@agentsky/sky 2.15.0 → 2.17.0

package/dist/index.js

@@ -4,12 +4,12 @@ import {
   api,
   apiBytes,
   apiForm,
-  downloadFile,
+  downloadFileTo,
   postEvents,
   resolveSessionRef,
   streamEvents,
   uploadFile
-} from "./chunk-Y3NTKJLA.js";
+} from "./chunk-FU43NICZ.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -20,7 +20,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-R5FKQQMG.js";
+} from "./chunk-H7SWXCH7.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -37,21 +37,126 @@ import {
   modelSubscriptionProviderFor,
   reasoningEffortDocLine,
   redactLine,
+  redactSecretValues,
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-RHRREQMF.js";
+} from "./chunk-ZJVFWFOY.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename6, resolve as resolve7 } from "path";
-import { createInterface as createInterface5 } from "readline";
+import { existsSync as existsSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename8, resolve as resolve9 } from "path";
+import { createInterface as createInterface6 } from "readline";
 import { Command } from "commander";
 
 // src/files.ts
-import { readFileSync } from "fs";
-import { basename, extname } from "path";
+import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { basename as basename2, extname } from "path";
+
+// src/resumable-upload.ts
+import { createHash } from "crypto";
+import { mkdirSync, openSync, readFileSync, readSync, closeSync, rmSync, statSync, writeFileSync } from "fs";
+import { basename, dirname, join, resolve } from "path";
+var SINGLE_REQUEST_MAX_BYTES = 32 * 1024 * 1024;
+var MAX_ATTEMPTS = 8;
+function statePath(path, size, mtimeMs) {
+  const key = createHash("sha256").update(`${resolve(path)}\0${size}\0${mtimeMs}`).digest("hex").slice(0, 32);
+  return join(dirname(configPath()), "uploads", `${key}.json`);
+}
+function loadSession(file, expiresInSeconds) {
+  try {
+    const saved = JSON.parse(readFileSync(file, "utf8"));
+    if (saved.expiresInSeconds !== expiresInSeconds) return null;
+    if (Date.parse(saved.expires_at) - Date.now() < 3600 * 1e3) return null;
+    return saved;
+  } catch {
+    return null;
+  }
+}
+function acknowledged(res) {
+  const range = res.headers.get("range")?.match(/^bytes=0-(\d+)$/);
+  return range ? Number(range[1]) + 1 : 0;
+}
+async function probe(session2) {
+  const res = await fetch(session2.upload_url, {
+    method: "PUT",
+    headers: { "user-agent": USER_AGENT, "content-range": `bytes */${session2.size_bytes}` }
+  });
+  if (res.status === 200 || res.status === 201) return "done";
+  if (res.status === 308) return acknowledged(res);
+  if (res.status === 404 || res.status === 410) throw new ApiError(res.status, "upload_expired", "the upload session is gone");
+  throw new ApiError(res.status, "upload_failed", `upload status check failed: ${res.status} ${res.statusText}`);
+}
+async function sendChunk(session2, fd, offset) {
+  const length = Math.min(session2.chunk_size, session2.size_bytes - offset);
+  const chunk = Buffer.alloc(length);
+  let read = 0;
+  while (read < length) read += readSync(fd, chunk, read, length - read, offset + read);
+  const res = await fetch(session2.upload_url, {
+    method: "PUT",
+    headers: {
+      "user-agent": USER_AGENT,
+      "content-range": `bytes ${offset}-${offset + length - 1}/${session2.size_bytes}`
+    },
+    body: chunk
+  });
+  if (res.status === 200 || res.status === 201) return "done";
+  if (res.status === 308) return acknowledged(res);
+  if (res.status >= 500 || res.status === 429) throw new Error(`transient ${res.status}`);
+  throw new ApiError(res.status, "upload_failed", `chunk upload failed: ${res.status} ${(await res.text()).slice(0, 200)}`);
+}
+async function transfer(session2, path, onProgress) {
+  const fd = openSync(path, "r");
+  try {
+    let failures = 0;
+    let state = await probe(session2);
+    while (state !== "done") {
+      onProgress(state, session2.size_bytes);
+      try {
+        state = await sendChunk(session2, fd, state);
+        failures = 0;
+      } catch (error) {
+        if (error instanceof ApiError || ++failures >= MAX_ATTEMPTS) throw error;
+        await new Promise((done) => setTimeout(done, Math.min(3e4, 500 * 2 ** failures)));
+        state = await probe(session2);
+      }
+    }
+    onProgress(session2.size_bytes, session2.size_bytes);
+  } finally {
+    closeSync(fd);
+  }
+}
+async function uploadLargeFile(path, mediaType, expiresInSeconds, onProgress) {
+  const { size, mtimeMs } = statSync(path);
+  const stateFile = statePath(path, size, mtimeMs);
+  let session2 = loadSession(stateFile, expiresInSeconds);
+  if (session2) {
+    try {
+      await probe(session2);
+    } catch (error) {
+      if (!(error instanceof ApiError) || error.status !== 404 && error.status !== 410) throw error;
+      session2 = null;
+    }
+  }
+  if (!session2) {
+    session2 = await api("POST", "/files/uploads", {
+      filename: basename(path),
+      size_bytes: size,
+      mime_type: mediaType,
+      ...expiresInSeconds ? { expires_in_seconds: expiresInSeconds } : {}
+    });
+    mkdirSync(dirname(stateFile), { recursive: true });
+    const saved = { ...session2, path: resolve(path), mtimeMs, expiresInSeconds };
+    writeFileSync(stateFile, JSON.stringify(saved), { mode: 384 });
+  }
+  await transfer(session2, path, onProgress);
+  const file = await api("POST", `/files/uploads/${encodeURIComponent(session2.id)}/complete`);
+  rmSync(stateFile, { force: true });
+  return file;
+}
+
+// src/files.ts
 var MEDIA_TYPES = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -71,20 +176,24 @@ var MEDIA_TYPES = {
 function mediaTypeFor(path) {
   return MEDIA_TYPES[extname(path).toLowerCase()] ?? "application/octet-stream";
 }
-async function uploadLocalFile(path, expiresInSeconds) {
-  const bytes = readFileSync(path);
-  return uploadFile(new Uint8Array(bytes), basename(path), mediaTypeFor(path), expiresInSeconds);
+async function uploadLocalFile(path, expiresInSeconds, onProgress = () => {
+}) {
+  if (statSync2(path).size > SINGLE_REQUEST_MAX_BYTES) {
+    return uploadLargeFile(path, mediaTypeFor(path), expiresInSeconds, onProgress);
+  }
+  const bytes = readFileSync2(path);
+  return uploadFile(new Uint8Array(bytes), basename2(path), mediaTypeFor(path), expiresInSeconds);
 }
 function fileBlock(file) {
   const source = { type: "file", file_id: file.id };
   return file.mime_type.startsWith("image/") ? { type: "image", source } : { type: "document", source, title: file.filename };
 }
-function eventsFor(text, files2, system) {
+function eventsFor(text, files2, system, interactionMode2) {
   const content = [];
   if (text.trim()) content.push({ type: "text", text });
   for (const file of files2) content.push(fileBlock(file));
   if (content.length === 0) throw new Error("nothing to send: pass text, --file or --image");
-  const events = [{ type: "user.message", content }];
+  const events = [{ type: "user.message", content, ...interactionMode2 ? { interaction_mode: interactionMode2 } : {} }];
   if (system?.trim()) events.push({ type: "system.message", content: [{ type: "text", text: system }] });
   return events;
 }
@@ -286,8 +395,8 @@ function renderContextPage(page) {
 }
 
 // src/agent-file.ts
-import { existsSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { dirname, resolve } from "path";
+import { existsSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve2 } from "path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 var fileInstructionSchema = external_exports.object({
   name: external_exports.string(),
@@ -319,7 +428,7 @@ var agentFileSchema = external_exports.object({
   memory_mb: external_exports.number().int().optional()
 });
 function readAgentFile(path) {
-  const raw = readFileSync2(path, "utf8");
+  const raw = readFileSync3(path, "utf8");
   const parsed = agentFileSchema.safeParse(parseToml(raw));
   if (!parsed.success) {
     const issue = parsed.error.issues[0];
@@ -331,11 +440,11 @@ function readAgentFile(path) {
       `${path}: reasoning_effort '${file.reasoning_effort}' is not available for ${file.type} \u2014 ${reasoningEffortDocLine()}`
     );
   }
-  const base = dirname(resolve(path));
+  const base = dirname2(resolve2(path));
   const inline = (ref, inlineContent) => {
     if (inlineContent !== void 0) return inlineContent;
     if (!ref) return void 0;
-    return readFileSync2(resolve(base, ref), "utf8");
+    return readFileSync3(resolve2(base, ref), "utf8");
   };
   const spec = {
     name: file.name,
@@ -361,14 +470,14 @@ function readAgentFile(path) {
   return { file, spec };
 }
 function stampId(path, id) {
-  const doc = parseToml(readFileSync2(path, "utf8"));
+  const doc = parseToml(readFileSync3(path, "utf8"));
   doc.id = id;
   delete doc.slug;
-  writeFileSync(path, stringifyToml(doc));
+  writeFileSync2(path, stringifyToml(doc));
 }
 function scaffoldAgentFile(path, name) {
   if (existsSync(path)) throw new Error(`${path} already exists`);
-  writeFileSync(
+  writeFileSync2(
     path,
     `# agent.toml \u2014 everything the create wizard can set. Only \`name\` is required.
 name = "${name}"
@@ -454,18 +563,18 @@ function renderCatalogAgent(agent2) {
 
 // src/clone.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { basename as basename2, join } from "path";
+import { basename as basename3, join as join2 } from "path";
 import { createInterface } from "readline";
 var PROMPT_CAP = 1e5;
 var HARNESSES = ["claude_code", "codex", "openclaw"];
 function claudeConfigRoot() {
-  return process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR ?? join2(homedir(), ".claude");
 }
 function readIfExists(path) {
   try {
-    return readFileSync3(path, "utf8");
+    return readFileSync4(path, "utf8");
   } catch {
     return void 0;
   }
@@ -481,9 +590,9 @@ function readJson(path) {
 }
 function claudeModel(configRoot) {
   const candidates = [
-    join(process.cwd(), ".claude", "settings.local.json"),
-    join(process.cwd(), ".claude", "settings.json"),
-    join(configRoot, "settings.json")
+    join2(process.cwd(), ".claude", "settings.local.json"),
+    join2(process.cwd(), ".claude", "settings.json"),
+    join2(configRoot, "settings.json")
   ];
   for (const path of candidates) {
     const model = readJson(path)?.model;
@@ -493,11 +602,11 @@ function claudeModel(configRoot) {
 }
 function claudeMcpServers() {
   const merged = {};
-  const userConfig = readJson(join(homedir(), ".claude.json"));
+  const userConfig = readJson(join2(homedir(), ".claude.json"));
   Object.assign(merged, userConfig?.mcpServers ?? {});
   Object.assign(merged, userConfig?.projects?.[process.cwd()]?.mcpServers ?? {});
   const projectConfig = readJson(
-    join(process.cwd(), ".mcp.json")
+    join2(process.cwd(), ".mcp.json")
   );
   Object.assign(merged, projectConfig?.mcpServers ?? {});
   return merged;
@@ -514,13 +623,13 @@ function readClaudeCode() {
   const configRoot = claudeConfigRoot();
   const parts = [];
   const sources = [];
-  const global = readIfExists(join(configRoot, "CLAUDE.md"));
+  const global = readIfExists(join2(configRoot, "CLAUDE.md"));
   if (global?.trim()) {
     parts.push({ label: "Global CLAUDE.md", content: global });
     sources.push("global CLAUDE.md");
   }
   for (const name of ["CLAUDE.md", "AGENTS.md"]) {
-    const project = readIfExists(join(process.cwd(), name));
+    const project = readIfExists(join2(process.cwd(), name));
     if (project?.trim()) {
       parts.push({ label: `Project ${name}`, content: project });
       sources.push(`project ${name}`);
@@ -561,8 +670,8 @@ function detectHarness(explicit) {
     return explicit;
   }
   if (existsSync2(claudeConfigRoot())) return "claude_code";
-  if (existsSync2(join(homedir(), ".codex"))) return "codex";
-  if (existsSync2(join(homedir(), ".openclaw"))) return "openclaw";
+  if (existsSync2(join2(homedir(), ".codex"))) return "codex";
+  if (existsSync2(join2(homedir(), ".openclaw"))) return "openclaw";
   throw new Error(
     "no local harness found (~/.claude, ~/.codex, ~/.openclaw) \u2014 pass --harness to override"
   );
@@ -574,14 +683,14 @@ function readLocal(harness2) {
   );
 }
 function linkPath(configRoot) {
-  return join(configRoot, "agentsky-link.json");
+  return join2(configRoot, "agentsky-link.json");
 }
 function readLink(configRoot) {
   const link = readJson(linkPath(configRoot));
   return link?.agentId ? link : void 0;
 }
 function writeLink(configRoot, link) {
-  writeFileSync2(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
+  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
 `);
 }
 var DEFAULT_VAULT_NAME = "default";
@@ -596,10 +705,10 @@ async function ensureDefaultVaultId() {
   const existing = await fetchDefaultVaultId();
   if (existing) return existing;
   try {
-    const { vault } = await api("POST", "/vaults", {
+    const { vault: vault2 } = await api("POST", "/vaults", {
       display_name: DEFAULT_VAULT_NAME
     });
-    return vault.id;
+    return vault2.id;
   } catch (error) {
     if (error instanceof ApiError && error.status === 409) {
       const raced = await fetchDefaultVaultId();
@@ -683,7 +792,7 @@ async function createClone(local, opts) {
     `model ${local.model ?? "(harness default)"}`,
     `${keptNames.length} MCP server${keptNames.length === 1 ? "" : "s"}${keptNames.length ? ` (${keptNames.join(", ")})` : ""}`
   ].join(" \xB7 ");
-  console.log(`Detected ${local.harness} at ${local.configRoot} (project ${basename2(process.cwd())})`);
+  console.log(`Detected ${local.harness} at ${local.configRoot} (project ${basename3(process.cwd())})`);
   console.log(`Will clone: ${summary}`);
   if (local.truncated) console.log("  note: instructions exceeded 100k chars and were truncated");
   if (local.droppedServers.length) {
@@ -820,22 +929,22 @@ async function clone(opts) {
 }
 
 // src/import-local.ts
-import { closeSync, existsSync as existsSync5, openSync, readdirSync as readdirSync2, readFileSync as readFileSync6, readSync, statSync as statSync3 } from "fs";
+import { closeSync as closeSync3, existsSync as existsSync5, openSync as openSync3, readdirSync as readdirSync3, readFileSync as readFileSync8, readSync as readSync3, statSync as statSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
-import { createHash } from "crypto";
+import { join as join6 } from "path";
+import { createHash as createHash3 } from "crypto";
 
 // src/import-files.ts
 import { isUtf8 } from "buffer";
-import { existsSync as existsSync4, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname3, extname as extname2, isAbsolute, join as join3, relative as relative2, resolve as resolve3, sep as sep2, basename as basename4 } from "path";
+import { dirname as dirname4, extname as extname2, isAbsolute, join as join4, relative as relative2, resolve as resolve4, sep as sep2, basename as basename5 } from "path";
 
