@agentsky/sky 2.24.0 → 2.25.0

package/dist/index.js

@@ -9,8 +9,9 @@ import {
   postEvents,
   resolveSessionRef,
   streamEvents,
-  uploadFile
-} from "./chunk-UHMKEYJN.js";
+  uploadFile,
+  writeResponseFile
+} from "./chunk-QROAAJN2.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -21,7 +22,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-RAFHOB5S.js";
+} from "./chunk-LPUGEMCV.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -43,11 +44,11 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-277AZSSG.js";
+} from "./chunk-D3WG4BMK.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync13, readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync20, writeFileSync as writeFileSync10 } from "fs";
 import { basename as basename9, resolve as resolve9 } from "path";
 import { createInterface as createInterface6 } from "readline";
 import { Command } from "commander";
@@ -467,1886 +468,1898 @@ async function unsubscribeMarketing() {
   return { marketing: notification_preferences.email.marketing };
 }
 
-// src/context.ts
-function memoryBody(operation, version) {
-  return { ...operation, expectedVersion: version };
+// src/import-local.ts
+import { closeSync as closeSync3, existsSync as existsSync4, openSync as openSync3, readdirSync as readdirSync4, readFileSync as readFileSync6, readSync as readSync3, statSync as statSync5 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
+import { createHash as createHash3 } from "crypto";
+
+// src/import-files.ts
+import { isUtf8 } from "buffer";
+import { existsSync as existsSync3, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname3, extname as extname2, isAbsolute, join as join4, relative as relative2, resolve as resolve2, sep as sep2, basename as basename4 } from "path";
+
+// src/import-workspace.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync3, realpathSync, statSync as statSync3 } from "fs";
+import { homedir } from "os";
+import { basename as basename3, dirname as dirname2, join as join3, relative, sep } from "path";
+import { parse as parseToml } from "smol-toml";
+var MAX_TREE = 5e3;
+var SKILL_LINE = /Base directory for this skill: (\/[^\n\r"'\\<>]+)/g;
+function git(cwd, ...args) {
+  const run2 = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8", timeout: 1e4, maxBuffer: 32 * 1024 * 1024 });
+  return run2.status === 0 ? run2.stdout : null;
 }
-function memoryIndex(value) {
-  if (!/^\d+$/.test(value.trim())) throw new Error(`the entry number must be a whole number, got ${JSON.stringify(value)}`);
-  return Number(value.trim());
+var isFile = (path) => {
+  try {
+    return statSync3(path).isFile();
+  } catch {
+    return false;
+  }
+};
+var isDir = (path) => {
+  try {
+    return statSync3(path).isDirectory();
+  } catch {
+    return false;
+  }
+};
+function sharedInstructionPaths(home = homedir()) {
+  const rules = join3(home, ".agents", "rules");
+  let ruleFiles = [];
+  try {
+    ruleFiles = readdirSync2(rules).filter((name) => name.endsWith(".md")).sort().map((name) => join3(rules, name));
+  } catch {
+  }
+  return [join3(home, "AGENTS.md"), join3(home, "MEMORY.md"), ...ruleFiles].filter(isFile);
 }
-function renderMemory(document) {
-  if (!document.entries.length) return "no saved memory \u2014 `sky memory save <text>` adds an entry";
-  return document.entries.map((entry2) => `${String(entry2.index).padStart(3)}  ${entry2.text}`).join("\n");
+function strings(value, out, depth = 0) {
+  if (depth > 12) return;
+  if (typeof value === "string") out.push(value);
+  else if (Array.isArray(value)) for (const item of value) strings(item, out, depth + 1);
+  else if (value && typeof value === "object") for (const item of Object.values(value)) strings(item, out, depth + 1);
 }
-function searchQuery(query, opts) {
-  const params = new URLSearchParams({ q: query });
-  params.set("scope", opts.scope ?? "sessions");
-  if (opts.limit) params.set("limit", opts.limit);
-  if (opts.cursor) params.set("cursor", opts.cursor);
-  if (opts.since) params.set("since", opts.since);
-  if (opts.until) params.set("until", opts.until);
-  return `?${params.toString()}`;
+function skillRoots(cwd, home) {
+  const claude = process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude");
+  const codex = process.env.CODEX_HOME ?? join3(home, ".codex");
+  return [
+    ...cwd ? [join3(cwd, ".claude", "skills"), join3(cwd, ".agents", "skills")] : [],
+    join3(home, ".agents", "skills"),
+    join3(claude, "skills"),
+    join3(codex, "skills"),
+    join3(home, ".hermes", "skills")
+  ];
 }
-function refArgument(ref) {
-  return `'${JSON.stringify(ref).replace(/'/g, "'\\''")}'`;
+function pluginSkill(plugin, skill, home) {
+  const walk = (dir, depth, underPlugin) => {
+    if (depth > 7) return null;
+    let entries;
+    try {
+      entries = readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      return null;
+    }
+    for (const entry2 of entries) {
+      if (!entry2.isDirectory() || entry2.name === "node_modules" || entry2.name === ".git") continue;
+      const path = join3(dir, entry2.name);
+      if (entry2.name === skill && basename3(dir) === "skills" && (underPlugin || path.includes(`${sep}${plugin}${sep}`)) && isFile(join3(path, "SKILL.md"))) return realpathSync(path);
+      const found = walk(path, depth + 1, underPlugin);
+      if (found) return found;
+    }
+    return null;
+  };
+  return walk(join3(process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude"), "plugins"), 0, false) ?? walk(join3(home, "Library", "Application Support", "Claude", "local-agent-mode-sessions", "skills-plugin"), 0, true);
 }
-function renderContextPage(page) {
-  const lines = [];
-  for (const { hit } of page.hits) {
-    lines.push(`${hit.source.padEnd(8)} ${hit.occurredAt?.slice(0, 10) ?? "          "}  ${hit.title}`);
-    lines.push(`         ${hit.snippet.replace(/\s+/g, " ").slice(0, 160)}`);
-    lines.push(`         sky context read ${refArgument(hit.ref)}`);
+function findSkill(name, cwd, home) {
+  const [scope, skill] = name.includes(":") ? name.split(":", 2) : [null, name];
+  if (scope && skill) return pluginSkill(scope, skill, home);
+  for (const root of skillRoots(cwd, home)) {
+    const direct = join3(root, name);
+    if (isFile(join3(direct, "SKILL.md"))) return realpathSync(direct);
   }
-  if (!page.hits.length) lines.push("no matches on this page");
-  if (page.partial) lines.push(`partial: ${page.coverage ?? "not every source was searched"}`);
-  if (page.nextCursor) lines.push(`more: --cursor ${page.nextCursor}`);
-  return lines.join("\n");
+  return null;
 }
-
-// src/agent-file.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, resolve as resolve2 } from "path";
-import { parse as parseToml } from "smol-toml";
-var fileInstructionSchema = external_exports.object({
-  name: external_exports.string(),
-  content: external_exports.string().optional(),
-  file: external_exports.string().optional()
-});
-var agentFileSchema = external_exports.object({
-  name: external_exports.string().min(1),
-  id: external_exports.string().optional(),
-  // stamped by launch/deploy; identifies the live agent
-  slug: external_exports.string().optional(),
-  // pre-RFC-0079 stamp; ignored (agents are id-addressed)
-  description: external_exports.string().optional(),
-  type: external_exports.enum(AGENT_TYPES).optional(),
-  llm: external_exports.string().optional(),
-  reasoning_effort: external_exports.enum(REASONING_EFFORT_VALUES).optional(),
-  capabilities: capabilitiesSchema.removeDefault().optional(),
-  // omitted = leave the agent's as they are
-  prompt: external_exports.string().optional(),
-  prompt_file: external_exports.string().optional(),
-  instructions: external_exports.array(fileInstructionSchema).optional(),
-  skills: external_exports.array(skillRefSchema).optional(),
-  customData: external_exports.array(customDataSchema).optional(),
-  /** "deny" makes the agent work alone: its sessions may not hire helpers. */
-  hiring_policy: external_exports.enum(["allow", "deny"]).optional(),
-  /** The environment its sessions boot in when they name none. */
-  environment: external_exports.string().min(1).optional(),
-  /** Advanced machine shape (create-only): 1|2|4|8 vCPUs, 256MB-step memory. */
-  vcpus: external_exports.number().int().optional(),
-  memory_mb: external_exports.number().int().optional()
-});
-function readAgentFile(path) {
-  const raw = readFileSync3(path, "utf8");
-  const parsed = agentFileSchema.safeParse(parseToml(raw));
-  if (!parsed.success) {
-    const issue = parsed.error.issues[0];
-    throw new Error(`${path}: ${issue?.path.join(".") ?? ""} ${issue?.message ?? "invalid"}`);
+function loadedSkills(records, touched, cwd, home = homedir()) {
+  const dirs = /* @__PURE__ */ new Map();
+  const missing = /* @__PURE__ */ new Set();
+  const add = (dir, name = basename3(dir)) => {
+    if (!isFile(join3(dir, "SKILL.md"))) return false;
+    const real = realpathSync(dir);
+    if (![...dirs.values()].includes(real)) dirs.set(name, real);
+    return true;
+  };
+  const called = [];
+  for (const record of records) {
+    const texts = [];
+    strings(record, texts);
+    for (const text of texts) for (const match of text.matchAll(SKILL_LINE)) add(match[1].trim().replace(/[.,;:)]+$/, ""));
+    const content = record?.message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const block of content) {
+      const b = block;
+      if (b?.type === "tool_use" && b.name === "Skill" && typeof b.input?.skill === "string") called.push(b.input.skill.replace(/^\//, ""));
+    }
   }
-  const file = parsed.data;
-  if (file.reasoning_effort && file.type && !isModelEffortSupported(file.type, file.llm ?? defaultLlm(file.type), file.reasoning_effort)) {
-    throw new Error(
-      `${path}: reasoning_effort '${file.reasoning_effort}' is not available for ${file.type} \u2014 ${reasoningEffortDocLine()}`
-    );
+  for (const path of touched) if (basename3(path) === "SKILL.md") add(dirname2(path));
+  for (const name of called) {
+    if (!name || dirs.has(name) || [...dirs.keys()].some((key) => key.endsWith(`:${name}`) || name.endsWith(`:${key}`))) continue;
+    const dir = findSkill(name, cwd, home);
+    if (!dir || !add(dir, name)) missing.add(name);
   }
-  const base = dirname2(resolve2(path));
-  const inline = (ref, inlineContent) => {
-    if (inlineContent !== void 0) return inlineContent;
-    if (!ref) return void 0;
-    return readFileSync3(resolve2(base, ref), "utf8");
-  };
-  const spec = {
-    name: file.name,
-    description: file.description,
-    agentType: file.type,
-    llm: file.llm,
-    reasoningEffort: file.reasoning_effort,
-    displayName: file.name,
-    capabilities: file.capabilities,
-    prompt: inline(file.prompt_file, file.prompt),
-    instructions: file.instructions?.map((f) => {
-      const content = inline(f.file, f.content);
-      if (content === void 0) throw new Error(`instruction ${f.name}: content or file required`);
-      return { name: f.name, content };
-    }),
-    skills: file.skills,
-    customData: file.customData,
-    hiringPolicy: file.hiring_policy,
-    environmentId: file.environment,
-    vcpus: file.vcpus,
-    memoryMb: file.memory_mb
-  };
-  return { file, spec };
+  return { found: [...dirs].map(([name, dir]) => ({ name: name.replace(/[^A-Za-z0-9._:-]/g, "-"), dir })), missing: [...missing] };
 }
-function stampId(path, id) {
-  writeFileSync2(path, stampIdText(readFileSync3(path, "utf8"), id));
+function readJson(path) {
+  try {
+    const value = JSON.parse(readFileSync3(path, "utf8"));
+    return value && typeof value === "object" ? value : null;
+  } catch {
+    return null;
+  }
 }
-function stampIdText(text, id) {
+function names(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const keys2 = Object.keys(value).sort();
+  return keys2.length ? keys2 : void 0;
+}
+function safeUrl(raw) {
+  try {
+    const url = new URL(raw);
+    if (!/^https?:$/.test(url.protocol)) return null;
+    const query = [.../* @__PURE__ */ new Set([...url.searchParams.keys()])].sort();
+    return { url: `${url.protocol}//${url.host}${url.pathname}`, ...query.length ? { query } : {} };
+  } catch {
+    return null;
+  }
+}
+function serverEntry(name, def, scope) {
+  if (!def || typeof def !== "object") return null;
+  const env = names(def.env);
+  const headers = names(def.headers ?? def.http_headers);
+  if (typeof def.url === "string") {
+    const url = safeUrl(def.url);
+    if (!url) return null;
+    const type = def.type === "sse" ? "sse" : "http";
+    return { name, scope, transport: type, ...url, ...headers ? { headers } : {}, ...env ? { env } : {} };
+  }
+  if (typeof def.command !== "string" || !def.command) return null;
+  const args = Array.isArray(def.args) ? def.args.filter((arg) => typeof arg === "string") : [];
+  return { name, scope, transport: "stdio", command: def.command, ...args.length ? { args } : {}, ...env ? { env } : {} };
+}
+function mcpServers(harness2, cwd, home = homedir()) {
   const out = [];
-  let topLevel = true;
-  let openString = null;
-  let stamped = false;
-  let nameAt = -1;
-  for (const line of text.split("\n")) {
-    if (openString) {
-      if (line.includes(openString)) openString = null;
-      out.push(line);
-      continue;
+  const push = (servers, scope) => {
+    if (!servers || typeof servers !== "object") return;
+    for (const [name, def] of Object.entries(servers)) {
+      const entry2 = serverEntry(name, def, scope);
+      if (entry2 && !out.some((existing) => existing.name === name)) out.push(entry2);
     }
-    if (/^\s*\[/.test(line)) topLevel = false;
-    if (topLevel && /^\s*(id|slug)\s*=/.test(line)) {
-      if (/^\s*id\s*=/.test(line) && !stamped) {
-        out.push(`id = ${JSON.stringify(id)}`);
-        stamped = true;
-      }
-      continue;
+  };
+  if (harness2 === "claude_code") {
+    const config = readJson(join3(process.env.CLAUDE_CONFIG_DIR ? dirname2(process.env.CLAUDE_CONFIG_DIR) : home, ".claude.json"));
+    const projects = config?.projects && typeof config.projects === "object" ? config.projects : {};
+    const root = cwd ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || cwd : "";
+    if (cwd) push(projects[cwd]?.mcpServers ?? projects[root]?.mcpServers, "local");
+    if (root) push(readJson(join3(root, ".mcp.json"))?.mcpServers, "project");
+    push(config?.mcpServers, "user");
+  }
+  if (harness2 === "codex") {
+    try {
+      const config = parseToml(readFileSync3(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "config.toml"), "utf8"));
+      push(config.mcp_servers, "user");
+    } catch {
     }
-    if (topLevel && nameAt < 0 && /^\s*name\s*=/.test(line)) nameAt = out.length;
-    const opener = /=\s*("""|''')/.exec(line);
-    if (opener && !line.slice(opener.index + opener[0].length).includes(opener[1])) openString = opener[1];
-    out.push(line);
   }
-  if (!stamped) out.splice(nameAt + 1, 0, `id = ${JSON.stringify(id)}`);
-  const next = out.join("\n");
-  if (parseToml(next).id !== id) throw new Error("could not stamp the agent id into the file");
-  return next;
+  return out;
 }
-function scaffoldAgentFile(path, name) {
-  if (existsSync2(path)) throw new Error(`${path} already exists`);
-  writeFileSync2(
-    path,
-    `# agent.toml \u2014 everything the create wizard can set. Only \`name\` is required.
-name = "${name}"
-# type = "pi"                  # pi (default) | hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode
-# llm = "deepseek-flash"       # must be compatible with type
-# reasoning_effort = "high"    # per harness \u2014 ${reasoningEffortDocLine()}
-# capabilities = []
-# hiring_policy = "deny"       # its sessions work alone; "allow" (default) lets them hire helpers
-# environment = "env_..."      # the environment its sessions boot in when they name none
-# [[skills]]                   # a skill from \`sky skills upload <dir>\`
-# type = "skill"
-# skillId = "skill_..."
-
-prompt = """
-You are ${name}, a helpful long-lived agent.
-"""
-`
-  );
+function remoteWithoutCredentials(remote) {
+  return remote.trim().replace(/\/\/[^@/]+@/, "//").replace(/^[^@/]+@([^:]+):/, "$1:");
 }
-function deployPatch(spec) {
+function workspaceState(cwd, harness2, skills2, home = homedir(), title = null) {
+  const present = !!cwd && isDir(cwd);
+  const root = present ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || null : null;
+  let gitState = null;
+  let tree = [];
+  let patch = null;
+  if (root) {
+    const dirty = (git(root, "status", "--porcelain=v1", "--untracked-files=normal") ?? "").split("\n").filter(Boolean).map((line) => line.slice(3));
+    const ahead = git(root, "rev-list", "--count", "@{upstream}..HEAD");
+    const remote = git(root, "remote", "get-url", "origin");
+    const branch = git(root, "rev-parse", "--abbrev-ref", "HEAD")?.trim() || null;
+    gitState = {
+      remote: remote ? remoteWithoutCredentials(remote) : null,
+      branch: branch === "HEAD" ? null : branch,
+      commit: git(root, "rev-parse", "HEAD")?.trim() || null,
+      dirty: dirty.slice(0, 500),
+      ahead: ahead === null ? null : Number(ahead.trim()) || 0
+    };
+    tree = (git(cwd, "-c", "core.quotePath=false", "ls-files") ?? "").split("\n").filter(Boolean);
+    if (dirty.length) patch = git(cwd, "diff", "HEAD", "--no-color", "--no-ext-diff", "--relative", "--", ".") || null;
+  }
   return {
-    displayName: spec.displayName,
-    ...spec.agentType ? { agentType: spec.agentType } : {},
-    ...spec.llm ? { llm: spec.llm } : {},
-    ...spec.capabilities ? { capabilities: spec.capabilities } : {},
-    ...spec.reasoningEffort ? { reasoningEffort: spec.reasoningEffort } : {},
-    ...spec.skills ? { skills: spec.skills } : {},
-    ...spec.hiringPolicy ? { hiringPolicy: spec.hiringPolicy } : {},
-    ...spec.environmentId ? { environmentId: spec.environmentId } : {}
+    manifest: {
+      format: "agentsky.import-workspace",
+      format_version: 1,
+      harness: harness2,
+      title: title?.trim().slice(0, 120) || null,
+      cwd: cwd ? cwd.replace(home, "~") : null,
+      project: cwd ? basename3(root ?? cwd) : null,
+      git: gitState,
+      tree: tree.slice(0, MAX_TREE),
+      tree_truncated: tree.length > MAX_TREE,
+      skills: [...skills2.found.map((skill) => ({ name: skill.name, found: true })), ...skills2.missing.map((name) => ({ name, found: false }))],
+      mcp_servers: mcpServers(harness2, cwd, home)
+    },
+    patch
   };
 }
-function deployReport(id, spec, before, after, promptChanged) {
-  if (spec.agentType && after.agentType !== spec.agentType) {
-    throw new Error(`${id} is still ${after.agentType}: the API did not apply type = "${spec.agentType}"`);
-  }
-  if (spec.llm && after.llm !== spec.llm) {
-    throw new Error(`${id} still runs ${after.llm}: the API did not apply llm = "${spec.llm}"`);
-  }
-  const changed = [];
-  if (promptChanged) changed.push("prompt");
-  if (after.version !== before.version) changed.push("settings");
-  if (!changed.length) return [`${id} is up to date \u2014 nothing to deploy (version ${after.version})`];
-  const lines = [`Deployed ${id}: ${changed.join(" and ")} updated (version ${before.version} \u2192 ${after.version})`];
-  if (after.agentType !== before.agentType || after.llm !== before.llm) {
-    lines.push(`  now ${after.agentType} \xB7 ${after.llm} for new sessions (was ${before.agentType} \xB7 ${before.llm})`);
-  }
-  if (spec.skills && after.version !== before.version) {
-    lines.push(`  Skills apply to new sessions; running sessions keep the skills they started with \u2014 start one with \`sky session create ${id}\`.`);
+function skillFiles(skill) {
+  const out = [];
+  const walk = (dir, depth) => {
+    if (depth > 8 || out.length > 400) return;
+    let entries;
+    try {
+      entries = readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry2 of entries) {
+      if (entry2.name === "node_modules" || entry2.name === ".git" || entry2.name === "__pycache__" || entry2.name === ".venv") continue;
+      const path = join3(dir, entry2.name);
+      if (entry2.isDirectory()) walk(path, depth + 1);
+      else if (entry2.isFile()) out.push({ path, name: `skills/${skill.name}/${relative(skill.dir, path).split(sep).join("/")}` });
+    }
+  };
+  if (existsSync2(skill.dir)) walk(skill.dir, 0);
+  return out;
+}
+function codexThreadName(sessionId, home = homedir()) {
+  let name = null;
+  try {
+    for (const line of readFileSync3(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "session_index.jsonl"), "utf8").split("\n")) {
+      if (!line.includes(sessionId)) continue;
+      try {
+        const entry2 = JSON.parse(line);
+        if (entry2.id === sessionId && typeof entry2.thread_name === "string" && entry2.thread_name.trim()) name = entry2.thread_name.trim();
+      } catch {
+      }
+    }
+  } catch {
   }
-  return lines;
+  return name;
 }
 
