@spencerboucher/switchyard 0.6.0 → 0.8.0

package/dist/switchyard.mjs

@@ -380,7 +380,8 @@ var SessionModel = z3.object({
 var SlashCommand = z3.object({
   name: z3.string().min(1),
   description: z3.string().nullable(),
-  source: z3.enum(["extension", "prompt", "skill"])
+  source: z3.enum(["extension", "prompt", "skill"]),
+  argumentHint: z3.string().nullable().optional()
 });
 var ContextUsage = z3.object({
   /** Estimated tokens in context; null right after compaction until the next reply. */
@@ -683,7 +684,7 @@ var Device = z3.object({
     permission: z3.enum(["granted", "denied", "default", "unknown"])
   }),
   preferredMobile: z3.boolean(),
-  enrolledVia: z3.enum(["enrollment", "passkey", "oidc", "admin"]).default("enrollment")
+  enrolledVia: z3.enum(["enrollment", "passkey", "oidc", "admin", "approval"]).default("enrollment")
 });
 var ToolItemData = z3.object({
   toolCallId: z3.string(),
@@ -921,6 +922,51 @@ var SetThinkingRequest = z4.object({ level: ThinkingLevel });
 var CompactRequest = z4.object({ instructions: z4.string().max(4e3).optional() });
 var SessionModelsResult = z4.object({ models: z4.array(SessionModel) });
 var SessionCommandsResult = z4.object({ commands: z4.array(SlashCommand) });
+var CompleteRequest = z4.object({ text: z4.string().min(1).max(500) });
+var CompletionItem = z4.object({
+  value: z4.string(),
+  label: z4.string(),
+  description: z4.string().nullable()
+});
+var SessionCompleteResult = z4.object({
+  items: z4.array(CompletionItem).max(50),
+  prefix: z4.string()
+});
+var TreeRow = z4.object({
+  entryId: z4.string(),
+  parentId: z4.string().nullable(),
+  depth: z4.number().int(),
+  role: z4.enum(["user", "assistant"]),
+  text: z4.string(),
+  activeBranch: z4.boolean(),
+  leaf: z4.boolean(),
+  label: z4.string().nullable(),
+  at: z4.string().nullable()
+});
+var SessionTreeResult = z4.object({ rows: z4.array(TreeRow) });
+var BranchRequest = z4.object({
+  entryId: z4.string().nullable(),
+  fork: z4.boolean().default(false)
+});
+var HostBranchResult = z4.object({
+  sessionFile: z4.string().nullable(),
+  prefill: z4.string().nullable()
+});
+var BranchResult = z4.object({
+  session: Session.nullable(),
+  prefill: z4.string().nullable()
+});
+var SessionExportResult = z4.object({ fileName: z4.string(), content: z4.string() });
+var CommandViewAction = z4.object({
+  label: z4.string().min(1).max(80),
+  command: z4.string().startsWith("/").max(500),
+  tone: z4.enum(["default", "primary", "danger"]).optional()
+});
+var CommandView = z4.object({
+  title: z4.string().min(1).max(200),
+  body: UINodeSchema,
+  actions: z4.array(CommandViewAction).max(30).default([])
+});
 var ModelStateResult = z4.object({
   model: SessionModel.nullable(),
   thinking: ThinkingLevel.nullable()
@@ -1049,7 +1095,6 @@ var PushPayload = z4.union([
   z4.object({ type: z4.literal("clear"), tag: z4.string() })
 ]);
 var SetupState = z4.object({
-  initialized: z4.boolean(),
   passkey: z4.object({
     available: z4.boolean(),
     registered: z4.boolean(),
@@ -1057,10 +1102,6 @@ var SetupState = z4.object({
   }),
   oidc: z4.object({ label: z4.string() }).nullable()
 });
-var InitResponse = z4.object({
-  alreadyInitialized: z4.boolean(),
-  enrollment: CreateEnrollmentResponse
-});
 var PasskeyRegisterOptionsResponse = z4.object({
   challengeId: z4.string(),
   options: z4.unknown()
@@ -1096,6 +1137,31 @@ var OidcClaimResponse = z4.union([
   z4.object({ status: z4.literal("pending") }),
   z4.object({ status: z4.literal("done"), deviceId: z4.string() })
 ]);
+var TerminalLoginStartRequest = z4.object({ name: z4.string().min(1).max(80) });
+var TerminalLoginStartResponse = z4.object({
+  userCode: z4.string(),
+  pollToken: z4.string(),
+  verifyUrl: z4.string(),
+  expiresAt: z4.string(),
+  intervalMs: z4.number().int()
+});
+var TerminalLoginClaimRequest = z4.object({
+  userCode: z4.string().min(1),
+  pollToken: z4.string().min(1)
+});
+var TerminalLoginClaimResponse = z4.union([
+  z4.object({ status: z4.literal("pending") }),
+  z4.object({ status: z4.literal("denied") }),
+  z4.object({ status: z4.literal("done"), deviceId: z4.string(), credential: z4.string() })
+]);
+var TerminalLoginRequest = z4.object({
+  userCode: z4.string(),
+  name: z4.string(),
+  requestedFrom: z4.string(),
+  createdAt: z4.string(),
+  expiresAt: z4.string(),
+  status: z4.enum(["pending", "approved", "denied"])
+});
 var AuthMethods = z4.object({
   passkeys: z4.array(Passkey),
   passkeyAvailability: z4.object({ available: z4.boolean(), reason: z4.string().nullable() }),
@@ -1301,6 +1367,20 @@ var HostCommand = z8.discriminatedUnion("type", [
   z8.object({ type: z8.literal("session.snapshot"), sessionId: z8.string() }),
   z8.object({ type: z8.literal("session.models"), sessionId: z8.string() }),
   z8.object({ type: z8.literal("session.commands"), sessionId: z8.string() }),
+  z8.object({
+    type: z8.literal("session.complete"),
+    sessionId: z8.string(),
+    text: z8.string().max(500)
+  }),
+  z8.object({ type: z8.literal("session.tree"), sessionId: z8.string() }),
+  z8.object({
+    type: z8.literal("session.branch"),
+    sessionId: z8.string(),
+    entryId: z8.string().nullable(),
+    fork: z8.boolean()
+  }),
+  z8.object({ type: z8.literal("session.reload"), sessionId: z8.string() }),
+  z8.object({ type: z8.literal("session.export"), sessionId: z8.string() }),
   z8.object({
     type: z8.literal("session.setModel"),
     sessionId: z8.string(),
@@ -1854,7 +1934,7 @@ var ApiClient = class {
   constructor(opts) {
     this.baseUrl = opts.coordinatorUrl.replace(/\/+$/, "");
     this.credential = opts.credential;
-    this.doFetch = opts.fetch ?? ((input, init2) => fetch(input, init2));
+    this.doFetch = opts.fetch ?? ((input, init) => fetch(input, init));
   }
   async request(method, path, body) {
     const headers = { accept: "application/json" };
@@ -2320,8 +2400,8 @@ function runRawTerminal(opts) {
 import { Command, Option } from "commander";
 
 // packages/cli/dist/commands/auth.js
-import { hostname } from "node:os";
-import QRCode from "qrcode";
+import { hostname as hostname3 } from "node:os";
+import QRCode2 from "qrcode";
 
 // packages/cli/dist/config.js
 import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -2483,121 +2563,10 @@ function trimUrl(url) {
   return url.trim().replace(/\/+$/, "");
 }
 
-// packages/cli/dist/commands/auth.js
-function adminApi(ctx, flags) {
-  const dataDir = flags.dataDir ?? ctx.paths?.dataDir ?? defaultDataDir(ctx.env);
-  const token = readAdminToken(dataDir, ctx.env);
-  if (!token) {
-    throw new CliError(`No admin token: run this on the coordinator machine (looked in ${dataDir}/admin.token) or set SWITCHYARD_ADMIN_TOKEN`);
-  }
-  const url = trimUrl(flags.coordinator ?? readEndpoint(dataDir)?.localUrl ?? DEFAULT_LOCAL_URL);
-  return new ApiClient({ coordinatorUrl: url, credential: token, fetch: ctx.fetch });
-}
-function clockTime(iso) {
-  const d = new Date(iso);
-  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
-}
-async function printDeviceLink(ctx, url) {
-  const qr = await QRCode.toString(url, { type: "terminal", small: true });
-  ctx.out("");
-  ctx.out(`  ${url}`);
-  ctx.out("");
-  ctx.out(qr.trimEnd());
-  ctx.out("");
-}
-async function printInit(ctx, r) {
-  if (r.alreadyInitialized) {
-    ctx.out("Already set up. New single-use sign-in link for one device:");
-    await printDeviceLink(ctx, r.enrollment.url);
-    return;
-  }
-  ctx.out(`Switchyard is set up. Open this single-use link on your first device (expires ${clockTime(r.enrollment.expiresAt)}):`);
-  await printDeviceLink(ctx, r.enrollment.url);
-  ctx.out("Then add a passkey in Settings \u203A Sign-in so other devices can sign in without a link.");
-}
-async function init(ctx, flags) {
-  const api = adminApi(ctx, flags);
-  const r = await api.post("/api/admin/init", {});
-  if (flags.json) {
-    ctx.out(JSON.stringify(r, null, 2));
-    return r;
-  }
-  await printInit(ctx, r);
-  return r;
-}
-async function pair(ctx, flags) {
-  const api = adminApi(ctx, flags);
-  const kind = flags.host ? "host" : "device";
-  const e = await api.post("/api/enrollments", { kind });
-  if (flags.json) {
-    ctx.out(JSON.stringify(e, null, 2));
-    return e;
-  }
-  const qr = await QRCode.toString(e.url, { type: "terminal", small: true });
-  if (kind === "host") {
-    ctx.out(`Host enrollment (single use, expires ${e.expiresAt}). On the host, run:`);
-    ctx.out("");
-    ctx.out(`  ${e.command ?? `switchyard host enroll --coordinator <url> --token ${e.token}`}`);
-    ctx.out("");
-    ctx.out(`Token: ${e.token}`);
-  } else {
-    ctx.out(`Open this link on the device to enroll it (single use, expires ${e.expiresAt}):`);
-    ctx.out("");
-    ctx.out(`  ${e.url}`);
-    ctx.out("");
-    ctx.out(qr.trimEnd());
-    ctx.out("");
-    ctx.out(`Terminal: switchyard login --coordinator ${originOf(e.url)} --token ${e.token}`);
-  }
-  ctx.out("The link does not provide network access: the device must already reach this URL.");
-  return e;
-}
-function originOf(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return url;
-  }
-}
-function parseEnrollmentInput(token, coordinator) {
-  const t = token.trim();
-  if (/^https?:\/\//.test(t)) {
-    const u = new URL(t);
-    const params = new URLSearchParams(u.hash.replace(/^#/, ""));
-    const fromUrl = params.get("token") ?? u.searchParams.get("token");
-    if (!fromUrl)
-      throw new CliError("That URL has no enrollment token");
-    return { url: trimUrl(coordinator ?? u.origin), token: fromUrl };
-  }
-  if (!coordinator)
-    throw new CliError("--coordinator <url> is required");
-  return { url: trimUrl(coordinator), token: t };
-}
-async function login(ctx, flags) {
-  const { url, token } = parseEnrollmentInput(flags.token, flags.coordinator);
-  const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
-  const name = flags.name ?? `${hostname().replace(/\.local$/, "")} terminal`;
-  const res = await api.post("/api/enroll", {
-    token,
-    name,
-    kind: "terminal"
-  });
-  if (!res.credential)
-    throw new CliError("The coordinator returned no credential");
-  const path = ctx.paths?.clientConfig ?? clientConfigPath(ctx.env);
-  writeClientConfig(path, {
-    coordinatorUrl: url,
-    credential: res.credential,
-    deviceId: res.deviceId
-  });
-  ctx.out(`Enrolled "${name}" (${res.deviceId}) with ${url}.`);
-  ctx.out(`Credential saved to ${path} (mode 0600). Open a session's Pi terminal with \`switchyard tui <session>\`.`);
-  return { path, deviceId: res.deviceId };
-}
-
-// packages/cli/dist/commands/coordinator.js
-import { existsSync as existsSync6, mkdirSync as mkdirSync4 } from "node:fs";
-import { resolve as resolve4 } from "node:path";
+// packages/cli/dist/commands/up.js
+import { spawn as spawn4 } from "node:child_process";
+import { existsSync as existsSync15 } from "node:fs";
+import { hostname as hostname2 } from "node:os";
 
 // packages/coordinator/dist/attention/router.js
 var DESKTOP_RECENT_MS = 5 * 6e4;
@@ -2895,12 +2864,10 @@ var Auth = class {
   store;
   config;
   hub;
-  owner;
-  constructor(store, config, hub, owner) {
+  constructor(store, config, hub) {
     this.store = store;
     this.config = config;
     this.hub = hub;
-    this.owner = owner;
   }
   get adminTokenPath() {
     return join3(this.config.dataDir, "admin.token");
@@ -2940,14 +2907,13 @@ var Auth = class {
     return this.store.devices.count("is_admin = 0 AND revoked_at IS NULL");
   }
   enrollmentUrl(token, kind) {
-    return kind === "device" ? `${this.config.publicUrl}/enroll#token=${token}` : `${this.config.publicUrl}/enroll#token=${token}&kind=host`;
+    return kind === "device" ? `${this.config.publicUrl}/sign-in#token=${token}` : `${this.config.publicUrl}/sign-in#token=${token}&kind=host`;
   }
   hostEnrollCommand(token) {
     return `switchyard host enroll --coordinator ${this.config.publicUrl} --token ${token}`;
   }
   /**
-   * Create a single-use enrollment (device 10 min, host 30 min by default). An enrollment created
-   * by a device (the local admin included) also marks the server set up.
+   * Create a single-use enrollment (device 10 min, host 30 min by default).
    */
   createEnrollment(kind, createdBy, ttlMs = kind === "device" ? DEVICE_ENROLLMENT_TTL_MS : HOST_ENROLLMENT_TTL_MS) {
     const token = newToken();
@@ -2955,8 +2921,6 @@ var Auth = class {
     const now = this.store.now();
     const expiresAt = new Date(now.getTime() + ttlMs).toISOString();
     this.store.tx(() => {
-      if (createdBy !== null)
-        this.owner.markInitialized();
       this.store.insertEnrollment({
         id,
         kind,
@@ -4459,7 +4423,7 @@ function createSession(ctx, input) {
     nativeHandle: null,
     profileSnapshot: profile,
     runtime: "starting",
-    runtimeDetail: null,
+    runtimeDetail: workspace ? "Starting Pi\u2026" : "Creating worktree\u2026",
     connectivity: host.connectivity,
     runId: null,
     taskId: null,
@@ -4475,19 +4439,27 @@ function createSession(ctx, input) {
   ctx.store.putSession(session);
   const choice = input.workspace;
   const started = (async () => {
+    const t0 = Date.now();
     try {
       let s = session;
       if (!("existingId" in choice)) {
         const ws = await createWorkspace(ctx, project, checkout, choice.newBranch, choice.base);
+        ctx.log.info({ sessionId: session.id, ms: Date.now() - t0 }, "session start: worktree ready");
         s = ctx.store.tx(() => {
           const cur = ctx.store.sessions.require(session.id);
-          return ctx.store.putSession({ ...cur, workspaceId: ws.id, cwd: ws.path });
+          return ctx.store.putSession({
+            ...cur,
+            workspaceId: ws.id,
+            cwd: ws.path,
+            runtimeDetail: "Starting Pi\u2026"
+          });
         });
       }
       await startOnHost(ctx, s, {
         initialPrompt: input.prompt.trim() ? input.prompt : null,
         nativeHandle: null
       });
+      ctx.log.info({ sessionId: session.id, ms: Date.now() - t0 }, "session start: started on host");
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       ctx.log.warn({ err, sessionId: session.id }, "session start failed");
@@ -7328,10 +7300,23 @@ INSERT OR IGNORE INTO settings(key, value)
   WHERE EXISTS (SELECT 1 FROM devices WHERE is_admin = 0 AND revoked_at IS NULL);
 `;
 
+// packages/coordinator/dist/db/migrations/003_terminal_login.js
+var sql3 = `
+DROP TABLE auth_flows;
+
+CREATE TABLE auth_flows (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('passkey_register','passkey_auth','oidc','terminal_login')),
+  data TEXT NOT NULL,
+  expires_at TEXT NOT NULL
+);
+`;
+
 // packages/coordinator/dist/db/index.js
 var MIGRATIONS = [
   { version: 1, name: "001_init", sql },
-  { version: 2, name: "002_owner_auth", sql: sql2 }
+  { version: 2, name: "002_owner_auth", sql: sql2 },
+  { version: 3, name: "003_terminal_login", sql: sql3 }
 ];
 var LATEST_MIGRATION = MIGRATIONS[MIGRATIONS.length - 1].version;
 function openDb(path) {
@@ -8171,8 +8156,11 @@ import * as client from "openid-client";
 // packages/coordinator/dist/owner.js
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { isIP } from "node:net";
-var OWNER_INITIALIZED_KEY = "owner.initialized_at";
 var OWNER_WEBAUTHN_USER_KEY = "owner.webauthn_user_id";
+function isLoopbackUrl(url) {
+  const host = new URL(url).hostname.replace(/^\[|\]$/g, "");
+  return host === "localhost" || host === "::1" || /^127\.\d+\.\d+\.\d+$/.test(host);
+}
 var Owner = class {
   store;
   config;
@@ -8180,18 +8168,6 @@ var Owner = class {
     this.store = store;
     this.config = config;
   }
-  isInitialized() {
-    return this.config.oidc !== null || this.store.getSetting(OWNER_INITIALIZED_KEY, null) !== null;
-  }
-  /** Mark the server set up. Returns true when this call set it. */
-  markInitialized() {
-    return this.store.tx(() => {
-      if (this.store.getSetting(OWNER_INITIALIZED_KEY, null) !== null)
-        return false;
-      this.store.setSetting(OWNER_INITIALIZED_KEY, this.store.nowIso());
-      return true;
-    });
-  }
   /** Stable random WebAuthn user handle for the owner (16 bytes, created lazily). */
   webauthnUserId() {
     return this.store.tx(() => {
@@ -8851,53 +8827,6 @@ function registerAttentionRoutes(app, ctx) {
   app.post("/api/attention/:id/acknowledge", async (req) => ctx.attention.acknowledge(req.params.id));
 }
 
