@tonbo/cli 0.14.1 → 0.16.0

package/dist/bin/tonbo.js

@@ -174,6 +174,42 @@ var managementOperations = {
     "idempotencyKey": false,
     "cli": "tonbo account show"
   },
+  "listBudgets": {
+    "method": "GET",
+    "path": "/budgets",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget list"
+  },
+  "createBudget": {
+    "method": "POST",
+    "path": "/budgets",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": true,
+    "cli": "tonbo budget add"
+  },
+  "getBudget": {
+    "method": "GET",
+    "path": "/budgets/{budget_id}",
+    "pathParams": [
+      "budget_id"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget show"
+  },
+  "changeBudget": {
+    "method": "PATCH",
+    "path": "/budgets/{budget_id}",
+    "pathParams": [
+      "budget_id"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget set"
+  },
   "listRegions": {
     "method": "GET",
     "path": "/regions",
@@ -438,6 +474,13 @@ var managementOperations = {
     "query": [],
     "idempotencyKey": false
   },
+  "renewHandoffHolds": {
+    "method": "POST",
+    "path": "/yield/handoffs/holds",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false
+  },
   "showPersonalHandoff": {
     "method": "GET",
     "path": "/yield/handoffs/{id}",
@@ -574,6 +617,13 @@ var managementOperations = {
     "query": [],
     "idempotencyKey": false
   },
+  "leaveYieldOrganization": {
+    "method": "POST",
+    "path": "/yield/leave",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false
+  },
   "recordYieldMetric": {
     "method": "POST",
     "path": "/yield/metrics",
@@ -600,6 +650,13 @@ var managementOperations = {
     "query": [],
     "idempotencyKey": false
   },
+  "createYieldPickup": {
+    "method": "POST",
+    "path": "/yield/pickups",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false
+  },
   "listYieldQuestions": {
     "method": "GET",
     "path": "/yield/questions",
@@ -794,6 +851,16 @@ var managementOperations = {
     "idempotencyKey": false,
     "cli": "tonbo machine sleep"
   },
+  "wakeMachine": {
+    "method": "POST",
+    "path": "/machines/{name}/wake",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine wake"
+  },
   "listMachineActivations": {
     "method": "GET",
     "path": "/machines/{name}/activations",
@@ -924,6 +991,101 @@ var managementOperations = {
     "cli": "tonbo machine file list",
     "cell": true
   },
+  "listMachineProcesses": {
+    "method": "GET",
+    "path": "/machines/{name}/processes",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine ps",
+    "cell": true
+  },
+  "startMachineProcess": {
+    "method": "POST",
+    "path": "/machines/{name}/processes",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": true,
+    "cli": "tonbo machine exec --detach",
+    "cell": true
+  },
+  "getMachineProcess": {
+    "method": "GET",
+    "path": "/machines/{name}/processes/{process}",
+    "pathParams": [
+      "name",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine wait",
+    "cell": true
+  },
+  "killMachineProcess": {
+    "method": "DELETE",
+    "path": "/machines/{name}/processes/{process}",
+    "pathParams": [
+      "name",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine kill",
+    "cell": true
+  },
+  "readMachineProcessOutput": {
+    "method": "GET",
+    "path": "/machines/{name}/processes/{process}/output",
+    "pathParams": [
+      "name",
+      "process"
+    ],
+    "query": [
+      "offset"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine output",
+    "cell": true
+  },
+  "listMachineHolds": {
+    "method": "GET",
+    "path": "/machines/{name}/holds",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine hold ls",
+    "cell": true
+  },
+  "setMachineHold": {
+    "method": "PUT",
+    "path": "/machines/{name}/holds/{hold}",
+    "pathParams": [
+      "name",
+      "hold"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine hold set",
+    "cell": true
+  },
+  "releaseMachineHold": {
+    "method": "DELETE",
+    "path": "/machines/{name}/holds/{hold}",
+    "pathParams": [
+      "name",
+      "hold"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine hold rm",
+    "cell": true
+  },
   "issueSshCertificate": {
     "method": "POST",
     "path": "/ssh/certificates",
@@ -1059,6 +1221,146 @@ var managementOperations = {
     "cli": "tonbo stream usage"
   }
 };
+var plannedManagementOperations = {
+  "getMachineActivation": {
+    "method": "GET",
+    "path": "/machines/{name}/activations/{activation}",
+    "pathParams": [
+      "name",
+      "activation"
+    ],
+    "query": [
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine activation show"
+  },
+  "getMachineUsage": {
+    "method": "GET",
+    "path": "/machines/{name}/usage",
+    "pathParams": [
+      "name"
+    ],
+    "query": [
+      "from",
+      "to",
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine usage"
+  },
+  "setMachineProcessDeadline": {
+    "method": "PUT",
+    "path": "/machines/{machine}/processes/{process}/deadline",
+    "pathParams": [
+      "machine",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine extend",
+    "cell": true
+  },
+  "signalMachineProcess": {
+    "method": "POST",
+    "path": "/machines/{machine}/processes/{process}/signal",
+    "pathParams": [
+      "machine",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine signal",
+    "cell": true
+  },
+  "createMachineDirectory": {
+    "method": "PUT",
+    "path": "/machines/{machine}/files/directory",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "path",
+      "parents",
+      "mode",
+      "user"
+    ],
+    "idempotencyKey": true,
+    "cli": "tonbo machine file mkdir",
+    "cell": true
+  },
+  "renameMachineFile": {
+    "method": "POST",
+    "path": "/machines/{machine}/files/rename",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "user"
+    ],
+    "idempotencyKey": true,
+    "cli": "tonbo machine file mv",
+    "cell": true
+  },
+  "getMachineFileArchive": {
+    "method": "GET",
+    "path": "/machines/{machine}/files/archive",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "path",
+      "format",
+      "user"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine file archive",
+    "cell": true
+  },
+  "readMachineLogs": {
+    "method": "GET",
+    "path": "/machines/{machine}/logs",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "activation",
+      "cursor",
+      "since",
+      "limit",
+      "follow"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine logs",
+    "cell": true
+  },
+  "listSshCertificates": {
+    "method": "GET",
+    "path": "/ssh/certificates",
+    "pathParams": [],
+    "query": [
+      "member",
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo ssh certificate list",
+    "cell": true
+  },
+  "revokeSshCertificate": {
+    "method": "DELETE",
+    "path": "/ssh/certificates/{certificate}",
+    "pathParams": [
+      "certificate"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo ssh certificate revoke",
+    "cell": true
+  }
+};
 var accountRoles = [
   "owner",
   "admin",
@@ -1673,6 +1975,7 @@ var machinePortAccess = [
 var machineTimings = {
   "pollAfterSeconds": 2,
   "sleepPollAfterSeconds": 5,
+  "wakePollAfterSeconds": 2,
   "wakeHoldSeconds": 25,
   "earlyReclaimSeconds": 120
 };
@@ -1687,19 +1990,29 @@ var MANAGEMENT_AUDIENCE = cliSessionContract.audiences.management;
 function isAccountBearer(bearer) {
   return typeof bearer !== "string";
 }
+function retriesAfterRefusal(bearer, audience, code) {
+  if (!isAccountBearer(bearer))
+    return false;
+  if (bearer.kind === "key")
+    return bearer.refused(audience, code);
+  bearer.invalidate(audience);
+  return true;
+}
 function managementBearer(bearer) {
   return isAccountBearer(bearer) ? bearer.token(MANAGEMENT_AUDIENCE) : Promise.resolve(bearer);
 }
 
 // ../../packages/tonbo-cli-core/dist/src/access-token.js
 var DEFAULT_LOGIN_HINT = credentialsContract.reader.login_hint;
+var STREAMS_AUDIENCE = "https://streams.tonbo.dev";
 var GIT_AUDIENCE = "https://git.tonbo.dev";
+var REFRESH_MARGIN_MS = 6e4;
 var AccessTokenError = class extends Error {
   status;
   retryAfterMs;
   code;
-  constructor(message, status, retryAfterMs = null, code = null) {
-    super(message);
+  constructor(message, status, retryAfterMs = null, code = null, options) {
+    super(message, options);
     this.status = status;
     this.retryAfterMs = retryAfterMs;
     this.code = code;
@@ -1708,6 +2021,116 @@ var AccessTokenError = class extends Error {
     return this.status === null || this.status === 429 || this.status >= 500;
   }
 };
+var AccessTokens = class {
+  fetcher;
+  userOrigin;
+  audience;
+  loginHint;
+  now;
+  cached = null;
+  /** The account bearer the last token was of, which `invalidate` forgets. */
+  last = null;
+  constructor(fetcher, userOrigin, audience = STREAMS_AUDIENCE, loginHint = DEFAULT_LOGIN_HINT, now = () => Date.now()) {
+    this.fetcher = fetcher;
+    this.userOrigin = userOrigin;
+    this.audience = audience;
+    this.loginHint = loginHint;
+    this.now = now;
+  }
+  async token(key) {
+    if (isAccountBearer(key)) {
+      this.last = key;
+      return key.token(this.audience);
+    }
+    if (this.cached && this.cached.key === key && this.cached.refreshAt > this.now())
+      return this.cached.token;
+    const issuedAt = this.now();
+    const what = this.audience === GIT_AUDIENCE ? "git" : this.audience === MANAGEMENT_AUDIENCE ? "Management" : "Streams";
+    let response;
+    try {
+      response = await this.fetcher(`${this.userOrigin}/api/iam/token`, {
+        method: "POST",
+        redirect: "manual",
+        signal: AbortSignal.timeout(3e4),
+        headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+        body: JSON.stringify({ audience: this.audience })
+      });
+    } catch (error) {
+      throw new AccessTokenError(`The ${what} token exchange failed: ${error instanceof Error ? error.message : String(error)}`, null, null, null, { cause: error });
+    }
+    if (!response.ok) {
+      const problem = await response.json().catch(() => null);
+      const retryAfter = Number(response.headers.get("retry-after") ?? "");
+      throw new AccessTokenError(response.status === 401 ? `Your Tonbo login was refused. Run \`${this.loginHint}\`.` : `The ${what} token exchange answered ${response.status}.`, response.status, Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1e3 : null, typeof problem?.code === "string" ? problem.code : null);
+    }
+    const body = await response.json().catch(() => null);
+    if (typeof body?.access_token !== "string" || !body.access_token || typeof body.expires_in !== "number" || !(body.expires_in > 0))
+      throw new AccessTokenError(`The ${what} token exchange answered no token.`, response.status);
+    this.cached = {
+      key,
+      token: body.access_token,
+      refreshAt: issuedAt + Math.max(0, body.expires_in * 1e3 - REFRESH_MARGIN_MS)
+    };
+    return body.access_token;
+  }
+  /** Forgets the token, after the resource server refused it. */
+  invalidate() {
+    this.cached = null;
+    this.last?.invalidate(this.audience);
+  }
+  /** Sends a request with the token; a 401 drops the token and sends once
+   * more with a newly exchanged one, whose answer is final. */
+  async send(key, request) {
+    const response = await request(await this.token(key));
+    if (response.status !== 401)
+      return response;
+    await response.body?.cancel();
+    if (isAccountBearer(key))
+      key.invalidate(this.audience);
+    else
+      this.invalidate();
+    return request(await this.token(key));
+  }
+};
+function apiKeyBearer(key, fetcher, userOrigin, now = () => Date.now()) {
+  const tokens = /* @__PURE__ */ new Map();
+  let exchanging = false;
+  const tokensOf = (audience) => {
+    let found = tokens.get(audience);
+    if (!found) {
+      found = new AccessTokens(fetcher, userOrigin, audience, void 0, now);
+      tokens.set(audience, found);
+    }
+    return found;
+  };
+  return {
+    kind: "key",
+    async token(audience) {
+      if (audience === MANAGEMENT_AUDIENCE && !exchanging)
+        return key;
+      try {
+        return await tokensOf(audience).token(key);
+      } catch (error) {
+        if (!(error instanceof AccessTokenError) || error.status !== 401)
+          throw error;
+        throw new AccessTokenError("TONBO_API_KEY was refused (HTTP 401). Check that the key exists and is not revoked or expired.", 401, null, error.code);
+      }
+    },
+    invalidate(audience) {
+      tokens.get(audience)?.invalidate();
+    },
+    refused(audience, code) {
+      if (audience === MANAGEMENT_AUDIENCE && !exchanging) {
+        if (code !== "exchange_required")
+          return false;
+        exchanging = true;
+        return true;
+      }
+      tokens.get(audience)?.invalidate();
+      return true;
+    }
+  };
+}
 
 // ../../packages/tonbo-cli-core/dist/src/http.js
 var HttpError = class extends Error {
@@ -1733,11 +2156,11 @@ async function requestJson(fetcher, url, init = {}) {
   if (response.ok)
     return body;
   const record = body && typeof body === "object" ? body : {};
-  const reason = [record.detail, record.title, record.error].find((value) => typeof value === "string" && value.length > 0);
+  const reason2 = [record.detail, record.title, record.error].find((value) => typeof value === "string" && value.length > 0);
   const requestId = response.headers.get("x-request-id") ?? (typeof record.request_id === "string" ? record.request_id : null);
   const issues = Array.isArray(record.errors) ? record.errors.filter((issue) => typeof issue?.field === "string" && typeof issue.code === "string").map((issue) => `${issue.field}: ${issue.code}`) : [];
   const message = [
-    reason ?? `Request failed with HTTP ${response.status}.`,
+    reason2 ?? `Request failed with HTTP ${response.status}.`,
     ...issues.length ? [`(${issues.join(", ")})`] : []
   ].join(" ");
   throw new HttpError(requestId ? `${message} (request ${requestId})` : message, response.status, body, requestId);
@@ -1745,6 +2168,9 @@ async function requestJson(fetcher, url, init = {}) {
 
