@agentsky/sky 2.17.0 → 2.19.0

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   resolveSessionRef,
   streamEvents,
   uploadFile
-} from "./chunk-FU43NICZ.js";
+} from "./chunk-4MVWXHZY.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -20,7 +20,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-H7SWXCH7.js";
+} from "./chunk-MOYCAI4S.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -37,22 +37,23 @@ import {
   modelSubscriptionProviderFor,
   reasoningEffortDocLine,
   redactLine,
+  redactPlainText,
   redactSecretValues,
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-ZJVFWFOY.js";
+} from "./chunk-UJ3D24IG.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
 import { basename as basename8, resolve as resolve9 } from "path";
 import { createInterface as createInterface6 } from "readline";
 import { Command } from "commander";
 
 // src/files.ts
-import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { basename as basename2, extname } from "path";
+import { readdirSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { basename as basename2, extname, join as join2 } from "path";
 
 // src/resumable-upload.ts
 import { createHash } from "crypto";
@@ -184,6 +185,58 @@ async function uploadLocalFile(path, expiresInSeconds, onProgress = () => {
   const bytes = readFileSync2(path);
   return uploadFile(new Uint8Array(bytes), basename2(path), mediaTypeFor(path), expiresInSeconds);
 }
+var IGNORED_NAMES = /* @__PURE__ */ new Set([".DS_Store", "Thumbs.db", "desktop.ini"]);
+function filesUnder(paths) {
+  const found = [];
+  const walk = (path) => {
+    const stat = statSync2(path);
+    if (stat.isFile()) {
+      if (!IGNORED_NAMES.has(basename2(path))) found.push(path);
+      return;
+    }
+    if (!stat.isDirectory()) return;
+    for (const name of readdirSync(path).sort()) walk(join2(path, name));
+  };
+  for (const path of paths) walk(path);
+  return found;
+}
+function transient(error) {
+  return !(error instanceof ApiError) || error.status === 429 || error.status >= 500;
+}
+async function uploadLocalFiles(paths, {
+  concurrency = 4,
+  attempts = 4,
+  expiresInSeconds,
+  onUploaded,
+  onFailed,
+  wait = (ms) => new Promise((done) => setTimeout(done, ms))
+}) {
+  let next = 0;
+  let uploaded = 0;
+  let failed = 0;
+  const worker = async () => {
+    while (next < paths.length) {
+      const path = paths[next++];
+      for (let attempt = 1; ; attempt++) {
+        try {
+          onUploaded(path, await uploadLocalFile(path, expiresInSeconds));
+          uploaded += 1;
+          break;
+        } catch (error) {
+          if (attempt < attempts && transient(error)) {
+            await wait(1e3 * 2 ** (attempt - 1));
+            continue;
+          }
+          onFailed(path, error);
+          failed += 1;
+          break;
+        }
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, paths.length) }, worker));
+  return { uploaded, failed };
+}
 function fileBlock(file) {
   const source = { type: "file", file_id: file.id };
   return file.mime_type.startsWith("image/") ? { type: "image", source } : { type: "document", source, title: file.filename };
@@ -565,12 +618,12 @@ function renderCatalogAgent(agent2) {
 import { spawn } from "child_process";
 import { existsSync as existsSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { basename as basename3, join as join2 } from "path";
+import { basename as basename3, join as join3 } from "path";
 import { createInterface } from "readline";
 var PROMPT_CAP = 1e5;
 var HARNESSES = ["claude_code", "codex", "openclaw"];
 function claudeConfigRoot() {
-  return process.env.CLAUDE_CONFIG_DIR ?? join2(homedir(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR ?? join3(homedir(), ".claude");
 }
 function readIfExists(path) {
   try {
@@ -590,9 +643,9 @@ function readJson(path) {
 }
 function claudeModel(configRoot) {
   const candidates = [
-    join2(process.cwd(), ".claude", "settings.local.json"),
-    join2(process.cwd(), ".claude", "settings.json"),
-    join2(configRoot, "settings.json")
+    join3(process.cwd(), ".claude", "settings.local.json"),
+    join3(process.cwd(), ".claude", "settings.json"),
+    join3(configRoot, "settings.json")
   ];
   for (const path of candidates) {
     const model = readJson(path)?.model;
@@ -602,11 +655,11 @@ function claudeModel(configRoot) {
 }
 function claudeMcpServers() {
   const merged = {};
-  const userConfig = readJson(join2(homedir(), ".claude.json"));
+  const userConfig = readJson(join3(homedir(), ".claude.json"));
   Object.assign(merged, userConfig?.mcpServers ?? {});
   Object.assign(merged, userConfig?.projects?.[process.cwd()]?.mcpServers ?? {});
   const projectConfig = readJson(
-    join2(process.cwd(), ".mcp.json")
+    join3(process.cwd(), ".mcp.json")
   );
   Object.assign(merged, projectConfig?.mcpServers ?? {});
   return merged;
@@ -623,13 +676,13 @@ function readClaudeCode() {
   const configRoot = claudeConfigRoot();
   const parts = [];
   const sources = [];
-  const global = readIfExists(join2(configRoot, "CLAUDE.md"));
+  const global = readIfExists(join3(configRoot, "CLAUDE.md"));
   if (global?.trim()) {
     parts.push({ label: "Global CLAUDE.md", content: global });
     sources.push("global CLAUDE.md");
   }
   for (const name of ["CLAUDE.md", "AGENTS.md"]) {
-    const project = readIfExists(join2(process.cwd(), name));
+    const project = readIfExists(join3(process.cwd(), name));
     if (project?.trim()) {
       parts.push({ label: `Project ${name}`, content: project });
       sources.push(`project ${name}`);
@@ -670,8 +723,8 @@ function detectHarness(explicit) {
     return explicit;
   }
   if (existsSync2(claudeConfigRoot())) return "claude_code";
-  if (existsSync2(join2(homedir(), ".codex"))) return "codex";
-  if (existsSync2(join2(homedir(), ".openclaw"))) return "openclaw";
+  if (existsSync2(join3(homedir(), ".codex"))) return "codex";
+  if (existsSync2(join3(homedir(), ".openclaw"))) return "openclaw";
   throw new Error(
     "no local harness found (~/.claude, ~/.codex, ~/.openclaw) \u2014 pass --harness to override"
   );
@@ -683,7 +736,7 @@ function readLocal(harness2) {
   );
 }
 function linkPath(configRoot) {
-  return join2(configRoot, "agentsky-link.json");
+  return join3(configRoot, "agentsky-link.json");
 }
 function readLink(configRoot) {
   const link = readJson(linkPath(configRoot));
@@ -929,22 +982,22 @@ async function clone(opts) {
 }
 
 // src/import-local.ts
-import { closeSync as closeSync3, existsSync as existsSync5, openSync as openSync3, readdirSync as readdirSync3, readFileSync as readFileSync8, readSync as readSync3, statSync as statSync5 } from "fs";
+import { closeSync as closeSync3, existsSync as existsSync5, openSync as openSync3, readdirSync as readdirSync4, readFileSync as readFileSync8, readSync as readSync3, statSync as statSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { createHash as createHash3 } from "crypto";
 
 // src/import-files.ts
 import { isUtf8 } from "buffer";
 import { existsSync as existsSync4, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, extname as extname2, isAbsolute, join as join4, relative as relative2, resolve as resolve4, sep as sep2, basename as basename5 } from "path";
+import { dirname as dirname4, extname as extname2, isAbsolute, join as join5, relative as relative2, resolve as resolve4, sep as sep2, basename as basename5 } from "path";
 
