@tonbo/cli 0.15.0 → 0.16.0

package/dist/bin/tonbo.js

@@ -174,6 +174,42 @@ var managementOperations = {
     "idempotencyKey": false,
     "cli": "tonbo account show"
   },
+  "listBudgets": {
+    "method": "GET",
+    "path": "/budgets",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget list"
+  },
+  "createBudget": {
+    "method": "POST",
+    "path": "/budgets",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": true,
+    "cli": "tonbo budget add"
+  },
+  "getBudget": {
+    "method": "GET",
+    "path": "/budgets/{budget_id}",
+    "pathParams": [
+      "budget_id"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget show"
+  },
+  "changeBudget": {
+    "method": "PATCH",
+    "path": "/budgets/{budget_id}",
+    "pathParams": [
+      "budget_id"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget set"
+  },
   "listRegions": {
     "method": "GET",
     "path": "/regions",
@@ -438,6 +474,13 @@ var managementOperations = {
     "query": [],
     "idempotencyKey": false
   },
+  "renewHandoffHolds": {
+    "method": "POST",
+    "path": "/yield/handoffs/holds",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false
+  },
   "showPersonalHandoff": {
     "method": "GET",
     "path": "/yield/handoffs/{id}",
@@ -1179,42 +1222,6 @@ var managementOperations = {
   }
 };
 var plannedManagementOperations = {
-  "listBudgets": {
-    "method": "GET",
-    "path": "/budgets",
-    "pathParams": [],
-    "query": [],
-    "idempotencyKey": false,
-    "cli": "tonbo budget list"
-  },
-  "createBudget": {
-    "method": "POST",
-    "path": "/budgets",
-    "pathParams": [],
-    "query": [],
-    "idempotencyKey": true,
-    "cli": "tonbo budget add"
-  },
-  "getBudget": {
-    "method": "GET",
-    "path": "/budgets/{budget_id}",
-    "pathParams": [
-      "budget_id"
-    ],
-    "query": [],
-    "idempotencyKey": false,
-    "cli": "tonbo budget show"
-  },
-  "changeBudget": {
-    "method": "PATCH",
-    "path": "/budgets/{budget_id}",
-    "pathParams": [
-      "budget_id"
-    ],
-    "query": [],
-    "idempotencyKey": false,
-    "cli": "tonbo budget set"
-  },
   "getMachineActivation": {
     "method": "GET",
     "path": "/machines/{name}/activations/{activation}",
@@ -1983,19 +1990,29 @@ var MANAGEMENT_AUDIENCE = cliSessionContract.audiences.management;
 function isAccountBearer(bearer) {
   return typeof bearer !== "string";
 }
+function retriesAfterRefusal(bearer, audience, code) {
+  if (!isAccountBearer(bearer))
+    return false;
+  if (bearer.kind === "key")
+    return bearer.refused(audience, code);
+  bearer.invalidate(audience);
+  return true;
+}
 function managementBearer(bearer) {
   return isAccountBearer(bearer) ? bearer.token(MANAGEMENT_AUDIENCE) : Promise.resolve(bearer);
 }
 
 // ../../packages/tonbo-cli-core/dist/src/access-token.js
 var DEFAULT_LOGIN_HINT = credentialsContract.reader.login_hint;
+var STREAMS_AUDIENCE = "https://streams.tonbo.dev";
 var GIT_AUDIENCE = "https://git.tonbo.dev";
+var REFRESH_MARGIN_MS = 6e4;
 var AccessTokenError = class extends Error {
   status;
   retryAfterMs;
   code;
-  constructor(message, status, retryAfterMs = null, code = null) {
-    super(message);
+  constructor(message, status, retryAfterMs = null, code = null, options) {
+    super(message, options);
     this.status = status;
     this.retryAfterMs = retryAfterMs;
     this.code = code;
@@ -2004,6 +2021,116 @@ var AccessTokenError = class extends Error {
     return this.status === null || this.status === 429 || this.status >= 500;
   }
 };
+var AccessTokens = class {
+  fetcher;
+  userOrigin;
+  audience;
+  loginHint;
+  now;
+  cached = null;
+  /** The account bearer the last token was of, which `invalidate` forgets. */
+  last = null;
+  constructor(fetcher, userOrigin, audience = STREAMS_AUDIENCE, loginHint = DEFAULT_LOGIN_HINT, now = () => Date.now()) {
+    this.fetcher = fetcher;
+    this.userOrigin = userOrigin;
+    this.audience = audience;
+    this.loginHint = loginHint;
+    this.now = now;
+  }
+  async token(key) {
+    if (isAccountBearer(key)) {
+      this.last = key;
+      return key.token(this.audience);
+    }
+    if (this.cached && this.cached.key === key && this.cached.refreshAt > this.now())
+      return this.cached.token;
+    const issuedAt = this.now();
+    const what = this.audience === GIT_AUDIENCE ? "git" : this.audience === MANAGEMENT_AUDIENCE ? "Management" : "Streams";
+    let response;
+    try {
+      response = await this.fetcher(`${this.userOrigin}/api/iam/token`, {
+        method: "POST",
+        redirect: "manual",
+        signal: AbortSignal.timeout(3e4),
+        headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+        body: JSON.stringify({ audience: this.audience })
+      });
+    } catch (error) {
+      throw new AccessTokenError(`The ${what} token exchange failed: ${error instanceof Error ? error.message : String(error)}`, null, null, null, { cause: error });
+    }
+    if (!response.ok) {
+      const problem = await response.json().catch(() => null);
+      const retryAfter = Number(response.headers.get("retry-after") ?? "");
+      throw new AccessTokenError(response.status === 401 ? `Your Tonbo login was refused. Run \`${this.loginHint}\`.` : `The ${what} token exchange answered ${response.status}.`, response.status, Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1e3 : null, typeof problem?.code === "string" ? problem.code : null);
+    }
+    const body = await response.json().catch(() => null);
+    if (typeof body?.access_token !== "string" || !body.access_token || typeof body.expires_in !== "number" || !(body.expires_in > 0))
+      throw new AccessTokenError(`The ${what} token exchange answered no token.`, response.status);
+    this.cached = {
+      key,
+      token: body.access_token,
+      refreshAt: issuedAt + Math.max(0, body.expires_in * 1e3 - REFRESH_MARGIN_MS)
+    };
+    return body.access_token;
+  }
+  /** Forgets the token, after the resource server refused it. */
+  invalidate() {
+    this.cached = null;
+    this.last?.invalidate(this.audience);
+  }
+  /** Sends a request with the token; a 401 drops the token and sends once
+   * more with a newly exchanged one, whose answer is final. */
+  async send(key, request) {
+    const response = await request(await this.token(key));
+    if (response.status !== 401)
+      return response;
+    await response.body?.cancel();
+    if (isAccountBearer(key))
+      key.invalidate(this.audience);
+    else
+      this.invalidate();
+    return request(await this.token(key));
+  }
+};
+function apiKeyBearer(key, fetcher, userOrigin, now = () => Date.now()) {
+  const tokens = /* @__PURE__ */ new Map();
+  let exchanging = false;
+  const tokensOf = (audience) => {
+    let found = tokens.get(audience);
+    if (!found) {
+      found = new AccessTokens(fetcher, userOrigin, audience, void 0, now);
+      tokens.set(audience, found);
+    }
+    return found;
+  };
+  return {
+    kind: "key",
+    async token(audience) {
+      if (audience === MANAGEMENT_AUDIENCE && !exchanging)
+        return key;
+      try {
+        return await tokensOf(audience).token(key);
+      } catch (error) {
+        if (!(error instanceof AccessTokenError) || error.status !== 401)
+          throw error;
+        throw new AccessTokenError("TONBO_API_KEY was refused (HTTP 401). Check that the key exists and is not revoked or expired.", 401, null, error.code);
+      }
+    },
+    invalidate(audience) {
+      tokens.get(audience)?.invalidate();
+    },
+    refused(audience, code) {
+      if (audience === MANAGEMENT_AUDIENCE && !exchanging) {
+        if (code !== "exchange_required")
+          return false;
+        exchanging = true;
+        return true;
+      }
+      tokens.get(audience)?.invalidate();
+      return true;
+    }
+  };
+}
 
 // ../../packages/tonbo-cli-core/dist/src/http.js
