iteration-cli 0.17.1 → 0.19.0

package/dist/cli.js

@@ -7,9 +7,8 @@ var __export = (target, all) => {
 
 // src/cli.ts
 import { spawnSync } from "node:child_process";
-import { promises as fs24 } from "node:fs";
-import os11 from "node:os";
-import path30 from "node:path";
+import { promises as fs29 } from "node:fs";
+import path36 from "node:path";
 import { parseArgs } from "node:util";
 
 // ../trace-vault/packages/cli/dist/index.js
@@ -1580,8 +1579,8 @@ function finalizeIssue(iss, ctx, config22) {
     else
       iss.schema = iss.inst;
   }
-  const schemaError2 = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : void 0;
-  const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError2?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config22.customError?.(iss)) ?? unwrapMessage(config22.localeError?.(iss)) ?? "Invalid input";
+  const schemaError22 = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : void 0;
+  const message = iss.message ? iss.message : unwrapMessage(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage(schemaError22?.(iss)) ?? unwrapMessage(ctx?.error?.(iss)) ?? unwrapMessage(config22.customError?.(iss)) ?? unwrapMessage(config22.localeError?.(iss)) ?? "Invalid input";
   const full = {};
   for (const k of Object.keys(iss)) {
     if (k === "inst" || k === "schema" || k === "continue" || k === "input" || k === "__proto__")
@@ -6197,13 +6196,13 @@ var recordProcessor = (schema, ctx, _json, params) => {
         ...params,
         path: [...params.path, "propertyNames"]
       });
-      let pending = pendingRecords.get(ctx);
-      if (!pending) {
-        pending = [];
-        pendingRecords.set(ctx, pending);
+      let pending2 = pendingRecords.get(ctx);
+      if (!pending2) {
+        pending2 = [];
+        pendingRecords.set(ctx, pending2);
         ctx.deferred.push(() => rewriteKeyNames(ctx));
       }
-      pending.push(schema);
+      pending2.push(schema);
     }
     json2.additionalProperties = processSchema(def.valueType, ctx, {
       ...params,
@@ -7973,16 +7972,16 @@ function consoleWriter(line, level) {
 }
 var loggingContext = () => ({});
 var logWriter = consoleWriter;
-function configureCollectorLogging(context2, write = consoleWriter) {
+function configureCollectorLogging(context2, write2 = consoleWriter) {
   loggingContext = context2;
-  logWriter = write;
+  logWriter = write2;
 }
 function writeLog(line, level) {
   logWriter(line, level);
 }
-function createLogger(context2, write = writeLog) {
+function createLogger(context2, write2 = writeLog) {
   return (entry) => {
-    write(
+    write2(
       JSON.stringify({
         ...entry,
         ...context2,
@@ -12927,7 +12926,7 @@ var connectionSchema = {
   dataDirectory: string2(),
   organizationId: uuid2().optional(),
   organizationName: string2().min(1).max(160).optional(),
-  destination: literal("vault").optional()
+  destination: _enum(["vault", "host"]).optional()
 };
 var configSchema = union([
   object({ ...connectionSchema, codexHome: string2() }).strict(),
@@ -13347,6 +13346,7 @@ async function nextBatch(paths, maxBytes, first = /* @__PURE__ */ new Set()) {
 }
 var recentMessagesSchema = object({
   version: literal(1),
+  captureCwds: record(string2(), string2()).optional(),
   cursors: record(
     string2(),
     number2().int().min(0).max(Number.MAX_SAFE_INTEGER)
@@ -13644,9 +13644,9 @@ async function lastCompleteRecordOffset(filename, size) {
 }
 async function rolloutFiles(root) {
   const files = [];
-  const pending = [root];
-  while (pending.length > 0) {
-    const directory = pending.pop();
+  const pending2 = [root];
+  while (pending2.length > 0) {
+    const directory = pending2.pop();
     if (directory === void 0) continue;
     let entries2;
     try {
@@ -13660,7 +13660,7 @@ async function rolloutFiles(root) {
     }
     for (const entry of entries2) {
       const filename = path4.join(directory, entry.name);
-      if (entry.isDirectory()) pending.push(filename);
+      if (entry.isDirectory()) pending2.push(filename);
       else if (entry.isFile() && /^rollout-.+\.jsonl$/.test(entry.name))
         files.push(filename);
       if (files.length > 1e4)
@@ -13705,9 +13705,6 @@ async function claudeFiles(root) {
 function isSessionFile(filename) {
   return !filename.includes(`${path4.sep}subagents${path4.sep}`);
 }
-async function countSavedSessions(source, home) {
-  return (await sourceFiles(source, home)).filter(isSessionFile).length;
-}
 async function sourceFilesNewestFirst(source, home) {
   const files = await sourceFiles(source, home);
   const listed = [];
@@ -13951,6 +13948,22 @@ function recordScope(source, record32, filename, cwds) {
     cwd: record32.input?.cwd ?? (record32.input?.workspace_roots?.length === 1 ? record32.input.workspace_roots[0] : void 0)
   };
 }
+function captureRecordLocation(source, line, filename, cwds) {
+  let decoded;
+  try {
+    decoded = JSON.parse(line);
+  } catch {
+    delete cwds[filename];
+    return null;
+  }
+  const parsed = scopeRecordSchema.safeParse(decoded);
+  if (!parsed.success) {
+    delete cwds[filename];
+    return null;
+  }
+  const cwd = recordScope(source, parsed.data, filename, cwds).cwd;
+  return cwd && path6.isAbsolute(cwd) ? resolveCaptureLocation(cwd) : null;
+}
 function authorizeVaultRecord(policy, source, line, filename, cwds, accounts = null) {
   let decoded;
   try {
@@ -15216,11 +15229,14 @@ async function vaultAccountIndex(config22) {
     await loadClaudeAccountLedger(config22.dataDirectory)
   ) : null;
 }
-async function scanCaptureState(config22, state, policy, accounts) {
+async function scanCaptureState(config22, state, policy, accounts, host) {
   if (config22.destination === "vault" && policy === void 0)
     throw new Error(
       "Company vault scanning requires a current capture policy."
     );
+  if (config22.destination === "host" && host === void 0)
+    throw new Error("Host collection requires a current capture policy.");
+  const revision = host?.revision ?? policy?.revision;
   const cwds = { ...state.captureCwds };
   const accountIndex = accounts === void 0 ? await vaultAccountIndex(config22) : accounts;
   return {
@@ -15229,15 +15245,21 @@ async function scanCaptureState(config22, state, policy, accounts) {
     persistEvidence: async () => {
       await accountIndex?.persistNativeTools(config22.dataDirectory);
     },
-    checkpoint: policy === void 0 ? {} : { captureCwds: cwds, captureRevision: policy.revision }
+    checkpoint: revision === void 0 ? {} : { captureCwds: cwds, captureRevision: revision }
   };
 }
-async function scanSourceOnce(config22, paths, signal, policy, accounts) {
+async function scanSourceOnce(config22, paths, signal, policy, accounts, host) {
   signal?.throwIfAborted();
   const source = collectorSource(config22);
   const sourceDirectory = path14.resolve(collectorSourceDirectory(config22));
   const state = await loadState(paths);
-  const captureState = await scanCaptureState(config22, state, policy, accounts);
+  const captureState = await scanCaptureState(
+    config22,
+    state,
+    policy,
+    accounts,
+    host
+  );
   if (!state.initialized || state.sourceDirectory !== sourceDirectory) {
     throw new Error(
       `Collector state does not match the ${source} directory; reconnect this source.`
@@ -15363,7 +15385,7 @@ async function scanSourceOnce(config22, paths, signal, policy, accounts) {
           lineStart = index + 1;
           continue;
         }
-        const capture = policy === void 0 ? void 0 : authorizeVaultRecord(
+        const capture = host !== void 0 ? host.authorizeRecord(source, line, filename, captureCwds) : policy === void 0 ? void 0 : authorizeVaultRecord(
           policy,
           source,
           line,
@@ -15453,7 +15475,7 @@ async function readRange(filename, start2, length) {
     await handle.close();
   }
 }
-async function messagesInRecords(source, filename, buffer, start2, room, queuedIds) {
+async function messagesInRecords(source, filename, buffer, start2, room, queuedIds, host, cwds) {
   const events = [];
   let lineStart = 0;
   for (let index = 0; index < buffer.length; index += 1) {
@@ -15476,7 +15498,9 @@ async function messagesInRecords(source, filename, buffer, start2, room, queuedI
       filename,
       byteOffset
     );
-    for (const record32 of parsed) {
+    const capture = host?.authorizeRecord(source, line, filename, cwds);
+    if (capture === null) continue;
+    for (const record32 of scopeVaultEvents(parsed, capture, line)) {
       if (record32.eventType !== "user_message" || queuedIds.has(record32.eventId))
         continue;
       const event3 = await redactTraceEvent(record32);
@@ -15486,17 +15510,19 @@ async function messagesInRecords(source, filename, buffer, start2, room, queuedI
   }
   return { events, consumed: lineStart };
 }
-async function queueRecentMessages(config22, paths, limit2, signal) {
+async function queueRecentMessages(config22, paths, limit2, signal, host) {
   if (limit2 === void 0) return void 0;
   const recent = await loadRecentMessages(paths) ?? {
     version: 1,
     cursors: {},
     queued: [...await queuedUserMessageIds(paths, limit2)],
     sent: 0,
+    captureCwds: {},
     scanned: false
   };
   if (recent.scanned) return new Set(recent.queued);
   const source = collectorSource(config22);
+  const captureCwds = { ...recent.captureCwds };
   const mainCursors = (await loadState(paths)).cursors;
   const files = await sourceFilesNewestFirst(
     source,
@@ -15525,7 +15551,9 @@ async function queueRecentMessages(config22, paths, limit2, signal) {
       buffer,
       start2,
       room,
-      queuedIds
+      queuedIds,
+      host,
+      captureCwds
     );
     for (const event3 of found.events) {
       events.push(event3);
@@ -15543,6 +15571,7 @@ async function queueRecentMessages(config22, paths, limit2, signal) {
   await saveRecentMessages(
     {
       version: 1,
+      ...host === void 0 ? {} : { captureCwds },
       cursors,
       queued,
       sent: recent.sent,
@@ -15558,8 +15587,8 @@ async function settleRecentMessages(paths, limit2) {
   if (recent === null) return { sent: 0, complete: false };
   if (recent.queued.length === 0)
     return { sent: recent.sent, complete: recent.scanned };
-  const pending = await pendingEventIds(paths);
-  const queued = recent.queued.filter((id) => pending.has(id));
+  const pending2 = await pendingEventIds(paths);
+  const queued = recent.queued.filter((id) => pending2.has(id));
   const sent = recent.sent + recent.queued.length - queued.length;
   if (queued.length !== recent.queued.length)
     await saveRecentMessages(
@@ -15594,12 +15623,20 @@ function retryAfterMs(response) {
   const milliseconds = /^\d+$/.test(header) ? Number(header) * 1e3 : Date.parse(header) - Date.now();
   return Number.isFinite(milliseconds) ? Math.max(1e3, Math.min(milliseconds, 3e5)) : 5e3;
 }
-async function uploadPendingOnce(config22, paths, fetcher = collectorFetch, signal, onAcknowledged, policy, first) {
+function captureBatch(pending2, host) {
+  const first = pending2[0];
+  const batchKey = host?.batchKey;
+  if (first === void 0 || batchKey === void 0) return pending2;
+  const key = batchKey(first);
+  return pending2.filter((event3) => batchKey(event3) === key);
+}
+async function uploadPendingOnce(config22, paths, fetcher = collectorFetch, signal, onAcknowledged, policy, first, host) {
   let uploaded = 0;
   for (let attempt = 0; attempt < MAX_UPLOADS_PER_TICK; attempt += 1) {
     signal?.throwIfAborted();
     await recheckQueuedAccounts(config22, paths, policy);
-    const batch = await nextBatch(paths, MAX_UPLOAD_BYTES, first);
+    const pending2 = await nextBatch(paths, MAX_UPLOAD_BYTES, first);
+    const batch = captureBatch(pending2, host);
     if (batch.length === 0) return { uploaded, retryAfterMs: null };
     const body = JSON.stringify({ events: batch });
     if (Buffer.byteLength(body, "utf8") > MAX_REQUEST_BYTES) {
@@ -15668,8 +15705,33 @@ async function recheckQueuedAccounts(config22, paths, policy) {
     (event3) => reauthorizeVaultEvent(policy, event3, accounts)
   );
 }
+async function prepareHostCapture(config22, paths, host) {
+  if (config22.destination === "host" && host === void 0)
+    throw new Error("Host collection requires a current capture policy.");
+  if (host !== void 0) {
+    if (!Number.isSafeInteger(host.revision) || host.revision <= 0)
+      throw new Error("Capture revisions must be positive safe integers.");
+    await rewritePendingEvents(paths, host.authorizeEvent);
+    const state = await loadState(paths);
+    if (state.captureRevision !== host.revision) {
+      await saveState(
+        {
+          ...state,
+          cursors: {},
+          skipping: [],
+          captureCwds: {},
+          captureRevision: host.revision
+        },
+        paths
+      );
+      await fs9.rm(paths.recentMessages, { force: true });
+    }
+  }
+}
 async function collectorTick(config22, paths, fetcher = collectorFetch, signal, onAcknowledged, options = {}) {
   const recentLimit = checkedRecentLimit(config22, options.recentMessages);
+  const host = options.capture;
+  await prepareHostCapture(config22, paths, host);
   const accounts = await vaultAccountIndex(config22);
   const policy = config22.destination === "vault" ? await fetchVaultPolicy(config22.endpoint, config22.token, fetcher, signal) : void 0;
   if (policy !== void 0) {
@@ -15694,7 +15756,13 @@ async function collectorTick(config22, paths, fetcher = collectorFetch, signal,
     }
   }
   await redactPendingOutbox(paths);
-  const first = await queueRecentMessages(config22, paths, recentLimit, signal);
+  const first = await queueRecentMessages(
+    config22,
+    paths,
+    recentLimit,
+    signal,
+    host
+  );
   let upload = await uploadPendingOnce(
     config22,
     paths,
@@ -15702,14 +15770,15 @@ async function collectorTick(config22, paths, fetcher = collectorFetch, signal,
     signal,
     onAcknowledged,
     policy,
-    first
+    first,
+    host
   );
   const scan = await outboxSize(paths) >= SCAN_PAUSE_OUTBOX_BYTES ? {
     discovered: 0,
     excludedRecords: 0,
     caughtUp: false,
     history: await savedHistoryProgress(config22, paths)
-  } : await scanSourceOnce(config22, paths, signal, policy, accounts);
+  } : await scanSourceOnce(config22, paths, signal, policy, accounts, host);
   if (policy !== void 0 && scan.caughtUp) {
     const state = await loadState(paths);
     if (state.captureRecheckAt === void 0)
@@ -15726,7 +15795,8 @@ async function collectorTick(config22, paths, fetcher = collectorFetch, signal,
       signal,
       onAcknowledged,
       policy,
-      first
+      first,
+      host
     );
     upload = { ...next, uploaded: upload.uploaded + next.uploaded };
   }
@@ -15756,6 +15826,14 @@ async function lockIdentity(filename) {
 }
 var CollectorLockBusyError = class extends Error {
 };
+async function tryAcquireCollectorLock(paths) {
+  try {
+    return await acquireCollectorLock(paths);
+  } catch (error22) {
+    if (error22 instanceof CollectorLockBusyError) return null;
+    throw error22;
+  }
+}
 async function acquireCollectorLock(paths) {
   await ensurePrivateDirectory(path15.dirname(paths.lock));
   const databasePath = `${paths.lock}.sqlite`;
@@ -16079,10 +16157,10 @@ function mergeDefs2(...defs) {
 function cloneDef2(schema) {
   return mergeDefs2(schema._zod.def);
 }
-function getElementAtPath2(obj, path31) {
-  if (!path31)
+function getElementAtPath2(obj, path37) {
+  if (!path37)
     return obj;
-  return path31.reduce((acc, key) => acc?.[key], obj);
+  return path37.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject2(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -16422,11 +16500,11 @@ function explicitlyAborted2(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues2(path31, issues) {
+function prefixIssues2(path37, issues) {
   return issues.map((iss) => {
     var _a5;
     (_a5 = iss).path ?? (_a5.path = []);
-    iss.path.unshift(path31);
+    iss.path.unshift(path37);
     return iss;
   });
 }
@@ -16460,8 +16538,8 @@ function finalizeIssue2(iss, ctx, config3) {
     else
       iss.schema = iss.inst;
   }
-  const schemaError2 = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : void 0;
-  const message = iss.message ? iss.message : unwrapMessage2(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage2(schemaError2?.(iss)) ?? unwrapMessage2(ctx?.error?.(iss)) ?? unwrapMessage2(config3.customError?.(iss)) ?? unwrapMessage2(config3.localeError?.(iss)) ?? "Invalid input";
+  const schemaError3 = iss.schema !== iss.inst ? iss.schema?._zod.def?.error : void 0;
+  const message = iss.message ? iss.message : unwrapMessage2(iss.inst?._zod.def?.error?.(iss)) ?? unwrapMessage2(schemaError3?.(iss)) ?? unwrapMessage2(ctx?.error?.(iss)) ?? unwrapMessage2(config3.customError?.(iss)) ?? unwrapMessage2(config3.localeError?.(iss)) ?? "Invalid input";
   const full = {};
   for (const k of Object.keys(iss)) {
     if (k === "inst" || k === "schema" || k === "continue" || k === "input" || k === "__proto__")
@@ -16884,16 +16962,16 @@ function flattenError2(error3, mapper = (issue3) => issue3.message) {
 }
 function formatError2(error3, mapper = (issue3) => issue3.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error4, path31 = []) => {
+  const processError = (error4, path37 = []) => {
     for (const issue3 of error4.issues) {
       if (issue3.code === "invalid_union" && issue3.errors.length) {
-        issue3.errors.map((issues) => processError({ issues }, [...path31, ...issue3.path]));
+        issue3.errors.map((issues) => processError({ issues }, [...path37, ...issue3.path]));
       } else if (issue3.code === "invalid_key") {
-        processError({ issues: issue3.issues }, [...path31, ...issue3.path]);
+        processError({ issues: issue3.issues }, [...path37, ...issue3.path]);
       } else if (issue3.code === "invalid_element") {
-        processError({ issues: issue3.issues }, [...path31, ...issue3.path]);
+        processError({ issues: issue3.issues }, [...path37, ...issue3.path]);
       } else {
-        const fullpath = [...path31, ...issue3.path];
+        const fullpath = [...path37, ...issue3.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue3));
         } else {
@@ -21191,13 +21269,13 @@ var recordProcessor2 = (schema, ctx, _json, params) => {
         ...params,
         path: [...params.path, "propertyNames"]
       });
-      let pending = pendingRecords2.get(ctx);
-      if (!pending) {
-        pending = [];
-        pendingRecords2.set(ctx, pending);
+      let pending2 = pendingRecords2.get(ctx);
+      if (!pending2) {
+        pending2 = [];
+        pendingRecords2.set(ctx, pending2);
         ctx.deferred.push(() => rewriteKeyNames2(ctx));
       }
-      pending.push(schema);
+      pending2.push(schema);
     }
     json2.additionalProperties = processSchema2(def.valueType, ctx, {
       ...params,
@@ -22539,6 +22617,65 @@ var acknowledgementSchema2 = object3({
   deviceId: string5().regex(UUID_PATTERN2),
   acceptedEventIds: array2(string5())
 }).strict().describe("Accepted event IDs must match the submitted batch exactly, without duplicates.");
+function schemaError2(error3, fallback) {
+  return error3.issues[0]?.message ?? fallback;
+}
+function parseTraceEventBatch2(input) {
+  const parsed = traceEventBatchSchema2.safeParse(input);
+  if (!parsed.success) {
+    return {
+      success: false,
+      error: schemaError2(parsed.error, "Trace event batch is invalid.")
+    };
+  }
+  const eventIds = /* @__PURE__ */ new Set();
+  for (const event3 of parsed.data.events) {
+    if (eventIds.has(event3.eventId)) {
+      return {
+        success: false,
+        error: "A batch cannot contain duplicate event ids."
+      };
+    }
+    eventIds.add(event3.eventId);
+  }
+  return { success: true, value: parsed.data };
+}
+function parseTraceEventAcknowledgement2(input, expectedEventIds) {
+  const parsed = acknowledgementSchema2.safeParse(input);
+  if (!parsed.success) {
+    return {
+      success: false,
+      error: schemaError2(parsed.error, "Acknowledgement has an invalid shape.")
+    };
+  }
+  const { acceptedEventIds } = parsed.data;
+  if (acceptedEventIds.length !== expectedEventIds.length) {
+    return {
+      success: false,
+      error: "Acknowledgement event ids do not match the batch."
+    };
+  }
+  const actual = /* @__PURE__ */ new Set();
+  for (const eventId of acceptedEventIds) {
+    if (!expectedEventIds.includes(eventId)) {
+      return {
+        success: false,
+        error: "Acknowledgement includes an unknown event id."
+      };
+    }
+    actual.add(eventId);
+  }
+  if (actual.size !== expectedEventIds.length) {
+    return {
+      success: false,
+      error: "Acknowledgement contains duplicate event ids."
+    };
+  }
+  return {
+    success: true,
+    value: { ...parsed.data, acceptedEventIds: [...actual] }
+  };
+}
 function isLaunchDirectory(value) {
   if (!(value.startsWith("/") || /^[A-Za-z]:[\\/]/.test(value) || /^\\\\[^\\/]+[\\/][^\\/]+(?:[\\/]|$)/.test(value)) || value.length > 4096)
     return false;
@@ -22550,11 +22687,148 @@ function isLaunchDirectory(value) {
   return true;
 }
 
