@agentsky/sky 2.23.0 → 2.24.1

package/dist/index.js

@@ -4,12 +4,13 @@ import {
   api,
   apiBytes,
   apiForm,
+  apiRaw,
   downloadFileTo,
   postEvents,
   resolveSessionRef,
   streamEvents,
   uploadFile
-} from "./chunk-HQPOCQRQ.js";
+} from "./chunk-KWLEADJQ.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -20,7 +21,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-V5XLV37X.js";
+} from "./chunk-S4YG3TXA.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -42,17 +43,17 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-HDPDY77W.js";
+} from "./chunk-D3WG4BMK.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync11 } from "fs";
 import { basename as basename9, resolve as resolve9 } from "path";
 import { createInterface as createInterface6 } from "readline";
 import { Command } from "commander";
 
 // src/files.ts
-import { readdirSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { existsSync, readdirSync, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
 import { basename as basename2, extname, join as join2 } from "path";
 
 // src/resumable-upload.ts
@@ -250,6 +251,16 @@ function eventsFor(text, files2, system, interactionMode2) {
   if (system?.trim()) events.push({ type: "system.message", content: [{ type: "text", text: system }] });
   return events;
 }
+function isFileId(ref) {
+  return /^file_[A-Za-z0-9]+$/.test(ref);
+}
+async function attachment(ref, opts = {}) {
+  if (opts.byId || isFileId(ref) && !existsSync(ref)) {
+    if (!isFileId(ref)) throw new Error(`--file-id takes a stored file's id (file_\u2026), got ${JSON.stringify(ref)}`);
+    return { file: await api("GET", `/files/${encodeURIComponent(ref)}`), uploaded: false };
+  }
+  return { file: await uploadLocalFile(ref), uploaded: true };
+}
 
 // src/goal.ts
 var CHECK_SEPARATOR = " :: ";
@@ -456,837 +467,266 @@ async function unsubscribeMarketing() {
   return { marketing: notification_preferences.email.marketing };
 }
 
-// src/context.ts
-function memoryBody(operation, version) {
-  return { ...operation, expectedVersion: version };
-}
-function memoryIndex(value) {
-  if (!/^\d+$/.test(value.trim())) throw new Error(`the entry number must be a whole number, got ${JSON.stringify(value)}`);
-  return Number(value.trim());
-}
-function renderMemory(document) {
-  if (!document.entries.length) return "no saved memory \u2014 `sky memory save <text>` adds an entry";
-  return document.entries.map((entry2) => `${String(entry2.index).padStart(3)}  ${entry2.text}`).join("\n");
-}
-function searchQuery(query, opts) {
-  const params = new URLSearchParams({ q: query });
-  params.set("scope", opts.scope ?? "sessions");
-  if (opts.limit) params.set("limit", opts.limit);
-  if (opts.cursor) params.set("cursor", opts.cursor);
-  if (opts.since) params.set("since", opts.since);
-  if (opts.until) params.set("until", opts.until);
-  return `?${params.toString()}`;
-}
-function refArgument(ref) {
-  return `'${JSON.stringify(ref).replace(/'/g, "'\\''")}'`;
-}
-function renderContextPage(page) {
-  const lines = [];
-  for (const { hit } of page.hits) {
-    lines.push(`${hit.source.padEnd(8)} ${hit.occurredAt?.slice(0, 10) ?? "          "}  ${hit.title}`);
-    lines.push(`         ${hit.snippet.replace(/\s+/g, " ").slice(0, 160)}`);
-    lines.push(`         sky context read ${refArgument(hit.ref)}`);
-  }
-  if (!page.hits.length) lines.push("no matches on this page");
-  if (page.partial) lines.push(`partial: ${page.coverage ?? "not every source was searched"}`);
-  if (page.nextCursor) lines.push(`more: --cursor ${page.nextCursor}`);
-  return lines.join("\n");
-}
-
-// src/agent-file.ts
-import { existsSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, resolve as resolve2 } from "path";
-import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
-var fileInstructionSchema = external_exports.object({
-  name: external_exports.string(),
-  content: external_exports.string().optional(),
-  file: external_exports.string().optional()
-});
-var agentFileSchema = external_exports.object({
-  name: external_exports.string().min(1),
-  id: external_exports.string().optional(),
-  // stamped by launch/deploy; identifies the live agent
-  slug: external_exports.string().optional(),
-  // pre-RFC-0079 stamp; ignored (agents are id-addressed)
-  description: external_exports.string().optional(),
-  type: external_exports.enum(AGENT_TYPES).optional(),
-  llm: external_exports.string().optional(),
-  reasoning_effort: external_exports.enum(REASONING_EFFORT_VALUES).optional(),
-  capabilities: capabilitiesSchema.optional(),
-  prompt: external_exports.string().optional(),
-  prompt_file: external_exports.string().optional(),
-  instructions: external_exports.array(fileInstructionSchema).optional(),
-  skills: external_exports.array(skillRefSchema).optional(),
-  customData: external_exports.array(customDataSchema).optional(),
-  /** "deny" makes the agent work alone: its sessions may not hire helpers. */
-  hiring_policy: external_exports.enum(["allow", "deny"]).optional(),
-  /** The environment its sessions boot in when they name none. */
-  environment: external_exports.string().min(1).optional(),
-  /** Advanced machine shape (create-only): 1|2|4|8 vCPUs, 256MB-step memory. */
-  vcpus: external_exports.number().int().optional(),
-  memory_mb: external_exports.number().int().optional()
-});
-function readAgentFile(path) {
-  const raw = readFileSync3(path, "utf8");
-  const parsed = agentFileSchema.safeParse(parseToml(raw));
-  if (!parsed.success) {
-    const issue = parsed.error.issues[0];
-    throw new Error(`${path}: ${issue?.path.join(".") ?? ""} ${issue?.message ?? "invalid"}`);
-  }
-  const file = parsed.data;
-  if (file.reasoning_effort && file.type && !isModelEffortSupported(file.type, file.llm ?? defaultLlm(file.type), file.reasoning_effort)) {
-    throw new Error(
-      `${path}: reasoning_effort '${file.reasoning_effort}' is not available for ${file.type} \u2014 ${reasoningEffortDocLine()}`
-    );
-  }
-  const base = dirname2(resolve2(path));
-  const inline = (ref, inlineContent) => {
-    if (inlineContent !== void 0) return inlineContent;
-    if (!ref) return void 0;
-    return readFileSync3(resolve2(base, ref), "utf8");
-  };
-  const spec = {
-    name: file.name,
-    description: file.description,
-    agentType: file.type,
-    llm: file.llm,
-    reasoningEffort: file.reasoning_effort,
-    displayName: file.name,
-    capabilities: file.capabilities,
-    prompt: inline(file.prompt_file, file.prompt),
-    instructions: file.instructions?.map((f) => {
-      const content = inline(f.file, f.content);
-      if (content === void 0) throw new Error(`instruction ${f.name}: content or file required`);
-      return { name: f.name, content };
-    }),
-    skills: file.skills,
-    customData: file.customData,
-    hiringPolicy: file.hiring_policy,
-    environmentId: file.environment,
-    vcpus: file.vcpus,
-    memoryMb: file.memory_mb
-  };
-  return { file, spec };
-}
-function stampId(path, id) {
-  const doc = parseToml(readFileSync3(path, "utf8"));
-  doc.id = id;
-  delete doc.slug;
-  writeFileSync2(path, stringifyToml(doc));
-}
-function scaffoldAgentFile(path, name) {
-  if (existsSync(path)) throw new Error(`${path} already exists`);
-  writeFileSync2(
-    path,
-    `# agent.toml \u2014 everything the create wizard can set. Only \`name\` is required.
-name = "${name}"
-# type = "pi"                  # pi (default) | hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode
-# llm = "deepseek-flash"       # must be compatible with type
-# reasoning_effort = "high"    # per harness \u2014 ${reasoningEffortDocLine()}
-# capabilities = []
-# hiring_policy = "deny"       # its sessions work alone; "allow" (default) lets them hire helpers
-# environment = "env_..."      # the environment its sessions boot in when they name none
-# [[skills]]                   # a skill from \`sky skills upload <dir>\`
-# type = "skill"
-# skillId = "skill_..."
-
-prompt = """
-You are ${name}, a helpful long-lived agent.
-"""
-`
-  );
-}
+// src/import-local.ts
+import { closeSync as closeSync3, existsSync as existsSync4, openSync as openSync3, readdirSync as readdirSync4, readFileSync as readFileSync6, readSync as readSync3, statSync as statSync5 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
+import { createHash as createHash3 } from "crypto";
 
-// src/catalog.ts
-var bare = (handle) => handle.replace(/^@/, "");
-var optionalAuth = () => ({ auth: Boolean(apiToken()) });
-function catalogQuery(filter) {
-  const params = new URLSearchParams();
-  if (filter.text?.trim()) params.set("q", filter.text.trim());
-  if (filter.category) params.set("category", filter.category);
-  const query = params.toString();
-  return query ? `?${query}` : "";
-}
-function listingBody(agentId, options) {
-  return {
-    agent_id: agentId,
-    handle: bare(options.handle),
-    tagline: options.tagline,
-    ...options.description ? { description: options.description } : {},
-    ...options.category?.length ? { categories: options.category } : {},
-    ...options.does?.length ? { does: options.does } : {},
-    ...options.doesNot?.length ? { does_not: options.doesNot } : {},
-    ...options.example?.length ? { examples: options.example } : {}
-  };
-}
-async function listCatalog(filter = {}) {
-  return (await api("GET", `/catalog/agents${catalogQuery(filter)}`, void 0, optionalAuth())).agents;
-}
-async function showCatalogAgent(handle) {
-  return (await api("GET", `/catalog/agents/${encodeURIComponent(bare(handle))}`, void 0, optionalAuth())).agent;
-}
-async function listCategories() {
-  return (await api("GET", "/catalog/categories", void 0, { auth: false })).categories;
-}
-async function publishListing(agentId, options) {
-  return (await api("POST", "/catalog/listings", listingBody(agentId, options))).agent;
-}
-async function removeListing(handle) {
-  await api("DELETE", `/catalog/listings/${encodeURIComponent(bare(handle))}`);
-}
-async function setEngineStatus(engine, status, reason) {
-  await api("PATCH", `/catalog/engines/${encodeURIComponent(engine)}`, { status, reason });
-  const state = await api("GET", "/catalog/engines", void 0, { auth: false });
-  if (state.delisted.includes(engine) !== (status === "delisted")) {
-    throw new Error("The catalog does not show the requested state; check whether another operator changed it.");
-  }
-}
-var uses = (agent2) => `${agent2.stats.uses} ${agent2.stats.uses === 1 ? "use" : "uses"}`;
-var mine = (agent2) => agent2.visibility === "workspace" ? "  (yours)" : "";
-function renderCatalogAgent(agent2) {
-  const section = (title, lines) => lines.length ? [`${title}:`, ...lines.map((line) => `  - ${line}`)] : [];
-  return [
-    `@${agent2.handle}  ${agent2.name}${mine(agent2)}`,
-    agent2.tagline,
-    ...agent2.description && agent2.description !== agent2.tagline ? ["", agent2.description] : [],
-    "",
-    `Categories: ${agent2.categories.join(", ") || "none"}`,
-    `Used: ${uses(agent2)}`,
-    ...section("Does", agent2.does),
-    ...section("Does not", agent2.does_not),
-    ...section("Examples", agent2.examples),
-    "",
-    `Hire it: sky session create @${agent2.handle} --message "\u2026"`
-  ].join("\n");
-}
+// src/import-files.ts
+import { isUtf8 } from "buffer";
+import { existsSync as existsSync3, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname3, extname as extname2, isAbsolute, join as join4, relative as relative2, resolve as resolve2, sep as sep2, basename as basename4 } from "path";
 
