@notis_ai/cli 0.2.0-beta.16.1 → 0.2.0-beta.160.1

package/dist/skill-sync-worker.mjs

@@ -0,0 +1,2990 @@
+// src/skill-sync-worker.js
+import { mkdirSync as mkdirSync3, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join5 } from "node:path";
+
+// src/runtime/profiles.js
+import { randomUUID } from "node:crypto";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, parse, resolve } from "node:path";
+
+// src/runtime/errors.js
+var EXIT_CODES = {
+  ok: 0,
+  usage: 2,
+  auth: 3,
+  network: 4,
+  conflict: 5,
+  backend: 6,
+  unexpected: 7,
+  payment: 8
+};
+var CliError = class extends Error {
+  constructor({
+    code,
+    message,
+    exitCode = EXIT_CODES.unexpected,
+    retryable = false,
+    details = {},
+    hints = [],
+    warnings = [],
+    cause
+  }) {
+    super(message);
+    this.name = "CliError";
+    this.code = code;
+    this.exitCode = exitCode;
+    this.retryable = retryable;
+    this.details = details;
+    this.hints = hints;
+    this.warnings = warnings;
+    this.cause = cause;
+  }
+};
+
+// src/runtime/channel.js
+var RELEASE_CHANNELS = ["stable", "beta"];
+var CHANNEL_TAGS = { stable: "latest", beta: "beta" };
+var CLI_PACKAGE_NAME = "@notis_ai/cli";
+function isReleaseChannel(value) {
+  return RELEASE_CHANNELS.includes(value);
+}
+function packageTagForChannel(channel) {
+  return CHANNEL_TAGS[channel] || CHANNEL_TAGS.stable;
+}
+function cliCommandForChannel(channel) {
+  return `npx --package ${CLI_PACKAGE_NAME}@${packageTagForChannel(channel)} -- notis`;
+}
+function channelFromProfile(profile = {}) {
+  if (isReleaseChannel(profile.channel)) {
+    return profile.channel;
+  }
+  if (profile.beta === true) return "beta";
+  if (profile.beta === false) return "stable";
+  for (const candidate of [profile.oauth_api_base, profile.api_base]) {
+    if (typeof candidate !== "string" || !candidate) continue;
+    try {
+      const { hostname } = new URL(candidate);
+      if (hostname === "api-beta.notis.ai") return "beta";
+      if (hostname === "api.notis.ai") return "stable";
+    } catch {
+    }
+  }
+  return null;
+}
+
+// src/runtime/auth-recovery.js
+function cliNpx(runtime = {}) {
+  return cliCommandForChannel(
+    runtime.channel || channelFromProfile({ api_base: runtime.apiBase })
+  );
+}
+function quoteShellArgument(value) {
+  return `'${String(value).replace(/'/g, `'"'"'`)}'`;
+}
+function profileSuffix(profileName) {
+  return profileName && profileName !== "default" ? ` --profile ${quoteShellArgument(profileName)}` : "";
+}
+function getAuthRecovery(runtime = {}, { mode = "expired" } = {}) {
+  const CLI_NPX = cliNpx(runtime);
+  const suffix = profileSuffix(runtime.profileName);
+  const hints = [
+    {
+      command: `${CLI_NPX} login${suffix}`,
+      reason: mode === "missing" ? "Sign in or create an account in the browser and authorize this machine" : "Authorize a fresh scoped CLI credential for this profile"
+    },
+    {
+      command: `${CLI_NPX} profile list`,
+      reason: "Check whether another profile on this machine is already signed in"
+    },
+    {
+      command: `${CLI_NPX} doctor${suffix}`,
+      reason: "Retry the auth and API checks once authorization completes"
+    }
+  ];
+  return { hints };
+}
+
+// src/runtime/profiles.js
+var CONFIG_DIR = join(homedir(), ".notis");
+var CONFIG_FILE = join(CONFIG_DIR, "config.json");
+var WORKSPACE_DIR = join(CONFIG_DIR, "workspace");
+var DEFAULT_API_BASE = "https://api.notis.ai";
+var BETA_API_BASE = "https://api-beta.notis.ai";
+var DEFAULT_PROFILE = "default";
+var PROFILE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+var LEGACY_DESKTOP_PROFILE_KEYS = [
+  "jwt",
+  "auth_mode",
+  "refresh_token",
+  "access_expires_at",
+  "refresh_expires_at",
+  "desktop_app_name",
+  "desktop_pid"
+];
+var WORKTREE_RUNTIME_FILENAME = join(".context", "notis-runtime.json");
+var WORKTREE_ROUTING_FILENAME = join(".context", "notis-routing.json");
+var LOCAL_API_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+var LIVE_API_HOSTS = /* @__PURE__ */ new Set(["api.notis.ai", "api-beta.notis.ai"]);
+var CONFIG_WRITE_LOCK_TIMEOUT_MS = 5e3;
+var CONFIG_WRITE_LOCK_STALE_MS = 2e3;
+var CONFIG_WRITE_LOCK_POLL_MS = 10;
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+function isValidProfileName(profileName) {
+  return typeof profileName === "string" && PROFILE_NAME_PATTERN.test(profileName) && !Object.hasOwn(Object.prototype, profileName);
+}
+function isSafeStoredProfileName(profileName) {
+  return typeof profileName === "string" && profileName.length > 0 && !Object.hasOwn(Object.prototype, profileName);
+}
+function assertValidProfileName(profileName) {
+  if (isValidProfileName(profileName)) {
+    return;
+  }
+  throw new CliError({
+    code: "profile_name_invalid",
+    message: "CLI profile names must start with a letter or number and contain only letters, numbers, dots, underscores, or hyphens (maximum 64 characters)",
+    exitCode: EXIT_CODES.usage,
+    hints: [
+      { command: "notis profile list", reason: "See the valid profiles already on this machine" }
+    ]
+  });
+}
+function normalizeProfile(rawProfile = {}) {
+  const raw = rawProfile && typeof rawProfile === "object" ? rawProfile : {};
+  return {
+    api_base: typeof raw.api_base === "string" ? raw.api_base : void 0,
+    beta: typeof raw.beta === "boolean" ? raw.beta : void 0,
+    // Which published CLI build this profile runs, as the deployment reported
+    // it at login. Unknown values are dropped rather than trusted: this key
+    // decides which code executes on the next run.
+    channel: isReleaseChannel(raw.channel) ? raw.channel : void 0,
+    label: typeof raw.label === "string" ? raw.label : void 0,
+    dev_access_token: typeof raw.dev_access_token === "string" ? raw.dev_access_token : void 0,
+    dev_access_expires_at: typeof raw.dev_access_expires_at === "number" ? raw.dev_access_expires_at : void 0,
+    dev_user_id: typeof raw.dev_user_id === "string" ? raw.dev_user_id : void 0,
+    dev_workspace_root: typeof raw.dev_workspace_root === "string" ? raw.dev_workspace_root : void 0,
+    oauth_access_token: typeof raw.oauth_access_token === "string" ? raw.oauth_access_token : void 0,
+    oauth_refresh_token: typeof raw.oauth_refresh_token === "string" ? raw.oauth_refresh_token : void 0,
+    oauth_access_expires_at: typeof raw.oauth_access_expires_at === "number" ? raw.oauth_access_expires_at : void 0,
+    oauth_refresh_expires_at: typeof raw.oauth_refresh_expires_at === "number" ? raw.oauth_refresh_expires_at : void 0,
+    oauth_client_id: typeof raw.oauth_client_id === "string" ? raw.oauth_client_id : void 0,
+    oauth_issuer: typeof raw.oauth_issuer === "string" ? raw.oauth_issuer : void 0,
+    oauth_api_base: typeof raw.oauth_api_base === "string" ? raw.oauth_api_base : void 0,
+    oauth_resource: typeof raw.oauth_resource === "string" ? raw.oauth_resource : void 0,
+    oauth_scopes: Array.isArray(raw.oauth_scopes) ? raw.oauth_scopes.filter((scope) => typeof scope === "string") : void 0,
+    oauth_user_id: typeof raw.oauth_user_id === "string" ? raw.oauth_user_id : void 0
+  };
+}
+function normalizeConfig(rawConfig = {}) {
+  const raw = rawConfig && typeof rawConfig === "object" ? clone(rawConfig) : {};
+  if (raw.profiles && typeof raw.profiles === "object") {
+    const profiles = {};
+    for (const [name, profile] of Object.entries(raw.profiles)) {
+      if (!isSafeStoredProfileName(name) || !profile || typeof profile !== "object") {
+        continue;
+      }
+      profiles[name] = normalizeProfile(profile);
+    }
+    if (!Object.hasOwn(profiles, DEFAULT_PROFILE)) {
+      profiles[DEFAULT_PROFILE] = {};
+    }
+    return {
+      current_profile: typeof raw.current_profile === "string" && Object.hasOwn(profiles, raw.current_profile) ? raw.current_profile : DEFAULT_PROFILE,
+      profiles
+    };
+  }
+  return {
+    current_profile: DEFAULT_PROFILE,
+    profiles: { [DEFAULT_PROFILE]: normalizeProfile(raw) }
+  };
+}
+function readJsonFile(path3) {
+  try {
+    return JSON.parse(readFileSync(path3, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function findUp(filename, startDir = process.cwd()) {
+  let current = resolve(startDir);
+  const root = parse(current).root;
+  while (true) {
+    const candidate = join(current, filename);
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+    if (current === root) {
+      return null;
+    }
+    current = dirname(current);
+  }
+}
+function processIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) {
+    return false;
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === "EPERM";
+  }
+}
+function resolveWorktreeRuntime(startDir = process.cwd()) {
+  if (process.env.NODE_ENV === "test" && process.env.NOTIS_TEST_DISABLE_WORKTREE_ROUTING === "1") {
+    return null;
+  }
+  const runtimePath = findUp(WORKTREE_RUNTIME_FILENAME, startDir);
+  const routingPath = findUp(WORKTREE_ROUTING_FILENAME, startDir);
+  const routing = routingPath ? readJsonFile(routingPath) : null;
+  if (!runtimePath) {
+    if (routing?.mode === "local-only") {
+      return {
+        unavailable: new CliError({
+          code: "dev_runtime_unavailable",
+          message: "This worktree is local-only, but its dev.sh runtime is not active",
+          exitCode: EXIT_CODES.network,
+          hints: [
+            { message: "Start ./dev.sh in this worktree, then retry the command." },
+            { command: "notis profile list", reason: "Run against a live account profile instead" },
+            { message: `Routing policy: ${routingPath}` }
+          ]
+        })
+      };
+    }
+    return null;
+  }
+  const runtime = readJsonFile(runtimePath);
+  const apiBase = typeof runtime?.api_base === "string" ? runtime.api_base.replace(/\/+$/, "") : "";
+  const profile = typeof runtime?.profile === "string" ? runtime.profile.trim() : "";
+  const devAccessToken = typeof runtime?.dev_access_token === "string" ? runtime.dev_access_token.trim() : "";
+  const desktopDeepLinkScheme = typeof runtime?.desktop_deep_link_scheme === "string" ? runtime.desktop_deep_link_scheme.trim() : "";
+  const pid = Number(runtime?.dev_pid);
+  if (runtime?.mode !== "local-only" || !isLocalApiBase(apiBase) || !profile || !devAccessToken || !processIsAlive(pid)) {
+    return {
+      unavailable: new CliError({
+        code: "dev_runtime_unavailable",
+        message: "The local-only worktree runtime is stale or invalid",
+        exitCode: EXIT_CODES.network,
+        hints: [
+          { message: "Restart ./dev.sh in this worktree, then retry the command." },
+          { command: "notis profile list", reason: "Run against a live account profile instead" },
+          { message: `Runtime lease: ${runtimePath}` }
+        ]
+      })
+    };
+  }
+  return {
+    ...runtime,
+    api_base: apiBase,
+    profile,
+    dev_access_token: devAccessToken,
+    desktop_deep_link_scheme: desktopDeepLinkScheme || void 0,
+    runtime_path: runtimePath,
+    routing_path: routingPath
+  };
+}
+function resolveConfigFile() {
+  const envConfigFile = process.env.NOTIS_CLI_CONFIG_FILE;
+  if (envConfigFile) {
+    return resolve(envConfigFile);
+  }
+  return CONFIG_FILE;
+}
+function loadConfig() {
+  const configFile = resolveConfigFile();
+  if (!existsSync(configFile)) {
+    return normalizeConfig({});
+  }
+  try {
+    return normalizeConfig(JSON.parse(readFileSync(configFile, "utf-8")));
+  } catch {
+    return normalizeConfig({});
+  }
+}
+function writeConfig(configFile, config) {
+  let rawConfig = null;
+  try {
+    rawConfig = JSON.parse(readFileSync(configFile, "utf-8"));
+  } catch {
+  }
+  const normalized = normalizeConfig(config);
+  const persisted = clone(normalized);
+  const rawProfiles = rawConfig?.profiles && typeof rawConfig.profiles === "object" ? rawConfig.profiles : { [DEFAULT_PROFILE]: rawConfig };
+  for (const [name, profile] of Object.entries(persisted.profiles)) {
+    const rawProfile = Object.hasOwn(rawProfiles || {}, name) ? rawProfiles[name] : null;
+    if (!rawProfile || typeof rawProfile !== "object") continue;
+    for (const key of LEGACY_DESKTOP_PROFILE_KEYS) {
+      if (Object.hasOwn(rawProfile, key)) {
+        profile[key] = rawProfile[key];
+      }
+    }
+  }
+  writeRawConfig(configFile, persisted);
+}
+function writeRawConfig(configFile, config) {
+  mkdirSync(dirname(configFile), { recursive: true });
+  const temporaryFile = `${configFile}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(temporaryFile, JSON.stringify(config, null, 2), { mode: 384 });
+  renameSync(temporaryFile, configFile);
+}
+function readLockOwner(lockDirectory) {
+  try {
+    return JSON.parse(readFileSync(join(lockDirectory, "owner"), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function lockDirectoryMtime(lockDirectory) {
+  try {
+    return statSync(lockDirectory).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+function publishConfigWriteLock(lockDirectory, ownerId) {
+  const candidateDirectory = `${lockDirectory}.candidate-${ownerId}`;
+  try {
+    mkdirSync(candidateDirectory);
+    writeFileSync(
+      join(candidateDirectory, "owner"),
+      JSON.stringify({ id: ownerId, at: Date.now() }),
+      { mode: 384 }
+    );
