@slock-ai/computer 0.0.16 → 0.0.18

package/dist/index.js

@@ -5729,9 +5729,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve, reject) => {
+          return new Promise((resolve2, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve(data);
+              return err ? reject(err) : resolve2(data);
             });
           });
         }
@@ -5769,9 +5769,9 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve, reject) => {
+          return new Promise((resolve2, reject) => {
             this.destroy(err, (err2, data) => {
-              return err2 ? reject(err2) : resolve(data);
+              return err2 ? reject(err2) : resolve2(data);
             });
           });
         }
@@ -9264,8 +9264,8 @@ var require_promise = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve, reject) => {
-        res = resolve;
+      const promise = new Promise((resolve2, reject) => {
+        res = resolve2;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -10568,12 +10568,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve, reject) => {
+      const waitForDrain = () => new Promise((resolve2, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve;
+          callback = resolve2;
         }
       });
       socket.on("close", onDrain).on("drain", onDrain);
@@ -11419,12 +11419,12 @@ var require_client_h2 = __commonJS({
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve, reject) => {
+      const waitForDrain = () => new Promise((resolve2, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve;
+          callback = resolve2;
         }
       });
       h2stream.on("close", onDrain).on("drain", onDrain);
@@ -11736,16 +11736,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       [kClose]() {
-        return new Promise((resolve) => {
+        return new Promise((resolve2) => {
           if (this[kSize]) {
-            this[kClosedResolve] = resolve;
+            this[kClosedResolve] = resolve2;
           } else {
-            resolve(null);
+            resolve2(null);
           }
         });
       }
       [kDestroy](err) {
-        return new Promise((resolve) => {
+        return new Promise((resolve2) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests.length; i++) {
             const request = requests[i];
@@ -11756,7 +11756,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve(null);
+            resolve2(null);
           };
           if (this[kHTTPContext]) {
             this[kHTTPContext].destroy(err, callback);
@@ -12163,8 +12163,8 @@ var require_pool_base = __commonJS({
           }
           return Promise.all(closeAll);
         } else {
-          return new Promise((resolve) => {
-            this[kClosedResolve] = resolve;
+          return new Promise((resolve2) => {
+            this[kClosedResolve] = resolve2;
           });
         }
       }
@@ -13263,10 +13263,10 @@ var require_socks5_proxy_agent = __commonJS({
         const proxyHost = this[kProxyUrl].hostname;
         const proxyPort = parseInt(this[kProxyUrl].port) || 1080;
         debug("creating SOCKS5 connection to", proxyHost, proxyPort);
-        const socket = await new Promise((resolve, reject) => {
+        const socket = await new Promise((resolve2, reject) => {
           const onConnect = () => {
             socket2.removeListener("error", onError);
-            resolve(socket2);
+            resolve2(socket2);
           };
           const onError = (err) => {
             socket2.removeListener("connect", onConnect);
@@ -13285,14 +13285,14 @@ var require_socks5_proxy_agent = __commonJS({
           socket.destroy();
         });
         await socks5Client.handshake();
-        await new Promise((resolve, reject) => {
+        await new Promise((resolve2, reject) => {
           const timeout = setTimeout(() => {
             reject(new Error("SOCKS5 authentication timeout"));
           }, 5e3);
           const onAuthenticated = () => {
             clearTimeout(timeout);
             socks5Client.removeListener("error", onError);
-            resolve();
+            resolve2();
           };
           const onError = (err) => {
             clearTimeout(timeout);
@@ -13301,14 +13301,14 @@ var require_socks5_proxy_agent = __commonJS({
           };
           if (socks5Client.state === "authenticated") {
             clearTimeout(timeout);
-            resolve();
+            resolve2();
           } else {
             socks5Client.once("authenticated", onAuthenticated);
             socks5Client.once("error", onError);
           }
         });
         await socks5Client.connect(targetHost, targetPort);
-        await new Promise((resolve, reject) => {
+        await new Promise((resolve2, reject) => {
           const timeout = setTimeout(() => {
             reject(new Error("SOCKS5 connection timeout"));
           }, 5e3);
@@ -13316,7 +13316,7 @@ var require_socks5_proxy_agent = __commonJS({
             debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info2);
             clearTimeout(timeout);
             socks5Client.removeListener("error", onError);
-            resolve();
+            resolve2();
           };
           const onError = (err) => {
             clearTimeout(timeout);
@@ -13357,8 +13357,8 @@ var require_socks5_proxy_agent = __commonJS({
                       servername: targetHost,
                       ...connectOpts.tls || {}
                     });
-                    await new Promise((resolve, reject) => {
-                      finalSocket.once("secureConnect", resolve);
+                    await new Promise((resolve2, reject) => {
+                      finalSocket.once("secureConnect", resolve2);
                       finalSocket.once("error", reject);
                     });
                   }
@@ -14389,7 +14389,7 @@ var require_readable = __commonJS({
         if (this._readableState.closeEmitted) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve2, reject) => {
           if (this[kContentLength] && this[kContentLength] > limit || this[kBytesRead] > limit) {
             this.destroy(new AbortError());
           }
@@ -14403,11 +14403,11 @@ var require_readable = __commonJS({
               if (signal.aborted) {
                 reject(signal.reason ?? new AbortError());
               } else {
-                resolve(null);
+                resolve2(null);
               }
             });
           } else {
-            this.on("close", resolve);
+            this.on("close", resolve2);
           }
           this.on("error", noop).on("data", () => {
             if (this[kBytesRead] > limit) {
@@ -14435,7 +14435,7 @@ var require_readable = __commonJS({
     }
