@agentsky/sky 2.16.0 → 2.17.0

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   resolveSessionRef,
   streamEvents,
   uploadFile
-} from "./chunk-MQECNHD2.js";
+} from "./chunk-FU43NICZ.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -20,7 +20,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-5JHQH7WH.js";
+} from "./chunk-H7SWXCH7.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -37,14 +37,15 @@ import {
   modelSubscriptionProviderFor,
   reasoningEffortDocLine,
   redactLine,
+  redactSecretValues,
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-RHRREQMF.js";
+} from "./chunk-ZJVFWFOY.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
 import { basename as basename8, resolve as resolve9 } from "path";
 import { createInterface as createInterface6 } from "readline";
 import { Command } from "commander";
@@ -928,10 +929,10 @@ async function clone(opts) {
 }
 
 // src/import-local.ts
-import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readdirSync as readdirSync2, readFileSync as readFileSync7, readSync as readSync2, statSync as statSync5 } from "fs";
+import { closeSync as closeSync3, existsSync as existsSync5, openSync as openSync3, readdirSync as readdirSync3, readFileSync as readFileSync8, readSync as readSync3, statSync as statSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
-import { createHash as createHash2 } from "crypto";
+import { join as join6 } from "path";
+import { createHash as createHash3 } from "crypto";
 
 // src/import-files.ts
 import { isUtf8 } from "buffer";
@@ -1432,6 +1433,325 @@ function collectSessionFiles(records, opts) {
   return { lines, bytes, attached, leftOut, setup };
 }
 