-// src/catalog.ts
-var bare = (handle) => handle.replace(/^@/, "");
-var optionalAuth = () => ({ auth: Boolean(apiToken()) });
-function catalogQuery(filter) {
-  const params = new URLSearchParams();
-  if (filter.text?.trim()) params.set("q", filter.text.trim());
-  if (filter.category) params.set("category", filter.category);
-  const query = params.toString();
-  return query ? `?${query}` : "";
+// src/import-files.ts
+var MAX_ATTACHED_FILE_BYTES = 10 * 1024 * 1024;
+var SECRET_FILE = /(^|\/)(\.env(\..*)?|\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.?credentials(\.json)?|auth\.json|\.claude\.json|id_(rsa|ed25519|ecdsa)[^/]*|.*\.(pem|key|p12|pfx|keystore|jks|kdbx|sqlite|db))$|\/\.ssh\/|\/\.aws\/|\/\.gnupg\/|\/\.docker\/config\.json$|\/Keychains\//i;
+var SKIP_DIR = /(^|\/)(node_modules|\.git|\.next|dist|build|__pycache__|\.venv)(\/|$)/;
+var INSTRUCTION_FILES = ["CLAUDE.md", "AGENTS.md", "HERMES.md", "GEMINI.md", ".cursorrules"];
+var DOCUMENTS = {
+  ".pdf": "application/pdf",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".doc": "application/msword",
+  ".rtf": "application/rtf",
+  ".odt": "application/vnd.oasis.opendocument.text"
+};
+var IMAGES = { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp" };
+var TEXT = {
+  ".md": "text/markdown",
+  ".mdx": "text/markdown",
+  ".txt": "text/plain",
+  ".csv": "text/csv",
+  ".tsv": "text/tab-separated-values",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".css": "text/css",
+  ".scss": "text/css",
+  ".json": "application/json",
+  ".jsonl": "application/x-ndjson",
+  ".ndjson": "application/x-ndjson",
+  ".yaml": "application/yaml",
+  ".yml": "application/yaml",
+  ".toml": "application/toml",
+  ".xml": "application/xml",
+  ".sql": "application/sql",
+  ".svg": "image/svg+xml",
+  ".js": "application/javascript",
+  ".mjs": "application/javascript",
+  ".cjs": "application/javascript",
+  ".py": "text/x-python",
+  ".sh": "text/x-shellscript",
+  ".bash": "text/x-shellscript",
+  ".zsh": "text/x-shellscript"
+};
+var PLAIN_TEXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".jsx", ".mts", ".cts", ".go", ".rs", ".java", ".kt", ".swift", ".rb", ".php", ".c", ".h", ".cc", ".cpp", ".hpp", ".cs", ".scala", ".lua", ".r", ".m", ".tex", ".bib", ".ipynb", ".prisma", ".graphql", ".proto", ".ini", ".cfg", ".conf", ".log", ".rst", ".vue", ".svelte", ".astro", ".tf", ".hcl", ".gradle", ".lock", ".patch", ".diff"]);
+var PLAIN_NAMES = /* @__PURE__ */ new Set(["Dockerfile", "Makefile", "Procfile", "Gemfile", "Rakefile", "LICENSE", "README", ".cursorrules", ".gitignore", ".dockerignore", ".editorconfig", ".prettierrc", ".eslintrc"]);
+function classify(path) {
+  const ext = extname2(path).toLowerCase();
+  if (DOCUMENTS[ext]) return { kind: "document", mediaType: DOCUMENTS[ext] };
+  if (IMAGES[ext]) return { kind: "image", mediaType: IMAGES[ext] };
+  if (TEXT[ext]) return { kind: "text", mediaType: TEXT[ext] };
+  if (PLAIN_TEXT.has(ext) || PLAIN_NAMES.has(basename4(path))) return { kind: "text", mediaType: "text/plain" };
+  return null;
 }
-function listingBody(agentId, options) {
-  return {
-    agent_id: agentId,
-    handle: bare(options.handle),
-    tagline: options.tagline,
-    ...options.description ? { description: options.description } : {},
-    ...options.category?.length ? { categories: options.category } : {},
-    ...options.does?.length ? { does: options.does } : {},
-    ...options.doesNot?.length ? { does_not: options.doesNot } : {},
-    ...options.example?.length ? { examples: options.example } : {}
+var SHELL_READ = /(?:^|[\s;&|(`"'])(?:cat|head|tail|nl|less|more|wc|bat|sed\s+-n\s+(?:'[^']*'|"[^"]*"|\S+))(?:\s+-[\w-]+(?:\s+\d+)?)*\s+((?:~|\.{0,2}\/)?[\w@%+./~-]*[\w-]\.[\w]{1,10}|\/[\w@%+./-]+)/g;
+var PATH_KEYS = ["file_path", "path", "notebook_path", "filePath", "target_file"];
+var obj = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var str = (value) => typeof value === "string" ? value : "";
+function shellText(input) {
+  if (typeof input === "string") return input;
+  const i = obj(input);
+  if (!i) return "";
+  const command = Array.isArray(i.command) ? i.command.filter((part) => typeof part === "string").join(" ") : str(i.command);
+  return [command, str(i.cmd), str(i.script)].filter(Boolean).join("\n");
+}
+function touchedPaths(records, cwd, home = homedir2()) {
+  const out = /* @__PURE__ */ new Set();
+  const add = (raw, base) => {
+    if (!raw || raw.length > 1e3) return;
+    const path = raw.replace(/^~(?=\/)/, home);
+    if (isAbsolute(path)) out.add(resolve2(path));
+    else if (base) out.add(resolve2(base, path));
+  };
+  const call = (name, input) => {
+    const i = obj(input);
+    const base = str(i?.workdir) || str(i?.cwd) || cwd;
+    if (i) for (const key of PATH_KEYS) add(str(i[key]), base);
+    const patch = typeof input === "string" ? input : str(i?.input) || str(i?.patch);
+    for (const match of patch.matchAll(/^\*\*\* (?:Add|Update) File: (.+)$/gm)) add(match[1].trim(), base);
+    if (!/bash|shell|exec|terminal|command|run/i.test(name)) return;
+    for (const match of shellText(input).replace(/\\n/g, "\n").matchAll(SHELL_READ)) add(match[1], base);
   };
+  for (const raw of records) {
+    const record = obj(raw);
+    if (!record) continue;
+    const content = obj(record.message)?.content;
+    if (record.type === "assistant" && Array.isArray(content)) {
+      for (const block of content) {
+        const b = obj(block);
+        if (b?.type === "tool_use") call(str(b.name), b.input);
+      }
+    }
+    const payload = obj(record.payload);
+    if (record.type === "response_item" && (payload?.type === "function_call" || payload?.type === "custom_tool_call")) {
+      let input = payload.arguments ?? payload.input ?? "";
+      if (typeof input === "string") {
+        try {
+          input = JSON.parse(input);
+        } catch {
+          input = payload.arguments ?? payload.input;
+        }
+      }
+      call(str(payload.name), input);
+    }
+  }
+  return [...out];
 }
-async function listCatalog(filter = {}) {
-  return (await api("GET", `/catalog/agents${catalogQuery(filter)}`, void 0, optionalAuth())).agents;
+function gitRoot(dir) {
+  for (let d = dir; ; d = dirname3(d)) {
+    if (existsSync3(join4(d, ".git"))) return d;
+    if (d === dirname3(d)) return null;
+  }
 }
-async function showCatalogAgent(handle) {
-  return (await api("GET", `/catalog/agents/${encodeURIComponent(bare(handle))}`, void 0, optionalAuth())).agent;
+function instructionPaths(cwd, harness2, home = homedir2()) {
+  const out = [];
+  if (cwd && existsSync3(cwd)) {
+    const root = gitRoot(cwd) ?? cwd;
+    for (let d = resolve2(cwd); ; d = dirname3(d)) {
+      for (const name of INSTRUCTION_FILES) out.push(join4(d, name));
+      if (d === root || d === dirname3(d)) break;
+    }
+  }
+  if (harness2 === "claude_code") out.push(join4(process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude"), "CLAUDE.md"));
+  if (harness2 === "codex") out.push(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "AGENTS.md"));
+  out.push(...sharedInstructionPaths(home));
+  return out.filter((path) => {
+    try {
+      return statSync4(path).isFile();
+    } catch {
+      return false;
+    }
+  });
 }
-async function listCategories() {
-  return (await api("GET", "/catalog/categories", void 0, { auth: false })).categories;
+function resourceName(path, cwd, home = homedir2()) {
+  const inside = cwd ? relative2(resolve2(cwd), path) : "";
+  if (cwd && inside && !inside.startsWith("..") && !isAbsolute(inside)) return `workspace/${inside.split(sep2).join("/")}`;
+  const underHome = relative2(home, path);
+  const shown = !underHome.startsWith("..") && !isAbsolute(underHome) ? `~/${underHome}` : path.replace(/^\/+/, "");
+  return `files/${shown.split(sep2).join("/")}`;
 }
-async function publishListing(agentId, options) {
-  return (await api("POST", "/catalog/listings", listingBody(agentId, options))).agent;
+var ORDER = { text: 0, document: 1, image: 2 };
+function resourceLine(name, mediaType, data) {
+  return redactLine(JSON.stringify({ type: "import.resource", name, media_type: mediaType, data: data.toString("base64") }), { requireStructured: true }).line + "\n";
 }
-async function removeListing(handle) {
-  await api("DELETE", `/catalog/listings/${encodeURIComponent(bare(handle))}`);
+function collectSessionFiles(records, opts) {
+  const home = opts.home ?? homedir2();
+  const exclude = new Set((opts.exclude ?? []).map((path) => resolve2(path)));
+  const leftOut = [];
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  const touched = touchedPaths(records, opts.cwd, home);
+  const skills2 = loadedSkills(records, touched, opts.cwd, home);
+  const consider = (path, name) => {
+    if (seen.has(path) || exclude.has(path)) return;
+    seen.add(path);
+    if (SECRET_FILE.test(path) || SKIP_DIR.test(path)) {
+      leftOut.push({ path, reason: "credential or build file" });
+      return;
+    }
+    let size;
+    try {
+      const stat = statSync4(path);
+      if (!stat.isFile()) return;
+      size = stat.size;
+    } catch {
+      leftOut.push({ path, reason: "missing" });
+      return;
+    }
+    const type = classify(path);
+    if (!type) {
+      leftOut.push({ path, reason: "unsupported type" });
+      return;
+    }
+    if (size > MAX_ATTACHED_FILE_BYTES) {
+      leftOut.push({ path, reason: "too large" });
+      return;
+    }
+    candidates.push({ path, name, ...type, size });
+  };
+  for (const path of [...instructionPaths(opts.cwd, opts.harness, home), ...touched]) consider(path, resourceName(path, opts.cwd, home));
+  for (const skill of skills2.found) for (const file of skillFiles(skill)) consider(file.path, file.name);
+  candidates.sort((a, b) => ORDER[a.kind] - ORDER[b.kind] || a.size - b.size);
+  const lines = [];
+  const attached = [];
+  let bytes = 0;
+  const state = workspaceState(opts.cwd, opts.harness, skills2, home, opts.title ?? null);
+  const described = !!opts.cwd || !!state.manifest.title || state.manifest.skills.length > 0 || state.manifest.mcp_servers.length > 0;
+  const generated = [
+    ...described ? [{ name: "agentsky/workspace.json", mediaType: "application/json", data: Buffer.from(JSON.stringify(state.manifest, null, 2)) }] : [],
+    ...state.patch ? [{ name: "agentsky/uncommitted.patch", mediaType: "text/x-diff", data: Buffer.from(state.patch) }] : []
+  ];
+  for (const file of generated) {
+    let line;
+    try {
+      line = resourceLine(file.name, file.mediaType, file.data);
+    } catch {
+      leftOut.push({ path: file.name, reason: "could not be redacted safely" });
+      continue;
+    }
+    const size = Buffer.byteLength(line);
+    if (bytes + size > opts.budget) {
+      leftOut.push({ path: file.name, reason: "over the upload budget" });
+      continue;
+    }
+    bytes += size;
+    lines.push(line);
+    attached.push({ name: file.name, kind: "text", bytes: file.data.length });
+  }
+  for (const file of candidates) {
+    let data;
+    try {
+      data = readFileSync4(file.path);
+    } catch {
+      leftOut.push({ path: file.path, reason: "missing" });
+      continue;
+    }
+    if (file.kind === "text" && data.includes(0)) {
+      leftOut.push({ path: file.path, reason: "not valid UTF-8 text" });
+      continue;
+    }
+    let line;
+    try {
+      line = resourceLine(file.name, file.mediaType, data);
+    } catch {
+      leftOut.push({ path: file.path, reason: file.kind === "text" && !isUtf8(data) ? "not valid UTF-8 text" : "could not be redacted safely" });
+      continue;
+    }
+    const size = Buffer.byteLength(line);
+    if (bytes + size > opts.budget) {
+      leftOut.push({ path: file.path, reason: "over the upload budget" });
+      continue;
+    }
+    bytes += size;
+    lines.push(line);
+    attached.push({ name: file.name, kind: file.kind, bytes: data.length });
+  }
+  const setup = {
+    skills: skills2.found.map((skill) => skill.name),
+    missingSkills: skills2.missing,
+    mcpServers: state.manifest.mcp_servers.map((server) => server.name),
+    git: state.manifest.git !== null
+  };
+  return { lines, bytes, attached, leftOut, setup };
 }
-async function setEngineStatus(engine, status, reason) {
-  await api("PATCH", `/catalog/engines/${encodeURIComponent(engine)}`, { status, reason });
-  const state = await api("GET", "/catalog/engines", void 0, { auth: false });
-  if (state.delisted.includes(engine) !== (status === "delisted")) {
-    throw new Error("The catalog does not show the requested state; check whether another operator changed it.");
+
+// src/import-environment.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import { closeSync as closeSync2, createWriteStream, lstatSync, mkdtempSync, openSync as openSync2, readdirSync as readdirSync3, readFileSync as readFileSync5, readSync as readSync2, rmSync as rmSync2 } from "fs";
+import { tmpdir } from "os";
+import { join as join5 } from "path";
+import { isUtf8 as isUtf82 } from "buffer";
+import { createGzip } from "zlib";
+
+// ../../packages/spec/src/import-layout.ts
+import { gzipSync } from "zlib";
+function folderName(workspace2, sourceCwd) {
+  const raw = workspace2?.project || (sourceCwd ? sourceCwd.split("/").filter(Boolean).pop() : "") || "";
+  const cleaned = raw.replace(/[^A-Za-z0-9._ -]/g, "-").replace(/^[^A-Za-z0-9_]+/, "").replace(/\.\.+/g, ".").slice(0, 80).trim();
+  return cleaned || "imported-session";
+}
+function envName(server, field) {
+  return `${server}_${field}`.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+function ownServer(server, platform) {
+  try {
+    return server.transport !== "stdio" && platform.ownHost.test(new URL(server.url ?? "").hostname);
+  } catch {
+    return false;
   }
 }
-var uses = (agent2) => `${agent2.stats.uses} ${agent2.stats.uses === 1 ? "use" : "uses"}`;
-var mine = (agent2) => agent2.visibility === "workspace" ? "  (yours)" : "";
-function renderCatalogAgent(agent2) {
-  const section = (title, lines) => lines.length ? [`${title}:`, ...lines.map((line) => `  - ${line}`)] : [];
+function mcpJson(servers, platform) {
+  const entries = servers.filter((server) => !ownServer(server, platform)).map((server) => {
+    if (server.transport === "stdio") {
+      return [server.name, {
+        command: server.command,
+        ...server.args?.length ? { args: server.args } : {},
+        ...server.env?.length ? { env: Object.fromEntries(server.env.map((name) => [name, `\${${name}:-}`])) } : {}
+      }];
+    }
+    const query = server.query?.length ? `?${server.query.map((name) => `${encodeURIComponent(name)}=\${${envName(server.name, name)}:-}`).join("&")}` : "";
+    return [server.name, {
+      type: server.transport,
+      url: `${server.url}${query}`,
+      ...server.headers?.length ? { headers: Object.fromEntries(server.headers.map((name) => [name, `\${${envName(server.name, name)}:-}`])) } : {}
+    }];
+  });
+  return JSON.stringify({ mcpServers: Object.fromEntries(entries) }, null, 2) + "\n";
+}
+function bullet(items, none) {
+  return items.length ? items.map((item) => `- ${item}`).join("\n") : `- ${none}`;
+}
+function readme(folder, workspace2, counts, skills2, mcpWritten, platform) {
+  const git2 = workspace2?.git;
+  const servers = workspace2?.mcp_servers ?? [];
+  const missingSkills = (workspace2?.skills ?? []).filter((skill) => !skill.found).map((skill) => skill.name);
+  const secrets2 = servers.filter((server) => !ownServer(server, platform)).flatMap((server) => [
+    ...server.env ?? [],
+    ...(server.headers ?? []).map((name) => envName(server.name, name)),
+    ...(server.query ?? []).map((name) => envName(server.name, name))
+  ]);
+  const where = workspace2?.cwd ? ` (${workspace2.cwd})` : "";
   return [
-    `@${agent2.handle}  ${agent2.name}${mine(agent2)}`,
-    agent2.tagline,
-    ...agent2.description && agent2.description !== agent2.tagline ? ["", agent2.description] : [],
+    "# Imported working copy",
     "",
-    `Categories: ${agent2.categories.join(", ") || "none"}`,
-    `Used: ${uses(agent2)}`,
-    ...section("Does", agent2.does),
-    ...section("Does not", agent2.does_not),
-    ...section("Examples", agent2.examples),
+    `This folder (/workspace/${folder}) holds what the imported conversation worked with on the person's computer.`,
+    "It is historical context: verify a path before acting on it, and follow the person's current message.",
     "",
-    `Hire it: sky session create @${agent2.handle} --message "\u2026"`
+    "## Files",
+    counts.wholeFolder ? `- The whole working directory${where}, ${counts.project} files at the same relative paths: its tracked files and new files git does not ignore (every file when it is not a repository), without version-control data, dependency and build output, or credential files.` : `- ${counts.project} files from the original working directory${where}, at the same relative paths: the files the conversation read, wrote or edited and its instruction files. The rest of the working tree did not travel${workspace2?.tree?.length ? `; its full file list is in ${platform.notesDir}/workspace.json (\`tree\`)` : ""}.`,
+    ...counts.outside ? [`- ${counts.outside} files from elsewhere on that computer (shared instructions such as ~/AGENTS.md, and files outside the working directory) under ${platform.notesDir}/files/, with ~ as home/.`] : [],
+    ...counts.attachments ? [`- ${counts.attachments} attachments of the conversation under ${platform.notesDir}/attachments/.`] : [],
+    "- Text was redacted on that computer before upload: a masked value (\u25CF\u25CF\u25CF\u25CF\u25CF) is a secret that was removed, not the real content.",
+    "",
+    "## Repository",
+    ...git2 ? [
+      `- Remote: ${git2.remote ?? "none"}`,
+      `- Branch: ${git2.branch ?? "detached"} at commit ${git2.commit ?? "unknown"}${git2.ahead ? ` (${git2.ahead} commits not pushed)` : ""}`,
+      ...git2.dirty?.length ? [`- Uncommitted changes in ${git2.dirty.length} paths${counts.wholeFolder ? " are already in these files" : ""}; the change against that commit is ${platform.notesDir}/uncommitted.patch (apply with \`git apply\` on a checkout of that commit).`] : ["- No uncommitted changes."],
+      counts.wholeFolder ? "- This folder's own git history starts with this copy; the project's history is on the remote." : `- To get the whole repository, clone the remote at that commit (connect GitHub in ${platform.name} if it is private), apply the patch, then use the files here.`
+    ] : ["- The working directory was not a git repository."],
+    "",
+    "## Skills",
+    bullet(skills2.map((name) => `${name}: .claude/skills/${name}/SKILL.md (also .agents/skills/${name}/)`), "No skills were loaded."),
+    ...missingSkills.length ? ["", `Loaded but no longer on that computer, so not carried: ${missingSkills.join(", ")}.`] : [],
+    "",
+    "## Tool servers (MCP)",
+    bullet(servers.map((server) => `${server.name} (${server.transport}${server.scope ? `, ${server.scope}` : ""}): ${server.transport === "stdio" ? [server.command, ...server.args ?? []].join(" ") : server.url}`), "None were configured."),
+    ...mcpWritten ? ["", `They are written to .mcp.json in this folder with every key as \${NAME:-}, except ${platform.name}'s own server, whose tools this session already has. Their values never leave the person's computer${secrets2.length ? `; these must be supplied to use them: ${[...new Set(secrets2)].join(", ")}` : ""}. A stdio server runs only if its command is installed here, and Claude Code connects a project server only once it is approved.`] : [],
+    ""
   ].join("\n");
 }
-
-// src/clone.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { homedir } from "os";
-import { basename as basename3, join as join3 } from "path";
-import { createInterface } from "readline";
-var PROMPT_CAP = 1e5;
-var HARNESSES = ["claude_code", "codex", "openclaw"];
-function claudeConfigRoot() {
-  return process.env.CLAUDE_CONFIG_DIR ?? join3(homedir(), ".claude");
-}
-function readIfExists(path) {
+function parseWorkspace(file) {
+  if (!file) return null;
   try {
-    return readFileSync4(path, "utf8");
+    const value = JSON.parse(file.data.toString("utf8"));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
   } catch {
-    return void 0;
+    return null;
   }
 }
-function readJson(path) {
-  const raw = readIfExists(path);
-  if (raw === void 0) return void 0;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return void 0;
+function importLayout(files2, sourceCwd, platform, wholeFolder) {
+  if (!files2.length && !wholeFolder) return null;
+  const workspace2 = parseWorkspace(files2.find((file) => file.name === "agentsky/workspace.json"));
+  const folder = folderName(workspace2, sourceCwd);
+  const entries = /* @__PURE__ */ new Map();
+  const skills2 = /* @__PURE__ */ new Set();
+  const counts = { project: wholeFolder?.files ?? 0, outside: 0, attachments: 0, wholeFolder: Boolean(wholeFolder) };
+  for (const file of files2) {
+    const [kind, ...rest] = file.name.split("/");
+    const path = rest.join("/");
+    if (kind === "workspace") {
+      if (wholeFolder) continue;
+      entries.set(path, file.data);
+      counts.project += 1;
+    } else if (kind === "files") {
+      entries.set(`${platform.notesDir}/files/${path.replace(/^~\//, "home/")}`, file.data);
+      counts.outside += 1;
+    } else if (kind === "imported-attachments") {
+      entries.set(`${platform.notesDir}/attachments/${path}`, file.data);
+      counts.attachments += 1;
+    } else if (kind === "agentsky") entries.set(`${platform.notesDir}/${path}`, file.data);
+    else if (kind === "skills" && rest.length > 1) {
+      const skill = rest[0].split(":").pop();
+      const inside = rest.slice(1).join("/");
+      skills2.add(skill);
+      entries.set(`.claude/skills/${skill}/${inside}`, file.data);
+      entries.set(`.agents/skills/${skill}/${inside}`, file.data);
+    }
   }
+  const servers = (workspace2?.mcp_servers ?? []).filter((server) => server && typeof server.name === "string" && (server.transport === "stdio" ? typeof server.command === "string" : typeof server.url === "string"));
+  const mcpWritten = servers.length > 0 && !entries.has(".mcp.json") && !wholeFolder?.paths.has(".mcp.json");
+  if (mcpWritten) entries.set(".mcp.json", Buffer.from(mcpJson(servers, platform)));
+  entries.set(`${platform.notesDir}/README.md`, Buffer.from(readme(folder, workspace2 ? { ...workspace2, mcp_servers: servers } : null, counts, [...skills2], mcpWritten, platform)));
+  if (wholeFolder) for (const path of wholeFolder.paths) entries.delete(path);
+  return { folder, entries, skills: [...skills2], mcpServers: servers.map((server) => server.name) };
 }
-function claudeModel(configRoot) {
-  const candidates = [
-    join3(process.cwd(), ".claude", "settings.local.json"),
-    join3(process.cwd(), ".claude", "settings.json"),
-    join3(configRoot, "settings.json")
-  ];
-  for (const path of candidates) {
-    const model = readJson(path)?.model;
-    if (typeof model === "string" && model.trim()) return model.trim();
+var TAR_BLOCK = 512;
+var TAR_END = Buffer.alloc(TAR_BLOCK * 2);
+function header(name, size, type) {
+  const block = Buffer.alloc(TAR_BLOCK);
+  block.write(name, 0, 100, "utf8");
+  block.write("0000644\0", 100);
+  block.write("0000000\0", 108);
+  block.write("0000000\0", 116);
+  block.write(size.toString(8).padStart(11, "0") + "\0", 124);
+  block.write("00000000000\0", 136);
+  block.write("        ", 148);
+  block.write(type, 156);
+  block.write("ustar\x0000", 257);
+  let sum = 0;
+  for (const byte of block) sum += byte;
+  block.write(sum.toString(8).padStart(6, "0") + "\0 ", 148);
+  return block;
+}
+function paxRecord(key, value) {
+  const body = ` ${key}=${value}
+`;
+  let length = Buffer.byteLength(body);
+  for (; ; ) {
+    const total = String(length).length + length;
+    if (String(total).length + length === total) return Buffer.from(`${total}${body}`);
+    length += 1;
   }
-  return void 0;
 }
-function claudeMcpServers() {
-  const merged = {};
-  const userConfig = readJson(join3(homedir(), ".claude.json"));
-  Object.assign(merged, userConfig?.mcpServers ?? {});
-  Object.assign(merged, userConfig?.projects?.[process.cwd()]?.mcpServers ?? {});
-  const projectConfig = readJson(
-    join3(process.cwd(), ".mcp.json")
-  );
-  Object.assign(merged, projectConfig?.mcpServers ?? {});
-  return merged;
+function tarPadding(size) {
+  const rest = size % TAR_BLOCK;
+  return Buffer.alloc(rest ? TAR_BLOCK - rest : 0);
+}
+function tarHeader(path, size) {
+  if (Buffer.byteLength(path) <= 100) return header(path, size, "0");
+  const pax = paxRecord("path", path);
+  return Buffer.concat([header("PaxHeader", pax.length, "x"), pax, tarPadding(pax.length), header(path, size, "0")]);
 }
-function assemblePrompt(parts) {
-  const joined = parts.map((p) => `# \u2500\u2500 ${p.label} \u2500\u2500
 