     function consume(stream, type) {
       assert(!stream[kConsume]);
-      return new Promise((resolve, reject) => {
+      return new Promise((resolve2, reject) => {
         if (isUnusable(stream)) {
           const rState = stream._readableState;
           if (rState.destroyed && rState.closeEmitted === false) {
@@ -14450,7 +14450,7 @@ var require_readable = __commonJS({
             stream[kConsume] = {
               type,
               stream,
-              resolve,
+              resolve: resolve2,
               reject,
               length: 0,
               body: []
@@ -14524,18 +14524,18 @@ var require_readable = __commonJS({
       return buffer;
     }
     function consumeEnd(consume2, encoding) {
-      const { type, body, resolve, stream, length } = consume2;
+      const { type, body, resolve: resolve2, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve(chunksDecode(body, length, encoding));
+          resolve2(chunksDecode(body, length, encoding));
         } else if (type === "json") {
-          resolve(JSON.parse(chunksDecode(body, length, encoding)));
+          resolve2(JSON.parse(chunksDecode(body, length, encoding)));
         } else if (type === "arrayBuffer") {
-          resolve(chunksConcat(body, length).buffer);
+          resolve2(chunksConcat(body, length).buffer);
         } else if (type === "blob") {
-          resolve(new Blob(body, { type: stream[kContentType] }));
+          resolve2(new Blob(body, { type: stream[kContentType] }));
         } else if (type === "bytes") {
-          resolve(chunksConcat(body, length));
+          resolve2(chunksConcat(body, length));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -14726,9 +14726,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve2, reject) => {
           request.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve2(data);
           });
         });
       }
@@ -14942,9 +14942,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve2, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve2(data);
           });
         });
       }
@@ -15234,9 +15234,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve2, reject) => {
           upgrade.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve2(data);
           });
         });
       }
@@ -15330,9 +15330,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve, reject) => {
+        return new Promise((resolve2, reject) => {
           connect.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve(data);
+            return err ? reject(err) : resolve2(data);
           });
         });
       }
@@ -16618,7 +16618,7 @@ var require_snapshot_recorder = __commonJS({
     "use strict";
     init_esm_shims();
     var { writeFile: writeFile13, readFile: readFile17, mkdir: mkdir17 } = __require("fs/promises");
-    var { dirname: dirname14, resolve } = __require("path");
+    var { dirname: dirname14, resolve: resolve2 } = __require("path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("timers");
     var { InvalidArgumentError: InvalidArgumentError2, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -16819,7 +16819,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile17(resolve(path3), "utf8");
+          const data = await readFile17(resolve2(path3), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -16848,7 +16848,7 @@ var require_snapshot_recorder = __commonJS({
         if (!path3) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path3);
+        const resolvedPath = resolve2(path3);
         await mkdir17(dirname14(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
@@ -23714,7 +23714,7 @@ var require_fetch = __commonJS({
         const agent = fetchParams.controller.dispatcher;
         const path3 = url.pathname + url.search;
         const hasTrailingQuestionMark = url.search.length === 0 && url.href[url.href.length - url.hash.length - 1] === "?";
-        return new Promise((resolve, reject) => agent.dispatch(
+        return new Promise((resolve2, reject) => agent.dispatch(
           {
             path: hasTrailingQuestionMark ? `${path3}?` : path3,
             origin: url.origin,
@@ -23802,7 +23802,7 @@ var require_fetch = __commonJS({
                 }
               }
               const onError = this.onError.bind(this);
-              resolve({
+              resolve2({
                 status,
                 statusText,
                 headersList,
@@ -23855,7 +23855,7 @@ var require_fetch = __commonJS({
                   headersList.append(headerName, String(value), true);
                 }
               }
-              resolve({
+              resolve2({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList,
@@ -23879,7 +23879,7 @@ var require_fetch = __commonJS({
                   headersList.append(nameStr, value.toString("latin1"), true);
                 }
               }
-              resolve({
+              resolve2({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList,
@@ -29193,11 +29193,11 @@ var require_mtime_precision = __commonJS({
     function probe(file, fs, callback) {
       const cachedPrecision = fs[cacheSymbol];
       if (cachedPrecision) {
-        return fs.stat(file, (err, stat4) => {
+        return fs.stat(file, (err, stat5) => {
           if (err) {
             return callback(err);
           }
-          callback(null, stat4.mtime, cachedPrecision);
+          callback(null, stat5.mtime, cachedPrecision);
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
@@ -29205,13 +29205,13 @@ var require_mtime_precision = __commonJS({
         if (err) {
           return callback(err);
         }
-        fs.stat(file, (err2, stat4) => {
+        fs.stat(file, (err2, stat5) => {
           if (err2) {
             return callback(err2);
           }
-          const precision = stat4.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
+          const precision = stat5.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
           Object.defineProperty(fs, cacheSymbol, { value: precision });
-          callback(null, stat4.mtime, precision);
+          callback(null, stat5.mtime, precision);
         });
       });
     }
@@ -29266,14 +29266,14 @@ var require_lockfile = __commonJS({
         if (options.stale <= 0) {
           return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
         }
-        options.fs.stat(lockfilePath, (err2, stat4) => {
+        options.fs.stat(lockfilePath, (err2, stat5) => {
           if (err2) {
             if (err2.code === "ENOENT") {
               return acquireLock(file, { ...options, stale: 0 }, callback);
             }
             return callback(err2);
