maesttro 0.5.0 → 0.6.0

package/dist/maesttro.js

@@ -94,14 +94,53 @@ var require_src = __commonJS(function(exports, module) {
 // src/credential-store.ts
 import {
   chmodSync,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  rmSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { dirname, join as join2 } from "node:path";
+
+// src/maesttro-home.ts
+import {
+  appendFileSync,
   mkdirSync,
   readFileSync,
   renameSync,
-  rmSync,
   writeFileSync
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
+function maesttroHome() {
+  return process.env.MAESTTRO_HOME ?? join(homedir(), ".config", "maesttro");
+}
+function configPath() {
+  return join(maesttroHome(), "config.json");
+}
+function readMaesttroConfig() {
+  try {
+    return JSON.parse(readFileSync(configPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeMaesttroConfig(config) {
+  mkdirSync(maesttroHome(), { recursive: true, mode: 448 });
+  const temporary = `${configPath()}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(config, null, 2)}
+`);
+  renameSync(temporary, configPath());
+}
+function fileSessionLog(path = join(maesttroHome(), "maesttro.log")) {
+  return (event, detail) => {
+    try {
+      mkdirSync(maesttroHome(), { recursive: true, mode: 448 });
+      appendFileSync(path, `${new Date().toISOString()} ${event}${detail ? ` ${detail}` : ""}
+`);
+    } catch {}
+  };
+}
 
 // src/run-command.ts
 import { spawnSync } from "node:child_process";
@@ -120,98 +159,1375 @@ function commandExists(run, command) {
   return run("sh", ["-c", `command -v ${command}`]).status === 0;
 }
 