-${p.content.trim()}`).join("\n\n").trim();
-  if (joined.length <= PROMPT_CAP) return { prompt: joined, truncated: false };
-  const notice = "\n\n[truncated by sky clone: local instructions exceeded the 100k prompt cap]";
-  return { prompt: joined.slice(0, PROMPT_CAP - notice.length) + notice, truncated: true };
+// src/import-environment.ts
+var IMPORT_PLATFORM = { name: "AgentSky", ownHost: /(^|\.)(agentsky\.dev|asteroidbelt\.ai)$/i, notesDir: ".agentsky-import" };
+var MAX_ENVIRONMENT_FILES = 2e5;
+var MAX_ENVIRONMENT_BYTES = 2 * 1024 ** 3;
+var MAX_REDACTED_TEXT_BYTES = 10 * 1024 * 1024;
+var SKIPPED = /* @__PURE__ */ new Set([".git", "node_modules", ".venv", "venv", "__pycache__", ".next", "dist", "build", "target", ".DS_Store", ".cache", ".turbo"]);
+var SECRET_FILE2 = /(^|\/)(\.env(\..*)?|\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.?credentials(\.json)?|auth\.json|\.claude\.json|id_(rsa|ed25519|ecdsa)[^/]*|.*\.(pem|key|p12|pfx|keystore|jks|kdbx))$|(^|\/)\.ssh\/|(^|\/)\.aws\/|(^|\/)\.gnupg\/|(^|\/)\.docker\/config\.json$/i;
+function listFiles(cwd) {
+  const git2 = spawnSync2("git", ["-C", cwd, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 512 * 1024 * 1024 });
+  if (git2.status === 0) return git2.stdout.split("\0").filter(Boolean).filter((path) => !path.split("/").some((part) => part === ".git"));
+  const out = [];
+  const walk = (dir, prefix) => {
+    let entries;
+    try {
+      entries = readdirSync3(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry2 of entries) {
+      if (SKIPPED.has(entry2.name)) continue;
+      const rel = prefix ? `${prefix}/${entry2.name}` : entry2.name;
+      if (entry2.isDirectory()) walk(join5(dir, entry2.name), rel);
+      else out.push(rel);
+      if (out.length > MAX_ENVIRONMENT_FILES) return;
+    }
+  };
+  walk(cwd, "");
+  return out;
 }
-function readClaudeCode() {
-  const configRoot = claudeConfigRoot();
-  const parts = [];
-  const sources = [];
-  const global = readIfExists(join3(configRoot, "CLAUDE.md"));
-  if (global?.trim()) {
-    parts.push({ label: "Global CLAUDE.md", content: global });
-    sources.push("global CLAUDE.md");
-  }
-  for (const name of ["CLAUDE.md", "AGENTS.md"]) {
-    const project2 = readIfExists(join3(process.cwd(), name));
-    if (project2?.trim()) {
-      parts.push({ label: `Project ${name}`, content: project2 });
-      sources.push(`project ${name}`);
-      break;
+function textOf(path, size) {
+  if (size > MAX_REDACTED_TEXT_BYTES) return null;
+  const data = readFileSync5(path);
+  if (data.subarray(0, 8e3).includes(0) || !isUtf82(data)) return null;
+  return data;
+}
+async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
+  const listed = listFiles(cwd);
+  if (listed.length > MAX_ENVIRONMENT_FILES) throw new Error(`The working folder has more than ${MAX_ENVIRONMENT_FILES} files; import it with --no-environment.`);
+  const scratch = mkdtempSync(join5(tmpdir(), "sky-environment-"));
+  const path = join5(scratch, "environment.tar.gz");
+  const leftOut = [];
+  const written2 = /* @__PURE__ */ new Set();
+  const hash = createHash2("sha256");
+  let bytes = 0;
+  let redacted2 = 0;
+  const gzip = createGzip({ level: 6 });
+  const sink = createWriteStream(path);
+  gzip.on("data", (chunk) => {
+    bytes += chunk.length;
+    hash.update(chunk);
+  });
+  gzip.pipe(sink);
+  const done = new Promise((resolve10, reject) => {
+    sink.on("finish", () => resolve10());
+    sink.on("error", reject);
+    gzip.on("error", reject);
+  });
+  const write = (chunk) => new Promise((resolve10, reject) => {
+    if (bytes > MAX_ENVIRONMENT_BYTES) {
+      reject(new Error(`The working folder packs to more than ${MAX_ENVIRONMENT_BYTES / 1024 ** 3} GiB; import it with --no-environment.`));
+      return;
     }
-  }
-  const { prompt, truncated } = assemblePrompt(parts);
-  const allServers = claudeMcpServers();
-  const { kept, dropped } = splitMcpServers(allServers);
-  const secretCandidates = [];
-  for (const d of dropped) {
-    const def = allServers[d.name];
-    if (!def?.env) continue;
-    for (const key of d.envKeys) {
-      const value = def.env[key];
-      if (value !== void 0 && value.trim()) {
-        secretCandidates.push({ serverName: d.name, envKey: key, value, url: d.url });
+    if (gzip.write(chunk)) resolve10();
+    else gzip.once("drain", resolve10);
+  });
+  try {
+    for (const rel of listed) {
+      const full = join5(cwd, ...rel.split("/"));
+      if (SECRET_FILE2.test(rel)) {
+        leftOut.push({ path: rel, reason: "credential file" });
+        continue;
+      }
+      let stat;
+      try {
+        stat = lstatSync(full);
+      } catch {
+        continue;
+      }
+      if (!stat.isFile()) {
+        leftOut.push({ path: rel, reason: "not a regular file" });
+        continue;
+      }
+      const text = textOf(full, stat.size);
+      if (text) {
+        const masked = redactSecretValues(text.toString("utf8"));
+        if (Object.keys(masked.hits).length) redacted2 += 1;
+        const data = Buffer.from(masked.text, "utf8");
+        await write(tarHeader(rel, data.length));
+        await write(data);
+        await write(tarPadding(data.length));
+      } else {
+        await write(tarHeader(rel, stat.size));
+        const fd = openSync2(full, "r");
+        try {
+          const chunk = Buffer.alloc(1024 * 1024);
+          let left = stat.size;
+          for (let offset = 0; left > 0; ) {
+            const read = readSync2(fd, chunk, 0, Math.min(chunk.length, left), offset);
+            if (read <= 0) throw new Error(`${rel} changed while it was packed; import again.`);
+            await write(Buffer.from(chunk.subarray(0, read)));
+            offset += read;
+            left -= read;
+          }
+        } finally {
+          closeSync2(fd);
+        }
+        await write(tarPadding(stat.size));
       }
+      written2.add(rel);
+    }
+    const layout = importLayout(resources, cwd, platform, { files: written2.size, paths: written2 });
+    for (const [entry2, data] of layout?.entries ?? []) {
+      await write(tarHeader(entry2, data.length));
+      await write(data);
+      await write(tarPadding(data.length));
     }
+    await write(TAR_END);
+    gzip.end();
+    await done;
+    if (bytes > MAX_ENVIRONMENT_BYTES) throw new Error(`The working folder packs to more than ${MAX_ENVIRONMENT_BYTES / 1024 ** 3} GiB; import it with --no-environment.`);
+    return {
+      path,
+      folder: layout?.folder ?? "imported-session",
+      bytes,
+      sha256: hash.digest("hex"),
+      files: written2.size + (layout?.entries.size ?? 0),
+      redacted: redacted2,
+      leftOut,
+      dispose: () => rmSync2(scratch, { recursive: true, force: true })
+    };
+  } catch (error) {
+    gzip.destroy();
+    sink.destroy();
+    rmSync2(scratch, { recursive: true, force: true });
+    throw error;
   }
-  return {
-    harness: "claude_code",
-    configRoot,
-    prompt,
-    promptSources: sources,
-    truncated,
-    model: claudeModel(configRoot),
-    keptServers: kept,
-    droppedServers: dropped,
-    secretCandidates
-  };
 }
-function detectHarness(explicit) {
-  if (explicit) {
-    if (!HARNESSES.includes(explicit)) {
-      throw new Error(`unknown harness ${explicit} \u2014 expected ${HARNESSES.join(" | ")}`);
+function resourcesOf(lines) {
+  return lines.flatMap((line) => {
+    try {
+      const record = JSON.parse(line);
+      if (record.type !== "import.resource" || typeof record.name !== "string" || typeof record.media_type !== "string" || typeof record.data !== "string") return [];
+      return [{ name: record.name, mediaType: record.media_type, data: Buffer.from(record.data, "base64") }];
+    } catch {
+      return [];
     }
-    return explicit;
-  }
-  if (existsSync3(claudeConfigRoot())) return "claude_code";
-  if (existsSync3(join3(homedir(), ".codex"))) return "codex";
-  if (existsSync3(join3(homedir(), ".openclaw"))) return "openclaw";
-  throw new Error(
-    "no local harness found (~/.claude, ~/.codex, ~/.openclaw) \u2014 pass --harness to override"
-  );
+  });
 }
-function readLocal(harness2) {
-  if (harness2 === "claude_code") return readClaudeCode();
-  throw new Error(
-    `${harness2} cloning lands next \u2014 claude_code is the first supported harness`
-  );
+
+// src/import-local.ts
+function redactLine2(raw) {
+  return redactLine(raw).line;
 }
-function linkPath(configRoot) {
-  return join3(configRoot, "agentsky-link.json");
+function decodeWorkspace(encoded) {
+  try {
+    return decodeURIComponent(encoded.replace(/-/g, "%").replace(/_/g, "%5F"));
+  } catch {
+    return encoded;
+  }
 }
-function readLink(configRoot) {
-  const link2 = readJson(linkPath(configRoot));
-  return link2?.agentId ? link2 : void 0;
+function readPrefix(filePath) {
+  const fd = openSync3(filePath, "r");
+  try {
+    const bytes = Buffer.alloc(256 * 1024);
+    return bytes.subarray(0, readSync3(fd, bytes, 0, bytes.length, 0)).toString("utf8");
+  } finally {
+    closeSync3(fd);
+  }
 }
-function writeLink(configRoot, link2) {
-  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link2, null, 2)}
-`);
-}
-var DEFAULT_VAULT_NAME = "default";
-async function fetchDefaultVaultId() {
-  const { vaults } = await api(
-    "GET",
-    "/vaults"
-  );
-  return vaults.find((v) => v.display_name === DEFAULT_VAULT_NAME)?.id ?? null;
-}
-async function ensureDefaultVaultId() {
-  const existing = await fetchDefaultVaultId();
-  if (existing) return existing;
+function sniffTitle(filePath) {
   try {
-    const { vault: vault2 } = await api("POST", "/vaults", {
-      display_name: DEFAULT_VAULT_NAME
-    });
-    return vault2.id;
-  } catch (error) {
-    if (error instanceof ApiError && error.status === 409) {
-      const raced = await fetchDefaultVaultId();
-      if (raced) return raced;
+    const data = readPrefix(filePath);
+    for (const raw of data.split("\n")) {
+      if (!raw.trim()) continue;
+      let line;
+      try {
+        line = JSON.parse(redactLine2(raw));
+      } catch {
+        continue;
+      }
+      if (!line || typeof line !== "object") continue;
+      const rec = line;
+      if (rec.type === "user" && rec.message && typeof rec.message === "object") {
+        const msg = rec.message;
+        if (Array.isArray(msg.content)) {
+          for (const block of msg.content) {
+            if (typeof block === "object" && block !== null) {
+              const b = block;
+              if (b.type === "text" && typeof b.text === "string" && b.text.trim()) {
+                return b.text.trim().slice(0, 120);
+              }
+            }
+          }
+        }
+        if (typeof msg.content === "string" && msg.content.trim()) {
+          return msg.content.trim().slice(0, 120);
+        }
+      }
+      if (rec.type === "event_msg" && rec.payload && typeof rec.payload === "object") {
+        const payload = rec.payload;
+        if (payload.type === "user_message" && typeof payload.message === "string") return redactLine2(payload.message).slice(0, 120);
+      }
+      if (rec.type === "response_item" && rec.payload && typeof rec.payload === "object") {
+        const payload = rec.payload;
+        if (payload.type === "message" && payload.role === "user" && Array.isArray(payload.content)) {
+          const text = payload.content.find((part) => typeof part?.text === "string")?.text;
+          if (typeof text === "string" && text.trim()) return redactLine2(text.trim()).slice(0, 120);
+        }
+      }
+      if (rec.type === "session_meta") continue;
+      if (rec.type === "user_turn" || rec.type === "message" && rec.role === "user") {
+        const content = rec.content;
+        if (typeof content === "string" && content.trim()) return content.trim().slice(0, 120);
+      }
     }
-    throw error;
+    return null;
+  } catch {
+    return null;
   }
 }
-async function confirmAndVaultSecrets(candidates, yes) {
-  if (!candidates.length) return;
-  if (yes) {
-    console.log(
-      `  ${candidates.length} secret${candidates.length === 1 ? "" : "s"} from dropped MCP servers not saved (--yes skips vault confirmation).`
-    );
-    return;
-  }
-  console.log("\nSecret-bearing MCP servers were left out of the clone payload.");
-  console.log("You can save their keys to your workspace vault now (values are sent encrypted, never displayed).\n");
-  let vaultId;
-  let saved = 0;
-  let skipped = 0;
-  for (const c of candidates) {
-    const chosen = await confirm(`  Add ${c.envKey} (from ${c.serverName}) to your default vault?`);
-    if (!chosen) {
-      console.log(`  \u2014 skipped ${c.envKey}`);
-      skipped += 1;
-      continue;
+function listClaudeCodeSessions(limit) {
+  const root = process.env.CLAUDE_CONFIG_DIR ?? join6(homedir3(), ".claude");
+  const projectsDir = join6(root, "projects");
+  if (!existsSync4(projectsDir)) return [];
+  const sessions = [];
+  try {
+    for (const encoded of readdirSync4(projectsDir)) {
+      const projectDir = join6(projectsDir, encoded);
+      let entries;
+      try {
+        entries = readdirSync4(projectDir);
+      } catch {
+        continue;
+      }
+      const workspace2 = decodeWorkspace(encoded);
+      for (const entry2 of entries) {
+        if (!entry2.endsWith(".jsonl")) continue;
+        const sessionId = entry2.slice(0, -6);
+        const mainFile = join6(projectDir, entry2);
+        let stat;
+        try {
+          stat = statSync5(mainFile);
+        } catch {
+          continue;
+        }
+        if (!stat.isFile()) continue;
+        let discoveryError;
+        const subagentFiles = [];
+        const subagentDir = join6(projectDir, sessionId, "subagents");
+        if (existsSync4(subagentDir)) {
+          try {
+            const subFiles = readdirSync4(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
+            for (const f of subFiles) {
+              subagentFiles.push(join6(subagentDir, f));
+            }
+          } catch {
+            discoveryError = "Cannot read all recorded subagent conversations. Fix local file access before importing this session.";
+          }
+        }
+        sessions.push({
+          harness: "claude_code",
+          sessionId,
+          workspace: workspace2,
+          title: sniffTitle(mainFile),
+          mtimeMs: stat.mtimeMs,
+          files: [mainFile, ...subagentFiles],
+          ...discoveryError ? { discoveryError } : {}
+        });
+      }
     }
+  } catch {
+  }
+  return sessions.sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
+}
+function listCodexSessions(limit) {
+  const sessionsDir = join6(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join6(homedir3(), ".codex"), "sessions");
+  const records = [];
+  function walk(dir) {
+    let entries;
     try {
-      vaultId ??= await ensureDefaultVaultId();
-      await api("POST", `/vaults/${encodeURIComponent(vaultId)}/secrets`, {
-        display_name: `${c.envKey} (${c.serverName})`,
-        auth: {
-          type: "environment_variable",
-          secret_name: c.envKey,
-          value: c.value,
-          allowed_hosts: c.url ? [c.url] : []
-        }
-      });
-      console.log(`  \u2713 saved ${c.envKey}`);
-      saved += 1;
-    } catch (error) {
-      if (error instanceof ApiError && error.status === 409) {
-        console.log(`  \u2014 ${c.envKey} already in vault`);
-      } else {
-        const msg = error instanceof Error ? error.message : String(error);
-        console.log(`  \u2717 ${c.envKey} failed: ${msg}`);
+      entries = readdirSync4(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry2 of entries) {
+      const full = join6(dir, entry2.name);
+      if (entry2.isDirectory()) {
+        walk(full);
+        continue;
+      }
+      if (!entry2.isFile() || !entry2.name.startsWith("rollout-") || !entry2.name.endsWith(".jsonl")) continue;
+      try {
+        const first = readPrefix(full).split("\n", 1)[0];
+        const meta = JSON.parse(first);
+        if (meta.type !== "session_meta" || typeof meta.payload?.id !== "string") continue;
+        const data = meta.payload;
+        const parent = data.forked_from_id ?? data.source?.spawn?.parent_thread_id ?? data.source?.subagent?.spawn?.parent_thread_id;
+        records.push({
+          session: {
+            harness: "codex",
+            sessionId: data.id,
+            workspace: typeof data.cwd === "string" ? data.cwd : dir,
+            title: sniffTitle(full),
+            mtimeMs: statSync5(full).mtimeMs,
+            files: [full]
+          },
+          ...typeof parent === "string" ? { parent } : {}
+        });
+      } catch {
+        continue;
       }
     }
   }
-  if (saved || skipped) {
-    console.log(
-      `
-Vault: ${saved} saved, ${skipped} skipped. Attach the "default" vault to a session to use these keys.`
-    );
+  walk(sessionsDir);
+  function descendants(id, visited) {
+    if (visited.has(id)) return [];
+    visited.add(id);
+    return records.filter((item) => item.parent === id).flatMap((item) => [
+      ...item.session.files,
+      ...descendants(item.session.sessionId, visited)
+    ]);
   }
+  return records.filter((item) => !item.parent).map(({ session: session2 }) => ({
+    ...session2,
+    files: [.../* @__PURE__ */ new Set([...session2.files, ...descendants(session2.sessionId, /* @__PURE__ */ new Set())])]
+  })).sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
-function confirm(question) {
-  return new Promise((done) => {
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    rl.question(`${question} [Y/n] `, (answer) => {
-      rl.close();
-      done(/^(y(es)?)?$/i.test(answer.trim()));
-    });
+function listRecentSessions(harness2, limit) {
+  const claudeSessions = harness2 === "codex" ? [] : listClaudeCodeSessions(limit);
+  const codexSessions = harness2 === "claude_code" ? [] : listCodexSessions(limit);
+  return [...claudeSessions, ...codexSessions].sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
+}
+function agentUseBase() {
+  const env = process.env.AGENT_USE_URL?.trim().replace(/\/$/, "");
+  if (env) return env;
+  const api2 = apiBase().replace(/\/$/, "");
+  const derived = api2.replace(/\/api\/v1$/, "").replace(/\/v1$/, "").replace("api.agentsky.dev", "agentsky.dev");
+  if (derived.includes("localhost:3000")) return derived.replace("localhost:3000", "localhost:3002");
+  return derived;
+}
+function currentSessionEnv() {
+  const claudeId = process.env.CLAUDE_CODE_SESSION_ID;
+  if (claudeId) return { harness: "claude_code", sessionId: claudeId };
+  const codexId = process.env.CODEX_THREAD_ID;
+  if (codexId) return { harness: "codex", sessionId: codexId };
+  return void 0;
+}
+async function mintTrace(base, harness2) {
+  const token = apiToken();
+  if (!token) throw new ApiError(401, "not_logged_in", "not logged in \u2014 run `sky auth login`");
+  const res = await fetch(`${base}/api/traces`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(15e3),
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${token}`,
+      "user-agent": USER_AGENT
+    },
+    body: JSON.stringify({ harness: harness2 })
   });
+  if (!res.ok) {
+    const body = await res.json().catch(() => null);
+    throw new Error(
+      typeof body?.error === "string" ? body.error : `Failed to create import (${res.status}).`
+    );
+  }
+  return await res.json();
 }
-function openBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+function loadSummaryFile(summaryPath) {
+  let raw;
   try {
-    spawn(cmd, [url], { stdio: "ignore", detached: true }).unref();
+    raw = readFileSync6(summaryPath, "utf8");
   } catch {
+    throw new Error(`Cannot read summary file: ${summaryPath}`);
   }
-}
-function kb(text) {
-  return `${Math.max(1, Math.round(text.length / 1024))} KB`;
-}
-async function createClone(local, opts) {
-  const keptNames = Object.keys(local.keptServers);
-  const summary = [
-    local.promptSources.length ? `${local.promptSources.join(" + ")} (${kb(local.prompt)})` : "no instructions found",
-    `model ${local.model ?? "(harness default)"}`,
-    `${keptNames.length} MCP server${keptNames.length === 1 ? "" : "s"}${keptNames.length ? ` (${keptNames.join(", ")})` : ""}`
-  ].join(" \xB7 ");
-  console.log(`Detected ${local.harness} at ${local.configRoot} (project ${basename3(process.cwd())})`);
-  console.log(`Will clone: ${summary}`);
-  if (local.truncated) console.log("  note: instructions exceeded 100k chars and were truncated");
-  if (local.droppedServers.length) {
-    console.log(
-      `Left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
-    );
-  }
-  if (opts.dryRun) {
-    console.log("Dry run \u2014 nothing sent.");
-    return;
-  }
-  if (!opts.yes && !await confirm("Launch this as a new cloud agent?")) {
-    console.log("Aborted \u2014 nothing sent.");
-    return;
-  }
-  const { servers: mcpServers2, skipped } = mcpServersFromKept(local.keptServers);
-  if (skipped.length) {
-    console.log(`  note: local (stdio) MCP servers have no cloud equivalent and were skipped: ${skipped.join(", ")}`);
-  }
-  const body = {
-    agentType: local.harness,
-    ...local.model ? { llm: local.model } : {},
-    ...local.prompt ? { prompt: local.prompt } : {},
-    ...mcpServers2.length ? { mcpServers: mcpServers2 } : {}
-  };
-  let sentLlm = local.model ?? null;
-  let created;
-  try {
-    ({ agent: created } = await api("POST", "/agents", body));
-  } catch (error) {
-    if (error instanceof ApiError && error.status === 422 && local.model) {
-      const successor = supersededBy(local.model);
-      console.log(
-        successor ? `  note: ${local.model} is superseded \u2014 using ${successor}` : `  note: ${local.model} isn't available for ${local.harness} \u2014 using the harness default`
-      );
-      sentLlm = successor;
-      ({ agent: created } = await api("POST", "/agents", {
-        ...body,
-        llm: successor ?? void 0
-      }));
-    } else {
-      throw error;
-    }
-  }
-  console.log("Starting its runtime\u2026");
-  await api("POST", "/sessions", { agent: created.id });
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  writeLink(local.configRoot, {
-    baseUrl: apiBase(),
-    agentId: created.id,
-    clonedAt: now,
-    lastSyncedAt: now,
-    llm: sentLlm,
-    mcpServers: keptNames
-  });
-  const url = `${apiBase()}/agents/${created.id}`;
-  console.log(`Cloned \u2192 ${created.id}  ${url}`);
-  console.log(
-    `Linked this machine (${linkPath(local.configRoot)}). Push prompt changes anytime by running \`sky clone\` again.`
-  );
-  await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
-  if (opts.open) openBrowser(url);
-}
-async function syncClone(local, link2, opts) {
-  const since = link2.lastSyncedAt ?? link2.clonedAt;
-  console.log(
-    `Syncing ${link2.agentId} from ${local.configRoot} (last synced ${since ? new Date(since).toLocaleDateString() : "never"})`
-  );
-  if (opts.dryRun) {
-    console.log(
-      `  would push prompt (${kb(local.prompt)}) to ${link2.agentId}. Dry run \u2014 nothing sent.`
-    );
-    return;
-  }
-  let agent2;
-  try {
-    ({ agent: agent2 } = await api(
-      "GET",
-      `/agents/${encodeURIComponent(link2.agentId)}`
-    ));
-  } catch (error) {
-    if (error instanceof ApiError && error.status === 404) {
-      throw new Error(
-        `linked agent ${link2.agentId} no longer exists \u2014 run \`sky clone --new\` to launch a fresh one`
-      );
-    }
-    throw error;
-  }
-  if (agent2.agentType !== local.harness) {
-    throw new Error(
-      `linked agent ${link2.agentId} is ${agent2.agentType}, this machine runs ${local.harness} \u2014 run \`sky clone --new\` to launch a fresh agent`
-    );
-  }
-  const result = await api(
-    "PUT",
-    `/agents/${encodeURIComponent(link2.agentId)}/prompt`,
-    { prompt: local.prompt }
-  );
-  console.log(
-    result.unchanged ? "  prompt   unchanged" : `  prompt   updated (v${result.version}${result.applied === "live" ? ", hot-reloaded" : ", applies on next boot"})`
-  );
-  const drift = [];
-  const localModel = local.model ?? null;
-  const linkedModel = link2.llm ?? agent2.llm;
-  if (localModel && linkedModel && localModel !== linkedModel) {
-    drift.push(`model changed ${linkedModel} \u2192 ${localModel}`);
-  }
-  const before = new Set(link2.mcpServers ?? []);
-  const nowKept = Object.keys(local.keptServers);
-  const newServers = nowKept.filter((n) => !before.has(n));
-  const goneServers = [...before].filter((n) => !nowKept.includes(n));
-  if (newServers.length) drift.push(`${newServers.length} new MCP server${newServers.length === 1 ? "" : "s"} (${newServers.join(", ")})`);
-  if (goneServers.length) drift.push(`${goneServers.length} removed MCP server${goneServers.length === 1 ? "" : "s"} (${goneServers.join(", ")})`);
-  if (drift.length) {
-    console.log(`  skipped (set at launch): ${drift.join("; ")}`);
-    console.log("    \u2192 a running agent can't change these; run `sky clone --new` to launch a fresh agent.");
-  }
-  if (local.droppedServers.length) {
-    console.log(
-      `  left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
-    );
-  }
-  writeLink(local.configRoot, { ...link2, lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  console.log(`Synced ${link2.agentId}.`);
-  await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
-  if (opts.open) openBrowser(`${apiBase()}/agents/${link2.agentId}`);
-}
-async function clone(opts) {
-  const harness2 = detectHarness(opts.harness);
-  const local = readLocal(harness2);
-  const link2 = opts.new ? void 0 : readLink(local.configRoot);
-  if (link2) await syncClone(local, link2, opts);
-  else await createClone(local, opts);
-}
-
-// src/import-local.ts
-import { closeSync as closeSync3, existsSync as existsSync6, openSync as openSync3, readdirSync as readdirSync4, readFileSync as readFileSync8, readSync as readSync3, statSync as statSync5 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join7 } from "path";
-import { createHash as createHash3 } from "crypto";
-
-// src/import-files.ts
-import { isUtf8 } from "buffer";
-import { existsSync as existsSync5, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname4, extname as extname2, isAbsolute, join as join5, relative as relative2, resolve as resolve4, sep as sep2, basename as basename5 } from "path";
-
-// src/import-workspace.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync5, realpathSync, statSync as statSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { basename as basename4, dirname as dirname3, join as join4, relative, sep } from "path";
-import { parse as parseToml2 } from "smol-toml";
-var MAX_TREE = 5e3;
-var SKILL_LINE = /Base directory for this skill: (\/[^\n\r"'\\<>]+)/g;
-function git(cwd, ...args) {
-  const run2 = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf8", timeout: 1e4, maxBuffer: 32 * 1024 * 1024 });
-  return run2.status === 0 ? run2.stdout : null;
-}
-var isFile = (path) => {
-  try {
-    return statSync3(path).isFile();
-  } catch {
-    return false;
-  }
-};
-var isDir = (path) => {
-  try {
-    return statSync3(path).isDirectory();
-  } catch {
-    return false;
-  }
-};
-function sharedInstructionPaths(home = homedir2()) {
-  const rules = join4(home, ".agents", "rules");
-  let ruleFiles = [];
-  try {
-    ruleFiles = readdirSync2(rules).filter((name) => name.endsWith(".md")).sort().map((name) => join4(rules, name));
-  } catch {
-  }
-  return [join4(home, "AGENTS.md"), join4(home, "MEMORY.md"), ...ruleFiles].filter(isFile);
-}
-function strings(value, out, depth = 0) {
-  if (depth > 12) return;
-  if (typeof value === "string") out.push(value);
-  else if (Array.isArray(value)) for (const item of value) strings(item, out, depth + 1);
-  else if (value && typeof value === "object") for (const item of Object.values(value)) strings(item, out, depth + 1);
-}
-function skillRoots(cwd, home) {
-  const claude = process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude");
-  const codex = process.env.CODEX_HOME ?? join4(home, ".codex");
-  return [
-    ...cwd ? [join4(cwd, ".claude", "skills"), join4(cwd, ".agents", "skills")] : [],
-    join4(home, ".agents", "skills"),
-    join4(claude, "skills"),
-    join4(codex, "skills"),
-    join4(home, ".hermes", "skills")
-  ];
-}
-function pluginSkill(plugin, skill, home) {
-  const walk = (dir, depth, underPlugin) => {
-    if (depth > 7) return null;
-    let entries;
-    try {
-      entries = readdirSync2(dir, { withFileTypes: true });
-    } catch {
-      return null;
-    }
-    for (const entry2 of entries) {
-      if (!entry2.isDirectory() || entry2.name === "node_modules" || entry2.name === ".git") continue;
-      const path = join4(dir, entry2.name);
-      if (entry2.name === skill && basename4(dir) === "skills" && (underPlugin || path.includes(`${sep}${plugin}${sep}`)) && isFile(join4(path, "SKILL.md"))) return realpathSync(path);
-      const found = walk(path, depth + 1, underPlugin);
-      if (found) return found;
-    }
-    return null;
-  };
-  return walk(join4(process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude"), "plugins"), 0, false) ?? walk(join4(home, "Library", "Application Support", "Claude", "local-agent-mode-sessions", "skills-plugin"), 0, true);
-}
-function findSkill(name, cwd, home) {
-  const [scope, skill] = name.includes(":") ? name.split(":", 2) : [null, name];
-  if (scope && skill) return pluginSkill(scope, skill, home);
-  for (const root of skillRoots(cwd, home)) {
-    const direct = join4(root, name);
-    if (isFile(join4(direct, "SKILL.md"))) return realpathSync(direct);
-  }
-  return null;
-}
-function loadedSkills(records, touched, cwd, home = homedir2()) {
-  const dirs = /* @__PURE__ */ new Map();
-  const missing = /* @__PURE__ */ new Set();
-  const add = (dir, name = basename4(dir)) => {
-    if (!isFile(join4(dir, "SKILL.md"))) return false;
-    const real = realpathSync(dir);
-    if (![...dirs.values()].includes(real)) dirs.set(name, real);
-    return true;
-  };
-  const called = [];
-  for (const record of records) {
-    const texts = [];
-    strings(record, texts);
-    for (const text of texts) for (const match of text.matchAll(SKILL_LINE)) add(match[1].trim().replace(/[.,;:)]+$/, ""));
-    const content = record?.message?.content;
-    if (!Array.isArray(content)) continue;
-    for (const block of content) {
-      const b = block;
-      if (b?.type === "tool_use" && b.name === "Skill" && typeof b.input?.skill === "string") called.push(b.input.skill.replace(/^\//, ""));
-    }
-  }
-  for (const path of touched) if (basename4(path) === "SKILL.md") add(dirname3(path));
-  for (const name of called) {
-    if (!name || dirs.has(name) || [...dirs.keys()].some((key) => key.endsWith(`:${name}`) || name.endsWith(`:${key}`))) continue;
-    const dir = findSkill(name, cwd, home);
-    if (!dir || !add(dir, name)) missing.add(name);
-  }
-  return { found: [...dirs].map(([name, dir]) => ({ name: name.replace(/[^A-Za-z0-9._:-]/g, "-"), dir })), missing: [...missing] };
-}
-function readJson2(path) {
-  try {
-    const value = JSON.parse(readFileSync5(path, "utf8"));
-    return value && typeof value === "object" ? value : null;
-  } catch {
-    return null;
-  }
-}
-function names(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const keys2 = Object.keys(value).sort();
-  return keys2.length ? keys2 : void 0;
-}
-function safeUrl(raw) {
-  try {
-    const url = new URL(raw);
-    if (!/^https?:$/.test(url.protocol)) return null;
-    const query = [.../* @__PURE__ */ new Set([...url.searchParams.keys()])].sort();
-    return { url: `${url.protocol}//${url.host}${url.pathname}`, ...query.length ? { query } : {} };
-  } catch {
-    return null;
-  }
-}
-function serverEntry(name, def, scope) {
-  if (!def || typeof def !== "object") return null;
-  const env = names(def.env);
-  const headers = names(def.headers ?? def.http_headers);
-  if (typeof def.url === "string") {
-    const url = safeUrl(def.url);
-    if (!url) return null;
-    const type = def.type === "sse" ? "sse" : "http";
-    return { name, scope, transport: type, ...url, ...headers ? { headers } : {}, ...env ? { env } : {} };
-  }
-  if (typeof def.command !== "string" || !def.command) return null;
-  const args = Array.isArray(def.args) ? def.args.filter((arg) => typeof arg === "string") : [];
-  return { name, scope, transport: "stdio", command: def.command, ...args.length ? { args } : {}, ...env ? { env } : {} };
-}
-function mcpServers(harness2, cwd, home = homedir2()) {
-  const out = [];
-  const push = (servers, scope) => {
-    if (!servers || typeof servers !== "object") return;
-    for (const [name, def] of Object.entries(servers)) {
-      const entry2 = serverEntry(name, def, scope);
-      if (entry2 && !out.some((existing) => existing.name === name)) out.push(entry2);
-    }
-  };
-  if (harness2 === "claude_code") {
-    const config = readJson2(join4(process.env.CLAUDE_CONFIG_DIR ? dirname3(process.env.CLAUDE_CONFIG_DIR) : home, ".claude.json"));
