aicomputer 0.1.6 → 0.1.7

package/dist/index.js

@@ -1,16 +1,15 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command9 } from "commander";
-import chalk8 from "chalk";
+import { Command as Command11 } from "commander";
+import chalk11 from "chalk";
 import { readFileSync as readFileSync3 } from "fs";
 import { basename as basename2 } from "path";
 
 // src/commands/access.ts
 import { spawn } from "child_process";
-import { select } from "@inquirer/prompts";
 import { Command } from "commander";
-import chalk2 from "chalk";
+import chalk3 from "chalk";
 import ora from "ora";
 
 // src/lib/config.ts
@@ -159,6 +158,11 @@ async function createComputer(input) {
     body: JSON.stringify(input)
   });
 }
+async function deleteComputer(computerID) {
+  return api(`/v1/computers/${computerID}`, {
+    method: "DELETE"
+  });
+}
 async function getFilesystemSettings() {
   return api("/v1/me/filesystem");
 }
@@ -236,6 +240,79 @@ function normalizePrimaryPath(primaryPath) {
   return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
 }
 
+// src/lib/computer-picker.ts
+import { select } from "@inquirer/prompts";
+import chalk2 from "chalk";
+
+// src/lib/format.ts
+import chalk from "chalk";
+function padEnd(str, len) {
+  const visible = str.replace(/\u001b\[[0-9;]*m/g, "");
+  return str + " ".repeat(Math.max(0, len - visible.length));
+}
+function timeAgo(dateStr) {
+  const seconds = Math.floor((Date.now() - new Date(dateStr).getTime()) / 1e3);
+  if (seconds < 60) return `${seconds}s ago`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  const days = Math.floor(hours / 24);
+  return `${days}d ago`;
+}
+function formatStatus(status) {
+  switch (status) {
+    case "running":
+      return chalk.green(status);
+    case "pending":
+    case "provisioning":
+    case "starting":
+      return chalk.yellow(status);
+    case "stopping":
+    case "stopped":
+    case "deleted":
+      return chalk.gray(status);
+    case "error":
+      return chalk.red(status);
+    default:
+      return status;
+  }
+}
+
+// src/lib/computer-picker.ts
+async function promptForSSHComputer(computers, message) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error("computer id or handle is required when not running interactively");
+  }
+  const available = computers.filter(isSSHSelectable);
+  if (available.length === 0) {
+    if (computers.length === 0) {
+      throw new Error("no computers found");
+    }
+    throw new Error("no running computers with SSH enabled");
+  }
+  const handleWidth = Math.max(6, ...available.map((computer) => computer.handle.length));
+  const selectedID = await select({
+    message,
+    pageSize: Math.min(available.length, 10),
+    choices: available.map((computer) => ({
+      name: `${padEnd(chalk2.white(computer.handle), handleWidth + 2)}${padEnd(formatStatus(computer.status), 12)}${chalk2.dim(describeSSHChoice(computer))}`,
+      value: computer.id
+    }))
+  });
+  return available.find((computer) => computer.id === selectedID) ?? available[0];
+}
+function isSSHSelectable(computer) {
+  return computer.ssh_enabled && computer.status === "running";
+}
+function describeSSHChoice(computer) {
+  const displayName = computer.display_name.trim();
+  if (displayName && displayName !== computer.handle) {
+    return `${displayName}  ${timeAgo(computer.updated_at)}`;
+  }
+  return `${computer.runtime_family}  ${timeAgo(computer.updated_at)}`;
+}
+
 // src/lib/ssh-config.ts
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
@@ -370,41 +447,6 @@ async function generateSSHKey() {
   return { publicKeyPath, privateKeyPath };
 }
 
-// src/lib/format.ts
-import chalk from "chalk";
-function padEnd(str, len) {
-  const visible = str.replace(/\u001b\[[0-9;]*m/g, "");
-  return str + " ".repeat(Math.max(0, len - visible.length));
-}
-function timeAgo(dateStr) {
-  const seconds = Math.floor((Date.now() - new Date(dateStr).getTime()) / 1e3);
-  if (seconds < 60) return `${seconds}s ago`;
-  const minutes = Math.floor(seconds / 60);
-  if (minutes < 60) return `${minutes}m ago`;
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24) return `${hours}h ago`;
-  const days = Math.floor(hours / 24);
-  return `${days}d ago`;
-}
-function formatStatus(status) {
-  switch (status) {
-    case "running":
-      return chalk.green(status);
-    case "pending":
-    case "provisioning":
-    case "starting":
-      return chalk.yellow(status);
-    case "stopping":
-    case "stopped":
-    case "deleted":
-      return chalk.gray(status);
-    case "error":
-      return chalk.red(status);
-    default:
-      return status;
-  }
-}
-
 // src/lib/open-browser.ts
 import { constants } from "fs";
 import { access } from "fs/promises";
@@ -466,9 +508,9 @@ var openCommand = new Command("open").description("Open a computer in your brows
         throw new Error("VNC is not available for this computer");
       }
       const url = info.connection.vnc_url;
-      spinner.succeed(`Opening VNC for ${chalk2.bold(computer.handle)}`);
+      spinner.succeed(`Opening VNC for ${chalk3.bold(computer.handle)}`);
       await openBrowserURL(url);
-      console.log(chalk2.dim(`  ${url}`));
+      console.log(chalk3.dim(`  ${url}`));
       return;
     }
     if (options.terminal) {
@@ -476,15 +518,15 @@ var openCommand = new Command("open").description("Open a computer in your brows
         throw new Error("Terminal access is not available for this computer");
       }
       const access3 = await createTerminalAccess(computer.id);
-      spinner.succeed(`Opening terminal for ${chalk2.bold(computer.handle)}`);
+      spinner.succeed(`Opening terminal for ${chalk3.bold(computer.handle)}`);
       await openBrowserURL(access3.access_url);
-      console.log(chalk2.dim(`  ${access3.access_url}`));
+      console.log(chalk3.dim(`  ${access3.access_url}`));
       return;
     }
     const access2 = await createBrowserAccess(computer.id);
-    spinner.succeed(`Opening ${chalk2.bold(computer.handle)}`);
+    spinner.succeed(`Opening ${chalk3.bold(computer.handle)}`);
     await openBrowserURL(access2.access_url);
-    console.log(chalk2.dim(`  ${access2.access_url}`));
+    console.log(chalk3.dim(`  ${access2.access_url}`));
   } catch (error) {
     spinner.fail(error instanceof Error ? error.message : "Failed to open computer");
     process.exit(1);
@@ -505,8 +547,8 @@ var sshCommand = new Command("ssh").description("Open an SSH session to a comput
       throw new Error("SSH is not available for this computer");
     }
     const registered = await ensureDefaultSSHKeyRegistered();
-    spinner.succeed(`Connecting to ${chalk2.bold(computer.handle)}`);
-    console.log(chalk2.dim(`  ${formatSSHCommand(info.connection.ssh_user, info.connection.ssh_host, info.connection.ssh_port)}`));
+    spinner.succeed(`Connecting to ${chalk3.bold(computer.handle)}`);
+    console.log(chalk3.dim(`  ${formatSSHCommand(info.connection.ssh_user, info.connection.ssh_host, info.connection.ssh_port)}`));
     console.log();
     await runSSH([
       "-i",
@@ -529,17 +571,17 @@ portsCommand.command("ls").description("List published ports for a computer").ar
     spinner.stop();
     if (ports.length === 0) {
       console.log();
-      console.log(chalk2.dim("  No published ports."));
+      console.log(chalk3.dim("  No published ports."));
       console.log();
       return;
     }
     const subWidth = Math.max(10, ...ports.map((p) => p.subdomain.length));
     console.log();
     console.log(
-      `  ${chalk2.dim(padEnd("Subdomain", subWidth + 2))}${chalk2.dim(padEnd("Port", 8))}${chalk2.dim("Protocol")}`
+      `  ${chalk3.dim(padEnd("Subdomain", subWidth + 2))}${chalk3.dim(padEnd("Port", 8))}${chalk3.dim("Protocol")}`
     );
     console.log(
-      `  ${chalk2.dim("-".repeat(subWidth + 2))}${chalk2.dim("-".repeat(8))}${chalk2.dim("-".repeat(8))}`
+      `  ${chalk3.dim("-".repeat(subWidth + 2))}${chalk3.dim("-".repeat(8))}${chalk3.dim("-".repeat(8))}`
     );
     for (const port of ports) {
       const url = `https://${port.subdomain}--${computer.handle}.computer.agentcomputer.ai`;
@@ -547,7 +589,7 @@ portsCommand.command("ls").description("List published ports for a computer").ar
         `  ${padEnd(port.subdomain, subWidth + 2)}${padEnd(String(port.target_port), 8)}${port.protocol}`
       );
       console.log(
-        `  ${chalk2.dim(url)}`
+        `  ${chalk3.dim(url)}`
       );
     }
     console.log();
@@ -570,8 +612,8 @@ portsCommand.command("publish").description("Publish an HTTP app port").argument
       protocol: options.protocol
     });
     const url = `https://${published.subdomain}--${computer.handle}.computer.agentcomputer.ai`;
-    spinner.succeed(`Published port ${chalk2.bold(String(published.target_port))}`);
-    console.log(chalk2.dim(`  ${url}`));
+    spinner.succeed(`Published port ${chalk3.bold(String(published.target_port))}`);
+    console.log(chalk3.dim(`  ${url}`));
   } catch (error) {
     spinner.fail(error instanceof Error ? error.message : "Failed to publish port");
     process.exit(1);
@@ -586,7 +628,7 @@ portsCommand.command("rm").description("Unpublish an app port").argument("<id-or
     }
     const computer = await resolveComputer(identifier);
     await deletePublishedPort(computer.id, targetPort);
-    spinner.succeed(`Removed port ${chalk2.bold(String(targetPort))}`);
+    spinner.succeed(`Removed port ${chalk3.bold(String(targetPort))}`);
   } catch (error) {
     spinner.fail(error instanceof Error ? error.message : "Failed to remove port");
     process.exit(1);
@@ -623,11 +665,11 @@ async function setupSSHAlias(options) {
     });
     spinner.succeed(`SSH alias '${alias}' is ready`);
     console.log();
-    console.log(chalk2.dim(`  SSH config: ${configResult.configPath}`));
-    console.log(chalk2.dim(`  Identity:   ${registered.privateKeyPath}`));
+    console.log(chalk3.dim(`  SSH config: ${configResult.configPath}`));
+    console.log(chalk3.dim(`  Identity:   ${registered.privateKeyPath}`));
     console.log();
-    console.log(`  ${chalk2.bold("Shell:")}   ssh ${alias}`);
-    console.log(`  ${chalk2.bold("Direct:")}  ssh <handle>@${alias}`);
+    console.log(`  ${chalk3.bold("Shell:")}   ssh ${alias}`);
+    console.log(`  ${chalk3.bold("Direct:")}  ssh <handle>@${alias}`);
     console.log();
   } catch (error) {
     spinner.fail(error instanceof Error ? error.message : "Failed to configure SSH alias");
@@ -675,43 +717,13 @@ async function resolveSSHComputer(identifier, spinner) {
   if (trimmed) {
     return resolveComputer(trimmed);
   }
-  if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    throw new Error("computer id or handle is required when not running interactively");
-  }
   const computers = await listComputers();
-  const available = computers.filter(isSSHSelectable);
-  if (available.length === 0) {
-    if (computers.length === 0) {
-      throw new Error("no computers found");
-    }
-    throw new Error("no running computers with SSH enabled");
-  }
-  const handleWidth = Math.max(6, ...available.map((computer) => computer.handle.length));
   spinner.stop();
-  let selectedID;
   try {
-    selectedID = await select({
-      message: "Select a computer to SSH into",
-      pageSize: Math.min(available.length, 10),
-      choices: available.map((computer) => ({
-        name: `${padEnd(chalk2.white(computer.handle), handleWidth + 2)}${padEnd(formatStatus(computer.status), 12)}${chalk2.dim(describeSSHChoice(computer))}`,
-        value: computer.id
-      }))
-    });
+    return await promptForSSHComputer(computers, "Select a computer to SSH into");
   } finally {
     spinner.start("Preparing SSH access...");
   }
-  return available.find((computer) => computer.id === selectedID) ?? available[0];
-}
-function isSSHSelectable(computer) {
-  return computer.ssh_enabled && computer.status === "running";
-}
-function describeSSHChoice(computer) {
-  const displayName = computer.display_name.trim();
-  if (displayName && displayName !== computer.handle) {
-    return `${displayName}  ${timeAgo(computer.updated_at)}`;
-  }
-  return `${computer.runtime_family}  ${timeAgo(computer.updated_at)}`;
 }
 