 // src/import-workspace.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync5, realpathSync, statSync as statSync3 } from "fs";
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync5, realpathSync, statSync as statSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename4, dirname as dirname3, join as join3, relative, sep } from "path";
+import { basename as basename4, dirname as dirname3, join as join4, relative, sep } from "path";
 import { parse as parseToml2 } from "smol-toml";
 var MAX_TREE = 5e3;
 var SKILL_LINE = /Base directory for this skill: (\/[^\s"'\\<>]+)/g;
@@ -967,13 +1020,13 @@ var isDir = (path) => {
   }
 };
 function sharedInstructionPaths(home = homedir2()) {
-  const rules = join3(home, ".agents", "rules");
+  const rules = join4(home, ".agents", "rules");
   let ruleFiles = [];
   try {
-    ruleFiles = readdirSync(rules).filter((name) => name.endsWith(".md")).sort().map((name) => join3(rules, name));
+    ruleFiles = readdirSync2(rules).filter((name) => name.endsWith(".md")).sort().map((name) => join4(rules, name));
   } catch {
   }
-  return [join3(home, "AGENTS.md"), join3(home, "MEMORY.md"), ...ruleFiles].filter(isFile);
+  return [join4(home, "AGENTS.md"), join4(home, "MEMORY.md"), ...ruleFiles].filter(isFile);
 }
 function strings(value, out, depth = 0) {
   if (depth > 12) return;
@@ -982,30 +1035,30 @@ function strings(value, out, depth = 0) {
   else if (value && typeof value === "object") for (const item of Object.values(value)) strings(item, out, depth + 1);
 }
 function skillRoots(cwd, home) {
-  const claude = process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude");
-  const codex = process.env.CODEX_HOME ?? join3(home, ".codex");
+  const claude = process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude");
+  const codex = process.env.CODEX_HOME ?? join4(home, ".codex");
   return [
-    ...cwd ? [join3(cwd, ".claude", "skills"), join3(cwd, ".agents", "skills")] : [],
-    join3(home, ".agents", "skills"),
-    join3(claude, "skills"),
-    join3(codex, "skills"),
-    join3(home, ".hermes", "skills")
+    ...cwd ? [join4(cwd, ".claude", "skills"), join4(cwd, ".agents", "skills")] : [],
+    join4(home, ".agents", "skills"),
+    join4(claude, "skills"),
+    join4(codex, "skills"),
+    join4(home, ".hermes", "skills")
   ];
 }
 function pluginSkill(plugin, skill, home) {
-  const base = join3(process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude"), "plugins");
+  const base = join4(process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude"), "plugins");
   const walk = (dir, depth) => {
     if (depth > 7) return null;
     let entries;
     try {
-      entries = readdirSync(dir, { withFileTypes: true });
+      entries = readdirSync2(dir, { withFileTypes: true });
     } catch {
       return null;
     }
     for (const entry2 of entries) {
       if (!entry2.isDirectory() || entry2.name === "node_modules" || entry2.name === ".git") continue;
-      const path = join3(dir, entry2.name);
-      if (entry2.name === skill && basename4(dir) === "skills" && path.includes(`${sep}${plugin}${sep}`) && isFile(join3(path, "SKILL.md"))) return path;
+      const path = join4(dir, entry2.name);
+      if (entry2.name === skill && basename4(dir) === "skills" && path.includes(`${sep}${plugin}${sep}`) && isFile(join4(path, "SKILL.md"))) return path;
       const found = walk(path, depth + 1);
       if (found) return found;
     }
@@ -1017,8 +1070,8 @@ function findSkill(name, cwd, home) {
   const [scope, skill] = name.includes(":") ? name.split(":", 2) : [null, name];
   if (scope && skill) return pluginSkill(scope, skill, home);
   for (const root of skillRoots(cwd, home)) {
-    const direct = join3(root, name);
-    if (isFile(join3(direct, "SKILL.md"))) return realpathSync(direct);
+    const direct = join4(root, name);
+    if (isFile(join4(direct, "SKILL.md"))) return realpathSync(direct);
   }
   return null;
 }
@@ -1026,7 +1079,7 @@ function loadedSkills(records, touched, cwd, home = homedir2()) {
   const dirs = /* @__PURE__ */ new Map();
   const missing = /* @__PURE__ */ new Set();
   const add = (dir, name = basename4(dir)) => {
-    if (!isFile(join3(dir, "SKILL.md"))) return false;
+    if (!isFile(join4(dir, "SKILL.md"))) return false;
     const real = realpathSync(dir);
     if (![...dirs.values()].includes(real)) dirs.set(name, real);
     return true;
@@ -1097,16 +1150,16 @@ function mcpServers(harness2, cwd, home = homedir2()) {
     }
   };
   if (harness2 === "claude_code") {
-    const config = readJson2(join3(process.env.CLAUDE_CONFIG_DIR ? dirname3(process.env.CLAUDE_CONFIG_DIR) : home, ".claude.json"));
+    const config = readJson2(join4(process.env.CLAUDE_CONFIG_DIR ? dirname3(process.env.CLAUDE_CONFIG_DIR) : home, ".claude.json"));
     const projects = config?.projects && typeof config.projects === "object" ? config.projects : {};
     const root = cwd ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || cwd : "";
     if (cwd) push(projects[cwd]?.mcpServers ?? projects[root]?.mcpServers, "local");
-    if (root) push(readJson2(join3(root, ".mcp.json"))?.mcpServers, "project");
+    if (root) push(readJson2(join4(root, ".mcp.json"))?.mcpServers, "project");
     push(config?.mcpServers, "user");
   }
   if (harness2 === "codex") {
     try {
-      const config = parseToml2(readFileSync5(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "config.toml"), "utf8"));
+      const config = parseToml2(readFileSync5(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "config.toml"), "utf8"));
       push(config.mcp_servers, "user");
     } catch {
     }
@@ -1160,13 +1213,13 @@ function skillFiles(skill) {
     if (depth > 8 || out.length > 400) return;
     let entries;
     try {
-      entries = readdirSync(dir, { withFileTypes: true });
+      entries = readdirSync2(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry2 of entries) {
       if (entry2.name === "node_modules" || entry2.name === ".git" || entry2.name === "__pycache__" || entry2.name === ".venv") continue;
-      const path = join3(dir, entry2.name);
+      const path = join4(dir, entry2.name);
       if (entry2.isDirectory()) walk(path, depth + 1);
       else if (entry2.isFile()) out.push({ path, name: `skills/${skill.name}/${relative(skill.dir, path).split(sep).join("/")}` });
     }
@@ -1177,7 +1230,7 @@ function skillFiles(skill) {
 function codexThreadName(sessionId, home = homedir2()) {
   let name = null;
   try {
-    for (const line of readFileSync5(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "session_index.jsonl"), "utf8").split("\n")) {
+    for (const line of readFileSync5(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "session_index.jsonl"), "utf8").split("\n")) {
       if (!line.includes(sessionId)) continue;
       try {
         const entry2 = JSON.parse(line);
@@ -1297,7 +1350,7 @@ function touchedPaths(records, cwd, home = homedir3()) {
 }
 function gitRoot(dir) {
   for (let d = dir; ; d = dirname4(d)) {
-    if (existsSync4(join4(d, ".git"))) return d;
+    if (existsSync4(join5(d, ".git"))) return d;
     if (d === dirname4(d)) return null;
   }
 }
@@ -1306,12 +1359,12 @@ function instructionPaths(cwd, harness2, home = homedir3()) {
   if (cwd && existsSync4(cwd)) {
     const root = gitRoot(cwd) ?? cwd;
     for (let d = resolve4(cwd); ; d = dirname4(d)) {
-      for (const name of INSTRUCTION_FILES) out.push(join4(d, name));
+      for (const name of INSTRUCTION_FILES) out.push(join5(d, name));
       if (d === root || d === dirname4(d)) break;
     }
   }
-  if (harness2 === "claude_code") out.push(join4(process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude"), "CLAUDE.md"));
-  if (harness2 === "codex") out.push(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "AGENTS.md"));
+  if (harness2 === "claude_code") out.push(join5(process.env.CLAUDE_CONFIG_DIR ?? join5(home, ".claude"), "CLAUDE.md"));
+  if (harness2 === "codex") out.push(join5(process.env.CODEX_HOME ?? join5(home, ".codex"), "AGENTS.md"));
   out.push(...sharedInstructionPaths(home));
   return out.filter((path) => {
     try {
@@ -1436,9 +1489,9 @@ function collectSessionFiles(records, opts) {
 // src/import-environment.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { closeSync as closeSync2, createWriteStream, lstatSync, mkdtempSync, openSync as openSync2, readdirSync as readdirSync2, readFileSync as readFileSync7, readSync as readSync2, rmSync as rmSync2 } from "fs";
+import { closeSync as closeSync2, createWriteStream, lstatSync, mkdtempSync, openSync as openSync2, readdirSync as readdirSync3, readFileSync as readFileSync7, readSync as readSync2, rmSync as rmSync2 } from "fs";
 import { tmpdir } from "os";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { isUtf8 as isUtf82 } from "buffer";
 import { createGzip } from "zlib";
 