 var HttpError = class extends Error {
@@ -2029,11 +2156,11 @@ async function requestJson(fetcher, url, init = {}) {
   if (response.ok)
     return body;
   const record = body && typeof body === "object" ? body : {};
-  const reason = [record.detail, record.title, record.error].find((value) => typeof value === "string" && value.length > 0);
+  const reason2 = [record.detail, record.title, record.error].find((value) => typeof value === "string" && value.length > 0);
   const requestId = response.headers.get("x-request-id") ?? (typeof record.request_id === "string" ? record.request_id : null);
   const issues = Array.isArray(record.errors) ? record.errors.filter((issue) => typeof issue?.field === "string" && typeof issue.code === "string").map((issue) => `${issue.field}: ${issue.code}`) : [];
   const message = [
-    reason ?? `Request failed with HTTP ${response.status}.`,
+    reason2 ?? `Request failed with HTTP ${response.status}.`,
     ...issues.length ? [`(${issues.join(", ")})`] : []
   ].join(" ");
   throw new HttpError(requestId ? `${message} (request ${requestId})` : message, response.status, body, requestId);
@@ -2051,9 +2178,9 @@ async function presented(key) {
   try {
     return await managementBearer(key);
   } catch (error) {
-    if (!(error instanceof AccessTokenError))
+    if (!(error instanceof AccessTokenError) || error.status === null)
       throw error;
-    throw new ExchangeRefusal(error.message, error.status ?? 503, { code: error.code }, null);
+    throw new ExchangeRefusal(error.message, error.status, { code: error.code }, null);
   }
 }
 var ManagementApi = class {
@@ -2081,15 +2208,14 @@ var ManagementApi = class {
     try {
       return await attempt();
     } catch (error) {
-      if (!isAccountBearer(key) || !(error instanceof HttpError) || error.status !== 401 || error instanceof ExchangeRefusal)
+      if (!(error instanceof HttpError) || error.status !== 401 || error instanceof ExchangeRefusal || !retriesAfterRefusal(key, MANAGEMENT_AUDIENCE, error.code))
         throw error;
-      key.invalidate(MANAGEMENT_AUDIENCE);
       return attempt();
     }
   }
   async requestWith(operationId, key, { params = {}, query = {}, body, idempotencyKey, ifMatch }, seen) {
     const operation = managementOperation(operationId);
-    const path4 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
+    const path5 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
       const value = params[name];
       if (value === void 0)
         throw new Error(`${operationId} needs the path parameter ${name}.`);
@@ -2113,7 +2239,7 @@ var ManagementApi = class {
     if (ifMatch)
       headers["if-match"] = ifMatch;
     const queryString = search.toString();
-    const url = `${this.apiOrigin}${managementApiBasePath}${path4}${queryString ? `?${queryString}` : ""}`;
+    const url = `${this.apiOrigin}${managementApiBasePath}${path5}${queryString ? `?${queryString}` : ""}`;
     try {
       const fetcher = seen ? async (input, init) => {
         const response = await this.fetcher(input, init);
@@ -2781,17 +2907,20 @@ function accountLogins(login) {
     });
   return entries;
 }
+function personalLogin(login) {
+  return accountLogins(login).find((entry) => entry.kind === "user") ?? null;
+}
 async function preparePrivateDirectory(directory) {
-  const stat = await lstat(directory);
-  if (stat.isSymbolicLink() || !stat.isDirectory())
+  const stat2 = await lstat(directory);
+  if (stat2.isSymbolicLink() || !stat2.isDirectory())
     throw new Error("Tonbo config directory must be a real directory.");
   if (process.platform !== "win32")
     await chmod(directory, DIRECTORY_MODE);
 }
 async function assertExistingDestinationIsSafe(filename) {
   try {
-    const stat = await lstat(filename);
-    if (stat.isSymbolicLink() || !stat.isFile())
+    const stat2 = await lstat(filename);
+    if (stat2.isSymbolicLink() || !stat2.isFile())
       throw new Error("Tonbo credential path must be a regular file.");
   } catch (error) {
     if (error.code !== "ENOENT")
@@ -2799,17 +2928,17 @@ async function assertExistingDestinationIsSafe(filename) {
   }
 }
 async function assertPrivateRegularFile(filename) {
-  const stat = await lstat(filename);
-  if (stat.isSymbolicLink() || !stat.isFile())
+  const stat2 = await lstat(filename);
+  if (stat2.isSymbolicLink() || !stat2.isFile())
     throw new Error("Tonbo credential path must be a regular file.");
-  if (process.platform !== "win32" && (stat.mode & REFUSED_MODE_BITS) !== 0)
+  if (process.platform !== "win32" && (stat2.mode & REFUSED_MODE_BITS) !== 0)
     throw new Error(`Tonbo credential file must have mode ${credentialsContract.permissions.file_mode}.`);
 }
 
 // ../../packages/tonbo-cli-core/dist/src/device.js
 import { execFile } from "node:child_process";
 import { createHash, randomUUID as randomUUID2 } from "node:crypto";
-import { link, mkdir as mkdir2, open as open2, readFile as readFile2, rename as rename2, rm as rm2 } from "node:fs/promises";
+import { link, mkdir as mkdir2, open as open2, readFile as readFile2, rename as rename2, rm as rm2, stat } from "node:fs/promises";
 import os2 from "node:os";
 import path2 from "node:path";
 import { promisify } from "node:util";
@@ -2836,6 +2965,14 @@ async function readMachineId(platform = process.platform) {
 function machineIdHash(machineId) {
   return createHash("sha256").update(machineId).digest("hex");
 }
+var NO_HARD_LINKS = /* @__PURE__ */ new Set(["EPERM", "ENOTSUP", "EOPNOTSUPP", "ENOSYS", "EMLINK", "EXDEV"]);
+var CREATE_POLL_MS = 50;
+var CREATE_STALE_MS = 5e3;
+var exists = (file) => stat(file).then(() => true, (error) => {
+  if (error.code === "ENOENT")
+    return false;
+  throw error;
+});
 var DeviceStore = class {
   filename;
   machineId;
@@ -2913,13 +3050,49 @@ var DeviceStore = class {
       await link(temporary, this.filename);
       return true;
     } catch (error) {
-      if (!replace && error.code === "EEXIST")
+      const code = error.code;
+      if (!replace && code === "EEXIST")
         return false;
+      if (!replace && code && NO_HARD_LINKS.has(code))
+        return await this.create(temporary);
       throw error;
     } finally {
       await rm2(temporary, { force: true });
     }
   }
+  /** The first record on a filesystem without hard links (some FUSE and
+   * network volumes), from the complete, synced `temporary`: renamed into
+   * place, so the file is never seen empty or partial, while holding a lock
+   * directory made exclusively, so of two first runs at once only one
+   * writes it and the other waits for it. A lock left by a run that died
+   * holding it is taken over after a while. */
+  async create(temporary) {
+    const lock = `${this.filename}.lock`;
+    for (let waited = 0; ; waited += CREATE_POLL_MS) {
+      try {
+        await mkdir2(lock, { mode: 448 });
+        break;
+      } catch (error) {
+        if (error.code !== "EEXIST")
+          throw error;
+      }
+      if (await exists(this.filename))
+        return false;
+      if (waited >= CREATE_STALE_MS) {
+        await rm2(lock, { recursive: true, force: true });
+        waited = -CREATE_POLL_MS;
+      } else
+        await new Promise((resolve) => setTimeout(resolve, CREATE_POLL_MS));
+    }
+    try {
+      if (await exists(this.filename))
+        return false;
+      await rename2(temporary, this.filename);
+      return true;
+    } finally {
+      await rm2(lock, { recursive: true, force: true });
+    }
+  }
 };
 
 // ../../packages/tonbo-cli-core/dist/src/session.js
@@ -2964,7 +3137,7 @@ var FileSessionStore = class {
     await removePrivateFile(this.filename);
   }
 };
-var REFRESH_MARGIN_MS = 6e4;
+var REFRESH_MARGIN_MS2 = 6e4;
 var clients = /* @__PURE__ */ new WeakMap();
 var SessionClient = class _SessionClient {
   stored;
@@ -3059,7 +3232,7 @@ var SessionClient = class _SessionClient {