 // src/commands/acp.ts
@@ -1062,22 +1074,22 @@ acpCommand.command("serve").description("Serve a local stdio ACP bridge backed b
 
 // src/commands/agent.ts
 import { Command as Command3 } from "commander";
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 import ora2 from "ora";
 function formatAgentSessionStatus(status) {
   switch (status) {
     case "idle":
-      return chalk3.green(status);
+      return chalk4.green(status);
     case "running":
-      return chalk3.blue(status);
+      return chalk4.blue(status);
     case "cancelling":
-      return chalk3.yellow(status);
+      return chalk4.yellow(status);
     case "interrupted":
-      return chalk3.yellow(status);
+      return chalk4.yellow(status);
     case "failed":
-      return chalk3.red(status);
+      return chalk4.red(status);
     case "closed":
-      return chalk3.gray(status);
+      return chalk4.gray(status);
     default:
       return status;
   }
@@ -1086,14 +1098,14 @@ function printAgents(agents) {
   const idWidth = Math.max(5, ...agents.map((agent) => agent.id.length));
   console.log();
   console.log(
-    `  ${chalk3.dim(padEnd("Agent", idWidth + 2))}${chalk3.dim(padEnd("Installed", 12))}${chalk3.dim(padEnd("Creds", 8))}${chalk3.dim("Version")}`
+    `  ${chalk4.dim(padEnd("Agent", idWidth + 2))}${chalk4.dim(padEnd("Installed", 12))}${chalk4.dim(padEnd("Creds", 8))}${chalk4.dim("Version")}`
   );
   console.log(
-    `  ${chalk3.dim("-".repeat(idWidth + 2))}${chalk3.dim("-".repeat(12))}${chalk3.dim("-".repeat(8))}${chalk3.dim("-".repeat(12))}`
+    `  ${chalk4.dim("-".repeat(idWidth + 2))}${chalk4.dim("-".repeat(12))}${chalk4.dim("-".repeat(8))}${chalk4.dim("-".repeat(12))}`
   );
   for (const agent of agents) {
     console.log(
-      `  ${padEnd(agent.id, idWidth + 2)}${padEnd(agent.installed ? chalk3.green("yes") : chalk3.gray("no"), 12)}${padEnd(agent.credentialsAvailable ? chalk3.green("yes") : chalk3.yellow("no"), 8)}${agent.version ?? chalk3.dim("unknown")}`
+      `  ${padEnd(agent.id, idWidth + 2)}${padEnd(agent.installed ? chalk4.green("yes") : chalk4.gray("no"), 12)}${padEnd(agent.credentialsAvailable ? chalk4.green("yes") : chalk4.yellow("no"), 8)}${agent.version ?? chalk4.dim("unknown")}`
     );
   }
   console.log();
@@ -1101,7 +1113,7 @@ function printAgents(agents) {
 function printSessions(sessions, handleByComputerID = /* @__PURE__ */ new Map()) {
   if (sessions.length === 0) {
     console.log();
-    console.log(chalk3.dim("  No agent sessions found."));
+    console.log(chalk4.dim("  No agent sessions found."));
     console.log();
     return;
   }
@@ -1110,19 +1122,19 @@ function printSessions(sessions, handleByComputerID = /* @__PURE__ */ new Map())
   const statusWidth = 13;
   console.log();
   console.log(
-    `  ${chalk3.dim(padEnd("Session", 14))}${chalk3.dim(padEnd("Name", nameWidth + 2))}${chalk3.dim(padEnd("Agent", agentWidth + 2))}${chalk3.dim(padEnd("Status", statusWidth + 2))}${chalk3.dim("Location")}`
+    `  ${chalk4.dim(padEnd("Session", 14))}${chalk4.dim(padEnd("Name", nameWidth + 2))}${chalk4.dim(padEnd("Agent", agentWidth + 2))}${chalk4.dim(padEnd("Status", statusWidth + 2))}${chalk4.dim("Location")}`
   );
   console.log(
-    `  ${chalk3.dim("-".repeat(14))}${chalk3.dim("-".repeat(nameWidth + 2))}${chalk3.dim("-".repeat(agentWidth + 2))}${chalk3.dim("-".repeat(statusWidth + 2))}${chalk3.dim("-".repeat(20))}`
+    `  ${chalk4.dim("-".repeat(14))}${chalk4.dim("-".repeat(nameWidth + 2))}${chalk4.dim("-".repeat(agentWidth + 2))}${chalk4.dim("-".repeat(statusWidth + 2))}${chalk4.dim("-".repeat(20))}`
   );
   for (const session of sessions) {
     const location = handleByComputerID.get(session.computer_id) ?? session.computer_id;
     console.log(
       `  ${padEnd(session.id.slice(0, 12), 14)}${padEnd(session.name || "default", nameWidth + 2)}${padEnd(session.agent, agentWidth + 2)}${padEnd(formatAgentSessionStatus(session.status), statusWidth + 2)}${location}`
     );
-    console.log(`  ${chalk3.dim(`  cwd=${session.cwd}  updated=${timeAgo(session.updated_at)}`)}`);
+    console.log(`  ${chalk4.dim(`  cwd=${session.cwd}  updated=${timeAgo(session.updated_at)}`)}`);
     if (session.last_stop_reason || session.last_error) {
-      console.log(`  ${chalk3.dim(`  ${session.last_error ? `error=${session.last_error}` : `stop=${session.last_stop_reason}`}`)}`);
+      console.log(`  ${chalk4.dim(`  ${session.last_error ? `error=${session.last_error}` : `stop=${session.last_stop_reason}`}`)}`);
     }
   }
   console.log();
@@ -1136,7 +1148,7 @@ var StreamPrinter = class {
   }
   writeDim(text) {
     this.ensureBreak();
-    process.stdout.write(chalk3.dim(text));
+    process.stdout.write(chalk4.dim(text));
     this.inlineOpen = !text.endsWith("\n");
   }
   writeLine(text) {
@@ -1204,7 +1216,7 @@ function renderSSEChunk(chunk, printer, asJson) {
   try {
     envelope = JSON.parse(payload);
   } catch {
-    printer.writeLine(chalk3.dim(payload));
+    printer.writeLine(chalk4.dim(payload));
     return;
   }
   const method = typeof envelope.method === "string" ? envelope.method : "";
@@ -1231,14 +1243,14 @@ function renderSSEChunk(chunk, printer, asJson) {
       case "tool_call_update": {
         const title = typeof update?.title === "string" && update.title ? update.title : "tool";
         const status = typeof update?.status === "string" && update.status ? update.status : "in_progress";
-        printer.writeLine(chalk3.dim(`[tool:${status}] ${title}`));
+        printer.writeLine(chalk4.dim(`[tool:${status}] ${title}`));
         return;
       }
       case "plan": {
         const entries = Array.isArray(update?.entries) ? update.entries : [];
         const detail = entries.filter((entry) => typeof entry === "object" && entry !== null).map((entry) => `- [${entry.status ?? "pending"}] ${entry.content ?? ""}`).join("\n");
         if (detail) {
-          printer.writeLine(chalk3.dim(`Plan
+          printer.writeLine(chalk4.dim(`Plan
 ${detail}`));
         }
         return;
@@ -1248,7 +1260,7 @@ ${detail}`));
     }
   }
   if (method === "session/request_permission") {
-    printer.writeLine(chalk3.yellow("Permission requested by remote agent"));
+    printer.writeLine(chalk4.yellow("Permission requested by remote agent"));
     return;
   }
 }
@@ -1376,12 +1388,12 @@ agentCommand.command("prompt").description("Send a prompt to a machine agent ses
       return;
     }
     console.log();
-    console.log(`  ${chalk3.bold(session.name || "default")}  ${formatAgentSessionStatus(settled.status)}`);
+    console.log(`  ${chalk4.bold(session.name || "default")}  ${formatAgentSessionStatus(settled.status)}`);
     if (settled.last_stop_reason) {
-      console.log(chalk3.dim(`  stop_reason=${settled.last_stop_reason}`));
+      console.log(chalk4.dim(`  stop_reason=${settled.last_stop_reason}`));
     }
     if (settled.last_error) {
-      console.log(chalk3.red(`  error=${settled.last_error}`));
+      console.log(chalk4.red(`  error=${settled.last_error}`));
     }
     console.log();
   } catch (error) {
@@ -1511,11 +1523,558 @@ fleetCommand.command("status").description("List open agent sessions across all
   }
 });
 