-// src/credential-store.ts
-var SERVICE = "maesttro";
-var ACCOUNT = "github";
-function encode(token) {
-  return Buffer.from(JSON.stringify(token)).toString("base64");
+// src/credential-store.ts
+var SERVICE = "maesttro";
+var GITHUB_CODEC = {
+  account: "github",
+  accepts: (value) => typeof value?.access_token === "string"
+};
+function encode(value) {
+  return Buffer.from(JSON.stringify(value)).toString("base64");
+}
+function decoderFor(codec) {
+  return (encoded) => {
+    try {
+      const value = JSON.parse(Buffer.from(encoded.trim(), "base64").toString("utf8"));
+      return codec.accepts(value) ? value : undefined;
+    } catch {
+      return;
+    }
+  };
+}
+function defaultFilePath(account) {
+  const name = account === "github" ? "credentials.json" : `credentials-${account}.json`;
+  return join2(maesttroHome(), name);
+}
+function keychainStore(run = runCommand, codec = GITHUB_CODEC) {
+  const identity = ["-s", SERVICE, "-a", codec.account];
+  const decode = decoderFor(codec);
+  return {
+    kind: "macOS keychain",
+    load: () => {
+      const result = run("security", [
+        "find-generic-password",
+        ...identity,
+        "-w"
+      ]);
+      return result.status === 0 ? decode(result.stdout) : undefined;
+    },
+    save: (value) => {
+      const command = `add-generic-password -U ${identity.join(" ")} -w ${encode(value)}
+`;
+      const result = run("security", ["-i"], command);
+      if (result.status !== 0)
+        throw new Error("Could not write to keychain");
+    },
+    clear: () => {
+      run("security", ["delete-generic-password", ...identity]);
+    }
+  };
+}
+function secretToolStore(run = runCommand, codec = GITHUB_CODEC) {
+  const attributes = ["service", SERVICE, "account", codec.account];
+  const decode = decoderFor(codec);
+  return {
+    kind: "Secret Service (secret-tool)",
+    load: () => {
+      const result = run("secret-tool", ["lookup", ...attributes]);
+      return result.status === 0 ? decode(result.stdout) : undefined;
+    },
+    save: (value) => {
+      const result = run("secret-tool", ["store", `--label=${SERVICE}`, ...attributes], encode(value));
+      if (result.status !== 0) {
+        throw new Error("Could not write to the Secret Service");
+      }
+    },
+    clear: () => {
+      run("secret-tool", ["clear", ...attributes]);
+    }
+  };
+}
+function fileStore(path, codec = GITHUB_CODEC) {
+  const resolvedPath = path ?? defaultFilePath(codec.account);
+  const decode = decoderFor(codec);
+  return {
+    kind: `file (${resolvedPath})`,
+    load: () => {
+      try {
+        return decode(readFileSync2(resolvedPath, "utf8"));
+      } catch {
+        return;
+      }
+    },
+    save: (value) => {
+      mkdirSync2(dirname(resolvedPath), { recursive: true, mode: 448 });
+      const temporary = `${resolvedPath}.tmp`;
+      writeFileSync2(temporary, encode(value), { mode: 384 });
+      chmodSync(temporary, 384);
+      renameSync2(temporary, resolvedPath);
+    },
+    clear: () => {
+      rmSync(resolvedPath, { force: true });
+    }
+  };
+}
+function selectCredentialStore({
+  platform = process.platform,
+  env = process.env,
+  run = runCommand,
+  codec = GITHUB_CODEC
+} = {}) {
+  if (env.MAESTTRO_CREDENTIAL_STORE === "file")
+    return fileStore(undefined, codec);
+  if (platform === "darwin")
+    return keychainStore(run, codec);
+  if (platform === "linux" && commandExists(run, "secret-tool")) {
+    return secretToolStore(run, codec);
+  }
+  return fileStore(undefined, codec);
+}
+
+// src/claude-credentials.ts
+function oauthOf(value) {
+  const oauth = value?.claudeAiOauth;
+  return oauth && typeof oauth === "object" ? oauth : undefined;
+}
+function nonEmpty(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isClaudeCredentials(value) {
+  const oauth = oauthOf(value);
+  return oauth !== undefined && nonEmpty(oauth.accessToken) && typeof oauth.expiresAt === "number" && oauth.expiresAt > 0;
+}
+function isMasterLogin(value) {
+  return isClaudeCredentials(value) && nonEmpty(oauthOf(value)?.refreshToken);
+}
+function carriesRefreshToken(value) {
+  return nonEmpty(oauthOf(value)?.refreshToken);
+}
+function isBlankedLogin(value) {
+  const oauth = oauthOf(value);
+  if (!oauth)
+    return false;
+  return oauth.accessToken === "" || oauth.refreshToken === "" || typeof oauth.expiresAt === "number" && oauth.expiresAt <= 0;
+}
+function withoutRefreshToken(credentials) {
+  const { refreshToken: _, ...oauth } = credentials.claudeAiOauth;
+  return { claudeAiOauth: oauth };
+}
+function markedExpired({
+  credentials,
+  now
+}) {
+  return {
+    claudeAiOauth: { ...credentials.claudeAiOauth, expiresAt: now - 60000 }
+  };
+}
+function acceptRefreshed({
+  previous,
+  candidate,
+  now
+}) {
+  if (!isMasterLogin(candidate))
+    return;
+  if (candidate.claudeAiOauth.expiresAt <= now)
+    return;
+  if (candidate.claudeAiOauth.accessToken === previous.claudeAiOauth.accessToken)
+    return;
+  return candidate;
+}
+function markedRejected({
+  credentials,
+  now
+}) {
+  return { ...credentials, rejectedAt: now };
+}
+function claudeLoginState({
+  credentials,
+  now
+}) {
+  if (!credentials)
+    return "missing";
+  if (credentials.rejectedAt !== undefined)
+    return "expired";
+  const { refreshTokenExpiresAt } = credentials.claudeAiOauth;
+  if (refreshTokenExpiresAt !== undefined && refreshTokenExpiresAt <= now) {
+    return "expired";
+  }
+  return "active";
+}
+var LOGIN_WARNING_MS = 5 * 24 * 60 * 60 * 1000;
+var DAY_MS = 24 * 60 * 60 * 1000;
+function claudeLoginWarning({
+  credentials,
+  now
+}) {
+  if (claudeLoginState({ credentials, now }) !== "active")
+    return;
+  const expiresAt = credentials?.claudeAiOauth.refreshTokenExpiresAt;
+  if (expiresAt === undefined || expiresAt - now > LOGIN_WARNING_MS) {
+    return;
+  }
+  const days = Math.floor((expiresAt - now) / DAY_MS);
+  const within = days === 0 ? "within a day" : `in ${days} day${days === 1 ? "" : "s"}`;
+  return `Claude login expires ${within} (${new Date(expiresAt).toLocaleString()}): run \`maesttro login claude\` before then`;
+}
+var CLAUDE_CODEC = {
+  account: "claude",
+  accepts: isMasterLogin
+};
+function claudeStore() {
+  return selectCredentialStore({ codec: CLAUDE_CODEC });
+}
+
+// src/claude-keeper.ts
+import { spawn, spawnSync as spawnSync2 } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import {
+  chmodSync as chmodSync2,
+  mkdirSync as mkdirSync3,
+  mkdtempSync,
+  readFileSync as readFileSync3,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync3
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join4 } from "node:path";
+
+// src/host-identity.ts
+function hostIdentityEnv() {
+  if (typeof process.getuid !== "function" || typeof process.getgid !== "function") {
+    return {};
+  }
+  return {
+    MAESTTRO_HOST_UID: String(process.getuid()),
+    MAESTTRO_HOST_GID: String(process.getgid())
+  };
+}
+function hostIdentityFlags() {
+  return Object.entries(hostIdentityEnv()).map(([name, value]) => `-e ${name}=${value}`).join(" ");
+}
+
+// src/paths.ts
+import { dirname as dirname2, join as join3, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var PACKAGE_ROOT = resolve(dirname2(fileURLToPath(import.meta.url)), "..");
+var DOCKERFILE_DIR = join3(PACKAGE_ROOT, "docker");
+var IMAGE = "maesttro-runner:latest";
+var LEGACY_VOLUME = process.env.MAESTTRO_VOLUME?.trim() || "maesttro-home";
+
+// src/claude-keeper.ts
+var KEEPER_COMMAND = 'claude -p --model haiku "ok"';
+var KEEPER_TIMEOUT_MS = 75 * 1000;
+var KEEPER_REMOVE_TIMEOUT_MS = 10 * 1000;
+var KEEPER_EXIT_GRACE_MS = 5 * 1000;
+var LOGIN_COMMAND = "claude auth login";
+var REASON_MAX_LENGTH = 200;
+var dockerCli = (args, { interactive }) => {
+  const result = spawnSync2("docker", args, {
+    stdio: interactive ? "inherit" : ["ignore", "pipe", "pipe"]
+  });
+  return {
+    status: result.status ?? null,
+    stderr: result.stderr?.toString() ?? "",
+    error: result.error
+  };
+};
+function collect(child) {
+  let stdout = "";
+  let stderr = "";
+  child.stdout?.on("data", (chunk) => {
+    stdout += String(chunk);
+  });
+  child.stderr?.on("data", (chunk) => {
+    stderr += String(chunk);
+  });
+  return new Promise((resolve) => {
+    child.on("error", (error) => resolve({ status: null, stdout, stderr, error }));
+    child.on("close", (status) => resolve({ status, stdout, stderr }));
+  });
+}
+var keeperDockerCli = {
+  start: (args) => {
+    const child = spawn("docker", args, {
+      stdio: ["ignore", "ignore", "pipe"],
+      detached: true
+    });
+    return { exited: collect(child), kill: () => child.kill("SIGKILL") };
+  },
+  exec: (args, timeoutMs) => collect(spawn("docker", args, {
+    stdio: ["ignore", "pipe", "pipe"],
+    detached: true,
+    timeout: timeoutMs,
+    killSignal: "SIGKILL"
+  }))
+};
+function keeperNamePrefix(uid = process.getuid?.()) {
+  return `claude-keeper-${uid ?? "user"}-`;
+}
+function keeperContainerName() {
+  return `${keeperNamePrefix()}${randomBytes(4).toString("hex")}`;
+}
+function keeperWorkDir() {
+  return join4(maesttroHome(), "claude-keeper");
+}
+function runArgs({
+  claudeDir,
+  identity,
+  interactive,
+  command,
+  name
+}) {
+  return [
+    "run",
+    ...interactive ? ["-it"] : [],
+    "--rm",
+    ...Object.entries(identity).flatMap(([envName, value]) => [
+      "-e",
+      `${envName}=${value}`
+    ]),
+    ...name ? ["--name", name] : [],
+    "--mount",
+    `type=bind,source=${claudeDir},target=/home/agent/.claude`,
+    IMAGE,
+    command
+  ];
+}
+function keeperArgs({
+  claudeDir,
+  identity,
+  name
+}) {
+  return runArgs({
+    claudeDir,
+    identity,
+    interactive: false,
+    command: KEEPER_COMMAND,
+    name
+  });
+}
+function loginArgs({
+  claudeDir,
+  identity
+}) {
+  return runArgs({
+    claudeDir,
+    identity,
+    interactive: true,
+    command: LOGIN_COMMAND
+  });
+}
+function privateDir(parent = tmpdir()) {
+  mkdirSync3(parent, { recursive: true, mode: 448 });
+  const dir = mkdtempSync(join4(parent, "maesttro-claude-"));
+  chmodSync2(dir, 448);
+  return dir;
+}
+function readKeeperCredentials(dir) {
+  try {
+    return JSON.parse(readFileSync3(join4(dir, ".credentials.json"), "utf8"));
+  } catch {
+    return;
+  }
+}
+function inPrivateDir(makeDir, use) {
+  const dir = makeDir();
+  try {
+    return use(dir);
+  } finally {
+    rmSync2(dir, { recursive: true, force: true });
+  }
+}
+function lastLine(text) {
+  const lines = text.split(`
+`).map((line) => line.trim()).filter(Boolean);
+  return (lines.at(-1) ?? "").slice(-REASON_MAX_LENGTH);
+}
+function failureReason({
+  result,
+  timedOut,
+  name
+}) {
+  if (result.error && !timedOut) {
+    return result.error.message.replaceAll(name, "claude-keeper");
+  }
+  const summary = timedOut ? "the keeper timed out" : result.status === 0 ? "the keeper left the login unchanged" : `the keeper exited with status ${result.status}`;
+  const detail = lastLine(result.stderr.replaceAll(name, "claude-keeper"));
+  return detail ? `${summary}: ${detail}` : summary;
+}
+var TIMED_OUT = Symbol("timed out");
+function sleepFor(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function runBounded({
+  docker,
+  args,
+  name,
+  sleep
+}) {
+  const run = docker.start(args);
+  const first = await Promise.race([
+    run.exited,
+    sleep(KEEPER_TIMEOUT_MS).then(() => TIMED_OUT)
+  ]);
+  if (first !== TIMED_OUT)
+    return { result: first, timedOut: false, gone: true };
+  const removal = await docker.exec(["rm", "-f", name], KEEPER_REMOVE_TIMEOUT_MS);
+  const settled = await Promise.race([
+    run.exited,
+    sleep(KEEPER_EXIT_GRACE_MS).then(() => TIMED_OUT)
+  ]);
+  if (settled !== TIMED_OUT) {
+    return { result: settled, timedOut: true, gone: true };
+  }
+  run.kill();
+  return {
+    result: await run.exited,
+    timedOut: true,
+    gone: removal.status === 0
+  };
+}
+async function removeLingeringKeepers({
+  docker = keeperDockerCli
+} = {}) {
+  const listed = await docker.exec(["ps", "-aq", "--filter", `name=^${keeperNamePrefix()}`], KEEPER_REMOVE_TIMEOUT_MS);
+  if (listed.status !== 0) {
+    throw new Error(lastLine(listed.stderr) || "docker ps failed");
+  }
+  const ids = (listed.stdout ?? "").split(`
+`).filter(Boolean);
+  if (ids.length === 0)
+    return;
+  const removed = await docker.exec(["rm", "-f", ...ids], KEEPER_REMOVE_TIMEOUT_MS);
+  if (removed.status !== 0) {
+    throw new Error(lastLine(removed.stderr) || "docker rm failed");
+  }
+}
+async function refreshWithKeeper({
+  master,
+  now,
+  workDir = keeperWorkDir(),
+  docker = keeperDockerCli,
+  identity = hostIdentityEnv(),
+  sleep = sleepFor
+}) {
+  const claudeDir = privateDir(workDir);
+  let outcome = {
+    kind: "inconclusive",
+    reason: "the keeper never ran"
+  };
+  let keepDir = false;
+  try {
+    writeFileSync3(join4(claudeDir, ".credentials.json"), JSON.stringify(markedExpired({ credentials: master, now })), { mode: 384 });
+    const name = keeperContainerName();
+    const { result, timedOut, gone } = await runBounded({
+      docker,
+      args: keeperArgs({ claudeDir, identity, name }),
+      name,
+      sleep
+    });
+    const candidate = readKeeperCredentials(claudeDir);
+    const refreshed = acceptRefreshed({ previous: master, candidate, now });
+    if (refreshed) {
+      outcome = { kind: "refreshed", credentials: refreshed };
+      return outcome;
+    }
+    if (!gone) {
+      keepDir = true;
+      return {
+        kind: "inconclusive",
+        reason: "the keeper couldn't be stopped; its result is kept for the next refresh"
+      };
+    }
+    outcome = isBlankedLogin(candidate) ? { kind: "rejected" } : {
+      kind: "inconclusive",
+      reason: failureReason({ result, timedOut, name })
+    };
+    return outcome;
+  } finally {
+    if (outcome.kind !== "refreshed" && !keepDir) {
+      rmSync2(claudeDir, { recursive: true, force: true });
+    }
+  }
+}
+function captureLogin({
+  docker = dockerCli,
+  makeDir = () => privateDir(),
+  identity = hostIdentityEnv()
+} = {}) {
+  return inPrivateDir(makeDir, (claudeDir) => {
+    const { status } = docker(loginArgs({ claudeDir, identity }), {
+      interactive: true
+    });
+    if (status !== 0)
+      return;
+    const credentials = readKeeperCredentials(claudeDir);
+    return isMasterLogin(credentials) ? credentials : undefined;
+  });
+}
+
+// src/claude-refresher.ts
+import { randomBytes as randomBytes4 } from "node:crypto";
+import {
+  closeSync as closeSync2,
+  existsSync,
+  linkSync,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync7,
+  openSync as openSync2,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync7,
+  renameSync as renameSync5,
+  rmSync as rmSync5,
+  statSync,
+  utimesSync,
+  writeSync
+} from "node:fs";
+import { dirname as dirname4, join as join7 } from "node:path";
+
+// src/held-signals.ts
+var HELD_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+var processSignals = {
+  listenerCount: (signal) => process.listenerCount(signal),
+  on: (signal, handler) => {
+    process.on(signal, handler);
+  },
+  off: (signal, handler) => {
+    process.off(signal, handler);
+  },
+  raise: (signal) => {
+    process.kill(process.pid, signal);
+  }
+};
+function holdSignals({
+  host = processSignals,
+  onHeld = () => {}
+}) {
+  let received;
+  let released = false;
+  const handlers = [];
+  const detach = () => {
+    for (const { signal, handler } of handlers)
+      host.off(signal, handler);
+    handlers.length = 0;
+  };
+  for (const signal of HELD_SIGNALS) {
+    if (host.listenerCount(signal) > 0)
+      continue;
+    const handler = () => {
+      if (received) {
+        released = true;
+        detach();
+        host.raise(signal);
+        return;
+      }
+      received = signal;
+      onHeld();
+    };
+    host.on(signal, handler);
+    handlers.push({ signal, handler });
+  }
+  return {
+    pending: () => received !== undefined,
+    release: () => {
+      if (released)
+        return;
+      released = true;
+      detach();
+      if (received)
+        host.raise(received);
+    }
+  };
+}
+function signalRouter({
+  base = processSignals,
+  onUnrouted
+}) {
+  const routed = new Map;
+  const listeners = HELD_SIGNALS.map((signal) => {
+    const listener = () => {
+      const handlers = [...routed.get(signal) ?? []];
+      if (handlers.length === 0)
+        return onUnrouted(signal);
+      for (const handler of handlers)
+        handler();
+    };
+    base.on(signal, listener);
+    return { signal, listener };
+  });
+  return {
+    listenerCount: (signal) => routed.get(signal)?.size ?? 0,
+    on: (signal, handler) => {
+      routed.set(signal, (routed.get(signal) ?? new Set).add(handler));
+    },
+    off: (signal, handler) => {
+      routed.get(signal)?.delete(handler);
+    },
+    raise: (signal) => onUnrouted(signal),
+    dispose: () => {
+      for (const { signal, listener } of listeners)
+        base.off(signal, listener);
+    }
+  };
+}
+
+// src/refresher.ts
+var REFRESH_LEAD_MS = 10 * 60 * 1000;
+var WALL_CLOCK_TICK_MS = 60 * 1000;
+var FIRST_BACKOFF_MS = 5 * 1000;
+var MAX_BACKOFF_MS = 5 * 60 * 1000;
+var nodeTimers = {
+  setTimeout: (callback, ms) => setTimeout(callback, ms).unref(),
+  clearTimeout: (handle) => clearTimeout(handle),
+  setInterval: (callback, ms) => setInterval(callback, ms).unref(),
+  clearInterval: (handle) => clearInterval(handle)
+};
+function refreshDueAt({
+  expiresAt,
+  now
+}) {
+  const halfRemaining = (expiresAt - now) / 2;
+  return expiresAt - Math.min(REFRESH_LEAD_MS, Math.max(halfRemaining, 0));
+}
+function startRefresher({
+  initial,
+  expiresAtOf,
+  firstAttemptAt,
+  refresh,
+  onRefreshed,
+  onFailed,
+  now = Date.now,
+  timers = nodeTimers
+}) {
+  let current = initial;
+  let nextAttemptAt = 0;
+  let backoffMs = FIRST_BACKOFF_MS;
+  let inFlight;
+  let stopped = false;
+  let pending;
+  function dueAt(token) {
+    return refreshDueAt({ expiresAt: expiresAtOf(token), now: now() });
+  }
+  nextAttemptAt = firstAttemptAt ?? dueAt(initial);
+  function scheduleAt(at) {
+    timers.clearTimeout(pending);
+    pending = timers.setTimeout(check, Math.max(at - now(), 0));
+  }
+  async function attempt() {
+    try {
+      const token = await refresh();
+      if (stopped)
+        return;
+      current = token;
+      backoffMs = FIRST_BACKOFF_MS;
+      nextAttemptAt = dueAt(token);
+      onRefreshed(token);
+    } catch (error) {
+      if (stopped)
+        return;
+      nextAttemptAt = now() + backoffMs;
+      onFailed(error, backoffMs);
+      backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
+    }
+    scheduleAt(nextAttemptAt);
+  }
+  function check() {
+    if (stopped)
+      return Promise.resolve();
+    if (inFlight)
+      return inFlight;
+    if (now() < nextAttemptAt)
+      return Promise.resolve();
+    inFlight = attempt().finally(() => {
+      inFlight = undefined;
+    });
+    return inFlight;
+  }
+  const tick = timers.setInterval(check, WALL_CLOCK_TICK_MS);
+  scheduleAt(nextAttemptAt);
+  return {
+    current: () => current,
+    check,
+    stop: () => {
+      stopped = true;
+      timers.clearTimeout(pending);
+      timers.clearInterval(tick);
+      return inFlight ?? Promise.resolve();
+    },
+    busy: () => inFlight !== undefined
+  };
+}
+
+// src/session-home.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import {
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync6,
+  openSync,
+  readFileSync as readFileSync6,
+  renameSync as renameSync4,
+  rmSync as rmSync4,
+  unlinkSync,
+  writeFileSync as writeFileSync6
+} from "node:fs";
+import { join as join6 } from "node:path";
+
+// src/json-file.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3 } from "node:path";
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeJson(existing, curated) {
+  const merged = { ...existing };
+  for (const [key, value] of Object.entries(curated)) {
+    const current = merged[key];
+    merged[key] = isObject(current) && isObject(value) ? mergeJson(current, value) : value;
+  }
+  return merged;
+}
+function readJson(path) {
+  try {
+    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    return isObject(parsed) ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function writeJson(path, value) {
+  mkdirSync4(dirname3(path), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+function skipInsignificant(text, from) {
+  let index = from;
+  while (index < text.length) {
+    if (/\s/.test(text[index] ?? "")) {
+      index++;
+    } else if (text.startsWith("//", index)) {
+      while (index < text.length && text[index] !== `
+`)
+        index++;
+    } else if (text.startsWith("/*", index)) {
+      const end = text.indexOf("*/", index + 2);
+      index = end === -1 ? text.length : end + 2;
+    } else {
+      return index;
+    }
+  }
+  return index;
+}
+function stripJsonc(text) {
+  let output = "";
+  let index = 0;
+  while (index < text.length) {
+    const char = text[index];
+    if (char === '"') {
+      const start = index;
+      index++;
+      while (index < text.length && text[index] !== '"') {
+        index += text[index] === "\\" ? 2 : 1;
+      }
+      index++;
+      output += text.slice(start, index);
+      continue;
+    }
+    const significant = skipInsignificant(text, index);
+    if (significant > index) {
+      output += " ";
+      index = significant;
+      continue;
+    }
+    const trailingComma = char === "," && /[}\]]/.test(text[skipInsignificant(text, index + 1)] ?? "");
+    if (!trailingComma)
+      output += char;
+    index++;
+  }
+  return output;
+}
+function parseJsonc(text) {
+  const parsed = JSON.parse(stripJsonc(text));
+  if (!isObject(parsed))
+    throw new Error("expected a JSON object");
+  return parsed;
+}
+
+// src/sessions.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import {
+  chmodSync as chmodSync3,
+  lstatSync,
+  mkdirSync as mkdirSync5,
+  readdirSync,
+  readFileSync as readFileSync5,
+  renameSync as renameSync3,
+  rmSync as rmSync3,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { join as join5 } from "node:path";
+function newSessionId() {
+  return `maesttro-${randomBytes2(4).toString("hex")}`;
+}
+function sessionsDir(home = maesttroHome()) {
+  return join5(home, "sessions");
+}
+function saveSession(record, dir = sessionsDir()) {
+  mkdirSync5(dir, { recursive: true, mode: 448 });
+  const path = join5(dir, `${record.id}.json`);
+  writeFileSync5(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
+`);
+  renameSync3(`${path}.tmp`, path);
+}
+function readSession(id, dir = sessionsDir()) {
+  try {
+    return JSON.parse(readFileSync5(join5(dir, `${id}.json`), "utf8"));
+  } catch {
+    return;
+  }
+}
+function unlockTree(path) {
+  let entry;
+  try {
+    entry = lstatSync(path);
+  } catch {
+    return;
+  }
+  if (!entry.isDirectory())
+    return;
+  chmodSync3(path, 448);
+  for (const name of readdirSync(path))
+    unlockTree(join5(path, name));
+}
+function removeTree(path) {
+  try {
+    rmSync3(path, { recursive: true, force: true });
+  } catch {
+    unlockTree(path);
+    rmSync3(path, { recursive: true, force: true });
+  }
+}
+function deleteSession(id, dir = sessionsDir()) {
+  removeTree(join5(dir, id));
+  rmSync3(join5(dir, `${id}.json`), { force: true });
+}
+function sessionsForRepo(repoRoot, dir = sessionsDir()) {
+  let names;
+  try {
+    names = readdirSync(dir).filter((name) => name.endsWith(".json"));
+  } catch {
+    return [];
+  }
+  return names.map((name) => readSession(name.slice(0, -".json".length), dir)).filter((record) => record?.repoRoot === repoRoot).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+}
+
+// src/session-home.ts
+var OPEN_DIRECTORY_NO_FOLLOW = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
+var CREATE_NEW_NO_FOLLOW = constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW;
+var READ_NO_FOLLOW_NO_BLOCK = constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+function sessionHome({
+  id,
+  dir = sessionsDir()
+}) {
+  return join6(dir, id, "home");
+}
+function sessionClaudeDir({
+  id,
+  dir = sessionsDir()
+}) {
+  return join6(dir, id, "claude");
+}
+function credentialsPath(claudeDir) {
+  return join6(claudeDir, ".credentials.json");
+}
+function entryAt(path) {
+  try {
+    return lstatSync2(path);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+}
+function requireRealDirectory(path) {
+  if (!lstatSync2(path).isDirectory()) {
+    throw new Error(`Not a directory: ${path}`);
+  }
+}
+function withFd(fd, use) {
+  try {
+    return use(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+function ensurePrivateDir(path) {
+  const entry = entryAt(path);
+  if (!entry?.isDirectory()) {
+    if (entry)
+      unlinkSync(path);
+    mkdirSync6(path, { recursive: true, mode: 448 });
+  }
+  withFd(openSync(path, OPEN_DIRECTORY_NO_FOLLOW), (fd) => fchmodSync(fd, 448));
+}
+function ensureSessionHome({
+  id,
+  dir = sessionsDir()
+}) {
+  const home = sessionHome({ id, dir });
+  const claudeDir = sessionClaudeDir({ id, dir });
+  ensurePrivateDir(home);
+  ensurePrivateDir(claudeDir);
+  ensurePrivateDir(join6(home, ".claude"));
+  return { home, claudeDir };
+}
+function supersedes({
+  credentials,
+  current
+}) {
+  if (carriesRefreshToken(current))
+    return false;
+  if (!isClaudeCredentials(current))
+    return true;
+  return credentials.claudeAiOauth.expiresAt > current.claudeAiOauth.expiresAt;
+}
+function writeSessionCredentials({
+  claudeDir,
+  credentials
+}) {
+  requireRealDirectory(claudeDir);
+  const current = readSessionCredentials({ claudeDir });
+  if (!supersedes({ credentials, current }))
+    return false;
+  const temporary = join6(claudeDir, `.credentials.json.maesttro-${randomBytes3(8).toString("hex")}`);
+  const fd = openSync(temporary, CREATE_NEW_NO_FOLLOW, 384);
+  try {
+    withFd(fd, () => {
+      writeFileSync6(fd, JSON.stringify({
+        ...isObject(current) ? current : {},
+        ...withoutRefreshToken(credentials)
+      }));
+      fchmodSync(fd, 384);
+    });
+    renameSync4(temporary, credentialsPath(claudeDir));
+  } catch (error) {
+    rmSync4(temporary, { force: true });
+    throw error;
+  }
+  return true;
 }
-function decode(encoded) {
+function readSessionCredentials({
+  claudeDir
+}) {
   try {
-    const token = JSON.parse(Buffer.from(encoded.trim(), "base64").toString("utf8"));
-    return typeof token.access_token === "string" ? token : undefined;
+    return withFd(openSync(credentialsPath(claudeDir), READ_NO_FOLLOW_NO_BLOCK), (fd) => fstatSync(fd).isFile() ? JSON.parse(readFileSync6(fd, "utf8")) : undefined);
   } catch {
     return;
   }
 }
-function keychainStore(run = runCommand) {
-  const identity = ["-s", SERVICE, "-a", ACCOUNT];
-  return {
-    kind: "macOS keychain",
-    load: () => {
-      const result = run("security", [
-        "find-generic-password",
-        ...identity,
-        "-w"
-      ]);
-      return result.status === 0 ? decode(result.stdout) : undefined;
-    },
-    save: (token) => {
-      const command = `add-generic-password -U ${identity.join(" ")} -w ${encode(token)}
-`;
-      const result = run("security", ["-i"], command);
-      if (result.status !== 0)
-        throw new Error("Could not write to keychain");
-    },
-    clear: () => {
-      run("security", ["delete-generic-password", ...identity]);
+function removeHostWrittenCredentials({
+  claudeDir
+}) {
+  requireRealDirectory(claudeDir);
+  const path = credentialsPath(claudeDir);
+  const entry = entryAt(path);
+  if (!entry)
+    return;
+  const inSessionLogin = entry.isFile() && carriesRefreshToken(readSessionCredentials({ claudeDir }));
+  if (!inSessionLogin)
+    unlinkSync(path);
+}
+
+// src/claude-refresher.ts
+var LOCK_STALE_MS = 2 * 60 * 1000;
+var LOCK_HEARTBEAT_MS = 20 * 1000;
+var SESSION_SYNC_MS = 60 * 1000;
+var LAUNCH_RETRY_MS = 60 * 1000;
+var WAITING_FOR_REFRESH = "Waiting for another maesttro's Claude refresh…";
+
+class ClaudeLoginExpired extends Error {
+  constructor() {
+    super("Claude login expired: run `maesttro login claude`");
+  }
+}
+
+class ClaudeRefreshFailed extends Error {
+  constructor(reason) {
+    super(`Couldn't refresh the Claude login (will retry): ${reason}`);
+  }
+}
+
+class ClaudeLoggedOut extends Error {
+  constructor() {
+    super("Not logged in to Claude: run `maesttro login claude`");
+  }
+}
+function claudeLockPath() {
+  return join7(maesttroHome(), "claude-refresh.lock");
+}
+function lockToken() {
+  return `${process.pid}-${randomBytes4(8).toString("hex")}`;
+}
+function tryAcquire(path, token) {
+  let fd;
+  try {
+    fd = openSync2(path, "wx", 384);
+  } catch (error) {
+    if (error.code === "EEXIST")
+      return false;
+    throw error;
+  }
+  try {
+    writeSync(fd, token);
+  } catch (error) {
+    rmSync5(path, { force: true });
+    throw error;
+  } finally {
+    closeSync2(fd);
+  }
+  return true;
+}
+function isStale(path, now, staleMs) {
+  try {
+    return now - statSync(path).mtimeMs > staleMs;
+  } catch {
+    return false;
+  }
+}
+function reclaimStaleLock({
+  path,
+  now,
+  staleMs
+}) {
+  const staging = `${path}.stale-${lockToken()}`;
+  try {
+    renameSync5(path, staging);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return;
+    throw error;
+  }
+  if (!isStale(staging, now, staleMs)) {
+    try {
+      linkSync(staging, path);
+    } catch {}
+  }
+  rmSync5(staging, { force: true });
+}
+function touchIfOwned(path, token) {
+  try {
+    if (readFileSync7(path, "utf8") === token) {
+      const now = new Date;
+      utimesSync(path, now, now);
     }
-  };
+  } catch {}
 }
-function secretToolStore(run = runCommand) {
-  const attributes = ["service", SERVICE, "account", ACCOUNT];
-  return {
-    kind: "Secret Service (secret-tool)",
-    load: () => {
-      const result = run("secret-tool", ["lookup", ...attributes]);
-      return result.status === 0 ? decode(result.stdout) : undefined;
-    },
-    save: (token) => {
-      const result = run("secret-tool", ["store", `--label=${SERVICE}`, ...attributes], encode(token));
-      if (result.status !== 0) {
-        throw new Error("Could not write to the Secret Service");
+function releaseIfOwned(path, token) {
+  try {
+    if (readFileSync7(path, "utf8") === token)
+      rmSync5(path, { force: true });
+  } catch {}
+}
+function sleepFor2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function withRefreshLock({
+  path,
+  now = Date.now,
+  staleMs = LOCK_STALE_MS,
+  pollMs = 500,
+  sleep = sleepFor2,
+  onWait = () => {},
+  timers = nodeTimers
+}, action) {
+  mkdirSync7(dirname4(path), { recursive: true, mode: 448 });
+  const token = lockToken();
+  let waited = false;
+  while (!tryAcquire(path, token)) {
+    if (isStale(path, now(), staleMs)) {
+      reclaimStaleLock({ path, now: now(), staleMs });
+    } else {
+      if (!waited)
+        onWait();
+      waited = true;
+      await sleep(pollMs);
+    }
+  }
+  const heartbeat = timers.setInterval(() => touchIfOwned(path, token), LOCK_HEARTBEAT_MS);
+  try {
+    return await action();
+  } finally {
+    timers.clearInterval(heartbeat);
+    releaseIfOwned(path, token);
+  }
+}
+function isDue({
+  credentials,
+  now
+}) {
+  return credentials.claudeAiOauth.expiresAt - now <= REFRESH_LEAD_MS;
+}
+var FINISHING_REFRESH = "Finishing the Claude refresh before exiting… (press Ctrl-C again to abort)";
+var FINISHING_BACKGROUND_REFRESH = "Finishing a Claude refresh before exiting…";
+var runKeeper = ({ master, now, workDir }) => refreshWithKeeper({ master, now, workDir });
+function loadMaster(store) {
+  const master = store.load();
+  if (!master)
+    throw new ClaudeLoggedOut;
+  return master;
+}
+function keeperLeftovers(workDir) {
+  try {
+    return readdirSync2(workDir).map((name) => join7(workDir, name)).filter((path) => lstatSync3(path).isDirectory());
+  } catch {
+    return [];
+  }
+}
+function discardLeftovers(workDir) {
+  for (const dir of keeperLeftovers(workDir)) {
+    rmSync5(dir, { recursive: true, force: true });
+  }
+}
+function discardKeeperLeftovers({
+  workDir = keeperWorkDir()
+} = {}) {
+  discardLeftovers(workDir);
+}
+function saveRotated({
+  store,
+  credentials,
+  workDir,
+  onRotated
+}) {
+  try {
+    store.save(credentials);
+  } catch (error) {
+    onRotated(credentials);
+    throw new ClaudeRefreshFailed(`couldn't save the refreshed login: ${messageOf(error)}`);
+  }
+  discardLeftovers(workDir);
+  onRotated(credentials);
+}
+function adoptLeftover({
+  master,
+  workDir
+}) {
+  let best;
+  for (const dir of keeperLeftovers(workDir)) {
+    const candidate = readKeeperCredentials(dir);
+    if (!isMasterLogin(candidate))
+      continue;
+    const { accessToken, expiresAt } = candidate.claudeAiOauth;
+    const newest = best ?? master;
+    if (accessToken !== master.claudeAiOauth.accessToken && expiresAt > newest.claudeAiOauth.expiresAt) {
+      best = { claudeAiOauth: candidate.claudeAiOauth };
+    }
+  }
+  return best;
+}
+function sameLogin(current, expected) {
+  return current?.claudeAiOauth.accessToken === expected.claudeAiOauth.accessToken;
+}
+function replacedMeanwhile({
+  store,
+  handed,
+  workDir
+}) {
+  const current = store.load();
+  if (sameLogin(current, handed))
+    return;
+  if (!current)
+    throw new ClaudeLoggedOut;
+  discardLeftovers(workDir);
+  return current;
+}
+async function clearEarlierKeepers(clearLingering) {
+  try {
+    await clearLingering();
+  } catch (error) {
+    throw new ClaudeRefreshFailed(`couldn't stop an earlier keeper: ${messageOf(error)}`);
+  }
+}
+async function refreshMaster({
+  store,
+  keeper = runKeeper,
+  lockPath = claudeLockPath(),
+  workDir = keeperWorkDir(),
+  clearLingering = () => removeLingeringKeepers(),
+  now = Date.now,
+  announce,
+  sleep,
+  signals,
+  onRotated = () => {}
+}) {
+  const loaded = loadMaster(store);
+  if (keeperLeftovers(workDir).length === 0) {
+    if (loaded.rejectedAt !== undefined)
+      throw new ClaudeLoginExpired;
+    if (!isDue({ credentials: loaded, now: now() }))
+      return loaded;
+  }
+  const onWait = announce ? () => announce(WAITING_FOR_REFRESH) : undefined;
+  const onHeld = announce ? () => announce(FINISHING_REFRESH) : undefined;
+  let hold;
+  try {
+    return await withRefreshLock({ path: lockPath, now, sleep, onWait }, async () => {
+      if (signals)
+        hold = holdSignals({ host: signals, onHeld });
+      await clearEarlierKeepers(clearLingering);
+      let stored = store.load();
+      if (!stored)
+        throw new ClaudeLoggedOut;
+      const adopted = adoptLeftover({ master: stored, workDir });
+      if (adopted) {
+        saveRotated({ store, credentials: adopted, workDir, onRotated });
+        stored = adopted;
       }
-    },
-    clear: () => {
-      run("secret-tool", ["clear", ...attributes]);
+      discardLeftovers(workDir);
+      if (stored.rejectedAt !== undefined)
+        throw new ClaudeLoginExpired;
+      if (!isDue({ credentials: stored, now: now() }))
+        return stored;
+      if (hold?.pending()) {
+        throw new ClaudeRefreshFailed("interrupted before the keeper ran");
+      }
+      const outcome = await keeper({ master: stored, now: now(), workDir });
+      if (outcome.kind === "inconclusive") {
+        throw new ClaudeRefreshFailed(outcome.reason);
+      }
+      const newer = replacedMeanwhile({ store, handed: stored, workDir });
+      if (newer)
+        return newer;
+      if (outcome.kind === "rejected") {
+        try {
+          store.save(markedRejected({ credentials: stored, now: now() }));
+        } catch {}
+        throw new ClaudeLoginExpired;
+      }
+      saveRotated({
+        store,
+        credentials: outcome.credentials,
+        workDir,
+        onRotated
+      });
+      return outcome.credentials;
+    });
+  } finally {
+    hold?.release();
+  }
+}
+function runningSessionIds({
+  run = runCommand
+} = {}) {
+  const result = run("docker", ["ps", "--format", "{{.Names}}"]);
+  if (result.status !== 0)
+    return [];
+  return result.stdout.split(`
+`).map((name) => name.trim()).filter((name) => name.startsWith("maesttro-"));
+}
+function messageOf(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function pushCredentials({
+  credentials,
+  claudeDirs,
+  announce
+}) {
+  for (const claudeDir of new Set(claudeDirs)) {
+    if (!existsSync(claudeDir))
+      continue;
+    try {
+      writeSessionCredentials({ claudeDir, credentials });
+    } catch (error) {
+      announce(`Couldn't update the Claude login in ${claudeDir}: ${messageOf(error)}`);
     }
-  };
+  }
 }
-function fileStore(path = join(homedir(), ".config", "maesttro", "credentials.json")) {
+function announcingOnce(announce, alreadySaid) {
+  let last = alreadySaid;
   return {
-    kind: `file (${path})`,
-    load: () => {
-      try {
-        return decode(readFileSync(path, "utf8"));
-      } catch {
+    say: (message) => {
+      if (message === last)
         return;
-      }
-    },
-    save: (token) => {
-      mkdirSync(dirname(path), { recursive: true, mode: 448 });
-      const temporary = `${path}.tmp`;
-      writeFileSync(temporary, encode(token), { mode: 384 });
-      chmodSync(temporary, 384);
-      renameSync(temporary, path);
+      last = message;
+      announce(message);
     },
-    clear: () => {
-      rmSync(path, { force: true });
+    reset: () => {
+      last = undefined;
     }
   };
 }
-function selectCredentialStore({
-  platform = process.platform,
-  env = process.env,
-  run = runCommand
-} = {}) {
-  if (env.MAESTTRO_CREDENTIAL_STORE === "file")
-    return fileStore();
-  if (platform === "darwin")
-    return keychainStore(run);
-  if (platform === "linux" && commandExists(run, "secret-tool")) {
-    return secretToolStore(run);
-  }
-  return fileStore();
+function syncSessionCredentials({
+  store,
+  claudeDir,
+  now = Date.now
+}) {
+  const master = store.load();
+  if (!master || master.claudeAiOauth.expiresAt <= now())
+    return;
+  writeSessionCredentials({ claudeDir, credentials: master });
+}
+function pushToRunningSessions({
+  credentials,
+  claudeDir,
+  run = runCommand,
+  claudeDirOf = (id) => sessionClaudeDir({ id }),
+  announce
+}) {
+  pushCredentials({
+    credentials,
+    claudeDirs: [claudeDir, ...runningSessionIds({ run }).map(claudeDirOf)],
+    announce
+  });
+}
+function startClaudeRefresher({
+  claudeDir,
+  store,
+  keeper,
+  lockPath,
+  workDir,
+  clearLingering,
+  run = runCommand,
+  claudeDirOf = (id) => sessionClaudeDir({ id }),
+  announce,
+  launchFailure,
+  now = Date.now,
+  timers = nodeTimers
+}) {
+  const initial = store.load();
+  if (!initial)
+    return;
+  const refreshNotices = announcingOnce(announce, launchFailure);
+  const syncNotices = announcingOnce(announce);
+  const refresher = startRefresher({
+    initial,
+    expiresAtOf: (credentials) => credentials.claudeAiOauth.expiresAt,
+    firstAttemptAt: launchFailure === undefined ? undefined : now() + LAUNCH_RETRY_MS,
+    refresh: () => refreshMaster({
+      store,
+      keeper,
+      lockPath,
+      workDir,
+      clearLingering,
+      now,
+      onRotated: (credentials) => pushToRunningSessions({
+        credentials,
+        claudeDir,
+        run,
+        claudeDirOf,
+        announce: refreshNotices.say
+      })
+    }),
+    onRefreshed: (credentials) => {
+      refreshNotices.reset();
+      pushCredentials({
+        credentials,
+        claudeDirs: [claudeDir],
+        announce: refreshNotices.say
+      });
+    },
+    onFailed: (error) => refreshNotices.say(messageOf(error)),
+    now,
+    timers
+  });
+  const sync = timers.setInterval(() => {
+    try {
+      syncSessionCredentials({ store, claudeDir, now });
+      syncNotices.reset();
+    } catch (error) {
+      syncNotices.say(messageOf(error));
+    }
+  }, SESSION_SYNC_MS);
+  return {
+    stop: () => {
+      timers.clearInterval(sync);
+      return refresher.stop();
+    },
+    busy: refresher.busy
+  };
 }
 