 // ../../packages/tonbo-cli-core/dist/src/api.js
 var DEFAULT_API_ORIGIN = "https://api.tonbo.dev";
+function managementOperation(operationId) {
+  return operationId in managementOperations ? managementOperations[operationId] : plannedManagementOperations[operationId];
+}
 var DEFAULT_LOGIN_HINT2 = credentialsContract.reader.login_hint;
 var ExchangeRefusal = class extends HttpError {
 };
@@ -1752,9 +2178,9 @@ async function presented(key) {
   try {
     return await managementBearer(key);
   } catch (error) {
-    if (!(error instanceof AccessTokenError))
+    if (!(error instanceof AccessTokenError) || error.status === null)
       throw error;
-    throw new ExchangeRefusal(error.message, error.status ?? 503, { code: error.code }, null);
+    throw new ExchangeRefusal(error.message, error.status, { code: error.code }, null);
   }
 }
 var ManagementApi = class {
@@ -1782,15 +2208,14 @@ var ManagementApi = class {
     try {
       return await attempt();
     } catch (error) {
-      if (!isAccountBearer(key) || !(error instanceof HttpError) || error.status !== 401 || error instanceof ExchangeRefusal)
+      if (!(error instanceof HttpError) || error.status !== 401 || error instanceof ExchangeRefusal || !retriesAfterRefusal(key, MANAGEMENT_AUDIENCE, error.code))
         throw error;
-      key.invalidate(MANAGEMENT_AUDIENCE);
       return attempt();
     }
   }
   async requestWith(operationId, key, { params = {}, query = {}, body, idempotencyKey, ifMatch }, seen) {
-    const operation = managementOperations[operationId];
-    const path4 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
+    const operation = managementOperation(operationId);
+    const path5 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
       const value = params[name];
       if (value === void 0)
         throw new Error(`${operationId} needs the path parameter ${name}.`);
@@ -1814,7 +2239,7 @@ var ManagementApi = class {
     if (ifMatch)
       headers["if-match"] = ifMatch;
     const queryString = search.toString();
-    const url = `${this.apiOrigin}${managementApiBasePath}${path4}${queryString ? `?${queryString}` : ""}`;
+    const url = `${this.apiOrigin}${managementApiBasePath}${path5}${queryString ? `?${queryString}` : ""}`;
     try {
       const fetcher = seen ? async (input, init) => {
         const response = await this.fetcher(input, init);
@@ -1855,6 +2280,27 @@ var ManagementApi = class {
       idempotencyKey
     }).catch(unconfirmed("Agent creation", idempotencyKey, "the same name, role and region"));
   }
+  /** The account's budgets (planned: 404 until budgets are served). */
+  listBudgets(key) {
+    return this.call("listBudgets", key);
+  }
+  getBudget(key, budgetId) {
+    return this.call("getBudget", key, { params: { budget_id: budgetId } });
+  }
+  /** A replay with the same idempotency key returns the budget the first
+   * request created. */
+  createBudget(key, request, idempotencyKey) {
+    return this.call("createBudget", key, {
+      body: withoutUndefined(request),
+      idempotencyKey
+    }).catch(unconfirmed("Budget creation", idempotencyKey, "the same name, limit and members"));
+  }
+  changeBudget(key, budgetId, change) {
+    return this.call("changeBudget", key, {
+      params: { budget_id: budgetId },
+      body: withoutUndefined(change)
+    });
+  }
   listApiKeys(key, page) {
     return this.page("listApiKeys", key, page);
   }
@@ -2074,6 +2520,18 @@ var ManagementApi = class {
     });
     return { machine: answer.data, retryAfterSeconds: retryAfterSeconds(headers.retryAfter) };
   }
+  /** With `etag`, only the Machine that ETag names, at that revision, is
+   * woken (machine-v2.json `etag.if_match.wake` is optional). A 202 carries
+   * the `Retry-After` to read the Machine again after (machine-v2.json
+   * `wake.poll_after_seconds`); a 200 (already awake) carries none. A
+   * refused wake throws the API's problem. */
+  async wakeMachine(key, name, etag) {
+    const headers = { retryAfter: null };
+    const answer = await this.request("wakeMachine", key, { params: { name }, ...etag ? { ifMatch: etag } : {} }, (response) => {
+      headers.retryAfter = response.headers.get("retry-after");
+    });
+    return { machine: answer.data, retryAfterSeconds: retryAfterSeconds(headers.retryAfter) };
+  }
   /** The Machine being deleted or the device forgotten, with its kind; the
    * Machine is null when the API answered 204, whose `X-Tonbo-Machine-Kind`
    * says whether a name was released (`managed`: its create never reached its
@@ -2144,11 +2602,42 @@ import os4 from "node:os";
 import { promisify as promisify2 } from "node:util";
 
 // ../../packages/tonbo-cli-core/dist/src/callback-page.js
-var WORDMARK = [
-  "\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-  "\u2588\u2588\u2584 \u2584\u2588\u2588\u2580\u2584 \u2588\u2588 \u2584\u2580\u2588\u2588 \u2584 \u2588\u2588 \u2584\u2580\u2588",
-  "\u2588\u2588\u2588\u2584\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2584\u2588\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2588"
-].join("\n");
+var LOGO_PIXELS = [
+  [0, 5],
+  [5, 0],
+  [5, 5],
+  [5, 10],
+  [5, 15],
+  [10, 5],
+  [10, 15],
+  [21, 10],
+  [21, 15],
+  [26, 5],
+  [26, 15],
+  [31, 5],
+  [31, 10],
+  [42, 5],
+  [42, 10],
+  [42, 15],
+  [47, 5],
+  [52, 10],
+  [52, 15],
+  [63, 0],
+  [63, 5],
+  [63, 10],
+  [63, 15],
+  [68, 5],
+  [68, 15],
+  [73, 5],
+  [73, 10],
+  [84, 5],
+  [84, 10],
+  [89, 5],
+  [89, 15],
+  [94, 10],
+  [94, 15]
+];
+var LOGO = `<svg class="wordmark" aria-hidden="true" viewBox="0 0 99 20" width="99" height="20"><g fill="currentColor" shape-rendering="crispEdges">${LOGO_PIXELS.map(([x, y]) => `<rect x="${x}" y="${y}" width="5" height="5"/>`).join("")}</g></svg>`;
 var OUTCOMES = {
   complete: {
     status: 200,
@@ -2185,7 +2674,7 @@ function renderCallbackPage(outcome) {
     --ink: #1d1b17;
     --rule: #c9c5ba;
     --quiet: #5c564a;
-    --signal: #d64a03;
+    --signal: #e5673e;
   }
   @media (prefers-color-scheme: dark) {
     :root {
@@ -2193,7 +2682,7 @@ function renderCallbackPage(outcome) {
       --ink: #f3f2ee;
       --rule: #3a362e;
       --quiet: #a49e8f;
-      --signal: #f08b4b;
+      --signal: #e5673e;
     }
   }
   * { box-sizing: border-box; }
@@ -2209,21 +2698,9 @@ function renderCallbackPage(outcome) {
     -webkit-font-smoothing: antialiased;
   }
   header { padding: 28px 0; }
-  /* Same metrics as .auth-wordmark in the app: the glyphs are the ground
-     and the letters are the gaps, so the 8px/10px/scaleY(0.8) combination is
-     what makes the rows meet without seams. Iosevka is not available here,
-     so it falls back to the platform monospace. */
-  pre.wordmark {
-    margin: 0;
-    font-family: 'Iosevka', ui-monospace, 'SFMono-Regular', Menlo, Consolas, monospace;
-    font-size: 8px;
-    font-weight: 400;
-    line-height: 10px;
-    letter-spacing: 0;
-    white-space: pre;
+  svg.wordmark {
+    display: block;
     color: var(--signal);
-    transform: scaleY(0.8);
-    transform-origin: left top;
   }
   main {
     display: flex;
@@ -2254,7 +2731,7 @@ function renderCallbackPage(outcome) {
 </style>
 </head>
 <body>
-<header><pre class="wordmark" aria-hidden="true">${WORDMARK}</pre></header>
+<header>${LOGO}</header>
 <main>
   <h1>${title}</h1>
   <p>${body}</p>
@@ -2430,17 +2907,20 @@ function accountLogins(login) {
     });
   return entries;
 }
+function personalLogin(login) {
+  return accountLogins(login).find((entry) => entry.kind === "user") ?? null;
+}
 async function preparePrivateDirectory(directory) {
-  const stat = await lstat(directory);
-  if (stat.isSymbolicLink() || !stat.isDirectory())
+  const stat2 = await lstat(directory);
+  if (stat2.isSymbolicLink() || !stat2.isDirectory())
     throw new Error("Tonbo config directory must be a real directory.");
   if (process.platform !== "win32")
     await chmod(directory, DIRECTORY_MODE);
 }
 async function assertExistingDestinationIsSafe(filename) {
   try {
-    const stat = await lstat(filename);
-    if (stat.isSymbolicLink() || !stat.isFile())
+    const stat2 = await lstat(filename);
+    if (stat2.isSymbolicLink() || !stat2.isFile())
       throw new Error("Tonbo credential path must be a regular file.");
   } catch (error) {
     if (error.code !== "ENOENT")
@@ -2448,17 +2928,17 @@ async function assertExistingDestinationIsSafe(filename) {
   }
 }
 async function assertPrivateRegularFile(filename) {
-  const stat = await lstat(filename);
-  if (stat.isSymbolicLink() || !stat.isFile())
+  const stat2 = await lstat(filename);
+  if (stat2.isSymbolicLink() || !stat2.isFile())
     throw new Error("Tonbo credential path must be a regular file.");
-  if (process.platform !== "win32" && (stat.mode & REFUSED_MODE_BITS) !== 0)
+  if (process.platform !== "win32" && (stat2.mode & REFUSED_MODE_BITS) !== 0)
     throw new Error(`Tonbo credential file must have mode ${credentialsContract.permissions.file_mode}.`);
 }
 
 // ../../packages/tonbo-cli-core/dist/src/device.js
 import { execFile } from "node:child_process";
 import { createHash, randomUUID as randomUUID2 } from "node:crypto";
-import { link, mkdir as mkdir2, open as open2, readFile as readFile2, rename as rename2, rm as rm2 } from "node:fs/promises";
+import { link, mkdir as mkdir2, open as open2, readFile as readFile2, rename as rename2, rm as rm2, stat } from "node:fs/promises";
 import os2 from "node:os";
 import path2 from "node:path";
 import { promisify } from "node:util";
@@ -2485,6 +2965,14 @@ async function readMachineId(platform = process.platform) {
 function machineIdHash(machineId) {
   return createHash("sha256").update(machineId).digest("hex");
 }
+var NO_HARD_LINKS = /* @__PURE__ */ new Set(["EPERM", "ENOTSUP", "EOPNOTSUPP", "ENOSYS", "EMLINK", "EXDEV"]);
+var CREATE_POLL_MS = 50;
+var CREATE_STALE_MS = 5e3;
+var exists = (file) => stat(file).then(() => true, (error) => {
+  if (error.code === "ENOENT")
+    return false;
+  throw error;
+});
 var DeviceStore = class {
   filename;
   machineId;
@@ -2562,13 +3050,49 @@ var DeviceStore = class {
       await link(temporary, this.filename);
       return true;
     } catch (error) {
-      if (!replace && error.code === "EEXIST")
+      const code = error.code;
+      if (!replace && code === "EEXIST")
         return false;
+      if (!replace && code && NO_HARD_LINKS.has(code))
+        return await this.create(temporary);
       throw error;
     } finally {
       await rm2(temporary, { force: true });
     }
   }
+  /** The first record on a filesystem without hard links (some FUSE and
+   * network volumes), from the complete, synced `temporary`: renamed into
+   * place, so the file is never seen empty or partial, while holding a lock
+   * directory made exclusively, so of two first runs at once only one
+   * writes it and the other waits for it. A lock left by a run that died
+   * holding it is taken over after a while. */
+  async create(temporary) {
+    const lock = `${this.filename}.lock`;
+    for (let waited = 0; ; waited += CREATE_POLL_MS) {
+      try {
+        await mkdir2(lock, { mode: 448 });
+        break;
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+      }
+      if (await exists(this.filename))
+        return false;
+      if (waited >= CREATE_STALE_MS) {
+        await rm2(lock, { recursive: true, force: true });
+        waited = -CREATE_POLL_MS;
+      } else
+        await new Promise((resolve) => setTimeout(resolve, CREATE_POLL_MS));
+    }
+    try {
+      if (await exists(this.filename))
+        return false;
+      await rename2(temporary, this.filename);
+      return true;
+    } finally {
+      await rm2(lock, { recursive: true, force: true });
+    }
+  }
 };
 