-// packages/coordinator/dist/routes/devices.js
-import QRCode2 from "qrcode";
-import { z as z14 } from "zod";
-var UpdateDeviceRequest = z14.object({
-  name: z14.string().min(1).max(80).optional(),
-  preferredMobile: z14.boolean().optional()
-});
-async function enrollmentResponse(ctx, kind, createdBy) {
-  const e = ctx.auth.createEnrollment(kind, createdBy);
-  const qrSvg = await QRCode2.toString(e.url, { type: "svg", margin: 1 });
-  return { token: e.token, url: e.url, expiresAt: e.expiresAt, qrSvg, command: e.command };
-}
-function publicDevice(ctx, id) {
-  return ctx.store.devices.require(id);
-}
-function registerDeviceRoutes(app, ctx) {
-  app.post("/api/enrollments", async (req, reply) => {
-    const body = parse(CreateEnrollmentRequest, req.body);
-    return reply.code(201).send(await enrollmentResponse(ctx, body.kind, deviceOf(req).id));
-  });
-  app.post("/api/devices/enrollments", async (req, reply) => reply.code(201).send(await enrollmentResponse(ctx, "device", deviceOf(req).id)));
-  app.get("/api/devices", async () => ctx.store.devices.list("is_admin = 0", [], "created_at"));
-  app.get("/api/devices/:id", async (req) => publicDevice(ctx, req.params.id));
-  app.patch("/api/devices/:id", async (req) => {
-    const { id } = req.params;
-    const body = parse(UpdateDeviceRequest, req.body);
-    return ctx.store.tx(() => {
-      const d = ctx.store.devices.require(id);
-      if (body.preferredMobile) {
-        for (const other of ctx.store.devices.list("is_admin = 0")) {
-          if (other.id !== id && other.preferredMobile) {
-            ctx.store.putDevice({ ...other, preferredMobile: false });
-          }
-        }
-      }
-      return ctx.store.putDevice({
-        ...d,
-        name: body.name ?? d.name,
-        preferredMobile: body.preferredMobile ?? d.preferredMobile
-      });
-    });
-  });
-  const revoke = async (req) => ctx.auth.revokeDevice(req.params.id);
-  app.post("/api/devices/:id/revoke", revoke);
-  app.delete("/api/devices/:id", revoke);
-}
-
 // packages/coordinator/dist/routes/auth.js
 var HANDOFF_PAGE = `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
@@ -8908,7 +8837,6 @@ var HANDOFF_PAGE = `<!doctype html>
 function setupState(ctx) {
   const availability = ctx.owner.passkeyAvailability();
   return {
-    initialized: ctx.owner.isInitialized(),
     passkey: {
       available: availability.available,
       registered: ctx.passkeys.count() > 0,
@@ -8988,6 +8916,18 @@ function registerAuthRoutes(app, ctx) {
     ctx.auth.setDeviceCookie(reply, r.credential);
     return { status: "done", deviceId: r.deviceId };
   });
+  app.post("/api/auth/terminal/start", async (req, reply) => {
+    limitAuth(req);
+    const body = parse(TerminalLoginStartRequest, req.body);
+    return reply.code(201).send(ctx.terminalLogins.start(body.name, req.ip));
+  });
+  app.post("/api/auth/terminal/claim", async (req) => {
+    const body = parse(TerminalLoginClaimRequest, req.body);
+    return ctx.terminalLogins.claim(body.userCode, body.pollToken);
+  });
+  app.get("/api/auth/terminal/requests/:code", async (req) => ctx.terminalLogins.describe(req.params.code));
+  app.post("/api/auth/terminal/requests/:code/approve", async (req) => ctx.terminalLogins.approve(req.params.code));
+  app.post("/api/auth/terminal/requests/:code/deny", async (req) => ctx.terminalLogins.deny(req.params.code));
   app.get("/api/auth/methods", async () => {
     const availability = ctx.owner.passkeyAvailability();
     return {
@@ -9006,15 +8946,6 @@ function registerAuthRoutes(app, ctx) {
     ctx.passkeys.remove(req.params.id);
     return { ok: true };
   });
-  app.post("/api/admin/init", async (req) => {
-    const device = deviceOf(req);
-    if (!device.isAdmin || device.id !== ADMIN_DEVICE_ID) {
-      throw new SwitchyardError("forbidden", "Only the server's local admin token can initialize");
-    }
-    const alreadyInitialized = !ctx.owner.markInitialized();
-    const enrollment = await enrollmentResponse(ctx, "device", device.id);
-    return { alreadyInitialized, enrollment };
-  });
 }
 function redirectError(ctx, req, reply, err) {
   const code = err instanceof SwitchyardError ? err.code : "oidc_failed";
@@ -9024,7 +8955,54 @@ function redirectError(ctx, req, reply, err) {
   else if (err.code === "forbidden")
     ctx.log.info({ detail }, "OIDC sign-in refused");
   const qs = new URLSearchParams({ error: code, detail });
-  return reply.redirect(`/enroll?${qs.toString()}`, 302);
+  return reply.redirect(`/sign-in?${qs.toString()}`, 302);
+}
+
+// packages/coordinator/dist/routes/devices.js
+import QRCode from "qrcode";
+import { z as z14 } from "zod";
+var UpdateDeviceRequest = z14.object({
+  name: z14.string().min(1).max(80).optional(),
+  preferredMobile: z14.boolean().optional()
+});
+async function enrollmentResponse(ctx, kind, createdBy) {
+  const e = ctx.auth.createEnrollment(kind, createdBy);
+  const qrSvg = await QRCode.toString(e.url, { type: "svg", margin: 1 });
+  return { token: e.token, url: e.url, expiresAt: e.expiresAt, qrSvg, command: e.command };
+}
+function publicDevice(ctx, id) {
+  return ctx.store.devices.require(id);
+}
+function registerDeviceRoutes(app, ctx) {
+  app.post("/api/enrollments", async (req, reply) => {
+    const body = parse(CreateEnrollmentRequest, req.body);
+    return reply.code(201).send(await enrollmentResponse(ctx, body.kind, deviceOf(req).id));
+  });
+  app.post("/api/devices/enrollments", async (req, reply) => reply.code(201).send(await enrollmentResponse(ctx, "device", deviceOf(req).id)));
+  app.get("/api/devices", async () => ctx.store.devices.list("is_admin = 0", [], "created_at"));
+  app.get("/api/devices/:id", async (req) => publicDevice(ctx, req.params.id));
+  app.patch("/api/devices/:id", async (req) => {
+    const { id } = req.params;
+    const body = parse(UpdateDeviceRequest, req.body);
+    return ctx.store.tx(() => {
+      const d = ctx.store.devices.require(id);
+      if (body.preferredMobile) {
+        for (const other of ctx.store.devices.list("is_admin = 0")) {
+          if (other.id !== id && other.preferredMobile) {
+            ctx.store.putDevice({ ...other, preferredMobile: false });
+          }
+        }
+      }
+      return ctx.store.putDevice({
+        ...d,
+        name: body.name ?? d.name,
+        preferredMobile: body.preferredMobile ?? d.preferredMobile
+      });
+    });
+  });
+  const revoke = async (req) => ctx.auth.revokeDevice(req.params.id);
+  app.post("/api/devices/:id/revoke", revoke);
+  app.delete("/api/devices/:id", revoke);
 }
 
 // packages/coordinator/dist/routes/hosts.js
@@ -9443,49 +9421,20 @@ function registerSessionRoutes(app, ctx) {
       where.push("archived_at IS NULL");
     return ctx.store.sessions.list(where.join(" AND ") || void 0, params, "last_activity_at DESC");
   });
-  app.get("/api/sessions/importable", async (req) => {
-    const q = parse(ImportableQuery, req.query, "query");
-    requireConnected(ctx, q.hostId);
-    const list = normalizeImportable(await ctx.hostHub.request(q.hostId, { type: "session.importable" }));
-    return list.map((s) => ({
-      ...s,
-      importedSessionId: ctx.store.sessionByNativeFile(q.hostId, s.sessionFile)?.id ?? null
-    }));
-  });
-  app.post("/api/sessions/import", async (req, reply) => {
-    const body = parse(ImportSessionRequest, req.body);
-    requireConnected(ctx, body.hostId);
-    const already = ctx.store.sessionByNativeFile(body.hostId, body.sessionFile);
-    if (already) {
-      throw new SwitchyardError("conflict", "This Pi session was already imported", {
-        sessionId: already.id
-      });
-    }
-    const list = normalizeImportable(await ctx.hostHub.request(body.hostId, { type: "session.importable" }));
-    const native = list.find((s) => s.sessionFile === body.sessionFile);
-    if (!native)
-      throw new SwitchyardError("not_found", "Pi session file not found on host");
-    if (!native.inactive) {
-      throw new SwitchyardError("conflict", "This Pi session is still active; close it in Pi before importing");
-    }
-    const rawItems = await ctx.hostHub.request(body.hostId, {
-      type: "session.readNative",
-      sessionFile: body.sessionFile
-    });
-    const ws = ctx.store.workspaceByPath(body.hostId, native.cwd);
-    const projectId = body.projectId ?? ws?.projectId ?? null;
+  function importNative(native, hostId, projectIdIn, items) {
+    const ws = ctx.store.workspaceByPath(hostId, native.cwd);
+    const projectId = projectIdIn ?? ws?.projectId ?? null;
     if (projectId)
       ctx.store.projects.require(projectId);
     const project = projectId ? ctx.store.projects.get(projectId) : null;
-    const host = ctx.store.hosts.require(body.hostId);
+    const host = ctx.store.hosts.require(hostId);
     const now = ctx.store.nowIso();
     const id = newId("ses");
-    const items = Array.isArray(rawItems) ? rawItems : rawItems?.items ?? [];
     const session = {
       id,
       title: native.name ?? native.cwd.split("/").pop() ?? "Imported session",
       subtitle: null,
-      hostId: body.hostId,
+      hostId,
       workspaceId: ws && ws.projectId === projectId ? ws.id : null,
       projectId,
       cwd: native.cwd,
@@ -9519,6 +9468,39 @@ function registerSessionRoutes(app, ctx) {
           ctx.store.upsertItem(item.data);
       });
     });
+    return session;
+  }
+  app.get("/api/sessions/importable", async (req) => {
+    const q = parse(ImportableQuery, req.query, "query");
+    requireConnected(ctx, q.hostId);
+    const list = normalizeImportable(await ctx.hostHub.request(q.hostId, { type: "session.importable" }));
+    return list.map((s) => ({
+      ...s,
+      importedSessionId: ctx.store.sessionByNativeFile(q.hostId, s.sessionFile)?.id ?? null
+    }));
+  });
+  app.post("/api/sessions/import", async (req, reply) => {
+    const body = parse(ImportSessionRequest, req.body);
+    requireConnected(ctx, body.hostId);
+    const already = ctx.store.sessionByNativeFile(body.hostId, body.sessionFile);
+    if (already) {
+      throw new SwitchyardError("conflict", "This Pi session was already imported", {
+        sessionId: already.id
+      });
+    }
+    const list = normalizeImportable(await ctx.hostHub.request(body.hostId, { type: "session.importable" }));
+    const native = list.find((s) => s.sessionFile === body.sessionFile);
+    if (!native)
+      throw new SwitchyardError("not_found", "Pi session file not found on host");
+    if (!native.inactive) {
+      throw new SwitchyardError("conflict", "This Pi session is still active; close it in Pi before importing");
+    }
+    const rawItems = await ctx.hostHub.request(body.hostId, {
+      type: "session.readNative",
+      sessionFile: body.sessionFile
+    });
+    const items = Array.isArray(rawItems) ? rawItems : rawItems?.items ?? [];
+    const session = importNative(native, body.hostId, body.projectId ?? null, items);
     return reply.code(201).send(session);
   });
   app.get("/api/sessions/:id", async (req) => get(idOf(req)));
@@ -9540,9 +9522,15 @@ function registerSessionRoutes(app, ctx) {
     return ctx.hostHub.request(s.hostId, { type: "session.snapshot", sessionId: s.id });
   });
   app.post("/api/sessions/:id/prompt", async (req) => {
-    const s = get(idOf(req));
+    let s = get(idOf(req));
     const body = parse(PromptRequest, req.body);
-    requireLiveSession(ctx, s);
+    if (!s.readOnly && !s.archivedAt && s.nativeHandle && !LIVE_RUNTIMES2.includes(s.runtime) && body.mode === "prompt") {
+      await resumeSession(s);
+      s = get(s.id);
+      requireConnected(ctx, s.hostId);
+    } else {
+      requireLiveSession(ctx, s);
+    }
     const run = ctx.store.runForSession(s);
     const result = await ctx.hostHub.request(s.hostId, {
       type: "session.prompt",
@@ -9553,6 +9541,9 @@ function registerSessionRoutes(app, ctx) {
       origin: "human",
       controlRevision: run?.controlRevision ?? 1
     });
+    const view = result?.view;
+    if (view)
+      CommandView.parse(view);
     return {
       ok: true,
       clientMessageId: body.clientMessageId ?? null,
@@ -9570,6 +9561,54 @@ function registerSessionRoutes(app, ctx) {
     requireSessionControls(ctx, s);
     return SessionCommandsResult.parse(await ctx.hostHub.request(s.hostId, { type: "session.commands", sessionId: s.id }));
   });
+  app.post("/api/sessions/:id/complete", async (req) => {
+    const s = get(idOf(req));
+    const body = parse(CompleteRequest, req.body);
+    requireSessionControls(ctx, s);
+    return SessionCompleteResult.parse(await ctx.hostHub.request(s.hostId, {
+      type: "session.complete",
+      sessionId: s.id,
+      text: body.text
+    }));
+  });
+  app.get("/api/sessions/:id/tree", async (req) => {
+    const s = get(idOf(req));
+    requireSessionControls(ctx, s);
+    return SessionTreeResult.parse(await ctx.hostHub.request(s.hostId, { type: "session.tree", sessionId: s.id }));
+  });
+  app.post("/api/sessions/:id/branch", async (req, reply) => {
+    const s = get(idOf(req));
+    const body = parse(BranchRequest, req.body);
+    requireSessionControls(ctx, s);
+    const r = HostBranchResult.parse(await ctx.hostHub.request(s.hostId, {
+      type: "session.branch",
+      sessionId: s.id,
+      entryId: body.entryId,
+      fork: body.fork
+    }));
+    if (!r.sessionFile)
+      return { session: null, prefill: r.prefill };
+    const native = await ctx.hostHub.request(s.hostId, { type: "session.readNative", sessionFile: r.sessionFile });
+    const session = importNative({
+      sessionId: native.sessionId,
+      sessionFile: r.sessionFile,
+      cwd: native.cwd,
+      name: `${native.name ?? s.title} (branch)`,
+      mtime: ctx.store.nowIso()
+    }, s.hostId, s.projectId, native.items ?? []);
+    return reply.code(201).send({ session, prefill: r.prefill });
+  });
+  app.post("/api/sessions/:id/reload", async (req) => {
+    const s = get(idOf(req));
+    requireSessionControls(ctx, s);
+    await ctx.hostHub.request(s.hostId, { type: "session.reload", sessionId: s.id });
+    return { ok: true };
+  });
+  app.get("/api/sessions/:id/export", async (req) => {
+    const s = get(idOf(req));
+    requireSessionControls(ctx, s);
+    return SessionExportResult.parse(await ctx.hostHub.request(s.hostId, { type: "session.export", sessionId: s.id }));
+  });
   app.post("/api/sessions/:id/model", async (req) => {
     const s = get(idOf(req));
     const body = parse(SetModelRequest, req.body);
@@ -9625,8 +9664,7 @@ function registerSessionRoutes(app, ctx) {
   });
   app.post("/api/sessions/:id/takeover", async (req) => takeover(ctx, idOf(req)));
   app.post("/api/sessions/:id/return-to-automation", async (req) => returnToAutomation(ctx, idOf(req)));
-  app.post("/api/sessions/:id/resume", async (req) => {
-    const s = get(idOf(req));
+  async function resumeSession(s) {
     if (!s.nativeHandle) {
       throw new SwitchyardError("native_session_missing", "This session has no native Pi session to resume");
     }
@@ -9659,6 +9697,10 @@ function registerSessionRoutes(app, ctx) {
       });
       throw err;
     }
+  }
+  app.post("/api/sessions/:id/resume", async (req) => {
+    const s = get(idOf(req));
+    await resumeSession(s);
     return get(s.id);
   });
   app.post("/api/sessions/:id/rename", async (req) => {
@@ -9808,11 +9850,11 @@ var Statements = class {
   constructor(db) {
     this.db = db;
   }
-  get(sql3) {
-    let s = this.cache.get(sql3);
+  get(sql4) {
+    let s = this.cache.get(sql4);
     if (!s) {
-      s = this.db.prepare(sql3);
-      this.cache.set(sql3, s);
+      s = this.db.prepare(sql4);
+      this.cache.set(sql4, s);
     }
     return s;
   }
@@ -9843,12 +9885,12 @@ var JsonRepo = class {
   }
   /** List with an optional SQL `WHERE` fragment over the indexed columns. */
   list(where, params = [], orderBy = "rowid") {
-    const sql3 = `SELECT json FROM ${this.table}${where ? ` WHERE ${where}` : ""} ORDER BY ${orderBy}`;
-    return this.st.get(sql3).all(...params).map((r) => JSON.parse(r.json));
+    const sql4 = `SELECT json FROM ${this.table}${where ? ` WHERE ${where}` : ""} ORDER BY ${orderBy}`;
+    return this.st.get(sql4).all(...params).map((r) => JSON.parse(r.json));
   }
   count(where, params = []) {
-    const sql3 = `SELECT COUNT(*) AS n FROM ${this.table}${where ? ` WHERE ${where}` : ""}`;
-    return this.st.get(sql3).get(...params).n;
+    const sql4 = `SELECT COUNT(*) AS n FROM ${this.table}${where ? ` WHERE ${where}` : ""}`;
+    return this.st.get(sql4).get(...params).n;
   }
   /**
    * Update by id, or insert when missing. `extra` columns are written in both cases when given
@@ -10594,6 +10636,126 @@ var TerminalHub = class {
   }
 };
 