@@ -1617,14 +1670,14 @@ function listFiles(cwd) {
   const walk = (dir, prefix) => {
     let entries;
     try {
-      entries = readdirSync2(dir, { withFileTypes: true });
+      entries = readdirSync3(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry2 of entries) {
       if (SKIPPED.has(entry2.name)) continue;
       const rel = prefix ? `${prefix}/${entry2.name}` : entry2.name;
-      if (entry2.isDirectory()) walk(join5(dir, entry2.name), rel);
+      if (entry2.isDirectory()) walk(join6(dir, entry2.name), rel);
       else out.push(rel);
       if (out.length > MAX_ENVIRONMENT_FILES) return;
     }
@@ -1641,8 +1694,8 @@ function textOf(path, size) {
 async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
   const listed = listFiles(cwd);
   if (listed.length > MAX_ENVIRONMENT_FILES) throw new Error(`The working folder has more than ${MAX_ENVIRONMENT_FILES} files; import it with --no-environment.`);
-  const scratch = mkdtempSync(join5(tmpdir(), "sky-environment-"));
-  const path = join5(scratch, "environment.tar.gz");
+  const scratch = mkdtempSync(join6(tmpdir(), "sky-environment-"));
+  const path = join6(scratch, "environment.tar.gz");
   const leftOut = [];
   const written = /* @__PURE__ */ new Set();
   const hash = createHash2("sha256");
@@ -1670,7 +1723,7 @@ async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
   });
   try {
     for (const rel of listed) {
-      const full = join5(cwd, ...rel.split("/"));
+      const full = join6(cwd, ...rel.split("/"));
       if (SECRET_FILE2.test(rel)) {
         leftOut.push({ path: rel, reason: "credential file" });
         continue;
@@ -1824,16 +1877,16 @@ function sniffTitle(filePath) {
   }
 }
 function listClaudeCodeSessions(limit) {
-  const root = process.env.CLAUDE_CONFIG_DIR ?? join6(homedir4(), ".claude");
-  const projectsDir = join6(root, "projects");
+  const root = process.env.CLAUDE_CONFIG_DIR ?? join7(homedir4(), ".claude");
+  const projectsDir = join7(root, "projects");
   if (!existsSync5(projectsDir)) return [];
   const sessions = [];
   try {
-    for (const encoded of readdirSync3(projectsDir)) {
-      const projectDir = join6(projectsDir, encoded);
+    for (const encoded of readdirSync4(projectsDir)) {
+      const projectDir = join7(projectsDir, encoded);
       let entries;
       try {
-        entries = readdirSync3(projectDir);
+        entries = readdirSync4(projectDir);
       } catch {
         continue;
       }
@@ -1841,7 +1894,7 @@ function listClaudeCodeSessions(limit) {
       for (const entry2 of entries) {
         if (!entry2.endsWith(".jsonl")) continue;
         const sessionId = entry2.slice(0, -6);
-        const mainFile = join6(projectDir, entry2);
+        const mainFile = join7(projectDir, entry2);
         let stat;
         try {
           stat = statSync5(mainFile);
@@ -1851,12 +1904,12 @@ function listClaudeCodeSessions(limit) {
         if (!stat.isFile()) continue;
         let discoveryError;
         const subagentFiles = [];
-        const subagentDir = join6(projectDir, sessionId, "subagents");
+        const subagentDir = join7(projectDir, sessionId, "subagents");
         if (existsSync5(subagentDir)) {
           try {
-            const subFiles = readdirSync3(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
+            const subFiles = readdirSync4(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
             for (const f of subFiles) {
-              subagentFiles.push(join6(subagentDir, f));
+              subagentFiles.push(join7(subagentDir, f));
             }
           } catch {
             discoveryError = "Cannot read all recorded subagent conversations. Fix local file access before importing this session.";
@@ -1878,17 +1931,17 @@ function listClaudeCodeSessions(limit) {
   return sessions.sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
 function listCodexSessions(limit) {
-  const sessionsDir = join6(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join6(homedir4(), ".codex"), "sessions");
+  const sessionsDir = join7(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join7(homedir4(), ".codex"), "sessions");
   const records = [];
   function walk(dir) {
     let entries;
     try {
-      entries = readdirSync3(dir, { withFileTypes: true });
+      entries = readdirSync4(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry2 of entries) {
-      const full = join6(dir, entry2.name);
+      const full = join7(dir, entry2.name);
       if (entry2.isDirectory()) {
         walk(full);
         continue;
@@ -2440,8 +2493,8 @@ async function triggerRequest(id, resource, change) {
 // src/session-workspace.ts
 import { spawnSync as spawnSync3 } from "child_process";
 import { createHash as createHash5, randomUUID } from "crypto";
-import { readdirSync as readdirSync4, statSync as statSync6 } from "fs";
-import { basename as basename6, join as join7, relative as relative3, resolve as resolve5 } from "path";
+import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
+import { basename as basename6, join as join8, relative as relative3, resolve as resolve5 } from "path";
 var SINGLE_IMPORT_MAX = 25 * 1024 * 1024;
 var PART_SIZE = 8 * 1024 * 1024;
 var SKIPPED2 = /* @__PURE__ */ new Set([".git", "node_modules"]);
@@ -2475,13 +2528,13 @@ function folderFiles(dir) {
   const git2 = spawnSync3("git", ["-C", dir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8" });
   const top = spawnSync3("git", ["-C", dir, "rev-parse", "--show-prefix"], { encoding: "utf8" });
   if (git2.status === 0 && top.status === 0) {
-    return git2.stdout.split("\0").filter((path) => path && statSync6(join7(dir, path), { throwIfNoEntry: false })?.isFile());
+    return git2.stdout.split("\0").filter((path) => path && statSync6(join8(dir, path), { throwIfNoEntry: false })?.isFile());
   }
   const files2 = [];
   const walk = (at) => {
-    for (const entry2 of readdirSync4(at, { withFileTypes: true })) {
+    for (const entry2 of readdirSync5(at, { withFileTypes: true })) {
       if (SKIPPED2.has(entry2.name)) continue;
-      const full = join7(at, entry2.name);
+      const full = join8(at, entry2.name);
       if (entry2.isDirectory()) walk(full);
       else if (entry2.isFile()) files2.push(relative3(dir, full));
     }
@@ -2565,15 +2618,15 @@ async function handoff(id, targetAgent, opts = {}) {
 // src/local-agents.ts
 import { existsSync as existsSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function localAgents(env = process.env, home = homedir5()) {
-  const claude = env.CLAUDE_CONFIG_DIR || join8(home, ".claude");
-  const codex = env.CODEX_HOME || join8(home, ".codex");
-  const cursor = join8(home, ".cursor");
+  const claude = env.CLAUDE_CONFIG_DIR || join9(home, ".claude");
+  const codex = env.CODEX_HOME || join9(home, ".codex");
+  const cursor = join9(home, ".cursor");
   return [
-    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join8(claude, "skills") },
-    { id: "codex", name: "Codex", root: codex, skillsDir: join8(codex, "skills") },
-    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join8(cursor, "skills") }
+    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join9(claude, "skills") },
+    { id: "codex", name: "Codex", root: codex, skillsDir: join9(codex, "skills") },
+    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join9(cursor, "skills") }
   ];
 }
 function detectLocalAgents(env = process.env, home = homedir5()) {
@@ -2679,7 +2732,7 @@ async function readTurn(sessionId, opts = {}) {
 
 // src/setup.ts
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname6, join as join12 } from "path";
+import { dirname as dirname6, join as join13 } from "path";
 import { createInterface as createInterface3 } from "readline";
 
 // src/mcp-register.ts
@@ -2687,7 +2740,7 @@ import { spawnSync as spawnSync4 } from "child_process";
 
 // src/skill.ts
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 
 // src/catalog-file.ts
 var CATALOG_FILE = "catalog.md";
@@ -3128,7 +3181,7 @@ To set a per-repo default, create \`.agentsky.json\` at the git root:
 }
 function installedVersion(dir) {
   try {
-    const marker = JSON.parse(readFileSync9(join9(dir, SKILL_MARKER), "utf8"));
+    const marker = JSON.parse(readFileSync9(join10(dir, SKILL_MARKER), "utf8"));
     return typeof marker.version === "string" ? marker.version : null;
   } catch {
     return null;
@@ -3138,25 +3191,25 @@ function isInstalledSkill(dir) {
   return installedVersion(dir) !== null;
 }
 function installSkill(agent2, opts = {}) {
-  const dir = join9(agent2.skillsDir, SKILL_NAME);
+  const dir = join10(agent2.skillsDir, SKILL_NAME);
   const previous = installedVersion(dir);
   const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
   if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
   if (outcome !== "current") {
     mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join9(dir, "SKILL.md"), skillDocument());
-    writeFileSync4(join9(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
+    writeFileSync4(join10(dir, "SKILL.md"), skillDocument());
+    writeFileSync4(join10(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
 `);
   }
   if (opts.catalog) {
     mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join9(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+    writeFileSync4(join10(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
   }
-  const refsDir = join9(dir, REFERENCES_DIR);
+  const refsDir = join10(dir, REFERENCES_DIR);
   mkdirSync2(refsDir, { recursive: true });
-  writeFileSync4(join9(refsDir, "import.md"), importReferenceDoc());
-  writeFileSync4(join9(refsDir, "workspaces.md"), workspacesReferenceDoc());
-  writeFileSync4(join9(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
+  writeFileSync4(join10(refsDir, "import.md"), importReferenceDoc());
+  writeFileSync4(join10(refsDir, "workspaces.md"), workspacesReferenceDoc());
+  writeFileSync4(join10(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
   return { agent: agent2.id, path: dir, outcome };
 }
 
@@ -3208,9 +3261,9 @@ function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
 
 // src/setup-local.ts
 import { isUtf8 as isUtf83 } from "buffer";
-import { existsSync as existsSync7, readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
+import { existsSync as existsSync7, readdirSync as readdirSync6, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join10, resolve as resolve6 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join11, resolve as resolve6 } from "path";
 import { parse as parseToml3 } from "smol-toml";
 var MAX_SKILL_FILE_BYTES = 1024 * 1024;
 var MAX_IMPORT_DEPTH = 5;
@@ -3234,8 +3287,8 @@ function redacted(data) {
 }
 function skillFiles2(root, prefix) {
   const files2 = [];
-  for (const entry2 of readdirSync5(root, { withFileTypes: true })) {
-    const path = join10(root, entry2.name);
+  for (const entry2 of readdirSync6(root, { withFileTypes: true })) {
+    const path = join11(root, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIPPED_DIRS.has(entry2.name)) files2.push(...skillFiles2(path, `${prefix}/${entry2.name}`));
     } else if (entry2.isFile() && !sensitive(entry2.name) && statSync7(path).size <= MAX_SKILL_FILE_BYTES) {
@@ -3250,8 +3303,8 @@ function readLocalSkills(agents) {
   const ignored = [];
   for (const agent2 of agents) {
     if (!existsSync7(agent2.skillsDir)) continue;
-    for (const entry2 of readdirSync5(agent2.skillsDir, { withFileTypes: true })) {
-      const dir = join10(agent2.skillsDir, entry2.name);
+    for (const entry2 of readdirSync6(agent2.skillsDir, { withFileTypes: true })) {
+      const dir = join11(agent2.skillsDir, entry2.name);
       let isDir2 = entry2.isDirectory();
       if (entry2.isSymbolicLink()) {
         try {
@@ -3260,8 +3313,8 @@ function readLocalSkills(agents) {
           isDir2 = false;
         }
       }
-      if (!isDir2 || !existsSync7(join10(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
-      const name = frontmatterName(readFileSync10(join10(dir, "SKILL.md"), "utf8"));
+      if (!isDir2 || !existsSync7(join11(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
+      const name = frontmatterName(readFileSync10(join11(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
         continue;
@@ -3289,7 +3342,7 @@ function inlineImports(content, from, home, depth, seen) {
     }
     const target = fence ? void 0 : line.match(/^@(\S+\.(?:md|markdown|txt))$/i)?.[1];
     if (!target || depth >= MAX_IMPORT_DEPTH) return line;
-    const path = target.startsWith("~/") ? join10(home, target.slice(2)) : isAbsolute2(target) ? target : resolve6(dirname5(from), target);
+    const path = target.startsWith("~/") ? join11(home, target.slice(2)) : isAbsolute2(target) ? target : resolve6(dirname5(from), target);
     if (seen.includes(path)) return "";
     let imported;
     try {
@@ -3306,7 +3359,7 @@ function readGlobalInstructions(agents, home = homedir6()) {
   for (const agent2 of agents) {
     const file = INSTRUCTION_FILES2[agent2.id];
     if (!file) continue;
-    const path = join10(agent2.root, file);
+    const path = join11(agent2.root, file);
     let raw;
     try {
       raw = readFileSync10(path, "utf8");
@@ -3342,10 +3395,10 @@ function bearerOf(def) {
   return match?.[1] ?? null;
 }
 function serversOf(agent2, home) {
-  if (agent2.id === "claude_code") return readJson3(join10(home, ".claude.json"))?.mcpServers ?? {};
-  if (agent2.id === "cursor") return readJson3(join10(agent2.root, "mcp.json"))?.mcpServers ?? {};
+  if (agent2.id === "claude_code") return readJson3(join11(home, ".claude.json"))?.mcpServers ?? {};
+  if (agent2.id === "cursor") return readJson3(join11(agent2.root, "mcp.json"))?.mcpServers ?? {};
   try {
-    return parseToml3(readFileSync10(join10(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
+    return parseToml3(readFileSync10(join11(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
   } catch {
     return {};
   }
@@ -3368,7 +3421,7 @@ function findLocalSecrets(agents, home = homedir6()) {
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 import { createInterface as createInterface2 } from "readline";
 var ALIASES = {
   claude: "anthropic",
@@ -3464,7 +3517,7 @@ async function connectClaude() {
   console.log(`Connected Claude subscription${expiry}. Powers new eligible agents.`);
 }
 function codexSignIn(env = process.env, home = homedir7()) {
-  const path = join11(env.CODEX_HOME || join11(home, ".codex"), "auth.json");
+  const path = join12(env.CODEX_HOME || join12(home, ".codex"), "auth.json");
   if (!existsSync8(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
@@ -3477,7 +3530,7 @@ function codexSignIn(env = process.env, home = homedir7()) {
   }
 }
 function cursorSignIn(env = process.env, home = homedir7()) {
-  const path = join11(env.XDG_CONFIG_HOME || join11(home, ".config"), "cursor", "auth.json");
+  const path = join12(env.XDG_CONFIG_HOME || join12(home, ".config"), "cursor", "auth.json");
   if (!existsSync8(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
@@ -3640,7 +3693,7 @@ function planProviders(names2) {
   }));
 }
 function reportPath() {
-  return join12(dirname6(configPath()), "setup.json");
+  return join13(dirname6(configPath()), "setup.json");
 }
 function loadReport() {
   try {
@@ -4007,15 +4060,15 @@ function renderArtifact(artifact2) {
 }
 