 // src/github-api.ts
@@ -403,7 +1719,7 @@ function loginDependencies() {
 function describeExpiry(iso) {
   return iso ? new Date(iso).toLocaleString() : "never";
 }
-async function login() {
+async function loginGitHub() {
   const dependencies = loginDependencies();
   const token = await deviceLogin(dependencies);
   const name = await githubLogin(token.access_token);
@@ -413,139 +1729,213 @@ async function ensureLogin() {
   const dependencies = loginDependencies();
   const token = await currentUserToken({ ...dependencies, interactive: true });
   const name = token && await githubLogin(token.access_token);
-  console.log(name ? `Logged in to GitHub as ${name}. Stored in ${dependencies.store.kind}.` : "GitHub login did not complete. Run `maesttro login` to retry.");
+  console.log(name ? `Logged in to GitHub as ${name}. Stored in ${dependencies.store.kind}.` : "GitHub login did not complete. Run `maesttro login github` to retry.");
 }
-function logout() {
+function logoutGitHub() {
   const { store } = loginDependencies();
   store.clear();
   console.log(`Logged out. Removed GitHub credentials from ${store.kind}.`);
 }
-async function status() {
-  const dependencies = loginDependencies();
-  const token = await currentUserToken({ ...dependencies, interactive: false });
-  if (!token) {
-    console.log("Not logged in to GitHub. Run `maesttro login`.");
+async function statusGitHub() {
+  const dependencies = loginDependencies();
+  const token = await currentUserToken({ ...dependencies, interactive: false });
+  if (!token) {
+    console.log("Not logged in to GitHub. Run `maesttro login github`.");
+    process.exitCode = 1;
+    return;
+  }
+  const name = await githubLogin(token.access_token);
+  console.log([
+    `GitHub: ${name ? `logged in as ${name}` : "token rejected — run `maesttro login github`"}`,
+    `Store: ${dependencies.store.kind}`,
+    `Access token expires: ${describeExpiry(token.expires_at)}`,
+    `Refresh token expires: ${describeExpiry(token.refresh_expires_at)}`
+  ].join(`
+`));
+  if (!name)
+    process.exitCode = 1;
+}
+function parseLoginTargets(args) {
+  const [target, ...rest] = args;
+  if (rest.length > 0)
+    return;
+  if (target === undefined)
+    return ["github", "claude"];
+  return target === "github" || target === "claude" ? [target] : undefined;
+}
+function claudeLogin({
+  capture = () => captureLogin(),
+  store = claudeStore(),
+  forgetLeftovers = () => discardKeeperLeftovers(),
+  announce = (message) => console.log(message)
+} = {}) {
+  announce("Logging in to Claude in a throwaway runner (opens a URL; paste the code back)...");
+  const credentials = capture();
+  if (!credentials) {
+    announce("Claude login did not complete. Run `maesttro login claude` to retry.");
+    return false;
+  }
+  store.save(credentials);
+  forgetLeftovers();
+  announce(`Logged in to Claude. Stored in ${store.kind}.`);
+  return true;
+}
+function describeClaudeStatus({
+  credentials,
+  now
+}) {
+  if (!credentials) {
+    return {
+      loggedIn: false,
+      lines: ["Claude: not logged in — run `maesttro login claude`"]
+    };
+  }
+  const { expiresAt, refreshTokenExpiresAt } = credentials.claudeAiOauth;
+  const loggedIn = claudeLoginState({ credentials, now }) === "active";
+  const warning = claudeLoginWarning({ credentials, now });
+  return {
+    loggedIn,
+    lines: [
+      loggedIn ? "Claude: logged in" : "Claude: login expired — run `maesttro login claude`",
+      ...warning ? [`Warning: ${warning}`] : [],
+      `Access token expires: ${new Date(expiresAt).toLocaleString()}`,
+      `Refresh token expires: ${refreshTokenExpiresAt ? new Date(refreshTokenExpiresAt).toLocaleString() : "unknown"}`
+    ]
+  };
+}
+function unknownTarget(command) {
+  console.log(`Usage: maesttro ${command} [github|claude]`);
+  process.exitCode = 1;
+}
+async function login({ args }) {
+  const targets = parseLoginTargets(args);
+  if (!targets)
+    return unknownTarget("login");
+  if (targets.includes("github"))
+    await loginGitHub();
+  if (targets.includes("claude") && !claudeLogin())
     process.exitCode = 1;
+}
+function logout({ args }) {
+  const targets = parseLoginTargets(args);
+  if (!targets) {
+    unknownTarget("logout");
     return;
   }
-  const name = await githubLogin(token.access_token);
-  console.log([
-    `GitHub: ${name ? `logged in as ${name}` : "token rejected — run `maesttro login`"}`,
-    `Store: ${dependencies.store.kind}`,
-    `Access token expires: ${describeExpiry(token.expires_at)}`,
-    `Refresh token expires: ${describeExpiry(token.refresh_expires_at)}`
-  ].join(`
+  if (targets.includes("github"))
+    logoutGitHub();
+  if (targets.includes("claude")) {
+    const store = claudeStore();
+    store.clear();
+    discardKeeperLeftovers();
+    console.log(`Logged out. Removed Claude credentials from ${store.kind}.`);
+  }
+}
+async function status({ args }) {
+  const targets = parseLoginTargets(args);
+  if (!targets)
+    return unknownTarget("status");
+  if (targets.includes("github"))
+    await statusGitHub();
+  if (targets.includes("claude")) {
+    const { loggedIn, lines } = describeClaudeStatus({
+      credentials: claudeStore().load(),
+      now: Date.now()
+    });
+    console.log(lines.join(`
 `));
-  if (!name)
-    process.exitCode = 1;
+    if (!loggedIn)
+      process.exitCode = 1;
+  }
+}
+
+// src/clients.ts
+var CLIENTS = {
+  claude: {
+    label: "Claude Code",
+    npmPackage: "@anthropic-ai/claude-code",
+    binary: "claude",
+    configDir: "/home/agent/.claude"
+  },
+  opencode: {
+    label: "opencode",
+    npmPackage: "opencode-ai",
+    binary: "opencode",
+    configDir: "/home/agent/.config/opencode"
+  }
+};
+var DEFAULT_CLIENT = "opencode";
+function isClientKey(value) {
+  return Object.hasOwn(CLIENTS, value);
 }
 
