@fabricorg/cli 0.3.4 → 0.3.6

package/dist/fabric.js

@@ -52,12 +52,12 @@ var __async = (__this, __arguments, generator) => {
 };
 
 // src/bin/fabric.ts
-import { Command as Command20 } from "commander";
+import { Command as Command21 } from "commander";
 
 // package.json
 var package_default = {
   name: "@fabricorg/cli",
-  version: "0.3.4",
+  version: "0.3.6",
   description: "CLI for the Fabric AI platform",
   keywords: [
     "fabric",
@@ -96,7 +96,8 @@ var package_default = {
     "cli-table3": "^0.6.5",
     commander: "^13.1.0",
     conf: "^13.1.0",
-    fflate: "^0.8.3"
+    fflate: "^0.8.3",
+    ignore: "7.0.9"
   },
   devDependencies: {
     "@repo/tsconfig": "workspace:*",
@@ -1051,806 +1052,1903 @@ function buildCompletionCommand() {
   return completion;
 }
 
-// src/commands/ctx/index.ts
+// src/commands/context/index.ts
+import { lstat as lstat3 } from "fs/promises";
+import path5 from "path";
 import { Command as Command8 } from "commander";
-function buildCtxCommand() {
-  const ctx = new Command8("ctx").description(
-    "Manage the organization commands run in"
-  );
-  ctx.command("current").description("Show the active default context").action(() => {
-    const stored = getDefaultContext();
-    if (!stored) {
-      printWarning(
-        "No default context set. Use --org <slug> on each command, or run:\n  fabric ctx use org <slug>"
-      );
-      return;
-    }
-    if (stored.type === "personal") {
-      printWarning(
-        "Context: personal \u2014 retired, and no command will accept it.\nReplace it with:\n  fabric ctx use org <slug>"
-      );
-      return;
+
+// src/lib/command-boundary.ts
+function outputFormatFor(command) {
+  const resolved = command.optsWithGlobals();
+  return resolved.format === "json" ? "json" : "text";
+}
+var CliFailure = class extends Error {
+  constructor(message, exitCode) {
+    super(message);
+    this.exitCode = exitCode;
+    this.name = "CliFailure";
+  }
+};
+function withDeadline(totalMs, body) {
+  return __async(this, null, function* () {
+    const controller = new AbortController();
+    let timer;
+    const deadline = new Promise((_resolve, reject) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        reject(
+          new Error(
+            `gave up after ${totalMs}ms so the session is not held up`
+          )
+        );
+      }, totalMs);
+    });
+    try {
+      yield Promise.race([body(controller.signal), deadline]);
+    } finally {
+      if (timer) {
+        clearTimeout(timer);
+      }
     }
-    process.stdout.write(`Context: org:${stored.slug}
-`);
-  });
-  const use = new Command8("use").description(
-    "Set the default organization for commands"
-  );
-  use.command("personal").description("Retired \u2014 context is organization-only").action(() => {
-    printError(
-      "Personal context no longer exists \u2014 every command runs inside an organization.\nSet one with:\n  fabric ctx use org <slug>",
-      2
-    );
-  });
-  use.command("org <slug>").description("Use an org context by default").action((slug) => {
-    saveDefaultContext({ type: "org", slug });
-    printSuccess(`Default context set to: org:${slug}`);
   });
-  ctx.addCommand(use);
-  return ctx;
+}
+function describeError(error) {
+  if (error instanceof Error) {
+    return error.message.replace(/\s*\n\s*/g, " ");
+  }
+  return String(error);
+}
+function asCliFailure(error) {
+  if (error instanceof CliFailure) {
+    return error;
+  }
+  const status = error.status;
+  const message = error instanceof Error ? error.message : String(error);
+  switch (status) {
+    case 401:
+      return new CliFailure(message, 3);
+    case 403:
+      return new CliFailure(message, 5);
+    case 404:
+      return new CliFailure(message, 4);
+    case 429:
+      return new CliFailure(message, 6);
+    case 400:
+    case 422:
+      return new CliFailure(message, 7);
+    default:
+      return new CliFailure(message, 1);
+  }
 }
 
