@spencerboucher/switchyard 0.5.0 → 0.7.0

package/dist/switchyard.mjs

@@ -283,6 +283,8 @@ var RuntimeCapabilities = z3.object({
   costAccounting: z3.boolean(),
   /** The host runs sessions as interactive Pi in a terminal that clients can attach to. */
   terminal: z3.boolean().optional(),
+  /** The host answers session.models, session.commands, session.setModel, session.setThinking and session.compact. */
+  sessionControls: z3.boolean().optional(),
   unsupported: z3.array(z3.object({ capability: z3.string(), reason: z3.string() }))
 });
 var ProjectScan = z3.object({
@@ -364,6 +366,28 @@ var Workspace = z3.object({
   updatedAt: Iso
 });
 var ThinkingLevel = z3.enum(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+var SessionModel = z3.object({
+  provider: z3.string(),
+  id: z3.string(),
+  name: z3.string().nullable(),
+  contextWindow: z3.number().nullable(),
+  reasoning: z3.boolean(),
+  /** In Pi's scoped (favorite) model list; set only when Pi has one. */
+  scoped: z3.boolean().optional(),
+  /** Effort levels this model accepts, in Pi's order; ["off"] without reasoning. */
+  thinkingLevels: z3.array(ThinkingLevel)
+});
+var SlashCommand = z3.object({
+  name: z3.string().min(1),
+  description: z3.string().nullable(),
+  source: z3.enum(["extension", "prompt", "skill"])
+});
+var ContextUsage = z3.object({
+  /** Estimated tokens in context; null right after compaction until the next reply. */
+  tokens: z3.number().nullable(),
+  window: z3.number(),
+  percent: z3.number().nullable()
+});
 var FORBIDDEN_EXTRA_ARGS = ["--mode", "--fork", "--no-session", "-e", "--extension"];
 var ExtraArg = z3.string().refine((a) => a.startsWith("--") || !a.startsWith("-"), "extra args must be long flags").refine((a) => !FORBIDDEN_EXTRA_ARGS.includes(a.split("=")[0]) && !a.startsWith("--session"), "this flag is managed by Switchyard");
 var Profile = z3.object({
@@ -373,7 +397,9 @@ var Profile = z3.object({
   model: z3.string().nullable(),
   thinking: ThinkingLevel.nullable(),
   projectTrust: z3.enum(["ask", "approve", "ignore"]),
-  extraArgs: z3.array(ExtraArg)
+  extraArgs: z3.array(ExtraArg),
+  /** "vanilla": --no-extensions --no-skills --no-prompt-templates. Undefined means "all". */
+  resources: z3.enum(["all", "vanilla"]).optional()
 });
 var RuntimeState = z3.enum([
   "starting",
@@ -387,7 +413,8 @@ var RuntimeState = z3.enum([
 var NativeHandle = z3.object({ sessionId: z3.string(), sessionFile: z3.string() });
 var SessionStats = z3.object({
   tokens: z3.number().nullable(),
-  costUsd: z3.number().nullable()
+  costUsd: z3.number().nullable(),
+  context: ContextUsage.nullable().optional()
 });
 var Session = z3.object({
   id: Id,
@@ -410,6 +437,12 @@ var Session = z3.object({
   archivedAt: Iso.nullable(),
   queue: z3.object({ steering: z3.array(z3.string()), followUp: z3.array(z3.string()) }),
   stats: SessionStats.nullable(),
+  /** The live model (host-owned; last known when stopped). */
+  model: SessionModel.nullable().optional(),
+  /** The live effort (Pi's thinking level). */
+  thinking: ThinkingLevel.nullable().optional(),
+  /** Pi is compacting the context. */
+  compacting: z3.boolean().optional(),
   lastAssistantText: z3.string().nullable(),
   createdAt: Iso,
   /** A live terminal session: `switchyard tui` can attach to its Pi terminal. */
@@ -650,7 +683,7 @@ var Device = z3.object({
     permission: z3.enum(["granted", "denied", "default", "unknown"])
   }),
   preferredMobile: z3.boolean(),
-  enrolledVia: z3.enum(["enrollment", "passkey", "oidc", "admin"]).default("enrollment")
+  enrolledVia: z3.enum(["enrollment", "passkey", "oidc", "admin", "approval"]).default("enrollment")
 });
 var ToolItemData = z3.object({
   toolCallId: z3.string(),
@@ -848,7 +881,8 @@ var ProfileInput = z4.object({
   model: z4.string().nullable().default(null),
   thinking: ThinkingLevel.nullable().default(null),
   projectTrust: z4.enum(["ask", "approve", "ignore"]).default("ask"),
-  extraArgs: z4.array(ExtraArg).default([])
+  extraArgs: z4.array(ExtraArg).default([]),
+  resources: z4.enum(["all", "vanilla"]).default("all")
 });
 var CreateWorkspaceRequest = z4.object({
   checkoutId: z4.string(),
@@ -879,6 +913,18 @@ var PromptRequest = z4.object({
   clientMessageId: z4.string().optional()
 });
 var RenameRequest = z4.object({ title: z4.string().min(1).max(200) });
+var SetModelRequest = z4.object({
+  provider: z4.string().min(1),
+  modelId: z4.string().min(1)
+});
+var SetThinkingRequest = z4.object({ level: ThinkingLevel });
+var CompactRequest = z4.object({ instructions: z4.string().max(4e3).optional() });
+var SessionModelsResult = z4.object({ models: z4.array(SessionModel) });
+var SessionCommandsResult = z4.object({ commands: z4.array(SlashCommand) });
+var ModelStateResult = z4.object({
+  model: SessionModel.nullable(),
+  thinking: ThinkingLevel.nullable()
+});
 var ImportSessionRequest = z4.object({
   hostId: z4.string(),
   sessionFile: z4.string(),
@@ -1003,7 +1049,6 @@ var PushPayload = z4.union([
   z4.object({ type: z4.literal("clear"), tag: z4.string() })
 ]);
 var SetupState = z4.object({
-  initialized: z4.boolean(),
   passkey: z4.object({
     available: z4.boolean(),
     registered: z4.boolean(),
@@ -1011,10 +1056,6 @@ var SetupState = z4.object({
   }),
   oidc: z4.object({ label: z4.string() }).nullable()
 });
-var InitResponse = z4.object({
-  alreadyInitialized: z4.boolean(),
-  enrollment: CreateEnrollmentResponse
-});
 var PasskeyRegisterOptionsResponse = z4.object({
   challengeId: z4.string(),
   options: z4.unknown()
@@ -1050,6 +1091,31 @@ var OidcClaimResponse = z4.union([
   z4.object({ status: z4.literal("pending") }),
   z4.object({ status: z4.literal("done"), deviceId: z4.string() })
 ]);
+var TerminalLoginStartRequest = z4.object({ name: z4.string().min(1).max(80) });
+var TerminalLoginStartResponse = z4.object({
+  userCode: z4.string(),
+  pollToken: z4.string(),
+  verifyUrl: z4.string(),
+  expiresAt: z4.string(),
+  intervalMs: z4.number().int()
+});
+var TerminalLoginClaimRequest = z4.object({
+  userCode: z4.string().min(1),
+  pollToken: z4.string().min(1)
+});
+var TerminalLoginClaimResponse = z4.union([
+  z4.object({ status: z4.literal("pending") }),
+  z4.object({ status: z4.literal("denied") }),
+  z4.object({ status: z4.literal("done"), deviceId: z4.string(), credential: z4.string() })
+]);
+var TerminalLoginRequest = z4.object({
+  userCode: z4.string(),
+  name: z4.string(),
+  requestedFrom: z4.string(),
+  createdAt: z4.string(),
+  expiresAt: z4.string(),
+  status: z4.enum(["pending", "approved", "denied"])
+});
 var AuthMethods = z4.object({
   passkeys: z4.array(Passkey),
   passkeyAvailability: z4.object({ available: z4.boolean(), reason: z4.string().nullable() }),
@@ -1253,6 +1319,20 @@ var HostCommand = z8.discriminatedUnion("type", [
   z8.object({ type: z8.literal("session.importable") }),
   z8.object({ type: z8.literal("session.readNative"), sessionFile: z8.string() }),
   z8.object({ type: z8.literal("session.snapshot"), sessionId: z8.string() }),
+  z8.object({ type: z8.literal("session.models"), sessionId: z8.string() }),
+  z8.object({ type: z8.literal("session.commands"), sessionId: z8.string() }),
+  z8.object({
+    type: z8.literal("session.setModel"),
+    sessionId: z8.string(),
+    provider: z8.string().min(1),
+    modelId: z8.string().min(1)
+  }),
+  z8.object({ type: z8.literal("session.setThinking"), sessionId: z8.string(), level: ThinkingLevel }),
+  z8.object({
+    type: z8.literal("session.compact"),
+    sessionId: z8.string(),
+    instructions: z8.string().nullable()
+  }),
   z8.object({ type: z8.literal("checkout.inspect"), path: z8.string() }),
   z8.object({ type: z8.literal("projects.scan"), folder: z8.string().min(1) }),
   z8.object({
@@ -1794,7 +1874,7 @@ var ApiClient = class {
   constructor(opts) {
     this.baseUrl = opts.coordinatorUrl.replace(/\/+$/, "");
     this.credential = opts.credential;
-    this.doFetch = opts.fetch ?? ((input, init2) => fetch(input, init2));
+    this.doFetch = opts.fetch ?? ((input, init) => fetch(input, init));
   }
   async request(method, path, body) {
     const headers = { accept: "application/json" };
@@ -2260,8 +2340,8 @@ function runRawTerminal(opts) {
 import { Command, Option } from "commander";
 
 // packages/cli/dist/commands/auth.js
-import { hostname } from "node:os";
-import QRCode from "qrcode";
+import { hostname as hostname3 } from "node:os";
+import QRCode2 from "qrcode";
 
 // packages/cli/dist/config.js
 import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -2423,121 +2503,10 @@ function trimUrl(url) {
   return url.trim().replace(/\/+$/, "");
 }
 
-// packages/cli/dist/commands/auth.js
-function adminApi(ctx, flags) {
-  const dataDir = flags.dataDir ?? ctx.paths?.dataDir ?? defaultDataDir(ctx.env);
-  const token = readAdminToken(dataDir, ctx.env);
-  if (!token) {
-    throw new CliError(`No admin token: run this on the coordinator machine (looked in ${dataDir}/admin.token) or set SWITCHYARD_ADMIN_TOKEN`);
-  }
-  const url = trimUrl(flags.coordinator ?? readEndpoint(dataDir)?.localUrl ?? DEFAULT_LOCAL_URL);
-  return new ApiClient({ coordinatorUrl: url, credential: token, fetch: ctx.fetch });
-}
-function clockTime(iso) {
-  const d = new Date(iso);
-  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
-}
-async function printDeviceLink(ctx, url) {
-  const qr = await QRCode.toString(url, { type: "terminal", small: true });
-  ctx.out("");
-  ctx.out(`  ${url}`);
-  ctx.out("");
-  ctx.out(qr.trimEnd());
-  ctx.out("");
-}
-async function printInit(ctx, r) {
-  if (r.alreadyInitialized) {
-    ctx.out("Already set up. New single-use sign-in link for one device:");
-    await printDeviceLink(ctx, r.enrollment.url);
-    return;
-  }
-  ctx.out(`Switchyard is set up. Open this single-use link on your first device (expires ${clockTime(r.enrollment.expiresAt)}):`);
-  await printDeviceLink(ctx, r.enrollment.url);
-  ctx.out("Then add a passkey in Settings \u203A Sign-in so other devices can sign in without a link.");
-}
-async function init(ctx, flags) {
-  const api = adminApi(ctx, flags);
-  const r = await api.post("/api/admin/init", {});
-  if (flags.json) {
-    ctx.out(JSON.stringify(r, null, 2));
-    return r;
-  }
-  await printInit(ctx, r);
-  return r;
-}
-async function pair(ctx, flags) {
-  const api = adminApi(ctx, flags);
-  const kind = flags.host ? "host" : "device";
-  const e = await api.post("/api/enrollments", { kind });
-  if (flags.json) {
-    ctx.out(JSON.stringify(e, null, 2));
-    return e;
-  }
-  const qr = await QRCode.toString(e.url, { type: "terminal", small: true });
-  if (kind === "host") {
-    ctx.out(`Host enrollment (single use, expires ${e.expiresAt}). On the host, run:`);
-    ctx.out("");
-    ctx.out(`  ${e.command ?? `switchyard host enroll --coordinator <url> --token ${e.token}`}`);
-    ctx.out("");
-    ctx.out(`Token: ${e.token}`);
-  } else {
-    ctx.out(`Open this link on the device to enroll it (single use, expires ${e.expiresAt}):`);
-    ctx.out("");
-    ctx.out(`  ${e.url}`);
-    ctx.out("");
-    ctx.out(qr.trimEnd());
-    ctx.out("");
-    ctx.out(`Terminal: switchyard login --coordinator ${originOf(e.url)} --token ${e.token}`);
-  }
-  ctx.out("The link does not provide network access: the device must already reach this URL.");
-  return e;
-}
-function originOf(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return url;
-  }
-}
-function parseEnrollmentInput(token, coordinator) {
-  const t = token.trim();
-  if (/^https?:\/\//.test(t)) {
-    const u = new URL(t);
-    const params = new URLSearchParams(u.hash.replace(/^#/, ""));
-    const fromUrl = params.get("token") ?? u.searchParams.get("token");
-    if (!fromUrl)
-      throw new CliError("That URL has no enrollment token");
-    return { url: trimUrl(coordinator ?? u.origin), token: fromUrl };
-  }
-  if (!coordinator)
-    throw new CliError("--coordinator <url> is required");
-  return { url: trimUrl(coordinator), token: t };
-}
-async function login(ctx, flags) {
-  const { url, token } = parseEnrollmentInput(flags.token, flags.coordinator);
-  const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
-  const name = flags.name ?? `${hostname().replace(/\.local$/, "")} terminal`;
-  const res = await api.post("/api/enroll", {
-    token,
-    name,
-    kind: "terminal"
-  });
-  if (!res.credential)
-    throw new CliError("The coordinator returned no credential");
-  const path = ctx.paths?.clientConfig ?? clientConfigPath(ctx.env);
-  writeClientConfig(path, {
-    coordinatorUrl: url,
-    credential: res.credential,
-    deviceId: res.deviceId
-  });
-  ctx.out(`Enrolled "${name}" (${res.deviceId}) with ${url}.`);
-  ctx.out(`Credential saved to ${path} (mode 0600). Open a session's Pi terminal with \`switchyard tui <session>\`.`);
-  return { path, deviceId: res.deviceId };
-}
-
-// packages/cli/dist/commands/coordinator.js
-import { existsSync as existsSync6, mkdirSync as mkdirSync4 } from "node:fs";
-import { resolve as resolve4 } from "node:path";
+// packages/cli/dist/commands/up.js
+import { spawn as spawn4 } from "node:child_process";
+import { existsSync as existsSync14 } from "node:fs";
+import { hostname as hostname2 } from "node:os";
 
