@vibelord/lanes 1.0.3 → 1.1.0

package/payload/lanes/bin/lanes

@@ -7,18 +7,63 @@
   lanes status                   one-line-per-workspace health summary
   lanes attach <device> [--client ID] [--mobile] [--viewports N]
                [--ascii] [--glyphs unicode|ascii|emoji] [--theme dark|light|auto] [--color truecolor|16|none]
+               [--default-device NAME] [--client-version V]
                                  attach this terminal to the device's view session (creates it if needed); the look
-                                 flags are remembered in devices/<device>.json and reach its running sidebars in a tick
+                                 flags are remembered in devices/<device>.json and reach its running sidebars in a tick.
+                                 lanes-launch passes its machine's device and its version: one dim line says when that
+                                 client is older than this server (`lanes-launch update`)
   lanes prepare <device> [--mobile|--desktop]
                                  create a device view without attaching a terminal (eg. Safari on a phone); an explicit
                                  layout that differs from the running view is refused, never rebuilt
-  lanes web <device> [--desktop|--mobile] [--viewports N] [--token | --print-only]
+  lanes web <device> [--desktop|--mobile] [--viewports N] [--token | --print-only] [--default-device NAME] [--no-qr]
                                  browser view in one step: prepare (desktop by default), enable the loopback web
-                                 services (install/enable-web.sh), print the private https://<tailnet name>:8443/<device>
-                                 URL; --token then shows a login token in YOUR terminal only
+                                 services (install/enable-web.sh), make Tailscale Serve forward https:8443 to them (added
+                                 when missing; exit 64 with the operator's `tailscale set --operator` step when refused),
+                                 print the private https://<tailnet name>:8443/<device> URL; --token then draws a QR code
+                                 of that URL (never of the token; qrencode when installed, else libexec/qr.py; --no-qr:
+                                 none), shows a login token in YOUR terminal only and records its name for the device;
+                                 --print-only changes nothing (it reads the Serve mapping and says what a real run would
+                                 do). A client runs it as `lanes-launch web phone|laptop|<device>` (--default-device:
+                                 that machine's device)
+  lanes token list | revoke <device> | revoke --name NAME | revoke-all [--yes]
+                                 web login tokens with the device each was minted for (zellij 0.45.1 cannot name them:
+                                 lanes records the name `lanes web --token` got). revoke signs that device's token out;
+                                 it refuses when zellij could then create no new token (0.45.1 names them token_<n+1>)
+                                 and names revoke-all, which signs every browser and phone out (nothing without --yes).
+                                 Tokens live under XDG_DATA_HOME=~/.local/share, the root lanes-web.service pins; every
+                                 token verb (and web --token, exit 64) refuses while the running server measurably reads
+                                 another token database (`lanes doctor` shows which)
   lanes open <lane-id>           attach this terminal straight to one lane (no multiplexer in between)
   lanes register <lane-id> [ws]  add an unregistered session to a workspace without restarting it
                                  use lanes ls --unregistered [--json] to find its ID
+  lanes workspaces               print the board ids (what the client installer reads)
+  lanes workspaces add <id> --container <name> --repo <path> [--title T] [--session S] [--write]
+                                 add a board to the site catalog (catalog.json + a new workspaces.<id>.json whose one
+                                 repository is <path>/.vscode/terminals.json in that container; <path> under /home/coder).
+                                 Dry-run by default (prints the diff); --write applies, keeping catalog.json.bak-<UTC>Z on
+                                 the first write. An id already in the catalog is verified, never rewritten: agreement is
+                                 a no-op, a difference is reported and exits 1. A repository belongs to one board: one
+                                 another board already declares (same container and folder) is refused, as cursor-sync
+                                 would rewrite its terminals.json for both. Then: install-container, sync, doctor
+  lanes onboard <login> --container <name> [--workspace <id> --repo <path> [--title T]]
+                [--write] [--no-mcp]
+                                 provision a user's container and agents in one verb. Dry-run by default (every diff and
+                                 command it would run). It first checks the container (read-only docker inspect: an
+                                 unknown one stops the run before anything is written); --write then applies, in order:
+                                 the board (`workspaces add`, when --workspace is given), install-container,
+                                 `hooks install --write` for claude and codex, `throttle setup --install-clients`
+                                 inside the container as uid 1000 when it has a CONFIGURED throttle (else the manual
+                                 step is printed: a first setup needs a person on a terminal; the laptop-pool step too
+                                 when site.conf names LANES_THROTTLE_REMOTE_URL), sync,
+                                 `cursor-sync <id> --canonicalize --write` when <path>/.vscode/terminals.json
+                                 exists (else it points at terminals.example.json), sync again when that rewrote the file,
+                                 and the doctor (reported, never fatal). When this account's uid or the home volume's
+                                 owner is not the container uid (1000), the check fails and the run stops there,
+                                 writing nothing: the agent could not read files this account writes. Prints a
+                                 key: value table (a stopped run names every step it did not reach: not-run) and keeps
+                                 ~/.local/state/lanes/onboard/<login>-<UTC>.json. Re-running changes nothing that is
+                                 done. --no-mcp leaves out lane-mcp (plan W6, not shipped yet).
+                                 Exit 1 only when a step failed; an unknown container or a board that disagrees stops it
   lanes layout <device> [--mobile]   print the generated zellij layout
   lanes rebuild <device>         recreate a device's view session (agents are never touched)
   lanes upgrade-session [device…]  sync catalog tabs and labels to live sessions without a rebuild
@@ -42,12 +87,16 @@
                                  with git plumbing only (no working tree or index is touched). Dry-run without --push.
   lanes hello [device]           what the client installer calls to prove the path, the key and the server version
   lanes client-config            site facts for clients (KEY=VALUE from ~/.config/lanes/site.conf on the server)
-  lanes install-container <name> install the `lane` contract (lane, lane-run, lane-signal, hooks/) + pinned zmx into a
-                                 container's home volume (additive; installs no agent hook)
+  lanes install-container <name> [--no-mcp]
+                                 install the `lane` contract (lane, lane-run, lane-signal, hooks/) + pinned zmx into a
+                                 container's home volume (additive; installs no agent hook). --no-mcp is accepted for
+                                 lane-mcp (plan W6); no MCP server ships yet, so today it changes nothing
   lanes hooks install --agent claude|codex (--container <name> | --home <dir>) [--dry-run | --write]
                                  merge the lane-signal hooks into that home's ~/.claude/settings.json or ~/.codex/hooks.json
                                  (+ a top-level Codex notify when none is set); prints the diff, writes only with --write
-                                 (backup kept). Opt-in, per container; Codex still asks you to trust new hooks
+                                 (backup kept). Opt-in, per container; Codex still asks you to trust new hooks.
+                                 --write into a --container whose home the agent could not read from this account (uid
+                                 not 1000, or a home volume not owned by 1000) is refused with the reason
   lanes invariant save|check     snapshot / verify every live pane's pid and window size
   lanes gc                       truncate oversized zmx logs, drop stale dynamic resolve files
   lanes sockets [check|repair]   lanes that run but cannot be reached: tmux servers whose socket file was deleted
@@ -92,13 +141,59 @@
                                  the lanes per create-recipe class (idempotent / attach-only / null / external /
                                  retired-path), lane identity, numeric session names, crowded `default` sockets and
                                  orphan tmux socket files (report only; in a container `lane gc --sockets` removes them),
-                                 and any record left in the retired legacy-sessions/ directory
+                                 any record left in the retired legacy-sessions/ directory, and the browser/phone half:
+                                 lanes-web / lanes-mobile units (⚠ not enabled, ✗ enabled but not running), the login-token
+                                 database the running lanes-web reads (✗ when it is not the one `lanes token` uses) and the
+                                 Tailscale Serve https:8443 mapping (⚠ not checked on a host without a Tailscale name)
   lanes device list | forget <name>
-                                 the devices `lanes ensure` recreates view sessions for; forget removes devices/<name>.json
-                                 (a running view session is left alone and is not brought back once it ends)
+                                 the devices `lanes ensure` recreates view sessions for, each with its owner's login
+                                 (from members/<device>.json, or the machine's for a window like mac-2, whenever that
+                                 record exists, so it agrees with `lanes keys list`; after a revoke the last one is
+                                 kept; blank for none); forget removes devices/<name>.json (a running view session is
+                                 left alone and is not brought back once it ends)
+  lanes keys list | add <device> <pubkey-file|-> | revoke <device> | adopt [--dry-run]
+             | owner <device> <login> [--name NAME] [--email ADDR]
+                                 who may log in, as a projection of ~/.local/state/lanes/members/<device>.json: one
+                                 `restrict,pty ssh-ed25519 <key> lanes:<device>` line per member between the
+                                 `# lanes-managed BEGIN` / `END` markers of ~/.ssh/authorized_keys (libexec/keys.py; every
+                                 byte outside the markers is kept, ed25519 keys only). add authorizes one device's .pub
+                                 (`-` reads stdin); revoke takes the line out of the block before it removes the member
+                                 file (a failed revoke exits 1 and keeps it, so revoke again finishes), also removes a
+                                 `lanes:<device>` line left in the block without one, and is a no-op for a device with
+                                 neither (exit 1 only when a line outside the block still lets it in); adopt moves
+                                 hand-added `lanes:<device>` lines into members/
+                                 and the block (first adopt keeps authorized_keys.bak-<UTC>) and re-renders the block;
+                                 owner names the person behind a member (add/adopt record none) — the tailnet login
+                                 `/enrol/pending` must see to let that person approve enrolment requests
+  lanes invite <name> [--email ADDR] [--expires 7d] [--workspaces a,b] [--tailscale-link URL] [--md]
+  lanes invite list | revoke <id>
+                                 mint a one-time code LN-<id>-<secret> a new machine redeems at lanes-enrold (libexec/
+                                 enrol.py; invites/<id>.json holds its hash only, valid 7 d by default, 1h..30d): the
+                                 welcome kit with the code is printed ONLY on a terminal (else exit 2, nothing minted),
+                                 --md as Markdown. --email records the invitee (on an invite-only server the member's
+                                 owner login) and, with ~/.config/lanes/resend.key, mails the kit (to anyone but the
+                                 Resend account itself only with a from=Name <addr> line on a Resend-verified domain in
+                                 that file); step 1's tailnet link is --tailscale-link, else minted with
+                                 ~/.config/lanes/tailscale-api.key, else "ask your admin". list shows
+                                 live/redeemed/revoked/expired; revoke refuses the code from then on
+  lanes enrol list [--all] | approve <id> [--as <device>] | deny <id> [--as <device>]
+                                 the enrolment requests machines filed (POST /enrol/request); approve writes the member
+                                 and its key line exactly as /enrol/pending does, recording cli[:<device>]@<ssh client
+                                 address> as the approver (--as names your own member device)
+  lanes enrol mode [request|invite|auto]
+                                 whether lanes-enrold takes access requests, pinned across restarts and reinstalls
+                                 (enrol-mode in the state directory): request after the Serve header check passes
+                                 (RUNBOOK "Operator verification"), invite to refuse every request, auto (the default)
+                                 to let the first request through Tailscale Serve after each start decide. A unit
+                                 drop-in's LANES_ENROL_REQUEST_MODE wins over it. No word: the pinned mode, said
+  lanes offboard <device> --yes  in your own terminal: revoke its key, forget the device, sign its browsers and phones
+                                 out (the web login tokens `lanes web --token` recorded for it, its windows and the
+                                 views `lanes-launch web` opened for it), end its view session (no lane is touched).
+                                 Without --yes or off a terminal: the plan, exit 2
 """
 import json
 import os
+import pwd
 import re
 import shutil
 import sys
@@ -393,6 +488,9 @@ def create_session(device, mobile, viewports=1):
     old = old if isinstance(old, dict) else {}
     if old.get('base'):   # learnt at attach (see base_device); `ensure` and `rebuild` must not forget it
         meta['base'] = old['base']
+    owner = device_owner(device, old)
+    if owner:             # who the device belongs to (W8 A2): the member record's, else the one recorded (device_owner)
+        meta['owner'] = owner
     # The look `lanes attach --ascii|--glyphs|--theme|--color` recorded (record_look) is the operator's choice, not
     # session state: a recreation (ensure after a reboot, rebuild) keeps every valid one, or every sidebar of the
     # device would flip back to the environment defaults within one tick of this rewrite.
@@ -414,12 +512,52 @@ def create_session(device, mobile, viewports=1):
                            + ('no answer in 60 s' if rc is None else err.strip() or out.strip() or f'exit {rc}'))
 
