    ["delete-generic-password", "-a", os.userInfo().username, "-s", keychainService(configDir)],
+    { stdio: "ignore", timeout: 6e4 }
+  );
+};
 var personalClaudeDir = (environment = process.env) => {
   const configured = environment["CLAUDE_CONFIG_DIR"];
   return configured === void 0 || configured === "" ? path.join(os.homedir(), ".claude") : configured;
@@ -344,16 +353,28 @@ var readClipboardImage = async (platform = process.platform, env = process.env)
 
 // src/codex-grant.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import * as fs2 from "node:fs";
+import * as fs3 from "node:fs";
 import * as os2 from "node:os";
+import * as path3 from "node:path";
+
+// src/login-dir.ts
+import * as fs2 from "node:fs";
 import * as path2 from "node:path";
+var throwawayLoginDir = (parent, prefix) => {
+  fs2.mkdirSync(parent, { recursive: true, mode: 448 });
+  const dir = fs2.mkdtempSync(path2.join(parent, prefix));
+  fs2.chmodSync(dir, 448);
+  return dir;
+};
+
+// src/codex-grant.ts
 var codexCli = (environment = process.env) => ({
   bin: environment["MEND_CODEX_BIN"] ?? "codex",
   env: environment
 });
 var personalCodexHome = (environment = process.env) => {
   const configured = environment["CODEX_HOME"];
-  return configured === void 0 || configured === "" ? path2.join(os2.homedir(), ".codex") : configured;
+  return configured === void 0 || configured === "" ? path3.join(os2.homedir(), ".codex") : configured;
 };
 var runCodexDeviceLogin = (cli, codexHome) => {
   const result = spawnSync2(cli.bin, ["login", "--device-auth"], {
@@ -379,19 +400,18 @@ var sameCodexLogin = (a, b) => {
   return first !== null && first === refreshTokenOf(b);
 };
 var codexGrant = (input) => {
-  const home = fs2.mkdtempSync(path2.join(os2.tmpdir(), "mend-codex-grant-"));
-  fs2.chmodSync(home, 448);
+  const home = throwawayLoginDir(input.parent, "codex-login-");
   try {
     input.say("  Mend needs its own Codex login; it is sent to your server and not kept here");
     input.say("  your own Codex login stays as it is");
     if (!runCodexDeviceLogin(input.cli, home)) {
       return { kind: "failed", reason: "codex: the login did not complete" };
     }
-    const file = path2.join(home, "auth.json");
-    if (!fs2.existsSync(file)) {
+    const file = path3.join(home, "auth.json");
+    if (!fs3.existsSync(file)) {
       return { kind: "failed", reason: `codex: logged in, but no auth.json appeared in ${home}` };
     }
-    const secret = fs2.readFileSync(file, "utf8").trim();
+    const secret = fs3.readFileSync(file, "utf8").trim();
     if (refreshTokenOf(secret) === null) {
       return {
         kind: "failed",
@@ -406,19 +426,19 @@ var codexGrant = (input) => {
     }
     return { kind: "grant", secret };
   } finally {
-    fs2.rmSync(home, { recursive: true, force: true });
+    fs3.rmSync(home, { recursive: true, force: true });
   }
 };
 
 // src/doctor-bundle-collectors.ts
-import * as fs4 from "node:fs";
+import * as fs5 from "node:fs";
 import * as os3 from "node:os";
-import * as path4 from "node:path";
+import * as path5 from "node:path";
 
 // src/server-runtime.ts
 import { spawn } from "node:child_process";
-import * as fs3 from "node:fs";
-import * as path3 from "node:path";
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
 var serverProcessDeadlines = {
   ordinary: 3e4,
   pull: 10 * 6e4,
@@ -464,7 +484,7 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
   return new Promise((resolve7) => {
     let fd;
     try {
-      if (options.stdoutFile !== void 0) fd = fs3.openSync(options.stdoutFile, "wx", 384);
+      if (options.stdoutFile !== void 0) fd = fs4.openSync(options.stdoutFile, "wx", 384);
       const child = spawn(command, [...args], {
         env,
         detached: process.platform !== "win32",
@@ -515,12 +535,12 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
       child.once("close", (status) => {
         globalThis.clearTimeout(timer);
         try {
-          if (fd !== void 0) fs3.fsyncSync(fd);
+          if (fd !== void 0) fs4.fsyncSync(fd);
         } catch {
           failure2 ??= "Could not durably write process output.";
         } finally {
           try {
-            if (fd !== void 0) fs3.closeSync(fd);
+            if (fd !== void 0) fs4.closeSync(fd);
           } catch {
             failure2 ??= "Could not close process output file.";
           }
@@ -534,7 +554,7 @@ var runServerProcess = (command, args, parentEnvironment, options = {}) => {
       });
     } catch (cause) {
       try {
-        if (fd !== void 0) fs3.closeSync(fd);
+        if (fd !== void 0) fs4.closeSync(fd);
       } catch {
       }
       resolve7({
@@ -555,9 +575,9 @@ var serverComposeArgs = (installation, command) => [
   "--project-directory",
   installation.directory,
   "--env-file",
-  path3.join(installation.directory, "server.env"),
+  path4.join(installation.directory, "server.env"),
   "-f",
-  path3.join(installation.directory, "compose.yaml"),
+  path4.join(installation.directory, "compose.yaml"),
   ...command
 ];
 
@@ -603,11 +623,11 @@ var mapLimit = async (items, limit, work) => {
   return results;
 };
 var pathOf = (command, env = process.env) => {
-  for (const directory of (env["PATH"] ?? "").split(path4.delimiter)) {
+  for (const directory of (env["PATH"] ?? "").split(path5.delimiter)) {
     if (directory === "") continue;
-    const candidate = path4.join(directory, command);
+    const candidate = path5.join(directory, command);
     try {
-      fs4.accessSync(candidate, fs4.constants.X_OK);
+      fs5.accessSync(candidate, fs5.constants.X_OK);
       return candidate;
     } catch {
     }
@@ -1097,8 +1117,8 @@ var bundleCollectors = (deps) => {
 };
 
 // src/doctor-bundle.ts
-import * as fs5 from "node:fs";
-import * as path5 from "node:path";
+import * as fs6 from "node:fs";
+import * as path6 from "node:path";
 import { gzipSync } from "node:zlib";
 
 // src/help.ts
@@ -1148,7 +1168,7 @@ var COMMANDS = [
     synopsis: ["<claude|codex|github> [--use-my-login] [--from-stdin] [--remove]"],
     description: [
       "Sessions run on the platform, so the platform needs your provider login. It is stored under your own user and used only for your work. Nothing is shared with other users.",
-      "Claude and Codex get a login of Mend's own. Both rotate their refresh token, so two copies of one login fight and the one that refreshes second is signed out, and Mend's server refreshes on a schedule. So this logs in through the provider's own flow and your own login stays as it is: Claude against a directory Mend keeps, Codex with a device code, sent and not kept here. Run it again whenever Mend says a login needs reconnecting. GitHub sends gh's token."
+      "Claude and Codex get a login of Mend's own. Both rotate their refresh token, so two copies of one login fight and the one that refreshes second is signed out, and Mend's server refreshes on a schedule. So this logs in through the provider's own flow and your own login stays as it is: Claude in the browser, Codex with a device code, both sent and not kept here. Run it again whenever Mend says a login needs reconnecting. GitHub sends gh's token."
     ],
     options: [
       {
@@ -2539,9 +2559,9 @@ var collectBundle = async (collectors) => {
 };
 var bundleFileName = (now) => `mend-bundle-${now.toISOString().replace(/\.\d{3}Z$/, "Z").replace(/:/g, "-")}.tgz`;
 var writeBundle = (files, outPath, now) => {
-  const directory = path5.dirname(outPath);
-  fs5.mkdirSync(directory, { recursive: true, mode: 448 });
-  const root = path5.basename(outPath).replace(/\.(?:tgz|tar\.gz)$/, "");
+  const directory = path6.dirname(outPath);
+  fs6.mkdirSync(directory, { recursive: true, mode: 448 });
+  const root = path6.basename(outPath).replace(/\.(?:tgz|tar\.gz)$/, "");
   const entries = files.map((file) => ({
     path: file.path,
     content: Buffer.from(file.content, "utf8")
@@ -2550,8 +2570,8 @@ var writeBundle = (files, outPath, now) => {
     entries.map((entry) => ({ path: `${root}/${entry.path}`, content: entry.content })),
     now
   );
-  fs5.writeFileSync(outPath, bytes, { mode: 384 });
-  fs5.chmodSync(outPath, 384);
+  fs6.writeFileSync(outPath, bytes, { mode: 384 });
+  fs6.chmodSync(outPath, 384);
   return {
     path: outPath,
     bytes: bytes.length,
@@ -2612,7 +2632,7 @@ var doctorBundleCommand = async (args, deps) => {
     return;
   }
   const now = deps.now();
-  const outPath = path5.resolve(parsed.args.out ?? path5.join(deps.defaultDir, bundleFileName(now)));
+  const outPath = path6.resolve(parsed.args.out ?? path6.join(deps.defaultDir, bundleFileName(now)));
   deps.warn("collecting \xB7 this can take a minute");
   const files = await collectBundle(deps.collectors(parsed.args.tail));
   const written = writeBundle(files, outPath, now);
@@ -2620,14 +2640,14 @@ var doctorBundleCommand = async (args, deps) => {
 };
 