           }
-          if (!isLockStale(stat4, options)) {
+          if (!isLockStale(stat5, options)) {
             return callback(Object.assign(new Error("Lock file is already being held"), { code: "ELOCKED", file }));
           }
           removeLock(file, options, (err3) => {
@@ -29285,8 +29285,8 @@ var require_lockfile = __commonJS({
         });
       });
     }
-    function isLockStale(stat4, options) {
-      return stat4.mtime.getTime() < Date.now() - options.stale;
+    function isLockStale(stat5, options) {
+      return stat5.mtime.getTime() < Date.now() - options.stale;
     }
     function removeLock(file, options, callback) {
       options.fs.rmdir(getLockFile(file, options), (err) => {
@@ -29304,7 +29304,7 @@ var require_lockfile = __commonJS({
       lock2.updateDelay = lock2.updateDelay || options.update;
       lock2.updateTimeout = setTimeout(() => {
         lock2.updateTimeout = null;
-        options.fs.stat(lock2.lockfilePath, (err, stat4) => {
+        options.fs.stat(lock2.lockfilePath, (err, stat5) => {
           const isOverThreshold = lock2.lastUpdate + options.stale < Date.now();
           if (err) {
             if (err.code === "ENOENT" || isOverThreshold) {
@@ -29313,7 +29313,7 @@ var require_lockfile = __commonJS({
             lock2.updateDelay = 1e3;
             return updateLock(file, options);
           }
-          const isMtimeOurs = lock2.mtime.getTime() === stat4.mtime.getTime();
+          const isMtimeOurs = lock2.mtime.getTime() === stat5.mtime.getTime();
           if (!isMtimeOurs) {
             return setLockAsCompromised(
               file,
@@ -29438,11 +29438,11 @@ var require_lockfile = __commonJS({
         if (err) {
           return callback(err);
         }
-        options.fs.stat(getLockFile(file2, options), (err2, stat4) => {
+        options.fs.stat(getLockFile(file2, options), (err2, stat5) => {
           if (err2) {
             return err2.code === "ENOENT" ? callback(null, false) : callback(err2);
           }
-          return callback(null, !isLockStale(stat4, options));
+          return callback(null, !isLockStale(stat5, options));
         });
       });
     }
@@ -29489,12 +29489,12 @@ var require_adapter = __commonJS({
       return newFs;
     }
     function toPromise(method) {
-      return (...args) => new Promise((resolve, reject) => {
+      return (...args) => new Promise((resolve2, reject) => {
         args.push((err, result) => {
           if (err) {
             reject(err);
           } else {
-            resolve(result);
+            resolve2(result);
           }
         });
         method(...args);
@@ -29799,6 +29799,52 @@ var ComputerAttachClient = class {
     return { ok: false, code };
   }
 };
+var LegacyMachinesClient = class {
+  constructor(baseUrl, accessToken) {
+    this.baseUrl = baseUrl;
+    this.accessToken = accessToken;
+  }
+  url(p) {
+    return new URL(p, this.baseUrl).toString();
+  }
+  async list(serverSlug) {
+    let res;
+    try {
+      res = await (0, import_undici.fetch)(
+        this.url(`/api/computer/legacy-machines?serverSlug=${encodeURIComponent(serverSlug)}`),
+        {
+          method: "GET",
+          headers: { Authorization: `Bearer ${this.accessToken}` }
+        }
+      );
+    } catch {
+      return { status: "error", code: "request_failed" };
+    }
+    const body = await res.json().catch(() => null);
+    if (res.status === 200 && body && Array.isArray(body.entries)) {
+      const entries = body.entries.map((raw) => {
+        if (!raw || typeof raw !== "object") return null;
+        const e = raw;
+        if (typeof e.daemonId !== "string" || typeof e.apiKeyFingerprint !== "string" || typeof e.machineName !== "string") {
+          return null;
+        }
+        return {
+          daemonId: e.daemonId,
+          apiKeyFingerprint: e.apiKeyFingerprint,
+          machineName: e.machineName,
+          hostname: typeof e.hostname === "string" ? e.hostname : null,
+          lastSeenAt: typeof e.lastSeenAt === "string" ? e.lastSeenAt : null
+        };
+      }).filter((entry) => entry !== null);
+      return { status: "success", entries };
+    }
+    if (res.status === 401) return { status: "auth_required" };
+    if (res.status === 403) return { status: "not_authorized" };
+    if (res.status === 404) return { status: "disabled" };
+    const code = body && typeof body.code === "string" ? body.code : `http_${res.status}`;
+    return { status: "error", code };
+  }
+};
 var RunnersClient = class {
   constructor(baseUrl, computerApiKey) {
     this.baseUrl = baseUrl;
@@ -29879,6 +29925,9 @@ function serverDir(slockHome, serverId) {
 function serverAttachmentPath(slockHome, serverId) {
   return path2.join(serverDir(slockHome, serverId), "runner.state.json");
 }
+function legacyServerAttachmentPath(slockHome, serverId) {
+  return path2.join(serverDir(slockHome, serverId), "attachment.json");
+}
 function serverRunnerPidPath(slockHome, serverId) {
   return path2.join(serverDir(slockHome, serverId), "server-runner.pid");
 }
@@ -29975,14 +30024,14 @@ function resolveServerUrl(...candidates) {
 
 // src/services/login.ts
 function sleep(ms, signal) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     if (signal?.aborted) {
       reject(abortError(signal));
       return;
     }
     const t = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve();
+      resolve2();
     }, ms);
     const onAbort = () => {
       clearTimeout(t);
@@ -30130,21 +30179,33 @@ function parseAttachment(raw) {
         serverMachineId: a.serverMachineId,
         apiKey: a.apiKey,
         serverUrl: a.serverUrl,
-        attachedAt: typeof a.attachedAt === "string" ? a.attachedAt : void 0
+        attachedAt: typeof a.attachedAt === "string" ? a.attachedAt : void 0,
+        adoptedFromLegacy: a.adoptedFromLegacy === true ? true : void 0,
+        legacyMachineId: typeof a.legacyMachineId === "string" ? a.legacyMachineId : void 0
       };
     }
   } catch {
   }
   return null;
 }
-async function readServerAttachment(slockHome, serverId) {
-  if (!isValidServerId(serverId)) return null;
+async function readAttachmentAt(path3) {
   try {
-    return parseAttachment(await readFile(serverAttachmentPath(slockHome, serverId), "utf8"));
+    return parseAttachment(await readFile(path3, "utf8"));
   } catch {
     return null;
   }
 }
+async function readServerAttachment(slockHome, serverId) {
+  if (!isValidServerId(serverId)) return null;
+  const current = await readAttachmentAt(serverAttachmentPath(slockHome, serverId));
+  const legacy = await readAttachmentAt(legacyServerAttachmentPath(slockHome, serverId));
