@alook/cli 0.0.98 → 0.0.100

package/dist/index.js

@@ -14833,7 +14833,7 @@ var EmailNotifyRequestSchema = exports_external.object({
   r2Key: exports_external.string().min(1),
   from: exports_external.string().min(1),
   to: exports_external.string().optional(),
-  subject: exports_external.string().min(1),
+  subject: exports_external.string(),
   isWhitelisted: exports_external.boolean(),
   forwarded: exports_external.boolean().optional().default(false),
   messageId: exports_external.string().optional().default(""),
@@ -14935,6 +14935,7 @@ var SkillItemSchema = exports_external.object({
 var SkillSyncRequestSchema = exports_external.object({
   scope: exports_external.enum(["global", "agent"]),
   agent_id: exports_external.string().min(1).optional(),
+  daemon_id: exports_external.string().min(1).optional(),
   runtime: exports_external.enum(["claude", "codex", "opencode"]),
   skills: exports_external.array(SkillItemSchema)
 });
@@ -16834,12 +16835,13 @@ var agentSkill = sqliteTable("agent_skill", {
   id: text("id").primaryKey().$defaultFn(() => "as_" + nanoid3()),
   workspaceId: text("workspace_id").notNull().references(() => workspace.id, { onDelete: "cascade" }),
   agentId: text("agent_id"),
+  daemonId: text("daemon_id"),
   runtime: text("runtime").notNull(),
   name: text("name").notNull(),
   description: text("description").notNull().default(""),
   syncedAt: text("synced_at").notNull().$defaultFn(() => new Date().toISOString())
 }, (t) => [
-  unique("agent_skill_ws_runtime_name_agent").on(t.workspaceId, t.runtime, t.name, t.agentId),
+  unique("agent_skill_ws_runtime_name_agent_daemon").on(t.workspaceId, t.runtime, t.name, t.agentId, t.daemonId),
   index("idx_as_workspace_runtime").on(t.workspaceId, t.runtime),
   index("idx_as_agent_runtime").on(t.agentId, t.runtime),
   foreignKey({
@@ -18728,6 +18730,10 @@ ${task.agent.instructions}
 `;
     }
     content += `
+**Isolated workspaces:**
+- Each agent runs in its own isolated workspace directory. Colleagues CANNOT read your local files — even in the same workspace.
+- When sending plans, code, or any file to a colleague, you MUST attach the file to the email (use --attachment). Never reference local file paths expecting them to read it.
+
 **Email threading rules:**
 - When communicating with a colleague on the **same topic** as an existing email thread, reply to that thread (use --in-reply-to) to keep context together.
 - **When starting a NEW topic or task that is unrelated to any previous email thread, you MUST compose a brand new email (do NOT use --in-reply-to). Never hijack an unrelated thread just because you recently emailed that colleague.** Judge by topic/task relevance, not by recency of communication.
@@ -18753,7 +18759,10 @@ ${lines.join(`
 
 ### Emails
 ---
-Run '${cmdPrefix()} email pull --status unread' to download unread emails from inbox to '${tempDir("alook-emails")}/${task.workspaceId}/${task.agentId}/'.
+When your task prompt includes an \`email_id\` field, fetch ONLY that specific email:
+- Run '${cmdPrefix()} email pull --email_id <EMAIL_ID>' (uses the email_id from the prompt)
+When no \`email_id\` is present, fall back to listing unread:
+- Run '${cmdPrefix()} email pull --status unread' to download unread emails from inbox to '${tempDir("alook-emails")}/${task.workspaceId}/${task.agentId}/'.
 ---
 To download sent emails, add '--folder sent': '${cmdPrefix()} email pull --folder sent'
 Valid folders: inbox (default), sent, untrust.
