codeam-cli 2.21.1 → 2.22.0

package/dist/index.js

@@ -87,7 +87,7 @@ var require_src = __commonJS({
 });
 
 // src/commands/start.ts
-var import_picocolors2 = __toESM(require("picocolors"));
+var import_picocolors3 = __toESM(require("picocolors"));
 
 // ../../packages/shared/src/protocol/constants.ts
 var PROTOCOL_VERSION = "2.0.0";
@@ -441,7 +441,7 @@ var import_qrcode_terminal = __toESM(require("qrcode-terminal"));
 // package.json
 var package_default = {
   name: "codeam-cli",
-  version: "2.21.1",
+  version: "2.22.0",
   description: "Workflow-continuity bridge for AI coding agents. Wrap Claude Code or Codex in a PTY and supervise, approve, and redirect the session from any device \u2014 async. The terminal companion for CodeAgent Mobile.",
   type: "commonjs",
   main: "dist/index.js",
@@ -5740,7 +5740,7 @@ function readAnonId() {
 }
 function superProperties() {
   return {
-    cliVersion: true ? "2.21.1" : "0.0.0-dev",
+    cliVersion: true ? "2.22.0" : "0.0.0-dev",
     nodeVersion: process.version,
     platform: process.platform,
     arch: process.arch,
@@ -6035,7 +6035,8 @@ var CommandRelayService = class {
   async sendHeartbeat(online) {
     await _postJson(`${API_BASE2}/api/plugin/heartbeat`, {
       pluginId: this.pluginId,
-      online
+      online,
+      agentId: this.agentMeta.id
     }).then(() => log.trace("relay", `heartbeat ok online=${online}`)).catch((err) => log.trace("relay", `heartbeat failed online=${online}`, err));
   }
   reportAgents() {
@@ -13753,9 +13754,9 @@ function buildKeepAlive(ctx) {
 }
 
 // src/commands/start/handlers.ts
-var fs26 = __toESM(require("fs"));
+var fs27 = __toESM(require("fs"));
 var os23 = __toESM(require("os"));
-var path32 = __toESM(require("path"));
+var path33 = __toESM(require("path"));
 var import_crypto5 = require("crypto");
 var import_child_process13 = require("child_process");
 
@@ -13813,7 +13814,14 @@ var startCommandSchema = import_zod2.z.object({
   // `git restore` from there. `action='approved'` stages the edit,
   // `action='rejected'` discards every worktree change on the file.
   filePath: import_zod2.z.string().min(1).max(4096).optional(),
-  action: import_zod2.z.enum(["approved", "rejected"]).optional()
+  action: import_zod2.z.enum(["approved", "rejected"]).optional(),
+  // `request_link_credentials` — backend fires this from the
+  // heartbeat handler when it notices the user is running an agent
+  // they haven't vaulted yet. We reuse the `codeam link` token-
+  // capture path to push the credential up; if extraction fails
+  // (no local auth, missing file), the handler no-ops silently —
+  // no browser-login surprises during a normal `codeam pair`.
+  agentId: import_zod2.z.enum(["claude_code", "codex", "cursor", "aider", "coderabbit"]).optional()
 });
 function parsePayload2(schema, raw) {
   const result = schema.safeParse(raw);
@@ -14653,240 +14661,582 @@ function findGitRoot2(startDir) {
   return null;
 }
 
