@agentsky/sky 2.20.2 → 2.22.0

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   resolveSessionRef,
   streamEvents,
   uploadFile
-} from "./chunk-WTFBVTMI.js";
+} from "./chunk-EBH3KXSU.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -20,7 +20,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-HB7SPKQ5.js";
+} from "./chunk-XT3W75V3.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -42,12 +42,12 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-GHTAIKQ6.js";
+} from "./chunk-YMYQT6KR.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
-import { basename as basename8, resolve as resolve9 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
+import { basename as basename9, resolve as resolve9 } from "path";
 import { createInterface as createInterface6 } from "readline";
 import { Command } from "commander";
 
@@ -1697,7 +1697,7 @@ async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
   const scratch = mkdtempSync(join6(tmpdir(), "sky-environment-"));
   const path = join6(scratch, "environment.tar.gz");
   const leftOut = [];
-  const written = /* @__PURE__ */ new Set();
+  const written2 = /* @__PURE__ */ new Set();
   const hash = createHash2("sha256");
   let bytes = 0;
   let redacted2 = 0;
@@ -1764,9 +1764,9 @@ async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
         }
         await write(tarPadding(stat.size));
       }
-      written.add(rel);
+      written2.add(rel);
     }
-    const layout = importLayout(resources, cwd, platform, { files: written.size, paths: written });
+    const layout = importLayout(resources, cwd, platform, { files: written2.size, paths: written2 });
     for (const [entry2, data] of layout?.entries ?? []) {
       await write(tarHeader(entry2, data.length));
       await write(data);
@@ -1781,7 +1781,7 @@ async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
       folder: layout?.folder ?? "imported-session",
       bytes,
       sha256: hash.digest("hex"),
-      files: written.size + (layout?.entries.size ?? 0),
+      files: written2.size + (layout?.entries.size ?? 0),
       redacted: redacted2,
       leftOut,
       dispose: () => rmSync2(scratch, { recursive: true, force: true })
@@ -2294,507 +2294,92 @@ import { createHash as createHash4, randomBytes } from "crypto";
 import { createServer } from "http";
 import { hostname } from "os";
 import { spawn as spawn2 } from "child_process";
-function b64url(buf) {
-  return buf.toString("base64url");
-}
-function openBrowser2(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  try {
-    spawn2(cmd, [url], { stdio: "ignore", detached: true }).unref();
-  } catch {
-  }
+
+// src/mcp-register.ts
+import { existsSync as existsSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { spawnSync as spawnSync3 } from "child_process";
+import { homedir as homedir6 } from "os";
+import { join as join10 } from "path";
+import { parse as parseToml3 } from "smol-toml";
+import { isMap, parseDocument } from "yaml";
+
+// src/local-agents.ts
+import { existsSync as existsSync6 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join8 } from "path";
+function localAgents(env = process.env, home = homedir5()) {
+  const claude = env.CLAUDE_CONFIG_DIR || join8(home, ".claude");
+  const codex = env.CODEX_HOME || join8(home, ".codex");
+  const cursor = join8(home, ".cursor");
+  return [
+    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join8(claude, "skills") },
+    { id: "codex", name: "Codex", root: codex, skillsDir: join8(codex, "skills") },
+    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join8(cursor, "skills") }
+  ];
 }
-async function login(opts) {
-  const verifier = b64url(randomBytes(32));
-  const challenge = b64url(createHash4("sha256").update(verifier).digest());
-  const result = opts.noBrowser ? await headlessLogin(verifier, challenge) : await browserLogin(verifier, challenge);
-  saveConfig({
-    ...loadConfig(),
-    apiBase: apiBase(),
-    token: result.token,
-    email: result.user.email ?? void 0,
-    currentUniverse: void 0
-    // personal by default
-  });
-  console.log(
-    `Logged in as ${result.user.email ?? "you"}${result.universe ? ` (universe: ${result.universe.slug})` : ""}`
-  );
+function detectLocalAgents(env = process.env, home = homedir5()) {
+  return localAgents(env, home).filter((agent2) => existsSync6(agent2.root));
 }
-async function browserLogin(verifier, challenge) {
-  const state = b64url(randomBytes(16));
-  const code = await new Promise((resolve10, reject) => {
-    const server = createServer((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/callback") {
-        res.writeHead(404).end();
-        return;
-      }
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end("<p>Logged in \u2014 you can close this tab and return to your terminal.</p>");
-      const got = url.searchParams.get("code");
-      if (url.searchParams.get("state") !== state || !got) {
-        reject(new Error("login callback state mismatch"));
-      } else {
-        resolve10(got);
-      }
-      server.close();
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      const port = typeof address === "object" && address ? address.port : 0;
-      const authorizeUrl = `${consoleBase()}/cli/authorize?state=${state}&port=${port}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
-      console.log("Opening your browser to authorize this machine\u2026");
-      console.log(`If it doesn't open, visit:
-  ${authorizeUrl}`);
-      openBrowser2(authorizeUrl);
-    });
-    setTimeout(() => {
-      server.close();
-      reject(new Error("login timed out after 10 minutes"));
-    }, 10 * 60 * 1e3).unref();
+function selectLocalAgents(ids, env = process.env, home = homedir5()) {
+  if (!ids?.length) return detectLocalAgents(env, home);
+  const known = localAgents(env, home);
+  return ids.map((id) => {
+    const agent2 = known.find((candidate) => candidate.id === id);
+    if (!agent2) throw new Error(`unknown agent ${id} \u2014 expected ${known.map((candidate) => candidate.id).join(" | ")}`);
+    return agent2;
   });
-  return api(
-    "POST",
-    "/cli/token-exchange",
-    { code, verifier, clientName: `cli ${hostname()}` },
-    { auth: false }
-  );
-}
-async function headlessLogin(verifier, challenge) {
-  const request = b64url(randomBytes(24));
-  const authorizeUrl = `${consoleBase()}/cli/authorize?request=${request}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
-  console.log(`Visit this URL on any device to authorize:
-  ${authorizeUrl}
-`);
-  process.stdout.write("Waiting for approval\u2026");
-  const deadline = Date.now() + 10 * 60 * 1e3;
-  while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, 3e3));
-    const res = await fetch(
-      `${apiBase()}/cli/poll?request=${request}&verifier=${encodeURIComponent(verifier)}&clientName=${encodeURIComponent(`cli ${hostname()}`)}`,
-      { headers: { "user-agent": USER_AGENT } }
-    );
-    if (!res.ok) {
-      const body2 = await res.json().catch(() => null);
-      throw new Error(body2?.error?.message ?? `poll failed (${res.status})`);
-    }
-    const body = await res.json();
-    if (body.status === "approved") {
-      console.log(" approved.");
-      return body;
-    }
-    process.stdout.write(".");
-  }
-  throw new Error("login timed out after 10 minutes");
 }
 
-// src/connectors.ts
-async function listApps(query, limit = 50) {
-  const apps = [];
-  let cursor = null;
-  do {
-    const params = new URLSearchParams();
-    if (query) params.set("q", query);
-    if (cursor) params.set("cursor", cursor);
-    const qs = params.toString();
-    const page = await api("GET", `/connectors/apps${qs ? `?${qs}` : ""}`);
-    apps.push(...page.apps);
-    cursor = page.next_cursor;
-  } while (cursor && apps.length < limit);
-  return apps.slice(0, limit);
-}
-function connectionLine2(c) {
-  return `${c.id}  ${c.app_name} (${c.app})  ${c.label}  since ${c.created_at.slice(0, 10)}`;
+// src/skill.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
+
+// src/catalog-file.ts
+var CATALOG_FILE = "catalog.md";
+var CATEGORY_ORDER = ["websites", "content", "video", "code", "research", "general"];
+function categoryOf(agent2) {
+  return CATEGORY_ORDER.find((category) => agent2.categories.includes(category)) ?? agent2.categories[0] ?? "general";
 }
-function workspaceConnectionLine(c) {
-  const owner = c.workspace_owned ? "the workspace" : c.mine ? "you" : c.shared_by?.name ?? c.shared_by?.user_id ?? "someone";
-  return `${c.connection_id}  ${c.app_name} (${c.app})  ${c.label}  shared by ${owner}`;
+function describe(value) {
+  const parts = Object.entries(value).filter(([, item]) => item !== null && item !== void 0 && item !== false && item !== "").map(([key, item]) => item === true ? key : `${key}: ${typeof item === "string" ? item : JSON.stringify(item)}`);
+  return parts.length ? parts.join(", ") : null;
 }
-function browserReturn(start, opts = {}) {
-  return new Promise((resolve10, reject) => {
-    const server = createServer2((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/done" && url.pathname !== "/failed") {
-        res.writeHead(404).end();
-        return;
-      }
-      const ok = url.pathname === "/done";
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end(ok ? "<p>Connected \u2014 you can close this tab and return to your terminal.</p>" : "<p>The app was not connected. Return to your terminal.</p>");
-      server.close();
-      if (ok) resolve10(url.searchParams.get("account_id") ?? void 0);
-      else reject(new ApiError(400, "connect_failed", "the app was not connected"));
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      const port = typeof address === "object" && address ? address.port : 0;
-      const base = `http://127.0.0.1:${port}`;
-      start(`${base}/done`, `${base}/failed`).then(
-        (authorizeUrl) => {
-          console.log(`Authorize access in your browser:
-  ${authorizeUrl}`);
-          if (opts.open !== false) openBrowser2(authorizeUrl);
-        },
-        (err) => {
-          server.close();
-          reject(err);
-        }
-      );
-    });
-    setTimeout(() => {
-      server.close();
-      reject(new ApiError(408, "connect_timeout", "nobody finished the authorization within 10 minutes"));
-    }, opts.timeoutMs ?? 10 * 6e4).unref();
-  });
+function entry(agent2) {
+  const engine = agent2.engine_type ? ` \xB7 engine ${agent2.engine_type}` : "";
+  const lines = [`### @${agent2.handle} \u2014 ${agent2.name}${engine}`, "", agent2.tagline];
+  if (agent2.does.length) lines.push("", `Does: ${agent2.does.join("; ")}`);
+  if (agent2.does_not.length) lines.push(`Does not: ${agent2.does_not.join("; ")}`);
+  const { mcp_servers: mcpServers2, ...rest } = agent2.requirements;
+  if (typeof mcpServers2 === "boolean") lines.push(mcpServers2 ? "Can use MCP servers." : "Cannot use MCP servers.");
+  const details = describe(rest);
+  if (details) lines.push(`Details: ${details}`);
+  const pricing = describe(agent2.pricing);
+  if (pricing) lines.push(`Pricing: ${pricing}`);
+  return lines.join("\n");
 }
-async function connectApp(app, opts = {}) {
-  const base = opts.workspace ? `/universes/${encodeURIComponent(opts.workspace)}/connections` : "/connectors/connections";
-  const accountId = await browserReturn(async (success_url, error_url) => {
-    const { url } = await api("POST", base, { app, success_url, error_url });
-    return url;
-  }, { open: opts.open });
-  const done = await api("POST", `${base}/complete`, {
-    app,
-    ...accountId ? { account_id: accountId } : {}
+function renderCatalog(agents, generatedAt) {
+  const header2 = [
+    "# AgentSky agent catalog",
+    "",
+    `Every agent you can hire, as of ${generatedAt.toISOString()}. Start one with \`start_session\` and its handle, written with the @.`,
+    "Run `npx @agentsky/sky setup` again to refresh this file; `search_catalog` always has the current list."
