@spencerboucher/switchyard 0.6.0 → 0.7.0

package/dist/switchyard.mjs

@@ -683,7 +683,7 @@ var Device = z3.object({
     permission: z3.enum(["granted", "denied", "default", "unknown"])
   }),
   preferredMobile: z3.boolean(),
-  enrolledVia: z3.enum(["enrollment", "passkey", "oidc", "admin"]).default("enrollment")
+  enrolledVia: z3.enum(["enrollment", "passkey", "oidc", "admin", "approval"]).default("enrollment")
 });
 var ToolItemData = z3.object({
   toolCallId: z3.string(),
@@ -1049,7 +1049,6 @@ var PushPayload = z4.union([
   z4.object({ type: z4.literal("clear"), tag: z4.string() })
 ]);
 var SetupState = z4.object({
-  initialized: z4.boolean(),
   passkey: z4.object({
     available: z4.boolean(),
     registered: z4.boolean(),
@@ -1057,10 +1056,6 @@ var SetupState = z4.object({
   }),
   oidc: z4.object({ label: z4.string() }).nullable()
 });
-var InitResponse = z4.object({
-  alreadyInitialized: z4.boolean(),
-  enrollment: CreateEnrollmentResponse
-});
 var PasskeyRegisterOptionsResponse = z4.object({
   challengeId: z4.string(),
   options: z4.unknown()
@@ -1096,6 +1091,31 @@ var OidcClaimResponse = z4.union([
   z4.object({ status: z4.literal("pending") }),
   z4.object({ status: z4.literal("done"), deviceId: z4.string() })
 ]);
+var TerminalLoginStartRequest = z4.object({ name: z4.string().min(1).max(80) });
+var TerminalLoginStartResponse = z4.object({
+  userCode: z4.string(),
+  pollToken: z4.string(),
+  verifyUrl: z4.string(),
+  expiresAt: z4.string(),
+  intervalMs: z4.number().int()
+});
+var TerminalLoginClaimRequest = z4.object({
+  userCode: z4.string().min(1),
+  pollToken: z4.string().min(1)
+});
+var TerminalLoginClaimResponse = z4.union([
+  z4.object({ status: z4.literal("pending") }),
+  z4.object({ status: z4.literal("denied") }),
+  z4.object({ status: z4.literal("done"), deviceId: z4.string(), credential: z4.string() })
+]);
+var TerminalLoginRequest = z4.object({
+  userCode: z4.string(),
+  name: z4.string(),
+  requestedFrom: z4.string(),
+  createdAt: z4.string(),
+  expiresAt: z4.string(),
+  status: z4.enum(["pending", "approved", "denied"])
+});
 var AuthMethods = z4.object({
   passkeys: z4.array(Passkey),
   passkeyAvailability: z4.object({ available: z4.boolean(), reason: z4.string().nullable() }),
@@ -1854,7 +1874,7 @@ var ApiClient = class {
   constructor(opts) {
     this.baseUrl = opts.coordinatorUrl.replace(/\/+$/, "");
     this.credential = opts.credential;
-    this.doFetch = opts.fetch ?? ((input, init2) => fetch(input, init2));
+    this.doFetch = opts.fetch ?? ((input, init) => fetch(input, init));
   }
   async request(method, path, body) {
     const headers = { accept: "application/json" };
@@ -2320,8 +2340,8 @@ function runRawTerminal(opts) {
 import { Command, Option } from "commander";
 
 // packages/cli/dist/commands/auth.js
-import { hostname } from "node:os";
-import QRCode from "qrcode";
+import { hostname as hostname3 } from "node:os";
+import QRCode2 from "qrcode";
 
 // packages/cli/dist/config.js
 import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -2483,121 +2503,10 @@ function trimUrl(url) {
   return url.trim().replace(/\/+$/, "");
 }
 
-// packages/cli/dist/commands/auth.js
-function adminApi(ctx, flags) {
-  const dataDir = flags.dataDir ?? ctx.paths?.dataDir ?? defaultDataDir(ctx.env);
-  const token = readAdminToken(dataDir, ctx.env);
-  if (!token) {
-    throw new CliError(`No admin token: run this on the coordinator machine (looked in ${dataDir}/admin.token) or set SWITCHYARD_ADMIN_TOKEN`);
-  }
-  const url = trimUrl(flags.coordinator ?? readEndpoint(dataDir)?.localUrl ?? DEFAULT_LOCAL_URL);
-  return new ApiClient({ coordinatorUrl: url, credential: token, fetch: ctx.fetch });
-}
-function clockTime(iso) {
-  const d = new Date(iso);
-  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
-}
-async function printDeviceLink(ctx, url) {
-  const qr = await QRCode.toString(url, { type: "terminal", small: true });
-  ctx.out("");
-  ctx.out(`  ${url}`);
-  ctx.out("");
-  ctx.out(qr.trimEnd());
-  ctx.out("");
-}
-async function printInit(ctx, r) {
-  if (r.alreadyInitialized) {
-    ctx.out("Already set up. New single-use sign-in link for one device:");
-    await printDeviceLink(ctx, r.enrollment.url);
-    return;
-  }
-  ctx.out(`Switchyard is set up. Open this single-use link on your first device (expires ${clockTime(r.enrollment.expiresAt)}):`);
-  await printDeviceLink(ctx, r.enrollment.url);
-  ctx.out("Then add a passkey in Settings \u203A Sign-in so other devices can sign in without a link.");
-}
-async function init(ctx, flags) {
-  const api = adminApi(ctx, flags);
-  const r = await api.post("/api/admin/init", {});
-  if (flags.json) {
-    ctx.out(JSON.stringify(r, null, 2));
-    return r;
-  }
-  await printInit(ctx, r);
-  return r;
-}
-async function pair(ctx, flags) {
-  const api = adminApi(ctx, flags);
-  const kind = flags.host ? "host" : "device";
-  const e = await api.post("/api/enrollments", { kind });
-  if (flags.json) {
-    ctx.out(JSON.stringify(e, null, 2));
-    return e;
-  }
-  const qr = await QRCode.toString(e.url, { type: "terminal", small: true });
-  if (kind === "host") {
-    ctx.out(`Host enrollment (single use, expires ${e.expiresAt}). On the host, run:`);
-    ctx.out("");
-    ctx.out(`  ${e.command ?? `switchyard host enroll --coordinator <url> --token ${e.token}`}`);
-    ctx.out("");
-    ctx.out(`Token: ${e.token}`);
-  } else {
-    ctx.out(`Open this link on the device to enroll it (single use, expires ${e.expiresAt}):`);
-    ctx.out("");
-    ctx.out(`  ${e.url}`);
-    ctx.out("");
-    ctx.out(qr.trimEnd());
-    ctx.out("");
-    ctx.out(`Terminal: switchyard login --coordinator ${originOf(e.url)} --token ${e.token}`);
-  }
-  ctx.out("The link does not provide network access: the device must already reach this URL.");
-  return e;
-}
-function originOf(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return url;
-  }
-}
-function parseEnrollmentInput(token, coordinator) {
-  const t = token.trim();
-  if (/^https?:\/\//.test(t)) {
-    const u = new URL(t);
-    const params = new URLSearchParams(u.hash.replace(/^#/, ""));
-    const fromUrl = params.get("token") ?? u.searchParams.get("token");
-    if (!fromUrl)
-      throw new CliError("That URL has no enrollment token");
-    return { url: trimUrl(coordinator ?? u.origin), token: fromUrl };
-  }
-  if (!coordinator)
-    throw new CliError("--coordinator <url> is required");
-  return { url: trimUrl(coordinator), token: t };
-}
-async function login(ctx, flags) {
-  const { url, token } = parseEnrollmentInput(flags.token, flags.coordinator);
-  const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
-  const name = flags.name ?? `${hostname().replace(/\.local$/, "")} terminal`;
-  const res = await api.post("/api/enroll", {
-    token,
-    name,
-    kind: "terminal"
-  });
-  if (!res.credential)
-    throw new CliError("The coordinator returned no credential");
-  const path = ctx.paths?.clientConfig ?? clientConfigPath(ctx.env);
-  writeClientConfig(path, {
-    coordinatorUrl: url,
-    credential: res.credential,
-    deviceId: res.deviceId
-  });
-  ctx.out(`Enrolled "${name}" (${res.deviceId}) with ${url}.`);
-  ctx.out(`Credential saved to ${path} (mode 0600). Open a session's Pi terminal with \`switchyard tui <session>\`.`);
-  return { path, deviceId: res.deviceId };
-}
-
-// packages/cli/dist/commands/coordinator.js
-import { existsSync as existsSync6, mkdirSync as mkdirSync4 } from "node:fs";
-import { resolve as resolve4 } from "node:path";
+// packages/cli/dist/commands/up.js
+import { spawn as spawn4 } from "node:child_process";
+import { existsSync as existsSync14 } from "node:fs";
+import { hostname as hostname2 } from "node:os";
 
 // packages/coordinator/dist/attention/router.js
 var DESKTOP_RECENT_MS = 5 * 6e4;
@@ -2895,12 +2804,10 @@ var Auth = class {
   store;
   config;
   hub;
-  owner;
-  constructor(store, config, hub, owner) {
+  constructor(store, config, hub) {
     this.store = store;
     this.config = config;
     this.hub = hub;
-    this.owner = owner;
   }
   get adminTokenPath() {
     return join3(this.config.dataDir, "admin.token");
@@ -2940,14 +2847,13 @@ var Auth = class {
     return this.store.devices.count("is_admin = 0 AND revoked_at IS NULL");
   }
   enrollmentUrl(token, kind) {
-    return kind === "device" ? `${this.config.publicUrl}/enroll#token=${token}` : `${this.config.publicUrl}/enroll#token=${token}&kind=host`;
+    return kind === "device" ? `${this.config.publicUrl}/sign-in#token=${token}` : `${this.config.publicUrl}/sign-in#token=${token}&kind=host`;
   }
   hostEnrollCommand(token) {
     return `switchyard host enroll --coordinator ${this.config.publicUrl} --token ${token}`;
   }
   /**
-   * Create a single-use enrollment (device 10 min, host 30 min by default). An enrollment created
-   * by a device (the local admin included) also marks the server set up.
+   * Create a single-use enrollment (device 10 min, host 30 min by default).
    */
   createEnrollment(kind, createdBy, ttlMs = kind === "device" ? DEVICE_ENROLLMENT_TTL_MS : HOST_ENROLLMENT_TTL_MS) {
     const token = newToken();
@@ -2955,8 +2861,6 @@ var Auth = class {
     const now = this.store.now();
     const expiresAt = new Date(now.getTime() + ttlMs).toISOString();
     this.store.tx(() => {
-      if (createdBy !== null)
-        this.owner.markInitialized();
       this.store.insertEnrollment({
         id,
         kind,
@@ -4459,7 +4363,7 @@ function createSession(ctx, input) {
     nativeHandle: null,
     profileSnapshot: profile,
     runtime: "starting",
-    runtimeDetail: null,
+    runtimeDetail: workspace ? "Starting Pi\u2026" : "Creating worktree\u2026",
     connectivity: host.connectivity,
     runId: null,
     taskId: null,
@@ -4475,19 +4379,27 @@ function createSession(ctx, input) {
   ctx.store.putSession(session);
   const choice = input.workspace;
   const started = (async () => {
+    const t0 = Date.now();
     try {
       let s = session;
       if (!("existingId" in choice)) {
         const ws = await createWorkspace(ctx, project, checkout, choice.newBranch, choice.base);
+        ctx.log.info({ sessionId: session.id, ms: Date.now() - t0 }, "session start: worktree ready");
         s = ctx.store.tx(() => {
           const cur = ctx.store.sessions.require(session.id);
-          return ctx.store.putSession({ ...cur, workspaceId: ws.id, cwd: ws.path });
+          return ctx.store.putSession({
+            ...cur,
+            workspaceId: ws.id,
+            cwd: ws.path,
+            runtimeDetail: "Starting Pi\u2026"
+          });
         });
       }
       await startOnHost(ctx, s, {
         initialPrompt: input.prompt.trim() ? input.prompt : null,
         nativeHandle: null
       });
+      ctx.log.info({ sessionId: session.id, ms: Date.now() - t0 }, "session start: started on host");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       ctx.log.warn({ err, sessionId: session.id }, "session start failed");
@@ -7328,10 +7240,23 @@ INSERT OR IGNORE INTO settings(key, value)
   WHERE EXISTS (SELECT 1 FROM devices WHERE is_admin = 0 AND revoked_at IS NULL);
 `;
 