 // packages/coordinator/dist/attention/router.js
 var DESKTOP_RECENT_MS = 5 * 6e4;
@@ -2835,12 +2804,10 @@ var Auth = class {
   store;
   config;
   hub;
-  owner;
-  constructor(store, config, hub, owner) {
+  constructor(store, config, hub) {
     this.store = store;
     this.config = config;
     this.hub = hub;
-    this.owner = owner;
   }
   get adminTokenPath() {
     return join3(this.config.dataDir, "admin.token");
@@ -2880,14 +2847,13 @@ var Auth = class {
     return this.store.devices.count("is_admin = 0 AND revoked_at IS NULL");
   }
   enrollmentUrl(token, kind) {
-    return kind === "device" ? `${this.config.publicUrl}/enroll#token=${token}` : `${this.config.publicUrl}/enroll#token=${token}&kind=host`;
+    return kind === "device" ? `${this.config.publicUrl}/sign-in#token=${token}` : `${this.config.publicUrl}/sign-in#token=${token}&kind=host`;
   }
   hostEnrollCommand(token) {
     return `switchyard host enroll --coordinator ${this.config.publicUrl} --token ${token}`;
   }
   /**
-   * Create a single-use enrollment (device 10 min, host 30 min by default). An enrollment created
-   * by a device (the local admin included) also marks the server set up.
+   * Create a single-use enrollment (device 10 min, host 30 min by default).
    */
   createEnrollment(kind, createdBy, ttlMs = kind === "device" ? DEVICE_ENROLLMENT_TTL_MS : HOST_ENROLLMENT_TTL_MS) {
     const token = newToken();
@@ -2895,8 +2861,6 @@ var Auth = class {
     const now = this.store.now();
     const expiresAt = new Date(now.getTime() + ttlMs).toISOString();
     this.store.tx(() => {
-      if (createdBy !== null)
-        this.owner.markInitialized();
       this.store.insertEnrollment({
         id,
         kind,
@@ -4278,7 +4242,7 @@ function resolveProfile(ctx, profileId, project) {
   const id = profileId ?? project?.defaultProfileId ?? null;
   if (id)
     return ctx.store.profiles.require(id);
-  const first = ctx.store.profiles.list(void 0, [], "created_at")[0];
+  const first = ctx.store.profiles.list(void 0, [], "created_at, rowid")[0];
   if (!first)
     throw new SwitchyardError("invalid_request", "No Pi profile configured");
   return first;
@@ -4399,7 +4363,7 @@ function createSession(ctx, input) {
     nativeHandle: null,
     profileSnapshot: profile,
     runtime: "starting",
-    runtimeDetail: null,
+    runtimeDetail: workspace ? "Starting Pi\u2026" : "Creating worktree\u2026",
     connectivity: host.connectivity,
     runId: null,
     taskId: null,
@@ -4415,19 +4379,27 @@ function createSession(ctx, input) {
   ctx.store.putSession(session);
   const choice = input.workspace;
   const started = (async () => {
+    const t0 = Date.now();
     try {
       let s = session;
       if (!("existingId" in choice)) {
         const ws = await createWorkspace(ctx, project, checkout, choice.newBranch, choice.base);
+        ctx.log.info({ sessionId: session.id, ms: Date.now() - t0 }, "session start: worktree ready");
         s = ctx.store.tx(() => {
           const cur = ctx.store.sessions.require(session.id);
-          return ctx.store.putSession({ ...cur, workspaceId: ws.id, cwd: ws.path });
+          return ctx.store.putSession({
+            ...cur,
+            workspaceId: ws.id,
+            cwd: ws.path,
+            runtimeDetail: "Starting Pi\u2026"
+          });
         });
       }
       await startOnHost(ctx, s, {
         initialPrompt: input.prompt.trim() ? input.prompt : null,
         nativeHandle: null
       });
+      ctx.log.info({ sessionId: session.id, ms: Date.now() - t0 }, "session start: started on host");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       ctx.log.warn({ err, sessionId: session.id }, "session start failed");
@@ -7268,10 +7240,23 @@ INSERT OR IGNORE INTO settings(key, value)
   WHERE EXISTS (SELECT 1 FROM devices WHERE is_admin = 0 AND revoked_at IS NULL);
 `;
 
+// packages/coordinator/dist/db/migrations/003_terminal_login.js
+var sql3 = `
+DROP TABLE auth_flows;
+
+CREATE TABLE auth_flows (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('passkey_register','passkey_auth','oidc','terminal_login')),
+  data TEXT NOT NULL,
+  expires_at TEXT NOT NULL
+);
+`;
+
 // packages/coordinator/dist/db/index.js
 var MIGRATIONS = [
   { version: 1, name: "001_init", sql },
-  { version: 2, name: "002_owner_auth", sql: sql2 }
+  { version: 2, name: "002_owner_auth", sql: sql2 },
+  { version: 3, name: "003_terminal_login", sql: sql3 }
 ];
 var LATEST_MIGRATION = MIGRATIONS[MIGRATIONS.length - 1].version;
 function openDb(path) {
@@ -7437,6 +7422,9 @@ var HOST_SESSION_FIELDS = [
   "runtimeDetail",
   "queue",
   "stats",
+  "model",
+  "thinking",
+  "compacting",
   "lastAssistantText",
   "lastActivityAt",
   "terminal"
@@ -7955,7 +7943,7 @@ var HostHub = class {
         projectId: ws?.projectId ?? null,
         cwd: "",
         nativeHandle: null,
-        profileSnapshot: this.store.profiles.list(void 0, [], "created_at")[0] ?? FALLBACK_PROFILE,
+        profileSnapshot: this.store.profiles.list(void 0, [], "created_at, rowid")[0] ?? FALLBACK_PROFILE,
         runtime: "idle",
         runtimeDetail: null,
         runId: null,
@@ -8108,8 +8096,11 @@ import * as client from "openid-client";
 // packages/coordinator/dist/owner.js
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { isIP } from "node:net";
-var OWNER_INITIALIZED_KEY = "owner.initialized_at";
 var OWNER_WEBAUTHN_USER_KEY = "owner.webauthn_user_id";
+function isLoopbackUrl(url) {
+  const host = new URL(url).hostname.replace(/^\[|\]$/g, "");
+  return host === "localhost" || host === "::1" || /^127\.\d+\.\d+\.\d+$/.test(host);
+}
 var Owner = class {
   store;
   config;
@@ -8117,18 +8108,6 @@ var Owner = class {
     this.store = store;
     this.config = config;
   }
-  isInitialized() {
-    return this.config.oidc !== null || this.store.getSetting(OWNER_INITIALIZED_KEY, null) !== null;
-  }
-  /** Mark the server set up. Returns true when this call set it. */
-  markInitialized() {
-    return this.store.tx(() => {
-      if (this.store.getSetting(OWNER_INITIALIZED_KEY, null) !== null)
-        return false;
-      this.store.setSetting(OWNER_INITIALIZED_KEY, this.store.nowIso());
-      return true;
-    });
-  }
   /** Stable random WebAuthn user handle for the owner (16 bytes, created lazily). */
   webauthnUserId() {
     return this.store.tx(() => {
@@ -8788,53 +8767,6 @@ function registerAttentionRoutes(app, ctx) {
   app.post("/api/attention/:id/acknowledge", async (req) => ctx.attention.acknowledge(req.params.id));
 }
 
-// packages/coordinator/dist/routes/devices.js
-import QRCode2 from "qrcode";
-import { z as z14 } from "zod";
-var UpdateDeviceRequest = z14.object({
-  name: z14.string().min(1).max(80).optional(),
-  preferredMobile: z14.boolean().optional()
-});
-async function enrollmentResponse(ctx, kind, createdBy) {
-  const e = ctx.auth.createEnrollment(kind, createdBy);
-  const qrSvg = await QRCode2.toString(e.url, { type: "svg", margin: 1 });
-  return { token: e.token, url: e.url, expiresAt: e.expiresAt, qrSvg, command: e.command };
-}
-function publicDevice(ctx, id) {
-  return ctx.store.devices.require(id);
-}
-function registerDeviceRoutes(app, ctx) {
-  app.post("/api/enrollments", async (req, reply) => {
-    const body = parse(CreateEnrollmentRequest, req.body);
-    return reply.code(201).send(await enrollmentResponse(ctx, body.kind, deviceOf(req).id));
-  });
-  app.post("/api/devices/enrollments", async (req, reply) => reply.code(201).send(await enrollmentResponse(ctx, "device", deviceOf(req).id)));
-  app.get("/api/devices", async () => ctx.store.devices.list("is_admin = 0", [], "created_at"));
-  app.get("/api/devices/:id", async (req) => publicDevice(ctx, req.params.id));
-  app.patch("/api/devices/:id", async (req) => {
-    const { id } = req.params;
-    const body = parse(UpdateDeviceRequest, req.body);
-    return ctx.store.tx(() => {
-      const d = ctx.store.devices.require(id);
-      if (body.preferredMobile) {
-        for (const other of ctx.store.devices.list("is_admin = 0")) {
-          if (other.id !== id && other.preferredMobile) {
-            ctx.store.putDevice({ ...other, preferredMobile: false });
-          }
-        }
-      }
-      return ctx.store.putDevice({
-        ...d,
-        name: body.name ?? d.name,
-        preferredMobile: body.preferredMobile ?? d.preferredMobile
-      });
-    });
-  });
-  const revoke = async (req) => ctx.auth.revokeDevice(req.params.id);
-  app.post("/api/devices/:id/revoke", revoke);
-  app.delete("/api/devices/:id", revoke);
-}
-
 // packages/coordinator/dist/routes/auth.js
 var HANDOFF_PAGE = `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
@@ -8845,7 +8777,6 @@ var HANDOFF_PAGE = `<!doctype html>
 function setupState(ctx) {
   const availability = ctx.owner.passkeyAvailability();
   return {
-    initialized: ctx.owner.isInitialized(),
     passkey: {
       available: availability.available,
       registered: ctx.passkeys.count() > 0,
@@ -8925,6 +8856,18 @@ function registerAuthRoutes(app, ctx) {
     ctx.auth.setDeviceCookie(reply, r.credential);
     return { status: "done", deviceId: r.deviceId };
   });
+  app.post("/api/auth/terminal/start", async (req, reply) => {
+    limitAuth(req);
+    const body = parse(TerminalLoginStartRequest, req.body);
+    return reply.code(201).send(ctx.terminalLogins.start(body.name, req.ip));
+  });
+  app.post("/api/auth/terminal/claim", async (req) => {
+    const body = parse(TerminalLoginClaimRequest, req.body);
+    return ctx.terminalLogins.claim(body.userCode, body.pollToken);
+  });
+  app.get("/api/auth/terminal/requests/:code", async (req) => ctx.terminalLogins.describe(req.params.code));
+  app.post("/api/auth/terminal/requests/:code/approve", async (req) => ctx.terminalLogins.approve(req.params.code));
+  app.post("/api/auth/terminal/requests/:code/deny", async (req) => ctx.terminalLogins.deny(req.params.code));
   app.get("/api/auth/methods", async () => {
     const availability = ctx.owner.passkeyAvailability();
     return {
@@ -8943,15 +8886,6 @@ function registerAuthRoutes(app, ctx) {
     ctx.passkeys.remove(req.params.id);
     return { ok: true };
   });
-  app.post("/api/admin/init", async (req) => {
-    const device = deviceOf(req);
-    if (!device.isAdmin || device.id !== ADMIN_DEVICE_ID) {
-      throw new SwitchyardError("forbidden", "Only the server's local admin token can initialize");
-    }
-    const alreadyInitialized = !ctx.owner.markInitialized();
-    const enrollment = await enrollmentResponse(ctx, "device", device.id);
-    return { alreadyInitialized, enrollment };
-  });
 }
 function redirectError(ctx, req, reply, err) {
   const code = err instanceof SwitchyardError ? err.code : "oidc_failed";
@@ -8961,7 +8895,54 @@ function redirectError(ctx, req, reply, err) {
   else if (err.code === "forbidden")
     ctx.log.info({ detail }, "OIDC sign-in refused");
   const qs = new URLSearchParams({ error: code, detail });
-  return reply.redirect(`/enroll?${qs.toString()}`, 302);
+  return reply.redirect(`/sign-in?${qs.toString()}`, 302);
+}
+
+// packages/coordinator/dist/routes/devices.js
+import QRCode from "qrcode";
+import { z as z14 } from "zod";
+var UpdateDeviceRequest = z14.object({
+  name: z14.string().min(1).max(80).optional(),
+  preferredMobile: z14.boolean().optional()
+});
+async function enrollmentResponse(ctx, kind, createdBy) {
+  const e = ctx.auth.createEnrollment(kind, createdBy);
+  const qrSvg = await QRCode.toString(e.url, { type: "svg", margin: 1 });
+  return { token: e.token, url: e.url, expiresAt: e.expiresAt, qrSvg, command: e.command };
+}
+function publicDevice(ctx, id) {
+  return ctx.store.devices.require(id);
+}
+function registerDeviceRoutes(app, ctx) {
+  app.post("/api/enrollments", async (req, reply) => {
+    const body = parse(CreateEnrollmentRequest, req.body);
+    return reply.code(201).send(await enrollmentResponse(ctx, body.kind, deviceOf(req).id));
+  });
+  app.post("/api/devices/enrollments", async (req, reply) => reply.code(201).send(await enrollmentResponse(ctx, "device", deviceOf(req).id)));
+  app.get("/api/devices", async () => ctx.store.devices.list("is_admin = 0", [], "created_at"));
+  app.get("/api/devices/:id", async (req) => publicDevice(ctx, req.params.id));
+  app.patch("/api/devices/:id", async (req) => {
+    const { id } = req.params;
+    const body = parse(UpdateDeviceRequest, req.body);
+    return ctx.store.tx(() => {
+      const d = ctx.store.devices.require(id);
+      if (body.preferredMobile) {
+        for (const other of ctx.store.devices.list("is_admin = 0")) {
+          if (other.id !== id && other.preferredMobile) {
+            ctx.store.putDevice({ ...other, preferredMobile: false });
+          }
+        }
+      }
+      return ctx.store.putDevice({
+        ...d,
+        name: body.name ?? d.name,
+        preferredMobile: body.preferredMobile ?? d.preferredMobile
+      });
+    });
+  });
+  const revoke = async (req) => ctx.auth.revokeDevice(req.params.id);
+  app.post("/api/devices/:id/revoke", revoke);
+  app.delete("/api/devices/:id", revoke);
 }
 
 // packages/coordinator/dist/routes/hosts.js
@@ -9133,23 +9114,39 @@ function registerOpsRoutes(app, ctx) {
 
 // packages/coordinator/dist/routes/profiles.js
 var ProfilePatch = Profile.omit({ id: true }).partial();
-function seedDefaultProfile(ctx) {
+function seedDefaultProfiles(ctx) {
   ctx.store.tx(() => {
-    if (ctx.store.profiles.count() > 0)
+    if (ctx.store.profiles.count() === 0) {
+      ctx.store.putProfile({
+        id: newId("prf"),
+        name: "Default",
+        provider: null,
+        model: null,
+        thinking: null,
+        projectTrust: "ask",
+        extraArgs: []
+      });
+    }
+    if (ctx.store.getSetting("profiles.vanillaSeeded", false))
       return;
-    ctx.store.putProfile({
-      id: newId("prf"),
-      name: "Default",
-      provider: null,
-      model: null,
-      thinking: null,
-      projectTrust: "ask",
-      extraArgs: []
-    });
+    const has = ctx.store.profiles.list().some((p) => p.resources === "vanilla");
+    if (!has) {
+      ctx.store.putProfile({
+        id: newId("prf"),
+        name: "Vanilla",
+        provider: null,
+        model: null,
+        thinking: null,
+        projectTrust: "ask",
+        extraArgs: [],
+        resources: "vanilla"
+      });
+    }
+    ctx.store.setSetting("profiles.vanillaSeeded", true);
   });
 }
 function registerProfileRoutes(app, ctx) {
-  app.get("/api/profiles", async () => ctx.store.profiles.list(void 0, [], "created_at"));
+  app.get("/api/profiles", async () => ctx.store.profiles.list(void 0, [], "created_at, rowid"));
   app.get("/api/profiles/:id", async (req) => ctx.store.profiles.require(req.params.id));
   app.post("/api/profiles", async (req, reply) => {
     const body = parse(ProfileInput, req.body);
@@ -9316,6 +9313,20 @@ function registerProjectRoutes(app, ctx) {
 