+  ];
+  if (!agents.length) return [...header2, "", "The catalog was empty when this file was written. Use `search_catalog`.", ""].join("\n");
+  const own = agents.filter((agent2) => agent2.visibility === "workspace");
+  const shared = agents.filter((agent2) => agent2.visibility !== "workspace");
+  const sections = [];
+  if (own.length) sections.push(["## Your workspace's agents", ...own.map(entry)].join("\n\n"));
+  const groups = /* @__PURE__ */ new Map();
+  for (const agent2 of shared) groups.set(categoryOf(agent2), [...groups.get(categoryOf(agent2)) ?? [], agent2]);
+  const ordered = [...groups.keys()].sort((a, b) => {
+    const rank = (category) => CATEGORY_ORDER.includes(category) ? CATEGORY_ORDER.indexOf(category) : CATEGORY_ORDER.length;
+    return rank(a) - rank(b) || a.localeCompare(b);
   });
-  return done.connection;
-}
-
-// src/routine-triggers.ts
-var triggerPath = (id, resource) => `/routines/${encodeURIComponent(id)}/${resource}`;
-function inboundLine(u) {
-  if (!u) return "no inbound URL \u2014 make one with --create";
-  return u.url ?? `inbound URL ${u.prefix}\u2026 made ${u.created_at.slice(0, 10)}${u.last_used_at ? `, last used ${u.last_used_at.slice(0, 16).replace("T", " ")}` : ", never used"}`;
-}
-function precheckLine(p) {
-  if (!p) return "no precheck: every scheduled fire runs";
-  const last = p.last_result ? `last check ${p.last_result}${p.last_error ? ` (${p.last_error.type}: ${p.last_error.message})` : ""}` : "not checked yet";
-  return `fires only when ${p.url} changes \xB7 ${last}`;
-}
-function triggerLine(t, available = true) {
-  if (!t) return "no chat trigger";
-  const where = t.thread_id ? `thread ${t.thread_id} on ${t.connection_id}` : `any conversation on ${t.connection_id}`;
-  const what = t.text_prefix ? `messages starting "${t.text_prefix}"` : "every message";
-  return `${what} in ${where} start a run${available ? "" : " (chat messages are not offered to routines in this deployment)"}`;
-}
-function deliverLine(d) {
-  return d ? `answers post to thread ${d.thread_id} on ${d.connection_id}` : "answers are posted nowhere";
-}
-function triggerBody(opts) {
-  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
-  return { connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {}, ...opts.prefix ? { text_prefix: opts.prefix } : {} };
-}
-function deliverBody(opts) {
-  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
-  return { type: "channel_thread", connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {} };
-}
-async function triggerRequest(id, resource, change) {
-  const path = triggerPath(id, resource);
-  if (change.remove) return api("DELETE", path);
-  if (change.create) return api("POST", path);
-  if (change.body) return api("PUT", path, change.body);
-  return api("GET", path);
-}
-
-// src/session-workspace.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { createHash as createHash5, randomUUID } from "crypto";
-import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
-import { basename as basename6, join as join8, relative as relative3, resolve as resolve5 } from "path";
-var SINGLE_IMPORT_MAX = 25 * 1024 * 1024;
-var PART_SIZE = 8 * 1024 * 1024;
-var SKIPPED2 = /* @__PURE__ */ new Set([".git", "node_modules"]);
-var workspacePath = (id) => `/sessions/${encodeURIComponent(id)}/workspace`;
-async function listFiles2(id, path, hidden) {
-  const query = new URLSearchParams();
-  if (path) query.set("path", path);
-  if (hidden) query.set("hidden", "true");
-  const qs = query.toString();
-  return api("GET", `${workspacePath(id)}/files${qs ? `?${qs}` : ""}`);
-}
-function entryLine(e) {
-  const size = e.type === "directory" ? "-" : String(e.size ?? 0);
-  return `${e.type === "directory" ? "d" : "-"} ${size.padStart(10)}  ${(e.mtime ?? "").slice(0, 16).replace("T", " ")}  ${e.name}${e.type === "directory" ? "/" : ""}`;
-}
-async function readFile(id, path) {
-  return (await apiBytes("GET", `${workspacePath(id)}/files/content?path=${encodeURIComponent(path)}`)).bytes;
-}
-function renderChanges(changes) {
-  if (!changes.repos.length) return [`no git repository under ${changes.root}`];
-  return changes.repos.flatMap((r) => [
-    `${r.path === "." ? changes.root : r.path}: ${r.status ? "changed" : "clean"}`,
-    ...(r.stat ?? r.status ?? "").split("\n").filter(Boolean).map((line) => `  ${line}`)
-  ]);
-}
-async function workspacePatch(id, repo) {
-  const { patch, ...meta } = await api("POST", `${workspacePath(id)}/patch`, { repo });
-  return { meta, patch: Buffer.from(patch, "base64") };
-}
-function folderFiles(dir) {
-  const git2 = spawnSync3("git", ["-C", dir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8" });
-  const top = spawnSync3("git", ["-C", dir, "rev-parse", "--show-prefix"], { encoding: "utf8" });
-  if (git2.status === 0 && top.status === 0) {
-    return git2.stdout.split("\0").filter((path) => path && statSync6(join8(dir, path), { throwIfNoEntry: false })?.isFile());
-  }
-  const files2 = [];
-  const walk = (at) => {
-    for (const entry2 of readdirSync5(at, { withFileTypes: true })) {
-      if (SKIPPED2.has(entry2.name)) continue;
-      const full = join8(at, entry2.name);
-      if (entry2.isDirectory()) walk(full);
-      else if (entry2.isFile()) files2.push(relative3(dir, full));
-    }
-  };
-  walk(dir);
-  return files2;
-}
-function folderArchive(dir, files2) {
-  const tar = spawnSync3("tar", ["--format=ustar", "-czf", "-", "-C", dir, "-T", "-"], {
-    input: files2.join("\n"),
-    env: { ...process.env, COPYFILE_DISABLE: "1" },
-    maxBuffer: 2 * 1024 * 1024 * 1024
-  });
-  if (tar.status !== 0) throw new ApiError(400, "archive_failed", `tar failed: ${tar.stderr.toString().trim()}`);
-  return tar.stdout;
-}
-async function importFolder(id, dir, opts = {}) {
-  const root = resolve5(dir);
-  const name = opts.name ?? basename6(root);
-  const archive = opts.archive ?? folderArchive(root, folderFiles(root));
-  if (archive.length <= SINGLE_IMPORT_MAX) {
-    const res = await apiBytes("POST", `${workspacePath(id)}/import?name=${encodeURIComponent(name)}`, { bytes: archive, mediaType: "application/gzip" });
-    return res.json();
-  }
-  const sha256 = createHash5("sha256").update(archive).digest("hex");
-  let upload = await api("POST", `${workspacePath(id)}/imports`, { name, size: archive.length, sha256, part_size: PART_SIZE });
-  const uploadPath = `${workspacePath(id)}/imports/${encodeURIComponent(upload.id)}`;
-  for (let part = 0; part < upload.parts; part += 1) {
-    if (upload.received.includes(part)) continue;
-    const bytes = archive.subarray(part * upload.part_size, (part + 1) * upload.part_size);
-    await apiBytes("PUT", `${uploadPath}/parts/${part}`, { bytes, mediaType: "application/octet-stream" });
-  }
-  upload = await api("POST", `${uploadPath}/complete`);
-  while (upload.state !== "imported" && upload.state !== "failed") {
-    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
-    upload = await api("GET", uploadPath);
-  }
-  if (upload.state === "failed") throw new ApiError(422, upload.error?.code ?? "import_failed", upload.error?.message ?? "the import failed");
-  return { path: upload.path ?? name, files: upload.files ?? 0 };
-}
-function renderAccess(a) {
-  const lines = [
-    `${a.session_id}${a.title ? ` \u2014 ${a.title}` : ""}`,
-    `  ${a.visibility === "private" ? "private to its owner" : `visible to ${a.workspace.name} (${a.workspace.slug})`} \xB7 you are its ${a.access}`,
-    `  owner: ${a.owner.name ?? a.owner.email ?? "unknown"}`
-  ];
-  if (a.viewers) lines.push(a.viewers.length ? `  viewers: ${a.viewers.map((v) => v.email).join(", ")}` : "  viewers: none");
-  return lines;
-}
-function accessPatch(opts) {
-  if (opts.private && opts.members) throw new ApiError(400, "invalid_request", "pass --private or --members, not both");
-  return {
-    ...opts.private ? { visibility: "private" } : opts.members ? { visibility: "workspace" } : {},
-    ...opts.addViewer?.length ? { add_viewers: opts.addViewer } : {},
-    ...opts.removeViewer?.length ? { remove_viewers: opts.removeViewer } : {}
-  };
-}
-function engineChange(model, thinking) {
-  if (!model && !thinking) return null;
-  return {
-    ...model ? { llm: model } : {},
-    ...thinking ? { reasoningEffort: thinking === "default" ? null : thinking } : {}
-  };
-}
-var TERMINAL = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
-async function handoff(id, targetAgent, opts = {}) {
-  let { handoff: h } = await api("POST", `/sessions/${encodeURIComponent(id)}/handoff`, {
-    target_agent: targetAgent,
-    ...opts.fromMessage ? { last_message_id: opts.fromMessage } : {}
-  }, { idempotencyKey: opts.idempotencyKey ?? randomUUID() });
-  opts.onStatus?.(h);
-  while (opts.wait && !TERMINAL.has(h.status)) {
-    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
-    const next = (await api("GET", `/session-handoffs/${encodeURIComponent(h.id)}`)).handoff;
-    if (next.status !== h.status) opts.onStatus?.(next);
-    h = next;
-  }
-  return h;
-}
-
-// src/local-agents.ts
-import { existsSync as existsSync6 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join9 } from "path";
-function localAgents(env = process.env, home = homedir5()) {
-  const claude = env.CLAUDE_CONFIG_DIR || join9(home, ".claude");
-  const codex = env.CODEX_HOME || join9(home, ".codex");
-  const cursor = join9(home, ".cursor");
-  return [
-    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join9(claude, "skills") },
-    { id: "codex", name: "Codex", root: codex, skillsDir: join9(codex, "skills") },
-    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join9(cursor, "skills") }
-  ];
-}
-function detectLocalAgents(env = process.env, home = homedir5()) {
-  return localAgents(env, home).filter((agent2) => existsSync6(agent2.root));
-}
-function selectLocalAgents(ids, env = process.env, home = homedir5()) {
-  if (!ids?.length) return detectLocalAgents(env, home);
-  const known = localAgents(env, home);
-  return ids.map((id) => {
-    const agent2 = known.find((candidate) => candidate.id === id);
-    if (!agent2) throw new Error(`unknown agent ${id} \u2014 expected ${known.map((candidate) => candidate.id).join(" | ")}`);
-    return agent2;
-  });
-}
-
-// src/render.ts
-var dim = (s) => `\x1B[2m${s}\x1B[0m`;
-var red = (s) => `\x1B[31m${s}\x1B[0m`;
-function clip(value, max = 120) {
-  const text = typeof value === "string" ? value : JSON.stringify(value);
-  return text.length > max ? `${text.slice(0, max)}\u2026` : text;
-}
-function renderEvent(event, data) {
-  const part = data.part;
-  switch (event) {
-    case "agent.message":
-      console.log(String(data.text ?? ""));
-      break;
-    case "agent.reasoning":
-      console.log(dim(`\xB7 ${clip(part?.text ?? "")}`));
-      break;
-    case "agent.tool_use":
-      console.log(dim(`\u2192 ${String(part?.tool_name ?? "tool")}(${clip(part?.args ?? {}, 80)})`));
-      break;
-    case "agent.tool_result":
-      console.log(dim(`\u2190 ${String(part?.tool_name ?? "tool")} ${String(part?.status ?? "")}`));
-      break;
-    case "agent.status":
-      console.log(dim(`\u2026 ${String(part?.level ?? "")} ${String(part?.text ?? "")}`.trim()));
-      break;
-    case "user.interrupt":
-      console.log(dim("\u23F9 interrupting"));
-      break;
-    case "session.error": {
-      const error = data.error;
-      const message2 = String(error?.message ?? error?.type ?? "unknown");
-      if (error?.retry_status === "retrying") console.error(dim(`retrying: ${message2}`));
-      else console.error(red(`error: ${message2}`));
-      break;
-    }
-    case "session.status_terminated":
-      console.log(dim("session terminated"));
-      break;
-    default:
-      break;
-  }
-}
-
-// src/session-read.ts
-var TURN_TYPES = ["user.message", "agent.message", "session.status_idle", "session.status_terminated", "session.error"];
-function latestTurn(events) {
-  let start = 0;
-  for (let index = events.length - 1; index >= 0; index -= 1) {
-    if (events[index].type === "user.message") {
-      start = index + 1;
-      break;
-    }
-  }
-  const reading = { finished: false, messages: [], errors: [] };
-  for (const event of events.slice(start)) {
-    if (event.type === "agent.message" && event.text?.trim()) reading.messages.push(event.text);
-    else if (event.type === "session.error" && event.error?.retry_status !== "retrying") {
-      reading.errors.push(event.error?.message ?? event.error?.type ?? "unknown error");
-    } else if (event.type === "session.status_terminated") reading.finished = true;
-    else if (event.type === "session.status_idle" && event.stop_reason?.type !== "requires_action") reading.finished = true;
-  }
-  return reading;
-}
-async function history2(sessionId) {
-  const events = [];
-  let cursor = null;
-  for (; ; ) {
-    const query = new URLSearchParams({ limit: "500" });
-    for (const type of TURN_TYPES) query.append("types[]", type);
-    if (cursor) query.set("cursor", cursor);
-    const page = await api(
-      "GET",
-      `/sessions/${encodeURIComponent(sessionId)}/events?${query}`
-    );
-    events.push(...page.events);
-    if (!page.hasMore || !page.cursor) return events;
-    cursor = page.cursor;
-  }
-}
-async function readTurn(sessionId, opts = {}) {
-  const deadline = Date.now() + (opts.timeoutSeconds ?? 600) * 1e3;
-  for (; ; ) {
-    const reading = latestTurn(await history2(sessionId));
-    if (reading.finished || !opts.wait || Date.now() >= deadline) return reading;
-    await new Promise((resolve10) => setTimeout(resolve10, opts.intervalMs ?? 3e3));
-  }
-}
-
-// src/setup.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname6, join as join13 } from "path";
-import { createInterface as createInterface3 } from "readline";
-
-// src/mcp-register.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
-import { spawnSync as spawnSync4 } from "child_process";
-
-// src/skill.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
-
-// src/catalog-file.ts
-var CATALOG_FILE = "catalog.md";
-var CATEGORY_ORDER = ["websites", "content", "video", "code", "research", "general"];
-function categoryOf(agent2) {
-  return CATEGORY_ORDER.find((category) => agent2.categories.includes(category)) ?? agent2.categories[0] ?? "general";
-}
-function describe(value) {
-  const parts = Object.entries(value).filter(([, item]) => item !== null && item !== void 0 && item !== false && item !== "").map(([key, item]) => item === true ? key : `${key}: ${typeof item === "string" ? item : JSON.stringify(item)}`);
-  return parts.length ? parts.join(", ") : null;
-}
-function entry(agent2) {
-  const engine = agent2.engine_type ? ` \xB7 engine ${agent2.engine_type}` : "";
-  const lines = [`### @${agent2.handle} \u2014 ${agent2.name}${engine}`, "", agent2.tagline];
-  if (agent2.does.length) lines.push("", `Does: ${agent2.does.join("; ")}`);
-  if (agent2.does_not.length) lines.push(`Does not: ${agent2.does_not.join("; ")}`);
-  const { mcp_servers: mcpServers2, ...rest } = agent2.requirements;
-  if (typeof mcpServers2 === "boolean") lines.push(mcpServers2 ? "Can use MCP servers." : "Cannot use MCP servers.");
-  const details = describe(rest);
-  if (details) lines.push(`Details: ${details}`);
-  const pricing = describe(agent2.pricing);
-  if (pricing) lines.push(`Pricing: ${pricing}`);
-  return lines.join("\n");
-}
-function renderCatalog(agents, generatedAt) {
-  const header2 = [
-    "# AgentSky agent catalog",
-    "",
-    `Every agent you can hire, as of ${generatedAt.toISOString()}. Start one with \`start_session\` and its handle, written with the @.`,
-    "Run `npx @agentsky/sky setup` again to refresh this file; `search_catalog` always has the current list."
