openmeld 0.3.125 → 0.3.128

package/dist/openmeld.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
-import { $ as runWithHeldLock, A as toSpaceContractUrl, At as openMeldBackupsDir, D as normalizeBaseUrl, E as updateConfiguredStartV1OnboardingState, F as toSpaceDispatchTraceUrl, Ft as openMeldRootDir, G as buildOpenMeldOrphanedLockAction, Gt as resolveOpenMeldRootDir, Ht as resolveOpenMeldCliEntryNameFromArgv, Jt as skillsDir, K as isOpenMeldLockError, Lt as organizationSkillReleaseDir, Mt as openMeldManagedBinaryPath, Nt as openMeldManagedVersionBinaryPath, Ot as normalizeAccountKey, P as toSpaceDispatchLookupUrl, Q as resolveOpenMeldOrphanedLockIssue, Rt as profileDir, S as setConfiguredSkillsConfig, St as accountsDir, Ut as resolveOpenMeldEnvPreset, V as toSpaceResultUrl, W as acquireLock, X as releaseLockSync, Xt as systemDir, Yt as spacesDir, Z as repairOrphanedLegacyLocks, Zt as formatLocalMachineIssueMessage, a as resolveBaseUrl, at as resolveCliContext, b as setConfiguredBaseUrl, bt as accountProfileViewPath, c as resolveExplicitGatewayUrlOrThrow, ct as formatLaneScopeSentence, ft as createActiveSetupConcurrencyIssue, g as getConfiguredSkillsConfig, gt as toRecognizedLocalMachineFailureError, ht as isLocalMachineFailureError, in as agentControllerConversationRefSchema, k as toSpaceBoardUrl, lt as resolveOpenMeldLaneDescriptor, m as getConfiguredOnboardingDisclaimerAcceptedAt, mt as createOrphanedSetupConcurrencyIssue, nt as OPENMELD_CLI_CONTEXT_ENV_KEY, o as resolveBaseUrlOrNull, q as isOpenMeldOrphanedLockError, tt as LEGACY_OPENMELD_AGENT_SESSION_ENV_KEY, u as alignRuntimeConfigStorage, ut as LocalMachineFailureError, w as updateConfiguredOnboardingConfig, yt as accountProfileSpaceCacheDir, zt as profileViewPath } from "./base-url-PkgATS5u.js";
-import { $ as runAgentsRepair, $a as installAgentActivityIntegrations, $i as readRecentDaemonLifecycleEvents, $n as canUseInteractivePrompts, $r as syncProfileWorkspaceState, $t as readRuntimeReportingHealthState, A as assertFullSignalIdArgument, Aa as updateOpenMeldProfile, Ai as buildDaemonRouteObservationPresentation$1, An as assertNoRemovedCcSpaceAddressingSyntax, Ao as setDefaultProjectConnection, Ar as formatDualViewGuideForDisplay, At as runDaemonStartupPreflight, B as persistAgentTransportSelection, Ba as resolveAuthenticationGuidanceFromMessage, Bi as finishCurrentCommandCheckScope, Bn as promptSearchSelect, Bo as outJsonLine, Br as scheduleDaemonServiceUpdate, Bt as resolveLocalComponentsStatus, C as toSpaceMetaUpsertInput, Ca as resolveOpenMeldProfileOrNull, Ci as parseAgentControllerRef, Cn as submitRuntimeAgentControllerReports, Co as removeProjectOutbox, Cr as registerSkillsTargetSelectionOptions, Ct as runDaemonUninstall, D as formatHumanReadTargetList, Da as listOpenMeldProfiles, Di as resolveEvidenceSyncHealth, Dn as resolveLocalAgentControllerReportDecision, Do as migrateProjectBindingStore, Dr as registerBuiltinAgentSelectionOptions, Dt as emitDaemonAgentOverview, E as buildHumanReplyContextSummary, Ea as deleteOpenMeldProfile, Ei as resolveAgentProfileEditCapabilities, En as resolveLocalAgentControllerLaunchability, Eo as listProjectConnectionsWithStatus, Er as registerAuthLoginRequestOptions, Et as reconcileCliVersionView, F as emitSpaceAgentOverview, Fa as buildAgentAuthenticationGuide, Fi as classifyDaemonServiceRunStartability, Fn as buildSpaceRoundReadProjection, Fo as renderInfoCard, Fr as areAllowedActionsEquivalent, Ft as updateSpaceMeta, G as runAgentsCustomList, Ga as LocalDaemonControlPlaneClientError, Gi as inspectDaemonServiceInventory, Gn as assertDispatchOwnedRuntimePublicWriteAllowed, Go as cliJsonSkillsLoadEnvelopeSchema, Gr as resolveDaemonServiceFreshnessWarning, Gt as collectSkillsReadinessSnapshot, H as runAgents, Ha as setProfileDefaultView, Hi as isCurrentCommandCheckScopeActive, Hn as runInteractivePrompt, Ho as cliBinaryDeltaPatchSchema, Hr as resolveDaemonDeviceId, Ht as resolveDaemonServiceParticipationStatus, I as emitSpaceCliAgentOverview, Ia as buildHumanAuthenticationCard, Ii as classifyDaemonServiceWakeability, In as buildUpdatesReplyWorkflowProjection, Io as renderTextInfoCard, Ir as buildAgentFacingPublicationModeGuideLines, It as readGatewayJsonResponse, J as runAgentsDetect, Ja as registerAgentActivityRoute, Ji as readCurrentObservedDaemonRuntimeStatus, Jn as writeDispatchSpaceActionRecord, Jo as organizationJoinLinkErrorResponseSchema, Jr as formatDeviceReplyReadinessLabel, Jt as runSkillsInstall, K as runAgentsCustomRemove, Ka as requestLocalAgentActivitySync, Ki as resolveVersionChangeDirection, Kn as readDispatchOwnedRuntimeGuard, Ko as cliJsonSkillsShowEnvelopeSchema, Kr as resolveCurrentReplyReadinessSnapshot, Kt as runSkillsCheck$1, L as prepareLocalAgentReadiness, La as createAuthenticationError, Li as resolveServiceUpdateUrgency, Ln as createSpaceMemberIdentityIndex, Lo as sanitizeTerminalDisplayText, Lr as canonicalizeAllowedActions, Lt as readGatewayTextResponse, M as prepareAuthenticatedSpaceCommandContext, Ma as clearSelectedOpenMeldProfileId, Mi as getSetupFlowCopy, Mn as buildDispatchResultReplyWorkflowProjection, Mo as canonicalizeLocalProjectPath, Mr as formatAgentOverviewPayload, Mt as fetchSpaceUpdates, N as resolveOpenMeldProfileForSpaceCommand, Na as getSelectedOpenMeldProfileId, Ni as buildDaemonServiceTargetSpec, Nn as buildSignalIndex, No as enqueueControllerTaskLifecycleEventWhileLocked, Nr as OPENMELD_AGENT_MENTAL_MODEL_LINES, Nt as createCliSpaceApi, O as parseEnvelope, Oa as primeOpenMeldProfilesSessionCache, Oi as resolveNativeAgentControllerPermissionModeForController, On as inspectSpaceCacheFile, Oo as removeProjectConnection, Or as buildAgentOverviewFromContract, Ot as createDelayedSpinner, P as resolveSpaceAccessLabel, Pa as setSelectedOpenMeldProfileId, Pi as resolveDaemonServiceAlignmentDecision, Pn as buildSignalMessageReadProjection, Po as readControllerTaskLifecycleOutboxHealth, Pr as SPACE_CONTRACT_ALLOWED_ACTION_ORDER, Pt as fetchSpaceMeta, Q as runAgentsManage, Qa as defaultManagedIntegrationPaths, Qi as resolveDaemonServiceManager, Qn as formatDaemonServiceMissingRecommendation, Qr as resolveOpenClawLocalDiagnosticsValue, Qt as readBundledOpenMeldCliSkillDocumentByPath, R as buildReplyReadinessGuidance, Ra as resolveAuthenticationGuidance, Ri as assessServerRequiredVersion, Rn as formatRemovedCcRelationMessage, Ro as emitCliJsonEnvelope, Rr as readOpenMeldToolsUpdateContextFromEnv, Rt as toStructuredGatewayFailure, S as loadSpaceSignalIndexOrNull, Sa as requireOpenMeldProfile, Si as listAgentControllerPermissionModeOptions, Sn as submitRuntimeAgentControllerReport, So as readAgentActivityOutboxHealth, Sr as SPACE_ADD_MEMBERS_PROGRESS_HEARTBEAT_MS, St as runDaemonTeardownStrict, T as buildFormalSignalReadPayload, Ta as createOpenMeldHumanProfile, Ti as resolveAgentExecutionStatus, Tn as resolveLocalAgentControllerBlockerReasonCodes, To as listProjectBindings, Tr as registerDaemonControlTargetOptions, Tt as buildProfileWorkspaceRows, U as runAgentsConfig, Ua as LocalProjectConnectionError, Ui as resetCurrentCommandCheckState, Un as assessCliUpdate, Uo as cliJsonOutputEnvelopeSchema, Ur as formatDaemonFailureContextText, Ut as runDaemonServiceParticipationGate, V as resolveAgentProfileSetup, Va as getProfileDefaultView, Vi as getCurrentCommandCheckState, Vn as isReturnKeypress, Vo as outLine, Vr as ensureDaemonRuntimePaths, Vt as writeInstalledLocalComponentsSnapshot, W as runAgentsCustomAdd, Wa as validateLocalProjectConnectionPath, Wi as startCurrentCommandCheckScope, Wn as isCliUpdateCheckApplicable, Wo as cliJsonSkillsListEnvelopeSchema, Wr as resolveServiceReadinessFromServiceStatus, Wt as runDaemonStartDecisionPrompt, X as runAgentsEnable, Xa as unregisterAgentActivityRoute, Xi as isDaemonServiceJobNeverSpawned, Xn as resolveElapsedTimeMs, Xo as compareAgentControllerRefsForDisplay, Xr as mapAgentReplyReadinessToLegacyAutoReply, Xt as runSkillsUpdate, Y as runAgentsDisable, Ya as resolveAgentActivityRouteForPath, Yi as getDaemonSystemServiceLogPath, Yn as formatElapsedTime, Yo as revokeOrganizationJoinLinkResponseSchema, Yr as formatHumanReplyReadinessReason$1, Yt as runSkillsUninstall, Z as runAgentsList, Zi as readDaemonServiceJobCrashExitCode, Zn as formatDaemonServiceDowngradeBlockedRecommendation, Zr as resolveGatewayChainReadiness, Zt as ensureLocalSkills, _ as runSpaceWriteWithPasswordRetry, _a as formatMessage, _i as resolveLocalRegistryAgentIdFromAgentControllerRef, _n as formatServiceParticipationReadinessLabel, _o as resolveObservedAgentActivityBinding, _r as createStartAuthenticationGuideError, _t as runDaemonReinstall, a as runSpaceDelete, aa as fetchLatestCliBinaryRelease, ai as resolveConfiguredProfileWorkspacePath, an as runAuthLogin, ao as formatOpenMeldCliCommands, ar as createSpaceAddMembersGuideError, at as renderOpenMeldBrandBlockLines, b as buildIdentityOnlyMembersSnapshotForReadProjection, ba as resolveViewProfileKey, bi as getAgentControllerPermissionModeDisplayMetadata, bn as computeRetryDelayMs, bo as enqueueAgentActivityHookEvent, br as getCommandHintsFromContract, bt as runDaemonStatusFlow, c as runSpaceLeave, ca as writeVersionState, ci as validateCustomProfileWorkspacePath, cn as runAuthStatus, co as formatProfileAwareOpenMeldCliCommands, cr as createSpaceLeaveGuideError, ct as renderOpenMeldTagline, d as runSpaceRemoveMembers, da as resolveCurrentDaemonExpectedVersion, di as createPrimaryBindingReadSession, dn as formatActiveOrganizationLabel, do as syncLocalAgentActivity, dr as createSpaceRemoveMembersGuideError, dt as runDaemon, ea as buildInstallSelfJsonPayload, ei as createModelCatalogReadSession, en as readRecentDaemonDispatchJournalEvents, eo as readAgentActivityIntegrationStatus, er as createDoctorFailedGuideError, et as runAgentsShow, f as runSpaceSend, fa as OPENMELD_VERSION, fi as resolveAgentProfilePrimaryAgentControllerReport, fn as createProfileByKind, fo as readDaemonServiceContract, fr as createSpaceResultGuideError, ft as runDaemonAutostart, g as runSpaceReadWithPasswordRetry, ga as