+    try {
+      renameSync(candidateDirectory, lockDirectory);
+      return true;
+    } catch (error) {
+      if (!existsSync(lockDirectory)) throw error;
+      return false;
+    }
+  } finally {
+    rmSync(candidateDirectory, { recursive: true, force: true });
+  }
+}
+function withConfigWriteLock(callback) {
+  const configFile = resolveConfigFile();
+  const lockDirectory = `${configFile}.write-lock`;
+  const ownerId = `${process.pid}.${randomUUID()}`;
+  const deadline = Date.now() + CONFIG_WRITE_LOCK_TIMEOUT_MS;
+  mkdirSync(dirname(configFile), { recursive: true });
+  for (; ; ) {
+    if (!existsSync(lockDirectory) && publishConfigWriteLock(lockDirectory, ownerId)) {
+      break;
+    }
+    const owner = readLockOwner(lockDirectory);
+    const observedMtime = lockDirectoryMtime(lockDirectory);
+    const ownerIsStale = owner?.id && Date.now() - Number(owner.at) > CONFIG_WRITE_LOCK_STALE_MS;
+    const ownerlessIsStale = !owner && observedMtime !== null && Date.now() - observedMtime > CONFIG_WRITE_LOCK_STALE_MS;
+    if (ownerIsStale || ownerlessIsStale) {
+      try {
+        const currentOwner = readLockOwner(lockDirectory);
+        const ownerUnchanged = owner?.id ? currentOwner?.id === owner.id : !currentOwner && lockDirectoryMtime(lockDirectory) === observedMtime;
+        if (ownerUnchanged) {
+          rmSync(lockDirectory, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+      }
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting to update ${configFile}`);
+    }
+    Atomics.wait(
+      new Int32Array(new SharedArrayBuffer(4)),
+      0,
+      0,
+      CONFIG_WRITE_LOCK_POLL_MS
+    );
+  }
+  try {
+    return callback(configFile);
+  } finally {
+    try {
+      if (readLockOwner(lockDirectory)?.id === ownerId) {
+        rmSync(lockDirectory, { recursive: true, force: true });
+      }
+    } catch {
+    }
+  }
+}
+function updateConfig(updater) {
+  return withConfigWriteLock((configFile) => {
+    const current = loadConfig();
+    const updated = updater(normalizeConfig(current));
+    const next = normalizeConfig(updated ?? current);
+    writeConfig(configFile, next);
+    return next;
+  });
+}
+function getProfile(config, profileName) {
+  const normalized = normalizeConfig(config);
+  return Object.hasOwn(normalized.profiles, profileName) ? normalized.profiles[profileName] : {};
+}
+function resolveProfileSelection(globalOptions = {}, worktreeRuntime = null, config, { allowUnknownProfile = false } = {}) {
+  const normalized = normalizeConfig(config);
+  const requested = globalOptions.profile || process.env.NOTIS_PROFILE || "";
+  if (requested) {
+    const existingProfile = Object.hasOwn(normalized.profiles, requested);
+    if (!existingProfile) {
+      assertValidProfileName(requested);
+    }
+    if (!existingProfile && !allowUnknownProfile) {
+      throw new CliError({
+        code: "profile_unknown",
+        message: `No CLI profile named "${requested}"`,
+        exitCode: EXIT_CODES.usage,
+        details: { known_profiles: Object.keys(normalized.profiles) },
+        hints: [
+          { command: "notis profile list", reason: "See which profiles this machine has" },
+          {
+            command: `notis login --profile ${quoteShellArgument(requested)}`,
+            reason: "Authorize a new account under this profile name"
+          }
+        ]
+      });
+    }
+    return { profileName: requested, source: "explicit" };
+  }
+  if (worktreeRuntime?.profile) {
+    return { profileName: worktreeRuntime.profile, source: "worktree" };
+  }
+  return {
+    profileName: normalized.current_profile || DEFAULT_PROFILE,
+    source: "current"
+  };
+}
+function ensureProfile(config, profileName) {
+  const normalized = normalizeConfig(config);
+  if (!Object.hasOwn(normalized.profiles, profileName)) {
+    assertValidProfileName(profileName);
+    normalized.profiles[profileName] = {};
+  }
+  return normalized;
+}
+function isLocalApiBase(value) {
+  if (typeof value !== "string" || !value) {
+    return false;
+  }
+  try {
+    const parsed = new URL(value);
+    return ["http:", "https:"].includes(parsed.protocol) && LOCAL_API_HOSTS.has(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+function isLiveApiBase(value) {
+  if (typeof value !== "string" || !value) {
+    return false;
+  }
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === "https:" && LIVE_API_HOSTS.has(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+function resolveDefaultLiveApiBase(profile = {}) {
+  if (profile.beta === true) {
+    return BETA_API_BASE;
+  }
+  if (profile.beta === false) {
+    return DEFAULT_API_BASE;
+  }
+  if (isLiveApiBase(profile.api_base)) {
+    try {
+      if (new URL(profile.api_base).hostname === "api-beta.notis.ai") {
+        return BETA_API_BASE;
+      }
+    } catch {
+    }
+  }
+  return DEFAULT_API_BASE;
+}
+function getApiBase(config, profileName, override) {
+  if (override) {
+    return override;
+  }
+  const env = process.env.NOTIS_API_BASE;
+  if (env) {
+    return env;
+  }
+  const profile = getProfile(config, profileName);
+  const profileApiBase = profile.api_base;
+  if (typeof profileApiBase === "string" && profileApiBase && !isLocalApiBase(profileApiBase)) {
+    return profileApiBase.replace(/\/+$/, "");
+  }
+  return resolveDefaultLiveApiBase(profile);
+}
+function isAgentMode(globalOptions = {}) {
+  return process.env.NOTIS_AGENT === "1" || Boolean(globalOptions.agentMode);
+}
+function isNonInteractive(globalOptions = {}) {
+  if (process.env.NOTIS_NON_INTERACTIVE === "1") {
+    return true;
+  }
+  if (globalOptions.nonInteractive) {
+    return true;
+  }
+  return isAgentMode(globalOptions);
+}
+function resolveOutputMode(globalOptions = {}) {
+  if (globalOptions.json) {
+    return "json";
+  }
+  if (globalOptions.output) {
+    return globalOptions.output;
+  }
+  if (process.env.NOTIS_OUTPUT) {
+    return process.env.NOTIS_OUTPUT;
+  }
+  return !process.stdout.isTTY || isAgentMode(globalOptions) ? "json" : "table";
+}
+function resolveTimeoutMs(globalOptions = {}) {
+  const raw = globalOptions.timeoutMs || process.env.NOTIS_TIMEOUT_MS;
+  if (!raw) {
+    return 3e4;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 3e4;
+}
+function parseDebugEntitlementOverride(value = process.env.NOTIS_DEBUG_ENTITLEMENT_OVERRIDE) {
+  if (!value) {
+    return null;
+  }
+  const candidates = [value];
+  try {
+    candidates.push(Buffer.from(value, "base64url").toString("utf-8"));
+  } catch {
+  }
+  for (const candidate of candidates) {
+    try {
+      const parsed = JSON.parse(candidate);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return parsed;
+      }
+    } catch {
+    }
+  }
+  throw new CliError({
+    code: "debug_entitlement_override_invalid",
+    message: "NOTIS_DEBUG_ENTITLEMENT_OVERRIDE must be a JSON object or base64url-encoded JSON object.",
+    exitCode: EXIT_CODES.usage
+  });
+}
+function getOAuthResource(profile = {}) {
+  if (typeof profile.oauth_resource === "string" && profile.oauth_resource) {
+    return profile.oauth_resource.replace(/\/+$/, "");
+  }
+  if (typeof profile.oauth_access_token === "string" && profile.oauth_access_token) {
+    try {
+      const parts = profile.oauth_access_token.split(".");
+      if (parts.length === 3) {
+        const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
+        if (typeof payload.aud === "string" && payload.aud) {
+          return payload.aud.replace(/\/+$/, "");
+        }
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function getOAuthApiBase(profile = {}) {
+  if (typeof profile.oauth_api_base === "string" && profile.oauth_api_base) {
+    return profile.oauth_api_base.replace(/\/+$/, "");
+  }
+  const resource = getOAuthResource(profile);
+  if (resource?.endsWith("/cli")) {
+    return resource.slice(0, -"/cli".length);
+  }
+  return null;
+}
+function resolveRuntimeProfile(globalOptions = {}, {
+  requireAuth = true,
+  includeDebugEntitlementOverride = true,
+  allowUnknownProfile = false,
+  allowUnavailableWorktree = false
+} = {}) {
+  const resolvedWorktree = resolveWorktreeRuntime();
+  const worktreeUnavailable = resolvedWorktree?.unavailable || null;
+  const worktreeRuntime = worktreeUnavailable ? null : resolvedWorktree;
+  const config = loadConfig();
+  const { profileName, source: profileSource } = resolveProfileSelection(
+    globalOptions,
+    worktreeRuntime,
+    config,
+    { allowUnknownProfile }
+  );
+  if (worktreeUnavailable && !allowUnavailableWorktree && profileSource !== "explicit") {
+    throw worktreeUnavailable;
+  }
+  const devRuntime = worktreeRuntime && worktreeRuntime.profile === profileName ? worktreeRuntime : null;
+  const requestedApiBase = globalOptions.apiBase;
+  if (devRuntime && requestedApiBase && requestedApiBase.replace(/\/+$/, "") !== devRuntime.api_base) {
+    throw new CliError({
+      code: "dev_runtime_route_mismatch",
+      message: `Profile "${profileName}" is bound to this worktree and cannot route to ${requestedApiBase}`,
+      exitCode: EXIT_CODES.usage,
+      hints: [
+        { message: `Expected local API: ${devRuntime.api_base}` },
+        { command: "notis profile list", reason: "Switch to a profile that targets that API instead" }
+      ]
+    });
+  }
+  let apiBase = devRuntime ? devRuntime.api_base : getApiBase(config, profileName, globalOptions.apiBase);
+  const profile = getProfile(config, profileName);
+  const envJwt = !devRuntime ? process.env.NOTIS_JWT : void 0;
+  const devJwt = devRuntime?.dev_access_token || profile.dev_access_token;
+  const oauthJwt = profile.oauth_access_token;
+  let jwt;
+  let credentialKind;
+  if (requireAuth && !devRuntime && devJwt && !oauthJwt && !process.env.NOTIS_JWT) {
+    throw new CliError({
+      code: "dev_runtime_unavailable",
+      message: `Profile "${profileName}" is a ./dev.sh profile and its local runtime is not active`,
+      exitCode: EXIT_CODES.network,
+      details: { workspace_root: profile.dev_workspace_root || null },
+      hints: [
+        profile.dev_workspace_root ? { message: `Start ./dev.sh in ${profile.dev_workspace_root}, then retry.` } : { message: "Start ./dev.sh in the worktree that owns this profile, then retry." },
+        { command: "notis profile list", reason: "Switch to a live account profile instead" }
+      ]
+    });
+  }
+  if (devRuntime && devJwt) {
+    jwt = devJwt;
+    credentialKind = "worktree";
+  } else if (envJwt) {
+    jwt = envJwt;
+    credentialKind = "env";
+  } else if (oauthJwt && !credentialIsExpired({ credentialKind: "oauth", jwt: oauthJwt }, profile)) {
+    jwt = oauthJwt;
+    credentialKind = "oauth";
+  } else if (oauthJwt) {
+    jwt = oauthJwt;
+    credentialKind = "oauth";
+  }
+  const oauthApiBase = getOAuthApiBase(profile);
+  const oauthResource = getOAuthResource(profile);
+  const normalizedRequestedApiBase = requestedApiBase ? requestedApiBase.replace(/\/+$/, "") : null;
+  if (requireAuth && credentialKind === "oauth" && normalizedRequestedApiBase && oauthApiBase && normalizedRequestedApiBase !== oauthApiBase) {
+    throw new CliError({
+      code: "oauth_api_target_mismatch",
+      message: `The OAuth credential for profile ${profileName} belongs to ${oauthApiBase}, not ${normalizedRequestedApiBase}`,
+      exitCode: EXIT_CODES.auth,
+      hints: [{
+        command: [
+          cliCommandForChannel(channelFromProfile({ api_base: normalizedRequestedApiBase })),
+          `--profile ${quoteShellArgument(profileName)}`,
+          `--api-base ${quoteShellArgument(normalizedRequestedApiBase)}`,
+          "login"
+        ].join(" "),
+        reason: "Authorize a separate OAuth grant for the requested Notis environment"
+      }]
+    });
+  }
+  if (credentialKind === "oauth" && oauthApiBase && !requestedApiBase) {
+    apiBase = oauthApiBase;
+  }
+  const agentMode = isAgentMode(globalOptions);
+  const nonInteractive = isNonInteractive(globalOptions);
+  const outputMode = resolveOutputMode(globalOptions);
+  const timeoutMs = resolveTimeoutMs(globalOptions);
+  const debugEntitlementOverride = includeDebugEntitlementOverride ? parseDebugEntitlementOverride() : null;
+  if (requireAuth && !jwt) {
+    throw new CliError({
+      code: "auth_missing",
+      message: `Profile "${profileName}" has no Notis credential`,
+      exitCode: EXIT_CODES.auth,
+      hints: getAuthRecovery({ profileName, apiBase }, { mode: "missing" }).hints
+    });
+  }
+  if (devRuntime?.expected_user_id && (credentialKind === "oauth" ? profile.oauth_user_id : getJwtSubject(jwt)) !== devRuntime.expected_user_id) {
+    throw new CliError({
+      code: "dev_runtime_identity_mismatch",
+      message: `Profile "${profileName}" no longer holds this worktree's test identity`,
+      exitCode: EXIT_CODES.auth,
+      hints: [
+        { message: "Restart ./dev.sh to restore the approved worktree identity." },
+        { message: `Expected user: ${devRuntime.expected_user_id}` }
+      ]
+    });
+  }
+  return {
+    config,
+    profileName,
+    profileSource,
+    profileLabel: profile.label,
+    // Which published build serves this profile. Carried on the runtime so
+    // every recovery hint prints the command that will actually run.