@@ -18940,7 +18949,8 @@ function prepare(config2, task) {
     ALOOK_CONVERSATION_ID: task.conversationId,
     ALOOK_TRACE_ID: task.traceId ?? "",
     ALOOK_CHANNEL: task.channel ?? "default",
-    ALOOK_HEALTH_PORT: process.env.ALOOK_HEALTH_PORT || "19514"
+    ALOOK_HEALTH_PORT: process.env.ALOOK_HEALTH_PORT || "19514",
+    ...config2.token ? { ALOOK_TOKEN: config2.token } : {}
   };
   return { workDir, timelineDir, env };
 }
@@ -19265,6 +19275,9 @@ function buildPrompt(task, attachments) {
     } else {
       obj.notice = EMAIL_NOTICE;
     }
+    if (ctx?.emailId != null) {
+      obj.email_id = ctx.emailId;
+    }
   }
   if (task.type === "calendar_event") {
     obj.notice = CALENDAR_NOTICE;
@@ -19412,7 +19425,7 @@ async function runSession(input) {
   const timelineDir = path.join(agentBaseDir, ".context_timeline").replace(/\\/g, "/");
   mkdirSync6(timelineDir, { recursive: true });
   await initEntryAsync(timelineDir, createTimelineEntry(task.id, task.prompt, task.type, undefined, process.pid, provider, task.contextKey, input.logFilePath));
-  const { workDir, env } = prepare({ workspacesRoot }, task);
+  const { workDir, env } = prepare({ workspacesRoot, token }, task);
   let killed = false;
   const earlyOnKill = async () => {
     if (killed)
@@ -20237,8 +20250,8 @@ function scanOpenCodeAgentSkills(workdir) {
 function computeHash(skills) {
   return createHash2("md5").update(JSON.stringify(skills)).digest("hex");
 }
-function globalCachePath(runtime) {
-  return join10(getCacheDir(), "global", `${runtime}.json`);
+function globalCachePath(daemonId, runtime) {
+  return join10(getCacheDir(), "global", daemonId, `${runtime}.json`);
 }
 function agentCachePath(agentId, runtime) {
   return join10(getCacheDir(), "agents", agentId, `${runtime}.json`);
@@ -20322,17 +20335,19 @@ function runScan() {
     try {
       const skills = getGlobalScanner(runtime)();
       const hash2 = computeHash(skills);
-      const prevHash = readCacheHash(globalCachePath(runtime));
+      const prevHash = readCacheHash(globalCachePath(scannerConfig.daemonId, runtime));
       if (prevHash !== hash2) {
         const skillItems = skills.map((s) => ({ name: s.name, description: s.description }));
         log8.info(`Syncing global ${runtime} — ${skills.length} skills`);
+        const daemonId = scannerConfig.daemonId;
         const syncPromises = scannerConfig.workspaces.map((ws) => clientRef.syncSkills(ws.token, {
           scope: "global",
           runtime,
-          skills: skillItems
+          skills: skillItems,
+          daemon_id: daemonId
         }));
         Promise.all(syncPromises).then(() => {
-          writeCacheFile(globalCachePath(runtime), hash2, skills);
+          writeCacheFile(globalCachePath(daemonId, runtime), hash2, skills);
         }).catch((e) => log8.debug("Global skill sync failed", e));
       }
     } catch (e) {
@@ -20935,7 +20950,8 @@ async function startDaemon(profile, serverUrl) {
       token: ws.token,
       agentIds: ws.agent_ids ?? []
     })),
-    runtimes: providers.map((p) => p.type)
+    runtimes: providers.map((p) => p.type),
+    daemonId: config2.daemonId
   }, 60000);
   let shuttingDown = false;
   let restartRequested = false;
@@ -21426,11 +21442,12 @@ function configCommand() {
 
 // commands/email.ts
 import { Command as Command5 } from "commander";
-import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync10, readFileSync as readFileSync9, statSync as statSync5 } from "fs";
-import { basename as basename2, join as join12 } from "path";
+import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync10, readFileSync as readFileSync11 } from "fs";
+import { join as join12 } from "path";
 import PostalMime from "postal-mime";
 
 // lib/flags.ts
+import { readFileSync as readFileSync9 } from "fs";
 function resolveAgentId(opts) {
   const id = opts.agent_id || process.env.ALOOK_AGENT_ID;
   if (!id) {
@@ -21439,83 +21456,157 @@ function resolveAgentId(opts) {
   }
   return id;
 }
-
-// commands/email.ts
-var log10 = createLogger2({ module: "email" });
-var VALID_STATUSES = ["unread", "read", "archived", "sent"];
-var VALID_FOLDERS = ["inbox", "sent", "untrust"];
-var EMAIL_BASE = tempDir("alook-emails");
-var MIME_BY_EXT = {
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".txt": "text/plain",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".json": "application/json",
-  ".csv": "text/csv",
-  ".md": "text/markdown",
-  ".zip": "application/zip"
-};
-function guessContentType(filename) {
-  const idx = filename.lastIndexOf(".");
-  if (idx < 0)
-    return "application/octet-stream";
-  const ext = filename.slice(idx).toLowerCase();
-  return MIME_BY_EXT[ext] ?? "application/octet-stream";
-}
 function collectRepeated(value, previous) {
   return previous.concat([value]);
 }
-function resolveClientOpts(command, opts) {
+function readBody(opts) {
