@divergeai/cli 0.1.24 → 0.1.25

package/dist/diverge.mjs

@@ -114,17 +114,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path17) {
-      const ctrl = callVisitor(key, node, visitor, path17);
+    function visit_(key, node, visitor, path18) {
+      const ctrl = callVisitor(key, node, visitor, path18);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path17, ctrl);
-        return visit_(key, ctrl, visitor, path17);
+        replaceNode(key, path18, ctrl);
+        return visit_(key, ctrl, visitor, path18);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path17 = Object.freeze(path17.concat(node));
+          path18 = Object.freeze(path18.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path17);
+            const ci = visit_(i, node.items[i], visitor, path18);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -135,13 +135,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path17 = Object.freeze(path17.concat(node));
-          const ck = visit_("key", node.key, visitor, path17);
+          path18 = Object.freeze(path18.concat(node));
+          const ck = visit_("key", node.key, visitor, path18);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path17);
+          const cv = visit_("value", node.value, visitor, path18);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -162,17 +162,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path17) {
-      const ctrl = await callVisitor(key, node, visitor, path17);
+    async function visitAsync_(key, node, visitor, path18) {
+      const ctrl = await callVisitor(key, node, visitor, path18);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path17, ctrl);
-        return visitAsync_(key, ctrl, visitor, path17);
+        replaceNode(key, path18, ctrl);
+        return visitAsync_(key, ctrl, visitor, path18);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path17 = Object.freeze(path17.concat(node));
+          path18 = Object.freeze(path18.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path17);
+            const ci = await visitAsync_(i, node.items[i], visitor, path18);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -183,13 +183,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path17 = Object.freeze(path17.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path17);
+          path18 = Object.freeze(path18.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path18);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path17);
+          const cv = await visitAsync_("value", node.value, visitor, path18);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -216,23 +216,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path17) {
+    function callVisitor(key, node, visitor, path18) {
       if (typeof visitor === "function")
-        return visitor(key, node, path17);
+        return visitor(key, node, path18);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path17);
+        return visitor.Map?.(key, node, path18);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path17);
+        return visitor.Seq?.(key, node, path18);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path17);
+        return visitor.Pair?.(key, node, path18);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path17);
+        return visitor.Scalar?.(key, node, path18);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path17);
+        return visitor.Alias?.(key, node, path18);
       return void 0;
     }
-    function replaceNode(key, path17, node) {
-      const parent = path17[path17.length - 1];
+    function replaceNode(key, path18, node) {
+      const parent = path18[path18.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -844,10 +844,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path17, value) {
+    function collectionFromPath(schema, path18, value) {
       let v = value;
-      for (let i = path17.length - 1; i >= 0; --i) {
-        const k = path17[i];
+      for (let i = path18.length - 1; i >= 0; --i) {
+        const k = path18[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -866,7 +866,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path17) => path17 == null || typeof path17 === "object" && !!path17[Symbol.iterator]().next().done;
+    var isEmptyPath = (path18) => path18 == null || typeof path18 === "object" && !!path18[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -896,11 +896,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path17, value) {
-        if (isEmptyPath(path17))
+      addIn(path18, value) {
+        if (isEmptyPath(path18))
           this.add(value);
         else {
-          const [key, ...rest] = path17;
+          const [key, ...rest] = path18;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -914,8 +914,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path17) {
-        const [key, ...rest] = path17;
+      deleteIn(path18) {
+        const [key, ...rest] = path18;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -929,8 +929,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path17, keepScalar) {
-        const [key, ...rest] = path17;
+      getIn(path18, keepScalar) {
+        const [key, ...rest] = path18;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -948,8 +948,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path17) {
-        const [key, ...rest] = path17;
+      hasIn(path18) {
+        const [key, ...rest] = path18;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -959,8 +959,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path17, value) {
-        const [key, ...rest] = path17;
+      setIn(path18, value) {
+        const [key, ...rest] = path18;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -1004,14 +1004,14 @@ var require_foldFlowLines = __commonJS({
     var FOLD_FLOW = "flow";
     var FOLD_BLOCK = "block";
     var FOLD_QUOTED = "quoted";
-    function foldFlowLines(text, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
+    function foldFlowLines(text2, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
       if (!lineWidth || lineWidth < 0)
-        return text;
+        return text2;
       if (lineWidth < minContentWidth)
         minContentWidth = 0;
       const endStep = Math.max(1 + minContentWidth, 1 + lineWidth - indent.length);
-      if (text.length <= endStep)
-        return text;
+      if (text2.length <= endStep)
+        return text2;
       const folds = [];
       const escapedFolds = {};
       let end = lineWidth - indent.length;
@@ -1028,14 +1028,14 @@ var require_foldFlowLines = __commonJS({
       let escStart = -1;
       let escEnd = -1;
       if (mode === FOLD_BLOCK) {
-        i = consumeMoreIndentedLines(text, i, indent.length);
+        i = consumeMoreIndentedLines(text2, i, indent.length);
         if (i !== -1)
           end = i + endStep;
       }
-      for (let ch; ch = text[i += 1]; ) {
+      for (let ch; ch = text2[i += 1]; ) {
         if (mode === FOLD_QUOTED && ch === "\\") {
           escStart = i;
-          switch (text[i + 1]) {
+          switch (text2[i + 1]) {
             case "x":
               i += 3;
               break;
@@ -1052,12 +1052,12 @@ var require_foldFlowLines = __commonJS({
         }
         if (ch === "\n") {
           if (mode === FOLD_BLOCK)
-            i = consumeMoreIndentedLines(text, i, indent.length);
+            i = consumeMoreIndentedLines(text2, i, indent.length);
           end = i + indent.length + endStep;
           split = void 0;
         } else {
           if (ch === " " && prev && prev !== " " && prev !== "\n" && prev !== "	") {
-            const next = text[i + 1];
+            const next = text2[i + 1];
             if (next && next !== " " && next !== "\n" && next !== "	")
               split = i;
           }
@@ -1069,12 +1069,12 @@ var require_foldFlowLines = __commonJS({
             } else if (mode === FOLD_QUOTED) {
               while (prev === " " || prev === "	") {
                 prev = ch;
-                ch = text[i += 1];
+                ch = text2[i += 1];
                 overflow = true;
               }
               const j = i > escEnd + 1 ? i - 2 : escStart - 1;
               if (escapedFolds[j])
-                return text;
+                return text2;
               folds.push(j);
               escapedFolds[j] = true;
               end = j + endStep;
@@ -1089,39 +1089,39 @@ var require_foldFlowLines = __commonJS({
       if (overflow && onOverflow)
         onOverflow();
       if (folds.length === 0)
-        return text;
+        return text2;
       if (onFold)
         onFold();
-      let res = text.slice(0, folds[0]);
+      let res = text2.slice(0, folds[0]);
       for (let i2 = 0; i2 < folds.length; ++i2) {
         const fold = folds[i2];
-        const end2 = folds[i2 + 1] || text.length;
+        const end2 = folds[i2 + 1] || text2.length;
         if (fold === 0)
           res = `
-${indent}${text.slice(0, end2)}`;
+${indent}${text2.slice(0, end2)}`;
         else {
           if (mode === FOLD_QUOTED && escapedFolds[fold])
-            res += `${text[fold]}\\`;
+            res += `${text2[fold]}\\`;
           res += `
-${indent}${text.slice(fold + 1, end2)}`;
+${indent}${text2.slice(fold + 1, end2)}`;
         }
       }
       return res;
     }
-    function consumeMoreIndentedLines(text, i, indent) {
+    function consumeMoreIndentedLines(text2, i, indent) {
       let end = i;
       let start = i + 1;
-      let ch = text[start];
+      let ch = text2[start];
       while (ch === " " || ch === "	") {
         if (i < start + indent) {
-          ch = text[++i];
+          ch = text2[++i];
         } else {
           do {
-            ch = text[++i];
+            ch = text2[++i];
           } while (ch && ch !== "\n");
           end = i;
           start = i + 1;
-          ch = text[start];
+          ch = text2[start];
         }
       }
       return end;
@@ -3475,9 +3475,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path17, value) {
+      addIn(path18, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path17, value);
+          this.contents.addIn(path18, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -3552,14 +3552,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path17) {
-        if (Collection.isEmptyPath(path17)) {
+      deleteIn(path18) {
+        if (Collection.isEmptyPath(path18)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path17) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path18) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -3574,10 +3574,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path17, keepScalar) {
-        if (Collection.isEmptyPath(path17))
+      getIn(path18, keepScalar) {
+        if (Collection.isEmptyPath(path18))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path17, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path18, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -3588,10 +3588,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path17) {
-        if (Collection.isEmptyPath(path17))
+      hasIn(path18) {
+        if (Collection.isEmptyPath(path18))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path17) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path18) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -3608,13 +3608,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path17, value) {
-        if (Collection.isEmptyPath(path17)) {
+      setIn(path18, value) {
+        if (Collection.isEmptyPath(path18)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path17), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path18), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path17, value);
+          this.contents.setIn(path18, value);
         }
       }
       /**
@@ -5575,9 +5575,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path17) => {
+    visit.itemAtPath = (cst, path18) => {
       let item = cst;
-      for (const [field, index] of path17) {
+      for (const [field, index] of path18) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -5586,23 +5586,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path17) => {
-      const parent = visit.itemAtPath(cst, path17.slice(0, -1));
-      const field = path17[path17.length - 1][0];
+    visit.parentCollection = (cst, path18) => {
+      const parent = visit.itemAtPath(cst, path18.slice(0, -1));
+      const field = path18[path18.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path17, item, visitor) {
-      let ctrl = visitor(item, path17);
+    function _visit(path18, item, visitor) {
+      let ctrl = visitor(item, path18);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path17.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path18.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -5613,10 +5613,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path17);
+            ctrl = ctrl(item, path18);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path17) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path18) : ctrl;
     }
     exports.visit = visit;
   }
@@ -6918,14 +6918,14 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs15 = this.flowScalar(this.type);
+              const fs16 = this.flowScalar(this.type);
               if (atNextItem || it.value) {
-                map.items.push({ start, key: fs15, sep: [] });
+                map.items.push({ start, key: fs16, sep: [] });
                 this.onKeyLine = true;
               } else if (it.sep) {
-                this.stack.push(fs15);
+                this.stack.push(fs16);
               } else {
-                Object.assign(it, { key: fs15, sep: [] });
+                Object.assign(it, { key: fs16, sep: [] });
                 this.onKeyLine = true;
               }
               return;
@@ -7053,13 +7053,13 @@ var require_parser = __commonJS({
             case "scalar":
             case "single-quoted-scalar":
             case "double-quoted-scalar": {
-              const fs15 = this.flowScalar(this.type);
+              const fs16 = this.flowScalar(this.type);
               if (!it || it.value)
-                fc.items.push({ start: [], key: fs15, sep: [] });
+                fc.items.push({ start: [], key: fs16, sep: [] });
               else if (it.sep)
-                this.stack.push(fs15);
+                this.stack.push(fs16);
               else
-                Object.assign(it, { key: fs15, sep: [] });
+                Object.assign(it, { key: fs16, sep: [] });
               return;
             }
             case "flow-map-end":
@@ -7384,10 +7384,18 @@ var CliError = class extends Error {
   }
   exitCode;
 };
+var NotGrantedError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "NotGrantedError";
+  }
+};
 
 // src/commands/agents.ts
-import fs10 from "node:fs";
-import path13 from "node:path";
+import { randomUUID } from "node:crypto";
+import fs11 from "node:fs";
+import os8 from "node:os";
+import path14 from "node:path";
 import { parseArgs as parseArgs3 } from "node:util";
 
 // src/auth/oauth-client.ts
@@ -7407,13 +7415,13 @@ import fs2 from "node:fs";
 // src/fs/atomic.ts
 import fs from "node:fs";
 import path from "node:path";
-function writeTextAtomic(filePath, text, mode = 384) {
+function writeTextAtomic(filePath, text2, mode = 384) {
   const dir = path.dirname(filePath);
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
   const tmp = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${Date.now()}.tmp`);
   const fd = fs.openSync(tmp, "wx", mode);
   try {
-    fs.writeFileSync(fd, text);
+    fs.writeFileSync(fd, text2);
     fs.closeSync(fd);
     fs.renameSync(tmp, filePath);
   } catch (error) {
@@ -7449,14 +7457,14 @@ function saveLoginRecord(file, record) {
   writeJsonAtomic(file, record, 384);
 }
 function loadUserToken(file) {
-  let text;
+  let text2;
   try {
-    text = fs2.readFileSync(file, "utf8");
+    text2 = fs2.readFileSync(file, "utf8");
   } catch {
     return null;
   }
   try {
-    const parsed = JSON.parse(text);
+    const parsed = JSON.parse(text2);
     if (typeof parsed.access_token !== "string" || typeof parsed.base_url !== "string" || typeof parsed.expires_at !== "number") {
       return null;
     }
@@ -7488,14 +7496,14 @@ function sessionTokenFile(env) {
   return env[SESSION_TOKEN_VARIABLE]?.trim() || void 0;
 }
 function readSessionToken(file) {
-  let text;
+  let text2;
   try {
-    text = fs3.readFileSync(file, "utf8");
+    text2 = fs3.readFileSync(file, "utf8");
   } catch (error) {
     const reason = error.code ?? (error instanceof Error ? error.message : String(error));
     throw new CliError(`Cannot read the session token file ${file} named by ${SESSION_TOKEN_VARIABLE} (${reason}).`);
   }
-  const token = text.trim();
+  const token = text2.trim();
   if (!token) throw new CliError(`The session token file ${file} named by ${SESSION_TOKEN_VARIABLE} is empty.`);
   return token;
 }
@@ -7548,7 +7556,7 @@ function tokenSource(env, baseUrl) {
 }
 
 // src/version.ts
-var VERSION = true ? "0.1.24" : "dev";
+var VERSION = true ? "0.1.25" : "dev";
 var USER_AGENT = `diverge/${VERSION}`;
 
 // src/http.ts
@@ -7587,10 +7595,10 @@ async function fetchJson(url, init = {}) {
     body: init.body,
     signal: AbortSignal.timeout(init.timeoutMs ?? 3e4)
   });
-  const text = await response.text();
-  let body = text;
+  const text2 = await response.text();
+  let body = text2;
   try {
-    body = text ? JSON.parse(text) : null;
+    body = text2 ? JSON.parse(text2) : null;
   } catch {
   }
   if (!response.ok) {
@@ -7814,7 +7822,7 @@ async function issueToken(source, record, organizationId, nowMs = Date.now()) {
     },
     (error) => {
       if (error.code === "invalid_grant") return loginRequired(`Your diverge login is no longer valid (${error.message}). Run: diverge login`);
-      if (error.code === "invalid_scope") return new CliError(`Not granted${organizationId ? ` at organization ${organizationId}` : ""}: ${error.message}`);
+      if (error.code === "invalid_scope") return new NotGrantedError(`Not granted${organizationId ? ` at organization ${organizationId}` : ""}: ${error.message}`);
       return void 0;
     }
   );
@@ -7931,11 +7939,11 @@ function verbPath(usage2, args) {
 function groupOptions(usage2) {
   return usage2.split("\n", 1)[0].match(/\[--[^\]]+\]/g) ?? [];
 }
-function verbUsage(command, usage2, path17) {
-  const lines = usageEntries(usage2).filter((entry) => startsWith(entry.verbs, path17)).flatMap((entry) => entry.lines);
-  if (path17.length === 0 || lines.length === 0) return usage2;
+function verbUsage(command, usage2, path18) {
+  const lines = usageEntries(usage2).filter((entry) => startsWith(entry.verbs, path18)).flatMap((entry) => entry.lines);
+  if (path18.length === 0 || lines.length === 0) return usage2;
   const shared = groupOptions(usage2);
-  return [`diverge ${command} ${path17.join(" ")} ...`, "", ...lines, ...shared.length ? ["", `Every ${command} command also takes ${shared.join(" ")}.`] : []].join("\n");
+  return [`diverge ${command} ${path18.join(" ")} ...`, "", ...lines, ...shared.length ? ["", `Every ${command} command also takes ${shared.join(" ")}.`] : []].join("\n");
 }
 var COMMON_WORDS = /* @__PURE__ */ new Set(["the", "and", "you", "for", "its", "with", "not", "one", "are", "all", "any", "from", "that", "this", "own", "per", "into", "out", "else", "each", "what", "when", "your"]);
 function distance(a, b) {
@@ -7972,7 +7980,7 @@ function closest(guess, candidates, rest = [], limit = 3) {
       matches.push({ candidate, score: Math.min(edits, threshold), hint: first });
       continue;
     }
-    const line = candidate.lines.find((text) => (prose(text).match(/[a-z]+/g) ?? []).some((word) => namesIt(word, target)));
+    const line = candidate.lines.find((text2) => (prose(text2).match(/[a-z]+/g) ?? []).some((word) => namesIt(word, target)));
     if (line) matches.push({ candidate, score: threshold + 1, hint: line });
   }
   return matches.sort((a, b) => a.score - b.score).slice(0, limit);
@@ -7987,12 +7995,12 @@ function didYouMean(matches) {
   return ` Did you mean one of:
 ${matches.map((match) => `  ${shown(match)}`).join("\n")}`;
 }
-function verbCandidates(command, usage2, path17) {
+function verbCandidates(command, usage2, path18) {
   const byName = /* @__PURE__ */ new Map();
   for (const entry of usageEntries(usage2)) {
-    if (!startsWith(entry.verbs, path17)) continue;
-    const name = entry.verbs[path17.length] ?? "";
-    const invocation = ["diverge", command, ...path17, ...name ? [name] : []].join(" ");
+    if (!startsWith(entry.verbs, path18)) continue;
+    const name = entry.verbs[path18.length] ?? "";
+    const invocation = ["diverge", command, ...path18, ...name ? [name] : []].join(" ");
     const lines = [entry.summary, ...entry.lines.slice(1).map((line) => line.trim())].filter(Boolean);
     const known = byName.get(name);
     if (known) known.lines.push(...lines);
@@ -8000,9 +8008,9 @@ function verbCandidates(command, usage2, path17) {
   }
   return [...byName.values()];
 }
-function unknownVerb(command, usage2, path17, verb, rest = []) {
-  const candidates = verbCandidates(command, usage2, path17);
-  const where = [command, ...path17].join(" ");
+function unknownVerb(command, usage2, path18, verb, rest = []) {
+  const candidates = verbCandidates(command, usage2, path18);
+  const where = [command, ...path18].join(" ");
   if (!verb) return new CliError(`${where} needs one of: ${candidates.map((candidate) => candidate.name).filter(Boolean).join(", ")}
 