-// src/commands/computers.ts
+// src/commands/claude-auth.ts
+import { randomBytes, createHash } from "crypto";
+import { spawn as spawn2 } from "child_process";
+import { input as textInput } from "@inquirer/prompts";
 import { Command as Command4 } from "commander";
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 import ora3 from "ora";
-import { select as select2, input as textInput, confirm } from "@inquirer/prompts";
+var CLAUDE_OAUTH_CLIENT_ID = process.env.CLAUDE_OAUTH_CLIENT_ID ?? "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+var CLAUDE_OAUTH_AUTHORIZE_URL = process.env.CLAUDE_OAUTH_AUTHORIZE_URL ?? "https://claude.ai/oauth/authorize";
+var CLAUDE_OAUTH_TOKEN_URL = process.env.CLAUDE_OAUTH_TOKEN_URL ?? "https://platform.claude.com/v1/oauth/token";
+var CLAUDE_OAUTH_REDIRECT_URL = process.env.CLAUDE_OAUTH_REDIRECT_URL ?? "https://platform.claude.com/oauth/code/callback";
+var CLAUDE_OAUTH_SCOPES = (process.env.CLAUDE_OAUTH_SCOPES ?? "user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload").split(/\s+/).filter(Boolean);
+var readyPollIntervalMs = 2e3;
+var readyPollTimeoutMs = 18e4;
+var claudeAuthCommand = new Command4("claude-auth").alias("claude-login").description("Authenticate Claude Code on a computer").option("--machine <id-or-handle>", "Use a specific computer").option("--keep-helper", "Keep a temporary helper machine if one is created").option("--skip-cross-check", "Skip verification on a second shared machine").action(async (options) => {
+  const todos = createTodoList();
+  let target = null;
+  let helperCreated = false;
+  let sharedInstall = false;
+  let activeTodoID = "target";
+  let failureMessage = null;
+  console.log();
+  console.log(chalk5.cyan("Authenticating with Claude Code...\n"));
+  try {
+    const prepared = await prepareTargetMachine(options);
+    target = prepared.computer;
+    helperCreated = prepared.helperCreated;
+    sharedInstall = prepared.sharedInstall;
+    markTodo(
+      todos,
+      "target",
+      "done",
+      prepared.detail
+    );
+    activeTodoID = "ready";
+    target = await waitForRunning(target);
+    markTodo(todos, "ready", "done", `${target.handle} is running`);
+    activeTodoID = "oauth";
+    const oauth = await runManualOAuthFlow();
+    markTodo(todos, "oauth", "done", "browser flow completed");
+    activeTodoID = "install";
+    const sshTarget = await resolveSSHTarget(target);
+    await installClaudeAuth(sshTarget, oauth);
+    markTodo(
+      todos,
+      "install",
+      "done",
+      sharedInstall ? `installed Claude login on shared home via ${target.handle}` : `installed Claude login on ${target.handle}`
+    );
+    activeTodoID = "verify-primary";
+    await verifyStoredAuth(sshTarget);
+    markTodo(
+      todos,
+      "verify-primary",
+      "done",
+      `${target.handle} fresh login shell sees Claude auth`
+    );
+    activeTodoID = "verify-shared";
+    const sharedCheck = await verifySecondaryMachine(
+      target.id,
+      sharedInstall,
+      Boolean(options.skipCrossCheck)
+    );
+    if (sharedCheck.status === "verified") {
+      markTodo(
+        todos,
+        "verify-shared",
+        "done",
+        `${sharedCheck.handle} also sees stored Claude auth`
+      );
+    } else {
+      markTodo(todos, "verify-shared", "skipped", sharedCheck.reason);
+    }
+  } catch (error) {
+    failureMessage = error instanceof Error ? error.message : "Failed to authenticate Claude";
+    markTodo(todos, activeTodoID, "failed", failureMessage);
+  } finally {
+    if (helperCreated && target && !options.keepHelper) {
+      try {
+        await deleteComputer(target.id);
+        markTodo(
+          todos,
+          "cleanup",
+          "done",
+          `removed temporary helper ${target.handle}`
+        );
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "failed to remove helper";
+        markTodo(todos, "cleanup", "failed", message);
+      }
+    } else if (helperCreated && target && options.keepHelper) {
+      markTodo(
+        todos,
+        "cleanup",
+        "skipped",
+        `kept helper ${target.handle}`
+      );
+    } else {
+      markTodo(todos, "cleanup", "skipped", "no helper created");
+    }
+    printTodoList(todos);
+  }
+  if (failureMessage) {
+    console.error(chalk5.red(`
+${failureMessage}`));
+    process.exit(1);
+  }
+  if (target) {
+    console.log(chalk5.green(`Claude is ready on ${chalk5.bold(target.handle)}.`));
+    console.log();
+  }
+});
+function createTodoList() {
+  return [
+    { id: "target", label: "Pick target computer", state: "pending" },
+    { id: "ready", label: "Wait for machine readiness", state: "pending" },
+    { id: "oauth", label: "Complete Claude browser auth", state: "pending" },
+    { id: "install", label: "Install stored Claude login", state: "pending" },
+    { id: "verify-primary", label: "Verify on target machine", state: "pending" },
+    { id: "verify-shared", label: "Verify shared-home propagation", state: "pending" },
+    { id: "cleanup", label: "Clean up temporary helper", state: "pending" }
+  ];
+}
+function markTodo(items, id, state, detail) {
+  const item = items.find((entry) => entry.id === id);
+  if (!item) {
+    return;
+  }
+  item.state = state;
+  item.detail = detail;
+}
+function printTodoList(items) {
+  console.log();
+  console.log(chalk5.dim("TODO"));
+  console.log();
+  for (const item of items) {
+    const marker = item.state === "done" ? chalk5.green("[x]") : item.state === "skipped" ? chalk5.yellow("[-]") : item.state === "failed" ? chalk5.red("[!]") : chalk5.dim("[ ]");
+    const detail = item.detail ? chalk5.dim(`  ${item.detail}`) : "";
+    console.log(`  ${marker} ${item.label}${detail ? ` ${detail}` : ""}`);
+  }
+  console.log();
+}
+async function prepareTargetMachine(options) {
+  if (options.machine?.trim()) {
+    const computer2 = await resolveComputer(options.machine.trim());
+    assertClaudeAuthTarget(computer2);
+    return {
+      computer: computer2,
+      helperCreated: false,
+      sharedInstall: isSharedInstallTarget(computer2),
+      detail: describeTarget(computer2, false)
+    };
+  }
+  const computers = await listComputers();
+  const filesystemSettings = await getFilesystemSettings().catch(() => null);
+  if (filesystemSettings?.shared_enabled) {
+    const existing = pickSharedRunningComputer(computers);
+    if (existing) {
+      return {
+        computer: existing,
+        helperCreated: false,
+        sharedInstall: true,
+        detail: describeTarget(existing, false)
+      };
+    }
+    const spinner = ora3("Creating temporary shared helper...").start();
+    try {
+      const helper = await createComputer({
+        handle: `claude-auth-${randomSuffix(6)}`,
+        display_name: "Claude Auth Helper",
+        runtime_family: "managed-worker",
+        use_platform_default: true,
+        ssh_enabled: true,
+        vnc_enabled: false
+      });
+      spinner.succeed(`Created temporary helper ${chalk5.bold(helper.handle)}`);
+      return {
+        computer: helper,
+        helperCreated: true,
+        sharedInstall: true,
+        detail: describeTarget(helper, true)
+      };
+    } catch (error) {
+      spinner.fail(
+        error instanceof Error ? error.message : "Failed to create temporary helper"
+      );
+      throw error;
+    }
+  }
+  const computer = await promptForSSHComputer(
+    computers,
+    "Select a computer for Claude auth"
+  );
+  return {
+    computer,
+    helperCreated: false,
+    sharedInstall: isSharedInstallTarget(computer),
+    detail: describeTarget(computer, false)
+  };
+}
+function pickSharedRunningComputer(computers) {
+  const candidates = computers.filter(
+    (computer) => computer.runtime_family === "managed-worker" && computer.filesystem_mode === "shared" && computer.ssh_enabled && computer.status === "running"
+  ).sort(
+    (left, right) => new Date(right.updated_at).getTime() - new Date(left.updated_at).getTime()
+  );
+  return candidates[0] ?? null;
+}
+function assertClaudeAuthTarget(computer) {
+  if (!computer.ssh_enabled) {
+    throw new Error(`${computer.handle} does not have SSH enabled`);
+  }
+}
+function isSharedInstallTarget(computer) {
+  return computer.runtime_family === "managed-worker" && computer.filesystem_mode === "shared";
+}
+function describeTarget(computer, helperCreated) {
+  if (helperCreated) {
+    return `created temporary helper ${computer.handle}`;
+  }
+  if (isSharedInstallTarget(computer)) {
+    return `using shared machine ${computer.handle}`;
+  }
+  return `using ${computer.handle}`;
+}
+async function waitForRunning(initial) {
+  if (initial.status === "running") {
+    return initial;
+  }
+  const spinner = ora3(`Waiting for ${chalk5.bold(initial.handle)} to be ready...`).start();
+  const deadline = Date.now() + readyPollTimeoutMs;
+  let lastStatus = initial.status;
+  while (Date.now() < deadline) {
+    const current = await getComputerByID(initial.id);
+    if (current.status === "running") {
+      spinner.succeed(`${chalk5.bold(current.handle)} is ready`);
+      return current;
+    }
+    if (current.status !== lastStatus) {
+      lastStatus = current.status;
+      spinner.text = `Waiting for ${chalk5.bold(current.handle)}... ${chalk5.dim(current.status)}`;
+    }
+    if (current.status === "error" || current.status === "deleted" || current.status === "stopped") {
+      spinner.fail(`${current.handle} entered ${current.status}`);
+      throw new Error(current.last_error || `${current.handle} entered ${current.status}`);
+    }
+    await delay(readyPollIntervalMs);
+  }
+  spinner.fail(`Timed out waiting for ${initial.handle}`);
+  throw new Error(`timed out waiting for ${initial.handle} to be ready`);
+}
+async function runManualOAuthFlow() {
+  const codeVerifier = base64url(randomBytes(32));
+  const state = randomBytes(16).toString("hex");
+  const codeChallenge = base64url(createHash("sha256").update(codeVerifier).digest());
+  const url = buildAuthorizationURL(codeChallenge, state);
+  console.log("We will open your browser so you can authenticate with Claude.");
+  console.log("If the browser does not open automatically, use the URL below:\n");
+  console.log(url);
+  console.log();
+  try {
+    await openBrowserURL(url);
+  } catch {
+    console.log(chalk5.yellow("Unable to open the browser automatically."));
+  }
+  console.log(
+    "After completing authentication, copy the code shown on the success page."
+  );
+  console.log("You can paste either the full URL, or a value formatted as CODE#STATE.\n");
+  const pasted = (await textInput({
+    message: "Paste the authorization code (or URL) here:"
+  })).trim();
+  if (!pasted) {
+    throw new Error("no authorization code provided");
+  }
+  const parsed = parseAuthorizationInput(pasted, state);
+  const spinner = ora3("Exchanging authorization code...").start();
+  try {
+    const response = await fetch(CLAUDE_OAUTH_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        grant_type: "authorization_code",
+        code: parsed.code,
+        state: parsed.state,
+        redirect_uri: CLAUDE_OAUTH_REDIRECT_URL,
+        client_id: CLAUDE_OAUTH_CLIENT_ID,
+        code_verifier: codeVerifier
+      })
+    });
+    if (!response.ok) {
+      throw new Error(
+        `token exchange failed: ${response.status} ${await response.text()}`
+      );
+    }
+    const payload = await response.json();
+    if (!payload.refresh_token || !payload.scope) {
+      throw new Error("token exchange returned an incomplete response");
+    }
+    spinner.succeed("Authorization code exchanged");
+    return {
+      refreshToken: payload.refresh_token,
+      scope: payload.scope
+    };
+  } catch (error) {
+    spinner.fail(
+      error instanceof Error ? error.message : "Failed to exchange authorization code"
+    );
+    throw error;
+  }
+}
+function buildAuthorizationURL(codeChallenge, state) {
+  const params = new URLSearchParams({
+    code: "true",
+    client_id: CLAUDE_OAUTH_CLIENT_ID,
+    response_type: "code",
+    redirect_uri: CLAUDE_OAUTH_REDIRECT_URL,
+    scope: CLAUDE_OAUTH_SCOPES.join(" "),
+    code_challenge: codeChallenge,
+    code_challenge_method: "S256",
+    state
+  });
+  return `${CLAUDE_OAUTH_AUTHORIZE_URL}?${params.toString()}`;
+}
+function parseAuthorizationInput(value, expectedState) {
+  if (value.startsWith("http://") || value.startsWith("https://")) {
+    const parsed = new URL(value);
+    const code2 = parsed.searchParams.get("code");
+    const state2 = parsed.searchParams.get("state");
+    if (!code2 || !state2) {
+      throw new Error("pasted URL is missing code or state");
+    }
+    if (state2 !== expectedState) {
+      throw new Error("state mismatch detected; restart the authentication flow");
+    }
+    return { code: code2, state: state2 };
+  }
+  const [code, state] = value.split("#", 2).map((part) => part?.trim() ?? "");
+  if (!code || !state) {
+    throw new Error("expected a full URL or a CODE#STATE value");
+  }
+  if (state !== expectedState) {
+    throw new Error("state mismatch detected; restart the authentication flow");
+  }
+  return { code, state };
+}
+async function resolveSSHTarget(computer) {
+  const registered = await ensureDefaultSSHKeyRegistered();
+  const info = await getConnectionInfo(computer.id);
+  if (!info.connection.ssh_available) {