-// src/clone.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+// src/import-workspace.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3, realpathSync, statSync as statSync3 } from "fs";
 import { homedir } from "os";
-import { basename as basename3, join as join3 } from "path";
-import { createInterface } from "readline";
-var PROMPT_CAP = 1e5;
-var HARNESSES = ["claude_code", "codex", "openclaw"];
-function claudeConfigRoot() {
-  return process.env.CLAUDE_CONFIG_DIR ?? join3(homedir(), ".claude");
+import { basename as basename3, dirname as dirname2, join as join3, relative, sep } from "path";
+import { parse as parseToml } from "smol-toml";
+var MAX_TREE = 5e3;
+var SKILL_LINE = /Base directory for this skill: (\/[^\n\r"'\\<>]+)/g;
+function git(cwd, ...args) {
+  const run2 = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8", timeout: 1e4, maxBuffer: 32 * 1024 * 1024 });
+  return run2.status === 0 ? run2.stdout : null;
 }
-function readIfExists(path) {
+var isFile = (path) => {
   try {
-    return readFileSync4(path, "utf8");
+    return statSync3(path).isFile();
   } catch {
-    return void 0;
+    return false;
   }
-}
-function readJson(path) {
-  const raw = readIfExists(path);
-  if (raw === void 0) return void 0;
+};
+var isDir = (path) => {
   try {
-    return JSON.parse(raw);
+    return statSync3(path).isDirectory();
   } catch {
-    return void 0;
+    return false;
   }
-}
-function claudeModel(configRoot) {
-  const candidates = [
-    join3(process.cwd(), ".claude", "settings.local.json"),
-    join3(process.cwd(), ".claude", "settings.json"),
-    join3(configRoot, "settings.json")
-  ];
-  for (const path of candidates) {
-    const model = readJson(path)?.model;
-    if (typeof model === "string" && model.trim()) return model.trim();
+};
+function sharedInstructionPaths(home = homedir()) {
+  const rules = join3(home, ".agents", "rules");
+  let ruleFiles = [];
+  try {
+    ruleFiles = readdirSync2(rules).filter((name) => name.endsWith(".md")).sort().map((name) => join3(rules, name));
+  } catch {
   }
-  return void 0;
+  return [join3(home, "AGENTS.md"), join3(home, "MEMORY.md"), ...ruleFiles].filter(isFile);
 }
-function claudeMcpServers() {
-  const merged = {};
-  const userConfig = readJson(join3(homedir(), ".claude.json"));
-  Object.assign(merged, userConfig?.mcpServers ?? {});
-  Object.assign(merged, userConfig?.projects?.[process.cwd()]?.mcpServers ?? {});
-  const projectConfig = readJson(
-    join3(process.cwd(), ".mcp.json")
-  );
-  Object.assign(merged, projectConfig?.mcpServers ?? {});
-  return merged;
+function strings(value, out, depth = 0) {
+  if (depth > 12) return;
+  if (typeof value === "string") out.push(value);
+  else if (Array.isArray(value)) for (const item of value) strings(item, out, depth + 1);
+  else if (value && typeof value === "object") for (const item of Object.values(value)) strings(item, out, depth + 1);
 }
-function assemblePrompt(parts) {
-  const joined = parts.map((p) => `# \u2500\u2500 ${p.label} \u2500\u2500
-
-${p.content.trim()}`).join("\n\n").trim();
-  if (joined.length <= PROMPT_CAP) return { prompt: joined, truncated: false };
-  const notice = "\n\n[truncated by sky clone: local instructions exceeded the 100k prompt cap]";
-  return { prompt: joined.slice(0, PROMPT_CAP - notice.length) + notice, truncated: true };
+function skillRoots(cwd, home) {
+  const claude = process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude");
+  const codex = process.env.CODEX_HOME ?? join3(home, ".codex");
+  return [
+    ...cwd ? [join3(cwd, ".claude", "skills"), join3(cwd, ".agents", "skills")] : [],
+    join3(home, ".agents", "skills"),
+    join3(claude, "skills"),
+    join3(codex, "skills"),
+    join3(home, ".hermes", "skills")
+  ];
 }
-function readClaudeCode() {
-  const configRoot = claudeConfigRoot();
-  const parts = [];
-  const sources = [];
-  const global = readIfExists(join3(configRoot, "CLAUDE.md"));
-  if (global?.trim()) {
-    parts.push({ label: "Global CLAUDE.md", content: global });
-    sources.push("global CLAUDE.md");
-  }
-  for (const name of ["CLAUDE.md", "AGENTS.md"]) {
-    const project2 = readIfExists(join3(process.cwd(), name));
-    if (project2?.trim()) {
-      parts.push({ label: `Project ${name}`, content: project2 });
-      sources.push(`project ${name}`);
-      break;
+function pluginSkill(plugin, skill, home) {
+  const walk = (dir, depth, underPlugin) => {
+    if (depth > 7) return null;
+    let entries;
+    try {
+      entries = readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      return null;
     }
-  }
-  const { prompt, truncated } = assemblePrompt(parts);
-  const allServers = claudeMcpServers();
-  const { kept, dropped } = splitMcpServers(allServers);
-  const secretCandidates = [];
-  for (const d of dropped) {
-    const def = allServers[d.name];
-    if (!def?.env) continue;
-    for (const key of d.envKeys) {
-      const value = def.env[key];
-      if (value !== void 0 && value.trim()) {
-        secretCandidates.push({ serverName: d.name, envKey: key, value, url: d.url });
-      }
+    for (const entry2 of entries) {
+      if (!entry2.isDirectory() || entry2.name === "node_modules" || entry2.name === ".git") continue;
+      const path = join3(dir, entry2.name);
+      if (entry2.name === skill && basename3(dir) === "skills" && (underPlugin || path.includes(`${sep}${plugin}${sep}`)) && isFile(join3(path, "SKILL.md"))) return realpathSync(path);
+      const found = walk(path, depth + 1, underPlugin);
+      if (found) return found;
     }
-  }
-  return {
-    harness: "claude_code",
-    configRoot,
-    prompt,
-    promptSources: sources,
-    truncated,
-    model: claudeModel(configRoot),
-    keptServers: kept,
-    droppedServers: dropped,
-    secretCandidates
+    return null;
   };
+  return walk(join3(process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude"), "plugins"), 0, false) ?? walk(join3(home, "Library", "Application Support", "Claude", "local-agent-mode-sessions", "skills-plugin"), 0, true);
 }
-function detectHarness(explicit) {
-  if (explicit) {
-    if (!HARNESSES.includes(explicit)) {
-      throw new Error(`unknown harness ${explicit} \u2014 expected ${HARNESSES.join(" | ")}`);
-    }
-    return explicit;
+function findSkill(name, cwd, home) {
+  const [scope, skill] = name.includes(":") ? name.split(":", 2) : [null, name];
+  if (scope && skill) return pluginSkill(scope, skill, home);
+  for (const root of skillRoots(cwd, home)) {
+    const direct = join3(root, name);
+    if (isFile(join3(direct, "SKILL.md"))) return realpathSync(direct);
   }
-  if (existsSync2(claudeConfigRoot())) return "claude_code";
-  if (existsSync2(join3(homedir(), ".codex"))) return "codex";
-  if (existsSync2(join3(homedir(), ".openclaw"))) return "openclaw";
-  throw new Error(
-    "no local harness found (~/.claude, ~/.codex, ~/.openclaw) \u2014 pass --harness to override"
-  );
-}
-function readLocal(harness2) {
-  if (harness2 === "claude_code") return readClaudeCode();
-  throw new Error(
-    `${harness2} cloning lands next \u2014 claude_code is the first supported harness`
-  );
-}
-function linkPath(configRoot) {
-  return join3(configRoot, "agentsky-link.json");
+  return null;
 }
-function readLink(configRoot) {
-  const link2 = readJson(linkPath(configRoot));
-  return link2?.agentId ? link2 : void 0;
+function loadedSkills(records, touched, cwd, home = homedir()) {
+  const dirs = /* @__PURE__ */ new Map();
+  const missing = /* @__PURE__ */ new Set();
+  const add = (dir, name = basename3(dir)) => {
+    if (!isFile(join3(dir, "SKILL.md"))) return false;
+    const real = realpathSync(dir);
+    if (![...dirs.values()].includes(real)) dirs.set(name, real);
+    return true;
+  };
+  const called = [];
+  for (const record of records) {
+    const texts = [];
+    strings(record, texts);
+    for (const text of texts) for (const match of text.matchAll(SKILL_LINE)) add(match[1].trim().replace(/[.,;:)]+$/, ""));
+    const content = record?.message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const block of content) {
+      const b = block;
+      if (b?.type === "tool_use" && b.name === "Skill" && typeof b.input?.skill === "string") called.push(b.input.skill.replace(/^\//, ""));
+    }
+  }
+  for (const path of touched) if (basename3(path) === "SKILL.md") add(dirname2(path));
+  for (const name of called) {
+    if (!name || dirs.has(name) || [...dirs.keys()].some((key) => key.endsWith(`:${name}`) || name.endsWith(`:${key}`))) continue;
+    const dir = findSkill(name, cwd, home);
+    if (!dir || !add(dir, name)) missing.add(name);
+  }
+  return { found: [...dirs].map(([name, dir]) => ({ name: name.replace(/[^A-Za-z0-9._:-]/g, "-"), dir })), missing: [...missing] };
 }
-function writeLink(configRoot, link2) {
-  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link2, null, 2)}
-`);
+function readJson(path) {
+  try {
+    const value = JSON.parse(readFileSync3(path, "utf8"));
+    return value && typeof value === "object" ? value : null;
+  } catch {
+    return null;
+  }
 }
-var DEFAULT_VAULT_NAME = "default";
-async function fetchDefaultVaultId() {
-  const { vaults } = await api(
-    "GET",
-    "/vaults"
-  );
-  return vaults.find((v) => v.display_name === DEFAULT_VAULT_NAME)?.id ?? null;
+function names(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const keys2 = Object.keys(value).sort();
+  return keys2.length ? keys2 : void 0;
 }
-async function ensureDefaultVaultId() {
-  const existing = await fetchDefaultVaultId();
-  if (existing) return existing;
+function safeUrl(raw) {
   try {
-    const { vault: vault2 } = await api("POST", "/vaults", {
-      display_name: DEFAULT_VAULT_NAME
-    });
-    return vault2.id;
-  } catch (error) {
-    if (error instanceof ApiError && error.status === 409) {
-      const raced = await fetchDefaultVaultId();
-      if (raced) return raced;
-    }
-    throw error;
+    const url = new URL(raw);
+    if (!/^https?:$/.test(url.protocol)) return null;
+    const query = [.../* @__PURE__ */ new Set([...url.searchParams.keys()])].sort();
+    return { url: `${url.protocol}//${url.host}${url.pathname}`, ...query.length ? { query } : {} };
+  } catch {
+    return null;
   }
 }
-async function confirmAndVaultSecrets(candidates, yes) {
-  if (!candidates.length) return;
-  if (yes) {
-    console.log(
-      `  ${candidates.length} secret${candidates.length === 1 ? "" : "s"} from dropped MCP servers not saved (--yes skips vault confirmation).`
-    );
-    return;
+function serverEntry(name, def, scope) {
+  if (!def || typeof def !== "object") return null;
+  const env = names(def.env);
+  const headers = names(def.headers ?? def.http_headers);
+  if (typeof def.url === "string") {
+    const url = safeUrl(def.url);
+    if (!url) return null;
+    const type = def.type === "sse" ? "sse" : "http";
+    return { name, scope, transport: type, ...url, ...headers ? { headers } : {}, ...env ? { env } : {} };
   }
-  console.log("\nSecret-bearing MCP servers were left out of the clone payload.");
-  console.log("You can save their keys to your workspace vault now (values are sent encrypted, never displayed).\n");
-  let vaultId;
-  let saved = 0;
-  let skipped = 0;
-  for (const c of candidates) {
-    const chosen = await confirm(`  Add ${c.envKey} (from ${c.serverName}) to your default vault?`);
-    if (!chosen) {
-      console.log(`  \u2014 skipped ${c.envKey}`);
-      skipped += 1;
-      continue;
+  if (typeof def.command !== "string" || !def.command) return null;
+  const args = Array.isArray(def.args) ? def.args.filter((arg) => typeof arg === "string") : [];
+  return { name, scope, transport: "stdio", command: def.command, ...args.length ? { args } : {}, ...env ? { env } : {} };
+}
+function mcpServers(harness2, cwd, home = homedir()) {
+  const out = [];
+  const push = (servers, scope) => {
+    if (!servers || typeof servers !== "object") return;
+    for (const [name, def] of Object.entries(servers)) {
+      const entry2 = serverEntry(name, def, scope);
+      if (entry2 && !out.some((existing) => existing.name === name)) out.push(entry2);
     }
+  };
+  if (harness2 === "claude_code") {
+    const config = readJson(join3(process.env.CLAUDE_CONFIG_DIR ? dirname2(process.env.CLAUDE_CONFIG_DIR) : home, ".claude.json"));
+    const projects = config?.projects && typeof config.projects === "object" ? config.projects : {};
+    const root = cwd ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || cwd : "";
+    if (cwd) push(projects[cwd]?.mcpServers ?? projects[root]?.mcpServers, "local");
+    if (root) push(readJson(join3(root, ".mcp.json"))?.mcpServers, "project");
+    push(config?.mcpServers, "user");
+  }
+  if (harness2 === "codex") {
     try {
-      vaultId ??= await ensureDefaultVaultId();
-      await api("POST", `/vaults/${encodeURIComponent(vaultId)}/secrets`, {
-        display_name: `${c.envKey} (${c.serverName})`,
-        auth: {
-          type: "environment_variable",
-          secret_name: c.envKey,
-          value: c.value,
-          allowed_hosts: c.url ? [c.url] : []
-        }
-      });
-      console.log(`  \u2713 saved ${c.envKey}`);
-      saved += 1;
-    } catch (error) {
-      if (error instanceof ApiError && error.status === 409) {
-        console.log(`  \u2014 ${c.envKey} already in vault`);
-      } else {
-        const msg = error instanceof Error ? error.message : String(error);
-        console.log(`  \u2717 ${c.envKey} failed: ${msg}`);
-      }
+      const config = parseToml(readFileSync3(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "config.toml"), "utf8"));
+      push(config.mcp_servers, "user");
+    } catch {
     }
   }
-  if (saved || skipped) {
-    console.log(
-      `
-Vault: ${saved} saved, ${skipped} skipped. Attach the "default" vault to a session to use these keys.`
-    );
-  }
+  return out;
 }
-function confirm(question) {
-  return new Promise((done) => {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    rl.question(`${question} [Y/n] `, (answer) => {
-      rl.close();
-      done(/^(y(es)?)?$/i.test(answer.trim()));
-    });
-  });
+function remoteWithoutCredentials(remote) {
+  return remote.trim().replace(/\/\/[^@/]+@/, "//").replace(/^[^@/]+@([^:]+):/, "$1:");
 }
-function openBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  try {
-    spawn(cmd, [url], { stdio: "ignore", detached: true }).unref();
-  } catch {
+function workspaceState(cwd, harness2, skills2, home = homedir(), title = null) {
+  const present = !!cwd && isDir(cwd);
+  const root = present ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || null : null;
+  let gitState = null;
+  let tree = [];
+  let patch = null;
+  if (root) {
+    const dirty = (git(root, "status", "--porcelain=v1", "--untracked-files=normal") ?? "").split("\n").filter(Boolean).map((line) => line.slice(3));
+    const ahead = git(root, "rev-list", "--count", "@{upstream}..HEAD");
+    const remote = git(root, "remote", "get-url", "origin");
+    const branch = git(root, "rev-parse", "--abbrev-ref", "HEAD")?.trim() || null;
+    gitState = {
+      remote: remote ? remoteWithoutCredentials(remote) : null,
+      branch: branch === "HEAD" ? null : branch,
+      commit: git(root, "rev-parse", "HEAD")?.trim() || null,
+      dirty: dirty.slice(0, 500),
+      ahead: ahead === null ? null : Number(ahead.trim()) || 0
+    };
+    tree = (git(cwd, "-c", "core.quotePath=false", "ls-files") ?? "").split("\n").filter(Boolean);
+    if (dirty.length) patch = git(cwd, "diff", "HEAD", "--no-color", "--no-ext-diff", "--relative", "--", ".") || null;
   }
-}
-function kb(text) {
-  return `${Math.max(1, Math.round(text.length / 1024))} KB`;
-}
-async function createClone(local, opts) {
-  const keptNames = Object.keys(local.keptServers);
-  const summary = [
-    local.promptSources.length ? `${local.promptSources.join(" + ")} (${kb(local.prompt)})` : "no instructions found",
-    `model ${local.model ?? "(harness default)"}`,
-    `${keptNames.length} MCP server${keptNames.length === 1 ? "" : "s"}${keptNames.length ? ` (${keptNames.join(", ")})` : ""}`
-  ].join(" \xB7 ");
-  console.log(`Detected ${local.harness} at ${local.configRoot} (project ${basename3(process.cwd())})`);
-  console.log(`Will clone: ${summary}`);
-  if (local.truncated) console.log("  note: instructions exceeded 100k chars and were truncated");
-  if (local.droppedServers.length) {
-    console.log(
-      `Left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
-    );
-  }
-  if (opts.dryRun) {
-    console.log("Dry run \u2014 nothing sent.");
-    return;
-  }
-  if (!opts.yes && !await confirm("Launch this as a new cloud agent?")) {
-    console.log("Aborted \u2014 nothing sent.");
-    return;
-  }
-  const { servers: mcpServers2, skipped } = mcpServersFromKept(local.keptServers);
-  if (skipped.length) {
-    console.log(`  note: local (stdio) MCP servers have no cloud equivalent and were skipped: ${skipped.join(", ")}`);
-  }
-  const body = {
-    agentType: local.harness,
-    ...local.model ? { llm: local.model } : {},
-    ...local.prompt ? { prompt: local.prompt } : {},
-    ...mcpServers2.length ? { mcpServers: mcpServers2 } : {}
+  return {
+    manifest: {
+      format: "agentsky.import-workspace",
+      format_version: 1,
+      harness: harness2,
+      title: title?.trim().slice(0, 120) || null,
+      cwd: cwd ? cwd.replace(home, "~") : null,
+      project: cwd ? basename3(root ?? cwd) : null,
+      git: gitState,
+      tree: tree.slice(0, MAX_TREE),
+      tree_truncated: tree.length > MAX_TREE,
+      skills: [...skills2.found.map((skill) => ({ name: skill.name, found: true })), ...skills2.missing.map((name) => ({ name, found: false }))],
+      mcp_servers: mcpServers(harness2, cwd, home)
+    },
+    patch
   };
-  let sentLlm = local.model ?? null;
-  let created;
-  try {
-    ({ agent: created } = await api("POST", "/agents", body));
-  } catch (error) {
-    if (error instanceof ApiError && error.status === 422 && local.model) {
-      const successor = supersededBy(local.model);
-      console.log(
-        successor ? `  note: ${local.model} is superseded \u2014 using ${successor}` : `  note: ${local.model} isn't available for ${local.harness} \u2014 using the harness default`
-      );
-      sentLlm = successor;
-      ({ agent: created } = await api("POST", "/agents", {
-        ...body,
-        llm: successor ?? void 0
-      }));
-    } else {
-      throw error;
-    }
-  }
-  console.log("Starting its runtime\u2026");
-  await api("POST", "/sessions", { agent: created.id });
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  writeLink(local.configRoot, {
-    baseUrl: apiBase(),
-    agentId: created.id,
-    clonedAt: now,
-    lastSyncedAt: now,
-    llm: sentLlm,
-    mcpServers: keptNames
-  });
-  const url = `${apiBase()}/agents/${created.id}`;
-  console.log(`Cloned \u2192 ${created.id}  ${url}`);
-  console.log(
-    `Linked this machine (${linkPath(local.configRoot)}). Push prompt changes anytime by running \`sky clone\` again.`
-  );
-  await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
-  if (opts.open) openBrowser(url);
-}
-async function syncClone(local, link2, opts) {
-  const since = link2.lastSyncedAt ?? link2.clonedAt;
-  console.log(
-    `Syncing ${link2.agentId} from ${local.configRoot} (last synced ${since ? new Date(since).toLocaleDateString() : "never"})`
-  );
-  if (opts.dryRun) {
-    console.log(
-      `  would push prompt (${kb(local.prompt)}) to ${link2.agentId}. Dry run \u2014 nothing sent.`
-    );
-    return;
-  }
-  let agent2;
-  try {
-    ({ agent: agent2 } = await api(
-      "GET",
-      `/agents/${encodeURIComponent(link2.agentId)}`
-    ));
-  } catch (error) {
-    if (error instanceof ApiError && error.status === 404) {
-      throw new Error(
-        `linked agent ${link2.agentId} no longer exists \u2014 run \`sky clone --new\` to launch a fresh one`
-      );
-    }
-    throw error;
-  }
-  if (agent2.agentType !== local.harness) {
-    throw new Error(
-      `linked agent ${link2.agentId} is ${agent2.agentType}, this machine runs ${local.harness} \u2014 run \`sky clone --new\` to launch a fresh agent`
-    );
-  }
-  const result = await api(
-    "PUT",
-    `/agents/${encodeURIComponent(link2.agentId)}/prompt`,
-    { prompt: local.prompt }
-  );
-  console.log(
-    result.unchanged ? "  prompt   unchanged" : `  prompt   updated (v${result.version}${result.applied === "live" ? ", hot-reloaded" : ", applies on next boot"})`
-  );
-  const drift = [];
-  const localModel = local.model ?? null;
-  const linkedModel = link2.llm ?? agent2.llm;
-  if (localModel && linkedModel && localModel !== linkedModel) {
-    drift.push(`model changed ${linkedModel} \u2192 ${localModel}`);
-  }
-  const before = new Set(link2.mcpServers ?? []);
-  const nowKept = Object.keys(local.keptServers);
-  const newServers = nowKept.filter((n) => !before.has(n));
-  const goneServers = [...before].filter((n) => !nowKept.includes(n));
-  if (newServers.length) drift.push(`${newServers.length} new MCP server${newServers.length === 1 ? "" : "s"} (${newServers.join(", ")})`);
-  if (goneServers.length) drift.push(`${goneServers.length} removed MCP server${goneServers.length === 1 ? "" : "s"} (${goneServers.join(", ")})`);
-  if (drift.length) {
-    console.log(`  skipped (set at launch): ${drift.join("; ")}`);
-    console.log("    \u2192 a running agent can't change these; run `sky clone --new` to launch a fresh agent.");
-  }
-  if (local.droppedServers.length) {
-    console.log(
-      `  left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
-    );
-  }
-  writeLink(local.configRoot, { ...link2, lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  console.log(`Synced ${link2.agentId}.`);
-  await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
-  if (opts.open) openBrowser(`${apiBase()}/agents/${link2.agentId}`);
-}
-async function clone(opts) {
-  const harness2 = detectHarness(opts.harness);
-  const local = readLocal(harness2);
-  const link2 = opts.new ? void 0 : readLink(local.configRoot);
-  if (link2) await syncClone(local, link2, opts);
-  else await createClone(local, opts);
-}
-
-// src/import-local.ts
-import { closeSync as closeSync3, existsSync as existsSync5, openSync as openSync3, readdirSync as readdirSync4, readFileSync as readFileSync8, readSync as readSync3, statSync as statSync5 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join7 } from "path";
-import { createHash as createHash3 } from "crypto";
-
-// src/import-files.ts
-import { isUtf8 } from "buffer";
-import { existsSync as existsSync4, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname4, extname as extname2, isAbsolute, join as join5, relative as relative2, resolve as resolve4, sep as sep2, basename as basename5 } from "path";
-
-// src/import-workspace.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync5, realpathSync, statSync as statSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { basename as basename4, dirname as dirname3, join as join4, relative, sep } from "path";
-import { parse as parseToml2 } from "smol-toml";
-var MAX_TREE = 5e3;
-var SKILL_LINE = /Base directory for this skill: (\/[^\n\r"'\\<>]+)/g;
-function git(cwd, ...args) {
-  const run2 = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8", timeout: 1e4, maxBuffer: 32 * 1024 * 1024 });
-  return run2.status === 0 ? run2.stdout : null;
-}
-var isFile = (path) => {
-  try {
-    return statSync3(path).isFile();
-  } catch {
-    return false;
-  }
-};
-var isDir = (path) => {
-  try {
-    return statSync3(path).isDirectory();
-  } catch {
-    return false;
-  }
-};
-function sharedInstructionPaths(home = homedir2()) {
-  const rules = join4(home, ".agents", "rules");
-  let ruleFiles = [];
-  try {
-    ruleFiles = readdirSync2(rules).filter((name) => name.endsWith(".md")).sort().map((name) => join4(rules, name));
-  } catch {
-  }
-  return [join4(home, "AGENTS.md"), join4(home, "MEMORY.md"), ...ruleFiles].filter(isFile);
-}
-function strings(value, out, depth = 0) {
-  if (depth > 12) return;
-  if (typeof value === "string") out.push(value);
-  else if (Array.isArray(value)) for (const item of value) strings(item, out, depth + 1);
-  else if (value && typeof value === "object") for (const item of Object.values(value)) strings(item, out, depth + 1);
-}
-function skillRoots(cwd, home) {
-  const claude = process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude");
-  const codex = process.env.CODEX_HOME ?? join4(home, ".codex");
-  return [
-    ...cwd ? [join4(cwd, ".claude", "skills"), join4(cwd, ".agents", "skills")] : [],
-    join4(home, ".agents", "skills"),
-    join4(claude, "skills"),
-    join4(codex, "skills"),
-    join4(home, ".hermes", "skills")
-  ];
 }
-function pluginSkill(plugin, skill, home) {
-  const walk = (dir, depth, underPlugin) => {
-    if (depth > 7) return null;
+function skillFiles(skill) {
+  const out = [];
+  const walk = (dir, depth) => {
+    if (depth > 8 || out.length > 400) return;
     let entries;
     try {
       entries = readdirSync2(dir, { withFileTypes: true });
     } catch {
-      return null;
+      return;
     }
     for (const entry2 of entries) {
-      if (!entry2.isDirectory() || entry2.name === "node_modules" || entry2.name === ".git") continue;
-      const path = join4(dir, entry2.name);
-      if (entry2.name === skill && basename4(dir) === "skills" && (underPlugin || path.includes(`${sep}${plugin}${sep}`)) && isFile(join4(path, "SKILL.md"))) return realpathSync(path);
-      const found = walk(path, depth + 1, underPlugin);
-      if (found) return found;
+      if (entry2.name === "node_modules" || entry2.name === ".git" || entry2.name === "__pycache__" || entry2.name === ".venv") continue;
+      const path = join3(dir, entry2.name);
+      if (entry2.isDirectory()) walk(path, depth + 1);
+      else if (entry2.isFile()) out.push({ path, name: `skills/${skill.name}/${relative(skill.dir, path).split(sep).join("/")}` });
     }
-    return null;
   };
-  return walk(join4(process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude"), "plugins"), 0, false) ?? walk(join4(home, "Library", "Application Support", "Claude", "local-agent-mode-sessions", "skills-plugin"), 0, true);
-}
-function findSkill(name, cwd, home) {
-  const [scope, skill] = name.includes(":") ? name.split(":", 2) : [null, name];
-  if (scope && skill) return pluginSkill(scope, skill, home);
-  for (const root of skillRoots(cwd, home)) {
-    const direct = join4(root, name);
-    if (isFile(join4(direct, "SKILL.md"))) return realpathSync(direct);
-  }
-  return null;
-}
-function loadedSkills(records, touched, cwd, home = homedir2()) {
-  const dirs = /* @__PURE__ */ new Map();
-  const missing = /* @__PURE__ */ new Set();
-  const add = (dir, name = basename4(dir)) => {
-    if (!isFile(join4(dir, "SKILL.md"))) return false;
-    const real = realpathSync(dir);
-    if (![...dirs.values()].includes(real)) dirs.set(name, real);
-    return true;
-  };
-  const called = [];
-  for (const record of records) {
-    const texts = [];
-    strings(record, texts);
-    for (const text of texts) for (const match of text.matchAll(SKILL_LINE)) add(match[1].trim().replace(/[.,;:)]+$/, ""));
-    const content = record?.message?.content;
-    if (!Array.isArray(content)) continue;
-    for (const block of content) {
-      const b = block;
-      if (b?.type === "tool_use" && b.name === "Skill" && typeof b.input?.skill === "string") called.push(b.input.skill.replace(/^\//, ""));
-    }
-  }
-  for (const path of touched) if (basename4(path) === "SKILL.md") add(dirname3(path));
-  for (const name of called) {
-    if (!name || dirs.has(name) || [...dirs.keys()].some((key) => key.endsWith(`:${name}`) || name.endsWith(`:${key}`))) continue;
-    const dir = findSkill(name, cwd, home);
-    if (!dir || !add(dir, name)) missing.add(name);
-  }
-  return { found: [...dirs].map(([name, dir]) => ({ name: name.replace(/[^A-Za-z0-9._:-]/g, "-"), dir })), missing: [...missing] };
+  if (existsSync2(skill.dir)) walk(skill.dir, 0);
+  return out;
 }
-function readJson2(path) {
+function codexThreadName(sessionId, home = homedir()) {
+  let name = null;
   try {
-    const value = JSON.parse(readFileSync5(path, "utf8"));
-    return value && typeof value === "object" ? value : null;
+    for (const line of readFileSync3(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "session_index.jsonl"), "utf8").split("\n")) {
+      if (!line.includes(sessionId)) continue;
+      try {
+        const entry2 = JSON.parse(line);
+        if (entry2.id === sessionId && typeof entry2.thread_name === "string" && entry2.thread_name.trim()) name = entry2.thread_name.trim();
+      } catch {
+      }
+    }
   } catch {
-    return null;
   }
-}
-function names(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const keys2 = Object.keys(value).sort();
-  return keys2.length ? keys2 : void 0;
-}
-function safeUrl(raw) {
-  try {
-    const url = new URL(raw);
-    if (!/^https?:$/.test(url.protocol)) return null;
-    const query = [.../* @__PURE__ */ new Set([...url.searchParams.keys()])].sort();
-    return { url: `${url.protocol}//${url.host}${url.pathname}`, ...query.length ? { query } : {} };
-  } catch {
-    return null;
-  }
-}
-function serverEntry(name, def, scope) {
-  if (!def || typeof def !== "object") return null;
-  const env = names(def.env);
-  const headers = names(def.headers ?? def.http_headers);
-  if (typeof def.url === "string") {
-    const url = safeUrl(def.url);
-    if (!url) return null;
-    const type = def.type === "sse" ? "sse" : "http";
-    return { name, scope, transport: type, ...url, ...headers ? { headers } : {}, ...env ? { env } : {} };
-  }
-  if (typeof def.command !== "string" || !def.command) return null;
-  const args = Array.isArray(def.args) ? def.args.filter((arg) => typeof arg === "string") : [];
-  return { name, scope, transport: "stdio", command: def.command, ...args.length ? { args } : {}, ...env ? { env } : {} };
-}
-function mcpServers(harness2, cwd, home = homedir2()) {
-  const out = [];
-  const push = (servers, scope) => {
-    if (!servers || typeof servers !== "object") return;
-    for (const [name, def] of Object.entries(servers)) {
-      const entry2 = serverEntry(name, def, scope);
-      if (entry2 && !out.some((existing) => existing.name === name)) out.push(entry2);
-    }
-  };
-  if (harness2 === "claude_code") {
-    const config = readJson2(join4(process.env.CLAUDE_CONFIG_DIR ? dirname3(process.env.CLAUDE_CONFIG_DIR) : home, ".claude.json"));
-    const projects = config?.projects && typeof config.projects === "object" ? config.projects : {};
-    const root = cwd ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || cwd : "";
-    if (cwd) push(projects[cwd]?.mcpServers ?? projects[root]?.mcpServers, "local");
-    if (root) push(readJson2(join4(root, ".mcp.json"))?.mcpServers, "project");
-    push(config?.mcpServers, "user");
-  }
-  if (harness2 === "codex") {
-    try {
-      const config = parseToml2(readFileSync5(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "config.toml"), "utf8"));
-      push(config.mcp_servers, "user");
-    } catch {
-    }
-  }
-  return out;
-}
-function remoteWithoutCredentials(remote) {
-  return remote.trim().replace(/\/\/[^@/]+@/, "//").replace(/^[^@/]+@([^:]+):/, "$1:");
-}
-function workspaceState(cwd, harness2, skills2, home = homedir2(), title = null) {
-  const present = !!cwd && isDir(cwd);
-  const root = present ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || null : null;
-  let gitState = null;
-  let tree = [];
-  let patch = null;
-  if (root) {
-    const dirty = (git(root, "status", "--porcelain=v1", "--untracked-files=normal") ?? "").split("\n").filter(Boolean).map((line) => line.slice(3));
-    const ahead = git(root, "rev-list", "--count", "@{upstream}..HEAD");
-    const remote = git(root, "remote", "get-url", "origin");
-    const branch = git(root, "rev-parse", "--abbrev-ref", "HEAD")?.trim() || null;
-    gitState = {
-      remote: remote ? remoteWithoutCredentials(remote) : null,
-      branch: branch === "HEAD" ? null : branch,
-      commit: git(root, "rev-parse", "HEAD")?.trim() || null,
-      dirty: dirty.slice(0, 500),
-      ahead: ahead === null ? null : Number(ahead.trim()) || 0
-    };
-    tree = (git(cwd, "-c", "core.quotePath=false", "ls-files") ?? "").split("\n").filter(Boolean);
-    if (dirty.length) patch = git(cwd, "diff", "HEAD", "--no-color", "--no-ext-diff", "--relative", "--", ".") || null;
-  }
-  return {
-    manifest: {
-      format: "agentsky.import-workspace",
-      format_version: 1,
-      harness: harness2,
-      title: title?.trim().slice(0, 120) || null,
-      cwd: cwd ? cwd.replace(home, "~") : null,
-      project: cwd ? basename4(root ?? cwd) : null,
-      git: gitState,
-      tree: tree.slice(0, MAX_TREE),
-      tree_truncated: tree.length > MAX_TREE,
-      skills: [...skills2.found.map((skill) => ({ name: skill.name, found: true })), ...skills2.missing.map((name) => ({ name, found: false }))],
-      mcp_servers: mcpServers(harness2, cwd, home)
-    },
-    patch
-  };
-}
-function skillFiles(skill) {
-  const out = [];
-  const walk = (dir, depth) => {
-    if (depth > 8 || out.length > 400) return;
-    let entries;
-    try {
-      entries = readdirSync2(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry2 of entries) {
-      if (entry2.name === "node_modules" || entry2.name === ".git" || entry2.name === "__pycache__" || entry2.name === ".venv") continue;
-      const path = join4(dir, entry2.name);
-      if (entry2.isDirectory()) walk(path, depth + 1);
-      else if (entry2.isFile()) out.push({ path, name: `skills/${skill.name}/${relative(skill.dir, path).split(sep).join("/")}` });
-    }
-  };
-  if (existsSync3(skill.dir)) walk(skill.dir, 0);
-  return out;
-}
-function codexThreadName(sessionId, home = homedir2()) {
-  let name = null;
-  try {
-    for (const line of readFileSync5(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "session_index.jsonl"), "utf8").split("\n")) {
-      if (!line.includes(sessionId)) continue;
-      try {
-        const entry2 = JSON.parse(line);
-        if (entry2.id === sessionId && typeof entry2.thread_name === "string" && entry2.thread_name.trim()) name = entry2.thread_name.trim();
-      } catch {
-      }
-    }
-  } catch {
-  }
-  return name;
+  return name;
 }
 