+    channel: devRuntime ? null : channelFromProfile(
+      globalOptions.apiBase || process.env.NOTIS_API_BASE ? { api_base: apiBase } : { ...profile, api_base: apiBase }
+    ),
+    apiBase,
+    requestedApiBase: normalizedRequestedApiBase,
+    jwt,
+    credentialKind,
+    credentialSource: credentialKind,
+    oauthAccessToken: profile.oauth_access_token,
+    oauthRefreshToken: profile.oauth_refresh_token,
+    oauthAccessExpiresAt: profile.oauth_access_expires_at,
+    oauthRefreshExpiresAt: profile.oauth_refresh_expires_at,
+    oauthClientId: profile.oauth_client_id,
+    oauthIssuer: profile.oauth_issuer,
+    oauthApiBase,
+    oauthResource,
+    oauthScopes: profile.oauth_scopes || [],
+    oauthUserId: profile.oauth_user_id,
+    agentMode,
+    nonInteractive,
+    outputMode,
+    timeoutMs,
+    debugEntitlementOverride,
+    worktreeRuntime: devRuntime,
+    detachedWorktreeRuntime: devRuntime ? null : worktreeRuntime,
+    worktreeRuntimeUnavailable: worktreeUnavailable
+  };
+}
+function getJwtExpiration(jwt) {
+  if (typeof jwt !== "string" || !jwt) {
+    return null;
+  }
+  try {
+    const parts = jwt.split(".");
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+function getJwtSubject(jwt) {
+  if (typeof jwt !== "string" || !jwt) {
+    return null;
+  }
+  try {
+    const parts = jwt.split(".");
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
+    return typeof payload.sub === "string" && payload.sub ? payload.sub : null;
+  } catch {
+    return null;
+  }
+}
+function credentialIsExpired(runtime, profile = {}, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  const credentialKind = runtime?.credentialKind || (runtime?.credentialSource === "env" ? "env" : null);
+  switch (credentialKind) {
+    case "oauth": {
+      const expiration = Number(profile.oauth_access_expires_at);
+      return !Number.isFinite(expiration) || expiration <= nowSeconds;
+    }
+    case "env": {
+      const expiration = getJwtExpiration(runtime?.jwt);
+      return expiration !== null && expiration <= nowSeconds;
+    }
+    case "worktree": {
+      const rawExpiration = profile.dev_access_expires_at ?? getJwtExpiration(runtime?.jwt);
+      if (rawExpiration === null || rawExpiration === void 0 || rawExpiration === "") {
+        return true;
+      }
+      const expiration = Number(rawExpiration);
+      return !Number.isFinite(expiration) || expiration <= nowSeconds;
+    }
+    default:
+      return true;
+  }
+}
+
+// src/runtime/oauth.js
+import {
+  createHash,
+  randomBytes,
+  timingSafeEqual
+} from "node:crypto";
+import {
+  mkdirSync as mkdirSync2,
+  readdirSync,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  rmdirSync,
+  rmSync as rmSync2,
+  statSync as statSync2,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { basename, dirname as dirname2, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createInterface } from "node:readline/promises";
+var OAUTH_LOCK_DIR = join2(homedir2(), ".notis", "oauth.lock");
+var DEFAULT_REFRESH_EXPIRES_IN = 30 * 24 * 60 * 60;
+var PENDING_LOGIN_TTL_SECONDS = 30 * 60;
+var OAUTH_HTTP_TIMEOUT_MS = 1e4;
+function oauthError(code, message, hints = null, details = {}) {
+  return new CliError({
+    code,
+    message,
+    exitCode: EXIT_CODES.auth,
+    details,
+    hints: hints || [
+      { command: "notis login", reason: "Start a new browser authorization" },
+      { command: "notis doctor", reason: "Inspect the active credential state" }
+    ]
+  });
+}
+function base64url(value) {
+  return Buffer.from(value).toString("base64url");
+}
+function decodeJwtPayload(token) {
+  try {
+    const parts = String(token || "").split(".");
+    if (parts.length !== 3) return {};
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+  } catch {
+    return {};
+  }
+}
+async function fetchJson(url, init = {}, fetchImpl = fetch) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), OAUTH_HTTP_TIMEOUT_MS);
+  const abortFromCaller = () => controller.abort();
+  init.signal?.addEventListener?.("abort", abortFromCaller, { once: true });
+  try {
+    const response = await fetchImpl(url, { ...init, signal: controller.signal });
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      throw oauthError(
+        payload.error || "oauth_request_failed",
+        payload.error_description || payload.message || `OAuth request failed with status ${response.status}`,
+        null,
+        payload
+      );
+    }
+    return payload;
+  } catch (error) {
+    if (controller.signal.aborted && !init.signal?.aborted) {
+      throw oauthError(
+        "oauth_request_timeout",
+        "The OAuth server did not respond in time. Retry the command."
+      );
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+    init.signal?.removeEventListener?.("abort", abortFromCaller);
+  }
+}
+function storedOAuthMetadata(runtime, profile) {
+  const issuer = String(profile.oauth_issuer || "").replace(/\/+$/, "");
+  const apiBase = getOAuthApiBase(profile) || String(profile.api_base || runtime.apiBase || "").replace(/\/+$/, "");
+  const resource = getOAuthResource(profile) || (apiBase ? `${apiBase}/cli` : "");
+  if (!issuer || !apiBase || !resource || !profile.oauth_client_id) {
+    throw oauthError(
+      "oauth_metadata_missing",
+      "The stored OAuth profile is incomplete. Run notis login again."
+    );
+  }
+  return {
+    apiBase,
+    issuer,
+    resource,
+    clientId: profile.oauth_client_id,
+    tokenEndpoint: `${issuer}/oauth/token`,
+    revocationEndpoint: `${issuer}/oauth/revoke`
+  };
+}
+function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
+  const now = Math.floor(Date.now() / 1e3);
+  const payload = decodeJwtPayload(tokenResponse.access_token);
+  const oauthApiBase = (metadata.apiBase || runtime.apiBase || "").replace(/\/+$/, "");
+  let beta;
+  try {
+    const hostname = new URL(oauthApiBase).hostname;
+    if (hostname === "api-beta.notis.ai") beta = true;
+    else if (hostname === "api.notis.ai") beta = false;
+  } catch {
+    beta = void 0;
+  }
+  const config = updateConfig((latest) => {
+    const next = ensureProfile(latest, runtime.profileName);
+    const profile = next.profiles[runtime.profileName];
+    next.profiles[runtime.profileName] = {
+      ...profile,
+      // The grant defines this profile's endpoint. A profile is one account on
+      // one API, and the environment the user just authorized against is the
+      // only endpoint the resulting token is accepted by.
+      api_base: oauthApiBase || profile.api_base,
+      beta: beta ?? profile.beta,
+      // The deployment that just authorized this profile also names the
+      // published build that belongs to it. Pinning it here is what lets the
+      // next run correct itself without the user knowing a channel exists.
+      channel: isReleaseChannel(metadata.channel) ? metadata.channel : channelFromProfile({ ...profile, beta: beta ?? profile.beta, api_base: oauthApiBase }) ?? profile.channel,
+      oauth_api_base: oauthApiBase || profile.oauth_api_base,
+      oauth_resource: metadata.resource,
+      oauth_access_token: tokenResponse.access_token,
+      oauth_refresh_token: tokenResponse.refresh_token || profile.oauth_refresh_token,
+      oauth_access_expires_at: now + Number(tokenResponse.expires_in || 0),
+      oauth_refresh_expires_at: now + Number(tokenResponse.refresh_expires_in || DEFAULT_REFRESH_EXPIRES_IN),
+      oauth_client_id: metadata.clientId,
+      oauth_issuer: metadata.issuer,
+      oauth_scopes: String(tokenResponse.scope || "").split(/\s+/).filter(Boolean),
+      oauth_user_id: payload.sub || payload.notis_user_id
+    };
+    return next;
+  });
+  return config.profiles[runtime.profileName];
+}
+var LISTENER_SCRIPT = fileURLToPath(new URL("./login-listener.js", import.meta.url));
+var LISTENER_HANDSHAKE_TIMEOUT_MS = 1e4;
+var LISTENER_START_LOCK_STALE_MS = LISTENER_HANDSHAKE_TIMEOUT_MS * 2;
+var LISTENER_GLOBAL_LOCK_HEARTBEAT_MS = 5e3;
+function listenerStateFile(runtime) {
+  const profileKey = createHash("sha256").update(String(runtime.profileName || "default")).digest("hex").slice(0, 16);
+  return `${resolveConfigFile()}.login-listener.${profileKey}`;
+}
+function listenerStartLockDir(runtime) {
+  return `${listenerStateFile(runtime)}.lock`;
+}
+function listenerGlobalLockDir() {
+  return `${resolveConfigFile()}.oauth-listener-global.lock`;
+}
+function listenerGlobalLockOwnerFile(lockDir) {
+  return join2(lockDir, "owner.json");
+}
+function readListenerGlobalLockOwner(lockDir) {
+  try {
+    return JSON.parse(readFileSync2(listenerGlobalLockOwnerFile(lockDir), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeListenerGlobalLockOwner(lock) {
+  const current = readListenerGlobalLockOwner(lock.lockDir);
+  if (current && current.owner_token !== lock.ownerToken) return false;
+  writeFileSync2(listenerGlobalLockOwnerFile(lock.lockDir), JSON.stringify({
+    owner_token: lock.ownerToken,
+    owner_pid: process.pid,
+    updated_at: Date.now()
+  }), { mode: 384 });
+  return true;
+}
+function listenerGlobalLockIsStale(lockDir, staleMs) {
+  try {
+    return Date.now() - statSync2(listenerGlobalLockOwnerFile(lockDir)).mtimeMs > staleMs;
+  } catch {
+    try {
+      return Date.now() - statSync2(lockDir).mtimeMs > staleMs;
+    } catch {
+      return false;
+    }
+  }
+}
+function retireStaleListenerGlobalLock(lockDir) {
+  const retiredDir = `${lockDir}.stale-${process.pid}-${base64url(randomBytes(8))}`;
+  try {
+    renameSync2(lockDir, retiredDir);
+  } catch {
+    return false;
+  }
+  rmSync2(retiredDir, { recursive: true, force: true });
+  return true;
+}
+async function acquireListenerStartLock(runtime) {
+  const lockDir = listenerStartLockDir(runtime);
+  mkdirSync2(dirname2(lockDir), { recursive: true });
+  const deadline = Date.now() + LISTENER_START_LOCK_STALE_MS * 2;
+  for (; ; ) {
+    try {
+      mkdirSync2(lockDir);
+      return lockDir;
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      try {
+        if (Date.now() - statSync2(lockDir).mtimeMs > LISTENER_START_LOCK_STALE_MS) {
+          rmdirSync(lockDir);
+          continue;
+        }
+      } catch {
+      }
+      if (Date.now() >= deadline) {
+        throw oauthError(
+          "oauth_listener_lock_timeout",
+          "Timed out waiting for another CLI process to start browser authorization."