-    const projects = config?.projects && typeof config.projects === "object" ? config.projects : {};
-    const root = cwd ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || cwd : "";
-    if (cwd) push(projects[cwd]?.mcpServers ?? projects[root]?.mcpServers, "local");
-    if (root) push(readJson2(join4(root, ".mcp.json"))?.mcpServers, "project");
-    push(config?.mcpServers, "user");
-  }
-  if (harness2 === "codex") {
-    try {
-      const config = parseToml2(readFileSync5(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "config.toml"), "utf8"));
-      push(config.mcp_servers, "user");
-    } catch {
-    }
-  }
-  return out;
-}
-function remoteWithoutCredentials(remote) {
-  return remote.trim().replace(/\/\/[^@/]+@/, "//").replace(/^[^@/]+@([^:]+):/, "$1:");
-}
-function workspaceState(cwd, harness2, skills2, home = homedir2(), title = null) {
-  const present = !!cwd && isDir(cwd);
-  const root = present ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || null : null;
-  let gitState = null;
-  let tree = [];
-  let patch = null;
-  if (root) {
-    const dirty = (git(root, "status", "--porcelain=v1", "--untracked-files=normal") ?? "").split("\n").filter(Boolean).map((line) => line.slice(3));
-    const ahead = git(root, "rev-list", "--count", "@{upstream}..HEAD");
-    const remote = git(root, "remote", "get-url", "origin");
-    const branch = git(root, "rev-parse", "--abbrev-ref", "HEAD")?.trim() || null;
-    gitState = {
-      remote: remote ? remoteWithoutCredentials(remote) : null,
-      branch: branch === "HEAD" ? null : branch,
-      commit: git(root, "rev-parse", "HEAD")?.trim() || null,
-      dirty: dirty.slice(0, 500),
-      ahead: ahead === null ? null : Number(ahead.trim()) || 0
-    };
-    tree = (git(cwd, "-c", "core.quotePath=false", "ls-files") ?? "").split("\n").filter(Boolean);
-    if (dirty.length) patch = git(cwd, "diff", "HEAD", "--no-color", "--no-ext-diff", "--relative", "--", ".") || null;
+  let pkg;
+  try {
+    pkg = JSON.parse(raw);
+  } catch {
+    throw new Error("Summary file is not valid JSON.");
   }
-  return {
-    manifest: {
-      format: "agentsky.import-workspace",
-      format_version: 1,
-      harness: harness2,
-      title: title?.trim().slice(0, 120) || null,
-      cwd: cwd ? cwd.replace(home, "~") : null,
-      project: cwd ? basename4(root ?? cwd) : null,
-      git: gitState,
-      tree: tree.slice(0, MAX_TREE),
-      tree_truncated: tree.length > MAX_TREE,
-      skills: [...skills2.found.map((skill) => ({ name: skill.name, found: true })), ...skills2.missing.map((name) => ({ name, found: false }))],
-      mcp_servers: mcpServers(harness2, cwd, home)
-    },
-    patch
-  };
+  if (!pkg || typeof pkg !== "object" || Array.isArray(pkg)) throw new Error("Summary file must be a JSON object.");
+  const p = pkg;
+  if (p.format !== "asteroids.session-summary") throw new Error('Summary file must have format "asteroids.session-summary".');
+  if (p.format_version !== 1) throw new Error("Summary file must have format_version 1.");
+  const redacted2 = redactLine2(raw.trimEnd());
+  return redacted2;
 }
-function skillFiles(skill) {
-  const out = [];
-  const walk = (dir, depth) => {
-    if (depth > 8 || out.length > 400) return;
-    let entries;
-    try {
-      entries = readdirSync2(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry2 of entries) {
-      if (entry2.name === "node_modules" || entry2.name === ".git" || entry2.name === "__pycache__" || entry2.name === ".venv") continue;
-      const path = join4(dir, entry2.name);
-      if (entry2.isDirectory()) walk(path, depth + 1);
-      else if (entry2.isFile()) out.push({ path, name: `skills/${skill.name}/${relative(skill.dir, path).split(sep).join("/")}` });
-    }
-  };
-  if (existsSync4(skill.dir)) walk(skill.dir, 0);
-  return out;
+var MAX_IMPORT_BYTES = 30 * 1024 * 1024;
+var SUMMARY_RESERVE_BYTES = 128 * 1024;
+var MAX_LISTED_ARTIFACTS = 99;
+function leftOutLine(left) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const file of left) counts.set(file.reason, (counts.get(file.reason) ?? 0) + 1);
+  const files2 = [...counts].map(([reason, n]) => `${n} ${n === 1 ? "file" : "files"} (${reason})`).join(", ");
+  return `Not transferred: ${files2 ? `${files2}; ` : ""}runtime state such as running processes, installed tools and environment variables; and reasoning the source harness stored unreadably.`;
 }
-function codexThreadName(sessionId, home = homedir2()) {
-  let name = null;
-  try {
-    for (const line of readFileSync5(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "session_index.jsonl"), "utf8").split("\n")) {
-      if (!line.includes(sessionId)) continue;
+function prepareImport(session2, summaryPath, options = {}) {
+  if (session2.discoveryError) throw new Error(session2.discoveryError);
+  const maximum = 16 * 1024 * 1024;
+  let inputBytes = 0;
+  let outputBytes = 0;
+  const lines = [];
+  const digest = createHash3("sha256");
+  let nativeId;
+  let redactionCount = 0;
+  let encryptedReasoningCount = 0;
+  let compactionCount = 0;
+  let unreadableCount = 0;
+  const source = new SessionSourceCollector();
+  const records = [];
+  for (const path of session2.files) {
+    const stat = statSync5(path);
+    if (!stat.isFile() || (inputBytes += stat.size) > maximum) throw new Error("Selected transcript exceeds the 16 MiB limit or is not a regular file.");
+    const text = readFileSync6(path, "utf8");
+    for (const raw of text.split("\n")) {
+      if (!raw.trim()) continue;
+      let record;
       try {
-        const entry2 = JSON.parse(line);
-        if (entry2.id === sessionId && typeof entry2.thread_name === "string" && entry2.thread_name.trim()) name = entry2.thread_name.trim();
+        record = JSON.parse(raw);
       } catch {
+        unreadableCount++;
+        continue;
+      }
+      if (!record || typeof record !== "object" || Array.isArray(record)) throw new Error("Transcript records must be JSON objects.");
+      const rec = record;
+      if (String(rec.type).startsWith("import.")) throw new Error("Native transcripts cannot supply import protocol records.");
+      if (path === session2.files[0]) source.push(rec);
+      records.push(rec);
+      if (rec.type === "response_item") {
+        const payload = rec.payload;
+        if (payload?.type === "reasoning" && typeof payload?.encrypted_content === "string" && payload.encrypted_content) {
+          encryptedReasoningCount++;
+        }
       }
+      if (rec.type === "compacted") {
+        compactionCount++;
+      }
+      const id = rec.type === "session_meta" ? rec.payload?.id : rec.sessionId;
+      if (!nativeId && typeof id === "string") nativeId = id;
+      const result = redactLine(raw.replace(/\r$/, ""), { requireStructured: true });
+      if (Object.keys(result.hits).length > 0) redactionCount++;
+      const line = result.line + "\n";
+      outputBytes += Buffer.byteLength(line);
+      if (outputBytes > maximum) throw new Error("Redacted transcript exceeds the 16 MiB limit.");
+      digest.update(line);
+      lines.push(line);
     }
-  } catch {
   }
-  return name;
+  if (!lines.length) throw new Error("The selected transcript is empty.");
+  const sourceId = nativeId ?? session2.sessionId;
+  if (!/^[A-Za-z0-9_-]{1,200}$/.test(sourceId) || redactLine2(JSON.stringify(sourceId)) !== JSON.stringify(sourceId)) throw new Error("The source conversation has an invalid identifier.");
+  const meta = source.result();
+  const files2 = options.files === false ? { lines: [], bytes: 0, attached: [], leftOut: [], setup: { skills: [], missingSkills: [], mcpServers: [], git: false } } : collectSessionFiles(records, {
+    harness: session2.harness,
+    cwd: meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : ""),
+    budget: MAX_IMPORT_BYTES - outputBytes - SUMMARY_RESERVE_BYTES,
+    exclude: session2.files,
+    title: meta.title ?? (session2.harness === "codex" ? codexThreadName(session2.sessionId) : null)
+  });
+  const attachedNote = files2.attached.length ? ` The ${files2.attached.length} local ${files2.attached.length === 1 ? "file" : "files"} it read, wrote or ran under, the skills it loaded and its workspace description (repository state and tool servers, agentsky/workspace.json) are attached as well (listed in artifacts).` : "";
+  let summaryJson;
+  if (summaryPath) {
+    summaryJson = loadSummaryFile(summaryPath);
+  } else {
+    const summary = {
+      format: "asteroids.session-summary",
+      format_version: 1,
+      source_harness: session2.harness,
+      source_harness_version: meta.harness_version?.slice(0, 100) ?? null,
+      source_session_id: sourceId,
+      created_at: (/* @__PURE__ */ new Date()).toISOString(),
+      summary: `The complete selected local conversation is attached as a transcript.${attachedNote} Review it before continuing; this automatic handoff does not infer the user's unfinished objective or claim any work is complete.`,
+      context: {
+        objective: "Review the imported conversation and continue its latest unfinished authorized objective.",
+        constraints: [],
+        decisions: [],
+        completed: [],
+        pending: ["Read the complete imported transcript, reconcile the latest human instructions and completed work, then continue."],
+        verification: [],
+        blockers: [leftOutLine(files2.leftOut), ...files2.setup.missingSkills.length ? [`Skills it loaded that are not on this computer any more: ${files2.setup.missingSkills.slice(0, 20).join(", ")}.`] : []],
+        artifacts: files2.attached.slice(0, MAX_LISTED_ARTIFACTS).map((file) => ({ path: file.name, description: `Attached from the local ${file.kind === "text" ? "workspace" : file.kind} the conversation used (${file.bytes} bytes).` })),
+        provenance: { native_checkpoint_sha256: digest.digest("hex"), selected_native_session_id: sourceId, context_bytes: outputBytes }
+      }
+    };
+    summaryJson = JSON.stringify(summary);
+  }
+  const body = lines.join("") + files2.lines.join("") + JSON.stringify({ type: "import.summary", package: JSON.parse(summaryJson) }) + "\n" + JSON.stringify({ type: "import.end", records: lines.length + files2.lines.length + 1 }) + "\n";
+  const gaps = [];
+  if (encryptedReasoningCount > 0) gaps.push({ kind: "encrypted_reasoning", count: encryptedReasoningCount });
+  if (compactionCount > 0) gaps.push({ kind: "compaction", count: compactionCount });
+  if (unreadableCount > 0) gaps.push({ kind: "unreadable", count: unreadableCount });
+  const cwd = meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : "");
+  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps, attachedFiles: files2.attached, leftOutFiles: files2.leftOut, setup: files2.setup, cwd, resourceLines: files2.lines };
 }
-
-// src/import-files.ts
-var MAX_ATTACHED_FILE_BYTES = 10 * 1024 * 1024;
-var SECRET_FILE = /(^|\/)(\.env(\..*)?|\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.?credentials(\.json)?|auth\.json|\.claude\.json|id_(rsa|ed25519|ecdsa)[^/]*|.*\.(pem|key|p12|pfx|keystore|jks|kdbx|sqlite|db))$|\/\.ssh\/|\/\.aws\/|\/\.gnupg\/|\/\.docker\/config\.json$|\/Keychains\//i;
-var SKIP_DIR = /(^|\/)(node_modules|\.git|\.next|dist|build|__pycache__|\.venv)(\/|$)/;
-var INSTRUCTION_FILES = ["CLAUDE.md", "AGENTS.md", "HERMES.md", "GEMINI.md", ".cursorrules"];
-var DOCUMENTS = {
-  ".pdf": "application/pdf",
-  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  ".doc": "application/msword",
-  ".rtf": "application/rtf",
-  ".odt": "application/vnd.oasis.opendocument.text"
-};
-var IMAGES = { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".gif": "image/gif", ".webp": "image/webp" };
-var TEXT = {
-  ".md": "text/markdown",
-  ".mdx": "text/markdown",
-  ".txt": "text/plain",
-  ".csv": "text/csv",
-  ".tsv": "text/tab-separated-values",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".css": "text/css",
-  ".scss": "text/css",
-  ".json": "application/json",
-  ".jsonl": "application/x-ndjson",
-  ".ndjson": "application/x-ndjson",
-  ".yaml": "application/yaml",
-  ".yml": "application/yaml",
-  ".toml": "application/toml",
-  ".xml": "application/xml",
-  ".sql": "application/sql",
-  ".svg": "image/svg+xml",
-  ".js": "application/javascript",
-  ".mjs": "application/javascript",
-  ".cjs": "application/javascript",
-  ".py": "text/x-python",
-  ".sh": "text/x-shellscript",
-  ".bash": "text/x-shellscript",
-  ".zsh": "text/x-shellscript"
-};
-var PLAIN_TEXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".jsx", ".mts", ".cts", ".go", ".rs", ".java", ".kt", ".swift", ".rb", ".php", ".c", ".h", ".cc", ".cpp", ".hpp", ".cs", ".scala", ".lua", ".r", ".m", ".tex", ".bib", ".ipynb", ".prisma", ".graphql", ".proto", ".ini", ".cfg", ".conf", ".log", ".rst", ".vue", ".svelte", ".astro", ".tf", ".hcl", ".gradle", ".lock", ".patch", ".diff"]);
-var PLAIN_NAMES = /* @__PURE__ */ new Set(["Dockerfile", "Makefile", "Procfile", "Gemfile", "Rakefile", "LICENSE", "README", ".cursorrules", ".gitignore", ".dockerignore", ".editorconfig", ".prettierrc", ".eslintrc"]);
-function classify(path) {
-  const ext = extname2(path).toLowerCase();
-  if (DOCUMENTS[ext]) return { kind: "document", mediaType: DOCUMENTS[ext] };
-  if (IMAGES[ext]) return { kind: "image", mediaType: IMAGES[ext] };
-  if (TEXT[ext]) return { kind: "text", mediaType: TEXT[ext] };
-  if (PLAIN_TEXT.has(ext) || PLAIN_NAMES.has(basename5(path))) return { kind: "text", mediaType: "text/plain" };
-  return null;
+async function importSession(opts) {
+  const base = (opts.agentUseUrl ?? agentUseBase()).replace(/\/$/, "");
+  const destination2 = new URL(base);
+  if (destination2.username || destination2.password || destination2.protocol !== "https:" && !(destination2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(destination2.hostname))) {
+    throw new Error("Import requires HTTPS, or a loopback development server.");
+  }
+  opts.onProgress?.("Reading transcript and redacting secrets locally\u2026");
+  const { body, transcriptLines, outputBytes, redactionCount, gaps, attachedFiles, leftOutFiles, setup, cwd, resourceLines } = prepareImport(opts.session, opts.summaryPath, { files: opts.files });
+  let traceId;
+  let key;
+  if (opts.importKey && opts.grantTraceId) {
+    traceId = opts.grantTraceId;
+    key = opts.importKey;
+  } else {
+    opts.onProgress?.("Minting import key\u2026");
+    ({ traceId, key } = await mintTrace(base, opts.session.harness));
+  }
+  opts.onProgress?.("Uploading the complete transcript\u2026");
+  const response = await fetch(`${base}/api/traces/ingest`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(12e4),
+    headers: { authorization: `Bearer ${key}`, "content-type": "application/x-ndjson", "x-source-harness": opts.session.harness, "user-agent": USER_AGENT },
+    body
+  });
+  if (!response.ok) {
+    const result2 = await response.json().catch(() => null);
+    throw new Error(typeof result2?.error === "string" ? result2.error : result2?.error?.message ?? `Upload failed (${response.status}).`);
+  }
+  const result = await response.json();
+  const finalTraceId = result.traceId ?? traceId;
+  const environment = opts.files === false || opts.environment === false || !cwd || !existsSync4(cwd) ? null : await uploadEnvironment(base, key, finalTraceId, cwd, resourceLines, opts.onProgress).catch((error) => ({ error: error instanceof Error ? error.message : String(error) }));
+  return {
+    traceId: finalTraceId,
+    url: `${base}/playground/new?import=${encodeURIComponent(finalTraceId)}`,
+    harness: opts.session.harness,
+    sessionId: opts.session.sessionId,
+    transcriptFiles: opts.session.files.length,
+    bytes: outputBytes,
+    redactionCount,
+    gaps,
+    attachedFiles,
+    leftOutFiles,
+    setup,
+    environment
+  };
 }
-var SHELL_READ = /(?:^|[\s;&|(`"'])(?:cat|head|tail|nl|less|more|wc|bat|sed\s+-n\s+(?:'[^']*'|"[^"]*"|\S+))(?:\s+-[\w-]+(?:\s+\d+)?)*\s+((?:~|\.{0,2}\/)?[\w@%+./~-]*[\w-]\.[\w]{1,10}|\/[\w@%+./-]+)/g;
-var PATH_KEYS = ["file_path", "path", "notebook_path", "filePath", "target_file"];
-var obj = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
-var str = (value) => typeof value === "string" ? value : "";
-function shellText(input) {
-  if (typeof input === "string") return input;
-  const i = obj(input);
-  if (!i) return "";
-  const command = Array.isArray(i.command) ? i.command.filter((part) => typeof part === "string").join(" ") : str(i.command);
-  return [command, str(i.cmd), str(i.script)].filter(Boolean).join("\n");
+async function grantCall(base, key, path, body) {
+  const response = await fetch(`${base}${path}`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(3e5),
+    headers: { authorization: `Bearer ${key}`, "content-type": "application/json", "user-agent": USER_AGENT },
+    body: JSON.stringify(body)
+  });
+  const answer = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(typeof answer?.error === "string" ? answer.error : answer?.error?.message ?? `The environment upload failed (${response.status}).`);
+  return answer;
 }
-function touchedPaths(records, cwd, home = homedir3()) {
-  const out = /* @__PURE__ */ new Set();
-  const add = (raw, base) => {
-    if (!raw || raw.length > 1e3) return;
-    const path = raw.replace(/^~(?=\/)/, home);
-    if (isAbsolute(path)) out.add(resolve4(path));
-    else if (base) out.add(resolve4(base, path));
-  };
-  const call = (name, input) => {
-    const i = obj(input);
-    const base = str(i?.workdir) || str(i?.cwd) || cwd;
-    if (i) for (const key of PATH_KEYS) add(str(i[key]), base);
-    const patch = typeof input === "string" ? input : str(i?.input) || str(i?.patch);
-    for (const match of patch.matchAll(/^\*\*\* (?:Add|Update) File: (.+)$/gm)) add(match[1].trim(), base);
-    if (!/bash|shell|exec|terminal|command|run/i.test(name)) return;
-    for (const match of shellText(input).replace(/\\n/g, "\n").matchAll(SHELL_READ)) add(match[1], base);
-  };
-  for (const raw of records) {
-    const record = obj(raw);
-    if (!record) continue;
-    const content = obj(record.message)?.content;
-    if (record.type === "assistant" && Array.isArray(content)) {
-      for (const block of content) {
-        const b = obj(block);
-        if (b?.type === "tool_use") call(str(b.name), b.input);
-      }
-    }
-    const payload = obj(record.payload);
-    if (record.type === "response_item" && (payload?.type === "function_call" || payload?.type === "custom_tool_call")) {
-      let input = payload.arguments ?? payload.input ?? "";
-      if (typeof input === "string") {
-        try {
-          input = JSON.parse(input);
-        } catch {
-          input = payload.arguments ?? payload.input;
-        }
+async function uploadEnvironment(base, key, traceId, cwd, resourceLines, onProgress) {
+  onProgress?.("Packing the working folder (secrets redacted locally)\u2026");
+  const packed = await packEnvironment(cwd, resourcesOf(resourceLines));
+  try {
+    const path = `/api/traces/${encodeURIComponent(traceId)}/environment`;
+    const { upload } = await grantCall(base, key, path, { name: packed.folder, size: packed.bytes, sha256: packed.sha256, files: packed.files });
+    let shown = -1;
+    await transfer(upload, packed.path, (sent, total) => {
+      const percent = Math.floor(sent / total * 100);
+      if (percent >= shown + 10 || sent === total) {
+        shown = percent;
+        onProgress?.(`Uploading the working folder\u2026 ${percent}% of ${(total / 1024 / 1024).toFixed(1)} MiB`);
       }
-      call(str(payload.name), input);
-    }
+    });
+    await grantCall(base, key, `${path}/complete`, {});
+    return { folder: packed.folder, files: packed.files, bytes: packed.bytes, redacted: packed.redacted, leftOut: packed.leftOut.length };
+  } finally {
+    packed.dispose();
   }
-  return [...out];
 }
-function gitRoot(dir) {
-  for (let d = dir; ; d = dirname4(d)) {
-    if (existsSync5(join5(d, ".git"))) return d;
-    if (d === dirname4(d)) return null;
+
+// src/context.ts
+async function contextRequest(path, universe2) {
+  try {
+    return await api("GET", `/api${path}`, void 0, { base: agentUseBase(), universe: universe2 });
+  } catch (error) {
+    if (!(error instanceof ApiError) || ![401, 403, 409].includes(error.status)) throw error;
+    return api("GET", path, void 0, { universe: universe2 });
   }
 }
-function instructionPaths(cwd, harness2, home = homedir3()) {
-  const out = [];
-  if (cwd && existsSync5(cwd)) {
-    const root = gitRoot(cwd) ?? cwd;
-    for (let d = resolve4(cwd); ; d = dirname4(d)) {
-      for (const name of INSTRUCTION_FILES) out.push(join5(d, name));
-      if (d === root || d === dirname4(d)) break;
-    }
-  }
-  if (harness2 === "claude_code") out.push(join5(process.env.CLAUDE_CONFIG_DIR ?? join5(home, ".claude"), "CLAUDE.md"));
-  if (harness2 === "codex") out.push(join5(process.env.CODEX_HOME ?? join5(home, ".codex"), "AGENTS.md"));
-  out.push(...sharedInstructionPaths(home));
-  return out.filter((path) => {
-    try {
-      return statSync4(path).isFile();
-    } catch {
-      return false;
-    }
-  });
+async function searchContext(query, opts, universe2) {
+  const page = await contextRequest(`/context/search${searchQuery(query, opts)}`, universe2);
+  return { ...page, hits: page.hits.map((entry2) => "hit" in entry2 ? entry2.hit : entry2) };
 }
-function resourceName(path, cwd, home = homedir3()) {
-  const inside = cwd ? relative2(resolve4(cwd), path) : "";
-  if (cwd && inside && !inside.startsWith("..") && !isAbsolute(inside)) return `workspace/${inside.split(sep2).join("/")}`;
-  const underHome = relative2(home, path);
-  const shown = !underHome.startsWith("..") && !isAbsolute(underHome) ? `~/${underHome}` : path.replace(/^\/+/, "");
-  return `files/${shown.split(sep2).join("/")}`;
+function memoryBody(operation, version) {
+  return { ...operation, expectedVersion: version };
 }
-var ORDER = { text: 0, document: 1, image: 2 };
-function resourceLine(name, mediaType, data) {
-  return redactLine(JSON.stringify({ type: "import.resource", name, media_type: mediaType, data: data.toString("base64") }), { requireStructured: true }).line + "\n";
+function memoryIndex(value) {
+  if (!/^\d+$/.test(value.trim())) throw new Error(`the entry number must be a whole number, got ${JSON.stringify(value)}`);
+  return Number(value.trim());
 }
-function collectSessionFiles(records, opts) {
-  const home = opts.home ?? homedir3();
-  const exclude = new Set((opts.exclude ?? []).map((path) => resolve4(path)));
-  const leftOut = [];
-  const candidates = [];
-  const seen = /* @__PURE__ */ new Set();
-  const touched = touchedPaths(records, opts.cwd, home);
-  const skills2 = loadedSkills(records, touched, opts.cwd, home);
-  const consider = (path, name) => {
-    if (seen.has(path) || exclude.has(path)) return;
-    seen.add(path);
-    if (SECRET_FILE.test(path) || SKIP_DIR.test(path)) {
-      leftOut.push({ path, reason: "credential or build file" });
-      return;
-    }
-    let size;
-    try {
-      const stat = statSync4(path);
-      if (!stat.isFile()) return;
-      size = stat.size;
-    } catch {
-      leftOut.push({ path, reason: "missing" });
-      return;
-    }
-    const type = classify(path);
-    if (!type) {
-      leftOut.push({ path, reason: "unsupported type" });
-      return;
-    }
-    if (size > MAX_ATTACHED_FILE_BYTES) {
-      leftOut.push({ path, reason: "too large" });
-      return;
-    }
-    candidates.push({ path, name, ...type, size });
-  };
-  for (const path of [...instructionPaths(opts.cwd, opts.harness, home), ...touched]) consider(path, resourceName(path, opts.cwd, home));
-  for (const skill of skills2.found) for (const file of skillFiles(skill)) consider(file.path, file.name);
-  candidates.sort((a, b) => ORDER[a.kind] - ORDER[b.kind] || a.size - b.size);
+function renderMemory(document) {
+  if (!document.entries.length) return "no saved memory \u2014 `sky memory save <text>` adds an entry";
+  return document.entries.map((entry2) => `${String(entry2.index).padStart(3)}  ${entry2.text}`).join("\n");
+}
+function searchQuery(query, opts) {
+  const params = new URLSearchParams({ q: query });
+  params.set("scope", opts.scope ?? "everything");
+  if (opts.limit) params.set("limit", opts.limit);
+  if (opts.cursor) params.set("cursor", opts.cursor);
+  if (opts.since) params.set("since", opts.since);
+  if (opts.until) params.set("until", opts.until);
+  return `?${params.toString()}`;
+}
+function refArgument(ref) {
+  return `'${JSON.stringify(ref).replace(/'/g, "'\\''")}'`;
+}
+function renderContextPage(page) {
   const lines = [];
-  const attached = [];
-  let bytes = 0;
-  const state = workspaceState(opts.cwd, opts.harness, skills2, home, opts.title ?? null);
-  const described = !!opts.cwd || !!state.manifest.title || state.manifest.skills.length > 0 || state.manifest.mcp_servers.length > 0;
-  const generated = [
-    ...described ? [{ name: "agentsky/workspace.json", mediaType: "application/json", data: Buffer.from(JSON.stringify(state.manifest, null, 2)) }] : [],
-    ...state.patch ? [{ name: "agentsky/uncommitted.patch", mediaType: "text/x-diff", data: Buffer.from(state.patch) }] : []
-  ];
-  for (const file of generated) {
-    let line;
-    try {
-      line = resourceLine(file.name, file.mediaType, file.data);
-    } catch {
-      leftOut.push({ path: file.name, reason: "could not be redacted safely" });
-      continue;
-    }
-    const size = Buffer.byteLength(line);
-    if (bytes + size > opts.budget) {
-      leftOut.push({ path: file.name, reason: "over the upload budget" });
-      continue;
-    }
-    bytes += size;
-    lines.push(line);
-    attached.push({ name: file.name, kind: "text", bytes: file.data.length });
+  for (const hit of page.hits) {
+    lines.push(`${hit.path ?? hit.title}${hit.line ? `:${hit.line}` : ""}: ${hit.snippet.replace(/\s+/g, " ").slice(0, 160)}`);
+    lines.push(`    sky context read ${refArgument(hit.ref)}`);
   }
-  for (const file of candidates) {
-    let data;
-    try {
-      data = readFileSync6(file.path);
-    } catch {
-      leftOut.push({ path: file.path, reason: "missing" });
-      continue;
-    }
-    if (file.kind === "text" && data.includes(0)) {
-      leftOut.push({ path: file.path, reason: "not valid UTF-8 text" });
-      continue;
-    }
-    let line;
-    try {
-      line = resourceLine(file.name, file.mediaType, data);
-    } catch {
-      leftOut.push({ path: file.path, reason: file.kind === "text" && !isUtf8(data) ? "not valid UTF-8 text" : "could not be redacted safely" });
+  if (!page.hits.length) lines.push("no matches on this page");
+  const missed = (page.sources ?? []).filter((source) => source.status === "failed" || source.status === "partial").map((source) => source.source);
+  if (page.partial) lines.push(`partial: ${missed.length ? `${missed.join(", ")} not fully searched` : "not every source was searched"}`);
+  if (page.nextCursor) lines.push(`more: --cursor ${page.nextCursor}`);
+  return lines.join("\n");
+}
+
+// src/agent-file.ts
+import { existsSync as existsSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname4, resolve as resolve3 } from "path";
+import { parse as parseToml2 } from "smol-toml";
+var fileInstructionSchema = external_exports.object({
+  name: external_exports.string(),
+  content: external_exports.string().optional(),
+  file: external_exports.string().optional()
+});
+var agentFileSchema = external_exports.object({
+  name: external_exports.string().min(1),
+  id: external_exports.string().optional(),
+  // stamped by launch/deploy; identifies the live agent
+  slug: external_exports.string().optional(),
+  // pre-RFC-0079 stamp; ignored (agents are id-addressed)
+  description: external_exports.string().optional(),
+  type: external_exports.enum(AGENT_TYPES).optional(),
+  llm: external_exports.string().optional(),
+  reasoning_effort: external_exports.enum(REASONING_EFFORT_VALUES).optional(),
+  capabilities: capabilitiesSchema.removeDefault().optional(),
+  // omitted = leave the agent's as they are
+  prompt: external_exports.string().optional(),
+  prompt_file: external_exports.string().optional(),
+  instructions: external_exports.array(fileInstructionSchema).optional(),
+  skills: external_exports.array(skillRefSchema).optional(),
+  customData: external_exports.array(customDataSchema).optional(),
+  /** "deny" makes the agent work alone: its sessions may not hire helpers. */
+  hiring_policy: external_exports.enum(["allow", "deny"]).optional(),
+  /** The environment its sessions boot in when they name none. */
+  environment: external_exports.string().min(1).optional(),
+  /** Advanced machine shape (create-only): 1|2|4|8 vCPUs, 256MB-step memory. */
+  vcpus: external_exports.number().int().optional(),
+  memory_mb: external_exports.number().int().optional()
+});
+function readAgentFile(path) {
+  const raw = readFileSync7(path, "utf8");
+  const parsed = agentFileSchema.safeParse(parseToml2(raw));
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    throw new Error(`${path}: ${issue?.path.join(".") ?? ""} ${issue?.message ?? "invalid"}`);
+  }
+  const file = parsed.data;
+  if (file.reasoning_effort && file.type && !isModelEffortSupported(file.type, file.llm ?? defaultLlm(file.type), file.reasoning_effort)) {
+    throw new Error(
+      `${path}: reasoning_effort '${file.reasoning_effort}' is not available for ${file.type} \u2014 ${reasoningEffortDocLine()}`
+    );
+  }
+  const base = dirname4(resolve3(path));
+  const inline = (ref, inlineContent) => {
+    if (inlineContent !== void 0) return inlineContent;
+    if (!ref) return void 0;
+    return readFileSync7(resolve3(base, ref), "utf8");
+  };
+  const spec = {
+    name: file.name,
+    description: file.description,
+    agentType: file.type,
+    llm: file.llm,
+    reasoningEffort: file.reasoning_effort,
+    displayName: file.name,
+    capabilities: file.capabilities,
+    prompt: inline(file.prompt_file, file.prompt),
+    instructions: file.instructions?.map((f) => {
+      const content = inline(f.file, f.content);
+      if (content === void 0) throw new Error(`instruction ${f.name}: content or file required`);
+      return { name: f.name, content };
+    }),
+    skills: file.skills,
+    customData: file.customData,
+    hiringPolicy: file.hiring_policy,
+    environmentId: file.environment,
+    vcpus: file.vcpus,
+    memoryMb: file.memory_mb
+  };
+  return { file, spec };
+}
+function stampId(path, id) {
+  writeFileSync2(path, stampIdText(readFileSync7(path, "utf8"), id));
+}
+function stampIdText(text, id) {
+  const out = [];
+  let topLevel = true;
+  let openString = null;
+  let stamped = false;
+  let nameAt = -1;
+  for (const line of text.split("\n")) {
+    if (openString) {
+      if (line.includes(openString)) openString = null;
+      out.push(line);
       continue;
     }
-    const size = Buffer.byteLength(line);
-    if (bytes + size > opts.budget) {
-      leftOut.push({ path: file.path, reason: "over the upload budget" });
+    if (/^\s*\[/.test(line)) topLevel = false;
+    if (topLevel && /^\s*(id|slug)\s*=/.test(line)) {
+      if (/^\s*id\s*=/.test(line) && !stamped) {
+        out.push(`id = ${JSON.stringify(id)}`);
+        stamped = true;
+      }
       continue;
     }
-    bytes += size;
-    lines.push(line);
-    attached.push({ name: file.name, kind: file.kind, bytes: data.length });
+    if (topLevel && nameAt < 0 && /^\s*name\s*=/.test(line)) nameAt = out.length;
+    const opener = /=\s*("""|''')/.exec(line);
+    if (opener && !line.slice(opener.index + opener[0].length).includes(opener[1])) openString = opener[1];
+    out.push(line);
   }
-  const setup = {
-    skills: skills2.found.map((skill) => skill.name),
-    missingSkills: skills2.missing,
-    mcpServers: state.manifest.mcp_servers.map((server) => server.name),
-    git: state.manifest.git !== null
-  };
-  return { lines, bytes, attached, leftOut, setup };
+  if (!stamped) out.splice(nameAt + 1, 0, `id = ${JSON.stringify(id)}`);
+  const next = out.join("\n");
+  if (parseToml2(next).id !== id) throw new Error("could not stamp the agent id into the file");
+  return next;
 }
+function scaffoldAgentFile(path, name) {
+  if (existsSync5(path)) throw new Error(`${path} already exists`);
+  writeFileSync2(
+    path,
+    `# agent.toml \u2014 everything the create wizard can set. Only \`name\` is required.
+name = "${name}"
+# type = "pi"                  # pi (default) | hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode
+# llm = "deepseek-flash"       # must be compatible with type
+# reasoning_effort = "high"    # per harness \u2014 ${reasoningEffortDocLine()}
+# capabilities = []
+# hiring_policy = "deny"       # its sessions work alone; "allow" (default) lets them hire helpers
+# environment = "env_..."      # the environment its sessions boot in when they name none
+# [[skills]]                   # a skill from \`sky skills upload <dir>\`
+# type = "skill"
+# skillId = "skill_..."
 