createPresenter, gi as notifyDaemonRouteCatalogChanged, gn as ensureAgentProfileRuntimeBinding, go as buildAgentActivityEvent, gr as createStartAgentIdentityGuideError, gt as runDaemonInterrupt, h as uploadPreparedSpaceFiles, ha as renderHumanTextErrorCard, hi as listBuiltinAgentsRegistryEntries, hn as promptTextEntry, ho as removeAgentActivityContextCache, hr as createSpaceUpdatesGuideError, ht as runDaemonInstall, i as runSpaceCreate, ia as ensureVersionStateReady, ii as readProfileWorkspaceConfig, in as evaluateCommandAuthentication, io as formatOpenMeldCliCommand, ir as createResetConfirmationGuideError, it as printOpenMeldBanner, j as assertValidSpaceIdTarget, ja as alignSelectedOpenMeldProfileStorage, ji as buildOnboardingPlan, jn as buildDispatchResultMessageReadProjection, jo as unbindProject, jr as buildDualViewGuideMessage, jt as readDaemonStartFailureLogTailLines, k as isSpaceCommandOutputHandledError, ka as resolveOpenMeldProfile, kn as upsertSpaceConfig, ko as runIfAgentActivityBindingGenerationIsCurrent, kr as DualViewGuideError, kt as shouldEmitAgentOverview, l as runSpaceList, la as resolveDaemonRuntimeContractCompatibility, li as describeProfileWorkspacePathValidationFailure, ln as buildAuthStatusRows, lo as resolveSetupFollowUpCliEntryCommand, lr as createSpaceMenuGuideError, lt as resolveGatewayWebOrigin, m as prepareRequestedSpaceSendFiles, ma as renderHumanErrorCard, mi as reconcileNewRunnableBuiltinAgentsForSetup, mn as resolveCreateProfileName, mo as readAgentActivityContextForPath, mr as createSpaceTargetGuideError, mt as runDaemonCancel, n as promptAndConfirmSpacePassword, na as buildNextVersionState, ni as ensureOpenMeldManagedProfileWorkspace, nn as buildCommandAuthenticationPromptMessage, no as uninstallAgentActivityIntegrations, nr as createProfileCreateGuideError, nt as colorizeAgentLabel, o as runSpaceHistory, oa as fetchLatestPackageInfo, oi as setCustomProfileWorkspace, on as runAuthLogout, oo as formatOpenMeldCliLine, or as createSpaceAliasTargetGuideError, ot as renderOpenMeldHeader, p as runSpaceWatch, pa as buildHumanErrorCopy, pi as listAgentTargetStates, pn as resolveCreateProfileKind, po as upsertDaemonServiceContract, pr as createSpaceSubcommandTargetGuideError, pt as runDaemonBackgroundStartForDecision, q as runAgentsCustomUpdate, qa as isAgentActivityRouteRegistered, qi as readCurrentDaemonRuntimeContext, qn as readDispatchSpaceActionContextFromEnv, qo as getOrganizationJoinLinkResponseSchema, qr as formatAgentReplyReadinessLabel, qt as runSkillsEnsure, r as runSpaceAddMembers, ra as compareSemver, ri as normalizeCustomProfileWorkspacePath, rn as ensureCommandAuthenticationOrCancel, ro as formatInlineOpenMeldCliCommands, rr as createProfileMenuGuideError, rt as colorizeDisplayProfileLabel, s as runSpaceJoin, sa as readVersionState, si as setOpenMeldManagedProfileWorkspace, sn as runAuthMenu, so as formatOpenMeldCliTextBlock, sr as createSpaceContractSetGuideError, st as renderOpenMeldLogo, t as buildCreateSpacePasswordPromptConfig, ta as performManagedInstall, ti as resolveProfileWorkspaceRuntime, tn as connectWebSocket, to as resolveAgentActivityDispatcherCommand, tr as createProfileActionGuideError, tt as formatTransportModeDisplay, u as runSpacePassword, ua as toStartBackgroundHelperExecutionCompatibility, ui as syncDeviceRuntimeStateProjection, un as buildAuthStatusSnapshot, uo as resolveUserFacingCliEntryCommand, ur as createSpacePublicationSetGuideError, ut as resolveSpaceSendText, v as buildHumanReadSignalsTranscriptItems, va as parseCliViewMode, vi as buildAgentControllerRef, vn as resolveServiceParticipationReadiness, vo as normalizeSharedSessionTitle, vr as createUpgradeConfirmationGuideError, vt as runDaemonRunAfterEntryChecks, w as buildFormalDispatchResultReadPayload, wa as createOpenMeldAgentProfile, wi as resolveAgentControllerPermissionModeForController, wn as collectLocalAgentControllerInventory, wo as bindProject, wr as getCliVersionInfo, wt as buildProfileWorkspacePresentation, x as loadSpaceIdentityDirectoryOrNull, xa as isSelectedOpenMeldProfileRequiredError, xi as getAgentControllerPermissionModeFieldLabel, xn as submitProfileRuntimeAgentControllerReport, xo as removeProjectInbox, xr as registerSpaceMemberSelectionOptions, xt as runDaemonStop, y as emitHumanReadSignalsTextProjection, ya as resolveRuntimeContext, yi as createAgentExecutionStatusDisplayRows, yn as assessActionParticipationCandidate, yo as readCodexSessionTitles, yr as getCommandEntryContract, yt as runDaemonSnapshot, z as resolveHumanControllerDisplayName, za as resolveAuthenticationGuidanceFromError, zi as resolveOpenMeldEnvironmentTarget, zn as promptSearchMultiselect, zo as errLine, zr as runPendingDaemonServiceUpdate, zt as parseJsonResponse } from "./command-CD_g9eAM.js";
-import { $ as ownerComputerDiagnosticsSchema, $t as agentActivityInventorySessionStatusSchema, B as sleep, Bt as agentActivityProviderSchema, Ct as authProfileKindSchema, D as toStructuredApiClientFailure, F as OPENMELD_HEADER_PROFILE_ID, G as projectSpaceDispatchTraceFinalVisibleOutcome, Ht as agentActivitySnapshotQuerySchema, J as spaceDispatchTraceDispatchStatusSchema, K as resolveSpaceDispatchTraceRootCause, Ot as submitFeedbackIssueRequestSchema, Qt as agentActivityInventorySessionOriginSchema, Vt as agentActivitySessionStatusSchema, W as SPACE_DISPATCH_TRACE_RESPONSE_CONTRACT_VERSION_HEADER, X as observabilityWakeTraceSelectorSchema, Y as spaceDispatchTraceResponseSchema, Z as projectObservabilityWakeCorrelation, _ as createOrganizationSkillsApi, b as createProjectsApi, c as createAgentProfileBindingApi, d as createCurrentDeviceApi, dn as START_BOUNDED_ID_SCHEMA, en as agentActivitySessionInventoryQuerySchema, et as projectOwnerComputerLocalRuntimes, f as createFeedbackApi, fn as START_BOUNDED_VERSION_SCHEMA, g as createOrganizationApi, gn as localAgentCatalogSchema, gt as organizationSkillBundleSchema, hn as startReplyReadinessSummarySchema, l as createCenterAgentApi, mn as START_TRIMMED_NON_EMPTY_STRING_SCHEMA, nn as localAgentSessionProviderSchema, nt as DEFAULT_AGENT_PROFILE_CREATION_CONFIGURATION, pn as START_ISO_DATE_TIME_SCHEMA, q as spaceDispatchTraceAttemptStatusSchema, rt as agentProfileCreationConfigurationSchema, s as createAgentActivityApi, tt as summarizeComputerFileAccessPolicy, u as createComputerFileAccessApi, v as createPrepareReadinessApi, wt as authProfileManagedRoleSchema, x as createRoutinesApi, yt as stringifyOrganizationSkillBundleCanonicalJson } from "./dist-DYE9Q3T4.js";
-import { $n as array, Bt as resolveSpaceFileMimeType, Cr as clientMessageIdSchema, Lt as isSpaceFileTextEditable, Mt as centerAgentInteractionSourceSchema, Wr as openMeldProfileIdSchema, Yr as openMeldRuntimeProfileIdSchema, ar as int, bn as messageEnvelopeSchema, cn as spaceContractSchema, dr as object, er as boolean, hr as string, ii as trimmedStringFromUnknown, ir as enumFactory, jt as spaceStatusSchema, lr as nullFactory, mr as strictObject, ni as nonEmptyTrimmedStringFromUnknown, nn as dispatchExecutionSchema, nr as discriminatedUnion, or as iso, pr as record, rn as spaceThreadContextSchema, sn as spaceContractFieldsSchema, sr as literal, vr as union, yr as unknown } from "./runtime-transport-CWWB2Ily.js";
+import { $ as runWithHeldLock, $t as formatLocalMachineIssueMessage, A as toSpaceContractUrl, At as normalizeAccountKey, Bt as profileDir, D as normalizeBaseUrl, E as updateConfiguredStartV1OnboardingState, F as toSpaceDispatchTraceUrl, Ft as openMeldManagedVersionBinaryPath, G as buildOpenMeldOrphanedLockAction, Gt as resolveOpenMeldEnvPreset, K as isOpenMeldLockError, Lt as openMeldRootDir, Mt as openMeldBackupsDir, P as toSpaceDispatchLookupUrl, Pt as openMeldManagedBinaryPath, Q as resolveOpenMeldOrphanedLockIssue, Qt as systemDir, S as setConfiguredSkillsConfig, St as accountProfileViewPath, V as toSpaceResultUrl, Vt as profileViewPath, W as acquireLock, Wt as resolveOpenMeldCliEntryNameFromArgv, X as releaseLockSync, Xt as skillsDir, Z as repairOrphanedLegacyLocks, Zt as spacesDir, a as resolveBaseUrl, at as resolveCliContext, b as setConfiguredBaseUrl, c as resolveExplicitGatewayUrlOrThrow, ct as formatLaneScopeSentence, ft as createActiveSetupConcurrencyIssue, g as getConfiguredSkillsConfig, gt as toRecognizedLocalMachineFailureError, ht as isLocalMachineFailureError, k as toSpaceBoardUrl, lt as resolveOpenMeldLaneDescriptor, m as getConfiguredOnboardingDisclaimerAcceptedAt, mt as createOrphanedSetupConcurrencyIssue, nt as OPENMELD_CLI_CONTEXT_ENV_KEY, o as resolveBaseUrlOrNull, on as agentControllerConversationRefSchema, q as isOpenMeldOrphanedLockError, qt as resolveOpenMeldRootDir, tt as LEGACY_OPENMELD_AGENT_SESSION_ENV_KEY, u as alignRuntimeConfigStorage, ut as LocalMachineFailureError, w as updateConfiguredOnboardingConfig, wt as accountsDir, xt as accountProfileSpaceCacheDir, zt as organizationSkillReleaseDir } from "./base-url-BtqW4aLS.js";
