@agentsky/sky 2.18.0 → 2.19.0

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   resolveSessionRef,
   streamEvents,
   uploadFile
-} from "./chunk-PL5KNPCX.js";
+} from "./chunk-4MVWXHZY.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -20,7 +20,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-MUHFB3LC.js";
+} from "./chunk-MOYCAI4S.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -37,15 +37,16 @@ import {
   modelSubscriptionProviderFor,
   reasoningEffortDocLine,
   redactLine,
+  redactPlainText,
   redactSecretValues,
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-ZJVFWFOY.js";
+} from "./chunk-UJ3D24IG.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
 import { basename as basename8, resolve as resolve9 } from "path";
 import { createInterface as createInterface6 } from "readline";
 import { Command } from "commander";
@@ -4101,6 +4102,355 @@ function renderRequest(request) {
   return `${request.id}  ${request.kind}  from ${request.session_id}
     ${request.question}${options}`;
 }
+async function getSkillUsage(since) {
+  const qs = since ? `?since=${encodeURIComponent(since)}` : "";
+  return api("GET", `/skills/usage${qs}`);
+}
+
+// src/task-export.ts
+import { createHash as createHash6 } from "crypto";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname7, join as join15 } from "path";
+import { stringify as stringifyToml2 } from "smol-toml";
+var TEXT_MAX = 2e4;
+function scrub(text, names2) {
+  let out = redactPlainText(text).text;
+  for (const { name, alias } of names2) {
+    if (!name) continue;
+    out = out.split(name).join(alias);
+  }
+  return out.length > TEXT_MAX ? `${out.slice(0, TEXT_MAX)}
+\u2026[cut]` : out;
+}
+function textOf2(event) {
+  if (typeof event.text === "string" && event.text.trim()) return event.text;
+  if (Array.isArray(event.content)) {
+    return event.content.map((block) => block.type === "text" && typeof block.text === "string" ? block.text : "").filter(Boolean).join("\n");
+  }
+  return "";
+}
+function firstAsk(record) {
+  const root = record.threads.find((thread) => thread.relation === "primary") ?? record.threads[0];
+  if (!root) return null;
+  for (const event of record.events[root.id] ?? []) {
+    if (event.type === "user.message") {
+      const text = textOf2(event).trim();
+      if (text) return text;
+    }
+  }
+  return null;
+}
+function decisionsOf(record) {
+  const out = [];
+  for (const thread of record.threads) {
+    for (const event of record.events[thread.id] ?? []) {
+      if (event.type === "human.decision" || event.type === "outcome.observed") out.push({ ...event, thread_id: thread.id });
+    }
+  }
+  return out.sort((a, b) => (a.at ?? "").localeCompare(b.at ?? ""));
+}
+function adoptedSession(record) {
+  const decisions = decisionsOf(record).filter((event) => event.type === "human.decision");
+  for (const event of [...decisions].reverse()) {
+    if (event.kind === "adopt") return event.target_session_id ?? event.thread_id;
+    if (event.kind === "vote" && event.target_session_id) return event.target_session_id;
+  }
+  return null;
+}
+function stepsOf(record, names2) {
+  const root = record.threads.find((thread) => thread.relation === "primary") ?? record.threads[0];
+  if (!root) return [];
+  const events = record.events[root.id] ?? [];
+  const steps = [];
+  events.forEach((event, index) => {
+    if (event.type !== "human.decision" || event.kind !== "revise" && event.kind !== "rerun") return;
+    const next = events.slice(index + 1).find((later) => later.type === "user.message" && textOf2(later).trim());
+    const words = next ? textOf2(next) : event.reason ?? "";
+    if (!words.trim()) return;
+    steps.push({ at: event.at ?? "", instruction: scrub(words, names2) });
+  });
+  return steps;
+}
+function rubricOf(record, instruction, names2) {
+  if (record.goal && record.goal.criteria.length) {
+    const verdicts = new Map((record.goal.last_evaluation?.criteria ?? []).map((row) => [row.id, row.verdict]));
+    return {
+      version: 1,
+      source: "goal",
+      criteria: record.goal.criteria.map((criterion) => ({
+        id: criterion.id,
+        text: scrub(criterion.text, names2),
+        must: true,
+        source: `goal criterion ${criterion.id}`,
+        ...criterion.command ? { command: criterion.command } : {},
+        ...verdicts.has(criterion.id) ? { last_verdict: verdicts.get(criterion.id) } : {}
+      }))
+    };
+  }
+  return {
+    version: 1,
+    source: "instruction",
+    criteria: [{ id: "c1", text: `The deliverable does what the instruction asks: ${instruction.split("\n")[0]?.slice(0, 300) ?? ""}`, must: true, source: "derived from the instruction; no goal was set" }]
+  };
+}
+var JUDGE_PY = String.raw`#!/usr/bin/env python3
+"""Harbor verifier: grade the agent's output against tests/rubric.json with an LLM judge.
+
+Reads every file under /workspace/outputs (falling back to /workspace) and asks the judge
+model, criterion by criterion, for a yes/no with quoted evidence. Writes
+/logs/verifier/reward.json ({"reward": 0|1, "criteria": [...]}) and reward.txt.
+Model and key come from the environment (JUDGE_MODEL, JUDGE_API_KEY, JUDGE_BASE_URL);
+nothing secret is in this file. Reward is 1 only when every MUST criterion passes.