-// src/import-environment.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { createHash as createHash2 } from "crypto";
-import { closeSync as closeSync2, createWriteStream, lstatSync, mkdtempSync, openSync as openSync2, readdirSync as readdirSync3, readFileSync as readFileSync7, readSync as readSync2, rmSync as rmSync2 } from "fs";
-import { tmpdir } from "os";
-import { join as join6 } from "path";
-import { isUtf8 as isUtf82 } from "buffer";
-import { createGzip } from "zlib";
-
-// ../../packages/spec/src/import-layout.ts
-import { gzipSync } from "zlib";
-function folderName(workspace2, sourceCwd) {
-  const raw = workspace2?.project || (sourceCwd ? sourceCwd.split("/").filter(Boolean).pop() : "") || "";
-  const cleaned = raw.replace(/[^A-Za-z0-9._ -]/g, "-").replace(/^[^A-Za-z0-9_]+/, "").replace(/\.\.+/g, ".").slice(0, 80).trim();
-  return cleaned || "imported-session";
+prompt = """
+You are ${name}, a helpful long-lived agent.
+"""
+`
+  );
 }
-function envName(server, field) {
-  return `${server}_${field}`.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+function deployPatch(spec) {
+  return {
+    displayName: spec.displayName,
+    ...spec.agentType ? { agentType: spec.agentType } : {},
+    ...spec.llm ? { llm: spec.llm } : {},
+    ...spec.capabilities ? { capabilities: spec.capabilities } : {},
+    ...spec.reasoningEffort ? { reasoningEffort: spec.reasoningEffort } : {},
+    ...spec.skills ? { skills: spec.skills } : {},
+    ...spec.hiringPolicy ? { hiringPolicy: spec.hiringPolicy } : {},
+    ...spec.environmentId ? { environmentId: spec.environmentId } : {}
+  };
 }
-function ownServer(server, platform) {
-  try {
-    return server.transport !== "stdio" && platform.ownHost.test(new URL(server.url ?? "").hostname);
-  } catch {
-    return false;
+function deployReport(id, spec, before, after, promptChanged) {
+  if (spec.agentType && after.agentType !== spec.agentType) {
+    throw new Error(`${id} is still ${after.agentType}: the API did not apply type = "${spec.agentType}"`);
+  }
+  if (spec.llm && after.llm !== spec.llm) {
+    throw new Error(`${id} still runs ${after.llm}: the API did not apply llm = "${spec.llm}"`);
   }
+  const changed = [];
+  if (promptChanged) changed.push("prompt");
+  if (after.version !== before.version) changed.push("settings");
+  if (!changed.length) return [`${id} is up to date \u2014 nothing to deploy (version ${after.version})`];
+  const lines = [`Deployed ${id}: ${changed.join(" and ")} updated (version ${before.version} \u2192 ${after.version})`];
+  if (after.agentType !== before.agentType || after.llm !== before.llm) {
+    lines.push(`  now ${after.agentType} \xB7 ${after.llm} for new sessions (was ${before.agentType} \xB7 ${before.llm})`);
+  }
+  if (spec.skills && after.version !== before.version) {
+    lines.push(`  Skills apply to new sessions; running sessions keep the skills they started with \u2014 start one with \`sky session create ${id}\`.`);
+  }
+  return lines;
 }
-function mcpJson(servers, platform) {
-  const entries = servers.filter((server) => !ownServer(server, platform)).map((server) => {
-    if (server.transport === "stdio") {
-      return [server.name, {
-        command: server.command,
-        ...server.args?.length ? { args: server.args } : {},
-        ...server.env?.length ? { env: Object.fromEntries(server.env.map((name) => [name, `\${${name}:-}`])) } : {}
-      }];
-    }
-    const query = server.query?.length ? `?${server.query.map((name) => `${encodeURIComponent(name)}=\${${envName(server.name, name)}:-}`).join("&")}` : "";
-    return [server.name, {
-      type: server.transport,
-      url: `${server.url}${query}`,
-      ...server.headers?.length ? { headers: Object.fromEntries(server.headers.map((name) => [name, `\${${envName(server.name, name)}:-}`])) } : {}
-    }];
-  });
-  return JSON.stringify({ mcpServers: Object.fromEntries(entries) }, null, 2) + "\n";
+
+// src/catalog.ts
+var bare = (handle) => handle.replace(/^@/, "");
+var optionalAuth = () => ({ auth: Boolean(apiToken()) });
+function catalogQuery(filter) {
+  const params = new URLSearchParams();
+  if (filter.text?.trim()) params.set("q", filter.text.trim());
+  if (filter.category) params.set("category", filter.category);
+  const query = params.toString();
+  return query ? `?${query}` : "";
 }
-function bullet(items, none) {
-  return items.length ? items.map((item) => `- ${item}`).join("\n") : `- ${none}`;
+function listingBody(agentId, options) {
+  return {
+    agent_id: agentId,
+    handle: bare(options.handle),
+    tagline: options.tagline,
+    ...options.description ? { description: options.description } : {},
+    ...options.category?.length ? { categories: options.category } : {},
+    ...options.does?.length ? { does: options.does } : {},
+    ...options.doesNot?.length ? { does_not: options.doesNot } : {},
+    ...options.example?.length ? { examples: options.example } : {}
+  };
 }
-function readme(folder, workspace2, counts, skills2, mcpWritten, platform) {
-  const git2 = workspace2?.git;
-  const servers = workspace2?.mcp_servers ?? [];
-  const missingSkills = (workspace2?.skills ?? []).filter((skill) => !skill.found).map((skill) => skill.name);
-  const secrets2 = servers.filter((server) => !ownServer(server, platform)).flatMap((server) => [
-    ...server.env ?? [],
-    ...(server.headers ?? []).map((name) => envName(server.name, name)),
-    ...(server.query ?? []).map((name) => envName(server.name, name))
-  ]);
-  const where = workspace2?.cwd ? ` (${workspace2.cwd})` : "";
+async function listCatalog(filter = {}) {
+  return (await api("GET", `/catalog/agents${catalogQuery(filter)}`, void 0, optionalAuth())).agents;
+}
+async function showCatalogAgent(handle) {
+  return (await api("GET", `/catalog/agents/${encodeURIComponent(bare(handle))}`, void 0, optionalAuth())).agent;
+}
+async function listCategories() {
+  return (await api("GET", "/catalog/categories", void 0, { auth: false })).categories;
+}
+async function publishListing(agentId, options) {
+  return (await api("POST", "/catalog/listings", listingBody(agentId, options))).agent;
+}
+async function removeListing(handle) {
+  await api("DELETE", `/catalog/listings/${encodeURIComponent(bare(handle))}`);
+}
+async function setEngineStatus(engine, status, reason) {
+  await api("PATCH", `/catalog/engines/${encodeURIComponent(engine)}`, { status, reason });
+  const state = await api("GET", "/catalog/engines", void 0, { auth: false });
+  if (state.delisted.includes(engine) !== (status === "delisted")) {
+    throw new Error("The catalog does not show the requested state; check whether another operator changed it.");
+  }
+}
+var uses = (agent2) => `${agent2.stats.uses} ${agent2.stats.uses === 1 ? "use" : "uses"}`;
+var mine = (agent2) => agent2.visibility === "workspace" ? "  (yours)" : "";
+function renderCatalogAgent(agent2) {
+  const section = (title, lines) => lines.length ? [`${title}:`, ...lines.map((line) => `  - ${line}`)] : [];
   return [
-    "# Imported working copy",
-    "",
-    `This folder (/workspace/${folder}) holds what the imported conversation worked with on the person's computer.`,
-    "It is historical context: verify a path before acting on it, and follow the person's current message.",
-    "",
-    "## Files",
-    counts.wholeFolder ? `- The whole working directory${where}, ${counts.project} files at the same relative paths: its tracked files and new files git does not ignore (every file when it is not a repository), without version-control data, dependency and build output, or credential files.` : `- ${counts.project} files from the original working directory${where}, at the same relative paths: the files the conversation read, wrote or edited and its instruction files. The rest of the working tree did not travel${workspace2?.tree?.length ? `; its full file list is in ${platform.notesDir}/workspace.json (\`tree\`)` : ""}.`,
-    ...counts.outside ? [`- ${counts.outside} files from elsewhere on that computer (shared instructions such as ~/AGENTS.md, and files outside the working directory) under ${platform.notesDir}/files/, with ~ as home/.`] : [],
-    ...counts.attachments ? [`- ${counts.attachments} attachments of the conversation under ${platform.notesDir}/attachments/.`] : [],
-    "- Text was redacted on that computer before upload: a masked value (\u25CF\u25CF\u25CF\u25CF\u25CF) is a secret that was removed, not the real content.",
-    "",
-    "## Repository",
-    ...git2 ? [
-      `- Remote: ${git2.remote ?? "none"}`,
-      `- Branch: ${git2.branch ?? "detached"} at commit ${git2.commit ?? "unknown"}${git2.ahead ? ` (${git2.ahead} commits not pushed)` : ""}`,
-      ...git2.dirty?.length ? [`- Uncommitted changes in ${git2.dirty.length} paths${counts.wholeFolder ? " are already in these files" : ""}; the change against that commit is ${platform.notesDir}/uncommitted.patch (apply with \`git apply\` on a checkout of that commit).`] : ["- No uncommitted changes."],
-      counts.wholeFolder ? "- This folder's own git history starts with this copy; the project's history is on the remote." : `- To get the whole repository, clone the remote at that commit (connect GitHub in ${platform.name} if it is private), apply the patch, then use the files here.`
-    ] : ["- The working directory was not a git repository."],
+    `@${agent2.handle}  ${agent2.name}${mine(agent2)}`,
+    agent2.tagline,
+    ...agent2.description && agent2.description !== agent2.tagline ? ["", agent2.description] : [],
     "",
-    "## Skills",
-    bullet(skills2.map((name) => `${name}: .claude/skills/${name}/SKILL.md (also .agents/skills/${name}/)`), "No skills were loaded."),
-    ...missingSkills.length ? ["", `Loaded but no longer on that computer, so not carried: ${missingSkills.join(", ")}.`] : [],
+    `Categories: ${agent2.categories.join(", ") || "none"}`,
+    `Used: ${uses(agent2)}`,
+    ...section("Does", agent2.does),
+    ...section("Does not", agent2.does_not),
+    ...section("Examples", agent2.examples),
     "",
-    "## Tool servers (MCP)",
-    bullet(servers.map((server) => `${server.name} (${server.transport}${server.scope ? `, ${server.scope}` : ""}): ${server.transport === "stdio" ? [server.command, ...server.args ?? []].join(" ") : server.url}`), "None were configured."),
-    ...mcpWritten ? ["", `They are written to .mcp.json in this folder with every key as \${NAME:-}, except ${platform.name}'s own server, whose tools this session already has. Their values never leave the person's computer${secrets2.length ? `; these must be supplied to use them: ${[...new Set(secrets2)].join(", ")}` : ""}. A stdio server runs only if its command is installed here, and Claude Code connects a project server only once it is approved.`] : [],
-    ""
+    `Hire it: sky session create @${agent2.handle} --message "\u2026"`
   ].join("\n");
 }
-function parseWorkspace(file) {
-  if (!file) return null;
+
+// src/clone.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir4 } from "os";
+import { basename as basename5, join as join7 } from "path";
+import { createInterface } from "readline";
+var PROMPT_CAP = 1e5;
+var HARNESSES = ["claude_code", "codex", "openclaw"];
+function claudeConfigRoot() {
+  return process.env.CLAUDE_CONFIG_DIR ?? join7(homedir4(), ".claude");
+}
+function readIfExists(path) {
   try {
-    const value = JSON.parse(file.data.toString("utf8"));
-    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+    return readFileSync8(path, "utf8");
   } catch {
-    return null;
+    return void 0;
   }
 }
-function importLayout(files2, sourceCwd, platform, wholeFolder) {
-  if (!files2.length && !wholeFolder) return null;
-  const workspace2 = parseWorkspace(files2.find((file) => file.name === "agentsky/workspace.json"));
-  const folder = folderName(workspace2, sourceCwd);
-  const entries = /* @__PURE__ */ new Map();
-  const skills2 = /* @__PURE__ */ new Set();
-  const counts = { project: wholeFolder?.files ?? 0, outside: 0, attachments: 0, wholeFolder: Boolean(wholeFolder) };
-  for (const file of files2) {
-    const [kind, ...rest] = file.name.split("/");
-    const path = rest.join("/");
-    if (kind === "workspace") {
-      if (wholeFolder) continue;
-      entries.set(path, file.data);
-      counts.project += 1;
-    } else if (kind === "files") {
-      entries.set(`${platform.notesDir}/files/${path.replace(/^~\//, "home/")}`, file.data);
-      counts.outside += 1;
-    } else if (kind === "imported-attachments") {
-      entries.set(`${platform.notesDir}/attachments/${path}`, file.data);
-      counts.attachments += 1;
-    } else if (kind === "agentsky") entries.set(`${platform.notesDir}/${path}`, file.data);
-    else if (kind === "skills" && rest.length > 1) {
-      const skill = rest[0].split(":").pop();
-      const inside = rest.slice(1).join("/");
-      skills2.add(skill);
-      entries.set(`.claude/skills/${skill}/${inside}`, file.data);
-      entries.set(`.agents/skills/${skill}/${inside}`, file.data);
-    }
+function readJson2(path) {
+  const raw = readIfExists(path);
+  if (raw === void 0) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return void 0;
   }
-  const servers = (workspace2?.mcp_servers ?? []).filter((server) => server && typeof server.name === "string" && (server.transport === "stdio" ? typeof server.command === "string" : typeof server.url === "string"));
-  const mcpWritten = servers.length > 0 && !entries.has(".mcp.json") && !wholeFolder?.paths.has(".mcp.json");
-  if (mcpWritten) entries.set(".mcp.json", Buffer.from(mcpJson(servers, platform)));
-  entries.set(`${platform.notesDir}/README.md`, Buffer.from(readme(folder, workspace2 ? { ...workspace2, mcp_servers: servers } : null, counts, [...skills2], mcpWritten, platform)));
-  if (wholeFolder) for (const path of wholeFolder.paths) entries.delete(path);
-  return { folder, entries, skills: [...skills2], mcpServers: servers.map((server) => server.name) };
-}
-var TAR_BLOCK = 512;
-var TAR_END = Buffer.alloc(TAR_BLOCK * 2);
-function header(name, size, type) {
-  const block = Buffer.alloc(TAR_BLOCK);
-  block.write(name, 0, 100, "utf8");
-  block.write("0000644\0", 100);
-  block.write("0000000\0", 108);
-  block.write("0000000\0", 116);
-  block.write(size.toString(8).padStart(11, "0") + "\0", 124);
-  block.write("00000000000\0", 136);
-  block.write("        ", 148);
-  block.write(type, 156);
-  block.write("ustar\x0000", 257);
-  let sum = 0;
-  for (const byte of block) sum += byte;
-  block.write(sum.toString(8).padStart(6, "0") + "\0 ", 148);
-  return block;
 }
-function paxRecord(key, value) {
-  const body = ` ${key}=${value}
-`;
-  let length = Buffer.byteLength(body);
-  for (; ; ) {
-    const total = String(length).length + length;
-    if (String(total).length + length === total) return Buffer.from(`${total}${body}`);
-    length += 1;
+function claudeModel(configRoot) {
+  const candidates = [
+    join7(process.cwd(), ".claude", "settings.local.json"),
+    join7(process.cwd(), ".claude", "settings.json"),
+    join7(configRoot, "settings.json")
+  ];
+  for (const path of candidates) {
+    const model = readJson2(path)?.model;
+    if (typeof model === "string" && model.trim()) return model.trim();
   }
+  return void 0;
 }
-function tarPadding(size) {
-  const rest = size % TAR_BLOCK;
-  return Buffer.alloc(rest ? TAR_BLOCK - rest : 0);
-}
-function tarHeader(path, size) {
-  if (Buffer.byteLength(path) <= 100) return header(path, size, "0");
-  const pax = paxRecord("path", path);
-  return Buffer.concat([header("PaxHeader", pax.length, "x"), pax, tarPadding(pax.length), header(path, size, "0")]);
+function claudeMcpServers() {
+  const merged = {};
+  const userConfig = readJson2(join7(homedir4(), ".claude.json"));
+  Object.assign(merged, userConfig?.mcpServers ?? {});
+  Object.assign(merged, userConfig?.projects?.[process.cwd()]?.mcpServers ?? {});
+  const projectConfig = readJson2(
+    join7(process.cwd(), ".mcp.json")
+  );
+  Object.assign(merged, projectConfig?.mcpServers ?? {});
+  return merged;
 }
+function assemblePrompt(parts) {
+  const joined = parts.map((p) => `# \u2500\u2500 ${p.label} \u2500\u2500
 
