mindwire 0.1.25 → 0.1.27

package/dist/cli.js

@@ -1,2172 +1,480 @@
 #!/usr/bin/env node
-import { MindwireError, TimeoutError, ApiError, RunFailedError, binaryCacheDirectory, cachedExecutable, verifyReleaseBytes, cacheExecutable, executableChecksum } from './chunk-PFYKJ6LX.js';
+import { defaultStateDirectory, superviseComputer, ensureComputer, computerPairingURI, stopComputer, computerClient, SDK_VERSION, readJSON, writeJSON, currentProcessIdentity, processStateAlive, acquireProcessLock, computerPairingQRData } from './chunk-QXHI4TMC.js';
+import './chunk-T6TD76UA.js';
 import { promisify, parseArgs } from 'util';
-import { fileURLToPath } from 'url';
-import { realpathSync } from 'fs';
-import * as path2 from 'path';
-import { createHash, randomBytes, randomUUID } from 'crypto';
+import { fileURLToPath, pathToFileURL } from 'url';
+import { realpathSync, mkdtempSync, chmodSync, writeFileSync, rmSync } from 'fs';
+import * as path from 'path';
+import { join } from 'path';
+import { createHash } from 'crypto';
+import { hostname, homedir, tmpdir } from 'os';
 import { createInterface } from 'readline/promises';
 import { setTimeout as setTimeout$1 } from 'timers/promises';
-import { execFile, execFileSync, spawn } from 'child_process';
+import { execFile, spawn } from 'child_process';
 import * as fs from 'fs/promises';
-import { readFile, mkdtemp, writeFile, rm } from 'fs/promises';
-import { homedir, networkInterfaces, tmpdir } from 'os';
 
-// src/computer.ts
-var ComputerApi = class {
-  constructor(client) {
-    this.client = client;
-  }
-  client;
-  info() {
-    return this.client.http.request("GET", "/computer");
-  }
-  setRoutes(routes) {
-    return this.client.http.request("PUT", "/computer/routes", { body: { routes } });
-  }
-  updateStatus() {
-    return this.client.http.request("GET", "/computer/update");
-  }
-  requestUpdate(version) {
-    return this.client.http.request("POST", "/computer/update", { body: { version } });
-  }
-  invite(routes) {
-    return this.client.http.request("POST", "/computer/pairings", { body: { routes } });
-  }
-  pairing(id) {
-    return this.client.http.request("GET", `/computer/pairings/${encodeURIComponent(id)}`);
-  }
-  completePairing(id, requestId) {
-    return this.client.http.request("POST", `/computer/pairings/${encodeURIComponent(id)}/complete`, { body: { requestId } });
-  }
-  decide(id, requestId, approve) {
-    return this.client.http.request("POST", `/computer/pairings/${encodeURIComponent(id)}/decision`, { body: { requestId, approve } });
-  }
-  devices() {
-    return this.client.http.request("GET", "/computer/devices");
-  }
-  revoke(id) {
-    return this.client.http.request("DELETE", `/computer/devices/${encodeURIComponent(id)}`);
-  }
-  forwards() {
-    return this.client.http.request("GET", "/computer/forwards");
-  }
-  /** Authorize a loopback port for this paired device. Renew the same ID every 30s;
-   * grants expire after two minutes. Carry traffic using SSH direct-tcpip. */
-  forward(request) {
-    return this.client.http.request("POST", "/computer/forwards", { body: request });
-  }
-  closeForward(id) {
-    return this.client.http.request("DELETE", `/computer/forwards/${encodeURIComponent(id)}`);
-  }
-};
-function computerPairingURI(invitation) {
-  const bytes = new TextEncoder().encode(JSON.stringify(invitation));
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  const encoded = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-  return `mindwire://pair?v=1#${encoded}`;
-}
-
-// src/version.ts
-var SDK_VERSION = "0.1.25" ;
-
-// src/http.ts
-var DEFAULT_TIMEOUT_MS = 12e4;
-function isAbortError(e) {
-  return typeof e === "object" && e !== null && e.name === "AbortError";
-}
-var Http = class {
-  fetchImpl;
-  baseHeaders;
-  resolver;
-  timeoutMs;
-  cached = null;
-  pending = null;
-  constructor(opts) {
-    const f = opts.fetch ?? globalThis.fetch;
-    if (!f) {
-      throw new MindwireError(
-        "mindwire: no global fetch found \u2014 pass a `fetch` implementation in the client options"
-      );
-    }
-    this.fetchImpl = f;
-    this.baseHeaders = { ...opts.headers };
-    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    if (opts.baseUrl) {
-      const base = { baseUrl: opts.baseUrl.replace(/\/+$/, ""), token: opts.token };
-      this.resolver = async () => base;
-    } else if (opts.resolveBase) {
-      const rb = opts.resolveBase;
-      this.resolver = async () => {
-        const r = await rb();
-        return {
-          baseUrl: r.baseUrl.replace(/\/+$/, ""),
-          token: r.token ?? opts.token,
-          getToken: r.getToken,
-          headers: r.headers,
-          fetch: r.fetch
-        };
-      };
-    } else {
-      throw new MindwireError("mindwire: Http requires a baseUrl or a resolveBase");
-    }
-  }
-  /**
-   * One fetch, with raw network failures wrapped as {@link MindwireError} so callers see a typed
-   * SDK error instead of a bare `TypeError: fetch failed`. An abort (the request's own signal, or
-   * our timeout controller) is re-thrown untouched — `fetchWithTimeout` classifies it.
-   */
-  async fetchOnce(f, url, init, method, path4) {
-    try {
-      return await f(url, init);
-    } catch (e) {
-      const aborted = init.signal?.aborted ?? false;
-      if (aborted || isAbortError(e)) throw e;
-      throw new MindwireError(`mindwire: ${method} ${path4} \u2014 network request failed`, { cause: e });
-    }
-  }
-  /**
-   * `fetchOnce` plus a timeout that composes with the caller's `signal`. A hand-rolled controller
-   * (not `AbortSignal.timeout`/`AbortSignal.any`, which need Node 20.3+/18.17+) fires after
-   * `timeoutMs`; whichever aborts first wins. Timeout → {@link TimeoutError}; the caller's own abort
-   * propagates as-is (its `reason`). `timeoutMs<=0` disables the deadline entirely.
-   */
-  async fetchWithTimeout(f, url, init, userSignal, method, path4) {
-    if (!this.timeoutMs || this.timeoutMs <= 0) {
-      return this.fetchOnce(f, url, { ...init, ...userSignal ? { signal: userSignal } : {} }, method, path4);
-    }
-    const ctrl = new AbortController();
-    const onAbort = () => ctrl.abort(userSignal?.reason);
-    if (userSignal) {
-      if (userSignal.aborted) ctrl.abort(userSignal.reason);
-      else userSignal.addEventListener("abort", onAbort, { once: true });
-    }
-    let timedOut = false;
-    const timer = setTimeout(() => {
-      timedOut = true;
-      ctrl.abort();
-    }, this.timeoutMs);
-    try {
-      return await this.fetchOnce(f, url, { ...init, signal: ctrl.signal }, method, path4);
-    } catch (e) {
-      if (timedOut) throw new TimeoutError(method, path4, this.timeoutMs);
-      if (userSignal?.aborted) throw userSignal.reason ?? e;
-      throw e;
-    } finally {
-      clearTimeout(timer);
-      if (userSignal) userSignal.removeEventListener("abort", onAbort);
-    }
-  }
-  /**
-   * The bearer token for the next request. Prefers the transport's dynamic `getToken` (which
-   * caches and mints on demand); falls back to the static token resolved at base time. `force`
-   * asks the getter to re-mint — used once on a 401 before retrying.
-   */
-  async authToken(base, force) {
-    if (base.getToken) {
-      const t = await base.getToken(force ? { force: true } : void 0);
-      return t ?? base.token;
-    }
-    return base.token;
-  }
-  base() {
-    if (this.cached) return Promise.resolve(this.cached);
-    if (!this.pending) {
-      this.pending = this.resolver().then((b) => this.cached = b).catch((err) => {
-        this.pending = null;
-        throw err;
-      });
-    }
-    return this.pending;
-  }
-  /**
-   * Resolve the base eagerly and memoize it — provisions the transport (spawns the embedded daemon,
-   * connects the sandbox/SSH/Docker target, …) now instead of on the first request. Idempotent: this
-   * awaits the *same* memoized promise the first `request()`/`open()` awaits, so the target's
-   * `connect()` fires exactly once. Backs {@link import("./client.js").Mindwire.ensure}.
-   */
-  async ready() {
-    await this.base();
-  }
-  url(baseUrl, path4, query) {
-    const u = new URL(baseUrl + (path4.startsWith("/") ? path4 : `/${path4}`));
-    if (query) {
-      for (const [k, v] of Object.entries(query)) {
-        if (v !== void 0) u.searchParams.set(k, String(v));
-      }
-    }
-    return u.toString();
-  }
-  headers(token, extra, hasBody = false) {
-    const h = { Accept: "application/json", ...this.baseHeaders, ...extra };
-    if (token) h["Authorization"] = `Bearer ${token}`;
-    if (hasBody) h["Content-Type"] = "application/json";
-    return h;
-  }
-  async request(method, path4, init = {}) {
-    const base = await this.base();
-    const hasBody = init.body !== void 0;
-    const url = this.url(base.baseUrl, path4, init.query);
-    const extra = { ...base.headers, ...init.headers };
-    const f = base.fetch ?? this.fetchImpl;
-    const send = async (force) => this.fetchWithTimeout(
-      f,
-      url,
-      {
-        method,
-        headers: this.headers(await this.authToken(base, force), extra, hasBody),
-        body: hasBody ? JSON.stringify(init.body) : void 0
-      },
-      init.signal,
-      method,
-      path4
-    );
-    let res = await send(false);
-    if (res.status === 401 && base.getToken) res = await send(true);
-    if (!res.ok) throw await this.toApiError(method, res);
-    if (res.status === 204) return void 0;
-    const text = await res.text();
-    if (text === "") return void 0;
-    try {
-      return JSON.parse(text);
-    } catch (e) {
-      throw new MindwireError(`mindwire: ${method} ${path4} returned a non-JSON body`, { cause: e });
-    }
-  }
-  /** Open a streaming response (SSE). Caller owns the body. */
-  async open(method, path4, init = {}) {
-    const base = await this.base();
-    const url = this.url(base.baseUrl, path4, init.query);
-    const extra = { Accept: "text/event-stream", ...base.headers, ...init.headers };
-    const f = base.fetch ?? this.fetchImpl;
-    const send = async (force) => this.fetchOnce(
-      f,
-      url,
-      {
-        method,
-        headers: this.headers(await this.authToken(base, force), extra, init.body !== void 0),
-        ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
-        ...init.signal ? { signal: init.signal } : {}
-      },
-      method,
-      path4
-    );
-    let res = await send(false);
-    if (res.status === 401 && base.getToken) res = await send(true);
-    if (!res.ok) throw await this.toApiError(method, res);
-    if (!res.body)
-      throw new MindwireError(`mindwire: ${method} ${path4} returned no response body to stream`);
-    return res;
-  }
-  async toApiError(method, res) {
-    let body = "";
-    try {
-      const text = await res.text();
-      try {
-        body = text ? JSON.parse(text) : "";
-      } catch {
-        body = text;
-      }
-    } catch {
-    }
-    return new ApiError({ status: res.status, url: res.url, method, body });
-  }
-};
-
-// src/sse.ts
-async function* readSSE(body, signal) {
-  const reader = body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  const onAbort = () => void reader.cancel().catch(() => {
-  });
-  if (signal) {
-    if (signal.aborted) {
-      await reader.cancel().catch(() => {
-      });
-      return;
-    }
-    signal.addEventListener("abort", onAbort, { once: true });
-  }
-  try {
-    for (; ; ) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      let sep;
-      while ((sep = indexOfBlankLine(buffer)) !== -1) {
-        const rawEvent = buffer.slice(0, sep);
-        buffer = buffer.slice(sepEnd(buffer, sep));
-        const payload2 = parseEvent(rawEvent);
-        if (payload2 !== void 0) yield JSON.parse(payload2);
-      }
-    }
-    const payload = parseEvent(buffer);
-    if (payload !== void 0) yield JSON.parse(payload);
-  } finally {
-    if (signal) signal.removeEventListener("abort", onAbort);
-    await reader.cancel().catch(() => {
-    });
-    reader.releaseLock();
-  }
-}
-function indexOfBlankLine(s) {
-  const a = s.indexOf("\n\n");
-  const b = s.indexOf("\r\n\r\n");
-  if (a === -1) return b;
-  if (b === -1) return a;
-  return Math.min(a, b);
-}
-function sepEnd(s, idx) {
-  return s.startsWith("\r\n\r\n", idx) ? idx + 4 : idx + 2;
-}
-function parseEvent(block) {
-  const lines = block.split(/\r\n|\n/);
-  const data = [];
-  for (const line of lines) {
-    if (line === "" || line.startsWith(":")) continue;
-    const colon = line.indexOf(":");
-    const field = colon === -1 ? line : line.slice(0, colon);
-    if (field !== "data") continue;
-    let value = colon === -1 ? "" : line.slice(colon + 1);
-    if (value.startsWith(" ")) value = value.slice(1);
-    data.push(value);
-  }
-  if (data.length === 0) return void 0;
-  return data.join("\n");
-}
-
-// src/run.ts
-var TERMINAL = /* @__PURE__ */ new Set(["done", "error", "cancelled"]);
-var Run = class _Run {
-  data;
-  http;
-  constructor(http, data) {
-    this.http = http;
-    this.data = data;
-  }
-  get id() {
-    return this.data.id;
-  }
-  get chatId() {
-    return this.data.chatId;
-  }
-  get agent() {
-    return this.data.agent;
-  }
-  get status() {
-    return this.data.status;
-  }
-  /** `"resolve"` on the parent of a global-resolve run; `undefined` for an ordinary turn. */
-  get kind() {
-    return this.data.kind;
-  }
-  /** On a child iteration of a resolve run, the id of its parent resolve run; else `undefined`. */
-  get parentId() {
-    return this.data.parentId;
-  }
-  /** Parent of a resolve run only: why the loop ended (`"done"` | `"capped"` | `"error"` | …). */
-  get stopReason() {
-    return this.data.stopReason;
-  }
-  /** Parent of a resolve run only: how many child turns the loop ran. */
-  get iterations() {
-    return this.data.iterations;
-  }
-  /** The latest known run record. */
-  get value() {
-    return this.data;
-  }
-  /** Unified SSE event stream: replay buffer, then live events, then close. */
-  async *stream(opts = {}) {
-    const cursor = opts.after === void 0 ? "" : `?after=${encodeURIComponent(opts.after)}`;
-    const res = await this.http.open("GET", `/runs/${encodeURIComponent(this.id)}/stream${cursor}`, {
-      ...opts.signal ? { signal: opts.signal } : {}
-    });
-    for await (const ev of readSSE(res.body, opts.signal)) {
-      if (!opts.includeOpenSentinel && ev.type === "status" && ev.meta?.["stream"] === "open") {
-        continue;
-      }
-      yield ev;
-    }
-  }
-  /** `for await (const ev of run)` — sugar for `run.stream()`. */
-  [Symbol.asyncIterator]() {
-    return this.stream();
-  }
-  /** Cancel the in-flight turn (kills the underlying agent process). */
-  async cancel() {
-    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/cancel`);
-  }
-  /**
-   * Answer a pending permission, question or plan. Message-mode questions remain answerable
-   * after completion; the daemon steers or resumes the conversation. Read the chat's latest
-   * run after replying to a completed run. Requires the agent's `respond` capability.
-   */
-  async respond(input = {}) {
-    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/respond`, { body: input });
-  }
-  /**
-   * Steer a follow-up message into the running turn without cancelling it. Requires the agent's
-   * `input` capability.
-   */
-  async sendInput(text) {
-    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/input`, { body: { text } });
-  }
-  /**
-   * Soft-stop the running turn (ask the agent to halt current work) without the hard process kill
-   * {@link Run.cancel} does — the turn stays open for a follow-up via {@link Run.sendInput}.