 // src/import-files.ts
@@ -1338,7 +778,7 @@ function classify(path) {
   if (DOCUMENTS[ext]) return { kind: "document", mediaType: DOCUMENTS[ext] };
   if (IMAGES[ext]) return { kind: "image", mediaType: IMAGES[ext] };
   if (TEXT[ext]) return { kind: "text", mediaType: TEXT[ext] };
-  if (PLAIN_TEXT.has(ext) || PLAIN_NAMES.has(basename5(path))) return { kind: "text", mediaType: "text/plain" };
+  if (PLAIN_TEXT.has(ext) || PLAIN_NAMES.has(basename4(path))) return { kind: "text", mediaType: "text/plain" };
   return null;
 }
 var SHELL_READ = /(?:^|[\s;&|(`"'])(?:cat|head|tail|nl|less|more|wc|bat|sed\s+-n\s+(?:'[^']*'|"[^"]*"|\S+))(?:\s+-[\w-]+(?:\s+\d+)?)*\s+((?:~|\.{0,2}\/)?[\w@%+./~-]*[\w-]\.[\w]{1,10}|\/[\w@%+./-]+)/g;
@@ -1352,13 +792,13 @@ function shellText(input) {
   const command = Array.isArray(i.command) ? i.command.filter((part) => typeof part === "string").join(" ") : str(i.command);
   return [command, str(i.cmd), str(i.script)].filter(Boolean).join("\n");
 }
-function touchedPaths(records, cwd, home = homedir3()) {
+function touchedPaths(records, cwd, home = homedir2()) {
   const out = /* @__PURE__ */ new Set();
   const add = (raw, base) => {
     if (!raw || raw.length > 1e3) return;
     const path = raw.replace(/^~(?=\/)/, home);
-    if (isAbsolute(path)) out.add(resolve4(path));
-    else if (base) out.add(resolve4(base, path));
+    if (isAbsolute(path)) out.add(resolve2(path));
+    else if (base) out.add(resolve2(base, path));
   };
   const call = (name, input) => {
     const i = obj(input);
@@ -1395,22 +835,22 @@ function touchedPaths(records, cwd, home = homedir3()) {
   return [...out];
 }
 function gitRoot(dir) {
-  for (let d = dir; ; d = dirname4(d)) {
-    if (existsSync4(join5(d, ".git"))) return d;
-    if (d === dirname4(d)) return null;
+  for (let d = dir; ; d = dirname3(d)) {
+    if (existsSync3(join4(d, ".git"))) return d;
+    if (d === dirname3(d)) return null;
   }
 }
-function instructionPaths(cwd, harness2, home = homedir3()) {
+function instructionPaths(cwd, harness2, home = homedir2()) {
   const out = [];
-  if (cwd && existsSync4(cwd)) {
+  if (cwd && existsSync3(cwd)) {
     const root = gitRoot(cwd) ?? cwd;
-    for (let d = resolve4(cwd); ; d = dirname4(d)) {
-      for (const name of INSTRUCTION_FILES) out.push(join5(d, name));
-      if (d === root || d === dirname4(d)) break;
+    for (let d = resolve2(cwd); ; d = dirname3(d)) {
+      for (const name of INSTRUCTION_FILES) out.push(join4(d, name));
+      if (d === root || d === dirname3(d)) break;
     }
   }
-  if (harness2 === "claude_code") out.push(join5(process.env.CLAUDE_CONFIG_DIR ?? join5(home, ".claude"), "CLAUDE.md"));
-  if (harness2 === "codex") out.push(join5(process.env.CODEX_HOME ?? join5(home, ".codex"), "AGENTS.md"));
+  if (harness2 === "claude_code") out.push(join4(process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude"), "CLAUDE.md"));
+  if (harness2 === "codex") out.push(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "AGENTS.md"));
   out.push(...sharedInstructionPaths(home));
   return out.filter((path) => {
     try {
@@ -1420,8 +860,8 @@ function instructionPaths(cwd, harness2, home = homedir3()) {
     }
   });
 }
-function resourceName(path, cwd, home = homedir3()) {
-  const inside = cwd ? relative2(resolve4(cwd), path) : "";
+function resourceName(path, cwd, home = homedir2()) {
+  const inside = cwd ? relative2(resolve2(cwd), path) : "";
   if (cwd && inside && !inside.startsWith("..") && !isAbsolute(inside)) return `workspace/${inside.split(sep2).join("/")}`;
   const underHome = relative2(home, path);
   const shown = !underHome.startsWith("..") && !isAbsolute(underHome) ? `~/${underHome}` : path.replace(/^\/+/, "");
@@ -1432,8 +872,8 @@ function resourceLine(name, mediaType, data) {
   return redactLine(JSON.stringify({ type: "import.resource", name, media_type: mediaType, data: data.toString("base64") }), { requireStructured: true }).line + "\n";
 }
 function collectSessionFiles(records, opts) {
-  const home = opts.home ?? homedir3();
-  const exclude = new Set((opts.exclude ?? []).map((path) => resolve4(path)));
+  const home = opts.home ?? homedir2();
+  const exclude = new Set((opts.exclude ?? []).map((path) => resolve2(path)));
   const leftOut = [];
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
@@ -1498,7 +938,7 @@ function collectSessionFiles(records, opts) {
   for (const file of candidates) {
     let data;
     try {
-      data = readFileSync6(file.path);
+      data = readFileSync4(file.path);
     } catch {
       leftOut.push({ path: file.path, reason: "missing" });
       continue;
@@ -1535,9 +975,9 @@ function collectSessionFiles(records, opts) {
 // src/import-environment.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { closeSync as closeSync2, createWriteStream, lstatSync, mkdtempSync, openSync as openSync2, readdirSync as readdirSync3, readFileSync as readFileSync7, readSync as readSync2, rmSync as rmSync2 } from "fs";
+import { closeSync as closeSync2, createWriteStream, lstatSync, mkdtempSync, openSync as openSync2, readdirSync as readdirSync3, readFileSync as readFileSync5, readSync as readSync2, rmSync as rmSync2 } from "fs";
 import { tmpdir } from "os";
-import { join as join6 } from "path";
+import { join as join5 } from "path";
 import { isUtf8 as isUtf82 } from "buffer";
 import { createGzip } from "zlib";
 