 // src/skills-store.ts
-import { readdirSync as readdirSync6, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
-import { basename as basename7, join as join13, relative as relative4, resolve as resolve7 } from "path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
+import { basename as basename7, join as join14, relative as relative4, resolve as resolve7 } from "path";
 function skillBundle(dir) {
   const root = resolve7(dir);
   const top = basename7(root);
   const files2 = [];
   const walk = (path) => {
-    for (const name of readdirSync6(path).sort()) {
-      const full = join13(path, name);
+    for (const name of readdirSync7(path).sort()) {
+      const full = join14(path, name);
       if (statSync8(full).isDirectory()) walk(full);
       else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync13(full) });
     }
@@ -4049,6 +4102,355 @@ function renderRequest(request) {
   return `${request.id}  ${request.kind}  from ${request.session_id}
     ${request.question}${options}`;
 }
+async function getSkillUsage(since) {
+  const qs = since ? `?since=${encodeURIComponent(since)}` : "";
+  return api("GET", `/skills/usage${qs}`);
+}
+
+// src/task-export.ts
+import { createHash as createHash6 } from "crypto";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname7, join as join15 } from "path";
+import { stringify as stringifyToml2 } from "smol-toml";
+var TEXT_MAX = 2e4;
+function scrub(text, names2) {
+  let out = redactPlainText(text).text;
+  for (const { name, alias } of names2) {
+    if (!name) continue;
+    out = out.split(name).join(alias);
+  }
+  return out.length > TEXT_MAX ? `${out.slice(0, TEXT_MAX)}
+\u2026[cut]` : out;
+}
+function textOf2(event) {
+  if (typeof event.text === "string" && event.text.trim()) return event.text;
+  if (Array.isArray(event.content)) {
+    return event.content.map((block) => block.type === "text" && typeof block.text === "string" ? block.text : "").filter(Boolean).join("\n");
+  }
+  return "";
+}
+function firstAsk(record) {
+  const root = record.threads.find((thread) => thread.relation === "primary") ?? record.threads[0];
+  if (!root) return null;
+  for (const event of record.events[root.id] ?? []) {
+    if (event.type === "user.message") {
+      const text = textOf2(event).trim();
+      if (text) return text;
+    }
+  }
+  return null;
+}
+function decisionsOf(record) {
+  const out = [];
+  for (const thread of record.threads) {
+    for (const event of record.events[thread.id] ?? []) {
+      if (event.type === "human.decision" || event.type === "outcome.observed") out.push({ ...event, thread_id: thread.id });
+    }
+  }
+  return out.sort((a, b) => (a.at ?? "").localeCompare(b.at ?? ""));
+}
+function adoptedSession(record) {
+  const decisions = decisionsOf(record).filter((event) => event.type === "human.decision");
+  for (const event of [...decisions].reverse()) {
+    if (event.kind === "adopt") return event.target_session_id ?? event.thread_id;
+    if (event.kind === "vote" && event.target_session_id) return event.target_session_id;
+  }
+  return null;
+}
+function stepsOf(record, names2) {
+  const root = record.threads.find((thread) => thread.relation === "primary") ?? record.threads[0];
+  if (!root) return [];
+  const events = record.events[root.id] ?? [];
+  const steps = [];
+  events.forEach((event, index) => {
+    if (event.type !== "human.decision" || event.kind !== "revise" && event.kind !== "rerun") return;
+    const next = events.slice(index + 1).find((later) => later.type === "user.message" && textOf2(later).trim());
+    const words = next ? textOf2(next) : event.reason ?? "";
+    if (!words.trim()) return;
+    steps.push({ at: event.at ?? "", instruction: scrub(words, names2) });
+  });
+  return steps;
+}
+function rubricOf(record, instruction, names2) {
+  if (record.goal && record.goal.criteria.length) {
+    const verdicts = new Map((record.goal.last_evaluation?.criteria ?? []).map((row) => [row.id, row.verdict]));
+    return {
+      version: 1,
+      source: "goal",
+      criteria: record.goal.criteria.map((criterion) => ({
+        id: criterion.id,
+        text: scrub(criterion.text, names2),
+        must: true,
+        source: `goal criterion ${criterion.id}`,
+        ...criterion.command ? { command: criterion.command } : {},
+        ...verdicts.has(criterion.id) ? { last_verdict: verdicts.get(criterion.id) } : {}
+      }))
+    };
+  }
+  return {
+    version: 1,
+    source: "instruction",
+    criteria: [{ id: "c1", text: `The deliverable does what the instruction asks: ${instruction.split("\n")[0]?.slice(0, 300) ?? ""}`, must: true, source: "derived from the instruction; no goal was set" }]
+  };
+}
+var JUDGE_PY = String.raw`#!/usr/bin/env python3
+"""Harbor verifier: grade the agent's output against tests/rubric.json with an LLM judge.
+
+Reads every file under /workspace/outputs (falling back to /workspace) and asks the judge
+model, criterion by criterion, for a yes/no with quoted evidence. Writes
+/logs/verifier/reward.json ({"reward": 0|1, "criteria": [...]}) and reward.txt.
+Model and key come from the environment (JUDGE_MODEL, JUDGE_API_KEY, JUDGE_BASE_URL);
+nothing secret is in this file. Reward is 1 only when every MUST criterion passes.
+"""
+import json, os, pathlib, sys, urllib.request
+
+HERE = pathlib.Path(__file__).resolve().parent
+RUBRIC = json.loads((HERE / "rubric.json").read_text())
+OUT_DIR = pathlib.Path(os.environ.get("HARBOR_OUTPUTS", "/workspace/outputs"))
+if not OUT_DIR.exists():
+    OUT_DIR = pathlib.Path("/workspace")
+LOGS = pathlib.Path(os.environ.get("HARBOR_VERIFIER_LOGS", "/logs/verifier"))
+LOGS.mkdir(parents=True, exist_ok=True)
+
+def collect(limit=200_000):
+    parts, size = [], 0
+    for path in sorted(p for p in OUT_DIR.rglob("*") if p.is_file()):
+        if any(s in path.parts for s in (".git", "node_modules", "__pycache__")):
+            continue
+        try:
+            text = path.read_text(errors="replace")
+        except OSError:
+            continue
+        chunk = f"\n===== {path.relative_to(OUT_DIR)} =====\n{text}"
+        if size + len(chunk) > limit:
+            break
+        parts.append(chunk); size += len(chunk)
+    return "".join(parts)
+
+def ask(prompt):
+    base = os.environ.get("JUDGE_BASE_URL", "https://api.openai.com/v1").rstrip("/")
+    body = json.dumps({"model": os.environ.get("JUDGE_MODEL", "gpt-5.5"), "temperature": 0,
+                       "messages": [{"role": "user", "content": prompt}]}).encode()
+    req = urllib.request.Request(f"{base}/chat/completions", data=body, headers={
+        "content-type": "application/json", "authorization": f"Bearer {os.environ['JUDGE_API_KEY']}"})
+    with urllib.request.urlopen(req, timeout=120) as res:
+        return json.load(res)["choices"][0]["message"]["content"]
+
+def grade(criterion, evidence):
+    prompt = (
+        "You grade one requirement of a task against the agent's output.\n"
+        f"Requirement: {criterion['text']}\n"
+        "Answer as JSON only: {\"pass\": true|false, \"evidence\": \"<quote from the output, or why it is missing>\"}.\n"
+        "Pass only when the output itself shows the requirement met.\n\nOUTPUT:\n" + evidence)
+    raw = ask(prompt).strip()
+    start, end = raw.find("{"), raw.rfind("}")
+    verdict = json.loads(raw[start:end + 1]) if start >= 0 else {"pass": False, "evidence": raw[:300]}
+    return {"id": criterion["id"], "must": criterion.get("must", True), "pass": bool(verdict.get("pass")), "evidence": str(verdict.get("evidence", ""))[:1000]}
+
+def main():
+    evidence = collect()
+    results = [grade(c, evidence) for c in RUBRIC["criteria"]]
+    reward = 1 if results and all(r["pass"] for r in results if r["must"]) else 0
+    (LOGS / "reward.json").write_text(json.dumps({"reward": reward, "criteria": results}, indent=2))
+    (LOGS / "reward.txt").write_text(f"{reward}\n")
+    print(json.dumps({"reward": reward, "passed": sum(r["pass"] for r in results), "total": len(results)}))
+    return 0
+
+if __name__ == "__main__":
+    sys.exit(main())
+`;
+var TEST_SH = `#!/usr/bin/env bash
+# Harbor verifier entry point: the judge reads tests/rubric.json and writes /logs/verifier/reward.json.
+set -euo pipefail
+cd "$(dirname "$0")"
+exec python3 judge.py
+`;
+var SOLVE_SH = `#!/usr/bin/env bash
+# Reference solution: the files the task's sessions produced, as the person left them.
+set -euo pipefail
+cd "$(dirname "$0")"
+mkdir -p /workspace/outputs
+if [ -d files ]; then cp -R files/. /workspace/outputs/; fi
+`;
+function buildHarborTask(record, opts) {
+  const names2 = opts.redactNames;
+  const out = /* @__PURE__ */ new Map();