+import { $ as runAgentsRepair, $a as validateLocalProjectConnectionPath, $i as startCurrentCommandCheckScope, $n as assertDispatchOwnedRuntimePublicWriteAllowed, $o as cliJsonSkillsListEnvelopeSchema, $r as resolveDaemonServiceFreshnessWarning, $t as readBundledOpenMeldCliSkillDocumentByPath, A as assertFullSignalIdArgument, Aa as isSelectedOpenMeldProfileRequiredError, Ai as listAgentControllerPermissionModeOptions, An as submitRuntimeAgentControllerReport, Ao as removeProjectInbox, Ar as SPACE_ADD_MEMBERS_PROGRESS_HEARTBEAT_MS, At as shouldEmitAgentOverview, B as persistAgentTransportSelection, Ba as alignSelectedOpenMeldProfileStorage, Bi as getSetupFlowCopy, Bn as buildDispatchResultReplyWorkflowProjection, Bo as unbindProject, Br as formatAgentOverviewPayload, Bt as parseJsonResponse, C as toSpaceMetaUpsertInput, Ca as renderHumanErrorCard, Ci as listBuiltinAgentsRegistryEntries, Cn as promptTextEntry, Co as readAgentActivityContextForPath, Cr as createSpaceUpdatesGuideError, Ct as runDaemonTeardownStrict, D as formatHumanReadTargetList, Da as parseCliViewMode, Di as createAgentExecutionStatusDisplayRows, Dn as assessActionParticipationCandidate, Do as normalizeSharedSessionTitle, Dr as getCommandEntryContract, Dt as reconcileCliVersionView, E as buildHumanReplyContextSummary, Ea as formatMessage, Ei as buildAgentControllerRef, En as resolveServiceParticipationReadiness, Eo as resolveObservedAgentActivityBinding, Er as createUpgradeConfirmationGuideError, Et as buildProfileWorkspaceRows, F as emitSpaceAgentOverview, Fa as deleteOpenMeldProfile, Fi as resolveEvidenceSyncHealth, Fn as resolveLocalAgentControllerReportDecision, Fo as listProjectConnectionsWithStatus, Fr as registerBuiltinAgentSelectionOptions, Ft as fetchSpaceMeta, G as runAgentsCustomList, Ga as buildHumanAuthenticationCard, Gi as resolveServiceUpdateUrgency, Gn as createSpaceMemberIdentityIndex, Go as renderTextInfoCard, Gr as canonicalizeAllowedActions, Gt as runDaemonStartDecisionPrompt, H as runAgents, Ha as getSelectedOpenMeldProfileId, Hi as resolveDaemonServiceAlignmentDecision, Hn as buildSignalMessageReadProjection, Ho as enqueueControllerTaskLifecycleEventWhileLocked, Hr as SPACE_CONTRACT_ALLOWED_ACTION_ORDER, Ht as writeInstalledLocalComponentsSnapshot, I as emitSpaceCliAgentOverview, Ia as listOpenMeldProfiles, Ii as resolveNativeAgentControllerPermissionModeForController, In as inspectSpaceCacheFile, Io as migrateProjectBindingStore, Ir as buildAgentOverviewFromContract, It as updateSpaceMeta, J as runAgentsDetect, Ja as resolveAuthenticationGuidanceFromError, Ji as resolveAuthBaseUrl, Jn as promptSearchSelect, Jo as errLine, Jr as scheduleDaemonServiceUpdate, Jt as runSkillsEnsure, K as runAgentsCustomRemove, Ka as createAuthenticationError, Ki as assessServerRequiredVersion, Kn as formatRemovedCcRelationMessage, Ko as sanitizeTerminalDisplayText, Kr as readOpenMeldToolsUpdateContextFromEnv, Kt as collectSkillsReadinessSnapshot, L as prepareLocalAgentReadiness, La as primeOpenMeldProfilesSessionCache, Ln as upsertSpaceConfig, Lo as removeProjectConnection, Lr as DualViewGuideError, Lt as readGatewayJsonResponse, M as prepareAuthenticatedSpaceCommandContext, Ma as resolveOpenMeldProfileOrNull, Mi as resolveAgentControllerPermissionModeForController, Mn as collectLocalAgentControllerInventory, Mo as removeProjectOutbox, Mr as getCliVersionInfo, Mt as readDaemonStartFailureLogTailLines, N as resolveOpenMeldProfileForSpaceCommand, Na as createOpenMeldAgentProfile, Ni as resolveAgentExecutionStatus, Nn as resolveLocalAgentControllerBlockerReasonCodes, No as bindProject, Nr as registerDaemonControlTargetOptions, Nt as fetchSpaceUpdates, O as parseEnvelope, Oa as resolveRuntimeContext, Oi as getAgentControllerPermissionModeDisplayMetadata, On as computeRetryDelayMs, Oo as readCodexSessionTitles, Or as getCommandHintsFromContract, Ot as emitDaemonAgentOverview, P as resolveSpaceAccessLabel, Pa as createOpenMeldHumanProfile, Pi as resolveAgentProfileEditCapabilities, Pn as resolveLocalAgentControllerLaunchability, Po as listProjectBindings, Pr as registerAuthLoginRequestOptions, Pt as createCliSpaceApi, Q as runAgentsManage, Qa as LocalProjectConnectionError, Qi as resetCurrentCommandCheckState, Qn as isCliUpdateCheckApplicable, Qo as cliJsonOutputEnvelopeSchema, Qr as resolveServiceReadinessFromServiceStatus, Qt as ensureLocalSkills, R as buildReplyReadinessGuidance, Ra as resolveOpenMeldProfile, Ri as buildDaemonRouteObservationPresentation$1, Rn as assertNoRemovedCcSpaceAddressingSyntax, Ro as runIfAgentActivityBindingGenerationIsCurrent, Rr as formatDualViewGuideForDisplay, Rt as readGatewayTextResponse, S as loadSpaceSignalIndexOrNull, Sa as buildHumanErrorCopy, Si as reconcileNewRunnableBuiltinAgentsForSetup, Sn as resolveCreateProfileName, So as upsertDaemonServiceContract, Sr as createSpaceTargetGuideError, St as runDaemonStop, T as buildFormalSignalReadPayload, Ta as createPresenter, Ti as resolveLocalRegistryAgentIdFromAgentControllerRef, Tn as formatServiceParticipationReadinessLabel, To as buildAgentActivityEvent, Tr as createStartAuthenticationGuideError, Tt as buildProfileWorkspacePresentation, U as runAgentsConfig, Ua as setSelectedOpenMeldProfileId, Ui as classifyDaemonServiceRunStartability, Un as buildSpaceRoundReadProjection, Uo as readControllerTaskLifecycleOutboxHealth, Ur as areAllowedActionsEquivalent, Ut as resolveDaemonServiceParticipationStatus, V as resolveAgentProfileSetup, Va as clearSelectedOpenMeldProfileId, Vi as buildDaemonServiceTargetSpec, Vn as buildSignalIndex, Vo as canonicalizeLocalProjectPath, Vr as OPENMELD_AGENT_MENTAL_MODEL_LINES, Vt as resolveLocalComponentsStatus, W as runAgentsCustomAdd, Wa as buildAgentAuthenticationGuide, Wi as classifyDaemonServiceWakeability, Wn as buildUpdatesReplyWorkflowProjection, Wo as renderInfoCard, Wr as buildAgentFacingPublicationModeGuideLines, Wt as runDaemonServiceParticipationGate, X as runAgentsEnable, Xa as getProfileDefaultView, Xi as getCurrentCommandCheckState, Xn as runInteractivePrompt, Xo as outLine, Xr as resolveDaemonDeviceId, Xt as runSkillsUninstall, Y as runAgentsDisable, Ya as resolveAuthenticationGuidanceFromMessage, Yi as finishCurrentCommandCheckScope, Yn as isReturnKeypress, Yo as outJsonLine, Yr as ensureDaemonRuntimePaths, Yt as runSkillsInstall, Z as runAgentsList, Za as setProfileDefaultView, Zi as isCurrentCommandCheckScopeActive, Zn as assessCliUpdate, Zo as cliBinaryDeltaPatchSchema, Zr as formatDaemonFailureContextText, Zt as runSkillsUpdate, _ as runSpaceWriteWithPasswordRetry, _a as writeVersionState, _i as describeProfileWorkspacePathValidationFailure, _n as resolveDeviceAuthClientId, _o as formatProfileAwareOpenMeldCliCommands, _r as createSpaceMenuGuideError, _t as runDaemonInterrupt, a as runSpaceDelete, aa as isDaemonServiceJobNeverSpawned, ai as resolveGatewayChainReadiness, an as evaluateCommandAuthentication, ao as unregisterAgentActivityRoute, ar as formatDaemonServiceDowngradeBlockedRecommendation, as as compareAgentControllerRefsForDisplay, at as renderOpenMeldBrandBlockLines, b as buildIdentityOnlyMembersSnapshotForReadProjection, ba as resolveCurrentDaemonExpectedVersion, bi as resolveAgentProfilePrimaryAgentControllerReport, bn as createProfileByKind, bo as syncLocalAgentActivity, br as createSpaceResultGuideError, bt as runDaemonSnapshot, c as runSpaceLeave, ca as readRecentDaemonLifecycleEvents, ci as createModelCatalogReadSession, cn as runAuthMenu, co as installAgentActivityIntegrations, cr as createDoctorFailedGuideError, ct as renderOpenMeldTagline, d as runSpaceRemoveMembers, da as buildNextVersionState, di as normalizeCustomProfileWorkspacePath, dn as buildAuthStatusRows, do as uninstallAgentActivityIntegrations, dr as createProfileMenuGuideError, dt as bestEffortStopCurrentLaneDaemonService, ea as inspectDaemonServiceInventory, ei as resolveCurrentReplyReadinessSnapshot, en as readRuntimeReportingHealthState, eo as LocalDaemonControlPlaneClientError, er as readDispatchOwnedRuntimeGuard, es as cliJsonSkillsLoadEnvelopeSchema, et as runAgentsShow, f as runSpaceSend, fa as compareSemver, fi as readProfileWorkspaceConfig, fn as buildAuthStatusSnapshot, fo as formatInlineOpenMeldCliCommands, fr as createResetConfirmationGuideError, ft as runDaemon, g as runSpaceReadWithPasswordRetry, ga as readVersionState, gi as validateCustomProfileWorkspacePath, gn as requestDeviceToken, go as formatOpenMeldCliTextBlock, gr as createSpaceLeaveGuideError, gt as runDaemonInstall, h as uploadPreparedSpaceFiles, ha as fetchLatestPackageInfo, hi as setOpenMeldManagedProfileWorkspace, hn as fetchAuthUserSnapshot, ho as formatOpenMeldCliLine, hr as createSpaceContractSetGuideError, ht as runDaemonCancel, i as runSpaceCreate, ia as getDaemonSystemServiceLogPath, ii as mapAgentReplyReadinessToLegacyAutoReply, in as ensureCommandAuthenticationOrCancel, io as resolveAgentActivityRouteForPath, ir as resolveElapsedTimeMs, is as revokeOrganizationJoinLinkResponseSchema, it as printOpenMeldBanner, j as assertValidSpaceIdTarget, ja as requireOpenMeldProfile, ji as parseAgentControllerRef, jn as submitRuntimeAgentControllerReports, jo as readAgentActivityOutboxHealth, jr as registerSkillsTargetSelectionOptions, jt as runDaemonStartupPreflight, k as isSpaceCommandOutputHandledError, ka as resolveViewProfileKey, ki as getAgentControllerPermissionModeFieldLabel, kn as submitProfileRuntimeAgentControllerReport, ko as enqueueAgentActivityHookEvent, kr as registerSpaceMemberSelectionOptions, kt as createDelayedSpinner, l as runSpaceList, la as buildInstallSelfJsonPayload, li as resolveProfileWorkspaceRuntime, ln as runAuthStatus, lo as readAgentActivityIntegrationStatus, lr as createProfileActionGuideError, lt as resolveGatewayWebOrigin, m as prepareRequestedSpaceSendFiles, ma as fetchLatestCliBinaryRelease, mi as setCustomProfileWorkspace, mn as extractAuthApiErrorMessage, mo as formatOpenMeldCliCommands, mr as createSpaceAliasTargetGuideError, mt as runDaemonBackgroundStartForDecision, n as promptAndConfirmSpacePassword, na as readCurrentDaemonRuntimeContext, ni as formatDeviceReplyReadinessLabel, nn as connectWebSocket, no as isAgentActivityRouteRegistered, nr as writeDispatchSpaceActionRecord, ns as getOrganizationJoinLinkResponseSchema, nt as colorizeAgentLabel, o as runSpaceHistory, oa as readDaemonServiceJobCrashExitCode, oi as resolveOpenClawLocalDiagnosticsValue, on as runAuthLogin, or as formatDaemonServiceMissingRecommendation, ot as renderOpenMeldHeader, p as runSpaceWatch, pa as ensureVersionStateReady, pi as resolveConfiguredProfileWorkspacePath, pn as formatActiveOrganizationLabel, po as formatOpenMeldCliCommand, pr as createSpaceAddMembersGuideError, pt as runDaemonAutostart, q as runAgentsCustomUpdate, qa as resolveAuthenticationGuidance, qi as resolveOpenMeldEnvironmentTarget, qn as promptSearchMultiselect, qo as emitCliJsonEnvelope, qr as runPendingDaemonServiceUpdate, qt as runSkillsCheck$1, r as runSpaceAddMembers, ra as readCurrentObservedDaemonRuntimeStatus, ri as formatHumanReplyReadinessReason$1, rn as buildCommandAuthenticationPromptMessage, ro as registerAgentActivityRoute, rr as formatElapsedTime, rs as organizationJoinLinkErrorResponseSchema, rt