+        );
+      }
+      await new Promise((resolve3) => setTimeout(resolve3, 50));
+    }
+  }
+}
+function releaseListenerStartLock(lockDir) {
+  if (!lockDir) return;
+  try {
+    rmdirSync(lockDir);
+  } catch {
+  }
+}
+async function acquireListenerGlobalLock({
+  staleMs = LISTENER_START_LOCK_STALE_MS,
+  waitMs = LISTENER_START_LOCK_STALE_MS * 2,
+  heartbeatMs = LISTENER_GLOBAL_LOCK_HEARTBEAT_MS
+} = {}) {
+  const lockDir = listenerGlobalLockDir();
+  mkdirSync2(dirname2(lockDir), { recursive: true });
+  const deadline = Date.now() + waitMs;
+  for (; ; ) {
+    try {
+      mkdirSync2(lockDir);
+      const lock = {
+        lockDir,
+        ownerToken: base64url(randomBytes(24)),
+        heartbeat: null
+      };
+      writeListenerGlobalLockOwner(lock);
+      lock.heartbeat = setInterval(() => {
+        try {
+          writeListenerGlobalLockOwner(lock);
+        } catch {
+        }
+      }, heartbeatMs);
+      lock.heartbeat.unref?.();
+      return lock;
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      if (listenerGlobalLockIsStale(lockDir, staleMs) && retireStaleListenerGlobalLock(lockDir)) {
+        continue;
+      }
+      if (Date.now() >= deadline) {
+        throw oauthError(
+          "oauth_listener_global_lock_timeout",
+          "Timed out waiting for another CLI process to finish OAuth account changes."
+        );
+      }
+      await new Promise((resolve3) => setTimeout(resolve3, 50));
+    }
+  }
+}
+function releaseListenerGlobalLock(lock) {
+  if (!lock) return;
+  clearInterval(lock.heartbeat);
+  const owner = readListenerGlobalLockOwner(lock.lockDir);
+  if (owner?.owner_token !== lock.ownerToken) return;
+  const releasedDir = `${lock.lockDir}.released-${process.pid}-${lock.ownerToken}`;
+  try {
+    renameSync2(lock.lockDir, releasedDir);
+  } catch {
+    return;
+  }
+  const movedOwner = readListenerGlobalLockOwner(releasedDir);
+  if (movedOwner?.owner_token !== lock.ownerToken) {
+    try {
+      renameSync2(releasedDir, lock.lockDir);
+    } catch {
+    }
+    return;
+  }
+  rmSync2(releasedDir, { recursive: true, force: true });
+}
+async function revokeCancelledToken(metadata, tokenResponse, fetchImpl) {
+  const token = tokenResponse?.refresh_token || tokenResponse?.access_token;
+  if (!token || !metadata?.revocationEndpoint || !metadata?.clientId) return;
+  try {
+    await fetchJson(
+      metadata.revocationEndpoint,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token, client_id: metadata.clientId })
+      },
+      fetchImpl
+    );
+  } catch {
+  }
+}
+function updateRuntimeFromOAuthProfile(runtime, profile) {
+  const oauthApiBase = getOAuthApiBase(profile);
+  runtime.jwt = profile.oauth_access_token;
+  runtime.credentialKind = "oauth";
+  runtime.credentialSource = "oauth";
+  runtime.oauthAccessToken = profile.oauth_access_token;
+  runtime.oauthRefreshToken = profile.oauth_refresh_token;
+  runtime.oauthAccessExpiresAt = profile.oauth_access_expires_at;
+  runtime.oauthRefreshExpiresAt = profile.oauth_refresh_expires_at;
+  runtime.oauthClientId = profile.oauth_client_id;
+  runtime.oauthIssuer = profile.oauth_issuer;
+  runtime.oauthApiBase = oauthApiBase;
+  runtime.oauthResource = getOAuthResource(profile);
+  runtime.oauthScopes = profile.oauth_scopes || [];
+  runtime.oauthUserId = profile.oauth_user_id;
+  if (oauthApiBase && !runtime.requestedApiBase) {
+    runtime.apiBase = oauthApiBase;
+  }
+}
+function assertOAuthApiTarget(runtime, profile) {
+  const requestedApiBase = String(runtime.requestedApiBase || "").replace(/\/+$/, "");
+  const oauthApiBase = getOAuthApiBase(profile);
+  if (requestedApiBase && oauthApiBase && requestedApiBase !== oauthApiBase) {
+    throw oauthError(
+      "oauth_api_target_mismatch",
+      `This OAuth grant belongs to ${oauthApiBase}, not ${requestedApiBase}. Run login for the requested environment.`
+    );
+  }
+}
+async function ensureFreshOAuthCredential(runtime, fetchImpl = fetch) {
+  if (runtime.credentialKind !== "oauth") {
+    return Boolean(runtime.jwt);
+  }
+  const profile = getProfile(loadConfig(), runtime.profileName);
+  assertOAuthApiTarget(runtime, profile);
+  if (!credentialIsExpired({ credentialKind: "oauth" }, profile)) {
+    updateRuntimeFromOAuthProfile(runtime, profile);
+    return true;
+  }
+  return refreshOAuthCredential(runtime, fetchImpl);
+}
+function lockIsStale() {
+  try {
+    return Date.now() - statSync2(OAUTH_LOCK_DIR).mtimeMs > 45e3;
+  } catch {
+    return false;
+  }
+}
+async function acquireRefreshLock(runtime, waitMs = 6e4) {
+  mkdirSync2(join2(homedir2(), ".notis"), { recursive: true });
+  const deadline = Date.now() + waitMs;
+  for (; ; ) {
+    try {
+      mkdirSync2(OAUTH_LOCK_DIR);
+      return true;
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      const profile = getProfile(loadConfig(), runtime.profileName);
+      if (profile.oauth_access_token && profile.oauth_access_token !== runtime.oauthAccessToken && !credentialIsExpired({ credentialKind: "oauth" }, profile)) {
+        updateRuntimeFromOAuthProfile(runtime, profile);
+        return false;
+      }
+      if (lockIsStale()) {
+        try {
+          rmdirSync(OAUTH_LOCK_DIR);
+          continue;
+        } catch {
+        }
+      }
+      if (Date.now() >= deadline) {
+        throw oauthError("oauth_refresh_lock_timeout", "Timed out waiting for another CLI process to refresh OAuth.");
+      }
+      await new Promise((resolve3) => setTimeout(resolve3, 100));
+    }
+  }
+}
+async function refreshOAuthCredential(runtime, fetchImpl = fetch) {
+  const globalLock = await acquireListenerGlobalLock();
+  let profileLock = null;
+  let ownsLock = false;
+  let metadata = null;
+  let rotatedResponse = null;
+  let rotatedPersisted = false;
+  try {
+    profileLock = await acquireListenerStartLock(runtime);
+    ownsLock = await acquireRefreshLock(runtime);
+    if (!ownsLock) return true;
+    const config = loadConfig();
+    const profile = getProfile(config, runtime.profileName);
+    assertOAuthApiTarget(runtime, profile);
+    if (profile.oauth_access_token && profile.oauth_access_token !== runtime.oauthAccessToken && !credentialIsExpired({ credentialKind: "oauth" }, profile)) {
+      updateRuntimeFromOAuthProfile(runtime, profile);
+      return true;
+    }
+    if (!profile.oauth_refresh_token || !profile.oauth_client_id || !profile.oauth_issuer) {
+      return false;
+    }
+    metadata = storedOAuthMetadata(runtime, profile);
+    rotatedResponse = await fetchJson(
+      metadata.tokenEndpoint,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: profile.oauth_refresh_token,
+          client_id: profile.oauth_client_id,
+          resource: metadata.resource
+        })
+      },
+      fetchImpl
+    );
+    const updated = persistOAuthTokenResponse(runtime, metadata, rotatedResponse);
+    rotatedPersisted = true;
+    updateRuntimeFromOAuthProfile(runtime, updated);
+    return true;
+  } catch (error) {
+    if (rotatedResponse && !rotatedPersisted) {
+      await revokeCancelledToken(metadata, rotatedResponse, fetchImpl);
+    }
+    if (error instanceof CliError) {
+      throw new CliError({
+        code: error.code,
+        message: error.message,
+        exitCode: error.exitCode,
+        retryable: error.retryable,
+        details: error.details,
+        hints: getAuthRecovery(runtime).hints,
+        warnings: error.warnings,
+        cause: error
+      });
+    }
+    throw error;
+  } finally {
+    if (ownsLock) {
+      try {
+        rmdirSync(OAUTH_LOCK_DIR);
+      } catch {
+      }
+    }
+    releaseListenerStartLock(profileLock);
+    releaseListenerGlobalLock(globalLock);
+  }
+}
+
+// dist/skill-sync/index.js
+import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "crypto";
+import { execFile } from "child_process";
+import { promises as fs } from "fs";
+import os from "os";
+import path from "path";
+import { promisify } from "util";
+import { promises as fs2 } from "fs";
+import os2 from "os";
+import path2 from "path";
+var DEFAULT_AGENT_TARGETS = {
+  notis: true,
+  claude_code: true,
+  cursor: true,
+  codex: true
+};
+function normalizeAgentTargets(targets) {
+  return {
+    notis: Boolean(targets?.notis ?? DEFAULT_AGENT_TARGETS.notis),
+    claude_code: Boolean(targets?.claude_code ?? DEFAULT_AGENT_TARGETS.claude_code),
+    cursor: Boolean(targets?.cursor ?? DEFAULT_AGENT_TARGETS.cursor),
+    codex: Boolean(targets?.codex ?? DEFAULT_AGENT_TARGETS.codex)
+  };
+}
+var HOME_DIR = os.homedir();
+var execFileAsync = promisify(execFile);
+var AGENTS_DIR = path.join(HOME_DIR, ".agents");
+var LEGACY_AGENTS_SKILLS_DIR = path.join(AGENTS_DIR, "skills");
+var NOTIS_SKILL_SYNC_ROOT = path.join(HOME_DIR, ".notis", "skills");
+var LEGACY_NOTIS_SYNC_STATE_PATH = path.join(
+  AGENTS_DIR,
+  ".notis-sync.json"
+);
+var AGENTS_SKILLS_DIR = LEGACY_AGENTS_SKILLS_DIR;
+var SKILL_LOCK_PATH = path.join(AGENTS_DIR, ".skill-lock.json");
+var DEFAULT_SYNC_STATE = {
+  version: 1,
+  lastSyncedAt: null,
+  skills: {}
+};
+var EXCLUDED_TOP_LEVEL_ROOT_NAMES = /* @__PURE__ */ new Set([
+  "backup",
+  "backups",
+  "builtin",
+  "builtins",
+  "cache",
+  "caches",
+  "marketplace",
+  "marketplaces",
+  "plugin",
+  "plugins",
+  "temp",
+  "tmp",
+  "worktree",
+  "worktrees"
+]);
+var DEFAULT_SYNC_PATHS = {
+  agentsDir: AGENTS_DIR,
+  syncRoot: NOTIS_SKILL_SYNC_ROOT,
+  legacySkillsDir: LEGACY_AGENTS_SKILLS_DIR,
+  legacyScopedSkillsDir: LEGACY_AGENTS_SKILLS_DIR,
+  legacyScopedSyncStatePath: LEGACY_NOTIS_SYNC_STATE_PATH,
+  skillsDir: LEGACY_AGENTS_SKILLS_DIR,
+  syncStatePath: LEGACY_NOTIS_SYNC_STATE_PATH,
+  skillLockPath: SKILL_LOCK_PATH,
+  gatherMetadataPath: path.join(NOTIS_SKILL_SYNC_ROOT, "skill-gather-metadata.json")
+};
+function getDefaultSyncRootForAgentsDir(resolvedAgentsDir) {
+  if (resolvedAgentsDir === path.resolve(AGENTS_DIR)) {
+    return NOTIS_SKILL_SYNC_ROOT;
+  }
+  return path.join(resolvedAgentsDir, ".notis", "skills");
+}
+function isResolvedChildPath(baseDir, candidatePath) {
+  return candidatePath.startsWith(`${baseDir}${path.sep}`);
+}
+function sanitizePathSegment(value) {
+  const raw = value.trim();
+  const sanitized = raw.replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^_+|_+$/g, "");
+  if (!sanitized) {
+    throw new Error("Invalid sync user id");
+  }
+  if (sanitized === raw) {
+    return sanitized;
+  }
+  return `${sanitized}-${createHash3("sha256").update(raw).digest("hex").slice(0, 12)}`;
+}
+function getSkillSyncPathsForUser(authUserId, agentsDir = AGENTS_DIR) {
+  const safeUserId = sanitizePathSegment(authUserId);
+  const resolvedAgentsDir = path.resolve(agentsDir);
+  const syncRoot = getDefaultSyncRootForAgentsDir(resolvedAgentsDir);
+  const userRoot = path.join(syncRoot, "users", safeUserId);
+  const legacyUserRoot = path.join(resolvedAgentsDir, "notis", "users", safeUserId);
+  return {
+    agentsDir: resolvedAgentsDir,
+    syncRoot,
+    legacySkillsDir: path.join(resolvedAgentsDir, "skills"),
+    legacyScopedSkillsDir: path.join(legacyUserRoot, "skills"),
+    legacyScopedSyncStatePath: path.join(legacyUserRoot, ".notis-sync.json"),
+    skillsDir: path.join(userRoot, "skills"),
+    syncStatePath: path.join(userRoot, ".notis-sync.json"),
+    skillLockPath: path.join(resolvedAgentsDir, ".skill-lock.json"),
+    gatherMetadataPath: path.join(userRoot, ".notis-gathered-skills.json")
+  };
+}
+function assertRelativeBundlePath(relativePath) {
+  const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+  if (!normalized || normalized.startsWith("../") || `/${normalized}/`.includes("/../")) {
+    throw new Error(`Invalid bundle file path: ${relativePath}`);
+  }
+  return normalized;
+}
+function stripWrappingQuotes(value) {
+  return value.replace(/^['"]|['"]$/g, "").trim();
+}
+function parseFrontMatter(skillMd) {
+  const match = skillMd.match(/^---\s*\n([\s\S]*?)\n---\s*(?:\n|$)/);
+  if (!match) {
+    return { description: "" };
+  }
+  let description = "";
+  for (const line of match[1].split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const descriptionMatch = trimmed.match(/^description\s*:\s*(.+)$/i);
