@sleds/cli 0.1.49 → 0.1.50

package/dist/sleds.mjs

@@ -5479,6 +5479,9 @@ var init_agent = __esm(() => {
   init_mention();
 });
 
+// ../../packages/shared/src/slack/channel.ts
+var init_channel = () => {};
+
 // ../../packages/shared/src/item/productHits.ts
 var PATH_STOP, COMMON;
 var init_productHits = __esm(() => {
@@ -6531,6 +6534,30 @@ var init_deploys = __esm(() => {
   SERVICE_RE = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,39}$/;
 });
 
+// ../../packages/shared/src/deploys/metrics.ts
+var WEEK_MS;
+var init_metrics = __esm(() => {
+  WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+});
+
+// ../../packages/shared/src/deploys/period.ts
+var DAY_MS2;
+var init_period = __esm(() => {
+  DAY_MS2 = 24 * 60 * 60 * 1000;
+});
+
+// ../../packages/shared/src/deploys/stability.ts
+var init_stability = __esm(() => {
+  init_outcome();
+  init_metrics();
+});
+
+// ../../packages/shared/src/deploys/batchSize.ts
+var init_batchSize = __esm(() => {
+  init_outcome();
+  init_metrics();
+});
+
 // ../../packages/shared/src/newrelic/newrelic.ts
 var init_newrelic = () => {};
 
@@ -7921,6 +7948,7 @@ var init_src = __esm(() => {
   init_mention();
   init_agent();
   init_copy();
+  init_channel();
   init_productHits();
   init_model();
   init_parse();
@@ -7936,6 +7964,10 @@ var init_src = __esm(() => {
   init_pack2();
   init_flags();
   init_deploys();
+  init_metrics();
+  init_period();
+  init_stability();
+  init_batchSize();
   init_sentry();
   init_newrelic();
   init_musher();
@@ -8611,7 +8643,7 @@ var init_seat = __esm(() => {
 
 // src/index.ts
 import { existsSync as existsSync36, realpathSync as realpathSync3 } from "fs";
-import { homedir as homedir9, platform as platform3 } from "os";
+import { homedir as homedir10, platform as platform3 } from "os";
 import { fileURLToPath } from "url";
 
 // ../../packages/shared/src/index.ts
@@ -8640,6 +8672,7 @@ init_outcome();
 init_mention();
 init_agent();
 init_copy();
+init_channel();
 init_productHits();
 init_model();
 init_parse();
@@ -8655,6 +8688,10 @@ init_cheatSheet();
 init_pack2();
 init_flags();
 init_deploys();
+init_metrics();
+init_period();
+init_stability();
+init_batchSize();
 init_sentry();
 init_newrelic();
 init_musher();
@@ -9824,6 +9861,7 @@ var defer = async (o) => {
 init_src();
 import { execFileSync as execFileSync2 } from "node:child_process";
 var DEPLOYS_URL = "https://hooks.sleds.ai/deploys";
+var DEPLOY_WAIT_MS = 120000;
 var USAGE = "usage: sleds deploy --env <slug> [--service <name>] [--sha <sha>] [--repo <owner/name>]";
 var FLAGS = ["env", "service", "sha", "repo"];
 var set = (x) => x?.trim() ? x.trim() : undefined;
@@ -9880,7 +9918,7 @@ var defaultPost = async (url, token, body) => {
       method: "POST",
       headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
       body: JSON.stringify(body),
-      signal: AbortSignal.timeout(15000)
+      signal: AbortSignal.timeout(DEPLOY_WAIT_MS)
     });
     let json = null;
     try {
@@ -9888,7 +9926,8 @@ var defaultPost = async (url, token, body) => {
     } catch {}
     return { status: res.status, json };
   } catch (e) {
-    return { error: e instanceof Error ? e.message : String(e) };
+    const timedOut = e instanceof Error && e.name === "TimeoutError";
+    return { error: e instanceof Error ? e.message : String(e), ...timedOut ? { timedOut } : {} };
   }
 };
 function deployLine(body, json) {
@@ -9921,6 +9960,10 @@ var deployCmd = async (o) => {
   const body = resolved.body;
   const url = set(env.SLEDS_DEPLOYS_URL) ?? DEPLOYS_URL;
   const r = await (o.post ?? defaultPost)(url, token, body);
+  if ("error" in r && r.timedOut) {
+    error(`notice: the report was sent but SLEDS did not answer within ${DEPLOY_WAIT_MS / 1000}s; it is usually still recorded — see Settings › Deploys › Recent deploys`);
+    return 0;
+  }
   if ("error" in r) {
     error(`warning: SLEDS unreachable, deploy not recorded — ${r.error}`);
     return 0;
@@ -9952,7 +9995,7 @@ import {
   writeFileSync as writeFileSync19
 } from "node:fs";
 import { tmpdir, userInfo as userInfo2 } from "node:os";
-import { delimiter as delimiter3, dirname as dirname17, join as join25, resolve as resolve9 } from "node:path";
+import { delimiter as delimiter3, dirname as dirname17, join as join26, resolve as resolve9 } from "node:path";
 
 // src/agentMcp.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
@@ -10328,8 +10371,36 @@ var runCockpit = async (cockpit, argv, opts = {}) => {
 // src/commands/doctor.ts
 init_config();
 
+// src/engine/credential.ts
+import { homedir } from "node:os";
+import { join as join11 } from "node:path";
+var API_KEY_VAR = "ANTHROPIC_API_KEY";
+var SEAT_TOKEN_VAR = "CLAUDE_CODE_OAUTH_TOKEN";
+function namesVar(text, name) {
+  return new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=\\s*\\S`, "m").test(text);
+}
+function loginPath(env, home = homedir()) {
+  return join11(env.CLAUDE_CONFIG_DIR?.trim() || join11(home, ".claude"), ".credentials.json");
+}
+function detectCredential(env, o) {
+  const file = o.boxEnvText ?? "";
+  const fileWhere = o.boxEnvPath ?? "box.env";
+  const vars = [
+    [API_KEY_VAR, "key", "api_key"],
+    [SEAT_TOKEN_VAR, "seat", "seat_token"]
+  ];
+  for (const [name, kind, source] of vars) {
+    if (env[name]?.trim())
+      return { kind, source, where: "this shell" };
+    if (namesVar(file, name))
+      return { kind, source, where: fileWhere };
+  }
+  const login = loginPath(env, o.home);
+  return o.exists(login) ? { kind: "seat", source: "login", where: login } : null;
+}
+
 // src/engine/repos.ts
-import { basename as basename2, dirname as dirname9, join as join11 } from "node:path";
+import { basename as basename2, dirname as dirname9, join as join12 } from "node:path";
 function splitReposDirs(raw) {
   return (raw ?? "").split(/[:\n]/).map((d) => d.trim()).filter(Boolean);
 }
@@ -10356,13 +10427,13 @@ function resolveRepoPath(o) {
     if (name.startsWith("."))
       continue;
     for (const dir of dirs) {
-      const p = join11(dir, name);
-      if (o.exists(join11(p, ".git")))
+      const p = join12(dir, name);
+      if (o.exists(join12(p, ".git")))
         return p;
     }
   }
   const want = o.repos.join(", ");
-  const where = names.flatMap((n) => dirs.map((d) => join11(d, n))).join(" or ");
+  const where = names.flatMap((n) => dirs.map((d) => join12(d, n))).join(" or ");
   return {
     error: `No checkout of ${want} on this engine's machine: expected ${where}. Clone it there (or pass --repo).`
   };
@@ -10370,7 +10441,7 @@ function resolveRepoPath(o) {
 var isRoot = (p) => dirname9(p) === p;
 function insideCheckout(dir, exists) {
   for (let d = dir;!isRoot(d); d = dirname9(d)) {
-    if (exists(join11(d, ".git")))
+    if (exists(join12(d, ".git")))
       return true;
   }
   return false;
@@ -10400,12 +10471,12 @@ init_meter();
 
 // src/runners/cmux.ts
 import { existsSync as existsSync11, rmSync as rmSync2, writeFileSync as writeFileSync10 } from "node:fs";
-import { delimiter, join as join13 } from "node:path";
+import { delimiter, join as join14 } from "node:path";
 
 // src/runners/exec.ts
 import { spawn, spawnSync as spawnSync3 } from "node:child_process";
 import { closeSync as closeSync2, fstatSync, openSync as openSync2, readSync as readSync2 } from "node:fs";
-import { basename as basename3, dirname as dirname10, join as join12 } from "node:path";
+import { basename as basename3, dirname as dirname10, join as join13 } from "node:path";
 