-// src/auto-connect.ts
-import { createHmac } from "node:crypto";
-import { promises as fs19 } from "node:fs";
-import os8 from "node:os";
-import path24 from "node:path";
+// src/agent-tools.ts
+import { promises as fs13 } from "node:fs";
+import os4 from "node:os";
+import path18 from "node:path";
+import readline from "node:readline";
+
+// src/sharing.ts
+import { promises as fs11 } from "node:fs";
+import path8 from "node:path";
+
+// ../collector-contracts/dist/sharing.js
+var collectorComputerIdSchema = uuid5();
+var collectorSharingApprovalIdentitySchema = object3({
+  workspaceId: uuid5(),
+  computerId: collectorComputerIdSchema,
+  revision: coerce_exports.number().int().positive()
+}).strict();
+var captureLocationSchema = string5().min(1).max(4096).refine((value) => !value.split("").some((character) => character.charCodeAt(0) < 32) && (/^\//.test(value) || /^[A-Za-z]:[\\/]/.test(value)), "Choose an absolute folder path.").describe("An absolute Unix or Windows folder path without control characters.");
+var collectorProjectInventorySchema = object3({
+  computerId: uuid5(),
+  projects: array2(object3({
+    path: captureLocationSchema,
+    name: string5().min(1).max(160),
+    sessions: number4().int().nonnegative(),
+    sources: array2(_enum2(COLLECTOR_SOURCES2)).min(1).max(3)
+  }).strict()).max(1e3),
+  truncated: boolean4()
+}).strict();
+var collectorSharingSelectionSchema = object3({
+  mode: _enum2(["selected", "all"]),
+  locations: array2(captureLocationSchema).max(1e3),
+  excludedLocations: array2(captureLocationSchema).max(1e3),
+  paused: boolean4().default(false)
+}).strict().refine((value) => value.mode === "all" || value.locations.length > 0, "Choose at least one project or folder.").describe("Selected mode requires at least one folder. All mode shares unmatched projects except exclusions.");
+var collectorWorkspaceSharingSchema = object3({
+  organizationId: uuid5(),
+  organizationName: string5().min(1).max(160),
+  selection: collectorSharingSelectionSchema,
+  active: boolean4(),
+  connectedSources: array2(_enum2(COLLECTOR_SOURCES2)).max(3)
+}).strict();
+var collectorSharingSnapshotSchema = object3({
+  computerId: uuid5(),
+  ownerId: uuid5(),
+  revision: number4().int().positive(),
+  approved: boolean4(),
+  workspaces: array2(collectorWorkspaceSharingSchema).max(100)
+}).strict();
+
+// ../collector-contracts/dist/sharing-policy.js
+function captureLocationContains(root, location) {
+  const normalize = (value) => {
+    const windows = /^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\");
+    const normalized = value.replaceAll("\\", "/").replace(/\/+$/, "");
+    return windows ? normalized.toLowerCase() : normalized;
+  };
+  const parent = normalize(root);
+  const child = normalize(location);
+  return child === parent || child.startsWith(parent + "/");
+}
+function sharingWorkspaceForLocation(snapshot, location) {
+  const candidates = snapshot.workspaces.flatMap((workspace) => {
+    const specificity = sharingSelectionSpecificity(workspace.selection, location);
+    if (specificity === null)
+      return [];
+    return [
+      {
+        workspace,
+        specificity
+      }
+    ];
+  }).sort((left, right) => right.specificity - left.specificity);
+  const first = candidates[0];
+  if (!first || candidates[1]?.specificity === first.specificity || !first.workspace.active)
+    return null;
+  return first.workspace.organizationId;
+}
+function sharingSelectionSpecificity(selection, location) {
+  const included = selection.locations.filter((root) => captureLocationContains(root, location));
+  if (!included.length && selection.mode !== "all")
+    return null;
+  const specificity = Math.max(0, ...included.map((root) => root.replace(/[/\\]+$/, "").length));
+  const excluded = selection.excludedLocations.filter((root) => captureLocationContains(root, location));
+  return excluded.some((root) => root.replace(/[/\\]+$/, "").length >= specificity) ? null : specificity;
+}
+
+// ../collector-contracts/dist/folders.js
+var folderEntrySchema = object3({ name: string5().min(1).max(255), path: captureLocationSchema }).strict();
+var collectorFolderRequestSchema = object3({
+  id: uuid5(),
+  directory: captureLocationSchema.nullable(),
+  query: string5().trim().max(80),
+  showHidden: boolean4(),
+  expiresAtMs: number4().int().positive()
+}).strict();
+var collectorFolderListingSchema = object3({
+  directory: captureLocationSchema,
+  name: string5().min(1).max(255),
+  parent: captureLocationSchema.nullable(),
+  breadcrumbs: array2(folderEntrySchema).min(1).max(8),
+  entries: array2(folderEntrySchema).max(200),
+  truncated: boolean4()
+}).strict();
+var pending = object3({
+  status: literal2("pending"),
+  request: collectorFolderRequestSchema
+}).strict();
+var ready = object3({
+  status: literal2("ready"),
+  request: collectorFolderRequestSchema,
+  listing: collectorFolderListingSchema
+}).strict();
+var failed = object3({
+  status: literal2("error"),
+  request: collectorFolderRequestSchema,
+  reason: _enum2(["permission", "missing", "unavailable"])
+}).strict();
+var collectorFolderStateSchema = discriminatedUnion2("status", [
+  pending,
+  ready,
+  failed
+]);
+var collectorFolderCommandSchema = object3({ organizationId: uuid5(), request: collectorFolderRequestSchema }).strict();
+var collectorFolderReplySchema = object3({
+  organizationId: uuid5(),
+  state: discriminatedUnion2("status", [ready, failed])
+}).strict();
+var collectorFolderActionSchema = object3({
+  workspaceId: uuid5(),
+  computerId: uuid5(),
+  intent: discriminatedUnion2("type", [
+    object3({
+      type: literal2("browse"),
+      id: uuid5(),
+      directory: captureLocationSchema.nullable(),
+      query: string5().trim().max(80),
+      showHidden: boolean4()
+    }).strict(),
+    object3({ type: literal2("read"), id: uuid5() }).strict(),
+    object3({ type: literal2("close"), id: uuid5() }).strict()
+  ])
+}).strict();
 
 // ../collector-contracts/dist/index.js
 var cursorBillingRequestSchema = object3({
@@ -22621,10 +22895,12 @@ var collectorHistoryProgressSchema = object3({
     complete: boolean4()
   }).strict().optional().describe("The newest messages sent ahead of the rest of the history; collectors before 0.17.0 omit it.")
 }).strict().refine((progress) => progress.readSessions <= progress.sessions, "Read sessions cannot exceed listed sessions.").refine((progress) => !progress.complete || progress.readSessions === progress.sessions, "A complete import has read every listed session.").describe("readSessions must not exceed sessions; complete requires equal counts.");
+var collectorSourceSchema = _enum2(COLLECTOR_SOURCES2);
 var collectorEnrollmentRequestSchema = object3({
   deviceName: string5().trim().min(1).max(160).describe("Trimmed before length validation."),
   organizationId: string5().regex(UUID_PATTERN3).optional(),
-  source: _enum2(COLLECTOR_SOURCES2).optional()
+  computerId: uuid5().optional(),
+  source: collectorSourceSchema.optional()
 }).strict();
 var collectorExpansionRequestSchema = object3({
   source: _enum2(COLLECTOR_SOURCES2),
@@ -22663,141 +22939,476 @@ function parseCollectorFrictionSummary(input) {
   };
 }
 