-// src/commands/features/index.ts
-import { Command as Command9 } from "commander";
-function buildFeaturesCommand() {
-  const features = new Command9("features").description(
-    "Manage project features"
-  );
-  features.command("list").description("List features in a project").requiredOption("-p, --project <id>", "Project ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
-    "--priority <priority>",
-    "Filter: P0_CRITICAL|P1_HIGH|P2_MEDIUM|P3_LOW"
-  ).option("--search <query>", "Search by title").option("--limit <n>", "Max results (default 50)", "50").option(
-    "--format <format>",
-    "Output format: table|json|yaml|csv",
-    "table"
-  ).option("-q, --quiet", "Print IDs only").action(
-    (opts) => __async(null, null, function* () {
-      const ctx = resolveContext(opts.personal, opts.org, false);
-      const client = getClient();
-      let list;
-      try {
-        list = yield client.projects.listFeatures(opts.project, {
-          org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0,
-          priority: opts.priority,
-          search: opts.search,
-          limit: Number(opts.limit)
-        });
-      } catch (err) {
-        printError(err.message, 1);
-      }
-      if (opts.quiet) {
-        for (const f of list) {
-          process.stdout.write(`${f.id}
-`);
-        }
-        return;
-      }
-      printOutput(list, {
-        format: opts.format,
-        columns: ["identifier", "title", "priority", "createdAt"]
-      });
-    })
+// src/lib/context-sync/lock.ts
+import path2 from "path";
+
+// src/lib/instructions/safe-write.ts
+import { createHash, randomBytes } from "crypto";
+import { constants } from "fs";
+import {
+  lstat,
+  mkdir,
+  open,
+  readFile,
+  realpath,
+  rename,
+  unlink
+} from "fs/promises";
+import path from "path";
+
+// src/lib/instructions/paths.ts
+var DRIVE_LETTER = /^[A-Za-z]:/;
+var RESERVED_DEVICE_NAME = /^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i;
+var FORBIDDEN_NAME_CHARACTER = /[<>:"|?*]/;
+var RESERVED_ROOTS = [".git", ".fabric"];
+var RESERVED_EXACT_PATHS = [
+  ".claude/settings.local.json",
+  ".codex/hooks.json"
+];
+function hasControlCharacter(input) {
+  for (let index = 0; index < input.length; index++) {
+    const code = input.charCodeAt(index);
+    if (code <= 31 || code === 127) {
+      return true;
+    }
+  }
+  return false;
+}
+function checkRelativePath(input) {
+  if (input.length === 0) {
+    return { ok: false, reason: "empty", detail: input };
+  }
+  if (hasControlCharacter(input)) {
+    return { ok: false, reason: "control_char", detail: input };
+  }
+  if (input.includes("\\")) {
+    return { ok: false, reason: "backslash", detail: input };
+  }
+  if (input.startsWith("/") || DRIVE_LETTER.test(input)) {
+    return { ok: false, reason: "absolute", detail: input };
+  }
+  if (input.endsWith("/")) {
+    return { ok: false, reason: "trailing_separator", detail: input };
+  }
+  const segments = input.split("/");
+  if (segments.some((s) => s.length === 0)) {
+    return { ok: false, reason: "empty", detail: input };
+  }
+  if (segments.some((s) => s === "." || s === "..")) {
+    return { ok: false, reason: "traversal", detail: input };
+  }
+  for (const segment of segments) {
+    if (/[. ]$/.test(segment)) {
+      return {
+        ok: false,
+        reason: "trailing_dot_or_space",
+        detail: input
+      };
+    }
+    if (RESERVED_DEVICE_NAME.test(segment)) {
+      return {
+        ok: false,
+        reason: "reserved_device_name",
+        detail: input
+      };
+    }
+    if (FORBIDDEN_NAME_CHARACTER.test(segment)) {
+      return {
+        ok: false,
+        reason: "forbidden_character",
+        detail: input
+      };
+    }
+  }
+  return { ok: true, path: input };
+}
+function isReservedPath(input) {
+  var _a2;
+  const first = (_a2 = input.split("/")[0]) == null ? void 0 : _a2.toLowerCase();
+  if (RESERVED_ROOTS.some((root) => first === root)) {
+    return true;
+  }
+  const key = collisionKey(input);
+  return RESERVED_EXACT_PATHS.some(
+    (reserved) => collisionKey(reserved) === key
   );
-  features.command("show <id>").description("Show feature details").requiredOption("-p, --project <projectId>", "Project ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--format <format>", "Output format: table|json|yaml", "table").action(
-    (id, opts) => __async(null, null, function* () {
-      var _a2, _b, _c;
-      const ctx = resolveContext(opts.personal, opts.org, false);
-      const client = getClient();
-      let feature;
-      try {
-        feature = yield client.projects.getFeature(
-          opts.project,
-          id,
-          {
-            org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0
-          }
-        );
-      } catch (err) {
-        printError(err.message, 1);
-      }
-      const fmt = opts.format;
-      if (fmt === "json" || fmt === "yaml") {
-        printOutput(feature, { format: fmt });
-        return;
-      }
-      printRecord({
-        ID: feature.id,
-        Identifier: feature.identifier,
-        Title: feature.title,
-        Priority: feature.priority,
-        Description: (_a2 = feature.description) != null ? _a2 : "(none)",
-        "Acceptance Criteria": (_b = feature.acceptanceCriteria) != null ? _b : "(none)",
-        Project: feature.projectId,
-        Assignee: (_c = feature.assigneeId) != null ? _c : "(none)",
-        Created: feature.createdAt.slice(0, 10)
-      });
-    })
-  );
-  features.command("create <title>").description("Create a feature in a project").requiredOption("-p, --project <projectId>", "Project ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("-d, --description <text>", "Feature description").option(
-    "--priority <priority>",
-    "Priority: P0_CRITICAL|P1_HIGH|P2_MEDIUM|P3_LOW (default: P2_MEDIUM)"
-  ).option("--format <format>", "Output format: table|json|yaml", "table").action(
-    (title, opts) => __async(null, null, function* () {
-      const ctx = resolveContext(opts.personal, opts.org, false);
-      const client = getClient();
-      let feature;
-      try {
-        feature = yield client.projects.createFeature(
-          opts.project,
-          {
-            title,
-            description: opts.description,
-            priority: opts.priority,
-            org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0
-          }
+}
+function collisionKey(input) {
+  return input.normalize("NFC").toLowerCase();
+}
+function findCollision(paths) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const candidate of paths) {
+    const key = collisionKey(candidate);
+    const previous = seen.get(key);
+    if (previous !== void 0) {
+      return { first: previous, second: candidate };
+    }
+    seen.set(key, candidate);
+  }
+  return null;
+}
+function describeRejection(rejection) {
+  switch (rejection.reason) {
+    case "empty":
+      return `empty or malformed path (${JSON.stringify(rejection.detail)})`;
+    case "absolute":
+      return `absolute path refused: ${rejection.detail}`;
+    case "traversal":
+      return `path traversal refused: ${rejection.detail}`;
+    case "backslash":
+      return `backslash in path refused: ${rejection.detail}`;
+    case "control_char":
+      return `control character in path refused: ${JSON.stringify(rejection.detail)}`;
+    case "trailing_separator":
+      return `path names a directory, not a file: ${rejection.detail}`;
+    case "trailing_dot_or_space":
+      return `path segment ending in a dot or space refused: ${rejection.detail}`;
+    case "reserved_device_name":
+      return `reserved device name refused: ${rejection.detail}`;
+    case "forbidden_character":
+      return `path contains a character Windows will not put in a filename (< > : " | ? *): ${rejection.detail}`;
+    case "reserved_path":
+      return `this tool never writes or deletes ${RESERVED_ROOTS.join(", ")} or ${RESERVED_EXACT_PATHS.join(", ")}: ${rejection.detail}`;
+    case "not_a_regular_file":
+      return `path is not a regular file: ${rejection.detail}`;
+    case "escapes_destination":
+      return `path resolves outside the destination: ${rejection.detail}`;
+    case "symlink":
+      return `refusing to follow a symlink: ${rejection.detail}`;
+    case "not_a_directory":
+      return `a path component is not a directory: ${rejection.detail}`;
+    case "collision":
+      return `two paths name the same file on a case- or Unicode-insensitive filesystem: ${rejection.detail}`;
+  }
+}
+
+// src/lib/instructions/safe-write.ts
+var ALLOWED_MODES = /* @__PURE__ */ new Set([420, 493]);
+function isAllowedMode(mode) {
+  if (mode === null || mode === void 0) {
+    return true;
+  }
+  if (!Number.isInteger(mode) || mode < 0) {
+    return false;
+  }
+  const type = mode & 61440;
+  if (type !== 0 && type !== 32768) {
+    return false;
+  }
+  return ALLOWED_MODES.has(mode & 4095);
+}
+function permissionBits(mode) {
+  if (mode === null || mode === void 0) {
+    return null;
+  }
+  return mode & 4095;
+}
+function resolveDestinationRoot(destination) {
+  return __async(this, null, function* () {
+    yield mkdir(destination, { recursive: true });
+    return realpath(destination);
+  });
+}
+function assertSafeTarget(root, relativePath) {
+  return __async(this, null, function* () {
+    const target = path.resolve(root, relativePath);
+    if (target === root || !target.startsWith(root + path.sep)) {
+      return {
+        ok: false,
+        reason: "escapes_destination",
+        detail: relativePath
+      };
+    }
+    const segments = relativePath.split("/");
+    let current = root;
+    let deepestExisting = root;
+    for (const [index, segment] of segments.entries()) {
+      current = path.join(current, segment);
+      const stats = yield lstatOrNull(current);
+      if (stats === null) {
+        break;
+      }
+      if (stats.isSymbolicLink()) {
+        return { ok: false, reason: "symlink", detail: current };
+      }
+      if (index < segments.length - 1 && !stats.isDirectory()) {
+        return { ok: false, reason: "not_a_directory", detail: current };
+      }
+      deepestExisting = current;
+    }
+    if (deepestExisting !== root) {
+      const canonical = yield realpath(deepestExisting).catch(() => null);
+      if (canonical !== null && canonical !== root && !canonical.startsWith(root + path.sep)) {
+        return {
+          ok: false,
+          reason: "escapes_destination",
+          detail: relativePath
+        };
+      }
+    }
+    return { ok: true, path: target };
+  });
+}
+function assertWritableTarget(root, relativePath) {
+  return __async(this, null, function* () {
+    const check = yield assertSafeTarget(root, relativePath);
+    if (!check.ok) {
+      return check;
+    }
+    const stats = yield lstatOrNull(check.path);
+    if (stats === null) {
+      return check;
+    }
+    if (stats.isSymbolicLink()) {
+      return { ok: false, reason: "symlink", detail: check.path };
+    }
+    if (!stats.isFile()) {
+      return { ok: false, reason: "not_a_regular_file", detail: check.path };
+    }
+    return check;
+  });
+}
+function readFileSafely(_0, _1) {
+  return __async(this, arguments, function* (root, relativePath, options = {}) {
+    const check = yield assertWritableTarget(root, relativePath);
+    if (!check.ok) {
+      throw new Error(`Refusing to sync: ${describeRejection(check)}.`);
+    }
+    let handle;
+    try {
+      handle = yield open(
+        check.path,
+        constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK
+      );
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return null;
+      }
+      throw error;
+    }
+    try {
+      const opened = yield handle.stat();
+      if (!opened.isFile()) {
+        throw new Error(
+          `Refusing to sync: ${relativePath} is not a regular file.`
         );
-      } catch (err) {
-        printError(err.message, 1);
       }
-      const fmt = opts.format;
-      if (fmt === "json" || fmt === "yaml") {
-        printOutput(feature, { format: fmt });
-        return;
+      const afterOpen = yield assertWritableTarget(root, relativePath);
+      if (!afterOpen.ok) {
+        throw new Error(
+          `Refusing to sync: ${describeRejection(afterOpen)}.`
+        );
       }
-      printSuccess(`Feature ${feature.identifier} created`);
-      printRecord({
-        ID: feature.id,
-        Identifier: feature.identifier,
-        Title: feature.title,
-        Priority: feature.priority,
-        Project: feature.projectId,
-        Created: feature.createdAt.slice(0, 10)
-      });
-    })
-  );
-  features.command("tasks").description("List tasks (sub-items) for a feature").requiredOption("-p, --project <projectId>", "Project ID").requiredOption("-f, --feature <featureId>", "Feature ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
-    "--format <format>",
-    "Output format: table|json|yaml|csv",
-    "table"
-  ).option("-q, --quiet", "Print IDs only").action(
-    (opts) => __async(null, null, function* () {
-      const ctx = resolveContext(opts.personal, opts.org, false);
-      const client = getClient();
-      let tasks;
-      try {
-        tasks = yield client.projects.listTasks(
-          opts.project,
-          opts.feature,
-          {
-            org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0
+      const current = yield lstatOrNull(afterOpen.path);
+      if (current === null || !current.isFile() || current.dev !== opened.dev || current.ino !== opened.ino) {
+        throw new Error(
+          `Refusing to sync: ${relativePath} changed while it was being opened.`
+        );
+      }
+      if (options.maxBytes === void 0) {
+        return { bytes: yield handle.readFile(), mode: opened.mode };
+      }
+      if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0) {
+        throw new Error(
+          "A safe file-read limit must be a non-negative integer."
+        );
+      }
+      if (opened.size > options.maxBytes) {
+        throw new Error(
+          `${relativePath} is too large to read safely (maximum ${options.maxBytes} bytes).`
+        );
+      }
+      const buffer = Buffer.allocUnsafe(options.maxBytes + 1);
+      let total = 0;
+      while (total <= options.maxBytes) {
+        const { bytesRead } = yield handle.read(
+          buffer,
+          total,
+          options.maxBytes + 1 - total,
+          total
+        );
+        if (bytesRead === 0) {
+          break;
+        }
+        total += bytesRead;
+      }
+      if (total > options.maxBytes) {
+        throw new Error(
+          `${relativePath} is too large to read safely (maximum ${options.maxBytes} bytes).`
+        );
+      }
+      return { bytes: buffer.subarray(0, total), mode: opened.mode };
+    } finally {
+      yield handle.close();
+    }
+  });
+}
+function resolveExistingRoot(destination) {
+  return __async(this, null, function* () {
+    return realpath(destination).catch(() => path.resolve(destination));
+  });
+}
+function makeParents(root, relativePath) {
+  return __async(this, null, function* () {
+    const segments = relativePath.split("/").slice(0, -1);
+    let current = root;
+    for (const segment of segments) {
+      current = path.join(current, segment);
+      const stats = yield lstatOrNull(current);
+      if (stats === null) {
+        yield mkdir(current).catch((error) => __async(null, null, function* () {
+          if (error.code !== "EEXIST") {
+            throw error;
+          }
+          const raced = yield lstatOrNull(current);
+          if (raced == null ? void 0 : raced.isSymbolicLink()) {
+            throw new Error(
+              `Refusing to sync: ${describeRejection({ ok: false, reason: "symlink", detail: current })}.`
+            );
           }
+        }));
+        continue;
+      }
+      if (stats.isSymbolicLink()) {
+        throw new Error(
+          `Refusing to sync: ${describeRejection({ ok: false, reason: "symlink", detail: current })}.`
         );
-      } catch (err) {
-        printError(err.message, 1);
       }
-      if (opts.quiet) {
-        for (const t of tasks) {
-          process.stdout.write(`${t.id}
-`);
-        }
-        return;
+      if (!stats.isDirectory()) {
+        throw new Error(
+          `Refusing to sync: ${describeRejection({ ok: false, reason: "not_a_directory", detail: current })}.`
+        );
+      }
+    }
+  });
+}
+function writeFileSafely(input) {
+  return __async(this, null, function* () {
+    var _a2;
+    const check = yield assertSafeTarget(input.root, input.relativePath);
+    if (!check.ok) {
+      throw new Error(`Refusing to sync: ${describeRejection(check)}.`);
+    }
+    if (!isAllowedMode(input.mode)) {
+      throw new Error(
+        `Refusing to sync: ${input.relativePath} asks for file mode ${((_a2 = input.mode) != null ? _a2 : 0).toString(8)}, and only 644 and 755 are accepted.`
+      );
+    }
+    yield makeParents(input.root, input.relativePath);
+    const target = check.path;
+    const directory = path.dirname(target);
+    const directoryBefore = yield lstatOrNull(directory);
+    const temporary = path.join(
+      directory,
+      `.${path.basename(target)}.${randomBytes(8).toString("hex")}.tmp`
+    );
+    let handle = null;
+    try {
+      handle = yield open(temporary, "wx", 384);
+      yield handle.writeFile(input.bytes);
+      const bits = permissionBits(input.mode);
+      if (bits !== null && process.platform !== "win32") {
+        yield handle.chmod(bits);
+      }
+      yield handle.close();
+      handle = null;
+      const parentStats = yield lstatOrNull(directory);
+      if (parentStats === null || parentStats.isSymbolicLink()) {
+        throw new Error(
+          `Refusing to sync: ${describeRejection({ ok: false, reason: "symlink", detail: directory })}.`
+        );
+      }
+      const targetStats = yield lstatOrNull(target);
+      if (targetStats == null ? void 0 : targetStats.isSymbolicLink()) {
+        throw new Error(
+          `Refusing to sync: ${describeRejection({ ok: false, reason: "symlink", detail: target })}.`
+        );
+      }
+      yield rename(temporary, target);
+    } catch (error) {
+      yield handle == null ? void 0 : handle.close().catch(() => {
+      });
+      if (yield isSameDirectory(directory, directoryBefore)) {
+        yield unlink(temporary).catch(() => {
+        });
+      }
+      throw error;
+    }
+  });
+}
+function isSameDirectory(directory, before) {
+  return __async(this, null, function* () {
+    if (before === null) {
+      return false;
+    }
+    const now = yield lstatOrNull(directory);
+    return now !== null && now.dev === before.dev && now.ino === before.ino;
+  });
+}
+function deleteFileSafely(root, relativePath, expectedSha256) {
+  return __async(this, null, function* () {
+    const check = yield assertSafeTarget(root, relativePath);
+    if (!check.ok) {
+      throw new Error(`Refusing to sync: ${describeRejection(check)}.`);
+    }
+    const stats = yield lstatOrNull(check.path);
+    if (stats === null) {
+      return "missing";
+    }
+    if (stats.isSymbolicLink()) {
+      throw new Error(
+        `Refusing to sync: ${describeRejection({ ok: false, reason: "symlink", detail: check.path })}.`
+      );
+    }
+    if (!stats.isFile()) {
+      throw new Error(
+        `Refusing to sync: ${describeRejection({ ok: false, reason: "not_a_regular_file", detail: check.path })}.`
+      );
+    }
+    let actual;
+    try {
+      actual = createHash("sha256").update(yield readFile(check.path)).digest("hex");
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return "missing";
+      }
+      throw error;
+    }
+    if (actual !== expectedSha256) {
+      return "modified";
+    }
+    try {
+      yield unlink(check.path);
+      return "deleted";
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return "missing";
+      }
+      throw error;
+    }
+  });
+}
+function lstatOrNull(target) {
+  return __async(this, null, function* () {
+    try {
+      return yield lstat(target);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return null;
+      }
+      throw error;
+    }
+  });
+}
+function resolvesInside(root, candidate) {
+  return __async(this, null, function* () {
+    const canonicalRoot = yield realpath(root).catch(() => path.resolve(root));
+    const canonicalCandidate = yield realpathDeepest(candidate);
+    return canonicalCandidate === canonicalRoot || canonicalCandidate.startsWith(canonicalRoot + path.sep);
+  });
+}
+function realpathDeepest(candidate) {
+  return __async(this, null, function* () {
+    const absolute = path.resolve(candidate);
+    const tail = [];
+    let current = absolute;
+    for (; ; ) {
+      const resolved = yield realpath(current).catch(() => null);
+      if (resolved !== null) {
+        return tail.length === 0 ? resolved : path.join(resolved, ...tail);
+      }
+      const parent = path.dirname(current);
+      if (parent === current) {
+        return absolute;
       }
-      printOutput(tasks, {
-        format: opts.format,
-        columns: [
-          "identifier",
-          "title",
-          "status",
-          "estimatedHours"
-        ]
-      });
-    })
+      tail.unshift(path.basename(current));
+      current = parent;
+    }
+  });
+}
+
+// src/lib/context-sync/source-path.ts
+var MAX_CONTEXT_SOURCE_PATH_LENGTH = 512;
+var CONTROL_OR_FORMAT_CHARACTER = /[\u0000-\u001f\u007f-\u009f\p{Cf}]/u;
+var DRIVE_LETTER_PREFIX = /^[A-Za-z]:/;
+function hasControlOrFormatCharacter(value) {
+  return CONTROL_OR_FORMAT_CHARACTER.test(value);
+}
+function normalizeContextSourcePath(input) {
+  const slashed = input.normalize("NFC").replace(/\\/g, "/");
+  if (hasControlOrFormatCharacter(slashed)) {
+    return { ok: false, reason: "control-character" };
+  }
+  if (slashed.startsWith("/") || DRIVE_LETTER_PREFIX.test(slashed)) {
+    return { ok: false, reason: "absolute" };
+  }
+  let path9 = slashed.replace(/\/{2,}/g, "/");
+  while (path9.startsWith("./")) {
+    path9 = path9.slice(2);
+  }
+  if (path9.length === 0) {
+    return { ok: false, reason: "empty" };
+  }
+  if (path9.endsWith("/")) {
+    return { ok: false, reason: "trailing-slash" };
+  }
+  if (path9.split("/").some((segment) => segment === "." || segment === "..")) {
+    return { ok: false, reason: "dot-segment" };
+  }
+  if (path9.length > MAX_CONTEXT_SOURCE_PATH_LENGTH) {
+    return { ok: false, reason: "too-long" };
+  }
+  return { ok: true, sourcePath: path9 };
+}
+
+// src/lib/context-sync/lock.ts
+var CONTEXT_LOCK_DIRECTORY = ".fabric";
+var CONTEXT_LOCK_FILENAME = "context.lock";
+var CONTEXT_LOCK_VERSION = 1;
+var CONTEXT_LOCK_RELATIVE_PATH = `${CONTEXT_LOCK_DIRECTORY}/${CONTEXT_LOCK_FILENAME}`;
+var MAX_CONTEXT_LOCK_BYTES = 32 * 1024 * 1024;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+function contextLockPath(root) {
+  return path2.join(root, CONTEXT_LOCK_DIRECTORY, CONTEXT_LOCK_FILENAME);
+}
+function readContextLock(root) {
+  return __async(this, null, function* () {
+    const file = contextLockPath(root);
+    const read = yield readFileSafely(root, CONTEXT_LOCK_RELATIVE_PATH, {
+      maxBytes: MAX_CONTEXT_LOCK_BYTES
+    });
+    if (read === null) {
+      return null;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(new TextDecoder().decode(read.bytes));
+    } catch (e) {
+      throw new Error(
+        `${file} is unreadable: it is not valid JSON. Delete it to push every file again with no expected version.`
+      );
+    }
+    const problem = lockProblem(parsed);
+    if (problem !== null) {
+      throw new Error(
+        `${file} is unreadable: ${problem}. Delete it to push every file again with no expected version.`
+      );
+    }
+    return parsed;
+  });
+}
+function serializeLock(lock) {
+  return `${JSON.stringify(lock, null, 2).replace(/\r\n/g, "\n")}
+`;
+}
+function writeContextLock(root, lock) {
+  return __async(this, null, function* () {
+    yield writeFileSafely({
+      root,
+      relativePath: CONTEXT_LOCK_RELATIVE_PATH,
+      bytes: new TextEncoder().encode(serializeLock(lock))
+    });
+  });
+}
+function lockProblem(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return "it is not a JSON object";
+  }
+  const candidate = value;
+  if (candidate.version !== CONTEXT_LOCK_VERSION) {
+    return `its version is ${JSON.stringify(candidate.version)} and this build writes version ${CONTEXT_LOCK_VERSION}`;
+  }
+  for (const field of ["projectId", "pushedAt"]) {
+    const actual = candidate[field];
+    if (typeof actual !== "string" || actual.length === 0) {
+      return `its "${field}" is not a non-empty string`;
+    }
+  }
+  if (typeof candidate.files !== "object" || candidate.files === null || Array.isArray(candidate.files)) {
+    return 'its "files" is not an object';
+  }
+  for (const [filePath, entry] of Object.entries(
+    candidate.files
+  )) {
+    const normalized = normalizeContextSourcePath(filePath);
+    if (!normalized.ok || normalized.sourcePath !== filePath) {
+      return `it names ${JSON.stringify(filePath)}, which is not a path the server stores`;
+    }
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+      return `its entry for ${JSON.stringify(filePath)} is not an object`;
+    }
+    const record = entry;
+    if (typeof record.sha256 !== "string" || !SHA256_HEX.test(record.sha256)) {
+      return `its entry for ${JSON.stringify(filePath)} has no 64-character hex sha256`;
+    }
+    if (record.state === "duplicate") {
+      if (record.contextId !== void 0) {
+        return `its duplicate entry for ${JSON.stringify(filePath)} names a contextId, which a duplicate never has`;
+      }
+      continue;
+    }
+    if (record.state !== void 0) {
+      return `its entry for ${JSON.stringify(filePath)} has an unknown state ${JSON.stringify(record.state)}`;
+    }
+    if (typeof record.contextId !== "string" || record.contextId.length === 0) {
+      return `its entry for ${JSON.stringify(filePath)} has no contextId`;
+    }
+  }
+  return null;
+}
+
+// src/lib/context-sync/classify.ts
+import { createHash as createHash2 } from "crypto";
+import path3 from "path";
+var MAX_CONTEXT_FILE_BYTES = 2 * 1024 * 1024;
+var CONTEXT_TEXT_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".md",
+  ".markdown",
+  ".txt",
+  ".json",
+  ".yaml",
+  ".yml"
+]);
+var HAS_NON_WHITESPACE = /\S/;
+function hasTextExtension(relativePath) {
+  return CONTEXT_TEXT_EXTENSIONS.has(
+    path3.posix.extname(relativePath).toLowerCase()
   );
-  features.command("update <id>").description("Update a feature").requiredOption("-p, --project <projectId>", "Project ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--title <title>", "New title").option("-d, --description <text>", "New description").option(
-    "--priority <priority>",
-    "Priority: P0_CRITICAL|P1_HIGH|P2_MEDIUM|P3_LOW"
-  ).option("--format <format>", "Output format: table|json|yaml", "table").action(
-    (id, opts) => __async(null, null, function* () {
-      const ctx = resolveContext(opts.personal, opts.org, false);
-      const client = getClient();
-      let feature;
-      try {
-        feature = yield client.projects.updateFeature(
-          opts.project,
-          id,
-          {
-            title: opts.title,
-            description: opts.description,
-            priority: opts.priority,
-            org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0
+}
+function classifyContextBytes(bytes) {
+  if (bytes.byteLength > MAX_CONTEXT_FILE_BYTES) {
+    return { ok: false, reason: "too-large" };
+  }
+  let content;
+  try {
+    content = new TextDecoder("utf-8", {
+      fatal: true,
+      ignoreBOM: true
+    }).decode(bytes);
+  } catch (e) {
+    return { ok: false, reason: "binary" };
+  }
+  if (content.includes("\0")) {
+    return { ok: false, reason: "binary" };
+  }
+  if (!HAS_NON_WHITESPACE.test(content)) {
+    return { ok: false, reason: "empty" };
+  }
+  return { ok: true, content };
+}
+function hashContextContent(content) {
+  return createHash2("sha256").update(content, "utf8").digest("hex");
+}
+
+// src/lib/context-sync/ignore.ts
+import ignore from "ignore";
+var CONTEXT_IGNORE_FILENAME = ".contextignore";
+var DEFAULT_CONTEXT_IGNORE_PATTERNS = [
+  ".git/",
+  ".fabric/",
+  ".claude/",
+  ".cursor/",
+  ".codex/",
+  "node_modules/",
+  "CLAUDE.md",
+  "AGENTS.md",
+  "GEMINI.md",
+  "skills/",
+  "agents/",
+  "hooks/",
+  "rules/",
+  "scripts/",
+  CONTEXT_IGNORE_FILENAME
+];
+function buildContextIgnoreRules(input = {}) {
+  const defaults = ignore().add([...DEFAULT_CONTEXT_IGNORE_PATTERNS]);
+  const user = ignore();
+  if (input.contextIgnore) {
+    user.add(input.contextIgnore);
+  }
+  if (input.excludes && input.excludes.length > 0) {
+    user.add([...input.excludes]);
+  }
+  const ignores = (candidate) => defaults.ignores(candidate) || user.ignores(candidate);
+  return {
+    ignoresFile: (relativePath) => ignores(relativePath),
+    // The trailing slash is what makes a directory-only pattern
+    // (`drafts/`) match: gitignore semantics, as the package implements
+    // them.
+    ignoresDirectory: (relativePath) => ignores(`${relativePath}/`)
+  };
+}
+
+// src/lib/context-sync/walk.ts
+import { lstat as lstat2, readdir } from "fs/promises";
+import path4 from "path";
+function byPath(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function walkContextDirectory(root, rules) {
+  return __async(this, null, function* () {
+    const walk = {
+      files: [],
+      symlinks: [],
+      special: [],
+      unmatchable: [],
+      ignored: []
+    };
+    const pending = [""];
+    while (pending.length > 0) {
+      const relativeDirectory = pending.pop();
+      const names = yield readdir(path4.join(root, relativeDirectory));
+      for (const name of names) {
+        const relative = relativeDirectory ? `${relativeDirectory}/${name}` : name;
+        let stats;
+        try {
+          stats = yield lstat2(path4.join(root, relative));
+        } catch (error) {
+          if (error.code === "ENOENT") {
+            continue;
           }
-        );
-      } catch (err) {
-        printError(err.message, 1);
-      }
-      const fmt = opts.format;
-      if (fmt === "json" || fmt === "yaml") {
-        printOutput(feature, { format: fmt });
-        return;
+          throw error;
+        }
+        let ignored;
+        try {
+          ignored = stats.isDirectory() ? rules.ignoresDirectory(relative) : stats.isSymbolicLink() ? rules.ignoresFile(relative) || rules.ignoresDirectory(relative) : rules.ignoresFile(relative);
+        } catch (e) {
+          walk.unmatchable.push(relative);
+          continue;
+        }
+        if (ignored) {
+          walk.ignored.push({
+            path: relative,
+            // A link was matched as a directory too, so what would sit
+            // beneath it counts as ignored with it.
+            directory: stats.isDirectory() || stats.isSymbolicLink()
+          });
+          continue;
+        }
+        if (stats.isSymbolicLink()) {
+          walk.symlinks.push(relative);
+        } else if (stats.isDirectory()) {
+          pending.push(relative);
+        } else if (stats.isFile()) {
+          walk.files.push({ path: relative, size: stats.size });
+        } else {
+          walk.special.push(relative);
+        }
       }
-      printRecord({
-        ID: feature.id,
-        Identifier: feature.identifier,
-        Title: feature.title,
-        Priority: feature.priority,
-        Updated: feature.updatedAt.slice(0, 10)
-      });
-    })
-  );
-  return features;
+    }
+    walk.files.sort((a, b) => byPath(a.path, b.path));
+    walk.symlinks.sort(byPath);
+    walk.special.sort(byPath);
+    walk.unmatchable.sort(byPath);
+    walk.ignored.sort((a, b) => byPath(a.path, b.path));
+    return walk;
+  });
 }
 