+// packages/coordinator/dist/terminal-login.js
+import { randomInt } from "node:crypto";
+var TERMINAL_LOGIN_TTL_MS = 10 * 6e4;
+var TERMINAL_LOGIN_POLL_MS = 2e3;
+var CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
+function normalizeUserCode(s) {
+  return s.toUpperCase().replace(/[^A-Z]/g, "");
+}
+function formatUserCode(n) {
+  return `${n.slice(0, 4)}-${n.slice(4)}`;
+}
+var TerminalLogins = class {
+  store;
+  config;
+  auth;
+  flows;
+  constructor(store, config, auth) {
+    this.store = store;
+    this.config = config;
+    this.auth = auth;
+    this.flows = new AuthFlows(store);
+  }
+  load(code) {
+    const id = normalizeUserCode(code);
+    const flow = this.flows.get("terminal_login", id);
+    if (!flow) {
+      throw new SwitchyardError("not_found", "This sign-in request expired or does not exist. Run `switchyard login` again.");
+    }
+    return { id, flow };
+  }
+  view(id, flow) {
+    return {
+      userCode: formatUserCode(id),
+      name: flow.name,
+      requestedFrom: flow.requestedFrom,
+      createdAt: flow.createdAt,
+      expiresAt: flow.expiresAt,
+      status: flow.status
+    };
+  }
+  start(name, requestedFrom) {
+    let id = "";
+    for (let attempt = 0; attempt < 5 && !id; attempt++) {
+      let candidate = "";
+      for (let i = 0; i < 8; i++)
+        candidate += CODE_ALPHABET[randomInt(0, CODE_ALPHABET.length)];
+      if (!this.flows.get("terminal_login", candidate))
+        id = candidate;
+    }
+    if (!id)
+      throw new SwitchyardError("internal", "Could not allocate a sign-in code");
+    const pollToken = newToken();
+    const now = this.store.now();
+    const createdAt = now.toISOString();
+    const expiresAt = new Date(now.getTime() + TERMINAL_LOGIN_TTL_MS).toISOString();
+    const flow = {
+      name,
+      requestedFrom,
+      createdAt,
+      expiresAt,
+      pollTokenHash: sha256(pollToken),
+      status: "pending",
+      result: null
+    };
+    this.flows.put("terminal_login", id, flow, TERMINAL_LOGIN_TTL_MS);
+    const userCode = formatUserCode(id);
+    return {
+      userCode,
+      pollToken,
+      verifyUrl: `${this.config.publicUrl}/terminal-login?code=${userCode}`,
+      expiresAt,
+      intervalMs: TERMINAL_LOGIN_POLL_MS
+    };
+  }
+  describe(code) {
+    const { id, flow } = this.load(code);
+    return this.view(id, flow);
+  }
+  approve(code) {
+    return this.store.tx(() => {
+      const { id, flow } = this.load(code);
+      if (flow.status !== "pending") {
+        throw new SwitchyardError("invalid_request", "This sign-in was already approved or denied");
+      }
+      const { device, credential } = this.auth.createDevice(flow.name, "terminal", "approval");
+      const next = {
+        ...flow,
+        status: "approved",
+        result: { deviceId: device.id, credential }
+      };
+      this.flows.update(id, next);
+      return this.view(id, next);
+    });
+  }
+  deny(code) {
+    return this.store.tx(() => {
+      const { id, flow } = this.load(code);
+      if (flow.status !== "pending") {
+        throw new SwitchyardError("invalid_request", "This sign-in was already approved or denied");
+      }
+      const next = { ...flow, status: "denied" };
+      this.flows.update(id, next);
+      return this.view(id, next);
+    });
+  }
+  claim(code, pollToken) {
+    const id = normalizeUserCode(code);
+    const flow = this.flows.get("terminal_login", id);
+    if (!flow || !safeEqualHex(sha256(pollToken), flow.pollTokenHash)) {
+      throw new SwitchyardError("unauthorized", "Unknown or expired sign-in");
+    }
+    if (flow.status === "pending")
+      return { status: "pending" };
+    this.flows.delete(id);
+    if (flow.status === "denied" || !flow.result)
+      return { status: "denied" };
+    return { status: "done", deviceId: flow.result.deviceId, credential: flow.result.credential };
+  }
+};
+
 // packages/coordinator/dist/server.js
 var MIN_HOST_ENROLL_SECRET_LENGTH = 32;
 var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
@@ -10604,6 +10766,8 @@ var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
   "/api/auth/oidc/begin",
   "/api/auth/oidc/callback",
   "/api/auth/oidc/claim",
+  "/api/auth/terminal/start",
+  "/api/auth/terminal/claim",
   "/api/hosts/enroll",
   "/api/hooks/:automationId",
   "/healthz",
@@ -10625,13 +10789,16 @@ function isApiLikePath(url) {
   }
   return path.startsWith("/api/") || path.startsWith("/ws/") || path.startsWith("/adapter-frames/");
 }
-function originOf2(url) {
+function originOf(url) {
   return new URL(url).origin;
 }
 function validateAuthOptions(opts) {
   if (opts.hostEnrollSecret !== void 0 && opts.hostEnrollSecret.length < MIN_HOST_ENROLL_SECRET_LENGTH) {
     throw new SwitchyardError("invalid_request", `SWITCHYARD_HOST_ENROLL_SECRET must be at least ${MIN_HOST_ENROLL_SECRET_LENGTH} characters`);
   }
+  if (!opts.oidc && opts.publicUrl && !isLoopbackUrl(opts.publicUrl)) {
+    throw new SwitchyardError("invalid_request", `Single sign-on is required for ${opts.publicUrl}: set SWITCHYARD_OIDC_ISSUER, SWITCHYARD_OIDC_CLIENT_ID and an owner (SWITCHYARD_OIDC_OWNER_*), see docs/auth.md. Without single sign-on, Switchyard runs only at a localhost public URL.`);
+  }
   if (opts.oidc && !hasOwnerMatch(opts.oidc.owner)) {
     throw new SwitchyardError("invalid_request", "OIDC needs an owner match: set SWITCHYARD_OIDC_OWNER_SUBJECT, SWITCHYARD_OIDC_OWNER_EMAIL or SWITCHYARD_OIDC_OWNER_GROUP");
   }
@@ -10656,7 +10823,7 @@ function createCoordinator(opts) {
   const config = {
     dataDir,
     publicUrl,
-    trustedOrigins: opts.trustedOrigins ?? [originOf2(publicUrl)],
+    trustedOrigins: opts.trustedOrigins ?? [originOf(publicUrl)],
     webDist: opts.webDist ? resolve3(opts.webDist) : null,
     secureCookies: publicUrl.startsWith("https:"),
     unreachableAfterMs: opts.unreachableAfterMs ?? 6e4,
@@ -10669,12 +10836,11 @@ function createCoordinator(opts) {
   hub.onListenerError = (name, err) => log.error({ err, event: name }, "event listener failed");
   const store = new Store2(db, hub, opts.clock);
   const owner = new Owner(store, config);
-  const auth = new Auth(store, config, hub, owner);
+  const auth = new Auth(store, config, hub);
   const adminToken = auth.ensureAdminToken();
-  if (config.oidc)
-    owner.markInitialized();
   const passkeys = new Passkeys(store, owner, config, auth);
   const oidc = config.oidc ? new Oidc(store, owner, config, auth) : null;
+  const terminalLogins = new TerminalLogins(store, config, auth);
   const limits = opts.rateLimits === false ? null : opts.rateLimits ?? {};
   const storeClock = () => store.now().getTime();
   const limiters = {
@@ -10703,6 +10869,7 @@ function createCoordinator(opts) {
     owner,
     passkeys,
     oidc,
+    terminalLogins,
     limiters,
     log,
     services: /* @__PURE__ */ new Map()
@@ -10810,10 +10977,10 @@ function createCoordinator(opts) {
       sweep();
       retentionTimer = setInterval(sweep, opts.retentionIntervalMs ?? 36e5);
       retentionTimer.unref();
-      if (!owner.isInitialized()) {
-        log.info("not set up yet: run `switchyard init` on this server");
+      if (!config.oidc && auth.activeDeviceCount() === 0 && passkeys.count() === 0) {
+        log.info("no device signed in yet: run `switchyard pair` on this machine");
         if (opts.setupHint !== false) {
-          process.stderr.write("Switchyard is not set up yet. Run `switchyard init` on this server to create the first sign-in link.\n");
+          process.stderr.write("No device is signed in yet. Run `switchyard pair` on this machine for a single-use sign-in link.\n");
         }
       }
     },
@@ -10834,207 +11001,56 @@ function createCoordinator(opts) {
   return coordinator;
 }
 
-// packages/cli/dist/commands/coordinator.js
-function parseListen(v) {
-  const s = v.trim();
-  let host = "0.0.0.0";
-  let portStr = s;
-  const v6 = s.match(/^\[([^\]]+)\]:(\d+)$/);
-  if (v6) {
-    host = v6[1];
-    portStr = v6[2];
-  } else if (s.includes(":")) {
-    const i = s.lastIndexOf(":");
-    host = s.slice(0, i) || "0.0.0.0";
-    portStr = s.slice(i + 1);
-  } else if (!/^\d+$/.test(s)) {
-    host = s;
-    portStr = String(DEFAULT_PORT);
-  }
-  const port = Number(portStr);
-  if (!Number.isInteger(port) || port < 0 || port > 65535) {
-    throw new CliError(`Invalid listen address "${v}" (expected host:port)`);
-  }
-  return { host, port };
+// packages/adapter-sdk/dist/discovery.js
+import { existsSync as existsSync6 } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { isAbsolute, join as join6, resolve as resolve4 } from "node:path";
+function piAgentDir(env = process.env, home = homedir2()) {
+  const fromEnv = env.PI_CODING_AGENT_DIR?.trim();
+  if (fromEnv)
+    return expandHome(fromEnv, home);
+  return join6(home, ".pi", "agent");
 }
-function parseOrigins(v) {
-  if (!v?.trim())
-    return void 0;
-  return v.split(",").map((o) => o.trim().replace(/\/+$/, "")).filter(Boolean);
+function defaultOwnerAdapterDir(home = homedir2()) {
+  return join6(home, ".config", "switchyard", "adapters");
 }
-var DEFAULT_OIDC_LABEL = "Sign in with single sign-on";
-var DEFAULT_OIDC_SCOPES = "openid profile email groups";
-function envValue(env, key) {
-  const v = env[key]?.trim();
-  return v ? v : void 0;
+function expandHome(p, home) {
+  if (p === "~")
+    return home;
+  if (p.startsWith("~/"))
+    return join6(home, p.slice(2));
+  return p;
 }
-function authOptionsFromEnv(env) {
-  const out = {};
-  const secret = envValue(env, "SWITCHYARD_HOST_ENROLL_SECRET");
-  if (secret)
-    out.hostEnrollSecret = secret;
-  const proxies = parseOrigins(env.SWITCHYARD_TRUSTED_PROXIES);
-  if (proxies)
-    out.trustedProxies = proxies;
-  const issuer = envValue(env, "SWITCHYARD_OIDC_ISSUER");
-  const clientId = envValue(env, "SWITCHYARD_OIDC_CLIENT_ID");
-  if (issuer && clientId) {
-    if (!/^https?:\/\//.test(issuer)) {
-      throw new CliError(`SWITCHYARD_OIDC_ISSUER must be an http(s) URL, got "${issuer}"`);
-    }
-    out.oidc = {
-      issuer,
-      clientId,
-      clientSecret: envValue(env, "SWITCHYARD_OIDC_CLIENT_SECRET") ?? null,
-      label: envValue(env, "SWITCHYARD_OIDC_LABEL") ?? DEFAULT_OIDC_LABEL,
-      scopes: envValue(env, "SWITCHYARD_OIDC_SCOPES") ?? DEFAULT_OIDC_SCOPES,
-      owner: {
-        subject: envValue(env, "SWITCHYARD_OIDC_OWNER_SUBJECT") ?? null,
-        email: envValue(env, "SWITCHYARD_OIDC_OWNER_EMAIL") ?? null,
-        group: envValue(env, "SWITCHYARD_OIDC_OWNER_GROUP") ?? null
-      }
-    };
-  } else if (issuer || clientId) {
-    throw new CliError("Single sign-on needs both SWITCHYARD_OIDC_ISSUER and SWITCHYARD_OIDC_CLIENT_ID");
-  }
-  return out;
+function isLocalPath(s) {
+  return s.startsWith(".") || s.startsWith("/") || s.startsWith("~") || /^[A-Za-z]:[\\/]/.test(s);
 }
-function coordinatorOptions(flags, env) {
-  const dataDir = flags.dataDir ? resolve4(flags.dataDir) : defaultDataDir(env);
-  const listen = parseListen(flags.listen ?? env.SWITCHYARD_LISTEN ?? `0.0.0.0:${DEFAULT_PORT}`);
-  const publicUrl = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim() || void 0;
-  if (publicUrl && !/^https?:\/\//.test(publicUrl)) {
-    throw new CliError(`Public URL must start with http:// or https://, got "${publicUrl}"`);
+function parseNpmName(spec) {
+  const s = spec.trim();
+  if (s.startsWith("@")) {
+    const at2 = s.indexOf("@", 1);
+    return at2 === -1 ? s : s.slice(0, at2);
   }
-  const trustedOrigins = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
-  return {
-    dataDir,
-    listen,
-    publicUrl,
-    trustedOrigins,
-    webDist: resolveWebDist(flags.webDist, env),
-    ...authOptionsFromEnv(env)
-  };
+  const at = s.indexOf("@");
+  return at === -1 ? s : s.slice(0, at);
 }
-function waitForSignal() {
-  return new Promise((res) => {
-    const on = (sig) => {
-      process.off("SIGINT", on);
-      process.off("SIGTERM", on);
-      res(sig);
-    };
-    process.on("SIGINT", on);
-    process.on("SIGTERM", on);
-  });
-}
-async function coordinatorStart(ctx, flags) {
-  const opts = coordinatorOptions(flags, ctx.env);
-  const c = createCoordinator(opts);
-  await c.start();
-  writeEndpoint(opts.dataDir, {
-    localUrl: localUrlFor(opts.listen, c.port),
-    publicUrl: c.config.publicUrl
-  });
-  ctx.err(`Switchyard coordinator listening on ${opts.listen.host}:${c.port} (public URL ${c.config.publicUrl}; data ${opts.dataDir}${opts.webDist ? "" : "; web app not found, API only"})`);
-  const sig = await waitForSignal();
-  ctx.err(`${sig}: stopping coordinator`);
-  await c.stop();
-}
-function localUrlFor(listen, port) {
-  const h = listen.host ?? "0.0.0.0";
-  const host = h === "0.0.0.0" || h === "::" || h === "" ? "127.0.0.1" : h.includes(":") ? `[${h}]` : h;
-  return `http://${host}:${port}`;
-}
-function dataDirOf(flags, env) {
-  return flags.dataDir ? resolve4(flags.dataDir) : defaultDataDir(env);
-}
-function coordinatorBackup(ctx, out, flags) {
-  const r = backup(dataDirOf(flags, ctx.env), out);
-  ctx.out(`Backed up to ${r.file} (schema ${r.migrationLevel})`);
-}
-function coordinatorRestore(ctx, file, flags) {
-  const r = restore(dataDirOf(flags, ctx.env), file);
-  ctx.out(`Restored ${r.restoredFrom} (schema ${r.migrationLevel}).`);
-  if (r.previous)
-    ctx.out(`The previous database was kept as ${r.previous}`);
-  if (r.migrationLevel < LATEST_MIGRATION) {
-    ctx.out("Migrations to the current schema run when the coordinator next starts.");
-  }
-}
-function coordinatorMigrate(ctx, flags) {
-  const dataDir = dataDirOf(flags, ctx.env);
-  const holder = lockHolder(dataDir);
-  if (holder !== null) {
-    throw new CliError(`Coordinator (pid ${holder}) is running on ${dataDir}; it migrated at start`);
-  }
-  const path = dbPath(dataDir);
-  const existed = existsSync6(path);
-  mkdirSync4(dataDir, { recursive: true });
-  const db = openDb(path);
-  try {
-    const before = existed ? migrationLevel(db) : 0;
-    migrate(db);
-    const after = migrationLevel(db);
-    ctx.out(before === after ? `Schema is current (level ${after}) at ${path}` : `Migrated ${path} from level ${before} to ${after}`);
-  } finally {
-    db.close();
-  }
-}
-
-// packages/cli/dist/commands/doctor.js
-import { execFile as execFile3 } from "node:child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
-
-// packages/adapter-sdk/dist/discovery.js
-import { existsSync as existsSync7 } from "node:fs";
-import { readFile } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { isAbsolute, join as join6, resolve as resolve5 } from "node:path";
-function piAgentDir(env = process.env, home = homedir2()) {
-  const fromEnv = env.PI_CODING_AGENT_DIR?.trim();
-  if (fromEnv)
-    return expandHome(fromEnv, home);
-  return join6(home, ".pi", "agent");
-}
-function defaultOwnerAdapterDir(home = homedir2()) {
-  return join6(home, ".config", "switchyard", "adapters");
-}
-function expandHome(p, home) {
-  if (p === "~")
-    return home;
-  if (p.startsWith("~/"))
-    return join6(home, p.slice(2));
-  return p;
-}
-function isLocalPath(s) {
-  return s.startsWith(".") || s.startsWith("/") || s.startsWith("~") || /^[A-Za-z]:[\\/]/.test(s);
-}
-function parseNpmName(spec) {
-  const s = spec.trim();
-  if (s.startsWith("@")) {
-    const at2 = s.indexOf("@", 1);
-    return at2 === -1 ? s : s.slice(0, at2);
-  }
-  const at = s.indexOf("@");
-  return at === -1 ? s : s.slice(0, at);
-}
-function parseGitSource(source) {
-  let s = source.trim();
-  const prefixed = s.startsWith("git:");
-  if (prefixed)
-    s = s.slice(4).trim();
-  if (!prefixed && !/^(https?|ssh|git):\/\//i.test(s))
-    return null;
-  s = s.replace(/^(https?|ssh|git):\/\//i, "");
-  s = s.replace(/^[^@/]+@/, "");
-  s = s.replace(/^([^/:]+):(?!\d)/, "$1/");
-  s = s.split("#")[0] ?? s;
-  const [hostPart, ...rest] = s.split("/");
-  const host = (hostPart ?? "").replace(/:\d+$/, "");
-  const path = rest.join("/").replace(/@[^/]*$/, "").replace(/\/+$/, "").replace(/\.git$/, "");
-  if (!host || !path)
-    return null;
-  return { host, path };
+function parseGitSource(source) {
+  let s = source.trim();
+  const prefixed = s.startsWith("git:");
+  if (prefixed)
+    s = s.slice(4).trim();
+  if (!prefixed && !/^(https?|ssh|git):\/\//i.test(s))
+    return null;
+  s = s.replace(/^(https?|ssh|git):\/\//i, "");
+  s = s.replace(/^[^@/]+@/, "");
+  s = s.replace(/^([^/:]+):(?!\d)/, "$1/");
+  s = s.split("#")[0] ?? s;
+  const [hostPart, ...rest] = s.split("/");
+  const host = (hostPart ?? "").replace(/:\d+$/, "");
+  const path = rest.join("/").replace(/@[^/]*$/, "").replace(/\/+$/, "").replace(/\.git$/, "");
+  if (!host || !path)
+    return null;
+  return { host, path };
 }
 function parsePiPackageSource(source) {
   const s = source.trim();
@@ -11061,7 +11077,7 @@ function piPackageDirCandidates(source, agentDir, opts = {}) {
       return [join6(agentDir, "git", parsed.host, parsed.path)];
     case "local": {
       const p = expandHome(parsed.path, home);
-      return [isAbsolute(p) ? p : resolve5(agentDir, p)];
+      return [isAbsolute(p) ? p : resolve4(agentDir, p)];
     }
   }
 }
@@ -11087,7 +11103,7 @@ async function discoverPiPackages(opts = {}) {
   };
   const diag = (level, message) => out.diagnostics.push({ sessionId: null, adapterId: null, level, message });
   const settingsPath = join6(agentDir, "settings.json");
-  if (!existsSync7(settingsPath))
+  if (!existsSync6(settingsPath))
     return out;
   let settings;
   try {
@@ -11109,14 +11125,14 @@ async function discoverPiPackages(opts = {}) {
       home,
       globalNpmRoot: opts.globalNpmRoot
     });
-    const dir = candidates.find((c) => existsSync7(c));
+    const dir = candidates.find((c) => existsSync6(c));
     if (!dir) {
       diag("warning", `Pi package ${source} could not be resolved (looked in ${candidates.join(", ")}); any adapter it provides is not loaded.`);
       continue;
     }
     let pkg = null;
     const pkgPath = join6(dir, "package.json");
-    if (existsSync7(pkgPath)) {
+    if (existsSync6(pkgPath)) {
       try {
         pkg = await readJson(pkgPath);
       } catch (err) {
@@ -11268,7 +11284,7 @@ function genericWidgetPanel(lines) {
 
