@slock-ai/computer 0.0.1-play.20260521182209 → 0.0.1

package/dist/index.js

@@ -24,7 +24,7 @@ var DeviceAuthClient = class {
     });
     if (res.status === 404) {
       throw new Error(
-        "device login is not enabled on this server (ask an admin to set SLOCK_DEVICE_LOGIN_ENABLED, or upgrade the server)"
+        "device login is not enabled on this server (ask an admin to unset SLOCK_DEVICE_LOGIN_ENABLED or set it back to a non-false value; this surface is on by default since PR-G \u2014 upgrade the server if you are on an older build)"
       );
     }
     if (res.status !== 201) {
@@ -67,14 +67,14 @@ var ComputerAttachClient = class {
     return new URL(p, this.baseUrl).toString();
   }
   /** POST /api/computer/attach — user-authed; issues sk_computer_*. */
-  async attach(serverId, name) {
+  async attach(serverSlug, name) {
     const res = await fetch2(this.url("/api/computer/attach"), {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         Authorization: `Bearer ${this.accessToken}`
       },
-      body: JSON.stringify({ serverId, name })
+      body: JSON.stringify({ serverSlug, name })
     });
     const body = await res.json().catch(() => null);
     if (res.status === 201 && body && typeof body.apiKey === "string") {
@@ -82,7 +82,8 @@ var ComputerAttachClient = class {
         status: "success",
         apiKey: body.apiKey,
         serverMachineId: String(body.serverMachineId ?? ""),
-        serverId: String(body.serverId ?? serverId),
+        serverId: String(body.serverId ?? ""),
+        serverSlug: String(body.serverSlug ?? serverSlug),
         resumed: body.resumed === true
       };
     }
@@ -92,6 +93,45 @@ var ComputerAttachClient = class {
     const code = body && typeof body.code === "string" ? body.code : `http_${res.status}`;
     return { status: "error", code };
   }
+  /**
+   * POST /api/computer/adopt-legacy — task #39 PR-J1 (RFC v8.2 §5.11).
+   * User-authed; the legacy `sk_machine_*` key is the proof of authority
+   * over the machine. On success the server marks the machine row migrated
+   * and mints a fresh `sk_computer_*`. The raw legacy key MUST NOT be
+   * persisted by the caller — only the freshly-minted sk_computer_* lands
+   * in attachment.json.
+   */
+  async adoptLegacy(legacyApiKey, name) {
+    const res = await fetch2(this.url("/api/computer/adopt-legacy"), {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${this.accessToken}`
+      },
+      body: JSON.stringify({ legacyApiKey, ...name ? { name } : {} })
+    });
+    const body = await res.json().catch(() => null);
+    if (res.status === 201 && body && typeof body.apiKey === "string") {
+      return {
+        status: "success",
+        apiKey: body.apiKey,
+        computerId: String(body.computerId ?? ""),
+        machineId: String(body.machineId ?? ""),
+        serverId: String(body.serverId ?? ""),
+        resumed: body.resumed === true
+      };
+    }
+    const code = body && typeof body.code === "string" ? body.code : `http_${res.status}`;
+    if (res.status === 401 && code === "legacy_key_invalid") {
+      return { status: "legacy_key_invalid" };
+    }
+    if (res.status === 409 && code === "legacy_machine_key_migrated") {
+      return { status: "legacy_machine_key_migrated" };
+    }
+    if (res.status === 403) return { status: "not_authorized" };
+    if (res.status === 404) return { status: "disabled" };
+    return { status: "error", code };
+  }
   /**
    * POST /internal/computer/preflight — §9 READ-ONLY, side-effect-free.
    * Authenticated with the freshly-issued sk_computer_* (NOT the user
@@ -108,7 +148,12 @@ var ComputerAttachClient = class {
       body: "{}"
     });
     const body = await res.json().catch(() => null);
-    if (res.status === 200 && body && body.ok === true) return { ok: true };
+    if (res.status === 200 && body && body.ok === true) {
+      return {
+        ok: true,
+        serverSlug: typeof body.serverSlug === "string" && body.serverSlug.length > 0 ? body.serverSlug : void 0
+      };
+    }
     const code = body && typeof body.code === "string" ? body.code : `http_${res.status}`;
     return { ok: false, code };
   }
@@ -154,6 +199,7 @@ var RunnersClient = class {
 };
 
 // src/paths.ts
+import { createHash } from "crypto";
 import os from "os";
 import path from "path";
 function resolveSlockHome(env = process.env, homeDir = os.homedir()) {
@@ -212,6 +258,32 @@ function supervisorLogPath(slockHome) {
 function supervisorVersionPath(slockHome) {
   return path.join(computerDir(slockHome), "supervisor-version.json");
 }
+var HOSTNAME_SUFFIXES = [
+  ".fritz.box",
+  ".localdomain",
+  ".local",
+  ".lan",
+  ".home"
+];
+function shortHostnameHash(hostname) {
+  return createHash("sha256").update(hostname).digest("hex").slice(0, 8);
+}
+function deriveDefaultComputerName(hostname = os.hostname()) {
+  const original = hostname.trim();
+  let name = original;
+  let lower = name.toLowerCase();
+  for (; ; ) {
+    const suffix = HOSTNAME_SUFFIXES.find((candidate) => lower.endsWith(candidate));
+    if (!suffix) break;
+    name = name.slice(0, -suffix.length);
+    lower = name.toLowerCase();
+  }
+  name = name.replace(/[\s'"]+/g, "-").replace(/-+$/g, "");
+  return name.length > 0 ? name : `slock-computer-${shortHostnameHash(original)}`;
+}
+function adoptionLogPath(slockHome) {
+  return path.join(computerDir(slockHome), "adoption.log");
+}
 function channelPath(slockHome) {
   return path.join(computerDir(slockHome), "channel");
 }
@@ -248,7 +320,8 @@ async function runLogin(opts) {
   } catch (err) {
     fail("DEVICE_AUTHORIZE_FAILED", err instanceof Error ? err.message : String(err));
   }
-  const verifyUrl = new URL(grant.verificationUri, baseUrl).toString();
+  const verificationUri = grant.verificationUriComplete || grant.verificationUri;
+  const verifyUrl = new URL(verificationUri, baseUrl).toString();
   info(`To finish login, open: ${verifyUrl}`);
   info(`and enter the code:   ${grant.userCode}`);
   info(`Waiting for approval (expires in ${grant.expiresIn}s)\u2026`);
@@ -274,21 +347,129 @@ async function runLogin(opts) {
       { mode: 384 }
     );
     info(`Logged in. User session written to ${file}`);
-    info(`Next: run \`slock-computer attach <serverId>\` to attach this machine.`);
+    info(`Next: run \`slock-computer attach <serverSlug>\` to attach this machine.`);
     return;
   }
   fail("LOGIN_EXPIRED", "Login request expired before approval. Re-run `slock-computer login`.");
 }
 
 // src/attach.ts
-import { chmod, mkdir as mkdir2, readFile, writeFile as writeFile2 } from "fs/promises";
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile2, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3 } from "path";
+
+// src/serverState.ts
+import { readFile, readdir, writeFile as writeFile2, mkdir as mkdir2, unlink, access, chmod } from "fs/promises";
 import { dirname as dirname2 } from "path";
+import { constants as fsConstants } from "fs";
+function parseAttachment(raw) {
+  try {
+    const a = JSON.parse(raw);
+    if (a.kind === "computer-attachment" && typeof a.serverId === "string" && typeof a.serverMachineId === "string" && typeof a.apiKey === "string" && a.apiKey.length > 0 && typeof a.serverUrl === "string") {
+      return {
+        kind: "computer-attachment",
+        serverId: a.serverId,
+        serverSlug: typeof a.serverSlug === "string" && a.serverSlug.length > 0 ? a.serverSlug : void 0,
+        serverMachineId: a.serverMachineId,
+        apiKey: a.apiKey,
+        serverUrl: a.serverUrl,
+        attachedAt: typeof a.attachedAt === "string" ? a.attachedAt : void 0
+      };
+    }
+  } catch {
+  }
+  return null;
+}
+async function readServerAttachment(slockHome, serverId) {
+  if (!isValidServerId(serverId)) return null;
+  try {
+    return parseAttachment(await readFile(serverAttachmentPath(slockHome, serverId), "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function writeServerAttachment(slockHome, attachment) {
+  if (!isValidServerId(attachment.serverId)) return;
+  const path2 = serverAttachmentPath(slockHome, attachment.serverId);
+  await mkdir2(dirname2(path2), { recursive: true });
+  await writeFile2(path2, JSON.stringify(attachment, null, 2), { mode: 384 });
+  await chmod(path2, 384);
+}
+async function listAttachedServerIds(slockHome) {
+  let entries;
+  try {
+    entries = await readdir(serversDir(slockHome));
+  } catch {
+    return [];
+  }
+  const ids = [];
+  for (const name of entries) {
+    if (!isValidServerId(name)) continue;
+    if (await readServerAttachment(slockHome, name)) ids.push(name);
+  }
+  return ids.sort();
+}
+async function listServerAttachments(slockHome) {
+  const ids = await listAttachedServerIds(slockHome);
+  const out = [];
+  for (const id of ids) {
+    const a = await readServerAttachment(slockHome, id);
+    if (a) out.push(a);
+  }
+  return out;
+}
+function normalizeServerSlug(input) {
+  const trimmed = input.trim();
+  if (!trimmed) return "";
+  return trimmed.startsWith("/") ? trimmed.slice(1) : trimmed;
+}
+function formatServerSlugDisplay(slug) {
+  if (!slug) return "(unknown slug; re-run attach or doctor)";
+  return slug.startsWith("/") ? slug : `/${slug}`;
+}
+async function resolveAttachedServerSlug(slockHome, serverSlug) {
+  const requested = normalizeServerSlug(serverSlug);
+  if (!requested) return null;
+  const attachments = await listServerAttachments(slockHome);
+  return attachments.find((a) => a.serverSlug === requested) ?? null;
+}
+async function setServerManaged(slockHome, serverId) {
+  if (!isValidServerId(serverId)) return;
+  const flagPath = serverManagedFlagPath(slockHome, serverId);
+  await mkdir2(dirname2(flagPath), { recursive: true });
+  await writeFile2(flagPath, "", { mode: 384 });
+}
+async function clearServerManaged(slockHome, serverId) {
+  if (!isValidServerId(serverId)) return;
+  try {
+    await unlink(serverManagedFlagPath(slockHome, serverId));
+  } catch {
+  }
+}
+async function isServerManaged(slockHome, serverId) {
+  if (!isValidServerId(serverId)) return false;
+  try {
+    await access(serverManagedFlagPath(slockHome, serverId), fsConstants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function listManagedServerIds(slockHome) {
+  const attached = await listAttachedServerIds(slockHome);
+  const out = [];
+  for (const id of attached) {
+    if (await isServerManaged(slockHome, id)) out.push(id);
+  }
+  return out;
+}
+
+// src/attach.ts
 async function runAttach(opts) {
   const slockHome = resolveSlockHome();
   const sessionFile = userSessionPath(slockHome);
   let session;
   try {
-    session = JSON.parse(await readFile(sessionFile, "utf8"));
+    session = JSON.parse(await readFile2(sessionFile, "utf8"));
   } catch {
     fail(
       "NO_USER_SESSION",
@@ -306,18 +487,23 @@ async function runAttach(opts) {
     fail("MISSING_SERVER_URL", "Set SLOCK_SERVER_URL or pass --server-url <url>.");
   }
   const client = new ComputerAttachClient(baseUrl, session.accessToken);
-  info(`Attaching this machine to server ${opts.serverId}\u2026`);
-  const attached = await client.attach(opts.serverId, "slock-computer");
+  const slugForServer = normalizeServerSlug(opts.serverSlug);
+  if (!slugForServer) {
+    fail("ATTACH_NOT_AUTHORIZED", "Server slug must not be empty.");
+  }
+  const computerName = opts.name?.trim() || deriveDefaultComputerName();
+  info(`Attaching this machine to server ${formatServerSlugDisplay(slugForServer)}\u2026`);
+  const attached = await client.attach(slugForServer, computerName);
   if (attached.status === "disabled") {
     fail(
       "ATTACH_DISABLED",
-      "Computer attach is not enabled on this server (ask an admin to set SLOCK_DEVICE_LOGIN_ENABLED, or upgrade the server)."
+      "Computer attach is not enabled on this server (ask an admin to unset SLOCK_DEVICE_LOGIN_ENABLED or set it back to a non-false value; this surface is on by default since PR-G \u2014 upgrade the server if you are on an older build)."
     );
   }
   if (attached.status === "not_authorized") {
     fail(
       "ATTACH_NOT_AUTHORIZED",
-      "Not authorized to attach to that server. Check the server id and that you're a member."
+      "Not authorized to attach to that server. Check the server slug and that you're a member."
     );
   }
   if (attached.status === "error") {
@@ -327,6 +513,12 @@ async function runAttach(opts) {
         "Your user session is no longer valid. Re-run `slock-computer login`."
       );
     }
+    if (attached.code === "COMPUTER_NAME_COLLISION") {
+      fail(
+        "COMPUTER_NAME_COLLISION",
+        `A Computer named ${JSON.stringify(computerName)} already exists on that server. Re-run with --name <name>.`
+      );
+    }
     fail("ATTACH_FAILED", `Attach failed (${attached.code}). Re-run after checking --server-url / server version.`);
   }
   info(attached.resumed ? "Resumed existing attachment; running preflight\u2026" : "Attachment issued; running preflight\u2026");
@@ -338,13 +530,14 @@ async function runAttach(opts) {
     );
   }
   const file = serverAttachmentPath(slockHome, attached.serverId);
-  await mkdir2(dirname2(file), { recursive: true });
-  await writeFile2(
+  await mkdir3(dirname3(file), { recursive: true });
+  await writeFile3(
     file,
     JSON.stringify(
       {
         kind: "computer-attachment",
         serverId: attached.serverId,
+        serverSlug: attached.serverSlug,
         serverMachineId: attached.serverMachineId,
         apiKey: attached.apiKey,
         serverUrl: baseUrl,
@@ -355,9 +548,9 @@ async function runAttach(opts) {
     ),
     { mode: 384 }
   );
-  await chmod(file, 384);
+  await chmod2(file, 384);
   info(`Attached. Computer state written to ${file}`);
-  info(`  server:        ${attached.serverId}`);
+  info(`  server:        ${formatServerSlugDisplay(attached.serverSlug)}`);
   info(`  serverMachine: ${attached.serverMachineId}`);
   if (opts.run === false) {
     info("Next: run `slock-computer start` to run it in the background.");
@@ -366,102 +559,357 @@ async function runAttach(opts) {
   }
 }
 