-// src/commands/frames/index.ts
-import { Command as Command10 } from "commander";
-function buildFramesCommand() {
-  const frames = new Command10("frames").description(
-    "Manage AI-generated frames and slideshows"
-  );
-  frames.command("list").description("List frames and slideshows").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--limit <n>", "Max results (default 50)", "50").option(
-    "--format <format>",
-    "Output format: table|json|yaml|csv",
-    "table"
-  ).option("-q, --quiet", "Print IDs only").action(
-    (opts) => __async(null, null, function* () {
-      const ctx = resolveContext(opts.personal, opts.org, false);
-      const client = getClient();
-      let list;
-      try {
-        list = yield client.frames.list({
-          org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0,
-          limit: Number(opts.limit)
+// src/lib/context-sync/plan.ts
+function byPath2(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function readContextIgnore(root) {
+  return __async(this, null, function* () {
+    const read = yield readFileSafely(root, CONTEXT_IGNORE_FILENAME, {
+      maxBytes: 1024 * 1024
+    });
+    return read === null ? null : new TextDecoder().decode(read.bytes);
+  });
+}
+function ignoredByWalk(ignored) {
+  const exact = new Set(ignored.map((entry) => entry.path.normalize("NFC")));
+  const directories = ignored.filter((entry) => entry.directory).map((entry) => `${entry.path.normalize("NFC")}/`);
+  return (sourcePath) => exact.has(sourcePath) || directories.some((prefix) => sourcePath.startsWith(prefix));
+}
+function sharedPathProblem(entry, group2) {
+  const others = group2.filter((other) => other.diskPath !== entry.diskPath);
+  if (others.length === 0) {
+    return null;
+  }
+  const names = others.map((other) => other.diskPath).join(", ");
+  return others.every((other) => other.sourcePath === entry.sourcePath) ? `names the same source as ${names}` : `case-only collision with ${names}`;
+}
+function computeContextPlan(input) {
+  return __async(this, null, function* () {
+    var _a2, _b, _c;
+    const { root, lock } = input;
+    const rules = buildContextIgnoreRules({
+      contextIgnore: yield readContextIgnore(root),
+      excludes: input.excludes
+    });
+    const walk = yield walkContextDirectory(root, rules);
+    const skipped = [
+      ...walk.symlinks.map((p) => ({ path: p, reason: "symlink" })),
+      ...walk.special.map((p) => ({
+        path: p,
+        reason: "unsupported-type"
+      })),
+      ...walk.unmatchable.map((p) => ({
+        path: p,
+        reason: "invalid-path",
+        detail: "cannot be matched against the ignore rules"
+      }))
+    ];
+    const readable = [];
+    for (const file of walk.files) {
+      if (file.path.includes("\\")) {
+        skipped.push({
+          path: file.path,
+          reason: "invalid-path",
+          detail: "backslash"
         });
-      } catch (err) {
-        printError(err.message, 1);
+        continue;
       }
-      if (opts.quiet) {
-        for (const f of list) {
-          process.stdout.write(`${f.id}
-`);
-        }
-        return;
+      const normalized = normalizeContextSourcePath(file.path);
+      if (!normalized.ok) {
+        skipped.push({
+          path: file.path,
+          reason: "invalid-path",
+          detail: normalized.reason
+        });
+        continue;
       }
-      printOutput(list, {
-        format: opts.format,
-        columns: [
-          "id",
-          "title",
-          "fileType",
-          "status",
-          "isPublic",
-          "updatedAt"
-        ]
+      if (!hasTextExtension(file.path)) {
+        skipped.push({ path: file.path, reason: "unsupported-type" });
+        continue;
+      }
+      if (file.size > MAX_CONTEXT_FILE_BYTES) {
+        skipped.push({ path: file.path, reason: "too-large" });
+        continue;
+      }
+      readable.push({
+        diskPath: file.path,
+        sourcePath: normalized.sourcePath
       });
-    })
-  );
-  frames.command("show <id>").description("Show frame details").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--format <format>", "Output format: table|json|yaml", "table").action(
-    (id, opts) => __async(null, null, function* () {
-      var _a2, _b, _c;
-      const ctx = resolveContext(opts.personal, opts.org, false);
-      const client = getClient();
-      let frame;
-      try {
-        frame = yield client.frames.get(id, {
-          org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0
+    }
+    const byFoldedPath = /* @__PURE__ */ new Map();
+    for (const entry of readable) {
+      const key = entry.sourcePath.toLowerCase();
+      byFoldedPath.set(key, [...(_a2 = byFoldedPath.get(key)) != null ? _a2 : [], entry]);
+    }
+    const push = [];
+    const unchangedLocal = [];
+    const present = /* @__PURE__ */ new Set();
+    for (const entry of readable) {
+      const problem = sharedPathProblem(
+        entry,
+        (_b = byFoldedPath.get(entry.sourcePath.toLowerCase())) != null ? _b : []
+      );
+      if (problem !== null) {
+        skipped.push({
+          path: entry.diskPath,
+          reason: "invalid-path",
+          detail: problem
         });
-      } catch (err) {
-        printError(err.message, 1);
-      }
-      const fmt = opts.format;
-      if (fmt === "json" || fmt === "yaml") {
-        printOutput(frame, { format: fmt });
-        return;
+        continue;
       }
-      printRecord({
-        ID: frame.id,
-        Title: frame.title,
-        Kind: (_a2 = frame.kind) != null ? _a2 : "(none)",
-        "File Type": frame.fileType,
-        Status: frame.status,
-        Public: frame.isPublic ? "yes" : "no",
-        "Share Token": (_b = frame.shareToken) != null ? _b : "(none)",
-        Description: (_c = frame.description) != null ? _c : "(none)",
-        Updated: frame.updatedAt.slice(0, 10)
+      const read = yield readFileSafely(root, entry.diskPath, {
+        maxBytes: MAX_CONTEXT_FILE_BYTES
+      }).catch((error) => {
+        if (error instanceof Error && /too large/.test(error.message)) {
+          return "too-large";
+        }
+        throw error;
       });
-    })
-  );
-  return frames;
-}
-
-// src/commands/instructions/index.ts
-import path4 from "path";
-import { Command as Command11 } from "commander";
-
-// src/lib/instructions/apply.ts
-import { createHash as createHash2 } from "crypto";
-import { chmod } from "fs/promises";
-
-// src/lib/instructions/paths.ts
-var DRIVE_LETTER = /^[A-Za-z]:/;
-var RESERVED_DEVICE_NAME = /^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i;
-var FORBIDDEN_NAME_CHARACTER = /[<>:"|?*]/;
-var RESERVED_ROOTS = [".git", ".fabric"];
-var RESERVED_EXACT_PATHS = [
-  ".claude/settings.local.json",
-  ".codex/hooks.json"
-];
-function hasControlCharacter(input) {
-  for (let index = 0; index < input.length; index++) {
-    const code = input.charCodeAt(index);
-    if (code <= 31 || code === 127) {
-      return true;
+      if (read === null) {
+        continue;
+      }
+      if (read === "too-large") {
+        skipped.push({ path: entry.diskPath, reason: "too-large" });
+        continue;
+      }
+      const verdict = classifyContextBytes(read.bytes);
+      if (!verdict.ok) {
+        skipped.push({ path: entry.diskPath, reason: verdict.reason });
+        continue;
+      }
+      const sha256 = hashContextContent(verdict.content);
+      const locked = lock == null ? void 0 : lock.files[entry.sourcePath];
+      const plannedFile = {
+        sourcePath: entry.sourcePath,
+        diskPath: entry.diskPath,
+        sha256,
+        bytes: read.bytes.byteLength
+      };
+      if ((locked == null ? void 0 : locked.sha256) === sha256) {
+        unchangedLocal.push(entry.sourcePath);
+      } else {
+        push.push(
+          // A duplicate never had a row of its own, so there is no
+          // version to name: it is sent like a new path.
+          locked && locked.state !== "duplicate" ? __spreadProps(__spreadValues({}, plannedFile), { expectedContentHash: locked.sha256 }) : plannedFile
+        );
+      }
+      present.add(entry.sourcePath);
     }
-  }
-  return false;
+    for (const skip of skipped) {
+      const check = normalizeContextSourcePath(skip.path);
+      if (check.ok) {
+        present.add(check.sourcePath);
+      }
+    }
+    const isIgnored = ignoredByWalk(walk.ignored);
+    const removed = [];
+    const forgotten = [];
+    for (const [sourcePath, entry] of Object.entries((_c = lock == null ? void 0 : lock.files) != null ? _c : {})) {
+      if (present.has(sourcePath)) {
+        continue;
+      }
+      if (entry.state === "duplicate") {
+        forgotten.push(sourcePath);
+      } else if (isIgnored(sourcePath)) {
+        skipped.push({ path: sourcePath, reason: "ignored" });
+      } else {
+        removed.push(sourcePath);
+      }
+    }
+    push.sort((a, b) => byPath2(a.sourcePath, b.sourcePath));
+    unchangedLocal.sort(byPath2);
+    removed.sort(byPath2);
+    forgotten.sort(byPath2);
+    skipped.sort((a, b) => byPath2(a.path, b.path));
+    return { push, unchangedLocal, removed, forgotten, skipped };
+  });
 }
-function checkRelativePath(input) {
-  if (input.length === 0) {
-    return { ok: false, reason: "empty", detail: input };
-  }
-  if (hasControlCharacter(input)) {
-    return { ok: false, reason: "control_char", detail: input };
-  }
-  if (input.includes("\\")) {
-    return { ok: false, reason: "backslash", detail: input };
-  }
-  if (input.startsWith("/") || DRIVE_LETTER.test(input)) {
-    return { ok: false, reason: "absolute", detail: input };
+
+// src/lib/context-sync/push.ts
+var RUN_LEVEL_STATUSES = /* @__PURE__ */ new Set([401, 403, 404, 429]);
+var RUN_LEVEL_CODES = /* @__PURE__ */ new Set(["NETWORK_ERROR", "TIMEOUT"]);
+function stopsTheRun(error) {
+  const { status, code } = error;
+  return typeof status === "number" && RUN_LEVEL_STATUSES.has(status) || typeof code === "string" && RUN_LEVEL_CODES.has(code);
+}
+function conflictOf(error) {
+  if (typeof error !== "object" || error === null) {
+    return null;
   }
-  if (input.endsWith("/")) {
-    return { ok: false, reason: "trailing_separator", detail: input };
+  const conflict = error.conflict;
+  if (typeof conflict === "object" && conflict !== null && conflict.status === "conflict" && "current" in conflict && // An object, or `null` for a named version deleted on the server.
+  typeof conflict.current === "object") {
+    return conflict;
   }
-  const segments = input.split("/");
-  if (segments.some((s) => s.length === 0)) {
-    return { ok: false, reason: "empty", detail: input };
+  return null;
+}
+function readPlannedContent(root, entry) {
+  return __async(this, null, function* () {
+    const read = yield readFileSafely(root, entry.diskPath, {
+      maxBytes: MAX_CONTEXT_FILE_BYTES
+    }).catch((error) => {
+      if (error instanceof Error && /too large/.test(error.message)) {
+        return null;
+      }
+      throw error;
+    });
+    if (read === null) {
+      return null;
+    }
+    const verdict = classifyContextBytes(read.bytes);
+    if (!verdict.ok || hashContextContent(verdict.content) !== entry.sha256) {
+      return null;
+    }
+    return verdict.content;
+  });
+}
+function fromResult(sourcePath, result) {
+  if (result.status === "duplicate") {
+    return {
+      sourcePath,
+      status: "duplicate",
+      contentHash: result.contentHash,
+      duplicateOfContextId: result.duplicateOfContextId,
+      duplicateOfSourcePath: result.duplicateOfSourcePath
+    };
   }
-  if (segments.some((s) => s === "." || s === "..")) {
-    return { ok: false, reason: "traversal", detail: input };
+  return {
+    sourcePath,
+    status: result.status,
+    contextId: result.contextId,
+    contentHash: result.contentHash
+  };
+}
+function pushContextPlan(input) {
+  return __async(this, null, function* () {
+    var _a2;
+    const results = [];
+    const send = (entry, content, expectedContentHash) => input.client.contexts.upsertSyncedFile(
+      input.projectId,
+      __spreadValues({
+        sourcePath: entry.sourcePath,
+        content
+      }, expectedContentHash !== void 0 ? { expectedContentHash } : {}),
+      { org: input.org }
+    );
+    for (const entry of input.plan.push) {
+      try {
+        const content = yield readPlannedContent(input.root, entry);
+        if (content === null) {
+          results.push({
+            sourcePath: entry.sourcePath,
+            status: "changed-during-run"
+          });
+          continue;
+        }
+        try {
+          results.push(
+            fromResult(
+              entry.sourcePath,
+              yield send(entry, content, entry.expectedContentHash)
+            )
+          );
+        } catch (error) {
+          const conflict = conflictOf(error);
+          if (conflict === null) {
+            throw error;
+          }
+          const { current } = conflict;
+          if (!input.force || current !== null && current.contentHash === null) {
+            results.push({
+              sourcePath: entry.sourcePath,
+              status: "conflict",
+              contentHash: conflict.contentHash,
+              wasLocked: entry.expectedContentHash !== void 0,
+              afterForce: false,
+              current
+            });
+            continue;
+          }
+          const forcedContent = yield readPlannedContent(
+            input.root,
+            entry
+          );
+          if (forcedContent === null) {
+            results.push({
+              sourcePath: entry.sourcePath,
+              status: "changed-during-run"
+            });
+            continue;
+          }
+          try {
+            const forced = fromResult(
+              entry.sourcePath,
+              yield send(
+                entry,
+                forcedContent,
+                current === null ? void 0 : (_a2 = current.contentHash) != null ? _a2 : void 0
+              )
+            );
+            results.push(
+              forced.status === "updated" && current !== null ? __spreadProps(__spreadValues({}, forced), { overwrote: current }) : forced
+            );
+          } catch (retryError) {
+            const again = conflictOf(retryError);
+            if (again === null) {
+              throw retryError;
+            }
+            results.push({
+              sourcePath: entry.sourcePath,
+              status: "conflict",
+              contentHash: again.contentHash,
+              wasLocked: entry.expectedContentHash !== void 0,
+              afterForce: true,
+              current: again.current
+            });
+          }
+        }
+      } catch (error) {
+        const failure = asCliFailure(error);
+        if (stopsTheRun(error)) {
+          return { results, stoppedBy: failure };
+        }
+        results.push({
+          sourcePath: entry.sourcePath,
+          status: "failed",
+          error: describeError(error),
+          exitCode: failure.exitCode
+        });
+      }
+    }
+    return { results, stoppedBy: null };
+  });
+}
+function nextContextLock(input) {
+  var _a2, _b, _c;
+  const files = __spreadValues({}, (_b = (_a2 = input.previous) == null ? void 0 : _a2.files) != null ? _b : {});
+  let changed = false;
+  for (const sourcePath of (_c = input.forgotten) != null ? _c : []) {
+    if (sourcePath in files) {
+      delete files[sourcePath];
+      changed = true;
+    }
   }
-  for (const segment of segments) {
-    if (/[. ]$/.test(segment)) {
-      return {
-        ok: false,
-        reason: "trailing_dot_or_space",
-        detail: input
+  for (const result of input.results) {
+    if (result.status === "duplicate") {
+      const before2 = files[result.sourcePath];
+      if ((before2 == null ? void 0 : before2.state) === "duplicate" && before2.sha256 === result.contentHash) {
+        continue;
+      }
+      files[result.sourcePath] = {
+        sha256: result.contentHash,
+        state: "duplicate"
       };
+      changed = true;
+      continue;
     }
-    if (RESERVED_DEVICE_NAME.test(segment)) {
-      return {
-        ok: false,
-        reason: "reserved_device_name",
-        detail: input
-      };
+    if (result.status !== "created" && result.status !== "updated" && result.status !== "unchanged") {
+      continue;
     }
-    if (FORBIDDEN_NAME_CHARACTER.test(segment)) {
-      return {
-        ok: false,
-        reason: "forbidden_character",
-        detail: input
-      };
+    const before = files[result.sourcePath];
+    if ((before == null ? void 0 : before.state) === void 0 && (before == null ? void 0 : before.sha256) === result.contentHash && before.contextId === result.contextId) {
+      continue;
     }
+    files[result.sourcePath] = {
+      sha256: result.contentHash,
+      contextId: result.contextId
+    };
+    changed = true;
   }
-  return { ok: true, path: input };
+  if (!changed) {
+    return null;
+  }
+  return {
+    version: CONTEXT_LOCK_VERSION,
+    projectId: input.projectId,
+    pushedAt: input.now.toISOString(),
+    files
+  };
 }
-function isReservedPath(input) {
+
+// src/lib/context-sync/report.ts
+function countOutcomes(plan, results) {
+  const count = (status) => results.filter((r) => r.status === status).length;
+  return {
+    created: count("created"),
+    updated: count("updated"),
+    unchanged: count("unchanged") + plan.unchangedLocal.length,
+    duplicate: count("duplicate"),
+    conflict: count("conflict"),
+    changedDuringRun: count("changed-during-run"),
+    failed: count("failed"),
+    removed: plan.removed.length,
+    skipped: plan.skipped.length
+  };
+}
+function who(current) {
+  var _a2, _b;
+  return (_b = (_a2 = current.contentUpdatedBy) == null ? void 0 : _a2.name) != null ? _b : "someone";
+}
+function when(current) {
   var _a2;
-  const first = (_a2 = input.split("/")[0]) == null ? void 0 : _a2.toLowerCase();
-  if (RESERVED_ROOTS.some((root) => first === root)) {
-    return true;
-  }
-  const key = collisionKey(input);
-  return RESERVED_EXACT_PATHS.some(
-    (reserved) => collisionKey(reserved) === key
-  );
+  return (_a2 = current.contentUpdatedAt) != null ? _a2 : "an unknown time";
 }
-function collisionKey(input) {
-  return input.normalize("NFC").toLowerCase();
+function conflictLine(result) {
+  const { current } = result;
+  if (current === null) {
+    return `${result.sourcePath}: deleted on the server since your last push`;
+  }
+  let text;
+  if (result.afterForce) {
+    text = `changed on the server again by ${who(current)} at ${when(current)} while --force was replacing it`;
+  } else if (result.wasLocked) {
+    text = `changed on the server by ${who(current)} at ${when(current)} since your last push`;
+  } else {
+    text = `already on the server with different content, last changed by ${who(current)} at ${when(current)}`;
+  }
+  if (current.contentHash === null) {
+    text += "; that version has no content hash, so --force cannot replace it";
+  }
+  return `${result.sourcePath}: ${text}`;
 }
-function findCollision(paths) {
-  const seen = /* @__PURE__ */ new Map();
-  for (const candidate of paths) {
-    const key = collisionKey(candidate);
-    const previous = seen.get(key);
-    if (previous !== void 0) {
-      return { first: previous, second: candidate };
-    }
-    seen.set(key, candidate);
+function storedLine(result) {
+  if (result.overwrote) {
+    return `${result.sourcePath}: replaced the version ${who(result.overwrote)} changed at ${when(result.overwrote)} (--force)`;
   }
-  return null;
+  return result.sourcePath;
 }
-function describeRejection(rejection) {
-  switch (rejection.reason) {
-    case "empty":
-      return `empty or malformed path (${JSON.stringify(rejection.detail)})`;
-    case "absolute":
-      return `absolute path refused: ${rejection.detail}`;
-    case "traversal":
-      return `path traversal refused: ${rejection.detail}`;
-    case "backslash":
-      return `backslash in path refused: ${rejection.detail}`;
-    case "control_char":
-      return `control character in path refused: ${JSON.stringify(rejection.detail)}`;
-    case "trailing_separator":
-      return `path names a directory, not a file: ${rejection.detail}`;
-    case "trailing_dot_or_space":
-      return `path segment ending in a dot or space refused: ${rejection.detail}`;
-    case "reserved_device_name":
-      return `reserved device name refused: ${rejection.detail}`;
-    case "forbidden_character":
-      return `path contains a character Windows will not put in a filename (< > : " | ? *): ${rejection.detail}`;
-    case "reserved_path":
-      return `this tool never writes or deletes ${RESERVED_ROOTS.join(", ")} or ${RESERVED_EXACT_PATHS.join(", ")}: ${rejection.detail}`;
-    case "not_a_regular_file":
-      return `path is not a regular file: ${rejection.detail}`;
-    case "escapes_destination":
-      return `path resolves outside the destination: ${rejection.detail}`;
-    case "symlink":
-      return `refusing to follow a symlink: ${rejection.detail}`;
-    case "not_a_directory":
-      return `a path component is not a directory: ${rejection.detail}`;
-    case "collision":
-      return `two paths name the same file on a case- or Unicode-insensitive filesystem: ${rejection.detail}`;
+function skippedLine(skip) {
+  if (skip.reason === "ignored") {
+    return `${skip.path}: now excluded by the ignore rules; server entry kept`;
   }
+  return skip.detail ? `${skip.path}: ${skip.reason} (${skip.detail})` : `${skip.path}: ${skip.reason}`;
 }
-
-// src/lib/instructions/safe-write.ts
-import { createHash, randomBytes } from "crypto";
-import { constants } from "fs";
-import {
-  lstat,
-  mkdir,
-  open,
-  readFile,
-  realpath,
-  rename,
-  unlink
-} from "fs/promises";
-import path from "path";
-var ALLOWED_MODES = /* @__PURE__ */ new Set([420, 493]);
-function isAllowedMode(mode) {
-  if (mode === null || mode === void 0) {
-    return true;
+function group(lines, label, items) {
+  if (items.length === 0) {
+    return;
   }
-  if (!Number.isInteger(mode) || mode < 0) {
-    return false;
+  lines.push(`${label} (${items.length})`);
+  for (const item of items) {
+    lines.push(`  ${item}`);
   }
-  const type = mode & 61440;
-  if (type !== 0 && type !== 32768) {
-    return false;
+}
+function formatPushReport(input) {
+  const { plan, results } = input;
+  const of = (status) => results.filter((r) => r.status === status);
+  const lines = [
+    `Context push from ${input.directory} to project ${input.projectId}:`
+  ];
+  group(lines, "created", of("created").map(storedLine));
+  group(lines, "updated", of("updated").map(storedLine));
+  group(
+    lines,
+    "duplicate",
+    of("duplicate").map(
+      (r) => {
+        var _a2;
+        return `${r.sourcePath}: duplicate of ${(_a2 = r.duplicateOfSourcePath) != null ? _a2 : "another source in this project"}`;
+      }
+    )
+  );
+  group(lines, "conflict", of("conflict").map(conflictLine));
+  group(
+    lines,
+    "changed during the run",
+    of("changed-during-run").map(
+      (r) => `${r.sourcePath}: changed-during-run; not sent, the next push sends the new content`
+    )
+  );
+  group(
+    lines,
+    "failed",
+    of("failed").map((r) => `${r.sourcePath}: ${r.error}`)
+  );
+  group(
+    lines,
+    "removed",
+    plan.removed.map((p) => `${p}: removed locally; server entry kept`)
+  );
+  group(lines, "skipped", plan.skipped.map(skippedLine));
+  const unchanged = countOutcomes(plan, results).unchanged;
+  if (unchanged > 0) {
+    lines.push(`unchanged (${unchanged})`);
   }
-  return ALLOWED_MODES.has(mode & 4095);
+  return lines;
+}
+function formatDryRunReport(input) {
+  const { plan } = input;
+  const lines = [
+    `Dry run of a context push from ${input.directory} to project ${input.projectId}: nothing was sent and the lock was not written.`
+  ];
+  group(
+    lines,
+    "new",
+    plan.push.filter((entry) => entry.expectedContentHash === void 0).map((entry) => entry.sourcePath)
+  );
+  group(
+    lines,
+    "changed",
+    plan.push.filter((entry) => entry.expectedContentHash !== void 0).map((entry) => entry.sourcePath)
+  );
+  group(
+    lines,
+    "removed",
+    plan.removed.map(
+      (p) => `${p}: removed locally; server entry would be kept`
+    )
+  );
+  group(lines, "skipped", plan.skipped.map(skippedLine));
+  if (plan.unchangedLocal.length > 0) {
+    lines.push(`unchanged (${plan.unchangedLocal.length})`);
+  }
+  return lines;
+}
+function contextPushJson(input) {
+  return {
+    projectId: input.projectId,
+    directory: input.directory,
+    dryRun: input.dryRun,
+    force: input.force,
+    lock: input.lockPath,
+    lockWritten: input.lockWritten,
+    plan: {
+      push: input.plan.push.map((entry) => {
+        var _a2;
+        return {
+          sourcePath: entry.sourcePath,
+          sha256: entry.sha256,
+          bytes: entry.bytes,
+          expectedContentHash: (_a2 = entry.expectedContentHash) != null ? _a2 : null
+        };
+      }),
+      unchangedLocal: input.plan.unchangedLocal,
+      removed: input.plan.removed,
+      forgotten: input.plan.forgotten,
+      skipped: input.plan.skipped
+    },
+    results: input.results,
+    counts: countOutcomes(input.plan, input.results)
+  };
 }
-function permissionBits(mode) {
-  if (mode === null || mode === void 0) {
-    return null;
-  }
-  return mode & 4095;
+
+// src/commands/context/index.ts
+var HOOK_DEADLINE_MS = 1e4;
+var PUSH_TIMEOUT_MS = 6e4;
+function collectPattern(value, previous) {
+  return [...previous, value];
 }
-function resolveDestinationRoot(destination) {
-  return __async(this, null, function* () {
-    yield mkdir(destination, { recursive: true });
-    return realpath(destination);
+function buildContextCommand() {
+  const context = new Command8("context").description(
+    "Sync local knowledge files into a project's Context"
+  );
+  context.command("push").description(
+    "Push every text file under <dir> into the project's Context by its relative path"
+  ).argument(
+    "<dir>",
+    "Folder to push (required; never the working directory by default)"
+  ).requiredOption("--project <id>", "Project ID").option("--org <slug>", "Organization context").option(
+    "--force",
+    "On a conflict, replace the server's version once with this folder's"
+  ).option("--dry-run", "Print the plan; send nothing and write no lock").option(
+    "--exclude <pattern>",
+    "Also leave out paths matching this gitignore pattern (repeatable)",
+    collectPattern,
+    []
+  ).option(
+    "--hook",
+    "Hook mode: never fails, never blocks, one line on stderr on failure"
+  ).option("--format <format>", "Output format: text|json").action(function(dir, opts) {