+"""
+import json, os, pathlib, sys, urllib.request
+
+HERE = pathlib.Path(__file__).resolve().parent
+RUBRIC = json.loads((HERE / "rubric.json").read_text())
+OUT_DIR = pathlib.Path(os.environ.get("HARBOR_OUTPUTS", "/workspace/outputs"))
+if not OUT_DIR.exists():
+    OUT_DIR = pathlib.Path("/workspace")
+LOGS = pathlib.Path(os.environ.get("HARBOR_VERIFIER_LOGS", "/logs/verifier"))
+LOGS.mkdir(parents=True, exist_ok=True)
+
+def collect(limit=200_000):
+    parts, size = [], 0
+    for path in sorted(p for p in OUT_DIR.rglob("*") if p.is_file()):
+        if any(s in path.parts for s in (".git", "node_modules", "__pycache__")):
+            continue
+        try:
+            text = path.read_text(errors="replace")
+        except OSError:
+            continue
+        chunk = f"\n===== {path.relative_to(OUT_DIR)} =====\n{text}"
+        if size + len(chunk) > limit:
+            break
+        parts.append(chunk); size += len(chunk)
+    return "".join(parts)
+
+def ask(prompt):
+    base = os.environ.get("JUDGE_BASE_URL", "https://api.openai.com/v1").rstrip("/")
+    body = json.dumps({"model": os.environ.get("JUDGE_MODEL", "gpt-5.5"), "temperature": 0,
+                       "messages": [{"role": "user", "content": prompt}]}).encode()
+    req = urllib.request.Request(f"{base}/chat/completions", data=body, headers={
+        "content-type": "application/json", "authorization": f"Bearer {os.environ['JUDGE_API_KEY']}"})
+    with urllib.request.urlopen(req, timeout=120) as res:
+        return json.load(res)["choices"][0]["message"]["content"]
+
+def grade(criterion, evidence):
+    prompt = (
+        "You grade one requirement of a task against the agent's output.\n"
+        f"Requirement: {criterion['text']}\n"
+        "Answer as JSON only: {\"pass\": true|false, \"evidence\": \"<quote from the output, or why it is missing>\"}.\n"
+        "Pass only when the output itself shows the requirement met.\n\nOUTPUT:\n" + evidence)
+    raw = ask(prompt).strip()
+    start, end = raw.find("{"), raw.rfind("}")
+    verdict = json.loads(raw[start:end + 1]) if start >= 0 else {"pass": False, "evidence": raw[:300]}
+    return {"id": criterion["id"], "must": criterion.get("must", True), "pass": bool(verdict.get("pass")), "evidence": str(verdict.get("evidence", ""))[:1000]}
+
+def main():
+    evidence = collect()
+    results = [grade(c, evidence) for c in RUBRIC["criteria"]]
+    reward = 1 if results and all(r["pass"] for r in results if r["must"]) else 0
+    (LOGS / "reward.json").write_text(json.dumps({"reward": reward, "criteria": results}, indent=2))
+    (LOGS / "reward.txt").write_text(f"{reward}\n")
+    print(json.dumps({"reward": reward, "passed": sum(r["pass"] for r in results), "total": len(results)}))
+    return 0
+
+if __name__ == "__main__":
+    sys.exit(main())
+`;
+var TEST_SH = `#!/usr/bin/env bash
+# Harbor verifier entry point: the judge reads tests/rubric.json and writes /logs/verifier/reward.json.
+set -euo pipefail
+cd "$(dirname "$0")"
+exec python3 judge.py
+`;
+var SOLVE_SH = `#!/usr/bin/env bash
+# Reference solution: the files the task's sessions produced, as the person left them.
+set -euo pipefail
+cd "$(dirname "$0")"
+mkdir -p /workspace/outputs
+if [ -d files ]; then cp -R files/. /workspace/outputs/; fi
+`;
+function buildHarborTask(record, opts) {
+  const names2 = opts.redactNames;
+  const out = /* @__PURE__ */ new Map();
+  const ask2 = record.goal?.objective ?? firstAsk(record) ?? record.title ?? "Complete the task described by the workspace.";
+  const instruction = scrub(ask2, names2);
+  const root = record.threads.find((thread) => thread.relation === "primary") ?? record.threads[0];
+  const harnesses = [...new Set(record.threads.map((thread) => thread.agent.harness))];
+  const decisions = decisionsOf(record);
+  const adopted = adoptedSession(record);
+  const steps = stepsOf(record, names2);
+  const idHash = createHash6("sha256").update(record.task_id).digest("hex").slice(0, 16);
+  out.set("instruction.md", `${instruction.trim()}
+
+Write your deliverables under /workspace/outputs.
