@hasna/skills 0.5.0 → 0.5.2

package/bin/mcp.js

@@ -8016,9 +8016,14 @@ var init_fleet_credentials = __esm(() => {
 
 // src/lib/auth-store.ts
 import { chmodSync, existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync11, renameSync as renameSync2, statSync as statSync7, unlinkSync, writeFileSync as writeFileSync5 } from "fs";
+import { basename as basename3, dirname as dirname5, join as join13 } from "path";
 function getAuthFilePath(env = process.env) {
   return skillsCredentialFilePath(env);
 }
+function getIdentityFilePath(env = process.env) {
+  const file = skillsCredentialFilePath(env);
+  return join13(dirname5(file), basename3(file).replace(/^credentials/, "identity") + ".json");
+}
 function getApiUrl(action, env = process.env, options = {}) {
   return requireSkillsApiOrigin(action, env, options);
 }
@@ -8295,9 +8300,99 @@ var init_remote_files = __esm(() => {
   MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
 });
 
+// src/lib/remote-workspace-selection.ts
+function workspaceExpectedUserId(value) {
+  if (!uuid2(value))
+    throw new WorkspaceContextInputError;
+  return value;
+}
+function workspaceContext(value) {
+  if (!record3(value) || Object.keys(value).sort().join(",") !== "membershipId,userId" || !uuid2(value.userId) || !uuid2(value.membershipId))
+    throw new WorkspaceContextInputError;
+  return { userId: value.userId, membershipId: value.membershipId };
+}
+function invalid() {
+  throw new Error(invalidWorkspaceResult);
+}
+function organization(v) {
+  if (!record3(v) || !uuid2(v.id) || !text(v.slug) || !text(v.name))
+    return invalid();
+  return { id: v.id, slug: v.slug, name: v.name };
+}
+function parseAccountWorkspaces(value) {
+  if (!record3(value) || !Array.isArray(value.workspaces) || !value.workspaces.length || value.workspaces.length > 1000)
+    return invalid();
+  const workspaces = value.workspaces.map((v) => {
+    if (!record3(v) || !uuid2(v.membershipId) || !role(v.role) || typeof v.current !== "boolean")
+      return invalid();
+    return { membershipId: v.membershipId, organization: organization(v.organization), role: v.role, current: v.current };
+  });
+  if (workspaces.filter((w) => w.current).length !== 1 || new Set(workspaces.map((w) => w.membershipId)).size !== workspaces.length || new Set(workspaces.map((w) => w.organization.id)).size !== workspaces.length)
+    return invalid();
+  return { workspaces };
+}
+function parseWorkspaceIdentity(value, expectedUserId) {
+  if (!record3(value))
+    return invalid();
+  const user = value.user;
+  if (!record3(user) || !uuid2(user.id) || !uuid2(user.membershipId) || !text(user.email, 320) || !(user.displayName === null || text(user.displayName)) || !role(user.role))
+    return invalid();
+  if (user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { user: { id: user.id, membershipId: user.membershipId, email: user.email, displayName: user.displayName, role: user.role }, organization: organization(value.organization) };
+}
+function sessionToken(value) {
+  if (typeof value !== "string" || !value || value.length > 8192 || /[^\x21-\x7e]/.test(value) || value.startsWith("sk_"))
+    return invalid();
+  return value;
+}
+function parseWorkspaceSession(value, expected) {
+  const identity = parseWorkspaceIdentity(value, expected.userId);
+  if (identity.user.membershipId !== expected.membershipId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), ...identity };
+}
+function parseWorkspaceLogin(value, expectedUserId) {
+  const user = record3(value) && value.user;
+  if (!record3(value) || !record3(user) || !uuid2(user.id))
+    return invalid();
+  if (expectedUserId !== undefined && user.id !== expectedUserId)
+    throw new WorkspaceIdentityMismatchError;
+  return { token: sessionToken(value.token), userId: user.id };
+}
+function workspaceSelectionFailure(value, status) {
+  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceSelectionFailures, value.code))
+    return null;
+  const code = value.code;
+  return workspaceSelectionFailures[code][0] === status ? code : null;
+}
+var record3 = (v) => !!v && typeof v === "object" && !Array.isArray(v), uuid2 = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), text = (v, max = 1024) => typeof v === "string" && !!v.trim() && v.length <= max && !/[\p{Cc}\p{Cs}\u2028\u2029]/u.test(v), role = (v) => typeof v === "string" && ["owner", "admin", "member", "viewer"].includes(v), invalidWorkspaceResult = "The server returned an invalid workspace selection result.", WorkspaceContextInputError, WorkspaceIdentityMismatchError, workspaceSelectionFailures;
+var init_remote_workspace_selection = __esm(() => {
+  WorkspaceContextInputError = class WorkspaceContextInputError extends Error {
+    constructor() {
+      super("Provide the observed user ID and exact lowercase membership ID.");
+      this.name = "WorkspaceContextInputError";
+    }
+  };
+  WorkspaceIdentityMismatchError = class WorkspaceIdentityMismatchError extends Error {
+    constructor() {
+      super("The verified account does not match the requested workspace context.");
+      this.name = "WorkspaceIdentityMismatchError";
+    }
+  };
+  workspaceSelectionFailures = {
+    INVALID_WORKSPACE_SELECTION: [400, "Provide only the exact membership ID from your workspace list."],
+    SESSION_EXPIRED: [401, "Sign in again before selecting a workspace."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Interactive sign-in is required to select a workspace."],
+    WORKSPACE_UNAVAILABLE: [404, "Workspace is unavailable. Refresh your workspace list."],
+    WORKSPACE_BUSY: [503, "Workspace is busy. Refresh before retrying."]