+  const ask2 = record.goal?.objective ?? firstAsk(record) ?? record.title ?? "Complete the task described by the workspace.";
+  const instruction = scrub(ask2, names2);
+  const root = record.threads.find((thread) => thread.relation === "primary") ?? record.threads[0];
+  const harnesses = [...new Set(record.threads.map((thread) => thread.agent.harness))];
+  const decisions = decisionsOf(record);
+  const adopted = adoptedSession(record);
+  const steps = stepsOf(record, names2);
+  const idHash = createHash6("sha256").update(record.task_id).digest("hex").slice(0, 16);
+  out.set("instruction.md", `${instruction.trim()}
+
+Write your deliverables under /workspace/outputs.
+`);
+  out.set(
+    "task.toml",
+    stringifyToml2({
+      metadata: {
+        name: `agentsky-${idHash}`,
+        tier: opts.tier,
+        source: "agentsky-session-record",
+        source_task: idHash,
+        exported_at: record.exported_at,
+        harnesses,
+        has_goal: Boolean(record.goal),
+        decisions: decisions.length,
+        steps: steps.length,
+        adopted_session: adopted ?? "",
+        did_the_job: record.completion_answer?.did_the_job ?? "unknown"
+      },
+      verifier: { kind: "rubric_judge", rubric: "tests/rubric.json", reward: "/logs/verifier/reward.json" }
+    })
+  );
+  const env = record.environment ?? root?.environment ?? null;
+  if (env && typeof env.repo === "string" && typeof env.commit === "string") {
+    out.set(
+      "environment/Dockerfile",
+      `FROM node:22-bookworm
+RUN apt-get update && apt-get install -y --no-install-recommends git python3 && rm -rf /var/lib/apt/lists/*
+WORKDIR /workspace
+RUN git clone ${env.repo} repo && cd repo && git checkout ${env.commit}
+`
+    );
+  } else {
+    out.set(
+      "environment/README.md",
+      "This task is a real execution, not a resettable environment: the record carries no repository and commit to rebuild from.\nAuthor environment/Dockerfile by hand from solution/files (the task's own files at export) before running it with Harbor, or keep it as trajectory data.\n"
+    );
+  }
+  const rubric = rubricOf(record, instruction, names2);
+  out.set("tests/rubric.json", `${JSON.stringify(rubric, null, 2)}
+`);
+  out.set("tests/judge.py", JUDGE_PY);
+  out.set("tests/test.sh", TEST_SH);
+  out.set("solution/solve.sh", SOLVE_SH);
+  out.set(
+    "solution/deliverables.json",
+    `${JSON.stringify({ files: record.files.map((file) => ({ path: file.path, bytes: file.size_bytes ?? null })), adopted_session: adopted }, null, 2)}
+`
+  );
+  for (const [path, bytes] of opts.fileBytes ?? []) out.set(`solution/files/${path}`, bytes);
+  const scrubbedEvents = {};
+  for (const [threadId, events] of Object.entries(record.events)) {
+    scrubbedEvents[threadId] = events.map((event) => ({
+      ...event,
+      ...typeof event.text === "string" ? { text: scrub(event.text, names2) } : {},
+      ...Array.isArray(event.content) ? { content: event.content.map((block) => typeof block.text === "string" ? { ...block, text: scrub(block.text, names2) } : block) } : {},
+      ...typeof event.reason === "string" ? { reason: scrub(event.reason, names2) } : {},
+      ..."parts" in event ? { parts: void 0 } : {}
+    }));
+  }
+  out.set("rollout/record.json", `${JSON.stringify({ ...record, title: record.title ? scrub(record.title, names2) : null, events: scrubbedEvents, goal: record.goal ? { ...record.goal, objective: scrub(record.goal.objective, names2) } : null }, null, 2)}
+`);
+  out.set("rollout/decisions.json", `${JSON.stringify(decisions.map((event) => ({ ...event, reason: typeof event.reason === "string" ? scrub(event.reason, names2) : event.reason })), null, 2)}
+`);
+  steps.forEach((step, index) => {
+    out.set(`steps/step-${index + 1}/instruction.md`, `${step.instruction.trim()}
+`);
+  });
+  return out;
+}
+async function pagedEvents(sessionId) {
+  const events = [];
+  let cursor = null;
+  for (; ; ) {
+    const query = new URLSearchParams({ limit: "500" });
+    if (cursor) query.set("cursor", cursor);
+    const page = await api("GET", `/sessions/${encodeURIComponent(sessionId)}/events?${query}`);
+    events.push(...page.events);
+    if (!page.hasMore || !page.cursor) return events;
+    cursor = page.cursor;
+  }
+}
+async function fetchTaskRecord(taskRef) {
+  const { task: task2 } = await api("GET", `/tasks/${encodeURIComponent(taskRef)}`);
+  const { threads } = await api("GET", `/sessions/${encodeURIComponent(task2.id)}/threads`);
+  const events = {};
+  for (const thread of threads) events[thread.id] = await pagedEvents(thread.id);
+  let goal2 = null;
+  try {
+    goal2 = (await api("GET", `/sessions/${encodeURIComponent(task2.id)}/goal`)).goal;
+  } catch (error) {
+    if (!(error instanceof ApiError && error.status === 404)) throw error;
+  }
+  let files2 = [];
+  try {
+    files2 = await listTaskFiles(task2.id);
+  } catch (error) {
+    if (!(error instanceof ApiError && (error.status === 404 || error.status === 503))) throw error;
+  }
+  const root = threads.find((thread) => thread.relation === "primary") ?? threads[0];
+  return { task_id: task2.id, exported_at: (/* @__PURE__ */ new Date()).toISOString(), title: task2.title ?? null, threads, events, goal: goal2, files: files2, completion_answer: task2.completion_answer ?? null, environment: root?.environment ?? null };
+}
+var FILE_BYTES_MAX = 50 * 1024 * 1024;
+async function exportTaskHarbor(taskRef, outDir, opts) {
+  const record = await fetchTaskRecord(taskRef);
+  const fileBytes = /* @__PURE__ */ new Map();
+  let total = 0;
+  for (const file of record.files) {
+    if (total + (file.size_bytes ?? 0) > FILE_BYTES_MAX) break;
+    const bytes = await readTaskFile(record.task_id, file.path);
+    total += bytes.byteLength;
+    fileBytes.set(file.path, bytes);
+  }
+  const files2 = buildHarborTask(record, { ...opts, fileBytes });
+  const written = [];
+  for (const [path, content] of files2) {
+    const target = join15(outDir, path);
+    mkdirSync4(dirname7(target), { recursive: true });
+    writeFileSync6(target, content, typeof content === "string" ? { mode: path.endsWith(".sh") || path.endsWith(".py") ? 493 : 420 } : void 0);
+    written.push(path);
+  }
+  return { written, record };
+}
+function parseRedactNames(values) {
+  return (values ?? []).map((value) => {
+    const index = value.indexOf("=");
+    if (index < 0) return { name: value.trim(), alias: "[redacted]" };
+    return { name: value.slice(0, index).trim(), alias: value.slice(index + 1).trim() || "[redacted]" };
+  }).filter((pair) => pair.name);
+}
+
+// src/task-record.ts
+import { randomUUID as randomUUID2 } from "crypto";
+var DECISION_KINDS = ["adopt", "rerun", "revise", "discard", "vote", "did_the_job", "approve"];
+async function listThreads(taskRef) {
+  return (await api("GET", `/sessions/${encodeURIComponent(taskRef)}/threads`)).threads;
+}
+function renderThread(thread) {
+  const spend = (Number(thread.usage.spent_usd_micros) / 1e6).toFixed(4);
+  const env = thread.environment?.repo ? `  ${thread.environment.repo}${thread.environment.commit ? `@${thread.environment.commit.slice(0, 7)}` : ""}` : "";
+  return `${thread.id}  ${thread.relation.padEnd(7)}  ${thread.source.padEnd(12)}  ${thread.agent.harness}/${thread.agent.model}  ${thread.status}  $${spend}${env}`;
+}
+async function recordDecision(sessionRef, kind, opts = {}) {
+  if (!DECISION_KINDS.includes(kind)) throw new Error(`kind must be one of ${DECISION_KINDS.join(", ")}`);
+  if ((kind === "did_the_job" || kind === "approve") && typeof opts.value !== "boolean") throw new Error(`${kind} needs --yes or --no`);
+  const key = opts.idempotencyKey ?? randomUUID2();
+  const res = await fetchRecord(sessionRef, {
+    type: "human.decision",
+    payload: {
+      kind,
+      ...opts.target ? { target_session_id: opts.target } : {},
+      ...typeof opts.value === "boolean" ? { value: opts.value } : {},
+      ...opts.reason ? { reason: opts.reason } : {},
+      surface: opts.surface ?? "cli"
+    }
+  }, key);
+  return res;
+}
+var OUTCOME_KINDS = ["pr_merged", "deployed", "reopened", "later_failure", "shipped"];
+async function recordOutcome(sessionRef, kind, opts = {}) {
+  if (!OUTCOME_KINDS.includes(kind)) throw new Error(`kind must be one of ${OUTCOME_KINDS.join(", ")}`);
+  return fetchRecord(sessionRef, { type: "outcome.observed", payload: { kind, ...opts.ref ? { ref: opts.ref } : {}, observer: opts.observer ?? "cli" } }, opts.idempotencyKey ?? randomUUID2());
+}
+async function fetchRecord(sessionRef, body, idempotencyKey) {
+  const result = await api("POST", `/sessions/${encodeURIComponent(sessionRef)}/record`, body, { idempotencyKey });
+  return { event: result.event, created: true };
+}
 