 // packages/coordinator/dist/routes/sessions.js
 import { z as z16 } from "zod";
+function requireLiveSession(ctx, s) {
+  if (s.readOnly)
+    throw new SwitchyardError("forbidden", SUBAGENT_READ_ONLY);
+  if (!LIVE_RUNTIMES2.includes(s.runtime) || s.runtime === "starting") {
+    throw new SwitchyardError("conflict", s.runtime === "starting" ? "Session is still starting" : `Session ${s.runtime}: Resume to send`);
+  }
+  requireConnected(ctx, s.hostId);
+}
+function requireSessionControls(ctx, s) {
+  requireLiveSession(ctx, s);
+  if (ctx.store.hosts.get(s.hostId)?.capabilities?.sessionControls !== true) {
+    throw new SwitchyardError("invalid_request", "Update Switchyard on this host to change the model, effort or commands from here");
+  }
+}
 var ListQuery5 = z16.object({
   projectId: z16.string().optional(),
   hostId: z16.string().optional(),
@@ -9449,12 +9460,7 @@ function registerSessionRoutes(app, ctx) {
   app.post("/api/sessions/:id/prompt", async (req) => {
     const s = get(idOf(req));
     const body = parse(PromptRequest, req.body);
-    if (s.readOnly)
-      throw new SwitchyardError("forbidden", SUBAGENT_READ_ONLY);
-    if (!LIVE_RUNTIMES2.includes(s.runtime) || s.runtime === "starting") {
-      throw new SwitchyardError("conflict", s.runtime === "starting" ? "Session is still starting" : `Session ${s.runtime}: Resume to send`);
-    }
-    requireConnected(ctx, s.hostId);
+    requireLiveSession(ctx, s);
     const run = ctx.store.runForSession(s);
     const result = await ctx.hostHub.request(s.hostId, {
       type: "session.prompt",
@@ -9472,9 +9478,56 @@ function registerSessionRoutes(app, ctx) {
       automationActive: run?.controlMode === "automation"
     };
   });
-  app.post("/api/sessions/:id/abort", async (req) => {
+  app.get("/api/sessions/:id/models", async (req) => {
     const s = get(idOf(req));
-    const body = parse(AbortRequest, req.body);
+    requireSessionControls(ctx, s);
+    return SessionModelsResult.parse(await ctx.hostHub.request(s.hostId, { type: "session.models", sessionId: s.id }));
+  });
+  app.get("/api/sessions/:id/commands", async (req) => {
+    const s = get(idOf(req));
+    requireSessionControls(ctx, s);
+    return SessionCommandsResult.parse(await ctx.hostHub.request(s.hostId, { type: "session.commands", sessionId: s.id }));
+  });
+  app.post("/api/sessions/:id/model", async (req) => {
+    const s = get(idOf(req));
+    const body = parse(SetModelRequest, req.body);
+    requireSessionControls(ctx, s);
+    return ModelStateResult.parse(await ctx.hostHub.request(s.hostId, {
+      type: "session.setModel",
+      sessionId: s.id,
+      provider: body.provider,
+      modelId: body.modelId
+    }));
+  });
+  app.post("/api/sessions/:id/thinking", async (req) => {
+    const s = get(idOf(req));
+    const body = parse(SetThinkingRequest, req.body);
+    requireSessionControls(ctx, s);
+    return ModelStateResult.parse(await ctx.hostHub.request(s.hostId, {
+      type: "session.setThinking",
+      sessionId: s.id,
+      level: body.level
+    }));
+  });
+  app.post("/api/sessions/:id/compact", async (req) => {
+    const s = get(idOf(req));
+    const body = parse(CompactRequest, req.body ?? {});
+    requireSessionControls(ctx, s);
+    if (s.runtime !== "idle") {
+      throw new SwitchyardError("conflict", "Wait for the run to finish before compacting");
+    }
+    if (s.compacting)
+      throw new SwitchyardError("conflict", "Compaction is already running");
+    await ctx.hostHub.request(s.hostId, {
+      type: "session.compact",
+      sessionId: s.id,
+      instructions: body.instructions?.trim() || null
+    });
+    return { ok: true };
+  });
+  app.post("/api/sessions/:id/abort", async (req) => {
+    const s = get(idOf(req));
+    const body = parse(AbortRequest, req.body);
     requireConnected(ctx, s.hostId);
     await ctx.hostHub.request(s.hostId, {
       type: "session.abort",
@@ -9673,11 +9726,11 @@ var Statements = class {
   constructor(db) {
     this.db = db;
   }
-  get(sql3) {
-    let s = this.cache.get(sql3);
+  get(sql4) {
+    let s = this.cache.get(sql4);
     if (!s) {
-      s = this.db.prepare(sql3);
-      this.cache.set(sql3, s);
+      s = this.db.prepare(sql4);
+      this.cache.set(sql4, s);
     }
     return s;
   }
@@ -9708,12 +9761,12 @@ var JsonRepo = class {
   }
   /** List with an optional SQL `WHERE` fragment over the indexed columns. */
   list(where, params = [], orderBy = "rowid") {
-    const sql3 = `SELECT json FROM ${this.table}${where ? ` WHERE ${where}` : ""} ORDER BY ${orderBy}`;
-    return this.st.get(sql3).all(...params).map((r) => JSON.parse(r.json));
+    const sql4 = `SELECT json FROM ${this.table}${where ? ` WHERE ${where}` : ""} ORDER BY ${orderBy}`;
+    return this.st.get(sql4).all(...params).map((r) => JSON.parse(r.json));
   }
   count(where, params = []) {
-    const sql3 = `SELECT COUNT(*) AS n FROM ${this.table}${where ? ` WHERE ${where}` : ""}`;
-    return this.st.get(sql3).get(...params).n;
+    const sql4 = `SELECT COUNT(*) AS n FROM ${this.table}${where ? ` WHERE ${where}` : ""}`;
+    return this.st.get(sql4).get(...params).n;
   }
   /**
    * Update by id, or insert when missing. `extra` columns are written in both cases when given
@@ -10356,7 +10409,7 @@ var Store2 = class {
       projects: this.projects.list(void 0, [], "created_at"),
       checkouts: this.checkouts.list(),
       workspaces: this.workspaces.list("archived_at IS NULL"),
-      profiles: this.profiles.list(void 0, [], "created_at"),
+      profiles: this.profiles.list(void 0, [], "created_at, rowid"),
       sessions,
       tasks,
       runs,
@@ -10459,6 +10512,126 @@ var TerminalHub = class {
   }
 };
 
+// packages/coordinator/dist/terminal-login.js
+import { randomInt } from "node:crypto";
+var TERMINAL_LOGIN_TTL_MS = 10 * 6e4;
+var TERMINAL_LOGIN_POLL_MS = 2e3;
+var CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
+function normalizeUserCode(s) {
+  return s.toUpperCase().replace(/[^A-Z]/g, "");
+}
+function formatUserCode(n) {
+  return `${n.slice(0, 4)}-${n.slice(4)}`;
+}
+var TerminalLogins = class {
+  store;
+  config;
+  auth;
+  flows;
+  constructor(store, config, auth) {
+    this.store = store;
+    this.config = config;
+    this.auth = auth;
+    this.flows = new AuthFlows(store);
+  }
+  load(code) {
+    const id = normalizeUserCode(code);
+    const flow = this.flows.get("terminal_login", id);
+    if (!flow) {
+      throw new SwitchyardError("not_found", "This sign-in request expired or does not exist. Run `switchyard login` again.");
+    }
+    return { id, flow };
+  }
+  view(id, flow) {
+    return {
+      userCode: formatUserCode(id),
+      name: flow.name,
+      requestedFrom: flow.requestedFrom,
+      createdAt: flow.createdAt,
+      expiresAt: flow.expiresAt,
+      status: flow.status
+    };
+  }
+  start(name, requestedFrom) {
+    let id = "";
+    for (let attempt = 0; attempt < 5 && !id; attempt++) {
+      let candidate = "";
+      for (let i = 0; i < 8; i++)
+        candidate += CODE_ALPHABET[randomInt(0, CODE_ALPHABET.length)];
+      if (!this.flows.get("terminal_login", candidate))
+        id = candidate;
+    }
+    if (!id)
+      throw new SwitchyardError("internal", "Could not allocate a sign-in code");
+    const pollToken = newToken();
+    const now = this.store.now();
+    const createdAt = now.toISOString();
+    const expiresAt = new Date(now.getTime() + TERMINAL_LOGIN_TTL_MS).toISOString();
+    const flow = {
+      name,
+      requestedFrom,
+      createdAt,
+      expiresAt,
+      pollTokenHash: sha256(pollToken),
+      status: "pending",
+      result: null
+    };
+    this.flows.put("terminal_login", id, flow, TERMINAL_LOGIN_TTL_MS);
+    const userCode = formatUserCode(id);
+    return {
+      userCode,
+      pollToken,
+      verifyUrl: `${this.config.publicUrl}/terminal-login?code=${userCode}`,
+      expiresAt,
+      intervalMs: TERMINAL_LOGIN_POLL_MS
+    };
+  }
+  describe(code) {
+    const { id, flow } = this.load(code);
+    return this.view(id, flow);
+  }
+  approve(code) {
+    return this.store.tx(() => {
+      const { id, flow } = this.load(code);
+      if (flow.status !== "pending") {
+        throw new SwitchyardError("invalid_request", "This sign-in was already approved or denied");
+      }
+      const { device, credential } = this.auth.createDevice(flow.name, "terminal", "approval");
+      const next = {
+        ...flow,
+        status: "approved",
+        result: { deviceId: device.id, credential }
+      };
+      this.flows.update(id, next);
+      return this.view(id, next);
+    });
+  }
+  deny(code) {
+    return this.store.tx(() => {
+      const { id, flow } = this.load(code);
+      if (flow.status !== "pending") {
+        throw new SwitchyardError("invalid_request", "This sign-in was already approved or denied");
+      }
+      const next = { ...flow, status: "denied" };
+      this.flows.update(id, next);
+      return this.view(id, next);
+    });
+  }
+  claim(code, pollToken) {
+    const id = normalizeUserCode(code);
+    const flow = this.flows.get("terminal_login", id);
+    if (!flow || !safeEqualHex(sha256(pollToken), flow.pollTokenHash)) {
+      throw new SwitchyardError("unauthorized", "Unknown or expired sign-in");
+    }
+    if (flow.status === "pending")
+      return { status: "pending" };
+    this.flows.delete(id);
+    if (flow.status === "denied" || !flow.result)
+      return { status: "denied" };
+    return { status: "done", deviceId: flow.result.deviceId, credential: flow.result.credential };
+  }
+};
+
 // packages/coordinator/dist/server.js
 var MIN_HOST_ENROLL_SECRET_LENGTH = 32;
 var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
@@ -10469,6 +10642,8 @@ var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
   "/api/auth/oidc/begin",
   "/api/auth/oidc/callback",
   "/api/auth/oidc/claim",
+  "/api/auth/terminal/start",
+  "/api/auth/terminal/claim",
   "/api/hosts/enroll",
   "/api/hooks/:automationId",
   "/healthz",
@@ -10490,13 +10665,16 @@ function isApiLikePath(url) {
   }
   return path.startsWith("/api/") || path.startsWith("/ws/") || path.startsWith("/adapter-frames/");
 }
-function originOf2(url) {
+function originOf(url) {
   return new URL(url).origin;
 }
 function validateAuthOptions(opts) {
   if (opts.hostEnrollSecret !== void 0 && opts.hostEnrollSecret.length < MIN_HOST_ENROLL_SECRET_LENGTH) {
     throw new SwitchyardError("invalid_request", `SWITCHYARD_HOST_ENROLL_SECRET must be at least ${MIN_HOST_ENROLL_SECRET_LENGTH} characters`);
   }
+  if (!opts.oidc && opts.publicUrl && !isLoopbackUrl(opts.publicUrl)) {
+    throw new SwitchyardError("invalid_request", `Single sign-on is required for ${opts.publicUrl}: set SWITCHYARD_OIDC_ISSUER, SWITCHYARD_OIDC_CLIENT_ID and an owner (SWITCHYARD_OIDC_OWNER_*), see docs/auth.md. Without single sign-on, Switchyard runs only at a localhost public URL.`);
+  }
   if (opts.oidc && !hasOwnerMatch(opts.oidc.owner)) {
     throw new SwitchyardError("invalid_request", "OIDC needs an owner match: set SWITCHYARD_OIDC_OWNER_SUBJECT, SWITCHYARD_OIDC_OWNER_EMAIL or SWITCHYARD_OIDC_OWNER_GROUP");
   }
@@ -10521,7 +10699,7 @@ function createCoordinator(opts) {
   const config = {
     dataDir,
     publicUrl,
-    trustedOrigins: opts.trustedOrigins ?? [originOf2(publicUrl)],
+    trustedOrigins: opts.trustedOrigins ?? [originOf(publicUrl)],
     webDist: opts.webDist ? resolve3(opts.webDist) : null,
     secureCookies: publicUrl.startsWith("https:"),
     unreachableAfterMs: opts.unreachableAfterMs ?? 6e4,
@@ -10534,19 +10712,18 @@ function createCoordinator(opts) {
   hub.onListenerError = (name, err) => log.error({ err, event: name }, "event listener failed");
   const store = new Store2(db, hub, opts.clock);
   const owner = new Owner(store, config);
-  const auth = new Auth(store, config, hub, owner);
+  const auth = new Auth(store, config, hub);
   const adminToken = auth.ensureAdminToken();
-  if (config.oidc)
-    owner.markInitialized();
   const passkeys = new Passkeys(store, owner, config, auth);
   const oidc = config.oidc ? new Oidc(store, owner, config, auth) : null;
+  const terminalLogins = new TerminalLogins(store, config, auth);
   const limits = opts.rateLimits === false ? null : opts.rateLimits ?? {};
   const storeClock = () => store.now().getTime();
   const limiters = {
     auth: new RateLimiter(limits ? limits.auth ?? AUTH_RATE_LIMIT : Number.POSITIVE_INFINITY, 6e4, storeClock),
     hosts: new RateLimiter(limits ? limits.hosts ?? HOSTS_RATE_LIMIT : Number.POSITIVE_INFINITY, 6e4, storeClock)
   };
-  seedDefaultProfile({ store });
+  seedDefaultProfiles({ store });
   const attention = new AttentionService(store, hub);
   const hostHub = new HostHub(store, hub, attention, log.child({ mod: "host-hub" }), {
     unreachableAfterMs: config.unreachableAfterMs,
@@ -10568,6 +10745,7 @@ function createCoordinator(opts) {
     owner,
     passkeys,
     oidc,
+    terminalLogins,
     limiters,
     log,
     services: /* @__PURE__ */ new Map()
@@ -10675,10 +10853,10 @@ function createCoordinator(opts) {
       sweep();
       retentionTimer = setInterval(sweep, opts.retentionIntervalMs ?? 36e5);
       retentionTimer.unref();
-      if (!owner.isInitialized()) {
-        log.info("not set up yet: run `switchyard init` on this server");
+      if (!config.oidc && auth.activeDeviceCount() === 0 && passkeys.count() === 0) {
+        log.info("no device signed in yet: run `switchyard pair` on this machine");
         if (opts.setupHint !== false) {
-          process.stderr.write("Switchyard is not set up yet. Run `switchyard init` on this server to create the first sign-in link.\n");
+          process.stderr.write("No device is signed in yet. Run `switchyard pair` on this machine for a single-use sign-in link.\n");
         }
       }
     },
@@ -10699,162 +10877,11 @@ function createCoordinator(opts) {
   return coordinator;
 }
 
