ledung 1.4.0 → 1.5.0

package/dist/main.js

@@ -1,11 +1,11 @@
 // src/main.ts
 import fs38 from "node:fs";
 import os16 from "node:os";
-import path40 from "node:path";
+import path42 from "node:path";
 
 // src/config.ts
 import fs10 from "node:fs";
-import path13 from "node:path";
+import path14 from "node:path";
 import { z as z6 } from "zod";
 
 // src/platform/paths.ts
@@ -494,8 +494,8 @@ async function commentSource(url, ctx) {
   const offline = ctx.offline();
   if (offline) throw new Error(offline);
   const repo = `${link.owner}/${link.name}`;
-  const path41 = link.what === "comment" ? `repos/${repo}/issues/comments/${link.id}` : link.what === "review comment" ? `repos/${repo}/pulls/comments/${link.id}` : `repos/${repo}/pulls/${link.number}/reviews/${link.id}`;
-  const answer = await ctx.ghApi([path41], GH_TIMEOUT_MS);
+  const path43 = link.what === "comment" ? `repos/${repo}/issues/comments/${link.id}` : link.what === "review comment" ? `repos/${repo}/pulls/comments/${link.id}` : `repos/${repo}/pulls/${link.number}/reviews/${link.id}`;
+  const answer = await ctx.ghApi([path43], GH_TIMEOUT_MS);
   if (!answer.ok) throw new Error(`GitHub did not give it: ${ghReason(answer)}`);
   let c;
   try {
@@ -2067,20 +2067,21 @@ var USAGE_REPO = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
 // src/accounts/store.ts
 import fs9 from "node:fs";
 import os5 from "node:os";
-import path12 from "node:path";
+import path13 from "node:path";
 
 // src/accounts/about-file.ts
 import fs8 from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 
 // src/accounts/signin-store.ts
 import { createHash } from "node:crypto";
 import fs7 from "node:fs";
 import os4 from "node:os";
-import path10 from "node:path";
+import path11 from "node:path";
 
 // src/accounts/signin.ts
 import { execFile as execFile2 } from "node:child_process";
+import path10 from "node:path";
 
 // src/runners/claude-program.ts
 import { execFile } from "node:child_process";
@@ -2395,6 +2396,16 @@ async function chooseClaude(setting = "installed", look = realLookup()) {
 }
 
 // src/accounts/signin.ts
+function signInKind(method2, subscriptionType) {
+  if (method2 === "oauth_token") return "token";
+  if (method2 === "api_key") return "key";
+  if (method2 !== "claude.ai") return null;
+  if (subscriptionType === null) return "token";
+  return typeof subscriptionType === "string" && subscriptionType ? "login" : null;
+}
+function shownSignIn(found) {
+  return found?.kind ?? (found?.state === "in" ? "other" : null);
+}
 function readAuthStatus(result) {
   const at2 = Date.now();
   if (result.error) return { state: "unknown", method: null, detail: result.error, checkedAt: at2 };
@@ -2405,6 +2416,12 @@ function readAuthStatus(result) {
   const method2 = typeof parsed.authMethod === "string" && parsed.authMethod !== "none" ? parsed.authMethod : null;
   return parsed.loggedIn ? { state: "in", method: method2, detail: null, checkedAt: at2 } : { state: "out", method: null, detail: null, checkedAt: at2 };
 }
+function readSignIn(result) {
+  const found = readAuthStatus(result);
+  if (found.state !== "in") return found;
+  const said = jsonOf(result.stdout);
+  return { ...found, kind: signInKind(said.authMethod, said.subscriptionType) };
+}
 function jsonOf(text2) {
   try {
     const v = JSON.parse(text2);
@@ -2427,7 +2444,7 @@ async function checkSignIn(env, opts = {}) {
   if (!binary) return { state: "unknown", method: null, detail: "no Claude Code to ask: it is not installed, or too old (see Settings \u2192 Claude Code)", checkedAt: Date.now() };
   const settings = opts.where?.settings && Object.keys(opts.where.settings).length ? ["--settings", JSON.stringify(opts.where.settings)] : [];
   const { command, args } = commandFor(binary);
-  return readAuthStatus(await (opts.run ?? runCommand)(command, [...args, ...settings, "auth", "status", "--json"], env, opts.timeoutMs ?? 15e3, opts.where?.cwd));
+  return readSignIn(await (opts.run ?? runCommand)(command, [...args, ...settings, "auth", "status", "--json"], env, opts.timeoutMs ?? 15e3, opts.where?.cwd));
 }
 function shellFolder(folder) {
   return folder.startsWith("~/") ? `"$HOME/${folder.slice(2)}"` : `'${folder}'`;
@@ -2438,7 +2455,7 @@ function dockerExecArgs(place, interactive = null) {
 async function checkContainerSignIn(place, folder, opts = {}) {
   const script = folder === null ? 'D=$(mktemp -d) || exit 1; CLAUDE_SECURESTORAGE_CONFIG_DIR="$D" env -u ANTHROPIC_API_KEY -u CLAUDE_CODE_OAUTH_TOKEN claude auth status --json; r=$?; rm -rf "$D"; exit $r' : `CLAUDE_SECURESTORAGE_CONFIG_DIR=${shellFolder(folder)} exec env -u ANTHROPIC_API_KEY -u CLAUDE_CODE_OAUTH_TOKEN claude auth status --json`;
   const result = await (opts.run ?? runCommand)("docker", [...dockerExecArgs(place), "sh", "-c", script], process.env, opts.timeoutMs ?? 2e4);
-  return readAuthStatus(result);
+  return readSignIn(result);
 }
 function signInHelp(account, platform = process.platform) {
   if (account.kind === "default") {
@@ -2451,6 +2468,11 @@ function signInHelp(account, platform = process.platform) {
 function signInCommand(dir, platform = process.platform) {
   return platform === "win32" ? `$env:CLAUDE_SECURESTORAGE_CONFIG_DIR="${dir}"; claude` : `CLAUDE_SECURESTORAGE_CONFIG_DIR="${dir}" claude`;
 }
+function tokenCommand(name, how) {
+  const run8 = how.packaged ? "ledung" : `node "${path10.join(how.appDir, "src", "cli.ts")}"`;
+  const data = !how.dataDir ? "" : how.platform === "win32" ? `$env:LEDUNG_DATA_DIR="${how.dataDir}"; ` : `LEDUNG_DATA_DIR="${how.dataDir}" `;
+  return `${data}${run8} account token ${name}`;
+}
 function containerSignInCommand(place, folder) {
   const dir = folder.startsWith("~/") ? `$HOME/${folder.slice(2)}` : folder;
   return `docker ${dockerExecArgs(place, "-it").join(" ")} sh -c 'CLAUDE_SECURESTORAGE_CONFIG_DIR=${dir} exec claude'`;
@@ -2496,7 +2518,14 @@ async function ghApiAnswer(command, args, input, timeoutMs) {
 
 // src/accounts/signin-store.ts
 var CREDENTIALS = ".credentials.json";
-function keychainEntry(folder, user = os4.userInfo().username) {
+function localUser(read = () => os4.userInfo().username) {
+  try {
+    return read();
+  } catch {
+    return process.env.USER ?? process.env.LOGNAME ?? "";
+  }
+}
+function keychainEntry(folder, user = localUser()) {
   return { service: `Claude Code-credentials-${createHash("sha256").update(folder.normalize("NFC")).digest("hex").slice(0, 8)}`, account: user };
 }
 async function removeSignIn(place, platform = process.platform, run8 = runWithInput) {
@@ -2507,7 +2536,7 @@ async function removeSignIn(place, platform = process.platform, run8 = runWithIn
       const { service, account } = keychainEntry(place.folder);
       await run8("security", ["delete-generic-password", "-a", account, "-s", service], null, 2e4);
     } else {
-      fs7.rmSync(path10.join(place.folder, CREDENTIALS), { force: true });
+      fs7.rmSync(path11.join(place.folder, CREDENTIALS), { force: true });
     }
   } catch {
   }
@@ -2541,7 +2570,7 @@ function aboutText(a, platform = process.platform) {
   return lines.join(platform === "win32" ? "\r\n" : "\n") + (platform === "win32" ? "\r\n" : "\n");
 }
 function writeAboutFile(a, platform = process.platform) {
-  const file = path11.join(a.configDir, ABOUT_FILE);
+  const file = path12.join(a.configDir, ABOUT_FILE);
   const text2 = aboutText(a, platform);
   try {
     if (!fs8.statSync(a.configDir).isDirectory()) return false;
@@ -2559,11 +2588,12 @@ var DEFAULT_ACCOUNT = "default";
 var AccountError = class extends Error {
 };
 var SIGN_IN_ENV = "CLAUDE_SECURESTORAGE_CONFIG_DIR";
+var LOGIN_ENV = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", SIGN_IN_ENV];
 function defaultContainerDir(name) {
   return `~/.ledung-accounts/${name}`;
 }
 function canonicalFolder(folder) {
-  return path12.resolve(folder);
+  return path13.resolve(folder);
 }
 function canonicalContainerFolder(folder) {
   const f = folder.trim().replace(/\/+$/, "");
@@ -2576,14 +2606,14 @@ function sameFolder(a, b, platform = process.platform) {
   return platform === "win32" || platform === "darwin" ? x.toLowerCase() === y.toLowerCase() : x === y;
 }
 function sharedLoginFolders() {
-  return [path12.join(os5.homedir(), ".claude"), ...process.env.CLAUDE_CONFIG_DIR ? [process.env.CLAUDE_CONFIG_DIR] : []];
+  return [path13.join(os5.homedir(), ".claude"), ...process.env.CLAUDE_CONFIG_DIR ? [process.env.CLAUDE_CONFIG_DIR] : []];
 }
 var SHARED_CONTAINER_FOLDERS = ["~/.claude"];
 var AccountStore = class {
   db;
   /** Ledung's own accounts folder: the default login folders. */
   dir;
-  constructor(db, dir = path12.join(userDataDir(), "accounts")) {
+  constructor(db, dir = path13.join(userDataDir(), "accounts")) {
     this.db = db;
     this.dir = dir;
   }
@@ -2596,7 +2626,7 @@ var AccountStore = class {
   }
   /** The default login folder on this computer for an account of this name. */
   defaultFolder(name) {
-    return canonicalFolder(path12.join(this.dir, name));
+    return canonicalFolder(path13.join(this.dir, name));
   }
   /** Adds an account: its login folder is made, empty until someone signs in to it. */
   add(a, whatItIsFor) {
@@ -2844,7 +2874,7 @@ function withoutNotes(raw) {
 }
 var ClaudeAccountSetting = z6.preprocess(withoutNotes, z6.object({
   whatItIsFor: z6.string().trim().max(200).optional(),
-  signInFolderOnThisComputer: z6.string().trim().min(1, "give a folder, or leave the field out for Ledung's own").refine((f) => path13.isAbsolute(f), "give the whole path, such as D:\\Claude sign-ins\\work or /Users/you/claude-signins/work").refine((f) => !sharedLoginFolders().some((s) => sameFolder(s, f)), "that is this computer's own Claude Code folder; an account needs a folder of its own").optional(),
+  signInFolderOnThisComputer: z6.string().trim().min(1, "give a folder, or leave the field out for Ledung's own").refine((f) => path14.isAbsolute(f), "give the whole path, such as D:\\Claude sign-ins\\work or /Users/you/claude-signins/work").refine((f) => !sharedLoginFolders().some((s) => sameFolder(s, f)), "that is this computer's own Claude Code folder; an account needs a folder of its own").optional(),
   signInFolderInContainers: z6.string().trim().min(1, "give a folder, or leave the field out for ~/.ledung-accounts/<name>").refine((f) => canonicalContainerFolder(f) !== null, "starts with ~/ or /, of letters, digits and . _ / + - only").refine((f) => canonicalContainerFolder(f) !== "~/.claude", "that is the container user's own Claude Code folder; an account needs a folder of its own").optional()
 }).strict());
 var ClaudeAccountsSetting = z6.preprocess(withoutNotes, z6.record(z6.string(), ClaudeAccountSetting)).default({}).superRefine((accounts, ctx) => {
@@ -2893,7 +2923,7 @@ var LocalProject = z6.object({
    * Folders outside the project folder where its sessions may also work, such as where its git worktrees
    * go (start_session's cwd, decision of 2026-10-14). None: only the project folder and folders inside it.
    */
-  extraFolders: z6.array(z6.string().min(1).refine((f) => path13.isAbsolute(f), "Give each extra folder as a full path.")).max(20).optional(),
+  extraFolders: z6.array(z6.string().min(1).refine((f) => path14.isAbsolute(f), "Give each extra folder as a full path.")).max(20).optional(),
   model: z6.string().optional(),
   /** Its manager's model; none: the same as its sessions (decision of 2026-10-13). */
   managerModel: z6.string().optional(),
@@ -3010,7 +3040,7 @@ var Config = z6.object({
    * One that is missing or older than the SDK needs is never run: sessions are refused and the page says how to fix it
    * (Martin, 2026-10-27). "bundled" only when set here. Containers run their own.
    */
-  claudeExecutable: z6.string().min(1).refine((v) => v === "installed" || v === "bundled" || path13.isAbsolute(v), 'claudeExecutable is "installed", "bundled" or a full path to Claude Code.').default("installed"),
+  claudeExecutable: z6.string().min(1).refine((v) => v === "installed" || v === "bundled" || path14.isAbsolute(v), 'claudeExecutable is "installed", "bundled" or a full path to Claude Code.').default("installed"),
   /** The shell a "!" command from the message box runs in on Windows (issue #212): Git Bash, as Claude's Bash tool, or PowerShell. */
   windowsShell: z6.enum(["bash", "powershell"]).default("bash"),
   board: BoardSetting,
@@ -3043,9 +3073,9 @@ function boardConfig(config) {
 }
 function configPath(packaged = PACKAGED) {
   const set = envSetting("CONFIG");
-  if (set) return path13.resolve(set);
-  if (packaged) return path13.join(userDataDir(), "ledung.config.json");
-  return path13.join(appDir(), "ledung.config.local.json");
+  if (set) return path14.resolve(set);
+  if (packaged) return path14.join(userDataDir(), "ledung.config.json");
+  return path14.join(appDir(), "ledung.config.local.json");
 }
 function parseConfig(raw) {
   const result = Config.safeParse(raw);
@@ -3084,7 +3114,7 @@ var FIRST_CONFIG = {
   port: DEFAULT_PORT2
 };
 function createDefaultConfig(file = configPath()) {
-  fs10.mkdirSync(path13.dirname(file), { recursive: true });
+  fs10.mkdirSync(path14.dirname(file), { recursive: true });
   try {
     fs10.writeFileSync(file, `${JSON.stringify(FIRST_CONFIG, null, 2)}
 `, { flag: "wx" });
@@ -3163,7 +3193,7 @@ function configProblem(text2) {
 