-// src/status.ts
-import { readFile as readFile5 } from "fs/promises";
-
-// src/serverState.ts
-import { readFile as readFile2, readdir, writeFile as writeFile3, mkdir as mkdir3, unlink, access } from "fs/promises";
-import { dirname as dirname3 } from "path";
-import { constants as fsConstants } from "fs";
-function parseAttachment(raw) {
-  try {
-    const a = JSON.parse(raw);
-    if (a.kind === "computer-attachment" && typeof a.serverId === "string" && typeof a.serverMachineId === "string" && typeof a.apiKey === "string" && a.apiKey.length > 0 && typeof a.serverUrl === "string") {
-      return {
-        kind: "computer-attachment",
-        serverId: a.serverId,
-        serverMachineId: a.serverMachineId,
-        apiKey: a.apiKey,
-        serverUrl: a.serverUrl,
-        attachedAt: typeof a.attachedAt === "string" ? a.attachedAt : void 0
-      };
-    }
-  } catch {
+// src/adopt.ts
+import { chmod as chmod3, mkdir as mkdir4, readFile as readFile3, writeFile as writeFile4, appendFile, stat } from "fs/promises";
+import { createHash as createHash2 } from "crypto";
+import { dirname as dirname4, join } from "path";
+import { setTimeout as delay } from "timers/promises";
+async function resolveLegacyKey(inputs, env) {
+  const sources = [];
+  if (typeof inputs.legacyApiKey === "string" && inputs.legacyApiKey.length > 0) {
+    sources.push({
+      mode: "legacy_key_argv",
+      load: async () => inputs.legacyApiKey.trim()
+    });
   }
-  return null;
+  if (typeof inputs.legacyApiKeyFile === "string" && inputs.legacyApiKeyFile.length > 0) {
+    sources.push({
+      mode: "legacy_key_file",
+      load: async () => {
+        const contents = await readFile3(inputs.legacyApiKeyFile, "utf8");
+        return contents.trim();
+      }
+    });
+  }
+  if (inputs.legacyApiKeyStdin) {
+    sources.push({
+      mode: "legacy_key_stdin",
+      load: async () => readAllStdin()
+    });
+  }
+  const envKey = env.SLOCK_LEGACY_API_KEY;
+  if (typeof envKey === "string" && envKey.trim().length > 0) {
+    sources.push({
+      mode: "legacy_key_env",
+      load: async () => envKey.trim()
+    });
+  }
+  if (sources.length === 0) {
+    fail(
+      "LEGACY_KEY_REQUIRED",
+      "No legacy api key provided. Pass exactly one of: --legacy-api-key <key>, --legacy-api-key-file <path>, --legacy-api-key-stdin, or SLOCK_LEGACY_API_KEY."
+    );
+  }
+  if (sources.length > 1) {
+    const modes = sources.map((s) => s.mode).join(", ");
+    fail(
+      "LEGACY_KEY_MULTIPLE_SOURCES",
+      `Multiple legacy api key sources provided (${modes}). Choose exactly one.`
+    );
+  }
+  const chosen = sources[0];
+  const rawKey = await chosen.load();
+  if (chosen.mode === "legacy_key_env") {
+    delete env.SLOCK_LEGACY_API_KEY;
+  }
+  if (!rawKey.startsWith("sk_machine_") && !rawKey.startsWith("sk_daemon_")) {
+    fail(
+      "LEGACY_KEY_INVALID",
+      "Provided key does not look like a legacy machine key (expected `sk_machine_*` or `sk_daemon_*`)."
+    );
+  }
+  return {
+    rawKey,
+    mode: chosen.mode,
+    redactedPrefix: rawKey.slice(0, 8)
+  };
 }
-async function readServerAttachment(slockHome, serverId) {
-  if (!isValidServerId(serverId)) return null;
+async function readAllStdin() {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    process.stdin.on("data", (chunk) => chunks.push(chunk));
+    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8").trim()));
+    process.stdin.on("error", reject);
+  });
+}
+var LEGACY_STOP_WAIT_MS = 1e4;
+var LEGACY_STOP_POLL_MS = 200;
+function legacyLockOwnerPath(slockHome, rawKey) {
+  const fingerprint = createHash2("sha256").update(rawKey).digest("hex").slice(0, 16);
+  return join(slockHome, "machines", `machine-${fingerprint}`, "daemon.lock", "owner.json");
+}
+function isProcessAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
-    return parseAttachment(await readFile2(serverAttachmentPath(slockHome, serverId), "utf8"));
-  } catch {
-    return null;
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = typeof err === "object" && err && "code" in err ? err.code : void 0;
+    return code !== "ESRCH";
   }
 }
-async function listAttachedServerIds(slockHome) {
-  let entries;
+async function stopLegacyDaemonByOwnerFile(ownerFile) {
+  let raw;
   try {
-    entries = await readdir(serversDir(slockHome));
+    raw = await readFile3(ownerFile, "utf8");
   } catch {
-    return [];
+    return { attempted: false, outcome: "absent" };
   }
-  const ids = [];
-  for (const name of entries) {
-    if (!isValidServerId(name)) continue;
-    if (await readServerAttachment(slockHome, name)) ids.push(name);
+  let pid;
+  try {
+    const owner = JSON.parse(raw);
+    if (typeof owner.pid !== "number") {
+      return { attempted: false, outcome: "error", reason: "owner_json_missing_pid" };
+    }
+    pid = owner.pid;
+  } catch {
+    return { attempted: false, outcome: "error", reason: "owner_json_unparseable" };
   }
-  return ids.sort();
-}
-async function listServerAttachments(slockHome) {
-  const ids = await listAttachedServerIds(slockHome);
-  const out = [];
-  for (const id of ids) {
-    const a = await readServerAttachment(slockHome, id);
-    if (a) out.push(a);
+  if (!isProcessAlive(pid)) {
+    return { attempted: false, pid, outcome: "already_dead" };
   }
-  return out;
-}
-async function setServerManaged(slockHome, serverId) {
-  if (!isValidServerId(serverId)) return;
-  const flagPath = serverManagedFlagPath(slockHome, serverId);
-  await mkdir3(dirname3(flagPath), { recursive: true });
-  await writeFile3(flagPath, "", { mode: 384 });
-}
-async function clearServerManaged(slockHome, serverId) {
-  if (!isValidServerId(serverId)) return;
   try {
-    await unlink(serverManagedFlagPath(slockHome, serverId));
-  } catch {
+    process.kill(pid, "SIGTERM");
+  } catch (err) {
+    const code = typeof err === "object" && err && "code" in err ? err.code : void 0;
+    if (code === "EPERM") return { attempted: true, pid, outcome: "denied", reason: "eperm" };
+    return { attempted: true, pid, outcome: "error", reason: code ?? "signal_failed" };
+  }
+  const deadline = Date.now() + LEGACY_STOP_WAIT_MS;
+  while (Date.now() < deadline) {
+    if (!isProcessAlive(pid)) return { attempted: true, pid, outcome: "stopped" };
+    await delay(LEGACY_STOP_POLL_MS);
   }
+  return { attempted: true, pid, outcome: "timed_out" };
 }
-async function isServerManaged(slockHome, serverId) {
-  if (!isValidServerId(serverId)) return false;
+async function runAdoptLegacy(inputs) {
+  const slockHome = resolveSlockHome();
+  const sessionFile = userSessionPath(slockHome);
+  let session;
   try {
-    await access(serverManagedFlagPath(slockHome, serverId), fsConstants.F_OK);
-    return true;
+    session = JSON.parse(await readFile3(sessionFile, "utf8"));
   } catch {
-    return false;
+    fail(
+      "NO_USER_SESSION",
+      `No user session at ${sessionFile}. Run \`slock-computer login\` first.`
+    );
   }
-}
-async function listManagedServerIds(slockHome) {
-  const attached = await listAttachedServerIds(slockHome);
-  const out = [];
-  for (const id of attached) {
-    if (await isServerManaged(slockHome, id)) out.push(id);
+  if (session.kind !== "user-session" || typeof session.accessToken !== "string" || !session.accessToken) {
+    fail(
+      "INVALID_USER_SESSION",
+      `User session at ${sessionFile} is invalid. Re-run \`slock-computer login\`.`
+    );
+  }
+  const baseUrl = (inputs.serverUrl ?? session.serverUrl ?? process.env.SLOCK_SERVER_URL ?? "").trim();
+  if (!baseUrl) {
+    fail("MISSING_SERVER_URL", "Set SLOCK_SERVER_URL or pass --server-url <url>.");
+  }
+  const slugForServer = normalizeServerSlug(inputs.serverSlug);
+  if (!slugForServer) {
+    fail("ADOPT_NOT_AUTHORIZED", "Server slug must not be empty.");
+  }
+  const legacy = await resolveLegacyKey(inputs, process.env);
+  info(
+    `Adopting legacy daemon for ${formatServerSlugDisplay(slugForServer)} via ${legacy.mode}\u2026`
+  );
+  const client = new ComputerAttachClient(baseUrl, session.accessToken);
+  const adoptStartedAt = /* @__PURE__ */ new Date();
+  const legacyOwnerFile = legacyLockOwnerPath(slockHome, legacy.rawKey);
+  const result = await client.adoptLegacy(legacy.rawKey, inputs.name);
+  legacy.rawKey = void 0;
+  if (result.status === "disabled") {
+    await appendAdoptionLog(slockHome, {
+      mode: legacy.mode,
+      redactedPrefix: legacy.redactedPrefix,
+      startedAt: adoptStartedAt,
+      outcome: "failed",
+      failureReason: "computer_adopt_disabled"
+    });
+    fail(
+      "ADOPT_DISABLED",
+      "Computer legacy adoption is not enabled on this server. Upgrade the server or set SLOCK_DEVICE_LOGIN_ENABLED."
+    );
+  }
+  if (result.status === "legacy_key_invalid") {
+    await appendAdoptionLog(slockHome, {
+      mode: legacy.mode,
+      redactedPrefix: legacy.redactedPrefix,
+      startedAt: adoptStartedAt,
+      outcome: "failed",
+      failureReason: "legacy_key_invalid"
+    });
+    fail(
+      "LEGACY_KEY_INVALID",
+      "Server rejected the legacy api key (unknown / wrong server / malformed). Verify the key and --server-url."
+    );
+  }
+  if (result.status === "legacy_machine_key_migrated") {
+    await appendAdoptionLog(slockHome, {
+      mode: legacy.mode,
+      redactedPrefix: legacy.redactedPrefix,
+      startedAt: adoptStartedAt,
+      outcome: "failed",
+      failureReason: "legacy_machine_key_migrated"
+    });
+    fail(
+      "LEGACY_MACHINE_KEY_MIGRATED",
+      "This machine has already been adopted; the legacy key is no longer accepted. Use `slock-computer attach` to add another Computer attachment."
+    );
+  }
+  if (result.status === "not_authorized") {
+    await appendAdoptionLog(slockHome, {
+      mode: legacy.mode,
+      redactedPrefix: legacy.redactedPrefix,
+      startedAt: adoptStartedAt,
+      outcome: "failed",
+      failureReason: "not_authorized"
+    });
+    fail(
+      "ADOPT_NOT_AUTHORIZED",
+      "Not authorized to adopt this machine on this server. Check that you are a current member."
+    );
+  }
+  if (result.status === "error") {
+    await appendAdoptionLog(slockHome, {
+      mode: legacy.mode,
+      redactedPrefix: legacy.redactedPrefix,
+      startedAt: adoptStartedAt,
+      outcome: "failed",
+      failureReason: result.code
+    });
+    fail("ADOPT_FAILED", `Adoption failed (${result.code}).`);
+  }
+  info(result.resumed ? "Adopted (resumed prior attachment); running preflight\u2026" : "Adopted; running preflight\u2026");
+  const pre = await client.preflight(result.apiKey);
+  if (!pre.ok) {
+    await appendAdoptionLog(slockHome, {
+      mode: legacy.mode,
+      redactedPrefix: legacy.redactedPrefix,
+      startedAt: adoptStartedAt,
+      outcome: "failed",
+      failureReason: `preflight_${pre.code}`
+    });
+    fail(
+      "PREFLIGHT_FAILED",
+      `Server preflight failed (${pre.code}); local state not written. Upgrade the server or retry.`
+    );
+  }
+  const stop = await stopLegacyDaemonByOwnerFile(legacyOwnerFile);
+  if (stop.outcome === "timed_out" || stop.outcome === "denied" || stop.outcome === "error") {
+    await appendAdoptionLog(slockHome, {
+      mode: legacy.mode,
+      redactedPrefix: legacy.redactedPrefix,
+      startedAt: adoptStartedAt,
+      outcome: "failed",
+      failureReason: `legacy_stop_${stop.outcome}`,
+      computerId: result.computerId,
+      machineId: result.machineId,
+      serverId: result.serverId,
+      legacyStop: stop
+    });
+    const detail = stop.outcome === "timed_out" ? `pid ${stop.pid} did not exit within ${LEGACY_STOP_WAIT_MS}ms` : stop.outcome === "denied" ? `pid ${stop.pid} cannot be stopped (permission denied)` : `stop attempt error (${stop.reason ?? "unknown"})`;
+    fail(
+      "LEGACY_DAEMON_STOP_FAILED",
+      `Adoption succeeded server-side but the legacy daemon could not be stopped: ${detail}. Stop it manually and re-run \`slock-computer adopt-legacy\`, or run \`slock-computer attach\` after confirming the legacy process is gone. No local Computer state was written.`
+    );
+  }
+  const file = serverAttachmentPath(slockHome, result.serverId);
+  await mkdir4(dirname4(file), { recursive: true });
+  await writeFile4(
+    file,
+    JSON.stringify(
+      {
+        kind: "computer-attachment",
+        serverId: result.serverId,
+        serverSlug: slugForServer,
+        serverMachineId: result.computerId,
+        apiKey: result.apiKey,
+        serverUrl: baseUrl,
+        attachedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        adoptedFromLegacy: true,
+        legacyMachineId: result.machineId
+      },
+      null,
+      2
+    ),
+    { mode: 384 }
+  );
+  await chmod3(file, 384);
+  await appendAdoptionLog(slockHome, {
+    mode: legacy.mode,
+    redactedPrefix: legacy.redactedPrefix,
+    startedAt: adoptStartedAt,
+    outcome: "succeeded",
+    computerId: result.computerId,
+    machineId: result.machineId,
+    serverId: result.serverId,
+    legacyStop: stop
+  });
+  info(`Adopted. Computer state written to ${file}`);
+  info(`  server:        ${formatServerSlugDisplay(slugForServer)}`);
+  info(`  serverMachine: ${result.computerId}`);
+  info(`  legacyMachine: ${result.machineId}`);
+  switch (stop.outcome) {
+    case "absent":
+      info("  legacy daemon: not detected on this Computer (no local lock file)");
+      break;
+    case "already_dead":
+      info(`  legacy daemon: already stopped (pid ${stop.pid} not running)`);
+      break;
+    case "stopped":
+      info(`  legacy daemon: stopped (pid ${stop.pid}, SIGTERM)`);
+      break;
+  }
+  info(`Next: run \`slock-computer start\` to bring this server online under the Computer supervisor.`);
+}
+async function appendAdoptionLog(slockHome, line) {
+  try {
+    await mkdir4(computerDir(slockHome), { recursive: true });
+    const fields = [
+      `ts=${(/* @__PURE__ */ new Date()).toISOString()}`,
+      `started_at=${line.startedAt.toISOString()}`,
+      `outcome=${line.outcome}`,
+      `credential_bridge_mode=${line.mode}`,
+      `legacy_key_prefix=${line.redactedPrefix}`
+    ];
+    if (line.failureReason) fields.push(`failure_reason=${line.failureReason}`);
+    if (line.computerId) fields.push(`computer_id=${line.computerId}`);
+    if (line.machineId) fields.push(`legacy_machine_id=${line.machineId}`);
+    if (line.serverId) fields.push(`server_id=${line.serverId}`);
+    if (line.legacyStop) {
+      fields.push(`legacy_stop_outcome=${line.legacyStop.outcome}`);
+      if (typeof line.legacyStop.pid === "number") {
+        fields.push(`legacy_stop_pid=${line.legacyStop.pid}`);
+      }
+      if (line.legacyStop.reason) {
+        fields.push(`legacy_stop_reason=${line.legacyStop.reason}`);
+      }
+    }
+    const path2 = adoptionLogPath(slockHome);
+    await appendFile(path2, fields.join(" ") + "\n", { mode: 384 });
+    try {
+      const st = await stat(path2);
+      if ((st.mode & 63) !== 0) await chmod3(path2, 384);
+    } catch {
+    }
+  } catch {
   }
-  return out;
 }
 