+  };
+});
+
 // src/lib/remote-workspace.ts
 function workspaceMembersQuery(options = {}) {
-  if (!record3(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
+  if (!record4(options) || Object.keys(options).some((key) => key !== "limit" && key !== "cursor") || options.limit !== undefined && (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100) || options.cursor !== undefined && !cursor(options.cursor))
     throw new Error("Use a roster limit from 1 to 100 and an unchanged continuation cursor.");
   const query = new URLSearchParams;
   if (options.limit !== undefined)
@@ -8313,7 +8408,7 @@ function timestamp(value) {
   return Number.isFinite(time3) && new Date(time3).toISOString().slice(0, 23) === value.slice(0, 23);
 }
 function parseMember(row, fail) {
-  if (!record3(row) || !uuid2(row.membershipId) || !uuid2(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
+  if (!record4(row) || !uuid3(row.membershipId) || !uuid3(row.userId) || typeof row.email !== "string" || !row.email || !(row.displayName === null || typeof row.displayName === "string") || !isRole(row.role) || !timestamp(row.createdAt))
     return fail();
   return {
     membershipId: row.membershipId,
@@ -8325,12 +8420,12 @@ function parseMember(row, fail) {
   };
 }
 function mutationInput(membershipId, input, roleChange) {
-  if (typeof membershipId !== "string" || !uuid2(membershipId) || membershipId !== membershipId.toLowerCase() || !record3(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
+  if (typeof membershipId !== "string" || !uuid3(membershipId) || membershipId !== membershipId.toLowerCase() || !record4(input) || Object.keys(input).sort().join(",") !== (roleChange ? "expectedRole,role" : "expectedRole"))
     throw new WorkspaceMemberInputError;
-  const expectedRole = input.expectedRole, role = roleChange ? input.role : undefined;
-  if (!isRole(expectedRole) || roleChange && !isRole(role))
+  const expectedRole = input.expectedRole, role2 = roleChange ? input.role : undefined;
+  if (!isRole(expectedRole) || roleChange && !isRole(role2))
     throw new WorkspaceMemberInputError;
-  return { membershipId, role, expectedRole };
+  return { membershipId, role: role2, expectedRole };
 }
 function workspaceMemberRoleInput(membershipId, input) {
   const value = mutationInput(membershipId, input, true);
@@ -8340,24 +8435,24 @@ function workspaceMemberRemovalInput(membershipId, input) {
   const value = mutationInput(membershipId, input, false);
   return { membershipId: value.membershipId, body: { expectedRole: value.expectedRole } };
 }
-function parseWorkspaceMemberRoleResult(value, membershipId, role) {
+function parseWorkspaceMemberRoleResult(value, membershipId, role2) {
   const fail = () => {
     throw new Error(invalidMemberResult);
   };
-  if (!record3(value) || !uuid2(value.organizationId) || typeof value.changed !== "boolean")
+  if (!record4(value) || !uuid3(value.organizationId) || typeof value.changed !== "boolean")
     return fail();
   const member = parseMember(value.member, fail);
-  if (member.membershipId !== membershipId || member.role !== role)
+  if (member.membershipId !== membershipId || member.role !== role2)
     return fail();
   return { organizationId: value.organizationId, member, changed: value.changed };
 }
 function parseWorkspaceMemberRemovalResult(value, membershipId) {
-  if (!record3(value) || !uuid2(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
+  if (!record4(value) || !uuid3(value.organizationId) || value.membershipId !== membershipId || value.removed !== true || typeof value.alreadyRemoved !== "boolean")
     throw new Error(invalidMemberResult);
   return { organizationId: value.organizationId, membershipId, removed: true, alreadyRemoved: value.alreadyRemoved };
 }
 function workspaceMemberFailure(value, status) {
-  if (!record3(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
+  if (!record4(value) || typeof value.code !== "string" || !Object.hasOwn(workspaceMemberFailures, value.code))
     return null;
   const code = value.code;
   return workspaceMemberFailures[code][0] === status ? code : null;
@@ -8366,14 +8461,14 @@ function parseWorkspaceMembersPage(value) {
   const fail = () => {
     throw new Error("The server returned an invalid workspace roster.");
   };
-  if (!record3(value) || !uuid2(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
+  if (!record4(value) || !uuid3(value.organizationId) || !Array.isArray(value.members) || value.members.length > 100 || !(value.nextCursor === null || cursor(value.nextCursor)) || !value.members.length && value.nextCursor !== null)
     return fail();
   const members = value.members.map((row) => parseMember(row, fail));
   if (new Set(members.map((row) => row.membershipId)).size !== members.length)
     return fail();
   return { organizationId: value.organizationId, members, nextCursor: value.nextCursor };
 }
-var record3 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid2 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
+var record4 = (value) => !!value && typeof value === "object" && !Array.isArray(value), cursor = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,512}$/.test(value), uuid3 = (value) => typeof value === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value), isRole = (value) => typeof value === "string" && ["owner", "admin", "member", "viewer"].includes(value), WorkspaceMemberInputError, invalidMemberResult = "The server returned an invalid workspace member result. Refresh the roster before another action.", workspaceMemberFailures;
 var init_remote_workspace = __esm(() => {
   WorkspaceMemberInputError = class WorkspaceMemberInputError extends Error {
     constructor() {
@@ -8395,6 +8490,75 @@ var init_remote_workspace = __esm(() => {
   };
 });
 
+// src/lib/remote-workspace-leave.ts
+function workspaceLeaveInput(context, input) {
+  const target = workspaceContext(context);
+  if (!input || typeof input !== "object" || Array.isArray(input) || Object.keys(input).sort().join(",") !== "confirm,expectedRole" || input.confirm !== true)
+    throw new WorkspaceLeaveInputError;
+  const captured = workspaceMemberRemovalInput(target.membershipId, { expectedRole: input.expectedRole });
+  return {
+    context: target,
+    input: { expectedRole: captured.body.expectedRole, confirm: true },
+    body: { membershipId: target.membershipId, expectedRole: captured.body.expectedRole }
+  };
+}
+function workspaceLeaveFailure(value, status) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const code = value.code;
+  return typeof code === "string" && Object.hasOwn(workspaceLeaveFailures, code) && workspaceLeaveFailures[code][0] === status ? code : null;
+}
+function parseWorkspaceLeaveResult(value, membershipId, organizationId) {
+  const row = value;
+  if (!row || typeof row !== "object" || Array.isArray(row) || row.membershipId !== membershipId || row.organizationId !== organizationId || row.removed !== true || row.signInRequired !== true)
+    throw new RemoteWorkspaceLeaveUnconfirmedError;
+  return { membershipId, organizationId, removed: true, signInRequired: true };
+}
+function workspaceLeaveProfileContext(membershipId, userId, profile) {
+  const observed = profile === undefined ? undefined : workspaceContext(profile);
+  const target = workspaceContext({ userId: userId ?? observed?.userId, membershipId });
+  if (observed && (observed.userId !== target.userId || observed.membershipId !== target.membershipId))
+    throw new WorkspaceIdentityMismatchError;
+  return target;
+}
+var WorkspaceLeaveInputError, workspaceLeaveFailures, RemoteWorkspaceLeaveError, RemoteWorkspaceLeaveUnconfirmedError;
+var init_remote_workspace_leave = __esm(() => {
+  init_remote_workspace_selection();
+  init_remote_workspace();
+  WorkspaceLeaveInputError = class WorkspaceLeaveInputError extends Error {
+    constructor() {
+      super("Confirm leaving the exact observed user and membership with its expected role.");
+      this.name = "WorkspaceLeaveInputError";
+    }
+  };
+  workspaceLeaveFailures = {
+    INVALID_REQUEST: [400, "Provide the exact current membership and expected role."],
+    ACCOUNT_UNAVAILABLE: [403, "Account is unavailable."],
+    INTERACTIVE_SESSION_REQUIRED: [403, "Fresh interactive sign-in is required to leave a workspace."],
+    MEMBERSHIP_ROLE_CHANGED: [409, "Your role changed. Sign in and inspect the workspace before leaving."],
+    LAST_OWNER_REQUIRED: [409, "The workspace must retain another active owner."],
+    LAST_WORKSPACE_REQUIRED: [409, "Another available workspace is required before leaving."],
+    MEMBERSHIP_BUSY: [503, "Membership is busy. Inspect the workspace before another leave action."]