-   * Requires the agent's `interrupt` capability.
-   */
-  async interrupt() {
-    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/interrupt`);
-  }
-  /**
-   * Switch the model of the live turn. An empty/omitted `model` resets the turn to the agent/CLI
-   * default. Only meaningful on a persistent (non-bypass) turn; on a one-shot turn it is a
-   * best-effort no-op. Requires the agent's `setModel` capability.
-   */
-  async setModel(model) {
-    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/set-model`, {
-      body: { model: model ?? "" }
-    });
-  }
-  /**
-   * Switch the live permission mode using a value from the agent's settings schema.
-   * Resolves after the harness acknowledges the change; rejects if it cannot apply it.
-   * Requires `setPermissionMode`. Codex settings apply on the next turn instead.
-   */
-  async setPermissionMode(mode) {
-    await this.http.request("POST", `/runs/${encodeURIComponent(this.id)}/set-permission-mode`, {
-      body: { mode }
-    });
-  }
-  /**
-   * `GET /runs/{id}/children` — the child iterations of a global-resolve run, oldest→newest, each as
-   * its own {@link Run} handle. An ordinary turn (or a resolve that ran a single iteration) returns an
-   * empty array. Use it to inspect the run tree a {@link Mindwire.resolve} produced.
-   */
-  async children() {
-    const data = await this.http.request(
-      "GET",
-      `/runs/${encodeURIComponent(this.id)}/children`
-    );
-    return data.map((d) => new _Run(this.http, d));
-  }
-  /** Re-fetch the run record from the daemon and update this handle. */
-  async refresh() {
-    this.data = await this.http.request("GET", `/runs/${encodeURIComponent(this.id)}`);
-    return this.data;
-  }
-  /** Restore current output once, then follow with `stream({ after: snapshot.sequence })`. */
-  async snapshot() {
-    const snapshot = await this.http.request("GET", `/runs/${encodeURIComponent(this.id)}/snapshot`);
-    this.data = snapshot.run;
-    return snapshot;
-  }
-  /**
-   * Consume the event stream to completion. Returns the final run record and the `result`
-   * event's summary (if any). Throws {@link RunFailedError} on an `error`/`cancelled` outcome
-   * unless `throwOnError` is set to `false`.
-   */
-  async wait(opts = {}) {
-    let result;
-    let streamError;
-    for await (const ev of this.stream(opts)) {
-      if (ev.type === "result") result = ev.result;
-      else if (ev.type === "error") streamError = ev.error;
-    }
-    const run = await this.refresh();
-    if (opts.throwOnError !== false) {
-      if (TERMINAL.has(run.status)) {
-        if (run.status !== "done") {
-          throw new RunFailedError(run.id, run.status, run.error ?? streamError);
-        }
-      } else {
-        throw new RunFailedError(
-          run.id,
-          run.status,
-          streamError ?? "event stream ended before the run reached a terminal state"
-        );
-      }
-    }
-    return result !== void 0 ? { run, result } : { run };
-  }
-};
-
-// src/workspace.ts
-var ProjectOperationsApi = class {
-  constructor(mw) {
-    this.mw = mw;
-  }
-  mw;
-  async list(activeOnly = false) {
-    const response = await this.mw.http.request("GET", "/workspace/operations", {
-      query: { active: activeOnly }
-    });
-    return response.operations;
-  }
-  get(id) {
-    return this.mw.http.request("GET", `/workspace/operations/${encodeURIComponent(id)}`);
-  }
-  cancel(id) {
-    return this.mw.http.request("POST", `/workspace/operations/${encodeURIComponent(id)}/cancel`);
-  }
-  retry(id, auth) {
-    return this.mw.http.request("POST", `/workspace/operations/${encodeURIComponent(id)}/retry`, { body: { auth } });
-  }
-  /** The first event is the current snapshot, then live changes. Reconnecting never replays old
-   * progress. Breaking the loop/aborting detaches the observer; cancel(id) explicitly stops work.
-   */
-  async *watch(id, opts = {}) {
-    const controller = new AbortController();
-    const abort = () => controller.abort();
-    opts.signal?.addEventListener("abort", abort, { once: true });
-    if (opts.signal?.aborted) controller.abort();
-    try {
-      const response = await this.mw.http.open("GET", `/workspace/operations/${encodeURIComponent(id)}/stream`, {
-        signal: controller.signal
-      });
-      let sequence = -1;
-      for await (const operation of readSSE(response.body, controller.signal)) {
-        if (operation.sequence > sequence) {
-          sequence = operation.sequence;
-          yield operation;
-        }
-      }
-    } finally {
-      controller.abort();
-      opts.signal?.removeEventListener("abort", abort);
-    }
-  }
-};
-var WorkspaceCollection = class {
-  constructor(mw, kind) {
-    this.mw = mw;
-    this.kind = kind;
-  }
-  mw;
-  kind;
-  /** Create with a stable client-generated ID. For updates, supply the record's last revision. */
-  put(id, record, expectedRevision) {
-    return this.mw.http.request("PUT", `/workspace/${this.kind}/${encodeURIComponent(id)}`, {
-      body: { record, expectedRevision }
-    });
-  }
-  /** Remove membership and dependent chat links. Files and native transcripts are retained.
-   * Use deleteChat() for an explicit transcript purge. Running chats reject removal with 409.
-   */
-  delete(id, revision) {
-    return this.mw.http.request("DELETE", `/workspace/${this.kind}/${encodeURIComponent(id)}`, {
-      query: { revision }
-    });
-  }
-};
-var WorkspaceApi = class {
-  constructor(mw) {
-    this.mw = mw;
-    this.git = new GitAccessApi(mw);
-    this.operations = new ProjectOperationsApi(mw);
-    this.agents = new WorkspaceCollection(mw, "agents");
-    this.projects = new WorkspaceCollection(mw, "projects");
-    this.chats = new WorkspaceCollection(mw, "chats");
-  }
-  mw;
-  git;
-  operations;
-  agents;
-  projects;
-  chats;
-  snapshot() {
-    return this.mw.http.request("GET", "/workspace");
-  }
-  /** Start an operation owned by the daemon. The same ID/payload returns the existing operation. */
-  createProject(request) {
-    return this.mw.http.request("POST", "/workspace/projects", { body: request });
-  }
-  /** Permanently remove the confirmed project's directory and membership.
-   * projects.delete() retains files. Native harness transcripts are not purged.
-   */
-  removeProjectFiles(id, request) {
-    return this.mw.http.request("POST", `/workspace/projects/${encodeURIComponent(id)}/remove`, { body: request });
-  }
-  /** Incremental reconciliation. Pass the previous identity to detect a replaced/restored workspace.
-   * A 409 requires fetching snapshot() again; never apply a delta to a different registry.
-   */
-  changes(since, workspaceId) {
-    return this.mw.http.request("GET", "/workspace/changes", { query: { since, workspaceId } });
-  }
-  /** Import legacy metadata before replacing a local cache. Safe to repeat after interruption. */
-  import(records) {
-    return this.mw.http.request("POST", "/workspace/import", { body: records });
-  }
-};
-var GitAccessApi = class {
-  constructor(mw) {
-    this.mw = mw;
-  }
-  mw;
-  /** Reads attribution independently of GitHub authentication. Requires gitIdentityVersion >= 1. */
-  identity(context = {}) {
-    return this.mw.http.request("GET", "/workspace/git/identity", { query: context });
-  }
-  /** Saves settings only; never stages or commits. all_workspaces installs this
-   * workspace's copy of a client-managed default; the client handles fan-out. */
-  setIdentity(update, context = {}) {
-    return this.mw.http.request("PUT", "/workspace/git/identity", { query: context, body: update });
-  }
-  state() {
-    return this.mw.http.request("GET", "/workspace/git");
-  }
-  setDefault(connection, auth) {
-    return this.mw.http.request("PUT", "/workspace/git", { body: { connection, auth } });
-  }
-  forget(connectionId) {
-    return this.mw.http.request("DELETE", `/workspace/git/connections/${encodeURIComponent(connectionId)}`);
-  }
-  project(projectId) {
-    return this.mw.http.request("GET", `/workspace/projects/${encodeURIComponent(projectId)}/git`);
-  }
-  setProject(projectId, connection, expectedRevision, auth) {
-    return this.mw.http.request("PUT", `/workspace/projects/${encodeURIComponent(projectId)}/git`, {
-      body: { connection, expectedRevision, auth }
-    });
-  }
-  /** Compatibility call. Prefer start() and operation()/watch() for reconnectable writes. */
-  run(projectId, operation, auth) {
-    return this.mw.http.request("POST", `/workspace/projects/${encodeURIComponent(projectId)}/git/${operation}`, { body: { auth } });
-  }
-  /** Requires health.gitOperationsVersion >= 1 (>= 2 for branches, >= 4 for restore_commit). Acceptance persists before Git runs;
-   * disconnecting only detaches the client. The same ID/intent never runs twice.
-   */
-  start(projectId, request) {
-    return this.mw.http.request("POST", `/workspace/projects/${encodeURIComponent(projectId)}/git/operations`, { body: request });
-  }
-  async operations(projectId, activeOnly = false) {
-    const result = await this.mw.http.request(
-      "GET",
-      `/workspace/projects/${encodeURIComponent(projectId)}/git/operations`,
-      { query: { active: activeOnly, actionsVersion: 4 } }
-    );
-    return result.operations;
-  }
-  operation(id) {
-    return this.mw.http.request("GET", `/workspace/git/operations/${encodeURIComponent(id)}`);
-  }
-  cancel(id) {
-    return this.mw.http.request("POST", `/workspace/git/operations/${encodeURIComponent(id)}/cancel`);
-  }
-  /** Current snapshot followed by state changes. Aborting observation never cancels the operation. */
-  async *watch(id, opts = {}) {
-    const controller = new AbortController();
-    const abort = () => controller.abort();
-    opts.signal?.addEventListener("abort", abort, { once: true });
-    if (opts.signal?.aborted) controller.abort();
-    try {
-      const response = await this.mw.http.open("GET", `/workspace/git/operations/${encodeURIComponent(id)}/stream`, {
-        signal: controller.signal
-      });
-      let sequence = -1;
-      for await (const operation of readSSE(response.body, controller.signal)) {
-        if (operation.sequence > sequence) {
-          sequence = operation.sequence;
-          yield operation;
-        }
-      }
-    } finally {
-      controller.abort();
-      opts.signal?.removeEventListener("abort", abort);
-    }
-  }
-};
-
-// src/surfaces.ts
-var SurfacesApi = class {
-  constructor(mw) {
-    this.mw = mw;
-  }
-  mw;
-  list() {
-    return this.mw.http.request("GET", "/surfaces");
-  }
-  status(refresh = false) {
-    return this.mw.http.request("GET", "/surfaces/desktop", { query: { refresh } });
-  }
-  bind(binding) {
-    return this.mw.http.request("PUT", "/surfaces/desktop/binding", { body: binding });
-  }
-  open(request) {
-    return this.mw.http.request("POST", "/surfaces/desktop/sessions", { body: request });
-  }
-  control(id, request) {
-    return this.mw.http.request("POST", `/surfaces/desktop/sessions/${encodeURIComponent(id)}/control`, { body: request });
-  }
-  close(id) {
-    return this.mw.http.request("DELETE", `/surfaces/desktop/sessions/${encodeURIComponent(id)}`);
-  }
-  capture(id) {
-    return this.mw.http.request("POST", `/surfaces/desktop/sessions/${encodeURIComponent(id)}/captures`);
-  }
-  action(request) {
-    return this.mw.http.request("POST", "/surfaces/desktop/actions", { body: request });
-  }
-  receipt(id) {
-    return this.mw.http.request("GET", `/surfaces/desktop/actions/${encodeURIComponent(id)}`);
-  }
-  artifact(id) {
-    return this.mw.http.request("GET", `/artifacts/${encodeURIComponent(id)}`);
-  }
-  /** Every connection starts with the current snapshot, then revisions. Never replays input. */
-  async *watch(opts = {}) {
-    const controller = new AbortController();
-    const abort = () => controller.abort();
-    opts.signal?.addEventListener("abort", abort, { once: true });
-    if (opts.signal?.aborted) controller.abort();
-    try {
-      const response = await this.mw.http.open("GET", "/surfaces/desktop/events", { signal: controller.signal });
-      let instance;
-      let revision = -1;
-      for await (const snapshot of readSSE(response.body, controller.signal)) {
-        if (instance !== snapshot.instanceId || snapshot.revision > revision) {
-          instance = snapshot.instanceId;
-          revision = snapshot.revision;
-          yield snapshot;
-        }
-      }
-    } finally {
-      controller.abort();
-      opts.signal?.removeEventListener("abort", abort);
-    }
-  }
-};
-
-// src/service.ts
-var ServiceApi = class {
-  constructor(client) {
-    this.client = client;
-  }
-  client;
-  updateStatus() {
-    return this.client.http.request("GET", "/service/update");
-  }
-  /** Download first. Acquire immediately before replacement; busy work returns 409.