 ${usage2}`);
@@ -8010,10 +8018,10 @@ ${usage2}`);
 
 ${usage2}`);
 }
-function optionCandidates(usage2, path17) {
+function optionCandidates(usage2, path18) {
   const entries = usageEntries(usage2);
   const [header = "", ...body] = usage2.split("\n");
-  const described = entries.length === 0 || path17.length === 0 ? body : entries.filter((entry) => startsWith(entry.verbs, path17)).flatMap((entry) => entry.lines);
+  const described = entries.length === 0 || path18.length === 0 ? body : entries.filter((entry) => startsWith(entry.verbs, path18)).flatMap((entry) => entry.lines);
   const byName = /* @__PURE__ */ new Map();
   const add = (line, describes) => {
     for (const [flag] of line.matchAll(/--[a-z][a-z-]*/g)) {
@@ -8030,12 +8038,12 @@ function unknownOption(error, usage2, args) {
   if (!(error instanceof Error) || error.name !== "TypeError") return null;
   const option = /^Unknown option '([^']+)'/.exec(error.message)?.[1];
   if (!option) return null;
-  const path17 = verbPath(usage2, args);
-  return `Unknown option: ${option}.${didYouMean(closest(option, optionCandidates(usage2, path17)))}`;
+  const path18 = verbPath(usage2, args);
+  return `Unknown option: ${option}.${didYouMean(closest(option, optionCandidates(usage2, path18)))}`;
 }
 
 // src/commands/login.ts
-import { parseArgs } from "node:util";
+import { parseArgs as parseArgs2 } from "node:util";
 
 // src/auth/organizations.ts
 function chooseOrganization(input) {
@@ -8090,244 +8098,219 @@ function ask(question) {
   }));
 }
 
-// src/commands/login.ts
-var loginUsage = `diverge login [--organization-id <id|name>] [--scopes "<scopes>"] [--as <email>] [--no-browser] [--api-url <url>]
+// src/commands/skills.ts
+import { parseArgs } from "node:util";
 
-Sign in through the browser, then choose where to act. The browser only
-authenticates the person; the organization is chosen here afterwards \u2014 the
-one named by --organization-id (id or name), else the last login's, else the
-only membership, else a menu. The login itself is yours, not an
-organization's; the default is a local preference.
-That is the default: commands act there unless they name another with
---organization-id or DIVERGENT_ORG_ID. Change it with: diverge org use <id|name>.
---as <email> names the account: the platform signs that account in instead of
-reusing whatever session the browser holds, and issues nothing to any other.
-Without --as, the account of the last login is used; switching is explicit.
-Without --scopes, the login asks for the scopes the platform registers for
-this CLI \u2014 everything it and forge use \u2014 and holds what your roles grant; a
-scope the platform adds later reaches this login on its next refresh.
---scopes asks for less, deliberately, and the login stays that narrow.
---api-url signs in to another deployment (a test stack, say). Each deployment
-keeps its own login, so this never replaces another one; commands reach it
-when DIVERGENT_API_URL names it.`;
-function resolveScopes(flag) {
-  const explicit = flag?.trim();
-  return explicit ? explicit.split(/\s+/).join(" ") : void 0;
-}
-function resolveLoginHint(flag, previous) {
-  const explicit = flag?.trim().toLowerCase();
-  if (explicit) return explicit;
-  const remembered = previous.account?.trim().toLowerCase();
-  return remembered || void 0;
-}
-async function runLogin(args, io) {
-  refuseInSession(io.env, "login");
-  const { values } = parseArgs({
-    args,
-    options: {
-      "organization-id": { type: "string" },
-      scopes: { type: "string" },
-      as: { type: "string" },
-      "no-browser": { type: "boolean", default: false },
-      "api-url": { type: "string" }
-    },
-    strict: true,
-    allowPositionals: false
-  });
-  const apiUrl = resolveApiUrl(values["api-url"], io.env);
-  const source = tokenSource(io.env, apiUrl);
-  const previous = loadLogin(source);
-  const loginHint = resolveLoginHint(values.as, { account: previous?.account });
-  if (loginHint) io.stdout(`Signing in as ${loginHint}${values.as ? "" : " (the last login; pass --as to switch)"}.`);
-  const scopes = resolveScopes(values.scopes);
-  io.stdout(scopes ? `Asking for scopes: ${scopes}.` : "Asking for the scopes the platform registers for this CLI.");
-  const signIn = await login({
-    baseUrl: apiUrl,
-    clientId: source.clientId,
-    scopes,
-    openBrowser: !values["no-browser"],
-    loginHint,
-    print: io.stdout
-  });
-  let info;
-  try {
-    info = await fetchUserInfo(apiUrl, signIn.token.access_token);
-  } catch (error) {
-    throw new CliError(`Signed in, but the platform could not say who or where (${error instanceof Error ? error.message : String(error)}); run: diverge login`);
-  }
-  io.stdout(`Signed in as: ${info.email}`);
-  const organizationId = await chooseDefaultOrganization(io, values["organization-id"], previous?.organization, info);
-  const issued = await issueToken(source, { base_url: source.baseUrl, refresh_token: signIn.refreshToken, account: info.email }, organizationId);
-  saveLogin(source, { ...issued.record, organization: organizationId });
-  saveOrganizationToken(source, organizationId, issued.token);
-  io.stdout(`Logged in to ${apiUrl}.`);
-  if (apiUrl !== resolveApiUrl(void 0, io.env)) io.stdout(`Commands reach this deployment with DIVERGENT_API_URL=${apiUrl}.`);
-  const granted = new Set(tokenClaims(issued.token.access_token).scopes ?? []);
-  io.stdout(`Scopes: ${[...granted].join(" ") || "none"}`);
-  const missing = (scopes ?? "").split(" ").filter((scope) => scope && !granted.has(scope));
-  if (missing.length) io.stderr(`Not granted at this organization (your roles lack them): ${missing.join(" ")}`);
-  return 0;
-}
-async function chooseDefaultOrganization(io, flag, remembered, info) {
-  let choice = chooseOrganization({ flag, remembered, organizations: info.organizations ?? [] });
-  if (choice.kind === "none") {
-    throw new CliError("You are not a member of any organization; ask an administrator to add you, then sign in again.");
-  }
-  if (choice.kind === "ask") {
-    if (!io.interactive) {
-      throw new CliError(`You may act in several organizations; pass --organization-id <id|name>:
-${organizationMenu(choice.options).join("\n")}`);
-    }
-    io.stdout("Choose the organization to act in:");
-    for (const line of organizationMenu(choice.options)) io.stdout(line);
-    const picked = pickFromMenu(await ask("Organization (number, id or name): "), choice.options);
-    choice = { kind: "chosen", organizationId: picked.id, name: picked.name, reason: "flag" };
-  }
-  const label = choice.name ? `${choice.name} (${choice.organizationId})` : choice.organizationId;
-  const why = choice.reason === "remembered" ? " (the last login; pass --organization-id to switch)" : choice.reason === "only" ? " (your only organization)" : "";
-  io.stdout(`Organization: ${label}${why}`);
-  return choice.organizationId;
-}
+// src/skills/bundled.ts
+var DIVERGE_SKILL = {
+  name: "diverge",
+  folder: "diverge",
+  description: "Reach the Divergent platform's tools from a shell with the diverge CLI: discover, read one schema, call, and read back a call that waits on a person. Use when a task needs the organization's records, diagnostics, documents or governed actions, which the platform holds and this skill's siblings name.",
+  tools: [],
+  updatedAt: `diverge/${VERSION}`,
+  content: `---
+name: diverge
+description: Reach the Divergent platform's tools from a shell with the diverge CLI - discover, read one schema, call, and read back a call that waits on a person. Use when a task needs the organization's records, diagnostics, documents or governed actions, which the platform holds and this skill's siblings name.
+---
 
-// src/gateway/urls.ts
-var SURFACES = ["anthropic", "openai"];
-var INFERENCE_SCOPE = "inference:execute";
-function anthropicBaseUrl(apiUrl) {
-  return `${apiUrl.replace(/\/+$/, "")}/api/plugins/inference/anthropic`;
-}
-function openaiBaseUrl(apiUrl) {
-  return `${apiUrl.replace(/\/+$/, "")}/api/plugins/inference/openai`;
-}
-function surfaceBaseUrl(apiUrl, surface) {
-  return surface === "openai" ? openaiBaseUrl(apiUrl) : anthropicBaseUrl(apiUrl);
-}
+# diverge: the platform's tools from a shell
 
-// src/gateway/models.ts
-function servedModel(record) {
-  return {
-    id: record.id,
-    input: record.input_modalities?.includes("image") ? ["text", "image"] : ["text"],
-    ...record.context_window ? { contextWindow: record.context_window } : {},
-    ...record.max_output_tokens ? { maxOutputTokens: record.max_output_tokens } : {}
-  };
-}
-async function listModels(apiUrl, accessToken, surface) {
-  try {
-    const body = await fetchJson(`${surfaceBaseUrl(apiUrl, surface)}/v1/models`, {
-      headers: { Authorization: `Bearer ${accessToken}` }
-    });
-    return body.data ?? [];
-  } catch (error) {
-    if (error instanceof HttpError) {
-      const hint = error.status === 403 && /scope/i.test(error.message) ? " \u2014 the token needs inference:execute and your role needs inference_models:execute" : "";
-      throw new CliError(`Gateway refused (${error.status}): ${error.message}${hint}`);
-    }
-    throw error;
-  }
-}
-async function ensureInferenceLogin(io, apiUrl, organizationId) {
-  const source = tokenSource(io.env, apiUrl);
-  if (!source.sessionTokenFile && !loadLogin(source)) {
-    if (!io.interactive) throw new CliError(`Not signed in to ${apiUrl}. Run: diverge login${organizationId ? ` --organization-id ${organizationId}` : ""}`);
-    await runLogin(organizationId ? ["--organization-id", organizationId] : [], io);
-  }
-  const token = await getUserToken(source, { organizationId });
-  const claims = tokenClaims(token.access_token);
-  if (!claims.organizationId) throw new CliError("The login has no default organization; run: diverge org use <id|name>");
-  if (!(claims.scopes ?? []).includes(INFERENCE_SCOPE)) {
-    throw new CliError(`The token for organization ${claims.organizationId} carries no ${INFERENCE_SCOPE}: your roles there lack inference_models:execute, or the login asked for less (re-run: diverge login).`);
-  }
-  return token;
-}
+The organization's tools run on the platform, as the signed-in person, with
+their permissions and audit trail. Nothing runs locally; the CLI is the
+transport. Keep the catalog out of context: pull the one schema you need.
 
-// src/agents/claude.ts
-import os2 from "node:os";
-import path4 from "node:path";
-var CLAUDE_MODEL_DISCOVERY_FLAG = "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY";
-function claudeSettingsPath(scope, cwd = process.cwd()) {
-  return scope === "user" ? path4.join(os2.homedir(), ".claude", "settings.json") : path4.join(cwd, ".claude", "settings.local.json");
-}
-function mergeClaudeSettings(existing, options) {
-  const settings = structuredClone(existing ?? {});
-  const env = { ...settings.env ?? {} };
-  const warnings = [];
-  env.ANTHROPIC_BASE_URL = options.baseUrl;
-  if (options.projectId) env.ANTHROPIC_CUSTOM_HEADERS = `x-project-id: ${options.projectId}`;
-  else delete env.ANTHROPIC_CUSTOM_HEADERS;
-  if (options.modelDiscovery) env[CLAUDE_MODEL_DISCOVERY_FLAG] = "1";
-  else delete env[CLAUDE_MODEL_DISCOVERY_FLAG];
-  if (env.ANTHROPIC_API_KEY || env.ANTHROPIC_AUTH_TOKEN) {
-    warnings.push("env.ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN is set in these settings and would shadow the platform token; remove it");
-  }
-  settings.env = env;
-  settings.apiKeyHelper = options.tokenHelper;
-  return { settings, warnings };
-}
+\`\`\`bash
+diverge tools list --filter <word>     # find candidates by name or description
+diverge tools describe <tool>          # the one schema, on demand
+diverge tools call <tool> --args-file args.json --json   # arguments from a file, one JSON outcome out
+diverge tools call search_online --args-json '{"query": "..."}'   # web search is a platform tool too
+\`\`\`
 
-// src/agents/codex.ts
-import os3 from "node:os";
-import path5 from "node:path";
-var CODEX_BLOCK_START = "# >>> divergent >>>";
-var CODEX_BLOCK_END = "# <<< divergent <<<";
-function codexConfigPath() {
-  return path5.join(os3.homedir(), ".codex", "config.toml");
-}
-var tomlString = (value) => JSON.stringify(value);
-function codexProviderToml(options) {
-  const lines = [
-    CODEX_BLOCK_START,
-    "[model_providers.divergent]",
-    'name = "Divergent"',
-    `base_url = ${tomlString(`${options.openaiBaseUrl}/v1`)}`,
-    'wire_api = "responses"'
-  ];
-  if (options.projectId) lines.push(`http_headers = { "x-project-id" = ${tomlString(options.projectId)} }`);
-  lines.push(
-    "",
-    "[model_providers.divergent.auth]",
-    `command = ${tomlString(options.self.command)}`,
-    `args = [${[...options.self.args, "token", ...options.organizationId ? ["--organization-id", options.organizationId] : []].map(tomlString).join(", ")}]`,
-    "refresh_interval_ms = 600000",
-    CODEX_BLOCK_END,
-    ""
-  );
-  return lines.join("\n");
-}
-function mergeCodexConfig(existing, block) {
-  const text = existing ?? "";
-  const start = text.indexOf(CODEX_BLOCK_START);
-  const endIndex = text.indexOf(CODEX_BLOCK_END);
-  if (start !== -1 && endIndex !== -1 && endIndex > start) {
-    let end = endIndex + CODEX_BLOCK_END.length;
-    if (text[end] === "\n") end += 1;
-    return text.slice(0, start) + block + text.slice(end);
-  }
-  const separator = !text || text.endsWith("\n") ? "" : "\n";
-  return text + separator + (text ? "\n" : "") + block;
-}
+The other skills installed beside this one are the organization's own
+procedures; each names the tools it is about. Prefer a procedure over
+guessing a tool.
 
-// src/agents/dsh.ts
-var import_yaml = __toESM(require_dist(), 1);
-import fs5 from "node:fs";
-import { createRequire } from "node:module";
-import os4 from "node:os";
-import path6 from "node:path";
+## Arguments: pipe them through stdin
 