-// src/background-service.ts
-import { promises as fs16 } from "node:fs";
-import os6 from "node:os";
-import path20 from "node:path";
-
-// src/launch-agent.ts
-import { execFile as execFileCallback2 } from "node:child_process";
-import { promises as fs11 } from "node:fs";
-import os3 from "node:os";
-import path8 from "node:path";
-import { setTimeout as sleep } from "node:timers/promises";
-import { promisify as promisify2 } from "node:util";
-
-// src/runtime.ts
-import { createHash as createHash4 } from "node:crypto";
+// src/sharing-storage.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
 import { promises as fs6 } from "node:fs";
 import os from "node:os";
 import path7 from "node:path";
-import { setTimeout as delay2 } from "node:timers/promises";
-import { fileURLToPath } from "node:url";
-function runtimePaths(home = os.homedir()) {
-  const root = path7.join(home, ".config", "iteration", "runtime");
+var connectionSchema2 = object3({
+  organizationId: uuid5(),
+  organizationName: string5().min(1).max(160),
+  source: _enum2(COLLECTOR_SOURCES2),
+  token: string5().min(1),
+  endpoint: url()
+}).strict();
+var registrySchema = object3({
+  version: literal2(1),
+  computerId: uuid5(),
+  ownerId: uuid5().nullable(),
+  connections: array2(connectionSchema2).max(300),
+  sourceHomes: object3({ codex: string5(), claude: string5(), cursor: string5() }).strict().optional(),
+  directories: partialRecord(_enum2(COLLECTOR_SOURCES2), string5()).optional()
+}).strict();
+function enrolledSharingConnection(enrollment, source, endpoint) {
   return {
-    home,
-    root,
-    versions: path7.join(root, "versions"),
-    staging: path7.join(root, "staging"),
-    state: path7.join(root, "state.json"),
-    settings: path7.join(root, "settings.json"),
-    lock: path7.join(root, "state.lock"),
-    updateLock: path7.join(root, "update.lock"),
-    launcher: path7.join(root, "launcher.js")
+    token: enrollment.token,
+    organizationId: enrollment.organizationId,
+    organizationName: enrollment.organizationName,
+    source,
+    endpoint
   };
 }
-var DEFAULT_UPDATE_REGISTRY = "https://registry.npmjs.org/";
-var VERSION_PATTERN = /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})$/;
-var versionSchema = string5().regex(VERSION_PATTERN);
-var sourceSchema = _enum2(COLLECTOR_SOURCES2);
-var timeSchema = number4().int().min(0);
-var trialSchema = object3({
-  version: versionSchema,
-  previous: versionSchema,
-  startedAtMs: timeSchema,
-  expected: array2(sourceSchema),
-  starts: partialRecord(sourceSchema, number4().int().min(0)),
-  confirmed: array2(sourceSchema)
-}).loose();
-var runtimeStateSchema = object3({
-  version: literal2(1),
-  current: versionSchema,
-  previous: versionSchema.nullable(),
-  trial: trialSchema.nullable(),
-  rejected: array2(
-    object3({
-      version: versionSchema,
-      reason: string5().max(500),
-      atMs: timeSchema
-    }).loose()
-  ).max(20),
-  lastCheck: object3({ atMs: timeSchema, error: string5().max(500).nullable() }).loose().nullable(),
-  lastUpdate: object3({ from: versionSchema, to: versionSchema, atMs: timeSchema }).loose().nullable()
-}).loose();
-var settingsSchema2 = object3({
-  autoUpdate: boolean4(),
-  registry: string5().url()
-}).loose();
-function errorCode2(error3) {
-  if (error3 instanceof Error && "code" in error3) return String(error3.code);
-  return null;
-}
-function isVersion(value) {
-  return VERSION_PATTERN.test(value);
-}
-function versionParts(value) {
-  const match = VERSION_PATTERN.exec(value);
-  if (match === null) throw new Error(`Invalid Iteration version ${value}.`);
-  return [Number(match[1]), Number(match[2]), Number(match[3])];
+function sharingDirectory() {
+  return path7.join(os.homedir(), ".config", "iteration", "sharing");
 }
-function compareVersions(left, right) {
-  const a = versionParts(left);
-  const b = versionParts(right);
-  for (let index = 0; index < 3; index += 1) {
-    const difference = a[index] - b[index];
-    if (difference !== 0) return Math.sign(difference);
+async function readSharingRegistry() {
+  let contents;
+  try {
+    contents = await fs6.readFile(
+      path7.join(sharingDirectory(), "connections.json"),
+      "utf8"
+    );
+  } catch (error3) {
+    if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
+      return null;
+    throw error3;
   }
-  return 0;
+  return registrySchema.parse(JSON.parse(contents));
 }
-function nodeRequirement(range, nodeVersion) {
-  const match = /^>=\s*(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(
-    range?.trim() ?? ""
-  );
-  if (match === null) {
-    return {
-      ok: false,
-      reason: `it declares an unsupported Node.js requirement (${range ?? "none"})`
+async function withSharingRegistry(work) {
+  const directory = sharingDirectory();
+  const release = await waitForCollectorLock(collectorPaths(directory));
+  try {
+    const registry3 = await readSharingRegistry() ?? {
+      version: 1,
+      computerId: randomUUID3(),
+      ownerId: null,
+      connections: []
     };
+    const save = async (next) => {
+      await ensurePrivateDirectory(directory);
+      const filename = path7.join(directory, "connections.json");
+      const temporary = `${filename}.${process.pid}.tmp`;
+      await fs6.writeFile(
+        temporary,
+        JSON.stringify(registrySchema.parse(next)),
+        { mode: 384 }
+      );
+      await fs6.rename(temporary, filename);
+    };
+    await save(registry3);
+    return await work(registry3, save);
+  } finally {
+    await release();
   }
-  const required3 = [
-    Number(match[1]),
-    Number(match[2] ?? 0),
-    Number(match[3] ?? 0)
-  ];
-  const actual = nodeVersion.split(".").map(Number);
-  for (let index = 0; index < 3; index += 1) {
-    const difference = (actual[index] ?? 0) - required3[index];
-    if (difference > 0) return { ok: true };
-    if (difference < 0) {
-      return {
-        ok: false,
-        reason: `it needs Node.js ${range} and this computer runs ${nodeVersion}`
-      };
-    }
-  }
-  return { ok: true };
 }
-async function ensureRuntimeDirectory(paths) {
-  for (const directory of [paths.root, paths.versions, paths.staging]) {
-    await ensurePrivateDirectory(directory);
-  }
+async function forgetSharingConnections() {
+  if (await readSharingRegistry() === null) return;
+  await withSharingRegistry(
+    async (registry3, save) => save({ ...registry3, ownerId: null, connections: [] })
+  );
+}
+function sharingConnection(registry3, organizationId, source) {
+  return registry3.connections.find(
+    (connection) => connection.organizationId === organizationId && connection.source === source
+  ) ?? null;
+}
+
+// src/sharing.ts
+async function fetchSharingSnapshot(config3, request2 = collectorFetch, signal) {
+  const response = await request2(
+    new URL("./collector-sharing", config3.endpoint),
+    {
+      headers: { authorization: `Bearer ${config3.token}` },
+      signal: AbortSignal.any([
+        AbortSignal.timeout(15e3),
+        ...signal ? [signal] : []
+      ])
+    }
+  );
+  if (!response.ok)
+    throw new Error(
+      `Could not check project sharing (HTTP ${response.status}). Collection is waiting.`
+    );
+  return collectorSharingSnapshotSchema.parse(await response.json());
+}
+function workspaceForSource(snapshot, location, source) {
+  const organizationId = sharingWorkspaceForLocation(
+    snapshot,
+    resolveCaptureLocation(location)
+  );
+  return snapshot.workspaces.some(
+    (workspace) => workspace.organizationId === organizationId && workspace.connectedSources.includes(source)
+  ) ? organizationId : null;
+}
+function hostCapturePolicy(snapshot, registry3, config3) {
+  const source = collectorSource(config3);
+  const permitted = (location) => {
+    const organizationId = workspaceForSource(snapshot, location, source);
+    return organizationId !== null && sharingConnection(registry3, organizationId, source) !== null;
+  };
+  return {
+    revision: snapshot.revision,
+    batchKey: (event3) => event3.capture ? sharingWorkspaceForLocation(snapshot, event3.capture.reference) ?? "unshared" : "unshared",
+    authorizeRecord: (recordSource, line, filename, cwds) => {
+      const location = captureRecordLocation(
+        recordSource,
+        line,
+        filename,
+        cwds
+      );
+      return location !== null && permitted(location) ? {
+        revision: snapshot.revision,
+        basis: "location",
+        reference: location
+      } : null;
+    },
+    authorizeEvent: (event3) => event3.capture?.basis === "location" && event3.capture.revision === snapshot.revision && permitted(event3.capture.reference) ? event3 : null
+  };
+}
+var sessionIndexSchema = record3(
+  string5(),
+  object3({ location: string5().nullable(), at: number4() }).strict()
+);
+async function loadSessionIndex(config3) {
+  try {
+    return sessionIndexSchema.parse(
+      JSON.parse(
+        await fs11.readFile(
+          path8.join(config3.dataDirectory, "shared-sessions.json"),
+          "utf8"
+        )
+      )
+    );
+  } catch (error3) {
+    if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
+      return {};
+    throw error3;
+  }
+}
+async function sharingTransport(config3, request2 = collectorFetch, signal, savedRegistry) {
+  const registry3 = savedRegistry ?? await readSharingRegistry();
+  if (registry3 === null)
+    throw new Error(
+      "Choose projects in Iteration before sharing this computer."
+    );
+  const connections = registry3.connections.filter(
+    (connection) => connection.source === collectorSource(config3) && connection.endpoint === config3.endpoint
+  );
+  let snapshot = null;
+  for (const connection of connections) {
+    try {
+      snapshot = await fetchSharingSnapshot(connection, request2, signal);
+      break;
+    } catch (error3) {
+      if (signal?.aborted) throw error3;
+    }
+  }
+  if (snapshot === null || snapshot.computerId !== registry3.computerId || snapshot.ownerId !== registry3.ownerId)
+    throw new Error("Could not verify project sharing. Collection is waiting.");
+  const current = snapshot;
+  const capture = hostCapturePolicy(current, registry3, config3);
+  const index = await loadSessionIndex(config3);
+  const destination = (location) => {
+    const organizationId = workspaceForSource(
+      current,
+      location,
+      collectorSource(config3)
+    );
+    return organizationId === null ? null : sharingConnection(registry3, organizationId, collectorSource(config3));
+  };
+  const forSession = (id) => {
+    const location = index[id]?.location;
+    return location ? destination(location) : null;
+  };
+  const upload = async (init, sendTo) => {
+    const body = string5().parse(init?.body);
+    const parsed = parseTraceEventBatch2(JSON.parse(body));
+    if (!parsed.success) throw new Error(parsed.error);
+    const batches = /* @__PURE__ */ new Map();
+    for (const event3 of parsed.value.events) {
+      if (capture.authorizeEvent(event3) === null)
+        throw new Error("Project sharing changed. Waiting for the next scan.");
+      const connection = destination(event3.capture.reference);
+      if (!connection) throw new Error("The project is no longer shared.");
+      const events = batches.get(connection.organizationId) ?? [];
+      events.push(event3);
+      batches.set(connection.organizationId, events);
+      const previous = index[event3.sessionId];
+      index[event3.sessionId] = {
+        location: previous && previous.location !== event3.capture.reference ? null : event3.capture.reference,
+        at: Date.now()
+      };
+    }
+    const acceptedEventIds = [];
+    let deviceId = "";
+    let retryAfter = null;
+    for (const [organizationId, events] of batches) {
+      const response = await sendTo(organizationId, JSON.stringify({ events }));
+      if (response.status !== 202) return response;
+      retryAfter = response.headers.get("retry-after");
+      const acknowledgement = parseTraceEventAcknowledgement2(
+        await response.json(),
+        events.map((event3) => event3.eventId)
+      );
+      if (!acknowledgement.success) throw new Error(acknowledgement.error);
+      acceptedEventIds.push(...acknowledgement.value.acceptedEventIds);
+      deviceId = acknowledgement.value.deviceId;
+    }
+    const retained = Object.fromEntries(
+      Object.entries(index).sort((left, right) => right[1].at - left[1].at).slice(0, 1e5)
+    );
+    const filename = path8.join(config3.dataDirectory, "shared-sessions.json");
+    const temporary = `${filename}.${process.pid}.tmp`;
+    await fs11.writeFile(temporary, JSON.stringify(retained), { mode: 384 });
+    await fs11.rename(temporary, filename);
+    return Response.json(
+      { deviceId, acceptedEventIds },
+      {
+        status: 202,
+        headers: retryAfter === null ? {} : { "Retry-After": retryAfter }
+      }
+    );
+  };
+  const send = (input, init) => request2(input, init);
+  const routed = async (input, init) => {
+    const url2 = new URL(String(input));
+    const sendTo = (organizationId, body) => {
+      const connection = sharingConnection(
+        registry3,
+        organizationId,
+        collectorSource(config3)
+      );
+      if (!connection)
+        throw new Error(
+          "The project workspace has no agent connection. Run iteration connect."
+        );
+      return send(input, {
+        ...init,
+        headers: {
+          ...Object.fromEntries(new Headers(init?.headers)),
+          authorization: `Bearer ${connection.token}`
+        },
+        ...body === void 0 ? {} : { body }
+      });
+    };
+    if (url2.pathname === new URL(config3.endpoint).pathname)
+      return upload(init, sendTo);
+    if (url2.pathname.endsWith("/friction-summary")) {
+      const directory = url2.searchParams.get("directory");
+      const connection = directory === null ? null : destination(directory);
+      return connection ? sendTo(connection.organizationId) : Response.json({ weekEpisodes: 0, dayEpisodes: 0 });
+    }
+    if (url2.pathname.endsWith("/codex-billing")) {
+      const body = codexBillingRequestSchema.parse(
+        JSON.parse(String(init?.body))
+      );
+      let matched = 0;
+      for (const workspace of current.workspaces.filter(
+        (workspace2) => workspace2.active && workspace2.connectedSources.includes(collectorSource(config3))
+      )) {
+        const tasks = body.tasks.filter(
+          (task) => forSession(task.threadId)?.organizationId === workspace.organizationId
+        ).map((task) => ({
+          ...task,
+          descendantThreadIds: task.descendantThreadIds.filter(
+            (id) => forSession(id)?.organizationId === workspace.organizationId
+          )
+        }));
+        if (tasks.length === 0) continue;
+        const ids = new Set(
+          tasks.flatMap((task) => [task.threadId, ...task.descendantThreadIds])
+        );
+        const response = await sendTo(
+          workspace.organizationId,
+          JSON.stringify({
+            ...body,
+            tasks,
+            authTurns: body.authTurns.filter((turn) => ids.has(turn.threadId))
+          })
+        );
+        if (!response.ok) return response;
+        matched += object3({ matched: number4() }).parse(await response.json()).matched;
+      }
+      return Response.json({ matched });
+    }
+    if (url2.pathname.endsWith("/cursor-billing")) {
+      const body = cursorBillingRequestSchema.parse(
+        JSON.parse(String(init?.body))
+      );
+      const connection = forSession(`cursor:${body.conversationId}`);
+      return connection ? sendTo(connection.organizationId) : Response.json({ matched: 0 });
+    }
+    if (url2.pathname.endsWith("/collector-progress")) {
+      for (const workspace of current.workspaces.filter(
+        (workspace2) => workspace2.active
+      )) {
+        if (!sharingConnection(
+          registry3,
+          workspace.organizationId,
+          collectorSource(config3)
+        ))
+          continue;
+        const response = await sendTo(workspace.organizationId);
+        if (!response.ok) return response;
+        await response.body?.cancel();
+      }
+      return Response.json({ ok: true });
+    }
+    throw new Error("This collector request does not support project sharing.");
+  };
+  return { capture, fetcher: routed, snapshot: current };
+}
+async function configForSharedDirectory(config3, directory) {
+  if (config3.destination !== "host") return config3;
+  const transport = await sharingTransport(config3);
+  const organizationId = workspaceForSource(
+    transport.snapshot,
+    directory,
+    collectorSource(config3)
+  );
+  const registry3 = await readSharingRegistry();
+  const connection = organizationId && registry3 ? sharingConnection(registry3, organizationId, collectorSource(config3)) : null;
+  return connection ? {
+    ...config3,
+    token: connection.token,
+    organizationId: connection.organizationId,
+    organizationName: connection.organizationName
+  } : null;
+}
+
+// src/runtime.ts
+import { createHash as createHash4 } from "node:crypto";
+import { promises as fs12 } from "node:fs";
+import os3 from "node:os";
+import path17 from "node:path";
+import { setTimeout as delay2 } from "node:timers/promises";
+import { fileURLToPath } from "node:url";
+function runtimePaths(home = os3.homedir()) {
+  const root = path17.join(home, ".config", "iteration", "runtime");
+  return {
+    home,
+    root,
+    versions: path17.join(root, "versions"),
+    staging: path17.join(root, "staging"),
+    state: path17.join(root, "state.json"),
+    settings: path17.join(root, "settings.json"),
+    lock: path17.join(root, "state.lock"),
+    updateLock: path17.join(root, "update.lock"),
+    launcher: path17.join(root, "launcher.js")
+  };
+}
+var DEFAULT_UPDATE_REGISTRY = "https://registry.npmjs.org/";
+var VERSION_PATTERN = /^(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})\.(0|[1-9]\d{0,5})$/;
+var versionSchema = string5().regex(VERSION_PATTERN);
+var sourceSchema = _enum2(COLLECTOR_SOURCES2);
+var timeSchema = number4().int().min(0);
+var trialSchema = object3({
+  version: versionSchema,
+  previous: versionSchema,
+  startedAtMs: timeSchema,
+  expected: array2(sourceSchema),
+  starts: partialRecord(sourceSchema, number4().int().min(0)),
+  confirmed: array2(sourceSchema)
+}).loose();
+var runtimeStateSchema = object3({
+  version: literal2(1),
+  current: versionSchema,
+  previous: versionSchema.nullable(),
+  trial: trialSchema.nullable(),
+  rejected: array2(
+    object3({
+      version: versionSchema,
+      reason: string5().max(500),
+      atMs: timeSchema
+    }).loose()
+  ).max(20),
+  lastCheck: object3({ atMs: timeSchema, error: string5().max(500).nullable() }).loose().nullable(),
+  lastUpdate: object3({ from: versionSchema, to: versionSchema, atMs: timeSchema }).loose().nullable()
+}).loose();
+var settingsSchema2 = object3({
+  autoUpdate: boolean4(),
+  registry: string5().url()
+}).loose();
+function errorCode2(error3) {
+  if (error3 instanceof Error && "code" in error3) return String(error3.code);
+  return null;
+}
+function isVersion(value) {
+  return VERSION_PATTERN.test(value);
+}
+function versionParts(value) {
+  const match = VERSION_PATTERN.exec(value);
+  if (match === null) throw new Error(`Invalid Iteration version ${value}.`);
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function compareVersions(left, right) {
+  const a = versionParts(left);
+  const b = versionParts(right);
+  for (let index = 0; index < 3; index += 1) {
+    const difference = a[index] - b[index];
+    if (difference !== 0) return Math.sign(difference);
+  }
+  return 0;
+}
+function nodeRequirement(range, nodeVersion) {
+  const match = /^>=\s*(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(
+    range?.trim() ?? ""
+  );
+  if (match === null) {
+    return {
+      ok: false,
+      reason: `it declares an unsupported Node.js requirement (${range ?? "none"})`
+    };
+  }
+  const required3 = [
+    Number(match[1]),
+    Number(match[2] ?? 0),
+    Number(match[3] ?? 0)
+  ];
+  const actual = nodeVersion.split(".").map(Number);
+  for (let index = 0; index < 3; index += 1) {
+    const difference = (actual[index] ?? 0) - required3[index];
+    if (difference > 0) return { ok: true };
+    if (difference < 0) {
+      return {
+        ok: false,
+        reason: `it needs Node.js ${range} and this computer runs ${nodeVersion}`
+      };
+    }
+  }
+  return { ok: true };
+}
+async function ensureRuntimeDirectory(paths) {
+  for (const directory of [paths.root, paths.versions, paths.staging]) {
+    await ensurePrivateDirectory(directory);
+  }
 }
 async function writeFileAtomic(filename, contents, mode) {
   const temporary = `${filename}.${process.pid}.${Date.now()}.tmp`;
-  const handle = await fs6.open(temporary, "w", mode);
+  const handle = await fs12.open(temporary, "w", mode);
   try {
     await handle.writeFile(contents, "utf8");
     await handle.sync();
   } finally {
     await handle.close();
   }
-  await fs6.rename(temporary, filename);
+  await fs12.rename(temporary, filename);
 }
 async function readRuntimeState(paths) {
   let contents;
   try {
-    contents = await fs6.readFile(paths.state, "utf8");
+    contents = await fs12.readFile(paths.state, "utf8");
   } catch (error3) {
     if (errorCode2(error3) === "ENOENT") return null;
     throw error3;
@@ -22829,7 +23440,7 @@ async function writeRuntimeState(paths, state) {
 async function readRuntimeSettings(paths) {
   let contents;
   try {
-    contents = await fs6.readFile(paths.settings, "utf8");
+    contents = await fs12.readFile(paths.settings, "utf8");
   } catch (error3) {
     if (errorCode2(error3) === "ENOENT")
       return { autoUpdate: true, registry: DEFAULT_UPDATE_REGISTRY };
@@ -22858,19 +23469,19 @@ var LockBusyError = class extends Error {
 async function tryLock(filename) {
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      const handle = await fs6.open(filename, "wx", 384);
+      const handle = await fs12.open(filename, "wx", 384);
       await handle.writeFile(`${process.pid}
 `, "utf8");
       await handle.close();
       return async () => {
-        const owner = await fs6.readFile(filename, "utf8").catch(() => "");
+        const owner = await fs12.readFile(filename, "utf8").catch(() => "");
         if (owner.trim() === String(process.pid))
-          await fs6.rm(filename, { force: true });
+          await fs12.rm(filename, { force: true });
       };
     } catch (error3) {
       if (errorCode2(error3) !== "EEXIST") throw error3;
       const owner = Number(
-        (await fs6.readFile(filename, "utf8").catch(() => "")).trim()
+        (await fs12.readFile(filename, "utf8").catch(() => "")).trim()
       );
       if (Number.isSafeInteger(owner) && owner > 1) {
         try {
@@ -22880,7 +23491,7 @@ async function tryLock(filename) {
           if (errorCode2(processError) !== "ESRCH") throw processError;
         }
       }
-      await fs6.rm(filename, { force: true });
+      await fs12.rm(filename, { force: true });
     }
   }
   throw new LockBusyError(`Could not obtain ${filename}.`);
@@ -22930,15 +23541,15 @@ function confirmTrialSource(state, version3, source, nowMs) {
 function versionDirectory(paths, version3) {
   if (!isVersion(version3))
     throw new Error(`Invalid Iteration version ${version3}.`);
-  return path7.join(paths.versions, version3);
+  return path17.join(paths.versions, version3);
 }
 function versionEntry(paths, version3, entry) {
-  return path7.join(versionDirectory(paths, version3), "dist", entry);
+  return path17.join(versionDirectory(paths, version3), "dist", entry);
 }
 var packageSchema = object3({ name: literal2("iteration-cli"), version: versionSchema }).loose();
 async function readPackageVersion(root) {
   const parsed = packageSchema.safeParse(
-    JSON.parse(await fs6.readFile(path7.join(root, "package.json"), "utf8"))
+    JSON.parse(await fs12.readFile(path17.join(root, "package.json"), "utf8"))
   );
   if (!parsed.success) {
     throw new Error(`${root} does not contain an Iteration CLI package.`, {
@@ -22948,7 +23559,7 @@ async function readPackageVersion(root) {
   return parsed.data.version;
 }
 function ownPackageRoot() {
-  return path7.dirname(path7.dirname(fileURLToPath(import.meta.url)));
+  return path17.dirname(path17.dirname(fileURLToPath(import.meta.url)));
 }
 async function assertInstallablePackage(root, version3) {
   const packageVersion = await readPackageVersion(root);
@@ -22957,12 +23568,12 @@ async function assertInstallablePackage(root, version3) {
       `The downloaded package is version ${packageVersion}, not ${version3}.`
     );
   }
-  const pending = [root];
-  while (pending.length > 0) {
-    const directory = pending.pop();
-    for (const entry of await fs6.readdir(directory, { withFileTypes: true })) {
-      const filename = path7.join(directory, entry.name);
-      if (entry.isDirectory()) pending.push(filename);
+  const pending2 = [root];
+  while (pending2.length > 0) {
+    const directory = pending2.pop();
+    for (const entry of await fs12.readdir(directory, { withFileTypes: true })) {
+      const filename = path17.join(directory, entry.name);
+      if (entry.isDirectory()) pending2.push(filename);
       else if (!entry.isFile())
         throw new Error(
           `The package contains an unexpected entry ${filename}.`
@@ -22970,7 +23581,7 @@ async function assertInstallablePackage(root, version3) {
     }
   }
   for (const entry of ["cli.js", "cursor-hook-entry.js", "launcher.js"]) {
-    const stats = await fs6.stat(path7.join(root, "dist", entry));
+    const stats = await fs12.stat(path17.join(root, "dist", entry));
     if (!stats.isFile())
       throw new Error(`The package is missing dist/${entry}.`);
   }
@@ -22978,48 +23589,48 @@ async function assertInstallablePackage(root, version3) {
 async function installVersionDirectory(paths, staged, version3) {
   await assertInstallablePackage(staged, version3);
   const target = versionDirectory(paths, version3);
-  const displaced = path7.join(
+  const displaced = path17.join(
     paths.staging,
     `displaced-${version3}-${process.pid}-${Date.now()}`
   );
   try {
-    await fs6.rename(target, displaced);
+    await fs12.rename(target, displaced);
   } catch (error3) {
     if (errorCode2(error3) !== "ENOENT") throw error3;
   }
-  await fs6.rename(staged, target);
-  await fs6.rm(displaced, { recursive: true, force: true });
+  await fs12.rename(staged, target);
+  await fs12.rm(displaced, { recursive: true, force: true });
 }
 async function copyOwnPackage(paths, root, version3) {
   await ensureRuntimeDirectory(paths);
-  const staged = await fs6.mkdtemp(path7.join(paths.staging, `copy-${version3}-`));
+  const staged = await fs12.mkdtemp(path17.join(paths.staging, `copy-${version3}-`));
   try {
-    const packageRoot = path7.join(staged, "package");
-    await fs6.mkdir(packageRoot);
-    await fs6.copyFile(
-      path7.join(root, "package.json"),
-      path7.join(packageRoot, "package.json")
+    const packageRoot = path17.join(staged, "package");
+    await fs12.mkdir(packageRoot);
+    await fs12.copyFile(
+      path17.join(root, "package.json"),
+      path17.join(packageRoot, "package.json")
     );
-    await fs6.cp(path7.join(root, "dist"), path7.join(packageRoot, "dist"), {
+    await fs12.cp(path17.join(root, "dist"), path17.join(packageRoot, "dist"), {
       recursive: true,
       dereference: true
     });
     await installVersionDirectory(paths, packageRoot, version3);
   } finally {
-    await fs6.rm(staged, { recursive: true, force: true });
+    await fs12.rm(staged, { recursive: true, force: true });
   }
 }
 async function pruneVersions(paths, keep) {
   let entries2;
   try {
-    entries2 = await fs6.readdir(paths.versions);
+    entries2 = await fs12.readdir(paths.versions);
   } catch (error3) {
     if (errorCode2(error3) === "ENOENT") return;
     throw error3;
   }
   for (const entry of entries2) {
     if (keep.includes(entry)) continue;
-    await fs6.rm(path7.join(paths.versions, entry), {
+    await fs12.rm(path17.join(paths.versions, entry), {
       recursive: true,
       force: true
     });
@@ -23028,8 +23639,8 @@ async function pruneVersions(paths, keep) {
 async function launcherMatches(paths, version3) {
   try {
     const [installed, packaged] = await Promise.all([
-      fs6.readFile(paths.launcher),
-      fs6.readFile(versionEntry(paths, version3, "launcher.js"))
+      fs12.readFile(paths.launcher),
+      fs12.readFile(versionEntry(paths, version3, "launcher.js"))
     ]);
     return installed.equals(packaged);
   } catch (error3) {
@@ -23038,35 +23649,35 @@ async function launcherMatches(paths, version3) {
   }
 }
 async function stageLauncher(paths, version3) {
-  const staged = path7.join(
+  const staged = path17.join(
     paths.staging,
     `launcher-${version3}-${process.pid}-${Date.now()}.js`
   );
-  await fs6.copyFile(versionEntry(paths, version3, "launcher.js"), staged);
-  await fs6.chmod(staged, 420);
+  await fs12.copyFile(versionEntry(paths, version3, "launcher.js"), staged);
+  await fs12.chmod(staged, 420);
   return staged;
 }
 async function commitLauncher(paths, staged) {
-  await fs6.rename(staged, paths.launcher);
+  await fs12.rename(staged, paths.launcher);
 }
 function rolloutDelayMs(deviceKey) {
   const digest3 = createHash4("sha256").update(deviceKey).digest();
   return digest3.readUInt32BE(0) % 360 * 6e4;
 }
 function deviceRolloutKey() {
-  return `${os.hostname()}\0${os.homedir()}`;
+  return `${os3.hostname()}\0${os3.homedir()}`;
 }
 async function stableNodePath() {
-  const actual = await fs6.realpath(process.execPath);
+  const actual = await fs12.realpath(process.execPath);
   const invoked = process.argv0;
   const binary = process.platform === "win32" ? "node.exe" : "node";
   const candidates = [
-    ...invoked !== void 0 && path7.isAbsolute(invoked) ? [invoked] : [],
-    ...(process.env.PATH ?? "").split(path7.delimiter).filter((directory) => path7.isAbsolute(directory)).map((directory) => path7.join(directory, binary))
+    ...invoked !== void 0 && path17.isAbsolute(invoked) ? [invoked] : [],
+    ...(process.env.PATH ?? "").split(path17.delimiter).filter((directory) => path17.isAbsolute(directory)).map((directory) => path17.join(directory, binary))
   ];
   for (const candidate of candidates) {
     try {
-      const resolved = await fs6.realpath(candidate);
+      const resolved = await fs12.realpath(candidate);
       const same = process.platform === "win32" ? resolved.toLowerCase() === actual.toLowerCase() : resolved === actual;
       if (same) return candidate;
     } catch (error3) {
@@ -23078,7 +23689,258 @@ async function stableNodePath() {
   return process.execPath;
 }
 