 
+def device_owner(device, meta):
+    """The owner devices/<device>.json records (W8 A2, members.owner_for): the owner of members/<device>.json, else of
+    the machine the view belongs to (members/<base>.json, once `lanes attach` has learnt the base: `mac-2` is mac's
+    window) — whenever such a record exists it decides, also when it names nobody, so a device handed to another
+    person follows its new record (DEF-1702). While neither has a record (revoked, never enrolled) the valid owner
+    `meta` already holds is kept across every rewrite, like `base`; `lanes device forget` clears it with the file.
+    Never raises: `lanes ensure` recreates views through create_session every minute, and a broken member file must
+    not stop that."""
+    try:
+        members = libexec_module('members')
+    except L.LanesError:
+        return None
+    return members.owner_for((device, meta.get('base')), meta.get('owner'))
+
+
 def base_device(device, default):
     """The machine a view belongs to: `mac-2` / `mac-w2`, opened by the client whose default device is `mac`, share
     mac's upload helper (one helper service per machine); every other device is its own base."""
     return default if default and device.startswith(default + '-') else device
 
 
+def record_base(device, args):
+    """Record base_device in devices/<device>.json, as `lanes attach` and `lanes web` learn it from the client's
+    `--default-device`. A client that names no default device teaches nothing: what is recorded stays. Readers treat a
+    missing "base" as the device itself. Only an existing file is updated — `ensure` builds a session for every
+    devices/*.json, so this never creates one. (`default` is unvalidated client text, but only ever stored when it is
+    a prefix of the validated device name.) The owner (W8 A2) is brought in line in the same write: filled in for a
+    view created before its member existed, replaced when the member record now names another person, dropped when it
+    names nobody (device_owner)."""
+    default = args[args.index('--default-device') + 1] if '--default-device' in args[:-1] else None
+    meta_file = L.STATE / 'devices' / f'{device}.json'
+    meta = L.read_json(meta_file)
+    meta = meta if isinstance(meta, dict) else {}
+    updated = dict(meta)
+    if default and meta and meta.get('base') != base_device(device, default):
+        updated['base'] = base_device(device, default)
+    if meta:
+        owner = device_owner(device, updated)
+        if owner:
+            updated['owner'] = owner
+        else:
+            updated.pop('owner', None)
+    if updated != meta:
+        L.atomic_write(meta_file, json.dumps(updated) + '\n')
+
+
 def viewports_arg(args, default=1):
     if '--viewports' in args:
         try:
@@ -503,13 +641,8 @@ def cmd_attach(args):
         missing = False
     if missing:
         create_session(device, '--mobile' in args, viewports_arg(args))
-    # Record the base, also for sessions that existed before it was known. A client that names no default device
-    # teaches nothing: what is recorded stays. Readers treat a missing "base" as the device itself. (`default` is
-    # unvalidated client text, but only ever stored when it is a prefix of the validated device name.)
-    meta_file = L.STATE / 'devices' / f'{device}.json'
-    meta = L.read_json(meta_file) or {}
-    if default and meta and meta.get('base') != base_device(device, default):
-        L.atomic_write(meta_file, json.dumps(dict(meta, base=base_device(device, default))) + '\n')
+    # Record the base and bring the owner (W8 A2) in line, also for sessions that existed before either was known.
+    record_base(device, args)
     record_look(device, args)
     # Views idle until a real client (with a real size) has attached once. We exec into the zellij
     # client below, so a detached helper raises the flag shortly after the client has sized the session.
@@ -540,6 +673,9 @@ def cmd_attach(args):
         time.sleep(1.2)
         zellij(['-s', device, 'action', 'go-to-tab-name', tab], 15)
         os._exit(0)
+    notice = client_notice(args)
+    if notice:   # before zellij takes the screen: the line is there again once the client detaches
+        print(f'\033[2m{notice}\033[0m' if sys.stderr.isatty() else notice, file=sys.stderr, flush=True)
     env = clean_env({'TERM': os.environ.get('TERM', 'xterm-256color'),
                      'COLORTERM': os.environ.get('COLORTERM', 'truecolor')})
     if L.run_bounded(['infocmp', env['TERM']], 5)[0] != 0:   # unknown here — or no answer: the safe default
@@ -583,8 +719,16 @@ def hook_env(home):
             handle.write(('' if text.endswith('\n') or not text else '\n') + ENV_HOOK + '\n')
 
 
+INSTALL_CONTAINER_USAGE = 'usage: lanes install-container <name> [--no-mcp]'
+
+
 def cmd_install_container(args):
-    container = args[0]
+    names = [word for word in args if word != '--no-mcp']
+    if len(names) != 1 or names[0].startswith('-'):
+        raise L.LanesError(INSTALL_CONTAINER_USAGE)
+    # --no-mcp leaves out lane-mcp, the in-container MCP server of plan W6. This checkout ships none, so there is
+    # nothing to leave out yet: the flag is accepted so that `lanes onboard --no-mcp` keeps its meaning when it ships.
+    container = names[0]
     info = L.container_info(container)
     if not info.get('home'):
         raise L.LanesError(f'{container}: home volume not found')
@@ -640,18 +784,30 @@ def is_lane_signal_group(group):
 
 def merge_hooks(existing, ours):
     """`existing` (a settings.json / hooks.json document) with every lane-signal group from an earlier install removed
-    and `ours` appended per event. Every other key, event and group stays exactly where it was."""
+    and `ours` appended per event. Every other key, event and group stays exactly where it was. An event whose
+    lane-signal groups already are ours (key order and group order aside) is left exactly as it is: another writer
+    may have put its own group after or before ours and re-encoded the file — `throttle setup --install-clients`
+    appends its observer group to Claude's SessionEnd, inserts it first in Codex's SessionStart and sorts every key
+    (serde_json) — and moving ours back to the end would rewrite the file, with a backup, on every re-run."""
     merged = dict(existing)
     hooks = existing.get('hooks', {})
     if not isinstance(hooks, dict) or not all(isinstance(groups, list) for groups in hooks.values()):
         raise L.LanesError('the existing file has a "hooks" value that is not {event: [groups]} — fix it by hand first')
-    out = {}
+
+    def same(a, b):
+        return sorted(json.dumps(g, sort_keys=True) for g in a) == sorted(json.dumps(g, sort_keys=True) for g in b)
+    out, installed = {}, set()
     for event, groups in hooks.items():
+        if event in ours['hooks'] and same([g for g in groups if is_lane_signal_group(g)], ours['hooks'][event]):
+            out[event] = groups
+            installed.add(event)
+            continue
         kept = [group for group in groups if not is_lane_signal_group(group)]
         if kept or event in ours['hooks']:
             out[event] = kept
     for event, groups in ours['hooks'].items():
-        out[event] = out.get(event, []) + groups
+        if event not in installed:
+            out[event] = out.get(event, []) + groups
     merged['hooks'] = out
     return merged
 