-   * Admission stays closed until release, process exit, or the one-minute expiry. */
-  acquireUpdate() {
-    return this.client.http.request("POST", "/service/update");
-  }
-  releaseUpdate(id) {
-    return this.client.http.request("DELETE", `/service/update/${encodeURIComponent(id)}`);
-  }
-};
-
-// src/execution.ts
-var ExecutionApi = class {
-  constructor(client) {
-    this.client = client;
-    this.terminals = new TerminalsApi(client);
-  }
-  client;
-  terminals;
-  host() {
-    return this.client.http.request("GET", "/workspace/host");
-  }
-  resources() {
-    return this.client.http.request("GET", "/workspace/resources");
-  }
-  files(path4 = "", query) {
-    return this.client.http.request("GET", "/workspace/files", { query: { path: path4, query } });
-  }
-  read(path4) {
-    return this.client.http.request("GET", "/workspace/file", { query: { path: path4 } });
-  }
-  write(path4, content) {
-    return this.client.http.request("PUT", "/workspace/file", { body: { path: path4, content } });
-  }
-  remove(path4) {
-    return this.client.http.request("DELETE", "/workspace/file", { query: { path: path4 } });
-  }
-  exec(command, signal) {
-    return this.client.http.request("POST", "/workspace/exec", { body: command, signal });
-  }
-  /** Output data is base64, preserving partial UTF-8 chunks. Cancelling stops this command. */
-  async *stream(command, signal) {
-    const response = await this.client.http.open("POST", "/workspace/exec/stream", { body: command, signal });
-    yield* readSSE(response.body, signal);
-  }
-};
-var TerminalsApi = class {
-  constructor(client) {
-    this.client = client;
-  }
-  client;
-  list(directory) {
-    return this.client.http.request("GET", "/workspace/terminals", { query: { directory } });
-  }
-  open(request) {
-    return this.client.http.request("POST", "/workspace/terminals", { body: request });
-  }
-  get(id) {
-    return this.client.http.request("GET", this.path(id));
-  }
-  close(id) {
-    return this.client.http.request("DELETE", this.path(id));
-  }
-  input(id, input) {
-    return this.client.http.request("POST", `${this.path(id)}/input`, { body: input });
-  }
-  resize(id, columns, rows) {
-    return this.client.http.request("PUT", `${this.path(id)}/size`, { body: { columns, rows } });
-  }
-  /** Detaching only closes the subscription. Resume from the last sequence; reset replaces the screen. */
-  async *events(id, after = 0, signal) {
-    const response = await this.client.http.open("GET", `${this.path(id)}/events`, { query: { after }, signal });
-    yield* readSSE(response.body, signal);
-  }
-  path(id) {
-    return `/workspace/terminals/${encodeURIComponent(id)}`;
-  }
-};
-
-// src/daemon-binary.ts
-function supported(platform, arch) {
-  if (!["darwin", "linux", "win32"].includes(platform) || !["x64", "arm64"].includes(arch)) {
-    throw new MindwireError(`mindwire: no daemon release for ${platform}-${arch}`);
-  }
-}
-function assetName(version, platform, arch) {
-  const releasePlatform = platform === "win32" ? "windows" : platform;
-  const releaseArch = arch === "x64" ? "amd64" : arch;
-  return `mindwired-v${version}-${releasePlatform}-${releaseArch}${platform === "win32" ? ".exe" : ""}`;
-}
-function checksumFor(text, asset) {
-  const line = text.split("\n").find((l) => l.trim().endsWith(` ${asset}`) || l.trim().endsWith(`  ${asset}`));
-  const hash = line?.trim().split(/\s+/)[0];
-  return hash && /^[a-f0-9]{64}$/i.test(hash) ? hash.toLowerCase() : void 0;
-}
-async function ensureDaemonBinary(opts = {}) {
-  const proc = globalThis;
-  const platform = opts.platform ?? proc.process?.platform;
-  const arch = opts.arch ?? proc.process?.arch;
-  supported(platform ?? "unknown", arch ?? "unknown");
-  const daemonPlatform = platform;
-  const daemonArch = arch;
-  const version = opts.version ?? SDK_VERSION;
-  if (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
-    throw new MindwireError(`mindwire: cannot download daemon for non-release SDK version ${version}`);
-  }
-  const path4 = await import('path');
-  const { binaryCacheDirectory: binaryCacheDirectory2, cachedExecutable: cachedExecutable2, cacheExecutable: cacheExecutable2 } = await import('./binary-cache-CG52TXCZ.js');
-  const dir = path4.join(opts.cacheDir ?? await binaryCacheDirectory2(daemonPlatform), version, `${daemonPlatform}-${daemonArch}`);
-  const asset = assetName(version, daemonPlatform, daemonArch);
-  const bin = path4.join(dir, asset);
-  const cached = await cachedExecutable2(bin);
-  if (cached) return cached;
-  const base = (opts.releaseBaseUrl ?? proc.process?.env?.MINDWIRE_RELEASE_BASE_URL ?? "https://github.com/oblien/mindwire/releases/download").replace(/\/$/, "");
-  const release = `${base}/v${version}`;
-  const request = opts.fetch ?? globalThis.fetch;
-  if (!request) throw new MindwireError("mindwire: fetch is unavailable; set daemonBin or MINDWIRE_DAEMON");
-  const [checksums, binary] = await Promise.all([request(`${release}/checksums.txt`), request(`${release}/${asset}`)]);
-  if (!checksums.ok || !binary.ok) {
-    if (!opts.releaseBaseUrl && !proc.process?.env?.MINDWIRE_RELEASE_BASE_URL) {
-      const latest = await request("https://api.github.com/repos/oblien/mindwire/releases/latest");
-      if (latest.ok) {
-        const tag = (await latest.json()).tag_name;
-        const fallback = typeof tag === "string" ? tag.replace(/^v/, "") : "";
-        if (/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(fallback) && fallback !== version) {
-          return ensureDaemonBinary({ ...opts, version: fallback });
-        }
-      }
-    }
-    throw new MindwireError(`mindwire: failed to download daemon v${version} for ${daemonPlatform}-${daemonArch}`);
-  }
-  const expected = checksumFor(await checksums.text(), asset);
-  if (!expected) throw new MindwireError(`mindwire: release v${version} has no checksum for ${asset}`);
-  const bytes = new Uint8Array(await binary.arrayBuffer());
-  return cacheExecutable2(bin, bytes, expected);
-}
-
-// src/embedded.ts
-var shared = /* @__PURE__ */ new Map();
-function configKey(opts) {
-  return JSON.stringify([opts.cwd ?? "", opts.statePath ?? "", opts.bin ?? ""]);
-}
-function startEmbedded(opts = {}) {
-  const key = configKey(opts);
-  let daemon = shared.get(key);
-  if (!daemon) {
-    daemon = spawnDaemon(opts).catch((err) => {
-      shared.delete(key);
-      throw err;
-    });
-    shared.set(key, daemon);
-  }
-  return daemon;
-}
-function serverRuntime() {
-  return globalThis;
-}
-function isServerRuntime() {
-  const g = serverRuntime();
-  return typeof g.process !== "undefined" && !!g.process.versions?.node || typeof g.Bun !== "undefined" || typeof g.Deno !== "undefined";
-}
-async function spawnDaemon(opts) {
-  if (!isServerRuntime()) {
-    throw new MindwireError(
-      "MindWire embedded mode needs a server runtime (Node/Bun/Deno). In the browser or an edge runtime, pass { baseUrl } to connect to a running daemon."
-    );
-  }
-  const { spawn: spawn3 } = await import('child_process');
-  const net = await import('net');
-  const proc = serverRuntime().process;
-  const { randomBytes: randomBytes2 } = await import('crypto');
-  const resolved = await resolveBinary(opts.bin);
-  const bin = resolved.bin;
-  const port = await freePort(net);
-  const baseUrl = `http://127.0.0.1:${port}`;
-  const token = randomBytes2(32).toString("hex");
-  const child = spawn3(bin, [], {
-    env: {
-      ...proc.env,
-      ADDR: `127.0.0.1:${port}`,
-      AGENT_CWD: opts.cwd ?? proc.cwd(),
-      STATE_PATH: opts.statePath ?? ".mindwire-state.json",
-      DAEMON_TOKEN: token
-    },
-    stdio: "ignore"
-  });
-  let spawnError = null;
-  child.on("error", (e) => {
-    spawnError = e;
-  });
-  const stop = () => {
-    try {
-      child.kill();
-    } catch {
-    }
-  };
-  proc.once?.("exit", stop);
-  proc.once?.("SIGINT", () => {
-    stop();
-    proc.exit?.(130);
-  });
-  await waitHealthy(baseUrl, token, () => spawnError, resolved);
-  return { baseUrl, token, stop };
-}
-async function resolveBinary(explicit) {
-  const fs2 = await import('fs');
-  const path4 = await import('path');
-  const proc = serverRuntime().process;
-  const ext = proc.platform === "win32" ? ".exe" : "";
-  const candidates = [];
-  if (explicit) candidates.push(explicit);
-  if (proc.env?.MINDWIRE_DAEMON) candidates.push(proc.env.MINDWIRE_DAEMON);
-  try {
-    const url = await import('url');
-    const here = path4.dirname(url.fileURLToPath(import.meta.url));
-    const named = `mindwired-${proc.platform}-${proc.arch}${ext}`;
-    candidates.push(path4.join(here, "bin", named), path4.join(here, "..", "bin", named));
-  } catch {
-  }
-  for (const c of candidates) {
-    try {
-      if (fs2.existsSync(c)) return { bin: c, found: true, checked: candidates };
-    } catch {
-    }
-  }
-  const downloaded = await ensureDaemonBinary({ platform: proc.platform, arch: proc.arch });
-  return { bin: downloaded, found: true, checked: [...candidates, downloaded] };
-}
-function daemonStartError(resolved, cause) {
-  if (!resolved.found) {
-    return [
-      "Couldn't start the mindwire daemon: the `mindwired` binary was not found.",
-      `Looked in: ${resolved.checked.join(", ")}.`,
-      "Fixes:",
-      "  \u2022 check GitHub Release access so the SDK can download its matching daemon binary; or",
-      "  \u2022 set MINDWIRE_DAEMON to a `mindwired` binary; or",
-      "  \u2022 pass { baseUrl } to connect to a daemon you run yourself.",
-      "  \u2022 Working inside the mindwire monorepo? Run `go build -o /tmp/mindwired ./daemon/cmd/daemon` and set MINDWIRE_DAEMON.",
-      `(underlying error: ${cause.message})`
-    ].join("\n");
-  }
-  return `Couldn't start the mindwire daemon (${resolved.bin}): ${cause.message}. Set MINDWIRE_DAEMON to the binary path, or pass { baseUrl } to use a running daemon.`;
-}
-function freePort(net) {
-  return new Promise((resolve3, reject) => {
-    const srv = net.createServer();
-    srv.on("error", reject);
-    srv.listen(0, "127.0.0.1", () => {
-      const addr = srv.address();
-      const port = addr && typeof addr === "object" ? addr.port : 0;
-      srv.close(() => resolve3(port));
-    });
-  });
-}
-async function waitHealthy(baseUrl, token, getError, resolved, timeoutMs = 15e3) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const err = getError();
-    if (err) {
-      throw new MindwireError(daemonStartError(resolved, err), { cause: err });
-    }
-    try {
-      const res = await fetch(`${baseUrl}/healthz`, { headers: { Authorization: `Bearer ${token}` } });
-      if (res.ok) return;
-    } catch {
-    }
-    await new Promise((r) => setTimeout(r, 150));
-  }
-  throw new MindwireError("mindwire embedded daemon did not become healthy in time.");
-}
-
-// src/target/index.ts
-function emit(spec, e) {
-  if (!spec.onLog) return;
-  try {
-    spec.onLog(e);
-  } catch {
-  }
-}
-function local(opts = {}) {
-  return {
-    name: "local",
-    async connect(spec) {
-      const d = await startEmbedded(opts);
-      emit(spec, { target: "local", phase: "ready", message: `embedded daemon on ${d.baseUrl}` });
-      return {
-        id: d.baseUrl,
-        baseUrl: d.baseUrl,
-        ...d.token !== void 0 ? { token: d.token } : {},
-        // No-op: the embedded daemon is shared (keyed memoization) and reaped on process exit.
-        stop: async () => {
-        }
-      };
-    }
-  };
-}
-function remote(baseUrl, opts = {}) {
-  return {
-    name: "remote",
-    async connect(spec) {
-      emit(spec, { target: "remote", phase: "skip", message: `using remote daemon at ${baseUrl}` });
-      return {
-        id: baseUrl,
-        baseUrl,
-        ...opts.token !== void 0 ? { token: opts.token } : {},
-        ...opts.headers !== void 0 ? { headers: opts.headers } : {},
-        ...opts.fetch !== void 0 ? { fetch: opts.fetch } : {},
-        stop: async () => {
-        }
-      };
-    }
-  };
-}
-
-// src/client.ts
-var handleByTransport = /* @__PURE__ */ new WeakMap();
-var Mindwire = class _Mindwire {
-  /** Workspace registry: saved agent profiles, projects and chat relationships. */
-  workspace;
-  surfaces;
-  service;
-  execution;
-  computer;
-  http;
-  /** The default agent type applied to agent-scoped calls, if set. */
-  defaultAgent;
-  /** Step-flow auth, scoped to this client's default agent (override per call). */
-  auth;
-  /** Persistent memory files + saved prompt templates, scoped to this client's default agent. */
-  prompts;
-  /** Persistent MCP-server config (the config an agent loads every run), scoped to this client's default agent. */
-  mcp;
-  /** Custom LLM-provider registration (opencode/Codex native config), scoped to this client's default agent. */
-  providers;
-  /** Daemon-driven notification channels + routing rules (webhook/slack/discord/telegram; per-agent/session/global). */
-  notify;
-  constructor(opts = {}) {
-    const target = opts.target ?? local();
-    const spec = { agent: opts.agent, onLog: opts.logger };
-    this.http = new Http({
-      fetch: opts.fetch,
-      headers: opts.headers,
-      timeoutMs: opts.requestTimeoutMs,
-      resolveBase: () => {
-        const h = target.connect(spec);
-        handleByTransport.set(this.http, h);
-        return h.then((x) => ({
-          baseUrl: x.baseUrl,
-          token: x.token,
-          getToken: x.getToken,
-          headers: x.headers,
-          fetch: x.fetch
-        }));
-      }
-    });
-    this.defaultAgent = opts.agent;
-    this.workspace = new WorkspaceApi(this);
-    this.surfaces = new SurfacesApi(this);
-    this.service = new ServiceApi(this);
-    this.execution = new ExecutionApi(this);
-    this.computer = new ComputerApi(this);
-    this.auth = new AuthApi(this);
-    this.prompts = new PromptsApi(this);
-    this.mcp = new McpApi(this);
-    this.providers = new ProvidersApi(this);
-    this.notify = new NotifyApi(this);
-  }
-  /**
-   * Provision the destination and await readiness **now**, rather than lazily on the first request —
-   * useful to front-load a fresh SSH/Docker/Oblien box (and to stream its {@link EnsureEvent}s to the
-   * `logger`) before the first `turn()`. Idempotent and memoized: repeated `ensure()` calls, and the
-   * first real request, all await the same provisioning, so the target connects exactly once.
-   */
-  async ensure() {
-    await this.http.ready();
-  }
-  /** Return a new client bound to a different default agent (shares the same transport config). */
-  withAgent(agent) {
-    const clone = Object.create(_Mindwire.prototype);
-    clone.http = this.http;
-    clone.defaultAgent = agent;
-    clone.workspace = new WorkspaceApi(clone);
-    clone.surfaces = new SurfacesApi(clone);
-    clone.service = new ServiceApi(clone);
-    clone.execution = new ExecutionApi(clone);
-    clone.computer = new ComputerApi(clone);
-    clone.auth = new AuthApi(clone);
-    clone.prompts = new PromptsApi(clone);
-    clone.mcp = new McpApi(clone);
-    clone.providers = new ProvidersApi(clone);
-    clone.notify = new NotifyApi(clone);
-    return clone;
-  }
-  /** The `?agent=` value to send for a scoped call: explicit override → client default → none. */
-  agentParam(scoped) {
-    const a = scoped?.agent ?? this.defaultAgent;
-    return a ? { agent: a } : void 0;
-  }
-  /**
-   * Release target-owned resources by calling the {@link TargetHandle}'s `stop()` — once, even across
-   * {@link withAgent} clones that share the transport. For an `ssh`/`docker`/`oblien` target this reaps
-   * the box (tear down the tunnel, stop or delete the container/workspace, per `stopOnExit`); a no-op
-   * for `local`/`remote` (embedded self-cleans on process exit; remote is not ours to stop). Safe to
-   * call before the target has connected (nothing to reap yet).
-   */
-  async close() {
-    const handle = handleByTransport.get(this.http);
-    if (!handle) return;
-    handleByTransport.delete(this.http);
-    const h = await handle.catch(() => null);
-    if (h) await h.stop();
-  }
-  // ---- health & catalog ----------------------------------------------------
-  /** `GET /healthz` — authenticated liveness check. Resolves with the daemon's health payload when it is up. */
-  health() {
-    return this.http.request("GET", "/healthz");
-  }
-  /**
-   * `GET /stats` — the daemon **process's** resource snapshot (heap in use, memory reserved from the
-   * OS, goroutines, GC cycles, cores, platform, uptime). Cheap enough to call on demand — the daemon
-   * reads its own Go runtime, not the machine — so a UI can fetch it when a user opens a daemon's page
-   * without any background polling. See {@link Stats} for what each field means and doesn't.
-   */
-  stats() {
-    return this.http.request("GET", "/stats");
-  }
-  /** `GET /catalog` — every agent this daemon binary supports. */
-  catalog() {
-    return this.http.request("GET", "/catalog");
-  }
-  /** `GET /agent` — capabilities + settings schema + auth methods/status for the selected agent. */
-  agent(scoped) {
-    return this.http.request("GET", "/agent", { query: this.agentParam(scoped) });
-  }
-  /** `GET /agent/software` — installed version, compatibility and approved update target. */
-  software(opts = {}) {
-    return this.http.request("GET", "/agent/software", {
-      query: { ...this.agentParam(opts), ...opts.refresh ? { refresh: "true" } : {} }
-    });
-  }
-  /**
-   * `GET /models` — the models the selected agent can run for the configured account. An empty array
-   * is valid (no credentials yet / offline). Throws a 400 {@link ApiError} for an agent whose model is
-   * free text (check `capabilities.models` first).