+  if (opts.body && opts.bodyFile) {
+    console.error("Error: --body and --body-file are mutually exclusive");
+    process.exit(1);
+  }
+  if (opts.bodyFile)
+    return readFileSync9(opts.bodyFile, "utf-8");
+  return opts.body ?? "";
+}
+
+// lib/command-utils.ts
+function getRootOpts(command) {
   let root = command;
   while (root.parent)
     root = root.parent;
-  const parentOpts = root.opts() || {};
-  const profile = parentOpts.profile;
-  const cfg = loadCLIConfigForProfile(profile);
-  const serverUrl = parentOpts.server || cfg.server_url;
+  return root.opts() || {};
+}
+
+// lib/resolve-client.ts
+function resolveClientOpts(command, opts = {}) {
+  const parentOpts = getRootOpts(command);
+  const cfg = loadCLIConfigForProfile(parentOpts.profile);
+  const serverUrl = parentOpts.server || process.env.ALOOK_SERVER_URL || cfg.server_url;
+  if (!serverUrl) {
+    console.error("Error: no server URL configured. Set ALOOK_SERVER_URL or run register.");
+    process.exit(1);
+  }
   const workspaces = cfg.watched_workspaces || [];
   let ws;
+  const envWorkspaceId = process.env.ALOOK_WORKSPACE_ID;
   if (opts.workspace) {
     ws = workspaces.find((w) => w.id === opts.workspace);
     if (!ws) {
-      console.error(`Error: workspace ${opts.workspace} not found in config.`);
-      process.exit(1);
+      if (envWorkspaceId === opts.workspace) {
+        ws = undefined;
+      } else {
+        console.error(`Error: workspace ${opts.workspace} not found in config.`);
+        process.exit(1);
+      }
     }
   } else if (opts.agentId) {
     ws = workspaces.find((w) => w.agent_ids?.includes(opts.agentId));
     if (!ws) {
       if (workspaces.length === 1) {
         ws = workspaces[0];
-      } else {
-        console.error(`Error: agent ${opts.agentId} not found in any registered workspace. Use --workspace to specify.`);
-        process.exit(1);
       }
     }
   } else if (workspaces.length === 1) {
     ws = workspaces[0];
-  } else {
-    console.error(`Error: multiple workspaces registered. Use --workspace to specify which one.`);
-    process.exit(1);
   }
-  const token = ws?.token;
+  const envToken = process.env.ALOOK_TOKEN;
+  const token = envToken || ws?.token;
   if (!token) {
     console.error(`Error: not registered. Run '${cmdPrefix()} register --token <token>' first.`);
     process.exit(1);
   }
-  return { serverUrl, token, cfg, profile, workspaceId: ws?.id };
+  const workspaceId = ws?.id || envWorkspaceId;
+  if (!workspaceId) {
+    console.error("Error: cannot determine workspace. Set ALOOK_WORKSPACE_ID env var or use --workspace flag.");
+    process.exit(1);
+  }
+  return { serverUrl, token, workspaceId };
+}
+
+// lib/file-utils.ts
+import { readFileSync as readFileSync10, statSync as statSync5 } from "fs";
+import { basename as basename2 } from "path";
+var MIME_BY_EXT = {
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".json": "application/json",
+  ".csv": "text/csv",
+  ".md": "text/markdown",
+  ".ts": "text/typescript",
+  ".js": "text/javascript",
+  ".yaml": "text/yaml",
+  ".yml": "text/yaml",
+  ".xml": "application/xml",
+  ".zip": "application/zip"
+};
+function guessContentType(filename) {
+  const idx = filename.lastIndexOf(".");
+  if (idx < 0)
+    return "application/octet-stream";
+  const ext = filename.slice(idx).toLowerCase();
+  return MIME_BY_EXT[ext] ?? "application/octet-stream";
+}
+function contentToBuffer(content) {
+  if (typeof content === "string") {
+    return Buffer.from(content, "base64");
+  } else if (content instanceof ArrayBuffer) {
+    return Buffer.from(new Uint8Array(content));
+  }
+  return Buffer.from(content);
 }
+async function uploadFile(client, filePath, endpoint) {
+  let bytes;
+  let size;
+  try {
+    bytes = readFileSync10(filePath);
+    size = statSync5(filePath).size;
+  } catch (err) {
+    throw new Error(`cannot read file "${filePath}": ${err instanceof Error ? err.message : err}`);
+  }
+  const filename = basename2(filePath);
+  const contentType = guessContentType(filename);
+  const form = new FormData;
+  form.append("file", new Blob([new Uint8Array(bytes)], { type: contentType }), filename);
+  const uploaded = await client.postMultipart(endpoint, form);
+  return {
+    key: uploaded.key,
+    filename: uploaded.filename,
+    size: uploaded.size ?? size,
+    contentType: uploaded.contentType ?? contentType
+  };
+}
+
+// lib/context-env.ts
+function gatherContextEnvVars() {
+  const conversationId = process.env.ALOOK_CONVERSATION_ID || undefined;
+  const traceId = process.env.ALOOK_TRACE_ID || undefined;
+  const sourceTaskId = process.env.ALOOK_TASK_ID || undefined;
+  return { conversationId, traceId, sourceTaskId };
+}
+
+// commands/email.ts
+var log10 = createLogger2({ module: "email" });
+var VALID_STATUSES = ["unread", "read", "archived", "sent"];
+var VALID_FOLDERS = ["inbox", "sent", "untrust"];
