@agentsky/sky 2.21.0 → 2.23.0

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   resolveSessionRef,
   streamEvents,
   uploadFile
-} from "./chunk-ZZ6UF7QA.js";
+} from "./chunk-HQPOCQRQ.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -20,7 +20,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-6JMFB3CV.js";
+} from "./chunk-V5XLV37X.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -42,12 +42,12 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-GHTAIKQ6.js";
+} from "./chunk-HDPDY77W.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
-import { basename as basename8, resolve as resolve9 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
+import { basename as basename9, resolve as resolve9 } from "path";
 import { createInterface as createInterface6 } from "readline";
 import { Command } from "commander";
 
@@ -410,6 +410,52 @@ function renderApiKey(key) {
   return `${key.id}  ${key.token_prefix}\u2026  ${key.status.padEnd(7)} ${key.scopes.join(",").padEnd(16)} ${where}  ${used}  ${key.name}${key.current ? "  (this key)" : ""}`;
 }
 
+// src/account-access.ts
+function linkToken(ref) {
+  const fromUrl = /\/s\/([A-Za-z0-9_-]+)\/?(?:[?#].*)?$/.exec(ref.trim());
+  const token = fromUrl ? fromUrl[1] : ref.trim();
+  if (!/^[A-Za-z0-9_-]{16,64}$/.test(token)) throw new ApiError(400, "invalid_request", "a share link is a /s/<token> URL or its token");
+  return token;
+}
+async function sendViaLink(ref, text, idempotencyKey) {
+  await api("POST", `/links/${encodeURIComponent(linkToken(ref))}/messages`, { text }, { idempotencyKey });
+}
+async function stopViaLink(ref) {
+  await api("POST", `/links/${encodeURIComponent(linkToken(ref))}/interrupt`);
+}
+function inviteCode(ref) {
+  const fromUrl = /\/i\/([^/?#]+)\/?(?:[?#].*)?$/.exec(ref.trim());
+  const code = fromUrl ? decodeURIComponent(fromUrl[1]) : ref.trim();
+  if (!code) throw new ApiError(400, "invalid_request", "a credit invite is an /i/<code> URL or its code");
+  return code;
+}
+async function claimCreditInvite(ref) {
+  return api("POST", "/billing/credit-invites/claim", { code: inviteCode(ref) });
+}
+function renderCreditInviteClaim(claim) {
+  const amount = `$${claim.amount_usd.toFixed(2)}`;
+  return claim.status === "granted" ? `Added ${amount} of credit to your balance` : `Already claimed: this link added ${amount} to your balance`;
+}
+async function listAppGrants() {
+  return (await api("GET", "/oauth_grants")).oauth_grants;
+}
+async function revokeAppGrant(clientId) {
+  await api("DELETE", `/oauth_grants/${encodeURIComponent(clientId)}`);
+}
+function renderAppGrant(grant) {
+  const since = grant.allowed_at ? `  since ${grant.allowed_at.slice(0, 10)}` : "";
+  const review = grant.review_status === "approved" ? "" : "  (unreviewed)";
+  return `${grant.client_id}  ${grant.name || "(unnamed)"}  ${grant.scopes.join(" ")}${since}${review}`;
+}
+async function unsubscribeMarketing() {
+  const { notification_preferences } = await api(
+    "PATCH",
+    "/notification-preferences",
+    { email: { marketing: false } }
+  );
+  return { marketing: notification_preferences.email.marketing };
+}
+
 // src/context.ts
 function memoryBody(operation, version) {
   return { ...operation, expectedVersion: version };
@@ -682,9 +728,9 @@ function readClaudeCode() {
     sources.push("global CLAUDE.md");
   }
   for (const name of ["CLAUDE.md", "AGENTS.md"]) {
-    const project = readIfExists(join3(process.cwd(), name));
-    if (project?.trim()) {
-      parts.push({ label: `Project ${name}`, content: project });
+    const project2 = readIfExists(join3(process.cwd(), name));
+    if (project2?.trim()) {
+      parts.push({ label: `Project ${name}`, content: project2 });
       sources.push(`project ${name}`);
       break;
     }
@@ -739,11 +785,11 @@ function linkPath(configRoot) {
   return join3(configRoot, "agentsky-link.json");
 }
 function readLink(configRoot) {
-  const link = readJson(linkPath(configRoot));
-  return link?.agentId ? link : void 0;
+  const link2 = readJson(linkPath(configRoot));
+  return link2?.agentId ? link2 : void 0;
 }
-function writeLink(configRoot, link) {
-  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
+function writeLink(configRoot, link2) {
+  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link2, null, 2)}
 `);
 }
 var DEFAULT_VAULT_NAME = "default";
@@ -909,14 +955,14 @@ async function createClone(local, opts) {
   await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
   if (opts.open) openBrowser(url);
 }
-async function syncClone(local, link, opts) {
-  const since = link.lastSyncedAt ?? link.clonedAt;
+async function syncClone(local, link2, opts) {
+  const since = link2.lastSyncedAt ?? link2.clonedAt;
   console.log(
-    `Syncing ${link.agentId} from ${local.configRoot} (last synced ${since ? new Date(since).toLocaleDateString() : "never"})`
+    `Syncing ${link2.agentId} from ${local.configRoot} (last synced ${since ? new Date(since).toLocaleDateString() : "never"})`
   );
   if (opts.dryRun) {
     console.log(
-      `  would push prompt (${kb(local.prompt)}) to ${link.agentId}. Dry run \u2014 nothing sent.`
+      `  would push prompt (${kb(local.prompt)}) to ${link2.agentId}. Dry run \u2014 nothing sent.`
     );
     return;
   }
@@ -924,24 +970,24 @@ async function syncClone(local, link, opts) {
   try {
     ({ agent: agent2 } = await api(
       "GET",
-      `/agents/${encodeURIComponent(link.agentId)}`
+      `/agents/${encodeURIComponent(link2.agentId)}`
     ));
   } catch (error) {
     if (error instanceof ApiError && error.status === 404) {
       throw new Error(
-        `linked agent ${link.agentId} no longer exists \u2014 run \`sky clone --new\` to launch a fresh one`
+        `linked agent ${link2.agentId} no longer exists \u2014 run \`sky clone --new\` to launch a fresh one`
       );
     }
     throw error;
   }
   if (agent2.agentType !== local.harness) {
     throw new Error(
-      `linked agent ${link.agentId} is ${agent2.agentType}, this machine runs ${local.harness} \u2014 run \`sky clone --new\` to launch a fresh agent`
+      `linked agent ${link2.agentId} is ${agent2.agentType}, this machine runs ${local.harness} \u2014 run \`sky clone --new\` to launch a fresh agent`
     );
   }
   const result = await api(
     "PUT",
-    `/agents/${encodeURIComponent(link.agentId)}/prompt`,
+    `/agents/${encodeURIComponent(link2.agentId)}/prompt`,
     { prompt: local.prompt }
   );
   console.log(
@@ -949,11 +995,11 @@ async function syncClone(local, link, opts) {
   );
   const drift = [];
   const localModel = local.model ?? null;
-  const linkedModel = link.llm ?? agent2.llm;
+  const linkedModel = link2.llm ?? agent2.llm;
   if (localModel && linkedModel && localModel !== linkedModel) {
     drift.push(`model changed ${linkedModel} \u2192 ${localModel}`);
   }
-  const before = new Set(link.mcpServers ?? []);
+  const before = new Set(link2.mcpServers ?? []);
   const nowKept = Object.keys(local.keptServers);
   const newServers = nowKept.filter((n) => !before.has(n));
   const goneServers = [...before].filter((n) => !nowKept.includes(n));
@@ -968,16 +1014,16 @@ async function syncClone(local, link, opts) {
       `  left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
     );
   }
-  writeLink(local.configRoot, { ...link, lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  console.log(`Synced ${link.agentId}.`);
+  writeLink(local.configRoot, { ...link2, lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  console.log(`Synced ${link2.agentId}.`);
   await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
-  if (opts.open) openBrowser(`${apiBase()}/agents/${link.agentId}`);
+  if (opts.open) openBrowser(`${apiBase()}/agents/${link2.agentId}`);
 }
 async function clone(opts) {
   const harness2 = detectHarness(opts.harness);
   const local = readLocal(harness2);
-  const link = opts.new ? void 0 : readLink(local.configRoot);
-  if (link) await syncClone(local, link, opts);
+  const link2 = opts.new ? void 0 : readLink(local.configRoot);
+  if (link2) await syncClone(local, link2, opts);
   else await createClone(local, opts);
 }
 
@@ -1000,7 +1046,7 @@ import { homedir as homedir2 } from "os";
 import { basename as basename4, dirname as dirname3, join as join4, relative, sep } from "path";
 import { parse as parseToml2 } from "smol-toml";
 var MAX_TREE = 5e3;
-var SKILL_LINE = /Base directory for this skill: (\/[^\s"'\\<>]+)/g;
+var SKILL_LINE = /Base directory for this skill: (\/[^\n\r"'\\<>]+)/g;
 function git(cwd, ...args) {
   const run2 = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8", timeout: 1e4, maxBuffer: 32 * 1024 * 1024 });
   return run2.status === 0 ? run2.stdout : null;
@@ -1046,8 +1092,7 @@ function skillRoots(cwd, home) {
   ];
 }
 function pluginSkill(plugin, skill, home) {
-  const base = join4(process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude"), "plugins");
-  const walk = (dir, depth) => {
+  const walk = (dir, depth, underPlugin) => {
     if (depth > 7) return null;
     let entries;
     try {
@@ -1058,13 +1103,13 @@ function pluginSkill(plugin, skill, home) {
     for (const entry2 of entries) {
       if (!entry2.isDirectory() || entry2.name === "node_modules" || entry2.name === ".git") continue;
       const path = join4(dir, entry2.name);
-      if (entry2.name === skill && basename4(dir) === "skills" && path.includes(`${sep}${plugin}${sep}`) && isFile(join4(path, "SKILL.md"))) return path;
-      const found = walk(path, depth + 1);
+      if (entry2.name === skill && basename4(dir) === "skills" && (underPlugin || path.includes(`${sep}${plugin}${sep}`)) && isFile(join4(path, "SKILL.md"))) return realpathSync(path);
+      const found = walk(path, depth + 1, underPlugin);
       if (found) return found;
     }
     return null;
   };
-  return walk(base, 0);
+  return walk(join4(process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude"), "plugins"), 0, false) ?? walk(join4(home, "Library", "Application Support", "Claude", "local-agent-mode-sessions", "skills-plugin"), 0, true);
 }
 function findSkill(name, cwd, home) {
   const [scope, skill] = name.includes(":") ? name.split(":", 2) : [null, name];
@@ -1084,23 +1129,24 @@ function loadedSkills(records, touched, cwd, home = homedir2()) {
     if (![...dirs.values()].includes(real)) dirs.set(name, real);
     return true;
   };
+  const called = [];
   for (const record of records) {
     const texts = [];
     strings(record, texts);
-    for (const text of texts) for (const match of text.matchAll(SKILL_LINE)) add(match[1].replace(/[.,;:)]+$/, ""));
+    for (const text of texts) for (const match of text.matchAll(SKILL_LINE)) add(match[1].trim().replace(/[.,;:)]+$/, ""));
     const content = record?.message?.content;
     if (!Array.isArray(content)) continue;
     for (const block of content) {
       const b = block;
-      if (b?.type !== "tool_use" || b.name !== "Skill" || typeof b.input?.skill !== "string") continue;
-      const name = b.input.skill.replace(/^\//, "");
-      if (!name || dirs.has(name) || [...dirs.keys()].some((key) => key.endsWith(`:${name}`) || name.endsWith(`:${key}`))) continue;
-      const dir = findSkill(name, cwd, home);
-      if (!dir || !add(dir, name)) missing.add(name);
+      if (b?.type === "tool_use" && b.name === "Skill" && typeof b.input?.skill === "string") called.push(b.input.skill.replace(/^\//, ""));
     }
   }
   for (const path of touched) if (basename4(path) === "SKILL.md") add(dirname3(path));
-  for (const name of dirs.keys()) missing.delete(name);
+  for (const name of called) {
+    if (!name || dirs.has(name) || [...dirs.keys()].some((key) => key.endsWith(`:${name}`) || name.endsWith(`:${key}`))) continue;
+    const dir = findSkill(name, cwd, home);
+    if (!dir || !add(dir, name)) missing.add(name);
+  }
   return { found: [...dirs].map(([name, dir]) => ({ name: name.replace(/[^A-Za-z0-9._:-]/g, "-"), dir })), missing: [...missing] };
 }
 function readJson2(path) {
@@ -1697,7 +1743,7 @@ async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
   const scratch = mkdtempSync(join6(tmpdir(), "sky-environment-"));
   const path = join6(scratch, "environment.tar.gz");
   const leftOut = [];
-  const written = /* @__PURE__ */ new Set();
+  const written2 = /* @__PURE__ */ new Set();
   const hash = createHash2("sha256");
   let bytes = 0;
   let redacted2 = 0;
@@ -1764,9 +1810,9 @@ async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
         }
         await write(tarPadding(stat.size));
       }
-      written.add(rel);
+      written2.add(rel);
     }
-    const layout = importLayout(resources, cwd, platform, { files: written.size, paths: written });
+    const layout = importLayout(resources, cwd, platform, { files: written2.size, paths: written2 });
     for (const [entry2, data] of layout?.entries ?? []) {
       await write(tarHeader(entry2, data.length));
       await write(data);
@@ -1781,7 +1827,7 @@ async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
       folder: layout?.folder ?? "imported-session",
       bytes,
       sha256: hash.digest("hex"),
-      files: written.size + (layout?.entries.size ?? 0),
+      files: written2.size + (layout?.entries.size ?? 0),
       redacted: redacted2,
       leftOut,
       dispose: () => rmSync2(scratch, { recursive: true, force: true })
@@ -2294,507 +2340,92 @@ import { createHash as createHash4, randomBytes } from "crypto";
 import { createServer } from "http";
 import { hostname } from "os";
 import { spawn as spawn2 } from "child_process";
-function b64url(buf) {
-  return buf.toString("base64url");
-}
-function openBrowser2(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  try {
-    spawn2(cmd, [url], { stdio: "ignore", detached: true }).unref();
-  } catch {
-  }
+
+// src/mcp-register.ts
+import { existsSync as existsSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { spawnSync as spawnSync3 } from "child_process";
+import { homedir as homedir6 } from "os";
+import { join as join10 } from "path";
+import { parse as parseToml3 } from "smol-toml";
+import { isMap, parseDocument } from "yaml";
+
+// src/local-agents.ts
+import { existsSync as existsSync6 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join8 } from "path";
+function localAgents(env = process.env, home = homedir5()) {
+  const claude = env.CLAUDE_CONFIG_DIR || join8(home, ".claude");
+  const codex = env.CODEX_HOME || join8(home, ".codex");
+  const cursor = join8(home, ".cursor");
+  return [
+    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join8(claude, "skills") },
+    { id: "codex", name: "Codex", root: codex, skillsDir: join8(codex, "skills") },
+    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join8(cursor, "skills") }
+  ];
 }
-async function login(opts) {
-  const verifier = b64url(randomBytes(32));
-  const challenge = b64url(createHash4("sha256").update(verifier).digest());
-  const result = opts.noBrowser ? await headlessLogin(verifier, challenge) : await browserLogin(verifier, challenge);
-  saveConfig({
-    ...loadConfig(),
-    apiBase: apiBase(),
-    token: result.token,
-    email: result.user.email ?? void 0,
-    currentUniverse: void 0
-    // personal by default
-  });
-  console.log(
-    `Logged in as ${result.user.email ?? "you"}${result.universe ? ` (universe: ${result.universe.slug})` : ""}`
-  );
+function detectLocalAgents(env = process.env, home = homedir5()) {
+  return localAgents(env, home).filter((agent2) => existsSync6(agent2.root));
 }
-async function browserLogin(verifier, challenge) {
-  const state = b64url(randomBytes(16));
-  const code = await new Promise((resolve10, reject) => {
-    const server = createServer((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/callback") {
-        res.writeHead(404).end();
-        return;
-      }
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end("<p>Logged in \u2014 you can close this tab and return to your terminal.</p>");
-      const got = url.searchParams.get("code");
-      if (url.searchParams.get("state") !== state || !got) {
-        reject(new Error("login callback state mismatch"));
-      } else {
-        resolve10(got);
-      }
-      server.close();
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      const port = typeof address === "object" && address ? address.port : 0;
-      const authorizeUrl = `${consoleBase()}/cli/authorize?state=${state}&port=${port}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
-      console.log("Opening your browser to authorize this machine\u2026");
-      console.log(`If it doesn't open, visit:
-  ${authorizeUrl}`);
-      openBrowser2(authorizeUrl);
-    });
-    setTimeout(() => {
-      server.close();
-      reject(new Error("login timed out after 10 minutes"));
-    }, 10 * 60 * 1e3).unref();
+function selectLocalAgents(ids, env = process.env, home = homedir5()) {
+  if (!ids?.length) return detectLocalAgents(env, home);
+  const known = localAgents(env, home);
+  return ids.map((id) => {
+    const agent2 = known.find((candidate) => candidate.id === id);
+    if (!agent2) throw new Error(`unknown agent ${id} \u2014 expected ${known.map((candidate) => candidate.id).join(" | ")}`);
+    return agent2;
   });
-  return api(
-    "POST",
-    "/cli/token-exchange",
-    { code, verifier, clientName: `cli ${hostname()}` },
-    { auth: false }
-  );
-}
-async function headlessLogin(verifier, challenge) {
-  const request = b64url(randomBytes(24));
-  const authorizeUrl = `${consoleBase()}/cli/authorize?request=${request}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
-  console.log(`Visit this URL on any device to authorize:
-  ${authorizeUrl}
-`);
-  process.stdout.write("Waiting for approval\u2026");
-  const deadline = Date.now() + 10 * 60 * 1e3;
-  while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, 3e3));
-    const res = await fetch(
-      `${apiBase()}/cli/poll?request=${request}&verifier=${encodeURIComponent(verifier)}&clientName=${encodeURIComponent(`cli ${hostname()}`)}`,
-      { headers: { "user-agent": USER_AGENT } }
-    );
-    if (!res.ok) {
-      const body2 = await res.json().catch(() => null);
-      throw new Error(body2?.error?.message ?? `poll failed (${res.status})`);
-    }
-    const body = await res.json();
-    if (body.status === "approved") {
-      console.log(" approved.");
-      return body;
-    }
-    process.stdout.write(".");
-  }
-  throw new Error("login timed out after 10 minutes");
 }
 