-   */
-  models(scoped) {
-    return this.http.request("GET", "/models", { query: this.agentParam(scoped) });
-  }
-  /** `GET /doctor` — daemon-level health plus the selected agent's own checks. */
-  doctor(scoped) {
-    return this.http.request("GET", "/doctor", { query: this.agentParam(scoped) });
-  }
-  // ---- toolchain setup -----------------------------------------------------
-  /** `POST /setup` — start the agent's install toolchain (background; poll {@link setupStatus}). */
-  setup(scoped) {
-    return this.http.request("POST", "/setup", { query: this.agentParam(scoped) });
-  }
-  /** `POST /update` — install the catalog's newest tested version compatible with this daemon. */
-  update(scoped) {
-    return this.http.request("POST", "/update", { query: this.agentParam(scoped) });
-  }
-  /** `GET /setup` — current toolchain install progress. */
-  setupStatus(scoped) {
-    return this.http.request("GET", "/setup", { query: this.agentParam(scoped) });
-  }
-  // ---- config --------------------------------------------------------------
-  /** `GET /config` — the declared, non-secret settings for the agent. */
-  getConfig(scoped) {
-    return this.http.request("GET", "/config", {
-      query: this.agentParam(scoped)
-    });
-  }
-  /** `PUT /config` — merge recognized (non-secret) setting keys. Unknown keys are ignored server-side. */
-  async setConfig(values, scoped) {
-    await this.http.request("PUT", "/config", {
-      query: this.agentParam(scoped),
-      body: values
-    });
-  }
-  // ---- chats & history -----------------------------------------------------
-  /** `GET /chats` — recorded chats (newest first), shared across agents. */
-  chats() {
-    return this.http.request("GET", "/chats");
-  }
-  /**
-   * `PUT /chats/{id}` — rename a chat. The user title wins over the agent's native auto-title in
-   * every listing; an empty title clears the rename (reverting to the native/derived title).
-   * Returns the updated summary.
-   */
-  renameChat(chatId, title) {
-    return this.http.request("PUT", `/chats/${encodeURIComponent(chatId)}`, {
-      body: { title }
-    });
-  }
-  /**
-   * `DELETE /chats/{id}` — a true, irreversible delete: purges ALL of the chat's mindwire
-   * bookkeeping and, for every session the chat mapped to, removes that agent's native transcript
-   * (the source of truth). Rejects with a 409 error if a turn is live. Native deletion is
-   * best-effort per agent; the result reports what was purged vs. failed.
-   */
-  deleteChat(chatId) {
-    return this.http.request("DELETE", `/chats/${encodeURIComponent(chatId)}`);
-  }
-  /**
-   * `POST /chats/{id}/fork` — clone a chat into a new id (generated when `newChatId` is omitted).
-   * The fork shares the source's native session until its first turn, which branches it (natively
-   * on Claude via `--fork-session`; a fresh session on agents without native fork). Rejects with a
-   * 409 if the source has a live turn, 404 if the source is unknown, 400 if the target id is in
-   * use. Returns the new chat's summary.
-   */
-  forkChat(chatId, opts = {}) {
-    return this.http.request("POST", `/chats/${encodeURIComponent(chatId)}/fork`, {
-      body: opts.newChatId ? { newChatId: opts.newChatId } : {}
-    });
-  }
-  /**
-   * `GET /chats/{id}/messages` — a chat's transcript (native when the agent supports it, else
-   * the recorded fallback). `limit` caps to the newest N; `before` pages older history.
-   */
-  messages(chatId, opts = {}) {
-    const query = { ...this.agentParam(opts) };
-    if (opts.limit !== void 0) query["limit"] = opts.limit;
-    if (opts.before !== void 0) query["before"] = opts.before;
-    return this.http.request("GET", `/chats/${encodeURIComponent(chatId)}/messages`, {
-      query
-    });
-  }
-  /** `GET /chats/{id}/run` — the latest run for a chat (reattach anchor), or `null` if none yet. */
-  async latestRun(chatId) {
-    const data = await this.http.request(
-      "GET",
-      `/chats/${encodeURIComponent(chatId)}/run`
-    );
-    return data ? new Run(this.http, data) : null;
-  }
-  // ---- turns & runs --------------------------------------------------------
-  /**
-   * `POST /turns` — start a turn. Returns a {@link Run} handle you can stream, cancel, or await.
-   * Rejects with an {@link ApiError} (409) if a turn is already running for the chat.
-   *
-   * `mode` defaults to `"turn"` — one agent turn that ends when the CLI settles. Pass
-   * `mode: "resolve"` (with optional {@link ResolveOptions} `resolve` caps) for a global-resolve run
-   * that auto-continues the agent's multi-step work until it's done; {@link Mindwire.resolve} is the
-   * clearer entry point for that. The returned {@link Run} is then the parent of the run tree.
-   */
-  async turn(input) {
-    const body = {
-      chatId: input.chatId,
-      message: input.message
-    };
-    if (input.cwd !== void 0) body.cwd = input.cwd;
-    if (input.options !== void 0) body.options = input.options;
-    if (input.mode !== void 0) body.mode = input.mode;
-    if (input.resolve !== void 0) body.resolve = input.resolve;
-    if (input.gitAuth !== void 0) body.gitAuth = input.gitAuth;
-    const data = await this.http.request("POST", "/turns", {
-      query: this.agentParam(input),
-      body
-    });
-    return new Run(this.http, data);
-  }
-  /**
-   * `POST /turns {mode:"resolve"}` — start a **global-resolve** run: instead of returning after one
-   * turn, the daemon holds the task open and auto-continues the agent (resuming on continuable stops
-   * and probing for completion) until the work is globally resolved, then aggregates one final result.
-   *
-   * The returned {@link Run} is the **parent** of a run tree: each auto-continued iteration is a child
-   * turn ({@link Run.children}) whose events stream onto the parent's topic, delimited by `continuation`
-   * boundary events. `run.wait()` resolves once with the aggregated result; `run.stopReason` /
-   * `run.iterations` report how the loop ended. Resolve turns run unattended (no mid-turn approvals)
-   * and are bounded by {@link ResolveOptions} caps — see the resolve guide. Rejects with an
-   * {@link ApiError} (409) if a turn is already running for the chat.
-   */
-  async resolve(input) {
-    return this.turn({ ...input, mode: "resolve" });
-  }
-  /** `GET /runs/{id}` — fetch an existing run as a {@link Run} handle. */
-  async run(id) {
-    const data = await this.http.request("GET", `/runs/${encodeURIComponent(id)}`);
-    return new Run(this.http, data);
-  }
-  /**
-   * `POST /chats/{id}/compact` — run an on-demand conversation compaction as a first-class {@link Run}
-   * you can stream or await. The agent folds prior context into a summary it carries forward, emitting
-   * a `compaction` event on the stream and recording the boundary in history exactly like an
-   * auto-compaction. Optional `instructions` focus the continuation summary (Claude's
-   * `/compact <instructions>`; agents that don't honor focus still compact). Rejects with an
-   * {@link ApiError}: 400 if the agent doesn't support compaction (`capabilities.compactNow`) or the
-   * chat has no conversation yet, 409 if a turn is already running for the chat.
-   */
-  async compact(chatId, opts = {}) {
-    const data = await this.http.request(
-      "POST",
-      `/chats/${encodeURIComponent(chatId)}/compact`,
-      {
-        query: this.agentParam(opts),
-        body: opts.instructions ? { instructions: opts.instructions } : {}
-      }
-    );
-    return new Run(this.http, data);
-  }
-  // ---- notifications -------------------------------------------------------
-  /** `GET /notify/config` — whether a notification channel is wired (token never returned). */
-  getNotifyConfig() {
-    return this.http.request("GET", "/notify/config");
-  }
-  /** `PUT /notify/config` — store the provisioned notification channel (daemon-wide). */
-  async setNotifyConfig(input) {
-    await this.http.request("PUT", "/notify/config", { body: input });
-  }
-  /** `GET /notify/stream` — SSE feed of the daemon's notifications (replay, then live). */
-  async *notifications(opts = {}) {
-    const res = await this.http.open("GET", "/notify/stream", {
-      ...opts.signal ? { signal: opts.signal } : {}
-    });
-    yield* readSSE(res.body, opts.signal);
-  }
-  // ---- live resources ------------------------------------------------------
-  /**
-   * `GET /processes/stream` — SSE feed of live per-turn CPU/memory, one {@link ProcessFrame} per tick.
-   * Sampling is **on demand**: the daemon starts measuring only while a client is connected and stops
-   * the instant the last one disconnects, so aborting the `signal` (or ending the loop) tells the
-   * daemon to stop — no background work, no leak. Pass `agent` to filter each frame's samples to one
-   * agent type. Frames are live snapshots (no replay); an empty `samples` array is a valid keep-alive.
-   */
-  async *processes(opts = {}) {
-    const path4 = "/processes/stream" + (opts.agent ? `?agent=${encodeURIComponent(opts.agent)}` : "");
-    const res = await this.http.open("GET", path4, {
-      ...opts.signal ? { signal: opts.signal } : {}
-    });
-    yield* readSSE(res.body, opts.signal);
-  }
-};
-var AuthApi = class {
-  constructor(mw) {
-    this.mw = mw;
-  }
-  mw;
-  /** `GET /auth/methods` — the options list to present. */
-  methods(scoped) {
-    return this.mw.http.request("GET", "/auth/methods", {
-      query: this.mw.agentParam(scoped)
-    });
-  }
-  /** `POST /auth/begin` — start one method (may return `{ url, code, fields, pending }`). */
-  begin(method, scoped) {
-    return this.mw.http.request("POST", "/auth/begin", {
-      query: this.mw.agentParam(scoped),
-      body: { method }
-    });
-  }
-  /** `POST /auth/step` — submit fields, or poll an interactive login to completion. */
-  step(input, scoped) {
-    return this.mw.http.request("POST", "/auth/step", {
-      query: this.mw.agentParam(scoped),
-      body: input
-    });
-  }
-  /** Read one interactive attempt, scoped by the returned AuthState.flowId. */
-  poll(flowId, scoped) {
-    return this.step({ _flowId: flowId }, scoped);
-  }
-  /** Cancel this native login without affecting a newer sign-in attempt. */
-  cancel(flowId, scoped) {
-    return this.step({ _flowId: flowId, _action: "cancel" }, scoped);
-  }
-  /** `GET /auth/status` — is the agent authenticated, and via which method. */
-  status(scoped) {
-    return this.mw.http.request("GET", "/auth/status", {
-      query: this.mw.agentParam(scoped)
-    });
-  }
-  /** `POST /auth/logout` — disconnect this harness once its running chats finish. */
-  logout(scoped) {
-    return this.mw.http.request("POST", "/auth/logout", {
-      query: this.mw.agentParam(scoped)
-    });
-  }
-};
-var PromptsApi = class {
-  constructor(mw) {
-    this.mw = mw;
-  }
-  mw;
-  query(scoped, extra) {
-    return { ...this.mw.agentParam(scoped), ...extra };
-  }
-  /**
-   * `GET /memory` — the agent's memory file at every supported scope (project + user for both
-   * Claude and Codex). Each entry carries the resolved `path` and `exists`; `content` is `""` for
-   * an absent file.
-   */
-  memory(opts = {}) {
-    return this.mw.http.request("GET", "/memory", {
-      query: this.query(opts, { dir: opts.dir })
-    });
-  }
-  /** `PUT /memory` — write the memory file at `scope`. Returns the resulting {@link MemoryDoc}. */
-  setMemory(input, opts = {}) {
-    return this.mw.http.request("PUT", "/memory", {
-      query: this.query(opts, { dir: opts.dir }),
-      body: input
-    });
-  }
-  /**
-   * `DELETE /memory` — remove the memory file at `scope` (defaults to `user`). Returns the resulting
-   * {@link MemoryDoc} (`exists: false` at the resolved path). Idempotent: deleting an absent file still
-   * succeeds.
-   */
-  deleteMemory(opts = {}) {
-    return this.mw.http.request("DELETE", "/memory", {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
-    });
-  }
-  /**
-   * `GET /prompts` — saved prompt templates across every supported scope (Claude: project + user;
-   * Codex: user only). `content` is omitted here; fetch it with {@link get}. A missing project
-   * directory yields an empty list for that scope rather than an error.
-   */
-  list(opts = {}) {
-    return this.mw.http.request("GET", "/prompts", {
-      query: this.query(opts, { dir: opts.dir })
-    });
-  }
-  /** `GET /prompts/{name}` — one template's full body. Rejects with a 404 `ApiError` if absent. */
-  get(name, opts = {}) {
-    return this.mw.http.request("GET", `/prompts/${encodeURIComponent(name)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
-    });
-  }
-  /** `PUT /prompts/{name}` — create or overwrite a template. Returns the resulting {@link PromptTemplate}. */
-  set(name, content, opts = {}) {
-    return this.mw.http.request("PUT", `/prompts/${encodeURIComponent(name)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir }),
-      body: { content }
-    });
-  }
-  /**
-   * `DELETE /prompts/{name}` — remove one template at `scope` (defaults to `user`). Idempotent:
-   * deleting an absent template still succeeds. A traversal name rejects with a 400 `ApiError`.
-   */
-  async delete(name, opts = {}) {
-    await this.mw.http.request("DELETE", `/prompts/${encodeURIComponent(name)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
-    });
-  }
-  /**
-   * `GET /subagents` — persistent subagent definitions (Claude `.claude/agents/*.md`) across every
-   * supported scope. `content` is omitted here (fetch it with {@link subagent}); `meta` is the parsed
-   * frontmatter view. Rejects with a 400 `ApiError` on an agent without the subagent-definition module.
-   * Distinct from a turn's per-turn `subagents` passthrough — this is the on-disk definition store.
-   */
-  subagents(opts = {}) {
-    return this.mw.http.request("GET", "/subagents", {
-      query: this.query(opts, { dir: opts.dir })
-    });
-  }
-  /** `GET /subagents/{name}` — one definition's raw body + parsed meta. 404 `ApiError` if absent. */
-  subagent(name, opts = {}) {
-    return this.mw.http.request("GET", `/subagents/${encodeURIComponent(name)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
-    });
-  }
-  /** `PUT /subagents/{name}` — create or overwrite a definition (raw content is canonical). Returns it. */
-  setSubagent(name, content, opts = {}) {
-    return this.mw.http.request("PUT", `/subagents/${encodeURIComponent(name)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir }),
-      body: { content }
-    });
-  }
-  /**
-   * `DELETE /subagents/{name}` — remove one definition at `scope` (defaults to `user`). Idempotent:
-   * deleting an absent definition still succeeds. A traversal name rejects with a 400 `ApiError`.
-   */
-  async deleteSubagent(name, opts = {}) {
-    await this.mw.http.request("DELETE", `/subagents/${encodeURIComponent(name)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
-    });
-  }
-};
-var McpApi = class {
-  constructor(mw) {
-    this.mw = mw;
-  }
-  mw;
-  query(scoped, extra) {
-    return { ...this.mw.agentParam(scoped), ...extra };
-  }
-  /**
-   * `GET /mcp` — every persistent MCP server across the agent's supported scopes, keyed
-   * `scope → name → server` (Claude: project + user; Codex: user only). A missing config file yields
-   * an empty object for that scope rather than an error.
-   */
-  list(opts = {}) {
-    return this.mw.http.request("GET", "/mcp", {
-      query: this.query(opts, { dir: opts.dir })
-    });
-  }
-  /** `GET /mcp/{name}` — one server's definition. Rejects with a 404 `ApiError` if it isn't configured. */
-  get(name, opts = {}) {
-    return this.mw.http.request("GET", `/mcp/${encodeURIComponent(name)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
-    });
-  }
-  /** `PUT /mcp/{name}` — create or overwrite one server. Returns the stored definition. */
-  set(name, server, opts = {}) {
-    return this.mw.http.request("PUT", `/mcp/${encodeURIComponent(name)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir }),
-      body: server
-    });
-  }
-  /** `DELETE /mcp/{name}` — remove one server. Idempotent: deleting an absent server still succeeds. */
-  async delete(name, opts = {}) {
-    await this.mw.http.request("DELETE", `/mcp/${encodeURIComponent(name)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
-    });
-  }
-};
-var ProvidersApi = class {
-  constructor(mw) {
-    this.mw = mw;
-  }
-  mw;
-  query(scoped, extra) {
-    return { ...this.mw.agentParam(scoped), ...extra };
-  }
-  /**
-   * `GET /providers` — every registered custom provider across the agent's supported scopes, keyed
-   * `scope → id → provider` (opencode/Codex: user only). A missing config file yields an empty object for
-   * that scope rather than an error. `hasKey` reports whether a secret is stored; the key is never returned.