-// packages/cli/dist/commands/coordinator.js
-function parseListen(v) {
-  const s = v.trim();
-  let host = "0.0.0.0";
-  let portStr = s;
-  const v6 = s.match(/^\[([^\]]+)\]:(\d+)$/);
-  if (v6) {
-    host = v6[1];
-    portStr = v6[2];
-  } else if (s.includes(":")) {
-    const i = s.lastIndexOf(":");
-    host = s.slice(0, i) || "0.0.0.0";
-    portStr = s.slice(i + 1);
-  } else if (!/^\d+$/.test(s)) {
-    host = s;
-    portStr = String(DEFAULT_PORT);
-  }
-  const port = Number(portStr);
-  if (!Number.isInteger(port) || port < 0 || port > 65535) {
-    throw new CliError(`Invalid listen address "${v}" (expected host:port)`);
-  }
-  return { host, port };
-}
-function parseOrigins(v) {
-  if (!v?.trim())
-    return void 0;
-  return v.split(",").map((o) => o.trim().replace(/\/+$/, "")).filter(Boolean);
-}
-var DEFAULT_OIDC_LABEL = "Sign in with single sign-on";
-var DEFAULT_OIDC_SCOPES = "openid profile email groups";
-function envValue(env, key) {
-  const v = env[key]?.trim();
-  return v ? v : void 0;
-}
-function authOptionsFromEnv(env) {
-  const out = {};
-  const secret = envValue(env, "SWITCHYARD_HOST_ENROLL_SECRET");
-  if (secret)
-    out.hostEnrollSecret = secret;
-  const proxies = parseOrigins(env.SWITCHYARD_TRUSTED_PROXIES);
-  if (proxies)
-    out.trustedProxies = proxies;
-  const issuer = envValue(env, "SWITCHYARD_OIDC_ISSUER");
-  const clientId = envValue(env, "SWITCHYARD_OIDC_CLIENT_ID");
-  if (issuer && clientId) {
-    if (!/^https?:\/\//.test(issuer)) {
-      throw new CliError(`SWITCHYARD_OIDC_ISSUER must be an http(s) URL, got "${issuer}"`);
-    }
-    out.oidc = {
-      issuer,
-      clientId,
-      clientSecret: envValue(env, "SWITCHYARD_OIDC_CLIENT_SECRET") ?? null,
-      label: envValue(env, "SWITCHYARD_OIDC_LABEL") ?? DEFAULT_OIDC_LABEL,
-      scopes: envValue(env, "SWITCHYARD_OIDC_SCOPES") ?? DEFAULT_OIDC_SCOPES,
-      owner: {
-        subject: envValue(env, "SWITCHYARD_OIDC_OWNER_SUBJECT") ?? null,
-        email: envValue(env, "SWITCHYARD_OIDC_OWNER_EMAIL") ?? null,
-        group: envValue(env, "SWITCHYARD_OIDC_OWNER_GROUP") ?? null
-      }
-    };
-  } else if (issuer || clientId) {
-    throw new CliError("Single sign-on needs both SWITCHYARD_OIDC_ISSUER and SWITCHYARD_OIDC_CLIENT_ID");
-  }
-  return out;
-}
-function coordinatorOptions(flags, env) {
-  const dataDir = flags.dataDir ? resolve4(flags.dataDir) : defaultDataDir(env);
-  const listen = parseListen(flags.listen ?? env.SWITCHYARD_LISTEN ?? `0.0.0.0:${DEFAULT_PORT}`);
-  const publicUrl = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim() || void 0;
-  if (publicUrl && !/^https?:\/\//.test(publicUrl)) {
-    throw new CliError(`Public URL must start with http:// or https://, got "${publicUrl}"`);
-  }
-  const trustedOrigins = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
-  return {
-    dataDir,
-    listen,
-    publicUrl,
-    trustedOrigins,
-    webDist: resolveWebDist(flags.webDist, env),
-    ...authOptionsFromEnv(env)
-  };
-}
-function waitForSignal() {
-  return new Promise((res) => {
-    const on = (sig) => {
-      process.off("SIGINT", on);
-      process.off("SIGTERM", on);
-      res(sig);
-    };
-    process.on("SIGINT", on);
-    process.on("SIGTERM", on);
-  });
-}
-async function coordinatorStart(ctx, flags) {
-  const opts = coordinatorOptions(flags, ctx.env);
-  const c = createCoordinator(opts);
-  await c.start();
-  writeEndpoint(opts.dataDir, {
-    localUrl: localUrlFor(opts.listen, c.port),
-    publicUrl: c.config.publicUrl
-  });
-  ctx.err(`Switchyard coordinator listening on ${opts.listen.host}:${c.port} (public URL ${c.config.publicUrl}; data ${opts.dataDir}${opts.webDist ? "" : "; web app not found, API only"})`);
-  const sig = await waitForSignal();
-  ctx.err(`${sig}: stopping coordinator`);
-  await c.stop();
-}
-function localUrlFor(listen, port) {
-  const h = listen.host ?? "0.0.0.0";
-  const host = h === "0.0.0.0" || h === "::" || h === "" ? "127.0.0.1" : h.includes(":") ? `[${h}]` : h;
-  return `http://${host}:${port}`;
-}
-function dataDirOf(flags, env) {
-  return flags.dataDir ? resolve4(flags.dataDir) : defaultDataDir(env);
-}
-function coordinatorBackup(ctx, out, flags) {
-  const r = backup(dataDirOf(flags, ctx.env), out);
-  ctx.out(`Backed up to ${r.file} (schema ${r.migrationLevel})`);
-}
-function coordinatorRestore(ctx, file, flags) {
-  const r = restore(dataDirOf(flags, ctx.env), file);
-  ctx.out(`Restored ${r.restoredFrom} (schema ${r.migrationLevel}).`);
-  if (r.previous)
-    ctx.out(`The previous database was kept as ${r.previous}`);
-  if (r.migrationLevel < LATEST_MIGRATION) {
-    ctx.out("Migrations to the current schema run when the coordinator next starts.");
-  }
-}
-function coordinatorMigrate(ctx, flags) {
-  const dataDir = dataDirOf(flags, ctx.env);
-  const holder = lockHolder(dataDir);
-  if (holder !== null) {
-    throw new CliError(`Coordinator (pid ${holder}) is running on ${dataDir}; it migrated at start`);
-  }
-  const path = dbPath(dataDir);
-  const existed = existsSync6(path);
-  mkdirSync4(dataDir, { recursive: true });
-  const db = openDb(path);
-  try {
-    const before = existed ? migrationLevel(db) : 0;
-    migrate(db);
-    const after = migrationLevel(db);
-    ctx.out(before === after ? `Schema is current (level ${after}) at ${path}` : `Migrated ${path} from level ${before} to ${after}`);
-  } finally {
-    db.close();
-  }
-}
-
-// packages/cli/dist/commands/doctor.js
-import { execFile as execFile3 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
-
 // packages/adapter-sdk/dist/discovery.js
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { isAbsolute, join as join6, resolve as resolve5 } from "node:path";
+import { isAbsolute, join as join6, resolve as resolve4 } from "node:path";
 function piAgentDir(env = process.env, home = homedir2()) {
   const fromEnv = env.PI_CODING_AGENT_DIR?.trim();
   if (fromEnv)
@@ -10926,7 +10953,7 @@ function piPackageDirCandidates(source, agentDir, opts = {}) {
       return [join6(agentDir, "git", parsed.host, parsed.path)];
     case "local": {
       const p = expandHome(parsed.path, home);
-      return [isAbsolute(p) ? p : resolve5(agentDir, p)];
+      return [isAbsolute(p) ? p : resolve4(agentDir, p)];
     }
   }
 }
@@ -10952,7 +10979,7 @@ async function discoverPiPackages(opts = {}) {
   };
   const diag = (level, message) => out.diagnostics.push({ sessionId: null, adapterId: null, level, message });
   const settingsPath = join6(agentDir, "settings.json");
-  if (!existsSync7(settingsPath))
+  if (!existsSync6(settingsPath))
     return out;
   let settings;
   try {
@@ -10974,14 +11001,14 @@ async function discoverPiPackages(opts = {}) {
       home,
       globalNpmRoot: opts.globalNpmRoot
     });
-    const dir = candidates.find((c) => existsSync7(c));
+    const dir = candidates.find((c) => existsSync6(c));
     if (!dir) {
       diag("warning", `Pi package ${source} could not be resolved (looked in ${candidates.join(", ")}); any adapter it provides is not loaded.`);
       continue;
     }
     let pkg = null;
     const pkgPath = join6(dir, "package.json");
-    if (existsSync7(pkgPath)) {
+    if (existsSync6(pkgPath)) {
       try {
         pkg = await readJson(pkgPath);
       } catch (err) {
@@ -11133,7 +11160,7 @@ function genericWidgetPanel(lines) {
 
 // packages/adapter-sdk/dist/manifest.js
 import { readFile as readFile2 } from "node:fs/promises";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, resolve as resolve6 } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, resolve as resolve5 } from "node:path";
 import { validRange } from "semver";
 import { z as z18 } from "zod";
 var MANIFEST_FILE = "switchyard-adapter.json";
@@ -11177,7 +11204,7 @@ function parseManifest(input, path = null) {
   throw new ManifestError(`invalid adapter manifest: ${issues}`, path);
 }
 async function loadManifest(pathOrDir) {
-  const abs = resolve6(pathOrDir);
+  const abs = resolve5(pathOrDir);
   const manifestPath = abs.endsWith(".json") ? abs : join7(abs, MANIFEST_FILE);
   let raw;
   try {
@@ -11197,8 +11224,8 @@ async function loadManifest(pathOrDir) {
     manifest,
     manifestPath,
     dir,
-    serverPath: resolve6(dir, manifest.server),
-    webRendererPath: manifest.webRenderer ? resolve6(dir, manifest.webRenderer) : null
+    serverPath: resolve5(dir, manifest.server),
+    webRendererPath: manifest.webRenderer ? resolve5(dir, manifest.webRenderer) : null
   };
 }
 
@@ -11253,9 +11280,9 @@ function responseFitsRequest(req, resp) {
 }
 
 // packages/adapter-sdk/dist/registry.js
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { readdir, readFile as readFile3 } from "node:fs/promises";
-import { join as join8, resolve as resolve7 } from "node:path";
+import { join as join8, resolve as resolve6 } from "node:path";
 import { pathToFileURL } from "node:url";
 import { satisfies } from "semver";
 
@@ -11339,6 +11366,10 @@ var AdapterSession = class {
     this.activeTools.set(e.toolCallId, e);
     await this.callAll("onToolStart", e);
   }
+  /** `tool_execution_update`: runs `onToolUpdate` hooks with the partial result. */
+  async onToolUpdate(e) {
+    await this.callAll("onToolUpdate", e);
+  }
   /** `tool_execution_end`: runs `onToolEnd` hooks, then expires answers queued for the call. */
   async onToolEnd(e) {
     try {
@@ -11676,7 +11707,7 @@ function isServerAdapter(x) {
 async function loadAdapterFromDir(pathOrDir, tier) {
   const m = await loadManifest(pathOrDir);
   const warnings = [];
-  if (!existsSync8(m.serverPath)) {
+  if (!existsSync7(m.serverPath)) {
     throw new AdapterLoadError(`server module ${m.serverPath} does not exist`, m.manifest);
   }
   let mod;
@@ -11697,7 +11728,7 @@ async function loadAdapterFromDir(pathOrDir, tier) {
     throw new AdapterLoadError(`${m.serverPath} must default-export a ServerAdapter object or factory`, m.manifest);
   }
   let webRendererPath = m.webRendererPath;
-  if (webRendererPath && !existsSync8(webRendererPath)) {
+  if (webRendererPath && !existsSync7(webRendererPath)) {
     warnings.push(`web renderer ${webRendererPath} does not exist; portable panels are used`);
     webRendererPath = null;
   }
@@ -11714,12 +11745,12 @@ async function loadAdapterFromDir(pathOrDir, tier) {
   };
 }
 async function subdirsWithManifest(root) {
-  if (!existsSync8(root))
+  if (!existsSync7(root))
     return [];
-  if (existsSync8(join8(root, MANIFEST_FILE)))
+  if (existsSync7(join8(root, MANIFEST_FILE)))
     return [root];
   const entries = await readdir(root, { withFileTypes: true });
-  return entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => join8(root, e.name)).filter((d) => existsSync8(join8(d, MANIFEST_FILE))).sort();
+  return entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => join8(root, e.name)).filter((d) => existsSync7(join8(d, MANIFEST_FILE))).sort();
 }
 var AdapterRegistry = class {
   opts;
@@ -11737,7 +11768,7 @@ var AdapterRegistry = class {
     this.diags = [];
     const candidates = [];
     if (opts.projectRoot) {
-      for (const d of await this.safeList(resolve7(opts.projectRoot, PROJECT_ADAPTER_DIR))) {
+      for (const d of await this.safeList(resolve6(opts.projectRoot, PROJECT_ADAPTER_DIR))) {
         candidates.push({ tier: "project", path: d });
       }
     }
@@ -11752,7 +11783,7 @@ var AdapterRegistry = class {
         this.diagnostic("warning", null, `Cannot read ${pkgDir}/package.json: ${err.message}`);
       }
       for (const e of entries)
-        candidates.push({ tier: "plugin", path: resolve7(pkgDir, e) });
+        candidates.push({ tier: "plugin", path: resolve6(pkgDir, e) });
     }
     const loaded = [];
     for (const c of candidates) {
@@ -12023,7 +12054,7 @@ async function runChecks(path, commands, opts = {}) {
 
 // packages/host-agent/dist/files.js
 import { lstat, readdir as readdir2, readFile as readFile4, realpath, stat } from "node:fs/promises";
-import { join as join9, relative, resolve as resolve8, sep } from "node:path";
+import { join as join9, relative, resolve as resolve7, sep } from "node:path";
 var MAX_READ_BYTES = 1024 * 1024;
 var BINARY_SNIFF_BYTES = 8e3;
 function isInside(root, target) {
@@ -12047,7 +12078,7 @@ async function resolveInside(root, rel) {
   if (rel.includes("\0"))
     throw new SwitchyardError("invalid_request", "Invalid path");
   const rootReal = await realRoot(root);
-  const target = resolve8(rootReal, rel.replace(/^[/\\]+/, ""));
+  const target = resolve7(rootReal, rel.replace(/^[/\\]+/, ""));
   if (!isInside(rootReal, target)) {
     throw new SwitchyardError("forbidden", "Path is outside the workspace");
   }
@@ -12126,7 +12157,7 @@ async function readWorkspaceFile(root, file) {
 import { execFile } from "node:child_process";
 import { appendFile, lstat as lstat2, mkdir, readFile as readFile5, realpath as realpath2, stat as stat2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join10, resolve as resolve9, sep as sep2 } from "node:path";
+import { join as join10, resolve as resolve8, sep as sep2 } from "node:path";
 var MAX_BUFFER = 64 * 1024 * 1024;
 var EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 var MAX_PATCH_BYTES = 2 * 1024 * 1024;
@@ -12203,7 +12234,7 @@ async function realpathOr(path) {
 }
 async function commonDirOf(path) {
   const { stdout } = await runGit(path, ["rev-parse", "--git-common-dir"]);
-  return realpathOr(resolve9(path, stdout.trim()));
+  return realpathOr(resolve8(path, stdout.trim()));
 }
 function notARepo(path) {
   return new SwitchyardError("not_a_git_repo", `${path} is not a git repository`);
@@ -12776,7 +12807,7 @@ function toErrorBody(err) {
 function queueKey(command) {
   if (command.type === "checks.run")
     return `checks:${command.sessionId}`;
-  if (command.type === "session.answer" || command.type === "session.abort" || command.type === "session.setControl" || command.type === "session.adapterAction" || command.type === "session.snapshot") {
+  if (command.type === "session.answer" || command.type === "session.abort" || command.type === "session.setControl" || command.type === "session.adapterAction" || command.type === "session.snapshot" || command.type === "session.models" || command.type === "session.commands") {
     return `control:${command.sessionId}`;
   }
   if ("sessionId" in command && typeof command.sessionId === "string") {
@@ -12931,6 +12962,16 @@ var CommandRouter = class {
         return sup.readNative(c.sessionFile);
       case "session.snapshot":
         return sup.snapshot(c.sessionId);
+      case "session.models":
+        return sup.models(c.sessionId);
+      case "session.commands":
+        return sup.commands(c.sessionId);
+      case "session.setModel":
+        return sup.setModel(c.sessionId, c.provider, c.modelId);
+      case "session.setThinking":
+        return sup.setThinking(c.sessionId, c.level);
+      case "session.compact":
+        return sup.compact(c.sessionId, c.instructions);
       case "checkout.inspect":
         return inspectCheckout2(c.path);
       case "projects.scan":
@@ -12967,8 +13008,8 @@ var CommandRouter = class {
 };
 
 // packages/host-agent/dist/config.js
-import { chmodSync as chmodSync3, existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync5, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir4, hostname as hostname2 } from "node:os";
+import { chmodSync as chmodSync3, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir4, hostname } from "node:os";
 import { dirname as dirname5, join as join12 } from "node:path";
 import { z as z21 } from "zod";
 var HostConfigSchema = z21.object({
@@ -13003,11 +13044,11 @@ function statePaths(stateDir) {
     logs: join12(stateDir, "logs")
   };
   for (const d of [p.root, p.runtime, p.logs])
-    mkdirSync5(d, { recursive: true, mode: 448 });
+    mkdirSync4(d, { recursive: true, mode: 448 });
   return p;
 }
 function loadConfig(path) {
-  if (!existsSync9(path)) {
+  if (!existsSync8(path)) {
     throw new SwitchyardError("not_found", `Host config ${path} not found; enroll this host first (switchyard host enroll)`);
   }
   let raw;
@@ -13026,7 +13067,7 @@ function loadConfig(path) {
 }
 function saveConfig(path, config) {
   const cfg = HostConfigSchema.parse(config);
-  mkdirSync5(dirname5(path), { recursive: true, mode: 448 });
+  mkdirSync4(dirname5(path), { recursive: true, mode: 448 });
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync4(tmp, `${JSON.stringify(cfg, null, 2)}
 `, { mode: 384 });
@@ -13104,16 +13145,16 @@ function abortError(signal) {
 async function waitForConfig(opts) {
   const { configPath, env, log, signal } = opts;
   const t = { ...DEFAULT_TIMING, ...opts.timing };
-  if (existsSync9(configPath))
+  if (existsSync8(configPath))
     return loadConfig(configPath);
   const secret = env.SWITCHYARD_HOST_ENROLL_SECRET?.trim();
   const coordinatorUrl = env.SWITCHYARD_COORDINATOR_URL?.trim();
   if (secret && coordinatorUrl) {
-    const name = env.SWITCHYARD_HOST_NAME?.trim() || hostname2();
+    const name = env.SWITCHYARD_HOST_NAME?.trim() || hostname();
     for (; ; ) {
       if (signal?.aborted)
         throw abortError(signal);
-      if (existsSync9(configPath))
+      if (existsSync8(configPath))
         return loadConfig(configPath);
       try {
         const enrolled = await enroll({
@@ -13143,7 +13184,7 @@ async function waitForConfig(opts) {
   for (; ; ) {
     if (signal?.aborted)
       throw abortError(signal);
-    if (existsSync9(configPath)) {
+    if (existsSync8(configPath)) {
       try {
         return loadConfig(configPath);
       } catch (err) {
@@ -13163,7 +13204,7 @@ async function waitForConfig(opts) {
 }
 
 // packages/host-agent/dist/db/index.js
-import { mkdirSync as mkdirSync6 } from "node:fs";
+import { mkdirSync as mkdirSync5 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
@@ -13247,7 +13288,7 @@ var HostDb = class {
   constructor(path) {
     this.path = path;
     if (path !== ":memory:")
-      mkdirSync6(dirname6(path), { recursive: true });
+      mkdirSync5(dirname6(path), { recursive: true });
     this.db = new DatabaseSync3(path);
     this.db.exec("PRAGMA journal_mode = WAL");
     this.db.exec("PRAGMA foreign_keys = ON");
@@ -13323,15 +13364,15 @@ var HostDb = class {
     else
       fn();
   }
-  run(sql3, params = []) {
-    const r = this.db.prepare(sql3).run(...params);
+  run(sql4, params = []) {
+    const r = this.db.prepare(sql4).run(...params);
     return { changes: Number(r.changes), lastInsertRowid: Number(r.lastInsertRowid) };
   }
-  get(sql3, params = []) {
-    return this.db.prepare(sql3).get(...params);
+  get(sql4, params = []) {
+    return this.db.prepare(sql4).get(...params);
   }
-  all(sql3, params = []) {
-    return this.db.prepare(sql3).all(...params);
+  all(sql4, params = []) {
+    return this.db.prepare(sql4).all(...params);
   }
   // ---- meta ----
   getMeta(key) {
@@ -13341,12 +13382,12 @@ var HostDb = class {
     this.run("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value", [key, value]);
   }
   // ---- JSON row helpers ----
-  getJson(sql3, params = []) {
-    const r = this.get(sql3, params);
+  getJson(sql4, params = []) {
+    const r = this.get(sql4, params);
     return r ? JSON.parse(r.json) : void 0;
   }
-  allJson(sql3, params = []) {
-    return this.all(sql3, params).map((r) => JSON.parse(r.json));
+  allJson(sql4, params = []) {
+    return this.all(sql4, params).map((r) => JSON.parse(r.json));
   }
   close() {
     try {
@@ -13871,6 +13912,45 @@ function createLogger2(opts = {}) {
 // packages/host-agent/dist/main.js
 import { readFileSync as readFileSync8 } from "node:fs";
 