+`);
+  out.set(
+    "task.toml",
+    stringifyToml2({
+      metadata: {
+        name: `agentsky-${idHash}`,
+        tier: opts.tier,
+        source: "agentsky-session-record",
+        source_task: idHash,
+        exported_at: record.exported_at,
+        harnesses,
+        has_goal: Boolean(record.goal),
+        decisions: decisions.length,
+        steps: steps.length,
+        adopted_session: adopted ?? "",
+        did_the_job: record.completion_answer?.did_the_job ?? "unknown"
+      },
+      verifier: { kind: "rubric_judge", rubric: "tests/rubric.json", reward: "/logs/verifier/reward.json" }
+    })
+  );
+  const env = record.environment ?? root?.environment ?? null;
+  if (env && typeof env.repo === "string" && typeof env.commit === "string") {
+    out.set(
+      "environment/Dockerfile",
+      `FROM node:22-bookworm
+RUN apt-get update && apt-get install -y --no-install-recommends git python3 && rm -rf /var/lib/apt/lists/*
+WORKDIR /workspace
+RUN git clone ${env.repo} repo && cd repo && git checkout ${env.commit}
+`
+    );
+  } else {
+    out.set(
+      "environment/README.md",
+      "This task is a real execution, not a resettable environment: the record carries no repository and commit to rebuild from.\nAuthor environment/Dockerfile by hand from solution/files (the task's own files at export) before running it with Harbor, or keep it as trajectory data.\n"
+    );
+  }
+  const rubric = rubricOf(record, instruction, names2);
+  out.set("tests/rubric.json", `${JSON.stringify(rubric, null, 2)}
+`);
+  out.set("tests/judge.py", JUDGE_PY);
+  out.set("tests/test.sh", TEST_SH);
+  out.set("solution/solve.sh", SOLVE_SH);
+  out.set(
+    "solution/deliverables.json",
+    `${JSON.stringify({ files: record.files.map((file) => ({ path: file.path, bytes: file.size_bytes ?? null })), adopted_session: adopted }, null, 2)}
+`
+  );
+  for (const [path, bytes] of opts.fileBytes ?? []) out.set(`solution/files/${path}`, bytes);
+  const scrubbedEvents = {};
+  for (const [threadId, events] of Object.entries(record.events)) {
+    scrubbedEvents[threadId] = events.map((event) => ({
+      ...event,
+      ...typeof event.text === "string" ? { text: scrub(event.text, names2) } : {},
+      ...Array.isArray(event.content) ? { content: event.content.map((block) => typeof block.text === "string" ? { ...block, text: scrub(block.text, names2) } : block) } : {},
+      ...typeof event.reason === "string" ? { reason: scrub(event.reason, names2) } : {},
+      ..."parts" in event ? { parts: void 0 } : {}
+    }));
+  }
+  out.set("rollout/record.json", `${JSON.stringify({ ...record, title: record.title ? scrub(record.title, names2) : null, events: scrubbedEvents, goal: record.goal ? { ...record.goal, objective: scrub(record.goal.objective, names2) } : null }, null, 2)}
+`);
+  out.set("rollout/decisions.json", `${JSON.stringify(decisions.map((event) => ({ ...event, reason: typeof event.reason === "string" ? scrub(event.reason, names2) : event.reason })), null, 2)}
+`);
+  steps.forEach((step, index) => {
+    out.set(`steps/step-${index + 1}/instruction.md`, `${step.instruction.trim()}
+`);
+  });
+  return out;
+}
+async function pagedEvents(sessionId) {
+  const events = [];
+  let cursor = null;
+  for (; ; ) {
+    const query = new URLSearchParams({ limit: "500" });
+    if (cursor) query.set("cursor", cursor);
+    const page = await api("GET", `/sessions/${encodeURIComponent(sessionId)}/events?${query}`);
+    events.push(...page.events);
+    if (!page.hasMore || !page.cursor) return events;
+    cursor = page.cursor;
+  }
+}
+async function fetchTaskRecord(taskRef) {
+  const { task: task2 } = await api("GET", `/tasks/${encodeURIComponent(taskRef)}`);
+  const { threads } = await api("GET", `/sessions/${encodeURIComponent(task2.id)}/threads`);
+  const events = {};
+  for (const thread of threads) events[thread.id] = await pagedEvents(thread.id);
+  let goal2 = null;
+  try {
+    goal2 = (await api("GET", `/sessions/${encodeURIComponent(task2.id)}/goal`)).goal;
+  } catch (error) {
+    if (!(error instanceof ApiError && error.status === 404)) throw error;
+  }
+  let files2 = [];
+  try {
+    files2 = await listTaskFiles(task2.id);
+  } catch (error) {
+    if (!(error instanceof ApiError && (error.status === 404 || error.status === 503))) throw error;
+  }
+  const root = threads.find((thread) => thread.relation === "primary") ?? threads[0];
+  return { task_id: task2.id, exported_at: (/* @__PURE__ */ new Date()).toISOString(), title: task2.title ?? null, threads, events, goal: goal2, files: files2, completion_answer: task2.completion_answer ?? null, environment: root?.environment ?? null };
+}
+var FILE_BYTES_MAX = 50 * 1024 * 1024;
+async function exportTaskHarbor(taskRef, outDir, opts) {
+  const record = await fetchTaskRecord(taskRef);
+  const fileBytes = /* @__PURE__ */ new Map();
+  let total = 0;
+  for (const file of record.files) {
+    if (total + (file.size_bytes ?? 0) > FILE_BYTES_MAX) break;
+    const bytes = await readTaskFile(record.task_id, file.path);
+    total += bytes.byteLength;
+    fileBytes.set(file.path, bytes);
+  }
+  const files2 = buildHarborTask(record, { ...opts, fileBytes });
+  const written = [];
+  for (const [path, content] of files2) {
+    const target = join15(outDir, path);
+    mkdirSync4(dirname7(target), { recursive: true });
+    writeFileSync6(target, content, typeof content === "string" ? { mode: path.endsWith(".sh") || path.endsWith(".py") ? 493 : 420 } : void 0);
+    written.push(path);
+  }
+  return { written, record };
+}
+function parseRedactNames(values) {
+  return (values ?? []).map((value) => {
+    const index = value.indexOf("=");
+    if (index < 0) return { name: value.trim(), alias: "[redacted]" };
+    return { name: value.slice(0, index).trim(), alias: value.slice(index + 1).trim() || "[redacted]" };
+  }).filter((pair) => pair.name);
+}
+
+// src/task-record.ts
+import { randomUUID as randomUUID2 } from "crypto";
+var DECISION_KINDS = ["adopt", "rerun", "revise", "discard", "vote", "did_the_job", "approve"];