+// packages/coordinator/dist/db/migrations/003_terminal_login.js
+var sql3 = `
+DROP TABLE auth_flows;
+
+CREATE TABLE auth_flows (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('passkey_register','passkey_auth','oidc','terminal_login')),
+  data TEXT NOT NULL,
+  expires_at TEXT NOT NULL
+);
+`;
+
 // packages/coordinator/dist/db/index.js
 var MIGRATIONS = [
   { version: 1, name: "001_init", sql },
-  { version: 2, name: "002_owner_auth", sql: sql2 }
+  { version: 2, name: "002_owner_auth", sql: sql2 },
+  { version: 3, name: "003_terminal_login", sql: sql3 }
 ];
 var LATEST_MIGRATION = MIGRATIONS[MIGRATIONS.length - 1].version;
 function openDb(path) {
@@ -8171,8 +8096,11 @@ import * as client from "openid-client";
 // packages/coordinator/dist/owner.js
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { isIP } from "node:net";
-var OWNER_INITIALIZED_KEY = "owner.initialized_at";
 var OWNER_WEBAUTHN_USER_KEY = "owner.webauthn_user_id";
+function isLoopbackUrl(url) {
+  const host = new URL(url).hostname.replace(/^\[|\]$/g, "");
+  return host === "localhost" || host === "::1" || /^127\.\d+\.\d+\.\d+$/.test(host);
+}
 var Owner = class {
   store;
   config;
@@ -8180,18 +8108,6 @@ var Owner = class {
     this.store = store;
     this.config = config;
   }
-  isInitialized() {
-    return this.config.oidc !== null || this.store.getSetting(OWNER_INITIALIZED_KEY, null) !== null;
-  }
-  /** Mark the server set up. Returns true when this call set it. */
-  markInitialized() {
-    return this.store.tx(() => {
-      if (this.store.getSetting(OWNER_INITIALIZED_KEY, null) !== null)
-        return false;
-      this.store.setSetting(OWNER_INITIALIZED_KEY, this.store.nowIso());
-      return true;
-    });
-  }
   /** Stable random WebAuthn user handle for the owner (16 bytes, created lazily). */
   webauthnUserId() {
     return this.store.tx(() => {
@@ -8851,53 +8767,6 @@ function registerAttentionRoutes(app, ctx) {
   app.post("/api/attention/:id/acknowledge", async (req) => ctx.attention.acknowledge(req.params.id));
 }
 
-// packages/coordinator/dist/routes/devices.js
-import QRCode2 from "qrcode";
-import { z as z14 } from "zod";
-var UpdateDeviceRequest = z14.object({
-  name: z14.string().min(1).max(80).optional(),
-  preferredMobile: z14.boolean().optional()
-});
-async function enrollmentResponse(ctx, kind, createdBy) {
-  const e = ctx.auth.createEnrollment(kind, createdBy);
-  const qrSvg = await QRCode2.toString(e.url, { type: "svg", margin: 1 });
-  return { token: e.token, url: e.url, expiresAt: e.expiresAt, qrSvg, command: e.command };
-}
-function publicDevice(ctx, id) {
-  return ctx.store.devices.require(id);
-}
-function registerDeviceRoutes(app, ctx) {
-  app.post("/api/enrollments", async (req, reply) => {
-    const body = parse(CreateEnrollmentRequest, req.body);
-    return reply.code(201).send(await enrollmentResponse(ctx, body.kind, deviceOf(req).id));
-  });
-  app.post("/api/devices/enrollments", async (req, reply) => reply.code(201).send(await enrollmentResponse(ctx, "device", deviceOf(req).id)));
-  app.get("/api/devices", async () => ctx.store.devices.list("is_admin = 0", [], "created_at"));
-  app.get("/api/devices/:id", async (req) => publicDevice(ctx, req.params.id));
-  app.patch("/api/devices/:id", async (req) => {
-    const { id } = req.params;
-    const body = parse(UpdateDeviceRequest, req.body);
-    return ctx.store.tx(() => {
-      const d = ctx.store.devices.require(id);
-      if (body.preferredMobile) {
-        for (const other of ctx.store.devices.list("is_admin = 0")) {
-          if (other.id !== id && other.preferredMobile) {
-            ctx.store.putDevice({ ...other, preferredMobile: false });
-          }
-        }
-      }
-      return ctx.store.putDevice({
-        ...d,
-        name: body.name ?? d.name,
-        preferredMobile: body.preferredMobile ?? d.preferredMobile
-      });
-    });
-  });
-  const revoke = async (req) => ctx.auth.revokeDevice(req.params.id);
-  app.post("/api/devices/:id/revoke", revoke);
-  app.delete("/api/devices/:id", revoke);
-}
-
 // packages/coordinator/dist/routes/auth.js
 var HANDOFF_PAGE = `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
@@ -8908,7 +8777,6 @@ var HANDOFF_PAGE = `<!doctype html>
 function setupState(ctx) {
   const availability = ctx.owner.passkeyAvailability();
   return {
-    initialized: ctx.owner.isInitialized(),
     passkey: {
       available: availability.available,
       registered: ctx.passkeys.count() > 0,
@@ -8988,6 +8856,18 @@ function registerAuthRoutes(app, ctx) {
     ctx.auth.setDeviceCookie(reply, r.credential);
     return { status: "done", deviceId: r.deviceId };
   });
+  app.post("/api/auth/terminal/start", async (req, reply) => {
+    limitAuth(req);
+    const body = parse(TerminalLoginStartRequest, req.body);
+    return reply.code(201).send(ctx.terminalLogins.start(body.name, req.ip));
+  });
+  app.post("/api/auth/terminal/claim", async (req) => {
+    const body = parse(TerminalLoginClaimRequest, req.body);
+    return ctx.terminalLogins.claim(body.userCode, body.pollToken);
+  });
+  app.get("/api/auth/terminal/requests/:code", async (req) => ctx.terminalLogins.describe(req.params.code));
+  app.post("/api/auth/terminal/requests/:code/approve", async (req) => ctx.terminalLogins.approve(req.params.code));
+  app.post("/api/auth/terminal/requests/:code/deny", async (req) => ctx.terminalLogins.deny(req.params.code));
   app.get("/api/auth/methods", async () => {
     const availability = ctx.owner.passkeyAvailability();
     return {
@@ -9006,15 +8886,6 @@ function registerAuthRoutes(app, ctx) {
     ctx.passkeys.remove(req.params.id);
     return { ok: true };
   });
-  app.post("/api/admin/init", async (req) => {
-    const device = deviceOf(req);
-    if (!device.isAdmin || device.id !== ADMIN_DEVICE_ID) {
-      throw new SwitchyardError("forbidden", "Only the server's local admin token can initialize");
-    }
-    const alreadyInitialized = !ctx.owner.markInitialized();
-    const enrollment = await enrollmentResponse(ctx, "device", device.id);
-    return { alreadyInitialized, enrollment };
-  });
 }
 function redirectError(ctx, req, reply, err) {
   const code = err instanceof SwitchyardError ? err.code : "oidc_failed";
@@ -9024,7 +8895,54 @@ function redirectError(ctx, req, reply, err) {
   else if (err.code === "forbidden")
     ctx.log.info({ detail }, "OIDC sign-in refused");
   const qs = new URLSearchParams({ error: code, detail });
-  return reply.redirect(`/enroll?${qs.toString()}`, 302);
+  return reply.redirect(`/sign-in?${qs.toString()}`, 302);
+}
+
+// packages/coordinator/dist/routes/devices.js
+import QRCode from "qrcode";
+import { z as z14 } from "zod";
+var UpdateDeviceRequest = z14.object({
+  name: z14.string().min(1).max(80).optional(),
+  preferredMobile: z14.boolean().optional()
+});
+async function enrollmentResponse(ctx, kind, createdBy) {
+  const e = ctx.auth.createEnrollment(kind, createdBy);
+  const qrSvg = await QRCode.toString(e.url, { type: "svg", margin: 1 });
+  return { token: e.token, url: e.url, expiresAt: e.expiresAt, qrSvg, command: e.command };
+}
+function publicDevice(ctx, id) {
+  return ctx.store.devices.require(id);
+}
+function registerDeviceRoutes(app, ctx) {
+  app.post("/api/enrollments", async (req, reply) => {
+    const body = parse(CreateEnrollmentRequest, req.body);
+    return reply.code(201).send(await enrollmentResponse(ctx, body.kind, deviceOf(req).id));
+  });
+  app.post("/api/devices/enrollments", async (req, reply) => reply.code(201).send(await enrollmentResponse(ctx, "device", deviceOf(req).id)));
+  app.get("/api/devices", async () => ctx.store.devices.list("is_admin = 0", [], "created_at"));
+  app.get("/api/devices/:id", async (req) => publicDevice(ctx, req.params.id));
+  app.patch("/api/devices/:id", async (req) => {
+    const { id } = req.params;
+    const body = parse(UpdateDeviceRequest, req.body);
+    return ctx.store.tx(() => {
+      const d = ctx.store.devices.require(id);
+      if (body.preferredMobile) {
+        for (const other of ctx.store.devices.list("is_admin = 0")) {
+          if (other.id !== id && other.preferredMobile) {
+            ctx.store.putDevice({ ...other, preferredMobile: false });
+          }
+        }
+      }
+      return ctx.store.putDevice({
+        ...d,
+        name: body.name ?? d.name,
+        preferredMobile: body.preferredMobile ?? d.preferredMobile
+      });
+    });
+  });
+  const revoke = async (req) => ctx.auth.revokeDevice(req.params.id);
+  app.post("/api/devices/:id/revoke", revoke);
+  app.delete("/api/devices/:id", revoke);
 }
 
 // packages/coordinator/dist/routes/hosts.js
@@ -9808,11 +9726,11 @@ var Statements = class {
   constructor(db) {
     this.db = db;
   }
-  get(sql3) {
-    let s = this.cache.get(sql3);
+  get(sql4) {
+    let s = this.cache.get(sql4);
     if (!s) {
-      s = this.db.prepare(sql3);
-      this.cache.set(sql3, s);
+      s = this.db.prepare(sql4);
+      this.cache.set(sql4, s);
     }
     return s;
   }
@@ -9843,12 +9761,12 @@ var JsonRepo = class {
   }
   /** List with an optional SQL `WHERE` fragment over the indexed columns. */
   list(where, params = [], orderBy = "rowid") {
-    const sql3 = `SELECT json FROM ${this.table}${where ? ` WHERE ${where}` : ""} ORDER BY ${orderBy}`;
-    return this.st.get(sql3).all(...params).map((r) => JSON.parse(r.json));
+    const sql4 = `SELECT json FROM ${this.table}${where ? ` WHERE ${where}` : ""} ORDER BY ${orderBy}`;
+    return this.st.get(sql4).all(...params).map((r) => JSON.parse(r.json));
   }
   count(where, params = []) {
-    const sql3 = `SELECT COUNT(*) AS n FROM ${this.table}${where ? ` WHERE ${where}` : ""}`;
-    return this.st.get(sql3).get(...params).n;
+    const sql4 = `SELECT COUNT(*) AS n FROM ${this.table}${where ? ` WHERE ${where}` : ""}`;
+    return this.st.get(sql4).get(...params).n;
   }
   /**
    * Update by id, or insert when missing. `extra` columns are written in both cases when given
@@ -10594,44 +10512,169 @@ var TerminalHub = class {
   }
 };
 
