@astrale-os/cli 1.0.0-beta.26 → 1.0.0-beta.28

package/dist/astrale.js

@@ -2578,7 +2578,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@astrale-os/cli",
-    version: "1.0.0-beta.26",
+    version: "1.0.0-beta.28",
     description: "Astrale CLI — connect to existing Astrale kernels",
     keywords: [
       "astrale",
@@ -2638,6 +2638,7 @@ var init_package = __esm(() => {
       format: "pnpm exec oxfmt --write .",
       "format:check": "pnpm exec oxfmt --check .",
       test: "node scripts/qualification/source-boundary.mjs --target && bun test src studio/client/src studio/server studio/shared && node --test scripts/*.test.mjs",
+      "test:skills-e2e": "node scripts/qualification/skills-update-e2e.mjs",
       "test:studio": "pnpm --dir studio test",
       "test:watch": "bun test --watch src"
     },
@@ -2660,8 +2661,8 @@ var init_package = __esm(() => {
       "@astrale/commitlint-config": "jsr:~2.0.1",
       "@commitlint/cli": "21.2.2",
       "@commitlint/config-conventional": "21.2.2",
-      "@types/bun": "^1.1.16",
       "@types/node": "^22.0.0",
+      "bun-types": "1.4.0",
       husky: "~9.1.7",
       "lint-staged": "17.3.0",
       msgpackr: "^2.0.5",
@@ -61295,38 +61296,668 @@ var init_browser = __esm(() => {
   AUTH_EVAL = "fetch('/auth/me',{credentials:'include'})" + ".then(r=>r.json())" + ".then(j=>({authed:!!j.authenticated,email:j.user&&j.user.email}))" + ".catch(()=>({authed:false}))";
 });
 