+// src/import-environment.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import { closeSync as closeSync2, createWriteStream, lstatSync, mkdtempSync, openSync as openSync2, readdirSync as readdirSync2, readFileSync as readFileSync7, readSync as readSync2, rmSync as rmSync2 } from "fs";
+import { tmpdir } from "os";
+import { join as join5 } from "path";
+import { isUtf8 as isUtf82 } from "buffer";
+import { createGzip } from "zlib";
+
+// ../../packages/spec/src/import-layout.ts
+import { gzipSync } from "zlib";
+function folderName(workspace2, sourceCwd) {
+  const raw = workspace2?.project || (sourceCwd ? sourceCwd.split("/").filter(Boolean).pop() : "") || "";
+  const cleaned = raw.replace(/[^A-Za-z0-9._ -]/g, "-").replace(/^[^A-Za-z0-9_]+/, "").replace(/\.\.+/g, ".").slice(0, 80).trim();
+  return cleaned || "imported-session";
+}
+function envName(server, field) {
+  return `${server}_${field}`.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+function ownServer(server, platform) {
+  try {
+    return server.transport !== "stdio" && platform.ownHost.test(new URL(server.url ?? "").hostname);
+  } catch {
+    return false;
+  }
+}
+function mcpJson(servers, platform) {
+  const entries = servers.filter((server) => !ownServer(server, platform)).map((server) => {
+    if (server.transport === "stdio") {
+      return [server.name, {
+        command: server.command,
+        ...server.args?.length ? { args: server.args } : {},
+        ...server.env?.length ? { env: Object.fromEntries(server.env.map((name) => [name, `\${${name}:-}`])) } : {}
+      }];
+    }
+    const query = server.query?.length ? `?${server.query.map((name) => `${encodeURIComponent(name)}=\${${envName(server.name, name)}:-}`).join("&")}` : "";
+    return [server.name, {
+      type: server.transport,
+      url: `${server.url}${query}`,
+      ...server.headers?.length ? { headers: Object.fromEntries(server.headers.map((name) => [name, `\${${envName(server.name, name)}:-}`])) } : {}
+    }];
+  });
+  return JSON.stringify({ mcpServers: Object.fromEntries(entries) }, null, 2) + "\n";
+}
+function bullet(items, none) {
+  return items.length ? items.map((item) => `- ${item}`).join("\n") : `- ${none}`;
+}
+function readme(folder, workspace2, counts, skills2, mcpWritten, platform) {
+  const git2 = workspace2?.git;
+  const servers = workspace2?.mcp_servers ?? [];
+  const missingSkills = (workspace2?.skills ?? []).filter((skill) => !skill.found).map((skill) => skill.name);
+  const secrets2 = servers.filter((server) => !ownServer(server, platform)).flatMap((server) => [
+    ...server.env ?? [],
+    ...(server.headers ?? []).map((name) => envName(server.name, name)),
+    ...(server.query ?? []).map((name) => envName(server.name, name))
+  ]);
+  const where = workspace2?.cwd ? ` (${workspace2.cwd})` : "";
+  return [
+    "# Imported working copy",
+    "",
+    `This folder (/workspace/${folder}) holds what the imported conversation worked with on the person's computer.`,
+    "It is historical context: verify a path before acting on it, and follow the person's current message.",
+    "",
+    "## Files",
+    counts.wholeFolder ? `- The whole working directory${where}, ${counts.project} files at the same relative paths: its tracked files and new files git does not ignore (every file when it is not a repository), without version-control data, dependency and build output, or credential files.` : `- ${counts.project} files from the original working directory${where}, at the same relative paths: the files the conversation read, wrote or edited and its instruction files. The rest of the working tree did not travel${workspace2?.tree?.length ? `; its full file list is in ${platform.notesDir}/workspace.json (\`tree\`)` : ""}.`,
+    ...counts.outside ? [`- ${counts.outside} files from elsewhere on that computer (shared instructions such as ~/AGENTS.md, and files outside the working directory) under ${platform.notesDir}/files/, with ~ as home/.`] : [],
+    ...counts.attachments ? [`- ${counts.attachments} attachments of the conversation under ${platform.notesDir}/attachments/.`] : [],
+    "- Text was redacted on that computer before upload: a masked value (\u25CF\u25CF\u25CF\u25CF\u25CF) is a secret that was removed, not the real content.",
+    "",
+    "## Repository",
+    ...git2 ? [
+      `- Remote: ${git2.remote ?? "none"}`,
+      `- Branch: ${git2.branch ?? "detached"} at commit ${git2.commit ?? "unknown"}${git2.ahead ? ` (${git2.ahead} commits not pushed)` : ""}`,
+      ...git2.dirty?.length ? [`- Uncommitted changes in ${git2.dirty.length} paths${counts.wholeFolder ? " are already in these files" : ""}; the change against that commit is ${platform.notesDir}/uncommitted.patch (apply with \`git apply\` on a checkout of that commit).`] : ["- No uncommitted changes."],
+      counts.wholeFolder ? "- This folder's own git history starts with this copy; the project's history is on the remote." : `- To get the whole repository, clone the remote at that commit (connect GitHub in ${platform.name} if it is private), apply the patch, then use the files here.`
+    ] : ["- The working directory was not a git repository."],
+    "",
+    "## Skills",
+    bullet(skills2.map((name) => `${name}: .claude/skills/${name}/SKILL.md (also .agents/skills/${name}/)`), "No skills were loaded."),
+    ...missingSkills.length ? ["", `Loaded but no longer on that computer, so not carried: ${missingSkills.join(", ")}.`] : [],
+    "",
+    "## Tool servers (MCP)",
+    bullet(servers.map((server) => `${server.name} (${server.transport}${server.scope ? `, ${server.scope}` : ""}): ${server.transport === "stdio" ? [server.command, ...server.args ?? []].join(" ") : server.url}`), "None were configured."),
+    ...mcpWritten ? ["", `They are written to .mcp.json in this folder with every key as \${NAME:-}, except ${platform.name}'s own server, whose tools this session already has. Their values never leave the person's computer${secrets2.length ? `; these must be supplied to use them: ${[...new Set(secrets2)].join(", ")}` : ""}. A stdio server runs only if its command is installed here, and Claude Code connects a project server only once it is approved.`] : [],
+    ""
+  ].join("\n");
+}
+function parseWorkspace(file) {
+  if (!file) return null;
+  try {
+    const value = JSON.parse(file.data.toString("utf8"));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function importLayout(files2, sourceCwd, platform, wholeFolder) {
+  if (!files2.length && !wholeFolder) return null;
+  const workspace2 = parseWorkspace(files2.find((file) => file.name === "agentsky/workspace.json"));
+  const folder = folderName(workspace2, sourceCwd);
+  const entries = /* @__PURE__ */ new Map();
+  const skills2 = /* @__PURE__ */ new Set();
+  const counts = { project: wholeFolder?.files ?? 0, outside: 0, attachments: 0, wholeFolder: Boolean(wholeFolder) };
+  for (const file of files2) {
+    const [kind, ...rest] = file.name.split("/");
+    const path = rest.join("/");
+    if (kind === "workspace") {
+      if (wholeFolder) continue;
+      entries.set(path, file.data);
+      counts.project += 1;
+    } else if (kind === "files") {
+      entries.set(`${platform.notesDir}/files/${path.replace(/^~\//, "home/")}`, file.data);
+      counts.outside += 1;
+    } else if (kind === "imported-attachments") {
+      entries.set(`${platform.notesDir}/attachments/${path}`, file.data);
+      counts.attachments += 1;
+    } else if (kind === "agentsky") entries.set(`${platform.notesDir}/${path}`, file.data);
+    else if (kind === "skills" && rest.length > 1) {
+      const skill = rest[0].split(":").pop();
+      const inside = rest.slice(1).join("/");
+      skills2.add(skill);
+      entries.set(`.claude/skills/${skill}/${inside}`, file.data);
+      entries.set(`.agents/skills/${skill}/${inside}`, file.data);
+    }
+  }
+  const servers = (workspace2?.mcp_servers ?? []).filter((server) => server && typeof server.name === "string" && (server.transport === "stdio" ? typeof server.command === "string" : typeof server.url === "string"));