+    if (descriptionMatch) {
+      description = stripWrappingQuotes(descriptionMatch[1]);
+      break;
+    }
+  }
+  return { description };
+}
+async function readJsonFile2(filePath) {
+  try {
+    const raw = await fs.readFile(filePath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function listFilesRecursive(dirPath) {
+  const entries = await fs.readdir(dirPath, { withFileTypes: true });
+  const nested = await Promise.all(
+    entries.map(async (entry) => {
+      if (entry.name === ".DS_Store") {
+        return [];
+      }
+      const fullPath = path.join(dirPath, entry.name);
+      if (entry.isDirectory()) {
+        return listFilesRecursive(fullPath);
+      }
+      if (entry.isFile()) {
+        return [fullPath];
+      }
+      return [];
+    })
+  );
+  return nested.flat().sort();
+}
+async function computeFolderHash(dirPath) {
+  const hash = createHash3("sha256");
+  const filePaths = await listFilesRecursive(dirPath);
+  for (const filePath of filePaths) {
+    const relativePath = path.relative(dirPath, filePath);
+    hash.update(relativePath);
+    hash.update("\0");
+    hash.update(await fs.readFile(filePath));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function resolveSkillBundleFilePath(skillDir, relativePath) {
+  const normalizedPath = assertRelativeBundlePath(relativePath);
+  const resolvedSkillDir = path.resolve(skillDir);
+  const candidatePath = path.resolve(resolvedSkillDir, normalizedPath);
+  if (candidatePath === resolvedSkillDir || !isResolvedChildPath(resolvedSkillDir, candidatePath)) {
+    throw new Error(
+      `Bundle file resolves outside the expected directory: ${relativePath}`
+    );
+  }
+  return candidatePath;
+}
+async function readSkillMdIfValid(skillDir) {
+  try {
+    await fs.readFile(path.join(skillDir, "SKILL.md"), "utf8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function moveDirectory(sourceDir, destinationDir) {
+  await fs.mkdir(path.dirname(destinationDir), { recursive: true });
+  try {
+    await fs.rename(sourceDir, destinationDir);
+  } catch (error) {
+    if (error.code !== "EXDEV") {
+      throw error;
+    }
+    await fs.cp(sourceDir, destinationDir, {
+      recursive: true,
+      errorOnExist: true,
+      force: false
+    });
+    await fs.rm(sourceDir, { recursive: true, force: true });
+  }
+}
+async function createDirectorySymlink(targetDir, linkPath) {
+  await fs.mkdir(path.dirname(linkPath), { recursive: true });
+  await fs.symlink(path.relative(path.dirname(linkPath), targetDir), linkPath, "dir");
+}
+function backupRootFor(paths, timestamp) {
+  return path.join(paths.syncRoot, "skill-dedupe-backups", timestamp);
+}
+function relativeBackupPath(label, skillName) {
+  return path.join(
+    label.replace(/[^A-Za-z0-9_.-]+/g, "_"),
+    safeName(skillName)
+  );
+}
+function isExcludedTopLevelSkillEntry(entryName) {
+  return entryName.startsWith(".") || isTransientSkillDirectoryName(entryName) || EXCLUDED_TOP_LEVEL_ROOT_NAMES.has(entryName.toLowerCase());
+}
+function isTransientSkillDirectoryName(entryName) {
+  return /\.(?:backup|staging)-/.test(entryName);
+}
+function defaultTopLevelSkillSources(paths) {
+  const sources = [];
+  if (path.resolve(paths.legacyScopedSkillsDir) !== path.resolve(paths.skillsDir)) {
+    sources.push({
+      label: "notis-legacy-scoped",
+      root: paths.legacyScopedSkillsDir,
+      priority: 1
+    });
+  }
+  sources.push(
+    { label: "agents", root: paths.legacySkillsDir, priority: 2 },
+    {
+      label: "codex",
+      root: path.join(HOME_DIR, ".codex", "skills"),
+      priority: 3
+    },
+    {
+      label: "cursor",
+      root: path.join(HOME_DIR, ".cursor", "skills"),
+      priority: 4
+    },
+    {
+      label: "claude",
+      root: path.join(HOME_DIR, ".claude", "skills"),
+      priority: 5
+    }
+  );
+  return sources;
+}
+function isManagedTopLevelSymlinkTarget(resolvedPath, paths) {
+  const managedRoots = [
+    path.resolve(paths.skillsDir),
+    path.resolve(paths.legacySkillsDir),
+    path.resolve(paths.legacyScopedSkillsDir),
+    path.join(path.resolve(paths.syncRoot), "base"),
+    path.join(path.resolve(paths.syncRoot), "users"),
+    path.join(path.resolve(paths.agentsDir), "notis", "users")
+  ];
+  return managedRoots.some(
+    (root) => resolvedPath === root || resolvedPath.startsWith(`${root}${path.sep}`)
+  );
+}
+async function listTopLevelSkillCandidates(paths, options) {
+  const sourceRoots = options.sourceRoots ? options.sourceRoots.map((source, index) => ({
+    ...source,
+    priority: index + 1
+  })) : defaultTopLevelSkillSources(paths);
+  const candidates = [];
+  try {
+    const scopedEntries = await fs.readdir(paths.skillsDir, {
+      withFileTypes: true
+    });
+    for (const entry of scopedEntries) {
+      if (!entry.isDirectory() && !entry.isSymbolicLink() || entry.name.startsWith(".") || isTransientSkillDirectoryName(entry.name)) {
+        continue;
+      }
+      const skillDir = path.join(paths.skillsDir, entry.name);
+      let resolvedPath = path.resolve(skillDir);
+      if (entry.isSymbolicLink()) {
+        try {
+          resolvedPath = path.resolve(path.dirname(skillDir), await fs.readlink(skillDir));
+        } catch {
+          continue;
+        }
+      }
+      if (await readSkillMdIfValid(skillDir)) {
+        candidates.push({
+          name: safeName(entry.name, paths.skillsDir),
+          root: paths.skillsDir,
+          label: "notis-managed",
+          path: skillDir,
+          resolvedPath,
+          priority: 0,
+          isScoped: true,
+          isSymlink: entry.isSymbolicLink()
+        });
+      }
+    }
+  } catch {
+  }
+  for (const source of sourceRoots) {
+    let entries;
+    try {
+      entries = await fs.readdir(source.root, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (isExcludedTopLevelSkillEntry(entry.name) || !entry.isDirectory() && !entry.isSymbolicLink()) {
+        continue;
+      }
+      const candidatePath = path.join(source.root, entry.name);
+      let resolvedPath;
+      try {
+        resolvedPath = entry.isSymbolicLink() ? path.resolve(
+          path.dirname(candidatePath),
+          await fs.readlink(candidatePath)
+        ) : path.resolve(candidatePath);
+      } catch {
+        continue;
+      }
+      if (entry.isSymbolicLink() && isManagedTopLevelSymlinkTarget(resolvedPath, paths)) {
+        continue;
+      }
+      if (!await readSkillMdIfValid(resolvedPath)) {
+        continue;
+      }
+      candidates.push({
+        name: safeName(entry.name, paths.skillsDir),
+        root: source.root,
+        label: source.label,
+        path: candidatePath,
+        resolvedPath,
+        priority: source.priority,
+        isScoped: false,
+        isSymlink: entry.isSymbolicLink()
+      });
+    }
+  }
+  return candidates.sort(
+    (a, b) => a.priority - b.priority || a.name.localeCompare(b.name)
+  );
+}
+async function gatherTopLevelLocalSkills(paths, options = {}) {
+  await ensureCanonicalSkillsDir(paths);
+  const protectedSkillNames = options.protectedSkillNames || /* @__PURE__ */ new Set();
+  const timestamp = options.timestamp || (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const backupRoot = backupRootFor(paths, timestamp);
+  const candidates = await listTopLevelSkillCandidates(paths, options);
+  const byName = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) {
+    const existing = byName.get(candidate.name) || [];
+    existing.push(candidate);
+    byName.set(candidate.name, existing);
+  }
+  let gathered = 0;
+  let backedUp = 0;
+  let skipped = 0;
+  const metadata = {
+    version: 1,
+    gatheredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    skills: {}
+  };
+  for (const [skillName, skillCandidates] of byName) {
+    const protectedFromLocalGather = protectedSkillNames.has(skillName);
+    const canonical = protectedFromLocalGather ? skillCandidates.find((candidate) => candidate.isScoped) || null : skillCandidates[0];
+    const destinationName = safeName(skillName, paths.skillsDir);
+    const destinationDir = path.join(paths.skillsDir, destinationName);
+    const skippedSources = [];
+    if (!canonical) {
+      for (const candidate of skillCandidates) {
+        if (candidate.isSymlink) {
+          skipped += 1;
+          skippedSources.push(candidate.path);
+          continue;
+        }
+        const backupDir = path.join(
+          backupRoot,
+          relativeBackupPath(candidate.label, skillName)
+        );
+        try {
+          await moveDirectory(candidate.path, backupDir);
+          backedUp += 1;
+          skippedSources.push(candidate.path);
+        } catch {
+          skipped += 1;
+        }
+      }
+      metadata.skills[skillName] = {
+        canonicalPath: null,
+        skippedSources,
+        protectedFromLocalGather: true
+      };
+      continue;
+    }
+    if (!canonical.isScoped && !await pathExists(destinationDir)) {
+      try {
+        if (canonical.isSymlink) {
+          await createDirectorySymlink(canonical.resolvedPath, destinationDir);
+        } else {
+          await moveDirectory(canonical.path, destinationDir);
+        }
+        gathered += 1;
+      } catch {
+        skipped += 1;
+      }
+    }
+    for (const candidate of skillCandidates) {
+      if (candidate === canonical || candidate.isScoped) {
+        continue;
+      }
+      if (candidate.isSymlink) {
+        skippedSources.push(candidate.path);
+        continue;
+      }
+      const backupDir = path.join(
+        backupRoot,
+        relativeBackupPath(candidate.label, skillName)
+      );
+      try {
+        await moveDirectory(candidate.path, backupDir);
+        backedUp += 1;
+        skippedSources.push(candidate.path);
+      } catch {
+        skipped += 1;
+      }
+    }
+    metadata.skills[skillName] = {
+      canonicalPath: await pathExists(destinationDir) ? destinationDir : canonical.path,
+      skippedSources,
+      ...protectedFromLocalGather ? { protectedFromLocalGather: true } : {}
+    };
+  }
+  await fs.mkdir(path.dirname(paths.gatherMetadataPath), { recursive: true });
+  await fs.writeFile(
+    paths.gatherMetadataPath,
+    `${JSON.stringify(metadata, null, 2)}
+`,
+    "utf8"
+  );
+  return {
+    gathered,
+    backedUp,
+    skipped,
+    metadataPath: paths.gatherMetadataPath
+  };
+}
+async function readSkillLock(paths = DEFAULT_SYNC_PATHS) {
+  const lockData = await readJsonFile2(paths.skillLockPath);
+  const sourceUrls = {};
+  for (const [skillName, entry] of Object.entries(lockData?.skills || {})) {
+    if (typeof entry?.sourceUrl === "string" && entry.sourceUrl.trim()) {
+      sourceUrls[skillName] = entry.sourceUrl.trim();
+    }
+  }
+  return sourceUrls;
+}
+async function ensureCanonicalSkillsDir(paths = DEFAULT_SYNC_PATHS) {
+  await fs.mkdir(paths.skillsDir, { recursive: true });
+}
+async function scanLocalSkills(paths = DEFAULT_SYNC_PATHS) {
+  await ensureCanonicalSkillsDir(paths);
+  const sourceUrls = await readSkillLock(paths);
+  const entries = await fs.readdir(paths.skillsDir, { withFileTypes: true });
+  const skills = await Promise.all(
+    entries.map(async (entry) => {
+      if (!entry.isDirectory() && !entry.isSymbolicLink() || isTransientSkillDirectoryName(entry.name)) {
+        return null;
+      }
+      const skillDir = path.join(paths.skillsDir, entry.name);
+      const skillMdPath = path.join(skillDir, "SKILL.md");
+      try {
+        const skillMd = await fs.readFile(skillMdPath, "utf8");
+        const { description } = parseFrontMatter(skillMd);
+        const folderHash = await computeFolderHash(skillDir);
+        const skill = {
+          name: entry.name,
+          skillMd,
+          description,
+          folderHash,
+          directoryPath: skillDir
+        };
+        if (sourceUrls[entry.name]) {
+          skill.sourceUrl = sourceUrls[entry.name];
+        }
+        return skill;
+      } catch {
+        return null;
+      }
+    })
+  );
+  return skills.filter((skill) => skill !== null).sort((a, b) => a.name.localeCompare(b.name));
+}
+function normalizeSyncState(state) {
+  if (!state || state.version !== 1 || typeof state.skills !== "object") {