as colorizeDisplayProfileLabel, s as runSpaceJoin, sa as resolveDaemonServiceManager, si as syncProfileWorkspaceState, sn as runAuthLogout, so as defaultManagedIntegrationPaths, sr as canUseInteractivePrompts, st as renderOpenMeldLogo, t as buildCreateSpacePasswordPromptConfig, ta as resolveVersionChangeDirection, ti as formatAgentReplyReadinessLabel, tn as readRecentDaemonDispatchJournalEvents, to as requestLocalAgentActivitySync, tr as readDispatchSpaceActionContextFromEnv, ts as cliJsonSkillsShowEnvelopeSchema, tt as formatTransportModeDisplay, u as runSpacePassword, ua as performManagedInstall, ui as ensureOpenMeldManagedProfileWorkspace, un as exchangeOneTimeTokenAuthSession, uo as resolveAgentActivityDispatcherCommand, ur as createProfileCreateGuideError, ut as resolveSpaceSendText, v as buildHumanReadSignalsTranscriptItems, va as resolveDaemonRuntimeContractCompatibility, vi as syncDeviceRuntimeStateProjection, vn as resolveDeviceTokenExpiresAt, vo as resolveSetupFollowUpCliEntryCommand, vr as createSpacePublicationSetGuideError, vt as runDaemonReinstall, w as buildFormalDispatchResultReadPayload, wa as renderHumanTextErrorCard, wi as notifyDaemonRouteCatalogChanged, wn as ensureAgentProfileRuntimeBinding, wo as removeAgentActivityContextCache, wr as createStartAgentIdentityGuideError, wt as runDaemonUninstall, x as loadSpaceIdentityDirectoryOrNull, xa as OPENMELD_VERSION, xi as listAgentTargetStates, xn as resolveCreateProfileKind, xo as readDaemonServiceContract, xr as createSpaceSubcommandTargetGuideError, xt as runDaemonStatusFlow, y as emitHumanReadSignalsTextProjection, ya as toStartBackgroundHelperExecutionCompatibility, yi as createPrimaryBindingReadSession, yn as revokeAuthAccessToken, yo as resolveUserFacingCliEntryCommand, yr as createSpaceRemoveMembersGuideError, yt as runDaemonRunAfterEntryChecks, z as resolveHumanControllerDisplayName, za as updateOpenMeldProfile, zi as buildOnboardingPlan, zn as buildDispatchResultMessageReadProjection, zo as setDefaultProjectConnection, zr as buildDualViewGuideMessage, zt as toStructuredGatewayFailure } from "./command-BTuYFU2T.js";
+import { $ as ownerComputerDiagnosticsSchema, $t as agentActivityInventorySessionStatusSchema, B as sleep, Bt as agentActivityProviderSchema, Ct as authProfileKindSchema, D as toStructuredApiClientFailure, F as OPENMELD_HEADER_PROFILE_ID, G as projectSpaceDispatchTraceFinalVisibleOutcome, Ht as agentActivitySnapshotQuerySchema, J as spaceDispatchTraceDispatchStatusSchema, K as resolveSpaceDispatchTraceRootCause, Ot as submitFeedbackIssueRequestSchema, Qt as agentActivityInventorySessionOriginSchema, Vt as agentActivitySessionStatusSchema, W as SPACE_DISPATCH_TRACE_RESPONSE_CONTRACT_VERSION_HEADER, X as observabilityWakeTraceSelectorSchema, Y as spaceDispatchTraceResponseSchema, Z as projectObservabilityWakeCorrelation, _ as createOrganizationSkillsApi, b as createProjectsApi, c as createAgentProfileBindingApi, d as createCurrentDeviceApi, dn as START_BOUNDED_ID_SCHEMA, en as agentActivitySessionInventoryQuerySchema, et as projectOwnerComputerLocalRuntimes, f as createFeedbackApi, fn as START_BOUNDED_VERSION_SCHEMA, g as createOrganizationApi, gn as localAgentCatalogSchema, gt as organizationSkillBundleSchema, hn as startReplyReadinessSummarySchema, l as createCenterAgentApi, mn as START_TRIMMED_NON_EMPTY_STRING_SCHEMA, nn as localAgentSessionProviderSchema, nt as DEFAULT_AGENT_PROFILE_CREATION_CONFIGURATION, pn as START_ISO_DATE_TIME_SCHEMA, q as spaceDispatchTraceAttemptStatusSchema, rt as agentProfileCreationConfigurationSchema, s as createAgentActivityApi, tt as summarizeComputerFileAccessPolicy, u as createComputerFileAccessApi, v as createPrepareReadinessApi, wt as authProfileManagedRoleSchema, x as createRoutinesApi, yt as stringifyOrganizationSkillBundleCanonicalJson } from "./dist-BnHChh7U.js";
+import { $n as array, Bt as resolveSpaceFileMimeType, Cr as clientMessageIdSchema, Lt as isSpaceFileTextEditable, Mt as centerAgentInteractionSourceSchema, Wr as openMeldProfileIdSchema, Yr as openMeldRuntimeProfileIdSchema, ar as int, bn as messageEnvelopeSchema, cn as spaceContractSchema, dr as object, er as boolean, hr as string, ii as trimmedStringFromUnknown, ir as enumFactory, jt as spaceStatusSchema, lr as nullFactory, mr as strictObject, ni as nonEmptyTrimmedStringFromUnknown, nn as dispatchExecutionSchema, nr as discriminatedUnion, or as iso, pr as record, rn as spaceThreadContextSchema, sn as spaceContractFieldsSchema, sr as literal, vr as union, yr as unknown } from "./runtime-transport-CHbXitKu.js";
 import { r as daemonServiceLaneSchema } from "./service-contract-CRyDcIIf.js";
-import { j as getDaemonStatus } from "./daemon-runtime-lease-Cvo63MGd.js";
-import { a as getCurrentAuthOwnerUserId, c as updateAuthSessionActiveOrganization, d as resolveOpenMeldDistribution, i as getAuthSessionState, l as runMacOsNativeKeychainHelperIfRequested, n as clearAuthSession, o as normalizeStoredActiveOrganization, r as getAuthSessionMetadata, u as isBinaryDistribution } from "./auth-session-qk94UQqs.js";
-import { c as buildRequestAuthHeaders, d as buildOpenMeldRequestContextFromProfile, n as createCliApiClientFoundation, p as deriveAuthBaseUrlFromGatewayUrl, r as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth } from "./api-client-foundation-w4Oa06t4.js";
+import { j as getDaemonStatus } from "./daemon-runtime-lease-D82uDZ5s.js";
+import { _ as isBinaryDistribution, a as clearAuthSession, c as getAuthSessionState, d as markInterruptedComputerAuthSessionRecovery, f as normalizeStoredActiveOrganization, g as runMacOsNativeKeychainHelperIfRequested, h as updateAuthSessionActiveOrganization, i as beginAuthSessionTransition, l as getCurrentAuthOwnerUserId, o as completeInterruptedComputerAuthSessionRecovery, p as recordInterruptedComputerAuthSessionRecoveryFailure, s as getAuthSessionMetadata, t as AuthSessionRecoveryInProgressError, u as getInterruptedComputerAuthSessionRecovery, v as resolveOpenMeldDistribution } from "./auth-session-B1jSy0ws.js";
+import { c as buildOpenMeldRequestContextHeadersWithAuth, d as buildOpenMeldRequestContextFromProfile, l as buildRequestAuthHeaders, n as createCliApiClientFoundation, p as deriveAuthBaseUrlFromGatewayUrl, r as fetchSpaceRequestWithTimeout } from "./api-client-foundation-eG7A-GEB.js";
 import { Command, Option } from "commander";
 import os, { homedir, hostname, release, tmpdir } from "node:os";
 import * as z$1 from "zod/v4";
@@ -3399,7 +3399,7 @@ async function resolveUpgradeStatus(input) {
 			distribution,
 			currentVersion: input.currentVersion,
 			checkedAt: input.checkedAt,
-			error: toErrorMessage$7(error)
+			error: toErrorMessage$9(error)
 		};
 	}
 }
@@ -3483,7 +3483,7 @@ function parseInstallSelfJsonOutput(output) {
 	try {
 		parsed = JSON.parse(jsonLine);
 	} catch (error) {
-		throw new Error(`binary install-self emitted invalid JSON: ${toErrorMessage$7(error)}`);
+		throw new Error(`binary install-self emitted invalid JSON: ${toErrorMessage$9(error)}`);
 	}
 	if (!parsed || typeof parsed !== "object") throw new Error("binary install-self emitted an invalid JSON payload");
 	const record = parsed;
@@ -3820,7 +3820,7 @@ function emitUpgradeCompleted(input) {
 		text: "OpenMeld CLI upgrade completed."
 	});
 }
-function toErrorMessage$7(error) {
+function toErrorMessage$9(error) {
 	if (error instanceof Error) return error.message;
 	return String(error);
 }
@@ -5546,7 +5546,7 @@ const CHOOSE_PROFILE = "__command_entry_choose_profile__";
 const CREATE_PROFILE = "__command_entry_create_profile__";
 const CANCEL_PROFILE = "__command_entry_cancel_profile__";
 async function runSelectedProfileCheck(input) {
-	const explicitProfileArg = normalizeOptionalString$13(input.context.profileArg);
+	const explicitProfileArg = normalizeOptionalString$16(input.context.profileArg);
 	const hasExplicitProfileArg = explicitProfileArg !== null;
 	const requiresConfirmation = input.requirement.mode === "confirm" && input.context.runtime.resolvedView === "human" && input.context.allowPrompt && !hasExplicitProfileArg;
 	const currentState = getCurrentCommandCheckState();
@@ -5719,7 +5719,7 @@ function ensureCurrentProfileIsVisible(input) {
 function resolveProfileConfirmationMessage(entryName) {
 	return entryName === "space.join" ? SPACE_JOIN_PROFILE_SELECTION_MESSAGE : SPACE_COMMAND_PROFILE_SELECTION_MESSAGE;
 }
-function normalizeOptionalString$13(value) {
+function normalizeOptionalString$16(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -6270,6 +6270,13 @@ const PASSIVE_CLI_QUERY_FLAGS = /* @__PURE__ */ new Set([
 	"-V",
 	"-h"
 ]);
+const PASSIVE_CLI_QUERY_COMMANDS = /* @__PURE__ */ new Set([
+	"auth status",
+	"service snapshot",
+	"service status",
+	"service trace",
+	"whoami"
+]);
 function isStandaloneViewQueryArgv(argv) {
 	const args = argv.slice(2);
 	return args.length === 1 && args[0] === "--view";
@@ -6346,7 +6353,7 @@ function isPassiveCliQueryArgv(argv) {
 		if (arg.startsWith("--view=") || arg.startsWith("--service-auto-install=")) continue;
 		if (arg === "help" || PASSIVE_CLI_QUERY_FLAGS.has(arg)) return true;
 	}
-	return false;
+	return PASSIVE_CLI_QUERY_COMMANDS.has(parseLeadingCommandTokensFromArgv(argv, 2).join(" "));
 }
 function hasJsonOutputArgv(argv) {
 	for (let i = 2; i < argv.length; i += 1) {
@@ -6418,7 +6425,7 @@ async function runCommandWithEntryChecks(input) {
 				allowPrompt: runtime.interactive,
 				environmentTarget,
 				gatewayUrl: normalizedGatewayUrl,
-				profileArg: normalizeOptionalString$12(input.profile),
+				profileArg: normalizeOptionalString$15(input.profile),
 				jsonOutput
 			}),
 			jsonOutput
@@ -6427,7 +6434,7 @@ async function runCommandWithEntryChecks(input) {
 		finishCurrentCommandCheckScope();
 	}
 }
-function normalizeOptionalString$12(value) {
+function normalizeOptionalString$15(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -7534,8 +7541,8 @@ function normalizeOrganizationSelectionPayload(payload) {
 		message: "OpenMeld auth returned an invalid Organization selection."