-// src/lib/skills.ts
-import { existsSync, lstatSync, mkdirSync, readlinkSync, symlinkSync } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+// src/lib/skills/lock.ts
+import { randomUUID as randomUUID4 } from "node:crypto";
+import { lstat, mkdir as mkdir9, readFile as readFile10, readdir as readdir2, rm as rm2, stat as stat2, unlink as unlink4, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname8, join as join6 } from "node:path";
-async function installSkills() {
-  const { code, stdout, stderr } = await run("npx", [
-    "skills",
-    "add",
-    ASTRALE_CLI_SKILL_SOURCE,
-    "-g",
-    "-y"
-  ]);
-  if (code !== 0)
-    process.stderr.write(stdout + stderr);
-  return code === 0;
+async function withFileLock2(lockPath, fn, opts = {}) {
+  const pollIntervalMs = opts.pollIntervalMs ?? 100;
+  const staleAfterMs = opts.staleAfterMs ?? 30000;
+  const timeoutMs = opts.timeoutMs ?? 60000;
+  const deadline = Date.now() + timeoutMs;
+  const claimsRoot = `${lockPath}.claims`;
+  const token = randomUUID4();
+  const claimDirectory = join6(claimsRoot, token);
+  await mkdir9(dirname8(lockPath), { recursive: true });
+  await mkdir9(claimsRoot, { recursive: true });
+  await mkdir9(claimDirectory);
+  await writeFile5(join6(claimDirectory, "owner.json"), JSON.stringify({ pid: process.pid }), {
+    mode: 384
+  });
+  await writeFile5(join6(claimDirectory, "choosing"), "", { mode: 384 });
+  try {
+    const claims = await liveClaims(claimsRoot, staleAfterMs);
+    const ticket = Math.max(0, ...claims.flatMap((claim) => claim.ticket ?? [])) + 1;
+    await writeFile5(join6(claimDirectory, "ticket"), String(ticket), { mode: 384 });
+    await unlink4(join6(claimDirectory, "choosing"));
+    for (;; ) {
+      const contenders = await liveClaims(claimsRoot, staleAfterMs);
+      const blocked = contenders.some((claim) => claim.directory !== claimDirectory && (claim.choosing || claim.ticket === null || claim.ticket < ticket || claim.ticket === ticket && claim.directory < claimDirectory));
+      if (!blocked)
+        return await fn();
+      if (Date.now() >= deadline)
+        throw new Error("Timed out waiting for another skill update");
+      await new Promise((resolve3) => setTimeout(resolve3, pollIntervalMs));
+    }
+  } finally {
+    await rm2(claimDirectory, { recursive: true, force: true });
+  }
+}
+async function liveClaims(root, staleAfterMs) {
+  const directories = (await readdir2(root, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isDirectory()).map((entry) => join6(root, entry.name));
+  const claims = await Promise.all(directories.map(async (directory) => {
+    try {
+      const owner4 = JSON.parse(await readFile10(join6(directory, "owner.json"), "utf8"));
+      if (typeof owner4.pid !== "number")
+        return await discardIfStale(directory, staleAfterMs);
+      if (!isPidAlive2(owner4.pid)) {
+        await rm2(directory, { recursive: true, force: true });
+        return null;
+      }
+      const choosing = await lstat(join6(directory, "choosing")).then(() => true).catch(() => false);
+      const ticket = await readFile10(join6(directory, "ticket"), "utf8").then((value2) => {
+        const parsed = Number(value2);
+        return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;
+      }).catch(() => null);
+      return { directory, pid: owner4.pid, ticket, choosing };
+    } catch {
+      return await discardIfStale(directory, staleAfterMs);
+    }
+  }));
+  return claims.filter((claim) => claim !== null);
+}
+async function discardIfStale(directory, staleAfterMs) {
+  try {
+    if (Date.now() - (await stat2(directory)).mtimeMs > staleAfterMs) {
+      await rm2(directory, { recursive: true, force: true });
+    }
+  } catch {}
+  return null;
+}
+function isPidAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error52) {
+    return error52.code === "EPERM";
+  }
+}
+var init_lock = () => {};
+
+// src/lib/skills/sync.ts
+import { createHash as createHash2 } from "node:crypto";
+import {
+  cp,
+  lstat as lstat2,
+  mkdir as mkdir10,
+  mkdtemp as mkdtemp2,
+  readFile as readFile11,
+  readdir as readdir3,
+  readlink,
+  rename as rename3,
+  rm as rm3,
+  symlink,
+  writeFile as writeFile6
+} from "node:fs/promises";
+import { homedir as homedir2, tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname9, join as join7, relative, resolve as resolve3 } from "node:path";
+function resolvedDependencies(overrides = {}) {
+  const home = overrides.home ?? homedir2();
+  const xdgStateHome = process.env.XDG_STATE_HOME;
+  return {
+    home,
+    lockPath: overrides.lockPath ?? (xdgStateHome ? join7(xdgStateHome, "skills", ".skill-lock.json") : join7(home, ".agents", ".skill-lock.json")),
+    run: overrides.run ?? run,
+    resolveSource: overrides.resolveSource
+  };
+}
+function sourceOwned(entry) {
+  return entry.source === ASTRALE_CLI_SKILL_SOURCE || entry.sourceUrl === SOURCE_REPOSITORY_URL || entry.sourceUrl === `https://github.com/${ASTRALE_CLI_SKILL_SOURCE}`;
+}
+function folderName(entry) {
+  const match = entry.skillPath?.match(/^skills\/([^/]+)\/SKILL\.md$/u);
+  return match?.[1] ?? null;
+}
+async function resolveAstraleSkillSource(execute) {
+  const checkout = await mkdtemp2(join7(tmpdir2(), "astrale-skill-source-"));
+  try {
+    const cloned = await execute("git", [
+      "clone",
+      "--quiet",
+      "--depth",
+      "1",
+      "--filter=blob:none",
+      "--no-checkout",
+      "--single-branch",
+      "--branch",
+      "main",
+      SOURCE_REPOSITORY_URL,
+      checkout
+    ]);
+    if (cloned.code !== 0)
+      throw new Error(cloned.stderr || cloned.stdout || "git clone failed");
+    const revision = await execute("git", ["-C", checkout, "rev-parse", "HEAD"]);
+    if (revision.code !== 0) {
+      throw new Error(revision.stderr || revision.stdout || "git rev-parse failed");
+    }
+    const folders = await execute("git", ["-C", checkout, "ls-tree", "HEAD:skills"]);
+    const files = await execute("git", [
+      "-C",
+      checkout,
+      "ls-tree",
+      "-r",
+      "--name-only",
+      "HEAD:skills"
+    ]);
+    if (folders.code !== 0 || files.code !== 0) {
+      throw new Error(folders.stderr || files.stderr || "git ls-tree failed");
+    }
+    const skillFiles = new Set(files.stdout.split(`
+`).filter((path4) => /^[^/]+\/SKILL\.md$/u.test(path4)).map((path4) => path4.slice(0, -"/SKILL.md".length)));
+    const skills = folders.stdout.split(`
+`).flatMap((line) => {
+      const match = line.match(/^040000 tree ([0-9a-f]{40})\t([^/]+)$/u);
+      if (!match || !SAFE_NAME.test(match[2]) || !skillFiles.has(match[2]))
+        return [];
+      return [{ name: match[2], path: `skills/${match[2]}/SKILL.md`, tree: match[1] }];
+    });
+    skills.sort((a, b) => a.name.localeCompare(b.name));
+    if (skills.length === 0)
+      throw new Error("astrale-os/cli publishes no top-level skills");
+    return { ref: "main", revision: revision.stdout.trim(), skills };
+  } finally {
+    await rm3(checkout, { recursive: true, force: true });
+  }
+}
+async function readSkillLock(path4) {
+  let raw2;
+  try {
+    raw2 = await readFile11(path4, "utf8");
+  } catch (error52) {
+    if (error52.code === "ENOENT")
+      return { lock: null, raw: null };
+    throw error52;
+  }
+  try {
+    const parsed = JSON.parse(raw2);
+    if (parsed === null || typeof parsed !== "object" || !("skills" in parsed) || parsed.skills === null || typeof parsed.skills !== "object") {
+      return { lock: null, raw: raw2 };
+    }
+    return { lock: parsed, raw: raw2 };
+  } catch {
+    return { lock: null, raw: raw2 };
+  }
+}
+async function writeSkillLock(path4, lock) {
+  await mkdir10(dirname9(path4), { recursive: true });
+  const next = `${path4}.next`;
+  await writeFile6(next, `${JSON.stringify(lock, null, 2)}
+`, { mode: 384 });
+  await rename3(next, path4);
+}
+function gitObjectHash(type, body) {
+  return createHash2("sha1").update(Buffer.from(`${type} ${body.length}\x00`)).update(body).digest();
+}
+async function computeSkillTreeHash(root) {
+  async function treeHash(directory) {
+    const entries = await Promise.all((await readdir3(directory)).map(async (name) => {
+      const path4 = join7(directory, name);
+      const stat3 = await lstat2(path4);
+      if (stat3.isDirectory()) {
+        return { name, sort: `${name}/`, mode: "40000", hash: await treeHash(path4) };
+      }
+      if (stat3.isSymbolicLink()) {
+        return {
+          name,
+          sort: name,
+          mode: "120000",
+          hash: gitObjectHash("blob", Buffer.from(await readlink(path4)))
+        };
+      }
+      return {
+        name,
+        sort: name,
+        mode: stat3.mode & 73 ? "100755" : "100644",
+        hash: gitObjectHash("blob", await readFile11(path4))
+      };
+    }));
+    entries.sort((a, b) => Buffer.compare(Buffer.from(a.sort), Buffer.from(b.sort)));
+    const body = Buffer.concat(entries.flatMap((entry) => [Buffer.from(`${entry.mode} ${entry.name}\x00`), entry.hash]));
+    return gitObjectHash("tree", body);
+  }
+  return (await treeHash(root)).toString("hex");
+}
+async function computeInstallerFolderHash(root) {
+  const files = [];
+  async function collect(directory) {
+    await Promise.all((await readdir3(directory, { withFileTypes: true })).map(async (entry) => {
+      if (entry.name === ".git" || entry.name === "node_modules")
+        return;
+      const path4 = join7(directory, entry.name);
+      if (entry.isDirectory())
+        await collect(path4);
+      else if (entry.isFile()) {
+        files.push({
+          path: relative(root, path4).split("\\").join("/"),
+          content: await readFile11(path4)
+        });
+      }
+    }));
+  }
+  await collect(root);
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  const hash2 = createHash2("sha256");
+  for (const file2 of files)
+    hash2.update(file2.path).update(file2.content);
+  return hash2.digest("hex");
+}
+async function inspectAstraleSkills(snapshot2, home, lockPath) {
+  const { lock } = await readSkillLock(lockPath);
+  const managed = Object.entries(lock?.skills ?? {}).filter(([, entry]) => sourceOwned(entry));
+  const expected = new Map(snapshot2.skills.map((skill) => [skill.name, skill]));
+  const expectedPresence = await Promise.all(snapshot2.skills.map(async (skill) => {
+    try {
+      return (await lstat2(join7(home, ".agents", "skills", skill.name))).isDirectory();
+    } catch {
+      return false;
+    }
+  }));
+  if (managed.length === 0 && expectedPresence.every((present2) => !present2)) {
+    return { state: "absent", managedNames: [], managedFolders: [] };
+  }
+  const folders = managed.flatMap(([name, entry]) => {
+    const folder = folderName(entry);
+    return folder ? [{ key: name, folder, entry }] : [];
+  });
+  const uniqueFolders = new Set(folders.map((entry) => entry.folder));
+  let coherent = folders.length === managed.length && uniqueFolders.size === folders.length;
+  const actualHashes = new Map;
+  for (const item of folders) {
+    try {
+      const root = join7(home, ".agents", "skills", item.folder);
+      const actual = await computeSkillTreeHash(root);
+      actualHashes.set(item.folder, actual);
+      const receiptHash = item.entry.skillFolderHash;
+      if (!receiptHash || (receiptHash.length === 40 ? actual !== receiptHash : receiptHash.length === 64 ? await computeInstallerFolderHash(root) !== receiptHash : true)) {
+        coherent = false;
+      }
+      if (item.entry.skillPath !== `skills/${item.folder}/SKILL.md`)
+        coherent = false;
+    } catch {
+      coherent = false;
+    }
+  }
+  for (const [index, skill] of snapshot2.skills.entries()) {
+    if (expectedPresence[index] && !uniqueFolders.has(skill.name))
+      coherent = false;
+  }
+  if (await directoryExists(join7(home, ".claude"))) {
+    for (const skill of snapshot2.skills) {
+      const link = join7(home, ".claude", "skills", skill.name);
+      try {
+        if (!(await lstat2(link)).isSymbolicLink())
+          coherent = false;
+        else if (resolve3(dirname9(link), await readlink(link)) !== join7(home, ".agents", "skills", skill.name)) {
+          coherent = false;
+        }
+      } catch {
+        coherent = false;
+      }
+    }
+  }
+  const exactCurrent = coherent && managed.length === snapshot2.skills.length && folders.every(({ key, folder, entry }) => {
+    const skill = expected.get(folder);
+    return key === folder && skill !== undefined && entry.ref === snapshot2.ref && actualHashes.get(folder) === skill.tree;
+  });
+  return {
+    state: exactCurrent ? "current" : coherent ? "outdated" : "unhealthy",
+    managedNames: managed.map(([name]) => name),
+    managedFolders: [...uniqueFolders]
+  };
+}
+async function directoryExists(path4) {
+  try {
+    return (await lstat2(path4)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function sourceSnapshot(dependencies) {
+  return dependencies.resolveSource ? await dependencies.resolveSource() : await resolveAstraleSkillSource(dependencies.run);
+}
+function installerArgs(...args) {
+  return ["--yes", SKILLS_INSTALLER_PACKAGE, ...args];
+}
+async function installSnapshot(snapshot2, execute, selectedAgents) {
+  return await execute("npx", installerArgs("add", `${ASTRALE_CLI_SKILL_SOURCE}#${snapshot2.ref}`, "-g", "-y", "--skill", ...snapshot2.skills.map((skill) => skill.name), ...selectedAgents.length > 0 ? ["--agent", ...selectedAgents] : []));
+}
+async function selectedAgents(home, lockPath) {
+  const { lock } = await readSkillLock(lockPath);
+  const agents = new Set((lock?.lastSelectedAgents ?? []).filter((agent) => typeof agent === "string" && SAFE_NAME.test(agent)));
+  agents.add("codex");
+  if (await directoryExists(join7(home, ".claude")))
+    agents.add("claude-code");
+  return [...agents];
+}
+async function cleanManagedState(names, home, lockPath) {
+  for (const name of names) {
+    await rm3(join7(home, ".agents", "skills", name), { recursive: true, force: true });
+  }
+  const { lock, raw: raw2 } = await readSkillLock(lockPath);
+  if (!lock) {
+    if (raw2 !== null)
+      await rm3(lockPath, { force: true });
+    return;
+  }
+  for (const [name, entry] of Object.entries(lock.skills)) {
+    if (sourceOwned(entry))
+      delete lock.skills[name];
+  }
+  await writeSkillLock(lockPath, lock);
+}
+async function removeKnownAgentLinks(names, home) {
+  const roots = await readdir3(home, { withFileTypes: true }).catch(() => []);
+  for (const root of roots) {
+    if (!root.isDirectory() || !root.name.startsWith(".") || root.name === ".agents")
+      continue;
+    for (const name of names) {
+      const link = join7(home, root.name, "skills", name);
+      try {
+        const stat3 = await lstat2(link);
+        if (!stat3.isSymbolicLink())
+          continue;
+        const target2 = await readlink(link);
+        if (resolve3(dirname9(link), target2) === join7(home, ".agents", "skills", name)) {
+          await rm3(link, { force: true });
+        }
+      } catch {}
+    }
+  }
+}
+async function pruneObsoleteEntries(snapshot2, home, lockPath, execute, knownRetired) {
+  const expected = new Set(snapshot2.skills.map((skill) => skill.name));
+  const { lock } = await readSkillLock(lockPath);
+  const retiredEntries = Object.entries(lock?.skills ?? {}).filter(([, entry]) => {
+    const folder = folderName(entry);
+    return sourceOwned(entry) && folder !== null && !expected.has(folder);
+  });
+  const retired = [
+    ...new Set([
+      ...knownRetired,
+      ...retiredEntries.flatMap(([, entry]) => folderName(entry) ?? [])
+    ])
+  ];
+  if (retired.length > 0) {
+    const result = await execute("npx", installerArgs("remove", ...retired, "-g", "-y"));
+    if (result.code !== 0)
+      throw new Error(result.stderr || result.stdout || "skill removal failed");
+  }
+  const refreshed = await readSkillLock(lockPath);
+  if (!refreshed.lock)
+    return;
+  let changed = false;
+  for (const [name, entry] of Object.entries(refreshed.lock.skills)) {
+    if (!sourceOwned(entry))
+      continue;
+    const folder = folderName(entry);
+    if (folder === null || name !== folder || !expected.has(folder)) {
+      delete refreshed.lock.skills[name];
+      changed = true;
+    }
+  }
+  if (changed)
+    await writeSkillLock(lockPath, refreshed.lock);
+  await removeKnownAgentLinks(retired, home);
+  for (const name of retired) {
+    await rm3(join7(home, ".agents", "skills", name), { recursive: true, force: true });
+  }
+}
+async function captureAgentLinks(home, names) {
+  const links = [];
+  const roots = await readdir3(home, { withFileTypes: true }).catch(() => []);
+  for (const root of roots) {
+    if (!root.isDirectory() || !root.name.startsWith(".") || root.name === ".agents")
+      continue;
+    for (const name of names) {
+      const path4 = join7(home, root.name, "skills", name);
+      try {
+        if ((await lstat2(path4)).isSymbolicLink()) {
+          links.push({ root: root.name, name, target: await readlink(path4) });
+        }
+      } catch {}
+    }
+  }
+  return links;
+}
+async function writeBackupManifest(backup) {
+  const next = join7(backup.root, `${BACKUP_MANIFEST}.next`);
+  await writeFile6(next, JSON.stringify(backup), { mode: 384 });
+  await rename3(next, join7(backup.root, BACKUP_MANIFEST));
 }
+async function captureBackup(home, lockPath, names) {
+  const agentsRoot = join7(home, ".agents");
+  await mkdir10(agentsRoot, { recursive: true });
+  const root = await mkdtemp2(join7(agentsRoot, BACKUP_PREFIX));
+  const copied = [];
+  for (const name of names) {
+    const source2 = join7(agentsRoot, "skills", name);
+    try {
+      await cp(source2, join7(root, name), { recursive: true, dereference: false });
+      copied.push(name);
+    } catch (error52) {
+      if (error52.code !== "ENOENT")
+        throw error52;
+    }
+  }
+  const lock = await readSkillLock(lockPath);
+  const backup = {
+    root,
+    names,
+    copied,
+    links: await captureAgentLinks(home, names),
+    lockRaw: lock.raw,
+    createdAt: new Date().toISOString(),
+    phase: "prepared"
+  };
+  await writeBackupManifest(backup);
+  return backup;
+}
+async function extendBackup(backup, home, names) {
+  const additions = names.filter((name) => !backup.names.includes(name));
+  if (additions.length === 0)
+    return;
+  for (const name of additions) {
+    const source2 = join7(home, ".agents", "skills", name);
+    try {
+      await cp(source2, join7(backup.root, name), { recursive: true, dereference: false });
+      backup.copied.push(name);
+    } catch (error52) {
+      if (error52.code !== "ENOENT")
+        throw error52;
+    }
+  }
+  backup.names.push(...additions);
+  backup.links.push(...await captureAgentLinks(home, additions));
+  await writeBackupManifest(backup);
+}
+async function restoreAgentLinks(backup, home, onlyForeign = false) {
+  for (const link of backup.links) {
+    const path4 = join7(home, link.root, "skills", link.name);
+    const canonical = join7(home, ".agents", "skills", link.name);
+    if (onlyForeign && resolve3(dirname9(path4), link.target) === canonical)
+      continue;
+    await mkdir10(dirname9(path4), { recursive: true });
+    await rm3(path4, { recursive: true, force: true });
+    await symlink(link.target, path4);
+  }
+}
+async function restoreBackup(backup, home, lockPath) {
+  for (const name of backup.names) {
+    await rm3(join7(home, ".agents", "skills", name), { recursive: true, force: true });
+  }
+  await mkdir10(join7(home, ".agents", "skills"), { recursive: true });
+  for (const name of backup.copied) {
+    await cp(join7(backup.root, name), join7(home, ".agents", "skills", name), {
+      recursive: true,
+      dereference: false
+    });
+  }
+  if (backup.lockRaw === null)
+    await rm3(lockPath, { force: true });
+  else {
+    await mkdir10(dirname9(lockPath), { recursive: true });
+    const next = `${lockPath}.restore`;
+    await writeFile6(next, backup.lockRaw, { mode: 384 });
+    await rename3(next, lockPath);
+  }
+  await removeKnownAgentLinks(backup.names, home);
+  await restoreAgentLinks(backup, home);
+}
+async function recoverInterruptedBackup(home, lockPath) {
+  const agentsRoot = join7(home, ".agents");
+  const candidates = (await readdir3(agentsRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isDirectory() && entry.name.startsWith(BACKUP_PREFIX)).map((entry) => join7(agentsRoot, entry.name));
+  const backups = [];
+  for (const root of candidates) {
+    try {
+      const parsed = JSON.parse(await readFile11(join7(root, BACKUP_MANIFEST), "utf8"));
+      if (Array.isArray(parsed.names) && parsed.names.every((name) => typeof name === "string" && SAFE_NAME.test(name)) && Array.isArray(parsed.copied) && parsed.copied.every((name) => typeof name === "string" && parsed.names.includes(name)) && Array.isArray(parsed.links) && (typeof parsed.lockRaw === "string" || parsed.lockRaw === null) && typeof parsed.createdAt === "string" && (parsed.phase === "prepared" || parsed.phase === "verified") && parsed.links.every((link) => link !== null && typeof link === "object" && typeof link.root === "string" && /^\.[^/]+$/u.test(link.root) && typeof link.name === "string" && parsed.names.includes(link.name) && typeof link.target === "string")) {
+        const backup = { ...parsed, root };
+        if (backup.phase === "verified")
+          await rm3(root, { recursive: true, force: true });
+        else
+          backups.push(backup);
+      } else {
+        await rm3(root, { recursive: true, force: true });
+      }
+    } catch {
+      await rm3(root, { recursive: true, force: true });
+    }
+  }
+  if (backups.length === 0)
+    return;
+  backups.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+  await restoreBackup(backups[0], home, lockPath);
+  await Promise.all(candidates.map((root) => rm3(root, { recursive: true, force: true })));
+}
+async function markBackupVerified(backup) {
+  backup.phase = "verified";
+  await writeBackupManifest(backup);
+}
+function skillFailure(error52) {
+  const detail = error52 instanceof Error && error52.message.trim() ? `: ${error52.message}` : "";
+  return new AstraleError("SKILL_UPDATE_FAILED", `Astrale could not install and verify its agent skills${detail}`, `Retry with \`${ASTRALE_SKILL_REPAIR_COMMAND}\`.`, error52 instanceof Error ? { cause: error52 } : undefined);
+}
+async function checkAstraleSkills(overrides = {}) {
+  const dependencies = resolvedDependencies(overrides);
+  try {
+    const snapshot2 = await sourceSnapshot(dependencies);
+    const inspection = await inspectAstraleSkills(snapshot2, dependencies.home, dependencies.lockPath);
+    return {
+      status: inspection.state === "current" ? "current" : inspection.state === "unhealthy" ? "repair-needed" : "update-available"
+    };
+  } catch (error52) {
+    return { status: "unavailable", error: error52 instanceof Error ? error52.message : String(error52) };
+  }
+}
+async function syncAstraleSkills(overrides = {}) {
+  const dependencies = resolvedDependencies(overrides);
+  let snapshot2;
+  try {
+    snapshot2 = await sourceSnapshot(dependencies);
+  } catch (error52) {
+    throw skillFailure(error52);
+  }
+  const lockFile = join7(process.env.ASTRALE_HOME ?? join7(dependencies.home, ".astrale"), "locks", "skills-update.lock");
+  try {
+    return await withFileLock2(lockFile, async () => {
+      await recoverInterruptedBackup(dependencies.home, dependencies.lockPath);
+      const initial = await inspectAstraleSkills(snapshot2, dependencies.home, dependencies.lockPath);
+      if (initial.state === "current")
+        return { status: "unchanged" };
+      let expectedNames = snapshot2.skills.map((skill) => skill.name);
+      let managedFolders = [...new Set([...expectedNames, ...initial.managedFolders])];
+      let knownRetired = initial.managedFolders.filter((name) => !expectedNames.includes(name));
+      const agents = await selectedAgents(dependencies.home, dependencies.lockPath);
+      const backup = await captureBackup(dependencies.home, dependencies.lockPath, managedFolders);
+      let lastError;
+      try {
+        for (let attempt = 0;attempt < 2; attempt++) {
+          try {
+            if (attempt === 1) {
+              snapshot2 = await sourceSnapshot(dependencies);
+              expectedNames = snapshot2.skills.map((skill) => skill.name);
+              managedFolders = [...new Set([...managedFolders, ...expectedNames])];
+              await extendBackup(backup, dependencies.home, managedFolders);
+              knownRetired = [
+                ...new Set([
+                  ...knownRetired,
+                  ...managedFolders.filter((name) => !expectedNames.includes(name))
+                ])
+              ];
+            }
+            if (initial.state === "unhealthy" || attempt === 1) {
+              await cleanManagedState(managedFolders, dependencies.home, dependencies.lockPath);
+            }
+            const installed = await installSnapshot(snapshot2, dependencies.run, agents);
+            if (installed.code !== 0) {
+              throw new Error(installed.stderr || installed.stdout || "skill installer failed");
+            }
+            await pruneObsoleteEntries(snapshot2, dependencies.home, dependencies.lockPath, dependencies.run, knownRetired);
+            const verified = await inspectAstraleSkills(snapshot2, dependencies.home, dependencies.lockPath);
+            if (verified.state !== "current") {
+              throw new Error("installed Astrale skills did not pass verification");
+            }
+            const latest = await sourceSnapshot(dependencies);
+            if (latest.revision !== snapshot2.revision) {
+              throw new Error("Astrale skill source changed during installation");
+            }
+            await markBackupVerified(backup);
+            await rm3(backup.root, { recursive: true, force: true });
+            return {
+              status: initial.state === "absent" ? "installed" : initial.state === "outdated" ? "updated" : "repaired"
+            };
+          } catch (error52) {
+            lastError = error52;
+          }
+        }
+        throw lastError;
+      } catch (error52) {
+        if (initial.state === "absent" || initial.state === "unhealthy") {
+          await cleanManagedState(managedFolders, dependencies.home, dependencies.lockPath);
+          await removeKnownAgentLinks(managedFolders, dependencies.home);
+          await restoreAgentLinks(backup, dependencies.home, true);
+        } else {
+          await restoreBackup(backup, dependencies.home, dependencies.lockPath);
+        }
+        await rm3(backup.root, { recursive: true, force: true });
+        throw skillFailure(error52);
+      }
+    });
+  } catch (error52) {
+    if (error52 instanceof AstraleError)
+      throw error52;
+    throw skillFailure(error52);
+  }
+}
+var ASTRALE_CLI_SKILL_SOURCE = "astrale-os/cli", ASTRALE_SKILL_REPAIR_COMMAND = "astrale update --yes --no-deps", SKILLS_INSTALLER_PACKAGE = "skills@1.5.23", SKILL_INSTALL_HINT, SOURCE_REPOSITORY_URL = "https://github.com/astrale-os/cli.git", SAFE_NAME, BACKUP_PREFIX = ".astrale-skill-backup-", BACKUP_MANIFEST = ".manifest.json";
+var init_sync = __esm(() => {
+  init_errors2();
+  init_proc();
+  init_lock();
+  SKILL_INSTALL_HINT = ASTRALE_SKILL_REPAIR_COMMAND;
+  SAFE_NAME = /^[a-z0-9][a-z0-9._-]*$/iu;
+});
+
+// src/lib/skills.ts
+import { existsSync, lstatSync, mkdirSync, readlinkSync, symlinkSync } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname10, join as join8 } from "node:path";
 function skillSearchDirs() {
   const dirs = [];
   let cur = process.cwd();
   for (;; ) {
-    dirs.push(join6(cur, ".claude", "skills"));
-    const parent = dirname8(cur);
+    dirs.push(join8(cur, ".claude", "skills"));
+    const parent = dirname10(cur);
     if (parent === cur)
       break;
     cur = parent;
   }
-  dirs.push(join6(homedir2(), ".claude", "skills"));
+  dirs.push(join8(homedir3(), ".claude", "skills"));
   return dirs;
 }
 function detectSkill(name) {
   for (const dir of skillSearchDirs()) {
-    const file2 = join6(dir, name, "SKILL.md");
+    const file2 = join8(dir, name, "SKILL.md");
     if (existsSync(file2))
       return { installed: true, location: file2 };
   }
@@ -61345,9 +61976,9 @@ function isSymlink(p) {
 function findAgentsSkillsRoot(fromDir) {
   let cur = fromDir;
   for (;; ) {
-    if (existsSync(join6(cur, ".agents", "skills")))
+    if (existsSync(join8(cur, ".agents", "skills")))
       return cur;
-    const parent = dirname8(cur);
+    const parent = dirname10(cur);
     if (parent === cur)
       return null;
     cur = parent;
@@ -61357,7 +61988,7 @@ function skillsBridgeStatus(fromDir = process.cwd()) {
   const root = findAgentsSkillsRoot(fromDir);
   if (!root)
     return { kind: "none" };
-  const link = join6(root, ".claude", "skills");
+  const link = join8(root, ".claude", "skills");
   if (isSymlink(link)) {
     try {
       if (readlinkSync(link) === BRIDGE_TARGET)
@@ -61373,16 +62004,15 @@ function ensureSkillsBridge(fromDir = process.cwd()) {
   const status = skillsBridgeStatus(fromDir);
   if (status.kind !== "unbridged")
     return status;
-  mkdirSync(dirname8(status.link), { recursive: true });
+  mkdirSync(dirname10(status.link), { recursive: true });
   symlinkSync(BRIDGE_TARGET, status.link);
   return { kind: "bridged", root: status.root };
 }
-var ASTRALE_CLI_SKILL = "astrale-cli", ASTRALE_DOMAIN_SKILL = "astrale-domain", AGENT_BROWSER_SKILL = "agent-browser", ASTRALE_CLI_SKILL_SOURCE = "astrale-os/cli", SKILL_INSTALL_HINT, BRIDGE_TARGET;
+var AGENT_BROWSER_SKILL = "agent-browser", BRIDGE_TARGET;
 var init_skills = __esm(() => {
   init_browser();
-  init_proc();
-  SKILL_INSTALL_HINT = `npx skills add ${ASTRALE_CLI_SKILL_SOURCE} -g`;
-  BRIDGE_TARGET = join6("..", ".agents", "skills");
+  init_sync();
+  BRIDGE_TARGET = join8("..", ".agents", "skills");
 });
 