+var EMAIL_BASE = tempDir("alook-emails");
 function emailCommand() {
   const cmd = new Command5("email").description("Manage agent emails");
-  cmd.command("pull").description("Download and parse emails to /tmp/alook-emails/{workspaceId}/{agentId}/").option("--agent_id <id>", "Agent ID").option("--status <status>", "Filter by status (unread, read, archived)").option("--folder <folder>", "Email folder (inbox, sent, untrust)").option("--limit <n>", "Maximum number of emails to download").option("--offset <n>", "Number of emails to skip").option("--workspace <id>", "Workspace ID").option("--json", "Output as JSON instead of files").action(async (opts, command) => {
+  cmd.command("pull").description("Download and parse emails to /tmp/alook-emails/{workspaceId}/{agentId}/").option("--agent_id <id>", "Agent ID").option("--email_id <id>", "Fetch a single email by ID (mutually exclusive with --status/--folder/--limit/--offset)").option("--status <status>", "Filter by status (unread, read, archived)").option("--folder <folder>", "Email folder (inbox, sent, untrust)").option("--limit <n>", "Maximum number of emails to download").option("--offset <n>", "Number of emails to skip").option("--workspace <id>", "Workspace ID").option("--json", "Output as JSON instead of files").action(async (opts, command) => {
     const agentId = resolveAgentId(opts);
     const { serverUrl, token, workspaceId } = resolveClientOpts(command, { workspace: opts.workspace, agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
+    if (opts.email_id && (opts.status || opts.folder || opts.limit || opts.offset)) {
+      console.error("Error: --email_id cannot be combined with --status, --folder, --limit, or --offset");
+      process.exit(1);
+    }
     if (opts.status && !VALID_STATUSES.includes(opts.status)) {
       console.error(`Error: invalid status "${opts.status}", must be one of: ${VALID_STATUSES.join(", ")}`);
       process.exit(1);
@@ -21540,16 +21631,22 @@ function emailCommand() {
     }
     const emailDir_base = join12(EMAIL_BASE, workspaceId, agentId);
     try {
-      let query = `/api/email?agentId=${agentId}`;
-      if (opts.status)
-        query += `&status=${opts.status}`;
-      if (opts.folder)
-        query += `&folder=${opts.folder}`;
-      if (opts.limit)
-        query += `&limit=${opts.limit}`;
-      if (opts.offset)
-        query += `&offset=${opts.offset}`;
-      const emails2 = await client.getJSON(query);
+      let emails2;
+      if (opts.email_id) {
+        const single = await client.getJSON(`/api/email/${opts.email_id}`);
+        emails2 = [single];
+      } else {
+        let query = `/api/email?agentId=${agentId}`;
+        if (opts.status)
+          query += `&status=${opts.status}`;
+        if (opts.folder)
+          query += `&folder=${opts.folder}`;
+        if (opts.limit)
+          query += `&limit=${opts.limit}`;
+        if (opts.offset)
+          query += `&offset=${opts.offset}`;
+        emails2 = await client.getJSON(query);
+      }
       if (!emails2.length) {
         console.log("No emails found.");
         return;
@@ -21611,16 +21708,7 @@ function emailCommand() {
             }
             usedFilenames.add(filename);
             const attPath = join12(attDir, filename);
-            const content = att.content;
-            let buf;
-            if (typeof content === "string") {
-              buf = Buffer.from(content, "base64");
-            } else if (content instanceof ArrayBuffer) {
-              buf = Buffer.from(new Uint8Array(content));
-            } else {
-              buf = Buffer.from(content);
-            }
-            writeFileSync8(attPath, buf);
+            writeFileSync8(attPath, contentToBuffer(att.content));
             downloadedPaths.push(attPath);
           }
         }
@@ -21661,7 +21749,7 @@ function emailCommand() {
     const client = new APIClient(serverUrl, token, workspaceId);
     let htmlBody;
     try {
-      htmlBody = readFileSync9(opts.bodyFile, "utf-8");
+      htmlBody = readFileSync11(opts.bodyFile, "utf-8");
     } catch (err) {
       console.error(`Error: cannot read body file "${opts.bodyFile}": ${err instanceof Error ? err.message : err}`);
       process.exit(1);
@@ -21673,27 +21761,8 @@ function emailCommand() {
     const attachmentPaths = opts.attachment ?? [];
     const attachments = [];
     try {
-      for (const path2 of attachmentPaths) {
-        let bytes;
-        let size;
-        try {
-          bytes = readFileSync9(path2);
-          size = statSync5(path2).size;
-        } catch (err) {
-          console.error(`Error: cannot read attachment "${path2}": ${err instanceof Error ? err.message : err}`);
-          process.exit(1);
-        }
-        const filename = basename2(path2);
-        const contentType = guessContentType(filename);
-        const form = new FormData;