+    return __async(this, null, function* () {
+      yield run(opts, () => runPush(dir, opts, outputFormatFor(this)));
+    });
   });
+  return context;
 }
-function assertSafeTarget(root, relativePath) {
+function run(opts, body) {
   return __async(this, null, function* () {
-    const target = path.resolve(root, relativePath);
-    if (target === root || !target.startsWith(root + path.sep)) {
-      return {
-        ok: false,
-        reason: "escapes_destination",
-        detail: relativePath
-      };
-    }
-    const segments = relativePath.split("/");
-    let current = root;
-    let deepestExisting = root;
-    for (const [index, segment] of segments.entries()) {
-      current = path.join(current, segment);
-      const stats = yield lstatOrNull(current);
-      if (stats === null) {
-        break;
-      }
-      if (stats.isSymbolicLink()) {
-        return { ok: false, reason: "symlink", detail: current };
+    try {
+      if (opts.hook) {
+        yield withDeadline(HOOK_DEADLINE_MS, () => body());
+      } else {
+        yield body();
       }
-      if (index < segments.length - 1 && !stats.isDirectory()) {
-        return { ok: false, reason: "not_a_directory", detail: current };
+    } catch (error) {
+      const message = describeError(error);
+      if (opts.hook) {
+        process.stderr.write(`fabric: context push failed: ${message}
+`);
+        process.exit(0);
       }
-      deepestExisting = current;
+      process.stderr.write(`\u2717 ${message}
+`);
+      process.exit(error instanceof CliFailure ? error.exitCode : 1);
     }
-    if (deepestExisting !== root) {
-      const canonical = yield realpath(deepestExisting).catch(() => null);
-      if (canonical !== null && canonical !== root && !canonical.startsWith(root + path.sep)) {
-        return {
-          ok: false,
-          reason: "escapes_destination",
-          detail: relativePath
-        };
-      }
+  });
+}
+function contextClient(opts) {
+  if (!getApiKey()) {
+    throw new CliFailure(
+      "Not authenticated. Run: fabric auth login --key <api-key>",
+      3
+    );
+  }
+  return getClient(
+    opts.hook ? { timeoutMs: HOOK_DEADLINE_MS, retry: { maxRetries: 0 } } : { timeoutMs: PUSH_TIMEOUT_MS }
+  ).withoutContext();
+}
+function resolveFolder(dir) {
+  return __async(this, null, function* () {
+    const directory = path5.resolve(dir);
+    const root = yield resolveExistingRoot(directory);
+    const stats = yield lstat3(root).catch(() => null);
+    if (stats === null || !stats.isDirectory()) {
+      throw new CliFailure(`${directory} is not a directory.`, 2);
     }
-    return { ok: true, path: target };
+    return root;
   });
 }
-function assertWritableTarget(root, relativePath) {
+function readLockForProject(root, projectId) {
   return __async(this, null, function* () {
-    const check = yield assertSafeTarget(root, relativePath);
-    if (!check.ok) {
-      return check;
+    let lock;
+    try {
+      lock = yield readContextLock(root);
+    } catch (error) {
+      throw new CliFailure(describeError(error), 7);
     }
-    const stats = yield lstatOrNull(check.path);
-    if (stats === null) {
-      return check;
+    if (lock !== null && lock.projectId !== projectId) {
+      throw new CliFailure(
+        `${contextLockPath(root)} belongs to project ${lock.projectId}, not ${projectId}. Push this folder to ${lock.projectId}, or remove that lock if this folder should now feed ${projectId}.`,
+        7
+      );
     }
-    if (stats.isSymbolicLink()) {
-      return { ok: false, reason: "symlink", detail: check.path };
+    return lock;
+  });
+}
+function print(lines) {
+  process.stdout.write(`${lines.join("\n")}
+`);
+}
+function runPush(dir, opts, format) {
+  return __async(this, null, function* () {
+    const root = yield resolveFolder(dir);
+    const client = opts.dryRun ? null : contextClient(opts);
+    const lock = yield readLockForProject(root, opts.project);
+    const plan = yield computeContextPlan({
+      root,
+      lock,
+      excludes: opts.exclude
+    });
+    if (client === null) {
+      if (format === "json") {
+        printOutput(
+          jsonOutcome({
+            root,
+            opts,
+            plan,
+            results: [],
+            lockWritten: false
+          }),
+          { format: "json" }
+        );
+        return;
+      }
+      print(
+        formatDryRunReport({
+          projectId: opts.project,
+          directory: root,
+          plan
+        })
+      );
+      return;
     }
-    if (!stats.isFile()) {
-      return { ok: false, reason: "not_a_regular_file", detail: check.path };
+    const pushed = yield pushContextPlan({
+      client,
+      projectId: opts.project,
+      org: opts.org,
+      root,
+      plan,
+      force: Boolean(opts.force)
+    });
+    const next = nextContextLock({
+      previous: lock,
+      projectId: opts.project,
+      results: pushed.results,
+      forgotten: plan.forgotten,
+      now: /* @__PURE__ */ new Date()
+    });
+    if (next !== null) {
+      yield writeContextLock(root, next);
     }
-    return check;
+    if (format === "json") {
+      printOutput(
+        jsonOutcome({
+          root,
+          opts,
+          plan,
+          results: pushed.results,
+          lockWritten: next !== null
+        }),
+        { format: "json" }
+      );
+    } else {
+      print(
+        formatPushReport({
+          projectId: opts.project,
+          directory: root,
+          plan,
+          results: pushed.results
+        })
+      );
+    }
+    if (pushed.stoppedBy !== null) {
+      throw pushed.stoppedBy;
+    }
+    throwIfIncomplete(pushed.results);
   });
 }
-function readFileSafely(_0, _1) {
-  return __async(this, arguments, function* (root, relativePath, options = {}) {
-    const check = yield assertWritableTarget(root, relativePath);
-    if (!check.ok) {
-      throw new Error(`Refusing to sync: ${describeRejection(check)}.`);
+function jsonOutcome(input) {
+  return contextPushJson({
+    projectId: input.opts.project,
+    directory: input.root,
+    lockPath: contextLockPath(input.root),
+    lockWritten: input.lockWritten,
+    dryRun: Boolean(input.opts.dryRun),
+    force: Boolean(input.opts.force),
+    plan: input.plan,
+    results: input.results
+  });
+}
+function throwIfIncomplete(results) {
+  const failed = results.filter((r) => r.status === "failed");
+  const conflicts = results.filter((r) => r.status === "conflict");
+  if (failed.length === 0 && conflicts.length === 0) {
+    return;
+  }
+  const parts = [];
+  if (conflicts.length > 0) {
+    parts.push(
+      `${conflicts.length} conflict${conflicts.length === 1 ? "" : "s"}`
+    );
+  }
+  const first = failed[0];
+  if (first && first.status === "failed") {
+    parts.push(
+      `${failed.length} failed, first ${first.sourcePath}: ${first.error}`
+    );
+  }
+  const total = conflicts.length + failed.length;
+  let message = `${total} of ${results.length} file${results.length === 1 ? "" : "s"} sent ${total === 1 ? "was" : "were"} not stored (${parts.join(", ")}).`;
+  if (conflicts.length > 0) {
+    message += " A conflict means the server holds a version this folder did not name, or deleted the one it named: compare the two in the project's Context tab, and use --force to replace the version the conflict reported with this folder's (or to send a deleted file again with no version, which recreates it, or answers duplicate if that content is already stored under another path).";
+  }
+  throw new CliFailure(
+    message,
+    first && first.status === "failed" ? first.exitCode : 1
+  );
+}
+
+// src/commands/ctx/index.ts
+import { Command as Command9 } from "commander";
+function buildCtxCommand() {
+  const ctx = new Command9("ctx").description(
+    "Manage the organization commands run in"
+  );
+  ctx.command("current").description("Show the active default context").action(() => {
+    const stored = getDefaultContext();
+    if (!stored) {
+      printWarning(
+        "No default context set. Use --org <slug> on each command, or run:\n  fabric ctx use org <slug>"
+      );
+      return;
     }
-    let handle;
-    try {
-      handle = yield open(
-        check.path,
-        constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK
+    if (stored.type === "personal") {
+      printWarning(
+        "Context: personal \u2014 retired, and no command will accept it.\nReplace it with:\n  fabric ctx use org <slug>"
       );
-    } catch (error) {
-      if (error.code === "ENOENT") {
-        return null;
-      }
-      throw error;
+      return;
     }
-    try {
-      const opened = yield handle.stat();
-      if (!opened.isFile()) {
-        throw new Error(
-          `Refusing to sync: ${relativePath} is not a regular file.`
-        );
-      }
-      const afterOpen = yield assertWritableTarget(root, relativePath);
-      if (!afterOpen.ok) {
-        throw new Error(
-          `Refusing to sync: ${describeRejection(afterOpen)}.`
-        );
-      }
-      const current = yield lstatOrNull(afterOpen.path);
-      if (current === null || !current.isFile() || current.dev !== opened.dev || current.ino !== opened.ino) {
-        throw new Error(
-          `Refusing to sync: ${relativePath} changed while it was being opened.`
-        );
-      }
-      if (options.maxBytes === void 0) {
-        return { bytes: yield handle.readFile(), mode: opened.mode };
-      }
-      if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0) {
-        throw new Error(
-          "A safe file-read limit must be a non-negative integer."
-        );
-      }
-      if (opened.size > options.maxBytes) {
-        throw new Error(
-          `${relativePath} is too large to read safely (maximum ${options.maxBytes} bytes).`
-        );
-      }
-      const buffer = Buffer.allocUnsafe(options.maxBytes + 1);
-      let total = 0;
-      while (total <= options.maxBytes) {
-        const { bytesRead } = yield handle.read(
-          buffer,
-          total,
-          options.maxBytes + 1 - total,
-          total
-        );
-        if (bytesRead === 0) {
-          break;
-        }
-        total += bytesRead;
+    process.stdout.write(`Context: org:${stored.slug}
+`);
+  });
+  const use = new Command9("use").description(
+    "Set the default organization for commands"
+  );
+  use.command("personal").description("Retired \u2014 context is organization-only").action(() => {
+    printError(
+      "Personal context no longer exists \u2014 every command runs inside an organization.\nSet one with:\n  fabric ctx use org <slug>",
+      2
+    );
+  });
+  use.command("org <slug>").description("Use an org context by default").action((slug) => {
+    saveDefaultContext({ type: "org", slug });
+    printSuccess(`Default context set to: org:${slug}`);
+  });
+  ctx.addCommand(use);
+  return ctx;
+}
+
+// src/commands/features/index.ts
+import { Command as Command10 } from "commander";
+function buildFeaturesCommand() {
+  const features = new Command10("features").description(
+    "Manage project features"
+  );
+  features.command("list").description("List features in a project").requiredOption("-p, --project <id>", "Project ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
+    "--priority <priority>",
+    "Filter: P0_CRITICAL|P1_HIGH|P2_MEDIUM|P3_LOW"
+  ).option("--search <query>", "Search by title").option("--limit <n>", "Max results (default 50)", "50").option(
+    "--format <format>",
+    "Output format: table|json|yaml|csv",
+    "table"
+  ).option("-q, --quiet", "Print IDs only").action(
+    (opts) => __async(null, null, function* () {
+      const ctx = resolveContext(opts.personal, opts.org, false);
+      const client = getClient();
+      let list;
+      try {
+        list = yield client.projects.listFeatures(opts.project, {
+          org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0,
+          priority: opts.priority,
+          search: opts.search,
+          limit: Number(opts.limit)
+        });
+      } catch (err) {
+        printError(err.message, 1);
       }
-      if (total > options.maxBytes) {
-        throw new Error(
-          `${relativePath} is too large to read safely (maximum ${options.maxBytes} bytes).`
-        );
+      if (opts.quiet) {
+        for (const f of list) {
+          process.stdout.write(`${f.id}
+`);
+        }
+        return;
       }
-      return { bytes: buffer.subarray(0, total), mode: opened.mode };
-    } finally {
-      yield handle.close();
-    }
-  });
-}
-function resolveExistingRoot(destination) {
-  return __async(this, null, function* () {
-    return realpath(destination).catch(() => path.resolve(destination));
-  });
-}
-function makeParents(root, relativePath) {
-  return __async(this, null, function* () {
-    const segments = relativePath.split("/").slice(0, -1);
-    let current = root;
-    for (const segment of segments) {
-      current = path.join(current, segment);
-      const stats = yield lstatOrNull(current);
-      if (stats === null) {
-        yield mkdir(current).catch((error) => __async(null, null, function* () {
-          if (error.code !== "EEXIST") {
-            throw error;
-          }
-          const raced = yield lstatOrNull(current);
-          if (raced == null ? void 0 : raced.isSymbolicLink()) {
-            throw new Error(
-              `Refusing to sync: ${describeRejection({ ok: false, reason: "symlink", detail: current })}.`
-            );
+      printOutput(list, {
+        format: opts.format,
+        columns: ["identifier", "title", "priority", "createdAt"]
+      });
+    })
+  );
+  features.command("show <id>").description("Show feature details").requiredOption("-p, --project <projectId>", "Project ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--format <format>", "Output format: table|json|yaml", "table").action(
+    (id, opts) => __async(null, null, function* () {
+      var _a2, _b, _c;
+      const ctx = resolveContext(opts.personal, opts.org, false);
+      const client = getClient();
+      let feature;
+      try {
+        feature = yield client.projects.getFeature(
+          opts.project,
+          id,
+          {
+            org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0
           }
-        }));
-        continue;
-      }
-      if (stats.isSymbolicLink()) {
-        throw new Error(
-          `Refusing to sync: ${describeRejection({ ok: false, reason: "symlink", detail: current })}.`
         );
+      } catch (err) {
+        printError(err.message, 1);
       }
-      if (!stats.isDirectory()) {
-        throw new Error(
-          `Refusing to sync: ${describeRejection({ ok: false, reason: "not_a_directory", detail: current })}.`
+      const fmt = opts.format;
+      if (fmt === "json" || fmt === "yaml") {
+        printOutput(feature, { format: fmt });
+        return;
+      }
+      printRecord({
+        ID: feature.id,
+        Identifier: feature.identifier,
+        Title: feature.title,
+        Priority: feature.priority,
+        Description: (_a2 = feature.description) != null ? _a2 : "(none)",
+        "Acceptance Criteria": (_b = feature.acceptanceCriteria) != null ? _b : "(none)",
+        Project: feature.projectId,
+        Assignee: (_c = feature.assigneeId) != null ? _c : "(none)",
+        Created: feature.createdAt.slice(0, 10)
+      });
+    })
+  );
+  features.command("create <title>").description("Create a feature in a project").requiredOption("-p, --project <projectId>", "Project ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("-d, --description <text>", "Feature description").option(
+    "--priority <priority>",
+    "Priority: P0_CRITICAL|P1_HIGH|P2_MEDIUM|P3_LOW (default: P2_MEDIUM)"
+  ).option("--format <format>", "Output format: table|json|yaml", "table").action(
+    (title, opts) => __async(null, null, function* () {
+      const ctx = resolveContext(opts.personal, opts.org, false);
+      const client = getClient();
+      let feature;
+      try {
+        feature = yield client.projects.createFeature(
+          opts.project,
+          {
+            title,
+            description: opts.description,
+            priority: opts.priority,
+            org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0
+          }
         );
+      } catch (err) {
+        printError(err.message, 1);
       }
-    }
-  });
-}
-function writeFileSafely(input) {
-  return __async(this, null, function* () {
-    var _a2;
-    const check = yield assertSafeTarget(input.root, input.relativePath);
-    if (!check.ok) {
-      throw new Error(`Refusing to sync: ${describeRejection(check)}.`);
-    }
-    if (!isAllowedMode(input.mode)) {
-      throw new Error(
-        `Refusing to sync: ${input.relativePath} asks for file mode ${((_a2 = input.mode) != null ? _a2 : 0).toString(8)}, and only 644 and 755 are accepted.`
-      );
-    }
-    yield makeParents(input.root, input.relativePath);
-    const target = check.path;
-    const directory = path.dirname(target);
-    const directoryBefore = yield lstatOrNull(directory);
-    const temporary = path.join(
-      directory,
-      `.${path.basename(target)}.${randomBytes(8).toString("hex")}.tmp`
-    );
-    let handle = null;
-    try {
-      handle = yield open(temporary, "wx", 384);
-      yield handle.writeFile(input.bytes);
-      const bits = permissionBits(input.mode);
-      if (bits !== null && process.platform !== "win32") {
-        yield handle.chmod(bits);
+      const fmt = opts.format;
+      if (fmt === "json" || fmt === "yaml") {
+        printOutput(feature, { format: fmt });
+        return;
       }
-      yield handle.close();
-      handle = null;
-      const parentStats = yield lstatOrNull(directory);
-      if (parentStats === null || parentStats.isSymbolicLink()) {
-        throw new Error(
-          `Refusing to sync: ${describeRejection({ ok: false, reason: "symlink", detail: directory })}.`
+      printSuccess(`Feature ${feature.identifier} created`);
+      printRecord({
+        ID: feature.id,
+        Identifier: feature.identifier,
+        Title: feature.title,
+        Priority: feature.priority,
+        Project: feature.projectId,
+        Created: feature.createdAt.slice(0, 10)
+      });
+    })
+  );
+  features.command("tasks").description("List tasks (sub-items) for a feature").requiredOption("-p, --project <projectId>", "Project ID").requiredOption("-f, --feature <featureId>", "Feature ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
+    "--format <format>",
+    "Output format: table|json|yaml|csv",
+    "table"
+  ).option("-q, --quiet", "Print IDs only").action(
+    (opts) => __async(null, null, function* () {
+      const ctx = resolveContext(opts.personal, opts.org, false);
+      const client = getClient();
+      let tasks;
+      try {
+        tasks = yield client.projects.listTasks(
+          opts.project,
+          opts.feature,
+          {
+            org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0
+          }
         );
+      } catch (err) {
+        printError(err.message, 1);
       }
-      const targetStats = yield lstatOrNull(target);
-      if (targetStats == null ? void 0 : targetStats.isSymbolicLink()) {
-        throw new Error(
-          `Refusing to sync: ${describeRejection({ ok: false, reason: "symlink", detail: target })}.`
-        );
+      if (opts.quiet) {
+        for (const t of tasks) {
+          process.stdout.write(`${t.id}
+`);
+        }
+        return;
       }
-      yield rename(temporary, target);
-    } catch (error) {
-      yield handle == null ? void 0 : handle.close().catch(() => {
+      printOutput(tasks, {
+        format: opts.format,
+        columns: [
+          "identifier",
+          "title",
+          "status",
+          "estimatedHours"
+        ]
       });
-      if (yield isSameDirectory(directory, directoryBefore)) {
-        yield unlink(temporary).catch(() => {
-        });
-      }
-      throw error;
-    }
-  });
-}
-function isSameDirectory(directory, before) {
-  return __async(this, null, function* () {
-    if (before === null) {
-      return false;
-    }
-    const now = yield lstatOrNull(directory);
-    return now !== null && now.dev === before.dev && now.ino === before.ino;
-  });
-}
-function deleteFileSafely(root, relativePath, expectedSha256) {
-  return __async(this, null, function* () {
-    const check = yield assertSafeTarget(root, relativePath);
-    if (!check.ok) {
-      throw new Error(`Refusing to sync: ${describeRejection(check)}.`);
-    }
-    const stats = yield lstatOrNull(check.path);
-    if (stats === null) {
-      return "missing";
-    }
-    if (stats.isSymbolicLink()) {
-      throw new Error(
-        `Refusing to sync: ${describeRejection({ ok: false, reason: "symlink", detail: check.path })}.`
-      );
-    }
-    if (!stats.isFile()) {
-      throw new Error(
-        `Refusing to sync: ${describeRejection({ ok: false, reason: "not_a_regular_file", detail: check.path })}.`
-      );
-    }
-    let actual;
-    try {
-      actual = createHash("sha256").update(yield readFile(check.path)).digest("hex");
-    } catch (error) {
-      if (error.code === "ENOENT") {
-        return "missing";
+    })
+  );
+  features.command("update <id>").description("Update a feature").requiredOption("-p, --project <projectId>", "Project ID").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--title <title>", "New title").option("-d, --description <text>", "New description").option(
+    "--priority <priority>",
+    "Priority: P0_CRITICAL|P1_HIGH|P2_MEDIUM|P3_LOW"
+  ).option("--format <format>", "Output format: table|json|yaml", "table").action(
+    (id, opts) => __async(null, null, function* () {
+      const ctx = resolveContext(opts.personal, opts.org, false);
+      const client = getClient();
+      let feature;
+      try {
+        feature = yield client.projects.updateFeature(
+          opts.project,
+          id,
+          {
+            title: opts.title,
+            description: opts.description,
+            priority: opts.priority,
+            org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0
+          }
+        );
+      } catch (err) {
+        printError(err.message, 1);
       }
-      throw error;
-    }
-    if (actual !== expectedSha256) {
-      return "modified";
-    }
-    try {
-      yield unlink(check.path);
-      return "deleted";
-    } catch (error) {
-      if (error.code === "ENOENT") {
-        return "missing";
+      const fmt = opts.format;
+      if (fmt === "json" || fmt === "yaml") {
+        printOutput(feature, { format: fmt });
+        return;
       }
-      throw error;
-    }
-  });
+      printRecord({
+        ID: feature.id,
+        Identifier: feature.identifier,
+        Title: feature.title,
+        Priority: feature.priority,
+        Updated: feature.updatedAt.slice(0, 10)
+      });
+    })
+  );
+  return features;
 }
-function lstatOrNull(target) {
-  return __async(this, null, function* () {
-    try {
-      return yield lstat(target);
-    } catch (error) {
-      if (error.code === "ENOENT") {
-        return null;
+
+// src/commands/frames/index.ts
+import { Command as Command11 } from "commander";
+function buildFramesCommand() {
+  const frames = new Command11("frames").description(
+    "Manage AI-generated frames and slideshows"
+  );
+  frames.command("list").description("List frames and slideshows").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--limit <n>", "Max results (default 50)", "50").option(
+    "--format <format>",
+    "Output format: table|json|yaml|csv",
+    "table"
+  ).option("-q, --quiet", "Print IDs only").action(
+    (opts) => __async(null, null, function* () {
+      const ctx = resolveContext(opts.personal, opts.org, false);
+      const client = getClient();
+      let list;
+      try {
+        list = yield client.frames.list({
+          org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0,
+          limit: Number(opts.limit)
+        });
+      } catch (err) {
+        printError(err.message, 1);
       }
-      throw error;
-    }
-  });
-}
-function resolvesInside(root, candidate) {
-  return __async(this, null, function* () {
-    const canonicalRoot = yield realpath(root).catch(() => path.resolve(root));
-    const canonicalCandidate = yield realpathDeepest(candidate);
-    return canonicalCandidate === canonicalRoot || canonicalCandidate.startsWith(canonicalRoot + path.sep);
-  });
-}
-function realpathDeepest(candidate) {
-  return __async(this, null, function* () {
-    const absolute = path.resolve(candidate);
-    const tail = [];
-    let current = absolute;
-    for (; ; ) {
-      const resolved = yield realpath(current).catch(() => null);
-      if (resolved !== null) {
-        return tail.length === 0 ? resolved : path.join(resolved, ...tail);
+      if (opts.quiet) {
+        for (const f of list) {
+          process.stdout.write(`${f.id}
+`);
+        }
+        return;
       }
-      const parent = path.dirname(current);
-      if (parent === current) {
-        return absolute;
+      printOutput(list, {
+        format: opts.format,
+        columns: [
+          "id",
+          "title",
+          "fileType",
+          "status",
+          "isPublic",
+          "updatedAt"
+        ]
+      });
+    })
+  );
+  frames.command("show <id>").description("Show frame details").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--format <format>", "Output format: table|json|yaml", "table").action(
+    (id, opts) => __async(null, null, function* () {
+      var _a2, _b, _c;
+      const ctx = resolveContext(opts.personal, opts.org, false);
+      const client = getClient();
+      let frame;
+      try {
+        frame = yield client.frames.get(id, {
+          org: (ctx == null ? void 0 : ctx.type) === "org" ? ctx.slug : void 0
+        });
+      } catch (err) {
+        printError(err.message, 1);
       }
-      tail.unshift(path.basename(current));
-      current = parent;
-    }
-  });
+      const fmt = opts.format;
+      if (fmt === "json" || fmt === "yaml") {
+        printOutput(frame, { format: fmt });
+        return;
+      }
+      printRecord({
+        ID: frame.id,
+        Title: frame.title,
+        Kind: (_a2 = frame.kind) != null ? _a2 : "(none)",
+        "File Type": frame.fileType,
+        Status: frame.status,
+        Public: frame.isPublic ? "yes" : "no",
+        "Share Token": (_b = frame.shareToken) != null ? _b : "(none)",
+        Description: (_c = frame.description) != null ? _c : "(none)",
+        Updated: frame.updatedAt.slice(0, 10)
+      });
+    })
+  );
+  return frames;
 }
 