+// src/agent-tools.ts
+var SERVER_NAME = "iteration";
+var RENEW_BEFORE_MS = 5 * 60 * 1e3;
+var accessSchema = object3({
+  url: url(),
+  token: string5().min(1),
+  expiresAt: iso_exports2.datetime()
+});
+var versioned = object3({ protocolVersion: string5().optional() }).loose().optional();
+var messageSchema = object3({
+  id: union2([string5(), number4()]).optional(),
+  method: string5().optional(),
+  params: versioned,
+  result: versioned
+}).loose();
+function write(message) {
+  process.stdout.write(`${JSON.stringify(message)}
+`);
+}
+async function serveAgentTools(config3) {
+  let access = null;
+  let scopedConfig = config3;
+  let version3;
+  let renewing = null;
+  const fetchAccess = async () => {
+    if (scopedConfig === null)
+      throw new Error(
+        "This computer is not connected to Iteration. Run iteration connect."
+      );
+    const response = await collectorFetch(
+      new URL(
+        "./tool-access",
+        validateCollectorEndpoint(scopedConfig.endpoint)
+      ),
+      {
+        method: "POST",
+        headers: { Authorization: `Bearer ${scopedConfig.token}` },
+        signal: AbortSignal.timeout(15e3)
+      }
+    );
+    const payload = await response.json().catch(() => null);
+    if (!response.ok) {
+      const error3 = object3({ error: string5() }).safeParse(payload);
+      throw new Error(
+        `Iteration's tools are unavailable: ${error3.success ? error3.data.error : `HTTP ${response.status}`}`
+      );
+    }
+    const parsed = accessSchema.parse(payload);
+    access = { ...parsed, expiresAt: Date.parse(parsed.expiresAt) };
+    return access;
+  };
+  const renew = (force) => {
+    if (!force && access !== null && access.expiresAt - Date.now() > RENEW_BEFORE_MS)
+      return Promise.resolve(access);
+    renewing ??= fetchAccess().finally(() => {
+      renewing = null;
+    });
+    return renewing;
+  };
+  const post = async (body, method, force) => {
+    if (config3?.destination === "host") {
+      const selected = await configForSharedDirectory(config3, process.cwd());
+      if (selected === null)
+        throw new Error(
+          "This project is not shared with Iteration. Choose it in project sharing first."
+        );
+      if (selected.organizationId !== scopedConfig?.organizationId || selected.token !== scopedConfig?.token)
+        access = null;
+      scopedConfig = selected;
+    }
+    const current = await renew(force);
+    return fetch(current.url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${current.token}`,
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream",
+        ...version3 !== void 0 && method !== "initialize" ? { "MCP-Protocol-Version": version3 } : {},
+        ...method === void 0 ? {} : { "MCP-Method": method }
+      },
+      body,
+      signal: AbortSignal.timeout(31e4)
+    });
+  };
+  const relay = (text) => {
+    const message = messageSchema.safeParse(JSON.parse(text));
+    const negotiated = message.success ? message.data.result?.protocolVersion : void 0;
+    if (negotiated !== void 0) version3 = negotiated;
+    write(JSON.parse(text));
+  };
+  const forward = async (line) => {
+    const message = messageSchema.parse(JSON.parse(line));
+    if (message.method === "initialize")
+      version3 = message.params?.protocolVersion ?? version3;
+    try {
+      let response = await post(line, message.method, false);
+      if (response.status === 401)
+        response = await post(line, message.method, true);
+      if (response.status === 202 || message.id === void 0) return;
+      const type = response.headers.get("content-type") ?? "";
+      if (type.includes("text/event-stream")) {
+        const text2 = await response.text();
+        for (const event3 of text2.split(/\r?\n\r?\n/)) {
+          const data = event3.split(/\r?\n/).filter((row) => row.startsWith("data:")).map((row) => row.slice(5).trimStart()).join("\n");
+          if (data.trim()) relay(data);
+        }
+        return;
+      }
+      const text = await response.text();
+      if (text.trim()) relay(text);
+      else if (!response.ok)
+        throw new Error(`Iteration's tools answered HTTP ${response.status}.`);
+    } catch (error3) {
+      if (message.id === void 0) return;
+      write({
+        jsonrpc: "2.0",
+        id: message.id,
+        error: {
+          code: -32603,
+          message: error3 instanceof Error ? error3.message : "Iteration's tools are unavailable."
+        }
+      });
+    }
+  };
+  const pending2 = /* @__PURE__ */ new Set();
+  for await (const line of readline.createInterface({
+    input: process.stdin
+  })) {
+    if (!line.trim()) continue;
+    const task = forward(line).catch(() => void 0);
+    pending2.add(task);
+    void task.finally(() => pending2.delete(task));
+  }
+  await Promise.allSettled(pending2);
+}
+async function writeAtomically(filename, content) {
+  await fs13.mkdir(path18.dirname(filename), { recursive: true });
+  const mode = await fs13.stat(filename).then((stat) => stat.mode & 511).catch(() => 384);
+  const temporary = `${filename}.${process.pid}.${Date.now()}.tmp`;
+  await fs13.writeFile(temporary, content, { mode });
+  await fs13.rename(temporary, filename);
+}
+async function readText2(filename) {
+  try {
+    return await fs13.readFile(filename, "utf8");
+  } catch (error3) {
+    if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
+      return null;
+    throw error3;
+  }
+}
+var jsonServersSchema = object3({
+  mcpServers: record3(string5(), unknown2()).optional()
+}).loose();
+async function updateJsonServers(filename, server) {
+  const text = await readText2(filename);
+  if (text === null && server === null) return;
+  let parsed;
+  try {
+    parsed = jsonServersSchema.parse(text === null ? {} : JSON.parse(text));
+  } catch (error3) {
+    throw new Error(`Could not read MCP settings at ${filename}.`, {
+      cause: error3
+    });
+  }
+  const { [SERVER_NAME]: existing, ...others } = parsed.mcpServers ?? {};
+  if (server === null && existing === void 0) return;
+  if (server !== null && JSON.stringify(existing) === JSON.stringify(server))
+    return;
+  const mcpServers = server === null ? others : { ...others, [SERVER_NAME]: server };
+  await writeAtomically(
+    filename,
+    `${JSON.stringify({ ...parsed, mcpServers }, null, 2)}
+`
+  );
+}
+var CODEX_TABLE = `[mcp_servers.${SERVER_NAME}]`;
+function withoutCodexServer(text) {
+  const lines = text.split(/\r?\n/);
+  const kept = [];
+  let skipping = false;
+  for (const line of lines) {
+    const table = /^\s*\[([^\]]+)\]\s*(?:#.*)?$/.exec(line)?.[1]?.trim();
+    if (table !== void 0)
+      skipping = table === `mcp_servers.${SERVER_NAME}` || table.startsWith(`mcp_servers.${SERVER_NAME}.`);
+    if (!skipping) kept.push(line);
+  }
+  return kept.join("\n").replace(/\n{3,}$/, "\n\n");
+}
+async function updateCodexServer(filename, command) {
+  const text = await readText2(filename);
+  if (text === null && command === null) return;
+  const base = withoutCodexServer(text ?? "");
+  const [program, ...args] = command ?? [];
+  const next = command === null ? base : `${base.trimEnd()}${base.trim() ? "\n\n" : ""}${CODEX_TABLE}
+command = ${JSON.stringify(program)}
+args = ${JSON.stringify(args)}
+`;
+  if (next === text) return;
+  await writeAtomically(filename, next);
+}
+function claudeSettingsFile(claudeHome) {
+  return path18.resolve(claudeHome) === path18.join(os4.homedir(), ".claude") ? path18.join(os4.homedir(), ".claude.json") : path18.join(claudeHome, ".claude.json");
+}
+var cursorSettingsFile = () => path18.join(os4.homedir(), ".cursor", "mcp.json");
+async function installAgentTools(homes) {
+  const command = [
+    await stableNodePath(),
+    runtimePaths().launcher,
+    "mcp"
+  ];
+  const [program, ...args] = command;
+  if (homes.claude !== void 0)
+    await updateJsonServers(claudeSettingsFile(homes.claude), {
+      type: "stdio",
+      command: program,
+      args
+    });
+  if (homes.codex !== void 0)
+    await updateCodexServer(path18.join(homes.codex, "config.toml"), command);
+  if (homes.cursor)
+    await updateJsonServers(cursorSettingsFile(), { command: program, args });
+}
+async function uninstallAgentTools(homes) {
+  if (homes.claude !== void 0)
+    await updateJsonServers(claudeSettingsFile(homes.claude), null);
+  if (homes.codex !== void 0)
+    await updateCodexServer(path18.join(homes.codex, "config.toml"), null);
+  if (homes.cursor) await updateJsonServers(cursorSettingsFile(), null);
+}
+function agentHomes(config3) {
+  return "cursorHome" in config3 ? { cursor: true } : "claudeHome" in config3 ? { claude: config3.claudeHome } : { codex: config3.codexHome };
+}
+
+// src/auto-connect.ts
+import { createHmac } from "node:crypto";
+import { promises as fs22 } from "node:fs";
+import os10 from "node:os";
+import path27 from "node:path";
+
+// src/background-service.ts
+import { promises as fs19 } from "node:fs";
+import os8 from "node:os";
+import path23 from "node:path";
+
 // src/launch-agent.ts
+import { execFile as execFileCallback2 } from "node:child_process";
+import { promises as fs14 } from "node:fs";
+import os5 from "node:os";
+import path19 from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+import { promisify as promisify2 } from "node:util";
 var execFile2 = promisify2(execFileCallback2);
 function label(source) {
   return `com.iteration.${source}-collector`;
@@ -23089,16 +23951,16 @@ var RESTART_POLL_MS = 200;
 function xml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 }
-function plistPath(source, homeDirectory = os3.homedir()) {
-  return path8.join(
+function plistPath(source, homeDirectory = os5.homedir()) {
+  return path19.join(
     homeDirectory,
     "Library",
     "LaunchAgents",
     `${label(source)}.plist`
   );
 }
-function launchAgentPlist(launcherPath = runtimePaths().launcher, nodePath = process.execPath, logDirectory = path8.join(os3.homedir(), "Library", "Logs"), dataDirectory2 = path8.join(
-  os3.homedir(),
+function launchAgentPlist(launcherPath = runtimePaths().launcher, nodePath = process.execPath, logDirectory = path19.join(os5.homedir(), "Library", "Logs"), dataDirectory2 = path19.join(
+  os5.homedir(),
   ".config",
   "iteration",
   "codex-collector"
@@ -23121,8 +23983,8 @@ function launchAgentPlist(launcherPath = runtimePaths().launcher, nodePath = pro
     "<key>RunAtLoad</key><true/>",
     "<key>KeepAlive</key><true/>",
     "<key>ThrottleInterval</key><integer>10</integer>",
-    `<key>StandardOutPath</key><string>${xml(path8.join(logDirectory, `iteration-${source}-collector.log`))}</string>`,
-    `<key>StandardErrorPath</key><string>${xml(path8.join(logDirectory, `iteration-${source}-collector.error.log`))}</string>`,
+    `<key>StandardOutPath</key><string>${xml(path19.join(logDirectory, `iteration-${source}-collector.log`))}</string>`,
+    `<key>StandardErrorPath</key><string>${xml(path19.join(logDirectory, `iteration-${source}-collector.error.log`))}</string>`,
     "</dict></plist>"
   ].join("");
 }
@@ -23202,17 +24064,17 @@ async function installLaunchAgent(dataDirectory2, source = "codex") {
     throw new Error("Automatic startup is currently supported on macOS only.");
   }
   const file = plistPath(source);
-  const launchAgents = path8.dirname(file);
-  const logs = path8.join(os3.homedir(), "Library", "Logs");
-  await fs11.mkdir(launchAgents, { recursive: true, mode: 493 });
-  await fs11.mkdir(logs, { recursive: true, mode: 493 });
-  await fs11.writeFile(
+  const launchAgents = path19.dirname(file);
+  const logs = path19.join(os5.homedir(), "Library", "Logs");
+  await fs14.mkdir(launchAgents, { recursive: true, mode: 493 });
+  await fs14.mkdir(logs, { recursive: true, mode: 493 });
+  await fs14.writeFile(
     file,
     launchAgentPlist(
       void 0,
       await stableNodePath(),
       void 0,
-      dataDirectory2 ?? path8.join(os3.homedir(), ".config", "iteration", `${source}-collector`),
+      dataDirectory2 ?? path19.join(os5.homedir(), ".config", "iteration", `${source}-collector`),
       source
     ),
     { encoding: "utf8", mode: 420 }
@@ -23244,7 +24106,7 @@ async function uninstallLaunchAgent(source = "codex") {
   }
   const file = plistPath(source);
   await bootoutIfLoaded(launchctlTarget(), source);
-  await fs11.rm(file, { force: true });
+  await fs14.rm(file, { force: true });
 }
 async function launchAgentStatus(source = "codex") {
   if (process.platform !== "darwin") return false;
@@ -23265,21 +24127,21 @@ function launchAgentRunning(output) {
 
 // src/runtime-install.ts
 import { execFile as execFileCallback4 } from "node:child_process";
-import { promises as fs13 } from "node:fs";
+import { promises as fs16 } from "node:fs";
 import { promisify as promisify4 } from "node:util";
 
 // src/updater.ts
 import { execFile as execFileCallback3 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { createWriteStream as createWriteStream2, promises as fs12 } from "node:fs";
+import { createWriteStream as createWriteStream2, promises as fs15 } from "node:fs";
 import http from "node:http";
 import https2 from "node:https";
-import path17 from "node:path";
+import path20 from "node:path";
 import { Transform } from "node:stream";
 import { pipeline as pipeline2 } from "node:stream/promises";
 import { promisify as promisify3 } from "node:util";
 var execFile3 = promisify3(execFileCallback3);
-var TAR = process.platform === "win32" ? path17.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe") : "tar";
+var TAR = process.platform === "win32" ? path20.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe") : "tar";
 var PACKAGE_NAME = "iteration-cli";
 var MAX_METADATA_BYTES = 16 * 1024 * 1024;
 var MAX_TARBALL_BYTES = 64 * 1024 * 1024;
@@ -23483,32 +24345,32 @@ async function selfCheck(paths, cliPath, version3) {
 }
 async function installCandidate(paths, candidate, signal) {
   await ensureRuntimeDirectory(paths);
-  const staged = await fs12.mkdtemp(
-    path17.join(paths.staging, `download-${candidate.version}-`)
+  const staged = await fs15.mkdtemp(
+    path20.join(paths.staging, `download-${candidate.version}-`)
   );
   try {
-    const archive = path17.join(staged, "package.tgz");
+    const archive = path20.join(staged, "package.tgz");
     await downloadVerified(
       candidate.tarball,
       candidate.integrity,
       archive,
       signal
     );
-    const extracted = path17.join(staged, "extracted");
-    await fs12.mkdir(extracted, { mode: 448 });
+    const extracted = path20.join(staged, "extracted");
+    await fs15.mkdir(extracted, { mode: 448 });
     await execFile3(TAR, ["-xzf", archive, "-C", extracted], {
       timeout: REQUEST_TIMEOUT_MS,
       windowsHide: true
     });
-    const packageRoot = path17.join(extracted, "package");
+    const packageRoot = path20.join(extracted, "package");
     await selfCheck(
       paths,
-      path17.join(packageRoot, "dist", "cli.js"),
+      path20.join(packageRoot, "dist", "cli.js"),
       candidate.version
     );
     await installVersionDirectory(paths, packageRoot, candidate.version);
   } finally {
-    await fs12.rm(staged, { recursive: true, force: true });
+    await fs15.rm(staged, { recursive: true, force: true });
   }
 }
 async function switchVersion(paths, from, version3, previous, expected, nowMs) {
@@ -23616,7 +24478,7 @@ async function ownVersion() {
 }
 async function exists(filename) {
   try {
-    await fs13.access(filename);
+    await fs16.access(filename);
     return true;
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
@@ -23643,7 +24505,7 @@ async function installLauncher(paths, version3) {
       );
     await commitLauncher(paths, staged);
   } finally {
-    await fs13.rm(staged, { force: true });
+    await fs16.rm(staged, { force: true });
   }
 }
 async function ensureRuntimeInstalled(expected, paths = runtimePaths()) {
@@ -23725,9 +24587,9 @@ async function expireRuntimeTrial(nowMs, paths = runtimePaths()) {
 
 // src/systemd-user.ts
 import { execFile as execFileCallback5 } from "node:child_process";
-import { promises as fs14 } from "node:fs";
-import os4 from "node:os";
-import path18 from "node:path";
+import { promises as fs17 } from "node:fs";
+import os6 from "node:os";
+import path21 from "node:path";
 import { promisify as promisify5 } from "node:util";
 var execFile5 = promisify5(execFileCallback5);
 var SYSTEMCTL_TIMEOUT_MS = 1e4;
@@ -23797,8 +24659,8 @@ function unitName(source) {
   return `iteration-${source}-collector.service`;
 }
 function unitPath(source) {
-  return path18.join(
-    os4.homedir(),
+  return path21.join(
+    os6.homedir(),
     ".config",
     "systemd",
     "user",
@@ -23806,8 +24668,8 @@ function unitPath(source) {
   );
 }
 function systemdLogPath(source) {
-  return path18.join(
-    os4.homedir(),
+  return path21.join(
+    os6.homedir(),
     ".config",
     "iteration",
     "logs",
@@ -23819,13 +24681,13 @@ function unitValue(value) {
     throw new Error("Collector paths cannot contain line breaks.");
   return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%")}"`;
 }
-function systemdUserUnit(launcherPath = runtimePaths().launcher, nodePath = process.execPath, dataDirectory2 = path18.join(
-  os4.homedir(),
+function systemdUserUnit(launcherPath = runtimePaths().launcher, nodePath = process.execPath, dataDirectory2 = path21.join(
+  os6.homedir(),
   ".config",
   "iteration",
   "codex-collector"
-), source = "codex", outputPath = path18.join(
-  os4.homedir(),
+), source = "codex", outputPath = path21.join(
+  os6.homedir(),
   ".config",
   "iteration",
   "logs",
@@ -23855,10 +24717,10 @@ async function systemctl(...args) {
 async function installSystemdUserService(dataDirectory2, source) {
   await ensureSystemdUserLinger();
   const file = unitPath(source);
-  const logDirectory = path18.dirname(systemdLogPath(source));
-  await fs14.mkdir(path18.dirname(file), { recursive: true, mode: 448 });
-  await fs14.mkdir(logDirectory, { recursive: true, mode: 448 });
-  await fs14.writeFile(
+  const logDirectory = path21.dirname(systemdLogPath(source));
+  await fs17.mkdir(path21.dirname(file), { recursive: true, mode: 448 });
+  await fs17.mkdir(logDirectory, { recursive: true, mode: 448 });
+  await fs17.writeFile(
     file,
     systemdUserUnit(void 0, await stableNodePath(), dataDirectory2, source),
     {
@@ -23874,14 +24736,14 @@ async function installSystemdUserService(dataDirectory2, source) {
 async function uninstallSystemdUserService(source) {
   const file = unitPath(source);
   try {
-    await fs14.access(file);
+    await fs17.access(file);
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return;
     throw error3;
   }
   await systemctl("disable", "--now", unitName(source));
-  await fs14.rm(file);
+  await fs17.rm(file);
   await systemctl("daemon-reload");
 }
 async function systemdUserServiceStatus(source) {
@@ -23900,9 +24762,9 @@ async function systemdUserServiceStatus(source) {
 
 // src/task-scheduler.ts
 import { execFile as execFileCallback6 } from "node:child_process";
-import { promises as fs15 } from "node:fs";
-import os5 from "node:os";
-import path19 from "node:path";
+import { promises as fs18 } from "node:fs";
+import os7 from "node:os";
+import path22 from "node:path";
 import { setTimeout as delay3 } from "node:timers/promises";
 import { promisify as promisify6 } from "node:util";
 