+// src/setup.ts
+import { readdir as readdir3, readFile as readFile6 } from "fs/promises";
+import { join as join3 } from "path";
+
 // src/supervisor.ts
 import { spawn as spawn2 } from "child_process";
-import { mkdir as mkdir6, readFile as readFile4, writeFile as writeFile5, open, unlink as unlink4, rename as rename2 } from "fs/promises";
-import { dirname as dirname6, join as joinPath } from "path";
+import { mkdir as mkdir7, readFile as readFile5, writeFile as writeFile6, open, unlink as unlink4, rename as rename2 } from "fs/promises";
+import { dirname as dirname7, join as joinPath } from "path";
 import { fileURLToPath } from "url";
 
 // src/cleanup.ts
-import { readdir as readdir2, stat, unlink as unlink2, rm, rmdir, rename, mkdir as mkdir4 } from "fs/promises";
+import { readdir as readdir2, stat as stat2, unlink as unlink2, rm, rmdir, rename, mkdir as mkdir5 } from "fs/promises";
 import { spawn } from "child_process";
-import { join } from "path";
+import { join as join2 } from "path";
 function emptyCleanupReport() {
   return {
     stalePidfiles: [],
@@ -475,7 +923,7 @@ function emptyCleanupReport() {
 async function cleanupStalePidfile(pidfilePath) {
   const pid = await readPidfileAt(pidfilePath);
   if (pid === null) return false;
-  if (isProcessAlive(pid)) return false;
+  if (isProcessAlive2(pid)) return false;
   try {
     await unlink2(pidfilePath);
     return true;
@@ -556,17 +1004,17 @@ async function cleanupOrphanProcesses(slockHome, psSpawn) {
   return signaled;
 }
 function quarantineDir(slockHome) {
-  return join(computerDir(slockHome), ".quarantine");
+  return join2(computerDir(slockHome), ".quarantine");
 }
 async function quarantineServerSubtree(slockHome, serverId) {
-  const src = join(serversDir(slockHome), serverId);
+  const src = join2(serversDir(slockHome), serverId);
   const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const dest = join(quarantineDir(slockHome), `${stamp}-${serverId}`);
-  await mkdir4(dirname4(dest), { recursive: true });
+  const dest = join2(quarantineDir(slockHome), `${stamp}-${serverId}`);
+  await mkdir5(dirname5(dest), { recursive: true });
   await rename(src, dest);
   return dest;
 }
-function dirname4(p) {
+function dirname5(p) {
   const idx = p.lastIndexOf("/");
   return idx > 0 ? p.slice(0, idx) : "/";
 }
@@ -600,13 +1048,13 @@ var TMP_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
 async function cleanupTmpFiles(slockHome) {
   const removed = [];
   const cdir = computerDir(slockHome);
-  const stagingDir = join(cdir, "upgrade-staging");
+  const stagingDir = join2(cdir, "upgrade-staging");
   try {
     const versions = await readdir2(stagingDir);
     for (const v of versions) {
-      const vdir = join(stagingDir, v);
+      const vdir = join2(stagingDir, v);
       try {
-        const s = await stat(vdir);
+        const s = await stat2(vdir);
         if (Date.now() - s.mtimeMs > TMP_MAX_AGE_MS) {
           await rm(vdir, { recursive: true, force: true });
           removed.push(vdir);
@@ -621,9 +1069,9 @@ async function cleanupTmpFiles(slockHome) {
     }
   } catch {
   }
-  const snap = join(cdir, "upgrade-snapshot.json");
+  const snap = join2(cdir, "upgrade-snapshot.json");
   try {
-    const s = await stat(snap);
+    const s = await stat2(snap);
     if (Date.now() - s.mtimeMs > TMP_MAX_AGE_MS) {
       await unlink2(snap);
       removed.push(snap);
@@ -633,9 +1081,9 @@ async function cleanupTmpFiles(slockHome) {
   return removed;
 }
 async function cleanupStaleLock(slockHome) {
-  const lockDir = join(computerDir(slockHome), ".lock");
+  const lockDir = join2(computerDir(slockHome), ".lock");
   try {
-    const s = await stat(lockDir);
+    const s = await stat2(lockDir);
     if (Date.now() - s.mtimeMs > 60 * 1e3) {
       await rm(lockDir, { recursive: true, force: true });
       return [lockDir];
@@ -645,9 +1093,9 @@ async function cleanupStaleLock(slockHome) {
   return [];
 }
 async function forceReleaseLock(slockHome) {
-  const lockDir = join(computerDir(slockHome), ".lock");
+  const lockDir = join2(computerDir(slockHome), ".lock");
   try {
-    await stat(lockDir);
+    await stat2(lockDir);
     await rm(lockDir, { recursive: true, force: true });
     return [lockDir];
   } catch {
@@ -668,14 +1116,14 @@ async function runFullCleanup(slockHome, options = {}) {
 }
 