     }, what, accountId);
     this.tokens.set(`${audience} ${accountId}`, {
       token: body.access_token,
-      refreshAt: issuedAt + Math.max(0, body.expires_in * 1e3 - REFRESH_MARGIN_MS)
+      refreshAt: issuedAt + Math.max(0, body.expires_in * 1e3 - REFRESH_MARGIN_MS2)
     });
     return body.access_token;
   }
@@ -3077,7 +3250,7 @@ var SessionClient = class _SessionClient {
         body: JSON.stringify(fields2)
       });
     } catch (error) {
-      throw new AccessTokenError(`The ${what} token exchange failed: ${error instanceof Error ? error.message : String(error)}`, null);
+      throw new AccessTokenError(`The ${what} token exchange failed: ${error instanceof Error ? error.message : String(error)}`, null, null, null, { cause: error });
     }
     if (!response.ok)
       throw await this.refusal(response, what, accountId);
@@ -3118,7 +3291,7 @@ var SessionClient = class _SessionClient {
         headers: { authorization: `Bearer ${token}`, accept: "application/json" }
       });
     } catch (error) {
-      throw new AccessTokenError(`Reading ${this.accountName(accountId)}'s git workspaces failed: ${error instanceof Error ? error.message : String(error)}`, null);
+      throw new AccessTokenError(`Reading ${this.accountName(accountId)}'s git workspaces failed: ${error instanceof Error ? error.message : String(error)}`, null, null, null, { cause: error });
     }
     const body = await response.json().catch(() => null);
     if (!response.ok)
@@ -3143,7 +3316,7 @@ var SessionClient = class _SessionClient {
         }
       });
     } catch (error) {
-      throw new AccessTokenError(`Reading your accounts failed: ${error instanceof Error ? error.message : String(error)}`, null);
+      throw new AccessTokenError(`Reading your accounts failed: ${error instanceof Error ? error.message : String(error)}`, null, null, null, { cause: error });
     }
     if (!response.ok)
       throw await this.refusal(response, "session", "");
@@ -3225,17 +3398,23 @@ var LoginStore = class {
     await this.sessions.remove();
     await this.legacy.remove();
   }
-  /** The person's accounts now, saved as the login's cache of names. */
+  /** The person's accounts now, saved as the login's cache of names. `client`
+   * holds them before the save, so when the file cannot be written (an
+   * agent's sandbox) `current(client)` still answers with them. */
   async refreshAccounts(client) {
     const accounts = await client.accounts();
     const latest = await this.sessions.load() ?? client.stored;
     if (latest.session.id === client.stored.session.id) {
       const saved = withAccounts(latest, accounts);
-      await this.sessions.save(saved);
       client.stored = saved;
+      await this.sessions.save(saved);
     }
     return accounts;
   }
+  /** The logins `client` holds in this process, without reading the file again. */
+  current(client) {
+    return this.view(client);
+  }
   /** Forgets an account the person no longer belongs to (they left it, or
    * were removed): the login's cache of names is read again without it, it
    * is no longer the default account, and this process's tokens of it are
@@ -3316,11 +3495,21 @@ var LoginStore = class {
     const named = this.options.account;
     if (!named)
       return;
-    const response = await this.fetcher(`${this.options.apiOrigin}${managementApiBasePath}${managementOperations.getAccount.path}`, {
+    const read = async () => this.fetcher(`${this.options.apiOrigin}${managementApiBasePath}${managementOperations.getAccount.path}`, {
       redirect: "manual",
       signal: AbortSignal.timeout(3e4),
-      headers: { authorization: `Bearer ${key}`, accept: "application/json" }
+      headers: {
+        authorization: `Bearer ${await managementBearer(key)}`,
+        accept: "application/json"
+      }
     });
+    let response = await read();
+    if (response.status === 401) {
+      const refusal = await response.json().catch(() => null);
+      const code = typeof refusal?.code === "string" ? refusal.code : null;
+      if (retriesAfterRefusal(key, MANAGEMENT_AUDIENCE, code))
+        response = await read();
+    }
     const body = await response.json().catch(() => null);
     if (!response.ok)
       throw new Error(`TONBO_API_KEY was refused (HTTP ${response.status}).`);
@@ -3353,9 +3542,11 @@ var DEFAULT_LOGIN_HINT3 = credentialsContract.reader.login_hint;
 var LOOPBACK_HOST = "127.0.0.1";
 var BrowserUnavailableError = class extends Error {
 };
-function prefersDeviceLogin(env = process.env) {
+function prefersDeviceLogin(env = process.env, platform = process.platform) {
+  if (env.DISPLAY || env.WAYLAND_DISPLAY)
+    return false;
   const ssh = Boolean(env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY);
-  return ssh && !env.DISPLAY && !env.WAYLAND_DISPLAY;
+  return ssh || platform !== "darwin" && platform !== "win32";
 }
 function loginHostname(hostname = os4.hostname()) {
   const cleaned = hostname.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[^A-Za-z0-9]+/, "").slice(0, 64);
@@ -3374,7 +3565,8 @@ var AuthClient = class {
   entryLine;
   env;
   facts;
-  keyChecked = null;
+  /** TONBO_API_KEY's bearer, made once per key so its tokens and its exchange outlive a call. */
+  injectedBearer = null;
   constructor(credentials, fetcher, loginOrigin2 = "https://tonbo.dev", browserOpener = openBrowser, hostname = loginHostname(), loginHint = DEFAULT_LOGIN_HINT3, entryLine = "cli", env = process.env, facts = {}) {
     this.credentials = credentials;
     this.fetcher = fetcher;
@@ -3388,18 +3580,25 @@ var AuthClient = class {
   }
   /**
    * The credential of the account a command acts in: TONBO_API_KEY (whose
-   * own account any account the command named must be), or the CLI login's
-   * bearer of the named account, else of its default, else of the personal
-   * account; with only a legacy login, that file's key.
+   * own account any account the command named must be), presented as the
+   * Tonbo SDK presents a key (apiKeyBearer), or the CLI login's bearer of the
+   * named account, else of its default, else of the personal account; with
+   * only a legacy login, that file's key.
    */
   async apiKey() {
     const injected = this.env.TONBO_API_KEY?.trim();
     if (injected) {
-      if (this.keyChecked !== injected) {
-        await this.credentials.checkKeyAccount(injected);
-        this.keyChecked = injected;
+      if (this.injectedBearer?.key !== injected)
+        this.injectedBearer = {
+          key: injected,
+          bearer: apiKeyBearer(injected, this.fetcher, this.loginOrigin),
+          checked: false
+        };
+      if (!this.injectedBearer.checked) {
+        await this.credentials.checkKeyAccount(this.injectedBearer.bearer);
+        this.injectedBearer.checked = true;
       }
-      return injected;
+      return this.injectedBearer.bearer;
     }
     const login = await this.credentials.load();
     if (!login)
@@ -3412,17 +3611,20 @@ var AuthClient = class {
    * Logs this computer in (ADR-0018): the browser handoff of /cli/login, PKCE
    * S256 with a loopback redirect on a free port, asks for a session
    * (`grant=cli_session`); the approval names this computer and asks no
-   * account. With `device`, in an SSH session without a display, or when no
+   * account. With `device`, in an SSH session or on Linux without a display, or when no
    * browser can be opened, the same PKCE challenge goes to a device-code
    * login instead: the person enters a short code at /cli/device in any
    * browser and the CLI polls. The redeemed session, tied to this
    * computer's device id, is saved as `login.json` and replaces this
    * computer's earlier session; the legacy `credentials.json` is left as it
    * is. With `account` (a name or id), commands act there by default unless
-   * `current` is false. Answers the login of the account commands act in.