-// packages/coordinator/dist/server.js
-var MIN_HOST_ENROLL_SECRET_LENGTH = 32;
-var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
-  "/api/enroll",
-  "/api/setup",
-  "/api/auth/passkey/options",
-  "/api/auth/passkey/verify",
-  "/api/auth/oidc/begin",
-  "/api/auth/oidc/callback",
-  "/api/auth/oidc/claim",
-  "/api/hosts/enroll",
-  "/api/hooks/:automationId",
-  "/healthz",
-  "/readyz",
-  "/ws/host"
-]);
-function isStaticFileRoute(req) {
-  if (req.method !== "GET" && req.method !== "HEAD")
-    return false;
-  const config = req.routeOptions.config;
-  return typeof config?.file === "string" && typeof config.rootPath === "string";
-}
-function isApiLikePath(url) {
-  let path = url.split("?")[0] ?? "";
-  try {
-    path = decodeURIComponent(path);
-  } catch {
-    return true;
-  }
+// packages/coordinator/dist/terminal-login.js
+import { randomInt } from "node:crypto";
+var TERMINAL_LOGIN_TTL_MS = 10 * 6e4;
+var TERMINAL_LOGIN_POLL_MS = 2e3;
+var CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
+function normalizeUserCode(s) {
+  return s.toUpperCase().replace(/[^A-Z]/g, "");
+}
+function formatUserCode(n) {
+  return `${n.slice(0, 4)}-${n.slice(4)}`;
+}
+var TerminalLogins = class {
+  store;
+  config;
+  auth;
+  flows;
+  constructor(store, config, auth) {
+    this.store = store;
+    this.config = config;
+    this.auth = auth;
+    this.flows = new AuthFlows(store);
+  }
+  load(code) {
+    const id = normalizeUserCode(code);
+    const flow = this.flows.get("terminal_login", id);
+    if (!flow) {
+      throw new SwitchyardError("not_found", "This sign-in request expired or does not exist. Run `switchyard login` again.");
+    }
+    return { id, flow };
+  }
+  view(id, flow) {
+    return {
+      userCode: formatUserCode(id),
+      name: flow.name,
+      requestedFrom: flow.requestedFrom,
+      createdAt: flow.createdAt,
+      expiresAt: flow.expiresAt,
+      status: flow.status
+    };
+  }
+  start(name, requestedFrom) {
+    let id = "";
+    for (let attempt = 0; attempt < 5 && !id; attempt++) {
+      let candidate = "";
+      for (let i = 0; i < 8; i++)
+        candidate += CODE_ALPHABET[randomInt(0, CODE_ALPHABET.length)];
+      if (!this.flows.get("terminal_login", candidate))
+        id = candidate;
+    }
+    if (!id)
+      throw new SwitchyardError("internal", "Could not allocate a sign-in code");
+    const pollToken = newToken();
+    const now = this.store.now();
+    const createdAt = now.toISOString();
+    const expiresAt = new Date(now.getTime() + TERMINAL_LOGIN_TTL_MS).toISOString();
+    const flow = {
+      name,
+      requestedFrom,
+      createdAt,
+      expiresAt,
+      pollTokenHash: sha256(pollToken),
+      status: "pending",
+      result: null
+    };
+    this.flows.put("terminal_login", id, flow, TERMINAL_LOGIN_TTL_MS);
+    const userCode = formatUserCode(id);
+    return {
+      userCode,
+      pollToken,
+      verifyUrl: `${this.config.publicUrl}/terminal-login?code=${userCode}`,
+      expiresAt,
+      intervalMs: TERMINAL_LOGIN_POLL_MS
+    };
+  }
+  describe(code) {
+    const { id, flow } = this.load(code);
+    return this.view(id, flow);
+  }
+  approve(code) {
+    return this.store.tx(() => {
+      const { id, flow } = this.load(code);
+      if (flow.status !== "pending") {
+        throw new SwitchyardError("invalid_request", "This sign-in was already approved or denied");
+      }
+      const { device, credential } = this.auth.createDevice(flow.name, "terminal", "approval");
+      const next = {
+        ...flow,
+        status: "approved",
+        result: { deviceId: device.id, credential }
+      };
+      this.flows.update(id, next);
+      return this.view(id, next);
+    });
+  }
+  deny(code) {
+    return this.store.tx(() => {
+      const { id, flow } = this.load(code);
+      if (flow.status !== "pending") {
+        throw new SwitchyardError("invalid_request", "This sign-in was already approved or denied");
+      }
+      const next = { ...flow, status: "denied" };
+      this.flows.update(id, next);
+      return this.view(id, next);
+    });
+  }
+  claim(code, pollToken) {
+    const id = normalizeUserCode(code);
+    const flow = this.flows.get("terminal_login", id);
+    if (!flow || !safeEqualHex(sha256(pollToken), flow.pollTokenHash)) {
+      throw new SwitchyardError("unauthorized", "Unknown or expired sign-in");
+    }
+    if (flow.status === "pending")
+      return { status: "pending" };
+    this.flows.delete(id);
+    if (flow.status === "denied" || !flow.result)
+      return { status: "denied" };
+    return { status: "done", deviceId: flow.result.deviceId, credential: flow.result.credential };
+  }
+};
+
+// packages/coordinator/dist/server.js
+var MIN_HOST_ENROLL_SECRET_LENGTH = 32;
+var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
+  "/api/enroll",
+  "/api/setup",
+  "/api/auth/passkey/options",
+  "/api/auth/passkey/verify",
+  "/api/auth/oidc/begin",
+  "/api/auth/oidc/callback",
+  "/api/auth/oidc/claim",
+  "/api/auth/terminal/start",
+  "/api/auth/terminal/claim",
+  "/api/hosts/enroll",
+  "/api/hooks/:automationId",
+  "/healthz",
+  "/readyz",
+  "/ws/host"
+]);
+function isStaticFileRoute(req) {
+  if (req.method !== "GET" && req.method !== "HEAD")
+    return false;
+  const config = req.routeOptions.config;
+  return typeof config?.file === "string" && typeof config.rootPath === "string";
+}
+function isApiLikePath(url) {
+  let path = url.split("?")[0] ?? "";
+  try {
+    path = decodeURIComponent(path);
+  } catch {
+    return true;
+  }
   return path.startsWith("/api/") || path.startsWith("/ws/") || path.startsWith("/adapter-frames/");
 }
-function originOf2(url) {
+function originOf(url) {
   return new URL(url).origin;
 }
 function validateAuthOptions(opts) {
   if (opts.hostEnrollSecret !== void 0 && opts.hostEnrollSecret.length < MIN_HOST_ENROLL_SECRET_LENGTH) {
     throw new SwitchyardError("invalid_request", `SWITCHYARD_HOST_ENROLL_SECRET must be at least ${MIN_HOST_ENROLL_SECRET_LENGTH} characters`);
   }
+  if (!opts.oidc && opts.publicUrl && !isLoopbackUrl(opts.publicUrl)) {
+    throw new SwitchyardError("invalid_request", `Single sign-on is required for ${opts.publicUrl}: set SWITCHYARD_OIDC_ISSUER, SWITCHYARD_OIDC_CLIENT_ID and an owner (SWITCHYARD_OIDC_OWNER_*), see docs/auth.md. Without single sign-on, Switchyard runs only at a localhost public URL.`);
+  }
   if (opts.oidc && !hasOwnerMatch(opts.oidc.owner)) {
     throw new SwitchyardError("invalid_request", "OIDC needs an owner match: set SWITCHYARD_OIDC_OWNER_SUBJECT, SWITCHYARD_OIDC_OWNER_EMAIL or SWITCHYARD_OIDC_OWNER_GROUP");
   }
@@ -10656,7 +10699,7 @@ function createCoordinator(opts) {
   const config = {
     dataDir,
     publicUrl,
-    trustedOrigins: opts.trustedOrigins ?? [originOf2(publicUrl)],
+    trustedOrigins: opts.trustedOrigins ?? [originOf(publicUrl)],
     webDist: opts.webDist ? resolve3(opts.webDist) : null,
     secureCookies: publicUrl.startsWith("https:"),
     unreachableAfterMs: opts.unreachableAfterMs ?? 6e4,
@@ -10669,12 +10712,11 @@ function createCoordinator(opts) {
   hub.onListenerError = (name, err) => log.error({ err, event: name }, "event listener failed");
   const store = new Store2(db, hub, opts.clock);
   const owner = new Owner(store, config);
-  const auth = new Auth(store, config, hub, owner);
+  const auth = new Auth(store, config, hub);
   const adminToken = auth.ensureAdminToken();
-  if (config.oidc)
-    owner.markInitialized();
   const passkeys = new Passkeys(store, owner, config, auth);
   const oidc = config.oidc ? new Oidc(store, owner, config, auth) : null;
+  const terminalLogins = new TerminalLogins(store, config, auth);
   const limits = opts.rateLimits === false ? null : opts.rateLimits ?? {};
   const storeClock = () => store.now().getTime();
   const limiters = {
@@ -10703,6 +10745,7 @@ function createCoordinator(opts) {
     owner,
     passkeys,
     oidc,
+    terminalLogins,
     limiters,
     log,
     services: /* @__PURE__ */ new Map()
@@ -10810,10 +10853,10 @@ function createCoordinator(opts) {
       sweep();
       retentionTimer = setInterval(sweep, opts.retentionIntervalMs ?? 36e5);
       retentionTimer.unref();
-      if (!owner.isInitialized()) {
-        log.info("not set up yet: run `switchyard init` on this server");
+      if (!config.oidc && auth.activeDeviceCount() === 0 && passkeys.count() === 0) {
+        log.info("no device signed in yet: run `switchyard pair` on this machine");
         if (opts.setupHint !== false) {
-          process.stderr.write("Switchyard is not set up yet. Run `switchyard init` on this server to create the first sign-in link.\n");
+          process.stderr.write("No device is signed in yet. Run `switchyard pair` on this machine for a single-use sign-in link.\n");
         }
       }
     },
@@ -10834,162 +10877,11 @@ function createCoordinator(opts) {
   return coordinator;
 }
 
-// packages/cli/dist/commands/coordinator.js
-function parseListen(v) {
-  const s = v.trim();
-  let host = "0.0.0.0";
-  let portStr = s;
-  const v6 = s.match(/^\[([^\]]+)\]:(\d+)$/);
-  if (v6) {
-    host = v6[1];
-    portStr = v6[2];
-  } else if (s.includes(":")) {
-    const i = s.lastIndexOf(":");
-    host = s.slice(0, i) || "0.0.0.0";
-    portStr = s.slice(i + 1);
-  } else if (!/^\d+$/.test(s)) {
-    host = s;
-    portStr = String(DEFAULT_PORT);
-  }
-  const port = Number(portStr);
-  if (!Number.isInteger(port) || port < 0 || port > 65535) {
-    throw new CliError(`Invalid listen address "${v}" (expected host:port)`);
-  }
-  return { host, port };
-}
-function parseOrigins(v) {
-  if (!v?.trim())
-    return void 0;
-  return v.split(",").map((o) => o.trim().replace(/\/+$/, "")).filter(Boolean);
-}
-var DEFAULT_OIDC_LABEL = "Sign in with single sign-on";
-var DEFAULT_OIDC_SCOPES = "openid profile email groups";
-function envValue(env, key) {
-  const v = env[key]?.trim();
-  return v ? v : void 0;
-}
-function authOptionsFromEnv(env) {
-  const out = {};
-  const secret = envValue(env, "SWITCHYARD_HOST_ENROLL_SECRET");
-  if (secret)
-    out.hostEnrollSecret = secret;
-  const proxies = parseOrigins(env.SWITCHYARD_TRUSTED_PROXIES);
-  if (proxies)
-    out.trustedProxies = proxies;
-  const issuer = envValue(env, "SWITCHYARD_OIDC_ISSUER");
-  const clientId = envValue(env, "SWITCHYARD_OIDC_CLIENT_ID");
-  if (issuer && clientId) {
-    if (!/^https?:\/\//.test(issuer)) {
-      throw new CliError(`SWITCHYARD_OIDC_ISSUER must be an http(s) URL, got "${issuer}"`);
-    }
-    out.oidc = {
-      issuer,
-      clientId,
-      clientSecret: envValue(env, "SWITCHYARD_OIDC_CLIENT_SECRET") ?? null,
-      label: envValue(env, "SWITCHYARD_OIDC_LABEL") ?? DEFAULT_OIDC_LABEL,
-      scopes: envValue(env, "SWITCHYARD_OIDC_SCOPES") ?? DEFAULT_OIDC_SCOPES,
-      owner: {
-        subject: envValue(env, "SWITCHYARD_OIDC_OWNER_SUBJECT") ?? null,
-        email: envValue(env, "SWITCHYARD_OIDC_OWNER_EMAIL") ?? null,
-        group: envValue(env, "SWITCHYARD_OIDC_OWNER_GROUP") ?? null
-      }
-    };
-  } else if (issuer || clientId) {
-    throw new CliError("Single sign-on needs both SWITCHYARD_OIDC_ISSUER and SWITCHYARD_OIDC_CLIENT_ID");
-  }
-  return out;
-}
-function coordinatorOptions(flags, env) {
-  const dataDir = flags.dataDir ? resolve4(flags.dataDir) : defaultDataDir(env);
-  const listen = parseListen(flags.listen ?? env.SWITCHYARD_LISTEN ?? `0.0.0.0:${DEFAULT_PORT}`);
-  const publicUrl = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim() || void 0;
-  if (publicUrl && !/^https?:\/\//.test(publicUrl)) {
-    throw new CliError(`Public URL must start with http:// or https://, got "${publicUrl}"`);
-  }
-  const trustedOrigins = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
-  return {
-    dataDir,
-    listen,
-    publicUrl,
-    trustedOrigins,
-    webDist: resolveWebDist(flags.webDist, env),
-    ...authOptionsFromEnv(env)
-  };
-}
-function waitForSignal() {
-  return new Promise((res) => {
-    const on = (sig) => {
-      process.off("SIGINT", on);
-      process.off("SIGTERM", on);
-      res(sig);
-    };
-    process.on("SIGINT", on);
-    process.on("SIGTERM", on);
-  });
-}
-async function coordinatorStart(ctx, flags) {
-  const opts = coordinatorOptions(flags, ctx.env);
-  const c = createCoordinator(opts);
-  await c.start();
-  writeEndpoint(opts.dataDir, {
-    localUrl: localUrlFor(opts.listen, c.port),
-    publicUrl: c.config.publicUrl
-  });
-  ctx.err(`Switchyard coordinator listening on ${opts.listen.host}:${c.port} (public URL ${c.config.publicUrl}; data ${opts.dataDir}${opts.webDist ? "" : "; web app not found, API only"})`);
-  const sig = await waitForSignal();
-  ctx.err(`${sig}: stopping coordinator`);
-  await c.stop();
-}
-function localUrlFor(listen, port) {
-  const h = listen.host ?? "0.0.0.0";
-  const host = h === "0.0.0.0" || h === "::" || h === "" ? "127.0.0.1" : h.includes(":") ? `[${h}]` : h;
-  return `http://${host}:${port}`;
-}
-function dataDirOf(flags, env) {
-  return flags.dataDir ? resolve4(flags.dataDir) : defaultDataDir(env);
-}
-function coordinatorBackup(ctx, out, flags) {
-  const r = backup(dataDirOf(flags, ctx.env), out);
-  ctx.out(`Backed up to ${r.file} (schema ${r.migrationLevel})`);
-}
-function coordinatorRestore(ctx, file, flags) {
-  const r = restore(dataDirOf(flags, ctx.env), file);
-  ctx.out(`Restored ${r.restoredFrom} (schema ${r.migrationLevel}).`);
-  if (r.previous)
-    ctx.out(`The previous database was kept as ${r.previous}`);
-  if (r.migrationLevel < LATEST_MIGRATION) {
-    ctx.out("Migrations to the current schema run when the coordinator next starts.");
-  }
-}
-function coordinatorMigrate(ctx, flags) {
-  const dataDir = dataDirOf(flags, ctx.env);
-  const holder = lockHolder(dataDir);
-  if (holder !== null) {
-    throw new CliError(`Coordinator (pid ${holder}) is running on ${dataDir}; it migrated at start`);
-  }
-  const path = dbPath(dataDir);
-  const existed = existsSync6(path);
-  mkdirSync4(dataDir, { recursive: true });
-  const db = openDb(path);
-  try {
-    const before = existed ? migrationLevel(db) : 0;
-    migrate(db);
-    const after = migrationLevel(db);
-    ctx.out(before === after ? `Schema is current (level ${after}) at ${path}` : `Migrated ${path} from level ${before} to ${after}`);
-  } finally {
-    db.close();
-  }
-}
-
-// packages/cli/dist/commands/doctor.js
-import { execFile as execFile3 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
-
 // packages/adapter-sdk/dist/discovery.js
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { isAbsolute, join as join6, resolve as resolve5 } from "node:path";
+import { isAbsolute, join as join6, resolve as resolve4 } from "node:path";
 function piAgentDir(env = process.env, home = homedir2()) {
   const fromEnv = env.PI_CODING_AGENT_DIR?.trim();
   if (fromEnv)
@@ -11061,7 +10953,7 @@ function piPackageDirCandidates(source, agentDir, opts = {}) {
       return [join6(agentDir, "git", parsed.host, parsed.path)];
     case "local": {
       const p = expandHome(parsed.path, home);
-      return [isAbsolute(p) ? p : resolve5(agentDir, p)];
+      return [isAbsolute(p) ? p : resolve4(agentDir, p)];
     }
   }
 }
@@ -11087,7 +10979,7 @@ async function discoverPiPackages(opts = {}) {
   };
   const diag = (level, message) => out.diagnostics.push({ sessionId: null, adapterId: null, level, message });
   const settingsPath = join6(agentDir, "settings.json");
-  if (!existsSync7(settingsPath))
+  if (!existsSync6(settingsPath))
     return out;
   let settings;
   try {
@@ -11109,14 +11001,14 @@ async function discoverPiPackages(opts = {}) {
       home,
       globalNpmRoot: opts.globalNpmRoot
     });
-    const dir = candidates.find((c) => existsSync7(c));
+    const dir = candidates.find((c) => existsSync6(c));
     if (!dir) {
       diag("warning", `Pi package ${source} could not be resolved (looked in ${candidates.join(", ")}); any adapter it provides is not loaded.`);
       continue;
     }
     let pkg = null;
     const pkgPath = join6(dir, "package.json");
-    if (existsSync7(pkgPath)) {
+    if (existsSync6(pkgPath)) {
       try {
         pkg = await readJson(pkgPath);
       } catch (err) {
@@ -11268,7 +11160,7 @@ function genericWidgetPanel(lines) {
 