 // packages/adapter-sdk/dist/manifest.js
 import { readFile as readFile2 } from "node:fs/promises";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, resolve as resolve6 } from "node:path";
+import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, resolve as resolve5 } from "node:path";
 import { validRange } from "semver";
 import { z as z18 } from "zod";
 var MANIFEST_FILE = "switchyard-adapter.json";
@@ -11312,7 +11328,7 @@ function parseManifest(input, path = null) {
   throw new ManifestError(`invalid adapter manifest: ${issues}`, path);
 }
 async function loadManifest(pathOrDir) {
-  const abs = resolve6(pathOrDir);
+  const abs = resolve5(pathOrDir);
   const manifestPath = abs.endsWith(".json") ? abs : join7(abs, MANIFEST_FILE);
   let raw;
   try {
@@ -11332,8 +11348,8 @@ async function loadManifest(pathOrDir) {
     manifest,
     manifestPath,
     dir,
-    serverPath: resolve6(dir, manifest.server),
-    webRendererPath: manifest.webRenderer ? resolve6(dir, manifest.webRenderer) : null
+    serverPath: resolve5(dir, manifest.server),
+    webRendererPath: manifest.webRenderer ? resolve5(dir, manifest.webRenderer) : null
   };
 }
 
@@ -11388,9 +11404,9 @@ function responseFitsRequest(req, resp) {
 }
 
 // packages/adapter-sdk/dist/registry.js
-import { existsSync as existsSync8 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import { readdir, readFile as readFile3 } from "node:fs/promises";
-import { join as join8, resolve as resolve7 } from "node:path";
+import { join as join8, resolve as resolve6 } from "node:path";
 import { pathToFileURL } from "node:url";
 import { satisfies } from "semver";
 
@@ -11474,6 +11490,10 @@ var AdapterSession = class {
     this.activeTools.set(e.toolCallId, e);
     await this.callAll("onToolStart", e);
   }
+  /** `tool_execution_update`: runs `onToolUpdate` hooks with the partial result. */
+  async onToolUpdate(e) {
+    await this.callAll("onToolUpdate", e);
+  }
   /** `tool_execution_end`: runs `onToolEnd` hooks, then expires answers queued for the call. */
   async onToolEnd(e) {
     try {
@@ -11811,7 +11831,7 @@ function isServerAdapter(x) {
 async function loadAdapterFromDir(pathOrDir, tier) {
   const m = await loadManifest(pathOrDir);
   const warnings = [];
-  if (!existsSync8(m.serverPath)) {
+  if (!existsSync7(m.serverPath)) {
     throw new AdapterLoadError(`server module ${m.serverPath} does not exist`, m.manifest);
   }
   let mod;
@@ -11832,7 +11852,7 @@ async function loadAdapterFromDir(pathOrDir, tier) {
     throw new AdapterLoadError(`${m.serverPath} must default-export a ServerAdapter object or factory`, m.manifest);
   }
   let webRendererPath = m.webRendererPath;
-  if (webRendererPath && !existsSync8(webRendererPath)) {
+  if (webRendererPath && !existsSync7(webRendererPath)) {
     warnings.push(`web renderer ${webRendererPath} does not exist; portable panels are used`);
     webRendererPath = null;
   }
@@ -11849,12 +11869,12 @@ async function loadAdapterFromDir(pathOrDir, tier) {
   };
 }
 async function subdirsWithManifest(root) {
-  if (!existsSync8(root))
+  if (!existsSync7(root))
     return [];
-  if (existsSync8(join8(root, MANIFEST_FILE)))
+  if (existsSync7(join8(root, MANIFEST_FILE)))
     return [root];
   const entries = await readdir(root, { withFileTypes: true });
-  return entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => join8(root, e.name)).filter((d) => existsSync8(join8(d, MANIFEST_FILE))).sort();
+  return entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => join8(root, e.name)).filter((d) => existsSync7(join8(d, MANIFEST_FILE))).sort();
 }
 var AdapterRegistry = class {
   opts;
@@ -11872,7 +11892,7 @@ var AdapterRegistry = class {
     this.diags = [];
     const candidates = [];
     if (opts.projectRoot) {
-      for (const d of await this.safeList(resolve7(opts.projectRoot, PROJECT_ADAPTER_DIR))) {
+      for (const d of await this.safeList(resolve6(opts.projectRoot, PROJECT_ADAPTER_DIR))) {
         candidates.push({ tier: "project", path: d });
       }
     }
@@ -11887,7 +11907,7 @@ var AdapterRegistry = class {
         this.diagnostic("warning", null, `Cannot read ${pkgDir}/package.json: ${err.message}`);
       }
       for (const e of entries)
-        candidates.push({ tier: "plugin", path: resolve7(pkgDir, e) });
+        candidates.push({ tier: "plugin", path: resolve6(pkgDir, e) });
     }
     const loaded = [];
     for (const c of candidates) {
@@ -12158,7 +12178,7 @@ async function runChecks(path, commands, opts = {}) {
 
 // packages/host-agent/dist/files.js
 import { lstat, readdir as readdir2, readFile as readFile4, realpath, stat } from "node:fs/promises";
-import { join as join9, relative, resolve as resolve8, sep } from "node:path";
+import { join as join9, relative, resolve as resolve7, sep } from "node:path";
 var MAX_READ_BYTES = 1024 * 1024;
 var BINARY_SNIFF_BYTES = 8e3;
 function isInside(root, target) {
@@ -12182,7 +12202,7 @@ async function resolveInside(root, rel) {
   if (rel.includes("\0"))
     throw new SwitchyardError("invalid_request", "Invalid path");
   const rootReal = await realRoot(root);
-  const target = resolve8(rootReal, rel.replace(/^[/\\]+/, ""));
+  const target = resolve7(rootReal, rel.replace(/^[/\\]+/, ""));
   if (!isInside(rootReal, target)) {
     throw new SwitchyardError("forbidden", "Path is outside the workspace");
   }
@@ -12261,7 +12281,7 @@ async function readWorkspaceFile(root, file) {
 import { execFile } from "node:child_process";
 import { appendFile, lstat as lstat2, mkdir, readFile as readFile5, realpath as realpath2, stat as stat2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join10, resolve as resolve9, sep as sep2 } from "node:path";
+import { join as join10, resolve as resolve8, sep as sep2 } from "node:path";
 var MAX_BUFFER = 64 * 1024 * 1024;
 var EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 var MAX_PATCH_BYTES = 2 * 1024 * 1024;
@@ -12338,7 +12358,7 @@ async function realpathOr(path) {
 }
 async function commonDirOf(path) {
   const { stdout } = await runGit(path, ["rev-parse", "--git-common-dir"]);
-  return realpathOr(resolve9(path, stdout.trim()));
+  return realpathOr(resolve8(path, stdout.trim()));
 }
 function notARepo(path) {
   return new SwitchyardError("not_a_git_repo", `${path} is not a git repository`);
@@ -12911,7 +12931,7 @@ function toErrorBody(err) {
 function queueKey(command) {
   if (command.type === "checks.run")
     return `checks:${command.sessionId}`;
-  if (command.type === "session.answer" || command.type === "session.abort" || command.type === "session.setControl" || command.type === "session.adapterAction" || command.type === "session.snapshot" || command.type === "session.models" || command.type === "session.commands") {
+  if (command.type === "session.answer" || command.type === "session.abort" || command.type === "session.setControl" || command.type === "session.adapterAction" || command.type === "session.snapshot" || command.type === "session.models" || command.type === "session.commands" || command.type === "session.complete" || command.type === "session.tree" || command.type === "session.export" || command.type === "session.reload") {
     return `control:${command.sessionId}`;
   }
   if ("sessionId" in command && typeof command.sessionId === "string") {
@@ -13070,6 +13090,16 @@ var CommandRouter = class {
         return sup.models(c.sessionId);
       case "session.commands":
         return sup.commands(c.sessionId);
+      case "session.complete":
+        return sup.complete(c.sessionId, c.text);
+      case "session.tree":
+        return sup.tree(c.sessionId);
+      case "session.branch":
+        return sup.branch(c.sessionId, c.entryId, c.fork);
+      case "session.reload":
+        return sup.reload(c.sessionId);
+      case "session.export":
+        return sup.exportSession(c.sessionId);
       case "session.setModel":
         return sup.setModel(c.sessionId, c.provider, c.modelId);
       case "session.setThinking":
@@ -13112,8 +13142,8 @@ var CommandRouter = class {
 };
 
 // packages/host-agent/dist/config.js
-import { chmodSync as chmodSync3, existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync5, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir4, hostname as hostname2 } from "node:os";
+import { chmodSync as chmodSync3, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir4, hostname } from "node:os";
 import { dirname as dirname5, join as join12 } from "node:path";
 import { z as z21 } from "zod";
 var HostConfigSchema = z21.object({
@@ -13148,11 +13178,11 @@ function statePaths(stateDir) {
     logs: join12(stateDir, "logs")
   };
   for (const d of [p.root, p.runtime, p.logs])
-    mkdirSync5(d, { recursive: true, mode: 448 });
+    mkdirSync4(d, { recursive: true, mode: 448 });
   return p;
 }
 function loadConfig(path) {
-  if (!existsSync9(path)) {
+  if (!existsSync8(path)) {
     throw new SwitchyardError("not_found", `Host config ${path} not found; enroll this host first (switchyard host enroll)`);
   }
   let raw;
@@ -13171,7 +13201,7 @@ function loadConfig(path) {
 }
 function saveConfig(path, config) {
   const cfg = HostConfigSchema.parse(config);
-  mkdirSync5(dirname5(path), { recursive: true, mode: 448 });
+  mkdirSync4(dirname5(path), { recursive: true, mode: 448 });
   const tmp = `${path}.${process.pid}.tmp`;
   writeFileSync4(tmp, `${JSON.stringify(cfg, null, 2)}
 `, { mode: 384 });
@@ -13249,16 +13279,16 @@ function abortError(signal) {
 async function waitForConfig(opts) {
   const { configPath, env, log, signal } = opts;
   const t = { ...DEFAULT_TIMING, ...opts.timing };
-  if (existsSync9(configPath))
+  if (existsSync8(configPath))
     return loadConfig(configPath);
   const secret = env.SWITCHYARD_HOST_ENROLL_SECRET?.trim();
   const coordinatorUrl = env.SWITCHYARD_COORDINATOR_URL?.trim();
   if (secret && coordinatorUrl) {
-    const name = env.SWITCHYARD_HOST_NAME?.trim() || hostname2();
+    const name = env.SWITCHYARD_HOST_NAME?.trim() || hostname();
     for (; ; ) {
       if (signal?.aborted)
         throw abortError(signal);
-      if (existsSync9(configPath))
+      if (existsSync8(configPath))
         return loadConfig(configPath);
       try {
         const enrolled = await enroll({
@@ -13288,7 +13318,7 @@ async function waitForConfig(opts) {
   for (; ; ) {
     if (signal?.aborted)
       throw abortError(signal);
-    if (existsSync9(configPath)) {
+    if (existsSync8(configPath)) {
       try {
         return loadConfig(configPath);
       } catch (err) {
@@ -13308,7 +13338,7 @@ async function waitForConfig(opts) {
 }
 
 // packages/host-agent/dist/db/index.js
-import { mkdirSync as mkdirSync6 } from "node:fs";
+import { mkdirSync as mkdirSync5 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
@@ -13392,7 +13422,7 @@ var HostDb = class {
   constructor(path) {
     this.path = path;
     if (path !== ":memory:")
-      mkdirSync6(dirname6(path), { recursive: true });
+      mkdirSync5(dirname6(path), { recursive: true });
     this.db = new DatabaseSync3(path);
     this.db.exec("PRAGMA journal_mode = WAL");
     this.db.exec("PRAGMA foreign_keys = ON");
@@ -13468,15 +13498,15 @@ var HostDb = class {
     else
       fn();
   }
-  run(sql3, params = []) {
-    const r = this.db.prepare(sql3).run(...params);
+  run(sql4, params = []) {
+    const r = this.db.prepare(sql4).run(...params);
     return { changes: Number(r.changes), lastInsertRowid: Number(r.lastInsertRowid) };
   }
-  get(sql3, params = []) {
-    return this.db.prepare(sql3).get(...params);
+  get(sql4, params = []) {
+    return this.db.prepare(sql4).get(...params);
   }
-  all(sql3, params = []) {
-    return this.db.prepare(sql3).all(...params);
+  all(sql4, params = []) {
+    return this.db.prepare(sql4).all(...params);
   }
   // ---- meta ----
   getMeta(key) {
@@ -13486,12 +13516,12 @@ var HostDb = class {
     this.run("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value", [key, value]);
   }
   // ---- JSON row helpers ----
-  getJson(sql3, params = []) {
-    const r = this.get(sql3, params);
+  getJson(sql4, params = []) {
+    const r = this.get(sql4, params);
     return r ? JSON.parse(r.json) : void 0;
   }
-  allJson(sql3, params = []) {
-    return this.all(sql3, params).map((r) => JSON.parse(r.json));
+  allJson(sql4, params = []) {
+    return this.all(sql4, params).map((r) => JSON.parse(r.json));
   }
   close() {
     try {
@@ -14150,7 +14180,7 @@ ${stderr}`));
 import { accessSync, constants, readFileSync as readFileSync6, realpathSync } from "node:fs";
 import { open, readdir as readdir4, readFile as readFile6, stat as stat4 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { delimiter, dirname as dirname7, join as join13, resolve as resolve10 } from "node:path";
+import { delimiter, dirname as dirname7, join as join13, resolve as resolve9 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 
 // packages/pi-runtime/dist/transcript.js
@@ -14413,7 +14443,7 @@ async function listImportable(sessionsRoot = defaultSessionsRoot(), now = Date.n
 }
 function findOnPath(bin) {
   if (bin.includes("/"))
-    return resolve10(bin);
+    return resolve9(bin);
   for (const dir of (process.env.PATH ?? "").split(delimiter)) {
     if (!dir)
       continue;
@@ -14672,14 +14702,117 @@ function writeJsonl(stream, value) {
   });
 }
 
