@agentsky/sky 2.11.0 → 2.13.0

package/dist/index.js

@@ -1,4 +1,15 @@
 #!/usr/bin/env node
+import {
+  ApiError,
+  api,
+  apiBytes,
+  apiForm,
+  downloadFile,
+  postEvents,
+  resolveSessionRef,
+  streamEvents,
+  uploadFile
+} from "./chunk-XJ5JLLXM.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -9,12 +20,13 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-RWPPIEHH.js";
+} from "./chunk-Z3FPPGWX.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
   MODEL_SUBSCRIPTION_PROVIDER_NAME,
   REASONING_EFFORT_VALUES,
+  SessionSourceCollector,
   capabilitiesSchema,
   customDataSchema,
   defaultLlm,
@@ -28,165 +40,15 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-WC7GJSAJ.js";
+} from "./chunk-2IKEJ74C.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename4, resolve as resolve6 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename5, resolve as resolve7 } from "path";
 import { createInterface as createInterface4 } from "readline";
 import { Command } from "commander";
 
-// src/api.ts
-var ApiError = class extends Error {
-  constructor(status, code, message2) {
-    super(message2);
-    this.status = status;
-    this.code = code;
-  }
-  status;
-  code;
-};
-function authHeaders() {
-  const token = apiToken();
-  if (!token) {
-    throw new ApiError(401, "not_logged_in", "not logged in \u2014 run `sky auth login`");
-  }
-  const headers = { authorization: `Bearer ${token}` };
-  const universe2 = currentUniverse();
-  if (universe2) headers["x-universe"] = universe2;
-  return headers;
-}
-async function parseError(res) {
-  let code = "http_error";
-  let message2 = `${res.status} ${res.statusText}`;
-  try {
-    const body = await res.json();
-    if (body.error?.message) {
-      code = body.error.code ?? code;
-      message2 = body.error.message;
-    }
-  } catch {
-  }
-  throw new ApiError(res.status, code, message2);
-}
-async function api(method, path, body, opts = {}) {
-  const res = await fetch(`${apiBase()}${path}`, {
-    method,
-    headers: {
-      "user-agent": USER_AGENT,
-      ...opts.auth === false ? {} : authHeaders(),
-      ...body !== void 0 ? { "content-type": "application/json" } : {},
-      ...opts.idempotencyKey ? { "idempotency-key": opts.idempotencyKey } : {}
-    },
-    body: body !== void 0 ? JSON.stringify(body) : void 0
-  });
-  if (!res.ok) await parseError(res);
-  if (res.status === 204) return void 0;
-  return await res.json();
-}
-async function postEvents(sessionId, events, idempotencyKey) {
-  const res = await fetch(`${apiBase()}/sessions/${encodeURIComponent(sessionId)}/events`, {
-    method: "POST",
-    headers: {
-      "user-agent": USER_AGENT,
-      ...authHeaders(),
-      "content-type": "application/json",
-      ...idempotencyKey ? { "idempotency-key": idempotencyKey } : {}
-    },
-    body: JSON.stringify({ events })
-  });
-  if (!res.ok) await parseError(res);
-  return await res.json();
-}
-async function uploadFile(bytes, filename, mediaType, expiresInSeconds) {
-  const form = new FormData();
-  form.append("file", new Blob([new Uint8Array(bytes)], { type: mediaType }), filename);
-  if (expiresInSeconds) form.append("expires_in_seconds", String(expiresInSeconds));
-  const res = await fetch(`${apiBase()}/files`, {
-    method: "POST",
-    headers: { "user-agent": USER_AGENT, ...authHeaders() },
-    body: form
-  });
-  if (!res.ok) await parseError(res);
-  return await res.json();
-}
-async function apiForm(method, path, form) {
-  const res = await fetch(`${apiBase()}${path}`, {
-    method,
-    headers: { "user-agent": USER_AGENT, ...authHeaders() },
-    body: form
-  });
-  if (!res.ok) await parseError(res);
-  return await res.json();
-}
-async function downloadFile(fileId) {
-  const res = await fetch(`${apiBase()}/files/${encodeURIComponent(fileId)}/content`, {
-    headers: { "user-agent": USER_AGENT, ...authHeaders() }
-  });
-  if (!res.ok) await parseError(res);
-  return { bytes: new Uint8Array(await res.arrayBuffer()), mediaType: res.headers.get("content-type") ?? "application/octet-stream" };
-}
-async function apiBytes(method, path, body) {
-  const res = await fetch(`${apiBase()}${path}`, {
-    method,
-    headers: {
-      "user-agent": USER_AGENT,
-      ...authHeaders(),
-      ...body ? { "content-type": body.mediaType } : {}
-    },
-    body: body ? new Uint8Array(body.bytes) : void 0
-  });
-  if (!res.ok) await parseError(res);
-  const bytes = new Uint8Array(await res.arrayBuffer());
-  return {
-    bytes,
-    mediaType: res.headers.get("content-type") ?? "application/octet-stream",
-    json: () => JSON.parse(new TextDecoder().decode(bytes))
-  };
-}
-async function resolveSessionRef(ref) {
-  if (ref.startsWith("sess-")) return ref;
-  const { agent: agent2 } = await api(
-    "GET",
-    `/agents/${encodeURIComponent(ref)}`
-  ).catch(async () => {
-    await api("GET", `/sessions/${encodeURIComponent(ref)}`);
-    return { agent: { id: ref, defaultSessionId: ref } };
-  });
-  if (!agent2.defaultSessionId) {
-    throw new ApiError(
-      404,
-      "no_sessions",
-      `agent ${agent2.id} has no sessions \u2014 create one: sky session create ${agent2.id}`
-    );
-  }
-  return agent2.defaultSessionId;
-}
-async function* streamEvents(sessionId, signal) {
-  const { parseSseStream } = await import("./src-HVCP3PPM.js");
-  const res = await fetch(
-    `${apiBase()}/sessions/${encodeURIComponent(sessionId)}/stream`,
-    {
-      headers: { "user-agent": USER_AGENT, ...authHeaders(), accept: "text/event-stream" },
-      signal
-    }
-  );
-  if (!res.ok) await parseError(res);
-  if (!res.body) throw new ApiError(502, "no_body", "stream returned no body");
-  try {
-    for await (const frame of parseSseStream(res.body)) {
-      if (!frame.data) continue;
-      try {
-        yield { id: frame.id, event: frame.event, data: JSON.parse(frame.data) };
-      } catch {
-      }
-    }
-  } catch (error) {
-    if (!(error instanceof DOMException && error.name === "AbortError")) throw error;
-  }
-}
-
 // src/files.ts
 import { readFileSync } from "fs";
 import { basename, extname } from "path";
@@ -306,6 +168,123 @@ function renderGoal(goal2) {
   return lines.join("\n");
 }
 
+// src/account.ts
+var DOLLARS = /^\d+(?:\.\d{1,2})?$/;
+function dollarsToCents(flag, value) {
+  const trimmed = value.trim().replace(/^\$/, "");
+  if (!DOLLARS.test(trimmed)) throw new Error(`${flag} must be a dollar amount like 20 or 20.00, got ${JSON.stringify(value)}`);
+  const [whole, fraction = ""] = trimmed.split(".");
+  const cents = Number(whole) * 100 + Number(fraction.padEnd(2, "0"));
+  if (cents <= 0) throw new Error(`${flag} must be more than $0`);
+  return String(cents);
+}
+function wholeDollars(flag, value) {
+  const trimmed = value.trim().replace(/^\$/, "");
+  if (!/^\d+$/.test(trimmed)) throw new Error(`${flag} must be whole dollars, got ${JSON.stringify(value)}`);
+  return Number(trimmed);
+}
+function autoTopupBody(opts) {
+  if (opts.on && opts.off) throw new Error("pass --on or --off, not both");
+  const body = {};
+  if (opts.on) body.enabled = true;
+  if (opts.off) body.enabled = false;
+  if (opts.threshold !== void 0) body.threshold_usd = wholeDollars("--threshold", opts.threshold);
+  if (opts.amount !== void 0) body.amount_usd = wholeDollars("--amount", opts.amount);
+  return Object.keys(body).length ? body : null;
+}
+var usd = (value) => `$${value.toFixed(2)}`;
+var centsUsd = (money) => `$${(Number(money.amount) / 100).toFixed(2)}`;
+function renderAutoTopup(settings) {
+  const state = settings.enabled ? `on \u2014 below ${usd(settings.threshold_usd)}, the saved card adds ${usd(settings.amount_usd)}` : `off${settings.opted_out ? " (you turned it off)" : ""} \u2014 would add ${usd(settings.amount_usd)} below ${usd(settings.threshold_usd)}`;
+  const lines = [`auto top-up: ${state}`];
+  if (settings.card_on_file === false) lines.push("  no saved card \u2014 `sky billing card` adds one");
+  if (settings.failure) lines.push(`  last charge failed${settings.failure.paused ? " (paused)" : ""}: ${settings.failure.reason}`);
+  return lines.join("\n");
+}
+function renderBalance(balance) {
+  return `balance: ${usd(balance.balance_usd)}   card on file: ${balance.card_on_file ? "yes" : "no"}`;
+}
+function renderTopup(result) {
+  return result.charged ? `Charged your saved card. Balance: ${centsUsd(result.balance)}` : `Already bought with this request id \u2014 not charged again. Balance: ${centsUsd(result.balance)}`;
+}
+function measureLine(m) {
+  return `${String(m.calls).padStart(6)} calls  ${String(m.inputTokens).padStart(10)} in  ${String(m.outputTokens).padStart(9)} out  ${`$${m.billedCostUsd.toFixed(4)}`.padStart(10)}`;
+}
+function renderUsage(summary) {
+  const lines = [`usage ${summary.range.from} \u2192 ${summary.range.to} (end exclusive), by ${summary.groupBy}`];
+  for (const group of summary.groups) {
+    lines.push(`  ${group.label.padEnd(28).slice(0, 28)} ${group.source.padEnd(8)} ${measureLine(group)}`);
+  }
+  if (!summary.groups.length) lines.push("  no usage in this range");
+  lines.push(`  ${"total".padEnd(37)} ${measureLine(summary.totals)}`);
+  return lines.join("\n");
+}
+function usageQuery(opts) {
+  const params = new URLSearchParams();
+  if (opts.from) params.set("from", opts.from);
+  if (opts.to) params.set("to", opts.to);
+  if (opts.groupBy) params.set("group_by", opts.groupBy);
+  if (opts.source) params.set("source", opts.source);
+  if (opts.key) params.set("api_key_id", opts.key);
+  if (opts.format) params.set("format", opts.format);
+  const query = params.toString();
+  return query ? `?${query}` : "";
+}
+function apiKeyBody(name, opts) {
+  const scopes = (opts.scopes ?? "read,write").split(",").map((scope) => scope.trim()).filter(Boolean);
+  const unknown = scopes.find((scope) => !["read", "write", "admin"].includes(scope));
+  if (unknown) throw new Error(`--scopes takes read, write and admin, got ${JSON.stringify(unknown)}`);
+  if (!scopes.length) throw new Error("--scopes needs at least one scope");
+  return {
+    name: name.trim(),
+    scopes,
+    ...opts.workspace !== void 0 ? { universe: opts.workspace === "personal" ? null : opts.workspace } : {},
+    ...opts.expires !== void 0 ? { expires_at: opts.expires } : {}
+  };
+}
+function renderApiKey(key) {
+  const where = key.universe ? `workspace ${key.universe}` : "any workspace";
+  const used = key.last_used_at ? `used ${key.last_used_at.slice(0, 10)}` : "never used";
+  return `${key.id}  ${key.token_prefix}\u2026  ${key.status.padEnd(7)} ${key.scopes.join(",").padEnd(16)} ${where}  ${used}  ${key.name}${key.current ? "  (this key)" : ""}`;
+}
+
+// src/context.ts
+function memoryBody(operation, version) {
+  return { ...operation, expectedVersion: version };
+}
+function memoryIndex(value) {
+  if (!/^\d+$/.test(value.trim())) throw new Error(`the entry number must be a whole number, got ${JSON.stringify(value)}`);
+  return Number(value.trim());
+}
+function renderMemory(document) {
+  if (!document.entries.length) return "no saved memory \u2014 `sky memory save <text>` adds an entry";
+  return document.entries.map((entry2) => `${String(entry2.index).padStart(3)}  ${entry2.text}`).join("\n");
+}
+function searchQuery(query, opts) {
+  const params = new URLSearchParams({ q: query });
+  params.set("scope", opts.scope ?? "sessions");
+  if (opts.limit) params.set("limit", opts.limit);
+  if (opts.cursor) params.set("cursor", opts.cursor);
+  if (opts.since) params.set("since", opts.since);
+  if (opts.until) params.set("until", opts.until);
+  return `?${params.toString()}`;
+}
+function refArgument(ref) {
+  return `'${JSON.stringify(ref).replace(/'/g, "'\\''")}'`;
+}
+function renderContextPage(page) {
+  const lines = [];
+  for (const { hit } of page.hits) {
+    lines.push(`${hit.source.padEnd(8)} ${hit.occurredAt?.slice(0, 10) ?? "          "}  ${hit.title}`);
+    lines.push(`         ${hit.snippet.replace(/\s+/g, " ").slice(0, 160)}`);
+    lines.push(`         sky context read ${refArgument(hit.ref)}`);
+  }
+  if (!page.hits.length) lines.push("no matches on this page");
+  if (page.partial) lines.push(`partial: ${page.coverage ?? "not every source was searched"}`);
+  if (page.nextCursor) lines.push(`more: --cursor ${page.nextCursor}`);
+  return lines.join("\n");
+}
+
 // src/agent-file.ts
 import { existsSync, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { dirname, resolve } from "path";
@@ -841,10 +820,222 @@ async function clone(opts) {
 }
 