@@ -24004,14 +24866,14 @@ function scheduledTaskName(source, sid) {
   return `iteration-${sid}-${source}-collector`;
 }
 function servicesDirectory() {
-  return path19.join(os5.homedir(), ".config", "iteration", "services");
+  return path22.join(os7.homedir(), ".config", "iteration", "services");
 }
 function taskDefinitionPath(source) {
-  return path19.join(servicesDirectory(), `iteration-${source}-collector.xml`);
+  return path22.join(servicesDirectory(), `iteration-${source}-collector.xml`);
 }
 function windowsLogPath(source) {
-  return path19.join(
-    os5.homedir(),
+  return path22.join(
+    os7.homedir(),
     ".config",
     "iteration",
     "logs",
@@ -24019,8 +24881,8 @@ function windowsLogPath(source) {
   );
 }
 function windowsOutputPath(source) {
-  return path19.join(
-    os5.homedir(),
+  return path22.join(
+    os7.homedir(),
     ".config",
     "iteration",
     "logs",
@@ -24035,7 +24897,7 @@ function scheduledTaskScript(task) {
     "--data-directory",
     task.dataDirectory
   ].map(windowsArgument).join(" ");
-  const errorLog = path19.join(
+  const errorLog = path22.join(
     task.home,
     ".config",
     "iteration",
@@ -24155,7 +25017,7 @@ function AccountSid([string]$account) {
 async function schtasks(source, operation, ...args) {
   try {
     await execFile6(
-      path19.join(
+      path22.join(
         process.env.SystemRoot ?? "C:\\Windows",
         "System32",
         "schtasks.exe"
@@ -24199,7 +25061,7 @@ async function desiredTask(dataDirectory2, source) {
     userSid: await currentUserSid(),
     nodePath: await stableNodePath(),
     launcher: runtimePaths().launcher,
-    home: os5.homedir()
+    home: os7.homedir()
   };
 }
 async function scheduledTaskUsesRuntime(dataDirectory2, source) {
@@ -24211,10 +25073,10 @@ async function scheduledTaskUsesRuntime(dataDirectory2, source) {
 async function installScheduledTask(dataDirectory2, source) {
   const file = taskDefinitionPath(source);
   await ensurePrivateDirectory(servicesDirectory());
-  await ensurePrivateDirectory(path19.dirname(windowsLogPath(source)));
+  await ensurePrivateDirectory(path22.dirname(windowsLogPath(source)));
   await stopTask(source);
   const xml2 = scheduledTaskXml(await desiredTask(dataDirectory2, source));
-  await fs15.writeFile(
+  await fs18.writeFile(
     file,
     Buffer.concat([Buffer.from([255, 254]), Buffer.from(xml2, "utf16le")])
   );
@@ -24224,7 +25086,7 @@ async function installScheduledTask(dataDirectory2, source) {
 }
 async function uninstallScheduledTask(source) {
   if (await stopTask(source)) await schtasks(source, "/Delete", "/F");
-  await fs15.rm(taskDefinitionPath(source), { force: true });
+  await fs18.rm(taskDefinitionPath(source), { force: true });
 }
 async function scheduledTaskStatus(source) {
   return (await observedTask(source))?.state === 4;
@@ -24248,8 +25110,8 @@ async function prepareBackgroundPersistence() {
 function collectorLogPath(source) {
   if (process.platform === "linux") return systemdLogPath(source);
   if (process.platform === "win32") return windowsLogPath(source);
-  return path20.join(
-    os6.homedir(),
+  return path23.join(
+    os8.homedir(),
     "Library",
     "Logs",
     `iteration-${source}-collector.error.log`
@@ -24283,7 +25145,7 @@ async function backgroundServiceDefinition(source) {
   requireCollectorPlatform();
   const file = process.platform === "darwin" ? plistPath(source) : process.platform === "linux" ? unitPath(source) : taskDefinitionPath(source);
   try {
-    return await fs16.readFile(
+    return await fs19.readFile(
       file,
       process.platform === "win32" ? "utf16le" : "utf8"
     );
@@ -24332,7 +25194,7 @@ function serviceDataDirectory(definition, platform) {
         (_, slashes) => slashes.slice(0, slashes.length / 2)
       );
   }
-  if (!directory || !(platform === "win32" ? path20.win32 : path20.posix).isAbsolute(directory))
+  if (!directory || !(platform === "win32" ? path23.win32 : path23.posix).isAbsolute(directory))
     throw new Error("Could not read the collector service data directory.");
   return directory;
 }
@@ -24355,15 +25217,15 @@ async function backgroundServiceUsesRuntime(directory, source) {
 }
 
 // src/config-paths.ts
-import os7 from "node:os";
-import path21 from "node:path";
+import os9 from "node:os";
+import path24 from "node:path";
 function defaultCollectorDirectory(source) {
-  return path21.join(os7.homedir(), ".config", "iteration", `${source}-collector`);
+  return path24.join(os9.homedir(), ".config", "iteration", `${source}-collector`);
 }
 
 // src/cursor-hooks.ts
-import { promises as fs17 } from "node:fs";
-import path22 from "node:path";
+import { promises as fs20 } from "node:fs";
+import path25 from "node:path";
 function shellQuote(value) {
   if (process.platform === "win32") return `"${value}"`;
   return `'${value.replaceAll("'", `'\\''`)}'`;
@@ -24398,8 +25260,8 @@ async function readHooks(filename) {
   let contents;
   let mode = 384;
   try {
-    contents = await fs17.readFile(filename, "utf8");
-    mode = (await fs17.stat(filename)).mode & 511;
+    contents = await fs20.readFile(filename, "utf8");
+    mode = (await fs20.stat(filename)).mode & 511;
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return { file: {}, mode };
@@ -24421,14 +25283,14 @@ async function readHooks(filename) {
   return { file: checked.data, mode };
 }
 async function writeHooks(filename, file, mode) {
-  await fs17.mkdir(path22.dirname(filename), { recursive: true, mode: 448 });
-  const target = await fs17.realpath(filename).catch((error3) => {
+  await fs20.mkdir(path25.dirname(filename), { recursive: true, mode: 448 });
+  const target = await fs20.realpath(filename).catch((error3) => {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return filename;
     throw error3;
   });
   const temporary = `${target}.iteration-${process.pid}.tmp`;
-  const handle = await fs17.open(temporary, "w", mode);
+  const handle = await fs20.open(temporary, "w", mode);
   try {
     await handle.writeFile(`${JSON.stringify(file, null, 2)}
 `, "utf8");
@@ -24436,14 +25298,14 @@ async function writeHooks(filename, file, mode) {
   } finally {
     await handle.close();
   }
-  await fs17.rename(temporary, target);
+  await fs20.rename(temporary, target);
 }
 function entries(value) {
   return value ?? [];
 }
 async function installCursorHooks(cursorHome, dataDirectory2) {
   await ensurePrivateDirectory(cursorHookDirectory(dataDirectory2));
-  const filename = path22.join(cursorHome, "hooks.json");
+  const filename = path25.join(cursorHome, "hooks.json");
   const { file, mode } = await readHooks(filename);
   const hooks = { ...file.hooks };
   const nodePath = await stableNodePath();
@@ -24457,7 +25319,7 @@ async function installCursorHooks(cursorHome, dataDirectory2) {
   await writeHooks(filename, { ...file, version: 1, hooks }, mode);
 }
 async function uninstallCursorHooks(cursorHome, dataDirectory2) {
-  const filename = path22.join(cursorHome, "hooks.json");
+  const filename = path25.join(cursorHome, "hooks.json");
   const { file, mode } = await readHooks(filename);
   const hooks = { ...file.hooks };
   let changed = false;
@@ -24487,8 +25349,8 @@ function silenceCollectorLogs() {
 // src/turn-summary.ts
 import { execFile as execFileCallback7 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { promises as fs18 } from "node:fs";
-import path23 from "node:path";
+import { promises as fs21 } from "node:fs";
+import path26 from "node:path";
 import { promisify as promisify7 } from "node:util";
 import { crc32 } from "node:zlib";
 var execFile7 = promisify7(execFileCallback7);
@@ -24499,13 +25361,13 @@ var REQUEST_TIMEOUT_MS2 = 1e4;
 var HOOK_TIMEOUT_SECONDS = 1;
 var REQUEST_KEY_PATTERN = /^\d{1,10}$/;
 function turnSummaryPaths(dataDirectory2) {
-  const directory = path23.join(dataDirectory2, "turn-summary");
+  const directory = path26.join(dataDirectory2, "turn-summary");
   return {
     directory,
-    script: path23.join(directory, "stop-hook.sh"),
-    requests: path23.join(directory, "requests"),
-    lines: path23.join(directory, "lines"),
-    shown: path23.join(directory, "shown")
+    script: path26.join(directory, "stop-hook.sh"),
+    requests: path26.join(directory, "requests"),
+    lines: path26.join(directory, "lines"),
+    shown: path26.join(directory, "shown")
   };
 }
 function shellQuote2(value) {
@@ -24561,7 +25423,7 @@ async function sessionStartCommand(config3) {
 function agentHookFile(config3) {
   if ("cursorHome" in config3)
     throw new Error("Cursor uses its own trace hooks.");
-  return "claudeHome" in config3 ? path23.join(config3.claudeHome, "settings.json") : path23.join(config3.codexHome, "hooks.json");
+  return "claudeHome" in config3 ? path26.join(config3.claudeHome, "settings.json") : path26.join(config3.codexHome, "hooks.json");
 }
 var hookEntrySchema2 = object3({
   command: string5().optional(),
@@ -24578,8 +25440,8 @@ async function readHookFile(filename) {
   let contents;
   let mode = 384;
   try {
-    contents = await fs18.readFile(filename, "utf8");
-    mode = (await fs18.stat(filename)).mode & 511;
+    contents = await fs21.readFile(filename, "utf8");
+    mode = (await fs21.stat(filename)).mode & 511;
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT") {
       return { file: {}, mode };
@@ -24605,19 +25467,19 @@ async function readHookFile(filename) {
   return { file: parsed.data, mode };
 }
 async function writeHookFile(filename, file, mode) {
-  await fs18.mkdir(path23.dirname(filename), { recursive: true });
-  const target = await fs18.realpath(filename).catch((error3) => {
+  await fs21.mkdir(path26.dirname(filename), { recursive: true });
+  const target = await fs21.realpath(filename).catch((error3) => {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return filename;
     throw error3;
   });
   const temporary = `${target}.iteration-${process.pid}.tmp`;
-  await fs18.writeFile(temporary, `${JSON.stringify(file, null, 2)}
+  await fs21.writeFile(temporary, `${JSON.stringify(file, null, 2)}
 `, {
     encoding: "utf8",
     mode
   });
-  await fs18.rename(temporary, target);
+  await fs21.rename(temporary, target);
 }
 function withoutCommand(groups, command) {
   return groups.flatMap((group) => {
@@ -24642,24 +25504,24 @@ async function installTurnSummary(config3) {
     [paths.requests, paths.lines, paths.shown].map(ensurePrivateDirectory)
   );
   if (process.platform !== "win32") {
-    await fs18.writeFile(paths.script, hookScript(paths), {
+    await fs21.writeFile(paths.script, hookScript(paths), {
       encoding: "utf8",
       mode: 448
     });
-    await fs18.chmod(paths.script, 448);
+    await fs21.chmod(paths.script, 448);
   }
   if ("claudeHome" in config3) {
     const gitPaths = claudeGitHookPaths(config3.dataDirectory);
     await ensurePrivateDirectory(gitPaths.queue);
     if (process.platform !== "win32") {
-      await fs18.writeFile(
+      await fs21.writeFile(
         gitPaths.script,
         `#!/bin/sh
 exec ${shellQuote2(await stableNodePath())} ${shellQuote2(runtimePaths().launcher)} claude-git-hook ${shellQuote2(config3.dataDirectory)}
 `,
         { encoding: "utf8", mode: 448 }
       );
-      await fs18.chmod(gitPaths.script, 448);
+      await fs21.chmod(gitPaths.script, 448);
     }
   }
   const filename = agentHookFile(config3);
@@ -24749,19 +25611,19 @@ async function captureTurnSummary(dataDirectory2) {
         windowsHide: true
       }
     ));
-    directory = path23.normalize(directory.trim());
+    directory = path26.normalize(directory.trim());
   } catch {
     quiet();
     return;
   }
-  if (!path23.isAbsolute(directory)) {
+  if (!path26.isAbsolute(directory)) {
     quiet();
     return;
   }
   const key = String(crc32(directory));
   const paths = turnSummaryPaths(dataDirectory2);
   try {
-    await fs18.writeFile(path23.join(paths.requests, key), `${directory}
+    await fs21.writeFile(path26.join(paths.requests, key), `${directory}
 `, {
       encoding: "utf8",
       mode: 384
@@ -24770,7 +25632,7 @@ async function captureTurnSummary(dataDirectory2) {
   }
   let lines;
   try {
-    lines = await fs18.readFile(path23.join(paths.lines, key), "utf8");
+    lines = await fs21.readFile(path26.join(paths.lines, key), "utf8");
   } catch {
     quiet();
     return;
@@ -24782,7 +25644,7 @@ async function captureTurnSummary(dataDirectory2) {
   }
   let last;
   try {
-    last = (await fs18.readFile(path23.join(paths.shown, key), "utf8")).split("\n")[0] ?? null;
+    last = (await fs21.readFile(path26.join(paths.shown, key), "utf8")).split("\n")[0] ?? null;
   } catch {
     last = null;
   }
@@ -24791,7 +25653,7 @@ async function captureTurnSummary(dataDirectory2) {
     return;
   }
   try {
-    await fs18.writeFile(path23.join(paths.shown, key), `${message}
+    await fs21.writeFile(path26.join(paths.shown, key), `${message}
 `, {
       encoding: "utf8",
       mode: 384
@@ -24851,7 +25713,7 @@ async function fetchSummary(config3, directory, fetcher, signal) {
 }
 async function readRequest(filename) {
   try {
-    const [directory] = (await fs18.readFile(filename, "utf8")).split("\n");
+    const [directory] = (await fs21.readFile(filename, "utf8")).split("\n");
     return directory ?? null;
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
@@ -24860,33 +25722,40 @@ async function readRequest(filename) {
   }
 }
 async function writeLine(paths, key, directory, message) {
-  const filename = path23.join(paths.lines, key);
+  const filename = path26.join(paths.lines, key);
   if (message === null) {
-    await fs18.rm(filename, { force: true });
+    await fs21.rm(filename, { force: true });
     return;
   }
   const temporary = `${filename}.${process.pid}.tmp`;
-  await fs18.writeFile(
+  await fs21.writeFile(
     temporary,
     `${directory}
 ${JSON.stringify({ systemMessage: message })}
 `,
     { encoding: "utf8", mode: 384 }
   );
-  await fs18.rename(temporary, filename);
+  await fs21.rename(temporary, filename);
 }
 async function forget(paths, key) {
   await Promise.all(
     [paths.requests, paths.lines, paths.shown].map(
-      (directory) => fs18.rm(path23.join(directory, key), { force: true })
+      (directory) => fs21.rm(path26.join(directory, key), { force: true })
     )
   );
 }
+async function clearTurnSummaries(config3) {
+  const paths = turnSummaryPaths(config3.dataDirectory);
+  for (const directory of [paths.lines, paths.shown]) {
+    await fs21.rm(directory, { recursive: true, force: true });
+    await ensurePrivateDirectory(directory);
+  }
+}
 async function refreshTurnSummaries(config3, refreshedAt, nowMs, fetcher = collectorFetch, signal) {
   const paths = turnSummaryPaths(config3.dataDirectory);
   let keys;
   try {
-    keys = await fs18.readdir(paths.requests);
+    keys = await fs21.readdir(paths.requests);
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return 0;
@@ -24896,8 +25765,8 @@ async function refreshTurnSummaries(config3, refreshedAt, nowMs, fetcher = colle
   for (const key of keys.sort()) {
     signal?.throwIfAborted();
     if (!REQUEST_KEY_PATTERN.test(key)) continue;
-    const filename = path23.join(paths.requests, key);
-    const stats = await fs18.stat(filename).catch((error3) => {
+    const filename = path26.join(paths.requests, key);
+    const stats = await fs21.stat(filename).catch((error3) => {
       if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
         return null;
       throw error3;
@@ -24964,8 +25833,8 @@ async function codexTurnSummaryApproval(config3) {
     if (handlerIndex < 0) continue;
     let configToml;
     try {
-      configToml = await fs18.readFile(
-        path23.join(config3.codexHome, "config.toml"),
+      configToml = await fs21.readFile(
+        path26.join(config3.codexHome, "config.toml"),
         "utf8"
       );
     } catch (error3) {
@@ -24992,25 +25861,25 @@ var consentSchema = object3({
   sourceHomes: object3({
     codex: string5(),
     claude: string5(),
-    cursor: string5().default(path24.join(os8.homedir(), ".cursor"))
+    cursor: string5().default(path27.join(os10.homedir(), ".cursor"))
   }).strict()
 }).strict();
 function consentPath() {
-  return path24.join(os8.homedir(), ".config", "iteration", "auto-connect.json");
+  return path27.join(os10.homedir(), ".config", "iteration", "auto-connect.json");
 }
 async function removeMachineConsent() {
-  await fs19.rm(consentPath(), { force: true });
+  await fs22.rm(consentPath(), { force: true });
 }
 async function detectedSources(sourceHomes) {
   const detected = [];
   for (const source of COLLECTOR_SOURCES2) {
-    const directory = path24.join(
+    const directory = path27.join(
       sourceHomes[source],
       source === "codex" ? "sessions" : "projects"
     );
     let stats;
     try {
-      stats = await fs19.stat(directory);
+      stats = await fs22.stat(directory);
     } catch (error3) {
       if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
         continue;
@@ -25030,7 +25899,7 @@ async function detectedSources(sourceHomes) {
 async function loadMachineConsent() {
   let text;
   try {
-    text = await fs19.readFile(consentPath(), "utf8");
+    text = await fs22.readFile(consentPath(), "utf8");
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return null;
@@ -25052,43 +25921,6 @@ async function loadMachineConsent() {
   validateCollectorEndpoint(parsed.data.endpoint);
   return parsed.data;
 }
-async function saveMachineConsent(consent) {
-  const parsed = consentSchema.parse(consent);
-  validateCollectorEndpoint(parsed.endpoint);
-  const filename = consentPath();
-  await ensurePrivateDirectory(path24.dirname(filename));
-  const temporary = `${filename}.${process.pid}.tmp`;
-  const handle = await fs19.open(temporary, "w", 384);
-  try {
-    await handle.writeFile(`${JSON.stringify(parsed)}
-`, "utf8");
-    await handle.sync();
-  } finally {
-    await handle.close();
-  }
-  await fs19.rename(temporary, filename);
-}
-async function readCollectorScope(anchor3) {
-  const endpoint = validateCollectorEndpoint(anchor3.endpoint);
-  const response = await collectorFetch(
-    new URL("./collector-auth/expand", endpoint),
-    {
-      headers: { Authorization: `Bearer ${anchor3.token}` },
-      signal: AbortSignal.timeout(1e4)
-    }
-  );
-  const payload = await response.json();
-  if (!response.ok) {
-    const error3 = object3({ error: string5() }).safeParse(payload);
-    throw new Error(
-      `Could not identify the collector workspace: ${error3.success ? error3.data.error : `HTTP ${response.status}`}`
-    );
-  }
-  const parsed = object3({ organizationId: uuid5(), organizationName: string5().min(1) }).strict().safeParse(payload);
-  if (!parsed.success)
-    throw new Error("Iteration returned an invalid collector workspace.");
-  return parsed.data;
-}
 async function expandSource(anchor3, source, organizationId, request2 = collectorFetch) {
   const endpoint = validateCollectorEndpoint(anchor3.endpoint);
   const token = createHmac("sha256", anchor3.token).update(`iteration-source:${source}`, "utf8").digest("base64url");
@@ -25162,7 +25994,7 @@ async function connectNewDetectedSources(anchor3, consent) {
     if (source === consent.anchorSource) continue;
     const paths = collectorPaths(defaultCollectorDirectory(source));
     try {
-      await fs19.access(paths.config);
+      await fs22.access(paths.config);
       continue;
     } catch (error3) {
       if (!(error3 instanceof Error && "code" in error3 && error3.code === "ENOENT"))
@@ -25200,18 +26032,28 @@ async function connectNewDetectedSources(anchor3, consent) {
   }
   return connected;
 }
-async function connectedConfig(source) {
-  const paths = collectorPaths(defaultCollectorDirectory(source));
+async function connectedConfig(source, directory = defaultCollectorDirectory(source)) {
+  const paths = collectorPaths(directory);
   try {
-    await fs19.access(paths.config);
+    await fs22.access(paths.config);
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return null;
     throw error3;
   }
-  return loadConfig(paths);
+  const config3 = await loadConfig(paths);
+  if (collectorSource(config3) !== source)
+    throw new Error(
+      `The collector directory belongs to a different coding agent: ${directory}.`
+    );
+  return config3;
 }
 