+  };
+  RemoteWorkspaceLeaveError = class RemoteWorkspaceLeaveError extends Error {
+    code;
+    status;
+    constructor(code) {
+      super(workspaceLeaveFailures[code][1]);
+      this.code = code;
+      this.name = "RemoteWorkspaceLeaveError";
+      this.status = workspaceLeaveFailures[code][0];
+    }
+  };
+  RemoteWorkspaceLeaveUnconfirmedError = class RemoteWorkspaceLeaveUnconfirmedError extends Error {
+    code = "WORKSPACE_LEAVE_UNCONFIRMED";
+    constructor() {
+      super("The leave outcome is unconfirmed. Sign in again and inspect available memberships before another action. Do not retry automatically; saved credentials are unchanged.");
+      this.name = "RemoteWorkspaceLeaveUnconfirmedError";
+    }
+  };
+});
+
 // src/lib/remote-account.ts
 function creditCount(value) {
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 2147483647) {
@@ -8498,11 +8662,11 @@ function parseUpdatedProfile(value) {
   return { user: { id: user.id, email: user.email, displayName: user.displayName, role: user.role } };
 }
 function parseUpdatedWorkspace(value) {
-  const organization = isRecord4(value) && value.organization;
-  if (!isRecord4(organization) || !string4(organization.id) || !string4(organization.slug) || !string4(organization.name)) {
+  const organization2 = isRecord4(value) && value.organization;
+  if (!isRecord4(organization2) || !string4(organization2.id) || !string4(organization2.slug) || !string4(organization2.name)) {
     throw new Error("The server returned an invalid workspace.");
   }
-  return { organization: { id: organization.id, slug: organization.slug, name: organization.name } };
+  return { organization: { id: organization2.id, slug: organization2.slug, name: organization2.name } };
 }
 
 // src/lib/remote-client.ts
@@ -8510,6 +8674,7 @@ var exports_remote_client = {};
 __export(exports_remote_client, {
   createRemoteSkillsClientReadOnly: () => createRemoteSkillsClientReadOnly,
   createRemoteSkillsClient: () => createRemoteSkillsClient,
+  RemoteWorkspaceSelectionError: () => RemoteWorkspaceSelectionError,
   RemoteWorkspaceMemberError: () => RemoteWorkspaceMemberError,
   RemoteSkillsClient: () => RemoteSkillsClient,
   RemoteRouteUnsupportedError: () => RemoteRouteUnsupportedError,
@@ -8529,6 +8694,7 @@ class RemoteSkillsClient {
     return fetch(`${this.apiUrl}${path}`, {
       ...options,
       redirect: "error",
+      credentials: "omit",
       signal: options?.signal ?? AbortSignal.timeout(15000),
       headers: {
         Authorization: `Bearer ${this.apiKey}`,
@@ -8635,6 +8801,65 @@ class RemoteSkillsClient {
   async getIdentity() {
     return (await this.requestNewRoute("/api/auth/whoami")).json();
   }
+  async listAccountWorkspaces(expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    let identity;
+    if (expected !== undefined) {
+      const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+      if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+        throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces", "INTERACTIVE_SESSION_REQUIRED");
+      identity = parseWorkspaceIdentity(value, expected);
+    }
+    const result = parseAccountWorkspaces(await connection.requestWorkspaceSelection("/api/v1/account/workspaces"));
+    const current = result.workspaces.find((workspace) => workspace.current);
+    if (identity && (current.membershipId !== identity.user.membershipId || current.organization.id !== identity.organization.id))
+      throw new WorkspaceIdentityMismatchError;
+    return result;
+  }
+  async switchWorkspace(context) {
+    const target = workspaceContext(context);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    parseWorkspaceIdentity(value, target.userId);
+    const selected = parseWorkspaceSession(await connection.requestWorkspaceSelection("/api/v1/account/workspaces/switch", {
+      method: "POST",
+      body: JSON.stringify({ membershipId: target.membershipId })
+    }), target);
+    const verified = await new RemoteSkillsClient(selected.token, connection.apiUrl).requestWorkspaceSelection("/api/auth/whoami");
+    if (!verified || typeof verified !== "object" || verified.authMethod !== "jwt")
+      throw new RemoteWorkspaceSelectionError("/api/v1/account/workspaces/switch", "INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(verified, target.userId);
+    if (identity.user.membershipId !== target.membershipId || identity.organization.id !== selected.organization.id)
+      throw new WorkspaceIdentityMismatchError;
+    return { token: selected.token, ...identity };
+  }
+  async requestWorkspaceSelection(path, options) {
+    let response;
+    try {
+      response = await this.request(path, { ...options, credentials: "omit" });
+    } catch {
+      throw new Error("Unable to reach the Skills workspace API.");
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, response.ok ? 1024 * 1024 : 4096)));
+    } catch {
+      if (response.ok)
+        throw new Error(invalidWorkspaceResult);
+    }
+    if (!response.ok) {
+      const code = workspaceSelectionFailure(value, response.status);
+      if (code)
+        throw new RemoteWorkspaceSelectionError(path, code);
+      if (response.status === 404 || response.status === 405)
+        throw new RemoteRouteUnsupportedError(path, response.status, this.apiUrl);
+      throw new RemoteRequestError(path, response.status);
+    }
+    return value;
+  }
   async updateProfile(input) {
     const body = customerNamePatch(input, "displayName");
     return parseUpdatedProfile(await (await this.requestNewRoute("/api/v1/account/profile", { method: "PATCH", body: JSON.stringify(body) })).json());
@@ -8687,6 +8912,30 @@ class RemoteSkillsClient {
     }
     return value;
   }
+  async leaveWorkspace(context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    const connection = new RemoteSkillsClient(this.apiKey, this.apiUrl);
+    const value = await connection.requestWorkspaceSelection("/api/auth/whoami");
+    if (!value || typeof value !== "object" || value.authMethod !== "jwt")
+      throw new RemoteWorkspaceLeaveError("INTERACTIVE_SESSION_REQUIRED");
+    const identity = parseWorkspaceIdentity(value, captured.context.userId);
+    if (identity.user.membershipId !== captured.context.membershipId)
+      throw new WorkspaceIdentityMismatchError;
+    let response, body;
+    try {
+      response = await connection.request("/api/v1/account/workspaces/leave", { method: "POST", body: JSON.stringify(captured.body) });
+      body = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 4096)));
+    } catch {
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    if (!response.ok) {