+    throw new Error(`SSH is not available for ${computer.handle}`);
+  }
+  return {
+    handle: computer.handle,
+    host: info.connection.ssh_host,
+    port: info.connection.ssh_port,
+    user: info.connection.ssh_user,
+    identityFile: registered.privateKeyPath
+  };
+}
+async function installClaudeAuth(target, oauth) {
+  const spinner = ora3(`Installing Claude auth on ${chalk5.bold(target.handle)}...`).start();
+  try {
+    const installScript = buildInstallScript(oauth.refreshToken, oauth.scope);
+    const result = await runRemoteBash(target, ["-s"], installScript);
+    if (result.stdout.trim()) {
+      spinner.succeed(`Installed Claude auth on ${chalk5.bold(target.handle)}`);
+      return;
+    }
+    spinner.succeed(`Installed Claude auth on ${chalk5.bold(target.handle)}`);
+  } catch (error) {
+    spinner.fail(
+      error instanceof Error ? error.message : `Failed to install Claude auth on ${target.handle}`
+    );
+    throw error;
+  }
+}
+function buildInstallScript(refreshToken, scopes) {
+  const tokenMarker = `TOKEN_${randomSuffix(12)}`;
+  const scopeMarker = `SCOPES_${randomSuffix(12)}`;
+  return [
+    "set -euo pipefail",
+    'command -v claude >/dev/null 2>&1 || { echo "claude is not installed on this computer" >&2; exit 1; }',
+    `export CLAUDE_CODE_OAUTH_REFRESH_TOKEN="$(cat <<'` + tokenMarker + "'",
+    refreshToken,
+    tokenMarker,
+    ')"',
+    `export CLAUDE_CODE_OAUTH_SCOPES="$(cat <<'` + scopeMarker + "'",
+    scopes,
+    scopeMarker,
+    ')"',
+    "claude auth login",
+    "unset CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+    "unset CLAUDE_CODE_OAUTH_SCOPES"
+  ].join("\n");
+}
+async function verifyStoredAuth(target) {
+  const command = freshShellCommand("claude auth status --json");
+  const result = await runRemoteBash(target, ["-lc", command]);
+  const payload = parseStatusOutput(result.stdout);
+  if (!payload.loggedIn) {
+    throw new Error(`Claude auth is not visible on ${target.handle}`);
+  }
+}
+function freshShellCommand(inner) {
+  return [
+    "env -i",
+    'HOME="$HOME"',
+    'USER="${USER:-node}"',
+    'SHELL="/bin/bash"',
+    'PATH="$HOME/.local/bin:/usr/local/bin:/usr/bin:/bin"',
+    "bash -lc",
+    shellQuote(inner)
+  ].join(" ");
+}
+function parseStatusOutput(stdout) {
+  const start = stdout.indexOf("{");
+  const end = stdout.lastIndexOf("}");
+  if (start === -1 || end === -1 || end <= start) {
+    throw new Error("could not parse claude auth status output");
+  }
+  const parsed = JSON.parse(stdout.slice(start, end + 1));
+  return { loggedIn: parsed.loggedIn === true };
+}
+async function verifySecondaryMachine(primaryComputerID, sharedInstall, skip) {
+  if (!sharedInstall) {
+    return { status: "skipped", reason: "target uses isolated filesystem" };
+  }
+  if (skip) {
+    return { status: "skipped", reason: "cross-check skipped by flag" };
+  }
+  const secondary = (await listComputers()).filter(
+    (computer) => computer.id !== primaryComputerID && computer.runtime_family === "managed-worker" && computer.filesystem_mode === "shared" && computer.ssh_enabled && computer.status === "running"
+  ).sort(
+    (left, right) => new Date(right.updated_at).getTime() - new Date(left.updated_at).getTime()
+  )[0];
+  if (!secondary) {
+    return {
+      status: "skipped",
+      reason: "no second running shared managed-worker was available"
+    };
+  }
+  const sshTarget = await resolveSSHTarget(secondary);
+  await verifyStoredAuth(sshTarget);
+  return { status: "verified", handle: secondary.handle };
+}
+async function runRemoteBash(target, bashArgs, script) {
+  const args = [
+    "-T",
+    "-i",
+    target.identityFile,
+    "-p",
+    String(target.port),
+    `${target.user}@${target.host}`,
+    "bash",
+    ...bashArgs
+  ];
+  return new Promise((resolve, reject) => {
+    const child = spawn2("ssh", args, {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0) {
+        resolve({ stdout, stderr });
+        return;
+      }
+      const message = stderr.trim() || stdout.trim() || `ssh exited with code ${code ?? 1}`;
+      reject(new Error(message));
+    });
+    if (script !== void 0) {
+      child.stdin.end(script);
+    } else {
+      child.stdin.end();
+    }
+  });
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function base64url(buffer) {
+  return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function randomSuffix(length) {
+  return randomBytes(Math.ceil(length / 2)).toString("hex").slice(0, length);
+}
+function delay(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
+// src/commands/computers.ts
+import { Command as Command5 } from "commander";
+import chalk6 from "chalk";
+import ora4 from "ora";
+import { select as select2, input as textInput2, confirm } from "@inquirer/prompts";
+
+// src/lib/machine-sources.ts
+async function getMachineSourceSettings() {
+  return api("/v1/me/machine-source");
+}
+async function upsertMachineSource(input) {
+  return api("/v1/me/machine-source", {
+    method: "PUT",
+    body: JSON.stringify(input)
+  });
+}
+async function clearMachineSourceDefault() {
+  return api("/v1/me/machine-source", {
+    method: "DELETE"
+  });
+}
+async function rebuildMachineSource(sourceID) {
+  return api(`/v1/me/machine-source/${encodeURIComponent(sourceID)}/rebuild`, {
+    method: "POST"
+  });
+}
+async function deleteMachineSource(sourceID) {
+  return api(`/v1/me/machine-source/${encodeURIComponent(sourceID)}`, {
+    method: "DELETE"
+  });
+}
+function summarizeMachineSourceSelection(settings) {
+  if (settings.platform_default || !settings.default_machine_source) {
+    return "AgentComputer platform default image";
+  }
+  return summarizeMachineSource(settings.default_machine_source);
+}
+function summarizeMachineSource(source) {
+  if (source.kind === "oci-image") {
+    return source.requested_ref || "OCI image";
+  }
+  const parts = [
+    source.git_url || "Nix git source",
+    source.git_ref ? `ref ${source.git_ref}` : "",
+    source.git_subpath ? `subpath ${source.git_subpath}` : ""
+  ].filter(Boolean);
+  return parts.join(" | ");
+}
+
+// src/commands/computers.ts
 function isInternalCondition(value) {
   return /^[A-Z][a-zA-Z]+$/.test(value);
 }
@@ -1525,32 +2084,38 @@ function printComputer(computer) {
   const ssh = computer.ssh_enabled ? formatSSHCommand2(computer.handle, computer.ssh_host, computer.ssh_port) : "disabled";
   const isCustom = computer.runtime_family === "custom-machine";
   console.log();
-  console.log(`  ${chalk4.bold.white(computer.handle)}  ${formatStatus(computer.status)}`);
+  console.log(`  ${chalk6.bold.white(computer.handle)}  ${formatStatus(computer.status)}`);
   console.log();
-  console.log(`  ${chalk4.dim("ID")}        ${computer.id}`);
-  console.log(`  ${chalk4.dim("Tier")}      ${computer.tier}`);
+  console.log(`  ${chalk6.dim("ID")}        ${computer.id}`);
+  console.log(`  ${chalk6.dim("Tier")}      ${computer.tier}`);
   if (isCustom) {
-    console.log(`  ${chalk4.dim("Runtime")}   ${computer.runtime_family}`);
-    console.log(`  ${chalk4.dim("Source")}    ${computer.source_kind}`);
-    console.log(`  ${chalk4.dim("Image")}     ${computer.image_family}`);
+    console.log(`  ${chalk6.dim("Runtime")}   ${computer.runtime_family}`);
+    console.log(`  ${chalk6.dim("Source")}    ${computer.source_kind}`);
+    console.log(`  ${chalk6.dim("Image")}     ${computer.image_family}`);
+  } else {
+    console.log(`  ${chalk6.dim("Runtime")}   ${computer.runtime_family}`);
+    console.log(`  ${chalk6.dim("Launch")}    ${formatManagedWorkerLaunchSource(computer)}`);
+    if (computer.user_source_id && computer.resolved_image_ref) {
+      console.log(`  ${chalk6.dim("Image")}     ${computer.resolved_image_ref}`);
+    }
   }
-  console.log(`  ${chalk4.dim("Primary")}   :${computer.primary_port}${computer.primary_path}`);
-  console.log(`  ${chalk4.dim("Health")}    ${computer.healthcheck_type}${computer.healthcheck_value ? ` (${computer.healthcheck_value})` : ""}`);
+  console.log(`  ${chalk6.dim("Primary")}   :${computer.primary_port}${computer.primary_path}`);
+  console.log(`  ${chalk6.dim("Health")}    ${computer.healthcheck_type}${computer.healthcheck_value ? ` (${computer.healthcheck_value})` : ""}`);
   console.log();
-  console.log(`  ${chalk4.dim("Gateway")}   ${chalk4.cyan(webURL(computer))}`);
-  console.log(`  ${chalk4.dim("VNC")}       ${vnc ? chalk4.cyan(vnc) : chalk4.dim("not available")}`);
-  console.log(`  ${chalk4.dim("Terminal")}  ${terminal ? chalk4.cyan(terminal) : chalk4.dim("not available")}`);
-  console.log(`  ${chalk4.dim("SSH")}       ${computer.ssh_enabled ? chalk4.white(ssh) : chalk4.dim(ssh)}`);
+  console.log(`  ${chalk6.dim("Gateway")}   ${chalk6.cyan(webURL(computer))}`);
+  console.log(`  ${chalk6.dim("VNC")}       ${vnc ? chalk6.cyan(vnc) : chalk6.dim("not available")}`);
+  console.log(`  ${chalk6.dim("Terminal")}  ${terminal ? chalk6.cyan(terminal) : chalk6.dim("not available")}`);
+  console.log(`  ${chalk6.dim("SSH")}       ${computer.ssh_enabled ? chalk6.white(ssh) : chalk6.dim(ssh)}`);
   if (computer.last_error) {
     console.log();
     if (isInternalCondition(computer.last_error)) {
-      console.log(`  ${chalk4.dim("Condition")} ${chalk4.dim(computer.last_error)}`);
+      console.log(`  ${chalk6.dim("Condition")} ${chalk6.dim(computer.last_error)}`);
     } else {
-      console.log(`  ${chalk4.dim("Error")}     ${chalk4.red(computer.last_error)}`);
+      console.log(`  ${chalk6.dim("Error")}     ${chalk6.red(computer.last_error)}`);
     }
   }
   console.log();
-  console.log(`  ${chalk4.dim("Created")}   ${timeAgo(computer.created_at)}`);
+  console.log(`  ${chalk6.dim("Created")}   ${timeAgo(computer.created_at)}`);
   console.log();
 }
 function formatSSHCommand2(user, host, port) {
@@ -1562,22 +2127,41 @@ function formatSSHCommand2(user, host, port) {
   }
   return `ssh -p ${port} ${user}@${host}`;
 }
+function formatManagedWorkerLaunchSource(computer) {
+  if (!computer.user_source_id) {
+    return "AgentComputer managed-worker platform default";
+  }
+  if (computer.source_repo_url) {
+    let value = computer.source_repo_url;
+    if (computer.source_ref) {
+      value += ` @ ${computer.source_ref}`;
+    }
+    if (computer.source_subpath) {
+      value += ` # ${computer.source_subpath}`;
+    }
+    return `saved nix-git source ${computer.user_source_id} (${value})`;
+  }
+  if (computer.source_ref) {
+    return `saved oci-image source ${computer.user_source_id} (${computer.source_ref})`;
+  }
+  return `saved custom source ${computer.user_source_id}`;
+}
 function printComputerTable(computers) {
   const handleWidth = Math.max(6, ...computers.map((c) => c.handle.length));
   const statusWidth = 12;
   const createdWidth = 10;
   console.log();
   console.log(
-    `  ${chalk4.dim(padEnd("Handle", handleWidth + 2))}${chalk4.dim(padEnd("Status", statusWidth + 2))}${chalk4.dim(padEnd("Created", createdWidth + 2))}${chalk4.dim("URL")}`
+    `  ${chalk6.dim(padEnd("Handle", handleWidth + 2))}${chalk6.dim(padEnd("Status", statusWidth + 2))}${chalk6.dim(padEnd("Created", createdWidth + 2))}${chalk6.dim("URL")}`
   );
   console.log(
-    `  ${chalk4.dim("-".repeat(handleWidth + 2))}${chalk4.dim("-".repeat(statusWidth + 2))}${chalk4.dim("-".repeat(createdWidth + 2))}${chalk4.dim("-".repeat(20))}`
+    `  ${chalk6.dim("-".repeat(handleWidth + 2))}${chalk6.dim("-".repeat(statusWidth + 2))}${chalk6.dim("-".repeat(createdWidth + 2))}${chalk6.dim("-".repeat(20))}`
   );
   for (const computer of computers) {
     const status = formatStatus(computer.status);
-    const created = chalk4.dim(timeAgo(computer.created_at));
+    const created = chalk6.dim(timeAgo(computer.created_at));
     console.log(
-      `  ${chalk4.white(padEnd(computer.handle, handleWidth + 2))}${padEnd(status, statusWidth + 2)}${padEnd(created, createdWidth + 2)}${chalk4.cyan(webURL(computer))}`
+      `  ${chalk6.white(padEnd(computer.handle, handleWidth + 2))}${padEnd(status, statusWidth + 2)}${padEnd(created, createdWidth + 2)}${chalk6.cyan(webURL(computer))}`
     );
   }
   console.log();
@@ -1587,29 +2171,29 @@ function printComputerTableVerbose(computers) {
   const statusWidth = 10;
   console.log();
   console.log(
-    `  ${chalk4.dim(padEnd("Handle", handleWidth + 2))}${chalk4.dim(padEnd("Status", statusWidth + 2))}${chalk4.dim("URLs")}`
+    `  ${chalk6.dim(padEnd("Handle", handleWidth + 2))}${chalk6.dim(padEnd("Status", statusWidth + 2))}${chalk6.dim("URLs")}`
   );
   console.log(
-    `  ${chalk4.dim("-".repeat(handleWidth + 2))}${chalk4.dim("-".repeat(statusWidth + 2))}${chalk4.dim("-".repeat(20))}`
+    `  ${chalk6.dim("-".repeat(handleWidth + 2))}${chalk6.dim("-".repeat(statusWidth + 2))}${chalk6.dim("-".repeat(20))}`
   );
   for (const computer of computers) {
     const status = formatStatus(computer.status);
     const vnc = vncURL(computer);
     const terminal = terminalURL(computer);
     console.log(
-      `  ${chalk4.white(padEnd(computer.handle, handleWidth + 2))}${padEnd(status, statusWidth + 2)}${chalk4.cyan(webURL(computer))}`
+      `  ${chalk6.white(padEnd(computer.handle, handleWidth + 2))}${padEnd(status, statusWidth + 2)}${chalk6.cyan(webURL(computer))}`
     );
     console.log(
-      `  ${padEnd("", handleWidth + 2)}${padEnd("", statusWidth + 2)}${chalk4.dim(vnc ?? "VNC not available")}`