 // src/config-watch.ts
 import fs11 from "node:fs";
-import path14 from "node:path";
+import path15 from "node:path";
 var exercised358 = false;
 var ConfigWatcher = class {
   opts;
@@ -3302,9 +3332,9 @@ function realFile(file) {
     full = fs11.realpathSync.native(file);
   } catch (e) {
     if (e.code !== "ENOENT") throw e;
-    return { dir: fs11.realpathSync.native(path14.dirname(file)), name: path14.basename(file) };
+    return { dir: fs11.realpathSync.native(path15.dirname(file)), name: path15.basename(file) };
   }
-  return { dir: path14.dirname(full), name: path14.basename(full) };
+  return { dir: path15.dirname(full), name: path15.basename(full) };
 }
 
 // src/platform/open-browser.ts
@@ -3336,12 +3366,12 @@ function lanNames(setting) {
 import { execFile as execFile4 } from "node:child_process";
 import fs13 from "node:fs";
 import os7 from "node:os";
-import path16 from "node:path";
+import path17 from "node:path";
 
 // src/server/security.ts
 import crypto3 from "node:crypto";
 import fs12 from "node:fs";
-import path15 from "node:path";
+import path16 from "node:path";
 
 // src/platform/running.ts
 import crypto from "node:crypto";
@@ -3540,7 +3570,7 @@ var Devices = class {
 
 // src/server/security.ts
 var COOKIE_NAME = "ledung_auth";
-function loadOrCreateToken(file = path15.join(userDataDir(), "auth-token")) {
+function loadOrCreateToken(file = path16.join(userDataDir(), "auth-token")) {
   if (fs12.existsSync(file)) {
     const token2 = fs12.readFileSync(file, "utf8").trim();
     if (/^[0-9a-f]{64}$/.test(token2)) return token2;
@@ -3732,18 +3762,18 @@ var LABELS = { desktop: "Desktop", "start-menu": "Start menu", applications: "Ap
 var ENV_FILE = "shortcut.env";
 var LOG_FILE_SETTING = "LEDUNG_LOG_FILE";
 function launchTarget(dataDir = userDataDir(), app = appDir(), packaged = PACKAGED) {
-  const releaseLauncher = path16.join(dataDir, "launcher.mjs");
-  const fromRelease = !path16.relative(path16.join(dataDir, "app"), app).startsWith("..") && fs13.existsSync(releaseLauncher);
-  const script = fromRelease ? releaseLauncher : path16.join(app, packaged ? path16.join("dist", "cli.js") : path16.join("src", "cli.ts"));
+  const releaseLauncher = path17.join(dataDir, "launcher.mjs");
+  const fromRelease = !path17.relative(path17.join(dataDir, "app"), app).startsWith("..") && fs13.existsSync(releaseLauncher);
+  const script = fromRelease ? releaseLauncher : path17.join(app, packaged ? path17.join("dist", "cli.js") : path17.join("src", "cli.ts"));
   const env = {};
   for (const name of ["DATA_DIR", "CONFIG"]) {
     const value = envSetting(name);
-    if (value) env[`LEDUNG_${name}`] = path16.resolve(value);
+    if (value) env[`LEDUNG_${name}`] = path17.resolve(value);
   }
   return Object.keys(env).length ? { node: process.execPath, script, env } : { node: process.execPath, script };
 }
 function startsInBackground(launch) {
-  return path16.basename(launch.script) !== "launcher.mjs";
+  return path17.basename(launch.script) !== "launcher.mjs";
 }
 function envFileText(env) {
   return Object.entries(env).map(([name, value]) => {
@@ -3765,9 +3795,9 @@ function starterText(head, tail2) {
   ].join("\r\n");
 }
 function iconFiles(app = appDir()) {
-  const built = path16.join(app, "web", "dist");
-  const dir = fs13.existsSync(path16.join(built, "icon-256.png")) ? built : path16.join(app, "web", "public");
-  return { png256: path16.join(dir, "icon-256.png"), png512: path16.join(dir, "icon-512.png") };
+  const built = path17.join(app, "web", "dist");
+  const dir = fs13.existsSync(path17.join(built, "icon-256.png")) ? built : path17.join(app, "web", "public");
+  return { png256: path17.join(dir, "icon-256.png"), png512: path17.join(dir, "icon-512.png") };
 }
 function powershell(script, env) {
   return new Promise((resolve, reject) => {
@@ -3783,20 +3813,20 @@ async function windowsFolders() {
   return { desktop, "start-menu": programs, startup };
 }
 function macFolders() {
-  const startup = path16.join(os7.homedir(), "Library", "LaunchAgents");
+  const startup = path17.join(os7.homedir(), "Library", "LaunchAgents");
   try {
     fs13.accessSync("/Applications", fs13.constants.W_OK);
     return { applications: "/Applications", startup };
   } catch {
-    return { applications: path16.join(os7.homedir(), "Applications"), startup };
+    return { applications: path17.join(os7.homedir(), "Applications"), startup };
   }
 }
 function linuxFolders() {
-  return { startup: path16.join(process.env.XDG_CONFIG_HOME ?? path16.join(os7.homedir(), ".config"), "autostart") };
+  return { startup: path17.join(process.env.XDG_CONFIG_HOME ?? path17.join(os7.homedir(), ".config"), "autostart") };
 }
 function ownDataFolders(platform) {
-  const root = path16.join(userDataDir(), "shortcuts");
-  return platform === "win32" ? { desktop: path16.join(root, "Desktop"), "start-menu": path16.join(root, "Start menu"), startup: path16.join(root, "Startup") } : platform === "darwin" ? { applications: path16.join(root, "Applications"), startup: path16.join(root, "LaunchAgents") } : { startup: path16.join(root, "autostart") };
+  const root = path17.join(userDataDir(), "shortcuts");
+  return platform === "win32" ? { desktop: path17.join(root, "Desktop"), "start-menu": path17.join(root, "Start menu"), startup: path17.join(root, "Startup") } : platform === "darwin" ? { applications: path17.join(root, "Applications"), startup: path17.join(root, "LaunchAgents") } : { startup: path17.join(root, "autostart") };
 }
 var shQuote = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
 var winQuote = (s) => `"${s}"`;
@@ -3871,7 +3901,7 @@ var Shortcuts = class {
     return ids.flatMap((id) => {
       const folder = folders[id];
       if (!folder) return [];
-      const file = path16.join(folder, kind === "windows" ? "Ledung.lnk" : "Ledung.app");
+      const file = path17.join(folder, kind === "windows" ? "Ledung.lnk" : "Ledung.app");
       return [{ id, label: LABELS[id], file, present: kind === "windows" ? fs13.existsSync(file) : isOurApp(file) }];
     });
   }
@@ -3880,7 +3910,7 @@ var Shortcuts = class {
     const folder = (await this.folders()).startup;
     if (!folder) return null;
     const kind = this.kind();
-    return path16.join(folder, SIGN_IN_FILES[kind]);
+    return path17.join(folder, SIGN_IN_FILES[kind]);
   }
   async signInView() {
     const label = SIGN_IN_LABELS[this.kind()];
@@ -3891,7 +3921,7 @@ var Shortcuts = class {
   async view() {
     const kind = this.kind();
     const asked = this.opts.meta.get(ASKED_KEY) !== null;
-    const log = { file: this.logFile(), active: envSetting("LOG_FILE") !== void 0 && path16.resolve(envSetting("LOG_FILE")) === path16.resolve(this.logFile()) };
+    const log = { file: this.logFile(), active: envSetting("LOG_FILE") !== void 0 && path17.resolve(envSetting("LOG_FILE")) === path17.resolve(this.logFile()) };
     const signIn = await this.signInView();
     if (kind === "other") {
       return { kind, available: false, reason: "Shortcuts are made on Windows and macOS. Here, start Ledung with ledung.sh or the ledung command.", asked, places: [], signIn, log };
@@ -3918,7 +3948,7 @@ var Shortcuts = class {
       if (this.kind() === "windows") await this.addWindows(places.filter((p) => !p.present));
       else {
         for (const p of places.filter((p2) => !p2.present)) {
-          if (fs13.existsSync(p.file)) throw new Error(`There is already a Ledung.app in ${path16.dirname(p.file)} that Ledung didn't make. Rename or remove it, then add the shortcut again.`);
+          if (fs13.existsSync(p.file)) throw new Error(`There is already a Ledung.app in ${path17.dirname(p.file)} that Ledung didn't make. Rename or remove it, then add the shortcut again.`);
           this.addMac(p.file);
         }
       }
@@ -3931,16 +3961,16 @@ var Shortcuts = class {
     return this.view();
   }
   icoFile() {
-    return path16.join(this.opts.iconDir, "Ledung.ico");
+    return path17.join(this.opts.iconDir, "Ledung.ico");
   }
   envFile() {
-    return path16.join(this.opts.iconDir, ENV_FILE);
+    return path17.join(this.opts.iconDir, ENV_FILE);
   }
   starterFile() {
-    return path16.join(this.opts.iconDir, STARTER_FILE);
+    return path17.join(this.opts.iconDir, STARTER_FILE);
   }
   logFile() {
-    return this.opts.logFile ?? path16.join(this.opts.iconDir, LOG_FILE);
+    return this.opts.logFile ?? path17.join(this.opts.iconDir, LOG_FILE);
   }
   /** The env file and the start script, which the icons and the start at sign-in share. */
   removeShared() {
@@ -3972,11 +4002,11 @@ var Shortcuts = class {
   }
   /** The Windows Script Host that runs the start script with no window, and its arguments. */
   windowsStart(extra) {
-    const wscript = path16.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "wscript.exe");
+    const wscript = path17.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "wscript.exe");
     return { target: wscript, arguments: ["//Nologo", this.starterFile(), ...extra].map(winQuote).join(" ") };
   }
   async writeLinks(files, extra, icon, description) {
-    for (const file of files) fs13.mkdirSync(path16.dirname(file), { recursive: true });
+    for (const file of files) fs13.mkdirSync(path17.dirname(file), { recursive: true });
     const spec = { files, ...this.windowsStart(extra), workdir: os7.homedir(), icon: icon ? `${icon},0` : "", description };
     await powershell([
       "$spec = $env:SHORTCUT_SPEC | ConvertFrom-Json",
@@ -4007,7 +4037,7 @@ var Shortcuts = class {
       return;
     }
     this.writeEnvFile();
-    fs13.mkdirSync(path16.dirname(file), { recursive: true });
+    fs13.mkdirSync(path17.dirname(file), { recursive: true });
     const { node, script } = this.opts.launch;
     const kind = this.kind();
     if (kind === "windows") {
@@ -4037,18 +4067,18 @@ var Shortcuts = class {
    */
   addMac(app) {
     const { node, script } = this.opts.launch;
-    const contents = path16.join(app, "Contents");
-    fs13.mkdirSync(path16.join(contents, "MacOS"), { recursive: true });
-    fs13.mkdirSync(path16.join(contents, "Resources"), { recursive: true });
+    const contents = path17.join(app, "Contents");
+    fs13.mkdirSync(path17.join(contents, "MacOS"), { recursive: true });
+    fs13.mkdirSync(path17.join(contents, "Resources"), { recursive: true });
     let version = "1";
     try {
-      version = String(JSON.parse(fs13.readFileSync(path16.join(appDir(), "package.json"), "utf8")).version ?? "1");
+      version = String(JSON.parse(fs13.readFileSync(path17.join(appDir(), "package.json"), "utf8")).version ?? "1");
     } catch {
     }
-    fs13.writeFileSync(path16.join(contents, "Info.plist"), PLIST(version));
-    fs13.writeFileSync(path16.join(contents, "Resources", "Ledung.icns"), icnsFromPngs([fs13.readFileSync(this.opts.icons.png256), fs13.readFileSync(this.opts.icons.png512)]));
+    fs13.writeFileSync(path17.join(contents, "Info.plist"), PLIST(version));
+    fs13.writeFileSync(path17.join(contents, "Resources", "Ledung.icns"), icnsFromPngs([fs13.readFileSync(this.opts.icons.png256), fs13.readFileSync(this.opts.icons.png512)]));
     const run8 = [...this.nodeOptions(), script].map(shQuote).join(" ");
-    fs13.writeFileSync(path16.join(contents, "MacOS", "Ledung"), [
+    fs13.writeFileSync(path17.join(contents, "MacOS", "Ledung"), [
       "#!/bin/sh",
       "# Opens a running Ledung's page, or starts Ledung in the background. Made by Ledung's Settings (issues #415, #456).",
       ...findNode(node),
@@ -4093,7 +4123,7 @@ function signInScript(node, run8, fallbackShell) {
 }
 function isOurApp(app) {
   try {
-    return fs13.readFileSync(path16.join(app, "Contents", "Info.plist"), "utf8").includes(`<string>${BUNDLE_ID}</string>`);
+    return fs13.readFileSync(path17.join(app, "Contents", "Info.plist"), "utf8").includes(`<string>${BUNDLE_ID}</string>`);
   } catch {
     return false;
   }
@@ -4105,13 +4135,13 @@ import fs32 from "node:fs";
 import http from "node:http";
 import os15 from "node:os";
 import tls3 from "node:tls";
-import path33 from "node:path";
+import path35 from "node:path";
 import { duplexPair } from "node:stream";
 import { WebSocketServer } from "ws";
 