-// src/tools/settings.ts
-var BRIDGE_SCOPES = "mcp:read mcp:execute";
-var LOGIN_HINT = "diverge login";
-function loadToolsSettings(options, env = process.env) {
-  const apiUrl = resolveApiUrl(void 0, env);
-  const projectId = options.projectId?.trim() || env.DIVERGENT_PROJECT_ID?.trim() || void 0;
-  let organizationId = options.organizationId?.trim() || env.DIVERGENT_ORG_ID?.trim() || "";
-  const tokenFile = sessionTokenFile(env);
-  if (tokenFile) {
-    organizationId = sessionOrganization(tokenFile, readSessionToken(tokenFile), organizationId || void 0);
-    return { apiUrl, organizationId, projectId, mode: "session", tokenFile };
-  }
-  const cached = loadLogin(tokenSource(env, apiUrl));
-  if (cached) {
-    organizationId ||= cached.organization ?? "";
+Shells mangle JSON. Windows PowerShell strips the double quotes inside an
+inline argument, so \`--args-json '{"a":"b"}'\` can arrive as \`{a:b}\`.
+Pipe the object to \`--args-json -\` from a heredoc (a here-string on
+PowerShell): exact on every shell, and no file to keep. A worked call:
+
+\`\`\`bash
+diverge tools describe forge_query_issues
+diverge tools call forge_query_issues --args-json - --json <<'JSON'
+{"query": "sync failed", "limit": 20}
+JSON
+\`\`\`
+
+\`--args-file <path>\` reads a file you already have. Keep anything a later
+command needs under the working directory: a sandboxed harness runs each
+command in a fresh sandbox, and its \`/tmp\` is gone when the command ends.
+
+## Read the outcome from stdout with --json
+
+\`call --json\` prints exactly one JSON object on stdout whatever happens,
+errors included: \`{"tool", "status", "result"?, "error"?, "invocationId"?,
+"decideAt"?}\`, where status is executed, pending, rejected, expired or failed.
+\`result\` is the tool's payload exactly as the tool returned it: the CLI
+unwraps the platform's envelope and nothing inside. Its shape is the tool's
+own and differs by tool and plugin \u2014 one returns its records under \`data\`,
+another at the top level \u2014 so read a tool's shape from its own answer, not
+from the last tool's. Parse stdout alone; stderr only carries the scope and
+identity lines. Without \`--json\`, errors are text on stderr.
+
+## Several related writes: one set, one decision
+
+When two or more writes serve one intent \u2014 assign a role to several groups,
+deactivate several users, set several notification routes \u2014 raise them as
+one set, never one call per write: the person approves the set once instead
+of clicking through one card each.
+
+\`\`\`bash
+diverge tools set - --summary "Coordinators get the field role" --json <<'JSON'
+[{"tool": "rbac_assign_role_to_group", "args": {"roleId": "r1", "groupId": "g1"}},
+ {"tool": "rbac_assign_role_to_group", "args": {"roleId": "r1", "groupId": "g2"}}]
+JSON
+\`\`\`
+
+The set answers like one call (exit 3 while it waits, one invocation id).
+Once approved its calls run in order and stop at the first failure; read
+every call's outcome \u2014 succeeded, failed, or not_run \u2014 from \`result.calls\`
+with \`diverge tools invocation <id>\`. Arguments are frozen when you raise
+the set, so a call cannot use an id an earlier call creates: raise that one
+after the first ran. A set carries writes only; reads, and prepared writes
+that propose a Forge Change, are called on their own.
+
+## Several independent calls at once
+
+When a task needs a sequence of reads or unrelated calls, pipe them to
+\`diverge tools run -\` once instead of one round trip each (or name a file):
+a JSON array of \`{"tool": "...", "args": {...}}\`, or one per line. Calls run
+in order; each prints one JSON line of outcome, the same shape as
+\`call --json\`; the exit code is the worst of them. Each write in a run is
+its own decision, so related writes belong in a set.
+
+## Exit codes are the contract
+
+| Code | Meaning | Do |
+| --- | --- | --- |
+| 0 | executed | use the result |
+| 3 | pending: a person must decide it in Compass | hand over the printed link, keep working, read it back later |
+| 4 | rejected, with the person's reason | re-plan; the reason is data |
+| 5 | expired: nobody decided in time | raise a fresh call if still needed |
+| 1 | executed but failed, or a transport error | read the message; do not re-raise blindly |
+
+A pending call prints its invocation id and a link. Read the outcome with
+\`diverge tools invocation <id>\` (add \`--wait\` to poll at the platform's
+cadence). Never decide your own invocation from any surface you can drive.
+
+## Session
+
+- \`diverge status\` says who is signed in and at which organization; a call
+  that names none runs there. To act in another organization, pass
+  \`--organization-id <id>\` (or set \`DIVERGENT_ORG_ID\`) on the call; that
+  never changes the default. \`diverge org use <id|name>\` changes it for
+  every session on the machine, so leave it to the person.
+- A missing login or scope prints the command to run; \`diverge login\` opens
+  the browser.
+- \`--json\` on \`list\`, \`describe\` and \`invocation\` gives raw records.
+`
+};
+var DRIVE_CHROME_DESCRIPTION = "Control the Chrome the person runs in debug mode (remote debugging on port 9222) through the mcp__chrome-devtools__ tools - list and pick tabs, open and navigate pages, read a page, click, fill forms, run JavaScript, read console and network, take screenshots and performance traces. Use when a task needs to look at or act in a web page, debug a UI, or reproduce a browser problem.";
+var DRIVE_CHROME_SKILL = {
+  name: "drive-chrome",
+  folder: "drive-chrome",
+  description: DRIVE_CHROME_DESCRIPTION,
+  tools: [],
+  updatedAt: `diverge/${VERSION}`,
+  content: [
+    "---",
+    "name: drive-chrome",
+    `description: ${DRIVE_CHROME_DESCRIPTION}`,
+    "---",
+    "",
+    "# drive-chrome: the person's Chrome",
+    "",
+    "The `mcp__chrome-devtools__*` tools act in a Chrome the person started with",
+    "remote debugging: their own tabs, signed in as them.",
+    "",
+    "## Find the page",
+    "",
+    "1. `list_pages` names every tab with a page id; the selected one is marked.",
+    "2. `select_page` with that id makes it the page every other tool acts on.",
+    "3. To load something new, `new_page` with the url. Do not `navigate_page` a tab",
+    "   the person already had open: that replaces what they were looking at.",
+    "",
+    "## Read before acting",
+    "",
+    "- `take_snapshot` returns the page as text, each element with a `uid`; prefer",
+    "  it to a screenshot. `click`, `fill`, `hover` and `fill_form` take those uids.",
+    "- A uid is valid for the snapshot it came from: after an action changes the",
+    "  page, take a fresh snapshot before the next one.",
+    "- `evaluate_script` runs a function in the page, for what a snapshot does not",
+    "  show: `() => document.title`.",
+    "- `list_console_messages` and `list_network_requests` read what the page logged",
+    "  and fetched; `get_network_request` reads one body.",
+    "- `take_screenshot` when the layout itself is the question.",
+    "",
+    "## The person's sessions",
+    "",
+    "Reading is free. Before a click or a script that submits, sends, buys,",
+    "deletes, approves or changes a setting, say what it will do and wait for the",
+    "person. Close the pages you opened with `close_page`; leave theirs.",
+    "",
+    "## When there is no Chrome",
+    "",
+    '"Could not connect to Chrome" means nothing listens on port 9222. Ask the',
+    "person to start Chrome in debug mode. Chrome refuses remote debugging on its",
+    "default profile, so it runs a profile of its own (signed in once, kept after):",
+    "",
+    "```bash",
+    'google-chrome --user-data-dir="$HOME/.config/google-chrome-debug" --remote-debugging-port=9222      # Linux',
+    'open -na "Google Chrome" --args --user-data-dir="$HOME/.chrome-debug" --remote-debugging-port=9222   # macOS',
+    "```",
+    "",
+    "On Windows: `chrome.exe --user-data-dir=%LOCALAPPDATA%\\chrome-debug --remote-debugging-port=9222`.",
+    "`curl -s http://127.0.0.1:9222/json/version` answers once it is up. The next",
+    "tool call connects; there is nothing to restart.",
+    "",
+    "If no `mcp__chrome-devtools__` tool is listed at all, dsh was started without",
+    "the Divergent overlay: `diverge agents run dsh` starts it with one.",
+    ""
+  ].join("\n")
+};
+function bundledSkills(harness) {
+  return harness === "dsh" ? [DIVERGE_SKILL, DRIVE_CHROME_SKILL] : [DIVERGE_SKILL];
+}
+
+// src/skills/install.ts
+import fs6 from "node:fs";
+import os3 from "node:os";
+import path5 from "node:path";
+
+// src/agents/dsh.ts
+var import_yaml = __toESM(require_dist(), 1);
+import fs5 from "node:fs";
+import { createRequire } from "node:module";
+import os2 from "node:os";
+import path4 from "node:path";
+
+// src/tools/settings.ts
+var BRIDGE_SCOPES = "mcp:read mcp:execute";
+var LOGIN_HINT = "diverge login";
+function loadToolsSettings(options, env = process.env) {
+  const apiUrl = resolveApiUrl(void 0, env);
+  const projectId = options.projectId?.trim() || env.DIVERGENT_PROJECT_ID?.trim() || void 0;
+  let organizationId = options.organizationId?.trim() || env.DIVERGENT_ORG_ID?.trim() || "";
+  const tokenFile = sessionTokenFile(env);
+  if (tokenFile) {
+    organizationId = sessionOrganization(tokenFile, readSessionToken(tokenFile), organizationId || void 0);
+    return { apiUrl, organizationId, projectId, mode: "session", tokenFile };
+  }
+  const cached = loadLogin(tokenSource(env, apiUrl));
+  if (cached) {
+    organizationId ||= cached.organization ?? "";
     if (!organizationId) throw new CliError(`The login has no default organization. Pass --organization-id or choose one:  diverge org use <id|name>`);
     return { apiUrl, organizationId, projectId, mode: "operator", clientId: clientId(env) };
   }
@@ -8429,10 +8412,10 @@ var ToolsClient = class {
     if (this.settings.mode === "service") headers["x-divergent-user-id"] = this.settings.delegatedUserId;
     return headers;
   }
-  scoped(path17) {
+  scoped(path18) {
     const query = new URLSearchParams({ organizationId: this.settings.organizationId });
     if (this.settings.projectId) query.set("projectId", this.settings.projectId);
-    return `${this.settings.apiUrl}${path17}?${query.toString()}`;
+    return `${this.settings.apiUrl}${path18}?${query.toString()}`;
   }
   async send(method, url, body) {
     return this.request(method, url, body, void 0);
@@ -8458,13 +8441,13 @@ var ToolsClient = class {
         this.serviceToken = null;
         continue;
       }
-      const text = await response.text();
+      const text2 = await response.text();
       if (!response.ok) {
-        const handled = refused?.(response.status, text);
+        const handled = refused?.(response.status, text2);
         if (handled !== void 0) return handled;
-        let message = text;
+        let message = text2;
         try {
-          const parsed = JSON.parse(text);
+          const parsed = JSON.parse(text2);
           if (typeof parsed.error === "string" && parsed.error) message = parsed.error;
         } catch {
         }
@@ -8474,7 +8457,7 @@ var ToolsClient = class {
         }
         throw new CliError(`${response.status}: ${message}`.slice(0, 2e3));
       }
-      return text ? JSON.parse(text) : {};
+      return text2 ? JSON.parse(text2) : {};
     }
     throw new CliError("Request failed after re-authentication");
   }
@@ -8487,10 +8470,10 @@ var ToolsClient = class {
    * a tool deployed after its server's catalog was read. A 404 is an answer.
    */
   describeTool(name) {
-    return this.request("GET", this.scoped(`/api/plugins/functions/tools/${encodeURIComponent(name)}`), void 0, (status2, text) => {
+    return this.request("GET", this.scoped(`/api/plugins/functions/tools/${encodeURIComponent(name)}`), void 0, (status2, text2) => {
       if (status2 !== 404) return void 0;
       try {
-        const parsed = JSON.parse(text);
+        const parsed = JSON.parse(text2);
         if (typeof parsed.error === "string" && parsed.error) return { notFound: parsed.error };
       } catch {
       }
@@ -8539,14 +8522,14 @@ var ToolsClient = class {
       "POST",
       this.descriptorsUrl(),
       { targetOrganizationId: this.settings.organizationId, manifest, dryRun: options.dryRun },
-      (status2, text) => {
+      (status2, text2) => {
         if (status2 !== 400) return void 0;
         try {
-          const parsed = JSON.parse(text);
+          const parsed = JSON.parse(text2);
           if (Array.isArray(parsed.details)) return { ok: false, details: parsed.details.map(String) };
-          return { ok: false, details: [parsed.error ?? text] };
+          return { ok: false, details: [parsed.error ?? text2] };
         } catch {
-          return { ok: false, details: [text] };
+          return { ok: false, details: [text2] };
         }
       }
     ).then((outcome) => "ok" in outcome ? outcome : { ok: true, result: outcome });
@@ -8564,7 +8547,7 @@ var ToolsClient = class {
 // src/agents/dsh.ts
 var DSH_SHIPPED_DEFAULT_MODEL = "deepseek-flash";
 function dshHome(env = process.env) {
-  return env.DSH_HOME?.trim() || path6.join(os4.homedir(), ".dsh");
+  return env.DSH_HOME?.trim() || path4.join(os2.homedir(), ".dsh");
 }
 function dshDefaultModel(models, requested) {
   if (requested) return requested;
@@ -8586,6 +8569,7 @@ function dshPatchYaml(options) {
     `        api: ${api}`,
     `        baseURL: ${endpoint}`,
     `        apiKeyEnv: ${tokenEnv}`,
+    ...options.launch ? dshLaunchHeaderRows(options.launch) : [],
     "        models:",
     ...options.models.flatMap((model) => [
       `          - id: ${JSON.stringify(model.id)}`,
@@ -8613,6 +8597,25 @@ function dshPatchYaml(options) {
     ""
   ].join("\n");
 }
+var DSH_LAUNCH_ID_HEADER = "x-divergent-launch-id";
+var DSH_CLIENT_HEADER = "x-divergent-client";
+function dshLaunchHeaderRows(launch) {
+  return [
+    "        headers:",
+    `          ${DSH_CLIENT_HEADER}: ${JSON.stringify(launch.client)}`,
+    `          ${DSH_LAUNCH_ID_HEADER}: ${JSON.stringify(launch.id)}`
+  ];
+}
+function dshVersionOf(binary) {
+  const dir = dshPackageDir(binary);
+  if (!dir) return null;
+  try {
+    const version = JSON.parse(fs5.readFileSync(path4.join(dir, "package.json"), "utf8")).version;
+    return typeof version === "string" && version.length > 0 ? version : null;
+  } catch {
+    return null;
+  }
+}
 function dshShellRows() {
   return ["bash-sandbox", "pwsh-sandbox"].flatMap((id) => [
     `- id: ${id}`,
@@ -8682,30 +8685,30 @@ var DIVERGENT_PRESET_ID = "divergent";
 var DSH_USER_PRESETS_DIR = ".agent-presets";
 function dshPackageDir(binary) {
   if (/\.(cmd|bat)$/i.test(binary)) {
-    const dir2 = path6.join(path6.dirname(binary), "node_modules", "@deepseek-ai", "dsh");
-    return fs5.existsSync(path6.join(dir2, "package.json")) ? dir2 : null;
+    const dir2 = path4.join(path4.dirname(binary), "node_modules", "@deepseek-ai", "dsh");
+    return fs5.existsSync(path4.join(dir2, "package.json")) ? dir2 : null;
   }
   let dir;
   try {
-    dir = path6.dirname(fs5.realpathSync(binary));
+    dir = path4.dirname(fs5.realpathSync(binary));
   } catch {
     return null;
   }
   for (; ; ) {
     try {
-      if (JSON.parse(fs5.readFileSync(path6.join(dir, "package.json"), "utf8")).name === "@deepseek-ai/dsh") return dir;
+      if (JSON.parse(fs5.readFileSync(path4.join(dir, "package.json"), "utf8")).name === "@deepseek-ai/dsh") return dir;
     } catch {
     }
-    const parent = path6.dirname(dir);
+    const parent = path4.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function shippedPresetDir(packageDir, id = "standard") {
   try {
-    const require2 = createRequire(path6.join(packageDir, "package.json"));
-    const dir = path6.join(path6.dirname(require2.resolve("@deepseek-ai/dsh-agent-presets/package.json")), "presets", id);
-    return fs5.existsSync(path6.join(dir, "agent.cordis.yml")) ? dir : null;
+    const require2 = createRequire(path4.join(packageDir, "package.json"));
+    const dir = path4.join(path4.dirname(require2.resolve("@deepseek-ai/dsh-agent-presets/package.json")), "presets", id);
+    return fs5.existsSync(path4.join(dir, "agent.cordis.yml")) ? dir : null;
   } catch {
     return null;
   }
@@ -8742,9 +8745,9 @@ var DIVERGENT_PRESET_METADATA = [
   ""
 ].join("\n");
 function writeDivergentPreset(home, shippedDir) {
-  const dir = path6.join(home, DSH_USER_PRESETS_DIR, DIVERGENT_PRESET_ID);
-  writeTextAtomic(path6.join(dir, "agent.cordis.yml"), divergentPreset(fs5.readFileSync(path6.join(shippedDir, "agent.cordis.yml"), "utf8")), 420);
-  writeTextAtomic(path6.join(dir, "preset.yml"), DIVERGENT_PRESET_METADATA, 420);
+  const dir = path4.join(home, DSH_USER_PRESETS_DIR, DIVERGENT_PRESET_ID);
+  writeTextAtomic(path4.join(dir, "agent.cordis.yml"), divergentPreset(fs5.readFileSync(path4.join(shippedDir, "agent.cordis.yml"), "utf8")), 420);
+  writeTextAtomic(path4.join(dir, "preset.yml"), DIVERGENT_PRESET_METADATA, 420);
   return dir;
 }
 function withDivergentPresetDefault(settingsText) {
@@ -8756,515 +8759,1069 @@ function withDivergentPresetDefault(settingsText) {
   return (0, import_yaml.stringify)(settings, { lineWidth: 0 });
 }
 