+      const code = workspaceLeaveFailure(body, response.status);
+      if (code)
+        throw new RemoteWorkspaceLeaveError(code);
+      throw new RemoteWorkspaceLeaveUnconfirmedError;
+    }
+    return parseWorkspaceLeaveResult(body, captured.context.membershipId, identity.organization.id);
+  }
   async listApiKeys() {
     return this.arrayResponse("/api/auth/keys");
   }
@@ -8937,13 +9186,13 @@ class RemoteSkillsClient {
     return normalizeUpdatedSincePage(await response.json());
   }
 }
-function requireOptionalString(record4, field) {
-  if (record4[field] === undefined)
+function requireOptionalString(record5, field) {
+  if (record5[field] === undefined)
     return;
-  if (typeof record4[field] !== "string") {
+  if (typeof record5[field] !== "string") {
     throw new Error(`Remote payload did not match the expected contract (${field} must be a string when present)`);
   }
-  return record4[field];
+  return record5[field];
 }
 function isVersionRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -8965,19 +9214,19 @@ function normalizePin(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote pin payload did not match the expected contract (expected an object)");
   }
-  const record4 = entry;
-  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
+  const record5 = entry;
+  const slug = typeof record5.slug === "string" && record5.slug.trim() ? record5.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote pin payload did not match the expected contract (missing slug)");
   }
   let metadata;
-  if (record4.metadata !== undefined) {
-    if (!record4.metadata || typeof record4.metadata !== "object" || Array.isArray(record4.metadata)) {
+  if (record5.metadata !== undefined) {
+    if (!record5.metadata || typeof record5.metadata !== "object" || Array.isArray(record5.metadata)) {
       throw new Error("Remote pin payload did not match the expected contract (metadata must be a JSON object when present)");
     }
-    metadata = record4.metadata;
+    metadata = record5.metadata;
   }
-  const pinnedAt = requireOptionalString(record4, "pinnedAt");
+  const pinnedAt = requireOptionalString(record5, "pinnedAt");
   return {
     slug,
     ...pinnedAt !== undefined ? { pinnedAt } : {},
@@ -8994,16 +9243,16 @@ function normalizeSkillSummary(entry) {
   if (!entry || typeof entry !== "object") {
     throw new Error("Remote skill payload did not match the expected contract (expected an object)");
   }
-  const record4 = entry;
-  const slug = typeof record4.slug === "string" && record4.slug.trim() ? record4.slug.trim() : undefined;
+  const record5 = entry;
+  const slug = typeof record5.slug === "string" && record5.slug.trim() ? record5.slug.trim() : undefined;
   if (!slug) {
     throw new Error("Remote skill payload did not match the expected contract (missing slug)");
   }
   return {
     slug,
-    ...requireOptionalString(record4, "name") !== undefined ? { name: requireOptionalString(record4, "name") } : {},
-    ...requireOptionalString(record4, "version") !== undefined ? { version: requireOptionalString(record4, "version") } : {},
-    ...requireOptionalString(record4, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record4, "updatedAt") } : {}
+    ...requireOptionalString(record5, "name") !== undefined ? { name: requireOptionalString(record5, "name") } : {},
+    ...requireOptionalString(record5, "version") !== undefined ? { version: requireOptionalString(record5, "version") } : {},
+    ...requireOptionalString(record5, "updatedAt") !== undefined ? { updatedAt: requireOptionalString(record5, "updatedAt") } : {}
   };
 }
 function normalizeSkillSummaryList(payload) {
@@ -9056,12 +9305,12 @@ function normalizeUpdatedSincePage(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Updated-since payload did not match the expected contract (expected an object)");
   }
-  const record4 = payload;
-  if (!Array.isArray(record4.skills)) {
+  const record5 = payload;
+  if (!Array.isArray(record5.skills)) {
     throw new Error("Updated-since payload did not match the expected contract (missing skills array)");
   }
-  const skills = record4.skills.map(normalizeSkillSummary);
-  const nextCursor = record4.nextCursor === undefined || record4.nextCursor === null ? null : record4.nextCursor;
+  const skills = record5.skills.map(normalizeSkillSummary);
+  const nextCursor = record5.nextCursor === undefined || record5.nextCursor === null ? null : record5.nextCursor;
   if (nextCursor !== null && typeof nextCursor !== "string") {
     throw new Error("Updated-since payload did not match the expected contract (nextCursor must be a string or absent)");
   }
@@ -9074,8 +9323,10 @@ async function createRemoteSkillsClient(env = process.env) {
 function createRemoteSkillsClientReadOnly(env = process.env) {
   return createRemoteSkillsClient(env);
 }
-var RemoteRouteUnsupportedError, RemoteRequestError, RemoteWorkspaceMemberError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
+var RemoteRouteUnsupportedError, RemoteRequestError, RemoteWorkspaceMemberError, RemoteWorkspaceSelectionError, RemoteCapabilityUnavailableError, INVALID_SKILL_VERSION_RESPONSE = "Remote skill version payload did not match the expected contract.";
 var init_remote_client = __esm(() => {
+  init_remote_workspace_leave();
+  init_remote_workspace_selection();
   init_remote_workspace();
   init_remote_workspace();
   init_auth_store();
@@ -9113,6 +9364,15 @@ var init_remote_client = __esm(() => {
       this.message = workspaceMemberFailures[code][1];
     }
   };
+  RemoteWorkspaceSelectionError = class RemoteWorkspaceSelectionError extends RemoteRequestError {
+    code;
+    constructor(path, code) {
+      super(path, workspaceSelectionFailures[code][0]);
+      this.code = code;
+      this.name = "RemoteWorkspaceSelectionError";
+      this.message = workspaceSelectionFailures[code][1];
+    }
+  };
   RemoteCapabilityUnavailableError = class RemoteCapabilityUnavailableError extends RemoteRequestError {
     code = "SUBSCRIPTION_CHECKOUT_UNAVAILABLE";
     constructor() {
@@ -14639,7 +14899,7 @@ class StdioServerTransport {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.0",
+  version: "0.5.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -27945,7 +28205,7 @@ function registerDiscoveryTools(server) {
 
 // src/mcp/operation-tools.ts
 import { existsSync as existsSync14, readdirSync as readdirSync8, statSync as statSync9 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 
 // src/lib/credential-state.ts
 init_auth_store();
@@ -27999,19 +28259,19 @@ function describeCredentialState() {