 // src/setup/steps/agent-browser.ts
@@ -61625,9 +62255,9 @@ var init_auth5 = __esm(() => {
 
 // src/setup/steps/domain.ts
 import { existsSync as existsSync2 } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join9 } from "node:path";
 function hasDomainProject() {
-  return existsSync2(join7(process.cwd(), "astrale.config.ts"));
+  return existsSync2(join9(process.cwd(), "astrale.config.ts"));
 }
 var FIX4 = "npx create-astrale-domain <name> --instance <slug>", domainStep;
 var init_domain2 = __esm(() => {
@@ -70385,7 +71015,7 @@ function createClasses(definitions, validation) {
   const declarations2 = new Map(definitions.filter((value2) => value2.ref.kind === "class").map((value2) => [Key.of(value2.ref), value2]));
   const resolved = new Map;
   const visiting = new Set;
-  const resolve3 = (ref) => {
+  const resolve4 = (ref) => {
     const key = Key.of(ref);
     const cached3 = resolved.get(key);
     if (cached3 !== undefined)
@@ -70396,7 +71026,7 @@ function createClasses(definitions, validation) {
     if (definition === undefined)
       throw new TypeError(`Class ${key} is absent from Domain input.`);
     visiting.add(key);
-    const parents = definition.extends.map(resolve3);
+    const parents = definition.extends.map(resolve4);
     if (parents.some((parent) => parent.kind !== definition.kind)) {
       throw new TypeError(`Class ${key} extends a Class of another graph kind.`);
     }
@@ -70510,7 +71140,7 @@ function createClasses(definitions, validation) {
     return value2;
   };
   for (const definition of declarations2.values())
-    resolve3(definition.ref);
+    resolve4(definition.ref);
   return resolved;
 }
 function uniquePolicyRefs(values) {
@@ -70981,7 +71611,7 @@ var init_program = __esm(() => {
 });
 
 // node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.13/node_modules/@astrale-os/kernel-dsl/dist/v1/schema/resolution/domain.js
-function resolve3(schema) {
+function resolve4(schema) {
   const cached3 = resolvedSchemas.get(schema);
   if (cached3 !== undefined)
     return cached3;
@@ -71106,7 +71736,7 @@ var init_schema5 = __esm(() => {
 
 // node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.13/node_modules/@astrale-os/kernel-dsl/dist/v1/schema/compatibility/meaning.js
 function compareDependencyMeaning(dependent, target2) {
-  resolve3(dependent);
+  resolve4(dependent);
   const closure2 = knownDomainClosure(dependent) ?? [];
   const source2 = closure2.find((candidate) => candidate.schema.origin === target2.origin)?.schema;
   if (source2 === undefined) {
@@ -71132,7 +71762,7 @@ function compareMemberMeaning(source2, target2, roots) {
       diagnostic2("DM_MEMBER_ROOT_INVALID", "/roots", "Member comparison roots must be one non-empty duplicate-free Key set.")
     ]);
   }
-  resolve3(source2);
+  resolve4(source2);
   const closure2 = knownDomainClosure(source2) ?? [];
   const schemas3 = new Map([
     [source2.origin, source2],
@@ -71143,7 +71773,7 @@ function compareMemberMeaning(source2, target2, roots) {
   return compareSourceMeanings(source2, target2, sourceMeanings);
 }
 function compareSourceMeanings(source2, target2, sourceMeanings) {
-  resolve3(target2);
+  resolve4(target2);
   const footprint = Object.freeze([...sourceMeanings.keys()].sort(compareUnicode));
   const changes = [];
   const comparisonCoordinates = [];
@@ -73942,12 +74572,12 @@ __export(exports_schema, {
   encode: () => encodeDomainSchema,
   header: () => header,
   load: () => load2,
-  resolve: () => resolve4,
+  resolve: () => resolve5,
   revision: () => revisionOfDomainSchema,
   serialize: () => serializeDomainSchema,
   values: () => exports_value_api
 });
-var resolve4;
+var resolve5;
 var init_schema6 = __esm(() => {
   init_domain7();
   init_accept3();
@@ -73958,7 +74588,7 @@ var init_schema6 = __esm(() => {
   init_compiled();
   init_diagnostic2();
   init_value_api();
-  resolve4 = resolve3;
+  resolve5 = resolve4;
 });
 
 // node_modules/.pnpm/@astrale-os+kernel-dsl@0.2.0-beta.13/node_modules/@astrale-os/kernel-dsl/dist/v1/bundle/diagnostic.js
@@ -75709,12 +76339,12 @@ var init_view_resolution = __esm(() => {
 });
 
 // node_modules/.pnpm/@astrale-os+kernel-core@0.9.0-beta.16/node_modules/@astrale-os/kernel-core/dist/schema/kernel/syscalls/descriptors/view.js
-var resolve5;
+var resolve6;
 var init_view5 = __esm(() => {
   init_kernel();
   init_view();
   init_view_resolution();
-  resolve5 = methodSyscall(resolve, K.classes.View.static.methods.resolve);
+  resolve6 = methodSyscall(resolve, K.classes.View.static.methods.resolve);
 });
 
 // node_modules/.pnpm/@astrale-os+kernel-core@0.9.0-beta.16/node_modules/@astrale-os/kernel-core/dist/schema/kernel/syscalls/descriptors/index.js
@@ -78542,14 +79172,14 @@ async function boundedResponse(response2, maximum, signal) {
     signal.removeEventListener("abort", abort);
     reader.releaseLock();
   }
-  return join8(chunks, total);
+  return join10(chunks, total);
 }
 function requireExactResponse(response2, expected, label) {
   if (response2.redirected || response2.url !== expected) {
     throw new ClientError(`${label} did not return the exact requested URL.`);
   }
 }
-function join8(parts, length) {
+function join10(parts, length) {
   if (parts.length === 1)
     return new Uint8Array(parts[0]);
   const output3 = new Uint8Array(length);
@@ -79426,7 +80056,7 @@ function requestUrl(input) {
   return new URL(input.url);
 }
 function fetchWithNode(url3, init, ca) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const request = httpsRequest(url3, {
       method: init?.method ?? "GET",
       headers: headersInitToRecord(init?.headers),
@@ -79443,7 +80073,7 @@ function fetchWithNode(url3, init, ca) {
           headers: responseHeaders(response2.headers)
         });
         Object.defineProperty(result, "url", { value: url3.toString() });
-        resolve6(result);
+        resolve7(result);
       });
     });
     request.on("error", reject);
@@ -80705,49 +81335,65 @@ var init_instance3 = __esm(() => {
 });
 
 // src/setup/steps/skills.ts
-var FIX5, bothInstalled = () => detectSkill(ASTRALE_CLI_SKILL).installed && detectSkill(ASTRALE_DOMAIN_SKILL).installed, skillsStep;
+var FIX5, skillsStep;
 var init_skills2 = __esm(() => {
   init_log();
   init_skills();
   FIX5 = SKILL_INSTALL_HINT;
   skillsStep = {
     id: "skills",
-    title: "astrale agent skills (cli + domain)",
+    title: "Astrale agent skills",
     group: "equip",
     async detect() {
-      if (bothInstalled()) {
-        return { state: "satisfied", summary: "astrale-cli + astrale-domain skills installed" };
+      const result = await checkAstraleSkills();
+      if (result.status === "current") {
+        return { state: "satisfied", summary: "Astrale skills are installed and up to date" };
+      }
+      if (result.status === "unavailable") {
+        return {
+          state: "broken",
+          summary: "Astrale skills could not be verified",
+          detail: result.error,
+          fixHint: FIX5
+        };
       }
-      const have = detectSkill(ASTRALE_CLI_SKILL).installed ? "astrale-domain" : "astrale agent skills";
-      return { state: "gap", summary: `${have} not installed`, fixHint: FIX5 };
+      return {
+        state: "gap",
+        summary: result.status === "repair-needed" ? "Astrale skills need repair" : "Astrale skills need installation or update",
+        fixHint: FIX5
+      };
     },
     async ensure() {
-      if (bothInstalled()) {
-        log.success("astrale-cli + astrale-domain skills already installed");
-        return "unchanged";
-      }
-      log.step(`Installing the astrale agent skills — ${FIX5}`);
-      if (!await installSkills()) {
-        log.warn(`Skill install did not complete — run it later: ${FIX5}`);
+      log.step("Ensuring Astrale agent skills are current and healthy");
+      try {
+        const result = await syncAstraleSkills();
+        if (result.status === "unchanged") {
+          log.success("Astrale skills already up to date");
+          return "unchanged";
+        }
+        if (result.status === "installed")
+          log.success("Astrale skills installed");
+        else if (result.status === "updated")
+          log.success("Astrale skills updated");
+        else if (result.status === "repaired")
+          log.success("Astrale skills repaired and updated");
+        return "fixed";
+      } catch (error52) {
+        log.warn(`Astrale skills could not be installed safely${error52 instanceof Error ? `: ${error52.message}` : ""}`);
+        log.dim(`  Retry: ${FIX5}`);
         return "failed";
       }
-      if (bothInstalled()) {
-        log.success("astrale-cli + astrale-domain skills installed");
-      } else {
-        log.success("astrale-cli skill installed");
-      }
-      return "fixed";
     }
   };
 });
 
 // src/setup/steps/skills-bridge.ts
 import { existsSync as existsSync3, readdirSync } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join11 } from "node:path";
 function countStaged(root) {
   try {
-    const dir = join9(root, ".agents", "skills");
-    return readdirSync(dir).filter((e) => existsSync3(join9(dir, e, "SKILL.md"))).length;
+    const dir = join11(root, ".agents", "skills");
+    return readdirSync(dir).filter((e) => existsSync3(join11(dir, e, "SKILL.md"))).length;
   } catch {
     return 0;
   }
@@ -80785,7 +81431,7 @@ var init_skills_bridge = __esm(() => {
       }
       const after = ensureSkillsBridge();
       if (after.kind === "bridged") {
-        log.success(`Workspace skills bridged — ${join9(after.root, ".agents/skills")} → .claude/skills`);
+        log.success(`Workspace skills bridged — ${join11(after.root, ".agents/skills")} → .claude/skills`);
         return "fixed";
       }
       log.warn("Could not create the skills bridge — create it manually: ln -s ../.agents/skills .claude/skills");
@@ -81253,18 +81899,18 @@ Examples:
 
 // src/lib/sdk-deps.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { join as join10 } from "node:path";
+import { join as join12 } from "node:path";
 function inDomainProject(cwd = process.cwd()) {
-  return existsSync4(join10(cwd, "astrale.config.ts"));
+  return existsSync4(join12(cwd, "astrale.config.ts"));
 }
 function foreignPackageManager(cwd = process.cwd()) {
-  if (existsSync4(join10(cwd, "pnpm-lock.yaml")))
+  if (existsSync4(join12(cwd, "pnpm-lock.yaml")))
     return null;
-  if (existsSync4(join10(cwd, "package-lock.json")))
+  if (existsSync4(join12(cwd, "package-lock.json")))
     return "npm";
-  if (existsSync4(join10(cwd, "yarn.lock")))
+  if (existsSync4(join12(cwd, "yarn.lock")))
     return "yarn";
-  if (existsSync4(join10(cwd, "bun.lockb")) || existsSync4(join10(cwd, "bun.lock")))
+  if (existsSync4(join12(cwd, "bun.lockb")) || existsSync4(join12(cwd, "bun.lock")))
     return "bun";
   return null;
 }
@@ -81317,15 +81963,30 @@ __export(exports_update, {
   fetchNpmTargetVersion: () => fetchNpmTargetVersion
 });
 async function refreshSkills() {
-  if (!detectSkill(ASTRALE_CLI_SKILL).installed) {
-    log.dim(`  Agent skills not installed — get them with: ${SKILL_INSTALL_HINT}`);
-    return;
-  }
-  log.step(`Refreshing the astrale agent skills — ${SKILL_INSTALL_HINT}`);
-  if (await installSkills()) {
-    log.success("astrale agent skills up to date");
-  } else {
-    log.warn(`Skill refresh did not complete — run it later: ${SKILL_INSTALL_HINT}`);
+  log.step("Ensuring Astrale agent skills are current and healthy");
+  const result = await syncAstraleSkills();
+  if (result.status === "unchanged")
+    log.success("Astrale skills already up to date");
+  else if (result.status === "installed")
+    log.success("Astrale skills installed");
+  else if (result.status === "updated")
+    log.success("Astrale skills updated");
+  else if (result.status === "repaired")
+    log.success("Astrale skills repaired and updated");
+  return result;
+}
+function skillCheckStale(skills) {
+  return skills.status === "update-available" || skills.status === "repair-needed";
+}
+function printSkillCheck(skills) {
+  if (skills.status === "current")
+    log.success("Astrale skills are up to date");
+  else if (skills.status === "update-available")
+    log.info("Astrale skills update available");
+  else if (skills.status === "repair-needed")
+    log.warn("Astrale skills need repair");
+  else if (skills.status === "unavailable") {
+    log.warn(`Could not verify Astrale skills${skills.error ? `: ${skills.error}` : ""}`);
   }
 }
 async function refreshSdkDeps(check3, assumeYes = false) {
@@ -81452,7 +82113,7 @@ var init_update2 = __esm(() => {
         default: DEFAULT_UPDATE_CHANNEL
       },
       { flags: "--version <version>", description: "Update to an exact version tag" },
-      { flags: "--no-skills", description: "Skip refreshing the astrale agent skills" },
+      { flags: "--no-skills", description: "Skip ensuring the Astrale agent skills" },
       { flags: "--no-deps", description: "Skip checking @astrale-os SDK dependency versions" },
       {
         flags: "--yes",
@@ -81465,23 +82126,22 @@ Behavior:
   Keeps three things current, in order. (1) The CLI binary: updates official
   script installs only — if Astrale was installed by another package manager this
   command refuses so that manager stays in charge; downloads are checksum-verified
-  before the binary is replaced. (2) The agent skills: if the astrale skills (cli +
-  domain) are already installed, refreshes them to the latest by delegating to
-  "npx skills add astrale-os/cli -g" — the same installer "astrale setup" uses;
-  fresh installs go through "astrale setup". (3) SDK deps: inside a pnpm domain
+  before the binary is replaced. (2) The Astrale agent skills: installs every
+  top-level skill published from astrale-os/cli main, updates healthy older
+  installs, repairs inconsistent installs, and verifies the result before
+  reporting success. (3) SDK deps: inside a pnpm domain
   project, proposes any @astrale-os/* dependency with a newer release and, on
   confirm, runs "pnpm update --latest --lockfile-only" (updates package.json AND
   the lockfile, honoring your registry + supply-chain age policy; run "pnpm
   install" to materialize).
 