+      `  ${padEnd("", handleWidth + 2)}${padEnd("", statusWidth + 2)}${chalk6.dim(vnc ?? "VNC not available")}`
     );
     console.log(
-      `  ${padEnd("", handleWidth + 2)}${padEnd("", statusWidth + 2)}${chalk4.dim(terminal ?? "Terminal not available")}`
+      `  ${padEnd("", handleWidth + 2)}${padEnd("", statusWidth + 2)}${chalk6.dim(terminal ?? "Terminal not available")}`
     );
   }
   console.log();
 }
-var lsCommand = new Command4("ls").description("List computers").option("--json", "Print raw JSON").option("-v, --verbose", "Show all URLs for each computer").action(async (options) => {
-  const spinner = options.json ? null : ora3("Fetching computers...").start();
+var lsCommand = new Command5("ls").description("List computers").option("--json", "Print raw JSON").option("-v, --verbose", "Show all URLs for each computer").action(async (options) => {
+  const spinner = options.json ? null : ora4("Fetching computers...").start();
   try {
     const computers = await listComputers();
     spinner?.stop();
@@ -1619,7 +2203,7 @@ var lsCommand = new Command4("ls").description("List computers").option("--json"
     }
     if (computers.length === 0) {
       console.log();
-      console.log(chalk4.dim("  No computers found."));
+      console.log(chalk6.dim("  No computers found."));
       console.log();
       return;
     }
@@ -1639,8 +2223,8 @@ var lsCommand = new Command4("ls").description("List computers").option("--json"
     process.exit(1);
   }
 });
-var getCommand = new Command4("get").description("Show computer details").argument("<id-or-handle>", "Computer id or handle").option("--json", "Print raw JSON").action(async (identifier, options) => {
-  const spinner = options.json ? null : ora3("Fetching computer...").start();
+var getCommand = new Command5("get").description("Show computer details").argument("<id-or-handle>", "Computer id or handle").option("--json", "Print raw JSON").action(async (identifier, options) => {
+  const spinner = options.json ? null : ora4("Fetching computer...").start();
   try {
     const computer = await resolveComputer(identifier);
     spinner?.stop();
@@ -1660,19 +2244,28 @@ var getCommand = new Command4("get").description("Show computer details").argume
     process.exit(1);
   }
 });
-var createCommand = new Command4("create").description("Create a computer").argument("[handle]", "Optional computer handle").option("--name <display-name>", "Display name").option("--tier <tier>", "Tier override").option("--interactive", "Prompt for runtime choices").option("--runtime-family <runtime-family>", "managed-worker or custom-machine").option("--source-kind <source-kind>", "none or oci-image").option("--image-family <family>", "Image family override").option("--image-ref <image>", "Resolved image override").option("--primary-port <port>", "Primary app port").option("--primary-path <path>", "Primary app path").option("--healthcheck-type <type>", "http or tcp").option("--healthcheck-value <value>", "Health check path or port").option("--ssh-enabled", "Enable SSH access").option("--ssh-disabled", "Disable SSH access").option("--vnc-enabled", "Enable VNC access").option("--vnc-disabled", "Disable VNC access").action(async (handle, options) => {
+var createCommand = new Command5("create").description("Create a computer").argument("[handle]", "Optional computer handle").option("--name <display-name>", "Display name").option("--tier <tier>", "Tier override").option("--interactive", "Prompt for runtime choices").option("--runtime-family <runtime-family>", "managed-worker or custom-machine").option("--source-kind <source-kind>", "none or oci-image").option("--image-family <family>", "Image family override").option("--image-ref <image>", "Resolved image override").option("--use-platform-default", "Use the AgentComputer platform default image").option("--primary-port <port>", "Primary app port").option("--primary-path <path>", "Primary app path").option("--healthcheck-type <type>", "http or tcp").option("--healthcheck-value <value>", "Health check path or port").option("--ssh-enabled", "Enable SSH access").option("--ssh-disabled", "Disable SSH access").option("--vnc-enabled", "Enable VNC access").option("--vnc-disabled", "Disable VNC access").action(async (handle, options) => {
   let spinner;
   let timer;
   let startTime = 0;
   try {
     const selectedOptions = await resolveCreateOptions(options);
     const runtimeFamily = effectiveRuntimeFamily(selectedOptions.runtimeFamily);
+    const machineSourceSettings = runtimeFamily === "managed-worker" ? await getMachineSourceSettings().catch(() => null) : null;
     const filesystemSettings = await loadFilesystemSettingsForCreate(runtimeFamily);
+    const machineSourceNote = createMachineSourceNote(
+      runtimeFamily,
+      machineSourceSettings,
+      Boolean(selectedOptions.usePlatformDefault)
+    );
+    if (machineSourceNote) {
+      console.log(chalk6.dim(machineSourceNote));
+    }
     const provisioningNote = createProvisioningNote(runtimeFamily, filesystemSettings);
     if (provisioningNote) {
-      console.log(chalk4.dim(provisioningNote));
+      console.log(chalk6.dim(provisioningNote));
     }
-    spinner = ora3(createSpinnerText(runtimeFamily, filesystemSettings, 0)).start();
+    spinner = ora4(createSpinnerText(runtimeFamily, filesystemSettings, 0)).start();
     startTime = Date.now();
     timer = setInterval(() => {
       const elapsed2 = (Date.now() - startTime) / 1e3;
@@ -1688,6 +2281,7 @@ var createCommand = new Command4("create").description("Create a computer").argu
       source_kind: parseSourceKindOption(selectedOptions.sourceKind),
       image_family: selectedOptions.imageFamily,
       image_ref: selectedOptions.imageRef,
+      use_platform_default: selectedOptions.usePlatformDefault,
       primary_port: parseOptionalPort(selectedOptions.primaryPort),
       primary_path: selectedOptions.primaryPath,
       healthcheck_type: parseHealthcheckTypeOption(selectedOptions.healthcheckType),
@@ -1708,7 +2302,7 @@ var createCommand = new Command4("create").description("Create a computer").argu
     }
     const elapsed = ((Date.now() - startTime) / 1e3).toFixed(1);
     spinner.succeed(
-      chalk4.green(`Created ${chalk4.bold(computer.handle)} ${chalk4.dim(`[${elapsed}s]`)}`)
+      chalk6.green(`Created ${chalk6.bold(computer.handle)} ${chalk6.dim(`[${elapsed}s]`)}`)
     );
     printComputer(computer);
   } catch (error) {
@@ -1717,18 +2311,17 @@ var createCommand = new Command4("create").description("Create a computer").argu
     }
     const message = error instanceof Error ? error.message : "Failed to create computer";
     if (spinner) {
-      const suffix = startTime ? ` ${chalk4.dim(`[${((Date.now() - startTime) / 1e3).toFixed(1)}s]`)}` : "";
+      const suffix = startTime ? ` ${chalk6.dim(`[${((Date.now() - startTime) / 1e3).toFixed(1)}s]`)}` : "";
       spinner.fail(`${message}${suffix}`);
     } else {
-      console.error(chalk4.red(message));
+      console.error(chalk6.red(message));
     }
     process.exit(1);
   }
 });
 async function resolveCreateOptions(options) {
   const selectedOptions = { ...options };
-  const hasExplicitRuntimeSelection = Boolean(selectedOptions.runtimeFamily) || Boolean(selectedOptions.imageRef) || Boolean(selectedOptions.sourceKind);
-  const shouldPrompt = Boolean(selectedOptions.interactive) || !hasExplicitRuntimeSelection;
+  const shouldPrompt = Boolean(selectedOptions.interactive);
   if (!process.stdin.isTTY || !process.stdout.isTTY || !shouldPrompt) {
     validateCreateOptions(selectedOptions);
     return selectedOptions;
@@ -1750,9 +2343,9 @@ async function resolveCreateOptions(options) {
   if (runtimeChoice === "custom-machine") {
     selectedOptions.runtimeFamily = "custom-machine";
     selectedOptions.sourceKind = "oci-image";
-    selectedOptions.imageRef = (await textInput({ message: "OCI image ref (required):" })).trim();
-    selectedOptions.primaryPort = (await textInput({ message: "Primary port:", default: "3000" })).trim();
-    selectedOptions.primaryPath = (await textInput({ message: "Primary path:", default: "/" })).trim();
+    selectedOptions.imageRef = (await textInput2({ message: "OCI image ref (required):" })).trim();
+    selectedOptions.primaryPort = (await textInput2({ message: "Primary port:", default: "3000" })).trim();
+    selectedOptions.primaryPath = (await textInput2({ message: "Primary path:", default: "/" })).trim();
     selectedOptions.healthcheckType = await select2({
       message: "Healthcheck type",
       choices: [
@@ -1761,7 +2354,7 @@ async function resolveCreateOptions(options) {
       ],
       default: "tcp"
     });
-    selectedOptions.healthcheckValue = (await textInput({ message: "Healthcheck value (optional):" })).trim();
+    selectedOptions.healthcheckValue = (await textInput2({ message: "Healthcheck value (optional):" })).trim();
     selectedOptions.sshEnabled = await confirm({
       message: "Enable SSH?",
       default: false
@@ -1775,28 +2368,28 @@ async function resolveCreateOptions(options) {
   validateCreateOptions(selectedOptions);
   return selectedOptions;
 }
-var removeCommand = new Command4("rm").description("Delete a computer").argument("<id-or-handle>", "Computer id or handle").option("-y, --yes", "Skip confirmation prompt").action(async (identifier, options, cmd) => {
+var removeCommand = new Command5("rm").description("Delete a computer").argument("<id-or-handle>", "Computer id or handle").option("-y, --yes", "Skip confirmation prompt").action(async (identifier, options, cmd) => {
   const globalYes = cmd.parent?.opts()?.yes;
   const skipConfirm = Boolean(options.yes || globalYes);
-  const spinner = ora3("Resolving computer...").start();
+  const spinner = ora4("Resolving computer...").start();
   try {
     const computer = await resolveComputer(identifier);
     spinner.stop();
     if (!skipConfirm && process.stdin.isTTY) {
       const confirmed = await confirm({
-        message: `Delete computer ${chalk4.bold(computer.handle)}?`,
+        message: `Delete computer ${chalk6.bold(computer.handle)}?`,
         default: false
       });
       if (!confirmed) {
-        console.log(chalk4.dim("  Cancelled."));
+        console.log(chalk6.dim("  Cancelled."));
         return;
       }
     }
-    const deleteSpinner = ora3("Deleting computer...").start();
+    const deleteSpinner = ora4("Deleting computer...").start();
     await api(`/v1/computers/${computer.id}`, {
       method: "DELETE"
     });
-    deleteSpinner.succeed(chalk4.green(`Deleted ${chalk4.bold(computer.handle)}`));
+    deleteSpinner.succeed(chalk6.green(`Deleted ${chalk6.bold(computer.handle)}`));
   } catch (error) {
     spinner.fail(
       error instanceof Error ? error.message : "Failed to delete computer"
@@ -1836,17 +2429,33 @@ function createProvisioningNote(runtimeFamily, filesystemSettings) {
   }
   return "Using isolated storage for this desktop.";
 }
+function createMachineSourceNote(runtimeFamily, machineSourceSettings, usePlatformDefault) {
+  if (runtimeFamily !== "managed-worker") {
+    return null;
+  }
+  if (usePlatformDefault) {
+    return "Using the AgentComputer platform default image for this machine.";
+  }
+  if (!machineSourceSettings) {
+    return null;
+  }
+  if (machineSourceSettings.platform_default || !machineSourceSettings.default_machine_source) {
+    return "Using the AgentComputer platform default image.";
+  }
+  return `Using managed-worker image source: ${summarizeMachineSourceSelection(machineSourceSettings)}.`;
+}
 function createSpinnerText(runtimeFamily, filesystemSettings, elapsedSeconds) {
-  const elapsedLabel = chalk4.dim(`${elapsedSeconds.toFixed(1)}s`);
+  const elapsedLabel = chalk6.dim(`${elapsedSeconds.toFixed(1)}s`);
   if (runtimeFamily === "managed-worker" && filesystemSettings?.shared_enabled && elapsedSeconds >= 5) {
-    return `Creating computer... ${elapsedLabel} ${chalk4.dim("mounting shared home")}`;
+    return `Creating computer... ${elapsedLabel} ${chalk6.dim("mounting shared home")}`;
   }
   return `Creating computer... ${elapsedLabel}`;
 }
 function validateCreateOptions(options) {
   const runtimeFamily = parseRuntimeFamilyOption(options.runtimeFamily);
   const sourceKind = parseSourceKindOption(options.sourceKind);
-  if (runtimeFamily === "custom-machine" && (typeof options.imageRef !== "string" || options.imageRef.trim() === "")) {
+  const imageRef = options.imageRef?.trim();
+  if (runtimeFamily === "custom-machine" && !imageRef) {
     throw new Error("--image-ref is required for --runtime-family custom-machine");
   }
   if (runtimeFamily === "custom-machine" && sourceKind === "none") {
@@ -1855,6 +2464,12 @@ function validateCreateOptions(options) {
   if (runtimeFamily === "custom-machine" && options.vncEnabled) {
     throw new Error("custom-machine does not support platform VNC");
   }
+  if (runtimeFamily === "custom-machine" && options.usePlatformDefault) {
+    throw new Error("--use-platform-default cannot be used with --runtime-family custom-machine");
+  }
+  if (imageRef && options.usePlatformDefault) {
+    throw new Error("choose either --image-ref or --use-platform-default");
+  }
 }
 function parseSourceKindOption(value) {
   switch (value) {
@@ -1900,7 +2515,7 @@ function resolveOptionalToggle(enabled, disabled, label) {
 }
 