+   * `current` is false. With `openBrowser` false the browser login opens no
+   * browser: the person opens the `authorization-url` they are shown, as
+   * when an agent shows it with what the approval consents to. Answers the
+   * login of the account commands act in.
    */
   async login(progress = () => {
-  }, account, { current = true, device } = {}) {
+  }, account, { current = true, device, openBrowser: openBrowser2 = true } = {}) {
     const deviceId = await (this.facts.devices ?? new DeviceStore()).deviceId();
     const verifier = randomBytes(48).toString("base64url");
     const challenge = createHash3("sha256").update(verifier).digest("base64url");
@@ -3433,7 +3635,7 @@ var AuthClient = class {
       ...clientFact(this.facts.clientVersion) ? { client_version: clientFact(this.facts.clientVersion) } : {},
       ...clientFact(process.platform) ? { os: process.platform } : {}
     };
-    const redeemed = device ?? prefersDeviceLogin(this.env) ? await this.deviceLogin(challenge, verifier, redeem, progress) : await this.browserLogin(challenge, verifier, redeem, progress).catch((error) => {
+    const redeemed = device ?? prefersDeviceLogin(this.env) ? await this.deviceLogin(challenge, verifier, redeem, progress) : await this.browserLogin(challenge, verifier, redeem, progress, openBrowser2).catch((error) => {
       if (!(error instanceof BrowserUnavailableError))
         throw error;
       progress({ status: "failed", step: "browser", reason: error.message });
@@ -3469,7 +3671,7 @@ var AuthClient = class {
       throw new Error("The saved login could not be read back.");
     return login;
   }
-  async browserLogin(challenge, verifier, redeem, progress) {
+  async browserLogin(challenge, verifier, redeem, progress, openBrowser2) {
     const state = randomBytes(24).toString("base64url");
     const code = await this.listenForCode(state, (redirectUri) => {
       const authorization = new URL("/cli/login", this.loginOrigin);
@@ -3483,7 +3685,7 @@ var AuthClient = class {
         [cliSessionContract.grantParameter]: cliSessionContract.grant
       }).toString();
       return authorization.toString();
-    }, progress);
+    }, progress, openBrowser2);
     progress({ status: "started", step: "key-redemption" });
     const redeemed = await requestJson(this.fetcher, new URL("/api/cli/login/token", this.loginOrigin).toString(), {
       method: "POST",
@@ -3561,7 +3763,7 @@ var AuthClient = class {
       }
     }
   }
-  listenForCode(expectedState, authorizationUrl, progress) {
+  listenForCode(expectedState, authorizationUrl, progress, openBrowser2) {
     return new Promise((resolve, reject) => {
       let settled = false;
       const sockets = /* @__PURE__ */ new Set();
@@ -3636,6 +3838,8 @@ var AuthClient = class {
         progress({ status: "completed", step: "callback-server" });
         const url = authorizationUrl(`http://${LOOPBACK_HOST}:${port}/callback`);
         progress({ status: "authorization-url", step: "browser", url });
+        if (!openBrowser2)
+          return;
         progress({ status: "started", step: "browser" });
         void Promise.resolve().then(() => this.browserOpener(url)).then(() => startAuthorization(), (error) => {
           if (settled || authorizationStarted)
@@ -3681,6 +3885,150 @@ async function openBrowser(url) {
   }
 }
 
+// ../../packages/tonbo-cli-core/dist/src/capture-filter.js
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir as mkdir3, open as open3, readFile as readFile3, rename as rename3, rm as rm3 } from "node:fs/promises";
+import os5 from "node:os";
+import path4 from "node:path";
+var KEPT_WINDOWS = 200;
+function yieldStateDirectory(env = process.env, home = os5.homedir()) {
+  return path4.join(env.XDG_STATE_HOME || path4.join(home, ".local", "state"), "tonbo-yield");
+}
+function emptyFilter() {
+  return { version: 1, pause: null, past: [], excluded: [] };
+}
+function activePause(file, now) {
+  const pause = file.pause;
+  return pause && (pause.until === null || now < pause.until) ? pause : null;
+}
+function pauseForLogout(file, now, person) {
+  const current = activePause(file, now);
+  if (current?.logout)
+    return file;
+  const after = current ? { after: current.until } : {};
+  if (current)
+    current.until = now;
+  settle(file, now);
+  file.pause = { since: now, until: null, logout: { ...after, person } };
+  return file;
+}
+function endLogoutPause(file, now, person) {
+  const current = activePause(file, now);
+  if (!current?.logout)
+    return file;
+  const { after, person: before } = current.logout;
+  if (person === null || before == null || before !== person)
+    current.since = 0;
+  current.until = now;
+  settle(file, now);
+  if (after === null || after !== void 0 && after > now)
+    file.pause = { since: now, until: after };
+  return file;
+}
+function settle(file, now) {
+  if (file.pause && !activePause(file, now)) {
+    file.past = [...file.past, file.pause].slice(-KEPT_WINDOWS);
+    file.pause = null;
+  }
+}
+async function durableWrite(filename, body) {
+  const parent = path4.dirname(filename);
+  const created = await mkdir3(parent, { recursive: true, mode: 448 });
+  if (created) {
+    const state = await open3(path4.dirname(parent), "r");
+    try {
+      await state.sync();
+    } finally {
+      await state.close();
+    }
+  }
+  const temporary = path4.join(parent, `.${randomUUID3()}.tmp`);
+  const file = await open3(temporary, "wx", 384);
+  try {
+    await file.writeFile(JSON.stringify(body));
+    await file.sync();
+  } finally {
+    await file.close();
+  }
+  try {
+    await rename3(temporary, filename);
+    const dir = await open3(parent, "r");
+    try {
+      await dir.sync();
+    } finally {
+      await dir.close();
+    }
+  } catch (error) {
+    await rm3(temporary, { force: true });
+    throw error;
+  }
+}
+var CaptureFilterStore = class {
+  filename;
+  constructor(filename = path4.join(yieldStateDirectory(), "capture-filter.json")) {
+    this.filename = filename;
+  }
+  /** A missing file filters nothing; an unreadable one throws, and the
+   * daemon then captures nothing (fail closed). */
+  async load() {
+    let body;
+    try {
+      body = await readFile3(this.filename, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return emptyFilter();
+      throw error;
+    }
+    const parsed = JSON.parse(body);
+    const window = (value) => !!value && Number.isFinite(value.since) && (value.until === null || Number.isFinite(value.until));
+    if (parsed?.version !== 1 || !(parsed.pause === null || window(parsed.pause)) || !Array.isArray(parsed.past) || !parsed.past.every(window) || !Array.isArray(parsed.excluded) || !parsed.excluded.every((folder) => typeof folder === "string" && path4.isAbsolute(folder)))
+      throw new Error(`${this.filename} is not a Yield capture filter file.`);
+    return parsed;
+  }
+  async save(file) {
+    await durableWrite(this.filename, file);
+  }
+  async update(change) {
+    const file = await this.load();
+    change(file);
+    await this.save(file);
+    return file;
+  }
+};
+var CaptureNotStoppedError = class extends Error {
+};
+var reason = (error) => error instanceof Error ? error.message : String(error);
+async function stopCaptureForLogout(person, store = new CaptureFilterStore(), now = Date.now()) {
+  if (!existsSync(path4.dirname(store.filename)))
+    return null;
+  let file;
+  try {
+    file = await store.load();
+  } catch (error) {
+    return `Yield's capture stays stopped on this computer: ${reason(error)}`;
+  }
+  pauseForLogout(file, now, person);
+  try {
+    await store.save(file);
+  } catch (error) {