+  const mcpWritten = servers.length > 0 && !entries.has(".mcp.json") && !wholeFolder?.paths.has(".mcp.json");
+  if (mcpWritten) entries.set(".mcp.json", Buffer.from(mcpJson(servers, platform)));
+  entries.set(`${platform.notesDir}/README.md`, Buffer.from(readme(folder, workspace2 ? { ...workspace2, mcp_servers: servers } : null, counts, [...skills2], mcpWritten, platform)));
+  if (wholeFolder) for (const path of wholeFolder.paths) entries.delete(path);
+  return { folder, entries, skills: [...skills2], mcpServers: servers.map((server) => server.name) };
+}
+var TAR_BLOCK = 512;
+var TAR_END = Buffer.alloc(TAR_BLOCK * 2);
+function header(name, size, type) {
+  const block = Buffer.alloc(TAR_BLOCK);
+  block.write(name, 0, 100, "utf8");
+  block.write("0000644\0", 100);
+  block.write("0000000\0", 108);
+  block.write("0000000\0", 116);
+  block.write(size.toString(8).padStart(11, "0") + "\0", 124);
+  block.write("00000000000\0", 136);
+  block.write("        ", 148);
+  block.write(type, 156);
+  block.write("ustar\x0000", 257);
+  let sum = 0;
+  for (const byte of block) sum += byte;
+  block.write(sum.toString(8).padStart(6, "0") + "\0 ", 148);
+  return block;
+}
+function paxRecord(key, value) {
+  const body = ` ${key}=${value}
+`;
+  let length = Buffer.byteLength(body);
+  for (; ; ) {
+    const total = String(length).length + length;
+    if (String(total).length + length === total) return Buffer.from(`${total}${body}`);
+    length += 1;
+  }
+}
+function tarPadding(size) {
+  const rest = size % TAR_BLOCK;
+  return Buffer.alloc(rest ? TAR_BLOCK - rest : 0);
+}
+function tarHeader(path, size) {
+  if (Buffer.byteLength(path) <= 100) return header(path, size, "0");
+  const pax = paxRecord("path", path);
+  return Buffer.concat([header("PaxHeader", pax.length, "x"), pax, tarPadding(pax.length), header(path, size, "0")]);
+}
+
+// src/import-environment.ts
+var IMPORT_PLATFORM = { name: "AgentSky", ownHost: /(^|\.)(agentsky\.dev|asteroidbelt\.ai)$/i, notesDir: ".agentsky-import" };
+var MAX_ENVIRONMENT_FILES = 2e5;
+var MAX_ENVIRONMENT_BYTES = 2 * 1024 ** 3;
+var MAX_REDACTED_TEXT_BYTES = 10 * 1024 * 1024;
+var SKIPPED = /* @__PURE__ */ new Set([".git", "node_modules", ".venv", "venv", "__pycache__", ".next", "dist", "build", "target", ".DS_Store", ".cache", ".turbo"]);
+var SECRET_FILE2 = /(^|\/)(\.env(\..*)?|\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.?credentials(\.json)?|auth\.json|\.claude\.json|id_(rsa|ed25519|ecdsa)[^/]*|.*\.(pem|key|p12|pfx|keystore|jks|kdbx))$|(^|\/)\.ssh\/|(^|\/)\.aws\/|(^|\/)\.gnupg\/|(^|\/)\.docker\/config\.json$/i;
+function listFiles(cwd) {
+  const git2 = spawnSync2("git", ["-C", cwd, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 512 * 1024 * 1024 });
+  if (git2.status === 0) return git2.stdout.split("\0").filter(Boolean).filter((path) => !path.split("/").some((part) => part === ".git"));
+  const out = [];
+  const walk = (dir, prefix) => {
+    let entries;
+    try {
+      entries = readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry2 of entries) {
+      if (SKIPPED.has(entry2.name)) continue;
+      const rel = prefix ? `${prefix}/${entry2.name}` : entry2.name;
+      if (entry2.isDirectory()) walk(join5(dir, entry2.name), rel);
+      else out.push(rel);
+      if (out.length > MAX_ENVIRONMENT_FILES) return;
+    }
+  };
+  walk(cwd, "");
+  return out;
+}
+function textOf(path, size) {
+  if (size > MAX_REDACTED_TEXT_BYTES) return null;
+  const data = readFileSync7(path);
+  if (data.subarray(0, 8e3).includes(0) || !isUtf82(data)) return null;
+  return data;
+}
+async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
+  const listed = listFiles(cwd);
+  if (listed.length > MAX_ENVIRONMENT_FILES) throw new Error(`The working folder has more than ${MAX_ENVIRONMENT_FILES} files; import it with --no-environment.`);
+  const scratch = mkdtempSync(join5(tmpdir(), "sky-environment-"));
+  const path = join5(scratch, "environment.tar.gz");
+  const leftOut = [];
+  const written = /* @__PURE__ */ new Set();
+  const hash = createHash2("sha256");
+  let bytes = 0;
+  let redacted2 = 0;
+  const gzip = createGzip({ level: 6 });
+  const sink = createWriteStream(path);
+  gzip.on("data", (chunk) => {
+    bytes += chunk.length;
+    hash.update(chunk);
+  });
+  gzip.pipe(sink);
+  const done = new Promise((resolve10, reject) => {
+    sink.on("finish", () => resolve10());
+    sink.on("error", reject);
+    gzip.on("error", reject);
+  });
+  const write = (chunk) => new Promise((resolve10, reject) => {
+    if (bytes > MAX_ENVIRONMENT_BYTES) {
+      reject(new Error(`The working folder packs to more than ${MAX_ENVIRONMENT_BYTES / 1024 ** 3} GiB; import it with --no-environment.`));
+      return;
+    }
+    if (gzip.write(chunk)) resolve10();
+    else gzip.once("drain", resolve10);
+  });
+  try {
+    for (const rel of listed) {
+      const full = join5(cwd, ...rel.split("/"));
+      if (SECRET_FILE2.test(rel)) {
+        leftOut.push({ path: rel, reason: "credential file" });
+        continue;
+      }
+      let stat;
+      try {
+        stat = lstatSync(full);
+      } catch {
+        continue;
+      }
+      if (!stat.isFile()) {
+        leftOut.push({ path: rel, reason: "not a regular file" });
+        continue;
+      }
+      const text = textOf(full, stat.size);
+      if (text) {
+        const masked = redactSecretValues(text.toString("utf8"));
+        if (Object.keys(masked.hits).length) redacted2 += 1;
+        const data = Buffer.from(masked.text, "utf8");
+        await write(tarHeader(rel, data.length));
+        await write(data);
+        await write(tarPadding(data.length));
+      } else {
+        await write(tarHeader(rel, stat.size));
+        const fd = openSync2(full, "r");
+        try {
+          const chunk = Buffer.alloc(1024 * 1024);
+          let left = stat.size;
+          for (let offset = 0; left > 0; ) {
+            const read = readSync2(fd, chunk, 0, Math.min(chunk.length, left), offset);
+            if (read <= 0) throw new Error(`${rel} changed while it was packed; import again.`);
+            await write(Buffer.from(chunk.subarray(0, read)));
+            offset += read;
+            left -= read;
+          }
+        } finally {
+          closeSync2(fd);
+        }
+        await write(tarPadding(stat.size));
+      }
+      written.add(rel);
+    }
+    const layout = importLayout(resources, cwd, platform, { files: written.size, paths: written });
+    for (const [entry2, data] of layout?.entries ?? []) {
+      await write(tarHeader(entry2, data.length));
+      await write(data);
+      await write(tarPadding(data.length));
+    }
+    await write(TAR_END);
+    gzip.end();
+    await done;
+    if (bytes > MAX_ENVIRONMENT_BYTES) throw new Error(`The working folder packs to more than ${MAX_ENVIRONMENT_BYTES / 1024 ** 3} GiB; import it with --no-environment.`);
+    return {
+      path,
+      folder: layout?.folder ?? "imported-session",
+      bytes,
+      sha256: hash.digest("hex"),
+      files: written.size + (layout?.entries.size ?? 0),
+      redacted: redacted2,
+      leftOut,
+      dispose: () => rmSync2(scratch, { recursive: true, force: true })
+    };
+  } catch (error) {
+    gzip.destroy();
+    sink.destroy();
+    rmSync2(scratch, { recursive: true, force: true });
+    throw error;
+  }
+}
+function resourcesOf(lines) {
+  return lines.flatMap((line) => {
+    try {
+      const record = JSON.parse(line);
+      if (record.type !== "import.resource" || typeof record.name !== "string" || typeof record.media_type !== "string" || typeof record.data !== "string") return [];
+      return [{ name: record.name, mediaType: record.media_type, data: Buffer.from(record.data, "base64") }];
+    } catch {
+      return [];
+    }
+  });
+}
+
 // src/import-local.ts
 function redactLine2(raw) {
   return redactLine(raw).line;
@@ -1444,12 +1764,12 @@ function decodeWorkspace(encoded) {
   }
 }
 function readPrefix(filePath) {
-  const fd = openSync2(filePath, "r");
+  const fd = openSync3(filePath, "r");
   try {
     const bytes = Buffer.alloc(256 * 1024);
-    return bytes.subarray(0, readSync2(fd, bytes, 0, bytes.length, 0)).toString("utf8");