 // src/runners/sandbox.ts
 var absRule = (dir) => `/${dir.replace(/\/+$/, "")}/**`;
@@ -10549,7 +10620,7 @@ var readLogTail = (path) => {
 };
 var logPathFor = (promptFile, ext, dir) => {
   const base = basename3(promptFile).replace(/\.md$/i, "");
-  return join12(dir ?? dirname10(promptFile), `${base}.${ext}`);
+  return join13(dir ?? dirname10(promptFile), `${base}.${ext}`);
 };
 var tailText = (s, bytes = 4096) => {
   if (s.length <= bytes)
@@ -10573,7 +10644,7 @@ var isRunnerKey = (key) => /^(?:[1-9]|esc)$/.test(key);
 var CMUX_APP_BIN = "/Applications/cmux.app/Contents/Resources/bin/cmux";
 var resolveCmuxBin = (exists = existsSync11, path = process.env.PATH ?? "") => {
   for (const dir of path.split(delimiter)) {
-    if (dir && exists(join13(dir, "cmux")))
+    if (dir && exists(join14(dir, "cmux")))
       return "cmux";
   }
   return exists(CMUX_APP_BIN) ? CMUX_APP_BIN : "cmux";
@@ -10934,7 +11005,7 @@ function cmuxRunner(exec, deps = {}) {
 
 // src/runners/orca.ts
 import { existsSync as existsSync12, lstatSync, readlinkSync, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join14, resolve as resolve7 } from "node:path";
+import { join as join15, resolve as resolve7 } from "node:path";
 var obj = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
 var str8 = (v) => typeof v === "string" && v.length > 0 ? v : null;
 var parseOrcaJson = (stdout) => {
@@ -10995,7 +11066,7 @@ var realFs = { lstat: lstatSync, readlink: readlinkSync, exists: existsSync12 };
 var ORCA_LINK_FIX = "reinstall Orca's shell command from Orca (it links `orca` onto your PATH)";
 function danglingOrca(path, fs) {
   for (const dir of path.split(":").filter(Boolean)) {
-    const link = join14(dir, "orca");
+    const link = join15(dir, "orca");
     try {
       if (!fs.lstat(link).isSymbolicLink())
         return null;
@@ -11142,10 +11213,10 @@ function orcaRunner(exec, deps = {}) {
 }
 
 // src/runtime.ts
-import { homedir } from "node:os";
-import { join as join15, win32 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { join as join16, win32 } from "node:path";
 var isCompiled = (argv1 = process.argv[1]) => Boolean(argv1 && (argv1.startsWith("/$bunfs/") || argv1.startsWith("B:\\~BUN\\")));
-var sledsLink = (home = homedir(), platform = process.platform) => platform === "win32" ? win32.join(process.env.LOCALAPPDATA ?? win32.join(home, "AppData", "Local"), "sleds", "bin", "sleds.exe") : join15(home, ".sleds", "bin", "sleds");
+var sledsLink = (home = homedir2(), platform = process.platform) => platform === "win32" ? win32.join(process.env.LOCALAPPDATA ?? win32.join(home, "AppData", "Local"), "sleds", "bin", "sleds.exe") : join16(home, ".sleds", "bin", "sleds");
 
 // src/commands/doctor.ts
 init_settings();
@@ -11165,7 +11236,7 @@ import {
   writeFileSync as writeFileSync16
 } from "node:fs";
 import { hostname as hostname2, userInfo } from "node:os";
-import { dirname as dirname15, isAbsolute as isAbsolute3, join as join23, resolve as resolve8 } from "node:path";
+import { dirname as dirname15, isAbsolute as isAbsolute3, join as join24, resolve as resolve8 } from "node:path";
 
 // src/engine/beat.ts
 var BEAT_EVERY_MS = 60000;
@@ -11177,10 +11248,11 @@ function beatBody(state, flags, host = {}, cap = {}) {
     name: flags.name,
     os: host.os ?? process.platform,
     runner: flags.runner,
-    version: host.version ?? "0.1.49" ?? "dev",
+    version: host.version ?? "0.1.50" ?? "dev",
     running: live.length,
     items: live.slice(0, BEAT_ITEMS).map((r) => `${r.item}/${r.node}`),
     ...cap.atOnce !== undefined ? { atOnce: cap.atOnce } : {},
+    ...host.credential ? { credential: host.credential } : {},
     ...m ? {
       machine: {
         cpuPct: m.cpuPct,
@@ -13067,9 +13139,9 @@ function providerFailure(screen) {
 // src/engine/worktree.ts
 init_src();
 import { appendFileSync, existsSync as existsSync13, mkdirSync as mkdirSync11 } from "node:fs";
-import { dirname as dirname11, isAbsolute, join as join16 } from "node:path";
+import { dirname as dirname11, isAbsolute, join as join17 } from "node:path";
 function worktreePath(repoPath, name) {
-  return join16(repoPath, ".worktrees", name);
+  return join17(repoPath, ".worktrees", name);
 }
 var fail = (what, r) => new Error(`${what} failed: ${(r.stderr || r.stdout).trim() || `exit ${r.status}`}`);
 function defaultBranch(exec, repoPath) {
@@ -13104,7 +13176,7 @@ function ensureIgnored(exec, repoPath, fs = realWorktreeFs) {
   if (common.status !== 0)
     return;
   const dir = common.stdout.trim();
-  const exclude = join16(isAbsolute(dir) ? dir : join16(repoPath, dir), "info", "exclude");
+  const exclude = join17(isAbsolute(dir) ? dir : join17(repoPath, dir), "info", "exclude");
   fs.append(exclude, `
 # sleds engine: one worktree per route node
 .worktrees/
@@ -13116,7 +13188,7 @@ function ensureWorktree(exec, repoPath, branch, path, base = "main", fs = realWo
   return path;
 }
 function makeWorktree(exec, repoPath, branch, path, base, fs, log) {
-  if (fs.exists(join16(path, ".git"))) {
+  if (fs.exists(join17(path, ".git"))) {
     fastForwardUntouched(exec, path, base, log);
     return path;
   }
@@ -13192,13 +13264,13 @@ function installArgv(command) {
   return rest.every((a) => a.startsWith("-")) ? argv : null;
 }
 function lockfileInstall(path, exists) {
-  if (exists(join16(path, "pnpm-lock.yaml")))
+  if (exists(join17(path, "pnpm-lock.yaml")))
     return ["pnpm", "install", "--frozen-lockfile"];
-  if (exists(join16(path, "bun.lock")) || exists(join16(path, "bun.lockb")))
+  if (exists(join17(path, "bun.lock")) || exists(join17(path, "bun.lockb")))
     return ["bun", "install", "--frozen-lockfile"];
-  if (exists(join16(path, "yarn.lock")))
+  if (exists(join17(path, "yarn.lock")))
     return ["yarn", "install", "--frozen-lockfile"];
-  if (exists(join16(path, "package-lock.json")))
+  if (exists(join17(path, "package-lock.json")))
     return ["npm", "ci"];
   return null;
 }
@@ -13256,7 +13328,7 @@ function claimRunOf(run, repo) {
   };
 }
 function ensureInstalled(exec, path, fs, o = {}) {
-  if (!fs.exists(join16(path, "package.json")) || fs.exists(join16(path, "node_modules")))
+  if (!fs.exists(join17(path, "package.json")) || fs.exists(join17(path, "node_modules")))
     return null;
   const argv = installArgv(o.command) ?? lockfileInstall(path, fs.exists);
   if (!argv)
@@ -13271,7 +13343,7 @@ function ensureInstalled(exec, path, fs, o = {}) {
   return { argv, ok };
 }
 function ensureDetachedWorktree(exec, repoPath, path, base = "main", fs = realWorktreeFs) {
-  if (fs.exists(join16(path, ".git")))
+  if (fs.exists(join17(path, ".git")))
     return path;
   ensureIgnored(exec, repoPath, fs);
   const f = exec("git", ["-C", repoPath, "fetch", "origin", base]);
@@ -16560,8 +16632,8 @@ init_settings();
 
 // src/update/drain.ts
 import { closeSync as closeSync4, existsSync as existsSync18, mkdirSync as mkdirSync17, openSync as openSync4, rmSync as rmSync9, statSync as statSync4, writeSync as writeSync2 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { join as join22 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { join as join23 } from "node:path";
 