 // src/import-local.ts
-import { closeSync, existsSync as existsSync3, openSync, readdirSync, readFileSync as readFileSync4, readSync, statSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { closeSync, existsSync as existsSync4, openSync, readdirSync, readFileSync as readFileSync5, readSync, statSync as statSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
 import { createHash } from "crypto";
+
+// src/import-files.ts
+import { isUtf8 } from "buffer";
+import { existsSync as existsSync3, readFileSync as readFileSync4, statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, extname as extname2, isAbsolute, join as join2, relative, resolve as resolve3, sep, basename as basename3 } from "path";
+var MAX_ATTACHED_FILE_BYTES = 10 * 1024 * 1024;
+var SECRET_FILE = /(^|\/)(\.env(\..*)?|\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.?credentials(\.json)?|auth\.json|\.claude\.json|id_(rsa|ed25519|ecdsa)[^/]*|.*\.(pem|key|p12|pfx|keystore|jks|kdbx|sqlite|db))$|\/\.ssh\/|\/\.aws\/|\/\.gnupg\/|\/\.docker\/config\.json$|\/Keychains\//i;
+var SKIP_DIR = /(^|\/)(node_modules|\.git|\.next|dist|build|__pycache__|\.venv)(\/|$)/;
+var INSTRUCTION_FILES = ["CLAUDE.md", "AGENTS.md", "HERMES.md", "GEMINI.md", ".cursorrules"];
+var DOCUMENTS = {
+  ".pdf": "application/pdf",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".doc": "application/msword",
+  ".rtf": "application/rtf",
+  ".odt": "application/vnd.oasis.opendocument.text"
+};
+var IMAGES = { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp" };
+var TEXT = {
+  ".md": "text/markdown",
+  ".mdx": "text/markdown",
+  ".txt": "text/plain",
+  ".csv": "text/csv",
+  ".tsv": "text/tab-separated-values",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".css": "text/css",
+  ".scss": "text/css",
+  ".json": "application/json",
+  ".jsonl": "application/x-ndjson",
+  ".ndjson": "application/x-ndjson",
+  ".yaml": "application/yaml",
+  ".yml": "application/yaml",
+  ".toml": "application/toml",
+  ".xml": "application/xml",
+  ".sql": "application/sql",
+  ".svg": "image/svg+xml",
+  ".js": "application/javascript",
+  ".mjs": "application/javascript",
+  ".cjs": "application/javascript",
+  ".py": "text/x-python",
+  ".sh": "text/x-shellscript",
+  ".bash": "text/x-shellscript",
+  ".zsh": "text/x-shellscript"
+};
+var PLAIN_TEXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".jsx", ".mts", ".cts", ".go", ".rs", ".java", ".kt", ".swift", ".rb", ".php", ".c", ".h", ".cc", ".cpp", ".hpp", ".cs", ".scala", ".lua", ".r", ".m", ".tex", ".bib", ".ipynb", ".prisma", ".graphql", ".proto", ".ini", ".cfg", ".conf", ".log", ".rst", ".vue", ".svelte", ".astro", ".tf", ".hcl", ".gradle", ".lock", ".patch", ".diff"]);
+var PLAIN_NAMES = /* @__PURE__ */ new Set(["Dockerfile", "Makefile", "Procfile", "Gemfile", "Rakefile", "LICENSE", "README", ".cursorrules", ".gitignore", ".dockerignore", ".editorconfig", ".prettierrc", ".eslintrc"]);
+function classify(path) {
+  const ext = extname2(path).toLowerCase();
+  if (DOCUMENTS[ext]) return { kind: "document", mediaType: DOCUMENTS[ext] };
+  if (IMAGES[ext]) return { kind: "image", mediaType: IMAGES[ext] };
+  if (TEXT[ext]) return { kind: "text", mediaType: TEXT[ext] };
+  if (PLAIN_TEXT.has(ext) || PLAIN_NAMES.has(basename3(path))) return { kind: "text", mediaType: "text/plain" };
+  return null;
+}
+var SHELL_READ = /(?:^|[\s;&|(`"'])(?:cat|head|tail|nl|less|more|wc|bat|sed\s+-n\s+(?:'[^']*'|"[^"]*"|\S+))(?:\s+-[\w-]+(?:\s+\d+)?)*\s+((?:~|\.{0,2}\/)?[\w@%+./~-]*[\w-]\.[\w]{1,10}|\/[\w@%+./-]+)/g;
+var PATH_KEYS = ["file_path", "path", "notebook_path", "filePath", "target_file"];
+var obj = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var str = (value) => typeof value === "string" ? value : "";
+function shellText(input) {
+  if (typeof input === "string") return input;
+  const i = obj(input);
+  if (!i) return "";
+  const command = Array.isArray(i.command) ? i.command.filter((part) => typeof part === "string").join(" ") : str(i.command);
+  return [command, str(i.cmd), str(i.script)].filter(Boolean).join("\n");
+}
+function touchedPaths(records, cwd, home = homedir2()) {
+  const out = /* @__PURE__ */ new Set();
+  const add = (raw, base) => {
+    if (!raw || raw.length > 1e3) return;
+    const path = raw.replace(/^~(?=\/)/, home);
+    if (isAbsolute(path)) out.add(resolve3(path));
+    else if (base) out.add(resolve3(base, path));
+  };
+  const call = (name, input) => {
+    const i = obj(input);
+    const base = str(i?.workdir) || str(i?.cwd) || cwd;
+    if (i) for (const key of PATH_KEYS) add(str(i[key]), base);
+    const patch = typeof input === "string" ? input : str(i?.input) || str(i?.patch);
+    for (const match of patch.matchAll(/^\*\*\* (?:Add|Update) File: (.+)$/gm)) add(match[1].trim(), base);
+    if (!/bash|shell|exec|terminal|command|run/i.test(name)) return;
+    for (const match of shellText(input).replace(/\\n/g, "\n").matchAll(SHELL_READ)) add(match[1], base);
+  };
+  for (const raw of records) {
+    const record = obj(raw);
+    if (!record) continue;
+    const content = obj(record.message)?.content;
+    if (record.type === "assistant" && Array.isArray(content)) {
+      for (const block of content) {
+        const b = obj(block);
+        if (b?.type === "tool_use") call(str(b.name), b.input);
+      }
+    }
+    const payload = obj(record.payload);
+    if (record.type === "response_item" && (payload?.type === "function_call" || payload?.type === "custom_tool_call")) {
+      let input = payload.arguments ?? payload.input ?? "";
+      if (typeof input === "string") {
+        try {
+          input = JSON.parse(input);
+        } catch {
+          input = payload.arguments ?? payload.input;
+        }
+      }
+      call(str(payload.name), input);
+    }
+  }
+  return [...out];
+}
+function gitRoot(dir) {
+  for (let d = dir; ; d = dirname2(d)) {
+    if (existsSync3(join2(d, ".git"))) return d;
+    if (d === dirname2(d)) return null;
+  }
+}
+function instructionPaths(cwd, harness2, home = homedir2()) {
+  const out = [];
+  if (cwd && existsSync3(cwd)) {
+    const root = gitRoot(cwd) ?? cwd;
+    for (let d = resolve3(cwd); ; d = dirname2(d)) {
+      for (const name of INSTRUCTION_FILES) out.push(join2(d, name));
+      if (d === root || d === dirname2(d)) break;
+    }
+  }
+  if (harness2 === "claude_code") out.push(join2(process.env.CLAUDE_CONFIG_DIR ?? join2(home, ".claude"), "CLAUDE.md"));
+  if (harness2 === "codex") out.push(join2(process.env.CODEX_HOME ?? join2(home, ".codex"), "AGENTS.md"));
+  return out.filter((path) => {
+    try {
+      return statSync(path).isFile();
+    } catch {
+      return false;
+    }
+  });
+}
+function resourceName(path, cwd, home = homedir2()) {
+  const inside = cwd ? relative(resolve3(cwd), path) : "";
+  if (cwd && inside && !inside.startsWith("..") && !isAbsolute(inside)) return `workspace/${inside.split(sep).join("/")}`;
+  const underHome = relative(home, path);
+  const shown = !underHome.startsWith("..") && !isAbsolute(underHome) ? `~/${underHome}` : path.replace(/^\/+/, "");
+  return `files/${shown.split(sep).join("/")}`;
+}
+var ORDER = { text: 0, document: 1, image: 2 };
+function collectSessionFiles(records, opts) {
+  const home = opts.home ?? homedir2();
+  const exclude = new Set((opts.exclude ?? []).map((path) => resolve3(path)));
+  const leftOut = [];
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const path of [...instructionPaths(opts.cwd, opts.harness, home), ...touchedPaths(records, opts.cwd, home)]) {
+    if (seen.has(path) || exclude.has(path)) continue;
+    seen.add(path);
+    if (SECRET_FILE.test(path) || SKIP_DIR.test(path)) {
+      leftOut.push({ path, reason: "credential or build file" });
+      continue;
+    }
+    let size;
+    try {
+      const stat = statSync(path);
+      if (!stat.isFile()) continue;
+      size = stat.size;
+    } catch {
+      leftOut.push({ path, reason: "missing" });
+      continue;
+    }
+    const type = classify(path);
+    if (!type) {
+      leftOut.push({ path, reason: "unsupported type" });
+      continue;
+    }
+    if (size > MAX_ATTACHED_FILE_BYTES) {
+      leftOut.push({ path, reason: "too large" });
+      continue;
+    }
+    candidates.push({ path, name: resourceName(path, opts.cwd, home), ...type, size });
+  }
+  candidates.sort((a, b) => ORDER[a.kind] - ORDER[b.kind] || a.size - b.size);
+  const lines = [];
+  const attached = [];
+  let bytes = 0;
+  for (const file of candidates) {
+    let data;
+    try {
+      data = readFileSync4(file.path);
+    } catch {
+      leftOut.push({ path: file.path, reason: "missing" });
+      continue;
+    }
+    if (file.kind === "text" && data.includes(0)) {
+      leftOut.push({ path: file.path, reason: "not valid UTF-8 text" });
+      continue;
+    }
+    let line;
+    try {
+      line = redactLine(JSON.stringify({ type: "import.resource", name: file.name, media_type: file.mediaType, data: data.toString("base64") }), { requireStructured: true }).line + "\n";
+    } catch {
+      leftOut.push({ path: file.path, reason: file.kind === "text" && !isUtf8(data) ? "not valid UTF-8 text" : "could not be redacted safely" });
+      continue;
+    }
+    const size = Buffer.byteLength(line);
+    if (bytes + size > opts.budget) {
+      leftOut.push({ path: file.path, reason: "over the upload budget" });
+      continue;
+    }
+    bytes += size;
+    lines.push(line);
+    attached.push({ name: file.name, kind: file.kind, bytes: data.length });
+  }
+  return { lines, bytes, attached, leftOut };
+}
+
+// src/import-local.ts
 function redactLine2(raw) {
   return redactLine(raw).line;
 }
@@ -916,13 +1107,13 @@ function sniffTitle(filePath) {
   }
 }
 function listClaudeCodeSessions(limit) {
-  const root = process.env.CLAUDE_CONFIG_DIR ?? join2(homedir2(), ".claude");
-  const projectsDir = join2(root, "projects");
-  if (!existsSync3(projectsDir)) return [];
+  const root = process.env.CLAUDE_CONFIG_DIR ?? join3(homedir3(), ".claude");
+  const projectsDir = join3(root, "projects");
+  if (!existsSync4(projectsDir)) return [];