 // src/server/source.ts
 import fs14 from "node:fs";
-import path17 from "node:path";
+import path18 from "node:path";
 
 // src/shared/version.ts
 function displayVersion(version) {
@@ -4154,7 +4184,7 @@ function sourceOffer(o) {
 }
 function readRepository(appDir2) {
   try {
-    return repositoryUrl(JSON.parse(fs14.readFileSync(path17.join(appDir2, "package.json"), "utf8"))) ?? DEFAULT_REPOSITORY;
+    return repositoryUrl(JSON.parse(fs14.readFileSync(path18.join(appDir2, "package.json"), "utf8"))) ?? DEFAULT_REPOSITORY;
   } catch {
     return DEFAULT_REPOSITORY;
   }
@@ -4755,7 +4785,7 @@ ${lines.join("\n")}`;
 // src/sessions/manager.ts
 import fs27 from "node:fs";
 import os14 from "node:os";
-import path28 from "node:path";
+import path29 from "node:path";
 
 // src/sessions/remote-control.ts
 function remoteControlName(role, project, enabled) {
@@ -4828,7 +4858,7 @@ var RemoteControl = class {
 // src/runners/shell-run.ts
 import { spawn as spawn2 } from "node:child_process";
 import fs15 from "node:fs";
-import path18 from "node:path";
+import path19 from "node:path";
 
 // src/platform/process-tree.ts
 import { execFile as execFile5 } from "node:child_process";
@@ -4901,11 +4931,11 @@ function gitBashPath(env = process.env, exists = fs15.existsSync) {
   if (set && exists(set)) return set;
   const dirs = (env.PATH ?? env.Path ?? "").split(";").filter(Boolean);
   for (const dir of dirs) {
-    if (!exists(path18.join(dir, "git.exe"))) continue;
-    for (const bash of [path18.join(dir, "..", "bin", "bash.exe"), path18.join(dir, "bash.exe")]) if (exists(bash)) return path18.resolve(bash);
+    if (!exists(path19.join(dir, "git.exe"))) continue;
+    for (const bash of [path19.join(dir, "..", "bin", "bash.exe"), path19.join(dir, "bash.exe")]) if (exists(bash)) return path19.resolve(bash);
   }
-  for (const root of [env.ProgramFiles, env["ProgramFiles(x86)"], env.LOCALAPPDATA && path18.join(env.LOCALAPPDATA, "Programs")]) {
-    const bash = root && path18.join(root, "Git", "bin", "bash.exe");
+  for (const root of [env.ProgramFiles, env["ProgramFiles(x86)"], env.LOCALAPPDATA && path19.join(env.LOCALAPPDATA, "Programs")]) {
+    const bash = root && path19.join(root, "Git", "bin", "bash.exe");
     if (bash && exists(bash)) return bash;
   }
   return null;
@@ -5060,16 +5090,16 @@ function bangRefusal(project, folder, others) {
 import { execFile as execFile6 } from "node:child_process";
 import fs16 from "node:fs";
 import os8 from "node:os";
-import path19 from "node:path";
+import path20 from "node:path";
 import { promisify as promisify2 } from "node:util";
 var run2 = promisify2(execFile6);
 var BrowseError = class extends Error {
 };
 function defaultRoots(configured) {
-  return (configured?.length ? configured : [os8.homedir()]).map((r) => path19.resolve(r));
+  return (configured?.length ? configured : [os8.homedir()]).map((r) => path20.resolve(r));
 }
 function defaultProjectsFolder(configured) {
-  return path19.resolve(configured ?? path19.join(os8.homedir(), "Projects"));
+  return path20.resolve(configured ?? path20.join(os8.homedir(), "Projects"));
 }
 function real(p) {
   try {
@@ -5084,12 +5114,12 @@ function isInside(folder, roots) {
   return roots.some((r) => {
     const root = real(r);
     if (!root) return false;
-    const rel = path19.relative(root, target);
-    return rel === "" || !rel.startsWith("..") && !path19.isAbsolute(rel);
+    const rel = path20.relative(root, target);
+    return rel === "" || !rel.startsWith("..") && !path20.isAbsolute(rel);
   });
 }
 function gitBranch(folder) {
-  const dotGit = path19.join(folder, ".git");
+  const dotGit = path20.join(folder, ".git");
   let stat;
   try {
     stat = fs16.statSync(dotGit);
@@ -5098,7 +5128,7 @@ function gitBranch(folder) {
   }
   if (!stat.isDirectory()) return "";
   try {
-    const head = fs16.readFileSync(path19.join(dotGit, "HEAD"), "utf8").trim();
+    const head = fs16.readFileSync(path20.join(dotGit, "HEAD"), "utf8").trim();
     return head.startsWith("ref: refs/heads/") ? head.slice("ref: refs/heads/".length) : "";
   } catch {
     return "";
@@ -5106,7 +5136,7 @@ function gitBranch(folder) {
 }
 var sameFolder2 = (a, b) => process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
 function listLocal(folder, roots, projects) {
-  const dir = path19.resolve(folder || roots[0]);
+  const dir = path20.resolve(folder || roots[0]);
   if (!isInside(dir, roots)) throw new BrowseError("That folder is outside the folders Ledung may show.");
   let names;
   try {
@@ -5117,7 +5147,7 @@ function listLocal(folder, roots, projects) {
   const entries = [];
   for (const d of names) {
     if (d.name.startsWith(".") || d.name.startsWith("$")) continue;
-    const full = path19.join(dir, d.name);
+    const full = path20.join(dir, d.name);
     if (d.isSymbolicLink()) {
       if (!isInside(full, roots)) continue;
       try {
@@ -5126,10 +5156,10 @@ function listLocal(folder, roots, projects) {
         continue;
       }
     } else if (!d.isDirectory()) continue;
-    entries.push({ name: d.name, path: full, git: gitBranch(full), project: projects.find((p) => sameFolder2(path19.resolve(p.path), full))?.name ?? null });
+    entries.push({ name: d.name, path: full, git: gitBranch(full), project: projects.find((p) => sameFolder2(path20.resolve(p.path), full))?.name ?? null });
   }
   entries.sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
-  const up = path19.dirname(dir);
+  const up = path20.dirname(dir);
   const isRoot = roots.some((r) => sameFolder2(r, dir));
   return { path: dir, parent: !isRoot && up !== dir && isInside(up, roots) ? up : null, roots, entries };
 }
@@ -5180,7 +5210,7 @@ async function listContainer(container, user, folder, projects) {
   const [dir = "/", ...lines] = out.split("\n").map((l) => l.replace(/\r$/, ""));
   const entries = lines.filter(Boolean).map((l) => {
     const [kind, name = "", branch = ""] = l.split("	");
-    const full = path19.posix.join(dir, name);
+    const full = path20.posix.join(dir, name);
     return {
       name,
       path: full,
@@ -5188,12 +5218,12 @@ async function listContainer(container, user, folder, projects) {
       project: projects.find((p) => p.container === container && p.path === full)?.name ?? null
     };
   });
-  return { path: dir, parent: dir === "/" ? null : path19.posix.dirname(dir), roots: ["/"], entries };
+  return { path: dir, parent: dir === "/" ? null : path20.posix.dirname(dir), roots: ["/"], entries };
 }
 async function createProjectFolder(parent, name, allowed, github) {
-  const parentDir = path19.resolve(parent);
+  const parentDir = path20.resolve(parent);
   if (!isInside(parentDir, allowed)) throw new BrowseError("That folder is outside the folders Ledung may use.");
-  const dir = path19.join(parentDir, name);
+  const dir = path20.join(parentDir, name);
   if (fs16.existsSync(dir)) throw new BrowseError(`There is already a folder named "${name}" there.`);
   fs16.mkdirSync(dir);
   try {
@@ -5221,19 +5251,19 @@ import crypto4 from "node:crypto";
 import { EventEmitter } from "node:events";
 import fs17 from "node:fs";
 import net from "node:net";
-import path20 from "node:path";
+import path21 from "node:path";
 import readline from "node:readline";
 import { PassThrough } from "node:stream";
 function hostsDir() {
-  const dir = path20.join(userDataDir(), "hosts");
+  const dir = path21.join(userDataDir(), "hosts");
   fs17.mkdirSync(dir, { recursive: true });
   return dir;
 }
-var recordFile = (sessionId) => path20.join(hostsDir(), `${sessionId}.json`);
+var recordFile = (sessionId) => path21.join(hostsDir(), `${sessionId}.json`);
 function listHostRecords() {
   return fs17.readdirSync(hostsDir()).filter((f) => f.endsWith(".json")).flatMap((f) => {
     try {
-      return [JSON.parse(fs17.readFileSync(path20.join(hostsDir(), f), "utf8"))];
+      return [JSON.parse(fs17.readFileSync(path21.join(hostsDir(), f), "utf8"))];
     } catch {
       return [];
     }
@@ -5256,7 +5286,7 @@ function startHost(sessionId, launch) {
     sessionId,
     pipe: pipePath(sessionId),
     graceMs: GRACE_MS,
-    logFile: path20.join(hostsDir(), `${sessionId}.log`),
+    logFile: path21.join(hostsDir(), `${sessionId}.log`),
     secret: crypto4.randomBytes(32).toString("hex")
   };
   const file = recordFile(sessionId);
@@ -5851,7 +5881,7 @@ var DockerRunner = class {
 import { execFile as execFile9 } from "node:child_process";
 import fs18 from "node:fs";
 import os9 from "node:os";
-import path21 from "node:path";
+import path22 from "node:path";
 import { promisify as promisify5 } from "node:util";
 async function readStart(file, bytes) {
   try {
@@ -5910,24 +5940,24 @@ var LocalRunner = class {
     return ghApiAnswer("gh", ["api", ...args], input, timeoutMs);
   }
   async pluginSettingsTexts(configDir) {
-    const dir = configDir ?? process.env.CLAUDE_CONFIG_DIR ?? path21.join(os9.homedir(), ".claude");
-    const files = [...PLUGIN_FILES.config.map((f) => path21.join(dir, f)), ...PLUGIN_FILES.project.map((f) => path21.join(this.cwd, f))];
+    const dir = configDir ?? process.env.CLAUDE_CONFIG_DIR ?? path22.join(os9.homedir(), ".claude");
+    const files = [...PLUGIN_FILES.config.map((f) => path22.join(dir, f)), ...PLUGIN_FILES.project.map((f) => path22.join(this.cwd, f))];
     const texts = await Promise.all(files.map((f) => fs18.promises.readFile(f, "utf8").catch(() => null)));
     return texts.filter((t) => t !== null);
   }
   async skillFiles(configDir) {
-    const dir = configDir ?? process.env.CLAUDE_CONFIG_DIR ?? path21.join(os9.homedir(), ".claude");
-    const folders = async (rel) => (await fs18.promises.readdir(path21.join(dir, rel), { withFileTypes: true }).catch(() => [])).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => `${rel}/${e.name}`);
+    const dir = configDir ?? process.env.CLAUDE_CONFIG_DIR ?? path22.join(os9.homedir(), ".claude");
+    const folders = async (rel) => (await fs18.promises.readdir(path22.join(dir, rel), { withFileTypes: true }).catch(() => [])).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => `${rel}/${e.name}`);
     const personal = (await folders("skills")).filter((f) => f !== "skills/synced");
     const synced = (await Promise.all((await folders("skills/synced")).map(folders))).flat();
     const files = await Promise.all([...personal, ...synced].map(async (f) => {
-      const text2 = await readStart(path21.join(dir, f, "SKILL.md"), SKILL_HEAD_BYTES);
+      const text2 = await readStart(path22.join(dir, f, "SKILL.md"), SKILL_HEAD_BYTES);
       return text2 === null ? null : { path: `${f}/SKILL.md`, text: text2 };
     }));
     return files.filter((f) => f !== null);
   }
   async readProjectFile(relative) {
-    return fs18.promises.readFile(path21.join(this.cwd, relative), "utf8").catch(() => null);
+    return fs18.promises.readFile(path22.join(this.cwd, relative), "utf8").catch(() => null);
   }
   async pullRequestView(pr, repo, fields, timeoutMs) {
     try {
@@ -6342,12 +6372,12 @@ function cpuTimes() {
 