+async function listThreads(taskRef) {
+  return (await api("GET", `/sessions/${encodeURIComponent(taskRef)}/threads`)).threads;
+}
+function renderThread(thread) {
+  const spend = (Number(thread.usage.spent_usd_micros) / 1e6).toFixed(4);
+  const env = thread.environment?.repo ? `  ${thread.environment.repo}${thread.environment.commit ? `@${thread.environment.commit.slice(0, 7)}` : ""}` : "";
+  return `${thread.id}  ${thread.relation.padEnd(7)}  ${thread.source.padEnd(12)}  ${thread.agent.harness}/${thread.agent.model}  ${thread.status}  $${spend}${env}`;
+}
+async function recordDecision(sessionRef, kind, opts = {}) {
+  if (!DECISION_KINDS.includes(kind)) throw new Error(`kind must be one of ${DECISION_KINDS.join(", ")}`);
+  if ((kind === "did_the_job" || kind === "approve") && typeof opts.value !== "boolean") throw new Error(`${kind} needs --yes or --no`);
+  const key = opts.idempotencyKey ?? randomUUID2();
+  const res = await fetchRecord(sessionRef, {
+    type: "human.decision",
+    payload: {
+      kind,
+      ...opts.target ? { target_session_id: opts.target } : {},
+      ...typeof opts.value === "boolean" ? { value: opts.value } : {},
+      ...opts.reason ? { reason: opts.reason } : {},
+      surface: opts.surface ?? "cli"
+    }
+  }, key);
+  return res;
+}
+var OUTCOME_KINDS = ["pr_merged", "deployed", "reopened", "later_failure", "shipped"];
+async function recordOutcome(sessionRef, kind, opts = {}) {
+  if (!OUTCOME_KINDS.includes(kind)) throw new Error(`kind must be one of ${OUTCOME_KINDS.join(", ")}`);
+  return fetchRecord(sessionRef, { type: "outcome.observed", payload: { kind, ...opts.ref ? { ref: opts.ref } : {}, observer: opts.observer ?? "cli" } }, opts.idempotencyKey ?? randomUUID2());
+}
+async function fetchRecord(sessionRef, body, idempotencyKey) {
+  const result = await api("POST", `/sessions/${encodeURIComponent(sessionRef)}/record`, body, { idempotencyKey });
+  return { event: result.event, created: true };
+}
 
 // src/workspace.ts
 import { createInterface as createInterface4 } from "readline";
@@ -4321,12 +4671,45 @@ function confirmPrompt(question) {
   });
 }
 
+// src/browser-profiles.ts
+async function listBrowserProfiles() {
+  const { data } = await api("GET", "/browser_profiles");
+  return data;
+}
+async function getBrowserProfile(scope) {
+  const { profile } = await api("GET", `/browser_profiles/${encodeURIComponent(scope)}`);
+  return profile;
+}
+async function importBrowserProfileState(scope, state) {
+  return api("POST", `/browser_profiles/${encodeURIComponent(scope)}/imports`, state);
+}
+async function listBrowserProfileSites(scope) {
+  const profile = await getBrowserProfile(scope);
+  return profile.sites;
+}
+async function removeBrowserProfileSite(scope, site) {
+  await api("DELETE", `/browser_profiles/${encodeURIComponent(scope)}/sites/${encodeURIComponent(site)}`);
+}
+async function moveBrowserProfileSite(scope, site, to) {
+  return api("POST", `/browser_profiles/${encodeURIComponent(scope)}/sites/${encodeURIComponent(site)}/move`, { to });
+}
+function renderBrowserProfileSite(site) {
+  const who = site.signed_in_by?.email ?? site.signed_in_by?.name ?? "unknown";
+  const used = site.last_used_at ? `used ${site.last_used_at.slice(0, 10)}` : "never used";
+  return `${site.site.padEnd(40)} ${site.status.padEnd(14)} ${who}  ${used}`;
+}
+function renderBrowserProfile(profile) {
+  const lines = [`scope: ${profile.scope}  revision: ${profile.revision}  sites: ${profile.sites.length}`];
+  for (const site of profile.sites) lines.push(`  ${renderBrowserProfileSite(site)}`);
+  return lines.join("\n");
+}
+
 // src/harness.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname7, join as join15, resolve as resolve8 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname8, join as join16, resolve as resolve8 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
-  return join15(resolve8(dir), HARNESS_FILE);
+  return join16(resolve8(dir), HARNESS_FILE);
 }
 function readHarnessFile(dir) {
   const path = harnessFilePath(dir);
@@ -4364,8 +4747,8 @@ function harnessInit(dir) {
   if (existsSync9(path)) {
     throw new Error(`${path} already exists \u2014 delete it to re-init`);
   }
-  mkdirSync4(dirname7(path), { recursive: true });
-  writeFileSync6(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+  mkdirSync5(dirname8(path), { recursive: true });
+  writeFileSync7(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
 `);
   console.log(`Created ${path}`);
   console.log(INIT_COMMENT);
@@ -5070,7 +5453,7 @@ sessionWorkspace.command("cat <ref> <path>").description("print a file (up to 1
   run(async (ref, path, opts) => {
     const bytes = await readFile(await resolveSessionRef(ref), path);
     if (opts.out) {
-      writeFileSync7(opts.out, bytes);
+      writeFileSync8(opts.out, bytes);
       console.error(`saved ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -5087,7 +5470,7 @@ sessionWorkspace.command("patch <ref> [repo]").description("the work in a reposi
     console.error(`${meta.repo}: ${meta.commits.length} commit${meta.commits.length === 1 ? "" : "s"} since ${meta.base_branch || "the imported copy"} (${meta.base_commit.slice(0, 12)})`);
     if (!patch.length) console.error("nothing changed");
     else if (opts.out) {
-      writeFileSync7(opts.out, patch);
+      writeFileSync8(opts.out, patch);
       console.error(`wrote ${opts.out} \u2014 apply with: git apply ${opts.out}`);
     } else process.stdout.write(patch);
   })
@@ -5098,6 +5481,43 @@ sessionWorkspace.command("import <ref> <dir>").description("copy a local folder
     console.log(`${imported.path}  (${imported.files} files)`);
   })
 );
+var sessionBrowser = session.command("browser").description("the sandbox browser for a session (start, show status, stop)");
+sessionBrowser.command("show <ref>").description("show the sandbox browser status for a session").option("--json", "print as JSON").action(
+  run(async (ref, opts) => {
+    const id = await resolveSessionRef(ref);