 // ../../packages/tonbo-cli-core/dist/src/session.js
@@ -2613,7 +3137,7 @@ var FileSessionStore = class {
     await removePrivateFile(this.filename);
   }
 };
-var REFRESH_MARGIN_MS = 6e4;
+var REFRESH_MARGIN_MS2 = 6e4;
 var clients = /* @__PURE__ */ new WeakMap();
 var SessionClient = class _SessionClient {
   stored;
@@ -2663,6 +3187,14 @@ var SessionClient = class _SessionClient {
     }
     return bearer;
   }
+  /** Drops every token of `accountId` this process keeps, and its bearer. */
+  forget(accountId) {
+    for (const id of [...this.tokens.keys()])
+      if (id.endsWith(` ${accountId}`))
+        this.tokens.delete(id);
+    this.bearers.delete(accountId);
+    this.workspaces.delete(accountId);
+  }
   /** A token of `accountId` for `audience`, kept until a minute before it expires. */
   async token(audience, accountId) {
     const id = `${audience} ${accountId}`;
@@ -2700,7 +3232,7 @@ var SessionClient = class _SessionClient {
     }, what, accountId);
     this.tokens.set(`${audience} ${accountId}`, {
       token: body.access_token,
-      refreshAt: issuedAt + Math.max(0, body.expires_in * 1e3 - REFRESH_MARGIN_MS)
+      refreshAt: issuedAt + Math.max(0, body.expires_in * 1e3 - REFRESH_MARGIN_MS2)
     });
     return body.access_token;
   }
@@ -2718,7 +3250,7 @@ var SessionClient = class _SessionClient {
         body: JSON.stringify(fields2)
       });
     } catch (error) {
-      throw new AccessTokenError(`The ${what} token exchange failed: ${error instanceof Error ? error.message : String(error)}`, null);
+      throw new AccessTokenError(`The ${what} token exchange failed: ${error instanceof Error ? error.message : String(error)}`, null, null, null, { cause: error });
     }
     if (!response.ok)
       throw await this.refusal(response, what, accountId);
@@ -2759,7 +3291,7 @@ var SessionClient = class _SessionClient {
         headers: { authorization: `Bearer ${token}`, accept: "application/json" }
       });
     } catch (error) {
-      throw new AccessTokenError(`Reading ${this.accountName(accountId)}'s git workspaces failed: ${error instanceof Error ? error.message : String(error)}`, null);
+      throw new AccessTokenError(`Reading ${this.accountName(accountId)}'s git workspaces failed: ${error instanceof Error ? error.message : String(error)}`, null, null, null, { cause: error });
     }
     const body = await response.json().catch(() => null);
     if (!response.ok)
@@ -2784,7 +3316,7 @@ var SessionClient = class _SessionClient {
         }
       });
     } catch (error) {
-      throw new AccessTokenError(`Reading your accounts failed: ${error instanceof Error ? error.message : String(error)}`, null);
+      throw new AccessTokenError(`Reading your accounts failed: ${error instanceof Error ? error.message : String(error)}`, null, null, null, { cause: error });
     }
     if (!response.ok)
       throw await this.refusal(response, "session", "");
@@ -2866,17 +3398,46 @@ var LoginStore = class {
     await this.sessions.remove();
     await this.legacy.remove();
   }
-  /** The person's accounts now, saved as the login's cache of names. */
+  /** The person's accounts now, saved as the login's cache of names. `client`
+   * holds them before the save, so when the file cannot be written (an
+   * agent's sandbox) `current(client)` still answers with them. */
   async refreshAccounts(client) {
     const accounts = await client.accounts();
     const latest = await this.sessions.load() ?? client.stored;
     if (latest.session.id === client.stored.session.id) {
       const saved = withAccounts(latest, accounts);
-      await this.sessions.save(saved);
       client.stored = saved;
+      await this.sessions.save(saved);
     }
     return accounts;
   }
+  /** The logins `client` holds in this process, without reading the file again. */
+  current(client) {
+    return this.view(client);
+  }
+  /** Forgets an account the person no longer belongs to (they left it, or
+   * were removed): the login's cache of names is read again without it, it
+   * is no longer the default account, and this process's tokens of it are
+   * dropped. The CLI login itself stays: it still reaches every other
+   * account. Without a CLI login there is nothing to forget. */
+  async forgetAccount(accountId) {
+    const client = await this.session().catch(() => null);
+    if (!client)
+      return;
+    await this.refreshAccounts(client).catch(() => void 0);
+    const latest = await this.sessions.load();
+    if (!latest || latest.session.id !== client.stored.session.id)
+      return;
+    const { [accountId]: _forgotten, ...accounts } = latest.accounts ?? {};
+    const saved = {
+      ...latest,
+      accounts,
+      default_account_id: latest.default_account_id === accountId ? null : latest.default_account_id ?? null
+    };
+    await this.sessions.save(saved);
+    client.stored = saved;
+    client.forget(accountId);
+  }
   /** The id of the account `nameOrId` names, looked up again once when the cache misses. */
   async resolve(client, nameOrId) {
     if (UUID2.test(nameOrId))
@@ -2934,11 +3495,21 @@ var LoginStore = class {
     const named = this.options.account;
     if (!named)
       return;
-    const response = await this.fetcher(`${this.options.apiOrigin}${managementApiBasePath}${managementOperations.getAccount.path}`, {
+    const read = async () => this.fetcher(`${this.options.apiOrigin}${managementApiBasePath}${managementOperations.getAccount.path}`, {
       redirect: "manual",
       signal: AbortSignal.timeout(3e4),
-      headers: { authorization: `Bearer ${key}`, accept: "application/json" }
+      headers: {
+        authorization: `Bearer ${await managementBearer(key)}`,
+        accept: "application/json"
+      }
     });
+    let response = await read();
+    if (response.status === 401) {
+      const refusal = await response.json().catch(() => null);
+      const code = typeof refusal?.code === "string" ? refusal.code : null;
+      if (retriesAfterRefusal(key, MANAGEMENT_AUDIENCE, code))
+        response = await read();
+    }
     const body = await response.json().catch(() => null);
     if (!response.ok)
       throw new Error(`TONBO_API_KEY was refused (HTTP ${response.status}).`);
@@ -2971,9 +3542,11 @@ var DEFAULT_LOGIN_HINT3 = credentialsContract.reader.login_hint;
 var LOOPBACK_HOST = "127.0.0.1";
 var BrowserUnavailableError = class extends Error {
 };
-function prefersDeviceLogin(env = process.env) {
+function prefersDeviceLogin(env = process.env, platform = process.platform) {
+  if (env.DISPLAY || env.WAYLAND_DISPLAY)
+    return false;
   const ssh = Boolean(env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY);
-  return ssh && !env.DISPLAY && !env.WAYLAND_DISPLAY;
+  return ssh || platform !== "darwin" && platform !== "win32";
 }
 function loginHostname(hostname = os4.hostname()) {
   const cleaned = hostname.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[^A-Za-z0-9]+/, "").slice(0, 64);
@@ -2992,7 +3565,8 @@ var AuthClient = class {
   entryLine;
   env;
   facts;
-  keyChecked = null;
+  /** TONBO_API_KEY's bearer, made once per key so its tokens and its exchange outlive a call. */
+  injectedBearer = null;
   constructor(credentials, fetcher, loginOrigin2 = "https://tonbo.dev", browserOpener = openBrowser, hostname = loginHostname(), loginHint = DEFAULT_LOGIN_HINT3, entryLine = "cli", env = process.env, facts = {}) {
     this.credentials = credentials;
     this.fetcher = fetcher;
@@ -3006,18 +3580,25 @@ var AuthClient = class {
   }
   /**
    * The credential of the account a command acts in: TONBO_API_KEY (whose
-   * own account any account the command named must be), or the CLI login's
-   * bearer of the named account, else of its default, else of the personal
-   * account; with only a legacy login, that file's key.
+   * own account any account the command named must be), presented as the
+   * Tonbo SDK presents a key (apiKeyBearer), or the CLI login's bearer of the
+   * named account, else of its default, else of the personal account; with
+   * only a legacy login, that file's key.
    */
   async apiKey() {
     const injected = this.env.TONBO_API_KEY?.trim();
     if (injected) {
-      if (this.keyChecked !== injected) {
-        await this.credentials.checkKeyAccount(injected);
-        this.keyChecked = injected;
+      if (this.injectedBearer?.key !== injected)
+        this.injectedBearer = {
+          key: injected,
+          bearer: apiKeyBearer(injected, this.fetcher, this.loginOrigin),
+          checked: false
+        };
+      if (!this.injectedBearer.checked) {
+        await this.credentials.checkKeyAccount(this.injectedBearer.bearer);
+        this.injectedBearer.checked = true;
       }
-      return injected;
+      return this.injectedBearer.bearer;
     }
     const login = await this.credentials.load();
     if (!login)
@@ -3030,17 +3611,20 @@ var AuthClient = class {
    * Logs this computer in (ADR-0018): the browser handoff of /cli/login, PKCE
    * S256 with a loopback redirect on a free port, asks for a session
    * (`grant=cli_session`); the approval names this computer and asks no
-   * account. With `device`, in an SSH session without a display, or when no
+   * account. With `device`, in an SSH session or on Linux without a display, or when no
    * browser can be opened, the same PKCE challenge goes to a device-code
    * login instead: the person enters a short code at /cli/device in any
    * browser and the CLI polls. The redeemed session, tied to this
    * computer's device id, is saved as `login.json` and replaces this
    * computer's earlier session; the legacy `credentials.json` is left as it
    * is. With `account` (a name or id), commands act there by default unless
-   * `current` is false. Answers the login of the account commands act in.
+   * `current` is false. With `openBrowser` false the browser login opens no
+   * browser: the person opens the `authorization-url` they are shown, as
+   * when an agent shows it with what the approval consents to. Answers the
+   * login of the account commands act in.
    */
   async login(progress = () => {
-  }, account, { current = true, device } = {}) {
+  }, account, { current = true, device, openBrowser: openBrowser2 = true } = {}) {
     const deviceId = await (this.facts.devices ?? new DeviceStore()).deviceId();
     const verifier = randomBytes(48).toString("base64url");
     const challenge = createHash3("sha256").update(verifier).digest("base64url");
@@ -3051,7 +3635,7 @@ var AuthClient = class {
       ...clientFact(this.facts.clientVersion) ? { client_version: clientFact(this.facts.clientVersion) } : {},
       ...clientFact(process.platform) ? { os: process.platform } : {}
     };
-    const redeemed = device ?? prefersDeviceLogin(this.env) ? await this.deviceLogin(challenge, verifier, redeem, progress) : await this.browserLogin(challenge, verifier, redeem, progress).catch((error) => {
+    const redeemed = device ?? prefersDeviceLogin(this.env) ? await this.deviceLogin(challenge, verifier, redeem, progress) : await this.browserLogin(challenge, verifier, redeem, progress, openBrowser2).catch((error) => {
       if (!(error instanceof BrowserUnavailableError))
         throw error;
       progress({ status: "failed", step: "browser", reason: error.message });
@@ -3087,7 +3671,7 @@ var AuthClient = class {
       throw new Error("The saved login could not be read back.");
     return login;
   }
-  async browserLogin(challenge, verifier, redeem, progress) {
+  async browserLogin(challenge, verifier, redeem, progress, openBrowser2) {
     const state = randomBytes(24).toString("base64url");
     const code = await this.listenForCode(state, (redirectUri) => {
       const authorization = new URL("/cli/login", this.loginOrigin);
@@ -3101,7 +3685,7 @@ var AuthClient = class {
         [cliSessionContract.grantParameter]: cliSessionContract.grant
       }).toString();
       return authorization.toString();
-    }, progress);
+    }, progress, openBrowser2);
     progress({ status: "started", step: "key-redemption" });
     const redeemed = await requestJson(this.fetcher, new URL("/api/cli/login/token", this.loginOrigin).toString(), {
       method: "POST",
@@ -3179,7 +3763,7 @@ var AuthClient = class {
       }
     }
   }
-  listenForCode(expectedState, authorizationUrl, progress) {
+  listenForCode(expectedState, authorizationUrl, progress, openBrowser2) {
     return new Promise((resolve, reject) => {
       let settled = false;
       const sockets = /* @__PURE__ */ new Set();
@@ -3254,6 +3838,8 @@ var AuthClient = class {
         progress({ status: "completed", step: "callback-server" });
         const url = authorizationUrl(`http://${LOOPBACK_HOST}:${port}/callback`);
         progress({ status: "authorization-url", step: "browser", url });
+        if (!openBrowser2)
+          return;
         progress({ status: "started", step: "browser" });
         void Promise.resolve().then(() => this.browserOpener(url)).then(() => startAuthorization(), (error) => {
           if (settled || authorizationStarted)
@@ -3299,6 +3885,150 @@ async function openBrowser(url) {
   }
 }
 
+// ../../packages/tonbo-cli-core/dist/src/capture-filter.js
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir as mkdir3, open as open3, readFile as readFile3, rename as rename3, rm as rm3 } from "node:fs/promises";
+import os5 from "node:os";
+import path4 from "node:path";
+var KEPT_WINDOWS = 200;
+function yieldStateDirectory(env = process.env, home = os5.homedir()) {
+  return path4.join(env.XDG_STATE_HOME || path4.join(home, ".local", "state"), "tonbo-yield");
+}
+function emptyFilter() {
+  return { version: 1, pause: null, past: [], excluded: [] };
+}
+function activePause(file, now) {
+  const pause = file.pause;
+  return pause && (pause.until === null || now < pause.until) ? pause : null;
+}
+function pauseForLogout(file, now, person) {
+  const current = activePause(file, now);
+  if (current?.logout)
+    return file;
+  const after = current ? { after: current.until } : {};
+  if (current)
+    current.until = now;
+  settle(file, now);
+  file.pause = { since: now, until: null, logout: { ...after, person } };
+  return file;
+}
+function endLogoutPause(file, now, person) {
+  const current = activePause(file, now);
+  if (!current?.logout)
+    return file;
+  const { after, person: before } = current.logout;
+  if (person === null || before == null || before !== person)
+    current.since = 0;
+  current.until = now;
+  settle(file, now);
+  if (after === null || after !== void 0 && after > now)
+    file.pause = { since: now, until: after };
+  return file;
+}
+function settle(file, now) {
+  if (file.pause && !activePause(file, now)) {
+    file.past = [...file.past, file.pause].slice(-KEPT_WINDOWS);
+    file.pause = null;
+  }
+}
+async function durableWrite(filename, body) {
+  const parent = path4.dirname(filename);
+  const created = await mkdir3(parent, { recursive: true, mode: 448 });
+  if (created) {
+    const state = await open3(path4.dirname(parent), "r");
+    try {
+      await state.sync();
+    } finally {
+      await state.close();
+    }
+  }
+  const temporary = path4.join(parent, `.${randomUUID3()}.tmp`);
+  const file = await open3(temporary, "wx", 384);
+  try {
+    await file.writeFile(JSON.stringify(body));
+    await file.sync();
+  } finally {
+    await file.close();
+  }
+  try {
+    await rename3(temporary, filename);
+    const dir = await open3(parent, "r");
+    try {
+      await dir.sync();
+    } finally {
+      await dir.close();
+    }
+  } catch (error) {
+    await rm3(temporary, { force: true });
+    throw error;
+  }
+}
+var CaptureFilterStore = class {
+  filename;
+  constructor(filename = path4.join(yieldStateDirectory(), "capture-filter.json")) {
+    this.filename = filename;
+  }
+  /** A missing file filters nothing; an unreadable one throws, and the
+   * daemon then captures nothing (fail closed). */
+  async load() {
+    let body;
+    try {
+      body = await readFile3(this.filename, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return emptyFilter();
+      throw error;
+    }
+    const parsed = JSON.parse(body);
+    const window = (value) => !!value && Number.isFinite(value.since) && (value.until === null || Number.isFinite(value.until));
+    if (parsed?.version !== 1 || !(parsed.pause === null || window(parsed.pause)) || !Array.isArray(parsed.past) || !parsed.past.every(window) || !Array.isArray(parsed.excluded) || !parsed.excluded.every((folder) => typeof folder === "string" && path4.isAbsolute(folder)))
+      throw new Error(`${this.filename} is not a Yield capture filter file.`);
+    return parsed;
+  }
+  async save(file) {
+    await durableWrite(this.filename, file);
+  }
+  async update(change) {
+    const file = await this.load();
+    change(file);
+    await this.save(file);
+    return file;
+  }
+};
+var CaptureNotStoppedError = class extends Error {
+};
+var reason = (error) => error instanceof Error ? error.message : String(error);
+async function stopCaptureForLogout(person, store = new CaptureFilterStore(), now = Date.now()) {
+  if (!existsSync(path4.dirname(store.filename)))
+    return null;
+  let file;
+  try {
+    file = await store.load();
+  } catch (error) {
+    return `Yield's capture stays stopped on this computer: ${reason(error)}`;
+  }
+  pauseForLogout(file, now, person);
+  try {
+    await store.save(file);
+  } catch (error) {
+    throw new CaptureNotStoppedError(`Could not stop Yield's capture on this computer (${reason(error)}), so nothing was logged out. Run the logout again where it can write ${store.filename}, outside an agent's sandbox.`, { cause: error });
+  }
+  return null;
+}
+async function resumeCaptureAfterLogin(person, store = new CaptureFilterStore(), now = Date.now()) {
+  try {
+    const file = await store.load();
+    if (!activePause(file, now)?.logout)
+      return null;
+    endLogoutPause(file, now, await person().catch(() => null));
+    await store.save(file);
+    return null;
+  } catch (error) {
+    return `Yield's capture stays stopped on this computer: ${reason(error)}`;
+  }
+}
+
 // ../../packages/tonbo-cli-core/dist/src/cell.js
 function cellOrigin(region, configured = process.env.TONBO_CELL_API_ORIGIN) {
   if (!/^[a-z0-9-]+$/.test(region))
@@ -3316,7 +4046,7 @@ var CellApi = class {
   }
   url(operationId, region, request) {
     const operation = managementOperations[operationId];
-    const path4 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
+    const path5 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
       const value = request.params[name];
       if (value === void 0)
         throw new Error(`${operationId} needs the path parameter ${name}.`);
@@ -3327,7 +4057,7 @@ var CellApi = class {
       if (value !== void 0)
         search.set(name, value);
     const query = search.toString();
-    return `${cellOrigin(region)}${managementApiBasePath}${path4}${query ? `?${query}` : ""}`;
+    return `${cellOrigin(region)}${managementApiBasePath}${path5}${query ? `?${query}` : ""}`;
   }
   async init(operationId, key, request) {
     const headers = {
@@ -3405,14 +4135,22 @@ function when(timestamp, absent = "never") {
 }
 