@@ -1723,7 +1163,7 @@ function listFiles(cwd) {
     for (const entry2 of entries) {
       if (SKIPPED.has(entry2.name)) continue;
       const rel = prefix ? `${prefix}/${entry2.name}` : entry2.name;
-      if (entry2.isDirectory()) walk(join6(dir, entry2.name), rel);
+      if (entry2.isDirectory()) walk(join5(dir, entry2.name), rel);
       else out.push(rel);
       if (out.length > MAX_ENVIRONMENT_FILES) return;
     }
@@ -1733,15 +1173,15 @@ function listFiles(cwd) {
 }
 function textOf(path, size) {
   if (size > MAX_REDACTED_TEXT_BYTES) return null;
-  const data = readFileSync7(path);
+  const data = readFileSync5(path);
   if (data.subarray(0, 8e3).includes(0) || !isUtf82(data)) return null;
   return data;
 }
 async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
   const listed = listFiles(cwd);
   if (listed.length > MAX_ENVIRONMENT_FILES) throw new Error(`The working folder has more than ${MAX_ENVIRONMENT_FILES} files; import it with --no-environment.`);
-  const scratch = mkdtempSync(join6(tmpdir(), "sky-environment-"));
-  const path = join6(scratch, "environment.tar.gz");
+  const scratch = mkdtempSync(join5(tmpdir(), "sky-environment-"));
+  const path = join5(scratch, "environment.tar.gz");
   const leftOut = [];
   const written2 = /* @__PURE__ */ new Set();
   const hash = createHash2("sha256");
@@ -1769,7 +1209,7 @@ async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
   });
   try {
     for (const rel of listed) {
-      const full = join6(cwd, ...rel.split("/"));
+      const full = join5(cwd, ...rel.split("/"));
       if (SECRET_FILE2.test(rel)) {
         leftOut.push({ path: rel, reason: "credential file" });
         continue;
@@ -1923,13 +1363,13 @@ function sniffTitle(filePath) {
   }
 }
 function listClaudeCodeSessions(limit) {
-  const root = process.env.CLAUDE_CONFIG_DIR ?? join7(homedir4(), ".claude");
-  const projectsDir = join7(root, "projects");
-  if (!existsSync5(projectsDir)) return [];
+  const root = process.env.CLAUDE_CONFIG_DIR ?? join6(homedir3(), ".claude");
+  const projectsDir = join6(root, "projects");
+  if (!existsSync4(projectsDir)) return [];
   const sessions = [];
   try {
     for (const encoded of readdirSync4(projectsDir)) {
-      const projectDir = join7(projectsDir, encoded);
+      const projectDir = join6(projectsDir, encoded);
       let entries;
       try {
         entries = readdirSync4(projectDir);
@@ -1940,7 +1380,7 @@ function listClaudeCodeSessions(limit) {
       for (const entry2 of entries) {
         if (!entry2.endsWith(".jsonl")) continue;
         const sessionId = entry2.slice(0, -6);
-        const mainFile = join7(projectDir, entry2);
+        const mainFile = join6(projectDir, entry2);
         let stat;
         try {
           stat = statSync5(mainFile);
@@ -1950,12 +1390,12 @@ function listClaudeCodeSessions(limit) {
         if (!stat.isFile()) continue;
         let discoveryError;
         const subagentFiles = [];
-        const subagentDir = join7(projectDir, sessionId, "subagents");
-        if (existsSync5(subagentDir)) {
+        const subagentDir = join6(projectDir, sessionId, "subagents");
+        if (existsSync4(subagentDir)) {
           try {
             const subFiles = readdirSync4(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
             for (const f of subFiles) {
-              subagentFiles.push(join7(subagentDir, f));
+              subagentFiles.push(join6(subagentDir, f));
             }
           } catch {
             discoveryError = "Cannot read all recorded subagent conversations. Fix local file access before importing this session.";
@@ -1977,7 +1417,7 @@ function listClaudeCodeSessions(limit) {
   return sessions.sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
 function listCodexSessions(limit) {
-  const sessionsDir = join7(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join7(homedir4(), ".codex"), "sessions");
+  const sessionsDir = join6(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join6(homedir3(), ".codex"), "sessions");
   const records = [];
   function walk(dir) {
     let entries;
@@ -1987,7 +1427,7 @@ function listCodexSessions(limit) {
       return;
     }
     for (const entry2 of entries) {
-      const full = join7(dir, entry2.name);
+      const full = join6(dir, entry2.name);
       if (entry2.isDirectory()) {
         walk(full);
         continue;
@@ -2074,7 +1514,7 @@ async function mintTrace(base, harness2) {
 function loadSummaryFile(summaryPath) {
   let raw;
   try {
-    raw = readFileSync8(summaryPath, "utf8");
+    raw = readFileSync6(summaryPath, "utf8");
   } catch {
     throw new Error(`Cannot read summary file: ${summaryPath}`);
   }
@@ -2117,7 +1557,7 @@ function prepareImport(session2, summaryPath, options = {}) {
   for (const path of session2.files) {
     const stat = statSync5(path);
     if (!stat.isFile() || (inputBytes += stat.size) > maximum) throw new Error("Selected transcript exceeds the 16 MiB limit or is not a regular file.");
-    const text = readFileSync8(path, "utf8");
+    const text = readFileSync6(path, "utf8");
     for (const raw of text.split("\n")) {
       if (!raw.trim()) continue;
       let record;
@@ -2190,92 +1630,735 @@ function prepareImport(session2, summaryPath, options = {}) {
     };
     summaryJson = JSON.stringify(summary);
   }
-  const body = lines.join("") + files2.lines.join("") + JSON.stringify({ type: "import.summary", package: JSON.parse(summaryJson) }) + "\n" + JSON.stringify({ type: "import.end", records: lines.length + files2.lines.length + 1 }) + "\n";
-  const gaps = [];
-  if (encryptedReasoningCount > 0) gaps.push({ kind: "encrypted_reasoning", count: encryptedReasoningCount });
-  if (compactionCount > 0) gaps.push({ kind: "compaction", count: compactionCount });
-  if (unreadableCount > 0) gaps.push({ kind: "unreadable", count: unreadableCount });
-  const cwd = meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : "");
-  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps, attachedFiles: files2.attached, leftOutFiles: files2.leftOut, setup: files2.setup, cwd, resourceLines: files2.lines };
-}
-async function importSession(opts) {
-  const base = (opts.agentUseUrl ?? agentUseBase()).replace(/\/$/, "");
-  const destination2 = new URL(base);
-  if (destination2.username || destination2.password || destination2.protocol !== "https:" && !(destination2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(destination2.hostname))) {
-    throw new Error("Import requires HTTPS, or a loopback development server.");
+  const body = lines.join("") + files2.lines.join("") + JSON.stringify({ type: "import.summary", package: JSON.parse(summaryJson) }) + "\n" + JSON.stringify({ type: "import.end", records: lines.length + files2.lines.length + 1 }) + "\n";
+  const gaps = [];
+  if (encryptedReasoningCount > 0) gaps.push({ kind: "encrypted_reasoning", count: encryptedReasoningCount });
+  if (compactionCount > 0) gaps.push({ kind: "compaction", count: compactionCount });
+  if (unreadableCount > 0) gaps.push({ kind: "unreadable", count: unreadableCount });
+  const cwd = meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : "");
+  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps, attachedFiles: files2.attached, leftOutFiles: files2.leftOut, setup: files2.setup, cwd, resourceLines: files2.lines };
+}
+async function importSession(opts) {
+  const base = (opts.agentUseUrl ?? agentUseBase()).replace(/\/$/, "");
+  const destination2 = new URL(base);
+  if (destination2.username || destination2.password || destination2.protocol !== "https:" && !(destination2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(destination2.hostname))) {
+    throw new Error("Import requires HTTPS, or a loopback development server.");
+  }
+  opts.onProgress?.("Reading transcript and redacting secrets locally\u2026");
+  const { body, transcriptLines, outputBytes, redactionCount, gaps, attachedFiles, leftOutFiles, setup, cwd, resourceLines } = prepareImport(opts.session, opts.summaryPath, { files: opts.files });
+  let traceId;
+  let key;
+  if (opts.importKey && opts.grantTraceId) {
+    traceId = opts.grantTraceId;
+    key = opts.importKey;
+  } else {
+    opts.onProgress?.("Minting import key\u2026");
+    ({ traceId, key } = await mintTrace(base, opts.session.harness));
+  }
+  opts.onProgress?.("Uploading the complete transcript\u2026");
+  const response = await fetch(`${base}/api/traces/ingest`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(12e4),
+    headers: { authorization: `Bearer ${key}`, "content-type": "application/x-ndjson", "x-source-harness": opts.session.harness, "user-agent": USER_AGENT },
+    body
+  });
+  if (!response.ok) {
+    const result2 = await response.json().catch(() => null);
+    throw new Error(typeof result2?.error === "string" ? result2.error : result2?.error?.message ?? `Upload failed (${response.status}).`);
+  }
+  const result = await response.json();
+  const finalTraceId = result.traceId ?? traceId;
+  const environment = opts.files === false || opts.environment === false || !cwd || !existsSync4(cwd) ? null : await uploadEnvironment(base, key, finalTraceId, cwd, resourceLines, opts.onProgress).catch((error) => ({ error: error instanceof Error ? error.message : String(error) }));
+  return {
+    traceId: finalTraceId,
+    url: `${base}/playground/new?import=${encodeURIComponent(finalTraceId)}`,
+    harness: opts.session.harness,
+    sessionId: opts.session.sessionId,
+    transcriptFiles: opts.session.files.length,
+    bytes: outputBytes,
+    redactionCount,
+    gaps,
+    attachedFiles,
+    leftOutFiles,
+    setup,
+    environment
+  };
+}
+async function grantCall(base, key, path, body) {
+  const response = await fetch(`${base}${path}`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(3e5),
+    headers: { authorization: `Bearer ${key}`, "content-type": "application/json", "user-agent": USER_AGENT },
+    body: JSON.stringify(body)
+  });
+  const answer = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(typeof answer?.error === "string" ? answer.error : answer?.error?.message ?? `The environment upload failed (${response.status}).`);
+  return answer;
+}
+async function uploadEnvironment(base, key, traceId, cwd, resourceLines, onProgress) {
+  onProgress?.("Packing the working folder (secrets redacted locally)\u2026");
+  const packed = await packEnvironment(cwd, resourcesOf(resourceLines));
+  try {
+    const path = `/api/traces/${encodeURIComponent(traceId)}/environment`;
+    const { upload } = await grantCall(base, key, path, { name: packed.folder, size: packed.bytes, sha256: packed.sha256, files: packed.files });
+    let shown = -1;
+    await transfer(upload, packed.path, (sent, total) => {
+      const percent = Math.floor(sent / total * 100);
+      if (percent >= shown + 10 || sent === total) {
+        shown = percent;
+        onProgress?.(`Uploading the working folder\u2026 ${percent}% of ${(total / 1024 / 1024).toFixed(1)} MiB`);
+      }
+    });
+    await grantCall(base, key, `${path}/complete`, {});
+    return { folder: packed.folder, files: packed.files, bytes: packed.bytes, redacted: packed.redacted, leftOut: packed.leftOut.length };
+  } finally {
+    packed.dispose();
+  }
+}
+
+// src/context.ts
+async function contextRequest(path, universe2) {
+  try {
+    return await api("GET", `/api${path}`, void 0, { base: agentUseBase(), universe: universe2 });
+  } catch (error) {
+    if (!(error instanceof ApiError) || ![401, 403, 409].includes(error.status)) throw error;
+    return api("GET", path, void 0, { universe: universe2 });
+  }
+}
+async function searchContext(query, opts, universe2) {
+  const page = await contextRequest(`/context/search${searchQuery(query, opts)}`, universe2);
+  return { ...page, hits: page.hits.map((entry2) => "hit" in entry2 ? entry2.hit : entry2) };
+}
+function memoryBody(operation, version) {
+  return { ...operation, expectedVersion: version };
+}
+function memoryIndex(value) {
+  if (!/^\d+$/.test(value.trim())) throw new Error(`the entry number must be a whole number, got ${JSON.stringify(value)}`);
+  return Number(value.trim());
+}
+function renderMemory(document) {
+  if (!document.entries.length) return "no saved memory \u2014 `sky memory save <text>` adds an entry";
+  return document.entries.map((entry2) => `${String(entry2.index).padStart(3)}  ${entry2.text}`).join("\n");
+}
+function searchQuery(query, opts) {
+  const params = new URLSearchParams({ q: query });
+  params.set("scope", opts.scope ?? "everything");
+  if (opts.limit) params.set("limit", opts.limit);
+  if (opts.cursor) params.set("cursor", opts.cursor);
+  if (opts.since) params.set("since", opts.since);
+  if (opts.until) params.set("until", opts.until);
+  return `?${params.toString()}`;
+}
+function refArgument(ref) {
+  return `'${JSON.stringify(ref).replace(/'/g, "'\\''")}'`;
+}
+function renderContextPage(page) {
+  const lines = [];
+  for (const hit of page.hits) {
+    lines.push(`${hit.path ?? hit.title}${hit.line ? `:${hit.line}` : ""}: ${hit.snippet.replace(/\s+/g, " ").slice(0, 160)}`);
+    lines.push(`    sky context read ${refArgument(hit.ref)}`);
+  }
+  if (!page.hits.length) lines.push("no matches on this page");
+  const missed = (page.sources ?? []).filter((source) => source.status === "failed" || source.status === "partial").map((source) => source.source);
+  if (page.partial) lines.push(`partial: ${missed.length ? `${missed.join(", ")} not fully searched` : "not every source was searched"}`);
+  if (page.nextCursor) lines.push(`more: --cursor ${page.nextCursor}`);
+  return lines.join("\n");
+}
+
+// src/agent-file.ts
+import { existsSync as existsSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname4, resolve as resolve3 } from "path";
+import { parse as parseToml2 } from "smol-toml";
+var fileInstructionSchema = external_exports.object({
+  name: external_exports.string(),
+  content: external_exports.string().optional(),
+  file: external_exports.string().optional()
+});
+var agentFileSchema = external_exports.object({
+  name: external_exports.string().min(1),
+  id: external_exports.string().optional(),
+  // stamped by launch/deploy; identifies the live agent
+  slug: external_exports.string().optional(),
+  // pre-RFC-0079 stamp; ignored (agents are id-addressed)
+  description: external_exports.string().optional(),
+  type: external_exports.enum(AGENT_TYPES).optional(),
+  llm: external_exports.string().optional(),
+  reasoning_effort: external_exports.enum(REASONING_EFFORT_VALUES).optional(),
+  capabilities: capabilitiesSchema.removeDefault().optional(),
+  // omitted = leave the agent's as they are
+  prompt: external_exports.string().optional(),
+  prompt_file: external_exports.string().optional(),
+  instructions: external_exports.array(fileInstructionSchema).optional(),
+  skills: external_exports.array(skillRefSchema).optional(),
+  customData: external_exports.array(customDataSchema).optional(),
+  /** "deny" makes the agent work alone: its sessions may not hire helpers. */
+  hiring_policy: external_exports.enum(["allow", "deny"]).optional(),
+  /** The environment its sessions boot in when they name none. */
+  environment: external_exports.string().min(1).optional(),
+  /** Advanced machine shape (create-only): 1|2|4|8 vCPUs, 256MB-step memory. */
+  vcpus: external_exports.number().int().optional(),
+  memory_mb: external_exports.number().int().optional()
+});
+function readAgentFile(path) {
+  const raw = readFileSync7(path, "utf8");
+  const parsed = agentFileSchema.safeParse(parseToml2(raw));
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    throw new Error(`${path}: ${issue?.path.join(".") ?? ""} ${issue?.message ?? "invalid"}`);
+  }
+  const file = parsed.data;
+  if (file.reasoning_effort && file.type && !isModelEffortSupported(file.type, file.llm ?? defaultLlm(file.type), file.reasoning_effort)) {
+    throw new Error(
+      `${path}: reasoning_effort '${file.reasoning_effort}' is not available for ${file.type} \u2014 ${reasoningEffortDocLine()}`
+    );
+  }
+  const base = dirname4(resolve3(path));
+  const inline = (ref, inlineContent) => {
+    if (inlineContent !== void 0) return inlineContent;
+    if (!ref) return void 0;
+    return readFileSync7(resolve3(base, ref), "utf8");
+  };
+  const spec = {
+    name: file.name,
+    description: file.description,
+    agentType: file.type,
+    llm: file.llm,
+    reasoningEffort: file.reasoning_effort,
+    displayName: file.name,
+    capabilities: file.capabilities,
+    prompt: inline(file.prompt_file, file.prompt),
+    instructions: file.instructions?.map((f) => {
+      const content = inline(f.file, f.content);
+      if (content === void 0) throw new Error(`instruction ${f.name}: content or file required`);
+      return { name: f.name, content };
+    }),
+    skills: file.skills,
+    customData: file.customData,
+    hiringPolicy: file.hiring_policy,
+    environmentId: file.environment,
+    vcpus: file.vcpus,
+    memoryMb: file.memory_mb
+  };
+  return { file, spec };
+}
+function stampId(path, id) {
+  writeFileSync2(path, stampIdText(readFileSync7(path, "utf8"), id));
+}
+function stampIdText(text, id) {
+  const out = [];
+  let topLevel = true;
+  let openString = null;
+  let stamped = false;
+  let nameAt = -1;
+  for (const line of text.split("\n")) {
+    if (openString) {
+      if (line.includes(openString)) openString = null;
+      out.push(line);
+      continue;
+    }
+    if (/^\s*\[/.test(line)) topLevel = false;
+    if (topLevel && /^\s*(id|slug)\s*=/.test(line)) {
+      if (/^\s*id\s*=/.test(line) && !stamped) {
+        out.push(`id = ${JSON.stringify(id)}`);
+        stamped = true;
+      }
+      continue;
+    }
+    if (topLevel && nameAt < 0 && /^\s*name\s*=/.test(line)) nameAt = out.length;
+    const opener = /=\s*("""|''')/.exec(line);
+    if (opener && !line.slice(opener.index + opener[0].length).includes(opener[1])) openString = opener[1];
+    out.push(line);
+  }
+  if (!stamped) out.splice(nameAt + 1, 0, `id = ${JSON.stringify(id)}`);
+  const next = out.join("\n");
+  if (parseToml2(next).id !== id) throw new Error("could not stamp the agent id into the file");
+  return next;
+}
+function scaffoldAgentFile(path, name) {
+  if (existsSync5(path)) throw new Error(`${path} already exists`);
+  writeFileSync2(
+    path,
+    `# agent.toml \u2014 everything the create wizard can set. Only \`name\` is required.
+name = "${name}"
+# type = "pi"                  # pi (default) | hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode
+# llm = "deepseek-flash"       # must be compatible with type
+# reasoning_effort = "high"    # per harness \u2014 ${reasoningEffortDocLine()}
+# capabilities = []
+# hiring_policy = "deny"       # its sessions work alone; "allow" (default) lets them hire helpers
+# environment = "env_..."      # the environment its sessions boot in when they name none
+# [[skills]]                   # a skill from \`sky skills upload <dir>\`
+# type = "skill"
+# skillId = "skill_..."
+
+prompt = """
+You are ${name}, a helpful long-lived agent.
+"""
+`
+  );
+}
+function deployPatch(spec) {
+  return {
+    displayName: spec.displayName,
+    ...spec.agentType ? { agentType: spec.agentType } : {},
+    ...spec.llm ? { llm: spec.llm } : {},
+    ...spec.capabilities ? { capabilities: spec.capabilities } : {},
+    ...spec.reasoningEffort ? { reasoningEffort: spec.reasoningEffort } : {},
+    ...spec.skills ? { skills: spec.skills } : {},
+    ...spec.hiringPolicy ? { hiringPolicy: spec.hiringPolicy } : {},
+    ...spec.environmentId ? { environmentId: spec.environmentId } : {}
+  };
+}
+function deployReport(id, spec, before, after, promptChanged) {
+  if (spec.agentType && after.agentType !== spec.agentType) {
+    throw new Error(`${id} is still ${after.agentType}: the API did not apply type = "${spec.agentType}"`);
+  }
+  if (spec.llm && after.llm !== spec.llm) {
+    throw new Error(`${id} still runs ${after.llm}: the API did not apply llm = "${spec.llm}"`);
+  }
+  const changed = [];
+  if (promptChanged) changed.push("prompt");
+  if (after.version !== before.version) changed.push("settings");
+  if (!changed.length) return [`${id} is up to date \u2014 nothing to deploy (version ${after.version})`];
+  const lines = [`Deployed ${id}: ${changed.join(" and ")} updated (version ${before.version} \u2192 ${after.version})`];
+  if (after.agentType !== before.agentType || after.llm !== before.llm) {
+    lines.push(`  now ${after.agentType} \xB7 ${after.llm} for new sessions (was ${before.agentType} \xB7 ${before.llm})`);
+  }
+  if (spec.skills && after.version !== before.version) {
+    lines.push(`  Skills apply to new sessions; running sessions keep the skills they started with \u2014 start one with \`sky session create ${id}\`.`);
+  }
+  return lines;
+}
+
+// src/catalog.ts
+var bare = (handle) => handle.replace(/^@/, "");
+var optionalAuth = () => ({ auth: Boolean(apiToken()) });
+function catalogQuery(filter) {
+  const params = new URLSearchParams();
+  if (filter.text?.trim()) params.set("q", filter.text.trim());
+  if (filter.category) params.set("category", filter.category);
+  const query = params.toString();
+  return query ? `?${query}` : "";
+}
+function listingBody(agentId, options) {
+  return {
+    agent_id: agentId,
+    handle: bare(options.handle),
+    tagline: options.tagline,
+    ...options.description ? { description: options.description } : {},
+    ...options.category?.length ? { categories: options.category } : {},
+    ...options.does?.length ? { does: options.does } : {},
+    ...options.doesNot?.length ? { does_not: options.doesNot } : {},
+    ...options.example?.length ? { examples: options.example } : {}
+  };
+}
+async function listCatalog(filter = {}) {
+  return (await api("GET", `/catalog/agents${catalogQuery(filter)}`, void 0, optionalAuth())).agents;
+}
+async function showCatalogAgent(handle) {
+  return (await api("GET", `/catalog/agents/${encodeURIComponent(bare(handle))}`, void 0, optionalAuth())).agent;
+}
+async function listCategories() {
+  return (await api("GET", "/catalog/categories", void 0, { auth: false })).categories;
+}
+async function publishListing(agentId, options) {
+  return (await api("POST", "/catalog/listings", listingBody(agentId, options))).agent;
+}
+async function removeListing(handle) {
+  await api("DELETE", `/catalog/listings/${encodeURIComponent(bare(handle))}`);
+}
+async function setEngineStatus(engine, status, reason) {
+  await api("PATCH", `/catalog/engines/${encodeURIComponent(engine)}`, { status, reason });
+  const state = await api("GET", "/catalog/engines", void 0, { auth: false });
+  if (state.delisted.includes(engine) !== (status === "delisted")) {
+    throw new Error("The catalog does not show the requested state; check whether another operator changed it.");
+  }
+}
+var uses = (agent2) => `${agent2.stats.uses} ${agent2.stats.uses === 1 ? "use" : "uses"}`;
+var mine = (agent2) => agent2.visibility === "workspace" ? "  (yours)" : "";
+function renderCatalogAgent(agent2) {
+  const section = (title, lines) => lines.length ? [`${title}:`, ...lines.map((line) => `  - ${line}`)] : [];
+  return [
+    `@${agent2.handle}  ${agent2.name}${mine(agent2)}`,
+    agent2.tagline,
+    ...agent2.description && agent2.description !== agent2.tagline ? ["", agent2.description] : [],
+    "",
+    `Categories: ${agent2.categories.join(", ") || "none"}`,
+    `Used: ${uses(agent2)}`,
+    ...section("Does", agent2.does),
+    ...section("Does not", agent2.does_not),
+    ...section("Examples", agent2.examples),
+    "",
+    `Hire it: sky session create @${agent2.handle} --message "\u2026"`
+  ].join("\n");
+}
+
+// src/clone.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { basename as basename5, join as join7 } from "path";
+import { createInterface } from "readline";
+var PROMPT_CAP = 1e5;
+var HARNESSES = ["claude_code", "codex", "openclaw"];
+function claudeConfigRoot() {
+  return process.env.CLAUDE_CONFIG_DIR ?? join7(homedir4(), ".claude");
+}
+function readIfExists(path) {
+  try {
+    return readFileSync8(path, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function readJson2(path) {
+  const raw = readIfExists(path);
+  if (raw === void 0) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+}
+function claudeModel(configRoot) {
+  const candidates = [
+    join7(process.cwd(), ".claude", "settings.local.json"),
+    join7(process.cwd(), ".claude", "settings.json"),
+    join7(configRoot, "settings.json")
+  ];
+  for (const path of candidates) {
+    const model = readJson2(path)?.model;
+    if (typeof model === "string" && model.trim()) return model.trim();
+  }
+  return void 0;
+}
+function claudeMcpServers() {
+  const merged = {};
+  const userConfig = readJson2(join7(homedir4(), ".claude.json"));
+  Object.assign(merged, userConfig?.mcpServers ?? {});
+  Object.assign(merged, userConfig?.projects?.[process.cwd()]?.mcpServers ?? {});
+  const projectConfig = readJson2(
+    join7(process.cwd(), ".mcp.json")
+  );
+  Object.assign(merged, projectConfig?.mcpServers ?? {});
+  return merged;
+}
+function assemblePrompt(parts) {
+  const joined = parts.map((p) => `# \u2500\u2500 ${p.label} \u2500\u2500
+
+${p.content.trim()}`).join("\n\n").trim();
+  if (joined.length <= PROMPT_CAP) return { prompt: joined, truncated: false };
+  const notice = "\n\n[truncated by sky clone: local instructions exceeded the 100k prompt cap]";
+  return { prompt: joined.slice(0, PROMPT_CAP - notice.length) + notice, truncated: true };
+}
+function readClaudeCode() {
+  const configRoot = claudeConfigRoot();
+  const parts = [];
+  const sources = [];
+  const global = readIfExists(join7(configRoot, "CLAUDE.md"));
+  if (global?.trim()) {
+    parts.push({ label: "Global CLAUDE.md", content: global });
+    sources.push("global CLAUDE.md");
+  }
+  for (const name of ["CLAUDE.md", "AGENTS.md"]) {
+    const project2 = readIfExists(join7(process.cwd(), name));
+    if (project2?.trim()) {
+      parts.push({ label: `Project ${name}`, content: project2 });
+      sources.push(`project ${name}`);
+      break;
+    }
+  }
+  const { prompt, truncated } = assemblePrompt(parts);
+  const allServers = claudeMcpServers();
+  const { kept, dropped } = splitMcpServers(allServers);
+  const secretCandidates = [];
+  for (const d of dropped) {
+    const def = allServers[d.name];
+    if (!def?.env) continue;
+    for (const key of d.envKeys) {
+      const value = def.env[key];
+      if (value !== void 0 && value.trim()) {
+        secretCandidates.push({ serverName: d.name, envKey: key, value, url: d.url });
+      }
+    }
+  }
+  return {
+    harness: "claude_code",
+    configRoot,
+    prompt,
+    promptSources: sources,
+    truncated,
+    model: claudeModel(configRoot),
+    keptServers: kept,
+    droppedServers: dropped,
+    secretCandidates
+  };
+}
+function detectHarness(explicit) {
+  if (explicit) {
+    if (!HARNESSES.includes(explicit)) {
+      throw new Error(`unknown harness ${explicit} \u2014 expected ${HARNESSES.join(" | ")}`);
+    }
+    return explicit;
+  }
+  if (existsSync6(claudeConfigRoot())) return "claude_code";
+  if (existsSync6(join7(homedir4(), ".codex"))) return "codex";
+  if (existsSync6(join7(homedir4(), ".openclaw"))) return "openclaw";
+  throw new Error(
+    "no local harness found (~/.claude, ~/.codex, ~/.openclaw) \u2014 pass --harness to override"
+  );
+}
+function readLocal(harness2) {
+  if (harness2 === "claude_code") return readClaudeCode();
+  throw new Error(
+    `${harness2} cloning lands next \u2014 claude_code is the first supported harness`
+  );
+}
+function linkPath(configRoot) {
+  return join7(configRoot, "agentsky-link.json");
+}
+function readLink(configRoot) {
+  const link2 = readJson2(linkPath(configRoot));
+  return link2?.agentId ? link2 : void 0;
+}
+function writeLink(configRoot, link2) {
+  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link2, null, 2)}
+`);
+}
+var DEFAULT_VAULT_NAME = "default";
+async function fetchDefaultVaultId() {
+  const { vaults } = await api(
+    "GET",
+    "/vaults"
+  );
+  return vaults.find((v) => v.display_name === DEFAULT_VAULT_NAME)?.id ?? null;
+}
+async function ensureDefaultVaultId() {
+  const existing = await fetchDefaultVaultId();
+  if (existing) return existing;
+  try {
+    const { vault: vault2 } = await api("POST", "/vaults", {
+      display_name: DEFAULT_VAULT_NAME
+    });
+    return vault2.id;
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 409) {
+      const raced = await fetchDefaultVaultId();
+      if (raced) return raced;
+    }
+    throw error;
+  }
+}
+async function confirmAndVaultSecrets(candidates, yes) {
+  if (!candidates.length) return;
+  if (yes) {
+    console.log(
+      `  ${candidates.length} secret${candidates.length === 1 ? "" : "s"} from dropped MCP servers not saved (--yes skips vault confirmation).`
+    );
+    return;
+  }
+  console.log("\nSecret-bearing MCP servers were left out of the clone payload.");
+  console.log("You can save their keys to your workspace vault now (values are sent encrypted, never displayed).\n");
+  let vaultId;
+  let saved = 0;
+  let skipped = 0;
+  for (const c of candidates) {
+    const chosen = await confirm(`  Add ${c.envKey} (from ${c.serverName}) to your default vault?`);
+    if (!chosen) {
+      console.log(`  \u2014 skipped ${c.envKey}`);
+      skipped += 1;
+      continue;
+    }
+    try {
+      vaultId ??= await ensureDefaultVaultId();
+      await api("POST", `/vaults/${encodeURIComponent(vaultId)}/secrets`, {
+        display_name: `${c.envKey} (${c.serverName})`,
+        auth: {
+          type: "environment_variable",
+          secret_name: c.envKey,
+          value: c.value,
+          allowed_hosts: c.url ? [c.url] : []
+        }
+      });
+      console.log(`  \u2713 saved ${c.envKey}`);
+      saved += 1;
+    } catch (error) {
+      if (error instanceof ApiError && error.status === 409) {
+        console.log(`  \u2014 ${c.envKey} already in vault`);
+      } else {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.log(`  \u2717 ${c.envKey} failed: ${msg}`);
+      }
+    }
+  }
+  if (saved || skipped) {
+    console.log(
+      `
+Vault: ${saved} saved, ${skipped} skipped. Attach the "default" vault to a session to use these keys.`
+    );
+  }
+}
+function confirm(question) {
+  return new Promise((done) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(`${question} [Y/n] `, (answer) => {
+      rl.close();
+      done(/^(y(es)?)?$/i.test(answer.trim()));
+    });
+  });
+}
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  try {
+    spawn(cmd, [url], { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+function kb(text) {
+  return `${Math.max(1, Math.round(text.length / 1024))} KB`;
+}
+async function createClone(local, opts) {
+  const keptNames = Object.keys(local.keptServers);
+  const summary = [
+    local.promptSources.length ? `${local.promptSources.join(" + ")} (${kb(local.prompt)})` : "no instructions found",
+    `model ${local.model ?? "(harness default)"}`,
+    `${keptNames.length} MCP server${keptNames.length === 1 ? "" : "s"}${keptNames.length ? ` (${keptNames.join(", ")})` : ""}`
+  ].join(" \xB7 ");
+  console.log(`Detected ${local.harness} at ${local.configRoot} (project ${basename5(process.cwd())})`);
+  console.log(`Will clone: ${summary}`);
+  if (local.truncated) console.log("  note: instructions exceeded 100k chars and were truncated");
+  if (local.droppedServers.length) {
+    console.log(
+      `Left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
+    );
+  }
+  if (opts.dryRun) {
+    console.log("Dry run \u2014 nothing sent.");
+    return;
+  }
+  if (!opts.yes && !await confirm("Launch this as a new cloud agent?")) {
+    console.log("Aborted \u2014 nothing sent.");
+    return;
+  }
+  const { servers: mcpServers2, skipped } = mcpServersFromKept(local.keptServers);
+  if (skipped.length) {
+    console.log(`  note: local (stdio) MCP servers have no cloud equivalent and were skipped: ${skipped.join(", ")}`);
+  }
+  const body = {
+    agentType: local.harness,
+    ...local.model ? { llm: local.model } : {},
+    ...local.prompt ? { prompt: local.prompt } : {},
+    ...mcpServers2.length ? { mcpServers: mcpServers2 } : {}
+  };
+  let sentLlm = local.model ?? null;
+  let created;
+  try {
+    ({ agent: created } = await api("POST", "/agents", body));
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 422 && local.model) {
+      const successor = supersededBy(local.model);
+      console.log(
+        successor ? `  note: ${local.model} is superseded \u2014 using ${successor}` : `  note: ${local.model} isn't available for ${local.harness} \u2014 using the harness default`
+      );
+      sentLlm = successor;
+      ({ agent: created } = await api("POST", "/agents", {
+        ...body,
+        llm: successor ?? void 0
+      }));
+    } else {
+      throw error;
+    }
+  }
+  console.log("Starting its runtime\u2026");
+  await api("POST", "/sessions", { agent: created.id });
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  writeLink(local.configRoot, {
+    baseUrl: apiBase(),
+    agentId: created.id,
+    clonedAt: now,
+    lastSyncedAt: now,
+    llm: sentLlm,
+    mcpServers: keptNames
+  });
+  const url = `${apiBase()}/agents/${created.id}`;
+  console.log(`Cloned \u2192 ${created.id}  ${url}`);
+  console.log(
+    `Linked this machine (${linkPath(local.configRoot)}). Push prompt changes anytime by running \`sky clone\` again.`
+  );
+  await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
+  if (opts.open) openBrowser(url);
+}
+async function syncClone(local, link2, opts) {
+  const since = link2.lastSyncedAt ?? link2.clonedAt;
+  console.log(
+    `Syncing ${link2.agentId} from ${local.configRoot} (last synced ${since ? new Date(since).toLocaleDateString() : "never"})`
+  );
+  if (opts.dryRun) {
+    console.log(
+      `  would push prompt (${kb(local.prompt)}) to ${link2.agentId}. Dry run \u2014 nothing sent.`
+    );
+    return;
+  }
+  let agent2;
+  try {
+    ({ agent: agent2 } = await api(
+      "GET",
+      `/agents/${encodeURIComponent(link2.agentId)}`
+    ));
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 404) {
+      throw new Error(
+        `linked agent ${link2.agentId} no longer exists \u2014 run \`sky clone --new\` to launch a fresh one`
+      );
+    }
+    throw error;
+  }
+  if (agent2.agentType !== local.harness) {
+    throw new Error(
+      `linked agent ${link2.agentId} is ${agent2.agentType}, this machine runs ${local.harness} \u2014 run \`sky clone --new\` to launch a fresh agent`
+    );
   }
-  opts.onProgress?.("Reading transcript and redacting secrets locally\u2026");
-  const { body, transcriptLines, outputBytes, redactionCount, gaps, attachedFiles, leftOutFiles, setup, cwd, resourceLines } = prepareImport(opts.session, opts.summaryPath, { files: opts.files });
-  let traceId;
-  let key;
-  if (opts.importKey && opts.grantTraceId) {
-    traceId = opts.grantTraceId;
-    key = opts.importKey;
-  } else {
-    opts.onProgress?.("Minting import key\u2026");
-    ({ traceId, key } = await mintTrace(base, opts.session.harness));
+  const result = await api(
+    "PUT",
+    `/agents/${encodeURIComponent(link2.agentId)}/prompt`,
+    { prompt: local.prompt }
+  );
+  console.log(
+    result.unchanged ? "  prompt   unchanged" : `  prompt   updated (v${result.version}${result.applied === "live" ? ", hot-reloaded" : ", applies on next boot"})`
+  );
+  const drift = [];
+  const localModel = local.model ?? null;
+  const linkedModel = link2.llm ?? agent2.llm;
+  if (localModel && linkedModel && localModel !== linkedModel) {
+    drift.push(`model changed ${linkedModel} \u2192 ${localModel}`);
   }
-  opts.onProgress?.("Uploading the complete transcript\u2026");
-  const response = await fetch(`${base}/api/traces/ingest`, {
-    method: "POST",
-    redirect: "error",
-    signal: AbortSignal.timeout(12e4),
-    headers: { authorization: `Bearer ${key}`, "content-type": "application/x-ndjson", "x-source-harness": opts.session.harness, "user-agent": USER_AGENT },
-    body
-  });
-  if (!response.ok) {
-    const result2 = await response.json().catch(() => null);
-    throw new Error(typeof result2?.error === "string" ? result2.error : result2?.error?.message ?? `Upload failed (${response.status}).`);
+  const before = new Set(link2.mcpServers ?? []);
+  const nowKept = Object.keys(local.keptServers);
+  const newServers = nowKept.filter((n) => !before.has(n));
+  const goneServers = [...before].filter((n) => !nowKept.includes(n));
+  if (newServers.length) drift.push(`${newServers.length} new MCP server${newServers.length === 1 ? "" : "s"} (${newServers.join(", ")})`);
+  if (goneServers.length) drift.push(`${goneServers.length} removed MCP server${goneServers.length === 1 ? "" : "s"} (${goneServers.join(", ")})`);
+  if (drift.length) {
+    console.log(`  skipped (set at launch): ${drift.join("; ")}`);
+    console.log("    \u2192 a running agent can't change these; run `sky clone --new` to launch a fresh agent.");
   }
-  const result = await response.json();
-  const finalTraceId = result.traceId ?? traceId;
-  const environment = opts.files === false || opts.environment === false || !cwd || !existsSync5(cwd) ? null : await uploadEnvironment(base, key, finalTraceId, cwd, resourceLines, opts.onProgress).catch((error) => ({ error: error instanceof Error ? error.message : String(error) }));
-  return {
-    traceId: finalTraceId,
-    url: `${base}/playground/new?import=${encodeURIComponent(finalTraceId)}`,
-    harness: opts.session.harness,
-    sessionId: opts.session.sessionId,
-    transcriptFiles: opts.session.files.length,
-    bytes: outputBytes,
-    redactionCount,
-    gaps,
-    attachedFiles,
-    leftOutFiles,
-    setup,
-    environment
-  };
-}
-async function grantCall(base, key, path, body) {
-  const response = await fetch(`${base}${path}`, {
-    method: "POST",
-    redirect: "error",
-    signal: AbortSignal.timeout(3e5),
-    headers: { authorization: `Bearer ${key}`, "content-type": "application/json", "user-agent": USER_AGENT },
-    body: JSON.stringify(body)
-  });
-  const answer = await response.json().catch(() => null);
-  if (!response.ok) throw new Error(typeof answer?.error === "string" ? answer.error : answer?.error?.message ?? `The environment upload failed (${response.status}).`);
-  return answer;
-}
-async function uploadEnvironment(base, key, traceId, cwd, resourceLines, onProgress) {
-  onProgress?.("Packing the working folder (secrets redacted locally)\u2026");
-  const packed = await packEnvironment(cwd, resourcesOf(resourceLines));
-  try {
-    const path = `/api/traces/${encodeURIComponent(traceId)}/environment`;
-    const { upload } = await grantCall(base, key, path, { name: packed.folder, size: packed.bytes, sha256: packed.sha256, files: packed.files });
-    let shown = -1;
-    await transfer(upload, packed.path, (sent, total) => {
-      const percent = Math.floor(sent / total * 100);
-      if (percent >= shown + 10 || sent === total) {
-        shown = percent;
-        onProgress?.(`Uploading the working folder\u2026 ${percent}% of ${(total / 1024 / 1024).toFixed(1)} MiB`);
-      }
-    });
-    await grantCall(base, key, `${path}/complete`, {});
-    return { folder: packed.folder, files: packed.files, bytes: packed.bytes, redacted: packed.redacted, leftOut: packed.leftOut.length };
-  } finally {
-    packed.dispose();
+  if (local.droppedServers.length) {
+    console.log(
+      `  left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
+    );
   }
+  writeLink(local.configRoot, { ...link2, lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  console.log(`Synced ${link2.agentId}.`);
+  await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
+  if (opts.open) openBrowser(`${apiBase()}/agents/${link2.agentId}`);
+}
+async function clone(opts) {
+  const harness2 = detectHarness(opts.harness);
+  const local = readLocal(harness2);
+  const link2 = opts.new ? void 0 : readLink(local.configRoot);
+  if (link2) await syncClone(local, link2, opts);
+  else await createClone(local, opts);
 }
 