-// src/connectors.ts
-async function listApps(query, limit = 50) {
-  const apps = [];
-  let cursor = null;
-  do {
-    const params = new URLSearchParams();
-    if (query) params.set("q", query);
-    if (cursor) params.set("cursor", cursor);
-    const qs = params.toString();
-    const page = await api("GET", `/connectors/apps${qs ? `?${qs}` : ""}`);
-    apps.push(...page.apps);
-    cursor = page.next_cursor;
-  } while (cursor && apps.length < limit);
-  return apps.slice(0, limit);
-}
-function connectionLine2(c) {
-  return `${c.id}  ${c.app_name} (${c.app})  ${c.label}  since ${c.created_at.slice(0, 10)}`;
+// src/skill.ts
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
+import { join as join9 } from "path";
+
+// src/catalog-file.ts
+var CATALOG_FILE = "catalog.md";
+var CATEGORY_ORDER = ["websites", "content", "video", "code", "research", "general"];
+function categoryOf(agent2) {
+  return CATEGORY_ORDER.find((category) => agent2.categories.includes(category)) ?? agent2.categories[0] ?? "general";
 }
-function workspaceConnectionLine(c) {
-  const owner = c.workspace_owned ? "the workspace" : c.mine ? "you" : c.shared_by?.name ?? c.shared_by?.user_id ?? "someone";
-  return `${c.connection_id}  ${c.app_name} (${c.app})  ${c.label}  shared by ${owner}`;
+function describe(value) {
+  const parts = Object.entries(value).filter(([, item]) => item !== null && item !== void 0 && item !== false && item !== "").map(([key, item]) => item === true ? key : `${key}: ${typeof item === "string" ? item : JSON.stringify(item)}`);
+  return parts.length ? parts.join(", ") : null;
 }
-function browserReturn(start, opts = {}) {
-  return new Promise((resolve10, reject) => {
-    const server = createServer2((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/done" && url.pathname !== "/failed") {
-        res.writeHead(404).end();
-        return;
-      }
-      const ok = url.pathname === "/done";
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end(ok ? "<p>Connected \u2014 you can close this tab and return to your terminal.</p>" : "<p>The app was not connected. Return to your terminal.</p>");
-      server.close();
-      if (ok) resolve10(url.searchParams.get("account_id") ?? void 0);
-      else reject(new ApiError(400, "connect_failed", "the app was not connected"));
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      const port = typeof address === "object" && address ? address.port : 0;
-      const base = `http://127.0.0.1:${port}`;
-      start(`${base}/done`, `${base}/failed`).then(
-        (authorizeUrl) => {
-          console.log(`Authorize access in your browser:
-  ${authorizeUrl}`);
-          if (opts.open !== false) openBrowser2(authorizeUrl);
-        },
-        (err) => {
-          server.close();
-          reject(err);
-        }
-      );
-    });
-    setTimeout(() => {
-      server.close();
-      reject(new ApiError(408, "connect_timeout", "nobody finished the authorization within 10 minutes"));
-    }, opts.timeoutMs ?? 10 * 6e4).unref();
-  });
+function entry(agent2) {
+  const engine = agent2.engine_type ? ` \xB7 engine ${agent2.engine_type}` : "";
+  const lines = [`### @${agent2.handle} \u2014 ${agent2.name}${engine}`, "", agent2.tagline];
+  if (agent2.does.length) lines.push("", `Does: ${agent2.does.join("; ")}`);
+  if (agent2.does_not.length) lines.push(`Does not: ${agent2.does_not.join("; ")}`);
+  const { mcp_servers: mcpServers2, ...rest } = agent2.requirements;
+  if (typeof mcpServers2 === "boolean") lines.push(mcpServers2 ? "Can use MCP servers." : "Cannot use MCP servers.");
+  const details = describe(rest);
+  if (details) lines.push(`Details: ${details}`);
+  const pricing = describe(agent2.pricing);
+  if (pricing) lines.push(`Pricing: ${pricing}`);
+  return lines.join("\n");
 }
-async function connectApp(app, opts = {}) {
-  const base = opts.workspace ? `/universes/${encodeURIComponent(opts.workspace)}/connections` : "/connectors/connections";
-  const accountId = await browserReturn(async (success_url, error_url) => {
-    const { url } = await api("POST", base, { app, success_url, error_url });
-    return url;
-  }, { open: opts.open });
-  const done = await api("POST", `${base}/complete`, {
-    app,
-    ...accountId ? { account_id: accountId } : {}
+function renderCatalog(agents, generatedAt) {
+  const header2 = [
+    "# AgentSky agent catalog",
+    "",
+    `Every agent you can hire, as of ${generatedAt.toISOString()}. Start one with \`start_session\` and its handle, written with the @.`,
+    "Run `npx @agentsky/sky setup` again to refresh this file; `search_catalog` always has the current list."
+  ];
+  if (!agents.length) return [...header2, "", "The catalog was empty when this file was written. Use `search_catalog`.", ""].join("\n");
+  const own = agents.filter((agent2) => agent2.visibility === "workspace");
+  const shared = agents.filter((agent2) => agent2.visibility !== "workspace");
+  const sections = [];
+  if (own.length) sections.push(["## Your workspace's agents", ...own.map(entry)].join("\n\n"));
+  const groups = /* @__PURE__ */ new Map();
+  for (const agent2 of shared) groups.set(categoryOf(agent2), [...groups.get(categoryOf(agent2)) ?? [], agent2]);
+  const ordered = [...groups.keys()].sort((a, b) => {
+    const rank = (category) => CATEGORY_ORDER.includes(category) ? CATEGORY_ORDER.indexOf(category) : CATEGORY_ORDER.length;
+    return rank(a) - rank(b) || a.localeCompare(b);
   });
-  return done.connection;
-}
-
-// src/routine-triggers.ts
-var triggerPath = (id, resource) => `/routines/${encodeURIComponent(id)}/${resource}`;
-function inboundLine(u) {
-  if (!u) return "no inbound URL \u2014 make one with --create";
-  return u.url ?? `inbound URL ${u.prefix}\u2026 made ${u.created_at.slice(0, 10)}${u.last_used_at ? `, last used ${u.last_used_at.slice(0, 16).replace("T", " ")}` : ", never used"}`;
-}
-function precheckLine(p) {
-  if (!p) return "no precheck: every scheduled fire runs";
-  const last = p.last_result ? `last check ${p.last_result}${p.last_error ? ` (${p.last_error.type}: ${p.last_error.message})` : ""}` : "not checked yet";
-  return `fires only when ${p.url} changes \xB7 ${last}`;
-}
-function triggerLine(t, available = true) {
-  if (!t) return "no chat trigger";
-  const where = t.thread_id ? `thread ${t.thread_id} on ${t.connection_id}` : `any conversation on ${t.connection_id}`;
-  const what = t.text_prefix ? `messages starting "${t.text_prefix}"` : "every message";
-  return `${what} in ${where} start a run${available ? "" : " (chat messages are not offered to routines in this deployment)"}`;
-}
-function deliverLine(d) {
-  return d ? `answers post to thread ${d.thread_id} on ${d.connection_id}` : "answers are posted nowhere";
-}
-function triggerBody(opts) {
-  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
-  return { connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {}, ...opts.prefix ? { text_prefix: opts.prefix } : {} };
-}
-function deliverBody(opts) {
-  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
-  return { type: "channel_thread", connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {} };
-}
-async function triggerRequest(id, resource, change) {
-  const path = triggerPath(id, resource);
-  if (change.remove) return api("DELETE", path);
-  if (change.create) return api("POST", path);
-  if (change.body) return api("PUT", path, change.body);
-  return api("GET", path);
-}
-
-// src/session-workspace.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import { createHash as createHash5, randomUUID } from "crypto";
-import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
-import { basename as basename6, join as join8, relative as relative3, resolve as resolve5 } from "path";
-var SINGLE_IMPORT_MAX = 25 * 1024 * 1024;
-var PART_SIZE = 8 * 1024 * 1024;
-var SKIPPED2 = /* @__PURE__ */ new Set([".git", "node_modules"]);
-var workspacePath = (id) => `/sessions/${encodeURIComponent(id)}/workspace`;
-async function listFiles2(id, path, hidden) {
-  const query = new URLSearchParams();
-  if (path) query.set("path", path);
-  if (hidden) query.set("hidden", "true");
-  const qs = query.toString();
-  return api("GET", `${workspacePath(id)}/files${qs ? `?${qs}` : ""}`);
-}
-function entryLine(e) {
-  const size = e.type === "directory" ? "-" : String(e.size ?? 0);
-  return `${e.type === "directory" ? "d" : "-"} ${size.padStart(10)}  ${(e.mtime ?? "").slice(0, 16).replace("T", " ")}  ${e.name}${e.type === "directory" ? "/" : ""}`;
-}
-async function readFile(id, path) {
-  return (await apiBytes("GET", `${workspacePath(id)}/files/content?path=${encodeURIComponent(path)}`)).bytes;
-}
-function renderChanges(changes) {
-  if (!changes.repos.length) return [`no git repository under ${changes.root}`];
-  return changes.repos.flatMap((r) => [
-    `${r.path === "." ? changes.root : r.path}: ${r.status ? "changed" : "clean"}`,
-    ...(r.stat ?? r.status ?? "").split("\n").filter(Boolean).map((line) => `  ${line}`)
-  ]);
-}
-async function workspacePatch(id, repo) {
-  const { patch, ...meta } = await api("POST", `${workspacePath(id)}/patch`, { repo });
-  return { meta, patch: Buffer.from(patch, "base64") };
-}
-function folderFiles(dir) {
-  const git2 = spawnSync3("git", ["-C", dir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8" });
-  const top = spawnSync3("git", ["-C", dir, "rev-parse", "--show-prefix"], { encoding: "utf8" });
-  if (git2.status === 0 && top.status === 0) {
-    return git2.stdout.split("\0").filter((path) => path && statSync6(join8(dir, path), { throwIfNoEntry: false })?.isFile());
-  }
-  const files2 = [];
-  const walk = (at) => {
-    for (const entry2 of readdirSync5(at, { withFileTypes: true })) {
-      if (SKIPPED2.has(entry2.name)) continue;
-      const full = join8(at, entry2.name);
-      if (entry2.isDirectory()) walk(full);
-      else if (entry2.isFile()) files2.push(relative3(dir, full));
-    }
-  };
-  walk(dir);
-  return files2;
-}
-function folderArchive(dir, files2) {
-  const tar = spawnSync3("tar", ["--format=ustar", "-czf", "-", "-C", dir, "-T", "-"], {
-    input: files2.join("\n"),
-    env: { ...process.env, COPYFILE_DISABLE: "1" },
-    maxBuffer: 2 * 1024 * 1024 * 1024
-  });
-  if (tar.status !== 0) throw new ApiError(400, "archive_failed", `tar failed: ${tar.stderr.toString().trim()}`);
-  return tar.stdout;
-}
-async function importFolder(id, dir, opts = {}) {
-  const root = resolve5(dir);
-  const name = opts.name ?? basename6(root);
-  const archive = opts.archive ?? folderArchive(root, folderFiles(root));
-  if (archive.length <= SINGLE_IMPORT_MAX) {
-    const res = await apiBytes("POST", `${workspacePath(id)}/import?name=${encodeURIComponent(name)}`, { bytes: archive, mediaType: "application/gzip" });
-    return res.json();
-  }
-  const sha256 = createHash5("sha256").update(archive).digest("hex");
-  let upload = await api("POST", `${workspacePath(id)}/imports`, { name, size: archive.length, sha256, part_size: PART_SIZE });
-  const uploadPath = `${workspacePath(id)}/imports/${encodeURIComponent(upload.id)}`;
-  for (let part = 0; part < upload.parts; part += 1) {
-    if (upload.received.includes(part)) continue;
-    const bytes = archive.subarray(part * upload.part_size, (part + 1) * upload.part_size);
-    await apiBytes("PUT", `${uploadPath}/parts/${part}`, { bytes, mediaType: "application/octet-stream" });
-  }
-  upload = await api("POST", `${uploadPath}/complete`);
-  while (upload.state !== "imported" && upload.state !== "failed") {
-    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
-    upload = await api("GET", uploadPath);
-  }
-  if (upload.state === "failed") throw new ApiError(422, upload.error?.code ?? "import_failed", upload.error?.message ?? "the import failed");
-  return { path: upload.path ?? name, files: upload.files ?? 0 };
-}
-function renderAccess(a) {
-  const lines = [
-    `${a.session_id}${a.title ? ` \u2014 ${a.title}` : ""}`,
-    `  ${a.visibility === "private" ? "private to its owner" : `visible to ${a.workspace.name} (${a.workspace.slug})`} \xB7 you are its ${a.access}`,
-    `  owner: ${a.owner.name ?? a.owner.email ?? "unknown"}`
-  ];
-  if (a.viewers) lines.push(a.viewers.length ? `  viewers: ${a.viewers.map((v) => v.email).join(", ")}` : "  viewers: none");
-  return lines;
-}
-function accessPatch(opts) {
-  if (opts.private && opts.members) throw new ApiError(400, "invalid_request", "pass --private or --members, not both");
-  return {
-    ...opts.private ? { visibility: "private" } : opts.members ? { visibility: "workspace" } : {},
-    ...opts.addViewer?.length ? { add_viewers: opts.addViewer } : {},
-    ...opts.removeViewer?.length ? { remove_viewers: opts.removeViewer } : {}
-  };
-}
-function engineChange(model, thinking) {
-  if (!model && !thinking) return null;
-  return {
-    ...model ? { llm: model } : {},
-    ...thinking ? { reasoningEffort: thinking === "default" ? null : thinking } : {}
-  };
-}
-var TERMINAL = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
-async function handoff(id, targetAgent, opts = {}) {
-  let { handoff: h } = await api("POST", `/sessions/${encodeURIComponent(id)}/handoff`, {
-    target_agent: targetAgent,
-    ...opts.fromMessage ? { last_message_id: opts.fromMessage } : {}
-  }, { idempotencyKey: opts.idempotencyKey ?? randomUUID() });
-  opts.onStatus?.(h);
-  while (opts.wait && !TERMINAL.has(h.status)) {
-    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
-    const next = (await api("GET", `/session-handoffs/${encodeURIComponent(h.id)}`)).handoff;
-    if (next.status !== h.status) opts.onStatus?.(next);
-    h = next;
-  }
-  return h;
-}
-
-// src/local-agents.ts
-import { existsSync as existsSync6 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join9 } from "path";
-function localAgents(env = process.env, home = homedir5()) {
-  const claude = env.CLAUDE_CONFIG_DIR || join9(home, ".claude");
-  const codex = env.CODEX_HOME || join9(home, ".codex");
-  const cursor = join9(home, ".cursor");
-  return [
-    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join9(claude, "skills") },
-    { id: "codex", name: "Codex", root: codex, skillsDir: join9(codex, "skills") },
-    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join9(cursor, "skills") }
-  ];
-}
-function detectLocalAgents(env = process.env, home = homedir5()) {
-  return localAgents(env, home).filter((agent2) => existsSync6(agent2.root));
-}
-function selectLocalAgents(ids, env = process.env, home = homedir5()) {
-  if (!ids?.length) return detectLocalAgents(env, home);
-  const known = localAgents(env, home);
-  return ids.map((id) => {
-    const agent2 = known.find((candidate) => candidate.id === id);
-    if (!agent2) throw new Error(`unknown agent ${id} \u2014 expected ${known.map((candidate) => candidate.id).join(" | ")}`);
-    return agent2;
-  });
-}
-
-// src/render.ts
-var dim = (s) => `\x1B[2m${s}\x1B[0m`;
-var red = (s) => `\x1B[31m${s}\x1B[0m`;
-function clip(value, max = 120) {
-  const text = typeof value === "string" ? value : JSON.stringify(value);
-  return text.length > max ? `${text.slice(0, max)}\u2026` : text;
-}
-function renderEvent(event, data) {
-  const part = data.part;
-  switch (event) {
-    case "agent.message":
-      console.log(String(data.text ?? ""));
-      break;
-    case "agent.reasoning":
-      console.log(dim(`\xB7 ${clip(part?.text ?? "")}`));
-      break;
-    case "agent.tool_use":
-      console.log(dim(`\u2192 ${String(part?.tool_name ?? "tool")}(${clip(part?.args ?? {}, 80)})`));
-      break;
-    case "agent.tool_result":
-      console.log(dim(`\u2190 ${String(part?.tool_name ?? "tool")} ${String(part?.status ?? "")}`));
-      break;
-    case "agent.status":
-      console.log(dim(`\u2026 ${String(part?.level ?? "")} ${String(part?.text ?? "")}`.trim()));
-      break;
-    case "user.interrupt":
-      console.log(dim("\u23F9 interrupting"));
-      break;
-    case "session.error": {
-      const error = data.error;
-      const message2 = String(error?.message ?? error?.type ?? "unknown");
-      if (error?.retry_status === "retrying") console.error(dim(`retrying: ${message2}`));
-      else console.error(red(`error: ${message2}`));
-      break;
-    }
-    case "session.status_terminated":
-      console.log(dim("session terminated"));
-      break;
-    default:
-      break;
-  }
-}
-
-// src/session-read.ts
-var TURN_TYPES = ["user.message", "agent.message", "session.status_idle", "session.status_terminated", "session.error"];
-function latestTurn(events) {
-  let start = 0;
-  for (let index = events.length - 1; index >= 0; index -= 1) {
-    if (events[index].type === "user.message") {
-      start = index + 1;
-      break;
-    }
-  }
-  const reading = { finished: false, messages: [], errors: [] };
-  for (const event of events.slice(start)) {
-    if (event.type === "agent.message" && event.text?.trim()) reading.messages.push(event.text);
-    else if (event.type === "session.error" && event.error?.retry_status !== "retrying") {
-      reading.errors.push(event.error?.message ?? event.error?.type ?? "unknown error");
-    } else if (event.type === "session.status_terminated") reading.finished = true;
-    else if (event.type === "session.status_idle" && event.stop_reason?.type !== "requires_action") reading.finished = true;
-  }
-  return reading;
-}
-async function history2(sessionId) {
-  const events = [];
-  let cursor = null;
-  for (; ; ) {
-    const query = new URLSearchParams({ limit: "500" });
-    for (const type of TURN_TYPES) query.append("types[]", type);
-    if (cursor) query.set("cursor", cursor);
-    const page = await api(
-      "GET",
-      `/sessions/${encodeURIComponent(sessionId)}/events?${query}`
-    );
-    events.push(...page.events);
-    if (!page.hasMore || !page.cursor) return events;
-    cursor = page.cursor;
-  }
-}
-async function readTurn(sessionId, opts = {}) {
-  const deadline = Date.now() + (opts.timeoutSeconds ?? 600) * 1e3;
-  for (; ; ) {
-    const reading = latestTurn(await history2(sessionId));
-    if (reading.finished || !opts.wait || Date.now() >= deadline) return reading;
-    await new Promise((resolve10) => setTimeout(resolve10, opts.intervalMs ?? 3e3));
-  }
-}
-
-// src/setup.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname6, join as join13 } from "path";
-import { createInterface as createInterface3 } from "readline";
-
-// src/mcp-register.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
-import { spawnSync as spawnSync4 } from "child_process";
-
-// src/skill.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
-
-// src/catalog-file.ts
-var CATALOG_FILE = "catalog.md";
-var CATEGORY_ORDER = ["websites", "content", "video", "code", "research", "general"];
-function categoryOf(agent2) {
-  return CATEGORY_ORDER.find((category) => agent2.categories.includes(category)) ?? agent2.categories[0] ?? "general";
-}
-function describe(value) {
-  const parts = Object.entries(value).filter(([, item]) => item !== null && item !== void 0 && item !== false && item !== "").map(([key, item]) => item === true ? key : `${key}: ${typeof item === "string" ? item : JSON.stringify(item)}`);
-  return parts.length ? parts.join(", ") : null;
-}
-function entry(agent2) {
-  const engine = agent2.engine_type ? ` \xB7 engine ${agent2.engine_type}` : "";
-  const lines = [`### @${agent2.handle} \u2014 ${agent2.name}${engine}`, "", agent2.tagline];
-  if (agent2.does.length) lines.push("", `Does: ${agent2.does.join("; ")}`);
-  if (agent2.does_not.length) lines.push(`Does not: ${agent2.does_not.join("; ")}`);
-  const { mcp_servers: mcpServers2, ...rest } = agent2.requirements;
-  if (typeof mcpServers2 === "boolean") lines.push(mcpServers2 ? "Can use MCP servers." : "Cannot use MCP servers.");
-  const details = describe(rest);
-  if (details) lines.push(`Details: ${details}`);
-  const pricing = describe(agent2.pricing);
-  if (pricing) lines.push(`Pricing: ${pricing}`);
-  return lines.join("\n");
-}
-function renderCatalog(agents, generatedAt) {
-  const header2 = [
-    "# AgentSky agent catalog",
-    "",
-    `Every agent you can hire, as of ${generatedAt.toISOString()}. Start one with \`start_session\` and its handle, written with the @.`,
-    "Run `npx @agentsky/sky setup` again to refresh this file; `search_catalog` always has the current list."
-  ];
-  if (!agents.length) return [...header2, "", "The catalog was empty when this file was written. Use `search_catalog`.", ""].join("\n");
-  const own = agents.filter((agent2) => agent2.visibility === "workspace");
-  const shared = agents.filter((agent2) => agent2.visibility !== "workspace");
-  const sections = [];
-  if (own.length) sections.push(["## Your workspace's agents", ...own.map(entry)].join("\n\n"));
-  const groups = /* @__PURE__ */ new Map();
-  for (const agent2 of shared) groups.set(categoryOf(agent2), [...groups.get(categoryOf(agent2)) ?? [], agent2]);
-  const ordered = [...groups.keys()].sort((a, b) => {
-    const rank = (category) => CATEGORY_ORDER.includes(category) ? CATEGORY_ORDER.indexOf(category) : CATEGORY_ORDER.length;
-    return rank(a) - rank(b) || a.localeCompare(b);
-  });
-  for (const category of ordered) {
-    const title = category.charAt(0).toUpperCase() + category.slice(1);
-    sections.push([`## ${title}`, ...groups.get(category).map(entry)].join("\n\n"));
-  }
-  return [...header2, "", sections.join("\n\n"), ""].join("\n");
+  for (const category of ordered) {
+    const title = category.charAt(0).toUpperCase() + category.slice(1);
+    sections.push([`## ${title}`, ...groups.get(category).map(entry)].join("\n\n"));
+  }
+  return [...header2, "", sections.join("\n\n"), ""].join("\n");
 }
 