 // ../../packages/tonbo-cli-core/dist/src/login.js
+function captureAfterLogin(deps) {
+  return resumeCaptureAfterLogin(async () => {
+    const file = await deps.credentials.load();
+    return file ? personalLogin(file)?.account_id ?? null : null;
+  }, deps.captureFilter);
+}
 async function loginCommand(deps, options = {}) {
   try {
     const login = await deps.auth.login((event) => reportLoginProgress(deps.progress, event), options.account, { current: options.current, device: options.device });
+    const stopped = await captureAfterLogin(deps);
     const file = await deps.credentials.load();
     const names = file ? accountLogins(file).map((entry) => entry.kind === "user" ? `${entry.name ?? "you"} (personal)` : entry.name ?? entry.account_id) : [];
     deps.output([
       `Logged in. This computer can act in every account you belong to, with your role in each${names.length ? `: ${names.join(", ")}` : ""}.`,
-      `Commands act in ${login.kind === "user" ? "your personal account" : login.name ?? login.account_id} unless you pass --account.${login.expires_at ? ` The login ends ${login.expires_at.slice(0, 10)}, or after 30 days unused.` : ""}`
+      `Commands act in ${login.kind === "user" ? "your personal account" : login.name ?? login.account_id} unless you pass --account.${login.expires_at ? ` The login ends ${login.expires_at.slice(0, 10)}, or after 30 days unused.` : ""}`,
+      ...stopped ? [stopped] : []
     ].join("\n"));
     return login;
   } catch (error) {
@@ -3484,11 +4222,13 @@ async function logoutCommand(deps) {
     failures.push(`${what}: ${failure.message}`);
   };
   let session = null;
+  let unusable = false;
   try {
     session = await deps.credentials.session({ anyDevice: true });
   } catch (error) {
     if (!(error instanceof UnusableLoginError))
       throw error;
+    unusable = true;
   }
   let legacy = null;
   try {
@@ -3496,6 +4236,13 @@ async function logoutCommand(deps) {
   } catch (error) {
     if (!(error instanceof UnusableLoginError))
       throw error;
+    unusable = true;
+  }
+  if (session || legacy || unusable) {
+    const person = session?.stored.personal_account_id ?? (legacy && personalLogin(legacy)?.account_id) ?? null;
+    const stopped = await stopCaptureForLogout(person, deps.captureFilter);
+    if (stopped)
+      deps.output(stopped);
   }
   if (session)
     await session.logout().catch((error) => failed("the CLI login", error));
@@ -3604,7 +4351,7 @@ var TerminalProgress = class {
 };
 
 // src/commands.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 
 // src/agent-name.ts
 var AGENT_NAME_RULE = agentNameContract.$defs.name;
@@ -3619,6 +4366,209 @@ function validateAgentName(name) {
   }
 }
 
+// src/budget.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+var BUDGETS_NOT_AVAILABLE = "Budgets are not available yet.";
+function parseDollars(value) {
+  const match = /^\$?([0-9]+)(?:\.([0-9]{1,2}))?$/.exec(value.trim());
+  if (!match) throw new Error(`${value} is not an amount in dollars, such as $50 or 12.50.`);
+  return Number(match[1]) * 1e6 + Number((match[2] ?? "").padEnd(2, "0")) * 1e4;
+}
+var isAmount = (value) => /^\$?[0-9]+(?:\.[0-9]{1,2})?$/.test(value.trim());
+function unavailable(error) {
+  if (error instanceof HttpError && error.status === 404 && error.code !== "budget_not_found")
+    return new HttpError(BUDGETS_NOT_AVAILABLE, 404, error.body, error.requestId);
+  return error;
+}
+async function budgets(deps, key) {
+  return deps.api.listBudgets(key).catch((error) => {
+    throw unavailable(error);
+  });
+}
+async function resolveBudget(deps, key, budget) {
+  const all = await budgets(deps, key);
+  const found = all.find((entry) => entry.id === budget || entry.name === budget);
+  if (!found) throw new Error(`No budget of this account is ${budget}. See \`tonbo budget list\`.`);
+  return found;
+}
+function usedText(budget) {
+  if (budget.limit_micros === void 0) return "\u2014";
+  const used = (budget.settled_micros ?? 0) + (budget.committed_micros ?? 0);
+  return `${usd(used)} of ${usd(budget.limit_micros)}`;
+}
+function budgetFields(budget) {
+  const rows = [
+    ["ID", budget.id],
+    ["Name", budget.name ?? "\u2014"],
+    ["Scope", budget.scope],
+    ["Stage", budget.stage]
+  ];
+  if (budget.limit_micros !== void 0) {
+    rows.push(["Limit", usd(budget.limit_micros)]);
+    rows.push(["Charged", usd(budget.settled_micros ?? 0)]);
+    rows.push(["Committed", usd(budget.committed_micros ?? 0)]);
+  }
+  if (budget.principals?.length) rows.push(["Covers", budget.principals.join(", ")]);
+  if (budget.write_pace)
+    rows.push([
+      "Writes paced",
+      `${budget.write_pace.units_per_second}/s (floor ${budget.write_pace.floor_units_per_second}/s)`
+    ]);
+  rows.push(["Resets", budget.resets_at]);
+  rows.push(["Raise at", budget.raise_url]);
+  return fields(rows);
+}
+async function budgetListCommand(deps, options) {
+  const all = await budgets(deps, await deps.auth.apiKey());
+  print(
+    deps,
+    options.json,
+    all,
+    all.length ? table(
+      ["ID", "NAME", "SCOPE", "STAGE", "USED", "RESETS"],
+      all.map((budget) => [
+        budget.id,
+        budget.name ?? "\u2014",
+        budget.scope,
+        budget.stage,
+        usedText(budget),
+        budget.resets_at
+      ])
+    ) : "No budgets. An owner or admin sets the account budget in the console; `tonbo budget add` sets one for you or an Agent you created."
+  );
+}
+async function budgetShowCommand(deps, budget, options) {
+  const found = await resolveBudget(deps, await deps.auth.apiKey(), budget);
+  print(deps, options.json, found, budgetFields(found));
+}
+async function sendToConsole(deps, url, why) {
+  deps.notice(`${why} An owner or admin makes it in the console: ${url}`);
+  if (deps.interactive() && deps.openUrl) await deps.openUrl(url).catch(() => void 0);
+}
+async function consoleOr(deps, error) {
+  if (error instanceof HttpError && error.code === "budget_raise_in_console") {
+    const body = error.body;
+    if (typeof body?.raise_url === "string") {
+      await sendToConsole(deps, body.raise_url, "Only the console makes this change.");
+      throw new HttpError(error.message, error.status, error.body, error.requestId);
+    }
+  }
+  throw unavailable(error);
+}
+async function budgetAddCommand(deps, name, options) {
+  const key = await deps.auth.apiKey();
+  const limit = parseDollars(options.limit);
+  const principals = options.member?.length ? await Promise.all(options.member.map((member) => resolveMemberSubject(deps, key, member))) : [(await deps.api.getAccount(key)).member.subject];
+  const created = await deps.api.createBudget(key, { scope: "principals", name, limit_micros: limit, principals }, randomUUID4()).catch((error) => consoleOr(deps, error));
+  print(
+    deps,
+    options.json,
+    created,
+    `Created budget ${created.name ?? name}: ${usd(limit)} a month, covering ${principals.join(", ")}.`
+  );
+}
+async function budgetSetCommand(deps, budget, options) {
+  if (options.limit === void 0 && !options.add?.length)
+    throw new Error("Nothing to change: pass --limit, --add or both.");
+  const key = await deps.auth.apiKey();
+  const found = await resolveBudget(deps, key, budget);
+  const limit = options.limit === void 0 ? void 0 : parseDollars(options.limit);
+  if (limit !== void 0 && (found.limit_micros === void 0 || limit >= found.limit_micros)) {
+    await sendToConsole(
+      deps,
+      found.raise_url,
+      found.limit_micros === void 0 ? "This budget is not yours to change here." : `${usd(limit)} is not below the budget's ${usd(found.limit_micros)}: the CLI only lowers a budget.`
+    );
+    throw new Error("The budget was not changed.");
+  }
+  const add = options.add?.length ? await Promise.all(options.add.map((member) => resolveMemberSubject(deps, key, member))) : void 0;
+  const changed = await deps.api.changeBudget(key, found.id, { limit_micros: limit, add_principals: add }).catch((error) => consoleOr(deps, error));
+  print(deps, options.json, changed, budgetFields(changed));
+}
+async function attachBudget(deps, key, subject, value, name, created) {
+  try {
+    if (isAmount(value)) {
+      const limit = parseDollars(value);
+      const budget = await deps.api.createBudget(
+        key,
+        { scope: "principals", name, limit_micros: limit, principals: [subject] },
+        randomUUID4()
+      ).catch((error) => consoleOr(deps, error));
+      deps.notice(`Budget ${budget.name ?? name}: ${usd(limit)} a month for ${subject}.`);
+      return;
+    }
+    const found = await resolveBudget(deps, key, value);
+    await deps.api.changeBudget(key, found.id, { add_principals: [subject] }).catch((error) => consoleOr(deps, error));
+    deps.notice(`Budget ${found.name ?? found.id} now covers ${subject}.`);
+  } catch (error) {
+    const reason2 = error instanceof Error ? error.message : String(error);
+    throw new Error(`${created} was created, but its budget was not set: ${reason2}`);
+  }
+}
+function accountBudgetFields(account) {
+  const budgets2 = account.budgets;
+  if (!budgets2) return [];
+  const line = (budget) => budget ? `${budget.name ?? budget.id} \xB7 ${budget.stage} \xB7 ${usedText(budget)} \xB7 resets ${budget.resets_at}` : "none";
+  const rows = [
+    ["Account budget", line(budgets2.account)],
+    ["Your budget", line(budgets2.caller)]
+  ];
+  const pace = budgets2.account?.write_pace;
+  if (pace)
+    rows.push([
+      "Writes paced",
+      `${pace.units_per_second}/s across regions (floor ${pace.floor_units_per_second}/s)`
+    ]);
+  return rows;
+}
+function refusalBudget(body) {
+  const budget = body?.budget;
+  if (!budget || typeof budget !== "object") return null;
+  const record = budget;
+  return typeof record.id === "string" && typeof record.raise_url === "string" ? record : null;
+}
+function budgetHint(error) {
+  const budget = refusalBudget(error.body);
+  const name = budget ? budget.name ?? budget.id : "a budget";
+  switch (error.code) {
+    case "budget_exhausted":
+      return `The budget ${name} is used up${budget?.retry_at ? ` until ${budget.retry_at}` : ""}: stop, and try again only after then. A person can raise it in the console${budget ? ` at ${budget.raise_url}` : ""}.`;
+    case "budget_slowdown":
+      return `The budget ${name} is close to its limit, so only a few of its Machines may be awake at once: sleep another of its Machines${budget?.largest_shape_that_fits ? `, or set this one's shape to ${budget.largest_shape_that_fits}` : ""}, then wake it again. A person can raise it${budget ? ` at ${budget.raise_url}` : " in the console"}.`;
+    case "budget_scope":
+      return "Your budget confines you to the Machines you created: work on one of those, or ask a person to.";
+    case "budget_raise_in_console": {
+      const url = error.body?.raise_url;
+      return `Only the console makes this change${typeof url === "string" ? `: ${url}` : "."}`;
+    }
+    default:
+      return null;
+  }
+}
+function budgetHeaderLine(header) {
+  const values = /* @__PURE__ */ new Map();
+  for (const member of header.split(",")) {
+    const [name, ...rest] = member.trim().split("=");
+    if (!name) continue;
+    values.set(name.trim(), rest.join("=").trim().replace(/^"|"$/g, ""));
+  }
+  const used = values.get("used");
+  const percent = used === void 0 ? "" : `, ${Math.round(Number(used) * 100)}% used`;
+  return `Budget: ${values.get("scope") === "account" ? "the account budget" : "your budget"} is at ${values.get("stage") ?? "notice"}${percent}; it resets ${values.get("resets") ?? "on the 1st"}.`;
+}
+function noticingBudget(fetcher, notice) {
+  let said = false;
+  return async (input, init) => {
+    const response = await fetcher(input, init);
+    const header = response.headers.get("tonbo-budget");
+    if (header && !said) {
+      said = true;
+      notice(budgetHeaderLine(header));
+    }
+    return response;
+  };
+}
+
 // src/commands.ts
 function print(deps, json, data, human) {
   deps.output(json ? JSON.stringify(data) : human);
@@ -3661,7 +4611,7 @@ async function agentCreateCommand(deps, name, options = {}) {
   const agent = await deps.api.createAgent(
     key,
     { name, region, ...options.role === void 0 ? {} : { role: options.role } },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID5()
   );
   print(
     deps,
@@ -3674,6 +4624,15 @@ async function agentCreateCommand(deps, name, options = {}) {
       `Region: ${agent.region}`
     ].join("\n")
   );
+  if (options.budget !== void 0)
+    await attachBudget(
+      deps,
+      key,
+      `agent.${agent.id}`,
+      options.budget,
+      agent.name,
+      `The Agent ${agent.name}`
+    );
 }
 async function accountShowCommand(deps, options = {}) {
   const account = await deps.api.getAccount(await deps.auth.apiKey());
@@ -3687,7 +4646,8 @@ async function accountShowCommand(deps, options = {}) {
       ["Kind", account.kind],
       ["Your role", account.member.role],
       ["Your subject", account.member.subject],
-      ["Bucket limit", String(account.limits.buckets)]
+      ["Bucket limit", String(account.limits.buckets)],
+      ...accountBudgetFields(account)
     ])
   );
 }
@@ -3892,6 +4852,15 @@ async function apiKeyCreateCommand(deps, name, options = {}) {
     deps.notice(
       "Do not set TONBO_API_KEY in your own shell: it overrides your `tonbo login`, for this CLI too."
     );
+  if (options.budget !== void 0)
+    await attachBudget(
+      deps,
+      key,
+      created.member,
+      options.budget,
+      created.name,
+      `The API key ${created.name}`
+    );
 }
 async function apiKeyShowCommand(deps, keyId, options = {}) {
   const apiKey = await deps.api.getApiKey(await deps.auth.apiKey(), keyId);
@@ -3950,7 +4919,7 @@ async function bucketCreateCommand(deps, name, options = {}) {
   const bucket = await deps.api.createBucket(
     await deps.auth.apiKey(),
     { name, region: options.region },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID5()
   );
   print(
     deps,
@@ -4081,7 +5050,7 @@ async function databaseCreateCommand(deps, name, options = {}) {
   const database = await deps.api.createDatabase(
     await deps.auth.apiKey(),
     { name, region: options.region, expires_at: expiresAt },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID5()
   );
   print(
     deps,
@@ -4269,7 +5238,7 @@ async function streamCreateCommand(deps, name, options = {}) {
       content_type: options.contentType,
       expires_at: expiresAt
     },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID5()
   );
   print(
     deps,
@@ -4493,11 +5462,11 @@ async function accountUseCommand(deps, account, options = {}) {
 import { Help } from "commander";
 