 	});
 	return {
-		activeOrganizationId: normalizeOptionalString$11(payload.session.activeOrganizationId),
-		lastSelectedOrganizationId: normalizeOptionalString$11(payload.user.lastSelectedOrganizationId)
+		activeOrganizationId: normalizeOptionalString$14(payload.session.activeOrganizationId),
+		lastSelectedOrganizationId: normalizeOptionalString$14(payload.user.lastSelectedOrganizationId)
 	};
 }
 function normalizeOrganizationListPayload(payload) {
@@ -7567,7 +7574,7 @@ function normalizeOrganizationFromPayload(payload) {
 	if (!isRecord(payload)) return null;
 	const organization = normalizeStoredActiveOrganization(payload.organization);
 	if (!organization) return null;
-	const role = normalizeOptionalString$11(payload.role) ?? (isRecord(payload.member) ? normalizeOptionalString$11(payload.member.role) : null);
+	const role = normalizeOptionalString$14(payload.role) ?? (isRecord(payload.member) ? normalizeOptionalString$14(payload.member.role) : null);
 	return {
 		...organization,
 		...role ? { role } : {}
@@ -7637,13 +7644,13 @@ function parseJsonOrNull(raw) {
 }
 function readRequestId(payload) {
 	if (!isRecord(payload)) return null;
-	return normalizeOptionalString$11(payload.requestId) ?? (isRecord(payload.error) ? normalizeOptionalString$11(payload.error.requestId) : null);
+	return normalizeOptionalString$14(payload.requestId) ?? (isRecord(payload.error) ? normalizeOptionalString$14(payload.error.requestId) : null);
 }
 function readErrorMessage(payload) {
 	if (!isRecord(payload)) return null;
-	return normalizeOptionalString$11(payload.message) ?? (isRecord(payload.error) ? normalizeOptionalString$11(payload.error.message) : null);
+	return normalizeOptionalString$14(payload.message) ?? (isRecord(payload.error) ? normalizeOptionalString$14(payload.error.message) : null);
 }
-function normalizeOptionalString$11(value) {
+function normalizeOptionalString$14(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -8051,7 +8058,7 @@ async function createCenterAgentApiClient(input) {
 const CODEX_THREAD_ID_ENV = "CODEX_THREAD_ID";
 const CLAUDE_CODE_SESSION_ID_ENV = "CLAUDE_CODE_SESSION_ID";
 function detectLocalAgentEnvironment(env) {
-	const claudeSessionId = normalizeOptionalString$10(env[CLAUDE_CODE_SESSION_ID_ENV]);
+	const claudeSessionId = normalizeOptionalString$13(env[CLAUDE_CODE_SESSION_ID_ENV]);
 	if (claudeSessionId) return {
 		kind: "agent",
 		agentControllerConversationId: claudeSessionId,
@@ -8059,7 +8066,7 @@ function detectLocalAgentEnvironment(env) {
 		conversationKind: "session",
 		label: "Claude Code"
 	};
-	const codexThreadId = normalizeOptionalString$10(env[CODEX_THREAD_ID_ENV]);
+	const codexThreadId = normalizeOptionalString$13(env[CODEX_THREAD_ID_ENV]);
 	if (codexThreadId) return {
 		kind: "agent",
 		agentControllerConversationId: codexThreadId,
@@ -8071,9 +8078,9 @@ function detectLocalAgentEnvironment(env) {
 	return { kind: "human" };
 }
 function isCodexLikeEnvironment(env) {
-	return Boolean(normalizeOptionalString$10(env.CODEX_SHELL) || normalizeOptionalString$10(env.CODEX_CI) || normalizeOptionalString$10(env.CODEX_SESSION_ID) || normalizeOptionalString$10(env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE));
+	return Boolean(normalizeOptionalString$13(env.CODEX_SHELL) || normalizeOptionalString$13(env.CODEX_CI) || normalizeOptionalString$13(env.CODEX_SESSION_ID) || normalizeOptionalString$13(env.CODEX_INTERNAL_ORIGINATOR_OVERRIDE));
 }
-function normalizeOptionalString$10(value) {
+function normalizeOptionalString$13(value) {
 	if (typeof value !== "string") return null;
 	const normalized = value.trim();
 	return normalized.length > 0 ? normalized : null;
@@ -9453,6 +9460,190 @@ function formatLastSeen(lastObservedAtMs) {
 	}).format(new Date(lastObservedAtMs))}`;
 }
 //#endregion
+//#region src/commands/computer-auth-session.ts
+async function exchangeComputerAuthorizationGrant(input) {
+	const authBaseUrl = resolveAuthBaseUrl(input.authBaseUrl);
+	const clientId = resolveDeviceAuthClientId(input.clientId);
+	const tokenResult = await requestDeviceToken({
+		authBaseUrl,
+		clientId,
+		deviceCode: normalizeRequiredString(input.deviceCode, "computer authorization code is required")
+	});
+	if (!tokenResult.ok) throw new Error(`computer authorization failed: ${extractAuthApiErrorMessage(tokenResult.error, tokenResult.status)}`);
+	let user;
+	try {
+		user = await fetchAuthUserSnapshot({
+			authBaseUrl,
+			accessToken: tokenResult.data.access_token
+		});
+	} catch (error) {
+		const cleanup = await revokeAuthAccessToken({
+			accessToken: tokenResult.data.access_token,
+			authBaseUrl,
+			tokenType: tokenResult.data.token_type
+		});
+		throw new Error(`computer authorization could not verify its OpenMeld account: ${toErrorMessage$8(error)}${formatCleanupFailure(cleanup)}`, { cause: error });
+	}
+	const userId = normalizeOptionalString$12(user?.id);
+	if (!userId) {
+		const cleanup = await revokeAuthAccessToken({
+			accessToken: tokenResult.data.access_token,
+			authBaseUrl,
+			tokenType: tokenResult.data.token_type
+		});
+		throw new Error(`computer authorization account response did not include a user id${formatCleanupFailure(cleanup)}`);
+	}
+	const expiresAt = resolveDeviceTokenExpiresAt(tokenResult.data.expires_in);
+	const scope = normalizeOptionalString$12(tokenResult.data.scope);
+	return {
+		accessToken: tokenResult.data.access_token,
+		tokenType: tokenResult.data.token_type,
+		authBaseUrl,
+		clientId,
+		...expiresAt ? { expiresAt } : {},
+		...scope ? { scope } : {},
+		user: {
+			...user,
+			id: userId
+		}
+	};
+}
+function revokePreparedAuthSession(session) {
+	return revokeAuthAccessToken(session);
+}
+function formatCleanupFailure(result) {
+	if (result.ok) return "";
+	const status = result.error.status === null ? "network error" : `HTTP ${result.error.status}`;
+	return `; cleanup failed at ${result.error.endpoint} (${status}): ${result.error.message}`;
+}
+function toErrorMessage$8(error) {
+	return error instanceof Error && error.message.trim() ? error.message.trim() : String(error ?? "unknown error");
+}
+function normalizeRequiredString(value, message) {
+	const normalized = normalizeOptionalString$12(value);
+	if (!normalized) throw new Error(message);
+	return normalized;
+}
+function normalizeOptionalString$12(value) {
+	const normalized = String(value ?? "").trim();
+	return normalized.length > 0 ? normalized : null;
+}
+//#endregion
+//#region src/commands/computer-auth-handoff-recovery.ts
+const UNUSED_SETUP_SESSION_CLEANUP_SUFFIX = " OpenMeld also could not revoke the unused setup session.";
+async function recoverInterruptedComputerAuthHandoff(input) {
+	const recovery = await getInterruptedComputerAuthSessionRecovery();
+	if (!recovery) return "none";
+	const previousOwnerUserId = normalizeOptionalString$11(recovery.previousSession?.user?.id);
+	if (!recovery.serviceReconciled) {
+		const stopped = await bestEffortStopCurrentLaneDaemonService({ runtime: input.runtime });
+		if (stopped.status === "warning") {
+			const error = new Error(stopped.errorMessage ?? "OpenMeld could not stop the incomplete Computer connection.");
+			await recordInterruptedComputerAuthSessionRecoveryFailure({
+				id: recovery.id,
+				message: error.message,
+				phase: "service"
+			});
+			logDeferredComputerAuthHandoffRecovery({
+				error: error.message,
+				phase: "service",
+				transitionId: recovery.id
+			});
+			throw error;
+		}
+		if (previousOwnerUserId) {
+			const restored = await runDaemonServiceParticipationGate({
+				intent: "start",
+				presenter: input.presenter,
+				resolvedView: input.runtime.resolvedView,
+				allowPrompt: false,
+				autoRepair: true,
+				expectedOwnerUserId: previousOwnerUserId,
+				forcePrompt: true,
+				forceRefresh: true,
+				gatewayUrl: recovery.gatewayUrl,
+				suppressRefreshHumanResultCard: true,
+				suppressStartSpinner: true,
+				view: input.view
+			});
+			if (restored.status !== "aligned") {
+				const error = new Error(restored.errorMessage ?? "OpenMeld could not reconnect the previous Computer account.");
+				await recordInterruptedComputerAuthSessionRecoveryFailure({
+					id: recovery.id,
+					message: error.message,
+					phase: "service"
+				});
+				logDeferredComputerAuthHandoffRecovery({
+					error: error.message,
+					phase: "service",
+					transitionId: recovery.id
+				});
+				throw error;
+			}
+		}
+		await markInterruptedComputerAuthSessionRecovery({
+			id: recovery.id,
+			phase: "service"
+		});
+	}
+	if (!recovery.remoteSessionRevoked) {
+		const revoked = await revokePreparedAuthSession(recovery.candidateSession);
+		if (!revoked.ok) {
+			await recordInterruptedComputerAuthSessionRecoveryFailure({
+				endpoint: revoked.error.endpoint,
+				id: recovery.id,
+				message: revoked.error.message,
+				phase: "remote_session",
+				status: revoked.error.status
+			});
+			logDeferredComputerAuthHandoffRecovery({
+				endpoint: revoked.error.endpoint,
+				error: revoked.error.message,
+				phase: "remote_session",
+				status: revoked.error.status,
+				transitionId: recovery.id
+			});
+			emitUnusedSetupSessionCleanupWarning(input.presenter, revoked.error);
+			return "deferred";
+		}
+		await markInterruptedComputerAuthSessionRecovery({
+			id: recovery.id,
+			phase: "remote_session"
+		});
+	}
+	return await completeInterruptedComputerAuthSessionRecovery(recovery.id) ? "completed" : "deferred";
+}
+function logDeferredComputerAuthHandoffRecovery(input) {
+	console.warn("[openmeld.auth.computer_handoff_recovery_deferred]", {
+		...input.endpoint ? { endpoint: input.endpoint } : {},
+		error: input.error,
+		phase: input.phase,
+		...input.status === void 0 ? {} : { status: input.status },
+		transitionId: input.transitionId
+	});
+}
+function emitUnusedSetupSessionCleanupWarning(presenter, cleanupError) {
+	presenter.line({
+		code: "setup.computer_authorization.cleanup_warning",
+		text: "OpenMeld kept the current Computer sign-in, but could not revoke the unused setup session. You can remove it later from Account sessions.",
+		data: {
+			endpoint: cleanupError.endpoint ?? null,
+			status: cleanupError.status ?? null,
+			error: cleanupError.message
+		}
+	});
+}
+function formatComputerAuthCleanupFailureSuffix(result) {
+	if (result.ok) return "";
+	const status = result.error.status === null ? "network error" : `HTTP ${result.error.status}`;
+	return `${UNUSED_SETUP_SESSION_CLEANUP_SUFFIX} Cleanup endpoint ${result.error.endpoint} returned ${status}: ${result.error.message}`;
+}
+function normalizeOptionalString$11(value) {
+	if (typeof value !== "string") return null;
+	const normalized = value.trim();
+	return normalized.length > 0 ? normalized : null;
+}
+//#endregion
 //#region src/local-service/diagnostics/runtime-reporting-health-diagnostic.ts
 const REPORTING_SUCCESS_STALE_AFTER_MS = 30 * 6e4;
 const REPORTING_DEGRADED_FAILURE_THRESHOLD = 3;
@@ -9888,7 +10079,7 @@ async function runDoctorProfileCheck(input) {
 		}
 		openMeldProfile = {
 			ok: false,
-			message: `openmeld-profile failed: ${toErrorMessage$6(error)}`
+			message: `openmeld-profile failed: ${toErrorMessage$7(error)}`
 		};
 	}
 	emitCheckResult(input.presenter, openMeldProfile, {
@@ -10406,7 +10597,7 @@ async function runCheck(label, fn) {
 	} catch (err) {
 		return {
 			ok: false,
-			message: `${label} failed: ${toErrorMessage$6(err)}`
+			message: `${label} failed: ${toErrorMessage$7(err)}`
 		};
 	}
 }
@@ -10540,7 +10731,7 @@ async function maybePromptRepairAfterLogin(presenter) {
 function normalizeDoctorHumanText(text) {
 	return text.replace(DOCTOR_TEXT_PREFIX_RE, "");
 }
-function toErrorMessage$6(err) {
+function toErrorMessage$7(err) {
 	if (err instanceof Error) return err.message;
 	return String(err);
 }
@@ -10612,11 +10803,11 @@ function resolveDaemonRouteSkipMessage(input) {
 	return `Reply route checks were skipped because the OpenMeld profile check failed: ${input.openMeldProfileMessage}`;
 }
 function resolveFeedbackInboxKey(input) {