 // src/skill.ts
@@ -3145,185 +2776,765 @@ your application has checked who they are. By hand: \`sky task show <id>\` and
 \`sky task answer <id> <request> --text "..."\` (MCP: \`get_task\`,
 \`answer_request\`).
 
-## 7. What the application keeps
+## 7. What the application keeps
+
+The agent decides; the application acts. Keep these in the application's own
+database:
+
+- **One job per event**, with a unique event key. The same key with the same
+  payload returns the job it made; with a different payload it is a conflict.
+- **The session id**, saved before you start polling, so a restart picks the
+  job up where it was.
+- **A confirmation receipt** from the signed-in customer before any side
+  effect.
+- **A unique action key per job**, so the side effect happens once. Agent
+  retries do not make it happen once; the key does.
+- **Webhooks to the customer** with an event id, retried until acknowledged.
+
+## Before launch
+
+Check one real session:
+
+- \`GET /v1/sessions/{id}\` lists only the upload under \`resources\`.
+- \`GET /v1/hook_rules\` and \`GET /v1/universes/{slug}/policies\` show the rules
+  above.
+- Ask the agent directly to run a shell command. The answer has to be the
+  platform's refusal.
+- A file id from another customer's workspace is refused at session create.
+`;
+}
+function workspacesReferenceDoc() {
+  return `# Workspaces in AgentSky
+
+A workspace (also called a universe) groups agents and sessions. Every API call
+and MCP tool accepts an optional workspace slug.
+
+## How to choose
+
+1. The person named one \u2192 use it.
+2. Check the git root for \`.agentsky.json\` with a \`"workspace"\` key \u2192 use that.
+3. Neither \u2192 use the account default (personal workspace). Never ask.
+
+## Applying it
+
+- MCP tools: pass \`workspace: "<slug>"\` on tools that accept it.
+- sky CLI: \`--workspace <slug>\` on any command, or set \`SKY_WORKSPACE=<slug>\`.
+- Tools that take a \`task_id\` or \`session_id\` inherit that task's workspace
+  automatically; one task never spans workspaces.
+
+## Listing workspaces
+
+\`sky workspace list\` (or \`sky universe list\`) prints your workspaces, with
+\`*\` marking the current default.
+
+## .agentsky.json
+
+To set a per-repo default, create \`.agentsky.json\` at the git root:
+
+\`\`\`json
+{"workspace": "my-team-slug"}
+\`\`\`
+`;
+}
+function installedVersion(dir) {
+  try {
+    const marker = JSON.parse(readFileSync9(join9(dir, SKILL_MARKER), "utf8"));
+    return typeof marker.version === "string" ? marker.version : null;
+  } catch {
+    return null;
+  }
+}
+function isInstalledSkill(dir) {
+  return installedVersion(dir) !== null;
+}
+function installSkill(agent2, opts = {}) {
+  const dir = join9(agent2.skillsDir, SKILL_NAME);
+  const previous = installedVersion(dir);
+  const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
+  if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
+  if (outcome !== "current") {
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync4(join9(dir, "SKILL.md"), skillDocument());
+    writeFileSync4(join9(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
+`);
+  }
+  if (opts.catalog) {
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync4(join9(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+  }
+  const refsDir = join9(dir, REFERENCES_DIR);
+  mkdirSync2(refsDir, { recursive: true });
+  writeFileSync4(join9(refsDir, "import.md"), importReferenceDoc());
+  writeFileSync4(join9(refsDir, "workspaces.md"), workspacesReferenceDoc());
+  writeFileSync4(join9(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
+  return { agent: agent2.id, path: dir, outcome };
+}
+
+// src/mcp-register.ts
+var MCP_SERVER_NAME = SKILL_NAME;
+function detectHermes(env = process.env, home = homedir6()) {
+  const root = env.HERMES_HOME || join10(home, ".hermes");
+  return existsSync7(root) ? { id: "hermes", name: "Hermes", root } : null;
+}
+function detectMcpClients(env = process.env, home = homedir6()) {
+  const hermes = detectHermes(env, home);
+  return [...detectLocalAgents(env, home), ...hermes ? [hermes] : []];
+}
+function systemCommandRunner() {
+  return {
+    has: (command) => spawnSync3(command, ["--version"], { stdio: "ignore" }).status === 0,
+    run: (command, args) => {
+      const result = spawnSync3(command, args, { encoding: "utf8" });
+      return { status: result.status, stderr: result.stderr ?? "" };
+    }
+  };
+}
+function mcpUrlFor(apiBase2) {
+  return `${apiBase2.replace(/\/$/, "")}/mcp`;
+}
+function mcpCommands(agent2, opts) {
+  if (agent2 === "claude_code") {
+    return {
+      command: "claude",
+      remove: ["mcp", "remove", "--scope", "user", MCP_SERVER_NAME],
+      add: ["mcp", "add", "--scope", "user", "--transport", "http", MCP_SERVER_NAME, opts.mcpUrl, "--header", `Authorization: Bearer ${opts.token}`]
+    };
+  }
+  return null;
+}
+function redact(text, token) {
+  return text.split(token).join(`${token.slice(0, 10)}\u2026`);
+}
+function registerMcpServer(client, opts, runner = systemCommandRunner()) {
+  if (client.id === "codex") return registerCodex(client, opts);
+  if (client.id === "cursor") return registerCursor(client, opts);
+  if (client.id === "hermes") return registerHermes(client, opts);
+  const commands = mcpCommands(client.id, opts);
+  if (!commands) return { agent: client.id, outcome: "unsupported" };
+  if (!runner.has(commands.command)) return { agent: client.id, outcome: "no_command", detail: `${commands.command} is not on PATH` };
+  if (opts.dryRun) return { agent: client.id, outcome: "planned", detail: redact(`run ${[commands.command, ...commands.add].join(" ")}`, opts.token) };
+  runner.run(commands.command, commands.remove);
+  const added = runner.run(commands.command, commands.add);
+  if (added.status !== 0) return { agent: client.id, outcome: "failed", detail: redact(added.stderr.trim() || `exit ${added.status}`, opts.token) };
+  return { agent: client.id, outcome: "registered" };
+}
+function mcpConfigPath(client, env = process.env, home = homedir6()) {
+  switch (client.id) {
+    case "claude_code":
+      return join10(env.CLAUDE_CONFIG_DIR || home, ".claude.json");
+    case "codex":
+      return join10(client.root, "config.toml");
+    case "cursor":
+      return join10(client.root, "mcp.json");
+    case "hermes":
+      return join10(client.root, "config.yaml");
+  }
+}
+function readText(path) {
+  try {
+    return readFileSync10(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function hasMcpServer(client, env = process.env, home = homedir6()) {
+  const raw = readText(mcpConfigPath(client, env, home));
+  if (raw === null) return false;
+  try {
+    if (client.id === "codex") return Boolean(parseToml3(raw).mcp_servers?.[MCP_SERVER_NAME]);
+    if (client.id === "hermes") return parseDocument(raw).hasIn(["mcp_servers", MCP_SERVER_NAME]);
+    return Boolean(JSON.parse(raw).mcpServers?.[MCP_SERVER_NAME]);
+  } catch {
+    return false;
+  }
+}
+function planned(client, path, entry2, opts) {
+  return { agent: client.id, outcome: "planned", detail: `write to ${path}: ${redact(entry2, opts.token)}` };
+}
+function written(client, path, text) {
+  try {
+    writeFileSync5(path, text, { encoding: "utf8", mode: 384 });
+  } catch (err) {
+    return { agent: client.id, outcome: "failed", detail: String(err) };
+  }
+  return { agent: client.id, outcome: "registered" };
+}
+function tomlTableKey(name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return `(?:${escaped}|"${escaped}"|'${escaped}')`;
+}
+function withoutTomlServer(text, name) {
+  const ours = new RegExp(`^\\s*\\[\\s*mcp_servers\\s*\\.\\s*${tomlTableKey(name)}\\s*(?:\\.[^\\]]*)?\\]\\s*(?:#.*)?$`);
+  let skipping = false;
+  const kept = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (/^\s*\[/.test(line)) skipping = ours.test(line);
+    if (!skipping) kept.push(line);
+  }
+  return kept.join("\n").replace(/\n+$/, "");
+}
+function registerCodex(client, opts) {
+  const path = mcpConfigPath(client);
+  const block = [
+    `[mcp_servers.${MCP_SERVER_NAME}]`,
+    `url = ${JSON.stringify(opts.mcpUrl)}`,
+    `http_headers = { Authorization = ${JSON.stringify(`Bearer ${opts.token}`)} }`
+  ].join("\n");
+  if (opts.dryRun) return planned(client, path, block, opts);
+  const raw = readText(path) ?? "";
+  let before;
+  try {
+    before = parseToml3(raw);
+  } catch (err) {
+    return { agent: client.id, outcome: "failed", detail: `${path} is not valid TOML, left as it was (${String(err).split("\n")[0]})` };
+  }
+  const rest = withoutTomlServer(raw, MCP_SERVER_NAME);
+  const text = `${rest ? `${rest}
 
-The agent decides; the application acts. Keep these in the application's own
-database:
+` : ""}${block}
+`;
+  try {
+    const after = parseToml3(text);
+    const others = Object.keys(before.mcp_servers ?? {}).filter((name) => name !== MCP_SERVER_NAME);
+    if (after.mcp_servers?.[MCP_SERVER_NAME]?.url !== opts.mcpUrl || others.some((name) => !after.mcp_servers?.[name])) throw new Error("the edited file lost an entry");
+  } catch (err) {
+    return { agent: client.id, outcome: "failed", detail: `could not edit ${path} safely, left as it was (${String(err).split("\n")[0]})` };
+  }
+  return written(client, path, text);
+}
+function registerCursor(client, opts) {
+  const path = mcpConfigPath(client);
+  const entry2 = { url: opts.mcpUrl, headers: { Authorization: `Bearer ${opts.token}` } };
+  if (opts.dryRun) return planned(client, path, JSON.stringify({ [MCP_SERVER_NAME]: entry2 }, null, 2), opts);
+  let existing = {};
+  try {
+    const parsed = JSON.parse(readText(path) ?? "");
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) existing = parsed;
+  } catch {
+    existing = {};
+  }
+  const updated = { ...existing, mcpServers: { ...existing.mcpServers ?? {}, [MCP_SERVER_NAME]: entry2 } };
+  return written(client, path, `${JSON.stringify(updated, null, 2)}
+`);
+}
+function registerHermes(client, opts) {
+  const path = mcpConfigPath(client);
+  const entry2 = { url: opts.mcpUrl, headers: { Authorization: `Bearer ${opts.token}` } };
+  if (opts.dryRun) return planned(client, path, `mcp_servers.${MCP_SERVER_NAME}: ${JSON.stringify(entry2)}`, opts);
+  const doc = parseDocument(readText(path) ?? "");
+  if (doc.errors.length) return { agent: client.id, outcome: "failed", detail: `${path} is not valid YAML, left as it was (${doc.errors[0].message.split("\n")[0]})` };
+  if (doc.contents !== null && !isMap(doc.contents)) {
+    return { agent: client.id, outcome: "failed", detail: `${path} is not a YAML mapping, left as it was` };
+  }
+  doc.setIn(["mcp_servers", MCP_SERVER_NAME], doc.createNode(entry2));
+  return written(client, path, doc.toString());
+}
+function refreshMcpRegistrations(opts, clients = detectMcpClients(), runner = systemCommandRunner()) {
+  return clients.filter((client) => hasMcpServer(client)).map((client) => registerMcpServer(client, opts, runner));
+}
 
-- **One job per event**, with a unique event key. The same key with the same
-  payload returns the job it made; with a different payload it is a conflict.
-- **The session id**, saved before you start polling, so a restart picks the
-  job up where it was.
-- **A confirmation receipt** from the signed-in customer before any side
-  effect.
-- **A unique action key per job**, so the side effect happens once. Agent
-  retries do not make it happen once; the key does.
-- **Webhooks to the customer** with an event id, retried until acknowledged.
+// src/shell-env.ts
+import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir7 } from "os";
+import { basename as basename6, dirname as dirname5, join as join11 } from "path";
+var TOKEN_ENV = "AGENTSKY_API_KEY";
+var HOOK_MARK = "# AgentSky API token, kept current by sky";
+function shellEnvFiles() {
+  const dir = dirname5(configPath());
+  return { sh: join11(dir, "env.sh"), fish: join11(dir, "env.fish") };
+}
+function quoted(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function shellStartupFiles(env = process.env, home = homedir7(), platform = process.platform) {
+  const shell = basename6(env.SHELL ?? "");
+  const files2 = [];
+  const zshenv = join11(env.ZDOTDIR || home, ".zshenv");
+  if (shell === "zsh" || platform === "darwin" || existsSync8(zshenv)) files2.push({ path: zshenv, kind: "sh" });
+  const bashrc = join11(home, ".bashrc");
+  if (shell === "bash" || existsSync8(bashrc)) files2.push({ path: bashrc, kind: "sh" });
+  const bashProfile = join11(home, ".bash_profile");
+  if (existsSync8(bashProfile)) files2.push({ path: bashProfile, kind: "sh" });
+  const fish = join11(env.XDG_CONFIG_HOME || join11(home, ".config"), "fish");
+  if (shell === "fish" || existsSync8(fish)) files2.push({ path: join11(fish, "conf.d", "agentsky.fish"), kind: "fish" });
+  return files2;
+}
+function writeShellEnv(token, opts = {}) {
+  const { sh, fish } = shellEnvFiles();
+  const startup = shellStartupFiles(opts.env, opts.home, opts.platform);
+  if (opts.dryRun) return { outcome: "planned", files: [sh, fish, ...startup.map((file) => file.path)] };
+  const header2 = "# Written by sky. `sky auth login` and `sky auth logout` rewrite this file.\n";
+  const hooked = [];
+  try {
+    mkdirSync3(dirname5(sh), { recursive: true });
+    writeFileSync6(sh, `${header2}${token ? `export ${TOKEN_ENV}=${quoted(token)}` : `unset ${TOKEN_ENV}`}
+`, { mode: 384 });
+    writeFileSync6(fish, `${header2}${token ? `set -gx ${TOKEN_ENV} ${quoted(token)}` : `set -e ${TOKEN_ENV}`}
+`, { mode: 384 });
+    for (const file of startup) {
+      const existing = existsSync8(file.path) ? readFileSync11(file.path, "utf8") : "";
+      if (existing.includes(HOOK_MARK)) continue;
+      const line = file.kind === "fish" ? `${HOOK_MARK}
+test -f ${quoted(fish)}; and source ${quoted(fish)}
+` : `${HOOK_MARK}
+[ -f ${quoted(sh)} ] && . ${quoted(sh)}
+`;
+      mkdirSync3(dirname5(file.path), { recursive: true });
+      appendFileSync(file.path, `${existing && !existing.endsWith("\n") ? "\n" : ""}${line}`);
+      hooked.push(file.path);
+    }
+  } catch (err) {
+    return { outcome: "failed", files: [sh, fish, ...hooked], detail: String(err) };
+  }
+  return { outcome: token ? "written" : "cleared", files: [sh, fish, ...hooked] };
+}
 