 // src/machine.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 import { readFileSync } from "node:fs";
 
 // src/volume.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 var VOLUME_DURABILITY_LINK = "https://tonbo.dev/docs/machines/guarantees/data#volume";
 var VOLUME_ERROR_HINTS = {
   payment_required: "Add credit at <billing>, then create the Volume again.",
@@ -4595,7 +5564,7 @@ async function volumeCreateCommand(deps, name, options = {}) {
     const volume = await deps.api.createVolume(
       key,
       { name, region, size_gib: sizeGib },
-      options.idempotencyKey ?? randomUUID4()
+      options.idempotencyKey ?? randomUUID6()
     );
     print(
       deps,
@@ -4662,7 +5631,8 @@ var MACHINE_ERROR_HINTS = {
   machine_kind_mismatch: "That Machine is one of your computers: `tonbo machine show` and `tonbo machine delete` serve it, and nothing else does.",
   volumes_not_offered: "Volumes are not offered to this account in the Machine's region yet; nothing was created or changed.",
   secret_env_conflict: "Use another secret key or remove the non-secret env variable with that name.",
-  secret_limit: "Reduce the number or byte size of this Machine's secrets."
+  secret_limit: "Reduce the number or byte size of this Machine's secrets.",
+  wake_unavailable: "The wake was refused for now; nothing woke. Wake it again after a while; `tonbo machine show` says why it is blocked."
 };
 var MACHINE_IMAGE_FAILURE_HINTS = {
   image_unavailable: "The registry no longer serves that image publicly, or served other bytes for it: publish it again, or use another image",
@@ -4694,7 +5664,7 @@ function ifMatchHeader(value) {
 }
 function explainMachineError(error) {
   if (!(error instanceof HttpError) || error.code === null) return error;
-  const hint = MACHINE_ERROR_HINTS[error.code];
+  const hint = budgetHint(error) ?? MACHINE_ERROR_HINTS[error.code];
   if (!hint) return error;
   return new HttpError(`${error.message}
 ${hint}`, error.status, error.body, error.requestId);
@@ -4724,7 +5694,13 @@ function portText(port) {
 function machinePortsText(machine) {
   return machine.ports.length ? machine.ports.map(portText).join(", ") : "none";
 }
-var { earlyReclaimSeconds, pollAfterSeconds, sleepPollAfterSeconds, wakeHoldSeconds } = machineTimings;
+var {
+  earlyReclaimSeconds,
+  pollAfterSeconds,
+  sleepPollAfterSeconds,
+  wakePollAfterSeconds,
+  wakeHoldSeconds
+} = machineTimings;
 function machineState(machine) {
   if (machine.failure)
     return `${machine.state}: ${machine.failure.code}: ${machine.failure.message}`;
@@ -4744,10 +5720,10 @@ function duration(seconds) {
   return seconds % 60 === 0 && seconds >= 120 ? `${seconds / 60} min` : `${seconds} s`;
 }
 function sleepText(machine) {
-  const { action, reason } = machine.status.sleep;
+  const { action, reason: reason2 } = machine.status.sleep;
   const when2 = `after about ${duration(earlyReclaimSeconds)} idle (early) or at most ${machine.sleep_after_seconds} s without a connection`;
   if (action !== "release") return `${when2}; it then ${action}s`;
-  return `${when2}; the disk resets at every sleep${reason === "suspend_unavailable" ? " until suspend ships" : ""}`;
+  return `${when2}; the disk resets at every sleep${reason2 === "suspend_unavailable" ? " until suspend ships" : ""}`;
 }
 function activationFields(machine) {
   const { activation } = machine;
@@ -5182,9 +6158,9 @@ async function waitForCreate(deps, key, machine, name, firstWait, timeout, json)
   }
   print(deps, json, settled, machineFields(settled, billing));
   if (settled.state === "failed") {
-    const { reason, hint } = creationFailureText(settled, billing);
+    const { reason: reason2, hint } = creationFailureText(settled, billing);
     throw new Error(
-      `Machine ${settled.name} failed to be created${reason}; delete it with \`tonbo machine delete ${settled.name}\` and create it again.${hint}`
+      `Machine ${settled.name} failed to be created${reason2}; delete it with \`tonbo machine delete ${settled.name}\` and create it again.${hint}`
     );
   }
   throw new Error(`Machine ${settled.name} is ${settled.state}; it was not created.`);
@@ -5226,7 +6202,7 @@ async function machineCreateCommand(deps, name, command, options = {}) {
           ...database ? { database: database.name } : {},
           ...options.database === false ? { database: null } : {}
         },
-        options.idempotencyKey ?? randomUUID5()
+        options.idempotencyKey ?? randomUUID7()
       );
     } catch (error) {
       if (error instanceof HttpError && error.code === "name_taken")
@@ -5238,9 +6214,9 @@ async function machineCreateCommand(deps, name, command, options = {}) {
     if (machine.state === "failed") {
       const billing = await billingUrl(deps);
       print(deps, options.json, machine, machineFields(machine, billing));
-      const { reason, hint } = creationFailureText(machine, billing);
+      const { reason: reason2, hint } = creationFailureText(machine, billing);
       throw new Error(
-        `Machine ${machine.name} failed to be created${reason}; delete it with \`tonbo machine delete ${machine.name}\` and create it again.${hint}`
+        `Machine ${machine.name} failed to be created${reason2}; delete it with \`tonbo machine delete ${machine.name}\` and create it again.${hint}`
       );
     }
     if (options.wait && machine.state === "creating")
@@ -5266,11 +6242,16 @@ async function machineShowCommand(deps, name, options = {}) {
     const key = await deps.auth.apiKey();
     const { machine, etag } = await deps.api.getMachineWithEtag(key, name);
     const lastEnd = options.json || machine.kind === "byoc" || machine.state !== "active" ? null : await lastActivationEnd(deps, key, machine.name);
+    const processes = options.json || machine.kind === "byoc" || machine.state !== "active" || !deps.processes ? null : await deps.processes(key, machine.region, machine.name);
+    const processLines = processes ? [
+      ...processes.running.map((line) => `Background process: ${line}`),
+      ...processes.last ? [`Last background process: ${processes.last}`] : []
+    ] : [];
     print(
       deps,
       options.json,
       machine,
-      anyMachineText(machine, await billingUrl(deps), etag, lastEnd)
+      [anyMachineText(machine, await billingUrl(deps), etag, lastEnd), ...processLines].join("\n")
     );
   });
 }
@@ -5279,9 +6260,9 @@ async function lastActivationEnd(deps, key, name) {
     const page = await deps.api.listMachineActivations(key, name, { limit: 2 });
     return page.data.find((entry) => entry.end !== null)?.end ?? null;
   } catch (error) {
-    if (!(error instanceof HttpError)) throw error;
+    if (!(error instanceof HttpError || error instanceof AccessTokenError)) throw error;
     deps.notice(
-      `Could not read how its last activation ended (${error.status}); \`tonbo machine activations ${name}\` lists them.`
+      `Could not read how its last activation ended (${error.status ?? "no answer"}); \`tonbo machine activations ${name}\` lists them.`
     );
     return null;
   }
@@ -5318,9 +6299,14 @@ function appliesText(name, change) {
     lines.push(
       change.delete_after_seconds === null ? "The Machine is no longer deleted for being asleep." : "Delete-after applies now; `tonbo machine show` says when."
     );
-  const later = [change.image, change.command, change.shape, change.env, change.volumes].some(
-    (field) => field !== void 0
-  );
+  const later = [
+    change.image,
+    change.command,
+    change.shape,
+    change.env,
+    change.volumes,
+    change.database
+  ].some((field) => field !== void 0);
   if (later) {
     lines.push(
       `The change applies at the next activation. To apply it now, run \`tonbo machine sleep ${name}\`; the next request boots the new spec.`
@@ -5370,6 +6356,8 @@ async function machineUpdateCommand(deps, name, command, options = {}) {
     if (options.volume === false) change.volumes = [];
     else if (typeof options.volume === "string")
       change.volumes = [(await resolveVolumeBinding(deps, key, options.volume)).binding];
+    if (options.database === false) change.database = null;
+    else if (typeof options.database === "string") change.database = options.database;
     if (options.discardSnapshot) change.discard_snapshot = true;
     if (Object.values(change).every((value) => value === void 0))
       throw new Error("Nothing to change: pass at least one option or a command.");
@@ -5431,6 +6419,42 @@ async function machineSleepCommand(deps, name, options = {}) {
     );
   });
 }
+function wokenText(machine, waking) {
+  if (!waking) return `Machine ${machine.name} is awake.`;
+  return `Machine ${machine.name} is waking; \`tonbo machine show ${machine.name}\` says when it is awake.`;
+}
+async function machineWakeCommand(deps, name, options = {}) {
+  await machineCommand(async () => {
+    const timeout = waitTimeout(options);
+    const key = await deps.auth.apiKey();
+    const { machine, retryAfterSeconds: retryAfterSeconds2 } = await deps.api.wakeMachine(
+      key,
+      name,
+      ifMatchHeader(options.ifMatch)
+    );
+    const waking = retryAfterSeconds2 !== null;
+    if (!options.wait || !waking) {
+      print(deps, options.json, machine, wokenText(machine, waking));
+      return;
+    }
+    const { machine: awake, waited } = await waitForMachine(
+      deps,
+      key,
+      name,
+      retryAfterSeconds2 ?? wakePollAfterSeconds,
+      wakePollAfterSeconds,
+      timeout,
+      (read) => read.status.power === "awake" || read.state !== "active"
+    );
+    if (!awake)
+      throw new Error(
+        `Machine ${name} is not awake after ${waited} s; \`tonbo machine show ${name}\` says why.`
+      );
+    if (awake.status.power !== "awake")
+      throw new Error(`Machine ${name} is ${awake.state}; it did not wake.`);
+    print(deps, options.json, awake, `Machine ${awake.name} is awake (after ${waited} s).`);
+  });
+}
 async function machineDeleteCommand(deps, name, options = {}) {
   await machineCommand(async () => {
     const key = await deps.auth.apiKey();
@@ -5567,7 +6591,7 @@ var TOPICS = [
     title: "The login, accounts and keys",
     text: [
       "Log in once per computer: `tonbo login` signs this computer in as you, and every account you belong to is reachable with `--account`, with your role in each. Joining an organization needs no new login, and leaving one ends this computer's access to it at once. A command acts in one account: `--account`, else `TONBO_ACCOUNT`, else the default `tonbo account use` set, else your personal account. For each request the CLI exchanges the login for a short-lived token of that account; what a command may do is what your role there allows, and the CLI never decides it.",
-      "`TONBO_API_KEY`, when it is set, is used instead: an API key reaches only its own account and is sent as the Bearer credential, as narrowed by the key. Agents and CI should use an Agent key or an API key of one account, never your login, which reaches every account you belong to.",
+      "`TONBO_API_KEY`, when it is set, is used instead: an API key reaches only its own account, as narrowed by the key. A personal key is sent as the Bearer credential. An Agent key, which the API never accepts directly, is exchanged at `POST https://tonbo.dev/api/iam/token` for a token of at most 10 minutes, kept in memory and exchanged again shortly before it expires; neither the key nor the token is ever printed. Agents and CI should use an Agent key or an API key of one account, never your login, which reaches every account you belong to.",
       "The login is saved at `${XDG_CONFIG_HOME:-$HOME/.config}/tonbo/login.json`, which `yield` shares: either CLI's `login` signs both in, and either `logout` signs both out. It works only on the computer that logged in, ends after 30 days unused or 180 days at most, and is listed and revoked on the console's Sign-in sessions page. The CLI replaces the file atomically with owner-only permissions and refuses a symlink or a file other users can read."
     ]
   },
@@ -5613,7 +6637,7 @@ var COMMAND_HELP = {
   },
   "tonbo logout": {
     about: [
-      "Ends this computer's login for every account and removes the file, which signs `yield` out too. A login an earlier release saved (one key per account in `credentials.json`) has each key revoked as well; one already revoked or expired is skipped. If a revocation fails, the files are still removed, and the CLI says what it could not revoke and exits 1, so you can revoke it on the console's Sign-in sessions page or under API keys. `TONBO_API_KEY` is never touched."