 // src/lib/run-state.ts
 import { createHash as createHash2, randomBytes } from "crypto";
 import { existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync12, readdirSync as readdirSync7, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
-import { extname, join as join13, relative as relative2 } from "path";
+import { extname, join as join14, relative as relative2 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
   const id = createRunId(now);
   const day = now.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root = getProjectStateDir(targetDir);
-  const runDir = join13(root, "runs", day, id);
-  const logsDir = join13(runDir, "logs");
-  const exportDir = join13(root, "exports", skillName, id);
+  const runDir = join14(root, "runs", day, id);
+  const logsDir = join14(runDir, "logs");
+  const exportDir = join14(root, "exports", skillName, id);
   mkdirSync6(logsDir, { recursive: true });
   mkdirSync6(exportDir, { recursive: true });
-  mkdirSync6(join13(root, "tmp"), { recursive: true });
+  mkdirSync6(join14(root, "tmp"), { recursive: true });
   const record3 = {
     id,
     skill: skillName,
@@ -28063,22 +28323,22 @@ function updateSkillRun(context, patch) {
   return context.record;
 }
 function writeRunLogs(context, stdout = "", stderr = "") {
-  writeFileSync6(join13(context.logsDir, "stdout.log"), stdout);
-  writeFileSync6(join13(context.logsDir, "stderr.log"), stderr);
+  writeFileSync6(join14(context.logsDir, "stdout.log"), stdout);
+  writeFileSync6(join14(context.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
-  const path = join13(context.runDir, "events.ndjson");
+  const path = join14(context.runDir, "events.ndjson");
   const previous = existsSync13(path) ? readFileSync12(path, "utf-8") : "";
   writeFileSync6(path, previous + line);
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
-  const runsRoot = join13(getProjectStateDir(targetDir), "runs");
+  const runsRoot = join14(getProjectStateDir(targetDir), "runs");
   if (!existsSync13(runsRoot))
     return null;
   for (const day of readdirSync7(runsRoot)) {
-    const record3 = readRunRecord(join13(runsRoot, day, runId));
+    const record3 = readRunRecord(join14(runsRoot, day, runId));
     if (record3)
       return record3;
   }
@@ -28095,11 +28355,11 @@ function skillRunEnv(context) {
   };
 }
 function writeRunRecord(context) {
-  writeFileSync6(join13(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
+  writeFileSync6(join14(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context, artifacts) {
-  writeFileSync6(join13(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
+  writeFileSync6(join14(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context) {
@@ -28119,7 +28379,7 @@ function collectRunArtifacts(context) {
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 function readRunRecord(runDir) {
-  const path = join13(runDir, "run.json");
+  const path = join14(runDir, "run.json");
   if (!existsSync13(path))
     return null;
   try {
@@ -28131,7 +28391,7 @@ function readRunRecord(runDir) {
 function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync7(dir)) {
-    const full = join13(dir, entry);
+    const full = join14(dir, entry);
     if (statSync8(full).isDirectory())
       files.push(...walkFiles(full));
     else
@@ -28638,7 +28898,7 @@ function registerOperationTools(server) {
       if (exists) {
         try {
           skillCount = readdirSync8(agentSkillsPath).filter((f) => {
-            const full = join14(agentSkillsPath, f);
+            const full = join15(agentSkillsPath, f);
             return !f.startsWith(".") && statSync9(full).isDirectory();
           }).length;
         } catch {}
@@ -28686,14 +28946,14 @@ function compactRunToolPayload(payload, detailHint) {
 
 // src/lib/feedback.ts
 import { appendFileSync, existsSync as existsSync15, mkdirSync as mkdirSync7 } from "fs";
-import { dirname as dirname5, join as join15 } from "path";
+import { dirname as dirname6, join as join16 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
-  return join15(getDataDir(), "skills.db");
+  return join16(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
-  const dir = dirname5(dbPath);
+  const dir = dirname6(dbPath);
   if (!existsSync15(dir))
     mkdirSync7(dir, { recursive: true });
   const db = new Database(dbPath);
@@ -28721,8 +28981,8 @@ function saveFeedback(input) {
     throw new Error("Feedback message is required");
   const category = input.category ?? "general";
   if (isApiMode()) {
-    const path = join15(getDataDir(), "feedback.jsonl");
-    const dir = dirname5(path);
+    const path = join16(getDataDir(), "feedback.jsonl");
+    const dir = dirname6(path);
     if (!existsSync15(dir))
       mkdirSync7(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input.email ?? null, agent: input.agent ?? null, version: input.version ?? null, createdAt: new Date().toISOString() }) + `
@@ -28870,9 +29130,9 @@ function registerResourceMetaTools(server) {
 
 // src/lib/scheduler.ts
 import { existsSync as existsSync16, readFileSync as readFileSync13, writeFileSync as writeFileSync7, mkdirSync as mkdirSync8 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
-  return join16(targetDir, ".skills", "schedules.json");
+  return join17(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
@@ -28885,7 +29145,7 @@ function loadSchedules(targetDir = process.cwd()) {
 }
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  const dir = join16(targetDir, ".skills");
+  const dir = join17(targetDir, ".skills");
   if (!existsSync16(dir))
     mkdirSync8(dir, { recursive: true });
   writeFileSync7(path, JSON.stringify(data, null, 2));
@@ -29155,7 +29415,7 @@ import {
   statSync as statSync10,
   writeFileSync as writeFileSync8
 } from "fs";
-import { dirname as dirname6, join as join17, normalize as normalize3, relative as relative3, sep as sep2 } from "path";
+import { dirname as dirname7, join as join18, normalize as normalize3, relative as relative3, sep as sep2 } from "path";
 var SKILLS_STORAGE_TABLES = [
   "skills_sync_records",
   "skills_sync_cursors"
@@ -29231,7 +29491,7 @@ function getSkillsNativeStorageStatus(options = {}) {
     local: {
       dataDir: getDataDir(),
       projectStateDir: getProjectStateDir(targetDir),
-      feedbackDbPath: join17(getDataDir(), "skills.db")
+      feedbackDbPath: join18(getDataDir(), "skills.db")
     },
     remote: {
       databaseConfigured: Boolean(config2.databaseUrl),
@@ -29335,7 +29595,7 @@ function parsePositiveInteger(value) {
 function walkFiles2(dir) {
   const files = [];
   for (const entry of readdirSync9(dir)) {