 // src/sessions/work-folder.ts
 import fs20 from "node:fs";
-import path22 from "node:path";
+import path23 from "node:path";
 var WorkFolderError = class extends Error {
 };
 function within2(root, real2) {
-  const inside = path22.relative(root, real2);
-  return inside === "" || !inside.startsWith("..") && !path22.isAbsolute(inside);
+  const inside = path23.relative(root, real2);
+  return inside === "" || !inside.startsWith("..") && !path23.isAbsolute(inside);
 }
 function realFolder(folder) {
   try {
@@ -6361,11 +6391,11 @@ function resolveWorkFolder(projectPath, extraRoots, wanted) {
   if (!wanted.trim()) throw new WorkFolderError("No folder given.");
   const project = realFolder(projectPath);
   if (!project) throw new WorkFolderError(`The project folder ${projectPath} does not exist.`);
-  const given = path22.resolve(project, wanted.trim());
+  const given = path23.resolve(project, wanted.trim());
   if (!fs20.existsSync(given)) throw new WorkFolderError(`The folder ${given} does not exist.`);
   const real2 = realFolder(given);
   if (!real2) throw new WorkFolderError(`${given} is not a folder.`);
-  if (within2(project, real2)) return path22.relative(project, real2) === "" ? null : real2;
+  if (within2(project, real2)) return path23.relative(project, real2) === "" ? null : real2;
   for (const root of extraRoots) {
     const realRoot = realFolder(root);
     if (realRoot && within2(realRoot, real2)) return real2;
@@ -6378,7 +6408,7 @@ function resolveWorkFolder(projectPath, extraRoots, wanted) {
 
 // src/sessions/files.ts
 import fs21 from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 var MAX_BYTES2 = 2 * 1024 * 1024;
 var FileError = class extends Error {
 };
@@ -6393,16 +6423,16 @@ function resolveInside(root, link) {
   let real2;
   try {
     realRoot = fs21.realpathSync(root);
-    real2 = fs21.realpathSync(path23.resolve(realRoot, wanted));
+    real2 = fs21.realpathSync(path24.resolve(realRoot, wanted));
   } catch {
     throw new FileError(`There is no file ${wanted} in the project.`);
   }
-  const inside = path23.relative(realRoot, real2);
-  if (!inside || inside.startsWith("..") || path23.isAbsolute(inside)) {
+  const inside = path24.relative(realRoot, real2);
+  if (!inside || inside.startsWith("..") || path24.isAbsolute(inside)) {
     throw new FileError("Only files inside the project folder can be shown.");
   }
   if (fs21.statSync(real2).isDirectory()) throw new FileError(`${inside} is a folder; only files can be shown.`);
-  return { real: real2, inside: inside.split(path23.sep).join("/") };
+  return { real: real2, inside: inside.split(path24.sep).join("/") };
 }
 function hiddenProblem(root, link, roots, refused = []) {
   const { real: typed, inside } = resolveInside(root, link);
@@ -6417,14 +6447,14 @@ function hiddenProblem(root, link, roots, refused = []) {
   for (const folder of refused) {
     const at2 = longName2(folder);
     if (!at2) continue;
-    const rel = path23.relative(at2, real2);
-    if (rel === "" || !rel.startsWith("..") && !path23.isAbsolute(rel)) return `${inside} is not shown: it is inside ${folder}, where settings and sign-ins are kept.`;
+    const rel = path24.relative(at2, real2);
+    if (rel === "" || !rel.startsWith("..") && !path24.isAbsolute(rel)) return `${inside} is not shown: it is inside ${folder}, where settings and sign-ins are kept.`;
   }
   const from = (r) => {
     const at2 = longName2(r);
-    return at2 === null ? null : path23.relative(at2, real2);
+    return at2 === null ? null : path24.relative(at2, real2);
   };
-  const under = roots.map(from).find((rel) => rel !== null && rel !== "" && !rel.startsWith("..") && !path23.isAbsolute(rel));
+  const under = roots.map(from).find((rel) => rel !== null && rel !== "" && !rel.startsWith("..") && !path24.isAbsolute(rel));
   const parts2 = (under ?? from(root) ?? inside).split(/[\\/]/);
   return parts2.some((p) => p.startsWith(".")) ? `${inside} is in a hidden folder or is a hidden file; a chat's file viewer doesn't show those.` : null;
 }
@@ -6469,7 +6499,7 @@ function handoffProblem(root, file, now = Date.now()) {
     throw e;
   }
   if (!found.content.trim()) return `The handoff file ${found.path} is empty; write the handoff first.`;
-  const age = now - fs21.statSync(path23.join(fs21.realpathSync(root), found.path)).mtimeMs;
+  const age = now - fs21.statSync(path24.join(fs21.realpathSync(root), found.path)).mtimeMs;
   if (age > HANDOFF_MAX_AGE_MS) {
     return `The handoff file ${found.path} was last changed ${Math.round(age / 6e4)} minutes ago; write the handoff first (it must be changed within the last hour).`;
   }
@@ -6478,7 +6508,7 @@ function handoffProblem(root, file, now = Date.now()) {
 