   const sessions = [];
   try {
     for (const encoded of readdirSync(projectsDir)) {
-      const projectDir = join2(projectsDir, encoded);
+      const projectDir = join3(projectsDir, encoded);
       let entries;
       try {
         entries = readdirSync(projectDir);
@@ -933,22 +1124,22 @@ function listClaudeCodeSessions(limit) {
       for (const entry2 of entries) {
         if (!entry2.endsWith(".jsonl")) continue;
         const sessionId = entry2.slice(0, -6);
-        const mainFile = join2(projectDir, entry2);
+        const mainFile = join3(projectDir, entry2);
         let stat;
         try {
-          stat = statSync(mainFile);
+          stat = statSync2(mainFile);
         } catch {
           continue;
         }
         if (!stat.isFile()) continue;
         let discoveryError;
         const subagentFiles = [];
-        const subagentDir = join2(projectDir, sessionId, "subagents");
-        if (existsSync3(subagentDir)) {
+        const subagentDir = join3(projectDir, sessionId, "subagents");
+        if (existsSync4(subagentDir)) {
           try {
             const subFiles = readdirSync(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
             for (const f of subFiles) {
-              subagentFiles.push(join2(subagentDir, f));
+              subagentFiles.push(join3(subagentDir, f));
             }
           } catch {
             discoveryError = "Cannot read all recorded subagent conversations. Fix local file access before importing this session.";
@@ -970,7 +1161,7 @@ function listClaudeCodeSessions(limit) {
   return sessions.sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
 function listCodexSessions(limit) {
-  const sessionsDir = join2(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join2(homedir2(), ".codex"), "sessions");
+  const sessionsDir = join3(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join3(homedir3(), ".codex"), "sessions");
   const records = [];
   function walk(dir) {
     let entries;
@@ -980,7 +1171,7 @@ function listCodexSessions(limit) {
       return;
     }
     for (const entry2 of entries) {
-      const full = join2(dir, entry2.name);
+      const full = join3(dir, entry2.name);
       if (entry2.isDirectory()) {
         walk(full);
         continue;
@@ -998,7 +1189,7 @@ function listCodexSessions(limit) {
             sessionId: data.id,
             workspace: typeof data.cwd === "string" ? data.cwd : dir,
             title: sniffTitle(full),
-            mtimeMs: statSync(full).mtimeMs,
+            mtimeMs: statSync2(full).mtimeMs,
             files: [full]
           },
           ...typeof parent === "string" ? { parent } : {}
@@ -1067,7 +1258,7 @@ async function mintTrace(base, harness2) {
 function loadSummaryFile(summaryPath) {
   let raw;
   try {
-    raw = readFileSync4(summaryPath, "utf8");
+    raw = readFileSync5(summaryPath, "utf8");
   } catch {
     throw new Error(`Cannot read summary file: ${summaryPath}`);
   }
@@ -1084,7 +1275,16 @@ function loadSummaryFile(summaryPath) {
   const redacted = redactLine2(raw.trimEnd());
   return redacted;
 }
-function prepareImport(session2, summaryPath) {
+var MAX_IMPORT_BYTES = 30 * 1024 * 1024;
+var SUMMARY_RESERVE_BYTES = 128 * 1024;
+var MAX_LISTED_ARTIFACTS = 99;
+function leftOutLine(left) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const file of left) counts.set(file.reason, (counts.get(file.reason) ?? 0) + 1);
+  const files2 = [...counts].map(([reason, n]) => `${n} ${n === 1 ? "file" : "files"} (${reason})`).join(", ");
+  return `Not transferred: ${files2 ? `${files2}; ` : ""}runtime state such as running processes, installed tools and environment variables; and reasoning the source harness stored unreadably.`;
+}
+function prepareImport(session2, summaryPath, options = {}) {
   if (session2.discoveryError) throw new Error(session2.discoveryError);
   const maximum = 16 * 1024 * 1024;
   let inputBytes = 0;
@@ -1096,10 +1296,12 @@ function prepareImport(session2, summaryPath) {
   let encryptedReasoningCount = 0;
   let compactionCount = 0;
   let unreadableCount = 0;
+  const source = new SessionSourceCollector();
+  const records = [];
   for (const path of session2.files) {
-    const stat = statSync(path);
+    const stat = statSync2(path);
     if (!stat.isFile() || (inputBytes += stat.size) > maximum) throw new Error("Selected transcript exceeds the 16 MiB limit or is not a regular file.");
-    const text = readFileSync4(path, "utf8");
+    const text = readFileSync5(path, "utf8");
     for (const raw of text.split("\n")) {
       if (!raw.trim()) continue;
       let record;
@@ -1112,6 +1314,8 @@ function prepareImport(session2, summaryPath) {
       if (!record || typeof record !== "object" || Array.isArray(record)) throw new Error("Transcript records must be JSON objects.");
       const rec = record;
       if (String(rec.type).startsWith("import.")) throw new Error("Native transcripts cannot supply import protocol records.");
+      if (path === session2.files[0]) source.push(rec);
+      records.push(rec);
       if (rec.type === "response_item") {
         const payload = rec.payload;
         if (payload?.type === "reasoning" && typeof payload?.encrypted_content === "string" && payload.encrypted_content) {
@@ -1135,6 +1339,9 @@ function prepareImport(session2, summaryPath) {
   if (!lines.length) throw new Error("The selected transcript is empty.");
   const sourceId = nativeId ?? session2.sessionId;
   if (!/^[A-Za-z0-9_-]{1,200}$/.test(sourceId) || redactLine2(JSON.stringify(sourceId)) !== JSON.stringify(sourceId)) throw new Error("The source conversation has an invalid identifier.");
+  const meta = source.result();
+  const files2 = options.files === false ? { lines: [], bytes: 0, attached: [], leftOut: [] } : collectSessionFiles(records, { harness: session2.harness, cwd: meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : ""), budget: MAX_IMPORT_BYTES - outputBytes - SUMMARY_RESERVE_BYTES, exclude: session2.files });
+  const attachedNote = files2.attached.length ? ` The ${files2.attached.length} local ${files2.attached.length === 1 ? "file" : "files"} it read, wrote or ran under are attached as well (listed in artifacts).` : "";
   let summaryJson;
   if (summaryPath) {
     summaryJson = loadSummaryFile(summaryPath);
@@ -1143,10 +1350,10 @@ function prepareImport(session2, summaryPath) {
       format: "asteroids.session-summary",
       format_version: 1,
       source_harness: session2.harness,
-      source_harness_version: null,
+      source_harness_version: meta.harness_version?.slice(0, 100) ?? null,
       source_session_id: sourceId,
       created_at: (/* @__PURE__ */ new Date()).toISOString(),
-      summary: "The complete selected local conversation is attached as a transcript. Review it before continuing; this automatic handoff does not infer the user's unfinished objective or claim any work is complete.",
+      summary: `The complete selected local conversation is attached as a transcript.${attachedNote} Review it before continuing; this automatic handoff does not infer the user's unfinished objective or claim any work is complete.`,
       context: {
         objective: "Review the imported conversation and continue its latest unfinished authorized objective.",
         constraints: [],
@@ -1154,19 +1361,19 @@ function prepareImport(session2, summaryPath) {
         completed: [],
         pending: ["Read the complete imported transcript, reconcile the latest human instructions and completed work, then continue."],
         verification: [],
-        blockers: ["This handoff contains the recorded conversation only. Referenced local files, runtime state, and unreadable reasoning are not transferred."],
-        artifacts: [],
+        blockers: [leftOutLine(files2.leftOut)],
+        artifacts: files2.attached.slice(0, MAX_LISTED_ARTIFACTS).map((file) => ({ path: file.name, description: `Attached from the local ${file.kind === "text" ? "workspace" : file.kind} the conversation used (${file.bytes} bytes).` })),
         provenance: { native_checkpoint_sha256: digest.digest("hex"), selected_native_session_id: sourceId, context_bytes: outputBytes }
       }
     };
     summaryJson = JSON.stringify(summary);
   }
-  const body = lines.join("") + JSON.stringify({ type: "import.summary", package: JSON.parse(summaryJson) }) + "\n" + JSON.stringify({ type: "import.end", records: lines.length + 1 }) + "\n";
+  const body = lines.join("") + files2.lines.join("") + JSON.stringify({ type: "import.summary", package: JSON.parse(summaryJson) }) + "\n" + JSON.stringify({ type: "import.end", records: lines.length + files2.lines.length + 1 }) + "\n";
   const gaps = [];
   if (encryptedReasoningCount > 0) gaps.push({ kind: "encrypted_reasoning", count: encryptedReasoningCount });
   if (compactionCount > 0) gaps.push({ kind: "compaction", count: compactionCount });
   if (unreadableCount > 0) gaps.push({ kind: "unreadable", count: unreadableCount });
-  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps };
+  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps, attachedFiles: files2.attached, leftOutFiles: files2.leftOut };
 }
 async function importSession(opts) {
   const base = (opts.agentUseUrl ?? agentUseBase()).replace(/\/$/, "");
@@ -1175,7 +1382,7 @@ async function importSession(opts) {
     throw new Error("Import requires HTTPS, or a loopback development server.");
   }
   opts.onProgress?.("Reading transcript and redacting secrets locally\u2026");
-  const { body, transcriptLines, outputBytes, redactionCount, gaps } = prepareImport(opts.session, opts.summaryPath);
+  const { body, transcriptLines, outputBytes, redactionCount, gaps, attachedFiles, leftOutFiles } = prepareImport(opts.session, opts.summaryPath, { files: opts.files });
   let traceId;
   let key;
   if (opts.importKey && opts.grantTraceId) {
@@ -1207,7 +1414,9 @@ async function importSession(opts) {
     transcriptFiles: opts.session.files.length,
     bytes: outputBytes,
     redactionCount,
-    gaps
+    gaps,
+    attachedFiles,
+    leftOutFiles
   };
 }
 