+// packages/pi-runtime/dist/bridge/pi-model.js
+var PI_THINKING_LEVELS = [
+  "off",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+  "max"
+];
+function supportedThinkingLevels(model) {
+  const known = PI_THINKING_LEVELS;
+  if (Array.isArray(model?.thinkingLevels)) {
+    return model.thinkingLevels.filter((l) => typeof l === "string" && known.includes(l));
+  }
+  if (!model?.reasoning)
+    return ["off"];
+  return PI_THINKING_LEVELS.filter((level) => {
+    const mapped = model.thinkingLevelMap?.[level];
+    if (mapped === null)
+      return false;
+    if (level === "xhigh" || level === "max")
+      return mapped !== void 0;
+    return true;
+  });
+}
+function modelInfo(model) {
+  if (!model || typeof model.provider !== "string" || typeof model.id !== "string")
+    return null;
+  return {
+    provider: model.provider,
+    id: model.id,
+    name: typeof model.name === "string" && model.name ? model.name : null,
+    contextWindow: typeof model.contextWindow === "number" ? model.contextWindow : null,
+    reasoning: model.reasoning === true,
+    thinkingLevels: supportedThinkingLevels(model)
+  };
+}
+
 // packages/pi-runtime/dist/capabilities.js
 import { execFile as execFile2 } from "node:child_process";
 import semver from "semver";
@@ -13889,6 +13969,7 @@ var PI_RPC_CAPABILITIES = {
   widgetsComponent: false,
   tokenAccounting: true,
   costAccounting: true,
+  sessionControls: true,
   unsupported: [
     { capability: "customUi", reason: "ctx.ui.custom() returns undefined in RPC mode" },
     {
@@ -13912,6 +13993,7 @@ function noCapabilities(reason) {
     widgetsComponent: false,
     tokenAccounting: false,
     costAccounting: false,
+    sessionControls: false,
     unsupported: [{ capability: "all", reason }]
   };
 }
@@ -13964,7 +14046,7 @@ ${stderr}`));
 import { accessSync, constants, readFileSync as readFileSync6, realpathSync } from "node:fs";
 import { open, readdir as readdir4, readFile as readFile6, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { delimiter, dirname as dirname7, join as join13, resolve as resolve10 } from "node:path";
+import { delimiter, dirname as dirname7, join as join13, resolve as resolve9 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 
 // packages/pi-runtime/dist/transcript.js
@@ -14227,7 +14309,7 @@ async function listImportable(sessionsRoot = defaultSessionsRoot(), now = Date.n
 }
 function findOnPath(bin) {
   if (bin.includes("/"))
-    return resolve10(bin);
+    return resolve9(bin);
   for (const dir of (process.env.PATH ?? "").split(delimiter)) {
     if (!dir)
       continue;
@@ -14490,14 +14572,14 @@ function writeJsonl(stream, value) {
 import { spawn as spawn2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { EventEmitter as EventEmitter3 } from "node:events";
-import { chmodSync as chmodSync4, existsSync as existsSync10, mkdirSync as mkdirSync7, rmSync as rmSync2 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync9, mkdirSync as mkdirSync6, rmSync as rmSync2 } from "node:fs";
 import { createServer } from "node:net";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function bridgeExtensionPath() {
   const sibling = fileURLToPath2(new URL("./bridge/switchyard-bridge.js", import.meta.url));
-  if (existsSync10(sibling))
+  if (existsSync9(sibling))
     return sibling;
   return fileURLToPath2(new URL("../dist/bridge/switchyard-bridge.js", import.meta.url));
 }
@@ -14516,7 +14598,7 @@ function shortSocketPath(runtimeDir, prefix) {
   if (join14(dir, name).length > MAX_SOCKET_PATH) {
     dir = join14("/tmp", `switchyard-${process.getuid?.() ?? "u"}`);
   }
-  mkdirSync7(dir, { recursive: true, mode: 448 });
+  mkdirSync6(dir, { recursive: true, mode: 448 });
   return join14(dir, name);
 }
 var PiRpcProcess = class _PiRpcProcess extends EventEmitter3 {
@@ -14755,12 +14837,12 @@ var PiRpcProcess = class _PiRpcProcess extends EventEmitter3 {
 // packages/pi-runtime/dist/session-runtime.js
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { EventEmitter as EventEmitter5 } from "node:events";
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 
 // packages/pi-runtime/dist/terminal-process.js
 import { spawn as spawn3 } from "node:child_process";
 import { EventEmitter as EventEmitter4 } from "node:events";
-import { closeSync, existsSync as existsSync11, mkdirSync as mkdirSync8, openSync, readFileSync as readFileSync7 } from "node:fs";
+import { closeSync, existsSync as existsSync10, mkdirSync as mkdirSync7, openSync, readFileSync as readFileSync7 } from "node:fs";
 import { createRequire } from "node:module";
 import { createConnection } from "node:net";
 import { tmpdir as tmpdir3 } from "node:os";
@@ -14768,7 +14850,7 @@ import { basename as basename2, dirname as dirname8, join as join15 } from "node
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveDist(rel) {
   const sibling = fileURLToPath3(new URL(`./${rel}`, import.meta.url));
-  if (existsSync11(sibling))
+  if (existsSync10(sibling))
     return sibling;
   return fileURLToPath3(new URL(`../dist/${rel}`, import.meta.url));
 }
@@ -14785,7 +14867,7 @@ function terminalSupport() {
     return { ok: false, reason: `node-pty is not available: ${err.message}` };
   }
   const holder = holderScriptPath();
-  if (!existsSync11(holder))
+  if (!existsSync10(holder))
     return { ok: false, reason: `Terminal holder not built: ${holder}` };
   return { ok: true };
 }
@@ -14872,7 +14954,7 @@ var PiTerminalProcess = class _PiTerminalProcess extends EventEmitter4 {
       rows: opts.rows ?? 40
     };
     const logPath = opts.logPath ?? join15(dirname8(socketPath), `${basename2(socketPath, ".sock")}.log`);
-    mkdirSync8(dirname8(logPath), { recursive: true, mode: 448 });
+    mkdirSync7(dirname8(logPath), { recursive: true, mode: 448 });
     const fd = openSync(logPath, "a", 384);
     try {
       const child = spawn3(process.execPath, [holderScriptPath()], {
@@ -15024,6 +15106,7 @@ var PiTerminalProcess = class _PiTerminalProcess extends EventEmitter4 {
           type: rec.event === "ui_prompt_end" ? "ui_prompt_end" : "ui_prompt_start",
           kind: typeof rec.kind === "string" ? rec.kind : "unknown",
           title: typeof rec.title === "string" ? rec.title : null,
+          remoteBacked: rec.remoteBacked === true,
           seq: ++this.seq,
           at: (/* @__PURE__ */ new Date()).toISOString(),
           pid: this.pid ?? 0
@@ -15099,6 +15182,11 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
   items = /* @__PURE__ */ new Map();
   partialToolOutput = /* @__PURE__ */ new Map();
   runAssistantText = null;
+  _model = null;
+  scoped = null;
+  _thinking = null;
+  _compacting = false;
+  lastModelJson = "";
   constructor(opts) {
     super();
     this.opts = opts;
@@ -15149,6 +15237,12 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
   get remoteDialogs() {
     return this.proc instanceof PiTerminalProcess ? this.proc.remoteDialogs : true;
   }
+  get modelState() {
+    return { model: this._model ? { ...this._model } : null, thinking: this._thinking };
+  }
+  get compacting() {
+    return this._compacting;
+  }
   get isAlive() {
     return this.proc !== null && this.proc.exited === null;
   }
@@ -15175,6 +15269,9 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
       args.push("--approve");
     else if (profile.projectTrust === "ignore")
       args.push("--no-approve");
+    if (profile.resources === "vanilla") {
+      args.push("--no-extensions", "--no-skills", "--no-prompt-templates");
+    }
     args.push(...profile.extraArgs);
     args.push(...this.opts.extraArgs ?? []);
     for (const ext of this.opts.extensions ?? [])
@@ -15190,7 +15287,7 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
       await this.attachTerminal(this.opts.terminalSocket);
       return;
     }
-    if (this._native && !existsSync12(this._native.sessionFile)) {
+    if (this._native && !existsSync11(this._native.sessionFile)) {
       const message = `Native session file not found: ${this._native.sessionFile}`;
       this.fail(message);
       throw new SwitchyardError("native_session_missing", message, {
@@ -15245,6 +15342,9 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
     this._native = { sessionId: state.sessionId, sessionFile: state.sessionFile };
     this.started = true;
     this.busy = state.isStreaming;
+    this.applyModel(state.model);
+    this.applyThinking(state.thinkingLevel);
+    this.emitModelIfChanged();
     this.emit("native", { ...this._native });
     this.setRuntime();
   }
@@ -15272,6 +15372,9 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
     }
     this.started = true;
     this.busy = state.isStreaming;
+    this.applyModel(state.model);
+    this.applyThinking(state.thinkingLevel);
+    this.emitModelIfChanged();
     this.setRuntime();
   }
   /** Terminal transport: let go of the holder; Pi keeps running and no exit is reported. */
@@ -15341,29 +15444,134 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
   async rename(title) {
     await this.call(this.requireAlive(), { type: "set_session_name", name: title });
   }
-  /** Token and cost totals (`get_session_stats`). */
-  async stats() {
-    const raw = await this.call(this.requireAlive(), { type: "get_session_stats" });
-    return {
-      tokens: typeof raw?.tokens?.total === "number" ? raw.tokens.total : null,
-      costUsd: typeof raw?.cost === "number" ? raw.cost : null,
-      raw
-    };
-  }
-  /** `get_state` passthrough. */
-  async state() {
-    return this.call(this.requireAlive(), { type: "get_state" });
-  }
-  /** Map `get_messages` to transcript items (orders from `startOrder`, default 0; live counter untouched). */
-  async history(startOrder = 0) {
+  /** Models Pi can use right now. */
+  async models() {
     const data = await this.call(this.requireAlive(), {
-      type: "get_messages"
-    });
-    return messagesToItems(data?.messages ?? [], {
-      sessionId: this.sessionId,
-      startOrder,
-      newItemId: this.newItemId,
-      fallbackAt: this.now()
+      type: "get_available_models"
+    });
+    const out = [];
+    for (const raw of data?.models ?? []) {
+      const m = this.toSessionModel(raw);
+      if (!m)
+        continue;
+      if (this.scoped && this.scoped.size > 0)
+        m.scoped = this.scoped.has(`${m.provider}/${m.id}`);
+      out.push(m);
+    }
+    return out.sort((a, b) => a.provider.localeCompare(b.provider) || (a.name ?? a.id).localeCompare(b.name ?? b.id));
+  }
+  /** Slash commands Pi knows (extension commands, prompt templates, skills). */
+  async commands() {
+    const data = await this.call(this.requireAlive(), {
+      type: "get_commands"
+    });
+    const out = [];
+    for (const c of data?.commands ?? []) {
+      if (typeof c?.name !== "string" || !c.name)
+        continue;
+      if (c.source !== "extension" && c.source !== "prompt" && c.source !== "skill")
+        continue;
+      out.push({
+        name: c.name,
+        description: typeof c.description === "string" ? c.description : null,
+        source: c.source
+      });
+    }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+  }
+  async setModel(provider, modelId) {
+    await this.call(this.requireAlive(), { type: "set_model", provider, modelId });
+    await this.refreshModelState();
+    return this.modelState;
+  }
+  async setThinking(level) {
+    await this.call(this.requireAlive(), { type: "set_thinking_level", level });
+    await this.refreshModelState();
+    return this.modelState;
+  }
+  /** Start a manual compaction. Terminal sessions answer at once; Pi's RPC answers when done. */
+  async compact(instructions) {
+    const proc = this.requireAlive();
+    const cmd = { type: "compact", ...instructions ? { customInstructions: instructions } : {} };
+    if (this.transport === "terminal") {
+      await this.call(proc, cmd, 1e4);
+    } else {
+      this.call(proc, cmd, 30 * 6e4).catch(() => {
+      });
+    }
+  }
+  async refreshModelState() {
+    const s = await this.state();
+    this.applyModel(s.model);
+    this.applyThinking(s.thinkingLevel);
+    this.emitModelIfChanged();
+  }
+  toSessionModel(raw) {
+    const info = modelInfo(raw);
+    if (!info)
+      return null;
+    return {
+      ...info,
+      thinkingLevels: info.thinkingLevels.flatMap((l) => {
+        const r = ThinkingLevel.safeParse(l);
+        return r.success ? [r.data] : [];
+      })
+    };
+  }
+  applyScoped(raw) {
+    if (Array.isArray(raw))
+      this.scoped = new Set(raw.filter((x) => typeof x === "string"));
+  }
+  applyModel(raw) {
+    this._model = this.toSessionModel(raw);
+  }
+  applyThinking(raw) {
+    const r = ThinkingLevel.safeParse(raw);
+    this._thinking = r.success ? r.data : null;
+  }
+  emitModelIfChanged() {
+    const json = JSON.stringify(this.modelState);
+    if (json === this.lastModelJson)
+      return;
+    this.lastModelJson = json;
+    this.emit("model", this.modelState);
+  }
+  setCompacting(v) {
+    if (this._compacting === v)
+      return;
+    this._compacting = v;
+    this.emit("compacting", v);
+  }
+  /** Token and cost totals (`get_session_stats`). */
+  async stats() {
+    const raw = await this.call(this.requireAlive(), { type: "get_session_stats" });
+    const cu = raw?.contextUsage;
+    const context = cu && typeof cu.contextWindow === "number" ? {
+      tokens: typeof cu.tokens === "number" ? cu.tokens : null,
+      window: cu.contextWindow,
+      percent: typeof cu.percent === "number" ? cu.percent : null
+    } : null;
+    return {
+      context,
+      tokens: typeof raw?.tokens?.total === "number" ? raw.tokens.total : null,
+      costUsd: typeof raw?.cost === "number" ? raw.cost : null,
+      raw
+    };
+  }
+  /** `get_state` passthrough. */
+  async state() {
+    return this.call(this.requireAlive(), { type: "get_state" });
+  }
+  /** Map `get_messages` to transcript items (orders from `startOrder`, default 0; live counter untouched). */
+  async history(startOrder = 0) {
+    const data = await this.call(this.requireAlive(), {
+      type: "get_messages"
+    });
+    return messagesToItems(data?.messages ?? [], {
+      sessionId: this.sessionId,
+      startOrder,
+      newItemId: this.newItemId,
+      fallbackAt: this.now()
     });
   }
   /** Current state for a client (re)attaching mid-stream. */
@@ -15478,6 +15686,12 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
       this.emit("bridge", msg);
       if (msg.type === "ui_prompt_end")
         this.onPromptEnd(msg);
+      if (msg.type === "model_state") {
+        this.applyScoped(msg.scoped);
+        this.applyModel(msg.model);
+        this.applyThinking(msg.thinkingLevel);
+        this.emitModelIfChanged();
+      }
     });
     proc.on("stderr", (text) => this.emit("stderr", text));
     proc.on("protocol_error", (err, line) => {
@@ -15520,6 +15734,7 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
       this.emit("ui_resolved", { id, by: "exit", request: req });
     this.pending.clear();
     this.current = null;
+    this.setCompacting(false);
     const wasBusy = this.busy;
     this.busy = false;
     if (this.terminal === "failed") {
@@ -15686,15 +15901,29 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
           this.notice("error", `Retry failed: ${ev.finalError ?? "unknown error"}`);
         break;
       case "compaction_start":
+        this.setCompacting(true);
         this.notice("info", `Compacting context (${ev.reason ?? "manual"})`);
         break;
       case "compaction_end":
+        this.setCompacting(false);
         if (ev.result)
           this.notice("info", "Context compacted");
         else if (ev.aborted)
           this.notice("warning", "Compaction aborted");
-        else
-          this.notice("error", `Compaction failed: ${ev.errorMessage ?? "unknown error"}`);
+        else {
+          const msg = String(ev.errorMessage ?? "unknown error").replace(/^Compaction failed:\s*/, "");
+          this.notice("error", `Compaction failed: ${msg}`);
+        }
+        break;
+      case "model_state":
+        this.applyScoped(ev.scoped);
+        this.applyModel(ev.model);
+        this.applyThinking(ev.thinkingLevel);
+        this.emitModelIfChanged();
+        break;
+      case "thinking_level_changed":
+        this.applyThinking(ev.level);
+        this.emitModelIfChanged();
         break;
       case "extension_error":
         this.emit("diagnostic", {
@@ -15848,7 +16077,7 @@ ${output}`.trimEnd() }));
 };
 