+  if (!current) return legacy;
+  if (!legacy) return current;
+  if (legacy.adoptedFromLegacy === true && current.adoptedFromLegacy !== true && legacy.serverMachineId !== current.serverMachineId) {
+    return legacy;
+  }
+  return current;
+}
 async function writeServerAttachment(slockHome, attachment) {
   if (!isValidServerId(attachment.serverId)) return;
   const path3 = serverAttachmentPath(slockHome, attachment.serverId);
@@ -30403,68 +30464,153 @@ import { dirname as dirname9 } from "path";
 
 // src/lib/migration.ts
 init_esm_shims();
-import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
-import { join } from "path";
+import { readdir as readdir2, readFile as readFile3, stat } from "fs/promises";
+import { join, resolve } from "path";
 var MACHINE_DIR_PREFIX = "machine-";
-async function readOwnerEvidence(installRoot, machineDirName) {
-  const ownerFile = join(
-    installRoot,
-    "machines",
-    machineDirName,
-    "daemon.lock",
-    "owner.json"
-  );
+var FINGERPRINT_HEX_RE = /^[0-9a-f]{16}$/;
+async function readLocalOwners(installRoot) {
+  const machinesDir = join(installRoot, "machines");
+  let entries;
+  try {
+    entries = await readdir2(machinesDir);
+  } catch {
+    return [];
+  }
+  const owners = [];
+  for (const name of entries) {
+    if (!name.startsWith(MACHINE_DIR_PREFIX)) continue;
+    const ownerPath = join(machinesDir, name, "daemon.lock", "owner.json");
+    let raw;
+    try {
+      raw = await readFile3(ownerPath, "utf8");
+    } catch {
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    const fp = parsed.apiKeyFingerprint;
+    if (typeof fp !== "string" || !FINGERPRINT_HEX_RE.test(fp)) continue;
+    owners.push({ apiKeyFingerprint: fp, localPath: ownerPath });
+  }
+  return owners;
+}
+function indexLocalByFingerprint(owners) {
+  const map = /* @__PURE__ */ new Map();
+  for (const owner of owners) {
+    if (!map.has(owner.apiKeyFingerprint)) {
+      map.set(owner.apiKeyFingerprint, owner);
+    }
+  }
+  return map;
+}
+function intersect(localByFp, roster) {
+  const out = [];
+  for (const entry of roster) {
+    const local = localByFp.get(entry.apiKeyFingerprint);
+    if (!local) continue;
+    out.push({
+      apiKeyFingerprint: entry.apiKeyFingerprint,
+      daemonId: entry.daemonId,
+      localPath: local.localPath,
+      machineName: entry.machineName,
+      ...entry.hostname ? { hostname: entry.hostname } : {},
+      ...entry.lastSeenAt ? { lastSeenAt: entry.lastSeenAt } : {}
+    });
+  }
+  out.sort((a, b) => {
+    const aSeen = a.lastSeenAt ?? "";
+    const bSeen = b.lastSeenAt ?? "";
+    if (aSeen !== bSeen) {
+      if (aSeen === "") return 1;
+      if (bSeen === "") return -1;
+      return aSeen < bSeen ? 1 : -1;
+    }
+    return a.apiKeyFingerprint < b.apiKeyFingerprint ? -1 : a.apiKeyFingerprint > b.apiKeyFingerprint ? 1 : 0;
+  });
+  return out;
+}
+async function detectLegacyMigration(installRoot, serverSlug, client) {
+  const localOwners = await readLocalOwners(installRoot);
+  if (localOwners.length === 0) {
+    return { kind: "candidates", candidates: [] };
+  }
+  const result = await client.list(serverSlug);
+  if (result.status !== "success") {
+    return { kind: "server-unavailable" };
+  }
+  const localByFp = indexLocalByFingerprint(localOwners);
+  return { kind: "candidates", candidates: intersect(localByFp, result.entries) };
+}
+async function validateManualMigratePath(inputPath, roster) {
+  const absInput = resolve(inputPath);
+  let stats;
+  try {
+    stats = await stat(absInput);
+  } catch {
+    return { ok: false, code: "MIGRATE_FROM_NOT_FOUND" };
+  }
+  const ownerPath = stats.isDirectory() ? join(absInput, "daemon.lock", "owner.json") : absInput;
+  const candidateOwnerPath = await firstReadableOwner([
+    ownerPath,
+    join(absInput, "owner.json"),
+    absInput
+  ]);
+  if (!candidateOwnerPath) {
+    return { ok: false, code: "MIGRATE_FROM_INVALID" };
+  }
   let raw;
   try {
-    raw = await readFile3(ownerFile, "utf8");
+    raw = await readFile3(candidateOwnerPath, "utf8");
   } catch {
-    return {};
+    return { ok: false, code: "MIGRATE_FROM_INVALID" };
   }
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return {};
+    return { ok: false, code: "MIGRATE_FROM_INVALID" };
   }
-  const machineName = typeof parsed.hostname === "string" && parsed.hostname.length > 0 ? parsed.hostname : void 0;
-  const serverUrl = typeof parsed.serverUrl === "string" && parsed.serverUrl.length > 0 ? parsed.serverUrl : void 0;
-  return { machineName, serverUrl };
-}
-async function detectLegacyMigration(installRoot, loggedInUserId) {
-  void loggedInUserId;
-  const machinesDir = join(installRoot, "machines");
-  let entries;
-  try {
-    entries = await readdir2(machinesDir);
-  } catch {
-    return { kind: "no-match" };
+  const fp = parsed.apiKeyFingerprint;
+  if (typeof fp !== "string" || !FINGERPRINT_HEX_RE.test(fp)) {
+    return { ok: false, code: "MIGRATE_FROM_INVALID" };
   }
-  const candidates = [];
-  for (const name of entries) {
-    if (!name.startsWith(MACHINE_DIR_PREFIX)) continue;
-    const evidence = await readOwnerEvidence(installRoot, name);
-    candidates.push({
-      machineId: name,
-      machineName: evidence.machineName,
-      serverUrl: evidence.serverUrl
-    });
+  const match = roster.find((r) => r.apiKeyFingerprint === fp);
+  if (!match) {
+    return { ok: false, code: "MIGRATE_FROM_NOT_OWNED" };
   }
-  if (candidates.length === 0) return { kind: "no-match" };
-  if (candidates.length === 1) {
-    const only = candidates[0];
-    return {
-      kind: "match",
-      machineId: only.machineId,
-      machineName: only.machineName,
-      serverUrl: only.serverUrl
-    };
+  return {
+    ok: true,
+    candidate: {
+      apiKeyFingerprint: match.apiKeyFingerprint,
+      daemonId: match.daemonId,
+      localPath: candidateOwnerPath,
+      machineName: match.machineName,
+      ...match.hostname ? { hostname: match.hostname } : {},
+      ...match.lastSeenAt ? { lastSeenAt: match.lastSeenAt } : {}
+    }
+  };
+}
+async function firstReadableOwner(paths) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const p of paths) {
+    if (seen.has(p)) continue;
+    seen.add(p);
+    try {
+      const st = await stat(p);
+      if (st.isFile()) return p;
+    } catch {
+    }
   }
-  return { kind: "ambiguous", candidates };
+  return null;
 }
 
 // src/services/adoptLegacy.ts
 init_esm_shims();
-import { chmod as chmod3, mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4, appendFile, stat } from "fs/promises";