@@ -695,7 +851,10 @@ def write_with_backup(path, before, after):
 
 def cmd_hooks(args):
     """`lanes hooks install`: merge the lane-signal hook definitions into ONE container home's agent config. Dry run
-    (the printed diff) unless --write; never touches Codex's hook trust (`[hooks.state]` is Codex's own decision)."""
+    (the printed diff) unless --write; never touches Codex's hook trust (`[hooks.state]` is Codex's own decision).
+    A --container target on a uid split (`uid_split`: this account or the home volume's owner is not the container
+    uid) is refused with --write — the agent could not read the 0600 file this account would create — and warned in a
+    dry run (DEF-1727). `--home <dir>` is for trying the merge on a copy, not an agent's home, and is not checked."""
     if not args or args[0] != 'install':
         raise L.LanesError(HOOKS_USAGE)
     opts, rest = {}, list(args[1:])
@@ -720,6 +879,10 @@ def cmd_hooks(args):
         home = Path(opts['--home'])
     if not home.is_dir():
         raise L.LanesError(f'{home}: not a directory')
+    split = uid_split(home) if '--container' in opts else None
+    if split and opts.get('--write'):
+        raise L.LanesError(f"{split}: the agent (uid {L.CONTAINER_UID}) could not read what this account would write "
+                           f"into {home} — nothing written; run it from a host account with uid {L.CONTAINER_UID}")
     target = home / HOOK_TARGETS[agent][1]
     before = target.read_text() if target.exists() else ''
     try:
@@ -740,6 +903,8 @@ def cmd_hooks(args):
             changes.append((config, text, patched))
         print('Codex asks you to review and trust new hooks before it runs them; lanes never writes that trust.')
     if not opts.get('--write'):
+        if split:
+            print(f'⚠ {split}: --write refuses here (run it from a host account with uid {L.CONTAINER_UID})')
         print('dry run: nothing written (add --write to apply)')
         return 0
     for path, old, new in changes:
@@ -835,12 +1000,18 @@ def cmd_prepare(args):
 
 
 WEB_LOOPBACK = 'http://127.0.0.1:8083'   # lanes-mobile.service (web/Caddyfile); Tailscale Serve forwards :8443 here
-WEB_USAGE = 'usage: lanes web <device> [--desktop|--mobile] [--viewports N] [--token | --print-only]'
+WEB_USAGE = ('usage: lanes web <device> [--desktop|--mobile] [--viewports N] [--token | --print-only] '
+             '[--default-device NAME] [--no-qr]')
+SERVE_PORT = '8443'
+SERVE_STATUS = ['tailscale', 'serve', 'status', '--json']
+SERVE_ADD = ['tailscale', 'serve', '--bg', f'--https={SERVE_PORT}', WEB_LOOPBACK]
+SERVE_TARGETS = {WEB_LOOPBACK, 'http://localhost:8083'}   # how `tailscale serve` stores the Lanes frontend target
+WEB_UNITS = ('lanes-web.service', 'lanes-mobile.service')
 
 
 def tailnet_name():
-    """This node's MagicDNS name, read the way install/enable-phone.sh reads it; None when tailscale is absent,
-    silent or has no name. Read-only: Tailscale Serve itself is configured once by enable-phone.sh."""
+    """This node's MagicDNS name, read the way install/enable-phone.sh read it; None when tailscale is absent,
+    silent or has no name. Read-only (ensure_serve owns the Serve mapping)."""
     if not shutil.which('tailscale'):
         return None
     rc, out, _err = L.run_bounded(['tailscale', 'status', '--json'], 10)
@@ -853,24 +1024,190 @@ def tailnet_name():
     return name.rstrip('.') or None
 
 
+def web_qr(url):
+    """The view's URL as a QR code for a phone camera (text to print), or None. Only the URL is ever encoded: the
+    login token does not exist yet (the pinned zellij prints it after the exec) and never passes through lanes.
+    `qrencode -t ANSIUTF8` when it is on PATH and answers; else libexec/qr.py (byte mode, level M, versions 1-6: up
+    to 106 bytes), which frames its half blocks the same way. None when this terminal's encoding cannot show the
+    block characters or neither can encode the URL: the `url:` line is the plain URL either way."""
+    try:
+        '█▀▄'.encode(getattr(sys.stdout, 'encoding', None) or 'utf-8')
+    except (LookupError, UnicodeEncodeError):
+        return None
+    if shutil.which('qrencode'):
+        rc, out, _err = L.run_bounded(['qrencode', '-t', 'ANSIUTF8', '-o', '-', url], 10)
+        if rc == 0 and out.strip():
+            return out
+    try:
+        qr = libexec_module('qr')
+        return qr.render(qr.encode(url).modules)
+    except (ValueError, L.LanesError):   # past version 6, or a broken install: the code is a convenience, never a stop
+        return None
+def serve_state():
+    """(state, detail) of the background Tailscale Serve config for HTTPS 8443, from `tailscale serve status --json`
+    (ipn.ServeConfig: `Web` maps "<name>:<port>" to `Handlers` per path). Read-only.
+      present  `/` on :8443 proxies to the Lanes frontend (127.0.0.1:8083 or localhost:8083)
+      missing  nothing serves `/` on :8443 (`null`, `{}`, other ports only, or only a `Foreground` session that ends
+               with its process)
+      other    `/` on :8443 is something else; detail = its target
+      unknown  status did not answer or was not JSON; detail = why"""
+    rc, out, err = L.run_bounded(SERVE_STATUS, 10)
+    if rc != 0:
+        return 'unknown', ('no answer in 10 s' if rc is None else err.strip() or out.strip() or f'exit {rc}')
+    try:
+        web = (json.loads(out) or {}).get('Web') or {}
+    except (ValueError, AttributeError):
+        return 'unknown', '`tailscale serve status --json` printed no JSON object'
+    others = []
+    for hostport, config in web.items():
+        if hostport.rpartition(':')[2] != SERVE_PORT:
+            continue
+        handler = ((config or {}).get('Handlers') or {}).get('/')
+        if not handler:
+            continue
+        target = handler.get('Proxy') or 'a file or text handler'
+        if target.rstrip('/') in SERVE_TARGETS:
+            return 'present', target
+        others.append(target)
+    return ('other', ', '.join(others)) if others else ('missing', '')
+
+
+class ServeRefused(L.LanesError):
+    """`lanes web` could not make https:8443 reach the Lanes frontend; the message says what the operator does."""
+
+
+def ensure_serve():
+    """Make Tailscale Serve forward HTTPS 8443 to the Lanes frontend -> 'present' | 'added'. A present mapping is
+    left alone (no call); a missing or unreadable one is added with SERVE_ADD; a mapping lanes did not make is never
+    replaced. Raises ServeRefused with the operator's next step."""
+    state, detail = serve_state()
+    if state == 'present':
+        return 'present'
+    if state == 'other':
+        raise ServeRefused(f'Tailscale Serve already maps https:{SERVE_PORT} / to {detail}; lanes does not replace a '
+                           f'mapping it did not make. To give the port to Lanes: tailscale serve --https={SERVE_PORT} '
+                           'off, then run this command again.')
+    rc, out, err = L.run_bounded(SERVE_ADD, 30)
+    if rc != 0:
+        reason = 'no answer in 30 s' if rc is None else f'exit {rc}'
+        said = (err.strip() or out.strip())[-400:]
+        user = pwd.getpwuid(os.getuid()).pw_name
+        raise ServeRefused(f"{' '.join(SERVE_ADD)} failed ({reason})" + (f': {said}' if said else '') + '\n'
+                           'The server admin must allow this account to manage Tailscale Serve:\n'
+                           f'  sudo tailscale set --operator={user}\n'
+                           'Then run this command again. See docs/INSTALL.md for HTTPS setup.')
+    return 'added'
+
+
+def serve_plan():
+    """The `serve:` value `lanes web --print-only` shows: what a real run would find and do. Read-only."""
+    state, detail = serve_state()
+    return {'present': f'present (https:{SERVE_PORT} -> {WEB_LOOPBACK})',
+            'missing': f"missing — a real run adds it: {' '.join(SERVE_ADD)}",
+            'other': f'https:{SERVE_PORT} serves {detail} — a real run refuses to replace it',
+            'unknown': f'unknown ({detail})'}[state]
+
+
+def account_home():
+    """The account's home from its passwd entry: what `%h` names in the user manager's units (lanes-web.service's
+    pinned XDG_DATA_HOME), whatever $HOME this shell carries; $HOME only when the account has no passwd entry."""
+    try:
+        return Path(pwd.getpwuid(os.getuid()).pw_dir)
+    except KeyError:
+        return Path.home()
+
+
+# The ONE root of zellij's login-token database (review of C1): systemd/lanes-web.service pins
+# Environment=XDG_DATA_HOME=%h/.local/share and the token commands run zellij with the same XDG_DATA_HOME, so neither
+# the calling shell's nor the user manager's own XDG_DATA_HOME moves either side (test_web.TokenDatabase pins the two
+# together). It is zellij's own default, so a server whose manager set no XDG_DATA_HOME already agrees.
+WEB_DATA_HOME = '.local/share'
+SERVER_PID = ['systemctl', '--user', 'show', '-p', 'MainPID', 'lanes-web.service']
+
+
+def token_db():
+    """The login-token database `lanes web --token` and `lanes token` use: $XDG_DATA_HOME/zellij/tokens.db (MEASURED
+    2026-10-05 from the pinned 0.45.1: --data-dir does not move it) under the pinned root."""
+    return account_home() / WEB_DATA_HOME / 'zellij/tokens.db'
+
+
+def token_env():
+    """The token commands' environment: clean_env() plus the pinned XDG_DATA_HOME — the root lanes-web.service is
+    rendered with, never the caller's (a shell export the user manager does not carry would mint where the server
+    never looks)."""
+    return clean_env({'XDG_DATA_HOME': str(account_home() / WEB_DATA_HOME)})
+
+
+def server_token_db(pid):
+    """The token database the running process `pid` (lanes-web.service's zellij) reads, by zellij's own rule —
+    $XDG_DATA_HOME when absolute, else $HOME/.local/share — from PROC/<pid>/environ, the environment systemd started it
+    with. -> (Path, '') or (None, why). Read-only."""
+    try:
+        raw = (PROC / str(pid) / 'environ').read_bytes()
+    except OSError as error:
+        return None, f'its environment (/proc/{pid}/environ) is unreadable: {error.strerror or error}'
+    env = dict(entry.partition(b'=')[::2] for entry in raw.split(b'\0') if b'=' in entry)
+    data = env.get(b'XDG_DATA_HOME', b'').decode(errors='replace')
+    if not data.startswith('/'):
+        home = env.get(b'HOME', b'').decode(errors='replace')
+        if not home.startswith('/'):
+            return None, f'its environment (/proc/{pid}/environ) names neither XDG_DATA_HOME nor HOME'
+        data = f'{home}/.local/share'
+    return Path(data) / 'zellij/tokens.db', ''
+
+
+def same_file(a, b):
+    return os.path.realpath(a) == os.path.realpath(b)
+
+
+def token_db_mismatch(server):
+    return (f'lanes-web.service reads login tokens from {server}, but `lanes web --token` and `lanes token` use '
+            f'{token_db()}: a token minted now is refused at sign-in and a revocation never reaches the server. '
+            f'`lanes web <device>` renders its unit with the pinned XDG_DATA_HOME=%h/{WEB_DATA_HOME}; then '
+            'systemctl --user restart lanes-web.service (open browser views reconnect; a token minted into the other '
+            'database is minted again)')
+
+
+def token_db_refusal():
+    """The message `lanes web --token` and `lanes token` refuse with when the RUNNING lanes-web.service measurably
+    reads another token database; None when it reads the same one, runs no process, or cannot be compared (no
+    systemctl, no answer, an unreadable environment) — the pinned unit reads the pinned root on its next start, and
+    `lanes doctor` names what was not compared. One bounded `systemctl --user show`; read-only."""
+    if not shutil.which('systemctl'):
+        return None
+    rc, out, _err = L.run_bounded(SERVER_PID, 10, env=clean_env())
+    pid = dict(line.partition('=')[::2] for line in out.splitlines()).get('MainPID', '') if rc == 0 else ''
+    if not pid.isdigit() or int(pid) == 0:
+        return None
+    server, _why = server_token_db(int(pid))
+    return None if server is None or same_file(server, token_db()) else token_db_mismatch(server)
+
+
 def cmd_web(args):
-    """lanes web <device> [--desktop|--mobile] [--viewports N] [--token | --print-only]
+    """lanes web <device> [--desktop|--mobile] [--viewports N] [--token | --print-only] [--default-device NAME] [--no-qr]
 