+// src/commands/instructions/index.ts
+import path8 from "path";
+import { Command as Command12 } from "commander";
+
 // src/lib/instructions/apply.ts
+import { createHash as createHash3 } from "crypto";
+import { chmod } from "fs/promises";
 function applyPlan(input) {
   return __async(this, null, function* () {
     var _a2, _b;
@@ -1880,7 +2978,7 @@ function applyPlan(input) {
           `The downloaded bundle is missing ${entry.path}. Nothing was written.`
         );
       }
-      const actual = createHash2("sha256").update(bytes).digest("hex");
+      const actual = createHash3("sha256").update(bytes).digest("hex");
       if (actual !== entry.sha256) {
         throw new Error(
           `Checksum mismatch for ${entry.path}: the published snapshot expects ${entry.sha256} and the downloaded bundle contains ${actual}. Nothing was written.`
@@ -2081,12 +3179,12 @@ function extractBundle(archive, wanted) {
 }
 
 // src/lib/instructions/hook.ts
-import path2 from "path";
-var CLAUDE_SETTINGS_RELATIVE_PATH = path2.join(
+import path6 from "path";
+var CLAUDE_SETTINGS_RELATIVE_PATH = path6.join(
   ".claude",
   "settings.local.json"
 );
-var CODEX_HOOKS_RELATIVE_PATH = path2.join(".codex", "hooks.json");
+var CODEX_HOOKS_RELATIVE_PATH = path6.join(".codex", "hooks.json");
 var CLAUDE_SETTINGS_POSIX_PATH = ".claude/settings.local.json";
 var CODEX_HOOKS_POSIX_PATH = ".codex/hooks.json";
 var HOOK_TIMEOUT_SECONDS = 15;
@@ -2110,7 +3208,7 @@ function mergeSessionStartHook(input) {
   return __async(this, null, function* () {
     var _a2;
     const hookTarget = hookTargetFor((_a2 = input.tool) != null ? _a2 : "claude-code");
-    const settingsPath = path2.join(input.root, hookTarget.relativePath);
+    const settingsPath = path6.join(input.root, hookTarget.relativePath);
     let existingRaw;
     try {
       const existing = yield readFileSafely(
@@ -2150,14 +3248,14 @@ function mergeSessionStartHook(input) {
       throw refuseShape(settingsPath, '"hooks.SessionStart" is not an array');
     }
     const rawGroups = Array.isArray(hooks.SessionStart) ? hooks.SessionStart : [];
-    for (const [index, group] of rawGroups.entries()) {
-      if (!isRecord(group)) {
+    for (const [index, group2] of rawGroups.entries()) {
+      if (!isRecord(group2)) {
         throw refuseShape(
           settingsPath,
           `"hooks.SessionStart[${index}]" is not an object`
         );
       }
-      if (group.hooks !== void 0 && !Array.isArray(group.hooks)) {
+      if (group2.hooks !== void 0 && !Array.isArray(group2.hooks)) {
         throw refuseShape(
           settingsPath,
           `"hooks.SessionStart[${index}].hooks" is not an array`
@@ -2165,8 +3263,8 @@ function mergeSessionStartHook(input) {
       }
     }
     const sessionStart = rawGroups.map(
-      (group) => __spreadProps(__spreadValues({}, group), {
-        hooks: Array.isArray(group == null ? void 0 : group.hooks) ? [...group.hooks] : []
+      (group2) => __spreadProps(__spreadValues({}, group2), {
+        hooks: Array.isArray(group2 == null ? void 0 : group2.hooks) ? [...group2.hooks] : []
       })
     );
     const replacement = {
@@ -2176,16 +3274,16 @@ function mergeSessionStartHook(input) {
     };
     let replacedCount = 0;
     const pruned = [];
-    for (const group of sessionStart) {
-      const kept = group.hooks.filter(
+    for (const group2 of sessionStart) {
+      const kept = group2.hooks.filter(
         (hook) => !isFabricHookFor(hook, input.projectId)
       );
-      const removed = group.hooks.length - kept.length;
+      const removed = group2.hooks.length - kept.length;
       replacedCount += removed;
       if (kept.length === 0 && removed > 0) {
         continue;
       }
-      pruned.push(__spreadProps(__spreadValues({}, group), { hooks: kept }));
+      pruned.push(__spreadProps(__spreadValues({}, group2), { hooks: kept }));
     }
     pruned.push({ hooks: [replacement] });
     const next = __spreadProps(__spreadValues({}, settings), {
@@ -2258,14 +3356,14 @@ function isRecord(value) {
 