-    const full = join17(dir, entry);
+    const full = join18(dir, entry);
     const stats = statSync10(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
@@ -29391,6 +29651,9 @@ function registerStorageTools(server) {
 }
 
 // src/lib/remote-auth.ts
+init_remote_workspace_leave();
+init_remote_workspace_selection();
+init_remote_files();
 init_remote_workspace();
 init_remote_workspace();
 init_remote_client();
@@ -29431,13 +29694,13 @@ async function requestAuthApi(instance, path, options) {
       apiUrl: safeUrl
     });
   }
-  const text = await res.text();
-  const body = text ? parseJsonBody(text) : {};
+  const text2 = await res.text();
+  const body = text2 ? parseJsonBody(text2) : {};
   if (!res.ok) {
-    const record4 = isRecord5(body) ? body : {};
-    const detail = typeof record4.detail === "string" ? record4.detail : undefined;
-    const error2 = typeof record4.error === "string" ? record4.error : undefined;
-    const code = typeof record4.code === "string" ? record4.code : undefined;
+    const record5 = isRecord5(body) ? body : {};
+    const detail = typeof record5.detail === "string" ? record5.detail : undefined;
+    const error2 = typeof record5.error === "string" ? record5.error : undefined;
+    const code = typeof record5.code === "string" ? record5.code : undefined;
     throw new HostedApiError(detail || error2 || `${res.status} ${res.statusText}`, {
       status: res.status,
       code,
@@ -29448,15 +29711,15 @@ async function requestAuthApi(instance, path, options) {
   }
   return body;
 }
-function parseJsonBody(text) {
+function parseJsonBody(text2) {
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { detail: condenseErrorBody(text) };
+    return { detail: condenseErrorBody(text2) };
   }
 }
-function condenseErrorBody(text) {
-  const stripped = /<[a-z!/]/i.test(text) ? text.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text;
+function condenseErrorBody(text2) {
+  const stripped = /<[a-z!/]/i.test(text2) ? text2.replace(/<(script|style)[\s\S]*?<\/\1>/gi, " ").replace(/<[^>]*>/g, " ") : text2;
   const collapsed = stripped.replace(/\s+/g, " ").trim();
   if (collapsed.length <= MAX_ERROR_DETAIL_LENGTH)
     return collapsed;
@@ -29483,7 +29746,12 @@ class RemoteSkillsAuthClient {
   pollDevice(deviceCode) {
     return this.request("/api/auth/device/token", { method: "POST", body: JSON.stringify({ deviceCode }) });
   }
-  async sessionClient(email2, code) {
+  async sessionClient(email2, code, context) {
+    if (context !== undefined) {
+      const target = workspaceContext(context), apiOrigin2 = this.apiOrigin;
+      const session = await this.switchWorkspace(email2, code, target);
+      return new RemoteSkillsClient(session.token, apiOrigin2);
+    }
     const apiOrigin = this.apiOrigin;
     if (!email2.includes("@") || !/^\d{6}$/.test(code))
       throw new Error("Fresh email and six-digit verification code are required to manage this account");
@@ -29492,34 +29760,80 @@ class RemoteSkillsAuthClient {
       throw new Error("The server did not return an authorized account session");
     return new RemoteSkillsClient(login.token, apiOrigin);
   }
-  async createApiKey(email2, code, name, scopes) {
-    return (await this.sessionClient(email2, code)).createApiKey(name, scopes);
+  async listAccountWorkspaces(email2, code, expectedUserId) {
+    const login = await this.workspaceLogin(email2, code, expectedUserId);
+    const result = await new RemoteSkillsClient(login.token, login.apiOrigin).listAccountWorkspaces(login.userId);
+    return { userId: login.userId, ...result };
   }
-  async listApiKeys(email2, code) {
-    return (await this.sessionClient(email2, code)).listApiKeys();
+  async switchWorkspace(email2, code, context) {
+    const target = workspaceContext(context);
+    const login = await this.workspaceLogin(email2, code, target.userId);
+    return new RemoteSkillsClient(login.token, login.apiOrigin).switchWorkspace(target);
   }
-  async revokeApiKey(email2, code, keyId) {
-    return (await this.sessionClient(email2, code)).revokeApiKey(keyId);
+  async workspaceLogin(email2, code, expectedUserId) {
+    const expected = expectedUserId === undefined ? undefined : workspaceExpectedUserId(expectedUserId);
+    const apiOrigin = this.apiOrigin;
+    if (typeof email2 !== "string" || !email2.includes("@") || typeof code !== "string" || !/^\d{6}$/.test(code))
+      throw new Error("Fresh email and six-digit verification code are required to manage this account");
+    let response;
+    try {
+      response = await fetch(`${apiOrigin}/api/auth/verify`, {
+        method: "POST",
+        redirect: "error",
+        credentials: "omit",
+        signal: AbortSignal.timeout(15000),
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: email2, code })
+      });
+    } catch {
+      throw new HostedApiError("Unable to verify the Skills account.");
+    }
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {});
+      throw new HostedApiError("Unable to verify the Skills account.", { status: response.status });
+    }
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder().decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new HostedApiError("The server returned an invalid account verification result.");
+    }
+    return { ...parseWorkspaceLogin(value, expected), apiOrigin };
+  }
+  async createApiKey(email2, code, name, scopes, context) {
+    const capturedScopes = scopes === undefined ? undefined : [...scopes];
+    return (await this.sessionClient(email2, code, context)).createApiKey(name, capturedScopes);
+  }
+  async listApiKeys(email2, code, context) {
+    return (await this.sessionClient(email2, code, context)).listApiKeys();
+  }
+  async revokeApiKey(email2, code, keyId, context) {
+    return (await this.sessionClient(email2, code, context)).revokeApiKey(keyId);
   }
-  async updateProfile(email2, code, input) {
-    customerNamePatch(input, "displayName");
-    return (await this.sessionClient(email2, code)).updateProfile(input);
+  async updateProfile(email2, code, input, context) {
+    const body = customerNamePatch(input, "displayName");
+    return (await this.sessionClient(email2, code, context)).updateProfile({ displayName: body.displayName });
   }
-  async updateCurrentWorkspace(email2, code, input) {
-    customerNamePatch(input, "name");
-    return (await this.sessionClient(email2, code)).updateCurrentWorkspace(input);
+  async updateCurrentWorkspace(email2, code, input, context) {
+    const body = customerNamePatch(input, "name");
+    return (await this.sessionClient(email2, code, context)).updateCurrentWorkspace({ name: body.name });