-   */
-  list(opts = {}) {
-    return this.mw.http.request("GET", "/providers", {
-      query: this.query(opts, { dir: opts.dir })
-    });
-  }
-  /** `GET /providers/{id}` — one provider's definition. Rejects with a 404 `ApiError` if it isn't configured. */
-  get(id, opts = {}) {
-    return this.mw.http.request("GET", `/providers/${encodeURIComponent(id)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
-    });
-  }
-  /**
-   * `PUT /providers/{id}` — create or overwrite one provider, returning the stored definition (with
-   * `hasKey` and the stored `envVars`). Two write-only secret channels, both optional: `opts.apiKey` is a
-   * single key (custom endpoints, single-key catalog brands); `opts.secrets` is a NAME→VALUE map for a
-   * catalog provider whose entry declares MULTIPLE env vars (e.g. AWS Bedrock). Omitting both leaves any
-   * previously stored secret intact. The path `id` wins over any `id` on the provider value.
-   */
-  set(id, provider, opts = {}) {
-    return this.mw.http.request("PUT", `/providers/${encodeURIComponent(id)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir }),
-      body: { ...provider, id, apiKey: opts.apiKey, secrets: opts.secrets }
-    });
-  }
-  /** `DELETE /providers/{id}` — remove one provider and clear its stored key. Idempotent. */
-  async delete(id, opts = {}) {
-    await this.mw.http.request("DELETE", `/providers/${encodeURIComponent(id)}`, {
-      query: this.query(opts, { scope: opts.scope, dir: opts.dir })
-    });
-  }
-};
-var NotifyApi = class {
-  constructor(mw) {
-    this.mw = mw;
-  }
-  mw;
-  /** `GET /notify/channels` — every channel, masked (no secrets). */
-  channels() {
-    return this.mw.http.request("GET", "/notify/channels");
-  }
-  /** `POST /notify/channels` — create a channel (server-assigns the id). Returns it masked. */
-  createChannel(input) {
-    return this.mw.http.request("POST", "/notify/channels", { body: input });
-  }
-  /**
-   * `PUT /notify/channels/{id}` — update a channel, merge-preserving any omitted secret
-   * (`url`/`token`/`secret`). Returns the updated masked channel. 404 `ApiError` if unknown.
-   */
-  setChannel(id, input) {
-    return this.mw.http.request("PUT", `/notify/channels/${encodeURIComponent(id)}`, {
-      body: input
-    });
-  }
-  /** `DELETE /notify/channels/{id}` — remove a channel. Idempotent. */
-  async deleteChannel(id) {
-    await this.mw.http.request("DELETE", `/notify/channels/${encodeURIComponent(id)}`);
-  }
-  /**
-   * `POST /notify/channels/{id}/test` — deliver a synthetic notification to a channel. A failed
-   * delivery is DATA (`{ ok: false, error }`), not a thrown error; only an unknown id rejects (404).
-   */
-  testChannel(id) {
-    return this.mw.http.request(
-      "POST",
-      `/notify/channels/${encodeURIComponent(id)}/test`
-    );
-  }
-  /** `GET /notify/rules` — every routing rule. */
-  rules() {
-    return this.mw.http.request("GET", "/notify/rules");
-  }
-  /** `POST /notify/rules` — create a rule (server-assigns the id). Returns it. */
-  createRule(input) {
-    return this.mw.http.request("POST", "/notify/rules", { body: input });
-  }
-  /** `PUT /notify/rules/{id}` — replace a rule. Returns it. 404 `ApiError` if unknown. */
-  setRule(id, input) {
-    return this.mw.http.request("PUT", `/notify/rules/${encodeURIComponent(id)}`, {
-      body: input
-    });
-  }
-  /** `DELETE /notify/rules/{id}` — remove a rule. Idempotent. */
-  async deleteRule(id) {
-    await this.mw.http.request("DELETE", `/notify/rules/${encodeURIComponent(id)}`);
-  }
-};
-var CLOUDFLARED_VERSION = "2026.9.3";
-var execute = promisify(execFile);
-async function ensureCloudflareBinary(options = {}) {
-  const platform = options.platform ?? process.platform, arch = options.arch ?? process.arch;
-  const cpu = arch === "x64" ? "amd64" : arch === "arm64" ? "arm64" : "";
-  if (!cpu || !["darwin", "linux", "win32"].includes(platform) || platform === "win32" && cpu !== "amd64") {
-    throw new Error("Install cloudflared for this computer, or select another connection provider.");
-  }
-  const asset = `cloudflared-${platform === "win32" ? "windows" : platform}-${cpu}${platform === "darwin" ? ".tgz" : platform === "win32" ? ".exe" : ""}`;
-  const bin = path2.join(
-    options.cacheDir ?? await binaryCacheDirectory(),
-    "cloudflared",
-    CLOUDFLARED_VERSION,
-    `${platform}-${arch}`,
-    platform === "win32" ? "cloudflared.exe" : "cloudflared"
-  );
-  const cached = await cachedExecutable(bin);
-  if (cached) return cached;
-  await options.onProgress?.("Downloading the secure connection helper\u2026");
-  const request = options.fetch ?? fetch;
-  const release = await request(
-    `https://api.github.com/repos/cloudflare/cloudflared/releases/tags/${CLOUDFLARED_VERSION}`,
-    { headers: { Accept: "application/vnd.github+json" }, signal: AbortSignal.timeout(2e4) }
-  );
-  if (!release.ok) throw new Error("Couldn't download the connection helper. Retry, install cloudflared yourself, or choose another provider.");
-  const metadata = await release.json();
-  const item = metadata.assets?.find((value) => value.name === asset);
-  const checksum = item?.digest?.match(/^sha256:([a-f0-9]{64})$/i)?.[1];
-  const expectedURL = `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/${asset}`;
-  if (!checksum || item?.browser_download_url !== expectedURL) throw new Error("The connection helper has no verified release asset for this computer.");
-  const downloaded = await request(expectedURL, { signal: AbortSignal.timeout(12e4) });
-  if (!downloaded.ok) throw new Error("Couldn't download the connection helper. Check your internet connection and retry.");
-  const archive = new Uint8Array(await downloaded.arrayBuffer());
-  await verifyReleaseBytes(archive, checksum, asset);
-  let executable = archive;
-  if (platform === "darwin") {
-    const temporary = await mkdtemp(path2.join(tmpdir(), "mindwire-cloudflared-"));
-    try {
-      const archivePath = path2.join(temporary, asset);
-      await writeFile(archivePath, archive, { mode: 384 });
-      const result = await execute(
-        "/usr/bin/tar",
-        ["-xzOf", archivePath, "cloudflared"],
-        { encoding: "buffer", maxBuffer: 128 * 1024 * 1024, timeout: 3e4 }
-      );
-      executable = new Uint8Array(result.stdout);
-    } finally {
-      await rm(temporary, { recursive: true, force: true });
-    }
-  }
-  return cacheExecutable(bin, executable, await executableChecksum(executable));
-}
-async function cloudflareCommand(options) {
-  try {
-    await execute("cloudflared", ["--version"], { timeout: 3e3, windowsHide: true });
-    return "cloudflared";
-  } catch (error) {
-    if (error.code !== "ENOENT") throw new Error("The installed cloudflared could not start. Repair it or choose another connection provider.");
-    return ensureCloudflareBinary(options);
-  }
+var enterScreen = "\x1B[?1049h\x1B[?25l";
+var leaveScreen = "\x1B[0m\x1B[?25h\x1B[?1049l";
+var clearScreen = "\x1B[H\x1B[2J";
+var scanInstruction = "Mindwire \u2192 Add computer \u2192 Scan QR code";
+async function createPairingQR(invitation) {
+  const QR = await import('qrcode');
+  const data = computerPairingQRData(invitation);
+  const options = { errorCorrectionLevel: "L", margin: 4 };
+  const { modules } = QR.create(data, options);
+  const width = modules.size + options.margin * 2;
+  const black = (x, y) => x >= 0 && y >= 0 && x < modules.size && y < modules.size && !!modules.data[y * modules.size + x];
+  const lines = [];
+  for (let y = -options.margin; y < modules.size + options.margin; y += 2) {
+    let line = "";
+    for (let x = -options.margin; x < modules.size + options.margin; x++) {
+      const top = black(x, y), bottom = black(x, y + 1);
+      line += top ? bottom ? "\u2588" : "\u2580" : bottom ? "\u2584" : " ";
+    }
+    lines.push("\x1B[30;107m" + line + "\x1B[0m");
+  }
+  const svg = await QR.toString(data, { ...options, type: "svg" });
+  return { lines, columns: Math.max(width, scanInstruction.length) + 1, rows: lines.length + 5, svg };
+}
+function escapeHTML(value) {
+  return value.replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch]);
+}
+function browserPage(invitation, svg) {
+  const reconnect = "mode" in invitation && invitation.mode === "reconnect";
+  const title = reconnect ? "Reconnect your phone" : "Connect your phone";
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'; form-action 'none'">
+<title>${title} \xB7 Mindwire</title>
+<style>
+*{box-sizing:border-box}body{margin:0;background:#141416;color:#f5f5f7;font:16px/1.5 system-ui,sans-serif}
+main{width:min(100% - 40px,520px);margin:32px auto;text-align:center}small{color:#a6a6af;letter-spacing:.16em}
+h1{font-size:28px;letter-spacing:-.04em;line-height:1.2;margin:16px 0 6px}p{color:#b7b7bf;margin:8px 0;overflow-wrap:anywhere}
+.code{width:min(100%,480px);margin:24px auto 16px;background:#fff;border-radius:16px;padding:8px}
+svg{display:block;width:100%;height:auto}.steps{margin:20px 0}.steps p{color:#e1e1e6}
+button{font:inherit;font-weight:600;color:#f5f5f7;border:1px solid #45454b;background:#252528;border-radius:10px;padding:10px 18px;cursor:pointer}
+button:disabled{opacity:.45;cursor:default}button:focus-visible{outline:3px solid #a4b8ef;outline-offset:3px}
+textarea{width:100%;margin-top:12px;padding:8px;color:inherit;background:#252528;border:1px solid #45454b;border-radius:8px}
+[hidden]{display:none!important}#expiry{font-size:14px}footer{font-size:13px;color:#93939d;margin:18px 0}
+</style></head><body><main>
+<small>MINDWIRE</small><h1>${title}</h1><p>${escapeHTML(invitation.name)}</p>
+<div class="code" id="code" role="img" aria-label="Mindwire connection QR code">${svg}</div>
+<p id="expiry" data-expires="${escapeHTML(invitation.expiresAt)}" aria-live="off"></p>
+<div class="steps"><p>In Mindwire, open <strong>Add computer</strong> and scan.</p>
+<p>${reconnect ? "Your saved pairing and workspace stay the same. No new approval is needed." : "Then return to the terminal to approve your phone."}</p></div>
+<button type="button" id="copy">Copy ${reconnect ? "reconnect" : "pairing"} link</button>
+<textarea id="link" readonly hidden aria-label="Pairing link">${escapeHTML(computerPairingURI(invitation))}</textarea>
+<footer>You can close this page after ${reconnect ? "reconnecting" : "pairing"}.</footer>
+</main><script>
+const expiry=document.getElementById('expiry'),code=document.getElementById('code'),copy=document.getElementById('copy'),link=document.getElementById('link');
+function tick(){const seconds=Math.max(0,Math.ceil((Date.parse(expiry.dataset.expires)-Date.now())/1000));
+if(!seconds){code.remove();copy.disabled=true;link.value='';link.hidden=true;expiry.textContent='Code expired. Run mindwire ${reconnect ? "reconnect" : "connect pair"} for a new code.';return;}
+expiry.textContent='Expires in '+Math.floor(seconds/60)+':'+String(seconds%60).padStart(2,'0');}
+tick();setInterval(tick,1000);
+copy.addEventListener('click',async()=>{try{await navigator.clipboard.writeText(link.value);copy.textContent='Copied';}
+catch{link.hidden=false;link.focus();link.select();copy.textContent='Select and copy the link';}});
+</script></body></html>`;
+}
+async function openBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32.exe", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+  return new Promise((resolve2) => {
+    const child = spawn(command, args, { stdio: "ignore", windowsHide: true });
+    const finish = (ok) => {
+      clearTimeout(timer);
+      resolve2(ok);
+    };
+    const timer = setTimeout(() => {
+      child.kill();
+      finish(false);
+    }, 5e3);
+    child.once("error", () => finish(false));
+    child.once("exit", (code) => finish(code === 0));
+  });
 }
+async function showPairingInvitation(invitation, options = {}) {
+  const reconnect = "mode" in invitation && invitation.mode === "reconnect";
+  const nextStep = reconnect ? "Scan with a saved phone, then press Enter here." : "Return here to approve your phone.";
+  const waiting = reconnect ? "Your saved pairing stays the same." : "Waiting for your phone\u2026";
+  const command = reconnect ? "mindwire reconnect" : "mindwire connect pair";
+  const output = options.output ?? process.stdout;
+  const environment = options.environment ?? process.env;
+  const mode = options.mode ?? "auto";
+  const interactive = !!output.isTTY && environment.TERM !== "dumb";
+  const linkOnly = mode === "none" || !interactive && mode !== "browser";
+  if (linkOnly) {
+    output.write(`Paste this link in Mindwire \u2192 Add computer (expires in 5 minutes):
+${computerPairingURI(invitation)}
 
-// src/computer/relay.ts
-function websocketURL(value) {
-  const url = new URL(value);
-  if (url.protocol === "https:") url.protocol = "wss:";
-  if (url.protocol !== "wss:" || !url.hostname || url.username || url.password || url.hash) {
-    throw new Error("Relay URLs must use wss:// with no embedded credentials or fragment.");
-  }
-  if (!url.pathname || url.pathname === "/") url.pathname = "/ssh";
-  return url.toString();
-}
-async function startRelay(options, port, runtime = {}) {
-  if (options.kind === "none") return { close() {
-  } };
-  if (options.kind === "custom") {
-    if (!options.url) throw new Error("A custom relay needs --relay-url wss://your-host/ssh.");
-    return { route: { kind: "websocket", url: websocketURL(options.url) }, close() {
+${waiting}
+`);
+    return { close() {
     } };
   }
-  const origin = `http://127.0.0.1:${port}`;
-  const env = { ...process.env };
-  let command, args;
-  if (options.kind === "cloudflare") {
-    command = await cloudflareCommand(runtime);
-    await runtime.onProgress?.("Connecting through Cloudflare\u2026");
-    if (options.cloudflareTokenFile) {
-      if (!options.url) throw new Error("A named Cloudflare tunnel needs --relay-url for its configured hostname.");
-      env.TUNNEL_TOKEN = (await readFile(options.cloudflareTokenFile, "utf8")).trim();
-      args = ["tunnel", "--no-autoupdate", "run"];
+  const qr = await createPairingQR(invitation);
+  const useScreen = interactive && mode !== "browser";
+  let closed = false, pageDirectory;
+  let browser = "idle";
+  let pageURL;
+  let browserAttempt;
+  const fits = () => (output.columns ?? 0) >= qr.columns && (output.rows ?? 0) >= qr.rows;
+  const draw = () => {
+    if (closed || !useScreen) return;
+    let lines;
+    if (fits()) {
+      lines = [scanInstruction, "", ...qr.lines, "", waiting];
     } else {
-      if (options.url) throw new Error("Use --cloudflare-token-file with a named tunnel, or --relay custom for an existing tunnel.");
-      args = ["tunnel", "--no-autoupdate", "--url", origin];
+      const size = `Terminal QR needs ${qr.columns} columns \xD7 ${qr.rows} rows.`;
+      lines = browser === "opened" ? ["QR opened in your browser.", scanInstruction, nextStep] : browser === "opening" ? ["Opening a resizable QR in your browser\u2026", nextStep] : browser === "failed" ? ["Couldn't open a browser here.", size, "Enlarge this terminal, or run:", `${command} --no-qr`] : [size, "Enlarge this terminal, or use --qr browser."];
+      lines = lines.map((line) => line.slice(0, Math.max(0, (output.columns ?? 80) - 1))).slice(0, Math.max(0, (output.rows ?? 24) - 1));
     }
-  } else {
-    command = "ngrok";
-    args = ["http", origin, "--log", "stdout", "--log-format", "json"];
-    if (options.url) {
-      const url = new URL(websocketURL(options.url));
-      args.push("--url", `https://${url.host}`);
+    output.write(clearScreen + lines.join("\r\n"));
+  };
+  const ensureBrowser = () => {
+    if (browserAttempt) return browserAttempt;
+    browser = "opening";
+    draw();
+    browserAttempt = (async () => {
+      try {
+        pageDirectory = mkdtempSync(join(tmpdir(), "mindwire-pair-"));
+        chmodSync(pageDirectory, 448);
+        const file = join(pageDirectory, "pair.html");
+        writeFileSync(file, browserPage(invitation, qr.svg), { mode: 384 });
+        pageURL = pathToFileURL(file).href;
+        const remoteShell = !!(environment.SSH_CONNECTION || environment.SSH_CLIENT || environment.SSH_TTY);
+        const opened = (mode === "browser" || !remoteShell) && await (options.openBrowser ?? openBrowser)(pageURL);
+        browser = opened ? "opened" : "failed";
+      } catch {
+        browser = "failed";
+      }
+      if (closed) return;
+      if (useScreen) draw();
+      else output.write(browser === "opened" ? `QR opened in your browser.