+import { chmod as chmod3, mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4, appendFile, stat as stat2 } from "fs/promises";
 import { createHash as createHash2 } from "crypto";
 import { dirname as dirname4, join as join2 } from "path";
 import { setTimeout as delay } from "timers/promises";
@@ -30807,7 +30953,7 @@ async function appendAdoptionLog(slockHome, line) {
     const path3 = adoptionLogPath(slockHome);
     await appendFile(path3, fields.join(" ") + "\n", { mode: 384 });
     try {
-      const st = await stat(path3);
+      const st = await stat2(path3);
       if ((st.mode & 63) !== 0) await chmod3(path3, 384);
     } catch {
     }
@@ -30824,7 +30970,7 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/cleanup.ts
 init_esm_shims();
-import { readdir as readdir3, stat as stat2, unlink as unlink3, rm, rmdir, rename, mkdir as mkdir6 } from "fs/promises";
+import { readdir as readdir3, stat as stat3, unlink as unlink3, rm, rmdir, rename, mkdir as mkdir6 } from "fs/promises";
 import { spawn } from "child_process";
 import { join as join3 } from "path";
 
@@ -30918,7 +31064,7 @@ async function readPsTable(psSpawn = defaultPsSpawn) {
   }
 }
 function defaultPsSpawn() {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn("ps", ["-o", "pid,ppid,comm", "-A"], {
       stdio: ["ignore", "pipe", "ignore"]
     });
@@ -30926,8 +31072,8 @@ function defaultPsSpawn() {
     child.stdout.on("data", (chunk) => {
       out += String(chunk);
     });
-    child.on("error", () => resolve({ stdout: "", exitCode: 1 }));
-    child.on("close", (code) => resolve({ stdout: out, exitCode: code ?? 1 }));
+    child.on("error", () => resolve2({ stdout: "", exitCode: 1 }));
+    child.on("close", (code) => resolve2({ stdout: out, exitCode: code ?? 1 }));
   });
 }
 async function cleanupOrphanProcesses(slockHome, psSpawn) {
@@ -31006,7 +31152,7 @@ async function cleanupTmpFiles(slockHome) {
     for (const v of versions) {
       const vdir = join3(stagingDir, v);
       try {
-        const s = await stat2(vdir);
+        const s = await stat3(vdir);
         if (Date.now() - s.mtimeMs > TMP_MAX_AGE_MS) {
           await rm(vdir, { recursive: true, force: true });
           removed.push(vdir);
@@ -31023,7 +31169,7 @@ async function cleanupTmpFiles(slockHome) {
   }
   const snap = join3(cdir, "upgrade-snapshot.json");
   try {
-    const s = await stat2(snap);
+    const s = await stat3(snap);
     if (Date.now() - s.mtimeMs > TMP_MAX_AGE_MS) {
       await unlink3(snap);
       removed.push(snap);
@@ -31035,7 +31181,7 @@ async function cleanupTmpFiles(slockHome) {
 async function cleanupStaleLock(slockHome) {
   const lockDir = join3(computerDir(slockHome), ".lock");
   try {
-    const s = await stat2(lockDir);
+    const s = await stat3(lockDir);
     if (Date.now() - s.mtimeMs > 60 * 1e3) {
       await rm(lockDir, { recursive: true, force: true });
       return [lockDir];
@@ -31047,7 +31193,7 @@ async function cleanupStaleLock(slockHome) {
 async function forceReleaseLock(slockHome) {
   const lockDir = join3(computerDir(slockHome), ".lock");
   try {
-    await stat2(lockDir);
+    await stat3(lockDir);
     await rm(lockDir, { recursive: true, force: true });
     return [lockDir];
   } catch {
@@ -31238,7 +31384,7 @@ function emit4(opts, event) {
 async function waitForManagedDaemonPids(slockHome, serverIds, opts) {
   const readPidfile = opts.readPidfile ?? readPidfileAt;
   const isAlive = opts.isProcessAlive ?? isProcessAlive2;
-  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = opts.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const timeoutMs = opts.ensureTimeoutMs ?? START_ENSURE_TIMEOUT_MS;
   const pollIntervalMs = opts.ensurePollIntervalMs ?? START_ENSURE_POLL_INTERVAL_MS;
   const deadline = Date.now() + timeoutMs;
@@ -31414,7 +31560,7 @@ async function stop(input = {}, options = {}) {
   const killer = options.killService ?? ((pid2) => {
     process.kill(pid2, "SIGTERM");
   });
-  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleep2 = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
   const pollIntervalMs = options.pollIntervalMs ?? STOP_POLL_INTERVAL_MS;
   const timeoutMs = options.timeoutMs ?? STOP_TIMEOUT_MS;
   const { pid, pidfilePath, firstStalePidfile, firstStalePid } = await findLiveServicePid(slockHome, {
@@ -31967,12 +32113,15 @@ async function runDetach(serverId, serverLabel = serverId) {
 
 // src/setup.ts
 var USER_SESSION_EXPIRY_LEEWAY_MS = 3e4;
-async function readUserSessionUserId(slockHome) {
+async function readUserSessionAuth(slockHome) {
   try {
     const parsed = JSON.parse(await readFile8(userSessionPath(slockHome), "utf8"));
-    return typeof parsed.userId === "string" ? parsed.userId : "";
+    return {
+      accessToken: typeof parsed.accessToken === "string" ? parsed.accessToken : "",
+      ...typeof parsed.serverUrl === "string" ? { serverUrl: parsed.serverUrl } : {}
+    };
   } catch {
-    return "";
+    return { accessToken: "" };
   }
 }
 async function hasValidUserSession(slockHome) {
@@ -32042,15 +32191,60 @@ async function refreshUserSession(slockHome, serverUrl) {
     return false;
   }
 }
-async function defaultConfirmMigrate(prompt) {
-  process.stdout.write(prompt);
-  const line = await readLine(false);
-  const norm = line.trim().toLowerCase();
-  return norm === "y" || norm === "yes";
+async function pickMigrationCandidateFromInput(candidates, read, write) {
+  write(
+    "Migration: detected legacy daemon(s) on this Computer that match the target server.\n"
+  );
+  candidates.forEach((c, i) => {
+    const host = c.hostname ? ` (${c.hostname})` : "";
+    const seen = c.lastSeenAt ? ` last seen ${c.lastSeenAt}` : "";
+    write(`  ${i + 1}. ${c.machineName}${host}${seen}
+`);
+    write(`     local: ${c.localPath}
+`);
+  });
+  write("  0. Fresh attach (skip migration)\n");
+  write("  m. Migrate from a different on-disk path\n");
+  while (true) {
+    write("Choose [1]: ");
+    const { line, eof } = await read();
+    if (eof) return { kind: "fresh" };
+    const trimmed = line.trim();
+    const norm = trimmed.toLowerCase();
+    if (norm === "m") {
+      write("Path to legacy machine dir or owner.json: ");
+      const { line: pathLine } = await read();
+      return { kind: "manual", path: pathLine.trim() };
+    }
+    if (norm.length === 0) return { kind: "candidate", index: 0 };
+    if (norm === "0") return { kind: "fresh" };
+    const n = Number.parseInt(norm, 10);
+    if (Number.isFinite(n) && String(n) === norm && n >= 1 && n <= candidates.length) {
+      return { kind: "candidate", index: n - 1 };
+    }
+    write(
+      `Invalid selection "${trimmed}". Enter 1..${candidates.length}, 0, or m.