-        form.append("file", new Blob([new Uint8Array(bytes)], { type: contentType }), filename);
-        const uploaded = await client.postMultipart("/api/email/upload", form);
-        attachments.push({
-          key: uploaded.key,
-          filename: uploaded.filename,
-          size: uploaded.size ?? size,
-          contentType: uploaded.contentType ?? contentType
-        });
+      for (const filePath of attachmentPaths) {
+        attachments.push(await uploadFile(client, filePath, "/api/email/upload"));
       }
       let inReplyTo;
       let references;
@@ -21708,9 +21777,7 @@ function emailCommand() {
           log10.warn(`could not fetch parent email ${opts.inReplyTo}, sending without threading`);
         }
       }
-      const conversationId = process.env.ALOOK_CONVERSATION_ID;
-      const traceId = process.env.ALOOK_TRACE_ID;
-      const sourceTaskId = process.env.ALOOK_TASK_ID;
+      const ctx = gatherContextEnvVars();
       const res = await client.postJSON("/api/email/send", {
         agentId,
         to: opts.to,
@@ -21719,9 +21786,9 @@ function emailCommand() {
         attachments,
         ...inReplyTo ? { inReplyTo, references } : {},
         ...opts.from ? { from: opts.from } : {},
-        ...conversationId ? { conversationId } : {},
-        ...traceId ? { traceId } : {},
-        ...sourceTaskId ? { sourceTaskId } : {}
+        ...ctx.conversationId ? { conversationId: ctx.conversationId } : {},
+        ...ctx.traceId ? { traceId: ctx.traceId } : {},
+        ...ctx.sourceTaskId ? { sourceTaskId: ctx.sourceTaskId } : {}
       });
       console.log(`Sent email to ${res.to_email} (id: ${res.id})`);
     } catch (err) {
@@ -21765,15 +21832,7 @@ function emailCommand() {
         for (const att of parsed.attachments) {
           const filename = att.filename || "attachment.bin";
           const contentType = att.mimeType || "application/octet-stream";
-          const content = att.content;
-          let buf;
-          if (typeof content === "string") {
-            buf = Buffer.from(content, "base64");
-          } else if (content instanceof ArrayBuffer) {
-            buf = Buffer.from(new Uint8Array(content));
-          } else {
-            buf = Buffer.from(content);
-          }
+          const buf = contentToBuffer(att.content);
           const form = new FormData;
           form.append("file", new Blob([new Uint8Array(buf)], { type: contentType }), filename);
           const uploaded = await client.postMultipart("/api/email/upload", form);
@@ -21786,27 +21845,8 @@ function emailCommand() {
         }
       }
       const extraPaths = opts.attachment ?? [];
-      for (const path2 of extraPaths) {
-        let bytes;
-        let size;
-        try {
-          bytes = readFileSync9(path2);
-          size = statSync5(path2).size;
-        } catch (err) {
-          console.error(`Error: cannot read attachment "${path2}": ${err instanceof Error ? err.message : err}`);
-          process.exit(1);
-        }
-        const filename = basename2(path2);
-        const contentType = guessContentType(filename);
-        const form = new FormData;
-        form.append("file", new Blob([new Uint8Array(bytes)], { type: contentType }), filename);
-        const uploaded = await client.postMultipart("/api/email/upload", form);
-        attachments.push({
-          key: uploaded.key,
-          filename: uploaded.filename,
-          size: uploaded.size ?? size,
-          contentType: uploaded.contentType ?? contentType
-        });
+      for (const filePath of extraPaths) {
+        attachments.push(await uploadFile(client, filePath, "/api/email/upload"));
       }
       let htmlBody = "";
       if (opts.note) {
@@ -21823,9 +21863,7 @@ function emailCommand() {
         htmlBody += `<pre>${parsed.text}</pre>`;
       }
       const subject = /^fwd:/i.test(original.subject) ? original.subject : `Fwd: ${original.subject}`;
-      const conversationId = process.env.ALOOK_CONVERSATION_ID;
-      const traceId = process.env.ALOOK_TRACE_ID;
-      const sourceTaskId = process.env.ALOOK_TASK_ID;
+      const ctx = gatherContextEnvVars();
       const res = await client.postJSON("/api/email/send", {
         agentId,
         to: opts.to,
@@ -21833,9 +21871,9 @@ function emailCommand() {
         htmlBody,
         attachments,
         ...opts.from ? { from: opts.from } : {},
-        ...conversationId ? { conversationId } : {},
-        ...traceId ? { traceId } : {},
-        ...sourceTaskId ? { sourceTaskId } : {}
+        ...ctx.conversationId ? { conversationId: ctx.conversationId } : {},
+        ...ctx.traceId ? { traceId: ctx.traceId } : {},
+        ...ctx.sourceTaskId ? { sourceTaskId: ctx.sourceTaskId } : {}
       });
       console.log(`Forwarded email to ${res.to_email} (id: ${res.id})`);
     } catch (err) {
@@ -21921,19 +21959,6 @@ function emailCommand() {
 
 // commands/calendar.ts