 // packages/host-agent/dist/supervisor.js
-import { existsSync as existsSync13, realpathSync as realpathSync2, statSync } from "node:fs";
+import { existsSync as existsSync12, realpathSync as realpathSync2, statSync } from "node:fs";
 import { join as join16, sep as sep3 } from "node:path";
 var RESTART_NOTICE = "Host agent restarted; resume to continue";
 var QUEUED_ANSWER_SUMMARY = "Answered from your earlier form";
@@ -15987,6 +16216,7 @@ var SessionSupervisor = class {
   markLost(rec, expireSummary) {
     rec.runtime = "interrupted";
     rec.runtimeDetail = "Host agent restarted";
+    rec.compacting = false;
     rec.queue = { steering: [], followUp: [] };
     rec.terminal = null;
     this.expirePending(rec.id, expireSummary);
@@ -16116,6 +16346,9 @@ var SessionSupervisor = class {
       archivedAt: null,
       queue: rec.queue,
       stats: rec.stats,
+      model: rec.model ?? null,
+      thinking: rec.thinking ?? null,
+      compacting: rec.compacting ?? false,
       lastAssistantText: rec.lastAssistantText,
       createdAt: rec.createdAt,
       terminal: rec.terminal != null
@@ -16186,7 +16419,7 @@ var SessionSupervisor = class {
     if (!pi.compatible) {
       throw new SwitchyardError("pi_incompatible", pi.reason ?? "Pi is not available on this host");
     }
-    if (!existsSync13(p.workspacePath) || !statSync(p.workspacePath).isDirectory()) {
+    if (!existsSync12(p.workspacePath) || !statSync(p.workspacePath).isDirectory()) {
       throw new SwitchyardError("not_found", `Workspace ${p.workspacePath} does not exist`);
     }
     const prev = this.records.get(p.sessionId);
@@ -16201,7 +16434,7 @@ var SessionSupervisor = class {
       }
     }
     let nextOrder = prev?.nextOrder ?? 0;
-    if (!prev && nativeHandle && existsSync13(nativeHandle.sessionFile)) {
+    if (!prev && nativeHandle && existsSync12(nativeHandle.sessionFile)) {
       try {
         const native = await readNativeTranscript(nativeHandle.sessionFile, {
           piBin: this.opts.piBin
@@ -16211,6 +16444,8 @@ var SessionSupervisor = class {
         nextOrder = 0;
       }
     }
+    const t0 = Date.now();
+    let adaptersMs = 0;
     const now = nowIso();
     let control = { controlRevision: p.controlRevision, controlMode: p.controlMode };
     for (const c of [prev, this.pendingControl.get(p.sessionId)]) {
@@ -16232,7 +16467,7 @@ var SessionSupervisor = class {
       profile: p.profile,
       nativeHandle,
       runtime: "starting",
-      runtimeDetail: null,
+      runtimeDetail: "Starting Pi\u2026",
       controlRevision: control.controlRevision,
       controlMode: control.controlMode,
       origin: p.origin,
@@ -16241,6 +16476,9 @@ var SessionSupervisor = class {
       nextOrder,
       queue: { steering: [], followUp: [] },
       stats: prev?.stats ?? null,
+      model: prev?.model ?? null,
+      thinking: prev?.thinking ?? null,
+      compacting: false,
       lastAssistantText: prev?.lastAssistantText ?? null,
       lastActivityAt: now,
       createdAt: prev?.createdAt ?? now
@@ -16249,7 +16487,11 @@ var SessionSupervisor = class {
     const l = this.newLive(rec);
     this.live.set(rec.id, l);
     this.db.tx(() => this.saveAndEmit(rec));
-    await this.openAdapters(l, p.workspacePath);
+    const adaptersStart = Date.now();
+    this.enqueue(l, async () => {
+      await this.openAdapters(l, p.workspacePath);
+      adaptersMs = Date.now() - adaptersStart;
+    });
     const ms = new ManagedSession({
       sessionId: rec.id,
       cwd: p.workspacePath,
@@ -16265,8 +16507,16 @@ var SessionSupervisor = class {
     });
     l.ms = ms;
     this.wire(l, ms);
+    const piStart = Date.now();
     try {
       await ms.start();
+      this.opts.log.info({
+        sessionId: rec.id,
+        piStartMs: Date.now() - piStart,
+        adaptersMs,
+        totalMs: Date.now() - t0,
+        transport: ms.transport
+      }, "session started");
       const socketPath = ms.terminalSocket;
       rec.terminal = socketPath ? { socketPath } : null;
       this.db.tx(() => this.saveAndEmit(rec));
@@ -16331,6 +16581,28 @@ var SessionSupervisor = class {
     this.db.tx(() => this.saveAndEmit(rec));
     return { title };
   }
+  async models(sessionId) {
+    return { models: await this.requireLive(sessionId).models() };
+  }
+  async commands(sessionId) {
+    return { commands: await this.requireLive(sessionId).commands() };
+  }
+  async setModel(sessionId, provider, modelId) {
+    return this.requireLive(sessionId).setModel(provider, modelId);
+  }
+  async setThinking(sessionId, level) {
+    return this.requireLive(sessionId).setThinking(level);
+  }
+  async compact(sessionId, instructions) {
+    const ms = this.requireLive(sessionId);
+    if (ms.compacting)
+      throw new SwitchyardError("conflict", "Compaction is already running");
+    if (ms.runtime !== "idle") {
+      throw new SwitchyardError("conflict", "Wait for the run to finish before compacting");
+    }
+    await ms.compact(instructions);
+    return { ok: true };
+  }
   async adapterAction(sessionId, adapterId, actionId, payload) {
     const l = this.live.get(sessionId);
     if (!l?.adapters) {
@@ -16394,7 +16666,7 @@ var SessionSupervisor = class {
     };
   }
   async readNative(sessionFile) {
-    if (!existsSync13(sessionFile)) {
+    if (!existsSync12(sessionFile)) {
       throw new SwitchyardError("native_session_missing", `Native session file not found: ${sessionFile}`);
     }
     return readNativeTranscript(sessionFile, { piBin: this.opts.piBin });
@@ -16585,6 +16857,18 @@ var SessionSupervisor = class {
         this.db.tx(() => this.saveAndEmit(rec));
       }
     });
+    ms.on("model", (m) => {
+      rec.model = m.model;
+      rec.thinking = m.thinking;
+      this.db.tx(() => this.saveAndEmit(rec));
+      void this.refreshStats(l);
+    });
+    ms.on("compacting", (c) => {
+      rec.compacting = c;
+      this.db.tx(() => this.saveAndEmit(rec));
+      if (!c)
+        void this.refreshStats(l);
+    });
     ms.on("diagnostic", (d) => this.diagnostic(rec.id, null, d.level, d.message));
     ms.on("stderr", (text) => this.opts.log.debug({ sessionId: rec.id, stderr: text.slice(0, 2e3) }, "pi stderr"));
     ms.on("ui_request", (req) => this.enqueue(l, () => this.onUiRequest(l, req)));
@@ -16619,7 +16903,7 @@ var SessionSupervisor = class {
       return;
     try {
       const s = await ms.stats();
-      const stats = { tokens: s.tokens, costUsd: s.costUsd };
+      const stats = { tokens: s.tokens, costUsd: s.costUsd, context: s.context };
       if (JSON.stringify(stats) === JSON.stringify(l.rec.stats))
         return;
       l.rec.stats = stats;
@@ -16640,6 +16924,21 @@ var SessionSupervisor = class {
         await this.applyToolCard(l, e);
         return;
       }
+      case "tool_execution_update": {
+        if (ev.parentToolCallId || !adapters)
+          return;
+        const id = String(ev.toolCallId);
+        const pr = ev.partialResult;
+        const details = pr && typeof pr === "object" && "details" in pr ? pr.details : void 0;
+        await adapters.onToolUpdate({
+          toolCallId: id,
+          name: String(ev.toolName),
+          args: ms?.toolItem(id)?.data.args ?? {},
+          partialResult: pr,
+          details
+        });
+        return;
+      }
       case "tool_execution_end": {
         if (ev.parentToolCallId || !adapters)
           return;
@@ -16664,6 +16963,8 @@ var SessionSupervisor = class {
         return;
       case "message_end": {
         const m = ev.message;
+        if (m?.role === "assistant")
+          void this.refreshStats(l);
         if (adapters && m?.role === "custom" && typeof m.customType === "string") {
           await adapters.onCustomMessage({
             customType: m.customType,
@@ -16840,6 +17141,8 @@ var SessionSupervisor = class {
    */
   onTerminalPrompt(l, b) {
     if (b.type === "ui_prompt_start") {
+      if (b.kind === "custom" && b.remoteBacked)
+        return;
       if (b.kind !== "custom" && l.ms?.remoteDialogs)
         return;
       if (l.terminalPrompt)
@@ -17166,9 +17469,10 @@ var WorkspaceService = class {
   }
   async create(checkoutPath, branch, base, setupCommand, worktreeDir) {
     const wt = await createWorktree(checkoutPath, branch, base, worktreeDir);
-    const git = await worktreeStatus(wt.path, wt.baseBranch).catch(() => null);
     const initial = setupCommand ? { state: "running", log: "" } : { state: "none", log: "" };
-    this.emitUpdate(wt.path, { branch: wt.branch, baseBranch: wt.baseBranch, git, setup: initial });
+    this.emitUpdate(wt.path, { branch: wt.branch, baseBranch: wt.baseBranch, setup: initial });
+    void worktreeStatus(wt.path, wt.baseBranch).then((git) => this.emitUpdate(wt.path, { git }), () => {
+    });
     let setupDone = Promise.resolve(initial);
     if (setupCommand) {
       setupDone = runSetup(wt.path, setupCommand, (setup) => this.emitUpdate(wt.path, { setup }), {
@@ -17190,7 +17494,7 @@ var WorkspaceService = class {
       branch: wt.branch,
       baseBranch: wt.baseBranch,
       provenance: "managed",
-      git,
+      git: null,
       setup: initial,
       setupDone
     };
@@ -17335,59 +17639,489 @@ async function runHostAgent(opts = {}) {
   if (interruptedOnStart.length > 0 || failedDispatches > 0) {
     log.warn({ sessions: interruptedOnStart.length, dispatches: failedDispatches }, "recovered after restart");
   }
-  router.pruneReceipts();
-  const reattach = await supervisor.reattachTerminals();
-  interruptedOnStart.push(...reattach.lost);
-  if (reattach.reattached.length > 0 || reattach.lost.length > 0) {
-    log.info({ reattached: reattach.reattached.length, lost: reattach.lost.length }, "terminal sessions after restart");
+  router.pruneReceipts();
+  try {
+    await catalog.init();
+  } catch (err) {
+    log.warn({ err: err.message }, "adapter discovery failed; Pi package adapters are not loaded");
+  }
+  const reattach = await supervisor.reattachTerminals();
+  interruptedOnStart.push(...reattach.lost);
+  if (reattach.reattached.length > 0 || reattach.lost.length > 0) {
+    log.info({ reattached: reattach.reattached.length, lost: reattach.lost.length }, "terminal sessions after restart");
+  }
+  supervisor.emitAdapters();
+  link.start();
+  let stopping = null;
+  const onSignal = (signal) => {
+    log.info({ signal }, "stopping host agent");
+    void handle.stop().finally(() => process.exit(0));
+  };
+  if (opts.handleSignals !== false) {
+    process.once("SIGTERM", onSignal);
+    process.once("SIGINT", onSignal);
+  }
+  const handle = {
+    hostId: config.hostId,
+    config,
+    db,
+    link,
+    supervisor,
+    router,
+    dispatcher,
+    pi,
+    interruptedOnStart,
+    terminalSessions: terminalEnabled,
+    get spawnedPiProcesses() {
+      return supervisor.spawnedProcesses;
+    },
+    stop(stopOpts = {}) {
+      stopping ??= (async () => {
+        process.off("SIGTERM", onSignal);
+        process.off("SIGINT", onSignal);
+        relay.closeAll();
+        await supervisor.stopAll(stopOpts);
+        await new Promise((r) => setTimeout(r, 50));
+        await link.stop();
+        db.close();
+      })();
+      return stopping;
+    }
+  };
+  return handle;
+}
+
+// packages/cli/dist/commands/coordinator.js
+import { existsSync as existsSync13, mkdirSync as mkdirSync8 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
+function parseListen(v) {
+  const s = v.trim();
+  let host = "0.0.0.0";
+  let portStr = s;
+  const v6 = s.match(/^\[([^\]]+)\]:(\d+)$/);
+  if (v6) {
+    host = v6[1];
+    portStr = v6[2];
+  } else if (s.includes(":")) {
+    const i = s.lastIndexOf(":");
+    host = s.slice(0, i) || "0.0.0.0";
+    portStr = s.slice(i + 1);
+  } else if (!/^\d+$/.test(s)) {
+    host = s;
+    portStr = String(DEFAULT_PORT);
+  }
+  const port = Number(portStr);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new CliError(`Invalid listen address "${v}" (expected host:port)`);
+  }
+  return { host, port };
+}
+function parseOrigins(v) {
+  if (!v?.trim())
+    return void 0;
+  return v.split(",").map((o) => o.trim().replace(/\/+$/, "")).filter(Boolean);
+}
+var DEFAULT_OIDC_LABEL = "Sign in with single sign-on";
+var DEFAULT_OIDC_SCOPES = "openid profile email groups";
+function envValue(env, key) {
+  const v = env[key]?.trim();
+  return v ? v : void 0;
+}
+function authOptionsFromEnv(env) {
+  const out = {};
+  const secret = envValue(env, "SWITCHYARD_HOST_ENROLL_SECRET");
+  if (secret)
+    out.hostEnrollSecret = secret;
+  const proxies = parseOrigins(env.SWITCHYARD_TRUSTED_PROXIES);
+  if (proxies)
+    out.trustedProxies = proxies;
+  const issuer = envValue(env, "SWITCHYARD_OIDC_ISSUER");
+  const clientId = envValue(env, "SWITCHYARD_OIDC_CLIENT_ID");
+  if (issuer && clientId) {
+    if (!/^https?:\/\//.test(issuer)) {
+      throw new CliError(`SWITCHYARD_OIDC_ISSUER must be an http(s) URL, got "${issuer}"`);
+    }
+    out.oidc = {
+      issuer,
+      clientId,
+      clientSecret: envValue(env, "SWITCHYARD_OIDC_CLIENT_SECRET") ?? null,
+      label: envValue(env, "SWITCHYARD_OIDC_LABEL") ?? DEFAULT_OIDC_LABEL,
+      scopes: envValue(env, "SWITCHYARD_OIDC_SCOPES") ?? DEFAULT_OIDC_SCOPES,
+      owner: {
+        subject: envValue(env, "SWITCHYARD_OIDC_OWNER_SUBJECT") ?? null,
+        email: envValue(env, "SWITCHYARD_OIDC_OWNER_EMAIL") ?? null,
+        group: envValue(env, "SWITCHYARD_OIDC_OWNER_GROUP") ?? null
+      }
+    };
+  } else if (issuer || clientId) {
+    throw new CliError("Single sign-on needs both SWITCHYARD_OIDC_ISSUER and SWITCHYARD_OIDC_CLIENT_ID");
+  }
+  return out;
+}
+function coordinatorOptions(flags, env) {
+  const dataDir = flags.dataDir ? resolve10(flags.dataDir) : defaultDataDir(env);
+  const listen = parseListen(flags.listen ?? env.SWITCHYARD_LISTEN ?? `0.0.0.0:${DEFAULT_PORT}`);
+  const publicUrl = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim() || void 0;
+  if (publicUrl && !/^https?:\/\//.test(publicUrl)) {
+    throw new CliError(`Public URL must start with http:// or https://, got "${publicUrl}"`);
+  }
+  const trustedOrigins = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
+  return {
+    dataDir,
+    listen,
+    publicUrl,
+    trustedOrigins,
+    webDist: resolveWebDist(flags.webDist, env),
+    ...authOptionsFromEnv(env)
+  };
+}
+function waitForSignal() {
+  return new Promise((res) => {
+    const on = (sig) => {
+      process.off("SIGINT", on);
+      process.off("SIGTERM", on);
+      res(sig);
+    };
+    process.on("SIGINT", on);
+    process.on("SIGTERM", on);
+  });
+}
+async function coordinatorStart(ctx, flags) {
+  const opts = coordinatorOptions(flags, ctx.env);
+  const c = createCoordinator(opts);
+  await c.start();
+  writeEndpoint(opts.dataDir, {
+    localUrl: localUrlFor(opts.listen, c.port),
+    publicUrl: c.config.publicUrl
+  });
+  ctx.err(`Switchyard coordinator listening on ${opts.listen.host}:${c.port} (public URL ${c.config.publicUrl}; data ${opts.dataDir}${opts.webDist ? "" : "; web app not found, API only"})`);
+  const sig = await waitForSignal();
+  ctx.err(`${sig}: stopping coordinator`);
+  await c.stop();
+}
+function localUrlFor(listen, port) {
+  const h = listen.host ?? "0.0.0.0";
+  const host = h === "0.0.0.0" || h === "::" || h === "" ? "127.0.0.1" : h.includes(":") ? `[${h}]` : h;
+  return `http://${host}:${port}`;
+}
+function dataDirOf(flags, env) {
+  return flags.dataDir ? resolve10(flags.dataDir) : defaultDataDir(env);
+}
+function coordinatorBackup(ctx, out, flags) {
+  const r = backup(dataDirOf(flags, ctx.env), out);
+  ctx.out(`Backed up to ${r.file} (schema ${r.migrationLevel})`);
+}
+function coordinatorRestore(ctx, file, flags) {
+  const r = restore(dataDirOf(flags, ctx.env), file);
+  ctx.out(`Restored ${r.restoredFrom} (schema ${r.migrationLevel}).`);
+  if (r.previous)
+    ctx.out(`The previous database was kept as ${r.previous}`);
+  if (r.migrationLevel < LATEST_MIGRATION) {
+    ctx.out("Migrations to the current schema run when the coordinator next starts.");
+  }
+}
+function coordinatorMigrate(ctx, flags) {
+  const dataDir = dataDirOf(flags, ctx.env);
+  const holder = lockHolder(dataDir);
+  if (holder !== null) {
+    throw new CliError(`Coordinator (pid ${holder}) is running on ${dataDir}; it migrated at start`);
+  }
+  const path = dbPath(dataDir);
+  const existed = existsSync13(path);
+  mkdirSync8(dataDir, { recursive: true });
+  const db = openDb(path);
+  try {
+    const before = existed ? migrationLevel(db) : 0;
+    migrate(db);
+    const after = migrationLevel(db);
+    ctx.out(before === after ? `Schema is current (level ${after}) at ${path}` : `Migrated ${path} from level ${before} to ${after}`);
+  } finally {
+    db.close();
+  }
+}
+
+// packages/cli/dist/commands/up.js
+var DEV_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
+function upOptions(flags, env) {
+  const port = flags.port === void 0 ? DEFAULT_PORT : Number(flags.port);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new CliError(`Invalid port "${flags.port}"`);
+  }
+  const listenHost = flags.host ?? "0.0.0.0";
+  const dataDir = flags.dataDir ?? defaultDataDir(env);
+  const explicitPublic = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim();
+  const publicUrl = explicitPublic || port !== 0 ? (explicitPublic || `http://localhost:${port}`).replace(/\/+$/, "") : void 0;
+  let trusted = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
+  if (!trusted && publicUrl) {
+    trusted = [new URL(publicUrl).origin];
+    if (!explicitPublic)
+      trusted.push(`http://127.0.0.1:${port}`);
+  }
+  if (flags.dev && trusted)
+    trusted = [.../* @__PURE__ */ new Set([...trusted, ...DEV_ORIGINS])];
+  return {
+    dataDir,
+    listen: { host: listenHost, port },
+    publicUrl,
+    trustedOrigins: trusted,
+    webDist: resolveWebDist(flags.webDist, env),
+    // Same server env as `coordinator start`: shared host secret, trusted proxies and OIDC.
+    ...authOptionsFromEnv(env)
+  };
+}
+async function ensureLocalHost(coordinator, localUrl, configPath, name, fetchImpl) {
+  if (existsSync14(configPath)) {
+    const cfg2 = loadConfig(configPath);
+    const known = coordinator.store.hosts.get(cfg2.hostId);
+    if (known && !known.revokedAt) {
+      return { config: { ...cfg2, coordinatorUrl: localUrl }, enrolled: false };
+    }
+  }
+  const api = new ApiClient({
+    coordinatorUrl: localUrl,
+    credential: coordinator.adminToken,
+    fetch: fetchImpl
+  });
+  const e = await api.post("/api/hosts/enrollments", {});
+  const cfg = await enroll({
+    coordinatorUrl: localUrl,
+    token: e.token,
+    name,
+    configPath,
+    fetch: fetchImpl
+  });
+  const { configPath: _p, ...config } = cfg;
+  return { config, enrolled: true };
+}
+function openBrowser(url, platform = process.platform, spawnFn = spawn4) {
+  const cmd = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
+  if (!cmd)
+    return;
+  try {
+    const child = spawnFn(cmd, [url], { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function firstSignInLink(ctx, coordinator, open2, opener) {
+  if (coordinator.config.oidc || coordinator.auth.activeDeviceCount() > 0)
+    return null;
+  const e = coordinator.auth.createEnrollment("device", ADMIN_DEVICE_ID);
+  await printSignInLink(ctx, e.url, e.expiresAt);
+  if (open2)
+    opener(e.url);
+  return e.url;
+}
+async function startStandalone(ctx, flags, deps = {}) {
+  if (flags.dev && !ctx.env.SWITCHYARD_LOG_LEVEL)
+    process.env.SWITCHYARD_LOG_LEVEL = "debug";
+  const opts = upOptions(flags, ctx.env);
+  const coordinator = createCoordinator({ ...opts, setupHint: false });
+  await coordinator.start();
+  let firstLink;
+  try {
+    firstLink = await firstSignInLink(ctx, coordinator, flags.open ?? process.stdout.isTTY === true, deps.open ?? ((url) => openBrowser(url)));
+  } catch (err) {
+    await coordinator.stop();
+    throw err;
+  }
+  const localUrl = localUrlFor(opts.listen, coordinator.port);
+  writeEndpoint(opts.dataDir, { localUrl, publicUrl: coordinator.config.publicUrl });
+  let host;
+  try {
+    const paths = standaloneHostPaths(opts.dataDir);
+    const { config, enrolled } = await ensureLocalHost(coordinator, localUrl, paths.configPath, flags.name ?? hostname2().replace(/\.local$/, ""));
+    if (enrolled)
+      ctx.err(`Enrolled the local host "${config.name}" (${config.hostId})`);
+    host = await runHostAgent({ config, stateDir: paths.stateDir, handleSignals: false });
+  } catch (err) {
+    await coordinator.stop();
+    throw err;
+  }
+  return {
+    coordinator,
+    host,
+    localUrl,
+    firstLink,
+    async stop() {
+      await host.stop();
+      await coordinator.stop();
+    }
+  };
+}
+async function up(ctx, flags) {
+  const s = await startStandalone(ctx, flags);
+  const c = s.coordinator;
+  ctx.err([
+    `Switchyard is up: ${c.config.publicUrl} (listening on port ${c.port})`,
+    `Data: ${c.config.dataDir}`,
+    c.config.webDist ? null : "Web app bundle not found: API only (run `pnpm build`)",
+    c.config.oidc ? `Sign in with single sign-on at ${c.config.publicUrl}    Terminal: switchyard login --coordinator ${c.config.publicUrl}` : `Another browser: switchyard pair    Terminal: switchyard login --coordinator ${c.config.publicUrl}`,
+    "Schedules run only while this process is running."
+  ].filter(Boolean).join("\n"));
+  const sig = await waitForSignal();
+  ctx.err(`${sig}: stopping (Pi sessions on this host are stopped and can be resumed later)`);
+  await s.stop();
+}
+
+// packages/cli/dist/commands/auth.js
+function adminApi(ctx, flags) {
+  const dataDir = flags.dataDir ?? ctx.paths?.dataDir ?? defaultDataDir(ctx.env);
+  const token = readAdminToken(dataDir, ctx.env);
+  if (!token) {
+    throw new CliError(`No admin token: run this on the coordinator machine (looked in ${dataDir}/admin.token) or set SWITCHYARD_ADMIN_TOKEN`);
+  }
+  const url = trimUrl(flags.coordinator ?? readEndpoint(dataDir)?.localUrl ?? DEFAULT_LOCAL_URL);
+  return new ApiClient({ coordinatorUrl: url, credential: token, fetch: ctx.fetch });
+}
+function clockTime(iso) {
+  const d = new Date(iso);
+  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+async function printDeviceLink(ctx, url) {
+  const qr = await QRCode2.toString(url, { type: "terminal", small: true });
+  ctx.out("");
+  ctx.out(`  ${url}`);
+  ctx.out("");
+  ctx.out(qr.trimEnd());
+  ctx.out("");
+}
+async function printSignInLink(ctx, url, expiresAt) {
+  ctx.out(`Open this single-use sign-in link in your browser (expires ${clockTime(expiresAt)}):`);
+  await printDeviceLink(ctx, url);
+  ctx.out("Then add a passkey in Settings \u203A Sign-in as a backup, or run `switchyard pair` for another browser.");
+}
+async function pair(ctx, flags) {
+  const api = adminApi(ctx, flags);
+  const kind = flags.host ? "host" : "device";
+  const e = await api.post("/api/enrollments", { kind });
+  if (flags.json) {
+    ctx.out(JSON.stringify(e, null, 2));
+    return e;
+  }
+  const qr = await QRCode2.toString(e.url, { type: "terminal", small: true });
+  if (kind === "host") {
+    ctx.out(`Host enrollment (single use, expires ${e.expiresAt}). On the host, run:`);
+    ctx.out("");
+    ctx.out(`  ${e.command ?? `switchyard host enroll --coordinator <url> --token ${e.token}`}`);
+    ctx.out("");
+    ctx.out(`Token: ${e.token}`);
+  } else {
+    ctx.out(`Open this link in a browser to sign it in (single use, expires ${e.expiresAt}):`);
+    ctx.out("");
+    ctx.out(`  ${e.url}`);
+    ctx.out("");
+    ctx.out(qr.trimEnd());
+    ctx.out("");
+    ctx.out(`Terminal: switchyard login --coordinator ${originOf2(e.url)} --token ${e.token}`);
   }
+  ctx.out("The link does not provide network access: the device must already reach this URL.");
+  return e;
+}
+function originOf2(url) {
   try {
-    await catalog.init();
-  } catch (err) {
-    log.warn({ err: err.message }, "adapter discovery failed; Pi package adapters are not loaded");
+    return new URL(url).origin;
+  } catch {
+    return url;
   }
-  supervisor.emitAdapters();
-  link.start();
-  let stopping = null;
-  const onSignal = (signal) => {
-    log.info({ signal }, "stopping host agent");
-    void handle.stop().finally(() => process.exit(0));
-  };
-  if (opts.handleSignals !== false) {
-    process.once("SIGTERM", onSignal);
-    process.once("SIGINT", onSignal);
+}
+function parseEnrollmentInput(token, coordinator) {
+  const t = token.trim();
+  if (/^https?:\/\//.test(t)) {
+    const u = new URL(t);
+    const params = new URLSearchParams(u.hash.replace(/^#/, ""));
+    const fromUrl = params.get("token") ?? u.searchParams.get("token");
+    if (!fromUrl)
+      throw new CliError("That URL has no enrollment token");
+    return { url: trimUrl(coordinator ?? u.origin), token: fromUrl };
   }
-  const handle = {
-    hostId: config.hostId,
-    config,
-    db,
-    link,
-    supervisor,
-    router,
-    dispatcher,
-    pi,
-    interruptedOnStart,
-    terminalSessions: terminalEnabled,
-    get spawnedPiProcesses() {
-      return supervisor.spawnedProcesses;
-    },
-    stop(stopOpts = {}) {
-      stopping ??= (async () => {
-        process.off("SIGTERM", onSignal);
-        process.off("SIGINT", onSignal);
-        relay.closeAll();
-        await supervisor.stopAll(stopOpts);
-        await new Promise((r) => setTimeout(r, 50));
-        await link.stop();
-        db.close();
-      })();
-      return stopping;
+  if (!coordinator)
+    throw new CliError("--coordinator <url> is required");
+  return { url: trimUrl(coordinator), token: t };
+}
+async function loginWithToken(ctx, flags) {
+  const { url, token } = parseEnrollmentInput(flags.token, flags.coordinator);
+  const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
+  const name = flags.name ?? `${hostname3().replace(/\.local$/, "")} terminal`;
+  const res = await api.post("/api/enroll", {
+    token,
+    name,
+    kind: "terminal"
+  });
+  if (!res.credential)
+    throw new CliError("The coordinator returned no credential");
+  const path = ctx.paths?.clientConfig ?? clientConfigPath(ctx.env);
+  writeClientConfig(path, {
+    coordinatorUrl: url,
+    credential: res.credential,
+    deviceId: res.deviceId
+  });
+  ctx.out(`Enrolled "${name}" (${res.deviceId}) with ${url}.`);
+  ctx.out(`Credential saved to ${path} (mode 0600). Open a session's Pi terminal with \`switchyard tui <session>\`.`);
+  return { path, deviceId: res.deviceId };
+}
+var EXPIRED2 = "The sign-in expired before it was approved. Run `switchyard login` again.";
+async function login(ctx, flags, deps = {}) {
+  if (flags.token)
+    return loginWithToken(ctx, { ...flags, token: flags.token });
+  const path = ctx.paths?.clientConfig ?? clientConfigPath(ctx.env);
+  const raw = flags.coordinator ?? ctx.env.SWITCHYARD_URL ?? readClientConfig(path)?.coordinatorUrl;
+  if (!raw)
+    throw new CliError("--coordinator <url> is required");
+  const url = trimUrl(raw);
+  const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
+  const name = flags.name ?? `${hostname3().replace(/\.local$/, "")} terminal`;
+  const started = await api.post("/api/auth/terminal/start", { name });
+  ctx.out("To sign in this terminal, open this link in a browser where you use Switchyard:");
+  ctx.out("");
+  ctx.out(`  ${started.verifyUrl}`);
+  ctx.out("");
+  ctx.out(`Check that it shows the code ${started.userCode}. Waiting for approval (expires ${clockTime(started.expiresAt)})\u2026`);
+  const interactive = process.stdout.isTTY === true && !ctx.env.SSH_CONNECTION && !ctx.env.SSH_TTY;
+  if (flags.open ?? interactive)
+    (deps.open ?? ((u) => openBrowser(u)))(started.verifyUrl);
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  const deadline = Date.parse(started.expiresAt);
+  for (; ; ) {
+    await sleep3(started.intervalMs);
+    let r;
+    try {
+      r = await api.post("/api/auth/terminal/claim", {
+        userCode: started.userCode,
+        pollToken: started.pollToken
+      });
+    } catch (err) {
+      if (err instanceof ApiRequestError) {
+        if (err.status === 401)
+          throw new CliError(EXPIRED2);
+        if (err.status === 0 && now() < deadline)
+          continue;
+      }
+      throw err;
     }
-  };
-  return handle;
+    if (r.status === "denied")
+      throw new CliError("The sign-in was denied in the browser.");
+    if (r.status === "done") {
+      writeClientConfig(path, {
+        coordinatorUrl: url,
+        credential: r.credential,
+        deviceId: r.deviceId
+      });
+      ctx.out(`Signed in "${name}" (${r.deviceId}) to ${url}.`);
+      ctx.out(`Credential saved to ${path} (mode 0600). Open a session's Pi terminal with \`switchyard tui <session>\`.`);
+      return { path, deviceId: r.deviceId };
+    }
+    if (now() >= deadline)
+      throw new CliError(EXPIRED2);
+  }
 }
 