 // src/configure.ts
 import {
   cpSync as cpSync2,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync4,
-  readdirSync,
-  readFileSync as readFileSync4,
-  writeFileSync as writeFileSync4
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync9,
+  readdirSync as readdirSync3,
+  readFileSync as readFileSync10,
+  writeFileSync as writeFileSync9
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname5, join as join4 } from "node:path";
+import { dirname as dirname6, join as join10 } from "node:path";
 
-// src/client-configs.ts
-import {
-  chmodSync as chmodSync2,
-  cpSync,
-  existsSync,
-  mkdirSync as mkdirSync3,
-  mkdtempSync,
-  readFileSync as readFileSync3,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync3
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname as dirname3, join as join2 } from "node:path";
+// src/claude-state.ts
+import { readFileSync as readFileSync8, renameSync as renameSync6, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join8 } from "node:path";
 
-// src/json-file.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
-function isObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function mergeJson(existing, curated) {
-  const merged = { ...existing };
-  for (const [key, value] of Object.entries(curated)) {
-    const current = merged[key];
-    merged[key] = isObject(current) && isObject(value) ? mergeJson(current, value) : value;
-  }
-  return merged;
+// src/runner-paths.ts
+var CONTAINER_REPO_PATH = "/workspace";
+
+// src/claude-state.ts
+function seededClaudeState({
+  existing,
+  claudeVersion
+}) {
+  const projects = isObject(existing.projects) ? existing.projects : {};
+  return {
+    ...existing,
+    hasCompletedOnboarding: true,
+    ...claudeVersion ? { lastOnboardingVersion: claudeVersion } : {},
+    theme: existing.theme ?? "dark",
+    projects: mergeJson(projects, {
+      [CONTAINER_REPO_PATH]: { hasTrustDialogAccepted: true }
+    })
+  };
 }
-function readJson(path) {
+function installedClaudeVersion(root = "/usr/local/lib/node_modules/@anthropic-ai/claude-code") {
   try {
-    const parsed = JSON.parse(readFileSync2(path, "utf8"));
-    return isObject(parsed) ? parsed : {};
+    return JSON.parse(readFileSync8(join8(root, "package.json"), "utf8")).version;
   } catch {
-    return {};
+    return;
   }
 }
-function writeJson(path, value) {
-  mkdirSync2(dirname2(path), { recursive: true });
-  writeFileSync2(path, `${JSON.stringify(value, null, 2)}
+function seedClaudeState({
+  home,
+  claudeVersion = installedClaudeVersion()
+}) {
+  const path = join8(home, ".claude.json");
+  const state = seededClaudeState({ existing: readJson(path), claudeVersion });
+  writeFileSync7(`${path}.tmp`, `${JSON.stringify(state, null, 2)}
 `);
-}
-function skipInsignificant(text, from) {
-  let index = from;
-  while (index < text.length) {
-    if (/\s/.test(text[index] ?? "")) {
-      index++;
-    } else if (text.startsWith("//", index)) {
-      while (index < text.length && text[index] !== `
-`)
-        index++;
-    } else if (text.startsWith("/*", index)) {
-      const end = text.indexOf("*/", index + 2);
-      index = end === -1 ? text.length : end + 2;
-    } else {
-      return index;
-    }
-  }
-  return index;
-}
-function stripJsonc(text) {
-  let output = "";
-  let index = 0;
-  while (index < text.length) {
-    const char = text[index];
-    if (char === '"') {
-      const start = index;
-      index++;
-      while (index < text.length && text[index] !== '"') {
-        index += text[index] === "\\" ? 2 : 1;
-      }
-      index++;
-      output += text.slice(start, index);
-      continue;
-    }
-    const significant = skipInsignificant(text, index);
-    if (significant > index) {
-      output += " ";
-      index = significant;
-      continue;
-    }
-    const trailingComma = char === "," && /[}\]]/.test(text[skipInsignificant(text, index + 1)] ?? "");
-    if (!trailingComma)
-      output += char;
-    index++;
-  }
-  return output;
-}
-function parseJsonc(text) {
-  const parsed = JSON.parse(stripJsonc(text));
-  if (!isObject(parsed))
-    throw new Error("expected a JSON object");
-  return parsed;
+  renameSync6(`${path}.tmp`, path);
 }
 
+// src/client-configs.ts
+import {
+  chmodSync as chmodSync4,
+  cpSync,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync8,
+  mkdtempSync as mkdtempSync2,
+  readFileSync as readFileSync9,
+  rmSync as rmSync6,
+  writeFileSync as writeFileSync8
+} from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname5, join as join9 } from "node:path";
+
 // src/maesttro-endpoint.ts
 var DEFAULT_MAESTTRO_URL = "http://100.64.0.2";
 var ORCHESTRATOR_MODEL = "maesttro";
@@ -758,11 +2148,11 @@ function readHostFile({
   parse,
   warn
 }) {
-  const path = join2(home, file);
-  if (!existsSync(path))
+  const path = join9(home, file);
+  if (!existsSync2(path))
     return {};
   try {
-    return parse(readFileSync3(path, "utf8"));
+    return parse(readFileSync9(path, "utf8"));
   } catch {
     warn(`maesttro: ignoring your ~/${file}, it doesn't parse`);
     return {};
@@ -794,66 +2184,46 @@ function buildClientConfigs({
     removed: opencode.removed.map((path) => `opencode ${path}`)
   };
 }
-function writeClientConfigDir(files, parent = tmpdir()) {
-  const root = mkdtempSync(join2(parent, "maesttro-clients-"));
-  chmodSync2(root, 448);
-  const dir = join2(root, "home");
+function writeClientConfigDir(files, parent = tmpdir2()) {
+  const root = mkdtempSync2(join9(parent, "maesttro-clients-"));
+  chmodSync4(root, 448);
+  const dir = join9(root, "home");
   for (const [file, content] of Object.entries(files)) {
-    const path = join2(dir, file);
-    mkdirSync3(dirname3(path), { recursive: true, mode: 493 });
-    writeFileSync3(path, content);
-    chmodSync2(path, 420);
+    const path = join9(dir, file);
+    mkdirSync8(dirname5(path), { recursive: true, mode: 493 });
+    writeFileSync8(path, content);
+    chmodSync4(path, 420);
   }
-  chmodSync2(dir, 493);
-  return { dir, remove: () => rmSync2(root, { recursive: true, force: true }) };
+  chmodSync4(dir, 493);
+  return { dir, remove: () => rmSync6(root, { recursive: true, force: true }) };
 }
 function installClientConfigs({
   home,
   source = CONTAINER_CLIENT_CONFIGS
 }) {
-  if (!existsSync(source))
+  if (!existsSync2(source))
     return false;
-  const merged = MERGED_INTO_HOME.map((file) => join2(source, file));
+  const merged = MERGED_INTO_HOME.map((file) => join9(source, file));
   cpSync(source, home, {
     recursive: true,
     force: true,
     filter: (path) => !merged.includes(path)
   });
   for (const file of MERGED_INTO_HOME) {
-    const staged = join2(source, file);
-    if (!existsSync(staged))
+    const staged = join9(source, file);
+    if (!existsSync2(staged))
       continue;
-    const target = join2(home, file);
+    const target = join9(home, file);
     writeJson(target, mergeJson(readJson(target), readJson(staged)));
   }
   return true;
 }
 function injectOpencodeTuiState({ home }) {
-  const path = join2(home, OPENCODE_TUI_STATE);
+  const path = join9(home, OPENCODE_TUI_STATE);
   writeJson(path, mergeJson(readJson(path), CURATED_OPENCODE_TUI_STATE));
   return path;
 }
 