 // src/import-workspace.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4, realpathSync, statSync } from "fs";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync5, realpathSync, statSync as statSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, dirname as dirname2, join as join2, relative, sep } from "path";
+import { basename as basename4, dirname as dirname3, join as join3, relative, sep } from "path";
 import { parse as parseToml2 } from "smol-toml";
 var MAX_TREE = 5e3;
 var SKILL_LINE = /Base directory for this skill: (\/[^\s"'\\<>]+)/g;
@@ -845,26 +954,26 @@ function git(cwd, ...args) {
 }
 var isFile = (path) => {
   try {
-    return statSync(path).isFile();
+    return statSync3(path).isFile();
   } catch {
     return false;
   }
 };
 var isDir = (path) => {
   try {
-    return statSync(path).isDirectory();
+    return statSync3(path).isDirectory();
   } catch {
     return false;
   }
 };
 function sharedInstructionPaths(home = homedir2()) {
-  const rules = join2(home, ".agents", "rules");
+  const rules = join3(home, ".agents", "rules");
   let ruleFiles = [];
   try {
-    ruleFiles = readdirSync(rules).filter((name) => name.endsWith(".md")).sort().map((name) => join2(rules, name));
+    ruleFiles = readdirSync(rules).filter((name) => name.endsWith(".md")).sort().map((name) => join3(rules, name));
   } catch {
   }
-  return [join2(home, "AGENTS.md"), join2(home, "MEMORY.md"), ...ruleFiles].filter(isFile);
+  return [join3(home, "AGENTS.md"), join3(home, "MEMORY.md"), ...ruleFiles].filter(isFile);
 }
 function strings(value, out, depth = 0) {
   if (depth > 12) return;
@@ -873,18 +982,18 @@ function strings(value, out, depth = 0) {
   else if (value && typeof value === "object") for (const item of Object.values(value)) strings(item, out, depth + 1);
 }
 function skillRoots(cwd, home) {
-  const claude = process.env.CLAUDE_CONFIG_DIR ?? join2(home, ".claude");
-  const codex = process.env.CODEX_HOME ?? join2(home, ".codex");
+  const claude = process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude");
+  const codex = process.env.CODEX_HOME ?? join3(home, ".codex");
   return [
-    ...cwd ? [join2(cwd, ".claude", "skills"), join2(cwd, ".agents", "skills")] : [],
-    join2(home, ".agents", "skills"),
-    join2(claude, "skills"),
-    join2(codex, "skills"),
-    join2(home, ".hermes", "skills")
+    ...cwd ? [join3(cwd, ".claude", "skills"), join3(cwd, ".agents", "skills")] : [],
+    join3(home, ".agents", "skills"),
+    join3(claude, "skills"),
+    join3(codex, "skills"),
+    join3(home, ".hermes", "skills")
   ];
 }
 function pluginSkill(plugin, skill, home) {
-  const base = join2(process.env.CLAUDE_CONFIG_DIR ?? join2(home, ".claude"), "plugins");
+  const base = join3(process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude"), "plugins");
   const walk = (dir, depth) => {
     if (depth > 7) return null;
     let entries;
@@ -895,8 +1004,8 @@ function pluginSkill(plugin, skill, home) {
     }
     for (const entry2 of entries) {
       if (!entry2.isDirectory() || entry2.name === "node_modules" || entry2.name === ".git") continue;
-      const path = join2(dir, entry2.name);
-      if (entry2.name === skill && basename3(dir) === "skills" && path.includes(`${sep}${plugin}${sep}`) && isFile(join2(path, "SKILL.md"))) return path;
+      const path = join3(dir, entry2.name);
+      if (entry2.name === skill && basename4(dir) === "skills" && path.includes(`${sep}${plugin}${sep}`) && isFile(join3(path, "SKILL.md"))) return path;
       const found = walk(path, depth + 1);
       if (found) return found;
     }
@@ -908,16 +1017,16 @@ function findSkill(name, cwd, home) {
   const [scope, skill] = name.includes(":") ? name.split(":", 2) : [null, name];
   if (scope && skill) return pluginSkill(scope, skill, home);
   for (const root of skillRoots(cwd, home)) {
-    const direct = join2(root, name);
-    if (isFile(join2(direct, "SKILL.md"))) return realpathSync(direct);
+    const direct = join3(root, name);
+    if (isFile(join3(direct, "SKILL.md"))) return realpathSync(direct);
   }
   return null;
 }
 function loadedSkills(records, touched, cwd, home = homedir2()) {
   const dirs = /* @__PURE__ */ new Map();
   const missing = /* @__PURE__ */ new Set();
-  const add = (dir, name = basename3(dir)) => {
-    if (!isFile(join2(dir, "SKILL.md"))) return false;
+  const add = (dir, name = basename4(dir)) => {
+    if (!isFile(join3(dir, "SKILL.md"))) return false;
     const real = realpathSync(dir);
     if (![...dirs.values()].includes(real)) dirs.set(name, real);
     return true;
@@ -937,13 +1046,13 @@ function loadedSkills(records, touched, cwd, home = homedir2()) {
       if (!dir || !add(dir, name)) missing.add(name);
     }
   }
-  for (const path of touched) if (basename3(path) === "SKILL.md") add(dirname2(path));
+  for (const path of touched) if (basename4(path) === "SKILL.md") add(dirname3(path));
   for (const name of dirs.keys()) missing.delete(name);
   return { found: [...dirs].map(([name, dir]) => ({ name: name.replace(/[^A-Za-z0-9._:-]/g, "-"), dir })), missing: [...missing] };
 }
 function readJson2(path) {
   try {
-    const value = JSON.parse(readFileSync4(path, "utf8"));
+    const value = JSON.parse(readFileSync5(path, "utf8"));
     return value && typeof value === "object" ? value : null;
   } catch {
     return null;
@@ -988,16 +1097,16 @@ function mcpServers(harness2, cwd, home = homedir2()) {
     }
   };
   if (harness2 === "claude_code") {
-    const config = readJson2(join2(process.env.CLAUDE_CONFIG_DIR ? dirname2(process.env.CLAUDE_CONFIG_DIR) : home, ".claude.json"));
+    const config = readJson2(join3(process.env.CLAUDE_CONFIG_DIR ? dirname3(process.env.CLAUDE_CONFIG_DIR) : home, ".claude.json"));
     const projects = config?.projects && typeof config.projects === "object" ? config.projects : {};
     const root = cwd ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || cwd : "";
     if (cwd) push(projects[cwd]?.mcpServers ?? projects[root]?.mcpServers, "local");
-    if (root) push(readJson2(join2(root, ".mcp.json"))?.mcpServers, "project");
+    if (root) push(readJson2(join3(root, ".mcp.json"))?.mcpServers, "project");
     push(config?.mcpServers, "user");
   }
   if (harness2 === "codex") {
     try {
-      const config = parseToml2(readFileSync4(join2(process.env.CODEX_HOME ?? join2(home, ".codex"), "config.toml"), "utf8"));
+      const config = parseToml2(readFileSync5(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "config.toml"), "utf8"));
       push(config.mcp_servers, "user");
     } catch {
     }
@@ -1035,7 +1144,7 @@ function workspaceState(cwd, harness2, skills2, home = homedir2(), title = null)
       harness: harness2,
       title: title?.trim().slice(0, 120) || null,
       cwd: cwd ? cwd.replace(home, "~") : null,
-      project: cwd ? basename3(root ?? cwd) : null,
+      project: cwd ? basename4(root ?? cwd) : null,
       git: gitState,
       tree: tree.slice(0, MAX_TREE),
       tree_truncated: tree.length > MAX_TREE,
@@ -1057,7 +1166,7 @@ function skillFiles(skill) {
     }
     for (const entry2 of entries) {
       if (entry2.name === "node_modules" || entry2.name === ".git" || entry2.name === "__pycache__" || entry2.name === ".venv") continue;
-      const path = join2(dir, entry2.name);
+      const path = join3(dir, entry2.name);
       if (entry2.isDirectory()) walk(path, depth + 1);
       else if (entry2.isFile()) out.push({ path, name: `skills/${skill.name}/${relative(skill.dir, path).split(sep).join("/")}` });
     }
@@ -1068,7 +1177,7 @@ function skillFiles(skill) {
 function codexThreadName(sessionId, home = homedir2()) {
   let name = null;
   try {
-    for (const line of readFileSync4(join2(process.env.CODEX_HOME ?? join2(home, ".codex"), "session_index.jsonl"), "utf8").split("\n")) {
+    for (const line of readFileSync5(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "session_index.jsonl"), "utf8").split("\n")) {
       if (!line.includes(sessionId)) continue;
       try {
         const entry2 = JSON.parse(line);
@@ -1130,7 +1239,7 @@ function classify(path) {
   if (DOCUMENTS[ext]) return { kind: "document", mediaType: DOCUMENTS[ext] };
   if (IMAGES[ext]) return { kind: "image", mediaType: IMAGES[ext] };
   if (TEXT[ext]) return { kind: "text", mediaType: TEXT[ext] };
-  if (PLAIN_TEXT.has(ext) || PLAIN_NAMES.has(basename4(path))) return { kind: "text", mediaType: "text/plain" };
+  if (PLAIN_TEXT.has(ext) || PLAIN_NAMES.has(basename5(path))) return { kind: "text", mediaType: "text/plain" };
   return null;
 }
 var SHELL_READ = /(?:^|[\s;&|(`"'])(?:cat|head|tail|nl|less|more|wc|bat|sed\s+-n\s+(?:'[^']*'|"[^"]*"|\S+))(?:\s+-[\w-]+(?:\s+\d+)?)*\s+((?:~|\.{0,2}\/)?[\w@%+./~-]*[\w-]\.[\w]{1,10}|\/[\w@%+./-]+)/g;
@@ -1149,8 +1258,8 @@ function touchedPaths(records, cwd, home = homedir3()) {
   const add = (raw, base) => {
     if (!raw || raw.length > 1e3) return;
     const path = raw.replace(/^~(?=\/)/, home);
-    if (isAbsolute(path)) out.add(resolve3(path));
-    else if (base) out.add(resolve3(base, path));
+    if (isAbsolute(path)) out.add(resolve4(path));
+    else if (base) out.add(resolve4(base, path));
   };
   const call = (name, input) => {
     const i = obj(input);
@@ -1187,33 +1296,33 @@ function touchedPaths(records, cwd, home = homedir3()) {
   return [...out];
 }
 function gitRoot(dir) {
-  for (let d = dir; ; d = dirname3(d)) {
-    if (existsSync4(join3(d, ".git"))) return d;
-    if (d === dirname3(d)) return null;
+  for (let d = dir; ; d = dirname4(d)) {
+    if (existsSync4(join4(d, ".git"))) return d;
+    if (d === dirname4(d)) return null;
   }
 }
 function instructionPaths(cwd, harness2, home = homedir3()) {
   const out = [];
   if (cwd && existsSync4(cwd)) {
     const root = gitRoot(cwd) ?? cwd;
-    for (let d = resolve3(cwd); ; d = dirname3(d)) {
-      for (const name of INSTRUCTION_FILES) out.push(join3(d, name));
-      if (d === root || d === dirname3(d)) break;
+    for (let d = resolve4(cwd); ; d = dirname4(d)) {
+      for (const name of INSTRUCTION_FILES) out.push(join4(d, name));
+      if (d === root || d === dirname4(d)) break;
     }
   }
-  if (harness2 === "claude_code") out.push(join3(process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude"), "CLAUDE.md"));
-  if (harness2 === "codex") out.push(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "AGENTS.md"));
+  if (harness2 === "claude_code") out.push(join4(process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude"), "CLAUDE.md"));
+  if (harness2 === "codex") out.push(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "AGENTS.md"));
   out.push(...sharedInstructionPaths(home));
   return out.filter((path) => {
     try {
-      return statSync2(path).isFile();
+      return statSync4(path).isFile();
     } catch {
       return false;
     }
   });
 }
 function resourceName(path, cwd, home = homedir3()) {
-  const inside = cwd ? relative2(resolve3(cwd), path) : "";
+  const inside = cwd ? relative2(resolve4(cwd), path) : "";
   if (cwd && inside && !inside.startsWith("..") && !isAbsolute(inside)) return `workspace/${inside.split(sep2).join("/")}`;
   const underHome = relative2(home, path);
   const shown = !underHome.startsWith("..") && !isAbsolute(underHome) ? `~/${underHome}` : path.replace(/^\/+/, "");
@@ -1225,7 +1334,7 @@ function resourceLine(name, mediaType, data) {
 }
 function collectSessionFiles(records, opts) {
   const home = opts.home ?? homedir3();
-  const exclude = new Set((opts.exclude ?? []).map((path) => resolve3(path)));
+  const exclude = new Set((opts.exclude ?? []).map((path) => resolve4(path)));
   const leftOut = [];
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
@@ -1240,7 +1349,7 @@ function collectSessionFiles(records, opts) {
     }
     let size;
     try {
-      const stat = statSync2(path);
+      const stat = statSync4(path);
       if (!stat.isFile()) return;
       size = stat.size;
     } catch {
@@ -1290,7 +1399,7 @@ function collectSessionFiles(records, opts) {
   for (const file of candidates) {
     let data;
     try {
-      data = readFileSync5(file.path);
+      data = readFileSync6(file.path);
     } catch {
       leftOut.push({ path: file.path, reason: "missing" });
       continue;
@@ -1324,6 +1433,325 @@ function collectSessionFiles(records, opts) {
   return { lines, bytes, attached, leftOut, setup };
 }
 