     One command for a browser view (laptop, tablet, phone): prepare the device's view (idempotent; a running view
-    of the other layout is refused, never rebuilt), enable the loopback web services through install/enable-web.sh,
-    print the private URL. Without --desktop/--mobile a known device (devices/<device>.json) keeps its recorded
-    layout, exactly as a flagless `lanes prepare` reuses whatever runs; only a new device defaults to desktop.
-    --token execs the pinned `zellij web --create-token` exactly as enable-phone.sh does, in the caller's terminal
-    only; lanes never prints or logs a token. --print-only changes nothing. Output: `key: value` lines
-    (DM-LANES-WEB-CLI v1)."""
+    of the other layout is refused, never rebuilt) BEFORE anything is printed (LNS-38), enable the loopback web
+    services through install/enable-web.sh, make Tailscale Serve forward https:8443 to the frontend (ensure_serve;
+    exit 64 with the operator's step when it cannot), print the private URL. Without --desktop/--mobile a known
+    device (devices/<device>.json) keeps its recorded layout, exactly as a flagless `lanes prepare` reuses whatever
+    runs; only a new device defaults to desktop. --token then draws a QR code of the URL for a phone camera (web_qr:
+    `qrencode -t ANSIUTF8`, else libexec/qr.py; none for a loopback URL, past qr.py's 106 bytes, or with --no-qr) —
+    the token cannot be in it: it does not exist yet — and creates a login token with the pinned
+    `zellij web --create-token` on the caller's terminal only, recording its name for the device
+    (libexec/web_tokens.py); lanes never prints or logs a token. It is refused (exit 64, before any output) while the
+    running lanes-web.service reads another token database (token_db_refusal). --print-only changes nothing.
+    `lanes-launch web` (W8 B4) adds --default-device, its machine's device: the view's base is recorded as
+    `lanes attach` records it; and passes --no-qr through when given. Output: `key: value` lines (DM-LANES-WEB-CLI
+    v1); with --token only, the QR code and then the token instruction follow them."""
     words, skip = [], False
     for arg in args:
         if skip:
             skip = False
-        elif arg == '--viewports':
+        elif arg in ('--viewports', '--default-device'):
             skip = True
         elif arg.startswith('-'):
-            if arg not in ('--desktop', '--mobile', '--token', '--print-only'):
+            if arg not in ('--desktop', '--mobile', '--token', '--print-only', '--no-qr'):
                 raise L.LanesError(f'unknown option {arg}; {WEB_USAGE}')
         else:
             words.append(arg)
@@ -896,27 +1233,73 @@ def cmd_web(args):
     state = 'planned'
     if not print_only:
         state = prepare_view(device, mobile, viewports, explicit=explicit)
+        record_base(device, args)
         rc, out, err = L.run_bounded(['sh', str(L.REPO / 'install/enable-web.sh'), device, flag], 180)
         if rc != 0:
             raise L.LanesError('install/enable-web.sh: ' + ('no answer in 180 s' if rc is None
                                                            else err.strip() or out.strip() or f'exit {rc}'))
     dns = tailnet_name()
+    url = f'https://{dns}:8443/{device}' if dns else f'{WEB_LOOPBACK}/{device}'
+    serve = None
+    if dns and print_only:
+        serve = serve_plan()
+    elif dns:
+        try:
+            added = ensure_serve()
+        except ServeRefused as refusal:
+            print(f'lanes: {refusal}', file=sys.stderr)
+            return 64
+        serve = (f'present (https:{SERVE_PORT} -> {WEB_LOOPBACK})' if added == 'present'
+                 else f"added ({' '.join(SERVE_ADD)})")
+    if token:
+        # Before any output: a token minted into a database the running server does not read is refused at sign-in.
+        refusal = token_db_refusal()
+        if refusal:
+            print(f'lanes: {refusal}', file=sys.stderr)
+            return 64
     lines = [('device', device), ('layout', 'mobile' if mobile else 'desktop'), ('state', state),
-             ('prepare', ' '.join(prepare)), ('services', f'sh install/enable-web.sh {device} {flag}'),
-             ('url', f'https://{dns}:8443/{device}' if dns else f'{WEB_LOOPBACK}/{device}')]
+             ('prepare', ' '.join(prepare)), ('services', f'sh install/enable-web.sh {device} {flag}'), ('url', url)]
     if not dns:
         lines.append(('note', 'no Tailscale name on this host: the loopback URL opens only here; '
                               'there is no public fallback by design (docs/INSTALL.md)'))
     if not token:
         lines.append(('next', f'lanes web {device} {flag} --token   (in your own terminal: a login token)'))
-    print(''.join(f'{key}: {value}\n' for key, value in lines), end='')
+    if serve:
+        lines.append(('serve', serve))   # appended after every earlier v1 key (DM-LANES-WEB-CLI is additive)
+    print(''.join(f'{key}: {value}\n' for key, value in lines), end='', flush=True)
     if token:
-        print('\nThe last line is NAME: TOKEN. Paste only TOKEN into the sign-in screen.\n', flush=True)
-        # Zellij 0.45.1 requires --create-token by itself; --token-name cannot accompany it (enable-phone.sh).
-        os.execv(ZELLIJ_BASE[0], ZELLIJ_BASE + ['web', '--create-token'])
+        # A phone camera opens the URL from this code; a loopback URL opens only on this host, so it gets none.
+        code = web_qr(url) if dns and '--no-qr' not in args else None
+        if code:
+            print('\n' + code, end='' if code.endswith('\n') else '\n')
+        # Zellij 0.45.1 cannot name a token (--token-name may not accompany --create-token): web_tokens records
+        # which device each token was minted for — and its machine, which `lanes offboard <machine>` signs out —
+        # and runs the create on this terminal without reading its output.
+        return libexec_module('web_tokens').mint(device, list(ZELLIJ_BASE), token_env(),
+                                                 machine=view_machine(device, args))
     return 0
 