   The default release channel is beta; --channel overrides it for one run.
-  --check is a dry run (binary + SDK deps; exit 10 if anything is available) and
+  --check is a dry run (binary + skills + SDK deps; exit 10 if anything is available) and
   never writes. With --json it emits a unified staleness report
-  ({ stale, cli, sdk }) for tooling — non-throwing, skills omitted (they ride
-  along with an update). --yes applies all three non-interactively (no prompts) and
+  ({ stale, cli, skills, sdk }) for tooling. --yes applies all three non-interactively and
   is resilient — a binary that can't self-update (package-managed) warns but never
-  blocks the skills/deps steps; this is what domain-studio's "Update now" runs.
-  --no-skills / --no-deps skip those steps in a real run.
+  blocks the skills/deps steps; a skill failure fails the command rather than
+  claiming a partial success. --no-skills / --no-deps explicitly skip those axes.
 
 Examples:
   $ astrale update
@@ -81496,8 +82156,14 @@ Examples:
       try {
         if (opts.check && isMachine(opts)) {
           const cli = await cliStale(opts);
+          const skills = opts.skills === false ? { status: "skipped" } : await checkAstraleSkills();
           const sdk = await sdkStale();
-          const report = { stale: cli.stale || sdk.stale, cli, sdk };
+          const report = {
+            stale: cli.stale || skillCheckStale(skills) || sdk.stale,
+            cli,
+            skills,
+            sdk
+          };
           output(report, opts);
           if (report.stale)
             process.exitCode = 10;
@@ -81536,22 +82202,32 @@ Examples:
             throw error52;
           log.warn(`CLI self-update skipped: ${error52.message}`);
         }
-        if (!opts.check && opts.skills !== false)
-          await refreshSkills();
+        if (opts.skills !== false) {
+          if (opts.check) {
+            const skills = await checkAstraleSkills();
+            printSkillCheck(skills);
+            if (skillCheckStale(skills))
+              anyAvailable = true;
+          } else {
+            await refreshSkills();
+          }
+        } else if (!opts.check) {
+          log.dim("  Astrale skills skipped (--no-skills)");
+        }
         if (opts.deps !== false && await refreshSdkDeps(opts.check === true, opts.yes === true)) {
           anyAvailable = true;
         }
         if (opts.check && anyAvailable)
           process.exitCode = 10;
       } catch (e) {
-        fatal(e);
+        fatal(e, opts);
       }
     }
   };
 });
 
 // src/lib/binary.ts
-import { writeFile as writeFile5 } from "node:fs/promises";
+import { writeFile as writeFile7 } from "node:fs/promises";
 async function readBinaryBody(body) {
   if (body instanceof Uint8Array)
     return new Uint8Array(body);
@@ -81603,7 +82279,7 @@ function jsonEnvelope(resp, bytes) {
 async function presentBinary(resp, opts, io) {
   const bytes = await readBinaryBody(resp.body);
   if (io?.outFile) {
-    await writeFile5(io.outFile, bytes);
+    await writeFile7(io.outFile, bytes);
     process.stderr.write(source_default.dim(`  wrote ${humanSize(bytes.length)} (${resp.mediaType}) → ${io.outFile}
 `));
     return;
@@ -81963,7 +82639,7 @@ var init_get = __esm(() => {
     description: "Get one canonical node by Path or ID",
     afterHelpText: `
 Behavior:
-  Resolves one exact Kernel V2 Path and prints the canonical Node
+  Resolves one exact Kernel Path and prints the canonical Node
   { id, class, props }. Missing and authorization-masked nodes remain
   intentionally indistinguishable. @self is expanded before dispatch.
 
@@ -82114,7 +82790,7 @@ __export(exports_mutate, {
   default: () => mutate_default,
   mutateCommand: () => mutateCommand
 });
-import { readFile as readFile10 } from "node:fs/promises";
+import { readFile as readFile12 } from "node:fs/promises";
 async function mutateCommand(opts) {
   let mutation;
   try {
@@ -82147,7 +82823,7 @@ async function readDocument(opts) {
   if (opts.file !== undefined) {
     let raw3;
     try {
-      raw3 = await readFile10(opts.file, "utf8");
+      raw3 = await readFile12(opts.file, "utf8");
     } catch (error52) {
       throw new AstraleError("FILE_READ_FAILED", `Cannot read --file ${opts.file}.`, undefined, {
         cause: error52
@@ -82231,7 +82907,7 @@ __export(exports_query, {
   default: () => query_default,
   queryCommand: () => queryCommand
 });
-import { readFile as readFile11 } from "node:fs/promises";
+import { readFile as readFile13 } from "node:fs/promises";
 async function queryCommand(sources2, opts) {
   let input;
   try {
@@ -82282,7 +82958,7 @@ async function readAst(opts) {
     return;
   let raw2;
   try {
-    raw2 = await readFile11(opts.file, "utf8");
+    raw2 = await readFile13(opts.file, "utf8");
   } catch (error52) {
     throw new AstraleError("FILE_READ_FAILED", `Cannot read --file ${opts.file}.`, undefined, {
       cause: error52
@@ -82608,7 +83284,7 @@ async function runOnce(opts) {
 }
 async function followLogs(opts, dependencies = {
   run: runKernelCommand,
-  pause: (milliseconds) => new Promise((resolve6) => setTimeout(resolve6, milliseconds))
+  pause: (milliseconds) => new Promise((resolve7) => setTimeout(resolve7, milliseconds))
 }) {
   validateLogsOpts(opts);
   await dependencies.run({
@@ -82776,11 +83452,8 @@ Behavior:
   Calls the public Kernel journal syscall and emits its { records, cursor }
   page. Topic selection is exact or prefix-based; cursors and timestamps are
   opaque strings owned by the journal backend. --follow reuses one Client Session
-  and advances only with the returned cursor. Machine follow output is NDJSON:
-  one complete admitted record per line; YAML follow is unsupported.
-
-  Historical event-glob lowering and the application-specific services-domain
-  log buffer are not part of the Kernel V2 journal contract.
+  and advances only with the returned cursor. With --json, follow output is
+  NDJSON with one complete admitted record per line; YAML follow is unsupported.
 
 Examples:
   $ astrale logs -i staging --limit 50
@@ -82814,10 +83487,10 @@ Examples:
 // src/lib/port.ts
 import net from "node:net";
 function portFree(port, host = LOOPBACK) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const srv = net.createServer();
-    srv.once("error", () => resolve6(false));
-    srv.once("listening", () => srv.close(() => resolve6(true)));
+    srv.once("error", () => resolve7(false));
+    srv.once("listening", () => srv.close(() => resolve7(true)));
     srv.listen({ port, host, exclusive: true });
   });
 }
@@ -82859,10 +83532,10 @@ var init_external_open_origins = __esm(() => {
 
 // src/lib/view/session.ts
 import { closeSync, fchmodSync, openSync } from "node:fs";
-import { chmod as chmod3, mkdir as mkdir9, readdir as readdir2, readFile as readFile12, rm as rm2 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { chmod as chmod3, mkdir as mkdir11, readdir as readdir4, readFile as readFile14, rm as rm4 } from "node:fs/promises";
+import { join as join13 } from "node:path";
 async function ensureViewDirectory(directory = VIEW_DIR) {
-  await mkdir9(directory, { recursive: true, mode: 448 });
+  await mkdir11(directory, { recursive: true, mode: 448 });
   await chmod3(directory, 448);
 }
 async function saveRecord(record12, directory = VIEW_DIR) {
@@ -82888,9 +83561,9 @@ async function openSessionLog(id, directory = VIEW_DIR) {
 }
 async function removeSessionFiles(id, directory = VIEW_DIR) {
   await Promise.all([
-    rm2(recordPath(id, directory), { force: true }),
-    rm2(configPath(id, directory), { force: true }),
-    rm2(logPath(id, directory), { force: true })
+    rm4(recordPath(id, directory), { force: true }),
+    rm4(configPath(id, directory), { force: true }),
+    rm4(logPath(id, directory), { force: true })
   ]);
 }
 function isAlive(pid) {
@@ -82904,7 +83577,7 @@ function isAlive(pid) {
 async function listSessions() {
   let entries;
   try {
-    entries = await readdir2(VIEW_DIR);
+    entries = await readdir4(VIEW_DIR);
   } catch {
     return [];
   }
@@ -82914,7 +83587,7 @@ async function listSessions() {
       continue;
     let record12;
     try {
-      record12 = JSON.parse(await readFile12(join11(VIEW_DIR, entry2), "utf8"));
+      record12 = JSON.parse(await readFile14(join13(VIEW_DIR, entry2), "utf8"));
     } catch {
       continue;
     }
@@ -82932,7 +83605,7 @@ async function closeSession(record12) {
     } catch {}
     const deadline = Date.now() + CLOSE_GRACE_MS;
     while (isAlive(record12.pid) && Date.now() < deadline) {
-      await new Promise((resolve6) => setTimeout(resolve6, 100));
+      await new Promise((resolve7) => setTimeout(resolve7, 100));
     }
     if (isAlive(record12.pid)) {
       try {
@@ -82942,14 +83615,14 @@ async function closeSession(record12) {
   }
   await removeSessionFiles(record12.id);
 }
-var VIEW_DIR, recordPath = (id, directory = VIEW_DIR) => join11(directory, `${id}.json`), logPath = (id, directory = VIEW_DIR) => join11(directory, `${id}.log`), configPath = (id, directory = VIEW_DIR) => join11(directory, `${id}.config.json`), CLOSE_GRACE_MS = 2000;
+var VIEW_DIR, recordPath = (id, directory = VIEW_DIR) => join13(directory, `${id}.json`), logPath = (id, directory = VIEW_DIR) => join13(directory, `${id}.log`), configPath = (id, directory = VIEW_DIR) => join13(directory, `${id}.config.json`), CLOSE_GRACE_MS = 2000;
 var init_session5 = __esm(() => {
   init_state();
-  VIEW_DIR = join11(paths2.home, "view");
+  VIEW_DIR = join13(paths2.home, "view");
 });
 
 // src/lib/view/port-allocation.ts
-import { join as join12 } from "node:path";
+import { join as join14 } from "node:path";
 function withViewPortAllocationLock(fn, lockPath = VIEW_PORT_LOCK) {
   return withFileLock(lockPath, fn);
 }
@@ -82957,7 +83630,7 @@ var VIEW_PORT_LOCK;
 var init_port_allocation = __esm(() => {
   init_state();
   init_session5();
-  VIEW_PORT_LOCK = join12(VIEW_DIR, "ports.lock");
+  VIEW_PORT_LOCK = join14(VIEW_DIR, "ports.lock");
 });
 
 // src/lib/view/resolve.ts
@@ -83027,33 +83700,33 @@ var init_resolve2 = __esm(() => {
 // src/lib/view/assets.ts
 import { existsSync as existsSync5, statSync } from "node:fs";
 import { copyFile as copyFile2 } from "node:fs/promises";
-import { dirname as dirname9, join as join13 } from "node:path";
+import { dirname as dirname11, join as join15 } from "node:path";
 import { fileURLToPath } from "node:url";
 function viewerDistDir(moduleUrl = import.meta.url, entry2 = process.argv[1] ?? ".", executable = process.execPath) {
   const override = process.env.ASTRALE_VIEWER_DIR;
   if (override)
     return override;
-  const moduleDirectory = dirname9(fileURLToPath(moduleUrl));
-  const published = join13(moduleDirectory, "..", "viewer", "dist");
-  const source2 = join13(moduleDirectory, "..", "..", "..", "viewer", "dist");
-  const legacy = join13(dirname9(entry2), "..", "viewer", "dist");
-  const standalone = entry2.startsWith("/$bunfs/") ? join13(dirname9(executable), "viewer", "dist") : undefined;
+  const moduleDirectory = dirname11(fileURLToPath(moduleUrl));
+  const published = join15(moduleDirectory, "..", "viewer", "dist");
+  const source2 = join15(moduleDirectory, "..", "..", "..", "viewer", "dist");
+  const legacy = join15(dirname11(entry2), "..", "viewer", "dist");
+  const standalone = entry2.startsWith("/$bunfs/") ? join15(dirname11(executable), "viewer", "dist") : undefined;
   const complete = [standalone, published, source2, legacy].find((candidate2) => candidate2 !== undefined && hasViewerBundle(candidate2));
   if (complete)
     return complete;
-  if (hasViewerSource(join13(source2, "..")))
+  if (hasViewerSource(join15(source2, "..")))
     return source2;
   return published;
 }
 async function ensureViewerAssets(moduleUrl = import.meta.url, entry2 = process.argv[1] ?? ".") {
   const dist = viewerDistDir(moduleUrl, entry2);
-  const srcDir = join13(dist, "..");
+  const srcDir = join15(dist, "..");
   if (hasViewerBundle(dist) && !viewerSourceIsNewer(srcDir, dist))
     return dist;
   const bun = globalThis.Bun;
   if (bun && hasViewerSource(srcDir)) {
     const result = await bun.build({
-      entrypoints: [join13(srcDir, "main.ts")],
+      entrypoints: [join15(srcDir, "main.ts")],
       outdir: dist,
       target: "browser",
       minify: false
@@ -83061,32 +83734,32 @@ async function ensureViewerAssets(moduleUrl = import.meta.url, entry2 = process.
     if (!result.success)
       throw new Error(`viewer build failed: ${result.logs.join(`
 `)}`);
-    await copyFile2(join13(srcDir, "index.html"), join13(dist, "index.html"));
+    await copyFile2(join15(srcDir, "index.html"), join15(dist, "index.html"));
     return dist;
   }
   throw new Error(`viewer bundle missing at ${dist} — reinstall the CLI (or run \`bun scripts/build.ts\` in a dev checkout)`);
 }
 function hasViewerBundle(directory) {
-  return existsSync5(join13(directory, "main.js")) && existsSync5(join13(directory, "index.html"));
+  return existsSync5(join15(directory, "main.js")) && existsSync5(join15(directory, "index.html"));
 }
 function hasViewerSource(directory) {
-  return existsSync5(join13(directory, "main.ts")) && existsSync5(join13(directory, "index.html"));
+  return existsSync5(join15(directory, "main.ts")) && existsSync5(join15(directory, "index.html"));
 }
 function viewerSourceIsNewer(source2, dist) {
   if (!hasViewerSource(source2))
     return false;
   if (!hasViewerBundle(dist))
     return true;
-  const newestSource = Math.max(statSync(join13(source2, "main.ts")).mtimeMs, statSync(join13(source2, "index.html")).mtimeMs);
-  const oldestOutput = Math.min(statSync(join13(dist, "main.js")).mtimeMs, statSync(join13(dist, "index.html")).mtimeMs);
+  const newestSource = Math.max(statSync(join15(source2, "main.ts")).mtimeMs, statSync(join15(source2, "index.html")).mtimeMs);
+  const oldestOutput = Math.min(statSync(join15(dist, "main.js")).mtimeMs, statSync(join15(dist, "index.html")).mtimeMs);
   return newestSource > oldestOutput;
 }
 var init_assets = () => {};
 