-## Before launch
+// src/local-access.ts
+function syncLocalAccess(token, clients = detectMcpClients()) {
+  const lines = [];
+  const shell = writeShellEnv(token);
+  if (shell.outcome === "failed") lines.push(`  ${TOKEN_ENV} not updated for new shells: ${shell.detail}`);
+  else lines.push(token ? `  new shells get ${TOKEN_ENV} for this login` : `  new shells no longer get ${TOKEN_ENV}`);
+  if (token) {
+    for (const registered of refreshMcpRegistrations({ token, mcpUrl: mcpUrlFor(apiBase()) }, clients)) {
+      const name = clients.find((client) => client.id === registered.agent)?.name ?? registered.agent;
+      lines.push(registered.outcome === "registered" ? `  agentsky MCP server for ${name} now uses this login` : `  agentsky MCP server for ${name} not updated: ${registered.detail ?? registered.outcome} \u2014 run \`sky setup skill\``);
+    }
+    return lines;
+  }
+  const holding = clients.filter((client) => hasMcpServer(client)).map((client) => client.name);
+  if (holding.length) lines.push(`  the agentsky MCP server in ${holding.join(", ")} still uses the old token: \`sky auth login\` replaces it, or revoke the key in Developer \u2192 API keys`);
+  return lines;
+}
 
-Check one real session:
+// src/login.ts
+function b64url(buf) {
+  return buf.toString("base64url");
+}
+function openBrowser2(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    spawn2(cmd, [url], { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+async function login(opts) {
+  const verifier = b64url(randomBytes(32));
+  const challenge = b64url(createHash4("sha256").update(verifier).digest());
+  const result = opts.noBrowser ? await headlessLogin(verifier, challenge) : await browserLogin(verifier, challenge);
+  saveConfig({
+    ...loadConfig(),
+    apiBase: apiBase(),
+    token: result.token,
+    email: result.user.email ?? void 0,
+    currentUniverse: void 0
+    // personal by default
+  });
+  console.log(
+    `Logged in as ${result.user.email ?? "you"}${result.universe ? ` (universe: ${result.universe.slug})` : ""}`
+  );
+  for (const line of syncLocalAccess(result.token)) console.log(line);
+}
+async function browserLogin(verifier, challenge) {
+  const state = b64url(randomBytes(16));
+  const code = await new Promise((resolve10, reject) => {
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end("<p>Logged in \u2014 you can close this tab and return to your terminal.</p>");
+      const got = url.searchParams.get("code");
+      if (url.searchParams.get("state") !== state || !got) {
+        reject(new Error("login callback state mismatch"));
+      } else {
+        resolve10(got);
+      }
+      server.close();
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      const authorizeUrl = `${consoleBase()}/cli/authorize?state=${state}&port=${port}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
+      console.log("Opening your browser to authorize this machine\u2026");
+      console.log(`If it doesn't open, visit:
+  ${authorizeUrl}`);
+      openBrowser2(authorizeUrl);
+    });
+    setTimeout(() => {
+      server.close();
+      reject(new Error("login timed out after 10 minutes"));
+    }, 10 * 60 * 1e3).unref();
+  });
+  return api(
+    "POST",
+    "/cli/token-exchange",
+    { code, verifier, clientName: `cli ${hostname()}` },
+    { auth: false }
+  );
+}
+async function headlessLogin(verifier, challenge) {
+  const request = b64url(randomBytes(24));
+  const authorizeUrl = `${consoleBase()}/cli/authorize?request=${request}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
+  console.log(`Visit this URL on any device to authorize:
+  ${authorizeUrl}
+`);
+  process.stdout.write("Waiting for approval\u2026");
+  const deadline = Date.now() + 10 * 60 * 1e3;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 3e3));
+    const res = await fetch(
+      `${apiBase()}/cli/poll?request=${request}&verifier=${encodeURIComponent(verifier)}&clientName=${encodeURIComponent(`cli ${hostname()}`)}`,
+      { headers: { "user-agent": USER_AGENT } }
+    );
+    if (!res.ok) {
+      const body2 = await res.json().catch(() => null);
+      throw new Error(body2?.error?.message ?? `poll failed (${res.status})`);
+    }
+    const body = await res.json();
+    if (body.status === "approved") {
+      console.log(" approved.");
+      return body;
+    }
+    process.stdout.write(".");
+  }
+  throw new Error("login timed out after 10 minutes");
+}
 
-- \`GET /v1/sessions/{id}\` lists only the upload under \`resources\`.
-- \`GET /v1/hook_rules\` and \`GET /v1/universes/{slug}/policies\` show the rules
-  above.
-- Ask the agent directly to run a shell command. The answer has to be the
-  platform's refusal.
-- A file id from another customer's workspace is refused at session create.
-`;
+// src/connectors.ts
+async function listApps(query, limit = 50) {
+  const apps = [];
+  let cursor = null;
+  do {
+    const params = new URLSearchParams();
+    if (query) params.set("q", query);
+    if (cursor) params.set("cursor", cursor);
+    const qs = params.toString();
+    const page = await api("GET", `/connectors/apps${qs ? `?${qs}` : ""}`);
+    apps.push(...page.apps);
+    cursor = page.next_cursor;
+  } while (cursor && apps.length < limit);
+  return apps.slice(0, limit);
+}
+function connectionLine2(c) {
+  return `${c.id}  ${c.app_name} (${c.app})  ${c.label}  since ${c.created_at.slice(0, 10)}`;
+}
+function workspaceConnectionLine(c) {
+  const owner = c.workspace_owned ? "the workspace" : c.mine ? "you" : c.shared_by?.name ?? c.shared_by?.user_id ?? "someone";
+  return `${c.connection_id}  ${c.app_name} (${c.app})  ${c.label}  shared by ${owner}`;
+}
+function browserReturn(start, opts = {}) {
+  return new Promise((resolve10, reject) => {
+    const server = createServer2((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/done" && url.pathname !== "/failed") {
+        res.writeHead(404).end();
+        return;
+      }
+      const ok = url.pathname === "/done";
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(ok ? "<p>Connected \u2014 you can close this tab and return to your terminal.</p>" : "<p>The app was not connected. Return to your terminal.</p>");
+      server.close();
+      if (ok) resolve10(url.searchParams.get("account_id") ?? void 0);
+      else reject(new ApiError(400, "connect_failed", "the app was not connected"));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      const base = `http://127.0.0.1:${port}`;
+      start(`${base}/done`, `${base}/failed`).then(
+        (authorizeUrl) => {
+          console.log(`Authorize access in your browser:
+  ${authorizeUrl}`);
+          if (opts.open !== false) openBrowser2(authorizeUrl);
+        },
+        (err) => {
+          server.close();
+          reject(err);
+        }
+      );
+    });
+    setTimeout(() => {
+      server.close();
+      reject(new ApiError(408, "connect_timeout", "nobody finished the authorization within 10 minutes"));
+    }, opts.timeoutMs ?? 10 * 6e4).unref();
+  });
+}
+async function connectApp(app, opts = {}) {
+  const base = opts.workspace ? `/universes/${encodeURIComponent(opts.workspace)}/connections` : "/connectors/connections";
+  const accountId = await browserReturn(async (success_url, error_url) => {
+    const { url } = await api("POST", base, { app, success_url, error_url });
+    return url;
+  }, { open: opts.open });
+  const done = await api("POST", `${base}/complete`, {
+    app,
+    ...accountId ? { account_id: accountId } : {}
+  });
+  return done.connection;
 }
-function workspacesReferenceDoc() {
-  return `# Workspaces in AgentSky
-
-A workspace (also called a universe) groups agents and sessions. Every API call
-and MCP tool accepts an optional workspace slug.
-
-## How to choose
-
-1. The person named one \u2192 use it.
-2. Check the git root for \`.agentsky.json\` with a \`"workspace"\` key \u2192 use that.
-3. Neither \u2192 use the account default (personal workspace). Never ask.
-
-## Applying it
-
-- MCP tools: pass \`workspace: "<slug>"\` on tools that accept it.
-- sky CLI: \`--workspace <slug>\` on any command, or set \`SKY_WORKSPACE=<slug>\`.
-- Tools that take a \`task_id\` or \`session_id\` inherit that task's workspace
-  automatically; one task never spans workspaces.
-
-## Listing workspaces
-
-\`sky workspace list\` (or \`sky universe list\`) prints your workspaces, with
-\`*\` marking the current default.
-
-## .agentsky.json
 
-To set a per-repo default, create \`.agentsky.json\` at the git root:
+// src/routine-triggers.ts
+var triggerPath = (id, resource) => `/routines/${encodeURIComponent(id)}/${resource}`;
+function inboundLine(u) {
+  if (!u) return "no inbound URL \u2014 make one with --create";
+  return u.url ?? `inbound URL ${u.prefix}\u2026 made ${u.created_at.slice(0, 10)}${u.last_used_at ? `, last used ${u.last_used_at.slice(0, 16).replace("T", " ")}` : ", never used"}`;
+}
+function precheckLine(p) {
+  if (!p) return "no precheck: every scheduled fire runs";
+  const last = p.last_result ? `last check ${p.last_result}${p.last_error ? ` (${p.last_error.type}: ${p.last_error.message})` : ""}` : "not checked yet";
+  return `fires only when ${p.url} changes \xB7 ${last}`;
+}
+function triggerLine(t, available = true) {
+  if (!t) return "no chat trigger";
+  const where = t.thread_id ? `thread ${t.thread_id} on ${t.connection_id}` : `any conversation on ${t.connection_id}`;
+  const what = t.text_prefix ? `messages starting "${t.text_prefix}"` : "every message";
+  return `${what} in ${where} start a run${available ? "" : " (chat messages are not offered to routines in this deployment)"}`;
+}
+function deliverLine(d) {
+  return d ? `answers post to thread ${d.thread_id} on ${d.connection_id}` : "answers are posted nowhere";
+}
+function triggerBody(opts) {
+  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
+  return { connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {}, ...opts.prefix ? { text_prefix: opts.prefix } : {} };
+}
+function deliverBody(opts) {
+  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
+  return { type: "channel_thread", connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {} };
+}
+async function triggerRequest(id, resource, change) {
+  const path = triggerPath(id, resource);
+  if (change.remove) return api("DELETE", path);
+  if (change.create) return api("POST", path);
+  if (change.body) return api("PUT", path, change.body);
+  return api("GET", path);
+}
 