-	const fromCli = normalizeOptionalString$9(input.cliValue);
+	const fromCli = normalizeOptionalString$10(input.cliValue);
 	if (fromCli) return fromCli;
-	return normalizeOptionalString$9((input.env ?? process.env).OPENMELD_FEEDBACK_INBOX_KEY) ?? "feedback_key_8oDRg9Aq-Q4crzVGV6hUqhKT2dQpKkBn4bKg9bjXLcE";
+	return normalizeOptionalString$10((input.env ?? process.env).OPENMELD_FEEDBACK_INBOX_KEY) ?? "feedback_key_8oDRg9Aq-Q4crzVGV6hUqhKT2dQpKkBn4bKg9bjXLcE";
 }
-function normalizeOptionalString$9(value) {
+function normalizeOptionalString$10(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -10900,7 +11091,7 @@ async function activateManagedCommandOrWarn(outcome) {
 		if (activationNotice) process$1.stderr.write(`${activationNotice}\n`);
 		if (activation.status === "unsupported_shell") process$1.stderr.write(`OpenMeld installed the CLI, but could not add the openmeld command to this shell automatically. Add ${dirname(outcome.currentPointerPath)} to your shell PATH.\n`);
 	} catch (error) {
-		process$1.stderr.write(`OpenMeld installed the CLI, but could not update your shell PATH: ${toErrorMessage$5(error)}. The managed command is ${outcome.currentPointerPath}.\n`);
+		process$1.stderr.write(`OpenMeld installed the CLI, but could not update your shell PATH: ${toErrorMessage$6(error)}. The managed command is ${outcome.currentPointerPath}.\n`);
 	}
 }
 function formatInstallSelfHuman(outcome) {
@@ -10908,7 +11099,7 @@ function formatInstallSelfHuman(outcome) {
 	if (outcome.result === "noop_same_version") return `OpenMeld CLI ${outcome.version} is already installed. Nothing to do.\n`;
 	return `A newer OpenMeld CLI (${outcome.previousVersion}) is already installed; keeping it. Use --force to install ${outcome.version} anyway.\n`;
 }
-function toErrorMessage$5(error) {
+function toErrorMessage$6(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
@@ -10957,7 +11148,7 @@ async function resolveAgentControllerPermissionModeInput(input) {
 		value: input.agentControllerPermissionModeInput
 	});
 	if (!agentControllerPermissionMode) return { hasAnyAgentControllerPermissionModeInput: false };
-	const agentControllerRef = normalizeOptionalString$8(input.agentControllerRef);
+	const agentControllerRef = normalizeOptionalString$9(input.agentControllerRef);
 	assertAgentControllerPermissionModeSupported({
 		agentControllerPermissionMode,
 		agentControllerRef,
@@ -10978,7 +11169,7 @@ async function resolveAgentControllerPermissionModeInput(input) {
 	};
 }
 function normalizeAgentControllerPermissionModeCliInput(input) {
-	const raw = normalizeOptionalString$8(input.value);
+	const raw = normalizeOptionalString$9(input.value);
 	if (!raw) return null;
 	const options = listAgentControllerPermissionModeOptions(input.agentControllerRef ? { agentControllerRef: input.agentControllerRef } : void 0);
 	for (const option of options) if (raw === option.value) return option.value;
@@ -11081,7 +11272,7 @@ const AGENT_CONTROLLER_PERMISSION_MODE_BY_CLI_VALUE = {
 	"run-everything": "cursor:force",
 	runeverything: "cursor:force"
 };
-function normalizeOptionalString$8(value) {
+function normalizeOptionalString$9(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -11445,7 +11636,7 @@ async function runProfileShow(input) {
 	}
 	const presenter = createPresenter(runtime);
 	const allowPrompt = canUseInteractivePrompts(runtime);
-	const explicitProfileId = normalizeOptionalString$7(input.profile);
+	const explicitProfileId = normalizeOptionalString$8(input.profile);
 	const visibleProfiles = explicitProfileId ? [] : await listVisibleProfilesForListByView(runtime.resolvedView);
 	const current = explicitProfileId ? null : await resolveCurrentProfileId({
 		profiles: visibleProfiles,
@@ -11927,7 +12118,7 @@ async function runProfileUpdate(input) {
 	}
 	const presenter = createPresenter(runtime);
 	const allowPrompt = canUseInteractivePrompts(runtime);
-	const explicitProfileId = normalizeOptionalString$7(input.profile);
+	const explicitProfileId = normalizeOptionalString$8(input.profile);
 	const visibleProfiles = explicitProfileId ? [] : await listVisibleProfilesForListByView(runtime.resolvedView);
 	const current = explicitProfileId ? null : await resolveCurrentProfileId({
 		profiles: visibleProfiles,
@@ -12155,7 +12346,7 @@ function emitProfileUpdateCandidatesForHuman(input) {
 	}
 }
 async function resolveProfileUpdatePayload(input) {
-	const profileName = normalizeOptionalString$7(input.profileName);
+	const profileName = normalizeOptionalString$8(input.profileName);
 	const explicitAgentController = await resolveExplicitAgentControllerPatchForProfile({
 		agentController: input.agentController,
 		agentControllerConversationId: input.agentControllerConversationId,
@@ -12200,7 +12391,7 @@ async function resolveProfileUpdatePayload(input) {
 }
 function resolveExplicitWorkspacePatchForProfile(input) {
 	const normalizedMode = normalizeWorkspaceModeInput(input.workspaceMode);
-	const normalizedWorkspacePath = normalizeOptionalString$7(input.workspacePath);
+	const normalizedWorkspacePath = normalizeOptionalString$8(input.workspacePath);
 	if (!(normalizedMode || normalizedWorkspacePath)) return null;
 	if (input.profile.profileKind !== "agent") throw new Error("Workspace can only be configured for agent profiles.");
 	if (!normalizedMode) throw new Error("--workspace-path can only be used with --workspace-mode custom.");
@@ -12233,7 +12424,7 @@ function resolveExplicitModelSelectionPatchForProfile(input) {
 	};
 }
 async function resolveExplicitAgentControllerPermissionModePatchForProfile(input) {
-	if (!normalizeOptionalString$7(input.agentControllerPermissionModeInput)) return null;
+	if (!normalizeOptionalString$8(input.agentControllerPermissionModeInput)) return null;
 	if (input.profile.profileKind !== "agent") throw new Error("Agent Controller Permission Mode can only be configured for agent profiles.");
 	const currentBinding = input.agentControllerRef ? null : await resolveAgentProfilePrimaryAgentControllerReport({ profile: input.profile });
 	const agentControllerRef = input.agentControllerRef ?? currentBinding?.agentControllerRef ?? null;
@@ -12252,8 +12443,8 @@ async function resolveExplicitAgentControllerPermissionModePatchForProfile(input
 	};
 }
 async function resolveExplicitAgentControllerPatchForProfile(input) {
-	const agentController = normalizeOptionalString$7(input.agentController);
-	const agentControllerConversationId = normalizeOptionalString$7(input.agentControllerConversationId);
+	const agentController = normalizeOptionalString$8(input.agentController);
+	const agentControllerConversationId = normalizeOptionalString$8(input.agentControllerConversationId);
 	if (!(agentController || agentControllerConversationId)) return null;
 	if (input.profile.profileKind !== "agent") throw new Error("Agent controller can only be configured for agent profiles.");
 	if (!agentController) throw new Error("--agent-controller-conversation-id requires --agent-controller.");
@@ -12267,7 +12458,7 @@ async function resolveExplicitAgentControllerPatchForProfile(input) {
 	};
 }
 async function applyAgentProfileControllerBinding(input) {
-	const agentControllerRef = normalizeOptionalString$7(input.agentControllerRef);
+	const agentControllerRef = normalizeOptionalString$8(input.agentControllerRef);
 	const hasModelSelectionPatch = input.modelId !== void 0;
 	if (!(agentControllerRef || hasModelSelectionPatch)) return;
 	if (input.profile.profileKind !== "agent") throw new Error("Agent controller can only be configured for agent profiles.");
@@ -12405,7 +12596,7 @@ async function promptWorkspacePayload(profile) {
 		});
 		if (workspacePath.status === "cancelled") return { status: "cancelled" };
 		if (workspacePath.status === "back") continue;
-		const customWorkspacePath = normalizeOptionalString$7(workspacePath.value);
+		const customWorkspacePath = normalizeOptionalString$8(workspacePath.value);
 		if (!customWorkspacePath) throw new Error("Custom workspace path is required.");
 		return {
 			status: "submitted",
@@ -12510,7 +12701,7 @@ async function promptModelSelectionPayload(profile) {
 	});
 	if (isCancel(selectedReasoningLevel)) return { status: "cancelled" };
 	if (selectedReasoningLevel === BACK_UPDATE_FIELD_SELECTION) return { status: "back" };
-	const reasoningLevel = normalizeOptionalString$7(selectedReasoningLevel);
+	const reasoningLevel = normalizeOptionalString$8(selectedReasoningLevel);
 	return {
 		status: "submitted",
 		value: {
@@ -12578,7 +12769,7 @@ async function promptProfileNamePayload(currentProfileName) {
 	});
 	if (nextName.status === "cancelled") return { status: "cancelled" };
 	if (nextName.status === "back") return { status: "back" };
-	const profileName = normalizeOptionalString$7(nextName.value);
+	const profileName = normalizeOptionalString$8(nextName.value);
 	if (!profileName) throw new Error("profileName is required");
 	return {
 		status: "submitted",
@@ -12834,11 +13025,11 @@ function buildProfileSearchItem(input) {
 function buildProfileSearchText(profile) {
 	return [
 		profile.openMeldProfileId,
-		normalizeOptionalString$7(profile.profileName),
+		normalizeOptionalString$8(profile.profileName),
 		profile.profileKind,
-		normalizeOptionalString$7(profile.ownerUserId),
-		normalizeOptionalString$7(profile.ownerName),
-		normalizeOptionalString$7(profile.source)
+		normalizeOptionalString$8(profile.ownerUserId),
+		normalizeOptionalString$8(profile.ownerName),
+		normalizeOptionalString$8(profile.source)
 	].filter((value) => typeof value === "string").join("\n");
 }
 function resolveProfileSelectLabel(input) {
@@ -12889,7 +13080,7 @@ function normalizeProfileDisplayName(profile) {
 }
 function normalizeAgentControllerArgumentInput(input) {
 	const agentController = String(input.agentController ?? "").trim();
-	const agentControllerConversationId = normalizeOptionalString$7(input.agentControllerConversationId);
+	const agentControllerConversationId = normalizeOptionalString$8(input.agentControllerConversationId);
 	const hasControllerEnabled = typeof input.controllerEnabled === "boolean";
 	const hasAnyAgentControllerInput = Boolean(agentController) || Boolean(agentControllerConversationId) || hasControllerEnabled;
 	return {
@@ -13097,7 +13288,7 @@ function resolveProfileUpdateCommandExamples() {
 function toProfileActionGuideExamples(_input) {
 	return {};
 }
-function normalizeOptionalString$7(value) {
+function normalizeOptionalString$8(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -13108,8 +13299,8 @@ function normalizeWorkspaceModeInput(value) {
 	throw new Error("--workspace-mode must be openmeld-managed|custom");
 }
 function normalizeModelSelectionInput(input) {
-	const modelId = normalizeOptionalString$7(input.model);
-	const reasoningLevel = normalizeOptionalString$7(input.reasoningEffort);
+	const modelId = normalizeOptionalString$8(input.model);
+	const reasoningLevel = normalizeOptionalString$8(input.reasoningEffort);
 	if (!(modelId || reasoningLevel)) return { hasAnyModelSelectionInput: false };
 	if (!modelId) throw new Error("--reasoning-effort requires --model.");
 	return {
@@ -13664,7 +13855,7 @@ async function resolvePrepareReadinessApiEvidence(input) {
 	} catch (error) {
 		console.warn("[openmeld.prepare_readiness.api_read_failed]", {
 			event: "cli.prepare_readiness.api_read_failed",
-			error: toErrorMessage$4(error),
+			error: toErrorMessage$5(error),
 			profileId: input.profile.openMeldProfileId
 		});
 		return unavailableEvidence({
@@ -13705,7 +13896,7 @@ function unavailableEvidence(input) {
 		status: "unavailable"
 	};
 }
-function toErrorMessage$4(error) {
+function toErrorMessage$5(error) {
 	if (error instanceof Error) {
 		const message = error.message.trim();
 		return message.length > 0 ? message : "unknown error";
@@ -14118,10 +14309,10 @@ function resolveDaemonDispatchJournalEvidence(dispatchId) {
 	};
 }
 async function resolveDispatchTraceSelection(input) {
-	const dispatchSelector = normalizeOptionalString$6(input.dispatchId);