+      "Ends this computer's login for every account and removes the file, which signs `yield` out too. Before anything is revoked, Yield's capture on this computer stops until the next login of either CLI, and nothing written meanwhile is ever recorded; when it cannot write Yield's folder to stop it, nothing is logged out. A login an earlier release saved (one key per account in `credentials.json`) has each key revoked as well; one already revoked or expired is skipped. If a revocation fails, the files are still removed, and the CLI says what it could not revoke and exits 1, so you can revoke it on the console's Sign-in sessions page or under API keys. `TONBO_API_KEY` is never touched."
     ],
     examples: ["tonbo logout"]
   },
@@ -5676,6 +6700,34 @@ var COMMAND_HELP = {
       "--idempotency-key": "a new UUID"
     }
   },
+  "tonbo budget list": {
+    about: [
+      "Lists the account's monthly spend budgets, the account budget first, with each one's stage and what it has used of its limit this UTC month. You see a budget's figures with `usage.read`, or when it covers you; of any other budget only its stage, reset and console link."
+    ],
+    examples: ["tonbo budget list"]
+  },
+  "tonbo budget show": {
+    about: [
+      "Prints one budget: its limit, what was charged and what is committed this month, whom it covers, its stage, when it resets (00:00 UTC on the 1st) and its page in the console."
+    ],
+    examples: ["tonbo budget show pi-agent"],
+    arguments: { budget: "the budget's name or id (`bdg_\u2026`)" }
+  },
+  "tonbo budget add": {
+    about: [
+      "Creates a budget over you, or over Agents you created, which counts the compute and outbound data of the Machines they create. Only the console sets the account budget or covers another member."
+    ],
+    examples: ["tonbo budget add pi-agent --limit 50 --member pi-agent"],
+    arguments: { name: "the budget's name, unique in the account" },
+    defaults: { "--member": "yourself" }
+  },
+  "tonbo budget set": {
+    about: [
+      "Lowers the budget that covers you, or adds Agents you created to it. Raising a limit, renaming, removing and every change to another budget are the console's: the command prints the budget's page and opens it instead."
+    ],
+    examples: ["tonbo budget set pi-agent --limit 25"],
+    arguments: { budget: "the budget's name or id (`bdg_\u2026`)" }
+  },
   "tonbo api-key list": {
     about: [
       "Shows your keys, or every key of the account for an owner or admin, with the last four characters of each secret, whether it is read-only, what it reaches of buckets, databases and streams, and when it expires and was last used."
@@ -5913,7 +6965,7 @@ var COMMAND_HELP = {
   "tonbo machine update": {
     about: [
       "Changes only what its options name. It reads the Machine and sends the ETag it read, or `--if-match`'s, so a change someone made in between is refused with `precondition_failed` rather than overwritten; a Machine whose creation failed is refused with `machine_failed`. `--env` and `--unset-env` change single variables; `--port` replaces every port, and the current default port stays the default while it is still listed.",
-      "Ports and `--sleep-after` apply at once. The image, command, shape and env apply at the next boot, and the command says how to apply them now: `tonbo machine sleep`, after which the next request boots the new spec. Naming the same tag again resolves its digest again.",
+      "Ports and `--sleep-after` apply at once. The image, command, shape, env, Volume and database apply at the next boot, and the command says how to apply them now: `tonbo machine sleep`, after which the next request boots the new spec. Naming the same tag again resolves its digest again. `--database <name>` binds another database of the account in the Machine's region, which no other Machine binds, and `--no-database` binds none; the database it leaves is kept. A Machine created with its own database keeps it.",
       "`--delete-after` applies at once and keeps the clock, which counts from the end of the Machine's last activation (or its creation), so a lower value can delete a Machine that has already slept that long; `--no-delete-after` turns it off. `tonbo machine show` prints when it will be deleted."
     ],
     examples: ["tonbo machine update web --env MODE=staging --sleep-after 300"],
@@ -5929,11 +6981,13 @@ var COMMAND_HELP = {
   "tonbo machine exec": {
     about: [
       "Runs one command in the Machine's running activation through its region's cell origin, waking the Machine first when it is asleep, and streams its stdout and stderr here as they come; a call that woke the Machine prints its hourly ceiling on stderr. The command runs without a shell, as the image's User, and lives exactly as long as the call: there is no terminal and no streamed stdin, and `--stdin` sends at most 1 MiB read before the call.",
-      "The CLI exits with the command's status: 128 plus the signal's number when a signal ended it, 124 at `--timeout`, 125 when it was refused, killed or passed 64 MiB of output, 126 or 127 when it could not run, and 255 when the connection ended first and the outcome is unknown. `--json` prints the answer's document instead, with the first and last 512 KiB of each stream."
+      "The CLI exits with the command's status: 128 plus the signal's number when a signal ended it, 124 at `--timeout`, 125 when it was refused, killed or passed 64 MiB of output, 126 or 127 when it could not run, and 255 when the connection ended first and the outcome is unknown. `--json` prints the answer's document instead, with the first and last 512 KiB of each stream.",
+      "`--detach` starts the command in the background instead, prints its process id and returns at once: it runs whatever happens to this call, keeps the Machine awake until it ends, and is ended at `--timeout` (default 3600, at most 21600). Read it with `tonbo machine output`, wait for it with `tonbo machine wait`, list them with `tonbo machine ps` and end one with `tonbo machine kill`. A budget or funding stop, or a sleep you ask for, still ends it."
     ],
     examples: [
       "tonbo machine exec web -- ls -la /app",
-      "tonbo machine exec web --timeout 60 -- npm test"
+      "tonbo machine exec web --timeout 60 -- npm test",
+      "tonbo machine exec web --detach -- npm run build"
     ],
     arguments: {
       name: "the Machine's name",
@@ -5941,6 +6995,37 @@ var COMMAND_HELP = {
     },
     defaults: { "--timeout": "600", "--cwd": "the image's WorkingDir" }
   },
+  "tonbo machine ps": {
+    about: [
+      "Lists the Machine's background processes, newest first: those running and those that ended in the last 24 hours, with how each ended. It never wakes the Machine."
+    ],
+    examples: ["tonbo machine ps web"],
+    arguments: { name: "the Machine's name" }
+  },
+  "tonbo machine wait": {
+    about: [
+      "Waits until a background process ends, prints how it ended and exits with its status as `tonbo machine exec` would: its exit code, 128 plus a signal's number, 124 at its timeout, 125 when it was killed and 255 when its outcome is unknown. It never wakes the Machine."
+    ],
+    examples: ["tonbo machine wait web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f"],
+    arguments: { name: "the Machine's name", process: "the process id `exec --detach` printed" }
+  },
+  "tonbo machine output": {
+    about: [
+      "Prints a background process's stdout and stderr together, as it wrote them, from the last 16 MiB the Machine keeps. `--follow` keeps printing until the process ends. The output is gone once the Machine sleeps. It never wakes the Machine."
+    ],
+    examples: [
+      "tonbo machine output web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f",
+      "tonbo machine output web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f --follow"
+    ],
+    arguments: { name: "the Machine's name", process: "the process id `exec --detach` printed" }
+  },
+  "tonbo machine kill": {
+    about: [
+      "Ends a background process: SIGTERM to everything it started, then a kill 5 seconds later. It never wakes the Machine."
+    ],
+    examples: ["tonbo machine kill web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f"],
+    arguments: { name: "the Machine's name", process: "the process id `exec --detach` printed" }
+  },
   "tonbo machine file read": {
     about: [
       "Prints one regular file of the Machine, waking it when it is asleep. A file is gone when the Machine sleeps, so a read that woke it sees only its image."
@@ -5979,6 +7064,30 @@ var COMMAND_HELP = {
     examples: ["tonbo machine file delete web /app/tmp --recursive"],
     arguments: { name: "the Machine's name", path: "the absolute path in the Machine" }
   },
+  "tonbo machine hold set": {
+    about: [
+      "Keeps the Machine awake until at least now plus `--for` (1 hour by default, at most 1 hour). Running it again only moves the end later, so a script can repeat it while its work runs. It never wakes an asleep Machine, and it ends when the Machine sleeps, stops or runs out of credit or budget. An awake Machine is billed as usual. A program inside the Machine sets its own holds on `/run/tonbo-hold.sock`, with no key."
+    ],
+    examples: ["tonbo machine hold set web build --for 30m"],
+    arguments: {
+      name: "the Machine's name",
+      hold: "a name you choose for the hold, such as build"
+    }
+  },
+  "tonbo machine hold rm": {
+    about: [
+      "Releases one hold set from outside the Machine, whether or not it existed. The Machine sleeps `sleep_after` seconds later unless something else keeps it awake."
+    ],
+    examples: ["tonbo machine hold rm web build"],
+    arguments: { name: "the Machine's name", hold: "the hold's name" }
+  },
+  "tonbo machine hold ls": {
+    about: [
+      "Lists the holds of the Machine's current activation, those set from outside and those a program inside set, with when each lapses. An asleep Machine has none."
+    ],
+    examples: ["tonbo machine hold ls web"],
+    arguments: { name: "the Machine's name" }
+  },
   "tonbo machine sleep": {
     about: [
       "Puts an awake Machine to sleep now, and says so when it is already asleep or still creating; its next request boots it on its latest spec. With `--wait` the CLI reads the Machine until it is asleep or `--timeout` passes."
@@ -5987,6 +7096,14 @@ var COMMAND_HELP = {
     arguments: NAME("Machine"),
     defaults: { "--timeout": String(DEFAULT_WAIT_SECONDS) }
   },
+  "tonbo machine wake": {
+    about: [
+      "Wakes an asleep Machine now, without a request to it, and says so when it is already awake. The wake passes the same checks as any other and is billed the same: it needs credit, room on a host and a budget that allows it, and a refused wake says why. With `--wait` the CLI reads the Machine until it is awake or `--timeout` passes."
+    ],
+    examples: ["tonbo machine wake web --wait"],
+    arguments: NAME("Machine"),
+    defaults: { "--timeout": String(DEFAULT_WAIT_SECONDS) }
+  },
   "tonbo machine delete": {
     about: [
       "Deletes the Machine with its disk and logs; a Volume or database it binds stays. Its name is free for a new Machine at once. At a terminal it asks you to type the Machine's name first, and sends the ETag it read then.",
@@ -6137,19 +7254,19 @@ function optionDescription(option) {
 function applyHelp(program) {
   const named = /* @__PURE__ */ new Set();
   const walk = (command, words) => {
-    const path4 = words.join(" ");
+    const path5 = words.join(" ");
     command.configureHelp({ ...command.configureHelp(), optionDescription });
-    const help = COMMAND_HELP[path4];
+    const help = COMMAND_HELP[path5];
     if (help) {
-      named.add(path4);
+      named.add(path5);
       for (const [name, text] of Object.entries(help.arguments ?? {})) {
         const argument = command.registeredArguments.find((entry) => entry.name() === name);
-        if (!argument) throw new Error(`${path4} has no argument ${name}`);
+        if (!argument) throw new Error(`${path5} has no argument ${name}`);
         argument.description = text;
       }
       for (const [flag, text] of Object.entries(help.defaults ?? {})) {
         const option = command.options.find((entry) => entry.long === flag);
-        if (!option) throw new Error(`${path4} has no option ${flag}`);
+        if (!option) throw new Error(`${path5} has no option ${flag}`);
         option.defaultValueDescription = text;
       }
       command.addHelpText("after", commandHelpText(help));
@@ -6157,15 +7274,15 @@ function applyHelp(program) {
     for (const child of command.commands) walk(child, [...words, child.name()]);
   };
   walk(program, [program.name()]);
-  for (const path4 of Object.keys(COMMAND_HELP))
-    if (!named.has(path4)) throw new Error(`The help of ${path4} names no command`);
+  for (const path5 of Object.keys(COMMAND_HELP))
+    if (!named.has(path5)) throw new Error(`The help of ${path5} names no command`);
   program.addHelpText("after", programHelpText());
   return program;
 }
 