 // src/lib/instructions/lock.ts
 import { readFile as readFile2 } from "fs/promises";
-import path3 from "path";
+import path7 from "path";
 var LOCK_DIRECTORY = ".fabric";
 var LOCK_FILENAME = "instructions.lock";
 var LOCK_VERSION = 1;
 var LOCK_RELATIVE_PATH = `${LOCK_DIRECTORY}/${LOCK_FILENAME}`;
-var SHA256_HEX = /^[0-9a-f]{64}$/;
+var SHA256_HEX2 = /^[0-9a-f]{64}$/;
 function lockPath(destination) {
-  return path3.join(destination, LOCK_DIRECTORY, LOCK_FILENAME);
+  return path7.join(destination, LOCK_DIRECTORY, LOCK_FILENAME);
 }
 function readLock(destination) {
   return __async(this, null, function* () {
@@ -2287,7 +3385,7 @@ function readLock(destination) {
         `${file} is unreadable: it is not valid JSON. Delete it to start from a clean sync.`
       );
     }
-    const problem = lockProblem(parsed);
+    const problem = lockProblem2(parsed);
     if (problem !== null) {
       throw new Error(
         `${file} is unreadable: ${problem}. Delete it to start from a clean sync.`
@@ -2296,7 +3394,7 @@ function readLock(destination) {
     return parsed;
   });
 }
-function serializeLock(lock) {
+function serializeLock2(lock) {
   return `${JSON.stringify(lock, null, 2).replace(/\r\n/g, "\n")}
 `;
 }
@@ -2305,11 +3403,11 @@ function writeLock(root, lock) {
     yield writeFileSafely({
       root,
       relativePath: LOCK_RELATIVE_PATH,
-      bytes: new TextEncoder().encode(serializeLock(lock))
+      bytes: new TextEncoder().encode(serializeLock2(lock))
     });
   });
 }
-function lockProblem(value) {
+function lockProblem2(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return "it is not a JSON object";
   }
@@ -2341,7 +3439,7 @@ function lockProblem(value) {
       return `its entry for ${JSON.stringify(filePath)} is not an object`;
     }
     const record = entry;
-    if (typeof record.sha256 !== "string" || !SHA256_HEX.test(record.sha256)) {
+    if (typeof record.sha256 !== "string" || !SHA256_HEX2.test(record.sha256)) {
       return `its entry for ${JSON.stringify(filePath)} has no 64-character hex sha256`;
     }
     if (record.mode !== null && (typeof record.mode !== "number" || !Number.isInteger(record.mode) || record.mode < 0)) {
@@ -2352,8 +3450,8 @@ function lockProblem(value) {
 }
 