 // src/doctor.ts
-import * as fs7 from "node:fs";
-import * as path7 from "node:path";
+import * as fs8 from "node:fs";
+import * as path8 from "node:path";
 
 // src/docker-shutdown.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import * as fs6 from "node:fs";
+import * as fs7 from "node:fs";
 import * as os4 from "node:os";
-import * as path6 from "node:path";
+import * as path7 from "node:path";
 var DOCKER_CAPTURE_STOP_GRACE_SECONDS = 3600;
 var DOCKERD_DEFAULT_SHUTDOWN_TIMEOUT_SECONDS = 15;
 var flagValue = (argv, name) => {
@@ -2652,12 +2672,12 @@ var daemonKindOf = (info) => {
 var defaultConfigPath = (facts, daemon) => {
   switch (daemon) {
     case "desktop":
-      return path6.join(facts.home, ".docker", "daemon.json");
+      return path7.join(facts.home, ".docker", "daemon.json");
     case "orbstack":
-      return path6.join(facts.home, ".orbstack", "config", "docker.json");
+      return path7.join(facts.home, ".orbstack", "config", "docker.json");
     case "rootless":
-      return path6.join(
-        facts.xdgConfigHome ?? path6.join(facts.home, ".config"),
+      return path7.join(
+        facts.xdgConfigHome ?? path7.join(facts.home, ".config"),
         "docker",
         "daemon.json"
       );
@@ -2786,7 +2806,7 @@ var parseDockerInfo = (stdout) => {
 };
 var readHostFile = (file) => {
   try {
-    return { kind: "read", text: fs6.readFileSync(file, "utf8") };
+    return { kind: "read", text: fs7.readFileSync(file, "utf8") };
   } catch (cause) {
     return cause instanceof Error && "code" in cause && cause.code === "ENOENT" ? { kind: "absent" } : { kind: "unreadable" };
   }
@@ -2794,21 +2814,21 @@ var readHostFile = (file) => {
 var hostProcView = {
   list: (dir) => {
     try {
-      return fs6.readdirSync(dir);
+      return fs7.readdirSync(dir);
     } catch {
       return null;
     }
   },
   read: (file) => {
     try {
-      return fs6.readFileSync(file, "utf8");
+      return fs7.readFileSync(file, "utf8");
     } catch {
       return null;
     }
   },
   link: (file) => {
     try {
-      return fs6.readlinkSync(file);
+      return fs7.readlinkSync(file);
     } catch {
       return null;
     }
@@ -2848,7 +2868,7 @@ var observeDockerd = (proc, host) => {
     const cmdline = proc.read(`/proc/${entry}/cmdline`);
     if (cmdline === null) continue;
     const argv = cmdline.split("\0").filter((arg) => arg !== "");
-    if (path6.basename(argv[0] ?? "") === "dockerd") daemons.push({ pid: entry, argv });
+    if (path7.basename(argv[0] ?? "") === "dockerd") daemons.push({ pid: entry, argv });
   }
   if (daemons.length === 0) return { kind: "none" };
   const socket = unixSocketOf(host);
@@ -3168,10 +3188,10 @@ var runChecks = async (config, probes) => {
   return checks;
 };
 var onPath = (command) => {
-  for (const directory of (process.env["PATH"] ?? "").split(path7.delimiter)) {
+  for (const directory of (process.env["PATH"] ?? "").split(path8.delimiter)) {
     if (directory === "") continue;
     try {
-      fs7.accessSync(path7.join(directory, command), fs7.constants.X_OK);
+      fs8.accessSync(path8.join(directory, command), fs8.constants.X_OK);
       return true;
     } catch {
     }
@@ -3196,8 +3216,8 @@ var doctorCommand = async (config, localCredential2, claudeGrant2) => {
 };
 
 // src/dotfiles.ts
-import * as fs8 from "node:fs";
-import * as path8 from "node:path";
+import * as fs9 from "node:fs";
+import * as path9 from "node:path";
 var DOTFILE_CANDIDATES = [
   {
     group: "shell",
@@ -3240,7 +3260,7 @@ var DOTFILE_CANDIDATES = [
 var MAX_FILE_BYTES = 1024 * 1024;
 var statFile = (home, relative4) => {
   try {
-    const stat = fs8.statSync(path8.join(home, relative4));
+    const stat = fs9.statSync(path9.join(home, relative4));
     return stat.isFile() ? stat : null;
   } catch {
     return null;
@@ -3253,9 +3273,9 @@ var scanDotfileCandidates = (home) => DOTFILE_CANDIDATES.flatMap(
   })
 );
 var homeRelativePath = (home, requested) => {
-  const relative4 = path8.relative(home, path8.resolve(home, requested));
-  const outside = relative4 === "" || relative4 === ".." || relative4.startsWith(`..${path8.sep}`) || path8.isAbsolute(relative4);
-  return outside ? null : relative4.split(path8.sep).join("/");
+  const relative4 = path9.relative(home, path9.resolve(home, requested));
+  const outside = relative4 === "" || relative4 === ".." || relative4.startsWith(`..${path9.sep}`) || path9.isAbsolute(relative4);
+  return outside ? null : relative4.split(path9.sep).join("/");
 };
 var readSyncFiles = (home, paths_) => {
   const files = [];
@@ -3275,7 +3295,7 @@ var readSyncFiles = (home, paths_) => {
     }
     files.push({
       path: relative4,
-      contentsBase64: fs8.readFileSync(path8.join(home, relative4)).toString("base64"),
+      contentsBase64: fs9.readFileSync(path9.join(home, relative4)).toString("base64"),
       // eslint-disable-next-line no-bitwise -- permission bits are the point
       mode: (stat.mode & 511).toString(8)
     });
@@ -3373,11 +3393,18 @@ var parseGitAuthorArgs = (args) => {
 };
 var gitAuthorLine = (author) => `${author.name} <${author.email}> \xB7 ${author.source === "setting" ? "your setting" : "your account's name and email"}`;
 
+// src/http-client.ts
+import { Agent, setGlobalDispatcher } from "undici";
+var cliDispatcher = (connect2) => new Agent({ allowH2: false, ...connect2 === void 0 ? {} : { connect: connect2 } });
+var useHttp1 = () => {
+  setGlobalDispatcher(cliDispatcher());
+};
+
 // src/landing.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import * as fs9 from "node:fs";
+import * as fs10 from "node:fs";
 import * as os5 from "node:os";
-import * as path9 from "node:path";
+import * as path10 from "node:path";
 var paint = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}[0m` : text;
 var dim = paint("2");
 var green = paint("32");
@@ -3615,9 +3642,9 @@ var gitRemotes = (cwd) => {
 var remoteForOrigin = (remotes, originUrl, cwd) => {
   if (originUrl === null) return null;
   const origin = normalizeRemoteUrl(originUrl);
-  const originPath = origin === null ? path9.resolve(originUrl.replace(/^file:\/\//, "")) : null;
+  const originPath = origin === null ? path10.resolve(originUrl.replace(/^file:\/\//, "")) : null;
   return remotes.find(
-    (remote) => origin === null ? path9.resolve(cwd, remote.url.replace(/^file:\/\//, "")) === originPath : normalizeRemoteUrl(remote.url) === origin
+    (remote) => origin === null ? path10.resolve(cwd, remote.url.replace(/^file:\/\//, "")) === originPath : normalizeRemoteUrl(remote.url) === origin
   ) ?? null;
 };
 var LOG_LINES = 10;
@@ -3640,10 +3667,10 @@ var fetchBundle = (cwd, bundle) => {
   const before = git(cwd, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]);
   const previous = before.status === 0 ? before.stdout.trim() : null;
   if (previous !== bundle.tip) {
-    const dir = fs9.mkdtempSync(path9.join(os5.tmpdir(), "mend-pull-"));
+    const dir = fs10.mkdtempSync(path10.join(os5.tmpdir(), "mend-pull-"));
     try {
-      const file = path9.join(dir, "change.bundle");
-      fs9.writeFileSync(file, bundle.bytes, { mode: 384 });
+      const file = path10.join(dir, "change.bundle");
+      fs10.writeFileSync(file, bundle.bytes, { mode: 384 });
       const fetched = git(cwd, [
         "fetch",
         "--no-tags",
@@ -3653,7 +3680,7 @@ var fetchBundle = (cwd, bundle) => {
       ]);
       if (fetched.status !== 0) return refusedWith(gitWords(fetched));
     } finally {
-      fs9.rmSync(dir, { recursive: true, force: true });
+      fs10.rmSync(dir, { recursive: true, force: true });
     }
   }
   const after = git(cwd, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).stdout.trim();
@@ -4087,8 +4114,8 @@ var loginCommand = async (args, deps) => {
 };
 