+`
+    );
+  }
 }
-async function defaultReadMigrateSecret(prompt) {
-  process.stdout.write(prompt);
-  const line = await readLine(true);
+async function defaultPickMigrationCandidate(candidates) {
+  return pickMigrationCandidateFromInput(
+    candidates,
+    () => readLine(false),
+    (s) => {
+      process.stdout.write(s);
+    }
+  );
+}
+async function readLegacyApiKey(isTty) {
+  const fromEnv = process.env.SLOCK_LEGACY_API_KEY;
+  if (typeof fromEnv === "string" && fromEnv.length > 0) return fromEnv.trim();
+  if (!isTty) return "";
+  process.stdout.write(
+    "Paste legacy api key (sk_machine_* or sk_daemon_*); input is hidden: "
+  );
+  const { line } = await readLine(true);
   process.stdout.write("\n");
   return line.trim();
 }
@@ -32060,7 +32254,7 @@ async function readLine(masked) {
   const enterRaw = masked && stdin.isTTY === true && typeof stdin.setRawMode === "function";
   if (enterRaw) stdin.setRawMode(true);
   stdin.resume();
-  return await new Promise((resolve) => {
+  return await new Promise((resolve2) => {
     let buf = "";
     const cleanup = () => {
       stdin.off("data", onData);
@@ -32073,12 +32267,17 @@ async function readLine(masked) {
       for (const ch of text) {
         if (ch === "\n" || ch === "\r") {
           cleanup();
-          resolve(buf);
+          resolve2({ line: buf, eof: false });
+          return;
+        }
+        if (ch === "") {
+          cleanup();
+          resolve2({ line: buf, eof: true });
           return;
         }
         if (ch === "") {
           cleanup();
-          resolve("");
+          resolve2({ line: "", eof: false });
           return;
         }
         if (ch === "\x7F" || ch === "\b") {
@@ -32090,12 +32289,88 @@ async function readLine(masked) {
     };
     const onEnd = () => {
       cleanup();
-      resolve(buf);
+      resolve2({ line: buf, eof: true });
     };
     stdin.on("data", onData);
     stdin.on("end", onEnd);
   });
 }
+async function runMigrateAdoption(opts, candidate, isTty, adoptLegacyImpl, readLegacyApiKeyImpl) {
+  const where = candidate.hostname ? ` (${candidate.hostname})` : "";
+  const seen = candidate.lastSeenAt ? ` last seen ${candidate.lastSeenAt}` : "";
+  info(`Migration: adopting legacy daemon "${candidate.machineName}"${where}${seen}.`);
+  info(`  local owner.json: ${candidate.localPath}`);
+  const rawKey = await readLegacyApiKeyImpl(isTty);
+  if (rawKey.length === 0) {
+    fail(
+      "LEGACY_KEY_REQUIRED",
+      "No legacy api key provided. Set `SLOCK_LEGACY_API_KEY` or paste the legacy `sk_machine_*` / `sk_daemon_*` key when prompted."
+    );
+  }
+  if (!rawKey.startsWith("sk_machine_") && !rawKey.startsWith("sk_daemon_")) {
+    fail(
+      "LEGACY_KEY_INVALID",
+      "Provided key does not look like a legacy machine key (expected `sk_machine_*` or `sk_daemon_*`)."
+    );
+  }
+  try {
+    await adoptLegacyImpl(
+      {
+        serverSlug: opts.serverSlug,
+        ...opts.serverUrl ? { serverUrl: opts.serverUrl } : {},
+        ...opts.name ? { name: opts.name } : {},
+        rawKey,
+        mode: "legacy_key_stdin",
+        redactedPrefix: rawKey.slice(0, 8)
+      },
+      {
+        onEvent: (event) => {
+          if (event.type === "adopting") {
+            info(
+              `Adopting legacy daemon for ${formatServerSlugDisplay(event.serverSlug)} via ${event.mode}\u2026`
+            );
+          } else if (event.type === "preflight") {
+            info(
+              event.resumed ? "Adopted (resumed prior attachment); running preflight\u2026" : "Adopted; running preflight\u2026"
+            );
+          } else if (event.type === "adopted") {
+            info(`Adopted. Computer state written to ${event.attachmentPath}`);
+            info(`  server:        ${formatServerSlugDisplay(event.serverSlug)}`);
+            info(`  serverMachine: ${event.serverMachineId}`);
+            info(`  legacyMachine: ${event.legacyMachineId}`);
+            switch (event.legacyStop.outcome) {
+              case "absent":
+                info("  legacy daemon: not detected on this Computer (no local lock file)");
+                break;
+              case "already_dead":
+                info(`  legacy daemon: already stopped (pid ${event.legacyStop.pid} not running)`);
+                break;
+              case "stopped":
+                info(`  legacy daemon: stopped (pid ${event.legacyStop.pid}, SIGTERM)`);
+                break;
+            }
+          }
+        }
+      }
+    );
+  } catch (err) {
+    if (err instanceof CliExit) throw err;
+    if (err instanceof ComputerServiceError) {
+      fail(err.code, err.message);
+    }
+    throw err;
+  }
+}
+function manualPathErrorMessage(code, inputPath) {
+  switch (code) {
+    case "MIGRATE_FROM_NOT_FOUND":
+      return `--migrate-from path not found: ${inputPath}. Pass the legacy machine directory, its daemon.lock/, or its owner.json file.`;
+    case "MIGRATE_FROM_INVALID":
+      return `--migrate-from path is not a valid legacy daemon install: ${inputPath}. Expected an owner.json with a 16-hex-char apiKeyFingerprint field.`;
+    case "MIGRATE_FROM_NOT_OWNED":
+      return `--migrate-from path's apiKeyFingerprint is not in this server's legacy machine roster for the logged-in user: ${inputPath}. Either the daemon is already migrated, the row is unowned by this user, or the fingerprint is from a different server.`;
+  }
+}
 async function runSetup(opts, deps = {}) {
   const slockHome = resolveSlockHome();
   const isTty = deps.isTty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