-// src/agents/opencode.ts
-import os5 from "node:os";
-import path7 from "node:path";
-function opencodeConfigPath() {
-  return path7.join(os5.homedir(), ".config", "opencode", "opencode.json");
+// src/skills/install.ts
+var HARNESSES = ["claude", "codex", "dsh"];
+var SKILLS_MANIFEST = ".diverge-skills.json";
+function skillsRoot(harness, env = process.env) {
+  switch (harness) {
+    case "claude":
+      return path5.join(env.CLAUDE_CONFIG_DIR?.trim() || path5.join(os3.homedir(), ".claude"), "skills");
+    case "codex":
+      return path5.join(env.CODEX_HOME?.trim() || path5.join(os3.homedir(), ".codex"), "skills");
+    case "dsh":
+      return path5.join(dshHome(env), "skills");
+  }
 }
-function mergeOpencodeConfig(existing, options) {
-  const tokenEnv = options.tokenEnv ?? "DIVERGENT_TOKEN";
-  const config = structuredClone(existing ?? {});
-  config.$schema ??= "https://opencode.ai/config.json";
-  const providers = { ...config.provider ?? {} };
-  const models = Object.fromEntries(options.models.map((model) => [model.id, {
-    name: model.id,
-    attachment: model.input.includes("image"),
-    modalities: { input: model.input, output: ["text"] },
-    ...model.contextWindow && model.maxOutputTokens ? { limit: { context: model.contextWindow, output: model.maxOutputTokens } } : {}
-  }]));
-  const options_ = { baseURL: `${options.baseUrl}/v1`, apiKey: `{env:${tokenEnv}}` };
-  providers[`divergent-${options.surface}`] = options.surface === "openai" ? { npm: "@ai-sdk/openai-compatible", name: "Divergent (OpenAI)", options: options_, models } : { npm: "@ai-sdk/anthropic", name: "Divergent (Anthropic)", options: options_, models };
-  config.provider = providers;
-  return config;
+function presentHarnesses(env = process.env) {
+  return HARNESSES.filter((harness) => fs6.existsSync(path5.dirname(skillsRoot(harness, env))));
 }
-
-// src/agents/run-dsh.ts
-import { spawn as spawn2 } from "node:child_process";
-import fs6 from "node:fs";
-import path8 from "node:path";
-function writeDshToken(credentialsPath, accessToken) {
-  const existing = fs6.existsSync(credentialsPath) ? fs6.readFileSync(credentialsPath, "utf8") : null;
-  let merged;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readSkillsManifest(root) {
+  let parsed;
   try {
-    merged = mergeDshCredentials(existing, accessToken);
-  } catch (error) {
-    throw new CliError(`${credentialsPath}: ${error instanceof Error ? error.message : String(error)}`);
+    parsed = JSON.parse(fs6.readFileSync(path5.join(root, SKILLS_MANIFEST), "utf8"));
+  } catch {
+    return null;
   }
-  writeTextAtomic(credentialsPath, merged, 384);
+  if (!isRecord(parsed)) return null;
+  const installedAt = typeof parsed.installedAt === "string" ? parsed.installedAt : "";
+  const source = typeof parsed.source === "string" ? parsed.source : "";
+  if (isRecord(parsed.organizations)) {
+    return {
+      installedAt,
+      source,
+      cli: isRecord(parsed.cli) ? parsed.cli : {},
+      organizations: parsed.organizations
+    };
+  }
+  if (isRecord(parsed.skills)) return { installedAt, source, cli: {}, organizations: {}, flat: parsed.skills };
+  return null;
 }
-function writeDivergeShim(binDir, cli, sessionTokenPath, platform = process.platform) {
-  if (platform === "win32") {
-    const file2 = path8.join(binDir, "diverge.cmd");
-    const run3 = [cli.command, ...cli.args].map((part) => `"${part}"`).join(" ");
-    writeTextAtomic(file2, `@setlocal\r
-@set "${SESSION_TOKEN_VARIABLE}=${sessionTokenPath}"\r
-@${run3} %*\r
-`, 493);
-    return file2;
+function few(names, limit = 6) {
+  return names.length <= limit ? names.join(", ") : `${names.slice(0, limit).join(", ")} and ${names.length - limit} more`;
+}
+function heldFolders(manifest) {
+  const held = /* @__PURE__ */ new Map();
+  for (const [folder, version] of Object.entries(manifest?.flat ?? {})) held.set(folder, version);
+  for (const [folder, version] of Object.entries(manifest?.cli ?? {})) held.set(folder, version);
+  for (const section of Object.values(manifest?.organizations ?? {})) for (const [folder, version] of Object.entries(section.skills)) held.set(folder, version);
+  return held;
+}
+function retirable(manifest, set2) {
+  const refreshed = new Set(set2.organizations.map((organization) => organization.id));
+  const folders = [...Object.keys(manifest?.flat ?? {}), ...Object.keys(manifest?.cli ?? {})];
+  for (const [id, section] of Object.entries(manifest?.organizations ?? {})) {
+    if (set2.complete || refreshed.has(id)) folders.push(...Object.keys(section.skills));
   }
-  const quote = (part) => `'${part.replace(/'/g, `'\\''`)}'`;
-  const file = path8.join(binDir, "diverge");
-  writeTextAtomic(file, `#!/bin/sh
-${SESSION_TOKEN_VARIABLE}=${quote(sessionTokenPath)}
-export ${SESSION_TOKEN_VARIABLE}
-exec ${[cli.command, ...cli.args].map(quote).join(" ")} "$@"
-`, 493);
-  return file;
+  return folders;
 }
-function dshEnv(env, binDir) {
-  const out = {};
-  for (const [key, value] of Object.entries(env)) {
-    if (value !== void 0 && key !== "DIVERGENT_TOKEN" && key !== "DIVERGENT_ORG_ID") out[key] = value;
+function installSkills(root, set2, source, now = () => /* @__PURE__ */ new Date()) {
+  const previous = readSkillsManifest(root);
+  const held = heldFolders(previous);
+  const written = [];
+  const added = [];
+  const updated = [];
+  const counts = [];
+  const write = (skill) => {
+    if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(skill.folder)) throw new Error(`skill folder ${JSON.stringify(skill.folder)} is not a folder name`);
+    writeTextAtomic(path5.join(root, skill.folder, "SKILL.md"), skill.content, 420);
+    written.push(skill.folder);
+    const before = held.get(skill.folder);
+    if (before === void 0) added.push(skill.folder);
+    else if (before !== skill.updatedAt) updated.push(skill.folder);
+  };
+  for (const organization of set2.organizations) {
+    organization.skills.forEach(write);
+    counts.push({ label: organization.name, count: organization.skills.length });
   }
-  out.PATH = env.PATH ? `${binDir}${path8.delimiter}${env.PATH}` : binDir;
-  return out;
-}
-function dshArgs(overlayPath, args) {
-  const rest = args.includes("--profile") ? args : args.length === 0 ? ["--profile", "web"] : ["--profile", "headless", ...args];
-  return ["--patch", overlayPath, ...rest];
-}
-function dshLaunch(binary, args, platform = process.platform, execPath = process.execPath) {
-  if (platform !== "win32" || !/\.(cmd|bat)$/i.test(binary)) return { command: binary, args };
-  const packageDir = path8.join(path8.dirname(binary), "node_modules", "@deepseek-ai", "dsh");
-  let bin;
-  try {
-    bin = JSON.parse(fs6.readFileSync(path8.join(packageDir, "package.json"), "utf8")).bin;
-  } catch {
-    throw new CliError(`${binary} is not an npm shim for @deepseek-ai/dsh (no ${packageDir}); reinstall: npm install -g @deepseek-ai/dsh`);
+  set2.cli.forEach(write);
+  if (set2.cli.length) counts.push({ label: "CLI", count: set2.cli.length });
+  const removed = [];
+  const kept = new Set(written);
+  for (const folder of retirable(previous, set2)) {
+    if (kept.has(folder) || removed.includes(folder)) continue;
+    fs6.rmSync(path5.join(root, folder), { recursive: true, force: true });
+    removed.push(folder);
+  }
+  const stamp = now().toISOString();
+  const refreshed = new Set(set2.organizations.map((organization) => organization.id));
+  const organizations = {};
+  if (!set2.complete) {
+    for (const [id, section] of Object.entries(previous?.organizations ?? {})) if (!refreshed.has(id)) organizations[id] = section;
+  }
+  for (const organization of set2.organizations) {
+    organizations[organization.id] = {
+      name: organization.name,
+      installedAt: stamp,
+      skills: Object.fromEntries(organization.skills.map((skill) => [skill.folder, skill.updatedAt]))
+    };
   }
-  const script = typeof bin === "string" ? bin : typeof bin === "object" && bin !== null ? bin.dsh : void 0;
-  if (typeof script !== "string") throw new CliError(`${packageDir}/package.json declares no dsh entry; reinstall: npm install -g @deepseek-ai/dsh`);
-  return { command: execPath, args: [path8.join(packageDir, script), ...args] };
+  const manifest = {
+    installedAt: stamp,
+    source,
+    cli: Object.fromEntries(set2.cli.map((skill) => [skill.folder, skill.updatedAt])),
+    organizations
+  };
+  writeJsonAtomic(path5.join(root, SKILLS_MANIFEST), manifest, 420);
+  return { root, written, added, updated, removed, counts };
 }
-async function keepTokenFresh(loop) {
-  let written = null;
-  while (loop.isRunning()) {
-    const token = await loop.freshToken();
-    if (token && token !== written) {
-      loop.write(token);
-      written = token;
-    }
-    for (let i = 0; i < 30; i += 1) {
-      if (!loop.isRunning()) return;
-      await loop.sleep(1e3);
-    }
+function skillsStatus(root, set2) {
+  const manifest = readSkillsManifest(root);
+  const held = heldFolders(manifest);
+  const current = [];
+  const behind = [];
+  const missing = [];
+  const served = [...set2.organizations.flatMap((organization) => organization.skills), ...set2.cli];
+  for (const skill of served) {
+    const before = held.get(skill.folder);
+    if (before === void 0 || !fs6.existsSync(path5.join(root, skill.folder, "SKILL.md"))) missing.push(skill.folder);
+    else if (before !== skill.updatedAt) behind.push(skill.folder);
+    else current.push(skill.folder);
   }
+  const servedFolders = new Set(served.map((skill) => skill.folder));
+  const retired = [...new Set(retirable(manifest, set2))].filter((folder) => !servedFolders.has(folder));
+  return { root, installedAt: manifest?.installedAt || null, current, behind, missing, retired };
 }
-function runDsh(options) {
-  const writeToken = (token) => {
-    writeDshToken(options.credentialsPath, token);
-    writeTextAtomic(options.sessionTokenPath, `${token}
-`, 384);
-  };
-  writeToken(options.initialToken);
-  writeDivergeShim(options.binDir, options.cli, options.sessionTokenPath);
-  const env = dshEnv(options.env, options.binDir);
-  const launch = dshLaunch(options.binary, dshArgs(options.overlayPath, options.args));
-  const child = spawn2(launch.command, launch.args, { env, stdio: "inherit" });
-  let exited = false;
-  let wake = null;
-  const finish = () => {
-    exited = true;
-    wake?.();
-  };
-  const done = new Promise((resolve, reject) => {
-    child.on("error", (error) => {
-      finish();
-      reject(error);
-    });
-    child.on("exit", (code2, signal) => {
-      finish();
-      resolve(code2 ?? (signal ? 128 + 15 : 1));
-    });
-  });
-  const ignore = () => {
-  };
-  process.on("SIGINT", ignore);
-  const terminate = () => child.kill("SIGTERM");
-  process.on("SIGTERM", terminate);
-  const loop = keepTokenFresh({
-    freshToken: options.freshToken,
-    write: writeToken,
-    isRunning: () => !exited,
-    sleep: (ms) => new Promise((resolve) => {
-      const timer = setTimeout(() => {
-        wake = null;
-        resolve();
-      }, ms);
-      wake = () => {
-        clearTimeout(timer);
-        wake = null;
-        resolve();
-      };
-    })
-  });
-  return done.finally(async () => {
-    process.off("SIGINT", ignore);
-    process.off("SIGTERM", terminate);
-    await loop;
-  });
+
+// src/skills/installable.ts
+async function fetchInstallableSkills(baseUrl, accessToken) {
+  const body = await fetchJson(
+    `${baseUrl.replace(/\/+$/, "")}/api/plugins/symphony/skills/installable`,
+    { headers: { Authorization: `Bearer ${accessToken}` } }
+  );
+  if (!body.success || !body.data) throw new CliError(body.error ?? "The platform answered without skills");
+  if (!body.data.organization) throw new CliError("The platform answered without the organization of its skills: it runs an older release than this CLI; refresh again after its next deploy");
+  return body.data;
 }
 
-// src/fs/path.ts
-import fs7 from "node:fs";
-import path9 from "node:path";
-function findOnPath(name, env = process.env, platform = process.platform) {
-  const dirs = (env.PATH ?? "").split(path9.delimiter).filter(Boolean);
-  const extensions = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
-  const candidates = platform === "win32" ? extensions.map((extension) => `${name}${extension.toLowerCase()}`) : [name];
-  for (const dir of dirs) {
-    for (const candidate of candidates) {
-      const full = path9.join(dir, candidate);
-      try {
-        fs7.accessSync(full, fs7.constants.X_OK);
-        if (fs7.statSync(full).isFile()) return full;
-      } catch {
+// src/skills/login-skills.ts
+async function collectLoginSkills(deps, options = {}) {
+  const reachable = await deps.organizations();
+  let chosen = reachable;
+  const narrow = options.organizationId?.trim();
+  if (narrow) {
+    const choice = chooseOrganization({ flag: narrow, organizations: reachable });
+    if (choice.kind !== "chosen") throw new CliError(`Not one of your organizations: ${narrow}`);
+    chosen = reachable.filter((organization) => organization.id === choice.organizationId);
+  }
+  const organizations = [];
+  const notes = [];
+  let unanswered = 0;
+  for (const organization of chosen) {
+    try {
+      const served = await deps.installable(organization.id);
+      organizations.push({ id: organization.id, name: served.organization.name, skills: served.skills });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (deps.refused(error)) {
+        organizations.push({ id: organization.id, name: organization.name, skills: [] });
+        notes.push(`${organization.name}: not served (${message})`);
+      } else {
+        unanswered += 1;
+        notes.push(`${organization.name}: not refreshed (${message})`);
       }
     }
   }
-  return null;
+  return { organizations, notes, complete: !narrow && unanswered === 0 };
 }
 
 // src/commands/skills.ts
-import { parseArgs as parseArgs2 } from "node:util";
-
-// src/skills/bundled.ts
-var DIVERGE_SKILL = {
-  name: "diverge",
-  description: "Reach the Divergent platform's tools from a shell with the diverge CLI: discover, read one schema, call, and read back a call that waits on a person. Use when a task needs the organization's records, diagnostics, documents or governed actions, which the platform holds and this skill's siblings name.",
-  tools: [],
-  updatedAt: `diverge/${VERSION}`,
-  content: `---
-name: diverge
-description: Reach the Divergent platform's tools from a shell with the diverge CLI - discover, read one schema, call, and read back a call that waits on a person. Use when a task needs the organization's records, diagnostics, documents or governed actions, which the platform holds and this skill's siblings name.
----
-
-# diverge: the platform's tools from a shell
-
-The organization's tools run on the platform, as the signed-in person, with
-their permissions and audit trail. Nothing runs locally; the CLI is the
-transport. Keep the catalog out of context: pull the one schema you need.
-
-\`\`\`bash
-diverge tools list --filter <word>     # find candidates by name or description
-diverge tools describe <tool>          # the one schema, on demand
-diverge tools call <tool> --args-file args.json --json   # arguments from a file, one JSON outcome out
-diverge tools call search_online --args-json '{"query": "..."}'   # web search is a platform tool too
-\`\`\`
-
-The other skills installed beside this one are the organization's own
-procedures; each names the tools it is about. Prefer a procedure over
-guessing a tool.
-
-## Arguments: pipe them through stdin
-
-Shells mangle JSON. Windows PowerShell strips the double quotes inside an
-inline argument, so \`--args-json '{"a":"b"}'\` can arrive as \`{a:b}\`.
-Pipe the object to \`--args-json -\` from a heredoc (a here-string on
-PowerShell): exact on every shell, and no file to keep. A worked call:
-
-\`\`\`bash
-diverge tools describe forge_query_issues
-diverge tools call forge_query_issues --args-json - --json <<'JSON'
-{"query": "sync failed", "limit": 20}
-JSON
-\`\`\`
+var skillsUsage = `diverge skills <list|install|refresh|status> [--organization-id <id|name>] [--harness claude,codex,dsh] [--into <dir>]
 
-\`--args-file <path>\` reads a file you already have. Keep anything a later
-command needs under the working directory: a sandboxed harness runs each
-command in a fresh sandbox, and its \`/tmp\` is gone when the command ends.
-
-## Read the outcome from stdout with --json
-
-\`call --json\` prints exactly one JSON object on stdout whatever happens,
-errors included: \`{"tool", "status", "result"?, "error"?, "invocationId"?,
-"decideAt"?}\`, where status is executed, pending, rejected, expired or failed.
-\`result\` is the tool's payload exactly as the tool returned it: the CLI
-unwraps the platform's envelope and nothing inside. Its shape is the tool's
-own and differs by tool and plugin \u2014 one returns its records under \`data\`,
-another at the top level \u2014 so read a tool's shape from its own answer, not
-from the last tool's. Parse stdout alone; stderr only carries the scope and
-identity lines. Without \`--json\`, errors are text on stderr.
-
-## Several related writes: one set, one decision
-
-When two or more writes serve one intent \u2014 assign a role to several groups,
-deactivate several users, set several notification routes \u2014 raise them as
-one set, never one call per write: the person approves the set once instead
-of clicking through one card each.
+  list      the skills the platform serves you: in every organization you can act in, the skills whose tools you can run
+  install   write them, and the CLI's own skills ("diverge"; "drive-chrome" for dsh), into each harness's user skill folder
+            (~/.claude/skills, ~/.codex/skills, $DSH_HOME/skills), side by side under each organization's prefix;
+            retires what an organization stopped serving; reports what changed \u2014 the full list is \`skills list\`
+  refresh   the same, best effort: no login, no network or nothing changed prints nothing and never fails.
+            Runs at sign-in and at every session start, so the folders hold what the organizations serve now
+  status    what each folder holds against what the platform serves now
 