+// src/import-environment.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import { closeSync as closeSync2, createWriteStream, lstatSync, mkdtempSync, openSync as openSync2, readdirSync as readdirSync2, readFileSync as readFileSync7, readSync as readSync2, rmSync as rmSync2 } from "fs";
+import { tmpdir } from "os";
+import { join as join5 } from "path";
+import { isUtf8 as isUtf82 } from "buffer";
+import { createGzip } from "zlib";
+
+// ../../packages/spec/src/import-layout.ts
+import { gzipSync } from "zlib";
+function folderName(workspace2, sourceCwd) {
+  const raw = workspace2?.project || (sourceCwd ? sourceCwd.split("/").filter(Boolean).pop() : "") || "";
+  const cleaned = raw.replace(/[^A-Za-z0-9._ -]/g, "-").replace(/^[^A-Za-z0-9_]+/, "").replace(/\.\.+/g, ".").slice(0, 80).trim();
+  return cleaned || "imported-session";
+}
+function envName(server, field) {
+  return `${server}_${field}`.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+function ownServer(server, platform) {
+  try {
+    return server.transport !== "stdio" && platform.ownHost.test(new URL(server.url ?? "").hostname);
+  } catch {
+    return false;
+  }
+}
+function mcpJson(servers, platform) {
+  const entries = servers.filter((server) => !ownServer(server, platform)).map((server) => {
+    if (server.transport === "stdio") {
+      return [server.name, {
+        command: server.command,
+        ...server.args?.length ? { args: server.args } : {},
+        ...server.env?.length ? { env: Object.fromEntries(server.env.map((name) => [name, `\${${name}:-}`])) } : {}
+      }];
+    }
+    const query = server.query?.length ? `?${server.query.map((name) => `${encodeURIComponent(name)}=\${${envName(server.name, name)}:-}`).join("&")}` : "";
+    return [server.name, {
+      type: server.transport,
+      url: `${server.url}${query}`,
+      ...server.headers?.length ? { headers: Object.fromEntries(server.headers.map((name) => [name, `\${${envName(server.name, name)}:-}`])) } : {}
+    }];
+  });
+  return JSON.stringify({ mcpServers: Object.fromEntries(entries) }, null, 2) + "\n";
+}
+function bullet(items, none) {
+  return items.length ? items.map((item) => `- ${item}`).join("\n") : `- ${none}`;
+}
+function readme(folder, workspace2, counts, skills2, mcpWritten, platform) {
+  const git2 = workspace2?.git;
+  const servers = workspace2?.mcp_servers ?? [];
+  const missingSkills = (workspace2?.skills ?? []).filter((skill) => !skill.found).map((skill) => skill.name);
+  const secrets2 = servers.filter((server) => !ownServer(server, platform)).flatMap((server) => [
+    ...server.env ?? [],
+    ...(server.headers ?? []).map((name) => envName(server.name, name)),
+    ...(server.query ?? []).map((name) => envName(server.name, name))
+  ]);
+  const where = workspace2?.cwd ? ` (${workspace2.cwd})` : "";
+  return [
+    "# Imported working copy",
+    "",
+    `This folder (/workspace/${folder}) holds what the imported conversation worked with on the person's computer.`,
+    "It is historical context: verify a path before acting on it, and follow the person's current message.",
+    "",
+    "## Files",
+    counts.wholeFolder ? `- The whole working directory${where}, ${counts.project} files at the same relative paths: its tracked files and new files git does not ignore (every file when it is not a repository), without version-control data, dependency and build output, or credential files.` : `- ${counts.project} files from the original working directory${where}, at the same relative paths: the files the conversation read, wrote or edited and its instruction files. The rest of the working tree did not travel${workspace2?.tree?.length ? `; its full file list is in ${platform.notesDir}/workspace.json (\`tree\`)` : ""}.`,
+    ...counts.outside ? [`- ${counts.outside} files from elsewhere on that computer (shared instructions such as ~/AGENTS.md, and files outside the working directory) under ${platform.notesDir}/files/, with ~ as home/.`] : [],
+    ...counts.attachments ? [`- ${counts.attachments} attachments of the conversation under ${platform.notesDir}/attachments/.`] : [],
+    "- Text was redacted on that computer before upload: a masked value (\u25CF\u25CF\u25CF\u25CF\u25CF) is a secret that was removed, not the real content.",
+    "",
+    "## Repository",
+    ...git2 ? [
+      `- Remote: ${git2.remote ?? "none"}`,
+      `- Branch: ${git2.branch ?? "detached"} at commit ${git2.commit ?? "unknown"}${git2.ahead ? ` (${git2.ahead} commits not pushed)` : ""}`,
+      ...git2.dirty?.length ? [`- Uncommitted changes in ${git2.dirty.length} paths${counts.wholeFolder ? " are already in these files" : ""}; the change against that commit is ${platform.notesDir}/uncommitted.patch (apply with \`git apply\` on a checkout of that commit).`] : ["- No uncommitted changes."],
+      counts.wholeFolder ? "- This folder's own git history starts with this copy; the project's history is on the remote." : `- To get the whole repository, clone the remote at that commit (connect GitHub in ${platform.name} if it is private), apply the patch, then use the files here.`
+    ] : ["- The working directory was not a git repository."],
+    "",
+    "## Skills",
+    bullet(skills2.map((name) => `${name}: .claude/skills/${name}/SKILL.md (also .agents/skills/${name}/)`), "No skills were loaded."),
+    ...missingSkills.length ? ["", `Loaded but no longer on that computer, so not carried: ${missingSkills.join(", ")}.`] : [],
+    "",
+    "## Tool servers (MCP)",
+    bullet(servers.map((server) => `${server.name} (${server.transport}${server.scope ? `, ${server.scope}` : ""}): ${server.transport === "stdio" ? [server.command, ...server.args ?? []].join(" ") : server.url}`), "None were configured."),
+    ...mcpWritten ? ["", `They are written to .mcp.json in this folder with every key as \${NAME:-}, except ${platform.name}'s own server, whose tools this session already has. Their values never leave the person's computer${secrets2.length ? `; these must be supplied to use them: ${[...new Set(secrets2)].join(", ")}` : ""}. A stdio server runs only if its command is installed here, and Claude Code connects a project server only once it is approved.`] : [],
+    ""
+  ].join("\n");
+}
+function parseWorkspace(file) {
+  if (!file) return null;
+  try {
+    const value = JSON.parse(file.data.toString("utf8"));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function importLayout(files2, sourceCwd, platform, wholeFolder) {
+  if (!files2.length && !wholeFolder) return null;
+  const workspace2 = parseWorkspace(files2.find((file) => file.name === "agentsky/workspace.json"));
+  const folder = folderName(workspace2, sourceCwd);
+  const entries = /* @__PURE__ */ new Map();
+  const skills2 = /* @__PURE__ */ new Set();
+  const counts = { project: wholeFolder?.files ?? 0, outside: 0, attachments: 0, wholeFolder: Boolean(wholeFolder) };
+  for (const file of files2) {
+    const [kind, ...rest] = file.name.split("/");
+    const path = rest.join("/");
+    if (kind === "workspace") {
+      if (wholeFolder) continue;
+      entries.set(path, file.data);
+      counts.project += 1;
+    } else if (kind === "files") {
+      entries.set(`${platform.notesDir}/files/${path.replace(/^~\//, "home/")}`, file.data);
+      counts.outside += 1;
+    } else if (kind === "imported-attachments") {
+      entries.set(`${platform.notesDir}/attachments/${path}`, file.data);
+      counts.attachments += 1;
+    } else if (kind === "agentsky") entries.set(`${platform.notesDir}/${path}`, file.data);
+    else if (kind === "skills" && rest.length > 1) {
+      const skill = rest[0].split(":").pop();
+      const inside = rest.slice(1).join("/");
+      skills2.add(skill);
+      entries.set(`.claude/skills/${skill}/${inside}`, file.data);
+      entries.set(`.agents/skills/${skill}/${inside}`, file.data);
+    }
+  }
+  const servers = (workspace2?.mcp_servers ?? []).filter((server) => server && typeof server.name === "string" && (server.transport === "stdio" ? typeof server.command === "string" : typeof server.url === "string"));
+  const mcpWritten = servers.length > 0 && !entries.has(".mcp.json") && !wholeFolder?.paths.has(".mcp.json");
+  if (mcpWritten) entries.set(".mcp.json", Buffer.from(mcpJson(servers, platform)));
+  entries.set(`${platform.notesDir}/README.md`, Buffer.from(readme(folder, workspace2 ? { ...workspace2, mcp_servers: servers } : null, counts, [...skills2], mcpWritten, platform)));
+  if (wholeFolder) for (const path of wholeFolder.paths) entries.delete(path);
+  return { folder, entries, skills: [...skills2], mcpServers: servers.map((server) => server.name) };
+}
+var TAR_BLOCK = 512;
+var TAR_END = Buffer.alloc(TAR_BLOCK * 2);
+function header(name, size, type) {
+  const block = Buffer.alloc(TAR_BLOCK);
+  block.write(name, 0, 100, "utf8");
+  block.write("0000644\0", 100);
+  block.write("0000000\0", 108);
+  block.write("0000000\0", 116);
+  block.write(size.toString(8).padStart(11, "0") + "\0", 124);
+  block.write("00000000000\0", 136);
+  block.write("        ", 148);
+  block.write(type, 156);
+  block.write("ustar\x0000", 257);
+  let sum = 0;
+  for (const byte of block) sum += byte;
+  block.write(sum.toString(8).padStart(6, "0") + "\0 ", 148);
+  return block;
+}
+function paxRecord(key, value) {
+  const body = ` ${key}=${value}
+`;
+  let length = Buffer.byteLength(body);
+  for (; ; ) {
+    const total = String(length).length + length;
+    if (String(total).length + length === total) return Buffer.from(`${total}${body}`);
+    length += 1;
+  }
+}
+function tarPadding(size) {
+  const rest = size % TAR_BLOCK;
+  return Buffer.alloc(rest ? TAR_BLOCK - rest : 0);
+}
+function tarHeader(path, size) {
+  if (Buffer.byteLength(path) <= 100) return header(path, size, "0");
+  const pax = paxRecord("path", path);
+  return Buffer.concat([header("PaxHeader", pax.length, "x"), pax, tarPadding(pax.length), header(path, size, "0")]);
+}
+
+// src/import-environment.ts
+var IMPORT_PLATFORM = { name: "AgentSky", ownHost: /(^|\.)(agentsky\.dev|asteroidbelt\.ai)$/i, notesDir: ".agentsky-import" };
+var MAX_ENVIRONMENT_FILES = 2e5;
+var MAX_ENVIRONMENT_BYTES = 2 * 1024 ** 3;
+var MAX_REDACTED_TEXT_BYTES = 10 * 1024 * 1024;
+var SKIPPED = /* @__PURE__ */ new Set([".git", "node_modules", ".venv", "venv", "__pycache__", ".next", "dist", "build", "target", ".DS_Store", ".cache", ".turbo"]);
+var SECRET_FILE2 = /(^|\/)(\.env(\..*)?|\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.?credentials(\.json)?|auth\.json|\.claude\.json|id_(rsa|ed25519|ecdsa)[^/]*|.*\.(pem|key|p12|pfx|keystore|jks|kdbx))$|(^|\/)\.ssh\/|(^|\/)\.aws\/|(^|\/)\.gnupg\/|(^|\/)\.docker\/config\.json$/i;
+function listFiles(cwd) {
+  const git2 = spawnSync2("git", ["-C", cwd, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 512 * 1024 * 1024 });
+  if (git2.status === 0) return git2.stdout.split("\0").filter(Boolean).filter((path) => !path.split("/").some((part) => part === ".git"));
+  const out = [];
+  const walk = (dir, prefix) => {
+    let entries;
+    try {
+      entries = readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry2 of entries) {
+      if (SKIPPED.has(entry2.name)) continue;
+      const rel = prefix ? `${prefix}/${entry2.name}` : entry2.name;
+      if (entry2.isDirectory()) walk(join5(dir, entry2.name), rel);
+      else out.push(rel);
+      if (out.length > MAX_ENVIRONMENT_FILES) return;
+    }
+  };
+  walk(cwd, "");
+  return out;
+}
+function textOf(path, size) {
+  if (size > MAX_REDACTED_TEXT_BYTES) return null;
+  const data = readFileSync7(path);
+  if (data.subarray(0, 8e3).includes(0) || !isUtf82(data)) return null;
+  return data;
+}
+async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
+  const listed = listFiles(cwd);
+  if (listed.length > MAX_ENVIRONMENT_FILES) throw new Error(`The working folder has more than ${MAX_ENVIRONMENT_FILES} files; import it with --no-environment.`);
+  const scratch = mkdtempSync(join5(tmpdir(), "sky-environment-"));
+  const path = join5(scratch, "environment.tar.gz");
+  const leftOut = [];
+  const written = /* @__PURE__ */ new Set();
+  const hash = createHash2("sha256");
+  let bytes = 0;
+  let redacted2 = 0;
+  const gzip = createGzip({ level: 6 });
+  const sink = createWriteStream(path);
+  gzip.on("data", (chunk) => {
+    bytes += chunk.length;
+    hash.update(chunk);
+  });
+  gzip.pipe(sink);
+  const done = new Promise((resolve10, reject) => {
+    sink.on("finish", () => resolve10());
+    sink.on("error", reject);
+    gzip.on("error", reject);
+  });
+  const write = (chunk) => new Promise((resolve10, reject) => {
+    if (bytes > MAX_ENVIRONMENT_BYTES) {
+      reject(new Error(`The working folder packs to more than ${MAX_ENVIRONMENT_BYTES / 1024 ** 3} GiB; import it with --no-environment.`));
+      return;
+    }
+    if (gzip.write(chunk)) resolve10();
+    else gzip.once("drain", resolve10);
+  });
+  try {
+    for (const rel of listed) {
+      const full = join5(cwd, ...rel.split("/"));
+      if (SECRET_FILE2.test(rel)) {
+        leftOut.push({ path: rel, reason: "credential file" });
+        continue;
+      }
+      let stat;
+      try {
+        stat = lstatSync(full);
+      } catch {
+        continue;
+      }
+      if (!stat.isFile()) {
+        leftOut.push({ path: rel, reason: "not a regular file" });
+        continue;
+      }
+      const text = textOf(full, stat.size);
+      if (text) {
+        const masked = redactSecretValues(text.toString("utf8"));
+        if (Object.keys(masked.hits).length) redacted2 += 1;
+        const data = Buffer.from(masked.text, "utf8");
+        await write(tarHeader(rel, data.length));
+        await write(data);
+        await write(tarPadding(data.length));
+      } else {
+        await write(tarHeader(rel, stat.size));
+        const fd = openSync2(full, "r");
+        try {
+          const chunk = Buffer.alloc(1024 * 1024);
+          let left = stat.size;
+          for (let offset = 0; left > 0; ) {
+            const read = readSync2(fd, chunk, 0, Math.min(chunk.length, left), offset);
+            if (read <= 0) throw new Error(`${rel} changed while it was packed; import again.`);
+            await write(Buffer.from(chunk.subarray(0, read)));
+            offset += read;
+            left -= read;
+          }
+        } finally {
+          closeSync2(fd);
+        }
+        await write(tarPadding(stat.size));
+      }
+      written.add(rel);
+    }
+    const layout = importLayout(resources, cwd, platform, { files: written.size, paths: written });
+    for (const [entry2, data] of layout?.entries ?? []) {
+      await write(tarHeader(entry2, data.length));
+      await write(data);
+      await write(tarPadding(data.length));
+    }
+    await write(TAR_END);
+    gzip.end();
+    await done;
+    if (bytes > MAX_ENVIRONMENT_BYTES) throw new Error(`The working folder packs to more than ${MAX_ENVIRONMENT_BYTES / 1024 ** 3} GiB; import it with --no-environment.`);
+    return {
+      path,
+      folder: layout?.folder ?? "imported-session",
+      bytes,
+      sha256: hash.digest("hex"),
+      files: written.size + (layout?.entries.size ?? 0),
+      redacted: redacted2,
+      leftOut,
+      dispose: () => rmSync2(scratch, { recursive: true, force: true })
+    };
+  } catch (error) {
+    gzip.destroy();
+    sink.destroy();
+    rmSync2(scratch, { recursive: true, force: true });
+    throw error;
+  }
+}
+function resourcesOf(lines) {
+  return lines.flatMap((line) => {
+    try {
+      const record = JSON.parse(line);
+      if (record.type !== "import.resource" || typeof record.name !== "string" || typeof record.media_type !== "string" || typeof record.data !== "string") return [];
+      return [{ name: record.name, mediaType: record.media_type, data: Buffer.from(record.data, "base64") }];
+    } catch {
+      return [];
+    }
+  });
+}
+
 // src/import-local.ts
 function redactLine2(raw) {
   return redactLine(raw).line;
@@ -1336,12 +1764,12 @@ function decodeWorkspace(encoded) {
   }
 }
 function readPrefix(filePath) {
-  const fd = openSync(filePath, "r");
+  const fd = openSync3(filePath, "r");
   try {
     const bytes = Buffer.alloc(256 * 1024);
-    return bytes.subarray(0, readSync(fd, bytes, 0, bytes.length, 0)).toString("utf8");
+    return bytes.subarray(0, readSync3(fd, bytes, 0, bytes.length, 0)).toString("utf8");
   } finally {
-    closeSync(fd);
+    closeSync3(fd);
   }
 }
 function sniffTitle(filePath) {
@@ -1396,16 +1824,16 @@ function sniffTitle(filePath) {
   }
 }
 function listClaudeCodeSessions(limit) {
-  const root = process.env.CLAUDE_CONFIG_DIR ?? join4(homedir4(), ".claude");
-  const projectsDir = join4(root, "projects");
+  const root = process.env.CLAUDE_CONFIG_DIR ?? join6(homedir4(), ".claude");
+  const projectsDir = join6(root, "projects");
   if (!existsSync5(projectsDir)) return [];
   const sessions = [];
   try {
-    for (const encoded of readdirSync2(projectsDir)) {
-      const projectDir = join4(projectsDir, encoded);
+    for (const encoded of readdirSync3(projectsDir)) {
+      const projectDir = join6(projectsDir, encoded);
       let entries;
       try {
-        entries = readdirSync2(projectDir);
+        entries = readdirSync3(projectDir);
       } catch {
         continue;
       }
@@ -1413,22 +1841,22 @@ function listClaudeCodeSessions(limit) {
       for (const entry2 of entries) {
         if (!entry2.endsWith(".jsonl")) continue;
         const sessionId = entry2.slice(0, -6);
-        const mainFile = join4(projectDir, entry2);
+        const mainFile = join6(projectDir, entry2);
         let stat;
         try {
-          stat = statSync3(mainFile);
+          stat = statSync5(mainFile);
         } catch {
           continue;
         }
         if (!stat.isFile()) continue;
         let discoveryError;
         const subagentFiles = [];
-        const subagentDir = join4(projectDir, sessionId, "subagents");
+        const subagentDir = join6(projectDir, sessionId, "subagents");
         if (existsSync5(subagentDir)) {
           try {
-            const subFiles = readdirSync2(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
+            const subFiles = readdirSync3(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
             for (const f of subFiles) {
-              subagentFiles.push(join4(subagentDir, f));
+              subagentFiles.push(join6(subagentDir, f));
             }
           } catch {
             discoveryError = "Cannot read all recorded subagent conversations. Fix local file access before importing this session.";
@@ -1450,17 +1878,17 @@ function listClaudeCodeSessions(limit) {
   return sessions.sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
 function listCodexSessions(limit) {
-  const sessionsDir = join4(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join4(homedir4(), ".codex"), "sessions");
+  const sessionsDir = join6(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join6(homedir4(), ".codex"), "sessions");
   const records = [];
   function walk(dir) {
     let entries;
     try {
-      entries = readdirSync2(dir, { withFileTypes: true });
+      entries = readdirSync3(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry2 of entries) {
-      const full = join4(dir, entry2.name);
+      const full = join6(dir, entry2.name);
       if (entry2.isDirectory()) {
         walk(full);
         continue;
@@ -1478,7 +1906,7 @@ function listCodexSessions(limit) {
             sessionId: data.id,
             workspace: typeof data.cwd === "string" ? data.cwd : dir,
             title: sniffTitle(full),
-            mtimeMs: statSync3(full).mtimeMs,
+            mtimeMs: statSync5(full).mtimeMs,
             files: [full]
           },
           ...typeof parent === "string" ? { parent } : {}
@@ -1547,7 +1975,7 @@ async function mintTrace(base, harness2) {
 function loadSummaryFile(summaryPath) {
   let raw;
   try {
-    raw = readFileSync6(summaryPath, "utf8");
+    raw = readFileSync8(summaryPath, "utf8");
   } catch {
     throw new Error(`Cannot read summary file: ${summaryPath}`);
   }
@@ -1579,7 +2007,7 @@ function prepareImport(session2, summaryPath, options = {}) {
   let inputBytes = 0;
   let outputBytes = 0;
   const lines = [];
-  const digest = createHash("sha256");
+  const digest = createHash3("sha256");
   let nativeId;
   let redactionCount = 0;
   let encryptedReasoningCount = 0;
@@ -1588,9 +2016,9 @@ function prepareImport(session2, summaryPath, options = {}) {
   const source = new SessionSourceCollector();
   const records = [];
   for (const path of session2.files) {
-    const stat = statSync3(path);
+    const stat = statSync5(path);
     if (!stat.isFile() || (inputBytes += stat.size) > maximum) throw new Error("Selected transcript exceeds the 16 MiB limit or is not a regular file.");
-    const text = readFileSync6(path, "utf8");
+    const text = readFileSync8(path, "utf8");
     for (const raw of text.split("\n")) {
       if (!raw.trim()) continue;
       let record;
@@ -1668,16 +2096,17 @@ function prepareImport(session2, summaryPath, options = {}) {
   if (encryptedReasoningCount > 0) gaps.push({ kind: "encrypted_reasoning", count: encryptedReasoningCount });
   if (compactionCount > 0) gaps.push({ kind: "compaction", count: compactionCount });
   if (unreadableCount > 0) gaps.push({ kind: "unreadable", count: unreadableCount });
-  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps, attachedFiles: files2.attached, leftOutFiles: files2.leftOut, setup: files2.setup };
+  const cwd = meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : "");
+  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps, attachedFiles: files2.attached, leftOutFiles: files2.leftOut, setup: files2.setup, cwd, resourceLines: files2.lines };
 }
 async function importSession(opts) {
   const base = (opts.agentUseUrl ?? agentUseBase()).replace(/\/$/, "");
-  const destination = new URL(base);
-  if (destination.username || destination.password || destination.protocol !== "https:" && !(destination.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(destination.hostname))) {
+  const destination2 = new URL(base);
+  if (destination2.username || destination2.password || destination2.protocol !== "https:" && !(destination2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(destination2.hostname))) {
     throw new Error("Import requires HTTPS, or a loopback development server.");
   }
   opts.onProgress?.("Reading transcript and redacting secrets locally\u2026");
-  const { body, transcriptLines, outputBytes, redactionCount, gaps, attachedFiles, leftOutFiles, setup } = prepareImport(opts.session, opts.summaryPath, { files: opts.files });
+  const { body, transcriptLines, outputBytes, redactionCount, gaps, attachedFiles, leftOutFiles, setup, cwd, resourceLines } = prepareImport(opts.session, opts.summaryPath, { files: opts.files });
   let traceId;
   let key;
   if (opts.importKey && opts.grantTraceId) {
@@ -1701,6 +2130,7 @@ async function importSession(opts) {
   }
   const result = await response.json();
   const finalTraceId = result.traceId ?? traceId;
+  const environment = opts.files === false || opts.environment === false || !cwd || !existsSync5(cwd) ? null : await uploadEnvironment(base, key, finalTraceId, cwd, resourceLines, opts.onProgress).catch((error) => ({ error: error instanceof Error ? error.message : String(error) }));
   return {
     traceId: finalTraceId,
     url: `${base}/playground/new?import=${encodeURIComponent(finalTraceId)}`,
@@ -1712,12 +2142,96 @@ async function importSession(opts) {
     gaps,
     attachedFiles,
     leftOutFiles,
-    setup
+    setup,
+    environment
   };
 }
+async function grantCall(base, key, path, body) {
+  const response = await fetch(`${base}${path}`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(3e5),
+    headers: { authorization: `Bearer ${key}`, "content-type": "application/json", "user-agent": USER_AGENT },
+    body: JSON.stringify(body)
+  });
+  const answer = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(typeof answer?.error === "string" ? answer.error : answer?.error?.message ?? `The environment upload failed (${response.status}).`);
+  return answer;
+}
+async function uploadEnvironment(base, key, traceId, cwd, resourceLines, onProgress) {
+  onProgress?.("Packing the working folder (secrets redacted locally)\u2026");
+  const packed = await packEnvironment(cwd, resourcesOf(resourceLines));
+  try {
+    const path = `/api/traces/${encodeURIComponent(traceId)}/environment`;
+    const { upload } = await grantCall(base, key, path, { name: packed.folder, size: packed.bytes, sha256: packed.sha256, files: packed.files });
+    let shown = -1;
+    await transfer(upload, packed.path, (sent, total) => {
+      const percent = Math.floor(sent / total * 100);
+      if (percent >= shown + 10 || sent === total) {
+        shown = percent;
+        onProgress?.(`Uploading the working folder\u2026 ${percent}% of ${(total / 1024 / 1024).toFixed(1)} MiB`);
+      }
+    });
+    await grantCall(base, key, `${path}/complete`, {});
+    return { folder: packed.folder, files: packed.files, bytes: packed.bytes, redacted: packed.redacted, leftOut: packed.leftOut.length };
+  } finally {
+    packed.dispose();
+  }
+}
+
+// src/channels.ts
+function connectionLine(c) {
+  const route = c.bound_session ? `\u2192 ${c.bound_session.id}${c.bound_session.label ? ` (${c.bound_session.label})` : ""}` : "unrouted";
+  return `${c.id}  ${c.platform.padEnd(9)} ${c.status.padEnd(12)} ${c.label ?? ""}  ${route}`;
+}
+function connectSteps(c) {
+  const steps = [];
+  if (c.connect?.url) steps.push(`Open: ${c.connect.url}`);
+  if (c.connect?.phone && c.connect.code) steps.push(`Text ${c.connect.code} to ${c.connect.phone}`);
+  else if (c.connect?.app_id && c.connect.code) steps.push(`Send ${c.connect.code} to the bot (app ${c.connect.app_id})`);
+  else if (c.connect?.code) steps.push(`Send ${c.connect.code} to the bot`);
+  if (c.connect?.expires_at) steps.push(`Expires ${c.connect.expires_at.replace("T", " ").slice(0, 16)}`);
+  return steps;
+}
+function destination(opts) {
+  if (Boolean(opts.session) === Boolean(opts.webhook)) {
+    throw new ApiError(400, "invalid_destination", "pass exactly one of --session or --webhook");
+  }
+  return opts.session ? { session: opts.session } : { webhook: opts.webhook };
+}
+async function listConnections() {
+  return (await api("GET", "/channels/connections")).connections;
+}
+async function connect(platform, opts) {
+  return api("POST", "/channels/connections", {
+    platform,
+    ...opts.label ? { label: opts.label } : {},
+    ...opts.app ? { app: opts.app } : {},
+    ...opts.session || opts.webhook ? { destination: destination(opts) } : {}
+  });
+}
+async function waitConnected(id, opts = {}) {
+  const deadline = Date.now() + (opts.timeoutMs ?? 10 * 6e4);
+  for (; ; ) {
+    const found = (await listConnections()).find((c) => c.id === id);
+    if (!found) throw new ApiError(404, "not_found", `connection ${id} is gone`);
+    if (found.status !== "PENDING") return found;
+    if (Date.now() > deadline) throw new ApiError(408, "connect_timeout", "the connection was not claimed within 10 minutes");
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 3e3));
+  }
+}
+async function bind(connectionId, opts) {
+  await api("PUT", `/channels/connections/${encodeURIComponent(connectionId)}/binding`, { destination: destination(opts) });
+}
+async function send(threadId, text) {
+  await api("POST", `/channels/threads/${encodeURIComponent(threadId)}/messages`, { parts: [{ type: "markdown", text }] });
+}
+
+// src/connectors.ts
+import { createServer as createServer2 } from "http";
 