+    const { browser } = await api("GET", `/sessions/${encodeURIComponent(id)}/browser`);
+    if (opts.json) {
+      console.log(JSON.stringify(browser, null, 2));
+      return;
+    }
+    if (!browser) {
+      console.log("no browser");
+      return;
+    }
+    const b = browser;
+    console.log(`${b.status ?? "unknown"}${b.url ? `  ${b.url}` : ""}${b.entry_url ? `  entry: ${b.entry_url}` : ""}`);
+  })
+);
+sessionBrowser.command("start <ref>").description("start a browser for a session (provisions it if not running)").option("--json", "print as JSON").action(
+  run(async (ref, opts) => {
+    const id = await resolveSessionRef(ref);
+    const { browser } = await api("POST", `/sessions/${encodeURIComponent(id)}/browser`, {});
+    if (opts.json) {
+      console.log(JSON.stringify(browser, null, 2));
+      return;
+    }
+    const b = browser;
+    console.log(`${b.status ?? "starting"}${b.entry_url ? `  entry: ${b.entry_url}` : ""}`);
+  })
+);
+sessionBrowser.command("stop <ref>").description("stop the browser for a session").action(
+  run(async (ref) => {
+    const id = await resolveSessionRef(ref);
+    const { browser } = await api("DELETE", `/sessions/${encodeURIComponent(id)}/browser`);
+    const b = browser;
+    console.log(b ? b.status ?? "stopped" : "stopped");
+  })
+);
 function interactionMode(opts) {
   if (opts.plan && opts.build) throw new ApiError(400, "invalid_request", "pass --plan or --build, not both");
   return opts.plan ? "plan" : opts.build ? "build" : void 0;
@@ -5558,7 +5978,7 @@ task.command("get <task> <path>").description("read one task file; prints it, or
   run(async (taskId, path, opts) => {
     const bytes = await readTaskFile(taskId, path);
     if (opts.out) {
-      writeFileSync7(opts.out, bytes);
+      writeFileSync8(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -5575,6 +5995,15 @@ task.command("rm <task> <path>").description("remove a path from the task's file
     console.log(`Removed ${path}`);
   })
 );
+task.command("export <task>").description("write the task's session record as a Harbor task directory: instruction, rubric + judge, files, rollout, and one step per revision").option("-o, --out <dir>", "where to write the directory (default ./harbor-<task>)").option("--tier <tier>", "gold | silver | exploratory (recorded in task.toml)", "silver").option("--redact <name=alias...>", "replace a name everywhere in the export (repeatable)").action(
+  run(async (taskId, opts) => {
+    const tier = opts.tier === "gold" || opts.tier === "exploratory" ? opts.tier : "silver";
+    const outDir = opts.out ?? `./harbor-${taskId.replace(/[^A-Za-z0-9_-]/g, "_")}`;
+    const { written, record } = await exportTaskHarbor(taskId, outDir, { tier, redactNames: parseRedactNames(opts.redact) });
+    console.log(`Wrote ${written.length} files to ${outDir} (${record.threads.length} thread${record.threads.length === 1 ? "" : "s"}, ${record.files.length} task file${record.files.length === 1 ? "" : "s"}${record.goal ? ", goal rubric" : ", no goal: derived rubric"})`);
+    if (!written.includes("environment/Dockerfile")) console.log("environment/: not resettable from the record \u2014 see environment/README.md before running with Harbor");
+  })
+);
 task.command("show <task>").description("the task's sessions and the requests waiting on you (questions, approvals, apps to connect)").option("--json", "print the task as JSON").action(
   run(async (taskId, opts) => {
     const found = await getTask(taskId);
@@ -5593,6 +6022,42 @@ task.command("answer <task> <request>").description("answer an open request; the
     console.log(`Answered ${requestId}`);
   })
 );
+task.command("threads <task>").description("the task's threads from the session record: root first, then every helper, handoff and child with its source, agent, status and spend").option("--json", "print the threads as JSON").action(
+  run(async (taskId, opts) => {
+    const threads = await listThreads(taskId);
+    if (opts.json) {
+      console.log(JSON.stringify({ threads }));
+      return;
+    }
+    for (const thread of threads) console.log(renderThread(thread));
+  })
+);
+task.command("decide <session> <kind>").description("record what you did with a session's result: adopt | rerun | revise | discard | vote | did_the_job | approve").option("--target <session>", "the session the decision names (a vote's winner, the option you adopted)").option("--yes", "the value for did_the_job and approve").option("--no", "the value for did_the_job and approve").option("--reason <text>", "your own words, kept with the decision").option("--key <key>", "an idempotency key, so a repeat records nothing new").action(
+  run(async (sessionId, kind, opts) => {
+    const value = opts.yes ? true : opts.no ? false : void 0;
+    const { event } = await recordDecision(sessionId, kind, { target: opts.target, value, reason: opts.reason, idempotencyKey: opts.key });
+    console.log(`Recorded ${kind} on ${event.sessionId} (${event.id})`);
+  })
+);
+task.command("outcome <session> <kind>").description("record what became of a session's result: pr_merged | deployed | reopened | later_failure | shipped").option("--ref <ref>", "the PR, deployment or task this refers to").option("--key <key>", "an idempotency key, so a repeat records nothing new").action(
+  run(async (sessionId, kind, opts) => {
+    const { event } = await recordOutcome(sessionId, kind, { ref: opts.ref, idempotencyKey: opts.key });
+    console.log(`Recorded ${kind} on ${event.sessionId} (${event.id})`);
+  })
+);
+task.command("dispute <task>").description("dispute an agent fee: tell the platform the task was not completed (allowed within 72 hours of the result)").requiredOption("--reason <text>", "why the task was not completed (up to 1000 characters)").option("--session <id>", "the specific session whose fee you dispute (required when the task has more than one)").action(
+  run(async (taskId, opts) => {
+    const { task: updated } = await api("POST", `/tasks/${encodeURIComponent(taskId)}/agent-fee/dispute`, { reason: opts.reason, ...opts.session ? { session_id: opts.session } : {} });