-  ];
-  if (!agents.length) return [...header2, "", "The catalog was empty when this file was written. Use `search_catalog`.", ""].join("\n");
-  const own = agents.filter((agent2) => agent2.visibility === "workspace");
-  const shared = agents.filter((agent2) => agent2.visibility !== "workspace");
-  const sections = [];
-  if (own.length) sections.push(["## Your workspace's agents", ...own.map(entry)].join("\n\n"));
-  const groups = /* @__PURE__ */ new Map();
-  for (const agent2 of shared) groups.set(categoryOf(agent2), [...groups.get(categoryOf(agent2)) ?? [], agent2]);
-  const ordered = [...groups.keys()].sort((a, b) => {
-    const rank = (category) => CATEGORY_ORDER.includes(category) ? CATEGORY_ORDER.indexOf(category) : CATEGORY_ORDER.length;
-    return rank(a) - rank(b) || a.localeCompare(b);
-  });
-  for (const category of ordered) {
-    const title = category.charAt(0).toUpperCase() + category.slice(1);
-    sections.push([`## ${title}`, ...groups.get(category).map(entry)].join("\n\n"));
-  }
-  return [...header2, "", sections.join("\n\n"), ""].join("\n");
+  for (const category of ordered) {
+    const title = category.charAt(0).toUpperCase() + category.slice(1);
+    sections.push([`## ${title}`, ...groups.get(category).map(entry)].join("\n\n"));
+  }
+  return [...header2, "", sections.join("\n\n"), ""].join("\n");
 }
 
 // src/skill.ts
@@ -3172,158 +2757,738 @@ Check one real session:
 - A file id from another customer's workspace is refused at session create.
 `;
 }
-function workspacesReferenceDoc() {
-  return `# Workspaces in AgentSky
-
-A workspace (also called a universe) groups agents and sessions. Every API call
-and MCP tool accepts an optional workspace slug.
-
-## How to choose
-
-1. The person named one \u2192 use it.
-2. Check the git root for \`.agentsky.json\` with a \`"workspace"\` key \u2192 use that.
-3. Neither \u2192 use the account default (personal workspace). Never ask.
-
-## Applying it
+function workspacesReferenceDoc() {
+  return `# Workspaces in AgentSky
+
+A workspace (also called a universe) groups agents and sessions. Every API call
+and MCP tool accepts an optional workspace slug.
+
+## How to choose
+
+1. The person named one \u2192 use it.
+2. Check the git root for \`.agentsky.json\` with a \`"workspace"\` key \u2192 use that.
+3. Neither \u2192 use the account default (personal workspace). Never ask.
+
+## Applying it
+
+- MCP tools: pass \`workspace: "<slug>"\` on tools that accept it.
+- sky CLI: \`--workspace <slug>\` on any command, or set \`SKY_WORKSPACE=<slug>\`.
+- Tools that take a \`task_id\` or \`session_id\` inherit that task's workspace
+  automatically; one task never spans workspaces.
+
+## Listing workspaces
+
+\`sky workspace list\` (or \`sky universe list\`) prints your workspaces, with
+\`*\` marking the current default.
+
+## .agentsky.json
+
+To set a per-repo default, create \`.agentsky.json\` at the git root:
+
+\`\`\`json
+{"workspace": "my-team-slug"}
+\`\`\`
+`;
+}
+function installedVersion(dir) {
+  try {
+    const marker = JSON.parse(readFileSync9(join9(dir, SKILL_MARKER), "utf8"));
+    return typeof marker.version === "string" ? marker.version : null;
+  } catch {
+    return null;
+  }
+}
+function isInstalledSkill(dir) {
+  return installedVersion(dir) !== null;
+}
+function installSkill(agent2, opts = {}) {
+  const dir = join9(agent2.skillsDir, SKILL_NAME);
+  const previous = installedVersion(dir);
+  const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
+  if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
+  if (outcome !== "current") {
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync4(join9(dir, "SKILL.md"), skillDocument());
+    writeFileSync4(join9(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
+`);
+  }
+  if (opts.catalog) {
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync4(join9(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+  }
+  const refsDir = join9(dir, REFERENCES_DIR);
+  mkdirSync2(refsDir, { recursive: true });
+  writeFileSync4(join9(refsDir, "import.md"), importReferenceDoc());
+  writeFileSync4(join9(refsDir, "workspaces.md"), workspacesReferenceDoc());
+  writeFileSync4(join9(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
+  return { agent: agent2.id, path: dir, outcome };
+}
+
+// src/mcp-register.ts
+var MCP_SERVER_NAME = SKILL_NAME;
+function detectHermes(env = process.env, home = homedir6()) {
+  const root = env.HERMES_HOME || join10(home, ".hermes");
+  return existsSync7(root) ? { id: "hermes", name: "Hermes", root } : null;
+}
+function detectMcpClients(env = process.env, home = homedir6()) {
+  const hermes = detectHermes(env, home);
+  return [...detectLocalAgents(env, home), ...hermes ? [hermes] : []];
+}
+function systemCommandRunner() {
+  return {
+    has: (command) => spawnSync3(command, ["--version"], { stdio: "ignore" }).status === 0,
+    run: (command, args) => {
+      const result = spawnSync3(command, args, { encoding: "utf8" });
+      return { status: result.status, stderr: result.stderr ?? "" };
+    }
+  };
+}
+function mcpUrlFor(apiBase2) {
+  return `${apiBase2.replace(/\/$/, "")}/mcp`;
+}
+function mcpCommands(agent2, opts) {
+  if (agent2 === "claude_code") {
+    return {
+      command: "claude",
+      remove: ["mcp", "remove", "--scope", "user", MCP_SERVER_NAME],
+      add: ["mcp", "add", "--scope", "user", "--transport", "http", MCP_SERVER_NAME, opts.mcpUrl, "--header", `Authorization: Bearer ${opts.token}`]
+    };
+  }
+  return null;
+}
+function redact(text, token) {
+  return text.split(token).join(`${token.slice(0, 10)}\u2026`);
+}
+function registerMcpServer(client, opts, runner = systemCommandRunner()) {
+  if (client.id === "codex") return registerCodex(client, opts);
+  if (client.id === "cursor") return registerCursor(client, opts);
+  if (client.id === "hermes") return registerHermes(client, opts);
+  const commands = mcpCommands(client.id, opts);
+  if (!commands) return { agent: client.id, outcome: "unsupported" };
+  if (!runner.has(commands.command)) return { agent: client.id, outcome: "no_command", detail: `${commands.command} is not on PATH` };
+  if (opts.dryRun) return { agent: client.id, outcome: "planned", detail: redact(`run ${[commands.command, ...commands.add].join(" ")}`, opts.token) };
+  runner.run(commands.command, commands.remove);
+  const added = runner.run(commands.command, commands.add);
+  if (added.status !== 0) return { agent: client.id, outcome: "failed", detail: redact(added.stderr.trim() || `exit ${added.status}`, opts.token) };
+  return { agent: client.id, outcome: "registered" };
+}
+function mcpConfigPath(client, env = process.env, home = homedir6()) {
+  switch (client.id) {
+    case "claude_code":
+      return join10(env.CLAUDE_CONFIG_DIR || home, ".claude.json");
+    case "codex":
+      return join10(client.root, "config.toml");
+    case "cursor":
+      return join10(client.root, "mcp.json");
+    case "hermes":
+      return join10(client.root, "config.yaml");
+  }
+}
+function readText(path) {
+  try {
+    return readFileSync10(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function hasMcpServer(client, env = process.env, home = homedir6()) {
+  const raw = readText(mcpConfigPath(client, env, home));
+  if (raw === null) return false;
+  try {
+    if (client.id === "codex") return Boolean(parseToml3(raw).mcp_servers?.[MCP_SERVER_NAME]);
+    if (client.id === "hermes") return parseDocument(raw).hasIn(["mcp_servers", MCP_SERVER_NAME]);
+    return Boolean(JSON.parse(raw).mcpServers?.[MCP_SERVER_NAME]);
+  } catch {
+    return false;
+  }
+}
+function planned(client, path, entry2, opts) {
+  return { agent: client.id, outcome: "planned", detail: `write to ${path}: ${redact(entry2, opts.token)}` };
+}
+function written(client, path, text) {
+  try {
+    writeFileSync5(path, text, { encoding: "utf8", mode: 384 });
+  } catch (err) {