 
+def view_machine(device, args):
+    """The machine a view belongs to, for the token record: the `base` devices/<device>.json holds (record_base), else
+    what this call's --default-device makes it (base_device); the device itself for a machine's own view."""
+    meta = L.read_json(L.STATE / 'devices' / f'{device}.json')
+    if isinstance(meta, dict) and isinstance(meta.get('base'), str) and meta['base']:
+        return meta['base']
+    default = args[args.index('--default-device') + 1] if '--default-device' in args[:-1] else None
+    return base_device(device, default)
+
+
+def cmd_token(args):
+    """lanes token list | revoke <device> | revoke --name NAME | revoke-all [--yes] (libexec/web_tokens.py). Refused
+    while the running lanes-web.service reads another token database: its list would not be the server's tokens and a
+    revocation would not sign anything out."""
+    refusal = token_db_refusal()
+    if refusal:
+        raise L.LanesError(refusal)
+    return libexec_module('web_tokens').main(args, list(ZELLIJ_BASE), token_env())
+
+
 # ------------------------------------------------------------------ safety
 
 PANE_FORMAT = '#{session_name}\t#{window_index}.#{pane_index}\t#{pane_pid}\t#{window_width}x#{window_height}'
@@ -1160,12 +1543,387 @@ def cmd_upload_result(args):
     return 0
 
 
-def cmd_workspaces(_args):
-    for workspace in L.load_registry()['workspaces']:
-        print(workspace['id'])
+WORKSPACES_USAGE = ('usage: lanes workspaces   |   lanes workspaces add <id> --container <name> --repo <path> '
+                    '[--title T] [--session S] [--write]')
+
+
+def cmd_workspaces(args):
+    """`lanes workspaces` prints the board ids (the client installer reads them); `lanes workspaces add` appends a
+    board to the site catalog and writes its manifest (libexec/site_edit.py). Dry run (the printed diff) unless
+    --write; an id already in the catalog is verified and never rewritten (exit 1 when it disagrees); a repository
+    another board already declares is refused (LanesError, before any write)."""
+    if not args:
+        for workspace in L.load_registry()['workspaces']:
+            print(workspace['id'])
+        return 0
+    if args[0] != 'add' or len(args) < 2 or args[1].startswith('-'):
+        raise L.LanesError(WORKSPACES_USAGE)
+    opts, rest = {}, list(args[2:])
+    while rest:
+        word = rest.pop(0)
+        if word in ('--container', '--repo', '--title', '--session') and rest:
+            opts[word] = rest.pop(0)
+        elif word == '--write':
+            opts[word] = True
+        else:
+            raise L.LanesError(WORKSPACES_USAGE)
+    if '--container' not in opts or '--repo' not in opts:
+        raise L.LanesError(WORKSPACES_USAGE)
+    board = args[1]
+    site_edit = libexec_module('site_edit')
+    result = site_edit.add_workspace(board, opts.get('--title', board), opts['--container'], opts['--repo'],
+                                     opts.get('--session'), write=bool(opts.get('--write')))
+    if result['status'] == 'exists':
+        print(f"{board}: already in the catalog ({result['catalog']}) and agrees; nothing written")
+        return 0
+    if result['status'] == 'mismatch':
+        print(f"{board}: not changed — the site ({result['site']}) already says otherwise:")
+        for difference in result['differences']:
+            print(f'  {difference}')
+        print('Edit those files by hand (workspaces.example/README.md) or choose another id.')
+        return 1
+    sys.stdout.write(site_edit.diff_text(result))
+    if result['status'] == 'would-add':
+        print('dry run: nothing written (add --write to apply)')
+        return 0
+    for backup in result['backups']:
+        print(f'backup {backup}')
+    print(f"added {board} to {result['catalog']}\n"
+          f"next: lanes install-container {opts['--container']} && lanes sync && lanes doctor")
     return 0
 