+    return bytes.subarray(0, readSync3(fd, bytes, 0, bytes.length, 0)).toString("utf8");
   } finally {
-    closeSync2(fd);
+    closeSync3(fd);
   }
 }
 function sniffTitle(filePath) {
@@ -1504,16 +1824,16 @@ function sniffTitle(filePath) {
   }
 }
 function listClaudeCodeSessions(limit) {
-  const root = process.env.CLAUDE_CONFIG_DIR ?? join5(homedir4(), ".claude");
-  const projectsDir = join5(root, "projects");
+  const root = process.env.CLAUDE_CONFIG_DIR ?? join6(homedir4(), ".claude");
+  const projectsDir = join6(root, "projects");
   if (!existsSync5(projectsDir)) return [];
   const sessions = [];
   try {
-    for (const encoded of readdirSync2(projectsDir)) {
-      const projectDir = join5(projectsDir, encoded);
+    for (const encoded of readdirSync3(projectsDir)) {
+      const projectDir = join6(projectsDir, encoded);
       let entries;
       try {
-        entries = readdirSync2(projectDir);
+        entries = readdirSync3(projectDir);
       } catch {
         continue;
       }
@@ -1521,7 +1841,7 @@ function listClaudeCodeSessions(limit) {
       for (const entry2 of entries) {
         if (!entry2.endsWith(".jsonl")) continue;
         const sessionId = entry2.slice(0, -6);
-        const mainFile = join5(projectDir, entry2);
+        const mainFile = join6(projectDir, entry2);
         let stat;
         try {
           stat = statSync5(mainFile);
@@ -1531,12 +1851,12 @@ function listClaudeCodeSessions(limit) {
         if (!stat.isFile()) continue;
         let discoveryError;
         const subagentFiles = [];
-        const subagentDir = join5(projectDir, sessionId, "subagents");
+        const subagentDir = join6(projectDir, sessionId, "subagents");
         if (existsSync5(subagentDir)) {
           try {
-            const subFiles = readdirSync2(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
+            const subFiles = readdirSync3(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
             for (const f of subFiles) {
-              subagentFiles.push(join5(subagentDir, f));
+              subagentFiles.push(join6(subagentDir, f));
             }
           } catch {
             discoveryError = "Cannot read all recorded subagent conversations. Fix local file access before importing this session.";
@@ -1558,17 +1878,17 @@ function listClaudeCodeSessions(limit) {
   return sessions.sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
 function listCodexSessions(limit) {
-  const sessionsDir = join5(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join5(homedir4(), ".codex"), "sessions");
+  const sessionsDir = join6(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join6(homedir4(), ".codex"), "sessions");
   const records = [];
   function walk(dir) {
     let entries;
     try {
-      entries = readdirSync2(dir, { withFileTypes: true });
+      entries = readdirSync3(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry2 of entries) {
-      const full = join5(dir, entry2.name);
+      const full = join6(dir, entry2.name);
       if (entry2.isDirectory()) {
         walk(full);
         continue;
@@ -1655,7 +1975,7 @@ async function mintTrace(base, harness2) {
 function loadSummaryFile(summaryPath) {
   let raw;
   try {
-    raw = readFileSync7(summaryPath, "utf8");
+    raw = readFileSync8(summaryPath, "utf8");
   } catch {
     throw new Error(`Cannot read summary file: ${summaryPath}`);
   }
@@ -1687,7 +2007,7 @@ function prepareImport(session2, summaryPath, options = {}) {
   let inputBytes = 0;
   let outputBytes = 0;
   const lines = [];
-  const digest = createHash2("sha256");
+  const digest = createHash3("sha256");
   let nativeId;
   let redactionCount = 0;
   let encryptedReasoningCount = 0;
@@ -1698,7 +2018,7 @@ function prepareImport(session2, summaryPath, options = {}) {
   for (const path of session2.files) {
     const stat = statSync5(path);
     if (!stat.isFile() || (inputBytes += stat.size) > maximum) throw new Error("Selected transcript exceeds the 16 MiB limit or is not a regular file.");
-    const text = readFileSync7(path, "utf8");
+    const text = readFileSync8(path, "utf8");
     for (const raw of text.split("\n")) {
       if (!raw.trim()) continue;
       let record;
@@ -1776,7 +2096,8 @@ function prepareImport(session2, summaryPath, options = {}) {
   if (encryptedReasoningCount > 0) gaps.push({ kind: "encrypted_reasoning", count: encryptedReasoningCount });
   if (compactionCount > 0) gaps.push({ kind: "compaction", count: compactionCount });
   if (unreadableCount > 0) gaps.push({ kind: "unreadable", count: unreadableCount });
-  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps, attachedFiles: files2.attached, leftOutFiles: files2.leftOut, setup: files2.setup };
+  const cwd = meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : "");
+  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps, attachedFiles: files2.attached, leftOutFiles: files2.leftOut, setup: files2.setup, cwd, resourceLines: files2.lines };
 }
 async function importSession(opts) {
   const base = (opts.agentUseUrl ?? agentUseBase()).replace(/\/$/, "");
@@ -1785,7 +2106,7 @@ async function importSession(opts) {
     throw new Error("Import requires HTTPS, or a loopback development server.");
   }
   opts.onProgress?.("Reading transcript and redacting secrets locally\u2026");
-  const { body, transcriptLines, outputBytes, redactionCount, gaps, attachedFiles, leftOutFiles, setup } = prepareImport(opts.session, opts.summaryPath, { files: opts.files });
+  const { body, transcriptLines, outputBytes, redactionCount, gaps, attachedFiles, leftOutFiles, setup, cwd, resourceLines } = prepareImport(opts.session, opts.summaryPath, { files: opts.files });
   let traceId;
   let key;
   if (opts.importKey && opts.grantTraceId) {
@@ -1809,6 +2130,7 @@ async function importSession(opts) {
   }
   const result = await response.json();
   const finalTraceId = result.traceId ?? traceId;
+  const environment = opts.files === false || opts.environment === false || !cwd || !existsSync5(cwd) ? null : await uploadEnvironment(base, key, finalTraceId, cwd, resourceLines, opts.onProgress).catch((error) => ({ error: error instanceof Error ? error.message : String(error) }));
   return {
     traceId: finalTraceId,
     url: `${base}/playground/new?import=${encodeURIComponent(finalTraceId)}`,
@@ -1820,9 +2142,42 @@ async function importSession(opts) {
     gaps,
     attachedFiles,
     leftOutFiles,
-    setup
+    setup,
+    environment
   };
 }
+async function grantCall(base, key, path, body) {
+  const response = await fetch(`${base}${path}`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(3e5),
+    headers: { authorization: `Bearer ${key}`, "content-type": "application/json", "user-agent": USER_AGENT },
+    body: JSON.stringify(body)
+  });
+  const answer = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(typeof answer?.error === "string" ? answer.error : answer?.error?.message ?? `The environment upload failed (${response.status}).`);
+  return answer;
+}
+async function uploadEnvironment(base, key, traceId, cwd, resourceLines, onProgress) {
+  onProgress?.("Packing the working folder (secrets redacted locally)\u2026");
+  const packed = await packEnvironment(cwd, resourcesOf(resourceLines));
+  try {
+    const path = `/api/traces/${encodeURIComponent(traceId)}/environment`;
+    const { upload } = await grantCall(base, key, path, { name: packed.folder, size: packed.bytes, sha256: packed.sha256, files: packed.files });
+    let shown = -1;
+    await transfer(upload, packed.path, (sent, total) => {
+      const percent = Math.floor(sent / total * 100);
+      if (percent >= shown + 10 || sent === total) {
+        shown = percent;
+        onProgress?.(`Uploading the working folder\u2026 ${percent}% of ${(total / 1024 / 1024).toFixed(1)} MiB`);
+      }
+    });
+    await grantCall(base, key, `${path}/complete`, {});
+    return { folder: packed.folder, files: packed.files, bytes: packed.bytes, redacted: packed.redacted, leftOut: packed.leftOut.length };
+  } finally {
+    packed.dispose();
+  }
+}
 