 // src/lib/view/server.ts
-import { readFile as readFile13 } from "node:fs/promises";
+import { readFile as readFile15 } from "node:fs/promises";
 import { createServer } from "node:http";
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 import { Readable } from "node:stream";
 function startViewServer(config2) {
   const { session: session3, proxy } = config2;
@@ -83134,11 +83807,11 @@ function startViewServer(config2) {
       return;
     }
     if (sub === "/" || sub === "/index.html") {
-      await serveAsset(res, join14(hostDir, "index.html"), "text/html; charset=utf-8");
+      await serveAsset(res, join16(hostDir, "index.html"), "text/html; charset=utf-8");
       return;
     }
     if (sub === "/main.js") {
-      await serveAsset(res, join14(hostDir, "main.js"), "text/javascript; charset=utf-8");
+      await serveAsset(res, join16(hostDir, "main.js"), "text/javascript; charset=utf-8");
       return;
     }
     if (sub === "/config.json" && req.method === "GET") {
@@ -83258,7 +83931,7 @@ function json3(res, code, body) {
 }
 async function serveAsset(res, file2, contentType) {
   try {
-    const content = await readFile13(file2);
+    const content = await readFile15(file2);
     res.writeHead(200, { "content-type": contentType, "cache-control": "no-store" });
     res.end(content);
   } catch {
@@ -83350,7 +84023,7 @@ var SETTLE_TIMEOUT_MS = 8000, QUIET_WINDOW_MS = 750, POLL_MS = 250, realClock, d
 var init_snapshot = __esm(() => {
   realClock = {
     now: Date.now,
-    sleep: (ms) => new Promise((resolve6) => setTimeout(resolve6, ms))
+    sleep: (ms) => new Promise((resolve7) => setTimeout(resolve7, ms))
   };
   defaultPolicy = {
     timeoutMs: SETTLE_TIMEOUT_MS,
@@ -83374,8 +84047,8 @@ __export(exports_view3, {
 });
 import { randomBytes } from "node:crypto";
 import { closeSync as closeSync2, existsSync as existsSync6, statSync as statSync2 } from "node:fs";
-import { readdir as readdir3, readFile as readFile14 } from "node:fs/promises";
-import { dirname as dirname10, join as join15 } from "node:path";
+import { readdir as readdir5, readFile as readFile16 } from "node:fs/promises";
+import { dirname as dirname12, join as join17 } from "node:path";
 async function resolveSession(spec, opts) {
   rejectUnrepresentableOverrides(opts);
   const parsed = parseViewSpec(spec);
@@ -83430,7 +84103,7 @@ async function resolveServeRuntime(environment = {}) {
   if (node4 && entry2?.endsWith(".js") && exists(entry2))
     return { file: node4, args: [entry2] };
   if (node4 && entry2?.endsWith(".ts")) {
-    const dist = join15(dirname10(entry2), "..", "dist", "astrale.js");
+    const dist = join17(dirname12(entry2), "..", "dist", "astrale.js");
     await ensureDevDist(entry2, dist);
     if (exists(dist))
       return { file: node4, args: [dist] };
@@ -83456,8 +84129,8 @@ async function findOnPath(name) {
 async function ensureDevDist(entry2, dist) {
   if (!await devDistIsStale(entry2, dist))
     return;
-  const projectDir = join15(dirname10(entry2), "..");
-  const buildScript = join15(projectDir, "scripts", "build.ts");
+  const projectDir = join17(dirname12(entry2), "..");
+  const buildScript = join17(projectDir, "scripts", "build.ts");
   const bun = await findOnPath("bun");
   if (!bun || !existsSync6(buildScript))
     return;
@@ -83473,13 +84146,13 @@ async function ensureDevDist(entry2, dist) {
 async function devDistIsStale(entry2, dist) {
   if (!existsSync6(dist))
     return true;
-  const projectDir = join15(dirname10(entry2), "..");
+  const projectDir = join17(dirname12(entry2), "..");
   const builtAt = statSync2(dist).mtimeMs;
-  const directories = [join15(projectDir, "src"), join15(projectDir, "bin"), join15(projectDir, "vendor")];
+  const directories = [join17(projectDir, "src"), join17(projectDir, "bin"), join17(projectDir, "vendor")];
   const files = [
-    join15(projectDir, "scripts", "build.ts"),
-    join15(projectDir, "package.json"),
-    join15(projectDir, "pnpm-lock.yaml")
+    join17(projectDir, "scripts", "build.ts"),
+    join17(projectDir, "package.json"),
+    join17(projectDir, "pnpm-lock.yaml")
   ];
   for (const directory of directories) {
     if (existsSync6(directory) && await newerThan(directory, builtAt))
@@ -83488,11 +84161,11 @@ async function devDistIsStale(entry2, dist) {
   return files.some((file2) => existsSync6(file2) && statSync2(file2).mtimeMs > builtAt);
 }
 async function newerThan(dir, mtimeMs) {
-  const entries = await readdir3(dir, { withFileTypes: true, recursive: true });
+  const entries = await readdir5(dir, { withFileTypes: true, recursive: true });
   for (const item of entries) {
     if (!item.isFile())
       continue;
-    if (statSync2(join15(item.parentPath, item.name)).mtimeMs > mtimeMs)
+    if (statSync2(join17(item.parentPath, item.name)).mtimeMs > mtimeMs)
       return true;
   }
   return false;
@@ -83570,7 +84243,7 @@ async function startSessionLocked(view2, opts, kernelTarget, activeInstance, def
       break;
     await sleep2(POLL_MS2);
   }
-  const tail = await readFile14(logPath(id), "utf8").catch(() => "");
+  const tail = await readFile16(logPath(id), "utf8").catch(() => "");
   await closeSession(live);
   throw new Error(`View session server did not come up.${tail ? `
 --- server log ---
@@ -83705,7 +84378,7 @@ async function sessionsCommand(opts) {
     console.log(`${source_default.bold(s.id)}  /:${s.view.route.key}  target ${s.view.target}  ${source_default.dim(s.pageUrl)}`);
   }
 }
-var VIEW_PORT_BASE = 4419, VIEW_PORT_SPAN = 20, IDLE_MS, READY_TIMEOUT_MS = 8000, STATE_TIMEOUT_MS = 25000, POLL_MS2 = 250, VIEW_PROFILE, sleep2 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)), view_default;
+var VIEW_PORT_BASE = 4419, VIEW_PORT_SPAN = 20, IDLE_MS, READY_TIMEOUT_MS = 8000, STATE_TIMEOUT_MS = 25000, POLL_MS2 = 250, VIEW_PROFILE, sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)), view_default;
 var init_view7 = __esm(() => {
   init_source();
   init_connection2();
@@ -83844,7 +84517,7 @@ Examples:
       if (state2?.state === "failed") {
         await reportOpened(record12, state2, mode, opts);
         if (opts.debug) {
-          const tail = await readFile14(logPath(record12.id), "utf8").catch(() => "");
+          const tail = await readFile16(logPath(record12.id), "utf8").catch(() => "");
           if (tail)
             console.error(`--- server log ---
 ${tail.slice(-3000)}`);
@@ -83966,7 +84639,7 @@ function reportConnected(session3, machine, opts) {
   console.log(`  agent-browser ${drive} open ${session3.url}`);
   console.log(`  agent-browser ${drive} click @e3`);
 }
-var LOGIN_TIMEOUT_MS = 180000, POLL_INTERVAL_MS = 2500, sleep3 = (ms) => new Promise((resolve6) => setTimeout(resolve6, ms)), browser_default;
+var LOGIN_TIMEOUT_MS = 180000, POLL_INTERVAL_MS = 2500, sleep3 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms)), browser_default;
 var init_browser2 = __esm(() => {
   init_source();
   init_browser();
@@ -84083,7 +84756,7 @@ var exports_view_serve = {};
 __export(exports_view_serve, {
   default: () => view_serve_default
 });
-import { readFile as readFile15 } from "node:fs/promises";
+import { readFile as readFile17 } from "node:fs/promises";
 var view_serve_default;
 var init_view_serve = __esm(() => {
   init_server();
@@ -84095,7 +84768,7 @@ var init_view_serve = __esm(() => {
     action: async (opts) => {
       if (!opts.config)
         throw new Error("--config is required");
-      const config2 = JSON.parse(await readFile15(opts.config, "utf8"));
+      const config2 = JSON.parse(await readFile17(opts.config, "utf8"));
       startViewServer(config2);
       console.log(`view session ${config2.session.id} listening on ${config2.session.pageUrl}`);
       await new Promise(() => {});
@@ -84110,7 +84783,7 @@ __export(exports_studio, {
   encodeStudioCliDescriptor: () => encodeStudioCliDescriptor
 });
 import { existsSync as existsSync8, realpathSync } from "node:fs";
-import { dirname as dirname11, join as join16, resolve as resolve6 } from "node:path";
+import { dirname as dirname13, join as join18, resolve as resolve7 } from "node:path";
 function encodeStudioCliDescriptor(executable = process.execPath, entry2 = process.argv[1]) {
   const args = entry2 && entry2 !== executable && !entry2.startsWith("/$bunfs") && existsSync8(entry2) ? [realpathSync(entry2)] : [];
   return JSON.stringify({ version: 1, executable, args });
@@ -84120,22 +84793,22 @@ function resolveStudioDir() {
   if (process.env.ASTRALE_STUDIO_DIR)
     candidates.push(process.env.ASTRALE_STUDIO_DIR);
   try {
-    const entryDir = dirname11(realpathSync(process.argv[1] ?? ""));
-    candidates.push(join16(entryDir, "..", "studio"), join16(entryDir, "studio"));
+    const entryDir = dirname13(realpathSync(process.argv[1] ?? ""));
+    candidates.push(join18(entryDir, "..", "studio"), join18(entryDir, "studio"));
   } catch {}
   for (const c of candidates) {
-    if (existsSync8(join16(c, "server", "index.ts")))
-      return resolve6(c);
+    if (existsSync8(join18(c, "server", "index.ts")))
+      return resolve7(c);
   }
   throw new Error(`Domain Studio assets not found (looked in: ${candidates.join(", ") || "<none>"}). ` + `Reinstall the astrale CLI, or set ASTRALE_STUDIO_DIR to a studio checkout.`);
 }
 function isDevSource(studioDir) {
-  return existsSync8(join16(studioDir, "vite.config.ts")) && existsSync8(join16(studioDir, "client", "src"));
+  return existsSync8(join18(studioDir, "vite.config.ts")) && existsSync8(join18(studioDir, "client", "src"));
 }
 function resolveViteBin(studioDir) {
   for (const c of [
-    join16(studioDir, "node_modules", ".bin", "vite"),
-    join16(studioDir, "..", "..", "node_modules", ".bin", "vite")
+    join18(studioDir, "node_modules", ".bin", "vite"),
+    join18(studioDir, "..", "..", "node_modules", ".bin", "vite")
   ]) {
     if (existsSync8(c))
       return c;
@@ -84256,11 +84929,11 @@ Examples:
 `,
     action: async (pathArg, opts) => {
       try {
-        const workspace = resolve6(pathArg ?? process.cwd());
+        const workspace = resolve7(pathArg ?? process.cwd());
         if (!existsSync8(workspace))
           throw new Error(`path not found: ${workspace}`);
         const studioDir = resolveStudioDir();
-        if (process.env.ASTRALE_STUDIO_DIR && studioDir === resolve6(process.env.ASTRALE_STUDIO_DIR)) {
+        if (process.env.ASTRALE_STUDIO_DIR && studioDir === resolve7(process.env.ASTRALE_STUDIO_DIR)) {
           log.dim(`  using ASTRALE_STUDIO_DIR=${studioDir}`);
         }
         await ensureBun();
@@ -84360,8 +85033,8 @@ Examples:
             }
           }), "server");
         } else {
-          const dist = join16(studioDir, "client", "dist");
-          if (!existsSync8(join16(dist, "index.html"))) {
+          const dist = join18(studioDir, "client", "dist");
+          if (!existsSync8(join18(dist, "index.html"))) {
             throw new Error(`studio client not built at ${dist} — run: pnpm --filter @astrale-os/studio build`);
           }
           serverChild = supervise(spawnHandle("bun", ["server/index.ts", workspace, "--port", String(studioPort), "--no-open"], {
@@ -84414,10 +85087,10 @@ var init_model7 = __esm(() => {
 });
 
 // src/ui/lock.ts
-import { createHash as createHash2 } from "node:crypto";
-import { readFile as readFile16 } from "node:fs/promises";
+import { createHash as createHash3 } from "node:crypto";
+import { readFile as readFile18 } from "node:fs/promises";
 function digest5(value3) {
-  return createHash2("sha256").update(value3).digest("hex");
+  return createHash3("sha256").update(value3).digest("hex");
 }
 function parseUiLock(value3) {
   const lock = value3;
@@ -84453,14 +85126,14 @@ function pathIsAbsolute(value3) {
 }
 async function readUiLock(target2) {
   try {
-    return parseUiLock(JSON.parse(await readFile16(target2, "utf8")));
+    return parseUiLock(JSON.parse(await readFile18(target2, "utf8")));
   } catch (cause) {
     if (cause instanceof UiError)
       throw cause;
     throw new UiError("UI_CONFIG_MISSING", "Unable to read " + UI_LOCK_FILE + ".", "Run astrale ui init.", { cause });
   }
 }
-var init_lock = __esm(() => {
+var init_lock2 = __esm(() => {
   init_model7();
 });
 
@@ -86484,14 +87157,14 @@ var require_lib5 = __commonJS(function(exports) {
 });
 
 // src/ui/project.ts
-import { access as access2, lstat, readFile as readFile17, realpath as realpath2 } from "node:fs/promises";
+import { access as access2, lstat as lstat3, readFile as readFile19, realpath as realpath2 } from "node:fs/promises";
 import path5 from "node:path";
 async function exists(target2) {
   return access2(target2).then(() => true, () => false);
 }
 async function readManifest(target2) {
   try {
-    return JSON.parse(await readFile17(target2, "utf8"));
+    return JSON.parse(await readFile19(target2, "utf8"));
   } catch (cause) {
     throw new UiError("UI_PROJECT_UNSUPPORTED", "package.json is not valid JSON.", undefined, {
       cause
@@ -86561,7 +87234,7 @@ async function resolveAlias(project2, candidate2) {
 async function resolveUiRegistryTarget(project2, declaredTarget) {
   if (!declaredTarget.startsWith("components/"))
     return declaredTarget;
-  const components = await readFile17(project2.componentsPath, "utf8").then((value3) => JSON.parse(value3)).catch(() => {
+  const components = await readFile19(project2.componentsPath, "utf8").then((value3) => JSON.parse(value3)).catch(() => {
     return;
   });
   const componentsAlias = components?.aliases?.components;
@@ -86573,11 +87246,11 @@ async function resolveUiRegistryTarget(project2, declaredTarget) {
   if (!resolved) {
     throw new UiError("UI_PROJECT_UNSUPPORTED", "components.json alias cannot be resolved through tsconfig.json or jsconfig.json.", "Define a matching compilerOptions.paths entry for " + componentsAlias + ".");
   }
-  const relative = path5.relative(project2.root, path5.join(resolved, suffix));
-  if (relative === ".." || relative.startsWith(".." + path5.sep) || path5.isAbsolute(relative)) {
+  const relative2 = path5.relative(project2.root, path5.join(resolved, suffix));
+  if (relative2 === ".." || relative2.startsWith(".." + path5.sep) || path5.isAbsolute(relative2)) {
     throw new UiError("UI_PROJECT_UNSUPPORTED", "components.json alias escapes the project.");
   }
-  return relative.split(path5.sep).join("/");
+  return relative2.split(path5.sep).join("/");
 }
 function hasReactTailwind(manifest) {
   const dependencies = {
@@ -86597,8 +87270,8 @@ async function assertPhysicalProjectPath(root, target2) {
     existing = parent;
   }
   const physicalTarget = await realpath2(existing);
-  const relative = path5.relative(physicalRoot, physicalTarget);
-  if (relative === ".." || relative.startsWith(".." + path5.sep) || path5.isAbsolute(relative)) {
+  const relative2 = path5.relative(physicalRoot, physicalTarget);
+  if (relative2 === ".." || relative2.startsWith(".." + path5.sep) || path5.isAbsolute(relative2)) {
     throw new UiError("UI_PROJECT_UNSUPPORTED", "components.json CSS path escapes the project.");
   }
 }
@@ -86607,7 +87280,7 @@ async function discoverUiProject(input = process.cwd()) {
   if (!await exists(root)) {
     throw new UiError("UI_PROJECT_UNSUPPORTED", "Project path does not exist: " + root);
   }
-  if (!(await lstat(root)).isDirectory())
+  if (!(await lstat3(root)).isDirectory())
     root = path5.dirname(root);
   while (true) {
     const manifestPath = path5.join(root, "package.json");
@@ -86663,17 +87336,17 @@ async function discoverUiProject(input = process.cwd()) {
     "frontend/src/styles.css"
   ];
   const componentsPath = path5.join(root, "components.json");
-  const configuredCss = await readFile17(componentsPath, "utf8").then((value3) => {
+  const configuredCss = await readFile19(componentsPath, "utf8").then((value3) => {
     const components = JSON.parse(value3);
     const css = components.tailwind?.css;
     if (typeof css !== "string" || css.length === 0)
       return;
     const target2 = path5.resolve(root, css);
-    const relative = path5.relative(root, target2);
-    if (relative === ".." || relative.startsWith(".." + path5.sep) || path5.isAbsolute(relative)) {
+    const relative2 = path5.relative(root, target2);
+    if (relative2 === ".." || relative2.startsWith(".." + path5.sep) || path5.isAbsolute(relative2)) {
       throw new UiError("UI_PROJECT_UNSUPPORTED", "components.json CSS path escapes the project.");
     }
-    return { relative: relative.split(path5.sep).join("/"), target: target2 };
+    return { relative: relative2.split(path5.sep).join("/"), target: target2 };
   }).catch((error52) => {
     if (error52 instanceof UiError)
       throw error52;
@@ -86712,11 +87385,11 @@ function assertSupportedUiProject(project2) {
   }
 }
 function projectRelative(project2, target2) {
-  const relative = path5.relative(project2.root, target2);
-  if (relative === "" || relative === ".." || relative.startsWith(".." + path5.sep) || path5.isAbsolute(relative)) {
+  const relative2 = path5.relative(project2.root, target2);
+  if (relative2 === "" || relative2 === ".." || relative2.startsWith(".." + path5.sep) || path5.isAbsolute(relative2)) {
     throw new UiError("UI_LOCK_INVALID", "Path escapes the project root: " + target2);
   }
-  return relative.split(path5.sep).join("/");
+  return relative2.split(path5.sep).join("/");
 }
 var import_tsconfig_paths, MANAGERS;
 var init_project3 = __esm(() => {
@@ -86971,13 +87644,13 @@ var init_runner = __esm(() => {
 });
 