 // src/health.ts
-import { readFile as readFile3, writeFile as writeFile4, unlink as unlink3, mkdir as mkdir5 } from "fs/promises";
-import { dirname as dirname5 } from "path";
+import { readFile as readFile4, writeFile as writeFile5, unlink as unlink3, mkdir as mkdir6 } from "fs/promises";
+import { dirname as dirname6 } from "path";
 var CRASH_WINDOW_MS = 6e4;
 var DEGRADED_THRESHOLD = 3;
 async function readHealthFile(slockHome, serverId) {
   if (!isValidServerId(serverId)) return { crashes: [] };
   try {
-    const raw = await readFile3(serverHealthPath(slockHome, serverId), "utf8");
+    const raw = await readFile4(serverHealthPath(slockHome, serverId), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object" && Array.isArray(parsed.crashes)) {
       return parsed;
@@ -686,8 +1134,8 @@ async function readHealthFile(slockHome, serverId) {
 }
 async function writeHealthFile(slockHome, serverId, file) {
   const path2 = serverHealthPath(slockHome, serverId);
-  await mkdir5(dirname5(path2), { recursive: true });
-  await writeFile4(path2, JSON.stringify(file), { mode: 384 });
+  await mkdir6(dirname6(path2), { recursive: true });
+  await writeFile5(path2, JSON.stringify(file), { mode: 384 });
 }
 async function recordCrash(slockHome, serverId, exitCode, signal, nowMs = Date.now()) {
   if (!isValidServerId(serverId)) return;
@@ -713,9 +1161,26 @@ async function readCrashHistory(slockHome, serverId, nowMs = Date.now()) {
   });
 }
 async function isDegraded(slockHome, serverId, nowMs = Date.now()) {
-  const recent = await readCrashHistory(slockHome, serverId, nowMs);
+  const file = await readHealthFile(slockHome, serverId);
+  if (file.fatalConfig) return true;
+  const cutoffMs = nowMs - CRASH_WINDOW_MS;
+  const recent = file.crashes.filter((c) => {
+    const t = new Date(c.at).getTime();
+    return Number.isFinite(t) && t >= cutoffMs;
+  });
   return recent.length >= DEGRADED_THRESHOLD;
 }
+async function markFatalConfig(slockHome, serverId, exitCode, signal, nowMs = Date.now()) {
+  if (!isValidServerId(serverId)) return;
+  const file = await readHealthFile(slockHome, serverId);
+  file.fatalConfig = {
+    at: new Date(nowMs).toISOString(),
+    exitCode,
+    signal,
+    reason: "ex_config"
+  };
+  await writeHealthFile(slockHome, serverId, file);
+}
 async function resetHealth(slockHome, serverId) {
   if (!isValidServerId(serverId)) return;
   try {
@@ -727,14 +1192,14 @@ async function resetHealth(slockHome, serverId) {
 // src/supervisor.ts
 async function readPidfileAt(pidfilePath) {
   try {
-    const raw = (await readFile4(pidfilePath, "utf8")).trim();
+    const raw = (await readFile5(pidfilePath, "utf8")).trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
     return null;
   }
 }
-function isProcessAlive(pid) {
+function isProcessAlive2(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
   try {
     process.kill(pid, 0);
@@ -744,8 +1209,8 @@ function isProcessAlive(pid) {
   }
 }
 async function writePidfileAt(pidfilePath, pid) {
-  await mkdir6(dirname6(pidfilePath), { recursive: true });
-  await writeFile5(pidfilePath, String(pid), { mode: 384 });
+  await mkdir7(dirname7(pidfilePath), { recursive: true });
+  await writeFile6(pidfilePath, String(pid), { mode: 384 });
 }
 async function clearPidfileAt(pidfilePath) {
   try {
@@ -759,7 +1224,7 @@ function buildResidentSpawn(mode, serverId, selfEntry = process.argv[1] ?? "", e
 }
 var PARENT_LOCK_HELD_ENV_VAR = "SLOCK_COMPUTER_PARENT_MUTATION_LOCK_HELD";
 async function spawnDetachedSupervisor(slockHome) {
-  await mkdir6(computerDir(slockHome), { recursive: true });
+  await mkdir7(computerDir(slockHome), { recursive: true });
   const supLogFd = await open(supervisorLogPath(slockHome), "a");
   const { command, args } = buildResidentSpawn("__supervise", null);
   const child = spawn2(command, args, {
@@ -783,10 +1248,35 @@ async function spawnDetachedSupervisor(slockHome) {
   await writePidfileAt(supervisorPidPath(slockHome), pid);
   return pid;
 }
+var EX_CONFIG_EXIT_CODE = 78;
 var defaultCoreFactory = async (creds) => {
-  const { DaemonCore } = await import("@slock-ai/daemon/core");
-  return new DaemonCore({ serverUrl: creds.serverUrl, apiKey: creds.apiKey, localTrace: true });
+  let coreMod;
+  try {
+    coreMod = await import("@slock-ai/daemon/core");
+  } catch (err) {
+    const code = err?.code;
+    const isModuleMissing = code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND" || err instanceof Error && /Cannot find (module|package)/i.test(err.message);
+    if (isModuleMissing) {
+      process.stderr.write(
+        `slock-computer: per-server daemon failed to load \`@slock-ai/daemon/core\`.
+  Reason: ${err instanceof Error ? err.message : String(err)}
+  This usually means a source-run workspace without a built daemon dist.
+  Fix: run \`pnpm --filter @slock-ai/daemon build\` once, then \`slock-computer doctor <server> --reset-health && slock-computer start\`.
+  (Packaged/npx installs ship the dist already \u2014 this only affects local source-run setups.)
+`
+      );
+      process.exit(EX_CONFIG_EXIT_CODE);
+    }
+    throw err;
+  }
+  return new coreMod.DaemonCore({ serverUrl: creds.serverUrl, apiKey: creds.apiKey, localTrace: true });
 };
+function classifyChildExit(code, signal) {
+  if (code === EX_CONFIG_EXIT_CODE) return "config-error";
+  if (signal === "SIGTERM" || signal === "SIGINT") return "graceful";
+  if (code === 0) return "graceful";
+  return "crash";
+}
 async function runResident(serverId, deps = {}) {
   assertValidServerId(serverId);
   const slockHome = resolveSlockHome();
@@ -852,10 +1342,10 @@ async function runSupervisorStartupRecovery(slockHome) {
 }
 async function resolveSupervisorIdentity() {
   const here = fileURLToPath(import.meta.url);
-  const installRoot = dirname6(dirname6(here));
+  const installRoot = dirname7(dirname7(here));
   let version = null;
   try {
-    const raw = await readFile4(joinPath(installRoot, "package.json"), "utf8");
+    const raw = await readFile5(joinPath(installRoot, "package.json"), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       version = parsed.version;
@@ -875,7 +1365,7 @@ async function writeSupervisorVersionEvidence(slockHome) {
     };
     const dest = supervisorVersionPath(slockHome);
     const tmp = `${dest}.tmp`;
-    await writeFile5(tmp, JSON.stringify(payload) + "\n", { mode: 384 });
+    await writeFile6(tmp, JSON.stringify(payload) + "\n", { mode: 384 });
     await rename2(tmp, dest);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -887,7 +1377,7 @@ async function writeSupervisorVersionEvidence(slockHome) {
 }
 async function readSupervisorVersionEvidence(slockHome) {
   try {
-    const raw = await readFile4(supervisorVersionPath(slockHome), "utf8");
+    const raw = await readFile5(supervisorVersionPath(slockHome), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.installRoot !== "string" || typeof parsed.pid !== "number" || typeof parsed.writtenAt !== "string" || parsed.version !== null && typeof parsed.version !== "string") {
       return null;
@@ -904,7 +1394,7 @@ async function readSupervisorVersionEvidence(slockHome) {
 }
 async function runSupervise() {
   const slockHome = resolveSlockHome();
-  await mkdir6(computerDir(slockHome), { recursive: true });
+  await mkdir7(computerDir(slockHome), { recursive: true });
   await runSupervisorStartupRecovery(slockHome);
   await writePidfileAt(supervisorPidPath(slockHome), process.pid);
   await writeSupervisorVersionEvidence(slockHome);
@@ -912,7 +1402,7 @@ async function runSupervise() {
   const { [PARENT_LOCK_HELD_ENV_VAR]: _parentLockMarker, ...childEnv } = process.env;
   const spawnChild = async (serverId) => {
     const logPath = serverDaemonLogPath(slockHome, serverId);
-    await mkdir6(dirname6(logPath), { recursive: true });
+    await mkdir7(dirname7(logPath), { recursive: true });
     const logFd = await open(logPath, "a");
     const { command, args } = buildResidentSpawn("__run", serverId);
     const child = spawn2(command, args, {
@@ -930,6 +1420,25 @@ async function runSupervise() {
         children.delete(serverId);
         await clearPidfileAt(serverDaemonPidPath(slockHome, serverId));
         if (handle.stopping) return;
+        const classification = classifyChildExit(code, signal);
+        if (classification === "config-error") {
+          try {
+            await markFatalConfig(slockHome, serverId, code, signal);
+          } catch {
+          }
+          process.stderr.write(
+            `Supervisor: server ${serverId} child exited with EX_CONFIG (${EX_CONFIG_EXIT_CODE}); marked degraded, NOT auto-restarting. See ${serverDaemonLogPath(slockHome, serverId)} for the actionable error.
+`
+          );
+          return;
+        }
+        if (classification === "graceful") {
+          await new Promise((r) => setTimeout(r, CHILD_RESTART_BACKOFF_MS));
+          if (await readServerAttachment(slockHome, serverId) && !shuttingDown) {
+            await spawnChild(serverId);
+          }
+          return;
+        }
         try {
           await recordCrash(slockHome, serverId, code, signal);
         } catch {
@@ -1001,10 +1510,10 @@ async function runStart(opts = {}, _deps = {}) {
     await setServerManaged(slockHome, id);
   }
   const existing = await readPidfileAt(supervisorPidPath(slockHome));
-  if (existing && isProcessAlive(existing)) {
+  if (existing && isProcessAlive2(existing)) {
     info(`Supervisor already running (pid ${existing}).`);
     info(
-      opts.serverId ? `Marked server ${opts.serverId} as managed; its daemon will be ensured on next reconcile tick.` : `Marked all ${attached.length} attached server(s) as managed; their daemons will be ensured on next reconcile tick.`
+      opts.serverId ? `Marked server ${opts.serverLabel ?? opts.serverId} as managed; its daemon will be ensured on next reconcile tick.` : `Marked all ${attached.length} attached server(s) as managed; their daemons will be ensured on next reconcile tick.`
     );
     return;
   }
@@ -1029,12 +1538,12 @@ async function runStart(opts = {}, _deps = {}) {
   info(`Per-server daemon logs: ~/.slock/computer/servers/<serverId>/daemon.log`);
   info(`Check state with \`slock-computer status\`.`);
 }
-async function runDetach(serverId) {
+async function runDetach(serverId, serverLabel = serverId) {
   assertValidServerId(serverId);
   const slockHome = resolveSlockHome();
   const a = await readServerAttachment(slockHome, serverId);
   if (!a) {
-    fail("NOT_ATTACHED", `Not attached to server ${serverId} (nothing to detach).`);
+    fail("NOT_ATTACHED", `Not attached to server ${serverLabel} (nothing to detach).`);
   }
   await bestEffortServerRevoke(a.serverUrl, a.apiKey, serverId);
   await clearServerManaged(slockHome, serverId);
@@ -1044,7 +1553,7 @@ async function runDetach(serverId) {
     serverDaemonLogPath(slockHome, serverId)
   ];
   for (const p of subtree) await clearPidfileAt(p);
-  info(`Detached from server ${serverId}.`);
+  info(`Detached from server ${serverLabel}.`);
   info(`The supervisor (if running) will stop that server's daemon on its next reconcile tick.`);
 }
 async function bestEffortServerRevoke(serverUrl, apiKey, serverId) {
@@ -1078,10 +1587,134 @@ async function bestEffortServerRevoke(serverUrl, apiKey, serverId) {
   }
 }
 