+    return null;
+  }
+  const normalizeStoredAgentTargets = (targets) => ({
+    notis: Boolean(targets?.notis ?? true),
+    claude_code: Boolean(targets?.claude_code ?? true),
+    cursor: Boolean(targets?.cursor ?? true),
+    codex: Boolean(targets?.codex ?? true)
+  });
+  return {
+    version: 1,
+    lastSyncedAt: typeof state.lastSyncedAt === "string" ? state.lastSyncedAt : null,
+    skills: Object.fromEntries(
+      Object.entries(state.skills || {}).map(([skillName, skillState]) => [
+        skillName,
+        {
+          ...skillState,
+          agentTargets: normalizeStoredAgentTargets(skillState.agentTargets)
+        }
+      ])
+    )
+  };
+}
+async function readSyncState(paths = DEFAULT_SYNC_PATHS) {
+  const scopedState = normalizeSyncState(
+    await readJsonFile2(paths.syncStatePath)
+  );
+  if (scopedState) {
+    return scopedState;
+  }
+  return DEFAULT_SYNC_STATE;
+}
+async function readLegacySyncState(paths = DEFAULT_SYNC_PATHS) {
+  const legacyStatePaths = [
+    paths.legacyScopedSyncStatePath,
+    path.resolve(paths.syncStatePath) === path.resolve(LEGACY_NOTIS_SYNC_STATE_PATH) ? paths.syncStatePath : path.join(paths.agentsDir, ".notis-sync.json")
+  ];
+  for (const legacyStatePath of legacyStatePaths) {
+    const state = normalizeSyncState(
+      await readJsonFile2(legacyStatePath)
+    );
+    if (state) {
+      return state;
+    }
+  }
+  return null;
+}
+async function writeSyncState(state, paths = DEFAULT_SYNC_PATHS) {
+  await fs.mkdir(path.dirname(paths.syncStatePath), { recursive: true });
+  await fs.writeFile(
+    paths.syncStatePath,
+    `${JSON.stringify(state, null, 2)}
+`,
+    "utf8"
+  );
+}
+function safeName(name, baseDir = AGENTS_SKILLS_DIR) {
+  const sanitizedName = name.trim().replace(/[\\/]+/g, "").replace(/\.\./g, "");
+  if (!sanitizedName) {
+    throw new Error("Invalid skill name");
+  }
+  const resolvedBaseDir = path.resolve(baseDir);
+  const resolvedPath = path.resolve(resolvedBaseDir, sanitizedName);
+  if (!isResolvedChildPath(resolvedBaseDir, resolvedPath)) {
+    throw new Error("Skill name resolves outside the expected directory");
+  }
+  return sanitizedName;
+}
+async function deleteLocalSkill(skillName, paths = DEFAULT_SYNC_PATHS) {
+  const skillDir = path.join(
+    paths.skillsDir,
+    safeName(skillName, paths.skillsDir)
+  );
+  try {
+    await fs.rm(skillDir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function createZipFromDirectory(directoryPath) {
+  const zipPath = path.join(
+    os.tmpdir(),
+    `notis-skill-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`
+  );
+  const parentDir = path.dirname(directoryPath);
+  const directoryName = path.basename(directoryPath);
+  if (process.platform === "win32") {
+    await execFileAsync("powershell.exe", [
+      "-NoProfile",
+      "-Command",
+      `Compress-Archive -Path '${directoryPath.replace(/'/g, "''")}' -DestinationPath '${zipPath.replace(/'/g, "''")}' -Force`
+    ]);
+    return zipPath;
+  }
+  await execFileAsync("zip", ["-qry", zipPath, directoryName], {
+    cwd: parentDir
+  });
+  return zipPath;
+}
+async function extractZipToDirectory(zipPath, destinationDir) {
+  const extractRoot = await fs.mkdtemp(
+    path.join(os.tmpdir(), "notis-skill-extract-")
+  );
+  try {
+    if (process.platform === "win32") {
+      await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-Command",
+        `Expand-Archive -Path '${zipPath.replace(/'/g, "''")}' -DestinationPath '${extractRoot.replace(/'/g, "''")}' -Force`
+      ]);
+    } else {
+      await execFileAsync("unzip", ["-qq", zipPath, "-d", extractRoot]);
+    }
+    const extractedEntries = await fs.readdir(extractRoot, {
+      withFileTypes: true
+    });
+    const extractedDirectory = extractedEntries.find(
+      (entry) => entry.isDirectory()
+    );
+    const sourceDir = extractedDirectory ? path.join(extractRoot, extractedDirectory.name) : extractRoot;
+    await fs.rm(destinationDir, { recursive: true, force: true });
+    await fs.mkdir(path.dirname(destinationDir), { recursive: true });
+    await fs.cp(sourceDir, destinationDir, { recursive: true });
+  } finally {
+    await fs.rm(extractRoot, { recursive: true, force: true });
+  }
+}
+async function pathExists(targetPath) {
+  try {
+    await fs.access(targetPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function replaceSkillDirectoryAtomically(skillDir, populateDir) {
+  const parentDir = path.dirname(skillDir);
+  const skillName = path.basename(skillDir);
+  await fs.mkdir(parentDir, { recursive: true });
+  const stagingDir = await fs.mkdtemp(
+    path.join(parentDir, `${skillName}.staging-`)
+  );
+  const backupDir = path.join(
+    parentDir,
+    `${skillName}.backup-${Date.now()}-${Math.random().toString(36).slice(2)}`
+  );
+  let movedExisting = false;
+  let promotedStaging = false;
+  let cleanupError = null;
+  try {
+    await populateDir(stagingDir);
+    if (await pathExists(skillDir)) {
+      await fs.rename(skillDir, backupDir);
+      movedExisting = true;
+    }
+    await fs.rename(stagingDir, skillDir);
+    promotedStaging = true;
+  } catch (error) {
+    if (movedExisting && !promotedStaging && await pathExists(backupDir)) {
+      await fs.rename(backupDir, skillDir);
+    }
+    throw error;
+  } finally {
+    if (!promotedStaging && await pathExists(stagingDir)) {
+      await fs.rm(stagingDir, { recursive: true, force: true });
+    }
+    if ((promotedStaging || !movedExisting) && await pathExists(backupDir)) {
+      try {
+        await fs.rm(backupDir, { recursive: true, force: true });
+      } catch (error) {
+        if (!cleanupError) {
+          cleanupError = error instanceof Error ? error : new Error(String(error));
+        }
+      }
+    }
+    if (cleanupError) {
+      console.warn(
+        `[Notis] Failed to clean up temporary skill directory backup for "${skillDir}"`,
+        cleanupError
+      );
+    }
+  }
+}
+function bundleFilesIncludeSkillMd(bundleFiles) {
+  return bundleFiles.some((bundleFile) => {
+    const basename2 = path.basename(bundleFile.path).toLowerCase();
+    return basename2 === "skill.md" || basename2 === "skills.md";
+  });
+}
+async function createSkillBundleBase64(skill) {
+  const zipPath = await createZipFromDirectory(skill.directoryPath);
+  try {
+    const zipBytes = await fs.readFile(zipPath);
+    return zipBytes.toString("base64");
+  } finally {
+    await fs.rm(zipPath, { force: true });
+  }
+}
+async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PATHS) {
+  const skillDir = path.join(
+    paths.skillsDir,
+    safeName(skill.name, paths.skillsDir)
+  );
+  if (bundleBytes?.length) {
+    const bundlePath = path.join(
+      os.tmpdir(),
+      `notis-skill-download-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`
+    );
+    try {
+      await fs.writeFile(bundlePath, bundleBytes);
+      await extractZipToDirectory(bundlePath, skillDir);
+      return true;
+    } finally {
+      await fs.rm(bundlePath, { force: true });
+    }
+  }
+  if (!skill.skill_md && (!skill.bundle_files || skill.bundle_files.length === 0)) {
+    return false;
+  }
+  if (skill.bundle_files && skill.bundle_files.length > 0) {
+    if (!bundleFilesIncludeSkillMd(skill.bundle_files)) {
+      throw new Error(
+        `Synced bundle for "${skill.name}" is missing SKILL.md or SKILLS.md`
+      );
+    }
+    await replaceSkillDirectoryAtomically(skillDir, async (stagingDir) => {
+      for (const bundleFile of skill.bundle_files || []) {
+        const filePath = resolveSkillBundleFilePath(
+          stagingDir,
+          bundleFile.path
+        );
+        await fs.mkdir(path.dirname(filePath), { recursive: true });
+        await fs.writeFile(
+          filePath,
+          Buffer.from(bundleFile.content_b64, "base64")
+        );
+      }
+    });
+    return true;
+  }
+  await replaceSkillDirectoryAtomically(skillDir, async (stagingDir) => {
+    await fs.writeFile(
+      path.join(stagingDir, "SKILL.md"),
+      skill.skill_md ?? "",
+      "utf8"
+    );
+  });
+  return true;
+}
+async function requestJson(url, jwt, options = {}) {
+  const response = await fetch(url, {
+    signal: AbortSignal.timeout(9e4),
+    method: options.method || "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${jwt}`
+    },
+    body: options.body ? JSON.stringify(options.body) : void 0
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`${options.method || "POST"} ${url} \u2192 ${response.status}: ${text}`);
+  }
+  return response.json();
+}
+async function fetchSyncSettings(serverUrl, jwt) {
+  return requestJson(`${serverUrl}/portal_skills/sync-settings`, jwt, {
+    body: {}
+  });
+}
+async function pullSkills(serverUrl, jwt) {
+  return requestJson(`${serverUrl}/portal_skills/sync-pull`, jwt, {
+    body: {}
+  });
+}
+async function pushChangedSkills(serverUrl, jwt, changedSkills) {
+  const payloadSkills = await Promise.all(changedSkills.map(async (skill) => ({
+    name: skill.name,
+    description: skill.description,
+    skill_md: skill.skillMd,
+    source_url: skill.sourceUrl,
+    folder_hash: skill.folderHash,
+    bundle_base64: await createSkillBundleBase64(skill)
+  })));
+  return requestJson(`${serverUrl}/portal_skills/sync-push`, jwt, {
+    body: {
+      skills: payloadSkills
+    }
+  });
+}
+async function downloadSkillBundle(bundleUrl) {
+  const response = await fetch(bundleUrl, { signal: AbortSignal.timeout(9e4) });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`GET ${bundleUrl} \u2192 ${response.status}: ${text}`);
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+async function updateAgentTargets(serverUrl, jwt, skillId, targets, expectedUpdatedAt) {
+  return requestJson(`${serverUrl}/portal_skills/agent-targets`, jwt, {
+    method: "PATCH",
+    body: {
+      skill_id: skillId,
+      agent_targets: targets,
+      ...expectedUpdatedAt ? { expected_updated_at: expectedUpdatedAt } : {}
+    }
+  });
+}
+var HOME_DIR2 = os2.homedir();
+var EXTERNAL_AGENT_SKILL_DIRS = {
+  claude_code: path2.join(HOME_DIR2, ".claude", "skills"),
+  cursor: path2.join(HOME_DIR2, ".cursor", "skills"),
+  codex: path2.join(HOME_DIR2, ".codex", "skills")
+};
+var EXTERNAL_AGENTS = Object.keys(EXTERNAL_AGENT_SKILL_DIRS);
+var AGENT_FAILURE_LABELS = {
+  claude_code: "Claude Code",
+  cursor: "Cursor",
+  codex: "Codex",
+  legacy: "legacy ~/.agents/skills"
+};
+function agentFailureLabel(agent) {
+  return AGENT_FAILURE_LABELS[agent] ?? agent;
+}
+function agentFolderFailureName(agent) {
+  return `${agentFailureLabel(agent)} skills folder`;
+}
+async function removeForeignAccountSymlinks(skillsDir, options = {}) {
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const currentRoot = path2.resolve(skillsDir);
+  const foreignCapableRoots = [
+    path2.join(path2.resolve(NOTIS_SKILL_SYNC_ROOT), "users"),
+    path2.join(path2.resolve(AGENTS_DIR), "notis", "users"),
+    path2.dirname(path2.dirname(currentRoot))
+  ];
+  let removed = 0;
+  const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
+  for (const agentDir of /* @__PURE__ */ new Set([...Object.values(agentSkillDirs), legacyGlobalSkillsDir])) {
+    let entries;
+    try {
+      entries = await fs2.readdir(agentDir, { withFileTypes: true });
+    } catch (error) {
+      if (error?.code === "ENOENT") continue;
+      throw error;
+    }
+    for (const entry of entries) {
+      if (!entry.isSymbolicLink()) continue;
+      const entryPath = path2.join(agentDir, entry.name);
+      try {
+        const target = await fs2.readlink(entryPath);
+        const resolvedTarget = path2.resolve(path2.dirname(entryPath), target);
+        const belongsToAnyAccount = foreignCapableRoots.some((root) => resolvedTarget.startsWith(`${root}${path2.sep}`));
+        const belongsToCurrentAccount = resolvedTarget === currentRoot || resolvedTarget.startsWith(`${currentRoot}${path2.sep}`);
+        if (belongsToAnyAccount && !belongsToCurrentAccount) {
+          await fs2.unlink(entryPath);
+          removed += 1;
+        }
+      } catch (error) {
+        if (error?.code !== "ENOENT") throw error;
+      }
+    }
+  }
+  return removed;
+}