-	const sourceSignalSelector = normalizeOptionalString$6(input.sourceSignalId);
-	const clientMessageSelector = normalizeOptionalString$6(input.clientMessageId);
-	const targetProfileSelector = normalizeOptionalString$6(input.targetProfileId);
+	const dispatchSelector = normalizeOptionalString$7(input.dispatchId);
+	const sourceSignalSelector = normalizeOptionalString$7(input.sourceSignalId);
+	const clientMessageSelector = normalizeOptionalString$7(input.clientMessageId);
+	const targetProfileSelector = normalizeOptionalString$7(input.targetProfileId);
 	if (Number(dispatchSelector !== null) + Number(sourceSignalSelector !== null) + Number(clientMessageSelector !== null) !== 1) throw new Error("exactly one of dispatchId, sourceSignalId, or clientMessageId is required");
 	if (dispatchSelector) return {
 		dispatchId: dispatchSelector,
@@ -14628,7 +14819,7 @@ function parenthesizedDetail(value, label) {
 	return detail.length > 0 ? detail : null;
 }
 async function resolveServiceTraceActorProfile(input) {
-	if (normalizeOptionalString$6(input.explicitProfileId) || !canUseInteractivePrompts(input.runtime)) return input.actingProfile;
+	if (normalizeOptionalString$7(input.explicitProfileId) || !canUseInteractivePrompts(input.runtime)) return input.actingProfile;
 	while (true) {
 		const selectedAction = await select({
 			message: `Use ${input.actingProfile.profileName} (${input.actingProfile.openMeldProfileId}) to read this dispatch trace?`,
@@ -15509,7 +15700,7 @@ function truncateText(text, maxLength) {
 	if (text.length <= maxLength) return text;
 	return `${text.slice(0, maxLength)}...`;
 }
-function normalizeOptionalString$6(value) {
+function normalizeOptionalString$7(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -16199,7 +16390,7 @@ async function runSetupFirstBootstrap(input) {
 		const stepError = error instanceof SetupBootstrapStepError ? error : null;
 		const cause = stepError?.causeValue ?? error;
 		const failedStep = stepError?.step ?? "unknown";
-		const message = toErrorMessage$3(cause);
+		const message = toErrorMessage$4(cause);
 		console.warn("[openmeld.setup.bootstrap.failed]", {
 			event: "cli.setup.bootstrap.failed",
 			error: message,
@@ -16263,13 +16454,13 @@ var SetupBootstrapStepError = class extends Error {
 	causeValue;
 	step;
 	constructor(step, causeValue) {
-		super(`${step}: ${toErrorMessage$3(causeValue)}`);
+		super(`${step}: ${toErrorMessage$4(causeValue)}`);
 		this.name = "SetupBootstrapStepError";
 		this.step = step;
 		this.causeValue = causeValue;
 	}
 };
-function toErrorMessage$3(error) {
+function toErrorMessage$4(error) {
 	if (error instanceof Error && error.message.trim().length > 0) return error.message;
 	if (typeof error === "string" && error.trim().length > 0) return error;
 	return "Unknown setup bootstrap error.";
@@ -16337,7 +16528,7 @@ async function acquireSetupCommandLockWithTakeover(input) {
 		pid,
 		startedAtLabel
 	};
-	if (!(normalizeOptionalString$5(input.startSession) !== null && pid !== null && pid !== deps.selfPid && deps.probePid(pid) === "alive")) return {
+	if (!(normalizeOptionalString$6(input.startSession) !== null && pid !== null && pid !== deps.selfPid && deps.probePid(pid) === "alive")) return {
 		status: "contended",
 		...contendedBase,
 		takeoverAttempted: false
@@ -16574,7 +16765,7 @@ function getErrorCode(error) {
 	const code = error.code;
 	return typeof code === "string" ? code : void 0;
 }
-function normalizeOptionalString$5(value) {
+function normalizeOptionalString$6(value) {
 	const normalized = String(value ?? "").trim();
 	return normalized.length > 0 ? normalized : null;
 }
@@ -16862,7 +17053,7 @@ var PrepareSessionCancelledError = class extends Error {
 	}
 };
 async function runPrepareSessionExecutor(input) {
-	let initial = await resolvePrepareSessionToken({
+	let initial = input.initialSnapshot ?? await resolvePrepareSessionForHandoff({
 		gatewayUrl: input.gatewayUrl,
 		opaqueToken: input.startSession
 	});
@@ -16921,7 +17112,7 @@ async function reconnectPrepareSession(input) {
 		if (Date.now() >= deadlineMs) break;
 		let snapshot;
 		try {
-			snapshot = await resolvePrepareSessionToken({
+			snapshot = await resolvePrepareSessionForHandoff({
 				gatewayUrl: input.input.gatewayUrl,
 				opaqueToken: input.input.startSession
 			});
@@ -17818,7 +18009,7 @@ function buildPrepareSessionExecutorCompletionFacts(input) {
 	};
 }
 function isTransientSelectedAgentConnectionError(error) {
-	const rawMessage = toErrorMessage$2(error).toLowerCase();
+	const rawMessage = toErrorMessage$3(error).toLowerCase();
 	return rawMessage.includes("service has not finished starting") || rawMessage.includes("openmeld service is not running") || rawMessage.includes("service.not_running") || rawMessage.includes("service_contract_unavailable") || rawMessage.includes("runtime.reporting.write_failed");
 }
 async function finishPrepareSetup() {
@@ -18079,7 +18270,7 @@ async function connectPrepareSessionStream(input) {
 		}
 	};
 }
-async function resolvePrepareSessionToken(input) {
+async function resolvePrepareSessionForHandoff(input) {
 	const response = await fetchSpaceRequestWithTimeout({
 		url: new URL("/v1/prepare/sessions/resolve-token", input.gatewayUrl).toString(),
 		operation: "prepare.session.resolve_token",
@@ -18186,7 +18377,7 @@ function toStatusCodeSlug(title) {
 	const slug = title.toLowerCase().replaceAll(/[^a-z0-9]+/g, "_").replaceAll(/^_+|_+$/g, "");
 	return slug.length > 0 ? slug : "status";
 }
-function toErrorMessage$2(error) {
+function toErrorMessage$3(error) {
 	if (error instanceof Error) {
 		const message = error.message.trim();
 		return message.length > 0 ? message : "unknown error";
@@ -18225,6 +18416,193 @@ function errorFromPrepareSessionServerError(input) {
 	return new Error(input.message);
 }
 //#endregion
+//#region src/commands/computer-auth-handoff.ts
+function runComputerAuthorizationHandoff(input) {
+	return runPreparedComputerAuthHandoff({
+		...input,
+		exchangeCandidate: async () => await exchangeComputerAuthorizationGrant({ deviceCode: input.deviceCode })
+	});
+}
+function runOneTimeTokenComputerHandoff(input) {
+	return runPreparedComputerAuthHandoff({
+		...input,
+		exchangeCandidate: async () => await exchangeOneTimeTokenAuthSession({
+			authBaseUrl: resolveAuthBaseUrl(),
+			clientId: "openmeld-cli",
+			token: input.oneTimeToken
+		})
+	});
+}
+async function runPreparedComputerAuthHandoff(input) {
+	if (await recoverInterruptedComputerAuthHandoff({
+		presenter: input.presenter,
+		runtime: input.runtime,
+		view: input.view
+	}) === "deferred") throw new AuthSessionRecoveryInProgressError();
+	const gatewayUrl = await resolveBaseUrl();
+	const initialSnapshot = await resolvePrepareSessionForHandoff({
+		gatewayUrl,
+		opaqueToken: input.startSession
+	});
+	const candidate = await input.exchangeCandidate();
+	await assertPrepareSessionOwner({
+		candidate,
+		ownerUserId: initialSnapshot.ownerUserId
+	});
+	if (!await confirmComputerAccountSwitch({
+		candidate,
+		currentSession: await resolveCurrentComputerSession(candidate),
+		interactive: input.interactive,
+		presenter: input.presenter,
+		resolvedView: input.runtime.resolvedView
+	})) {
+		const revoked = await revokePreparedAuthSession(candidate);
+		if (!revoked.ok) emitUnusedSetupSessionCleanupWarning(input.presenter, revoked.error);
+		return {
+			reason: "user_cancelled",
+			status: "not_completed"
+		};
+	}
+	const transition = await beginComputerSessionTransition({
+		candidate,
+		gatewayUrl
+	});
+	try {
+		const sessionResult = await runPrepareSessionExecutor({
+			gatewayUrl,
+			initialSnapshot,
+			startSession: input.startSession,
+			runtime: input.runtime,
+			presenter: input.presenter,
+			interactive: input.interactive,
+			localAgentSelection: input.localAgentSelection,
+			view: input.view
+		});
+		if (sessionResult.status !== "completed") {
+			await restorePreviousComputerAfterFailedHandoff({
+				candidate,
+				gatewayUrl,
+				presenter: input.presenter,
+				runtime: input.runtime,
+				transition,
+				view: input.view
+			});
+			return sessionResult;
+		}
+		await transition.commit();
+		return sessionResult;
+	} catch (error) {
+		try {
+			await restorePreviousComputerAfterFailedHandoff({
+				candidate,
+				gatewayUrl,
+				presenter: input.presenter,
+				runtime: input.runtime,
+				transition,
+				view: input.view
+			});
+		} catch (recoveryError) {
+			throw new Error(`Computer setup failed, and OpenMeld could not restore the previous local account: ${toErrorMessage$2(recoveryError)}`, { cause: error });
+		}
+		throw error;
+	}
+}
+async function assertPrepareSessionOwner(input) {
+	if (input.candidate.user.id === input.ownerUserId) return;
+	const revoked = await revokePreparedAuthSession(input.candidate);
+	throw new Error(`This setup command and its computer authorization belong to different OpenMeld accounts. Copy a fresh setup command from OpenMeld Web and try again.${formatComputerAuthCleanupFailureSuffix(revoked)}`);
+}
+async function resolveCurrentComputerSession(candidate) {
+	let currentState;
+	try {
+		currentState = await getAuthSessionState({ validateRemote: false });
+	} catch (error) {
+		const revoked = await revokePreparedAuthSession(candidate);
+		throw new Error(`OpenMeld could not inspect the current Computer sign-in. The current Computer connection was not changed. ${toErrorMessage$2(error)}${formatComputerAuthCleanupFailureSuffix(revoked)}`, { cause: error });
+	}
+	if (currentState.state === "missing" || currentState.session) return currentState.session;
+	const revoked = await revokePreparedAuthSession(candidate);
+	const detail = normalizeOptionalString$5(currentState.errorMessage) ?? normalizeOptionalString$5(currentState.reasonCode);
+	throw new Error(`OpenMeld could not inspect the current Computer sign-in. The current Computer connection was not changed.${detail ? ` ${detail}` : ""}${formatComputerAuthCleanupFailureSuffix(revoked)}`);
+}
+async function beginComputerSessionTransition(input) {
+	try {
+		return await beginAuthSessionTransition(input.candidate, { computerHandoff: { gatewayUrl: input.gatewayUrl } });
+	} catch (error) {
+		const revoked = await revokePreparedAuthSession(input.candidate);
+		if (!revoked.ok) throw new Error(`OpenMeld could not save the new Computer sign-in.${formatComputerAuthCleanupFailureSuffix(revoked)} ${toErrorMessage$2(error)}`, { cause: error });
+		throw error;
+	}
+}
+async function confirmComputerAccountSwitch(input) {
+	const currentUserId = normalizeOptionalString$5(input.currentSession?.user?.id);
+	if (!input.currentSession) return true;
+	if (!currentUserId) {
+		const revoked = await revokePreparedAuthSession(input.candidate);
+		throw new Error(`OpenMeld could not verify the account currently connected to this Computer. The current Computer connection was not changed.${formatComputerAuthCleanupFailureSuffix(revoked)}`);
+	}
+	if (currentUserId === input.candidate.user.id) return true;
+	const currentAccount = normalizeOptionalString$5(input.currentSession?.user?.email) ?? "the current account";
+	const nextAccount = normalizeOptionalString$5(input.candidate.user.email) ?? "another account";
+	if (!input.interactive || input.resolvedView !== "human") {
+		const revoked = await revokePreparedAuthSession(input.candidate);
+		throw new Error(`This computer is signed in as ${currentAccount}, but the setup command uses ${nextAccount}. Run the setup command in an interactive Terminal to review and confirm the account switch. The current Computer connection was not changed.${formatComputerAuthCleanupFailureSuffix(revoked)}`);
+	}
+	const confirmed = await confirm({
+		initialValue: false,
+		message: `Switch this computer from ${currentAccount} to ${nextAccount}?`
+	});
+	if (isCancel(confirmed) || !confirmed) {
+		input.presenter.line({
+			code: "setup.account_switch.cancelled",
+			text: "Account switch canceled. The current Computer connection was not changed."