+// src/sharing-connect.ts
+import os12 from "node:os";
+import path30 from "node:path";
+import { setTimeout as delay6 } from "node:timers/promises";
+
 // src/clerk-device-auth.ts
 import { execFile as execFile8 } from "node:child_process";
 import { promisify as promisify8 } from "node:util";
@@ -25586,8 +26428,8 @@ async function clerkDeviceSignIn(configuration) {
     stopSpinner();
   }
 }
-async function enrollDevice(endpoint, accessToken, deviceName, organizationId, source) {
-  const body = { deviceName };
+async function enrollDevice(endpoint, accessToken, deviceName, organizationId, source, computerId) {
+  const body = { deviceName, ...computerId === void 0 ? {} : { computerId } };
   if (source !== "codex") body.source = source;
   if (organizationId !== null) body.organizationId = organizationId;
   const response = await collectorFetch(
@@ -25658,7 +26500,7 @@ async function chooseOrganization(organizations, hasMore) {
   }
   return organization.id;
 }
-async function authenticateAndEnrollCollector(endpoint, deviceNameValue, organizationId, source = "codex") {
+async function authenticateAndEnrollCollector(endpoint, deviceNameValue, organizationId, source = "codex", computerId) {
   const deviceName = string5().trim().min(1).max(160).safeParse(deviceNameValue);
   if (!deviceName.success) {
     throw new Error("--device-name must contain 1 to 160 characters.");
@@ -25670,34 +26512,617 @@ async function authenticateAndEnrollCollector(endpoint, deviceNameValue, organiz
     clerkAccessToken,
     deviceName.data,
     organizationId,
-    source
+    source,
+    computerId
+  );
+  if (result.status === "choose_organization") {
+    const selectedOrganizationId = await chooseOrganization(
+      result.organizations,
+      result.hasMore
+    );
+    result = await enrollDevice(
+      endpoint,
+      clerkAccessToken,
+      deviceName.data,
+      selectedOrganizationId,
+      source,
+      computerId
+    );
+  }
+  if (result.status !== "enrolled") {
+    throw new Error("The collector could not be assigned to that workspace.");
+  }
+  return {
+    token: result.token,
+    deviceId: result.deviceId,
+    organizationId: result.organizationId,
+    organizationName: result.organizationName
+  };
+}
+
+// src/sharing-inventory.ts
+import { promises as fs23 } from "node:fs";
+import path28 from "node:path";
+var MAX_FILES = 1e4;
+var MAX_HEADER_BYTES = 256 * 1024;
+async function projectInventory(computerId, homes) {
+  const projects = /* @__PURE__ */ new Map();
+  let inventoryBytes = 256;
+  let truncated = false;
+  for (const source of ["codex", "claude", "cursor"]) {
+    const home = homes[source];
+    if (home === void 0) continue;
+    const files = await sourceFilesNewestFirst(source, home);
+    truncated ||= files.length > MAX_FILES;
+    for (const file of files.slice(0, MAX_FILES)) {
+      const handle = await fs23.open(file.filename, "r");
+      let contents;
+      try {
+        const buffer = Buffer.alloc(Math.min(file.size, MAX_HEADER_BYTES));
+        const result = await handle.read(buffer, 0, buffer.length, 0);
+        contents = buffer.subarray(0, result.bytesRead).toString("utf8");
+      } finally {
+        await handle.close();
+      }
+      const cwds = {};
+      const locations = /* @__PURE__ */ new Set();
+      for (const line of contents.split("\n")) {
+        const location = captureRecordLocation(
+          source,
+          line,
+          file.filename,
+          cwds
+        );
+        if (location !== null) locations.add(location);
+      }
+      for (const location of locations) {
+        const bytes = Buffer.byteLength(JSON.stringify(location), "utf8") + 1200;
+        if (!projects.has(location) && (projects.size >= 1e3 || inventoryBytes + bytes > 480 * 1024)) {
+          truncated = true;
+          continue;
+        }
+        if (!projects.has(location)) inventoryBytes += bytes;
+        const project = projects.get(location) ?? {
+          name: (path28.basename(location) || location).slice(0, 160),
+          sessions: 0,
+          sources: /* @__PURE__ */ new Set()
+        };
+        project.sessions += file.session ? 1 : 0;
+        project.sources.add(source);
+        projects.set(location, project);
+      }
+    }
+  }
+  return {
+    computerId,
+    truncated,
+    projects: [...projects].map(([folder, project]) => ({
+      path: folder,
+      name: project.name,
+      sessions: project.sessions,
+      sources: [...project.sources]
+    })).sort(
+      (left, right) => left.name.localeCompare(right.name) || left.path.localeCompare(right.path)
+    )
+  };
+}
+
+// src/folder-browser.ts
+import { promises as fs24 } from "node:fs";
+import os11 from "node:os";
+import path29 from "node:path";
+import { setTimeout as delay5 } from "node:timers/promises";
+function breadcrumbs(directory, home) {
+  const entries2 = [];
+  let current = directory;
+  for (let depth = 0; depth < 8; depth += 1) {
+    entries2.unshift({
+      path: current,
+      name: current === home ? "Home" : path29.basename(current) || current
+    });
+    const parent = path29.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return entries2;
+}
+async function folderEntryIsDirectory(entry, filename) {
+  if (!entry.isSymbolicLink()) return entry.isDirectory();
+  try {
+    return (await fs24.stat(filename)).isDirectory();
+  } catch (error3) {
+    if (error3 instanceof Error && "code" in error3 && ["ENOENT", "EACCES", "EPERM", "ELOOP"].includes(String(error3.code)))
+      return false;
+    throw error3;
+  }
+}
+async function readFolderListing(request2, home = os11.homedir(), signal) {
+  signal?.throwIfAborted();
+  const directory = await fs24.realpath(request2.directory ?? home);
+  const parent = path29.dirname(directory);
+  const entries2 = [];
+  let scanned = 0, bytes = 0, truncated = false;
+  const deadline = Date.now() + 3e3;
+  const handle = await fs24.opendir(directory);
+  for await (const entry of handle) {
+    signal?.throwIfAborted();
+    if (++scanned > 1e4 || Date.now() > deadline) {
+      truncated = true;
+      break;
+    }
+    if (!request2.showHidden && entry.name.startsWith(".") || !entry.name.toLowerCase().includes(request2.query.toLowerCase()))
+      continue;
+    const filename = path29.join(directory, entry.name);
+    if (!captureLocationSchema.safeParse(filename).success) continue;
+    if (!await folderEntryIsDirectory(entry, filename)) continue;
+    const folder = { name: entry.name, path: filename };
+    bytes += Buffer.byteLength(JSON.stringify(folder), "utf8");
+    if (entries2.length === 200 || bytes > 384 * 1024) {
+      truncated = true;
+      break;
+    }
+    entries2.push(folder);
+  }
+  entries2.sort((left, right) => left.name.localeCompare(right.name));
+  return {
+    directory,
+    name: path29.basename(directory) || directory,
+    parent: parent === directory ? null : parent,
+    breadcrumbs: breadcrumbs(directory, home),
+    entries: entries2,
+    truncated
+  };
+}
+async function listingState(request2, signal) {
+  try {
+    return {
+      status: "ready",
+      request: request2,
+      listing: await readFolderListing(request2, void 0, signal)
+    };
+  } catch (error3) {
+    if (signal.aborted) throw error3;
+    const code = error3 instanceof Error && "code" in error3 ? String(error3.code) : "";
+    return {
+      status: "error",
+      request: request2,
+      reason: ["EACCES", "EPERM"].includes(code) ? "permission" : ["ENOENT", "ENOTDIR", "ELOOP"].includes(code) ? "missing" : "unavailable"
+    };
+  }
+}
+async function folderBrowserCycle(config3, signal, fetcher) {
+  const registry3 = await readSharingRegistry();
+  if (!registry3 || registry3.ownerId === null)
+    throw new Error(
+      "The computer connection is unavailable for folder selection."
+    );
+  const deadline = AbortSignal.any([signal, AbortSignal.timeout(1e4)]);
+  for (const connection of registry3.connections.filter(
+    (connection2) => connection2.endpoint === config3.endpoint
+  )) {
+    const url2 = new URL("./collector-folders", connection.endpoint);
+    const headers = { authorization: `Bearer ${connection.token}` };
+    const response = await fetcher(url2, { headers, signal: deadline });
+    if (response.status === 401) {
+      await response.body?.cancel();
+      continue;
+    }
+    if (!response.ok)
+      throw new Error(`Folder selection is waiting (HTTP ${response.status}).`);
+    const command = collectorFolderCommandSchema.nullable().parse(await response.json());
+    if (command === null) return false;
+    if (command.request.expiresAtMs <= Date.now()) return true;
+    const state = await listingState(command.request, deadline);
+    const reply = await fetcher(url2, {
+      method: "POST",
+      headers: { ...headers, "content-type": "application/json" },
+      body: JSON.stringify(
+        collectorFolderReplySchema.parse({
+          organizationId: command.organizationId,
+          state
+        })
+      ),
+      signal: deadline
+    });
+    if (!reply.ok)
+      throw new Error(
+        `Folder selection could not finish (HTTP ${reply.status}).`
+      );
+    object3({ accepted: boolean4() }).strict().parse(await reply.json());
+    return true;
+  }
+  throw new Error("Reconnect this computer to use folder selection.");
+}
+async function runFolderBrowser(config3, signal, fetcher = collectorFetch) {
+  const paths = collectorPaths(path29.join(sharingDirectory(), "folder-browser"));
+  try {
+    while (!signal.aborted) {
+      const release = await tryAcquireCollectorLock(paths);
+      if (release === null) {
+        await delay5(1500, void 0, { signal });
+        continue;
+      }
+      try {
+        while (!signal.aborted) {
+          let pause = 1500;
+          try {
+            if (await folderBrowserCycle(config3, signal, fetcher)) pause = 250;
+          } catch (error3) {
+            if (signal.aborted) throw error3;
+            collectorLogger({
+              level: "warning",
+              operation: "folder_browser",
+              message: "Folder selection is waiting for the computer connection. Retrying.",
+              errorName: error3 instanceof Error ? error3.name : "UnknownError"
+            });
+            pause = 5e3;
+          }
+          await delay5(pause, void 0, { signal });
+        }
+      } finally {
+        await release();
+      }
+    }
+  } catch (error3) {
+    if (!signal.aborted) throw error3;
+  }
+}
+
+// src/sharing-connect.ts
+function textOption(options, key) {
+  const value = options[key];
+  if (value === void 0) return null;
+  const parsed = string5().trim().min(1).safeParse(value);
+  if (!parsed.success) throw new Error(`--${key} requires a value.`);
+  return parsed.data;
+}
+function sourceConfig(source, home, directory, endpoint, enrollment) {
+  const common = {
+    destination: "host",
+    endpoint,
+    dataDirectory: directory,
+    token: enrollment.token,
+    organizationId: enrollment.organizationId,
+    organizationName: enrollment.organizationName
+  };
+  return source === "codex" ? { ...common, codexHome: home } : source === "claude" ? { ...common, source, claudeHome: home } : { ...common, source, cursorHome: home };
+}
+async function prepareSource(config3, previous) {
+  const source = collectorSource(config3);
+  const paths = collectorPaths(config3.dataDirectory);
+  if (previous !== null) await uninstallBackgroundService(source);
+  const release = await waitForCollectorLock(paths);
+  try {
+    if (previous === null) {
+      const home = "codexHome" in config3 ? config3.codexHome : "claudeHome" in config3 ? config3.claudeHome : config3.cursorHome;
+      await saveState(
+        await prepareSourceInitialState(source, home, true),
+        paths
+      );
+    } else await ensureStartableState(previous, paths);
+    await saveConfig(config3, paths);
+  } finally {
+    await release();
+  }
+}
+async function startSource(config3) {
+  const source = collectorSource(config3);
+  if ("cursorHome" in config3)
+    await installCursorHooks(config3.cursorHome, config3.dataDirectory);
+  await installBackgroundService(config3.dataDirectory, source);
+  try {
+    if (source !== "cursor") await installTurnSummary(config3);
+    await installAgentTools(agentHomes(config3));
+  } catch (error3) {
+    process.stdout.write(
+      `Connected, but the agent integration needs attention: ${error3 instanceof Error ? error3.message : "setup failed"}
+`
+    );
+  }
+}
+async function localConnectionOptions(options, selectedSource) {
+  const existing = await Promise.all(
+    COLLECTOR_SOURCES2.map(
+      (source) => connectedConfig(
+        source,
+        source === selectedSource ? textOption(options, "data-directory") ?? void 0 : void 0
+      )
+    )
+  );
+  const homes = Object.fromEntries(
+    COLLECTOR_SOURCES2.map((source, index) => {
+      const previous = existing[index];
+      const home = previous ? "codexHome" in previous ? previous.codexHome : "claudeHome" in previous ? previous.claudeHome : previous.cursorHome : sourceHome(source);
+      return [
+        source,
+        path30.resolve(textOption(options, `${source}-home`) ?? home)
+      ];
+    })
+  );
+  const detected = await detectedSources(homes);
+  const sources = selectedSource ? [selectedSource] : [
+    .../* @__PURE__ */ new Set([
+      ...detected,
+      ...COLLECTOR_SOURCES2.filter((_, index) => existing[index] !== null)
+    ])
+  ];
+  const endpoint = validateCollectorEndpoint(
+    textOption(options, "endpoint") ?? existing.find((config3) => config3 !== null)?.endpoint ?? "https://useiteration.com/api/traces/ingest"
+  ).toString();
+  if (existing.some((config3) => config3 !== null && config3.endpoint !== endpoint))
+    throw new Error(
+      "This computer is connected to another Iteration server. Sign out before changing servers."
+    );
+  return { existing, homes, sources, endpoint };
+}
+function assertSharingOwner(ownerId, nextOwnerId) {
+  if (ownerId !== null && ownerId !== nextOwnerId)
+    throw new Error(
+      "This computer is connected to another Iteration account. Run iteration logout before switching accounts."
+    );
+}
+async function waitForSharing(anchor3, alreadyApproved, signal) {
+  const deadline = Date.now() + 15 * 60 * 1e3;
+  let approved = alreadyApproved;
+  while (!approved && Date.now() < deadline) {
+    await delay6(2e3, void 0, { signal });
+    approved = (await fetchSharingSnapshot(anchor3, void 0, signal)).approved;
+  }
+  if (!approved)
+    throw new Error(
+      "Sharing is still waiting for your project choice. Finish it in Iteration, then run iteration connect again."
+    );
+}
+async function connectWorkspace(options, selectedSource) {
+  requireCollectorPlatform();
+  if (selectedSource === void 0 && options["data-directory"] !== void 0)
+    throw new Error(
+      "--data-directory requires a source-specific connect command."
+    );
+  const local = await localConnectionOptions(options, selectedSource);
+  if (local.sources.length === 0) {
+    process.stdout.write(
+      "No supported local coding agents found yet. Run iteration connect after using Claude Code, Codex or Cursor.\n"
+    );
+    return;
+  }
+  if ((!process.stdin.isTTY || !process.stdout.isTTY) && options.yes !== true)
+    throw new Error(
+      "Run iteration connect interactively or pass --yes to open browser sign-in. Project sharing still requires approval in Iteration."
+    );
+  await prepareBackgroundPersistence();
+  const prepared = await withSharingRegistry(async (initial, save) => {
+    let registry3 = initial;
+    const { existing, homes, sources, endpoint } = local;
+    const first = sources[0];
+    const requested = textOption(options, "workspace");
+    let anchor3 = requested === null ? null : sharingConnection(registry3, requested, first);
+    if (anchor3 !== null) {
+      try {
+        await fetchSharingSnapshot(anchor3);
+      } catch {
+        anchor3 = null;
+      }
+    }
+    if (anchor3 === null) {
+      const enrollment = await authenticateAndEnrollCollector(
+        new URL(endpoint),
+        textOption(options, "device-name") ?? os12.hostname(),
+        requested,
+        first,
+        registry3.computerId
+      );
+      anchor3 = enrolledSharingConnection(enrollment, first, endpoint);
+    }
+    const anchorConfig = sourceConfig(
+      first,
+      homes[first],
+      defaultCollectorDirectory(first),
+      endpoint,
+      anchor3
+    );
+    const inventory = collectorProjectInventorySchema.parse(
+      await projectInventory(registry3.computerId, homes)
+    );
+    const response = await collectorFetch(
+      new URL("./collector-sharing", endpoint),
+      {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${anchor3.token}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify(inventory),
+        signal: AbortSignal.timeout(2e4)
+      }
+    );
+    if (!response.ok)
+      throw new Error(
+        `Could not prepare project sharing (HTTP ${response.status}). No new sharing has started.`
+      );
+    const snapshot = collectorSharingSnapshotSchema.parse(
+      await response.json()
+    );
+    assertSharingOwner(registry3.ownerId, snapshot.ownerId);
+    registry3 = {
+      ...registry3,
+      ownerId: snapshot.ownerId,
+      sourceHomes: homes,
+      connections: [
+        ...registry3.connections.filter(
+          (connection) => connection.organizationId !== anchor3.organizationId || connection.source !== first
+        ),
+        anchor3
+      ]
+    };
+    await save(registry3);
+    await prepareBackgroundPersistence();
+    for (const previous of existing) {
+      if (previous !== null && previous.destination !== "host")
+        await prepareSource({ ...previous, destination: "host" }, previous);
+    }
+    const configs = [];
+    for (const source of sources) {
+      const enrollment = source === first ? anchor3 : await expandSource(anchorConfig, source, anchor3.organizationId);
+      const connection = enrolledSharingConnection(
+        enrollment,
+        source,
+        endpoint
+      );
+      registry3 = {
+        ...registry3,
+        connections: [
+          ...registry3.connections.filter(
+            (saved) => saved.organizationId !== connection.organizationId || saved.source !== source
+          ),
+          connection
+        ]
+      };
+      await save(registry3);
+      const previous = existing[COLLECTOR_SOURCES2.indexOf(source)] ?? null;
+      const directory = selectedSource ? path30.resolve(
+        textOption(options, "data-directory") ?? defaultCollectorDirectory(source)
+      ) : defaultCollectorDirectory(source);
+      const config3 = previous === null ? sourceConfig(source, homes[source], directory, endpoint, enrollment) : { ...previous, destination: "host" };
+      if (previous === null || previous.destination !== "host")
+        await prepareSource(config3, previous);
+      registry3 = {
+        ...registry3,
+        directories: {
+          ...registry3.directories,
+          [source]: config3.dataDirectory
+        }
+      };
+      await save(registry3);
+      configs.push(config3);
+    }
+    return {
+      configs,
+      anchor: anchor3,
+      approved: snapshot.approved,
+      computerId: registry3.computerId
+    };
+  });
+  const url2 = new URL("/app/collectors/share", prepared.anchor.endpoint);
+  url2.searchParams.set("workspace", prepared.anchor.organizationId);
+  url2.searchParams.set("computer", prepared.computerId);
+  process.stdout.write(
+    `
+Choose which projects ${prepared.anchor.organizationName} can see.
+${url2}
+
+Nothing new uploads until you approve sharing in Iteration.
+`
   );
-  if (result.status === "choose_organization") {
-    const selectedOrganizationId = await chooseOrganization(
-      result.organizations,
-      result.hasMore
+  const folderController = new AbortController();
+  const failures = [];
+  const folderTask = runFolderBrowser(
+    prepared.anchor,
+    folderController.signal
+  ).then(
+    () => null,
+    (error3) => {
+      folderController.abort();
+      return { error: error3 };
+    }
+  );
+  try {
+    await openBrowser(url2.toString());
+    await waitForSharing(
+      prepared.anchor,
+      prepared.approved,
+      folderController.signal
     );
-    result = await enrollDevice(
-      endpoint,
-      clerkAccessToken,
-      deviceName.data,
-      selectedOrganizationId,
-      source
+    for (const config3 of prepared.configs) {
+      await startSource(config3);
+      process.stdout.write(
+        `${collectorSourceLabel(collectorSource(config3))} connected \xB7 sharing approved projects
+`
+      );
+    }
+  } catch (error3) {
+    failures.push(error3);
+  } finally {
+    folderController.abort();
+    const outcome = await folderTask;
+    if (outcome !== null) failures.push(outcome.error);
+  }
+  if (failures.length === 1) throw failures[0];
+  if (failures.length > 1)
+    throw new AggregateError(
+      failures,
+      "The computer connection could not finish cleanly."
     );
-  }
-  if (result.status !== "enrolled") {
-    throw new Error("The collector could not be assigned to that workspace.");
-  }
-  return {
-    token: result.token,
-    deviceId: result.deviceId,
-    organizationId: result.organizationId,
-    organizationName: result.organizationName
-  };
+  process.stdout.write(
+    "Saved sessions from those projects import first. New activity follows the same choice, whichever coding account you use.\n"
+  );
+}
+async function connectSharedDetectedSources(config3) {
+  await withSharingRegistry(async (registry3, save) => {
+    if (registry3.connections.length === 0) return;
+    const { snapshot } = await sharingTransport(
+      config3,
+      void 0,
+      void 0,
+      registry3
+    );
+    const homes = registry3.sourceHomes ?? {
+      codex: sourceHome("codex"),
+      claude: sourceHome("claude"),
+      cursor: sourceHome("cursor")
+    };
+    let next = registry3;
+    for (const source of await detectedSources(homes)) {
+      const previous = await connectedConfig(
+        source,
+        registry3.directories?.[source]
+      );
+      for (const workspace of snapshot.workspaces.filter(
+        (workspace2) => workspace2.active
+      )) {
+        if (sharingConnection(next, workspace.organizationId, source)) continue;
+        const anchor3 = next.connections.find(
+          (connection2) => connection2.organizationId === workspace.organizationId
+        );
+        if (!anchor3) continue;
+        const enrollment = await expandSource(
+          {
+            ...config3,
+            token: anchor3.token,
+            organizationId: anchor3.organizationId,
+            organizationName: anchor3.organizationName
+          },
+          source,
+          workspace.organizationId
+        );
+        next = {
+          ...next,
+          connections: [
+            ...next.connections,
+            enrolledSharingConnection(enrollment, source, config3.endpoint)
+          ]
+        };
+        await save(next);
+      }
+      const connection = next.connections.find(
+        (item) => item.source === source
+      );
+      if (previous !== null || !connection) continue;
+      const added = sourceConfig(
+        source,
+        homes[source],
+        defaultCollectorDirectory(source),
+        config3.endpoint,
+        connection
+      );
+      await prepareSource(added, null);
+      await startSource(added);
+    }
+  });
 }
 