 // src/ui/operations.ts
-import { access as access3, lstat as lstat2, mkdir as mkdir10, readFile as readFile18, realpath as realpath3, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
+import { access as access3, lstat as lstat4, mkdir as mkdir12, readFile as readFile20, realpath as realpath3, rm as rm5, writeFile as writeFile8 } from "node:fs/promises";
 import path6 from "node:path";
 async function exists2(target2) {
   return access3(target2).then(() => true, () => false);
 }
 async function readOptional(target2) {
-  return readFile18(target2, "utf8").catch(() => {
+  return readFile20(target2, "utf8").catch(() => {
     return;
   });
 }
@@ -86993,10 +87666,10 @@ function admitLocalThemeCss(source2, slug) {
   }
 }
 function themeImport(project2, target2) {
-  let relative = path6.relative(path6.dirname(project2.cssPath), target2).split(path6.sep).join("/");
-  if (!relative.startsWith("."))
-    relative = "./" + relative;
-  return "@import '" + relative + "';";
+  let relative2 = path6.relative(path6.dirname(project2.cssPath), target2).split(path6.sep).join("/");
+  if (!relative2.startsWith("."))
+    relative2 = "./" + relative2;
+  return "@import '" + relative2 + "';";
 }
 function activateTheme(current, statement) {
   const lines = current.split(/\r?\n/u).filter((line) => !/^@import\s+['"][^'"]*components\/astrale\/theme\/[a-z][a-z0-9-]*\.css['"];?\s*$/u.test(line));
@@ -87067,7 +87740,7 @@ async function appendPnpmWorkspace(project2, workspace) {
   const target2 = pnpmWorkspacePath(project2);
   const source2 = await readOptional(target2);
   if (source2 === undefined) {
-    await writeFile6(target2, `packages:
+    await writeFile8(target2, `packages:
   - '` + workspace + `'
 `, "utf8");
     return;
@@ -87086,12 +87759,12 @@ async function appendPnpmWorkspace(project2, workspace) {
   }
   if (!values.includes(workspace))
     packages.add(workspace);
-  await writeFile6(target2, String(document), "utf8");
+  await writeFile8(target2, String(document), "utf8");
 }
 async function hasDomainRegistryWorkspace(project2) {
   if (!project2.isAstraleDomain || !await exists2(domainRegistryPackagePath(project2)))
     return false;
-  const registryManifest = JSON.parse(await readFile18(domainRegistryPackagePath(project2), "utf8"));
+  const registryManifest = JSON.parse(await readFile20(domainRegistryPackagePath(project2), "utf8"));
   if (registryManifest.private !== true || typeof registryManifest.name !== "string" || registryManifest.name === UI_PACKAGE || registryManifest.name === project2.packageJson.name) {
     return false;
   }
@@ -87211,8 +87884,8 @@ async function initUi(options, dependencies = {}) {
       "@import '" + UI_PACKAGE + "/presets/" + preset + ".css';"
     ];
     const withoutAstrale = currentCss.replace(/^@import\s+['"]@astrale-os\/ui\/(?:theme\.css|presets\/[a-z-]+\.css)['"];?\s*$/gmu, "").trimStart();
-    await mkdir10(path6.dirname(project2.cssPath), { recursive: true });
-    await writeFile6(project2.cssPath, imports.join(`
+    await mkdir12(path6.dirname(project2.cssPath), { recursive: true });
+    await writeFile8(project2.cssPath, imports.join(`
 `) + `
 
 ` + withoutAstrale, "utf8");
@@ -87269,15 +87942,15 @@ async function initUi(options, dependencies = {}) {
   } catch (error52) {
     for (const [target2, value3] of snapshots) {
       if (value3 !== undefined)
-        await writeFile6(target2, value3, "utf8");
+        await writeFile8(target2, value3, "utf8");
       else
-        await rm3(target2, { force: true });
+        await rm5(target2, { force: true });
     }
     throw error52;
   }
 }
 async function pinUiDependency(project2, version2, section, runner) {
-  const manifest = JSON.parse(await readFile18(project2.packageJsonPath, "utf8"));
+  const manifest = JSON.parse(await readFile20(project2.packageJsonPath, "utf8"));
   const current = manifestDependencies(manifest, section)[UI_PACKAGE];
   const other = section === "dependencies" ? "devDependencies" : "dependencies";
   if (current === version2 && manifestDependencies(manifest, other)[UI_PACKAGE] === undefined)
@@ -87316,7 +87989,7 @@ async function lockedRelease(project2, fetcher) {
 }
 async function addLocalTheme(address, project2, options) {
   const sourcePath = path6.resolve(project2.root, address);
-  const sourceInfo = await lstat2(sourcePath).catch(() => {
+  const sourceInfo = await lstat4(sourcePath).catch(() => {
     return;
   });
   if (!sourceInfo?.isFile() || sourceInfo.isSymbolicLink()) {
@@ -87326,7 +87999,7 @@ async function addLocalTheme(address, project2, options) {
   if (!THEME_SLUG.test(slug)) {
     throw new UiError("UI_ITEM_CONFLICT", "Local theme filename must be a kebab-case theme name.", "Rename it to a name such as observatory.css.");
   }
-  const source2 = await readFile18(sourcePath, "utf8");
+  const source2 = await readFile20(sourcePath, "utf8");
   admitLocalThemeCss(source2, slug);
   return installThemeCss(slug, source2, digest5(source2), address, project2, options);
 }
@@ -87361,10 +88034,10 @@ async function installThemeCss(slug, source2, sourceDigest, sourceLabel, project
     snapshots.set(mutation, await readOptional(mutation));
   }
   try {
-    await mkdir10(path6.dirname(target2), { recursive: true });
-    await writeFile6(target2, source2, "utf8");
+    await mkdir12(path6.dirname(target2), { recursive: true });
+    await writeFile8(target2, source2, "utf8");
     const css = await readOptional(project2.cssPath) ?? "";
-    await writeFile6(project2.cssPath, activateTheme(css, statement), "utf8");
+    await writeFile8(project2.cssPath, activateTheme(css, statement), "utf8");
     lock.items[canonicalAddress] = {
       address: canonicalAddress,
       sourceDigest,
@@ -87375,9 +88048,9 @@ async function installThemeCss(slug, source2, sourceDigest, sourceLabel, project
   } catch (error52) {
     for (const [mutation, previous] of snapshots) {
       if (previous === undefined)
-        await rm3(mutation, { force: true });
+        await rm5(mutation, { force: true });
       else
-        await writeFile6(mutation, previous, "utf8");
+        await writeFile8(mutation, previous, "utf8");
     }
     throw error52;
   }
@@ -87464,15 +88137,15 @@ async function addUi(addresses, options, dependencies = {}) {
       if (themeTarget) {
         const target2 = await safeTarget(project2, themeTarget);
         const css = await readOptional(project2.cssPath) ?? "";
-        await writeFile6(project2.cssPath, activateTheme(css, themeImport(project2, target2)), "utf8");
+        await writeFile8(project2.cssPath, activateTheme(css, themeImport(project2, target2)), "utf8");
       }
     }
   } catch (error52) {
     for (const [target2, previous] of snapshots) {
       if (previous === undefined)
-        await rm3(target2, { force: true });
+        await rm5(target2, { force: true });
       else
-        await writeFile6(target2, previous, "utf8");
+        await writeFile8(target2, previous, "utf8");
     }
     throw error52;
   }
@@ -87501,7 +88174,7 @@ async function addUi(addresses, options, dependencies = {}) {
         if (!file2.target)
           continue;
         const target2 = await safeTarget(project2, resolvedTargets.get(file2.target));
-        files[projectRelative(project2, target2)] = digest5(await readFile18(target2));
+        files[projectRelative(project2, target2)] = digest5(await readFile20(target2));
       }
       lock.items[item.meta.canonicalAddress] = {
         address: item.meta.canonicalAddress,
@@ -87513,9 +88186,9 @@ async function addUi(addresses, options, dependencies = {}) {
   } catch (error52) {
     for (const [target2, previous] of snapshots) {
       if (previous === undefined)
-        await rm3(target2, { force: true });
+        await rm5(target2, { force: true });
       else
-        await writeFile6(target2, previous, "utf8");
+        await writeFile8(target2, previous, "utf8");
     }
     throw error52;
   }
@@ -87533,7 +88206,7 @@ async function doctorUi(input) {
   const checks3 = [];
   let lock;
   try {
-    lock = parseUiLock(JSON.parse(await readFile18(project2.uiLockPath, "utf8")));
+    lock = parseUiLock(JSON.parse(await readFile20(project2.uiLockPath, "utf8")));
     checks3.push({ check: "lock", ok: true });
   } catch (error52) {
     checks3.push({
@@ -87561,7 +88234,7 @@ async function doctorUi(input) {
   if (lock) {
     for (const item of Object.values(lock.items)) {
       for (const [file2, expected] of Object.entries(item.files)) {
-        const actual = await readFile18(path6.join(project2.root, file2)).then(digest5).catch(() => "");
+        const actual = await readFile20(path6.join(project2.root, file2)).then(digest5).catch(() => "");
         checks3.push({ check: "item:" + item.address + ":" + file2, ok: actual === expected });
       }
     }
@@ -87586,7 +88259,7 @@ async function applyPreset(preset, options) {
     throw new UiError("UI_CONFIG_MISSING", "No Astrale preset import was found.");
   }
   if (!options.dryRun) {
-    await writeFile6(project2.cssPath, next, "utf8");
+    await writeFile8(project2.cssPath, next, "utf8");
     lock.preset = preset;
     await writeJson(project2.uiLockPath, lock);
   }
@@ -87614,34 +88287,34 @@ async function rejectLocalChanges(project2, lock, items, overwrite) {
     if (!installed)
       continue;
     for (const [file2, expected] of Object.entries(installed.files)) {
-      const actual = await readFile18(path6.join(project2.root, file2)).then(digest5).catch(() => "");
+      const actual = await readFile20(path6.join(project2.root, file2)).then(digest5).catch(() => "");
       if (actual !== expected) {
         throw new UiError("UI_LOCAL_CHANGES", "Installed UI file has local changes: " + file2, "Review the file, then repeat add with explicit --overwrite --yes.");
       }
     }
   }
 }
-async function safeTarget(project2, relative) {
-  if (path6.isAbsolute(relative) || relative.split(/[\\/]/u).includes("..")) {
-    throw new UiError("UI_LOCK_INVALID", "Unsafe registry target: " + relative);
+async function safeTarget(project2, relative2) {
+  if (path6.isAbsolute(relative2) || relative2.split(/[\\/]/u).includes("..")) {
+    throw new UiError("UI_LOCK_INVALID", "Unsafe registry target: " + relative2);
   }
-  const target2 = path6.resolve(project2.root, relative);
+  const target2 = path6.resolve(project2.root, relative2);
   projectRelative(project2, target2);
   const parent = await realpath3(path6.dirname(target2));
   const root = await realpath3(project2.root);
   if (parent !== root && !parent.startsWith(root + path6.sep)) {
-    throw new UiError("UI_LOCK_INVALID", "Registry target escapes through a symlink: " + relative);
+    throw new UiError("UI_LOCK_INVALID", "Registry target escapes through a symlink: " + relative2);
   }
-  if (await exists2(target2) && (await lstat2(target2)).isSymbolicLink()) {
-    throw new UiError("UI_LOCK_INVALID", "Registry target is a symlink: " + relative);
+  if (await exists2(target2) && (await lstat4(target2)).isSymbolicLink()) {
+    throw new UiError("UI_LOCK_INVALID", "Registry target is a symlink: " + relative2);
   }
   return target2;
 }
-async function assertSafePlannedTarget(project2, relative) {
-  if (path6.isAbsolute(relative) || relative.split(/[\\/]/u).includes("..")) {
-    throw new UiError("UI_LOCK_INVALID", "Unsafe registry target: " + relative);
+async function assertSafePlannedTarget(project2, relative2) {
+  if (path6.isAbsolute(relative2) || relative2.split(/[\\/]/u).includes("..")) {
+    throw new UiError("UI_LOCK_INVALID", "Unsafe registry target: " + relative2);
   }
-  const target2 = path6.resolve(project2.root, relative);
+  const target2 = path6.resolve(project2.root, relative2);
   projectRelative(project2, target2);
   const root = await realpath3(project2.root);
   const physicalTarget = path6.resolve(root, path6.relative(project2.root, target2));
@@ -87650,21 +88323,21 @@ async function assertSafePlannedTarget(project2, relative) {
     current = path6.join(current, segment);
     if (!await exists2(current))
       break;
-    if ((await lstat2(current)).isSymbolicLink()) {
-      throw new UiError("UI_LOCK_INVALID", "Registry target traverses a symlink: " + relative);
+    if ((await lstat4(current)).isSymbolicLink()) {
+      throw new UiError("UI_LOCK_INVALID", "Registry target traverses a symlink: " + relative2);
     }
   }
   return target2;
 }
 async function writeJson(target2, value3) {
-  await mkdir10(path6.dirname(target2), { recursive: true });
-  await writeFile6(target2, JSON.stringify(value3, null, 2) + `
+  await mkdir12(path6.dirname(target2), { recursive: true });
+  await writeFile8(target2, JSON.stringify(value3, null, 2) + `
 `, "utf8");
 }
 var LOCAL_THEME_MAX_BYTES = 131072, THEME_SLUG, REQUIRED_THEME_TOKENS;
 var init_operations3 = __esm(() => {
   init_dist();
-  init_lock();
+  init_lock2();
   init_model7();
   init_project3();
   init_release();
@@ -89350,7 +90023,7 @@ async function installDirect(target2, opts, dependencies = {}) {
     }
     host = validateInstallUrl(target2);
     operation = opts.operation === undefined ? direct.createOperationId() : direct.acceptOperationId(opts.operation);
-    consentedOrigin = await ensureIdentityOverrideConsent(target2, host, opts.allowIdentityOverride ?? false);
+    consentedOrigin = await ensureIdentityOverrideConsent(target2, host, opts.allowIdentityOverride ?? false, isMachine(opts));
   } catch (e) {
     fatal(e, opts);
   }
@@ -89370,7 +90043,9 @@ async function installDirect(target2, opts, dependencies = {}) {
       log.success(`Domain ${installed.status}: ${installed.origin}@${installed.revision}`);
       log.dim(`  operation:   ${installed.operation}`);
       if (isIdentityOverride(installed.origin, host) && installed.origin !== consentedOrigin) {
-        log.warn(`Installed origin "${installed.origin}" differs from the serving host "${host}" ` + `and was not confirmed before install (the worker Publication was unavailable). ` + `Every ${installed.origin}/* call on this instance now routes to ${host}.`);
+        if (!isMachine(fmtOpts)) {
+          log.warn(`Installed origin "${installed.origin}" differs from the serving host "${host}" ` + `and was not confirmed before install (the worker Publication was unavailable). ` + `Every ${installed.origin}/* call on this instance now routes to ${host}.`);
+        }
       }
     }
   });
@@ -89394,16 +90069,20 @@ function validateInstallUrl(value3) {
 function isIdentityOverride(origin2, host) {
   return origin2.toLowerCase() !== host.toLowerCase();
 }
-async function ensureIdentityOverrideConsent(url3, host, allow) {
+async function ensureIdentityOverrideConsent(url3, host, allow, machine) {
   const origin2 = await probeDeclaredOrigin(url3);
   if (origin2 === undefined) {
-    log.warn(`Could not read a declared origin from ` + `${new URL("/.well-known/astrale/domain.json", url3).href} — ` + `skipping the pre-install identity check (the installed origin is verified after install).`);
+    if (!machine) {
+      log.warn(`Could not read a declared origin from ` + `${new URL("/.well-known/astrale/domain.json", url3).href} — ` + `skipping the pre-install identity check (the installed origin is verified after install).`);
+    }
     return;
   }
   if (!isIdentityOverride(origin2, host))
     return;
   if (allow) {
-    log.warn(`Identity override consented via --allow-identity-override: ${origin2} ← ${host}`);
+    if (!machine) {
+      log.warn(`Identity override consented via --allow-identity-override: ${origin2} ← ${host}`);
+    }
     return origin2;
   }
   const banner = source_default.red.bold("⚠  DANGER — IDENTITY OVERRIDE") + `
@@ -89813,9 +90492,9 @@ __export(exports_register, {
   formatIdentityRegistration: () => formatIdentityRegistration,
   prepareIdentityProvision: () => prepareIdentityProvision
 });
-import { readFile as readFile19 } from "node:fs/promises";
+import { readFile as readFile21 } from "node:fs/promises";
 async function readJwk(path8) {
-  return JSON.parse(await readFile19(path8, "utf8"));
+  return JSON.parse(await readFile21(path8, "utf8"));
 }
 function formatIdentityRegistration(result, format3, machine) {
   output(result, format3);
@@ -89882,10 +90561,9 @@ Behavior:
   its result and stores the same target-bound registration. The callable owns
   authorization; the CLI never receives installed Domain authority.
 