@@ -1244,7 +1453,7 @@ async function login(opts) {
 }
 async function browserLogin(verifier, challenge) {
   const state = b64url(randomBytes(16));
-  const code = await new Promise((resolve7, reject) => {
+  const code = await new Promise((resolve8, reject) => {
     const server = createServer((req, res) => {
       const url = new URL(req.url ?? "/", "http://127.0.0.1");
       if (url.pathname !== "/callback") {
@@ -1257,7 +1466,7 @@ async function browserLogin(verifier, challenge) {
       if (url.searchParams.get("state") !== state || !got) {
         reject(new Error("login callback state mismatch"));
       } else {
-        resolve7(got);
+        resolve8(got);
       }
       server.close();
     });
@@ -1311,23 +1520,23 @@ async function headlessLogin(verifier, challenge) {
 }
 
 // src/local-agents.ts
-import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
-function localAgents(env = process.env, home = homedir3()) {
-  const claude = env.CLAUDE_CONFIG_DIR || join3(home, ".claude");
-  const codex = env.CODEX_HOME || join3(home, ".codex");
-  const cursor = join3(home, ".cursor");
+import { existsSync as existsSync5 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join4 } from "path";
+function localAgents(env = process.env, home = homedir4()) {
+  const claude = env.CLAUDE_CONFIG_DIR || join4(home, ".claude");
+  const codex = env.CODEX_HOME || join4(home, ".codex");
+  const cursor = join4(home, ".cursor");
   return [
-    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join3(claude, "skills") },
-    { id: "codex", name: "Codex", root: codex, skillsDir: join3(codex, "skills") },
-    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join3(cursor, "skills") }
+    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join4(claude, "skills") },
+    { id: "codex", name: "Codex", root: codex, skillsDir: join4(codex, "skills") },
+    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join4(cursor, "skills") }
   ];
 }
-function detectLocalAgents(env = process.env, home = homedir3()) {
-  return localAgents(env, home).filter((agent2) => existsSync4(agent2.root));
+function detectLocalAgents(env = process.env, home = homedir4()) {
+  return localAgents(env, home).filter((agent2) => existsSync5(agent2.root));
 }
-function selectLocalAgents(ids, env = process.env, home = homedir3()) {
+function selectLocalAgents(ids, env = process.env, home = homedir4()) {
   if (!ids?.length) return detectLocalAgents(env, home);
   const known = localAgents(env, home);
   return ids.map((id) => {
@@ -1421,21 +1630,21 @@ async function readTurn(sessionId, opts = {}) {
   for (; ; ) {
     const reading = latestTurn(await history(sessionId));
     if (reading.finished || !opts.wait || Date.now() >= deadline) return reading;
-    await new Promise((resolve7) => setTimeout(resolve7, opts.intervalMs ?? 3e3));
+    await new Promise((resolve8) => setTimeout(resolve8, opts.intervalMs ?? 3e3));
   }
 }
 
 // src/setup.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname3, join as join7 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, join as join8 } from "path";
 import { createInterface as createInterface3 } from "readline";
 
 // src/mcp-register.ts
 import { spawnSync } from "child_process";
 
 // src/skill.ts
-import { mkdirSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { mkdirSync, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
 
 // src/catalog-file.ts
 var CATALOG_FILE = "catalog.md";
@@ -1511,7 +1720,7 @@ at the end; they do the same things, one agent at a time.
 
 Use the workspace the person named. If they named none, check the git root for
 \`.agentsky.json\` \u2014 if it has a \`"workspace"\` key, use that. Otherwise use the
-account default (personal). Never ask. Pass the chosen slug as \`workspace\` on
+account default workspace. Never ask. Pass the chosen slug as \`workspace\` on
 every MCP tool that accepts it, or as \`--workspace <slug>\` on sky commands.
 Details: \`${REFERENCES_DIR}/workspaces.md\` in this skill's folder.
 
@@ -1876,7 +2085,7 @@ To set a per-repo default, create \`.agentsky.json\` at the git root:
 }
 function installedVersion(dir) {
   try {
-    const marker = JSON.parse(readFileSync5(join4(dir, SKILL_MARKER), "utf8"));
+    const marker = JSON.parse(readFileSync6(join5(dir, SKILL_MARKER), "utf8"));
     return typeof marker.version === "string" ? marker.version : null;
   } catch {
     return null;
@@ -1886,25 +2095,25 @@ function isInstalledSkill(dir) {
   return installedVersion(dir) !== null;
 }
 function installSkill(agent2, opts = {}) {
-  const dir = join4(agent2.skillsDir, SKILL_NAME);
+  const dir = join5(agent2.skillsDir, SKILL_NAME);
   const previous = installedVersion(dir);
   const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
   if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
   if (outcome !== "current") {
     mkdirSync(dir, { recursive: true });
-    writeFileSync3(join4(dir, "SKILL.md"), skillDocument());
-    writeFileSync3(join4(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
+    writeFileSync3(join5(dir, "SKILL.md"), skillDocument());
+    writeFileSync3(join5(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
 `);
   }
   if (opts.catalog) {
     mkdirSync(dir, { recursive: true });
-    writeFileSync3(join4(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+    writeFileSync3(join5(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
   }
-  const refsDir = join4(dir, REFERENCES_DIR);
+  const refsDir = join5(dir, REFERENCES_DIR);
   mkdirSync(refsDir, { recursive: true });
-  writeFileSync3(join4(refsDir, "import.md"), importReferenceDoc());
-  writeFileSync3(join4(refsDir, "workspaces.md"), workspacesReferenceDoc());
-  writeFileSync3(join4(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
+  writeFileSync3(join5(refsDir, "import.md"), importReferenceDoc());
+  writeFileSync3(join5(refsDir, "workspaces.md"), workspacesReferenceDoc());
+  writeFileSync3(join5(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
   return { agent: agent2.id, path: dir, outcome };
 }
 
@@ -1955,9 +2164,9 @@ function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
 }
 