 // packages/cli/dist/commands/doctor.js
+import { execFile as execFile3 } from "node:child_process";
+import { existsSync as existsSync15, readFileSync as readFileSync9 } from "node:fs";
 function defaultDoctorDeps(ctx) {
   const dataDir = ctx.paths?.dataDir ?? defaultDataDir(ctx.env);
   return {
@@ -17395,7 +18129,7 @@ function defaultDoctorDeps(ctx) {
     detectPi: () => detectPi(ctx.env.SWITCHYARD_PI_BIN ?? "pi"),
     gitVersion: () => new Promise((resolve13) => execFile3("git", ["--version"], (err, stdout) => resolve13(err ? null : stdout.trim()))),
     hostConfigPaths: [defaultConfigPath(ctx.env), standaloneHostPaths(dataDir).configPath],
-    readFile: (p) => existsSync14(p) ? readFileSync9(p, "utf8") : null
+    readFile: (p) => existsSync15(p) ? readFileSync9(p, "utf8") : null
   };
 }
 function findHostConfig(deps) {
@@ -17525,13 +18259,13 @@ async function checkSignIn(ctx, url, add) {
   try {
     const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
     const s = await api.get("/api/setup");
-    if (!s.initialized) {
-      add("FAIL", "Sign-in", "not set up: run `switchyard init` on the server");
-      return;
-    }
     const passkey = !s.passkey.available ? `unavailable, ${s.passkey.reason ?? "unsupported"}` : s.passkey.registered ? "registered" : "none registered yet";
     const sso = s.oidc ? `on (${s.oidc.label})` : "off";
-    add("PASS", "Sign-in", `set up (passkey: ${passkey}, single sign-on: ${sso})`);
+    if (!s.oidc && !s.passkey.registered) {
+      add("WARN", "Sign-in", "no single sign-on and no passkey: sign in with a link from `switchyard pair` on the server");
+      return;
+    }
+    add("PASS", "Sign-in", `passkey: ${passkey}, single sign-on: ${sso}`);
   } catch (err) {
     add("WARN", "Sign-in", `could not read the setup state: ${err.message}`);
   }
@@ -17547,8 +18281,8 @@ function printDoctor(ctx, results) {
 }
 