 // src/organization.ts
-import * as fs10 from "node:fs";
-import * as path10 from "node:path";
+import * as fs11 from "node:fs";
+import * as path11 from "node:path";
 var paint4 = (code) => (text) => process.stdout.isTTY === true ? `[${code}m${text}[0m` : text;
 var dim4 = paint4("2");
 var green4 = paint4("32");
@@ -4152,7 +4179,7 @@ var scanFolder = (dir) => {
   const files = [];
   const skipped = [];
   const walk = (relative4) => {
-    const entries = fs10.readdirSync(path10.join(dir, relative4), { withFileTypes: true }).toSorted((a, b) => a.name.localeCompare(b.name));
+    const entries = fs11.readdirSync(path11.join(dir, relative4), { withFileTypes: true }).toSorted((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       const child = relative4 === "" ? entry.name : `${relative4}/${entry.name}`;
       if (entry.isSymbolicLink()) {
@@ -4161,7 +4188,7 @@ var scanFolder = (dir) => {
         if (SKIPPED_DIRECTORIES.has(entry.name)) skipped.push({ path: child, reason: "skipped" });
         else walk(child);
       } else if (entry.isFile()) {
-        const size = fs10.statSync(path10.join(dir, child)).size;
+        const size = fs11.statSync(path11.join(dir, child)).size;
         if (size > FOLDER_FILE_BYTES) skipped.push({ path: child, reason: "over 1 MiB" });
         else files.push({ path: child, size });
       }
@@ -4214,7 +4241,7 @@ var folderCommand = async (api2, args) => {
     }
     case "push": {
       if (dir === void 0) return fail4("usage: mend folder push <name> <dir> [--replace]");
-      if (!fs10.existsSync(dir) || !fs10.statSync(dir).isDirectory()) {
+      if (!fs11.existsSync(dir) || !fs11.statSync(dir).isDirectory()) {
         return fail4(`${dir} is not a directory`);
       }
       const folder = await folderNamed(api2, name);
@@ -4229,7 +4256,7 @@ var folderCommand = async (api2, args) => {
           files: batch.map((file) => ({
             path: file.path,
             // Read one batch at a time, so a large tree never sits in memory at once.
-            contentsBase64: fs10.readFileSync(path10.join(dir, file.path)).toString("base64")
+            contentsBase64: fs11.readFileSync(path11.join(dir, file.path)).toString("base64")
           })),
           // --replace empties the folder with the first batch; the rest add to it.
           merge: !(replace && index === 0)
@@ -4414,7 +4441,7 @@ import { createHmac, randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import * as net2 from "node:net";
 import * as os8 from "node:os";
-import * as path12 from "node:path";
+import * as path13 from "node:path";
 
 // src/server-docker-volumes.ts
 import { createHash as createHash2 } from "node:crypto";
@@ -4632,9 +4659,9 @@ var verifyServerDockerVolumes = (runtime, input) => ownership(runtime, input, "v
 