+    return { agent: client.id, outcome: "failed", detail: String(err) };
+  }
+  return { agent: client.id, outcome: "registered" };
+}
+function tomlTableKey(name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return `(?:${escaped}|"${escaped}"|'${escaped}')`;
+}
+function withoutTomlServer(text, name) {
+  const ours = new RegExp(`^\\s*\\[\\s*mcp_servers\\s*\\.\\s*${tomlTableKey(name)}\\s*(?:\\.[^\\]]*)?\\]\\s*(?:#.*)?$`);
+  let skipping = false;
+  const kept = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (/^\s*\[/.test(line)) skipping = ours.test(line);
+    if (!skipping) kept.push(line);
+  }
+  return kept.join("\n").replace(/\n+$/, "");
+}
+function registerCodex(client, opts) {
+  const path = mcpConfigPath(client);
+  const block = [
+    `[mcp_servers.${MCP_SERVER_NAME}]`,
+    `url = ${JSON.stringify(opts.mcpUrl)}`,
+    `http_headers = { Authorization = ${JSON.stringify(`Bearer ${opts.token}`)} }`
+  ].join("\n");
+  if (opts.dryRun) return planned(client, path, block, opts);
+  const raw = readText(path) ?? "";
+  let before;
+  try {
+    before = parseToml3(raw);
+  } catch (err) {
+    return { agent: client.id, outcome: "failed", detail: `${path} is not valid TOML, left as it was (${String(err).split("\n")[0]})` };
+  }
+  const rest = withoutTomlServer(raw, MCP_SERVER_NAME);
+  const text = `${rest ? `${rest}
+
+` : ""}${block}
+`;
+  try {
+    const after = parseToml3(text);
+    const others = Object.keys(before.mcp_servers ?? {}).filter((name) => name !== MCP_SERVER_NAME);
+    if (after.mcp_servers?.[MCP_SERVER_NAME]?.url !== opts.mcpUrl || others.some((name) => !after.mcp_servers?.[name])) throw new Error("the edited file lost an entry");
+  } catch (err) {
+    return { agent: client.id, outcome: "failed", detail: `could not edit ${path} safely, left as it was (${String(err).split("\n")[0]})` };
+  }
+  return written(client, path, text);
+}
+function registerCursor(client, opts) {
+  const path = mcpConfigPath(client);
+  const entry2 = { url: opts.mcpUrl, headers: { Authorization: `Bearer ${opts.token}` } };
+  if (opts.dryRun) return planned(client, path, JSON.stringify({ [MCP_SERVER_NAME]: entry2 }, null, 2), opts);
+  let existing = {};
+  try {
+    const parsed = JSON.parse(readText(path) ?? "");
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) existing = parsed;
+  } catch {
+    existing = {};
+  }
+  const updated = { ...existing, mcpServers: { ...existing.mcpServers ?? {}, [MCP_SERVER_NAME]: entry2 } };
+  return written(client, path, `${JSON.stringify(updated, null, 2)}
+`);
+}
+function registerHermes(client, opts) {
+  const path = mcpConfigPath(client);
+  const entry2 = { url: opts.mcpUrl, headers: { Authorization: `Bearer ${opts.token}` } };
+  if (opts.dryRun) return planned(client, path, `mcp_servers.${MCP_SERVER_NAME}: ${JSON.stringify(entry2)}`, opts);
+  const doc = parseDocument(readText(path) ?? "");
+  if (doc.errors.length) return { agent: client.id, outcome: "failed", detail: `${path} is not valid YAML, left as it was (${doc.errors[0].message.split("\n")[0]})` };
+  if (doc.contents !== null && !isMap(doc.contents)) {
+    return { agent: client.id, outcome: "failed", detail: `${path} is not a YAML mapping, left as it was` };
+  }
+  doc.setIn(["mcp_servers", MCP_SERVER_NAME], doc.createNode(entry2));
+  return written(client, path, doc.toString());
+}
+function refreshMcpRegistrations(opts, clients = detectMcpClients(), runner = systemCommandRunner()) {
+  return clients.filter((client) => hasMcpServer(client)).map((client) => registerMcpServer(client, opts, runner));
+}
 
-- MCP tools: pass \`workspace: "<slug>"\` on tools that accept it.
-- sky CLI: \`--workspace <slug>\` on any command, or set \`SKY_WORKSPACE=<slug>\`.
-- Tools that take a \`task_id\` or \`session_id\` inherit that task's workspace
-  automatically; one task never spans workspaces.
+// src/shell-env.ts
+import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir7 } from "os";
+import { basename as basename6, dirname as dirname5, join as join11 } from "path";
+var TOKEN_ENV = "AGENTSKY_API_KEY";
+var HOOK_MARK = "# AgentSky API token, kept current by sky";
+function shellEnvFiles() {
+  const dir = dirname5(configPath());
+  return { sh: join11(dir, "env.sh"), fish: join11(dir, "env.fish") };
+}
+function quoted(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function shellStartupFiles(env = process.env, home = homedir7(), platform = process.platform) {
+  const shell = basename6(env.SHELL ?? "");
+  const files2 = [];
+  const zshenv = join11(env.ZDOTDIR || home, ".zshenv");
+  if (shell === "zsh" || platform === "darwin" || existsSync8(zshenv)) files2.push({ path: zshenv, kind: "sh" });
+  const bashrc = join11(home, ".bashrc");
+  if (shell === "bash" || existsSync8(bashrc)) files2.push({ path: bashrc, kind: "sh" });
+  const bashProfile = join11(home, ".bash_profile");
+  if (existsSync8(bashProfile)) files2.push({ path: bashProfile, kind: "sh" });
+  const fish = join11(env.XDG_CONFIG_HOME || join11(home, ".config"), "fish");
+  if (shell === "fish" || existsSync8(fish)) files2.push({ path: join11(fish, "conf.d", "agentsky.fish"), kind: "fish" });
+  return files2;
+}
+function writeShellEnv(token, opts = {}) {
+  const { sh, fish } = shellEnvFiles();
+  const startup = shellStartupFiles(opts.env, opts.home, opts.platform);
+  if (opts.dryRun) return { outcome: "planned", files: [sh, fish, ...startup.map((file) => file.path)] };
+  const header2 = "# Written by sky. `sky auth login` and `sky auth logout` rewrite this file.\n";
+  const hooked = [];
+  try {
+    mkdirSync3(dirname5(sh), { recursive: true });
+    writeFileSync6(sh, `${header2}${token ? `export ${TOKEN_ENV}=${quoted(token)}` : `unset ${TOKEN_ENV}`}
+`, { mode: 384 });
+    writeFileSync6(fish, `${header2}${token ? `set -gx ${TOKEN_ENV} ${quoted(token)}` : `set -e ${TOKEN_ENV}`}
+`, { mode: 384 });
+    for (const file of startup) {
+      const existing = existsSync8(file.path) ? readFileSync11(file.path, "utf8") : "";
+      if (existing.includes(HOOK_MARK)) continue;
+      const line = file.kind === "fish" ? `${HOOK_MARK}
+test -f ${quoted(fish)}; and source ${quoted(fish)}
+` : `${HOOK_MARK}
+[ -f ${quoted(sh)} ] && . ${quoted(sh)}
+`;
+      mkdirSync3(dirname5(file.path), { recursive: true });
+      appendFileSync(file.path, `${existing && !existing.endsWith("\n") ? "\n" : ""}${line}`);
+      hooked.push(file.path);
+    }
+  } catch (err) {
+    return { outcome: "failed", files: [sh, fish, ...hooked], detail: String(err) };
+  }
+  return { outcome: token ? "written" : "cleared", files: [sh, fish, ...hooked] };
+}
 
-## Listing workspaces
+// src/local-access.ts
+function syncLocalAccess(token, clients = detectMcpClients()) {
+  const lines = [];
+  const shell = writeShellEnv(token);
+  if (shell.outcome === "failed") lines.push(`  ${TOKEN_ENV} not updated for new shells: ${shell.detail}`);
+  else lines.push(token ? `  new shells get ${TOKEN_ENV} for this login` : `  new shells no longer get ${TOKEN_ENV}`);
+  if (token) {
+    for (const registered of refreshMcpRegistrations({ token, mcpUrl: mcpUrlFor(apiBase()) }, clients)) {
+      const name = clients.find((client) => client.id === registered.agent)?.name ?? registered.agent;
+      lines.push(registered.outcome === "registered" ? `  agentsky MCP server for ${name} now uses this login` : `  agentsky MCP server for ${name} not updated: ${registered.detail ?? registered.outcome} \u2014 run \`sky setup skill\``);
+    }
+    return lines;
+  }
+  const holding = clients.filter((client) => hasMcpServer(client)).map((client) => client.name);
+  if (holding.length) lines.push(`  the agentsky MCP server in ${holding.join(", ")} still uses the old token: \`sky auth login\` replaces it, or revoke the key in Developer \u2192 API keys`);
+  return lines;
+}
 
-\`sky workspace list\` (or \`sky universe list\`) prints your workspaces, with
-\`*\` marking the current default.