 import { Command as Command6 } from "commander";
-function resolveClientOpts2(command, agentId) {
-  const parentOpts = command.parent?.parent?.opts() || {};
-  const profile = parentOpts.profile;
-  const cfg = loadCLIConfigForProfile(profile);
-  const serverUrl = parentOpts.server || cfg.server_url;
-  const workspaces = cfg.watched_workspaces || [];
-  const ws = workspaces.find((w) => w.agent_ids?.includes(agentId));
-  if (!ws || !ws.token) {
-    console.error(`Error: no registered workspace contains agent ${agentId}. Run '${cmdPrefix()} register --token <token>' first.`);
-    process.exit(1);
-  }
-  return { serverUrl, token: ws.token, workspaceId: ws.id };
-}
 function parseLocalDatetime(input) {
   const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2}))?$/.exec(input);
   if (!match) {
@@ -21967,7 +21992,7 @@ function calendarCommand() {
   const cmd = new Command6("calendar").description("Manage scheduled agent events");
   cmd.command("set").description("Create a calendar event").option("--agent_id <id>", "Agent ID").requiredOption("--event_title <title>", "Event title (used as the task prompt)").requiredOption("--datetime <iso>", "Scheduled datetime (YYYY-MM-DDTHH:MM, local time)").option("--description <text>", "Optional longer-form notes for the event").option("--repeat <interval>", "Repeat interval, e.g. 1day, 2hour, 1month").option("--repeat_stop_date <date>", "Stop repeating on or after this date (YYYY-MM-DD, local time)").option("--json", "Output as JSON").action(async (opts, command) => {
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts2(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     let scheduledAt;
     try {
@@ -22011,7 +22036,7 @@ function calendarCommand() {
   });
   cmd.command("list").description("List calendar events for an agent").option("--agent_id <id>", "Agent ID").option("--future_days <n>", "Include events scheduled in the next N days", "30").option("--past_days <n>", "Include events scheduled in the past N days", "0").option("--json", "Output as JSON").action(async (opts, command) => {
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts2(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     const now = Date.now();
     const from = new Date(now - Number(opts.past_days) * 86400000).toISOString();
@@ -22038,7 +22063,7 @@ function calendarCommand() {
   });
   cmd.command("show").description("Show the full detail of a single calendar event").option("--agent_id <id>", "Agent ID").requiredOption("--event_id <id>", "Event ID").option("--json", "Output as JSON").action(async (opts, command) => {
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts2(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     try {
       const ev = await client.getJSON(`/api/calendar/${opts.event_id}`);
@@ -22102,7 +22127,7 @@ function calendarCommand() {
       process.exit(1);
     }
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts2(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     try {
       const updated = await client.patchJSON(`/api/calendar/${opts.event_id}`, body);
@@ -22122,7 +22147,7 @@ function calendarCommand() {
   });
   cmd.command("delete").description("Delete a calendar event").option("--agent_id <id>", "Agent ID").requiredOption("--event_id <id>", "Event ID").action(async (opts, command) => {
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts2(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     try {
       await client.deleteJSON(`/api/calendar/${opts.event_id}`);
@@ -22137,33 +22162,7 @@ function calendarCommand() {
 
 // commands/issue.ts
 import { Command as Command7 } from "commander";
-import { readFileSync as readFileSync10 } from "fs";
 var VALID_STATUSES2 = ["todo", "in_progress", "review", "done", "closed", "canceled", "failed"];
-function resolveClientOpts3(command, agentId) {
-  let root = command;
-  while (root.parent)
-    root = root.parent;
-  const parentOpts = root.opts() || {};
-  const profile = parentOpts.profile;
-  const cfg = loadCLIConfigForProfile(profile);
-  const serverUrl = parentOpts.server || cfg.server_url;
-  const workspaces = cfg.watched_workspaces || [];
-  const ws = workspaces.find((w) => w.agent_ids?.includes(agentId));
-  if (!ws || !ws.token) {
-    console.error(`Error: no registered workspace contains agent ${agentId}. Run '${cmdPrefix()} register --token <token>' first.`);
-    process.exit(1);
-  }
-  return { serverUrl, token: ws.token, workspaceId: ws.id };
-}
-function readBody(opts) {
-  if (opts.body && opts.bodyFile) {
-    console.error("Error: --body and --body-file are mutually exclusive");
-    process.exit(1);
-  }
-  if (opts.bodyFile)
-    return readFileSync10(opts.bodyFile, "utf-8");
-  return opts.body ?? "";
-}
 function printIssue(issue3) {
   console.log(`${issue3.id}  ${issue3.status.padEnd(11)}  ${issue3.title}`);
 }
@@ -22197,7 +22196,7 @@ function issueCommand() {