@@ -32104,8 +32379,11 @@ async function runSetup(opts, deps = {}) {
   const start2 = deps.runStart ?? runStart;
   const refreshSession = deps.refreshUserSession ?? refreshUserSession;
   const detectMigration = deps.detectLegacyMigration ?? detectLegacyMigration;
-  const confirmMigrate = deps.confirmMigrate ?? defaultConfirmMigrate;
-  const readMigrateSecret = deps.readMigrateSecret ?? defaultReadMigrateSecret;
+  const validateManualPath = deps.validateManualMigratePath ?? validateManualMigratePath;
+  const buildRoster = deps.buildRosterClient ?? ((baseUrl, accessToken) => new LegacyMachinesClient(baseUrl, accessToken));
+  const pickCandidate = deps.pickMigrationCandidate ?? defaultPickMigrationCandidate;
+  const adoptLegacy2 = deps.adoptLegacy ?? adoptLegacy;
+  const readLegacyKey = deps.readLegacyApiKey ?? readLegacyApiKey;
   if (!isTty && !opts.yes) {
     fail(
       "NON_INTERACTIVE_SETUP_REQUIRES_FLAGS",
@@ -32134,78 +32412,85 @@ async function runSetup(opts, deps = {}) {
   if (attachment) {
     info(`Attachment: already attached to ${label}.`);
   } else {
+    const session = await readUserSessionAuth(slockHome);
+    const baseUrl = resolveServerUrl(
+      opts.serverUrl,
+      session.serverUrl,
+      process.env.SLOCK_SERVER_URL
+    );
+    const rosterClient = buildRoster(baseUrl, session.accessToken);
     let migrated = false;
-    if (isTty) {
-      const detection = await detectMigration(slockHome, await readUserSessionUserId(slockHome));
-      if (detection.kind === "match") {
-        const where = detection.serverUrl ? ` attached to ${detection.serverUrl}` : "";
-        const who = detection.machineName ? ` "${detection.machineName}"` : "";
-        const accepted = await confirmMigrate(
-          `Migration: detected legacy daemon machine${who}${where}. Migrate it under Computer instead of creating a fresh attachment? [y/N] `
+    if (typeof opts.migrateFrom === "string" && opts.migrateFrom.length > 0) {
+      const rosterResult = await rosterClient.list(opts.serverSlug);
+      if (rosterResult.status !== "success") {
+        fail(
+          "MIGRATE_FROM_ROSTER_UNAVAILABLE",
+          `Cannot validate --migrate-from path: legacy machine roster unavailable (${rosterResult.status}). Retry when the server is reachable, or remove --migrate-from to fall through to fresh attach.`
         );
-        if (accepted) {
-          const rawKey = await readMigrateSecret(
-            "Paste legacy api key (sk_machine_* or sk_daemon_*); input is hidden: "
-          );
-          if (rawKey.length === 0) {
-            info("Migration: no key provided; falling back to fresh attach.");
-          } else if (!rawKey.startsWith("sk_machine_") && !rawKey.startsWith("sk_daemon_")) {
-            fail(
-              "LEGACY_KEY_INVALID",
-              "Provided key does not look like a legacy machine key (expected `sk_machine_*` or `sk_daemon_*`)."
-            );
-          } else {
-            try {
-              await adoptLegacy(
-                {
-                  serverSlug: opts.serverSlug,
-                  serverUrl: opts.serverUrl,
-                  name: opts.name,
-                  rawKey,
-                  mode: "legacy_key_stdin",
-                  redactedPrefix: rawKey.slice(0, 8)
-                },
-                {
-                  onEvent: (event) => {
-                    if (event.type === "adopting") {
-                      info(
-                        `Adopting legacy daemon for ${formatServerSlugDisplay(event.serverSlug)} via ${event.mode}\u2026`
-                      );
-                    } else if (event.type === "preflight") {
-                      info(
-                        event.resumed ? "Adopted (resumed prior attachment); running preflight\u2026" : "Adopted; running preflight\u2026"
-                      );
-                    } else if (event.type === "adopted") {
-                      info(`Adopted. Computer state written to ${event.attachmentPath}`);
-                      info(`  server:        ${formatServerSlugDisplay(event.serverSlug)}`);
-                      info(`  serverMachine: ${event.serverMachineId}`);
-                      info(`  legacyMachine: ${event.legacyMachineId}`);
-                      switch (event.legacyStop.outcome) {
-                        case "absent":
-                          info("  legacy daemon: not detected on this Computer (no local lock file)");
-                          break;
-                        case "already_dead":
-                          info(`  legacy daemon: already stopped (pid ${event.legacyStop.pid} not running)`);
-                          break;
-                        case "stopped":
-                          info(`  legacy daemon: stopped (pid ${event.legacyStop.pid}, SIGTERM)`);
-                          break;
-                      }
-                    }
-                  }
-                }
+      }
+      const validation = await validateManualPath(opts.migrateFrom, rosterResult.entries);
+      if (!validation.ok) {
+        fail(validation.code, manualPathErrorMessage(validation.code, opts.migrateFrom));
+      }
+      await runMigrateAdoption(opts, validation.candidate, isTty, adoptLegacy2, readLegacyKey);
+      migrated = true;
+    } else {
+      const detection = await detectMigration(slockHome, opts.serverSlug, rosterClient);
+      if (detection.kind === "server-unavailable") {
+        info(
+          "Migration: legacy machine roster unavailable (fresh trigger: server-unavailable); falling back to fresh attach."