 // src/machine-cell.ts
-import { readFile as readFile3, writeFile } from "node:fs/promises";
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { readFile as readFile4, writeFile } from "node:fs/promises";
+import { randomUUID as randomUUID8 } from "node:crypto";
 var EXEC_EXIT_CODES = {
   timeout: 124,
   output_limit: 125,
@@ -6318,13 +7435,198 @@ async function machineExecCommand(deps, name, command, options = {}) {
     deps.notice(`The command ended: ${ended.reason}.`);
   exitWith(deps, execExitCode(ended));
 }
-async function machineFileReadCommand(deps, name, path4, options = {}) {
+function processEndText(process2) {
+  const end = process2.end;
+  if (!end) return "-";
+  if (end.reason === "exited") return `exited ${end.exit_code ?? 0}`;
+  if (end.reason === "signaled") return `signaled ${end.signal ?? ""}`.trim();
+  return end.reason;
+}
+function processExitCode(process2) {
+  const end = process2.end;
+  if (!end) return 0;
+  if (end.reason === "exited" || end.reason === "signaled" || end.reason === "timeout")
+    return execExitCode({ reason: end.reason, exit_code: end.exit_code, signal: end.signal });
+  return end.reason === "lost" ? EXEC_EXIT_CODES.lost : EXEC_EXIT_CODES.killed;
+}
+async function machineProcessStartCommand(deps, name, command, options = {}) {
+  if (command.length === 0)
+    throw new Error(
+      "Name the command after --, such as `tonbo machine exec web --detach -- npm run build`."
+    );
+  const body = { command };
+  if (options.cwd) body.cwd = options.cwd;
+  if (options.env?.length) body.env = parseEnv2(options.env);
+  if (options.timeout !== void 0) body.timeout_seconds = options.timeout;
+  if (options.expectActivation) body.expect_activation = options.expectActivation;
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    if (options.stdin) body.stdin = Buffer.from(await readAllStdin(deps)).toString("base64");
+    const response = await cellApi(deps).fetch("startMachineProcess", key, region, {
+      params: { name },
+      headers: {
+        "content-type": "application/json",
+        "idempotency-key": options.idempotencyKey ?? randomUUID8()
+      },
+      body: JSON.stringify(body)
+    });
+    const { data } = await response.json();
+    if (response.headers.get("tonbo-woke") === "true") {
+      const ceiling = response.headers.get("tonbo-ceiling-usd-micros-per-hour");
+      noticeWake(
+        deps,
+        {
+          activation: data.activation,
+          woke: true,
+          ceiling_usd_micros_per_hour: ceiling === null ? null : Number(ceiling)
+        },
+        name
+      );
+    }
+    print(
+      deps,
+      options.json,
+      data,
+      response.status === 200 ? `${data.process} (already started under this key, ${data.state})` : data.process
+    );
+    if (!options.json && response.status !== 200)
+      deps.notice(
+        `Started; it keeps ${name} awake until it ends or at ${data.deadline}. Read it with \`tonbo machine output ${name} ${data.process}\`, wait for it with \`tonbo machine wait ${name} ${data.process}\`.`
+      );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function readProcess(deps, key, region, name, id) {
+  return cellApi(deps).json("getMachineProcess", key, region, {
+    params: { name, process: id }
+  });
+}
+function processFields(process2) {
+  return fields([
+    ["process", process2.process],
+    ["state", process2.state],
+    ["command", (process2.argv_preview ?? []).join(" ") || "-"],
+    ["started", process2.started_at],
+    ["deadline", process2.deadline],
+    ["ended", process2.ended_at ?? "-"],
+    ["end", processEndText(process2)],
+    ["activation", process2.activation]
+  ]);
+}
+async function machineProcessListCommand(deps, name, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const processes = await cellApi(deps).json(
+      "listMachineProcesses",
+      key,
+      region,
+      {
+        params: { name }
+      }
+    );
+    print(
+      deps,
+      options.json,
+      processes,
+      processes.length === 0 ? `${name} has no background processes.` : table(
+        ["PROCESS", "STATE", "STARTED", "END", "COMMAND"],
+        processes.map((process2) => [
+          process2.process,
+          process2.state,
+          process2.started_at,
+          processEndText(process2),
+          (process2.argv_preview ?? []).join(" ")
+        ])
+      )
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessWaitCommand(deps, name, id, options = {}) {
+  const sleep = options.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    let process2 = await readProcess(deps, key, region, name, id);
+    while (process2.state === "running") {
+      await sleep(2e3);
+      process2 = await readProcess(deps, key, region, name, id);
+    }
+    print(deps, options.json, process2, processFields(process2));
+    exitWith(deps, processExitCode(process2));
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessOutputCommand(deps, name, id, options = {}) {
+  const sleep = options.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    let offset = options.offset ?? 0;
+    for (; ; ) {
+      const response = await cellApi(deps).fetch("readMachineProcessOutput", key, region, {
+        params: { name, process: id },
+        query: { offset: String(offset) }
+      });
+      const bytes2 = new Uint8Array(await response.arrayBuffer());
+      const start = Number(response.headers.get("tonbo-output-start") ?? offset);
+      if (start > offset)
+        deps.notice(`(${start - offset} bytes before offset ${start} were dropped from the ring)`);
+      if (bytes2.length) writeBytes(deps, "stdout", bytes2);
+      offset = Number(response.headers.get("tonbo-output-next-offset") ?? start + bytes2.length);
+      const ended = response.headers.get("tonbo-process-state") === "ended";
+      if (start + bytes2.length < offset) continue;
+      if (!options.follow || ended) break;
+      await sleep(1e3);
+    }
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessKillCommand(deps, name, id, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const process2 = await cellApi(deps).json("killMachineProcess", key, region, {
+      params: { name, process: id }
+    });
+    print(
+      deps,
+      options.json,
+      process2,
+      process2.state === "ended" ? `${id} had already ended: ${processEndText(process2)}.` : `Killing ${id}; it ends within a few seconds.`
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessSummary(cell, key, region, name) {
+  try {
+    const processes = await cell.json("listMachineProcesses", key, region, {
+      params: { name }
+    });
+    const line = (process2) => `${process2.process} ${(process2.argv_preview ?? []).join(" ")} (${process2.state === "running" ? `until ${process2.deadline}` : processEndText(process2)})`;
+    const last = processes.find((process2) => process2.state === "ended");
+    return {
+      running: processes.filter((process2) => process2.state === "running").map(line),
+      last: last ? line(last) : null
+    };
+  } catch {
+    return null;
+  }
+}
+async function machineFileReadCommand(deps, name, path5, options = {}) {
   try {
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
     const response = await cellApi(deps).fetch("readMachineFile", key, region, {
       params: { name },
-      query: { path: path4 },
+      query: { path: path5 },
       headers: { range: options.range, "tonbo-expect-activation": options.expectActivation }
     });
     const bytes2 = new Uint8Array(await response.arrayBuffer());
@@ -6334,21 +7636,21 @@ async function machineFileReadCommand(deps, name, path4, options = {}) {
     throw explainMachineError(error);
   }
 }
-async function machineFileWriteCommand(deps, name, path4, options = {}) {
+async function machineFileWriteCommand(deps, name, path5, options = {}) {
   try {
-    const bytes2 = options.from ? new Uint8Array(await readFile3(options.from)) : await readAllStdin(deps);
+    const bytes2 = options.from ? new Uint8Array(await readFile4(options.from)) : await readAllStdin(deps);
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
     const written = await cellApi(deps).json("writeMachineFile", key, region, {
       params: { name },
-      query: { path: path4 },
+      query: { path: path5 },
       headers: {
         "content-type": "application/octet-stream",
         "if-match": options.ifMatch,
         "if-none-match": options.create ? "*" : void 0,
         "tonbo-file-mode": options.mode,
         "tonbo-expect-activation": options.expectActivation,
-        "idempotency-key": randomUUID6()
+        "idempotency-key": randomUUID8()
       },
       body: new Uint8Array(bytes2)
     });
@@ -6363,28 +7665,28 @@ async function machineFileWriteCommand(deps, name, path4, options = {}) {
     throw explainMachineError(error);
   }
 }
-async function machineFileStatCommand(deps, name, path4, options = {}) {
+async function machineFileStatCommand(deps, name, path5, options = {}) {
   try {
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
-    const stat = await cellApi(deps).json(
+    const stat2 = await cellApi(deps).json(
       "statMachineFile",
       key,
       region,
       {
         params: { name },
-        query: { path: path4 },
+        query: { path: path5 },
         headers: { "tonbo-expect-activation": options.expectActivation }
       }
     );
-    noticeWake(deps, stat.machine, name);
+    noticeWake(deps, stat2.machine, name);
     print(
       deps,
       options.json,
-      stat,
+      stat2,
       fields(
         ["path", "type", "size", "mode", "uid", "gid", "mtime", "etag", "target", "durability"].map(
-          (field) => [field, cellText(stat[field])]
+          (field) => [field, cellText(stat2[field])]
         )
       )
     );
@@ -6392,13 +7694,13 @@ async function machineFileStatCommand(deps, name, path4, options = {}) {
     throw explainMachineError(error);
   }
 }
-async function machineFileListCommand(deps, name, path4, options = {}) {
+async function machineFileListCommand(deps, name, path5, options = {}) {
   try {
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
     const listing = await cellApi(deps).json("listMachineFiles", key, region, {
       params: { name },
-      query: { path: path4 },
+      query: { path: path5 },
       headers: { "tonbo-expect-activation": options.expectActivation }
     });
     noticeWake(deps, listing.machine, name);
@@ -6422,19 +7724,89 @@ async function machineFileListCommand(deps, name, path4, options = {}) {
     throw explainMachineError(error);
   }
 }
-async function machineFileDeleteCommand(deps, name, path4, options = {}) {
+async function machineFileDeleteCommand(deps, name, path5, options = {}) {
   try {
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
     await cellApi(deps).fetch("deleteMachineFile", key, region, {
       params: { name },
-      query: { path: path4, recursive: options.recursive ? "true" : void 0 },
+      query: { path: path5, recursive: options.recursive ? "true" : void 0 },
       headers: {
         "tonbo-expect-activation": options.expectActivation,
-        "idempotency-key": randomUUID6()
+        "idempotency-key": randomUUID8()
       }
     });
-    print(deps, options.json, { path: path4 }, `Deleted ${path4}.`);
+    print(deps, options.json, { path: path5 }, `Deleted ${path5}.`);
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+var HOLD_MAX_SECONDS = 3600;
+function parseHoldDuration(value) {
+  const match = /^(\d+)\s*([smh]?)$/.exec(value.trim());
+  const unit = { "": 1, s: 1, m: 60, h: 3600 }[match?.[2] ?? ""] ?? 1;
+  const seconds = match ? Number(match[1]) * unit : Number.NaN;
+  if (!Number.isSafeInteger(seconds) || seconds < 1 || seconds > HOLD_MAX_SECONDS)
+    throw new Error(`--for ${value} is not between 1 second and 1 hour, such as 90s, 45m or 1h.`);
+  return seconds;
+}
+async function machineHoldSetCommand(deps, name, hold, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const placed = await cellApi(deps).json("setMachineHold", key, region, {
+      params: { name, hold },
+      headers: {
+        "content-type": "application/json",
+        "tonbo-expect-activation": options.expectActivation
+      },
+      body: JSON.stringify({ seconds: options.for ?? HOLD_MAX_SECONDS })
+    });
+    print(
+      deps,
+      options.json,
+      placed,
+      `${name} stays awake until ${placed.until} (hold ${placed.hold}). Run this again before then to extend it; \`tonbo machine hold rm ${name} ${placed.hold}\` lets it sleep. An awake Machine is billed as usual.`
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineHoldRmCommand(deps, name, hold, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    await cellApi(deps).fetch("releaseMachineHold", key, region, { params: { name, hold } });
+    print(
+      deps,
+      options.json,
+      { hold },
+      `Released ${hold}. ${name} sleeps once nothing else keeps it awake.`
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineHoldLsCommand(deps, name, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const holds = await cellApi(deps).json("listMachineHolds", key, region, {
+      params: { name }
+    });
+    print(
+      deps,
+      options.json,
+      holds,
+      holds.length === 0 ? `${name} has no holds.` : table(
+        ["HOLD", "SET FROM", "UNTIL"],
+        holds.map((entry) => [
+          entry.hold,
+          entry.source === "guest" ? "inside the Machine" : "outside (API or CLI)",
+          entry.until
+        ])
+      )
+    );
   } catch (error) {
     throw explainMachineError(error);
   }
@@ -6467,8 +7839,8 @@ async function terminalAsk(question) {
 