 // src/login.ts
-import { createHash as createHash2, randomBytes } from "crypto";
+import { createHash as createHash4, randomBytes } from "crypto";
 import { createServer } from "http";
 import { hostname } from "os";
 import { spawn as spawn2 } from "child_process";
@@ -1733,7 +2247,7 @@ function openBrowser2(url) {
 }
 async function login(opts) {
   const verifier = b64url(randomBytes(32));
-  const challenge = b64url(createHash2("sha256").update(verifier).digest());
+  const challenge = b64url(createHash4("sha256").update(verifier).digest());
   const result = opts.noBrowser ? await headlessLogin(verifier, challenge) : await browserLogin(verifier, challenge);
   saveConfig({
     ...loadConfig(),
@@ -1749,7 +2263,7 @@ async function login(opts) {
 }
 async function browserLogin(verifier, challenge) {
   const state = b64url(randomBytes(16));
-  const code = await new Promise((resolve8, reject) => {
+  const code = await new Promise((resolve10, reject) => {
     const server = createServer((req, res) => {
       const url = new URL(req.url ?? "/", "http://127.0.0.1");
       if (url.pathname !== "/callback") {
@@ -1762,7 +2276,7 @@ async function browserLogin(verifier, challenge) {
       if (url.searchParams.get("state") !== state || !got) {
         reject(new Error("login callback state mismatch"));
       } else {
-        resolve8(got);
+        resolve10(got);
       }
       server.close();
     });
@@ -1815,18 +2329,251 @@ async function headlessLogin(verifier, challenge) {
   throw new Error("login timed out after 10 minutes");
 }
 
+// src/connectors.ts
+async function listApps(query, limit = 50) {
+  const apps = [];
+  let cursor = null;
+  do {
+    const params = new URLSearchParams();
+    if (query) params.set("q", query);
+    if (cursor) params.set("cursor", cursor);
+    const qs = params.toString();
+    const page = await api("GET", `/connectors/apps${qs ? `?${qs}` : ""}`);
+    apps.push(...page.apps);
+    cursor = page.next_cursor;
+  } while (cursor && apps.length < limit);
+  return apps.slice(0, limit);
+}
+function connectionLine2(c) {
+  return `${c.id}  ${c.app_name} (${c.app})  ${c.label}  since ${c.created_at.slice(0, 10)}`;
+}
+function workspaceConnectionLine(c) {
+  const owner = c.workspace_owned ? "the workspace" : c.mine ? "you" : c.shared_by?.name ?? c.shared_by?.user_id ?? "someone";
+  return `${c.connection_id}  ${c.app_name} (${c.app})  ${c.label}  shared by ${owner}`;
+}
+function browserReturn(start, opts = {}) {
+  return new Promise((resolve10, reject) => {
+    const server = createServer2((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/done" && url.pathname !== "/failed") {
+        res.writeHead(404).end();
+        return;
+      }
+      const ok = url.pathname === "/done";
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(ok ? "<p>Connected \u2014 you can close this tab and return to your terminal.</p>" : "<p>The app was not connected. Return to your terminal.</p>");
+      server.close();
+      if (ok) resolve10(url.searchParams.get("account_id") ?? void 0);
+      else reject(new ApiError(400, "connect_failed", "the app was not connected"));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      const base = `http://127.0.0.1:${port}`;
+      start(`${base}/done`, `${base}/failed`).then(
+        (authorizeUrl) => {
+          console.log(`Authorize access in your browser:
+  ${authorizeUrl}`);
+          if (opts.open !== false) openBrowser2(authorizeUrl);
+        },
+        (err) => {
+          server.close();
+          reject(err);
+        }
+      );
+    });
+    setTimeout(() => {
+      server.close();
+      reject(new ApiError(408, "connect_timeout", "nobody finished the authorization within 10 minutes"));
+    }, opts.timeoutMs ?? 10 * 6e4).unref();
+  });
+}
+async function connectApp(app, opts = {}) {
+  const base = opts.workspace ? `/universes/${encodeURIComponent(opts.workspace)}/connections` : "/connectors/connections";
+  const accountId = await browserReturn(async (success_url, error_url) => {
+    const { url } = await api("POST", base, { app, success_url, error_url });
+    return url;
+  }, { open: opts.open });
+  const done = await api("POST", `${base}/complete`, {
+    app,
+    ...accountId ? { account_id: accountId } : {}
+  });
+  return done.connection;
+}
+
+// src/routine-triggers.ts
+var triggerPath = (id, resource) => `/routines/${encodeURIComponent(id)}/${resource}`;
+function inboundLine(u) {
+  if (!u) return "no inbound URL \u2014 make one with --create";
+  return u.url ?? `inbound URL ${u.prefix}\u2026 made ${u.created_at.slice(0, 10)}${u.last_used_at ? `, last used ${u.last_used_at.slice(0, 16).replace("T", " ")}` : ", never used"}`;
+}
+function precheckLine(p) {
+  if (!p) return "no precheck: every scheduled fire runs";
+  const last = p.last_result ? `last check ${p.last_result}${p.last_error ? ` (${p.last_error.type}: ${p.last_error.message})` : ""}` : "not checked yet";
+  return `fires only when ${p.url} changes \xB7 ${last}`;
+}
+function triggerLine(t, available = true) {
+  if (!t) return "no chat trigger";
+  const where = t.thread_id ? `thread ${t.thread_id} on ${t.connection_id}` : `any conversation on ${t.connection_id}`;
+  const what = t.text_prefix ? `messages starting "${t.text_prefix}"` : "every message";
+  return `${what} in ${where} start a run${available ? "" : " (chat messages are not offered to routines in this deployment)"}`;
+}
+function deliverLine(d) {
+  return d ? `answers post to thread ${d.thread_id} on ${d.connection_id}` : "answers are posted nowhere";
+}
+function triggerBody(opts) {
+  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
+  return { connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {}, ...opts.prefix ? { text_prefix: opts.prefix } : {} };
+}
+function deliverBody(opts) {
+  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
+  return { type: "channel_thread", connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {} };
+}
+async function triggerRequest(id, resource, change) {
+  const path = triggerPath(id, resource);
+  if (change.remove) return api("DELETE", path);
+  if (change.create) return api("POST", path);
+  if (change.body) return api("PUT", path, change.body);
+  return api("GET", path);
+}
+
+// src/session-workspace.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import { createHash as createHash5, randomUUID } from "crypto";
+import { readdirSync as readdirSync4, statSync as statSync6 } from "fs";
+import { basename as basename6, join as join7, relative as relative3, resolve as resolve5 } from "path";
+var SINGLE_IMPORT_MAX = 25 * 1024 * 1024;
+var PART_SIZE = 8 * 1024 * 1024;
+var SKIPPED2 = /* @__PURE__ */ new Set([".git", "node_modules"]);
+var workspacePath = (id) => `/sessions/${encodeURIComponent(id)}/workspace`;
+async function listFiles2(id, path, hidden) {
+  const query = new URLSearchParams();
+  if (path) query.set("path", path);
+  if (hidden) query.set("hidden", "true");
+  const qs = query.toString();
+  return api("GET", `${workspacePath(id)}/files${qs ? `?${qs}` : ""}`);
+}
+function entryLine(e) {
+  const size = e.type === "directory" ? "-" : String(e.size ?? 0);
+  return `${e.type === "directory" ? "d" : "-"} ${size.padStart(10)}  ${(e.mtime ?? "").slice(0, 16).replace("T", " ")}  ${e.name}${e.type === "directory" ? "/" : ""}`;
+}
+async function readFile(id, path) {
+  return (await apiBytes("GET", `${workspacePath(id)}/files/content?path=${encodeURIComponent(path)}`)).bytes;
+}
+function renderChanges(changes) {
+  if (!changes.repos.length) return [`no git repository under ${changes.root}`];
+  return changes.repos.flatMap((r) => [
+    `${r.path === "." ? changes.root : r.path}: ${r.status ? "changed" : "clean"}`,
+    ...(r.stat ?? r.status ?? "").split("\n").filter(Boolean).map((line) => `  ${line}`)
+  ]);
+}
+async function workspacePatch(id, repo) {
+  const { patch, ...meta } = await api("POST", `${workspacePath(id)}/patch`, { repo });
+  return { meta, patch: Buffer.from(patch, "base64") };
+}
+function folderFiles(dir) {
+  const git2 = spawnSync3("git", ["-C", dir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8" });
+  const top = spawnSync3("git", ["-C", dir, "rev-parse", "--show-prefix"], { encoding: "utf8" });
+  if (git2.status === 0 && top.status === 0) {
+    return git2.stdout.split("\0").filter((path) => path && statSync6(join7(dir, path), { throwIfNoEntry: false })?.isFile());
+  }
+  const files2 = [];
+  const walk = (at) => {
+    for (const entry2 of readdirSync4(at, { withFileTypes: true })) {
+      if (SKIPPED2.has(entry2.name)) continue;
+      const full = join7(at, entry2.name);
+      if (entry2.isDirectory()) walk(full);
+      else if (entry2.isFile()) files2.push(relative3(dir, full));
+    }
+  };
+  walk(dir);
+  return files2;
+}
+function folderArchive(dir, files2) {
+  const tar = spawnSync3("tar", ["--format=ustar", "-czf", "-", "-C", dir, "-T", "-"], {
+    input: files2.join("\n"),
+    env: { ...process.env, COPYFILE_DISABLE: "1" },
+    maxBuffer: 2 * 1024 * 1024 * 1024
+  });
+  if (tar.status !== 0) throw new ApiError(400, "archive_failed", `tar failed: ${tar.stderr.toString().trim()}`);
+  return tar.stdout;
+}
+async function importFolder(id, dir, opts = {}) {
+  const root = resolve5(dir);
+  const name = opts.name ?? basename6(root);
+  const archive = opts.archive ?? folderArchive(root, folderFiles(root));
+  if (archive.length <= SINGLE_IMPORT_MAX) {
+    const res = await apiBytes("POST", `${workspacePath(id)}/import?name=${encodeURIComponent(name)}`, { bytes: archive, mediaType: "application/gzip" });
+    return res.json();
+  }
+  const sha256 = createHash5("sha256").update(archive).digest("hex");
+  let upload = await api("POST", `${workspacePath(id)}/imports`, { name, size: archive.length, sha256, part_size: PART_SIZE });
+  const uploadPath = `${workspacePath(id)}/imports/${encodeURIComponent(upload.id)}`;
+  for (let part = 0; part < upload.parts; part += 1) {
+    if (upload.received.includes(part)) continue;
+    const bytes = archive.subarray(part * upload.part_size, (part + 1) * upload.part_size);
+    await apiBytes("PUT", `${uploadPath}/parts/${part}`, { bytes, mediaType: "application/octet-stream" });
+  }
+  upload = await api("POST", `${uploadPath}/complete`);
+  while (upload.state !== "imported" && upload.state !== "failed") {
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
+    upload = await api("GET", uploadPath);
+  }
+  if (upload.state === "failed") throw new ApiError(422, upload.error?.code ?? "import_failed", upload.error?.message ?? "the import failed");
+  return { path: upload.path ?? name, files: upload.files ?? 0 };
+}
+function renderAccess(a) {
+  const lines = [
+    `${a.session_id}${a.title ? ` \u2014 ${a.title}` : ""}`,
+    `  ${a.visibility === "private" ? "private to its owner" : `visible to ${a.workspace.name} (${a.workspace.slug})`} \xB7 you are its ${a.access}`,
+    `  owner: ${a.owner.name ?? a.owner.email ?? "unknown"}`
+  ];
+  if (a.viewers) lines.push(a.viewers.length ? `  viewers: ${a.viewers.map((v) => v.email).join(", ")}` : "  viewers: none");
+  return lines;
+}
+function accessPatch(opts) {
+  if (opts.private && opts.members) throw new ApiError(400, "invalid_request", "pass --private or --members, not both");
+  return {
+    ...opts.private ? { visibility: "private" } : opts.members ? { visibility: "workspace" } : {},
+    ...opts.addViewer?.length ? { add_viewers: opts.addViewer } : {},
+    ...opts.removeViewer?.length ? { remove_viewers: opts.removeViewer } : {}
+  };
+}
+function engineChange(model, thinking) {
+  if (!model && !thinking) return null;
+  return {
+    ...model ? { llm: model } : {},
+    ...thinking ? { reasoningEffort: thinking === "default" ? null : thinking } : {}
+  };
+}
+var TERMINAL = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
+async function handoff(id, targetAgent, opts = {}) {
+  let { handoff: h } = await api("POST", `/sessions/${encodeURIComponent(id)}/handoff`, {
+    target_agent: targetAgent,
+    ...opts.fromMessage ? { last_message_id: opts.fromMessage } : {}
+  }, { idempotencyKey: opts.idempotencyKey ?? randomUUID() });
+  opts.onStatus?.(h);
+  while (opts.wait && !TERMINAL.has(h.status)) {
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
+    const next = (await api("GET", `/session-handoffs/${encodeURIComponent(h.id)}`)).handoff;
+    if (next.status !== h.status) opts.onStatus?.(next);
+    h = next;
+  }
+  return h;
+}
+
 // src/local-agents.ts
 import { existsSync as existsSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { join as join8 } from "path";
 function localAgents(env = process.env, home = homedir5()) {
-  const claude = env.CLAUDE_CONFIG_DIR || join5(home, ".claude");
-  const codex = env.CODEX_HOME || join5(home, ".codex");
-  const cursor = join5(home, ".cursor");
+  const claude = env.CLAUDE_CONFIG_DIR || join8(home, ".claude");
+  const codex = env.CODEX_HOME || join8(home, ".codex");
+  const cursor = join8(home, ".cursor");
   return [
-    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join5(claude, "skills") },
-    { id: "codex", name: "Codex", root: codex, skillsDir: join5(codex, "skills") },
-    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join5(cursor, "skills") }
+    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join8(claude, "skills") },
+    { id: "codex", name: "Codex", root: codex, skillsDir: join8(codex, "skills") },
+    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join8(cursor, "skills") }
   ];
 }
 function detectLocalAgents(env = process.env, home = homedir5()) {
@@ -1926,21 +2673,21 @@ async function readTurn(sessionId, opts = {}) {
   for (; ; ) {
     const reading = latestTurn(await history(sessionId));
     if (reading.finished || !opts.wait || Date.now() >= deadline) return reading;
-    await new Promise((resolve8) => setTimeout(resolve8, opts.intervalMs ?? 3e3));
+    await new Promise((resolve10) => setTimeout(resolve10, opts.intervalMs ?? 3e3));
   }
 }
 