+    throw new CaptureNotStoppedError(`Could not stop Yield's capture on this computer (${reason(error)}), so nothing was logged out. Run the logout again where it can write ${store.filename}, outside an agent's sandbox.`, { cause: error });
+  }
+  return null;
+}
+async function resumeCaptureAfterLogin(person, store = new CaptureFilterStore(), now = Date.now()) {
+  try {
+    const file = await store.load();
+    if (!activePause(file, now)?.logout)
+      return null;
+    endLogoutPause(file, now, await person().catch(() => null));
+    await store.save(file);
+    return null;
+  } catch (error) {
+    return `Yield's capture stays stopped on this computer: ${reason(error)}`;
+  }
+}
+
 // ../../packages/tonbo-cli-core/dist/src/cell.js
 function cellOrigin(region, configured = process.env.TONBO_CELL_API_ORIGIN) {
   if (!/^[a-z0-9-]+$/.test(region))
@@ -3698,7 +4046,7 @@ var CellApi = class {
   }
   url(operationId, region, request) {
     const operation = managementOperations[operationId];
-    const path4 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
+    const path5 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
       const value = request.params[name];
       if (value === void 0)
         throw new Error(`${operationId} needs the path parameter ${name}.`);
@@ -3709,7 +4057,7 @@ var CellApi = class {
       if (value !== void 0)
         search.set(name, value);
     const query = search.toString();
-    return `${cellOrigin(region)}${managementApiBasePath}${path4}${query ? `?${query}` : ""}`;
+    return `${cellOrigin(region)}${managementApiBasePath}${path5}${query ? `?${query}` : ""}`;
   }
   async init(operationId, key, request) {
     const headers = {
@@ -3787,14 +4135,22 @@ function when(timestamp, absent = "never") {
 }
 
 // ../../packages/tonbo-cli-core/dist/src/login.js
+function captureAfterLogin(deps) {
+  return resumeCaptureAfterLogin(async () => {
+    const file = await deps.credentials.load();
+    return file ? personalLogin(file)?.account_id ?? null : null;
+  }, deps.captureFilter);
+}
 async function loginCommand(deps, options = {}) {
   try {
     const login = await deps.auth.login((event) => reportLoginProgress(deps.progress, event), options.account, { current: options.current, device: options.device });
+    const stopped = await captureAfterLogin(deps);
     const file = await deps.credentials.load();
     const names = file ? accountLogins(file).map((entry) => entry.kind === "user" ? `${entry.name ?? "you"} (personal)` : entry.name ?? entry.account_id) : [];
     deps.output([
       `Logged in. This computer can act in every account you belong to, with your role in each${names.length ? `: ${names.join(", ")}` : ""}.`,
-      `Commands act in ${login.kind === "user" ? "your personal account" : login.name ?? login.account_id} unless you pass --account.${login.expires_at ? ` The login ends ${login.expires_at.slice(0, 10)}, or after 30 days unused.` : ""}`
+      `Commands act in ${login.kind === "user" ? "your personal account" : login.name ?? login.account_id} unless you pass --account.${login.expires_at ? ` The login ends ${login.expires_at.slice(0, 10)}, or after 30 days unused.` : ""}`,
+      ...stopped ? [stopped] : []
     ].join("\n"));
     return login;
   } catch (error) {
@@ -3866,11 +4222,13 @@ async function logoutCommand(deps) {
     failures.push(`${what}: ${failure.message}`);
   };
   let session = null;
+  let unusable = false;
   try {
     session = await deps.credentials.session({ anyDevice: true });
   } catch (error) {
     if (!(error instanceof UnusableLoginError))
       throw error;
+    unusable = true;
   }
   let legacy = null;
   try {
@@ -3878,6 +4236,13 @@ async function logoutCommand(deps) {
   } catch (error) {
     if (!(error instanceof UnusableLoginError))
       throw error;
+    unusable = true;
+  }
+  if (session || legacy || unusable) {
+    const person = session?.stored.personal_account_id ?? (legacy && personalLogin(legacy)?.account_id) ?? null;
+    const stopped = await stopCaptureForLogout(person, deps.captureFilter);
+    if (stopped)
+      deps.output(stopped);
   }
   if (session)
     await session.logout().catch((error) => failed("the CLI login", error));
@@ -3986,7 +4351,7 @@ var TerminalProgress = class {
 };
 
 // src/commands.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 
 // src/agent-name.ts
 var AGENT_NAME_RULE = agentNameContract.$defs.name;
@@ -4002,7 +4367,7 @@ function validateAgentName(name) {
 }
 
 // src/budget.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 var BUDGETS_NOT_AVAILABLE = "Budgets are not available yet.";
 function parseDollars(value) {
   const match = /^\$?([0-9]+)(?:\.([0-9]{1,2}))?$/.exec(value.trim());
@@ -4094,7 +4459,7 @@ async function budgetAddCommand(deps, name, options) {
   const key = await deps.auth.apiKey();
   const limit = parseDollars(options.limit);
   const principals = options.member?.length ? await Promise.all(options.member.map((member) => resolveMemberSubject(deps, key, member))) : [(await deps.api.getAccount(key)).member.subject];
-  const created = await deps.api.createBudget(key, { scope: "principals", name, limit_micros: limit, principals }, randomUUID3()).catch((error) => consoleOr(deps, error));
+  const created = await deps.api.createBudget(key, { scope: "principals", name, limit_micros: limit, principals }, randomUUID4()).catch((error) => consoleOr(deps, error));
   print(
     deps,
     options.json,
@@ -4127,7 +4492,7 @@ async function attachBudget(deps, key, subject, value, name, created) {
       const budget = await deps.api.createBudget(
         key,
         { scope: "principals", name, limit_micros: limit, principals: [subject] },
-        randomUUID3()
+        randomUUID4()
       ).catch((error) => consoleOr(deps, error));
       deps.notice(`Budget ${budget.name ?? name}: ${usd(limit)} a month for ${subject}.`);
       return;
@@ -4136,8 +4501,8 @@ async function attachBudget(deps, key, subject, value, name, created) {
     await deps.api.changeBudget(key, found.id, { add_principals: [subject] }).catch((error) => consoleOr(deps, error));
     deps.notice(`Budget ${found.name ?? found.id} now covers ${subject}.`);
   } catch (error) {
-    const reason = error instanceof Error ? error.message : String(error);
-    throw new Error(`${created} was created, but its budget was not set: ${reason}`);
+    const reason2 = error instanceof Error ? error.message : String(error);
+    throw new Error(`${created} was created, but its budget was not set: ${reason2}`);
   }
 }
 function accountBudgetFields(account) {
@@ -4246,7 +4611,7 @@ async function agentCreateCommand(deps, name, options = {}) {
   const agent = await deps.api.createAgent(
     key,
     { name, region, ...options.role === void 0 ? {} : { role: options.role } },
-    options.idempotencyKey ?? randomUUID4()
+    options.idempotencyKey ?? randomUUID5()
   );
   print(
     deps,
@@ -4554,7 +4919,7 @@ async function bucketCreateCommand(deps, name, options = {}) {
   const bucket = await deps.api.createBucket(
     await deps.auth.apiKey(),
     { name, region: options.region },
-    options.idempotencyKey ?? randomUUID4()
+    options.idempotencyKey ?? randomUUID5()
   );
   print(
     deps,
@@ -4685,7 +5050,7 @@ async function databaseCreateCommand(deps, name, options = {}) {
   const database = await deps.api.createDatabase(
     await deps.auth.apiKey(),
     { name, region: options.region, expires_at: expiresAt },
-    options.idempotencyKey ?? randomUUID4()
+    options.idempotencyKey ?? randomUUID5()
   );
   print(
     deps,
@@ -4873,7 +5238,7 @@ async function streamCreateCommand(deps, name, options = {}) {
       content_type: options.contentType,
       expires_at: expiresAt