-// src/commands/start/handlers.ts
-var pendingAttachmentFiles = /* @__PURE__ */ new Set();
-function cleanupAttachmentTempFiles() {
-  for (const p2 of pendingAttachmentFiles) {
-    try {
-      fs26.unlinkSync(p2);
-    } catch {
-    }
-  }
-  pendingAttachmentFiles.clear();
+// src/commands/link.ts
+var import_node_crypto4 = require("crypto");
+var fs26 = __toESM(require("fs"));
+var path32 = __toESM(require("path"));
+var import_chokidar = __toESM(require("chokidar"));
+var import_picocolors2 = __toESM(require("picocolors"));
+
+// src/ui/prompts.ts
+async function confirmAction(message) {
+  const result = await ot2({ message });
+  if (q(result)) return false;
+  return result;
 }
-function saveFilesTemp(files) {
-  return files.filter(({ base64 }) => base64 && base64.length > 0).map(({ filename, base64 }) => {
-    const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
-    const tmpPath = path32.join(os23.tmpdir(), `codeam-${(0, import_crypto5.randomUUID)()}-${safeName}`);
-    fs26.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
-    pendingAttachmentFiles.add(tmpPath);
-    return tmpPath;
+async function selectSession(sessions3, activeId) {
+  const result = await _t({
+    message: "Select active session:",
+    options: sessions3.map((s) => ({
+      value: s.id,
+      label: `${s.userName}  ${s.plan}`,
+      hint: s.id === activeId ? "active" : `paired ${new Date(s.pairedAt).toLocaleDateString()}`
+    })),
+    initialValue: activeId ?? void 0
   });
+  if (q(result)) return null;
+  return result;
 }
-function dispatchPrompt(ctx, prompt) {
-  ctx.outputSvc.newTurn();
-  ctx.agent.sendCommand(prompt);
+
+// src/commands/link.ts
+function buildLinkContext(agentId) {
+  const runtime = createRuntimeStrategy(agentId);
+  return {
+    runtime,
+    locator: runtime.credentialLocator(),
+    launcher: runtime.loginLauncher(),
+    displayName: runtime.meta.displayName,
+    binary: runtime.meta.binaryName
+  };
 }
-var startTask = (ctx, _cmd, parsed) => {
-  const { prompt, files } = parsed;
-  const effectivePrompt = prompt ?? "";
-  if (files && files.length > 0) {
-    const paths = saveFilesTemp(files);
-    const atRefs = paths.map((p2) => `@${p2}`).join(" ");
-    ctx.outputSvc.newTurn();
-    ctx.agent.sendCommand(`${atRefs} ${effectivePrompt}`.trim());
-    setTimeout(() => {
-      for (const p2 of paths) {
-        try {
-          fs26.unlinkSync(p2);
-        } catch {
-        }
-        pendingAttachmentFiles.delete(p2);
-      }
-    }, 12e4);
-  } else if (effectivePrompt) {
-    dispatchPrompt(ctx, effectivePrompt);
+function enabledLinkableAgents() {
+  return Object.values(AGENT_REGISTRY).filter((m) => m.enabled).map((m) => m.id);
+}
+function parseLinkArgs(args2) {
+  const positional = args2.find((a) => !a.startsWith("--"));
+  const valid = enabledLinkableAgents();
+  if (!positional) {
+    throw new Error(
+      `Usage: codeam link <agent>
+         agent: ${valid.join(" | ")}`
+    );
   }
-};
-var provideInput = (ctx, _cmd, parsed) => {
-  if (parsed.input) dispatchPrompt(ctx, parsed.input);
-};
-var selectOption = (ctx, _cmd, parsed) => {
-  const index = parsed.index ?? 0;
-  const from = parsed.from ?? 0;
-  ctx.outputSvc.newTurn();
-  ctx.agent.selectOption(index, from);
-};
-var escapeKey = (ctx) => {
-  ctx.outputSvc.newTurn();
-  ctx.agent.sendEscape();
-};
-var stopTask = (ctx) => {
-  ctx.agent.interrupt();
-};
-var resumeSession = async (ctx, _cmd, parsed) => {
-  const { id, auto } = parsed;
-  if (!id) return;
-  ctx.historySvc.setCurrentConversationId(id);
-  await ctx.historySvc.loadConversation(id);
-  await ctx.outputSvc.newTurnResume(id);
-  ctx.agent.restart(id, auto ?? false);
-};
-var getContext = async (ctx, cmd) => {
-  const usage = ctx.historySvc.getCurrentUsage();
-  const monthlyCost = ctx.historySvc.getMonthlyEstimatedCost();
-  const rateLimitReset = ctx.historySvc.getRateLimitReset();
-  const quotaPercent = ctx.historySvc.getQuotaPercent();
-  const base = usage ? { ...usage, monthlyCost } : { used: 0, total: 2e5, percent: 0, model: null, outputTokens: 0, cacheReadTokens: 0, monthlyCost, error: "No usage data found" };
-  const result = {
-    ...base,
-    ...rateLimitReset ? { rateLimitReset } : {},
-    ...quotaPercent !== null ? { quotaPercent } : {}
-  };
-  await ctx.relay.sendResult(cmd.id, "completed", result);
-};
-var getConversation = async (ctx, cmd) => {
-  const currentId = ctx.historySvc.getCurrentConversationId();
-  if (!currentId) {
-    await ctx.relay.sendResult(cmd.id, "completed", { conversationId: null });
-    return;
+  const normalised = positional === "claude_code" ? "claude" : positional;
+  if (!isKnownAgentId(normalised) || !AGENT_REGISTRY[normalised].enabled) {
+    throw new Error(
+      `Unknown or unsupported agent "${positional}". Valid: ${valid.join(", ")}`
+    );
   }
-  try {
-    await ctx.historySvc.loadConversation(currentId);
-    await ctx.relay.sendResult(cmd.id, "completed", { conversationId: currentId });
-  } catch {
-    await ctx.relay.sendResult(cmd.id, "failed", {});
+  const reuseExisting = args2.includes("--reuse-existing");
+  const dryRun = args2.includes("--dry-run");
+  const apiKeyFileArg = args2.find((a) => a.startsWith("--api-key-file="));
+  let apiKey = null;
+  if (apiKeyFileArg) {
+    const filePath = apiKeyFileArg.slice("--api-key-file=".length);
+    try {
+      apiKey = fs26.readFileSync(path32.resolve(filePath), "utf8").trim();
+    } catch (err) {
+      throw new Error(`Could not read --api-key-file ${filePath}: ${err.message}`);
+    }
+    if (!apiKey) {
+      throw new Error(`--api-key-file ${filePath} is empty.`);
+    }
+  } else {
+    const apiKeyArg = args2.find((a) => a.startsWith("--api-key="));
+    apiKey = apiKeyArg ? apiKeyArg.slice("--api-key=".length) : null;
   }
-};
-var listModels = async (ctx, cmd) => {
-  const models = await ctx.runtime.listModels();
-  await ctx.relay.sendResult(cmd.id, "completed", { models });
-};
-var changeModel = async (ctx, cmd) => {
-  const params = cmd.payload;
-  if (typeof params.modelId !== "string" || !params.modelId) {
-    await ctx.relay.sendResult(cmd.id, "failed", { error: "modelId required" });
+  const tokenFileArg = args2.find((a) => a.startsWith("--token-file="));
+  const tokenFile = tokenFileArg ? tokenFileArg.slice("--token-file=".length) : null;
+  return { agent: normalised, reuseExisting, apiKey, tokenFile, dryRun };
+}
+async function link(args2 = []) {
+  const parsed = parseLinkArgs(args2);
+  const ctx = buildLinkContext(parsed.agent);
+  showIntro();
+  console.log(
+    import_picocolors2.default.bold(`  Link ${ctx.displayName}`) + import_picocolors2.default.dim(`  \xB7  ${ctx.locator.vendor}`)
+  );
+  console.log("");
+  if (parsed.dryRun) {
+    await linkDryRunPreflight(ctx);
     return;
   }
-  const instr = ctx.runtime.changeModelInstruction(params.modelId);
-  if (instr.type === "pty") {
-    if (!instr.ptyInput) {
-      await ctx.relay.sendResult(cmd.id, "failed", { error: "no pty input for this agent" });
-      return;
-    }
-    ctx.agent.sendRawPtyInput(instr.ptyInput);
-  } else if (instr.type === "restart") {
-    await ctx.relay.sendResult(cmd.id, "failed", { error: "restart-mode change_model not supported in Phase 1" });
-    return;
+  const pluginId = (0, import_node_crypto4.randomUUID)();
+  const spin = dist_exports.spinner();
+  spin.start("Requesting pairing code...");
+  const pairing = await requestCode(pluginId);
+  if (!pairing) {
+    spin.stop("Failed");
+    showError("Could not reach the server. Check your connection and try again.");
+    process.exit(1);
   }
-  await ctx.relay.sendResult(cmd.id, "completed", {});
-};
-var summarize = async (ctx, cmd) => {
-  const params = cmd.payload;
-  const mode = params.mode === "auto" ? "auto" : "normal";
-  const instr = ctx.runtime.summarizeInstruction(mode);
-  ctx.agent.sendRawPtyInput(instr.ptyInput);
-  await ctx.relay.sendResult(cmd.id, "completed", {});
-};
-var setKeepAlive = async (ctx, cmd) => {
-  const enabled = !!cmd.payload.enabled;
-  ctx.setKeepAlive(enabled);
-  try {
-    await ctx.relay.sendResult(
-      cmd.id,
-      "success",
-      {
-        enabled,
-        applied: enabled && ctx.keepAliveCtx.inCodespace,
-        runtime: ctx.keepAliveCtx.inCodespace ? "github-codespaces" : "local"
+  spin.stop("Got pairing code");
+  showPairingCode(pairing.code);
+  console.log(import_picocolors2.default.dim("  Scan the QR or enter the code in CodeAgent Mobile."));
+  console.log("");
+  const waitSpin = dist_exports.spinner();
+  const waitMsg = () => `Waiting for mobile pair... \xB7 expires in ${formatRemaining(pairing.expiresAt)}`;
+  waitSpin.start(waitMsg());
+  const countdown = setInterval(() => waitSpin.message(waitMsg()), 1e3);
+  countdown.unref?.();
+  const paired = await new Promise((resolve5, reject) => {
+    let stopPoll = null;
+    const sigint = () => {
+      clearInterval(countdown);
+      stopPoll?.();
+      reject(new Error("cancelled"));
+    };
+    stopPoll = pollStatus(
+      pluginId,
+      (info) => {
+        process.removeListener("SIGINT", sigint);
+        clearInterval(countdown);
+        waitSpin.stop("Paired");
+        resolve5(info);
+      },
+      () => {
+        clearInterval(countdown);
+        waitSpin.stop("Timed out");
+        reject(new Error("Pairing timed out after 5 minutes. Run codeam link again."));
       }
     );
-  } catch {
+    process.once("SIGINT", sigint);
+  });
+  if (!paired.pluginAuthToken) {
+    showError(
+      "Backend did not return a pluginAuthToken \u2014 upgrade api-v2 (deploy includes the link endpoint)."
+    );
+    process.exit(1);
   }
-};
-var sessionTerminated = (ctx) => {
-  showInfo("Session was deleted from the app \u2014 exiting.");
-  try {
-    ctx.agent.kill();
-  } catch {
+  addSession({
+    id: paired.sessionId,
+    pluginId,
+    userName: paired.userName,
+    userEmail: paired.userEmail,
+    plan: paired.plan,
+    pairedAt: Date.now(),
+    pluginAuthToken: paired.pluginAuthToken,
+    agent: ctx.runtime.id
+  });
+  saveCliConfig({ ...loadCliConfig(), preferredAgent: ctx.runtime.id });
+  if (parsed.apiKey) {
+    await uploadAndSucceed(ctx, paired, pluginId, {
+      method: "api_key",
+      credential: parsed.apiKey.trim(),
+      source: "manual"
+    });
+    return;
   }
-  try {
-    const proc = (0, import_child_process13.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
-      detached: true,
-      stdio: "ignore"
+  if (parsed.tokenFile) {
+    const credential = fs26.readFileSync(path32.resolve(parsed.tokenFile), "utf8").trim();
+    if (!credential) {
+      showError(`--token-file ${parsed.tokenFile} is empty.`);
+      process.exit(1);
+    }
+    await uploadAndSucceed(ctx, paired, pluginId, {
+      method: "oauth",
+      credential,
+      source: "manual"
     });
-    proc.unref();
-  } catch {
+    return;
   }
-  ctx.outputSvc.dispose();
-  ctx.relay.stop();
-  process.exit(0);
-};
-var shutdownSession = async (ctx, cmd) => {
-  try {
-    await ctx.relay.sendResult(cmd.id, "success", { ok: true });
-  } catch {
+  const installSpin = dist_exports.spinner();
+  installSpin.start(`Checking that ${ctx.binary} is installed...`);
+  const installed = await ctx.launcher.ensureInstalled();
+  if (!installed) {
+    installSpin.stop("Failed");
+    showError(`Could not install ${ctx.displayName}. Install it manually then re-run.`);
+    process.exit(1);
   }
-  try {
-    ctx.agent.kill();
-  } catch {
+  installSpin.stop(`${ctx.displayName} is installed`);
+  const existing = await ctx.locator.extract();
+  if (existing) {
+    showInfo(`Found existing ${ctx.displayName} credentials at ${import_picocolors2.default.bold(existing.source)}.`);
+    await uploadAndSucceed(ctx, paired, pluginId, existing);
+    return;
   }
-  if (ctx.keepAliveCtx.inCodespace && ctx.keepAliveCtx.codespaceName) {
-    try {
-      const stopProc = (0, import_child_process13.spawn)(
-        "bash",
-        ["-lc", `sleep 1; gh codespace stop -c ${JSON.stringify(ctx.keepAliveCtx.codespaceName)} >/dev/null 2>&1 || true`],
-        { detached: true, stdio: "ignore" }
-      );
-      stopProc.unref();
-    } catch {
-    }
+  if (parsed.reuseExisting) {
+    showError(
+      `--reuse-existing set, but no local ${ctx.displayName} credentials were found at ${ctx.locator.hint}.`
+    );
+    process.exit(1);
   }
+  showInfo(
+    `No local ${ctx.displayName} credentials found. Launching the sign-in \u2014 complete it in your browser, the CLI will detect the new token and finish automatically.`
+  );
+  console.log("");
+  const captured = await captureFreshCredentials(ctx);
+  console.log("");
+  await uploadAndSucceed(ctx, paired, pluginId, captured);
+}
+async function captureFreshCredentials(ctx) {
+  const isWin = ctx.runtime.os.id === "win32";
+  const watcher = import_chokidar.default.watch(ctx.locator.watchPaths(), {
+    persistent: true,
+    ignoreInitial: false,
+    awaitWriteFinish: { stabilityThreshold: 500, pollInterval: 100 },
+    // Windows-only: when a credential file's ancestor is missing,
+    // chokidar walks up to the closest existing parent and starts
+    // traversing it. On a default Windows shell that ancestor is
+    // `C:\Users\<u>`, which contains legacy junctions whose ACL makes
+    // `fs.watch` throw EPERM (#43). These flags are no-ops on macOS,
+    // where the user has read access to their entire home.
+    ...isWin ? { followSymlinks: false, ignorePermissionErrors: true } : {}
+  });
+  watcher.on("error", () => {
+  });
+  let child = null;
+  let keychainPoll = null;
+  const cleanup = () => {
+    void watcher.close();
+    if (keychainPoll) clearInterval(keychainPoll);
+    if (child && !child.killed) {
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+    }
+  };
   try {
-    const proc = (0, import_child_process13.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
-      detached: true,
-      stdio: "ignore"
+    const token = await new Promise((resolve5, reject) => {
+      let settled = false;
+      const tryExtract = async () => {
+        if (settled) return;
+        const t2 = await ctx.locator.extract();
+        if (t2 && !settled) {
+          settled = true;
+          resolve5(t2);
+        }
+      };
+      watcher.on("add", () => void tryExtract());
+      watcher.on("change", () => void tryExtract());
+      keychainPoll = setInterval(() => void tryExtract(), 2e3);
+      keychainPoll.unref?.();
+      const sigint = () => {
+        if (settled) return;
+        settled = true;
+        reject(new Error("cancelled"));
+      };
+      process.once("SIGINT", sigint);
+      setTimeout(() => {
+        if (settled) return;
+        settled = true;
+        reject(new Error(`Timed out waiting for ${ctx.displayName} sign-in (5 minutes).`));
+      }, 5 * 6e4);
+      child = ctx.launcher.launch();
+      child.on("exit", () => {
+        void tryExtract().then(() => {
+          if (!settled) {
+            settled = true;
+            reject(
+              new Error(
+                `${ctx.binary} exited but no credentials were written at ${ctx.locator.hint}.`
+              )
+            );
+          }
+        });
+      });
     });
-    proc.unref();
-  } catch {
+    cleanup();
+    return token;
+  } catch (err) {
+    cleanup();
+    throw err;
   }
-  ctx.outputSvc.dispose();
-  ctx.relay.stop();
-  process.exit(0);
-};
-var readFile4 = async (ctx, cmd, parsed) => {
-  if (!parsed.path) {
-    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing path" });
-    return;
+}
+async function uploadAndSucceed(ctx, paired, pluginId, token) {
+  if (!paired.pluginAuthToken) {
+    showError("Missing pluginAuthToken; re-run codeam link.");
+    process.exit(1);
   }
-  const result = await readProjectFile(parsed.path);
-  await ctx.relay.sendResult(cmd.id, "completed", result);
-};
-var writeFile3 = async (ctx, cmd, parsed) => {
-  if (!parsed.path || typeof parsed.content !== "string") {
-    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing path or content" });
-    return;
+  const uploadSpin = dist_exports.spinner();
+  uploadSpin.start("Sealing credential in your vault...");
+  const result = await postLinkCredential({
+    agentId: ctx.locator.publicId,
+    sessionId: paired.sessionId,
+    pluginId,
+    pluginAuthToken: paired.pluginAuthToken,
+    method: token.method,
+    credential: token.credential
+  });
+  if (!result.ok) {
+    uploadSpin.stop("Failed");
+    if (result.status === 401) {