 // packages/adapter-sdk/dist/manifest.js
 import { readFile as readFile2 } from "node:fs/promises";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, resolve as resolve6 } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, resolve as resolve5 } from "node:path";
 import { validRange } from "semver";
 import { z as z18 } from "zod";
 var MANIFEST_FILE = "switchyard-adapter.json";
@@ -11312,7 +11204,7 @@ function parseManifest(input, path = null) {
   throw new ManifestError(`invalid adapter manifest: ${issues}`, path);
 }
 async function loadManifest(pathOrDir) {
-  const abs = resolve6(pathOrDir);
+  const abs = resolve5(pathOrDir);
   const manifestPath = abs.endsWith(".json") ? abs : join7(abs, MANIFEST_FILE);
   let raw;
   try {
@@ -11332,8 +11224,8 @@ async function loadManifest(pathOrDir) {
     manifest,
     manifestPath,
     dir,
-    serverPath: resolve6(dir, manifest.server),
-    webRendererPath: manifest.webRenderer ? resolve6(dir, manifest.webRenderer) : null
+    serverPath: resolve5(dir, manifest.server),
+    webRendererPath: manifest.webRenderer ? resolve5(dir, manifest.webRenderer) : null
   };
 }
 
@@ -11388,9 +11280,9 @@ function responseFitsRequest(req, resp) {
 }
 
 // packages/adapter-sdk/dist/registry.js
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { readdir, readFile as readFile3 } from "node:fs/promises";
-import { join as join8, resolve as resolve7 } from "node:path";
+import { join as join8, resolve as resolve6 } from "node:path";
 import { pathToFileURL } from "node:url";
 import { satisfies } from "semver";
 
@@ -11474,6 +11366,10 @@ var AdapterSession = class {
     this.activeTools.set(e.toolCallId, e);
     await this.callAll("onToolStart", e);
   }
+  /** `tool_execution_update`: runs `onToolUpdate` hooks with the partial result. */
+  async onToolUpdate(e) {
+    await this.callAll("onToolUpdate", e);
+  }
   /** `tool_execution_end`: runs `onToolEnd` hooks, then expires answers queued for the call. */
   async onToolEnd(e) {
     try {
@@ -11811,7 +11707,7 @@ function isServerAdapter(x) {
 async function loadAdapterFromDir(pathOrDir, tier) {
   const m = await loadManifest(pathOrDir);
   const warnings = [];
-  if (!existsSync8(m.serverPath)) {
+  if (!existsSync7(m.serverPath)) {
     throw new AdapterLoadError(`server module ${m.serverPath} does not exist`, m.manifest);
   }
   let mod;
@@ -11832,7 +11728,7 @@ async function loadAdapterFromDir(pathOrDir, tier) {
     throw new AdapterLoadError(`${m.serverPath} must default-export a ServerAdapter object or factory`, m.manifest);
   }
   let webRendererPath = m.webRendererPath;
-  if (webRendererPath && !existsSync8(webRendererPath)) {
+  if (webRendererPath && !existsSync7(webRendererPath)) {
     warnings.push(`web renderer ${webRendererPath} does not exist; portable panels are used`);
     webRendererPath = null;
   }
@@ -11849,12 +11745,12 @@ async function loadAdapterFromDir(pathOrDir, tier) {
   };
 }
 async function subdirsWithManifest(root) {
-  if (!existsSync8(root))
+  if (!existsSync7(root))
     return [];
-  if (existsSync8(join8(root, MANIFEST_FILE)))
+  if (existsSync7(join8(root, MANIFEST_FILE)))
     return [root];
   const entries = await readdir(root, { withFileTypes: true });
-  return entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => join8(root, e.name)).filter((d) => existsSync8(join8(d, MANIFEST_FILE))).sort();
+  return entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => join8(root, e.name)).filter((d) => existsSync7(join8(d, MANIFEST_FILE))).sort();
 }
 var AdapterRegistry = class {
   opts;
@@ -11872,7 +11768,7 @@ var AdapterRegistry = class {
     this.diags = [];
     const candidates = [];
     if (opts.projectRoot) {
-      for (const d of await this.safeList(resolve7(opts.projectRoot, PROJECT_ADAPTER_DIR))) {
+      for (const d of await this.safeList(resolve6(opts.projectRoot, PROJECT_ADAPTER_DIR))) {
         candidates.push({ tier: "project", path: d });
       }
     }
@@ -11887,7 +11783,7 @@ var AdapterRegistry = class {
         this.diagnostic("warning", null, `Cannot read ${pkgDir}/package.json: ${err.message}`);
       }
       for (const e of entries)
-        candidates.push({ tier: "plugin", path: resolve7(pkgDir, e) });
+        candidates.push({ tier: "plugin", path: resolve6(pkgDir, e) });
     }
     const loaded = [];
     for (const c of candidates) {
@@ -12158,7 +12054,7 @@ async function runChecks(path, commands, opts = {}) {
 
 // packages/host-agent/dist/files.js
 import { lstat, readdir as readdir2, readFile as readFile4, realpath, stat } from "node:fs/promises";
-import { join as join9, relative, resolve as resolve8, sep } from "node:path";
+import { join as join9, relative, resolve as resolve7, sep } from "node:path";
 var MAX_READ_BYTES = 1024 * 1024;
 var BINARY_SNIFF_BYTES = 8e3;
 function isInside(root, target) {
@@ -12182,7 +12078,7 @@ async function resolveInside(root, rel) {
   if (rel.includes("\0"))
     throw new SwitchyardError("invalid_request", "Invalid path");
   const rootReal = await realRoot(root);
-  const target = resolve8(rootReal, rel.replace(/^[/\\]+/, ""));
+  const target = resolve7(rootReal, rel.replace(/^[/\\]+/, ""));
   if (!isInside(rootReal, target)) {
     throw new SwitchyardError("forbidden", "Path is outside the workspace");
   }
@@ -12261,7 +12157,7 @@ async function readWorkspaceFile(root, file) {
 import { execFile } from "node:child_process";
 import { appendFile, lstat as lstat2, mkdir, readFile as readFile5, realpath as realpath2, stat as stat2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join10, resolve as resolve9, sep as sep2 } from "node:path";
+import { join as join10, resolve as resolve8, sep as sep2 } from "node:path";
 var MAX_BUFFER = 64 * 1024 * 1024;
 var EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 var MAX_PATCH_BYTES = 2 * 1024 * 1024;
@@ -12338,7 +12234,7 @@ async function realpathOr(path) {
 }
 async function commonDirOf(path) {
   const { stdout } = await runGit(path, ["rev-parse", "--git-common-dir"]);
-  return realpathOr(resolve9(path, stdout.trim()));
+  return realpathOr(resolve8(path, stdout.trim()));
 }
 function notARepo(path) {
   return new SwitchyardError("not_a_git_repo", `${path} is not a git repository`);
@@ -13112,8 +13008,8 @@ var CommandRouter = class {
 };
 
 // packages/host-agent/dist/config.js
-import { chmodSync as chmodSync3, existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync5, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir4, hostname as hostname2 } from "node:os";
+import { chmodSync as chmodSync3, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir4, hostname } from "node:os";
 import { dirname as dirname5, join as join12 } from "node:path";
 import { z as z21 } from "zod";
 var HostConfigSchema = z21.object({
@@ -13148,11 +13044,11 @@ function statePaths(stateDir) {
     logs: join12(stateDir, "logs")
   };
   for (const d of [p.root, p.runtime, p.logs])
-    mkdirSync5(d, { recursive: true, mode: 448 });
+    mkdirSync4(d, { recursive: true, mode: 448 });
   return p;
 }
 function loadConfig(path) {
-  if (!existsSync9(path)) {
+  if (!existsSync8(path)) {
     throw new SwitchyardError("not_found", `Host config ${path} not found; enroll this host first (switchyard host enroll)`);
   }
   let raw;
@@ -13171,7 +13067,7 @@ function loadConfig(path) {
 }
 function saveConfig(path, config) {
   const cfg = HostConfigSchema.parse(config);
-  mkdirSync5(dirname5(path), { recursive: true, mode: 448 });
+  mkdirSync4(dirname5(path), { recursive: true, mode: 448 });
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync4(tmp, `${JSON.stringify(cfg, null, 2)}
 `, { mode: 384 });
@@ -13249,16 +13145,16 @@ function abortError(signal) {
 async function waitForConfig(opts) {
   const { configPath, env, log, signal } = opts;
   const t = { ...DEFAULT_TIMING, ...opts.timing };
-  if (existsSync9(configPath))
+  if (existsSync8(configPath))
     return loadConfig(configPath);
   const secret = env.SWITCHYARD_HOST_ENROLL_SECRET?.trim();
   const coordinatorUrl = env.SWITCHYARD_COORDINATOR_URL?.trim();
   if (secret && coordinatorUrl) {
-    const name = env.SWITCHYARD_HOST_NAME?.trim() || hostname2();
+    const name = env.SWITCHYARD_HOST_NAME?.trim() || hostname();
     for (; ; ) {
       if (signal?.aborted)
         throw abortError(signal);
-      if (existsSync9(configPath))
+      if (existsSync8(configPath))
         return loadConfig(configPath);
       try {
         const enrolled = await enroll({
@@ -13288,7 +13184,7 @@ async function waitForConfig(opts) {
   for (; ; ) {
     if (signal?.aborted)
       throw abortError(signal);
-    if (existsSync9(configPath)) {
+    if (existsSync8(configPath)) {
       try {
         return loadConfig(configPath);
       } catch (err) {
@@ -13308,7 +13204,7 @@ async function waitForConfig(opts) {
 }
 