     },
-    options.idempotencyKey ?? randomUUID4()
+    options.idempotencyKey ?? randomUUID5()
   );
   print(
     deps,
@@ -5097,11 +5462,11 @@ async function accountUseCommand(deps, account, options = {}) {
 import { Help } from "commander";
 
 // src/machine.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 import { readFileSync } from "node:fs";
 
 // src/volume.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 var VOLUME_DURABILITY_LINK = "https://tonbo.dev/docs/machines/guarantees/data#volume";
 var VOLUME_ERROR_HINTS = {
   payment_required: "Add credit at <billing>, then create the Volume again.",
@@ -5199,7 +5564,7 @@ async function volumeCreateCommand(deps, name, options = {}) {
     const volume = await deps.api.createVolume(
       key,
       { name, region, size_gib: sizeGib },
-      options.idempotencyKey ?? randomUUID5()
+      options.idempotencyKey ?? randomUUID6()
     );
     print(
       deps,
@@ -5355,10 +5720,10 @@ function duration(seconds) {
   return seconds % 60 === 0 && seconds >= 120 ? `${seconds / 60} min` : `${seconds} s`;
 }
 function sleepText(machine) {
-  const { action, reason } = machine.status.sleep;
+  const { action, reason: reason2 } = machine.status.sleep;
   const when2 = `after about ${duration(earlyReclaimSeconds)} idle (early) or at most ${machine.sleep_after_seconds} s without a connection`;
   if (action !== "release") return `${when2}; it then ${action}s`;
-  return `${when2}; the disk resets at every sleep${reason === "suspend_unavailable" ? " until suspend ships" : ""}`;
+  return `${when2}; the disk resets at every sleep${reason2 === "suspend_unavailable" ? " until suspend ships" : ""}`;
 }
 function activationFields(machine) {
   const { activation } = machine;
@@ -5793,9 +6158,9 @@ async function waitForCreate(deps, key, machine, name, firstWait, timeout, json)
   }
   print(deps, json, settled, machineFields(settled, billing));
   if (settled.state === "failed") {
-    const { reason, hint } = creationFailureText(settled, billing);
+    const { reason: reason2, hint } = creationFailureText(settled, billing);
     throw new Error(
-      `Machine ${settled.name} failed to be created${reason}; delete it with \`tonbo machine delete ${settled.name}\` and create it again.${hint}`
+      `Machine ${settled.name} failed to be created${reason2}; delete it with \`tonbo machine delete ${settled.name}\` and create it again.${hint}`
     );
   }
   throw new Error(`Machine ${settled.name} is ${settled.state}; it was not created.`);
@@ -5837,7 +6202,7 @@ async function machineCreateCommand(deps, name, command, options = {}) {
           ...database ? { database: database.name } : {},
           ...options.database === false ? { database: null } : {}
         },
-        options.idempotencyKey ?? randomUUID6()
+        options.idempotencyKey ?? randomUUID7()
       );
     } catch (error) {
       if (error instanceof HttpError && error.code === "name_taken")
@@ -5849,9 +6214,9 @@ async function machineCreateCommand(deps, name, command, options = {}) {
     if (machine.state === "failed") {
       const billing = await billingUrl(deps);
       print(deps, options.json, machine, machineFields(machine, billing));
-      const { reason, hint } = creationFailureText(machine, billing);
+      const { reason: reason2, hint } = creationFailureText(machine, billing);
       throw new Error(
-        `Machine ${machine.name} failed to be created${reason}; delete it with \`tonbo machine delete ${machine.name}\` and create it again.${hint}`
+        `Machine ${machine.name} failed to be created${reason2}; delete it with \`tonbo machine delete ${machine.name}\` and create it again.${hint}`
       );
     }
     if (options.wait && machine.state === "creating")
@@ -5895,9 +6260,9 @@ async function lastActivationEnd(deps, key, name) {
     const page = await deps.api.listMachineActivations(key, name, { limit: 2 });
     return page.data.find((entry) => entry.end !== null)?.end ?? null;
   } catch (error) {
-    if (!(error instanceof HttpError)) throw error;
+    if (!(error instanceof HttpError || error instanceof AccessTokenError)) throw error;
     deps.notice(
-      `Could not read how its last activation ended (${error.status}); \`tonbo machine activations ${name}\` lists them.`
+      `Could not read how its last activation ended (${error.status ?? "no answer"}); \`tonbo machine activations ${name}\` lists them.`
     );
     return null;
   }
@@ -6226,7 +6591,7 @@ var TOPICS = [
     title: "The login, accounts and keys",
     text: [
       "Log in once per computer: `tonbo login` signs this computer in as you, and every account you belong to is reachable with `--account`, with your role in each. Joining an organization needs no new login, and leaving one ends this computer's access to it at once. A command acts in one account: `--account`, else `TONBO_ACCOUNT`, else the default `tonbo account use` set, else your personal account. For each request the CLI exchanges the login for a short-lived token of that account; what a command may do is what your role there allows, and the CLI never decides it.",
-      "`TONBO_API_KEY`, when it is set, is used instead: an API key reaches only its own account and is sent as the Bearer credential, as narrowed by the key. Agents and CI should use an Agent key or an API key of one account, never your login, which reaches every account you belong to.",
+      "`TONBO_API_KEY`, when it is set, is used instead: an API key reaches only its own account, as narrowed by the key. A personal key is sent as the Bearer credential. An Agent key, which the API never accepts directly, is exchanged at `POST https://tonbo.dev/api/iam/token` for a token of at most 10 minutes, kept in memory and exchanged again shortly before it expires; neither the key nor the token is ever printed. Agents and CI should use an Agent key or an API key of one account, never your login, which reaches every account you belong to.",
       "The login is saved at `${XDG_CONFIG_HOME:-$HOME/.config}/tonbo/login.json`, which `yield` shares: either CLI's `login` signs both in, and either `logout` signs both out. It works only on the computer that logged in, ends after 30 days unused or 180 days at most, and is listed and revoked on the console's Sign-in sessions page. The CLI replaces the file atomically with owner-only permissions and refuses a symlink or a file other users can read."
     ]
   },
@@ -6272,7 +6637,7 @@ var COMMAND_HELP = {
   },
   "tonbo logout": {
     about: [
-      "Ends this computer's login for every account and removes the file, which signs `yield` out too. A login an earlier release saved (one key per account in `credentials.json`) has each key revoked as well; one already revoked or expired is skipped. If a revocation fails, the files are still removed, and the CLI says what it could not revoke and exits 1, so you can revoke it on the console's Sign-in sessions page or under API keys. `TONBO_API_KEY` is never touched."
+      "Ends this computer's login for every account and removes the file, which signs `yield` out too. Before anything is revoked, Yield's capture on this computer stops until the next login of either CLI, and nothing written meanwhile is ever recorded; when it cannot write Yield's folder to stop it, nothing is logged out. A login an earlier release saved (one key per account in `credentials.json`) has each key revoked as well; one already revoked or expired is skipped. If a revocation fails, the files are still removed, and the CLI says what it could not revoke and exits 1, so you can revoke it on the console's Sign-in sessions page or under API keys. `TONBO_API_KEY` is never touched."