 // ../../packages/shared/src/updates/manifest.ts
 var CLI_PLATFORMS = [
@@ -16703,13 +16775,13 @@ import {
   statSync as statSync2,
   writeFileSync as writeFileSync13
 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname12, join as join17, win32 as win322 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname12, join as join18, win32 as win322 } from "node:path";
 var UPDATE_LOCK_STALE_MS = 10 * 60000;
-function sledsRoot(home = homedir2(), platform = process.platform) {
-  return platform === "win32" ? win322.join(process.env.LOCALAPPDATA ?? win322.join(home, "AppData", "Local"), "sleds") : join17(home, ".sleds");
+function sledsRoot(home = homedir3(), platform = process.platform) {
+  return platform === "win32" ? win322.join(process.env.LOCALAPPDATA ?? win322.join(home, "AppData", "Local"), "sleds") : join18(home, ".sleds");
 }
-var pathFor = (platform) => platform === "win32" ? win322 : { join: join17 };
+var pathFor = (platform) => platform === "win32" ? win322 : { join: join18 };
 function versionDir(home, v, platform = process.platform) {
   return pathFor(platform).join(sledsRoot(home, platform), "versions", v);
 }
@@ -16901,7 +16973,7 @@ async function fetchVersion(o) {
   const platform = o.platform ?? process.platform;
   const arch = o.arch ?? process.arch;
   const publicKey = o.publicKey ?? RELEASE_PUBLIC_KEY;
-  const running = o.running ?? "0.1.49";
+  const running = o.running ?? "0.1.50";
   if (!publicKey)
     return { ok: false, why: "no release key yet" };
   if (!VERSION_RE2.test(o.version))
@@ -16978,7 +17050,7 @@ async function fetchVersion(o) {
 
 // src/update/guard.ts
 import { existsSync as existsSync17 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 
 // src/update/migrate.ts
 import { spawn as spawn2 } from "node:child_process";
@@ -16994,20 +17066,20 @@ import {
   symlinkSync,
   writeFileSync as writeFileSync15
 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { basename as basename5, delimiter as delimiter2, dirname as dirname13, isAbsolute as isAbsolute2, join as join20, relative } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { basename as basename5, delimiter as delimiter2, dirname as dirname13, isAbsolute as isAbsolute2, join as join21, relative } from "node:path";
 