 // src/channels.ts
 function connectionLine(c) {
@@ -1876,7 +2231,7 @@ async function send(threadId, text) {
 import { createServer as createServer2 } from "http";
 
 // src/login.ts
-import { createHash as createHash3, randomBytes } from "crypto";
+import { createHash as createHash4, randomBytes } from "crypto";
 import { createServer } from "http";
 import { hostname } from "os";
 import { spawn as spawn2 } from "child_process";
@@ -1892,7 +2247,7 @@ function openBrowser2(url) {
 }
 async function login(opts) {
   const verifier = b64url(randomBytes(32));
-  const challenge = b64url(createHash3("sha256").update(verifier).digest());
+  const challenge = b64url(createHash4("sha256").update(verifier).digest());
   const result = opts.noBrowser ? await headlessLogin(verifier, challenge) : await browserLogin(verifier, challenge);
   saveConfig({
     ...loadConfig(),
@@ -2083,15 +2438,15 @@ async function triggerRequest(id, resource, change) {
 }
 
 // src/session-workspace.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { createHash as createHash4, randomUUID } from "crypto";
-import { readdirSync as readdirSync3, statSync as statSync6 } from "fs";
-import { basename as basename6, join as join6, relative as relative3, resolve as resolve5 } from "path";
+import { spawnSync as spawnSync3 } from "child_process";
+import { createHash as createHash5, randomUUID } from "crypto";
+import { readdirSync as readdirSync4, statSync as statSync6 } from "fs";
+import { basename as basename6, join as join7, relative as relative3, resolve as resolve5 } from "path";
 var SINGLE_IMPORT_MAX = 25 * 1024 * 1024;
 var PART_SIZE = 8 * 1024 * 1024;
-var SKIPPED = /* @__PURE__ */ new Set([".git", "node_modules"]);
+var SKIPPED2 = /* @__PURE__ */ new Set([".git", "node_modules"]);
 var workspacePath = (id) => `/sessions/${encodeURIComponent(id)}/workspace`;
-async function listFiles(id, path, hidden) {
+async function listFiles2(id, path, hidden) {
   const query = new URLSearchParams();
   if (path) query.set("path", path);
   if (hidden) query.set("hidden", "true");
@@ -2117,16 +2472,16 @@ async function workspacePatch(id, repo) {
   return { meta, patch: Buffer.from(patch, "base64") };
 }
 function folderFiles(dir) {
-  const git2 = spawnSync2("git", ["-C", dir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8" });
-  const top = spawnSync2("git", ["-C", dir, "rev-parse", "--show-prefix"], { encoding: "utf8" });
+  const git2 = spawnSync3("git", ["-C", dir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8" });
+  const top = spawnSync3("git", ["-C", dir, "rev-parse", "--show-prefix"], { encoding: "utf8" });
   if (git2.status === 0 && top.status === 0) {
-    return git2.stdout.split("\0").filter((path) => path && statSync6(join6(dir, path), { throwIfNoEntry: false })?.isFile());
+    return git2.stdout.split("\0").filter((path) => path && statSync6(join7(dir, path), { throwIfNoEntry: false })?.isFile());
   }
   const files2 = [];
   const walk = (at) => {
-    for (const entry2 of readdirSync3(at, { withFileTypes: true })) {
-      if (SKIPPED.has(entry2.name)) continue;
-      const full = join6(at, entry2.name);
+    for (const entry2 of readdirSync4(at, { withFileTypes: true })) {
+      if (SKIPPED2.has(entry2.name)) continue;
+      const full = join7(at, entry2.name);
       if (entry2.isDirectory()) walk(full);
       else if (entry2.isFile()) files2.push(relative3(dir, full));
     }
@@ -2135,7 +2490,7 @@ function folderFiles(dir) {
   return files2;
 }
 function folderArchive(dir, files2) {
-  const tar = spawnSync2("tar", ["--format=ustar", "-czf", "-", "-C", dir, "-T", "-"], {
+  const tar = spawnSync3("tar", ["--format=ustar", "-czf", "-", "-C", dir, "-T", "-"], {
     input: files2.join("\n"),
     env: { ...process.env, COPYFILE_DISABLE: "1" },
     maxBuffer: 2 * 1024 * 1024 * 1024
@@ -2151,7 +2506,7 @@ async function importFolder(id, dir, opts = {}) {
     const res = await apiBytes("POST", `${workspacePath(id)}/import?name=${encodeURIComponent(name)}`, { bytes: archive, mediaType: "application/gzip" });
     return res.json();
   }
-  const sha256 = createHash4("sha256").update(archive).digest("hex");
+  const sha256 = createHash5("sha256").update(archive).digest("hex");
   let upload = await api("POST", `${workspacePath(id)}/imports`, { name, size: archive.length, sha256, part_size: PART_SIZE });
   const uploadPath = `${workspacePath(id)}/imports/${encodeURIComponent(upload.id)}`;
   for (let part = 0; part < upload.parts; part += 1) {
@@ -2184,6 +2539,13 @@ function accessPatch(opts) {
     ...opts.removeViewer?.length ? { remove_viewers: opts.removeViewer } : {}
   };
 }
+function engineChange(model, thinking) {
+  if (!model && !thinking) return null;
+  return {
+    ...model ? { llm: model } : {},
+    ...thinking ? { reasoningEffort: thinking === "default" ? null : thinking } : {}
+  };
+}
 var TERMINAL = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
 async function handoff(id, targetAgent, opts = {}) {
   let { handoff: h } = await api("POST", `/sessions/${encodeURIComponent(id)}/handoff`, {
@@ -2203,15 +2565,15 @@ async function handoff(id, targetAgent, opts = {}) {
 // src/local-agents.ts
 import { existsSync as existsSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 function localAgents(env = process.env, home = homedir5()) {
-  const claude = env.CLAUDE_CONFIG_DIR || join7(home, ".claude");
-  const codex = env.CODEX_HOME || join7(home, ".codex");
-  const cursor = join7(home, ".cursor");
+  const claude = env.CLAUDE_CONFIG_DIR || join8(home, ".claude");
+  const codex = env.CODEX_HOME || join8(home, ".codex");
+  const cursor = join8(home, ".cursor");
   return [
-    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join7(claude, "skills") },
-    { id: "codex", name: "Codex", root: codex, skillsDir: join7(codex, "skills") },
-    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join7(cursor, "skills") }
+    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join8(claude, "skills") },
+    { id: "codex", name: "Codex", root: codex, skillsDir: join8(codex, "skills") },
+    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join8(cursor, "skills") }
   ];
 }
 function detectLocalAgents(env = process.env, home = homedir5()) {
@@ -2316,16 +2678,16 @@ async function readTurn(sessionId, opts = {}) {
 }
 
 // src/setup.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname6, join as join11 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, join as join12 } from "path";
 import { createInterface as createInterface3 } from "readline";
 
 // src/mcp-register.ts
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 
 // src/skill.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
-import { join as join8 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
 
 // src/catalog-file.ts
 var CATALOG_FILE = "catalog.md";
@@ -2351,13 +2713,13 @@ function entry(agent2) {
   return lines.join("\n");
 }
 function renderCatalog(agents, generatedAt) {
-  const header = [
+  const header2 = [
     "# AgentSky agent catalog",
     "",
     `Every agent you can hire, as of ${generatedAt.toISOString()}. Start one with \`start_session\` and its handle, written with the @.`,
     "Run `npx @agentsky/sky setup` again to refresh this file; `search_catalog` always has the current list."
   ];
-  if (!agents.length) return [...header, "", "The catalog was empty when this file was written. Use `search_catalog`.", ""].join("\n");
+  if (!agents.length) return [...header2, "", "The catalog was empty when this file was written. Use `search_catalog`.", ""].join("\n");
   const own = agents.filter((agent2) => agent2.visibility === "workspace");
   const shared = agents.filter((agent2) => agent2.visibility !== "workspace");
   const sections = [];
@@ -2372,7 +2734,7 @@ function renderCatalog(agents, generatedAt) {
     const title = category.charAt(0).toUpperCase() + category.slice(1);
     sections.push([`## ${title}`, ...groups.get(category).map(entry)].join("\n\n"));
   }
-  return [...header, "", sections.join("\n\n"), ""].join("\n");
+  return [...header2, "", sections.join("\n\n"), ""].join("\n");
 }
 
 // src/skill.ts
@@ -2766,7 +3128,7 @@ To set a per-repo default, create \`.agentsky.json\` at the git root:
 }
 function installedVersion(dir) {
   try {
-    const marker = JSON.parse(readFileSync8(join8(dir, SKILL_MARKER), "utf8"));
+    const marker = JSON.parse(readFileSync9(join9(dir, SKILL_MARKER), "utf8"));
     return typeof marker.version === "string" ? marker.version : null;
   } catch {
     return null;
@@ -2776,25 +3138,25 @@ function isInstalledSkill(dir) {
   return installedVersion(dir) !== null;
 }
 function installSkill(agent2, opts = {}) {
-  const dir = join8(agent2.skillsDir, SKILL_NAME);
+  const dir = join9(agent2.skillsDir, SKILL_NAME);
   const previous = installedVersion(dir);
   const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
   if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
   if (outcome !== "current") {
     mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join8(dir, "SKILL.md"), skillDocument());
-    writeFileSync4(join8(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
+    writeFileSync4(join9(dir, "SKILL.md"), skillDocument());
+    writeFileSync4(join9(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
 `);
   }
   if (opts.catalog) {
     mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join8(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+    writeFileSync4(join9(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
   }
-  const refsDir = join8(dir, REFERENCES_DIR);
+  const refsDir = join9(dir, REFERENCES_DIR);
   mkdirSync2(refsDir, { recursive: true });
-  writeFileSync4(join8(refsDir, "import.md"), importReferenceDoc());
-  writeFileSync4(join8(refsDir, "workspaces.md"), workspacesReferenceDoc());
-  writeFileSync4(join8(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
+  writeFileSync4(join9(refsDir, "import.md"), importReferenceDoc());
+  writeFileSync4(join9(refsDir, "workspaces.md"), workspacesReferenceDoc());
+  writeFileSync4(join9(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
   return { agent: agent2.id, path: dir, outcome };
 }
 