+// src/login.ts
+function b64url(buf) {
+  return buf.toString("base64url");
+}
+function openBrowser2(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    spawn2(cmd, [url], { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+async function login(opts) {
+  const verifier = b64url(randomBytes(32));
+  const challenge = b64url(createHash4("sha256").update(verifier).digest());
+  const result = opts.noBrowser ? await headlessLogin(verifier, challenge) : await browserLogin(verifier, challenge);
+  saveConfig({
+    ...loadConfig(),
+    apiBase: apiBase(),
+    token: result.token,
+    email: result.user.email ?? void 0,
+    currentUniverse: void 0
+    // personal by default
+  });
+  console.log(
+    `Logged in as ${result.user.email ?? "you"}${result.universe ? ` (universe: ${result.universe.slug})` : ""}`
+  );
+  for (const line of syncLocalAccess(result.token)) console.log(line);
+}
+async function browserLogin(verifier, challenge) {
+  const state = b64url(randomBytes(16));
+  const code = await new Promise((resolve10, reject) => {
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end("<p>Logged in \u2014 you can close this tab and return to your terminal.</p>");
+      const got = url.searchParams.get("code");
+      if (url.searchParams.get("state") !== state || !got) {
+        reject(new Error("login callback state mismatch"));
+      } else {
+        resolve10(got);
+      }
+      server.close();
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      const authorizeUrl = `${consoleBase()}/cli/authorize?state=${state}&port=${port}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
+      console.log("Opening your browser to authorize this machine\u2026");
+      console.log(`If it doesn't open, visit:
+  ${authorizeUrl}`);
+      openBrowser2(authorizeUrl);
+    });
+    setTimeout(() => {
+      server.close();
+      reject(new Error("login timed out after 10 minutes"));
+    }, 10 * 60 * 1e3).unref();
+  });
+  return api(
+    "POST",
+    "/cli/token-exchange",
+    { code, verifier, clientName: `cli ${hostname()}` },
+    { auth: false }
+  );
+}
+async function headlessLogin(verifier, challenge) {
+  const request = b64url(randomBytes(24));
+  const authorizeUrl = `${consoleBase()}/cli/authorize?request=${request}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
+  console.log(`Visit this URL on any device to authorize:
+  ${authorizeUrl}
+`);
+  process.stdout.write("Waiting for approval\u2026");
+  const deadline = Date.now() + 10 * 60 * 1e3;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 3e3));
+    const res = await fetch(
+      `${apiBase()}/cli/poll?request=${request}&verifier=${encodeURIComponent(verifier)}&clientName=${encodeURIComponent(`cli ${hostname()}`)}`,
+      { headers: { "user-agent": USER_AGENT } }
+    );
+    if (!res.ok) {
+      const body2 = await res.json().catch(() => null);
+      throw new Error(body2?.error?.message ?? `poll failed (${res.status})`);
+    }
+    const body = await res.json();
+    if (body.status === "approved") {
+      console.log(" approved.");
+      return body;
+    }
+    process.stdout.write(".");
+  }
+  throw new Error("login timed out after 10 minutes");
+}
 
-## .agentsky.json
+// src/connectors.ts
+async function listApps(query, limit = 50) {
+  const apps = [];
+  let cursor = null;
+  do {
+    const params = new URLSearchParams();
+    if (query) params.set("q", query);
+    if (cursor) params.set("cursor", cursor);
+    const qs = params.toString();
+    const page = await api("GET", `/connectors/apps${qs ? `?${qs}` : ""}`);
+    apps.push(...page.apps);
+    cursor = page.next_cursor;
+  } while (cursor && apps.length < limit);
+  return apps.slice(0, limit);
+}
+function connectionLine2(c) {
+  return `${c.id}  ${c.app_name} (${c.app})  ${c.label}  since ${c.created_at.slice(0, 10)}`;
+}
+function workspaceConnectionLine(c) {
+  const owner = c.workspace_owned ? "the workspace" : c.mine ? "you" : c.shared_by?.name ?? c.shared_by?.user_id ?? "someone";
+  return `${c.connection_id}  ${c.app_name} (${c.app})  ${c.label}  shared by ${owner}`;
+}
+function browserReturn(start, opts = {}) {
+  return new Promise((resolve10, reject) => {
+    const server = createServer2((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/done" && url.pathname !== "/failed") {
+        res.writeHead(404).end();
+        return;
+      }
+      const ok = url.pathname === "/done";
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(ok ? "<p>Connected \u2014 you can close this tab and return to your terminal.</p>" : "<p>The app was not connected. Return to your terminal.</p>");
+      server.close();
+      if (ok) resolve10(url.searchParams.get("account_id") ?? void 0);
+      else reject(new ApiError(400, "connect_failed", "the app was not connected"));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      const base = `http://127.0.0.1:${port}`;
+      start(`${base}/done`, `${base}/failed`).then(
+        (authorizeUrl) => {
+          console.log(`Authorize access in your browser:
+  ${authorizeUrl}`);
+          if (opts.open !== false) openBrowser2(authorizeUrl);
+        },
+        (err) => {
+          server.close();
+          reject(err);
+        }
+      );
+    });
+    setTimeout(() => {
+      server.close();
+      reject(new ApiError(408, "connect_timeout", "nobody finished the authorization within 10 minutes"));
+    }, opts.timeoutMs ?? 10 * 6e4).unref();
+  });
+}
+async function connectApp(app, opts = {}) {
+  const base = opts.workspace ? `/universes/${encodeURIComponent(opts.workspace)}/connections` : "/connectors/connections";
+  const accountId = await browserReturn(async (success_url, error_url) => {
+    const { url } = await api("POST", base, { app, success_url, error_url });
+    return url;
+  }, { open: opts.open });
+  const done = await api("POST", `${base}/complete`, {
+    app,
+    ...accountId ? { account_id: accountId } : {}
+  });
+  return done.connection;
+}
 
-To set a per-repo default, create \`.agentsky.json\` at the git root:
+// src/routine-triggers.ts
+var triggerPath = (id, resource) => `/routines/${encodeURIComponent(id)}/${resource}`;
+function inboundLine(u) {
+  if (!u) return "no inbound URL \u2014 make one with --create";
+  return u.url ?? `inbound URL ${u.prefix}\u2026 made ${u.created_at.slice(0, 10)}${u.last_used_at ? `, last used ${u.last_used_at.slice(0, 16).replace("T", " ")}` : ", never used"}`;
+}
+function precheckLine(p) {
+  if (!p) return "no precheck: every scheduled fire runs";
+  const last = p.last_result ? `last check ${p.last_result}${p.last_error ? ` (${p.last_error.type}: ${p.last_error.message})` : ""}` : "not checked yet";
+  return `fires only when ${p.url} changes \xB7 ${last}`;
+}
+function triggerLine(t, available = true) {
+  if (!t) return "no chat trigger";
+  const where = t.thread_id ? `thread ${t.thread_id} on ${t.connection_id}` : `any conversation on ${t.connection_id}`;
+  const what = t.text_prefix ? `messages starting "${t.text_prefix}"` : "every message";
+  return `${what} in ${where} start a run${available ? "" : " (chat messages are not offered to routines in this deployment)"}`;
+}
+function deliverLine(d) {
+  return d ? `answers post to thread ${d.thread_id} on ${d.connection_id}` : "answers are posted nowhere";
+}
+function triggerBody(opts) {
+  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
+  return { connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {}, ...opts.prefix ? { text_prefix: opts.prefix } : {} };
+}
+function deliverBody(opts) {
+  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
+  return { type: "channel_thread", connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {} };
+}
+async function triggerRequest(id, resource, change) {
+  const path = triggerPath(id, resource);
+  if (change.remove) return api("DELETE", path);
+  if (change.create) return api("POST", path);
+  if (change.body) return api("PUT", path, change.body);
+  return api("GET", path);
+}
 
-\`\`\`json
-{"workspace": "my-team-slug"}
-\`\`\`
-`;
+// src/session-workspace.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { createHash as createHash5, randomUUID } from "crypto";
+import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
+import { basename as basename7, join as join12, relative as relative3, resolve as resolve5 } from "path";
+var SINGLE_IMPORT_MAX = 25 * 1024 * 1024;
+var PART_SIZE = 8 * 1024 * 1024;
+var SKIPPED2 = /* @__PURE__ */ new Set([".git", "node_modules"]);
+var workspacePath = (id) => `/sessions/${encodeURIComponent(id)}/workspace`;
+async function listFiles2(id, path, hidden) {
+  const query = new URLSearchParams();
+  if (path) query.set("path", path);
+  if (hidden) query.set("hidden", "true");
+  const qs = query.toString();
+  return api("GET", `${workspacePath(id)}/files${qs ? `?${qs}` : ""}`);
 }
-function installedVersion(dir) {
-  try {
-    const marker = JSON.parse(readFileSync9(join10(dir, SKILL_MARKER), "utf8"));
-    return typeof marker.version === "string" ? marker.version : null;
-  } catch {
-    return null;
+function entryLine(e) {
+  const size = e.type === "directory" ? "-" : String(e.size ?? 0);
+  return `${e.type === "directory" ? "d" : "-"} ${size.padStart(10)}  ${(e.mtime ?? "").slice(0, 16).replace("T", " ")}  ${e.name}${e.type === "directory" ? "/" : ""}`;
+}
+async function readFile(id, path) {
+  return (await apiBytes("GET", `${workspacePath(id)}/files/content?path=${encodeURIComponent(path)}`)).bytes;
+}
+function renderChanges(changes) {
+  if (!changes.repos.length) return [`no git repository under ${changes.root}`];
+  return changes.repos.flatMap((r) => [
+    `${r.path === "." ? changes.root : r.path}: ${r.status ? "changed" : "clean"}`,
+    ...(r.stat ?? r.status ?? "").split("\n").filter(Boolean).map((line) => `  ${line}`)
+  ]);
+}
+async function workspacePatch(id, repo) {
+  const { patch, ...meta } = await api("POST", `${workspacePath(id)}/patch`, { repo });
+  return { meta, patch: Buffer.from(patch, "base64") };
+}
+function folderFiles(dir) {
+  const git2 = spawnSync4("git", ["-C", dir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8" });
+  const top = spawnSync4("git", ["-C", dir, "rev-parse", "--show-prefix"], { encoding: "utf8" });
+  if (git2.status === 0 && top.status === 0) {
+    return git2.stdout.split("\0").filter((path) => path && statSync6(join12(dir, path), { throwIfNoEntry: false })?.isFile());
   }
+  const files2 = [];
+  const walk = (at) => {
+    for (const entry2 of readdirSync5(at, { withFileTypes: true })) {
+      if (SKIPPED2.has(entry2.name)) continue;
+      const full = join12(at, entry2.name);
+      if (entry2.isDirectory()) walk(full);
+      else if (entry2.isFile()) files2.push(relative3(dir, full));
+    }
+  };
+  walk(dir);
+  return files2;
 }
-function isInstalledSkill(dir) {
-  return installedVersion(dir) !== null;
+function folderArchive(dir, files2) {
+  const tar = spawnSync4("tar", ["--format=ustar", "-czf", "-", "-C", dir, "-T", "-"], {
+    input: files2.join("\n"),
+    env: { ...process.env, COPYFILE_DISABLE: "1" },
+    maxBuffer: 2 * 1024 * 1024 * 1024
+  });
+  if (tar.status !== 0) throw new ApiError(400, "archive_failed", `tar failed: ${tar.stderr.toString().trim()}`);
+  return tar.stdout;
 }
-function installSkill(agent2, opts = {}) {
-  const dir = join10(agent2.skillsDir, SKILL_NAME);
-  const previous = installedVersion(dir);
-  const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
-  if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
-  if (outcome !== "current") {
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join10(dir, "SKILL.md"), skillDocument());
-    writeFileSync4(join10(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
-`);
+async function importFolder(id, dir, opts = {}) {
+  const root = resolve5(dir);
+  const name = opts.name ?? basename7(root);
+  const archive = opts.archive ?? folderArchive(root, folderFiles(root));
+  if (archive.length <= SINGLE_IMPORT_MAX) {
+    const res = await apiBytes("POST", `${workspacePath(id)}/import?name=${encodeURIComponent(name)}`, { bytes: archive, mediaType: "application/gzip" });
+    return res.json();
   }
-  if (opts.catalog) {
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join10(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+  const sha256 = createHash5("sha256").update(archive).digest("hex");
+  let upload = await api("POST", `${workspacePath(id)}/imports`, { name, size: archive.length, sha256, part_size: PART_SIZE });
+  const uploadPath = `${workspacePath(id)}/imports/${encodeURIComponent(upload.id)}`;
+  for (let part = 0; part < upload.parts; part += 1) {
+    if (upload.received.includes(part)) continue;
+    const bytes = archive.subarray(part * upload.part_size, (part + 1) * upload.part_size);
+    await apiBytes("PUT", `${uploadPath}/parts/${part}`, { bytes, mediaType: "application/octet-stream" });
   }
-  const refsDir = join10(dir, REFERENCES_DIR);
-  mkdirSync2(refsDir, { recursive: true });
-  writeFileSync4(join10(refsDir, "import.md"), importReferenceDoc());
-  writeFileSync4(join10(refsDir, "workspaces.md"), workspacesReferenceDoc());
-  writeFileSync4(join10(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
-  return { agent: agent2.id, path: dir, outcome };
+  upload = await api("POST", `${uploadPath}/complete`);
+  while (upload.state !== "imported" && upload.state !== "failed") {
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