-\`\`\`bash
-diverge tools set - --summary "Coordinators get the field role" --json <<'JSON'
-[{"tool": "rbac_assign_role_to_group", "args": {"roleId": "r1", "groupId": "g1"}},
- {"tool": "rbac_assign_role_to_group", "args": {"roleId": "r1", "groupId": "g2"}}]
-JSON
-\`\`\`
+A skill is a procedure over the tools it names; you get the ones whose every
+tool you may run, in every organization the login can act in. Each lands as
+<organization prefix>-<name> \u2014 the organization's short code, or a slug of
+its name \u2014 and its SKILL.md opens with the organization its tools run in.
+--organization-id refreshes one organization and leaves the others as they
+are; without it the whole login is refreshed, and an organization the login
+no longer lists is retired. Without --harness, the harnesses present on this
+machine are written; name one to write it anyway.`;
+function narrowedOrganization(flag, env) {
+  return flag?.trim() || env.DIVERGENT_ORG_ID?.trim() || void 0;
+}
+function loginDeps(apiUrl, env) {
+  const source = tokenSource(env, apiUrl);
+  return {
+    organizations: async () => {
+      const token = await getUserToken(source);
+      if (source.sessionTokenFile) {
+        const organizationId = tokenClaims(token.access_token).organizationId;
+        if (!organizationId) throw new CliError("The session token names no organization");
+        return [{ id: organizationId, name: organizationId }];
+      }
+      return (await fetchUserInfo(source.baseUrl, token.access_token)).organizations ?? [];
+    },
+    installable: async (organizationId) => {
+      const token = await getUserToken(source, { organizationId });
+      return fetchInstallableSkills(apiUrl, token.access_token);
+    },
+    refused: (error) => error instanceof NotGrantedError || error instanceof HttpError && error.status === 403
+  };
+}
+async function loginSkillSet(apiUrl, env, organizationId) {
+  return collectLoginSkills(loginDeps(apiUrl, env), { organizationId });
+}
+function harnessesOf(flag, env) {
+  if (!flag) return presentHarnesses(env);
+  const chosen = flag.split(",").map((name) => name.trim()).filter(Boolean);
+  for (const name of chosen) if (!HARNESSES.includes(name)) throw new CliError(`--harness must name some of: ${HARNESSES.join(", ")}`);
+  return chosen;
+}
+function installSet(harness, skills) {
+  return { cli: bundledSkills(harness), organizations: skills.organizations, complete: skills.complete };
+}
+function installReport(harness, result) {
+  const holdings = result.counts.map((entry) => `${entry.label} ${entry.count}`).join(", ");
+  const changes = [
+    ...result.added.length ? [`${result.added.length} new: ${few(result.added)}`] : [],
+    ...result.updated.length ? [`${result.updated.length} updated: ${few(result.updated)}`] : [],
+    ...result.removed.length ? [`${result.removed.length} retired: ${few(result.removed)}`] : []
+  ];
+  return `${harness}: ${result.written.length} skills in ${result.root} (${holdings}${changes.length ? `; ${changes.join("; ")}` : "; unchanged"})`;
+}
+function installForHarness(io, harness, skills, apiUrl, into) {
+  const result = installSkills(into ?? skillsRoot(harness, io.env), installSet(harness, skills), apiUrl);
+  io.stdout(installReport(harness, result));
+  return result;
+}
+async function refreshSkills(io, apiUrl, options = {}) {
+  const harnesses = presentHarnesses(io.env);
+  if (harnesses.length === 0) {
+    if (!options.quiet) io.stdout("No coding-agent harness on this machine yet (Claude Code, Codex or dsh); run `diverge skills install --harness <name>` once one is.");
+    return;
+  }
+  let skills;
+  try {
+    skills = await loginSkillSet(apiUrl, io.env, options.organizationId);
+  } catch (error) {
+    io.stderr(`warning: skills not refreshed (${error instanceof Error ? error.message : String(error)}); run: diverge skills install`);
+    return;
+  }
+  for (const harness of harnesses) {
+    const result = installSkills(skillsRoot(harness, io.env), installSet(harness, skills), apiUrl);
+    if (!options.quiet || result.added.length || result.updated.length || result.removed.length) io.stdout(installReport(harness, result));
+  }
+  for (const note of skills.notes) io.stderr(`warning: ${note}`);
+}
+async function runSkills(args, io) {
+  const [verb, ...rest] = args;
+  const { values } = parseArgs({ args: rest, options: { "organization-id": { type: "string" }, harness: { type: "string" }, into: { type: "string" } }, strict: true });
+  const apiUrl = resolveApiUrl(void 0, io.env);
+  const organizationId = narrowedOrganization(values["organization-id"], io.env);
+  switch (verb) {
+    case "list": {
+      const skills = await loginSkillSet(apiUrl, io.env, organizationId);
+      io.stdout(`Skills the platform serves you, after the CLI's own (${bundledSkills("dsh").map((skill) => skill.name).join("; ")}):`);
+      for (const organization of skills.organizations) {
+        io.stdout(`${organization.name} (${organization.id}): ${organization.skills.length} skills`);
+        for (const skill of organization.skills) io.stdout(`  ${skill.folder.padEnd(40)} ${skill.tools.join(", ")}`);
+      }
+      for (const note of skills.notes) io.stdout(note);
+      return ExitCode.Ok;
+    }
+    case "install": {
+      const skills = await loginSkillSet(apiUrl, io.env, organizationId);
+      const harnesses = values.into ? [harnessesOf(values.harness ?? HARNESSES[0], io.env)[0]] : harnessesOf(values.harness, io.env);
+      if (harnesses.length === 0) throw new CliError("No coding-agent harness on this machine yet (Claude Code, Codex or dsh); name one with --harness to write its folder anyway.");
+      for (const harness of harnesses) installForHarness(io, harness, skills, apiUrl, values.into);
+      for (const note of skills.notes) io.stderr(`warning: ${note}`);
+      return ExitCode.Ok;
+    }
+    case "refresh": {
+      await refreshSkills(io, apiUrl, { organizationId, quiet: true });
+      return ExitCode.Ok;
+    }
+    case "status": {
+      const skills = await loginSkillSet(apiUrl, io.env, organizationId);
+      let behind = false;
+      for (const harness of harnessesOf(values.harness, io.env)) {
+        const status2 = skillsStatus(values.into ?? skillsRoot(harness, io.env), installSet(harness, skills));
+        const parts = [`${status2.current.length} current`];
+        if (status2.behind.length) parts.push(`${status2.behind.length} behind (${few(status2.behind)})`);
+        if (status2.missing.length) parts.push(`${status2.missing.length} missing${status2.current.length || status2.behind.length ? ` (${few(status2.missing)})` : ""}`);
+        if (status2.retired.length) parts.push(`${status2.retired.length} retired (${few(status2.retired)})`);
+        behind ||= status2.behind.length + status2.missing.length + status2.retired.length > 0;
+        io.stdout(`${harness}: ${parts.join(", ")} in ${status2.root}${status2.installedAt ? ` (installed ${status2.installedAt})` : " (never installed)"}`);
+      }
+      for (const note of skills.notes) io.stdout(note);
+      if (behind) io.stdout("Run: diverge skills install");
+      return ExitCode.Ok;
+    }
+    default:
+      throw unknownVerb("skills", skillsUsage, [], verb, rest);
+  }
+}
 
-The set answers like one call (exit 3 while it waits, one invocation id).
-Once approved its calls run in order and stop at the first failure; read
-every call's outcome \u2014 succeeded, failed, or not_run \u2014 from \`result.calls\`
-with \`diverge tools invocation <id>\`. Arguments are frozen when you raise
-the set, so a call cannot use an id an earlier call creates: raise that one
-after the first ran. A set carries writes only; reads, and prepared writes
-that propose a Forge Change, are called on their own.
+// src/commands/login.ts
+var loginUsage = `diverge login [--organization-id <id|name>] [--scopes "<scopes>"] [--as <email>] [--no-browser] [--api-url <url>]
 
-## Several independent calls at once
-
-When a task needs a sequence of reads or unrelated calls, pipe them to
-\`diverge tools run -\` once instead of one round trip each (or name a file):
-a JSON array of \`{"tool": "...", "args": {...}}\`, or one per line. Calls run
-in order; each prints one JSON line of outcome, the same shape as
-\`call --json\`; the exit code is the worst of them. Each write in a run is
-its own decision, so related writes belong in a set.
-
-## Exit codes are the contract
+Sign in through the browser, then choose where to act. The browser only
+authenticates the person; the organization is chosen here afterwards \u2014 the
+one named by --organization-id (id or name), else the last login's, else the
+only membership, else a menu. The login itself is yours, not an
+organization's; the default is a local preference.
+That is the default: commands act there unless they name another with
+--organization-id or DIVERGENT_ORG_ID. Change it with: diverge org use <id|name>.
+Signing in also installs the login's skills \u2014 every organization it can act
+in, side by side \u2014 into the coding-agent harnesses on this machine.
+--as <email> names the account: the platform signs that account in instead of
+reusing whatever session the browser holds, and issues nothing to any other.
+Without --as, the account of the last login is used; switching is explicit.
+Without --scopes, the login asks for the scopes the platform registers for
+this CLI \u2014 everything it and forge use \u2014 and holds what your roles grant; a
+scope the platform adds later reaches this login on its next refresh.
+--scopes asks for less, deliberately, and the login stays that narrow.
+--api-url signs in to another deployment (a test stack, say). Each deployment
+keeps its own login, so this never replaces another one; commands reach it
+when DIVERGENT_API_URL names it.`;
+function resolveScopes(flag) {
+  const explicit = flag?.trim();
+  return explicit ? explicit.split(/\s+/).join(" ") : void 0;
+}
+function resolveLoginHint(flag, previous) {
+  const explicit = flag?.trim().toLowerCase();
+  if (explicit) return explicit;
+  const remembered = previous.account?.trim().toLowerCase();
+  return remembered || void 0;
+}
+async function runLogin(args, io) {
+  refuseInSession(io.env, "login");
+  const { values } = parseArgs2({
+    args,
+    options: {
+      "organization-id": { type: "string" },
+      scopes: { type: "string" },
+      as: { type: "string" },
+      "no-browser": { type: "boolean", default: false },
+      "api-url": { type: "string" }
+    },
+    strict: true,
+    allowPositionals: false
+  });
+  const apiUrl = resolveApiUrl(values["api-url"], io.env);
+  const source = tokenSource(io.env, apiUrl);
+  const previous = loadLogin(source);
+  const loginHint = resolveLoginHint(values.as, { account: previous?.account });
+  if (loginHint) io.stdout(`Signing in as ${loginHint}${values.as ? "" : " (the last login; pass --as to switch)"}.`);
+  const scopes = resolveScopes(values.scopes);
+  io.stdout(scopes ? `Asking for scopes: ${scopes}.` : "Asking for the scopes the platform registers for this CLI.");
+  const signIn = await login({
+    baseUrl: apiUrl,
+    clientId: source.clientId,
+    scopes,
+    openBrowser: !values["no-browser"],
+    loginHint,
+    print: io.stdout
+  });
+  let info;
+  try {
+    info = await fetchUserInfo(apiUrl, signIn.token.access_token);
+  } catch (error) {
+    throw new CliError(`Signed in, but the platform could not say who or where (${error instanceof Error ? error.message : String(error)}); run: diverge login`);
+  }
+  io.stdout(`Signed in as: ${info.email}`);
+  const organizationId = await chooseDefaultOrganization(io, values["organization-id"], previous?.organization, info);
+  const issued = await issueToken(source, { base_url: source.baseUrl, refresh_token: signIn.refreshToken, account: info.email }, organizationId);
+  saveLogin(source, { ...issued.record, organization: organizationId });
+  saveOrganizationToken(source, organizationId, issued.token);
+  io.stdout(`Logged in to ${apiUrl}.`);
+  if (apiUrl !== resolveApiUrl(void 0, io.env)) io.stdout(`Commands reach this deployment with DIVERGENT_API_URL=${apiUrl}.`);
+  const granted = new Set(tokenClaims(issued.token.access_token).scopes ?? []);
+  io.stdout(`Scopes: ${[...granted].join(" ") || "none"}`);
+  const missing = (scopes ?? "").split(" ").filter((scope) => scope && !granted.has(scope));
+  if (missing.length) io.stderr(`Not granted at this organization (your roles lack them): ${missing.join(" ")}`);
+  await refreshSkills(io, apiUrl);
+  return 0;
+}
+async function chooseDefaultOrganization(io, flag, remembered, info) {
+  let choice = chooseOrganization({ flag, remembered, organizations: info.organizations ?? [] });
+  if (choice.kind === "none") {
+    throw new CliError("You are not a member of any organization; ask an administrator to add you, then sign in again.");
+  }
+  if (choice.kind === "ask") {
+    if (!io.interactive) {
+      throw new CliError(`You may act in several organizations; pass --organization-id <id|name>:
+${organizationMenu(choice.options).join("\n")}`);
+    }
+    io.stdout("Choose the organization to act in:");
+    for (const line of organizationMenu(choice.options)) io.stdout(line);
+    const picked = pickFromMenu(await ask("Organization (number, id or name): "), choice.options);
+    choice = { kind: "chosen", organizationId: picked.id, name: picked.name, reason: "flag" };
+  }
+  const label = choice.name ? `${choice.name} (${choice.organizationId})` : choice.organizationId;
+  const why = choice.reason === "remembered" ? " (the last login; pass --organization-id to switch)" : choice.reason === "only" ? " (your only organization)" : "";
+  io.stdout(`Organization: ${label}${why}`);
+  return choice.organizationId;
+}
 
-| Code | Meaning | Do |
-| --- | --- | --- |
-| 0 | executed | use the result |
-| 3 | pending: a person must decide it in Compass | hand over the printed link, keep working, read it back later |
-| 4 | rejected, with the person's reason | re-plan; the reason is data |
-| 5 | expired: nobody decided in time | raise a fresh call if still needed |
-| 1 | executed but failed, or a transport error | read the message; do not re-raise blindly |
+// src/gateway/urls.ts
+var SURFACES = ["anthropic", "openai"];
+var INFERENCE_SCOPE = "inference:execute";
+function anthropicBaseUrl(apiUrl) {
+  return `${apiUrl.replace(/\/+$/, "")}/api/plugins/inference/anthropic`;
+}
+function openaiBaseUrl(apiUrl) {
+  return `${apiUrl.replace(/\/+$/, "")}/api/plugins/inference/openai`;
+}
+function surfaceBaseUrl(apiUrl, surface) {
+  return surface === "openai" ? openaiBaseUrl(apiUrl) : anthropicBaseUrl(apiUrl);
+}
 
-A pending call prints its invocation id and a link. Read the outcome with
-\`diverge tools invocation <id>\` (add \`--wait\` to poll at the platform's
-cadence). Never decide your own invocation from any surface you can drive.
+// src/gateway/models.ts
+function servedModel(record) {
+  return {
+    id: record.id,
+    input: record.input_modalities?.includes("image") ? ["text", "image"] : ["text"],
+    ...record.context_window ? { contextWindow: record.context_window } : {},
+    ...record.max_output_tokens ? { maxOutputTokens: record.max_output_tokens } : {}
+  };
+}
+async function listModels(apiUrl, accessToken, surface) {
+  try {
+    const body = await fetchJson(`${surfaceBaseUrl(apiUrl, surface)}/v1/models`, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    return body.data ?? [];
+  } catch (error) {
+    if (error instanceof HttpError) {
+      const hint = error.status === 403 && /scope/i.test(error.message) ? " \u2014 the token needs inference:execute and your role needs inference_models:execute" : "";
+      throw new CliError(`Gateway refused (${error.status}): ${error.message}${hint}`);
+    }
+    throw error;
+  }
+}
+async function ensureInferenceLogin(io, apiUrl, organizationId) {
+  const source = tokenSource(io.env, apiUrl);
+  if (!source.sessionTokenFile && !loadLogin(source)) {
+    if (!io.interactive) throw new CliError(`Not signed in to ${apiUrl}. Run: diverge login${organizationId ? ` --organization-id ${organizationId}` : ""}`);
+    await runLogin(organizationId ? ["--organization-id", organizationId] : [], io);
+  }
+  const token = await getUserToken(source, { organizationId });
+  const claims = tokenClaims(token.access_token);
+  if (!claims.organizationId) throw new CliError("The login has no default organization; run: diverge org use <id|name>");
+  if (!(claims.scopes ?? []).includes(INFERENCE_SCOPE)) {
+    throw new CliError(`The token for organization ${claims.organizationId} carries no ${INFERENCE_SCOPE}: your roles there lack inference_models:execute, or the login asked for less (re-run: diverge login).`);
+  }
+  return token;
+}
 
-## Session
+// src/agents/claude.ts
+import os4 from "node:os";
+import path6 from "node:path";
+var CLAUDE_MODEL_DISCOVERY_FLAG = "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY";
+function claudeSettingsPath(scope, cwd = process.cwd()) {
+  return scope === "user" ? path6.join(os4.homedir(), ".claude", "settings.json") : path6.join(cwd, ".claude", "settings.local.json");
+}
+var SKILLS_REFRESH_MATCHER = "startup|resume";
+function isSkillsRefreshHook(hook) {
+  return typeof hook === "object" && hook !== null && typeof hook.command === "string" && /(^|\s)skills refresh$/.test(hook.command);
+}
+function withSkillsRefreshHook(hooks, command) {
+  const all = typeof hooks === "object" && hooks !== null ? structuredClone(hooks) : {};
+  const entries = Array.isArray(all.SessionStart) ? all.SessionStart : [];
+  const kept = entries.map((entry) => {
+    if (typeof entry !== "object" || entry === null || !Array.isArray(entry.hooks)) return entry;
+    return { ...entry, hooks: entry.hooks.filter((hook) => !isSkillsRefreshHook(hook)) };
+  }).filter((entry) => !(typeof entry === "object" && entry !== null && Array.isArray(entry.hooks) && entry.hooks.length === 0));
+  kept.push({ matcher: SKILLS_REFRESH_MATCHER, hooks: [{ type: "command", command, timeout: 30 }] });
+  all.SessionStart = kept;
+  return all;
+}
+function mergeClaudeSettings(existing, options) {
+  const settings = structuredClone(existing ?? {});
+  const env = { ...settings.env ?? {} };
+  const warnings = [];
+  env.ANTHROPIC_BASE_URL = options.baseUrl;
+  if (options.projectId) env.ANTHROPIC_CUSTOM_HEADERS = `x-project-id: ${options.projectId}`;
+  else delete env.ANTHROPIC_CUSTOM_HEADERS;
+  if (options.modelDiscovery) env[CLAUDE_MODEL_DISCOVERY_FLAG] = "1";
+  else delete env[CLAUDE_MODEL_DISCOVERY_FLAG];
+  if (env.ANTHROPIC_API_KEY || env.ANTHROPIC_AUTH_TOKEN) {
+    warnings.push("env.ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN is set in these settings and would shadow the platform token; remove it");
+  }
+  settings.env = env;
+  settings.apiKeyHelper = options.tokenHelper;
+  if (options.skillsRefresh) settings.hooks = withSkillsRefreshHook(settings.hooks, options.skillsRefresh);
+  return { settings, warnings };
+}
 