   const cmd = new Command7("issue").description("Manage assigned issues");
   cmd.command("create").description("Create and dispatch an issue to an agent").option("--agent_id <id>", "Agent ID").requiredOption("--title <title>", "Issue title").option("--description <text>", "Issue description").option("--body-file <path>", "Read issue description from a file").option("--json", "Output as JSON").action(async (opts, command) => {
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts3(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     const description = readBody({ body: opts.description, bodyFile: opts.bodyFile });
     try {
@@ -22220,7 +22219,7 @@ function issueCommand() {
       process.exit(1);
     }
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts3(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     const params = new URLSearchParams({ agentId });
     if (opts.status)
@@ -22244,7 +22243,7 @@ function issueCommand() {
   });
   cmd.command("show").description("Show issue details and conversation").option("--agent_id <id>", "Agent ID").requiredOption("--issue_id <id>", "Issue ID").option("--json", "Output as JSON").action(async (opts, command) => {
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts3(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     try {
       const res = await client.getJSON(`/api/issues/${opts.issue_id}?agentId=${encodeURIComponent(agentId)}`);
@@ -22278,7 +22277,7 @@ function issueCommand() {
       process.exit(1);
     }
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts3(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     try {
       const issue3 = await client.patchJSON(`/api/issues/${opts.issue_id}?agentId=${encodeURIComponent(agentId)}`, body);
@@ -22297,7 +22296,7 @@ function issueCommand() {
       process.exit(1);
     }
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts3(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     try {
       const res = await client.postJSON(`/api/issues/${opts.issue_id}/comments?agentId=${encodeURIComponent(agentId)}`, { content });
@@ -22359,62 +22358,23 @@ ${result.output}`);
 
 // commands/sync.ts
 import { Command as Command10 } from "commander";
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 import { basename as basename3 } from "path";
-var MIME_BY_EXT2 = {
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".txt": "text/plain",
-  ".html": "text/html",
-  ".json": "application/json",
-  ".csv": "text/csv",
-  ".md": "text/markdown",
-  ".ts": "text/typescript",
-  ".js": "text/javascript",
-  ".yaml": "text/yaml",
-  ".yml": "text/yaml",
-  ".svg": "image/svg+xml",
-  ".xml": "application/xml",
-  ".zip": "application/zip"
-};
-function guessContentType2(filename) {
-  const idx = filename.lastIndexOf(".");
-  if (idx < 0)
-    return "application/octet-stream";
-  const ext = filename.slice(idx).toLowerCase();
-  return MIME_BY_EXT2[ext] ?? "application/octet-stream";
-}
-function resolveClientOpts4(command, agentId) {
-  const parentOpts = command.parent?.parent?.opts() || {};
-  const profile = parentOpts.profile;
-  const cfg = loadCLIConfigForProfile(profile);
-  const serverUrl = parentOpts.server || cfg.server_url;
-  const workspaces = cfg.watched_workspaces || [];
-  const ws = workspaces.find((w) => w.agent_ids?.includes(agentId));
-  if (!ws || !ws.token) {
-    console.error(`Error: no registered workspace contains agent ${agentId}. Run '${cmdPrefix()} register --token <token>' first.`);
-    process.exit(1);
-  }
-  return { serverUrl, token: ws.token, workspaceId: ws.id };
-}
 function syncCommand() {
   const cmd = new Command10("sync").description("File sync utilities");
   cmd.command("upload-artifact").description("Upload a file artifact to a conversation").option("--agent_id <id>", "Agent ID").requiredOption("--conversation_id <id>", "Conversation ID").requiredOption("--file <path>", "Path to file to upload").action(async (opts, command) => {
     const agentId = resolveAgentId(opts);
-    const { serverUrl, token, workspaceId } = resolveClientOpts4(command, agentId);
+    const { serverUrl, token, workspaceId } = resolveClientOpts(command, { agentId });
     const client = new APIClient(serverUrl, token, workspaceId);
     let bytes;
     try {
-      bytes = readFileSync11(opts.file);
+      bytes = readFileSync12(opts.file);
     } catch (err) {
       console.error(`Error: cannot read file "${opts.file}": ${err.message}`);
       process.exit(1);
     }
     const filename = basename3(opts.file);
-    const contentType = guessContentType2(filename);
+    const contentType = guessContentType(filename);
     const form = new FormData;
     form.append("file", new Blob([new Uint8Array(bytes)], { type: contentType }), filename);
     form.append("agent_id", agentId);

package/dist/session-runner.js

@@ -14700,7 +14700,7 @@ var EmailNotifyRequestSchema = exports_external.object({