-  Kernel V2 Nodes have opaque identity and no caller-assigned storage path, so
-  the historical --path option no longer exists. The CLI binds the key proof
-  to the exact provision fingerprint and target Kernel audience, then caches
-  the returned (issuer, subject) for subsequent calls.
+  The Kernel assigns each Node ID; callers do not choose a storage path. The
+  CLI binds the key proof to the exact provision fingerprint and target Kernel
+  audience, then caches the returned (issuer, subject) for subsequent calls.
 
 Example:
   $ astrale identity register alice --class /:accounts.example:class.User       --props '{"accounts.example:class.User.property.name":"Alice"}' -i staging
@@ -90075,7 +90753,7 @@ __export(exports_sync, {
   default: () => sync_default
 });
 var sync_default;
-var init_sync = __esm(() => {
+var init_sync2 = __esm(() => {
   init_identity7();
   init_log();
   init_output();
@@ -90196,7 +90874,7 @@ var exports_import = {};
 __export(exports_import, {
   default: () => import_default
 });
-import { readFile as readFile20 } from "node:fs/promises";
+import { readFile as readFile22 } from "node:fs/promises";
 var import_default;
 var init_import2 = __esm(() => {
   init_identity7();
@@ -90224,7 +90902,7 @@ var init_import2 = __esm(() => {
     ],
     action: async (path8, opts) => {
       try {
-        const raw2 = await readFile20(path8, "utf-8");
+        const raw2 = await readFile22(path8, "utf-8");
         const passphrase = isEncryptedIdentityExport(raw2) ? await readPassphrase("Passphrase: ") : undefined;
         const envelope = await decodeIdentityExport(raw2, passphrase);
         const name = opts.name ?? envelope.subject;
@@ -90578,21 +91256,68 @@ var init_status4 = __esm(() => {
 
 // src/telemetry/store.ts
 import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync as statSync3 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join19 } from "node:path";
 function sessionsRoot() {
-  return join17(createPaths().home, "sessions");
+  return join19(createPaths().home, "sessions");
 }
 function sessionDir(id) {
-  return join17(sessionsRoot(), id);
+  return join19(sessionsRoot(), id);
 }
 function eventsPath(id) {
-  return join17(sessionDir(id), "events.jsonl");
+  return join19(sessionDir(id), "events.jsonl");
 }
 function metaPath(id) {
-  return join17(sessionDir(id), "meta.json");
+  return join19(sessionDir(id), "meta.json");
 }
 function markerPath(id) {
-  return join17(sessionDir(id), ".analyzed");
+  return join19(sessionDir(id), ".analyzed");
+}
+function sessionIds() {
+  try {
+    return readdirSync2(sessionsRoot()).filter((name) => !name.startsWith("."));
+  } catch {
+    return [];
+  }
+}
+function scanSessions(now = Date.now()) {
+  return sessionIds().map((id) => {
+    let lastEventAt = null;
+    try {
+      lastEventAt = statSync3(eventsPath(id)).mtime;
+    } catch {}
+    return {
+      id,
+      lastEventAt,
+      closed: lastEventAt !== null && now - lastEventAt.getTime() > IDLE_WINDOW_MS,
+      analyzed: existsSync9(markerPath(id))
+    };
+  }).sort((a, b) => (b.lastEventAt?.getTime() ?? 0) - (a.lastEventAt?.getTime() ?? 0));
+}
+function directoryBytes(dir) {
+  let entries;
+  try {
+    entries = readdirSync2(dir, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  let total = 0;
+  for (const entry2 of entries) {
+    const path8 = join19(dir, entry2.name);
+    if (entry2.isDirectory()) {
+      total += directoryBytes(path8);
+    } else if (entry2.isFile()) {
+      try {
+        total += statSync3(path8).size;
+      } catch {}
+    }
+  }
+  return total;
+}
+function sessionBytes(id) {
+  return directoryBytes(sessionDir(id));
+}
+function readMeta(id) {
+  return readJsonSafe(metaPath(id));
 }
 function readJsonSafe(path8) {
   try {
@@ -90618,13 +91343,7 @@ function inspectSession(id, now = Date.now()) {
   };
 }
 function listSessions2(now = Date.now()) {
-  let ids;
-  try {
-    ids = readdirSync2(sessionsRoot()).filter((n) => !n.startsWith("."));
-  } catch {
-    return [];
-  }
-  return ids.map((id) => inspectSession(id, now)).filter((s) => s !== null).sort((a, b) => (b.lastEventAt?.getTime() ?? 0) - (a.lastEventAt?.getTime() ?? 0));
+  return sessionIds().map((id) => inspectSession(id, now)).filter((s) => s !== null).sort((a, b) => (b.lastEventAt?.getTime() ?? 0) - (a.lastEventAt?.getTime() ?? 0));
 }
 var IDLE_WINDOW_MS;
 var init_store = __esm(() => {
@@ -90669,13 +91388,13 @@ var init_list5 = __esm(() => {
 
 // src/telemetry/adapters/claude-code.ts
 import { existsSync as existsSync10, readdirSync as readdirSync3, statSync as statSync4 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import { join as join18 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { join as join20 } from "node:path";
 function mungeCwd(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
 }
-function claudeCodeAdapter(base2 = join18(homedir3(), ".claude")) {
-  const projectsDir = join18(base2, "projects");
+function claudeCodeAdapter(base2 = join20(homedir4(), ".claude")) {
+  const projectsDir = join20(base2, "projects");
   function detect2() {
     try {
       return existsSync10(projectsDir);
@@ -90699,7 +91418,7 @@ function claudeCodeAdapter(base2 = join18(homedir3(), ".claude")) {
       for (const dir of dirs) {
         if (dir !== munged && !dir.startsWith(prefix))
           continue;
-        const projectPath = join18(projectsDir, dir);
+        const projectPath = join20(projectsDir, dir);
         let files;
         try {
           files = readdirSync3(projectPath);
@@ -90709,7 +91428,7 @@ function claudeCodeAdapter(base2 = join18(homedir3(), ".claude")) {
         for (const file2 of files) {
           if (!file2.endsWith(".jsonl"))
             continue;
-          const transcriptPath = join18(projectPath, file2);
+          const transcriptPath = join20(projectPath, file2);
           try {
             const st = statSync4(transcriptPath);
             const mtimeMs = st.mtime.getTime();
@@ -90744,8 +91463,8 @@ var init_claude_code = __esm(() => {
 // src/telemetry/adapters/codex.ts
 import { existsSync as existsSync11, openSync as openSync2, readdirSync as readdirSync4, readSync, statSync as statSync5 } from "node:fs";
 import { closeSync as closeSync3 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { join as join19 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { join as join21 } from "node:path";
 function readFirstLine(path8) {
   let fd = null;
   try {
@@ -90785,8 +91504,8 @@ function numericDirs(path8) {
     return [];
   }
 }
-function codexAdapter(base2 = join19(homedir4(), ".codex")) {
-  const sessionsDir = join19(base2, "sessions");
+function codexAdapter(base2 = join21(homedir5(), ".codex")) {
+  const sessionsDir = join21(base2, "sessions");
   function detect2() {
     try {
       return existsSync11(sessionsDir);
@@ -90801,12 +91520,12 @@ function codexAdapter(base2 = join19(homedir4(), ".codex")) {
       const endMs = window2.end.getTime();
       const lowerMs = startMs - DAY_MS;
       for (const yyyy of numericDirs(sessionsDir)) {
-        for (const mm of numericDirs(join19(sessionsDir, yyyy))) {
-          for (const dd of numericDirs(join19(sessionsDir, yyyy, mm))) {
+        for (const mm of numericDirs(join21(sessionsDir, yyyy))) {
+          for (const dd of numericDirs(join21(sessionsDir, yyyy, mm))) {
             const dayStart = Date.UTC(Number(yyyy), Number(mm) - 1, Number(dd));
             if (dayStart > endMs + DAY_MS || dayStart + DAY_MS <= lowerMs)
               continue;
-            scanDay(join19(sessionsDir, yyyy, mm, dd), root, startMs, endMs, sessions);
+            scanDay(join21(sessionsDir, yyyy, mm, dd), root, startMs, endMs, sessions);
           }
         }
       }
@@ -90828,7 +91547,7 @@ function scanDay(dayPath, root, startMs, endMs, out) {
   for (const file2 of files) {
     if (!file2.startsWith("rollout-") || !file2.endsWith(".jsonl"))
       continue;
-    const transcriptPath = join19(dayPath, file2);
+    const transcriptPath = join21(dayPath, file2);
     try {
       const st = statSync5(transcriptPath);
       const mtimeMs = st.mtime.getTime();
@@ -90975,7 +91694,7 @@ var init_gate = () => {};
 // src/telemetry/analyze.ts
 import { spawn as spawn3 } from "node:child_process";
 import { appendFileSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join22 } from "node:path";
 function writeMarker(id, marker) {
   writeFileSync2(markerPath(id), JSON.stringify(marker, null, 2) + `
 `);
@@ -91071,7 +91790,7 @@ async function analyzeSession(id, opts = {}) {
   const guides = new Map(adapters.map((a) => [a.name, a.readingGuide]));
   const prompt = buildPrompt({ id, root, signals: signals2, guides, file: opts.file ?? false });
   const dir = sessionDir(id);
-  writeFileSync2(join20(dir, "analyzer-prompt.md"), prompt);
+  writeFileSync2(join22(dir, "analyzer-prompt.md"), prompt);
   const outcome = await runClaude(prompt, dir, opts);
   const marker = {
     analyzedAt: new Date().toISOString(),
@@ -91079,10 +91798,10 @@ async function analyzeSession(id, opts = {}) {
     note: outcome.note
   };
   writeMarker(id, marker);
-  return { ...marker, reportPath: join20(dir, "report.md") };
+  return { ...marker, reportPath: join22(dir, "report.md") };
 }
 function runClaude(prompt, cwd, opts) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const env2 = { ASTRALE_TELEMETRY: "0" };
     for (const [k, v] of Object.entries(process.env)) {
       if (v !== undefined && !k.startsWith("CLAUDE"))
@@ -91095,10 +91814,10 @@ function runClaude(prompt, cwd, opts) {
     try {
       child3 = spawn3("claude", args, { cwd, env: env2, stdio: ["ignore", "pipe", "pipe"] });
     } catch (e) {
-      resolve7({ ok: false, note: `claude spawn failed: ${String(e)}` });
+      resolve8({ ok: false, note: `claude spawn failed: ${String(e)}` });
       return;
     }
-    child3.on("error", (e) => resolve7({ ok: false, note: `claude not available: ${e.message}` }));
+    child3.on("error", (e) => resolve8({ ok: false, note: `claude not available: ${e.message}` }));
     let out = "";
     let err = "";
     child3.stdout?.setEncoding("utf8");
@@ -91109,22 +91828,22 @@ function runClaude(prompt, cwd, opts) {
     child3.on("close", (code) => {
       clearTimeout(timer);
       try {
-        appendFileSync(join20(cwd, "analyzer.log"), out + (err ? `
+        appendFileSync(join22(cwd, "analyzer.log"), out + (err ? `
 --- stderr ---
 ${err}` : ""));
       } catch {}
       try {
         const result = JSON.parse(out);
         if (result.is_error) {
-          resolve7({ ok: false, note: `analyzer errored: ${result.result?.slice(0, 200)}` });
+          resolve8({ ok: false, note: `analyzer errored: ${result.result?.slice(0, 200)}` });
           return;
         }
-        resolve7({
+        resolve8({
           ok: true,
           note: `${result.num_turns ?? "?"} turns, $${(result.total_cost_usd ?? 0).toFixed(4)}`
         });
       } catch {
-        resolve7({ ok: false, note: `claude exit ${code}, unparseable output` });
+        resolve8({ ok: false, note: `claude exit ${code}, unparseable output` });
       }
     });
   });
@@ -91140,28 +91859,111 @@ var init_analyze = __esm(() => {
 