-\`\`\`json
-{"workspace": "my-team-slug"}
-\`\`\`
-`;
+// src/session-workspace.ts
+import { spawnSync as spawnSync4 } from "child_process";
+import { createHash as createHash5, randomUUID } from "crypto";
+import { readdirSync as readdirSync5, statSync as statSync6 } from "fs";
+import { basename as basename7, join as join12, relative as relative3, resolve as resolve5 } from "path";
+var SINGLE_IMPORT_MAX = 25 * 1024 * 1024;
+var PART_SIZE = 8 * 1024 * 1024;
+var SKIPPED2 = /* @__PURE__ */ new Set([".git", "node_modules"]);
+var workspacePath = (id) => `/sessions/${encodeURIComponent(id)}/workspace`;
+async function listFiles2(id, path, hidden) {
+  const query = new URLSearchParams();
+  if (path) query.set("path", path);
+  if (hidden) query.set("hidden", "true");
+  const qs = query.toString();
+  return api("GET", `${workspacePath(id)}/files${qs ? `?${qs}` : ""}`);
 }
-function installedVersion(dir) {
-  try {
-    const marker = JSON.parse(readFileSync9(join10(dir, SKILL_MARKER), "utf8"));
-    return typeof marker.version === "string" ? marker.version : null;
-  } catch {
-    return null;
+function entryLine(e) {
+  const size = e.type === "directory" ? "-" : String(e.size ?? 0);
+  return `${e.type === "directory" ? "d" : "-"} ${size.padStart(10)}  ${(e.mtime ?? "").slice(0, 16).replace("T", " ")}  ${e.name}${e.type === "directory" ? "/" : ""}`;
+}
+async function readFile(id, path) {
+  return (await apiBytes("GET", `${workspacePath(id)}/files/content?path=${encodeURIComponent(path)}`)).bytes;
+}
+function renderChanges(changes) {
+  if (!changes.repos.length) return [`no git repository under ${changes.root}`];
+  return changes.repos.flatMap((r) => [
+    `${r.path === "." ? changes.root : r.path}: ${r.status ? "changed" : "clean"}`,
+    ...(r.stat ?? r.status ?? "").split("\n").filter(Boolean).map((line) => `  ${line}`)
+  ]);
+}
+async function workspacePatch(id, repo) {
+  const { patch, ...meta } = await api("POST", `${workspacePath(id)}/patch`, { repo });
+  return { meta, patch: Buffer.from(patch, "base64") };
+}
+function folderFiles(dir) {
+  const git2 = spawnSync4("git", ["-C", dir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8" });
+  const top = spawnSync4("git", ["-C", dir, "rev-parse", "--show-prefix"], { encoding: "utf8" });
+  if (git2.status === 0 && top.status === 0) {
+    return git2.stdout.split("\0").filter((path) => path && statSync6(join12(dir, path), { throwIfNoEntry: false })?.isFile());
   }
+  const files2 = [];
+  const walk = (at) => {
+    for (const entry2 of readdirSync5(at, { withFileTypes: true })) {
+      if (SKIPPED2.has(entry2.name)) continue;
+      const full = join12(at, entry2.name);
+      if (entry2.isDirectory()) walk(full);
+      else if (entry2.isFile()) files2.push(relative3(dir, full));
+    }
+  };
+  walk(dir);
+  return files2;
 }
-function isInstalledSkill(dir) {
-  return installedVersion(dir) !== null;
+function folderArchive(dir, files2) {
+  const tar = spawnSync4("tar", ["--format=ustar", "-czf", "-", "-C", dir, "-T", "-"], {
+    input: files2.join("\n"),
+    env: { ...process.env, COPYFILE_DISABLE: "1" },
+    maxBuffer: 2 * 1024 * 1024 * 1024
+  });
+  if (tar.status !== 0) throw new ApiError(400, "archive_failed", `tar failed: ${tar.stderr.toString().trim()}`);
+  return tar.stdout;
 }
-function installSkill(agent2, opts = {}) {
-  const dir = join10(agent2.skillsDir, SKILL_NAME);
-  const previous = installedVersion(dir);
-  const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
-  if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
-  if (outcome !== "current") {
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join10(dir, "SKILL.md"), skillDocument());
-    writeFileSync4(join10(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
-`);
+async function importFolder(id, dir, opts = {}) {
+  const root = resolve5(dir);
+  const name = opts.name ?? basename7(root);
+  const archive = opts.archive ?? folderArchive(root, folderFiles(root));
+  if (archive.length <= SINGLE_IMPORT_MAX) {
+    const res = await apiBytes("POST", `${workspacePath(id)}/import?name=${encodeURIComponent(name)}`, { bytes: archive, mediaType: "application/gzip" });
+    return res.json();
   }
-  if (opts.catalog) {
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join10(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+  const sha256 = createHash5("sha256").update(archive).digest("hex");
+  let upload = await api("POST", `${workspacePath(id)}/imports`, { name, size: archive.length, sha256, part_size: PART_SIZE });
+  const uploadPath = `${workspacePath(id)}/imports/${encodeURIComponent(upload.id)}`;
+  for (let part = 0; part < upload.parts; part += 1) {
+    if (upload.received.includes(part)) continue;
+    const bytes = archive.subarray(part * upload.part_size, (part + 1) * upload.part_size);
+    await apiBytes("PUT", `${uploadPath}/parts/${part}`, { bytes, mediaType: "application/octet-stream" });
   }
-  const refsDir = join10(dir, REFERENCES_DIR);
-  mkdirSync2(refsDir, { recursive: true });
-  writeFileSync4(join10(refsDir, "import.md"), importReferenceDoc());
-  writeFileSync4(join10(refsDir, "workspaces.md"), workspacesReferenceDoc());
-  writeFileSync4(join10(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
-  return { agent: agent2.id, path: dir, outcome };
+  upload = await api("POST", `${uploadPath}/complete`);
+  while (upload.state !== "imported" && upload.state !== "failed") {
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
+    upload = await api("GET", uploadPath);
+  }
+  if (upload.state === "failed") throw new ApiError(422, upload.error?.code ?? "import_failed", upload.error?.message ?? "the import failed");
+  return { path: upload.path ?? name, files: upload.files ?? 0 };
 }
-
-// src/mcp-register.ts
-var MCP_SERVER_NAME = SKILL_NAME;
-var CODEX_TOKEN_ENV = "AGENTSKY_API_KEY";
-function systemCommandRunner() {
+function renderAccess(a) {
+  const lines = [
+    `${a.session_id}${a.title ? ` \u2014 ${a.title}` : ""}`,
+    `  ${a.visibility === "private" ? "private to its owner" : `visible to ${a.workspace.name} (${a.workspace.slug})`} \xB7 you are its ${a.access}`,
+    `  owner: ${a.owner.name ?? a.owner.email ?? "unknown"}`
+  ];
+  if (a.viewers) lines.push(a.viewers.length ? `  viewers: ${a.viewers.map((v) => v.email).join(", ")}` : "  viewers: none");
+  return lines;
+}
+function accessPatch(opts) {
+  if (opts.private && opts.members) throw new ApiError(400, "invalid_request", "pass --private or --members, not both");
   return {
-    has: (command) => spawnSync4(command, ["--version"], { stdio: "ignore" }).status === 0,
-    run: (command, args) => {
-      const result = spawnSync4(command, args, { encoding: "utf8" });
-      return { status: result.status, stderr: result.stderr ?? "" };
-    }
+    ...opts.private ? { visibility: "private" } : opts.members ? { visibility: "workspace" } : {},
+    ...opts.addViewer?.length ? { add_viewers: opts.addViewer } : {},
+    ...opts.removeViewer?.length ? { remove_viewers: opts.removeViewer } : {}
   };
 }
-function mcpUrlFor(apiBase2) {
-  return `${apiBase2.replace(/\/$/, "")}/mcp`;
+function engineChange(model, thinking) {
+  if (!model && !thinking) return null;
+  return {
+    ...model ? { llm: model } : {},
+    ...thinking ? { reasoningEffort: thinking === "default" ? null : thinking } : {}
+  };
 }
-function mcpCommands(agent2, opts) {
-  if (agent2 === "claude_code") {
-    return {
-      command: "claude",
-      remove: ["mcp", "remove", "--scope", "user", MCP_SERVER_NAME],
-      add: ["mcp", "add", "--scope", "user", "--transport", "http", MCP_SERVER_NAME, opts.mcpUrl, "--header", `Authorization: Bearer ${opts.token}`]
-    };
+var TERMINAL = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
+async function handoff(id, targetAgent, opts = {}) {
+  let { handoff: h } = await api("POST", `/sessions/${encodeURIComponent(id)}/handoff`, {
+    target_agent: targetAgent,
+    ...opts.fromMessage ? { last_message_id: opts.fromMessage } : {}
+  }, { idempotencyKey: opts.idempotencyKey ?? randomUUID() });
+  opts.onStatus?.(h);
+  while (opts.wait && !TERMINAL.has(h.status)) {
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
+    const next = (await api("GET", `/session-handoffs/${encodeURIComponent(h.id)}`)).handoff;
+    if (next.status !== h.status) opts.onStatus?.(next);
+    h = next;
   }
-  if (agent2 === "codex") {
-    return {
-      command: "codex",
-      remove: ["mcp", "remove", MCP_SERVER_NAME],
-      add: ["mcp", "add", MCP_SERVER_NAME, "--url", opts.mcpUrl, "--bearer-token-env-var", CODEX_TOKEN_ENV]
-    };
+  return h;
+}
+
+// src/render.ts
+var dim = (s) => `\x1B[2m${s}\x1B[0m`;
+var red = (s) => `\x1B[31m${s}\x1B[0m`;
+function clip(value, max = 120) {
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  return text.length > max ? `${text.slice(0, max)}\u2026` : text;
+}
+function renderEvent(event, data) {
+  const part = data.part;
+  switch (event) {
+    case "agent.message":
+      console.log(String(data.text ?? ""));
+      break;
+    case "agent.reasoning":
+      console.log(dim(`\xB7 ${clip(part?.text ?? "")}`));
+      break;
+    case "agent.tool_use":
+      console.log(dim(`\u2192 ${String(part?.tool_name ?? "tool")}(${clip(part?.args ?? {}, 80)})`));
+      break;
+    case "agent.tool_result":
+      console.log(dim(`\u2190 ${String(part?.tool_name ?? "tool")} ${String(part?.status ?? "")}`));
+      break;
+    case "agent.status":
+      console.log(dim(`\u2026 ${String(part?.level ?? "")} ${String(part?.text ?? "")}`.trim()));
+      break;
+    case "user.interrupt":
+      console.log(dim("\u23F9 interrupting"));
+      break;
+    case "session.error": {
+      const error = data.error;
+      const message2 = String(error?.message ?? error?.type ?? "unknown");
+      if (error?.retry_status === "retrying") console.error(dim(`retrying: ${message2}`));
+      else console.error(red(`error: ${message2}`));
+      break;
+    }
+    case "session.status_terminated":
+      console.log(dim("session terminated"));
+      break;
+    default:
+      break;
   }
-  return null;
-}
-function redact(text, token) {
-  return text.split(token).join(`${token.slice(0, 10)}\u2026`);
 }
-function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
-  if (agent2.id === "cursor") {
-    return registerCursorMcpServer(agent2, opts);
+
+// src/session-read.ts
+var TURN_TYPES = ["user.message", "agent.message", "session.status_idle", "session.status_terminated", "session.error"];
+function latestTurn(events) {
+  let start = 0;
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    if (events[index].type === "user.message") {
+      start = index + 1;
+      break;
+    }
   }
-  const commands = mcpCommands(agent2.id, opts);
-  if (!commands) return { agent: agent2.id, outcome: "unsupported" };
-  if (!runner.has(commands.command)) return { agent: agent2.id, outcome: "no_command", detail: `${commands.command} is not on PATH` };
-  if (opts.dryRun) return { agent: agent2.id, outcome: "planned", detail: redact([commands.command, ...commands.add].join(" "), opts.token) };
-  runner.run(commands.command, commands.remove);
-  const added = runner.run(commands.command, commands.add);
-  if (added.status !== 0) return { agent: agent2.id, outcome: "failed", detail: redact(added.stderr.trim() || `exit ${added.status}`, opts.token) };
-  return agent2.id === "codex" ? { agent: agent2.id, outcome: "registered", detail: `set ${CODEX_TOKEN_ENV} to an AgentSky API token in the shell that runs codex` } : { agent: agent2.id, outcome: "registered" };
-}
-function registerCursorMcpServer(agent2, opts) {
-  const configPath2 = `${agent2.root}/mcp.json`;
-  const entry2 = {
-    url: opts.mcpUrl,
-    headers: { Authorization: `Bearer ${opts.token}` }
-  };
-  if (opts.dryRun) {
-    const preview = JSON.stringify({ agentsky: { url: opts.mcpUrl, headers: { Authorization: `Bearer ${opts.token.slice(0, 10)}\u2026` } } }, null, 2);
-    return { agent: agent2.id, outcome: "planned", detail: `would write to ${configPath2}: ${preview}` };
+  const reading = { finished: false, messages: [], errors: [] };
+  for (const event of events.slice(start)) {
+    if (event.type === "agent.message" && event.text?.trim()) reading.messages.push(event.text);
+    else if (event.type === "session.error" && event.error?.retry_status !== "retrying") {
+      reading.errors.push(event.error?.message ?? event.error?.type ?? "unknown error");
+    } else if (event.type === "session.status_terminated") reading.finished = true;
+    else if (event.type === "session.status_idle" && event.stop_reason?.type !== "requires_action") reading.finished = true;
   }
-  let existing = { mcpServers: {} };
-  try {
-    const raw = readFileSync10(configPath2, "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      existing = parsed;
-    }
-  } catch {
+  return reading;
+}
+async function history2(sessionId) {
+  const events = [];
+  let cursor = null;
+  for (; ; ) {
+    const query = new URLSearchParams({ limit: "500" });
+    for (const type of TURN_TYPES) query.append("types[]", type);
+    if (cursor) query.set("cursor", cursor);
+    const page = await api(
+      "GET",
+      `/sessions/${encodeURIComponent(sessionId)}/events?${query}`
+    );
+    events.push(...page.events);
+    if (!page.hasMore || !page.cursor) return events;
+    cursor = page.cursor;
   }
-  const updated = {
-    ...existing,
-    mcpServers: { ...existing.mcpServers ?? {}, [MCP_SERVER_NAME]: entry2 }
-  };
-  try {
-    writeFileSync5(configPath2, JSON.stringify(updated, null, 2) + "\n", "utf8");
-  } catch (err) {
-    return { agent: agent2.id, outcome: "failed", detail: String(err) };
+}
+async function readTurn(sessionId, opts = {}) {
+  const deadline = Date.now() + (opts.timeoutSeconds ?? 600) * 1e3;
+  for (; ; ) {
+    const reading = latestTurn(await history2(sessionId));
+    if (reading.finished || !opts.wait || Date.now() >= deadline) return reading;
+    await new Promise((resolve10) => setTimeout(resolve10, opts.intervalMs ?? 3e3));
   }
-  return { agent: agent2.id, outcome: "registered" };
 }
 
+// src/setup.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname7, join as join15 } from "path";
+import { createInterface as createInterface3 } from "readline";
+
 // src/setup-local.ts
 import { isUtf8 as isUtf83 } from "buffer";
-import { existsSync as existsSync7, readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync7 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join11, resolve as resolve6 } from "path";
-import { parse as parseToml3 } from "smol-toml";
+import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync7 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join13, resolve as resolve6 } from "path";
+import { parse as parseToml4 } from "smol-toml";
 var MAX_SKILL_FILE_BYTES = 1024 * 1024;
 var MAX_IMPORT_DEPTH = 5;
 var SKIPPED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
@@ -3347,11 +3558,11 @@ function redacted(data) {
 function skillFiles2(root, prefix) {
   const files2 = [];
   for (const entry2 of readdirSync6(root, { withFileTypes: true })) {
-    const path = join11(root, entry2.name);
+    const path = join13(root, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIPPED_DIRS.has(entry2.name)) files2.push(...skillFiles2(path, `${prefix}/${entry2.name}`));
     } else if (entry2.isFile() && !sensitive(entry2.name) && statSync7(path).size <= MAX_SKILL_FILE_BYTES) {
-      const bytes = redacted(readFileSync11(path));
+      const bytes = redacted(readFileSync12(path));
       if (bytes) files2.push({ path: `${prefix}/${entry2.name}`, bytes });
     }
   }
@@ -3361,9 +3572,9 @@ function readLocalSkills(agents) {
   const skills2 = [];
   const ignored = [];
   for (const agent2 of agents) {
-    if (!existsSync7(agent2.skillsDir)) continue;
+    if (!existsSync9(agent2.skillsDir)) continue;
     for (const entry2 of readdirSync6(agent2.skillsDir, { withFileTypes: true })) {
-      const dir = join11(agent2.skillsDir, entry2.name);
+      const dir = join13(agent2.skillsDir, entry2.name);
       let isDir2 = entry2.isDirectory();
       if (entry2.isSymbolicLink()) {
         try {
@@ -3372,8 +3583,8 @@ function readLocalSkills(agents) {
           isDir2 = false;
         }
       }
-      if (!isDir2 || !existsSync7(join11(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
-      const name = frontmatterName(readFileSync11(join11(dir, "SKILL.md"), "utf8"));
+      if (!isDir2 || !existsSync9(join13(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
+      const name = frontmatterName(readFileSync12(join13(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
         continue;
@@ -3401,11 +3612,11 @@ function inlineImports(content, from, home, depth, seen) {
     }
     const target = fence ? void 0 : line.match(/^@(\S+\.(?:md|markdown|txt))$/i)?.[1];
     if (!target || depth >= MAX_IMPORT_DEPTH) return line;
-    const path = target.startsWith("~/") ? join11(home, target.slice(2)) : isAbsolute2(target) ? target : resolve6(dirname5(from), target);
+    const path = target.startsWith("~/") ? join13(home, target.slice(2)) : isAbsolute2(target) ? target : resolve6(dirname6(from), target);
     if (seen.includes(path)) return "";
     let imported;
     try {
-      imported = readFileSync11(path, "utf8");
+      imported = readFileSync12(path, "utf8");
     } catch {
       return line;
     }
@@ -3413,15 +3624,15 @@ function inlineImports(content, from, home, depth, seen) {
     return inlineImports(imported, path, home, depth + 1, seen).trim();
   }).join("\n");
 }
-function readGlobalInstructions(agents, home = homedir6()) {
+function readGlobalInstructions(agents, home = homedir8()) {
   const found = [];
   for (const agent2 of agents) {
     const file = INSTRUCTION_FILES2[agent2.id];
     if (!file) continue;
-    const path = join11(agent2.root, file);
+    const path = join13(agent2.root, file);
     let raw;
     try {
-      raw = readFileSync11(path, "utf8");
+      raw = readFileSync12(path, "utf8");
     } catch {
       continue;
     }
@@ -3440,7 +3651,7 @@ ${item.content.trim()}`).join("\n\n");
 }
 function readJson3(path) {
   try {
-    return JSON.parse(readFileSync11(path, "utf8"));
+    return JSON.parse(readFileSync12(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -3454,18 +3665,19 @@ function bearerOf(def) {
   return match?.[1] ?? null;
 }
 function serversOf(agent2, home) {
-  if (agent2.id === "claude_code") return readJson3(join11(home, ".claude.json"))?.mcpServers ?? {};
-  if (agent2.id === "cursor") return readJson3(join11(agent2.root, "mcp.json"))?.mcpServers ?? {};
+  if (agent2.id === "claude_code") return readJson3(join13(home, ".claude.json"))?.mcpServers ?? {};
+  if (agent2.id === "cursor") return readJson3(join13(agent2.root, "mcp.json"))?.mcpServers ?? {};
   try {
-    return parseToml3(readFileSync11(join11(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
+    return parseToml4(readFileSync12(join13(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
   } catch {
     return {};
   }
 }
-function findLocalSecrets(agents, home = homedir6()) {
+function findLocalSecrets(agents, home = homedir8()) {
   const secrets2 = [];
   for (const agent2 of agents) {
     for (const [name, def] of Object.entries(serversOf(agent2, home))) {
+      if (name === SKILL_NAME) continue;
       if (!def || typeof def !== "object" || typeof def.url !== "string" || !/^https:\/\//i.test(def.url)) continue;
       const token = bearerOf(def);
       if (!token || /^\$\{?[A-Za-z_]/.test(token)) continue;
@@ -3478,9 +3690,9 @@ function findLocalSecrets(agents, home = homedir6()) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync12 } from "fs";
-import { homedir as homedir7 } from "os";
-import { join as join12 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join14 } from "path";
 import { createInterface as createInterface2 } from "readline";
 var ALIASES = {
   claude: "anthropic",
@@ -3575,12 +3787,12 @@ async function connectClaude() {
   const expiry = sub.expiresAt ? ` (expires ~${sub.expiresAt.slice(0, 10)})` : "";
   console.log(`Connected Claude subscription${expiry}. Powers new eligible agents.`);
 }
-function codexSignIn(env = process.env, home = homedir7()) {
-  const path = join12(env.CODEX_HOME || join12(home, ".codex"), "auth.json");
-  if (!existsSync8(path)) {
+function codexSignIn(env = process.env, home = homedir9()) {
+  const path = join14(env.CODEX_HOME || join14(home, ".codex"), "auth.json");
+  if (!existsSync10(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
-  const raw = readFileSync12(path, "utf8");
+  const raw = readFileSync13(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     return { path, raw, account: parsed.tokens?.account_id };
@@ -3588,12 +3800,12 @@ function codexSignIn(env = process.env, home = homedir7()) {
     throw new ApiError(400, "invalid_codex_auth", `${path} isn't valid JSON \u2014 re-run \`codex login\``);
   }
 }
-function cursorSignIn(env = process.env, home = homedir7()) {
-  const path = join12(env.XDG_CONFIG_HOME || join12(home, ".config"), "cursor", "auth.json");
-  if (!existsSync8(path)) {
+function cursorSignIn(env = process.env, home = homedir9()) {
+  const path = join14(env.XDG_CONFIG_HOME || join14(home, ".config"), "cursor", "auth.json");
+  if (!existsSync10(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
-  const raw = readFileSync12(path, "utf8");
+  const raw = readFileSync13(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") throw new Error("shape");
@@ -3752,11 +3964,11 @@ function planProviders(names2) {
   }));
 }
 function reportPath() {
-  return join13(dirname6(configPath()), "setup.json");
+  return join15(dirname7(configPath()), "setup.json");
 }
 function loadReport() {
   try {
-    const saved = JSON.parse(readFileSync13(reportPath(), "utf8"));
+    const saved = JSON.parse(readFileSync14(reportPath(), "utf8"));
     return { agents: saved.agents ?? [], plans: saved.plans ?? [], ...saved.secrets ? { secrets: saved.secrets } : {} };
   } catch {
     return { agents: [], plans: [] };
@@ -3769,8 +3981,8 @@ function mergeReport(base, next) {
   return { agents, plans, ...secrets2 ? { secrets: secrets2 } : {} };
 }
 function saveReport(report) {
-  mkdirSync3(dirname6(reportPath()), { recursive: true });
-  writeFileSync6(reportPath(), `${JSON.stringify(report, null, 2)}
+  mkdirSync4(dirname7(reportPath()), { recursive: true });
+  writeFileSync7(reportPath(), `${JSON.stringify(report, null, 2)}
 `, { mode: 384 });
 }
 function confirm3(question) {
@@ -3788,7 +4000,7 @@ function kb2(bytes) {
 function describe2(event) {
   switch (event.type) {
     case "agents":
-      return event.agents.length ? `Found on this computer: ${event.agents.map((agent2) => agent2.name).join(", ")}` : "No agent found on this computer (looked for Claude Code, Codex and Cursor).";
+      return event.agents.length ? `Found on this computer: ${event.agents.map((agent2) => agent2.name).join(", ")}` : "No agent found on this computer (looked for Claude Code, Codex, Cursor and Hermes).";
     case "catalog":
       return event.outcome === "read" ? `  agent catalog: ${event.agents} agent${event.agents === 1 ? "" : "s"}` : `  agent catalog: not read${event.detail ? ` (${event.detail})` : ""}; the skill looks agents up with search_catalog`;
     case "skill":
@@ -3798,12 +4010,23 @@ function describe2(event) {
         case "registered":
           return `  agentsky MCP server registered for ${event.agent}${event.detail ? ` (${event.detail})` : ""}`;
         case "planned":
-          return `  would run: ${event.detail}`;
+          return `  ${event.agent}: would ${event.detail}`;
         case "unsupported":
           return null;
         default:
           return `  agentsky MCP server not registered for ${event.agent}: ${event.detail ?? event.outcome}`;
       }
+    case "env":
+      switch (event.outcome) {
+        case "written":
+          return `  new shells get ${event.variable} for this login (open a new terminal, or run: . ${event.files[0]})`;
+        case "planned":
+          return `  would write ${event.variable} to ${event.files.join(", ")}`;
+        case "cleared":
+          return null;
+        default:
+          return `  ${event.variable} not set for new shells: ${event.detail ?? event.outcome}`;
+      }
     case "plan":
       return `  ${event.provider} plan: ${event.outcome === "already" ? "already connected" : event.outcome}${event.detail ? ` (${event.detail})` : ""}`;
     case "found": {
@@ -3893,8 +4116,11 @@ async function runSetup(opts) {
   };
   const agreed = async (question) => !interactive || confirm3(question);
   const has = (step) => steps.includes(step);
-  const agents = selectLocalAgents(opts.agents);
-  emit({ type: "agents", agents: agents.map((agent2) => ({ id: agent2.id, name: agent2.name })) });
+  const named = opts.agents?.filter((id) => id !== "hermes");
+  const agents = opts.agents?.length && !named?.length ? [] : selectLocalAgents(named);
+  const hermes = !opts.agents?.length || opts.agents.includes("hermes") ? detectHermes() : null;
+  const mcpOnly = hermes ? [hermes] : [];
+  emit({ type: "agents", agents: [...agents, ...mcpOnly].map((agent2) => ({ id: agent2.id, name: agent2.name })) });
   const needsToken = !opts.dryRun && (has("skill") || has("logins") || has("secrets") || has("import") && !opts.key);
   if (needsToken && !apiToken()) {
     if (opts.json) throw new ApiError(401, "not_logged_in", "not logged in \u2014 run `sky auth login`");
@@ -3916,10 +4142,14 @@ async function runSetup(opts) {
     held = new Map((claimed.body.skills ?? []).map((skill) => [skill.name, skill.fingerprint]));
   };
   await tell();
-  if (has("skill") && agents.length && await agreed("Add the AgentSky skill and MCP server to these agents, so they can hand work to others?")) {
+  if (has("skill") && (agents.length || mcpOnly.length) && await agreed("Add the AgentSky skill and MCP server to these agents, so they can hand work to others?")) {
     const { catalog: catalog2, detail } = await readCatalog();
     emit(catalog2 ? { type: "catalog", outcome: "read", agents: catalog2.length } : { type: "catalog", outcome: "unavailable", ...detail ? { detail } : {} });
     const token = apiToken();
+    const registerMcp = (client) => {
+      const registered = token ? registerMcpServer(client, { token, mcpUrl: mcpUrlFor(apiBase()), dryRun: opts.dryRun }) : { agent: client.id, outcome: "skipped", detail: "not logged in" };
+      emit({ type: "mcp", agent: client.id, outcome: registered.outcome, ...registered.detail ? { detail: registered.detail } : {} });
+    };
     for (const agent2 of agents) {
       try {
         const installed = installSkill(agent2, { dryRun: opts.dryRun, catalog: catalog2 });
@@ -3931,8 +4161,12 @@ async function runSetup(opts) {
         run2.agents.push({ id: agent2.id, skill: "failed" });
         continue;
       }
-      const registered = token ? registerMcpServer(agent2, { token, mcpUrl: mcpUrlFor(apiBase()), dryRun: opts.dryRun }) : { agent: agent2.id, outcome: "skipped", detail: "not logged in" };
-      emit({ type: "mcp", agent: agent2.id, outcome: registered.outcome, ...registered.detail ? { detail: registered.detail } : {} });
+      registerMcp(agent2);
+    }
+    for (const client of mcpOnly) registerMcp(client);
+    if (token) {
+      const shell = writeShellEnv(token, { dryRun: opts.dryRun });
+      emit({ type: "env", variable: TOKEN_ENV, outcome: shell.outcome, files: shell.files, ...shell.detail ? { detail: shell.detail } : {} });
     }
     await tell();
   }
@@ -4119,17 +4353,17 @@ function renderArtifact(artifact2) {
 }
 