   r2Key: exports_external.string().min(1),
   from: exports_external.string().min(1),
   to: exports_external.string().optional(),
-  subject: exports_external.string().min(1),
+  subject: exports_external.string(),
   isWhitelisted: exports_external.boolean(),
   forwarded: exports_external.boolean().optional().default(false),
   messageId: exports_external.string().optional().default(""),
@@ -14802,6 +14802,7 @@ var SkillItemSchema = exports_external.object({
 var SkillSyncRequestSchema = exports_external.object({
   scope: exports_external.enum(["global", "agent"]),
   agent_id: exports_external.string().min(1).optional(),
+  daemon_id: exports_external.string().min(1).optional(),
   runtime: exports_external.enum(["claude", "codex", "opencode"]),
   skills: exports_external.array(SkillItemSchema)
 });
@@ -16701,12 +16702,13 @@ var agentSkill = sqliteTable("agent_skill", {
   id: text("id").primaryKey().$defaultFn(() => "as_" + nanoid3()),
   workspaceId: text("workspace_id").notNull().references(() => workspace.id, { onDelete: "cascade" }),
   agentId: text("agent_id"),
+  daemonId: text("daemon_id"),
   runtime: text("runtime").notNull(),
   name: text("name").notNull(),
   description: text("description").notNull().default(""),
   syncedAt: text("synced_at").notNull().$defaultFn(() => new Date().toISOString())
 }, (t) => [
-  unique("agent_skill_ws_runtime_name_agent").on(t.workspaceId, t.runtime, t.name, t.agentId),
+  unique("agent_skill_ws_runtime_name_agent_daemon").on(t.workspaceId, t.runtime, t.name, t.agentId, t.daemonId),
   index("idx_as_workspace_runtime").on(t.workspaceId, t.runtime),
   index("idx_as_agent_runtime").on(t.agentId, t.runtime),
   foreignKey({
@@ -18066,6 +18068,10 @@ ${task.agent.instructions}
 `;
     }
     content += `
+**Isolated workspaces:**
+- Each agent runs in its own isolated workspace directory. Colleagues CANNOT read your local files — even in the same workspace.
+- When sending plans, code, or any file to a colleague, you MUST attach the file to the email (use --attachment). Never reference local file paths expecting them to read it.
+
 **Email threading rules:**
 - When communicating with a colleague on the **same topic** as an existing email thread, reply to that thread (use --in-reply-to) to keep context together.
 - **When starting a NEW topic or task that is unrelated to any previous email thread, you MUST compose a brand new email (do NOT use --in-reply-to). Never hijack an unrelated thread just because you recently emailed that colleague.** Judge by topic/task relevance, not by recency of communication.
@@ -18091,7 +18097,10 @@ ${lines.join(`
 
 ### Emails
 ---
-Run '${cmdPrefix()} email pull --status unread' to download unread emails from inbox to '${tempDir("alook-emails")}/${task.workspaceId}/${task.agentId}/'.
+When your task prompt includes an \`email_id\` field, fetch ONLY that specific email:
+- Run '${cmdPrefix()} email pull --email_id <EMAIL_ID>' (uses the email_id from the prompt)
+When no \`email_id\` is present, fall back to listing unread:
+- Run '${cmdPrefix()} email pull --status unread' to download unread emails from inbox to '${tempDir("alook-emails")}/${task.workspaceId}/${task.agentId}/'.
 ---
 To download sent emails, add '--folder sent': '${cmdPrefix()} email pull --folder sent'
 Valid folders: inbox (default), sent, untrust.
@@ -18278,7 +18287,8 @@ function prepare(config2, task) {
     ALOOK_CONVERSATION_ID: task.conversationId,
     ALOOK_TRACE_ID: task.traceId ?? "",
     ALOOK_CHANNEL: task.channel ?? "default",
-    ALOOK_HEALTH_PORT: process.env.ALOOK_HEALTH_PORT || "19514"
+    ALOOK_HEALTH_PORT: process.env.ALOOK_HEALTH_PORT || "19514",
+    ...config2.token ? { ALOOK_TOKEN: config2.token } : {}
   };
   return { workDir, timelineDir, env };
 }
@@ -18651,6 +18661,9 @@ function buildPrompt(task, attachments) {
     } else {
       obj.notice = EMAIL_NOTICE;
     }
+    if (ctx?.emailId != null) {
+      obj.email_id = ctx.emailId;
+    }
   }
   if (task.type === "calendar_event") {
     obj.notice = CALENDAR_NOTICE;
@@ -18798,7 +18811,7 @@ async function runSession(input) {
   const timelineDir = path.join(agentBaseDir, ".context_timeline").replace(/\\/g, "/");
   mkdirSync4(timelineDir, { recursive: true });
   await initEntryAsync(timelineDir, createTimelineEntry(task.id, task.prompt, task.type, undefined, process.pid, provider, task.contextKey, input.logFilePath));
-  const { workDir, env } = prepare({ workspacesRoot }, task);
+  const { workDir, env } = prepare({ workspacesRoot, token }, task);
   let killed = false;
   const earlyOnKill = async () => {
     if (killed)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alook/cli",
-  "version": "0.0.98",
+  "version": "0.0.100",
   "description": "Alook CLI — Enable Your Person Colleague",
   "license": "Apache-2.0",
   "homepage": "https://github.com/alookai/alook#readme",