 // src/sessions/tree.ts
 import fs22 from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 
 // src/sessions/git-read.ts
 import { spawn as spawn5 } from "node:child_process";
@@ -6560,18 +6590,18 @@ function longName(p) {
   }
 }
 function within3(root, real2) {
-  const rel = path24.relative(root, real2);
-  return rel === "" || !rel.startsWith("..") && !path24.isAbsolute(rel) ? rel : null;
+  const rel = path25.relative(root, real2);
+  return rel === "" || !rel.startsWith("..") && !path25.isAbsolute(rel) ? rel : null;
 }
 function problem(realRoot, real2, rules, refused) {
   const inside = within3(realRoot, real2);
   if (inside === null) return "Only folders inside the session's folder can be listed.";
-  if (inside.split(path24.sep).some(hiddenName)) return "Hidden folders and files (names starting with . or $) are not listed.";
+  if (inside.split(path25.sep).some(hiddenName)) return "Hidden folders and files (names starting with . or $) are not listed.";
   if (refused.some((r) => within3(r, real2) !== null)) return "Folders where settings and sign-ins are kept are not listed.";
   for (const r of rules.hiddenFrom) {
     const at2 = longName(r);
     const rel = at2 === null ? null : within3(at2, real2);
-    if (rel && rel.split(path24.sep).some(hiddenName)) return "Hidden folders and files (names starting with . or $) are not listed.";
+    if (rel && rel.split(path25.sep).some(hiddenName)) return "Hidden folders and files (names starting with . or $) are not listed.";
   }
   return null;
 }
@@ -6579,9 +6609,9 @@ async function listTree(root, rel, rules) {
   const realRoot = longName(root);
   if (!realRoot) throw new FileError(`The folder ${root} does not exist.`);
   const refused = rules.refused.map(longName).filter((r) => r !== null);
-  if (path24.isAbsolute(rel) && /[^\\/]/.test(rel) && within3(realRoot, longName(rel) ?? path24.resolve(rel)) === null) throw new FileError("Only folders inside the session's folder can be listed.");
+  if (path25.isAbsolute(rel) && /[^\\/]/.test(rel) && within3(realRoot, longName(rel) ?? path25.resolve(rel)) === null) throw new FileError("Only folders inside the session's folder can be listed.");
   const wanted = rel.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
-  const real2 = longName(path24.resolve(realRoot, wanted));
+  const real2 = longName(path25.resolve(realRoot, wanted));
   if (!real2) throw new FileError(`There is no folder ${wanted} in the session's folder.`);
   const why = problem(realRoot, real2, rules, refused);
   if (why) throw new FileError(why);
@@ -6592,11 +6622,11 @@ async function listTree(root, rel, rules) {
   } catch (e) {
     throw new FileError(`Can't read that folder: ${e.code ?? e.message}`);
   }
-  const at2 = within3(realRoot, real2).split(path24.sep).filter(Boolean).join("/");
+  const at2 = within3(realRoot, real2).split(path25.sep).filter(Boolean).join("/");
   const entries = [];
   for (const d of dirents) {
     if (hiddenName(d.name)) continue;
-    const full = path24.join(real2, d.name);
+    const full = path25.join(real2, d.name);
     let dir;
     let size = null;
     const target = d.isSymbolicLink() ? longName(full) : full;
@@ -6745,15 +6775,15 @@ function checkLineComments(value) {
   for (const [i, c] of value.entries()) {
     const bad = (what) => ({ problem: `Line comment ${i + 1}: ${what}.` });
     if (!c || typeof c !== "object") return bad("not a comment");
-    const { path: path41, line, side, lineText, commit, body } = c;
-    if (typeof path41 !== "string" || !path41.trim() || path41.length > 500 || /[\r\n]/.test(path41)) return bad("the file is missing");
+    const { path: path43, line, side, lineText, commit, body } = c;
+    if (typeof path43 !== "string" || !path43.trim() || path43.length > 500 || /[\r\n]/.test(path43)) return bad("the file is missing");
     if (typeof line !== "number" || !Number.isInteger(line) || line < 1) return bad("the line number is missing");
     if (side !== "new" && side !== "old") return bad('the side is "new" or "old"');
     if (typeof lineText !== "string") return bad("the line's text is missing");
     if (typeof commit !== "string" || !/^[0-9a-f]{7,64}$/.test(commit)) return bad("the commit is missing");
     if (typeof body !== "string" || !body.trim()) return bad("it is empty");
     if (body.length > MAX_BODY) return bad(`it is longer than ${MAX_BODY} characters`);
-    comments.push({ path: path41, line, side, lineText: lineText.slice(0, 2e3), commit, body: body.trim() });
+    comments.push({ path: path43, line, side, lineText: lineText.slice(0, 2e3), commit, body: body.trim() });
   }
   return { comments };
 }
@@ -7254,15 +7284,15 @@ ${note.trim()}` : "");
       return about?.shots && this.store.getSession(about.sessionId)?.parentId === sessionId ? about.shots : null;
     }
     return shots.map((s, i) => {
-      let path41;
+      let path43;
       try {
-        path41 = this.ctx.shotPath(sessionId, s.file.trim().replace(/\\/g, "/"));
+        path43 = this.ctx.shotPath(sessionId, s.file.trim().replace(/\\/g, "/"));
       } catch (e) {
         throw new ManagementError(`Screenshot ${i + 1} (${s.file}) can't be attached: ${e.message} Nothing was asked.`);
       }
       const clean = (t) => t?.trim() || null;
       return {
-        path: path41,
+        path: path43,
         // One line: the group heads the strip and its shots' lines in the answer.
         group: clean(s.group && oneLine(s.group)) ?? "Screenshots",
         lookFor: s.look_for.trim(),
@@ -8835,7 +8865,6 @@ var InputQueue = class {
     }
   }
 };
-var LOGIN_ENV = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_SECURESTORAGE_CONFIG_DIR"];
 function claudeEnvironment(base, accountEnv, ledungInstructions) {
   const env = {};
   for (const [k, v] of Object.entries(base)) if (v !== void 0 && !(accountEnv && LOGIN_ENV.includes(k))) env[k] = v;
@@ -10094,7 +10123,7 @@ function unaskedTool(toolName, alwaysAsked) {
 // src/board/attachments.ts
 import crypto5 from "node:crypto";
 import fs24 from "node:fs";
-import path25 from "node:path";
+import path26 from "node:path";
 var MAX_ATTACHMENTS = 5;
 var MAX_IMAGE_BYTES2 = 5 * 1024 * 1024;
 var MAX_TEXT_BYTES = 512 * 1024;
@@ -10111,7 +10140,7 @@ function newPostKey() {
   return crypto5.randomBytes(6).toString("hex");
 }
 function safeName(name) {
-  const base = path25.basename(name.replace(/\\/g, "/")).replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[.-]+/, "");
+  const base = path26.basename(name.replace(/\\/g, "/")).replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[.-]+/, "");
   return (base || "file").slice(-80);
 }
 function evidencePath(threadId, postKey, n, kind) {
@@ -10163,7 +10192,7 @@ function readEvidence(root, link) {
 function outboxFile(cacheDir, repo, key, n, kind) {
   if (!/^[0-9a-f]{12}$/.test(key) || !Number.isInteger(n) || n < 1 || n > MAX_ATTACHMENTS) throw new FileError("Not a held attachment.");
   const rel = `outbox/${key}-${n}.${EXT[kind]}`;
-  return { file: path25.join(repoCacheDir(cacheDir, repo), ...rel.split("/")), rel };
+  return { file: path26.join(repoCacheDir(cacheDir, repo), ...rel.split("/")), rel };
 }
 function contentProblem(ref, bytes) {
   if (bytes.length !== ref.size) return `its size is ${bytes.length} bytes, not the ${ref.size} the post says`;
@@ -10176,17 +10205,17 @@ function contentProblem(ref, bytes) {
 function repoCacheDir(cacheDir, repo) {
   const parts2 = repo.split("/");
   if (parts2.length !== 2 || parts2.some((p) => !/^[A-Za-z0-9_.-]+$/.test(p) || /^\.+$/.test(p))) throw new FileError(`"${repo}" is not a board repo.`);
-  return path25.join(cacheDir, parts2[0], parts2[1]);
+  return path26.join(cacheDir, parts2[0], parts2[1]);
 }
 function cacheFile(cacheDir, repo, threadId, postId, n, kind) {
   if (!THREAD_ID.test(threadId)) throw new FileError(`"${threadId}" is not a thread id.`);
   const post2 = postId.replace(/[^A-Za-z0-9]+/g, "-").slice(0, 60);
   if (!post2 || !Number.isInteger(n) || n < 1 || n > MAX_ATTACHMENTS) throw new FileError("Not an attachment of a post.");
   const rel = `${threadId}/${post2}-${n}.${EXT[kind]}`;
-  return { file: path25.join(repoCacheDir(cacheDir, repo), ...rel.split("/")), rel };
+  return { file: path26.join(repoCacheDir(cacheDir, repo), ...rel.split("/")), rel };
 }
 function writeCache(file, bytes) {
-  fs24.mkdirSync(path25.dirname(file), { recursive: true });
+  fs24.mkdirSync(path26.dirname(file), { recursive: true });
   const tmp = `${file}.${process.pid}.tmp`;
   fs24.writeFileSync(tmp, bytes);
   fs24.renameSync(tmp, file);
@@ -10292,7 +10321,7 @@ function sensitiveInText(text2, rules) {
 
 // src/board/board.ts
 import fs25 from "node:fs";
-import path26 from "node:path";
+import path27 from "node:path";
 
 // src/board/store.ts
 var unsentId = (repoPath) => `unsent-${repoPath}`;
@@ -10958,7 +10987,7 @@ ${fenced(p.text)}${this.attachmentText(p.id)}`;
       if (a.kind !== "text") return `- ${what}: to show it to ${this.ctx.userName}, give ask_user's screenshots file "${this.boardFile(a.cacheFile)}", or in a review its evidence file.`;
       let content = "";
       try {
-        content = fs25.readFileSync(path26.join(repoCacheDir(this.ctx.cacheDir, this.repo), ...a.cacheFile.split("/")), "utf8");
+        content = fs25.readFileSync(path27.join(repoCacheDir(this.ctx.cacheDir, this.repo), ...a.cacheFile.split("/")), "utf8");
       } catch {
       }
       const cut2 = content.length > TEXT_INLINE_CHARS ? `${content.slice(0, TEXT_INLINE_CHARS)}
@@ -11023,7 +11052,7 @@ ${lines.join("\n")}`;
       if (!a.snapshot || !a.kind || !this.ctx.cacheDir) throw new BoardError("access", "it was held without a copy of its files; nothing was sent. Post again to ask anew.");
       let bytes;
       try {
-        bytes = fs25.readFileSync(path26.join(repoCacheDir(this.ctx.cacheDir, this.repo), ...a.snapshot.split("/")));
+        bytes = fs25.readFileSync(path27.join(repoCacheDir(this.ctx.cacheDir, this.repo), ...a.snapshot.split("/")));
       } catch {
         throw new BoardError("access", `the copy of ${a.file} ${this.ctx.userName} was shown is gone; nothing was sent. Post again to ask anew.`);
       }
@@ -11041,7 +11070,7 @@ ${lines.join("\n")}`;
     for (const a of item.attachments) {
       if (!a.snapshot) continue;
       try {
-        fs25.rmSync(path26.join(repoCacheDir(this.ctx.cacheDir, this.repo), ...a.snapshot.split("/")), { force: true });
+        fs25.rmSync(path27.join(repoCacheDir(this.ctx.cacheDir, this.repo), ...a.snapshot.split("/")), { force: true });
       } catch (e) {
         console.error(`Board: could not remove ${a.snapshot} from the cache: ${e.message}`);
       }
@@ -11123,7 +11152,7 @@ ${lines.join("\n")}`;
         let bytes = null;
         if (same) {
           try {
-            bytes = fs25.readFileSync(path26.join(repoCacheDir(this.ctx.cacheDir, this.repo), ...same.split("/")));
+            bytes = fs25.readFileSync(path27.join(repoCacheDir(this.ctx.cacheDir, this.repo), ...same.split("/")));
           } catch {
           }
         }
@@ -11153,7 +11182,7 @@ ${lines.join("\n")}`;
     for (const a of due) {
       if (a.cacheFile && this.ctx.cacheDir && !this.store.cacheFileInUse(a.cacheFile)) {
         try {
-          fs25.rmSync(path26.join(repoCacheDir(this.ctx.cacheDir, this.repo), ...a.cacheFile.split("/")), { force: true });
+          fs25.rmSync(path27.join(repoCacheDir(this.ctx.cacheDir, this.repo), ...a.cacheFile.split("/")), { force: true });
         } catch (e) {
           console.error(`Board: could not remove ${a.cacheFile} from the cache: ${e.message}`);
         }
@@ -11803,7 +11832,7 @@ var MacroList = z8.array(z8.object({
 