+${scanInstruction}
+${nextStep}
+` : `Open this local QR page in a browser:
+${pageURL ?? `Page unavailable. Run ${command} --no-qr for a link.`}
+
+${waiting}
+`);
+    })();
+    return browserAttempt;
+  };
+  const resize = () => {
+    draw();
+    if (!closed && mode === "auto" && !fits()) void ensureBrowser();
+  };
+  const close = () => {
+    if (closed) return;
+    closed = true;
+    output.off("resize", resize);
+    process.off("exit", close);
+    process.off("SIGINT", interrupt);
+    process.off("SIGTERM", terminate);
+    process.off("SIGHUP", hangup);
+    if (useScreen) output.write(leaveScreen);
+    if (pageDirectory) {
+      try {
+        rmSync(pageDirectory, { recursive: true, force: true });
+      } catch {
+      }
     }
+  };
+  const interrupt = () => {
+    close();
+    process.exit(130);
+  };
+  const terminate = () => {
+    close();
+    process.exit(143);
+  };
+  const hangup = () => {
+    close();
+    process.exit(129);
+  };
+  process.once("exit", close);
+  process.once("SIGINT", interrupt);
+  process.once("SIGTERM", terminate);
+  process.once("SIGHUP", hangup);
+  if (useScreen) {
+    output.write(enterScreen);
+    output.on("resize", resize);
+    draw();
   }
-  const child = spawn(command, args, { env, stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
-  let buffer = "";
   try {
-    const address = await new Promise((resolve3, reject) => {
-      const timer = setTimeout(() => {
-        cleanup();
-        reject(new Error(`${command} did not establish its tunnel. Check its account and tunnel configuration.`));
-      }, 45e3);
-      const cleanup = () => {
-        clearTimeout(timer);
-        child.off("error", fail);
-        child.off("exit", exited);
-      };
-      const fail = (error) => {
-        cleanup();
-        reject(new Error(`Could not run ${command}. Install it on the computer first.`, { cause: error }));
-      };
-      const exited = () => {
-        cleanup();
-        reject(new Error(`${command} exited before the tunnel connected. Check its account configuration.`));
-      };
-      let cloudflareAddress = options.url;
-      let cloudflareConnected = false;
-      const receive = (chunk) => {
-        const received = buffer + chunk.toString();
-        buffer = received.slice(-16384);
-        let found;
-        if (options.kind === "cloudflare") {
-          cloudflareAddress ??= received.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/)?.[0];
-          cloudflareConnected ||= /Registered tunnel connection/.test(received);
-          if (cloudflareConnected) found = cloudflareAddress;
-        } else {
-          for (const line of received.split(/\r?\n/)) {
-            try {
-              const event = JSON.parse(line);
-              if (event.msg === "started tunnel" && event.url?.startsWith("https://")) found = event.url;
-            } catch {
-            }
-          }
-        }
-        if (found) {
-          cleanup();
-          resolve3(websocketURL(found));
-        }
-      };
-      child.once("error", fail);
-      child.once("exit", exited);
-      child.stdout.on("data", receive);
-      child.stderr.on("data", receive);
-    });
-    child.stdout.removeAllListeners("data");
-    child.stderr.removeAllListeners("data");
-    child.stdout.resume();
-    child.stderr.resume();
-    child.on("error", () => {
-    });
-    return { route: { kind: "websocket", url: address }, process: child, close() {
-      child.kill();
-    } };
+    if (mode === "browser" || mode === "auto" && !fits()) await ensureBrowser();
+    return { close };
   } catch (error) {
-    child.kill();
+    close();
     throw error;
   }
 }
-
-// src/computer/lifecycle.ts
-var defaultStateDirectory = () => path2.join(homedir(), ".mindwire", "computer");
-var defaultComputerConfig = () => ({ directory: homedir(), bind: "0.0.0.0", sshPort: 8791, websocketPort: 8792, relay: { kind: "cloudflare" } });
-async function readJSON(file) {
-  try {
-    return JSON.parse(await fs.readFile(file, "utf8"));
-  } catch (error) {
-    if (error.code === "ENOENT") return void 0;
-    throw error;
+var execute = promisify(execFile);
+var xml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+var systemd = (value, expandEnvironment = false) => '"' + value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%").replace(/\$/g, () => expandEnvironment ? "$$" : "$") + '"';
+var windowsArg = (value) => '"' + value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\+)$/g, "$1$1") + '"';
+function startupPlan(options) {
+  const { directory, cliPath } = options;
+  const executable = options.executable ?? process.execPath, home = options.home ?? homedir();
+  const platform = options.platform ?? process.platform;
+  const environmentPath = options.environmentPath ?? process.env.PATH ?? path.dirname(executable);
+  for (const value of [directory, cliPath, executable, home, environmentPath]) {
+    if (/[\r\n\x00]/.test(value)) throw new Error("Startup paths cannot contain control characters.");
+  }
+  const id = createHash("sha256").update(directory).digest("hex").slice(0, 12);
+  const name = `sh.mindwire.computer.${id}`;
+  const args = [cliPath, "_watch", "--state-dir", directory];
+  if (platform === "darwin") {
+    const domain = `gui/${options.uid ?? process.getuid?.()}`;
+    const file = path.join(home, "Library", "LaunchAgents", name + ".plist");
+    return {
+      kind: "launchd",
+      name,
+      file,
+      content: `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key><string>${name}</string>
+<key>ProgramArguments</key><array>${[executable, ...args].map((v) => `<string>${xml(v)}</string>`).join("")}</array>
+<key>WorkingDirectory</key><string>${xml(home)}</string>
+<key>EnvironmentVariables</key><dict><key>PATH</key><string>${xml(environmentPath)}</string></dict>
+<key>RunAtLoad</key><true/><key>KeepAlive</key><true/>
+<key>ThrottleInterval</key><integer>10</integer>
+<key>StandardOutPath</key><string>${xml(path.join(directory, "startup.log"))}</string>
+<key>StandardErrorPath</key><string>${xml(path.join(directory, "startup.log"))}</string>
+</dict></plist>
+`,
+      query: ["launchctl", "print", `${domain}/${name}`],
+      enable: [["launchctl", "enable", `${domain}/${name}`], ["launchctl", "bootstrap", domain, file]],
+      disable: [["launchctl", "bootout", `${domain}/${name}`]]
+    };
   }
-}
-async function writeJSON(file, value) {
-  const temp = `${file}.${randomUUID()}.tmp`;
-  try {
-    await fs.writeFile(temp, JSON.stringify(value) + "\n", { mode: 384 });
-    await fs.rename(temp, file);
-  } finally {
-    await fs.rm(temp, { force: true });
+  if (platform === "linux") {
+    const file = path.join(home, ".config", "systemd", "user", name + ".service");
+    return {
+      kind: "systemd",
+      name,
+      file,
+      content: `[Unit]
+Description=Mindwire computer connection
+After=network-online.target
+[Service]
+Type=simple
+ExecStart=${[executable, ...args].map((value) => systemd(value, true)).join(" ")}
+WorkingDirectory=${systemd(home)}
+Environment=${systemd("PATH=" + environmentPath)}
+Restart=always
+RestartSec=10
+KillMode=process
+[Install]
+WantedBy=default.target
+`,
+      query: ["systemctl", "--user", "is-active", name + ".service"],
+      enable: [["systemctl", "--user", "daemon-reload"], ["systemctl", "--user", "enable", "--now", name + ".service"]],
+      disable: [["systemctl", "--user", "disable", "--now", name + ".service"], ["systemctl", "--user", "daemon-reload"]]
+    };
   }
-}
-function alive(pid) {
-  if (!pid || !Number.isSafeInteger(pid) || pid < 1) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
+  if (platform === "win32") {
+    if (!options.user) throw new Error("Couldn't determine the Windows user for startup.");
+    const file = path.join(directory, "startup-task.xml");
+    return {
+      kind: "task-scheduler",
+      name,
+      file,
+      content: `<?xml version="1.0" encoding="UTF-16"?>
+<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
+<Triggers><LogonTrigger><Enabled>true</Enabled><UserId>${xml(options.user)}</UserId></LogonTrigger></Triggers>
+<Principals><Principal id="Owner"><UserId>${xml(options.user)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>
+<Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries><StopIfGoingOnBatteries>false</StopIfGoingOnBatteries><StartWhenAvailable>true</StartWhenAvailable><ExecutionTimeLimit>PT0S</ExecutionTimeLimit><RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure></Settings>
+<Actions Context="Owner"><Exec><Command>${xml(executable)}</Command><Arguments>${xml(args.map(windowsArg).join(" "))}</Arguments><WorkingDirectory>${xml(home)}</WorkingDirectory></Exec></Actions>
+</Task>
+`,
+      query: ["schtasks.exe", "/Query", "/TN", name],
+      enable: [["schtasks.exe", "/Create", "/TN", name, "/XML", file, "/F"], ["schtasks.exe", "/Run", "/TN", name]],
+      disable: [["schtasks.exe", "/End", "/TN", name], ["schtasks.exe", "/Delete", "/TN", name, "/F"]]
+    };
   }
+  throw new Error("Automatic startup supports macOS, Linux with systemd, and Windows. Run mindwire start on this system.");
 }
-async function computerClient(directory) {
-  const runtime = await readJSON(path2.join(directory, "computer-runtime.json"));
-  if (!runtime) throw new Error("Mindwire is not running. Run mindwire connect on the computer.");
-  const url = new URL(`http://${runtime.apiAddress}`);
-  if (!["127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password) throw new Error("Invalid local Mindwire address.");
-  const token = (await fs.readFile(path2.join(directory, "daemon.token"), "utf8")).trim();
-  const client = new Mindwire({ target: remote(url.origin, { token }), requestTimeoutMs: 3e3 });
-  const info = await client.computer.info();
-  if (info.computerId !== runtime.computerId || info.pid !== runtime.pid) throw new Error("The local Mindwire process changed. Retry the command.");
-  return client;
-}
-function directRoutes(config, port) {
-  if (config.host) return [{ kind: "ssh", host: config.host, port }];
-  if (!["0.0.0.0", "::"].includes(config.bind)) return [{ kind: "ssh", host: config.bind, port }];
-  const addresses = /* @__PURE__ */ new Set();
-  for (const entries of Object.values(networkInterfaces())) {
-    for (const address of entries ?? []) if (address.family === "IPv4" && !address.internal) addresses.add(address.address);
-  }
-  return [...addresses].slice(0, 6).map((host) => ({ kind: "ssh", host, port }));
+var run = async ([command, ...args]) => {
+  await execute(command, args, { timeout: 15e3, windowsHide: true });
+};
+async function startupStatus(directory) {
+  const state = await readJSON(path.join(directory, "computer-startup.json")) ?? { enabled: false };
+  const guardian = await readJSON(path.join(directory, "computer-guardian.json"));
+  return { ...state, running: state.enabled && await processStateAlive(guardian) };
 }
-async function ensureComputer(directory, cliPath, patch = {}, onProgress) {
+async function configureStartup(directory, cliPath, enabled, runtime = {}) {
   await fs.mkdir(directory, { recursive: true, mode: 448 });
-  let current;
-  try {
-    current = await computerClient(directory);
-  } catch {
-  }
-  const configPath = path2.join(directory, "computer-config.json");
-  const previous = await readJSON(configPath);
-  const config = { ...defaultComputerConfig(), ...previous, ...patch };
-  const waitUntilReady = async () => {
-    let phase;
-    for (let attempt = 0; attempt < 1200; attempt++) {
-      const controller = await readJSON(path2.join(directory, "computer-controller.json"));
-      if (controller?.error) throw new Error(controller.error);
-      if (controller?.ready) return computerClient(directory);
-      if (controller?.phase && controller.phase !== phase) {
-        phase = controller.phase;
-        onProgress?.(phase);
-      }
-      await setTimeout$1(250);
-    }
-    throw new Error(`Mindwire did not finish starting. Inspect ${path2.join(directory, "computer.log")}.`);
-  };
-  if (current) {
-    if (Object.keys(patch).some((key) => JSON.stringify(config[key]) !== JSON.stringify(previous?.[key]))) {
-      throw new Error("Mindwire is running with different connection settings. Run mindwire stop when idle, then retry with the new settings.");
-    }
-    return waitUntilReady();
-  }
-  const lockPath = path2.join(directory, "launch.lock");
-  let lock;
-  for (let attempt = 0; attempt < 120; attempt++) {
-    try {
-      lock = await fs.open(lockPath, "wx", 384);
-      await lock.writeFile(String(process.pid));
-      break;
-    } catch (error) {
-      if (error.code !== "EEXIST") throw error;
-      const owner = Number(await fs.readFile(lockPath, "utf8").catch(() => ""));
-      const age = Date.now() - (await fs.stat(lockPath).catch(() => ({ mtimeMs: Date.now() }))).mtimeMs;
-      if (age > 5e3 && !alive(owner)) {
-        await fs.rm(lockPath, { force: true });
-        continue;
-      }
-      const controller = await readJSON(path2.join(directory, "computer-controller.json"));
-      if (alive(controller?.pid)) {
-        const saved = await readJSON(configPath);
-        if (Object.keys(patch).some((key) => JSON.stringify(patch[key]) !== JSON.stringify(saved?.[key]))) {
-          throw new Error("Another start used different connection settings. Stop Mindwire when idle before changing them.");
-        }
-        return waitUntilReady();
-      }
-      await setTimeout$1(250);
-    }
-  }
-  if (!lock) throw new Error("Another Mindwire start is in progress. Try again shortly.");
+  const lockPath = path.join(directory, "startup.lock");
+  const lock = await acquireProcessLock(lockPath);
+  if (!lock) throw new Error("Startup is already being configured. Try again shortly.");
   try {
-    let existing;
+    const user = process.platform === "win32" && !runtime.plan ? (await execute("whoami.exe", [], { timeout: 3e3, windowsHide: true })).stdout.trim() : void 0;
+    const plan = runtime.plan ?? startupPlan({ directory, cliPath, user });
+    const command = runtime.run ?? run;
+    let loaded = false;
     try {
-      existing = await computerClient(directory);
+      await command(plan.query);
+      loaded = true;
     } catch {
     }
-    if (existing) {
-      const saved = await readJSON(configPath);
-      if (Object.keys(patch).some((key) => JSON.stringify(patch[key]) !== JSON.stringify(saved?.[key]))) {
-        throw new Error("Another start used different connection settings. Stop Mindwire when idle before changing them.");
+    if (enabled) {
+      const previous = await fs.readFile(plan.file, plan.kind === "task-scheduler" ? "utf16le" : "utf8").catch(() => "");
+      const changed = previous !== plan.content;
+      if (changed) {
+        await fs.mkdir(path.dirname(plan.file), { recursive: true, mode: 448 });
+        const temporary = plan.file + `.tmp-${process.pid}`;
+        try {
+          await fs.writeFile(temporary, plan.content, { mode: 384, encoding: plan.kind === "task-scheduler" ? "utf16le" : "utf8" });
+          await fs.rename(temporary, plan.file);
+        } finally {
+          await fs.rm(temporary, { force: true });
+        }
+      }
+      if (!loaded || changed && plan.kind !== "launchd") {
+        for (const action of plan.enable) await command(action);
+      }
+      await command(plan.query);
+      if (runtime.verify) await runtime.verify();
+      else {
+        let running = false;
+        for (let attempt = 0; attempt < 60; attempt++) {
+          const guardian = await readJSON(path.join(directory, "computer-guardian.json"));
+          if (await processStateAlive(guardian)) {
+            running = true;
+            break;
+          }
+          await setTimeout$1(250);
+        }
+        if (!running) throw new Error(`Automatic startup was registered but its guardian didn't start. Inspect ${path.join(directory, "startup.log")}.`);
       }
-      return waitUntilReady();
-    }
-    const controller = await readJSON(path2.join(directory, "computer-controller.json"));
-    if (alive(controller?.pid)) {