 // src/lib/instructions/manifest.ts
-import { createHash as createHash3 } from "crypto";
-var SHA256_HEX2 = /^[0-9a-f]{64}$/;
+import { createHash as createHash4 } from "crypto";
+var SHA256_HEX3 = /^[0-9a-f]{64}$/;
 var MANIFEST_LIMITS = {
   maxFiles: 5e3,
   maxTotalBytes: 52428800,
@@ -2372,7 +3470,7 @@ function maxArchiveBytes(entries) {
 function computeSnapshotDigest(entries) {
   const lines = [...entries].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0).map((entry) => `${entry.path}\0${entry.sha256}
 `).join("");
-  return createHash3("sha256").update(Buffer.from(lines, "utf8")).digest("hex");
+  return createHash4("sha256").update(Buffer.from(lines, "utf8")).digest("hex");
 }
 function assertValidManifest(input) {
   const { manifest, snapshot } = input;
@@ -2458,7 +3556,7 @@ function validateEntry(raw) {
       })}.`
     );
   }
-  if (typeof entry.sha256 !== "string" || !SHA256_HEX2.test(entry.sha256)) {
+  if (typeof entry.sha256 !== "string" || !SHA256_HEX3.test(entry.sha256)) {
     throw new Error(
       `The manifest entry for ${entry.path} has no 64-character hex sha256. Nothing was changed.`
     );
@@ -2493,11 +3591,11 @@ function validateEntry(raw) {
 }
 
 // src/lib/instructions/plan.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function hashLocalFile(root, relativePath) {
   return __async(this, null, function* () {
     const read = yield readFileSafely(root, relativePath);
-    return read === null ? null : createHash4("sha256").update(read.bytes).digest("hex");
+    return read === null ? null : createHash5("sha256").update(read.bytes).digest("hex");
   });
 }
 function lockPaths(lock) {
@@ -2550,7 +3648,7 @@ function verifyLedger(input) {
         drifted.push(`${lockedPath} (missing)`);
         continue;
       }
-      const actual = createHash4("sha256").update(read.bytes).digest("hex");
+      const actual = createHash5("sha256").update(read.bytes).digest("hex");
       if (actual !== locked.sha256) {
         drifted.push(`${lockedPath} (edited)`);
         continue;
@@ -2658,7 +3756,7 @@ function nextLock(input) {
 }
 
 // src/lib/instructions/push.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var MAX_PUSH_CHANGES = 50;
 function assertPushablePath(candidate, source) {
   const check = checkRelativePath(candidate);
@@ -2697,16 +3795,16 @@ function assertLockMatchesManifest(lock, manifest) {
   const published = new Map(
     manifest.map((entry) => [entry.path, entry.sha256])
   );
-  for (const [path5, entry] of Object.entries(lock.files)) {
-    const expected = published.get(path5);
+  for (const [path9, entry] of Object.entries(lock.files)) {
+    const expected = published.get(path9);
     if (expected === void 0) {
       refuseStaleLedger(
-        `it lists ${path5}, which version ${lock.snapshotVersion} does not contain`
+        `it lists ${path9}, which version ${lock.snapshotVersion} does not contain`
       );
     }
     if (expected !== entry.sha256) {
       refuseStaleLedger(
-        `its record of ${path5} is not the published file`
+        `its record of ${path9} is not the published file`
       );
     }
   }
@@ -2772,7 +3870,7 @@ function computePushPlan(input) {
         changes.push({ op: "delete", path: lockedPath });
         continue;
       }
-      const actual = createHash5("sha256").update(read.bytes).digest("hex");
+      const actual = createHash6("sha256").update(read.bytes).digest("hex");
       if (actual === ((_b = lock.files[lockedPath]) == null ? void 0 : _b.sha256)) {
         unchanged.push(lockedPath);
         continue;
@@ -2801,23 +3899,16 @@ function computePushPlan(input) {
 }
 