 
+# ------------------------------------------------------------------- onboard
+
+ONBOARD_USAGE = ('usage: lanes onboard <login> --container <name> [--workspace <id> --repo <path> [--title T]] '
+                 '[--write] [--no-mcp]')
+# The receipt's status vocabulary. A dry run reports planned, unchanged, skipped, manual or failed, and `ok` for the
+# read-only `inspect` of the container; `manual` names a step a person still has to take (printed with the exact command);
+# `warn` is a step that ran and reported a problem that does not stop onboarding (the doctor's verdict, a board with
+# registry errors); `not-run` is a step a stopped run did not reach. Only `failed` makes exit 1 (an unknown container,
+# a uid split, a board that disagrees, a contract that could not be installed: each stops the run).
+ONBOARD_STATUSES = ('planned', 'changed', 'unchanged', 'ok', 'skipped', 'manual', 'warn', 'failed', 'not-run')
+# `throttle setup` is headless only when Throttle is already configured. It branches on ONE fact: does its config file
+# exist (src/cli.rs `cmd_setup` -> `preflight_setup_config`, `text.is_some()`), at `config_path()` =
+# dirs::config_dir()/throttle/config.toml, i.e. $XDG_CONFIG_HOME, else ~/.config (crates/throttle-base product.rs
+# `RuntimePaths::config_file`). Without it, setup takes the first-run branch: it adopts the container's own Claude login
+# as pool account "main" and points Claude Code at a local proxy nobody has started, or it opens the claude.ai login
+# and waits for a pasted code (`run_oauth_flow`). Neither is for a script, so the probe — a file test, the cheapest
+# truthful answer, no daemon contacted — decides first, and setup runs only on `configured`. `-f` is deliberately
+# narrower than "exists": a config path that is not a regular file is left to the person too.
+THROTTLE_PROBE = ('if ! command -v throttle >/dev/null; then echo absent; '
+                  'elif [ -f "${XDG_CONFIG_HOME:-$HOME/.config}/throttle/config.toml" ]; then echo configured; '
+                  'else echo unconfigured; fi')
+THROTTLE_SETUP = 'throttle setup --install-clients'
+THROTTLE_PROBE_TIMEOUT = 20
+THROTTLE_TIMEOUT = 120
+SITE_LINE = re.compile(r'^(LANES_[A-Z_]+)=([A-Za-z0-9_.:@/-]*)$')   # also what `lanes client-config` hands out
+
+
+def onboard_step(name, status, detail=''):
+    return {'name': name, 'status': status, 'detail': detail}
+
+
+def uid_split(home):
+    """Why this account must not write the agents' files into a container home, or None. Lanes writes into the home
+    volume as the HOST account, so what it creates belongs to this account's uid; the agent inside runs as
+    CONTAINER_UID (1000) and cannot read a 0600 file it does not own (`.claude/settings.json`), nor write into a
+    directory this account made (`throttle setup`, as uid 1000, writes into `.claude/` and `.codex/`). Both must be the
+    container uid: this account's effective uid, and the home volume's owner."""
+    want, host = L.CONTAINER_UID, os.geteuid()
+    if host != want:
+        return f'host account uid {host} ≠ container uid {want}'
+    owner = os.stat(home).st_uid
+    if owner != want:
+        return f'container home {home} is owned by uid {owner}, not the container uid {want}'
+    return None
+
+
+def site_profile():
+    """This server's site facts: the LANES_* KEY=VALUE lines of ~/.config/lanes/site.conf (read, never executed)."""
+    try:
+        text = (Path.home() / '.config/lanes/site.conf').read_text()
+    except OSError:
+        return {}
+    return dict(match.groups() for match in map(SITE_LINE.match, text.splitlines()) if match)
+
+
+def provision_throttle(container, site, write=True):
+    """Attach a container's agents to Throttle: inside it as uid 1000, a probe (absent / configured / unconfigured,
+    THROTTLE_PROBE), then `throttle setup --install-clients` only when it answers `configured` -> receipt steps.
+    Absent, not configured, failed or timed out, it prints the manual step (a missing Throttle is not an onboarding
+    failure: Lanes runs without it). Never reached on a uid split: onboard stops at `inspect` (DEF-1727). Its output
+    is not relayed — setup names accounts and credential sources, and this printout is pasted
+    into tickets — only a failure's last stderr line is.
+    The hook point of plan Track D: the laptop-pool step is printed, and recorded, only when the site profile names
+    LANES_THROTTLE_REMOTE_URL (the operator-gated pool the user's laptop joins with `throttle remote join`)."""
+    uid = str(L.CONTAINER_UID)
+    probe, setup = (f"docker exec -u {uid} {container} sh -lc '{command}'" for command in (THROTTLE_PROBE, THROTTLE_SETUP))
+    by_hand = f"docker exec -it -u {uid} {container} sh -lc '{THROTTLE_SETUP}'"
+
+    def last_line(text):
+        return next((line.strip() for line in reversed(text.splitlines()) if line.strip()), '')
+
+    def manual(reason, then, err=''):
+        last = last_line(err)
+        print(f'⚠ throttle: {reason}' + (f' ({last[:160]})' if last else ''))
+        print(f'  manual step: {then}')
+        return [onboard_step('throttle', 'manual', f'{reason} — {then}')]
+    if not write:
+        print(f'would run: {probe}')
+        print(f'  and only when it answers `configured`: {setup}')
+        return provision_laptop([onboard_step('throttle', 'planned', f'{probe}; when configured: {setup}')], site)
+    rc, out, err = L.run_bounded(['docker', 'exec', '-u', uid, container, 'sh', '-lc', THROTTLE_PROBE],
+                                 THROTTLE_PROBE_TIMEOUT)
+    # A login shell may print (a motd, a profile's echo) before the answer: the answer is the last line.
+    answer = last_line(out) if rc == 0 else ''
+    if answer == 'configured':
+        rc, _out, err = L.run_bounded(['docker', 'exec', '-u', uid, container, 'sh', '-lc', THROTTLE_SETUP],
+                                      THROTTLE_TIMEOUT)
+        if rc == 0:
+            print(f'attached: {THROTTLE_SETUP} exit 0 in {container}')
+            return provision_laptop([onboard_step('throttle', 'ok', f'{THROTTLE_SETUP} in {container}')], site)
+        reason = f'no answer within {THROTTLE_TIMEOUT} s' if rc is None else f'exit {rc}: `{THROTTLE_SETUP}` failed'
+        steps = manual(reason, f'run it on a terminal to see why: {by_hand}', err)
+    elif answer == 'unconfigured':
+        steps = manual(f'Throttle is installed but not configured (no ~/.config/throttle/config.toml for uid {uid}): '
+                       "its first setup signs in to claude.ai, or adopts this container's own Claude login, and "
+                       'needs a person', f'run it once, on a terminal: {by_hand}')
+    elif answer == 'absent':
+        steps = manual("no `throttle` on the container's login PATH",
+                       f'install it (npx @vibelord/throttle@latest), then run once, on a terminal: {by_hand}')
+    else:
+        reason = (f'the Throttle probe got no answer within {THROTTLE_PROBE_TIMEOUT} s' if rc is None else
+                  f'the Throttle probe failed (exit {rc})' if rc else f'the Throttle probe answered {answer!r}')
+        steps = manual(reason, f'inside {container} (as uid {uid}): install Throttle if it is missing, then: {by_hand}',
+                       err)
+    return provision_laptop(steps, site)
+
+
+def provision_laptop(steps, site):
+    remote = site.get('LANES_THROTTLE_REMOTE_URL')
+    if remote:
+        laptop = (f'on the user\'s laptop: throttle remote join <pairing code> — the code comes from the operator\'s '
+                  f'`throttle remote share` for the pool at {remote}')
+        print(f'  laptop agents on the pool: {laptop}')
+        steps.append(onboard_step('laptop-pool', 'manual', laptop))
+    return steps
+
+
+def onboard_args(args):
+    if not args or args[0].startswith('-'):
+        raise L.LanesError(ONBOARD_USAGE)
+    opts, rest = {}, list(args[1:])
+    while rest:
+        word = rest.pop(0)
+        if word in ('--container', '--workspace', '--repo', '--title') and rest and word not in opts:
+            opts[word] = rest.pop(0)
+        elif word in ('--write', '--no-mcp'):
+            opts[word] = True
+        else:
+            raise L.LanesError(ONBOARD_USAGE)
+    if '--container' not in opts or ('--workspace' in opts) != ('--repo' in opts) or \
+            ('--title' in opts and '--workspace' not in opts):
+        raise L.LanesError(ONBOARD_USAGE)
+    for label, value in (('login', args[0]), ('container', opts['--container'])):
+        if not L.IDENT.fullmatch(value):   # fullmatch: IDENT's `$` would accept a trailing newline
+            raise L.LanesError(f'Invalid {label}: {value!r}')
+    return args[0], opts
+
+
+def onboard_receipt(login, container, board, steps):
+    """~/.local/state/lanes/onboard/<login>-<UTC>.json; a second run in the same second gets its own file."""
+    now = time.gmtime()
+    stem = f"{login}-{time.strftime('%Y%m%dT%H%M%SZ', now)}"
+    path, n = L.STATE / 'onboard' / f'{stem}.json', 2
+    while path.exists():
+        path, n = L.STATE / 'onboard' / f'{stem}-{n}.json', n + 1
+    document = {'version': 1, 'login': login, 'container': container, 'workspace': board,
+                'at': time.strftime('%Y-%m-%dT%H:%M:%SZ', now), 'steps': steps}
+    L.atomic_write(path, json.dumps(document, indent=1, ensure_ascii=False) + '\n')
+    return path
+
+
+def cmd_onboard(args):
+    """`lanes onboard`: one verb provisions a user's container and agents — the board (site_edit), the lane contract,
+    the claude and codex lane-signal hooks, the Throttle attachment, canonical create recipes, sync and the doctor —
+    with a receipt. A dry run (every diff, every command) unless --write. Re-running changes nothing that is done.
+    The container (inspected first, read-only, so that a mistyped --container never reaches the site catalog), the
+    board and the contract are prerequisites: their failure stops the run, and every step it did not reach is still
+    named, as `not-run`, in the table and the receipt. cursor-sync needs the board in the
+    registry, so a sync runs before it, and a second one after it when it rewrote terminals.json, so that the
+    container's ~/.lz/registry.json (what `lane open` reads) carries the canonical recipes."""
+    login, opts = onboard_args(args)
+    write, no_mcp = bool(opts.get('--write')), bool(opts.get('--no-mcp'))
+    container, board, repo = opts['--container'], opts.get('--workspace'), opts.get('--repo')
+    site_edit = libexec_module('site_edit') if board else None
+    site = site_profile()
+    steps = []
+
+    def run(name, step, required=False):
+        print(f'== {name}')
+        try:
+            result = step()
+        except (L.LanesError, OSError, ValueError, KeyError) as error:   # KeyError: a hand-edited site missing a key
+            print(f'✗ {error}')
+            result = ('failed', str(error))
+        found = result if isinstance(result, list) else [onboard_step(name, *result)]
+        steps.extend(found)
+        return not (required and any(s['status'] == 'failed' for s in found))
+
+    volume = {}
+
+    def home():
+        return volume['home']
+
+    def inspect_step():
+        """Read-only (`docker inspect`), in a dry run too: every later step needs the container, and the board names
+        it, so a mistyped --container must stop the run before the board is written to the site catalog. It also
+        decides whether this account may write into that home for the agent at all (`uid_split`): on a split the run
+        stops here, before the board, the contract or any other write (DEF-1727)."""
+        info = L.container_info(container)
+        if not info.get('home'):
+            raise L.LanesError(f'{container}: home volume not found')
+        volume['home'] = Path(info['home'])
+        volume['split'] = uid_split(volume['home'])
+        if volume['split']:
+            print(f"✗ {volume['split']}: what this account would create in {volume['home']} (the lane contract, the "
+                  f'hooks) would not be the agent\'s, uid {L.CONTAINER_UID} — onboarding stops here and writes nothing; '
+                  f'run it from a host account with uid {L.CONTAINER_UID}')
+            return 'failed', (f"home volume {volume['home']}; {volume['split']} — nothing written: run lanes onboard "
+                              f'from a host account with uid {L.CONTAINER_UID}')
+        return 'ok', f"home volume {volume['home']}"
+
+    def board_step():
+        if not board:
+            return 'skipped', 'no --workspace: the container and its agents only'
+        title = opts.get('--title')
+        if title is None:   # a board an earlier run titled keeps its title, so a re-run agrees with it
+            catalog_file = site_edit.site_dir() / 'catalog.json'
+            catalog = L.read_site_json(catalog_file) if catalog_file.exists() else {}
+            boards = catalog.get('workspaces')   # not a list: add_workspace refuses it
+            title = next((w.get('title') for w in boards if isinstance(w, dict) and w.get('id') == board), None) \
+                if isinstance(boards, list) else None
+            title = title or board
+        result = site_edit.add_workspace(board, title, container, repo, write=write)
+        if result['status'] == 'mismatch':
+            for difference in result['differences']:
+                print(f'  {difference}')
+            return 'failed', (f"{board} is already in {result['catalog']} and says otherwise: "
+                              + '; '.join(result['differences']))
+        if result['status'] == 'exists':
+            print(f"{board}: already in the catalog ({result['catalog']}) and agrees; nothing written")
+            return 'unchanged', f"{board} in {result['catalog']}"
+        sys.stdout.write(site_edit.diff_text(result))
+        for backup in result['backups']:
+            print(f'backup {backup}')
+        return ('changed' if write else 'planned'), f"{board} in {result['catalog']}"
+
+    def contract_step():
+        root = home() / '.lz'
+        if not write:
+            print(f'would install the lane contract into {root} and link {Path.home() / ".lz" / container}')
+            return 'planned', str(root)
+        cmd_install_container([container] + (['--no-mcp'] if no_mcp else []))
+        return 'ok', str(root)
+
+    def mcp_step():
+        if no_mcp:
+            return 'skipped', '--no-mcp: left out'
+        return 'skipped', 'lane-mcp is not shipped yet (plan W6): install-container has nothing to add'
+
+    def hooks_step(agent):
+        def step():
+            target = home()
+            files = [target / HOOK_TARGETS[agent][1]] + ([target / '.codex/config.toml'] if agent == 'codex' else [])
+            before = [path.read_bytes() if path.exists() else None for path in files]
+            cmd_hooks(['install', '--agent', agent, '--container', container, '--write' if write else '--dry-run'])
+            if not write:
+                return 'planned', str(files[0])
+            changed = [str(path) for path, old in zip(files, before)
+                       if (path.read_bytes() if path.exists() else None) != old]
+            return ('changed', ', '.join(changed)) if changed else ('unchanged', str(files[0]))
+        return step
+
+    def sync_step():
+        if not write:
+            print('would run: lanes sync')
+            return 'planned', 'lanes sync'
+        if cmd_sync([]) == 0:
+            return 'ok', 'registry published'
+        return 'warn', 'a board has registry errors (listed above)'
+
+    cursor = {}
+
+    def cursor_step():
+        if not board:
+            return 'skipped', 'no --workspace'
+        registry_file = site_edit.registry_path(repo)
+        host_file = L.host_path({'home': str(home())}, registry_file)
+        again = f'lanes cursor-sync {board} --canonicalize --write'
+        if not host_file.exists():
+            example = L.REPO / 'workspaces.example/terminals.example.json'
+            print(f'{container} has no {registry_file}: start it from {example} (every terminal needs an explicit tmux '
+                  f'binding), then run: {again} && lanes sync')
+            return 'manual', f'no {registry_file}; start from workspaces.example/terminals.example.json, then {again}'
+        known = next((w for w in (L.read_json(L.STATE / 'registry.json') or {}).get('workspaces', [])
+                      if w.get('id') == board), None)
+        if not write:
+            if known and not known.get('errors'):
+                libexec_module('cursor_sync').run([board, '--canonicalize'])
+            else:
+                print(f'after the sync: {again}')
+            return 'planned', registry_file
+        if not known or known.get('errors'):
+            reason = '; '.join((known or {}).get('errors') or ['the board is not in the registry'])
+            return 'warn', f'not run — {reason}; fix it, then {again}'
+        before = host_file.read_bytes()
+        libexec_module('cursor_sync').run([board, '--canonicalize', '--write'])
+        cursor['changed'] = host_file.read_bytes() != before
+        return ('changed' if cursor['changed'] else 'unchanged'), registry_file
+
+    def resync_step():
+        if not write:
+            print('would run: lanes sync (again, when cursor-sync rewrote terminals.json)')
+            return 'planned', 'only when cursor-sync rewrote terminals.json'
+        if not cursor.get('changed'):
+            return 'skipped', 'cursor-sync changed nothing'
+        return sync_step()
+
+    def doctor_step():
+        if not write:
+            print('would run: lanes doctor (reported, never fatal)')
+            return 'planned', 'lanes doctor'
+        return ('ok', 'lanes doctor exit 0') if cmd_doctor([]) == 0 else ('warn', 'lanes doctor exit 1: see ✗ above')
+
+    print(f"lanes onboard {login} -> container {container}" + (f', board {board}' if board else '')
+          + ('' if write else ' (dry run)'))
+    plan = [('inspect', inspect_step, True), ('board', board_step, True), ('contract', contract_step, True),
+            ('lane-mcp', mcp_step, False), ('hooks-claude', hooks_step('claude'), False),
+            ('hooks-codex', hooks_step('codex'), False),
+            ('throttle', lambda: provision_throttle(container, site, write), False),
+            ('sync', sync_step, False), ('cursor-sync', cursor_step, False), ('resync', resync_step, False),
+            ('doctor', doctor_step, False)]
+    halted = None
+    for name, step, required in plan:
+        if halted:   # a stopped run still names every step it did not reach (the laptop step rides with throttle)
+            names = [name] + (['laptop-pool'] if name == 'throttle' and site.get('LANES_THROTTLE_REMOTE_URL') else [])
+            why = f" ({volume['split']})" if halted == 'inspect' and volume.get('split') else ''
+            steps.extend(onboard_step(n, 'not-run', f'not reached: {halted} failed{why}') for n in names)
+        elif not run(name, step, required):
+            halted = name
+    print()
+    for key, value in (('login', login), ('container', container), ('workspace', board or '-')):
+        print(f'{key + ":":<14}{value}')
+    for step in steps:
+        print(f"{step['name'] + ':':<14}{step['status']:<10} {step['detail']}")
+    if write:
+        print(f"{'receipt:':<14}{onboard_receipt(login, container, board, steps)}")
+    else:
+        print('dry run: nothing written (add --write to apply)')
+    return 1 if any(step['status'] == 'failed' for step in steps) else 0
+
+
 def cmd_rebuilt(args):
     """Exit 0 if this device's view session was rebuilt in the last minute (the client then reconnects)."""
     try:
@@ -1175,9 +1933,49 @@ def cmd_rebuilt(args):
     return 0 if time.time() - stamp < 60 else 1
 