 // src/sessions/workflow-profiles.ts
 import fs26 from "node:fs";
-import path27 from "node:path";
+import path28 from "node:path";
 import { z as z9 } from "zod";
 var WorkflowProfilesFile = z9.preprocess(withoutComments, z9.object({
   version: z9.literal(1, { message: "version must be 1" }),
@@ -11829,7 +11858,7 @@ function settingsKeyProblem(profiles) {
   return null;
 }
 function profilesFilePath(workflow) {
-  return workflow.profilesFile ? path27.resolve(workflow.folder, workflow.profilesFile) : null;
+  return workflow.profilesFile ? path28.resolve(workflow.folder, workflow.profilesFile) : null;
 }
 function parseWorkflowProfiles(file, text2) {
   if (text2 === null) return { file, problem: `The workflow's profiles file ${file} was not found.` };
@@ -12404,7 +12433,7 @@ var SessionManager = class _SessionManager {
     if (!info) return "No such session.";
     const project = this.configOf(info);
     if (project.runner !== "local") {
-      return path28.isAbsolute(file) || file.split("/").includes("..") ? "Give the handoff file relative to the project folder, inside it." : null;
+      return path29.isAbsolute(file) || file.split("/").includes("..") ? "Give the handoff file relative to the project folder, inside it." : null;
     }
     return handoffProblem(info.workDir ?? project.path, file);
   }
@@ -12784,11 +12813,13 @@ var SessionManager = class _SessionManager {
   accountsEvent() {
     const raw = this.store.getMeta(_SessionManager.IDENTITY_KEY);
     const inFile = this.config.claudeAccounts;
-    const accounts = this.accounts.list().map((a) => inFile[a.name] ? { ...a, inConfigFile: true, whatItIsFor: inFile[a.name].whatItIsFor ?? null } : a);
+    const accounts = this.accounts.list().map((a) => this.accountView(inFile[a.name] ? { ...a, inConfigFile: true, whatItIsFor: inFile[a.name].whatItIsFor ?? null } : a));
+    const identity = raw ? JSON.parse(raw) : null;
+    const defaultKind = shownSignIn(this.signIns.get(DEFAULT_ACCOUNT));
     return {
       type: "accounts",
       accounts,
-      defaultIdentity: raw ? JSON.parse(raw) : null,
+      defaultIdentity: defaultKind ? { email: null, organization: null, plan: null, seenAt: null, ...identity, signInKind: defaultKind } : identity,
       choices: this.accountChoices(),
       signedOut: this.signedOut(),
       claudeProblem: this.claudeProblem,
@@ -12796,6 +12827,16 @@ var SessionManager = class _SessionManager {
       configFileProblems: this.accountFileProblems
     };
   }
+  /** An account as the page shows it: how it is signed in (from the last check) and the commands to sign it in (#85). */
+  accountView(a) {
+    const data = envSetting("DATA_DIR");
+    return {
+      ...a,
+      signInKind: shownSignIn(this.signIns.get(a.name)),
+      loginCommand: signInCommand(a.configDir),
+      tokenCommand: tokenCommand(a.name, { packaged: PACKAGED, appDir: appDir(), dataDir: data ? path29.resolve(data) : void 0, platform: process.platform })
+    };
+  }
   /** What the config file's accounts block asked that couldn't be done, from its last read (issue #425). */
   accountFileProblems = [];
   /**
@@ -12896,7 +12937,7 @@ var SessionManager = class _SessionManager {
     const found = await Promise.all(places.map((p) => this.checkPlace(p)));
     const out = places.filter((_, i) => found[i].state === "out");
     const state = out.length ? "out" : found.some((f) => f.state === "unknown") ? "unknown" : "in";
-    const combined = { state, method: found.find((f) => f.method)?.method ?? null, detail: found.find((f) => f.detail)?.detail ?? null, checkedAt: Date.now() };
+    const combined = { state, method: found.find((f) => f.method)?.method ?? null, kind: found.find((f) => f.kind)?.kind ?? null, detail: found.find((f) => f.detail)?.detail ?? null, checkedAt: Date.now() };
     this.signIns.set(name, { ...combined, help: out.map((p) => this.placeHelp(name, p)).join(" ") });
     return combined;
   }
@@ -12987,7 +13028,7 @@ var SessionManager = class _SessionManager {
       const added = this.accounts.add(a);
       this.publishAccounts();
       void this.checkSignIns([added.name]);
-      return added;
+      return this.accountView(added);
     } catch (e) {
       throw e instanceof AccountError ? new UserError(e.message) : e;
     }
@@ -13039,12 +13080,12 @@ var SessionManager = class _SessionManager {
    */
   workflowCheck(folder, projectConfig2, name) {
     if (folder) {
-      folder = path28.resolve(folder);
+      folder = path29.resolve(folder);
       if (!isInside(folder, this.allowedFolders())) throw new UserError("That folder is outside the folders Ledung may use.");
     }
     const mayLook = (file) => {
       let at2 = file;
-      while (!fs27.existsSync(at2) && path28.dirname(at2) !== at2) at2 = path28.dirname(at2);
+      while (!fs27.existsSync(at2) && path29.dirname(at2) !== at2) at2 = path29.dirname(at2);
       return isInside(at2, this.allowedFolders());
     };
     const workflows = workflowsOf(this.config);
@@ -13058,7 +13099,7 @@ var SessionManager = class _SessionManager {
     const local = this.projectStore.list().flatMap((p) => p.config.runner === "local" ? [{ name: p.config.name, path: p.config.path }] : []);
     const roots = defaultRoots(this.config.browseRoots);
     const projects = this.projectsFolder;
-    const starts = fs27.existsSync(projects) && !roots.some((r) => path28.resolve(r) === projects) ? [...roots, projects] : roots;
+    const starts = fs27.existsSync(projects) && !roots.some((r) => path29.resolve(r) === projects) ? [...roots, projects] : roots;
     try {
       return { ...listLocal(folder, this.allowedFolders().filter((f) => fs27.existsSync(f)), local), roots: starts };
     } catch (e) {
@@ -13086,10 +13127,10 @@ var SessionManager = class _SessionManager {
    * GitHub repository; then the project, and its manager started with the task, if one is given.
    */
   async createProject(opts) {
-    const parent = path28.resolve(opts.parent || this.projectsFolder);
+    const parent = path29.resolve(opts.parent || this.projectsFolder);
     let settings;
     try {
-      settings = parseProject({ ...withSuggestedSensitive(opts.settings), runner: "local", path: path28.join(parent, String(opts.settings.name ?? "")) });
+      settings = parseProject({ ...withSuggestedSensitive(opts.settings), runner: "local", path: path29.join(parent, String(opts.settings.name ?? "")) });
     } catch (e) {
       throw new UserError(e.message);
     }
@@ -13110,7 +13151,7 @@ var SessionManager = class _SessionManager {
   /** Adds an existing project; its manager is started when first needed (decided 2026-10-11). */
   addProject(config) {
     if (config?.runner === "local") {
-      const folder = path28.resolve(String(config.path ?? ""));
+      const folder = path29.resolve(String(config.path ?? ""));
       if (!fs27.existsSync(folder) || !fs27.statSync(folder).isDirectory()) throw new UserError("That folder doesn't exist.");
       if (!isInside(folder, this.allowedFolders())) throw new UserError("That folder is outside the folders Ledung may use.");
       config = { ...config, path: folder };
@@ -13377,7 +13418,7 @@ var SessionManager = class _SessionManager {
   chats() {
     const c = this.config.chats;
     return {
-      folder: path28.resolve(c.folder ?? os14.homedir()),
+      folder: path29.resolve(c.folder ?? os14.homedir()),
       permissionMode: c.permissionMode,
       sensitive: this.chatsSensitive(),
       fromConfig: { commandPatterns: c.sensitive.commandPatterns, pathPatterns: c.sensitive.pathPatterns, mcpTools: c.sensitive.mcpTools },
@@ -13455,7 +13496,7 @@ var SessionManager = class _SessionManager {
    * start and on every resume, so a link changed or a project locked since can't move it.
    */
   chatFolder(wanted) {
-    const given = path28.resolve(this.chats().folder, wanted?.trim() || ".");
+    const given = path29.resolve(this.chats().folder, wanted?.trim() || ".");
     let real2;
     try {
       real2 = fs27.realpathSync(given);
@@ -13547,7 +13588,7 @@ var SessionManager = class _SessionManager {
   checkWorkDir(project, info) {
     if (!info.workDir) return;
     const again = info.project === CHATS ? this.chatFolder(info.workDir) : this.workFolder(project, info.workDir);
-    if (again === null || path28.relative(again, info.workDir) !== "") {
+    if (again === null || path29.relative(again, info.workDir) !== "") {
       throw new UserError(`The session's folder ${info.workDir} no longer leads to the same folder; start a new session.`);
     }
   }
@@ -13703,7 +13744,7 @@ ${firstMessage}`);
     if (info.project === CHATS) return start;
     const call = this.store.lastToolCall(info.id, ["EnterWorktree", "ExitWorktree"]);
     if (!call || call.name !== "EnterWorktree" || call.isError) return start;
-    const given = typeof call.input.path === "string" && call.input.path ? path28.resolve(start, call.input.path) : /worktree at (.+?) on branch /.exec(call.result ?? "")?.[1] ?? (typeof call.input.name === "string" ? path28.join(start, ".claude", "worktrees", call.input.name) : null);
+    const given = typeof call.input.path === "string" && call.input.path ? path29.resolve(start, call.input.path) : /worktree at (.+?) on branch /.exec(call.result ?? "")?.[1] ?? (typeof call.input.name === "string" ? path29.join(start, ".claude", "worktrees", call.input.name) : null);
     if (!given) return start;
     try {
       return resolveWorkFolder(project.path, project.extraFolders ?? [], given) ?? project.path;
@@ -13713,7 +13754,7 @@ ${firstMessage}`);
   }
   /** The folders a chat's file viewer and tree never show from (Martin, question #317). */
   settingsFolders() {
-    return [path28.join(os14.homedir(), "AppData"), path28.join(os14.homedir(), "Library"), userDataDir()];
+    return [path29.join(os14.homedir(), "AppData"), path29.join(os14.homedir(), "Library"), userDataDir()];
   }
   /** The folders the Files pane offers: where the session works, and the project folder when that is another one. */
   paneFolders(sessionId) {
@@ -13722,7 +13763,7 @@ ${firstMessage}`);
     const folders = [{ key: "session", path: own, label: info.project === CHATS ? "This chat's folder" : "This session's folder" }];
     const same = (a, b) => {
       try {
-        return path28.relative(fs27.realpathSync(a), fs27.realpathSync(b)) === "";
+        return path29.relative(fs27.realpathSync(a), fs27.realpathSync(b)) === "";
       } catch {
         return a === b;
       }
@@ -13790,7 +13831,7 @@ ${firstMessage}`);
         const hidden = hiddenProblem(root, link, this.allowedFolders(), this.settingsFolders());
         if (hidden) throw new UserError(hidden);
       }
-      if (folder && this.lockedFoldersBesides(info.project).some((f) => within(f, path28.resolve(root, decodeURIComponent(link.replace(/[?#].*$/, "")))))) {
+      if (folder && this.lockedFoldersBesides(info.project).some((f) => within(f, path29.resolve(root, decodeURIComponent(link.replace(/[?#].*$/, "")))))) {
         throw new UserError("That file is in a locked project's folder.");
       }
       return read(root, link);
@@ -14268,7 +14309,7 @@ function challengeIn(res) {
 // src/server/push.ts
 import crypto7 from "node:crypto";
 import fs28 from "node:fs";
-import path29 from "node:path";
+import path30 from "node:path";
 
 // src/shared/waiting.ts
 var questionWaits = (q) => q.status === "open" && q.addressedTo === "user";
@@ -14326,7 +14367,7 @@ function loadOrCreateVapid(file) {
   const { privateKey } = crypto7.generateKeyPairSync("ec", { namedCurve: "P-256" });
   const jwk = privateKey.export({ format: "jwk" });
   const publicKey = b64(Buffer.concat([Buffer.from([4]), unb64(jwk.x), unb64(jwk.y)]));
-  fs28.mkdirSync(path29.dirname(file), { recursive: true, mode: 448 });
+  fs28.mkdirSync(path30.dirname(file), { recursive: true, mode: 448 });
   fs28.writeFileSync(file, JSON.stringify({ publicKey, privateKey: privateKey.export({ format: "pem", type: "pkcs8" }) }), { mode: 384 });
   return { publicKey, privateKey };
 }
@@ -14485,7 +14526,7 @@ var Push = class {
 // src/update/updater.ts
 import { spawn as spawn6 } from "node:child_process";
 import fs29 from "node:fs";
-import path30 from "node:path";
+import path31 from "node:path";
 var BRANCH = "main";
 var TAIL_LINES = 15;
 var MAX_CHANGES = 50;
@@ -14498,7 +14539,7 @@ var PACKAGE = "ledung";
 var CHANNEL_KEY = "update-channel";
 var devCheckTraced = false;
 function readRunningRelease(appDir2) {
-  const own = readJson(path30.join(appDir2, "release.json"));
+  const own = readJson(path31.join(appDir2, "release.json"));
   if (own && typeof own.source === "string") {
     return { source: own.source, commit: typeof own.commit === "string" ? own.commit : null, releasedAt: str2(own.releasedAt) };
   }
@@ -14672,7 +14713,7 @@ ${r.tail}`);
   }
   async compare(running) {
     const src = running.source;
-    if (!fs29.existsSync(path30.join(src, ".git"))) throw new Error(`The source folder ${src} is not a git clone.`);
+    if (!fs29.existsSync(path31.join(src, ".git"))) throw new Error(`The source folder ${src} is not a git clone.`);
     const fetched = await this.run({ cmd: "git", args: ["fetch", "origin", BRANCH] }, src);
     if (fetched.code !== 0) throw new Error(`git fetch origin ${BRANCH} failed:
 ${fetched.tail}`);
@@ -14755,7 +14796,7 @@ ${fetched.tail}`);
   }
   /** Why the source folder can't be updated: changes, another branch, or main has gone its own way. */
   async precheck(src) {
-    if (!fs29.existsSync(path30.join(src, ".git"))) return { reason: `The source folder ${src} is not a git clone.` };
+    if (!fs29.existsSync(path31.join(src, ".git"))) return { reason: `The source folder ${src} is not a git clone.` };
     const status = await this.run({ cmd: "git", args: ["status", "--porcelain", "--untracked-files=no"] }, src);
     if (status.code !== 0) return { reason: "git status failed in the source folder.", output: status.tail };
     if (status.out.trim()) {
@@ -14864,7 +14905,7 @@ function typicalCosts(turns) {
 // src/server/tunnel-tls.ts
 import crypto8 from "node:crypto";
 import fs30 from "node:fs";
-import path31 from "node:path";
+import path32 from "node:path";
 import tls from "node:tls";
 var TLS_KEY = "tls.key";
 var TLS_CERT = "tls.crt";
@@ -14878,8 +14919,8 @@ var CertificateFiles = class {
   }
   /** What changed since the last call: nothing, gone, unusable, or a new key and certificate to use. */
   check() {
-    const keyFile = path31.join(this.dir, TLS_KEY);
-    const certFile = path31.join(this.dir, TLS_CERT);
+    const keyFile = path32.join(this.dir, TLS_KEY);
+    const certFile = path32.join(this.dir, TLS_CERT);
     let stamp;
     try {
       stamp = [fs30.statSync(keyFile), fs30.statSync(certFile)].map((s) => `${s.size}:${s.mtimeMs}`).join("|");
@@ -15046,22 +15087,56 @@ function protocols(body) {
 