+// packages/pi-runtime/dist/pi-session-manager.js
+import { existsSync as existsSync9 } from "node:fs";
+import { dirname as dirname8, join as join14 } from "node:path";
+import { pathToFileURL as pathToFileURL3 } from "node:url";
+var managerPromise = null;
+function loadPiSessionManager(piBin = "pi") {
+  managerPromise ??= (async () => {
+    const root = resolvePiPackageRoot(piBin);
+    if (!root)
+      return null;
+    try {
+      const mod = await import(pathToFileURL3(join14(root, "dist", "index.js")).href);
+      return mod.SessionManager ?? null;
+    } catch {
+      return null;
+    }
+  })();
+  return managerPromise;
+}
+function messageText(message) {
+  const c = message?.content;
+  if (typeof c === "string")
+    return c;
+  if (!Array.isArray(c))
+    return "";
+  return c.filter((p) => p?.type === "text" && typeof p.text === "string").map((p) => p.text).join(" ");
+}
+var MAX_ROWS = 2e3;
+function treeRows(sm) {
+  const active = new Set((sm.getBranch() ?? []).map((e) => e.id));
+  const leafId = sm.getLeafId?.() ?? null;
+  const rows = [];
+  const walk = (nodes, depth, parentId) => {
+    for (const node of nodes) {
+      if (rows.length >= MAX_ROWS)
+        return;
+      const entry = node.entry;
+      const role = entry?.message?.role;
+      const shown = entry?.type === "message" && (role === "user" || role === "assistant");
+      if (shown) {
+        const raw = messageText(entry.message).replace(/\s+/g, " ").trim();
+        const text = raw ? raw.slice(0, 160) : role === "assistant" ? "(tool calls)" : "";
+        rows.push({
+          entryId: entry.id,
+          parentId,
+          depth,
+          role,
+          text,
+          activeBranch: active.has(entry.id),
+          leaf: entry.id === leafId,
+          label: node.label ?? null,
+          at: typeof entry.timestamp === "string" ? entry.timestamp : null
+        });
+        walk(node.children ?? [], depth + 1, entry.id);
+      } else {
+        walk(node.children ?? [], depth, parentId);
+      }
+    }
+  };
+  walk(sm.getTree() ?? [], 0, null);
+  if (!rows.some((r) => r.leaf)) {
+    const last = [...rows].reverse().find((r) => r.activeBranch);
+    if (last)
+      last.leaf = true;
+  }
+  return rows;
+}
+async function branchSession(sessionFile, entryId, fork, piBin, load = loadPiSessionManager, checkFile = true) {
+  const SM = await load(piBin);
+  if (!SM) {
+    throw new SwitchyardError("invalid_request", "Pi's SessionManager could not be loaded on this host");
+  }
+  const sm = SM.open(sessionFile, dirname8(sessionFile));
+  let target;
+  let prefill = null;
+  if (fork) {
+    const e = entryId ? sm.getEntry(entryId) : void 0;
+    if (!e || e.type !== "message" || e.message?.role !== "user") {
+      throw new SwitchyardError("invalid_request", "Pick one of your messages to fork from");
+    }
+    prefill = messageText(e.message);
+    target = e.parentId ?? null;
+    if (!target)
+      return { sessionFile: null, prefill };
+  } else {
+    target = entryId ?? sm.getLeafId();
+    if (!target) {
+      throw new SwitchyardError("invalid_request", "This session has nothing to branch yet");
+    }
+  }
+  const hasMessages = (sm.getBranch(target) ?? []).some((e) => e?.type === "message" && (e.message?.role === "user" || e.message?.role === "assistant"));
+  if (!hasMessages) {
+    if (fork)
+      return { sessionFile: null, prefill };
+    throw new SwitchyardError("invalid_request", "There is no conversation before that point");
+  }
+  const file = sm.createBranchedSession(target);
+  if (!file || checkFile && !existsSync9(file)) {
+    throw new SwitchyardError("invalid_request", "Pi did not write a branched session");
+  }
+  return { sessionFile: file, prefill };
+}
+
 // packages/pi-runtime/dist/rpc-process.js
 import { spawn as spawn2 } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { EventEmitter as EventEmitter3 } from "node:events";
-import { chmodSync as chmodSync4, existsSync as existsSync10, mkdirSync as mkdirSync7, rmSync as rmSync2 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync10, mkdirSync as mkdirSync6, rmSync as rmSync2 } from "node:fs";
 import { createServer } from "node:net";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function bridgeExtensionPath() {
   const sibling = fileURLToPath2(new URL("./bridge/switchyard-bridge.js", import.meta.url));
@@ -14699,11 +14832,11 @@ var MAX_SOCKET_PATH = 100;
 function shortSocketPath(runtimeDir, prefix) {
   const name = `${prefix}-${randomUUID().slice(0, 8)}.sock`;
   let dir = runtimeDir;
-  if (join14(dir, name).length > MAX_SOCKET_PATH) {
-    dir = join14("/tmp", `switchyard-${process.getuid?.() ?? "u"}`);
+  if (join15(dir, name).length > MAX_SOCKET_PATH) {
+    dir = join15("/tmp", `switchyard-${process.getuid?.() ?? "u"}`);
   }
-  mkdirSync7(dir, { recursive: true, mode: 448 });
-  return join14(dir, name);
+  mkdirSync6(dir, { recursive: true, mode: 448 });
+  return join15(dir, name);
 }
 var PiRpcProcess = class _PiRpcProcess extends EventEmitter3 {
   child;
@@ -14756,7 +14889,7 @@ var PiRpcProcess = class _PiRpcProcess extends EventEmitter3 {
     let proc = null;
     const early = [];
     if (useBridge) {
-      socketPath = shortSocketPath(opts.runtimeDir ?? join14(tmpdir2(), "switchyard"), "bridge");
+      socketPath = shortSocketPath(opts.runtimeDir ?? join15(tmpdir2(), "switchyard"), "bridge");
       server = createServer((socket) => {
         if (proc)
           proc.attachBridgeSocket(socket);
@@ -14943,14 +15076,46 @@ import { randomUUID as randomUUID2 } from "node:crypto";
 import { EventEmitter as EventEmitter5 } from "node:events";
 import { existsSync as existsSync12 } from "node:fs";
 
+// packages/pi-runtime/dist/command-hints.js
+import { readFile as readFile7 } from "node:fs/promises";
+function parseArgumentHint(markdown) {
+  const lines = markdown.split(/\r?\n/);
+  if (lines[0] !== "---")
+    return null;
+  const end = lines.indexOf("---", 1);
+  if (end < 0)
+    return null;
+  for (const line of lines.slice(1, end)) {
+    const m = /^argument-hint:\s*(.*)$/.exec(line);
+    if (!m)
+      continue;
+    let value = (m[1] ?? "").trim();
+    const q = value[0];
+    if (value.length >= 2 && (q === '"' || q === "'") && value.endsWith(q)) {
+      value = value.slice(1, -1).trim();
+    }
+    return value ? value.slice(0, 80) : null;
+  }
+  return null;
+}
+async function readArgumentHint(path) {
+  if (!path.endsWith(".md"))
+    return null;
+  try {
+    return parseArgumentHint(await readFile7(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
 // packages/pi-runtime/dist/terminal-process.js
 import { spawn as spawn3 } from "node:child_process";
 import { EventEmitter as EventEmitter4 } from "node:events";
-import { closeSync, existsSync as existsSync11, mkdirSync as mkdirSync8, openSync, readFileSync as readFileSync7 } from "node:fs";
+import { closeSync, existsSync as existsSync11, mkdirSync as mkdirSync7, openSync, readFileSync as readFileSync7 } from "node:fs";
 import { createRequire } from "node:module";
 import { createConnection } from "node:net";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename2, dirname as dirname8, join as join15 } from "node:path";
+import { basename as basename2, dirname as dirname9, join as join16 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveDist(rel) {
   const sibling = fileURLToPath3(new URL(`./${rel}`, import.meta.url));
@@ -15036,7 +15201,7 @@ var PiTerminalProcess = class _PiTerminalProcess extends EventEmitter4 {
   }
   /** Start a holder running interactive Pi and attach to it. */
   static async start(opts) {
-    const runtimeDir = opts.runtimeDir ?? join15(tmpdir3(), "switchyard");
+    const runtimeDir = opts.runtimeDir ?? join16(tmpdir3(), "switchyard");
     const socketPath = shortSocketPath(runtimeDir, "term");
     const env = {};
     for (const [k, v] of Object.entries({ ...process.env, ...opts.env ?? {} })) {
@@ -15057,8 +15222,8 @@ var PiTerminalProcess = class _PiTerminalProcess extends EventEmitter4 {
       cols: opts.cols ?? 120,
       rows: opts.rows ?? 40
     };
-    const logPath = opts.logPath ?? join15(dirname8(socketPath), `${basename2(socketPath, ".sock")}.log`);
-    mkdirSync8(dirname8(logPath), { recursive: true, mode: 448 });
+    const logPath = opts.logPath ?? join16(dirname9(socketPath), `${basename2(socketPath, ".sock")}.log`);
+    mkdirSync7(dirname9(logPath), { recursive: true, mode: 448 });
     const fd = openSync(logPath, "a", 384);
     try {
       const child = spawn3(process.execPath, [holderScriptPath()], {
@@ -15210,6 +15375,7 @@ var PiTerminalProcess = class _PiTerminalProcess extends EventEmitter4 {
           type: rec.event === "ui_prompt_end" ? "ui_prompt_end" : "ui_prompt_start",
           kind: typeof rec.kind === "string" ? rec.kind : "unknown",
           title: typeof rec.title === "string" ? rec.title : null,
+          remoteBacked: rec.remoteBacked === true,
           seq: ++this.seq,
           at: (/* @__PURE__ */ new Date()).toISOString(),
           pid: this.pid ?? 0
@@ -15517,7 +15683,22 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
     } else {
       data = await this.call(proc, { type: "follow_up", ...body });
     }
-    return data?.disposition ?? "started";
+    if (data?.disposition === "view") {
+      const view = CommandView.safeParse(data.view);
+      if (!view.success) {
+        throw new SwitchyardError("invalid_request", "The command returned an invalid view");
+      }
+      return { disposition: "view", view: view.data };
+    }
+    return { disposition: data?.disposition ?? "started", view: null };
+  }
+  /** Reload Pi's extensions, skills, prompts and context files (terminal sessions only). */
+  async reload() {
+    const proc = this.requireAlive();
+    if (!(proc instanceof PiTerminalProcess)) {
+      throw new SwitchyardError("invalid_request", "Reload needs a terminal session");
+    }
+    await this.call(proc, { type: "reload" }, 1e4);
   }
   /** Abort the current run; with `clearQueue`, first clear and return queued messages. */
   async abort(clearQueue = false) {
@@ -15569,19 +15750,36 @@ var ManagedSession = class _ManagedSession extends EventEmitter5 {
       type: "get_commands"
     });
     const out = [];
+    const hints = [];
     for (const c of data?.commands ?? []) {
       if (typeof c?.name !== "string" || !c.name)
         continue;
       if (c.source !== "extension" && c.source !== "prompt" && c.source !== "skill")
         continue;
-      out.push({
+      const entry = {
         name: c.name,
         description: typeof c.description === "string" ? c.description : null,
-        source: c.source
-      });
+        source: c.source,
+        argumentHint: null
+      };
+      if (c.source === "prompt" && typeof c.sourceInfo?.path === "string") {
+        hints.push(readArgumentHint(c.sourceInfo.path).then((h) => {
+          entry.argumentHint = h;
+        }));
+      }
+      out.push(entry);
     }
+    await Promise.all(hints);
     return out.sort((a, b) => a.name.localeCompare(b.name));
   }
+  /** Pi's argument completions for a draft such as `/model cl` (terminal sessions only). */
+  async complete(text) {
+    const proc = this.requireAlive();
+    if (!(proc instanceof PiTerminalProcess))
+      return { items: [], prefix: "" };
+    const data = await this.call(proc, { type: "complete", text }, 5e3);
+    return SessionCompleteResult.parse({ items: data?.items ?? [], prefix: data?.prefix ?? "" });
+  }
   async setModel(provider, modelId) {
     await this.call(this.requireAlive(), { type: "set_model", provider, modelId });
     await this.refreshModelState();
@@ -16181,7 +16379,8 @@ ${output}`.trimEnd() }));
 