+// src/setup.ts
+async function hasValidUserSession(slockHome) {
+  try {
+    const parsed = JSON.parse(await readFile6(userSessionPath(slockHome), "utf8"));
+    return parsed.kind === "user-session" && typeof parsed.accessToken === "string" && parsed.accessToken.length > 0;
+  } catch {
+    return false;
+  }
+}
+async function hasLiveLegacyDaemon(slockHome) {
+  let machineDirs;
+  try {
+    machineDirs = await readdir3(join3(slockHome, "machines"));
+  } catch {
+    return false;
+  }
+  for (const name of machineDirs) {
+    if (!name.startsWith("machine-")) continue;
+    try {
+      const raw = await readFile6(join3(slockHome, "machines", name, "daemon.lock", "owner.json"), "utf8");
+      const owner = JSON.parse(raw);
+      if (typeof owner.pid === "number" && isProcessAlive2(owner.pid)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function hasExplicitLegacyKeyInput(opts) {
+  return typeof opts.legacyApiKey === "string" && opts.legacyApiKey.length > 0 || typeof opts.legacyApiKeyFile === "string" && opts.legacyApiKeyFile.length > 0 || opts.legacyApiKeyStdin === true;
+}
+function hasAmbientLegacyKeyInput() {
+  return typeof process.env.SLOCK_LEGACY_API_KEY === "string" && process.env.SLOCK_LEGACY_API_KEY.trim().length > 0;
+}
+async function runSetup(opts, deps = {}) {
+  const slockHome = resolveSlockHome();
+  const isTty = deps.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const login = deps.runLogin ?? runLogin;
+  const attach = deps.runAttach ?? runAttach;
+  const adopt = deps.runAdoptLegacy ?? runAdoptLegacy;
+  const start = deps.runStart ?? runStart;
+  const legacyDaemonCheck = deps.hasLiveLegacyDaemon ?? hasLiveLegacyDaemon;
+  if (!isTty && !opts.yes) {
+    fail(
+      "NON_INTERACTIVE_SETUP_REQUIRES_FLAGS",
+      "Non-interactive setup requires --yes after you have confirmed the login/attach/adopt/start actions. Run `slock-computer login`, `slock-computer attach`, and `slock-computer start` separately for fully explicit automation."
+    );
+  }
+  if (!opts.adoptLegacy && hasExplicitLegacyKeyInput(opts)) {
+    fail(
+      "LEGACY_KEY_OUTSIDE_ADOPT",
+      "`--legacy-api-key*` options are only accepted with `slock-computer setup --adopt-legacy` or `slock-computer adopt-legacy`."
+    );
+  }
+  const label = formatServerSlugDisplay(opts.serverSlug);
+  info(`Setting up Slock Computer for ${label}\u2026`);
+  if (!await hasValidUserSession(slockHome)) {
+    if (!isTty) {
+      fail(
+        "NON_INTERACTIVE_SETUP_REQUIRES_FLAGS",
+        "No user session is available and setup is running non-interactively. Run `slock-computer login` in a terminal first, then re-run setup with --yes."
+      );
+    }
+    await login({ serverUrl: opts.serverUrl });
+  } else {
+    info("User session: already logged in.");
+  }
+  let attachment = await resolveAttachedServerSlug(slockHome, opts.serverSlug);
+  if (attachment) {
+    info(`Attachment: already attached to ${label}.`);
+  } else {
+    const liveLegacy = await legacyDaemonCheck(slockHome);
+    const explicitLegacyKey = hasExplicitLegacyKeyInput(opts);
+    const hasLegacyKey = explicitLegacyKey || opts.adoptLegacy === true && hasAmbientLegacyKeyInput();
+    if (!opts.adoptLegacy && liveLegacy) {
+      fail(
+        "LEGACY_DAEMON_RUNNING",
+        "A legacy daemon appears to be running in this SLOCK_HOME. Re-run with `--adopt-legacy` and a legacy key, or stop the legacy daemon before fresh setup."
+      );
+    }
+    if (opts.adoptLegacy && hasLegacyKey) {
+      await adopt({
+        serverSlug: opts.serverSlug,
+        serverUrl: opts.serverUrl,
+        name: opts.name,
+        legacyApiKey: opts.legacyApiKey,
+        legacyApiKeyFile: opts.legacyApiKeyFile,
+        legacyApiKeyStdin: opts.legacyApiKeyStdin
+      });
+    } else if (opts.adoptLegacy && liveLegacy) {
+      fail(
+        "LEGACY_DAEMON_RUNNING",
+        "A legacy daemon is running, but no legacy key was provided. Provide --legacy-api-key-file/--legacy-api-key/--legacy-api-key-stdin, or stop the legacy daemon before falling back to a fresh attach."
+      );
+    } else {
+      if (opts.adoptLegacy) {
+        info("Legacy key: not provided; falling back to fresh device-login attach.");
+      }
+      await attach({
+        serverSlug: opts.serverSlug,
+        serverUrl: opts.serverUrl,
+        name: opts.name,
+        run: false
+      });
+    }
+    attachment = await resolveAttachedServerSlug(slockHome, opts.serverSlug);
+    if (!attachment) {
+      fail(
+        "SETUP_ATTACHMENT_MISSING",
+        `Setup did not produce a local attachment for ${label}. Re-run \`slock-computer attach ${label}\` or \`slock-computer adopt-legacy ${label}\`.`
+      );
+    }
+  }
+  if (opts.start === false) {
+    info(`Start: skipped (--no-start). Run \`slock-computer start ${label}\` when ready.`);
+    return;
+  }
+  await start({
+    serverId: attachment.serverId,
+    serverLabel: opts.serverSlug,
+    foreground: opts.foreground
+  });
+}
+
 // src/status.ts
+import { readFile as readFile7 } from "fs/promises";
 async function readJsonSafe(path2) {
   try {
-    return JSON.parse(await readFile5(path2, "utf8"));
+    return JSON.parse(await readFile7(path2, "utf8"));
   } catch {
     return null;
   }
@@ -1091,7 +1724,7 @@ function str(v) {
 }
 async function pidStatus(pidfile) {
   const pid = await readPidfileAt(pidfile);
-  return pid !== null && isProcessAlive(pid) ? { running: true, pid } : { running: false };
+  return pid !== null && isProcessAlive2(pid) ? { running: true, pid } : { running: false };
 }
 async function deriveHealth(slockHome, serverId, daemon) {
   if (!daemon.running) return "offline";
@@ -1102,15 +1735,20 @@ async function buildStatusReport() {
   const slockHome = resolveSlockHome();
   const session = await readJsonSafe(userSessionPath(slockHome));
   const attachments = await listServerAttachments(slockHome);
-  const supervisor = await pidStatus(supervisorPidPath(slockHome));
+  const supervisor = {
+    ...await pidStatus(supervisorPidPath(slockHome)),
+    logPath: supervisorLogPath(slockHome)
+  };
   const servers = [];
   for (const a of attachments) {
     const daemon = await pidStatus(serverDaemonPidPath(slockHome, a.serverId));
     servers.push({
       serverId: a.serverId,
+      serverSlug: a.serverSlug ?? null,
       serverMachineId: a.serverMachineId,
       serverUrl: a.serverUrl,
       attachedAt: a.attachedAt ?? null,
+      daemonLogPath: serverDaemonLogPath(slockHome, a.serverId),
       daemon,
       health: await deriveHealth(slockHome, a.serverId, daemon)
     });
@@ -1143,17 +1781,19 @@ async function runStatus(opts) {
   info(
     `Supervisor:   ${report.supervisor.running ? `running (pid ${report.supervisor.pid})` : "stopped \u2014 run `slock-computer start`"}`
   );
+  info(`Supervisor log: ${report.supervisor.logPath}`);
   info("");
   if (report.servers.length === 0) {
-    info("Attachments:  none \u2014 run `slock-computer attach <serverId>`");
+    info("Attachments:  none \u2014 run `slock-computer attach /<serverSlug>` (e.g. `/myserver`).");
   } else {
     info("Attachments:");
-    info(`  ${pad("SERVER", 38)}${pad("HEALTH", 12)}${pad("DAEMON", 24)}${pad("MACHINE", 38)}URL`);
+    info(`  ${pad("SERVER", 24)}${pad("HEALTH", 12)}${pad("DAEMON", 24)}${pad("MACHINE", 38)}URL`);
     for (const s of report.servers) {
       const dcol = s.daemon.running ? `running (pid ${s.daemon.pid})` : "stopped";
       info(
-        `  ${pad(s.serverId, 38)}${pad(s.health, 12)}${pad(dcol, 24)}${pad(s.serverMachineId, 38)}${s.serverUrl}`
+        `  ${pad(formatServerSlugDisplay(s.serverSlug), 24)}${pad(s.health, 12)}${pad(dcol, 24)}${pad(s.serverMachineId, 38)}${s.serverUrl}`
       );
+      info(`    Daemon log: ${s.daemonLogPath}`);
     }
     if (report.servers.some((s) => s.health === "degraded")) {
       info("");
@@ -1161,7 +1801,7 @@ async function runStatus(opts) {
         "  Note: one or more servers are `degraded` (repeated crashes; auto-restart paused)."
       );
       info(
-        "  Run `slock-computer doctor <serverId> --reset-health` after fixing the underlying issue."
+        "  Run `slock-computer doctor /<serverSlug> --reset-health` (e.g. `/myserver`) after fixing the underlying issue."
       );
     }
   }
@@ -1169,36 +1809,60 @@ async function runStatus(opts) {
 }
 
 // src/targetServer.ts
+function attachmentLabel(a) {
+  return formatServerSlugDisplay(a.serverSlug);
+}
+async function refreshAttachmentSlug(home, attachment) {
+  try {
+    const client = new ComputerAttachClient(attachment.serverUrl, "");
+    const result = await client.preflight(attachment.apiKey);
+    if (!result.ok || !result.serverSlug || result.serverSlug === attachment.serverSlug) {
+      return attachment;
+    }
+    const updated = { ...attachment, serverSlug: result.serverSlug };
+    await writeServerAttachment(home, updated);
+    return updated;
+  } catch {
+    return attachment;
+  }
+}
+async function listAttachmentsWithFreshSlugs(home) {
+  const attachments = await listServerAttachments(home);
+  return await Promise.all(attachments.map((a) => refreshAttachmentSlug(home, a)));
+}
 async function resolveTargetServerId(opts) {
   const home = resolveSlockHome();
-  const ids = await listAttachedServerIds(home);
-  if (ids.length === 0) {
-    fail("NO_ATTACHMENT", "No server attachments yet. Run `slock-computer attach <serverId>` first.");
+  let attachments = await listServerAttachments(home);
+  if (attachments.length === 0) {
+    fail("NO_ATTACHMENT", "No server attachments yet. Run `slock-computer attach /<serverSlug>` (e.g. `/myserver`) first.");
   }
-  const requested = (opts.server ?? "").trim();
+  const requested = normalizeServerSlug(opts.server ?? "");
   if (requested) {
-    if (!isValidServerId(requested)) {
-      fail("INVALID_SERVER_ID", `--server ${JSON.stringify(requested)} is not a valid server id (expected a UUID).`);
+    let found = attachments.find((a) => a.serverSlug === requested);
+    if (!found) {
+      attachments = await listAttachmentsWithFreshSlugs(home);
+      found = attachments.find((a) => a.serverSlug === requested);
     }
-    if (!ids.includes(requested)) {
+    if (!found) {
       fail(
         "NOT_ATTACHED",
-        `Not attached to server ${requested}. Attached servers: ${ids.join(", ")}.`
+        `Server slug ${formatServerSlugDisplay(requested)} is not attached. Attached server slugs: ${attachments.map(attachmentLabel).join(", ")}.`
       );
     }
-    return requested;
+    return found.serverId;
   }
-  if (ids.length === 1) return ids[0];
+  if (attachments.length === 1) return attachments[0].serverId;
   fail(
     "AMBIGUOUS_SERVER",
-    `Multiple servers attached (${ids.join(", ")}). Pass \`--server <serverId>\` to choose one.`
+    `Multiple servers attached (${attachments.map(attachmentLabel).join(", ")}). Pass \`--server /<serverSlug>\` (e.g. \`--server ${attachmentLabel(attachments[0])}\`) to choose one.`
   );
 }
 async function resolveTargetAttachment(opts) {
   const serverId = await resolveTargetServerId(opts);
   const a = await readServerAttachment(resolveSlockHome(), serverId);
   if (!a) {
-    fail("INVALID_ATTACHMENT", `Attachment for ${serverId} is missing/invalid. Re-run \`slock-computer attach ${serverId}\`.`);
+    const label = opts.server ?? serverId;
+    fail("INVALID_ATTACHMENT", `Attachment for ${label} is missing/invalid. Re-run \`slock-computer attach ${label}\`.`);
   }
   return a;
 }
@@ -1208,22 +1872,23 @@ async function runRunnersList(opts) {
   const a = await resolveTargetAttachment({ server: opts.server });
   const client = new RunnersClient(a.serverUrl, a.apiKey);
   const result = await client.list();
+  const label = a.serverSlug ? formatServerSlugDisplay(a.serverSlug) : a.serverId;
   if (result.status === "unauthorized") {
     fail(
       "RUNNERS_UNAUTHORIZED",
-      `The Computer credential for ${a.serverId} was rejected. Re-run \`slock-computer attach ${a.serverId}\`.`
+      `The Computer credential for ${label} was rejected. Re-run \`slock-computer attach ${label}\`.`
     );
   }
   if (result.status === "error") {
     fail(
       "RUNNERS_LIST_FAILED",
-      `Could not list runners on ${a.serverId} (${result.code}). Check --server-url / server version.`
+      `Could not list runners on ${label} (${result.code}). Check --server-url / server version.`
     );
   }
   if (opts.json) {
     info(
       JSON.stringify(
-        { server: a.serverId, whitelist: result.whitelist, runners: result.runners },
+        { server: label, serverId: a.serverId, whitelist: result.whitelist, runners: result.runners },
         null,
         2
       )
@@ -1231,11 +1896,11 @@ async function runRunnersList(opts) {
     return;
   }
   if (result.runners.length === 0) {
-    info(`No runners on server ${a.serverId}.`);
+    info(`No runners on server ${label}.`);
     return;
   }
   info("");
-  info(`Server ${a.serverId}:`);
+  info(`Server ${label}:`);
   info("  AGENT                                 STATUS     RUNTIME   MODEL          NAME");
   for (const r of result.runners) {
     info(
@@ -1246,27 +1911,28 @@ async function runRunnersList(opts) {
 }
 async function runRunnersStop(agentId, opts = {}) {
   if (!agentId || agentId.trim().length === 0) {
-    fail("AGENT_ID_REQUIRED", "Usage: slock-computer runners stop <agentId> [--server <serverId>]");
+    fail("AGENT_ID_REQUIRED", "Usage: slock-computer runners stop <agentId> [--server /<serverSlug>]");
   }
   const a = await resolveTargetAttachment({ server: opts.server });
   const client = new RunnersClient(a.serverUrl, a.apiKey);
   const result = await client.stop(agentId);
+  const label = a.serverSlug ? formatServerSlugDisplay(a.serverSlug) : a.serverId;
   if (result.status === "unauthorized") {
     fail(
       "RUNNERS_UNAUTHORIZED",
-      `The Computer credential for ${a.serverId} was rejected. Re-run \`slock-computer attach ${a.serverId}\`.`
+      `The Computer credential for ${label} was rejected. Re-run \`slock-computer attach ${label}\`.`
     );
   }
   if (result.status === "not_found") {
-    fail("RUNNER_NOT_FOUND", `No runner ${agentId} on server ${a.serverId}.`);
+    fail("RUNNER_NOT_FOUND", `No runner ${agentId} on server ${label}.`);
   }
   if (result.status === "error") {
     fail(
       "RUNNER_STOP_FAILED",
-      `Could not stop runner on ${a.serverId} (${result.code}). Check --server-url / server version.`
+      `Could not stop runner on ${label} (${result.code}). Check --server-url / server version.`
     );
   }
-  info(`Stop signalled for runner ${agentId} on server ${a.serverId}.`);
+  info(`Stop signalled for runner ${agentId} on server ${label}.`);
 }
 