 // src/channels.ts
@@ -2342,7 +2425,7 @@ import { hostname } from "os";
 import { spawn as spawn2 } from "child_process";
 
 // src/mcp-register.ts
-import { existsSync as existsSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
 import { spawnSync as spawnSync3 } from "child_process";
 import { homedir as homedir6 } from "os";
 import { join as join10 } from "path";
@@ -2350,7 +2433,7 @@ import { parse as parseToml3 } from "smol-toml";
 import { isMap, parseDocument } from "yaml";
 
 // src/local-agents.ts
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join8 } from "path";
 function localAgents(env = process.env, home = homedir5()) {
@@ -2364,7 +2447,7 @@ function localAgents(env = process.env, home = homedir5()) {
   ];
 }
 function detectLocalAgents(env = process.env, home = homedir5()) {
-  return localAgents(env, home).filter((agent2) => existsSync6(agent2.root));
+  return localAgents(env, home).filter((agent2) => existsSync7(agent2.root));
 }
 function selectLocalAgents(ids, env = process.env, home = homedir5()) {
   if (!ids?.length) return detectLocalAgents(env, home);
@@ -2487,6 +2570,12 @@ Details: \`${REFERENCES_DIR}/workspaces.md\` in this skill's folder.
   cheaper or different agent to get around a refusal.
 - \`get_usage\` shows the balance; check it before starting several cloud sessions
   at once so the person is told once, up front, instead of after the first fails.
+- Anything else the person can do on agentsky.dev or in the Mac app (rename or
+  archive a thread, edit a Library file or skill, change an agent's model, invite
+  a member, \u2026) is an API operation: find it with \`search_api\`, read its
+  parameters with \`describe_api\`, and run it with \`call_api\`. It acts as the
+  person with their own key, so make only the change they asked for. Where MCP
+  is missing, \`sky api search <words>\` and \`sky api <METHOD> <path>\` do the same.
 
 ## How to pick
 
@@ -2874,7 +2963,7 @@ function installSkill(agent2, opts = {}) {
 var MCP_SERVER_NAME = SKILL_NAME;
 function detectHermes(env = process.env, home = homedir6()) {
   const root = env.HERMES_HOME || join10(home, ".hermes");
-  return existsSync7(root) ? { id: "hermes", name: "Hermes", root } : null;
+  return existsSync8(root) ? { id: "hermes", name: "Hermes", root } : null;
 }
 function detectMcpClients(env = process.env, home = homedir6()) {
   const hermes = detectHermes(env, home);
@@ -3034,7 +3123,7 @@ function refreshMcpRegistrations(opts, clients = detectMcpClients(), runner = sy
 }
 
 // src/shell-env.ts
-import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { appendFileSync, existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir7 } from "os";
 import { basename as basename6, dirname as dirname5, join as join11 } from "path";
 var TOKEN_ENV = "AGENTSKY_API_KEY";
@@ -3050,13 +3139,13 @@ function shellStartupFiles(env = process.env, home = homedir7(), platform = proc
   const shell = basename6(env.SHELL ?? "");
   const files2 = [];
   const zshenv = join11(env.ZDOTDIR || home, ".zshenv");
-  if (shell === "zsh" || platform === "darwin" || existsSync8(zshenv)) files2.push({ path: zshenv, kind: "sh" });
+  if (shell === "zsh" || platform === "darwin" || existsSync9(zshenv)) files2.push({ path: zshenv, kind: "sh" });
   const bashrc = join11(home, ".bashrc");
-  if (shell === "bash" || existsSync8(bashrc)) files2.push({ path: bashrc, kind: "sh" });
+  if (shell === "bash" || existsSync9(bashrc)) files2.push({ path: bashrc, kind: "sh" });
   const bashProfile = join11(home, ".bash_profile");
-  if (existsSync8(bashProfile)) files2.push({ path: bashProfile, kind: "sh" });
+  if (existsSync9(bashProfile)) files2.push({ path: bashProfile, kind: "sh" });
   const fish = join11(env.XDG_CONFIG_HOME || join11(home, ".config"), "fish");
-  if (shell === "fish" || existsSync8(fish)) files2.push({ path: join11(fish, "conf.d", "agentsky.fish"), kind: "fish" });
+  if (shell === "fish" || existsSync9(fish)) files2.push({ path: join11(fish, "conf.d", "agentsky.fish"), kind: "fish" });
   return files2;
 }
 function writeShellEnv(token, opts = {}) {
@@ -3072,7 +3161,7 @@ function writeShellEnv(token, opts = {}) {
     writeFileSync6(fish, `${header2}${token ? `set -gx ${TOKEN_ENV} ${quoted(token)}` : `set -e ${TOKEN_ENV}`}
 `, { mode: 384 });
     for (const file of startup) {
-      const existing = existsSync8(file.path) ? readFileSync11(file.path, "utf8") : "";
+      const existing = existsSync9(file.path) ? readFileSync11(file.path, "utf8") : "";
       if (existing.includes(HOOK_MARK)) continue;
       const line = file.kind === "fish" ? `${HOOK_MARK}
 test -f ${quoted(fish)}; and source ${quoted(fish)}
@@ -3443,12 +3532,42 @@ function clip(value, max = 120) {
   const text = typeof value === "string" ? value : JSON.stringify(value);
   return text.length > max ? `${text.slice(0, max)}\u2026` : text;
 }
-function renderEvent(event, data) {
+function createEventRenderer(out = process.stdout) {
+  const seen = /* @__PURE__ */ new Set();
+  let openStream = null;
+  const closeLine = () => {
+    if (openStream === null) return;
+    out.write("\n");
+    openStream = null;
+  };
+  return (event, data) => {
+    const id = typeof data.id === "string" ? data.id : void 0;
+    if (id) {
+      if (seen.has(id)) return;
+      seen.add(id);
+    }
+    if (event !== "agent.message") {
+      if (event && event !== "keepalive") closeLine();
+      renderOther(event, data);
+      return;
+    }
+    const parts = Array.isArray(data.parts) ? data.parts : [];
+    const streamId = typeof parts[0]?.stream_id === "string" ? parts[0].stream_id : null;
+    const text = String(data.text ?? "");
+    if (streamId === null) {
+      closeLine();
+      out.write(`${text}
+`);
+    } else {
+      if (openStream !== streamId) closeLine();
+      out.write(text);
+      openStream = streamId;
+    }
+  };
+}
+function renderOther(event, data) {
   const part = data.part;
   switch (event) {
-    case "agent.message":
-      console.log(String(data.text ?? ""));
-      break;
     case "agent.reasoning":
       console.log(dim(`\xB7 ${clip(part?.text ?? "")}`));
       break;
@@ -3480,11 +3599,12 @@ function renderEvent(event, data) {
 }
 