 // packages/host-agent/dist/supervisor.js
 import { existsSync as existsSync13, realpathSync as realpathSync2, statSync } from "node:fs";
-import { join as join16, sep as sep3 } from "node:path";
+import { readFile as readFile8, stat as stat5 } from "node:fs/promises";
+import { basename as basename3, dirname as dirname10, join as join17, sep as sep3 } from "node:path";
 var RESTART_NOTICE = "Host agent restarted; resume to continue";
 var QUEUED_ANSWER_SUMMARY = "Answered from your earlier form";
 var PI_CLOSED_SUMMARY = "Pi closed this question (timeout or abort)";
@@ -16547,6 +16746,8 @@ var SessionSupervisor = class {
         nextOrder = 0;
       }
     }
+    const t0 = Date.now();
+    let adaptersMs = 0;
     const now = nowIso();
     let control = { controlRevision: p.controlRevision, controlMode: p.controlMode };
     for (const c of [prev, this.pendingControl.get(p.sessionId)]) {
@@ -16568,7 +16769,7 @@ var SessionSupervisor = class {
       profile: p.profile,
       nativeHandle,
       runtime: "starting",
-      runtimeDetail: null,
+      runtimeDetail: "Starting Pi\u2026",
       controlRevision: control.controlRevision,
       controlMode: control.controlMode,
       origin: p.origin,
@@ -16588,7 +16789,11 @@ var SessionSupervisor = class {
     const l = this.newLive(rec);
     this.live.set(rec.id, l);
     this.db.tx(() => this.saveAndEmit(rec));
-    await this.openAdapters(l, p.workspacePath);
+    const adaptersStart = Date.now();
+    this.enqueue(l, async () => {
+      await this.openAdapters(l, p.workspacePath);
+      adaptersMs = Date.now() - adaptersStart;
+    });
     const ms = new ManagedSession({
       sessionId: rec.id,
       cwd: p.workspacePath,
@@ -16604,8 +16809,16 @@ var SessionSupervisor = class {
     });
     l.ms = ms;
     this.wire(l, ms);
+    const piStart = Date.now();
     try {
       await ms.start();
+      this.opts.log.info({
+        sessionId: rec.id,
+        piStartMs: Date.now() - piStart,
+        adaptersMs,
+        totalMs: Date.now() - t0,
+        transport: ms.transport
+      }, "session started");
       const socketPath = ms.terminalSocket;
       rec.terminal = socketPath ? { socketPath } : null;
       this.db.tx(() => this.saveAndEmit(rec));
@@ -16639,8 +16852,8 @@ var SessionSupervisor = class {
   }
   async prompt(sessionId, text, images, mode) {
     const ms = this.requireLive(sessionId);
-    const disposition = await ms.prompt(text, images, mode);
-    return { disposition };
+    const { disposition, view } = await ms.prompt(text, images, mode);
+    return { disposition, view };
   }
   async abort(sessionId, clearQueue) {
     const ms = this.requireLive(sessionId);
@@ -16676,6 +16889,41 @@ var SessionSupervisor = class {
   async commands(sessionId) {
     return { commands: await this.requireLive(sessionId).commands() };
   }
+  async complete(sessionId, text) {
+    return this.requireLive(sessionId).complete(text);
+  }
+  async reload(sessionId) {
+    await this.requireLive(sessionId).reload();
+    return { ok: true };
+  }
+  piFile(sessionId) {
+    const file = this.requireRecord(sessionId).nativeHandle?.sessionFile;
+    if (!file)
+      throw new SwitchyardError("invalid_request", "This session has no Pi session file");
+    return file;
+  }
+  async tree(sessionId) {
+    const file = this.piFile(sessionId);
+    const SM = await loadPiSessionManager(this.opts.piBin);
+    if (!SM) {
+      throw new SwitchyardError("invalid_request", "Pi's SessionManager could not be loaded on this host");
+    }
+    return { rows: treeRows(SM.open(file, dirname10(file))) };
+  }
+  async branch(sessionId, entryId, fork) {
+    return branchSession(this.piFile(sessionId), entryId, fork, this.opts.piBin);
+  }
+  async exportSession(sessionId) {
+    const file = this.piFile(sessionId);
+    const info = await stat5(file).catch(() => null);
+    if (!info) {
+      throw new SwitchyardError("native_session_missing", `Native session file not found: ${file}`);
+    }
+    if (info.size > 50 * 1024 * 1024) {
+      throw new SwitchyardError("invalid_request", "Session file is too large to export (over 50 MB)");
+    }
+    return { fileName: basename3(file), content: await readFile8(file, "utf8") };
+  }
   async setModel(sessionId, provider, modelId) {
     return this.requireLive(sessionId).setModel(provider, modelId);
   }
@@ -16744,7 +16992,7 @@ var SessionSupervisor = class {
   }
   async importable() {
     const env = { ...process.env, ...this.opts.env ?? {} };
-    const root = join16(piAgentDir(env), "sessions");
+    const root = join17(piAgentDir(env), "sessions");
     const list = await listImportable(root);
     const liveFiles = new Set([...this.live.values()].flatMap((l) => l.rec.nativeHandle ? [realpathOr2(l.rec.nativeHandle.sessionFile)] : []));
     return {
@@ -17013,6 +17261,21 @@ var SessionSupervisor = class {
         await this.applyToolCard(l, e);
         return;
       }
+      case "tool_execution_update": {
+        if (ev.parentToolCallId || !adapters)
+          return;
+        const id = String(ev.toolCallId);
+        const pr = ev.partialResult;
+        const details = pr && typeof pr === "object" && "details" in pr ? pr.details : void 0;
+        await adapters.onToolUpdate({
+          toolCallId: id,
+          name: String(ev.toolName),
+          args: ms?.toolItem(id)?.data.args ?? {},
+          partialResult: pr,
+          details
+        });
+        return;
+      }
       case "tool_execution_end": {
         if (ev.parentToolCallId || !adapters)
           return;
@@ -17215,6 +17478,8 @@ var SessionSupervisor = class {
    */
   onTerminalPrompt(l, b) {
     if (b.type === "ui_prompt_start") {
+      if (b.kind === "custom" && b.remoteBacked)
+        return;
       if (b.kind !== "custom" && l.ms?.remoteDialogs)
         return;
       if (l.terminalPrompt)
@@ -17541,9 +17806,10 @@ var WorkspaceService = class {
   }
   async create(checkoutPath, branch, base, setupCommand, worktreeDir) {
     const wt = await createWorktree(checkoutPath, branch, base, worktreeDir);
-    const git = await worktreeStatus(wt.path, wt.baseBranch).catch(() => null);
     const initial = setupCommand ? { state: "running", log: "" } : { state: "none", log: "" };
-    this.emitUpdate(wt.path, { branch: wt.branch, baseBranch: wt.baseBranch, git, setup: initial });
+    this.emitUpdate(wt.path, { branch: wt.branch, baseBranch: wt.baseBranch, setup: initial });
+    void worktreeStatus(wt.path, wt.baseBranch).then((git) => this.emitUpdate(wt.path, { git }), () => {
+    });
     let setupDone = Promise.resolve(initial);
     if (setupCommand) {
       setupDone = runSetup(wt.path, setupCommand, (setup) => this.emitUpdate(wt.path, { setup }), {
@@ -17565,7 +17831,7 @@ var WorkspaceService = class {
       branch: wt.branch,
       baseBranch: wt.baseBranch,
       provenance: "managed",
-      git,
+      git: null,
       setup: initial,
       setupDone
     };
@@ -17710,59 +17976,489 @@ async function runHostAgent(opts = {}) {
   if (interruptedOnStart.length > 0 || failedDispatches > 0) {
     log.warn({ sessions: interruptedOnStart.length, dispatches: failedDispatches }, "recovered after restart");
   }
-  router.pruneReceipts();
-  const reattach = await supervisor.reattachTerminals();
-  interruptedOnStart.push(...reattach.lost);
-  if (reattach.reattached.length > 0 || reattach.lost.length > 0) {
-    log.info({ reattached: reattach.reattached.length, lost: reattach.lost.length }, "terminal sessions after restart");
+  router.pruneReceipts();
+  try {
+    await catalog.init();
+  } catch (err) {
+    log.warn({ err: err.message }, "adapter discovery failed; Pi package adapters are not loaded");
+  }
+  const reattach = await supervisor.reattachTerminals();
+  interruptedOnStart.push(...reattach.lost);
+  if (reattach.reattached.length > 0 || reattach.lost.length > 0) {
+    log.info({ reattached: reattach.reattached.length, lost: reattach.lost.length }, "terminal sessions after restart");
+  }
+  supervisor.emitAdapters();
+  link.start();
+  let stopping = null;
+  const onSignal = (signal) => {
+    log.info({ signal }, "stopping host agent");
+    void handle.stop().finally(() => process.exit(0));
+  };
+  if (opts.handleSignals !== false) {
+    process.once("SIGTERM", onSignal);
+    process.once("SIGINT", onSignal);
+  }
+  const handle = {
+    hostId: config.hostId,
+    config,
+    db,
+    link,
+    supervisor,
+    router,
+    dispatcher,
+    pi,
+    interruptedOnStart,
+    terminalSessions: terminalEnabled,
+    get spawnedPiProcesses() {
+      return supervisor.spawnedProcesses;
+    },
+    stop(stopOpts = {}) {
+      stopping ??= (async () => {
+        process.off("SIGTERM", onSignal);
+        process.off("SIGINT", onSignal);
+        relay.closeAll();
+        await supervisor.stopAll(stopOpts);
+        await new Promise((r) => setTimeout(r, 50));
+        await link.stop();
+        db.close();
+      })();
+      return stopping;
+    }
+  };
+  return handle;
+}
+
+// packages/cli/dist/commands/coordinator.js
+import { existsSync as existsSync14, mkdirSync as mkdirSync8 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
+function parseListen(v) {
+  const s = v.trim();
+  let host = "0.0.0.0";
+  let portStr = s;
+  const v6 = s.match(/^\[([^\]]+)\]:(\d+)$/);
+  if (v6) {
+    host = v6[1];
+    portStr = v6[2];
+  } else if (s.includes(":")) {
+    const i = s.lastIndexOf(":");
+    host = s.slice(0, i) || "0.0.0.0";
+    portStr = s.slice(i + 1);
+  } else if (!/^\d+$/.test(s)) {
+    host = s;
+    portStr = String(DEFAULT_PORT);
+  }
+  const port = Number(portStr);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new CliError(`Invalid listen address "${v}" (expected host:port)`);
+  }
+  return { host, port };
+}
+function parseOrigins(v) {
+  if (!v?.trim())
+    return void 0;
+  return v.split(",").map((o) => o.trim().replace(/\/+$/, "")).filter(Boolean);
+}
+var DEFAULT_OIDC_LABEL = "Sign in with single sign-on";
+var DEFAULT_OIDC_SCOPES = "openid profile email groups";
+function envValue(env, key) {
+  const v = env[key]?.trim();
+  return v ? v : void 0;
+}
+function authOptionsFromEnv(env) {
+  const out = {};
+  const secret = envValue(env, "SWITCHYARD_HOST_ENROLL_SECRET");
+  if (secret)
+    out.hostEnrollSecret = secret;
+  const proxies = parseOrigins(env.SWITCHYARD_TRUSTED_PROXIES);
+  if (proxies)
+    out.trustedProxies = proxies;
+  const issuer = envValue(env, "SWITCHYARD_OIDC_ISSUER");
+  const clientId = envValue(env, "SWITCHYARD_OIDC_CLIENT_ID");
+  if (issuer && clientId) {
+    if (!/^https?:\/\//.test(issuer)) {
+      throw new CliError(`SWITCHYARD_OIDC_ISSUER must be an http(s) URL, got "${issuer}"`);
+    }
+    out.oidc = {
+      issuer,
+      clientId,
+      clientSecret: envValue(env, "SWITCHYARD_OIDC_CLIENT_SECRET") ?? null,
+      label: envValue(env, "SWITCHYARD_OIDC_LABEL") ?? DEFAULT_OIDC_LABEL,
+      scopes: envValue(env, "SWITCHYARD_OIDC_SCOPES") ?? DEFAULT_OIDC_SCOPES,
+      owner: {
+        subject: envValue(env, "SWITCHYARD_OIDC_OWNER_SUBJECT") ?? null,
+        email: envValue(env, "SWITCHYARD_OIDC_OWNER_EMAIL") ?? null,
+        group: envValue(env, "SWITCHYARD_OIDC_OWNER_GROUP") ?? null
+      }
+    };
+  } else if (issuer || clientId) {
+    throw new CliError("Single sign-on needs both SWITCHYARD_OIDC_ISSUER and SWITCHYARD_OIDC_CLIENT_ID");
+  }
+  return out;
+}
+function coordinatorOptions(flags, env) {
+  const dataDir = flags.dataDir ? resolve10(flags.dataDir) : defaultDataDir(env);
+  const listen = parseListen(flags.listen ?? env.SWITCHYARD_LISTEN ?? `0.0.0.0:${DEFAULT_PORT}`);
+  const publicUrl = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim() || void 0;
+  if (publicUrl && !/^https?:\/\//.test(publicUrl)) {
+    throw new CliError(`Public URL must start with http:// or https://, got "${publicUrl}"`);
+  }
+  const trustedOrigins = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
+  return {
+    dataDir,
+    listen,
+    publicUrl,
+    trustedOrigins,
+    webDist: resolveWebDist(flags.webDist, env),
+    ...authOptionsFromEnv(env)
+  };
+}
+function waitForSignal() {
+  return new Promise((res) => {
+    const on = (sig) => {
+      process.off("SIGINT", on);
+      process.off("SIGTERM", on);
+      res(sig);
+    };
+    process.on("SIGINT", on);
+    process.on("SIGTERM", on);
+  });
+}
+async function coordinatorStart(ctx, flags) {
+  const opts = coordinatorOptions(flags, ctx.env);
+  const c = createCoordinator(opts);
+  await c.start();
+  writeEndpoint(opts.dataDir, {
+    localUrl: localUrlFor(opts.listen, c.port),
+    publicUrl: c.config.publicUrl
+  });
+  ctx.err(`Switchyard coordinator listening on ${opts.listen.host}:${c.port} (public URL ${c.config.publicUrl}; data ${opts.dataDir}${opts.webDist ? "" : "; web app not found, API only"})`);
+  const sig = await waitForSignal();
+  ctx.err(`${sig}: stopping coordinator`);
+  await c.stop();
+}
+function localUrlFor(listen, port) {
+  const h = listen.host ?? "0.0.0.0";
+  const host = h === "0.0.0.0" || h === "::" || h === "" ? "127.0.0.1" : h.includes(":") ? `[${h}]` : h;
+  return `http://${host}:${port}`;
+}
+function dataDirOf(flags, env) {
+  return flags.dataDir ? resolve10(flags.dataDir) : defaultDataDir(env);
+}
+function coordinatorBackup(ctx, out, flags) {
+  const r = backup(dataDirOf(flags, ctx.env), out);
+  ctx.out(`Backed up to ${r.file} (schema ${r.migrationLevel})`);
+}
+function coordinatorRestore(ctx, file, flags) {
+  const r = restore(dataDirOf(flags, ctx.env), file);
+  ctx.out(`Restored ${r.restoredFrom} (schema ${r.migrationLevel}).`);
+  if (r.previous)
+    ctx.out(`The previous database was kept as ${r.previous}`);
+  if (r.migrationLevel < LATEST_MIGRATION) {
+    ctx.out("Migrations to the current schema run when the coordinator next starts.");
+  }
+}
+function coordinatorMigrate(ctx, flags) {
+  const dataDir = dataDirOf(flags, ctx.env);
+  const holder = lockHolder(dataDir);
+  if (holder !== null) {
+    throw new CliError(`Coordinator (pid ${holder}) is running on ${dataDir}; it migrated at start`);
+  }
+  const path = dbPath(dataDir);
+  const existed = existsSync14(path);
+  mkdirSync8(dataDir, { recursive: true });
+  const db = openDb(path);
+  try {
+    const before = existed ? migrationLevel(db) : 0;
+    migrate(db);
+    const after = migrationLevel(db);
+    ctx.out(before === after ? `Schema is current (level ${after}) at ${path}` : `Migrated ${path} from level ${before} to ${after}`);
+  } finally {
+    db.close();
+  }
+}
+
+// packages/cli/dist/commands/up.js
+var DEV_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
+function upOptions(flags, env) {
+  const port = flags.port === void 0 ? DEFAULT_PORT : Number(flags.port);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new CliError(`Invalid port "${flags.port}"`);
+  }
+  const listenHost = flags.host ?? "0.0.0.0";
+  const dataDir = flags.dataDir ?? defaultDataDir(env);
+  const explicitPublic = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim();
+  const publicUrl = explicitPublic || port !== 0 ? (explicitPublic || `http://localhost:${port}`).replace(/\/+$/, "") : void 0;
+  let trusted = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
+  if (!trusted && publicUrl) {
+    trusted = [new URL(publicUrl).origin];
+    if (!explicitPublic)
+      trusted.push(`http://127.0.0.1:${port}`);
+  }
+  if (flags.dev && trusted)
+    trusted = [.../* @__PURE__ */ new Set([...trusted, ...DEV_ORIGINS])];
+  return {
+    dataDir,
+    listen: { host: listenHost, port },
+    publicUrl,
+    trustedOrigins: trusted,
+    webDist: resolveWebDist(flags.webDist, env),
+    // Same server env as `coordinator start`: shared host secret, trusted proxies and OIDC.
+    ...authOptionsFromEnv(env)
+  };
+}
+async function ensureLocalHost(coordinator, localUrl, configPath, name, fetchImpl) {
+  if (existsSync15(configPath)) {
+    const cfg2 = loadConfig(configPath);
+    const known = coordinator.store.hosts.get(cfg2.hostId);
+    if (known && !known.revokedAt) {
+      return { config: { ...cfg2, coordinatorUrl: localUrl }, enrolled: false };
+    }
+  }
+  const api = new ApiClient({
+    coordinatorUrl: localUrl,
+    credential: coordinator.adminToken,
+    fetch: fetchImpl
+  });
+  const e = await api.post("/api/hosts/enrollments", {});
+  const cfg = await enroll({
+    coordinatorUrl: localUrl,
+    token: e.token,
+    name,
+    configPath,
+    fetch: fetchImpl
+  });
+  const { configPath: _p, ...config } = cfg;
+  return { config, enrolled: true };
+}
+function openBrowser(url, platform = process.platform, spawnFn = spawn4) {
+  const cmd = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
+  if (!cmd)
+    return;
+  try {
+    const child = spawnFn(cmd, [url], { detached: true, stdio: "ignore" });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function firstSignInLink(ctx, coordinator, open2, opener) {
+  if (coordinator.config.oidc || coordinator.auth.activeDeviceCount() > 0)
+    return null;
+  const e = coordinator.auth.createEnrollment("device", ADMIN_DEVICE_ID);
+  await printSignInLink(ctx, e.url, e.expiresAt);
+  if (open2)
+    opener(e.url);
+  return e.url;
+}
+async function startStandalone(ctx, flags, deps = {}) {
+  if (flags.dev && !ctx.env.SWITCHYARD_LOG_LEVEL)
+    process.env.SWITCHYARD_LOG_LEVEL = "debug";
+  const opts = upOptions(flags, ctx.env);
+  const coordinator = createCoordinator({ ...opts, setupHint: false });
+  await coordinator.start();
+  let firstLink;
+  try {
+    firstLink = await firstSignInLink(ctx, coordinator, flags.open ?? process.stdout.isTTY === true, deps.open ?? ((url) => openBrowser(url)));
+  } catch (err) {
+    await coordinator.stop();
+    throw err;
+  }
+  const localUrl = localUrlFor(opts.listen, coordinator.port);
+  writeEndpoint(opts.dataDir, { localUrl, publicUrl: coordinator.config.publicUrl });
+  let host;
+  try {
+    const paths = standaloneHostPaths(opts.dataDir);
+    const { config, enrolled } = await ensureLocalHost(coordinator, localUrl, paths.configPath, flags.name ?? hostname2().replace(/\.local$/, ""));
+    if (enrolled)
+      ctx.err(`Enrolled the local host "${config.name}" (${config.hostId})`);
+    host = await runHostAgent({ config, stateDir: paths.stateDir, handleSignals: false });
+  } catch (err) {
+    await coordinator.stop();
+    throw err;
+  }
+  return {
+    coordinator,
+    host,
+    localUrl,
+    firstLink,
+    async stop() {
+      await host.stop();
+      await coordinator.stop();
+    }
+  };
+}
+async function up(ctx, flags) {
+  const s = await startStandalone(ctx, flags);
+  const c = s.coordinator;
+  ctx.err([
+    `Switchyard is up: ${c.config.publicUrl} (listening on port ${c.port})`,
+    `Data: ${c.config.dataDir}`,
+    c.config.webDist ? null : "Web app bundle not found: API only (run `pnpm build`)",
+    c.config.oidc ? `Sign in with single sign-on at ${c.config.publicUrl}    Terminal: switchyard login --coordinator ${c.config.publicUrl}` : `Another browser: switchyard pair    Terminal: switchyard login --coordinator ${c.config.publicUrl}`,
+    "Schedules run only while this process is running."
+  ].filter(Boolean).join("\n"));
+  const sig = await waitForSignal();
+  ctx.err(`${sig}: stopping (Pi sessions on this host are stopped and can be resumed later)`);
+  await s.stop();
+}
+
+// packages/cli/dist/commands/auth.js
+function adminApi(ctx, flags) {
+  const dataDir = flags.dataDir ?? ctx.paths?.dataDir ?? defaultDataDir(ctx.env);
+  const token = readAdminToken(dataDir, ctx.env);
+  if (!token) {
+    throw new CliError(`No admin token: run this on the coordinator machine (looked in ${dataDir}/admin.token) or set SWITCHYARD_ADMIN_TOKEN`);
+  }
+  const url = trimUrl(flags.coordinator ?? readEndpoint(dataDir)?.localUrl ?? DEFAULT_LOCAL_URL);
+  return new ApiClient({ coordinatorUrl: url, credential: token, fetch: ctx.fetch });
+}
+function clockTime(iso) {
+  const d = new Date(iso);
+  return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}`;
+}
+async function printDeviceLink(ctx, url) {
+  const qr = await QRCode2.toString(url, { type: "terminal", small: true });
+  ctx.out("");
+  ctx.out(`  ${url}`);
+  ctx.out("");
+  ctx.out(qr.trimEnd());
+  ctx.out("");
+}
+async function printSignInLink(ctx, url, expiresAt) {
+  ctx.out(`Open this single-use sign-in link in your browser (expires ${clockTime(expiresAt)}):`);
+  await printDeviceLink(ctx, url);
+  ctx.out("Then add a passkey in Settings \u203A Sign-in as a backup, or run `switchyard pair` for another browser.");
+}
+async function pair(ctx, flags) {
+  const api = adminApi(ctx, flags);
+  const kind = flags.host ? "host" : "device";
+  const e = await api.post("/api/enrollments", { kind });
+  if (flags.json) {
+    ctx.out(JSON.stringify(e, null, 2));
+    return e;
+  }
+  const qr = await QRCode2.toString(e.url, { type: "terminal", small: true });
+  if (kind === "host") {
+    ctx.out(`Host enrollment (single use, expires ${e.expiresAt}). On the host, run:`);
+    ctx.out("");
+    ctx.out(`  ${e.command ?? `switchyard host enroll --coordinator <url> --token ${e.token}`}`);
+    ctx.out("");
+    ctx.out(`Token: ${e.token}`);
+  } else {
+    ctx.out(`Open this link in a browser to sign it in (single use, expires ${e.expiresAt}):`);
+    ctx.out("");
+    ctx.out(`  ${e.url}`);
+    ctx.out("");
+    ctx.out(qr.trimEnd());
+    ctx.out("");
+    ctx.out(`Terminal: switchyard login --coordinator ${originOf2(e.url)} --token ${e.token}`);
   }
+  ctx.out("The link does not provide network access: the device must already reach this URL.");
+  return e;
+}
+function originOf2(url) {
   try {
-    await catalog.init();
-  } catch (err) {
-    log.warn({ err: err.message }, "adapter discovery failed; Pi package adapters are not loaded");
+    return new URL(url).origin;
+  } catch {
+    return url;
   }
-  supervisor.emitAdapters();
-  link.start();
-  let stopping = null;
-  const onSignal = (signal) => {
-    log.info({ signal }, "stopping host agent");
-    void handle.stop().finally(() => process.exit(0));
-  };
-  if (opts.handleSignals !== false) {
-    process.once("SIGTERM", onSignal);
-    process.once("SIGINT", onSignal);
+}
+function parseEnrollmentInput(token, coordinator) {
+  const t = token.trim();
+  if (/^https?:\/\//.test(t)) {
+    const u = new URL(t);
+    const params = new URLSearchParams(u.hash.replace(/^#/, ""));
+    const fromUrl = params.get("token") ?? u.searchParams.get("token");
+    if (!fromUrl)
+      throw new CliError("That URL has no enrollment token");
+    return { url: trimUrl(coordinator ?? u.origin), token: fromUrl };
   }
-  const handle = {
-    hostId: config.hostId,
-    config,
-    db,
-    link,
-    supervisor,
-    router,
-    dispatcher,
-    pi,
-    interruptedOnStart,
-    terminalSessions: terminalEnabled,
-    get spawnedPiProcesses() {
-      return supervisor.spawnedProcesses;
-    },
-    stop(stopOpts = {}) {
-      stopping ??= (async () => {
-        process.off("SIGTERM", onSignal);
-        process.off("SIGINT", onSignal);
-        relay.closeAll();
-        await supervisor.stopAll(stopOpts);
-        await new Promise((r) => setTimeout(r, 50));
-        await link.stop();
-        db.close();
-      })();
-      return stopping;
+  if (!coordinator)
+    throw new CliError("--coordinator <url> is required");
+  return { url: trimUrl(coordinator), token: t };
+}
+async function loginWithToken(ctx, flags) {
+  const { url, token } = parseEnrollmentInput(flags.token, flags.coordinator);
+  const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
+  const name = flags.name ?? `${hostname3().replace(/\.local$/, "")} terminal`;
+  const res = await api.post("/api/enroll", {
+    token,
+    name,
+    kind: "terminal"
+  });
+  if (!res.credential)
+    throw new CliError("The coordinator returned no credential");
+  const path = ctx.paths?.clientConfig ?? clientConfigPath(ctx.env);
+  writeClientConfig(path, {
+    coordinatorUrl: url,
+    credential: res.credential,
+    deviceId: res.deviceId
+  });
+  ctx.out(`Enrolled "${name}" (${res.deviceId}) with ${url}.`);
+  ctx.out(`Credential saved to ${path} (mode 0600). Open a session's Pi terminal with \`switchyard tui <session>\`.`);
+  return { path, deviceId: res.deviceId };
+}
+var EXPIRED2 = "The sign-in expired before it was approved. Run `switchyard login` again.";
+async function login(ctx, flags, deps = {}) {
+  if (flags.token)
+    return loginWithToken(ctx, { ...flags, token: flags.token });
+  const path = ctx.paths?.clientConfig ?? clientConfigPath(ctx.env);
+  const raw = flags.coordinator ?? ctx.env.SWITCHYARD_URL ?? readClientConfig(path)?.coordinatorUrl;
+  if (!raw)
+    throw new CliError("--coordinator <url> is required");
+  const url = trimUrl(raw);
+  const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
+  const name = flags.name ?? `${hostname3().replace(/\.local$/, "")} terminal`;
+  const started = await api.post("/api/auth/terminal/start", { name });
+  ctx.out("To sign in this terminal, open this link in a browser where you use Switchyard:");
+  ctx.out("");
+  ctx.out(`  ${started.verifyUrl}`);
+  ctx.out("");
+  ctx.out(`Check that it shows the code ${started.userCode}. Waiting for approval (expires ${clockTime(started.expiresAt)})\u2026`);
+  const interactive = process.stdout.isTTY === true && !ctx.env.SSH_CONNECTION && !ctx.env.SSH_TTY;
+  if (flags.open ?? interactive)
+    (deps.open ?? ((u) => openBrowser(u)))(started.verifyUrl);
+  const sleep3 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  const deadline = Date.parse(started.expiresAt);
+  for (; ; ) {
+    await sleep3(started.intervalMs);
+    let r;
+    try {
+      r = await api.post("/api/auth/terminal/claim", {
+        userCode: started.userCode,
+        pollToken: started.pollToken
+      });
+    } catch (err) {
+      if (err instanceof ApiRequestError) {
+        if (err.status === 401)
+          throw new CliError(EXPIRED2);
+        if (err.status === 0 && now() < deadline)
+          continue;
+      }
+      throw err;
     }
-  };
-  return handle;
+    if (r.status === "denied")
+      throw new CliError("The sign-in was denied in the browser.");
+    if (r.status === "done") {
+      writeClientConfig(path, {
+        coordinatorUrl: url,
+        credential: r.credential,
+        deviceId: r.deviceId
+      });
+      ctx.out(`Signed in "${name}" (${r.deviceId}) to ${url}.`);
+      ctx.out(`Credential saved to ${path} (mode 0600). Open a session's Pi terminal with \`switchyard tui <session>\`.`);
+      return { path, deviceId: r.deviceId };
+    }
+    if (now() >= deadline)
+      throw new CliError(EXPIRED2);
+  }
 }
 