 // src/setup-local.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname2, isAbsolute, join as join5, resolve as resolve3 } from "path";
+import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync3 } from "fs";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join6, resolve as resolve4 } from "path";
 import { parse as parseToml2 } from "smol-toml";
 var MAX_SKILL_FILE_BYTES = 1024 * 1024;
 var MAX_IMPORT_DEPTH = 5;
@@ -1973,11 +2182,11 @@ function sensitive(name) {
 function skillFiles(root, prefix) {
   const files2 = [];
   for (const entry2 of readdirSync2(root, { withFileTypes: true })) {
-    const path = join5(root, entry2.name);
+    const path = join6(root, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIPPED_DIRS.has(entry2.name)) files2.push(...skillFiles(path, `${prefix}/${entry2.name}`));
-    } else if (entry2.isFile() && !sensitive(entry2.name) && statSync2(path).size <= MAX_SKILL_FILE_BYTES) {
-      files2.push({ path: `${prefix}/${entry2.name}`, bytes: new Uint8Array(readFileSync6(path)) });
+    } else if (entry2.isFile() && !sensitive(entry2.name) && statSync3(path).size <= MAX_SKILL_FILE_BYTES) {
+      files2.push({ path: `${prefix}/${entry2.name}`, bytes: new Uint8Array(readFileSync7(path)) });
     }
   }
   return files2;
@@ -1986,19 +2195,19 @@ function readLocalSkills(agents) {
   const skills2 = [];
   const ignored = [];
   for (const agent2 of agents) {
-    if (!existsSync5(agent2.skillsDir)) continue;
+    if (!existsSync6(agent2.skillsDir)) continue;
     for (const entry2 of readdirSync2(agent2.skillsDir, { withFileTypes: true })) {
-      const dir = join5(agent2.skillsDir, entry2.name);
+      const dir = join6(agent2.skillsDir, entry2.name);
       let isDir = entry2.isDirectory();
       if (entry2.isSymbolicLink()) {
         try {
-          isDir = statSync2(dir).isDirectory();
+          isDir = statSync3(dir).isDirectory();
         } catch {
           isDir = false;
         }
       }
-      if (!isDir || !existsSync5(join5(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
-      const name = frontmatterName(readFileSync6(join5(dir, "SKILL.md"), "utf8"));
+      if (!isDir || !existsSync6(join6(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
+      const name = frontmatterName(readFileSync7(join6(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
         continue;
@@ -2014,7 +2223,7 @@ function readLocalSkills(agents) {
   }
   return { skills: skills2, ignored };
 }
-var INSTRUCTION_FILES = { claude_code: "CLAUDE.md", codex: "AGENTS.md" };
+var INSTRUCTION_FILES2 = { claude_code: "CLAUDE.md", codex: "AGENTS.md" };
 function inlineImports(content, from, home, depth, seen) {
   let fence;
   return content.split(/\r?\n/).map((line) => {
@@ -2026,11 +2235,11 @@ function inlineImports(content, from, home, depth, seen) {
     }
     const target = fence ? void 0 : line.match(/^@(\S+\.(?:md|markdown|txt))$/i)?.[1];
     if (!target || depth >= MAX_IMPORT_DEPTH) return line;
-    const path = target.startsWith("~/") ? join5(home, target.slice(2)) : isAbsolute(target) ? target : resolve3(dirname2(from), target);
+    const path = target.startsWith("~/") ? join6(home, target.slice(2)) : isAbsolute2(target) ? target : resolve4(dirname3(from), target);
     if (seen.includes(path)) return "";
     let imported;
     try {
-      imported = readFileSync6(path, "utf8");
+      imported = readFileSync7(path, "utf8");
     } catch {
       return line;
     }
@@ -2038,15 +2247,15 @@ function inlineImports(content, from, home, depth, seen) {
     return inlineImports(imported, path, home, depth + 1, seen).trim();
   }).join("\n");
 }
-function readGlobalInstructions(agents, home = homedir4()) {
+function readGlobalInstructions(agents, home = homedir5()) {
   const found = [];
   for (const agent2 of agents) {
-    const file = INSTRUCTION_FILES[agent2.id];
+    const file = INSTRUCTION_FILES2[agent2.id];
     if (!file) continue;
-    const path = join5(agent2.root, file);
+    const path = join6(agent2.root, file);
     let raw;
     try {
-      raw = readFileSync6(path, "utf8");
+      raw = readFileSync7(path, "utf8");
     } catch {
       continue;
     }
@@ -2065,7 +2274,7 @@ ${item.content.trim()}`).join("\n\n");
 }
 function readJson2(path) {
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -2079,15 +2288,15 @@ function bearerOf(def) {
   return match?.[1] ?? null;
 }
 function serversOf(agent2, home) {
-  if (agent2.id === "claude_code") return readJson2(join5(home, ".claude.json"))?.mcpServers ?? {};
-  if (agent2.id === "cursor") return readJson2(join5(agent2.root, "mcp.json"))?.mcpServers ?? {};
+  if (agent2.id === "claude_code") return readJson2(join6(home, ".claude.json"))?.mcpServers ?? {};
+  if (agent2.id === "cursor") return readJson2(join6(agent2.root, "mcp.json"))?.mcpServers ?? {};
   try {
-    return parseToml2(readFileSync6(join5(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
+    return parseToml2(readFileSync7(join6(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
   } catch {
     return {};
   }
 }
-function findLocalSecrets(agents, home = homedir4()) {
+function findLocalSecrets(agents, home = homedir5()) {
   const secrets2 = [];
   for (const agent2 of agents) {
     for (const [name, def] of Object.entries(serversOf(agent2, home))) {
@@ -2103,9 +2312,9 @@ function findLocalSecrets(agents, home = homedir4()) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join7 } from "path";
 import { createInterface as createInterface2 } from "readline";
 var ALIASES = {
   claude: "anthropic",
@@ -2190,12 +2399,12 @@ async function connectClaude() {
   const expiry = sub.expiresAt ? ` (expires ~${sub.expiresAt.slice(0, 10)})` : "";
   console.log(`Connected Claude subscription${expiry}. Powers new eligible agents.`);
 }
-function codexSignIn(env = process.env, home = homedir5()) {
-  const path = join6(env.CODEX_HOME || join6(home, ".codex"), "auth.json");
-  if (!existsSync6(path)) {
+function codexSignIn(env = process.env, home = homedir6()) {
+  const path = join7(env.CODEX_HOME || join7(home, ".codex"), "auth.json");
+  if (!existsSync7(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
-  const raw = readFileSync7(path, "utf8");
+  const raw = readFileSync8(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     return { path, raw, account: parsed.tokens?.account_id };
@@ -2203,12 +2412,12 @@ function codexSignIn(env = process.env, home = homedir5()) {
     throw new ApiError(400, "invalid_codex_auth", `${path} isn't valid JSON \u2014 re-run \`codex login\``);
   }
 }
-function cursorSignIn(env = process.env, home = homedir5()) {
-  const path = join6(env.XDG_CONFIG_HOME || join6(home, ".config"), "cursor", "auth.json");
-  if (!existsSync6(path)) {
+function cursorSignIn(env = process.env, home = homedir6()) {
+  const path = join7(env.XDG_CONFIG_HOME || join7(home, ".config"), "cursor", "auth.json");
+  if (!existsSync7(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
-  const raw = readFileSync7(path, "utf8");
+  const raw = readFileSync8(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") throw new Error("shape");
@@ -2287,11 +2496,11 @@ function planProviders(names) {
   }));
 }
 function reportPath() {
-  return join7(dirname3(configPath()), "setup.json");
+  return join8(dirname4(configPath()), "setup.json");
 }
 function loadReport() {
   try {
-    const saved = JSON.parse(readFileSync8(reportPath(), "utf8"));
+    const saved = JSON.parse(readFileSync9(reportPath(), "utf8"));
     return { agents: saved.agents ?? [], plans: saved.plans ?? [], ...saved.secrets ? { secrets: saved.secrets } : {} };
   } catch {
     return { agents: [], plans: [] };
@@ -2304,7 +2513,7 @@ function mergeReport(base, next) {
   return { agents, plans, ...secrets2 ? { secrets: secrets2 } : {} };
 }
 function saveReport(report) {
-  mkdirSync2(dirname3(reportPath()), { recursive: true });
+  mkdirSync2(dirname4(reportPath()), { recursive: true });
   writeFileSync4(reportPath(), `${JSON.stringify(report, null, 2)}
 `, { mode: 384 });
 }
@@ -2654,17 +2863,17 @@ function renderArtifact(artifact2) {
 }
 
 // src/skills-store.ts
-import { readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
-import { basename as basename3, join as join8, relative, resolve as resolve4 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync10, statSync as statSync4 } from "fs";
+import { basename as basename4, join as join9, relative as relative2, resolve as resolve5 } from "path";
 function skillBundle(dir) {
-  const root = resolve4(dir);
-  const top = basename3(root);
+  const root = resolve5(dir);
+  const top = basename4(root);
   const files2 = [];
   const walk = (path) => {
     for (const name of readdirSync3(path).sort()) {
-      const full = join8(path, name);
-      if (statSync3(full).isDirectory()) walk(full);
-      else files2.push({ path: `${top}/${relative(root, full)}`, bytes: readFileSync9(full) });
+      const full = join9(path, name);
+      if (statSync4(full).isDirectory()) walk(full);
+      else files2.push({ path: `${top}/${relative2(root, full)}`, bytes: readFileSync10(full) });
     }
   };
   walk(root);
@@ -2674,7 +2883,7 @@ function skillBundle(dir) {
 async function uploadSkill(dir, displayName) {
   const form = new FormData();
   for (const file of skillBundle(dir)) form.append("files", new Blob([new Uint8Array(file.bytes)]), file.path);
-  form.append("displayName", displayName ?? basename3(resolve4(dir)));
+  form.append("displayName", displayName ?? basename4(resolve5(dir)));
   return apiForm("POST", "/skills", form);
 }
 async function listSkills() {
@@ -2792,19 +3001,19 @@ function renderPolicy(rule) {
 }
 