 // src/server-store.ts
 import { randomUUID } from "node:crypto";
-import * as fs11 from "node:fs";
+import * as fs12 from "node:fs";
 import * as os7 from "node:os";
-import * as path11 from "node:path";
+import * as path12 from "node:path";
 var ServerStoreError = class extends Error {
   _tag = "ServerStoreError";
 };
@@ -4655,28 +4682,28 @@ var attempt = (operation) => {
 var hasCode = (cause, code) => cause instanceof Error && "code" in cause && cause.code === code;
 var readOptional = (file) => {
   try {
-    return fs11.readFileSync(file, "utf8");
+    return fs12.readFileSync(file, "utf8");
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
   }
 };
 var syncDirectory = (directory) => {
-  const fd = fs11.openSync(directory, "r");
+  const fd = fs12.openSync(directory, "r");
   try {
-    fs11.fsyncSync(fd);
+    fs12.fsyncSync(fd);
   } finally {
-    fs11.closeSync(fd);
+    fs12.closeSync(fd);
   }
 };
 var writeDurable = (file, content, mode = 384) => {
-  const fd = fs11.openSync(file, "wx", mode);
+  const fd = fs12.openSync(file, "wx", mode);
   try {
-    fs11.writeFileSync(fd, content, "utf8");
-    fs11.fchmodSync(fd, mode);
-    fs11.fsyncSync(fd);
+    fs12.writeFileSync(fd, content, "utf8");
+    fs12.fchmodSync(fd, mode);
+    fs12.fsyncSync(fd);
   } finally {
-    fs11.closeSync(fd);
+    fs12.closeSync(fd);
   }
 };
 var fileKeys = ["identity", "config", "env", "compose", "postgresInit"];
@@ -4696,7 +4723,7 @@ var parseLockOwner = (raw) => {
 };
 var describeOwner = (lockDir) => {
   try {
-    const raw = JSON.parse(fs11.readFileSync(path11.join(lockDir, "owner.json"), "utf8"));
+    const raw = JSON.parse(fs12.readFileSync(path12.join(lockDir, "owner.json"), "utf8"));
     const owner = parseLockOwner(raw);
     if (owner === null) return "owner metadata is invalid";
     const label = `PID ${owner.pid} on ${owner.hostname}`;
@@ -4716,28 +4743,28 @@ var lockGuidance = (lockDir) => new ServerStoreError(
 );
 var acquireLock = (configDir, create) => {
   if (create) {
-    fs11.mkdirSync(configDir, { recursive: true, mode: 448 });
-    fs11.chmodSync(configDir, 448);
-  } else if (!fs11.existsSync(configDir)) {
+    fs12.mkdirSync(configDir, { recursive: true, mode: 448 });
+    fs12.chmodSync(configDir, 448);
+  } else if (!fs12.existsSync(configDir)) {
     throw new ServerStoreError(
       "No Mend server is configured. Run mend server setup explicitly to install one."
     );
   }
-  const lockDir = path11.join(configDir, "server.lock");
+  const lockDir = path12.join(configDir, "server.lock");
   try {
-    fs11.mkdirSync(lockDir, { mode: 448 });
+    fs12.mkdirSync(lockDir, { mode: 448 });
   } catch (cause) {
     if (hasCode(cause, "EEXIST")) throw lockGuidance(lockDir);
     throw cause;
   }
-  const owned = fs11.statSync(lockDir);
-  const ownerFile = path11.join(lockDir, "owner.json");
+  const owned = fs12.statSync(lockDir);
+  const ownerFile = path12.join(lockDir, "owner.json");
   const owner = `${JSON.stringify({ pid: process.pid, hostname: os7.hostname(), token: randomUUID() })}
 `;
   let open = true;
   const assertOwned = () => {
-    const current = fs11.statSync(lockDir);
-    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs11.readFileSync(ownerFile, "utf8") !== owner) {
+    const current = fs12.statSync(lockDir);
+    if (!open || current.dev !== owned.dev || current.ino !== owned.ino || fs12.readFileSync(ownerFile, "utf8") !== owner) {
       throw new ServerStoreError(
         "Server lock ownership was lost. Stop and check for another server command before retrying."
       );
@@ -4753,8 +4780,8 @@ var acquireLock = (configDir, create) => {
     release: () => {
       const result = attempt(() => {
         assertOwned();
-        fs11.unlinkSync(ownerFile);
-        fs11.rmdirSync(lockDir);
+        fs12.unlinkSync(ownerFile);
+        fs12.rmdirSync(lockDir);
       });
       open = false;
       return result;
@@ -4763,7 +4790,7 @@ var acquireLock = (configDir, create) => {
 };
 var readIdentity = (paths) => {
   const identity = readOptional(paths.identity);
-  if (identity === null && (fs11.existsSync(paths.active) || fs11.existsSync(paths.generations) && fs11.readdirSync(paths.generations).length > 0)) {
+  if (identity === null && (fs12.existsSync(paths.active) || fs12.existsSync(paths.generations) && fs12.readdirSync(paths.generations).length > 0)) {
     throw new ServerStoreError(
       "Server identity.env is missing. Restore it from a retained generation or backup; refusing to generate replacement credentials."
     );
@@ -4773,7 +4800,7 @@ var readIdentity = (paths) => {
 var readActive = (paths) => {
   let target;
   try {
-    target = fs11.readlinkSync(paths.active);
+    target = fs12.readlinkSync(paths.active);
   } catch (cause) {
     if (hasCode(cause, "ENOENT")) return null;
     throw cause;
@@ -4783,13 +4810,13 @@ var readActive = (paths) => {
       "Server active pointer is invalid. Restore the symlink to a retained generation before retrying."
     );
   }
-  const directory = path11.join(paths.configDir, target);
+  const directory = path12.join(paths.configDir, target);
   const files = {
-    identity: fs11.readFileSync(path11.join(directory, fileNames.identity), "utf8"),
-    config: fs11.readFileSync(path11.join(directory, fileNames.config), "utf8"),
-    env: fs11.readFileSync(path11.join(directory, fileNames.env), "utf8"),
-    compose: fs11.readFileSync(path11.join(directory, fileNames.compose), "utf8"),
-    postgresInit: fs11.readFileSync(path11.join(directory, fileNames.postgresInit), "utf8")
+    identity: fs12.readFileSync(path12.join(directory, fileNames.identity), "utf8"),
+    config: fs12.readFileSync(path12.join(directory, fileNames.config), "utf8"),
+    env: fs12.readFileSync(path12.join(directory, fileNames.env), "utf8"),
+    compose: fs12.readFileSync(path12.join(directory, fileNames.compose), "utf8"),
+    postgresInit: fs12.readFileSync(path12.join(directory, fileNames.postgresInit), "utf8")
   };
   if (readIdentity(paths) !== files.identity) {
     throw new ServerStoreError(
@@ -4799,20 +4826,20 @@ var readActive = (paths) => {
   return { directory, files };
 };
 var publishIdentity = (paths, identity) => {
-  const temporary = path11.join(paths.configDir, `.identity-${randomUUID()}`);
+  const temporary = path12.join(paths.configDir, `.identity-${randomUUID()}`);
   writeDurable(temporary, identity);
-  fs11.linkSync(temporary, paths.identity);
+  fs12.linkSync(temporary, paths.identity);
   syncDirectory(paths.configDir);
-  fs11.unlinkSync(temporary);
+  fs12.unlinkSync(temporary);
 };
 var prepareGeneration = (paths, files) => {
-  fs11.mkdirSync(paths.generations, { recursive: true, mode: 448 });
+  fs12.mkdirSync(paths.generations, { recursive: true, mode: 448 });
   const generationName = `gen-${randomUUID()}`;
-  const directory = path11.join(paths.generations, generationName);
-  fs11.mkdirSync(directory, { mode: 448 });
+  const directory = path12.join(paths.generations, generationName);
+  fs12.mkdirSync(directory, { mode: 448 });
   for (const key of fileKeys) {
     writeDurable(
-      path11.join(directory, fileNames[key]),
+      path12.join(directory, fileNames[key]),
       files[key],
       key === "postgresInit" ? 493 : 384
     );
@@ -4823,18 +4850,18 @@ var prepareGeneration = (paths, files) => {
   return { directory, files };
 };
 var activateGeneration = (paths, generation) => {
-  const relative4 = path11.relative(paths.configDir, generation.directory);
-  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative4) || readIdentity(paths) !== fs11.readFileSync(path11.join(generation.directory, "identity.env"), "utf8")) {
+  const relative4 = path12.relative(paths.configDir, generation.directory);
+  if (!/^generations\/gen-[0-9a-f-]{36}$/.test(relative4) || readIdentity(paths) !== fs12.readFileSync(path12.join(generation.directory, "identity.env"), "utf8")) {
     throw new ServerStoreError("Cannot activate a generation outside this installation identity.");
   }
   for (const key of fileKeys) {
-    if (fs11.readFileSync(path11.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
+    if (fs12.readFileSync(path12.join(generation.directory, fileNames[key]), "utf8") !== generation.files[key]) {
       throw new ServerStoreError("Cannot activate an incomplete or changed server generation.");
     }
   }
-  const pointer = path11.join(paths.configDir, `.active-${randomUUID()}`);
-  fs11.symlinkSync(relative4, pointer);
-  fs11.renameSync(pointer, paths.active);
+  const pointer = path12.join(paths.configDir, `.active-${randomUUID()}`);
+  fs12.symlinkSync(relative4, pointer);
+  fs12.renameSync(pointer, paths.active);
   syncDirectory(paths.configDir);
 };
 var prepareFiles = (paths, files) => {
@@ -4843,7 +4870,7 @@ var prepareFiles = (paths, files) => {
     throw new ServerStoreError("Server identity already exists; refusing to replace credentials.");
   }
   const active = readActive(paths);
-  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs11.statSync(path11.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
+  if (active !== null && fileKeys.every((key) => files[key] === active.files[key]) && (fs12.statSync(path12.join(active.directory, fileNames.postgresInit)).mode & 4095) === 493)
     return active;
   if (identity === null) publishIdentity(paths, files.identity);
   return prepareGeneration(paths, files);
@@ -4856,9 +4883,9 @@ var commitGeneration = (paths, files) => {
 var createStore = (configDir, lock) => {
   const paths = {
     configDir,
-    identity: path11.join(configDir, "identity.env"),
-    generations: path11.join(configDir, "generations"),
-    active: path11.join(configDir, "active")
+    identity: path12.join(configDir, "identity.env"),
+    generations: path12.join(configDir, "generations"),
+    active: path12.join(configDir, "active")
   };
   const whileOwned = (operation) => attempt(() => {
     lock.assertOwned();
@@ -4871,13 +4898,13 @@ var createStore = (configDir, lock) => {
     prepare: (files) => whileOwned(() => prepareFiles(paths, files)),
     activate: (generation) => whileOwned(() => activateGeneration(paths, generation)),
     createBackup: (previous, target) => whileOwned(() => {
-      const backups = path11.join(configDir, "backups");
-      fs11.mkdirSync(backups, { recursive: true, mode: 448 });
-      fs11.chmodSync(backups, 448);
-      const directory = path11.join(backups, `upgrade-${randomUUID()}`);
-      fs11.mkdirSync(directory, { mode: 448 });
+      const backups = path12.join(configDir, "backups");
+      fs12.mkdirSync(backups, { recursive: true, mode: 448 });
+      fs12.chmodSync(backups, 448);
+      const directory = path12.join(backups, `upgrade-${randomUUID()}`);
+      fs12.mkdirSync(directory, { mode: 448 });
       writeDurable(
-        path11.join(directory, "recovery.json"),
+        path12.join(directory, "recovery.json"),
         `${JSON.stringify(
           {
             previousGeneration: previous.directory,
@@ -4893,21 +4920,21 @@ var createStore = (configDir, lock) => {
       syncDirectory(directory);
       syncDirectory(backups);
       syncDirectory(configDir);
-      const partialFile = path11.join(directory, "database.sql.partial");
+      const partialFile = path12.join(directory, "database.sql.partial");
       return {
         directory,
         partialFile,
         complete: () => whileOwned(() => {
-          if (fs11.statSync(partialFile).size === 0)
+          if (fs12.statSync(partialFile).size === 0)
             throw new ServerStoreError("Database backup is empty; refusing target startup.");
-          const fd = fs11.openSync(partialFile, "r");
+          const fd = fs12.openSync(partialFile, "r");
           try {
-            fs11.fchmodSync(fd, 384);
-            fs11.fsyncSync(fd);
+            fs12.fchmodSync(fd, 384);
+            fs12.fsyncSync(fd);
           } finally {
-            fs11.closeSync(fd);
+            fs12.closeSync(fd);
           }
-          fs11.renameSync(partialFile, path11.join(directory, "database.sql"));
+          fs12.renameSync(partialFile, path12.join(directory, "database.sql"));
           syncDirectory(directory);
         })
       };
@@ -4916,7 +4943,7 @@ var createStore = (configDir, lock) => {
 };
 var refuseFlatLayout = (configDir) => {
   if (["server.json", "server.env", "compose.yaml", "postgres-init.sh"].some(
-    (name) => fs11.existsSync(path11.join(configDir, name))
+    (name) => fs12.existsSync(path12.join(configDir, name))
   )) {
     throw new ServerStoreError(
       "Unreleased flat server configuration found. Preserve its credentials and volumes; migrate it to the generation layout before retrying. Setup will not replace this identity."
@@ -4924,7 +4951,7 @@ var refuseFlatLayout = (configDir) => {
   }
 };
 var withServerStore = async (directory, operation, options = {}) => {
-  const configDir = path11.resolve(directory);
+  const configDir = path12.resolve(directory);
   let lock;
   let result;
   try {
@@ -4941,9 +4968,9 @@ var withServerStore = async (directory, operation, options = {}) => {
 };
 