 // src/commands/completion.ts
-import { Command as Command5 } from "commander";
+import { Command as Command6 } from "commander";
 var ZSH_SCRIPT = `#compdef computer agentcomputer aicomputer
 
 _computer() {
@@ -1909,9 +2524,12 @@ _computer() {
     'login:Authenticate the CLI'
     'logout:Remove stored API key'
     'whoami:Show current user'
+    'claude-auth:Authenticate Claude Code on a computer'
+    'claude-login:Alias for claude-auth'
     'create:Create a computer'
     'ls:List computers'
     'get:Show computer details'
+    'image:Manage machine image sources'
     'open:Open in browser'
     'ssh:SSH into a computer'
     'ports:Manage published ports'
@@ -1930,6 +2548,15 @@ _computer() {
     'rm:Unpublish an app port'
   )
 
+  local -a image_commands
+  image_commands=(
+    'ls:List machine image sources'
+    'save:Create or update a machine image source'
+    'default:Set the default machine image source'
+    'rebuild:Rebuild a machine image source'
+    'rm:Delete a machine image source'
+  )
+
   _arguments -C \\
     '(-h --help)'{-h,--help}'[Display help]' \\
     '(-V --version)'{-V,--version}'[Show version]' \\
@@ -1951,6 +2578,12 @@ _computer() {
         whoami)
           _arguments '--json[Print raw JSON]'
           ;;
+        claude-auth|claude-login)
+          _arguments \\
+            '--machine[Use a specific computer]:computer:_computer_handles' \\
+            '--keep-helper[Keep a temporary helper machine]' \\
+            '--skip-cross-check[Skip second-machine verification]'
+          ;;
         create)
           _arguments \\
             '--name[Display name]:name:' \\
@@ -1960,6 +2593,7 @@ _computer() {
             '--source-kind[Source kind]:kind:(none oci-image)' \\
             '--image-family[Image family]:family:' \\
             '--image-ref[Image reference]:image:' \\
+            '--use-platform-default[Use platform default image]' \\
             '--primary-port[Primary app port]:port:' \\
             '--primary-path[Primary app path]:path:' \\
             '--healthcheck-type[Healthcheck type]:type:(http tcp)' \\
@@ -1980,6 +2614,50 @@ _computer() {
             '--json[Print raw JSON]' \\
             '1:computer:_computer_handles'
           ;;
+        image)
+          _arguments -C \\
+            '1:command:->image_command' \\
+            '*::arg:->image_args'
+          case "$state" in
+            image_command)
+              _describe -t commands 'image command' image_commands
+              ;;
+            image_args)
+              case "$words[2]" in
+                ls)
+                  _arguments '--json[Print raw JSON]'
+                  ;;
+                save)
+                  _arguments \\
+                    '--id[source id]:id:' \\
+                    '--kind[source kind]:kind:(oci-image nix-git)' \\
+                    '--requested-ref[OCI image ref or resolved ref]:ref:' \\
+                    '--git-url[Git URL]:url:' \\
+                    '--git-ref[Git ref]:ref:' \\
+                    '--git-subpath[Git subpath]:path:' \\
+                    '--set-as-default[Select as default after saving]' \\
+                    '--json[Print raw JSON]'
+                  ;;
+                default)
+                  _arguments \\
+                    '--json[Print raw JSON]' \\
+                    '1:source id:_machine_source_ids'
+                  ;;
+                rebuild)
+                  _arguments \\
+                    '--json[Print raw JSON]' \\
+                    '1:source id:_machine_source_ids'
+                  ;;
+                rm)
+                  _arguments \\
+                    '--json[Print raw JSON]' \\
+                    '(-y --yes)'{-y,--yes}'[Skip confirmation]' \\
+                    '1:source id:_machine_source_ids'
+                  ;;
+              esac
+              ;;
+          esac
+          ;;
         open)
           _arguments \\
             '--vnc[Open VNC desktop]' \\
@@ -2039,13 +2717,22 @@ _computer_handles() {
   fi
 }
 
+_machine_source_ids() {
+  local -a ids
+  local cli="\${words[1]:-computer}"
+  if ids=(\${(f)"$(\${cli} image ls --json 2>/dev/null | grep '"id"' | sed 's/.*"id": "\\([^"]*\\)".*/\\1/')"}); then
+    _describe -t ids 'machine image source' ids
+  fi
+}
+
 _computer "$@"`;
 var BASH_SCRIPT = `_computer() {
   local cur prev words cword
   _init_completion || return
 
-  local commands="login logout whoami create ls get open ssh ports agent fleet acp rm completion help"
+  local commands="login logout whoami claude-auth claude-login create ls get image open ssh ports agent fleet acp rm completion help"
   local ports_commands="ls publish rm"
+  local image_commands="ls save default rebuild rm"
 
   if [[ $cword -eq 1 ]]; then
     COMPREPLY=($(compgen -W "$commands" -- "$cur"))
@@ -2061,12 +2748,60 @@ var BASH_SCRIPT = `_computer() {
     whoami)
       COMPREPLY=($(compgen -W "--json" -- "$cur"))
       ;;
+    claude-auth|claude-login)
+      COMPREPLY=($(compgen -W "--machine --keep-helper --skip-cross-check" -- "$cur"))
+      ;;
     create)
-      COMPREPLY=($(compgen -W "--name --tier --interactive --runtime-family --source-kind --image-family --image-ref --primary-port --primary-path --healthcheck-type --healthcheck-value --ssh-enabled --ssh-disabled --vnc-enabled --vnc-disabled" -- "$cur"))
+      COMPREPLY=($(compgen -W "--name --tier --interactive --runtime-family --source-kind --image-family --image-ref --use-platform-default --primary-port --primary-path --healthcheck-type --healthcheck-value --ssh-enabled --ssh-disabled --vnc-enabled --vnc-disabled" -- "$cur"))
       ;;
     ls)
       COMPREPLY=($(compgen -W "--json --verbose -v" -- "$cur"))
       ;;
+    image)
+      if [[ $cword -eq 2 ]]; then
+        COMPREPLY=($(compgen -W "$image_commands" -- "$cur"))
+      else
+        case "\${words[2]}" in
+          ls)
+            COMPREPLY=($(compgen -W "--json" -- "$cur"))
+            ;;
+          save)
+            COMPREPLY=($(compgen -W "--id --kind --requested-ref --git-url --git-ref --git-subpath --set-as-default --json" -- "$cur"))
+            ;;
+          default|rebuild|rm)
+            case "\${words[2]}" in
+              default)
+                if [[ "$cur" == -* ]]; then
+                  COMPREPLY=($(compgen -W "--json" -- "$cur"))
+                else
+                  local source_ids cli="\${words[0]:-computer}"
+                  source_ids=$(\${cli} image ls --json 2>/dev/null | grep '"id"' | sed 's/.*"id": "([^"]*)".*/\\1/')
+                  COMPREPLY=($(compgen -W "$source_ids" -- "$cur"))
+                fi
+                ;;
+              rebuild)
+                if [[ "$cur" == -* ]]; then
+                  COMPREPLY=($(compgen -W "--json" -- "$cur"))
+                else
+                  local source_ids cli="\${words[0]:-computer}"
+                  source_ids=$(\${cli} image ls --json 2>/dev/null | grep '"id"' | sed 's/.*"id": "([^"]*)".*/\\1/')
+                  COMPREPLY=($(compgen -W "$source_ids" -- "$cur"))
+                fi
+                ;;
+              rm)
+                if [[ "$cur" == -* ]]; then
+                  COMPREPLY=($(compgen -W "--json --yes -y" -- "$cur"))
+                else
+                  local source_ids cli="\${words[0]:-computer}"
+                  source_ids=$(\${cli} image ls --json 2>/dev/null | grep '"id"' | sed 's/.*"id": "([^"]*)".*/\\1/')
+                  COMPREPLY=($(compgen -W "$source_ids" -- "$cur"))
+                fi
+                ;;
+            esac
+            ;;
+        esac
+      fi
+      ;;
     get|open|ssh|rm)
       if [[ $cword -eq 2 ]]; then
         local handles cli="\${words[0]:-computer}"
@@ -2098,7 +2833,7 @@ var BASH_SCRIPT = `_computer() {
 }
 
 complete -F _computer computer agentcomputer aicomputer`;
-var completionCommand = new Command5("completion").description("Generate shell completions").argument("<shell>", "Shell type (bash or zsh)").action((shell) => {
+var completionCommand = new Command6("completion").description("Generate shell completions").argument("<shell>", "Shell type (bash or zsh)").action((shell) => {
   switch (shell) {
     case "zsh":
       console.log(ZSH_SCRIPT);
@@ -2112,19 +2847,299 @@ var completionCommand = new Command5("completion").description("Generate shell c
   }
 });
 