+      showError("Pair token rejected by the backend (401). Re-run `codeam link`.");
+    } else if (result.status === 404) {
+      showError(
+        `${ctx.displayName} link endpoint not available on this backend (404). The api-v2 deployment may not yet include the route.`
+      );
+    } else {
+      showError(`Upload failed: ${result.message}`);
+    }
+    process.exit(1);
   }
-  const result = await writeProjectFile(parsed.path, parsed.content);
-  await ctx.relay.sendResult(cmd.id, "completed", result);
-};
-var listFiles = async (ctx, cmd, parsed) => {
-  const result = await listProjectFiles({ query: parsed.query });
-  await ctx.relay.sendResult(cmd.id, "completed", result);
-};
-var terminalOpenH = async (ctx, cmd, parsed) => {
-  const r = openTerminal({
-    cols: typeof parsed.cols === "number" ? parsed.cols : void 0,
-    rows: typeof parsed.rows === "number" ? parsed.rows : void 0,
-    cwd: typeof parsed.cwd === "string" ? parsed.cwd : void 0
+  uploadSpin.stop("Linked");
+  console.log("");
+  showSuccess(`${ctx.displayName} is now linked to ${paired.userEmail || paired.userName}.`);
+  showInfo(
+    `Your codespaces and @codeagent mentions can now use ${ctx.displayName} without you signing in again.`
+  );
+  console.log("");
+}
+async function linkDryRunPreflight(ctx) {
+  const publicId = ctx.locator.publicId;
+  const spin = dist_exports.spinner();
+  spin.start(`Probing ${publicId} link endpoint...`);
+  const result = await postLinkCredential({
+    agentId: publicId,
+    sessionId: "dryrun-session",
+    pluginId: "dryrun-plugin",
+    pluginAuthToken: "dryrun-token",
+    method: "oauth",
+    credential: "dryrun-credential"
   });
-  if ("error" in r) {
-    await ctx.relay.sendResult(cmd.id, "failed", { error: r.error });
-    return;
+  if (result.ok) {
+    spin.stop("Unexpected 2xx");
+    showError(
+      "Link dry-run: backend accepted a stub credential (2xx). PluginAuthGuard appears to be disabled \u2014 investigate api-v2."
+    );
+    process.exit(1);
   }
-  await ctx.relay.sendResult(cmd.id, "completed", r);
-};
-var terminalWriteH = async (ctx, cmd, parsed) => {
-  if (typeof parsed.sessionId !== "string" || typeof parsed.data !== "string") {
-    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing sessionId or data" });
-    return;
+  if (result.status === 401) {
+    spin.stop("Endpoint OK");
+    showSuccess(
+      `Link dry-run OK \u2014 /api/plugin/agents/${publicId}/link reachable and auth-gated (401 as expected).`
+    );
+    process.exit(0);
   }
-  const r = writeTerminal(parsed.sessionId, parsed.data);
-  await ctx.relay.sendResult(cmd.id, r.ok ? "completed" : "failed", r);
-};
-var terminalResizeH = async (ctx, cmd, parsed) => {
-  if (typeof parsed.sessionId !== "string" || typeof parsed.cols !== "number" || typeof parsed.rows !== "number") {
-    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing sessionId / cols / rows" });
+  spin.stop("Failed");
+  showError(
+    `Link dry-run: unexpected response from /api/plugin/agents/${publicId}/link (status=${result.status}, message=${result.message}). Expected 401.`
+  );
+  process.exit(1);
+}
+
+// src/commands/start/handlers.ts
+var pendingAttachmentFiles = /* @__PURE__ */ new Set();
+function cleanupAttachmentTempFiles() {
+  for (const p2 of pendingAttachmentFiles) {
+    try {
+      fs27.unlinkSync(p2);
+    } catch {
+    }
+  }
+  pendingAttachmentFiles.clear();
+}
+function saveFilesTemp(files) {
+  return files.filter(({ base64 }) => base64 && base64.length > 0).map(({ filename, base64 }) => {
+    const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 80);
+    const tmpPath = path33.join(os23.tmpdir(), `codeam-${(0, import_crypto5.randomUUID)()}-${safeName}`);
+    fs27.writeFileSync(tmpPath, Buffer.from(base64, "base64"));
+    pendingAttachmentFiles.add(tmpPath);
+    return tmpPath;
+  });
+}
+function dispatchPrompt(ctx, prompt) {
+  ctx.outputSvc.newTurn();
+  ctx.agent.sendCommand(prompt);
+}
+var startTask = (ctx, _cmd, parsed) => {
+  const { prompt, files } = parsed;
+  const effectivePrompt = prompt ?? "";
+  if (files && files.length > 0) {
+    const paths = saveFilesTemp(files);
+    const atRefs = paths.map((p2) => `@${p2}`).join(" ");
+    ctx.outputSvc.newTurn();
+    ctx.agent.sendCommand(`${atRefs} ${effectivePrompt}`.trim());
+    setTimeout(() => {
+      for (const p2 of paths) {
+        try {
+          fs27.unlinkSync(p2);
+        } catch {
+        }
+        pendingAttachmentFiles.delete(p2);
+      }
+    }, 12e4);
+  } else if (effectivePrompt) {
+    dispatchPrompt(ctx, effectivePrompt);
+  }
+};
+var provideInput = (ctx, _cmd, parsed) => {
+  if (parsed.input) dispatchPrompt(ctx, parsed.input);
+};
+var selectOption = (ctx, _cmd, parsed) => {
+  const index = parsed.index ?? 0;
+  const from = parsed.from ?? 0;
+  ctx.outputSvc.newTurn();
+  ctx.agent.selectOption(index, from);
+};
+var escapeKey = (ctx) => {
+  ctx.outputSvc.newTurn();
+  ctx.agent.sendEscape();
+};
+var stopTask = (ctx) => {
+  ctx.agent.interrupt();
+};
+var resumeSession = async (ctx, _cmd, parsed) => {
+  const { id, auto } = parsed;
+  if (!id) return;
+  ctx.historySvc.setCurrentConversationId(id);
+  await ctx.historySvc.loadConversation(id);
+  await ctx.outputSvc.newTurnResume(id);
+  ctx.agent.restart(id, auto ?? false);
+};
+var getContext = async (ctx, cmd) => {
+  const usage = ctx.historySvc.getCurrentUsage();
+  const monthlyCost = ctx.historySvc.getMonthlyEstimatedCost();
+  const rateLimitReset = ctx.historySvc.getRateLimitReset();
+  const quotaPercent = ctx.historySvc.getQuotaPercent();
+  const base = usage ? { ...usage, monthlyCost } : { used: 0, total: 2e5, percent: 0, model: null, outputTokens: 0, cacheReadTokens: 0, monthlyCost, error: "No usage data found" };
+  const result = {
+    ...base,
+    ...rateLimitReset ? { rateLimitReset } : {},
+    ...quotaPercent !== null ? { quotaPercent } : {}
+  };
+  await ctx.relay.sendResult(cmd.id, "completed", result);
+};
+var getConversation = async (ctx, cmd) => {
+  const currentId = ctx.historySvc.getCurrentConversationId();
+  if (!currentId) {
+    await ctx.relay.sendResult(cmd.id, "completed", { conversationId: null });
+    return;
+  }
+  try {
+    await ctx.historySvc.loadConversation(currentId);
+    await ctx.relay.sendResult(cmd.id, "completed", { conversationId: currentId });
+  } catch {
+    await ctx.relay.sendResult(cmd.id, "failed", {});
+  }
+};
+var listModels = async (ctx, cmd) => {
+  const models = await ctx.runtime.listModels();
+  await ctx.relay.sendResult(cmd.id, "completed", { models });
+};
+var changeModel = async (ctx, cmd) => {
+  const params = cmd.payload;
+  if (typeof params.modelId !== "string" || !params.modelId) {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "modelId required" });
+    return;
+  }
+  const instr = ctx.runtime.changeModelInstruction(params.modelId);
+  if (instr.type === "pty") {
+    if (!instr.ptyInput) {
+      await ctx.relay.sendResult(cmd.id, "failed", { error: "no pty input for this agent" });
+      return;
+    }
+    ctx.agent.sendRawPtyInput(instr.ptyInput);
+  } else if (instr.type === "restart") {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "restart-mode change_model not supported in Phase 1" });
+    return;
+  }
+  await ctx.relay.sendResult(cmd.id, "completed", {});
+};
+var summarize = async (ctx, cmd) => {
+  const params = cmd.payload;
+  const mode = params.mode === "auto" ? "auto" : "normal";
+  const instr = ctx.runtime.summarizeInstruction(mode);
+  ctx.agent.sendRawPtyInput(instr.ptyInput);
+  await ctx.relay.sendResult(cmd.id, "completed", {});
+};
+var setKeepAlive = async (ctx, cmd) => {
+  const enabled = !!cmd.payload.enabled;
+  ctx.setKeepAlive(enabled);
+  try {
+    await ctx.relay.sendResult(
+      cmd.id,
+      "success",
+      {
+        enabled,
+        applied: enabled && ctx.keepAliveCtx.inCodespace,
+        runtime: ctx.keepAliveCtx.inCodespace ? "github-codespaces" : "local"
+      }
+    );
+  } catch {
+  }
+};
+var sessionTerminated = (ctx) => {
+  showInfo("Session was deleted from the app \u2014 exiting.");
+  try {
+    ctx.agent.kill();
+  } catch {
+  }
+  try {
+    const proc = (0, import_child_process13.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
+      detached: true,
+      stdio: "ignore"
+    });
+    proc.unref();
+  } catch {
+  }
+  ctx.outputSvc.dispose();
+  ctx.relay.stop();
+  process.exit(0);
+};
+var shutdownSession = async (ctx, cmd) => {
+  try {
+    await ctx.relay.sendResult(cmd.id, "success", { ok: true });
+  } catch {
+  }
+  try {
+    ctx.agent.kill();
+  } catch {
+  }
+  if (ctx.keepAliveCtx.inCodespace && ctx.keepAliveCtx.codespaceName) {
+    try {
+      const stopProc = (0, import_child_process13.spawn)(
+        "bash",
+        ["-lc", `sleep 1; gh codespace stop -c ${JSON.stringify(ctx.keepAliveCtx.codespaceName)} >/dev/null 2>&1 || true`],
+        { detached: true, stdio: "ignore" }
+      );
+      stopProc.unref();
+    } catch {
+    }
+  }
+  try {
+    const proc = (0, import_child_process13.spawn)("bash", ["-lc", "pm2 delete codeam-pair >/dev/null 2>&1 || true"], {
+      detached: true,
+      stdio: "ignore"
+    });
+    proc.unref();
+  } catch {
+  }
+  ctx.outputSvc.dispose();
+  ctx.relay.stop();
+  process.exit(0);
+};
+var readFile4 = async (ctx, cmd, parsed) => {
+  if (!parsed.path) {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing path" });
+    return;
+  }
+  const result = await readProjectFile(parsed.path);
+  await ctx.relay.sendResult(cmd.id, "completed", result);
+};
+var writeFile3 = async (ctx, cmd, parsed) => {
+  if (!parsed.path || typeof parsed.content !== "string") {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing path or content" });
+    return;
+  }
+  const result = await writeProjectFile(parsed.path, parsed.content);
+  await ctx.relay.sendResult(cmd.id, "completed", result);
+};
+var listFiles = async (ctx, cmd, parsed) => {
+  const result = await listProjectFiles({ query: parsed.query });
+  await ctx.relay.sendResult(cmd.id, "completed", result);
+};
+var terminalOpenH = async (ctx, cmd, parsed) => {
+  const r = openTerminal({
+    cols: typeof parsed.cols === "number" ? parsed.cols : void 0,
+    rows: typeof parsed.rows === "number" ? parsed.rows : void 0,
+    cwd: typeof parsed.cwd === "string" ? parsed.cwd : void 0
+  });
+  if ("error" in r) {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: r.error });
+    return;
+  }
+  await ctx.relay.sendResult(cmd.id, "completed", r);
+};
+var terminalWriteH = async (ctx, cmd, parsed) => {
+  if (typeof parsed.sessionId !== "string" || typeof parsed.data !== "string") {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing sessionId or data" });
+    return;
+  }
+  const r = writeTerminal(parsed.sessionId, parsed.data);
+  await ctx.relay.sendResult(cmd.id, r.ok ? "completed" : "failed", r);
+};
+var terminalResizeH = async (ctx, cmd, parsed) => {
+  if (typeof parsed.sessionId !== "string" || typeof parsed.cols !== "number" || typeof parsed.rows !== "number") {
+    await ctx.relay.sendResult(cmd.id, "failed", { error: "Missing sessionId / cols / rows" });
     return;
   }
   const r = resizeTerminal(parsed.sessionId, parsed.cols, parsed.rows);
@@ -14974,25 +15324,66 @@ var applyFileReviewH = async (ctx, cmd, parsed) => {
     result
   );
 };
-var handlers = {
-  start_task: startTask,
-  provide_input: provideInput,
-  select_option: selectOption,
-  escape_key: escapeKey,
-  stop_task: stopTask,
-  resume_session: resumeSession,
-  get_context: getContext,
-  get_conversation: getConversation,
-  list_models: listModels,
-  change_model: changeModel,
-  summarize,
-  set_keep_alive: setKeepAlive,
-  session_terminated: sessionTerminated,
-  shutdown_session: shutdownSession,
-  read_file: readFile4,
-  write_file: writeFile3,
-  list_files: listFiles,
-  search_files: searchFilesH,
+var requestLinkCredentialsH = async (ctx, _cmd, parsed) => {
+  const publicId = parsed.agentId;
+  if (!publicId) return;
+  if (!ctx.pluginAuthToken) {
+    log.trace("auto-link", "skipped \u2014 no pluginAuthToken on this paired session");
+    return;
+  }
+  const internalId = publicId === "claude_code" ? "claude" : publicId;
+  if (!isKnownAgentId(internalId) || !AGENT_REGISTRY[internalId].enabled) {
+    log.trace("auto-link", `unknown / disabled agent: ${internalId}`);
+    return;
+  }
+  let linkCtx;
+  try {
+    linkCtx = buildLinkContext(internalId);
+  } catch (err) {
+    log.trace("auto-link", "buildLinkContext threw", err);
+    return;
+  }
+  const token = await linkCtx.locator.extract().catch((err) => {
+    log.trace("auto-link", `locator.extract failed for ${publicId}`, err);
+    return null;
+  });
+  if (!token) {
+    log.trace("auto-link", `no local ${linkCtx.displayName} credentials \u2014 skipping`);
+    return;
+  }
+  const result = await postLinkCredential({
+    agentId: publicId,
+    sessionId: ctx.sessionId,
+    pluginId: ctx.pluginId,
+    pluginAuthToken: ctx.pluginAuthToken,
+    method: token.method,
+    credential: token.credential
+  });
+  if (result.ok) {
+    log.trace("auto-link", `vaulted ${publicId} from ${token.source}`);
+  } else {
+    log.trace("auto-link", `upload failed (${result.status}): ${result.message}`);
+  }
+};
+var handlers = {
+  start_task: startTask,
+  provide_input: provideInput,
+  select_option: selectOption,
+  escape_key: escapeKey,
+  stop_task: stopTask,
+  resume_session: resumeSession,
+  get_context: getContext,
+  get_conversation: getConversation,
+  list_models: listModels,
+  change_model: changeModel,
+  summarize,
+  set_keep_alive: setKeepAlive,
+  session_terminated: sessionTerminated,
+  shutdown_session: shutdownSession,
+  read_file: readFile4,
+  write_file: writeFile3,
+  list_files: listFiles,
+  search_files: searchFilesH,
   terminal_open: terminalOpenH,
   terminal_write: terminalWriteH,
   terminal_resize: terminalResizeH,
@@ -15005,7 +15396,8 @@ var handlers = {
   git_push: gitPushH,
   git_pull: gitPullH,
   git_resolve: gitResolveH,
-  apply_file_review: applyFileReviewH
+  apply_file_review: applyFileReviewH,
+  request_link_credentials: requestLinkCredentialsH
 };
 async function dispatchCommand(ctx, cmd) {
   const parsed = parsePayload2(startCommandSchema, cmd.payload);
@@ -15025,14 +15417,14 @@ async function start(requestedAgent) {
   if (!session) {
     if (requestedAgent) {
       const displayName = AGENT_REGISTRY[requestedAgent]?.displayName ?? requestedAgent;
-      console.log(`  ${import_picocolors2.default.dim(`No paired ${displayName} session found.`)}`);
+      console.log(`  ${import_picocolors3.default.dim(`No paired ${displayName} session found.`)}`);
       console.log(
-        `  ${import_picocolors2.default.dim(`Run ${import_picocolors2.default.white("codeam pair")} from a ${displayName} setup to connect your mobile app.`)}
+        `  ${import_picocolors3.default.dim(`Run ${import_picocolors3.default.white("codeam pair")} from a ${displayName} setup to connect your mobile app.`)}
 `
       );
     } else {
-      console.log(`  ${import_picocolors2.default.dim("No paired session found.")}`);
-      console.log(`  ${import_picocolors2.default.dim(`Run ${import_picocolors2.default.white("codeam pair")} to connect your mobile app.`)}
+      console.log(`  ${import_picocolors3.default.dim("No paired session found.")}`);
+      console.log(`  ${import_picocolors3.default.dim(`Run ${import_picocolors3.default.white("codeam pair")} to connect your mobile app.`)}
 `);
     }
     process.exit(0);
@@ -15041,7 +15433,7 @@ async function start(requestedAgent) {
     throw new Error("Active session has no agent \u2014 re-pair with `codeam pair`.");
   }
   const pluginId = session.pluginId ?? ensurePluginId();
-  showInfo(`${session.userName}  \xB7  ${import_picocolors2.default.cyan(session.plan)}`);
+  showInfo(`${session.userName}  \xB7  ${import_picocolors3.default.cyan(session.plan)}`);
   showInfo(`Launching ${AGENT_REGISTRY[session.agent].displayName}...
 `);
   identifyUser({
@@ -15142,7 +15534,10 @@ async function start(requestedAgent) {
     runtime,
     relay: void 0,
     setKeepAlive: setKeepAlive2,
-    keepAliveCtx
+    keepAliveCtx,
+    pluginId,
+    sessionId: session.id,
+    pluginAuthToken: session.pluginAuthToken ?? void 0
   };
   const relay = new CommandRelayService(pluginId, async (cmd) => {
     await dispatchCommand(ctx, cmd);
@@ -15187,27 +15582,7 @@ async function start(requestedAgent) {
 