 // src/commands/instructions/index.ts
-var HOOK_DEADLINE_MS = 1e4;
+var HOOK_DEADLINE_MS2 = 1e4;
 var CHECK_TIMEOUT_MS = 5e3;
 var SYNC_TIMEOUT_MS = 15e3;
 var BUNDLE_TIMEOUT_MS = 6e4;
-var PUSH_TIMEOUT_MS = 6e4;
+var PUSH_TIMEOUT_MS2 = 6e4;
 function collectAdded(value, previous) {
   return [...previous, value];
 }
-var CliFailure = class extends Error {
-  constructor(message, exitCode) {
-    super(message);
-    this.exitCode = exitCode;
-    this.name = "CliFailure";
-  }
-};
 function buildInstructionsCommand() {
-  const instructions = new Command11("instructions").description(
+  const instructions = new Command12("instructions").description(
     "Keep a checkout current with a project's published coding instructions"
   );
   instructions.command("check").description(
@@ -2830,7 +3921,11 @@ function buildInstructionsCommand() {
     "Session-hook mode: plain text, never fails, never blocks a session"
   ).option("--format <format>", "Output format: text|json").action(function(opts) {
     return __async(this, null, function* () {
-      yield run(opts, "check", () => runCheck(opts, formatFor(this)));
+      yield run2(
+        opts,
+        "check",
+        () => runCheck(opts, outputFormatFor(this))
+      );
     });
   });
   instructions.command("sync").description(
@@ -2840,22 +3935,25 @@ function buildInstructionsCommand() {
     "Session-hook mode: plain text, never fails, never blocks a session"
   ).option("--format <format>", "Output format: text|json").action(function(opts) {
     return __async(this, null, function* () {
-      yield run(opts, "sync", () => runSync(opts, formatFor(this)));
+      yield run2(opts, "sync", () => runSync(opts, outputFormatFor(this)));
     });
   });
   instructions.command("push").description(
-    "Suggest this checkout's edits to the project's coding instructions"
+    "Propose this checkout's edits to the project's coding instructions, or publish them with --publish"
   ).requiredOption("--project <id>", "Project ID").option("--dest <dir>", "Destination directory (default: cwd)").option("--org <slug>", "Organization context").option(
     "--add <path>",
     "Also send a file the last sync did not write (repeatable)",
     collectAdded,
     []
+  ).option(
+    "--publish",
+    "Publish the change as a new version instead of proposing it (needs a key with instructions:publish)"
   ).option("--dry-run", "Print the change set and send nothing").option("--format <format>", "Output format: text|json").action(function(opts) {
     return __async(this, null, function* () {
-      yield run(
+      yield run2(
         __spreadProps(__spreadValues({}, opts), { hook: false }),
         "push",
-        () => runPush(opts, formatFor(this))
+        () => runPush2(opts, outputFormatFor(this))
       );
     });
   });
@@ -2869,24 +3967,25 @@ function buildInstructionsCommand() {
     "Let the hook apply changes instead of only reporting them"
   ).option("--format <format>", "Output format: text|json").action(function(opts) {
     return __async(this, null, function* () {
-      yield run(
+      yield run2(
         __spreadProps(__spreadValues({}, opts), { hook: false }),
         "init",
-        () => runInit(opts, formatFor(this))
+        () => runInit(opts, outputFormatFor(this))
       );
     });
   });
   return instructions;
 }
-function formatFor(command) {
-  const resolved = command.optsWithGlobals();
-  return resolved.format === "json" ? "json" : "text";
-}
-function run(opts, verb, body) {
+function run2(opts, verb, body) {
   return __async(this, null, function* () {
     try {
       if (opts.hook) {
-        yield withDeadline(HOOK_DEADLINE_MS, body);
+        yield withDeadline(HOOK_DEADLINE_MS2, (signal) => {
+          activeDeadline = signal;
+          return body();
+        }).finally(() => {
+          activeDeadline = void 0;
+        });
       } else {
         yield body();
       }
@@ -2905,63 +4004,10 @@ function run(opts, verb, body) {
     }
   });
 }
-function withDeadline(totalMs, body) {
-  return __async(this, null, function* () {
-    const controller = new AbortController();
-    let timer;
-    const deadline = new Promise((_resolve, reject) => {
-      timer = setTimeout(() => {
-        controller.abort();
-        reject(
-          new Error(
-            `gave up after ${totalMs}ms so the session is not held up`
-          )
-        );
-      }, totalMs);
-    });
-    activeDeadline = controller.signal;
-    try {
-      yield Promise.race([body(), deadline]);
-    } finally {
-      activeDeadline = void 0;
-      if (timer) {
-        clearTimeout(timer);
-      }
-    }
-  });
-}
 var activeDeadline;
-function describeError(error) {
-  if (error instanceof Error) {
-    return error.message.replace(/\s*\n\s*/g, " ");
-  }
-  return String(error);
-}
-function asCliFailure(error) {
-  if (error instanceof CliFailure) {
-    return error;
-  }
-  const status = error.status;
-  const message = error instanceof Error ? error.message : String(error);
-  switch (status) {
-    case 401:
-      return new CliFailure(message, 3);
-    case 403:
-      return new CliFailure(message, 5);
-    case 404:
-      return new CliFailure(message, 4);
-    case 429:
-      return new CliFailure(message, 6);
-    case 400:
-    case 422:
-      return new CliFailure(message, 7);
-    default:
-      return new CliFailure(message, 1);
-  }
-}
 function destinationOf(opts) {
   var _a2;
-  return path4.resolve((_a2 = opts.dest) != null ? _a2 : process.cwd());
+  return path8.resolve((_a2 = opts.dest) != null ? _a2 : process.cwd());
 }
 function instructionsClient(opts, timeoutMs, { neverRetry = false } = {}) {
   if (!getApiKey()) {
@@ -2976,7 +4022,7 @@ function instructionsClient(opts, timeoutMs, { neverRetry = false } = {}) {
       // call it makes, so it cannot spend it on retries: a
       // session that will not start is worse than instructions
       // one version stale.
-      timeoutMs: Math.min(timeoutMs, HOOK_DEADLINE_MS),
+      timeoutMs: Math.min(timeoutMs, HOOK_DEADLINE_MS2),
       retry: { maxRetries: 0 }
     } : neverRetry ? { timeoutMs, retry: { maxRetries: 0 } } : { timeoutMs }
   ).withoutContext();
@@ -2984,7 +4030,7 @@ function instructionsClient(opts, timeoutMs, { neverRetry = false } = {}) {
 function downloadUrlClient(opts) {
   return instructionsClient(
     opts,
-    opts.hook ? HOOK_DEADLINE_MS : BUNDLE_TIMEOUT_MS,
+    opts.hook ? HOOK_DEADLINE_MS2 : BUNDLE_TIMEOUT_MS,
     { neverRetry: true }
   );
 }
@@ -3015,7 +4061,7 @@ function assertHookMayAct(opts, published) {
     );
   }
 }
-function readLockForProject(destination, projectId) {
+function readLockForProject2(destination, projectId) {
   return __async(this, null, function* () {
     const lock = yield readLock(destination);
     if (lock !== null && lock.projectId !== projectId) {
@@ -3045,7 +4091,7 @@ function runCheck(opts, format) {
     var _a2;
     const destination = destinationOf(opts);
     const root = yield resolveExistingRoot(destination);
-    const lock = yield readLockForProject(destination, opts.project);
+    const lock = yield readLockForProject2(destination, opts.project);
     const client = instructionsClient(opts, CHECK_TIMEOUT_MS);
     const published = yield fetchPublished(client, opts, lock == null ? void 0 : lock.digest);
     const drifted = opts.verify && lock !== null ? yield verifyLedger({ root, lock }) : [];
@@ -3154,7 +4200,7 @@ function syncOnce(opts) {
   return __async(this, null, function* () {
     const root = yield resolveDestinationRoot(destinationOf(opts));
     const outcome = emptyOutcome(opts, root);
-    const lock = yield readLockForProject(root, opts.project);
+    const lock = yield readLockForProject2(root, opts.project);
     const client = instructionsClient(opts, SYNC_TIMEOUT_MS);
     let published = yield fetchPublished(client, opts, lock == null ? void 0 : lock.digest);
     assertInitSyncMayAct(opts, published);
@@ -3208,7 +4254,7 @@ function syncOnce(opts) {
         manifest.map((entry) => [entry.path, entry.size])
       );
       const archive = yield fetchBundle(download.url, {
-        timeoutMs: opts.hook ? HOOK_DEADLINE_MS : BUNDLE_TIMEOUT_MS,
+        timeoutMs: opts.hook ? HOOK_DEADLINE_MS2 : BUNDLE_TIMEOUT_MS,
         // Bounded by what this manifest says it holds, not by what the
         // response claims. The manifest has already been checked against
         // the published snapshot limits, so this is a number the client
@@ -3296,12 +4342,12 @@ function reportSync(outcome, opts) {
     line(`Everything in ${outcome.destination} already matched.`);
   }
 }
-function runPush(opts, format) {
+function runPush2(opts, format) {
   return __async(this, null, function* () {
     var _a2;
     const destination = destinationOf(opts);
     const root = yield resolveExistingRoot(destination);
-    const lock = yield readLockForProject(root, opts.project);
+    const lock = yield readLockForProject2(root, opts.project);
     if (lock === null) {
       throw new CliFailure(
         `No coding-instructions lock in ${destination}. Run \`fabric instructions sync --project ${opts.project}\` first: a push is a diff against the version that was last applied here, and without that ledger there is nothing to diff against.`,
@@ -3310,7 +4356,7 @@ function runPush(opts, format) {
     }
     const client = instructionsClient(
       __spreadProps(__spreadValues({}, opts), { hook: false }),
-      PUSH_TIMEOUT_MS
+      PUSH_TIMEOUT_MS2
     );
     const published = yield fetchPublished(client, opts);
     if (!published.published || !published.snapshot) {
@@ -3347,6 +4393,7 @@ function runPush(opts, format) {
       projectId: opts.project,
       destination: root,
       dryRun: Boolean(opts.dryRun),
+      publish: Boolean(opts.publish),
       baseSnapshotId: lock.snapshotId,
       baseVersion: lock.snapshotVersion,
       put: plan.entries.filter((entry) => entry.action === "put").map((entry) => entry.path),
@@ -3355,11 +4402,17 @@ function runPush(opts, format) {
       snapshotId: null,
       version: null,
       proposalStatus: null,
-      status: null
+      status: null,
+      published: null
     };
     if (!opts.dryRun) {
       try {
-        const submitted = yield client.instructions.submitChange(
+        const submitted = opts.publish ? yield client.instructions.publishChange(
+          opts.project,
+          lock.snapshotId,
+          plan.changes,
+          { org: orgSlugFor(opts) }
+        ) : yield client.instructions.submitChange(
           opts.project,
           lock.snapshotId,
           plan.changes,
@@ -3369,6 +4422,7 @@ function runPush(opts, format) {
         outcome.version = submitted.version;
         outcome.proposalStatus = submitted.proposalStatus;
         outcome.status = submitted.status;
+        outcome.published = submitted.published;
       } catch (error) {
         throw asPushFailure(error);
       }
@@ -3408,6 +4462,16 @@ function asPushFailure(error) {
 }
 function pushVerdict(outcome) {
   var _a2;
+  if (outcome.publish) {
+    if (outcome.published) {
+      return `Published version ${outcome.version}. Run \`fabric instructions sync\` to bring this checkout onto it.`;
+    }
+    if (outcome.status === "FAILED" || outcome.status === "REJECTED") {
+      return `Version ${outcome.version} did not pass its checks (${outcome.status}), so nothing was published; open the project's Coding Instructions tab to see why.`;
+    }
+    const sent = `Sent as version ${outcome.version}. It publishes on its own once its checks pass (${outcome.status}) \u2014 then run \`fabric instructions sync\` to bring this checkout onto it.`;
+    return outcome.status === "READY" ? `${sent} It has passed its checks; its publication state is shown in the project's Coding Instructions tab.` : sent;
+  }
   if (outcome.proposalStatus === "PENDING" && outcome.status === "RECEIVING") {
     return `An earlier attempt is still sending this change; if version ${outcome.version} stays unfinished, cancel it in the project's Coding Instructions tab, or leave it and it is closed out automatically after six hours.`;
   }
@@ -3434,13 +4498,13 @@ function reportPush(outcome) {
   listPaths("deleted", outcome.deleted);
   if (outcome.dryRun) {
     line(
-      "Nothing was sent. Without --dry-run this would open a proposal for review."
+      outcome.publish ? "Nothing was sent. Without --dry-run this would create a new version that publishes on its own once its checks pass, with no review." : "Nothing was sent. Without --dry-run this would open a proposal for review."
     );
     return;
   }
   line(pushVerdict(outcome));
   line(
-    "Your lock was not changed: it still names the published version, which is what `fabric instructions sync` compares against."
+    outcome.publish ? `Your lock was not changed: it still names version ${outcome.baseVersion}, which is what \`fabric instructions sync\` compares against.` : "Your lock was not changed: it still names the published version, which is what `fabric instructions sync` compares against."
   );
 }
 function runInit(opts, format) {
@@ -3453,7 +4517,7 @@ function runInit(opts, format) {
     }
     const tool = opts.tool;
     const root = yield resolveDestinationRoot(destinationOf(opts));
-    yield readLockForProject(root, opts.project);
+    yield readLockForProject2(root, opts.project);
     try {
       yield assertKeyStaysOutside(root, getConfigPath());
     } catch (error) {
@@ -3534,9 +4598,9 @@ function hookPathFor(tool) {
 }
 
 // src/commands/mcp/index.ts
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 function buildMcpCommand() {
-  const mcp = new Command12("mcp").description(
+  const mcp = new Command13("mcp").description(
     "Manage MCP servers and configurations"
   );
   mcp.command("servers").description("List accessible MCP servers (system + custom)").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
@@ -3574,7 +4638,7 @@ function buildMcpCommand() {
       });
     })
   );
-  const configs = new Command12("configs").description(
+  const configs = new Command13("configs").description(
     "Manage MCP configurations"
   );
   configs.command("list", { isDefault: true }).description("List your MCP configurations").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
@@ -3679,9 +4743,9 @@ function buildMcpCommand() {
 }
 
 // src/commands/orgs/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 function buildOrgsCommand() {
-  const orgs = new Command13("orgs").description("Manage organizations");
+  const orgs = new Command14("orgs").description("Manage organizations");
   orgs.command("list").description("List organizations you belong to").option(
     "--format <format>",
     "Output format: table|json|yaml|csv",
@@ -3738,9 +4802,9 @@ function buildOrgsCommand() {
 }
 
 // src/commands/projects/index.ts
-import { Command as Command14 } from "commander";
+import { Command as Command15 } from "commander";
 function buildProjectsCommand() {
-  const projects = new Command14("projects").description("Manage projects");
+  const projects = new Command15("projects").description("Manage projects");
   projects.command("list").description("List projects").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option(
     "--status <status>",
     "Filter by status: ACTIVE|DRAFT|COMPLETED|ARCHIVED"
@@ -3875,9 +4939,9 @@ function buildProjectsCommand() {
 }
 
 // src/commands/prompts/index.ts
-import { Command as Command15 } from "commander";
+import { Command as Command16 } from "commander";
 function buildPromptsCommand() {
-  const prompts = new Command15("prompts").description(
+  const prompts = new Command16("prompts").description(
     "Manage prompt templates"
   );
   prompts.command("list").description("List prompt templates").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--search <query>", "Search by name").option("--category <cat>", "Filter by category").option("--limit <n>", "Max results", "50").option(
@@ -4030,12 +5094,12 @@ ${content}
 }
 
 // src/commands/reports/index.ts
-import { Command as Command16 } from "commander";
+import { Command as Command17 } from "commander";
 function buildReportsCommand() {
-  const reports = new Command16("reports").description(
+  const reports = new Command17("reports").description(
     "Manage report templates and executions"
   );
-  const templates = new Command16("templates").description(
+  const templates = new Command17("templates").description(
     "Manage report templates"
   );
   templates.command("list", { isDefault: true }).description("List report templates").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--search <query>", "Search by name").option("--category <cat>", "Filter by category").option("--limit <n>", "Max results (default 20)", "20").option(
@@ -4109,7 +5173,7 @@ function buildReportsCommand() {
     })
   );
   reports.addCommand(templates);
-  const executions = new Command16("executions").description(
+  const executions = new Command17("executions").description(
     "View report executions"
   );
   executions.command("list", { isDefault: true }).description("List report executions").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--limit <n>", "Max results (default 20)", "20").option(
@@ -4153,9 +5217,9 @@ function buildReportsCommand() {
 }
 
 // src/commands/skills/index.ts
-import { Command as Command17 } from "commander";
+import { Command as Command18 } from "commander";
 function buildSkillsCommand() {
-  const skills = new Command17("skills").description(
+  const skills = new Command18("skills").description(
     "Browse skill definitions"
   );
   skills.command("list").description("List skills").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--search <query>", "Search by name").option("--category <cat>", "Filter by category").option("--limit <n>", "Max results", "50").option(
@@ -4222,9 +5286,9 @@ function buildSkillsCommand() {
 }
 
 // src/commands/workflows/index.ts
-import { Command as Command18 } from "commander";
+import { Command as Command19 } from "commander";
 function buildWorkflowsCommand() {
-  const workflows = new Command18("workflows").description("Manage workflows");
+  const workflows = new Command19("workflows").description("Manage workflows");
   workflows.command("list").description("List workflows").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--status <status>", "Filter: DRAFT|ACTIVE|PAUSED|ARCHIVED").option("--search <query>", "Search by name").option("--limit <n>", "Max results", "20").option(
     "--format <format>",
     "Output format: table|json|yaml|csv",
@@ -4352,9 +5416,9 @@ function buildWorkflowsCommand() {
 }
 
 // src/commands/workspaces/index.ts
-import { Command as Command19 } from "commander";
+import { Command as Command20 } from "commander";
 function buildWorkspacesCommand() {
-  const workspaces = new Command19("workspaces").description(
+  const workspaces = new Command20("workspaces").description(
     "Manage workspaces"
   );
   workspaces.command("list").description("List workspaces").option("--org <slug>", "Organization context").option("--personal", "Retired \u2014 context is organization-only").option("--search <query>", "Search by name").option("--status <status>", "Filter: ACTIVE|ARCHIVED").option("--limit <n>", "Max results (default 20)", "20").option(
@@ -4430,14 +5494,14 @@ function buildWorkspacesCommand() {
 }
 
 // src/bin/fabric.ts
-var program = new Command20();
+var program = new Command21();
 var _a;
 program.name("fabric").description("Fabric AI platform CLI").version(package_default.version).option(
   "--format <format>",
   "Output format: table|json|yaml|csv",
   (_a = process.env.FABRIC_FORMAT) != null ? _a : "table"
 );
-var auth = new Command20("auth").description(
+var auth = new Command21("auth").description(
   "Authenticate and manage API keys"
 );
 auth.addCommand(buildLoginCommand());
@@ -4454,13 +5518,14 @@ program.addCommand(buildPromptsCommand());
 program.addCommand(buildAgentsCommand());
 program.addCommand(buildSkillsCommand());
 program.addCommand(buildInstructionsCommand());
+program.addCommand(buildContextCommand());
 program.addCommand(buildMcpCommand());
 program.addCommand(buildFramesCommand());
 program.addCommand(buildWorkspacesCommand());
 program.addCommand(buildChatsCommand());
 program.addCommand(buildReportsCommand());
 program.addCommand(buildCompletionCommand());
-var config = new Command20("config").description("Show CLI configuration");
+var config = new Command21("config").description("Show CLI configuration");
 config.command("path").description("Print the path to the config file").action(() => {
   process.stdout.write(`${getConfigPath()}
 `);