   }
-  async listWorkspaceMembers(email2, code, options = {}) {
+  async listWorkspaceMembers(email2, code, options = {}, context) {
     workspaceMembersQuery(options);
-    return (await this.sessionClient(email2, code)).listWorkspaceMembers(options);
+    const captured = { ...options };
+    return (await this.sessionClient(email2, code, context)).listWorkspaceMembers(captured);
   }
-  async setWorkspaceMemberRole(email2, code, membershipId, input) {
+  async setWorkspaceMemberRole(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRoleInput(membershipId, input);
-    return (await this.sessionClient(email2, code)).setWorkspaceMemberRole(captured.membershipId, captured.body);
+    return (await this.sessionClient(email2, code, context)).setWorkspaceMemberRole(captured.membershipId, captured.body);
   }
-  async removeWorkspaceMember(email2, code, membershipId, input) {
+  async leaveWorkspace(email2, code, context, input) {
+    const captured = workspaceLeaveInput(context, input);
+    return (await this.sessionClient(email2, code, captured.context)).leaveWorkspace(captured.context, captured.input);
+  }
+  async removeWorkspaceMember(email2, code, membershipId, input, context) {
     const captured = workspaceMemberRemovalInput(membershipId, input);
-    return (await this.sessionClient(email2, code)).removeWorkspaceMember(captured.membershipId, captured.body);
+    return (await this.sessionClient(email2, code, context)).removeWorkspaceMember(captured.membershipId, captured.body);
   }
   request(path, options) {
     if (!["/api/auth/login", "/api/auth/verify", "/api/auth/device/start", "/api/auth/device/token", "/api/auth/keys", "/api/auth/whoami"].includes(path))
@@ -29528,9 +29842,89 @@ class RemoteSkillsAuthClient {
   }
 }
 
-// src/mcp/remote-customer-tools.ts
+// src/lib/workspace-profile.ts
+import { constants as constants2, closeSync as closeSync3, fstatSync as fstatSync3, lstatSync as lstatSync4, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync2, openSync as openSync3, readFileSync as readFileSync15, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync9 } from "fs";
 init_auth_store();
+init_fleet_credentials();
+init_instance_credentials();
 init_remote_client();
+init_remote_workspace_selection();
+
+class WorkspaceProfileError extends Error {
+}
+var fail = (message) => {
+  throw new WorkspaceProfileError(message);
+};
+function stat(path) {
+  try {
+    return lstatSync4(path);
+  } catch (error2) {
+    if (error2.code === "ENOENT")
+      return null;
+    throw error2;
+  }
+}
+function safeText(file) {
+  if (stat(file) === null)
+    return null;
+  const fd = openSync3(file, constants2.O_RDONLY | constants2.O_NOFOLLOW | constants2.O_NONBLOCK);
+  try {
+    const s = fstatSync3(fd);
+    if (!s.isFile() || s.size > 65536 || ![256, 384].includes(s.mode & 4095) || process.getuid && s.uid !== process.getuid())
+      return fail("The selected profile must use bounded owner-only regular files.");
+    return readFileSync15(fd, "utf8");
+  } finally {
+    closeSync3(fd);
+  }
+}
+function checkIdentityMetadata(file, identity) {
+  const text2 = safeText(file);
+  if (text2 === null)
+    return;
+  let value;
+  try {
+    value = JSON.parse(text2);
+  } catch {
+    return fail("The profile identity metadata is invalid. Sign in again before managing this workspace.");
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return fail("The profile identity metadata is invalid.");
+  for (const [key, expected] of Object.entries({ userId: identity.user.id, orgId: identity.organization.id })) {
+    if (value[key] !== undefined && value[key] !== expected)
+      return fail("The profile identity metadata does not match its authenticated key. Sign in again before managing this workspace.");
+  }
+}
+async function keyIdentity(key, origin) {
+  const value = await new RemoteSkillsClient(key, origin).getIdentity();
+  if (value.authMethod !== "api_key")
+    return fail("The selected credential is not a workspace API key.");
+  const user = value.user;
+  return parseWorkspaceIdentity(value, workspaceExpectedUserId(user?.id));
+}
+function prepareProfileWorkspace(action, source = process.env) {
+  const env = { ...source }, origin = getApiUrl(action, env), profile = selectedSkillsProfile(env);
+  const unchanged2 = captureSkillsCredentialFiles(skillsProfileCredentialFiles(env));
+  return { origin, async resolve() {
+    unchanged2();
+    if (!profile)
+      return { origin, context: undefined, unchanged: unchanged2 };
+    const connection = await resolveSkillsConnection(env);
+    if (!connection || connection.apiOrigin !== origin)
+      return fail("The selected profile has no usable credential for this server.");
+    const identity = await keyIdentity(connection.apiKey, origin);
+    checkIdentityMetadata(getIdentityFilePath(env), identity);
+    unchanged2();
+    const context = { userId: identity.user.id, membershipId: identity.user.membershipId };
+    return { origin, context, unchanged: unchanged2 };
+  } };
+}
+async function captureProfileWorkspace(action, source = process.env) {
+  return prepareProfileWorkspace(action, source).resolve();
+}
+
+// src/mcp/remote-customer-tools.ts
+init_remote_client();
+init_remote_workspace_leave();
 function registerRemoteCustomerTools(server) {
   const memberRole = exports_external.enum(["owner", "admin", "member", "viewer"]);
   const memberInput = {
@@ -29539,13 +29933,25 @@ function registerRemoteCustomerTools(server) {
     email: exports_external.string().email(),
     code: exports_external.string().regex(/^\d{6}$/)
   };
+  server.registerTool("leave_workspace", {
+    title: "Leave Current Workspace",
+    description: "Leave exactly the observed user and membership with confirm=true and fresh verification. The server enforces last-owner and last-workspace safeguards. Sign in again afterwards; no automatic retry or saved-profile deletion.",
+    annotations: { destructiveHint: true, idempotentHint: false, readOnlyHint: false },
+    inputSchema: exports_external.object({ ...memberInput, userId: memberInput.membershipId, confirm: exports_external.literal(true) }).strict()
+  }, async ({ membershipId, userId, expectedRole, email: email2, code, confirm }) => {
+    try {
+      return mcpJson(await freshAccount("Leave workspace", (client, context) => client.leaveWorkspace(email2, code, workspaceLeaveProfileContext(membershipId, userId, context), { expectedRole, confirm })));
+    } catch (error2) {