@@ -2803,9 +3165,9 @@ var MCP_SERVER_NAME = SKILL_NAME;
 var CODEX_TOKEN_ENV = "AGENTSKY_API_KEY";
 function systemCommandRunner() {
   return {
-    has: (command) => spawnSync3(command, ["--version"], { stdio: "ignore" }).status === 0,
+    has: (command) => spawnSync4(command, ["--version"], { stdio: "ignore" }).status === 0,
     run: (command, args) => {
-      const result = spawnSync3(command, args, { encoding: "utf8" });
+      const result = spawnSync4(command, args, { encoding: "utf8" });
       return { status: result.status, stderr: result.stderr ?? "" };
     }
   };
@@ -2845,10 +3207,10 @@ function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
 }
 
 // src/setup-local.ts
-import { isUtf8 as isUtf82 } from "buffer";
-import { existsSync as existsSync7, readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync7 } from "fs";
+import { isUtf8 as isUtf83 } from "buffer";
+import { existsSync as existsSync7, readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join9, resolve as resolve6 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join10, resolve as resolve6 } from "path";
 import { parse as parseToml3 } from "smol-toml";
 var MAX_SKILL_FILE_BYTES = 1024 * 1024;
 var MAX_IMPORT_DEPTH = 5;
@@ -2862,7 +3224,7 @@ function sensitive(name) {
   return name.startsWith(".env") || name.endsWith(".pem") || name.endsWith(".key");
 }
 function redacted(data) {
-  if (data.includes(0) || !isUtf82(data)) return new Uint8Array(data);
+  if (data.includes(0) || !isUtf83(data)) return new Uint8Array(data);
   try {
     const line = redactLine(JSON.stringify({ type: "import.resource", name: "skill", media_type: "text/plain", data: data.toString("base64") }), { requireStructured: true }).line;
     return new Uint8Array(Buffer.from(JSON.parse(line).data, "base64"));
@@ -2872,12 +3234,12 @@ function redacted(data) {
 }
 function skillFiles2(root, prefix) {
   const files2 = [];
-  for (const entry2 of readdirSync4(root, { withFileTypes: true })) {
-    const path = join9(root, entry2.name);
+  for (const entry2 of readdirSync5(root, { withFileTypes: true })) {
+    const path = join10(root, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIPPED_DIRS.has(entry2.name)) files2.push(...skillFiles2(path, `${prefix}/${entry2.name}`));
     } else if (entry2.isFile() && !sensitive(entry2.name) && statSync7(path).size <= MAX_SKILL_FILE_BYTES) {
-      const bytes = redacted(readFileSync9(path));
+      const bytes = redacted(readFileSync10(path));
       if (bytes) files2.push({ path: `${prefix}/${entry2.name}`, bytes });
     }
   }
@@ -2888,8 +3250,8 @@ function readLocalSkills(agents) {
   const ignored = [];
   for (const agent2 of agents) {
     if (!existsSync7(agent2.skillsDir)) continue;
-    for (const entry2 of readdirSync4(agent2.skillsDir, { withFileTypes: true })) {
-      const dir = join9(agent2.skillsDir, entry2.name);
+    for (const entry2 of readdirSync5(agent2.skillsDir, { withFileTypes: true })) {
+      const dir = join10(agent2.skillsDir, entry2.name);
       let isDir2 = entry2.isDirectory();
       if (entry2.isSymbolicLink()) {
         try {
@@ -2898,8 +3260,8 @@ function readLocalSkills(agents) {
           isDir2 = false;
         }
       }
-      if (!isDir2 || !existsSync7(join9(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
-      const name = frontmatterName(readFileSync9(join9(dir, "SKILL.md"), "utf8"));
+      if (!isDir2 || !existsSync7(join10(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
+      const name = frontmatterName(readFileSync10(join10(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
         continue;
@@ -2927,11 +3289,11 @@ function inlineImports(content, from, home, depth, seen) {
     }
     const target = fence ? void 0 : line.match(/^@(\S+\.(?:md|markdown|txt))$/i)?.[1];
     if (!target || depth >= MAX_IMPORT_DEPTH) return line;
-    const path = target.startsWith("~/") ? join9(home, target.slice(2)) : isAbsolute2(target) ? target : resolve6(dirname5(from), target);
+    const path = target.startsWith("~/") ? join10(home, target.slice(2)) : isAbsolute2(target) ? target : resolve6(dirname5(from), target);
     if (seen.includes(path)) return "";
     let imported;
     try {
-      imported = readFileSync9(path, "utf8");
+      imported = readFileSync10(path, "utf8");
     } catch {
       return line;
     }
@@ -2944,10 +3306,10 @@ function readGlobalInstructions(agents, home = homedir6()) {
   for (const agent2 of agents) {
     const file = INSTRUCTION_FILES2[agent2.id];
     if (!file) continue;
-    const path = join9(agent2.root, file);
+    const path = join10(agent2.root, file);
     let raw;
     try {
-      raw = readFileSync9(path, "utf8");
+      raw = readFileSync10(path, "utf8");
     } catch {
       continue;
     }
@@ -2966,7 +3328,7 @@ ${item.content.trim()}`).join("\n\n");
 }
 function readJson3(path) {
   try {
-    return JSON.parse(readFileSync9(path, "utf8"));
+    return JSON.parse(readFileSync10(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -2980,10 +3342,10 @@ function bearerOf(def) {
   return match?.[1] ?? null;
 }
 function serversOf(agent2, home) {
-  if (agent2.id === "claude_code") return readJson3(join9(home, ".claude.json"))?.mcpServers ?? {};
-  if (agent2.id === "cursor") return readJson3(join9(agent2.root, "mcp.json"))?.mcpServers ?? {};
+  if (agent2.id === "claude_code") return readJson3(join10(home, ".claude.json"))?.mcpServers ?? {};
+  if (agent2.id === "cursor") return readJson3(join10(agent2.root, "mcp.json"))?.mcpServers ?? {};
   try {
-    return parseToml3(readFileSync9(join9(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
+    return parseToml3(readFileSync10(join10(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
   } catch {
     return {};
   }
@@ -3004,9 +3366,9 @@ function findLocalSecrets(agents, home = homedir6()) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { createInterface as createInterface2 } from "readline";
 var ALIASES = {
   claude: "anthropic",
@@ -3102,11 +3464,11 @@ async function connectClaude() {
   console.log(`Connected Claude subscription${expiry}. Powers new eligible agents.`);
 }
 function codexSignIn(env = process.env, home = homedir7()) {
-  const path = join10(env.CODEX_HOME || join10(home, ".codex"), "auth.json");
+  const path = join11(env.CODEX_HOME || join11(home, ".codex"), "auth.json");
   if (!existsSync8(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
-  const raw = readFileSync10(path, "utf8");
+  const raw = readFileSync11(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     return { path, raw, account: parsed.tokens?.account_id };
@@ -3115,11 +3477,11 @@ function codexSignIn(env = process.env, home = homedir7()) {
   }
 }
 function cursorSignIn(env = process.env, home = homedir7()) {
-  const path = join10(env.XDG_CONFIG_HOME || join10(home, ".config"), "cursor", "auth.json");
+  const path = join11(env.XDG_CONFIG_HOME || join11(home, ".config"), "cursor", "auth.json");
   if (!existsSync8(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
-  const raw = readFileSync10(path, "utf8");
+  const raw = readFileSync11(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") throw new Error("shape");
@@ -3278,11 +3640,11 @@ function planProviders(names2) {
   }));
 }
 function reportPath() {
-  return join11(dirname6(configPath()), "setup.json");
+  return join12(dirname6(configPath()), "setup.json");
 }
 function loadReport() {
   try {
-    const saved = JSON.parse(readFileSync11(reportPath(), "utf8"));
+    const saved = JSON.parse(readFileSync12(reportPath(), "utf8"));
     return { agents: saved.agents ?? [], plans: saved.plans ?? [], ...saved.secrets ? { secrets: saved.secrets } : {} };
   } catch {
     return { agents: [], plans: [] };
@@ -3645,17 +4007,17 @@ function renderArtifact(artifact2) {
 }
 