+// src/commands/images.ts
+import { confirm as confirm2, input as textInput3, select as select3 } from "@inquirer/prompts";
+import { Command as Command7 } from "commander";
+import chalk7 from "chalk";
+import ora5 from "ora";
+var imageCommand = new Command7("image").description("Manage machine image sources");
+imageCommand.command("ls").description("List machine image sources").option("--json", "Print raw JSON").action(async (options) => {
+  const spinner = options.json ? null : ora5("Fetching machine images...").start();
+  try {
+    const settings = await getMachineSourceSettings();
+    spinner?.stop();
+    if (options.json) {
+      console.log(JSON.stringify(settings, null, 2));
+      return;
+    }
+    printMachineSourceSettings(settings);
+  } catch (error) {
+    if (spinner) {
+      spinner.fail(error instanceof Error ? error.message : "Failed to fetch machine images");
+    } else {
+      console.error(error instanceof Error ? error.message : "Failed to fetch machine images");
+    }
+    process.exit(1);
+  }
+});
+imageCommand.command("save").description("Create or update a machine image source").option("--id <id>", "Existing source id to update").option("--kind <kind>", "oci-image or nix-git").option("--requested-ref <ref>", "OCI image ref or explicit resolved ref").option("--git-url <url>", "Repository URL for a Nix git source").option("--git-ref <ref>", "Git ref for a Nix git source").option("--git-subpath <path>", "Subdirectory for a Nix git source").option("--set-as-default", "Select this source as the default after saving").option("--json", "Print raw JSON").action(async (options) => {
+  const spinner = options.json ? null : ora5("Saving machine image source...").start();
+  try {
+    const input = await resolveSaveInput(options);
+    const settings = await upsertMachineSource(input);
+    spinner?.stop();
+    if (options.json) {
+      console.log(JSON.stringify(settings, null, 2));
+      return;
+    }
+    console.log();
+    console.log(chalk7.green("Saved machine image source."));
+    printMachineSourceSettings(settings);
+  } catch (error) {
+    if (spinner) {
+      spinner.fail(error instanceof Error ? error.message : "Failed to save machine image source");
+    } else {
+      console.error(error instanceof Error ? error.message : "Failed to save machine image source");
+    }
+    process.exit(1);
+  }
+});
+imageCommand.command("default").description("Set the default machine image source").argument("[source-id]", "Source id to select; use 'platform' or omit for the platform default").option("--json", "Print raw JSON").action(async (sourceID, options) => {
+  const usePlatformDefault = !sourceID || sourceID === "platform";
+  const spinner = options.json ? null : ora5("Updating machine image default...").start();
+  try {
+    let settings;
+    if (usePlatformDefault) {
+      settings = await clearMachineSourceDefault();
+    } else {
+      const current = await getMachineSourceSettings();
+      const source = current.sources.find((entry) => entry.id === sourceID);
+      if (!source) {
+        throw new Error(`machine image source '${sourceID}' not found`);
+      }
+      settings = await upsertMachineSource({
+        id: source.id,
+        kind: source.kind,
+        set_as_default: true
+      });
+    }
+    spinner?.stop();
+    if (options.json) {
+      console.log(JSON.stringify(settings, null, 2));
+      return;
+    }
+    console.log();
+    if (!usePlatformDefault) {
+      const selected = settings.default_machine_source ?? void 0;
+      const label = selected ? summarizeMachineSource(selected) : sourceID;
+      console.log(chalk7.green(`Selected ${chalk7.bold(label)} as the default machine image.`));
+    } else {
+      console.log(chalk7.green("Using the AgentComputer platform default image."));
+    }
+    printMachineSourceSettings(settings);
+  } catch (error) {
+    if (spinner) {
+      spinner.fail(error instanceof Error ? error.message : "Failed to update machine image default");
+    } else {
+      console.error(error instanceof Error ? error.message : "Failed to update machine image default");
+    }
+    process.exit(1);
+  }
+});
+imageCommand.command("rebuild").description("Rebuild a machine image source").argument("<source-id>", "Source id to rebuild").option("--json", "Print raw JSON").action(async (sourceID, options) => {
+  const spinner = options.json ? null : ora5("Queueing machine image rebuild...").start();
+  try {
+    const settings = await rebuildMachineSource(sourceID);
+    spinner?.stop();
+    if (options.json) {
+      console.log(JSON.stringify(settings, null, 2));
+      return;
+    }
+    console.log();
+    console.log(chalk7.green(`Queued rebuild for ${chalk7.bold(sourceID)}.`));
+    printMachineSourceSettings(settings);
+  } catch (error) {
+    if (spinner) {
+      spinner.fail(error instanceof Error ? error.message : "Failed to rebuild machine image source");
+    } else {
+      console.error(error instanceof Error ? error.message : "Failed to rebuild machine image source");
+    }
+    process.exit(1);
+  }
+});
+imageCommand.command("rm").description("Delete a machine image source").argument("<source-id>", "Source id to delete").option("-y, --yes", "Skip confirmation prompt").option("--json", "Print raw JSON").action(async (sourceID, options, cmd) => {
+  const globalYes = cmd.parent?.parent?.opts()?.yes;
+  const skipConfirm = Boolean(options.yes || globalYes);
+  let spinner = null;
+  try {
+    if (!skipConfirm && process.stdin.isTTY) {
+      const confirmed = await confirmDeletion(sourceID);
+      if (!confirmed) {
+        console.log(chalk7.dim("  Cancelled."));
+        return;
+      }
+    }
+    spinner = options.json ? null : ora5("Deleting machine image source...").start();
+    const settings = await deleteMachineSource(sourceID);
+    spinner?.stop();
+    if (options.json) {
+      console.log(JSON.stringify(settings, null, 2));
+      return;
+    }
+    console.log();
+    console.log(chalk7.green(`Deleted machine image source ${chalk7.bold(sourceID)}.`));
+    printMachineSourceSettings(settings);
+  } catch (error) {
+    if (spinner) {
+      spinner.fail(error instanceof Error ? error.message : "Failed to delete machine image source");
+    } else {
+      console.error(error instanceof Error ? error.message : "Failed to delete machine image source");
+    }
+    process.exit(1);
+  }
+});
+function printMachineSourceSettings(settings) {
+  console.log(`  ${chalk7.dim("Default")}  ${chalk7.white(summarizeMachineSourceSelection(settings))}`);
+  console.log();
+  if (settings.sources.length === 0) {
+    console.log(chalk7.dim("  No custom machine images configured yet."));
+    console.log();
+    return;
+  }
+  for (const source of settings.sources) {
+    printMachineSourceCard(source, settings.default_machine_source_id === source.id);
+  }
+}
+function printMachineSourceCard(source, isDefault) {
+  console.log(`  ${chalk7.bold(machineSourceTitle(source))}${isDefault ? chalk7.green("  (default)") : ""}`);
+  console.log(`  ${chalk7.dim("    ID")}      ${source.id}`);
+  console.log(`  ${chalk7.dim("    Kind")}    ${source.kind}`);
+  console.log(`  ${chalk7.dim("    Status")}  ${source.status}${source.latest_build ? ` | latest build ${source.latest_build.status}` : ""}`);
+  if (source.resolved_image_ref) {
+    console.log(`  ${chalk7.dim("    Resolved")} ${source.resolved_image_ref}`);
+  }
+  if (source.error) {
+    console.log(`  ${chalk7.dim("    Error")}    ${chalk7.red(source.error)}`);
+  }
+  console.log(`  ${chalk7.dim("    Source")}   ${summarizeMachineSource(source)}`);
+  console.log();
+}
+function machineSourceTitle(source) {
+  if (source.kind === "oci-image") {
+    return source.requested_ref || "OCI image";
+  }
+  return source.git_url || "Nix git source";
+}
+function parseMachineSourceKind(value) {
+  switch (value) {
+    case void 0:
+    case "oci-image":
+    case "nix-git":
+      return value;
+    default:
+      throw new Error("--kind must be oci-image or nix-git");
+  }
+}
+function hasTTY() {
+  return process.stdin.isTTY && process.stdout.isTTY;
+}
+async function resolveSaveInput(options) {
+  const existing = await loadExistingSource(options.id);
+  const selectedKind = parseMachineSourceKind(options.kind) ?? existing?.kind;
+  let kind = selectedKind;
+  if (!kind) {
+    if (!hasTTY()) {
+      throw new Error("--kind is required");
+    }
+    kind = await selectMachineSourceKind();
+  }
+  const input = {
+    id: options.id,
+    kind,
+    set_as_default: options.setAsDefault
+  };
+  switch (kind) {
+    case "oci-image": {
+      const existingSameKind = existing?.kind === kind;
+      const requestedRef = normalizeValue(options.requestedRef) ?? (existingSameKind ? existing?.requested_ref : void 0);
+      if (!requestedRef) {
+        if (!hasTTY()) {
+          throw new Error("--requested-ref is required for oci-image sources");
+        }
+        const promptedRef = normalizeValue(await textInput3({ message: "OCI image ref:" }));
+        if (!promptedRef) {
+          throw new Error("OCI image ref is required");
+        }
+        input.requested_ref = promptedRef;
+        break;
+      }
+      input.requested_ref = requestedRef;
+      break;
+    }
+    case "nix-git": {
+      const existingSameKind = existing?.kind === kind;
+      const gitUrl = normalizeValue(options.gitUrl) ?? (existingSameKind ? existing?.git_url : void 0);
+      const gitRef = normalizeValue(options.gitRef) ?? (existingSameKind ? existing?.git_ref : void 0);
+      const gitSubpath = normalizeValue(options.gitSubpath) ?? (existingSameKind ? existing?.git_subpath : void 0);
+      if (!gitUrl) {
+        if (!hasTTY()) {
+          throw new Error("--git-url is required for nix-git sources");
+        }
+        const promptedGitURL = normalizeValue(await textInput3({ message: "Git URL:" }));
+        if (!promptedGitURL) {
+          throw new Error("Git URL is required");
+        }
+        input.git_url = promptedGitURL;
+        break;
+      }
+      input.git_url = gitUrl;
+      if (gitRef) {
+        input.git_ref = gitRef;
+      }
+      if (gitSubpath) {
+        input.git_subpath = gitSubpath;
+      }
+      break;
+    }
+  }
+  return input;
+}
+async function selectMachineSourceKind() {
+  const kind = await select3({
+    message: "Select machine image kind",
+    choices: [
+      { name: "oci-image  -  resolve an OCI image digest", value: "oci-image" },
+      { name: "nix-git    -  build a Nix source into OCI", value: "nix-git" }
+    ],
+    default: "oci-image"
+  });
+  return kind;
+}
+async function loadExistingSource(sourceID) {
+  if (!sourceID) {
+    return void 0;
+  }
+  const settings = await getMachineSourceSettings();
+  const source = settings.sources.find((entry) => entry.id === sourceID);
+  if (!source) {
+    throw new Error(`machine image source '${sourceID}' not found`);
+  }
+  return source;
+}
+function normalizeValue(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : void 0;
+}
+async function confirmDeletion(sourceID) {
+  return confirm2({
+    message: `Delete machine image source ${sourceID}?`,
+    default: false
+  });
+}
+
 // src/commands/login.ts
-import { Command as Command6 } from "commander";
-import chalk5 from "chalk";
-import ora4 from "ora";
+import { Command as Command8 } from "commander";
+import chalk8 from "chalk";
+import ora6 from "ora";
 