 // src/session-read.ts
-var TURN_TYPES = ["user.message", "agent.message", "session.status_idle", "session.status_terminated", "session.error"];
+var TURN_STARTS = /* @__PURE__ */ new Set(["user.message", "goal.defined", "goal.iteration"]);
+var TURN_TYPES = [...TURN_STARTS, "agent.message", "session.status_idle", "session.status_terminated", "session.error"];
 function latestTurn(events) {
   let start = 0;
   for (let index = events.length - 1; index >= 0; index -= 1) {
-    if (events[index].type === "user.message") {
+    if (TURN_STARTS.has(events[index].type)) {
       start = index + 1;
       break;
     }
@@ -3531,7 +3651,7 @@ import { createInterface as createInterface3 } from "readline";
 
 // src/setup-local.ts
 import { isUtf8 as isUtf83 } from "buffer";
-import { existsSync as existsSync9, readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync7 } from "fs";
+import { existsSync as existsSync10, readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync7 } from "fs";
 import { homedir as homedir8 } from "os";
 import { dirname as dirname6, isAbsolute as isAbsolute2, join as join13, resolve as resolve6 } from "path";
 import { parse as parseToml4 } from "smol-toml";
@@ -3572,7 +3692,7 @@ function readLocalSkills(agents) {
   const skills2 = [];
   const ignored = [];
   for (const agent2 of agents) {
-    if (!existsSync9(agent2.skillsDir)) continue;
+    if (!existsSync10(agent2.skillsDir)) continue;
     for (const entry2 of readdirSync6(agent2.skillsDir, { withFileTypes: true })) {
       const dir = join13(agent2.skillsDir, entry2.name);
       let isDir2 = entry2.isDirectory();
@@ -3583,7 +3703,7 @@ function readLocalSkills(agents) {
           isDir2 = false;
         }
       }
-      if (!isDir2 || !existsSync9(join13(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
+      if (!isDir2 || !existsSync10(join13(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
       const name = frontmatterName(readFileSync12(join13(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
@@ -3690,7 +3810,7 @@ function findLocalSecrets(agents, home = homedir8()) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync13 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join14 } from "path";
 import { createInterface as createInterface2 } from "readline";
@@ -3789,7 +3909,7 @@ async function connectClaude() {
 }
 function codexSignIn(env = process.env, home = homedir9()) {
   const path = join14(env.CODEX_HOME || join14(home, ".codex"), "auth.json");
-  if (!existsSync10(path)) {
+  if (!existsSync11(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
   const raw = readFileSync13(path, "utf8");
@@ -3802,7 +3922,7 @@ function codexSignIn(env = process.env, home = homedir9()) {
 }
 function cursorSignIn(env = process.env, home = homedir9()) {
   const path = join14(env.XDG_CONFIG_HOME || join14(home, ".config"), "cursor", "auth.json");
-  if (!existsSync10(path)) {
+  if (!existsSync11(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
   const raw = readFileSync13(path, "utf8");
@@ -3924,7 +4044,9 @@ async function subscriptionUsage(name, account) {
   return usage;
 }
 function renderSubscriptionUsage(name, usage) {
-  const label = MODEL_SUBSCRIPTION_PROVIDER_NAME[managedProviderFor(name)];
+  const provider = managedProviderFor(name);
+  const label = MODEL_SUBSCRIPTION_PROVIDER_NAME[provider];
+  if (usage.status === "unavailable" && (usage.reason === "unsupported" || provider === "anthropic" && usage.reason === "permission")) return [`${label}: usage isn't available for this account type`];
   if (usage.status === "unavailable") return [`${label}: usage unavailable (${usage.reason ?? "unknown"})`];
   const head = [`${label}${usage.plan ? ` ${usage.plan}` : ""}`, usage.allowed === false ? "limit reached" : null].filter(Boolean).join(" \xB7 ");
   const rows = usage.windows.map(
@@ -4399,12 +4521,25 @@ async function getSkillUsage(since) {
   const qs = since ? `?since=${encodeURIComponent(since)}` : "";
   return api("GET", `/skills/usage${qs}`);
 }
+function nextSkills(current, skillId, verb) {
+  const has = current.some((ref) => ref.type === "skill" && ref.skillId === skillId);
+  if (verb === "attach") return has ? null : [...current, { type: "skill", skillId, version: "latest" }];
+  return has ? current.filter((ref) => !(ref.type === "skill" && ref.skillId === skillId)) : null;
+}
+async function setAgentSkill(agentId, skillId, verb) {
+  const path = `/agents/${encodeURIComponent(agentId)}`;
+  const { agent: agent2 } = await api("GET", path);
+  const skills2 = nextSkills(agent2.skills ?? [], skillId, verb);
+  if (!skills2) return "unchanged";
+  await api("PATCH", path, { skills: skills2, expectedVersion: agent2.version });
+  return "changed";
+}
 
 // src/task-export.ts
 import { createHash as createHash6 } from "crypto";
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname8, join as join17 } from "path";
-import { stringify as stringifyToml2 } from "smol-toml";
+import { stringify as stringifyToml } from "smol-toml";
 var TEXT_MAX = 2e4;
 function scrub(text, names2) {
   let out = redactPlainText(text).text;
@@ -4582,7 +4717,7 @@ Write your deliverables under /workspace/outputs.
 `);
   out.set(
     "task.toml",
-    stringifyToml2({
+    stringifyToml({
       metadata: {
         name: `agentsky-${idHash}`,
         tier: opts.tier,
@@ -4969,41 +5104,43 @@ async function listBrowserProfiles() {
   const { data } = await api("GET", "/browser_profiles");
   return data;
 }
-async function getBrowserProfile(scope) {
-  const profiles = await listBrowserProfiles();
-  const profile = profiles.find((entry2) => entry2.scope === scope);
-  if (!profile) throw new ApiError(404, "not_found", "browser profile not found");
-  return profile;
-}
 async function importBrowserProfileState(scope, state) {
   return api("POST", `/browser_profiles/${encodeURIComponent(scope)}/imports`, state);
 }
-async function listBrowserProfileSites(scope) {
-  const profile = await getBrowserProfile(scope);
-  return profile.sites;
+async function listBrowserProfileSites() {
+  const profiles = await listBrowserProfiles();
+  return (profiles.find((entry2) => entry2.scope === "mine") ?? profiles.find((entry2) => entry2.scope === "workspace"))?.sites ?? [];
 }
-async function browserSiteReference(scope, site) {
-  const sites = await listBrowserProfileSites(scope);
+async function removeBrowserProfileSite(site) {
+  const sites = await listBrowserProfileSites();
   const row = sites.find((entry2) => entry2.site === site) ?? sites.find((entry2) => entry2.site_id === site);
-  if (!row) throw new ApiError(404, "not_found", "site not found in this browser profile");
-  return row.site_id ? `${encodeURIComponent(row.site_id)}?by=id` : encodeURIComponent(row.site);
+  if (!row) throw new ApiError(404, "not_found", "site not found in your browser");
+  await api("DELETE", `/browser_profiles/mine/sites/${row.site_id ? `${encodeURIComponent(row.site_id)}?by=id` : encodeURIComponent(row.site)}`);
 }
-async function removeBrowserProfileSite(scope, site) {
-  await api("DELETE", `/browser_profiles/${encodeURIComponent(scope)}/sites/${await browserSiteReference(scope, site)}`);
+async function shareBrowserProfile(member, sites) {
+  const { share } = await api("POST", "/browser_profiles/mine/shares", {
+    grantee: member ? { user_id: member } : "workspace",
+    sites: sites.length ? sites : null
+  });
+  return share;
 }
-async function moveBrowserProfileSite(scope, site, to) {
-  const reference = await browserSiteReference(scope, site);
-  const [identifier, query] = reference.split("?");
-  return api("POST", `/browser_profiles/${encodeURIComponent(scope)}/sites/${identifier}/move${query ? `?${query}` : ""}`, { to });
+async function unshareBrowserProfile(shareId) {
+  await api("DELETE", `/browser_profiles/mine/shares/${encodeURIComponent(shareId)}`);
 }
 function renderBrowserProfileSite(site) {
   const who = site.signed_in_by?.email ?? site.signed_in_by?.name ?? "unknown";
   const used = site.last_used_at ? `used ${site.last_used_at.slice(0, 10)}` : "never used";
   return `${site.site.padEnd(40)} ${site.status.padEnd(14)} ${who}  ${used}${site.status === "removing" && site.site_id ? `  retry with site ID ${site.site_id}` : ""}`;
 }
+function renderBrowserProfileShare(share) {
+  const who = share.grantee.type === "workspace" ? "everyone in this workspace" : share.grantee.user.email ?? share.grantee.user.name ?? share.grantee.user.id;
+  return `shared with ${who}: ${share.sites ? share.sites.join(", ") : "every site"}  (share ${share.id})`;
+}
 function renderBrowserProfile(profile) {
-  const lines = [`scope: ${profile.scope}  revision: ${profile.revision}  sites: ${profile.sites.length}`];
+  const title = profile.scope === "mine" ? "your browser" : profile.scope === "shared" ? `shared with you by ${profile.owner?.email ?? profile.owner?.name ?? profile.owner?.id ?? "someone"}` : "shared with this workspace";
+  const lines = [`${title}  revision: ${profile.revision}  sites: ${profile.sites.length}`];
   for (const site of profile.sites) lines.push(`  ${renderBrowserProfileSite(site)}`);
+  for (const share of profile.shares ?? []) lines.push(`  ${renderBrowserProfileShare(share)}`);
   return lines.join("\n");
 }
 
@@ -5159,6 +5296,148 @@ function renderLibraryArtifact(artifact2) {
   return `${artifact2.id}  ${artifact2.name}  ${version}${artifact2.shared ? "  shared" : ""}`;
 }
 
+// src/design-systems.ts
+import { readdirSync as readdirSync8, readFileSync as readFileSync16, statSync as statSync9 } from "fs";
+import { join as join18, relative as relative5, sep as sep3 } from "path";
+var TEXT2 = /\.(mdx?|markdown|txt|json|m?js|cjs|jsx|tsx?|css|html?|svg|xml|csv|ya?ml|toml)$/i;
+var MEDIA = {
+  woff2: "font/woff2",
+  woff: "font/woff",
+  ttf: "font/ttf",
+  otf: "font/otf",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  pdf: "application/pdf",
+  mp4: "video/mp4",
+  webm: "video/webm"
+};
+async function listDesignSystems() {
+  return (await api("GET", "/artifacts?kind=design_system")).artifacts;
+}
+async function getDesignSystem(id) {
+  return (await api("GET", `/artifacts/${encodeURIComponent(id)}/design-system`)).design_system;
+}
+async function importDesignSystem(task2, files2, title) {
+  return (await api("POST", "/artifacts/design-systems", { task_id: task2, files: files2, ...title ? { title } : {} })).artifact;
+}
+async function saveDesignTokens(id, baseVersion, tokens, note) {
+  return (await api("PUT", `/artifacts/${encodeURIComponent(id)}/design-system/tokens`, {
+    base_version: baseVersion,
+    tokens,
+    ...note ? { note } : {}
+  })).artifact;
+}
+function fileTableFrom(dir) {
+  const files2 = {};
+  const walk = (current) => {
+    for (const name of readdirSync8(current)) {
+      if (name.startsWith(".") || name === "node_modules") continue;
+      const path = join18(current, name);
+      if (statSync9(path).isDirectory()) {
+        walk(path);
+        continue;
+      }
+      const key = relative5(dir, path).split(sep3).join("/");
+      const bytes = readFileSync16(path);
+      files2[key] = TEXT2.test(name) ? bytes.toString("utf8") : `data:${MEDIA[name.split(".").pop()?.toLowerCase() ?? ""] ?? "application/octet-stream"};base64,${bytes.toString("base64")}`;
+    }
+  };
+  walk(dir);
+  return files2;
+}
+function renderDesignSystem(system) {
+  const tokens = system.tokens;
+  const lines = [
+    `${system.artifact_id}  ${system.title}  v${system.version}${system.editable ? "" : "  read-only"}`,
+    tokens ? `themes ${tokens.themes.map((theme) => theme.id).join(", ")} \xB7 ${tokens.colors.length} colors \xB7 ${tokens.typeGroups.reduce((sum, group) => sum + group.styles.length, 0)} type styles \xB7 ${tokens.spacing.length} spacing \xB7 ${tokens.radius.length} radius` : "no tokens.json",
+    `components: ${system.components.map((component) => component.name).join(", ") || "none"}`,
+    `assets: ${system.assets.map((group) => `${group.name} (${group.files.length})`).join(", ") || "none"}`
+  ];
+  if (system.last_change) lines.push(`last change: ${system.last_change.by}${system.last_change.via ? ` via ${system.last_change.via}` : ""} at ${system.last_change.at}`);
+  for (const token of tokens?.dropped ?? []) lines.push(`not read: ${token.family} ${token.name || "(unnamed)"}: ${token.reason}`);
+  return lines.join("\n");
+}
+async function designComments(id, input) {
+  return api(input ? "POST" : "GET", `/artifacts/${encodeURIComponent(id)}/design-system/comments`, input);
+}
+
+// src/api-command.ts
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "fs";
+var API_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+function readData(data, stdin = () => readFileSync17(0, "utf8")) {
+  if (data === void 0) return void 0;
+  const raw = data === "-" ? stdin() : data.startsWith("@") ? readFileSync17(data.slice(1), "utf8") : data;
+  try {
+    JSON.parse(raw);
+  } catch {
+    throw new Error("--data must be JSON (inline, @file or - for stdin)");
+  }
+  return raw;
+}
+function requestPath(path, query = []) {
+  if (!path.startsWith("/") || path.startsWith("//")) throw new Error("path must start with /, e.g. /threads");
+  const clean = path.replace(/^\/v1(?=\/)/, "");
+  const params = new URLSearchParams();
+  for (const pair of query) {
+    const at = pair.indexOf("=");
+    if (at <= 0) throw new Error(`--query needs key=value, got "${pair}"`);
+    params.append(pair.slice(0, at), pair.slice(at + 1));
+  }
+  const sep4 = clean.includes("?") ? "&" : "?";
+  const encoded = params.toString();
+  return encoded ? `${clean}${sep4}${encoded}` : clean;
+}
+function matchOperations(doc, words) {
+  const needles = words.map((w) => w.toLowerCase());
+  const out = [];
+  for (const [path, item] of Object.entries(doc.paths ?? {})) {
+    for (const [method, op] of Object.entries(item)) {
+      if (!API_METHODS.includes(method.toUpperCase())) continue;
+      const hay = `${method} ${path} ${op.summary ?? ""} ${op.operationId ?? ""}`.toLowerCase();
+      if (needles.every((n) => hay.includes(n))) out.push({ method: method.toUpperCase(), path, summary: op.summary, operationId: op.operationId });
+    }
+  }
+  return out.sort((a, b) => a.path.localeCompare(b.path) || a.method.localeCompare(b.method));
+}
+async function searchApi(words) {
+  const res = await apiRaw("GET", "/openapi.json", { auth: false });
+  if (!res.ok) throw new Error(`could not read the API reference (${res.status})`);
+  const ops = matchOperations(await res.json(), words);
+  if (!ops.length) {
+    console.log("no operations match");
+    return;
+  }
+  for (const op of ops) console.log(`${op.method.padEnd(6)} ${op.path}${op.summary ? `  \u2014 ${op.summary}` : ""}`);
+}
+async function callApi(method, path, opts) {
+  const verb = method.toUpperCase();
+  if (!API_METHODS.includes(verb)) throw new Error(`method must be one of ${API_METHODS.join(", ")} or "search"`);
+  const body = readData(opts.data);
+  if (body !== void 0 && verb === "GET") throw new Error("a GET takes no --data; use --query");
+  const res = await apiRaw(verb, requestPath(path, opts.query), { body, idempotencyKey: opts.idempotencyKey, universe: opts.workspace });
+  const type = res.headers.get("content-type") ?? "";
+  if (opts.output) {
+    writeFileSync9(opts.output, new Uint8Array(await res.arrayBuffer()));
+    console.error(`${res.status} \u2192 ${opts.output}`);
+  } else if (/json/.test(type)) {
+    const text = await res.text();
+    let printed = text;
+    try {
+      printed = JSON.stringify(JSON.parse(text), null, 2);
+    } catch {
+    }
+    (res.ok ? console.log : console.error)(printed);
+  } else if (/^text\/|xml|csv|markdown/.test(type) || !type) {
+    (res.ok ? console.log : console.error)(await res.text());
+  } else {
+    console.error(`${res.status}: ${type} body (${res.headers.get("content-length") ?? "?"} bytes); pass --output <file> to save it`);
+  }
+  if (!res.ok && res.status !== 304) process.exitCode = 1;
+}
+
 // src/billing-plans.ts
 var readCodingPlan = () => api("GET", "/billing/coding-plan");
 function joinCodingPlan(dollars2, requestId) {
@@ -5233,20 +5512,31 @@ function wholeNumber2(flag, value) {
   return Number(value.trim());
 }
 