 // src/skills-store.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync14, statSync as statSync8 } from "fs";
-import { basename as basename7, join as join14, relative as relative4, resolve as resolve7 } from "path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync15, statSync as statSync8 } from "fs";
+import { basename as basename8, join as join16, relative as relative4, resolve as resolve7 } from "path";
 function skillBundle(dir) {
   const root = resolve7(dir);
-  const top = basename7(root);
+  const top = basename8(root);
   const files2 = [];
   const walk = (path) => {
     for (const name of readdirSync7(path).sort()) {
-      const full = join14(path, name);
+      const full = join16(path, name);
       if (statSync8(full).isDirectory()) walk(full);
-      else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync14(full) });
+      else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync15(full) });
     }
   };
   walk(root);
@@ -4139,7 +4373,7 @@ function skillBundle(dir) {
 async function uploadSkill(dir, displayName) {
   const form = new FormData();
   for (const file of skillBundle(dir)) form.append("files", new Blob([new Uint8Array(file.bytes)]), file.path);
-  form.append("displayName", displayName ?? basename7(resolve7(dir)));
+  form.append("displayName", displayName ?? basename8(resolve7(dir)));
   return apiForm("POST", "/skills", form);
 }
 async function listSkills() {
@@ -4168,8 +4402,8 @@ async function getSkillUsage(since) {
 
 // src/task-export.ts
 import { createHash as createHash6 } from "crypto";
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname7, join as join15 } from "path";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname8, join as join17 } from "path";
 import { stringify as stringifyToml2 } from "smol-toml";
 var TEXT_MAX = 2e4;
 function scrub(text, names2) {
@@ -4457,14 +4691,14 @@ async function exportTaskHarbor(taskRef, outDir, opts) {
     fileBytes.set(file.path, bytes);
   }
   const files2 = buildHarborTask(record, { ...opts, fileBytes });
-  const written = [];
+  const written2 = [];
   for (const [path, content] of files2) {
-    const target = join15(outDir, path);
-    mkdirSync4(dirname7(target), { recursive: true });
-    writeFileSync7(target, content, typeof content === "string" ? { mode: path.endsWith(".sh") || path.endsWith(".py") ? 493 : 420 } : void 0);
-    written.push(path);
+    const target = join17(outDir, path);
+    mkdirSync5(dirname8(target), { recursive: true });
+    writeFileSync8(target, content, typeof content === "string" ? { mode: path.endsWith(".sh") || path.endsWith(".py") ? 493 : 420 } : void 0);
+    written2.push(path);
   }
-  return { written, record };
+  return { written: written2, record };
 }
 function parseRedactNames(values) {
   return (values ?? []).map((value) => {
@@ -4773,6 +5007,44 @@ function renderBrowserProfile(profile) {
   return lines.join("\n");
 }
 
+// src/mac.ts
+var REACH_KINDS = ["folder", "browser", "screen", "host"];
+var OPEN = /* @__PURE__ */ new Set(["pending", "asking"]);
+var MAX_WAIT_SECONDS = 25;
+async function listMacs() {
+  return (await api("GET", "/desktop/machines")).machines;
+}
+async function askMac(machine, kind, reason) {
+  if (!REACH_KINDS.includes(kind)) throw new Error(`kind must be one of ${REACH_KINDS.join(", ")}`);
+  return api("POST", `/desktop/machines/${encodeURIComponent(machine)}/reach-requests`, { kind, reason });
+}
+async function readReachRequest(id, waitSeconds = 0) {
+  const wait = Math.min(Math.max(Math.floor(waitSeconds), 0), MAX_WAIT_SECONDS);
+  return (await api("GET", `/desktop/reach-requests/${encodeURIComponent(id)}${wait ? `?wait=${wait}` : ""}`)).reach_request;
+}
+async function waitForAnswer(id, budgetSeconds) {
+  const until = Date.now() + budgetSeconds * 1e3;
+  for (; ; ) {
+    const left = Math.ceil((until - Date.now()) / 1e3);
+    const request = await readReachRequest(id, Math.max(left, 0));
+    if (!OPEN.has(request.status) || left <= 0) return request;
+  }
+}
+async function takeBack(mount) {
+  await api("DELETE", `/desktop/mounts/${encodeURIComponent(mount)}`);
+}
+function renderMac(mac2) {
+  const lends = mac2.reach ? mac2.reach.kinds.join(", ") || "nothing" : "unknown (update the Mac app)";
+  const screen = mac2.reach && !mac2.reach.kinds.includes("screen") ? `  screen: ${mac2.reach.screen}` : "";
+  const lines = [`${mac2.id}  ${mac2.name}  ${mac2.online ? "online" : "offline"}  can lend: ${lends}${screen}`];
+  for (const mount of mac2.mounts ?? []) lines.push(`  ${mount.id}  ${mount.kind.padEnd(7)}  ${mount.root ?? mount.label}`);
+  return lines.join("\n");
+}
+function renderReachRequest(request) {
+  if (request.status === "granted" && request.mount) return `${request.id}  granted  ${request.mount.id} (${request.mount.kind}${request.mount.root ? ` ${request.mount.root}` : ""})`;
+  return `${request.id}  ${request.status}${request.error ? `  ${request.error.code}: ${request.error.message}` : ""}`;
+}
+
 // src/compare.ts
 async function listComparisons(opts = {}) {
   const qs = opts.archived ? "?archived=true" : "";
@@ -4793,6 +5065,53 @@ async function listThreads2(opts = {}) {
   const { threads } = await api("GET", `/threads${qs}`);
   return threads;
 }
+async function startThread(body) {
+  return api("POST", "/threads", body);
+}
+var threadPath = (id) => `/threads/${encodeURIComponent(id)}`;
+async function getThread(id) {
+  return api("GET", threadPath(id));
+}
+async function organizeThread(id, change) {
+  return api("PATCH", threadPath(id), change);
+}
+async function deleteThread(id) {
+  return api("DELETE", threadPath(id));
+}
+async function sendThreadMessage(id, body) {
+  return api("POST", `${threadPath(id)}/messages`, body);
+}
+async function addThreadAgent(id, body) {
+  return api("POST", `${threadPath(id)}/agents`, body);
+}
+async function removeThreadAgent(id, columnId) {
+  return api("DELETE", `${threadPath(id)}/agents/${encodeURIComponent(columnId)}`);
+}
+async function interruptThread(id, columnId) {
+  return api("POST", `${threadPath(id)}/interrupt`, columnId ? { columnId } : {});
+}
+async function forkThread(id, body) {
+  return api("POST", `${threadPath(id)}/fork`, body);
+}
+async function changeThreadModel(id, change, columnId) {
+  return api("PATCH", `${threadPath(id)}/engine${columnId ? `?column=${encodeURIComponent(columnId)}` : ""}`, change);
+}
+async function searchThreads(q, opts = {}) {
+  const params = new URLSearchParams({ q, ...opts.threads ? { threads: opts.threads } : {}, ...opts.cursor ? { cursor: opts.cursor } : {} });
+  return api("GET", `/threads/search?${params}`);
+}
+async function threadOptions() {
+  return api("GET", "/threads/options");
+}
+async function joinThread(sessionId) {
+  return api("POST", "/threads/joinable", { sessionId });
+}
+async function listProjects() {
+  return api("GET", "/projects");
+}
+async function rememberProject(project2) {
+  return api("PUT", "/projects", { project: project2 });
+}
 function renderComparisonSummary(c) {
   const agents = c.agents.map((a) => `${a.agentType}/${a.llm}`).join(" vs ");
   const status = c.statusLine ?? c.attention ?? (c.archived ? "archived" : "active");
@@ -4805,20 +5124,129 @@ function renderThreadSummary(t) {
   return `${t.id.slice(0, 12)}  ${flag}${t.title.slice(0, 40).padEnd(44)} [${agents}]  ${status}`;
 }
 