 // src/workspace.ts
 import { createInterface as createInterface4 } from "readline";
@@ -4269,12 +4671,45 @@ function confirmPrompt(question) {
   });
 }
 
+// src/browser-profiles.ts
+async function listBrowserProfiles() {
+  const { data } = await api("GET", "/browser_profiles");
+  return data;
+}
+async function getBrowserProfile(scope) {
+  const { profile } = await api("GET", `/browser_profiles/${encodeURIComponent(scope)}`);
+  return profile;
+}
+async function importBrowserProfileState(scope, state) {
+  return api("POST", `/browser_profiles/${encodeURIComponent(scope)}/imports`, state);
+}
+async function listBrowserProfileSites(scope) {
+  const profile = await getBrowserProfile(scope);
+  return profile.sites;
+}
+async function removeBrowserProfileSite(scope, site) {
+  await api("DELETE", `/browser_profiles/${encodeURIComponent(scope)}/sites/${encodeURIComponent(site)}`);
+}
+async function moveBrowserProfileSite(scope, site, to) {
+  return api("POST", `/browser_profiles/${encodeURIComponent(scope)}/sites/${encodeURIComponent(site)}/move`, { to });
+}
+function renderBrowserProfileSite(site) {
+  const who = site.signed_in_by?.email ?? site.signed_in_by?.name ?? "unknown";
+  const used = site.last_used_at ? `used ${site.last_used_at.slice(0, 10)}` : "never used";
+  return `${site.site.padEnd(40)} ${site.status.padEnd(14)} ${who}  ${used}`;
+}
+function renderBrowserProfile(profile) {
+  const lines = [`scope: ${profile.scope}  revision: ${profile.revision}  sites: ${profile.sites.length}`];
+  for (const site of profile.sites) lines.push(`  ${renderBrowserProfileSite(site)}`);
+  return lines.join("\n");
+}
+
 // src/harness.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname7, join as join14, resolve as resolve8 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname8, join as join16, resolve as resolve8 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
-  return join14(resolve8(dir), HARNESS_FILE);
+  return join16(resolve8(dir), HARNESS_FILE);
 }
 function readHarnessFile(dir) {
   const path = harnessFilePath(dir);
@@ -4312,8 +4747,8 @@ function harnessInit(dir) {
   if (existsSync9(path)) {
     throw new Error(`${path} already exists \u2014 delete it to re-init`);
   }
-  mkdirSync4(dirname7(path), { recursive: true });
-  writeFileSync6(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+  mkdirSync5(dirname8(path), { recursive: true });
+  writeFileSync7(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
 `);
   console.log(`Created ${path}`);
   console.log(INIT_COMMENT);
@@ -5018,7 +5453,7 @@ sessionWorkspace.command("cat <ref> <path>").description("print a file (up to 1
   run(async (ref, path, opts) => {
     const bytes = await readFile(await resolveSessionRef(ref), path);
     if (opts.out) {
-      writeFileSync7(opts.out, bytes);
+      writeFileSync8(opts.out, bytes);
       console.error(`saved ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -5035,7 +5470,7 @@ sessionWorkspace.command("patch <ref> [repo]").description("the work in a reposi
     console.error(`${meta.repo}: ${meta.commits.length} commit${meta.commits.length === 1 ? "" : "s"} since ${meta.base_branch || "the imported copy"} (${meta.base_commit.slice(0, 12)})`);
     if (!patch.length) console.error("nothing changed");
     else if (opts.out) {
-      writeFileSync7(opts.out, patch);
+      writeFileSync8(opts.out, patch);
       console.error(`wrote ${opts.out} \u2014 apply with: git apply ${opts.out}`);
     } else process.stdout.write(patch);
   })
@@ -5046,6 +5481,43 @@ sessionWorkspace.command("import <ref> <dir>").description("copy a local folder
     console.log(`${imported.path}  (${imported.files} files)`);
   })
 );
+var sessionBrowser = session.command("browser").description("the sandbox browser for a session (start, show status, stop)");
+sessionBrowser.command("show <ref>").description("show the sandbox browser status for a session").option("--json", "print as JSON").action(
+  run(async (ref, opts) => {
+    const id = await resolveSessionRef(ref);
+    const { browser } = await api("GET", `/sessions/${encodeURIComponent(id)}/browser`);
+    if (opts.json) {
+      console.log(JSON.stringify(browser, null, 2));
+      return;
+    }
+    if (!browser) {
+      console.log("no browser");
+      return;
+    }
+    const b = browser;
+    console.log(`${b.status ?? "unknown"}${b.url ? `  ${b.url}` : ""}${b.entry_url ? `  entry: ${b.entry_url}` : ""}`);
+  })
+);
+sessionBrowser.command("start <ref>").description("start a browser for a session (provisions it if not running)").option("--json", "print as JSON").action(
+  run(async (ref, opts) => {
+    const id = await resolveSessionRef(ref);
+    const { browser } = await api("POST", `/sessions/${encodeURIComponent(id)}/browser`, {});
+    if (opts.json) {
+      console.log(JSON.stringify(browser, null, 2));
+      return;
+    }
+    const b = browser;
+    console.log(`${b.status ?? "starting"}${b.entry_url ? `  entry: ${b.entry_url}` : ""}`);
+  })
+);
+sessionBrowser.command("stop <ref>").description("stop the browser for a session").action(
+  run(async (ref) => {
+    const id = await resolveSessionRef(ref);
+    const { browser } = await api("DELETE", `/sessions/${encodeURIComponent(id)}/browser`);
+    const b = browser;
+    console.log(b ? b.status ?? "stopped" : "stopped");
+  })
+);
 function interactionMode(opts) {
   if (opts.plan && opts.build) throw new ApiError(400, "invalid_request", "pass --plan or --build, not both");
   return opts.plan ? "plan" : opts.build ? "build" : void 0;
@@ -5427,10 +5899,40 @@ Importing ${label} \u2026
   )
 );
 var files = program.command("files").description("files: upload once, reference by id from any message");
-files.command("upload <path>").description("upload a local file; prints the file id to reference from a message").option("--expires <seconds>", "expire the upload after this many seconds (3600\u20137776000)").action(
-  run(async (path, opts) => {
-    const file = await uploadLocalFile(path, opts.expires ? Number(opts.expires) : void 0, uploadProgress);
-    console.log(`${file.id}  ${file.filename}  ${file.mime_type}  ${file.size_bytes} bytes`);
+files.command("upload <paths...>").description("upload local files and folders, up to 50 GiB each; prints each file id to reference from a message").option("--expires <seconds>", "expire the uploads after this many seconds (3600\u20137776000)").action(
+  run(async (paths, opts) => {
+    const expires = opts.expires ? Number(opts.expires) : void 0;
+    const chosen = filesUnder(paths);
+    if (chosen.length === 0) throw new Error("no files to upload");
+    const line = (file) => `${file.id}  ${file.filename}  ${file.mime_type}  ${file.size_bytes} bytes`;
+    if (chosen.length === 1) {
+      console.log(line(await uploadLocalFile(chosen[0], expires, uploadProgress)));
+      return;
+    }
+    let done = 0;
+    const tally = () => process.stderr.write(`${process.stderr.isTTY ? "\r" : ""}uploaded ${++done} / ${chosen.length}${process.stderr.isTTY && done < chosen.length ? "" : "\n"}`);
+    const result = await uploadLocalFiles(chosen, {
+      expiresInSeconds: expires,
+      onUploaded: (_path, file) => {
+        console.log(line(file));
+        tally();
+      },
+      onFailed: (path, error) => {
+        console.error(`sky: ${path}: ${error instanceof Error ? error.message : String(error)}`);
+        tally();
+      }
+    });
+    if (result.failed) {
+      console.error(`sky: ${result.failed} of ${chosen.length} files failed; run the same command for those paths to retry`);
+      process.exitCode = 1;
+    }
+  })
+);
+files.command("usage").description("how many files your workspace holds and the space they take (there is no storage limit)").action(
+  run(async () => {
+    const usage = await api("GET", "/files/usage");
+    const gib = (bytes) => `${(bytes / 1024 ** 3).toFixed(2)} GiB`;
+    console.log(`${usage.file_count} files  ${gib(usage.size_bytes)} used  ${usage.storage_limit_bytes === null ? "no storage limit" : `${gib(usage.storage_limit_bytes)} limit`}  up to ${gib(usage.max_file_bytes)} per file`);
   })
 );
 files.command("list").description("list your uploads, or one session's files with --session").option("--session <ref>", "list the files of this session (its message copies and outputs)").option("--limit <n>", "page size (default 20)").option("--page <cursor>", "continue from a previous page").action(
@@ -5476,7 +5978,7 @@ task.command("get <task> <path>").description("read one task file; prints it, or
   run(async (taskId, path, opts) => {
     const bytes = await readTaskFile(taskId, path);
     if (opts.out) {
-      writeFileSync7(opts.out, bytes);
+      writeFileSync8(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -5493,6 +5995,15 @@ task.command("rm <task> <path>").description("remove a path from the task's file
     console.log(`Removed ${path}`);
   })
 );
+task.command("export <task>").description("write the task's session record as a Harbor task directory: instruction, rubric + judge, files, rollout, and one step per revision").option("-o, --out <dir>", "where to write the directory (default ./harbor-<task>)").option("--tier <tier>", "gold | silver | exploratory (recorded in task.toml)", "silver").option("--redact <name=alias...>", "replace a name everywhere in the export (repeatable)").action(
+  run(async (taskId, opts) => {
+    const tier = opts.tier === "gold" || opts.tier === "exploratory" ? opts.tier : "silver";
+    const outDir = opts.out ?? `./harbor-${taskId.replace(/[^A-Za-z0-9_-]/g, "_")}`;
+    const { written, record } = await exportTaskHarbor(taskId, outDir, { tier, redactNames: parseRedactNames(opts.redact) });
+    console.log(`Wrote ${written.length} files to ${outDir} (${record.threads.length} thread${record.threads.length === 1 ? "" : "s"}, ${record.files.length} task file${record.files.length === 1 ? "" : "s"}${record.goal ? ", goal rubric" : ", no goal: derived rubric"})`);
+    if (!written.includes("environment/Dockerfile")) console.log("environment/: not resettable from the record \u2014 see environment/README.md before running with Harbor");
+  })
+);
 task.command("show <task>").description("the task's sessions and the requests waiting on you (questions, approvals, apps to connect)").option("--json", "print the task as JSON").action(
   run(async (taskId, opts) => {
     const found = await getTask(taskId);