+function managedSkillRoots(skillsDir, legacyGlobalSkillsDir = LEGACY_AGENTS_SKILLS_DIR) {
+  const resolvedSkillsDir = path2.resolve(skillsDir);
+  const scopedUsersRoot = path2.dirname(path2.dirname(resolvedSkillsDir));
+  const roots = [
+    resolvedSkillsDir,
+    path2.resolve(legacyGlobalSkillsDir),
+    path2.join(path2.resolve(NOTIS_SKILL_SYNC_ROOT), "users"),
+    path2.join(path2.resolve(AGENTS_DIR), "notis", "users")
+  ];
+  if (path2.basename(scopedUsersRoot) === "users") {
+    roots.push(scopedUsersRoot);
+  }
+  return roots;
+}
+async function isManagedSymlink(linkPath, managedRoots) {
+  try {
+    const stats = await fs2.lstat(linkPath);
+    if (!stats.isSymbolicLink()) {
+      return false;
+    }
+    const target = await fs2.readlink(linkPath);
+    const resolvedTarget = path2.resolve(path2.dirname(linkPath), target);
+    return managedRoots.some((root) => resolvedTarget === root || resolvedTarget.startsWith(`${root}${path2.sep}`));
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
+async function ensureCorrectSymlink(linkPath, targetPath) {
+  try {
+    const stats = await fs2.lstat(linkPath);
+    if (stats.isSymbolicLink()) {
+      const currentTarget = await fs2.readlink(linkPath);
+      const resolvedTarget = path2.resolve(path2.dirname(linkPath), currentTarget);
+      if (resolvedTarget === targetPath) {
+        return "skipped";
+      }
+      await fs2.unlink(linkPath);
+    } else {
+      return "blocked";
+    }
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+  const relativePath = path2.relative(path2.dirname(linkPath), targetPath);
+  await fs2.symlink(relativePath, linkPath);
+  return "linked";
+}
+function defaultAgentSkillDirs(skillsDir) {
+  return {
+    notis: skillsDir,
+    ...EXTERNAL_AGENT_SKILL_DIRS
+  };
+}
+async function removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots, failures, agent) {
+  let removed = 0;
+  try {
+    await fs2.mkdir(agentDir, { recursive: true });
+    const existingEntries = await fs2.readdir(agentDir, { withFileTypes: true });
+    for (const entry of existingEntries) {
+      const entryPath = path2.join(agentDir, entry.name);
+      try {
+        if (!desiredSkills.has(entry.name) && await isManagedSymlink(entryPath, managedRoots)) {
+          await fs2.unlink(entryPath);
+          removed += 1;
+        }
+      } catch (error) {
+        if (error?.code !== "ENOENT") {
+          failures.push({ name: entry.name, error: `${agentFailureLabel(agent)}: could not remove skill link (${error.message})` });
+        }
+      }
+    }
+  } catch (error) {
+    failures.push({ name: agentFolderFailureName(agent), error: `Could not read agent skills directory (${error.message})` });
+  }
+  return removed;
+}
+async function removeAllSymlinksForSkill(skillName, skillsDir = LEGACY_AGENTS_SKILLS_DIR, options = {}) {
+  let removed = 0;
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
+  const managedRoots = managedSkillRoots(skillsDir, legacyGlobalSkillsDir);
+  const agentDirs = /* @__PURE__ */ new Set([...Object.values(agentSkillDirs), legacyGlobalSkillsDir]);
+  const expectedTarget = path2.resolve(skillsDir, safeName(skillName, skillsDir));
+  for (const agentDir of agentDirs) {
+    const linkPath = path2.join(agentDir, safeName(skillName, agentDir));
+    const owned = options.ownership === "exact-skill-dir" ? await isManagedSymlink(linkPath, [expectedTarget]) : await isManagedSymlink(linkPath, managedRoots);
+    if (owned) {
+      await fs2.unlink(linkPath);
+      removed += 1;
+    }
+  }
+  return removed;
+}
+async function detectDeletedAgentSymlinks(cloudSkills, previousState, skillsDir = LEGACY_AGENTS_SKILLS_DIR, options = {}) {
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const deletions = [];
+  for (const agent of EXTERNAL_AGENTS) {
+    const agentDir = agentSkillDirs[agent];
+    if (path2.resolve(agentDir) === path2.resolve(skillsDir)) {
+      continue;
+    }
+    try {
+      const dirStat = await fs2.stat(agentDir);
+      if (!dirStat.isDirectory()) {
+        continue;
+      }
+    } catch {
+      continue;
+    }
+    for (const skill of cloudSkills) {
+      if (skill.status !== "active") {
+        continue;
+      }
+      if (!skill.id || skill.id.startsWith("local-")) {
+        continue;
+      }
+      const previous = previousState.skills[skill.name];
+      if (!previous || previous.cloudId !== skill.id || previous.verifiedAgentLinks?.[agent] !== true || !skill.updated_at || previous.cloudUpdatedAt !== skill.updated_at) {
+        continue;
+      }
+      const cloudTargets = normalizeAgentTargets(skill.agent_targets);
+      const previousTargets = normalizeAgentTargets(previous.agentTargets);
+      if (!cloudTargets[agent] || !previousTargets[agent]) {
+        continue;
+      }
+      let safeSkillName;
+      try {
+        safeSkillName = safeName(skill.name, skillsDir);
+      } catch {
+        continue;
+      }
+      const linkPath = path2.join(agentDir, safeName(safeSkillName, agentDir));
+      try {
+        await fs2.lstat(linkPath);
+      } catch (error) {
+        if (error?.code === "ENOENT") {
+          deletions.push({ skillId: skill.id, skillName: skill.name, agent });
+        }
+      }
+    }
+  }
+  return deletions;
+}
+async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, options = {}) {
+  await fs2.mkdir(skillsDir, { recursive: true });
+  const result = {
+    linked: 0,
+    removed: 0,
+    skipped: 0,
+    verifiedAgentLinks: {},
+    failures: []
+  };
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
+  const managedRoots = managedSkillRoots(skillsDir, legacyGlobalSkillsDir);
+  const desiredByAgent = {
+    notis: /* @__PURE__ */ new Set(),
+    claude_code: /* @__PURE__ */ new Set(),
+    cursor: /* @__PURE__ */ new Set(),
+    codex: /* @__PURE__ */ new Set()
+  };
+  for (const skill of skills) {
+    if (skill.status !== "active") {
+      continue;
+    }
+    const safeSkillName = safeName(skill.name, skillsDir);
+    const targets = normalizeAgentTargets(skill.agent_targets);
+    if (targets.notis) {
+      desiredByAgent.notis.add(safeSkillName);
+    }
+    if (targets.claude_code) {
+      desiredByAgent.claude_code.add(safeSkillName);
+    }
+    if (targets.cursor) {
+      desiredByAgent.cursor.add(safeSkillName);
+    }
+    if (targets.codex) {
+      desiredByAgent.codex.add(safeSkillName);
+    }
+  }
+  for (const [agent, agentDir] of Object.entries(agentSkillDirs)) {
+    if (path2.resolve(agentDir) === path2.resolve(skillsDir)) {
+      result.skipped += desiredByAgent[agent].size;
+      continue;
+    }
+    try {
+      await fs2.mkdir(agentDir, { recursive: true });
+    } catch (error) {
+      result.failures.push({ name: agentFolderFailureName(agent), error: `Could not create agent skills directory (${error.message})` });
+      continue;
+    }
+    const desiredSkills = desiredByAgent[agent];
+    if (options.removeUndesired !== false) {
+      result.removed += await removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots, result.failures, agent);
+    }
+    for (const skillName of desiredSkills) {
+      const targetPath = path2.join(skillsDir, skillName);
+      const linkPath = path2.join(agentDir, safeName(skillName, agentDir));
+      try {
+        if (!(await fs2.stat(path2.join(targetPath, "SKILL.md"))).isFile()) throw new Error("Missing SKILL.md");
+      } catch {
+        result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: SKILL.md is missing or unreadable` });
+        continue;
+      }
+      let syncOutcome;
+      try {
+        syncOutcome = await ensureCorrectSymlink(linkPath, targetPath);
+      } catch (error) {
+        result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: could not create skill link (${error.message})` });
+        continue;
+      }
+      if (syncOutcome === "linked") {
+        result.linked += 1;
+      } else if (syncOutcome === "blocked") {
+        console.warn(
+          `[skill-sync] Could not link "${skillName}" for ${agent}: non-symlink entry blocks ${linkPath}`
+        );
+        result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: an existing file or folder blocks the skill link` });
+      } else {
+        result.skipped += 1;
+      }
+      if (syncOutcome !== "blocked") {
+        result.verifiedAgentLinks[skillName] = { ...result.verifiedAgentLinks[skillName], [agent]: true };
+      }
+    }
+  }
+  if (options.removeUndesired !== false && !Object.values(agentSkillDirs).some(
+    (agentDir) => path2.resolve(agentDir) === path2.resolve(legacyGlobalSkillsDir)
+  )) {
+    result.removed += await removeUndesiredManagedSymlinks(
+      legacyGlobalSkillsDir,
+      /* @__PURE__ */ new Set(),
+      managedRoots,
+      result.failures,
+      "legacy"
+    );
+  }
+  return result;
+}
+function getPushCandidates(localSkills, syncState, cloudCuratedSkillNames = /* @__PURE__ */ new Set(), cloudSkillNames) {
+  return localSkills.filter((skill) => {
+    if (cloudCuratedSkillNames.has(skill.name)) {
+      return false;
+    }
+    const previous = syncState.skills[skill.name];
+    if (!previous) {
+      return true;
+    }
+    if (cloudSkillNames && !cloudSkillNames.has(skill.name)) {
+      return false;
+    }
+    return previous.folderHash !== skill.folderHash;
+  });
+}
+async function writeCloudSkillWithBundleFallback(skill, dependencies) {
+  if (skill.skill_source_url) {
+    try {
+      const bundleBytes = await dependencies.downloadSkillBundle(skill.skill_source_url);
+      const wroteBundleToDisk = await dependencies.writeCloudSkillToDisk(skill, bundleBytes);
+      if (wroteBundleToDisk) {
+        return true;
+      }
+      dependencies.onWarning?.(
+        `Bundle sync for "${skill.name}" produced no local changes, falling back to SKILL.md payload.`,
+        new Error("Bundle write returned false")
+      );
+    } catch (error) {
+      dependencies.onWarning?.(
+        `Failed to apply bundle sync for "${skill.name}", falling back to SKILL.md payload.`,
+        error
+      );
+    }
+  }
+  if (skill.bundle_hydration_failed) {
+    dependencies.onWarning?.(
+      `Skipping markdown fallback for synced skill "${skill.name}" because its stored bundle could not be hydrated by the server.`,
+      new Error("Bundle hydration failed")
+    );
+    return false;
+  }
+  try {
+    return await dependencies.writeCloudSkillToDisk(skill);
+  } catch (error) {
+    dependencies.onWarning?.(
+      `Failed to write synced skill "${skill.name}" to disk.`,
+      error
+    );
+    return false;
+  }
+}
+var BASE_SKILL_NAMES = /* @__PURE__ */ new Set(["notis-apps", "notis-query", "notis-cli"]);
+function withoutBaseSkills(pullResponse) {
+  return {
+    ...pullResponse,
+    skills: pullResponse.skills.filter((skill) => !BASE_SKILL_NAMES.has(skill.name))
+  };
+}
+function withoutBaseSkillState(state) {
+  return {
+    ...state,
+    skills: Object.fromEntries(
+      Object.entries(state.skills).filter(([name]) => !BASE_SKILL_NAMES.has(name))
+    )
+  };
+}
+var DEFAULT_RUN_SKILL_SYNC_DEPS = {
+  fetchSyncSettings,
+  pullSkills,
+  pushChangedSkills,
+  downloadSkillBundle,
+  gatherTopLevelLocalSkills,
+  readLegacySyncState,
+  readSyncState,
+  scanLocalSkills,
+  deleteLocalSkill,
+  writeCloudSkillToDisk,
+  writeSyncState,
+  removeAllSymlinksForSkill,
+  syncSymlinks,
+  detectDeletedAgentSymlinks,
+  removeForeignAccountSymlinks,
+  updateAgentTargets
+};
+function toSkillMap(skills) {
+  return new Map(skills.map((skill) => [skill.name, skill]));
+}
+function decodeJwtSubject(jwt) {
+  try {
+    const parts = jwt.split(".");
+    if (parts.length !== 3) return null;
+    const decoded = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString()
+    );
+    return typeof decoded.sub === "string" && decoded.sub.trim() ? decoded.sub.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function cloudContentHash(skill) {
+  return createHash2("sha256").update(JSON.stringify({
+    md: skill.skill_md,
+    hash: skill.skill_folder_hash,
+    source: skill.skill_source_url,
+    files: skill.bundle_files?.slice().sort((a, b) => a.path.localeCompare(b.path)),