 // src/setup.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname5, join as join9 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, join as join12 } from "path";
 import { createInterface as createInterface3 } from "readline";
 
 // src/mcp-register.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 
 // src/skill.ts
-import { mkdirSync, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 
 // src/catalog-file.ts
 var CATALOG_FILE = "catalog.md";
@@ -1966,13 +2713,13 @@ function entry(agent2) {
   return lines.join("\n");
 }
 function renderCatalog(agents, generatedAt) {
-  const header = [
+  const header2 = [
     "# AgentSky agent catalog",
     "",
     `Every agent you can hire, as of ${generatedAt.toISOString()}. Start one with \`start_session\` and its handle, written with the @.`,
     "Run `npx @agentsky/sky setup` again to refresh this file; `search_catalog` always has the current list."
   ];
-  if (!agents.length) return [...header, "", "The catalog was empty when this file was written. Use `search_catalog`.", ""].join("\n");
+  if (!agents.length) return [...header2, "", "The catalog was empty when this file was written. Use `search_catalog`.", ""].join("\n");
   const own = agents.filter((agent2) => agent2.visibility === "workspace");
   const shared = agents.filter((agent2) => agent2.visibility !== "workspace");
   const sections = [];
@@ -1987,7 +2734,7 @@ function renderCatalog(agents, generatedAt) {
     const title = category.charAt(0).toUpperCase() + category.slice(1);
     sections.push([`## ${title}`, ...groups.get(category).map(entry)].join("\n\n"));
   }
-  return [...header, "", sections.join("\n\n"), ""].join("\n");
+  return [...header2, "", sections.join("\n\n"), ""].join("\n");
 }
 
 // src/skill.ts
@@ -2381,7 +3128,7 @@ To set a per-repo default, create \`.agentsky.json\` at the git root:
 }
 function installedVersion(dir) {
   try {
-    const marker = JSON.parse(readFileSync7(join6(dir, SKILL_MARKER), "utf8"));
+    const marker = JSON.parse(readFileSync9(join9(dir, SKILL_MARKER), "utf8"));
     return typeof marker.version === "string" ? marker.version : null;
   } catch {
     return null;
@@ -2391,25 +3138,25 @@ function isInstalledSkill(dir) {
   return installedVersion(dir) !== null;
 }
 function installSkill(agent2, opts = {}) {
-  const dir = join6(agent2.skillsDir, SKILL_NAME);
+  const dir = join9(agent2.skillsDir, SKILL_NAME);
   const previous = installedVersion(dir);
   const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
   if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
   if (outcome !== "current") {
-    mkdirSync(dir, { recursive: true });
-    writeFileSync3(join6(dir, "SKILL.md"), skillDocument());
-    writeFileSync3(join6(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync4(join9(dir, "SKILL.md"), skillDocument());
+    writeFileSync4(join9(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
 `);
   }
   if (opts.catalog) {
-    mkdirSync(dir, { recursive: true });
-    writeFileSync3(join6(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
-  }
-  const refsDir = join6(dir, REFERENCES_DIR);
-  mkdirSync(refsDir, { recursive: true });
-  writeFileSync3(join6(refsDir, "import.md"), importReferenceDoc());
-  writeFileSync3(join6(refsDir, "workspaces.md"), workspacesReferenceDoc());
-  writeFileSync3(join6(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync4(join9(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+  }
+  const refsDir = join9(dir, REFERENCES_DIR);
+  mkdirSync2(refsDir, { recursive: true });
+  writeFileSync4(join9(refsDir, "import.md"), importReferenceDoc());
+  writeFileSync4(join9(refsDir, "workspaces.md"), workspacesReferenceDoc());
+  writeFileSync4(join9(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
   return { agent: agent2.id, path: dir, outcome };
 }
 
@@ -2418,9 +3165,9 @@ var MCP_SERVER_NAME = SKILL_NAME;
 var CODEX_TOKEN_ENV = "AGENTSKY_API_KEY";
 function systemCommandRunner() {
   return {
-    has: (command) => spawnSync2(command, ["--version"], { stdio: "ignore" }).status === 0,
+    has: (command) => spawnSync4(command, ["--version"], { stdio: "ignore" }).status === 0,
     run: (command, args) => {
-      const result = spawnSync2(command, args, { encoding: "utf8" });
+      const result = spawnSync4(command, args, { encoding: "utf8" });
       return { status: result.status, stderr: result.stderr ?? "" };
     }
   };
@@ -2460,10 +3207,10 @@ function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
 }
 
 // src/setup-local.ts
-import { isUtf8 as isUtf82 } from "buffer";
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync4 } from "fs";
+import { isUtf8 as isUtf83 } from "buffer";
+import { existsSync as existsSync7, readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, resolve as resolve4 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join10, resolve as resolve6 } from "path";
 import { parse as parseToml3 } from "smol-toml";
 var MAX_SKILL_FILE_BYTES = 1024 * 1024;
 var MAX_IMPORT_DEPTH = 5;
@@ -2477,7 +3224,7 @@ function sensitive(name) {
   return name.startsWith(".env") || name.endsWith(".pem") || name.endsWith(".key");
 }
 function redacted(data) {
-  if (data.includes(0) || !isUtf82(data)) return new Uint8Array(data);
+  if (data.includes(0) || !isUtf83(data)) return new Uint8Array(data);
   try {
     const line = redactLine(JSON.stringify({ type: "import.resource", name: "skill", media_type: "text/plain", data: data.toString("base64") }), { requireStructured: true }).line;
     return new Uint8Array(Buffer.from(JSON.parse(line).data, "base64"));
@@ -2487,12 +3234,12 @@ function redacted(data) {
 }
 function skillFiles2(root, prefix) {
   const files2 = [];
-  for (const entry2 of readdirSync3(root, { withFileTypes: true })) {
-    const path = join7(root, entry2.name);
+  for (const entry2 of readdirSync5(root, { withFileTypes: true })) {
+    const path = join10(root, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIPPED_DIRS.has(entry2.name)) files2.push(...skillFiles2(path, `${prefix}/${entry2.name}`));
-    } else if (entry2.isFile() && !sensitive(entry2.name) && statSync4(path).size <= MAX_SKILL_FILE_BYTES) {
-      const bytes = redacted(readFileSync8(path));
+    } else if (entry2.isFile() && !sensitive(entry2.name) && statSync7(path).size <= MAX_SKILL_FILE_BYTES) {
+      const bytes = redacted(readFileSync10(path));
       if (bytes) files2.push({ path: `${prefix}/${entry2.name}`, bytes });
     }
   }
@@ -2503,18 +3250,18 @@ function readLocalSkills(agents) {
   const ignored = [];
   for (const agent2 of agents) {
     if (!existsSync7(agent2.skillsDir)) continue;
-    for (const entry2 of readdirSync3(agent2.skillsDir, { withFileTypes: true })) {
-      const dir = join7(agent2.skillsDir, entry2.name);
+    for (const entry2 of readdirSync5(agent2.skillsDir, { withFileTypes: true })) {
+      const dir = join10(agent2.skillsDir, entry2.name);
       let isDir2 = entry2.isDirectory();
       if (entry2.isSymbolicLink()) {
         try {
-          isDir2 = statSync4(dir).isDirectory();
+          isDir2 = statSync7(dir).isDirectory();
         } catch {
           isDir2 = false;
         }
       }
-      if (!isDir2 || !existsSync7(join7(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
-      const name = frontmatterName(readFileSync8(join7(dir, "SKILL.md"), "utf8"));
+      if (!isDir2 || !existsSync7(join10(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
+      const name = frontmatterName(readFileSync10(join10(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
         continue;
@@ -2542,11 +3289,11 @@ function inlineImports(content, from, home, depth, seen) {
     }
     const target = fence ? void 0 : line.match(/^@(\S+\.(?:md|markdown|txt))$/i)?.[1];
     if (!target || depth >= MAX_IMPORT_DEPTH) return line;
-    const path = target.startsWith("~/") ? join7(home, target.slice(2)) : isAbsolute2(target) ? target : resolve4(dirname4(from), target);
+    const path = target.startsWith("~/") ? join10(home, target.slice(2)) : isAbsolute2(target) ? target : resolve6(dirname5(from), target);
     if (seen.includes(path)) return "";
     let imported;
     try {
-      imported = readFileSync8(path, "utf8");
+      imported = readFileSync10(path, "utf8");
     } catch {
       return line;
     }
@@ -2559,10 +3306,10 @@ function readGlobalInstructions(agents, home = homedir6()) {
   for (const agent2 of agents) {
     const file = INSTRUCTION_FILES2[agent2.id];
     if (!file) continue;
-    const path = join7(agent2.root, file);
+    const path = join10(agent2.root, file);
     let raw;
     try {
-      raw = readFileSync8(path, "utf8");
+      raw = readFileSync10(path, "utf8");
     } catch {
       continue;
     }
@@ -2581,7 +3328,7 @@ ${item.content.trim()}`).join("\n\n");
 }
 function readJson3(path) {
   try {
-    return JSON.parse(readFileSync8(path, "utf8"));
+    return JSON.parse(readFileSync10(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -2595,10 +3342,10 @@ function bearerOf(def) {
   return match?.[1] ?? null;
 }
 function serversOf(agent2, home) {
-  if (agent2.id === "claude_code") return readJson3(join7(home, ".claude.json"))?.mcpServers ?? {};
-  if (agent2.id === "cursor") return readJson3(join7(agent2.root, "mcp.json"))?.mcpServers ?? {};
+  if (agent2.id === "claude_code") return readJson3(join10(home, ".claude.json"))?.mcpServers ?? {};
+  if (agent2.id === "cursor") return readJson3(join10(agent2.root, "mcp.json"))?.mcpServers ?? {};
   try {
-    return parseToml3(readFileSync8(join7(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
+    return parseToml3(readFileSync10(join10(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
   } catch {
     return {};
   }
@@ -2619,9 +3366,9 @@ function findLocalSecrets(agents, home = homedir6()) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join8 } from "path";
+import { join as join11 } from "path";
 import { createInterface as createInterface2 } from "readline";
 var ALIASES = {
   claude: "anthropic",
@@ -2637,14 +3384,24 @@ function providerFor(name) {
   }
   return provider;
 }
+var MANAGED_ALIASES = {
+  ...ALIASES,
+  cursor: "cursor",
+  grok: "xai",
+  xai: "xai",
+  muse: "meta",
+  meta: "meta"
+};
 function managedProviderFor(name) {
-  if (name.toLowerCase() === "cursor") return "cursor";
-  const provider = ALIASES[name.toLowerCase()];
+  const provider = MANAGED_ALIASES[name.toLowerCase()];
   if (!provider) {
-    throw new ApiError(400, "unknown_provider", `unknown provider "${name}" \u2014 use claude, chatgpt or cursor`);
+    throw new ApiError(400, "unknown_provider", `unknown provider "${name}" \u2014 use claude, chatgpt, cursor, grok or muse`);
   }
   return provider;
 }
+function accountQuery(account) {
+  return account ? `?accountId=${encodeURIComponent(account)}` : "";
+}
 function ask(question) {
   return new Promise((done) => {
     const rl = createInterface2({ input: process.stdin, output: process.stdout });
@@ -2707,11 +3464,11 @@ async function connectClaude() {
   console.log(`Connected Claude subscription${expiry}. Powers new eligible agents.`);
 }
 function codexSignIn(env = process.env, home = homedir7()) {
-  const path = join8(env.CODEX_HOME || join8(home, ".codex"), "auth.json");
+  const path = join11(env.CODEX_HOME || join11(home, ".codex"), "auth.json");
   if (!existsSync8(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
-  const raw = readFileSync9(path, "utf8");
+  const raw = readFileSync11(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     return { path, raw, account: parsed.tokens?.account_id };
@@ -2720,11 +3477,11 @@ function codexSignIn(env = process.env, home = homedir7()) {
   }
 }
 function cursorSignIn(env = process.env, home = homedir7()) {
-  const path = join8(env.XDG_CONFIG_HOME || join8(home, ".config"), "cursor", "auth.json");
+  const path = join11(env.XDG_CONFIG_HOME || join11(home, ".config"), "cursor", "auth.json");
   if (!existsSync8(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
-  const raw = readFileSync9(path, "utf8");
+  const raw = readFileSync11(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") throw new Error("shape");
@@ -2787,7 +3544,87 @@ async function disconnect(name, opts) {
     console.log(
       `${affectedAgents.length} agent${affectedAgents.length === 1 ? "" : "s"} still point at it and will fail: ` + affectedAgents.map((a) => a.agentId ?? a.id).join(", ")
     );
-    console.log("Switch them to Platform in each agent's Configure tab (or reconnect).");
+    console.log(`Move them to platform credits with \`sky auth switch-to-credits ${name}\`, or reconnect.`);
+  }
+}
+async function browserSignIn(name, opts) {
+  const provider = managedProviderFor(name);
+  const base = `/model-subscriptions/${provider}/logins`;
+  const readCode = opts.readCode ?? ask;
+  let { login: login2 } = await api("POST", base, {
+    ...opts.account ? { accountId: opts.account } : {},
+    ...opts.label ? { label: opts.label } : {}
+  });
+  let shown = false;
+  let codeSent = false;
+  const cancel = () => {
+    if ("loginId" in login2 && login2.loginId) {
+      void api("DELETE", `${base}/${encodeURIComponent(login2.loginId)}`).catch(() => void 0);
+    }
+  };
+  process.once("SIGINT", cancel);
+  try {
+    for (; ; ) {
+      if (login2.state === "connected" || login2.state === "cleanup_pending") {
+        if (login2.state === "cleanup_pending") cancel();
+        return login2.subscription;
+      }
+      if (login2.state === "failed") {
+        if (login2.loginId) cancel();
+        throw new ApiError(422, "sign_in_failed", login2.reason);
+      }
+      if (login2.state === "waiting" && !shown) {
+        shown = true;
+        console.log(`Sign in to ${MODEL_SUBSCRIPTION_PROVIDER_NAME[provider]} at:
+  ${login2.url}`);
+        if (login2.userCode) console.log(`Confirm this code on that page: ${login2.userCode}`);
+        if (opts.browser !== false) openBrowser2(login2.url);
+      }
+      if (login2.state === "waiting" && login2.acceptsCode && !codeSent) {
+        const code = await readCode("Paste the code the sign-in page shows: ");
+        if (!code) throw new ApiError(400, "no_code", "no code provided");
+        await api("POST", `${base}/${encodeURIComponent(login2.loginId)}/code`, { code });
+        codeSent = true;
+      } else {
+        await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
+      }
+      ({ login: login2 } = await api("GET", `${base}/${encodeURIComponent(login2.loginId)}`));
+    }
+  } finally {
+    process.removeListener("SIGINT", cancel);
+  }
+}
+async function subscriptionUsage(name, account) {
+  const provider = managedProviderFor(name);
+  const { usage } = await api("GET", `/model-subscriptions/${provider}/usage${accountQuery(account)}`);
+  return usage;
+}
+function renderSubscriptionUsage(name, usage) {
+  const label = MODEL_SUBSCRIPTION_PROVIDER_NAME[managedProviderFor(name)];
+  if (usage.status === "unavailable") return [`${label}: usage unavailable (${usage.reason ?? "unknown"})`];
+  const head = [`${label}${usage.plan ? ` ${usage.plan}` : ""}`, usage.allowed === false ? "limit reached" : null].filter(Boolean).join(" \xB7 ");
+  const rows = usage.windows.map(
+    (w) => `  ${w.label}: ${Math.round(w.remainingPercent)}% left${w.resetsAt ? ` \xB7 resets ${w.resetsAt.slice(0, 16).replace("T", " ")}` : ""}`
+  );
+  return [head, ...rows.length ? rows : ["  no usage windows reported"]];
+}
+async function switchToCredits(name, opts) {
+  const provider = managedProviderFor(name);
+  const label = MODEL_SUBSCRIPTION_PROVIDER_NAME[provider];
+  if (!opts.yes) {
+    const ok = await confirm2(`Move every agent on this ${label} account to platform credits? Their running sessions restart.`);
+    if (!ok) {
+      console.log("Aborted.");
+      return;
+    }
+  }
+  const result = await api(
+    "POST",
+    `/model-subscriptions/${provider}/switch-to-credits${accountQuery(opts.account)}`
+  );
+  console.log(`Moved ${result.switched} agent${result.switched === 1 ? "" : "s"} to platform credits.`);
+  if (result.restartFailures.length) {
+    console.log(`Couldn't restart: ${result.restartFailures.join(", ")} \u2014 they pick up credits on their next start.`);
   }
 }
 