 // src/commands/pair.ts
 var import_crypto6 = require("crypto");
-var import_picocolors3 = __toESM(require("picocolors"));
-
-// src/ui/prompts.ts
-async function confirmAction(message) {
-  const result = await ot2({ message });
-  if (q(result)) return false;
-  return result;
-}
-async function selectSession(sessions3, activeId) {
-  const result = await _t({
-    message: "Select active session:",
-    options: sessions3.map((s) => ({
-      value: s.id,
-      label: `${s.userName}  ${s.plan}`,
-      hint: s.id === activeId ? "active" : `paired ${new Date(s.pairedAt).toLocaleDateString()}`
-    })),
-    initialValue: activeId ?? void 0
-  });
-  if (q(result)) return null;
-  return result;
-}
+var import_picocolors4 = __toESM(require("picocolors"));
 
 // src/utils/agent-prompt.ts
 function parseAgentFlag(args2) {
@@ -15276,7 +15651,7 @@ async function pair(args2 = []) {
     process.exit(0);
   }
   showPairingCode(result.code);
-  console.log(import_picocolors3.default.dim("  Scan the QR code or enter the code in CodeAgent Mobile."));
+  console.log(import_picocolors4.default.dim("  Scan the QR code or enter the code in CodeAgent Mobile."));
   console.log("");
   const waitSpin = dist_exports.spinner();
   const waitMessage = () => `Waiting for mobile app... \xB7 expires in ${formatRemaining(result.expiresAt)}`;
@@ -15341,7 +15716,7 @@ async function pair(args2 = []) {
 }
 