-// src/clients.ts
-var CLIENTS = {
-  claude: {
-    label: "Claude Code",
-    npmPackage: "@anthropic-ai/claude-code",
-    binary: "claude",
-    configDir: "/home/agent/.claude"
-  },
-  opencode: {
-    label: "opencode",
-    npmPackage: "opencode-ai",
-    binary: "opencode",
-    configDir: "/home/agent/.config/opencode"
-  }
-};
-var DEFAULT_CLIENT = "opencode";
-function isClientKey(value) {
-  return Object.hasOwn(CLIENTS, value);
-}
-
 // src/host-instructions.ts
 var HOST_STAGING_DIR = "/opt/maesttro-host";
 var STAGED_DIRECTORIES = [
@@ -867,14 +2237,6 @@ var INSTRUCTION_FILES = [
 ];
 var STAGED_PATHS = [...INSTRUCTION_FILES, ...STAGED_DIRECTORIES];
 
-// src/paths.ts
-import { dirname as dirname4, join as join3, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-var PACKAGE_ROOT = resolve(dirname4(fileURLToPath(import.meta.url)), "..");
-var DOCKERFILE_DIR = join3(PACKAGE_ROOT, "docker");
-var IMAGE = "maesttro-runner:latest";
-var VOLUME = process.env.MAESTTRO_VOLUME?.trim() || "maesttro-home";
-
 // src/runner-context.ts
 function githubMode(value) {
   return value === "on" || value === "strict" ? value : "off";
@@ -927,7 +2289,7 @@ function runnerInstructions(context) {
     "",
     "- Preinstalled: Node 24 (npm, pnpm, yarn), TypeScript (`tsc`), Bun, Python 3.14 and uv (`uv venv`, `uv pip`, `uv tool`; plain `pip` and `python -m venv` work too), the .NET 10 SDK, a C/C++ build toolchain, and common CLI tools (jq, ripgrep, fd, unzip, zip, sqlite3).",
     "- You can install more yourself without root: `npm i -g`, `bun add -g`, `pip install`, `uv tool install`, `uv python install`, `dotnet tool install -g`. They work as usual and are on `PATH` right away.",
-    "- Installs last only until this container exits; install again when a new session needs them. Don't install into your home directory to make them stick.",
+    "- Installs last only until this container exits; install again when a new session needs them. Your home directory belongs to this session: it survives `maesttro resume` but no other session sees it.",
     "- System packages are unavailable: there is no root, `sudo` or `apt`. If a task needs one, tell the user which package and why.",
     "",
     "## Pushing",
@@ -954,24 +2316,24 @@ function withoutComments(value) {
 }
 function applyProviderConfigs({
   home,
-  configsDir = join4(DOCKERFILE_DIR, "configs")
+  configsDir = join10(DOCKERFILE_DIR, "configs")
 }) {
   const written = [];
   for (const [key, client] of Object.entries(CLIENTS)) {
-    const source = join4(configsDir, key);
-    if (!existsSync2(source))
+    const source = join10(configsDir, key);
+    if (!existsSync3(source))
       continue;
-    const targetDir = join4(home, client.configDir.replace(/^\/home\/agent\/?/, ""));
-    for (const name of readdirSync(source)) {
+    const targetDir = join10(home, client.configDir.replace(/^\/home\/agent\/?/, ""));
+    for (const name of readdirSync3(source)) {
       if (!name.endsWith(".json"))
         continue;
-      const curated = withoutComments(readJson(join4(source, name)));
+      const curated = withoutComments(readJson(join10(source, name)));
       if (Object.keys(curated).length === 0)
         continue;
-      const target = join4(targetDir, name);
-      mkdirSync4(targetDir, { recursive: true });
+      const target = join10(targetDir, name);
+      mkdirSync9(targetDir, { recursive: true });
       const merged = mergeJson(readJson(target), curated);
-      writeFileSync4(target, `${JSON.stringify(merged, null, 2)}
+      writeFileSync9(target, `${JSON.stringify(merged, null, 2)}
 `);
       written.push(target);
     }
@@ -984,27 +2346,27 @@ function stageHostInstructions({
   context
 }) {
   for (const directory of STAGED_DIRECTORIES) {
-    const source = join4(staging, directory);
-    if (!existsSync2(source))
+    const source = join10(staging, directory);
+    if (!existsSync3(source))
       continue;
     try {
-      cpSync2(source, join4(home, directory), { recursive: true, force: true });
+      cpSync2(source, join10(home, directory), { recursive: true, force: true });
     } catch {}
   }
   const instructions = runnerInstructions(context);
   for (const file of INSTRUCTION_FILES) {
-    const source = join4(staging, file);
-    const hostCopy = existsSync2(source) ? readFileSync4(source, "utf8") : "";
-    const target = join4(home, file);
-    mkdirSync4(dirname5(target), { recursive: true });
-    writeFileSync4(target, hostCopy ? `${hostCopy.trimEnd()}
+    const source = join10(staging, file);
+    const hostCopy = existsSync3(source) ? readFileSync10(source, "utf8") : "";
+    const target = join10(home, file);
+    mkdirSync9(dirname6(target), { recursive: true });
+    writeFileSync9(target, hostCopy ? `${hostCopy.trimEnd()}
 
 ${instructions}` : instructions);
   }
 }
 function configure({
   home = homedir2(),
-  inRunner = existsSync2(RUNNER_MARKER),
+  inRunner = existsSync3(RUNNER_MARKER),
   env = process.env,
   staging = HOST_STAGING_DIR,
   clientConfigs
@@ -1013,6 +2375,7 @@ function configure({
   if (!inRunner)
     return;
   installClientConfigs({ home, source: clientConfigs });
+  seedClaudeState({ home });
   injectOpencodeTuiState({ home });
   stageHostInstructions({
     home,
@@ -1095,52 +2458,6 @@ async function revokeSessionToken(token, fetchImpl = fetch, apiUrl = githubApiUr
   } catch {}
 }
 
-// src/host-identity.ts
-function hostIdentityEnv() {
-  if (typeof process.getuid !== "function" || typeof process.getgid !== "function") {
-    return {};
-  }
-  return {
-    MAESTTRO_HOST_UID: String(process.getuid()),
-    MAESTTRO_HOST_GID: String(process.getgid())
-  };
-}
-function hostIdentityFlags() {
-  return Object.entries(hostIdentityEnv()).map(([name, value]) => `-e ${name}=${value}`).join(" ");
-}
-
-// src/legacy-token.ts
-import { execSync } from "node:child_process";
-var LEGACY_HOSTS = "~/.config/gh/hosts.yml";
-var PURGE_LEGACY_TOKEN = [
-  `if [ -e ${LEGACY_HOSTS} ]; then rm -f ${LEGACY_HOSTS}; echo FOUND; fi`,
-  "git config --global --remove-section credential.https://github.com 2>/dev/null || true",
-  "git config --global --remove-section credential.https://gist.github.com 2>/dev/null || true"
-].join("; ");
-var DETECT_LEGACY_TOKEN = `if [ -e ${LEGACY_HOSTS} ]; then echo FOUND; else echo CLEAN; fi`;
-function inVolume(command) {
-  return execSync(`docker run --rm ${hostIdentityFlags()} -v ${VOLUME}:/home/agent ${IMAGE} "${command}"`).toString();
-}
-function purgeLegacyToken() {
-  return inVolume(PURGE_LEGACY_TOKEN).includes("FOUND");
-}
-function hasLegacyToken() {
-  return inVolume(DETECT_LEGACY_TOKEN).includes("FOUND");
-}
-var REVOKE_NOTICE = "Removed a long-lived GitHub token that an older maesttro stored in the runner volume. Revoke it on GitHub too: https://github.com/settings/tokens?type=beta";
-function purgeLegacyTokenOnce({
-  config,
-  saveConfig,
-  purge = purgeLegacyToken,
-  announce
-}) {
-  if (config.legacyTokenPurged)
-    return;
-  if (purge())
-    announce(REVOKE_NOTICE);
-  saveConfig({ ...config, legacyTokenPurged: true });
-}
-
 // src/network-probe.ts
 import { connect } from "node:net";
 async function reachable(host, port, {
@@ -1166,8 +2483,8 @@ async function reachable(host, port, {
 }
 
 // src/repo.ts
-import { appendFileSync, mkdirSync as mkdirSync5, realpathSync } from "node:fs";
-import { join as join5 } from "node:path";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync10, realpathSync } from "node:fs";
+import { join as join11 } from "node:path";
 var MINIMUM_GIT = [2, 48];
 var WORKTREES_DIR = ".worktrees";
 
@@ -1210,7 +2527,7 @@ function repoRoot(run, cwd) {
     "--git-common-dir"
   ]).out;
   const root = realpathSync(top.out);
-  if (realpathSync(commonDir) !== join5(root, ".git")) {
+  if (realpathSync(commonDir) !== join11(root, ".git")) {
     throw new LaunchError("This is a git worktree. Run maesttro from the main checkout; each session gets its own isolated clone.");
   }
   if (realpathSync(cwd) !== root) {
@@ -1236,57 +2553,144 @@ function defaultBranch(run, root) {
   }
   throw new LaunchError("Can't find the default branch of origin. Run `git remote set-head origin --auto`.");
 }
-function ensureWorktreesDir(run, root) {
-  mkdirSync5(join5(root, WORKTREES_DIR), { recursive: true });
-  if (git(run, root, ["check-ignore", "-q", `${WORKTREES_DIR}/`]).ok)
+function ensureWorktreesDir(run, root) {
+  mkdirSync10(join11(root, WORKTREES_DIR), { recursive: true });
+  if (git(run, root, ["check-ignore", "-q", `${WORKTREES_DIR}/`]).ok)
+    return;
+  const info = join11(root, ".git", "info");
+  mkdirSync10(info, { recursive: true });
+  appendFileSync2(join11(info, "exclude"), `
+${WORKTREES_DIR}/
+`);
+}
+function snapshotRefs(run, root) {
+  const listed = git(run, root, [
+    "for-each-ref",
+    "--format=%(refname) %(objectname)",
+    "refs/heads",
+    "refs/tags"
+  ]);
+  const refs = {};
+  for (const line of listed.out.split(`
+`)) {
+    const [name, sha] = line.split(" ");
+    if (name && sha)
+      refs[name] = sha;
+  }
+  return refs;
+}
+function revision(run, root, rev) {
+  const parsed = git(run, root, [
+    "rev-parse",
+    "--verify",
+    "--quiet",
+    `${rev}^{commit}`
+  ]);
+  return parsed.ok ? parsed.out : undefined;
+}
+
+// src/volume-migration.ts
+import { execSync } from "node:child_process";
+var LEGACY_HOSTS = "~/.config/gh/hosts.yml";
+var PURGE_LEGACY_TOKEN = [
+  `if [ -e ${LEGACY_HOSTS} ]; then rm -f ${LEGACY_HOSTS}; echo FOUND; fi`,
+  "git config --global --remove-section credential.https://github.com 2>/dev/null || true",
+  "git config --global --remove-section credential.https://gist.github.com 2>/dev/null || true"
+].join("; ");
+var REVOKE_NOTICE = "Removed a long-lived GitHub token that an older maesttro stored in the runner volume. Revoke it on GitHub too: https://github.com/settings/tokens?type=beta";
+var OLD_SESSIONS_RUNNING = `Old sessions still use ${LEGACY_VOLUME}; will move the Claude login once they exit.`;
+function dockerExec(command) {
+  try {
+    return execSync(command, { stdio: ["ignore", "pipe", "pipe"] }).toString();
+  } catch (error) {
+    const stderr = error?.stderr;
+    throw new Error(stderr ? stderr.toString().trim() : error.message);
+  }
+}
+function legacyVolumeExists({
+  exec = dockerExec
+} = {}) {
+  try {
+    exec(`docker volume inspect ${LEGACY_VOLUME}`);
+    return true;
+  } catch (error) {
+    if (error instanceof Error && /no such volume/i.test(error.message)) {
+      return false;
+    }
+    throw error;
+  }
+}
+function dockerVolume({
+  exec = dockerExec
+} = {}) {
+  const inVolume = (command) => exec(`docker run --rm ${hostIdentityFlags()} -v ${LEGACY_VOLUME}:/home/agent ${IMAGE} "${command}"`);
+  return {
+    exists: () => legacyVolumeExists({ exec }),
+    inUse: () => exec(`docker ps -q --filter volume=${LEGACY_VOLUME}`).trim().length > 0,
+    readClaudeCredentials: () => {
+      const output = inVolume("cat ~/.claude/.credentials.json 2>/dev/null || echo null");
+      try {
+        return JSON.parse(output);
+      } catch {
+        return;
+      }
+    },
+    purgeGitHubToken: () => inVolume(PURGE_LEGACY_TOKEN).includes("FOUND")
+  };
+}
+function migrateFromVolumeOnce({
+  config,
+  saveConfig,
+  store,
+  volume = dockerVolume(),
+  announce
+}) {
+  if (config.volumeMigrated)
+    return;
+  try {
+    if (volume.exists()) {
+      if (!config.legacyTokenPurged && volume.purgeGitHubToken()) {
+        announce(REVOKE_NOTICE);
+      }
+      if (volume.inUse()) {
+        announce(OLD_SESSIONS_RUNNING);
+        saveConfig({ ...config, legacyTokenPurged: true });
+        return;
+      }
+      const credentials = volume.readClaudeCredentials();
+      if (!store.load() && isMasterLogin(credentials)) {
+        store.save(credentials);
+        announce(`Moved the runner's Claude login into ${store.kind}.`);
+      }
+      announce(`Sessions no longer use the shared ${LEGACY_VOLUME} volume. Remove it with \`docker volume rm ${LEGACY_VOLUME}\` once nothing runs.`);
+    }
+  } catch {
+    announce(`Couldn't check the legacy ${LEGACY_VOLUME} volume; will retry next launch.`);
     return;
-  const info = join5(root, ".git", "info");
-  mkdirSync5(info, { recursive: true });
-  appendFileSync(join5(info, "exclude"), `
-${WORKTREES_DIR}/
-`);
-}
-function snapshotRefs(run, root) {
-  const listed = git(run, root, [
-    "for-each-ref",
-    "--format=%(refname) %(objectname)",
-    "refs/heads",
-    "refs/tags"
-  ]);
-  const refs = {};
-  for (const line of listed.out.split(`
-`)) {
-    const [name, sha] = line.split(" ");
-    if (name && sha)
-      refs[name] = sha;
   }
-  return refs;
-}
-function revision(run, root, rev) {
-  const parsed = git(run, root, [
-    "rev-parse",
-    "--verify",
-    "--quiet",
-    `${rev}^{commit}`
-  ]);
-  return parsed.ok ? parsed.out : undefined;
+  saveConfig({ ...config, volumeMigrated: true });
 }
 