 // packages/cli/dist/commands/doctor.js
+import { execFile as execFile3 } from "node:child_process";
+import { existsSync as existsSync16, readFileSync as readFileSync9 } from "node:fs";
 function defaultDoctorDeps(ctx) {
   const dataDir = ctx.paths?.dataDir ?? defaultDataDir(ctx.env);
   return {
@@ -17770,7 +18466,7 @@ function defaultDoctorDeps(ctx) {
     detectPi: () => detectPi(ctx.env.SWITCHYARD_PI_BIN ?? "pi"),
     gitVersion: () => new Promise((resolve13) => execFile3("git", ["--version"], (err, stdout) => resolve13(err ? null : stdout.trim()))),
     hostConfigPaths: [defaultConfigPath(ctx.env), standaloneHostPaths(dataDir).configPath],
-    readFile: (p) => existsSync14(p) ? readFileSync9(p, "utf8") : null
+    readFile: (p) => existsSync16(p) ? readFileSync9(p, "utf8") : null
   };
 }
 function findHostConfig(deps) {
@@ -17900,13 +18596,13 @@ async function checkSignIn(ctx, url, add) {
   try {
     const api = new ApiClient({ coordinatorUrl: url, credential: null, fetch: ctx.fetch });
     const s = await api.get("/api/setup");
-    if (!s.initialized) {
-      add("FAIL", "Sign-in", "not set up: run `switchyard init` on the server");
-      return;
-    }
     const passkey = !s.passkey.available ? `unavailable, ${s.passkey.reason ?? "unsupported"}` : s.passkey.registered ? "registered" : "none registered yet";
     const sso = s.oidc ? `on (${s.oidc.label})` : "off";
-    add("PASS", "Sign-in", `set up (passkey: ${passkey}, single sign-on: ${sso})`);
+    if (!s.oidc && !s.passkey.registered) {
+      add("WARN", "Sign-in", "no single sign-on and no passkey: sign in with a link from `switchyard pair` on the server");
+      return;
+    }
+    add("PASS", "Sign-in", `passkey: ${passkey}, single sign-on: ${sso}`);
   } catch (err) {
     add("WARN", "Sign-in", `could not read the setup state: ${err.message}`);
   }
@@ -17922,9 +18618,9 @@ function printDoctor(ctx, results) {
 }
 
 // packages/cli/dist/commands/herdr.js
-import { spawn as spawn4 } from "node:child_process";
-import { closeSync as closeSync2, existsSync as existsSync18, openSync as openSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join21 } from "node:path";
+import { spawn as spawn5 } from "node:child_process";
+import { closeSync as closeSync2, existsSync as existsSync20, openSync as openSync2, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join22 } from "node:path";
 
 // packages/cli/dist/context.js
 function defaultCtx() {
@@ -17934,7 +18630,7 @@ function defaultCtx() {
     err: (l) => process.stderr.write(`${l}
 `),
     env: process.env,
-    fetch: (input, init2) => fetch(input, init2)
+    fetch: (input, init) => fetch(input, init)
   };
 }
 function connect(ctx, flags) {
@@ -17975,10 +18671,10 @@ function ago(iso, now = Date.now()) {
 }
 
 // packages/cli/dist/herdr/client.js
-import { existsSync as existsSync15, readdirSync } from "node:fs";
+import { existsSync as existsSync17, readdirSync } from "node:fs";
 import { createConnection as createConnection3 } from "node:net";
 import { homedir as homedir6 } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var HerdrUnavailable = class extends Error {
   constructor(message) {
     super(message);
@@ -17996,15 +18692,15 @@ var HerdrError = class extends Error {
 function herdrSocketPath(env = process.env, home = homedir6()) {
   if (env.HERDR_SOCKET_PATH)
     return env.HERDR_SOCKET_PATH;
-  const base = join17(home, ".config", "herdr");
+  const base = join18(home, ".config", "herdr");
   if (env.HERDR_SESSION)
-    return join17(base, "sessions", env.HERDR_SESSION, "herdr.sock");
-  const dflt = join17(base, "herdr.sock");
-  if (existsSync15(dflt))
+    return join18(base, "sessions", env.HERDR_SESSION, "herdr.sock");
+  const dflt = join18(base, "herdr.sock");
+  if (existsSync17(dflt))
     return dflt;
   let live = [];
   try {
-    live = readdirSync(join17(base, "sessions")).map((s) => join17(base, "sessions", s, "herdr.sock")).filter((p) => existsSync15(p));
+    live = readdirSync(join18(base, "sessions")).map((s) => join18(base, "sessions", s, "herdr.sock")).filter((p) => existsSync17(p));
   } catch {
     live = [];
   }
@@ -18117,11 +18813,11 @@ function nextSeq() {
 }
 
 // packages/cli/dist/herdr/daemon.js
-import { existsSync as existsSync17, mkdirSync as mkdirSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join20 } from "node:path";
 
 // packages/cli/dist/herdr/mirror.js
-import { basename as basename3 } from "node:path";
+import { basename as basename4 } from "node:path";
 var SOURCE = "switchyard";
 var PENDING_MS = 15e3;
 var NEW_SESSION_GRACE_MS = 5e3;
@@ -18153,10 +18849,10 @@ function projectOfKey(key, st) {
 function spaceLabel(key, st) {
   const w = st.workspaces.find((x) => x.id === key);
   if (w) {
-    const project2 = st.projects.find((p) => p.id === w.projectId)?.name ?? basename3(w.path);
+    const project2 = st.projects.find((p) => p.id === w.projectId)?.name ?? basename4(w.path);
     let label = project2;
     if (w.provenance !== "main")
-      label += ` \xB7 ${w.branch ?? basename3(w.path)}`;
+      label += ` \xB7 ${w.branch ?? basename4(w.path)}`;
     const hosts = new Set(st.checkouts.filter((c) => c.projectId === w.projectId).map((c) => c.hostId));
     if (hosts.size >= 2)
       label += ` \xB7 ${hostName(st, w.hostId)}`;
@@ -18165,7 +18861,7 @@ function spaceLabel(key, st) {
   const cwd = key.split(":").slice(2).join(":");
   const s = st.sessions.find((x) => spaceKey(x) === key);
   const project = s?.projectId && st.projects.find((p) => p.id === s.projectId)?.name || null;
-  return cap2(`${project ?? basename3(cwd)} \xB7 ${basename3(cwd)}`);
+  return cap2(`${project ?? basename4(cwd)} \xB7 ${basename4(cwd)}`);
 }
 function tabLabel(s, overrides = {}) {
   return cap2(overrides[s.id] ?? s.title);
@@ -18404,27 +19100,27 @@ function planMirror(st, h, mem, now) {
 }
 
 // packages/cli/dist/herdr/util.js
-import { chmodSync as chmodSync5, existsSync as existsSync16, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { chmodSync as chmodSync5, existsSync as existsSync18, mkdirSync as mkdirSync9, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function herdrStateDir(env = process.env, home = homedir7()) {
   const xdg = env.XDG_STATE_HOME?.trim();
-  return join18(xdg || join18(home, ".local", "state"), "switchyard-herdr");
+  return join19(xdg || join19(home, ".local", "state"), "switchyard-herdr");
 }
 function sessionStateDir(env = process.env) {
-  const dir = join18(herdrStateDir(env), herdrSessionName(env));
+  const dir = join19(herdrStateDir(env), herdrSessionName(env));
   mkdirSync9(dir, { recursive: true, mode: 448 });
   return dir;
 }
 function stableLauncherPath(env = process.env) {
-  return env.SWITCHYARD_HERDR_LAUNCHER || join18(herdrStateDir(env), "switchyard-herdr");
+  return env.SWITCHYARD_HERDR_LAUNCHER || join19(herdrStateDir(env), "switchyard-herdr");
 }
 function writeStableLauncher(stateRoot, pluginRoot) {
   if (pluginRoot.includes("'") || stateRoot.includes("'")) {
     throw new CliError("Plugin path contains an apostrophe");
   }
   mkdirSync9(stateRoot, { recursive: true, mode: 448 });
-  const path = join18(stateRoot, "switchyard-herdr");
+  const path = join19(stateRoot, "switchyard-herdr");
   writeFileSync5(path, `#!/bin/sh
 exec sh '${pluginRoot}/switchyard-herdr.sh' "$@"
 `, {
@@ -18434,7 +19130,7 @@ exec sh '${pluginRoot}/switchyard-herdr.sh' "$@"
   return path;
 }
 function launcherExists(env = process.env) {
-  return existsSync16(stableLauncherPath(env));
+  return existsSync18(stableLauncherPath(env));
 }
 async function isAtShell(call, paneId) {
   const info = (await call("pane.process_info", { pane_id: paneId }))?.process_info ?? {};
@@ -18508,7 +19204,7 @@ var MirrorDaemon = class {
     return (this.deps.now ?? Date.now)();
   }
   get spacesFile() {
-    return join19(this.deps.stateDir, "spaces.json");
+    return join20(this.deps.stateDir, "spaces.json");
   }
   async start() {
     this.load();
@@ -18633,10 +19329,10 @@ var MirrorDaemon = class {
     const titleOf = (sid) => st.sessions.find((s) => s.id === sid)?.title ?? sid;
     const launcher = this.deps.launcherPath;
     const paneCmd = (sid) => launcherCommand(launcher, ["pane", sid]);
-    const exists2 = this.deps.exists ?? existsSync17;
+    const exists2 = this.deps.exists ?? existsSync19;
     const createdNow = {};
     const fallbackCwd = () => {
-      const dir = join19(this.deps.stateDir, "spaces");
+      const dir = join20(this.deps.stateDir, "spaces");
       mkdirSync10(dir, { recursive: true, mode: 448 });
       return dir;
     };
@@ -18862,7 +19558,7 @@ var MirrorDaemon = class {
 
 // packages/cli/dist/herdr/new-session.js
 import { readFileSync as readFileSync11 } from "node:fs";
-import { basename as basename4, join as join20 } from "node:path";
+import { basename as basename5, join as join21 } from "node:path";
 