-- \`diverge status\` says who is signed in and at which organization; a call
-  that names none runs there. To act in another organization, pass
-  \`--organization-id <id>\` (or set \`DIVERGENT_ORG_ID\`) on the call; that
-  never changes the default. \`diverge org use <id|name>\` changes it for
-  every session on the machine, so leave it to the person.
-- A missing login or scope prints the command to run; \`diverge login\` opens
-  the browser.
-- \`--json\` on \`list\`, \`describe\` and \`invocation\` gives raw records.
-`
-};
-var DRIVE_CHROME_DESCRIPTION = "Control the Chrome the person runs in debug mode (remote debugging on port 9222) through the mcp__chrome-devtools__ tools - list and pick tabs, open and navigate pages, read a page, click, fill forms, run JavaScript, read console and network, take screenshots and performance traces. Use when a task needs to look at or act in a web page, debug a UI, or reproduce a browser problem.";
-var DRIVE_CHROME_SKILL = {
-  name: "drive-chrome",
-  description: DRIVE_CHROME_DESCRIPTION,
-  tools: [],
-  updatedAt: `diverge/${VERSION}`,
-  content: [
-    "---",
-    "name: drive-chrome",
-    `description: ${DRIVE_CHROME_DESCRIPTION}`,
-    "---",
-    "",
-    "# drive-chrome: the person's Chrome",
-    "",
-    "The `mcp__chrome-devtools__*` tools act in a Chrome the person started with",
-    "remote debugging: their own tabs, signed in as them.",
-    "",
-    "## Find the page",
-    "",
-    "1. `list_pages` names every tab with a page id; the selected one is marked.",
-    "2. `select_page` with that id makes it the page every other tool acts on.",
-    "3. To load something new, `new_page` with the url. Do not `navigate_page` a tab",
-    "   the person already had open: that replaces what they were looking at.",
-    "",
-    "## Read before acting",
-    "",
-    "- `take_snapshot` returns the page as text, each element with a `uid`; prefer",
-    "  it to a screenshot. `click`, `fill`, `hover` and `fill_form` take those uids.",
-    "- A uid is valid for the snapshot it came from: after an action changes the",
-    "  page, take a fresh snapshot before the next one.",
-    "- `evaluate_script` runs a function in the page, for what a snapshot does not",
-    "  show: `() => document.title`.",
-    "- `list_console_messages` and `list_network_requests` read what the page logged",
-    "  and fetched; `get_network_request` reads one body.",
-    "- `take_screenshot` when the layout itself is the question.",
-    "",
-    "## The person's sessions",
-    "",
-    "Reading is free. Before a click or a script that submits, sends, buys,",
-    "deletes, approves or changes a setting, say what it will do and wait for the",
-    "person. Close the pages you opened with `close_page`; leave theirs.",
-    "",
-    "## When there is no Chrome",
-    "",
-    '"Could not connect to Chrome" means nothing listens on port 9222. Ask the',
-    "person to start Chrome in debug mode. Chrome refuses remote debugging on its",
-    "default profile, so it runs a profile of its own (signed in once, kept after):",
-    "",
-    "```bash",
-    'google-chrome --user-data-dir="$HOME/.config/google-chrome-debug" --remote-debugging-port=9222      # Linux',
-    'open -na "Google Chrome" --args --user-data-dir="$HOME/.chrome-debug" --remote-debugging-port=9222   # macOS',
-    "```",
-    "",
-    "On Windows: `chrome.exe --user-data-dir=%LOCALAPPDATA%\\chrome-debug --remote-debugging-port=9222`.",
-    "`curl -s http://127.0.0.1:9222/json/version` answers once it is up. The next",
-    "tool call connects; there is nothing to restart.",
+// src/agents/codex.ts
+import os5 from "node:os";
+import path7 from "node:path";
+var CODEX_BLOCK_START = "# >>> divergent >>>";
+var CODEX_BLOCK_END = "# <<< divergent <<<";
+function codexConfigPath() {
+  return path7.join(os5.homedir(), ".codex", "config.toml");
+}
+var tomlString = (value) => JSON.stringify(value);
+function codexProviderToml(options) {
+  const lines = [
+    CODEX_BLOCK_START,
+    "[model_providers.divergent]",
+    'name = "Divergent"',
+    `base_url = ${tomlString(`${options.openaiBaseUrl}/v1`)}`,
+    'wire_api = "responses"'
+  ];
+  if (options.projectId) lines.push(`http_headers = { "x-project-id" = ${tomlString(options.projectId)} }`);
+  lines.push(
     "",
-    "If no `mcp__chrome-devtools__` tool is listed at all, dsh was started without",
-    "the Divergent overlay: `diverge agents run dsh` starts it with one.",
+    "[model_providers.divergent.auth]",
+    `command = ${tomlString(options.self.command)}`,
+    `args = [${[...options.self.args, "token", ...options.organizationId ? ["--organization-id", options.organizationId] : []].map(tomlString).join(", ")}]`,
+    "refresh_interval_ms = 600000",
+    CODEX_BLOCK_END,
     ""
-  ].join("\n")
-};
-function bundledSkills(harness) {
-  return harness === "dsh" ? [DIVERGE_SKILL, DRIVE_CHROME_SKILL] : [DIVERGE_SKILL];
+  );
+  return lines.join("\n");
+}
+function mergeCodexConfig(existing, block) {
+  const text2 = existing ?? "";
+  const start = text2.indexOf(CODEX_BLOCK_START);
+  const endIndex = text2.indexOf(CODEX_BLOCK_END);
+  if (start !== -1 && endIndex !== -1 && endIndex > start) {
+    let end = endIndex + CODEX_BLOCK_END.length;
+    if (text2[end] === "\n") end += 1;
+    return text2.slice(0, start) + block + text2.slice(end);
+  }
+  const separator = !text2 || text2.endsWith("\n") ? "" : "\n";
+  return text2 + separator + (text2 ? "\n" : "") + block;
 }
 
-// src/skills/install.ts
-import fs8 from "node:fs";
+// src/agents/opencode.ts
 import os6 from "node:os";
-import path10 from "node:path";
-var HARNESSES = ["claude", "codex", "dsh"];
-var SKILLS_MANIFEST = ".diverge-skills.json";
-function skillsRoot(harness, env = process.env) {
-  switch (harness) {
-    case "claude":
-      return path10.join(env.CLAUDE_CONFIG_DIR?.trim() || path10.join(os6.homedir(), ".claude"), "skills");
-    case "codex":
-      return path10.join(env.CODEX_HOME?.trim() || path10.join(os6.homedir(), ".codex"), "skills");
-    case "dsh":
-      return path10.join(dshHome(env), "skills");
+import path8 from "node:path";
+function opencodeConfigPath() {
+  return path8.join(os6.homedir(), ".config", "opencode", "opencode.json");
+}
+function mergeOpencodeConfig(existing, options) {
+  const tokenEnv = options.tokenEnv ?? "DIVERGENT_TOKEN";
+  const config = structuredClone(existing ?? {});
+  config.$schema ??= "https://opencode.ai/config.json";
+  const providers = { ...config.provider ?? {} };
+  const models = Object.fromEntries(options.models.map((model) => [model.id, {
+    name: model.id,
+    attachment: model.input.includes("image"),
+    modalities: { input: model.input, output: ["text"] },
+    ...model.contextWindow && model.maxOutputTokens ? { limit: { context: model.contextWindow, output: model.maxOutputTokens } } : {}
+  }]));
+  const options_ = { baseURL: `${options.baseUrl}/v1`, apiKey: `{env:${tokenEnv}}` };
+  providers[`divergent-${options.surface}`] = options.surface === "openai" ? { npm: "@ai-sdk/openai-compatible", name: "Divergent (OpenAI)", options: options_, models } : { npm: "@ai-sdk/anthropic", name: "Divergent (Anthropic)", options: options_, models };
+  config.provider = providers;
+  return config;
+}
+
+// src/agents/run-dsh.ts
+import { spawn as spawn2 } from "node:child_process";
+import fs7 from "node:fs";
+import path9 from "node:path";
+function writeDshToken(credentialsPath, accessToken) {
+  const existing = fs7.existsSync(credentialsPath) ? fs7.readFileSync(credentialsPath, "utf8") : null;
+  let merged;
+  try {
+    merged = mergeDshCredentials(existing, accessToken);
+  } catch (error) {
+    throw new CliError(`${credentialsPath}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  writeTextAtomic(credentialsPath, merged, 384);
+}
+function writeDivergeShim(binDir, cli, sessionTokenPath, platform = process.platform) {
+  if (platform === "win32") {
+    const file2 = path9.join(binDir, "diverge.cmd");
+    const run3 = [cli.command, ...cli.args].map((part) => `"${part}"`).join(" ");
+    writeTextAtomic(file2, `@setlocal\r
+@set "${SESSION_TOKEN_VARIABLE}=${sessionTokenPath}"\r
+@${run3} %*\r
+`, 493);
+    return file2;
+  }
+  const quote = (part) => `'${part.replace(/'/g, `'\\''`)}'`;
+  const file = path9.join(binDir, "diverge");
+  writeTextAtomic(file, `#!/bin/sh
+${SESSION_TOKEN_VARIABLE}=${quote(sessionTokenPath)}
+export ${SESSION_TOKEN_VARIABLE}
+exec ${[cli.command, ...cli.args].map(quote).join(" ")} "$@"
+`, 493);
+  return file;
+}
+function dshEnv(env, binDir) {
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== void 0 && key !== "DIVERGENT_TOKEN" && key !== "DIVERGENT_ORG_ID") out[key] = value;
   }
+  out.PATH = env.PATH ? `${binDir}${path9.delimiter}${env.PATH}` : binDir;
+  return out;
+}
+function dshArgs(overlayPath, args) {
+  const rest = args.includes("--profile") ? args : args.length === 0 ? ["--profile", "web"] : ["--profile", "headless", ...args];
+  return ["--patch", overlayPath, ...rest];
 }
-function readSkillsManifest(root) {
+function dshLaunch(binary, args, platform = process.platform, execPath = process.execPath) {
+  if (platform !== "win32" || !/\.(cmd|bat)$/i.test(binary)) return { command: binary, args };
+  const packageDir = path9.join(path9.dirname(binary), "node_modules", "@deepseek-ai", "dsh");
+  let bin;
   try {
-    const parsed = JSON.parse(fs8.readFileSync(path10.join(root, SKILLS_MANIFEST), "utf8"));
-    if (parsed && typeof parsed === "object" && typeof parsed.skills === "object") return parsed;
+    bin = JSON.parse(fs7.readFileSync(path9.join(packageDir, "package.json"), "utf8")).bin;
   } catch {
+    throw new CliError(`${binary} is not an npm shim for @deepseek-ai/dsh (no ${packageDir}); reinstall: npm install -g @deepseek-ai/dsh`);
   }
-  return null;
-}
-function few(names, limit = 6) {
-  return names.length <= limit ? names.join(", ") : `${names.slice(0, limit).join(", ")} and ${names.length - limit} more`;
+  const script = typeof bin === "string" ? bin : typeof bin === "object" && bin !== null ? bin.dsh : void 0;
+  if (typeof script !== "string") throw new CliError(`${packageDir}/package.json declares no dsh entry; reinstall: npm install -g @deepseek-ai/dsh`);
+  return { command: execPath, args: [path9.join(packageDir, script), ...args] };
 }
-function installSkills(root, skills, source, now = () => /* @__PURE__ */ new Date()) {
-  const previous = readSkillsManifest(root);
-  const held = previous?.skills ?? {};
-  const written = [];
-  const added = [];
-  const updated = [];
-  for (const skill of skills) {
-    if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(skill.name)) throw new Error(`skill name ${JSON.stringify(skill.name)} is not a folder name`);
-    writeTextAtomic(path10.join(root, skill.name, "SKILL.md"), skill.content, 420);
-    written.push(skill.name);
-    if (!(skill.name in held)) added.push(skill.name);
-    else if (held[skill.name] !== skill.updatedAt) updated.push(skill.name);
-  }
-  const removed = [];
-  for (const name of Object.keys(previous?.skills ?? {})) {
-    if (skills.some((skill) => skill.name === name)) continue;
-    fs8.rmSync(path10.join(root, name), { recursive: true, force: true });
-    removed.push(name);
+async function keepTokenFresh(loop) {
+  let written = null;
+  while (loop.isRunning()) {
+    const token = await loop.freshToken();
+    if (token && token !== written) {
+      loop.write(token);
+      written = token;
+    }
+    for (let i = 0; i < 30; i += 1) {
+      if (!loop.isRunning()) return;
+      await loop.sleep(1e3);
+    }
   }
-  const manifest = {
-    installedAt: now().toISOString(),
-    source,
-    skills: Object.fromEntries(skills.map((skill) => [skill.name, skill.updatedAt]))
+}
+function runDsh(options) {
+  const writeToken = (token) => {
+    writeDshToken(options.credentialsPath, token);
+    writeTextAtomic(options.sessionTokenPath, `${token}
+`, 384);
+  };
+  writeToken(options.initialToken);
+  writeDivergeShim(options.binDir, options.cli, options.sessionTokenPath);
+  const env = dshEnv(options.env, options.binDir);
+  const launch = dshLaunch(options.binary, dshArgs(options.overlayPath, options.args));
+  const child = spawn2(launch.command, launch.args, { env, stdio: "inherit" });
+  let exited = false;
+  let wake = null;
+  const finish = () => {
+    exited = true;
+    wake?.();
+  };
+  const done = new Promise((resolve, reject) => {
+    child.on("error", (error) => {
+      finish();
+      reject(error);
+    });
+    child.on("exit", (code2, signal) => {
+      finish();
+      resolve(code2 ?? (signal ? 128 + 15 : 1));
+    });
+  });
+  const ignore = () => {
   };
-  writeJsonAtomic(path10.join(root, SKILLS_MANIFEST), manifest, 420);
-  return { root, written, added, updated, removed };
+  process.on("SIGINT", ignore);
+  const terminate = () => child.kill("SIGTERM");
+  process.on("SIGTERM", terminate);
+  const loop = keepTokenFresh({
+    freshToken: options.freshToken,
+    write: writeToken,
+    isRunning: () => !exited,
+    sleep: (ms) => new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        wake = null;
+        resolve();
+      }, ms);
+      wake = () => {
+        clearTimeout(timer);
+        wake = null;
+        resolve();
+      };
+    })
+  });
+  return done.finally(async () => {
+    process.off("SIGINT", ignore);
+    process.off("SIGTERM", terminate);
+    await loop;
+  });
 }
-function skillsStatus(root, skills) {
-  const manifest = readSkillsManifest(root);
-  const held = manifest?.skills ?? {};
-  const current = [];
-  const behind = [];
-  const missing = [];
-  for (const skill of skills) {
-    if (!(skill.name in held) || !fs8.existsSync(path10.join(root, skill.name, "SKILL.md"))) missing.push(skill.name);
-    else if (held[skill.name] !== skill.updatedAt) behind.push(skill.name);
-    else current.push(skill.name);
+
+// src/agents/dsh-session-publisher.ts
+import fs8 from "node:fs";
+import path10 from "node:path";
+
+// src/agents/dsh-session-log.ts
+import zlib from "node:zlib";
+var DSH_SESSION_LOG_FILE = "session.jsonl.zstd";
+var DSH_DELTA_RECORD_TYPES = /* @__PURE__ */ new Set(["assistant/chunk", "reasoning-chunks", "text-chunks", "tool-call-chunks"]);
+function dshProjectKey(cwd) {
+  if (cwd.length === 0) throw new Error("cannot encode an empty project path");
+  let readable = "";
+  let separatorRun = false;
+  for (let i = 0; i < cwd.length; i += 1) {
+    const code2 = cwd.charCodeAt(i);
+    const ch = String.fromCharCode(code2);
+    if (ch === "/" || ch === "\\" || ch === ":") {
+      if (!separatorRun) readable += "-";
+      separatorRun = true;
+    } else if (ch !== "~" && /^[A-Za-z0-9._-]$/.test(ch)) {
+      readable += ch;
+      separatorRun = false;
+    } else {
+      readable += `~${code2.toString(16).toUpperCase().padStart(4, "0")}`;
+      separatorRun = false;
+    }
+  }
+  return `--${(readable.replace(/^-+/, "") || "root").slice(0, 251)}--`;
+}
+function zstdAvailable() {
+  return typeof zlib.zstdDecompressSync === "function";
+}
+var ZSTD_MAGIC = 4247762216;
+var SKIPPABLE_MAGIC_LOW = 407710288;
+var SKIPPABLE_MAGIC_HIGH = 407710303;
+function zstdFrameEnd(buffer, start) {
+  if (buffer.length - start < 4) return null;
+  const magic = buffer.readUInt32LE(start);
+  if (magic >= SKIPPABLE_MAGIC_LOW && magic <= SKIPPABLE_MAGIC_HIGH) {
+    if (buffer.length - start < 8) return null;
+    const end = start + 8 + buffer.readUInt32LE(start + 4);
+    return end <= buffer.length ? end : null;
+  }
+  if (magic !== ZSTD_MAGIC) return null;
+  if (buffer.length - start < 5) return null;
+  const descriptor = buffer[start + 4];
+  const contentSizeFlag = descriptor >> 6;
+  const singleSegment = descriptor >> 5 & 1;
+  const checksum = descriptor >> 2 & 1;
+  const dictionaryFlag = descriptor & 3;
+  let pos = start + 5;
+  if (!singleSegment) pos += 1;
+  pos += [0, 1, 2, 4][dictionaryFlag];
+  pos += contentSizeFlag === 0 ? singleSegment : [0, 2, 4, 8][contentSizeFlag];
+  for (; ; ) {
+    if (pos + 3 > buffer.length) return null;