 // src/doctor.ts
-async function check(label, probe) {
+class DoctorWarning extends Error {
+}
+async function check(label, probe, print = console.log) {
   try {
     const detail = await probe();
-    console.log(`  [ok]   ${label}${detail ? ` — ${detail}` : ""}`);
+    print(`  [ok]   ${label}${detail ? ` — ${detail}` : ""}`);
     return true;
   } catch (error) {
+    if (error instanceof DoctorWarning) {
+      print(`  [warn] ${label} — ${error.message}`);
+      return true;
+    }
     const reason = error instanceof Error && error.message ? error.message : "";
-    console.log(`  [fail] ${label}${reason ? ` — ${reason}` : ""}`);
+    print(`  [fail] ${label}${reason ? ` — ${reason}` : ""}`);
     return false;
   }
 }
-function inRunner(command, { withVolume = true } = {}) {
-  const volume = withVolume ? `-v ${VOLUME}:/home/agent ` : "";
-  return execSync2(`docker run --rm ${hostIdentityFlags()} ${volume}${IMAGE} "${command}"`).toString();
+function inRunner(command) {
+  return execSync2(`docker run --rm ${hostIdentityFlags()} ${IMAGE} "${command}"`).toString();
 }
 async function doctor() {
   console.log(`== maesttro doctor ==
@@ -1310,19 +2714,6 @@ async function doctor() {
       "Runner image built",
       () => `built ${execSync2(`docker image inspect ${IMAGE} --format "{{.Created}}"`).toString().trim()}`
     ],
-    [
-      "Persistent volume exists",
-      () => {
-        execSync2(`docker volume inspect ${VOLUME}`, { stdio: "ignore" });
-      }
-    ],
-    [
-      "No long-lived GitHub token in the volume",
-      () => {
-        if (hasLegacyToken())
-          throw new Error("run `maesttro setup` to remove it");
-      }
-    ],
     [
       "Logged in to GitHub",
       async () => {
@@ -1333,13 +2724,36 @@ async function doctor() {
           interactive: false
         });
         if (!token)
-          throw new Error("run `maesttro login`");
+          throw new Error("run `maesttro login github`");
         const name = await githubLogin(token.access_token);
         if (!name)
-          throw new Error("token rejected, run `maesttro login`");
+          throw new Error("token rejected, run `maesttro login github`");
         return name;
       }
     ],
+    [
+      "Logged in to Claude",
+      () => {
+        const credentials = claudeStore().load();
+        if (!credentials)
+          throw new Error("run `maesttro login claude`");
+        if (claudeLoginState({ credentials, now: Date.now() }) === "expired") {
+          throw new ClaudeLoginExpired;
+        }
+        const warning = claudeLoginWarning({ credentials, now: Date.now() });
+        if (warning)
+          throw new DoctorWarning(warning);
+        return `access token until ${new Date(credentials.claudeAiOauth.expiresAt).toLocaleString()}`;
+      }
+    ],
+    [
+      "Old shared volume removed",
+      () => {
+        if (legacyVolumeExists()) {
+          throw new Error(`docker volume rm ${LEGACY_VOLUME}`);
+        }
+      }
+    ],
     [
       "Token broker reachable",
       async () => {
@@ -1371,7 +2785,7 @@ async function doctor() {
     ...Object.values(CLIENTS).map((client) => [
       `Client available: ${client.label}`,
       () => {
-        inRunner(`which ${client.binary}`, { withVolume: false });
+        inRunner(`which ${client.binary}`);
       }
     ])
   ];
@@ -1395,7 +2809,9 @@ Usage:
   maesttro <client>        Same, with a specific client — see \`maesttro list\`
   maesttro --strict [client]
                           Same, in strict mode: no GitHub token reaches the runner, so \`gh\` is off
-  maesttro resume <id>     Continue a kept session in its clone, in the mode it started with
+  maesttro resume [client] <id>
+                          Continue a kept session in its clone, in the mode it started with,
+                          with its last client unless one is given
                           (\`--strict\` or \`--no-strict\` after the id changes it)
   maesttro sessions        List this repo's sessions
   maesttro sessions remove <id>
@@ -1406,74 +2822,35 @@ Usage:
   maesttro push [branch] [--force]
                           Push a branch a session created, after showing what goes out
   maesttro list            Show available clients
-  maesttro setup           One-time: build image, create volume, log in to GitHub
-  maesttro login           Log in to GitHub (device flow) so sessions get repo access
-  maesttro logout          Remove the stored GitHub credentials
-  maesttro status          Show GitHub login status
+  maesttro setup           One-time: build image, move off the old shared volume, log in to GitHub and Claude
+  maesttro login [github|claude]
+                          Log in to GitHub (device flow) and/or Claude; without a target, does both
+  maesttro logout [github|claude]
+                          Remove the stored credentials; without a target, does both
+  maesttro status [github|claude]
+                          Show login status; without a target, does both
   maesttro configure       Apply maesttro's client configs (also runs inside the runner)
   maesttro update          Update the package and rebuild the runner image with refreshed client configs
-  maesttro doctor          Health check — Docker, image, volume, GitHub login, broker, isolation, clients
+  maesttro doctor          Health check — Docker, image, GitHub and Claude logins, old volume gone, broker, isolation, clients
   maesttro help            Show this message
 `;
 
 // src/launch.ts
-import { execSync as execSync3, spawn, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync4, rmSync as rmSync6 } from "node:fs";
-import { constants, homedir as homedir4 } from "node:os";
-import { join as join11 } from "node:path";
+import { execSync as execSync3, spawn as spawn2, spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync5, rmSync as rmSync9 } from "node:fs";
+import { constants as constants2, homedir as homedir3 } from "node:os";
+import { join as join15 } from "node:path";
 
 // src/backup.ts
 import { createHash } from "node:crypto";
-import { mkdirSync as mkdirSync7, readdirSync as readdirSync2, rmSync as rmSync3 } from "node:fs";
-import { basename, join as join7 } from "node:path";
-
-// src/maesttro-home.ts
-import {
-  appendFileSync as appendFileSync2,
-  mkdirSync as mkdirSync6,
-  readFileSync as readFileSync5,
-  renameSync as renameSync2,
-  writeFileSync as writeFileSync5
-} from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { join as join6 } from "node:path";
-function maesttroHome() {
-  return join6(homedir3(), ".config", "maesttro");
-}
-function configPath() {
-  return join6(maesttroHome(), "config.json");
-}
-function readMaesttroConfig() {
-  try {
-    return JSON.parse(readFileSync5(configPath(), "utf8"));
-  } catch {
-    return {};
-  }
-}
-function writeMaesttroConfig(config) {
-  mkdirSync6(maesttroHome(), { recursive: true, mode: 448 });
-  const temporary = `${configPath()}.tmp`;
-  writeFileSync5(temporary, `${JSON.stringify(config, null, 2)}
-`);
-  renameSync2(temporary, configPath());
-}
-function fileSessionLog(path = join6(maesttroHome(), "maesttro.log")) {
-  return (event, detail) => {
-    try {
-      mkdirSync6(maesttroHome(), { recursive: true, mode: 448 });
-      appendFileSync2(path, `${new Date().toISOString()} ${event}${detail ? ` ${detail}` : ""}
-`);
-    } catch {}
-  };
-}
-
-// src/backup.ts
+import { mkdirSync as mkdirSync11, readdirSync as readdirSync4, rmSync as rmSync7 } from "node:fs";
+import { basename, join as join12 } from "node:path";
 var BACKUPS_KEPT = 5;
 function shortHash(value) {
   return createHash("sha256").update(value).digest("hex").slice(0, 8);
 }
 function backupDir(repoRoot, home = maesttroHome()) {
-  return join7(home, "backups", `${basename(repoRoot)}-${shortHash(repoRoot)}`);
+  return join12(home, "backups", `${basename(repoRoot)}-${shortHash(repoRoot)}`);
 }
 function refsFingerprint(refs) {
   const sorted = Object.keys(refs).sort().map((ref) => `${ref} ${refs[ref]}`);
@@ -1491,119 +2868,41 @@ function backupRepo({
 }) {
   if (Object.keys(refs).length === 0)
     return;
-  mkdirSync7(dir, { recursive: true, mode: 448 });
+  mkdirSync11(dir, { recursive: true, mode: 448 });
   const fingerprint = refsFingerprint(refs);
-  const existing = readdirSync2(dir).filter((name) => name.endsWith(".bundle")).sort();
+  const existing = readdirSync4(dir).filter((name) => name.endsWith(".bundle")).sort();
   const latest = existing.at(-1);
   if (latest?.endsWith(`-${fingerprint}.bundle`)) {
-    return { path: join7(dir, latest), reused: true };
+    return { path: join12(dir, latest), reused: true };
   }
   const stamp = now.toISOString().replace(/[:.]/g, "-");
-  const path = join7(dir, `${stamp}-${sessionId}-${fingerprint}.bundle`);
+  const path = join12(dir, `${stamp}-${sessionId}-${fingerprint}.bundle`);
   if (!git(run, repoRoot, ["bundle", "create", "--quiet", path, "--all"]).ok) {
     return;
   }
   for (const stale of [...existing, basename(path)].sort().slice(0, -keep)) {
-    rmSync3(join7(dir, stale), { force: true });
+    rmSync7(join12(dir, stale), { force: true });
   }
   return { path, reused: false };
 }
 
-// src/refresher.ts
-var REFRESH_LEAD_MS = 10 * 60 * 1000;
-var WALL_CLOCK_TICK_MS = 60 * 1000;
-var FIRST_BACKOFF_MS = 5 * 1000;
-var MAX_BACKOFF_MS = 5 * 60 * 1000;
-var nodeTimers = {
-  setTimeout: (callback, ms) => setTimeout(callback, ms).unref(),
-  clearTimeout: (handle) => clearTimeout(handle),
-  setInterval: (callback, ms) => setInterval(callback, ms).unref(),
-  clearInterval: (handle) => clearInterval(handle)
-};
-function startRefresher({
-  initial,
-  refresh,
-  onRefreshed,
-  onFailed,
-  now = Date.now,
-  timers = nodeTimers
-}) {
-  let current = initial;
-  let nextAttemptAt = 0;
-  let backoffMs = FIRST_BACKOFF_MS;
-  let inFlight;
-  let stopped = false;
-  let pending;
-  function refreshDueAt(token) {
-    const expiresAt = Date.parse(token.expires_at);
-    const halfRemaining = (expiresAt - now()) / 2;
-    return expiresAt - Math.min(REFRESH_LEAD_MS, Math.max(halfRemaining, 0));
-  }
-  nextAttemptAt = refreshDueAt(initial);
-  function scheduleAt(at) {
-    timers.clearTimeout(pending);
-    pending = timers.setTimeout(check, Math.max(at - now(), 0));
-  }
-  async function attempt() {
-    try {
-      const token = await refresh();
-      if (stopped)
-        return;
-      current = token;
-      backoffMs = FIRST_BACKOFF_MS;
-      nextAttemptAt = refreshDueAt(token);
-      onRefreshed(token);
-    } catch (error) {
-      if (stopped)
-        return;
-      nextAttemptAt = now() + backoffMs;
-      onFailed(error, backoffMs);
-      backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
-    }
-    scheduleAt(nextAttemptAt);
-  }
-  function check() {
-    if (stopped)
-      return Promise.resolve();
-    if (inFlight)
-      return inFlight;
-    if (now() < nextAttemptAt)
-      return Promise.resolve();
-    inFlight = attempt().finally(() => {
-      inFlight = undefined;
-    });
-    return inFlight;
-  }
-  const tick = timers.setInterval(check, WALL_CLOCK_TICK_MS);
-  scheduleAt(nextAttemptAt);
-  return {
-    current: () => current,
-    check,
-    stop: () => {
-      stopped = true;
-      timers.clearTimeout(pending);
-      timers.clearInterval(tick);
-    }
-  };
-}
-
 // src/session-dir.ts
 import {
-  chmodSync as chmodSync3,
-  mkdirSync as mkdirSync8,
-  mkdtempSync as mkdtempSync2,
-  renameSync as renameSync3,
-  rmSync as rmSync4,
-  writeFileSync as writeFileSync6
+  chmodSync as chmodSync5,
+  mkdirSync as mkdirSync12,
+  mkdtempSync as mkdtempSync3,
+  renameSync as renameSync7,
+  rmSync as rmSync8,
+  writeFileSync as writeFileSync10
 } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import { join as join8 } from "node:path";
+import { tmpdir as tmpdir3 } from "node:os";
+import { join as join13 } from "node:path";
 var CONTAINER_GH_CONFIG_DIR = "/home/agent/.config/gh-maesttro";
 function writeAtomically(path, content) {
   const temporary = `${path}.tmp`;
-  writeFileSync6(temporary, content, { mode: 420 });
-  chmodSync3(temporary, 420);
-  renameSync3(temporary, path);
+  writeFileSync10(temporary, content, { mode: 420 });
+  chmodSync5(temporary, 420);
+  renameSync7(temporary, path);
 }
 function hostsYaml(token, user) {
   return [
@@ -1615,20 +2914,20 @@ function hostsYaml(token, user) {
   ].join(`
 `);
 }
-function createSessionDir(parent = tmpdir2()) {
-  const root = mkdtempSync2(join8(parent, "maesttro-"));
-  chmodSync3(root, 448);
-  const ghDir = join8(root, "gh");
-  mkdirSync8(ghDir);
-  chmodSync3(ghDir, 493);
-  writeAtomically(join8(ghDir, "config.yml"), `version: "1"
+function createSessionDir(parent = tmpdir3()) {
+  const root = mkdtempSync3(join13(parent, "maesttro-"));
+  chmodSync5(root, 448);
+  const ghDir = join13(root, "gh");
+  mkdirSync12(ghDir);
+  chmodSync5(ghDir, 493);
+  writeAtomically(join13(ghDir, "config.yml"), `version: "1"
 `);
   return {
     ghDir,
-    writeToken: (token, user) => writeAtomically(join8(ghDir, "hosts.yml"), hostsYaml(token, user)),
-    writeStatus: (status) => writeAtomically(join8(ghDir, "status"), `${status}
+    writeToken: (token, user) => writeAtomically(join13(ghDir, "hosts.yml"), hostsYaml(token, user)),
+    writeStatus: (status) => writeAtomically(join13(ghDir, "status"), `${status}
 `),
-    remove: () => rmSync4(root, { recursive: true, force: true })
+    remove: () => rmSync8(root, { recursive: true, force: true })
   };
 }
 