 // src/platform/open-folder.ts
 import { spawn as spawn7 } from "node:child_process";
+import path33 from "node:path";
+var STILL_RUNNING_MS = 3e3;
+var MAX_REASON = 500;
 function openFolderCommand(folder, platform = process.platform) {
-  return platform === "win32" ? ["explorer.exe", [folder]] : platform === "darwin" ? ["open", [folder]] : ["xdg-open", [folder]];
+  return platform === "win32" ? ["explorer.exe", [path33.win32.normalize(folder)]] : platform === "darwin" ? ["open", [folder]] : ["xdg-open", [folder]];
 }
-function openFolder(folder) {
-  const [command, args] = openFolderCommand(folder);
-  const child = spawn7(command, args, { stdio: "ignore", detached: true, windowsHide: true });
-  child.on("error", () => {
+function openRun(platform = process.platform) {
+  return { exitCodeCounts: platform !== "win32", windowsHide: false, stillRunningMs: STILL_RUNNING_MS };
+}
+function runOpener(command, args, run8) {
+  return new Promise((resolve, reject) => {
+    const child = spawn7(command, args, { stdio: ["ignore", "ignore", "pipe"], detached: true, windowsHide: run8.windowsHide });
+    let stderr = "";
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (text2) => {
+      if (stderr.length < MAX_REASON) stderr += text2;
+    });
+    const settled = () => {
+      clearTimeout(timer);
+      child.stderr.unref();
+      child.unref();
+    };
+    const timer = setTimeout(() => {
+      settled();
+      resolve();
+    }, run8.stillRunningMs);
+    child.on("error", (e) => {
+      settled();
+      reject(e);
+    });
+    child.on("close", (code, signal) => {
+      settled();
+      if (!run8.exitCodeCounts || code === 0) resolve();
+      else reject(new Error(stderr.trim().slice(0, MAX_REASON) || `${command} stopped with ${code ?? signal}`));
+    });
   });
-  child.unref();
+}
+var exercised = false;
+async function openFolder(folder) {
+  const [command, args] = openFolderCommand(folder);
+  await runOpener(command, args, openRun());
+  if (!exercised) exercisedLine(`EXERCISED #83 ${command} was waited for and opened the folder`);
+  exercised = true;
 }
 
 // src/remote/linked.ts
 import crypto9 from "node:crypto";
 import fs31 from "node:fs";
 import https from "node:https";
-import path32 from "node:path";
+import path34 from "node:path";
 import tls2 from "node:tls";
 var LINKS_FILE = "links.json";
 var LINK_CODE_MS = 10 * 60 * 1e3;
@@ -15120,7 +15195,7 @@ var LinkedComputers = class {
   pending = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.opts = opts;
-    this.file = path32.join(opts.dir, LINKS_FILE);
+    this.file = path34.join(opts.dir, LINKS_FILE);
     this.now = opts.now ?? Date.now;
   }
   list() {
@@ -15270,7 +15345,7 @@ var LinkedComputers = class {
     }
   }
   write(links) {
-    fs31.mkdirSync(path32.dirname(this.file), { recursive: true });
+    fs31.mkdirSync(path34.dirname(this.file), { recursive: true });
     const temp = `${this.file}.${process.pid}.new`;
     fs31.writeFileSync(temp, JSON.stringify({ links }, null, 2), { mode: 384 });
     fs31.renameSync(temp, this.file);
@@ -15423,7 +15498,7 @@ var LedungServer = class {
     this.push?.seed(opts.manager.questions(), opts.store.pendingPermissions());
     this.guard = new Guard(opts.token, opts.port, opts.lanNames ?? [], opts.lanOpen ?? false);
     this.headers = {};
-    this.webRoot = opts.webRoot ?? path33.join(appDir(), "web", "dist");
+    this.webRoot = opts.webRoot ?? path35.join(appDir(), "web", "dist");
     this.setPublicName(opts.publicName ?? null, opts.tunnelTls ?? null);
     opts.manager.setSettings(this.settingsPort());
   }
@@ -15752,7 +15827,7 @@ Connection: close\r
       packaged: PACKAGED,
       version: appVersion(),
       release: PACKAGED ? null : readRunningRelease(appDir()),
-      build: path33.basename(appDir())
+      build: path35.basename(appDir())
     });
     return this.sourceCache;
   }
@@ -15762,7 +15837,7 @@ Connection: close\r
     return {
       type: "hello",
       // A release is named by its folder; the npm package's folder never changes, so by its version (#105).
-      build: PACKAGED ? `ledung@${appVersion()}` : path33.basename(appDir()),
+      build: PACKAGED ? `ledung@${appVersion()}` : path35.basename(appDir()),
       canRestart: !!this.opts.onRestart,
       source: this.source(),
       userName: manager.userName,
@@ -16215,6 +16290,14 @@ Connection: close\r
   requirePageForManager(req, sessionId) {
     if (sessionId && this.opts.store.getSession(sessionId)?.role === "manager") this.requireOpenPage(req);
   }
+  /** Says why, with the folder so it can be opened by hand; the page shows it (issue #83). */
+  async openAccountFolder(folder) {
+    try {
+      await (this.opts.openFolder ?? openFolder)(folder);
+    } catch (e) {
+      throw new UserError(`Couldn't open ${folder}: ${e.message}`);
+    }
+  }
   /** Paired devices are managed only on this computer: a device can't pair others or list them. */
   requireLocal(req, what = "Devices are managed") {
     if (this.guard.isPublic(req)) throw new HttpError(403, `${what} in Settings on the computer Ledung runs on.`);
@@ -16477,7 +16560,7 @@ Connection: close\r
       case "POST accounts/:id/open-folder":
         this.requireLocal(req, "Folders are opened");
         await this.requirePage(req, url);
-        (this.opts.openFolder ?? openFolder)(manager.accountFolder(decodeURIComponent(id)));
+        await this.openAccountFolder(manager.accountFolder(decodeURIComponent(id)));
         return { ok: true };
       case "POST accounts/:id/remove":
         return await manager.removeAccount(decodeURIComponent(id));
@@ -16947,19 +17030,19 @@ Connection: close\r
     return this.opts.updater;
   }
   serveStatic(pathname, res, signedIn, remote) {
-    const root = path33.resolve(this.webRoot);
-    let file = path33.resolve(root, "." + decodeURIComponent(pathname));
-    if (!file.startsWith(root + path33.sep) && file !== root) throw new HttpError(404, "Not found.");
+    const root = path35.resolve(this.webRoot);
+    let file = path35.resolve(root, "." + decodeURIComponent(pathname));
+    if (!file.startsWith(root + path35.sep) && file !== root) throw new HttpError(404, "Not found.");
     if (!fs32.existsSync(file) || fs32.statSync(file).isDirectory()) {
       if (!signedIn) {
         res.writeHead(401, { ...this.headersFor(res), "Content-Type": "text/html; charset=utf-8" });
         res.end(`<!doctype html><title>Ledung</title><div style="font-family:sans-serif;max-width:30em;margin:2em auto"><p>${remote ? NOT_PAIRED : "Not signed in. Open Ledung through the link it prints when it starts."}</p>${remote ? PAIR_CODE_FORM : ""}</div>`);
         return;
       }
-      file = path33.join(root, "index.html");
+      file = path35.join(root, "index.html");
       if (!fs32.existsSync(file)) throw new HttpError(500, 'The page has not been built. Run "npm run build".');
     }
-    const type = CONTENT_TYPES[path33.extname(file).toLowerCase()] ?? "application/octet-stream";
+    const type = CONTENT_TYPES[path35.extname(file).toLowerCase()] ?? "application/octet-stream";
     res.writeHead(200, { ...this.headersFor(res), "Content-Type": type });
     fs32.createReadStream(file).pipe(res);
   }
@@ -17059,7 +17142,7 @@ async function adminCall(fn) {
 }
 
 // src/store/database.ts
-import path34 from "node:path";
+import path36 from "node:path";
 import { DatabaseSync } from "node:sqlite";
 var DAILY_COLUMNS = ["at", "account", "machine", "model", "project", "role", "trigger", "input", "cache_write", "cache_read", "output", "thinking", "cost", "subagent"];
 var dailyDay = (r) => `date(${r}.at / 1000, 'unixepoch', 'localtime')`;
@@ -17632,7 +17715,7 @@ var MIGRATIONS = [
   `
 ];
 function databaseFile(dir = userDataDir()) {
-  return path34.join(dir, "ledung.db");
+  return path36.join(dir, "ledung.db");
 }
 function openDatabase(file = databaseFile()) {
   const db = new DatabaseSync(file);
@@ -17687,7 +17770,7 @@ function quietTexts(entries) {
 