+    console.log(`Disputed fee on task ${updated.id}`);
+  })
+);
+task.command("verdict <task> <did-the-job>").description("record whether the task did the job: `yes` or `no` (replaces an earlier answer)").action(
+  run(async (taskId, value) => {
+    if (value !== "yes" && value !== "no") throw new Error("value must be yes or no");
+    const { task: updated } = await api("PUT", `/tasks/${encodeURIComponent(taskId)}/completion_answer`, { did_the_job: value === "yes" });
+    console.log(`Recorded verdict on task ${updated.id}: did_the_job=${value === "yes"}`);
+  })
+);
 var skills = program.command("skills").description("the workspace's skill store: upload a skill, then attach it to an agent by id");
 skills.command("upload <dir>").description("upload a skill directory (SKILL.md at its root) as a new skill").option("--name <name>", "display name (default: the directory's name)").option("--json", "print the stored skill as JSON").action(
   run(async (dir, opts) => {
@@ -5614,6 +6079,27 @@ skills.command("list").description("the workspace's stored skills").action(
     for (const skill of list) console.log(`${skill.id}  ${skill.displayName ?? ""}`);
   })
 );
+skills.command("usage").description("view and miss counts per skill name in this workspace").option("--since <iso>", `start date (ISO 8601); default is the last 30 days`).option("--json", "print JSON").action(
+  run(async (opts) => {
+    const summary = await getSkillUsage(opts.since);
+    if (opts.json) {
+      console.log(JSON.stringify(summary, null, 2));
+      return;
+    }
+    if (!summary.skills.length) {
+      console.log("No skill usage recorded in this period.");
+    } else {
+      console.log(`${"NAME".padEnd(32)} ${"VIEWS".padStart(6)} ${"MISSES".padStart(7)}  LAST SEEN`);
+      for (const s of summary.skills) {
+        console.log(`${s.name.padEnd(32)} ${String(s.views).padStart(6)} ${String(s.misses).padStart(7)}  ${s.lastSeen.slice(0, 10)}`);
+      }
+    }
+    if (summary.topMissed.length) {
+      console.log("\nTop missed:");
+      for (const m of summary.topMissed) console.log(`  ${m.name} (${m.misses})`);
+    }
+  })
+);
 async function decideReflection(id, verb) {
   const { reflection_proposal: p } = await api("POST", `/reflection_proposals/${encodeURIComponent(id)}/${verb}`);
   console.log(`${p.id} ${p.status}`);
@@ -5653,7 +6139,7 @@ artifact.command("get <id> <path>").description("read one file of an artifact; p
   run(async (id, path, opts) => {
     const bytes = await readArtifactFile(id, path);
     if (opts.out) {
-      writeFileSync7(opts.out, bytes);
+      writeFileSync8(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -5951,7 +6437,7 @@ usageOptions(
   run(async (opts) => {
     const { bytes } = await apiBytes("GET", `/billing/usage/export${usageQuery(opts)}`);
     if (opts.out) {
-      writeFileSync7(opts.out, bytes);
+      writeFileSync8(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else {
       process.stdout.write(bytes);
@@ -6161,6 +6647,226 @@ connector.command("shared").description("everything you share with workspaces, a
     for (const s of shared) console.log(`${s.connection_id}  ${s.app_name} (${s.label}) \u2192 ${s.workspace.slug}  ${s.use_count} call${s.use_count === 1 ? "" : "s"}`);
   })
 );
+var hookRule = program.command("hook-rule").description("workspace hook rules: run a webhook or block at platform-controlled points");
+hookRule.command("list").description("the workspace's hook rules in evaluation order, or a specific workspace's with --workspace").option("--workspace <slug>", "list the workspace-level hooks for this workspace (PUT/GET /universes/{slug}/hooks)").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const slug = opts.workspace ?? await workspaceSlug();
+    let data;
+    if (opts.workspace) {
+      data = await api("GET", `/universes/${encodeURIComponent(slug)}/hooks`);
+    } else {
+      data = await api("GET", "/hook_rules");
+    }
+    console.log(opts.json ? JSON.stringify(data, null, 2) : JSON.stringify(data, null, 2));
+  })
+);
+hookRule.command("set").description("replace the entire ordered list of workspace-level hook rules (owner only); pass JSON rules on stdin or --rules").option("--workspace <slug>", "act on this workspace's hooks instead of the top-level hook_rules").option("--rules <json>", "JSON array of rule objects (overrides stdin)").action(
+  run(async (opts) => {
+    const raw = opts.rules ?? await new Promise((resolve10) => {
+      const chunks = [];
+      process.stdin.on("data", (d) => chunks.push(d));
+      process.stdin.on("end", () => resolve10(Buffer.concat(chunks).toString()));
+    });
+    const rules = JSON.parse(raw);
+    const slug = opts.workspace ?? await workspaceSlug();
+    let result;
+    if (opts.workspace) {
+      result = await api("PUT", `/universes/${encodeURIComponent(slug)}/hooks`, { hooks: rules });
+    } else {
+      result = await api("PUT", "/hook_rules", { rules });
+    }
+    console.log(JSON.stringify(result, null, 2));
+  })
+);
+var vendorLine = (a) => `${a.id}  ${a.vendor_name.padEnd(18)} ${a.status.padEnd(14)} ${a.label}${a.plan ? ` (${a.plan})` : ""}  used ${a.last_used_at?.slice(0, 10) ?? "never"}`;
+var vendor = program.command("vendor").description("vendor accounts: third-party API keys and agent logins your agents use");
+vendor.command("list").description("your workspace's vendor accounts").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const { external_accounts: list } = await api("GET", "/external_accounts");
+    if (opts.json) {
+      console.log(JSON.stringify(list, null, 2));
+      return;
+    }
+    if (!list.length) console.log("no vendor accounts");
+    for (const a of list) console.log(vendorLine(a));
+  })
+);
+vendor.command("add <vendor>").description("connect a vendor account by pasting its key or settings JSON").option("--label <label>", "a name for this account").option("--credential <value>", "the key or JSON settings (prompts if omitted)").action(
+  run(async (vendorId, opts) => {