+    const header = buffer[pos] | buffer[pos + 1] << 8 | buffer[pos + 2] << 16;
+    const last = header & 1;
+    const type = header >> 1 & 3;
+    const size = header >> 3;
+    if (type === 3) return null;
+    pos += 3 + (type === 1 ? 1 : size);
+    if (pos > buffer.length) return null;
+    if (last) break;
+  }
+  if (checksum) pos += 4;
+  return pos <= buffer.length ? pos : null;
+}
+function decodeZstdFrames(buffer) {
+  const parts = [];
+  let offset = 0;
+  while (offset < buffer.length) {
+    const end = zstdFrameEnd(buffer, offset);
+    if (end === null) break;
+    if (buffer.readUInt32LE(offset) === ZSTD_MAGIC) {
+      try {
+        parts.push(zlib.zstdDecompressSync(buffer.subarray(offset, end)));
+      } catch (error) {
+        return { text: Buffer.concat(parts).toString("utf8"), consumed: offset, failed: { at: offset, error: error instanceof Error ? error.message : String(error) } };
+      }
+    }
+    offset = end;
   }
-  const retired = Object.keys(held).filter((name) => !skills.some((skill) => skill.name === name));
-  return { root, installedAt: manifest?.installedAt ?? null, current, behind, missing, retired };
+  return { text: Buffer.concat(parts).toString("utf8"), consumed: offset };
 }
-
-// src/skills/installable.ts
-async function fetchInstallableSkills(baseUrl, accessToken) {
-  const body = await fetchJson(
-    `${baseUrl.replace(/\/+$/, "")}/api/plugins/symphony/skills/installable`,
-    { headers: { Authorization: `Bearer ${accessToken}` } }
-  );
-  if (!body.success || !body.data) throw new CliError(body.error ?? "The platform answered without skills");
-  return body.data;
+function text(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
 }
-
-// src/commands/skills.ts
-var skillsUsage = `diverge skills <list|install|status> [--harness claude,codex,dsh] [--into <dir>]
-
-  list      the skills the platform serves you: your organization's skills whose tools you can run
-  install   write them, and the CLI's own skills ("diverge"; "drive-chrome" for dsh), into each harness's user skill folder
-            (~/.claude/skills, ~/.codex/skills, $DSH_HOME/skills); retires the ones the organization retired;
-            reports what changed \u2014 the full list is \`skills list\`
-  status    what each folder holds against what the platform serves now
-
-A skill is a procedure over the tools it names; you get the ones whose every
-tool you may run. Re-run install after the organization changes its skills.`;
-async function installableSkillSet(apiUrl, env) {
-  const token = await getUserToken(tokenSource(env, apiUrl));
-  const organizationId = tokenClaims(token.access_token).organizationId;
-  if (!organizationId) throw new CliError("The login has no default organization; run: diverge org use <id|name>");
-  const served = await fetchInstallableSkills(apiUrl, token.access_token);
-  return { skills: served.skills, organizationId };
-}
-function harnessesOf(flag) {
-  if (!flag) return [...HARNESSES];
-  const chosen = flag.split(",").map((name) => name.trim()).filter(Boolean);
-  for (const name of chosen) if (!HARNESSES.includes(name)) throw new CliError(`--harness must name some of: ${HARNESSES.join(", ")}`);
-  return chosen;
+function instant(value, fallback) {
+  const ms = typeof value === "number" && Number.isFinite(value) ? value : fallback;
+  return new Date(ms).toISOString();
 }
-function installForHarness(io, harness, skills, apiUrl, into) {
-  const root = into ?? skillsRoot(harness, io.env);
-  const result = installSkills(root, [...bundledSkills(harness), ...skills], apiUrl);
-  const changes = [
-    ...result.added.length ? [`${result.added.length} new: ${few(result.added)}`] : [],
-    ...result.updated.length ? [`${result.updated.length} updated: ${few(result.updated)}`] : [],
-    ...result.removed.length ? [`${result.removed.length} retired: ${few(result.removed)}`] : []
-  ];
-  io.stdout(`${harness}: ${result.written.length} skills in ${root}${changes.length ? ` (${changes.join("; ")})` : " (unchanged)"}`);
+function parseDshRecords(logText, now = Date.now) {
+  const parsed = { header: null, events: [], unreadable: 0 };
+  for (const line of logText.split("\n")) {
+    if (line.trim().length === 0) continue;
+    let record;
+    try {
+      record = JSON.parse(line);
+    } catch {
+      parsed.unreadable += 1;
+      continue;
+    }
+    if (!record || typeof record !== "object" || Array.isArray(record)) {
+      parsed.unreadable += 1;
+      continue;
+    }
+    const row = record;
+    const type = text(row.type);
+    if (type === "session" && text(row.id)) {
+      parsed.header = {
+        id: row.id,
+        createdAt: typeof row.createdAt === "number" ? row.createdAt : null,
+        cwd: text(row.cwd),
+        parentSession: text(row.parentSession),
+        origin: text(row.origin),
+        delegationDepth: typeof row.delegationDepth === "number" ? row.delegationDepth : null
+      };
+      continue;
+    }
+    if (!type || DSH_DELTA_RECORD_TYPES.has(type)) continue;
+    if (!Number.isInteger(row.seq) || row.seq < 0) {
+      parsed.unreadable += 1;
+      continue;
+    }
+    parsed.events.push({ seq: row.seq, type, time: instant(row.time, now()), data: row.data === void 0 ? {} : row.data });
+  }
+  return parsed;
 }
-async function runSkills(args, io) {
-  const [verb, ...rest] = args;
-  const { values } = parseArgs2({ args: rest, options: { harness: { type: "string" }, into: { type: "string" } }, strict: true });
-  const apiUrl = resolveApiUrl(void 0, io.env);
-  switch (verb) {
-    case "list": {
-      const { skills, organizationId } = await installableSkillSet(apiUrl, io.env);
-      io.stdout(`Skills the platform serves you at organization ${organizationId}, after the CLI's own:`);
-      for (const skill of [...bundledSkills("dsh"), ...skills]) io.stdout(`  ${skill.name.padEnd(36)} ${skill.tools.length ? skill.tools.join(", ") : "(ships with the CLI)"}`);
-      return ExitCode.Ok;
+
+// src/agents/dsh-session-publisher.ts
+var DSH_HARNESS = "dsh";
+var EVENTS_PER_APPEND = 400;
+var BYTES_PER_APPEND = 15e5;
+var MAX_PENDING_EVENTS = 2e4;
+var DEFAULT_POLL_MS = 2e3;
+var LAUNCH_SLACK_MS = 5e3;
+var STALLED_TICKS = 30;
+function eventBytes(event) {
+  return Buffer.byteLength(JSON.stringify(event), "utf8");
+}
+function nextBatch(pending) {
+  const batch = [];
+  let bytes = 0;
+  for (const event of pending) {
+    const size = eventBytes(event);
+    if (batch.length > 0 && (batch.length >= EVENTS_PER_APPEND || bytes + size > BYTES_PER_APPEND)) break;
+    batch.push(event);
+    bytes += size;
+  }
+  return batch;
+}
+var DshSessionPublisher = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.pollMs = deps.pollMs ?? DEFAULT_POLL_MS;
+    this.now = deps.now ?? Date.now;
+  }
+  deps;
+  sessions = /* @__PURE__ */ new Map();
+  pollMs;
+  now;
+  running = false;
+  loop = null;
+  /** The organization does not record: nothing more is read or sent. */
+  disabled = false;
+  ticking = null;
+  /** The directory dsh writes this launch's sessions under. */
+  get projectDir() {
+    return path10.join(this.deps.sessionsRoot, dshProjectKey(this.deps.cwd));
+  }
+  start() {
+    if (this.running) return;
+    if (!zstdAvailable()) {
+      this.deps.report(`warning: this Node (${process.versions.node}) cannot decode dsh's session log (Zstandard needs Node 22.15 or later); the session is not recorded`);
+      this.disabled = true;
+      return;
     }
-    case "install": {
-      const { skills } = await installableSkillSet(apiUrl, io.env);
-      const harnesses = values.into ? [harnessesOf(values.harness)[0]] : harnessesOf(values.harness);
-      for (const harness of harnesses) installForHarness(io, harness, skills, apiUrl, values.into);
-      return ExitCode.Ok;
+    this.running = true;
+    this.loop = (async () => {
+      while (this.running) {
+        await this.tick();
+        if (!this.running) break;
+        await this.deps.sleep(this.pollMs);
+      }
+    })();
+  }
+  /** The harness exited: publish what is left and close every session this launch opened. */
+  async stop() {
+    this.running = false;
+    await this.loop;
+    if (this.disabled) return;
+    await this.tick();
+    const at = new Date(this.now()).toISOString();
+    for (const session of this.sessions.values()) {
+      if (!session.opened || !session.header) continue;
+      try {
+        await this.deps.append({ ...this.openInput(session.header), events: [], ended: { at, reason: "exit" } });
+      } catch (error) {
+        this.deps.report(`warning: could not close the record of dsh session ${session.header.id}: ${error instanceof Error ? error.message : String(error)}`);
+      }
     }
-    case "status": {
-      const { skills } = await installableSkillSet(apiUrl, io.env);
-      let behind = false;
-      for (const harness of harnessesOf(values.harness)) {
-        const status2 = skillsStatus(values.into ?? skillsRoot(harness, io.env), [...bundledSkills(harness), ...skills]);
-        const parts = [`${status2.current.length} current`];
-        if (status2.behind.length) parts.push(`${status2.behind.length} behind (${few(status2.behind)})`);
-        if (status2.missing.length) parts.push(`${status2.missing.length} missing${status2.current.length || status2.behind.length ? ` (${few(status2.missing)})` : ""}`);
-        if (status2.retired.length) parts.push(`${status2.retired.length} retired (${few(status2.retired)})`);
-        behind ||= status2.behind.length + status2.missing.length + status2.retired.length > 0;
-        io.stdout(`${harness}: ${parts.join(", ")} in ${status2.root}${status2.installedAt ? ` (installed ${status2.installedAt})` : " (never installed)"}`);
+  }
+  /** One pass: find new sessions, read what each appended, send what is pending. Serialized; a slow platform never overlaps ticks. */
+  async tick() {
+    if (this.disabled) return;
+    if (this.ticking) {
+      await this.ticking;
+      return;
+    }
+    this.ticking = this.pass().finally(() => {
+      this.ticking = null;
+    });
+    await this.ticking;
+  }
+  async pass() {
+    this.discover();
+    for (const session of this.sessions.values()) {
+      if (this.disabled) return;
+      this.read(session);
+      await this.flush(session);
+    }
+  }
+  discover() {
+    let entries;
+    try {
+      entries = fs8.readdirSync(this.projectDir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || this.sessions.has(entry.name)) continue;
+      const dir = path10.join(this.projectDir, entry.name);
+      const file = path10.join(dir, DSH_SESSION_LOG_FILE);
+      let stat;
+      try {
+        stat = fs8.statSync(dir);
+      } catch {
+        continue;
       }
-      if (behind) io.stdout("Run: diverge skills install");
-      return ExitCode.Ok;
+      const born = Math.min(stat.birthtimeMs || Number.POSITIVE_INFINITY, stat.mtimeMs);
+      if (born < this.deps.launchedAt - LAUNCH_SLACK_MS) continue;
+      this.sessions.set(entry.name, {
+        dir,
+        file,
+        offset: 0,
+        header: null,
+        pending: [],
+        opened: false,
+        lastSeq: -1,
+        reportedFailure: null,
+        unreadableReported: false,
+        stalledAt: 0,
+        stalledTicks: 0,
+        dead: false
+      });
+    }
+  }
+  read(session) {
+    if (session.dead) return;
+    let fd;
+    try {
+      fd = fs8.openSync(session.file, "r");
+    } catch {
+      return;
+    }
+    try {
+      const size = fs8.fstatSync(fd).size;
+      if (size <= session.offset) return;
+      const buffer = Buffer.alloc(size - session.offset);
+      const read = fs8.readSync(fd, buffer, 0, buffer.length, session.offset);
+      const decoded = decodeZstdFrames(buffer.subarray(0, read));
+      if (decoded.failed) {
+        this.giveUp(session, `the frame at byte ${session.offset + decoded.failed.at} does not decode: ${decoded.failed.error}`);
+      } else if (decoded.consumed === 0) {
+        session.stalledTicks = size === session.stalledAt ? session.stalledTicks + 1 : 1;
+        session.stalledAt = size;
+        if (session.stalledTicks >= STALLED_TICKS) this.giveUp(session, `${size - session.offset} byte(s) at byte ${session.offset} complete no frame`);
+        return;
+      }
+      if (decoded.consumed === 0) return;
+      session.stalledTicks = 0;
+      session.offset += decoded.consumed;
+      const parsed = parseDshRecords(decoded.text, this.now);
+      if (parsed.header) session.header = parsed.header;
+      if (parsed.unreadable > 0 && !session.unreadableReported) {
+        session.unreadableReported = true;
+        this.deps.report(`warning: ${parsed.unreadable} line(s) of ${session.file} could not be read as dsh events and were left out`);
+      }
+      for (const event of parsed.events) {
+        if (event.seq > session.lastSeq) session.pending.push(event);
+      }
+      if (session.pending.length > MAX_PENDING_EVENTS) {
+        const dropped = session.pending.length - MAX_PENDING_EVENTS;
+        session.pending.splice(0, dropped);
+        this.deps.report(`warning: the platform has not taken ${session.file} for a while; ${dropped} oldest unsent event(s) were dropped`);
+      }
+    } finally {
+      fs8.closeSync(fd);
     }
-    default:
-      throw unknownVerb("skills", skillsUsage, [], verb, rest);
   }
+  /** The rest of this session's log cannot be read; what was sent stands, and the person is told once. */
+  giveUp(session, why) {
+    session.dead = true;
+    this.deps.report(`warning: ${session.file} is not read further (${why}); what was recorded so far stands`);
+  }
+  openInput(header) {
+    return {
+      harness: DSH_HARNESS,
+      harnessSessionId: header.id,
+      ...this.deps.harnessVersion ? { harnessVersion: this.deps.harnessVersion } : {},
+      host: this.deps.host,
+      workingDirectory: header.cwd ?? this.deps.cwd,
+      ...header.createdAt !== null ? { startedAt: new Date(header.createdAt).toISOString() } : {},
+      launchId: this.deps.launchId,
+      ...header.parentSession ? { parentHarnessSessionId: header.parentSession } : {},
+      ...header.origin ? { origin: header.origin } : {}
+    };
+  }
+  async flush(session) {
+    if (!session.header) return;
+    while (session.pending.length > 0 && !this.disabled) {
+      const batch = nextBatch(session.pending);
+      let result;
+      try {
+        result = await this.deps.append({ ...this.openInput(session.header), events: batch });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (session.reportedFailure !== message) {
+          session.reportedFailure = message;
+          this.deps.report(`warning: the platform did not take dsh session ${session.header.id}'s events (kept for the next try): ${message}`);
+        }
+        return;
+      }
+      session.reportedFailure = null;
+      if (!result.recording) {
+        this.disabled = true;
+        this.deps.report("This organization does not record agent sessions (Forge installation config agentSessions.recording is off); nothing is sent.");
+        return;
+      }
+      session.opened = true;
+      session.lastSeq = Math.max(session.lastSeq, result.lastSeq, batch[batch.length - 1].seq);
+      session.pending.splice(0, batch.length);
+    }
+  }
+};
+
+// src/agents/dsh-session-tools.ts
+var AGENT_SESSION_APPEND_TOOL = "forge_append_agent_session_events";
+var AGENT_SESSION_LIST_TOOL = "forge_list_agent_sessions";
+
+// src/fs/path.ts
+import fs9 from "node:fs";
+import path11 from "node:path";
+function findOnPath(name, env = process.env, platform = process.platform) {
+  const dirs = (env.PATH ?? "").split(path11.delimiter).filter(Boolean);
+  const extensions = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  const candidates = platform === "win32" ? extensions.map((extension) => `${name}${extension.toLowerCase()}`) : [name];
+  for (const dir of dirs) {
+    for (const candidate of candidates) {
+      const full = path11.join(dir, candidate);
+      try {
+        fs9.accessSync(full, fs9.constants.X_OK);
+        if (fs9.statSync(full).isFile()) return full;
+      } catch {
+      }
+    }
+  }
+  return null;
 }
 