+    upload = await api("GET", uploadPath);
+  }
+  if (upload.state === "failed") throw new ApiError(422, upload.error?.code ?? "import_failed", upload.error?.message ?? "the import failed");
+  return { path: upload.path ?? name, files: upload.files ?? 0 };
 }
-
-// src/mcp-register.ts
-var MCP_SERVER_NAME = SKILL_NAME;
-var CODEX_TOKEN_ENV = "AGENTSKY_API_KEY";
-function systemCommandRunner() {
+function renderAccess(a) {
+  const lines = [
+    `${a.session_id}${a.title ? ` \u2014 ${a.title}` : ""}`,
+    `  ${a.visibility === "private" ? "private to its owner" : `visible to ${a.workspace.name} (${a.workspace.slug})`} \xB7 you are its ${a.access}`,
+    `  owner: ${a.owner.name ?? a.owner.email ?? "unknown"}`
+  ];
+  if (a.viewers) lines.push(a.viewers.length ? `  viewers: ${a.viewers.map((v) => v.email).join(", ")}` : "  viewers: none");
+  return lines;
+}
+function accessPatch(opts) {
+  if (opts.private && opts.members) throw new ApiError(400, "invalid_request", "pass --private or --members, not both");
   return {
-    has: (command) => spawnSync4(command, ["--version"], { stdio: "ignore" }).status === 0,
-    run: (command, args) => {
-      const result = spawnSync4(command, args, { encoding: "utf8" });
-      return { status: result.status, stderr: result.stderr ?? "" };
-    }
+    ...opts.private ? { visibility: "private" } : opts.members ? { visibility: "workspace" } : {},
+    ...opts.addViewer?.length ? { add_viewers: opts.addViewer } : {},
+    ...opts.removeViewer?.length ? { remove_viewers: opts.removeViewer } : {}
   };
 }
-function mcpUrlFor(apiBase2) {
-  return `${apiBase2.replace(/\/$/, "")}/mcp`;
+function engineChange(model, thinking) {
+  if (!model && !thinking) return null;
+  return {
+    ...model ? { llm: model } : {},
+    ...thinking ? { reasoningEffort: thinking === "default" ? null : thinking } : {}
+  };
 }
-function mcpCommands(agent2, opts) {
-  if (agent2 === "claude_code") {
-    return {
-      command: "claude",
-      remove: ["mcp", "remove", "--scope", "user", MCP_SERVER_NAME],
-      add: ["mcp", "add", "--scope", "user", "--transport", "http", MCP_SERVER_NAME, opts.mcpUrl, "--header", `Authorization: Bearer ${opts.token}`]
-    };
-  }
-  if (agent2 === "codex") {
-    return {
-      command: "codex",
-      remove: ["mcp", "remove", MCP_SERVER_NAME],
-      add: ["mcp", "add", MCP_SERVER_NAME, "--url", opts.mcpUrl, "--bearer-token-env-var", CODEX_TOKEN_ENV]
-    };
+var TERMINAL = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
+async function handoff(id, targetAgent, opts = {}) {
+  let { handoff: h } = await api("POST", `/sessions/${encodeURIComponent(id)}/handoff`, {
+    target_agent: targetAgent,
+    ...opts.fromMessage ? { last_message_id: opts.fromMessage } : {}
+  }, { idempotencyKey: opts.idempotencyKey ?? randomUUID() });
+  opts.onStatus?.(h);
+  while (opts.wait && !TERMINAL.has(h.status)) {
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
+    const next = (await api("GET", `/session-handoffs/${encodeURIComponent(h.id)}`)).handoff;
+    if (next.status !== h.status) opts.onStatus?.(next);
+    h = next;
   }
-  return null;
+  return h;
 }
-function redact(text, token) {
-  return text.split(token).join(`${token.slice(0, 10)}\u2026`);
+
+// src/render.ts
+var dim = (s) => `\x1B[2m${s}\x1B[0m`;
+var red = (s) => `\x1B[31m${s}\x1B[0m`;
+function clip(value, max = 120) {
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  return text.length > max ? `${text.slice(0, max)}\u2026` : text;
 }
-function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
-  if (agent2.id === "cursor") {
-    return registerCursorMcpServer(agent2, opts);
-  }
-  const commands = mcpCommands(agent2.id, opts);
-  if (!commands) return { agent: agent2.id, outcome: "unsupported" };
-  if (!runner.has(commands.command)) return { agent: agent2.id, outcome: "no_command", detail: `${commands.command} is not on PATH` };
-  if (opts.dryRun) return { agent: agent2.id, outcome: "planned", detail: redact([commands.command, ...commands.add].join(" "), opts.token) };
-  runner.run(commands.command, commands.remove);
-  const added = runner.run(commands.command, commands.add);
-  if (added.status !== 0) return { agent: agent2.id, outcome: "failed", detail: redact(added.stderr.trim() || `exit ${added.status}`, opts.token) };
-  return agent2.id === "codex" ? { agent: agent2.id, outcome: "registered", detail: `set ${CODEX_TOKEN_ENV} to an AgentSky API token in the shell that runs codex` } : { agent: agent2.id, outcome: "registered" };
-}
-function registerCursorMcpServer(agent2, opts) {
-  const configPath2 = `${agent2.root}/mcp.json`;
-  const entry2 = {
-    url: opts.mcpUrl,
-    headers: { Authorization: `Bearer ${opts.token}` }
-  };
-  if (opts.dryRun) {
-    const preview = JSON.stringify({ agentsky: { url: opts.mcpUrl, headers: { Authorization: `Bearer ${opts.token.slice(0, 10)}\u2026` } } }, null, 2);
-    return { agent: agent2.id, outcome: "planned", detail: `would write to ${configPath2}: ${preview}` };
+function renderEvent(event, data) {
+  const part = data.part;
+  switch (event) {
+    case "agent.message":
+      console.log(String(data.text ?? ""));
+      break;
+    case "agent.reasoning":
+      console.log(dim(`\xB7 ${clip(part?.text ?? "")}`));
+      break;
+    case "agent.tool_use":
+      console.log(dim(`\u2192 ${String(part?.tool_name ?? "tool")}(${clip(part?.args ?? {}, 80)})`));
+      break;
+    case "agent.tool_result":
+      console.log(dim(`\u2190 ${String(part?.tool_name ?? "tool")} ${String(part?.status ?? "")}`));
+      break;
+    case "agent.status":
+      console.log(dim(`\u2026 ${String(part?.level ?? "")} ${String(part?.text ?? "")}`.trim()));
+      break;
+    case "user.interrupt":
+      console.log(dim("\u23F9 interrupting"));
+      break;
+    case "session.error": {
+      const error = data.error;
+      const message2 = String(error?.message ?? error?.type ?? "unknown");
+      if (error?.retry_status === "retrying") console.error(dim(`retrying: ${message2}`));
+      else console.error(red(`error: ${message2}`));
+      break;
+    }
+    case "session.status_terminated":
+      console.log(dim("session terminated"));
+      break;
+    default:
+      break;
   }
-  let existing = { mcpServers: {} };
-  try {
-    const raw = readFileSync10(configPath2, "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      existing = parsed;
+}
+
+// src/session-read.ts
+var TURN_TYPES = ["user.message", "agent.message", "session.status_idle", "session.status_terminated", "session.error"];
+function latestTurn(events) {
+  let start = 0;
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    if (events[index].type === "user.message") {
+      start = index + 1;
+      break;
     }
-  } catch {
   }
-  const updated = {
-    ...existing,
-    mcpServers: { ...existing.mcpServers ?? {}, [MCP_SERVER_NAME]: entry2 }
-  };
-  try {
-    writeFileSync5(configPath2, JSON.stringify(updated, null, 2) + "\n", "utf8");
-  } catch (err) {
-    return { agent: agent2.id, outcome: "failed", detail: String(err) };
+  const reading = { finished: false, messages: [], errors: [] };
+  for (const event of events.slice(start)) {
+    if (event.type === "agent.message" && event.text?.trim()) reading.messages.push(event.text);
+    else if (event.type === "session.error" && event.error?.retry_status !== "retrying") {
+      reading.errors.push(event.error?.message ?? event.error?.type ?? "unknown error");
+    } else if (event.type === "session.status_terminated") reading.finished = true;
+    else if (event.type === "session.status_idle" && event.stop_reason?.type !== "requires_action") reading.finished = true;
+  }
+  return reading;
+}
+async function history2(sessionId) {
+  const events = [];
+  let cursor = null;
+  for (; ; ) {
+    const query = new URLSearchParams({ limit: "500" });
+    for (const type of TURN_TYPES) query.append("types[]", type);
+    if (cursor) query.set("cursor", cursor);
+    const page = await api(
+      "GET",
+      `/sessions/${encodeURIComponent(sessionId)}/events?${query}`
+    );
+    events.push(...page.events);
+    if (!page.hasMore || !page.cursor) return events;
+    cursor = page.cursor;
+  }
+}
+async function readTurn(sessionId, opts = {}) {
+  const deadline = Date.now() + (opts.timeoutSeconds ?? 600) * 1e3;
+  for (; ; ) {
+    const reading = latestTurn(await history2(sessionId));
+    if (reading.finished || !opts.wait || Date.now() >= deadline) return reading;
+    await new Promise((resolve10) => setTimeout(resolve10, opts.intervalMs ?? 3e3));
   }
-  return { agent: agent2.id, outcome: "registered" };
 }
 
+// src/setup.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname7, join as join15 } from "path";
+import { createInterface as createInterface3 } from "readline";
+
 // src/setup-local.ts
 import { isUtf8 as isUtf83 } from "buffer";
-import { existsSync as existsSync7, readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync7 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join11, resolve as resolve6 } from "path";
-import { parse as parseToml3 } from "smol-toml";
+import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync7 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join13, resolve as resolve6 } from "path";
+import { parse as parseToml4 } from "smol-toml";
 var MAX_SKILL_FILE_BYTES = 1024 * 1024;
 var MAX_IMPORT_DEPTH = 5;
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
@@ -3347,11 +3512,11 @@ function redacted(data) {
 function skillFiles2(root, prefix) {
   const files2 = [];
   for (const entry2 of readdirSync6(root, { withFileTypes: true })) {
-    const path = join11(root, entry2.name);
+    const path = join13(root, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIPPED_DIRS.has(entry2.name)) files2.push(...skillFiles2(path, `${prefix}/${entry2.name}`));
     } else if (entry2.isFile() && !sensitive(entry2.name) && statSync7(path).size <= MAX_SKILL_FILE_BYTES) {
-      const bytes = redacted(readFileSync11(path));
+      const bytes = redacted(readFileSync12(path));
       if (bytes) files2.push({ path: `${prefix}/${entry2.name}`, bytes });
     }
   }
@@ -3361,9 +3526,9 @@ function readLocalSkills(agents) {
   const skills2 = [];
   const ignored = [];
   for (const agent2 of agents) {
-    if (!existsSync7(agent2.skillsDir)) continue;
+    if (!existsSync9(agent2.skillsDir)) continue;
     for (const entry2 of readdirSync6(agent2.skillsDir, { withFileTypes: true })) {
-      const dir = join11(agent2.skillsDir, entry2.name);
+      const dir = join13(agent2.skillsDir, entry2.name);
       let isDir2 = entry2.isDirectory();
       if (entry2.isSymbolicLink()) {
         try {
@@ -3372,8 +3537,8 @@ function readLocalSkills(agents) {
           isDir2 = false;
         }
       }
-      if (!isDir2 || !existsSync7(join11(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
-      const name = frontmatterName(readFileSync11(join11(dir, "SKILL.md"), "utf8"));
+      if (!isDir2 || !existsSync9(join13(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
+      const name = frontmatterName(readFileSync12(join13(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
         continue;
@@ -3401,11 +3566,11 @@ function inlineImports(content, from, home, depth, seen) {
     }
     const target = fence ? void 0 : line.match(/^@(\S+\.(?:md|markdown|txt))$/i)?.[1];
     if (!target || depth >= MAX_IMPORT_DEPTH) return line;
-    const path = target.startsWith("~/") ? join11(home, target.slice(2)) : isAbsolute2(target) ? target : resolve6(dirname5(from), target);
+    const path = target.startsWith("~/") ? join13(home, target.slice(2)) : isAbsolute2(target) ? target : resolve6(dirname6(from), target);
     if (seen.includes(path)) return "";
     let imported;
     try {
-      imported = readFileSync11(path, "utf8");
+      imported = readFileSync12(path, "utf8");
     } catch {
       return line;
     }
@@ -3413,15 +3578,15 @@ function inlineImports(content, from, home, depth, seen) {
     return inlineImports(imported, path, home, depth + 1, seen).trim();
   }).join("\n");
 }
-function readGlobalInstructions(agents, home = homedir6()) {
+function readGlobalInstructions(agents, home = homedir8()) {
   const found = [];
   for (const agent2 of agents) {
     const file = INSTRUCTION_FILES2[agent2.id];
     if (!file) continue;
-    const path = join11(agent2.root, file);
+    const path = join13(agent2.root, file);
     let raw;
     try {
-      raw = readFileSync11(path, "utf8");
+      raw = readFileSync12(path, "utf8");
     } catch {
       continue;
     }
@@ -3440,7 +3605,7 @@ ${item.content.trim()}`).join("\n\n");
 }
 function readJson3(path) {
   try {
-    return JSON.parse(readFileSync11(path, "utf8"));
+    return JSON.parse(readFileSync12(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -3454,18 +3619,19 @@ function bearerOf(def) {
   return match?.[1] ?? null;
 }
 function serversOf(agent2, home) {
-  if (agent2.id === "claude_code") return readJson3(join11(home, ".claude.json"))?.mcpServers ?? {};
-  if (agent2.id === "cursor") return readJson3(join11(agent2.root, "mcp.json"))?.mcpServers ?? {};
+  if (agent2.id === "claude_code") return readJson3(join13(home, ".claude.json"))?.mcpServers ?? {};
+  if (agent2.id === "cursor") return readJson3(join13(agent2.root, "mcp.json"))?.mcpServers ?? {};
   try {
-    return parseToml3(readFileSync11(join11(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