+// src/workspace-flag.ts
+function workspaceFlagIsCommands(argv, commandPath) {
+  let at = 0;
+  let matched = 0;
+  for (; at < argv.length && matched < commandPath.length; at += 1) {
+    if (argv[at] === commandPath[matched]) matched += 1;
+  }
+  if (matched < commandPath.length) return false;
+  return argv.slice(at).some((arg) => arg === "--workspace" || arg.startsWith("--workspace="));
+}
+
 // src/harness.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname9, join as join18, resolve as resolve8 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname9, join as join19, resolve as resolve8 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
-  return join18(resolve8(dir), HARNESS_FILE);
+  return join19(resolve8(dir), HARNESS_FILE);
 }
 function readHarnessFile(dir) {
   const path = harnessFilePath(dir);
-  if (!existsSync11(path)) {
+  if (!existsSync12(path)) {
     throw new Error(`no ${HARNESS_FILE} found in ${resolve8(dir)} \u2014 run \`sky harness init\` first`);
   }
   try {
-    return JSON.parse(readFileSync16(path, "utf8"));
+    return JSON.parse(readFileSync18(path, "utf8"));
   } catch (err) {
     throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -5273,11 +5563,11 @@ var INIT_COMMENT = `# harness.json \u2014 workspace harness profile skeleton
 `;
 function harnessInit(dir) {
   const path = harnessFilePath(dir);
-  if (existsSync11(path)) {
+  if (existsSync12(path)) {
     throw new Error(`${path} already exists \u2014 delete it to re-init`);
   }
   mkdirSync6(dirname9(path), { recursive: true });
-  writeFileSync9(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+  writeFileSync10(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
 `);
   console.log(`Created ${path}`);
   console.log(INIT_COMMENT);
@@ -5410,9 +5700,16 @@ function printModelBilling(session2) {
 }
 var program = new Command();
 program.name("sky").description("Launch and talk to long-lived agents \u2014 agentsky.dev").version(CLI_VERSION).option("--workspace <slug>", "workspace to act in (overrides sky universe switch and SKY_UNIVERSE; alias of --universe on sub-commands)");
-program.hook("preAction", () => {
+program.hook("preAction", (_root, action) => {
   const workspace2 = program.opts().workspace;
-  if (workspace2) process.env.SKY_WORKSPACE = workspace2;
+  if (!workspace2) return;
+  const path = [];
+  for (let command = action; command && command !== program; command = command.parent) path.unshift(command.name());
+  if (action.options.some((option) => option.long === "--workspace") && workspaceFlagIsCommands(process.argv.slice(2), path)) {
+    action.setOptionValue("workspace", workspace2);
+    return;
+  }
+  process.env.SKY_WORKSPACE = workspace2;
 });
 var lastProgressDecile = -1;
 function uploadProgress(sent, total) {
@@ -5447,6 +5744,9 @@ auth.command("whoami").description("who the current token acts as").action(
     console.log(
       `${who.user.email ?? "unknown"} \xB7 universe ${who.universe.slug}${who.universe.isPersonal ? " (default)" : ""} \xB7 scopes ${who.scopes.join(",")}`
     );
+    if (who.credential_universe) {
+      console.log(`  this key is fixed to workspace ${who.credential_universe}: it cannot act in other workspaces or create new ones (make an account-wide key with \`sky keys create\`, or \`sky auth login\`)`);
+    }
   })
 );
 auth.command("connect <provider>").description("connect a model subscription: claude (setup-token) or chatgpt (Codex sign-in); --browser signs any plan in on its own page").option("-y, --yes", "skip the consent prompt").option("--browser", "sign in on the provider's page instead of using this machine's sign-in (claude, chatgpt, cursor, grok, muse)").option("--account <id>", "with --browser: re-sign an additional account, or `new` to add one").option("--label <label>", "with --browser: name the account").option("--no-open", "with --browser: print the sign-in link without opening it").action(
@@ -5583,6 +5883,12 @@ workspace.command("list").action(
   })
 );
 workspace.command("delete <slug>").description("permanently delete a workspace you own and everything in it (asks you to type the slug)").option("-y, --yes", "skip typing the slug").action(run(deleteWorkspaceCommand));
+async function renameWorkspaceCommand(slug, name) {
+  const { universe: renamed } = await api("PATCH", `/universes/${encodeURIComponent(slug)}`, { name: name.join(" ") });
+  console.log(`${renamed.slug} is now "${renamed.name}"`);
+}
+universe.command("rename <slug> <name...>").description("rename a workspace you own (its slug stays)").action(run(renameWorkspaceCommand));
+workspace.command("rename <slug> <name...>").description("rename a workspace you own (alias of universe rename)").action(run(renameWorkspaceCommand));
 var policy = program.command("policy").description("policy rules: tool calls, spend caps, call counts, capabilities");
 async function policyScope(opts) {
   return opts.session ? { session: await resolveSessionRef(opts.session) } : { slug: await workspaceSlug(opts.universe) };
@@ -5693,7 +5999,7 @@ agent.command("destroy <id>").description("delete the spec; requires all session
     console.log(`Destroyed ${id}`);
   })
 );
-agent.command("message <id> [text]").description("send one message to the default session and stream the turn until idle").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").option("--plan", "plan mode: the agent inspects and answers with a plan, then waits for you to choose to implement it").option("--build", "build mode for this turn, overriding a session left in plan mode").action(
+agent.command("message <id> [text]").description("send one message to the default session and stream the turn until idle").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks); a file_\u2026 id attaches that stored file").option("--file-id <id...>", "attach files already uploaded (`sky files upload`), by id, without uploading again").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").option("--plan", "plan mode: the agent inspects and answers with a plan, then waits for you to choose to implement it").option("--build", "build mode for this turn, overriding a session left in plan mode").action(
   run(
     async (id, text, opts) => sendAndFollow(await resolveSessionRef(id), text ?? "", opts)
   )
@@ -5807,7 +6113,7 @@ session.command("delete <id>").description("permanently delete the session, its
     console.log(`Deleted ${id}`);
   })
 );
-session.command("message <ref> [text]").description("send one message (session id, or agent id = its default session)").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").option("--plan", "plan mode: the agent inspects and answers with a plan, then waits for you to choose to implement it").option("--build", "build mode for this turn, overriding a session left in plan mode").action(
+session.command("message <ref> [text]").description("send one message (session id, or agent id = its default session)").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks); a file_\u2026 id attaches that stored file").option("--file-id <id...>", "attach files already uploaded (`sky files upload`), by id, without uploading again").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").option("--plan", "plan mode: the agent inspects and answers with a plan, then waits for you to choose to implement it").option("--build", "build mode for this turn, overriding a session left in plan mode").action(
   run(
     async (ref, text, opts) => sendAndFollow(await resolveSessionRef(ref), text ?? "", opts)
   )
@@ -6000,7 +6306,7 @@ sessionWorkspace.command("cat <ref> <path>").description("print a file (up to 1
   run(async (ref, path, opts) => {
     const bytes = await readFile(await resolveSessionRef(ref), path);
     if (opts.out) {
-      writeFileSync10(opts.out, bytes);
+      writeFileSync11(opts.out, bytes);
       console.error(`saved ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -6017,7 +6323,7 @@ sessionWorkspace.command("patch <ref> [repo]").description("the work in a reposi
     console.error(`${meta.repo}: ${meta.commits.length} commit${meta.commits.length === 1 ? "" : "s"} since ${meta.base_branch || "the imported copy"} (${meta.base_commit.slice(0, 12)})`);
     if (!patch.length) console.error("nothing changed");
     else if (opts.out) {
-      writeFileSync10(opts.out, patch);
+      writeFileSync11(opts.out, patch);
       console.error(`wrote ${opts.out} \u2014 apply with: git apply ${opts.out}`);
     } else process.stdout.write(patch);
   })
@@ -6071,9 +6377,10 @@ function interactionMode(opts) {
 }
 async function uploadAttachments(opts) {
   const files2 = [];
-  for (const path of [...opts.image ?? [], ...opts.file ?? []]) {
-    const file = await uploadLocalFile(path);
-    console.error(`uploaded ${file.filename} \u2192 ${file.id}`);
+  const refs = [...opts.image ?? [], ...opts.file ?? []].map((ref) => ({ ref, byId: false }));
+  for (const { ref, byId } of [...refs, ...(opts.fileId ?? []).map((ref2) => ({ ref: ref2, byId: true }))]) {
+    const { file, uploaded } = await attachment(ref, { byId });
+    console.error(uploaded ? `uploaded ${file.filename} \u2192 ${file.id}` : `attaching ${file.id} (${file.filename})`);
     files2.push(file);
   }
   return files2;
@@ -6090,9 +6397,10 @@ async function sendAndFollow(sessionId, text, opts) {
   const controller = new AbortController();
   let opened = null;
   if (!opts.detach) {
+    const render = createEventRenderer();
     opened = (async () => {
       for await (const frame of streamEvents(sessionId, controller.signal)) {
-        renderEvent(frame.event, frame.data);
+        render(frame.event, frame.data);
         if (turnOver(frame)) {
           controller.abort();
           break;
@@ -6113,10 +6421,11 @@ async function chatLoop(sessionId, opts = {}) {
   const controller = new AbortController();
   const rl = createInterface6({ input: process.stdin, output: process.stdout, prompt: "> " });
   let system = opts.system;
+  const render = createEventRenderer();
   void (async () => {
     try {
       for await (const frame of streamEvents(sessionId, controller.signal)) {
-        renderEvent(frame.event, frame.data);
+        render(frame.event, frame.data);
         if (frame.event === "session.status_terminated") rl.close();
         else if (frame.event === "session.status_idle") rl.prompt();
       }
@@ -6223,10 +6532,32 @@ secrets.command("unset <id> <key>").action(
     console.log(`unset ${key}`);
   })
 );
-program.command("launch").description("scaffold ./agent.toml if absent, create the agent, print its address").option("-f, --file <path>", "agent file", "agent.toml").option("--type <type>", "override the file's harness: hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "override the file's model (must suit the harness)").action(
+async function launchFromFile(path, spec, opts) {
+  const { vcpus, memoryMb, ...specBody } = spec;
+  const body = {
+    ...specBody,
+    ...opts.type ? { agentType: opts.type } : {},
+    ...opts.llm ? { llm: opts.llm } : {}
+  };
+  const { agent: created } = await api("POST", "/agents", body);
+  const { session: session2 } = await api("POST", "/sessions", {
+    agent: created.id,
+    ...opts.start ? {} : { provision: "deferred" },
+    ...vcpus !== void 0 ? { vcpus } : {},
+    ...memoryMb !== void 0 ? { memoryMb } : {}
+  });
+  stampId(path, created.id);
+  console.log(`Launched ${created.id} (${created.agentType} \xB7 ${created.llm})`);
+  printModelBilling(session2);
+  console.log(opts.start ? "  its first session is starting now" : "  its first session starts on the first message");
+  if (!spec.llm && !opts.llm) console.log(`  model: ${created.llm}, the ${created.agentType} default \u2014 set llm = "\u2026" in ${basename9(path)} and run \`sky deploy\` to change it`);
+  console.log(`  sky agent message ${created.id} "hello"`);
+  console.log(`  sky agent chat ${created.id}`);
+}
+program.command("launch").description("scaffold ./agent.toml if absent, create the agent and its first session (idle until the first message), print its address").option("-f, --file <path>", "agent file", "agent.toml").option("--type <type>", "override the file's harness: hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "override the file's model (must suit the harness)").option("--start", "boot the first session now instead of on the first message").action(
   run(async (opts) => {
     const path = resolve9(opts.file);
-    if (!existsSync12(path)) {
+    if (!existsSync13(path)) {
       const name = basename9(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
       scaffoldAgentFile(path, name);
       console.log(`Scaffolded ${opts.file} \u2014 edit it anytime; re-apply with \`sky deploy\`.`);
@@ -6236,55 +6567,27 @@ program.command("launch").description("scaffold ./agent.toml if absent, create t
       console.log(`${file.id} already launched \u2014 use \`sky deploy\` to re-apply.`);
       return;
     }
-    const { vcpus, memoryMb, ...specBody } = spec;
-    const body = {
-      ...specBody,
-      ...opts.type ? { agentType: opts.type } : {},
-      ...opts.llm ? { llm: opts.llm } : {}
-    };
-    const { agent: created } = await api("POST", "/agents", body);
-    console.log("Starting its runtime\u2026");
-    const { session: session2 } = await api("POST", "/sessions", {
-      agent: created.id,
-      ...vcpus !== void 0 ? { vcpus } : {},
-      ...memoryMb !== void 0 ? { memoryMb } : {}
-    });
-    stampId(path, created.id);
-    console.log(`Launched ${created.id} (${created.agentType} \xB7 ${created.llm})`);
-    printModelBilling(session2);
-    console.log(`  sky agent message ${created.id} "hello"`);
-    console.log(`  sky agent chat ${created.id}`);
+    await launchFromFile(path, spec, opts);
   })
 );
-program.command("deploy").description("re-apply ./agent.toml to the existing agent (idempotent)").option("-f, --file <path>", "agent file", "agent.toml").action(
+program.command("deploy").description("re-apply ./agent.toml to the existing agent (idempotent: an unchanged file changes nothing)").option("-f, --file <path>", "agent file", "agent.toml").action(
   run(async (opts) => {
     const path = resolve9(opts.file);
     const { file, spec } = readAgentFile(path);
     if (!file.id) {
       console.log("No agent id in the file yet \u2014 running launch instead.");
-      const { vcpus, memoryMb, ...specBody } = spec;
-      const { agent: created } = await api("POST", "/agents", specBody);
-      await api("POST", "/sessions", {
-        agent: created.id,
-        ...vcpus !== void 0 ? { vcpus } : {},
-        ...memoryMb !== void 0 ? { memoryMb } : {}
-      });
-      stampId(path, created.id);
-      console.log(`Launched ${created.id}`);
+      await launchFromFile(path, spec, {});
       return;
     }
+    const ref = encodeURIComponent(file.id);
+    const { agent: before } = await api("GET", `/agents/${ref}`);
+    let promptChanged = false;
     if (spec.prompt !== void 0) {
-      await api("PUT", `/agents/${encodeURIComponent(file.id)}/prompt`, {
-        prompt: spec.prompt
-      });
+      const saved = await api("PUT", `/agents/${ref}/prompt`, { prompt: spec.prompt });
+      promptChanged = saved.unchanged === false;
     }
-    await api("PATCH", `/agents/${encodeURIComponent(file.id)}`, {
-      displayName: spec.displayName,
-      ...spec.capabilities ? { capabilities: spec.capabilities } : {},
-      ...spec.reasoningEffort ? { reasoningEffort: spec.reasoningEffort } : {},
-      ...spec.skills ? { skills: spec.skills } : {}
-    });
-    console.log(`Deployed ${file.id} (prompt + settings re-applied)`);
+    const { agent: after } = await api("PATCH", `/agents/${ref}`, deployPatch(spec));
+    for (const line of deployReport(file.id, spec, before, after, promptChanged)) console.log(line);
   })
 );
 program.command("clone").description("clone your local agent (Claude Code, \u2026) into the cloud; re-run to sync its prompt").option("--harness <type>", "claude_code | codex | openclaw (default: detected)").option("--new", "always launch a fresh agent, even if this machine is linked").option("--dry-run", "print the plan and send nothing").option("-y, --yes", "skip the confirmation").option("--open", "open the agent page when done").action(
@@ -6525,14 +6828,14 @@ task.command("get <task> <path>").description("read one task file; prints it, or
   run(async (taskId, path, opts) => {
     const bytes = await readTaskFile(taskId, path);
     if (opts.out) {
-      writeFileSync10(opts.out, bytes);
+      writeFileSync11(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync17(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync19(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -6605,7 +6908,7 @@ task.command("verdict <task> <did-the-job>").description("record whether the tas
     console.log(`Recorded verdict on task ${updated.id}: did_the_job=${value === "yes"}`);
   })
 );
-var skills = program.command("skills").description("the workspace's skill store: upload a skill, then attach it to an agent by id");
+var skills = program.command("skills").description("the workspace's skill store: upload a skill, then attach it to an agent (sky skills attach, or [[skills]] in agent.toml)");
 skills.command("upload <dir>").description("upload a skill directory (SKILL.md at its root) as a new skill").option("--name <name>", "display name (default: the directory's name)").option("--json", "print the stored skill as JSON").action(
   run(async (dir, opts) => {
     const { skill } = await uploadSkill(dir, opts.name);
@@ -6613,7 +6916,7 @@ skills.command("upload <dir>").description("upload a skill directory (SKILL.md a
       console.log(JSON.stringify(skill));
       return;
     }
-    console.log(`Uploaded ${skill.id} (${skill.displayName ?? dir}). Attach it in agent.toml:`);
+    console.log(`Uploaded ${skill.id} (${skill.displayName ?? dir}). Attach it: sky skills attach ${skill.id} --agent <id>, or in agent.toml:`);
     console.log(`  [[skills]]
   type = "skill"
   skillId = "${skill.id}"`);
@@ -6626,6 +6929,18 @@ skills.command("list").description("the workspace's stored skills").action(
     for (const skill of list) console.log(`${skill.id}  ${skill.displayName ?? ""}`);
   })
 );
+for (const [verb, blurb] of [
+  ["attach", "add a stored skill to an agent; its new sessions load it"],
+  ["detach", "remove a skill from an agent; its new sessions no longer load it"]
+]) {
+  skills.command(`${verb} <skill>`).description(blurb).requiredOption("--agent <id>", "the agent").action(
+    run(async (skillId, opts) => {
+      const outcome = await setAgentSkill(opts.agent, skillId, verb);
+      if (outcome === "unchanged") console.log(`${skillId} is ${verb === "attach" ? "already" : "not"} attached to ${opts.agent}`);
+      else console.log(`${verb === "attach" ? "Attached" : "Detached"} ${skillId} ${verb === "attach" ? "to" : "from"} ${opts.agent} \u2014 new sessions ${verb === "attach" ? "load it" : "no longer load it"}; running sessions keep the skills they started with`);
+    })
+  );
+}
 skills.command("usage").description("view and miss counts per skill name in this workspace").option("--since <iso>", `start date (ISO 8601); default is the last 30 days`).option("--json", "print JSON").action(
   run(async (opts) => {
     const summary = await getSkillUsage(opts.since);
@@ -6684,7 +6999,7 @@ library.command("list").description("your Library, newest first").option("--sear
 );
 library.command("upload <path>").description("save a file from this computer to your Library").option("--workspace <key>", "place it in this workspace").action(
   run(async (path, opts) => {
-    const bytes = readFileSync17(path);
+    const bytes = readFileSync19(path);
     const { artifact: artifact2 } = await uploadToLibrary({ bytes, name: basename9(path), mediaType: "application/octet-stream" }, `sky-upload-${crypto.randomUUID()}`, opts.workspace);
     console.log(renderLibraryArtifact(artifact2));
   })
@@ -6715,7 +7030,7 @@ library.command("place <id> <workspace>").description('place your artifact in a
 library.command("download <id> <out>").description("save one version's bytes to a file").option("--version <n>", "a saved version (the current one when omitted)").action(
   run(async (id, out, opts) => {
     const { bytes } = await downloadLibraryArtifact(id, opts.version ? Number(opts.version) : void 0);
-    writeFileSync10(out, bytes);
+    writeFileSync11(out, bytes);
     console.log(`wrote ${bytes.length} bytes to ${out}`);
   })
 );
@@ -6736,7 +7051,7 @@ artifact.command("get <id> <path>").description("read one file of an artifact; p
   run(async (id, path, opts) => {
     const bytes = await readArtifactFile(id, path);
     if (opts.out) {
-      writeFileSync10(opts.out, bytes);
+      writeFileSync11(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -6753,6 +7068,35 @@ artifact.command("rm <id>").description("delete an artifact").action(
     console.log(`Deleted ${id}`);
   })
 );
+var designSystem = program.command("design-system").description("design systems: brand books, tokens and components agents design with");
+designSystem.command("list").description("the workspace's design systems").action(
+  run(async () => {
+    const list = await listDesignSystems();
+    if (!list.length) console.log("no design systems");
+    for (const a of list) console.log(renderArtifact(a));
+  })
+);
+designSystem.command("show <id>").description("a design system's tokens, components and assets; --readme prints its brand book instead").option("--readme", "print project/README.md").action(
+  run(async (id, opts) => {
+    const system = await getDesignSystem(id);
+    console.log(opts.readme ? system.readme ?? "this design system has no README.md" : renderDesignSystem(system));
+  })
+);
+designSystem.command("import <task> <folder>").description("import a local design-system folder (one holding project/, or project/ itself) into a task and publish it").option("--title <title>", "the system's name; defaults to the title in design-system.json").action(
+  run(async (task2, folder, opts) => {
+    console.log(renderArtifact(await importDesignSystem(task2, fileTableFrom(resolve9(folder)), opts.title)));
+  })
+);
+designSystem.command("tokens <id> <file>").description("save a tokens.json file as the system's next version; --base is the version you edited").requiredOption("--base <version>", "the version the file was edited from", (value) => Number(value)).option("--note <note>", "one line saying what changed").action(
+  run(async (id, file, opts) => {
+    const tokens = JSON.parse(readFileSync19(resolve9(file), "utf8"));
+    console.log(renderArtifact(await saveDesignTokens(id, opts.base, tokens, opts.note)));