     ],
     examples: ["tonbo logout"]
   },
@@ -6889,19 +7254,19 @@ function optionDescription(option) {
 function applyHelp(program) {
   const named = /* @__PURE__ */ new Set();
   const walk = (command, words) => {
-    const path4 = words.join(" ");
+    const path5 = words.join(" ");
     command.configureHelp({ ...command.configureHelp(), optionDescription });
-    const help = COMMAND_HELP[path4];
+    const help = COMMAND_HELP[path5];
     if (help) {
-      named.add(path4);
+      named.add(path5);
       for (const [name, text] of Object.entries(help.arguments ?? {})) {
         const argument = command.registeredArguments.find((entry) => entry.name() === name);
-        if (!argument) throw new Error(`${path4} has no argument ${name}`);
+        if (!argument) throw new Error(`${path5} has no argument ${name}`);
         argument.description = text;
       }
       for (const [flag, text] of Object.entries(help.defaults ?? {})) {
         const option = command.options.find((entry) => entry.long === flag);
-        if (!option) throw new Error(`${path4} has no option ${flag}`);
+        if (!option) throw new Error(`${path5} has no option ${flag}`);
         option.defaultValueDescription = text;
       }
       command.addHelpText("after", commandHelpText(help));
@@ -6909,15 +7274,15 @@ function applyHelp(program) {
     for (const child of command.commands) walk(child, [...words, child.name()]);
   };
   walk(program, [program.name()]);
-  for (const path4 of Object.keys(COMMAND_HELP))
-    if (!named.has(path4)) throw new Error(`The help of ${path4} names no command`);
+  for (const path5 of Object.keys(COMMAND_HELP))
+    if (!named.has(path5)) throw new Error(`The help of ${path5} names no command`);
   program.addHelpText("after", programHelpText());
   return program;
 }
 
 // src/machine-cell.ts
-import { readFile as readFile3, writeFile } from "node:fs/promises";
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { readFile as readFile4, writeFile } from "node:fs/promises";
+import { randomUUID as randomUUID8 } from "node:crypto";
 var EXEC_EXIT_CODES = {
   timeout: 124,
   output_limit: 125,
@@ -7102,7 +7467,7 @@ async function machineProcessStartCommand(deps, name, command, options = {}) {
       params: { name },
       headers: {
         "content-type": "application/json",
-        "idempotency-key": options.idempotencyKey ?? randomUUID7()
+        "idempotency-key": options.idempotencyKey ?? randomUUID8()
       },
       body: JSON.stringify(body)
     });
@@ -7255,13 +7620,13 @@ async function machineProcessSummary(cell, key, region, name) {
     return null;
   }
 }
-async function machineFileReadCommand(deps, name, path4, options = {}) {
+async function machineFileReadCommand(deps, name, path5, options = {}) {
   try {
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
     const response = await cellApi(deps).fetch("readMachineFile", key, region, {
       params: { name },
-      query: { path: path4 },
+      query: { path: path5 },
       headers: { range: options.range, "tonbo-expect-activation": options.expectActivation }
     });
     const bytes2 = new Uint8Array(await response.arrayBuffer());
@@ -7271,21 +7636,21 @@ async function machineFileReadCommand(deps, name, path4, options = {}) {
     throw explainMachineError(error);
   }
 }
-async function machineFileWriteCommand(deps, name, path4, options = {}) {
+async function machineFileWriteCommand(deps, name, path5, options = {}) {
   try {
-    const bytes2 = options.from ? new Uint8Array(await readFile3(options.from)) : await readAllStdin(deps);
+    const bytes2 = options.from ? new Uint8Array(await readFile4(options.from)) : await readAllStdin(deps);
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
     const written = await cellApi(deps).json("writeMachineFile", key, region, {
       params: { name },
-      query: { path: path4 },
+      query: { path: path5 },
       headers: {
         "content-type": "application/octet-stream",
         "if-match": options.ifMatch,
         "if-none-match": options.create ? "*" : void 0,
         "tonbo-file-mode": options.mode,
         "tonbo-expect-activation": options.expectActivation,
-        "idempotency-key": randomUUID7()
+        "idempotency-key": randomUUID8()
       },
       body: new Uint8Array(bytes2)
     });
@@ -7300,28 +7665,28 @@ async function machineFileWriteCommand(deps, name, path4, options = {}) {
     throw explainMachineError(error);
   }
 }
-async function machineFileStatCommand(deps, name, path4, options = {}) {
+async function machineFileStatCommand(deps, name, path5, options = {}) {
   try {
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
-    const stat = await cellApi(deps).json(
+    const stat2 = await cellApi(deps).json(
       "statMachineFile",
       key,
       region,
       {
         params: { name },
-        query: { path: path4 },
+        query: { path: path5 },
         headers: { "tonbo-expect-activation": options.expectActivation }
       }
     );
-    noticeWake(deps, stat.machine, name);
+    noticeWake(deps, stat2.machine, name);
     print(
       deps,
       options.json,
-      stat,
+      stat2,
       fields(
         ["path", "type", "size", "mode", "uid", "gid", "mtime", "etag", "target", "durability"].map(
-          (field) => [field, cellText(stat[field])]
+          (field) => [field, cellText(stat2[field])]
         )
       )
     );
@@ -7329,13 +7694,13 @@ async function machineFileStatCommand(deps, name, path4, options = {}) {
     throw explainMachineError(error);
   }
 }
-async function machineFileListCommand(deps, name, path4, options = {}) {
+async function machineFileListCommand(deps, name, path5, options = {}) {
   try {
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
     const listing = await cellApi(deps).json("listMachineFiles", key, region, {
       params: { name },
-      query: { path: path4 },
+      query: { path: path5 },
       headers: { "tonbo-expect-activation": options.expectActivation }
     });
     noticeWake(deps, listing.machine, name);
@@ -7359,19 +7724,19 @@ async function machineFileListCommand(deps, name, path4, options = {}) {
     throw explainMachineError(error);
   }
 }
-async function machineFileDeleteCommand(deps, name, path4, options = {}) {
+async function machineFileDeleteCommand(deps, name, path5, options = {}) {
   try {
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
     await cellApi(deps).fetch("deleteMachineFile", key, region, {
       params: { name },
-      query: { path: path4, recursive: options.recursive ? "true" : void 0 },
+      query: { path: path5, recursive: options.recursive ? "true" : void 0 },
       headers: {
         "tonbo-expect-activation": options.expectActivation,
-        "idempotency-key": randomUUID7()
+        "idempotency-key": randomUUID8()
       }
     });
-    print(deps, options.json, { path: path4 }, `Deleted ${path4}.`);
+    print(deps, options.json, { path: path5 }, `Deleted ${path5}.`);
   } catch (error) {
     throw explainMachineError(error);
   }
@@ -7474,8 +7839,8 @@ async function terminalAsk(question) {
 
 // src/ssh.ts
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { chmod as chmod2, mkdir as mkdir3, readFile as readFile4, readdir, rename as rename3, writeFile as writeFile2 } from "node:fs/promises";
+import { existsSync as existsSync2 } from "node:fs";
+import { chmod as chmod2, mkdir as mkdir4, readFile as readFile5, readdir, rename as rename4, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 function sshDirectory(env = process.env) {
@@ -7499,9 +7864,9 @@ function cellOrigin2(host) {
 }
 async function ensureKey(directory) {
   const key = join(directory, "id_ed25519");
-  await mkdir3(directory, { recursive: true, mode: 448 });
+  await mkdir4(directory, { recursive: true, mode: 448 });
   await chmod2(directory, 448);
-  if (!existsSync(key)) {
+  if (!existsSync2(key)) {
     const made = spawnSync(
       "ssh-keygen",
       ["-q", "-t", "ed25519", "-N", "", "-C", "tonbo", "-f", key],
@@ -7517,10 +7882,10 @@ async function ensureKey(directory) {
   }
   return key;
 }
-async function writeAtomic(path4, data) {
-  const temporary = `${path4}.${process.pid}.tmp`;
+async function writeAtomic(path5, data) {