@@ -2803,11 +3640,11 @@ function planProviders(names2) {
   }));
 }
 function reportPath() {
-  return join9(dirname5(configPath()), "setup.json");
+  return join12(dirname6(configPath()), "setup.json");
 }
 function loadReport() {
   try {
-    const saved = JSON.parse(readFileSync10(reportPath(), "utf8"));
+    const saved = JSON.parse(readFileSync12(reportPath(), "utf8"));
     return { agents: saved.agents ?? [], plans: saved.plans ?? [], ...saved.secrets ? { secrets: saved.secrets } : {} };
   } catch {
     return { agents: [], plans: [] };
@@ -2820,8 +3657,8 @@ function mergeReport(base, next) {
   return { agents, plans, ...secrets2 ? { secrets: secrets2 } : {} };
 }
 function saveReport(report) {
-  mkdirSync2(dirname5(reportPath()), { recursive: true });
-  writeFileSync4(reportPath(), `${JSON.stringify(report, null, 2)}
+  mkdirSync3(dirname6(reportPath()), { recursive: true });
+  writeFileSync5(reportPath(), `${JSON.stringify(report, null, 2)}
 `, { mode: 384 });
 }
 function confirm3(question) {
@@ -2908,7 +3745,7 @@ async function connectedProviders() {
 var WORKSPACE_VAULT_NAME = "default";
 async function findWorkspaceVault() {
   const { vaults } = await api("GET", "/vaults");
-  return vaults.find((vault) => vault.display_name === WORKSPACE_VAULT_NAME)?.id ?? null;
+  return vaults.find((vault2) => vault2.display_name === WORKSPACE_VAULT_NAME)?.id ?? null;
 }
 async function workspaceVaultId() {
   const existing = await findWorkspaceVault();
@@ -3170,17 +4007,17 @@ function renderArtifact(artifact2) {
 }
 
 // src/skills-store.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync11, statSync as statSync5 } from "fs";
-import { basename as basename5, join as join10, relative as relative3, resolve as resolve5 } from "path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
+import { basename as basename7, join as join13, relative as relative4, resolve as resolve7 } from "path";
 function skillBundle(dir) {
-  const root = resolve5(dir);
-  const top = basename5(root);
+  const root = resolve7(dir);
+  const top = basename7(root);
   const files2 = [];
   const walk = (path) => {
-    for (const name of readdirSync4(path).sort()) {
-      const full = join10(path, name);
-      if (statSync5(full).isDirectory()) walk(full);
-      else files2.push({ path: `${top}/${relative3(root, full)}`, bytes: readFileSync11(full) });
+    for (const name of readdirSync6(path).sort()) {
+      const full = join13(path, name);
+      if (statSync8(full).isDirectory()) walk(full);
+      else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync13(full) });
     }
   };
   walk(root);
@@ -3190,7 +4027,7 @@ function skillBundle(dir) {
 async function uploadSkill(dir, displayName) {
   const form = new FormData();
   for (const file of skillBundle(dir)) form.append("files", new Blob([new Uint8Array(file.bytes)]), file.path);
-  form.append("displayName", displayName ?? basename5(resolve5(dir)));
+  form.append("displayName", displayName ?? basename7(resolve7(dir)));
   return apiForm("POST", "/skills", form);
 }
 async function listSkills() {
@@ -3222,9 +4059,9 @@ async function workspaceSlug(explicit) {
   if (current) return current;
   return (await api("GET", "/whoami")).universe.slug;
 }
-var workspacePath = (slug) => `/universes/${encodeURIComponent(slug)}`;
+var workspacePath2 = (slug) => `/universes/${encodeURIComponent(slug)}`;
 async function listMembers(slug) {
-  return api("GET", `${workspacePath(slug)}/members`);
+  return api("GET", `${workspacePath2(slug)}/members`);
 }
 function findMember(members, ref) {
   const needle = ref.toLowerCase();
@@ -3243,20 +4080,20 @@ function inviteBody(emails, options) {
   };
 }
 async function invite(slug, emails, options) {
-  return api("POST", `${workspacePath(slug)}/invites`, inviteBody(emails, options));
+  return api("POST", `${workspacePath2(slug)}/invites`, inviteBody(emails, options));
 }
 async function withdrawInvite(slug, inviteId) {
-  await api("DELETE", `${workspacePath(slug)}/invites/${encodeURIComponent(inviteId)}`);
+  await api("DELETE", `${workspacePath2(slug)}/invites/${encodeURIComponent(inviteId)}`);
 }
 async function setRole(slug, memberRef, role) {
   if (role !== "admin" && role !== "member") throw new ApiError(400, "invalid_request", "a role is admin or member");
   const member = findMember((await listMembers(slug)).members, memberRef);
-  await api("PATCH", `${workspacePath(slug)}/members/${encodeURIComponent(member.user_id)}`, { role });
+  await api("PATCH", `${workspacePath2(slug)}/members/${encodeURIComponent(member.user_id)}`, { role });
   return member;
 }
 async function removeMember(slug, memberRef) {
   const member = findMember((await listMembers(slug)).members, memberRef);
-  await api("DELETE", `${workspacePath(slug)}/members/${encodeURIComponent(member.user_id)}`);
+  await api("DELETE", `${workspacePath2(slug)}/members/${encodeURIComponent(member.user_id)}`);
   return member;
 }
 async function joinWorkspace(token) {
@@ -3289,7 +4126,7 @@ function policyRuleBody(options) {
     ...options.disabled ? { enabled: false } : {}
   };
 }
-var policiesPath = (scope) => "session" in scope ? `/sessions/${encodeURIComponent(scope.session)}/policies` : `${workspacePath(scope.slug)}/policies`;
+var policiesPath = (scope) => "session" in scope ? `/sessions/${encodeURIComponent(scope.session)}/policies` : `${workspacePath2(scope.slug)}/policies`;
 async function listPolicies(scope, effective = false) {
   if (effective && "session" in scope) return api("GET", `/sessions/${encodeURIComponent(scope.session)}/effective-policy`);
   return api("GET", policiesPath(scope));
@@ -3353,20 +4190,99 @@ function typedConfirmation(slug) {
   });
 }
 