+// src/library.ts
+var artifactPath = (id) => `/library/artifacts/${encodeURIComponent(id)}`;
+async function listLibrary(query = {}) {
+  const params = new URLSearchParams(Object.entries(query).filter((entry2) => Boolean(entry2[1])));
+  const qs = params.size ? `?${params}` : "";
+  return api("GET", `/library/artifacts${qs}`);
+}
+async function uploadToLibrary(file, requestId, workspace2) {
+  const form = new FormData();
+  form.append("file", new Blob([new Uint8Array(file.bytes)], { type: file.mediaType }), file.name);
+  form.append("requestId", requestId);
+  if (workspace2) form.append("workspace", workspace2);
+  return apiForm("POST", "/library/artifacts", form);
+}
+async function getLibraryArtifact(id) {
+  return api("GET", artifactPath(id));
+}
+async function deleteLibraryArtifact(id, revision) {
+  return api("DELETE", artifactPath(id), { revision });
+}
+async function shareLibraryArtifact(id, enabled) {
+  const { currentVersion } = await getLibraryArtifact(id);
+  return api("PATCH", `${artifactPath(id)}/share`, { enabled, revision: currentVersion });
+}
+async function placeLibraryArtifact(id, workspace2) {
+  return api("PATCH", `${artifactPath(id)}/workspace`, { workspace: workspace2 });
+}
+async function downloadLibraryArtifact(id, version) {
+  return apiBytes("GET", `${artifactPath(id)}/download${version ? `?version=${version}` : ""}`);
+}
+function renderLibraryArtifact(artifact2) {
+  const version = artifact2.currentVersion ? `v${artifact2.currentVersion}` : "";
+  return `${artifact2.id}  ${artifact2.name}  ${version}${artifact2.shared ? "  shared" : ""}`;
+}
+
+// src/billing-plans.ts
+var readCodingPlan = () => api("GET", "/billing/coding-plan");
+function joinCodingPlan(dollars2, requestId) {
+  const amount = Number(dollars2.trim().replace(/^\$/, ""));
+  if (!Number.isInteger(amount) || amount <= 0) throw new Error(`<dollars> must be whole dollars, got ${JSON.stringify(dollars2)}`);
+  return api("POST", "/billing/coding-plan", { amount_usd: amount, request_id: requestId });
+}
+var cancelCodingPlan = () => api("DELETE", "/billing/coding-plan");
+function renderCodingPlan(plan) {
+  if (!plan.active) {
+    const lines2 = [`coding plan: not a member (enrollment ${plan.enrollment}; monthly amounts $${plan.amounts_usd.join(", $")})`];
+    if (plan.charge_failure) lines2.push(`  last charge failed: ${plan.charge_failure}`);
+    return lines2.join("\n");
+  }
+  const until = plan.current_period_end?.slice(0, 10) ?? "?";
+  const lines = [`coding plan: $${plan.monthly_credit_usd}/month, paid until ${until}, ${plan.renews ? "renews" : "does not renew"}`];
+  if (plan.charge_failure) lines.push(`  last charge failed: ${plan.charge_failure}`);
+  return lines.join("\n");
+}
+function readRequestUsage(opts) {
+  const query = usageQuery(opts);
+  const cursor = opts.cursor ? `${query ? "&" : "?"}cursor=${encodeURIComponent(opts.cursor)}` : "";
+  return api("GET", `/billing/usage/requests${query}${cursor}`);
+}
+function renderRequestUsage(page) {
+  const lines = page.rows.map((row) => `${row.at.slice(0, 19).replace("T", " ")}  ${(row.apiKeyName ?? "").padEnd(16).slice(0, 16)} ${(row.model ?? "-").padEnd(28).slice(0, 28)} ${String(row.httpStatus ?? "-").padStart(3)} ${String(row.inputTokens ?? 0).padStart(9)} in ${String(row.outputTokens ?? 0).padStart(8)} out ${`$${(row.billedCostUsd ?? 0).toFixed(6)}`.padStart(11)}`);
+  if (!lines.length) lines.push("no API requests in this range");
+  if (page.nextCursor) lines.push(`more: --cursor ${page.nextCursor}`);
+  return lines.join("\n");
+}
+var readReferralLinks = () => api("GET", "/billing/referral-links");
+function referralLinkBody(opts) {
+  if (opts.price === void 0 === !opts.sku?.length) throw new Error("pass --price for every model, or --sku id=multiplier for each SKU, not both");
+  const body = {};
+  if (opts.price !== void 0) body.customer_multiplier = multiplier("--price", opts.price);
+  if (opts.sku?.length) {
+    body.sku_prices = opts.sku.map((pair) => {
+      const at = pair.lastIndexOf("=");
+      if (at <= 0) throw new Error(`--sku must be id=multiplier, got ${JSON.stringify(pair)}`);
+      return { sku_id: pair.slice(0, at), multiplier: multiplier("--sku", pair.slice(at + 1)) };
+    });
+  }
+  if (opts.email) body.audience_email = opts.email;
+  if (opts.uses) body.max_redemptions = wholeNumber2("--uses", opts.uses);
+  if (opts.days) body.expires_in_days = wholeNumber2("--days", opts.days);
+  return body;
+}
+var createReferralLink = (opts) => api("POST", "/billing/referral-links", referralLinkBody(opts));
+var disableReferralLink = (id) => api("POST", `/billing/referral-links/${encodeURIComponent(id)}/disable`);
+function renderReferralLinks(dashboard) {
+  const lines = [`priced from ${dashboard.source_plan.name}: customers pay at least ${Math.round(dashboard.source_plan.multiplier * 100)}% of public price`];
+  for (const link2 of dashboard.links) {
+    const state = link2.disabled_at ? "disabled" : `expires ${link2.expires_at.slice(0, 10)}`;
+    const audience = link2.audience_email ? ` for ${link2.audience_email} (${link2.email_status})` : "";
+    lines.push(`  ${link2.id}  ${Math.round(link2.customer_multiplier * 100)}%  ${link2.redeemed_count}/${link2.max_redemptions} used  ${state}${audience}`);
+    lines.push(`    ${link2.url}`);
+  }
+  if (!dashboard.links.length) lines.push("  no links yet");
+  const earned = dashboard.earnings.reduce((sum, earning) => sum + earning.amount_usd, 0);
+  lines.push(`earned $${earned.toFixed(2)} from ${dashboard.earnings.length} customer${dashboard.earnings.length === 1 ? "" : "s"}`);
+  return lines.join("\n");
+}
+function multiplier(flag, value) {
+  const trimmed = value.trim();
+  const percent = trimmed.endsWith("%");
+  const number = Number(percent ? trimmed.slice(0, -1) : trimmed);
+  if (!Number.isFinite(number) || number <= 0) throw new Error(`${flag} must be a share of public price like 0.8 or 80%, got ${JSON.stringify(value)}`);
+  return percent ? number / 100 : number;
+}
+function wholeNumber2(flag, value) {
+  if (!/^\d+$/.test(value.trim())) throw new Error(`${flag} must be a whole number, got ${JSON.stringify(value)}`);
+  return Number(value.trim());
+}
+
 // src/harness.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname8, join as join16, resolve as resolve8 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname9, join as join18, resolve as resolve8 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
-  return join16(resolve8(dir), HARNESS_FILE);
+  return join18(resolve8(dir), HARNESS_FILE);
 }
 function readHarnessFile(dir) {
   const path = harnessFilePath(dir);
-  if (!existsSync9(path)) {
+  if (!existsSync11(path)) {
     throw new Error(`no ${HARNESS_FILE} found in ${resolve8(dir)} \u2014 run \`sky harness init\` first`);
   }
   try {
-    return JSON.parse(readFileSync15(path, "utf8"));
+    return JSON.parse(readFileSync16(path, "utf8"));
   } catch (err) {
     throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -4845,11 +5273,11 @@ var INIT_COMMENT = `# harness.json \u2014 workspace harness profile skeleton
 `;
 function harnessInit(dir) {
   const path = harnessFilePath(dir);
-  if (existsSync9(path)) {
+  if (existsSync11(path)) {
     throw new Error(`${path} already exists \u2014 delete it to re-init`);
   }
-  mkdirSync5(dirname8(path), { recursive: true });
-  writeFileSync8(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+  mkdirSync6(dirname9(path), { recursive: true });
+  writeFileSync9(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
 `);
   console.log(`Created ${path}`);
   console.log(INIT_COMMENT);
@@ -5010,6 +5438,7 @@ auth.command("logout").description("forget the stored token (revoke it in Develo
   run(async () => {
     saveConfig({ ...loadConfig(), token: void 0, email: void 0 });
     console.log(`Logged out. (Token revocation: Developer \u2192 API keys.)`);
+    for (const line of syncLocalAccess(void 0)) console.log(line);
   })
 );
 auth.command("whoami").description("who the current token acts as").action(
@@ -5042,6 +5471,19 @@ auth.command("usage <provider>").description("plan allowance left on a connected
 auth.command("switch-to-credits <provider>").description("move the agents on a model subscription onto platform credits (do this before disconnecting)").option("--account <id>", "an additional account (default: the provider's first account)").option("-y, --yes", "skip the confirmation prompt").action(run(async (name, opts) => switchToCredits(name, opts)));
 auth.command("accounts").description("list connected model subscriptions and the agents they power").action(run(async () => listSubscriptions()));
 auth.command("disconnect <provider>").description("disconnect a model subscription (agents on it fail until switched)").option("-y, --yes", "skip the confirmation prompt").action(run(async (name, opts) => disconnect(name, opts)));
+auth.command("apps").description("the registered apps you let into your account, with the scopes you allowed").action(
+  run(async () => {
+    const grants = await listAppGrants();
+    if (!grants.length) console.log("No apps have access to your account.");
+    for (const grant of grants) console.log(renderAppGrant(grant));
+  })
+);
+auth.command("revoke-app <clientId>").description("remove an app's access to your account; its tokens stop working at once (admin scope)").action(
+  run(async (clientId) => {
+    await revokeAppGrant(clientId);
+    console.log(`Removed ${clientId}'s access to your account`);
+  })
+);
 var universe = program.command("universe").description("grouping boundary for agents");
 universe.command("list").action(
   run(async () => {
@@ -5088,7 +5530,7 @@ universe.command("invite <emails...>").description("invite people by email; prin
   run(async (emails, opts) => {
     const result = await invite(await workspaceSlug(opts.universe), emails, opts);
     for (const i of result.invites) console.log(`invited ${i.email} as ${i.role}  ${i.id}`);
-    for (const link of result.links) console.log(`  ${link.email} joins with: sky universe join ${link.token}`);
+    for (const link2 of result.links) console.log(`  ${link2.email} joins with: sky universe join ${link2.token}`);
     if (!result.invites.length) console.log("nobody new to invite \u2014 everyone listed is already a member");
   })
 );
@@ -5405,12 +5847,12 @@ session.command("share <ref>").description("print the session's share link, turn
       console.log(`Sharing is off for ${id}`);
       return;
     }
-    const link = await api("POST", path, {
+    const link2 = await api("POST", path, {
       access: opts.view ? "view" : "prompt",
       ...opts.rotate ? { rotate: true } : {}
     });
-    if (link.shareUrl) console.log(link.shareUrl);
-    else console.log(`view-only token: ${link.token} \u2014 read with GET /links/${link.token}/events`);
+    if (link2.shareUrl) console.log(link2.shareUrl);
+    else console.log(`view-only token: ${link2.token} \u2014 read with GET /links/${link2.token}/events`);
   })
 );
 session.command("usage <ref>").description("what the session has cost so far, and its newest billed entries").option("--limit <n>", "entries to list (default 20)").option("--json", "print the API's answer as JSON").action(
@@ -5558,7 +6000,7 @@ sessionWorkspace.command("cat <ref> <path>").description("print a file (up to 1
   run(async (ref, path, opts) => {
     const bytes = await readFile(await resolveSessionRef(ref), path);
     if (opts.out) {
-      writeFileSync9(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.error(`saved ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -5575,7 +6017,7 @@ sessionWorkspace.command("patch <ref> [repo]").description("the work in a reposi
     console.error(`${meta.repo}: ${meta.commits.length} commit${meta.commits.length === 1 ? "" : "s"} since ${meta.base_branch || "the imported copy"} (${meta.base_commit.slice(0, 12)})`);
     if (!patch.length) console.error("nothing changed");
     else if (opts.out) {
-      writeFileSync9(opts.out, patch);
+      writeFileSync10(opts.out, patch);
       console.error(`wrote ${opts.out} \u2014 apply with: git apply ${opts.out}`);
     } else process.stdout.write(patch);
   })
@@ -5720,7 +6162,7 @@ catalog.command("search [words...]").description("find an agent for a piece of w
 Start one:  sky session create @<handle> --message "<the job>"`);
   })
 );
-program.command("skill").description("the AgentSky skill for the agents on this machine").command("install").description("add the AgentSky skill to each installed agent (Claude Code, Codex, Cursor)").option("--agent <id...>", "only these agents: claude_code | codex | cursor").option("--dry-run", "say what would be written; write nothing").option("--json", "print the outcome per agent as JSON").action(
+program.command("skill").description("the AgentSky skill for the agents on this machine").command("install").description("add the AgentSky skill to each installed agent (Claude Code, Codex, Cursor)").option("--agent <id...>", "only these agents: claude_code | codex | cursor | hermes").option("--dry-run", "say what would be written; write nothing").option("--json", "print the outcome per agent as JSON").action(
   run(async (opts) => {
     const installs = selectLocalAgents(opts.agent).map((a) => installSkill(a, { dryRun: opts.dryRun }));
     if (opts.json) {
@@ -5736,7 +6178,7 @@ program.command("skill").description("the AgentSky skill for the agents on this
   })
 );
 program.command("setup [steps...]").description("bring this machine's agents to AgentSky: the skill and its MCP server, your plans, your skills and instructions, your tool keys").addHelpText("after", `
-Steps (all when none is named): ${SETUP_STEPS.join(" | ")}`).option("--key <key>", "a setup key from agentsky.dev/setup").option("--agent <id...>", "only these agents: claude_code | codex | cursor").option("--secret <name...>", "save these tool keys to your vault (asked one by one when omitted)").option("--no-claude", "leave the Claude plan alone").option("--plan <name...>", "connect only these plans: claude | chatgpt | cursor").option("--dry-run", "say what would be done; write and send nothing").option("-y, --yes", "do not ask before each step").option("--json", "print progress as one JSON object per line; never asks").action(
+Steps (all when none is named): ${SETUP_STEPS.join(" | ")}`).option("--key <key>", "a setup key from agentsky.dev/setup").option("--agent <id...>", "only these agents: claude_code | codex | cursor | hermes").option("--secret <name...>", "save these tool keys to your vault (asked one by one when omitted)").option("--no-claude", "leave the Claude plan alone").option("--plan <name...>", "connect only these plans: claude | chatgpt | cursor").option("--dry-run", "say what would be done; write and send nothing").option("-y, --yes", "do not ask before each step").option("--json", "print progress as one JSON object per line; never asks").action(
   run(async (steps, opts) => {
     const unknown = steps.find((step) => !SETUP_STEPS.includes(step));
     if (unknown) throw new Error(`unknown step ${unknown} \u2014 expected ${SETUP_STEPS.join(" | ")}`);
@@ -5784,8 +6226,8 @@ secrets.command("unset <id> <key>").action(
 program.command("launch").description("scaffold ./agent.toml if absent, create the agent, print its address").option("-f, --file <path>", "agent file", "agent.toml").option("--type <type>", "override the file's harness: hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "override the file's model (must suit the harness)").action(
   run(async (opts) => {
     const path = resolve9(opts.file);
-    if (!existsSync10(path)) {
-      const name = basename8(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
+    if (!existsSync12(path)) {
+      const name = basename9(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
       scaffoldAgentFile(path, name);
       console.log(`Scaffolded ${opts.file} \u2014 edit it anytime; re-apply with \`sky deploy\`.`);
     }
@@ -6067,8 +6509,8 @@ files.command("rm <id>").description("delete a file (a session that already rece
 );
 files.command("download <id>").description("download a session file's bytes").requiredOption("-o, --out <path>", "where to write the bytes").action(
   run(async (id, opts) => {
-    const written = await downloadFileTo(id, opts.out);
-    console.log(`Wrote ${written} bytes to ${opts.out}`);
+    const written2 = await downloadFileTo(id, opts.out);
+    console.log(`Wrote ${written2} bytes to ${opts.out}`);
   })
 );
 var task = program.command("task").description("a task's shared files and open requests (the task is its first session's id)");
@@ -6083,14 +6525,14 @@ task.command("get <task> <path>").description("read one task file; prints it, or
   run(async (taskId, path, opts) => {
     const bytes = await readTaskFile(taskId, path);
     if (opts.out) {
-      writeFileSync9(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync16(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync17(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -6104,9 +6546,9 @@ task.command("export <task>").description("write the task's session record as a
   run(async (taskId, opts) => {
     const tier = opts.tier === "gold" || opts.tier === "exploratory" ? opts.tier : "silver";
     const outDir = opts.out ?? `./harbor-${taskId.replace(/[^A-Za-z0-9_-]/g, "_")}`;
-    const { written, record } = await exportTaskHarbor(taskId, outDir, { tier, redactNames: parseRedactNames(opts.redact) });
-    console.log(`Wrote ${written.length} files to ${outDir} (${record.threads.length} thread${record.threads.length === 1 ? "" : "s"}, ${record.files.length} task file${record.files.length === 1 ? "" : "s"}${record.goal ? ", goal rubric" : ", no goal: derived rubric"})`);
-    if (!written.includes("environment/Dockerfile")) console.log("environment/: not resettable from the record \u2014 see environment/README.md before running with Harbor");
+    const { written: written2, record } = await exportTaskHarbor(taskId, outDir, { tier, redactNames: parseRedactNames(opts.redact) });
+    console.log(`Wrote ${written2.length} files to ${outDir} (${record.threads.length} thread${record.threads.length === 1 ? "" : "s"}, ${record.files.length} task file${record.files.length === 1 ? "" : "s"}${record.goal ? ", goal rubric" : ", no goal: derived rubric"})`);
+    if (!written2.includes("environment/Dockerfile")) console.log("environment/: not resettable from the record \u2014 see environment/README.md before running with Harbor");
   })
 );
 task.command("show <task>").description("the task's sessions and the requests waiting on you (questions, approvals, apps to connect)").option("--json", "print the task as JSON").action(
@@ -6227,6 +6669,56 @@ reflections.command("list").description("the workspace's proposals, newest first
 );
 reflections.command("approve <id>").description("write the proposal through the skill or memory store").action(run(async (id) => decideReflection(id, "approve")));
 reflections.command("reject <id>").description("decline the proposal; nothing is written").action(run(async (id) => decideReflection(id, "reject")));
+var library = program.command("library").description("your artifact Library on agentsky.dev: files and sites your agents saved or you uploaded");
+library.command("list").description("your Library, newest first").option("--search <text>", "only names that match").option("--cursor <cursor>", "the next page").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const page = await listLibrary({ q: opts.search, cursor: opts.cursor });
+    if (opts.json) {
+      console.log(JSON.stringify(page, null, 2));
+      return;
+    }
+    if (!page.artifacts.length) console.log("no artifacts");
+    for (const a of page.artifacts) console.log(renderLibraryArtifact(a));
+    if (page.nextCursor) console.log(`more: --cursor ${page.nextCursor}`);
+  })
+);
+library.command("upload <path>").description("save a file from this computer to your Library").option("--workspace <key>", "place it in this workspace").action(
+  run(async (path, opts) => {
+    const bytes = readFileSync17(path);
+    const { artifact: artifact2 } = await uploadToLibrary({ bytes, name: basename9(path), mediaType: "application/octet-stream" }, `sky-upload-${crypto.randomUUID()}`, opts.workspace);
+    console.log(renderLibraryArtifact(artifact2));
+  })
+);
+library.command("show <id>").description("one artifact and its saved versions").action(run(async (id) => {
+  console.log(JSON.stringify(await getLibraryArtifact(id), null, 2));
+}));
+library.command("delete <id>").description("delete your artifact with all its versions").action(
+  run(async (id) => {
+    const { currentVersion } = await getLibraryArtifact(id);
+    await deleteLibraryArtifact(id, currentVersion ?? 0);
+    console.log(`deleted ${id}`);
+  })
+);
+for (const [verb, enabled, description] of [
+  ["share", true, "turn on the artifact's public link"],
+  ["unshare", false, "turn off the artifact's public link"]
+]) {
+  library.command(`${verb} <id>`).description(description).action(run(async (id) => {
+    const state = await shareLibraryArtifact(id, enabled);
+    console.log(state.url ?? `${verb}: ${id}`);
+  }));
+}
+library.command("place <id> <workspace>").description('place your artifact in a workspace, or "me" to take it back to you alone').action(run(async (id, workspace2) => {
+  await placeLibraryArtifact(id, workspace2 === "me" ? null : workspace2);
+  console.log(`placed ${id}`);
+}));
+library.command("download <id> <out>").description("save one version's bytes to a file").option("--version <n>", "a saved version (the current one when omitted)").action(
+  run(async (id, out, opts) => {
+    const { bytes } = await downloadLibraryArtifact(id, opts.version ? Number(opts.version) : void 0);
+    writeFileSync10(out, bytes);
+    console.log(`wrote ${bytes.length} bytes to ${out}`);
+  })
+);
 var artifact = program.command("artifact").description("artifacts: publish a task's files as a named, shareable result");
 artifact.command("list").description("the workspace's artifacts, or one task's with --task").option("--task <task>", "only this task's artifacts").action(
   run(async (opts) => {
@@ -6244,7 +6736,7 @@ artifact.command("get <id> <path>").description("read one file of an artifact; p
   run(async (id, path, opts) => {
     const bytes = await readArtifactFile(id, path);
     if (opts.out) {
-      writeFileSync9(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -6494,6 +6986,19 @@ program.command("config").description("show the CLI config location and current
   console.log(`  token:    ${config.token ? `${config.token.slice(0, 10)}\u2026` : "(none)"}`);
   console.log(`  universe: ${config.currentUniverse ?? "(default)"}`);
 });
+var link = program.command("link").description("a session someone shared with you by a guest link: send to it and stop it");