+    return parseToml4(readFileSync12(join13(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
   } catch {
     return {};
   }
 }
-function findLocalSecrets(agents, home = homedir6()) {
+function findLocalSecrets(agents, home = homedir8()) {
   const secrets2 = [];
   for (const agent2 of agents) {
     for (const [name, def] of Object.entries(serversOf(agent2, home))) {
+      if (name === SKILL_NAME) continue;
       if (!def || typeof def !== "object" || typeof def.url !== "string" || !/^https:\/\//i.test(def.url)) continue;
       const token = bearerOf(def);
       if (!token || /^\$\{?[A-Za-z_]/.test(token)) continue;
@@ -3478,9 +3644,9 @@ function findLocalSecrets(agents, home = homedir6()) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync12 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join12 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join14 } from "path";
 import { createInterface as createInterface2 } from "readline";
 var ALIASES = {
   claude: "anthropic",
@@ -3575,12 +3741,12 @@ async function connectClaude() {
   const expiry = sub.expiresAt ? ` (expires ~${sub.expiresAt.slice(0, 10)})` : "";
   console.log(`Connected Claude subscription${expiry}. Powers new eligible agents.`);
 }
-function codexSignIn(env = process.env, home = homedir7()) {
-  const path = join12(env.CODEX_HOME || join12(home, ".codex"), "auth.json");
-  if (!existsSync8(path)) {
+function codexSignIn(env = process.env, home = homedir9()) {
+  const path = join14(env.CODEX_HOME || join14(home, ".codex"), "auth.json");
+  if (!existsSync10(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
-  const raw = readFileSync12(path, "utf8");
+  const raw = readFileSync13(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     return { path, raw, account: parsed.tokens?.account_id };
@@ -3588,12 +3754,12 @@ function codexSignIn(env = process.env, home = homedir7()) {
     throw new ApiError(400, "invalid_codex_auth", `${path} isn't valid JSON \u2014 re-run \`codex login\``);
   }
 }
-function cursorSignIn(env = process.env, home = homedir7()) {
-  const path = join12(env.XDG_CONFIG_HOME || join12(home, ".config"), "cursor", "auth.json");
-  if (!existsSync8(path)) {
+function cursorSignIn(env = process.env, home = homedir9()) {
+  const path = join14(env.XDG_CONFIG_HOME || join14(home, ".config"), "cursor", "auth.json");
+  if (!existsSync10(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
-  const raw = readFileSync12(path, "utf8");
+  const raw = readFileSync13(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") throw new Error("shape");
@@ -3752,11 +3918,11 @@ function planProviders(names2) {
   }));
 }
 function reportPath() {
-  return join13(dirname6(configPath()), "setup.json");
+  return join15(dirname7(configPath()), "setup.json");
 }
 function loadReport() {
   try {
-    const saved = JSON.parse(readFileSync13(reportPath(), "utf8"));
+    const saved = JSON.parse(readFileSync14(reportPath(), "utf8"));
     return { agents: saved.agents ?? [], plans: saved.plans ?? [], ...saved.secrets ? { secrets: saved.secrets } : {} };
   } catch {
     return { agents: [], plans: [] };
@@ -3769,8 +3935,8 @@ function mergeReport(base, next) {
   return { agents, plans, ...secrets2 ? { secrets: secrets2 } : {} };
 }
 function saveReport(report) {
-  mkdirSync3(dirname6(reportPath()), { recursive: true });
-  writeFileSync6(reportPath(), `${JSON.stringify(report, null, 2)}
+  mkdirSync4(dirname7(reportPath()), { recursive: true });
+  writeFileSync7(reportPath(), `${JSON.stringify(report, null, 2)}
 `, { mode: 384 });
 }
 function confirm3(question) {
@@ -3788,7 +3954,7 @@ function kb2(bytes) {
 function describe2(event) {
   switch (event.type) {
     case "agents":
-      return event.agents.length ? `Found on this computer: ${event.agents.map((agent2) => agent2.name).join(", ")}` : "No agent found on this computer (looked for Claude Code, Codex and Cursor).";
+      return event.agents.length ? `Found on this computer: ${event.agents.map((agent2) => agent2.name).join(", ")}` : "No agent found on this computer (looked for Claude Code, Codex, Cursor and Hermes).";
     case "catalog":
       return event.outcome === "read" ? `  agent catalog: ${event.agents} agent${event.agents === 1 ? "" : "s"}` : `  agent catalog: not read${event.detail ? ` (${event.detail})` : ""}; the skill looks agents up with search_catalog`;
     case "skill":
@@ -3798,12 +3964,23 @@ function describe2(event) {
         case "registered":
           return `  agentsky MCP server registered for ${event.agent}${event.detail ? ` (${event.detail})` : ""}`;
         case "planned":
-          return `  would run: ${event.detail}`;
+          return `  ${event.agent}: would ${event.detail}`;
         case "unsupported":
           return null;
         default:
           return `  agentsky MCP server not registered for ${event.agent}: ${event.detail ?? event.outcome}`;
       }
+    case "env":
+      switch (event.outcome) {
+        case "written":
+          return `  new shells get ${event.variable} for this login (open a new terminal, or run: . ${event.files[0]})`;
+        case "planned":
+          return `  would write ${event.variable} to ${event.files.join(", ")}`;
+        case "cleared":
+          return null;
+        default:
+          return `  ${event.variable} not set for new shells: ${event.detail ?? event.outcome}`;
+      }
     case "plan":
       return `  ${event.provider} plan: ${event.outcome === "already" ? "already connected" : event.outcome}${event.detail ? ` (${event.detail})` : ""}`;
     case "found": {
@@ -3893,8 +4070,11 @@ async function runSetup(opts) {
   };
   const agreed = async (question) => !interactive || confirm3(question);
   const has = (step) => steps.includes(step);
-  const agents = selectLocalAgents(opts.agents);
-  emit({ type: "agents", agents: agents.map((agent2) => ({ id: agent2.id, name: agent2.name })) });
+  const named = opts.agents?.filter((id) => id !== "hermes");
+  const agents = opts.agents?.length && !named?.length ? [] : selectLocalAgents(named);
+  const hermes = !opts.agents?.length || opts.agents.includes("hermes") ? detectHermes() : null;
+  const mcpOnly = hermes ? [hermes] : [];
+  emit({ type: "agents", agents: [...agents, ...mcpOnly].map((agent2) => ({ id: agent2.id, name: agent2.name })) });
   const needsToken = !opts.dryRun && (has("skill") || has("logins") || has("secrets") || has("import") && !opts.key);
   if (needsToken && !apiToken()) {
     if (opts.json) throw new ApiError(401, "not_logged_in", "not logged in \u2014 run `sky auth login`");
@@ -3916,10 +4096,14 @@ async function runSetup(opts) {
     held = new Map((claimed.body.skills ?? []).map((skill) => [skill.name, skill.fingerprint]));
   };
   await tell();
-  if (has("skill") && agents.length && await agreed("Add the AgentSky skill and MCP server to these agents, so they can hand work to others?")) {
+  if (has("skill") && (agents.length || mcpOnly.length) && await agreed("Add the AgentSky skill and MCP server to these agents, so they can hand work to others?")) {
     const { catalog: catalog2, detail } = await readCatalog();
     emit(catalog2 ? { type: "catalog", outcome: "read", agents: catalog2.length } : { type: "catalog", outcome: "unavailable", ...detail ? { detail } : {} });
     const token = apiToken();
+    const registerMcp = (client) => {
+      const registered = token ? registerMcpServer(client, { token, mcpUrl: mcpUrlFor(apiBase()), dryRun: opts.dryRun }) : { agent: client.id, outcome: "skipped", detail: "not logged in" };
+      emit({ type: "mcp", agent: client.id, outcome: registered.outcome, ...registered.detail ? { detail: registered.detail } : {} });
+    };
     for (const agent2 of agents) {
       try {
         const installed = installSkill(agent2, { dryRun: opts.dryRun, catalog: catalog2 });
@@ -3931,8 +4115,12 @@ async function runSetup(opts) {
         run2.agents.push({ id: agent2.id, skill: "failed" });
         continue;
       }
-      const registered = token ? registerMcpServer(agent2, { token, mcpUrl: mcpUrlFor(apiBase()), dryRun: opts.dryRun }) : { agent: agent2.id, outcome: "skipped", detail: "not logged in" };
-      emit({ type: "mcp", agent: agent2.id, outcome: registered.outcome, ...registered.detail ? { detail: registered.detail } : {} });
+      registerMcp(agent2);
+    }
+    for (const client of mcpOnly) registerMcp(client);
+    if (token) {
+      const shell = writeShellEnv(token, { dryRun: opts.dryRun });
+      emit({ type: "env", variable: TOKEN_ENV, outcome: shell.outcome, files: shell.files, ...shell.detail ? { detail: shell.detail } : {} });
     }
     await tell();
   }
@@ -4119,17 +4307,17 @@ function renderArtifact(artifact2) {
 }
 
 // src/skills-store.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync14, statSync as statSync8 } from "fs";
-import { basename as basename7, join as join14, relative as relative4, resolve as resolve7 } from "path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync15, statSync as statSync8 } from "fs";
+import { basename as basename8, join as join16, relative as relative4, resolve as resolve7 } from "path";
 function skillBundle(dir) {
   const root = resolve7(dir);
-  const top = basename7(root);
+  const top = basename8(root);
   const files2 = [];
   const walk = (path) => {
     for (const name of readdirSync7(path).sort()) {
-      const full = join14(path, name);
+      const full = join16(path, name);
       if (statSync8(full).isDirectory()) walk(full);
-      else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync14(full) });
+      else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync15(full) });
     }
   };
   walk(root);
@@ -4139,7 +4327,7 @@ function skillBundle(dir) {
 async function uploadSkill(dir, displayName) {
   const form = new FormData();
   for (const file of skillBundle(dir)) form.append("files", new Blob([new Uint8Array(file.bytes)]), file.path);
-  form.append("displayName", displayName ?? basename7(resolve7(dir)));
+  form.append("displayName", displayName ?? basename8(resolve7(dir)));
   return apiForm("POST", "/skills", form);
 }
 async function listSkills() {
@@ -4168,8 +4356,8 @@ async function getSkillUsage(since) {
 
 // src/task-export.ts
 import { createHash as createHash6 } from "crypto";
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname7, join as join15 } from "path";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname8, join as join17 } from "path";
 import { stringify as stringifyToml2 } from "smol-toml";
 var TEXT_MAX = 2e4;
 function scrub(text, names2) {
@@ -4457,14 +4645,14 @@ async function exportTaskHarbor(taskRef, outDir, opts) {
     fileBytes.set(file.path, bytes);
   }
   const files2 = buildHarborTask(record, { ...opts, fileBytes });
-  const written = [];
+  const written2 = [];
   for (const [path, content] of files2) {
-    const target = join15(outDir, path);
-    mkdirSync4(dirname7(target), { recursive: true });
-    writeFileSync7(target, content, typeof content === "string" ? { mode: path.endsWith(".sh") || path.endsWith(".py") ? 493 : 420 } : void 0);
-    written.push(path);
+    const target = join17(outDir, path);
+    mkdirSync5(dirname8(target), { recursive: true });
+    writeFileSync8(target, content, typeof content === "string" ? { mode: path.endsWith(".sh") || path.endsWith(".py") ? 493 : 420 } : void 0);
+    written2.push(path);
   }
-  return { written, record };
+  return { written: written2, record };
 }
 function parseRedactNames(values) {
   return (values ?? []).map((value) => {
@@ -4806,19 +4994,19 @@ function renderThreadSummary(t) {
 }
 
 // src/harness.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname8, join as join16, resolve as resolve8 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname9, join as join18, resolve as resolve8 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
-  return join16(resolve8(dir), HARNESS_FILE);
+  return join18(resolve8(dir), HARNESS_FILE);
 }
 function readHarnessFile(dir) {
   const path = harnessFilePath(dir);
-  if (!existsSync9(path)) {
+  if (!existsSync11(path)) {
     throw new Error(`no ${HARNESS_FILE} found in ${resolve8(dir)} \u2014 run \`sky harness init\` first`);
   }
   try {
-    return JSON.parse(readFileSync15(path, "utf8"));
+    return JSON.parse(readFileSync16(path, "utf8"));
   } catch (err) {
     throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -4845,11 +5033,11 @@ var INIT_COMMENT = `# harness.json \u2014 workspace harness profile skeleton
 `;
 function harnessInit(dir) {
   const path = harnessFilePath(dir);
-  if (existsSync9(path)) {
+  if (existsSync11(path)) {
     throw new Error(`${path} already exists \u2014 delete it to re-init`);
   }
-  mkdirSync5(dirname8(path), { recursive: true });
-  writeFileSync8(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+  mkdirSync6(dirname9(path), { recursive: true });
+  writeFileSync9(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
 `);
   console.log(`Created ${path}`);
   console.log(INIT_COMMENT);
@@ -5010,6 +5198,7 @@ auth.command("logout").description("forget the stored token (revoke it in Develo
   run(async () => {
     saveConfig({ ...loadConfig(), token: void 0, email: void 0 });
     console.log(`Logged out. (Token revocation: Developer \u2192 API keys.)`);
+    for (const line of syncLocalAccess(void 0)) console.log(line);
   })
 );
 auth.command("whoami").description("who the current token acts as").action(