+		});
+		return false;
+	}
+	return true;
+}
+async function restorePreviousComputerAfterFailedHandoff(input) {
+	await input.transition.rollback();
+	if (await recoverInterruptedComputerAuthHandoff({
+		presenter: input.presenter,
+		runtime: input.runtime,
+		view: input.view
+	}) === "none") await restoreLegacyComputerAuthTransition(input);
+}
+async function restoreLegacyComputerAuthTransition(input) {
+	const revoked = await revokePreparedAuthSession(input.candidate);
+	if (!revoked.ok) emitUnusedSetupSessionCleanupWarning(input.presenter, revoked.error);
+	const previousOwnerUserId = normalizeOptionalString$5(input.transition.previousSession?.user?.id);
+	if (!previousOwnerUserId) {
+		const stopped = await bestEffortStopCurrentLaneDaemonService({ runtime: input.runtime });
+		if (stopped.status === "warning") throw new Error(stopped.errorMessage ?? "OpenMeld could not stop the incomplete Computer connection.");
+		return;
+	}
+	const restored = await runDaemonServiceParticipationGate({
+		intent: "start",
+		presenter: input.presenter,
+		resolvedView: input.runtime.resolvedView,
+		allowPrompt: false,
+		autoRepair: true,
+		expectedOwnerUserId: previousOwnerUserId,
+		forcePrompt: true,
+		forceRefresh: true,
+		gatewayUrl: input.gatewayUrl,
+		suppressRefreshHumanResultCard: true,
+		suppressStartSpinner: true,
+		view: input.view
+	});
+	if (restored.status !== "aligned") throw new Error(restored.errorMessage ?? "OpenMeld could not reconnect the previous Computer account.");
+}
+function normalizeOptionalString$5(value) {
+	if (typeof value !== "string") return null;
+	const normalized = value.trim();
+	return normalized.length > 0 ? normalized : null;
+}
+function toErrorMessage$2(error) {
+	return error instanceof Error && error.message.trim() ? error.message.trim() : String(error ?? "unknown error");
+}
+//#endregion
 //#region src/commands/setup-local-agent-connection.ts
 const LOCAL_AGENT_CONNECTION_CARD_TITLE = "Local Agent Connection";
 const RETIRED_HUMAN_PROFILE_SETUP_MESSAGE = "This OpenMeld Web setup command is retired. Run `openmeld setup` to set up this computer, or open the org-scoped Connect page in OpenMeld Web and copy a fresh setup command.";
@@ -18242,6 +18620,26 @@ async function runSetupLocalAgentConnection(input) {
 		view: runtime.resolvedView
 	});
 	if (input.humanProfile) throw new Error(RETIRED_HUMAN_PROFILE_SETUP_MESSAGE);
+	const deviceCode = normalizeOptionalString$4(input.deviceCode);
+	if (input.startSession && deviceCode) return buildPrepareSessionSetupResult(await runComputerAuthorizationHandoff({
+		deviceCode,
+		interactive,
+		localAgentSelection: resolvePrepareSessionLocalAgentSelection(input),
+		presenter,
+		runtime,
+		startSession: input.startSession,
+		view: input.view
+	}));
+	const oneTimeToken = normalizeOptionalString$4(input.ott);
+	if (input.startSession && oneTimeToken) return buildPrepareSessionSetupResult(await runOneTimeTokenComputerHandoff({
+		oneTimeToken,
+		interactive,
+		localAgentSelection: resolvePrepareSessionLocalAgentSelection(input),
+		presenter,
+		runtime,
+		startSession: input.startSession,
+		view: input.view
+	}));
 	await maybeLogInWithOneTimeToken$1({
 		ott: input.ott,
 		view: input.view
@@ -18258,19 +18656,15 @@ async function runSetupLocalAgentConnection(input) {
 			status: "not_completed"
 		};
 	}
-	if (input.startSession) {
-		const sessionResult = await runPrepareSessionExecutor({
-			gatewayUrl: await resolveBaseUrl(),
-			startSession: input.startSession,
-			runtime,
-			presenter,
-			interactive,
-			localAgentSelection: resolvePrepareSessionLocalAgentSelection(input),
-			view: input.view
-		});
-		if (sessionResult.status !== "completed") return resolveIncompletePrepareSessionSetupResult(sessionResult);
-		return buildCompletedSetupSessionResult(sessionResult);
-	}
+	if (input.startSession) return buildPrepareSessionSetupResult(await runPrepareSessionExecutor({
+		gatewayUrl: await resolveBaseUrl(),
+		startSession: input.startSession,
+		runtime,
+		presenter,
+		interactive,
+		localAgentSelection: resolvePrepareSessionLocalAgentSelection(input),
+		view: input.view
+	}));
 	if (input.agent && input.agent.length > 0) {
 		await runAgentsRepair({
 			agent: input.agent,
@@ -18358,6 +18752,9 @@ function resolveIncompletePrepareSessionSetupResult(sessionResult) {
 		status: "not_completed"
 	};
 }
+function buildPrepareSessionSetupResult(sessionResult) {
+	return sessionResult.status === "completed" ? buildCompletedSetupSessionResult(sessionResult) : resolveIncompletePrepareSessionSetupResult(sessionResult);
+}
 function buildCompletedSetupSessionResult(sessionResult) {
 	return {
 		...sessionResult.completionFacts ? { completionFacts: sessionResult.completionFacts } : {},
@@ -18386,6 +18783,8 @@ function emitSetupLocalAgentConnectionHeader(input) {
 }
 function assertValidSetupLocalAgentConnectionInput(input) {
 	const facts = resolveSetupLocalAgentConnectionInputFacts(input);
+	if (normalizeOptionalString$4(input.deviceCode) && !facts.hasStartSession) throw new Error("--device-code requires --start-session.");
+	if (normalizeOptionalString$4(input.deviceCode) && normalizeOptionalString$4(input.ott)) throw new Error("use either --device-code or --ott, not both");
 	if (facts.hasStartSession && (facts.hasProfile || facts.hasHumanProfile || facts.hasLocalAgentPreparation)) throw new Error("--start-session cannot be combined with --profile, --human-profile, or --agent.");
 	if (!facts.hasStartSession && facts.hasPrepareSessionLocalAgentMode) throw new Error("--local-agents requires --start-session.");
 	assertValidLocalAgentSelectionInput({
@@ -27435,7 +27834,7 @@ function normalizeOptionalString(value) {
 	return normalized.length > 0 ? normalized : null;
 }
 async function runDefaultSpaceAddMeMembership(input) {
-	const { runSpaceAddMeMembership } = await import("./add-me-membership-BCGn5T-D.js");
+	const { runSpaceAddMeMembership } = await import("./add-me-membership-CoSmA50L.js");
 	return await runSpaceAddMeMembership(input);
 }
 //#endregion
@@ -31108,7 +31507,7 @@ withStartOptions(program.command("start").description("Initial onboarding: set u
 		}
 	});
 });
-program.command("setup").description("Set up this computer for OpenMeld Space Wake.").option("--profile <id>", "Existing OpenMeld agent profile ID to connect to this computer").option("--agent <id...>", "Builtin local agent ID to repair directly when you already know the target").option("--human-profile <id>", "Retired OpenMeld Web setup flag; copy a fresh setup command from OpenMeld Web instead").option("--ott <token>", "One-time token to sign in on this device before setup").option("--start-session <opaque-token>", "Continue an OpenMeld Web Prepare setup command on this device").option("--local-agents <mode>", "Select local agents during setup: all or none").option("--local-agent <id...>", "Select specific local agent IDs during setup").option("--reset-this-computer", "Stop stale local OpenMeld Service state before reconnecting this computer").addHelpText("after", buildCommandHelpExamples("Primary entry points", [
+program.command("setup").description("Set up this computer for OpenMeld Space Wake.").option("--profile <id>", "Existing OpenMeld agent profile ID to connect to this computer").option("--agent <id...>", "Builtin local agent ID to repair directly when you already know the target").option("--human-profile <id>", "Retired OpenMeld Web setup flag; copy a fresh setup command from OpenMeld Web instead").option("--ott <token>", "One-time token to sign in on this device before setup").option("--device-code <code>", "Browser-approved code used to create this computer's independent sign-in session").option("--start-session <opaque-token>", "Continue an OpenMeld Web Prepare setup command on this device").option("--local-agents <mode>", "Select local agents during setup: all or none").option("--local-agent <id...>", "Select specific local agent IDs during setup").option("--reset-this-computer", "Stop stale local OpenMeld Service state before reconnecting this computer").addHelpText("after", buildCommandHelpExamples("Primary entry points", [
 	"openmeld setup",
 	"openmeld setup --start-session <opaque-token> --local-agents all",
 	"openmeld setup --profile <agent-profile-id> --local-agent <local-agent-id>"
@@ -31121,6 +31520,7 @@ program.command("setup").description("Set up this computer for OpenMeld Space Wa
 		run: async () => {
 			await runSetup({
 				agent: opts.agent,
+				deviceCode: opts.deviceCode,
 				humanProfile: opts.humanProfile,
 				localAgent: opts.localAgent,
 				localAgents: opts.localAgents,
@@ -32313,10 +32713,10 @@ serviceCmd.command("trace").description("Read a Space delivery trace for debuggi
 		profile: opts.profile,
 		gatewayUrl: opts.gatewayUrl,
 		run: async () => {
-			const dispatchId = normalizeOptionalString$12(opts.dispatch);
-			const sourceSignalId = normalizeOptionalString$12(opts.sourceSignal);
-			const clientMessageId = normalizeOptionalString$12(opts.clientMessage);
-			const targetProfileId = normalizeOptionalString$12(opts.targetProfile);
+			const dispatchId = normalizeOptionalString$15(opts.dispatch);
+			const sourceSignalId = normalizeOptionalString$15(opts.sourceSignal);
+			const clientMessageId = normalizeOptionalString$15(opts.clientMessage);
+			const targetProfileId = normalizeOptionalString$15(opts.targetProfile);
 			if (Number(dispatchId !== null) + Number(sourceSignalId !== null) + Number(clientMessageId !== null) !== 1) throw new Error("exactly one of --dispatch, --source-signal, or --client-message is required");
 			await runServiceTrace({
 				profile: opts.profile,
@@ -32507,7 +32907,7 @@ spaceActionCmd.command("help").description("Show OpenMeld Space Action help.").a
 withSpaceProfileOption(spaceCmd.command("create").description("Create a new space and print its space ID.").option("--name <name>", "Space name (<=80 chars; prompted in human interactive mode)").option("--visibility <public|private>", "Organization visibility for this space").option("--guide <text>", "Optional space guide").option("--password <value>", "Optional space password (minimum 6 characters; numbers/letters/symbols accepted)").option("--join", "Join immediately after create").option("--no-join", "Do not ask to join after create").option("--output <mode>", "Output mode when auto-joining: ndjson|text", "text")).action(async (opts, command) => {
 	const cliOptions = resolveSpaceCommandCliOptions(command, opts);
 	const view = getGlobalViewOption();
-	if (view === "agent" && (normalizeOptionalString$12(opts.name) === null || normalizeOptionalString$12(opts.visibility) === null)) {
+	if (view === "agent" && (normalizeOptionalString$15(opts.name) === null || normalizeOptionalString$15(opts.visibility) === null)) {
 		await runSpaceCreate({
 			profile: cliOptions.profile,
 			baseUrl: cliOptions.gatewayUrl,
@@ -32567,7 +32967,7 @@ withSpaceProfileOption(spaceCmd.command("join").description("Open an existing Sp
 	const localEcho = opts.noLocalEcho !== true;
 	const view = getGlobalViewOption();
 	if (opts.selfServe === true) {
-		const spaceValue = normalizeOptionalString$12(space);
+		const spaceValue = normalizeOptionalString$15(space);
 		if (!spaceValue) throw Object.assign(/* @__PURE__ */ new Error("space join --self-serve requires an explicit public Organization Space ID"), { code: "space.join.self_serve.space_required" });
 		await runCommandWithEntryChecks({
 			routeTokens: [
@@ -32591,7 +32991,7 @@ withSpaceProfileOption(spaceCmd.command("join").description("Open an existing Sp
 		});
 		return;
 	}
-	if (view === "agent" && normalizeOptionalString$12(space) === null) {
+	if (view === "agent" && normalizeOptionalString$15(space) === null) {
 		await runSpaceJoin({
 			profile: cliOptions.profile,
 			baseUrl: cliOptions.gatewayUrl,
@@ -32643,8 +33043,8 @@ withSpaceProfileOption(spaceCmd.command("wake-progress").description("Read live
 				profile: cliOptions.profile,
 				baseUrl: cliOptions.gatewayUrl,
 				space: String(space),
-				clientMessageId: normalizeOptionalString$12(opts.clientMessage) ?? void 0,
-				targetProfileId: normalizeOptionalString$12(opts.targetProfile) ?? void 0,
+				clientMessageId: normalizeOptionalString$15(opts.clientMessage) ?? void 0,
+				targetProfileId: normalizeOptionalString$15(opts.targetProfile) ?? void 0,
 				password: cliOptions.password,
 				view,
 				entryChecksHandled: true
@@ -32665,10 +33065,10 @@ withSpaceProfileOption(spaceCmd.command("wake-stop").description("Request Stop f
 				profile: cliOptions.profile,
 				baseUrl: cliOptions.gatewayUrl,
 				space: String(space),
-				clientMessageId: normalizeOptionalString$12(opts.clientMessage) ?? void 0,
-				sourceSignalId: normalizeOptionalString$12(opts.sourceSignal) ?? void 0,
+				clientMessageId: normalizeOptionalString$15(opts.clientMessage) ?? void 0,
+				sourceSignalId: normalizeOptionalString$15(opts.sourceSignal) ?? void 0,
 				targetProfileId: String(opts.targetProfile),
-				reason: normalizeOptionalString$12(opts.reason) ?? void 0,
+				reason: normalizeOptionalString$15(opts.reason) ?? void 0,
 				password: cliOptions.password,
 				view,
 				entryChecksHandled: true
@@ -33176,8 +33576,8 @@ withSpaceProfileOption(spaceCmd.command("updates").description("Read formal upda
 withSpaceProfileOption(spaceCmd.command("result").description("Read one formal dispatch result scoped to this space.").argument("[space]", "Space ID (64-character hex)").option("--dispatch <dispatch-id>", "Lookup by dispatch ID").option("--result-ref <result-ref>", "Lookup by dispatch result ref").option("--json", "Print canonical JSON", false).option("--password <value>", "Space password for protected access")).action(async (space, opts, command) => {
 	const cliOptions = resolveSpaceCommandCliOptions(command, opts);
 	const spaceValue = String(space ?? "").trim();
-	const dispatchId = normalizeOptionalString$12(opts.dispatch);
-	const resultRef = normalizeOptionalString$12(opts.resultRef);
+	const dispatchId = normalizeOptionalString$15(opts.dispatch);
+	const resultRef = normalizeOptionalString$15(opts.resultRef);
 	const selectorCount = Number(dispatchId !== null) + Number(resultRef !== null);
 	const outputView = await resolveEffectiveViewForOutput();
 	if ((spaceValue.length === 0 || selectorCount !== 1) && outputView === "agent") throw createSpaceResultGuideError();
@@ -33805,6 +34205,16 @@ function isDispatchSpaceActionToolServerArgv(argv) {
 async function runLocalCli(argv) {
 	try {
 		await ensureSystemLayout();
+		const [startupCommand, startupSubcommand] = parseLeadingCommandTokensFromArgv(argv, 2);
+		if (!(isPassiveCliQueryArgv(argv) || startupCommand === "service" && startupSubcommand === "run")) await recoverInterruptedComputerAuthHandoff({
+			presenter: createSilentPresenter("agent"),
+			runtime: {
+				interactive: false,
+				resolvedView: "agent",
+				viewMode: "agent"
+			},
+			view: "agent"
+		});
 		const removedCcInputMessage = getRemovedCcCliInputMessage(argv);
 		if (removedCcInputMessage) throw new Error(removedCcInputMessage);
 		const retiredCommandMessage = resolveRetiredCliCommandMessage(argv);