 // src/harness.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join9, resolve as resolve5 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname5, join as join10, resolve as resolve6 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
-  return join9(resolve5(dir), HARNESS_FILE);
+  return join10(resolve6(dir), HARNESS_FILE);
 }
 function readHarnessFile(dir) {
   const path = harnessFilePath(dir);
-  if (!existsSync7(path)) {
-    throw new Error(`no ${HARNESS_FILE} found in ${resolve5(dir)} \u2014 run \`sky harness init\` first`);
+  if (!existsSync8(path)) {
+    throw new Error(`no ${HARNESS_FILE} found in ${resolve6(dir)} \u2014 run \`sky harness init\` first`);
   }
   try {
-    return JSON.parse(readFileSync10(path, "utf8"));
+    return JSON.parse(readFileSync11(path, "utf8"));
   } catch (err) {
     throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -2831,10 +3040,10 @@ var INIT_COMMENT = `# harness.json \u2014 workspace harness profile skeleton
 `;
 function harnessInit(dir) {
   const path = harnessFilePath(dir);
-  if (existsSync7(path)) {
+  if (existsSync8(path)) {
     throw new Error(`${path} already exists \u2014 delete it to re-init`);
   }
-  mkdirSync3(dirname4(path), { recursive: true });
+  mkdirSync3(dirname5(path), { recursive: true });
   writeFileSync5(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
 `);
   console.log(`Created ${path}`);
@@ -2990,7 +3199,7 @@ auth.command("whoami").description("who the current token acts as").action(
   run(async () => {
     const who = await api("GET", "/whoami");
     console.log(
-      `${who.user.email ?? "unknown"} \xB7 universe ${who.universe.slug}${who.universe.isPersonal ? " (personal)" : ""} \xB7 scopes ${who.scopes.join(",")}`
+      `${who.user.email ?? "unknown"} \xB7 universe ${who.universe.slug}${who.universe.isPersonal ? " (default)" : ""} \xB7 scopes ${who.scopes.join(",")}`
     );
   })
 );
@@ -3010,7 +3219,7 @@ universe.command("list").action(
     const current = currentUniverse();
     for (const u of universes) {
       const marker = u.slug === current || !current && u.isPersonal ? "*" : " ";
-      console.log(`${marker} ${u.slug}${u.isPersonal ? " (personal)" : ""}`);
+      console.log(`${marker} ${u.slug}${u.isPersonal ? " (default)" : ""}`);
     }
   })
 );
@@ -3036,7 +3245,7 @@ universe.command("show").action(
       console.log(`${u.slug} \u2014 ${u.name} \xB7 ${u.agents} agents \xB7 ${u.members} members`);
     } else {
       const who = await api("GET", path);
-      console.log(`${who.universe.slug} (personal)`);
+      console.log(`${who.universe.slug} (default)`);
     }
   })
 );
@@ -3084,7 +3293,7 @@ workspace.command("list").action(
     const current = currentUniverse();
     for (const u of universes) {
       const marker = u.slug === current || !current && u.isPersonal ? "*" : " ";
-      console.log(`${marker} ${u.slug}${u.isPersonal ? " (personal)" : ""}`);
+      console.log(`${marker} ${u.slug}${u.isPersonal ? " (default)" : ""}`);
     }
   })
 );
@@ -3339,6 +3548,38 @@ session.command("read <ref>").description("what the agent has said since the las
     if (!reading.finished) console.error("The agent is still working. Run this again to read more.");
   })
 );
+session.command("share <ref>").description("print the session's share link, turning sharing on; --view makes it read-only, --off turns it off").option("--view", "a view-only link: holders read the conversation and can do nothing else").option("--rotate", "replace the link; the old one stops working").option("--off", "turn sharing off; the link stops working at once").action(
+  run(async (ref, opts) => {
+    const id = await resolveSessionRef(ref);
+    const path = `/sessions/${encodeURIComponent(id)}/share`;
+    if (opts.off) {
+      await api("DELETE", path);
+      console.log(`Sharing is off for ${id}`);
+      return;
+    }
+    const link = await api("POST", path, {
+      access: opts.view ? "view" : "prompt",
+      ...opts.rotate ? { rotate: true } : {}
+    });
+    if (link.shareUrl) console.log(link.shareUrl);
+    else console.log(`view-only token: ${link.token} \u2014 read with GET /links/${link.token}/events`);
+  })
+);
+session.command("usage <ref>").description("what the session has cost so far, and its newest billed entries").option("--limit <n>", "entries to list (default 20)").option("--json", "print the API's answer as JSON").action(
+  run(async (ref, opts) => {
+    const id = await resolveSessionRef(ref);
+    const usage = await api("GET", `/sessions/${encodeURIComponent(id)}/usage?limit=${encodeURIComponent(opts.limit ?? "20")}`);
+    if (opts.json) {
+      console.log(JSON.stringify(usage, null, 2));
+      return;
+    }
+    const t = usage.totals;
+    console.log(`${id}: $${t.billedCostUsd.toFixed(4)} billed, ${t.turns} model calls, ${t.inputTokens} in / ${t.outputTokens} out tokens`);
+    for (const entry2 of usage.entries) {
+      console.log(`  ${entry2.at}  ${entry2.kind.padEnd(16)} ${(entry2.model ?? "").padEnd(24)} $${entry2.billedCostUsd.toFixed(4)}`);
+    }
+  })
+);
 var sessionResources = session.command("resources").description("files and GitHub repositories mounted into a session's working directory");
 var resourcesPath = (id) => `/sessions/${encodeURIComponent(id)}/resources`;
 sessionResources.command("list <ref>").description("the session's resources, oldest first").action(
@@ -3555,9 +3796,9 @@ secrets.command("set <id> <pairs...>").description("set KEY=VALUE pairs on the a
 );
 secrets.command("list <id>").action(
   run(async (id) => {
-    const { secrets: keys } = await api("GET", `/agents/${encodeURIComponent(id)}/secrets`);
-    if (!keys.length) console.log("no secrets set");
-    for (const s of keys) {
+    const { secrets: keys2 } = await api("GET", `/agents/${encodeURIComponent(id)}/secrets`);
+    if (!keys2.length) console.log("no secrets set");
+    for (const s of keys2) {
       console.log(`\u25CF ${s.key}${s.description ? ` \u2014 ${s.description}` : ""}`);
     }
   })
@@ -3573,9 +3814,9 @@ secrets.command("unset <id> <key>").action(
 );
 program.command("launch").description("scaffold ./agent.toml if absent, create the agent, print its address").option("-f, --file <path>", "agent file", "agent.toml").option("--type <type>", "override the file's harness: hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "override the file's model (must suit the harness)").action(
   run(async (opts) => {
-    const path = resolve6(opts.file);
-    if (!existsSync8(path)) {
-      const name = basename4(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
+    const path = resolve7(opts.file);
+    if (!existsSync9(path)) {
+      const name = basename5(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
       scaffoldAgentFile(path, name);
       console.log(`Scaffolded ${opts.file} \u2014 edit it anytime; re-apply with \`sky deploy\`.`);
     }
@@ -3606,7 +3847,7 @@ program.command("launch").description("scaffold ./agent.toml if absent, create t
 );
 program.command("deploy").description("re-apply ./agent.toml to the existing agent (idempotent)").option("-f, --file <path>", "agent file", "agent.toml").action(
   run(async (opts) => {
-    const path = resolve6(opts.file);
+    const path = resolve7(opts.file);
     const { file, spec } = readAgentFile(path);
     if (!file.id) {
       console.log("No agent id in the file yet \u2014 running launch instead.");
@@ -3649,7 +3890,7 @@ function formatRelative(msAgo) {
   if (hours < 48) return `${hours}h ago`;
   return `${Math.round(hours / 24)}d ago`;
 }
-program.command("import").description("import a local Claude Code or Codex session to AgentSky and continue it in the cloud").option("--current", "import the session this agent is running in (reads CLAUDE_CODE_SESSION_ID or CODEX_THREAD_ID, then falls back to most recent session in the cwd)").option("--all", "import all found sessions up to --limit").option("-y, --yes", "confirm transfer without prompting (default when --current or --session is given in non-TTY)").option("--json", "print one JSON result object per import and nothing else to stdout").option("--limit <n>", "maximum sessions to list or import", "10").option("--session <id>", "import one specific session by its ID").option("--harness <type>", "claude_code | codex | all (default: all)").option("--summary <path>", "attach a pre-written summary JSON (asteroids.session-summary v1) instead of the auto-generated one").option("--key <importKey>", "import grant key minted by the web page (skips sky auth login)").option("--trace <traceId>", "trace id paired with --key").option("--url <base>", "agent-use app URL (default: derived from SKY_API_URL or AGENT_USE_URL)").action(
+program.command("import").description("import a local Claude Code or Codex session to AgentSky and continue it in the cloud").option("--current", "import the session this agent is running in (reads CLAUDE_CODE_SESSION_ID or CODEX_THREAD_ID, then falls back to most recent session in the cwd)").option("--all", "import all found sessions up to --limit").option("-y, --yes", "confirm transfer without prompting (default when --current or --session is given in non-TTY)").option("--json", "print one JSON result object per import and nothing else to stdout").option("--limit <n>", "maximum sessions to list or import", "10").option("--session <id>", "import one specific session by its ID").option("--harness <type>", "claude_code | codex | all (default: all)").option("--summary <path>", "attach a pre-written summary JSON (asteroids.session-summary v1) instead of the auto-generated one").option("--key <importKey>", "import grant key minted by the web page (skips sky auth login)").option("--trace <traceId>", "trace id paired with --key").option("--url <base>", "agent-use app URL (default: derived from SKY_API_URL or AGENT_USE_URL)").option("--no-files", "send the conversation only, without the local files it read, wrote or ran under").action(
   run(
     async (opts) => {
       if (opts.key && !opts.trace) throw new Error("--key requires --trace <traceId>");
@@ -3709,11 +3950,11 @@ program.command("import").description("import a local Claude Code or Codex sessi
         console.log();
         const rl = createInterface4({ input: process.stdin, output: process.stdout });
         const answer = await new Promise(
-          (resolve7) => rl.question(
+          (resolve8) => rl.question(
             `Import which session? [1-${candidates.length}, or comma-separated, or "all"]: `,
             (a) => {
               rl.close();
-              resolve7(a.trim());
+              resolve8(a.trim());
             }
           )
         );
@@ -3731,14 +3972,14 @@ program.command("import").description("import a local Claude Code or Codex sessi
       toImport = [...new Map(toImport.map((session2) => [`${session2.harness}:${session2.sessionId}`, session2])).values()];
       if (!opts.json) {
         console.log(`Selected ${toImport.length} conversation(s), ${toImport.reduce((count, session2) => count + session2.files.length, 0)} transcript file(s). Destination: ${base}`);
-        console.log("The recorded conversation is redacted locally. Local project files and login credentials are not transferred.");