@@ -5511,6 +6022,42 @@ task.command("answer <task> <request>").description("answer an open request; the
     console.log(`Answered ${requestId}`);
   })
 );
+task.command("threads <task>").description("the task's threads from the session record: root first, then every helper, handoff and child with its source, agent, status and spend").option("--json", "print the threads as JSON").action(
+  run(async (taskId, opts) => {
+    const threads = await listThreads(taskId);
+    if (opts.json) {
+      console.log(JSON.stringify({ threads }));
+      return;
+    }
+    for (const thread of threads) console.log(renderThread(thread));
+  })
+);
+task.command("decide <session> <kind>").description("record what you did with a session's result: adopt | rerun | revise | discard | vote | did_the_job | approve").option("--target <session>", "the session the decision names (a vote's winner, the option you adopted)").option("--yes", "the value for did_the_job and approve").option("--no", "the value for did_the_job and approve").option("--reason <text>", "your own words, kept with the decision").option("--key <key>", "an idempotency key, so a repeat records nothing new").action(
+  run(async (sessionId, kind, opts) => {
+    const value = opts.yes ? true : opts.no ? false : void 0;
+    const { event } = await recordDecision(sessionId, kind, { target: opts.target, value, reason: opts.reason, idempotencyKey: opts.key });
+    console.log(`Recorded ${kind} on ${event.sessionId} (${event.id})`);
+  })
+);
+task.command("outcome <session> <kind>").description("record what became of a session's result: pr_merged | deployed | reopened | later_failure | shipped").option("--ref <ref>", "the PR, deployment or task this refers to").option("--key <key>", "an idempotency key, so a repeat records nothing new").action(
+  run(async (sessionId, kind, opts) => {
+    const { event } = await recordOutcome(sessionId, kind, { ref: opts.ref, idempotencyKey: opts.key });
+    console.log(`Recorded ${kind} on ${event.sessionId} (${event.id})`);
+  })
+);
+task.command("dispute <task>").description("dispute an agent fee: tell the platform the task was not completed (allowed within 72 hours of the result)").requiredOption("--reason <text>", "why the task was not completed (up to 1000 characters)").option("--session <id>", "the specific session whose fee you dispute (required when the task has more than one)").action(
+  run(async (taskId, opts) => {
+    const { task: updated } = await api("POST", `/tasks/${encodeURIComponent(taskId)}/agent-fee/dispute`, { reason: opts.reason, ...opts.session ? { session_id: opts.session } : {} });
+    console.log(`Disputed fee on task ${updated.id}`);
+  })
+);
+task.command("verdict <task> <did-the-job>").description("record whether the task did the job: `yes` or `no` (replaces an earlier answer)").action(
+  run(async (taskId, value) => {
+    if (value !== "yes" && value !== "no") throw new Error("value must be yes or no");
+    const { task: updated } = await api("PUT", `/tasks/${encodeURIComponent(taskId)}/completion_answer`, { did_the_job: value === "yes" });
+    console.log(`Recorded verdict on task ${updated.id}: did_the_job=${value === "yes"}`);
+  })
+);
 var skills = program.command("skills").description("the workspace's skill store: upload a skill, then attach it to an agent by id");
 skills.command("upload <dir>").description("upload a skill directory (SKILL.md at its root) as a new skill").option("--name <name>", "display name (default: the directory's name)").option("--json", "print the stored skill as JSON").action(
   run(async (dir, opts) => {
@@ -5532,6 +6079,27 @@ skills.command("list").description("the workspace's stored skills").action(
     for (const skill of list) console.log(`${skill.id}  ${skill.displayName ?? ""}`);
   })
 );
+skills.command("usage").description("view and miss counts per skill name in this workspace").option("--since <iso>", `start date (ISO 8601); default is the last 30 days`).option("--json", "print JSON").action(
+  run(async (opts) => {
+    const summary = await getSkillUsage(opts.since);
+    if (opts.json) {
+      console.log(JSON.stringify(summary, null, 2));
+      return;
+    }
+    if (!summary.skills.length) {
+      console.log("No skill usage recorded in this period.");
+    } else {
+      console.log(`${"NAME".padEnd(32)} ${"VIEWS".padStart(6)} ${"MISSES".padStart(7)}  LAST SEEN`);
+      for (const s of summary.skills) {
+        console.log(`${s.name.padEnd(32)} ${String(s.views).padStart(6)} ${String(s.misses).padStart(7)}  ${s.lastSeen.slice(0, 10)}`);
+      }
+    }
+    if (summary.topMissed.length) {
+      console.log("\nTop missed:");
+      for (const m of summary.topMissed) console.log(`  ${m.name} (${m.misses})`);
+    }
+  })
+);
 async function decideReflection(id, verb) {
   const { reflection_proposal: p } = await api("POST", `/reflection_proposals/${encodeURIComponent(id)}/${verb}`);
   console.log(`${p.id} ${p.status}`);
@@ -5571,7 +6139,7 @@ artifact.command("get <id> <path>").description("read one file of an artifact; p
   run(async (id, path, opts) => {
     const bytes = await readArtifactFile(id, path);
     if (opts.out) {
-      writeFileSync7(opts.out, bytes);
+      writeFileSync8(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -5869,7 +6437,7 @@ usageOptions(
   run(async (opts) => {
     const { bytes } = await apiBytes("GET", `/billing/usage/export${usageQuery(opts)}`);
     if (opts.out) {
-      writeFileSync7(opts.out, bytes);
+      writeFileSync8(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else {
       process.stdout.write(bytes);
@@ -6079,6 +6647,226 @@ connector.command("shared").description("everything you share with workspaces, a
     for (const s of shared) console.log(`${s.connection_id}  ${s.app_name} (${s.label}) \u2192 ${s.workspace.slug}  ${s.use_count} call${s.use_count === 1 ? "" : "s"}`);
   })
 );
+var hookRule = program.command("hook-rule").description("workspace hook rules: run a webhook or block at platform-controlled points");
+hookRule.command("list").description("the workspace's hook rules in evaluation order, or a specific workspace's with --workspace").option("--workspace <slug>", "list the workspace-level hooks for this workspace (PUT/GET /universes/{slug}/hooks)").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const slug = opts.workspace ?? await workspaceSlug();
+    let data;
+    if (opts.workspace) {
+      data = await api("GET", `/universes/${encodeURIComponent(slug)}/hooks`);
+    } else {
+      data = await api("GET", "/hook_rules");
+    }
+    console.log(opts.json ? JSON.stringify(data, null, 2) : JSON.stringify(data, null, 2));
+  })
+);
+hookRule.command("set").description("replace the entire ordered list of workspace-level hook rules (owner only); pass JSON rules on stdin or --rules").option("--workspace <slug>", "act on this workspace's hooks instead of the top-level hook_rules").option("--rules <json>", "JSON array of rule objects (overrides stdin)").action(
+  run(async (opts) => {
+    const raw = opts.rules ?? await new Promise((resolve10) => {
+      const chunks = [];
+      process.stdin.on("data", (d) => chunks.push(d));
+      process.stdin.on("end", () => resolve10(Buffer.concat(chunks).toString()));
+    });
+    const rules = JSON.parse(raw);
+    const slug = opts.workspace ?? await workspaceSlug();
+    let result;
+    if (opts.workspace) {
+      result = await api("PUT", `/universes/${encodeURIComponent(slug)}/hooks`, { hooks: rules });
+    } else {
+      result = await api("PUT", "/hook_rules", { rules });
+    }
+    console.log(JSON.stringify(result, null, 2));
+  })
+);
+var vendorLine = (a) => `${a.id}  ${a.vendor_name.padEnd(18)} ${a.status.padEnd(14)} ${a.label}${a.plan ? ` (${a.plan})` : ""}  used ${a.last_used_at?.slice(0, 10) ?? "never"}`;
+var vendor = program.command("vendor").description("vendor accounts: third-party API keys and agent logins your agents use");
+vendor.command("list").description("your workspace's vendor accounts").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const { external_accounts: list } = await api("GET", "/external_accounts");
+    if (opts.json) {
+      console.log(JSON.stringify(list, null, 2));
+      return;
+    }
+    if (!list.length) console.log("no vendor accounts");
+    for (const a of list) console.log(vendorLine(a));
+  })
+);
+vendor.command("add <vendor>").description("connect a vendor account by pasting its key or settings JSON").option("--label <label>", "a name for this account").option("--credential <value>", "the key or JSON settings (prompts if omitted)").action(
+  run(async (vendorId, opts) => {
+    let credential = opts.credential ?? "";
+    if (!credential) {
+      credential = await new Promise((resolve10) => {
+        const rl = createInterface6({ input: process.stdin, output: process.stderr });
+        rl.question(`${vendorId} credential: `, (a) => {
+          rl.close();
+          resolve10(a.trim());
+        });
+      });
+    }
+    let parsed = credential;
+    try {
+      parsed = JSON.parse(credential);
+    } catch {
+    }
+    const { external_account: created } = await api("POST", "/external_accounts", { vendor: vendorId, label: opts.label, credential: parsed });
+    console.log(vendorLine(created));
+  })
+);
+vendor.command("rm <id>").description("disconnect a vendor account").action(
+  run(async (id) => {
+    await api("DELETE", `/external_accounts/${encodeURIComponent(id)}`);
+    console.log(`Removed ${id}`);
+  })
+);
+vendor.command("usage <id>").description("the agents and tasks that used this vendor account").option("--json", "print as JSON").action(
+  run(async (id, opts) => {
+    const { usage } = await api("GET", `/external_accounts/${encodeURIComponent(id)}/usage`);
+    if (opts.json) {
+      console.log(JSON.stringify(usage, null, 2));
+      return;
+    }
+    console.log(`${usage.agents.length} agent${usage.agents.length === 1 ? "" : "s"}, ${usage.tasks.length} task${usage.tasks.length === 1 ? "" : "s"}`);
+    const agents = usage.agents;
+    for (const a of agents) console.log(`  agent  ${a.id}  ${a.name}`);
+    const tasks = usage.tasks;
+    for (const t of tasks) console.log(`  task   ${t.session_id}  ${t.title ?? "(untitled)"}  ${t.last_used_at.slice(0, 10)}`);
+  })
+);
+var browserProfile = program.command("browser-profile").description("saved-login profiles: the sites your agents stay signed in to");