-      if (controller?.error) throw new Error(controller.error);
     } else {
-      await writeJSON(configPath, config);
-      await fs.rm(path2.join(directory, "computer-controller.json"), { force: true });
-      const log = await fs.open(path2.join(directory, "computer.log"), "a", 384);
-      try {
-        const child = spawn(process.execPath, [cliPath, "_serve", "--state-dir", directory], {
-          detached: true,
-          stdio: ["ignore", log.fd, log.fd],
-          windowsHide: true
-        });
-        await new Promise((resolve3, reject) => {
-          child.once("spawn", resolve3);
-          child.once("error", reject);
-        });
-        child.unref();
-      } finally {
-        await log.close();
+      if (loaded || await fs.stat(plan.file).then(() => true, () => false)) {
+        for (const action of plan.disable) {
+          try {
+            await command(action);
+          } catch (error) {
+            if (action.includes("/End") || action.includes("bootout") && !loaded) continue;
+            throw error;
+          }
+        }
       }
+      await fs.rm(plan.file, { force: true });
     }
-    return await waitUntilReady();
+    const state = { enabled, kind: plan.kind, name: plan.name, file: plan.file };
+    await writeJSON(path.join(directory, "computer-startup.json"), state);
+    return { ...state, running: enabled };
   } finally {
     await lock.close();
-    await fs.rm(lockPath, { force: true });
-  }
-}
-async function terminate(child) {
-  if (child.exitCode !== null || child.signalCode !== null) return;
-  const exited = new Promise((resolve3) => child.once("exit", () => resolve3()));
-  child.kill("SIGTERM");
-  const timer = setTimeout(() => child.kill("SIGKILL"), 15e3);
-  try {
-    await exited;
-  } finally {
-    clearTimeout(timer);
   }
 }
-async function superviseComputer(directory) {
-  let config = await readJSON(path2.join(directory, "computer-config.json"));
-  if (!config) throw new Error("Computer configuration is missing.");
-  const controllerPath = path2.join(directory, "computer-controller.json");
-  const previous = await readJSON(controllerPath);
-  if (alive(previous?.pid)) throw new Error("The computer already has a service controller.");
-  const phase = (message) => writeJSON(controllerPath, { pid: process.pid, ready: false, phase: message });
-  await phase("Preparing Mindwire\u2026");
-  let child, relay, stopping = false;
+async function watchComputer(directory, cliPath) {
+  let stopping = false;
+  const abort = new AbortController();
   const stop = () => {
     stopping = true;
+    abort.abort();
   };
   process.on("SIGTERM", stop);
   process.on("SIGINT", stop);
-  let token;
-  try {
-    token = (await fs.readFile(path2.join(directory, "daemon.token"), "utf8")).trim();
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-    token = randomBytes(32).toString("hex");
-    await fs.writeFile(path2.join(directory, "daemon.token"), token, { mode: 384, flag: "wx" });
-  }
-  const daemonEnv = { ...process.env };
-  if (process.platform === "win32") {
-    try {
-      const git = execFileSync("where.exe", ["git"], { encoding: "utf8", timeout: 3e3, windowsHide: true }).split(/\r?\n/)[0];
-      if (git) {
-        const shellDirectory = path2.resolve(path2.dirname(git), "..", "bin");
-        await fs.access(path2.join(shellDirectory, "bash.exe"));
-        const pathKey = Object.keys(daemonEnv).find((key) => key.toLowerCase() === "path") ?? "PATH";
-        daemonEnv[pathKey] = `${shellDirectory}${path2.delimiter}${daemonEnv[pathKey] ?? ""}`;
-      }
-    } catch {
-    }
-  }
-  let sshPort = config.sshPort, websocketPort = config.websocketPort;
-  const launch = async (binary) => {
-    await fs.rm(path2.join(directory, "computer-runtime.json"), { force: true });
-    child = spawn(binary, ["--computer"], {
-      cwd: config.directory,
-      stdio: ["ignore", "inherit", "inherit"],
-      windowsHide: true,
-      env: {
-        ...daemonEnv,
-        DAEMON_TOKEN: token,
-        ADDR: "127.0.0.1:0",
-        STATE_PATH: path2.join(directory, "agent-state.json"),
-        WORKSPACE_DB_PATH: path2.join(directory, "workspace.db"),
-        AGENT_CWD: config.directory,
-        COMPUTER_SSH_ADDR: `${config.bind.includes(":") ? `[${config.bind}]` : config.bind}:${sshPort}`,
-        COMPUTER_WS_ADDR: `127.0.0.1:${websocketPort}`,
-        MINDWIRE_COMPUTER_MANAGED: "1"
-      }
-    });
-    let failure;
-    child.on("error", (error) => {
-      failure = error;
-    });
-    for (let attempt = 0; attempt < 100; attempt++) {
-      if (failure) throw failure;
-      if (child.exitCode !== null || child.signalCode !== null) throw new Error("Mindwire exited during startup. Check computer.log; the downloaded release must support computer connections.");
-      try {
-        const client = await computerClient(directory);
-        const health = await client.health();
-        if (health.computerConnectionVersion !== 1) throw new Error("This daemon release does not support computer connections. Update Mindwire.");
-        return client;
-      } catch (error) {
-        if (attempt === 99) throw error;
-      }
-      await setTimeout$1(100);
-    }
-    throw new Error("Mindwire startup timed out.");
-  };
-  let routes = [];
+  let reportedError = "";
+  const guardianPath = path.join(directory, "computer-guardian.json");
   try {
-    await phase("Checking the Mindwire service\u2026");
-    let binary = config.daemonBin ?? await ensureDaemonBinary({ version: config.version ?? SDK_VERSION, cacheDir: process.env.MINDWIRE_RELEASE_CACHE_DIR });
-    await phase("Starting the Mindwire service\u2026");
-    let client = await launch(binary);
-    const info = await client.computer.info();
-    sshPort = info.sshPort;
-    websocketPort = info.websocketPort;
-    await phase(config.relay.kind === "none" ? "Preparing direct SSH\u2026" : "Preparing your internet connection\u2026");
-    relay = await startRelay(config.relay, info.websocketPort, { cacheDir: path2.join(directory, "tools"), onProgress: phase });
-    routes = directRoutes(config, info.sshPort);
-    if (relay.route) routes.push(relay.route);
-    if (routes.length === 0) throw new Error("No network address is available. Use --host with your LAN/VPN address or choose a relay.");
-    await client.computer.setRoutes(routes);
-    await writeJSON(controllerPath, { pid: process.pid, ready: true, routes });
+    await writeJSON(guardianPath, await currentProcessIdentity());
     while (!stopping) {
-      await setTimeout$1(500);
-      if (child.exitCode !== null || child.signalCode !== null) throw new Error("The Mindwire service stopped. Run mindwire start to reconnect.");
-      if (relay.process && (relay.process.exitCode !== null || relay.process.signalCode !== null)) {
-        routes = routes.filter((r) => r.kind === "ssh");
-        if (routes.length > 0) await client.computer.setRoutes(routes);
-        await writeJSON(controllerPath, { pid: process.pid, ready: true, routes, error: "The relay disconnected. Direct SSH still works. Restart Mindwire when idle to reconnect the relay." });
-        relay = { close() {
-        } };
-      }
-      const updatePath = path2.join(directory, "computer-update.json");
-      const update = await readJSON(updatePath);
-      if (!update || !["queued", "downloading", "waiting", "restarting"].includes(update.status)) continue;
-      const status = async (state, error) => writeJSON(updatePath, { ...update, status: state, error, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
-      try {
-        await status("downloading");
-        const replacement = await ensureDaemonBinary({ version: update.version, cacheDir: process.env.MINDWIRE_RELEASE_CACHE_DIR });
-        await status("waiting");
-        let lease;
-        while (!stopping && !lease) {
-          try {
-            lease = await client.service.acquireUpdate();
-          } catch (error) {
-            if (error.status !== 409) throw error;
-            await setTimeout$1(2e3);
-          }
-        }
-        if (stopping || !lease) break;
-        if (lease.pid !== child.pid) {
-          await client.service.releaseUpdate(lease.id);
-          throw new Error("The leased service process changed.");
-        }
-        await status("restarting");
-        await terminate(child);
+      const paused = await readJSON(path.join(directory, "computer-stopped.json"));
+      const controller = await readJSON(path.join(directory, "computer-controller.json"));
+      if (!paused?.stopped && !await processStateAlive(controller)) {
         try {
-          client = await launch(replacement);
-          await client.computer.setRoutes(routes);
-          const health = await client.health();
-          if (health.version.replace(/^v/, "") !== update.version) throw new Error("The replacement service reports a different release version.");
+          await ensureComputer(directory, cliPath, {}, void 0, { resume: false, signal: abort.signal });
+          reportedError = "";
         } catch (error) {
-          if (child) await terminate(child);
-          client = await launch(binary);
-          await client.computer.setRoutes(routes);
-          throw error;
+          if (stopping) break;
+          const message = error instanceof Error ? error.message : "Computer recovery failed.";
+          if (message !== reportedError) {
+            process.stderr.write(`Mindwire recovery: ${message}
+`);
+            reportedError = message;
+          }
         }
-        binary = replacement;
-        config = { ...config, daemonBin: void 0, version: update.version };
-        await writeJSON(path2.join(directory, "computer-config.json"), config);
-        await status("complete");
-      } catch (error) {
-        await status("failed", error instanceof Error ? error.message : "Service update failed.");
       }
+      for (let tick = 0; tick < 10 && !stopping; tick++) await setTimeout$1(500);
     }
-  } catch (error) {
-    await writeJSON(controllerPath, { pid: process.pid, ready: false, error: error instanceof Error ? error.message : "Computer service failed." });
-    throw error;
   } finally {
-    relay?.close();
-    if (child) await terminate(child);
+    if ((await readJSON(guardianPath))?.pid === process.pid) await writeJSON(guardianPath, { pid: 0 });
     process.off("SIGTERM", stop);
     process.off("SIGINT", stop);
-    if (stopping) await writeJSON(controllerPath, { pid: 0, ready: false });
   }
 }
-async function stopComputer(directory, force = false) {
-  const client = await computerClient(directory);
-  const controller = await readJSON(path2.join(directory, "computer-controller.json"));
-  if (!alive(controller?.pid)) throw new Error("The Mindwire controller is not running.");
-  const lease = force ? void 0 : await client.service.acquireUpdate();
-  try {
-    process.kill(controller.pid, "SIGTERM");
-  } catch (error) {
-    if (lease) await client.service.releaseUpdate(lease.id);
-    throw error;
-  }
-  for (let attempt = 0; attempt < 80; attempt++) {
-    if (!alive(controller.pid)) return;
-    await setTimeout$1(250);
-  }
-  throw new Error("Mindwire is still stopping. Check computer.log.");
+
+// src/computer/connection-flow.ts
+function connectionAction(value) {
+  if (value === void 0) return void 0;
+  if (value === "resume" || value === "reconnect" || value === "pair") return value;
+  throw new Error("Use mindwire connect, mindwire connect resume, mindwire reconnect, or mindwire connect pair.");
+}
+async function chooseConnectionAction(options) {
+  const paired = options.devices.filter((device) => !device.revoked);
+  if (options.requested) {
+    if (options.requested !== "pair" && paired.length === 0) {
+      throw new Error("No saved phones yet. Run mindwire connect to pair one first.");
+    }
+    return options.requested;
+  }
+  if (paired.length === 0) return "pair";
+  if (!options.question) return "resume";
+  for (; ; ) {
+    const answer = (await options.question(
+      "\n  1  Resume saved connection\n  2  Refresh address on a saved phone (QR)\n  3  Pair another phone\n\nChoose [1]: "
+    )).trim().toLowerCase();
+    if (answer === "" || answer === "1" || answer === "resume") return "resume";
+    if (answer === "2" || answer === "reconnect") return "reconnect";
+    if (answer === "3" || answer === "pair") return "pair";
+  }
+}
+async function chooseStartupAction(options) {
+  if (options.startup && options.noStartup) throw new Error("Choose either --startup or --no-startup.");
+  if (options.startup) return !options.state.enabled || !options.state.running ? true : void 0;
+  if (options.noStartup) return options.state.kind ? void 0 : false;
+  if (options.state.kind) return options.state.enabled && !options.state.running ? true : void 0;
+  if (!options.question) return void 0;
+  for (; ; ) {
+    const answer = (await options.question(
+      "\nStart Mindwire automatically after you sign in to this computer? [Y/n] "
+    )).trim().toLowerCase();
+    if (["", "y", "yes"].includes(answer)) return true;
+    if (["n", "no"].includes(answer)) return false;
+  }
+}
+function reconnectCode(info, name, now = /* @__PURE__ */ new Date()) {
+  if (info.routes.length === 0) throw new Error("No connection address is ready. Run mindwire status and retry once the tunnel is online.");
+  return {
+    version: 1,
+    mode: "reconnect",
+    computerId: info.computerId,
+    registryId: info.registryId,
+    fingerprint: info.fingerprint,
+    name,
+    routes: info.routes,
+    expiresAt: new Date(now.getTime() + 5 * 6e4).toISOString()
+  };
+}
+function deviceSummary(devices) {
+  return devices.filter((device) => !device.revoked).sort((a, b) => a.name.localeCompare(b.name) || a.id.localeCompare(b.id)).map((device) => {
+    const name = device.name.replace(/[\x00-\x1f\x7f-\x9f]/g, "");
+    const status = device.connected === true ? "connected" : "paired";
+    return `  ${name} \xB7 ${status}`;
+  }).join("\n");
 }
 
 // src/cli.ts
 var help = `Mindwire \u2014 connect this computer to your phone
 
   npm install -g mindwire
-  mindwire connect                       Connect across networks, show QR, approve phone
+  mindwire connect                       Resume a saved connection, or pair your first phone
+  mindwire connect resume                Resume without creating another pairing
+  mindwire reconnect                     Refresh a saved phone's address with a QR code
+  mindwire connect pair                  Pair another phone with this computer
   mindwire connect --relay none --host laptop.tailnet  Use your existing VPN
   mindwire connect --relay none           Direct SSH only (reachable network required)
   mindwire connect --relay cloudflare     Cloudflare quick tunnel
@@ -2174,6 +482,8 @@ var help = `Mindwire \u2014 connect this computer to your phone
   mindwire connect --relay custom --relay-url wss://computer.example/ssh
 
   mindwire start                         Start the saved connection in the background
+  mindwire startup enable|disable        Manage automatic startup after computer login
+  mindwire startup status                Check automatic startup
   mindwire status                        Show connection and running service
   mindwire devices                       List paired phones
   mindwire revoke DEVICE_ID              Disconnect and revoke one phone
@@ -2188,7 +498,10 @@ Options:
   --cloudflare-token-file PATH            Named Cloudflare tunnel token file
   --state-dir PATH                       Private state directory
   --json                                 Structured output (QR invitation includes a secret)
+  --qr auto|terminal|browser              Fit the QR to your terminal or open a local page
   --no-qr                                Print only the pairing link
+  --startup                              Enable automatic startup without a prompt
+  --no-startup                            Skip automatic startup setup
 
 The default works across Wi-Fi and mobile networks. Mindwire privately downloads
 a verified Cloudflare helper when needed. Relays carry encrypted SSH.