 // src/commands/pair-auto.ts
-var fs27 = __toESM(require("fs"));
+var fs28 = __toESM(require("fs"));
 var os24 = __toESM(require("os"));
 var import_crypto7 = require("crypto");
 var API_BASE8 = resolveApiBaseUrl();
@@ -15361,10 +15736,10 @@ function readTokenFromArgs(args2) {
   if (fileFlag) {
     const path40 = fileFlag.slice("--token-file=".length);
     try {
-      const content = fs27.readFileSync(path40, "utf8").trim();
+      const content = fs28.readFileSync(path40, "utf8").trim();
       if (content.length === 0) fail(`--token-file ${path40} is empty`);
       try {
-        fs27.unlinkSync(path40);
+        fs28.unlinkSync(path40);
       } catch {
       }
       return content;
@@ -15487,7 +15862,7 @@ async function pairAuto(args2) {
 }
 
 // src/commands/sessions.ts
-var import_picocolors4 = __toESM(require("picocolors"));
+var import_picocolors5 = __toESM(require("picocolors"));
 async function sessions2(args2) {
   const [sub, id] = args2;
   if (sub === "switch") return switchSession();
@@ -15504,18 +15879,18 @@ function listSessions() {
   showIntro();
   const config = getConfig();
   if (config.sessions.length === 0) {
-    console.log(import_picocolors4.default.dim("  No paired sessions. Run codeam pair to connect.\n"));
+    console.log(import_picocolors5.default.dim("  No paired sessions. Run codeam pair to connect.\n"));
     return;
   }
-  console.log(import_picocolors4.default.bold("  Paired sessions:\n"));
+  console.log(import_picocolors5.default.bold("  Paired sessions:\n"));
   for (const s of config.sessions) {
     const isActive = s.id === config.activeSessionId;
-    const bullet = isActive ? import_picocolors4.default.green("  \u25CF") : import_picocolors4.default.dim("  \u25CB");
-    const name = isActive ? import_picocolors4.default.bold(s.userName) : s.userName;
-    const plan = import_picocolors4.default.cyan(s.plan);
-    const date = import_picocolors4.default.dim(new Date(s.pairedAt).toLocaleDateString());
+    const bullet = isActive ? import_picocolors5.default.green("  \u25CF") : import_picocolors5.default.dim("  \u25CB");
+    const name = isActive ? import_picocolors5.default.bold(s.userName) : s.userName;
+    const plan = import_picocolors5.default.cyan(s.plan);
+    const date = import_picocolors5.default.dim(new Date(s.pairedAt).toLocaleDateString());
     console.log(`${bullet}  ${name}  ${plan}  ${date}`);
-    console.log(import_picocolors4.default.dim(`       ${s.id}`));
+    console.log(import_picocolors5.default.dim(`       ${s.id}`));
   }
   console.log("");
 }
@@ -15533,7 +15908,7 @@ async function switchSession() {
   }
   setActiveSession(chosen);
   const s = config.sessions.find((x) => x.id === chosen);
-  console.log(import_picocolors4.default.green(`
+  console.log(import_picocolors5.default.green(`
   \u2713 Switched to ${s?.userName ?? chosen}
 `));
 }
@@ -15551,29 +15926,29 @@ async function deleteSession(id) {
     return;
   }
   removeSession(id);
-  console.log(import_picocolors4.default.green("\n  \u2713 Session deleted\n"));
+  console.log(import_picocolors5.default.green("\n  \u2713 Session deleted\n"));
 }
 
 // src/commands/status.ts
-var import_picocolors5 = __toESM(require("picocolors"));
+var import_picocolors6 = __toESM(require("picocolors"));
 function status() {
   showIntro();
   const config = getConfig();
   const active = config.sessions.find((s) => s.id === config.activeSessionId) ?? null;
-  console.log(import_picocolors5.default.bold("  Status\n"));
-  console.log(`  Plugin ID   ${import_picocolors5.default.dim(config.pluginId || "not generated yet")}`);
+  console.log(import_picocolors6.default.bold("  Status\n"));
+  console.log(`  Plugin ID   ${import_picocolors6.default.dim(config.pluginId || "not generated yet")}`);
   console.log(`  Sessions    ${config.sessions.length} paired`);
   if (active) {
-    console.log(`  Active      ${import_picocolors5.default.bold(active.userName)}  ${import_picocolors5.default.cyan(active.plan)}`);
-    console.log(`  Session ID  ${import_picocolors5.default.dim(active.id)}`);
+    console.log(`  Active      ${import_picocolors6.default.bold(active.userName)}  ${import_picocolors6.default.cyan(active.plan)}`);
+    console.log(`  Session ID  ${import_picocolors6.default.dim(active.id)}`);
   } else {
-    console.log(`  Active      ${import_picocolors5.default.yellow("none")}  ${import_picocolors5.default.dim("run codeam pair to connect")}`);
+    console.log(`  Active      ${import_picocolors6.default.yellow("none")}  ${import_picocolors6.default.dim("run codeam pair to connect")}`);
   }
   console.log("");
 }
 
 // src/commands/logout.ts
-var import_picocolors6 = __toESM(require("picocolors"));
+var import_picocolors7 = __toESM(require("picocolors"));
 var API_BASE9 = resolveApiBaseUrl();
 async function notifyBackendOffline() {
   const cfg = loadCliConfig();
@@ -15607,17 +15982,17 @@ async function logout() {
   }
   await notifyBackendOffline();
   clearAll();
-  console.log(import_picocolors6.default.green("\n  \u2713 Done. All sessions removed.\n"));
+  console.log(import_picocolors7.default.green("\n  \u2713 Done. All sessions removed.\n"));
 }
 
 // src/commands/deploy.ts
-var import_picocolors9 = __toESM(require("picocolors"));
+var import_picocolors10 = __toESM(require("picocolors"));
 