+        console.log(opts.files === false ? "The recorded conversation is redacted locally. Local project files and login credentials are not transferred." : "The recorded conversation and the local files it read, wrote or ran under are attached; text is redacted locally. Credential files and login credentials are never transferred. Use --no-files to send the conversation only.");
       }
       if (!autoConfirm) {
         if (nonInteractive) throw new Error("Use --yes to confirm this transfer in a non-interactive terminal.");
         const prompt = createInterface4({ input: process.stdin, output: process.stdout });
-        const answer = await new Promise((resolve7) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
+        const answer = await new Promise((resolve8) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
           prompt.close();
-          resolve7(value);
+          resolve8(value);
         }));
         if (!/^y(?:es)?$/i.test(answer.trim())) {
           console.log("Cancelled. Nothing uploaded.");
@@ -3756,6 +3997,7 @@ Importing ${label} \u2026
           summaryPath: opts.summary,
           importKey: opts.key,
           grantTraceId: opts.trace,
+          files: opts.files,
           onProgress: opts.json ? void 0 : (msg) => process.stdout.write(`  ${msg}
 `)
         });
@@ -3770,9 +4012,12 @@ Importing ${label} \u2026
             bytes: result.bytes,
             redactionCount: result.redactionCount,
             gaps: result.gaps,
+            attachedFiles: result.attachedFiles,
+            leftOutFiles: result.leftOutFiles.map((file) => ({ reason: file.reason })),
             continueUrl: result.url
           }));
         } else {
+          if (result.attachedFiles.length || result.leftOutFiles.length) console.log(`  Attached ${result.attachedFiles.length} local ${result.attachedFiles.length === 1 ? "file" : "files"}${result.leftOutFiles.length ? `; left out ${result.leftOutFiles.length} (credential, missing, unsupported or over the 30 MiB upload)` : ""}.`);
           console.log(`  \u2713 Imported. Continue here:
     ${result.url}
 `);
@@ -3839,7 +4084,7 @@ task.command("get <task> <path>").description("read one task file; prints it, or
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync11(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync12(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -4004,6 +4249,19 @@ for (const [verb, blurb] of [
     })
   );
 }
+routine.command("runs [id]").description("every fire attempt, newest first \u2014 of one routine, or all of them").option("--failed", "only runs that failed to start").option("--limit <n>", "how many (default 20)").action(
+  run(async (id, opts) => {
+    const params = new URLSearchParams({ limit: opts.limit ?? "20" });
+    if (id) params.set("routine", id);
+    if (opts.failed) params.set("has_error", "true");
+    const { items } = await api("GET", `/routine-runs?${params}`);
+    if (!items.length) console.log("no runs");
+    for (const runRow of items) {
+      const outcome = runRow.error ? `FAILED ${runRow.error.type}: ${runRow.error.message}` : runRow.session_id ?? "ok";
+      console.log(`${runRow.id}  ${runRow.created_at}  ${runRow.trigger_context.type.padEnd(8)} ${outcome}`);
+    }
+  })
+);
 var collect = (value, previous = []) => [...previous, value];
 function goalPath(sessionId, suffix = "") {
   return `/sessions/${encodeURIComponent(sessionId)}/goal${suffix}`;
@@ -4096,8 +4354,149 @@ program.command("config").description("show the CLI config location and current
   console.log(`config: ${configPath()}`);
   console.log(`  apiBase:  ${config.apiBase ?? "(default)"}`);
   console.log(`  token:    ${config.token ? `${config.token.slice(0, 10)}\u2026` : "(none)"}`);
-  console.log(`  universe: ${config.currentUniverse ?? "(personal)"}`);
+  console.log(`  universe: ${config.currentUniverse ?? "(default)"}`);
 });
+var billing = program.command("billing").description("your balance, auto top-up, usage across sessions and API keys, and buying credit");
+billing.command("show").description("balance, whether a card is saved, and auto top-up").action(
+  run(async () => {
+    const [balance, autoTopup] = await Promise.all([
+      api("GET", "/billing"),
+      api("GET", "/billing/auto-topup")
+    ]);
+    console.log(renderBalance(balance));
+    console.log(renderAutoTopup(autoTopup));
+  })
+);
+billing.command("card").description("print the address of a card form to save a card; saving moves no money").action(
+  run(async () => {
+    const { url } = await api("POST", "/billing/card-setup");
+    console.log(url);
+  })
+);
+billing.command("topup <dollars>").description("buy credit with your saved card: 10, 20, 50 or 100 dollars").option("--request-id <id>", "repeat a request without charging twice (default: a new id)").action(
+  run(async (dollars2, opts) => {
+    const result = await api("POST", "/billing/topups", {
+      amount: { amount: dollarsToCents("<dollars>", dollars2), currency: "USD" },
+      request_id: opts.requestId ?? `sky-${crypto.randomUUID()}`
+    });
+    console.log(renderTopup(result));
+  })
+);
+billing.command("auto-topup").description("show auto top-up, or change it: --on/--off, --threshold <5|10|20>, --amount <10|20|50|100>").option("--on", "charge the saved card when the balance falls under the threshold").option("--off", "stop charging automatically").option("--threshold <dollars>", "the balance that triggers a charge").option("--amount <dollars>", "the credit each charge adds").action(
+  run(async (opts) => {
+    const body = autoTopupBody(opts);
+    const settings = body ? await api("PATCH", "/billing/auto-topup", body) : await api("GET", "/billing/auto-topup");
+    console.log(renderAutoTopup(settings));
+  })
+);
+var usageOptions = (command) => command.option("--from <day>", "first UTC day, YYYY-MM-DD (default: 29 days ago)").option("--to <day>", "first UTC day not included (default: tomorrow)").option("--source <source>", "session or api_key (default: both)").option("--key <id>", "only this API key");
+usageOptions(
+  billing.command("usage").description("what you spent over a range of days, across sessions and API keys").option("--by <dimension>", "day, kind, session or api_key (default day)").option("--json", "print the API's answer as JSON")
+).action(
+  run(async (opts) => {
+    const summary = await api("GET", `/billing/usage${usageQuery({ ...opts, groupBy: opts.by })}`);
+    console.log(opts.json ? JSON.stringify(summary, null, 2) : renderUsage(summary));
+  })
+);
+usageOptions(
+  billing.command("export").description("every usage record in the range, as CSV or JSONL").option("--format <format>", "csv or jsonl (default csv)").option("-o, --out <path>", "write to a file instead of printing")
+).action(
+  run(async (opts) => {
+    const { bytes } = await apiBytes("GET", `/billing/usage/export${usageQuery(opts)}`);
+    if (opts.out) {
+      writeFileSync6(opts.out, bytes);
+      console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
+    } else {
+      process.stdout.write(bytes);
+    }
+  })
+);
+var keys = program.command("keys").description("your own API keys: list, create, revoke, restore (admin scope)");
+keys.command("list").action(
+  run(async () => {
+    const { api_keys: list } = await api("GET", "/api_keys");
+    if (!list.length) console.log("no API keys");
+    for (const key of list) console.log(renderApiKey(key));
+  })
+);
+keys.command("create <name>").description("make a key; its secret is printed once (`sky keys reveal` reads it again where allowed)").option("--scopes <list>", "comma-separated: read, write, admin (default read,write)").option("--workspace <slug>", 'fix the key to one workspace, or "personal" for none').option("--expires <iso>", "when the key stops working, e.g. 2027-01-01T00:00:00Z").action(
+  run(async (name, opts) => {
+    const { api_key: key, secret } = await api("POST", "/api_keys", apiKeyBody(name, opts));
+    console.error(renderApiKey(key));
+    console.log(secret);
+  })
+);
+keys.command("reveal <id>").description("print a key's secret again").action(
+  run(async (id) => {
+    const { secret } = await api("POST", `/api_keys/${encodeURIComponent(id)}/reveal`);
+    console.log(secret);
+  })
+);
+for (const [verb, blurb] of [
+  ["revoke", "the key stops working at once"],
+  ["restore", "a revoked key works again"]
+]) {
+  keys.command(`${verb} <id>`).description(blurb).action(
+    run(async (id) => {
+      const { api_key: key } = await api("POST", `/api_keys/${encodeURIComponent(id)}/${verb}`);
+      console.log(renderApiKey(key));
+    })
+  );
+}
+var memory = program.command("memory").description("your personal memory: what every session you start is told about you");
+async function writeMemory(operation) {
+  const current = await api("GET", "/memory");
+  console.log(renderMemory(await api("POST", "/memory", memoryBody(operation, current.version))));
+}
+memory.command("list").action(run(async () => console.log(renderMemory(await api("GET", "/memory")))));
+memory.command("save <text...>").description("add an entry").action(run(async (text) => writeMemory({ op: "save", text: text.join(" ") })));
+memory.command("edit <index> <text...>").description("replace entry <index>").action(run(async (index, text) => writeMemory({ op: "update", index: memoryIndex(index), text: text.join(" ") })));
+memory.command("rm <index>").description("remove entry <index>").action(run(async (index) => writeMemory({ op: "remove", index: memoryIndex(index) })));
+memory.command("clear").description("remove every entry").action(run(async () => writeMemory({ op: "clear" })));
+var context = program.command("context").description("search your conversations, memory and the workspace trace library");
+context.command("search <words...>").description("literal matches, in source order; follow --cursor for more").option("--scope <scope>", "sessions, memory or traces (default sessions)").option("--limit <n>", "hits per page (default 20)").option("--cursor <cursor>", "continue a previous search").option("--since <iso>", "inclusive lower time bound").option("--until <iso>", "exclusive upper time bound").option("--json", "print the API's answer as JSON").action(
+  run(async (words, opts) => {
+    const page = await api("GET", `/context/search${searchQuery(words.join(" "), opts)}`);
+    console.log(opts.json ? JSON.stringify(page, null, 2) : renderContextPage(page));
+  })
+);
+context.command("read <ref>").description("read a search hit in full: <ref> is the JSON reference the search printed").option("--offset <n>", "continue a long message from this offset").action(
+  run(async (ref, opts) => {
+    const params = new URLSearchParams({ ref });
+    if (opts.offset) params.set("offset", opts.offset);
+    const read = await api("GET", `/context/read?${params}`);
+    console.log(read.text);
+    if (read.nextOffset !== null) console.error(`more: --offset ${read.nextOffset}`);
+  })
+);
+var webhookLine = (w) => `${w.id}  ${w.status.padEnd(8)} ${w.url}  ${w.events.join(",")}${w.failure_count ? `  (${w.failure_count} failures)` : ""}`;