@@ -1646,7 +2945,7 @@ function refusalNotice(code, repo) {
       return `${UNAVAILABLE}: your GitHub account cannot see ${repo} — ${WITHOUT}`;
     case "user_token_invalid":
     case "not_logged_in":
-      return `${UNAVAILABLE}: GitHub login expired, run \`maesttro login\` — ${WITHOUT}`;
+      return `${UNAVAILABLE}: GitHub login expired, run \`maesttro login github\` — ${WITHOUT}`;
     default:
       return `${UNAVAILABLE} (${code}) — ${WITHOUT}`;
   }
@@ -1733,6 +3032,7 @@ async function openGitHubSession({
   log("session.token_minted", `${repo} expires ${initial.expires_at}`);
   const refresher = startRefresher({
     initial,
+    expiresAtOf: (token) => Date.parse(token.expires_at),
     refresh: () => mint({ interactive: false }),
     onRefreshed: (token) => {
       publish(token);
@@ -1779,14 +3079,14 @@ function ask(question) {
 // src/session-clone.ts
 import {
   copyFileSync,
-  existsSync as existsSync3,
-  lstatSync,
-  mkdirSync as mkdirSync9,
-  readdirSync as readdirSync3,
-  readFileSync as readFileSync6,
-  writeFileSync as writeFileSync7
+  existsSync as existsSync4,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync13,
+  readdirSync as readdirSync5,
+  readFileSync as readFileSync11,
+  writeFileSync as writeFileSync11
 } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join14 } from "node:path";
 
 // src/sanitize.ts
 function stripControl(text) {
@@ -1873,27 +3173,27 @@ function createSessionClone(run, root, clonePath, baseSha) {
 }
 function realDir(path) {
   try {
-    return lstatSync(path).isDirectory();
+    return lstatSync4(path).isDirectory();
   } catch {
     return false;
   }
 }
 function dirents(dir) {
   try {
-    return readdirSync3(dir, { withFileTypes: true });
+    return readdirSync5(dir, { withFileTypes: true });
   } catch {
     return [];
   }
 }
 function cloneGitDir(clonePath) {
-  const gitDir = join9(clonePath, ".git");
+  const gitDir = join14(clonePath, ".git");
   return realDir(gitDir) ? gitDir : undefined;
 }
 function readSha(path) {
   try {
-    if (!lstatSync(path).isFile())
+    if (!lstatSync4(path).isFile())
       return;
-    const text = readFileSync6(path, "utf8").trim();
+    const text = readFileSync11(path, "utf8").trim();
     return SHA.test(text) ? text : undefined;
   } catch {
     return;
@@ -1903,7 +3203,7 @@ function packedRefs(gitDir) {
   const refs = new Map;
   let text;
   try {
-    text = readFileSync6(join9(gitDir, "packed-refs"), "utf8");
+    text = readFileSync11(join14(gitDir, "packed-refs"), "utf8");
   } catch {
     return refs;
   }
@@ -1928,12 +3228,12 @@ function cloneBranches(clonePath) {
         continue;
       const name = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory())
-        walk(join9(dir, entry.name), name);
+        walk(join14(dir, entry.name), name);
       else if (entry.isFile())
         names.add(name);
     }
   };
-  walk(join9(gitDir, "refs", "heads"), "");
+  walk(join14(gitDir, "refs", "heads"), "");
   for (const ref of packedRefs(gitDir).keys()) {
     if (ref.startsWith(HEADS_PREFIX))
       names.add(ref.slice(HEADS_PREFIX.length));
@@ -1946,7 +3246,7 @@ function branchTip(clonePath, branch) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
     return;
-  return readSha(join9(gitDir, "refs", "heads", branch)) ?? packedRefs(gitDir).get(`${HEADS_PREFIX}${branch}`);
+  return readSha(join14(gitDir, "refs", "heads", branch)) ?? packedRefs(gitDir).get(`${HEADS_PREFIX}${branch}`);
 }
 function cloneHead(clonePath) {
   const gitDir = cloneGitDir(clonePath);
@@ -1954,9 +3254,9 @@ function cloneHead(clonePath) {
     return;
   let text;
   try {
-    if (!lstatSync(join9(gitDir, "HEAD")).isFile())
+    if (!lstatSync4(join14(gitDir, "HEAD")).isFile())
       return;
-    text = readFileSync6(join9(gitDir, "HEAD"), "utf8").trim();
+    text = readFileSync11(join14(gitDir, "HEAD"), "utf8").trim();
   } catch {
     return;
   }
@@ -1977,29 +3277,29 @@ function copyObjectFiles(fromDir, intoDir) {
   for (const entry of dirents(fromDir)) {
     if (!entry.isFile())
       continue;
-    const dest = join9(intoDir, entry.name);
-    if (existsSync3(dest))
+    const dest = join14(intoDir, entry.name);
+    if (existsSync4(dest))
       continue;
     if (!created) {
-      mkdirSync9(intoDir, { recursive: true });
+      mkdirSync13(intoDir, { recursive: true });
       created = true;
     }
-    copyFileSync(join9(fromDir, entry.name), dest);
+    copyFileSync(join14(fromDir, entry.name), dest);
   }
 }
 function pinAlternates(clonePath, containerObjects) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
     return;
-  const objects = join9(gitDir, "objects");
-  const info = join9(objects, "info");
+  const objects = join14(gitDir, "objects");
+  const info = join14(objects, "info");
   if (!realDir(objects) || !realDir(info)) {
     throw new LaunchError(`Unsafe objects tree in the session clone: ${clonePath}`);
   }
-  const alternates = join9(info, "alternates");
+  const alternates = join14(info, "alternates");
   let stat;
   try {
-    stat = lstatSync(alternates);
+    stat = lstatSync4(alternates);
   } catch {
     return;
   }
@@ -2008,73 +3308,29 @@ function pinAlternates(clonePath, containerObjects) {
   }
   const desired = `${containerObjects}
 `;
-  if (readFileSync6(alternates, "utf8") !== desired) {
-    writeFileSync7(alternates, desired);
+  if (readFileSync11(alternates, "utf8") !== desired) {
+    writeFileSync11(alternates, desired);
   }
 }
 function importObjects(run, root, clonePath, tip) {
   const gitDir = cloneGitDir(clonePath);
   if (!gitDir)
     return false;
-  const objects = join9(gitDir, "objects");
+  const objects = join14(gitDir, "objects");
   if (!realDir(objects))
     return false;
-  const into = join9(root, ".git", "objects");
+  const into = join14(root, ".git", "objects");
   for (const entry of dirents(objects)) {
     if (entry.name === "info" || entry.isSymbolicLink() || !entry.isDirectory()) {
       continue;
     }
     if (!OBJECT_SUBDIR.test(entry.name) && entry.name !== "pack")
       continue;
-    copyObjectFiles(join9(objects, entry.name), join9(into, entry.name));
+    copyObjectFiles(join14(objects, entry.name), join14(into, entry.name));
   }
   return git(run, root, ["cat-file", "-e", `${tip}^{commit}`]).ok;
 }
 
-// src/sessions.ts
-import { randomBytes } from "node:crypto";
-import {
-  mkdirSync as mkdirSync10,
-  readdirSync as readdirSync4,
-  readFileSync as readFileSync7,
-  renameSync as renameSync4,
-  rmSync as rmSync5,
-  writeFileSync as writeFileSync8
-} from "node:fs";
-import { join as join10 } from "node:path";
-function newSessionId() {
-  return `maesttro-${randomBytes(4).toString("hex")}`;
-}
-function sessionsDir(home = maesttroHome()) {
-  return join10(home, "sessions");
-}
-function saveSession(record, dir = sessionsDir()) {
-  mkdirSync10(dir, { recursive: true, mode: 448 });
-  const path = join10(dir, `${record.id}.json`);
-  writeFileSync8(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
-`);
-  renameSync4(`${path}.tmp`, path);
-}
-function readSession(id, dir = sessionsDir()) {
-  try {
-    return JSON.parse(readFileSync7(join10(dir, `${id}.json`), "utf8"));
-  } catch {
-    return;
-  }
-}
-function deleteSession(id, dir = sessionsDir()) {
-  rmSync5(join10(dir, `${id}.json`), { force: true });
-}
-function sessionsForRepo(repoRoot, dir = sessionsDir()) {
-  let names;
-  try {
-    names = readdirSync4(dir).filter((name) => name.endsWith(".json"));
-  } catch {
-    return [];
-  }
-  return names.map((name) => readSession(name.slice(0, -".json".length), dir)).filter((record) => record?.repoRoot === repoRoot).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
-}
-
 // src/workspace-git.ts
 var GITHUB_REMOTE = /^(?:https:\/\/(?:[^@/]+@)?github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+?)(?:\.git)?\/?$/;
 function githubRepoFromRemote(remote) {
@@ -2102,9 +3358,18 @@ function workspaceAuthor(run, workspace) {
 }
 