 // src/services/providers/github-codespaces.ts
 var import_child_process14 = require("child_process");
 var import_util3 = require("util");
-var import_picocolors7 = __toESM(require("picocolors"));
-var path33 = __toESM(require("path"));
+var import_picocolors8 = __toESM(require("picocolors"));
+var path34 = __toESM(require("path"));
 var execFileP4 = (0, import_util3.promisify)(import_child_process14.execFile);
 var MAX_BUFFER = 8 * 1024 * 1024;
 function resetStdinForChild() {
@@ -15684,7 +16059,7 @@ var GitHubCodespacesProvider = class {
       if (expectedUser) {
         noteLines.push("");
         noteLines.push(
-          `${import_picocolors7.default.yellow("\u26A0")}  Sign in as ${import_picocolors7.default.cyan(expectedUser)} in the browser.`
+          `${import_picocolors8.default.yellow("\u26A0")}  Sign in as ${import_picocolors8.default.cyan(expectedUser)} in the browser.`
         );
         noteLines.push(
           "   If a different GitHub account is already signed in, sign out"
@@ -15707,7 +16082,7 @@ var GitHubCodespacesProvider = class {
       if (refreshCode !== 0) {
         const lines = [
           "The browser approval came back for a different GitHub account",
-          `than the one gh is configured for${expectedUser ? ` (${import_picocolors7.default.cyan(expectedUser)})` : ""}.`,
+          `than the one gh is configured for${expectedUser ? ` (${import_picocolors8.default.cyan(expectedUser)})` : ""}.`,
           "",
           "To recover:",
           "  1. Open https://github.com and sign out of any non-target",
@@ -15716,7 +16091,7 @@ var GitHubCodespacesProvider = class {
           "",
           "You can also grant the scope manually first and skip this step",
           "on the next run:",
-          `  ${import_picocolors7.default.cyan("gh auth refresh -h github.com -s codespace")}`
+          `  ${import_picocolors8.default.cyan("gh auth refresh -h github.com -s codespace")}`
         ];
         throw new Error(lines.join("\n"));
       }
@@ -15783,7 +16158,7 @@ var GitHubCodespacesProvider = class {
   async tryInstallGh() {
     const platform2 = process.platform;
     wt(
-      `GitHub CLI (${import_picocolors7.default.cyan("gh")}) is required for Codespaces deploys but isn't on your PATH.`,
+      `GitHub CLI (${import_picocolors8.default.cyan("gh")}) is required for Codespaces deploys but isn't on your PATH.`,
       "Heads up"
     );
     if (platform2 === "linux") {
@@ -15839,7 +16214,7 @@ var GitHubCodespacesProvider = class {
       return;
     }
     const proceed = await ot2({
-      message: `Run ${import_picocolors7.default.cyan(installCmd.describe)} now?`,
+      message: `Run ${import_picocolors8.default.cyan(installCmd.describe)} now?`,
       initialValue: true
     });
     if (q(proceed) || !proceed) return;
@@ -16106,7 +16481,7 @@ var GitHubCodespacesProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path33.posix.dirname(remotePath);
+    const remoteDir = path34.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote(remoteDir)}`,
       `cat > ${shellQuote(remotePath)}`
@@ -16176,8 +16551,8 @@ function shellQuote(s) {
 // src/services/providers/gitpod.ts
 var import_child_process15 = require("child_process");
 var import_util4 = require("util");
-var path34 = __toESM(require("path"));
-var import_picocolors8 = __toESM(require("picocolors"));
+var path35 = __toESM(require("path"));
+var import_picocolors9 = __toESM(require("picocolors"));
 var execFileP5 = (0, import_util4.promisify)(import_child_process15.execFile);
 var MAX_BUFFER2 = 8 * 1024 * 1024;
 function resetStdinForChild2() {
@@ -16416,7 +16791,7 @@ var GitpodProvider = class {
     });
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
-    const remoteDir = path34.posix.dirname(remotePath);
+    const remoteDir = path35.posix.dirname(remotePath);
     const parts = [
       `mkdir -p ${shellQuote2(remoteDir)}`,
       `cat > ${shellQuote2(remotePath)}`
@@ -16452,7 +16827,7 @@ function shellQuote2(s) {
 // src/services/providers/gitlab-workspaces.ts
 var import_child_process16 = require("child_process");
 var import_util5 = require("util");
-var path35 = __toESM(require("path"));
+var path36 = __toESM(require("path"));
 var execFileP6 = (0, import_util5.promisify)(import_child_process16.execFile);
 var MAX_BUFFER3 = 8 * 1024 * 1024;
 var GITLAB_API_BASE = process.env.CODEAM_GITLAB_API_URL ?? "https://gitlab.com/api/v4";
@@ -16712,7 +17087,7 @@ Docs: https://docs.gitlab.com/ee/user/workspace/configuration.html`
   }
   async uploadFile(workspaceId, remotePath, contents, options = {}) {
     const sshHost = process.env.CODEAM_GITLAB_SSH_HOST ?? "workspaces.gitlab.com";
-    const remoteDir = path35.posix.dirname(remotePath);
+    const remoteDir = path36.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote3(remoteDir)}`, `cat > ${shellQuote3(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote3(remotePath)}`);
@@ -16780,7 +17155,7 @@ function shellQuote3(s) {
 // src/services/providers/railway.ts
 var import_child_process17 = require("child_process");
 var import_util6 = require("util");
-var path36 = __toESM(require("path"));
+var path37 = __toESM(require("path"));
 var execFileP7 = (0, import_util6.promisify)(import_child_process17.execFile);
 var MAX_BUFFER4 = 8 * 1024 * 1024;
 function resetStdinForChild4() {
@@ -17016,7 +17391,7 @@ var RailwayProvider = class {
     if (!projectId || !serviceId) {
       throw new Error("Invalid Railway workspace id (expected projectId/serviceId).");
     }
-    const remoteDir = path36.posix.dirname(remotePath);
+    const remoteDir = path37.posix.dirname(remotePath);
     const parts = [`mkdir -p ${shellQuote4(remoteDir)}`, `cat > ${shellQuote4(remotePath)}`];
     if (options.mode != null) {
       parts.push(`chmod ${options.mode.toString(8)} ${shellQuote4(remotePath)}`);
@@ -17057,7 +17432,7 @@ var PROVIDERS = [
 // src/commands/deploy.ts
 async function deploy(args2 = []) {
   console.log();
-  mt(import_picocolors9.default.bgMagenta(import_picocolors9.default.white(" codeam deploy ")));
+  mt(import_picocolors10.default.bgMagenta(import_picocolors10.default.white(" codeam deploy ")));
   const provider = await pickProvider();
   if (!provider) {
     pt("No provider selected.");
@@ -17094,7 +17469,7 @@ async function deploy(args2 = []) {
     if (provider.expandListScopes) {
       options.push({
         value: EXPAND_SCOPES,
-        label: import_picocolors9.default.cyan("+ Don't see your project? Expand scopes\u2026"),
+        label: import_picocolors10.default.cyan("+ Don't see your project? Expand scopes\u2026"),
         hint: "Re-authorize with broader scopes (org / team repos)"
       });
     }
@@ -17142,7 +17517,7 @@ async function deploy(args2 = []) {
             label: w3.displayName ?? w3.id,
             hint: [w3.state, formatLastUsed(w3.lastUsedAt)].filter(Boolean).join(" \xB7 ")
           })),
-          { value: "__new__", label: import_picocolors9.default.green("+ Create a new workspace"), hint: "fresh codespace" }
+          { value: "__new__", label: import_picocolors10.default.green("+ Create a new workspace"), hint: "fresh codespace" }
         ]
       });
       if (q(choice)) {
@@ -17243,12 +17618,12 @@ async function deploy(args2 = []) {
   cliStep.stop("\u2713 codeam-cli installed");
   wt(
     [
-      `Workspace: ${import_picocolors9.default.cyan(workspace.displayName ?? workspace.id)}`,
-      workspace.webUrl ? `Web:       ${import_picocolors9.default.cyan(workspace.webUrl)}` : "",
+      `Workspace: ${import_picocolors10.default.cyan(workspace.displayName ?? workspace.id)}`,
+      workspace.webUrl ? `Web:       ${import_picocolors10.default.cyan(workspace.webUrl)}` : "",
       "",
       `Starting \`codeam pair\` on the workspace (agent: ${AGENT_REGISTRY[agentId].displayName}).`,
       "Scan the QR code from your phone to pair.",
-      import_picocolors9.default.dim("(Once paired, this terminal disconnects automatically; the session stays alive on the codespace.)")
+      import_picocolors10.default.dim("(Once paired, this terminal disconnects automatically; the session stays alive on the codespace.)")
     ].filter(Boolean).join("\n"),
     "Almost there"
   );
@@ -17363,11 +17738,11 @@ async function deploy(args2 = []) {
   ].join("\n");
   const code = (await provider.streamCommand(workspace.id, `bash -lc ${shellQuoteSingle(wrapper)}`)).code;
   if (code === 0) {
-    gt(import_picocolors9.default.green("\u2713 Workspace deployed and paired. Drive from your phone, anywhere."));
+    gt(import_picocolors10.default.green("\u2713 Workspace deployed and paired. Drive from your phone, anywhere."));
   } else if (code === 130) {
-    gt(import_picocolors9.default.yellow("Disconnected from local terminal. Mobile session keeps running on the codespace."));
+    gt(import_picocolors10.default.yellow("Disconnected from local terminal. Mobile session keeps running on the codespace."));
   } else {
-    gt(import_picocolors9.default.yellow('Pairing did not complete. Run "codeam pair" inside the codespace if needed.'));
+    gt(import_picocolors10.default.yellow('Pairing did not complete. Run "codeam pair" inside the codespace if needed.'));
   }
 }
 function shellQuoteSingle(s) {
@@ -17401,7 +17776,7 @@ async function pickProvider() {
     message: "Where do you want to deploy?",
     options: PROVIDERS.map((prov) => ({
       value: prov.id,
-      label: prov.available ? prov.displayName : `${prov.displayName} ${import_picocolors9.default.dim("(coming soon)")}`,
+      label: prov.available ? prov.displayName : `${prov.displayName} ${import_picocolors10.default.dim("(coming soon)")}`,
       hint: prov.tagline
     }))
   });
@@ -17415,464 +17790,144 @@ async function pickProvider() {
     return null;
   }
   return found;
-}
-
-// src/commands/deploy-manage.ts
-var import_picocolors10 = __toESM(require("picocolors"));
-async function deployList() {
-  console.log();
-  mt(import_picocolors10.default.bgMagenta(import_picocolors10.default.white(" codeam deploy ls ")));
-  const workspaces = await collectWorkspacesWithStatus();
-  if (workspaces.length === 0) {
-    gt(import_picocolors10.default.dim("No deployed workspaces found."));
-    return;
-  }
-  for (const w3 of workspaces) {
-    const tag = w3.codeamRunning ? import_picocolors10.default.green("\u25CF running") : w3.state === "Available" ? import_picocolors10.default.dim("\u25CB idle") : import_picocolors10.default.dim(`\u25CB ${w3.state ?? "stopped"}`);
-    console.log(`  ${tag}  ${import_picocolors10.default.cyan(w3.displayName ?? w3.id)}  ${import_picocolors10.default.dim("(" + w3.providerName + ")")}`);
-  }
-  gt(import_picocolors10.default.dim("Use `codeam deploy stop` to terminate a session."));
-}
-async function deployStop() {
-  console.log();
-  mt(import_picocolors10.default.bgMagenta(import_picocolors10.default.white(" codeam deploy stop ")));
-  const workspaces = await collectWorkspacesWithStatus();
-  if (workspaces.length === 0) {
-    gt(import_picocolors10.default.dim("No deployed workspaces found."));
-    return;
-  }
-  const choice = await _t({
-    message: "Pick a workspace to stop:",
-    options: workspaces.map((w3) => ({
-      value: w3.id,
-      label: w3.displayName ?? w3.id,
-      hint: [
-        w3.providerName,
-        w3.codeamRunning ? import_picocolors10.default.green("\u25CF codeam-pair running") : import_picocolors10.default.dim("\u25CB no codeam-pair"),
-        w3.state ?? ""
-      ].filter(Boolean).join(" \xB7 ")
-    }))
-  });
-  if (q(choice)) {
-    pt("Cancelled.");
-    process.exit(0);
-  }
-  const target = workspaces.find((w3) => w3.id === choice);
-  if (target.codeamRunning) {
-    const stopStep = fe();
-    stopStep.start("Stopping codeam-pair on the workspace\u2026");
-    try {
-      const result = await target.provider.exec(
-        target.id,
-        "pm2 delete codeam-pair >/dev/null 2>&1; pm2 list 2>/dev/null | grep -c codeam-pair || true"
-      );
-      void result;
-      stopStep.stop("\u2713 codeam-pair stopped \u2014 your phone is now disconnected from this workspace");
-    } catch (err) {
-      stopStep.stop("\u26A0 Could not reach the workspace to stop codeam-pair");
-      void err;
-    }
-  } else {
-    O2.info("No codeam-pair process to stop on this workspace.");
-  }
-  const alsoStop = await ot2({
-    message: `Also stop the workspace ${import_picocolors10.default.cyan(target.displayName ?? target.id)} to save compute hours?`,
-    initialValue: true
-  });
-  if (!q(alsoStop) && alsoStop) {
-    const cs = fe();
-    cs.start("Stopping workspace\u2026");
-    try {
-      const result = await target.provider.exec(
-        target.id,
-        // We'd ideally use a provider method; for now do it inline
-        // — works for the github-codespaces provider, no-op-ish for
-        // others (the command will fail and we fall back gracefully).
-        "echo stopping"
-      );
-      void result;
-      await stopWorkspaceFromLocal(target);
-      cs.stop(`\u2713 Workspace ${target.displayName ?? target.id} is stopping`);
-    } catch (err) {
-      cs.stop("\u26A0 Could not stop the workspace");
-      O2.warn(err instanceof Error ? err.message : String(err));
-    }
-  }
-  gt(import_picocolors10.default.green("\u2713 Done."));
-}
-async function collectWorkspacesWithStatus() {
-  const out2 = [];
-  const ready = PROVIDERS.filter((prov) => prov.available);
-  for (const provider of ready) {
-    if (!provider.listExistingWorkspaces) continue;
-    const probeStep = fe();
-    probeStep.start(`Listing ${provider.displayName} workspaces\u2026`);
-    let workspaces = [];
-    try {
-      await provider.authorize();
-      workspaces = await provider.listExistingWorkspaces();
-      probeStep.stop(`\u2713 ${workspaces.length} workspace${workspaces.length === 1 ? "" : "s"} on ${provider.displayName}`);
-    } catch (err) {
-      probeStep.stop(`\u2717 Could not list ${provider.displayName} workspaces`);
-      O2.warn(err instanceof Error ? err.message : String(err));
-      continue;
-    }
-    for (const w3 of workspaces) {
-      const codeamRunning = await probeCodeamPair(provider, w3);
-      out2.push({
-        ...w3,
-        provider,
-        providerName: provider.displayName,
-        codeamRunning
-      });
-    }
-  }
-  return out2;
-}
-async function probeCodeamPair(provider, workspace) {
-  if (workspace.state && workspace.state !== "Available") return false;
-  try {
-    const result = await provider.exec(
-      workspace.id,
-      // `online` is the only state we care about — `errored`, `stopped`,
-      // `stopping` all mean it's not actively serving the user's phone.
-      `pm2 jlist 2>/dev/null | grep -c '"name":"codeam-pair"[^}]*"status":"online"' || echo 0`
-    );
-    if (result.code !== 0) return false;
-    const n = parseInt(result.stdout.trim(), 10);
-    return Number.isFinite(n) && n > 0;
-  } catch {
-    return false;
-  }
-}
-async function stopWorkspaceFromLocal(target) {
-  if (target.provider.id === "github-codespaces") {
-    const { execFile: execFile8 } = await import("child_process");
-    const { promisify: promisify9 } = await import("util");
-    const execFileP8 = promisify9(execFile8);
-    await execFileP8("gh", ["codespace", "stop", "-c", target.id], { maxBuffer: 8 * 1024 * 1024 });
-    return;
-  }
-}
-
-// src/commands/link.ts
-var import_node_crypto4 = require("crypto");
-var fs28 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
-var import_chokidar = __toESM(require("chokidar"));
-var import_picocolors11 = __toESM(require("picocolors"));
-function buildLinkContext(agentId) {
-  const runtime = createRuntimeStrategy(agentId);
-  return {
-    runtime,
-    locator: runtime.credentialLocator(),
-    launcher: runtime.loginLauncher(),
-    displayName: runtime.meta.displayName,
-    binary: runtime.meta.binaryName
-  };
-}
-function enabledLinkableAgents() {
-  return Object.values(AGENT_REGISTRY).filter((m) => m.enabled).map((m) => m.id);
-}