+      return error2 instanceof RemoteWorkspaceLeaveError || error2 instanceof RemoteWorkspaceLeaveUnconfirmedError ? mcpError(error2.code, error2.message) : mcpError("WORKSPACE_LEAVE_UNCONFIRMED", "Leaving could not be confirmed. Check the selected profile and exact membership, sign in again and inspect available workspaces before another action. Do not retry automatically; saved credentials are unchanged.");
+    }
+  });
   server.registerTool("set_workspace_member_role", {
     title: "Set Current Workspace Member Role",
     description: "Change exactly this membership incarnation with its observed expectedRole and fresh verification. The server enforces owner/admin policy. No automatic refresh or retry; saved credentials stay unchanged.",
     inputSchema: exports_external.object({ ...memberInput, role: memberRole }).strict()
-  }, async ({ membershipId, role, expectedRole, email: email2, code }) => {
+  }, async ({ membershipId, role: role2, expectedRole, email: email2, code }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Set workspace member role")).setWorkspaceMemberRole(email2, code, membershipId, { role, expectedRole }));
+      return mcpJson(await freshAccount("Set workspace member role", (client, context) => client.setWorkspaceMemberRole(email2, code, membershipId, { role: role2, expectedRole }, context)));
     } catch (error2) {
       return memberError(error2);
     }
@@ -29556,7 +29962,7 @@ function registerRemoteCustomerTools(server) {
     inputSchema: exports_external.object(memberInput).strict()
   }, async ({ membershipId, expectedRole, email: email2, code }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Remove workspace member")).removeWorkspaceMember(email2, code, membershipId, { expectedRole }));
+      return mcpJson(await freshAccount("Remove workspace member", (client, context) => client.removeWorkspaceMember(email2, code, membershipId, { expectedRole }, context)));
     } catch (error2) {
       return memberError(error2);
     }
@@ -29572,7 +29978,7 @@ function registerRemoteCustomerTools(server) {
     }).strict()
   }, async ({ email: email2, code, limit, cursor: cursor2 }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("List workspace members")).listWorkspaceMembers(email2, code, { limit, cursor: cursor2 }));
+      return mcpJson(await freshAccount("List workspace members", (client, context) => client.listWorkspaceMembers(email2, code, { limit, cursor: cursor2 }, context)));
     } catch {
       return mcpError("WORKSPACE_MEMBERS_FAILED", "Unable to list workspace members. Check the selected server, owner/admin permissions, pagination and fresh verification code.");
     }
@@ -29584,8 +29990,7 @@ function registerRemoteCustomerTools(server) {
       inputSchema: exports_external.object({ name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }).strict()
     }, async ({ name, email: email2, code }) => {
       try {
-        const client = new RemoteSkillsAuthClient(getApiUrl("Update customer name"));
-        return mcpJson(kind === "profile" ? await client.updateProfile(email2, code, { displayName: name }) : await client.updateCurrentWorkspace(email2, code, { name }));
+        return mcpJson(await freshAccount("Update customer name", async (client, context) => kind === "profile" ? client.updateProfile(email2, code, { displayName: name }, context) : client.updateCurrentWorkspace(email2, code, { name }, context)));
       } catch {
         return mcpError("NAME_UPDATE_FAILED", "Unable to update the name. Check the selected server, name, permissions and fresh verification code.");
       }
@@ -29607,9 +30012,9 @@ function registerRemoteCustomerTools(server) {
     inputSchema: { email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
   }, async ({ email: email2, code }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("List API keys")).listApiKeys(email2, code));
-    } catch (error2) {
-      return mcpError("KEY_LIST_FAILED", error2.message);
+      return mcpJson(await freshAccount("List API keys", (client, context) => client.listApiKeys(email2, code, context)));
+    } catch {
+      return mcpError("KEY_LIST_FAILED", "Unable to list API keys. Check the selected profile, server, account and fresh verification code.");
     }
   });
   server.registerTool("revoke_api_key", {
@@ -29618,9 +30023,9 @@ function registerRemoteCustomerTools(server) {
     inputSchema: { key_id: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/) }
   }, async ({ key_id, email: email2, code }) => {
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Revoke API key")).revokeApiKey(email2, code, key_id));
-    } catch (error2) {
-      return mcpError("KEY_REVOKE_FAILED", error2.message);
+      return mcpJson(await freshAccount("Revoke API key", (client, context) => client.revokeApiKey(email2, code, key_id, context)));
+    } catch {
+      return mcpError("KEY_REVOKE_FAILED", "Unable to revoke this API key. Check the selected profile, key, account and fresh verification code.");
     }
   });
   server.registerTool("create_api_key", {
@@ -29628,10 +30033,11 @@ function registerRemoteCustomerTools(server) {
     description: "Create an API key using fresh email OTP reauthentication; returns its secret once. A stored API key cannot grant this authority.",
     inputSchema: { name: exports_external.string().min(1), email: exports_external.string().email(), code: exports_external.string().regex(/^\d{6}$/), scopes: exports_external.array(exports_external.string()).optional() }
   }, async ({ name, email: email2, code, scopes }) => {
+    const capturedScopes = scopes === undefined ? undefined : [...scopes];
     try {
-      return mcpJson(await new RemoteSkillsAuthClient(getApiUrl("Create API key")).createApiKey(email2, code, name, scopes));
-    } catch (error2) {
-      return mcpError("KEY_CREATION_FAILED", error2.message);
+      return mcpJson(await freshAccount("Create API key", (client, context) => client.createApiKey(email2, code, name, capturedScopes, context)));
+    } catch {
+      return mcpError("KEY_CREATION_FAILED", "API key creation could not be confirmed. Check the selected profile and workspace keys before retrying; a lost response may still have created a key.");
     }
   });
   server.registerTool("quote_skill", {
@@ -29665,6 +30071,11 @@ async function callRemote(action) {
     return mcpError("REMOTE_REQUEST_FAILED", error2 instanceof Error ? error2.message : "Skills server request failed");
   }
 }
+async function freshAccount(action, operation) {
+  const target = await captureProfileWorkspace(action);
+  target.unchanged();
+  return operation(new RemoteSkillsAuthClient(target.origin), target.context);
+}
 
 // src/mcp/server.ts
 function buildServer() {