 // src/launch.ts
-var CONTAINER_REPO = "/workspace";
+var CONTAINER_REPO = CONTAINER_REPO_PATH;
 var CONTAINER_PACKAGE = "/opt/maesttro";
 var CONTAINER_GIT_OBJECTS = "/opt/maesttro-objects";
+function sessionClientArgs({
+  args,
+  session
+}) {
+  const chosen = args.length > 0 ? args : session.client ? [session.client] : [];
+  const [first] = chosen;
+  const client = first === undefined ? DEFAULT_CLIENT : isClientKey(first) ? first : undefined;
+  return { args: chosen, client };
+}
 function resolveCommand(args) {
   const [first, ...rest] = args;
   if (first === undefined)
@@ -2123,16 +3388,19 @@ function sessionMounts({
   hostHome,
   stagedPaths,
   clientConfigs,
-  sharedSkills
+  sharedSkills,
+  home,
+  claudeDir
 }) {
-  const objects = join11(repoRoot, ".git", "objects");
+  const objects = join15(repoRoot, ".git", "objects");
   const mounts = [
-    { host: VOLUME, container: "/home/agent", type: "volume" },
+    { host: home, container: "/home/agent" },
+    { host: claudeDir, container: "/home/agent/.claude" },
     { host: objects, container: CONTAINER_GIT_OBJECTS, readOnly: true },
     { host: sessionDir, container: CONTAINER_REPO },
     { host: packageRoot, container: CONTAINER_PACKAGE, readOnly: true },
     ...stagedPaths.map((path) => ({
-      host: join11(hostHome, path),
+      host: join15(hostHome, path),
       container: `${HOST_STAGING_DIR}/${path}`,
       readOnly: true
     })),
@@ -2158,9 +3426,9 @@ function dockerRunArgs({
   extra = [],
   name
 }) {
-  const volumes = mounts.flatMap(({ host, container, readOnly, type = "bind" }) => [
+  const volumes = mounts.flatMap(({ host, container, readOnly }) => [
     "--mount",
-    `type=${type},source=${host},target=${container}${readOnly ? ",readonly" : ""}`
+    `type=bind,source=${host},target=${container}${readOnly ? ",readonly" : ""}`
   ]);
   return [
     "run",
@@ -2189,17 +3457,54 @@ Default: ${DEFAULT_CLIENT}. Run \`maesttro <client>\` to pick one, or \`maesttro
 function ensureReady() {
   try {
     execSync3(`docker image inspect ${IMAGE}`, { stdio: "ignore" });
-    execSync3(`docker volume inspect ${VOLUME}`, { stdio: "ignore" });
   } catch {
     throw new LaunchError("Runner isn't set up yet. Run `maesttro setup` first.");
   }
 }
 function clearStaleContainer(id) {
-  spawnSync2("docker", ["rm", "-f", id], { stdio: "ignore" });
+  spawnSync3("docker", ["rm", "-f", id], { stdio: "ignore" });
+}
+async function establishClaudeCredentials({
+  claudeDir,
+  store,
+  refresh = refreshMaster,
+  onRotated = (credentials) => pushToRunningSessions({ credentials, claudeDir, announce }),
+  signals = processSignals,
+  announce,
+  now = Date.now
+}) {
+  const credentials = store.load();
+  if (credentials && claudeLoginState({ credentials, now: now() }) === "active" && isDue({ credentials, now: now() })) {
+    announce("Refreshing Claude login…");
+  }
+  try {
+    writeSessionCredentials({
+      claudeDir,
+      credentials: await refresh({ store, announce, onRotated, signals })
+    });
+    return {};
+  } catch (error) {
+    if (error instanceof ClaudeLoggedOut) {
+      announce(error.message);
+      removeHostWrittenCredentials({ claudeDir });
+      return { failure: error.message };
+    }
+    if (error instanceof ClaudeLoginExpired || error instanceof ClaudeRefreshFailed) {
+      announce(error.message);
+      const master = store.load();
+      if (master && master.claudeAiOauth.expiresAt > now()) {
+        writeSessionCredentials({ claudeDir, credentials: master });
+      } else if (error instanceof ClaudeLoginExpired) {
+        removeHostWrittenCredentials({ claudeDir });
+      }
+      return { failure: error.message };
+    }
+    throw error;
+  }
 }
 function sharedSkillsDir() {
-  const dir = process.env.AGENT_SHARED_SKILLS ?? join11(homedir4(), "agent-shared", "skills");
-  return existsSync4(dir) ? dir : undefined;
+  const dir = process.env.AGENT_SHARED_SKILLS ?? join15(homedir3(), "agent-shared", "skills");
+  return existsSync5(dir) ? dir : undefined;
 }
 async function resolveAuthor(workspace) {
   const fromRepo = workspaceAuthor(runCommand, workspace);
@@ -2228,7 +3533,7 @@ function startSession(run, root) {
   if (!baseSha)
     throw new LaunchError(`Can't resolve ${base}.`);
   const id = newSessionId();
-  const sessionDir = join11(root, WORKTREES_DIR, id);
+  const sessionDir = join15(root, WORKTREES_DIR, id);
   createSessionClone(run, root, sessionDir, baseSha);
   return {
     id,
@@ -2245,7 +3550,7 @@ function resumeSession(root, id) {
   if (!session || session.repoRoot !== root) {
     throw new LaunchError(`No session ${id} in this repo. See \`maesttro sessions\`.`);
   }
-  if (!existsSync4(session.worktree)) {
+  if (!existsSync5(session.worktree)) {
     throw new LaunchError(`The clone for ${id} is gone: ${session.worktree}`);
   }
   return session;
@@ -2268,13 +3573,13 @@ function preserveBranches(run, session) {
   return preserved;
 }
 function finishSession(run, session) {
-  if (!existsSync4(session.worktree)) {
+  if (!existsSync5(session.worktree)) {
     deleteSession(session.id);
     return;
   }
   const preserved = preserveBranches(run, session);
   if (!cloneHasWork(session.worktree, session.baseSha)) {
-    rmSync6(session.worktree, { recursive: true, force: true });
+    rmSync9(session.worktree, { recursive: true, force: true });
     deleteSession(session.id);
     return;
   }
@@ -2303,9 +3608,45 @@ function runnerGitHubMode({
 function exitCodeOf(code, signal) {
   if (code !== null)
     return code;
-  return signal ? 128 + (constants.signals[signal] ?? 0) : 1;
+  return signal ? 128 + (constants2.signals[signal] ?? 0) : 1;
 }
 var FORWARDED_SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+var ABANDON_GRACE_MS = 3000;
+function closeSession({
+  run,
+  session
+}) {
+  try {
+    finishSession(run, session);
+  } catch (error) {
+    console.log(`
+Couldn't clean up session ${session.id}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function claudeNoticeSink({
+  log,
+  print = (message) => console.log(message)
+}) {
+  let quiet = false;
+  let unseen;
+  return {
+    announce: (message) => {
+      if (!quiet)
+        return print(message);
+      log("claude.notice", message);
+      unseen = message;
+    },
+    quiet: () => {
+      quiet = true;
+    },
+    replay: () => {
+      if (unseen)
+        print(`
+${unseen}`);
+      unseen = undefined;
+    }
+  };
+}
 async function launch({
   args,
   resume,
@@ -2315,9 +3656,10 @@ async function launch({
   ensureReady();
   requireGit(run);
   const root = repoRoot(run, process.cwd());
-  purgeLegacyTokenOnce({
+  migrateFromVolumeOnce({
     config: readMaesttroConfig(),
     saveConfig: writeMaesttroConfig,
+    store: claudeStore(),
     announce: (message) => console.log(message)
   });
   const started = resume ? resumeSession(root, resume) : startSession(run, root);
@@ -2328,13 +3670,55 @@ async function launch({
     sessionId: started.id
   });
   const strict = isStrict(requestedStrict, started);
+  const client = sessionClientArgs({ args, session: started });
   const saved = {
     ...started,
     backup: started.backup ?? backup?.path,
-    strict
+    strict,
+    client: client.client ?? started.client
   };
   saveSession(saved);
+  let github;
+  let claudeRefresher;
+  let clientConfigDir;
+  let abandoning = false;
+  const interrupts = signalRouter({
+    onUnrouted: async (signal) => {
+      const code = exitCodeOf(null, signal);
+      if (abandoning)
+        process.exit(code);
+      abandoning = true;
+      console.log(`
+Interrupted; cleaning up session ${saved.id}…`);
+      claudeRefresher?.stop();
+      clientConfigDir?.remove();
+      if (github) {
+        await Promise.race([
+          github.close(),
+          new Promise((resolve) => setTimeout(resolve, ABANDON_GRACE_MS))
+        ]);
+      }
+      closeSession({ run, session: saved });
+      process.exit(code);
+    }
+  });
   console.log(`Session ${saved.id}${strict ? " (strict)" : ""}: clone .worktrees/${saved.id} at ${saved.base}${backup ? `, backup ${backup.reused ? "reused" : "written"}` : ""}.`);
+  const { home, claudeDir } = ensureSessionHome({ id: saved.id });
+  const claude = claudeStore();
+  const sessionLog = fileSessionLog();
+  const claudeNotices = claudeNoticeSink({ log: sessionLog });
+  const { failure } = await establishClaudeCredentials({
+    claudeDir,
+    store: claude,
+    announce: claudeNotices.announce,
+    signals: interrupts
+  });
+  claudeRefresher = startClaudeRefresher({
+    claudeDir,
+    store: claude,
+    announce: claudeNotices.announce,
+    launchFailure: failure
+  });
   const repo = workspaceRepo(run, root);
   if (repo && !resume) {
     git(run, saved.worktree, [
@@ -2344,7 +3728,7 @@ async function launch({
       `https://github.com/${repo}.git`
     ]);
   }
-  const github = await openGitHubSession({
+  github = await openGitHubSession({
     repo,
     author: await resolveAuthor(root),
     strict,
@@ -2354,11 +3738,11 @@ async function launch({
       store: selectCredentialStore(),
       announce: (message) => console.log(message)
     },
-    log: fileSessionLog()
+    log: sessionLog
   });
   if (github.notice)
     console.log(github.notice);
-  const hostHome = homedir4();
+  const hostHome = homedir3();
   const url = maesttroUrl();
   const orchestratorWindow = await fetchOrchestratorWindow({ url });
   if (orchestratorWindow === undefined) {
@@ -2372,15 +3756,17 @@ async function launch({
   if (clientConfigs.removed.length > 0) {
     console.log(`Kept out of the runner as secrets: ${clientConfigs.removed.join(", ")}`);
   }
-  const clientConfigDir = writeClientConfigDir(clientConfigs.files);
+  clientConfigDir = writeClientConfigDir(clientConfigs.files);
   const { mounts, workdir } = sessionMounts({
     repoRoot: root,
     sessionDir: saved.worktree,
     packageRoot: PACKAGE_ROOT,
     hostHome,
-    stagedPaths: STAGED_PATHS.filter((path) => existsSync4(join11(hostHome, path))),
+    stagedPaths: STAGED_PATHS.filter((path) => existsSync5(join15(hostHome, path))),
     clientConfigs: clientConfigDir.dir,
-    sharedSkills: sharedSkillsDir()
+    sharedSkills: sharedSkillsDir(),
+    home,
+    claudeDir
   });
   const sessionEnv = {
     ...github.env,
@@ -2399,13 +3785,15 @@ async function launch({
   ].concat(repo ? ["MAESTTRO_REPO"] : []).flatMap((name) => ["-e", name]);
   clearStaleContainer(saved.id);
   pinAlternates(saved.worktree, CONTAINER_GIT_OBJECTS);
-  const child = spawn("docker", dockerRunArgs({
-    command: containerCommand(resolveCommand(args)),
+  const child = spawn2("docker", dockerRunArgs({
+    command: containerCommand(resolveCommand(client.args)),
     mounts,
     workdir,
     name: saved.id,
     extra: [...github.dockerArgs, ...envFlags]
   }), { stdio: "inherit", env: { ...process.env, ...sessionEnv } });
+  interrupts.dispose();
+  claudeNotices.quiet();
   const forward = (signal) => child.kill(signal);
   for (const signal of FORWARDED_SIGNALS)
     process.on(signal, forward);
@@ -2416,13 +3804,18 @@ async function launch({
   for (const signal of FORWARDED_SIGNALS)
     process.off(signal, forward);
   await github.close();
+  if (claudeRefresher?.busy())
+    console.log(`
+${FINISHING_BACKGROUND_REFRESH}`);
+  await claudeRefresher?.stop();
+  claudeNotices.replay();
   clientConfigDir.remove();
-  finishSession(run, saved);
+  closeSession({ run, session: saved });
   process.exit(exitCode);
 }
 
 // src/push.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 
 // ../node_modules/.bun/@clack+core@1.5.1/node_modules/@clack/core/dist/index.mjs
 import { stdout, stdin } from "node:process";
@@ -3614,7 +5007,7 @@ async function push({ args }) {
       return;
     }
   }
-  const pushed = spawnSync3("git", ["-C", root, "push", ...gitFlags, "origin", `${tip}:refs/heads/${branch}`], { stdio: "inherit" });
+  const pushed = spawnSync4("git", ["-C", root, "push", ...gitFlags, "origin", `${tip}:refs/heads/${branch}`], { stdio: "inherit" });
   if (pushed.status === 0) {
     const done = `Pushed ${branch}. Base for comparison was ${baseSha.slice(0, 8)}.`;
     if (tty && !yes)
@@ -3626,7 +5019,7 @@ async function push({ args }) {
 }
 
 // src/sessions-command.ts
-import { existsSync as existsSync5, rmSync as rmSync7 } from "node:fs";
+import { existsSync as existsSync6, rmSync as rmSync10 } from "node:fs";
 function parseRemoveArgs(args) {
   let all = false;
   let force = false;
@@ -3642,7 +5035,7 @@ function parseRemoveArgs(args) {
   return { all, force, id };
 }
 async function removeSession(run, session, force, ask, interactive) {
-  if (existsSync5(session.worktree)) {
+  if (existsSync6(session.worktree)) {
     const preserved = preserveBranches(run, session);
     const head = cloneHead(session.worktree);
     const unbranched = preserved.length === 0 && head?.detached !== undefined && head.detached !== session.baseSha;
@@ -3660,7 +5053,7 @@ async function removeSession(run, session, force, ask, interactive) {
         return "kept";
       }
     }
-    rmSync7(session.worktree, { recursive: true, force: true });
+    rmSync10(session.worktree, { recursive: true, force: true });
     const kept = preserved.length > 0 ? ` Its branches are kept as refs/maesttro/${session.id}/*.` : "";
     console.log(`Removed session ${session.id}.${kept}`);
   } else {
@@ -3717,7 +5110,7 @@ async function sessionsCommand({
     return;
   }
   for (const session of sessions) {
-    const branches = existsSync5(session.worktree) ? cloneBranches(session.worktree) : undefined;
+    const branches = existsSync6(session.worktree) ? cloneBranches(session.worktree) : undefined;
     const where = branches === undefined ? "clone missing" : branches.length > 0 ? `branches: ${branches.join(", ")}` : "no branches yet";
     const mode = session.strict ? "  strict" : "";
     console.log(`  ${session.id}  ${session.createdAt.slice(0, 16)}  ${where}${mode}`);
@@ -3745,23 +5138,31 @@ async function setup({ args }) {
   console.log("-> Building runner image (this pulls node:22-slim + installs CLIs, first run only)...");
   run(`docker build -t ${IMAGE} "${DOCKERFILE_DIR}"`);
   console.log(`
--> Ensuring persistent volume exists...`);
-  execSync4(`docker volume create ${VOLUME}`, { stdio: "ignore" });
-  console.log(`
--> Removing any long-lived GitHub token from the volume...`);
-  if (purgeLegacyToken())
-    console.log(`   ${REVOKE_NOTICE}`);
-  writeMaesttroConfig({ ...readMaesttroConfig(), legacyTokenPurged: true });
+-> Checking for the old shared runner volume...`);
+  migrateFromVolumeOnce({
+    config: readMaesttroConfig(),
+    saveConfig: writeMaesttroConfig,
+    store: claudeStore(),
+    announce: (message) => console.log(`   ${message}`)
+  });
   if (args[0]) {
-    console.log("   Ignoring the token argument: sessions now get short-lived tokens through `maesttro login`.");
+    console.log("   Ignoring the token argument: sessions now get short-lived tokens through `maesttro login github`.");
   }
   console.log(`
 -> Logging in to GitHub...`);
   await ensureLogin();
   console.log(`
+-> Logging in to Claude...`);
+  const claude = claudeStore();
+  if (claudeLoginState({ credentials: claude.load(), now: Date.now() }) === "active") {
+    console.log(`   Already logged in. Stored in ${claude.kind}.`);
+  } else if (!claudeLogin({ announce: (message) => console.log(`   ${message}`) })) {
+    console.log("   Setup continues without it; Claude Code sessions will show their own login screen.");
+  }
+  console.log(`
 -> Verifying isolation...`);
   console.log("   personal SSH key should NOT be visible:");
-  run(`docker run --rm ${hostIdentityFlags()} -v ${VOLUME}:/home/agent ${IMAGE} "cat ~/.ssh/id_rsa 2>&1 || true"`);
+  run(`docker run --rm ${hostIdentityFlags()} ${IMAGE} "cat ~/.ssh/id_rsa 2>&1 || true"`);
   console.log("\nSetup complete. Run `maesttro` from any project directory to start a session,");
   console.log("or `maesttro list` to see available clients.");
 }
@@ -3843,15 +5244,15 @@ function removeStaleRunnerImages({
 
 // src/version-check.ts
 import { execFile } from "node:child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync8 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync12 } from "node:fs";
+import { join as join16 } from "node:path";
 var LOOKUP_TIMEOUT_MS = 3000;
 function installedManifest() {
-  return JSON.parse(readFileSync8(join12(PACKAGE_ROOT, "package.json"), "utf8"));
+  return JSON.parse(readFileSync12(join16(PACKAGE_ROOT, "package.json"), "utf8"));
 }
 function canOfferUpdate({
   interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY),
-  inRunner = existsSync6(RUNNER_MARKER)
+  inRunner = existsSync7(RUNNER_MARKER)
 } = {}) {
   return interactive && !inRunner;
 }
@@ -3945,6 +5346,13 @@ var MODE_FLAGS = {
   "--strict": true,
   "--no-strict": false
 };
+function clientFirst(args) {
+  const [first, second, ...rest] = args;
+  if (first !== undefined && second !== undefined && isClientKey(first)) {
+    return [second, first, ...rest];
+  }
+  return args;
+}
 function takeModeFlags(args) {
   let strict;
   let index = 0;
@@ -3996,13 +5404,13 @@ async function main(argv, commands = defaultCommands) {
       await commands.doctor();
       return;
     case "login":
-      await commands.login();
+      await commands.login({ args: rest });
       return;
     case "logout":
-      await commands.logout();
+      await commands.logout({ args: rest });
       return;
     case "status":
-      await commands.status();
+      await commands.status({ args: rest });
       return;
     case "push":
       await commands.push({ args: rest });
@@ -4012,11 +5420,11 @@ async function main(argv, commands = defaultCommands) {
       return;
     case "resume": {
       const beforeId = takeModeFlags(rest);
-      const [id, ...afterId] = beforeId.rest;
+      const [id, ...afterId] = clientFirst(beforeId.rest);
       const afterIdFlags = takeModeFlags(afterId);
       const strict = afterIdFlags.strict ?? beforeId.strict ?? leading.strict;
       if (!id) {
-        commands.print("Usage: maesttro resume <session-id> [--strict|--no-strict] [client] [args...]");
+        commands.print("Usage: maesttro resume [client] <session-id> [--strict|--no-strict] [client] [args...]");
         return;
       }
       await commands.launch({