 // src/lib/browser-login.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 import { createServer } from "http";
 var CALLBACK_HOST = "127.0.0.1";
 var CALLBACK_PATH = "/callback";
 var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
 async function createBrowserLoginAttempt() {
-  const state = randomBytes(16).toString("hex");
+  const state = randomBytes2(16).toString("hex");
   const deferred = createDeferred();
   let callbackURL = "";
   let closed = false;
@@ -2343,11 +3358,11 @@ function escapeHTML(value) {
 }
 
 // src/commands/login.ts
-var loginCommand = new Command6("login").description("Authenticate the CLI").option("--api-key <key>", "API key starting with ac_live_").option("--stdin", "Read the API key from stdin").option("-f, --force", "Overwrite an existing stored API key").action(async (options) => {
+var loginCommand = new Command8("login").description("Authenticate the CLI").option("--api-key <key>", "API key starting with ac_live_").option("--stdin", "Read the API key from stdin").option("-f, --force", "Overwrite an existing stored API key").action(async (options) => {
   const existingKey = getStoredAPIKey();
   if (existingKey && !options.force) {
     console.log();
-    console.log(chalk5.yellow("  Already logged in. Use --force to overwrite."));
+    console.log(chalk8.yellow("  Already logged in. Use --force to overwrite."));
     console.log();
     return;
   }
@@ -2355,8 +3370,8 @@ var loginCommand = new Command6("login").description("Authenticate the CLI").opt
   const apiKey = await resolveAPIKeyInput(options.apiKey, options.stdin);
   if (!apiKey && wantsManualLogin) {
     console.log();
-    console.log(chalk5.dim("  Usage: computer login --api-key <ac_live_...>"));
-    console.log(chalk5.dim(`  API:   ${getBaseURL()}`));
+    console.log(chalk8.dim("  Usage: computer login --api-key <ac_live_...>"));
+    console.log(chalk8.dim(`  API:   ${getBaseURL()}`));
     console.log();
     process.exit(1);
   }
@@ -2366,15 +3381,15 @@ var loginCommand = new Command6("login").description("Authenticate the CLI").opt
   }
   if (!apiKey.startsWith("ac_live_")) {
     console.log();
-    console.log(chalk5.red("  API key must start with ac_live_"));
+    console.log(chalk8.red("  API key must start with ac_live_"));
     console.log();
     process.exit(1);
   }
-  const spinner = ora4("Authenticating...").start();
+  const spinner = ora6("Authenticating...").start();
   try {
     const me = await apiWithKey(apiKey, "/v1/me");
     setAPIKey(apiKey);
-    spinner.succeed(`Logged in as ${chalk5.bold(me.user.email)}`);
+    spinner.succeed(`Logged in as ${chalk8.bold(me.user.email)}`);
   } catch (error) {
     spinner.fail(
       error instanceof Error ? error.message : "Failed to validate API key"
@@ -2383,7 +3398,7 @@ var loginCommand = new Command6("login").description("Authenticate the CLI").opt
   }
 });
 async function runBrowserLogin() {
-  const spinner = ora4("Starting browser login...").start();
+  const spinner = ora6("Starting browser login...").start();
   let attempt = null;
   try {
     attempt = await createBrowserLoginAttempt();
@@ -2393,14 +3408,14 @@ async function runBrowserLogin() {
     } catch {
       spinner.stop();
       console.log();
-      console.log(chalk5.yellow("  Browser auto-open failed. Open this URL to continue:"));
-      console.log(chalk5.dim(`  ${attempt.loginURL}`));
+      console.log(chalk8.yellow("  Browser auto-open failed. Open this URL to continue:"));
+      console.log(chalk8.dim(`  ${attempt.loginURL}`));
       console.log();
       spinner.start("Waiting for browser login...");
     }
     spinner.text = "Waiting for browser login...";
     const result = await attempt.waitForResult();
-    spinner.succeed(`Logged in as ${chalk5.bold(result.me.user.email)}`);
+    spinner.succeed(`Logged in as ${chalk8.bold(result.me.user.email)}`);
   } catch (error) {
     spinner.fail(error instanceof Error ? error.message : "Browser login failed");
     process.exit(1);
@@ -2426,33 +3441,33 @@ async function resolveAPIKeyInput(flagValue, readFromStdin) {
 }
 
 // src/commands/logout.ts
-import { Command as Command7 } from "commander";
-import chalk6 from "chalk";
-var logoutCommand = new Command7("logout").description("Remove stored API key").action(() => {
+import { Command as Command9 } from "commander";
+import chalk9 from "chalk";
+var logoutCommand = new Command9("logout").description("Remove stored API key").action(() => {
   if (!getStoredAPIKey()) {
     console.log();
-    console.log(chalk6.dim("  Not logged in."));
+    console.log(chalk9.dim("  Not logged in."));
     if (hasEnvAPIKey()) {
-      console.log(chalk6.dim("  Environment API key is still active in this shell."));
+      console.log(chalk9.dim("  Environment API key is still active in this shell."));
     }
     console.log();
     return;
   }
   clearAPIKey();
   console.log();
-  console.log(chalk6.green("  Logged out."));
+  console.log(chalk9.green("  Logged out."));
   if (hasEnvAPIKey()) {
-    console.log(chalk6.dim("  Environment API key is still active in this shell."));
+    console.log(chalk9.dim("  Environment API key is still active in this shell."));
   }
   console.log();
 });
 
 // src/commands/whoami.ts
-import { Command as Command8 } from "commander";
-import chalk7 from "chalk";
-import ora5 from "ora";
-var whoamiCommand = new Command8("whoami").description("Show current user").option("--json", "Print raw JSON").action(async (options) => {
-  const spinner = options.json ? null : ora5("Loading user...").start();
+import { Command as Command10 } from "commander";
+import chalk10 from "chalk";
+import ora7 from "ora";
+var whoamiCommand = new Command10("whoami").description("Show current user").option("--json", "Print raw JSON").action(async (options) => {
+  const spinner = options.json ? null : ora7("Loading user...").start();
   try {
     const me = await api("/v1/me");
     spinner?.stop();
@@ -2461,14 +3476,14 @@ var whoamiCommand = new Command8("whoami").description("Show current user").opti
       return;
     }
     console.log();
-    console.log(`  ${chalk7.bold.white(me.user.display_name || me.user.email)}`);
+    console.log(`  ${chalk10.bold.white(me.user.display_name || me.user.email)}`);
     if (me.user.display_name) {
-      console.log(`  ${chalk7.dim(me.user.email)}`);
+      console.log(`  ${chalk10.dim(me.user.email)}`);
     }
     if (me.api_key.name) {
-      console.log(`  ${chalk7.dim("Key:")}  ${me.api_key.name}`);
+      console.log(`  ${chalk10.dim("Key:")}  ${me.api_key.name}`);
     }
-    console.log(`  ${chalk7.dim("API:")}  ${chalk7.dim(getBaseURL())}`);
+    console.log(`  ${chalk10.dim("API:")}  ${chalk10.dim(getBaseURL())}`);
     console.log();
   } catch (error) {
     if (spinner) {
@@ -2485,15 +3500,15 @@ var pkg2 = JSON.parse(
   readFileSync3(new URL("../package.json", import.meta.url), "utf8")
 );
 var cliName = process.argv[1] ? basename2(process.argv[1]) : "agentcomputer";
-var program = new Command9();
+var program = new Command11();
 function appendTextSection(lines, title, values) {
   if (values.length === 0) {
     return;
   }
-  lines.push(`  ${chalk8.dim(title)}`);
+  lines.push(`  ${chalk11.dim(title)}`);
   lines.push("");
   for (const value of values) {
-    lines.push(`    ${chalk8.white(value)}`);
+    lines.push(`    ${chalk11.white(value)}`);
   }
   lines.push("");
 }
@@ -2502,10 +3517,10 @@ function appendTableSection(lines, title, entries) {
     return;
   }
   const width = Math.max(...entries.map((entry) => entry.term.length), 0) + 2;
-  lines.push(`  ${chalk8.dim(title)}`);
+  lines.push(`  ${chalk11.dim(title)}`);
   lines.push("");
   for (const entry of entries) {
-    lines.push(`    ${chalk8.white(padEnd(entry.term, width))}${chalk8.dim(entry.desc)}`);
+    lines.push(`    ${chalk11.white(padEnd(entry.term, width))}${chalk11.dim(entry.desc)}`);
   }
   lines.push("");
 }
@@ -2524,29 +3539,32 @@ function formatRootHelp(cmd) {
   const groups = [
     ["Auth", []],
     ["Computers", []],
+    ["Images", []],
     ["Access", []],
     ["Agents", []],
     ["Other", []]
   ];
   const otherGroup = groups.find(([name]) => name === "Other")[1];
-  lines.push(`${chalk8.bold(cliName)} ${chalk8.dim(`v${version}`)}`);
+  lines.push(`${chalk11.bold(cliName)} ${chalk11.dim(`v${version}`)}`);
   lines.push("");
   if (cmd.description()) {
-    lines.push(`  ${chalk8.dim(cmd.description())}`);
+    lines.push(`  ${chalk11.dim(cmd.description())}`);
     lines.push("");
   }
   appendTextSection(lines, "Usage", [`${cliName} <command> [options]`]);
   for (const sub of cmd.commands) {
     const name = sub.name();
     const entry = { term: name, desc: sub.description() };
-    if (["login", "logout", "whoami"].includes(name)) {
+    if (["login", "logout", "whoami", "claude-auth"].includes(name)) {
       groups[0][1].push(entry);
     } else if (["create", "ls", "get", "rm"].includes(name)) {
       groups[1][1].push(entry);
-    } else if (["open", "ssh", "ports"].includes(name)) {
+    } else if (name === "image") {
       groups[2][1].push(entry);
-    } else if (["agent", "fleet", "acp"].includes(name)) {
+    } else if (["open", "ssh", "ports"].includes(name)) {
       groups[3][1].push(entry);
+    } else if (["agent", "fleet", "acp"].includes(name)) {
+      groups[4][1].push(entry);
     } else {
       otherGroup.push(entry);
     }
@@ -2581,10 +3599,10 @@ function formatSubcommandHelp(cmd, helper) {
     term: helper.optionTerm(option),
     desc: helper.optionDescription(option)
   }));
-  lines.push(chalk8.bold(commandPath(cmd)));
+  lines.push(chalk11.bold(commandPath(cmd)));
   lines.push("");
   if (description) {
-    lines.push(`  ${chalk8.dim(description)}`);
+    lines.push(`  ${chalk11.dim(description)}`);
     lines.push("");
   }
   appendTextSection(lines, "Usage", [helper.commandUsage(cmd)]);
@@ -2611,9 +3629,11 @@ program.name(cliName).description("Agent Computer CLI").version(pkg2.version ??
 program.addCommand(loginCommand);
 program.addCommand(logoutCommand);
 program.addCommand(whoamiCommand);
+program.addCommand(claudeAuthCommand);
 program.addCommand(createCommand);
 program.addCommand(lsCommand);
 program.addCommand(getCommand);
+program.addCommand(imageCommand);
 program.addCommand(agentCommand);
 program.addCommand(fleetCommand);
 program.addCommand(acpCommand);