 // src/skills-store.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
-import { basename as basename7, join as join12, relative as relative4, resolve as resolve7 } from "path";
+import { readdirSync as readdirSync6, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
+import { basename as basename7, join as join13, relative as relative4, resolve as resolve7 } from "path";
 function skillBundle(dir) {
   const root = resolve7(dir);
   const top = basename7(root);
   const files2 = [];
   const walk = (path) => {
-    for (const name of readdirSync5(path).sort()) {
-      const full = join12(path, name);
+    for (const name of readdirSync6(path).sort()) {
+      const full = join13(path, name);
       if (statSync8(full).isDirectory()) walk(full);
-      else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync12(full) });
+      else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync13(full) });
     }
   };
   walk(root);
@@ -3908,11 +4270,11 @@ function confirmPrompt(question) {
 }
 
 // src/harness.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname7, join as join13, resolve as resolve8 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname7, join as join14, resolve as resolve8 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
-  return join13(resolve8(dir), HARNESS_FILE);
+  return join14(resolve8(dir), HARNESS_FILE);
 }
 function readHarnessFile(dir) {
   const path = harnessFilePath(dir);
@@ -3920,7 +4282,7 @@ function readHarnessFile(dir) {
     throw new Error(`no ${HARNESS_FILE} found in ${resolve8(dir)} \u2014 run \`sky harness init\` first`);
   }
   try {
-    return JSON.parse(readFileSync13(path, "utf8"));
+    return JSON.parse(readFileSync14(path, "utf8"));
   } catch (err) {
     throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -4621,22 +4983,33 @@ session.command("shared").description("sessions other people shared with you to
     for (const s of sessions) console.log(`${s.id}  ${s.agent_type.padEnd(12)} ${s.title ?? "(untitled)"}  from ${s.owner.name ?? s.owner.email ?? "unknown"}  ${s.shared_at.slice(0, 10)}`);
   })
 );
-session.command("handoff <ref> <targetAgent>").description("hand the session's context to another agent (agent id or catalog handle); prints the new session").option("--from-message <id>", "carry the conversation up to this message only").option("--no-wait", "return once the handoff is accepted").action(
+session.command("model <ref> [model]").description("show the session's model and thinking level, or switch them; the next turn uses the new ones").option("--thinking <level>", `thinking level for the next turns; "default" returns to the agent's own`).action(
+  run(async (ref, model, opts) => {
+    const id = await resolveSessionRef(ref);
+    const change = engineChange(model, opts.thinking);
+    const { session: s } = change ? await api("PATCH", `/sessions/${encodeURIComponent(id)}`, change) : await api("GET", `/sessions/${encodeURIComponent(id)}`);
+    console.log(`${id}: ${s.llm}${s.reasoningEffort ? ` \xB7 thinking ${s.reasoningEffort}` : ""}${change ? "  (from the next turn)" : ""}`);
+  })
+);
+session.command("handoff <ref> <targetAgent>").description("hand the session's context and workspace to another agent (agent id or catalog handle); prints the new session").option("--from-message <id>", "carry the conversation up to this message only").option("--model <id>", "the model the new session runs").option("--thinking <level>", "the new session's thinking level").option("--no-wait", "return once the handoff is accepted").action(
   run(async (ref, targetAgent, opts) => {
     const id = await resolveSessionRef(ref);
+    const change = engineChange(opts.model, opts.thinking);
+    if (change && opts.wait === false) throw new ApiError(400, "invalid_request", "--model and --thinking need the handoff to finish; drop --no-wait");
     const done = await handoff(id, targetAgent, {
       fromMessage: opts.fromMessage,
       wait: opts.wait !== false,
       onStatus: (h) => console.error(`${h.id}: ${h.status}`)
     });
     if (done.status === "failed") throw new ApiError(422, done.error?.code ?? "handoff_failed", done.error?.message ?? "the handoff failed");
+    if (done.target_session && change) await api("PATCH", `/sessions/${encodeURIComponent(done.target_session)}`, change);
     if (done.target_session) console.log(`${done.target_session}  (${done.resolved_mode === "native_fork" ? "forked" : "from a written summary"})`);
   })
 );
 var sessionWorkspace = session.command("workspace").description("the session's workspace: list and read files, see changes, take a patch, copy a folder in");
 sessionWorkspace.command("ls <ref> [path]").description("list a directory (default: the workspace root)").option("--hidden", "include dotfiles").action(
   run(async (ref, path, opts) => {
-    const listing = await listFiles(await resolveSessionRef(ref), path, Boolean(opts.hidden));
+    const listing = await listFiles2(await resolveSessionRef(ref), path, Boolean(opts.hidden));
     for (const e of listing.entries) console.log(entryLine(e));
     if (listing.truncated) console.error(`(only the first ${listing.entries.length} entries)`);
   })
@@ -4909,7 +5282,7 @@ function formatRelative(msAgo) {
   if (hours < 48) return `${hours}h ago`;
   return `${Math.round(hours / 24)}d ago`;
 }
-program.command("import").description("import a local Claude Code or Codex session to AgentSky and continue it in the cloud").option("--current", "import the session this agent is running in (reads CLAUDE_CODE_SESSION_ID or CODEX_THREAD_ID, then falls back to most recent session in the cwd)").option("--all", "import all found sessions up to --limit").option("-y, --yes", "confirm transfer without prompting (default when --current or --session is given in non-TTY)").option("--json", "print one JSON result object per import and nothing else to stdout").option("--limit <n>", "maximum sessions to list or import", "10").option("--session <id>", "import one specific session by its ID").option("--harness <type>", "claude_code | codex | all (default: all)").option("--summary <path>", "attach a pre-written summary JSON (asteroids.session-summary v1) instead of the auto-generated one").option("--key <importKey>", "import grant key minted by the web page (skips sky auth login)").option("--trace <traceId>", "trace id paired with --key").option("--url <base>", "agent-use app URL (default: derived from SKY_API_URL or AGENT_USE_URL)").option("--no-files", "send the conversation only, without its local files, skills, repository state or tool-server setup").action(
+program.command("import").description("import a local Claude Code or Codex session to AgentSky and continue it in the cloud").option("--current", "import the session this agent is running in (reads CLAUDE_CODE_SESSION_ID or CODEX_THREAD_ID, then falls back to most recent session in the cwd)").option("--all", "import all found sessions up to --limit").option("-y, --yes", "confirm transfer without prompting (default when --current or --session is given in non-TTY)").option("--json", "print one JSON result object per import and nothing else to stdout").option("--limit <n>", "maximum sessions to list or import", "10").option("--session <id>", "import one specific session by its ID").option("--harness <type>", "claude_code | codex | all (default: all)").option("--summary <path>", "attach a pre-written summary JSON (asteroids.session-summary v1) instead of the auto-generated one").option("--key <importKey>", "import grant key minted by the web page (skips sky auth login)").option("--trace <traceId>", "trace id paired with --key").option("--url <base>", "agent-use app URL (default: derived from SKY_API_URL or AGENT_USE_URL)").option("--no-files", "send the conversation only, without its local files, skills, repository state or tool-server setup").option("--no-environment", "keep the working folder on this computer: send only the files the conversation touched").action(