 // src/telemetry/settings.ts
 import { readFileSync as readFileSync5 } from "node:fs";
+function readConfig2() {
+  try {
+    const parsed = JSON.parse(readFileSync5(createPaths().config, "utf-8"));
+    const telemetry = parsed.telemetry;
+    return typeof telemetry === "object" && telemetry !== null ? telemetry : {};
+  } catch {
+    return {};
+  }
+}
 function telemetryEnabled() {
   const env2 = process.env.ASTRALE_TELEMETRY;
   if (env2 !== undefined && OFF_VALUES.has(env2.trim().toLowerCase()))
     return false;
-  try {
-    const parsed = JSON.parse(readFileSync5(createPaths().config, "utf-8"));
-    if (parsed.telemetry?.enabled === false)
-      return false;
-  } catch {}
-  return true;
+  return readConfig2().enabled !== false;
+}
+function firstPositive(candidates) {
+  for (const candidate2 of candidates) {
+    if (candidate2 === undefined)
+      continue;
+    const n = typeof candidate2 === "string" ? Number(candidate2.trim()) : candidate2;
+    if (Number.isFinite(n) && n > 0)
+      return n;
+  }
+  return null;
+}
+function retentionBudget() {
+  const config2 = readConfig2();
+  const days = firstPositive([process.env.ASTRALE_TELEMETRY_MAX_AGE_DAYS, config2.maxAgeDays]) ?? DEFAULT_MAX_AGE_DAYS;
+  const bytes = firstPositive([process.env.ASTRALE_TELEMETRY_MAX_BYTES, config2.maxBytes]) ?? DEFAULT_MAX_BYTES;
+  return { maxAgeMs: days * 24 * 60 * 60 * 1000, maxBytes: bytes };
 }
-var OFF_VALUES;
+var OFF_VALUES, DEFAULT_MAX_AGE_DAYS = 30, DEFAULT_MAX_BYTES;
 var init_settings = __esm(() => {
   init_state();
   OFF_VALUES = new Set(["0", "false", "off"]);
+  DEFAULT_MAX_BYTES = 50 * 1024 * 1024;
+});
+
+// src/telemetry/retention.ts
+import { rmSync as rmSync2 } from "node:fs";
+function remove(id, into) {
+  try {
+    rmSync2(sessionDir(id), { recursive: true, force: true });
+    into.push(id);
+  } catch {}
+}
+function sweepByAge(sessions, options = {}) {
+  const { maxAgeMs } = options.budget ?? retentionBudget();
+  const cutoff = (options.now ?? Date.now()) - maxAgeMs;
+  const limit = options.limit ?? Number.POSITIVE_INFINITY;
+  const protect = options.protect;
+  const removed = [];
+  for (const session3 of sessions) {
+    if (removed.length >= limit)
+      break;
+    if (protect?.has(session3.id))
+      continue;
+    if (session3.lastEventAt !== null && session3.lastEventAt.getTime() < cutoff) {
+      remove(session3.id, removed);
+    }
+  }
+  return { removed };
+}
+function sweepToBudget(sessions, options = {}) {
+  const { maxBytes } = options.budget ?? retentionBudget();
+  const protect = options.protect;
+  const removed = [];
+  const sized = sessions.map((session3) => ({ session: session3, bytes: sessionBytes(session3.id) }));
+  let total = sized.reduce((sum, entry2) => sum + entry2.bytes, 0);
+  if (total <= maxBytes)
+    return { removed };
+  const evictable = sized.filter((entry2) => entry2.session.closed && !protect?.has(entry2.session.id)).sort((a, b) => (a.session.lastEventAt?.getTime() ?? 0) - (b.session.lastEventAt?.getTime() ?? 0));
+  for (const analyzedFirst of [true, false]) {
+    for (const entry2 of evictable) {
+      if (total <= maxBytes)
+        return { removed };
+      if (entry2.session.analyzed !== analyzedFirst)
+        continue;
+      const before = removed.length;
+      remove(entry2.session.id, removed);
+      if (removed.length > before)
+        total -= entry2.bytes;
+    }
+  }
+  return { removed };
+}
+function sweepStore(options = {}) {
+  const budget = options.budget ?? retentionBudget();
+  const sessions = scanSessions();
+  const byAge = sweepByAge(sessions, { ...options, budget });
+  const gone = new Set(byAge.removed);
+  const bySize = sweepToBudget(sessions.filter((session3) => !gone.has(session3.id)), { ...options, budget });
+  return { removed: [...byAge.removed, ...bySize.removed] };
+}
+var MAX_REMOVALS_ON_START = 20;
+var init_retention = __esm(() => {
+  init_settings();
+  init_store();
 });
 
 // src/telemetry/trigger.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync2, readFileSync as readFileSync6, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join21 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync2, readFileSync as readFileSync6, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join23 } from "node:path";
 function lockPath() {
-  return join21(sessionsRoot(), ".analyzer.lock");
+  return join23(sessionsRoot(), ".analyzer.lock");
 }
 function releaseLock() {
   try {
@@ -91173,12 +91975,12 @@ function restampLock() {
     writeFileSync3(lockPath(), JSON.stringify({ pid: process.pid, at: Date.now() }));
   } catch {}
 }
-var LOCK_STALE_MS, GC_AGE_MS;
+var LOCK_STALE_MS;
 var init_trigger = __esm(() => {
+  init_retention();
   init_settings();
   init_store();
   LOCK_STALE_MS = 30 * 60 * 1000;
-  GC_AGE_MS = 30 * 24 * 60 * 60 * 1000;
 });
 
 // src/commands/session/analyze.ts
@@ -91191,12 +91993,19 @@ var init_analyze2 = __esm(() => {
   init_source();
   init_log();
   init_analyze();
+  init_retention();
   init_store();
   init_trigger();
   analyze_default = {
     name: "analyze",
     description: "Analyze a recorded session for DX frictions (dry-run: writes report.md)",
-    arguments: [{ name: "id", description: "Session id (default: most recent closed, unanalyzed)" }],
+    arguments: [
+      {
+        name: "id",
+        description: "Session id (default: most recent closed, unanalyzed)",
+        required: false
+      }
+    ],
     options: [
       { flags: "--file", description: "File cleared findings as issues on the admin tracker" },
       { flags: "--model <model>", description: "Model for the analyzer pass" },
@@ -91206,10 +92015,10 @@ var init_analyze2 = __esm(() => {
     action: async (id, opts) => {
       if (opts.auto)
         restampLock();
+      let target2 = id;
       try {
-        let target2 = id;
         if (!target2) {
-          const candidate2 = listSessions2().find((s) => s.closed && (opts.force || !s.analyzed));
+          const candidate2 = scanSessions().find((s) => s.closed && (opts.force || !s.analyzed));
           if (!candidate2) {
             if (!opts.auto)
               log.dim("Nothing to analyze — no closed, unanalyzed session.");
@@ -91234,6 +92043,12 @@ var init_analyze2 = __esm(() => {
       } finally {
         if (opts.auto)
           releaseLock();
+        try {
+          const swept = sweepStore({ protect: new Set(target2 === undefined ? [] : [target2]) });
+          if (!opts.auto && swept.removed.length > 0) {
+            log.dim(`retention: removed ${swept.removed.length} session(s)`);
+          }
+        } catch {}
       }
     }
   };
@@ -91244,7 +92059,7 @@ var exports_add2 = {};
 __export(exports_add2, {
   default: () => add_default2
 });
-import { readFile as readFile21 } from "node:fs/promises";
+import { readFile as readFile23 } from "node:fs/promises";
 function isString(value3) {
   return typeof value3 === "string";
 }
@@ -91306,7 +92121,7 @@ Security:
       if (!opts.issuer && !opts.metadata && !opts.workosAuthkit) {
         throw new Error("Either --issuer, --metadata, or --workos-authkit is required");
       }
-      let metadata = opts.workosAuthkit ? workosAuthKitMetadata(opts.workosApiHostname, opts.clientId) : opts.metadata ? OidcMetadataSchema.parse(JSON.parse(await readFile21(opts.metadata, "utf-8"))) : await fetchOidcMetadata(opts.issuer);
+      let metadata = opts.workosAuthkit ? workosAuthKitMetadata(opts.workosApiHostname, opts.clientId) : opts.metadata ? OidcMetadataSchema.parse(JSON.parse(await readFile23(opts.metadata, "utf-8"))) : await fetchOidcMetadata(opts.issuer);
       if (opts.issuer) {
         validateUrl(opts.issuer);
         if (normalizeIssuer2(metadata.issuer) !== normalizeIssuer2(opts.issuer)) {
@@ -91872,7 +92687,7 @@ async function buildProgram() {
       (await Promise.resolve().then(() => (init_use4(), exports_use4))).default,
       (await Promise.resolve().then(() => (init_whoami3(), exports_whoami))).default,
       (await Promise.resolve().then(() => (init_delete2(), exports_delete2))).default,
-      (await Promise.resolve().then(() => (init_sync(), exports_sync))).default,
+      (await Promise.resolve().then(() => (init_sync2(), exports_sync))).default,
       (await Promise.resolve().then(() => (init_unsync(), exports_unsync))).default,
       (await Promise.resolve().then(() => (init_export2(), exports_export))).default,
       (await Promise.resolve().then(() => (init_import2(), exports_import))).default
@@ -91996,16 +92811,16 @@ function redactArgv(argv) {
 
 // src/telemetry/session.ts
 init_store();
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { existsSync as existsSync13, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname12, join as join22 } from "node:path";
+import { dirname as dirname14, join as join24 } from "node:path";
 var MAX_ID_LEN = 64;
 function findGitRoot(start) {
   let dir = start;
   for (;; ) {
-    if (existsSync13(join22(dir, ".git")))
+    if (existsSync13(join24(dir, ".git")))
       return dir;
-    const parent = dirname12(dir);
+    const parent = dirname14(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -92018,19 +92833,21 @@ function stamp(d = new Date) {
   const p = (n, w = 2) => String(n).padStart(w, "0");
   return `${p(d.getFullYear(), 4)}${p(d.getMonth() + 1)}${p(d.getDate())}${p(d.getHours())}${p(d.getMinutes())}`;
 }
-function findOpenAmbient(root) {
-  for (const s of listSessions2()) {
-    if (s.meta?.root === root && s.meta.explicit === false && !s.closed && s.analyzed === null) {
+function findOpenAmbient(root, sessions) {
+  for (const s of sessions) {
+    if (s.closed || s.analyzed)
+      continue;
+    const meta3 = readMeta(s.id);
+    if (meta3?.root === root && meta3.explicit === false)
       return s.id;
-    }
   }
   return null;
 }
 function mintAmbientId(root) {
-  const hash8 = createHash3("sha256").update(root).digest("hex").slice(0, 8);
+  const hash8 = createHash4("sha256").update(root).digest("hex").slice(0, 8);
   return `amb-${hash8}-${stamp()}`;
 }
-function resolveSession2(cwd) {
+function resolveSession2(cwd, sessions) {
   const root = findGitRoot(cwd) ?? cwd;
   const pinned = process.env.ASTRALE_SESSION;
   if (pinned) {
@@ -92038,10 +92855,11 @@ function resolveSession2(cwd) {
     if (id.length > 0)
       return { id, root, explicit: true };
   }
-  return { id: findOpenAmbient(root) ?? mintAmbientId(root), root, explicit: false };
+  const scan2 = sessions ?? scanSessions();
+  return { id: findOpenAmbient(root, scan2) ?? mintAmbientId(root), root, explicit: false };
 }
-function ensureSession(cwd) {
-  const resolved = resolveSession2(cwd);
+function ensureSession(cwd, sessions) {
+  const resolved = resolveSession2(cwd, sessions);
   const dir = sessionDir(resolved.id);
   if (!existsSync13(dir)) {
     try {
@@ -92075,7 +92893,7 @@ var HELP_VERSION = new Set([
 function isHelpOrVersion(args) {
   return args.every((a) => HELP_VERSION.has(a));
 }
-function beginInvocation(argv) {
+function beginInvocation(argv, sessions) {
   try {
     const args = argv.slice(2);
     if (!telemetryEnabled() || isHelpOrVersion(args))
@@ -92083,7 +92901,7 @@ function beginInvocation(argv) {
     const startMs = Date.now();
     const ts = new Date(startMs).toISOString();
     const cwd = process.cwd();
-    const { id, root } = ensureSession(cwd);
+    const { id, root } = ensureSession(cwd, sessions);
     return (exitCode, errorName) => {
       try {
         const event = {
@@ -92107,37 +92925,61 @@ function beginInvocation(argv) {
   }
 }
 
+// src/telemetry/store.ts
+init_state();
+import { existsSync as existsSync14, readdirSync as readdirSync5, readFileSync as readFileSync7, statSync as statSync6 } from "node:fs";
+import { join as join25 } from "node:path";
+var IDLE_WINDOW_MS2 = 30 * 60 * 1000;
+function sessionsRoot2() {
+  return join25(createPaths().home, "sessions");
+}
+function sessionDir2(id) {
+  return join25(sessionsRoot2(), id);
+}
+function eventsPath2(id) {
+  return join25(sessionDir2(id), "events.jsonl");
+}
+function markerPath2(id) {
+  return join25(sessionDir2(id), ".analyzed");
+}
+function sessionIds2() {
+  try {
+    return readdirSync5(sessionsRoot2()).filter((name) => !name.startsWith("."));
+  } catch {
+    return [];
+  }
+}
+function scanSessions2(now = Date.now()) {
+  return sessionIds2().map((id) => {
+    let lastEventAt = null;
+    try {
+      lastEventAt = statSync6(eventsPath2(id)).mtime;
+    } catch {}
+    return {
+      id,
+      lastEventAt,
+      closed: lastEventAt !== null && now - lastEventAt.getTime() > IDLE_WINDOW_MS2,
+      analyzed: existsSync14(markerPath2(id))
+    };
+  }).sort((a, b) => (b.lastEventAt?.getTime() ?? 0) - (a.lastEventAt?.getTime() ?? 0));
+}
+
 // src/telemetry/trigger.ts
+init_retention();
 init_settings();
 init_store();
 import { spawn as spawn4 } from "node:child_process";
-import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync7, rmSync as rmSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync4, readFileSync as readFileSync8, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join26 } from "node:path";
 var LOCK_STALE_MS2 = 30 * 60 * 1000;
-var GC_AGE_MS2 = 30 * 24 * 60 * 60 * 1000;
-var GC_MAX_PER_RUN = 20;
-function gcOldSessions(sessions) {
-  try {
-    const cutoff = Date.now() - GC_AGE_MS2;
-    let removed = 0;
-    for (const s of sessions) {
-      if (removed >= GC_MAX_PER_RUN)
-        break;
-      if (s.analyzed !== null && s.lastEventAt !== null && s.lastEventAt.getTime() < cutoff) {
-        rmSync3(sessionDir(s.id), { recursive: true, force: true });
-        removed++;
-      }
-    }
-  } catch {}
-}
 function lockPath2() {
-  return join23(sessionsRoot(), ".analyzer.lock");
+  return join26(sessionsRoot(), ".analyzer.lock");
 }
 function claimLock() {
   const path8 = lockPath2();
   try {
-    if (existsSync14(path8)) {
-      const lock = JSON.parse(readFileSync7(path8, "utf-8"));
+    if (existsSync15(path8)) {
+      const lock = JSON.parse(readFileSync8(path8, "utf-8"));
       const stale2 = Date.now() - lock.at > LOCK_STALE_MS2;
       let alive = false;
       try {
@@ -92155,17 +92997,17 @@ function claimLock() {
     return false;
   }
 }
-function maybeTriggerAnalysis(argv) {
+function maybeTriggerAnalysis(argv, scan2) {
   try {
-    if (!telemetryEnabled())
-      return;
     if (process.env.ASTRALE_TELEMETRY_NO_TRIGGER === "1")
       return;
+    const sessions = scan2 ?? scanSessions();
+    const swept = new Set(sweepByAge(sessions, { limit: MAX_REMOVALS_ON_START }).removed);
+    if (!telemetryEnabled())
+      return;
     if (argv[2] === "session")
       return;
-    const sessions = listSessions2();
-    gcOldSessions(sessions);
-    const target2 = sessions.find((s) => s.closed && s.analyzed === null && s.lastEventAt !== null);
+    const target2 = sessions.find((s) => s.closed && !s.analyzed && s.lastEventAt !== null && !swept.has(s.id));
     if (!target2)
       return;
     if (!claimLock())
@@ -92188,11 +93030,12 @@ function overrideExits(command) {
   for (const child3 of command.commands)
     overrideExits(child3);
 }
-var finalize2 = process.argv[2] === "session" ? undefined : beginInvocation(process.argv);
+var sessions = scanSessions2();
+var finalize2 = process.argv[2] === "session" ? undefined : beginInvocation(process.argv, sessions);
 var errorName;
 if (finalize2)
   process.on("exit", (code) => finalize2(code ?? 0, errorName));
-maybeTriggerAnalysis(process.argv);
+maybeTriggerAnalysis(process.argv, sessions);
 var argv = normalizeRootVersionArgv(process.argv);
 configureInvocation(argv);
 var program4 = await buildProgram();