 // src/commands/engineSystemd.ts
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 var BOX_ENV_UNIT_PATH = "%h/.config/sleds/box.env";
 function boxEnvPath(home) {
-  return join18(home, ".config", "sleds", "box.env");
+  return join19(home, ".config", "sleds", "box.env");
 }
 function engineUnitDir(home) {
-  return join18(home, ".config", "systemd", "user");
+  return join19(home, ".config", "systemd", "user");
 }
 function engineUnitPath(home, label) {
-  return join18(engineUnitDir(home), `${label}.service`);
+  return join19(engineUnitDir(home), `${label}.service`);
 }
 function systemdQuote(s) {
   const body = s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/%/g, "%%").replace(/\$/g, "$$$$");
@@ -17049,7 +17121,7 @@ function parseEngineUnit(text) {
 // src/schedule.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { existsSync as existsSync15, mkdirSync as mkdirSync14, rmSync as rmSync6, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var REVERT_LABEL = "ai.sleds.revert";
 var defaultExec2 = (cmd, args) => {
   const r = spawnSync4(cmd, [...args], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
@@ -17057,7 +17129,7 @@ var defaultExec2 = (cmd, args) => {
     return { ok: false, stderr: r.error.message };
   return { ok: r.status === 0, stderr: r.stderr ?? "" };
 };
-var plistPath = (home) => join19(home, "Library", "LaunchAgents", `${REVERT_LABEL}.plist`);
+var plistPath = (home) => join20(home, "Library", "LaunchAgents", `${REVERT_LABEL}.plist`);
 var xmlEscape2 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 var buildLaunchdPlist = (sledsArgv, deadline) => {
   const args = [...sledsArgv, "off"].map((a) => `    <string>${xmlEscape2(a)}</string>`).join(`
@@ -17096,7 +17168,7 @@ var scheduleRevert = (d, deadlineMs) => {
   if (d.platform === "darwin") {
     const p = plistPath(d.home);
     try {
-      mkdirSync14(join19(d.home, "Library", "LaunchAgents"), { recursive: true });
+      mkdirSync14(join20(d.home, "Library", "LaunchAgents"), { recursive: true });
       d.exec("launchctl", ["unload", p]);
       writeFileSync14(p, buildLaunchdPlist(d.sledsArgv, deadline));
       const r = d.exec("launchctl", ["load", p]);
@@ -17148,8 +17220,8 @@ var HOOK_SUBS = [
   "stop-event",
   "permission-event"
 ];
-var migrateBakDir = (home) => join20(sledsRoot(home), "migrate.bak");
-var manifestPath = (home) => join20(migrateBakDir(home), "manifest.json");
+var migrateBakDir = (home) => join21(sledsRoot(home), "migrate.bak");
+var manifestPath = (home) => join21(migrateBakDir(home), "manifest.json");
 var xmlEscape3 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 var xmlUnescape = (s) => s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
 var shQuote = (s) => /^[\w./~-]+$/.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
@@ -17249,13 +17321,13 @@ function rewriteSettings(text, link) {
 }
 var listDir = (dir, keep) => {
   try {
-    return readdirSync2(dir).filter(keep).sort().map((n) => join20(dir, n));
+    return readdirSync2(dir).filter(keep).sort().map((n) => join21(dir, n));
   } catch {
     return [];
   }
 };
 function unitFiles(home) {
-  const agents = listDir(join20(home, "Library", "LaunchAgents"), (n) => n.startsWith("ai.sleds.") && n.endsWith(".plist")).map((path) => ({
+  const agents = listDir(join21(home, "Library", "LaunchAgents"), (n) => n.startsWith("ai.sleds.") && n.endsWith(".plist")).map((path) => ({
     path,
     ...basename5(path).startsWith("ai.sleds.revert") ? {} : { reload: "launchd" }
   }));
@@ -17267,7 +17339,7 @@ function unitClaudeDir(text) {
   return plist ? xmlUnescape(plist) : undefined;
 }
 function claudeDirs(home, env) {
-  const dirs = [join20(home, ".claude"), claudeDir(home, env)];
+  const dirs = [join21(home, ".claude"), claudeDir(home, env)];
   for (const u of unitFiles(home)) {
     try {
       const d = unitClaudeDir(readFileSync14(u.path, "utf8"));
@@ -17291,7 +17363,7 @@ function migrationPlan(home, link, env = process.env) {
       out.push({ ...u, text: next });
   }
   for (const dir of claudeDirs(home, env)) {
-    const path = join20(dir, "settings.json");
+    const path = join21(dir, "settings.json");
     let text;
     try {
       text = readFileSync14(path, "utf8");
@@ -17306,7 +17378,7 @@ function migrationPlan(home, link, env = process.env) {
 }
 var backupFor = (home, path) => {
   const rel = relative(home, path);
-  return rel.startsWith("..") || isAbsolute2(rel) ? join20(migrateBakDir(home), "abs", path) : join20(migrateBakDir(home), rel);
+  return rel.startsWith("..") || isAbsolute2(rel) ? join21(migrateBakDir(home), "abs", path) : join21(migrateBakDir(home), rel);
 };
 function writeKeepingMode(path, text) {
   let mode = 420;
@@ -17391,7 +17463,7 @@ function putBack(home, m) {
   return failed;
 }
 function restoreMigration(s, o) {
-  const home = o.home ?? homedir3();
+  const home = o.home ?? homedir4();
   const m = readManifest(home);
   const to = m?.to ?? s.pending?.to ?? "?";
   const failed = m ? putBack(home, m) : [];
@@ -17403,7 +17475,7 @@ function restoreMigration(s, o) {
   return failed.length ? `moved back to the npm install, but could not restore ${failed.join(", ")} — the copies are in ${migrateBakDir(home)}` : "moved back to the npm install";
 }
 async function migrateToBinary(o) {
-  const home = o.home ?? homedir3();
+  const home = o.home ?? homedir4();
   const log = o.log ?? console.error;
   const env = o.env ?? process.env;
   const platform = o.platform ?? process.platform;
@@ -17497,11 +17569,11 @@ import {
   rmSync as rmSync8,
   symlinkSync as symlinkSync2
 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname14, join as join21 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname14, join as join22 } from "node:path";
 var NO_PREVIOUS = "no previous version on this machine";
-function allStateFiles(home = homedir4(), env = process.env) {
-  const roots = [...new Set([configDir(home, env), join21(home, ".config", "sleds")])];
+function allStateFiles(home = homedir5(), env = process.env) {
+  const roots = [...new Set([configDir(home, env), join22(home, ".config", "sleds")])];
   const out = [];
   const walk = (dir) => {
     let names;
@@ -17512,20 +17584,20 @@ function allStateFiles(home = homedir4(), env = process.env) {
     }
     for (const n of names.sort())
       if (n.endsWith(".json") && n !== "removed-engines.json")
-        out.push(join21(dir, n));
+        out.push(join22(dir, n));
     for (const sub of ["orgs", "seats"]) {
       let kids;
       try {
-        kids = readdirSync3(join21(dir, sub));
+        kids = readdirSync3(join22(dir, sub));
       } catch {
         continue;
       }
       for (const k of kids.sort())
-        walk(join21(dir, sub, k));
+        walk(join22(dir, sub, k));
     }
   };
   for (const r of roots)
-    walk(join21(r, "engine"));
+    walk(join22(r, "engine"));
   return out;
 }
 var backupPath2 = (file, v) => `${file}.${v}.bak`;
@@ -17621,7 +17693,7 @@ function applyConfirm(s, home, o = {}) {
     }
     for (const n of names)
       if (n.startsWith(prefix) && n.endsWith(".bak"))
-        rmSync8(join21(dir, n), { force: true });
+        rmSync8(join22(dir, n), { force: true });
   }
   const keep = new Set([s.current, s.previous, s.drain?.to].filter(Boolean));
   const versions = dirname14(versionDir(home, s.current, platform));
@@ -17711,7 +17783,7 @@ function movedAway(s, home, version, platform) {
   return at && at !== version ? at : null;
 }
 async function startGuard(o) {
-  const home = o.home ?? homedir5();
+  const home = o.home ?? homedir6();
   const platform = o.platform ?? process.platform;
   const version = o.version;
   if (!version || !guarded(home, version, platform))
@@ -17743,7 +17815,7 @@ async function startGuard(o) {
   }
 }
 function firstBeatWatchdog(o) {
-  const home = o.home ?? homedir5();
+  const home = o.home ?? homedir6();
   const platform = o.platform ?? process.platform;
   const version = o.version;
   const idle = { beat: async () => {}, stop: () => {} };
@@ -17884,7 +17956,7 @@ async function machineAnswer(client, tokens) {
 }
 async function fetchOnce(o) {
   const dir = versionDir(o.home, o.version, o.platform);
-  const lock = join22(dir, "fetch.lock");
+  const lock = join23(dir, "fetch.lock");
   mkdirSync17(dir, { recursive: true, mode: 493 });
   let fd;
   try {
@@ -17928,7 +18000,7 @@ var realPidAlive = (pid) => {
   }
 };
 function engineUpdater(o) {
-  const home = o.home ?? homedir6();
+  const home = o.home ?? homedir7();
   const platform = o.platform ?? process.platform;
   const version = o.version;
   if (!version || !VERSION_RE3.test(version))
@@ -18391,7 +18463,7 @@ function flagsFromProfile(flags, given, profile, home) {
     }
   }
   if (profile.reposDir && !has("repos-dir") && !has("repo")) {
-    out.reposDir = splitReposDirs(profile.reposDir).map((d) => home && /^~(\/|$)/.test(d) ? join23(home, d.slice(1)) : d).join(":");
+    out.reposDir = splitReposDirs(profile.reposDir).map((d) => home && /^~(\/|$)/.test(d) ? join24(home, d.slice(1)) : d).join(":");
     used.push(`repos ${profile.reposDir}`);
   }
   if (profile.mcpStrict !== undefined && !has("strict-mcp") && !has("no-strict-mcp")) {
@@ -18485,7 +18557,7 @@ function engineClient(o, org) {
     return fetchClient({
       ...src,
       timeoutMs: ENGINE_TIMEOUT_MS,
-      version: "0.1.49"
+      version: "0.1.50"
     });
   const asked = org?.trim() || env.SLEDS_ORG?.trim();
   if (asked && !selectOrg(readConfig(o.home), org, env).seat)
@@ -18525,12 +18597,12 @@ function memberMcpConfigs(o, cwd) {
   });
   const claudeDir = (o.env ?? process.env).CLAUDE_CONFIG_DIR;
   return [
-    read(claudeDir ? join23(claudeDir, ".claude.json") : join23(o.home, ".claude.json")),
-    ...cwd ? [read(join23(cwd, ".mcp.json"))] : []
+    read(claudeDir ? join24(claudeDir, ".claude.json") : join24(o.home, ".claude.json")),
+    ...cwd ? [read(join24(cwd, ".mcp.json"))] : []
   ];
 }
 function engineStateDir(o, org, seat) {
-  return seatStateDir(orgStateDir(o.stateDir ?? join23(configDir(o.home, o.env ?? process.env), "engine"), org), seat);
+  return seatStateDir(orgStateDir(o.stateDir ?? join24(configDir(o.home, o.env ?? process.env), "engine"), org), seat);
 }
 function engineSeat(o, org) {
   try {
@@ -18560,8 +18632,8 @@ function engineDeps(o, flags, source, runner, stateName) {
   const repo = flags.repo ? resolve8(cwd, flags.repo) : undefined;
   const reposDirs = splitReposDirs(flags.reposDir).map((d) => resolve8(cwd, d));
   const { branch, prTitle } = flags;
-  const hooksDir = join23(stateDir, "hooks");
-  const permissionMark = (name) => join23(hooksDir, `${name}.permission.json`);
+  const hooksDir = join24(stateDir, "hooks");
+  const permissionMark = (name) => join24(hooksDir, `${name}.permission.json`);
   const withHook = (name, settings) => applyPermissionHook(settings, [...o.sledsArgv ?? ["sleds"], "permission-event", "--mark", permissionMark(name)].map(shq2).join(" "));
   return {
     source,
@@ -18586,9 +18658,9 @@ function engineDeps(o, flags, source, runner, stateName) {
       sandbox: true,
       writeSandboxSettings: o.writeSandboxSettings ?? ((name, cwd, allow) => {
         const gitCommonDir = gitCommonDirOf(exec, cwd);
-        const dir = join23(stateDir, "sandbox");
+        const dir = join24(stateDir, "sandbox");
         mkdirSync18(dir, { recursive: true, mode: 448 });
-        const p = join23(dir, `${name}.json`);
+        const p = join24(dir, `${name}.json`);
         const walls = engineSandboxSettings(o.home, o.env ?? process.env, gitCommonDir, [
           ...SANDBOX_DEFAULT_ALLOW,
           ...flags.sandboxAllow ?? []
@@ -18605,7 +18677,7 @@ function engineDeps(o, flags, source, runner, stateName) {
     } : {},
     writeHookSettings: (name, allow) => {
       mkdirSync18(hooksDir, { recursive: true, mode: 448 });
-      const p = join23(hooksDir, `${name}.json`);
+      const p = join24(hooksDir, `${name}.json`);
       const base = allow?.length ? { permissions: { allow: [...allow] } } : {};
       writeFileSync16(p, `${JSON.stringify(withHook(name, base), null, 2)}
 `, { mode: 384 });
@@ -18633,9 +18705,9 @@ function engineDeps(o, flags, source, runner, stateName) {
       exists
     }),
     writeMcpConfig: o.writeMcpConfig ?? ((name, runToken, worktree) => {
-      const dir = join23(stateDir, "mcp");
+      const dir = join24(stateDir, "mcp");
       mkdirSync18(dir, { recursive: true, mode: 448 });
-      const p = join23(dir, `${name}.json`);
+      const p = join24(dir, `${name}.json`);
       let others = {};
       if (flags.strictMcp && flags.mcpAllow?.length) {
         const r = mcpPassThrough(flags.mcpAllow, memberMcpConfigs(o, worktree));
@@ -18651,9 +18723,9 @@ function engineDeps(o, flags, source, runner, stateName) {
     }),
     removeMcpConfig: o.removeMcpConfig ?? ((p) => rmSync10(p, { force: true })),
     writePrompt: o.writePrompt ?? ((name, text) => {
-      const dir = join23(stateDir, "prompts");
+      const dir = join24(stateDir, "prompts");
       mkdirSync18(dir, { recursive: true, mode: 448 });
-      const p = join23(dir, `${name}.md`);
+      const p = join24(dir, `${name}.md`);
       writeFileSync16(p, text, { mode: 384 });
       return p;
     }),
@@ -18680,14 +18752,14 @@ function engineDeps(o, flags, source, runner, stateName) {
 }
 function sandboxDenyRead(home, env) {
   return {
-    dirs: [...new Set([configDir(home, env), join23(home, ".config", "sleds")])],
+    dirs: [...new Set([configDir(home, env), join24(home, ".config", "sleds")])],
     files: [
       ...new Set([
         tokenPath(home, env),
-        join23(home, ".sleds-token"),
+        join24(home, ".sleds-token"),
         settingsPath(home, env),
         backupPath(home, env),
-        join23(claudeDir(home, env), "settings.local.json")
+        join24(claudeDir(home, env), "settings.local.json")
       ])
     ]
   };
@@ -18708,7 +18780,7 @@ function gitCommonDirOf(exec, cwd) {
 }
 var LENT_NEEDS_SANDBOX = "a lent engine runs every session sandboxed (spec 48 rule 10) — add --sandbox to --lent-by";
 function lenderHome(accountHome, lentBy) {
-  return isAbsolute3(lentBy) ? resolve8(lentBy) : join23(dirname15(accountHome), lentBy);
+  return isAbsolute3(lentBy) ? resolve8(lentBy) : join24(dirname15(accountHome), lentBy);
 }
 function lentHomeProblems(accountHome, lentBy, modeOf) {
   const lender = lenderHome(accountHome, lentBy);
@@ -18776,7 +18848,7 @@ async function driveEngine(o, flags, deps, until = {}) {
     runner: deps.runner.name,
     atOnce: flags.atOnce,
     interval: flags.interval,
-    cliVersion: "0.1.49"
+    cliVersion: "0.1.50"
   };
   const beat = (checkedAt) => {
     const m = deps.machine;
@@ -19122,7 +19194,7 @@ import {
   writeFileSync as writeFileSync17
 } from "node:fs";
 import { hostname as hostname3 } from "node:os";
-import { basename as basename6, dirname as dirname16, isAbsolute as isAbsolute4, join as join24 } from "node:path";
+import { basename as basename6, dirname as dirname16, isAbsolute as isAbsolute4, join as join25 } from "node:path";
 init_state();
 var ENGINE_LABEL = "ai.sleds.engine";
 var ENGINE_INSTALL_USAGE = `usage: sleds engine install [engine flags]   |   sleds engine uninstall [--name <n>] [--org <slug>]
@@ -19143,13 +19215,13 @@ function engineLabel(name, org, seat) {
   return [ENGINE_LABEL, org, seat?.trim(), name].filter((p) => Boolean(p)).map((p, i) => i === 0 ? p : engineSlug(p)).join(".");
 }
 function enginePlistPath(home, name, org, seat) {
-  return join24(home, "Library", "LaunchAgents", `${engineLabel(name, org, seat)}.plist`);
+  return join25(home, "Library", "LaunchAgents", `${engineLabel(name, org, seat)}.plist`);
 }
 function engineLogPath(stateDir, name) {
-  return join24(stateDir, `${engineSlug(name)}.log`);
+  return join25(stateDir, `${engineSlug(name)}.log`);
 }
 function engineEventsPath(stateDir, name) {
-  return join24(stateDir, `${engineSlug(name)}.events.jsonl`);
+  return join25(stateDir, `${engineSlug(name)}.events.jsonl`);
 }
 var xmlEscape4 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 function buildEnginePlist(o) {
@@ -19246,7 +19318,7 @@ function readEngines(dir, suffix, manager, parse) {
   }
   const out = [];
   for (const name of names.filter((n) => n.startsWith(`${ENGINE_LABEL}.`) && n.endsWith(suffix))) {
-    const path = join24(dir, name);
+    const path = join25(dir, name);
     let parsed;
     try {
       parsed = parse(readFileSync16(path, "utf8"), name);
@@ -19266,7 +19338,7 @@ function readEngines(dir, suffix, manager, parse) {
 }
 function installedEngines(home) {
   return [
-    ...readEngines(join24(home, "Library", "LaunchAgents"), ".plist", "launchd", parseEnginePlist),
+    ...readEngines(join25(home, "Library", "LaunchAgents"), ".plist", "launchd", parseEnginePlist),
     ...readEngines(engineUnitDir(home), ".service", "systemd", (text, file) => {
       const parsed = parseEngineUnit(text);
       return parsed && { label: basename6(file, ".service"), ...parsed };
@@ -19923,12 +19995,12 @@ function sandboxChecks(o, env) {
       }
     ];
   const nonce = o.nonce ?? `sleds-probe-${randomBytes(16).toString("hex")}`;
-  const probe = join25(dir, SANDBOX_PROBE);
-  const work = mkdtempSync(join25(tmpdir(), "sleds-sandbox-"));
+  const probe = join26(dir, SANDBOX_PROBE);
+  const work = mkdtempSync(join26(tmpdir(), "sleds-sandbox-"));
   try {
     writeFileSync19(probe, `${nonce}
 `, { mode: 384 });
-    const settingsFile = join25(work, "settings.json");
+    const settingsFile = join26(work, "settings.json");
     const settings = engineSandboxSettings(o.home, env, work, SANDBOX_DEFAULT_ALLOW);
     const claudeSettings = settingsPath(o.home, env);
     writeFileSync19(settingsFile, JSON.stringify(settings, null, 2), { mode: 384 });
@@ -20100,12 +20172,18 @@ function lentChecks(o, lentBy, engine) {
 function boxChecks(o, env, which, need) {
   const claude = which("claude");
   const file = boxEnvPath(o.home);
-  let named = false;
+  let boxEnvText = null;
   try {
-    named = /^\s*(?:export\s+)?ANTHROPIC_API_KEY\s*=\s*\S/m.test(readFileSync19(file, "utf8"));
+    boxEnvText = readFileSync19(file, "utf8");
   } catch {
-    named = false;
+    boxEnvText = null;
   }
+  const cred = detectCredential(env, {
+    home: o.home,
+    boxEnvText,
+    boxEnvPath: file,
+    exists: o.exists ?? existsSync21
+  });
   return [
     claude ? { level: "ok", name: "claude cli", detail: `${claude} · the headless runner's agent` } : {
       level: need,
@@ -20113,14 +20191,20 @@ function boxChecks(o, env, which, need) {
       detail: "`claude` not on PATH — the headless runner starts Claude Code for each node",
       fix: "npm install -g @anthropic-ai/claude-code"
     },
-    env.ANTHROPIC_API_KEY?.trim() ? { level: "ok", name: "api key", detail: "ANTHROPIC_API_KEY set in this shell" } : named ? { level: "ok", name: "api key", detail: `ANTHROPIC_API_KEY named in ${file}` } : {
+    cred ? { level: "ok", name: "credential", detail: credentialDetail(cred) } : {
       level: need,
-      name: "api key",
-      detail: `ANTHROPIC_API_KEY is not set here or in ${file} — a headless session cannot sign in`,
-      fix: `add ANTHROPIC_API_KEY=… to ${file} (the engine's unit reads it at start)`
+      name: "credential",
+      detail: `no ${API_KEY_VAR}, ${SEAT_TOKEN_VAR} or claude login here or in ${file} — a headless session cannot sign in`,
+      fix: `add ${API_KEY_VAR}=… (a key) or ${SEAT_TOKEN_VAR}=… (a seat, from \`claude setup-token\`) to ${file}, or sign in once with \`claude\` and /login`
     }
   ];
 }
+function credentialDetail(c) {
+  if (c.source === "login")
+    return `seat · claude login at ${c.where}`;
+  const name = c.source === "api_key" ? API_KEY_VAR : SEAT_TOKEN_VAR;
+  return `${c.kind} · ${name} ${c.where === "this shell" ? "set in this shell" : `named in ${c.where}`}`;
+}
 function cmuxCheck(o, env) {
   const exec = o.exec ?? defaultExec3;
   const bin = resolveCmuxBin(o.exists ?? existsSync21, env.PATH ?? "");
@@ -20215,7 +20299,7 @@ import {
   writeFileSync as writeFileSync20
 } from "node:fs";
 import { hostname as hostname4, userInfo as userInfo3 } from "node:os";
-import { dirname as dirname18, isAbsolute as isAbsolute5, join as join26, resolve as resolve10 } from "node:path";
+import { dirname as dirname18, isAbsolute as isAbsolute5, join as join27, resolve as resolve10 } from "node:path";
 init_machine();
 init_state();
 init_meter();
@@ -20475,7 +20559,7 @@ function flagsFromProfile2(flags, given, profile, home) {
     }
   }
   if (profile.reposDir && !has("repos-dir") && !has("repo")) {
-    out.reposDir = splitReposDirs(profile.reposDir).map((d) => home && /^~(\/|$)/.test(d) ? join26(home, d.slice(1)) : d).join(":");
+    out.reposDir = splitReposDirs(profile.reposDir).map((d) => home && /^~(\/|$)/.test(d) ? join27(home, d.slice(1)) : d).join(":");
     used.push(`repos ${profile.reposDir}`);
   }
   if (profile.mcpStrict !== undefined && !has("strict-mcp") && !has("no-strict-mcp")) {
@@ -20621,7 +20705,7 @@ function engineClient2(o, org) {
     return fetchClient({
       ...src,
       timeoutMs: ENGINE_TIMEOUT_MS2,
-      version: "0.1.49"
+      version: "0.1.50"
     });
   const asked = org?.trim() || env.SLEDS_ORG?.trim();
   if (asked && !selectOrg(readConfig(o.home), org, env).seat)
@@ -20670,12 +20754,12 @@ function memberMcpConfigs2(o, cwd) {
   });
   const claudeDir = (o.env ?? process.env).CLAUDE_CONFIG_DIR;
   return [
-    read(claudeDir ? join26(claudeDir, ".claude.json") : join26(o.home, ".claude.json")),
-    ...cwd ? [read(join26(cwd, ".mcp.json"))] : []
+    read(claudeDir ? join27(claudeDir, ".claude.json") : join27(o.home, ".claude.json")),
+    ...cwd ? [read(join27(cwd, ".mcp.json"))] : []
   ];
 }
 function engineStateDir2(o, org, seat) {
-  return seatStateDir(orgStateDir(o.stateDir ?? join26(configDir(o.home, o.env ?? process.env), "engine"), org), seat);