+  const temporary = `${path5}.${process.pid}.tmp`;
   await writeFile2(temporary, data, { mode: 384 });
-  await rename3(temporary, path4);
+  await rename4(temporary, path5);
 }
 function certificatePath(directory, user) {
   return join(directory, `${user}-cert.pub`);
@@ -7533,7 +7898,7 @@ function hostCAPath(directory, host) {
 }
 async function trustHostCA(directory, host, lines) {
   const cells = join(directory, "host-ca");
-  await mkdir3(cells, { recursive: true, mode: 448 });
+  await mkdir4(cells, { recursive: true, mode: 448 });
   await writeAtomic(hostCAPath(directory, host), `${lines.join("\n")}
 `);
   const trusted = /* @__PURE__ */ new Set();
@@ -7541,7 +7906,7 @@ async function trustHostCA(directory, host, lines) {
     if (name.endsWith(".tmp")) {
       continue;
     }
-    for (const line of (await readFile4(join(cells, name), "utf8")).split("\n")) {
+    for (const line of (await readFile5(join(cells, name), "utf8")).split("\n")) {
       if (line.trim() !== "") {
         trusted.add(line.trim());
       }
@@ -7553,7 +7918,7 @@ async function trustHostCA(directory, host, lines) {
 async function heldUntil(directory, user) {
   try {
     const sidecar = JSON.parse(
-      await readFile4(`${certificatePath(directory, user)}.json`, "utf8")
+      await readFile5(`${certificatePath(directory, user)}.json`, "utf8")
     );
     return sidecar.valid_before ? Date.parse(sidecar.valid_before) : 0;
   } catch {
@@ -7572,11 +7937,9 @@ async function cellRequest(bearer, method, url, body) {
       },
       body: body === void 0 ? void 0 : JSON.stringify(body)
     });
-    if (response.status === 401 && attempt === 0 && isAccountBearer(bearer)) {
-      bearer.invalidate(MANAGEMENT_AUDIENCE);
-      continue;
-    }
     const answer = await response.json().catch(() => null);
+    if (response.status === 401 && attempt === 0 && retriesAfterRefusal(bearer, MANAGEMENT_AUDIENCE, answer?.code ?? null))
+      continue;
     if (!response.ok) {
       throw new Error(
         `${url} answered ${response.status}${answer?.code ? ` ${answer.code}` : ""}${answer?.detail ? `: ${answer.detail}` : ""}`
@@ -7589,11 +7952,11 @@ async function refreshCertificate(bearer, destination, now = Date.now, directory
   const key = await ensureKey(directory);
   const certificate = certificatePath(directory, destination.user);
   const knownHosts = join(directory, "known_hosts");
-  if (await heldUntil(directory, destination.user) - now() > RENEW_BEFORE_MS && existsSync(hostCAPath(directory, destination.host)) && existsSync(knownHosts)) {
+  if (await heldUntil(directory, destination.user) - now() > RENEW_BEFORE_MS && existsSync2(hostCAPath(directory, destination.host)) && existsSync2(knownHosts)) {
     return { key, certificate, knownHosts };
   }
   const origin = cellOrigin2(destination.host);
-  const publicKey = (await readFile4(`${key}.pub`, "utf8")).trim();
+  const publicKey = (await readFile5(`${key}.pub`, "utf8")).trim();
   const issued = await cellRequest(bearer, "POST", `${origin}/v1/ssh/certificates`, {
     public_key: publicKey,
     ttl_seconds: REQUESTED_TTL_SECONDS
@@ -7685,7 +8048,7 @@ async function sshHostCaCommand(deps, options) {
   print(deps, options.json, data, data.known_hosts.join("\n"));
 }
 async function sshCertificateIssueCommand(deps, options) {
-  const publicKey = (await readFile4(options.publicKey, "utf8")).trim();
+  const publicKey = (await readFile5(options.publicKey, "utf8")).trim();
   const key = await deps.auth.apiKey();
   const data = await (deps.cell ?? new CellApi(fetch)).json(
     "issueSshCertificate",
@@ -7762,7 +8125,7 @@ var repeated = (value, previous = []) => [...previous, value];
 var budgetOption = (whom) => new Option(
   "--budget <budget>",
   `put ${whom} under a monthly budget: an amount in dollars such as 50 creates one, a budget's name adds to it`
-).hideHelp();
+);
 var roleOption = (description) => new Option("--role <role>", description).choices(accountRoles);
 function machineSpecOptions(command, update) {
   const later = update ? "; applies at the next boot" : "";
@@ -7828,7 +8191,9 @@ function createProgram(makeDependencies = createDependencies) {
     const account2 = program.opts().account;
     await loginCommand(dependencies(), { ...options, account: account2 });
   });
-  program.command("logout").description("end this computer's CLI login and remove the saved login").action(async () => logoutCommand(dependencies()));
+  program.command("logout").description(
+    "end this computer's CLI login and remove the saved login; Yield's capture here stops until the next login"
+  ).action(async () => logoutCommand(dependencies()));
   const account = program.command("account").description("the accounts you belong to and the one commands act in");
   operationOptions(
     account.command("show").description("show the account, your role in it and its limits"),
@@ -7919,7 +8284,7 @@ function createProgram(makeDependencies = createDependencies) {
   ).action(
     async (keyId, options) => apiKeyRevokeCommand(dependencies(), keyId, options)
   );
-  const budget = program.command("budget", { hidden: true }).description("the account's monthly spend budgets");
+  const budget = program.command("budget").description("the account's monthly spend budgets");
   operationOptions(
     budget.command("list").description("list the budgets, the account budget first"),
     "listBudgets"
@@ -8225,31 +8590,31 @@ function createProgram(makeDependencies = createDependencies) {
     file.command("read <name> <path>").description("print a file of a Machine, waking it first").option("--output <file>", "write the bytes to this local file instead of stdout").option("--range <range>", "one byte range, such as bytes=0-1023").option("--expect-activation <activation>", "read only in this activation"),
     "readMachineFile"
   ).action(
-    async (name, path4, options) => machineFileReadCommand(dependencies(), name, path4, options)
+    async (name, path5, options) => machineFileReadCommand(dependencies(), name, path5, options)
   );
   operationOptions(
     file.command("write <name> <path>").description("replace a file of a Machine with stdin or --from, atomically").option("--from <file>", "the local file to send instead of stdin").option("--mode <mode>", "the file's mode, four octal digits such as 0755").option("--if-match <etag>", "replace only the version with this ETag").option("--create", "only create the file; refuse when it exists").option("--expect-activation <activation>", "write only in this activation"),
     "writeMachineFile"
   ).action(
-    async (name, path4, options) => machineFileWriteCommand(dependencies(), name, path4, options)
+    async (name, path5, options) => machineFileWriteCommand(dependencies(), name, path5, options)
   );
   operationOptions(
     file.command("stat <name> <path>").description("show a path's type, size, mode, owner and ETag").option("--expect-activation <activation>", "stat only in this activation"),
     "statMachineFile"
   ).action(
-    async (name, path4, options) => machineFileStatCommand(dependencies(), name, path4, options)
+    async (name, path5, options) => machineFileStatCommand(dependencies(), name, path5, options)
   );
   operationOptions(
     file.command("list <name> <path>").description("list a directory of a Machine").option("--expect-activation <activation>", "list only in this activation"),
     "listMachineFiles"
   ).action(
-    async (name, path4, options) => machineFileListCommand(dependencies(), name, path4, options)
+    async (name, path5, options) => machineFileListCommand(dependencies(), name, path5, options)
   );
   operationOptions(
     file.command("delete <name> <path>").description("delete a file, a symbolic link or an empty directory of a Machine").option("--recursive", "delete a directory and everything in it").option("--expect-activation <activation>", "delete only in this activation"),
     "deleteMachineFile"
   ).action(
-    async (name, path4, options) => machineFileDeleteCommand(dependencies(), name, path4, options)
+    async (name, path5, options) => machineFileDeleteCommand(dependencies(), name, path5, options)
   );
   const hold = machine.command("hold").description("keep a Machine awake for work that has no open connection");
   operationOptions(