-function parseLinkArgs(args2) {
-  const positional = args2.find((a) => !a.startsWith("--"));
-  const valid = enabledLinkableAgents();
-  if (!positional) {
-    throw new Error(
-      `Usage: codeam link <agent>
-         agent: ${valid.join(" | ")}`
-    );
-  }
-  const normalised = positional === "claude_code" ? "claude" : positional;
-  if (!isKnownAgentId(normalised) || !AGENT_REGISTRY[normalised].enabled) {
-    throw new Error(
-      `Unknown or unsupported agent "${positional}". Valid: ${valid.join(", ")}`
-    );
-  }
-  const reuseExisting = args2.includes("--reuse-existing");
-  const dryRun = args2.includes("--dry-run");
-  const apiKeyFileArg = args2.find((a) => a.startsWith("--api-key-file="));
-  let apiKey = null;
-  if (apiKeyFileArg) {
-    const filePath = apiKeyFileArg.slice("--api-key-file=".length);
-    try {
-      apiKey = fs28.readFileSync(path37.resolve(filePath), "utf8").trim();
-    } catch (err) {
-      throw new Error(`Could not read --api-key-file ${filePath}: ${err.message}`);
-    }
-    if (!apiKey) {
-      throw new Error(`--api-key-file ${filePath} is empty.`);
-    }
-  } else {
-    const apiKeyArg = args2.find((a) => a.startsWith("--api-key="));
-    apiKey = apiKeyArg ? apiKeyArg.slice("--api-key=".length) : null;
-  }
-  const tokenFileArg = args2.find((a) => a.startsWith("--token-file="));
-  const tokenFile = tokenFileArg ? tokenFileArg.slice("--token-file=".length) : null;
-  return { agent: normalised, reuseExisting, apiKey, tokenFile, dryRun };
-}
-async function link(args2 = []) {
-  const parsed = parseLinkArgs(args2);
-  const ctx = buildLinkContext(parsed.agent);
-  showIntro();
-  console.log(
-    import_picocolors11.default.bold(`  Link ${ctx.displayName}`) + import_picocolors11.default.dim(`  \xB7  ${ctx.locator.vendor}`)
-  );
-  console.log("");
-  if (parsed.dryRun) {
-    await linkDryRunPreflight(ctx);
-    return;
-  }
-  const pluginId = (0, import_node_crypto4.randomUUID)();
-  const spin = dist_exports.spinner();
-  spin.start("Requesting pairing code...");
-  const pairing = await requestCode(pluginId);
-  if (!pairing) {
-    spin.stop("Failed");
-    showError("Could not reach the server. Check your connection and try again.");
-    process.exit(1);
-  }
-  spin.stop("Got pairing code");
-  showPairingCode(pairing.code);
-  console.log(import_picocolors11.default.dim("  Scan the QR or enter the code in CodeAgent Mobile."));
-  console.log("");
-  const waitSpin = dist_exports.spinner();
-  const waitMsg = () => `Waiting for mobile pair... \xB7 expires in ${formatRemaining(pairing.expiresAt)}`;
-  waitSpin.start(waitMsg());
-  const countdown = setInterval(() => waitSpin.message(waitMsg()), 1e3);
-  countdown.unref?.();
-  const paired = await new Promise((resolve5, reject) => {
-    let stopPoll = null;
-    const sigint = () => {
-      clearInterval(countdown);
-      stopPoll?.();
-      reject(new Error("cancelled"));
-    };
-    stopPoll = pollStatus(
-      pluginId,
-      (info) => {
-        process.removeListener("SIGINT", sigint);
-        clearInterval(countdown);
-        waitSpin.stop("Paired");
-        resolve5(info);
-      },
-      () => {
-        clearInterval(countdown);
-        waitSpin.stop("Timed out");
-        reject(new Error("Pairing timed out after 5 minutes. Run codeam link again."));
-      }
-    );
-    process.once("SIGINT", sigint);
-  });
-  if (!paired.pluginAuthToken) {
-    showError(
-      "Backend did not return a pluginAuthToken \u2014 upgrade api-v2 (deploy includes the link endpoint)."
-    );
-    process.exit(1);
-  }
-  addSession({
-    id: paired.sessionId,
-    pluginId,
-    userName: paired.userName,
-    userEmail: paired.userEmail,
-    plan: paired.plan,
-    pairedAt: Date.now(),
-    pluginAuthToken: paired.pluginAuthToken,
-    agent: ctx.runtime.id
-  });
-  saveCliConfig({ ...loadCliConfig(), preferredAgent: ctx.runtime.id });
-  if (parsed.apiKey) {
-    await uploadAndSucceed(ctx, paired, pluginId, {
-      method: "api_key",
-      credential: parsed.apiKey.trim(),
-      source: "manual"
-    });
-    return;
-  }
-  if (parsed.tokenFile) {
-    const credential = fs28.readFileSync(path37.resolve(parsed.tokenFile), "utf8").trim();
-    if (!credential) {
-      showError(`--token-file ${parsed.tokenFile} is empty.`);
-      process.exit(1);
-    }
-    await uploadAndSucceed(ctx, paired, pluginId, {
-      method: "oauth",
-      credential,
-      source: "manual"
-    });
-    return;
-  }
-  const installSpin = dist_exports.spinner();
-  installSpin.start(`Checking that ${ctx.binary} is installed...`);
-  const installed = await ctx.launcher.ensureInstalled();
-  if (!installed) {
-    installSpin.stop("Failed");
-    showError(`Could not install ${ctx.displayName}. Install it manually then re-run.`);
-    process.exit(1);
-  }
-  installSpin.stop(`${ctx.displayName} is installed`);
-  const existing = await ctx.locator.extract();
-  if (existing) {
-    showInfo(`Found existing ${ctx.displayName} credentials at ${import_picocolors11.default.bold(existing.source)}.`);
-    await uploadAndSucceed(ctx, paired, pluginId, existing);
+}
+
+// src/commands/deploy-manage.ts
+var import_picocolors11 = __toESM(require("picocolors"));
+async function deployList() {
+  console.log();
+  mt(import_picocolors11.default.bgMagenta(import_picocolors11.default.white(" codeam deploy ls ")));
+  const workspaces = await collectWorkspacesWithStatus();
+  if (workspaces.length === 0) {
+    gt(import_picocolors11.default.dim("No deployed workspaces found."));
     return;
   }
-  if (parsed.reuseExisting) {
-    showError(
-      `--reuse-existing set, but no local ${ctx.displayName} credentials were found at ${ctx.locator.hint}.`
-    );
-    process.exit(1);
+  for (const w3 of workspaces) {
+    const tag = w3.codeamRunning ? import_picocolors11.default.green("\u25CF running") : w3.state === "Available" ? import_picocolors11.default.dim("\u25CB idle") : import_picocolors11.default.dim(`\u25CB ${w3.state ?? "stopped"}`);
+    console.log(`  ${tag}  ${import_picocolors11.default.cyan(w3.displayName ?? w3.id)}  ${import_picocolors11.default.dim("(" + w3.providerName + ")")}`);
   }
-  showInfo(
-    `No local ${ctx.displayName} credentials found. Launching the sign-in \u2014 complete it in your browser, the CLI will detect the new token and finish automatically.`
-  );
-  console.log("");
-  const captured = await captureFreshCredentials(ctx);
-  console.log("");
-  await uploadAndSucceed(ctx, paired, pluginId, captured);
+  gt(import_picocolors11.default.dim("Use `codeam deploy stop` to terminate a session."));
 }
-async function captureFreshCredentials(ctx) {
-  const isWin = ctx.runtime.os.id === "win32";
-  const watcher = import_chokidar.default.watch(ctx.locator.watchPaths(), {
-    persistent: true,
-    ignoreInitial: false,
-    awaitWriteFinish: { stabilityThreshold: 500, pollInterval: 100 },
-    // Windows-only: when a credential file's ancestor is missing,
-    // chokidar walks up to the closest existing parent and starts
-    // traversing it. On a default Windows shell that ancestor is
-    // `C:\Users\<u>`, which contains legacy junctions whose ACL makes
-    // `fs.watch` throw EPERM (#43). These flags are no-ops on macOS,
-    // where the user has read access to their entire home.
-    ...isWin ? { followSymlinks: false, ignorePermissionErrors: true } : {}
-  });
-  watcher.on("error", () => {
+async function deployStop() {
+  console.log();
+  mt(import_picocolors11.default.bgMagenta(import_picocolors11.default.white(" codeam deploy stop ")));
+  const workspaces = await collectWorkspacesWithStatus();
+  if (workspaces.length === 0) {
+    gt(import_picocolors11.default.dim("No deployed workspaces found."));
+    return;
+  }
+  const choice = await _t({
+    message: "Pick a workspace to stop:",
+    options: workspaces.map((w3) => ({
+      value: w3.id,
+      label: w3.displayName ?? w3.id,
+      hint: [
+        w3.providerName,
+        w3.codeamRunning ? import_picocolors11.default.green("\u25CF codeam-pair running") : import_picocolors11.default.dim("\u25CB no codeam-pair"),
+        w3.state ?? ""
+      ].filter(Boolean).join(" \xB7 ")
+    }))
   });
-  let child = null;
-  let keychainPoll = null;
-  const cleanup = () => {
-    void watcher.close();
-    if (keychainPoll) clearInterval(keychainPoll);
-    if (child && !child.killed) {
-      try {
-        child.kill("SIGTERM");
-      } catch {
-      }
-    }
-  };
-  try {
-    const token = await new Promise((resolve5, reject) => {
-      let settled = false;
-      const tryExtract = async () => {
-        if (settled) return;
-        const t2 = await ctx.locator.extract();
-        if (t2 && !settled) {
-          settled = true;
-          resolve5(t2);
-        }
-      };
-      watcher.on("add", () => void tryExtract());
-      watcher.on("change", () => void tryExtract());
-      keychainPoll = setInterval(() => void tryExtract(), 2e3);
-      keychainPoll.unref?.();
-      const sigint = () => {
-        if (settled) return;
-        settled = true;
-        reject(new Error("cancelled"));
-      };
-      process.once("SIGINT", sigint);
-      setTimeout(() => {
-        if (settled) return;
-        settled = true;
-        reject(new Error(`Timed out waiting for ${ctx.displayName} sign-in (5 minutes).`));
-      }, 5 * 6e4);
-      child = ctx.launcher.launch();
-      child.on("exit", () => {
-        void tryExtract().then(() => {
-          if (!settled) {
-            settled = true;
-            reject(
-              new Error(
-                `${ctx.binary} exited but no credentials were written at ${ctx.locator.hint}.`
-              )
-            );
-          }
-        });
-      });
-    });
-    cleanup();
-    return token;
-  } catch (err) {
-    cleanup();
-    throw err;
+  if (q(choice)) {
+    pt("Cancelled.");
+    process.exit(0);
   }
-}
-async function uploadAndSucceed(ctx, paired, pluginId, token) {
-  if (!paired.pluginAuthToken) {
-    showError("Missing pluginAuthToken; re-run codeam link.");
-    process.exit(1);
+  const target = workspaces.find((w3) => w3.id === choice);
+  if (target.codeamRunning) {
+    const stopStep = fe();
+    stopStep.start("Stopping codeam-pair on the workspace\u2026");
+    try {
+      const result = await target.provider.exec(
+        target.id,
+        "pm2 delete codeam-pair >/dev/null 2>&1; pm2 list 2>/dev/null | grep -c codeam-pair || true"
+      );
+      void result;
+      stopStep.stop("\u2713 codeam-pair stopped \u2014 your phone is now disconnected from this workspace");
+    } catch (err) {
+      stopStep.stop("\u26A0 Could not reach the workspace to stop codeam-pair");
+      void err;
+    }
+  } else {
+    O2.info("No codeam-pair process to stop on this workspace.");
   }
-  const uploadSpin = dist_exports.spinner();
-  uploadSpin.start("Sealing credential in your vault...");
-  const result = await postLinkCredential({
-    agentId: ctx.locator.publicId,
-    sessionId: paired.sessionId,
-    pluginId,
-    pluginAuthToken: paired.pluginAuthToken,
-    method: token.method,
-    credential: token.credential
+  const alsoStop = await ot2({
+    message: `Also stop the workspace ${import_picocolors11.default.cyan(target.displayName ?? target.id)} to save compute hours?`,
+    initialValue: true
   });
-  if (!result.ok) {
-    uploadSpin.stop("Failed");
-    if (result.status === 401) {
-      showError("Pair token rejected by the backend (401). Re-run `codeam link`.");
-    } else if (result.status === 404) {
-      showError(
-        `${ctx.displayName} link endpoint not available on this backend (404). The api-v2 deployment may not yet include the route.`
+  if (!q(alsoStop) && alsoStop) {
+    const cs = fe();
+    cs.start("Stopping workspace\u2026");
+    try {
+      const result = await target.provider.exec(
+        target.id,
+        // We'd ideally use a provider method; for now do it inline
+        // — works for the github-codespaces provider, no-op-ish for
+        // others (the command will fail and we fall back gracefully).
+        "echo stopping"
       );
-    } else {
-      showError(`Upload failed: ${result.message}`);
+      void result;
+      await stopWorkspaceFromLocal(target);
+      cs.stop(`\u2713 Workspace ${target.displayName ?? target.id} is stopping`);
+    } catch (err) {
+      cs.stop("\u26A0 Could not stop the workspace");
+      O2.warn(err instanceof Error ? err.message : String(err));
     }
-    process.exit(1);
   }
-  uploadSpin.stop("Linked");
-  console.log("");
-  showSuccess(`${ctx.displayName} is now linked to ${paired.userEmail || paired.userName}.`);
-  showInfo(
-    `Your codespaces and @codeagent mentions can now use ${ctx.displayName} without you signing in again.`
-  );
-  console.log("");
+  gt(import_picocolors11.default.green("\u2713 Done."));
 }
-async function linkDryRunPreflight(ctx) {
-  const publicId = ctx.locator.publicId;
-  const spin = dist_exports.spinner();
-  spin.start(`Probing ${publicId} link endpoint...`);
-  const result = await postLinkCredential({
-    agentId: publicId,
-    sessionId: "dryrun-session",
-    pluginId: "dryrun-plugin",
-    pluginAuthToken: "dryrun-token",
-    method: "oauth",
-    credential: "dryrun-credential"
-  });
-  if (result.ok) {
-    spin.stop("Unexpected 2xx");
-    showError(
-      "Link dry-run: backend accepted a stub credential (2xx). PluginAuthGuard appears to be disabled \u2014 investigate api-v2."
-    );
-    process.exit(1);
+async function collectWorkspacesWithStatus() {
+  const out2 = [];
+  const ready = PROVIDERS.filter((prov) => prov.available);
+  for (const provider of ready) {
+    if (!provider.listExistingWorkspaces) continue;
+    const probeStep = fe();
+    probeStep.start(`Listing ${provider.displayName} workspaces\u2026`);
+    let workspaces = [];
+    try {
+      await provider.authorize();
+      workspaces = await provider.listExistingWorkspaces();
+      probeStep.stop(`\u2713 ${workspaces.length} workspace${workspaces.length === 1 ? "" : "s"} on ${provider.displayName}`);
+    } catch (err) {
+      probeStep.stop(`\u2717 Could not list ${provider.displayName} workspaces`);
+      O2.warn(err instanceof Error ? err.message : String(err));
+      continue;
+    }
+    for (const w3 of workspaces) {
+      const codeamRunning = await probeCodeamPair(provider, w3);
+      out2.push({
+        ...w3,
+        provider,
+        providerName: provider.displayName,
+        codeamRunning
+      });
+    }
   }
-  if (result.status === 401) {
-    spin.stop("Endpoint OK");
-    showSuccess(
-      `Link dry-run OK \u2014 /api/plugin/agents/${publicId}/link reachable and auth-gated (401 as expected).`
+  return out2;
+}
+async function probeCodeamPair(provider, workspace) {
+  if (workspace.state && workspace.state !== "Available") return false;
+  try {
+    const result = await provider.exec(
+      workspace.id,
+      // `online` is the only state we care about — `errored`, `stopped`,
+      // `stopping` all mean it's not actively serving the user's phone.
+      `pm2 jlist 2>/dev/null | grep -c '"name":"codeam-pair"[^}]*"status":"online"' || echo 0`
     );
-    process.exit(0);
+    if (result.code !== 0) return false;
+    const n = parseInt(result.stdout.trim(), 10);
+    return Number.isFinite(n) && n > 0;
+  } catch {
+    return false;
+  }
+}
+async function stopWorkspaceFromLocal(target) {
+  if (target.provider.id === "github-codespaces") {
+    const { execFile: execFile8 } = await import("child_process");
+    const { promisify: promisify9 } = await import("util");
+    const execFileP8 = promisify9(execFile8);
+    await execFileP8("gh", ["codespace", "stop", "-c", target.id], { maxBuffer: 8 * 1024 * 1024 });
+    return;
   }
-  spin.stop("Failed");
-  showError(
-    `Link dry-run: unexpected response from /api/plugin/agents/${publicId}/link (status=${result.status}, message=${result.message}). Expected 401.`
-  );
-  process.exit(1);
 }
 