 // src/store/trim.ts
 import fs33 from "node:fs";
-import path35 from "node:path";
+import path37 from "node:path";
 var RESULT_LIMIT = 64 * 1024;
 var OLD_RESULT_LIMIT = 2e3;
 var DAY2 = 24 * 60 * 60 * 1e3;
@@ -17903,7 +17986,7 @@ function diskFreeFor(db) {
   const main2 = db.prepare("PRAGMA database_list").all().find((d) => d.name === "main");
   if (!main2?.file) return null;
   try {
-    const s = fs33.statfsSync(path35.dirname(main2.file));
+    const s = fs33.statfsSync(path37.dirname(main2.file));
     return Number(s.bavail) * Number(s.bsize);
   } catch {
     return null;
@@ -18666,9 +18749,9 @@ var GitHubBackend = class {
     this.now = opts.now ?? Date.now;
   }
   /** A call to GitHub; conditional (If-None-Match) when `conditional`, answering a 304 from what was kept. */
-  async call(method2, path41, body, conditional = false, accept = "application/vnd.github+json") {
+  async call(method2, path43, body, conditional = false, accept = "application/vnd.github+json") {
     if (!this.tokenValue) this.tokenValue = await this.token();
-    const url = path41.startsWith("http") ? path41 : `${API}${path41}`;
+    const url = path43.startsWith("http") ? path43 : `${API}${path43}`;
     const kept = conditional ? this.etags.get(url) : void 0;
     const headers = {
       authorization: `Bearer ${this.tokenValue}`,
@@ -18767,10 +18850,10 @@ var GitHubBackend = class {
     };
   }
   /** All pages of a list, following Link: rel="next"; every page conditional. Fresh: anything changed. */
-  async list(path41) {
+  async list(path43) {
     const items = [];
     let fresh = false;
-    let next = path41;
+    let next = path43;
     for (let page = 0; next && page < 20; page++) {
       const r = await this.call("GET", next, void 0, true);
       fresh ||= r.fresh;
@@ -18927,8 +19010,8 @@ ${lines.join("\n")}`;
     for (const f of files.slice(1)) entries.push({ path: f.path, sha: (await blob(f.bytes)).body.sha });
     await this.replaceEvidence(entries, message2);
   }
-  async getFile(path41) {
-    const url = `/repos/${this.repo}/contents/${path41.split("/").map(encodeURIComponent).join("/")}?ref=${EVIDENCE_BRANCH}`;
+  async getFile(path43) {
+    const url = `/repos/${this.repo}/contents/${path43.split("/").map(encodeURIComponent).join("/")}?ref=${EVIDENCE_BRANCH}`;
     let body;
     try {
       body = (await this.call("GET", url, void 0, false, RAW)).body;
@@ -18936,11 +19019,11 @@ ${lines.join("\n")}`;
       if (e instanceof BoardError && e.kind === "access") throw new BoardError("access", "it is not on the board (pruned, or never uploaded)");
       throw e;
     }
-    if (!Buffer.isBuffer(body)) throw new BoardError("unreachable", `GitHub did not send the file ${path41}.`);
+    if (!Buffer.isBuffer(body)) throw new BoardError("unreachable", `GitHub did not send the file ${path43}.`);
     return body;
   }
   async deleteFiles(paths, message2) {
-    if (paths.length) await this.replaceEvidence(paths.map((path41) => ({ path: path41, sha: null })), message2);
+    if (paths.length) await this.replaceEvidence(paths.map((path43) => ({ path: path43, sha: null })), message2);
   }
   /**
    * People for the allowlist picker (decision 5): the repo's collaborators with name and picture (needs
@@ -18993,14 +19076,14 @@ var GitHubRepos = class _GitHubRepos {
     this.token = opts.token ?? ghToken;
     this.now = opts.now ?? Date.now;
   }
-  async call(method2, path41, body) {
+  async call(method2, path43, body) {
     if (!this.tokenValue) this.tokenValue = await this.token().catch(() => {
       throw new BoardError("signin", SIGN_IN2);
     });
     const headers = { authorization: `Bearer ${this.tokenValue}`, accept: "application/vnd.github+json", "x-github-api-version": "2022-11-28", "user-agent": "Ledung" };
     let res;
     try {
-      res = await this.http(method2, path41.startsWith("http") ? path41 : `${API2}${path41}`, headers, body);
+      res = await this.http(method2, path43.startsWith("http") ? path43 : `${API2}${path43}`, headers, body);
     } catch (e) {
       throw new BoardError("unreachable", `GitHub could not be reached: ${e.message}`);
     }
@@ -19062,8 +19145,8 @@ var GitHubRepos = class _GitHubRepos {
     const owners = await this.owners();
     const found = owners.find((o) => o.login.toLowerCase() === owner.toLowerCase());
     if (!found) throw new BoardError("access", `You can't create repositories under "${owner}": it is neither your account nor an organisation you belong to.`);
-    const path41 = found.kind === "user" ? "/user/repos" : `/orgs/${encodeURIComponent(found.login)}/repos`;
-    const res = await this.call("POST", path41, { name, private: true, description: "Message board for Ledung managers" });
+    const path43 = found.kind === "user" ? "/user/repos" : `/orgs/${encodeURIComponent(found.login)}/repos`;
+    const res = await this.call("POST", path43, { name, private: true, description: "Message board for Ledung managers" });
     if (res.status === 422) {
       const why = _GitHubRepos.message(res.body);
       if (/already exists|name already/i.test(why)) throw new BoardError("access", `${found.login}/${name} already exists. Pick another name, or choose it from the list.`);
@@ -19083,7 +19166,7 @@ var GitHubRepos = class _GitHubRepos {
 // src/usage/queries.ts
 var DAY3 = 24 * 60 * 60 * 1e3;
 var tokensOf = (r) => r.input + r.cache_write + r.cache_read + r.output;
-var exercised = false;
+var exercised2 = false;
 function push(groups, key, r) {
   const list2 = groups.get(key);
   if (!list2) {
@@ -19091,8 +19174,8 @@ function push(groups, key, r) {
     return;
   }
   list2.push(r);
-  if (!exercised) {
-    exercised = true;
+  if (!exercised2) {
+    exercised2 = true;
     exercisedLine("EXERCISED #356 usage report grouped calls in place");
   }
 }
@@ -19318,7 +19401,7 @@ var UsageQueries = class {
 // src/usage/publisher.ts
 import crypto12 from "node:crypto";
 import fs34 from "node:fs";
-import path36 from "node:path";
+import path38 from "node:path";
 
 // src/usage/publish-file.ts
 import crypto11 from "node:crypto";
@@ -19464,14 +19547,14 @@ var UsageRepo = class {
     this.http = opts.http ?? fetchHttp;
     this.token = opts.token ?? ghToken;
   }
-  async call(method2, path41, body, extra = {}) {
+  async call(method2, path43, body, extra = {}) {
     if (!this.tokenValue) this.tokenValue = await this.token().catch(() => {
       throw new BoardError("signin", SIGN_IN3);
     });
     const headers = { authorization: `Bearer ${this.tokenValue}`, accept: "application/vnd.github+json", "x-github-api-version": "2022-11-28", "user-agent": "Ledung", ...extra };
     let res;
     try {
-      res = await this.http(method2, `${API3}${path41}`, headers, body);
+      res = await this.http(method2, `${API3}${path43}`, headers, body);
     } catch (e) {
       throw new BoardError("unreachable", `GitHub could not be reached: ${e.message}`);
     }
@@ -19489,8 +19572,8 @@ var UsageRepo = class {
     if (res.status === 403 || res.status === 404) return new BoardError("access", `GitHub refused ${what}: ${this.repo} is missing, or the login can't write to it${why ? ` (${why})` : ""}.`);
     return new BoardError("unreachable", `GitHub answered ${res.status} for ${what}${why ? ` (${why})` : ""}.`);
   }
-  async ok(what, method2, path41, body) {
-    const res = await this.call(method2, path41, body);
+  async ok(what, method2, path43, body) {
+    const res = await this.call(method2, path43, body);
     if (res.status < 200 || res.status >= 300) throw this.failure(what, res);
     return res.body;
   }
@@ -19672,7 +19755,7 @@ var UsagePublisher = class {
   }
   // --- The usage key ---------------------------------------------------------------------------------------
   keyFile() {
-    return path36.join(this.opts.keyDir, USAGE_KEY_FILE);
+    return path38.join(this.opts.keyDir, USAGE_KEY_FILE);
   }
   /** The usage key, or null when this computer has none yet. */
   key() {
@@ -20105,13 +20188,13 @@ function originOf(folder) {
 
 // src/remote/link.ts
 import fs36 from "node:fs";
-import path38 from "node:path";
+import path40 from "node:path";
 
 // src/server/acme.ts
 import crypto13 from "node:crypto";
 import dns from "node:dns";
 import fs35 from "node:fs";
-import path37 from "node:path";
+import path39 from "node:path";
 import acme from "acme-client";
 var ACCOUNT_KEY = "acme-account.key";
 var ACME_STATE = "acme.json";
@@ -20342,8 +20425,8 @@ var CertificateManager = class {
     const chain = Buffer.from(await client.getCertificate(finalized));
     const problem2 = certificateProblem({ key, cert: chain }, name);
     if (problem2) throw new Error(problem2);
-    writePrivate(path37.join(this.opts.dir, TLS_KEY), key);
-    writePrivate(path37.join(this.opts.dir, TLS_CERT), chain);
+    writePrivate(path39.join(this.opts.dir, TLS_KEY), key);
+    writePrivate(path39.join(this.opts.dir, TLS_CERT), chain);
     this.save({ issuedBy: this.opts.directoryUrl });
   }
   /** The certificate in remoteDir() if it can serve the name, has not run out and is this directory's; null otherwise. */
@@ -20351,7 +20434,7 @@ var CertificateManager = class {
     const issuedBy = this.saved().issuedBy;
     if (issuedBy !== null && issuedBy !== this.opts.directoryUrl) return null;
     try {
-      const files = { key: fs35.readFileSync(path37.join(this.opts.dir, TLS_KEY)), cert: fs35.readFileSync(path37.join(this.opts.dir, TLS_CERT)) };
+      const files = { key: fs35.readFileSync(path39.join(this.opts.dir, TLS_KEY)), cert: fs35.readFileSync(path39.join(this.opts.dir, TLS_CERT)) };
       if (certificateProblem(files, this.opts.publicName)) return null;
       const life = lifetime(files.cert);
       return this.now() < life.validUntil ? life : null;
@@ -20373,20 +20456,20 @@ var CertificateManager = class {
 function readSaved(dir) {
   const empty = { accounts: {}, issuedBy: null, failures: 0, nextTry: null, error: null };
   try {
-    const raw = JSON.parse(fs35.readFileSync(path37.join(dir, ACME_STATE), "utf8"));
+    const raw = JSON.parse(fs35.readFileSync(path39.join(dir, ACME_STATE), "utf8"));
     return { ...empty, ...raw, accounts: { ...raw.accounts } };
   } catch {
     return empty;
   }
 }
 function writeSaved(dir, change) {
-  writePrivate(path37.join(dir, ACME_STATE), Buffer.from(JSON.stringify({ ...readSaved(dir), ...change }, null, 2)));
+  writePrivate(path39.join(dir, ACME_STATE), Buffer.from(JSON.stringify({ ...readSaved(dir), ...change }, null, 2)));
 }
 function saveAccount(dir, directoryUrl, accountUrl) {
   writeSaved(dir, { accounts: { ...readSaved(dir).accounts, [directoryUrl]: accountUrl } });
 }
 async function acmeAccount(opts) {
-  const keyFile = path37.join(opts.dir, ACCOUNT_KEY);
+  const keyFile = path39.join(opts.dir, ACCOUNT_KEY);
   let key;
   try {
     key = fs35.readFileSync(keyFile);
@@ -20902,11 +20985,11 @@ var RemoteLink = class {
     return { name: answer.name, host: answer.host };
   }
   savedFile() {
-    return path38.join(this.opts.dir, SAVED_REMOTE);
+    return path40.join(this.opts.dir, SAVED_REMOTE);
   }
 };
 function savedRemote(dir, log = (line) => console.log(line)) {
-  const file = path38.join(dir, SAVED_REMOTE);
+  const file = path40.join(dir, SAVED_REMOTE);
   try {
     return parseRemote(JSON.parse(fs36.readFileSync(file, "utf8")));
   } catch (e) {
@@ -20923,7 +21006,7 @@ function writePrivate2(file, data) {
 // src/remote/admin.ts
 import crypto15 from "node:crypto";
 import fs37 from "node:fs";
-import path39 from "node:path";
+import path41 from "node:path";
 
 // src/remote/cloudflare.ts
 var API4 = "https://api.cloudflare.com/client/v4";
@@ -20959,10 +21042,10 @@ var Cloudflare = class {
     }
     throw new Error(`The Cloudflare token reaches no zone holding ${name}.`);
   }
-  async call(method2, path41, body) {
+  async call(method2, path43, body) {
     let res;
     try {
-      res = await this.fetch(`${API4}${path41}`, {
+      res = await this.fetch(`${API4}${path43}`, {
         method: method2,
         headers: { Authorization: `Bearer ${this.token}`, ...body ? { "Content-Type": "application/json" } : {} },
         body: body ? JSON.stringify(body) : void 0,
@@ -21155,7 +21238,7 @@ var RelayAdmin = class {
     return answer;
   }
   file() {
-    return path39.join(this.opts.dir, ADMIN_FILE);
+    return path41.join(this.opts.dir, ADMIN_FILE);
   }
   saved() {
     try {
@@ -21204,7 +21287,7 @@ async function main() {
   let watcher = null;
   const manager = new SessionManager(config, store, (event) => server?.broadcast(event));
   const pollMs = boardConfig(config).pollSeconds * 1e3;
-  manager.attachBoards((repo) => new GitHubBackend({ repo, pollMs }), new GitHubRepos(), path40.join(userDataDir(), "board-cache"));
+  manager.attachBoards((repo) => new GitHubBackend({ repo, pollMs }), new GitHubRepos(), path42.join(userDataDir(), "board-cache"));
   const attached = await manager.attachRunningHosts();
   const leftover = store.markUnfinishedSessionsEnded("Ledung stopped before this session ended. Resume to continue.", attached);
   manager.away.begin();
@@ -21278,7 +21361,7 @@ async function main() {
     computerSettings: config.computers,
     linkConnect: config.remote?.linkVia ? connectVia(config.remote.linkVia) : void 0,
     // The VAPID keys stay on this computer, next to the relay's (issue #246).
-    push: { keyFile: path40.join(remoteDir(), "push-vapid.json") }
+    push: { keyFile: path42.join(remoteDir(), "push-vapid.json") }
   });
   link = new RemoteLink({ server, dir: remoteDir(), configured: config.remote, joinAcme: config.relayJoin });
   server.attachRemote(link);