+  return seatStateDir(orgStateDir(o.stateDir ?? join27(configDir(o.home, o.env ?? process.env), "engine"), org), seat);
 }
 function engineSeat2(o, org) {
   try {
@@ -20694,6 +20778,19 @@ function engineToken2(o, org) {
   }
 }
 var withToken2 = (token, now) => token ? { token, tokenNow: now } : {};
+function engineCredential(o) {
+  const file = boxEnvPath(o.home);
+  let boxEnvText = null;
+  try {
+    boxEnvText = readFileSync20(file, "utf8");
+  } catch {}
+  return detectCredential(o.env ?? process.env, {
+    home: o.home,
+    boxEnvText,
+    boxEnvPath: file,
+    exists: o.exists ?? realExists2
+  })?.kind;
+}
 function engineDeps2(o, flags, source, runner, stateName) {
   const exec = guardGit(o.exec ?? defaultExec);
   const cwd = o.cwd ?? process.cwd();
@@ -20705,8 +20802,8 @@ function engineDeps2(o, flags, source, runner, stateName) {
   const repo = flags.repo ? resolve10(cwd, flags.repo) : undefined;
   const reposDirs = splitReposDirs(flags.reposDir).map((d) => resolve10(cwd, d));
   const { branch, prTitle } = flags;
-  const hooksDir = join26(stateDir, "hooks");
-  const permissionMark = (name) => join26(hooksDir, `${name}.permission.json`);
+  const hooksDir = join27(stateDir, "hooks");
+  const permissionMark = (name) => join27(hooksDir, `${name}.permission.json`);
   const withHook = (name, settings) => applyPermissionHook(settings, [...o.sledsArgv ?? ["sleds"], "permission-event", "--mark", permissionMark(name)].map(shq2).join(" "));
   return {
     source,
@@ -20731,9 +20828,9 @@ function engineDeps2(o, flags, source, runner, stateName) {
       sandbox: true,
       writeSandboxSettings: o.writeSandboxSettings ?? ((name, cwd, allow) => {
         const gitCommonDir = gitCommonDirOf2(exec, cwd);
-        const dir = join26(stateDir, "sandbox");
+        const dir = join27(stateDir, "sandbox");
         mkdirSync21(dir, { recursive: true, mode: 448 });
-        const p = join26(dir, `${name}.json`);
+        const p = join27(dir, `${name}.json`);
         const walls = engineSandboxSettings2(o.home, o.env ?? process.env, gitCommonDir, [
           ...SANDBOX_DEFAULT_ALLOW,
           ...flags.sandboxAllow ?? []
@@ -20750,7 +20847,7 @@ function engineDeps2(o, flags, source, runner, stateName) {
     } : {},
     writeHookSettings: (name, allow) => {
       mkdirSync21(hooksDir, { recursive: true, mode: 448 });
-      const p = join26(hooksDir, `${name}.json`);
+      const p = join27(hooksDir, `${name}.json`);
       const base = allow?.length ? { permissions: { allow: [...allow] } } : {};
       writeFileSync20(p, `${JSON.stringify(withHook(name, base), null, 2)}
 `, { mode: 384 });
@@ -20778,9 +20875,9 @@ function engineDeps2(o, flags, source, runner, stateName) {
       exists
     }),
     writeMcpConfig: o.writeMcpConfig ?? ((name, runToken, worktree) => {
-      const dir = join26(stateDir, "mcp");
+      const dir = join27(stateDir, "mcp");
       mkdirSync21(dir, { recursive: true, mode: 448 });
-      const p = join26(dir, `${name}.json`);
+      const p = join27(dir, `${name}.json`);
       let others = {};
       if (flags.strictMcp && flags.mcpAllow?.length) {
         const r = mcpPassThrough(flags.mcpAllow, memberMcpConfigs2(o, worktree));
@@ -20796,9 +20893,9 @@ function engineDeps2(o, flags, source, runner, stateName) {
     }),
     removeMcpConfig: o.removeMcpConfig ?? ((p) => rmSync14(p, { force: true })),
     writePrompt: o.writePrompt ?? ((name, text) => {
-      const dir = join26(stateDir, "prompts");
+      const dir = join27(stateDir, "prompts");
       mkdirSync21(dir, { recursive: true, mode: 448 });
-      const p = join26(dir, `${name}.md`);
+      const p = join27(dir, `${name}.md`);
       writeFileSync20(p, text, { mode: 384 });
       return p;
     }),
@@ -20825,14 +20922,14 @@ function engineDeps2(o, flags, source, runner, stateName) {
 }
 function sandboxDenyRead2(home, env) {
   return {
-    dirs: [...new Set([configDir(home, env), join26(home, ".config", "sleds")])],
+    dirs: [...new Set([configDir(home, env), join27(home, ".config", "sleds")])],
     files: [
       ...new Set([
         tokenPath(home, env),
-        join26(home, ".sleds-token"),
+        join27(home, ".sleds-token"),
         settingsPath(home, env),
         backupPath(home, env),
-        join26(claudeDir(home, env), "settings.local.json")
+        join27(claudeDir(home, env), "settings.local.json")
       ])
     ]
   };
@@ -20866,7 +20963,7 @@ function sandboxRefusal(flags) {
 }
 var LENT_NEEDS_SANDBOX2 = "a lent engine runs every session sandboxed (spec 48 rule 10) — add --sandbox to --lent-by";
 function lenderHome2(accountHome, lentBy) {
-  return isAbsolute5(lentBy) ? resolve10(lentBy) : join26(dirname18(accountHome), lentBy);
+  return isAbsolute5(lentBy) ? resolve10(lentBy) : join27(dirname18(accountHome), lentBy);
 }
 function lentHomeProblems2(accountHome, lentBy, modeOf) {
   const lender = lenderHome2(accountHome, lentBy);
@@ -20934,7 +21031,7 @@ async function driveEngine2(o, flags, deps, until = {}) {
     runner: deps.runner.name,
     atOnce: flags.atOnce,
     interval: flags.interval,
-    cliVersion: "0.1.49"
+    cliVersion: "0.1.50"
   };
   const beat = (checkedAt) => {
     const m = deps.machine;
@@ -21312,9 +21409,10 @@ var engineCmd = async (o) => {
       refused = r.refused;
       error(r.below ? `${r.refused}. This engine is not shown as up until it beats on a version SLEDS serves.` : `${r.refused}. This engine is not shown as up until it beats under a name of its own.`);
     };
+    const credential = engineCredential(o);
     const body = () => {
       const m = deps.machine;
-      return beatBody(deps.readState(), { name: flags.name, runner: deps.runner.name }, {}, {
+      return beatBody(deps.readState(), { name: flags.name, runner: deps.runner.name }, credential ? { credential } : {}, {
         atOnce: deps.atOnce,
         ...m?.last ? { machine: m.last } : {},
         ...m?.hold && !m.off ? { hold: m.hold } : {}
@@ -21556,7 +21654,7 @@ import {
   writeFileSync as writeFileSync21
 } from "node:fs";
 import { hostname as hostname5 } from "node:os";
-import { basename as basename7, dirname as dirname19, isAbsolute as isAbsolute6, join as join27 } from "node:path";
+import { basename as basename7, dirname as dirname19, isAbsolute as isAbsolute6, join as join28 } from "node:path";
 init_state();
 var ENGINE_LABEL2 = "ai.sleds.engine";
 var ENGINE_INSTALL_USAGE2 = `usage: sleds engine install [engine flags]   |   sleds engine uninstall [--name <n>] [--org <slug>]
@@ -21577,13 +21675,13 @@ function engineLabel2(name, org, seat) {
   return [ENGINE_LABEL2, org, seat?.trim(), name].filter((p) => Boolean(p)).map((p, i) => i === 0 ? p : engineSlug(p)).join(".");
 }
 function enginePlistPath2(home, name, org, seat) {
-  return join27(home, "Library", "LaunchAgents", `${engineLabel2(name, org, seat)}.plist`);
+  return join28(home, "Library", "LaunchAgents", `${engineLabel2(name, org, seat)}.plist`);
 }
 function engineLogPath2(stateDir, name) {
-  return join27(stateDir, `${engineSlug(name)}.log`);
+  return join28(stateDir, `${engineSlug(name)}.log`);
 }
 function engineEventsPath2(stateDir, name) {
-  return join27(stateDir, `${engineSlug(name)}.events.jsonl`);
+  return join28(stateDir, `${engineSlug(name)}.events.jsonl`);
 }
 var xmlEscape5 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 function buildEnginePlist2(o) {
@@ -21680,7 +21778,7 @@ function readEngines2(dir, suffix, manager, parse) {
   }
   const out = [];
   for (const name of names.filter((n) => n.startsWith(`${ENGINE_LABEL2}.`) && n.endsWith(suffix))) {
-    const path = join27(dir, name);
+    const path = join28(dir, name);
     let parsed;
     try {
       parsed = parse(readFileSync21(path, "utf8"), name);
@@ -21700,7 +21798,7 @@ function readEngines2(dir, suffix, manager, parse) {
 }
 function installedEngines2(home) {
   return [
-    ...readEngines2(join27(home, "Library", "LaunchAgents"), ".plist", "launchd", parseEnginePlist2),
+    ...readEngines2(join28(home, "Library", "LaunchAgents"), ".plist", "launchd", parseEnginePlist2),
     ...readEngines2(engineUnitDir(home), ".service", "systemd", (text, file) => {
       const parsed = parseEngineUnit(text);
       return parsed && { label: basename7(file, ".service"), ...parsed };
@@ -21738,7 +21836,7 @@ async function ensureReposDir(o) {
     return false;
   }
   const exists = o.exists ?? existsSync22;
-  const missing = dirs.filter((d) => !exists(/^~(\/|$)/.test(d) ? join27(o.home, d.slice(1)) : d));
+  const missing = dirs.filter((d) => !exists(/^~(\/|$)/.test(d) ? join28(o.home, d.slice(1)) : d));
   if (missing.length) {
     error(`Not a folder on this machine: ${missing.join(", ")}. ${REPOS_DIR_NEEDED}`);
     return false;
@@ -22861,9 +22959,9 @@ init_meter();
 // src/owed.ts
 init_config();
 import { existsSync as existsSync26, mkdirSync as mkdirSync23, readFileSync as readFileSync25, renameSync as renameSync11, writeFileSync as writeFileSync22 } from "node:fs";
-import { dirname as dirname20, join as join28 } from "node:path";
-var owedPath = (home) => join28(configDir(home), "owed.json");
-var sessionPath = (home) => join28(configDir(home), "session.json");
+import { dirname as dirname20, join as join29 } from "node:path";
+var owedPath = (home) => join29(configDir(home), "owed.json");
+var sessionPath = (home) => join29(configDir(home), "session.json");
 var OWED_TTL_MS = 3 * 24 * 60 * 60000;
 var str14 = (v) => typeof v === "string" ? v : undefined;
 function sourceKey(s) {
@@ -23021,7 +23119,7 @@ function contextFor(deps) {
     ...src,
     fetchFn: deps.fetchFn,
     timeoutMs: deps.timeoutMs,
-    version: "0.1.49"
+    version: "0.1.50"
   }), deps.home, now) : null;
   return {
     channel: "code",
@@ -24588,7 +24686,7 @@ var orgCmd = (o) => {
 init_src();
 import { spawnSync as spawnSync8 } from "node:child_process";
 import { writeFileSync as writeFileSync25 } from "node:fs";
-import { join as join29 } from "node:path";
+import { join as join30 } from "node:path";
 function packFileName(key) {
   return `pack-${slugify(key, 80) || "item"}.md`;
 }
@@ -24616,7 +24714,7 @@ var packCmd = async (o) => {
     log(r.text);
     return 0;
   }
-  const path = join29(o.cwd ?? process.cwd(), packFileName(key));
+  const path = join30(o.cwd ?? process.cwd(), packFileName(key));
   (o.write ?? ((p, t) => writeFileSync25(p, t.endsWith(`
 `) ? t : `${t}
 `)))(path, r.text);
@@ -25764,12 +25862,12 @@ async function seatRevokeCmd(o) {
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync30, mkdirSync as mkdirSync27, readFileSync as readFileSync30, readdirSync as readdirSync7, rmSync as rmSync21, writeFileSync as writeFileSync27 } from "node:fs";
 import { platform as platform2 } from "node:os";
-import { dirname as dirname23, join as join31 } from "node:path";
+import { dirname as dirname23, join as join32 } from "node:path";
 