   run(
     async (opts) => {
       if (opts.key && !opts.trace) throw new Error("--key requires --trace <traceId>");
@@ -5017,6 +5390,7 @@ Importing ${label} \u2026
           importKey: opts.key,
           grantTraceId: opts.trace,
           files: opts.files,
+          environment: opts.environment,
           onProgress: opts.json ? void 0 : (msg) => process.stdout.write(`  ${msg}
 `)
         });
@@ -5036,11 +5410,14 @@ Importing ${label} \u2026
             skills: result.setup.skills,
             missingSkills: result.setup.missingSkills,
             mcpServers: result.setup.mcpServers,
+            environment: result.environment,
             continueUrl: result.url
           }));
         } else {
           if (result.setup.skills.length || result.setup.mcpServers.length) console.log(`  Carried ${result.setup.skills.length} ${result.setup.skills.length === 1 ? "skill" : "skills"} and the setup of ${result.setup.mcpServers.length} tool ${result.setup.mcpServers.length === 1 ? "server" : "servers"} (their keys stay on this computer).`);
           if (result.attachedFiles.length || result.leftOutFiles.length) console.log(`  Attached ${result.attachedFiles.length} local ${result.attachedFiles.length === 1 ? "file" : "files"}${result.leftOutFiles.length ? `; left out ${result.leftOutFiles.length} (credential, missing, unsupported or over the 30 MiB upload)` : ""}.`);
+          if (result.environment && "folder" in result.environment) console.log(`  Uploaded the working folder ${result.environment.folder}: ${result.environment.files} files, ${(result.environment.bytes / 1024 / 1024).toFixed(1)} MiB packed${result.environment.leftOut ? `, ${result.environment.leftOut} credential or special files left on this computer` : ""}.`);
+          else if (result.environment) console.log(`  The working folder did not upload (${result.environment.error}); the conversation and the files it touched did.`);
           console.log(`  \u2713 Imported. Continue here:
     ${result.url}
 `);
@@ -5106,7 +5483,7 @@ task.command("get <task> <path>").description("read one task file; prints it, or
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync14(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync15(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -5155,6 +5532,28 @@ skills.command("list").description("the workspace's stored skills").action(
     for (const skill of list) console.log(`${skill.id}  ${skill.displayName ?? ""}`);
   })
 );
+async function decideReflection(id, verb) {
+  const { reflection_proposal: p } = await api("POST", `/reflection_proposals/${encodeURIComponent(id)}/${verb}`);
+  console.log(`${p.id} ${p.status}`);
+}
+var reflections = program.command("reflections").description("skill and lesson changes proposed after finished sessions; an owner or admin approves each one");
+reflections.command("list").description("the workspace's proposals, newest first (default: pending)").option("--status <status>", "pending, approved, rejected or superseded", "pending").option("--json", "print JSON").action(
+  run(async (opts) => {
+    const { reflection_proposals: list } = await api(
+      "GET",
+      `/reflection_proposals?status=${encodeURIComponent(opts.status)}`
+    );
+    if (opts.json) return void console.log(JSON.stringify(list, null, 2));
+    if (!list.length) return void console.log(`no ${opts.status} proposals`);
+    for (const p of list) {
+      const target = p.kind === "save_lesson" ? p.path : p.kind === "create_skill" ? `new skill ${p.payload.name}` : `skill ${p.target_skill_id}`;
+      console.log(`${p.id}  ${p.kind}  ${target}  from ${p.session_id}
+  ${p.payload.why ?? ""}`);
+    }
+  })
+);
+reflections.command("approve <id>").description("write the proposal through the skill or memory store").action(run(async (id) => decideReflection(id, "approve")));
+reflections.command("reject <id>").description("decline the proposal; nothing is written").action(run(async (id) => decideReflection(id, "reject")));
 var artifact = program.command("artifact").description("artifacts: publish a task's files as a named, shareable result");
 artifact.command("list").description("the workspace's artifacts, or one task's with --task").option("--task <task>", "only this task's artifacts").action(
   run(async (opts) => {
@@ -5769,7 +6168,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-IOARVWJ6.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-H3AP64UZ.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -5804,7 +6203,7 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-IOARVWJ6.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-H3AP64UZ.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -5817,14 +6216,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-IOARVWJ6.js");
+  const { readState, flush, grantSender } = await import("./trace-H3AP64UZ.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-IOARVWJ6.js");
+  const { readState, spoolStatus } = await import("./trace-H3AP64UZ.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -5834,7 +6233,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-IOARVWJ6.js");
+  const { readState } = await import("./trace-H3AP64UZ.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -5861,7 +6260,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-IOARVWJ6.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-H3AP64UZ.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -5871,7 +6270,7 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
 traceCmd.command("sync [payload]").description("upload this machine's Claude Code and Codex sessions to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-K3NE26GH.js");
+  const lib = await import("./trace-library-LGPKAQTY.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -5919,10 +6318,10 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       console.log(`A repository's .agentsky.json "workspace" wins over these rules.`);
     }
     if (opts.installSchedule) {
-      const { join: join14 } = await import("path");
+      const { join: join15 } = await import("path");
       const { homedir: homedir8 } = await import("os");
       const { execFileSync } = await import("child_process");
-      const log = join14(homedir8(), ".config", "sky", "trace-sync.log");
+      const log = join15(homedir8(), ".config", "sky", "trace-sync.log");
       const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
       try {
         execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
@@ -5932,11 +6331,11 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       console.log(`Sweeping every 15 minutes (${plist}); a full re-read runs weekly. Log: ${log}`);
     }
     if (opts.status) {
-      const { readFileSync: readFileSync15 } = await import("fs");
-      const { join: join14 } = await import("path");
+      const { readFileSync: readFileSync16 } = await import("fs");
+      const { join: join15 } = await import("path");
       let state = { sessions: {} };
       try {
-        state = JSON.parse(readFileSync15(join14(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+        state = JSON.parse(readFileSync16(join15(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
       } catch {
       }
       const counts = /* @__PURE__ */ new Map();
@@ -5969,7 +6368,7 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
   })();
 });
 traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
-  const { libraryRequest } = await import("./trace-library-K3NE26GH.js");
+  const { libraryRequest } = await import("./trace-library-LGPKAQTY.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
@@ -5986,7 +6385,7 @@ traceCmd.command("search <query...>").description("search every session in a wor
   if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-K3NE26GH.js");
+  const { libraryRequest } = await import("./trace-library-LGPKAQTY.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);