 // src/history-import.ts
-import path25 from "node:path";
+import path31 from "node:path";
 function backgroundControl(source) {
   return {
     isRunning: () => backgroundServiceStatus(source),
@@ -25710,7 +27135,7 @@ async function importSourceHistory(config3, paths, confirmed, control = backgrou
   const source = collectorSource(config3);
   const directory = collectorSourceDirectory(config3);
   const state = await loadState(paths);
-  if (!state.initialized || state.sourceDirectory !== path25.resolve(directory)) {
+  if (!state.initialized || state.sourceDirectory !== path31.resolve(directory)) {
     throw new Error(
       `Connect the ${source} source before importing its history.`
     );
@@ -25758,37 +27183,37 @@ async function importSourceHistory(config3, paths, confirmed, control = backgrou
 }
 
 // src/logout.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { promises as fs20 } from "node:fs";
-import os9 from "node:os";
-import path26 from "node:path";
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { promises as fs25 } from "node:fs";
+import os13 from "node:os";
+import path32 from "node:path";
 async function pendingDirectories(filename) {
   let contents;
   try {
-    contents = await fs20.readFile(filename, "utf8");
+    contents = await fs25.readFile(filename, "utf8");
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return [];
     throw error3;
   }
-  const parsed = array2(string5().refine(path26.isAbsolute)).max(64).safeParse(JSON.parse(contents));
+  const parsed = array2(string5().refine(path32.isAbsolute)).max(64).safeParse(JSON.parse(contents));
   if (!parsed.success)
     throw new Error("Pending logout directories are invalid.");
   return parsed.data;
 }
 async function savePendingDirectories(filename, directories) {
-  await ensurePrivateDirectory(path26.dirname(filename));
+  await ensurePrivateDirectory(path32.dirname(filename));
   const temporary = `${filename}.${process.pid}.tmp`;
-  await fs20.writeFile(temporary, JSON.stringify([...directories]), {
+  await fs25.writeFile(temporary, JSON.stringify([...directories]), {
     mode: 384
   });
-  await fs20.rename(temporary, filename);
+  await fs25.rename(temporary, filename);
 }
 async function clearConnection(directory) {
   const paths = collectorPaths(directory);
   let names;
   try {
-    names = await fs20.readdir(directory);
+    names = await fs25.readdir(directory);
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return;
@@ -25798,14 +27223,15 @@ async function clearConnection(directory) {
   try {
     for (const name of names)
       if (/^config\.json\.\d+\.tmp$/.test(name))
-        await fs20.rm(path26.join(directory, name), { force: true });
-    if (!names.includes(path26.basename(paths.config))) return;
+        await fs25.rm(path32.join(directory, name), { force: true });
+    if (!names.includes(path32.basename(paths.config))) return;
     const config3 = await loadConfig(paths);
     if (config3.destination === "vault")
       throw new Error("This directory belongs to Trace Vault, not Iteration.");
     if ("cursorHome" in config3)
       await uninstallCursorHooks(config3.cursorHome, config3.dataDirectory);
     else await uninstallTurnSummary(config3);
+    await uninstallAgentTools(agentHomes(config3));
     const retained = [
       paths.state,
       paths.outbox,
@@ -25819,41 +27245,43 @@ async function clearConnection(directory) {
         "claude-git",
         "turn-summary",
         "codex-billing-sync.json",
-        "cursor-billing-sync.json"
-      ].map((name) => path26.join(directory, name))
+        "cursor-billing-sync.json",
+        "shared-sessions.json"
+      ].map((name) => path32.join(directory, name))
     ];
-    const archive = path26.join(directory, "logged-out", randomUUID3());
+    const archive = path32.join(directory, "logged-out", randomUUID4());
     await ensurePrivateDirectory(archive);
     for (const filename of retained) {
       try {
-        await fs20.rename(filename, path26.join(archive, path26.basename(filename)));
+        await fs25.rename(filename, path32.join(archive, path32.basename(filename)));
       } catch (error3) {
         if (!(error3 instanceof Error && "code" in error3 && error3.code === "ENOENT"))
           throw error3;
       }
     }
-    await fs20.rm(paths.config);
+    await fs25.rm(paths.config);
   } finally {
     await release();
   }
 }
 async function logout(extraDirectory) {
   requireCollectorPlatform();
-  const pending = path26.join(
-    os9.homedir(),
+  const pending2 = path32.join(
+    os13.homedir(),
     ".config",
     "iteration",
     "logout-pending.json"
   );
   const directories = /* @__PURE__ */ new Set([
     ...COLLECTOR_SOURCES2.map(defaultCollectorDirectory),
-    ...await pendingDirectories(pending)
+    ...await pendingDirectories(pending2)
   ]);
   if (extraDirectory !== void 0)
-    directories.add(path26.resolve(extraDirectory));
+    directories.add(path32.resolve(extraDirectory));
   const failures = [];
   try {
     await removeMachineConsent();
+    await forgetSharingConnections();
   } catch (error3) {
     failures.push(
       `Automatic connection approval: ${error3 instanceof Error ? error3.message : "Could not remove approval."}`
@@ -25871,7 +27299,7 @@ async function logout(extraDirectory) {
       );
     }
   }
-  await savePendingDirectories(pending, directories);
+  await savePendingDirectories(pending2, directories);
   const stopped = await Promise.all(
     COLLECTOR_SOURCES2.filter((source) => !unreadableServices.has(source)).map(
       (source) => uninstallBackgroundService(source).then(
@@ -25895,7 +27323,7 @@ async function logout(extraDirectory) {
       `Logout did not finish. Resolve these errors and run iteration logout again:
 ${failures.join("\n")}`
     );
-  await fs20.rm(pending);
+  await fs25.rm(pending2);
 }
 
 // src/runtime-services.ts
@@ -25922,17 +27350,17 @@ async function adoptRuntime() {
 }
 
 // src/service.ts
-import { setTimeout as delay5 } from "node:timers/promises";
+import { setTimeout as delay7 } from "node:timers/promises";
 
 // src/codex-billing.ts
 import { createHash as createHash7 } from "node:crypto";
-import { promises as fs21 } from "node:fs";
-import path27 from "node:path";
+import { promises as fs26 } from "node:fs";
+import path33 from "node:path";
 var TASK_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage/thread_usage/query_v2";
 var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var TASK_BATCH_SIZE = 50;
-var MAX_HEADER_BYTES = 3 * 1024 * 1024;
+var MAX_HEADER_BYTES2 = 3 * 1024 * 1024;
 var stateSchema2 = object3({
   accountFingerprint: string5().regex(/^[0-9a-f]{64}$/),
   lastSyncedAtMs: number4().int().nonnegative(),
@@ -25979,7 +27407,7 @@ function fingerprint(value) {
 async function readAuth(codexHome) {
   let contents;
   try {
-    contents = await fs21.readFile(path27.join(codexHome, "auth.json"), "utf8");
+    contents = await fs26.readFile(path33.join(codexHome, "auth.json"), "utf8");
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return {
@@ -26014,7 +27442,7 @@ async function readAuth(codexHome) {
 async function readState(filename) {
   let contents;
   try {
-    contents = await fs21.readFile(filename, "utf8");
+    contents = await fs26.readFile(filename, "utf8");
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return null;
@@ -26036,7 +27464,7 @@ async function readState(filename) {
 }
 async function saveState2(filename, state) {
   const temporary = `${filename}.${process.pid}.tmp`;
-  const handle = await fs21.open(temporary, "w", 384);
+  const handle = await fs26.open(temporary, "w", 384);
   try {
     await handle.writeFile(`${JSON.stringify(state)}
 `);
@@ -26044,21 +27472,21 @@ async function saveState2(filename, state) {
   } finally {
     await handle.close();
   }
-  await fs21.rename(temporary, filename);
+  await fs26.rename(temporary, filename);
 }
 async function localThread(filename) {
-  const stat = await fs21.stat(filename);
-  const handle = await fs21.open(filename, "r");
+  const stat = await fs26.stat(filename);
+  const handle = await fs26.open(filename, "r");
   let header = null;
   try {
     const buffer = Buffer.alloc(64 * 1024);
     const chunks = [];
     let offset = 0;
-    while (offset < Math.min(stat.size, MAX_HEADER_BYTES)) {
+    while (offset < Math.min(stat.size, MAX_HEADER_BYTES2)) {
       const read = await handle.read(
         buffer,
         0,
-        Math.min(buffer.length, MAX_HEADER_BYTES - offset),
+        Math.min(buffer.length, MAX_HEADER_BYTES2 - offset),
         offset
       );
       if (read.bytesRead === 0) break;
@@ -26148,9 +27576,9 @@ function parseCodexAuthLog(threadId, body) {
   return { threadId, turnId: turn[1], mode };
 }
 async function localAuthTurns(codexHome, modelProviders) {
-  const filename = path27.join(codexHome, "logs_2.sqlite");
+  const filename = path33.join(codexHome, "logs_2.sqlite");
   try {
-    await fs21.access(filename);
+    await fs26.access(filename);
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return [];
@@ -26243,7 +27671,7 @@ async function queryTaskUsage(tasks, accessToken, accountId, signal) {
 }
 async function syncCodexBilling(config3, fetcher = collectorFetch, signal) {
   const auth = await readAuth(config3.codexHome);
-  const stateFile = path27.join(config3.dataDirectory, "codex-billing-sync.json");
+  const stateFile = path33.join(config3.dataDirectory, "codex-billing-sync.json");
   const prior = await readState(stateFile);
   const nowMs = Date.now();
   const history = prior === null || prior.accountFingerprint !== auth.accountFingerprint;
@@ -26414,9 +27842,9 @@ async function syncCodexBilling(config3, fetcher = collectorFetch, signal) {
 
 // src/cursor-billing.ts
 import { createHash as createHash8 } from "node:crypto";
-import { promises as fs22 } from "node:fs";
-import os10 from "node:os";
-import path28 from "node:path";
+import { promises as fs27 } from "node:fs";
+import os14 from "node:os";
+import path34 from "node:path";
 var CURSOR_USAGE_URL = "https://api2.cursor.sh/aiserver.v1.DashboardService/GetFilteredUsageEvents";
 var PAGE_SIZE = 500;
 var MAX_PAGES = 1e3;
@@ -26447,18 +27875,18 @@ var usagePageSchema = object3({
 var emptyUsagePageSchema = object3({}).strict();
 function cursorAuthDatabase() {
   if (process.platform === "darwin")
-    return path28.join(
-      os10.homedir(),
+    return path34.join(
+      os14.homedir(),
       "Library/Application Support/Cursor/User/globalStorage/state.vscdb"
     );
   if (process.platform === "linux")
-    return path28.join(
-      os10.homedir(),
+    return path34.join(
+      os14.homedir(),
       ".config/Cursor/User/globalStorage/state.vscdb"
     );
   if (process.platform === "win32")
-    return path28.join(
-      process.env.APPDATA ?? path28.join(os10.homedir(), "AppData", "Roaming"),
+    return path34.join(
+      process.env.APPDATA ?? path34.join(os14.homedir(), "AppData", "Roaming"),
       "Cursor/User/globalStorage/state.vscdb"
     );
   return null;
@@ -26500,7 +27928,7 @@ async function readCursorAuth() {
 async function loadBillingState(filename) {
   let contents;
   try {
-    contents = await fs22.readFile(filename, "utf8");
+    contents = await fs27.readFile(filename, "utf8");
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
       return null;
@@ -26516,7 +27944,7 @@ async function loadBillingState(filename) {
 }
 async function saveBillingState(filename, state) {
   const temporary = `${filename}.${process.pid}.tmp`;
-  const handle = await fs22.open(temporary, "w", 384);
+  const handle = await fs27.open(temporary, "w", 384);
   try {
     await handle.writeFile(`${JSON.stringify(state)}
 `, "utf8");
@@ -26524,7 +27952,7 @@ async function saveBillingState(filename, state) {
   } finally {
     await handle.close();
   }
-  await fs22.rename(temporary, filename);
+  await fs27.rename(temporary, filename);
 }
 function planCursorBillingSync(state, accountFingerprint, nowMs) {
   if (state === null || state.accountFingerprint !== accountFingerprint)
@@ -26546,7 +27974,7 @@ function planCursorBillingSync(state, accountFingerprint, nowMs) {
 }
 function cursorConversationIds(filenames) {
   return new Set(
-    filenames.map((filename) => path28.basename(filename, ".jsonl")).filter((id) => UUID3.test(id))
+    filenames.map((filename) => path34.basename(filename, ".jsonl")).filter((id) => UUID3.test(id))
   );
 }
 function billingKind(kind) {
@@ -26604,11 +28032,11 @@ async function syncCursorBilling(config3, fetcher = collectorFetch, signal) {
   if (auth === null)
     return { sessions: 0, matched: 0, skipped: true, mode: null };
   const localConversations = cursorConversationIds(
-    await cursorFiles(path28.join(config3.cursorHome, "projects"))
+    await cursorFiles(path34.join(config3.cursorHome, "projects"))
   );
   if (localConversations.size === 0)
     return { sessions: 0, matched: 0, skipped: true, mode: null };
-  const stateFile = path28.join(config3.dataDirectory, "cursor-billing-sync.json");
+  const stateFile = path34.join(config3.dataDirectory, "cursor-billing-sync.json");
   const priorState = await loadBillingState(stateFile);
   const nowMs = Date.now();
   const plan = planCursorBillingSync(
@@ -26850,6 +28278,14 @@ async function onTrial(version3) {
   const state = await readRuntimeState(runtimePaths());
   return state?.trial?.version === version3;
 }
+function throwCollectorFailures(failures) {
+  if (failures.length === 1) throw failures[0];
+  if (failures.length > 1)
+    throw new AggregateError(
+      failures,
+      "The collector could not finish cleanly."
+    );
+}
 async function runCollector(directory = defaultCollectorDirectory("codex"), expectedSource) {
   const paths = collectorPaths(directory);
   const releaseLock = await acquireCollectorLock(paths);
@@ -26858,8 +28294,18 @@ async function runCollector(directory = defaultCollectorDirectory("codex"), expe
   process.on("SIGTERM", stop);
   process.on("SIGINT", stop);
   let retryDelayMs = 5e3;
+  let folderTask = null;
+  const failures = [];
   try {
     const config3 = await loadConfig(paths);
+    if (config3.destination === "host")
+      folderTask = runFolderBrowser(config3, controller.signal).then(
+        () => null,
+        (error3) => {
+          controller.abort();
+          return { error: error3 };
+        }
+      );
     const source = collectorSource(config3);
     if (expectedSource !== void 0 && expectedSource !== source) {
       throw new Error(
@@ -26884,6 +28330,16 @@ async function runCollector(directory = defaultCollectorDirectory("codex"), expe
     } else await ensureHistoryBackfill(config3.codexHome, paths);
     const summariesRefreshedAt = /* @__PURE__ */ new Map();
     let lastAutoCheckAt = 0;
+    let scoped = null;
+    let sharingRevision = null;
+    const fetcher = (input, init) => {
+      if (config3.destination !== "host") return collectorFetch(input, init);
+      if (scoped === null)
+        throw new Error(
+          "Project sharing could not be verified. Collection is waiting."
+        );
+      return scoped.fetcher(input, init);
+    };
     let lastBillingSyncAt = 0;
     const historyProgress2 = new HistoryProgressReporter();
     const runtimeVersion = process.env.ITERATION_RUNTIME_VERSION;
@@ -26920,6 +28376,10 @@ async function runCollector(directory = defaultCollectorDirectory("codex"), expe
       if (Date.now() - lastAutoCheckAt >= 6e4) {
         lastAutoCheckAt = Date.now();
         try {
+          if (config3.destination === "host") {
+            await connectSharedDetectedSources(config3);
+            return;
+          }
           const consent = await loadMachineConsent();
           if (consent?.anchorSource === source) {
             const connected = await connectNewDetectedSources(config3, consent);
@@ -26972,15 +28432,31 @@ async function runCollector(directory = defaultCollectorDirectory("codex"), expe
       let billingReady = false;
       let history = null;
       try {
+        if (config3.destination === "host") {
+          scoped = null;
+          scoped = await sharingTransport(
+            config3,
+            collectorFetch,
+            controller.signal
+          );
+          if (sharingRevision !== scoped.snapshot.revision) {
+            await clearTurnSummaries(config3);
+            summariesRefreshedAt.clear();
+            sharingRevision = scoped.snapshot.revision;
+          }
+        }
         const result = await collectorTick(
           config3,
           paths,
-          collectorFetch,
+          fetcher,
           controller.signal,
           () => {
             acknowledgedAtMs = Date.now();
           },
-          { recentMessages: RECENT_MESSAGE_LIMIT }
+          {
+            recentMessages: RECENT_MESSAGE_LIMIT,
+            ...scoped === null ? {} : { capture: scoped.capture }
+          }
         );
         billingReady = result.historyCaughtUp && result.outboxBytes === 0;
         history = {
@@ -27021,7 +28497,7 @@ async function runCollector(directory = defaultCollectorDirectory("codex"), expe
           await historyProgress2.report(
             config3,
             history,
-            collectorFetch,
+            fetcher,
             controller.signal,
             Date.now()
           );
@@ -27046,7 +28522,7 @@ async function runCollector(directory = defaultCollectorDirectory("codex"), expe
             config3,
             summariesRefreshedAt,
             Date.now(),
-            collectorFetch,
+            fetcher,
             controller.signal
           );
       } catch (error3) {
@@ -27067,7 +28543,7 @@ async function runCollector(directory = defaultCollectorDirectory("codex"), expe
         try {
           const billing = await syncCursorBilling(
             config3,
-            collectorFetch,
+            fetcher,
             controller.signal
           );
           lastBillingSyncAt = billing.skipped ? Date.now() - 6 * 60 * 60 * 1e3 + 5 * 60 * 1e3 : Date.now();
@@ -27090,7 +28566,7 @@ async function runCollector(directory = defaultCollectorDirectory("codex"), expe
         try {
           const billing = await syncCodexBilling(
             config3,
-            collectorFetch,
+            fetcher,
             controller.signal
           );
           lastBillingSyncAt = billing.skipped ? Date.now() - 6 * 60 * 60 * 1e3 + 5 * 60 * 1e3 : Date.now();
@@ -27120,17 +28596,23 @@ async function runCollector(directory = defaultCollectorDirectory("codex"), expe
       if (!await refreshSummaries()) break;
       if (!await syncBilling(result.billingReady)) break;
       try {
-        await delay5(retryDelayMs, void 0, { signal: controller.signal });
+        await delay7(retryDelayMs, void 0, { signal: controller.signal });
       } catch (error3) {
         if (error3 instanceof Error && error3.name === "AbortError") break;
         throw error3;
       }
     }
+  } catch (error3) {
+    failures.push(error3);
   } finally {
+    controller.abort();
     process.off("SIGTERM", stop);
     process.off("SIGINT", stop);
-    await releaseLock();
+    const outcome = await folderTask;
+    if (outcome) failures.push(outcome.error);
+    await releaseLock().catch((error3) => failures.push(error3));
   }
+  throwCollectorFailures(failures);
 }
 