+// src/vaults.ts
+import { createInterface as createInterface5 } from "readline";
+var vaultPath = (id) => `/vaults/${encodeURIComponent(id)}`;
+function secretLine(s) {
+  const target = s.secret_name ? `$${s.secret_name}` : s.mcp_server_url ?? "";
+  return `${s.id}  ${s.auth_type.padEnd(20)} ${s.display_name}  ${target}  ${s.status}${s.expires_at ? `  expires ${s.expires_at.slice(0, 10)}` : ""}`;
+}
+async function readSecretValue(prompt, input = process.stdin) {
+  if (!input.isTTY) {
+    const chunks = [];
+    for await (const chunk of input) chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  }
+  const rl = createInterface5({ input, output: process.stdout, terminal: true });
+  const write = rl._writeToOutput.bind(rl);
+  let prompted = false;
+  rl._writeToOutput = (s) => {
+    if (!prompted) {
+      prompted = true;
+      write(s);
+    }
+  };
+  const value = await new Promise((done) => rl.question(prompt, done));
+  rl.close();
+  process.stdout.write("\n");
+  return value;
+}
+function secretBody(input) {
+  if (input.kind === "mcp") {
+    return { display_name: input.displayName ?? new URL(input.url).host, auth: { type: "static_bearer", mcp_server_url: input.url, token: input.token } };
+  }
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(input.name)) {
+    throw new ApiError(400, "invalid_name", `"${input.name}" is not an environment variable name`);
+  }
+  if (!input.hosts.length) throw new ApiError(400, "no_hosts", "name at least one --host the secret may be sent to");
+  const injection = {
+    header: true,
+    body: false,
+    ...input.header ? { header_name: input.header } : {},
+    ...input.template ? { value_template: input.template } : {}
+  };
+  return {
+    display_name: input.displayName ?? input.name,
+    auth: { type: "environment_variable", secret_name: input.name, value: input.value, allowed_hosts: input.hosts, injection_location: injection }
+  };
+}
+async function listVaults() {
+  return (await api("GET", "/vaults")).vaults;
+}
+async function listSecrets(vaultId) {
+  return (await api("GET", `${vaultPath(vaultId)}/secrets`)).secrets;
+}
+async function addSecret(vaultId, input) {
+  return (await api("POST", `${vaultPath(vaultId)}/secrets`, secretBody(input))).secret;
+}
+async function updateSecret(vaultId, secretId, patch) {
+  const body = {
+    ...patch.value !== void 0 ? { value: patch.value } : {},
+    ...patch.token !== void 0 ? { token: patch.token } : {},
+    ...patch.hosts?.length ? { allowed_hosts: patch.hosts } : {},
+    ...patch.displayName ? { display_name: patch.displayName } : {}
+  };
+  if (!Object.keys(body).length) throw new ApiError(400, "nothing_to_change", "pass a new value, --host or --name");
+  return (await api("PATCH", `${vaultPath(vaultId)}/secrets/${encodeURIComponent(secretId)}`, body)).secret;
+}
+async function moveSecrets(intoVault, from, dryRun) {
+  const result = await api("POST", `${vaultPath(intoVault)}/secrets/move`, { from, ...dryRun ? { dry_run: true } : {} });
+  return result.secrets;
+}
+function confirmPrompt(question) {
+  return new Promise((done) => {
+    const rl = createInterface5({ input: process.stdin, output: process.stdout });
+    rl.question(`${question} [y/N] `, (answer) => {
+      rl.close();
+      done(/^y(es)?$/i.test(answer.trim()));
+    });
+  });
+}
+
 // src/harness.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname6, join as join11, resolve as resolve6 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname7, join as join14, resolve as resolve8 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
-  return join11(resolve6(dir), HARNESS_FILE);
+  return join14(resolve8(dir), HARNESS_FILE);
 }
 function readHarnessFile(dir) {
   const path = harnessFilePath(dir);
   if (!existsSync9(path)) {
-    throw new Error(`no ${HARNESS_FILE} found in ${resolve6(dir)} \u2014 run \`sky harness init\` first`);
+    throw new Error(`no ${HARNESS_FILE} found in ${resolve8(dir)} \u2014 run \`sky harness init\` first`);
   }
   try {
-    return JSON.parse(readFileSync12(path, "utf8"));
+    return JSON.parse(readFileSync14(path, "utf8"));
   } catch (err) {
     throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -3396,8 +4312,8 @@ function harnessInit(dir) {
   if (existsSync9(path)) {
     throw new Error(`${path} already exists \u2014 delete it to re-init`);
   }
-  mkdirSync3(dirname6(path), { recursive: true });
-  writeFileSync5(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+  mkdirSync4(dirname7(path), { recursive: true });
+  writeFileSync6(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
 `);
   console.log(`Created ${path}`);
   console.log(INIT_COMMENT);
@@ -3534,6 +4450,18 @@ program.hook("preAction", () => {
   const workspace2 = program.opts().workspace;
   if (workspace2) process.env.SKY_WORKSPACE = workspace2;
 });
+var lastProgressDecile = -1;
+function uploadProgress(sent, total) {
+  const percent = Math.floor(sent / total * 100);
+  const line = `uploading ${(sent / 1024 / 1024).toFixed(0)} / ${(total / 1024 / 1024).toFixed(0)} MiB (${percent}%)`;
+  if (process.stderr.isTTY) {
+    process.stderr.write(`\r${line}${sent >= total ? "\n" : ""}`);
+  } else if (Math.floor(percent / 10) !== lastProgressDecile) {
+    lastProgressDecile = Math.floor(percent / 10);
+    process.stderr.write(`${line}
+`);
+  }
+}
 function fail(error) {
   if (error instanceof ApiError) console.error(`sky: ${error.message} (${error.code})`);
   else console.error(`sky: ${error instanceof Error ? error.message : String(error)}`);
@@ -3556,13 +4484,26 @@ auth.command("whoami").description("who the current token acts as").action(
     );
   })
 );
-auth.command("connect <provider>").description("connect a model subscription: claude (setup-token) or chatgpt (Codex sign-in)").option("-y, --yes", "skip the consent prompt").action(
+auth.command("connect <provider>").description("connect a model subscription: claude (setup-token) or chatgpt (Codex sign-in); --browser signs any plan in on its own page").option("-y, --yes", "skip the consent prompt").option("--browser", "sign in on the provider's page instead of using this machine's sign-in (claude, chatgpt, cursor, grok, muse)").option("--account <id>", "with --browser: re-sign an additional account, or `new` to add one").option("--label <label>", "with --browser: name the account").option("--no-open", "with --browser: print the sign-in link without opening it").action(
   run(async (name, opts) => {
+    if (opts.browser) {
+      const sub = await browserSignIn(name, { account: opts.account, label: opts.label, browser: opts.open });
+      console.log(`Connected ${MODEL_SUBSCRIPTION_PROVIDER_NAME[sub.provider]} (${sub.label}). Powers new eligible agents.`);
+      return;
+    }
     const provider = providerFor(name);
     if (provider === "anthropic") await connectClaude();
     else await connectChatgpt(opts);
   })
 );
+auth.command("usage <provider>").description("plan allowance left on a connected model subscription").option("--account <id>", "an additional account (default: the provider's first account)").option("--json", "print the raw usage").action(
+  run(async (name, opts) => {
+    const usage = await subscriptionUsage(name, opts.account);
+    if (opts.json) console.log(JSON.stringify(usage, null, 2));
+    else for (const line of renderSubscriptionUsage(name, usage)) console.log(line);
+  })
+);
+auth.command("switch-to-credits <provider>").description("move the agents on a model subscription onto platform credits (do this before disconnecting)").option("--account <id>", "an additional account (default: the provider's first account)").option("-y, --yes", "skip the confirmation prompt").action(run(async (name, opts) => switchToCredits(name, opts)));
 auth.command("accounts").description("list connected model subscriptions and the agents they power").action(run(async () => listSubscriptions()));
 auth.command("disconnect <provider>").description("disconnect a model subscription (agents on it fail until switched)").option("-y, --yes", "skip the confirmation prompt").action(run(async (name, opts) => disconnect(name, opts)));
 var universe = program.command("universe").description("grouping boundary for agents");
@@ -3774,7 +4715,7 @@ agent.command("destroy <id>").description("delete the spec; requires all session
     console.log(`Destroyed ${id}`);
   })
 );
-agent.command("message <id> [text]").description("send one message to the default session and stream the turn until idle").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").action(
+agent.command("message <id> [text]").description("send one message to the default session and stream the turn until idle").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").option("--plan", "plan mode: the agent inspects and answers with a plan, then waits for you to choose to implement it").option("--build", "build mode for this turn, overriding a session left in plan mode").action(
   run(
     async (id, text, opts) => sendAndFollow(await resolveSessionRef(id), text ?? "", opts)
   )
@@ -3884,7 +4825,7 @@ session.command("delete <id>").description("permanently delete the session, its
     console.log(`Deleted ${id}`);
   })
 );
-session.command("message <ref> [text]").description("send one message (session id, or agent id = its default session)").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").action(
+session.command("message <ref> [text]").description("send one message (session id, or agent id = its default session)").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").option("--plan", "plan mode: the agent inspects and answers with a plan, then waits for you to choose to implement it").option("--build", "build mode for this turn, overriding a session left in plan mode").action(
   run(
     async (ref, text, opts) => sendAndFollow(await resolveSessionRef(ref), text ?? "", opts)
   )
@@ -4026,6 +4967,89 @@ sessionPorts.command("revoke <ref> <port>").description("stop exposing a port; i
     console.log(`Revoked port ${port}`);
   })
 );
+session.command("access <ref>").description("who may use the session; --private/--members and --add-viewer/--remove-viewer change it (owner)").option("--private", "only you can use it").option("--members", "every member of its workspace can read and prompt it").option("--add-viewer <email...>", "people who may read its messages from any workspace").option("--remove-viewer <email...>", "take viewers off").action(
+  run(async (ref, opts) => {
+    const id = await resolveSessionRef(ref);
+    const patch = accessPatch(opts);
+    const path = `/sessions/${encodeURIComponent(id)}/access`;
+    const access = await api(Object.keys(patch).length ? "PATCH" : "GET", path, Object.keys(patch).length ? patch : void 0);
+    for (const line of renderAccess(access)) console.log(line);
+  })
+);
+session.command("shared").description("sessions other people shared with you to read, newest first").option("--limit <n>", "at most this many (1\u2013100, default 50)").action(
+  run(async (opts) => {
+    const { sessions } = await api("GET", `/shared-sessions${opts.limit ? `?limit=${encodeURIComponent(opts.limit)}` : ""}`);
+    if (!sessions.length) console.log("nobody has shared a session with you");
+    for (const s of sessions) console.log(`${s.id}  ${s.agent_type.padEnd(12)} ${s.title ?? "(untitled)"}  from ${s.owner.name ?? s.owner.email ?? "unknown"}  ${s.shared_at.slice(0, 10)}`);
+  })
+);
+session.command("model <ref> [model]").description("show the session's model and thinking level, or switch them; the next turn uses the new ones").option("--thinking <level>", `thinking level for the next turns; "default" returns to the agent's own`).action(
+  run(async (ref, model, opts) => {
+    const id = await resolveSessionRef(ref);
+    const change = engineChange(model, opts.thinking);
+    const { session: s } = change ? await api("PATCH", `/sessions/${encodeURIComponent(id)}`, change) : await api("GET", `/sessions/${encodeURIComponent(id)}`);
+    console.log(`${id}: ${s.llm}${s.reasoningEffort ? ` \xB7 thinking ${s.reasoningEffort}` : ""}${change ? "  (from the next turn)" : ""}`);
+  })
+);
+session.command("handoff <ref> <targetAgent>").description("hand the session's context and workspace to another agent (agent id or catalog handle); prints the new session").option("--from-message <id>", "carry the conversation up to this message only").option("--model <id>", "the model the new session runs").option("--thinking <level>", "the new session's thinking level").option("--no-wait", "return once the handoff is accepted").action(
+  run(async (ref, targetAgent, opts) => {
+    const id = await resolveSessionRef(ref);
+    const change = engineChange(opts.model, opts.thinking);
+    if (change && opts.wait === false) throw new ApiError(400, "invalid_request", "--model and --thinking need the handoff to finish; drop --no-wait");
+    const done = await handoff(id, targetAgent, {
+      fromMessage: opts.fromMessage,
+      wait: opts.wait !== false,
+      onStatus: (h) => console.error(`${h.id}: ${h.status}`)
+    });
+    if (done.status === "failed") throw new ApiError(422, done.error?.code ?? "handoff_failed", done.error?.message ?? "the handoff failed");
+    if (done.target_session && change) await api("PATCH", `/sessions/${encodeURIComponent(done.target_session)}`, change);
+    if (done.target_session) console.log(`${done.target_session}  (${done.resolved_mode === "native_fork" ? "forked" : "from a written summary"})`);
+  })
+);
+var sessionWorkspace = session.command("workspace").description("the session's workspace: list and read files, see changes, take a patch, copy a folder in");
+sessionWorkspace.command("ls <ref> [path]").description("list a directory (default: the workspace root)").option("--hidden", "include dotfiles").action(
+  run(async (ref, path, opts) => {
+    const listing = await listFiles2(await resolveSessionRef(ref), path, Boolean(opts.hidden));
+    for (const e of listing.entries) console.log(entryLine(e));
+    if (listing.truncated) console.error(`(only the first ${listing.entries.length} entries)`);
+  })
+);
+sessionWorkspace.command("cat <ref> <path>").description("print a file (up to 1 MB), or save it with --out").option("--out <file>", "write it to this local file").action(
+  run(async (ref, path, opts) => {
+    const bytes = await readFile(await resolveSessionRef(ref), path);
+    if (opts.out) {
+      writeFileSync7(opts.out, bytes);
+      console.error(`saved ${bytes.length} bytes to ${opts.out}`);
+    } else process.stdout.write(bytes);
+  })
+);
+sessionWorkspace.command("changes <ref>").description("git status and diff summary of each repository in the workspace").action(
+  run(async (ref) => {
+    const changes = await api("GET", `/sessions/${encodeURIComponent(await resolveSessionRef(ref))}/workspace/changes`);
+    for (const line of renderChanges(changes)) console.log(line);
+  })
+);
+sessionWorkspace.command("patch <ref> [repo]").description("the work in a repository since its base branch, as a git patch (default repo: the root)").option("--out <file>", "write the patch to this file instead of stdout").action(
+  run(async (ref, repo, opts) => {
+    const { meta, patch } = await workspacePatch(await resolveSessionRef(ref), repo ?? ".");
+    console.error(`${meta.repo}: ${meta.commits.length} commit${meta.commits.length === 1 ? "" : "s"} since ${meta.base_branch || "the imported copy"} (${meta.base_commit.slice(0, 12)})`);
+    if (!patch.length) console.error("nothing changed");
+    else if (opts.out) {
+      writeFileSync7(opts.out, patch);
+      console.error(`wrote ${opts.out} \u2014 apply with: git apply ${opts.out}`);
+    } else process.stdout.write(patch);
+  })
+);
+sessionWorkspace.command("import <ref> <dir>").description("copy a local folder into the workspace as a git repository (files git ignores are left out)").option("--name <name>", "its folder name in the workspace (default: the local folder's name)").action(
+  run(async (ref, dir, opts) => {
+    const imported = await importFolder(await resolveSessionRef(ref), dir, { name: opts.name });
+    console.log(`${imported.path}  (${imported.files} files)`);
+  })
+);
+function interactionMode(opts) {
+  if (opts.plan && opts.build) throw new ApiError(400, "invalid_request", "pass --plan or --build, not both");
+  return opts.plan ? "plan" : opts.build ? "build" : void 0;
+}
 async function uploadAttachments(opts) {
   const files2 = [];
   for (const path of [...opts.image ?? [], ...opts.file ?? []]) {
@@ -4042,7 +5066,8 @@ function turnOver(frame) {
   return stopReason?.type !== "requires_action";
 }
 async function sendAndFollow(sessionId, text, opts) {
-  const events = eventsFor(text, await uploadAttachments(opts), opts.system);
+  const mode = interactionMode(opts);
+  const events = eventsFor(text, await uploadAttachments(opts), opts.system, mode);
   const controller = new AbortController();
   let opened = null;
   if (!opts.detach) {
@@ -4067,7 +5092,7 @@ async function sendAndFollow(sessionId, text, opts) {
 async function chatLoop(sessionId, opts = {}) {
   console.log(`Chatting with ${sessionId} \u2014 Ctrl-C to leave.`);
   const controller = new AbortController();
-  const rl = createInterface5({ input: process.stdin, output: process.stdout, prompt: "> " });
+  const rl = createInterface6({ input: process.stdin, output: process.stdout, prompt: "> " });
   let system = opts.system;
   void (async () => {
     try {
@@ -4181,9 +5206,9 @@ secrets.command("unset <id> <key>").action(
 );
 program.command("launch").description("scaffold ./agent.toml if absent, create the agent, print its address").option("-f, --file <path>", "agent file", "agent.toml").option("--type <type>", "override the file's harness: hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "override the file's model (must suit the harness)").action(
   run(async (opts) => {
-    const path = resolve7(opts.file);
+    const path = resolve9(opts.file);
     if (!existsSync10(path)) {
-      const name = basename6(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
+      const name = basename8(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
       scaffoldAgentFile(path, name);
       console.log(`Scaffolded ${opts.file} \u2014 edit it anytime; re-apply with \`sky deploy\`.`);
     }
@@ -4214,7 +5239,7 @@ program.command("launch").description("scaffold ./agent.toml if absent, create t
 );
 program.command("deploy").description("re-apply ./agent.toml to the existing agent (idempotent)").option("-f, --file <path>", "agent file", "agent.toml").action(
   run(async (opts) => {
-    const path = resolve7(opts.file);
+    const path = resolve9(opts.file);
     const { file, spec } = readAgentFile(path);
     if (!file.id) {
       console.log("No agent id in the file yet \u2014 running launch instead.");
@@ -4257,7 +5282,7 @@ function formatRelative(msAgo) {
   if (hours < 48) return `${hours}h ago`;
   return `${Math.round(hours / 24)}d ago`;
 }
-program.command("import").description("import a local Claude Code or Codex session to AgentSky and continue it in the cloud").option("--current", "import the session this agent is running in (reads CLAUDE_CODE_SESSION_ID or CODEX_THREAD_ID, then falls back to most recent session in the cwd)").option("--all", "import all found sessions up to --limit").option("-y, --yes", "confirm transfer without prompting (default when --current or --session is given in non-TTY)").option("--json", "print one JSON result object per import and nothing else to stdout").option("--limit <n>", "maximum sessions to list or import", "10").option("--session <id>", "import one specific session by its ID").option("--harness <type>", "claude_code | codex | all (default: all)").option("--summary <path>", "attach a pre-written summary JSON (asteroids.session-summary v1) instead of the auto-generated one").option("--key <importKey>", "import grant key minted by the web page (skips sky auth login)").option("--trace <traceId>", "trace id paired with --key").option("--url <base>", "agent-use app URL (default: derived from SKY_API_URL or AGENT_USE_URL)").option("--no-files", "send the conversation only, without its local files, skills, repository state or tool-server setup").action(
+program.command("import").description("import a local Claude Code or Codex session to AgentSky and continue it in the cloud").option("--current", "import the session this agent is running in (reads CLAUDE_CODE_SESSION_ID or CODEX_THREAD_ID, then falls back to most recent session in the cwd)").option("--all", "import all found sessions up to --limit").option("-y, --yes", "confirm transfer without prompting (default when --current or --session is given in non-TTY)").option("--json", "print one JSON result object per import and nothing else to stdout").option("--limit <n>", "maximum sessions to list or import", "10").option("--session <id>", "import one specific session by its ID").option("--harness <type>", "claude_code | codex | all (default: all)").option("--summary <path>", "attach a pre-written summary JSON (asteroids.session-summary v1) instead of the auto-generated one").option("--key <importKey>", "import grant key minted by the web page (skips sky auth login)").option("--trace <traceId>", "trace id paired with --key").option("--url <base>", "agent-use app URL (default: derived from SKY_API_URL or AGENT_USE_URL)").option("--no-files", "send the conversation only, without its local files, skills, repository state or tool-server setup").option("--no-environment", "keep the working folder on this computer: send only the files the conversation touched").action(
   run(
     async (opts) => {
       if (opts.key && !opts.trace) throw new Error("--key requires --trace <traceId>");
@@ -4315,13 +5340,13 @@ program.command("import").description("import a local Claude Code or Codex sessi
           console.log(`       ${ws}`);
         });
         console.log();
-        const rl = createInterface5({ input: process.stdin, output: process.stdout });
+        const rl = createInterface6({ input: process.stdin, output: process.stdout });
         const answer = await new Promise(
-          (resolve8) => rl.question(
+          (resolve10) => rl.question(
             `Import which session? [1-${candidates.length}, or comma-separated, or "all"]: `,
             (a) => {
               rl.close();
-              resolve8(a.trim());
+              resolve10(a.trim());
             }
           )
         );
@@ -4343,10 +5368,10 @@ program.command("import").description("import a local Claude Code or Codex sessi
       }
       if (!autoConfirm) {
         if (nonInteractive) throw new Error("Use --yes to confirm this transfer in a non-interactive terminal.");
-        const prompt = createInterface5({ input: process.stdin, output: process.stdout });
-        const answer = await new Promise((resolve8) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
+        const prompt = createInterface6({ input: process.stdin, output: process.stdout });
+        const answer = await new Promise((resolve10) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
           prompt.close();
-          resolve8(value);
+          resolve10(value);
         }));
         if (!/^y(?:es)?$/i.test(answer.trim())) {
           console.log("Cancelled. Nothing uploaded.");
@@ -4365,6 +5390,7 @@ Importing ${label} \u2026
           importKey: opts.key,
           grantTraceId: opts.trace,
           files: opts.files,
+          environment: opts.environment,
           onProgress: opts.json ? void 0 : (msg) => process.stdout.write(`  ${msg}
 `)
         });
@@ -4384,11 +5410,14 @@ Importing ${label} \u2026
             skills: result.setup.skills,
             missingSkills: result.setup.missingSkills,
             mcpServers: result.setup.mcpServers,
+            environment: result.environment,
             continueUrl: result.url
           }));
         } else {
           if (result.setup.skills.length || result.setup.mcpServers.length) console.log(`  Carried ${result.setup.skills.length} ${result.setup.skills.length === 1 ? "skill" : "skills"} and the setup of ${result.setup.mcpServers.length} tool ${result.setup.mcpServers.length === 1 ? "server" : "servers"} (their keys stay on this computer).`);
           if (result.attachedFiles.length || result.leftOutFiles.length) console.log(`  Attached ${result.attachedFiles.length} local ${result.attachedFiles.length === 1 ? "file" : "files"}${result.leftOutFiles.length ? `; left out ${result.leftOutFiles.length} (credential, missing, unsupported or over the 30 MiB upload)` : ""}.`);
+          if (result.environment && "folder" in result.environment) console.log(`  Uploaded the working folder ${result.environment.folder}: ${result.environment.files} files, ${(result.environment.bytes / 1024 / 1024).toFixed(1)} MiB packed${result.environment.leftOut ? `, ${result.environment.leftOut} credential or special files left on this computer` : ""}.`);