@@ -5558,7 +5747,7 @@ sessionWorkspace.command("cat <ref> <path>").description("print a file (up to 1
   run(async (ref, path, opts) => {
     const bytes = await readFile(await resolveSessionRef(ref), path);
     if (opts.out) {
-      writeFileSync9(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.error(`saved ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -5575,7 +5764,7 @@ sessionWorkspace.command("patch <ref> [repo]").description("the work in a reposi
     console.error(`${meta.repo}: ${meta.commits.length} commit${meta.commits.length === 1 ? "" : "s"} since ${meta.base_branch || "the imported copy"} (${meta.base_commit.slice(0, 12)})`);
     if (!patch.length) console.error("nothing changed");
     else if (opts.out) {
-      writeFileSync9(opts.out, patch);
+      writeFileSync10(opts.out, patch);
       console.error(`wrote ${opts.out} \u2014 apply with: git apply ${opts.out}`);
     } else process.stdout.write(patch);
   })
@@ -5720,7 +5909,7 @@ catalog.command("search [words...]").description("find an agent for a piece of w
 Start one:  sky session create @<handle> --message "<the job>"`);
   })
 );
-program.command("skill").description("the AgentSky skill for the agents on this machine").command("install").description("add the AgentSky skill to each installed agent (Claude Code, Codex, Cursor)").option("--agent <id...>", "only these agents: claude_code | codex | cursor").option("--dry-run", "say what would be written; write nothing").option("--json", "print the outcome per agent as JSON").action(
+program.command("skill").description("the AgentSky skill for the agents on this machine").command("install").description("add the AgentSky skill to each installed agent (Claude Code, Codex, Cursor)").option("--agent <id...>", "only these agents: claude_code | codex | cursor | hermes").option("--dry-run", "say what would be written; write nothing").option("--json", "print the outcome per agent as JSON").action(
   run(async (opts) => {
     const installs = selectLocalAgents(opts.agent).map((a) => installSkill(a, { dryRun: opts.dryRun }));
     if (opts.json) {
@@ -5736,7 +5925,7 @@ program.command("skill").description("the AgentSky skill for the agents on this
   })
 );
 program.command("setup [steps...]").description("bring this machine's agents to AgentSky: the skill and its MCP server, your plans, your skills and instructions, your tool keys").addHelpText("after", `
-Steps (all when none is named): ${SETUP_STEPS.join(" | ")}`).option("--key <key>", "a setup key from agentsky.dev/setup").option("--agent <id...>", "only these agents: claude_code | codex | cursor").option("--secret <name...>", "save these tool keys to your vault (asked one by one when omitted)").option("--no-claude", "leave the Claude plan alone").option("--plan <name...>", "connect only these plans: claude | chatgpt | cursor").option("--dry-run", "say what would be done; write and send nothing").option("-y, --yes", "do not ask before each step").option("--json", "print progress as one JSON object per line; never asks").action(
+Steps (all when none is named): ${SETUP_STEPS.join(" | ")}`).option("--key <key>", "a setup key from agentsky.dev/setup").option("--agent <id...>", "only these agents: claude_code | codex | cursor | hermes").option("--secret <name...>", "save these tool keys to your vault (asked one by one when omitted)").option("--no-claude", "leave the Claude plan alone").option("--plan <name...>", "connect only these plans: claude | chatgpt | cursor").option("--dry-run", "say what would be done; write and send nothing").option("-y, --yes", "do not ask before each step").option("--json", "print progress as one JSON object per line; never asks").action(
   run(async (steps, opts) => {
     const unknown = steps.find((step) => !SETUP_STEPS.includes(step));
     if (unknown) throw new Error(`unknown step ${unknown} \u2014 expected ${SETUP_STEPS.join(" | ")}`);
@@ -5784,8 +5973,8 @@ secrets.command("unset <id> <key>").action(
 program.command("launch").description("scaffold ./agent.toml if absent, create the agent, print its address").option("-f, --file <path>", "agent file", "agent.toml").option("--type <type>", "override the file's harness: hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "override the file's model (must suit the harness)").action(
   run(async (opts) => {
     const path = resolve9(opts.file);
-    if (!existsSync10(path)) {
-      const name = basename8(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
+    if (!existsSync12(path)) {
+      const name = basename9(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
       scaffoldAgentFile(path, name);
       console.log(`Scaffolded ${opts.file} \u2014 edit it anytime; re-apply with \`sky deploy\`.`);
     }
@@ -6067,8 +6256,8 @@ files.command("rm <id>").description("delete a file (a session that already rece
 );
 files.command("download <id>").description("download a session file's bytes").requiredOption("-o, --out <path>", "where to write the bytes").action(
   run(async (id, opts) => {
-    const written = await downloadFileTo(id, opts.out);
-    console.log(`Wrote ${written} bytes to ${opts.out}`);
+    const written2 = await downloadFileTo(id, opts.out);
+    console.log(`Wrote ${written2} bytes to ${opts.out}`);
   })
 );
 var task = program.command("task").description("a task's shared files and open requests (the task is its first session's id)");
@@ -6083,14 +6272,14 @@ task.command("get <task> <path>").description("read one task file; prints it, or
   run(async (taskId, path, opts) => {
     const bytes = await readTaskFile(taskId, path);
     if (opts.out) {
-      writeFileSync9(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync16(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync17(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -6104,9 +6293,9 @@ task.command("export <task>").description("write the task's session record as a
   run(async (taskId, opts) => {
     const tier = opts.tier === "gold" || opts.tier === "exploratory" ? opts.tier : "silver";
     const outDir = opts.out ?? `./harbor-${taskId.replace(/[^A-Za-z0-9_-]/g, "_")}`;
-    const { written, record } = await exportTaskHarbor(taskId, outDir, { tier, redactNames: parseRedactNames(opts.redact) });
-    console.log(`Wrote ${written.length} files to ${outDir} (${record.threads.length} thread${record.threads.length === 1 ? "" : "s"}, ${record.files.length} task file${record.files.length === 1 ? "" : "s"}${record.goal ? ", goal rubric" : ", no goal: derived rubric"})`);
-    if (!written.includes("environment/Dockerfile")) console.log("environment/: not resettable from the record \u2014 see environment/README.md before running with Harbor");
+    const { written: written2, record } = await exportTaskHarbor(taskId, outDir, { tier, redactNames: parseRedactNames(opts.redact) });
+    console.log(`Wrote ${written2.length} files to ${outDir} (${record.threads.length} thread${record.threads.length === 1 ? "" : "s"}, ${record.files.length} task file${record.files.length === 1 ? "" : "s"}${record.goal ? ", goal rubric" : ", no goal: derived rubric"})`);
+    if (!written2.includes("environment/Dockerfile")) console.log("environment/: not resettable from the record \u2014 see environment/README.md before running with Harbor");
   })
 );
 task.command("show <task>").description("the task's sessions and the requests waiting on you (questions, approvals, apps to connect)").option("--json", "print the task as JSON").action(
@@ -6244,7 +6433,7 @@ artifact.command("get <id> <path>").description("read one file of an artifact; p
   run(async (id, path, opts) => {
     const bytes = await readArtifactFile(id, path);
     if (opts.out) {
-      writeFileSync9(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -6542,7 +6731,7 @@ usageOptions(
   run(async (opts) => {
     const { bytes } = await apiBytes("GET", `/billing/usage/export${usageQuery(opts)}`);
     if (opts.out) {
-      writeFileSync9(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else {
       process.stdout.write(bytes);
@@ -7093,7 +7282,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-HTWXINXI.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-PDIOL2TC.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -7128,7 +7317,7 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-HTWXINXI.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-PDIOL2TC.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -7141,14 +7330,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-HTWXINXI.js");
+  const { readState, flush, grantSender } = await import("./trace-PDIOL2TC.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-HTWXINXI.js");
+  const { readState, spoolStatus } = await import("./trace-PDIOL2TC.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -7158,7 +7347,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-HTWXINXI.js");
+  const { readState } = await import("./trace-PDIOL2TC.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -7185,7 +7374,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-HTWXINXI.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-PDIOL2TC.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -7194,8 +7383,8 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   clearState();
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
-traceCmd.command("sync [payload]").description("upload this machine's Claude Code and Codex sessions to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-QR54Q4Z3.js");
+traceCmd.command("sync [payload]").description("upload this machine's agent sessions (Claude Code, Codex, Cursor, Gemini CLI and every other agent `--agents` lists) to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--import <export>", "add a downloaded cloud export (claude.ai, ChatGPT, Gemini, Grok, DeepSeek \u2026: its .zip, folder or file) so sync uploads it (repeatable)", collect).option("--agents", "list the agents sync reads and which are on this machine").option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
+  const lib = await import("./trace-library-TA3QUBHJ.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -7236,17 +7425,28 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       };
       lib.saveSyncConfig(next);
       console.log(`Trace sync is ${next.enabled ? "on" : "off"} on this machine. It reads only:`);
-      for (const folder of lib.sourceFolders()) console.log(`  ${folder}`);
+      for (const folder of await lib.sourceFolders()) console.log(`  ${folder}`);
       console.log("and sends each session, redacted here first, to:");
       for (const rule of next.rules) console.log(`  folder path contains "${rule.match}" \u2192 ${rule.workspace}`);
       console.log(`  anything else \u2192 ${next.fallback ?? "stays on this machine"}`);
       console.log(`A repository's .agentsky.json "workspace" wins over these rules.`);
     }
+    if (opts.agents) {
+      for (const agent2 of await lib.supportedAgents()) {
+        const how = agent2.kind === "export" ? "cloud export: sky trace sync --import <file>" : agent2.found ? "found on this machine" : "not on this machine";
+        console.log(`  ${agent2.name.padEnd(46)} ${how}`);
+      }
+      return;
+    }
+    for (const input of opts.import ?? []) {
+      const imported = await lib.importExport(input);
+      console.log(`Added ${imported.sessions} ${imported.agent} session${imported.sessions === 1 ? "" : "s"} from ${input}.`);
+    }
     if (opts.installSchedule) {
-      const { join: join17 } = await import("path");
-      const { homedir: homedir8 } = await import("os");
+      const { join: join19 } = await import("path");
+      const { homedir: homedir10 } = await import("os");
       const { execFileSync } = await import("child_process");
-      const log = join17(homedir8(), ".config", "sky", "trace-sync.log");
+      const log = join19(homedir10(), ".config", "sky", "trace-sync.log");
       const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
       try {
         execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
@@ -7256,11 +7456,11 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       console.log(`Sweeping every 15 minutes (${plist}); a full re-read runs weekly. Log: ${log}`);
     }
     if (opts.status) {
-      const { readFileSync: readFileSync17 } = await import("fs");
-      const { join: join17 } = await import("path");
+      const { readFileSync: readFileSync18 } = await import("fs");
+      const { join: join19 } = await import("path");
       let state = { sessions: {} };
       try {
-        state = JSON.parse(readFileSync17(join17(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+        state = JSON.parse(readFileSync18(join19(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
       } catch {
       }
       const counts = /* @__PURE__ */ new Map();
@@ -7293,7 +7493,7 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
   })();
 });
 traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
-  const { libraryRequest } = await import("./trace-library-QR54Q4Z3.js");
+  const { libraryRequest } = await import("./trace-library-TA3QUBHJ.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
@@ -7310,7 +7510,7 @@ traceCmd.command("search <query...>").description("search every session in a wor
   if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-QR54Q4Z3.js");
+  const { libraryRequest } = await import("./trace-library-TA3QUBHJ.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);