+browserProfile.command("list").description("your workspace's browser profiles (requires BROWSER_PROFILES to be enabled)").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const profiles = await listBrowserProfiles();
+    if (opts.json) {
+      console.log(JSON.stringify(profiles, null, 2));
+      return;
+    }
+    if (!profiles.length) console.log("no browser profiles");
+    for (const p of profiles) console.log(renderBrowserProfile(p));
+  })
+);
+browserProfile.command("sites <scope>").description("list the sites in a profile: workspace or private").option("--json", "print as JSON").action(
+  run(async (scope, opts) => {
+    const sites = await listBrowserProfileSites(scope);
+    if (opts.json) {
+      console.log(JSON.stringify(sites, null, 2));
+      return;
+    }
+    if (!sites.length) console.log("no sites");
+    console.log(`${"SITE".padEnd(40)} ${"STATUS".padEnd(14)} SIGNED IN BY  LAST USED`);
+    for (const s of sites) console.log(renderBrowserProfileSite(s));
+  })
+);
+browserProfile.command("import <scope>").description("import saved browser state into a profile (workspace or private); reads Playwright storage state JSON from stdin or --file").option("--file <path>", "path to a Playwright storage state JSON file (reads stdin if omitted)").action(
+  run(async (scope, opts) => {
+    let raw;
+    if (opts.file) {
+      const { readFileSync: rf } = await import("fs");
+      raw = rf(opts.file, "utf8");
+    } else {
+      raw = await new Promise((resolve10) => {
+        const chunks = [];
+        process.stdin.on("data", (d) => chunks.push(d));
+        process.stdin.on("end", () => resolve10(Buffer.concat(chunks).toString()));
+      });
+    }
+    const state = JSON.parse(raw);
+    const result = await importBrowserProfileState(scope, { state });
+    console.log(`Imported ${result.sites.length} site${result.sites.length === 1 ? "" : "s"}: ${result.sites.join(", ")}`);
+  })
+);
+browserProfile.command("remove-site <scope> <site>").description("remove a site from a profile (the agent will need to sign in again)").action(
+  run(async (scope, site) => {
+    await removeBrowserProfileSite(scope, site);
+    console.log(`Removed ${site} from ${scope}`);
+  })
+);
+browserProfile.command("move-site <scope> <site> <to>").description("move a site between profiles: <scope> is the current one, <to> is workspace or private").action(
+  run(async (scope, site, to) => {
+    if (to !== "workspace" && to !== "private") throw new ApiError(400, "invalid_request", "to must be workspace or private");
+    const result = await moveBrowserProfileSite(scope, site, to);
+    console.log(`Moved ${site} from ${scope} to ${result.to}`);
+  })
+);
+var notifications = program.command("notifications").description("email and browser push notification preferences for tasks");
+notifications.command("get").description("show the current notification preferences").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const { notification_preferences: prefs } = await api("GET", "/notification-preferences");
+    if (opts.json) {
+      console.log(JSON.stringify(prefs, null, 2));
+      return;
+    }
+    console.log(`email:  needs_you=${prefs.email.needs_you}  done=${prefs.email.done}`);
+    console.log(`push:   needs_you=${prefs.push.needs_you}  done=${prefs.push.done}`);
+  })
+);
+notifications.command("set").description("update notification preferences (pass at least one flag)").option("--email-needs-you <bool>", "email when the task needs your input: true or false").option("--email-done <bool>", "email when the task finishes: true or false").option("--push-needs-you <bool>", "push notification when the task needs your input: true or false").option("--push-done <bool>", "push notification when the task finishes: true or false").action(
+  run(async (opts) => {
+    const parseBool = (v) => v === void 0 ? void 0 : v === "true" ? true : v === "false" ? false : (() => {
+      throw new ApiError(400, "invalid_request", "value must be true or false");
+    })();
+    const email = {};
+    const push = {};
+    const ny_e = parseBool(opts.emailNeedsYou);
+    if (ny_e !== void 0) email.needs_you = ny_e;
+    const d_e = parseBool(opts.emailDone);
+    if (d_e !== void 0) email.done = d_e;
+    const ny_p = parseBool(opts.pushNeedsYou);
+    if (ny_p !== void 0) push.needs_you = ny_p;
+    const d_p = parseBool(opts.pushDone);
+    if (d_p !== void 0) push.done = d_p;
+    if (!Object.keys(email).length && !Object.keys(push).length) throw new ApiError(400, "invalid_request", "pass at least one --email-* or --push-* flag");
+    const { notification_preferences: prefs } = await api("PATCH", "/notification-preferences", {
+      ...Object.keys(email).length ? { email } : {},
+      ...Object.keys(push).length ? { push } : {}
+    });
+    console.log(`email:  needs_you=${prefs.email.needs_you}  done=${prefs.email.done}`);
+    console.log(`push:   needs_you=${prefs.push.needs_you}  done=${prefs.push.done}`);
+  })
+);
+var helpBase = () => agentUseBase().replace(/\/$/, "");
+async function helpFetch(path) {
+  const res = await fetch(`${helpBase()}${path}`, { headers: { "user-agent": USER_AGENT } });
+  if (!res.ok) {
+    let msg = `${res.status} ${res.statusText}`;
+    try {
+      const b = await res.json();
+      if (b.error) msg = b.error;
+    } catch {
+    }
+    throw new ApiError(res.status, "http_error", msg);
+  }
+  return await res.json();
+}
+var help = program.command("help").description("search the AgentSky help center");
+help.command("search <query...>").description("search help articles by keyword").option("--top <n>", "how many results (1\u201320, default 5)", "5").option("--json", "print as JSON").action(
+  run(async (words, opts) => {
+    const q = words.join(" ");
+    const topK = Math.min(Math.max(parseInt(opts.top, 10) || 5, 1), 20);
+    const { results } = await helpFetch(`/api/help/search?q=${encodeURIComponent(q)}&top_k=${topK}`);
+    if (opts.json) {
+      console.log(JSON.stringify(results, null, 2));
+      return;
+    }
+    if (!results.length) {
+      console.log("no results");
+      return;
+    }
+    for (const r of results) console.log(`${r.slug.padEnd(40)} [${r.category}] ${r.title}
+  ${r.snippet.slice(0, 100)}`);
+  })
+);
+help.command("get <slug>").description("read a help article by its slug").option("--json", "print as JSON").action(
+  run(async (slug, opts) => {
+    const article = await helpFetch(`/api/help/${encodeURIComponent(slug)}`);
+    if (opts.json) {
+      console.log(JSON.stringify(article, null, 2));
+      return;
+    }
+    console.log(`# ${article.title}
+`);
+    console.log(article.body);
+  })
+);
 var vault = program.command("vault").description("vaults: credentials a session is granted when it starts (values write-only)");
 vault.command("list").description("the workspace's vaults").action(
   run(async () => {
@@ -6168,7 +6956,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-H3AP64UZ.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-VZX6UIOF.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -6203,7 +6991,7 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-H3AP64UZ.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-VZX6UIOF.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -6216,14 +7004,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-H3AP64UZ.js");
+  const { readState, flush, grantSender } = await import("./trace-VZX6UIOF.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-H3AP64UZ.js");
+  const { readState, spoolStatus } = await import("./trace-VZX6UIOF.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -6233,7 +7021,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-H3AP64UZ.js");
+  const { readState } = await import("./trace-VZX6UIOF.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -6260,7 +7048,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-H3AP64UZ.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-VZX6UIOF.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -6270,7 +7058,7 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
 traceCmd.command("sync [payload]").description("upload this machine's Claude Code and Codex sessions to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-LGPKAQTY.js");
+  const lib = await import("./trace-library-EBH2GYDA.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -6318,10 +7106,10 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       console.log(`A repository's .agentsky.json "workspace" wins over these rules.`);
     }
     if (opts.installSchedule) {
-      const { join: join15 } = await import("path");
+      const { join: join17 } = await import("path");
       const { homedir: homedir8 } = await import("os");
       const { execFileSync } = await import("child_process");
-      const log = join15(homedir8(), ".config", "sky", "trace-sync.log");
+      const log = join17(homedir8(), ".config", "sky", "trace-sync.log");
       const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
       try {
         execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
@@ -6332,10 +7120,10 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
     }
     if (opts.status) {
       const { readFileSync: readFileSync16 } = await import("fs");
-      const { join: join15 } = await import("path");
+      const { join: join17 } = await import("path");
       let state = { sessions: {} };
       try {
-        state = JSON.parse(readFileSync16(join15(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+        state = JSON.parse(readFileSync16(join17(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
       } catch {
       }
       const counts = /* @__PURE__ */ new Map();
@@ -6368,7 +7156,7 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
   })();
 });
 traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
-  const { libraryRequest } = await import("./trace-library-LGPKAQTY.js");
+  const { libraryRequest } = await import("./trace-library-EBH2GYDA.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
@@ -6385,7 +7173,7 @@ traceCmd.command("search <query...>").description("search every session in a wor
   if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-LGPKAQTY.js");
+  const { libraryRequest } = await import("./trace-library-EBH2GYDA.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);