 // packages/cli/dist/commands/herdr.js
-import { spawn as spawn4 } from "node:child_process";
-import { closeSync as closeSync2, existsSync as existsSync18, openSync as openSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { spawn as spawn5 } from "node:child_process";
+import { closeSync as closeSync2, existsSync as existsSync19, openSync as openSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join21 } from "node:path";
 
 // packages/cli/dist/context.js
@@ -17559,7 +18293,7 @@ function defaultCtx() {
     err: (l) => process.stderr.write(`${l}
 `),
     env: process.env,
-    fetch: (input, init2) => fetch(input, init2)
+    fetch: (input, init) => fetch(input, init)
   };
 }
 function connect(ctx, flags) {
@@ -17600,7 +18334,7 @@ function ago(iso, now = Date.now()) {
 }
 
 // packages/cli/dist/herdr/client.js
-import { existsSync as existsSync15, readdirSync } from "node:fs";
+import { existsSync as existsSync16, readdirSync } from "node:fs";
 import { createConnection as createConnection3 } from "node:net";
 import { homedir as homedir6 } from "node:os";
 import { join as join17 } from "node:path";
@@ -17625,11 +18359,11 @@ function herdrSocketPath(env = process.env, home = homedir6()) {
   if (env.HERDR_SESSION)
     return join17(base, "sessions", env.HERDR_SESSION, "herdr.sock");
   const dflt = join17(base, "herdr.sock");
-  if (existsSync15(dflt))
+  if (existsSync16(dflt))
     return dflt;
   let live = [];
   try {
-    live = readdirSync(join17(base, "sessions")).map((s) => join17(base, "sessions", s, "herdr.sock")).filter((p) => existsSync15(p));
+    live = readdirSync(join17(base, "sessions")).map((s) => join17(base, "sessions", s, "herdr.sock")).filter((p) => existsSync16(p));
   } catch {
     live = [];
   }
@@ -17742,7 +18476,7 @@ function nextSeq() {
 }
 
 // packages/cli/dist/herdr/daemon.js
-import { existsSync as existsSync17, mkdirSync as mkdirSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join19 } from "node:path";
 
 // packages/cli/dist/herdr/mirror.js
@@ -18029,7 +18763,7 @@ function planMirror(st, h, mem, now) {
 }
 
 // packages/cli/dist/herdr/util.js
-import { chmodSync as chmodSync5, existsSync as existsSync16, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { chmodSync as chmodSync5, existsSync as existsSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { join as join18 } from "node:path";
 function herdrStateDir(env = process.env, home = homedir7()) {
@@ -18059,7 +18793,7 @@ exec sh '${pluginRoot}/switchyard-herdr.sh' "$@"
   return path;
 }
 function launcherExists(env = process.env) {
-  return existsSync16(stableLauncherPath(env));
+  return existsSync17(stableLauncherPath(env));
 }
 async function isAtShell(call, paneId) {
   const info = (await call("pane.process_info", { pane_id: paneId }))?.process_info ?? {};
@@ -18258,7 +18992,7 @@ var MirrorDaemon = class {
     const titleOf = (sid) => st.sessions.find((s) => s.id === sid)?.title ?? sid;
     const launcher = this.deps.launcherPath;
     const paneCmd = (sid) => launcherCommand(launcher, ["pane", sid]);
-    const exists2 = this.deps.exists ?? existsSync17;
+    const exists2 = this.deps.exists ?? existsSync18;
     const createdNow = {};
     const fallbackCwd = () => {
       const dir = join19(this.deps.stateDir, "spaces");
@@ -19364,13 +20098,13 @@ async function herdrDaemon(ctx, flags) {
     }
     return;
   }
-  const running = existsSync18(pidFile) ? Number(readFileSync12(pidFile, "utf8").trim()) : 0;
+  const running = existsSync19(pidFile) ? Number(readFileSync12(pidFile, "utf8").trim()) : 0;
   if (flags.ensure) {
     if (running && pidAlive2(running))
       return;
     const fd = openSync2(logFile, "a", 384);
     try {
-      const child = spawn4(process.execPath, [process.argv[1], "herdr", "daemon"], {
+      const child = spawn5(process.execPath, [process.argv[1], "herdr", "daemon"], {
         detached: true,
         stdio: ["ignore", fd, fd],
         env: { ...process.env, SWITCHYARD_HERDR_LAUNCHER: launcherPath }
@@ -19432,14 +20166,14 @@ async function herdrStatus(ctx, flags) {
 }
 
 // packages/cli/dist/commands/host.js
-import { existsSync as existsSync20, mkdirSync as mkdirSync12 } from "node:fs";
-import { hostname as hostname3 } from "node:os";
+import { existsSync as existsSync21, mkdirSync as mkdirSync12 } from "node:fs";
+import { hostname as hostname4 } from "node:os";
 import { dirname as dirname10, join as join23, resolve as resolve12 } from "node:path";
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 
 // packages/cli/dist/commands/service.js
 import { execFile as execFile4 } from "node:child_process";
-import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 import { dirname as dirname9, join as join22, resolve as resolve11 } from "node:path";
 var LAUNCHD_LABEL = "com.switchyard.host";
@@ -19531,7 +20265,7 @@ function systemdEscape(s, exec = true) {
 }
 function loadTemplate(kind, dir = deployDir()) {
   const p = join22(dir, TEMPLATE_FILES[kind]);
-  return existsSync19(p) ? readFileSync13(p, "utf8") : TEMPLATES[kind];
+  return existsSync20(p) ? readFileSync13(p, "utf8") : TEMPLATES[kind];
 }
 function renderService(kind, vars, template = TEMPLATES[kind]) {
   for (const [k, v] of Object.entries(vars)) {
@@ -19575,7 +20309,7 @@ function loadCommands(kind, file, uid, instance) {
     ["systemctl", "--user", "restart", unit]
   ];
 }
-function stableNodePath(execPath, exists2 = existsSync19) {
+function stableNodePath(execPath, exists2 = existsSync20) {
   const m = execPath.match(/^(.*)\/Cellar\/node(?:@[^/]+)?\/[^/]+\/bin\/node$/);
   if (m) {
     const candidate = `${m[1]}/bin/node`;
@@ -19599,7 +20333,7 @@ async function installService(ctx, flags, deps = defaultInstallDeps()) {
     throw new CliError("--instance needs --config and --state-dir, so the second host agent keeps its own enrollment and state");
   }
   const config = flags.config ?? defaultConfigPath(ctx.env, deps.home);
-  if (!existsSync19(config) && !flags.print) {
+  if (!existsSync20(config) && !flags.print) {
     throw new CliError(`No host config at ${config}. Enroll first: switchyard host enroll --coordinator <url> --token <t>`);
   }
   const stateDir = flags.stateDir ? resolve11(flags.stateDir) : defaultStateDir(ctx.env, deps.platform, deps.home);
@@ -19649,7 +20383,7 @@ async function hostEnroll(ctx, flags) {
   if (!flags.token === !flags.secret) {
     throw new CliError("Pass exactly one of --token or --secret");
   }
-  const name = flags.name ?? hostname3().replace(/\.local$/, "");
+  const name = flags.name ?? hostname4().replace(/\.local$/, "");
   const cfg = await enroll({
     coordinatorUrl: flags.coordinator,
     ...flags.token ? { token: flags.token } : { secret: flags.secret },
@@ -19663,7 +20397,7 @@ async function hostEnroll(ctx, flags) {
 }
 async function hostRun(ctx, flags) {
   const configPath = flags.config ?? defaultConfigPath(ctx.env);
-  if (!existsSync20(configPath)) {
+  if (!existsSync21(configPath)) {
     ctx.err(`No host config at ${configPath} yet: waiting for it (with SWITCHYARD_HOST_ENROLL_SECRET and SWITCHYARD_COORDINATOR_URL set, the host enrolls itself).`);
   }
   const agent = await runHostAgent({
@@ -19679,10 +20413,10 @@ async function hostRun(ctx, flags) {
 function hostBackup(ctx, out, flags) {
   const stateDir = flags.stateDir ?? defaultStateDir(ctx.env);
   const src = join23(stateDir, "host.db");
-  if (!existsSync20(src))
+  if (!existsSync21(src))
     throw new CliError(`No host database at ${src}`);
   const dest = resolve12(out);
-  if (existsSync20(dest))
+  if (existsSync21(dest))
     throw new CliError(`${dest} already exists`);
   mkdirSync12(dirname10(dest), { recursive: true });
   const db = new DatabaseSync4(src);
@@ -19699,7 +20433,7 @@ async function hostStatus(ctx, flags) {
   const configPath = flags.config ?? defaultConfigPath(ctx.env);
   const stateDir = flags.stateDir ?? defaultStateDir(ctx.env);
   const status = { configPath, stateDir };
-  if (!existsSync20(configPath)) {
+  if (!existsSync21(configPath)) {
     status.enrolled = false;
   } else {
     const cfg = loadConfig(configPath);
@@ -19732,7 +20466,7 @@ async function hostStatus(ctx, flags) {
   try {
     const kind = serviceKindFor(process.platform);
     const file = serviceFilePath(kind);
-    status.service = { kind, file, installed: existsSync20(file) };
+    status.service = { kind, file, installed: existsSync21(file) };
   } catch {
     status.service = null;
   }
@@ -19884,136 +20618,6 @@ async function tuiCommand(ctx, sessionId, flags, run = runRawTerminal) {
   throw new CliError(result.message);
 }
 
-// packages/cli/dist/commands/up.js
-import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
-import { hostname as hostname4 } from "node:os";
-var DEV_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
-function upOptions(flags, env) {
-  const port = flags.port === void 0 ? DEFAULT_PORT : Number(flags.port);
-  if (!Number.isInteger(port) || port < 0 || port > 65535) {
-    throw new CliError(`Invalid port "${flags.port}"`);
-  }
-  const listenHost = flags.host ?? "0.0.0.0";
-  const dataDir = flags.dataDir ?? defaultDataDir(env);
-  const explicitPublic = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim();
-  const publicUrl = explicitPublic || port !== 0 ? (explicitPublic || `http://localhost:${port}`).replace(/\/+$/, "") : void 0;
-  let trusted = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
-  if (!trusted && publicUrl) {
-    trusted = [new URL(publicUrl).origin];
-    if (!explicitPublic)
-      trusted.push(`http://127.0.0.1:${port}`);
-  }
-  if (flags.dev && trusted)
-    trusted = [.../* @__PURE__ */ new Set([...trusted, ...DEV_ORIGINS])];
-  return {
-    dataDir,
-    listen: { host: listenHost, port },
-    publicUrl,
-    trustedOrigins: trusted,
-    webDist: resolveWebDist(flags.webDist, env),
-    // Same server env as `coordinator start`: shared host secret, trusted proxies and OIDC.
-    ...authOptionsFromEnv(env)
-  };
-}
-async function ensureLocalHost(coordinator, localUrl, configPath, name, fetchImpl) {
-  if (existsSync21(configPath)) {
-    const cfg2 = loadConfig(configPath);
-    const known = coordinator.store.hosts.get(cfg2.hostId);
-    if (known && !known.revokedAt) {
-      return { config: { ...cfg2, coordinatorUrl: localUrl }, enrolled: false };
-    }
-  }
-  const api = new ApiClient({
-    coordinatorUrl: localUrl,
-    credential: coordinator.adminToken,
-    fetch: fetchImpl
-  });
-  const e = await api.post("/api/hosts/enrollments", {});
-  const cfg = await enroll({
-    coordinatorUrl: localUrl,
-    token: e.token,
-    name,
-    configPath,
-    fetch: fetchImpl
-  });
-  const { configPath: _p, ...config } = cfg;
-  return { config, enrolled: true };
-}
-function openBrowser(url, platform = process.platform, spawnFn = spawn5) {
-  const cmd = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
-  if (!cmd)
-    return;
-  try {
-    const child = spawnFn(cmd, [url], { detached: true, stdio: "ignore" });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-async function initializeLocally(ctx, coordinator, open2, opener) {
-  if (coordinator.owner.isInitialized())
-    return null;
-  coordinator.owner.markInitialized();
-  const e = coordinator.auth.createEnrollment("device", ADMIN_DEVICE_ID);
-  await printInit(ctx, { alreadyInitialized: false, enrollment: e });
-  if (open2)
-    opener(e.url);
-  return e.url;
-}
-async function startStandalone(ctx, flags, deps = {}) {
-  if (flags.dev && !ctx.env.SWITCHYARD_LOG_LEVEL)
-    process.env.SWITCHYARD_LOG_LEVEL = "debug";
-  const opts = upOptions(flags, ctx.env);
-  const coordinator = createCoordinator({ ...opts, setupHint: false });
-  await coordinator.start();
-  let firstLink;
-  try {
-    firstLink = await initializeLocally(ctx, coordinator, flags.open ?? process.stdout.isTTY === true, deps.open ?? ((url) => openBrowser(url)));
-  } catch (err) {
-    await coordinator.stop();
-    throw err;
-  }
-  const localUrl = localUrlFor(opts.listen, coordinator.port);
-  writeEndpoint(opts.dataDir, { localUrl, publicUrl: coordinator.config.publicUrl });
-  let host;
-  try {
-    const paths = standaloneHostPaths(opts.dataDir);
-    const { config, enrolled } = await ensureLocalHost(coordinator, localUrl, paths.configPath, flags.name ?? hostname4().replace(/\.local$/, ""));
-    if (enrolled)
-      ctx.err(`Enrolled the local host "${config.name}" (${config.hostId})`);
-    host = await runHostAgent({ config, stateDir: paths.stateDir, handleSignals: false });
-  } catch (err) {
-    await coordinator.stop();
-    throw err;
-  }
-  return {
-    coordinator,
-    host,
-    localUrl,
-    firstLink,
-    async stop() {
-      await host.stop();
-      await coordinator.stop();
-    }
-  };
-}
-async function up(ctx, flags) {
-  const s = await startStandalone(ctx, flags);
-  const c = s.coordinator;
-  ctx.err([
-    `Switchyard is up: ${c.config.publicUrl} (listening on port ${c.port})`,
-    `Data: ${c.config.dataDir}`,
-    c.config.webDist ? null : "Web app bundle not found: API only (run `pnpm build`)",
-    "Another device: switchyard pair    Terminal: switchyard tui <session>",
-    "Schedules run only while this process is running."
-  ].filter(Boolean).join("\n"));
-  const sig = await waitForSignal();
-  ctx.err(`${sig}: stopping (Pi sessions on this host are stopped and can be resumed later)`);
-  await s.stop();
-}
-
 // packages/cli/dist/commands/work.js
 function byId2(list) {
   return new Map(list.map((x) => [x.id, x]));
@@ -20221,13 +20825,10 @@ function buildProgram(ctx = defaultCtx()) {
   });
   host.command("backup <out>").description("Consistent backup of the host database").option("--state-dir <dir>", "state dir (env SWITCHYARD_STATE_DIR)").action((out, o) => hostBackup(ctx, out, o));
   host.command("status").description("Show this host's enrollment, link and Pi status").option("--config <path>", "host.json path").option("--state-dir <dir>", "state dir").option("--json", "JSON output").action((o) => hostStatus(ctx, o));
-  program.command("init").description("Set up this server and print a single-use sign-in link for your first device").option("--coordinator <url>", "local coordinator URL (default: the running one)").option("--data-dir <dir>", "data dir holding admin.token").option("--json", "JSON output").action(async (o) => {
-    await init(ctx, o);
-  });
-  program.command("pair").description("Create a single-use link and QR for another device (or --host); also the recovery path when every device is lost").option("--host", "enroll a host instead of a device").option("--coordinator <url>", "local coordinator URL (default: the running one)").option("--data-dir <dir>", "data dir holding admin.token").option("--json", "JSON output").action(async (o) => {
+  program.command("pair").description("Print a single-use sign-in link and QR for a browser (or --host for a host token), using the admin token: for local servers and recovery").option("--host", "enroll a host instead of a device").option("--coordinator <url>", "local coordinator URL (default: the running one)").option("--data-dir <dir>", "data dir holding admin.token").option("--json", "JSON output").action(async (o) => {
     await pair(ctx, o);
   });
-  program.command("login").description("Enroll this terminal as a device (writes ~/.config/switchyard/client.json)").option("--coordinator <url>", "coordinator URL").requiredOption("--token <token>", "device enrollment token or link (switchyard pair)").option("--name <name>", "device name").action(async (o) => {
+  program.command("login").description("Sign this terminal in by approving it in a browser (writes ~/.config/switchyard/client.json)").option("--coordinator <url>", "coordinator URL (default: SWITCHYARD_URL or client.json)").option("--name <name>", "device name").option("--token <token>", "single-use sign-in link or token from `switchyard pair`, instead of browser approval").option("--open", "open the approval page in a browser (default: when interactive and not over SSH)").option("--no-open", "never open a browser").action(async (o) => {
     await login(ctx, o);
   });
   connectionOptions(program.command("doctor").description("Check Node, Pi, git, coordinator, credentials, host link and push")).action(async (o) => {