 // src/status-view.ts
@@ -27255,14 +28737,14 @@ function failureSummary(terminal2, status2, source, nowMs) {
 }
 function connectionSummary(terminal2, status2, source, nowMs) {
   const name = sourceName(source);
-  const pending = status2.pendingEvents > 0 ? [`${pendingDescription(status2)}.`] : [];
+  const pending2 = status2.pendingEvents > 0 ? [`${pendingDescription(status2)}.`] : [];
   const details = `Details: ${terminal2.bold(`iteration status ${source}`)}`;
   if (!status2.running)
     return {
       tone: "warning",
       headline: "Stopped",
       facts: [],
-      details: ["New sessions are not being collected.", ...pending],
+      details: ["New sessions are not being collected.", ...pending2],
       next: `Resume with ${terminal2.bold(`iteration start ${source}`)}`
     };
   if (status2.hookFailureAtMs !== null && status2.hookFailureAtMs !== void 0)
@@ -27282,7 +28764,7 @@ function connectionSummary(terminal2, status2, source, nowMs) {
       facts: [],
       details: [
         "Upload history could not be read. Collection continues in the background.",
-        ...pending
+        ...pending2
       ],
       next: details
     };
@@ -27292,7 +28774,7 @@ function connectionSummary(terminal2, status2, source, nowMs) {
 }
 function scanSummary(status2, source, nowMs) {
   const name = sourceName(source);
-  const pending = status2.pendingEvents > 0 ? [`${pendingDescription(status2)}.`] : [];
+  const pending2 = status2.pendingEvents > 0 ? [`${pendingDescription(status2)}.`] : [];
   const lastUpload = status2.health.lastUploadAtMs === null ? [] : [`last upload ${relativeTime(status2.health.lastUploadAtMs, nowMs)}`];
   const summary = (headline, details, facts = []) => ({
     tone: "success",
@@ -27311,10 +28793,10 @@ function scanSummary(status2, source, nowMs) {
   if (scan.totalBytes - scan.scannedBytes >= 1e6)
     return summary("Catching up with new activity", [
       historyDescription(status2, source),
-      ...pending
+      ...pending2
     ]);
   if (status2.pendingEvents > 0)
-    return summary("Uploading captured sessions", pending);
+    return summary("Uploading captured sessions", pending2);
   if (scan.totalBytes === 0)
     return summary("Connected", [
       `Waiting for ${name} sessions on this computer.`
@@ -27534,26 +29016,26 @@ function renderRuntime(terminal2, summary) {
 
 // src/windows-supervisor.ts
 import { spawn } from "node:child_process";
-import { promises as fs23 } from "node:fs";
-import path29 from "node:path";
-import { setTimeout as delay6 } from "node:timers/promises";
+import { promises as fs28 } from "node:fs";
+import path35 from "node:path";
+import { setTimeout as delay8 } from "node:timers/promises";
 var MAX_LOG_BYTES = 8 * 1024 * 1024;
 var RESTART_DELAY_MS = 5e3;
 async function appendLog(filename, bytes) {
   let offset = 0;
   while (offset < bytes.length) {
-    const size = await fs23.stat(filename).then((stat) => stat.size).catch((error3) => {
+    const size = await fs28.stat(filename).then((stat) => stat.size).catch((error3) => {
       if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT")
         return 0;
       throw error3;
     });
     if (size >= MAX_LOG_BYTES) {
-      await fs23.rm(`${filename}.1`, { force: true });
-      await fs23.rename(filename, `${filename}.1`);
+      await fs28.rm(`${filename}.1`, { force: true });
+      await fs28.rename(filename, `${filename}.1`);
       continue;
     }
     const count = Math.min(bytes.length - offset, MAX_LOG_BYTES - size);
-    await fs23.appendFile(filename, bytes.subarray(offset, offset + count), {
+    await fs28.appendFile(filename, bytes.subarray(offset, offset + count), {
       mode: 384
     });
     offset += count;
@@ -27569,7 +29051,7 @@ async function copyOutput(stream, filename) {
 async function superviseCollector(source, dataDirectory2) {
   const output = windowsOutputPath(source);
   const errors = windowsLogPath(source);
-  await ensurePrivateDirectory(path29.dirname(output));
+  await ensurePrivateDirectory(path35.dirname(output));
   const controller = new AbortController();
   const stop = () => controller.abort();
   process.once("SIGTERM", stop);
@@ -27626,7 +29108,7 @@ async function superviseCollector(source, dataDirectory2) {
 `
         )
       );
-      await delay6(RESTART_DELAY_MS, void 0, {
+      await delay8(RESTART_DELAY_MS, void 0, {
         signal: controller.signal
       }).catch((error3) => {
         if (!controller.signal.aborted) throw error3;
@@ -27639,7 +29121,6 @@ async function superviseCollector(source, dataDirectory2) {
 }
 
 // src/cli.ts
-var DEFAULT_INGEST_ENDPOINT = "https://useiteration.com/api/traces/ingest";
 var terminal = terminalFor(process.stdout);
 function print(...lines) {
   process.stdout.write(`${lines.join("\n")}
@@ -27733,7 +29214,7 @@ function usage(command) {
       "",
       wrap(
         terminal,
-        "Existing local sessions and new activity are collected automatically."
+        "Choose projects in Iteration before any sessions upload."
       ),
       "",
       ...section("Options for advanced setups", [
@@ -27742,7 +29223,7 @@ function usage(command) {
         ["--codex-home DIR", "Use a different Codex data directory"],
         ["--claude-home DIR", "Use a different Claude data directory"],
         ["--cursor-home DIR", "Use a different Cursor data directory"],
-        ["--yes", "Approve uploads without a terminal prompt"],
+        ["--yes", "Project sharing still requires approval in Iteration"],
         [
           "--data-directory DIR",
           "Use a different state directory with a one-agent command"
@@ -27781,7 +29262,7 @@ function usage(command) {
 }
 async function fileExists(filename) {
   try {
-    await fs24.access(filename);
+    await fs29.access(filename);
     return true;
   } catch (error3) {
     if (error3 instanceof Error && "code" in error3 && error3.code === "ENOENT") {
@@ -27822,7 +29303,7 @@ async function defaultCommand() {
   await connectAll({});
 }
 function dataDirectory(source, values) {
-  return path30.resolve(
+  return path36.resolve(
     optionalString(values, "data-directory") ?? defaultCollectorDirectory(source)
   );
 }
@@ -27869,312 +29350,8 @@ function turnSummaryLines(results) {
     ...warnings
   ];
 }
-var CONNECTED_WIDTH = Math.max(
-  ...COLLECTOR_SOURCES2.map(
-    (source) => `${collectorSourceLabel(source)} connected`.length
-  )
-);
-function connectedLine(source, sessions) {
-  return mark(
-    terminal,
-    "success",
-    `${padEnd(`${collectorSourceLabel(source)} connected`, CONNECTED_WIDTH)}  ${terminal.dim(
-      sessions === 0 ? "no saved sessions yet" : `importing ${sessions.toLocaleString("en-US")} ${sessions === 1 ? "session" : "sessions"}`
-    )}`
-  );
-}
-function connectionSummary2(results, imported) {
-  const links = [
-    ...new Set(results.map(({ endpoint }) => tracesUrl(endpoint)))
-  ];
-  const notes = turnSummaryLines(results);
-  return [
-    ...notes.length === 0 ? [] : ["", ...notes],
-    "",
-    wrap(
-      terminal,
-      imported ? `Sessions import newest first. Run ${terminal.bold("iteration")} to follow progress.` : `Run ${terminal.bold("iteration")} to see their status.`
-    ),
-    ...links.map((url2) => `  Open Iteration  ${terminal.link(url2)}`)
-  ];
-}
-async function initialize(source, values) {
-  requireCollectorPlatform();
-  const endpoint = optionalString(values, "endpoint") ?? DEFAULT_INGEST_ENDPOINT;
-  const endpointUrl = validateCollectorEndpoint(endpoint);
-  const deviceName = optionalString(values, "device-name") ?? os11.hostname();
-  const organizationId = optionalString(values, "workspace");
-  const directory = dataDirectory(source, values);
-  const paths = collectorPaths(directory);
-  const selectedHome = path30.resolve(
-    source === "codex" ? optionalString(values, "codex-home") ?? process.env.CODEX_HOME ?? path30.join(os11.homedir(), ".codex") : source === "claude" ? optionalString(values, "claude-home") ?? process.env.CLAUDE_CONFIG_DIR ?? path30.join(os11.homedir(), ".claude") : optionalString(values, "cursor-home") ?? path30.join(os11.homedir(), ".cursor")
-  );
-  await assertFreshCollectorDirectory(paths, source);
-  const preparedState = await prepareSourceInitialState(
-    source,
-    selectedHome,
-    true
-  );
-  await prepareBackgroundPersistence();
-  const enrollment = await authenticateAndEnrollCollector(
-    endpointUrl,
-    deviceName,
-    organizationId,
-    source
-  );
-  print(
-    mark(
-      terminal,
-      "success",
-      `Signed in to ${terminal.bold(safeWorkspaceName(enrollment.organizationName) ?? "your workspace")}`
-    )
-  );
-  const connection = {
-    endpoint: endpointUrl.toString(),
-    token: enrollment.token,
-    dataDirectory: directory,
-    organizationId: enrollment.organizationId,
-    organizationName: enrollment.organizationName
-  };
-  const config3 = source === "codex" ? { ...connection, codexHome: selectedHome } : source === "claude" ? { ...connection, source: "claude", claudeHome: selectedHome } : { ...connection, source: "cursor", cursorHome: selectedHome };
-  await saveConfig(config3, paths);
-  try {
-    await saveState(preparedState, paths);
-    if (source === "cursor") await installCursorHooks(selectedHome, directory);
-  } catch (error3) {
-    throw new Error(
-      `Collector access was approved, but local setup did not finish. Run iteration start ${source} to repair it.`,
-      { cause: error3 }
-    );
-  }
-  try {
-    await installBackgroundService(directory, source);
-  } catch (error3) {
-    throw new Error(
-      `Collector access was approved, but background startup failed. Run iteration start ${source} to retry it.`,
-      { cause: error3 }
-    );
-  }
-  const turnSummary = await setUpTurnSummary(config3);
-  print(connectedLine(source, await countSavedSessions(source, selectedHome)));
-  return {
-    config: config3,
-    result: { source, endpoint: config3.endpoint, turnSummary }
-  };
-}
-async function approveAllSources(sources, workspaceName, yes) {
-  const safeName = safeWorkspaceName(workspaceName);
-  print(
-    wrap(
-      terminal,
-      sources.length === 0 ? "No saved agent sessions found on this computer" : `Found ${sources.length} coding ${sources.length === 1 ? "agent" : "agents"} on this computer`,
-      { style: terminal.bold }
-    ),
-    ...sources.length === 0 ? [] : [
-      "",
-      rows(
-        terminal,
-        sources.map(({ source, sessions }) => [
-          collectorSourceLabel(source),
-          terminal.dim(
-            `${sessions.toLocaleString("en-US")} saved ${sessions === 1 ? "session" : "sessions"}`
-          )
-        ]),
-        "    "
-      )
-    ],
-    "",
-    wrap(
-      terminal,
-      `Existing sessions and new activity, including prompts, code and tool output, upload to ${safeName ?? "your workspace"}, where its members can read them. Supported agents you install later connect automatically.${process.platform === "linux" ? " Collection continues after you log out." : ""}`
-    ),
-    ""
-  );
-  if (yes) return;
-  if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    throw new Error(
-      "Run iteration connect interactively or pass --yes to approve uploads."
-    );
-  }
-  const answer = await ask(
-    terminal,
-    `${terminal.bold(sources.length === 1 ? "Connect this agent?" : "Connect these agents?")} ${terminal.dim("(y/N)")}`
-  );
-  const approved = answer?.trim().toLowerCase();
-  if (approved !== "y" && approved !== "yes")
-    throw new Error(
-      "No agents were connected. Run iteration connect when you are ready."
-    );
-}
 async function connectAll(values) {
-  requireCollectorPlatform();
-  if (values["data-directory"] !== void 0) {
-    throw new Error(
-      "--data-directory requires a source-specific connect command."
-    );
-  }
-  const configs = await Promise.all(COLLECTOR_SOURCES2.map(connectedConfig));
-  const resolveSourceHomes = () => ({
-    codex: path30.resolve(
-      optionalString(values, "codex-home") ?? (configs[0] && "codexHome" in configs[0] ? configs[0].codexHome : sourceHome("codex"))
-    ),
-    claude: path30.resolve(
-      optionalString(values, "claude-home") ?? (configs[1] && "claudeHome" in configs[1] ? configs[1].claudeHome : sourceHome("claude"))
-    ),
-    cursor: path30.resolve(
-      optionalString(values, "cursor-home") ?? (configs[2] && "cursorHome" in configs[2] ? configs[2].cursorHome : sourceHome("cursor"))
-    )
-  });
-  const sourceHomes = resolveSourceHomes();
-  const detected = await detectedSources(sourceHomes);
-  const existing = COLLECTOR_SOURCES2.flatMap(
-    (source, index) => configs[index] ? [{ source, config: configs[index] }] : []
-  );
-  print(brand(terminal), "");
-  if (detected.length === 0 && existing.length === 0) {
-    print(
-      mark(terminal, "warning", "No supported local coding agents found yet"),
-      wrap(
-        terminal,
-        `Run ${terminal.bold("iteration connect")} after using Codex, Claude Code or Cursor on this computer.`
-      )
-    );
-    return;
-  }
-  const sessions = await Promise.all(
-    detected.map(async (source) => ({
-      source,
-      sessions: await countSavedSessions(source, sourceHomes[source])
-    }))
-  );
-  const anchorSource = existing[0]?.source ?? detected[0];
-  const anchorExisting = existing[0]?.config ?? null;
-  const endpoint = validateCollectorEndpoint(
-    optionalString(values, "endpoint") ?? anchorExisting?.endpoint ?? DEFAULT_INGEST_ENDPOINT
-  ).toString();
-  const existingScopes = await Promise.all(
-    existing.map(async (item) => ({
-      ...item,
-      scope: await readCollectorScope(item.config)
-    }))
-  );
-  const validateWorkspace = () => {
-    for (const item of existingScopes) {
-      if (item.config.endpoint !== endpoint) {
-        throw new Error(
-          "Existing sources use different Iteration servers. Connect one source at a time."
-        );
-      }
-      if (existingScopes[0]?.scope.organizationId !== item.scope.organizationId) {
-        throw new Error(
-          "Existing sources use different workspaces. Connect one source at a time."
-        );
-      }
-    }
-    const requestedOrganizationId2 = optionalString(values, "workspace");
-    if (requestedOrganizationId2 && existingScopes[0] && requestedOrganizationId2 !== existingScopes[0].scope.organizationId) {
-      throw new Error(
-        "The existing collector belongs to a different workspace."
-      );
-    }
-  };
-  validateWorkspace();
-  const requestedOrganizationId = optionalString(values, "workspace");
-  const previousConsent = await loadMachineConsent();
-  const approveConnection = async () => {
-    const needsApproval = () => previousConsent === null || anchorExisting === null || previousConsent.endpoint !== endpoint || previousConsent.anchorSource !== anchorSource || previousConsent.anchorDataDirectory !== anchorExisting.dataDirectory || previousConsent.organizationId !== existingScopes[0]?.scope.organizationId || previousConsent.sourceHomes.codex !== sourceHomes.codex || previousConsent.sourceHomes.claude !== sourceHomes.claude || previousConsent.sourceHomes.cursor !== sourceHomes.cursor;
-    if (needsApproval()) {
-      await approveAllSources(
-        sessions,
-        existingScopes[0]?.scope.organizationName ?? null,
-        values.yes === true
-      );
-    }
-  };
-  await approveConnection();
-  await prepareBackgroundPersistence();
-  const results = [];
-  const initializeAnchor = async () => {
-    const initialized = await initialize(anchorSource, values);
-    results.push(initialized.result);
-    return initialized.config;
-  };
-  let anchor3 = anchorExisting ?? await initializeAnchor();
-  let organizationId = requestedOrganizationId ?? existingScopes[0]?.scope.organizationId ?? anchor3.organizationId ?? null;
-  const connectDetectedSources = async () => {
-    for (const source of detected) {
-      if (source === anchorSource || configs[COLLECTOR_SOURCES2.indexOf(source)] !== null)
-        continue;
-      const paths = collectorPaths(defaultCollectorDirectory(source));
-      await assertFreshCollectorDirectory(paths, source);
-      const state = await prepareSourceInitialState(
-        source,
-        sourceHomes[source],
-        true
-      );
-      const enrollment = await expandSource(anchor3, source, organizationId);
-      const config3 = await activateSource(
-        source,
-        sourceHomes[source],
-        endpoint,
-        enrollment,
-        state
-      );
-      organizationId = enrollment.organizationId;
-      results.push({
-        source,
-        endpoint: config3.endpoint,
-        turnSummary: await setUpTurnSummary(config3)
-      });
-      print(
-        connectedLine(
-          source,
-          sessions.find((item) => item.source === source)?.sessions ?? 0
-        )
-      );
-    }
-  };
-  await connectDetectedSources();
-  if (organizationId === null) {
-    organizationId = (await readCollectorScope(anchor3)).organizationId;
-  }
-  if (anchor3.organizationId === void 0) {
-    anchor3 = { ...anchor3, organizationId };
-    await saveConfig(anchor3, collectorPaths(anchor3.dataDirectory));
-  }
-  await saveMachineConsent({
-    version: 1,
-    endpoint,
-    organizationId,
-    anchorSource,
-    anchorDataDirectory: anchor3.dataDirectory,
-    sourceHomes
-  });
-  for (const item of existing) {
-    await ensureStartableState(
-      item.config,
-      collectorPaths(item.config.dataDirectory)
-    );
-    if ("cursorHome" in item.config)
-      await installCursorHooks(
-        item.config.cursorHome,
-        item.config.dataDirectory
-      );
-    await installBackgroundService(item.config.dataDirectory, item.source);
-    results.push({
-      source: item.source,
-      endpoint: item.config.endpoint,
-      turnSummary: await setUpTurnSummary(item.config)
-    });
-    print(
-      mark(
-        terminal,
-        "success",
-        `${collectorSourceLabel(item.source)} is still connected`
-      )
-    );
-  }
-  print(...connectionSummary2(results, results.length > existing.length));
+  await connectWorkspace(values);
 }
 async function importHistory(source, values) {
   requireCollectorPlatform();
@@ -28505,6 +29682,14 @@ async function runInternalCommand() {
     }
     return true;
   }
+  if (process.argv[2] === "mcp") {
+    if (process.argv.length !== 3) throw new Error("Invalid mcp command.");
+    const configs = await Promise.all(
+      COLLECTOR_SOURCES2.map((source) => connectedConfig(source))
+    );
+    await serveAgentTools(configs.find((config3) => config3 !== null) ?? null);
+    return true;
+  }
   if (process.argv[2] === "turn-summary-hook") {
     const directory = process.argv[3];
     if (!directory || process.argv.length !== 4)
@@ -28606,6 +29791,7 @@ async function disconnect(selectedSource, values) {
     if ("cursorHome" in config3)
       await uninstallCursorHooks(config3.cursorHome, config3.dataDirectory);
     else await uninstallTurnSummary(config3);
+    await uninstallAgentTools(agentHomes(config3));
   }
   print(
     mark(
@@ -28628,9 +29814,7 @@ async function dispatchSourceCommand(command, source, values, selectedSource) {
   };
   validateSourceOptions();
   if (command === "connect" && selectedSource !== null) {
-    print(brand(terminal), "");
-    const { result } = await initialize(selectedSource, values);
-    print(...connectionSummary2([result], true));
+    await connectWorkspace(values, selectedSource);
     return;
   }
   if (command === "run") {