+    let credential = opts.credential ?? "";
+    if (!credential) {
+      credential = await new Promise((resolve10) => {
+        const rl = createInterface6({ input: process.stdin, output: process.stderr });
+        rl.question(`${vendorId} credential: `, (a) => {
+          rl.close();
+          resolve10(a.trim());
+        });
+      });
+    }
+    let parsed = credential;
+    try {
+      parsed = JSON.parse(credential);
+    } catch {
+    }
+    const { external_account: created } = await api("POST", "/external_accounts", { vendor: vendorId, label: opts.label, credential: parsed });
+    console.log(vendorLine(created));
+  })
+);
+vendor.command("rm <id>").description("disconnect a vendor account").action(
+  run(async (id) => {
+    await api("DELETE", `/external_accounts/${encodeURIComponent(id)}`);
+    console.log(`Removed ${id}`);
+  })
+);
+vendor.command("usage <id>").description("the agents and tasks that used this vendor account").option("--json", "print as JSON").action(
+  run(async (id, opts) => {
+    const { usage } = await api("GET", `/external_accounts/${encodeURIComponent(id)}/usage`);
+    if (opts.json) {
+      console.log(JSON.stringify(usage, null, 2));
+      return;
+    }
+    console.log(`${usage.agents.length} agent${usage.agents.length === 1 ? "" : "s"}, ${usage.tasks.length} task${usage.tasks.length === 1 ? "" : "s"}`);
+    const agents = usage.agents;
+    for (const a of agents) console.log(`  agent  ${a.id}  ${a.name}`);
+    const tasks = usage.tasks;
+    for (const t of tasks) console.log(`  task   ${t.session_id}  ${t.title ?? "(untitled)"}  ${t.last_used_at.slice(0, 10)}`);
+  })
+);
+var browserProfile = program.command("browser-profile").description("saved-login profiles: the sites your agents stay signed in to");
+browserProfile.command("list").description("your workspace's browser profiles (requires BROWSER_PROFILES to be enabled)").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const profiles = await listBrowserProfiles();
+    if (opts.json) {
+      console.log(JSON.stringify(profiles, null, 2));
+      return;
+    }
+    if (!profiles.length) console.log("no browser profiles");
+    for (const p of profiles) console.log(renderBrowserProfile(p));
+  })
+);
+browserProfile.command("sites <scope>").description("list the sites in a profile: workspace or private").option("--json", "print as JSON").action(
+  run(async (scope, opts) => {
+    const sites = await listBrowserProfileSites(scope);
+    if (opts.json) {
+      console.log(JSON.stringify(sites, null, 2));
+      return;
+    }
+    if (!sites.length) console.log("no sites");
+    console.log(`${"SITE".padEnd(40)} ${"STATUS".padEnd(14)} SIGNED IN BY  LAST USED`);
+    for (const s of sites) console.log(renderBrowserProfileSite(s));
+  })
+);
+browserProfile.command("import <scope>").description("import saved browser state into a profile (workspace or private); reads Playwright storage state JSON from stdin or --file").option("--file <path>", "path to a Playwright storage state JSON file (reads stdin if omitted)").action(
+  run(async (scope, opts) => {
+    let raw;
+    if (opts.file) {
+      const { readFileSync: rf } = await import("fs");
+      raw = rf(opts.file, "utf8");
+    } else {
+      raw = await new Promise((resolve10) => {
+        const chunks = [];
+        process.stdin.on("data", (d) => chunks.push(d));
+        process.stdin.on("end", () => resolve10(Buffer.concat(chunks).toString()));
+      });
+    }
+    const state = JSON.parse(raw);
+    const result = await importBrowserProfileState(scope, { state });
+    console.log(`Imported ${result.sites.length} site${result.sites.length === 1 ? "" : "s"}: ${result.sites.join(", ")}`);
+  })
+);
+browserProfile.command("remove-site <scope> <site>").description("remove a site from a profile (the agent will need to sign in again)").action(
+  run(async (scope, site) => {
+    await removeBrowserProfileSite(scope, site);
+    console.log(`Removed ${site} from ${scope}`);
+  })
+);
+browserProfile.command("move-site <scope> <site> <to>").description("move a site between profiles: <scope> is the current one, <to> is workspace or private").action(
+  run(async (scope, site, to) => {
+    if (to !== "workspace" && to !== "private") throw new ApiError(400, "invalid_request", "to must be workspace or private");
+    const result = await moveBrowserProfileSite(scope, site, to);
+    console.log(`Moved ${site} from ${scope} to ${result.to}`);
+  })
+);
+var notifications = program.command("notifications").description("email and browser push notification preferences for tasks");
+notifications.command("get").description("show the current notification preferences").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const { notification_preferences: prefs } = await api("GET", "/notification-preferences");
+    if (opts.json) {
+      console.log(JSON.stringify(prefs, null, 2));
+      return;
+    }
+    console.log(`email:  needs_you=${prefs.email.needs_you}  done=${prefs.email.done}`);
+    console.log(`push:   needs_you=${prefs.push.needs_you}  done=${prefs.push.done}`);
+  })
+);
+notifications.command("set").description("update notification preferences (pass at least one flag)").option("--email-needs-you <bool>", "email when the task needs your input: true or false").option("--email-done <bool>", "email when the task finishes: true or false").option("--push-needs-you <bool>", "push notification when the task needs your input: true or false").option("--push-done <bool>", "push notification when the task finishes: true or false").action(
+  run(async (opts) => {
+    const parseBool = (v) => v === void 0 ? void 0 : v === "true" ? true : v === "false" ? false : (() => {
+      throw new ApiError(400, "invalid_request", "value must be true or false");
+    })();
+    const email = {};
+    const push = {};
+    const ny_e = parseBool(opts.emailNeedsYou);
+    if (ny_e !== void 0) email.needs_you = ny_e;
+    const d_e = parseBool(opts.emailDone);
+    if (d_e !== void 0) email.done = d_e;