 // packages/cli/dist/herdr/pane.js
 var LIVE = /* @__PURE__ */ new Set(["starting", "idle", "running", "waiting_input"]);
@@ -19489,7 +20185,7 @@ function workspaceItems(st, projectId) {
       own.length > 0 ? plural(own.length, "session") : "",
       w.git?.dirty ? "modified" : ""
     ].filter(Boolean).join(" \xB7 ");
-    const label = `${w.branch ?? basename4(w.path)}${w.provenance === "main" ? " (main checkout)" : ""}`;
+    const label = `${w.branch ?? basename5(w.path)}${w.provenance === "main" ? " (main checkout)" : ""}`;
     return {
       item: { label, detail, value: { kind: "existing", workspaceId: w.id } },
       active: latest(own.map((x) => x.lastActivityAt)),
@@ -19536,7 +20232,7 @@ async function chooseSession(st, screen, opts = {}) {
     if (pick?.kind === "existing") {
       const w = st.workspaces.find((x) => x.id === pick.workspaceId);
       if (w && w.provenance !== "main")
-        c.push(w.branch ?? basename4(w.path));
+        c.push(w.branch ?? basename5(w.path));
     } else if (pick?.kind === "new" && pick.branch) {
       c.push(pick.branch);
     }
@@ -19677,7 +20373,7 @@ async function newHere(ctx) {
   const ws = snap.focused_workspace_id;
   let key = null;
   try {
-    const raw = JSON.parse(readFileSync11(join20(sessionStateDir(ctx.env), "spaces.json"), "utf8"));
+    const raw = JSON.parse(readFileSync11(join21(sessionStateDir(ctx.env), "spaces.json"), "utf8"));
     key = ws ? raw.spaces?.[ws]?.key ?? null : null;
   } catch {
     key = null;
@@ -19708,8 +20404,8 @@ async function herdrDaemon(ctx, flags) {
   }
   const launcherPath = stableLauncherPath(env);
   const dir = sessionStateDir(env);
-  const pidFile = join21(dir, "daemon.pid");
-  const logFile = join21(dir, "daemon.log");
+  const pidFile = join22(dir, "daemon.pid");
+  const logFile = join22(dir, "daemon.log");
   const socket = herdrSocketPath(env);
   const call = (method, params) => herdrCall(method, params, socket);
   if (flags.once) {
@@ -19739,13 +20435,13 @@ async function herdrDaemon(ctx, flags) {
     }
     return;
   }
-  const running = existsSync18(pidFile) ? Number(readFileSync12(pidFile, "utf8").trim()) : 0;
+  const running = existsSync20(pidFile) ? Number(readFileSync12(pidFile, "utf8").trim()) : 0;
   if (flags.ensure) {
     if (running && pidAlive2(running))
       return;
     const fd = openSync2(logFile, "a", 384);
     try {
-      const child = spawn4(process.execPath, [process.argv[1], "herdr", "daemon"], {
+      const child = spawn5(process.execPath, [process.argv[1], "herdr", "daemon"], {
         detached: true,
         stdio: ["ignore", fd, fd],
         env: { ...process.env, SWITCHYARD_HERDR_LAUNCHER: launcherPath }
@@ -19807,16 +20503,16 @@ async function herdrStatus(ctx, flags) {
 }
 
 // packages/cli/dist/commands/host.js
-import { existsSync as existsSync20, mkdirSync as mkdirSync12 } from "node:fs";
-import { hostname as hostname3 } from "node:os";
-import { dirname as dirname10, join as join23, resolve as resolve12 } from "node:path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync12 } from "node:fs";
+import { hostname as hostname4 } from "node:os";
+import { dirname as dirname12, join as join24, resolve as resolve12 } from "node:path";
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 
 // packages/cli/dist/commands/service.js
 import { execFile as execFile4 } from "node:child_process";
-import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync21, mkdirSync as mkdirSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir8 } from "node:os";
-import { dirname as dirname9, join as join22, resolve as resolve11 } from "node:path";
+import { dirname as dirname11, join as join23, resolve as resolve11 } from "node:path";
 var LAUNCHD_LABEL = "com.switchyard.host";
 var SYSTEMD_UNIT = "switchyard-host.service";
 var TEMPLATES = {
@@ -19892,8 +20588,8 @@ WantedBy=default.target
 `
 };
 var TEMPLATE_FILES = {
-  launchd: join22("launchd", `${LAUNCHD_LABEL}.plist`),
-  systemd: join22("systemd", SYSTEMD_UNIT)
+  launchd: join23("launchd", `${LAUNCHD_LABEL}.plist`),
+  systemd: join23("systemd", SYSTEMD_UNIT)
 };
 function xmlEscape(s) {
   return s.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
@@ -19905,8 +20601,8 @@ function systemdEscape(s, exec = true) {
   return exec ? out.replaceAll("$", "$$$$") : out;
 }
 function loadTemplate(kind, dir = deployDir()) {
-  const p = join22(dir, TEMPLATE_FILES[kind]);
-  return existsSync19(p) ? readFileSync13(p, "utf8") : TEMPLATES[kind];
+  const p = join23(dir, TEMPLATE_FILES[kind]);
+  return existsSync21(p) ? readFileSync13(p, "utf8") : TEMPLATES[kind];
 }
 function renderService(kind, vars, template = TEMPLATES[kind]) {
   for (const [k, v] of Object.entries(vars)) {
@@ -19937,7 +20633,7 @@ function serviceNames(instance) {
 }
 function serviceFilePath(kind, home = homedir8(), instance) {
   const { label, unit } = serviceNames(instance);
-  return kind === "launchd" ? join22(home, "Library", "LaunchAgents", `${label}.plist`) : join22(home, ".config", "systemd", "user", unit);
+  return kind === "launchd" ? join23(home, "Library", "LaunchAgents", `${label}.plist`) : join23(home, ".config", "systemd", "user", unit);
 }
 function loadCommands(kind, file, uid, instance) {
   const { label, unit } = serviceNames(instance);
@@ -19950,7 +20646,7 @@ function loadCommands(kind, file, uid, instance) {
     ["systemctl", "--user", "restart", unit]
   ];
 }
-function stableNodePath(execPath, exists2 = existsSync19) {
+function stableNodePath(execPath, exists2 = existsSync21) {
   const m = execPath.match(/^(.*)\/Cellar\/node(?:@[^/]+)?\/[^/]+\/bin\/node$/);
   if (m) {
     const candidate = `${m[1]}/bin/node`;
@@ -19974,11 +20670,11 @@ async function installService(ctx, flags, deps = defaultInstallDeps()) {
     throw new CliError("--instance needs --config and --state-dir, so the second host agent keeps its own enrollment and state");
   }
   const config = flags.config ?? defaultConfigPath(ctx.env, deps.home);
-  if (!existsSync19(config) && !flags.print) {
+  if (!existsSync21(config) && !flags.print) {
     throw new CliError(`No host config at ${config}. Enroll first: switchyard host enroll --coordinator <url> --token <t>`);
   }
   const stateDir = flags.stateDir ? resolve11(flags.stateDir) : defaultStateDir(ctx.env, deps.platform, deps.home);
-  const logDir = join22(stateDir, "logs");
+  const logDir = join23(stateDir, "logs");
   const content = renderService(kind, {
     node: stableNodePath(process.execPath),
     cli: cliEntry(),
@@ -19994,7 +20690,7 @@ async function installService(ctx, flags, deps = defaultInstallDeps()) {
     ctx.out(content.trimEnd());
     return { file, content };
   }
-  mkdirSync11(dirname9(file), { recursive: true });
+  mkdirSync11(dirname11(file), { recursive: true });
   mkdirSync11(logDir, { recursive: true, mode: 448 });
   writeFileSync8(file, content, { mode: 420 });
   ctx.out(`Wrote ${file}`);
@@ -20024,7 +20720,7 @@ async function hostEnroll(ctx, flags) {
   if (!flags.token === !flags.secret) {
     throw new CliError("Pass exactly one of --token or --secret");
   }
-  const name = flags.name ?? hostname3().replace(/\.local$/, "");
+  const name = flags.name ?? hostname4().replace(/\.local$/, "");
   const cfg = await enroll({
     coordinatorUrl: flags.coordinator,
     ...flags.token ? { token: flags.token } : { secret: flags.secret },
@@ -20038,7 +20734,7 @@ async function hostEnroll(ctx, flags) {
 }
 async function hostRun(ctx, flags) {
   const configPath = flags.config ?? defaultConfigPath(ctx.env);
-  if (!existsSync20(configPath)) {
+  if (!existsSync22(configPath)) {
     ctx.err(`No host config at ${configPath} yet: waiting for it (with SWITCHYARD_HOST_ENROLL_SECRET and SWITCHYARD_COORDINATOR_URL set, the host enrolls itself).`);
   }
   const agent = await runHostAgent({
@@ -20053,13 +20749,13 @@ async function hostRun(ctx, flags) {
 }
 function hostBackup(ctx, out, flags) {
   const stateDir = flags.stateDir ?? defaultStateDir(ctx.env);
-  const src = join23(stateDir, "host.db");
-  if (!existsSync20(src))
+  const src = join24(stateDir, "host.db");
+  if (!existsSync22(src))
     throw new CliError(`No host database at ${src}`);
   const dest = resolve12(out);
-  if (existsSync20(dest))
+  if (existsSync22(dest))
     throw new CliError(`${dest} already exists`);
-  mkdirSync12(dirname10(dest), { recursive: true });
+  mkdirSync12(dirname12(dest), { recursive: true });
   const db = new DatabaseSync4(src);
   try {
     db.exec("PRAGMA busy_timeout = 5000");
@@ -20074,7 +20770,7 @@ async function hostStatus(ctx, flags) {
   const configPath = flags.config ?? defaultConfigPath(ctx.env);
   const stateDir = flags.stateDir ?? defaultStateDir(ctx.env);
   const status = { configPath, stateDir };
-  if (!existsSync20(configPath)) {
+  if (!existsSync22(configPath)) {
     status.enrolled = false;
   } else {
     const cfg = loadConfig(configPath);
@@ -20107,7 +20803,7 @@ async function hostStatus(ctx, flags) {
   try {
     const kind = serviceKindFor(process.platform);
     const file = serviceFilePath(kind);
-    status.service = { kind, file, installed: existsSync20(file) };
+    status.service = { kind, file, installed: existsSync22(file) };
   } catch {
     status.service = null;
   }
@@ -20259,136 +20955,6 @@ async function tuiCommand(ctx, sessionId, flags, run = runRawTerminal) {
   throw new CliError(result.message);
 }
 
-// packages/cli/dist/commands/up.js
-import { spawn as spawn5 } from "node:child_process";
-import { existsSync as existsSync21 } from "node:fs";
-import { hostname as hostname4 } from "node:os";
-var DEV_ORIGINS = ["http://localhost:5173", "http://127.0.0.1:5173"];
-function upOptions(flags, env) {
-  const port = flags.port === void 0 ? DEFAULT_PORT : Number(flags.port);
-  if (!Number.isInteger(port) || port < 0 || port > 65535) {
-    throw new CliError(`Invalid port "${flags.port}"`);
-  }
-  const listenHost = flags.host ?? "0.0.0.0";
-  const dataDir = flags.dataDir ?? defaultDataDir(env);
-  const explicitPublic = (flags.publicUrl ?? env.SWITCHYARD_PUBLIC_URL)?.trim();
-  const publicUrl = explicitPublic || port !== 0 ? (explicitPublic || `http://localhost:${port}`).replace(/\/+$/, "") : void 0;
-  let trusted = parseOrigins(flags.trustedOrigins ?? env.SWITCHYARD_TRUSTED_ORIGINS);
-  if (!trusted && publicUrl) {
-    trusted = [new URL(publicUrl).origin];
-    if (!explicitPublic)
-      trusted.push(`http://127.0.0.1:${port}`);
-  }
-  if (flags.dev && trusted)
-    trusted = [.../* @__PURE__ */ new Set([...trusted, ...DEV_ORIGINS])];
-  return {
-    dataDir,
-    listen: { host: listenHost, port },
-    publicUrl,
-    trustedOrigins: trusted,
-    webDist: resolveWebDist(flags.webDist, env),
-    // Same server env as `coordinator start`: shared host secret, trusted proxies and OIDC.
-    ...authOptionsFromEnv(env)
-  };
-}
-async function ensureLocalHost(coordinator, localUrl, configPath, name, fetchImpl) {
-  if (existsSync21(configPath)) {
-    const cfg2 = loadConfig(configPath);
-    const known = coordinator.store.hosts.get(cfg2.hostId);
-    if (known && !known.revokedAt) {
-      return { config: { ...cfg2, coordinatorUrl: localUrl }, enrolled: false };
-    }
-  }
-  const api = new ApiClient({
-    coordinatorUrl: localUrl,
-    credential: coordinator.adminToken,
-    fetch: fetchImpl
-  });
-  const e = await api.post("/api/hosts/enrollments", {});
-  const cfg = await enroll({
-    coordinatorUrl: localUrl,
-    token: e.token,
-    name,
-    configPath,
-    fetch: fetchImpl
-  });
-  const { configPath: _p, ...config } = cfg;
-  return { config, enrolled: true };
-}
-function openBrowser(url, platform = process.platform, spawnFn = spawn5) {
-  const cmd = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
-  if (!cmd)
-    return;
-  try {
-    const child = spawnFn(cmd, [url], { detached: true, stdio: "ignore" });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-async function initializeLocally(ctx, coordinator, open2, opener) {
-  if (coordinator.owner.isInitialized())
-    return null;
-  coordinator.owner.markInitialized();
-  const e = coordinator.auth.createEnrollment("device", ADMIN_DEVICE_ID);
-  await printInit(ctx, { alreadyInitialized: false, enrollment: e });
-  if (open2)
-    opener(e.url);
-  return e.url;
-}
-async function startStandalone(ctx, flags, deps = {}) {
-  if (flags.dev && !ctx.env.SWITCHYARD_LOG_LEVEL)
-    process.env.SWITCHYARD_LOG_LEVEL = "debug";
-  const opts = upOptions(flags, ctx.env);
-  const coordinator = createCoordinator({ ...opts, setupHint: false });
-  await coordinator.start();
-  let firstLink;
-  try {
-    firstLink = await initializeLocally(ctx, coordinator, flags.open ?? process.stdout.isTTY === true, deps.open ?? ((url) => openBrowser(url)));
-  } catch (err) {
-    await coordinator.stop();
-    throw err;
-  }
-  const localUrl = localUrlFor(opts.listen, coordinator.port);
-  writeEndpoint(opts.dataDir, { localUrl, publicUrl: coordinator.config.publicUrl });
-  let host;
-  try {
-    const paths = standaloneHostPaths(opts.dataDir);
-    const { config, enrolled } = await ensureLocalHost(coordinator, localUrl, paths.configPath, flags.name ?? hostname4().replace(/\.local$/, ""));
-    if (enrolled)
-      ctx.err(`Enrolled the local host "${config.name}" (${config.hostId})`);
-    host = await runHostAgent({ config, stateDir: paths.stateDir, handleSignals: false });
-  } catch (err) {
-    await coordinator.stop();
-    throw err;
-  }
-  return {
-    coordinator,
-    host,
-    localUrl,
-    firstLink,
-    async stop() {
-      await host.stop();
-      await coordinator.stop();
-    }
-  };
-}
-async function up(ctx, flags) {
-  const s = await startStandalone(ctx, flags);
-  const c = s.coordinator;
-  ctx.err([
-    `Switchyard is up: ${c.config.publicUrl} (listening on port ${c.port})`,
-    `Data: ${c.config.dataDir}`,
-    c.config.webDist ? null : "Web app bundle not found: API only (run `pnpm build`)",
-    "Another device: switchyard pair    Terminal: switchyard tui <session>",
-    "Schedules run only while this process is running."
-  ].filter(Boolean).join("\n"));
-  const sig = await waitForSignal();
-  ctx.err(`${sig}: stopping (Pi sessions on this host are stopped and can be resumed later)`);
-  await s.stop();
-}
-
 // packages/cli/dist/commands/work.js
 function byId2(list) {
   return new Map(list.map((x) => [x.id, x]));
@@ -20596,13 +21162,10 @@ function buildProgram(ctx = defaultCtx()) {
   });
   host.command("backup <out>").description("Consistent backup of the host database").option("--state-dir <dir>", "state dir (env SWITCHYARD_STATE_DIR)").action((out, o) => hostBackup(ctx, out, o));
   host.command("status").description("Show this host's enrollment, link and Pi status").option("--config <path>", "host.json path").option("--state-dir <dir>", "state dir").option("--json", "JSON output").action((o) => hostStatus(ctx, o));
-  program.command("init").description("Set up this server and print a single-use sign-in link for your first device").option("--coordinator <url>", "local coordinator URL (default: the running one)").option("--data-dir <dir>", "data dir holding admin.token").option("--json", "JSON output").action(async (o) => {
-    await init(ctx, o);
-  });
-  program.command("pair").description("Create a single-use link and QR for another device (or --host); also the recovery path when every device is lost").option("--host", "enroll a host instead of a device").option("--coordinator <url>", "local coordinator URL (default: the running one)").option("--data-dir <dir>", "data dir holding admin.token").option("--json", "JSON output").action(async (o) => {
+  program.command("pair").description("Print a single-use sign-in link and QR for a browser (or --host for a host token), using the admin token: for local servers and recovery").option("--host", "enroll a host instead of a device").option("--coordinator <url>", "local coordinator URL (default: the running one)").option("--data-dir <dir>", "data dir holding admin.token").option("--json", "JSON output").action(async (o) => {
     await pair(ctx, o);
   });
-  program.command("login").description("Enroll this terminal as a device (writes ~/.config/switchyard/client.json)").option("--coordinator <url>", "coordinator URL").requiredOption("--token <token>", "device enrollment token or link (switchyard pair)").option("--name <name>", "device name").action(async (o) => {
+  program.command("login").description("Sign this terminal in by approving it in a browser (writes ~/.config/switchyard/client.json)").option("--coordinator <url>", "coordinator URL (default: SWITCHYARD_URL or client.json)").option("--name <name>", "device name").option("--token <token>", "single-use sign-in link or token from `switchyard pair`, instead of browser approval").option("--open", "open the approval page in a browser (default: when interactive and not over SSH)").option("--no-open", "never open a browser").action(async (o) => {
     await login(ctx, o);
   });
   connectionOptions(program.command("doctor").description("Check Node, Pi, git, coordinator, credentials, host link and push")).action(async (o) => {