 // src/ssh.ts
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { chmod as chmod2, mkdir as mkdir3, readFile as readFile4, readdir, rename as rename3, writeFile as writeFile2 } from "node:fs/promises";
+import { existsSync as existsSync2 } from "node:fs";
+import { chmod as chmod2, mkdir as mkdir4, readFile as readFile5, readdir, rename as rename4, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 function sshDirectory(env = process.env) {
@@ -6492,9 +7864,9 @@ function cellOrigin2(host) {
 }
 async function ensureKey(directory) {
   const key = join(directory, "id_ed25519");
-  await mkdir3(directory, { recursive: true, mode: 448 });
+  await mkdir4(directory, { recursive: true, mode: 448 });
   await chmod2(directory, 448);
-  if (!existsSync(key)) {
+  if (!existsSync2(key)) {
     const made = spawnSync(
       "ssh-keygen",
       ["-q", "-t", "ed25519", "-N", "", "-C", "tonbo", "-f", key],
@@ -6510,10 +7882,10 @@ async function ensureKey(directory) {
   }
   return key;
 }
-async function writeAtomic(path4, data) {
-  const temporary = `${path4}.${process.pid}.tmp`;
+async function writeAtomic(path5, data) {
+  const temporary = `${path5}.${process.pid}.tmp`;
   await writeFile2(temporary, data, { mode: 384 });
-  await rename3(temporary, path4);
+  await rename4(temporary, path5);
 }
 function certificatePath(directory, user) {
   return join(directory, `${user}-cert.pub`);
@@ -6526,7 +7898,7 @@ function hostCAPath(directory, host) {
 }
 async function trustHostCA(directory, host, lines) {
   const cells = join(directory, "host-ca");
-  await mkdir3(cells, { recursive: true, mode: 448 });
+  await mkdir4(cells, { recursive: true, mode: 448 });
   await writeAtomic(hostCAPath(directory, host), `${lines.join("\n")}
 `);
   const trusted = /* @__PURE__ */ new Set();
@@ -6534,7 +7906,7 @@ async function trustHostCA(directory, host, lines) {
     if (name.endsWith(".tmp")) {
       continue;
     }
-    for (const line of (await readFile4(join(cells, name), "utf8")).split("\n")) {
+    for (const line of (await readFile5(join(cells, name), "utf8")).split("\n")) {
       if (line.trim() !== "") {
         trusted.add(line.trim());
       }
@@ -6546,7 +7918,7 @@ async function trustHostCA(directory, host, lines) {
 async function heldUntil(directory, user) {
   try {
     const sidecar = JSON.parse(
-      await readFile4(`${certificatePath(directory, user)}.json`, "utf8")
+      await readFile5(`${certificatePath(directory, user)}.json`, "utf8")
     );
     return sidecar.valid_before ? Date.parse(sidecar.valid_before) : 0;
   } catch {
@@ -6565,11 +7937,9 @@ async function cellRequest(bearer, method, url, body) {
       },
       body: body === void 0 ? void 0 : JSON.stringify(body)
     });
-    if (response.status === 401 && attempt === 0 && isAccountBearer(bearer)) {
-      bearer.invalidate(MANAGEMENT_AUDIENCE);
-      continue;
-    }
     const answer = await response.json().catch(() => null);
+    if (response.status === 401 && attempt === 0 && retriesAfterRefusal(bearer, MANAGEMENT_AUDIENCE, answer?.code ?? null))
+      continue;
     if (!response.ok) {
       throw new Error(
         `${url} answered ${response.status}${answer?.code ? ` ${answer.code}` : ""}${answer?.detail ? `: ${answer.detail}` : ""}`
@@ -6582,11 +7952,11 @@ async function refreshCertificate(bearer, destination, now = Date.now, directory
   const key = await ensureKey(directory);
   const certificate = certificatePath(directory, destination.user);
   const knownHosts = join(directory, "known_hosts");
-  if (await heldUntil(directory, destination.user) - now() > RENEW_BEFORE_MS && existsSync(hostCAPath(directory, destination.host)) && existsSync(knownHosts)) {
+  if (await heldUntil(directory, destination.user) - now() > RENEW_BEFORE_MS && existsSync2(hostCAPath(directory, destination.host)) && existsSync2(knownHosts)) {
     return { key, certificate, knownHosts };
   }
   const origin = cellOrigin2(destination.host);
-  const publicKey = (await readFile4(`${key}.pub`, "utf8")).trim();
+  const publicKey = (await readFile5(`${key}.pub`, "utf8")).trim();
   const issued = await cellRequest(bearer, "POST", `${origin}/v1/ssh/certificates`, {
     public_key: publicKey,
     ttl_seconds: REQUESTED_TTL_SECONDS
@@ -6678,7 +8048,7 @@ async function sshHostCaCommand(deps, options) {
   print(deps, options.json, data, data.known_hosts.join("\n"));
 }
 async function sshCertificateIssueCommand(deps, options) {
-  const publicKey = (await readFile4(options.publicKey, "utf8")).trim();
+  const publicKey = (await readFile5(options.publicKey, "utf8")).trim();
   const key = await deps.auth.apiKey();
   const data = await (deps.cell ?? new CellApi(fetch)).json(
     "issueSshCertificate",
@@ -6709,8 +8079,9 @@ function createDependencies(selection = {}) {
     loginOrigin: loginOrigin(api),
     account
   });
+  const notice = (text) => console.error(text);
   return {
-    api: new ManagementApi(fetch, api),
+    api: new ManagementApi(noticingBudget(fetch, notice), api),
     ask: terminalAsk,
     auth: new AuthClient(
       credentials,
@@ -6726,7 +8097,9 @@ function createDependencies(selection = {}) {
     credentials,
     interactive: () => process.stdin.isTTY === true && process.stderr.isTTY === true,
     output: (text) => console.log(text),
-    notice: (text) => console.error(text),
+    notice,
+    openUrl: openBrowser,
+    processes: (key, region, name) => machineProcessSummary(new CellApi(fetch), key, region, name),
     progress: new TerminalProgress(process.stderr),
     select: terminalSelect
   };
@@ -6740,7 +8113,7 @@ function parseWhole(value) {
   return Number(value);
 }
 function operationOptions(command, operationId) {
-  const query = managementOperations[operationId].query;
+  const query = managementOperation(operationId).query;
   if (query.includes("limit"))
     command.option("--limit <count>", "the most items to return", parseLimit);
   if (query.includes("cursor"))
@@ -6749,6 +8122,10 @@ function operationOptions(command, operationId) {
 }
 var ifMatchHelp = (action) => `${action} only the Machine at the ETag \`tonbo machine show\` printed (with or without its quotes)`;
 var repeated = (value, previous = []) => [...previous, value];
+var budgetOption = (whom) => new Option(
+  "--budget <budget>",
+  `put ${whom} under a monthly budget: an amount in dollars such as 50 creates one, a budget's name adds to it`
+);
 var roleOption = (description) => new Option("--role <role>", description).choices(accountRoles);
 function machineSpecOptions(command, update) {
   const later = update ? "; applies at the next boot" : "";
@@ -6814,7 +8191,9 @@ function createProgram(makeDependencies = createDependencies) {
     const account2 = program.opts().account;
     await loginCommand(dependencies(), { ...options, account: account2 });
   });
-  program.command("logout").description("end this computer's CLI login and remove the saved login").action(async () => logoutCommand(dependencies()));
+  program.command("logout").description(
+    "end this computer's CLI login and remove the saved login; Yield's capture here stops until the next login"
+  ).action(async () => logoutCommand(dependencies()));
   const account = program.command("account").description("the accounts you belong to and the one commands act in");
   operationOptions(
     account.command("show").description("show the account, your role in it and its limits"),
@@ -6856,7 +8235,7 @@ function createProgram(makeDependencies = createDependencies) {
     ).option(
       "--idempotency-key <key>",
       "reuse the key of an unconfirmed creation to get the Agent it created"
-    ),
+    ).addOption(budgetOption("the Agent")),
     "createAgent"
   ).action(
     async (name, options) => agentCreateCommand(dependencies(), name, options)
@@ -6891,7 +8270,7 @@ function createProgram(makeDependencies = createDependencies) {
       repeated
     ).addOption(
       new Option("--expires-in <period>", "when the key expires").choices(apiKeyExpirations)
-    ),
+    ).addOption(budgetOption("the key's member")),
     "createApiKey"
   ).action(
     async (name, options) => apiKeyCreateCommand(dependencies(), name, options)
@@ -6905,6 +8284,37 @@ function createProgram(makeDependencies = createDependencies) {
   ).action(
     async (keyId, options) => apiKeyRevokeCommand(dependencies(), keyId, options)
   );
+  const budget = program.command("budget").description("the account's monthly spend budgets");
+  operationOptions(
+    budget.command("list").description("list the budgets, the account budget first"),
+    "listBudgets"
+  ).action(async (options) => budgetListCommand(dependencies(), options));
+  operationOptions(
+    budget.command("show <budget>").description("show one budget, by its name or id"),
+    "getBudget"
+  ).action(
+    async (name, options) => budgetShowCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    budget.command("add <name>").description("create a budget for you or Agents you created").requiredOption("--limit <dollars>", "the monthly limit in dollars, such as 50").option(
+      "--member <member>",
+      "a member to cover: you, or an Agent you created (subject, id or name); repeat for several",
+      repeated
+    ),
+    "createBudget"
+  ).action(
+    async (name, options) => budgetAddCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    budget.command("set <budget>").description("lower the budget that covers you, or add Agents you created to it").option("--limit <dollars>", "a lower monthly limit; a raise opens the console").option(
+      "--add <member>",
+      "an Agent you created to cover too (subject, id or name); repeat for several",
+      repeated
+    ),
+    "changeBudget"
+  ).action(
+    async (name, options) => budgetSetCommand(dependencies(), name, options)
+  );
   const bucket = program.command("bucket").description("the account's Streams buckets");
   operationOptions(bucket.command("list").description("list the buckets"), "listBuckets").action(
     async (options) => bucketListCommand(dependencies(), options)
@@ -7116,7 +8526,10 @@ function createProgram(makeDependencies = createDependencies) {
     machineSpecOptions(
       machine.command("update <name> [command...]").description(
         "change a Machine; [command...] after -- replaces its command at the next boot"
-      ).option("--image <reference>", "a new image, named as for create; applies at the next boot").option("--image-command", "run the image's own CMD again at the next boot").option("--unset-env <KEY>", "remove an environment variable; repeat for several", repeated).option("--clear-ports", "remove every port").option("--if-match <etag>", ifMatchHelp("change")).option("--discard-snapshot", "apply a change that discards the Machine's snapshot").option("--no-volume", "remove the Machine's Volume at the next boot; the Volume is kept").option("--no-delete-after", "never delete the Machine for being asleep"),
+      ).option("--image <reference>", "a new image, named as for create; applies at the next boot").option("--image-command", "run the image's own CMD again at the next boot").option("--unset-env <KEY>", "remove an environment variable; repeat for several", repeated).option("--clear-ports", "remove every port").option("--if-match <etag>", ifMatchHelp("change")).option("--discard-snapshot", "apply a change that discards the Machine's snapshot").option("--no-volume", "remove the Machine's Volume at the next boot; the Volume is kept").option(
+        "--database <name>",
+        "bind the account's database <name> of the Machine's region instead; applies at the next wake"
+      ).option("--no-database", "bind no database from the next wake; the database is kept").option("--no-delete-after", "never delete the Machine for being asleep"),
       true
     ),
     "updateMachine"
@@ -7126,13 +8539,16 @@ function createProgram(makeDependencies = createDependencies) {
   operationOptions(
     machine.command("exec <name> [command...]").description(
       "run a command in a Machine, waking it first, and print its output; exits with its status"
+    ).option(
+      "--detach",
+      "start it in the background and print its id at once; it keeps the Machine awake until it ends or its timeout"
     ).option("--cwd <path>", "the working directory, an absolute path").option(
       "--env <KEY=VALUE>",
       "set an environment variable for the command; repeat for several",
       repeated
     ).option(
       "--timeout <seconds>",
-      "kill the command after this many seconds (default 600, at most 3600)",
+      "kill the command after this many seconds (default 600, at most 3600; with --detach default 3600, at most 21600)",
       parseWhole
     ).option("--stdin", "send this process's stdin to the command (at most 1 MiB)").option(
       "--expect-activation <activation>",
@@ -7143,38 +8559,85 @@ function createProgram(makeDependencies = createDependencies) {
     ),
     "execMachineCommand"
   ).action(
-    async (name, command, options) => machineExecCommand(dependencies(), name, command, options)
+    async (name, command, options) => options.detach ? machineProcessStartCommand(dependencies(), name, command, options) : machineExecCommand(dependencies(), name, command, options)
+  );
+  operationOptions(
+    machine.command("ps <name>").description("list a Machine's background processes, running and recently ended"),
+    "listMachineProcesses"
+  ).action(
+    async (name, options) => machineProcessListCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    machine.command("wait <name> <process>").description("wait for a background process to end; exits with its status"),
+    "getMachineProcess"
+  ).action(
+    async (name, id, options) => machineProcessWaitCommand(dependencies(), name, id, options)
+  );
+  operationOptions(
+    machine.command("output <name> <process>").description("print a background process's output, stdout and stderr together").option("--offset <bytes>", "start at this byte offset", parseWhole).option("--follow", "keep printing new output until the process ends"),
+    "readMachineProcessOutput"
+  ).action(
+    async (name, id, options) => machineProcessOutputCommand(dependencies(), name, id, options)
+  );
+  operationOptions(
+    machine.command("kill <name> <process>").description("end a background process: SIGTERM, then a kill after 5 seconds"),
+    "killMachineProcess"
+  ).action(
+    async (name, id, options) => machineProcessKillCommand(dependencies(), name, id, options)
   );
   const file = machine.command("file").description("read, write, stat, list and delete a Machine's files");
   operationOptions(
     file.command("read <name> <path>").description("print a file of a Machine, waking it first").option("--output <file>", "write the bytes to this local file instead of stdout").option("--range <range>", "one byte range, such as bytes=0-1023").option("--expect-activation <activation>", "read only in this activation"),
     "readMachineFile"
   ).action(
-    async (name, path4, options) => machineFileReadCommand(dependencies(), name, path4, options)
+    async (name, path5, options) => machineFileReadCommand(dependencies(), name, path5, options)
   );
   operationOptions(
     file.command("write <name> <path>").description("replace a file of a Machine with stdin or --from, atomically").option("--from <file>", "the local file to send instead of stdin").option("--mode <mode>", "the file's mode, four octal digits such as 0755").option("--if-match <etag>", "replace only the version with this ETag").option("--create", "only create the file; refuse when it exists").option("--expect-activation <activation>", "write only in this activation"),
     "writeMachineFile"
   ).action(
-    async (name, path4, options) => machineFileWriteCommand(dependencies(), name, path4, options)
+    async (name, path5, options) => machineFileWriteCommand(dependencies(), name, path5, options)
   );
   operationOptions(
     file.command("stat <name> <path>").description("show a path's type, size, mode, owner and ETag").option("--expect-activation <activation>", "stat only in this activation"),
     "statMachineFile"
   ).action(
-    async (name, path4, options) => machineFileStatCommand(dependencies(), name, path4, options)
+    async (name, path5, options) => machineFileStatCommand(dependencies(), name, path5, options)
   );
   operationOptions(
     file.command("list <name> <path>").description("list a directory of a Machine").option("--expect-activation <activation>", "list only in this activation"),
     "listMachineFiles"
   ).action(
-    async (name, path4, options) => machineFileListCommand(dependencies(), name, path4, options)
+    async (name, path5, options) => machineFileListCommand(dependencies(), name, path5, options)
   );
   operationOptions(
     file.command("delete <name> <path>").description("delete a file, a symbolic link or an empty directory of a Machine").option("--recursive", "delete a directory and everything in it").option("--expect-activation <activation>", "delete only in this activation"),
     "deleteMachineFile"
   ).action(
-    async (name, path4, options) => machineFileDeleteCommand(dependencies(), name, path4, options)
+    async (name, path5, options) => machineFileDeleteCommand(dependencies(), name, path5, options)
+  );
+  const hold = machine.command("hold").description("keep a Machine awake for work that has no open connection");
+  operationOptions(
+    hold.command("set <name> <hold>").description("keep a Machine awake until a hold lapses; never wakes it").option(
+      "--for <duration>",
+      "how long from now, such as 90s, 45m or 1h (at most 1h)",
+      parseHoldDuration
+    ).option("--expect-activation <activation>", "hold only this activation"),
+    "setMachineHold"
+  ).action(
+    async (name, holdName, options) => machineHoldSetCommand(dependencies(), name, holdName, options)
+  );
+  operationOptions(
+    hold.command("rm <name> <hold>").description("release a hold set from outside the Machine"),
+    "releaseMachineHold"
+  ).action(
+    async (name, holdName, options) => machineHoldRmCommand(dependencies(), name, holdName, options)
+  );
+  operationOptions(
+    hold.command("ls <name>").description("list what holds a Machine awake"),
+    "listMachineHolds"
+  ).action(
+    async (name, options) => machineHoldLsCommand(dependencies(), name, options)
   );
   operationOptions(
     machine.command("sleep <name>").description("put a Machine to sleep now; its next request boots it on its latest spec").option("--if-match <etag>", ifMatchHelp("put to sleep")).option("--wait", "wait until the Machine is asleep").option("--timeout <seconds>", "how long --wait waits, in seconds", parseWhole),
@@ -7182,6 +8645,12 @@ function createProgram(makeDependencies = createDependencies) {
   ).action(
     async (name, options) => machineSleepCommand(dependencies(), name, options)
   );
+  operationOptions(
+    machine.command("wake <name>").description("wake an asleep Machine now, without a request to it").option("--if-match <etag>", ifMatchHelp("wake")).option("--wait", "wait until the Machine is awake").option("--timeout <seconds>", "how long --wait waits, in seconds", parseWhole),
+    "wakeMachine"
+  ).action(
+    async (name, options) => machineWakeCommand(dependencies(), name, options)
+  );
   operationOptions(
     machine.command("delete <name>").description("delete a Machine with its disk and logs, or forget one of your computers").option("--yes", "delete without asking; required when stdin is not a terminal").option("--if-match <etag>", ifMatchHelp("delete")),
     "deleteMachine"