+    const ny_p = parseBool(opts.pushNeedsYou);
+    if (ny_p !== void 0) push.needs_you = ny_p;
+    const d_p = parseBool(opts.pushDone);
+    if (d_p !== void 0) push.done = d_p;
+    if (!Object.keys(email).length && !Object.keys(push).length) throw new ApiError(400, "invalid_request", "pass at least one --email-* or --push-* flag");
+    const { notification_preferences: prefs } = await api("PATCH", "/notification-preferences", {
+      ...Object.keys(email).length ? { email } : {},
+      ...Object.keys(push).length ? { push } : {}
+    });
+    console.log(`email:  needs_you=${prefs.email.needs_you}  done=${prefs.email.done}`);
+    console.log(`push:   needs_you=${prefs.push.needs_you}  done=${prefs.push.done}`);
+  })
+);
+var helpBase = () => agentUseBase().replace(/\/$/, "");
+async function helpFetch(path) {
+  const res = await fetch(`${helpBase()}${path}`, { headers: { "user-agent": USER_AGENT } });
+  if (!res.ok) {
+    let msg = `${res.status} ${res.statusText}`;
+    try {
+      const b = await res.json();
+      if (b.error) msg = b.error;
+    } catch {
+    }
+    throw new ApiError(res.status, "http_error", msg);
+  }
+  return await res.json();
+}
+var help = program.command("help").description("search the AgentSky help center");
+help.command("search <query...>").description("search help articles by keyword").option("--top <n>", "how many results (1\u201320, default 5)", "5").option("--json", "print as JSON").action(
+  run(async (words, opts) => {
+    const q = words.join(" ");
+    const topK = Math.min(Math.max(parseInt(opts.top, 10) || 5, 1), 20);
+    const { results } = await helpFetch(`/api/help/search?q=${encodeURIComponent(q)}&top_k=${topK}`);
+    if (opts.json) {
+      console.log(JSON.stringify(results, null, 2));
+      return;
+    }
+    if (!results.length) {
+      console.log("no results");
+      return;
+    }
+    for (const r of results) console.log(`${r.slug.padEnd(40)} [${r.category}] ${r.title}
+  ${r.snippet.slice(0, 100)}`);
+  })
+);
+help.command("get <slug>").description("read a help article by its slug").option("--json", "print as JSON").action(
+  run(async (slug, opts) => {
+    const article = await helpFetch(`/api/help/${encodeURIComponent(slug)}`);
+    if (opts.json) {
+      console.log(JSON.stringify(article, null, 2));
+      return;
+    }
+    console.log(`# ${article.title}
+`);
+    console.log(article.body);
+  })
+);
 var vault = program.command("vault").description("vaults: credentials a session is granted when it starts (values write-only)");
 vault.command("list").description("the workspace's vaults").action(
   run(async () => {
@@ -6250,7 +6956,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-QLJH7VK6.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-VZX6UIOF.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -6285,7 +6991,7 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-QLJH7VK6.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-VZX6UIOF.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -6298,14 +7004,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-QLJH7VK6.js");
+  const { readState, flush, grantSender } = await import("./trace-VZX6UIOF.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-QLJH7VK6.js");
+  const { readState, spoolStatus } = await import("./trace-VZX6UIOF.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -6315,7 +7021,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-QLJH7VK6.js");
+  const { readState } = await import("./trace-VZX6UIOF.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -6342,7 +7048,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-QLJH7VK6.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-VZX6UIOF.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -6352,7 +7058,7 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
 traceCmd.command("sync [payload]").description("upload this machine's Claude Code and Codex sessions to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-FS5PCBJC.js");
+  const lib = await import("./trace-library-EBH2GYDA.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -6400,10 +7106,10 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       console.log(`A repository's .agentsky.json "workspace" wins over these rules.`);
     }
     if (opts.installSchedule) {
-      const { join: join16 } = await import("path");
+      const { join: join17 } = await import("path");
       const { homedir: homedir8 } = await import("os");
       const { execFileSync } = await import("child_process");
-      const log = join16(homedir8(), ".config", "sky", "trace-sync.log");
+      const log = join17(homedir8(), ".config", "sky", "trace-sync.log");
       const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
       try {
         execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
@@ -6414,10 +7120,10 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
     }
     if (opts.status) {
       const { readFileSync: readFileSync16 } = await import("fs");
-      const { join: join16 } = await import("path");
+      const { join: join17 } = await import("path");
       let state = { sessions: {} };
       try {
-        state = JSON.parse(readFileSync16(join16(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+        state = JSON.parse(readFileSync16(join17(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
       } catch {
       }
       const counts = /* @__PURE__ */ new Map();
@@ -6450,7 +7156,7 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
   })();
 });
 traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
-  const { libraryRequest } = await import("./trace-library-FS5PCBJC.js");
+  const { libraryRequest } = await import("./trace-library-EBH2GYDA.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
@@ -6467,7 +7173,7 @@ traceCmd.command("search <query...>").description("search every session in a wor
   if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-FS5PCBJC.js");
+  const { libraryRequest } = await import("./trace-library-EBH2GYDA.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);