 // src/agents/rotate.ts
 import os7 from "node:os";
-import path11 from "node:path";
+import path12 from "node:path";
 function defaultTokenFilePath() {
-  return path11.join(os7.homedir(), ".divergent", "token");
+  return path12.join(os7.homedir(), ".divergent", "token");
 }
 var MIN_ROTATE_INTERVAL_SECONDS = 60;
 async function rotateTokenFile(loop) {
@@ -9279,19 +9836,19 @@ async function rotateTokenFile(loop) {
 }
 
 // src/agents/self-command.ts
-import fs9 from "node:fs";
-import path12 from "node:path";
+import fs10 from "node:fs";
+import path13 from "node:path";
 function resolveSelfCommand(argv = process.argv, platform = process.platform, execPath = process.execPath) {
   const script = argv[1];
   if (!script) return { command: execPath, args: [] };
   if (platform !== "win32") {
     try {
-      fs9.accessSync(script, fs9.constants.X_OK);
-      return { command: path12.resolve(script), args: [] };
+      fs10.accessSync(script, fs10.constants.X_OK);
+      return { command: path13.resolve(script), args: [] };
     } catch {
     }
   }
-  return { command: execPath, args: [fs9.realpathSync(script)] };
+  return { command: execPath, args: [fs10.realpathSync(script)] };
 }
 function shellCommand(self, ...trailing) {
   return [self.command, ...self.args, ...trailing].map((part) => /[\s"]/.test(part) ? `"${part.replace(/"/g, '\\"')}"` : part).join(" ");
@@ -9318,8 +9875,8 @@ function surfaceOf(value, fallback) {
   throw new CliError(`--surface must be one of: ${SURFACES.join(", ")}`);
 }
 function readJson(file) {
-  if (!fs10.existsSync(file)) return null;
-  return JSON.parse(fs10.readFileSync(file, "utf8"));
+  if (!fs11.existsSync(file)) return null;
+  return JSON.parse(fs11.readFileSync(file, "utf8"));
 }
 async function servedModels(apiUrl, token, surface) {
   return (await listModels(apiUrl, token.access_token, surface)).map(servedModel);
@@ -9336,26 +9893,27 @@ function syncDivergentPreset(io, binary, home) {
     return;
   }
   const dir = writeDivergentPreset(home, shipped);
-  const settingsPath = path13.join(home, "settings.yaml");
-  const settings = withDivergentPresetDefault(fs10.existsSync(settingsPath) ? fs10.readFileSync(settingsPath, "utf8") : null);
+  const settingsPath = path14.join(home, "settings.yaml");
+  const settings = withDivergentPresetDefault(fs11.existsSync(settingsPath) ? fs11.readFileSync(settingsPath, "utf8") : null);
   if (settings !== null) writeTextAtomic(settingsPath, settings);
   io.stderr(`Agent preset "${DIVERGENT_PRESET_ID}" (${dir}): web sessions search through the platform${settings !== null ? "; set as the default preset in settings.yaml" : ""}.`);
 }
-async function skillsFor(io, apiUrl, harness) {
+async function skillsFor(io, apiUrl, harness, organizationId) {
   try {
-    const { skills } = await installableSkillSet(apiUrl, io.env);
+    const skills = await loginSkillSet(apiUrl, io.env, organizationId?.trim() || void 0);
     installForHarness(io, harness, skills, apiUrl);
+    for (const note of skills.notes) io.stderr(`warning: ${note}`);
   } catch (error) {
     io.stderr(`warning: skills not installed (${error instanceof Error ? error.message : String(error)}); run: diverge skills install`);
   }
 }
-async function overlayAndDefault(apiUrl, token, surface, io, requested) {
+async function overlayAndDefault(apiUrl, token, surface, io, requested, launch) {
   const served = await servedModels(apiUrl, token, surface);
   const models = served.map((model) => model.id);
   if (models.length === 0) throw new CliError(`the gateway serves no models on the ${surface} surface for this organization`);
   if (requested && !models.includes(requested)) throw new CliError(`${requested} is not served on the ${surface} surface; choose one of: ${models.join(", ")}`);
   const defaultModel = dshDefaultModel(models, requested);
-  return { overlay: dshPatchYaml({ baseUrl: surfaceBaseUrl(apiUrl, surface), surface, models: served, defaultModel }), defaultModel, models };
+  return { overlay: dshPatchYaml({ baseUrl: surfaceBaseUrl(apiUrl, surface), surface, models: served, defaultModel, launch }), defaultModel, models };
 }
 function organizationArgs(organizationId) {
   const trimmed = organizationId?.trim();
@@ -9374,12 +9932,14 @@ async function setup(args, io) {
         baseUrl: anthropicBaseUrl(apiUrl),
         tokenHelper: shellCommand(resolveSelfCommand(), "token", ...organizationArgs(values["organization-id"])),
         projectId: values["project-id"],
-        modelDiscovery: values["model-discovery"]
+        modelDiscovery: values["model-discovery"],
+        // Claude Code scans its skill folder when a session starts, so that is when the login's skills are brought current.
+        skillsRefresh: values.scope === "user" ? shellCommand(resolveSelfCommand(), "skills", "refresh") : void 0
       });
       writeJsonAtomic(file, settings);
       io.stdout(`Claude Code \u2192 ${anthropicBaseUrl(apiUrl)} as you, organization ${tokenClaims(token.access_token).organizationId}. Wrote ${file}.`);
       for (const warning of warnings) io.stderr(`warning: ${warning}`);
-      await skillsFor(io, apiUrl, "claude");
+      await skillsFor(io, apiUrl, "claude", values["organization-id"]);
       return ExitCode.Ok;
     }
     case "opencode": {
@@ -9409,24 +9969,24 @@ async function setup(args, io) {
       }
       const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
       const file = values.config ?? codexConfigPath();
-      const existing = fs10.existsSync(file) ? fs10.readFileSync(file, "utf8") : null;
+      const existing = fs11.existsSync(file) ? fs11.readFileSync(file, "utf8") : null;
       writeTextAtomic(file, mergeCodexConfig(existing, block));
       io.stdout(`Codex provider divergent \u2192 ${openaiBaseUrl(apiUrl)} as you, organization ${tokenClaims(token.access_token).organizationId}. Wrote ${file}.`);
       io.stdout('Select it per run with: codex -c model_provider=divergent   (or set model_provider = "divergent" in the config)');
-      await skillsFor(io, apiUrl, "codex");
+      await skillsFor(io, apiUrl, "codex", values["organization-id"]);
       return ExitCode.Ok;
     }
     case "dsh": {
       const { values } = parseArgs3({ args: rest, options: { surface: { type: "string" }, model: { type: "string" }, "organization-id": { type: "string" }, into: { type: "string" }, print: { type: "boolean", default: false } }, strict: true });
       const surface = surfaceOf(values.surface, "openai");
       const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
-      if (!values.print) await skillsFor(io, apiUrl, "dsh");
+      if (!values.print) await skillsFor(io, apiUrl, "dsh", values["organization-id"]);
       const { overlay, defaultModel } = await overlayAndDefault(apiUrl, token, surface, io, values.model);
       if (values.print) {
         io.stdout(overlay.trimEnd());
         return ExitCode.Ok;
       }
-      const file = values.into ?? path13.join(dshHome(io.env), `divergent-${surface}.yml`);
+      const file = values.into ?? path14.join(dshHome(io.env), `divergent-${surface}.yml`);
       writeTextAtomic(file, overlay);
       io.stdout(`dsh route divergent-${surface} \u2192 ${surfaceBaseUrl(apiUrl, surface)} as you, organization ${tokenClaims(token.access_token).organizationId}, default model ${defaultModel}. Wrote ${file}.`);
       io.stdout("Platform tools, web search included, are reached from dsh's shell through `diverge tools`; the installed skills say when and how. dsh's DeepSeek search is off.");
@@ -9452,43 +10012,72 @@ async function run(args, io) {
   const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
   const binary = findOnPath("dsh", io.env);
   if (!binary) throw new CliError("dsh is not on PATH (install: npm install -g @deepseek-ai/dsh)");
-  await skillsFor(io, apiUrl, "dsh");
-  const { overlay, defaultModel } = await overlayAndDefault(apiUrl, token, surface, io, values.model);
+  await skillsFor(io, apiUrl, "dsh", values["organization-id"]);
+  const launch = { id: randomUUID(), client: `dsh/${dshVersionOf(binary) ?? "unknown"}` };
+  const { overlay, defaultModel } = await overlayAndDefault(apiUrl, token, surface, io, values.model, launch);
   const home = dshHome(io.env);
-  const settingsPath = path13.join(home, "settings.yaml");
+  const settingsPath = path14.join(home, "settings.yaml");
   let pinned;
   try {
-    pinned = dshSettingsDefaultModel(fs10.existsSync(settingsPath) ? fs10.readFileSync(settingsPath, "utf8") : null, surface);
+    pinned = dshSettingsDefaultModel(fs11.existsSync(settingsPath) ? fs11.readFileSync(settingsPath, "utf8") : null, surface);
   } catch (error) {
     throw new CliError(`${settingsPath}: ${error instanceof Error ? error.message : String(error)}`);
   }
   const served = servedIds(overlay);
   if (pinned && !served.includes(pinned)) throw new CliError(stalePinMessage(settingsPath, pinned, surface, served));
-  const overlayPath = path13.join(home, `divergent-${surface}.yml`);
+  const overlayPath = path14.join(home, `divergent-${surface}.yml`);
   writeTextAtomic(overlayPath, overlay);
   syncDivergentPreset(io, binary, home);
   io.stderr(`dsh on divergent-${surface} as you (organization ${tokenClaims(token.access_token).organizationId}), default model ${defaultModel}`);
   if (passthrough.length === 0) io.stderr('Starting the web UI; open the URL dsh prints. For one task without the UI: diverge agents run dsh -- "<task>"');
   const source = tokenSource(io.env, apiUrl);
-  return runDsh({
-    binary,
-    overlayPath,
-    credentialsPath: path13.join(home, ".credentials.yaml"),
-    sessionTokenPath: path13.join(home, "session-token"),
-    binDir: path13.join(home, "bin"),
-    cli: { command: process.execPath, args: [path13.resolve(process.argv[1])] },
-    args: passthrough,
-    env: io.env,
-    initialToken: token.access_token,
-    freshToken: async () => {
-      try {
-        return (await getUserToken(source, { freshForSeconds: 120, organizationId: values["organization-id"] })).access_token;
-      } catch (error) {
-        io.stderr(`warning: could not refresh the platform token: ${error instanceof Error ? error.message : String(error)}`);
-        return null;
-      }
-    }
+  const organizationId = tokenClaims(token.access_token).organizationId ?? values["organization-id"];
+  if (!organizationId) throw new CliError("the gateway token names no organization; pass --organization-id");
+  io.stderr(`This session is recorded as organization ${organizationId}'s own record \u2014 the conversation, every tool call and its result \u2014 unless the organization turned recording off; its administrators set whether and for how long. Yours to read: diverge tools call ${AGENT_SESSION_LIST_TOOL} (ADR 0121).`);
+  const tools = new ToolsClient({ apiUrl, organizationId, mode: "operator", clientId: clientId(io.env) }, io.env);
+  const publisher = new DshSessionPublisher({
+    sessionsRoot: path14.join(home, "sessions"),
+    cwd: process.cwd(),
+    launchedAt: Date.now(),
+    launchId: launch.id,
+    harnessVersion: dshVersionOf(binary),
+    host: os8.hostname(),
+    append: (input) => appendSession(tools, input),
+    report: (line) => io.stderr(line),
+    sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
   });
+  publisher.start();
+  try {
+    return await runDsh({
+      binary,
+      overlayPath,
+      credentialsPath: path14.join(home, ".credentials.yaml"),
+      sessionTokenPath: path14.join(home, "session-token"),
+      binDir: path14.join(home, "bin"),
+      cli: { command: process.execPath, args: [path14.resolve(process.argv[1])] },
+      args: passthrough,
+      env: io.env,
+      initialToken: token.access_token,
+      freshToken: async () => {
+        try {
+          return (await getUserToken(source, { freshForSeconds: 120, organizationId: values["organization-id"] })).access_token;
+        } catch (error) {
+          io.stderr(`warning: could not refresh the platform token: ${error instanceof Error ? error.message : String(error)}`);
+          return null;
+        }
+      }
+    });
+  } finally {
+    await publisher.stop();
+  }
+}
+async function appendSession(tools, input) {
+  const response = await tools.callTool(AGENT_SESSION_APPEND_TOOL, input);
+  if (response.success === false || response.error) throw new CliError(response.error ?? "the platform refused the append");
+  if (isPending(response.result)) throw new CliError("the append was raised for a decision, which an inert record never needs");
+  const result = response.result;
+  if (!result || typeof result.recording !== "boolean") throw new CliError("the platform answered the append without a result");
+  return { recording: result.recording, sessionId: result.sessionId ?? null, stored: result.stored ?? 0, skipped: result.skipped ?? 0, lastSeq: typeof result.lastSeq === "number" ? result.lastSeq : -1 };
 }
 async function status(args, io) {
   const { values } = parseArgs3({ args, options: { "organization-id": { type: "string" } }, strict: true });
@@ -9599,7 +10188,7 @@ async function runLogout(_args, io) {
 }
 
 // src/commands/status.ts
-import path14 from "node:path";
+import path15 from "node:path";
 var statusUsage = "diverge status\n\nShow the deployment, the cached login (or the session token), whose account it is, what it carries, and who a tool call would run as. One request: the account behind the login.";
 async function runStatus(_args, io) {
   const apiUrl = resolveApiUrl(void 0, io.env);
@@ -9615,7 +10204,7 @@ async function runStatus(_args, io) {
     io.stdout(describeToolExecution(io.env));
     return 0;
   }
-  io.stdout(`State: ${path14.dirname(source.loginFile)}`);
+  io.stdout(`State: ${path15.dirname(source.loginFile)}`);
   const record = loadLogin(source);
   if (!record) {
     io.stdout(`Not logged in. Run: diverge login${apiUrl === DEFAULT_API_URL ? "" : ` --api-url ${apiUrl}`}`);
@@ -9751,14 +10340,14 @@ function pendingResult(result) {
     summary: result.invocation?.preview?.summary
   };
   const who = result.decision?.outcome === "second_principal" ? "another person (a holder of the decide permission, never the proposer)" : "the operator";
-  const text = [
+  const text2 = [
     "Pending human approval \u2014 nothing has executed.",
     `invocationId: ${structured.invocationId}`,
     `decision: ${result.decision?.outcome ?? "pending"}`,
     `Ask ${who} to decide it at: ${structured.approvalUrl}`,
     `Then read the outcome with ${INVOCATION_STATUS_TOOL}, no sooner than ${structured.pollAfterMs} ms between reads; expires ${structured.expiresAt}.`
   ].join("\n");
-  return { content: textContent(text), structuredContent: structured, _meta: { "net.divergeai/invocationId": structured.invocationId } };
+  return { content: textContent(text2), structuredContent: structured, _meta: { "net.divergeai/invocationId": structured.invocationId } };
 }
 var BridgeServer = class {
   constructor(client3, options = {}) {
@@ -9907,30 +10496,30 @@ async function waitForInvocation(id, options, deps) {
 }
 
 // src/tools/call-args.ts
-import fs11 from "node:fs";
+import fs12 from "node:fs";
 async function resolveCallArgs(options, stdin = readStdin) {
   if (options.argsJson !== void 0 && options.argsJson !== "{}" && options.argsFile !== void 0) {
     throw new CliError("give the arguments once: --args-json or --args-file");
   }
-  let text;
+  let text2;
   let source;
   if (options.argsFile !== void 0) {
     source = `--args-file ${options.argsFile}`;
     try {
-      text = fs11.readFileSync(options.argsFile, "utf8");
+      text2 = fs12.readFileSync(options.argsFile, "utf8");
     } catch (error) {
       throw new CliError(`${source}: ${error instanceof Error ? error.message : String(error)}`);
     }
   } else if (options.argsJson === "-") {
     source = "--args-json - (stdin)";
-    text = await stdin();
+    text2 = await stdin();
   } else {
     source = "--args-json";
-    text = options.argsJson ?? "{}";
+    text2 = options.argsJson ?? "{}";
   }
   let parsed;
   try {
-    parsed = JSON.parse(text.trim() === "" ? "{}" : text);
+    parsed = JSON.parse(text2.trim() === "" ? "{}" : text2);
   } catch (error) {
     throw new CliError(`${source} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
   }
@@ -9944,8 +10533,8 @@ async function readStdin() {
 }
 
 // src/tools/batch.ts
-function parseBatch(text) {
-  const trimmed = text.trim();
+function parseBatch(text2) {
+  const trimmed = text2.trim();
   if (!trimmed) throw new Error("the batch file is empty");
   const raw = trimmed.startsWith("[") ? JSON.parse(trimmed) : trimmed.split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
   if (!Array.isArray(raw)) throw new Error("the batch file must hold a JSON array or one JSON object per line");
@@ -10009,7 +10598,7 @@ function worstExitCode(outcomes) {
 }
 
 // src/commands/tools.ts
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 
 // src/tools/print.ts
 function matchesCapability(selector, capability) {
@@ -10166,7 +10755,7 @@ async function set(rest, io) {
     if (!file) throw new CliError("set needs a file of calls, or - for stdin");
     let entries;
     try {
-      entries = parseBatch(file === "-" ? await readStdin() : fs12.readFileSync(file, "utf8"));
+      entries = parseBatch(file === "-" ? await readStdin() : fs13.readFileSync(file, "utf8"));
     } catch (error) {
       throw new CliError(`${file}: ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -10253,7 +10842,7 @@ async function runTools(args, io) {
       if (!file) throw new CliError("run needs a file of calls, or - for stdin");
       let entries;
       try {
-        entries = parseBatch(file === "-" ? await readStdin() : fs12.readFileSync(file, "utf8"));
+        entries = parseBatch(file === "-" ? await readStdin() : fs13.readFileSync(file, "utf8"));
       } catch (error) {
         throw new CliError(`${file}: ${error instanceof Error ? error.message : String(error)}`);
       }
@@ -10297,7 +10886,7 @@ async function runTools(args, io) {
 }
 
 // src/commands/plugins.ts
-import fs13 from "node:fs";
+import fs14 from "node:fs";
 import { parseArgs as parseArgs7 } from "node:util";
 var pluginsUsage = `diverge plugins <validate|publish|list|retire> [--organization-id <id>] ...
 
@@ -10322,15 +10911,15 @@ function readManifest(file) {
   if (!file) throw new CliError(`A manifest file is required.
 
 ${pluginsUsage}`);
-  let text;
+  let text2;
   try {
-    text = fs13.readFileSync(file, "utf8");
+    text2 = fs14.readFileSync(file, "utf8");
   } catch (error) {
     throw new CliError(`Cannot read ${file}: ${error instanceof Error ? error.message : String(error)}`);
   }
   let parsed;
   try {
-    parsed = JSON.parse(text);
+    parsed = JSON.parse(text2);
   } catch (error) {
     throw new CliError(`${file} is not JSON: ${error instanceof Error ? error.message : String(error)}`);
   }
@@ -10412,20 +11001,20 @@ ${pluginsUsage}`);
 
 // src/commands/update.ts
 import { spawn as spawn4 } from "node:child_process";
-import path16 from "node:path";
+import path17 from "node:path";
 
 // src/update-notice.ts
 import { spawn as spawn3 } from "node:child_process";
-import fs14 from "node:fs";
-import path15 from "node:path";
+import fs15 from "node:fs";
+import path16 from "node:path";
 var UPDATE_CHECK_FILE = "update-check.json";
 var UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 function updateCheckFile(env) {
-  return path15.join(configDir(env), UPDATE_CHECK_FILE);
+  return path16.join(configDir(env), UPDATE_CHECK_FILE);
 }
 function readUpdateCheck(env) {
   try {
-    const parsed = JSON.parse(fs14.readFileSync(updateCheckFile(env), "utf8"));
+    const parsed = JSON.parse(fs15.readFileSync(updateCheckFile(env), "utf8"));
     if (parsed && typeof parsed === "object" && typeof parsed.checkedAt === "number" && typeof parsed.latest === "string") return parsed;
   } catch {
   }
@@ -10517,7 +11106,7 @@ function installLatest(version, env = process.env, platform = process.platform)
     command = npm;
     if (/\.(cmd|bat)$/i.test(npm)) {
       command = process.execPath;
-      args.unshift(path16.join(path16.dirname(npm), "node_modules", "npm", "bin", "npm-cli.js"));
+      args.unshift(path17.join(path17.dirname(npm), "node_modules", "npm", "bin", "npm-cli.js"));
     }
   }
   return new Promise((resolve, reject) => {
@@ -10537,7 +11126,7 @@ var COMMANDS = [
   { name: "agents", summary: "Point a coding agent at the model gateway (setup, run, status)", usage: agentsUsage, run: runAgents },
   { name: "tools", summary: "Discover and execute platform tools; raise and read approvals", usage: toolsUsage, run: runTools },
   { name: "plugins", summary: "Validate, publish, list and retire tenant plugins for your organization", usage: pluginsUsage, run: runPlugins },
-  { name: "skills", summary: "Install your organization's skills into Claude Code, Codex and dsh", usage: skillsUsage, run: runSkills },
+  { name: "skills", summary: "Install the skills of every organization you can act in into Claude Code, Codex and dsh", usage: skillsUsage, run: runSkills },
   { name: "update", summary: "Install the latest release", usage: updateUsage, run: (args, io) => runUpdate(args, io) }
 ];
 function usage() {
@@ -10575,9 +11164,9 @@ ${usage()}`);
   }
   const own = rest.includes("--") ? rest.slice(0, rest.indexOf("--")) : rest;
   if (own.includes("--help") || own.includes("-h")) {
-    const path17 = verbPath(command.usage, own);
-    if (path17.length > 0 || own[0].startsWith("-")) {
-      io.stdout(verbUsage(command.name, command.usage, path17));
+    const path18 = verbPath(command.usage, own);
+    if (path18.length > 0 || own[0].startsWith("-")) {
+      io.stdout(verbUsage(command.name, command.usage, path18));
       return ExitCode.Ok;
     }
   }