-// src/import-environment.ts
-var IMPORT_PLATFORM = { name: "AgentSky", ownHost: /(^|\.)(agentsky\.dev|asteroidbelt\.ai)$/i, notesDir: ".agentsky-import" };
-var MAX_ENVIRONMENT_FILES = 2e5;
-var MAX_ENVIRONMENT_BYTES = 2 * 1024 ** 3;
-var MAX_REDACTED_TEXT_BYTES = 10 * 1024 * 1024;
-var SKIPPED = /* @__PURE__ */ new Set([".git", "node_modules", ".venv", "venv", "__pycache__", ".next", "dist", "build", "target", ".DS_Store", ".cache", ".turbo"]);
-var SECRET_FILE2 = /(^|\/)(\.env(\..*)?|\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.?credentials(\.json)?|auth\.json|\.claude\.json|id_(rsa|ed25519|ecdsa)[^/]*|.*\.(pem|key|p12|pfx|keystore|jks|kdbx))$|(^|\/)\.ssh\/|(^|\/)\.aws\/|(^|\/)\.gnupg\/|(^|\/)\.docker\/config\.json$/i;
-function listFiles(cwd) {
-  const git2 = spawnSync2("git", ["-C", cwd, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 512 * 1024 * 1024 });
-  if (git2.status === 0) return git2.stdout.split("\0").filter(Boolean).filter((path) => !path.split("/").some((part) => part === ".git"));
-  const out = [];
-  const walk = (dir, prefix) => {
-    let entries;
-    try {
-      entries = readdirSync3(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry2 of entries) {
-      if (SKIPPED.has(entry2.name)) continue;
-      const rel = prefix ? `${prefix}/${entry2.name}` : entry2.name;
-      if (entry2.isDirectory()) walk(join6(dir, entry2.name), rel);
-      else out.push(rel);
-      if (out.length > MAX_ENVIRONMENT_FILES) return;
-    }
-  };
-  walk(cwd, "");
-  return out;
-}
-function textOf(path, size) {
-  if (size > MAX_REDACTED_TEXT_BYTES) return null;
-  const data = readFileSync7(path);
-  if (data.subarray(0, 8e3).includes(0) || !isUtf82(data)) return null;
-  return data;
+${p.content.trim()}`).join("\n\n").trim();
+  if (joined.length <= PROMPT_CAP) return { prompt: joined, truncated: false };
+  const notice = "\n\n[truncated by sky clone: local instructions exceeded the 100k prompt cap]";
+  return { prompt: joined.slice(0, PROMPT_CAP - notice.length) + notice, truncated: true };
 }
-async function packEnvironment(cwd, resources, platform = IMPORT_PLATFORM) {
-  const listed = listFiles(cwd);
-  if (listed.length > MAX_ENVIRONMENT_FILES) throw new Error(`The working folder has more than ${MAX_ENVIRONMENT_FILES} files; import it with --no-environment.`);
-  const scratch = mkdtempSync(join6(tmpdir(), "sky-environment-"));
-  const path = join6(scratch, "environment.tar.gz");
-  const leftOut = [];
-  const written2 = /* @__PURE__ */ new Set();
-  const hash = createHash2("sha256");
-  let bytes = 0;
-  let redacted2 = 0;
-  const gzip = createGzip({ level: 6 });
-  const sink = createWriteStream(path);
-  gzip.on("data", (chunk) => {
-    bytes += chunk.length;
-    hash.update(chunk);
-  });
-  gzip.pipe(sink);
-  const done = new Promise((resolve10, reject) => {
-    sink.on("finish", () => resolve10());
-    sink.on("error", reject);
-    gzip.on("error", reject);
-  });
-  const write = (chunk) => new Promise((resolve10, reject) => {
-    if (bytes > MAX_ENVIRONMENT_BYTES) {
-      reject(new Error(`The working folder packs to more than ${MAX_ENVIRONMENT_BYTES / 1024 ** 3} GiB; import it with --no-environment.`));
-      return;
-    }
-    if (gzip.write(chunk)) resolve10();
-    else gzip.once("drain", resolve10);
-  });
-  try {
-    for (const rel of listed) {
-      const full = join6(cwd, ...rel.split("/"));
-      if (SECRET_FILE2.test(rel)) {
-        leftOut.push({ path: rel, reason: "credential file" });
-        continue;
-      }
-      let stat;
-      try {
-        stat = lstatSync(full);
-      } catch {
-        continue;
-      }
-      if (!stat.isFile()) {
-        leftOut.push({ path: rel, reason: "not a regular file" });
-        continue;
-      }
-      const text = textOf(full, stat.size);
-      if (text) {
-        const masked = redactSecretValues(text.toString("utf8"));
-        if (Object.keys(masked.hits).length) redacted2 += 1;
-        const data = Buffer.from(masked.text, "utf8");
-        await write(tarHeader(rel, data.length));
-        await write(data);
-        await write(tarPadding(data.length));
-      } else {
-        await write(tarHeader(rel, stat.size));
-        const fd = openSync2(full, "r");
-        try {
-          const chunk = Buffer.alloc(1024 * 1024);
-          let left = stat.size;
-          for (let offset = 0; left > 0; ) {
-            const read = readSync2(fd, chunk, 0, Math.min(chunk.length, left), offset);
-            if (read <= 0) throw new Error(`${rel} changed while it was packed; import again.`);
-            await write(Buffer.from(chunk.subarray(0, read)));
-            offset += read;
-            left -= read;
-          }
-        } finally {
-          closeSync2(fd);
-        }
-        await write(tarPadding(stat.size));
-      }
-      written2.add(rel);
-    }
-    const layout = importLayout(resources, cwd, platform, { files: written2.size, paths: written2 });
-    for (const [entry2, data] of layout?.entries ?? []) {
-      await write(tarHeader(entry2, data.length));
-      await write(data);
-      await write(tarPadding(data.length));
+function readClaudeCode() {
+  const configRoot = claudeConfigRoot();
+  const parts = [];
+  const sources = [];
+  const global = readIfExists(join7(configRoot, "CLAUDE.md"));
+  if (global?.trim()) {
+    parts.push({ label: "Global CLAUDE.md", content: global });
+    sources.push("global CLAUDE.md");
+  }
+  for (const name of ["CLAUDE.md", "AGENTS.md"]) {
+    const project2 = readIfExists(join7(process.cwd(), name));
+    if (project2?.trim()) {
+      parts.push({ label: `Project ${name}`, content: project2 });
+      sources.push(`project ${name}`);
+      break;
+    }
+  }
+  const { prompt, truncated } = assemblePrompt(parts);
+  const allServers = claudeMcpServers();
+  const { kept, dropped } = splitMcpServers(allServers);
+  const secretCandidates = [];
+  for (const d of dropped) {
+    const def = allServers[d.name];
+    if (!def?.env) continue;
+    for (const key of d.envKeys) {
+      const value = def.env[key];
+      if (value !== void 0 && value.trim()) {
+        secretCandidates.push({ serverName: d.name, envKey: key, value, url: d.url });
+      }
     }
-    await write(TAR_END);
-    gzip.end();
-    await done;
-    if (bytes > MAX_ENVIRONMENT_BYTES) throw new Error(`The working folder packs to more than ${MAX_ENVIRONMENT_BYTES / 1024 ** 3} GiB; import it with --no-environment.`);
-    return {
-      path,
-      folder: layout?.folder ?? "imported-session",
-      bytes,
-      sha256: hash.digest("hex"),
-      files: written2.size + (layout?.entries.size ?? 0),
-      redacted: redacted2,
-      leftOut,
-      dispose: () => rmSync2(scratch, { recursive: true, force: true })
-    };
-  } catch (error) {
-    gzip.destroy();
-    sink.destroy();
-    rmSync2(scratch, { recursive: true, force: true });
-    throw error;
   }
+  return {
+    harness: "claude_code",
+    configRoot,
+    prompt,
+    promptSources: sources,
+    truncated,
+    model: claudeModel(configRoot),
+    keptServers: kept,
+    droppedServers: dropped,
+    secretCandidates
+  };
 }
-function resourcesOf(lines) {
-  return lines.flatMap((line) => {
-    try {
-      const record = JSON.parse(line);
-      if (record.type !== "import.resource" || typeof record.name !== "string" || typeof record.media_type !== "string" || typeof record.data !== "string") return [];
-      return [{ name: record.name, mediaType: record.media_type, data: Buffer.from(record.data, "base64") }];
-    } catch {
-      return [];
+function detectHarness(explicit) {
+  if (explicit) {
+    if (!HARNESSES.includes(explicit)) {
+      throw new Error(`unknown harness ${explicit} \u2014 expected ${HARNESSES.join(" | ")}`);
     }
-  });
+    return explicit;
+  }
+  if (existsSync6(claudeConfigRoot())) return "claude_code";
+  if (existsSync6(join7(homedir4(), ".codex"))) return "codex";
+  if (existsSync6(join7(homedir4(), ".openclaw"))) return "openclaw";
+  throw new Error(
+    "no local harness found (~/.claude, ~/.codex, ~/.openclaw) \u2014 pass --harness to override"
+  );
 }
-
-// src/import-local.ts
-function redactLine2(raw) {
-  return redactLine(raw).line;
+function readLocal(harness2) {
+  if (harness2 === "claude_code") return readClaudeCode();
+  throw new Error(
+    `${harness2} cloning lands next \u2014 claude_code is the first supported harness`
+  );
 }
-function decodeWorkspace(encoded) {
-  try {
-    return decodeURIComponent(encoded.replace(/-/g, "%").replace(/_/g, "%5F"));
-  } catch {
-    return encoded;
-  }
+function linkPath(configRoot) {
+  return join7(configRoot, "agentsky-link.json");
 }
-function readPrefix(filePath) {
-  const fd = openSync3(filePath, "r");
-  try {
-    const bytes = Buffer.alloc(256 * 1024);
-    return bytes.subarray(0, readSync3(fd, bytes, 0, bytes.length, 0)).toString("utf8");
-  } finally {
-    closeSync3(fd);
-  }
+function readLink(configRoot) {
+  const link2 = readJson2(linkPath(configRoot));
+  return link2?.agentId ? link2 : void 0;
 }
-function sniffTitle(filePath) {
-  try {
-    const data = readPrefix(filePath);
-    for (const raw of data.split("\n")) {
-      if (!raw.trim()) continue;
-      let line;
-      try {
-        line = JSON.parse(redactLine2(raw));
-      } catch {
-        continue;
-      }
-      if (!line || typeof line !== "object") continue;
-      const rec = line;
-      if (rec.type === "user" && rec.message && typeof rec.message === "object") {
-        const msg = rec.message;
-        if (Array.isArray(msg.content)) {
-          for (const block of msg.content) {
-            if (typeof block === "object" && block !== null) {
-              const b = block;
-              if (b.type === "text" && typeof b.text === "string" && b.text.trim()) {
-                return b.text.trim().slice(0, 120);
-              }
-            }
-          }
-        }
-        if (typeof msg.content === "string" && msg.content.trim()) {
-          return msg.content.trim().slice(0, 120);
-        }
-      }
-      if (rec.type === "event_msg" && rec.payload && typeof rec.payload === "object") {
-        const payload = rec.payload;
-        if (payload.type === "user_message" && typeof payload.message === "string") return redactLine2(payload.message).slice(0, 120);
-      }
-      if (rec.type === "response_item" && rec.payload && typeof rec.payload === "object") {
-        const payload = rec.payload;
-        if (payload.type === "message" && payload.role === "user" && Array.isArray(payload.content)) {
-          const text = payload.content.find((part) => typeof part?.text === "string")?.text;
-          if (typeof text === "string" && text.trim()) return redactLine2(text.trim()).slice(0, 120);
-        }
-      }
-      if (rec.type === "session_meta") continue;
-      if (rec.type === "user_turn" || rec.type === "message" && rec.role === "user") {
-        const content = rec.content;
-        if (typeof content === "string" && content.trim()) return content.trim().slice(0, 120);
-      }
-    }
-    return null;
-  } catch {
-    return null;
-  }
+function writeLink(configRoot, link2) {
+  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link2, null, 2)}
+`);
 }
-function listClaudeCodeSessions(limit) {
-  const root = process.env.CLAUDE_CONFIG_DIR ?? join7(homedir4(), ".claude");
-  const projectsDir = join7(root, "projects");
-  if (!existsSync6(projectsDir)) return [];
-  const sessions = [];
+var DEFAULT_VAULT_NAME = "default";
+async function fetchDefaultVaultId() {
+  const { vaults } = await api(
+    "GET",
+    "/vaults"
+  );
+  return vaults.find((v) => v.display_name === DEFAULT_VAULT_NAME)?.id ?? null;
+}
+async function ensureDefaultVaultId() {
+  const existing = await fetchDefaultVaultId();
+  if (existing) return existing;
   try {
-    for (const encoded of readdirSync4(projectsDir)) {
-      const projectDir = join7(projectsDir, encoded);
-      let entries;
-      try {
-        entries = readdirSync4(projectDir);
-      } catch {
-        continue;
-      }
-      const workspace2 = decodeWorkspace(encoded);
-      for (const entry2 of entries) {
-        if (!entry2.endsWith(".jsonl")) continue;
-        const sessionId = entry2.slice(0, -6);
-        const mainFile = join7(projectDir, entry2);
-        let stat;
-        try {
-          stat = statSync5(mainFile);
-        } catch {
-          continue;
-        }
-        if (!stat.isFile()) continue;
-        let discoveryError;
-        const subagentFiles = [];
-        const subagentDir = join7(projectDir, sessionId, "subagents");
-        if (existsSync6(subagentDir)) {
-          try {
-            const subFiles = readdirSync4(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
-            for (const f of subFiles) {
-              subagentFiles.push(join7(subagentDir, f));
-            }
-          } catch {
-            discoveryError = "Cannot read all recorded subagent conversations. Fix local file access before importing this session.";
-          }
-        }
-        sessions.push({
-          harness: "claude_code",
-          sessionId,
-          workspace: workspace2,
-          title: sniffTitle(mainFile),
-          mtimeMs: stat.mtimeMs,
-          files: [mainFile, ...subagentFiles],
-          ...discoveryError ? { discoveryError } : {}
-        });
-      }
+    const { vault: vault2 } = await api("POST", "/vaults", {
+      display_name: DEFAULT_VAULT_NAME
+    });
+    return vault2.id;
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 409) {
+      const raced = await fetchDefaultVaultId();
+      if (raced) return raced;
     }
-  } catch {
+    throw error;
   }
-  return sessions.sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
-function listCodexSessions(limit) {
-  const sessionsDir = join7(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join7(homedir4(), ".codex"), "sessions");
-  const records = [];
-  function walk(dir) {
-    let entries;
-    try {
-      entries = readdirSync4(dir, { withFileTypes: true });
-    } catch {
-      return;
+async function confirmAndVaultSecrets(candidates, yes) {
+  if (!candidates.length) return;
+  if (yes) {
+    console.log(
+      `  ${candidates.length} secret${candidates.length === 1 ? "" : "s"} from dropped MCP servers not saved (--yes skips vault confirmation).`
+    );
+    return;
+  }
+  console.log("\nSecret-bearing MCP servers were left out of the clone payload.");
+  console.log("You can save their keys to your workspace vault now (values are sent encrypted, never displayed).\n");
+  let vaultId;
+  let saved = 0;
+  let skipped = 0;
+  for (const c of candidates) {
+    const chosen = await confirm(`  Add ${c.envKey} (from ${c.serverName}) to your default vault?`);
+    if (!chosen) {
+      console.log(`  \u2014 skipped ${c.envKey}`);
+      skipped += 1;
+      continue;
     }
-    for (const entry2 of entries) {
-      const full = join7(dir, entry2.name);
-      if (entry2.isDirectory()) {
-        walk(full);
-        continue;
-      }
-      if (!entry2.isFile() || !entry2.name.startsWith("rollout-") || !entry2.name.endsWith(".jsonl")) continue;
-      try {
-        const first = readPrefix(full).split("\n", 1)[0];
-        const meta = JSON.parse(first);
-        if (meta.type !== "session_meta" || typeof meta.payload?.id !== "string") continue;
-        const data = meta.payload;
-        const parent = data.forked_from_id ?? data.source?.spawn?.parent_thread_id ?? data.source?.subagent?.spawn?.parent_thread_id;
-        records.push({
-          session: {
-            harness: "codex",
-            sessionId: data.id,
-            workspace: typeof data.cwd === "string" ? data.cwd : dir,
-            title: sniffTitle(full),
-            mtimeMs: statSync5(full).mtimeMs,
-            files: [full]
-          },
-          ...typeof parent === "string" ? { parent } : {}
-        });
-      } catch {
-        continue;
+    try {
+      vaultId ??= await ensureDefaultVaultId();
+      await api("POST", `/vaults/${encodeURIComponent(vaultId)}/secrets`, {
+        display_name: `${c.envKey} (${c.serverName})`,
+        auth: {
+          type: "environment_variable",
+          secret_name: c.envKey,
+          value: c.value,
+          allowed_hosts: c.url ? [c.url] : []
+        }
+      });
+      console.log(`  \u2713 saved ${c.envKey}`);
+      saved += 1;
+    } catch (error) {
+      if (error instanceof ApiError && error.status === 409) {
+        console.log(`  \u2014 ${c.envKey} already in vault`);
+      } else {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.log(`  \u2717 ${c.envKey} failed: ${msg}`);
       }
     }
   }
-  walk(sessionsDir);
-  function descendants(id, visited) {
-    if (visited.has(id)) return [];
-    visited.add(id);
-    return records.filter((item) => item.parent === id).flatMap((item) => [
-      ...item.session.files,
-      ...descendants(item.session.sessionId, visited)
-    ]);
+  if (saved || skipped) {
+    console.log(
+      `
+Vault: ${saved} saved, ${skipped} skipped. Attach the "default" vault to a session to use these keys.`
+    );
   }
-  return records.filter((item) => !item.parent).map(({ session: session2 }) => ({
-    ...session2,
-    files: [.../* @__PURE__ */ new Set([...session2.files, ...descendants(session2.sessionId, /* @__PURE__ */ new Set())])]
-  })).sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
-}
-function listRecentSessions(harness2, limit) {
-  const claudeSessions = harness2 === "codex" ? [] : listClaudeCodeSessions(limit);
-  const codexSessions = harness2 === "claude_code" ? [] : listCodexSessions(limit);
-  return [...claudeSessions, ...codexSessions].sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
-}
-function agentUseBase() {
-  const env = process.env.AGENT_USE_URL?.trim().replace(/\/$/, "");
-  if (env) return env;
-  const api2 = apiBase().replace(/\/$/, "");
-  const derived = api2.replace(/\/api\/v1$/, "").replace(/\/v1$/, "").replace("api.agentsky.dev", "agentsky.dev");
-  if (derived.includes("localhost:3000")) return derived.replace("localhost:3000", "localhost:3002");
-  return derived;
-}
-function currentSessionEnv() {
-  const claudeId = process.env.CLAUDE_CODE_SESSION_ID;
-  if (claudeId) return { harness: "claude_code", sessionId: claudeId };
-  const codexId = process.env.CODEX_THREAD_ID;
-  if (codexId) return { harness: "codex", sessionId: codexId };
-  return void 0;
 }
-async function mintTrace(base, harness2) {
-  const token = apiToken();
-  if (!token) throw new ApiError(401, "not_logged_in", "not logged in \u2014 run `sky auth login`");
-  const res = await fetch(`${base}/api/traces`, {
-    method: "POST",
-    redirect: "error",
-    signal: AbortSignal.timeout(15e3),
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${token}`,
-      "user-agent": USER_AGENT
-    },
-    body: JSON.stringify({ harness: harness2 })
+function confirm(question) {
+  return new Promise((done) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(`${question} [Y/n] `, (answer) => {
+      rl.close();
+      done(/^(y(es)?)?$/i.test(answer.trim()));
+    });
   });
-  if (!res.ok) {
-    const body = await res.json().catch(() => null);
-    throw new Error(
-      typeof body?.error === "string" ? body.error : `Failed to create import (${res.status}).`
-    );
-  }
-  return await res.json();
 }
-function loadSummaryFile(summaryPath) {
-  let raw;
-  try {
-    raw = readFileSync8(summaryPath, "utf8");
-  } catch {
-    throw new Error(`Cannot read summary file: ${summaryPath}`);
-  }
-  let pkg;
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
   try {
-    pkg = JSON.parse(raw);
+    spawn(cmd, [url], { stdio: "ignore", detached: true }).unref();
   } catch {
-    throw new Error("Summary file is not valid JSON.");
   }
-  if (!pkg || typeof pkg !== "object" || Array.isArray(pkg)) throw new Error("Summary file must be a JSON object.");
-  const p = pkg;
-  if (p.format !== "asteroids.session-summary") throw new Error('Summary file must have format "asteroids.session-summary".');
-  if (p.format_version !== 1) throw new Error("Summary file must have format_version 1.");
-  const redacted2 = redactLine2(raw.trimEnd());
-  return redacted2;
 }
-var MAX_IMPORT_BYTES = 30 * 1024 * 1024;
-var SUMMARY_RESERVE_BYTES = 128 * 1024;
-var MAX_LISTED_ARTIFACTS = 99;
-function leftOutLine(left) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const file of left) counts.set(file.reason, (counts.get(file.reason) ?? 0) + 1);
-  const files2 = [...counts].map(([reason, n]) => `${n} ${n === 1 ? "file" : "files"} (${reason})`).join(", ");
-  return `Not transferred: ${files2 ? `${files2}; ` : ""}runtime state such as running processes, installed tools and environment variables; and reasoning the source harness stored unreadably.`;
+function kb(text) {
+  return `${Math.max(1, Math.round(text.length / 1024))} KB`;
 }
-function prepareImport(session2, summaryPath, options = {}) {
-  if (session2.discoveryError) throw new Error(session2.discoveryError);
-  const maximum = 16 * 1024 * 1024;
-  let inputBytes = 0;
-  let outputBytes = 0;
-  const lines = [];
-  const digest = createHash3("sha256");
-  let nativeId;
-  let redactionCount = 0;
-  let encryptedReasoningCount = 0;
-  let compactionCount = 0;
-  let unreadableCount = 0;
-  const source = new SessionSourceCollector();
-  const records = [];
-  for (const path of session2.files) {
-    const stat = statSync5(path);
-    if (!stat.isFile() || (inputBytes += stat.size) > maximum) throw new Error("Selected transcript exceeds the 16 MiB limit or is not a regular file.");
-    const text = readFileSync8(path, "utf8");
-    for (const raw of text.split("\n")) {
-      if (!raw.trim()) continue;
-      let record;
-      try {
-        record = JSON.parse(raw);
-      } catch {
-        unreadableCount++;
-        continue;
-      }
-      if (!record || typeof record !== "object" || Array.isArray(record)) throw new Error("Transcript records must be JSON objects.");
-      const rec = record;
-      if (String(rec.type).startsWith("import.")) throw new Error("Native transcripts cannot supply import protocol records.");
-      if (path === session2.files[0]) source.push(rec);
-      records.push(rec);
-      if (rec.type === "response_item") {
-        const payload = rec.payload;
-        if (payload?.type === "reasoning" && typeof payload?.encrypted_content === "string" && payload.encrypted_content) {
-          encryptedReasoningCount++;
-        }
-      }
-      if (rec.type === "compacted") {
-        compactionCount++;
-      }
-      const id = rec.type === "session_meta" ? rec.payload?.id : rec.sessionId;
-      if (!nativeId && typeof id === "string") nativeId = id;
-      const result = redactLine(raw.replace(/\r$/, ""), { requireStructured: true });
-      if (Object.keys(result.hits).length > 0) redactionCount++;
-      const line = result.line + "\n";
-      outputBytes += Buffer.byteLength(line);
-      if (outputBytes > maximum) throw new Error("Redacted transcript exceeds the 16 MiB limit.");
-      digest.update(line);
-      lines.push(line);
+async function createClone(local, opts) {
+  const keptNames = Object.keys(local.keptServers);
+  const summary = [
+    local.promptSources.length ? `${local.promptSources.join(" + ")} (${kb(local.prompt)})` : "no instructions found",
+    `model ${local.model ?? "(harness default)"}`,
+    `${keptNames.length} MCP server${keptNames.length === 1 ? "" : "s"}${keptNames.length ? ` (${keptNames.join(", ")})` : ""}`
+  ].join(" \xB7 ");
+  console.log(`Detected ${local.harness} at ${local.configRoot} (project ${basename5(process.cwd())})`);
+  console.log(`Will clone: ${summary}`);
+  if (local.truncated) console.log("  note: instructions exceeded 100k chars and were truncated");
+  if (local.droppedServers.length) {
+    console.log(
+      `Left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
+    );
+  }
+  if (opts.dryRun) {
+    console.log("Dry run \u2014 nothing sent.");
+    return;
+  }
+  if (!opts.yes && !await confirm("Launch this as a new cloud agent?")) {
+    console.log("Aborted \u2014 nothing sent.");
+    return;
+  }
+  const { servers: mcpServers2, skipped } = mcpServersFromKept(local.keptServers);
+  if (skipped.length) {
+    console.log(`  note: local (stdio) MCP servers have no cloud equivalent and were skipped: ${skipped.join(", ")}`);
+  }
+  const body = {
+    agentType: local.harness,
+    ...local.model ? { llm: local.model } : {},
+    ...local.prompt ? { prompt: local.prompt } : {},
+    ...mcpServers2.length ? { mcpServers: mcpServers2 } : {}
+  };
+  let sentLlm = local.model ?? null;
+  let created;
+  try {
+    ({ agent: created } = await api("POST", "/agents", body));
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 422 && local.model) {
+      const successor = supersededBy(local.model);
+      console.log(
+        successor ? `  note: ${local.model} is superseded \u2014 using ${successor}` : `  note: ${local.model} isn't available for ${local.harness} \u2014 using the harness default`
+      );
+      sentLlm = successor;
+      ({ agent: created } = await api("POST", "/agents", {
+        ...body,
+        llm: successor ?? void 0
+      }));
+    } else {
+      throw error;
     }
   }
-  if (!lines.length) throw new Error("The selected transcript is empty.");
-  const sourceId = nativeId ?? session2.sessionId;
-  if (!/^[A-Za-z0-9_-]{1,200}$/.test(sourceId) || redactLine2(JSON.stringify(sourceId)) !== JSON.stringify(sourceId)) throw new Error("The source conversation has an invalid identifier.");
-  const meta = source.result();
-  const files2 = options.files === false ? { lines: [], bytes: 0, attached: [], leftOut: [], setup: { skills: [], missingSkills: [], mcpServers: [], git: false } } : collectSessionFiles(records, {
-    harness: session2.harness,
-    cwd: meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : ""),
-    budget: MAX_IMPORT_BYTES - outputBytes - SUMMARY_RESERVE_BYTES,
-    exclude: session2.files,
-    title: meta.title ?? (session2.harness === "codex" ? codexThreadName(session2.sessionId) : null)
+  console.log("Starting its runtime\u2026");
+  await api("POST", "/sessions", { agent: created.id });
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  writeLink(local.configRoot, {
+    baseUrl: apiBase(),
+    agentId: created.id,
+    clonedAt: now,
+    lastSyncedAt: now,
+    llm: sentLlm,
+    mcpServers: keptNames
   });
-  const attachedNote = files2.attached.length ? ` The ${files2.attached.length} local ${files2.attached.length === 1 ? "file" : "files"} it read, wrote or ran under, the skills it loaded and its workspace description (repository state and tool servers, agentsky/workspace.json) are attached as well (listed in artifacts).` : "";
-  let summaryJson;
-  if (summaryPath) {
-    summaryJson = loadSummaryFile(summaryPath);
-  } else {
-    const summary = {
-      format: "asteroids.session-summary",
-      format_version: 1,
-      source_harness: session2.harness,
-      source_harness_version: meta.harness_version?.slice(0, 100) ?? null,
-      source_session_id: sourceId,
-      created_at: (/* @__PURE__ */ new Date()).toISOString(),
-      summary: `The complete selected local conversation is attached as a transcript.${attachedNote} Review it before continuing; this automatic handoff does not infer the user's unfinished objective or claim any work is complete.`,
-      context: {
-        objective: "Review the imported conversation and continue its latest unfinished authorized objective.",
-        constraints: [],
-        decisions: [],
-        completed: [],
-        pending: ["Read the complete imported transcript, reconcile the latest human instructions and completed work, then continue."],
-        verification: [],
-        blockers: [leftOutLine(files2.leftOut), ...files2.setup.missingSkills.length ? [`Skills it loaded that are not on this computer any more: ${files2.setup.missingSkills.slice(0, 20).join(", ")}.`] : []],
-        artifacts: files2.attached.slice(0, MAX_LISTED_ARTIFACTS).map((file) => ({ path: file.name, description: `Attached from the local ${file.kind === "text" ? "workspace" : file.kind} the conversation used (${file.bytes} bytes).` })),
-        provenance: { native_checkpoint_sha256: digest.digest("hex"), selected_native_session_id: sourceId, context_bytes: outputBytes }
-      }
-    };
-    summaryJson = JSON.stringify(summary);
+  const url = `${apiBase()}/agents/${created.id}`;
+  console.log(`Cloned \u2192 ${created.id}  ${url}`);
+  console.log(
+    `Linked this machine (${linkPath(local.configRoot)}). Push prompt changes anytime by running \`sky clone\` again.`
+  );
+  await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
+  if (opts.open) openBrowser(url);
+}
+async function syncClone(local, link2, opts) {
+  const since = link2.lastSyncedAt ?? link2.clonedAt;
+  console.log(
+    `Syncing ${link2.agentId} from ${local.configRoot} (last synced ${since ? new Date(since).toLocaleDateString() : "never"})`
+  );
+  if (opts.dryRun) {
+    console.log(
+      `  would push prompt (${kb(local.prompt)}) to ${link2.agentId}. Dry run \u2014 nothing sent.`
+    );
+    return;
+  }
+  let agent2;
+  try {
+    ({ agent: agent2 } = await api(
+      "GET",
+      `/agents/${encodeURIComponent(link2.agentId)}`
+    ));
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 404) {
+      throw new Error(
+        `linked agent ${link2.agentId} no longer exists \u2014 run \`sky clone --new\` to launch a fresh one`
+      );
+    }
+    throw error;
   }
-  const body = lines.join("") + files2.lines.join("") + JSON.stringify({ type: "import.summary", package: JSON.parse(summaryJson) }) + "\n" + JSON.stringify({ type: "import.end", records: lines.length + files2.lines.length + 1 }) + "\n";
-  const gaps = [];
-  if (encryptedReasoningCount > 0) gaps.push({ kind: "encrypted_reasoning", count: encryptedReasoningCount });
-  if (compactionCount > 0) gaps.push({ kind: "compaction", count: compactionCount });
-  if (unreadableCount > 0) gaps.push({ kind: "unreadable", count: unreadableCount });
-  const cwd = meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : "");
-  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps, attachedFiles: files2.attached, leftOutFiles: files2.leftOut, setup: files2.setup, cwd, resourceLines: files2.lines };
-}
-async function importSession(opts) {
-  const base = (opts.agentUseUrl ?? agentUseBase()).replace(/\/$/, "");
-  const destination2 = new URL(base);
-  if (destination2.username || destination2.password || destination2.protocol !== "https:" && !(destination2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(destination2.hostname))) {
-    throw new Error("Import requires HTTPS, or a loopback development server.");
+  if (agent2.agentType !== local.harness) {
+    throw new Error(
+      `linked agent ${link2.agentId} is ${agent2.agentType}, this machine runs ${local.harness} \u2014 run \`sky clone --new\` to launch a fresh agent`
+    );
   }
-  opts.onProgress?.("Reading transcript and redacting secrets locally\u2026");
-  const { body, transcriptLines, outputBytes, redactionCount, gaps, attachedFiles, leftOutFiles, setup, cwd, resourceLines } = prepareImport(opts.session, opts.summaryPath, { files: opts.files });
-  let traceId;
-  let key;
-  if (opts.importKey && opts.grantTraceId) {
-    traceId = opts.grantTraceId;
-    key = opts.importKey;
-  } else {
-    opts.onProgress?.("Minting import key\u2026");
-    ({ traceId, key } = await mintTrace(base, opts.session.harness));
+  const result = await api(
+    "PUT",
+    `/agents/${encodeURIComponent(link2.agentId)}/prompt`,
+    { prompt: local.prompt }
+  );
+  console.log(
+    result.unchanged ? "  prompt   unchanged" : `  prompt   updated (v${result.version}${result.applied === "live" ? ", hot-reloaded" : ", applies on next boot"})`
+  );
+  const drift = [];
+  const localModel = local.model ?? null;
+  const linkedModel = link2.llm ?? agent2.llm;
+  if (localModel && linkedModel && localModel !== linkedModel) {
+    drift.push(`model changed ${linkedModel} \u2192 ${localModel}`);
   }
-  opts.onProgress?.("Uploading the complete transcript\u2026");
-  const response = await fetch(`${base}/api/traces/ingest`, {
-    method: "POST",
-    redirect: "error",
-    signal: AbortSignal.timeout(12e4),
-    headers: { authorization: `Bearer ${key}`, "content-type": "application/x-ndjson", "x-source-harness": opts.session.harness, "user-agent": USER_AGENT },
-    body
-  });
-  if (!response.ok) {
-    const result2 = await response.json().catch(() => null);
-    throw new Error(typeof result2?.error === "string" ? result2.error : result2?.error?.message ?? `Upload failed (${response.status}).`);
+  const before = new Set(link2.mcpServers ?? []);
+  const nowKept = Object.keys(local.keptServers);
+  const newServers = nowKept.filter((n) => !before.has(n));
+  const goneServers = [...before].filter((n) => !nowKept.includes(n));
+  if (newServers.length) drift.push(`${newServers.length} new MCP server${newServers.length === 1 ? "" : "s"} (${newServers.join(", ")})`);
+  if (goneServers.length) drift.push(`${goneServers.length} removed MCP server${goneServers.length === 1 ? "" : "s"} (${goneServers.join(", ")})`);
+  if (drift.length) {
+    console.log(`  skipped (set at launch): ${drift.join("; ")}`);
+    console.log("    \u2192 a running agent can't change these; run `sky clone --new` to launch a fresh agent.");
   }
-  const result = await response.json();
-  const finalTraceId = result.traceId ?? traceId;
-  const environment = opts.files === false || opts.environment === false || !cwd || !existsSync6(cwd) ? null : await uploadEnvironment(base, key, finalTraceId, cwd, resourceLines, opts.onProgress).catch((error) => ({ error: error instanceof Error ? error.message : String(error) }));
-  return {
-    traceId: finalTraceId,
-    url: `${base}/playground/new?import=${encodeURIComponent(finalTraceId)}`,
-    harness: opts.session.harness,
-    sessionId: opts.session.sessionId,
-    transcriptFiles: opts.session.files.length,
-    bytes: outputBytes,
-    redactionCount,
-    gaps,
-    attachedFiles,
-    leftOutFiles,
-    setup,
-    environment
-  };
-}
-async function grantCall(base, key, path, body) {
-  const response = await fetch(`${base}${path}`, {
-    method: "POST",
-    redirect: "error",
-    signal: AbortSignal.timeout(3e5),
-    headers: { authorization: `Bearer ${key}`, "content-type": "application/json", "user-agent": USER_AGENT },
-    body: JSON.stringify(body)
-  });
-  const answer = await response.json().catch(() => null);
-  if (!response.ok) throw new Error(typeof answer?.error === "string" ? answer.error : answer?.error?.message ?? `The environment upload failed (${response.status}).`);
-  return answer;
-}
-async function uploadEnvironment(base, key, traceId, cwd, resourceLines, onProgress) {
-  onProgress?.("Packing the working folder (secrets redacted locally)\u2026");
-  const packed = await packEnvironment(cwd, resourcesOf(resourceLines));
-  try {
-    const path = `/api/traces/${encodeURIComponent(traceId)}/environment`;
-    const { upload } = await grantCall(base, key, path, { name: packed.folder, size: packed.bytes, sha256: packed.sha256, files: packed.files });
-    let shown = -1;
-    await transfer(upload, packed.path, (sent, total) => {
-      const percent = Math.floor(sent / total * 100);
-      if (percent >= shown + 10 || sent === total) {
-        shown = percent;
-        onProgress?.(`Uploading the working folder\u2026 ${percent}% of ${(total / 1024 / 1024).toFixed(1)} MiB`);
-      }
-    });
-    await grantCall(base, key, `${path}/complete`, {});
-    return { folder: packed.folder, files: packed.files, bytes: packed.bytes, redacted: packed.redacted, leftOut: packed.leftOut.length };
-  } finally {
-    packed.dispose();
+  if (local.droppedServers.length) {
+    console.log(
+      `  left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
+    );
   }
+  writeLink(local.configRoot, { ...link2, lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
+  console.log(`Synced ${link2.agentId}.`);
+  await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
+  if (opts.open) openBrowser(`${apiBase()}/agents/${link2.agentId}`);
+}
+async function clone(opts) {
+  const harness2 = detectHarness(opts.harness);
+  const local = readLocal(harness2);
+  const link2 = opts.new ? void 0 : readLink(local.configRoot);
+  if (link2) await syncClone(local, link2, opts);
+  else await createClone(local, opts);
 }
 