 
+def server_version():
+    """This server's release (lanes/VERSION), as `lanes hello` reports it; 'dev' without the file."""
+    path = L.REPO / 'VERSION'
+    return path.read_text().strip() if path.exists() else 'dev'
+
+
+VERSION_RE = re.compile(r'(\d+)\.(\d+)\.(\d+)(?:[-+][A-Za-z0-9.]+)?')
+
+
+def version_key(text):
+    """(major, minor, patch) of a release string, else None ('dev', or client text that is no version). A pre-release
+    or build suffix is not compared: 1.1.0-rc.1 counts as 1.1.0, so a release candidate is never told to update."""
+    match = VERSION_RE.fullmatch(text or '') if len(text or '') <= 32 else None
+    return tuple(int(part) for part in match.groups()) if match else None
+
+
+# The newest published release whose lanes-launch passes `--client` but no `--client-version` (@vibelord/lanes 1.0.4).
+# A client without the flag is this release or an earlier one, so it is older only than a server past it. A fixed fact
+# about what was published: bumping lanes/VERSION never moves it.
+LAST_FLAGLESS_CLIENT = (1, 0, 4)
+
+
+def client_notice(args):
+    """The one line `lanes attach` shows a lanes-launch older than this server (W8 B4), or None. lanes-launch passes
+    `--client-version` (the VERSION copied beside it); one that passes `--client` but no version is at most
+    LAST_FLAGLESS_CLIENT and has no update verb, so a server past that release tells it the npm command (DEF-1621: a
+    1.0.4 server must not tell a 1.0.4 client to update to itself). A person's own `lanes attach` passes neither:
+    nothing to say. The client's text is printed only when it parses as a version."""
+    server = server_version()
+    if version_key(server) is None:
+        return None
+    if '--client-version' in args:
+        client = args[args.index('--client-version') + 1] if '--client-version' in args[:-1] else ''
+        older = version_key(client) is not None and version_key(client) < version_key(server)
+        return f'lanes client {client} is older than the server ({server}) — run lanes-launch update' if older else None
+    if '--client' in args and version_key(server) > LAST_FLAGLESS_CLIENT:
+        return f'lanes client is older than the server ({server}) — update it: npx @vibelord/lanes@latest'
+    return None
+
+
 def cmd_hello(args):
     device = resolve_device(args[0], args) if args else '-'
-    version = (L.REPO / 'VERSION').read_text().strip() if (L.REPO / 'VERSION').exists() else 'dev'
+    version = server_version()
     boards = len(L.load_registry()['workspaces']) if (L.STATE / 'registry.json').exists() else 0
     print(f'ok device={device} version={version} boards={boards}')
     return 0
@@ -1188,7 +1986,7 @@ def cmd_client_config(_args):
     need not be written into the distributed package. KEY=VALUE lines, LANES_* keys only."""
     path = Path.home() / '.config/lanes/site.conf'
     for line in (path.read_text().splitlines() if path.exists() else []):
-        if re.match(r'^LANES_[A-Z_]+=[A-Za-z0-9_.:@/-]*$', line):
+        if SITE_LINE.match(line):
             print(line)
     return 0
 
@@ -1247,6 +2045,59 @@ def cmd_studio_host(args):
     return libexec_module('studio_host').main(args)   # verbs, refusals and exit codes are studio_host's
 
 
+def cmd_keys(args):
+    return libexec_module('keys').main(args)          # verbs, refusals and exit codes are keys.py's
+
+
+def cmd_invite(args):
+    return libexec_module('enrol').invite_main(args)  # verbs, refusals and exit codes are enrol.py's
+
+
+def cmd_enrol(args):
+    return libexec_module('enrol').enrol_main(args)
+
+
+def cmd_offboard(args):
+    """lanes offboard <device> --yes: enrol.py owns the order, the refusals and the key step; these are the view half."""
+    return libexec_module('enrol').offboard_main(args, forget=lambda device: cmd_device(['forget', device]),
+                                                 revoke_token=revoke_web_token, end_view=end_view)
+
+
+def revoke_web_token(device, windows=()):
+    """Offboard step 3 -> (status, sentence), status 'done' | 'warn' | 'failed'; never raises. Signs the machine's
+    browsers and phones out through libexec/web_tokens.py (offboard): every Zellij web login token `lanes web --token`
+    recorded for `device`, for each of its `windows` (devices/<view>.json `base` = device) and for each view minted
+    with `device` as its machine (`lanes-launch web phone|laptop`), never another machine's. It runs as every token
+    command does — the pinned binary in the pinned token environment (token_env), refused while the running
+    lanes-web.service reads another database (token_db_refusal), where a revocation would sign nothing out. Zellij
+    0.45.1 names every token token_<n> (measured 2026-10-05), so the record, not the name, says whose a token is."""
+    again = f'`lanes offboard {device} --yes` again finishes it'
+    try:
+        refusal = token_db_refusal()
+        if refusal:
+            return 'failed', f'the web login tokens were not revoked: {refusal}; then {again}'
+        return libexec_module('web_tokens').offboard([device, *windows], list(ZELLIJ_BASE), token_env())
+    except (L.LanesError, OSError) as error:
+        return 'failed', f'the web login tokens were not revoked ({error}); {again}'
+
+
+def end_view(device):
+    """Offboard step 4 -> (status, sentence): end the view session `device` the way `lanes rebuild` does (kill, then
+    delete the serialized session) without its reconnect stamp and without recreating it. No lane is touched."""
+    try:
+        live = live_sessions()
+    except L.LanesError as error:
+        return 'failed', f'whether the view session {device} runs is unknown ({error}); `lanes offboard {device} --yes` again'
+    if device not in live:
+        return 'none', f'no view session {device} is running'
+    rc = zellij(['kill-session', device], 30)[0]
+    if rc != 0:
+        return 'failed', (f'the view session {device} did not end ('
+                          + ('no answer in 30 s' if rc is None else f'exit {rc}') + f'); `lanes offboard {device} --yes` again')
+    zellij(['delete-session', '--force', device], 30)
+    return 'done', f'ended view session {device} (no lane was touched)'
+
+
 def libexec_module(name):
     try:
         return __import__(name)
@@ -1384,7 +2235,9 @@ def socket_report(containers, live_by_container):
 def cmd_device(args):
     """lanes device list | lanes device forget <name>: the devices/<name>.json files `lanes ensure` (lanes-ensure.timer)
     recreates a view session from, and `sync`/`upgrade-session` update. Forgetting removes that file only: a running
-    view session is never ended here."""
+    view session is never ended here. list prints the owner's login as the next rewrite records it (device_owner: the
+    member record's whenever one exists, so it agrees with `lanes keys list`; else the validated recorded one), blank
+    for none — a devices/*.json or members/*.json value never reaches the terminal unchecked."""
     usage = 'usage: lanes device list | lanes device forget <name>'
     devices = L.STATE / 'devices'
     if args == ['list']:
@@ -1393,11 +2246,15 @@ def cmd_device(args):
         except L.LanesError:
             live = None
         for meta_file in sorted(devices.glob('*.json')):
-            meta = L.read_json(meta_file) or {}
+            meta = L.read_json(meta_file)
+            meta = meta if isinstance(meta, dict) else {}
             kind = 'phone' if meta.get('mobile') else f"desktop, {int(meta.get('viewports') or 1)} viewports"
             running = 'unknown (zellij did not answer)' if live is None else (
                 'running' if meta_file.stem in live else 'not running')
-            print(f'{meta_file.stem:<16} {kind:<24} {running}' + (f"  base {meta['base']}" if meta.get('base') else ''))
+            owner = device_owner(meta_file.stem, meta) or {}     # validated; blank when none
+            base = meta.get('base') if isinstance(meta.get('base'), str) and L.IDENT.match(meta['base']) else None
+            print(f"{meta_file.stem:<16} {kind:<24} {owner.get('login', ''):<24} {running}"
+                  + (f"  base {base}" if base else ''))
         return 0
     if len(args) != 2 or args[0] != 'forget':
         raise L.LanesError(usage)
@@ -1424,6 +2281,77 @@ def cmd_device(args):
     return 0
 