 // src/cookieDb.ts
 import { copyFileSync as copyFileSync3, rmSync as rmSync20 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 var QUERY = "SELECT name, hex(encrypted_value) AS ev FROM cookies WHERE host_key LIKE '%claude.ai%'";
 var isBun = () => typeof globalThis.Bun !== "undefined";
 async function queryRows(dbPath) {
@@ -25798,7 +25896,7 @@ function nodeSqlite() {
   return mod;
 }
 async function readCookieRows(dbPath) {
-  const copy = join30(tmpdir2(), `sleds-cookies-${process.pid}-${Date.now()}.sqlite`);
+  const copy = join31(tmpdir2(), `sleds-cookies-${process.pid}-${Date.now()}.sqlite`);
   copyFileSync3(dbPath, copy);
   try {
     const rows = await queryRows(copy);
@@ -26091,7 +26189,7 @@ function findFile(root, name) {
       continue;
     }
     for (const e of entries) {
-      const p = join31(dir, e.name);
+      const p = join32(dir, e.name);
       if (e.isDirectory())
         stack.push(p);
       else if (e.name === name)
@@ -26102,7 +26200,7 @@ function findFile(root, name) {
 }
 function findCookieDb(home, source) {
   const b = BROWSERS[source.browser];
-  const root = join31(home, APP_SUPPORT, b.appDir);
+  const root = join32(home, APP_SUPPORT, b.appDir);
   if (!existsSync30(root))
     throw new Error(`no ${source.browser} data at ${root} (is it installed?)`);
   if (!b.profiled) {
@@ -26111,7 +26209,7 @@ function findCookieDb(home, source) {
       throw new Error(`no cookie store under ${root}`);
     return db;
   }
-  const localStatePath = join31(root, "Local State");
+  const localStatePath = join32(root, "Local State");
   const localState = existsSync30(localStatePath) ? readFileSync30(localStatePath, "utf8") : null;
   const wanted = source.profile ?? "Default";
   const { dir, ambiguous } = resolveProfileDir(localState, wanted);
@@ -26119,7 +26217,7 @@ function findCookieDb(home, source) {
     throw new Error(`"${wanted}" names ${ambiguous.length} ${source.browser} profiles (${ambiguous.join(", ")}) — pass the directory or the account email instead`);
   if (!dir)
     throw new Error(`no ${source.browser} profile named "${wanted}" (check chrome://version)`);
-  const db = cookieDbCandidates(join31(root, dir)).find((p) => existsSync30(p));
+  const db = cookieDbCandidates(join32(root, dir)).find((p) => existsSync30(p));
   if (!db)
     throw new Error(`profile "${dir}" has no cookie store yet (open claude.ai in it once)`);
   return db;
@@ -26163,7 +26261,7 @@ function fetchSeatUsage(jar, org, now, run) {
 }
 function launchAgentPlist(argv, home, source) {
   const label = launchLabel(source);
-  const log = join31(home, ".config", "sleds", `${label.slice("ai.sleds.".length)}.log`);
+  const log = join32(home, ".config", "sleds", `${label.slice("ai.sleds.".length)}.log`);
   const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
   const args = [...argv, "seat-sync", ...sourceArgs(source)].map((a) => `    <string>${esc(a)}</string>`).join(`
 `);
@@ -26185,14 +26283,14 @@ ${args}
 `;
 }
 function plistPath2(home, source) {
-  return join31(home, "Library", "LaunchAgents", `${launchLabel(source)}.plist`);
+  return join32(home, "Library", "LaunchAgents", `${launchLabel(source)}.plist`);
 }
 function install(home, argv, source, log, launchctl) {
   if (!argv[0]) {
     log("cannot resolve the sleds command to install the timer");
     return 1;
   }
-  const dir = join31(home, "Library", "LaunchAgents");
+  const dir = join32(home, "Library", "LaunchAgents");
   mkdirSync27(dir, { recursive: true });
   const path = plistPath2(home, source);
   const tokenPath = seatTokenPath(home, source);
@@ -27041,7 +27139,7 @@ var hasEitherKey = (settings) => {
 // src/commands/update.ts
 init_server();
 import { existsSync as existsSync34 } from "node:fs";
-import { homedir as homedir7, userInfo as userInfo4 } from "node:os";
+import { homedir as homedir8, userInfo as userInfo4 } from "node:os";
 import { basename as basename9 } from "node:path";
 init_config();
 init_state();
@@ -27107,7 +27205,7 @@ var realPidAlive4 = (pid) => {
 };
 function machineClient(home, env) {
   const src = meterSource(home, undefined, { env });
-  return src ? fetchClient({ ...src, version: "0.1.49" }) : null;
+  return src ? fetchClient({ ...src, version: "0.1.50" }) : null;
 }
 async function noteAnswer2(home, a, now) {
   try {
@@ -27129,7 +27227,7 @@ function busyLine(busy) {
   return `${n} session${n === 1 ? " is" : "s are"} running on ${on} — sleds update --now releases ${n === 1 ? "it" : "them"}`;
 }
 async function updateCmd(o) {
-  const home = o.home ?? homedir7();
+  const home = o.home ?? homedir8();
   const env = o.env ?? process.env;
   const log = o.log ?? console.log;
   const error = o.error ?? console.error;
@@ -27433,12 +27531,12 @@ var webhooksCmd = async (o) => {
 // src/config.ts
 init_settings();
 import { chmodSync as chmodSync8, existsSync as existsSync35, mkdirSync as mkdirSync28, readFileSync as readFileSync33, renameSync as renameSync13, writeFileSync as writeFileSync28 } from "node:fs";
-import { join as join32, resolve as resolve11 } from "node:path";
+import { join as join33, resolve as resolve11 } from "node:path";
 var configDir2 = (home, env = process.env) => {
   const o = env.SLEDS_HOME?.trim();
-  return o ? resolve11(home, o) : join32(home, ".config", "sleds");
+  return o ? resolve11(home, o) : join33(home, ".config", "sleds");
 };
-var configPath2 = (home) => join32(configDir2(home), "config.json");
+var configPath2 = (home) => join33(configDir2(home), "config.json");
 var isObject17 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 var optString2 = (v) => typeof v === "string" ? v : undefined;
 var parsePriorEnv2 = (v) => {
@@ -27615,10 +27713,10 @@ function runnerFor3(name, exec = defaultExec, o = {}) {
 }
 