 // src/channels.ts
@@ -2631,6 +2644,35 @@ it, and name its path in the brief.
 6. Tell the person what was done, which agent did which part, and what it cost
    (\`get_task\` reports the task's cost).
 
+## Share an existing Library document
+
+Use \`read_library_file_links\` with the document's exact \`ref\` to read its
+current revision, supported access and real available members. The reference
+can name a Drive file (including an uploaded meeting note), task file, memory
+note, skill file, agent user instructions (\`{kind:"agent_prompt",agentId}\`), saved artifact or platform artifact. Only the user-authored AGENTS.md is shared; system instructions and credentials are never included. \`workspace\` names the
+audience workspace, never a storage move or the connection's default.
+\`share_library_file\` changes only the requested workspace/member grants;
+\`publish_library_file\` enables or disables a public view-only link while
+preserving other grants. Both read first and merge against the current
+revision. \`revoke_library_file_links\` needs the explicit revision you reviewed.
+A conflict is an error: read the current state before intentionally retrying.
+These tools send no messages and start no sessions. CLI equivalents are
+\`sky library links show\`, \`share\`, \`publish\` and \`revoke\`; their help
+shows every reference shape. Existing artifact links and version pins keep
+using their existing controls and \`share_artifact\`.
+
+When you receive a Library shared/public URL, \`read_shared_library_file\`
+accepts the 43-character token at its end; \`public: true\` chooses the public
+view-only reader. A recipient with a live edit grant can use
+\`save_shared_library_file\` with the opaque source revision from that read
+and exactly one native text/HTML/Office/restore field. Public links have no
+writer. The CLI equivalents are \`sky library links read --token \u2026\`
+(\`--output\` streams original bytes) and \`sky library links save --token \u2026
+--revision \u2026 --file \u2026\`; \`--data\` accepts the other native save fields.
+A 403 is not a saved result; a 409 requires reading current state before an
+intentional retry. This source revision is distinct from the integer revision
+of the sharing settings.
+
 ## Build an agent that the person's own application runs
 
 When the person wants an agent their product starts for its customers, built
@@ -5092,41 +5134,43 @@ async function listBrowserProfiles() {
   const { data } = await api("GET", "/browser_profiles");
   return data;
 }
-async function getBrowserProfile(scope) {
-  const profiles = await listBrowserProfiles();
-  const profile = profiles.find((entry2) => entry2.scope === scope);
-  if (!profile) throw new ApiError(404, "not_found", "browser profile not found");
-  return profile;
-}
 async function importBrowserProfileState(scope, state) {
   return api("POST", `/browser_profiles/${encodeURIComponent(scope)}/imports`, state);
 }
-async function listBrowserProfileSites(scope) {
-  const profile = await getBrowserProfile(scope);
-  return profile.sites;
+async function listBrowserProfileSites() {
+  const profiles = await listBrowserProfiles();
+  return (profiles.find((entry2) => entry2.scope === "mine") ?? profiles.find((entry2) => entry2.scope === "workspace"))?.sites ?? [];
 }
-async function browserSiteReference(scope, site) {
-  const sites = await listBrowserProfileSites(scope);
+async function removeBrowserProfileSite(site) {
+  const sites = await listBrowserProfileSites();
   const row = sites.find((entry2) => entry2.site === site) ?? sites.find((entry2) => entry2.site_id === site);
-  if (!row) throw new ApiError(404, "not_found", "site not found in this browser profile");
-  return row.site_id ? `${encodeURIComponent(row.site_id)}?by=id` : encodeURIComponent(row.site);
+  if (!row) throw new ApiError(404, "not_found", "site not found in your browser");
+  await api("DELETE", `/browser_profiles/mine/sites/${row.site_id ? `${encodeURIComponent(row.site_id)}?by=id` : encodeURIComponent(row.site)}`);
 }
-async function removeBrowserProfileSite(scope, site) {
-  await api("DELETE", `/browser_profiles/${encodeURIComponent(scope)}/sites/${await browserSiteReference(scope, site)}`);
+async function shareBrowserProfile(member, sites) {
+  const { share } = await api("POST", "/browser_profiles/mine/shares", {
+    grantee: member ? { user_id: member } : "workspace",
+    sites: sites.length ? sites : null
+  });
+  return share;
 }
-async function moveBrowserProfileSite(scope, site, to) {
-  const reference = await browserSiteReference(scope, site);
-  const [identifier, query] = reference.split("?");
-  return api("POST", `/browser_profiles/${encodeURIComponent(scope)}/sites/${identifier}/move${query ? `?${query}` : ""}`, { to });
+async function unshareBrowserProfile(shareId) {
+  await api("DELETE", `/browser_profiles/mine/shares/${encodeURIComponent(shareId)}`);
 }
 function renderBrowserProfileSite(site) {
   const who = site.signed_in_by?.email ?? site.signed_in_by?.name ?? "unknown";
   const used = site.last_used_at ? `used ${site.last_used_at.slice(0, 10)}` : "never used";
   return `${site.site.padEnd(40)} ${site.status.padEnd(14)} ${who}  ${used}${site.status === "removing" && site.site_id ? `  retry with site ID ${site.site_id}` : ""}`;
 }
+function renderBrowserProfileShare(share) {
+  const who = share.grantee.type === "workspace" ? "everyone in this workspace" : share.grantee.user.email ?? share.grantee.user.name ?? share.grantee.user.id;
+  return `shared with ${who}: ${share.sites ? share.sites.join(", ") : "every site"}  (share ${share.id})`;
+}
 function renderBrowserProfile(profile) {
-  const lines = [`scope: ${profile.scope}  revision: ${profile.revision}  sites: ${profile.sites.length}`];
+  const title = profile.scope === "mine" ? "your browser" : profile.scope === "shared" ? `shared with you by ${profile.owner?.email ?? profile.owner?.name ?? profile.owner?.id ?? "someone"}` : "shared with this workspace";
+  const lines = [`${title}  revision: ${profile.revision}  sites: ${profile.sites.length}`];
   for (const site of profile.sites) lines.push(`  ${renderBrowserProfileSite(site)}`);
+  for (const share of profile.shares ?? []) lines.push(`  ${renderBrowserProfileShare(share)}`);
   return lines.join("\n");
 }
 
@@ -5248,42 +5292,10 @@ function renderThreadSummary(t) {
 }
 
 // src/library.ts
-var artifactPath = (id) => `/library/artifacts/${encodeURIComponent(id)}`;
-async function listLibrary(query = {}) {
-  const params = new URLSearchParams(Object.entries(query).filter((entry2) => Boolean(entry2[1])));
-  const qs = params.size ? `?${params}` : "";
-  return api("GET", `/library/artifacts${qs}`);
-}
-async function uploadToLibrary(file, requestId, workspace2) {
-  const form = new FormData();
-  form.append("file", new Blob([new Uint8Array(file.bytes)], { type: file.mediaType }), file.name);
-  form.append("requestId", requestId);
-  if (workspace2) form.append("workspace", workspace2);
-  return apiForm("POST", "/library/artifacts", form);
-}
-async function getLibraryArtifact(id) {
-  return api("GET", artifactPath(id));
-}
-async function deleteLibraryArtifact(id, revision) {
-  return api("DELETE", artifactPath(id), { revision });
-}
-async function shareLibraryArtifact(id, enabled) {
-  const { currentVersion } = await getLibraryArtifact(id);
-  return api("PATCH", `${artifactPath(id)}/share`, { enabled, revision: currentVersion });
-}
-async function placeLibraryArtifact(id, workspace2) {
-  return api("PATCH", `${artifactPath(id)}/workspace`, { workspace: workspace2 });
-}
-async function downloadLibraryArtifact(id, version) {
-  return apiBytes("GET", `${artifactPath(id)}/download${version ? `?version=${version}` : ""}`);
-}
-function renderLibraryArtifact(artifact2) {
-  const version = artifact2.currentVersion ? `v${artifact2.currentVersion}` : "";
-  return `${artifact2.id}  ${artifact2.name}  ${version}${artifact2.shared ? "  shared" : ""}`;
-}
+import { readFileSync as readFileSync17 } from "fs";
 
 // src/api-command.ts
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 var API_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
 function readData(data, stdin = () => readFileSync16(0, "utf8")) {
   if (data === void 0) return void 0;
@@ -5304,9 +5316,9 @@ function requestPath(path, query = []) {
     if (at <= 0) throw new Error(`--query needs key=value, got "${pair}"`);
     params.append(pair.slice(0, at), pair.slice(at + 1));
   }
-  const sep3 = clean.includes("?") ? "&" : "?";
+  const sep4 = clean.includes("?") ? "&" : "?";
   const encoded = params.toString();
-  return encoded ? `${clean}${sep3}${encoded}` : clean;
+  return encoded ? `${clean}${sep4}${encoded}` : clean;
 }
 function matchOperations(doc, words) {
   const needles = words.map((w) => w.toLowerCase());
@@ -5338,7 +5350,7 @@ async function callApi(method, path, opts) {
   const res = await apiRaw(verb, requestPath(path, opts.query), { body, idempotencyKey: opts.idempotencyKey, universe: opts.workspace });
   const type = res.headers.get("content-type") ?? "";
   if (opts.output) {
-    writeFileSync9(opts.output, new Uint8Array(await res.arrayBuffer()));
+    await writeResponseFile(res, opts.output);
     console.error(`${res.status} \u2192 ${opts.output}`);
   } else if (/json/.test(type)) {
     const text = await res.text();
@@ -5356,6 +5368,239 @@ async function callApi(method, path, opts) {
   if (!res.ok && res.status !== 304) process.exitCode = 1;
 }
 
+// src/library.ts
+var artifactPath = (id) => `/library/artifacts/${encodeURIComponent(id)}`;
+async function listLibrary(query = {}) {
+  const params = new URLSearchParams(Object.entries(query).filter((entry2) => Boolean(entry2[1])));
+  const qs = params.size ? `?${params}` : "";
+  return api("GET", `/library/artifacts${qs}`);
+}
+async function uploadToLibrary(file, requestId, workspace2) {
+  const form = new FormData();
+  form.append("file", new Blob([new Uint8Array(file.bytes)], { type: file.mediaType }), file.name);
+  form.append("requestId", requestId);
+  if (workspace2) form.append("workspace", workspace2);
+  return apiForm("POST", "/library/artifacts", form);
+}
+async function getLibraryArtifact(id) {
+  return api("GET", artifactPath(id));
+}
+async function deleteLibraryArtifact(id, revision) {
+  return api("DELETE", artifactPath(id), { revision });
+}
+async function shareLibraryArtifact(id, enabled) {
+  const { currentVersion } = await getLibraryArtifact(id);
+  return api("PATCH", `${artifactPath(id)}/share`, { enabled, revision: currentVersion });
+}
+async function placeLibraryArtifact(id, workspace2) {
+  return api("PATCH", `${artifactPath(id)}/workspace`, { workspace: workspace2 });
+}
+async function downloadLibraryArtifact(id, version) {
+  return apiBytes("GET", `${artifactPath(id)}/download${version ? `?version=${version}` : ""}`);
+}
+function renderLibraryArtifact(artifact2) {
+  const version = artifact2.currentVersion ? `v${artifact2.currentVersion}` : "";
+  return `${artifact2.id}  ${artifact2.name}  ${version}${artifact2.shared ? "  shared" : ""}`;
+}
+var libraryFileRefSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("agent_prompt"), agentId: external_exports.string().min(1).max(200).regex(/^[a-zA-Z0-9_-]+$/) }).strict(),
+  external_exports.object({ kind: external_exports.literal("file"), fileId: external_exports.string().min(1), sessionId: external_exports.string().min(1).optional() }).strict(),
+  external_exports.object({ kind: external_exports.literal("task_file"), taskId: external_exports.string().min(1), path: external_exports.string().min(1) }).strict(),
+  external_exports.object({ kind: external_exports.literal("memory_note"), storeId: external_exports.string().min(1), memoryId: external_exports.string().min(1) }).strict(),
+  external_exports.object({ kind: external_exports.literal("skill_file"), skillId: external_exports.string().min(1), path: external_exports.string().min(1) }).strict(),
+  external_exports.object({ kind: external_exports.literal("artifact"), artifactId: external_exports.string().min(1) }).strict(),
+  external_exports.object({ kind: external_exports.literal("platform_artifact"), artifactId: external_exports.string().min(1), path: external_exports.string().min(1).optional() }).strict()
+]);
+var linkAccessSchema = external_exports.enum(["none", "view", "edit"]);
+var linkMemberSchema = external_exports.object({ userId: external_exports.string().min(1), access: external_exports.enum(["view", "edit"]) });
+var linkRevisionSchema = external_exports.number().int().nonnegative();
+var libraryLinksSchema = external_exports.object({
+  link: external_exports.object({
+    id: external_exports.string().nullable(),
+    ref: libraryFileRefSchema,
+    workspace: external_exports.string().nullable(),
+    revision: linkRevisionSchema,
+    editable: external_exports.boolean(),
+    workspaceAccess: linkAccessSchema,
+    members: external_exports.array(linkMemberSchema),
+    publicEnabled: external_exports.boolean(),
+    sharedUrl: external_exports.string().nullable(),
+    publicUrl: external_exports.string().nullable()
+  }),
+  availableMembers: external_exports.array(external_exports.object({ userId: external_exports.string(), name: external_exports.string().nullable(), email: external_exports.string().nullable() }))
+});
+function parseLibraryFileRef(value) {
+  return libraryFileRefSchema.parse(JSON.parse(value));
+}
+async function getLibraryLinks(ref, workspace2) {
+  const params = new URLSearchParams({ ref: JSON.stringify(libraryFileRefSchema.parse(ref)), ...workspace2 ? { workspace: workspace2 } : {} });
+  const result = libraryLinksSchema.parse(await api("GET", `/library/links?${params}`));
+  if (JSON.stringify(result.link.ref) !== JSON.stringify(libraryFileRefSchema.parse(ref)) || workspace2 !== void 0 && result.link.workspace !== workspace2) throw new Error("The API returned sharing for a different source. No access was changed.");
+  return result;
+}
+async function updateLibraryLinks(ref, change) {
+  const current = await getLibraryLinks(ref, change.workspace);
+  if (change.revision !== void 0 && linkRevisionSchema.parse(change.revision) !== current.link.revision) throw new Error("Sharing changed since that revision. Read the current links and retry.");
+  const members = new Map(current.link.members.map((member) => [member.userId, member]));
+  for (const member of change.memberChanges ?? []) {
+    const userId = external_exports.string().min(1).parse(member.userId);
+    const access = linkAccessSchema.parse(member.access);
+    if (access === "none") members.delete(userId);
+    else members.set(userId, { userId, access });
+  }
+  return libraryLinksSchema.parse(await api("PUT", "/library/links", {
+    ref,
+    workspace: current.link.workspace,
+    revision: current.link.revision,
+    workspaceAccess: change.workspaceAccess === void 0 ? current.link.workspaceAccess : linkAccessSchema.parse(change.workspaceAccess),
+    members: [...members.values()],
+    publicEnabled: change.publicEnabled === void 0 ? current.link.publicEnabled : external_exports.boolean().parse(change.publicEnabled)
+  }));
+}
+async function revokeLibraryLinks(ref, revision, workspace2) {
+  return libraryLinksSchema.parse(await api("DELETE", "/library/links", {
+    ref: libraryFileRefSchema.parse(ref),
+    revision: linkRevisionSchema.parse(revision),
+    ...workspace2 ? { workspace: workspace2 } : {}
+  }));
+}
+var sharedLibraryToken = external_exports.string().length(43).regex(/^[A-Za-z0-9_-]{43}$/, "use the 43-character token from the Library shared or public URL");
+var sharedLibrarySource = external_exports.object({
+  name: external_exports.string(),
+  format: external_exports.enum(["file", "site"]),
+  mediaType: external_exports.string(),
+  revision: external_exports.string(),
+  editable: external_exports.boolean(),
+  url: external_exports.string(),
+  maxBytes: external_exports.number(),
+  history: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown()))
+}).passthrough();
+var sharedLibrarySaved = external_exports.object({ url: external_exports.string(), revision: external_exports.string().min(1), publishedAt: external_exports.string().datetime({ offset: true }), text: external_exports.string().nullable().optional(), historyRevision: external_exports.string().optional() });
+var sharedLibrarySaveSchema = external_exports.object({
+  revision: external_exports.string().min(1),
+  text: external_exports.string().optional(),
+  html: external_exports.string().optional(),
+  office: external_exports.string().optional(),
+  docx: external_exports.string().optional(),
+  restoreRevision: external_exports.string().min(1).optional(),
+  requestId: external_exports.string().uuid().optional()
+}).strict().refine((body) => [body.text, body.html, body.office, body.docx, body.restoreRevision].filter((field) => field !== void 0).length === 1, "provide exactly one of text, html, office, docx or restoreRevision");
+async function readSharedLibraryFile(token, options = {}) {
+  const path = `/library/${options.public ? "public" : "shared"}/${sharedLibraryToken.parse(token)}`;
+  if (!options.output) return sharedLibrarySource.parse(await api("GET", path, void 0, { auth: options.public !== true }));
+  const response = await apiRaw("GET", `${path}?raw=1`, { auth: options.public !== true });
+  if (!response.ok) {
+    const body = await response.json().catch(() => null);
+    throw new ApiError(response.status, body?.error?.code ?? "http_error", body?.error?.message ?? `Download failed (${response.status}).`);
+  }
+  return { output: options.output, bytes: await writeResponseFile(response, options.output) };
+}
+async function saveSharedLibraryFile(token, body) {
+  return sharedLibrarySaved.parse(await api("PUT", `/library/shared/${sharedLibraryToken.parse(token)}`, sharedLibrarySaveSchema.parse(body)));
+}
+function registerLibraryLinkCommands(library2) {
+  const libraryLinks = library2.command("links").description("share or publish any Library file; --workspace selects the sharing audience without moving the file");
+  libraryLinks.command("read").description("read a shared native document snapshot; --public reads a public view-only link").requiredOption("--token <token>", "43-character token from a Library shared or public URL").option("--public", "use the public reader without sending your API key").option("--output <file>", "stream the original bytes to this file instead of printing the JSON snapshot").action(async (opts) => {
+    console.log(JSON.stringify(await readSharedLibraryFile(opts.token, opts), null, 2));
+  });
+  libraryLinks.command("save").description("save through a live recipient edit grant; --revision is the opaque source revision from links read").requiredOption("--token <token>", "43-character token from the authenticated shared URL (public URLs have no writer)").requiredOption("--revision <revision>", "native source revision from links read; stale revisions fail without retry").option("--file <path>", "UTF-8 text file to save").option("--data <json>", "instead of --file, JSON/ @file / - containing exactly one text/html/office/docx/restoreRevision and optional requestId").action(async (opts) => {
+    if (opts.file !== void 0 === (opts.data !== void 0)) throw new Error("Choose exactly one of --file or --data.");
+    const body = opts.file !== void 0 ? { text: new TextDecoder("utf-8", { fatal: true }).decode(readFileSync17(opts.file)) } : JSON.parse(readData(opts.data));
+    if (!body || typeof body !== "object" || Array.isArray(body)) throw new Error("--data must be a JSON object with one native save field.");
+    if ("revision" in body && body.revision !== opts.revision) throw new Error("--data revision must match --revision.");
+    console.log(JSON.stringify(await saveSharedLibraryFile(opts.token, sharedLibrarySaveSchema.parse({ ...body, revision: opts.revision })), null, 2));
+  });
+  const linkRefOption = (command) => command.requiredOption("--ref <json>", 'file reference JSON, e.g. {"kind":"file","fileId":"file_\u2026"}').option("--workspace <slug>", "the team audience for this link (omit for private/public-only sharing)");
+  const linkRevision = (value) => value === void 0 ? void 0 : linkRevisionSchema.parse(Number(external_exports.string().regex(/^\d+$/, "revision must be a nonnegative integer").parse(value)));
+  const printLibraryLinks = (value) => console.log(JSON.stringify(value, null, 2));
+  linkRefOption(libraryLinks.command("show").description("read sharing, real workspace members and the current revision without creating a link")).action(async (opts) => printLibraryLinks(await getLibraryLinks(parseLibraryFileRef(opts.ref), opts.workspace)));
+  linkRefOption(libraryLinks.command("share").description("change workspace or specific members' access while preserving every unmentioned grant")).option("--workspace-access <access>", "none, view or edit (edit requires an editable source)").option("--member <user:access>", "grant a member view or edit; repeat to update several members", (value, previous) => [...previous, value], []).option("--remove-member <user>", "clear a member override; workspace access still applies", (value, previous) => [...previous, value], []).option("--revision <n>", "refuse if sharing changed since this reviewed revision").action(async (opts) => {
+    if (opts.workspaceAccess === void 0 && !opts.member?.length && !opts.removeMember?.length) throw new Error("Choose --workspace-access, --member or --remove-member; links show reads without changing access.");
+    const memberChanges = (opts.member ?? []).map((value) => {
+      const colon = value.lastIndexOf(":");
+      if (colon < 1) throw new Error("--member must be a user id followed by :view or :edit");
+      return { userId: value.slice(0, colon), access: external_exports.enum(["view", "edit"]).parse(value.slice(colon + 1)) };
+    });
+    memberChanges.push(...(opts.removeMember ?? []).map((userId) => ({ userId, access: "none" })));
+    printLibraryLinks(await updateLibraryLinks(parseLibraryFileRef(opts.ref), {
+      workspace: opts.workspace,
+      revision: linkRevision(opts.revision),
+      memberChanges,
+      workspaceAccess: opts.workspaceAccess === void 0 ? void 0 : external_exports.enum(["none", "view", "edit"]).parse(opts.workspaceAccess)
+    }));
+  });
+  linkRefOption(libraryLinks.command("publish").description("create a public view-only link; --disable revokes only public access and keeps other grants")).option("--disable", "turn off public viewing").option("--revision <n>", "refuse if sharing changed since this reviewed revision").action(async (opts) => printLibraryLinks(await updateLibraryLinks(parseLibraryFileRef(opts.ref), { workspace: opts.workspace, revision: linkRevision(opts.revision), publicEnabled: !opts.disable })));
+  linkRefOption(libraryLinks.command("revoke").description("stop all sharing at an explicitly reviewed revision")).requiredOption("--revision <n>", "current revision from links show; stale revisions fail without retry").action(async (opts) => printLibraryLinks(await revokeLibraryLinks(parseLibraryFileRef(opts.ref), linkRevision(opts.revision), opts.workspace)));
+}
+
+// src/design-systems.ts
+import { readdirSync as readdirSync8, readFileSync as readFileSync18, statSync as statSync9 } from "fs";
+import { join as join18, relative as relative5, sep as sep3 } from "path";
+var TEXT2 = /\.(mdx?|markdown|txt|json|m?js|cjs|jsx|tsx?|css|html?|svg|xml|csv|ya?ml|toml)$/i;
+var MEDIA = {
+  woff2: "font/woff2",
+  woff: "font/woff",
+  ttf: "font/ttf",
+  otf: "font/otf",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  gif: "image/gif",
+  webp: "image/webp",
+  pdf: "application/pdf",
+  mp4: "video/mp4",
+  webm: "video/webm"
+};
+async function listDesignSystems() {
+  return (await api("GET", "/artifacts?kind=design_system")).artifacts;
+}
+async function getDesignSystem(id) {
+  return (await api("GET", `/artifacts/${encodeURIComponent(id)}/design-system`)).design_system;
+}
+async function importDesignSystem(task2, files2, title) {
+  return (await api("POST", "/artifacts/design-systems", { task_id: task2, files: files2, ...title ? { title } : {} })).artifact;
+}
+async function saveDesignTokens(id, baseVersion, tokens, note) {
+  return (await api("PUT", `/artifacts/${encodeURIComponent(id)}/design-system/tokens`, {
+    base_version: baseVersion,
+    tokens,
+    ...note ? { note } : {}
+  })).artifact;
+}
+function fileTableFrom(dir) {
+  const files2 = {};
+  const walk = (current) => {
+    for (const name of readdirSync8(current)) {
+      if (name.startsWith(".") || name === "node_modules") continue;
+      const path = join18(current, name);
+      if (statSync9(path).isDirectory()) {
+        walk(path);
+        continue;
+      }
+      const key = relative5(dir, path).split(sep3).join("/");
+      const bytes = readFileSync18(path);
+      files2[key] = TEXT2.test(name) ? bytes.toString("utf8") : `data:${MEDIA[name.split(".").pop()?.toLowerCase() ?? ""] ?? "application/octet-stream"};base64,${bytes.toString("base64")}`;
+    }
+  };
+  walk(dir);
+  return files2;
+}
+function renderDesignSystem(system) {
+  const tokens = system.tokens;
+  const lines = [
+    `${system.artifact_id}  ${system.title}  v${system.version}${system.editable ? "" : "  read-only"}`,
+    tokens ? `themes ${tokens.themes.map((theme) => theme.id).join(", ")} \xB7 ${tokens.colors.length} colors \xB7 ${tokens.typeGroups.reduce((sum, group) => sum + group.styles.length, 0)} type styles \xB7 ${tokens.spacing.length} spacing \xB7 ${tokens.radius.length} radius` : "no tokens.json",
+    `components: ${system.components.map((component) => component.name).join(", ") || "none"}`,
+    `assets: ${system.assets.map((group) => `${group.name} (${group.files.length})`).join(", ") || "none"}`
+  ];
+  if (system.last_change) lines.push(`last change: ${system.last_change.by}${system.last_change.via ? ` via ${system.last_change.via}` : ""} at ${system.last_change.at}`);
+  for (const token of tokens?.dropped ?? []) lines.push(`not read: ${token.family} ${token.name || "(unnamed)"}: ${token.reason}`);
+  return lines.join("\n");
+}
+async function designComments(id, input) {
+  return api(input ? "POST" : "GET", `/artifacts/${encodeURIComponent(id)}/design-system/comments`, input);
+}
+
 // src/billing-plans.ts
 var readCodingPlan = () => api("GET", "/billing/coding-plan");
 function joinCodingPlan(dollars2, requestId) {
@@ -5442,11 +5687,11 @@ function workspaceFlagIsCommands(argv, commandPath) {
 }
 