 // packages/host-agent/dist/db/index.js
-import { mkdirSync as mkdirSync6 } from "node:fs";
+import { mkdirSync as mkdirSync5 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
@@ -13392,7 +13288,7 @@ var HostDb = class {
   constructor(path) {
     this.path = path;
     if (path !== ":memory:")
-      mkdirSync6(dirname6(path), { recursive: true });
+      mkdirSync5(dirname6(path), { recursive: true });
     this.db = new DatabaseSync3(path);
     this.db.exec("PRAGMA journal_mode = WAL");
     this.db.exec("PRAGMA foreign_keys = ON");
@@ -13468,15 +13364,15 @@ var HostDb = class {
     else
       fn();
   }
-  run(sql3, params = []) {
-    const r = this.db.prepare(sql3).run(...params);
+  run(sql4, params = []) {
+    const r = this.db.prepare(sql4).run(...params);
     return { changes: Number(r.changes), lastInsertRowid: Number(r.lastInsertRowid) };
   }
-  get(sql3, params = []) {
-    return this.db.prepare(sql3).get(...params);
+  get(sql4, params = []) {
+    return this.db.prepare(sql4).get(...params);
   }
-  all(sql3, params = []) {
-    return this.db.prepare(sql3).all(...params);
+  all(sql4, params = []) {
+    return this.db.prepare(sql4).all(...params);
   }
   // ---- meta ----
   getMeta(key) {
@@ -13486,12 +13382,12 @@ var HostDb = class {
     this.run("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value", [key, value]);
   }
   // ---- JSON row helpers ----
-  getJson(sql3, params = []) {
-    const r = this.get(sql3, params);
+  getJson(sql4, params = []) {
+    const r = this.get(sql4, params);
     return r ? JSON.parse(r.json) : void 0;
   }
-  allJson(sql3, params = []) {
-    return this.all(sql3, params).map((r) => JSON.parse(r.json));
+  allJson(sql4, params = []) {
+    return this.all(sql4, params).map((r) => JSON.parse(r.json));
   }
   close() {
     try {
@@ -14150,7 +14046,7 @@ ${stderr}`));
 import { accessSync, constants, readFileSync as readFileSync6, realpathSync } from "node:fs";
 import { open, readdir as readdir4, readFile as readFile6, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { delimiter, dirname as dirname7, join as join13, resolve as resolve10 } from "node:path";
+import { delimiter, dirname as dirname7, join as join13, resolve as resolve9 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 
 // packages/pi-runtime/dist/transcript.js
@@ -14413,7 +14309,7 @@ async function listImportable(sessionsRoot = defaultSessionsRoot(), now = Date.n
 }
 function findOnPath(bin) {
   if (bin.includes("/"))
-    return resolve10(bin);
+    return resolve9(bin);
   for (const dir of (process.env.PATH ?? "").split(delimiter)) {
     if (!dir)
       continue;
@@ -14676,14 +14572,14 @@ function writeJsonl(stream, value) {
 import { spawn as spawn2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { EventEmitter as EventEmitter3 } from "node:events";
-import { chmodSync as chmodSync4, existsSync as existsSync10, mkdirSync as mkdirSync7, rmSync as rmSync2 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync9, mkdirSync as mkdirSync6, rmSync as rmSync2 } from "node:fs";
 import { createServer } from "node:net";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function bridgeExtensionPath() {
   const sibling = fileURLToPath2(new URL("./bridge/switchyard-bridge.js", import.meta.url));
-  if (existsSync10(sibling))
+  if (existsSync9(sibling))
     return sibling;
   return fileURLToPath2(new URL("../dist/bridge/switchyard-bridge.js", import.meta.url));
 }
@@ -14702,7 +14598,7 @@ function shortSocketPath(runtimeDir, prefix) {
   if (join14(dir, name).length > MAX_SOCKET_PATH) {
     dir = join14("/tmp", `switchyard-${process.getuid?.() ?? "u"}`);
   }
-  mkdirSync7(dir, { recursive: true, mode: 448 });
+  mkdirSync6(dir, { recursive: true, mode: 448 });
   return join14(dir, name);
 }
 var PiRpcProcess = class _PiRpcProcess extends EventEmitter3 {
@@ -14941,12 +14837,12 @@ var PiRpcProcess = class _PiRpcProcess extends EventEmitter3 {
 // packages/pi-runtime/dist/session-runtime.js
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { EventEmitter as EventEmitter5 } from "node:events";
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 
 // packages/pi-runtime/dist/terminal-process.js
 import { spawn as spawn3 } from "node:child_process";
 import { EventEmitter as EventEmitter4 } from "node:events";
-import { closeSync, existsSync as existsSync11, mkdirSync as mkdirSync8, openSync, readFileSync as readFileSync7 } from "node:fs";
+import { closeSync, existsSync as existsSync10, mkdirSync as mkdirSync7, openSync, readFileSync as readFileSync7 } from "node:fs";
 import { createRequire } from "node:module";
 import { createConnection } from "node:net";
 import { tmpdir as tmpdir3 } from "node:os";
@@ -14954,7 +14850,7 @@ import { basename as basename2, dirname as dirname8, join as join15 } from "node
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveDist(rel) {
   const sibling = fileURLToPath3(new URL(`./${rel}`, import.meta.url));
-  if (existsSync11(sibling))
+  if (existsSync10(sibling))
     return sibling;
   return fileURLToPath3(new URL(`../dist/${rel}`, import.meta.url));
 }
@@ -14971,7 +14867,7 @@ function terminalSupport() {
     return { ok: false, reason: `node-pty is not available: ${err.message}` };
   }
   const holder = holderScriptPath();
-  if (!existsSync11(holder))
+  if (!existsSync10(holder))
     return { ok: false, reason: `Terminal holder not built: ${holder}` };
   return { ok: true };
 }
@@ -15058,7 +14954,7 @@ var PiTerminalProcess = class _PiTerminalProcess extends EventEmitter4 {
       rows: opts.rows ?? 40
     };
     const logPath = opts.logPath ?? join15(dirname8(socketPath), `${basename2(socketPath, ".sock")}.log`);
-    mkdirSync8(dirname8(logPath), { recursive: true, mode: 448 });
+    mkdirSync7(dirname8(logPath), { recursive: true, mode: 448 });
     const fd = openSync(logPath, "a", 384);
     try {
       const child = spawn3(process.execPath, [holderScriptPath()], {
@@ -15210,6 +15106,7 @@ var PiTerminalProcess = class _PiTerminalProcess extends EventEmitter4 {
           type: rec.event === "ui_prompt_end" ? "ui_prompt_end" : "ui_prompt_start",
           kind: typeof rec.kind === "string" ? rec.kind : "unknown",
           title: typeof rec.title === "string" ? rec.title : null,
+          remoteBacked: rec.remoteBacked === true,
           seq: ++this.seq,
           at: (/* @__PURE__ */ new Date()).toISOString(),
           pid: this.pid ?? 0
@@ -15390,7 +15287,7 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
       await this.attachTerminal(this.opts.terminalSocket);
       return;
     }
-    if (this._native && !existsSync12(this._native.sessionFile)) {
+    if (this._native && !existsSync11(this._native.sessionFile)) {
       const message = `Native session file not found: ${this._native.sessionFile}`;
       this.fail(message);
       throw new SwitchyardError("native_session_missing", message, {
@@ -16180,7 +16077,7 @@ ${output}`.trimEnd() }));
 };
 
 // packages/host-agent/dist/supervisor.js
-import { existsSync as existsSync13, realpathSync as realpathSync2, statSync } from "node:fs";
+import { existsSync as existsSync12, realpathSync as realpathSync2, statSync } from "node:fs";
 import { join as join16, sep as sep3 } from "node:path";
 var RESTART_NOTICE = "Host agent restarted; resume to continue";
 var QUEUED_ANSWER_SUMMARY = "Answered from your earlier form";
@@ -16522,7 +16419,7 @@ var SessionSupervisor = class {
     if (!pi.compatible) {
       throw new SwitchyardError("pi_incompatible", pi.reason ?? "Pi is not available on this host");
     }
-    if (!existsSync13(p.workspacePath) || !statSync(p.workspacePath).isDirectory()) {
+    if (!existsSync12(p.workspacePath) || !statSync(p.workspacePath).isDirectory()) {
       throw new SwitchyardError("not_found", `Workspace ${p.workspacePath} does not exist`);
     }
     const prev = this.records.get(p.sessionId);
@@ -16537,7 +16434,7 @@ var SessionSupervisor = class {
       }
     }
     let nextOrder = prev?.nextOrder ?? 0;
-    if (!prev && nativeHandle && existsSync13(nativeHandle.sessionFile)) {
+    if (!prev && nativeHandle && existsSync12(nativeHandle.sessionFile)) {
       try {
         const native = await readNativeTranscript(nativeHandle.sessionFile, {
           piBin: this.opts.piBin
@@ -16547,6 +16444,8 @@ var SessionSupervisor = class {
         nextOrder = 0;
       }
     }
+    const t0 = Date.now();
+    let adaptersMs = 0;
     const now = nowIso();
     let control = { controlRevision: p.controlRevision, controlMode: p.controlMode };
     for (const c of [prev, this.pendingControl.get(p.sessionId)]) {
@@ -16568,7 +16467,7 @@ var SessionSupervisor = class {
       profile: p.profile,
       nativeHandle,
       runtime: "starting",
-      runtimeDetail: null,
+      runtimeDetail: "Starting Pi\u2026",
       controlRevision: control.controlRevision,
       controlMode: control.controlMode,
       origin: p.origin,
@@ -16588,7 +16487,11 @@ var SessionSupervisor = class {
     const l = this.newLive(rec);
     this.live.set(rec.id, l);
     this.db.tx(() => this.saveAndEmit(rec));
-    await this.openAdapters(l, p.workspacePath);
+    const adaptersStart = Date.now();
+    this.enqueue(l, async () => {
+      await this.openAdapters(l, p.workspacePath);
+      adaptersMs = Date.now() - adaptersStart;
+    });
     const ms = new ManagedSession({
       sessionId: rec.id,
       cwd: p.workspacePath,
@@ -16604,8 +16507,16 @@ var SessionSupervisor = class {
     });
     l.ms = ms;
     this.wire(l, ms);
+    const piStart = Date.now();
     try {
       await ms.start();
+      this.opts.log.info({
+        sessionId: rec.id,
+        piStartMs: Date.now() - piStart,
+        adaptersMs,
+        totalMs: Date.now() - t0,
+        transport: ms.transport
+      }, "session started");
       const socketPath = ms.terminalSocket;
       rec.terminal = socketPath ? { socketPath } : null;
       this.db.tx(() => this.saveAndEmit(rec));
@@ -16755,7 +16666,7 @@ var SessionSupervisor = class {
     };
   }
   async readNative(sessionFile) {
-    if (!existsSync13(sessionFile)) {
+    if (!existsSync12(sessionFile)) {
       throw new SwitchyardError("native_session_missing", `Native session file not found: ${sessionFile}`);
     }
     return readNativeTranscript(sessionFile, { piBin: this.opts.piBin });
@@ -17013,6 +16924,21 @@ var SessionSupervisor = class {
         await this.applyToolCard(l, e);
         return;
       }
+      case "tool_execution_update": {
+        if (ev.parentToolCallId || !adapters)
+          return;
+        const id = String(ev.toolCallId);
+        const pr = ev.partialResult;
+        const details = pr && typeof pr === "object" && "details" in pr ? pr.details : void 0;
+        await adapters.onToolUpdate({
+          toolCallId: id,
+          name: String(ev.toolName),
+          args: ms?.toolItem(id)?.data.args ?? {},
+          partialResult: pr,
+          details
+        });
+        return;
+      }
       case "tool_execution_end": {
         if (ev.parentToolCallId || !adapters)
           return;
@@ -17215,6 +17141,8 @@ var SessionSupervisor = class {
    */
   onTerminalPrompt(l, b) {
     if (b.type === "ui_prompt_start") {
+      if (b.kind === "custom" && b.remoteBacked)
+        return;
       if (b.kind !== "custom" && l.ms?.remoteDialogs)
         return;
       if (l.terminalPrompt)
@@ -17541,9 +17469,10 @@ var WorkspaceService = class {
   }
   async create(checkoutPath, branch, base, setupCommand, worktreeDir) {
     const wt = await createWorktree(checkoutPath, branch, base, worktreeDir);
-    const git = await worktreeStatus(wt.path, wt.baseBranch).catch(() => null);
     const initial = setupCommand ? { state: "running", log: "" } : { state: "none", log: "" };
-    this.emitUpdate(wt.path, { branch: wt.branch, baseBranch: wt.baseBranch, git, setup: initial });
+    this.emitUpdate(wt.path, { branch: wt.branch, baseBranch: wt.baseBranch, setup: initial });
+    void worktreeStatus(wt.path, wt.baseBranch).then((git) => this.emitUpdate(wt.path, { git }), () => {
+    });
     let setupDone = Promise.resolve(initial);
     if (setupCommand) {
       setupDone = runSetup(wt.path, setupCommand, (setup) => this.emitUpdate(wt.path, { setup }), {
@@ -17565,7 +17494,7 @@ var WorkspaceService = class {
       branch: wt.branch,
       baseBranch: wt.baseBranch,
       provenance: "managed",
-      git,
+      git: null,
       setup: initial,
       setupDone
     };
@@ -17711,16 +17640,16 @@ async function runHostAgent(opts = {}) {
     log.warn({ sessions: interruptedOnStart.length, dispatches: failedDispatches }, "recovered after restart");
   }
   router.pruneReceipts();
-  const reattach = await supervisor.reattachTerminals();
-  interruptedOnStart.push(...reattach.lost);
-  if (reattach.reattached.length > 0 || reattach.lost.length > 0) {
-    log.info({ reattached: reattach.reattached.length, lost: reattach.lost.length }, "terminal sessions after restart");
-  }
   try {
     await catalog.init();
   } catch (err) {
     log.warn({ err: err.message }, "adapter discovery failed; Pi package adapters are not loaded");
   }
+  const reattach = await supervisor.reattachTerminals();
+  interruptedOnStart.push(...reattach.lost);
+  if (reattach.reattached.length > 0 || reattach.lost.length > 0) {
+    log.info({ reattached: reattach.reattached.length, lost: reattach.lost.length }, "terminal sessions after restart");
+  }
   supervisor.emitAdapters();
   link.start();
   let stopping = null;
@@ -17762,15 +17691,445 @@ async function runHostAgent(opts = {}) {
   return handle;
 }
 