@@ -2204,6 +517,7 @@ async function main(args = process.argv.slice(2)) {
     help: { type: "boolean", short: "h" },
     json: { type: "boolean" },
     "no-qr": { type: "boolean" },
+    qr: { type: "string" },
     "state-dir": { type: "string" },
     directory: { type: "string" },
     host: { type: "string" },
@@ -2215,15 +529,19 @@ async function main(args = process.argv.slice(2)) {
     port: { type: "string" },
     "websocket-port": { type: "string" },
     version: { type: "string" },
-    force: { type: "boolean" }
+    force: { type: "boolean" },
+    startup: { type: "boolean" },
+    "no-startup": { type: "boolean" }
   } });
   const command = positionals[0] ?? "help";
   if (values.help || command === "help") {
     process.stdout.write(help);
     return;
   }
-  const directory = path2.resolve(values["state-dir"] ?? defaultStateDirectory());
-  const emit2 = (event, data = {}, text) => {
+  if (values.qr && !["auto", "terminal", "browser"].includes(values.qr)) throw new Error("Choose --qr auto, terminal or browser.");
+  if (values.startup && values["no-startup"]) throw new Error("Choose either --startup or --no-startup.");
+  const directory = path.resolve(values["state-dir"] ?? defaultStateDirectory());
+  const emit = (event, data = {}, text) => {
     if (values.json) process.stdout.write(JSON.stringify({ event, ...data }) + "\n");
     else if (text) process.stdout.write(text + "\n");
   };
@@ -2231,9 +549,21 @@ async function main(args = process.argv.slice(2)) {
     await superviseComputer(directory);
     return;
   }
-  if (["connect", "start"].includes(command)) {
+  if (command === "_watch") {
+    await watchComputer(directory, fileURLToPath(import.meta.url));
+    return;
+  }
+  if (command === "startup") {
+    const action = positionals[1] ?? "status";
+    if (!["enable", "disable", "status"].includes(action)) throw new Error("Use mindwire startup enable, disable or status.");
+    const state = action === "status" ? await startupStatus(directory) : await configureStartup(directory, fileURLToPath(import.meta.url), action === "enable");
+    emit("startup", state, state.enabled ? "Mindwire starts after you sign in to this computer and recovers automatically." : "Automatic startup is off. Use mindwire start to run the service.");
+    return;
+  }
+  if (["connect", "start", "reconnect"].includes(command)) {
+    const requestedAction = command === "reconnect" ? "reconnect" : command === "connect" ? connectionAction(positionals[1]) : void 0;
     const patch = {};
-    if (values.directory) patch.directory = path2.resolve(values.directory);
+    if (values.directory) patch.directory = path.resolve(values.directory);
     if (values.host) patch.host = values.host;
     if (values.bind) patch.bind = values.bind;
     for (const [flag, field] of [["port", "sshPort"], ["websocket-port", "websocketPort"]]) {
@@ -2243,7 +573,7 @@ async function main(args = process.argv.slice(2)) {
         patch[field] = n;
       }
     }
-    if (values["daemon-bin"] || process.env.MINDWIRE_DAEMON) patch.daemonBin = path2.resolve(values["daemon-bin"] ?? process.env.MINDWIRE_DAEMON);
+    if (values["daemon-bin"] || process.env.MINDWIRE_DAEMON) patch.daemonBin = path.resolve(values["daemon-bin"] ?? process.env.MINDWIRE_DAEMON);
     if (values.version) patch.version = values.version.replace(/^v/, "");
     if (values.relay || values["relay-url"] || values["cloudflare-token-file"]) {
       const kind = values.relay ?? "custom";
@@ -2251,98 +581,155 @@ async function main(args = process.argv.slice(2)) {
       patch.relay = {
         kind,
         url: values["relay-url"],
-        cloudflareTokenFile: values["cloudflare-token-file"] ? path2.resolve(values["cloudflare-token-file"]) : void 0
+        cloudflareTokenFile: values["cloudflare-token-file"] ? path.resolve(values["cloudflare-token-file"]) : void 0
       };
     }
-    emit2("starting", {}, "Starting Mindwire\u2026");
+    emit("starting", {}, "Starting Mindwire\u2026");
     const client2 = await ensureComputer(
       directory,
       fileURLToPath(import.meta.url),
       patch,
-      (phase) => emit2("progress", { message: phase }, phase)
+      (phase) => emit("progress", { message: phase }, phase)
     );
     const info = await client2.computer.info();
-    emit2("ready", { computerId: info.computerId, routes: info.routes }, "Mindwire is running in the background.");
+    emit("ready", { computerId: info.computerId, routes: info.routes }, "Mindwire is running in the background.");
     if (command === "start") return;
-    if (info.routes.some((route) => route.kind === "websocket" && new URL(route.url).hostname.endsWith(".trycloudflare.com"))) {
-      emit2("temporary_address", {}, "Internet access is ready. This quick-tunnel address changes after a restart; use a stable hostname or VPN for regular access.");
-    }
-    const invitation = await client2.computer.invite(info.routes);
-    const uri = computerPairingURI(invitation);
-    emit2("invitation", { invitation, uri }, "Open Mindwire on your phone \u2192 Add computer \u2192 Scan QR code.");
-    if (!values.json) {
-      if (!values["no-qr"]) {
-        const QR = await import('qrcode');
-        process.stdout.write(await QR.toString(uri, { type: "terminal", small: true, errorCorrectionLevel: "L" }));
+    if (info.routes.some((route) => route.kind === "websocket")) {
+      emit("secure_connection", {}, "Your phone connects over end-to-end encrypted SSH. The tunnel carries encrypted traffic; only phones you approve can connect.");
+    }
+    const devices = await client2.computer.devices();
+    const saved = devices.filter((device) => !device.revoked);
+    if (saved.length) emit("saved_devices", { devices: saved }, `
+Saved phones
+${deviceSummary(saved)}`);
+    const question = !values.json && process.stdin.isTTY ? async (prompt) => {
+      const input = createInterface({ input: process.stdin, output: process.stderr });
+      try {
+        return await input.question(prompt);
+      } finally {
+        input.close();
       }
-      process.stdout.write(`
-Pairing link (expires in 5 minutes):
-${uri}
-
-Waiting for your phone\u2026
-`);
+    } : void 0;
+    const action = await chooseConnectionAction({ requested: requestedAction, devices, question });
+    const startupPreference = await startupStatus(directory);
+    const startupAction = await chooseStartupAction({
+      state: startupPreference,
+      startup: values.startup,
+      noStartup: values["no-startup"],
+      question
+    });
+    if (startupAction !== void 0) {
+      try {
+        const startup = await configureStartup(directory, fileURLToPath(import.meta.url), startupAction);
+        emit("startup", startup, startup.enabled ? "Automatic startup enabled. Saved phones can reconnect after you sign in to this computer." : "Automatic startup is off. Run mindwire connect after restarting, or mindwire startup enable to change this.");
+      } catch {
+        emit("startup_unavailable", {}, "Mindwire is running, but startup setup didn't complete. Run mindwire startup enable to check your system's startup service.");
+      }
+    } else {
+      emit("startup", startupPreference, startupPreference.enabled ? "Automatic startup is on. Change it with mindwire startup disable." : "Automatic startup is off. Enable it with mindwire startup enable.");
     }
-    let shownRequest;
-    while (Date.now() < Date.parse(invitation.expiresAt)) {
-      const pairing = await client2.computer.pairing(invitation.pairingId);
-      if (pairing.status === "approved") {
-        emit2("paired", {}, "Phone connected. You can close this terminal; Mindwire keeps running.");
-        return;
+    if (action === "resume") {
+      emit("resumed", { computerId: info.computerId, devices: saved }, "\nReady for your saved phone. Open this computer in Mindwire.");
+      if (info.routes.some((route) => route.kind === "websocket" && new URL(route.url).hostname.endsWith(".trycloudflare.com"))) {
+        emit("reconnect_hint", {}, "If its temporary tunnel address changed, run mindwire reconnect to refresh your phone.");
       }
-      if (pairing.status === "rejected") {
-        emit2("rejected", {}, "Pairing declined.");
-        return;
+      return;
+    }
+    if (action === "reconnect") {
+      const code = reconnectCode(await client2.computer.info(), hostname());
+      emit("reconnect_code", { code, uri: computerPairingURI(code) });
+      if (values.json) return;
+      const display2 = await showPairingInvitation(code, {
+        mode: values["no-qr"] ? "none" : values.qr ?? "auto"
+      });
+      try {
+        if (question) await question("\nScan with your saved phone, then press Enter to close this code. ");
+        else if (values.qr === "browser") {
+          emit("waiting", {}, "This code stays open until it expires. Press Ctrl+C to close it; Mindwire keeps running.");
+          await setTimeout$1(Math.max(0, Date.parse(code.expiresAt) - Date.now()));
+        }
+      } finally {
+        display2.close();
       }
-      if (pairing.request && shownRequest !== pairing.request.id) {
-        shownRequest = pairing.request.id;
-        const key = Buffer.from(pairing.request.publicKey.split(" ")[1] ?? "", "base64");
-        const fingerprint = "SHA256:" + createHash("sha256").update(key).digest("base64").replace(/=+$/, "");
-        emit2(
-          "approval_required",
-          { pairingId: invitation.pairingId, request: pairing.request, fingerprint },
-          `
+      emit("resumed", { computerId: info.computerId }, "Saved pairing kept. Mindwire continues running in the background.");
+      return;
+    }
+    const invitation = await client2.computer.invite((await client2.computer.info()).routes);
+    const uri = computerPairingURI(invitation);
+    emit("invitation", { invitation, uri });
+    const display = values.json ? void 0 : await showPairingInvitation(invitation, {
+      mode: values["no-qr"] ? "none" : values.qr ?? "auto"
+    });
+    try {
+      let shownRequest;
+      while (Date.now() < Date.parse(invitation.expiresAt)) {
+        const pairing = await client2.computer.pairing(invitation.pairingId);
+        if (pairing.status === "approved") {
+          display?.close();
+          emit("paired", {}, "Phone connected. You can close this terminal; Mindwire keeps running.");
+          return;
+        }
+        if (pairing.status === "rejected") {
+          display?.close();
+          emit("rejected", {}, "Pairing declined.");
+          return;
+        }
+        if (pairing.request && shownRequest !== pairing.request.id) {
+          display?.close();
+          shownRequest = pairing.request.id;
+          const key = Buffer.from(pairing.request.publicKey.split(" ")[1] ?? "", "base64");
+          const fingerprint = "SHA256:" + createHash("sha256").update(key).digest("base64").replace(/=+$/, "");
+          emit(
+            "approval_required",
+            { pairingId: invitation.pairingId, request: pairing.request, fingerprint },
+            `
 ${safeName(pairing.request.name)} wants to connect.
 Device key: ${fingerprint}`
-        );
-        if (!process.stdin.isTTY) {
-          emit2(
-            "approval_command",
-            { command: `mindwire approve ${invitation.pairingId} ${pairing.request.id}` },
-            `Review this device, then run:
-mindwire approve ${invitation.pairingId} ${pairing.request.id}`
           );
-        } else {
-          const input = createInterface({ input: process.stdin, output: process.stderr });
-          try {
-            const answer = await input.question("Allow this phone to access this workspace? [y/N] ");
-            await client2.computer.decide(invitation.pairingId, pairing.request.id, /^y(es)?$/i.test(answer.trim()));
-          } finally {
-            input.close();
+          if (!process.stdin.isTTY) {
+            emit(
+              "approval_command",
+              { command: `mindwire approve ${invitation.pairingId} ${pairing.request.id}` },
+              `Review this device, then run:
+mindwire approve ${invitation.pairingId} ${pairing.request.id}`
+            );
+          } else {
+            const input = createInterface({ input: process.stdin, output: process.stderr });
+            try {
+              const answer = await input.question("Allow this phone to access this workspace? [y/N] ");
+              await client2.computer.decide(invitation.pairingId, pairing.request.id, /^y(es)?$/i.test(answer.trim()));
+            } finally {
+              input.close();
+            }
           }
         }
+        await setTimeout$1(750);
       }
-      await setTimeout$1(750);
+      throw new Error("Pairing expired. Run mindwire connect to show a new QR code.");
+    } finally {
+      display?.close();
     }
-    throw new Error("Pairing expired. Run mindwire connect to show a new QR code.");
   }
   if (command === "stop") {
     await stopComputer(directory, values.force === true);
-    emit2("stopped", {}, "Mindwire stopped.");
+    emit("stopped", {}, "Mindwire stopped.");
     return;
   }
   const client = await computerClient(directory);
   switch (command) {
     case "status": {
-      const [info, health, work, controller] = await Promise.all([
+      const [info, health, work, controller, startup] = await Promise.all([
         client.computer.info(),
         client.health(),
         client.service.updateStatus(),
-        readJSON(path2.join(directory, "computer-controller.json"))
+        readJSON(path.join(directory, "computer-controller.json")),
+        startupStatus(directory)
       ]);
-      emit2(
+      emit(
         "status",
-        { ...info, daemonVersion: health.version, ...work, relayError: controller?.error },
+        { ...info, daemonVersion: health.version, ...work, startup, recovering: controller?.recovering, relayError: controller?.error },
         `Mindwire ${health.version} \xB7 ${work.idle ? "idle" : "working"}
+Startup: ${startup.enabled ? "on" : "off"}
 ${info.routes.map((route) => route.kind === "ssh" ? `SSH ${route.host}:${route.port}` : route.url).join("\n")}${controller?.error ? `
 ${controller.error}` : ""}`
       );
@@ -2350,38 +737,38 @@ ${controller.error}` : ""}`
     }
     case "devices": {
       const devices = await client.computer.devices();
-      emit2("devices", { devices }, devices.length ? devices.map((d) => `${safeName(d.name)}  ${d.id}${d.revoked ? "  (revoked)" : ""}`).join("\n") : "No paired phones yet. Run mindwire connect.");
+      emit("devices", { devices }, devices.length ? devices.map((d) => `${safeName(d.name)}  ${d.id}${d.revoked ? "  (revoked)" : ""}`).join("\n") : "No paired phones yet. Run mindwire connect.");
       break;
     }
     case "revoke": {
       if (!positionals[1]) throw new Error("Use mindwire revoke DEVICE_ID (from mindwire devices).");
       await client.computer.revoke(positionals[1]);
-      emit2("revoked", {}, "Device revoked and disconnected.");
+      emit("revoked", {}, "Device revoked and disconnected.");
       break;
     }
     case "approve":
     case "reject": {
       if (!positionals[1] || !positionals[2]) throw new Error(`Use mindwire ${command} PAIRING_ID REQUEST_ID.`);
       await client.computer.decide(positionals[1], positionals[2], command === "approve");
-      emit2(command, {}, command === "approve" ? "Phone approved." : "Phone declined.");
+      emit(command, {}, command === "approve" ? "Phone approved." : "Phone declined.");
       break;
     }
     case "update": {
       const version = (values.version ?? SDK_VERSION).replace(/^v/, "");
       const health = await client.health();
       if (health.version.replace(/^v/, "") === version) {
-        emit2("updated", { version }, `Mindwire ${version} is already installed.`);
+        emit("updated", { version }, `Mindwire ${version} is already installed.`);
         return;
       }
       const requested = await client.computer.requestUpdate(version);
-      emit2("update_queued", requested, "Update queued. It will wait until all work and terminals are finished.");
+      emit("update_queued", requested, "Update queued. It will wait until all work and terminals are finished.");
       let last = "";
       for (; ; ) {
-        const update = await readJSON(path2.join(directory, "computer-update.json"));
+        const update = await readJSON(path.join(directory, "computer-update.json"));
         if (update?.id !== requested.id) throw new Error("The update request changed. Run mindwire status.");
         if (update.status !== last) {
           last = update.status;
-          emit2("update", update, `Update: ${update.status}`);
+          emit("update", update, `Update: ${update.status}`);
         }
         if (update.status === "complete") return;
         if (update.status === "failed") throw new Error(update.error ?? "Update failed.");