 // src/doctor.ts
@@ -1303,13 +1969,14 @@ async function runDoctorChecks() {
     checks.push({
       name: "attachments",
       ok: false,
-      detail: "no attachments \u2014 run `slock-computer attach <serverId>`"
+      detail: "no attachments \u2014 run `slock-computer attach /<serverSlug>` (e.g. `/myserver`)"
     });
     return checks;
   }
   for (const a of attachments) {
+    const label = a.serverSlug ? formatServerSlugDisplay(a.serverSlug) : a.serverId;
     checks.push({
-      name: `attach ${a.serverId}`,
+      name: `attach ${label}`,
       ok: true,
       detail: `machine ${a.serverMachineId} @ ${a.serverUrl}`
     });
@@ -1317,15 +1984,15 @@ async function runDoctorChecks() {
       const client = new ComputerAttachClient(a.serverUrl, "");
       const r = await client.preflight(a.apiKey);
       checks.push(
-        r.ok ? { name: `preflight ${a.serverId}`, ok: true, detail: "surface aligned (\xA79 ok)" } : {
-          name: `preflight ${a.serverId}`,
+        r.ok ? { name: `preflight ${label}`, ok: true, detail: "surface aligned (\xA79 ok)" } : {
+          name: `preflight ${label}`,
           ok: false,
           detail: `preflight rejected (${r.code}) \u2014 upgrade the server or re-attach`
         }
       );
     } catch (err) {
       checks.push({
-        name: `preflight ${a.serverId}`,
+        name: `preflight ${label}`,
         ok: false,
         detail: `server unreachable (${err instanceof Error ? err.message : String(err)}) \u2014 check serverUrl / network`
       });
@@ -1337,7 +2004,7 @@ async function runDoctor(opts) {
   const slockHome = resolveSlockHome();
   if (opts.resetHealth && opts.serverId) {
     await resetHealth(slockHome, opts.serverId);
-    info(`Reset health state for server ${opts.serverId}.`);
+    info(`Reset health state for server ${opts.serverLabel ?? opts.serverId}.`);
     info(`Supervisor will resume auto-restart on next daemon exit.`);
   }
   const checks = await runDoctorChecks();
@@ -1366,14 +2033,14 @@ async function runDoctor(opts) {
   info(allOk ? "All checks passed." : "Some checks failed \u2014 see the actionable hints above.");
   if (crashes.length > 0) {
     info("");
-    info(`Recent crashes for server ${opts.serverId} (within 60s window):`);
+    info(`Recent crashes for server ${opts.serverLabel ?? opts.serverId} (within 60s window):`);
     for (const c of crashes) {
       const sig = c.signal ? ` signal=${c.signal}` : "";
       const code = c.exitCode !== null ? ` exitCode=${c.exitCode}` : "";
       info(`  - ${c.at}${code}${sig}`);
     }
     info(`  \u2192 Once you fix the underlying issue, run`);
-    info(`    \`slock-computer doctor ${opts.serverId} --reset-health\` to resume auto-restart.`);
+    info(`    \`slock-computer doctor ${opts.serverLabel ?? opts.serverId} --reset-health\` to resume auto-restart.`);
   }
   if (cleanupReport) {
     info("");
@@ -1407,14 +2074,14 @@ async function runDoctor(opts) {
 }
 
 // src/logs.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile8 } from "fs/promises";
 var DEFAULT_LINES = 200;
 async function runLogs(opts) {
   const home = resolveSlockHome();
   const file = opts.supervisor ? supervisorLogPath(home) : serverDaemonLogPath(home, await resolveTargetServerId({ server: opts.server }));
   let content;
   try {
-    content = await readFile6(file, "utf8");
+    content = await readFile8(file, "utf8");
   } catch {
     fail(
       "NO_DAEMON_LOG",
@@ -1430,14 +2097,14 @@ async function runLogs(opts) {
 
 // src/concurrency.ts
 import lockfile from "proper-lockfile";
-import { mkdir as mkdir7 } from "fs/promises";
-import { join as join2 } from "path";
+import { mkdir as mkdir8 } from "fs/promises";
+import { join as join4 } from "path";
 var STALE_LOCK_THRESHOLD_MS = 6e4;
 async function withMutationLock(fn) {
   const slockHome = resolveSlockHome();
   const lockTarget = computerDir(slockHome);
-  await mkdir7(lockTarget, { recursive: true });
-  const lockfilePath = join2(lockTarget, ".lock");
+  await mkdir8(lockTarget, { recursive: true });
+  const lockfilePath = join4(lockTarget, ".lock");
   let release = null;
   try {
     release = await lockfile.lock(lockTarget, {
@@ -1474,8 +2141,8 @@ async function withMutationLock(fn) {
 }
 
 // src/channel.ts
-import { readFile as readFile7, writeFile as writeFile6, mkdir as mkdir8 } from "fs/promises";
-import { dirname as dirname7 } from "path";
+import { readFile as readFile9, writeFile as writeFile7, mkdir as mkdir9 } from "fs/promises";
+import { dirname as dirname8 } from "path";
 var DEFAULT_CHANNEL = "latest";
 var SEMVER_RE = /^\d+\.\d+\.\d+(-[\w.]+)?$/;
 function parseChannel(raw) {
@@ -1490,7 +2157,7 @@ function parseChannel(raw) {
 }
 async function readChannel(slockHome) {
   try {
-    const raw = await readFile7(channelPath(slockHome), "utf8");
+    const raw = await readFile9(channelPath(slockHome), "utf8");
     const parsed = parseChannel(raw);
     if (parsed !== null) return parsed;
   } catch {
@@ -1499,8 +2166,8 @@ async function readChannel(slockHome) {
 }
 async function writeChannel(slockHome, channel2) {
   const p = channelPath(slockHome);
-  await mkdir8(dirname7(p), { recursive: true });
-  await writeFile6(p, `${channel2}
+  await mkdir9(dirname8(p), { recursive: true });
+  await writeFile7(p, `${channel2}
 `, { mode: 384 });
 }
 async function runChannelShow(slockHome) {
@@ -1522,21 +2189,21 @@ async function runChannelSet(slockHome, raw) {
 }
 
 // src/upgradeCli.ts
-import { readFile as readFile10 } from "fs/promises";
+import { readFile as readFile12 } from "fs/promises";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname8, join as join5 } from "path";
+import { dirname as dirname9, join as join7 } from "path";
 
 // src/upgrade.ts
 import { spawn as spawn4 } from "child_process";
-import { mkdir as mkdir9, readFile as readFile9, writeFile as writeFile7, rm as rm2, rename as rename3 } from "fs/promises";
-import { join as join4 } from "path";
-import { createHash } from "crypto";
+import { mkdir as mkdir10, readFile as readFile11, writeFile as writeFile8, rm as rm2, rename as rename3 } from "fs/promises";
+import { join as join6 } from "path";
+import { createHash as createHash3 } from "crypto";
 
 // src/preflightDepDrift.ts
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile10 } from "fs/promises";
 import { spawn as spawn3 } from "child_process";
 import { createRequire } from "module";
-import { join as join3 } from "path";
+import { join as join5 } from "path";
 import { pathToFileURL } from "url";
 var DAEMON_PACKAGE_NAME = "@slock-ai/daemon";
 async function preflightDepDriftCheck(currentBinaryDir, stagedTarballPath, deps = {}) {
@@ -1704,13 +2371,13 @@ async function defaultReadTarballPackageJson(tarballPath) {
   return JSON.parse(raw);
 }
 async function defaultReadCurrentPackageJson(currentBinaryDir) {
-  const raw = await readFile8(join3(currentBinaryDir, "package.json"), "utf8");
+  const raw = await readFile10(join5(currentBinaryDir, "package.json"), "utf8");
   return JSON.parse(raw);
 }
 async function defaultReadInstalledDaemonVersion(currentBinaryDir) {
   let searchPaths;
   try {
-    const anchor = pathToFileURL(join3(currentBinaryDir, "package.json"));
+    const anchor = pathToFileURL(join5(currentBinaryDir, "package.json"));
     const req = createRequire(anchor);
     searchPaths = req.resolve.paths(DAEMON_PACKAGE_NAME);
   } catch {
@@ -1719,9 +2386,9 @@ async function defaultReadInstalledDaemonVersion(currentBinaryDir) {
   if (!searchPaths || searchPaths.length === 0) return null;
   const subPath = DAEMON_PACKAGE_NAME.split("/");
   for (const base of searchPaths) {
-    const candidate = join3(base, ...subPath, "package.json");
+    const candidate = join5(base, ...subPath, "package.json");
     try {
-      const raw = await readFile8(candidate, "utf8");
+      const raw = await readFile10(candidate, "utf8");
       const parsed = JSON.parse(raw);
       if (parsed.name !== DAEMON_PACKAGE_NAME) continue;
       if (typeof parsed.version === "string" && parsed.version.length > 0) {
@@ -1800,13 +2467,13 @@ function satisfiesTilde(ver, base) {
 