-// packages/cli/dist/commands/doctor.js
-function defaultDoctorDeps(ctx) {
-  const dataDir = ctx.paths?.dataDir ?? defaultDataDir(ctx.env);
-  return {
-    nodeVersion: process.versions.node,
-    detectPi: () => detectPi(ctx.env.SWITCHYARD_PI_BIN ?? "pi"),
-    gitVersion: () => new Promise((resolve13) => execFile3("git", ["--version"], (err, stdout) => resolve13(err ? null : stdout.trim()))),
+// packages/cli/dist/commands/coordinator.js
+import { existsSync as existsSync13, mkdirSync as mkdirSync8 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
+function parseListen(v) {
+  const s = v.trim();
+  let host = "0.0.0.0";
+  let portStr = s;
+  const v6 = s.match(/^\[([^\]]+)\]:(\d+)$/);
+  if (v6) {
+    host = v6[1];
+    portStr = v6[2];
+  } else if (s.includes(":")) {
+    const i = s.lastIndexOf(":");
+    host = s.slice(0, i) || "0.0.0.0";
+    portStr = s.slice(i + 1);
+  } else if (!/^\d+$/.test(s)) {
+    host = s;
+    portStr = String(DEFAULT_PORT);
+  }
+  const port = Number(portStr);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new CliError(`Invalid listen address "${v}" (expected host:port)`);
+  }
+  return { host, port };
+}
+function parseOrigins(v) {
+  if (!v?.trim())
+    return void 0;
+  return v.split(",").map((o) => o.trim().replace(/\/+$/, "")).filter(Boolean);
+}
+var DEFAULT_OIDC_LABEL = "Sign in with single sign-on";
+var DEFAULT_OIDC_SCOPES = "openid profile email groups";
+function envValue(env, key) {
+  const v = env[key]?.trim();
+  return v ? v : void 0;
+}
+function authOptionsFromEnv(env) {
+  const out = {};
+  const secret = envValue(env, "SWITCHYARD_HOST_ENROLL_SECRET");
+  if (secret)
+    out.hostEnrollSecret = secret;
+  const proxies = parseOrigins(env.SWITCHYARD_TRUSTED_PROXIES);
+  if (proxies)
+    out.trustedProxies = proxies;
+  const issuer = envValue(env, "SWITCHYARD_OIDC_ISSUER");
+  const clientId = envValue(env, "SWITCHYARD_OIDC_CLIENT_ID");
+  if (issuer && clientId) {
+    if (!/^https?:\/\//.test(issuer)) {
+      throw new CliError(`SWITCHYARD_OIDC_ISSUER must be an http(s) URL, got "${issuer}"`);
+    }
+    out.oidc = {
+      issuer,
+      clientId,
+      clientSecret: envValue(env, "SWITCHYARD_OIDC_CLIENT_SECRET") ?? null,
+      label: envValue(env, "SWITCHYARD_OIDC_LABEL") ?? DEFAULT_OIDC_LABEL,
+      scopes: envValue(env, "SWITCHYARD_OIDC_SCOPES") ?? DEFAULT_OIDC_SCOPES,
+      owner: {
+        subject: envValue(env, "SWITCHYARD_OIDC_OWNER_SUBJECT") ?? null,
+        email: envValue(env, "SWITCHYARD_OIDC_OWNER_EMAIL") ?? null,
+        group: envValue(env, "SWITCHYARD_OIDC_OWNER_GROUP") ?? null
+      }
+    };
+  } else if (issuer || clientId) {
+    throw new CliError("Single sign-on needs both SWITCHYARD_OIDC_ISSUER and SWITCHYARD_OIDC_CLIENT_ID");
+  }
+  return out;
+}
+function coordinatorOptions(flags, env) {
+  const dataDir = flags.dataDir ? resolve10(flags.dataDir) : defaultDataDir(env);
+  const listen = parseListen(flags.listen ?? env.SWITCHYARD_LISTEN ?? `0.0.0.0:${DEFAULT_PORT}`);
+  const publicUrl = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim() || void 0;
+  if (publicUrl && !/^https?:\/\//.test(publicUrl)) {
+    throw new CliError(`Public URL must start with http:// or https://, got "${publicUrl}"`);
+  }
+  const trustedOrigins = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
+  return {
+    dataDir,
+    listen,
+    publicUrl,
+    trustedOrigins,
+    webDist: resolveWebDist(flags.webDist, env),
+    ...authOptionsFromEnv(env)
+  };
+}
+function waitForSignal() {
+  return new Promise((res) => {
+    const on = (sig) => {
+      process.off("SIGINT", on);
+      process.off("SIGTERM", on);
+      res(sig);
+    };
+    process.on("SIGINT", on);
+    process.on("SIGTERM", on);
+  });
+}
+async function coordinatorStart(ctx, flags) {
+  const opts = coordinatorOptions(flags, ctx.env);
+  const c = createCoordinator(opts);
+  await c.start();
+  writeEndpoint(opts.dataDir, {
+    localUrl: localUrlFor(opts.listen, c.port),
+    publicUrl: c.config.publicUrl
+  });
+  ctx.err(`Switchyard coordinator listening on ${opts.listen.host}:${c.port} (public URL ${c.config.publicUrl}; data ${opts.dataDir}${opts.webDist ? "" : "; web app not found, API only"})`);
+  const sig = await waitForSignal();
+  ctx.err(`${sig}: stopping coordinator`);
+  await c.stop();
+}
+function localUrlFor(listen, port) {
+  const h = listen.host ?? "0.0.0.0";
+  const host = h === "0.0.0.0" || h === "::" || h === "" ? "127.0.0.1" : h.includes(":") ? `[${h}]` : h;
+  return `http://${host}:${port}`;
+}
+function dataDirOf(flags, env) {
+  return flags.dataDir ? resolve10(flags.dataDir) : defaultDataDir(env);
+}
+function coordinatorBackup(ctx, out, flags) {
+  const r = backup(dataDirOf(flags, ctx.env), out);
+  ctx.out(`Backed up to ${r.file} (schema ${r.migrationLevel})`);
+}
+function coordinatorRestore(ctx, file, flags) {
+  const r = restore(dataDirOf(flags, ctx.env), file);
+  ctx.out(`Restored ${r.restoredFrom} (schema ${r.migrationLevel}).`);
+  if (r.previous)
+    ctx.out(`The previous database was kept as ${r.previous}`);
+  if (r.migrationLevel < LATEST_MIGRATION) {
+    ctx.out("Migrations to the current schema run when the coordinator next starts.");
+  }
+}
+function coordinatorMigrate(ctx, flags) {
+  const dataDir = dataDirOf(flags, ctx.env);
+  const holder = lockHolder(dataDir);
+  if (holder !== null) {
+    throw new CliError(`Coordinator (pid ${holder}) is running on ${dataDir}; it migrated at start`);
+  }
+  const path = dbPath(dataDir);
+  const existed = existsSync13(path);
+  mkdirSync8(dataDir, { recursive: true });
+  const db = openDb(path);
+  try {
+    const before = existed ? migrationLevel(db) : 0;
+    migrate(db);
+    const after = migrationLevel(db);
+    ctx.out(before === after ? `Schema is current (level ${after}) at ${path}` : `Migrated ${path} from level ${before} to ${after}`);
+  } finally {
+    db.close();
+  }
+}
+
+// packages/cli/dist/commands/up.js
+var DEV_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
+function upOptions(flags, env) {
+  const port = flags.port === void 0 ? DEFAULT_PORT : Number(flags.port);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new CliError(`Invalid port "${flags.port}"`);
+  }
+  const listenHost = flags.host ?? "0.0.0.0";
+  const dataDir = flags.dataDir ?? defaultDataDir(env);
+  const explicitPublic = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim();
+  const publicUrl = explicitPublic || port !== 0 ? (explicitPublic || `http://localhost:${port}`).replace(/\/+$/, "") : void 0;
+  let trusted = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
+  if (!trusted && publicUrl) {
+    trusted = [new URL(publicUrl).origin];
+    if (!explicitPublic)
+      trusted.push(`http://127.0.0.1:${port}`);
+  }
+  if (flags.dev && trusted)
+    trusted = [.../* @__PURE__ */ new Set([...trusted, ...DEV_ORIGINS])];
+  return {
+    dataDir,
+    listen: { host: listenHost, port },
+    publicUrl,
+    trustedOrigins: trusted,
+    webDist: resolveWebDist(flags.webDist, env),
+    // Same server env as `coordinator start`: shared host secret, trusted proxies and OIDC.
+    ...authOptionsFromEnv(env)
+  };
+}
+async function ensureLocalHost(coordinator, localUrl, configPath, name, fetchImpl) {
+  if (existsSync14(configPath)) {
+    const cfg2 = loadConfig(configPath);
+    const known = coordinator.store.hosts.get(cfg2.hostId);
+    if (known && !known.revokedAt) {
+      return { config: { ...cfg2, coordinatorUrl: localUrl }, enrolled: false };
+    }
+  }
+  const api = new ApiClient({
+    coordinatorUrl: localUrl,
+    credential: coordinator.adminToken,
+    fetch: fetchImpl
+  });
+  const e = await api.post("/api/hosts/enrollments", {});
+  const cfg = await enroll({
+    coordinatorUrl: localUrl,
+    token: e.token,
+    name,
+    configPath,
+    fetch: fetchImpl
+  });
+  const { configPath: _p, ...config } = cfg;
+  return { config, enrolled: true };
+}
+function openBrowser(url, platform = process.platform, spawnFn = spawn4) {
+  const cmd = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
+  if (!cmd)
+    return;
+  try {
+    const child = spawnFn(cmd, [url], { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function firstSignInLink(ctx, coordinator, open2, opener) {
+  if (coordinator.config.oidc || coordinator.auth.activeDeviceCount() > 0)
+    return null;
+  const e = coordinator.auth.createEnrollment("device", ADMIN_DEVICE_ID);
+  await printSignInLink(ctx, e.url, e.expiresAt);
+  if (open2)
+    opener(e.url);
+  return e.url;
+}
+async function startStandalone(ctx, flags, deps = {}) {
+  if (flags.dev && !ctx.env.SWITCHYARD_LOG_LEVEL)
+    process.env.SWITCHYARD_LOG_LEVEL = "debug";
+  const opts = upOptions(flags, ctx.env);
+  const coordinator = createCoordinator({ ...opts, setupHint: false });
+  await coordinator.start();
+  let firstLink;
+  try {
+    firstLink = await firstSignInLink(ctx, coordinator, flags.open ?? process.stdout.isTTY === true, deps.open ?? ((url) => openBrowser(url)));
+  } catch (err) {
+    await coordinator.stop();
+    throw err;
+  }
+  const localUrl = localUrlFor(opts.listen, coordinator.port);
+  writeEndpoint(opts.dataDir, { localUrl, publicUrl: coordinator.config.publicUrl });
+  let host;
+  try {
+    const paths = standaloneHostPaths(opts.dataDir);
+    const { config, enrolled } = await ensureLocalHost(coordinator, localUrl, paths.configPath, flags.name ?? hostname2().replace(/\.local$/, ""));
+    if (enrolled)
+      ctx.err(`Enrolled the local host "${config.name}" (${config.hostId})`);
+    host = await runHostAgent({ config, stateDir: paths.stateDir, handleSignals: false });
+  } catch (err) {
+    await coordinator.stop();
+    throw err;
+  }
+  return {
+    coordinator,
+    host,
+    localUrl,
+    firstLink,
+    async stop() {
+      await host.stop();
+      await coordinator.stop();
+    }
+  };
+}
+async function up(ctx, flags) {
+  const s = await startStandalone(ctx, flags);
+  const c = s.coordinator;
+  ctx.err([
+    `Switchyard is up: ${c.config.publicUrl} (listening on port ${c.port})`,
+    `Data: ${c.config.dataDir}`,
+    c.config.webDist ? null : "Web app bundle not found: API only (run `pnpm build`)",
+    c.config.oidc ? `Sign in with single sign-on at ${c.config.publicUrl}    Terminal: switchyard login --coordinator ${c.config.publicUrl}` : `Another browser: switchyard pair    Terminal: switchyard login --coordinator ${c.config.publicUrl}`,
+    "Schedules run only while this process is running."
+  ].filter(Boolean).join("\n"));
+  const sig = await waitForSignal();
+  ctx.err(`${sig}: stopping (Pi sessions on this host are stopped and can be resumed later)`);
+  await s.stop();
+}
+
+// packages/cli/dist/commands/auth.js
+function adminApi(ctx, flags) {
+  const dataDir = flags.dataDir ?? ctx.paths?.dataDir ?? defaultDataDir(ctx.env);
+  const token = readAdminToken(dataDir, ctx.env);
+  if (!token) {
+    throw new CliError(`No admin token: run this on the coordinator machine (looked in ${dataDir}/admin.token) or set SWITCHYARD_ADMIN_TOKEN`);
+  }
+  const url = trimUrl(flags.coordinator ?? readEndpoint(dataDir)?.localUrl ?? DEFAULT_LOCAL_URL);
+  return new ApiClient({ coordinatorUrl: url, credential: token, fetch: ctx.fetch });
+}
+function clockTime(iso) {
+  const d = new Date(iso);
+  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+async function printDeviceLink(ctx, url) {
+  const qr = await QRCode2.toString(url, { type: "terminal", small: true });
+  ctx.out("");
+  ctx.out(`  ${url}`);
+  ctx.out("");
+  ctx.out(qr.trimEnd());
+  ctx.out("");
+}
+async function printSignInLink(ctx, url, expiresAt) {
+  ctx.out(`Open this single-use sign-in link in your browser (expires ${clockTime(expiresAt)}):`);
+  await printDeviceLink(ctx, url);
+  ctx.out("Then add a passkey in Settings \u203A Sign-in as a backup, or run `switchyard pair` for another browser.");
+}
+async function pair(ctx, flags) {
+  const api = adminApi(ctx, flags);
+  const kind = flags.host ? "host" : "device";
+  const e = await api.post("/api/enrollments", { kind });
+  if (flags.json) {
+    ctx.out(JSON.stringify(e, null, 2));
+    return e;
+  }
+  const qr = await QRCode2.toString(e.url, { type: "terminal", small: true });
+  if (kind === "host") {
+    ctx.out(`Host enrollment (single use, expires ${e.expiresAt}). On the host, run:`);
+    ctx.out("");
+    ctx.out(`  ${e.command ?? `switchyard host enroll --coordinator <url> --token ${e.token}`}`);
+    ctx.out("");
+    ctx.out(`Token: ${e.token}`);
+  } else {
+    ctx.out(`Open this link in a browser to sign it in (single use, expires ${e.expiresAt}):`);
+    ctx.out("");
+    ctx.out(`  ${e.url}`);
+    ctx.out("");
+    ctx.out(qr.trimEnd());
+    ctx.out("");
+    ctx.out(`Terminal: switchyard login --coordinator ${originOf2(e.url)} --token ${e.token}`);
+  }
+  ctx.out("The link does not provide network access: the device must already reach this URL.");
+  return e;
+}
+function originOf2(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return url;
+  }
+}
+function parseEnrollmentInput(token, coordinator) {
+  const t = token.trim();
+  if (/^https?:\/\//.test(t)) {
+    const u = new URL(t);
+    const params = new URLSearchParams(u.hash.replace(/^#/, ""));
+    const fromUrl = params.get("token") ?? u.searchParams.get("token");
+    if (!fromUrl)
+      throw new CliError("That URL has no enrollment token");
+    return { url: trimUrl(coordinator ?? u.origin), token: fromUrl };
+  }
+  if (!coordinator)
+    throw new CliError("--coordinator <url> is required");
+  return { url: trimUrl(coordinator), token: t };
+}
+async function loginWithToken(ctx, flags) {
+  const { url, token } = parseEnrollmentInput(flags.token, flags.coordinator);
+  const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
+  const name = flags.name ?? `${hostname3().replace(/\.local$/, "")} terminal`;
+  const res = await api.post("/api/enroll", {
+    token,
+    name,
+    kind: "terminal"
+  });
+  if (!res.credential)
+    throw new CliError("The coordinator returned no credential");
+  const path = ctx.paths?.clientConfig ?? clientConfigPath(ctx.env);
+  writeClientConfig(path, {
+    coordinatorUrl: url,
+    credential: res.credential,
+    deviceId: res.deviceId
+  });
+  ctx.out(`Enrolled "${name}" (${res.deviceId}) with ${url}.`);
+  ctx.out(`Credential saved to ${path} (mode 0600). Open a session's Pi terminal with \`switchyard tui <session>\`.`);
+  return { path, deviceId: res.deviceId };
+}
+var EXPIRED2 = "The sign-in expired before it was approved. Run `switchyard login` again.";
+async function login(ctx, flags, deps = {}) {
+  if (flags.token)
+    return loginWithToken(ctx, { ...flags, token: flags.token });
+  const path = ctx.paths?.clientConfig ?? clientConfigPath(ctx.env);
+  const raw = flags.coordinator ?? ctx.env.SWITCHYARD_URL ?? readClientConfig(path)?.coordinatorUrl;
+  if (!raw)
+    throw new CliError("--coordinator <url> is required");
+  const url = trimUrl(raw);
+  const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
+  const name = flags.name ?? `${hostname3().replace(/\.local$/, "")} terminal`;
+  const started = await api.post("/api/auth/terminal/start", { name });
+  ctx.out("To sign in this terminal, open this link in a browser where you use Switchyard:");
+  ctx.out("");
+  ctx.out(`  ${started.verifyUrl}`);
+  ctx.out("");
+  ctx.out(`Check that it shows the code ${started.userCode}. Waiting for approval (expires ${clockTime(started.expiresAt)})\u2026`);
+  const interactive = process.stdout.isTTY === true && !ctx.env.SSH_CONNECTION && !ctx.env.SSH_TTY;
+  if (flags.open ?? interactive)
+    (deps.open ?? ((u) => openBrowser(u)))(started.verifyUrl);
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  const deadline = Date.parse(started.expiresAt);
+  for (; ; ) {
+    await sleep3(started.intervalMs);
+    let r;
+    try {
+      r = await api.post("/api/auth/terminal/claim", {
+        userCode: started.userCode,
+        pollToken: started.pollToken
+      });
+    } catch (err) {
+      if (err instanceof ApiRequestError) {
+        if (err.status === 401)
+          throw new CliError(EXPIRED2);
+        if (err.status === 0 && now() < deadline)
+          continue;
+      }
+      throw err;
+    }
+    if (r.status === "denied")
+      throw new CliError("The sign-in was denied in the browser.");
+    if (r.status === "done") {
+      writeClientConfig(path, {
+        coordinatorUrl: url,
+        credential: r.credential,
+        deviceId: r.deviceId
+      });
+      ctx.out(`Signed in "${name}" (${r.deviceId}) to ${url}.`);
+      ctx.out(`Credential saved to ${path} (mode 0600). Open a session's Pi terminal with \`switchyard tui <session>\`.`);
+      return { path, deviceId: r.deviceId };
+    }
+    if (now() >= deadline)
+      throw new CliError(EXPIRED2);
+  }
+}
+
+// packages/cli/dist/commands/doctor.js
+import { execFile as execFile3 } from "node:child_process";
+import { existsSync as existsSync15, readFileSync as readFileSync9 } from "node:fs";
+function defaultDoctorDeps(ctx) {
+  const dataDir = ctx.paths?.dataDir ?? defaultDataDir(ctx.env);
+  return {
+    nodeVersion: process.versions.node,
+    detectPi: () => detectPi(ctx.env.SWITCHYARD_PI_BIN ?? "pi"),
+    gitVersion: () => new Promise((resolve13) => execFile3("git", ["--version"], (err, stdout) => resolve13(err ? null : stdout.trim()))),
     hostConfigPaths: [defaultConfigPath(ctx.env), standaloneHostPaths(dataDir).configPath],
-    readFile: (p) => existsSync14(p) ? readFileSync9(p, "utf8") : null
+    readFile: (p) => existsSync15(p) ? readFileSync9(p, "utf8") : null
   };
 }
 function findHostConfig(deps) {
@@ -17900,13 +18259,13 @@ async function checkSignIn(ctx, url, add) {
   try {
     const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
     const s = await api.get("/api/setup");
-    if (!s.initialized) {
-      add("FAIL", "Sign-in", "not set up: run `switchyard init` on the server");
-      return;
-    }
     const passkey = !s.passkey.available ? `unavailable, ${s.passkey.reason ?? "unsupported"}` : s.passkey.registered ? "registered" : "none registered yet";
     const sso = s.oidc ? `on (${s.oidc.label})` : "off";
-    add("PASS", "Sign-in", `set up (passkey: ${passkey}, single sign-on: ${sso})`);
+    if (!s.oidc && !s.passkey.registered) {
+      add("WARN", "Sign-in", "no single sign-on and no passkey: sign in with a link from `switchyard pair` on the server");
+      return;
+    }
+    add("PASS", "Sign-in", `passkey: ${passkey}, single sign-on: ${sso}`);
   } catch (err) {
     add("WARN", "Sign-in", `could not read the setup state: ${err.message}`);
   }
@@ -17922,8 +18281,8 @@ function printDoctor(ctx, results) {
 }
 