 
+def web_doctor():
+    """`lanes doctor`'s browser/phone lines -> [(mark, text)], mark ✓ | ⚠ | ✗ (LNS-50). One bounded
+    `systemctl --user show` for both web units, a read of the running lanes-web's environment, `tailscale status --json`
+    and, when the host has a Tailscale name, `tailscale serve status --json`; read-only.
+      unit enabled and active ✓ · enabled but not active ✗ · not enabled ⚠ (no browser view yet, or one that a reboot
+      loses when it runs anyway) · systemctl silent ✗ (NOT checked) · no systemctl ⚠
+      token database (lanes-web runs a process): the one the token commands use ✓ · another ✗ · unreadable ⚠
+      Serve mapping present ✓ · missing or foreign ✗ once a web unit is enabled, else ⚠ · unreadable ⚠ · no tailscale ⚠
+      · no Tailscale name ⚠ (cmd_web's own guard: there `lanes web` configures no Serve and prints a loopback URL)"""
+    lines, enabled_any = [], False
+    if not shutil.which('systemctl'):
+        lines.append(('⚠', 'web units not checked — no systemctl on this host (`lanes web` needs systemd user services)'))
+    else:
+        argv = ['systemctl', '--user', 'show', '-p', 'Id', '-p', 'LoadState', '-p', 'ActiveState', '-p', 'UnitFileState',
+                '-p', 'MainPID', *WEB_UNITS]
+        rc, out, err = L.run_bounded(argv, 10, env=clean_env())
+        if rc != 0:
+            lines.append(('✗', f"web units NOT checked — systemctl --user {'did not answer in 10 s' if rc is None else err.strip() or f'exit {rc}'}"))
+        else:
+            units = {}
+            for block in out.strip().split('\n\n'):
+                props = dict(line.partition('=')[::2] for line in block.splitlines() if '=' in line)
+                units[props.get('Id', '')] = props
+            for unit in WEB_UNITS:
+                props = units.get(unit, {})
+                active = props.get('ActiveState') or 'unknown'
+                enabled = props.get('UnitFileState', '').startswith(('enabled', 'linked', 'alias'))
+                enabled_any = enabled_any or enabled
+                if enabled and active == 'active':
+                    lines.append(('✓', f'{unit} active'))
+                elif enabled:
+                    lines.append(('✗', f'{unit} enabled but {active} — journalctl --user -u {unit}; '
+                                       f'systemctl --user restart {unit}'))
+                elif active == 'active':
+                    lines.append(('⚠', f'{unit} active but not enabled: a reboot loses it — `lanes web <device>` enables it'))
+                else:
+                    lines.append(('⚠', f'{unit} not enabled (no browser or phone view yet) — `lanes web <device>` enables it'))
+            pid = units.get(WEB_UNITS[0], {}).get('MainPID', '')
+            if pid.isdigit() and int(pid) > 0:
+                server, why = server_token_db(int(pid))
+                if server is None:
+                    lines.append(('⚠', f'login-token database not compared — lanes-web.service: {why}'))
+                elif same_file(server, token_db()):
+                    lines.append(('✓', f'lanes-web.service reads login tokens from {token_db()}, where '
+                                       '`lanes web --token` and `lanes token` keep them'))
+                else:
+                    lines.append(('✗', token_db_mismatch(server)))
+    if not shutil.which('tailscale'):
+        lines.append(('⚠', 'Tailscale Serve not checked — tailscale is not installed: browser and phone views have no '
+                           'private HTTPS'))
+        return lines
+    if not tailnet_name():
+        lines.append(('⚠', 'Tailscale Serve not checked — this host has no Tailscale name (logged out, no MagicDNS '
+                           'name, or `tailscale status` did not answer): `lanes web` configures no Serve mapping and '
+                           'prints a loopback URL that opens only here'))
+        return lines
+    state, detail = serve_state()
+    severity = '✗' if enabled_any else '⚠'
+    if state == 'present':
+        lines.append(('✓', f'Tailscale Serve https:{SERVE_PORT} -> {WEB_LOOPBACK}'))
+    elif state == 'missing':
+        lines.append((severity, f'Tailscale Serve has no https:{SERVE_PORT} -> {WEB_LOOPBACK} mapping, so browser and '
+                                'phone views do not open — `lanes web <device>` adds it'))
+    elif state == 'other':
+        lines.append((severity, f'Tailscale Serve maps https:{SERVE_PORT} / to {detail}, not the Lanes frontend — free '
+                                f'the port (tailscale serve --https={SERVE_PORT} off), then `lanes web <device>`'))
+    else:
+        lines.append(('⚠', f'Tailscale Serve not checked — {detail}'))
+    return lines
+
+
 def cmd_doctor(_args):
     problems = 0
 
@@ -1457,6 +2385,16 @@ def cmd_doctor(_args):
               'run lanes sync — ' + '; '.join(stale_sources[:3]) + (' …' if len(stale_sources) > 3 else ''))
         for name, info in containers.items():
             check(bool(info.get('running')), f'container {name} running', f"init pid {info.get('pid')}")
+            # Lanes writes the agents' files into this home as this account: a uid split leaves them unreadable to
+            # the agent (uid 1000). A warning: nothing is broken until something writes there.
+            try:
+                split = uid_split(Path(info['home'])) if info.get('home') else None
+            except OSError as error:
+                split = f'home volume not readable ({error.strerror or error}): its owner was not checked'
+            if split:
+                print(f'⚠ container {name}: {split} — files this account writes there (lanes install-container, '
+                      'lanes hooks install, lanes onboard) would not be the agent\'s; lanes onboard stops before '
+                      'writing and lanes hooks install --write refuses')
         # Recipes, identity, session names, crowded `default` sockets, orphan socket files: warnings, never a ✗
         # (they describe the boards' declarations and the containers' /tmp, which doctor reports and never changes).
         lines, warnings = recipe_report(registry)
@@ -1515,6 +2453,11 @@ def cmd_doctor(_args):
     check(not stale_pickers, 'phone picker panes report their own title (DEF-1531)',
           'built from a layout that names the picker pane, so the phone shows no counts; upgrade-session does not '
           're-lay-out a tab — run ' + '; '.join(f'lanes rebuild {d}' for d in stale_pickers))
+    for mark, text in web_doctor():   # browser/phone: web units and the Tailscale Serve mapping (LNS-50)
+        if mark == '⚠':
+            print(f'⚠ {text}')
+        else:
+            check(mark == '✓', text)
     print('PRESSURE')
     health = L.compute_health()
     print('\n'.join(pressure_lines(health, L.read_json(L.STATE / 'containers.json') or {})))
@@ -1813,7 +2756,9 @@ COMMANDS = {'rebuilt': cmd_rebuilt, 'hello': cmd_hello, 'client-config': cmd_cli
             'prepare': cmd_prepare, 'web': cmd_web, 'attach': cmd_attach, 'rebuild': cmd_rebuild, 'ensure': cmd_ensure, 'invariant': cmd_invariant,
             'doctor': cmd_doctor, 'pressure': cmd_pressure, 'sockets': cmd_sockets, 'tmp': cmd_tmp,
             'guard': cmd_guard, 'rename': cmd_rename, 'register': cmd_register, 'hooks': cmd_hooks, 'economy': cmd_economy,
-            'preview': cmd_preview, 'device': cmd_device, 'next': cmd_next, 'prev': cmd_prev, 'studio-host': cmd_studio_host}
+            'preview': cmd_preview, 'device': cmd_device, 'next': cmd_next, 'prev': cmd_prev, 'studio-host': cmd_studio_host,
+            'keys': cmd_keys, 'invite': cmd_invite, 'enrol': cmd_enrol, 'offboard': cmd_offboard,
+            'token': cmd_token, 'onboard': cmd_onboard}
 
 if __name__ == '__main__':
     if len(sys.argv) < 2 or sys.argv[1] not in COMMANDS: