maesttro 0.4.4 → 0.6.0

package/dist/maesttro.js

@@ -1,16 +1,146 @@
 #!/usr/bin/env node
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+
+// ../node_modules/.bun/sisteransi@1.0.5/node_modules/sisteransi/src/index.js
+var require_src = __commonJS(function(exports, module) {
+  var ESC = "\x1B";
+  var CSI = `${ESC}[`;
+  var beep = "\x07";
+  var cursor = {
+    to(x, y) {
+      if (!y)
+        return `${CSI}${x + 1}G`;
+      return `${CSI}${y + 1};${x + 1}H`;
+    },
+    move(x, y) {
+      let ret = "";
+      if (x < 0)
+        ret += `${CSI}${-x}D`;
+      else if (x > 0)
+        ret += `${CSI}${x}C`;
+      if (y < 0)
+        ret += `${CSI}${-y}A`;
+      else if (y > 0)
+        ret += `${CSI}${y}B`;
+      return ret;
+    },
+    up: (count = 1) => `${CSI}${count}A`,
+    down: (count = 1) => `${CSI}${count}B`,
+    forward: (count = 1) => `${CSI}${count}C`,
+    backward: (count = 1) => `${CSI}${count}D`,
+    nextLine: (count = 1) => `${CSI}E`.repeat(count),
+    prevLine: (count = 1) => `${CSI}F`.repeat(count),
+    left: `${CSI}G`,
+    hide: `${CSI}?25l`,
+    show: `${CSI}?25h`,
+    save: `${ESC}7`,
+    restore: `${ESC}8`
+  };
+  var scroll = {
+    up: (count = 1) => `${CSI}S`.repeat(count),
+    down: (count = 1) => `${CSI}T`.repeat(count)
+  };
+  var erase = {
+    screen: `${CSI}2J`,
+    up: (count = 1) => `${CSI}1J`.repeat(count),
+    down: (count = 1) => `${CSI}J`.repeat(count),
+    line: `${CSI}2K`,
+    lineEnd: `${CSI}K`,
+    lineStart: `${CSI}1K`,
+    lines(count) {
+      let clear = "";
+      for (let i = 0;i < count; i++)
+        clear += this.line + (i < count - 1 ? cursor.up() : "");
+      if (count)
+        clear += cursor.left;
+      return clear;
+    }
+  };
+  module.exports = { cursor, scroll, erase, beep };
+});
 
 // src/credential-store.ts
 import {
   chmodSync,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  rmSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { dirname, join as join2 } from "node:path";
+
+// src/maesttro-home.ts
+import {
+  appendFileSync,
   mkdirSync,
   readFileSync,
   renameSync,
-  rmSync,
   writeFileSync
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
+function maesttroHome() {
+  return process.env.MAESTTRO_HOME ?? join(homedir(), ".config", "maesttro");
+}
+function configPath() {
+  return join(maesttroHome(), "config.json");
+}
+function readMaesttroConfig() {
+  try {
+    return JSON.parse(readFileSync(configPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeMaesttroConfig(config) {
+  mkdirSync(maesttroHome(), { recursive: true, mode: 448 });
+  const temporary = `${configPath()}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(config, null, 2)}
+`);
+  renameSync(temporary, configPath());
+}
+function fileSessionLog(path = join(maesttroHome(), "maesttro.log")) {
+  return (event, detail) => {
+    try {
+      mkdirSync(maesttroHome(), { recursive: true, mode: 448 });
+      appendFileSync(path, `${new Date().toISOString()} ${event}${detail ? ` ${detail}` : ""}
+`);
+    } catch {}
+  };
+}
 
 // src/run-command.ts
 import { spawnSync } from "node:child_process";
@@ -31,20 +161,30 @@ function commandExists(run, command) {
 
 // src/credential-store.ts
 var SERVICE = "maesttro";
-var ACCOUNT = "github";
-function encode(token) {
-  return Buffer.from(JSON.stringify(token)).toString("base64");
+var GITHUB_CODEC = {
+  account: "github",
+  accepts: (value) => typeof value?.access_token === "string"
+};
+function encode(value) {
+  return Buffer.from(JSON.stringify(value)).toString("base64");
 }
-function decode(encoded) {
-  try {
-    const token = JSON.parse(Buffer.from(encoded.trim(), "base64").toString("utf8"));
-    return typeof token.access_token === "string" ? token : undefined;
-  } catch {
-    return;
-  }
+function decoderFor(codec) {
+  return (encoded) => {
+    try {
+      const value = JSON.parse(Buffer.from(encoded.trim(), "base64").toString("utf8"));
+      return codec.accepts(value) ? value : undefined;
+    } catch {
+      return;
+    }
+  };
 }
-function keychainStore(run = runCommand) {
-  const identity = ["-s", SERVICE, "-a", ACCOUNT];
+function defaultFilePath(account) {
+  const name = account === "github" ? "credentials.json" : `credentials-${account}.json`;
+  return join2(maesttroHome(), name);
+}
+function keychainStore(run = runCommand, codec = GITHUB_CODEC) {
+  const identity = ["-s", SERVICE, "-a", codec.account];
+  const decode = decoderFor(codec);
   return {
     kind: "macOS keychain",
     load: () => {
@@ -55,8 +195,8 @@ function keychainStore(run = runCommand) {
       ]);
       return result.status === 0 ? decode(result.stdout) : undefined;
     },
-    save: (token) => {
-      const command = `add-generic-password -U ${identity.join(" ")} -w ${encode(token)}
+    save: (value) => {
+      const command = `add-generic-password -U ${identity.join(" ")} -w ${encode(value)}
 `;
       const result = run("security", ["-i"], command);
       if (result.status !== 0)
@@ -67,61 +207,1328 @@ function keychainStore(run = runCommand) {
     }
   };
 }
-function secretToolStore(run = runCommand) {
-  const attributes = ["service", SERVICE, "account", ACCOUNT];
+function secretToolStore(run = runCommand, codec = GITHUB_CODEC) {
+  const attributes = ["service", SERVICE, "account", codec.account];
+  const decode = decoderFor(codec);
+  return {
+    kind: "Secret Service (secret-tool)",
+    load: () => {
+      const result = run("secret-tool", ["lookup", ...attributes]);
+      return result.status === 0 ? decode(result.stdout) : undefined;
+    },
+    save: (value) => {
+      const result = run("secret-tool", ["store", `--label=${SERVICE}`, ...attributes], encode(value));
+      if (result.status !== 0) {
+        throw new Error("Could not write to the Secret Service");
+      }
+    },
+    clear: () => {
+      run("secret-tool", ["clear", ...attributes]);
+    }
+  };
+}
+function fileStore(path, codec = GITHUB_CODEC) {
+  const resolvedPath = path ?? defaultFilePath(codec.account);
+  const decode = decoderFor(codec);
+  return {
+    kind: `file (${resolvedPath})`,
+    load: () => {
+      try {
+        return decode(readFileSync2(resolvedPath, "utf8"));
+      } catch {
+        return;
+      }
+    },
+    save: (value) => {
+      mkdirSync2(dirname(resolvedPath), { recursive: true, mode: 448 });
+      const temporary = `${resolvedPath}.tmp`;
+      writeFileSync2(temporary, encode(value), { mode: 384 });
+      chmodSync(temporary, 384);
+      renameSync2(temporary, resolvedPath);
+    },
+    clear: () => {
+      rmSync(resolvedPath, { force: true });
+    }
+  };
+}
+function selectCredentialStore({
+  platform = process.platform,
+  env = process.env,
+  run = runCommand,
+  codec = GITHUB_CODEC
+} = {}) {
+  if (env.MAESTTRO_CREDENTIAL_STORE === "file")
+    return fileStore(undefined, codec);
+  if (platform === "darwin")
+    return keychainStore(run, codec);
+  if (platform === "linux" && commandExists(run, "secret-tool")) {
+    return secretToolStore(run, codec);
+  }
+  return fileStore(undefined, codec);
+}
+
+// src/claude-credentials.ts
+function oauthOf(value) {
+  const oauth = value?.claudeAiOauth;
+  return oauth && typeof oauth === "object" ? oauth : undefined;
+}
+function nonEmpty(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isClaudeCredentials(value) {
+  const oauth = oauthOf(value);
+  return oauth !== undefined && nonEmpty(oauth.accessToken) && typeof oauth.expiresAt === "number" && oauth.expiresAt > 0;
+}
+function isMasterLogin(value) {
+  return isClaudeCredentials(value) && nonEmpty(oauthOf(value)?.refreshToken);
+}
+function carriesRefreshToken(value) {
+  return nonEmpty(oauthOf(value)?.refreshToken);
+}
+function isBlankedLogin(value) {
+  const oauth = oauthOf(value);
+  if (!oauth)
+    return false;
+  return oauth.accessToken === "" || oauth.refreshToken === "" || typeof oauth.expiresAt === "number" && oauth.expiresAt <= 0;
+}
+function withoutRefreshToken(credentials) {
+  const { refreshToken: _, ...oauth } = credentials.claudeAiOauth;
+  return { claudeAiOauth: oauth };
+}
+function markedExpired({
+  credentials,
+  now
+}) {
+  return {
+    claudeAiOauth: { ...credentials.claudeAiOauth, expiresAt: now - 60000 }
+  };
+}
+function acceptRefreshed({
+  previous,
+  candidate,
+  now
+}) {
+  if (!isMasterLogin(candidate))
+    return;
+  if (candidate.claudeAiOauth.expiresAt <= now)
+    return;
+  if (candidate.claudeAiOauth.accessToken === previous.claudeAiOauth.accessToken)
+    return;
+  return candidate;
+}
+function markedRejected({
+  credentials,
+  now
+}) {
+  return { ...credentials, rejectedAt: now };
+}
+function claudeLoginState({
+  credentials,
+  now
+}) {
+  if (!credentials)
+    return "missing";
+  if (credentials.rejectedAt !== undefined)
+    return "expired";
+  const { refreshTokenExpiresAt } = credentials.claudeAiOauth;
+  if (refreshTokenExpiresAt !== undefined && refreshTokenExpiresAt <= now) {
+    return "expired";
+  }
+  return "active";
+}
+var LOGIN_WARNING_MS = 5 * 24 * 60 * 60 * 1000;
+var DAY_MS = 24 * 60 * 60 * 1000;
+function claudeLoginWarning({
+  credentials,
+  now
+}) {
+  if (claudeLoginState({ credentials, now }) !== "active")
+    return;
+  const expiresAt = credentials?.claudeAiOauth.refreshTokenExpiresAt;
+  if (expiresAt === undefined || expiresAt - now > LOGIN_WARNING_MS) {
+    return;
+  }
+  const days = Math.floor((expiresAt - now) / DAY_MS);
+  const within = days === 0 ? "within a day" : `in ${days} day${days === 1 ? "" : "s"}`;
+  return `Claude login expires ${within} (${new Date(expiresAt).toLocaleString()}): run \`maesttro login claude\` before then`;
+}
+var CLAUDE_CODEC = {
+  account: "claude",
+  accepts: isMasterLogin
+};
+function claudeStore() {
+  return selectCredentialStore({ codec: CLAUDE_CODEC });
+}
+
+// src/claude-keeper.ts
+import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import {
+  chmodSync as chmodSync2,
+  mkdirSync as mkdirSync3,
+  mkdtempSync,
+  readFileSync as readFileSync3,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join4 } from "node:path";
+
+// src/host-identity.ts
+function hostIdentityEnv() {
+  if (typeof process.getuid !== "function" || typeof process.getgid !== "function") {
+    return {};
+  }
+  return {
+    MAESTTRO_HOST_UID: String(process.getuid()),
+    MAESTTRO_HOST_GID: String(process.getgid())
+  };
+}
+function hostIdentityFlags() {
+  return Object.entries(hostIdentityEnv()).map(([name, value]) => `-e ${name}=${value}`).join(" ");
+}
+
+// src/paths.ts
+import { dirname as dirname2, join as join3, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var PACKAGE_ROOT = resolve(dirname2(fileURLToPath(import.meta.url)), "..");
+var DOCKERFILE_DIR = join3(PACKAGE_ROOT, "docker");
+var IMAGE = "maesttro-runner:latest";
+var LEGACY_VOLUME = process.env.MAESTTRO_VOLUME?.trim() || "maesttro-home";
+
+// src/claude-keeper.ts
+var KEEPER_COMMAND = 'claude -p --model haiku "ok"';
+var KEEPER_TIMEOUT_MS = 75 * 1000;
+var KEEPER_REMOVE_TIMEOUT_MS = 10 * 1000;
+var KEEPER_EXIT_GRACE_MS = 5 * 1000;
+var LOGIN_COMMAND = "claude auth login";
+var REASON_MAX_LENGTH = 200;
+var dockerCli = (args, { interactive }) => {
+  const result = spawnSync2("docker", args, {
+    stdio: interactive ? "inherit" : ["ignore", "pipe", "pipe"]
+  });
+  return {
+    status: result.status ?? null,
+    stderr: result.stderr?.toString() ?? "",
+    error: result.error
+  };
+};
+function collect(child) {
+  let stdout = "";
+  let stderr = "";
+  child.stdout?.on("data", (chunk) => {
+    stdout += String(chunk);
+  });
+  child.stderr?.on("data", (chunk) => {
+    stderr += String(chunk);
+  });
+  return new Promise((resolve) => {
+    child.on("error", (error) => resolve({ status: null, stdout, stderr, error }));
+    child.on("close", (status) => resolve({ status, stdout, stderr }));
+  });
+}
+var keeperDockerCli = {
+  start: (args) => {
+    const child = spawn("docker", args, {
+      stdio: ["ignore", "ignore", "pipe"],
+      detached: true
+    });
+    return { exited: collect(child), kill: () => child.kill("SIGKILL") };
+  },
+  exec: (args, timeoutMs) => collect(spawn("docker", args, {
+    stdio: ["ignore", "pipe", "pipe"],
+    detached: true,
+    timeout: timeoutMs,
+    killSignal: "SIGKILL"
+  }))
+};
+function keeperNamePrefix(uid = process.getuid?.()) {
+  return `claude-keeper-${uid ?? "user"}-`;
+}
+function keeperContainerName() {
+  return `${keeperNamePrefix()}${randomBytes(4).toString("hex")}`;
+}
+function keeperWorkDir() {
+  return join4(maesttroHome(), "claude-keeper");
+}
+function runArgs({
+  claudeDir,
+  identity,
+  interactive,
+  command,
+  name
+}) {
+  return [
+    "run",
+    ...interactive ? ["-it"] : [],
+    "--rm",
+    ...Object.entries(identity).flatMap(([envName, value]) => [
+      "-e",
+      `${envName}=${value}`
+    ]),
+    ...name ? ["--name", name] : [],
+    "--mount",
+    `type=bind,source=${claudeDir},target=/home/agent/.claude`,
+    IMAGE,
+    command
+  ];
+}
+function keeperArgs({
+  claudeDir,
+  identity,
+  name
+}) {
+  return runArgs({
+    claudeDir,
+    identity,
+    interactive: false,
+    command: KEEPER_COMMAND,
+    name
+  });
+}
+function loginArgs({
+  claudeDir,
+  identity
+}) {
+  return runArgs({
+    claudeDir,
+    identity,
+    interactive: true,
+    command: LOGIN_COMMAND
+  });
+}
+function privateDir(parent = tmpdir()) {
+  mkdirSync3(parent, { recursive: true, mode: 448 });
+  const dir = mkdtempSync(join4(parent, "maesttro-claude-"));
+  chmodSync2(dir, 448);
+  return dir;
+}
+function readKeeperCredentials(dir) {
+  try {
+    return JSON.parse(readFileSync3(join4(dir, ".credentials.json"), "utf8"));
+  } catch {
+    return;
+  }
+}
+function inPrivateDir(makeDir, use) {
+  const dir = makeDir();
+  try {
+    return use(dir);
+  } finally {
+    rmSync2(dir, { recursive: true, force: true });
+  }
+}
+function lastLine(text) {
+  const lines = text.split(`
+`).map((line) => line.trim()).filter(Boolean);
+  return (lines.at(-1) ?? "").slice(-REASON_MAX_LENGTH);
+}
+function failureReason({
+  result,
+  timedOut,
+  name
+}) {
+  if (result.error && !timedOut) {
+    return result.error.message.replaceAll(name, "claude-keeper");
+  }
+  const summary = timedOut ? "the keeper timed out" : result.status === 0 ? "the keeper left the login unchanged" : `the keeper exited with status ${result.status}`;
+  const detail = lastLine(result.stderr.replaceAll(name, "claude-keeper"));
+  return detail ? `${summary}: ${detail}` : summary;
+}
+var TIMED_OUT = Symbol("timed out");
+function sleepFor(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function runBounded({
+  docker,
+  args,
+  name,
+  sleep
+}) {
+  const run = docker.start(args);
+  const first = await Promise.race([
+    run.exited,
+    sleep(KEEPER_TIMEOUT_MS).then(() => TIMED_OUT)
+  ]);
+  if (first !== TIMED_OUT)
+    return { result: first, timedOut: false, gone: true };
+  const removal = await docker.exec(["rm", "-f", name], KEEPER_REMOVE_TIMEOUT_MS);
+  const settled = await Promise.race([
+    run.exited,
+    sleep(KEEPER_EXIT_GRACE_MS).then(() => TIMED_OUT)
+  ]);
+  if (settled !== TIMED_OUT) {
+    return { result: settled, timedOut: true, gone: true };
+  }
+  run.kill();
+  return {
+    result: await run.exited,
+    timedOut: true,
+    gone: removal.status === 0
+  };
+}
+async function removeLingeringKeepers({
+  docker = keeperDockerCli
+} = {}) {
+  const listed = await docker.exec(["ps", "-aq", "--filter", `name=^${keeperNamePrefix()}`], KEEPER_REMOVE_TIMEOUT_MS);
+  if (listed.status !== 0) {
+    throw new Error(lastLine(listed.stderr) || "docker ps failed");
+  }
+  const ids = (listed.stdout ?? "").split(`
+`).filter(Boolean);
+  if (ids.length === 0)
+    return;
+  const removed = await docker.exec(["rm", "-f", ...ids], KEEPER_REMOVE_TIMEOUT_MS);
+  if (removed.status !== 0) {
+    throw new Error(lastLine(removed.stderr) || "docker rm failed");
+  }
+}
+async function refreshWithKeeper({
+  master,
+  now,
+  workDir = keeperWorkDir(),
+  docker = keeperDockerCli,
+  identity = hostIdentityEnv(),
+  sleep = sleepFor
+}) {
+  const claudeDir = privateDir(workDir);
+  let outcome = {
+    kind: "inconclusive",
+    reason: "the keeper never ran"
+  };
+  let keepDir = false;
+  try {
+    writeFileSync3(join4(claudeDir, ".credentials.json"), JSON.stringify(markedExpired({ credentials: master, now })), { mode: 384 });
+    const name = keeperContainerName();
+    const { result, timedOut, gone } = await runBounded({
+      docker,
+      args: keeperArgs({ claudeDir, identity, name }),
+      name,
+      sleep
+    });
+    const candidate = readKeeperCredentials(claudeDir);
+    const refreshed = acceptRefreshed({ previous: master, candidate, now });
+    if (refreshed) {
+      outcome = { kind: "refreshed", credentials: refreshed };
+      return outcome;
+    }
+    if (!gone) {
+      keepDir = true;
+      return {
+        kind: "inconclusive",
+        reason: "the keeper couldn't be stopped; its result is kept for the next refresh"
+      };
+    }
+    outcome = isBlankedLogin(candidate) ? { kind: "rejected" } : {
+      kind: "inconclusive",
+      reason: failureReason({ result, timedOut, name })
+    };
+    return outcome;
+  } finally {
+    if (outcome.kind !== "refreshed" && !keepDir) {
+      rmSync2(claudeDir, { recursive: true, force: true });
+    }
+  }
+}
+function captureLogin({
+  docker = dockerCli,
+  makeDir = () => privateDir(),
+  identity = hostIdentityEnv()
+} = {}) {
+  return inPrivateDir(makeDir, (claudeDir) => {
+    const { status } = docker(loginArgs({ claudeDir, identity }), {
+      interactive: true
+    });
+    if (status !== 0)
+      return;
+    const credentials = readKeeperCredentials(claudeDir);
+    return isMasterLogin(credentials) ? credentials : undefined;
+  });
+}
+
+// src/claude-refresher.ts
+import { randomBytes as randomBytes4 } from "node:crypto";
+import {
+  closeSync as closeSync2,
+  existsSync,
+  linkSync,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync7,
+  openSync as openSync2,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync7,
+  renameSync as renameSync5,
+  rmSync as rmSync5,
+  statSync,
+  utimesSync,
+  writeSync
+} from "node:fs";
+import { dirname as dirname4, join as join7 } from "node:path";
+
+// src/held-signals.ts
+var HELD_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+var processSignals = {
+  listenerCount: (signal) => process.listenerCount(signal),
+  on: (signal, handler) => {
+    process.on(signal, handler);
+  },
+  off: (signal, handler) => {
+    process.off(signal, handler);
+  },
+  raise: (signal) => {
+    process.kill(process.pid, signal);
+  }
+};
+function holdSignals({
+  host = processSignals,
+  onHeld = () => {}
+}) {
+  let received;
+  let released = false;
+  const handlers = [];
+  const detach = () => {
+    for (const { signal, handler } of handlers)
+      host.off(signal, handler);
+    handlers.length = 0;
+  };
+  for (const signal of HELD_SIGNALS) {
+    if (host.listenerCount(signal) > 0)
+      continue;
+    const handler = () => {
+      if (received) {
+        released = true;
+        detach();
+        host.raise(signal);
+        return;
+      }
+      received = signal;
+      onHeld();
+    };
+    host.on(signal, handler);
+    handlers.push({ signal, handler });
+  }
+  return {
+    pending: () => received !== undefined,
+    release: () => {
+      if (released)
+        return;
+      released = true;
+      detach();
+      if (received)
+        host.raise(received);
+    }
+  };
+}
+function signalRouter({
+  base = processSignals,
+  onUnrouted
+}) {
+  const routed = new Map;
+  const listeners = HELD_SIGNALS.map((signal) => {
+    const listener = () => {
+      const handlers = [...routed.get(signal) ?? []];
+      if (handlers.length === 0)
+        return onUnrouted(signal);
+      for (const handler of handlers)
+        handler();
+    };
+    base.on(signal, listener);
+    return { signal, listener };
+  });
+  return {
+    listenerCount: (signal) => routed.get(signal)?.size ?? 0,
+    on: (signal, handler) => {
+      routed.set(signal, (routed.get(signal) ?? new Set).add(handler));
+    },
+    off: (signal, handler) => {
+      routed.get(signal)?.delete(handler);
+    },
+    raise: (signal) => onUnrouted(signal),
+    dispose: () => {
+      for (const { signal, listener } of listeners)
+        base.off(signal, listener);
+    }
+  };
+}
+
+// src/refresher.ts
+var REFRESH_LEAD_MS = 10 * 60 * 1000;
+var WALL_CLOCK_TICK_MS = 60 * 1000;
+var FIRST_BACKOFF_MS = 5 * 1000;
+var MAX_BACKOFF_MS = 5 * 60 * 1000;
+var nodeTimers = {
+  setTimeout: (callback, ms) => setTimeout(callback, ms).unref(),
+  clearTimeout: (handle) => clearTimeout(handle),
+  setInterval: (callback, ms) => setInterval(callback, ms).unref(),
+  clearInterval: (handle) => clearInterval(handle)
+};
+function refreshDueAt({
+  expiresAt,
+  now
+}) {
+  const halfRemaining = (expiresAt - now) / 2;
+  return expiresAt - Math.min(REFRESH_LEAD_MS, Math.max(halfRemaining, 0));
+}
+function startRefresher({
+  initial,
+  expiresAtOf,
+  firstAttemptAt,
+  refresh,
+  onRefreshed,
+  onFailed,
+  now = Date.now,
+  timers = nodeTimers
+}) {
+  let current = initial;
+  let nextAttemptAt = 0;
+  let backoffMs = FIRST_BACKOFF_MS;
+  let inFlight;
+  let stopped = false;
+  let pending;
+  function dueAt(token) {
+    return refreshDueAt({ expiresAt: expiresAtOf(token), now: now() });
+  }
+  nextAttemptAt = firstAttemptAt ?? dueAt(initial);
+  function scheduleAt(at) {
+    timers.clearTimeout(pending);
+    pending = timers.setTimeout(check, Math.max(at - now(), 0));
+  }
+  async function attempt() {
+    try {
+      const token = await refresh();
+      if (stopped)
+        return;
+      current = token;
+      backoffMs = FIRST_BACKOFF_MS;
+      nextAttemptAt = dueAt(token);
+      onRefreshed(token);
+    } catch (error) {
+      if (stopped)
+        return;
+      nextAttemptAt = now() + backoffMs;
+      onFailed(error, backoffMs);
+      backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
+    }
+    scheduleAt(nextAttemptAt);
+  }
+  function check() {
+    if (stopped)
+      return Promise.resolve();
+    if (inFlight)
+      return inFlight;
+    if (now() < nextAttemptAt)
+      return Promise.resolve();
+    inFlight = attempt().finally(() => {
+      inFlight = undefined;
+    });
+    return inFlight;
+  }
+  const tick = timers.setInterval(check, WALL_CLOCK_TICK_MS);
+  scheduleAt(nextAttemptAt);
+  return {
+    current: () => current,
+    check,
+    stop: () => {
+      stopped = true;
+      timers.clearTimeout(pending);
+      timers.clearInterval(tick);
+      return inFlight ?? Promise.resolve();
+    },
+    busy: () => inFlight !== undefined
+  };
+}
+
+// src/session-home.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import {
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync6,
+  openSync,
+  readFileSync as readFileSync6,
+  renameSync as renameSync4,
+  rmSync as rmSync4,
+  unlinkSync,
+  writeFileSync as writeFileSync6
+} from "node:fs";
+import { join as join6 } from "node:path";
+
+// src/json-file.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3 } from "node:path";
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeJson(existing, curated) {
+  const merged = { ...existing };
+  for (const [key, value] of Object.entries(curated)) {
+    const current = merged[key];
+    merged[key] = isObject(current) && isObject(value) ? mergeJson(current, value) : value;
+  }
+  return merged;
+}
+function readJson(path) {
+  try {
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    return isObject(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeJson(path, value) {
+  mkdirSync4(dirname3(path), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+function skipInsignificant(text, from) {
+  let index = from;
+  while (index < text.length) {
+    if (/\s/.test(text[index] ?? "")) {
+      index++;
+    } else if (text.startsWith("//", index)) {
+      while (index < text.length && text[index] !== `
+`)
+        index++;
+    } else if (text.startsWith("/*", index)) {
+      const end = text.indexOf("*/", index + 2);
+      index = end === -1 ? text.length : end + 2;
+    } else {
+      return index;
+    }
+  }
+  return index;
+}
+function stripJsonc(text) {
+  let output = "";
+  let index = 0;
+  while (index < text.length) {
+    const char = text[index];
+    if (char === '"') {
+      const start = index;
+      index++;
+      while (index < text.length && text[index] !== '"') {
+        index += text[index] === "\\" ? 2 : 1;
+      }
+      index++;
+      output += text.slice(start, index);
+      continue;
+    }
+    const significant = skipInsignificant(text, index);
+    if (significant > index) {
+      output += " ";
+      index = significant;
+      continue;
+    }
+    const trailingComma = char === "," && /[}\]]/.test(text[skipInsignificant(text, index + 1)] ?? "");
+    if (!trailingComma)
+      output += char;
+    index++;
+  }
+  return output;
+}
+function parseJsonc(text) {
+  const parsed = JSON.parse(stripJsonc(text));
+  if (!isObject(parsed))
+    throw new Error("expected a JSON object");
+  return parsed;
+}
+
+// src/sessions.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import {
+  chmodSync as chmodSync3,
+  lstatSync,
+  mkdirSync as mkdirSync5,
+  readdirSync,
+  readFileSync as readFileSync5,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { join as join5 } from "node:path";
+function newSessionId() {
+  return `maesttro-${randomBytes2(4).toString("hex")}`;
+}
+function sessionsDir(home = maesttroHome()) {
+  return join5(home, "sessions");
+}
+function saveSession(record, dir = sessionsDir()) {
+  mkdirSync5(dir, { recursive: true, mode: 448 });
+  const path = join5(dir, `${record.id}.json`);
+  writeFileSync5(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
+`);
+  renameSync3(`${path}.tmp`, path);
+}
+function readSession(id, dir = sessionsDir()) {
+  try {
+    return JSON.parse(readFileSync5(join5(dir, `${id}.json`), "utf8"));
+  } catch {
+    return;
+  }
+}
+function unlockTree(path) {
+  let entry;
+  try {
+    entry = lstatSync(path);
+  } catch {
+    return;
+  }
+  if (!entry.isDirectory())
+    return;
+  chmodSync3(path, 448);
+  for (const name of readdirSync(path))
+    unlockTree(join5(path, name));
+}
+function removeTree(path) {
+  try {
+    rmSync3(path, { recursive: true, force: true });
+  } catch {
+    unlockTree(path);
+    rmSync3(path, { recursive: true, force: true });
+  }
+}
+function deleteSession(id, dir = sessionsDir()) {
+  removeTree(join5(dir, id));
+  rmSync3(join5(dir, `${id}.json`), { force: true });
+}
+function sessionsForRepo(repoRoot, dir = sessionsDir()) {
+  let names;
+  try {
+    names = readdirSync(dir).filter((name) => name.endsWith(".json"));
+  } catch {
+    return [];
+  }
+  return names.map((name) => readSession(name.slice(0, -".json".length), dir)).filter((record) => record?.repoRoot === repoRoot).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+}
+
+// src/session-home.ts
+var OPEN_DIRECTORY_NO_FOLLOW = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
+var CREATE_NEW_NO_FOLLOW = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
+var READ_NO_FOLLOW_NO_BLOCK = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+function sessionHome({
+  id,
+  dir = sessionsDir()
+}) {
+  return join6(dir, id, "home");
+}
+function sessionClaudeDir({
+  id,
+  dir = sessionsDir()
+}) {
+  return join6(dir, id, "claude");
+}
+function credentialsPath(claudeDir) {
+  return join6(claudeDir, ".credentials.json");
+}
+function entryAt(path) {
+  try {
+    return lstatSync2(path);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+}
+function requireRealDirectory(path) {
+  if (!lstatSync2(path).isDirectory()) {
+    throw new Error(`Not a directory: ${path}`);
+  }
+}
+function withFd(fd, use) {
+  try {
+    return use(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+function ensurePrivateDir(path) {
+  const entry = entryAt(path);
+  if (!entry?.isDirectory()) {
+    if (entry)
+      unlinkSync(path);
+    mkdirSync6(path, { recursive: true, mode: 448 });
+  }
+  withFd(openSync(path, OPEN_DIRECTORY_NO_FOLLOW), (fd) => fchmodSync(fd, 448));
+}
+function ensureSessionHome({
+  id,
+  dir = sessionsDir()
+}) {
+  const home = sessionHome({ id, dir });
+  const claudeDir = sessionClaudeDir({ id, dir });
+  ensurePrivateDir(home);
+  ensurePrivateDir(claudeDir);
+  ensurePrivateDir(join6(home, ".claude"));
+  return { home, claudeDir };
+}
+function supersedes({
+  credentials,
+  current
+}) {
+  if (carriesRefreshToken(current))
+    return false;
+  if (!isClaudeCredentials(current))
+    return true;
+  return credentials.claudeAiOauth.expiresAt > current.claudeAiOauth.expiresAt;
+}
+function writeSessionCredentials({
+  claudeDir,
+  credentials
+}) {
+  requireRealDirectory(claudeDir);
+  const current = readSessionCredentials({ claudeDir });
+  if (!supersedes({ credentials, current }))
+    return false;
+  const temporary = join6(claudeDir, `.credentials.json.maesttro-${randomBytes3(8).toString("hex")}`);
+  const fd = openSync(temporary, CREATE_NEW_NO_FOLLOW, 384);
+  try {
+    withFd(fd, () => {
+      writeFileSync6(fd, JSON.stringify({
+        ...isObject(current) ? current : {},
+        ...withoutRefreshToken(credentials)
+      }));
+      fchmodSync(fd, 384);
+    });
+    renameSync4(temporary, credentialsPath(claudeDir));
+  } catch (error) {
+    rmSync4(temporary, { force: true });
+    throw error;
+  }
+  return true;
+}
+function readSessionCredentials({
+  claudeDir
+}) {
+  try {
+    return withFd(openSync(credentialsPath(claudeDir), READ_NO_FOLLOW_NO_BLOCK), (fd) => fstatSync(fd).isFile() ? JSON.parse(readFileSync6(fd, "utf8")) : undefined);
+  } catch {
+    return;
+  }
+}
+function removeHostWrittenCredentials({
+  claudeDir
+}) {
+  requireRealDirectory(claudeDir);
+  const path = credentialsPath(claudeDir);
+  const entry = entryAt(path);
+  if (!entry)
+    return;
+  const inSessionLogin = entry.isFile() && carriesRefreshToken(readSessionCredentials({ claudeDir }));
+  if (!inSessionLogin)
+    unlinkSync(path);
+}
+
+// src/claude-refresher.ts
+var LOCK_STALE_MS = 2 * 60 * 1000;
+var LOCK_HEARTBEAT_MS = 20 * 1000;
+var SESSION_SYNC_MS = 60 * 1000;
+var LAUNCH_RETRY_MS = 60 * 1000;
+var WAITING_FOR_REFRESH = "Waiting for another maesttro's Claude refresh…";
+
+class ClaudeLoginExpired extends Error {
+  constructor() {
+    super("Claude login expired: run `maesttro login claude`");
+  }
+}
+
+class ClaudeRefreshFailed extends Error {
+  constructor(reason) {
+    super(`Couldn't refresh the Claude login (will retry): ${reason}`);
+  }
+}
+
+class ClaudeLoggedOut extends Error {
+  constructor() {
+    super("Not logged in to Claude: run `maesttro login claude`");
+  }
+}
+function claudeLockPath() {
+  return join7(maesttroHome(), "claude-refresh.lock");
+}
+function lockToken() {
+  return `${process.pid}-${randomBytes4(8).toString("hex")}`;
+}
+function tryAcquire(path, token) {
+  let fd;
+  try {
+    fd = openSync2(path, "wx", 384);
+  } catch (error) {
+    if (error.code === "EEXIST")
+      return false;
+    throw error;
+  }
+  try {
+    writeSync(fd, token);
+  } catch (error) {
+    rmSync5(path, { force: true });
+    throw error;
+  } finally {
+    closeSync2(fd);
+  }
+  return true;
+}
+function isStale(path, now, staleMs) {
+  try {
+    return now - statSync(path).mtimeMs > staleMs;
+  } catch {
+    return false;
+  }
+}
+function reclaimStaleLock({
+  path,
+  now,
+  staleMs
+}) {
+  const staging = `${path}.stale-${lockToken()}`;
+  try {
+    renameSync5(path, staging);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  if (!isStale(staging, now, staleMs)) {
+    try {
+      linkSync(staging, path);
+    } catch {}
+  }
+  rmSync5(staging, { force: true });
+}
+function touchIfOwned(path, token) {
+  try {
+    if (readFileSync7(path, "utf8") === token) {
+      const now = new Date;
+      utimesSync(path, now, now);
+    }
+  } catch {}
+}
+function releaseIfOwned(path, token) {
+  try {
+    if (readFileSync7(path, "utf8") === token)
+      rmSync5(path, { force: true });
+  } catch {}
+}
+function sleepFor2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function withRefreshLock({
+  path,
+  now = Date.now,
+  staleMs = LOCK_STALE_MS,
+  pollMs = 500,
+  sleep = sleepFor2,
+  onWait = () => {},
+  timers = nodeTimers
+}, action) {
+  mkdirSync7(dirname4(path), { recursive: true, mode: 448 });
+  const token = lockToken();
+  let waited = false;
+  while (!tryAcquire(path, token)) {
+    if (isStale(path, now(), staleMs)) {
+      reclaimStaleLock({ path, now: now(), staleMs });
+    } else {
+      if (!waited)
+        onWait();
+      waited = true;
+      await sleep(pollMs);
+    }
+  }
+  const heartbeat = timers.setInterval(() => touchIfOwned(path, token), LOCK_HEARTBEAT_MS);
+  try {
+    return await action();
+  } finally {
+    timers.clearInterval(heartbeat);
+    releaseIfOwned(path, token);
+  }
+}
+function isDue({
+  credentials,
+  now
+}) {
+  return credentials.claudeAiOauth.expiresAt - now <= REFRESH_LEAD_MS;
+}
+var FINISHING_REFRESH = "Finishing the Claude refresh before exiting… (press Ctrl-C again to abort)";
+var FINISHING_BACKGROUND_REFRESH = "Finishing a Claude refresh before exiting…";
+var runKeeper = ({ master, now, workDir }) => refreshWithKeeper({ master, now, workDir });
+function loadMaster(store) {
+  const master = store.load();
+  if (!master)
+    throw new ClaudeLoggedOut;
+  return master;
+}
+function keeperLeftovers(workDir) {
+  try {
+    return readdirSync2(workDir).map((name) => join7(workDir, name)).filter((path) => lstatSync3(path).isDirectory());
+  } catch {
+    return [];
+  }
+}
+function discardLeftovers(workDir) {
+  for (const dir of keeperLeftovers(workDir)) {
+    rmSync5(dir, { recursive: true, force: true });
+  }
+}
+function discardKeeperLeftovers({
+  workDir = keeperWorkDir()
+} = {}) {
+  discardLeftovers(workDir);
+}
+function saveRotated({
+  store,
+  credentials,
+  workDir,
+  onRotated
+}) {
+  try {
+    store.save(credentials);
+  } catch (error) {
+    onRotated(credentials);
+    throw new ClaudeRefreshFailed(`couldn't save the refreshed login: ${messageOf(error)}`);
+  }
+  discardLeftovers(workDir);
+  onRotated(credentials);
+}
+function adoptLeftover({
+  master,
+  workDir
+}) {
+  let best;
+  for (const dir of keeperLeftovers(workDir)) {
+    const candidate = readKeeperCredentials(dir);
+    if (!isMasterLogin(candidate))
+      continue;
+    const { accessToken, expiresAt } = candidate.claudeAiOauth;
+    const newest = best ?? master;
+    if (accessToken !== master.claudeAiOauth.accessToken && expiresAt > newest.claudeAiOauth.expiresAt) {
+      best = { claudeAiOauth: candidate.claudeAiOauth };
+    }
+  }
+  return best;
+}
+function sameLogin(current, expected) {
+  return current?.claudeAiOauth.accessToken === expected.claudeAiOauth.accessToken;
+}
+function replacedMeanwhile({
+  store,
+  handed,
+  workDir
+}) {
+  const current = store.load();
+  if (sameLogin(current, handed))
+    return;
+  if (!current)
+    throw new ClaudeLoggedOut;
+  discardLeftovers(workDir);
+  return current;
+}
+async function clearEarlierKeepers(clearLingering) {
+  try {
+    await clearLingering();
+  } catch (error) {
+    throw new ClaudeRefreshFailed(`couldn't stop an earlier keeper: ${messageOf(error)}`);
+  }
+}
+async function refreshMaster({
+  store,
+  keeper = runKeeper,
+  lockPath = claudeLockPath(),
+  workDir = keeperWorkDir(),
+  clearLingering = () => removeLingeringKeepers(),
+  now = Date.now,
+  announce,
+  sleep,
+  signals,
+  onRotated = () => {}
+}) {
+  const loaded = loadMaster(store);
+  if (keeperLeftovers(workDir).length === 0) {
+    if (loaded.rejectedAt !== undefined)
+      throw new ClaudeLoginExpired;
+    if (!isDue({ credentials: loaded, now: now() }))
+      return loaded;
+  }
+  const onWait = announce ? () => announce(WAITING_FOR_REFRESH) : undefined;
+  const onHeld = announce ? () => announce(FINISHING_REFRESH) : undefined;
+  let hold;
+  try {
+    return await withRefreshLock({ path: lockPath, now, sleep, onWait }, async () => {
+      if (signals)
+        hold = holdSignals({ host: signals, onHeld });
+      await clearEarlierKeepers(clearLingering);
+      let stored = store.load();
+      if (!stored)
+        throw new ClaudeLoggedOut;
+      const adopted = adoptLeftover({ master: stored, workDir });
+      if (adopted) {
+        saveRotated({ store, credentials: adopted, workDir, onRotated });
+        stored = adopted;
+      }
+      discardLeftovers(workDir);
+      if (stored.rejectedAt !== undefined)
+        throw new ClaudeLoginExpired;
+      if (!isDue({ credentials: stored, now: now() }))
+        return stored;
+      if (hold?.pending()) {
+        throw new ClaudeRefreshFailed("interrupted before the keeper ran");
+      }
+      const outcome = await keeper({ master: stored, now: now(), workDir });
+      if (outcome.kind === "inconclusive") {
+        throw new ClaudeRefreshFailed(outcome.reason);
+      }
+      const newer = replacedMeanwhile({ store, handed: stored, workDir });
+      if (newer)
+        return newer;
+      if (outcome.kind === "rejected") {
+        try {
+          store.save(markedRejected({ credentials: stored, now: now() }));
+        } catch {}
+        throw new ClaudeLoginExpired;
+      }
+      saveRotated({
+        store,
+        credentials: outcome.credentials,
+        workDir,
+        onRotated
+      });
+      return outcome.credentials;
+    });
+  } finally {
+    hold?.release();
+  }
+}
+function runningSessionIds({
+  run = runCommand
+} = {}) {
+  const result = run("docker", ["ps", "--format", "{{.Names}}"]);
+  if (result.status !== 0)
+    return [];
+  return result.stdout.split(`
+`).map((name) => name.trim()).filter((name) => name.startsWith("maesttro-"));
+}
+function messageOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function pushCredentials({
+  credentials,
+  claudeDirs,
+  announce
+}) {
+  for (const claudeDir of new Set(claudeDirs)) {
+    if (!existsSync(claudeDir))
+      continue;
+    try {
+      writeSessionCredentials({ claudeDir, credentials });
+    } catch (error) {
+      announce(`Couldn't update the Claude login in ${claudeDir}: ${messageOf(error)}`);
+    }
+  }
+}
+function announcingOnce(announce, alreadySaid) {
+  let last = alreadySaid;
   return {
-    kind: "Secret Service (secret-tool)",
-    load: () => {
-      const result = run("secret-tool", ["lookup", ...attributes]);
-      return result.status === 0 ? decode(result.stdout) : undefined;
-    },
-    save: (token) => {
-      const result = run("secret-tool", ["store", `--label=${SERVICE}`, ...attributes], encode(token));
-      if (result.status !== 0) {
-        throw new Error("Could not write to the Secret Service");
-      }
+    say: (message) => {
+      if (message === last)
+        return;
+      last = message;
+      announce(message);
     },
-    clear: () => {
-      run("secret-tool", ["clear", ...attributes]);
+    reset: () => {
+      last = undefined;
     }
   };
 }
-function fileStore(path = join(homedir(), ".config", "maesttro", "credentials.json")) {
-  return {
-    kind: `file (${path})`,
-    load: () => {
-      try {
-        return decode(readFileSync(path, "utf8"));
-      } catch {
-        return;
-      }
-    },
-    save: (token) => {
-      mkdirSync(dirname(path), { recursive: true, mode: 448 });
-      const temporary = `${path}.tmp`;
-      writeFileSync(temporary, encode(token), { mode: 384 });
-      chmodSync(temporary, 384);
-      renameSync(temporary, path);
+function syncSessionCredentials({
+  store,
+  claudeDir,
+  now = Date.now
+}) {
+  const master = store.load();
+  if (!master || master.claudeAiOauth.expiresAt <= now())
+    return;
+  writeSessionCredentials({ claudeDir, credentials: master });
+}
+function pushToRunningSessions({
+  credentials,
+  claudeDir,
+  run = runCommand,
+  claudeDirOf = (id) => sessionClaudeDir({ id }),
+  announce
+}) {
+  pushCredentials({
+    credentials,
+    claudeDirs: [claudeDir, ...runningSessionIds({ run }).map(claudeDirOf)],
+    announce
+  });
+}
+function startClaudeRefresher({
+  claudeDir,
+  store,
+  keeper,
+  lockPath,
+  workDir,
+  clearLingering,
+  run = runCommand,
+  claudeDirOf = (id) => sessionClaudeDir({ id }),
+  announce,
+  launchFailure,
+  now = Date.now,
+  timers = nodeTimers
+}) {
+  const initial = store.load();
+  if (!initial)
+    return;
+  const refreshNotices = announcingOnce(announce, launchFailure);
+  const syncNotices = announcingOnce(announce);
+  const refresher = startRefresher({
+    initial,
+    expiresAtOf: (credentials) => credentials.claudeAiOauth.expiresAt,
+    firstAttemptAt: launchFailure === undefined ? undefined : now() + LAUNCH_RETRY_MS,
+    refresh: () => refreshMaster({
+      store,
+      keeper,
+      lockPath,
+      workDir,
+      clearLingering,
+      now,
+      onRotated: (credentials) => pushToRunningSessions({
+        credentials,
+        claudeDir,
+        run,
+        claudeDirOf,
+        announce: refreshNotices.say
+      })
+    }),
+    onRefreshed: (credentials) => {
+      refreshNotices.reset();
+      pushCredentials({
+        credentials,
+        claudeDirs: [claudeDir],
+        announce: refreshNotices.say
+      });
     },
-    clear: () => {
-      rmSync(path, { force: true });
+    onFailed: (error) => refreshNotices.say(messageOf(error)),
+    now,
+    timers
+  });
+  const sync = timers.setInterval(() => {
+    try {
+      syncSessionCredentials({ store, claudeDir, now });
+      syncNotices.reset();
+    } catch (error) {
+      syncNotices.say(messageOf(error));
     }
+  }, SESSION_SYNC_MS);
+  return {
+    stop: () => {
+      timers.clearInterval(sync);
+      return refresher.stop();
+    },
+    busy: refresher.busy
   };
 }
-function selectCredentialStore({
-  platform = process.platform,
-  env = process.env,
-  run = runCommand
-} = {}) {
-  if (env.MAESTTRO_CREDENTIAL_STORE === "file")
-    return fileStore();
-  if (platform === "darwin")
-    return keychainStore(run);
-  if (platform === "linux" && commandExists(run, "secret-tool")) {
-    return secretToolStore(run);
-  }
-  return fileStore();
-}
 
 // src/github-api.ts
 function githubApiUrl(env = process.env) {
@@ -312,7 +1719,7 @@ function loginDependencies() {
 function describeExpiry(iso) {
   return iso ? new Date(iso).toLocaleString() : "never";
 }
-async function login() {
+async function loginGitHub() {
   const dependencies = loginDependencies();
   const token = await deviceLogin(dependencies);
   const name = await githubLogin(token.access_token);
@@ -322,24 +1729,24 @@ async function ensureLogin() {
   const dependencies = loginDependencies();
   const token = await currentUserToken({ ...dependencies, interactive: true });
   const name = token && await githubLogin(token.access_token);
-  console.log(name ? `Logged in to GitHub as ${name}. Stored in ${dependencies.store.kind}.` : "GitHub login did not complete. Run `maesttro login` to retry.");
+  console.log(name ? `Logged in to GitHub as ${name}. Stored in ${dependencies.store.kind}.` : "GitHub login did not complete. Run `maesttro login github` to retry.");
 }
-function logout() {
+function logoutGitHub() {
   const { store } = loginDependencies();
   store.clear();
   console.log(`Logged out. Removed GitHub credentials from ${store.kind}.`);
 }
-async function status() {
+async function statusGitHub() {
   const dependencies = loginDependencies();
   const token = await currentUserToken({ ...dependencies, interactive: false });
   if (!token) {
-    console.log("Not logged in to GitHub. Run `maesttro login`.");
+    console.log("Not logged in to GitHub. Run `maesttro login github`.");
     process.exitCode = 1;
     return;
   }
   const name = await githubLogin(token.access_token);
   console.log([
-    `GitHub: ${name ? `logged in as ${name}` : "token rejected — run `maesttro login`"}`,
+    `GitHub: ${name ? `logged in as ${name}` : "token rejected — run `maesttro login github`"}`,
     `Store: ${dependencies.store.kind}`,
     `Access token expires: ${describeExpiry(token.expires_at)}`,
     `Refresh token expires: ${describeExpiry(token.refresh_expires_at)}`
@@ -348,112 +1755,186 @@ async function status() {
   if (!name)
     process.exitCode = 1;
 }
+function parseLoginTargets(args) {
+  const [target, ...rest] = args;
+  if (rest.length > 0)
+    return;
+  if (target === undefined)
+    return ["github", "claude"];
+  return target === "github" || target === "claude" ? [target] : undefined;
+}
+function claudeLogin({
+  capture = () => captureLogin(),
+  store = claudeStore(),
+  forgetLeftovers = () => discardKeeperLeftovers(),
+  announce = (message) => console.log(message)
+} = {}) {
+  announce("Logging in to Claude in a throwaway runner (opens a URL; paste the code back)...");
+  const credentials = capture();
+  if (!credentials) {
+    announce("Claude login did not complete. Run `maesttro login claude` to retry.");
+    return false;
+  }
+  store.save(credentials);
+  forgetLeftovers();
+  announce(`Logged in to Claude. Stored in ${store.kind}.`);
+  return true;
+}
+function describeClaudeStatus({
+  credentials,
+  now
+}) {
+  if (!credentials) {
+    return {
+      loggedIn: false,
+      lines: ["Claude: not logged in — run `maesttro login claude`"]
+    };
+  }
+  const { expiresAt, refreshTokenExpiresAt } = credentials.claudeAiOauth;
+  const loggedIn = claudeLoginState({ credentials, now }) === "active";
+  const warning = claudeLoginWarning({ credentials, now });
+  return {
+    loggedIn,
+    lines: [
+      loggedIn ? "Claude: logged in" : "Claude: login expired — run `maesttro login claude`",
+      ...warning ? [`Warning: ${warning}`] : [],
+      `Access token expires: ${new Date(expiresAt).toLocaleString()}`,
+      `Refresh token expires: ${refreshTokenExpiresAt ? new Date(refreshTokenExpiresAt).toLocaleString() : "unknown"}`
+    ]
+  };
+}
+function unknownTarget(command) {
+  console.log(`Usage: maesttro ${command} [github|claude]`);
+  process.exitCode = 1;
+}
+async function login({ args }) {
+  const targets = parseLoginTargets(args);
+  if (!targets)
+    return unknownTarget("login");
+  if (targets.includes("github"))
+    await loginGitHub();
+  if (targets.includes("claude") && !claudeLogin())
+    process.exitCode = 1;
+}
+function logout({ args }) {
+  const targets = parseLoginTargets(args);
+  if (!targets) {
+    unknownTarget("logout");
+    return;
+  }
+  if (targets.includes("github"))
+    logoutGitHub();
+  if (targets.includes("claude")) {
+    const store = claudeStore();
+    store.clear();
+    discardKeeperLeftovers();
+    console.log(`Logged out. Removed Claude credentials from ${store.kind}.`);
+  }
+}
+async function status({ args }) {
+  const targets = parseLoginTargets(args);
+  if (!targets)
+    return unknownTarget("status");
+  if (targets.includes("github"))
+    await statusGitHub();
+  if (targets.includes("claude")) {
+    const { loggedIn, lines } = describeClaudeStatus({
+      credentials: claudeStore().load(),
+      now: Date.now()
+    });
+    console.log(lines.join(`
+`));
+    if (!loggedIn)
+      process.exitCode = 1;
+  }
+}
+
+// src/clients.ts
+var CLIENTS = {
+  claude: {
+    label: "Claude Code",
+    npmPackage: "@anthropic-ai/claude-code",
+    binary: "claude",
+    configDir: "/home/agent/.claude"
+  },
+  opencode: {
+    label: "opencode",
+    npmPackage: "opencode-ai",
+    binary: "opencode",
+    configDir: "/home/agent/.config/opencode"
+  }
+};
+var DEFAULT_CLIENT = "opencode";
+function isClientKey(value) {
+  return Object.hasOwn(CLIENTS, value);
+}
 
 // src/configure.ts
 import {
   cpSync as cpSync2,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync4,
-  readdirSync,
-  readFileSync as readFileSync4,
-  writeFileSync as writeFileSync4
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync9,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync10,
+  writeFileSync as writeFileSync9
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname5, join as join4 } from "node:path";
+import { dirname as dirname6, join as join10 } from "node:path";
 
-// src/client-configs.ts
-import {
-  chmodSync as chmodSync2,
-  cpSync,
-  existsSync,
-  mkdirSync as mkdirSync3,
-  mkdtempSync,
-  readFileSync as readFileSync3,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync3
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname as dirname3, join as join2 } from "node:path";
+// src/claude-state.ts
+import { readFileSync as readFileSync8, renameSync as renameSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join8 } from "node:path";
 
-// src/json-file.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
-function isObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function mergeJson(existing, curated) {
-  const merged = { ...existing };
-  for (const [key, value] of Object.entries(curated)) {
-    const current = merged[key];
-    merged[key] = isObject(current) && isObject(value) ? mergeJson(current, value) : value;
-  }
-  return merged;
+// src/runner-paths.ts
+var CONTAINER_REPO_PATH = "/workspace";
+
+// src/claude-state.ts
+function seededClaudeState({
+  existing,
+  claudeVersion
+}) {
+  const projects = isObject(existing.projects) ? existing.projects : {};
+  return {
+    ...existing,
+    hasCompletedOnboarding: true,
+    ...claudeVersion ? { lastOnboardingVersion: claudeVersion } : {},
+    theme: existing.theme ?? "dark",
+    projects: mergeJson(projects, {
+      [CONTAINER_REPO_PATH]: { hasTrustDialogAccepted: true }
+    })
+  };
 }
-function readJson(path) {
+function installedClaudeVersion(root = "/usr/local/lib/node_modules/@anthropic-ai/claude-code") {
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return isObject(parsed) ? parsed : {};
+    return JSON.parse(readFileSync8(join8(root, "package.json"), "utf8")).version;
   } catch {
-    return {};
+    return;
   }
 }
-function writeJson(path, value) {
-  mkdirSync2(dirname2(path), { recursive: true });
-  writeFileSync2(path, `${JSON.stringify(value, null, 2)}
+function seedClaudeState({
+  home,
+  claudeVersion = installedClaudeVersion()
+}) {
+  const path = join8(home, ".claude.json");
+  const state = seededClaudeState({ existing: readJson(path), claudeVersion });
+  writeFileSync7(`${path}.tmp`, `${JSON.stringify(state, null, 2)}
 `);
+  renameSync6(`${path}.tmp`, path);
 }
-function skipInsignificant(text, from) {
-  let index = from;
-  while (index < text.length) {
-    if (/\s/.test(text[index] ?? "")) {
-      index++;
-    } else if (text.startsWith("//", index)) {
-      while (index < text.length && text[index] !== `
-`)
-        index++;
-    } else if (text.startsWith("/*", index)) {
-      const end = text.indexOf("*/", index + 2);
-      index = end === -1 ? text.length : end + 2;
-    } else {
-      return index;
-    }
-  }
-  return index;
-}
-function stripJsonc(text) {
-  let output = "";
-  let index = 0;
-  while (index < text.length) {
-    const char = text[index];
-    if (char === '"') {
-      const start = index;
-      index++;
-      while (index < text.length && text[index] !== '"') {
-        index += text[index] === "\\" ? 2 : 1;
-      }
-      index++;
-      output += text.slice(start, index);
-      continue;
-    }
-    const significant = skipInsignificant(text, index);
-    if (significant > index) {
-      output += " ";
-      index = significant;
-      continue;
-    }
-    const trailingComma = char === "," && /[}\]]/.test(text[skipInsignificant(text, index + 1)] ?? "");
-    if (!trailingComma)
-      output += char;
-    index++;
-  }
-  return output;
-}
-function parseJsonc(text) {
-  const parsed = JSON.parse(stripJsonc(text));
-  if (!isObject(parsed))
-    throw new Error("expected a JSON object");
-  return parsed;
-}
+
+// src/client-configs.ts
+import {
+  chmodSync as chmodSync4,
+  cpSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync8,
+  mkdtempSync as mkdtempSync2,
+  readFileSync as readFileSync9,
+  rmSync as rmSync6,
+  writeFileSync as writeFileSync8
+} from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname5, join as join9 } from "node:path";
 
 // src/maesttro-endpoint.ts
 var DEFAULT_MAESTTRO_URL = "http://100.64.0.2";
@@ -667,11 +2148,11 @@ function readHostFile({
   parse,
   warn
 }) {
-  const path = join2(home, file);
-  if (!existsSync(path))
+  const path = join9(home, file);
+  if (!existsSync2(path))
     return {};
   try {
-    return parse(readFileSync3(path, "utf8"));
+    return parse(readFileSync9(path, "utf8"));
   } catch {
     warn(`maesttro: ignoring your ~/${file}, it doesn't parse`);
     return {};
@@ -703,66 +2184,46 @@ function buildClientConfigs({
     removed: opencode.removed.map((path) => `opencode ${path}`)
   };
 }
-function writeClientConfigDir(files, parent = tmpdir()) {
-  const root = mkdtempSync(join2(parent, "maesttro-clients-"));
-  chmodSync2(root, 448);
-  const dir = join2(root, "home");
+function writeClientConfigDir(files, parent = tmpdir2()) {
+  const root = mkdtempSync2(join9(parent, "maesttro-clients-"));
+  chmodSync4(root, 448);
+  const dir = join9(root, "home");
   for (const [file, content] of Object.entries(files)) {
-    const path = join2(dir, file);
-    mkdirSync3(dirname3(path), { recursive: true, mode: 493 });
-    writeFileSync3(path, content);
-    chmodSync2(path, 420);
+    const path = join9(dir, file);
+    mkdirSync8(dirname5(path), { recursive: true, mode: 493 });
+    writeFileSync8(path, content);
+    chmodSync4(path, 420);
   }
-  chmodSync2(dir, 493);
-  return { dir, remove: () => rmSync2(root, { recursive: true, force: true }) };
+  chmodSync4(dir, 493);
+  return { dir, remove: () => rmSync6(root, { recursive: true, force: true }) };
 }
 function installClientConfigs({
   home,
   source = CONTAINER_CLIENT_CONFIGS
 }) {
-  if (!existsSync(source))
+  if (!existsSync2(source))
     return false;
-  const merged = MERGED_INTO_HOME.map((file) => join2(source, file));
+  const merged = MERGED_INTO_HOME.map((file) => join9(source, file));
   cpSync(source, home, {
     recursive: true,
     force: true,
     filter: (path) => !merged.includes(path)
   });
   for (const file of MERGED_INTO_HOME) {
-    const staged = join2(source, file);
-    if (!existsSync(staged))
+    const staged = join9(source, file);
+    if (!existsSync2(staged))
       continue;
-    const target = join2(home, file);
+    const target = join9(home, file);
     writeJson(target, mergeJson(readJson(target), readJson(staged)));
   }
   return true;
 }
 function injectOpencodeTuiState({ home }) {
-  const path = join2(home, OPENCODE_TUI_STATE);
+  const path = join9(home, OPENCODE_TUI_STATE);
   writeJson(path, mergeJson(readJson(path), CURATED_OPENCODE_TUI_STATE));
   return path;
 }
 
-// src/clients.ts
-var CLIENTS = {
-  claude: {
-    label: "Claude Code",
-    npmPackage: "@anthropic-ai/claude-code",
-    binary: "claude",
-    configDir: "/home/agent/.claude"
-  },
-  opencode: {
-    label: "opencode",
-    npmPackage: "opencode-ai",
-    binary: "opencode",
-    configDir: "/home/agent/.config/opencode"
-  }
-};
-var DEFAULT_CLIENT = "opencode";
-function isClientKey(value) {
-  return Object.hasOwn(CLIENTS, value);
-}
-
 // src/host-instructions.ts
 var HOST_STAGING_DIR = "/opt/maesttro-host";
 var STAGED_DIRECTORIES = [
@@ -776,14 +2237,6 @@ var INSTRUCTION_FILES = [
 ];
 var STAGED_PATHS = [...INSTRUCTION_FILES, ...STAGED_DIRECTORIES];
 
-// src/paths.ts
-import { dirname as dirname4, join as join3, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-var PACKAGE_ROOT = resolve(dirname4(fileURLToPath(import.meta.url)), "..");
-var DOCKERFILE_DIR = join3(PACKAGE_ROOT, "docker");
-var IMAGE = "maesttro-runner:latest";
-var VOLUME = process.env.MAESTTRO_VOLUME?.trim() || "maesttro-home";
-
 // src/runner-context.ts
 function githubMode(value) {
   return value === "on" || value === "strict" ? value : "off";
@@ -832,6 +2285,13 @@ function runnerInstructions(context) {
     "- Work in this directory. Anything outside it is not persisted.",
     "- Commit on a branch you create here. The user pushes it from their machine with `maesttro push`; the runner cannot push, merge, or delete remote branches.",
     "",
+    "## Installing tools",
+    "",
+    "- Preinstalled: Node 24 (npm, pnpm, yarn), TypeScript (`tsc`), Bun, Python 3.14 and uv (`uv venv`, `uv pip`, `uv tool`; plain `pip` and `python -m venv` work too), the .NET 10 SDK, a C/C++ build toolchain, and common CLI tools (jq, ripgrep, fd, unzip, zip, sqlite3).",
+    "- You can install more yourself without root: `npm i -g`, `bun add -g`, `pip install`, `uv tool install`, `uv python install`, `dotnet tool install -g`. They work as usual and are on `PATH` right away.",
+    "- Installs last only until this container exits; install again when a new session needs them. Your home directory belongs to this session: it survives `maesttro resume` but no other session sees it.",
+    "- System packages are unavailable: there is no root, `sudo` or `apt`. If a task needs one, tell the user which package and why.",
+    "",
     "## Pushing",
     "",
     "- `git push` does not work here: the runner has read-only access to the remote. This is deliberate.",
@@ -856,24 +2316,24 @@ function withoutComments(value) {
 }
 function applyProviderConfigs({
   home,
-  configsDir = join4(DOCKERFILE_DIR, "configs")
+  configsDir = join10(DOCKERFILE_DIR, "configs")
 }) {
   const written = [];
   for (const [key, client] of Object.entries(CLIENTS)) {
-    const source = join4(configsDir, key);
-    if (!existsSync2(source))
+    const source = join10(configsDir, key);
+    if (!existsSync3(source))
       continue;
-    const targetDir = join4(home, client.configDir.replace(/^\/home\/agent\/?/, ""));
-    for (const name of readdirSync(source)) {
+    const targetDir = join10(home, client.configDir.replace(/^\/home\/agent\/?/, ""));
+    for (const name of readdirSync3(source)) {
       if (!name.endsWith(".json"))
         continue;
-      const curated = withoutComments(readJson(join4(source, name)));
+      const curated = withoutComments(readJson(join10(source, name)));
       if (Object.keys(curated).length === 0)
         continue;
-      const target = join4(targetDir, name);
-      mkdirSync4(targetDir, { recursive: true });
+      const target = join10(targetDir, name);
+      mkdirSync9(targetDir, { recursive: true });
       const merged = mergeJson(readJson(target), curated);
-      writeFileSync4(target, `${JSON.stringify(merged, null, 2)}
+      writeFileSync9(target, `${JSON.stringify(merged, null, 2)}
 `);
       written.push(target);
     }
@@ -886,27 +2346,27 @@ function stageHostInstructions({
   context
 }) {
   for (const directory of STAGED_DIRECTORIES) {
-    const source = join4(staging, directory);
-    if (!existsSync2(source))
+    const source = join10(staging, directory);
+    if (!existsSync3(source))
       continue;
     try {
-      cpSync2(source, join4(home, directory), { recursive: true, force: true });
+      cpSync2(source, join10(home, directory), { recursive: true, force: true });
     } catch {}
   }
   const instructions = runnerInstructions(context);
   for (const file of INSTRUCTION_FILES) {
-    const source = join4(staging, file);
-    const hostCopy = existsSync2(source) ? readFileSync4(source, "utf8") : "";
-    const target = join4(home, file);
-    mkdirSync4(dirname5(target), { recursive: true });
-    writeFileSync4(target, hostCopy ? `${hostCopy.trimEnd()}
+    const source = join10(staging, file);
+    const hostCopy = existsSync3(source) ? readFileSync10(source, "utf8") : "";
+    const target = join10(home, file);
+    mkdirSync9(dirname6(target), { recursive: true });
+    writeFileSync9(target, hostCopy ? `${hostCopy.trimEnd()}
 
 ${instructions}` : instructions);
   }
 }
 function configure({
   home = homedir2(),
-  inRunner = existsSync2(RUNNER_MARKER),
+  inRunner = existsSync3(RUNNER_MARKER),
   env = process.env,
   staging = HOST_STAGING_DIR,
   clientConfigs
@@ -915,6 +2375,7 @@ function configure({
   if (!inRunner)
     return;
   installClientConfigs({ home, source: clientConfigs });
+  seedClaudeState({ home });
   injectOpencodeTuiState({ home });
   stageHostInstructions({
     home,
@@ -988,64 +2449,42 @@ async function revokeSessionToken(token, fetchImpl = fetch, apiUrl = githubApiUr
     await fetchImpl(new URL("/installation/token", apiUrl), {
       method: "DELETE",
       headers: {
-        Accept: "application/vnd.github+json",
-        Authorization: `Bearer ${token}`,
-        "User-Agent": "maesttro"
-      },
-      signal: AbortSignal.timeout(5000)
-    });
-  } catch {}
-}
-
-// src/host-identity.ts
-function hostIdentityEnv() {
-  if (typeof process.getuid !== "function" || typeof process.getgid !== "function") {
-    return {};
-  }
-  return {
-    MAESTTRO_HOST_UID: String(process.getuid()),
-    MAESTTRO_HOST_GID: String(process.getgid())
-  };
-}
-function hostIdentityFlags() {
-  return Object.entries(hostIdentityEnv()).map(([name, value]) => `-e ${name}=${value}`).join(" ");
-}
-
-// src/legacy-token.ts
-import { execSync } from "node:child_process";
-var LEGACY_HOSTS = "~/.config/gh/hosts.yml";
-var PURGE_LEGACY_TOKEN = [
-  `if [ -e ${LEGACY_HOSTS} ]; then rm -f ${LEGACY_HOSTS}; echo FOUND; fi`,
-  "git config --global --remove-section credential.https://github.com 2>/dev/null || true",
-  "git config --global --remove-section credential.https://gist.github.com 2>/dev/null || true"
-].join("; ");
-var DETECT_LEGACY_TOKEN = `if [ -e ${LEGACY_HOSTS} ]; then echo FOUND; else echo CLEAN; fi`;
-function inVolume(command) {
-  return execSync(`docker run --rm ${hostIdentityFlags()} -v ${VOLUME}:/home/agent ${IMAGE} "${command}"`).toString();
-}
-function purgeLegacyToken() {
-  return inVolume(PURGE_LEGACY_TOKEN).includes("FOUND");
-}
-function hasLegacyToken() {
-  return inVolume(DETECT_LEGACY_TOKEN).includes("FOUND");
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "User-Agent": "maesttro"
+      },
+      signal: AbortSignal.timeout(5000)
+    });
+  } catch {}
 }
-var REVOKE_NOTICE = "Removed a long-lived GitHub token that an older maesttro stored in the runner volume. Revoke it on GitHub too: https://github.com/settings/tokens?type=beta";
-function purgeLegacyTokenOnce({
-  config,
-  saveConfig,
-  purge = purgeLegacyToken,
-  announce
-}) {
-  if (config.legacyTokenPurged)
-    return;
-  if (purge())
-    announce(REVOKE_NOTICE);
-  saveConfig({ ...config, legacyTokenPurged: true });
+
+// src/network-probe.ts
+import { connect } from "node:net";
+async function reachable(host, port, {
+  timeoutMs = 2000,
+  connectImpl = connect
+} = {}) {
+  return new Promise((resolve) => {
+    const socket = connectImpl(port, host);
+    const timer = setTimeout(() => {
+      socket.destroy();
+      resolve(false);
+    }, timeoutMs);
+    socket.once("connect", () => {
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(true);
+    });
+    socket.once("error", () => {
+      clearTimeout(timer);
+      resolve(false);
+    });
+  });
 }
 
 // src/repo.ts
-import { appendFileSync, mkdirSync as mkdirSync5, realpathSync } from "node:fs";
-import { join as join5 } from "node:path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync10, realpathSync } from "node:fs";
+import { join as join11 } from "node:path";
 var MINIMUM_GIT = [2, 48];
 var WORKTREES_DIR = ".worktrees";
 
@@ -1088,7 +2527,7 @@ function repoRoot(run, cwd) {
     "--git-common-dir"
   ]).out;
   const root = realpathSync(top.out);
-  if (realpathSync(commonDir) !== join5(root, ".git")) {
+  if (realpathSync(commonDir) !== join11(root, ".git")) {
     throw new LaunchError("This is a git worktree. Run maesttro from the main checkout; each session gets its own isolated clone.");
   }
   if (realpathSync(cwd) !== root) {
@@ -1115,12 +2554,12 @@ function defaultBranch(run, root) {
   throw new LaunchError("Can't find the default branch of origin. Run `git remote set-head origin --auto`.");
 }
 function ensureWorktreesDir(run, root) {
-  mkdirSync5(join5(root, WORKTREES_DIR), { recursive: true });
+  mkdirSync10(join11(root, WORKTREES_DIR), { recursive: true });
   if (git(run, root, ["check-ignore", "-q", `${WORKTREES_DIR}/`]).ok)
     return;
-  const info = join5(root, ".git", "info");
-  mkdirSync5(info, { recursive: true });
-  appendFileSync(join5(info, "exclude"), `
+  const info = join11(root, ".git", "info");
+  mkdirSync10(info, { recursive: true });
+  appendFileSync2(join11(info, "exclude"), `
 ${WORKTREES_DIR}/
 `);
 }
@@ -1150,21 +2589,108 @@ function revision(run, root, rev) {
   return parsed.ok ? parsed.out : undefined;
 }
 
+// src/volume-migration.ts
+import { execSync } from "node:child_process";
+var LEGACY_HOSTS = "~/.config/gh/hosts.yml";
+var PURGE_LEGACY_TOKEN = [
+  `if [ -e ${LEGACY_HOSTS} ]; then rm -f ${LEGACY_HOSTS}; echo FOUND; fi`,
+  "git config --global --remove-section credential.https://github.com 2>/dev/null || true",
+  "git config --global --remove-section credential.https://gist.github.com 2>/dev/null || true"
+].join("; ");
+var REVOKE_NOTICE = "Removed a long-lived GitHub token that an older maesttro stored in the runner volume. Revoke it on GitHub too: https://github.com/settings/tokens?type=beta";
+var OLD_SESSIONS_RUNNING = `Old sessions still use ${LEGACY_VOLUME}; will move the Claude login once they exit.`;
+function dockerExec(command) {
+  try {
+    return execSync(command, { stdio: ["ignore", "pipe", "pipe"] }).toString();
+  } catch (error) {
+    const stderr = error?.stderr;
+    throw new Error(stderr ? stderr.toString().trim() : error.message);
+  }
+}
+function legacyVolumeExists({
+  exec = dockerExec
+} = {}) {
+  try {
+    exec(`docker volume inspect ${LEGACY_VOLUME}`);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && /no such volume/i.test(error.message)) {
+      return false;
+    }
+    throw error;
+  }
+}
+function dockerVolume({
+  exec = dockerExec
+} = {}) {
+  const inVolume = (command) => exec(`docker run --rm ${hostIdentityFlags()} -v ${LEGACY_VOLUME}:/home/agent ${IMAGE} "${command}"`);
+  return {
+    exists: () => legacyVolumeExists({ exec }),
+    inUse: () => exec(`docker ps -q --filter volume=${LEGACY_VOLUME}`).trim().length > 0,
+    readClaudeCredentials: () => {
+      const output = inVolume("cat ~/.claude/.credentials.json 2>/dev/null || echo null");
+      try {
+        return JSON.parse(output);
+      } catch {
+        return;
+      }
+    },
+    purgeGitHubToken: () => inVolume(PURGE_LEGACY_TOKEN).includes("FOUND")
+  };
+}
+function migrateFromVolumeOnce({
+  config,
+  saveConfig,
+  store,
+  volume = dockerVolume(),
+  announce
+}) {
+  if (config.volumeMigrated)
+    return;
+  try {
+    if (volume.exists()) {
+      if (!config.legacyTokenPurged && volume.purgeGitHubToken()) {
+        announce(REVOKE_NOTICE);
+      }
+      if (volume.inUse()) {
+        announce(OLD_SESSIONS_RUNNING);
+        saveConfig({ ...config, legacyTokenPurged: true });
+        return;
+      }
+      const credentials = volume.readClaudeCredentials();
+      if (!store.load() && isMasterLogin(credentials)) {
+        store.save(credentials);
+        announce(`Moved the runner's Claude login into ${store.kind}.`);
+      }
+      announce(`Sessions no longer use the shared ${LEGACY_VOLUME} volume. Remove it with \`docker volume rm ${LEGACY_VOLUME}\` once nothing runs.`);
+    }
+  } catch {
+    announce(`Couldn't check the legacy ${LEGACY_VOLUME} volume; will retry next launch.`);
+    return;
+  }
+  saveConfig({ ...config, volumeMigrated: true });
+}
+
 // src/doctor.ts
-async function check(label, probe) {
+class DoctorWarning extends Error {
+}
+async function check(label, probe, print = console.log) {
   try {
     const detail = await probe();
-    console.log(`  [ok]   ${label}${detail ? ` — ${detail}` : ""}`);
+    print(`  [ok]   ${label}${detail ? ` — ${detail}` : ""}`);
     return true;
   } catch (error) {
+    if (error instanceof DoctorWarning) {
+      print(`  [warn] ${label} — ${error.message}`);
+      return true;
+    }
     const reason = error instanceof Error && error.message ? error.message : "";
-    console.log(`  [fail] ${label}${reason ? ` — ${reason}` : ""}`);
+    print(`  [fail] ${label}${reason ? ` — ${reason}` : ""}`);
     return false;
   }
 }
-function inRunner(command, { withVolume = true } = {}) {
-  const volume = withVolume ? `-v ${VOLUME}:/home/agent ` : "";
-  return execSync2(`docker run --rm ${hostIdentityFlags()} ${volume}${IMAGE} "${command}"`).toString();
+function inRunner(command) {
+  return execSync2(`docker run --rm ${hostIdentityFlags()} ${IMAGE} "${command}"`).toString();
 }
 async function doctor() {
   console.log(`== maesttro doctor ==
@@ -1188,19 +2714,6 @@ async function doctor() {
       "Runner image built",
       () => `built ${execSync2(`docker image inspect ${IMAGE} --format "{{.Created}}"`).toString().trim()}`
     ],
-    [
-      "Persistent volume exists",
-      () => {
-        execSync2(`docker volume inspect ${VOLUME}`, { stdio: "ignore" });
-      }
-    ],
-    [
-      "No long-lived GitHub token in the volume",
-      () => {
-        if (hasLegacyToken())
-          throw new Error("run `maesttro setup` to remove it");
-      }
-    ],
     [
       "Logged in to GitHub",
       async () => {
@@ -1211,13 +2724,36 @@ async function doctor() {
           interactive: false
         });
         if (!token)
-          throw new Error("run `maesttro login`");
+          throw new Error("run `maesttro login github`");
         const name = await githubLogin(token.access_token);
         if (!name)
-          throw new Error("token rejected, run `maesttro login`");
+          throw new Error("token rejected, run `maesttro login github`");
         return name;
       }
     ],
+    [
+      "Logged in to Claude",
+      () => {
+        const credentials = claudeStore().load();
+        if (!credentials)
+          throw new Error("run `maesttro login claude`");
+        if (claudeLoginState({ credentials, now: Date.now() }) === "expired") {
+          throw new ClaudeLoginExpired;
+        }
+        const warning = claudeLoginWarning({ credentials, now: Date.now() });
+        if (warning)
+          throw new DoctorWarning(warning);
+        return `access token until ${new Date(credentials.claudeAiOauth.expiresAt).toLocaleString()}`;
+      }
+    ],
+    [
+      "Old shared volume removed",
+      () => {
+        if (legacyVolumeExists()) {
+          throw new Error(`docker volume rm ${LEGACY_VOLUME}`);
+        }
+      }
+    ],
     [
       "Token broker reachable",
       async () => {
@@ -1227,6 +2763,16 @@ async function doctor() {
         return broker;
       }
     ],
+    [
+      "dgx-spark reachable",
+      async () => {
+        const { hostname, port } = new URL(DGX_SPARK_URL);
+        if (!await reachable(hostname, Number(port))) {
+          throw new Error(`${DGX_SPARK_URL} (on the tailnet?)`);
+        }
+        return DGX_SPARK_URL;
+      }
+    ],
     [
       "Personal SSH key NOT visible inside runner (isolation intact)",
       () => {
@@ -1239,7 +2785,7 @@ async function doctor() {
     ...Object.values(CLIENTS).map((client) => [
       `Client available: ${client.label}`,
       () => {
-        inRunner(`which ${client.binary}`, { withVolume: false });
+        inRunner(`which ${client.binary}`);
       }
     ])
   ];
@@ -1263,7 +2809,9 @@ Usage:
   maesttro <client>        Same, with a specific client — see \`maesttro list\`
   maesttro --strict [client]
                           Same, in strict mode: no GitHub token reaches the runner, so \`gh\` is off
-  maesttro resume <id>     Continue a kept session in its clone, in the mode it started with
+  maesttro resume [client] <id>
+                          Continue a kept session in its clone, in the mode it started with,
+                          with its last client unless one is given
                           (\`--strict\` or \`--no-strict\` after the id changes it)
   maesttro sessions        List this repo's sessions
   maesttro sessions remove <id>
@@ -1274,74 +2822,35 @@ Usage:
   maesttro push [branch] [--force]
                           Push a branch a session created, after showing what goes out
   maesttro list            Show available clients
-  maesttro setup           One-time: build image, create volume, log in to GitHub
-  maesttro login           Log in to GitHub (device flow) so sessions get repo access
-  maesttro logout          Remove the stored GitHub credentials
-  maesttro status          Show GitHub login status
+  maesttro setup           One-time: build image, move off the old shared volume, log in to GitHub and Claude
+  maesttro login [github|claude]
+                          Log in to GitHub (device flow) and/or Claude; without a target, does both
+  maesttro logout [github|claude]
+                          Remove the stored credentials; without a target, does both
+  maesttro status [github|claude]
+                          Show login status; without a target, does both
   maesttro configure       Apply maesttro's client configs (also runs inside the runner)
   maesttro update          Update the package and rebuild the runner image with refreshed client configs
-  maesttro doctor          Health check — Docker, image, volume, GitHub login, broker, isolation, clients
+  maesttro doctor          Health check — Docker, image, GitHub and Claude logins, old volume gone, broker, isolation, clients
   maesttro help            Show this message
 `;
 
 // src/launch.ts
-import { execSync as execSync3, spawn, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync4, rmSync as rmSync6 } from "node:fs";
-import { constants, homedir as homedir4 } from "node:os";
-import { join as join11 } from "node:path";
+import { execSync as execSync3, spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync5, rmSync as rmSync9 } from "node:fs";
+import { constants as constants2, homedir as homedir3 } from "node:os";
+import { join as join15 } from "node:path";
 
 // src/backup.ts
 import { createHash } from "node:crypto";
-import { mkdirSync as mkdirSync7, readdirSync as readdirSync2, rmSync as rmSync3 } from "node:fs";
-import { basename, join as join7 } from "node:path";
-
-// src/maesttro-home.ts
-import {
-  appendFileSync as appendFileSync2,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync5,
-  renameSync as renameSync2,
-  writeFileSync as writeFileSync5
-} from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { join as join6 } from "node:path";
-function maesttroHome() {
-  return join6(homedir3(), ".config", "maesttro");
-}
-function configPath() {
-  return join6(maesttroHome(), "config.json");
-}
-function readMaesttroConfig() {
-  try {
-    return JSON.parse(readFileSync5(configPath(), "utf8"));
-  } catch {
-    return {};
-  }
-}
-function writeMaesttroConfig(config) {
-  mkdirSync6(maesttroHome(), { recursive: true, mode: 448 });
-  const temporary = `${configPath()}.tmp`;
-  writeFileSync5(temporary, `${JSON.stringify(config, null, 2)}
-`);
-  renameSync2(temporary, configPath());
-}
-function fileSessionLog(path = join6(maesttroHome(), "maesttro.log")) {
-  return (event, detail) => {
-    try {
-      mkdirSync6(maesttroHome(), { recursive: true, mode: 448 });
-      appendFileSync2(path, `${new Date().toISOString()} ${event}${detail ? ` ${detail}` : ""}
-`);
-    } catch {}
-  };
-}
-
-// src/backup.ts
+import { mkdirSync as mkdirSync11, readdirSync as readdirSync4, rmSync as rmSync7 } from "node:fs";
+import { basename, join as join12 } from "node:path";
 var BACKUPS_KEPT = 5;
 function shortHash(value) {
   return createHash("sha256").update(value).digest("hex").slice(0, 8);
 }
 function backupDir(repoRoot, home = maesttroHome()) {
-  return join7(home, "backups", `${basename(repoRoot)}-${shortHash(repoRoot)}`);
+  return join12(home, "backups", `${basename(repoRoot)}-${shortHash(repoRoot)}`);
 }
 function refsFingerprint(refs) {
   const sorted = Object.keys(refs).sort().map((ref) => `${ref} ${refs[ref]}`);
@@ -1359,119 +2868,41 @@ function backupRepo({
 }) {
   if (Object.keys(refs).length === 0)
     return;
-  mkdirSync7(dir, { recursive: true, mode: 448 });
+  mkdirSync11(dir, { recursive: true, mode: 448 });
   const fingerprint = refsFingerprint(refs);
-  const existing = readdirSync2(dir).filter((name) => name.endsWith(".bundle")).sort();
+  const existing = readdirSync4(dir).filter((name) => name.endsWith(".bundle")).sort();
   const latest = existing.at(-1);
   if (latest?.endsWith(`-${fingerprint}.bundle`)) {
-    return { path: join7(dir, latest), reused: true };
+    return { path: join12(dir, latest), reused: true };
   }
   const stamp = now.toISOString().replace(/[:.]/g, "-");
-  const path = join7(dir, `${stamp}-${sessionId}-${fingerprint}.bundle`);
+  const path = join12(dir, `${stamp}-${sessionId}-${fingerprint}.bundle`);
   if (!git(run, repoRoot, ["bundle", "create", "--quiet", path, "--all"]).ok) {
     return;
   }
   for (const stale of [...existing, basename(path)].sort().slice(0, -keep)) {
-    rmSync3(join7(dir, stale), { force: true });
+    rmSync7(join12(dir, stale), { force: true });
   }
   return { path, reused: false };
 }
 
-// src/refresher.ts
-var REFRESH_LEAD_MS = 10 * 60 * 1000;
-var WALL_CLOCK_TICK_MS = 60 * 1000;
-var FIRST_BACKOFF_MS = 5 * 1000;
-var MAX_BACKOFF_MS = 5 * 60 * 1000;
-var nodeTimers = {
-  setTimeout: (callback, ms) => setTimeout(callback, ms).unref(),
-  clearTimeout: (handle) => clearTimeout(handle),
-  setInterval: (callback, ms) => setInterval(callback, ms).unref(),
-  clearInterval: (handle) => clearInterval(handle)
-};
-function startRefresher({
-  initial,
-  refresh,
-  onRefreshed,
-  onFailed,
-  now = Date.now,
-  timers = nodeTimers
-}) {
-  let current = initial;
-  let nextAttemptAt = 0;
-  let backoffMs = FIRST_BACKOFF_MS;
-  let inFlight;
-  let stopped = false;
-  let pending;
-  function refreshDueAt(token) {
-    const expiresAt = Date.parse(token.expires_at);
-    const halfRemaining = (expiresAt - now()) / 2;
-    return expiresAt - Math.min(REFRESH_LEAD_MS, Math.max(halfRemaining, 0));
-  }
-  nextAttemptAt = refreshDueAt(initial);
-  function scheduleAt(at) {
-    timers.clearTimeout(pending);
-    pending = timers.setTimeout(check, Math.max(at - now(), 0));
-  }
-  async function attempt() {
-    try {
-      const token = await refresh();
-      if (stopped)
-        return;
-      current = token;
-      backoffMs = FIRST_BACKOFF_MS;
-      nextAttemptAt = refreshDueAt(token);
-      onRefreshed(token);
-    } catch (error) {
-      if (stopped)
-        return;
-      nextAttemptAt = now() + backoffMs;
-      onFailed(error, backoffMs);
-      backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
-    }
-    scheduleAt(nextAttemptAt);
-  }
-  function check() {
-    if (stopped)
-      return Promise.resolve();
-    if (inFlight)
-      return inFlight;
-    if (now() < nextAttemptAt)
-      return Promise.resolve();
-    inFlight = attempt().finally(() => {
-      inFlight = undefined;
-    });
-    return inFlight;
-  }
-  const tick = timers.setInterval(check, WALL_CLOCK_TICK_MS);
-  scheduleAt(nextAttemptAt);
-  return {
-    current: () => current,
-    check,
-    stop: () => {
-      stopped = true;
-      timers.clearTimeout(pending);
-      timers.clearInterval(tick);
-    }
-  };
-}
-
 // src/session-dir.ts
 import {
-  chmodSync as chmodSync3,
-  mkdirSync as mkdirSync8,
-  mkdtempSync as mkdtempSync2,
-  renameSync as renameSync3,
-  rmSync as rmSync4,
-  writeFileSync as writeFileSync6
+  chmodSync as chmodSync5,
+  mkdirSync as mkdirSync12,
+  mkdtempSync as mkdtempSync3,
+  renameSync as renameSync7,
+  rmSync as rmSync8,
+  writeFileSync as writeFileSync10
 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join8 } from "node:path";
+import { tmpdir as tmpdir3 } from "node:os";
+import { join as join13 } from "node:path";
 var CONTAINER_GH_CONFIG_DIR = "/home/agent/.config/gh-maesttro";
 function writeAtomically(path, content) {
   const temporary = `${path}.tmp`;
-  writeFileSync6(temporary, content, { mode: 420 });
-  chmodSync3(temporary, 420);
-  renameSync3(temporary, path);
+  writeFileSync10(temporary, content, { mode: 420 });
+  chmodSync5(temporary, 420);
+  renameSync7(temporary, path);
 }
 function hostsYaml(token, user) {
   return [
@@ -1483,20 +2914,20 @@ function hostsYaml(token, user) {
   ].join(`
 `);
 }
-function createSessionDir(parent = tmpdir2()) {
-  const root = mkdtempSync2(join8(parent, "maesttro-"));
-  chmodSync3(root, 448);
-  const ghDir = join8(root, "gh");
-  mkdirSync8(ghDir);
-  chmodSync3(ghDir, 493);
-  writeAtomically(join8(ghDir, "config.yml"), `version: "1"
+function createSessionDir(parent = tmpdir3()) {
+  const root = mkdtempSync3(join13(parent, "maesttro-"));
+  chmodSync5(root, 448);
+  const ghDir = join13(root, "gh");
+  mkdirSync12(ghDir);
+  chmodSync5(ghDir, 493);
+  writeAtomically(join13(ghDir, "config.yml"), `version: "1"
 `);
   return {
     ghDir,
-    writeToken: (token, user) => writeAtomically(join8(ghDir, "hosts.yml"), hostsYaml(token, user)),
-    writeStatus: (status) => writeAtomically(join8(ghDir, "status"), `${status}
+    writeToken: (token, user) => writeAtomically(join13(ghDir, "hosts.yml"), hostsYaml(token, user)),
+    writeStatus: (status) => writeAtomically(join13(ghDir, "status"), `${status}
 `),
-    remove: () => rmSync4(root, { recursive: true, force: true })
+    remove: () => rmSync8(root, { recursive: true, force: true })
   };
 }
 
@@ -1514,7 +2945,7 @@ function refusalNotice(code, repo) {
       return `${UNAVAILABLE}: your GitHub account cannot see ${repo} — ${WITHOUT}`;
     case "user_token_invalid":
     case "not_logged_in":
-      return `${UNAVAILABLE}: GitHub login expired, run \`maesttro login\` — ${WITHOUT}`;
+      return `${UNAVAILABLE}: GitHub login expired, run \`maesttro login github\` — ${WITHOUT}`;
     default:
       return `${UNAVAILABLE} (${code}) — ${WITHOUT}`;
   }
@@ -1601,6 +3032,7 @@ async function openGitHubSession({
   log("session.token_minted", `${repo} expires ${initial.expires_at}`);
   const refresher = startRefresher({
     initial,
+    expiresAtOf: (token) => Date.parse(token.expires_at),
     refresh: () => mint({ interactive: false }),
     onRefreshed: (token) => {
       publish(token);
@@ -1647,14 +3079,14 @@ function ask(question) {
 // src/session-clone.ts
 import {
   copyFileSync,
-  existsSync as existsSync3,
-  lstatSync,
-  mkdirSync as mkdirSync9,
-  readdirSync as readdirSync3,
-  readFileSync as readFileSync6,
-  writeFileSync as writeFileSync7
+  existsSync as existsSync4,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync13,
+  readdirSync as readdirSync5,
+  readFileSync as readFileSync11,
+  writeFileSync as writeFileSync11
 } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join14 } from "node:path";
 
 // src/sanitize.ts
 function stripControl(text) {
@@ -1666,6 +3098,14 @@ function stripControl(text) {
   }
   return out;
 }
+var ESC = String.fromCharCode(27);
+var BEL = String.fromCharCode(7);
+var ANSI = new RegExp(`${ESC}(?:\\[[0-9;?]*[a-zA-Z]|\\][^${BEL}]*${BEL})?`, "g");
+function cleanOutput(text) {
+  return text.split(`
+`).map((line) => stripControl(line.replace(ANSI, "")).replace(/\r+$/, "")).join(`
+`).trim();
+}
 var VALID_BRANCH = /^[A-Za-z0-9](?:[A-Za-z0-9._/-]*[A-Za-z0-9_-])?$/;
 function isSafeBranchName(name) {
   if (name.length === 0 || name.length > 255)
@@ -1733,27 +3173,27 @@ function createSessionClone(run, root, clonePath, baseSha) {
 }
 function realDir(path) {
   try {
-    return lstatSync(path).isDirectory();
+    return lstatSync4(path).isDirectory();
   } catch {
     return false;
   }
 }
 function dirents(dir) {
   try {
-    return readdirSync3(dir, { withFileTypes: true });
+    return readdirSync5(dir, { withFileTypes: true });
   } catch {
     return [];
   }
 }
 function cloneGitDir(clonePath) {
-  const gitDir = join9(clonePath, ".git");
+  const gitDir = join14(clonePath, ".git");
   return realDir(gitDir) ? gitDir : undefined;
 }
 function readSha(path) {
   try {
-    if (!lstatSync(path).isFile())
+    if (!lstatSync4(path).isFile())
       return;
-    const text = readFileSync6(path, "utf8").trim();
+    const text = readFileSync11(path, "utf8").trim();
     return SHA.test(text) ? text : undefined;
   } catch {
     return;
@@ -1763,7 +3203,7 @@ function packedRefs(gitDir) {
   const refs = new Map;
   let text;
   try {
-    text = readFileSync6(join9(gitDir, "packed-refs"), "utf8");
+    text = readFileSync11(join14(gitDir, "packed-refs"), "utf8");
   } catch {
     return refs;
   }
@@ -1788,12 +3228,12 @@ function cloneBranches(clonePath) {
         continue;
       const name = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory())
-        walk(join9(dir, entry.name), name);
+        walk(join14(dir, entry.name), name);
       else if (entry.isFile())
         names.add(name);
     }
   };
-  walk(join9(gitDir, "refs", "heads"), "");
+  walk(join14(gitDir, "refs", "heads"), "");
   for (const ref of packedRefs(gitDir).keys()) {
     if (ref.startsWith(HEADS_PREFIX))
       names.add(ref.slice(HEADS_PREFIX.length));
@@ -1806,7 +3246,7 @@ function branchTip(clonePath, branch) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
     return;
-  return readSha(join9(gitDir, "refs", "heads", branch)) ?? packedRefs(gitDir).get(`${HEADS_PREFIX}${branch}`);
+  return readSha(join14(gitDir, "refs", "heads", branch)) ?? packedRefs(gitDir).get(`${HEADS_PREFIX}${branch}`);
 }
 function cloneHead(clonePath) {
   const gitDir = cloneGitDir(clonePath);
@@ -1814,9 +3254,9 @@ function cloneHead(clonePath) {
     return;
   let text;
   try {
-    if (!lstatSync(join9(gitDir, "HEAD")).isFile())
+    if (!lstatSync4(join14(gitDir, "HEAD")).isFile())
       return;
-    text = readFileSync6(join9(gitDir, "HEAD"), "utf8").trim();
+    text = readFileSync11(join14(gitDir, "HEAD"), "utf8").trim();
   } catch {
     return;
   }
@@ -1837,29 +3277,29 @@ function copyObjectFiles(fromDir, intoDir) {
   for (const entry of dirents(fromDir)) {
     if (!entry.isFile())
       continue;
-    const dest = join9(intoDir, entry.name);
-    if (existsSync3(dest))
+    const dest = join14(intoDir, entry.name);
+    if (existsSync4(dest))
       continue;
     if (!created) {
-      mkdirSync9(intoDir, { recursive: true });
+      mkdirSync13(intoDir, { recursive: true });
       created = true;
     }
-    copyFileSync(join9(fromDir, entry.name), dest);
+    copyFileSync(join14(fromDir, entry.name), dest);
   }
 }
 function pinAlternates(clonePath, containerObjects) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
     return;
-  const objects = join9(gitDir, "objects");
-  const info = join9(objects, "info");
+  const objects = join14(gitDir, "objects");
+  const info = join14(objects, "info");
   if (!realDir(objects) || !realDir(info)) {
     throw new LaunchError(`Unsafe objects tree in the session clone: ${clonePath}`);
   }
-  const alternates = join9(info, "alternates");
+  const alternates = join14(info, "alternates");
   let stat;
   try {
-    stat = lstatSync(alternates);
+    stat = lstatSync4(alternates);
   } catch {
     return;
   }
@@ -1868,73 +3308,29 @@ function pinAlternates(clonePath, containerObjects) {
   }
   const desired = `${containerObjects}
 `;
-  if (readFileSync6(alternates, "utf8") !== desired) {
-    writeFileSync7(alternates, desired);
+  if (readFileSync11(alternates, "utf8") !== desired) {
+    writeFileSync11(alternates, desired);
   }
 }
 function importObjects(run, root, clonePath, tip) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
     return false;
-  const objects = join9(gitDir, "objects");
+  const objects = join14(gitDir, "objects");
   if (!realDir(objects))
     return false;
-  const into = join9(root, ".git", "objects");
+  const into = join14(root, ".git", "objects");
   for (const entry of dirents(objects)) {
     if (entry.name === "info" || entry.isSymbolicLink() || !entry.isDirectory()) {
       continue;
     }
     if (!OBJECT_SUBDIR.test(entry.name) && entry.name !== "pack")
       continue;
-    copyObjectFiles(join9(objects, entry.name), join9(into, entry.name));
+    copyObjectFiles(join14(objects, entry.name), join14(into, entry.name));
   }
   return git(run, root, ["cat-file", "-e", `${tip}^{commit}`]).ok;
 }
 
-// src/sessions.ts
-import { randomBytes } from "node:crypto";
-import {
-  mkdirSync as mkdirSync10,
-  readdirSync as readdirSync4,
-  readFileSync as readFileSync7,
-  renameSync as renameSync4,
-  rmSync as rmSync5,
-  writeFileSync as writeFileSync8
-} from "node:fs";
-import { join as join10 } from "node:path";
-function newSessionId() {
-  return `maesttro-${randomBytes(4).toString("hex")}`;
-}
-function sessionsDir(home = maesttroHome()) {
-  return join10(home, "sessions");
-}
-function saveSession(record, dir = sessionsDir()) {
-  mkdirSync10(dir, { recursive: true, mode: 448 });
-  const path = join10(dir, `${record.id}.json`);
-  writeFileSync8(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
-`);
-  renameSync4(`${path}.tmp`, path);
-}
-function readSession(id, dir = sessionsDir()) {
-  try {
-    return JSON.parse(readFileSync7(join10(dir, `${id}.json`), "utf8"));
-  } catch {
-    return;
-  }
-}
-function deleteSession(id, dir = sessionsDir()) {
-  rmSync5(join10(dir, `${id}.json`), { force: true });
-}
-function sessionsForRepo(repoRoot, dir = sessionsDir()) {
-  let names;
-  try {
-    names = readdirSync4(dir).filter((name) => name.endsWith(".json"));
-  } catch {
-    return [];
-  }
-  return names.map((name) => readSession(name.slice(0, -".json".length), dir)).filter((record) => record?.repoRoot === repoRoot).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
-}
-
 // src/workspace-git.ts
 var GITHUB_REMOTE = /^(?:https:\/\/(?:[^@/]+@)?github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?\/?$/;
 function githubRepoFromRemote(remote) {
@@ -1962,9 +3358,18 @@ function workspaceAuthor(run, workspace) {
 }
 
 // src/launch.ts
-var CONTAINER_REPO = "/workspace";
+var CONTAINER_REPO = CONTAINER_REPO_PATH;
 var CONTAINER_PACKAGE = "/opt/maesttro";
 var CONTAINER_GIT_OBJECTS = "/opt/maesttro-objects";
+function sessionClientArgs({
+  args,
+  session
+}) {
+  const chosen = args.length > 0 ? args : session.client ? [session.client] : [];
+  const [first] = chosen;
+  const client = first === undefined ? DEFAULT_CLIENT : isClientKey(first) ? first : undefined;
+  return { args: chosen, client };
+}
 function resolveCommand(args) {
   const [first, ...rest] = args;
   if (first === undefined)
@@ -1983,16 +3388,19 @@ function sessionMounts({
   hostHome,
   stagedPaths,
   clientConfigs,
-  sharedSkills
+  sharedSkills,
+  home,
+  claudeDir
 }) {
-  const objects = join11(repoRoot, ".git", "objects");
+  const objects = join15(repoRoot, ".git", "objects");
   const mounts = [
-    { host: VOLUME, container: "/home/agent", type: "volume" },
+    { host: home, container: "/home/agent" },
+    { host: claudeDir, container: "/home/agent/.claude" },
     { host: objects, container: CONTAINER_GIT_OBJECTS, readOnly: true },
     { host: sessionDir, container: CONTAINER_REPO },
     { host: packageRoot, container: CONTAINER_PACKAGE, readOnly: true },
     ...stagedPaths.map((path) => ({
-      host: join11(hostHome, path),
+      host: join15(hostHome, path),
       container: `${HOST_STAGING_DIR}/${path}`,
       readOnly: true
     })),
@@ -2018,9 +3426,9 @@ function dockerRunArgs({
   extra = [],
   name
 }) {
-  const volumes = mounts.flatMap(({ host, container, readOnly, type = "bind" }) => [
+  const volumes = mounts.flatMap(({ host, container, readOnly }) => [
     "--mount",
-    `type=${type},source=${host},target=${container}${readOnly ? ",readonly" : ""}`
+    `type=bind,source=${host},target=${container}${readOnly ? ",readonly" : ""}`
   ]);
   return [
     "run",
@@ -2049,17 +3457,54 @@ Default: ${DEFAULT_CLIENT}. Run \`maesttro <client>\` to pick one, or \`maesttro
 function ensureReady() {
   try {
     execSync3(`docker image inspect ${IMAGE}`, { stdio: "ignore" });
-    execSync3(`docker volume inspect ${VOLUME}`, { stdio: "ignore" });
   } catch {
     throw new LaunchError("Runner isn't set up yet. Run `maesttro setup` first.");
   }
 }
-function clearStaleContainer(id) {
-  spawnSync2("docker", ["rm", "-f", id], { stdio: "ignore" });
-}
+function clearStaleContainer(id) {
+  spawnSync3("docker", ["rm", "-f", id], { stdio: "ignore" });
+}
+async function establishClaudeCredentials({
+  claudeDir,
+  store,
+  refresh = refreshMaster,
+  onRotated = (credentials) => pushToRunningSessions({ credentials, claudeDir, announce }),
+  signals = processSignals,
+  announce,
+  now = Date.now
+}) {
+  const credentials = store.load();
+  if (credentials && claudeLoginState({ credentials, now: now() }) === "active" && isDue({ credentials, now: now() })) {
+    announce("Refreshing Claude login…");
+  }
+  try {
+    writeSessionCredentials({
+      claudeDir,
+      credentials: await refresh({ store, announce, onRotated, signals })
+    });
+    return {};
+  } catch (error) {
+    if (error instanceof ClaudeLoggedOut) {
+      announce(error.message);
+      removeHostWrittenCredentials({ claudeDir });
+      return { failure: error.message };
+    }
+    if (error instanceof ClaudeLoginExpired || error instanceof ClaudeRefreshFailed) {
+      announce(error.message);
+      const master = store.load();
+      if (master && master.claudeAiOauth.expiresAt > now()) {
+        writeSessionCredentials({ claudeDir, credentials: master });
+      } else if (error instanceof ClaudeLoginExpired) {
+        removeHostWrittenCredentials({ claudeDir });
+      }
+      return { failure: error.message };
+    }
+    throw error;
+  }
+}
 function sharedSkillsDir() {
-  const dir = process.env.AGENT_SHARED_SKILLS ?? join11(homedir4(), "agent-shared", "skills");
-  return existsSync4(dir) ? dir : undefined;
+  const dir = process.env.AGENT_SHARED_SKILLS ?? join15(homedir3(), "agent-shared", "skills");
+  return existsSync5(dir) ? dir : undefined;
 }
 async function resolveAuthor(workspace) {
   const fromRepo = workspaceAuthor(runCommand, workspace);
@@ -2088,7 +3533,7 @@ function startSession(run, root) {
   if (!baseSha)
     throw new LaunchError(`Can't resolve ${base}.`);
   const id = newSessionId();
-  const sessionDir = join11(root, WORKTREES_DIR, id);
+  const sessionDir = join15(root, WORKTREES_DIR, id);
   createSessionClone(run, root, sessionDir, baseSha);
   return {
     id,
@@ -2105,7 +3550,7 @@ function resumeSession(root, id) {
   if (!session || session.repoRoot !== root) {
     throw new LaunchError(`No session ${id} in this repo. See \`maesttro sessions\`.`);
   }
-  if (!existsSync4(session.worktree)) {
+  if (!existsSync5(session.worktree)) {
     throw new LaunchError(`The clone for ${id} is gone: ${session.worktree}`);
   }
   return session;
@@ -2128,13 +3573,13 @@ function preserveBranches(run, session) {
   return preserved;
 }
 function finishSession(run, session) {
-  if (!existsSync4(session.worktree)) {
+  if (!existsSync5(session.worktree)) {
     deleteSession(session.id);
     return;
   }
   const preserved = preserveBranches(run, session);
   if (!cloneHasWork(session.worktree, session.baseSha)) {
-    rmSync6(session.worktree, { recursive: true, force: true });
+    rmSync9(session.worktree, { recursive: true, force: true });
     deleteSession(session.id);
     return;
   }
@@ -2163,9 +3608,45 @@ function runnerGitHubMode({
 function exitCodeOf(code, signal) {
   if (code !== null)
     return code;
-  return signal ? 128 + (constants.signals[signal] ?? 0) : 1;
+  return signal ? 128 + (constants2.signals[signal] ?? 0) : 1;
 }
 var FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+var ABANDON_GRACE_MS = 3000;
+function closeSession({
+  run,
+  session
+}) {
+  try {
+    finishSession(run, session);
+  } catch (error) {
+    console.log(`
+Couldn't clean up session ${session.id}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function claudeNoticeSink({
+  log,
+  print = (message) => console.log(message)
+}) {
+  let quiet = false;
+  let unseen;
+  return {
+    announce: (message) => {
+      if (!quiet)
+        return print(message);
+      log("claude.notice", message);
+      unseen = message;
+    },
+    quiet: () => {
+      quiet = true;
+    },
+    replay: () => {
+      if (unseen)
+        print(`
+${unseen}`);
+      unseen = undefined;
+    }
+  };
+}
 async function launch({
   args,
   resume,
@@ -2175,9 +3656,10 @@ async function launch({
   ensureReady();
   requireGit(run);
   const root = repoRoot(run, process.cwd());
-  purgeLegacyTokenOnce({
+  migrateFromVolumeOnce({
     config: readMaesttroConfig(),
     saveConfig: writeMaesttroConfig,
+    store: claudeStore(),
     announce: (message) => console.log(message)
   });
   const started = resume ? resumeSession(root, resume) : startSession(run, root);
@@ -2188,13 +3670,55 @@ async function launch({
     sessionId: started.id
   });
   const strict = isStrict(requestedStrict, started);
+  const client = sessionClientArgs({ args, session: started });
   const saved = {
     ...started,
     backup: started.backup ?? backup?.path,
-    strict
+    strict,
+    client: client.client ?? started.client
   };
   saveSession(saved);
+  let github;
+  let claudeRefresher;
+  let clientConfigDir;
+  let abandoning = false;
+  const interrupts = signalRouter({
+    onUnrouted: async (signal) => {
+      const code = exitCodeOf(null, signal);
+      if (abandoning)
+        process.exit(code);
+      abandoning = true;
+      console.log(`
+Interrupted; cleaning up session ${saved.id}…`);
+      claudeRefresher?.stop();
+      clientConfigDir?.remove();
+      if (github) {
+        await Promise.race([
+          github.close(),
+          new Promise((resolve) => setTimeout(resolve, ABANDON_GRACE_MS))
+        ]);
+      }
+      closeSession({ run, session: saved });
+      process.exit(code);
+    }
+  });
   console.log(`Session ${saved.id}${strict ? " (strict)" : ""}: clone .worktrees/${saved.id} at ${saved.base}${backup ? `, backup ${backup.reused ? "reused" : "written"}` : ""}.`);
+  const { home, claudeDir } = ensureSessionHome({ id: saved.id });
+  const claude = claudeStore();
+  const sessionLog = fileSessionLog();
+  const claudeNotices = claudeNoticeSink({ log: sessionLog });
+  const { failure } = await establishClaudeCredentials({
+    claudeDir,
+    store: claude,
+    announce: claudeNotices.announce,
+    signals: interrupts
+  });
+  claudeRefresher = startClaudeRefresher({
+    claudeDir,
+    store: claude,
+    announce: claudeNotices.announce,
+    launchFailure: failure
+  });
   const repo = workspaceRepo(run, root);
   if (repo && !resume) {
     git(run, saved.worktree, [
@@ -2204,7 +3728,7 @@ async function launch({
       `https://github.com/${repo}.git`
     ]);
   }
-  const github = await openGitHubSession({
+  github = await openGitHubSession({
     repo,
     author: await resolveAuthor(root),
     strict,
@@ -2214,11 +3738,11 @@ async function launch({
       store: selectCredentialStore(),
       announce: (message) => console.log(message)
     },
-    log: fileSessionLog()
+    log: sessionLog
   });
   if (github.notice)
     console.log(github.notice);
-  const hostHome = homedir4();
+  const hostHome = homedir3();
   const url = maesttroUrl();
   const orchestratorWindow = await fetchOrchestratorWindow({ url });
   if (orchestratorWindow === undefined) {
@@ -2232,15 +3756,17 @@ async function launch({
   if (clientConfigs.removed.length > 0) {
     console.log(`Kept out of the runner as secrets: ${clientConfigs.removed.join(", ")}`);
   }
-  const clientConfigDir = writeClientConfigDir(clientConfigs.files);
+  clientConfigDir = writeClientConfigDir(clientConfigs.files);
   const { mounts, workdir } = sessionMounts({
     repoRoot: root,
     sessionDir: saved.worktree,
     packageRoot: PACKAGE_ROOT,
     hostHome,
-    stagedPaths: STAGED_PATHS.filter((path) => existsSync4(join11(hostHome, path))),
+    stagedPaths: STAGED_PATHS.filter((path) => existsSync5(join15(hostHome, path))),
     clientConfigs: clientConfigDir.dir,
-    sharedSkills: sharedSkillsDir()
+    sharedSkills: sharedSkillsDir(),
+    home,
+    claudeDir
   });
   const sessionEnv = {
     ...github.env,
@@ -2259,13 +3785,15 @@ async function launch({
   ].concat(repo ? ["MAESTTRO_REPO"] : []).flatMap((name) => ["-e", name]);
   clearStaleContainer(saved.id);
   pinAlternates(saved.worktree, CONTAINER_GIT_OBJECTS);
-  const child = spawn("docker", dockerRunArgs({
-    command: containerCommand(resolveCommand(args)),
+  const child = spawn2("docker", dockerRunArgs({
+    command: containerCommand(resolveCommand(client.args)),
     mounts,
     workdir,
     name: saved.id,
     extra: [...github.dockerArgs, ...envFlags]
   }), { stdio: "inherit", env: { ...process.env, ...sessionEnv } });
+  interrupts.dispose();
+  claudeNotices.quiet();
   const forward = (signal) => child.kill(signal);
   for (const signal of FORWARDED_SIGNALS)
     process.on(signal, forward);
@@ -2276,13 +3804,1035 @@ async function launch({
   for (const signal of FORWARDED_SIGNALS)
     process.off(signal, forward);
   await github.close();
+  if (claudeRefresher?.busy())
+    console.log(`
+${FINISHING_BACKGROUND_REFRESH}`);
+  await claudeRefresher?.stop();
+  claudeNotices.replay();
   clientConfigDir.remove();
-  finishSession(run, saved);
+  closeSession({ run, session: saved });
   process.exit(exitCode);
 }
 
 // src/push.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
+
+// ../node_modules/.bun/@clack+core@1.5.1/node_modules/@clack/core/dist/index.mjs
+import { stdout, stdin } from "node:process";
+import * as l from "node:readline";
+import l__default from "node:readline";
+
+// ../node_modules/.bun/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/utils.js
+var getCodePointsLength = (() => {
+  const SURROGATE_PAIR_RE = /[\uD800-\uDBFF][\uDC00-\uDFFF]/g;
+  return (input) => {
+    let surrogatePairsNr = 0;
+    SURROGATE_PAIR_RE.lastIndex = 0;
+    while (SURROGATE_PAIR_RE.test(input)) {
+      surrogatePairsNr += 1;
+    }
+    return input.length - surrogatePairsNr;
+  };
+})();
+var isFullWidth = (x) => {
+  return x === 12288 || x >= 65281 && x <= 65376 || x >= 65504 && x <= 65510;
+};
+var isWideNotCJKTNotEmoji = (x) => {
+  return x === 8987 || x === 9001 || x >= 12272 && x <= 12287 || x >= 12289 && x <= 12350 || x >= 12441 && x <= 12543 || x >= 12549 && x <= 12591 || x >= 12593 && x <= 12686 || x >= 12688 && x <= 12771 || x >= 12783 && x <= 12830 || x >= 12832 && x <= 12871 || x >= 12880 && x <= 19903 || x >= 65040 && x <= 65049 || x >= 65072 && x <= 65106 || x >= 65108 && x <= 65126 || x >= 65128 && x <= 65131 || x >= 127488 && x <= 127490 || x >= 127504 && x <= 127547 || x >= 127552 && x <= 127560 || x >= 131072 && x <= 196605 || x >= 196608 && x <= 262141;
+};
+
+// ../node_modules/.bun/fast-string-truncated-width@3.0.3/node_modules/fast-string-truncated-width/dist/index.js
+var ANSI_RE = /[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]|\u001b\]8;[^;]*;.*?(?:\u0007|\u001b\u005c)/y;
+var CONTROL_RE = /[\x00-\x08\x0A-\x1F\x7F-\x9F]{1,1000}/y;
+var CJKT_WIDE_RE = /(?:(?![\uFF61-\uFF9F\uFF00-\uFFEF])[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Tangut}]){1,1000}/yu;
+var TAB_RE = /\t{1,1000}/y;
+var EMOJI_RE = /[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[\u{E0061}-\u{E007A}]{2}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{1,3}\u{E007F}|(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation})(?:\u200D(?:\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|\p{Emoji_Presentation}|\p{Emoji}\uFE0F\u20E3?))*/yu;
+var LATIN_RE = /(?:[\x20-\x7E\xA0-\xFF](?!\uFE0F)){1,1000}/y;
+var MODIFIER_RE = /\p{M}+/gu;
+var NO_TRUNCATION = { limit: Infinity, ellipsis: "" };
+var getStringTruncatedWidth = (input, truncationOptions = {}, widthOptions = {}) => {
+  const LIMIT = truncationOptions.limit ?? Infinity;
+  const ELLIPSIS = truncationOptions.ellipsis ?? "";
+  const ELLIPSIS_WIDTH = truncationOptions?.ellipsisWidth ?? (ELLIPSIS ? getStringTruncatedWidth(ELLIPSIS, NO_TRUNCATION, widthOptions).width : 0);
+  const ANSI_WIDTH = 0;
+  const CONTROL_WIDTH = widthOptions.controlWidth ?? 0;
+  const TAB_WIDTH = widthOptions.tabWidth ?? 8;
+  const EMOJI_WIDTH = widthOptions.emojiWidth ?? 2;
+  const FULL_WIDTH_WIDTH = 2;
+  const REGULAR_WIDTH = widthOptions.regularWidth ?? 1;
+  const WIDE_WIDTH = widthOptions.wideWidth ?? FULL_WIDTH_WIDTH;
+  const PARSE_BLOCKS = [
+    [LATIN_RE, REGULAR_WIDTH],
+    [ANSI_RE, ANSI_WIDTH],
+    [CONTROL_RE, CONTROL_WIDTH],
+    [TAB_RE, TAB_WIDTH],
+    [EMOJI_RE, EMOJI_WIDTH],
+    [CJKT_WIDE_RE, WIDE_WIDTH]
+  ];
+  let indexPrev = 0;
+  let index = 0;
+  let length = input.length;
+  let lengthExtra = 0;
+  let truncationEnabled = false;
+  let truncationIndex = length;
+  let truncationLimit = Math.max(0, LIMIT - ELLIPSIS_WIDTH);
+  let unmatchedStart = 0;
+  let unmatchedEnd = 0;
+  let width = 0;
+  let widthExtra = 0;
+  outer:
+    while (true) {
+      if (unmatchedEnd > unmatchedStart || index >= length && index > indexPrev) {
+        const unmatched = input.slice(unmatchedStart, unmatchedEnd) || input.slice(indexPrev, index);
+        lengthExtra = 0;
+        for (const char of unmatched.replaceAll(MODIFIER_RE, "")) {
+          const codePoint = char.codePointAt(0) || 0;
+          if (isFullWidth(codePoint)) {
+            widthExtra = FULL_WIDTH_WIDTH;
+          } else if (isWideNotCJKTNotEmoji(codePoint)) {
+            widthExtra = WIDE_WIDTH;
+          } else {
+            widthExtra = REGULAR_WIDTH;
+          }
+          if (width + widthExtra > truncationLimit) {
+            truncationIndex = Math.min(truncationIndex, Math.max(unmatchedStart, indexPrev) + lengthExtra);
+          }
+          if (width + widthExtra > LIMIT) {
+            truncationEnabled = true;
+            break outer;
+          }
+          lengthExtra += char.length;
+          width += widthExtra;
+        }
+        unmatchedStart = unmatchedEnd = 0;
+      }
+      if (index >= length) {
+        break outer;
+      }
+      for (let i = 0, l = PARSE_BLOCKS.length;i < l; i++) {
+        const [BLOCK_RE, BLOCK_WIDTH] = PARSE_BLOCKS[i];
+        BLOCK_RE.lastIndex = index;
+        if (BLOCK_RE.test(input)) {
+          lengthExtra = BLOCK_RE === CJKT_WIDE_RE ? getCodePointsLength(input.slice(index, BLOCK_RE.lastIndex)) : BLOCK_RE === EMOJI_RE ? 1 : BLOCK_RE.lastIndex - index;
+          widthExtra = lengthExtra * BLOCK_WIDTH;
+          if (width + widthExtra > truncationLimit) {
+            truncationIndex = Math.min(truncationIndex, index + Math.floor((truncationLimit - width) / BLOCK_WIDTH));
+          }
+          if (width + widthExtra > LIMIT) {
+            truncationEnabled = true;
+            break outer;
+          }
+          width += widthExtra;
+          unmatchedStart = indexPrev;
+          unmatchedEnd = index;
+          index = indexPrev = BLOCK_RE.lastIndex;
+          continue outer;
+        }
+      }
+      index += 1;
+    }
+  return {
+    width: truncationEnabled ? truncationLimit : width,
+    index: truncationEnabled ? truncationIndex : length,
+    truncated: truncationEnabled,
+    ellipsed: truncationEnabled && LIMIT >= ELLIPSIS_WIDTH
+  };
+};
+var dist_default = getStringTruncatedWidth;
+
+// ../node_modules/.bun/fast-string-width@3.0.2/node_modules/fast-string-width/dist/index.js
+var NO_TRUNCATION2 = {
+  limit: Infinity,
+  ellipsis: "",
+  ellipsisWidth: 0
+};
+var fastStringWidth = (input, options = {}) => {
+  return dist_default(input, NO_TRUNCATION2, options).width;
+};
+var dist_default2 = fastStringWidth;
+
+// ../node_modules/.bun/fast-wrap-ansi@0.2.2/node_modules/fast-wrap-ansi/lib/main.js
+var ESC2 = "\x1B";
+var CSI = "›";
+var END_CODE = 39;
+var ANSI_ESCAPE_BELL = "\x07";
+var ANSI_CSI = "[";
+var ANSI_OSC = "]";
+var ANSI_SGR_TERMINATOR = "m";
+var ANSI_ESCAPE_LINK = `${ANSI_OSC}8;;`;
+var GROUP_REGEX = new RegExp(`(?:\\${ANSI_CSI}(?<code>\\d+)m|\\${ANSI_ESCAPE_LINK}(?<uri>.*)${ANSI_ESCAPE_BELL})`, "y");
+var getClosingCode = (openingCode) => {
+  if (openingCode >= 30 && openingCode <= 37)
+    return 39;
+  if (openingCode >= 90 && openingCode <= 97)
+    return 39;
+  if (openingCode >= 40 && openingCode <= 47)
+    return 49;
+  if (openingCode >= 100 && openingCode <= 107)
+    return 49;
+  if (openingCode === 1 || openingCode === 2)
+    return 22;
+  if (openingCode === 3)
+    return 23;
+  if (openingCode === 4)
+    return 24;
+  if (openingCode === 7)
+    return 27;
+  if (openingCode === 8)
+    return 28;
+  if (openingCode === 9)
+    return 29;
+  if (openingCode === 0)
+    return 0;
+  return;
+};
+var wrapAnsiCode = (code) => `${ESC2}${ANSI_CSI}${code}${ANSI_SGR_TERMINATOR}`;
+var wrapAnsiHyperlink = (url) => `${ESC2}${ANSI_ESCAPE_LINK}${url}${ANSI_ESCAPE_BELL}`;
+var wrapWord = (rows, word, columns) => {
+  const characters = word[Symbol.iterator]();
+  let isInsideEscape = false;
+  let isInsideLinkEscape = false;
+  let lastRow = rows.at(-1);
+  let visible = lastRow === undefined ? 0 : dist_default2(lastRow);
+  let currentCharacter = characters.next();
+  let nextCharacter = characters.next();
+  let rawCharacterIndex = 0;
+  while (!currentCharacter.done) {
+    const character = currentCharacter.value;
+    const characterLength = dist_default2(character);
+    if (visible + characterLength <= columns) {
+      rows[rows.length - 1] += character;
+    } else {
+      rows.push(character);
+      visible = 0;
+    }
+    if (character === ESC2 || character === CSI) {
+      isInsideEscape = true;
+      isInsideLinkEscape = word.startsWith(ANSI_ESCAPE_LINK, rawCharacterIndex + 1);
+    }
+    if (isInsideEscape) {
+      if (isInsideLinkEscape) {
+        if (character === ANSI_ESCAPE_BELL) {
+          isInsideEscape = false;
+          isInsideLinkEscape = false;
+        }
+      } else if (character === ANSI_SGR_TERMINATOR) {
+        isInsideEscape = false;
+      }
+    } else {
+      visible += characterLength;
+      if (visible === columns && !nextCharacter.done) {
+        rows.push("");
+        visible = 0;
+      }
+    }
+    currentCharacter = nextCharacter;
+    nextCharacter = characters.next();
+    rawCharacterIndex += character.length;
+  }
+  lastRow = rows.at(-1);
+  if (!visible && lastRow !== undefined && lastRow.length && rows.length > 1) {
+    rows[rows.length - 2] += rows.pop();
+  }
+};
+var stringVisibleTrimSpacesRight = (string) => {
+  const words = string.split(" ");
+  let last = words.length;
+  while (last) {
+    if (dist_default2(words[last - 1])) {
+      break;
+    }
+    last--;
+  }
+  if (last === words.length) {
+    return string;
+  }
+  return words.slice(0, last).join(" ") + words.slice(last).join("");
+};
+var exec = (string, columns, options = {}) => {
+  if (options.trim !== false && string.trim() === "") {
+    return "";
+  }
+  let returnValue = "";
+  let escapeCode;
+  let escapeUrl;
+  const words = string.split(" ");
+  let rows = [""];
+  let rowLength = 0;
+  for (let index = 0;index < words.length; index++) {
+    const word = words[index];
+    if (options.trim !== false) {
+      const row = rows.at(-1) ?? "";
+      const trimmed = row.trimStart();
+      if (row.length !== trimmed.length) {
+        rows[rows.length - 1] = trimmed;
+        rowLength = dist_default2(trimmed);
+      }
+    }
+    if (index !== 0) {
+      if (rowLength >= columns && (options.wordWrap === false || options.trim === false)) {
+        rows.push("");
+        rowLength = 0;
+      }
+      if (rowLength || options.trim === false) {
+        rows[rows.length - 1] += " ";
+        rowLength++;
+      }
+    }
+    const wordLength = dist_default2(word);
+    if (options.hard && wordLength > columns) {
+      const remainingColumns = columns - rowLength;
+      const breaksStartingThisLine = 1 + Math.floor((wordLength - remainingColumns - 1) / columns);
+      const breaksStartingNextLine = Math.floor((wordLength - 1) / columns);
+      if (breaksStartingNextLine < breaksStartingThisLine) {
+        rows.push("");
+      }
+      wrapWord(rows, word, columns);
+      rowLength = dist_default2(rows.at(-1) ?? "");
+      continue;
+    }
+    if (rowLength + wordLength > columns && rowLength && wordLength) {
+      if (options.wordWrap === false && rowLength < columns) {
+        wrapWord(rows, word, columns);
+        rowLength = dist_default2(rows.at(-1) ?? "");
+        continue;
+      }
+      rows.push("");
+      rowLength = 0;
+    }
+    if (rowLength + wordLength > columns && options.wordWrap === false) {
+      wrapWord(rows, word, columns);
+      rowLength = dist_default2(rows.at(-1) ?? "");
+      continue;
+    }
+    rows[rows.length - 1] += word;
+    rowLength += wordLength;
+  }
+  if (options.trim !== false) {
+    rows = rows.map((row) => stringVisibleTrimSpacesRight(row));
+  }
+  const preString = rows.join(`
+`);
+  let inSurrogate = false;
+  for (let i = 0;i < preString.length; i++) {
+    const character = preString[i];
+    returnValue += character;
+    if (!inSurrogate) {
+      inSurrogate = character >= "\uD800" && character <= "\uDBFF";
+      if (inSurrogate) {
+        continue;
+      }
+    } else {
+      inSurrogate = false;
+    }
+    if (character === ESC2 || character === CSI) {
+      GROUP_REGEX.lastIndex = i + 1;
+      const groupsResult = GROUP_REGEX.exec(preString);
+      const groups = groupsResult?.groups;
+      if (groups?.code !== undefined) {
+        const code = Number.parseFloat(groups.code);
+        escapeCode = code === END_CODE ? undefined : code;
+      } else if (groups?.uri !== undefined) {
+        escapeUrl = groups.uri.length === 0 ? undefined : groups.uri;
+      }
+    }
+    if (preString[i + 1] === `
+`) {
+      if (escapeUrl) {
+        returnValue += wrapAnsiHyperlink("");
+      }
+      const closingCode = escapeCode ? getClosingCode(escapeCode) : undefined;
+      if (escapeCode && closingCode) {
+        returnValue += wrapAnsiCode(closingCode);
+      }
+    } else if (character === `
+`) {
+      if (escapeCode && getClosingCode(escapeCode)) {
+        returnValue += wrapAnsiCode(escapeCode);
+      }
+      if (escapeUrl) {
+        returnValue += wrapAnsiHyperlink(escapeUrl);
+      }
+    }
+  }
+  return returnValue;
+};
+var CRLF_OR_LF = /\r?\n/;
+function wrapAnsi(string, columns, options) {
+  return String(string).normalize().split(CRLF_OR_LF).map((line) => exec(line, columns, options)).join(`
+`);
+}
+
+// ../node_modules/.bun/@clack+core@1.5.1/node_modules/@clack/core/dist/index.mjs
+var import_sisteransi = __toESM(require_src(), 1);
+import { ReadStream } from "node:tty";
+function findCursor(s, o, l) {
+  if (!l.some((r) => !r.disabled))
+    return s;
+  const t = s + o, n = Math.max(l.length - 1, 0), e = t < 0 ? n : t > n ? 0 : t;
+  return l[e]?.disabled ? findCursor(e, o < 0 ? -1 : 1, l) : e;
+}
+var a$1 = ["up", "down", "left", "right", "space", "enter", "cancel"];
+var t = [
+  "January",
+  "February",
+  "March",
+  "April",
+  "May",
+  "June",
+  "July",
+  "August",
+  "September",
+  "October",
+  "November",
+  "December"
+];
+var settings = {
+  actions: new Set(a$1),
+  aliases: /* @__PURE__ */ new Map([
+    ["k", "up"],
+    ["j", "down"],
+    ["h", "left"],
+    ["l", "right"],
+    ["\x03", "cancel"],
+    ["escape", "cancel"]
+  ]),
+  messages: {
+    cancel: "Canceled",
+    error: "Something went wrong"
+  },
+  withGuide: true,
+  accessible: undefined,
+  date: {
+    monthNames: [...t],
+    messages: {
+      required: "Please enter a valid date",
+      invalidMonth: "There are only 12 months in a year",
+      invalidDay: (n, e) => `There are only ${n} days in ${e}`,
+      afterMin: (n) => `Date must be on or after ${n.toISOString().slice(0, 10)}`,
+      beforeMax: (n) => `Date must be on or before ${n.toISOString().slice(0, 10)}`
+    }
+  }
+};
+function isAccessible(n) {
+  if (n !== undefined)
+    return n;
+  if (settings.accessible !== undefined)
+    return settings.accessible;
+  const e = process.env.ACCESSIBLE;
+  return e !== undefined && e !== "" && e !== "0" && e !== "false";
+}
+function isActionKey(n, e) {
+  if (typeof n == "string")
+    return settings.aliases.get(n) === e;
+  for (const s of n)
+    if (s !== undefined && isActionKey(s, e))
+      return true;
+  return false;
+}
+function diffLines(i, s) {
+  if (i === s)
+    return;
+  const e = i.split(`
+`), t = s.split(`
+`), r = Math.max(e.length, t.length), f = [];
+  for (let n = 0;n < r; n++)
+    e[n] !== t[n] && f.push(n);
+  return {
+    lines: f,
+    numLinesBefore: e.length,
+    numLinesAfter: t.length,
+    numLines: r
+  };
+}
+var R = globalThis.process.platform.startsWith("win");
+var CANCEL_SYMBOL = Symbol("clack:cancel");
+function isCancel(e) {
+  return e === CANCEL_SYMBOL;
+}
+function setRawMode(e, r) {
+  const o = e;
+  o.isTTY && o.setRawMode(r);
+}
+function block({
+  input: e = stdin,
+  output: r = stdout,
+  overwrite: o = true,
+  hideCursor: n = true
+} = {}) {
+  const s = l.createInterface({
+    input: e,
+    output: r,
+    prompt: "",
+    tabSize: 1
+  });
+  l.emitKeypressEvents(e, s), e instanceof ReadStream && e.isTTY && e.setRawMode(true);
+  const t = (f, { name: a, sequence: w }) => {
+    const c = String(f);
+    if (isActionKey([c, a, w], "cancel")) {
+      n && r.write(import_sisteransi.cursor.show), process.exit(0);
+      return;
+    }
+    if (!o)
+      return;
+    const i = a === "return" ? 0 : -1, m = a === "return" ? -1 : 0;
+    l.moveCursor(r, i, m, () => {
+      l.clearLine(r, 1, () => {
+        e.once("keypress", t);
+      });
+    });
+  };
+  return n && r.write(import_sisteransi.cursor.hide), e.once("keypress", t), () => {
+    e.off("keypress", t), n && r.write(import_sisteransi.cursor.show), e instanceof ReadStream && e.isTTY && !R && e.setRawMode(false), s.terminal = false, s.close();
+  };
+}
+var getColumns = (e) => ("columns" in e) && typeof e.columns == "number" ? e.columns : 80;
+var getRows = (e) => ("rows" in e) && typeof e.rows == "number" ? e.rows : 20;
+function wrapTextWithPrefix(e, r, o, n = o, s = o, t) {
+  const f = getColumns(e ?? stdout);
+  return wrapAnsi(r, f - o.length, {
+    hard: true,
+    trim: false
+  }).split(`
+`).map((c, i, m) => {
+    const d = t ? t(c, i) : c;
+    return i === 0 ? `${n}${d}` : i === m.length - 1 ? `${s}${d}` : `${o}${d}`;
+  }).join(`
+`);
+}
+function runValidation(e, a) {
+  if ("~standard" in e) {
+    const n = e["~standard"].validate(a);
+    return n instanceof Promise ? n.then((r) => r.issues?.at(0)?.message) : n.issues?.at(0)?.message;
+  }
+  return e(a);
+}
+
+class y {
+  input;
+  output;
+  _abortSignal;
+  rl;
+  opts;
+  _render;
+  _track = false;
+  _prevFrame = "";
+  _subscribers = /* @__PURE__ */ new Map;
+  _cursor = 0;
+  state = "initial";
+  error = "";
+  value;
+  userInput = "";
+  get accessible() {
+    return isAccessible(this.opts.accessible);
+  }
+  constructor(t, e = true) {
+    const { input: i = stdin, output: s = stdout, render: r, signal: n, ...o } = t;
+    this.opts = o, this.onKeypress = this.onKeypress.bind(this), this.close = this.close.bind(this), this.render = this.render.bind(this), this._render = r.bind(this), this._track = e, this._abortSignal = n, this.input = i, this.output = s;
+  }
+  unsubscribe() {
+    this._subscribers.clear();
+  }
+  setSubscriber(t, e) {
+    const i = this._subscribers.get(t) ?? [];
+    i.push(e), this._subscribers.set(t, i);
+  }
+  on(t, e) {
+    this.setSubscriber(t, { cb: e });
+  }
+  once(t, e) {
+    this.setSubscriber(t, { cb: e, once: true });
+  }
+  emit(t, ...e) {
+    const i = this._subscribers.get(t) ?? [], s = [];
+    for (const r of i)
+      r.cb(...e), r.once && s.push(() => i.splice(i.indexOf(r), 1));
+    for (const r of s)
+      r();
+  }
+  prompt() {
+    return new Promise((t) => {
+      if (this._abortSignal) {
+        if (this._abortSignal.aborted)
+          return this.state = "cancel", this.close(), t(CANCEL_SYMBOL);
+        this._abortSignal.addEventListener("abort", () => {
+          this.state = "cancel", this.close();
+        }, { once: true });
+      }
+      this.rl = l__default.createInterface({
+        input: this.input,
+        tabSize: 2,
+        prompt: "",
+        escapeCodeTimeout: 50,
+        terminal: true
+      }), this.rl.prompt(), this.opts.initialUserInput !== undefined && this._setUserInput(this.opts.initialUserInput, true), this.input.on("keypress", this.onKeypress), setRawMode(this.input, true), this.output.on("resize", this.render), this.render(), this.once("submit", () => {
+        this.output.write(import_sisteransi.cursor.show), this.output.off("resize", this.render), setRawMode(this.input, false), t(this.value);
+      }), this.once("cancel", () => {
+        this.output.write(import_sisteransi.cursor.show), this.output.off("resize", this.render), setRawMode(this.input, false), t(CANCEL_SYMBOL);
+      });
+    });
+  }
+  _isActionKey(t, e) {
+    return t === "\t";
+  }
+  _shouldSubmit(t, e) {
+    return true;
+  }
+  _setValue(t) {
+    this.value = t, this.emit("value", this.value);
+  }
+  _setUserInput(t, e) {
+    this.userInput = t ?? "", this.emit("userInput", this.userInput), e && this._track && this.rl && (this.rl.write(this.userInput), this._cursor = this.rl.cursor);
+  }
+  _clearUserInput() {
+    this.rl?.write(null, { ctrl: true, name: "u" }), this._setUserInput("");
+  }
+  async onKeypress(t, e) {
+    if (this.state !== "validating") {
+      if (this._track && e.name !== "return" && (e.name && this._isActionKey(t, e) && this.rl?.write(null, { ctrl: true, name: "h" }), this._cursor = this.rl?.cursor ?? 0, this._setUserInput(this.rl?.line)), this.state === "error" && (this.state = "active"), e?.name && (!this._track && settings.aliases.has(e.name) && this.emit("cursor", settings.aliases.get(e.name)), settings.actions.has(e.name) && this.emit("cursor", e.name)), t && (t.toLowerCase() === "y" || t.toLowerCase() === "n") && this.emit("confirm", t.toLowerCase() === "y"), this.emit("key", t, e), e?.name === "return" && this._shouldSubmit(t, e)) {
+        if (this.opts.validate) {
+          const i = runValidation(this.opts.validate, this.value);
+          let s;
+          i instanceof Promise ? (this.state = "validating", this.render(), s = await i) : s = i, s && (this.error = s instanceof Error ? s.message : s, this.state = "error", this.rl?.write(this.userInput));
+        }
+        this.state !== "error" && (this.state = "submit");
+      }
+      isActionKey([t, e?.name, e?.sequence], "cancel") && (this.state = "cancel"), (this.state === "submit" || this.state === "cancel") && this.emit("finalize"), this.render(), (this.state === "submit" || this.state === "cancel") && this.close();
+    }
+  }
+  close() {
+    this.input.unpipe(), this.input.removeListener("keypress", this.onKeypress), this.output.write(`
+`), setRawMode(this.input, false), this.rl?.close(), this.rl = undefined, this.emit(`${this.state}`, this.value), this.unsubscribe();
+  }
+  restoreCursor() {
+    const t = wrapAnsi(this._prevFrame, process.stdout.columns, { hard: true, trim: false }).split(`
+`).length - 1;
+    this.output.write(import_sisteransi.cursor.move(-999, t * -1));
+  }
+  render() {
+    const t = wrapAnsi(this._render(this) ?? "", process.stdout.columns, {
+      hard: true,
+      trim: false
+    });
+    if (t !== this._prevFrame) {
+      if (this.state === "initial")
+        this.output.write(import_sisteransi.cursor.hide);
+      else {
+        const e = diffLines(this._prevFrame, t), i = getRows(this.output);
+        if (this.restoreCursor(), e) {
+          const s = Math.max(0, e.numLinesAfter - i), r = Math.max(0, e.numLinesBefore - i);
+          let n = e.lines.find((o) => o >= s);
+          if (n === undefined) {
+            this._prevFrame = t;
+            return;
+          }
+          if (e.lines.length === 1) {
+            this.output.write(import_sisteransi.cursor.move(0, n - r)), this.output.write(import_sisteransi.erase.lines(1));
+            const o = t.split(`
+`);
+            this.output.write(o[n]), this._prevFrame = t, this.output.write(import_sisteransi.cursor.move(0, o.length - n - 1));
+            return;
+          } else if (e.lines.length > 1) {
+            if (s < r)
+              n = s;
+            else {
+              const h = n - r;
+              h > 0 && this.output.write(import_sisteransi.cursor.move(0, h));
+            }
+            this.output.write(import_sisteransi.erase.down());
+            const f = t.split(`
+`).slice(n);
+            this.output.write(f.join(`
+`)), this._prevFrame = t;
+            return;
+          }
+        }
+        this.output.write(import_sisteransi.erase.down());
+      }
+      this.output.write(t), this.state === "initial" && (this.state = "active"), this._prevFrame = t;
+    }
+  }
+}
+class r extends y {
+  get cursor() {
+    return this.value ? 0 : 1;
+  }
+  get _value() {
+    return this.cursor === 0;
+  }
+  constructor(t) {
+    super(t, false), this.value = !!t.initialValue, this.on("userInput", () => {
+      this.value = this._value;
+    }), this.on("confirm", (i) => {
+      this.output.write(import_sisteransi.cursor.move(0, -1)), this.value = i, this.state = "submit", this.close();
+    }), this.on("cursor", () => {
+      this.value = !this.value;
+    });
+  }
+}
+var n$1 = class n extends y {
+  options;
+  cursor = 0;
+  get _selectedValue() {
+    return this.options[this.cursor];
+  }
+  changeValue() {
+    const e = this._selectedValue;
+    this.value = e === undefined ? undefined : e.value;
+  }
+  constructor(e) {
+    super(e, false), this.options = e.options;
+    const o = this.options.findIndex(({ value: s }) => s === e.initialValue), t = o === -1 ? 0 : o;
+    this.cursor = this.options[t]?.disabled ? findCursor(t, 1, this.options) : t, this.changeValue(), this.on("cursor", (s) => {
+      switch (s) {
+        case "left":
+        case "up":
+          this.cursor = findCursor(this.cursor, -1, this.options);
+          break;
+        case "down":
+        case "right":
+          this.cursor = findCursor(this.cursor, 1, this.options);
+          break;
+      }
+      this.changeValue();
+    });
+  }
+};
+
+// ../node_modules/.bun/@clack+prompts@1.8.1/node_modules/@clack/prompts/dist/index.mjs
+import { styleText, stripVTControlCharacters } from "node:util";
+import process$1 from "node:process";
+var import_sisteransi2 = __toESM(require_src(), 1);
+function isUnicodeSupported() {
+  if (process$1.platform !== "win32") {
+    return process$1.env.TERM !== "linux";
+  }
+  return Boolean(process$1.env.CI) || Boolean(process$1.env.WT_SESSION) || Boolean(process$1.env.TERMINUS_SUBLIME) || process$1.env.ConEmuTask === "{cmd::Cmder}" || process$1.env.TERM_PROGRAM === "Terminus-Sublime" || process$1.env.TERM_PROGRAM === "vscode" || process$1.env.TERM === "xterm-256color" || process$1.env.TERM === "alacritty" || process$1.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
+}
+var unicode = isUnicodeSupported();
+var isCI = () => process.env.CI === "true";
+var unicodeOr = (o, e) => unicode ? o : e;
+var S_STEP_ACTIVE = unicodeOr("◆", "*");
+var S_STEP_CANCEL = unicodeOr("■", "x");
+var S_STEP_ERROR = unicodeOr("▲", "x");
+var S_STEP_SUBMIT = unicodeOr("◇", "o");
+var S_BAR_START = unicodeOr("┌", "T");
+var S_BAR = unicodeOr("│", "|");
+var S_BAR_END = unicodeOr("└", "—");
+var S_BAR_START_RIGHT = unicodeOr("┐", "T");
+var S_BAR_END_RIGHT = unicodeOr("┘", "—");
+var S_RADIO_ACTIVE = unicodeOr("●", ">");
+var S_RADIO_INACTIVE = unicodeOr("○", " ");
+var S_CHECKBOX_ACTIVE = unicodeOr("◻", "[•]");
+var S_CHECKBOX_SELECTED = unicodeOr("◼", "[+]");
+var S_CHECKBOX_INACTIVE = unicodeOr("◻", "[ ]");
+var S_PASSWORD_MASK = unicodeOr("▪", "•");
+var S_BAR_H = unicodeOr("─", "-");
+var S_CORNER_TOP_RIGHT = unicodeOr("╮", "+");
+var S_CONNECT_LEFT = unicodeOr("├", "+");
+var S_CORNER_BOTTOM_RIGHT = unicodeOr("╯", "+");
+var S_CORNER_BOTTOM_LEFT = unicodeOr("╰", "+");
+var S_CORNER_TOP_LEFT = unicodeOr("╭", "+");
+var S_INFO = unicodeOr("●", "•");
+var S_SUCCESS = unicodeOr("◆", "*");
+var S_WARN = unicodeOr("▲", "!");
+var S_ERROR = unicodeOr("■", "x");
+var symbol = (o) => {
+  switch (o) {
+    case "initial":
+    case "active":
+      return styleText("cyan", S_STEP_ACTIVE);
+    case "cancel":
+      return styleText("red", S_STEP_CANCEL);
+    case "error":
+      return styleText("yellow", S_STEP_ERROR);
+    case "submit":
+      return styleText("green", S_STEP_SUBMIT);
+    case "validating":
+      return styleText("dim", S_STEP_ACTIVE);
+  }
+};
+var symbolBar = (o) => {
+  switch (o) {
+    case "initial":
+    case "active":
+      return styleText("cyan", S_BAR);
+    case "cancel":
+      return styleText("red", S_BAR);
+    case "error":
+      return styleText("yellow", S_BAR);
+    case "submit":
+      return styleText("green", S_BAR);
+  }
+};
+function formatInstructionFooter(o, e) {
+  const r = [`${e ? `${styleText("cyan", S_BAR)}  ` : ""}${o.join(" • ")}`];
+  return e && r.push(styleText("cyan", S_BAR_END)), r;
+}
+var I = (l, e, w, p, b, C = false) => {
+  let r = e, O = 0;
+  if (C)
+    for (let i = p - 1;i >= w; i--) {
+      const m = l[i];
+      if (m && (r -= m.length), O++, r <= b)
+        break;
+    }
+  else
+    for (let i = w;i < p; i++) {
+      const m = l[i];
+      if (m && (r -= m.length), O++, r <= b)
+        break;
+    }
+  return { lineCount: r, removals: O };
+};
+var limitOptions = ({
+  cursor: l,
+  options: e,
+  style: w,
+  output: p = process.stdout,
+  maxItems: b = Number.POSITIVE_INFINITY,
+  columnPadding: C = 0,
+  rowPadding: r = 4
+}) => {
+  const i = getColumns(p) - C, m = getRows(p), M = styleText("dim", "..."), v = Math.max(m - r, 0), a = Math.max(Math.min(b, v), 5);
+  let f = 0;
+  l >= a - 3 && (f = Math.max(Math.min(l - a + 3, e.length - a), 0));
+  let d = a < e.length && f > 0, c = a < e.length && f + a < e.length;
+  const W = Math.min(f + a, e.length), s = [];
+  let g = 0;
+  d && g++, c && g++;
+  const T = f + (d ? 1 : 0), y = W - (c ? 1 : 0);
+  for (let t = T;t < y; t++) {
+    const n = e[t], o = n ? w(n, t === l) : "", h = wrapAnsi(o, i, {
+      hard: true,
+      trim: false
+    }).split(`
+`);
+    s.push(h), g += h.length;
+  }
+  if (g > v) {
+    let t = 0, n = 0, o = g;
+    const h = l - T;
+    let u = v;
+    const L = () => I(s, o, 0, h, u), E = () => I(s, o, h + 1, s.length, u, true);
+    d ? ({ lineCount: o, removals: t } = L(), o > u && (c || (u -= 1), { lineCount: o, removals: n } = E())) : (c || (u -= 1), { lineCount: o, removals: n } = E(), o > u && (u -= 1, { lineCount: o, removals: t } = L())), t > 0 && (d = true, s.splice(0, t)), n > 0 && (c = true, s.splice(s.length - n, n));
+  }
+  const x = [];
+  d && x.push(M);
+  for (const t of s)
+    for (const n of t)
+      x.push(n);
+  return c && x.push(M), x;
+};
+var confirm = (e) => {
+  const a = e.active ?? "Yes", o = e.inactive ?? "No";
+  return new r({
+    active: a,
+    inactive: o,
+    signal: e.signal,
+    input: e.input,
+    output: e.output,
+    initialValue: e.initialValue ?? true,
+    render() {
+      const i = e.withGuide ?? settings.withGuide, u = `${symbol(this.state)}  `, l = i ? `${styleText("gray", S_BAR)}  ` : "", f = wrapTextWithPrefix(e.output, e.message, l, u), s = `${i ? `${styleText("gray", S_BAR)}
+` : ""}${f}
+`, c = this.value ? a : o;
+      switch (this.state) {
+        case "submit": {
+          const r = i ? `${styleText("gray", S_BAR)}  ` : "";
+          return `${s}${r}${styleText("dim", c)}`;
+        }
+        case "cancel": {
+          const r = i ? `${styleText("gray", S_BAR)}  ` : "";
+          return `${s}${r}${styleText(["strikethrough", "dim"], c)}${i ? `
+${styleText("gray", S_BAR)}` : ""}`;
+        }
+        default: {
+          const r = i ? `${styleText("cyan", S_BAR)}  ` : "", g = i ? styleText("cyan", S_BAR_END) : "";
+          return `${s}${r}${this.value ? `${styleText("green", S_RADIO_ACTIVE)} ${a}` : `${styleText("dim", S_RADIO_INACTIVE)} ${styleText("dim", a)}`}${e.vertical ? i ? `
+${styleText("cyan", S_BAR)}  ` : `
+` : ` ${styleText("dim", "/")} `}${this.value ? `${styleText("dim", S_RADIO_INACTIVE)} ${styleText("dim", o)}` : `${styleText("green", S_RADIO_ACTIVE)} ${o}`}
+${g}
+`;
+        }
+      }
+    }
+  }).prompt();
+};
+var MULTISELECT_INSTRUCTIONS = [
+  `${styleText("dim", "↑/↓")} to navigate`,
+  `${styleText("dim", "Space:")} select`,
+  `${styleText("dim", "Enter:")} confirm`
+];
+var intro = (o = "", t) => {
+  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText("gray", S_BAR_START)}  ` : "";
+  i.write(`${e}${o}
+`);
+};
+var outro = (o = "", t) => {
+  const i = t?.output ?? process.stdout, e = t?.withGuide ?? settings.withGuide ? `${styleText("gray", S_BAR)}
+${styleText("gray", S_BAR_END)}  ` : "";
+  i.write(`${e}${o}
+
+`);
+};
+var W = (l) => styleText("magenta", l);
+var spinner = ({
+  indicator: l = "dots",
+  onCancel: h,
+  output: n = process.stdout,
+  cancelMessage: G,
+  errorMessage: O,
+  frames: E = unicode ? ["◒", "◐", "◓", "◑"] : ["•", "o", "O", "0"],
+  delay: F = unicode ? 80 : 120,
+  signal: m,
+  ...I
+} = {}) => {
+  const u = isCI();
+  let M, T, d = false, S = false, s = "", p, w = performance.now();
+  const x = getColumns(n), k = I?.styleFrame ?? W, g = (e) => {
+    const r = e > 1 ? O ?? settings.messages.error : G ?? settings.messages.cancel;
+    S = e === 1, d && (a(r, e), S && typeof h == "function" && h());
+  }, f = () => g(2), i = () => g(1), A = () => {
+    process.on("uncaughtExceptionMonitor", f), process.on("unhandledRejection", f), process.on("SIGINT", i), process.on("SIGTERM", i), process.on("exit", g), m && m.addEventListener("abort", i);
+  }, H = () => {
+    process.removeListener("uncaughtExceptionMonitor", f), process.removeListener("unhandledRejection", f), process.removeListener("SIGINT", i), process.removeListener("SIGTERM", i), process.removeListener("exit", g), m && m.removeEventListener("abort", i);
+  }, y = () => {
+    if (p === undefined)
+      return;
+    u && n.write(`
+`);
+    const r = wrapAnsi(p, x, {
+      hard: true,
+      trim: false
+    }).split(`
+`);
+    r.length > 1 && n.write(import_sisteransi2.cursor.up(r.length - 1)), n.write(import_sisteransi2.cursor.to(0)), n.write(import_sisteransi2.erase.down());
+  }, C = (e) => e.replace(/\.+$/, ""), _ = (e) => {
+    const r = (performance.now() - e) / 1000, t = Math.floor(r / 60), o = Math.floor(r % 60);
+    return t > 0 ? `[${t}m ${o}s]` : `[${o}s]`;
+  }, N = I.withGuide ?? settings.withGuide, P = (e = "") => {
+    d = true, M = block({ output: n }), s = C(e), w = performance.now(), N && n.write(`${styleText("gray", S_BAR)}
+`);
+    let r = 0, t = 0;
+    A(), T = setInterval(() => {
+      if (u && s === p)
+        return;
+      y(), p = s;
+      const o = k(E[r]);
+      let v;
+      if (u)
+        v = `${o}  ${s}...`;
+      else if (l === "timer")
+        v = `${o}  ${s} ${_(w)}`;
+      else {
+        const B = ".".repeat(Math.floor(t)).slice(0, 3);
+        v = `${o}  ${s}${B}`;
+      }
+      const j = wrapAnsi(v, x, {
+        hard: true,
+        trim: false
+      });
+      n.write(j), r = r + 1 < E.length ? r + 1 : 0, t = t < 4 ? t + 0.125 : 0;
+    }, F);
+  }, a = (e = "", r = 0, t = false) => {
+    if (!d)
+      return;
+    d = false, clearInterval(T), y();
+    const o = r === 0 ? styleText("green", S_STEP_SUBMIT) : r === 1 ? styleText("red", S_STEP_CANCEL) : styleText("red", S_STEP_ERROR);
+    s = e ?? s, t || (l === "timer" ? n.write(`${o}  ${s} ${_(w)}
+`) : n.write(`${o}  ${s}
+`)), H(), M();
+  };
+  return {
+    start: P,
+    stop: (e = "") => a(e, 0),
+    message: (e = "") => {
+      s = C(e ?? s);
+    },
+    cancel: (e = "") => a(e, 1),
+    error: (e = "") => a(e, 2),
+    clear: () => a("", 0, true),
+    get isCancelled() {
+      return S;
+    }
+  };
+};
+var u2 = {
+  light: unicodeOr("─", "-"),
+  heavy: unicodeOr("━", "="),
+  block: unicodeOr("█", "#")
+};
+var SELECT_INSTRUCTIONS = [
+  `${styleText("dim", "↑/↓")} to navigate`,
+  `${styleText("dim", "Enter:")} confirm`
+];
+var c = (t, o) => t.includes(`
+`) ? t.split(`
+`).map((d) => o(d)).join(`
+`) : o(t);
+var select = (t) => {
+  const o = (n, m) => {
+    if (n === undefined)
+      return "";
+    const s = n.label ?? String(n.value);
+    switch (m) {
+      case "disabled":
+        return `${styleText("gray", S_RADIO_INACTIVE)} ${c(s, (i) => styleText("gray", i))}${n.hint ? ` ${styleText("dim", `(${n.hint ?? "disabled"})`)}` : ""}`;
+      case "selected":
+        return `${c(s, (i) => styleText("dim", i))}`;
+      case "active":
+        return `${styleText("green", S_RADIO_ACTIVE)} ${s}${n.hint ? ` ${styleText("dim", `(${n.hint})`)}` : ""}`;
+      case "cancelled":
+        return `${c(s, (i) => styleText(["strikethrough", "dim"], i))}`;
+      default:
+        return `${styleText("dim", S_RADIO_INACTIVE)} ${c(s, (i) => styleText("dim", i))}`;
+    }
+  }, d = t.showInstructions ?? true;
+  return new n$1({
+    options: t.options,
+    signal: t.signal,
+    input: t.input,
+    output: t.output,
+    initialValue: t.initialValue,
+    render() {
+      const n = t.withGuide ?? settings.withGuide, m = `${symbol(this.state)}  `, s = `${symbolBar(this.state)}  `, i = wrapTextWithPrefix(t.output, t.message, s, m), u = `${n ? `${styleText("gray", S_BAR)}
+` : ""}${i}
+`;
+      switch (this.state) {
+        case "submit": {
+          const r = n ? `${styleText("gray", S_BAR)}  ` : "", a = wrapTextWithPrefix(t.output, o(this.options[this.cursor], "selected"), r);
+          return `${u}${a}`;
+        }
+        case "cancel": {
+          const r = n ? `${styleText("gray", S_BAR)}  ` : "", a = wrapTextWithPrefix(t.output, o(this.options[this.cursor], "cancelled"), r);
+          return `${u}${a}${n ? `
+${styleText("gray", S_BAR)}` : ""}`;
+        }
+        default: {
+          const r = n ? `${styleText("cyan", S_BAR)}  ` : "", a = u.split(`
+`).length, p = d ? formatInstructionFooter(SELECT_INSTRUCTIONS, n) : n ? [styleText("cyan", S_BAR_END)] : [], f = p.join(`
+`), b = p.length + 1;
+          return `${u}${r}${limitOptions({
+            output: t.output,
+            cursor: this.cursor,
+            options: this.options,
+            maxItems: t.maxItems,
+            columnPadding: r.length,
+            rowPadding: a + b,
+            style: (g, x) => o(g, g.disabled ? "disabled" : x ? "active" : "inactive")
+          }).join(`
+${r}`)}
+${f}
+`;
+        }
+      }
+    }
+  }).prompt();
+};
+var i = `${styleText("gray", S_BAR)}  `;
+
+// src/push.ts
 var CONFIRM_FLAGS = new Set(["--yes", "-y"]);
 var FORWARDED_GIT_FLAGS = new Set(["--force"]);
 function parsePushArgs(args) {
@@ -2352,26 +4902,46 @@ function planPush({
     reason: names.length === 0 ? "No session in this repo has a branch ready to push." : "Several session branches are ready; pick one."
   };
 }
-async function choose(candidates) {
-  if (!process.stdin.isTTY)
-    return;
-  console.log(candidates.map((name, index) => `  ${index + 1}) ${name}`).join(`
-`));
-  const answer = await ask("Branch to push: ");
-  return candidates[Number(answer) - 1];
+function branchHint(run, candidate) {
+  const count = git(run, candidate.dir, [
+    "rev-list",
+    "--count",
+    `${candidate.baseSha}..${candidate.branch}`
+  ]).out;
+  const stat = cleanOutput(git(run, candidate.dir, [
+    "diff",
+    "--no-color",
+    "--stat",
+    `${candidate.baseSha}...${candidate.branch}`
+  ]).out);
+  const files = stat.split(`
+`).pop() ?? "";
+  return [
+    `${count || "0"} commit${count === "1" ? "" : "s"}`,
+    files || "no file changes"
+  ].join(" | ");
+}
+async function chooseInteractive(run, names, candidates) {
+  return select({
+    message: "Branch to push",
+    options: names.map((name) => ({
+      value: name,
+      label: name,
+      hint: branchHint(run, candidates.get(name))
+    }))
+  });
 }
 function describe(run, root, branch, base, tip, gitFlags) {
-  const commits = git(run, root, [
-    "log",
-    "--format=  %h %s (%an / %cn)",
-    `${base}..${tip}`
-  ]).out;
-  const stat = git(run, root, ["diff", "--stat", `${base}...${tip}`]).out;
+  const commits = cleanOutput(git(run, root, ["log", "--format=  %h %s (%an / %cn)", `${base}..${tip}`]).out);
+  const stat = cleanOutput(git(run, root, ["diff", "--no-color", "--stat", `${base}...${tip}`]).out);
   return [
     `Pushing ${branch} to origin${gitFlags.length ? ` with ${gitFlags.join(" ")}` : ""} (compared with ${base}):`,
-    stripControl(commits) || "  (no new commits)",
+    `
+Commits:`,
+    commits || "  (no new commits)",
     stat ? `
-${stripControl(stat)}` : ""
+Changed files:
+${stat}` : ""
   ].join(`
 `);
 }
@@ -2390,10 +4960,20 @@ async function push({ args }) {
   } catch (error) {
     throw error instanceof LaunchError ? error : new LaunchError(String(error));
   }
+  const tty = process.stdin.isTTY === true;
   const candidates = pushCandidates(sessionsForRepo(root));
   let plan = planPush({ requested, candidates });
   if (!plan.ok && !requested && plan.candidates.length > 1) {
-    const picked = await choose(plan.candidates);
+    let picked;
+    if (tty) {
+      intro("maesttro push");
+      const chosen = await chooseInteractive(run, plan.candidates, candidates);
+      if (isCancel(chosen)) {
+        console.log("Not pushed.");
+        return;
+      }
+      picked = chosen;
+    }
     if (picked)
       plan = planPush({ requested: picked, candidates });
   }
@@ -2403,36 +4983,43 @@ async function push({ args }) {
     return;
   }
   const { branch, base, baseSha, dir, sessionId } = plan.candidate;
+  const prepare = tty ? spinner() : undefined;
+  prepare?.start(`Preparing ${branch}...`);
   const tip = branchTip(dir, branch);
   if (!tip || !importObjects(run, root, dir, tip)) {
+    prepare?.stop(`Could not prepare ${branch}.`);
     console.error(`Could not read ${branch} from session ${sessionId}.`);
     process.exitCode = 1;
     return;
   }
   git(run, root, ["update-ref", `refs/maesttro/${sessionId}/${branch}`, tip]);
+  prepare?.stop(`Prepared ${branch}.`);
   console.log(describe(run, root, branch, base, tip, gitFlags));
   if (!yes) {
-    if (!process.stdin.isTTY) {
+    if (!tty) {
       console.error("Not a terminal; re-run with --yes to push without confirming.");
       process.exitCode = 1;
       return;
     }
-    const answer = await ask(`
-Push? [y/N] `);
-    if (!/^y(es)?$/i.test(answer)) {
+    const answer = await confirm({ message: `Push ${branch} to origin?` });
+    if (isCancel(answer) || !answer) {
       console.log("Not pushed.");
       return;
     }
   }
-  const pushed = spawnSync3("git", ["-C", root, "push", ...gitFlags, "origin", `${tip}:refs/heads/${branch}`], { stdio: "inherit" });
+  const pushed = spawnSync4("git", ["-C", root, "push", ...gitFlags, "origin", `${tip}:refs/heads/${branch}`], { stdio: "inherit" });
   if (pushed.status === 0) {
-    console.log(`Pushed ${branch}. Base for comparison was ${baseSha.slice(0, 8)}.`);
+    const done = `Pushed ${branch}. Base for comparison was ${baseSha.slice(0, 8)}.`;
+    if (tty && !yes)
+      outro(done);
+    else
+      console.log(done);
   }
   process.exitCode = pushed.status ?? 1;
 }
 
 // src/sessions-command.ts
-import { existsSync as existsSync5, rmSync as rmSync7 } from "node:fs";
+import { existsSync as existsSync6, rmSync as rmSync10 } from "node:fs";
 function parseRemoveArgs(args) {
   let all = false;
   let force = false;
@@ -2448,7 +5035,7 @@ function parseRemoveArgs(args) {
   return { all, force, id };
 }
 async function removeSession(run, session, force, ask, interactive) {
-  if (existsSync5(session.worktree)) {
+  if (existsSync6(session.worktree)) {
     const preserved = preserveBranches(run, session);
     const head = cloneHead(session.worktree);
     const unbranched = preserved.length === 0 && head?.detached !== undefined && head.detached !== session.baseSha;
@@ -2466,7 +5053,7 @@ async function removeSession(run, session, force, ask, interactive) {
         return "kept";
       }
     }
-    rmSync7(session.worktree, { recursive: true, force: true });
+    rmSync10(session.worktree, { recursive: true, force: true });
     const kept = preserved.length > 0 ? ` Its branches are kept as refs/maesttro/${session.id}/*.` : "";
     console.log(`Removed session ${session.id}.${kept}`);
   } else {
@@ -2523,7 +5110,7 @@ async function sessionsCommand({
     return;
   }
   for (const session of sessions) {
-    const branches = existsSync5(session.worktree) ? cloneBranches(session.worktree) : undefined;
+    const branches = existsSync6(session.worktree) ? cloneBranches(session.worktree) : undefined;
     const where = branches === undefined ? "clone missing" : branches.length > 0 ? `branches: ${branches.join(", ")}` : "no branches yet";
     const mode = session.strict ? "  strict" : "";
     console.log(`  ${session.id}  ${session.createdAt.slice(0, 16)}  ${where}${mode}`);
@@ -2551,23 +5138,31 @@ async function setup({ args }) {
   console.log("-> Building runner image (this pulls node:22-slim + installs CLIs, first run only)...");
   run(`docker build -t ${IMAGE} "${DOCKERFILE_DIR}"`);
   console.log(`
--> Ensuring persistent volume exists...`);
-  execSync4(`docker volume create ${VOLUME}`, { stdio: "ignore" });
-  console.log(`
--> Removing any long-lived GitHub token from the volume...`);
-  if (purgeLegacyToken())
-    console.log(`   ${REVOKE_NOTICE}`);
-  writeMaesttroConfig({ ...readMaesttroConfig(), legacyTokenPurged: true });
+-> Checking for the old shared runner volume...`);
+  migrateFromVolumeOnce({
+    config: readMaesttroConfig(),
+    saveConfig: writeMaesttroConfig,
+    store: claudeStore(),
+    announce: (message) => console.log(`   ${message}`)
+  });
   if (args[0]) {
-    console.log("   Ignoring the token argument: sessions now get short-lived tokens through `maesttro login`.");
+    console.log("   Ignoring the token argument: sessions now get short-lived tokens through `maesttro login github`.");
   }
   console.log(`
 -> Logging in to GitHub...`);
   await ensureLogin();
   console.log(`
+-> Logging in to Claude...`);
+  const claude = claudeStore();
+  if (claudeLoginState({ credentials: claude.load(), now: Date.now() }) === "active") {
+    console.log(`   Already logged in. Stored in ${claude.kind}.`);
+  } else if (!claudeLogin({ announce: (message) => console.log(`   ${message}`) })) {
+    console.log("   Setup continues without it; Claude Code sessions will show their own login screen.");
+  }
+  console.log(`
 -> Verifying isolation...`);
   console.log("   personal SSH key should NOT be visible:");
-  run(`docker run --rm ${hostIdentityFlags()} -v ${VOLUME}:/home/agent ${IMAGE} "cat ~/.ssh/id_rsa 2>&1 || true"`);
+  run(`docker run --rm ${hostIdentityFlags()} ${IMAGE} "cat ~/.ssh/id_rsa 2>&1 || true"`);
   console.log("\nSetup complete. Run `maesttro` from any project directory to start a session,");
   console.log("or `maesttro list` to see available clients.");
 }
@@ -2575,17 +5170,89 @@ async function setup({ args }) {
 // src/update.ts
 import { execSync as execSync5 } from "node:child_process";
 
+// src/runner-images.ts
+var RUNNER_LABEL = "org.maesttro.runner";
+var RUNNER_ENTRYPOINT = "/usr/local/bin/maesttro-entrypoint";
+var INSPECT_FORMAT = "{{.Id}}\t{{json .Config}}\t{{json .RepoTags}}";
+function parseJson(text, fallback) {
+  try {
+    return JSON.parse(text ?? "") ?? fallback;
+  } catch {
+    return fallback;
+  }
+}
+function parseImageRows(stdout) {
+  return stdout.split(`
+`).filter((line) => line.trim() !== "").map((line) => {
+    const [id = "", config, tags] = line.split("\t");
+    const { Entrypoint, Labels } = parseJson(config, {});
+    return {
+      id,
+      entrypoint: Entrypoint ?? [],
+      labels: Labels ?? {},
+      tags: parseJson(tags, [])
+    };
+  });
+}
+function isRunnerImage(row) {
+  return row.labels[RUNNER_LABEL] !== undefined || row.entrypoint.includes(RUNNER_ENTRYPOINT);
+}
+function staleRunnerImages({
+  rows,
+  latestId
+}) {
+  if (!latestId)
+    return [];
+  return rows.filter((row) => row.id !== latestId && isRunnerImage(row));
+}
+function currentLatestId(run) {
+  const result = run("docker", [
+    "image",
+    "inspect",
+    "--format",
+    "{{.Id}}",
+    IMAGE
+  ]);
+  return result.status === 0 ? result.stdout.trim() || undefined : undefined;
+}
+function removeStaleRunnerImages({
+  run = runCommand,
+  latestId = () => currentLatestId(run)
+} = {}) {
+  const listed = run("docker", ["image", "ls", "--quiet", "--no-trunc"]);
+  if (listed.status !== 0)
+    return 0;
+  const ids = [
+    ...new Set(listed.stdout.split(`
+`).map((id) => id.trim()).filter(Boolean))
+  ];
+  if (ids.length === 0)
+    return 0;
+  const inspected = run("docker", [
+    "image",
+    "inspect",
+    "--format",
+    INSPECT_FORMAT,
+    ...ids
+  ]);
+  const stale = staleRunnerImages({
+    rows: parseImageRows(inspected.stdout),
+    latestId: latestId()
+  });
+  return stale.filter((image) => run("docker", ["rmi", ...image.tags, image.id]).status === 0).length;
+}
+
 // src/version-check.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync12 } from "node:fs";
+import { join as join16 } from "node:path";
 var LOOKUP_TIMEOUT_MS = 3000;
 function installedManifest() {
-  return JSON.parse(readFileSync8(join12(PACKAGE_ROOT, "package.json"), "utf8"));
+  return JSON.parse(readFileSync12(join16(PACKAGE_ROOT, "package.json"), "utf8"));
 }
 function canOfferUpdate({
   interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY),
-  inRunner = existsSync6(RUNNER_MARKER)
+  inRunner = existsSync7(RUNNER_MARKER)
 } = {}) {
   return interactive && !inRunner;
 }
@@ -2634,6 +5301,10 @@ function update() {
 -> Rebuilding runner image with refreshed client configs...`);
   execSync5(`docker build -t ${IMAGE} "${DOCKERFILE_DIR}"`, { stdio: "inherit" });
   console.log(`
+-> Removing older runner images...`);
+  const removed = removeStaleRunnerImages();
+  console.log(removed > 0 ? `   Removed ${removed} older runner image${removed === 1 ? "" : "s"}.` : "   None to remove.");
+  console.log(`
 Update complete. Bot identity and your project files are untouched —`);
   console.log("only the runner image (client versions + curated configs) was refreshed.");
 }
@@ -2675,6 +5346,13 @@ var MODE_FLAGS = {
   "--strict": true,
   "--no-strict": false
 };
+function clientFirst(args) {
+  const [first, second, ...rest] = args;
+  if (first !== undefined && second !== undefined && isClientKey(first)) {
+    return [second, first, ...rest];
+  }
+  return args;
+}
 function takeModeFlags(args) {
   let strict;
   let index = 0;
@@ -2726,13 +5404,13 @@ async function main(argv, commands = defaultCommands) {
       await commands.doctor();
       return;
     case "login":
-      await commands.login();
+      await commands.login({ args: rest });
       return;
     case "logout":
-      await commands.logout();
+      await commands.logout({ args: rest });
       return;
     case "status":
-      await commands.status();
+      await commands.status({ args: rest });
       return;
     case "push":
       await commands.push({ args: rest });
@@ -2742,11 +5420,11 @@ async function main(argv, commands = defaultCommands) {
       return;
     case "resume": {
       const beforeId = takeModeFlags(rest);
-      const [id, ...afterId] = beforeId.rest;
+      const [id, ...afterId] = clientFirst(beforeId.rest);
       const afterIdFlags = takeModeFlags(afterId);
       const strict = afterIdFlags.strict ?? beforeId.strict ?? leading.strict;
       if (!id) {
-        commands.print("Usage: maesttro resume <session-id> [--strict|--no-strict] [client] [args...]");
+        commands.print("Usage: maesttro resume [client] <session-id> [--strict|--no-strict] [client] [args...]");
         return;
       }
       await commands.launch({