 // src/commands/doctor.ts
@@ -18048,7 +18103,7 @@ function checkChokidar() {
 }
 async function doctor(args2 = []) {
   const json = args2.includes("--json");
-  const cliVersion = true ? "2.21.1" : "0.0.0-dev";
+  const cliVersion = true ? "2.22.0" : "0.0.0-dev";
   const apiBase = resolveApiBaseUrl();
   const diagnosticId = (0, import_node_crypto5.randomUUID)();
   log.info("doctor", `run id=${diagnosticId} cli=${cliVersion}`);
@@ -18247,7 +18302,7 @@ async function completion(args2) {
 // src/commands/version.ts
 var import_picocolors13 = __toESM(require("picocolors"));
 function version2() {
-  const v = true ? "2.21.1" : "unknown";
+  const v = true ? "2.22.0" : "unknown";
   console.log(`${import_picocolors13.default.bold("codeam-cli")} ${import_picocolors13.default.cyan(v)}`);
 }
 
@@ -18475,7 +18530,7 @@ function checkForUpdates() {
   if (process.env.CODEAM_DISABLE_UPDATE_CHECK === "1") return;
   if (process.env.CI) return;
   if (!process.stdout.isTTY) return;
-  const current = true ? "2.21.1" : null;
+  const current = true ? "2.22.0" : null;
   if (!current) return;
   const cache = readCache();
   const fresh = cache && Date.now() - cache.fetchedAt < TTL_MS;