 // src/harness.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname9, join as join18, resolve as resolve8 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname9, join as join19, resolve as resolve8 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
-  return join18(resolve8(dir), HARNESS_FILE);
+  return join19(resolve8(dir), HARNESS_FILE);
 }
 function readHarnessFile(dir) {
   const path = harnessFilePath(dir);
@@ -5454,7 +5699,7 @@ function readHarnessFile(dir) {
     throw new Error(`no ${HARNESS_FILE} found in ${resolve8(dir)} \u2014 run \`sky harness init\` first`);
   }
   try {
-    return JSON.parse(readFileSync17(path, "utf8"));
+    return JSON.parse(readFileSync19(path, "utf8"));
   } catch (err) {
     throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -5485,7 +5730,7 @@ function harnessInit(dir) {
     throw new Error(`${path} already exists \u2014 delete it to re-init`);
   }
   mkdirSync6(dirname9(path), { recursive: true });
-  writeFileSync10(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+  writeFileSync9(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
 `);
   console.log(`Created ${path}`);
   console.log(INIT_COMMENT);
@@ -6224,7 +6469,7 @@ sessionWorkspace.command("cat <ref> <path>").description("print a file (up to 1
   run(async (ref, path, opts) => {
     const bytes = await readFile(await resolveSessionRef(ref), path);
     if (opts.out) {
-      writeFileSync11(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.error(`saved ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -6241,7 +6486,7 @@ sessionWorkspace.command("patch <ref> [repo]").description("the work in a reposi
     console.error(`${meta.repo}: ${meta.commits.length} commit${meta.commits.length === 1 ? "" : "s"} since ${meta.base_branch || "the imported copy"} (${meta.base_commit.slice(0, 12)})`);
     if (!patch.length) console.error("nothing changed");
     else if (opts.out) {
-      writeFileSync11(opts.out, patch);
+      writeFileSync10(opts.out, patch);
       console.error(`wrote ${opts.out} \u2014 apply with: git apply ${opts.out}`);
     } else process.stdout.write(patch);
   })
@@ -6746,14 +6991,14 @@ task.command("get <task> <path>").description("read one task file; prints it, or
   run(async (taskId, path, opts) => {
     const bytes = await readTaskFile(taskId, path);
     if (opts.out) {
-      writeFileSync11(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync18(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync20(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -6826,6 +7071,34 @@ task.command("verdict <task> <did-the-job>").description("record whether the tas
     console.log(`Recorded verdict on task ${updated.id}: did_the_job=${value === "yes"}`);
   })
 );
+var plugins = program.command("plugins").description("Claude Code plugins in the workspace: install from GitHub, list, remove");
+plugins.command("list").description("the workspace's installed plugins and the skills each one installed").option("--json", "print the list as JSON").action(
+  run(async (opts) => {
+    const { plugins: list } = await api("GET", "/plugins");
+    if (opts.json) return void console.log(JSON.stringify(list));
+    if (list.length === 0) return void console.log("No plugins. `sky plugins install github:owner/repo[/path][@ref]`");
+    for (const p of list) console.log(`${p.name}  ${p.skills.length} skill${p.skills.length === 1 ? "" : "s"}: ${p.skills.map((s) => s.displayName.split("/").pop()).join(", ")}`);
+  })
+);
+plugins.command("install <source>").description("install or update a plugin: github:owner/repo[/path][@ref] or a github.com URL").option("--json", "print the result as JSON").action(
+  run(async (source, opts) => {
+    const result = await api("POST", "/plugins", { source });
+    if (opts.json) return void console.log(JSON.stringify(result));
+    console.log(`Installed ${result.plugin.name}${result.plugin.version ? ` ${result.plugin.version}` : ""} from ${result.plugin.source}: ${result.skills.length} skill(s), on for every new session.`);
+    for (const c of result.connectors) {
+      const state = c.app === null ? "no AgentSky connector for it yet" : c.connected ? `uses your ${c.app} connection` : `connect ${c.app}: ${c.connect_url}`;
+      console.log(`  connector ${c.server}: ${state}`);
+    }
+    for (const s of result.skipped) console.log(`  skipped ${s.part}: ${s.reason}`);
+    for (const r of result.removed) console.log(`  ${r.part}: ${r.result.replace("_", " ")} (no longer in the plugin)`);
+  })
+);
+plugins.command("rm <name>").description("remove a plugin's skills (a skill a session still holds is switched off)").action(
+  run(async (name) => {
+    const result = await api("DELETE", `/plugins/${encodeURIComponent(name)}`);
+    console.log(`Removed ${result.name}: ${result.parts.map((p) => `${p.part} ${p.result.replace("_", " ")}`).join(", ")}`);
+  })
+);
 var skills = program.command("skills").description("the workspace's skill store: upload a skill, then attach it to an agent (sky skills attach, or [[skills]] in agent.toml)");
 skills.command("upload <dir>").description("upload a skill directory (SKILL.md at its root) as a new skill").option("--name <name>", "display name (default: the directory's name)").option("--json", "print the stored skill as JSON").action(
   run(async (dir, opts) => {
@@ -6917,7 +7190,7 @@ library.command("list").description("your Library, newest first").option("--sear
 );
 library.command("upload <path>").description("save a file from this computer to your Library").option("--workspace <key>", "place it in this workspace").action(
   run(async (path, opts) => {
-    const bytes = readFileSync18(path);
+    const bytes = readFileSync20(path);
     const { artifact: artifact2 } = await uploadToLibrary({ bytes, name: basename9(path), mediaType: "application/octet-stream" }, `sky-upload-${crypto.randomUUID()}`, opts.workspace);
     console.log(renderLibraryArtifact(artifact2));
   })
@@ -6948,10 +7221,11 @@ library.command("place <id> <workspace>").description('place your artifact in a
 library.command("download <id> <out>").description("save one version's bytes to a file").option("--version <n>", "a saved version (the current one when omitted)").action(
   run(async (id, out, opts) => {
     const { bytes } = await downloadLibraryArtifact(id, opts.version ? Number(opts.version) : void 0);
-    writeFileSync11(out, bytes);
+    writeFileSync10(out, bytes);
     console.log(`wrote ${bytes.length} bytes to ${out}`);
   })
 );
+registerLibraryLinkCommands(library);
 var artifact = program.command("artifact").description("artifacts: publish a task's files as a named, shareable result");
 artifact.command("list").description("the workspace's artifacts, or one task's with --task").option("--task <task>", "only this task's artifacts").action(
   run(async (opts) => {
@@ -6969,7 +7243,7 @@ artifact.command("get <id> <path>").description("read one file of an artifact; p
   run(async (id, path, opts) => {
     const bytes = await readArtifactFile(id, path);
     if (opts.out) {
-      writeFileSync11(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -6986,6 +7260,35 @@ artifact.command("rm <id>").description("delete an artifact").action(
     console.log(`Deleted ${id}`);
   })
 );
+var designSystem = program.command("design-system").description("design systems: brand books, tokens and components agents design with");
+designSystem.command("list").description("the workspace's design systems").action(
+  run(async () => {
+    const list = await listDesignSystems();
+    if (!list.length) console.log("no design systems");
+    for (const a of list) console.log(renderArtifact(a));
+  })
+);
+designSystem.command("show <id>").description("a design system's tokens, components and assets; --readme prints its brand book instead").option("--readme", "print project/README.md").action(
+  run(async (id, opts) => {
+    const system = await getDesignSystem(id);
+    console.log(opts.readme ? system.readme ?? "this design system has no README.md" : renderDesignSystem(system));
+  })
+);
+designSystem.command("import <task> <folder>").description("import a local design-system folder (one holding project/, or project/ itself) into a task and publish it").option("--title <title>", "the system's name; defaults to the title in design-system.json").action(
+  run(async (task2, folder, opts) => {
+    console.log(renderArtifact(await importDesignSystem(task2, fileTableFrom(resolve9(folder)), opts.title)));
+  })
+);
+designSystem.command("tokens <id> <file>").description("save a tokens.json file as the system's next version; --base is the version you edited").requiredOption("--base <version>", "the version the file was edited from", (value) => Number(value)).option("--note <note>", "one line saying what changed").action(
+  run(async (id, file, opts) => {
+    const tokens = JSON.parse(readFileSync20(resolve9(file), "utf8"));
+    console.log(renderArtifact(await saveDesignTokens(id, opts.base, tokens, opts.note)));
+  })
+);
+designSystem.command("comments <id>").description("read design-system comments, or add one with --text and --base").option("--text <text>", "comment to add").option("--target <target>", "overview, color:<name> or component:<name>", "overview").option("--base <version>", "the version you viewed", Number).action(run(async (id, opts) => {
+  if (opts.text !== void 0 && (!Number.isInteger(opts.base) || opts.base < 1)) throw Error("Adding a comment requires --base <version>.");
+  console.log(JSON.stringify(await designComments(id, opts.text === void 0 ? void 0 : { text: opts.text, target: opts.target, base_version: opts.base }), null, 2));
+}));
 function routineLine(r) {
   const target = r.target.type === "session" ? `\u2192 ${r.target.session_id}` : `+ ${r.target.agent}`;
   const cron = r.schedule ? `${r.schedule.expression} ${r.schedule.timezone}` : "manual-only";
@@ -7291,7 +7594,7 @@ usageOptions(
   run(async (opts) => {
     const { bytes } = await apiBytes("GET", `/billing/usage/export${usageQuery(opts)}`);
     if (opts.out) {
-      writeFileSync11(opts.out, bytes);
+      writeFileSync10(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else {
       process.stdout.write(bytes);
@@ -7369,10 +7672,10 @@ memory.command("save <text...>").description("add an entry").action(run(async (t
 memory.command("edit <index> <text...>").description("replace entry <index>").action(run(async (index, text) => writeMemory({ op: "update", index: memoryIndex(index), text: text.join(" ") })));
 memory.command("rm <index>").description("remove entry <index>").action(run(async (index) => writeMemory({ op: "remove", index: memoryIndex(index) })));
 memory.command("clear").description("remove every entry").action(run(async () => writeMemory({ op: "clear" })));
-var context = program.command("context").description("search your conversations, memory and the workspace trace library");
-context.command("search <words...>").description("literal matches, in source order; follow --cursor for more").option("--scope <scope>", "sessions, memory or traces (default sessions)").option("--limit <n>", "hits per page (default 20)").option("--cursor <cursor>", "continue a previous search").option("--since <iso>", "inclusive lower time bound").option("--until <iso>", "exclusive upper time bound").option("--json", "print the API's answer as JSON").action(
+var context = program.command("context").description("search everything you can open in the workspace, and read a hit");
+context.command("search <words...>").description('plain words, "exact phrase" or /regex/ (every matching line, like grep); follow --cursor for more').option("--scope <folder>", "memory/, chats, traces, outputs/, files/, meetings/, skills/<name>/, agents/ or docs/ (default everything)").option("--limit <n>", "hits per page (default 20)").option("--cursor <cursor>", "continue a previous search").option("--since <iso>", "inclusive lower time bound").option("--until <iso>", "exclusive upper time bound").option("--json", "print the API's answer as JSON").action(
   run(async (words, opts) => {
-    const page = await api("GET", `/context/search${searchQuery(words.join(" "), opts)}`);
+    const page = await searchContext(words.join(" "), opts);
     console.log(opts.json ? JSON.stringify(page, null, 2) : renderContextPage(page));
   })
 );
@@ -7380,7 +7683,7 @@ context.command("read <ref>").description("read a search hit in full: <ref> is t
   run(async (ref, opts) => {
     const params = new URLSearchParams({ ref });
     if (opts.offset) params.set("offset", opts.offset);
-    const read = await api("GET", `/context/read?${params}`);
+    const read = await contextRequest(`/context/read?${params}`);
     console.log(read.text);
     if (read.nextOffset !== null) console.error(`more: --offset ${read.nextOffset}`);
   })
@@ -7690,7 +7993,7 @@ mac.command("take-back <mount>").description("end a folder, browser window, scre
   })
 );
 var browserProfile = program.command("browser-profile").description("saved-login profiles: the sites your agents stay signed in to");
-browserProfile.command("list").description("your workspace's browser profiles: the sites your agents stay signed in to").option("--json", "print as JSON").action(
+browserProfile.command("list").description("your browser, with whom you shared it, and the browsers shared with you in this workspace").option("--json", "print as JSON").action(
   run(async (opts) => {
     const profiles = await listBrowserProfiles();
     if (opts.json) {
@@ -7701,9 +8004,9 @@ browserProfile.command("list").description("your workspace's browser profiles: t
     for (const p of profiles) console.log(renderBrowserProfile(p));
   })
 );
-browserProfile.command("sites <scope>").description("list the sites in a profile: workspace or private").option("--json", "print as JSON").action(
-  run(async (scope, opts) => {
-    const sites = await listBrowserProfileSites(scope);
+browserProfile.command("sites").description("list the sites your browser is signed in to").option("--json", "print as JSON").action(
+  run(async (opts) => {
+    const sites = await listBrowserProfileSites();
     if (opts.json) {
       console.log(JSON.stringify(sites, null, 2));
       return;
@@ -7713,8 +8016,8 @@ browserProfile.command("sites <scope>").description("list the sites in a profile
     for (const s of sites) console.log(renderBrowserProfileSite(s));
   })
 );
-browserProfile.command("import <scope>").description("import saved browser state into a profile (workspace or private); reads Playwright storage state JSON from stdin or --file").option("--file <path>", "path to a Playwright storage state JSON file (reads stdin if omitted)").action(
-  run(async (scope, opts) => {
+browserProfile.command("import").description("import saved browser state into your browser; reads Playwright storage state JSON from stdin or --file").option("--file <path>", "path to a Playwright storage state JSON file (reads stdin if omitted)").action(
+  run(async (opts) => {
     let raw;
     if (opts.file) {
       const { readFileSync: rf } = await import("fs");
@@ -7727,21 +8030,26 @@ browserProfile.command("import <scope>").description("import saved browser state
       });
     }
     const state = JSON.parse(raw);
-    const result = await importBrowserProfileState(scope, { state });
+    const result = await importBrowserProfileState("mine", { state });
     console.log(`Imported ${result.sites.length} site${result.sites.length === 1 ? "" : "s"}: ${result.sites.join(", ")}`);
   })
 );
-browserProfile.command("remove-site <scope> <site>").description("remove a site from a profile (the agent will need to sign in again)").action(
-  run(async (scope, site) => {
-    await removeBrowserProfileSite(scope, site);
-    console.log(`Removed ${site} from ${scope}`);
+browserProfile.command("remove-site <site>").description("sign your browser out of a site everywhere (the agent will need to sign in again)").action(
+  run(async (site) => {
+    await removeBrowserProfileSite(site);
+    console.log(`Signed out of ${site}`);
+  })
+);
+browserProfile.command("share").description("share your browser in this workspace: with one member (--member <user id>) or everyone; every site unless --sites").option("--member <userId>", "the member to share with (default: everyone in the workspace)").option("--sites <sites>", "comma-separated sites to share (default: every site)").action(
+  run(async (opts) => {
+    const share = await shareBrowserProfile(opts.member, (opts.sites ?? "").split(",").map((s) => s.trim()).filter(Boolean));
+    console.log(renderBrowserProfileShare(share));
   })
 );
-browserProfile.command("move-site <scope> <site> <to>").description("move a site between profiles: <scope> is the current one, <to> is workspace or private").action(
-  run(async (scope, site, to) => {
-    if (to !== "workspace" && to !== "private") throw new ApiError(400, "invalid_request", "to must be workspace or private");
-    const result = await moveBrowserProfileSite(scope, site, to);
-    console.log(`Moved ${site} from ${scope} to ${result.to}`);
+browserProfile.command("unshare <shareId>").description("stop a share of your browser; it ends from the grantee's next turn").action(
+  run(async (shareId) => {
+    await unshareBrowserProfile(shareId);
+    console.log(`Stopped share ${shareId}`);
   })
 );
 var notifications = program.command("notifications").description("email and browser push notification preferences for tasks");
@@ -7801,21 +8109,21 @@ async function helpFetch(path) {
   return await res.json();
 }
 var help = program.command("help").description("search the AgentSky help center");
-help.command("search <query...>").description("search help articles by keyword").option("--top <n>", "how many results (1\u201320, default 5)", "5").option("--json", "print as JSON").action(
+help.command("search <query...>").description('search help articles: plain words rank them, "exact" or /regex/ list every matching line').option("--top <n>", "how many results (1\u201320, default 5)", "5").option("--json", "print as JSON").action(
   run(async (words, opts) => {
     const q = words.join(" ");
     const topK = Math.min(Math.max(parseInt(opts.top, 10) || 5, 1), 20);
-    const { results } = await helpFetch(`/api/help/search?q=${encodeURIComponent(q)}&top_k=${topK}`);
+    const { hits } = await helpFetch(`/api/context/search?${new URLSearchParams({ q, scope: "docs/", limit: String(topK) })}`);
     if (opts.json) {
-      console.log(JSON.stringify(results, null, 2));
+      console.log(JSON.stringify(hits, null, 2));
       return;
     }
-    if (!results.length) {
+    if (!hits.length) {
       console.log("no results");
       return;
     }
-    for (const r of results) console.log(`${r.slug.padEnd(40)} [${r.category}] ${r.title}
-  ${r.snippet.slice(0, 100)}`);
+    for (const hit of hits) console.log(`${String(hit.ref.slug).padEnd(40)} ${hit.title}
+  ${hit.snippet.slice(0, 100)}`);
   })
 );
 help.command("get <slug>").description("read a help article by its slug").option("--json", "print as JSON").action(
@@ -7898,7 +8206,7 @@ notes.command("read <storeId> <noteId>").description("print one note").action(
 notes.command("save <storeId> <file>").description("write a note from a local file: --path creates one, --note saves a new version of one").option("--path <path>", "path of a new note, e.g. /projects/launch.md").option("--note <noteId>", "the note to update").action(
   run(async (storeId, file, opts) => {
     if (!opts.path === !opts.note) throw new Error("pass exactly one of --path (new note) or --note (update)");
-    const content = readFileSync18(file, "utf8");
+    const content = readFileSync20(file, "utf8");
     const target = `/memory_stores/${encodeURIComponent(storeId)}/memories${opts.note ? `/${encodeURIComponent(opts.note)}` : ""}`;
     const { memory: memory2 } = await api("POST", target, { content, ...opts.path ? { path: opts.path } : {} });
     console.log(`Saved ${memory2.path} (${memory2.id})`);
@@ -7998,7 +8306,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-CFHCOGKB.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-HV4E2BPX.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -8033,7 +8341,7 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-CFHCOGKB.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-HV4E2BPX.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -8046,14 +8354,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-CFHCOGKB.js");
+  const { readState, flush, grantSender } = await import("./trace-HV4E2BPX.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-CFHCOGKB.js");
+  const { readState, spoolStatus } = await import("./trace-HV4E2BPX.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -8063,7 +8371,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-CFHCOGKB.js");
+  const { readState } = await import("./trace-HV4E2BPX.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -8090,7 +8398,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-CFHCOGKB.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-HV4E2BPX.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -8100,7 +8408,7 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
 traceCmd.command("sync [payload]").description("upload this machine's agent sessions (Claude Code, Codex, Cursor, Gemini CLI and every other agent `--agents` lists) to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--import <export>", "add a downloaded cloud export (claude.ai, ChatGPT, Gemini, Grok, DeepSeek \u2026: its .zip, folder or file) so sync uploads it (repeatable)", collect).option("--agents", "list the agents sync reads and which are on this machine").option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-2VHTJCOY.js");
+  const lib = await import("./trace-library-HJWI7KM7.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -8159,10 +8467,10 @@ traceCmd.command("sync [payload]").description("upload this machine's agent sess
       console.log(`Added ${imported.sessions} ${imported.agent} session${imported.sessions === 1 ? "" : "s"} from ${input}.`);
     }
     if (opts.installSchedule) {
-      const { join: join19 } = await import("path");
+      const { join: join20 } = await import("path");
       const { homedir: homedir10 } = await import("os");
       const { execFileSync } = await import("child_process");
-      const log = join19(homedir10(), ".config", "sky", "trace-sync.log");
+      const log = join20(homedir10(), ".config", "sky", "trace-sync.log");
       const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
       try {
         execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
@@ -8172,11 +8480,11 @@ traceCmd.command("sync [payload]").description("upload this machine's agent sess
       console.log(`Sweeping every 15 minutes (${plist}); a full re-read runs weekly. Log: ${log}`);
     }
     if (opts.status) {
-      const { readFileSync: readFileSync19 } = await import("fs");
-      const { join: join19 } = await import("path");
+      const { readFileSync: readFileSync21 } = await import("fs");
+      const { join: join20 } = await import("path");
       let state = { sessions: {} };
       try {
-        state = JSON.parse(readFileSync19(join19(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+        state = JSON.parse(readFileSync21(join20(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
       } catch {
       }
       const counts = /* @__PURE__ */ new Map();
@@ -8208,25 +8516,14 @@ traceCmd.command("sync [payload]").description("upload this machine's agent sess
     if (report.failed) process.exitCode = 1;
   })();
 });
-traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
-  const { libraryRequest } = await import("./trace-library-2VHTJCOY.js");
+traceCmd.command("search <query...>").description("search every session in a workspace's trace library: the one search with --scope traces").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", "20").option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
-  const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
-  const page = await libraryRequest("GET", `/context/search?${params}`, workspace2);
-  if (opts.json) {
-    console.log(JSON.stringify(page, null, 2));
-    return;
-  }
-  if (!page.hits.length) console.log(page.partial ? `No hits, but the search was cut short (${page.coverage}).` : "No hits.");
-  for (const { hit } of page.hits) {
-    console.log(`${hit.occurredAt?.slice(0, 16).replace("T", " ") ?? "                "}  ${hit.title}`);
-    console.log(`  ${hit.snippet.replace(/\s+/g, " ")}`);
-  }
-  if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
+  const page = await searchContext(words.join(" "), { ...opts, scope: "traces" }, workspace2);
+  console.log(opts.json ? JSON.stringify(page, null, 2) : renderContextPage(page));
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-2VHTJCOY.js");
+  const { libraryRequest } = await import("./trace-library-HJWI7KM7.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);