 // src/runtime.ts
-import { homedir as homedir8 } from "node:os";
-import { join as join33, win32 as win323 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { join as join34, win32 as win323 } from "node:path";
 var isCompiled2 = (argv1 = process.argv[1]) => Boolean(argv1 && (argv1.startsWith("/$bunfs/") || argv1.startsWith("B:\\~BUN\\")));
-var sledsLink2 = (home = homedir8(), platform = process.platform) => platform === "win32" ? win323.join(process.env.LOCALAPPDATA ?? win323.join(home, "AppData", "Local"), "sleds", "bin", "sleds.exe") : join33(home, ".sleds", "bin", "sleds");
+var sledsLink2 = (home = homedir9(), platform = process.platform) => platform === "win32" ? win323.join(process.env.LOCALAPPDATA ?? win323.join(home, "AppData", "Local"), "sleds", "bin", "sleds.exe") : join34(home, ".sleds", "bin", "sleds");
 
 // src/schedule.ts
 import { spawnSync as spawnSync11 } from "node:child_process";
@@ -27630,7 +27728,7 @@ var defaultExec5 = (cmd, args) => {
 };
 
 // src/settings.ts
-import { dirname as dirname24, join as join34, resolve as resolve12 } from "node:path";
+import { dirname as dirname24, join as join35, resolve as resolve12 } from "node:path";
 var withSeatEnv2 = (command, home, env = process.env, org) => {
   const parts = [];
   const sh = env.SLEDS_HOME?.trim();
@@ -27927,12 +28025,12 @@ var sledsArgv = (execPath = process.execPath, script = process.argv[1], realpath
   return stableArgv2(script ? [execPath, script] : [execPath], realpath, o.home);
 };
 var shellQuote = (s) => /^[\w./-]+$/.test(s) ? s : `'${s.replace(/'/g, "'\\''")}'`;
-var statusLineCommand = (argv, home = homedir9()) => withSeatEnv2([...argv, "statusline"].map(shellQuote).join(" "), home);
-var seatEventCommand = (argv, home = homedir9()) => withSeatEnv2([...argv, "seat-event"].map(shellQuote).join(" "), home);
-var promptEventCommand = (argv, home = homedir9()) => withSeatEnv2([...argv, "prompt-event"].map(shellQuote).join(" "), home);
-var sessionEventCommand = (argv, home = homedir9()) => withSeatEnv2([...argv, "session-event"].map(shellQuote).join(" "), home);
-var stopEventCommand = (argv, home = homedir9()) => withSeatEnv2([...argv, "stop-event"].map(shellQuote).join(" "), home);
-var specEventCommand = (argv, home = homedir9()) => withSeatEnv2([...argv, "spec-event"].map(shellQuote).join(" "), home);
+var statusLineCommand = (argv, home = homedir10()) => withSeatEnv2([...argv, "statusline"].map(shellQuote).join(" "), home);
+var seatEventCommand = (argv, home = homedir10()) => withSeatEnv2([...argv, "seat-event"].map(shellQuote).join(" "), home);
+var promptEventCommand = (argv, home = homedir10()) => withSeatEnv2([...argv, "prompt-event"].map(shellQuote).join(" "), home);
+var sessionEventCommand = (argv, home = homedir10()) => withSeatEnv2([...argv, "session-event"].map(shellQuote).join(" "), home);
+var stopEventCommand = (argv, home = homedir10()) => withSeatEnv2([...argv, "stop-event"].map(shellQuote).join(" "), home);
+var specEventCommand = (argv, home = homedir10()) => withSeatEnv2([...argv, "spec-event"].map(shellQuote).join(" "), home);
 var mcpFlag = (flags) => flags["no-mcp"] === true ? false : flags.mcp === true ? true : undefined;
 var main = async (argv) => {
   const { cmd, flags } = parseArgs(argv);
@@ -27940,7 +28038,7 @@ var main = async (argv) => {
     console.log(commandUsage(cmd));
     return 0;
   }
-  const home = homedir9();
+  const home = homedir10();
   const scheduler = {
     platform: platform3(),
     home,
@@ -27952,7 +28050,7 @@ var main = async (argv) => {
     now: Date.now(),
     stderr: (line) => console.error(line),
     isTTY: !!process.stderr.isTTY,
-    version: "0.1.49"
+    version: "0.1.50"
   });
   switch (cmd) {
     case "update":
@@ -28185,7 +28283,7 @@ ${renderHelpText(argv[1])}`);
     case "version":
     case "--version":
     case "-v":
-      console.log("sleds 0.1.49");
+      console.log("sleds 0.1.50");
       return 0;
     default:
       console.error(`unknown command: ${cmd}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleds/cli",
-  "version": "0.1.49",
+  "version": "0.1.50",
   "description": "SLEDS CLI — the cost and limits of AI agent work, decided at the wall. Point Claude Code at a SLEDS proxy; estimate before you run; hold, switch model, or run overnight when you hit a limit.",
   "license": "UNLICENSED",
   "type": "module",