 // src/upgrade.ts
 function upgradeStagingDir(slockHome, version) {
-  return join4(computerDir(slockHome), "upgrade-staging", version);
+  return join6(computerDir(slockHome), "upgrade-staging", version);
 }
 async function stagePhase(slockHome, version, deps = {}) {
   const npmPack = deps.npmPack ?? defaultNpmPack;
-  const fsReadFile = deps.fsReadFile ?? readFile9;
+  const fsReadFile = deps.fsReadFile ?? readFile11;
   const stagedPath = upgradeStagingDir(slockHome, version);
-  await mkdir9(stagedPath, { recursive: true });
+  await mkdir10(stagedPath, { recursive: true });
   const packageRef = `@slock-ai/computer@${version}`;
   const result = await npmPack(stagedPath, packageRef);
   if (result.exitCode !== 0) {
@@ -1825,7 +2492,7 @@ async function stagePhase(slockHome, version, deps = {}) {
     err.code = "UPGRADE_DOWNLOAD_FAILED";
     throw err;
   }
-  const tarballSha1 = createHash("sha1").update(tarballBytes).digest("hex");
+  const tarballSha1 = createHash3("sha1").update(tarballBytes).digest("hex");
   return { stagedPath, version, tarballSha1 };
 }
 function defaultNpmPack(cwd, packageRef) {
@@ -1857,7 +2524,7 @@ function defaultNpmPack(cwd, packageRef) {
           resolve({ tarballPath: "", exitCode: 1, stderr: "npm pack returned no filename" });
           return;
         }
-        resolve({ tarballPath: join4(cwd, filename), exitCode: 0, stderr: stderrBuf });
+        resolve({ tarballPath: join6(cwd, filename), exitCode: 0, stderr: stderrBuf });
       } catch (e) {
         resolve({ tarballPath: "", exitCode: 1, stderr: `parse npm pack output: ${e}` });
       }
@@ -1912,13 +2579,13 @@ async function cleanupStaged(slockHome, version) {
   }
 }
 function upgradeSnapshotPath(slockHome) {
-  return join4(computerDir(slockHome), "upgrade-snapshot.json");
+  return join6(computerDir(slockHome), "upgrade-snapshot.json");
 }
 async function snapshotPhase(slockHome, snap) {
   const path2 = upgradeSnapshotPath(slockHome);
   const tmp = `${path2}.tmp`;
-  await mkdir9(computerDir(slockHome), { recursive: true });
-  await writeFile7(tmp, JSON.stringify(snap, null, 2), { mode: 384 });
+  await mkdir10(computerDir(slockHome), { recursive: true });
+  await writeFile8(tmp, JSON.stringify(snap, null, 2), { mode: 384 });
   await rename3(tmp, path2);
 }
 async function clearUpgradeSnapshot(slockHome) {
@@ -1930,7 +2597,7 @@ async function clearUpgradeSnapshot(slockHome) {
 }
 async function extractTarball(tarballPath, destDir, deps = {}) {
   const tarSpawn = deps.tarSpawn ?? defaultTarSpawn;
-  await mkdir9(destDir, { recursive: true });
+  await mkdir10(destDir, { recursive: true });
   const result = await tarSpawn(tarballPath, destDir);
   if (result.exitCode !== 0) {
     const err = new Error(
@@ -1939,7 +2606,7 @@ async function extractTarball(tarballPath, destDir, deps = {}) {
     err.code = "UPGRADE_EXTRACT_FAILED";
     throw err;
   }
-  return { extractedPackageDir: join4(destDir, "package") };
+  return { extractedPackageDir: join6(destDir, "package") };
 }
 function defaultTarSpawn(tarballPath, destDir) {
   return new Promise((resolve) => {
@@ -1995,7 +2662,7 @@ async function rollbackSwap(currentBinaryDir, deps = {}) {
 }
 async function rollbackRestart(slockHome, currentBinaryDir, deps = {}) {
   const readSupervisorPid = deps.readSupervisorPid ?? (() => defaultReadSupervisorPid(slockHome));
-  const isProcessAlive2 = deps.isProcessAlive ?? defaultIsProcessAlive;
+  const isProcessAlive3 = deps.isProcessAlive ?? defaultIsProcessAlive;
   const killSupervisor = deps.killSupervisor ?? defaultKillSupervisor;
   const forceKillSupervisor = deps.forceKillSupervisor ?? defaultForceKillSupervisor;
   const waitForExit = deps.waitForExit ?? defaultWaitForExit;
@@ -2006,7 +2673,7 @@ async function rollbackRestart(slockHome, currentBinaryDir, deps = {}) {
   let supervisorStopped = false;
   try {
     const pid = await readSupervisorPid();
-    if (pid === null || !isProcessAlive2(pid)) {
+    if (pid === null || !isProcessAlive3(pid)) {
       supervisorStopped = true;
     } else {
       await killSupervisor(pid);
@@ -2149,7 +2816,7 @@ async function restartPhase(slockHome, deps = {}) {
 }
 async function defaultReadSupervisorPid(slockHome) {
   try {
-    const raw = (await readFile9(supervisorPidPath(slockHome), "utf8")).trim();
+    const raw = (await readFile11(supervisorPidPath(slockHome), "utf8")).trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
@@ -2290,7 +2957,7 @@ async function runUpgrade(slockHome, opts) {
   try {
     const ex = await extractTarball(
       stagedTarballPath,
-      join4(staged.stagedPath, "extracted"),
+      join6(staged.stagedPath, "extracted"),
       { tarSpawn: deps.tarSpawn }
     );
     extractedPackageDir = ex.extractedPackageDir;
@@ -2398,7 +3065,7 @@ async function runUpgrade(slockHome, opts) {
 async function rollingDaemonHealthCheck(slockHome, deps = {}) {
   const list = deps.listManagedServerIds ?? listManagedServerIds;
   const readDaemonPid = deps.readDaemonPid ?? defaultReadDaemonPid;
-  const isProcessAlive2 = deps.isProcessAlive ?? defaultIsProcessAlive;
+  const isProcessAlive3 = deps.isProcessAlive ?? defaultIsProcessAlive;
   const perDaemonTimeoutMs = deps.perDaemonTimeoutMs ?? 3e4;
   const pollIntervalMs = deps.pollIntervalMs ?? 500;
   const managed = await list(slockHome);
@@ -2411,7 +3078,7 @@ async function rollingDaemonHealthCheck(slockHome, deps = {}) {
       const pid = await readDaemonPid(slockHome, serverId);
       if (pid === null) {
         lastReason = "pidfile_missing";
-      } else if (!isProcessAlive2(pid)) {
+      } else if (!isProcessAlive3(pid)) {
         lastReason = "process_dead";
       } else {
         healthy = true;
@@ -2429,7 +3096,7 @@ async function rollingDaemonHealthCheck(slockHome, deps = {}) {
 }
 async function defaultReadDaemonPid(slockHome, serverId) {
   try {
-    const raw = (await readFile9(serverDaemonPidPath(slockHome, serverId), "utf8")).trim();
+    const raw = (await readFile11(serverDaemonPidPath(slockHome, serverId), "utf8")).trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
@@ -2446,13 +3113,13 @@ function defaultIsProcessAlive(pid) {
   }
 }
 async function locateStagedTarball(stagedPath) {
-  const { readdir: readdir4 } = await import("fs/promises");
-  const entries = await readdir4(stagedPath);
+  const { readdir: readdir5 } = await import("fs/promises");
+  const entries = await readdir5(stagedPath);
   const tgz = entries.find((e) => e.endsWith(".tgz"));
   if (!tgz) {
     throw new Error(`no .tgz tarball found in staged dir ${stagedPath}`);
   }
-  return join4(stagedPath, tgz);
+  return join6(stagedPath, tgz);
 }
 
 // src/upgradeCli.ts
@@ -2614,12 +3281,12 @@ async function defaultFetchDistTags() {
 }
 function defaultCurrentBinaryDir() {
   const here = fileURLToPath2(import.meta.url);
-  return dirname8(dirname8(here));
+  return dirname9(dirname9(here));
 }
 async function defaultCurrentVersion() {
-  const pkgPath = join5(defaultCurrentBinaryDir(), "package.json");
+  const pkgPath = join7(defaultCurrentBinaryDir(), "package.json");
   try {
-    const raw = await readFile10(pkgPath, "utf8");
+    const raw = await readFile12(pkgPath, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
@@ -2630,9 +3297,9 @@ async function defaultCurrentVersion() {
 }
 
 // src/upgradeTestHarness.ts
-import { mkdir as mkdir10, readdir as readdir3, stat as stat2, writeFile as writeFile8 } from "fs/promises";
-import { join as join6 } from "path";
-import { createHash as createHash2 } from "crypto";
+import { mkdir as mkdir11, readdir as readdir4, stat as stat3, writeFile as writeFile9 } from "fs/promises";
+import { join as join8 } from "path";
+import { createHash as createHash4 } from "crypto";
 var PHASES = /* @__PURE__ */ new Set([
   "stage",
   "verify",
@@ -2664,7 +3331,7 @@ function buildSimulatedDeps(slockHome, opts) {
   const targetVersion = opts.targetVersion ?? "0.99.0";
   const fromVersion = opts.fromVersion ?? "0.0.0-test";
   const tarballBytes = Buffer.from(`harness-tarball-${targetVersion}`, "utf8");
-  const expectedSha = createHash2("sha1").update(tarballBytes).digest("hex");
+  const expectedSha = createHash4("sha1").update(tarballBytes).digest("hex");
   const sleepMs = opts.simulateSleepWakeMs ?? 0;
   const maybeSleep = async () => {
     if (sleepMs > 0) {
@@ -2678,7 +3345,7 @@ function buildSimulatedDeps(slockHome, opts) {
       targetVersion,
       fromVersion,
       channel: "latest",
-      currentBinaryDir: join6(slockHome, "harness-current"),
+      currentBinaryDir: join8(slockHome, "harness-current"),
       drainMode: opts.drain,
       deps: {
         npmPack: async (cwd) => {
@@ -2689,8 +3356,8 @@ function buildSimulatedDeps(slockHome, opts) {
             return { tarballPath: "", exitCode: 1, stderr: "simulated stage failure" };
           }
           const filename = `slock-ai-computer-${targetVersion}.tgz`;
-          await writeFile8(join6(cwd, filename), tarballBytes);
-          return { tarballPath: join6(cwd, filename), exitCode: 0, stderr: "" };
+          await writeFile9(join8(cwd, filename), tarballBytes);
+          return { tarballPath: join8(cwd, filename), exitCode: 0, stderr: "" };
         },
         fetchAdvertisedHash: async () => {
           if (opts.simulateNetworkLossAt === "verify") return null;
@@ -2701,8 +3368,8 @@ function buildSimulatedDeps(slockHome, opts) {
           if (opts.simulateFail === "extract") {
             return { exitCode: 1, stderr: "simulated extract failure" };
           }
-          await mkdir10(join6(destDir, "package"), { recursive: true });
-          await writeFile8(join6(destDir, "package", "marker.txt"), `NEW@${targetVersion}`);
+          await mkdir11(join8(destDir, "package"), { recursive: true });
+          await writeFile9(join8(destDir, "package", "marker.txt"), `NEW@${targetVersion}`);
           return { exitCode: 0, stderr: "" };
         },
         fsRename: opts.simulateFail === "swap" ? async () => {
@@ -2761,12 +3428,12 @@ function buildSimulatedDeps(slockHome, opts) {
   };
 }
 async function arrangeSnapshotFailure(slockHome) {
-  const snapshotPath = join6(slockHome, "computer", "upgrade-snapshot.json");
-  await mkdir10(snapshotPath, { recursive: true });
+  const snapshotPath = join8(slockHome, "computer", "upgrade-snapshot.json");
+  await mkdir11(snapshotPath, { recursive: true });
 }
 async function pathInfo(path2) {
   try {
-    const s = await stat2(path2);
+    const s = await stat3(path2);
     if (s.isDirectory()) return { kind: "dir", size: 0 };
     if (s.isFile()) return { kind: "file", size: s.size };
     return null;
@@ -2780,14 +3447,14 @@ async function captureStateSnapshot(slockHome, version, currentBinaryDir) {
   let stagingEntries = null;
   if (stagingExists?.kind === "dir") {
     try {
-      stagingEntries = (await readdir3(stagingPath)).sort();
+      stagingEntries = (await readdir4(stagingPath)).sort();
     } catch {
       stagingEntries = null;
     }
   }
   let servers = [];
   try {
-    const ids = await readdir3(serversDir(slockHome));
+    const ids = await readdir4(serversDir(slockHome));
     servers = await Promise.all(
       ids.map(async (serverId) => ({
         serverId,
@@ -2802,7 +3469,7 @@ async function captureStateSnapshot(slockHome, version, currentBinaryDir) {
     stagingDir: stagingExists,
     stagingEntries,
     supervisorPid: await pathInfo(supervisorPidPath(slockHome)),
-    channelFile: await pathInfo(join6(computerDir(slockHome), "channel")),
+    channelFile: await pathInfo(join8(computerDir(slockHome), "channel")),
     computerDir: await pathInfo(computerDir(slockHome)),
     servers,
     prevBinary: await pathInfo(currentBinaryDir + ".prev"),
@@ -2817,12 +3484,12 @@ async function runUpgradeTestHarness(slockHome, opts, writer = (s) => process.st
     process.exitCode = 1;
     return;
   }
-  await mkdir10(slockHome, { recursive: true });
+  await mkdir11(slockHome, { recursive: true });
   if (opts.simulateFail === "snapshot") {
     await arrangeSnapshotFailure(slockHome);
   }
   const { opts: upgradeOpts } = buildSimulatedDeps(slockHome, opts);
-  await mkdir10(upgradeOpts.currentBinaryDir, { recursive: true });
+  await mkdir11(upgradeOpts.currentBinaryDir, { recursive: true });
   let outcome;
   try {
     outcome = await runUpgrade(slockHome, upgradeOpts);
@@ -2859,9 +3526,9 @@ async function runUpgradeTestHarness(slockHome, opts, writer = (s) => process.st
 }
 