+  })
+);
+designSystem.command("comments <id>").description("read design-system comments, or add one with --text and --base").option("--text <text>", "comment to add").option("--target <target>", "overview, color:<name> or component:<name>", "overview").option("--base <version>", "the version you viewed", Number).action(run(async (id, opts) => {
+  if (opts.text !== void 0 && (!Number.isInteger(opts.base) || opts.base < 1)) throw Error("Adding a comment requires --base <version>.");
+  console.log(JSON.stringify(await designComments(id, opts.text === void 0 ? void 0 : { text: opts.text, target: opts.target, base_version: opts.base }), null, 2));
+}));
 function routineLine(r) {
   const target = r.target.type === "session" ? `\u2192 ${r.target.session_id}` : `+ ${r.target.agent}`;
   const cron = r.schedule ? `${r.schedule.expression} ${r.schedule.timezone}` : "manual-only";
@@ -6835,6 +7179,12 @@ for (const [verb, blurb] of [
     })
   );
 }
+routine.command("rm <id>").description("delete a routine: it never runs again; the sessions it started are kept").action(
+  run(async (id) => {
+    await api("DELETE", `/routines/${encodeURIComponent(id)}`);
+    console.log(`Deleted routine ${id}. It will not run again; sessions it started are kept.`);
+  })
+);
 routine.command("runs [id]").description("every fire attempt, newest first \u2014 of one routine, or all of them").option("--failed", "only runs that failed to start").option("--limit <n>", "how many (default 20)").action(
   run(async (id, opts) => {
     const params = new URLSearchParams({ limit: opts.limit ?? "20" });
@@ -7052,7 +7402,7 @@ usageOptions(
   run(async (opts) => {
     const { bytes } = await apiBytes("GET", `/billing/usage/export${usageQuery(opts)}`);
     if (opts.out) {
-      writeFileSync10(opts.out, bytes);
+      writeFileSync11(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else {
       process.stdout.write(bytes);
@@ -7130,10 +7480,10 @@ memory.command("save <text...>").description("add an entry").action(run(async (t
 memory.command("edit <index> <text...>").description("replace entry <index>").action(run(async (index, text) => writeMemory({ op: "update", index: memoryIndex(index), text: text.join(" ") })));
 memory.command("rm <index>").description("remove entry <index>").action(run(async (index) => writeMemory({ op: "remove", index: memoryIndex(index) })));
 memory.command("clear").description("remove every entry").action(run(async () => writeMemory({ op: "clear" })));
-var context = program.command("context").description("search your conversations, memory and the workspace trace library");
-context.command("search <words...>").description("literal matches, in source order; follow --cursor for more").option("--scope <scope>", "sessions, memory or traces (default sessions)").option("--limit <n>", "hits per page (default 20)").option("--cursor <cursor>", "continue a previous search").option("--since <iso>", "inclusive lower time bound").option("--until <iso>", "exclusive upper time bound").option("--json", "print the API's answer as JSON").action(
+var context = program.command("context").description("search everything you can open in the workspace, and read a hit");
+context.command("search <words...>").description('plain words, "exact phrase" or /regex/ (every matching line, like grep); follow --cursor for more').option("--scope <folder>", "memory/, chats, traces, outputs/, files/, meetings/, skills/<name>/, agents/ or docs/ (default everything)").option("--limit <n>", "hits per page (default 20)").option("--cursor <cursor>", "continue a previous search").option("--since <iso>", "inclusive lower time bound").option("--until <iso>", "exclusive upper time bound").option("--json", "print the API's answer as JSON").action(
   run(async (words, opts) => {
-    const page = await api("GET", `/context/search${searchQuery(words.join(" "), opts)}`);
+    const page = await searchContext(words.join(" "), opts);
     console.log(opts.json ? JSON.stringify(page, null, 2) : renderContextPage(page));
   })
 );
@@ -7141,7 +7491,7 @@ context.command("read <ref>").description("read a search hit in full: <ref> is t
   run(async (ref, opts) => {
     const params = new URLSearchParams({ ref });
     if (opts.offset) params.set("offset", opts.offset);
-    const read = await api("GET", `/context/read?${params}`);
+    const read = await contextRequest(`/context/read?${params}`);
     console.log(read.text);
     if (read.nextOffset !== null) console.error(`more: --offset ${read.nextOffset}`);
   })
@@ -7451,7 +7801,7 @@ mac.command("take-back <mount>").description("end a folder, browser window, scre
   })
 );
 var browserProfile = program.command("browser-profile").description("saved-login profiles: the sites your agents stay signed in to");
-browserProfile.command("list").description("your workspace's browser profiles: the sites your agents stay signed in to").option("--json", "print as JSON").action(
+browserProfile.command("list").description("your browser, with whom you shared it, and the browsers shared with you in this workspace").option("--json", "print as JSON").action(
   run(async (opts) => {
     const profiles = await listBrowserProfiles();
     if (opts.json) {
@@ -7462,9 +7812,9 @@ browserProfile.command("list").description("your workspace's browser profiles: t
     for (const p of profiles) console.log(renderBrowserProfile(p));
   })
 );
-browserProfile.command("sites <scope>").description("list the sites in a profile: workspace or private").option("--json", "print as JSON").action(
-  run(async (scope, opts) => {
-    const sites = await listBrowserProfileSites(scope);
+browserProfile.command("sites").description("list the sites your browser is signed in to").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const sites = await listBrowserProfileSites();
     if (opts.json) {
       console.log(JSON.stringify(sites, null, 2));
       return;
@@ -7474,8 +7824,8 @@ browserProfile.command("sites <scope>").description("list the sites in a profile
     for (const s of sites) console.log(renderBrowserProfileSite(s));
   })
 );
-browserProfile.command("import <scope>").description("import saved browser state into a profile (workspace or private); reads Playwright storage state JSON from stdin or --file").option("--file <path>", "path to a Playwright storage state JSON file (reads stdin if omitted)").action(
-  run(async (scope, opts) => {
+browserProfile.command("import").description("import saved browser state into your browser; reads Playwright storage state JSON from stdin or --file").option("--file <path>", "path to a Playwright storage state JSON file (reads stdin if omitted)").action(
+  run(async (opts) => {
     let raw;
     if (opts.file) {
       const { readFileSync: rf } = await import("fs");
@@ -7488,21 +7838,26 @@ browserProfile.command("import <scope>").description("import saved browser state
       });
     }
     const state = JSON.parse(raw);
-    const result = await importBrowserProfileState(scope, { state });
+    const result = await importBrowserProfileState("mine", { state });
     console.log(`Imported ${result.sites.length} site${result.sites.length === 1 ? "" : "s"}: ${result.sites.join(", ")}`);
   })
 );
-browserProfile.command("remove-site <scope> <site>").description("remove a site from a profile (the agent will need to sign in again)").action(
-  run(async (scope, site) => {
-    await removeBrowserProfileSite(scope, site);
-    console.log(`Removed ${site} from ${scope}`);
+browserProfile.command("remove-site <site>").description("sign your browser out of a site everywhere (the agent will need to sign in again)").action(
+  run(async (site) => {
+    await removeBrowserProfileSite(site);
+    console.log(`Signed out of ${site}`);
+  })
+);
+browserProfile.command("share").description("share your browser in this workspace: with one member (--member <user id>) or everyone; every site unless --sites").option("--member <userId>", "the member to share with (default: everyone in the workspace)").option("--sites <sites>", "comma-separated sites to share (default: every site)").action(
+  run(async (opts) => {
+    const share = await shareBrowserProfile(opts.member, (opts.sites ?? "").split(",").map((s) => s.trim()).filter(Boolean));
+    console.log(renderBrowserProfileShare(share));
   })
 );
-browserProfile.command("move-site <scope> <site> <to>").description("move a site between profiles: <scope> is the current one, <to> is workspace or private").action(
-  run(async (scope, site, to) => {
-    if (to !== "workspace" && to !== "private") throw new ApiError(400, "invalid_request", "to must be workspace or private");
-    const result = await moveBrowserProfileSite(scope, site, to);
-    console.log(`Moved ${site} from ${scope} to ${result.to}`);
+browserProfile.command("unshare <shareId>").description("stop a share of your browser; it ends from the grantee's next turn").action(
+  run(async (shareId) => {
+    await unshareBrowserProfile(shareId);
+    console.log(`Stopped share ${shareId}`);
   })
 );
 var notifications = program.command("notifications").description("email and browser push notification preferences for tasks");
@@ -7562,21 +7917,21 @@ async function helpFetch(path) {
   return await res.json();
 }
 var help = program.command("help").description("search the AgentSky help center");
-help.command("search <query...>").description("search help articles by keyword").option("--top <n>", "how many results (1\u201320, default 5)", "5").option("--json", "print as JSON").action(
+help.command("search <query...>").description('search help articles: plain words rank them, "exact" or /regex/ list every matching line').option("--top <n>", "how many results (1\u201320, default 5)", "5").option("--json", "print as JSON").action(
   run(async (words, opts) => {
     const q = words.join(" ");
     const topK = Math.min(Math.max(parseInt(opts.top, 10) || 5, 1), 20);
-    const { results } = await helpFetch(`/api/help/search?q=${encodeURIComponent(q)}&top_k=${topK}`);
+    const { hits } = await helpFetch(`/api/context/search?${new URLSearchParams({ q, scope: "docs/", limit: String(topK) })}`);
     if (opts.json) {
-      console.log(JSON.stringify(results, null, 2));
+      console.log(JSON.stringify(hits, null, 2));
       return;
     }
-    if (!results.length) {
+    if (!hits.length) {
       console.log("no results");
       return;
     }
-    for (const r of results) console.log(`${r.slug.padEnd(40)} [${r.category}] ${r.title}
-  ${r.snippet.slice(0, 100)}`);
+    for (const hit of hits) console.log(`${String(hit.ref.slug).padEnd(40)} ${hit.title}
+  ${hit.snippet.slice(0, 100)}`);
   })
 );
 help.command("get <slug>").description("read a help article by its slug").option("--json", "print as JSON").action(
@@ -7591,6 +7946,85 @@ help.command("get <slug>").description("read a help article by its slug").option
     console.log(article.body);
   })
 );
+program.command("api <method> [path...]").description("call any AgentSky API operation (GET|POST|PUT|PATCH|DELETE <path>), or `sky api search <words\u2026>` to find one").option("-d, --data <json>", "JSON body: inline, @file, or - for stdin").option("-q, --query <key=value>", "query parameter (repeatable)", (v, acc) => [...acc, v], []).option("--workspace <slug>", "send the request in this workspace (X-Universe)").option("--idempotency-key <key>", "retry-safe key for a POST").option("-o, --output <file>", "save the body to a file (for downloads)").action(
+  run(async (method, rest, opts) => {
+    if (method.toLowerCase() === "search") return searchApi(rest);
+    if (rest.length !== 1) throw new Error("usage: sky api <METHOD> <path> (one path), or sky api search <words\u2026>");
+    return callApi(method, rest[0], opts);
+  })
+);
+agent.command("edit <id>").description("change an agent's name, engine, model or thinking level (as its Library folder does)").option("--name <name>", "new name").option("--engine <agentType>", "engine, e.g. CLAUDE_CODE, CODEX, HERMES").option("--model <llm>", "model id, e.g. anthropic/claude-sonnet-4-5").option("--thinking <effort>", 'reasoning effort, or "default" to clear the pin').action(
+  run(async (id, opts) => {
+    const body = {
+      ...opts.name ? { displayName: opts.name } : {},
+      ...opts.engine ? { agentType: opts.engine } : {},
+      ...opts.model ? { llm: opts.model } : {},
+      ...opts.thinking ? { reasoningEffort: opts.thinking === "default" ? null : opts.thinking } : {}
+    };
+    if (!Object.keys(body).length) throw new Error("pass at least one of --name, --engine, --model, --thinking");
+    const { agent: a } = await api("PATCH", `/agents/${encodeURIComponent(id)}`, body);
+    console.log(`${a.id} \u2014 ${a.displayName} \xB7 ${a.agentType} \xB7 ${a.llm}${a.reasoningEffort ? ` \xB7 ${a.reasoningEffort}` : ""}`);
+  })
+);
+skills.command("revisions <skillId>").description("a skill's saved versions, newest first").option("--json", "print as JSON").action(
+  run(async (skillId, opts) => {
+    const page = await api("GET", `/skills/${encodeURIComponent(skillId)}/revisions`);
+    const rows = page.revisions ?? [];
+    if (opts.json) return void console.log(JSON.stringify(rows, null, 2));
+    if (!rows.length) return void console.log("no versions");
+    for (const r of rows) console.log(`${r.id}  ${r.createdAt ?? r.created_at ?? ""}`);
+  })
+);
+skills.command("cat <skillId> <revisionId> <path>").description("print one file (e.g. SKILL.md) of a skill version").action(
+  run(async (skillId, revisionId, path) => {
+    const res = await apiRaw("GET", `/skills/${encodeURIComponent(skillId)}/revisions/${encodeURIComponent(revisionId)}/content?path=${encodeURIComponent(path)}`);
+    if (!res.ok) throw new ApiError(res.status, "http_error", await res.text() || `${res.status}`);
+    process.stdout.write(await res.text());
+  })
+);
+skills.command("rm <skillId>").description("delete a skill from the workspace").action(
+  run(async (skillId) => {
+    await api("DELETE", `/skills/${encodeURIComponent(skillId)}`);
+    console.log(`Deleted ${skillId}`);
+  })
+);
+var notes = program.command("notes").description("memory notes in the Library's memory stores: list, read, write (every save keeps a version)");
+notes.command("stores").description("the workspace's memory stores").action(
+  run(async () => {
+    const { memory_stores: stores } = await api("GET", "/memory_stores?limit=100");
+    if (!stores.length) return void console.log("no memory stores");
+    for (const st of stores) console.log(`${st.id}  ${st.name}`);
+  })
+);
+notes.command("list <storeId> [folder]").description("the notes in a store, optionally under a folder ending in /").action(
+  run(async (storeId, folder) => {
+    const q = folder ? `&path_prefix=${encodeURIComponent(folder)}` : "";
+    const { memories } = await api("GET", `/memory_stores/${encodeURIComponent(storeId)}/memories?limit=100${q}`);
+    if (!memories.length) return void console.log("no notes");
+    for (const n of memories) console.log(`${n.id}  ${n.path}`);
+  })
+);
+notes.command("read <storeId> <noteId>").description("print one note").action(
+  run(async (storeId, noteId) => {
+    const { memory: memory2 } = await api("GET", `/memory_stores/${encodeURIComponent(storeId)}/memories/${encodeURIComponent(noteId)}`);
+    process.stdout.write(memory2.content.endsWith("\n") ? memory2.content : `${memory2.content}
+`);
+  })
+);
+notes.command("save <storeId> <file>").description("write a note from a local file: --path creates one, --note saves a new version of one").option("--path <path>", "path of a new note, e.g. /projects/launch.md").option("--note <noteId>", "the note to update").action(
+  run(async (storeId, file, opts) => {
+    if (!opts.path === !opts.note) throw new Error("pass exactly one of --path (new note) or --note (update)");
+    const content = readFileSync19(file, "utf8");
+    const target = `/memory_stores/${encodeURIComponent(storeId)}/memories${opts.note ? `/${encodeURIComponent(opts.note)}` : ""}`;
+    const { memory: memory2 } = await api("POST", target, { content, ...opts.path ? { path: opts.path } : {} });
+    console.log(`Saved ${memory2.path} (${memory2.id})`);
+  })
+);
+workspace.command("context").description("what every session in the workspace loads at start: AGENTS.md, MEMORY.md, indexes, your member page").action(
+  run(async () => {
+    console.log(JSON.stringify(await api("GET", "/workspace-context"), null, 2));
+  })
+);
 var vault = program.command("vault").description("vaults: credentials a session is granted when it starts (values write-only)");
 vault.command("list").description("the workspace's vaults").action(
   run(async () => {
@@ -7680,7 +8114,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-ZRU624EY.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-WLTD4C22.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -7715,7 +8149,7 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-ZRU624EY.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-WLTD4C22.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -7728,14 +8162,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-ZRU624EY.js");
+  const { readState, flush, grantSender } = await import("./trace-WLTD4C22.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-ZRU624EY.js");
+  const { readState, spoolStatus } = await import("./trace-WLTD4C22.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -7745,7 +8179,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-ZRU624EY.js");
+  const { readState } = await import("./trace-WLTD4C22.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -7772,7 +8206,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-ZRU624EY.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-WLTD4C22.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -7782,7 +8216,7 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
 traceCmd.command("sync [payload]").description("upload this machine's agent sessions (Claude Code, Codex, Cursor, Gemini CLI and every other agent `--agents` lists) to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--import <export>", "add a downloaded cloud export (claude.ai, ChatGPT, Gemini, Grok, DeepSeek \u2026: its .zip, folder or file) so sync uploads it (repeatable)", collect).option("--agents", "list the agents sync reads and which are on this machine").option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-QOQUAL5H.js");
+  const lib = await import("./trace-library-YMAVLH4Y.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -7841,10 +8275,10 @@ traceCmd.command("sync [payload]").description("upload this machine's agent sess
       console.log(`Added ${imported.sessions} ${imported.agent} session${imported.sessions === 1 ? "" : "s"} from ${input}.`);
     }
     if (opts.installSchedule) {
-      const { join: join19 } = await import("path");
+      const { join: join20 } = await import("path");
       const { homedir: homedir10 } = await import("os");
       const { execFileSync } = await import("child_process");
-      const log = join19(homedir10(), ".config", "sky", "trace-sync.log");
+      const log = join20(homedir10(), ".config", "sky", "trace-sync.log");
       const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
       try {
         execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
@@ -7854,11 +8288,11 @@ traceCmd.command("sync [payload]").description("upload this machine's agent sess
       console.log(`Sweeping every 15 minutes (${plist}); a full re-read runs weekly. Log: ${log}`);
     }
     if (opts.status) {
-      const { readFileSync: readFileSync18 } = await import("fs");
-      const { join: join19 } = await import("path");
+      const { readFileSync: readFileSync20 } = await import("fs");
+      const { join: join20 } = await import("path");
       let state = { sessions: {} };
       try {
-        state = JSON.parse(readFileSync18(join19(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+        state = JSON.parse(readFileSync20(join20(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
       } catch {
       }
       const counts = /* @__PURE__ */ new Map();
@@ -7890,25 +8324,14 @@ traceCmd.command("sync [payload]").description("upload this machine's agent sess
     if (report.failed) process.exitCode = 1;
   })();
 });
-traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
-  const { libraryRequest } = await import("./trace-library-QOQUAL5H.js");
+traceCmd.command("search <query...>").description("search every session in a workspace's trace library: the one search with --scope traces").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", "20").option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
-  const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
-  const page = await libraryRequest("GET", `/context/search?${params}`, workspace2);
-  if (opts.json) {
-    console.log(JSON.stringify(page, null, 2));
-    return;
-  }
-  if (!page.hits.length) console.log(page.partial ? `No hits, but the search was cut short (${page.coverage}).` : "No hits.");
-  for (const { hit } of page.hits) {
-    console.log(`${hit.occurredAt?.slice(0, 16).replace("T", " ") ?? "                "}  ${hit.title}`);
-    console.log(`  ${hit.snippet.replace(/\s+/g, " ")}`);
-  }
-  if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
+  const page = await searchContext(words.join(" "), { ...opts, scope: "traces" }, workspace2);
+  console.log(opts.json ? JSON.stringify(page, null, 2) : renderContextPage(page));
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-QOQUAL5H.js");
+  const { libraryRequest } = await import("./trace-library-YMAVLH4Y.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);
@@ -8214,7 +8637,7 @@ session.command("code-review <id>").description("run the code-review assistant o
     }
   })
 );
-session.command("snapshot <id>").description("read or revoke the public share link for a session").requiredOption("--thread <threadId>", "the thread/comparison that owns this session").option("--revoke", "revoke the snapshot link instead of reading it").option("--json", "print as JSON").action(
+session.command("snapshot <id>").usage("<id> --thread <threadId> [--revoke] [--json]").description("read or revoke the public share link for a session; --thread is required").requiredOption("--thread <threadId>", "(required) the thread/comparison that owns this session").option("--revoke", "revoke the snapshot link instead of reading it").option("--json", "print as JSON").action(
   run(async (id, opts) => {
     const path = `/sessions/${encodeURIComponent(id)}/snapshot?thread=${encodeURIComponent(opts.thread)}`;
     const result = await api(opts.revoke ? "DELETE" : "GET", path);