+        );
+      } else if (detection.candidates.length === 0) {
+      } else if (!isTty) {
+        info(
+          `Migration: ${detection.candidates.length} legacy daemon(s) match this server but setup is non-interactive (fresh trigger: non-tty); falling back to fresh attach. Re-run on a TTY or pass --migrate-from <path> to adopt a specific install.`
+        );
+      } else {
+        pickerLoop: while (true) {
+          const selection = await pickCandidate(detection.candidates);
+          if (selection.kind === "candidate") {
+            const candidate = detection.candidates[selection.index];
+            if (!candidate) {
+              fail(
+                "MIGRATE_PICKER_OUT_OF_RANGE",
+                `Picker returned candidate index ${selection.index} but only ${detection.candidates.length} candidate(s) were detected.`
               );
-              migrated = true;
-            } catch (err) {
-              if (err instanceof CliExit) throw err;
-              if (err instanceof ComputerServiceError) {
-                fail(err.code, err.message);
-              }
-              throw err;
             }
+            await runMigrateAdoption(opts, candidate, isTty, adoptLegacy2, readLegacyKey);
+            migrated = true;
+            break pickerLoop;
+          } else if (selection.kind === "manual") {
+            if (selection.path.length === 0) {
+              info("Migration: no path provided; returning to picker.");
+              continue pickerLoop;
+            }
+            const rosterResult = await rosterClient.list(opts.serverSlug);
+            if (rosterResult.status !== "success") {
+              info(
+                `Migration: MIGRATE_FROM_ROSTER_UNAVAILABLE \u2014 legacy machine roster unavailable (${rosterResult.status}); returning to picker. Pick "0" to fall through to fresh attach if the server stays unreachable.`
+              );
+              continue pickerLoop;
+            }
+            const validation = await validateManualPath(selection.path, rosterResult.entries);
+            if (!validation.ok) {
+              info(
+                `Migration: ${validation.code} \u2014 ${manualPathErrorMessage(validation.code, selection.path)} Returning to picker.`
+              );
+              continue pickerLoop;
+            }
+            await runMigrateAdoption(
+              opts,
+              validation.candidate,
+              isTty,
+              adoptLegacy2,
+              readLegacyKey
+            );
+            migrated = true;
+            break pickerLoop;
+          } else {
+            info("Migration: fresh attach selected.");
+            break pickerLoop;
           }
-        } else {
-          info("Migration: declined; falling back to fresh attach.");
         }
       }
     }
@@ -33096,7 +33381,7 @@ function errMsg(e) {
   return e instanceof Error ? e.message : String(e);
 }
 async function defaultReadTarballPackageJson(tarballPath) {
-  const raw = await new Promise((resolve, reject) => {
+  const raw = await new Promise((resolve2, reject) => {
     const child = spawn3("tar", ["-xzOf", tarballPath, "package/package.json"], {
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -33114,7 +33399,7 @@ async function defaultReadTarballPackageJson(tarballPath) {
         reject(new Error(`tar -xzOf exited ${code}: ${stderrBuf.slice(0, 300)}`));
         return;
       }
-      resolve(stdoutBuf);
+      resolve2(stdoutBuf);
     });
   });
   return JSON.parse(raw);
@@ -33242,7 +33527,7 @@ async function stagePhase(slockHome, version, deps = {}) {
   return { stagedPath, version, tarballSha1 };
 }
 function defaultNpmPack(cwd, packageRef) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn4("npm", ["pack", packageRef, "--json"], {
       cwd,
       stdio: ["ignore", "pipe", "pipe"]
@@ -33256,23 +33541,23 @@ function defaultNpmPack(cwd, packageRef) {
       stderrBuf += String(chunk);
     });
     child.on("error", (err) => {
-      resolve({ tarballPath: "", exitCode: 1, stderr: String(err) });
+      resolve2({ tarballPath: "", exitCode: 1, stderr: String(err) });
     });
     child.on("close", (code) => {
       if (code !== 0) {
-        resolve({ tarballPath: "", exitCode: code ?? 1, stderr: stderrBuf });
+        resolve2({ tarballPath: "", exitCode: code ?? 1, stderr: stderrBuf });
         return;
       }
       try {
         const parsed = JSON.parse(stdoutBuf);
         const filename = parsed[0]?.filename;
         if (!filename) {
-          resolve({ tarballPath: "", exitCode: 1, stderr: "npm pack returned no filename" });
+          resolve2({ tarballPath: "", exitCode: 1, stderr: "npm pack returned no filename" });
           return;
         }
-        resolve({ tarballPath: join6(cwd, filename), exitCode: 0, stderr: stderrBuf });
+        resolve2({ tarballPath: join6(cwd, filename), exitCode: 0, stderr: stderrBuf });
       } catch (e) {
-        resolve({ tarballPath: "", exitCode: 1, stderr: `parse npm pack output: ${e}` });
+        resolve2({ tarballPath: "", exitCode: 1, stderr: `parse npm pack output: ${e}` });
       }
     });
   });
@@ -33352,7 +33637,7 @@ async function extractTarball(tarballPath, destDir, deps = {}) {
   return { extractedPackageDir: join6(destDir, "package") };
 }
 function defaultTarSpawn(tarballPath, destDir) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn4("tar", ["-xzf", tarballPath, "-C", destDir], {
       stdio: ["ignore", "ignore", "pipe"]
     });
@@ -33361,10 +33646,10 @@ function defaultTarSpawn(tarballPath, destDir) {
       stderrBuf += String(chunk);
     });
     child.on("error", (err) => {
-      resolve({ exitCode: 1, stderr: String(err) });
+      resolve2({ exitCode: 1, stderr: String(err) });
     });
     child.on("close", (code) => {
-      resolve({ exitCode: code ?? 1, stderr: stderrBuf });
+      resolve2({ exitCode: code ?? 1, stderr: stderrBuf });
     });
   });
 }
@@ -33380,7 +33665,7 @@ async function hydrateStagedDependencies(extractedPackageDir, deps = {}) {
   }
 }
 function defaultNpmInstallProductionDeps(cwd) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn4(
       "npm",
       [
@@ -33401,10 +33686,10 @@ function defaultNpmInstallProductionDeps(cwd) {
       stderrBuf += String(chunk);
     });
     child.on("error", (err) => {
-      resolve({ exitCode: 1, stderr: String(err) });
+      resolve2({ exitCode: 1, stderr: String(err) });
     });
     child.on("close", (code) => {
-      resolve({ exitCode: code ?? 1, stderr: stderrBuf });
+      resolve2({ exitCode: code ?? 1, stderr: stderrBuf });
     });
   });
 }
@@ -34264,7 +34549,7 @@ async function defaultCurrentVersion() {
 
 // src/upgradeTestHarness.ts
 init_esm_shims();
-import { mkdir as mkdir15, readdir as readdir4, stat as stat3, writeFile as writeFile12 } from "fs/promises";
+import { mkdir as mkdir15, readdir as readdir4, stat as stat4, writeFile as writeFile12 } from "fs/promises";
 import { join as join8 } from "path";
 import { createHash as createHash4 } from "crypto";
 var PHASES = /* @__PURE__ */ new Set([
@@ -34401,7 +34686,7 @@ async function arrangeSnapshotFailure(slockHome) {
 }
 async function pathInfo(path3) {
   try {
-    const s = await stat3(path3);
+    const s = await stat4(path3);
     if (s.isDirectory()) return { kind: "dir", size: 0 };
     if (s.isFile()) return { kind: "file", size: s.size };
     return null;