 // packages/cli/dist/commands/herdr.js
-import { spawn as spawn4 } from "node:child_process";
-import { closeSync as closeSync2, existsSync as existsSync18, openSync as openSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { spawn as spawn5 } from "node:child_process";
+import { closeSync as closeSync2, existsSync as existsSync19, openSync as openSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join21 } from "node:path";
 
 // packages/cli/dist/context.js
@@ -17934,7 +18293,7 @@ function defaultCtx() {
     err: (l) => process.stderr.write(`${l}
 `),
     env: process.env,
-    fetch: (input, init2) => fetch(input, init2)
+    fetch: (input, init) => fetch(input, init)
   };
 }
 function connect(ctx, flags) {
@@ -17975,7 +18334,7 @@ function ago(iso, now = Date.now()) {
 }
 
 // packages/cli/dist/herdr/client.js
-import { existsSync as existsSync15, readdirSync } from "node:fs";
+import { existsSync as existsSync16, readdirSync } from "node:fs";
 import { createConnection as createConnection3 } from "node:net";
 import { homedir as homedir6 } from "node:os";
 import { join as join17 } from "node:path";
@@ -18000,11 +18359,11 @@ function herdrSocketPath(env = process.env, home = homedir6()) {
   if (env.HERDR_SESSION)
     return join17(base, "sessions", env.HERDR_SESSION, "herdr.sock");
   const dflt = join17(base, "herdr.sock");
-  if (existsSync15(dflt))
+  if (existsSync16(dflt))
     return dflt;
   let live = [];
   try {
-    live = readdirSync(join17(base, "sessions")).map((s) => join17(base, "sessions", s, "herdr.sock")).filter((p) => existsSync15(p));
+    live = readdirSync(join17(base, "sessions")).map((s) => join17(base, "sessions", s, "herdr.sock")).filter((p) => existsSync16(p));
   } catch {
     live = [];
   }
@@ -18117,7 +18476,7 @@ function nextSeq() {
 }
 
 // packages/cli/dist/herdr/daemon.js
-import { existsSync as existsSync17, mkdirSync as mkdirSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join19 } from "node:path";
 
 // packages/cli/dist/herdr/mirror.js
@@ -18404,7 +18763,7 @@ function planMirror(st, h, mem, now) {
 }
 
 // packages/cli/dist/herdr/util.js
-import { chmodSync as chmodSync5, existsSync as existsSync16, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { chmodSync as chmodSync5, existsSync as existsSync17, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
 import { join as join18 } from "node:path";
 function herdrStateDir(env = process.env, home = homedir7()) {
@@ -18434,7 +18793,7 @@ exec sh '${pluginRoot}/switchyard-herdr.sh' "$@"
   return path;
 }
 function launcherExists(env = process.env) {
-  return existsSync16(stableLauncherPath(env));
+  return existsSync17(stableLauncherPath(env));
 }
 async function isAtShell(call, paneId) {
   const info = (await call("pane.process_info", { pane_id: paneId }))?.process_info ?? {};
@@ -18633,7 +18992,7 @@ var MirrorDaemon = class {
     const titleOf = (sid) => st.sessions.find((s) => s.id === sid)?.title ?? sid;
     const launcher = this.deps.launcherPath;
     const paneCmd = (sid) => launcherCommand(launcher, ["pane", sid]);
-    const exists2 = this.deps.exists ?? existsSync17;
+    const exists2 = this.deps.exists ?? existsSync18;
     const createdNow = {};
     const fallbackCwd = () => {
       const dir = join19(this.deps.stateDir, "spaces");
@@ -19739,13 +20098,13 @@ async function herdrDaemon(ctx, flags) {
     }
     return;
   }
-  const running = existsSync18(pidFile) ? Number(readFileSync12(pidFile, "utf8").trim()) : 0;
+  const running = existsSync19(pidFile) ? Number(readFileSync12(pidFile, "utf8").trim()) : 0;
   if (flags.ensure) {
     if (running && pidAlive2(running))
       return;
     const fd = openSync2(logFile, "a", 384);
     try {
-      const child = spawn4(process.execPath, [process.argv[1], "herdr", "daemon"], {
+      const child = spawn5(process.execPath, [process.argv[1], "herdr", "daemon"], {
         detached: true,
         stdio: ["ignore", fd, fd],
         env: { ...process.env, SWITCHYARD_HERDR_LAUNCHER: launcherPath }
@@ -19807,14 +20166,14 @@ async function herdrStatus(ctx, flags) {
 }
 