 // src/version.ts
-import * as fs12 from "node:fs";
+import * as fs13 from "node:fs";
 var cliVersion = () => {
-  const raw = fs12.readFileSync(new URL("../package.json", import.meta.url), "utf8");
+  const raw = fs13.readFileSync(new URL("../package.json", import.meta.url), "utf8");
   const parsed = JSON.parse(raw);
   if (typeof parsed === "object" && parsed !== null && "version" in parsed) {
     const version = parsed.version;
@@ -5646,7 +5673,7 @@ var resolveServerVersion = async (runtime, options, existing) => {
   return version;
 };
 var parseDockerSocketPath = (socket) => {
-  if (!path12.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
+  if (!path13.isAbsolute(socket) || /[\r\n$'"#:\\]/.test(socket)) {
     throw setupError(
       "--docker-socket must be an absolute path without line breaks or Compose interpolation characters."
     );
@@ -5672,8 +5699,8 @@ var resolveAssets = async (runtime, serverVersion, existing, store, options) =>
   if (options.assetsDir !== void 0) {
     try {
       const [compose2, postgresInit2] = await Promise.all([
-        readFile(path12.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
-        readFile(path12.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
+        readFile(path13.join(options.assetsDir, COMPOSE_ASSET), "utf8"),
+        readFile(path13.join(options.assetsDir, POSTGRES_INIT_ASSET), "utf8")
       ]);
       validateComposeAsset(compose2);
       validatePostgresAsset(postgresInit2);
@@ -6200,9 +6227,9 @@ var manageServer = async (command, args, runtime, store) => {
 var nodeServerRuntime = () => {
   const environment = { ...process.env };
   const home = os8.homedir();
-  const configHome = environment["XDG_CONFIG_HOME"] ?? path12.join(home, ".config");
+  const configHome = environment["XDG_CONFIG_HOME"] ?? path13.join(home, ".config");
   return {
-    configDir: path12.join(configHome, "mend"),
+    configDir: path13.join(configHome, "mend"),
     platform: process.platform,
     cliVersion: cliVersion(),
     run: (command, args, options) => runServerProcess(command, args, environment, options),
@@ -6655,8 +6682,8 @@ var createServiceTunnels = (options) => {
 };
 
 // src/skills.ts
-import * as fs13 from "node:fs";
-import * as path13 from "node:path";
+import * as fs14 from "node:fs";
+import * as path14 from "node:path";
 var DEFAULT_SKILLS_DIR = ".agents/skills";
 var MAX_SKILL_FILES = 64;
 var MAX_SKILL_FILE_BYTES = 512 * 1024;
@@ -6679,12 +6706,12 @@ var readFrontmatterDescription = (contents) => {
 var walkFiles = (root) => {
   const found = [];
   const visit = (dir) => {
-    for (const entry of fs13.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs14.readdirSync(dir, { withFileTypes: true })) {
       if (IGNORED_DIRS.has(entry.name)) continue;
-      const absolute = path13.join(dir, entry.name);
+      const absolute = path14.join(dir, entry.name);
       let stat;
       try {
-        stat = fs13.statSync(absolute);
+        stat = fs14.statSync(absolute);
       } catch {
         continue;
       }
@@ -6698,7 +6725,7 @@ var walkFiles = (root) => {
 var scanSkillLibrary = (root) => {
   let entries;
   try {
-    entries = fs13.readdirSync(root, { withFileTypes: true });
+    entries = fs14.readdirSync(root, { withFileTypes: true });
   } catch {
     return { error: `${root} is not a readable directory` };
   }
@@ -6706,23 +6733,23 @@ var scanSkillLibrary = (root) => {
   const notes = [];
   for (const entry of entries.toSorted((a, b) => a.name.localeCompare(b.name))) {
     if (entry.name.startsWith(".")) continue;
-    const skillDir = path13.join(root, entry.name);
+    const skillDir = path14.join(root, entry.name);
     let stat;
     try {
-      stat = fs13.statSync(skillDir);
+      stat = fs14.statSync(skillDir);
     } catch {
       continue;
     }
     if (!stat.isDirectory()) continue;
-    if (!fs13.existsSync(path13.join(skillDir, "SKILL.md"))) {
+    if (!fs14.existsSync(path14.join(skillDir, "SKILL.md"))) {
       notes.push({ skill: entry.name, message: "no SKILL.md \u2014 skipped" });
       continue;
     }
     const files = [];
     let bytes = 0;
     for (const absolute of walkFiles(skillDir)) {
-      const relative4 = path13.relative(skillDir, absolute).split(path13.sep).join("/");
-      const buffer = fs13.readFileSync(absolute);
+      const relative4 = path14.relative(skillDir, absolute).split(path14.sep).join("/");
+      const buffer = fs14.readFileSync(absolute);
       if (buffer.byteLength > MAX_SKILL_FILE_BYTES) {
         notes.push({ skill: entry.name, message: `${relative4} is over 512KB \u2014 skipped` });
         continue;
@@ -6758,15 +6785,15 @@ var scanSkillLibrary = (root) => {
 
 // src/ssh-setup.ts
 import * as os10 from "node:os";
-import * as path15 from "node:path";
+import * as path16 from "node:path";
 
 // ../../packages/workspace-ssh/src/index.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { createHash as createHash3 } from "node:crypto";
-import * as fs14 from "node:fs";
+import * as fs15 from "node:fs";
 import { isIP as isIP2 } from "node:net";
 import * as os9 from "node:os";
-import * as path14 from "node:path";
+import * as path15 from "node:path";
 var LEGACY_BLOCK_BEGIN = "# >>> mend workspace ssh (managed by `mend ssh setup`) >>>";
 var LEGACY_BLOCK_END = "# <<< mend workspace ssh <<<";
 var WorkspaceSshError = class extends Error {
@@ -6853,8 +6880,8 @@ var blockBegin = (alias) => `# >>> mend workspace ssh ${alias} (managed) >>>`;
 var blockEnd = (alias) => `# <<< mend workspace ssh ${alias} <<<`;
 var hasControls = (value) => /[\p{Cc}\p{Zl}\p{Zp}]/u.test(value);
 var parseIdentityPath = (value) => {
-  const resolved = path14.resolve(
-    value.startsWith("~/") ? path14.join(os9.homedir(), value.slice(2)) : value
+  const resolved = path15.resolve(
+    value.startsWith("~/") ? path15.join(os9.homedir(), value.slice(2)) : value
   );
   if (value === "" || hasControls(value) || hasControls(resolved) || value.includes("${") || resolved.includes("${")) {
     return failure(
@@ -7010,7 +7037,7 @@ var agentKeys = () => {
 };
 var readText = (file) => {
   try {
-    return success(fs14.readFileSync(file, "utf8"));
+    return success(fs15.readFileSync(file, "utf8"));
   } catch (cause) {
     const error = cause instanceof Error && "code" in cause ? cause.code : void 0;
     return error === "ENOENT" ? success("") : failure(new WorkspaceSshError("key", `Could not read ${file}.`, cause));
@@ -7068,19 +7095,19 @@ var readRequiredKey = (keyPath, source) => {
 var readOptionalKey = (keyPath) => {
   const parsed = parseIdentityPath(keyPath);
   if (!parsed.ok) return parsed;
-  if (!fs14.existsSync(parsed.value) && !fs14.existsSync(publicKeyPath(parsed.value)))
+  if (!fs15.existsSync(parsed.value) && !fs15.existsSync(publicKeyPath(parsed.value)))
     return success(null);
   return readRequiredKey(parsed.value, "existing");
 };
 var pinAgentKey = (configHome, publicKey) => {
-  const identityFile = path14.resolve(
+  const identityFile = path15.resolve(
     configHome,
     "ssh",
     `agent-${hashIdentity(publicKeyIdentity(publicKey))}.pub`
   );
   try {
-    fs14.mkdirSync(path14.dirname(identityFile), { recursive: true, mode: 448 });
-    fs14.writeFileSync(identityFile, `${publicKey}
+    fs15.mkdirSync(path15.dirname(identityFile), { recursive: true, mode: 448 });
+    fs15.writeFileSync(identityFile, `${publicKey}
 `, { mode: 384 });
     return success({ publicKey, identityFile, source: "agent" });
   } catch (cause) {
@@ -7091,10 +7118,10 @@ var pinAgentKey = (configHome, publicKey) => {
 };
 var generateDedicatedKey = (privatePath) => {
   try {
-    fs14.mkdirSync(path14.dirname(privatePath), { recursive: true, mode: 448 });
+    fs15.mkdirSync(path15.dirname(privatePath), { recursive: true, mode: 448 });
   } catch (cause) {
     return failure(
-      new WorkspaceSshError("key", `Could not create ${path14.dirname(privatePath)}.`, cause)
+      new WorkspaceSshError("key", `Could not create ${path15.dirname(privatePath)}.`, cause)
     );
   }
   const generated = spawnSync5(
@@ -7123,7 +7150,7 @@ var generateDedicatedKey = (privatePath) => {
   return fresh;
 };
 var dedicatedKey = (configHome, create) => {
-  const privatePath = path14.join(configHome, "ssh", "id_ed25519");
+  const privatePath = path15.join(configHome, "ssh", "id_ed25519");
   const existing = readOptionalKey(privatePath);
   if (existing.ok === false) return failure(existing.error);
   if (existing.value !== null || !create) return existing;
@@ -7171,10 +7198,10 @@ var writeWorkspaceSshConfig = (configFile, target, identityFile) => {
   const reconciled = reconcileWorkspaceSshConfig(before.value, target, identityFile);
   if (reconciled.ok === false) return failure(reconciled.error);
   try {
-    fs14.mkdirSync(path14.dirname(configFile), { recursive: true, mode: 448 });
-    fs14.chmodSync(path14.dirname(configFile), 448);
-    fs14.writeFileSync(configFile, reconciled.value, { mode: 384 });
-    fs14.chmodSync(configFile, 384);
+    fs15.mkdirSync(path15.dirname(configFile), { recursive: true, mode: 448 });
+    fs15.chmodSync(path15.dirname(configFile), 448);
+    fs15.writeFileSync(configFile, reconciled.value, { mode: 384 });
+    fs15.chmodSync(configFile, 384);
     return success(void 0);
   } catch (cause) {
     return failure(new WorkspaceSshError("config", `Could not write ${configFile}.`, cause));
@@ -7187,7 +7214,7 @@ var dim5 = ansi("2");
 var green5 = ansi("32");
 var warn = ansi("33");
 var say5 = (line) => console.log(line);
-var sshConfigPath = () => path15.join(os10.homedir(), ".ssh", "config");
+var sshConfigPath = () => path16.join(os10.homedir(), ".ssh", "config");
 var flagValue2 = (args, flag) => {
   const index = args.indexOf(flag);
   return index === -1 || args[index + 1] === void 0 ? null : String(args[index + 1]);
@@ -7299,8 +7326,8 @@ var sshCommand = async (args, api2, cliHome, serverUrl) => {
 };
 
 // src/uninstall.ts
-import * as fs15 from "node:fs";
-import * as path16 from "node:path";
+import * as fs16 from "node:fs";
+import * as path17 from "node:path";
 var UNINSTALL_USAGE = "usage: mend uninstall [--all | --server | --home] [--yes]";
 var parseUninstallArgs = (args) => {
   let scope = null;
@@ -7322,14 +7349,14 @@ var parseUninstallArgs = (args) => {
 var SERVER_FILES = ["identity.env", "active", "generations", "backups"];
 var countEntries = (directory) => {
   try {
-    return fs15.readdirSync(directory).length;
+    return fs16.readdirSync(directory).length;
   } catch {
     return 0;
   }
 };
 var exists = (file) => {
   try {
-    fs15.lstatSync(file);
+    fs16.lstatSync(file);
     return true;
   } catch {
     return false;
@@ -7338,7 +7365,7 @@ var exists = (file) => {
 var managedBlockCount = (sshConfigFile) => {
   let config;
   try {
-    config = fs15.readFileSync(sshConfigFile, "utf8");
+    config = fs16.readFileSync(sshConfigFile, "utf8");
   } catch {
     return 0;
   }
@@ -7362,27 +7389,27 @@ var describeUninstall = async (runtime, scope) => {
       if (!read.error.message.startsWith("No Mend server is configured")) throw read.error;
       server = "none";
     } else if (read.value === null) {
-      server = exists(path16.join(configDir, "identity.env")) ? {
+      server = exists(path17.join(configDir, "identity.env")) ? {
         version: "(no active generation)",
         appUrl: "",
         dockerContext: "",
-        generations: countEntries(path16.join(configDir, "generations")),
-        backups: countEntries(path16.join(configDir, "backups"))
+        generations: countEntries(path17.join(configDir, "generations")),
+        backups: countEntries(path17.join(configDir, "backups"))
       } : "none";
     } else {
       server = {
         version: read.value.config.serverVersion,
         appUrl: read.value.config.appUrl,
         dockerContext: read.value.config.dockerContext,
-        generations: countEntries(path16.join(configDir, "generations")),
-        backups: countEntries(path16.join(configDir, "backups"))
+        generations: countEntries(path17.join(configDir, "generations")),
+        backups: countEntries(path17.join(configDir, "backups"))
       };
     }
   }
   let home = null;
   if (scope !== "server") {
-    const cliConfig = path16.join(runtime.cliHome, "cli.json");
-    const sshDirectory = path16.join(runtime.cliHome, "ssh");
+    const cliConfig = path17.join(runtime.cliHome, "cli.json");
+    const sshDirectory = path17.join(runtime.cliHome, "ssh");
     home = {
       cliConfig: exists(cliConfig) ? cliConfig : null,
       sshDirectory: exists(sshDirectory) ? sshDirectory : null,
@@ -7514,7 +7541,7 @@ var removeServer = async (runtime, failures, leftovers) => {
         }
       }
       for (const name of SERVER_FILES) {
-        fs15.rmSync(path16.join(configDir, name), { recursive: true, force: true });
+        fs16.rmSync(path17.join(configDir, name), { recursive: true, force: true });
       }
       server.writeLine(`removed ${configDir}/{identity.env, active, generations, backups}`);
     },
@@ -7525,20 +7552,20 @@ var removeServer = async (runtime, failures, leftovers) => {
 var removeHome = async (runtime, plan, failures, leftovers) => {
   const { server } = runtime;
   if (plan.cliConfig !== null) {
-    fs15.rmSync(plan.cliConfig, { force: true });
+    fs16.rmSync(plan.cliConfig, { force: true });
     server.writeLine(`removed ${plan.cliConfig}`);
   }
   if (plan.sshDirectory !== null) {
-    fs15.rmSync(plan.sshDirectory, { recursive: true, force: true });
+    fs16.rmSync(plan.sshDirectory, { recursive: true, force: true });
     server.writeLine(`removed ${plan.sshDirectory}`);
   }
   if (plan.managedSshBlocks > 0) {
     try {
-      const before = fs15.readFileSync(runtime.sshConfigFile, "utf8");
+      const before = fs16.readFileSync(runtime.sshConfigFile, "utf8");
       const stripped = stripManagedWorkspaceSshBlocks(before);
       if (!stripped.ok) throw stripped.error;
       if (stripped.value.removed > 0) {
-        fs15.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
+        fs16.writeFileSync(runtime.sshConfigFile, stripped.value.config, { mode: 384 });
         server.writeLine(
           `removed ${plural(stripped.value.removed, "managed block")} from ${runtime.sshConfigFile}`
         );
@@ -7551,12 +7578,12 @@ var removeHome = async (runtime, plan, failures, leftovers) => {
   }
   let remaining = [];
   try {
-    remaining = fs15.readdirSync(runtime.cliHome);
+    remaining = fs16.readdirSync(runtime.cliHome);
   } catch {
     return;
   }
   if (remaining.length === 0) {
-    fs15.rmdirSync(runtime.cliHome);
+    fs16.rmdirSync(runtime.cliHome);
     server.writeLine(`removed ${runtime.cliHome}`);
   } else {
     leftovers.push(
@@ -7620,19 +7647,19 @@ var upgradeUrl = async (input) => {
 // src/main.ts
 var mendCliHome = () => {
   const xdg = process.env["XDG_CONFIG_HOME"];
-  const preferred = path17.join(
-    xdg === void 0 || xdg === "" ? path17.join(os11.homedir(), ".config") : xdg,
+  const preferred = path18.join(
+    xdg === void 0 || xdg === "" ? path18.join(os11.homedir(), ".config") : xdg,
     "mend"
   );
-  const legacy = path17.join(os11.homedir(), ".mend");
-  return !fs16.existsSync(preferred) && fs16.existsSync(legacy) ? legacy : preferred;
+  const legacy = path18.join(os11.homedir(), ".mend");
+  return !fs17.existsSync(preferred) && fs17.existsSync(legacy) ? legacy : preferred;
 };
-var CONFIG_PATH = path17.join(mendCliHome(), "cli.json");
+var CONFIG_PATH = path18.join(mendCliHome(), "cli.json");
 var loadConfig = () => {
   let fileConfig = {};
-  if (fs16.existsSync(CONFIG_PATH)) {
+  if (fs17.existsSync(CONFIG_PATH)) {
     try {
-      fileConfig = JSON.parse(fs16.readFileSync(CONFIG_PATH, "utf8"));
+      fileConfig = JSON.parse(fs17.readFileSync(CONFIG_PATH, "utf8"));
     } catch {
       fail6(`could not parse ${CONFIG_PATH}`);
     }
@@ -7884,7 +7911,7 @@ var adopt = async (config, args) => {
   }
   const sourceIssue = repositoryCloneUrlIssue(source);
   if (sourceIssue !== null) return fail6(sourceIssue);
-  const projectName = name ?? normalizeProjectName(path17.basename(source, ".git"));
+  const projectName = name ?? normalizeProjectName(path18.basename(source, ".git"));
   const auth = authFlagIndex !== -1 && args[authFlagIndex + 1] !== void 0 ? String(args[authFlagIndex + 1]) : null;
   if (auth !== null && auth !== "ambient" && auth !== "mend-key" && auth !== "bridge") {
     return fail6(`--auth takes "ambient", "mend-key", or "bridge", not "${auth}"`);
@@ -7933,7 +7960,7 @@ var findProject = async (config, explicit, adoptCwd = false) => {
   const sourceIssue = repositoryCloneUrlIssue(facts.originUrl);
   if (sourceIssue !== null) return fail6(sourceIssue);
   const adopted = await api(config, "POST", "/projects", {
-    name: normalizeProjectName(path17.basename(facts.repoRoot)),
+    name: normalizeProjectName(path18.basename(facts.repoRoot)),
     source: facts.originUrl
   });
   say6(`${green6("\u2713")} adopted \xB7 ${adopted.name} \xB7 ${dim6(adopted.storePath)}`);
@@ -8894,13 +8921,13 @@ var serviceRestart = async (config, args) => {
 };
 var serviceInit = async (args) => {
   const root = gitTopLevel(process.cwd()) ?? process.cwd();
-  const target = path17.join(root, "mend.toml");
-  if (fs16.existsSync(target)) {
+  const target = path18.join(root, "mend.toml");
+  if (fs17.existsSync(target)) {
     return fail6(`${target} already exists \u2014 edit it directly (init never merges)`);
   }
-  const rootFiles = fs16.readdirSync(root);
+  const rootFiles = fs17.readdirSync(root);
   const proposals = [];
-  const readRoot = (name) => fs16.readFileSync(path17.join(root, name), "utf8");
+  const readRoot = (name) => fs17.readFileSync(path18.join(root, name), "utf8");
   if (rootFiles.includes("package.json")) {
     proposals.push(...proposeFromPackageJson(readRoot("package.json"), rootFiles));
   }
@@ -8910,13 +8937,13 @@ var serviceInit = async (args) => {
   );
   for (const glob of globs) {
     const parent = glob.replace(/\/?\*+$/, "");
-    const dirs = glob.endsWith("*") ? fs16.existsSync(path17.join(root, parent)) ? fs16.readdirSync(path17.join(root, parent)).map((dir) => path17.join(parent, dir)) : [] : [glob];
+    const dirs = glob.endsWith("*") ? fs17.existsSync(path18.join(root, parent)) ? fs17.readdirSync(path18.join(root, parent)).map((dir) => path18.join(parent, dir)) : [] : [glob];
     for (const dir of dirs) {
-      const manifest = path17.join(root, dir, "package.json");
-      if (!fs16.existsSync(manifest)) continue;
+      const manifest = path18.join(root, dir, "package.json");
+      if (!fs17.existsSync(manifest)) continue;
       for (const proposal of proposeFromWorkspacePackage(
-        path17.basename(dir),
-        fs16.readFileSync(manifest, "utf8"),
+        path18.basename(dir),
+        fs17.readFileSync(manifest, "utf8"),
         rootFiles
       )) {
         if (!proposals.some((existing) => existing.name === proposal.name)) {
@@ -8960,7 +8987,7 @@ var serviceInit = async (args) => {
       return;
     }
   }
-  fs16.writeFileSync(target, toml);
+  fs17.writeFileSync(target, toml);
   say6(`${green6("\u2713")} wrote ${target} \u2014 commit it, then: mend service run ${proposals[0]?.name}`);
 };
 var tunnelServices = async (config, services, portOverride) => {
@@ -9064,18 +9091,18 @@ var serviceCommand = async (config, args) => {
   }
 };
 var isProvider = (value) => value === "claude" || value === "codex" || value === "github";
-var readIfExists = (file) => fs16.existsSync(file) ? fs16.readFileSync(file, "utf8") : null;
+var readIfExists = (file) => fs17.existsSync(file) ? fs17.readFileSync(file, "utf8") : null;
 var localCredential = (provider) => {
   const home = os11.homedir();
   switch (provider) {
     case "codex":
       return readIfExists(
-        path17.join(process.env["CODEX_HOME"] ?? path17.join(home, ".codex"), "auth.json")
+        path18.join(process.env["CODEX_HOME"] ?? path18.join(home, ".codex"), "auth.json")
       );
     case "claude":
       return readIfExists(
-        path17.join(
-          process.env["CLAUDE_CONFIG_DIR"] ?? path17.join(home, ".claude"),
+        path18.join(
+          process.env["CLAUDE_CONFIG_DIR"] ?? path18.join(home, ".claude"),
           ".credentials.json"
         )
       );
@@ -9125,7 +9152,7 @@ var claudeGrantSecret = () => {
   return read.kind === "missing" ? null : read.secret;
 };
 var doctorBundle = (config, args) => doctorBundleCommand(args, {
-  defaultDir: path17.join(mendCliHome(), "bundles"),
+  defaultDir: path18.join(mendCliHome(), "bundles"),
   now: () => /* @__PURE__ */ new Date(),
   say: say6,
   warn: (line) => process.stderr.write(`${line}
@@ -9166,74 +9193,69 @@ var staleGrantReason = (secret) => {
 };
 var claudeGrant = async () => {
   const cli = claudeCli();
-  const dir = claudeGrantDir(mendCliHome());
+  const home = mendCliHome();
   const personal = personalClaudeDir();
   const personalBefore = grantStatus(cli, personal);
-  let status = grantStatus(cli, dir);
-  if (status === null) {
-    fail6(
-      "claude: could not run `claude auth status` \u2014 install Claude Code, set MEND_CLAUDE_BIN, or paste a credential: mend connect claude --from-stdin"
-    );
-    return null;
-  }
-  if (!status.loggedIn) {
-    say6(`  Mend needs its own Claude login, kept in ${dir}`);
+  const dir = throwawayLoginDir(home, "claude-login-");
+  try {
+    if (grantStatus(cli, dir) === null) {
+      fail6(
+        "claude: could not run `claude auth status` \u2014 install Claude Code, set MEND_CLAUDE_BIN, or paste a credential: mend connect claude --from-stdin"
+      );
+      return null;
+    }
+    say6("  Mend needs its own Claude login; it is sent to your server and not kept here");
     say6(dim6("  your own Claude login stays as it is"));
     if (!runClaudeLogin(cli, dir)) {
       fail6("claude: the login did not complete");
       return null;
     }
-    status = grantStatus(cli, dir) ?? status;
-    if (!status.loggedIn) {
+    const status = grantStatus(cli, dir);
+    if (status === null || !status.loggedIn) {
       fail6("claude: the login completed but Claude still reports no grant in Mend's directory");
       return null;
     }
-  }
-  if (status.configDirectory !== null && path17.resolve(status.configDirectory) !== path17.resolve(dir)) {
-    fail6(
-      `claude: this Claude read ${status.configDirectory} instead of ${dir}, so a separate grant is not possible \u2014 connect the shared one deliberately with --use-my-login`
-    );
-    return null;
-  }
-  let read = readGrant(dir);
-  if (read.kind !== "missing") {
+    if (status.configDirectory !== null && path18.resolve(status.configDirectory) !== path18.resolve(dir)) {
+      fail6(
+        `claude: this Claude read ${status.configDirectory} instead of ${dir}, so a separate grant is not possible \u2014 connect the shared one deliberately with --use-my-login`
+      );
+      return null;
+    }
+    const read = readGrant(dir);
+    if (read.kind === "missing") {
+      const where = read.triedService === null ? read.triedPath : `${read.triedPath} or the Keychain item ${read.triedService}`;
+      fail6(`claude: logged in, but no credential to read \u2014 looked in ${where}`);
+      return null;
+    }
     const why = staleGrantReason(read.secret);
     if (why !== null) {
-      say6(`  Mend's Claude grant is ${why}; logging in again`);
-      if (!runClaudeLogin(cli, dir)) {
-        fail6("claude: the login did not complete");
-        return null;
-      }
-      read = readGrant(dir);
-      const still = read.kind === "missing" ? "missing" : staleGrantReason(read.secret);
-      if (still !== null) {
-        fail6(`claude: the grant is still ${still} after logging in`);
-        return null;
-      }
+      fail6(`claude: the new login is already ${why}`);
+      return null;
     }
+    const mine = localCredential("claude");
+    if (mine !== null && sameGrant(read.secret, mine)) {
+      fail6(
+        "claude: that is the same grant this machine's Claude holds, so both sides would race on refresh \u2014 connect it deliberately with --use-my-login"
+      );
+      return null;
+    }
+    const personalAfter = grantStatus(cli, personal);