+var webhook = program.command("webhook").description("your HTTPS endpoints for platform events, signed with a whsec_ secret");
+webhook.command("list").action(
+  run(async () => {
+    const { webhooks } = await api("GET", "/webhooks");
+    if (!webhooks.length) console.log("no webhooks");
+    for (const w of webhooks) console.log(webhookLine(w));
+  })
+);
+webhook.command("create <url>").description("register an endpoint; its signing secret is printed once").requiredOption("--event <type...>", "event types to deliver, e.g. goal.completed routine_run.failed").action(
+  run(async (url, opts) => {
+    const { webhook: created } = await api("POST", "/webhooks", { url, events: opts.event });
+    console.error(webhookLine(created));
+    if (created.secret) console.log(created.secret);
+  })
+);
+webhook.command("enable <id>").description("re-enable an endpoint that was disabled after failed deliveries").action(
+  run(async (id) => {
+    const { webhook: updated } = await api("PATCH", `/webhooks/${encodeURIComponent(id)}`, { status: "active" });
+    console.log(webhookLine(updated));
+  })
+);
+webhook.command("rm <id>").description("delete an endpoint").action(
+  run(async (id) => {
+    await api("DELETE", `/webhooks/${encodeURIComponent(id)}`);
+    console.log(`Deleted ${id}`);
+  })
+);
 var harness = program.command("harness").description("workspace harnesses: init, verify, push");
 harness.command("init [dir]").description("write a harness.json profile skeleton in the given directory (default: .)").action(run(async (dir) => {
   harnessInit(dir ?? ".");
@@ -4121,7 +4520,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-MPGQYXNR.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-DS35CFKV.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -4150,13 +4549,13 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
   ]);
   console.log(`Tracing ${trace.id} as ${opts.source} until ${grant.expires_at}`);
   console.log(scopes.length ? `  content: ${scopes.join(", ")} (redacted here before it leaves)` : "  metadata only");
-  if (opts.hooks) console.log(`  hooks: ${installClaudeHooks(resolve6(typeof opts.hooks === "string" ? opts.hooks : ".claude/settings.local.json"))}`);
+  if (opts.hooks) console.log(`  hooks: ${installClaudeHooks(resolve7(typeof opts.hooks === "string" ? opts.hooks : ".claude/settings.local.json"))}`);
   console.log(`  a session started elsewhere joins it with metadata {"trace_id": "${trace.id}"}`);
   console.log(`  sky trace show ${trace.id}`);
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-MPGQYXNR.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-DS35CFKV.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -4169,14 +4568,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-MPGQYXNR.js");
+  const { readState, flush, grantSender } = await import("./trace-DS35CFKV.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-MPGQYXNR.js");
+  const { readState, spoolStatus } = await import("./trace-DS35CFKV.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -4186,7 +4585,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-MPGQYXNR.js");
+  const { readState } = await import("./trace-DS35CFKV.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -4213,7 +4612,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-MPGQYXNR.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-DS35CFKV.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -4222,6 +4621,138 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   clearState();
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
+traceCmd.command("sync [payload]").description("upload this machine's Claude Code and Codex sessions to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
+  const lib = await import("./trace-library-B3NZ4OQM.js");
+  if (opts.hook) {
+    try {
+      let raw = payload ?? "";
+      if (!raw && !process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin) chunks.push(chunk);
+        raw = Buffer.concat(chunks).toString("utf8");
+      }
+      if (!lib.loadSyncConfig().enabled) return;
+      const ref = lib.hookSessionRef(raw);
+      const { spawn: spawn4 } = await import("child_process");
+      spawn4(process.execPath, [process.argv[1], "trace", "sync", "--quiet", ...ref ? ["--session", ref] : []], { detached: true, stdio: "ignore" }).unref();
+    } catch {
+    }
+    return;
+  }
+  await run(async () => {
+    const config = lib.loadSyncConfig();
+    if (opts.disable) {
+      lib.saveSyncConfig({ ...config, enabled: false });
+      console.log("Trace sync is off on this machine. Uploaded traces stay in their workspaces until deleted there.");
+      return;
+    }
+    const changedSettings = opts.enable || opts.route || opts.default || opts.keepLocal;
+    if (changedSettings) {
+      if (opts.enable && !apiToken()) throw new Error("not logged in \u2014 run `sky auth login` first");
+      const rules = opts.route ? opts.route.map((spec) => {
+        const at = spec.lastIndexOf("=");
+        if (at <= 0 || at === spec.length - 1) throw new Error(`--route takes match=workspace, got "${spec}"`);
+        return { match: spec.slice(0, at), workspace: spec.slice(at + 1) };
+      }) : config.rules;
+      const next = {
+        ...config,
+        rules,
+        enabled: opts.enable ? true : config.enabled,
+        enabledAt: opts.enable ? (/* @__PURE__ */ new Date()).toISOString() : config.enabledAt,
+        fallback: opts.keepLocal ? void 0 : opts.default ?? config.fallback
+      };
+      lib.saveSyncConfig(next);
+      console.log(`Trace sync is ${next.enabled ? "on" : "off"} on this machine. It reads only:`);
+      for (const folder of lib.sourceFolders()) console.log(`  ${folder}`);
+      console.log("and sends each session, redacted here first, to:");
+      for (const rule of next.rules) console.log(`  folder path contains "${rule.match}" \u2192 ${rule.workspace}`);
+      console.log(`  anything else \u2192 ${next.fallback ?? "stays on this machine"}`);
+      console.log(`A repository's .agentsky.json "workspace" wins over these rules.`);
+    }
+    if (opts.installSchedule) {
+      const { join: join11 } = await import("path");
+      const { homedir: homedir7 } = await import("os");
+      const { execFileSync } = await import("child_process");
+      const log = join11(homedir7(), ".config", "sky", "trace-sync.log");
+      const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
+      try {
+        execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
+      } catch {
+      }
+      execFileSync("launchctl", ["load", plist]);
+      console.log(`Sweeping every 15 minutes (${plist}); a full re-read runs weekly. Log: ${log}`);
+    }
+    if (opts.status) {
+      const { readFileSync: readFileSync13 } = await import("fs");
+      const { join: join11 } = await import("path");
+      let state = { sessions: {} };
+      try {
+        state = JSON.parse(readFileSync13(join11(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+      } catch {
+      }
+      const counts = /* @__PURE__ */ new Map();
+      for (const entry2 of Object.values(state.sessions)) {
+        const label = entry2.status === "stored" ? `stored in ${entry2.workspace}` : entry2.status;
+        counts.set(label, (counts.get(label) ?? 0) + 1);
+      }
+      console.log(`Trace sync is ${config.enabled ? "on" : "off"}${config.enabledAt ? ` (since ${config.enabledAt})` : ""}. Last full sweep: ${state.lastFullAt ?? "never"}.`);
+      for (const [label, count] of [...counts].sort((a, b) => b[1] - a[1])) console.log(`  ${count}  ${label}`);
+      return;
+    }
+    if (changedSettings && !opts.full && !opts.session) return;
+    const report = await lib.syncTraces({
+      full: opts.full,
+      only: opts.session,
+      dryRun: opts.dryRun,
+      limit: opts.limit,
+      onProgress: opts.quiet ? void 0 : (line) => console.log(line)
+    });
+    if (!report) {
+      if (!opts.quiet) console.log("Another sync is running on this machine; it will pick these up.");
+      return;
+    }
+    if (!opts.quiet || report.failed) {
+      const where = Object.entries(report.byWorkspace).map(([workspace2, count]) => `${count} \u2192 ${workspace2}`).join(", ");
+      console.log(`${opts.dryRun ? "Would upload" : "Uploaded"} ${report.uploaded}${where ? ` (${where})` : ""}; unchanged ${report.unchanged}; kept local ${report.local}; empty ${report.empty}; another member's ${report.owned}; failed ${report.failed}. Scanned ${report.scanned}, ${report.changed} changed.`);
+      for (const error of report.errors.slice(0, 20)) console.error(`  ${error}`);
+    }
+    if (report.failed) process.exitCode = 1;
+  })();
+});
+traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
+  const { libraryRequest } = await import("./trace-library-B3NZ4OQM.js");
+  const workspace2 = opts.workspace ?? currentUniverse();
+  if (!workspace2) throw new Error("name a workspace with --workspace");
+  const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
+  const page = await libraryRequest("GET", `/context/search?${params}`, workspace2);
+  if (opts.json) {
+    console.log(JSON.stringify(page, null, 2));
+    return;
+  }
+  if (!page.hits.length) console.log(page.partial ? `No hits, but the search was cut short (${page.coverage}).` : "No hits.");
+  for (const { hit } of page.hits) {
+    console.log(`${hit.occurredAt?.slice(0, 16).replace("T", " ") ?? "                "}  ${hit.title}`);
+    console.log(`  ${hit.snippet.replace(/\s+/g, " ")}`);
+  }
+  if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
+}));
+traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
+  const { libraryRequest } = await import("./trace-library-B3NZ4OQM.js");
+  const workspace2 = opts.workspace ?? currentUniverse();
+  if (!workspace2) throw new Error("name a workspace with --workspace");
+  const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);
+  if (opts.json) {
+    console.log(JSON.stringify(page, null, 2));
+    return;
+  }
+  console.log(`${page.total} sessions in ${workspace2}'s trace library`);
+  for (const trace of page.traces) {
+    const models = trace.models?.length ? `${trace.models[0]}${trace.models.length > 1 ? ` +${trace.models.length - 1}` : ""}` : "";
+    const output = trace.usage?.output_tokens ? `${trace.usage.output_tokens.toLocaleString("en-US")} out` : "";
+    const source = [models, output].filter(Boolean).join(" \xB7 ");
+    console.log(`${trace.updated_at.slice(0, 16).replace("T", " ")}  ${trace.harness.padEnd(11)} ${(trace.project ?? "").padEnd(16)} ${String(trace.messages).padStart(5)} msgs  ${trace.title ?? trace.session_id}${source ? `  (${source})` : ""}`);
+  }
+}));
 var workerCmd = program.command("worker").description("run a pod on this machine and connect it to a worker pool");
 workerCmd.command("start <pool>").description("start a worker connected to the given pool (wpool_\u2026 id)").option("--token <token>", "bearer token (default: $SKY_WORKER_TOKEN)").option("--label <label>", "a human-readable name for this machine", "cli").action(async (poolId, options) => {
   const { startWorker } = await import("./worker-6Q4K4HZW.js");