+          else if (result.environment) console.log(`  The working folder did not upload (${result.environment.error}); the conversation and the files it touched did.`);
           console.log(`  \u2713 Imported. Continue here:
     ${result.url}
 `);
@@ -4400,7 +5429,7 @@ Importing ${label} \u2026
 var files = program.command("files").description("files: upload once, reference by id from any message");
 files.command("upload <path>").description("upload a local file; prints the file id to reference from a message").option("--expires <seconds>", "expire the upload after this many seconds (3600\u20137776000)").action(
   run(async (path, opts) => {
-    const file = await uploadLocalFile(path, opts.expires ? Number(opts.expires) : void 0);
+    const file = await uploadLocalFile(path, opts.expires ? Number(opts.expires) : void 0, uploadProgress);
     console.log(`${file.id}  ${file.filename}  ${file.mime_type}  ${file.size_bytes} bytes`);
   })
 );
@@ -4431,9 +5460,8 @@ files.command("rm <id>").description("delete a file (a session that already rece
 );
 files.command("download <id>").description("download a session file's bytes").requiredOption("-o, --out <path>", "where to write the bytes").action(
   run(async (id, opts) => {
-    const { bytes } = await downloadFile(id);
-    writeFileSync6(opts.out, bytes);
-    console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
+    const written = await downloadFileTo(id, opts.out);
+    console.log(`Wrote ${written} bytes to ${opts.out}`);
   })
 );
 var task = program.command("task").description("a task's shared files and open requests (the task is its first session's id)");
@@ -4448,14 +5476,14 @@ task.command("get <task> <path>").description("read one task file; prints it, or
   run(async (taskId, path, opts) => {
     const bytes = await readTaskFile(taskId, path);
     if (opts.out) {
-      writeFileSync6(opts.out, bytes);
+      writeFileSync7(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync13(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync15(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -4504,6 +5532,28 @@ skills.command("list").description("the workspace's stored skills").action(
     for (const skill of list) console.log(`${skill.id}  ${skill.displayName ?? ""}`);
   })
 );
+async function decideReflection(id, verb) {
+  const { reflection_proposal: p } = await api("POST", `/reflection_proposals/${encodeURIComponent(id)}/${verb}`);
+  console.log(`${p.id} ${p.status}`);
+}
+var reflections = program.command("reflections").description("skill and lesson changes proposed after finished sessions; an owner or admin approves each one");
+reflections.command("list").description("the workspace's proposals, newest first (default: pending)").option("--status <status>", "pending, approved, rejected or superseded", "pending").option("--json", "print JSON").action(
+  run(async (opts) => {
+    const { reflection_proposals: list } = await api(
+      "GET",
+      `/reflection_proposals?status=${encodeURIComponent(opts.status)}`
+    );
+    if (opts.json) return void console.log(JSON.stringify(list, null, 2));
+    if (!list.length) return void console.log(`no ${opts.status} proposals`);
+    for (const p of list) {
+      const target = p.kind === "save_lesson" ? p.path : p.kind === "create_skill" ? `new skill ${p.payload.name}` : `skill ${p.target_skill_id}`;
+      console.log(`${p.id}  ${p.kind}  ${target}  from ${p.session_id}
+  ${p.payload.why ?? ""}`);
+    }
+  })
+);
+reflections.command("approve <id>").description("write the proposal through the skill or memory store").action(run(async (id) => decideReflection(id, "approve")));
+reflections.command("reject <id>").description("decline the proposal; nothing is written").action(run(async (id) => decideReflection(id, "reject")));
 var artifact = program.command("artifact").description("artifacts: publish a task's files as a named, shareable result");
 artifact.command("list").description("the workspace's artifacts, or one task's with --task").option("--task <task>", "only this task's artifacts").action(
   run(async (opts) => {
@@ -4521,7 +5571,7 @@ artifact.command("get <id> <path>").description("read one file of an artifact; p
   run(async (id, path, opts) => {
     const bytes = await readArtifactFile(id, path);
     if (opts.out) {
-      writeFileSync6(opts.out, bytes);
+      writeFileSync7(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -4633,6 +5683,50 @@ routine.command("runs [id]").description("every fire attempt, newest first \u201
     }
   })
 );
+routine.command("inbound-url <id>").description("a URL that starts a run when posted to, for services that can't hold an API token").option("--create", "make one (replaces any earlier URL); the URL is printed once").option("--rm", "remove it; posting to it stops working").action(
+  run(async (id, opts) => {
+    const res = await triggerRequest(id, "inbound-url", { create: opts.create, remove: opts.rm });
+    console.log(opts.rm ? res.removed ? "Removed the inbound URL" : "There was no inbound URL" : inboundLine(res.inbound_url ?? null));
+  })
+);
+routine.command("precheck <id> [url]").description("run scheduled fires only when the content at an https URL changed; no url shows the precheck").option("--rm", "remove it: every scheduled fire runs again").action(
+  run(async (id, url, opts) => {
+    const res = await triggerRequest(id, "precheck", { body: url ? { url } : void 0, remove: opts.rm });
+    console.log(opts.rm ? res.removed ? "Removed the precheck" : "There was no precheck" : precheckLine(res.precheck ?? null));
+  })
+);
+routine.command("result-email <id> [state]").description("email you each run's result: on or off; no state shows the setting (new-session routines only)").action(
+  run(async (id, state) => {
+    if (state && state !== "on" && state !== "off") throw new ApiError(400, "invalid_request", "state is on or off");
+    const res = await api(
+      state === "on" ? "PUT" : state === "off" ? "DELETE" : "GET",
+      triggerPath(id, "result-email")
+    );
+    console.log(`result email ${res.result_email.enabled ? "on" : "off"}`);
+  })
+);
+routine.command("chat-trigger <id>").description("start a run from your own message in a connected chat; no flags shows the trigger").option("--connection <id>", "the chat connection (see `sky channel list`)").option("--thread <id>", "only this conversation (default: every conversation on the connection)").option("--prefix <text>", "only messages starting with this; the rest of the message is the run's input").option("--rm", "remove the trigger").action(
+  run(async (id, opts) => {
+    const setting = Boolean(opts.connection || opts.thread || opts.prefix);
+    const res = await triggerRequest(
+      id,
+      "channel-trigger",
+      { body: setting ? triggerBody(opts) : void 0, remove: opts.rm }
+    );
+    console.log(opts.rm ? res.removed ? "Removed the chat trigger" : "There was no chat trigger" : triggerLine(res.channel_trigger ?? null, res.available ?? true));
+  })
+);
+routine.command("deliver-to <id>").description("post each run's answer to a conversation in a connected chat; no flags shows where").option("--connection <id>", "the chat connection (see `sky channel list`)").option("--thread <id>", "the conversation (default: the chat itself)").option("--rm", "stop posting answers").action(
+  run(async (id, opts) => {
+    const setting = Boolean(opts.connection || opts.thread);
+    const res = await triggerRequest(
+      id,
+      "deliver-to",
+      { body: setting ? deliverBody(opts) : void 0, remove: opts.rm }
+    );
+    console.log(opts.rm ? res.removed ? "Stopped posting answers" : "Answers were posted nowhere" : deliverLine(res.deliver_to ?? null));
+  })
+);
 var collect = (value, previous = []) => [...previous, value];
 function goalPath(sessionId, suffix = "") {
   return `/sessions/${encodeURIComponent(sessionId)}/goal${suffix}`;
@@ -4775,7 +5869,7 @@ usageOptions(
   run(async (opts) => {
     const { bytes } = await apiBytes("GET", `/billing/usage/export${usageQuery(opts)}`);
     if (opts.out) {
-      writeFileSync6(opts.out, bytes);
+      writeFileSync7(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else {
       process.stdout.write(bytes);
@@ -4868,6 +5962,189 @@ webhook.command("rm <id>").description("delete an endpoint").action(
     console.log(`Deleted ${id}`);
   })
 );
+var channel = program.command("channel").description("chat surfaces (Slack, Telegram, Discord, WhatsApp, iMessage, \u2026) routed to a session");
+channel.command("list").description("your connections and the session each routes to").action(
+  run(async () => {
+    const connections = await listConnections();
+    if (!connections.length) console.log("no channels \u2014 connect one with `sky channel connect <platform> --session sess_\u2026`");
+    for (const c of connections) console.log(connectionLine(c));
+  })
+);
+channel.command("connect <platform>").description("connect a surface; prints the link or code that finishes it").option("--session <id>", "route it to this session (sess_\u2026) once claimed").option("--webhook <id>", "route it to this channel webhook endpoint instead").option("--app <id>", "run the connection on your own registered bot or number (see `sky channel apps`)").option("--label <label>", "a name for the connection").option("--wait", "wait until the connection is claimed").action(
+  run(async (platform, opts) => {
+    const created = await connect(platform, opts);
+    console.log(connectionLine(created));
+    for (const step of connectSteps(created)) console.log(`  ${step}`);
+    if (opts.wait && created.status === "PENDING") {
+      const done = await waitConnected(created.id);
+      console.log(connectionLine(done));
+    }
+  })
+);
+channel.command("bind <connectionId>").description("route a connection to a session or a channel webhook endpoint").option("--session <id>", "the session (sess_\u2026)").option("--webhook <id>", "the channel webhook endpoint").action(
+  run(async (connectionId, opts) => {
+    await bind(connectionId, opts);
+    console.log(`${connectionId} \u2192 ${opts.session ?? opts.webhook}`);
+  })
+);
+channel.command("send <threadId> <text...>").description("post a markdown message into a connected thread").action(
+  run(async (threadId, text) => {
+    await send(threadId, text.join(" "));
+    console.log(`Sent to ${threadId}`);
+  })
+);
+channel.command("disconnect <connectionId>").description("disconnect a surface").action(
+  run(async (connectionId) => {
+    await api("DELETE", `/channels/connections/${encodeURIComponent(connectionId)}`);
+    console.log(`Disconnected ${connectionId}`);
+  })
+);
+channel.command("apps").description("your own bots and numbers registered as channel apps").action(
+  run(async () => {
+    const { apps } = await api("GET", "/channels/apps");
+    if (!apps.length) console.log("no channel apps \u2014 connections use the shared AgentSky bots");
+    for (const a of apps) console.log(`${a.id}  ${a.platform.padEnd(9)} ${a.label}${a.status ? `  ${a.status}` : ""}`);
+  })
+);
+channel.command("identities").description("chat identities whose messages run as you").action(
+  run(async () => {
+    const { identities } = await api("GET", "/channels/identities");
+    if (!identities.length) console.log("no linked chat identities");
+    for (const i of identities) console.log(`${i.id}  ${i.platform.padEnd(9)} ${i.display_name ?? i.external_user_id}${i.linked_at ? `  since ${i.linked_at.slice(0, 10)}` : ""}`);
+  })
+);
+channel.command("unlink <identityId>").description("unlink a chat identity; that person's messages stop running as you").action(
+  run(async (identityId) => {
+    await api("DELETE", `/channels/identities/${encodeURIComponent(identityId)}`);
+    console.log(`Unlinked ${identityId}`);
+  })
+);
+var connector = program.command("connector").description("apps your agents can use: connect, list, share with a workspace");
+connector.command("apps [query]").description("apps you can connect, searched by name").option("--limit <n>", "at most this many", (v) => Number.parseInt(v, 10), 50).action(
+  run(async (query, opts) => {
+    for (const a of await listApps(query, opts.limit)) console.log(`${a.slug.padEnd(24)} ${a.name} \u2014 ${a.description}`);
+  })
+);
+connector.command("list").description("the accounts you connected").action(
+  run(async () => {
+    const { connections, credit } = await api("GET", "/connectors/connections");
+    if (!connections.length) console.log("no connections \u2014 connect one with `sky connector connect <app>`");
+    for (const c of connections) console.log(connectionLine2(c));
+    if (credit.cap_usd > 0) console.log(`credit earned by connecting: $${credit.earned_usd} of $${credit.cap_usd}`);
+  })
+);
+connector.command("connect <app>").description("connect an app in the browser (the slug from `sky connector apps`)").option("--universe <slug>", "connect it for this workspace itself (owner or admin)").option("--no-open", "print the authorization link without opening it").action(
+  run(async (app, opts) => {
+    const connection = await connectApp(app, { workspace: opts.universe, open: opts.open });
+    console.log(`Connected ${connection.app_name} (${connection.label})${opts.universe ? ` for ${opts.universe}` : ""}`);
+  })
+);
+connector.command("disconnect <connectionId>").description("disconnect one of your connections; agents lose it at once").action(
+  run(async (connectionId) => {
+    await api("DELETE", `/connectors/connections/${encodeURIComponent(connectionId)}`);
+    console.log(`Disconnected ${connectionId}`);
+  })
+);
+connector.command("repos").description("repositories your GitHub connection can reach").action(
+  run(async () => {
+    const { repos } = await api("GET", "/connectors/github/repos");
+    for (const r of repos) console.log(`${r.full_name}  ${r.default_branch}${r.private ? "  private" : ""}`);
+  })
+);
+connector.command("workspace [slug]").description("connections shared with a workspace (default: the current one)").action(
+  run(async (slug) => {
+    const ws = await api("GET", `/universes/${encodeURIComponent(await workspaceSlug(slug))}/connections`);
+    if (!ws.sharing) console.log("this workspace does not take shared connections");
+    for (const c of ws.connections) console.log(workspaceConnectionLine(c));
+  })
+);
+connector.command("share <connectionId>").description("share one of your connections with a workspace, so its sessions can call through it").option("--universe <slug>", "the workspace (default: the current one)").action(
+  run(async (connectionId, opts) => {
+    const slug = await workspaceSlug(opts.universe);
+    await api("POST", `/universes/${encodeURIComponent(slug)}/connections`, { connection_id: connectionId });
+    console.log(`Shared ${connectionId} with ${slug}`);
+  })
+);
+connector.command("unshare <connectionId>").description("stop sharing a connection with a workspace").option("--universe <slug>", "the workspace (default: the current one)").action(
+  run(async (connectionId, opts) => {
+    const slug = await workspaceSlug(opts.universe);
+    await api("DELETE", `/universes/${encodeURIComponent(slug)}/connections/${encodeURIComponent(connectionId)}`);
+    console.log(`Stopped sharing ${connectionId} with ${slug}`);
+  })
+);
+connector.command("shared").description("everything you share with workspaces, and the calls made through each").action(
+  run(async () => {
+    const { shared } = await api("GET", "/shared-connections");
+    if (!shared.length) console.log("you share no connections");
+    for (const s of shared) console.log(`${s.connection_id}  ${s.app_name} (${s.label}) \u2192 ${s.workspace.slug}  ${s.use_count} call${s.use_count === 1 ? "" : "s"}`);
+  })
+);
+var vault = program.command("vault").description("vaults: credentials a session is granted when it starts (values write-only)");
+vault.command("list").description("the workspace's vaults").action(
+  run(async () => {
+    const vaults = await listVaults();
+    if (!vaults.length) console.log("no vaults");
+    for (const v of vaults) console.log(`${v.id}  ${v.display_name}`);
+  })
+);
+vault.command("create <name>").description("create a vault; pass its id as vault_ids when starting a session").action(
+  run(async (name) => {
+    const { vault: created } = await api("POST", "/vaults", { display_name: name });
+    console.log(`${created.id}  ${created.display_name}`);
+  })
+);
+vault.command("show <vaultId>").description("a vault's secrets (metadata only)").action(
+  run(async (vaultId) => {
+    const secrets2 = await listSecrets(vaultId);
+    if (!secrets2.length) console.log("no secrets");
+    for (const secret of secrets2) console.log(secretLine(secret));
+  })
+);
+vault.command("rm <vaultId>").description("delete a vault and every secret in it").option("-y, --yes", "skip the confirmation prompt").action(
+  run(async (vaultId, opts) => {
+    if (!opts.yes && !await confirmPrompt(`Delete ${vaultId} and every secret in it?`)) return void console.log("Aborted.");
+    await api("DELETE", `/vaults/${encodeURIComponent(vaultId)}`);
+    console.log(`Deleted ${vaultId}`);
+  })
+);
+vault.command("move <intoVaultId>").description("move the secrets of other vaults into this one").requiredOption("--from <vaultId...>", "the vaults to move out of").option("--dry-run", "only report what would move").action(
+  run(async (intoVaultId, opts) => {
+    for (const m of await moveSecrets(intoVaultId, opts.from, Boolean(opts.dryRun))) {
+      console.log(`${m.outcome.padEnd(8)} ${m.name}  from ${m.from}${m.reason ? `  (${m.reason})` : ""}`);
+    }
+  })
+);
+var vaultSecret = vault.command("secret").description("the secrets in a vault");
+vaultSecret.command("add <vaultId> <name>").description("add an environment variable (value from stdin or a hidden prompt), or an MCP server's bearer token with --mcp").option("--host <host...>", "hosts the environment variable may be sent to").option("--header <name>", "the header it is sent in (default: Authorization)").option("--template <template>", "how the header value is built, e.g. 'Bearer {secret}'").option("--mcp <url>", "store a bearer token for this MCP server instead; <name> is its display name").action(
+  run(async (vaultId, name, opts) => {
+    const value = await readSecretValue(opts.mcp ? "Token: " : `Value for ${name}: `);
+    if (!value) throw new ApiError(400, "no_value", "no value provided");
+    const input = opts.mcp ? { kind: "mcp", url: opts.mcp, token: value, displayName: name } : { kind: "env", name, value, hosts: opts.host ?? [], header: opts.header, template: opts.template };
+    console.log(secretLine(await addSecret(vaultId, input)));
+  })
+);
+vaultSecret.command("rotate <vaultId> <secretId>").description("replace a secret's value in place (stdin or a hidden prompt); running sessions keep working").option("--host <host...>", "also replace the hosts it may be sent to").option("--keep-value", "only change --host, keep the value").action(
+  run(async (vaultId, secretId, opts) => {
+    const current = (await listSecrets(vaultId)).find((s) => s.id === secretId);
+    if (!current) throw new ApiError(404, "not_found", `no secret ${secretId} in ${vaultId}`);
+    const value = opts.keepValue ? void 0 : await readSecretValue("New value: ");
+    if (value === "") throw new ApiError(400, "no_value", "no value provided");
+    const field = current.auth_type === "environment_variable" ? "value" : "token";
+    console.log(secretLine(await updateSecret(vaultId, secretId, { [field]: value, hosts: opts.host })));
+  })
+);
+vaultSecret.command("rm <vaultId> <secretId>").description("delete a secret").action(
+  run(async (vaultId, secretId) => {
+    await api("DELETE", `/vaults/${encodeURIComponent(vaultId)}/secrets/${encodeURIComponent(secretId)}`);
+    console.log(`Deleted ${secretId}`);
+  })
+);
+vaultSecret.command("validate <vaultId> <secretId>").description("check that an MCP OAuth grant still works").action(
+  run(async (vaultId, secretId) => {
+    const { result } = await api("POST", `/vaults/${encodeURIComponent(vaultId)}/secrets/${encodeURIComponent(secretId)}/validate`);
+    console.log(`${secretId}: ${result}`);
+  })
+);
 var harness = program.command("harness").description("workspace harnesses: init, verify, push");
 harness.command("init [dir]").description("write a harness.json profile skeleton in the given directory (default: .)").action(run(async (dir) => {
   harnessInit(dir ?? ".");
@@ -4891,7 +6168,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-PMUETYJS.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-H3AP64UZ.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -4920,13 +6197,13 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
   ]);
   console.log(`Tracing ${trace.id} as ${opts.source} until ${grant.expires_at}`);
   console.log(scopes.length ? `  content: ${scopes.join(", ")} (redacted here before it leaves)` : "  metadata only");
-  if (opts.hooks) console.log(`  hooks: ${installClaudeHooks(resolve7(typeof opts.hooks === "string" ? opts.hooks : ".claude/settings.local.json"))}`);
+  if (opts.hooks) console.log(`  hooks: ${installClaudeHooks(resolve9(typeof opts.hooks === "string" ? opts.hooks : ".claude/settings.local.json"))}`);
   console.log(`  a session started elsewhere joins it with metadata {"trace_id": "${trace.id}"}`);
   console.log(`  sky trace show ${trace.id}`);
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-PMUETYJS.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-H3AP64UZ.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -4939,14 +6216,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-PMUETYJS.js");
+  const { readState, flush, grantSender } = await import("./trace-H3AP64UZ.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-PMUETYJS.js");
+  const { readState, spoolStatus } = await import("./trace-H3AP64UZ.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -4956,7 +6233,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-PMUETYJS.js");
+  const { readState } = await import("./trace-H3AP64UZ.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -4983,7 +6260,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-PMUETYJS.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-H3AP64UZ.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -4993,7 +6270,7 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
 traceCmd.command("sync [payload]").description("upload this machine's Claude Code and Codex sessions to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-FIMBRED6.js");
+  const lib = await import("./trace-library-LGPKAQTY.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -5041,10 +6318,10 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       console.log(`A repository's .agentsky.json "workspace" wins over these rules.`);
     }
     if (opts.installSchedule) {
-      const { join: join12 } = await import("path");
+      const { join: join15 } = await import("path");
       const { homedir: homedir8 } = await import("os");
       const { execFileSync } = await import("child_process");
-      const log = join12(homedir8(), ".config", "sky", "trace-sync.log");
+      const log = join15(homedir8(), ".config", "sky", "trace-sync.log");
       const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
       try {
         execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
@@ -5054,11 +6331,11 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       console.log(`Sweeping every 15 minutes (${plist}); a full re-read runs weekly. Log: ${log}`);
     }
     if (opts.status) {
-      const { readFileSync: readFileSync14 } = await import("fs");
-      const { join: join12 } = await import("path");
+      const { readFileSync: readFileSync16 } = await import("fs");
+      const { join: join15 } = await import("path");
       let state = { sessions: {} };
       try {
-        state = JSON.parse(readFileSync14(join12(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+        state = JSON.parse(readFileSync16(join15(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
       } catch {
       }
       const counts = /* @__PURE__ */ new Map();
@@ -5091,7 +6368,7 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
   })();
 });
 traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
-  const { libraryRequest } = await import("./trace-library-FIMBRED6.js");
+  const { libraryRequest } = await import("./trace-library-LGPKAQTY.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
@@ -5108,7 +6385,7 @@ traceCmd.command("search <query...>").description("search every session in a wor
   if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-FIMBRED6.js");
+  const { libraryRequest } = await import("./trace-library-LGPKAQTY.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);