 // src/upgradeInstallSmoke.ts
-import { copyFile, mkdir as mkdir11, readFile as readFile11 } from "fs/promises";
-import { createHash as createHash3 } from "crypto";
-import { dirname as dirname9, isAbsolute, join as join7, resolve as pathResolve } from "path";
+import { copyFile, mkdir as mkdir12, readFile as readFile13 } from "fs/promises";
+import { createHash as createHash5 } from "crypto";
+import { dirname as dirname10, isAbsolute, join as join9, resolve as pathResolve } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
   if (typeof opts.packageTarball !== "string" || opts.packageTarball.trim().length === 0) {
@@ -2870,19 +3537,19 @@ async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
   const tarballPath = isAbsolute(opts.packageTarball) ? opts.packageTarball : pathResolve(opts.packageTarball);
   let tarballBytes;
   try {
-    tarballBytes = await readFile11(tarballPath);
+    tarballBytes = await readFile13(tarballPath);
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     throw new Error(`__upgrade-install-smoke: cannot read --package-tarball ${tarballPath}: ${msg}`);
   }
-  const tarballSha1 = createHash3("sha1").update(tarballBytes).digest("hex");
+  const tarballSha1 = createHash5("sha1").update(tarballBytes).digest("hex");
   const currentBinaryDir = opts.currentBinaryDir ?? (deps.currentBinaryDir ?? defaultCurrentBinaryDirLocal)();
   const fromVersion = opts.fromVersion ?? await (deps.currentVersion ?? defaultCurrentVersionLocal)();
   const channel2 = opts.channel ?? "latest";
   const spawnFreshSupervisor = deps.spawnFreshSupervisor ?? (async (h) => {
     await spawnDetachedSupervisor(h);
   });
-  await mkdir11(slockHome, { recursive: true });
+  await mkdir12(slockHome, { recursive: true });
   const outcome = await runUpgrade(slockHome, {
     targetVersion: opts.targetVersion,
     fromVersion,
@@ -2895,7 +3562,7 @@ async function runUpgradeInstallSmoke(slockHome, opts, deps = {}) {
       // other dep falls back to its production default.
       npmPack: async (cwd) => {
         const filename = `slock-ai-computer-${opts.targetVersion}.tgz`;
-        const stagedTarball = join7(cwd, filename);
+        const stagedTarball = join9(cwd, filename);
         await copyFile(tarballPath, stagedTarball);
         return { tarballPath: stagedTarball, exitCode: 0, stderr: "" };
       },
@@ -2935,12 +3602,12 @@ async function runUpgradeInstallSmokeCli(slockHome, opts, writer = (s) => proces
 }
 function defaultCurrentBinaryDirLocal() {
   const here = fileURLToPath3(import.meta.url);
-  return dirname9(dirname9(here));
+  return dirname10(dirname10(here));
 }
 async function defaultCurrentVersionLocal() {
-  const pkgPath = join7(defaultCurrentBinaryDirLocal(), "package.json");
+  const pkgPath = join9(defaultCurrentBinaryDirLocal(), "package.json");
   try {
-    const raw = await readFile11(pkgPath, "utf8");
+    const raw = await readFile13(pkgPath, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.version === "string" && parsed.version.length > 0) {
       return parsed.version;
@@ -2971,43 +3638,83 @@ program.name("slock-computer").description("Slock Computer \u2014 local-machine
 program.command("login").description("Log in via device-code (one user identity per Computer / SLOCK_HOME).").option("--server-url <url>", "Slock API base URL; defaults to SLOCK_SERVER_URL").action(withCliExit(async (opts) => {
   await runLogin({ serverUrl: opts.serverUrl });
 }));
-program.command("attach").argument("<serverId>", "target Slock server id").description("Attach this Computer to one Slock server (add-not-replace; multi-server OK).").option("--server-url <url>", "Slock API base URL; defaults to SLOCK_SERVER_URL").option("--no-run", "only authorize + write local state; do not start the supervisor").option("--foreground", "run the supervisor in this terminal instead of the background").action(withCliExit(async (serverId, opts) => {
+program.command("attach").argument("<serverSlug>", "target Slock server slug (canonical form `/myserver`; bare `myserver` accepted)").description("Attach this Computer to one Slock server (add-not-replace; multi-server OK).").option("--server-url <url>", "Slock API base URL; defaults to SLOCK_SERVER_URL").option("--name <name>", "Computer display name; defaults to a sanitized hostname").option("--no-run", "only authorize + write local state; do not start the supervisor").option("--foreground", "run the supervisor in this terminal instead of the background").action(withCliExit(async (serverSlug, opts) => {
   await withMutationLock(
-    () => runAttach({ serverId, serverUrl: opts.serverUrl, run: opts.run, foreground: opts.foreground })
+    () => runAttach({ serverSlug, serverUrl: opts.serverUrl, name: opts.name, run: opts.run, foreground: opts.foreground })
   );
 }));
-program.command("detach").argument("<serverId>", "server id to detach from this Computer").description("Remove ONE server's local attachment; never touches user-session or other servers.").action(withCliExit(async (serverId) => {
-  await withMutationLock(() => runDetach(serverId));
+program.command("setup").argument("<serverSlug>", "target Slock server slug (canonical form `/myserver`; bare `myserver` accepted)").description("Set up this Computer for one server: login if needed, attach/adopt if needed, then start.").option("--server-url <url>", "Slock API base URL; defaults to SLOCK_SERVER_URL or the saved user session").option("--name <name>", "Computer display name for a new attachment/adoption; defaults to a sanitized hostname").option("--adopt-legacy", "attempt one-time migration from a legacy daemon before fresh attach fallback").option("--legacy-api-key <key>", "legacy key for --adopt-legacy (migration-only; prefer file/stdin)").option("--legacy-api-key-file <path>", "path to a file containing the legacy key for --adopt-legacy").option("--legacy-api-key-stdin", "read the legacy key from stdin for --adopt-legacy").option("--no-start", "stop after login + attach/adopt; do not start the supervisor").option("--foreground", "run the supervisor in this terminal instead of the background").option("-y, --yes", "allow non-interactive setup after confirming the planned actions").action(
+  withCliExit(async (serverSlug, opts) => {
+    await withMutationLock(
+      () => runSetup({
+        serverSlug,
+        serverUrl: opts.serverUrl,
+        name: opts.name,
+        adoptLegacy: opts.adoptLegacy,
+        legacyApiKey: opts.legacyApiKey,
+        legacyApiKeyFile: opts.legacyApiKeyFile,
+        legacyApiKeyStdin: opts.legacyApiKeyStdin,
+        start: opts.start,
+        foreground: opts.foreground,
+        yes: opts.yes
+      })
+    );
+  })
+);
+program.command("adopt-legacy").argument("<serverSlug>", "target Slock server slug (the legacy machine's server)").description(
+  "One-time migration: trade a legacy sk_machine_* / sk_daemon_* key for a fresh Computer attachment (sk_computer_*)."
+).option("--server-url <url>", "Slock API base URL; defaults to SLOCK_SERVER_URL").option("--name <name>", "name to record on the new Computer attachment (default: existing machine name)").option("--legacy-api-key <key>", "raw legacy key on argv (insecure on shared shells; prefer --legacy-api-key-file or stdin)").option("--legacy-api-key-file <path>", "path to a 0600 file containing the legacy key (one line)").option("--legacy-api-key-stdin", "read the legacy key from stdin").action(
+  withCliExit(async (serverSlug, opts) => {
+    await withMutationLock(
+      () => runAdoptLegacy({
+        serverSlug,
+        serverUrl: opts.serverUrl,
+        name: opts.name,
+        legacyApiKey: opts.legacyApiKey,
+        legacyApiKeyFile: opts.legacyApiKeyFile,
+        legacyApiKeyStdin: opts.legacyApiKeyStdin
+      })
+    );
+  })
+);
+program.command("detach").argument("<serverSlug>", "server slug to detach from this Computer (canonical form `/myserver`)").description("Remove ONE server's local attachment; never touches user-session or other servers.").action(withCliExit(async (serverSlug) => {
+  await withMutationLock(async () => runDetach(await resolveTargetServerId({ server: serverSlug }), serverSlug));
 }));
 program.command("status").description("Show this Computer's aggregate state (login + supervisor + per-server daemons).").option("--json", "emit the machine-readable report").action(withCliExit(async (opts) => {
   await runStatus({ json: opts.json });
 }));
-program.command("start").argument("[serverId]", "optional: verify this server is attached and ensure its daemon is reconciled (default: ensure all attached)").description("Start/ensure the Computer supervisor (manages all per-server daemons).").option("--foreground", "stay in this terminal instead of detaching").action(withCliExit(async (serverId, opts) => {
+program.command("start").argument("[serverSlug]", "optional: verify this server is attached and ensure its daemon is reconciled (default: ensure all attached)").description("Start/ensure the Computer supervisor (manages all per-server daemons).").option("--foreground", "stay in this terminal instead of detaching").action(withCliExit(async (serverSlug, opts) => {
   await withMutationLock(
-    () => runStart({ foreground: opts.foreground, serverId: serverId ?? null })
+    async () => runStart({
+      foreground: opts.foreground,
+      serverId: serverSlug ? await resolveTargetServerId({ server: serverSlug }) : null,
+      serverLabel: serverSlug ?? null
+    })
   );
 }));
-program.command("doctor").argument("[serverId]", "optional: scope detail (recent crashes) to one server").description("Diagnose login + per-server attachments + per-server preflight (no secrets).").option("--json", "emit the machine-readable report").option("--cleanup", "after diagnosis, run the local residue cleanup pass").option("--fix", "alias for --cleanup (same behavior)").option("--reset-health", "clear <serverId>'s crash history so supervisor resumes auto-restart").action(
+program.command("doctor").argument("[serverSlug]", "optional: scope detail (recent crashes) to one server").description("Diagnose login + per-server attachments + per-server preflight (no secrets).").option("--json", "emit the machine-readable report").option("--cleanup", "after diagnosis, run the local residue cleanup pass").option("--fix", "alias for --cleanup (same behavior)").option("--reset-health", "clear <serverSlug>'s crash history so supervisor resumes auto-restart").action(
   withCliExit(
-    async (serverId, opts) => {
+    async (serverSlug, opts) => {
+      const serverId = serverSlug ? await resolveTargetServerId({ server: serverSlug }) : void 0;
       await runDoctor({
         json: opts.json,
         cleanup: opts.cleanup,
         fix: opts.fix,
         serverId,
+        serverLabel: serverSlug,
         resetHealth: opts.resetHealth
       });
     }
   )
 );
-program.command("logs").description("Tail one server's daemon log (or the supervisor log); secrets redacted.").option("--lines <n>", "trailing lines to show (default 200)", (v) => Number.parseInt(v, 10)).option("--server <id>", "select target server (required when \u22652 attached)").option("--supervisor", "tail the global supervisor log instead of a per-server daemon log").action(withCliExit(async (opts) => {
+program.command("logs").description("Tail one server's daemon log (or the supervisor log); secrets redacted.").option("--lines <n>", "trailing lines to show (default 200)", (v) => Number.parseInt(v, 10)).option("--server <slug>", "select target server slug (required when \u22652 attached)").option("--supervisor", "tail the global supervisor log instead of a per-server daemon log").action(withCliExit(async (opts) => {
   await runLogs({ lines: opts.lines, server: opts.server ?? null, supervisor: !!opts.supervisor });
 }));
 var runners = program.command("runners").description("Computer runner control plane (per-server scoped; \xA712 whitelist server-side).");
-runners.command("list").description("List runners on one attached server.").option("--json", "emit the machine-readable list").option("--server <id>", "select target server (required when \u22652 attached)").action(withCliExit(async (opts) => {
+runners.command("list").description("List runners on one attached server.").option("--json", "emit the machine-readable list").option("--server <slug>", "select target server slug (required when \u22652 attached)").action(withCliExit(async (opts) => {
   await runRunnersList({ json: opts.json, server: opts.server ?? null });
 }));
-runners.command("stop").argument("<agentId>", "id of the runner to stop").option("--server <id>", "select target server (required when \u22652 attached)").description("Stop a runner (server-mediated; reuses the orchestrator's agent stop).").action(withCliExit(async (agentId, opts) => {
+runners.command("stop").argument("<agentId>", "id of the runner to stop").option("--server <slug>", "select target server slug (required when \u22652 attached)").description("Stop a runner (server-mediated; reuses the orchestrator's agent stop).").action(withCliExit(async (agentId, opts) => {
   await withMutationLock(() => runRunnersStop(agentId, { server: opts.server ?? null }));
 }));
 var channel = program.command("channel").description("Show or set the Computer release channel (latest | alpha | pinned:<semver>).");
@@ -3094,6 +3801,21 @@ program.command("__upgrade-install-smoke", { hidden: true }).requiredOption("--p
     );
   })
 );
+{
+  const argv = process.argv.slice(2);
+  const isAdopt = argv[0] === "adopt-legacy";
+  const isSetup = argv[0] === "setup";
+  const strayLegacyFlag = argv.find(
+    (a) => a === "--legacy-api-key" || a.startsWith("--legacy-api-key=") || a === "--legacy-api-key-file" || a.startsWith("--legacy-api-key-file=") || a === "--legacy-api-key-stdin"
+  );
+  if (strayLegacyFlag && !isAdopt && !isSetup) {
+    process.stderr.write(
+      `slock-computer: LEGACY_KEY_OUTSIDE_ADOPT: ${strayLegacyFlag} is only accepted by \`slock-computer adopt-legacy\` or \`slock-computer setup --adopt-legacy\`. Remove it or run an adopt flow.
+`
+    );
+    process.exit(2);
+  }
+}
 program.parseAsync(process.argv).catch((err) => {
   process.stderr.write(`slock-computer: ${err instanceof Error ? err.message : String(err)}
 `);