+    if (personalBefore?.loggedIn === true && personalAfter?.loggedIn === false) {
+      say6(
+        `  your own Claude login was signed out by this one \u2014 this account allows one grant at a time. Run \`claude auth login\` to get it back, and connect the shared grant with --use-my-login instead.`
+      );
+    } else if (personalAfter?.loggedIn === true) {
+      say6(dim6("  your own Claude login still works \xB7 verified"));
+    }
+    const kept = claudeGrantDir(home);
+    if (fs17.existsSync(kept)) {
+      forgetGrant(kept);
+      say6(dim6(`  removed the copy an older mend kept in ${kept} \xB7 the server refreshes the login`));
+    }
+    return read.secret;
+  } finally {
+    forgetGrant(dir);
   }
-  if (read.kind === "missing") {
-    const where = read.triedService === null ? read.triedPath : `${read.triedPath} or the Keychain item ${read.triedService}`;
-    fail6(`claude: logged in, but no credential to read \u2014 looked in ${where}`);
-    return null;
-  }
-  const mine = localCredential("claude");
-  if (mine !== null && sameGrant(read.secret, mine)) {
-    fail6(
-      "claude: that is the same grant this machine's Claude holds, so both sides would race on refresh \u2014 remove Mend's directory and log in again, or accept the race with --use-my-login"
-    );
-    return null;
-  }
-  const personalAfter = grantStatus(cli, personal);
-  if (personalBefore?.loggedIn === true && personalAfter?.loggedIn === false) {
-    say6(
-      `  your own Claude login was signed out by this one \u2014 this account allows one grant at a time. Run \`claude auth login\` to get it back, and connect the shared grant with --use-my-login instead.`
-    );
-  } else if (personalAfter?.loggedIn === true) {
-    say6(dim6("  your own Claude login still works \xB7 verified"));
-  }
-  say6(dim6(`  grant ${read.kind === "file" ? read.path : `keychain ${read.service}`}`));
-  return read.secret;
 };
 var connectCommand = async (config, args) => {
   const [providerArg, ...flags] = args;
@@ -9252,13 +9274,14 @@ var connectCommand = async (config, args) => {
   }
   let secret;
   if (flags.includes("--from-stdin")) {
-    secret = fs16.readFileSync(0, "utf8").trim();
+    secret = fs17.readFileSync(0, "utf8").trim();
     if (secret === "") return fail6("nothing on stdin");
   } else if (provider === "codex" && !flags.includes("--use-my-login")) {
     const grant = codexGrant({
       cli: codexCli(),
-      personalAuthJson: readIfExists(path17.join(personalCodexHome(), "auth.json")),
-      say: say6
+      personalAuthJson: readIfExists(path18.join(personalCodexHome(), "auth.json")),
+      say: say6,
+      parent: mendCliHome()
     });
     if (grant.kind === "failed") return fail6(grant.reason);
     secret = grant.secret;
@@ -9306,14 +9329,14 @@ var takeFlagValue4 = (args, flag) => {
   return at !== -1 && args[at + 1] !== void 0 ? String(args[at + 1]) : null;
 };
 var saveCliConfig = (next) => {
-  fs16.mkdirSync(path17.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
-  fs16.writeFileSync(
+  fs17.mkdirSync(path18.dirname(CONFIG_PATH), { recursive: true, mode: 448 });
+  fs17.writeFileSync(
     CONFIG_PATH,
     `${JSON.stringify({ url: next.url, token: next.token, deviceId: next.deviceId }, null, 2)}
 `,
     { mode: 384 }
   );
-  fs16.chmodSync(CONFIG_PATH, 384);
+  fs17.chmodSync(CONFIG_PATH, 384);
 };
 var login = async (config, args) => {
   await loginCommand(args, {
@@ -9326,7 +9349,7 @@ var login = async (config, args) => {
   });
 };
 var logout = async (config) => {
-  if (!fs16.existsSync(CONFIG_PATH) && config.token === null) {
+  if (!fs17.existsSync(CONFIG_PATH) && config.token === null) {
     say6(dim6("nothing saved \u2014 already signed out"));
     return;
   }
@@ -9379,8 +9402,8 @@ var uninstallCommand = async (config, args) => {
   const runtime = {
     server,
     cliHome: mendCliHome(),
-    sshConfigFile: path17.join(os11.homedir(), ".ssh", "config"),
-    signedIn: config.token === null || !fs16.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
+    sshConfigFile: path18.join(os11.homedir(), ".ssh", "config"),
+    signedIn: config.token === null || !fs17.existsSync(CONFIG_PATH) ? null : { url: config.url, deviceId: config.deviceId },
     revokeDevice: async () => {
       if (config.deviceId === null) return "no device id saved";
       try {
@@ -9621,10 +9644,10 @@ var envLoad = async (config, args) => {
   const positional = args.filter(
     (arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project" && !consumed.has(i)
   );
-  const file = path17.resolve(positional[0] ?? ".env");
+  const file = path18.resolve(positional[0] ?? ".env");
   let contents;
   try {
-    contents = fs16.readFileSync(file, "utf8");
+    contents = fs17.readFileSync(file, "utf8");
   } catch {
     return fail6(`cannot read ${file} \u2014 pass a path: mend env load path/to/.env`);
   }
@@ -9640,10 +9663,10 @@ var envLoad = async (config, args) => {
     { contents, allSecret, secretNames }
   );
   if (report.loaded.length === 0 && report.rejected.length === 0 && report.malformedLines.length === 0) {
-    say6(dim6(`${path17.basename(file)} has no variables`));
+    say6(dim6(`${path18.basename(file)} has no variables`));
     return;
   }
-  say6(`${green6("\u2713")} loaded ${path17.basename(file)} into ${project2.name}`);
+  say6(`${green6("\u2713")} loaded ${path18.basename(file)} into ${project2.name}`);
   for (const line of formatLoadReport(report, { dim: dim6, warn: amber2 })) say6(line);
   const plaintextUrls = report.loaded.filter(
     (entry) => entry.lane === "configuration" && /_(URL|URI|DSN)$/.test(entry.name)
@@ -9834,7 +9857,7 @@ var skillsList = async (config, args) => {
 };
 var skillsPush = async (config, args) => {
   const dirFlag = takeFlagValue4(args, "--dir");
-  const root = dirFlag === null ? path17.join(os11.homedir(), DEFAULT_SKILLS_DIR) : path17.resolve(dirFlag);
+  const root = dirFlag === null ? path18.join(os11.homedir(), DEFAULT_SKILLS_DIR) : path18.resolve(dirFlag);
   const scanned = scanSkillLibrary(root);
   if ("error" in scanned) return fail6(scanned.error);
   for (const note of scanned.notes) say6(dim6(`  ${note.skill}: ${note.message}`));
@@ -10590,15 +10613,16 @@ var manCommand = (words) => {
   }
   const version = cliVersion();
   const page = doc === null ? renderManIndex(version) : renderManPage(doc, version);
-  const file = path17.join(os11.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
-  fs16.writeFileSync(file, page);
+  const file = path18.join(os11.tmpdir(), `mend-man-${process.pid}-${manFileName(doc)}`);
+  fs17.writeFileSync(file, page);
   const result = spawnSync6("man", ["-l", file], { stdio: "inherit" });
-  fs16.rmSync(file, { force: true });
+  fs17.rmSync(file, { force: true });
   if (result.error !== void 0 || result.status !== 0) {
     say6(doc === null ? renderIndex() : renderCommand(doc));
   }
 };
 var main = async () => {
+  useHttp1();
   const [command, ...rest] = process.argv.slice(2);
   const ownArgs = rest.slice(0, rest.indexOf("--") === -1 ? rest.length : rest.indexOf("--"));
   if (command !== void 0 && command !== "help" && ownArgs.some((a) => a === "--help" || a === "-h")) {