 // packages/cli/dist/commands/host.js
-import { existsSync as existsSync20, mkdirSync as mkdirSync12 } from "node:fs";
-import { hostname as hostname3 } from "node:os";
+import { existsSync as existsSync21, mkdirSync as mkdirSync12 } from "node:fs";
+import { hostname as hostname4 } from "node:os";
 import { dirname as dirname10, join as join23, resolve as resolve12 } from "node:path";
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 
 // packages/cli/dist/commands/service.js
 import { execFile as execFile4 } from "node:child_process";
-import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
 import { dirname as dirname9, join as join22, resolve as resolve11 } from "node:path";
 var LAUNCHD_LABEL = "com.switchyard.host";
@@ -19906,7 +20265,7 @@ function systemdEscape(s, exec = true) {
 }
 function loadTemplate(kind, dir = deployDir()) {
   const p = join22(dir, TEMPLATE_FILES[kind]);
-  return existsSync19(p) ? readFileSync13(p, "utf8") : TEMPLATES[kind];
+  return existsSync20(p) ? readFileSync13(p, "utf8") : TEMPLATES[kind];
 }
 function renderService(kind, vars, template = TEMPLATES[kind]) {
   for (const [k, v] of Object.entries(vars)) {
@@ -19950,7 +20309,7 @@ function loadCommands(kind, file, uid, instance) {
     ["systemctl", "--user", "restart", unit]
   ];
 }
-function stableNodePath(execPath, exists2 = existsSync19) {
+function stableNodePath(execPath, exists2 = existsSync20) {
   const m = execPath.match(/^(.*)\/Cellar\/node(?:@[^/]+)?\/[^/]+\/bin\/node$/);
   if (m) {
     const candidate = `${m[1]}/bin/node`;
@@ -19974,7 +20333,7 @@ async function installService(ctx, flags, deps = defaultInstallDeps()) {
     throw new CliError("--instance needs --config and --state-dir, so the second host agent keeps its own enrollment and state");
   }
   const config = flags.config ?? defaultConfigPath(ctx.env, deps.home);
-  if (!existsSync19(config) && !flags.print) {
+  if (!existsSync20(config) && !flags.print) {
     throw new CliError(`No host config at ${config}. Enroll first: switchyard host enroll --coordinator <url> --token <t>`);
   }
   const stateDir = flags.stateDir ? resolve11(flags.stateDir) : defaultStateDir(ctx.env, deps.platform, deps.home);
@@ -20024,7 +20383,7 @@ async function hostEnroll(ctx, flags) {
   if (!flags.token === !flags.secret) {
     throw new CliError("Pass exactly one of --token or --secret");
   }
-  const name = flags.name ?? hostname3().replace(/\.local$/, "");
+  const name = flags.name ?? hostname4().replace(/\.local$/, "");
   const cfg = await enroll({
     coordinatorUrl: flags.coordinator,
     ...flags.token ? { token: flags.token } : { secret: flags.secret },
@@ -20038,7 +20397,7 @@ async function hostEnroll(ctx, flags) {
 }
 async function hostRun(ctx, flags) {
   const configPath = flags.config ?? defaultConfigPath(ctx.env);
-  if (!existsSync20(configPath)) {
+  if (!existsSync21(configPath)) {
     ctx.err(`No host config at ${configPath} yet: waiting for it (with SWITCHYARD_HOST_ENROLL_SECRET and SWITCHYARD_COORDINATOR_URL set, the host enrolls itself).`);
   }
   const agent = await runHostAgent({
@@ -20054,10 +20413,10 @@ async function hostRun(ctx, flags) {
 function hostBackup(ctx, out, flags) {
   const stateDir = flags.stateDir ?? defaultStateDir(ctx.env);
   const src = join23(stateDir, "host.db");
-  if (!existsSync20(src))
+  if (!existsSync21(src))
     throw new CliError(`No host database at ${src}`);
   const dest = resolve12(out);
-  if (existsSync20(dest))
+  if (existsSync21(dest))
     throw new CliError(`${dest} already exists`);
   mkdirSync12(dirname10(dest), { recursive: true });
   const db = new DatabaseSync4(src);
@@ -20074,7 +20433,7 @@ async function hostStatus(ctx, flags) {
   const configPath = flags.config ?? defaultConfigPath(ctx.env);
   const stateDir = flags.stateDir ?? defaultStateDir(ctx.env);
   const status = { configPath, stateDir };
-  if (!existsSync20(configPath)) {
+  if (!existsSync21(configPath)) {
     status.enrolled = false;
   } else {
     const cfg = loadConfig(configPath);
@@ -20107,7 +20466,7 @@ async function hostStatus(ctx, flags) {
   try {
     const kind = serviceKindFor(process.platform);
     const file = serviceFilePath(kind);
-    status.service = { kind, file, installed: existsSync20(file) };
+    status.service = { kind, file, installed: existsSync21(file) };
   } catch {
     status.service = null;
   }
@@ -20259,136 +20618,6 @@ async function tuiCommand(ctx, sessionId, flags, run = runRawTerminal) {
   throw new CliError(result.message);
 }
 
-// packages/cli/dist/commands/up.js
-import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
-import { hostname as hostname4 } from "node:os";
-var DEV_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
-function upOptions(flags, env) {
-  const port = flags.port === void 0 ? DEFAULT_PORT : Number(flags.port);
-  if (!Number.isInteger(port) || port < 0 || port > 65535) {
-    throw new CliError(`Invalid port "${flags.port}"`);
-  }
-  const listenHost = flags.host ?? "0.0.0.0";
-  const dataDir = flags.dataDir ?? defaultDataDir(env);
-  const explicitPublic = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim();
-  const publicUrl = explicitPublic || port !== 0 ? (explicitPublic || `http://localhost:${port}`).replace(/\/+$/, "") : void 0;
-  let trusted = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
-  if (!trusted && publicUrl) {
-    trusted = [new URL(publicUrl).origin];
-    if (!explicitPublic)
-      trusted.push(`http://127.0.0.1:${port}`);
-  }
-  if (flags.dev && trusted)
-    trusted = [.../* @__PURE__ */ new Set([...trusted, ...DEV_ORIGINS])];
-  return {
-    dataDir,
-    listen: { host: listenHost, port },
-    publicUrl,
-    trustedOrigins: trusted,
-    webDist: resolveWebDist(flags.webDist, env),
-    // Same server env as `coordinator start`: shared host secret, trusted proxies and OIDC.
-    ...authOptionsFromEnv(env)
-  };
-}
-async function ensureLocalHost(coordinator, localUrl, configPath, name, fetchImpl) {
-  if (existsSync21(configPath)) {
-    const cfg2 = loadConfig(configPath);
-    const known = coordinator.store.hosts.get(cfg2.hostId);
-    if (known && !known.revokedAt) {
-      return { config: { ...cfg2, coordinatorUrl: localUrl }, enrolled: false };
-    }
-  }
-  const api = new ApiClient({
-    coordinatorUrl: localUrl,
-    credential: coordinator.adminToken,
-    fetch: fetchImpl
-  });
-  const e = await api.post("/api/hosts/enrollments", {});
-  const cfg = await enroll({
-    coordinatorUrl: localUrl,
-    token: e.token,
-    name,
-    configPath,
-    fetch: fetchImpl
-  });
-  const { configPath: _p, ...config } = cfg;
-  return { config, enrolled: true };
-}
-function openBrowser(url, platform = process.platform, spawnFn = spawn5) {
-  const cmd = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
-  if (!cmd)
-    return;
-  try {
-    const child = spawnFn(cmd, [url], { detached: true, stdio: "ignore" });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-async function initializeLocally(ctx, coordinator, open2, opener) {
-  if (coordinator.owner.isInitialized())
-    return null;
-  coordinator.owner.markInitialized();
-  const e = coordinator.auth.createEnrollment("device", ADMIN_DEVICE_ID);
-  await printInit(ctx, { alreadyInitialized: false, enrollment: e });
-  if (open2)
-    opener(e.url);
-  return e.url;
-}
-async function startStandalone(ctx, flags, deps = {}) {
-  if (flags.dev && !ctx.env.SWITCHYARD_LOG_LEVEL)
-    process.env.SWITCHYARD_LOG_LEVEL = "debug";
-  const opts = upOptions(flags, ctx.env);
-  const coordinator = createCoordinator({ ...opts, setupHint: false });
-  await coordinator.start();
-  let firstLink;
-  try {
-    firstLink = await initializeLocally(ctx, coordinator, flags.open ?? process.stdout.isTTY === true, deps.open ?? ((url) => openBrowser(url)));
-  } catch (err) {
-    await coordinator.stop();
-    throw err;
-  }
-  const localUrl = localUrlFor(opts.listen, coordinator.port);
-  writeEndpoint(opts.dataDir, { localUrl, publicUrl: coordinator.config.publicUrl });
-  let host;
-  try {
-    const paths = standaloneHostPaths(opts.dataDir);
-    const { config, enrolled } = await ensureLocalHost(coordinator, localUrl, paths.configPath, flags.name ?? hostname4().replace(/\.local$/, ""));
-    if (enrolled)
-      ctx.err(`Enrolled the local host "${config.name}" (${config.hostId})`);
-    host = await runHostAgent({ config, stateDir: paths.stateDir, handleSignals: false });
-  } catch (err) {
-    await coordinator.stop();
-    throw err;
-  }
-  return {
-    coordinator,
-    host,
-    localUrl,
-    firstLink,
-    async stop() {
-      await host.stop();
-      await coordinator.stop();
-    }
-  };
-}
-async function up(ctx, flags) {
-  const s = await startStandalone(ctx, flags);
-  const c = s.coordinator;
-  ctx.err([
-    `Switchyard is up: ${c.config.publicUrl} (listening on port ${c.port})`,
-    `Data: ${c.config.dataDir}`,
-    c.config.webDist ? null : "Web app bundle not found: API only (run `pnpm build`)",
-    "Another device: switchyard pair    Terminal: switchyard tui <session>",
-    "Schedules run only while this process is running."
-  ].filter(Boolean).join("\n"));
-  const sig = await waitForSignal();
-  ctx.err(`${sig}: stopping (Pi sessions on this host are stopped and can be resumed later)`);
-  await s.stop();
-}
-
 // packages/cli/dist/commands/work.js
 function byId2(list) {
   return new Map(list.map((x) => [x.id, x]));
@@ -20596,13 +20825,10 @@ function buildProgram(ctx = defaultCtx()) {
   });
   host.command("backup <out>").description("Consistent backup of the host database").option("--state-dir <dir>", "state dir (env SWITCHYARD_STATE_DIR)").action((out, o) => hostBackup(ctx, out, o));
   host.command("status").description("Show this host's enrollment, link and Pi status").option("--config <path>", "host.json path").option("--state-dir <dir>", "state dir").option("--json", "JSON output").action((o) => hostStatus(ctx, o));
-  program.command("init").description("Set up this server and print a single-use sign-in link for your first device").option("--coordinator <url>", "local coordinator URL (default: the running one)").option("--data-dir <dir>", "data dir holding admin.token").option("--json", "JSON output").action(async (o) => {
-    await init(ctx, o);
-  });
-  program.command("pair").description("Create a single-use link and QR for another device (or --host); also the recovery path when every device is lost").option("--host", "enroll a host instead of a device").option("--coordinator <url>", "local coordinator URL (default: the running one)").option("--data-dir <dir>", "data dir holding admin.token").option("--json", "JSON output").action(async (o) => {
+  program.command("pair").description("Print a single-use sign-in link and QR for a browser (or --host for a host token), using the admin token: for local servers and recovery").option("--host", "enroll a host instead of a device").option("--coordinator <url>", "local coordinator URL (default: the running one)").option("--data-dir <dir>", "data dir holding admin.token").option("--json", "JSON output").action(async (o) => {
     await pair(ctx, o);
   });
-  program.command("login").description("Enroll this terminal as a device (writes ~/.config/switchyard/client.json)").option("--coordinator <url>", "coordinator URL").requiredOption("--token <token>", "device enrollment token or link (switchyard pair)").option("--name <name>", "device name").action(async (o) => {
+  program.command("login").description("Sign this terminal in by approving it in a browser (writes ~/.config/switchyard/client.json)").option("--coordinator <url>", "coordinator URL (default: SWITCHYARD_URL or client.json)").option("--name <name>", "device name").option("--token <token>", "single-use sign-in link or token from `switchyard pair`, instead of browser approval").option("--open", "open the approval page in a browser (default: when interactive and not over SSH)").option("--no-open", "never open a browser").action(async (o) => {
     await login(ctx, o);
   });
   connectionOptions(program.command("doctor").description("Check Node, Pi, git, coordinator, credentials, host link and push")).action(async (o) => {