+link.command("send <link> <text...>").description("send a message through a guest link (/s/<token> URL or token); it runs and bills as the session's owner").option("--idempotency-key <key>", "repeat a send without sending twice (default: a new key)").action(
+  run(async (ref, words, opts) => {
+    await sendViaLink(ref, words.join(" "), opts.idempotencyKey ?? `sky-${crypto.randomUUID()}`);
+    console.log("Sent. Read the reply with GET /links/<token>/events.");
+  })
+);
+link.command("stop <link>").description("stop the turn running on the session a guest link opens").action(
+  run(async (ref) => {
+    await stopViaLink(ref);
+    console.log("Stopped.");
+  })
+);
 var billing = program.command("billing").description("your balance, auto top-up, usage across sessions and API keys, and buying credit");
 billing.command("show").description("balance, whether a card is saved, and auto top-up").action(
   run(async () => {
@@ -6520,6 +7025,11 @@ billing.command("topup <dollars>").description("buy credit with your saved card:
     console.log(renderTopup(result));
   })
 );
+billing.command("claim <link>").description("claim a credit invite link (agentsky.dev/i/<code>, or just the code) for your own balance").action(
+  run(async (link2) => {
+    console.log(renderCreditInviteClaim(await claimCreditInvite(link2)));
+  })
+);
 billing.command("auto-topup").description("show auto top-up, or change it: --on/--off, --threshold <5|10|20>, --amount <10|20|50|100>").option("--on", "charge the saved card when the balance falls under the threshold").option("--off", "stop charging automatically").option("--threshold <dollars>", "the balance that triggers a charge").option("--amount <dollars>", "the credit each charge adds").action(
   run(async (opts) => {
     const body = autoTopupBody(opts);
@@ -6542,13 +7052,42 @@ usageOptions(
   run(async (opts) => {
     const { bytes } = await apiBytes("GET", `/billing/usage/export${usageQuery(opts)}`);
     if (opts.out) {
-      writeFileSync9(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else {
       process.stdout.write(bytes);
     }
   })
 );
+billing.command("requests").description("one row per API request your developer API keys made, newest first, a page at a time").option("--from <day>", "first UTC day, YYYY-MM-DD (default: 29 days ago)").option("--to <day>", "first UTC day not included (default: tomorrow)").option("--key <id>", "only this API key").option("--cursor <cursor>", "the next page, as printed after the previous one").option("--json", "print the API's answer as JSON").action(
+  run(async (opts) => {
+    const page = await readRequestUsage(opts);
+    console.log(opts.json ? JSON.stringify(page, null, 2) : renderRequestUsage(page));
+  })
+);
+var codingPlan = billing.command("coding-plan").description("the coding plan: monthly credit on your saved card, API gateway calls billed at cost");
+codingPlan.command("show").description("whether you are a member, the monthly amount, and whether it renews").action(run(async () => console.log(renderCodingPlan(await readCodingPlan()))));
+codingPlan.command("join <dollars>").description("join with your saved card (charged now), or change your monthly amount from the next renewal").option("--request-id <id>", "repeat a request without charging twice (default: a new id)").action(
+  run(async (dollars2, opts) => {
+    console.log(renderCodingPlan(await joinCodingPlan(dollars2, opts.requestId ?? `sky-${crypto.randomUUID()}`)));
+  })
+);
+codingPlan.command("cancel").description("stop the plan renewing; the paid month stays").action(run(async () => console.log(renderCodingPlan(await cancelCodingPlan()))));
+var referralLinks = billing.command("referral-links").description("customer discount links for the API gateway (accounts on a discount plan)");
+referralLinks.command("list").description("your links, their use, and what referred customers earned you").action(run(async () => console.log(renderReferralLinks(await readReferralLinks()))));
+referralLinks.command("create").description("create a link priced at no less than your own price; --email sends it to one customer").option("--price <share>", "what the customer pays for every model, as a share of public price: 0.8 or 80%").option("--sku <id=share>", "a price for one SKU; repeat for several", collect).option("--email <address>", "email the link to this customer; it then redeems once").option("--uses <n>", "how many customers can redeem it (default 100)").option("--days <n>", "days until it expires (default 30)").action(
+  run(async (opts) => {
+    const { url, email_status: emailStatus } = await createReferralLink(opts);
+    console.log(emailStatus ? `${url}
+email: ${emailStatus}` : url);
+  })
+);
+referralLinks.command("disable <id>").description("stop a link being redeemed; customers already enrolled keep their price").action(
+  run(async (id) => {
+    await disableReferralLink(id);
+    console.log(`Disabled ${id}`);
+  })
+);
 var keys = program.command("keys").description("your own API keys: list, create, revoke, restore (admin scope)");
 keys.command("list").action(
   run(async () => {
@@ -6869,6 +7408,48 @@ vendor.command("usage <id>").description("the agents and tasks that used this ve
     for (const t of tasks) console.log(`  task   ${t.session_id}  ${t.title ?? "(untitled)"}  ${t.last_used_at.slice(0, 10)}`);
   })
 );
+var mac = program.command("mac").description("your Macs: what each lends to agents now, and asking one for a folder, a browser window, its screen or its apps and files");
+mac.command("list").description("your Macs: online or not, what each can lend, and the folders, browser windows and screens lent now").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const macs = await listMacs();
+    if (opts.json) {
+      console.log(JSON.stringify(macs, null, 2));
+      return;
+    }
+    if (!macs.length) console.log("no Macs connected; sign in to the AgentSky Mac app");
+    for (const entry2 of macs) console.log(renderMac(entry2));
+  })
+);
+mac.command("ask <machine> <kind>").description("ask a Mac to lend a folder, a browser window, its screen or its apps and files (host: local chats, call notes, uploads, saves, local git); the person answers on the Mac. Prints the MCP URL a session attaches once it is granted").requiredOption("--reason <text>", "why, in one sentence the person reads on their Mac").option("--no-wait", "return as soon as the Mac has the ask").option("--json", "print as JSON").action(
+  run(async (machine, kind, opts) => {
+    const asked = await askMac(machine, kind, opts.reason);
+    const answer = opts.wait ? await waitForAnswer(asked.reach_request.id, 240) : asked.reach_request;
+    if (opts.json) {
+      console.log(JSON.stringify({ reach_request: answer, mcp_url: asked.mcp_url }, null, 2));
+      return;
+    }
+    console.log(renderReachRequest(answer));
+    console.log(`mcp_url: ${asked.mcp_url}`);
+    if (answer.status === "granted") console.log("attach it as an MCP server: mcp_servers on POST /v1/sessions (MCP start_session: sources), or PATCH /v1/sessions/{id}");
+    else if (!["pending", "asking"].includes(answer.status)) process.exitCode = 1;
+  })
+);
+mac.command("ask-status <id>").description("where an ask stands: pending, asking, granted, denied, unavailable or expired").option("--wait <seconds>", "wait up to this long (at most 25) for the person to answer", "0").option("--json", "print as JSON").action(
+  run(async (id, opts) => {
+    const answer = await readReachRequest(id, Number(opts.wait) || 0);
+    if (opts.json) {
+      console.log(JSON.stringify(answer, null, 2));
+      return;
+    }
+    console.log(renderReachRequest(answer));
+  })
+);
+mac.command("take-back <mount>").description("end a folder, browser window, screen or apps and files lent from a Mac; every later call to it fails").action(
+  run(async (mount) => {
+    await takeBack(mount);
+    console.log(`took back ${mount}`);
+  })
+);
 var browserProfile = program.command("browser-profile").description("saved-login profiles: the sites your agents stay signed in to");
 browserProfile.command("list").description("your workspace's browser profiles: the sites your agents stay signed in to").option("--json", "print as JSON").action(
   run(async (opts) => {
@@ -6932,10 +7513,16 @@ notifications.command("get").description("show the current notification preferen
       console.log(JSON.stringify(prefs, null, 2));
       return;
     }
-    console.log(`email:  needs_you=${prefs.email.needs_you}  done=${prefs.email.done}`);
+    console.log(`email:  needs_you=${prefs.email.needs_you}  done=${prefs.email.done}  marketing=${prefs.email.marketing}`);
     console.log(`push:   needs_you=${prefs.push.needs_you}  done=${prefs.push.done}`);
   })
 );
+notifications.command("unsubscribe-marketing").description("stop AgentSky marketing email to your address; login and account email continue").action(
+  run(async () => {
+    const { marketing } = await unsubscribeMarketing();
+    console.log(marketing ? "Marketing email is still on." : "Unsubscribed from AgentSky marketing email.");
+  })
+);
 notifications.command("set").description("update notification preferences (pass at least one flag)").option("--email-needs-you <bool>", "email when the task needs your input: true or false").option("--email-done <bool>", "email when the task finishes: true or false").option("--push-needs-you <bool>", "push notification when the task needs your input: true or false").option("--push-done <bool>", "push notification when the task finishes: true or false").action(
   run(async (opts) => {
     const parseBool = (v) => v === void 0 ? void 0 : v === "true" ? true : v === "false" ? false : (() => {
@@ -7093,7 +7680,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-NMBMU4GS.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-ZRU624EY.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -7128,7 +7715,7 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-NMBMU4GS.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-ZRU624EY.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -7141,14 +7728,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-NMBMU4GS.js");
+  const { readState, flush, grantSender } = await import("./trace-ZRU624EY.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-NMBMU4GS.js");
+  const { readState, spoolStatus } = await import("./trace-ZRU624EY.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -7158,7 +7745,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-NMBMU4GS.js");
+  const { readState } = await import("./trace-ZRU624EY.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -7185,7 +7772,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-NMBMU4GS.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-ZRU624EY.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -7195,7 +7782,7 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
 traceCmd.command("sync [payload]").description("upload this machine's agent sessions (Claude Code, Codex, Cursor, Gemini CLI and every other agent `--agents` lists) to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--import <export>", "add a downloaded cloud export (claude.ai, ChatGPT, Gemini, Grok, DeepSeek \u2026: its .zip, folder or file) so sync uploads it (repeatable)", collect).option("--agents", "list the agents sync reads and which are on this machine").option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-OWYB75AR.js");
+  const lib = await import("./trace-library-QOQUAL5H.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -7254,10 +7841,10 @@ traceCmd.command("sync [payload]").description("upload this machine's agent sess
       console.log(`Added ${imported.sessions} ${imported.agent} session${imported.sessions === 1 ? "" : "s"} from ${input}.`);
     }
     if (opts.installSchedule) {
-      const { join: join17 } = await import("path");
-      const { homedir: homedir8 } = await import("os");
+      const { join: join19 } = await import("path");
+      const { homedir: homedir10 } = await import("os");
       const { execFileSync } = await import("child_process");
-      const log = join17(homedir8(), ".config", "sky", "trace-sync.log");
+      const log = join19(homedir10(), ".config", "sky", "trace-sync.log");
       const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
       try {
         execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
@@ -7267,11 +7854,11 @@ traceCmd.command("sync [payload]").description("upload this machine's agent sess
       console.log(`Sweeping every 15 minutes (${plist}); a full re-read runs weekly. Log: ${log}`);
     }
     if (opts.status) {
-      const { readFileSync: readFileSync17 } = await import("fs");
-      const { join: join17 } = await import("path");
+      const { readFileSync: readFileSync18 } = await import("fs");
+      const { join: join19 } = await import("path");
       let state = { sessions: {} };
       try {
-        state = JSON.parse(readFileSync17(join17(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+        state = JSON.parse(readFileSync18(join19(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
       } catch {
       }
       const counts = /* @__PURE__ */ new Map();
@@ -7304,7 +7891,7 @@ traceCmd.command("sync [payload]").description("upload this machine's agent sess
   })();
 });
 traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
-  const { libraryRequest } = await import("./trace-library-OWYB75AR.js");
+  const { libraryRequest } = await import("./trace-library-QOQUAL5H.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
@@ -7321,7 +7908,7 @@ traceCmd.command("search <query...>").description("search every session in a wor
   if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-OWYB75AR.js");
+  const { libraryRequest } = await import("./trace-library-QOQUAL5H.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);
@@ -7437,6 +8024,140 @@ thread.command("list").description("your workspace threads, most recently update
     for (const t of threads) console.log(renderThreadSummary(t));
   })
 );
+thread.command("start <text>").description("start a thread and send it its first message, as the web composer does").requiredOption("--agent <type>", "the agent's harness type (e.g. claude_code, codex)").option("--llm <model>", "the model (the harness default when omitted)").option("--effort <level>", "thinking level").option("--vs <type:model...>", "more agents that get the same message, side by side", (val, acc) => [...acc, val], []).option("--saved-agent <id>", "run on one of your saved agents").option("--workspace <slug>", "start it in this team workspace").option("--plan", "send the first message in Plan mode").option("--json", "print the new thread as JSON").action(
+  run(async (text, opts) => {
+    const compared = (opts.vs ?? []).map((v) => {
+      const [agentType, llm] = v.split(":");
+      if (!agentType) throw new ApiError(400, "invalid_request", `--vs must be type[:model], got "${v}"`);
+      return { agentType, ...llm ? { llm } : {} };
+    });
+    const result = await startThread({
+      requestId: `sky-thread-${crypto.randomUUID()}`,
+      agentType: opts.agent,
+      text,
+      ...opts.llm ? { llm: opts.llm } : {},
+      ...opts.effort ? { reasoningEffort: opts.effort } : {},
+      ...compared.length ? { compare: compared } : {},
+      ...opts.savedAgent ? { agentId: opts.savedAgent } : {},
+      ...opts.workspace ? { workspace: opts.workspace } : {},
+      ...opts.plan ? { interactionMode: "plan" } : {}
+    });
+    if (opts.json) {
+      console.log(JSON.stringify(result, null, 2));
+      return;
+    }
+    console.log(`started ${result.playgroundId}`);
+    for (const col of result.columns) console.log(`  agent ${col.columnId}  session ${col.sessionId}`);
+  })
+);
+thread.command("show <id>").description("one thread with every agent and the session each one runs in").option("--json", "print as JSON").action(
+  run(async (id, opts) => {
+    const detail = await getThread(id);
+    if (opts.json) {
+      console.log(JSON.stringify(detail, null, 2));
+      return;
+    }
+    console.log(`thread ${detail.id}  ${detail.title}`);
+    for (const col of detail.columns) console.log(`  agent ${col.id}  session ${col.sessionId}  ${col.blind ? "(hidden until the vote)" : `${col.agentType}/${col.llm}`}  ${col.status ?? col.podStatus ?? ""}`);
+  })
+);
+thread.command("rename <id> <title>").description("rename a thread").action(run(async (id, title) => {
+  await organizeThread(id, { title });
+  console.log(`renamed ${id}`);
+}));
+for (const [verb, change, description] of [
+  ["pin", { pinned: true }, "pin a thread to the top of the rail"],
+  ["unpin", { pinned: false }, "unpin a thread"],
+  ["archive", { archived: true }, "put a thread away"],
+  ["unarchive", { archived: false }, "bring an archived thread back"],
+  ["mark-read", { seen: true }, "mark a thread read"],
+  ["mark-unread", { seen: false }, "mark a thread unread"]
+]) {
+  thread.command(`${verb} <id>`).description(description).action(run(async (id) => {
+    await organizeThread(id, change);
+    console.log(`${verb}: ${id}`);
+  }));
+}
+thread.command("delete <id>").description("delete a thread with its sessions").action(run(async (id) => {
+  await deleteThread(id);
+  console.log(`deleted ${id}`);
+}));
+thread.command("send <id> <text>").description("send one message to every agent of the thread, or to the ones --agent names").option("--agent <columnId...>", "only these agents (column ids from `sky thread show`)").option("--json", "print each agent's outcome as JSON").action(
+  run(async (id, text, opts) => {
+    const { results } = await sendThreadMessage(id, { text, deliveryId: crypto.randomUUID(), ...opts.agent?.length ? { columnIds: opts.agent } : {} });
+    if (opts.json) {
+      console.log(JSON.stringify(results, null, 2));
+      return;
+    }
+    for (const [column, outcome] of Object.entries(results)) console.log(`  ${column}  ${outcome.ok ? "sent" : `not sent: ${outcome.error ?? "refused"}`}`);
+  })
+);
+thread.command("add-agent <id>").description("add an agent to the thread, in a session of its own").requiredOption("--agent <type>", "the agent's harness type").option("--llm <model>", "the model").option("--effort <level>", "thinking level").action(
+  run(async (id, opts) => {
+    const { columns } = await addThreadAgent(id, { requestId: `sky-agent-${crypto.randomUUID()}`, agentType: opts.agent, ...opts.llm ? { llm: opts.llm } : {}, ...opts.effort ? { reasoningEffort: opts.effort } : {} });
+    for (const col of columns) console.log(`added agent ${col.columnId}  session ${col.sessionId}`);
+  })
+);
+thread.command("remove-agent <id> <columnId>").description("take one agent out of the thread; its session is left as it is").action(run(async (id, columnId) => {
+  await removeThreadAgent(id, columnId);
+  console.log(`removed ${columnId}`);
+}));
+thread.command("stop <id>").description("stop what the thread's agents are doing").option("--agent <columnId>", "stop only this agent").action(run(async (id, opts) => {
+  await interruptThread(id, opts.agent);
+  console.log(`stopped ${id}`);
+}));
+thread.command("fork <id>").description("continue one agent's conversation in a thread of its own").option("--agent <columnId>", "the agent to fork (the first when omitted)").option("--at <messageId>", "carry the conversation only up to this message").option("--to <type:model>", "continue on another agent or model").action(
+  run(async (id, opts) => {
+    const [agentType, llm] = (opts.to ?? "").split(":");
+    const { playgroundId } = await forkThread(id, {
+      requestId: `sky-fork-${crypto.randomUUID()}`,
+      ...opts.agent ? { columnId: opts.agent } : {},
+      ...opts.at ? { messageId: opts.at } : {},
+      ...agentType ? { target: { agentType, ...llm ? { llm } : {} } } : {}
+    });
+    console.log(`forked into ${playgroundId}`);
+  })
+);
+thread.command("model <id>").description("change the model or thinking level one agent of the thread runs on, from its next turn").option("--agent <columnId>", "the agent (the first when omitted)").option("--llm <model>", "the new model").option("--effort <level>", 'the new thinking level, or "default"').action(
+  run(async (id, opts) => {
+    if (!opts.llm && !opts.effort) throw new ApiError(400, "invalid_request", "Provide --llm or --effort.");
+    const result = await changeThreadModel(id, { ...opts.llm ? { llm: opts.llm } : {}, ...opts.effort ? { reasoningEffort: opts.effort === "default" ? null : opts.effort } : {} }, opts.agent);
+    console.log(`now ${result.llm}${result.reasoningEffort ? ` (${result.reasoningEffort})` : ""}`);
+  })
+);
+thread.command("search <query>").description("search the words of your conversations").option("--archived", "search archived threads only").option("--all", "search active and archived threads").option("--cursor <cursor>", "the next page").action(
+  run(async (query, opts) => {
+    const threads = opts.all ? "all" : opts.archived ? "archived" : void 0;
+    console.log(JSON.stringify(await searchThreads(query, { ...threads ? { threads } : {}, ...opts.cursor ? { cursor: opts.cursor } : {} }), null, 2));
+  })
+);
+thread.command("options").description("what a new thread can start on: agents, models, thinking levels and grantable tools").action(run(async () => {
+  console.log(JSON.stringify(await threadOptions(), null, 2));
+}));
+thread.command("join <sessionId>").description("open a teammate's thread, or one shared with you, as the session link does").action(
+  run(async (sessionId) => {
+    const opened = await joinThread(sessionId);
+    console.log(opened.readOnly ? `read-only: session ${opened.sessionId}` : `opened ${opened.playgroundId}`);
+  })
+);
+var project = program.command("project").description("the GitHub repositories a new thread can start on");
+project.command("list").description("repositories a new thread can start on, and the one you chose last").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const listed = await listProjects();
+    if (opts.json) {
+      console.log(JSON.stringify(listed, null, 2));
+      return;
+    }
+    if (listed.unavailable) console.log(listed.unavailable.message);
+    for (const repo of listed.repos) console.log(`${repo.fullName === listed.last?.repoFullName ? "* " : "  "}${repo.fullName}`);
+  })
+);
+project.command("use [repo]").description("remember a repository (owner/name) for your next new thread, or none when omitted").option("--branch <branch>", "the branch", "main").action(
+  run(async (repo, opts) => {
+    const { project: remembered } = await rememberProject(repo ? { repoFullName: repo, branch: opts.branch } : null);
+    console.log(remembered ? `next thread starts on ${remembered.repoFullName}@${remembered.branch}` : "next thread starts on no repository");
+  })
+);
 session.command("feedback <id>").description("read the thumbs-up/down feedback on this session's messages").option("--json", "print as JSON").action(
   run(async (id, opts) => {
     const result = await api(