+    hydrationFailed: skill.bundle_hydration_failed === true
+  })).digest("hex");
+}
+function shouldWriteCloudSkill(cloudSkill, localSkills, previousState) {
+  const skillName = cloudSkill.name;
+  const cloudHash = cloudSkill.skill_folder_hash || "";
+  const localSkill = localSkills.get(skillName);
+  if (!localSkill) {
+    return true;
+  }
+  const previous = previousState.skills[skillName];
+  if (previous?.folderHash === localSkill.folderHash && previous.cloudContentHash === cloudContentHash(cloudSkill)) return false;
+  if (cloudSkill.source === "curated") {
+    return cloudHash ? cloudHash !== localSkill.folderHash : true;
+  }
+  const localChangedSinceLastSync = !previous || previous.folderHash !== localSkill.folderHash;
+  return !localChangedSinceLastSync && (Boolean(cloudHash) && cloudHash !== localSkill.folderHash || Boolean(previous?.cloudContentHash && previous.cloudContentHash !== cloudContentHash(cloudSkill)));
+}
+function buildSyncState(pullResponse, localSkills, lastSyncedAt, verifiedAgentLinks = {}, failedContentNames = /* @__PURE__ */ new Set()) {
+  const localSkillMap = toSkillMap(localSkills);
+  const skills = Object.fromEntries(
+    pullResponse.skills.map((skill) => {
+      const localSkill = localSkillMap.get(skill.name);
+      return [
+        skill.name,
+        {
+          cloudId: skill.id,
+          folderHash: localSkill?.folderHash || skill.skill_folder_hash || "",
+          agentTargets: normalizeAgentTargets(skill.agent_targets),
+          verifiedAgentLinks: skill.status === "active" ? verifiedAgentLinks[skill.name] ?? {} : {},
+          cloudUpdatedAt: skill.updated_at,
+          ...!failedContentNames.has(skill.name) && !skill.skill_source_url ? { cloudContentHash: cloudContentHash(skill) } : {},
+          syncedAt: lastSyncedAt || (/* @__PURE__ */ new Date()).toISOString()
+        }
+      ];
+    })
+  );
+  return {
+    version: 1,
+    lastSyncedAt,
+    skills
+  };
+}
+function buildLocalSymlinkCandidates(pullResponse, localSkills, previousState) {
+  const cloudSkillNames = new Set(
+    pullResponse.skills.map((skill) => skill.name)
+  );
+  const localOnlySkills = localSkills.filter((skill) => !cloudSkillNames.has(skill.name)).map((skill) => {
+    const previous = previousState.skills[skill.name];
+    return {
+      id: previous?.cloudId || `local-${skill.name}`,
+      name: skill.name,
+      description: skill.description || null,
+      skill_md: skill.skillMd,
+      agent_targets: previous?.agentTargets,
+      skill_folder_hash: skill.folderHash,
+      source: "local",
+      status: "active"
+    };
+  });
+  return [...pullResponse.skills, ...localOnlySkills];
+}
+function isEmptySyncState(state) {
+  return state.lastSyncedAt === null && Object.keys(state.skills).length === 0;
+}
+function applyLegacyFirstRunState(localSkills, scopedState, legacyState) {
+  if (!isEmptySyncState(scopedState) || !legacyState) {
+    return scopedState;
+  }
+  const migratedSkills = Object.fromEntries(
+    localSkills.flatMap((skill) => {
+      const previous = legacyState.skills[skill.name];
+      if (!previous || previous.folderHash !== skill.folderHash) {
+        return [];
+      }
+      return [[skill.name, previous]];
+    })
+  );
+  if (Object.keys(migratedSkills).length === 0) {
+    return scopedState;
+  }
+  return {
+    version: 1,
+    lastSyncedAt: legacyState.lastSyncedAt,
+    skills: migratedSkills
+  };
+}
+async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previousState, syncPaths, deps, failures = [], writtenSkillNames = /* @__PURE__ */ new Set()) {
+  const localSkillMap = toSkillMap(localSkills);
+  const warnSkillSync = (message, error) => {
+    console.warn(`[Notis] ${message}`, error);
+  };
+  let downloaded = 0;
+  for (const cloudSkill of pullResponse.skills) {
+    if (!shouldWriteCloudSkill(cloudSkill, localSkillMap, previousState)) {
+      continue;
+    }
+    if (await writeCloudSkillWithBundleFallback(cloudSkill, {
+      downloadSkillBundle: deps.downloadSkillBundle,
+      writeCloudSkillToDisk: (skill, bundleBytes) => deps.writeCloudSkillToDisk(skill, bundleBytes, syncPaths),
+      onWarning: warnSkillSync
+    })) {
+      downloaded += 1;
+      writtenSkillNames.add(cloudSkill.name);
+    } else {
+      failures.push({ name: cloudSkill.name, error: "Skill content could not be downloaded or written; sync will retry" });
+    }
+  }
+  return downloaded;
+}
+function assertSkillsPullAuthorized(pullResponse) {
+  if (pullResponse.entitlement_access?.code === "entitlement_upgrade_required" && pullResponse.entitlement_access.entitlement === "skills") {
+    throw new Error(
+      "Skill sync access was denied; preserving existing local skills."
+    );
+  }
+}
+async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previousState, scopedState, skillsDir, deps, failures) {
+  if (isEmptySyncState(scopedState)) {
+    return 0;
+  }
+  const deletions = await deps.detectDeletedAgentSymlinks(
+    pullResponse.skills,
+    previousState,
+    skillsDir
+  );
+  if (deletions.length === 0) {
+    return 0;
+  }
+  const agentsBySkill = /* @__PURE__ */ new Map();
+  for (const deletion of deletions) {
+    const entry = agentsBySkill.get(deletion.skillId) ?? {
+      skillName: deletion.skillName,
+      agents: /* @__PURE__ */ new Set()
+    };
+    entry.agents.add(deletion.agent);
+    agentsBySkill.set(deletion.skillId, entry);
+  }
+  const fresh = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+  assertSkillsPullAuthorized(fresh);
+  Object.assign(pullResponse, fresh);
+  let needsRefresh = false;
+  let deactivated = 0;
+  for (const [skillId, { skillName, agents }] of agentsBySkill) {
+    const skill = pullResponse.skills.find((item) => item.id === skillId);
+    const previous = previousState.skills[skillName];
+    if (!skill?.updated_at || previous?.cloudUpdatedAt !== skill.updated_at) continue;
+    const patch = Object.fromEntries([...agents].map((agent) => [agent, false]));
+    try {
+      const saved = await deps.updateAgentTargets(serverUrl, jwt, skillId, patch, skill.updated_at);
+      if (saved.success !== true || !saved.updated_at?.trim() || saved.updated_at === skill.updated_at || !["notis", "claude_code", "cursor", "codex"].every((agent) => typeof saved.agent_targets?.[agent] === "boolean") || ![...agents].every((agent) => saved.agent_targets[agent] === false)) {
+        throw new Error("Assignment update did not return a verified saved revision");
+      }
+      skill.agent_targets = saved.agent_targets;
+      skill.updated_at = saved.updated_at;
+      deactivated += agents.size;
+    } catch (error) {
+      needsRefresh = true;
+      failures.push({ name: skillName, error: "Could not save the local agent removal; refreshed saved assignments" });
+      console.warn(`[skill-sync] Assignment changed or could not be saved for "${skillName}"; refreshing before reconciliation.`, error);
+    }
+  }
+  if (needsRefresh) {
+    const refreshed = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+    assertSkillsPullAuthorized(refreshed);
+    Object.assign(pullResponse, refreshed);
+  }
+  return deactivated;
+}
+async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
+  const deps = {
+    ...DEFAULT_RUN_SKILL_SYNC_DEPS,
+    ...dependencies
+  };
+  const syncSettings = await deps.fetchSyncSettings(
+    serverUrl,
+    jwt
+  );
+  const syncUserId = syncSettings.user_id?.trim() || decodeJwtSubject(jwt);
+  if (!syncUserId) {
+    throw new Error(
+      "Cannot sync skills without a server-verified account identity."
+    );
+  }
+  const syncPaths = getSkillSyncPathsForUser(syncUserId);
+  const foreignLinksRemoved = await deps.removeForeignAccountSymlinks(
+    syncPaths.skillsDir
+  );
+  if (options.honorSyncEnabled !== false && !syncSettings.sync_enabled) {
+    return {
+      syncEnabled: false,
+      pushed: 0,
+      pulled: 0,
+      downloaded: 0,
+      deleted: 0,
+      deactivated: 0,
+      linked: 0,
+      removed: foreignLinksRemoved,
+      skipped: 0,
+      lastSyncedAt: syncSettings.last_synced_at,
+      failedPushes: []
+    };
+  }
+  let pullResponse = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+  assertSkillsPullAuthorized(pullResponse);
+  const cloudCuratedSkillNames = new Set(
+    pullResponse.skills.filter((skill) => skill.source === "curated").map((skill) => skill.name)
+  );
+  const protectedSkillNames = /* @__PURE__ */ new Set([...cloudCuratedSkillNames, ...BASE_SKILL_NAMES]);
+  const scopedState = withoutBaseSkillState(await deps.readSyncState(syncPaths));
+  const assignmentFailures = [];
+  const deactivated = syncSettings.agent_targets_conditional_updates === true ? await deactivateDeletedAgentSkills(
+    serverUrl,
+    jwt,
+    pullResponse,
+    scopedState,
+    scopedState,
+    syncPaths.skillsDir,
+    deps,
+    assignmentFailures
+  ) : 0;
+  const authUserId = decodeJwtSubject(jwt);
+  let previousAuthState = null;
+  if (authUserId && authUserId !== syncUserId) {
+    const previousAuthPaths = getSkillSyncPathsForUser(authUserId);
+    previousAuthState = await deps.readSyncState(previousAuthPaths);
+    await deps.gatherTopLevelLocalSkills(syncPaths, {
+      sourceRoots: [{ label: "previous-auth-scope", root: previousAuthPaths.skillsDir }],
+      protectedSkillNames
+    });
+  }
+  await deps.gatherTopLevelLocalSkills(syncPaths, {
+    protectedSkillNames
+  });
+  const localSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
+  const previousState = withoutBaseSkillState(applyLegacyFirstRunState(
+    localSkills,
+    scopedState,
+    isEmptySyncState(scopedState) ? !previousAuthState || isEmptySyncState(previousAuthState) ? await deps.readLegacySyncState(syncPaths) : previousAuthState : null
+  ));
+  const gatheredSymlinkResult = await deps.syncSymlinks(
+    buildLocalSymlinkCandidates(pullResponse, localSkills, previousState),
+    syncPaths.skillsDir
+  );
+  const pushCandidates = getPushCandidates(
+    localSkills,
+    previousState,
+    cloudCuratedSkillNames,
+    new Set(pullResponse.skills.map((skill) => skill.name))
+  );
+  const failedPushes = [];
+  if (pushCandidates.length > 0) {
+    const pushResult = await deps.pushChangedSkills(serverUrl, jwt, pushCandidates);
+    if (Array.isArray(pushResult?.failed) && pushResult.failed.length > 0) {
+      failedPushes.push(...pushResult.failed);
+      console.warn(
+        `[skill-sync] ${pushResult.failed.length} skill(s) were rejected during push: ` + pushResult.failed.map((f) => `${f.name} (${f.error})`).join("; ")
+      );
+    }
+    pullResponse = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+    assertSkillsPullAuthorized(pullResponse);
+  }
+  const cloudSkillNames = new Set(pullResponse.skills.map((s) => s.name));
+  let deleted = 0;
+  for (const skillName of Object.keys(previousState.skills)) {
+    if (!cloudSkillNames.has(skillName)) {
+      await deps.deleteLocalSkill(skillName, syncPaths);
+      await deps.removeAllSymlinksForSkill(skillName, syncPaths.skillsDir);
+      deleted += 1;
+    }
+  }
+  const failedDownloads = [];
+  const downloaded = await writePulledSkillsToScopedMirror(
+    pullResponse,
+    localSkills,
+    previousState,
+    syncPaths,
+    deps,
+    failedDownloads
+  );
+  const finalLocalSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
+  const symlinkResult = await deps.syncSymlinks(
+    buildLocalSymlinkCandidates(pullResponse, finalLocalSkills, previousState),
+    syncPaths.skillsDir
+  );
+  const verifiedLinks = { ...symlinkResult.verifiedAgentLinks ?? {} };
+  for (const failure of failedDownloads) delete verifiedLinks[failure.name];
+  const lastSyncedAt = pullResponse.last_synced_at || (/* @__PURE__ */ new Date()).toISOString();
+  await deps.writeSyncState(
+    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt, verifiedLinks, new Set(failedDownloads.map((item) => item.name))),
+    syncPaths
+  );
+  return {
+    syncEnabled: true,
+    pushed: pushCandidates.length,
+    pulled: pullResponse.skills.length,
+    downloaded,
+    deleted,
+    deactivated,
+    linked: gatheredSymlinkResult.linked + symlinkResult.linked,
+    removed: foreignLinksRemoved + gatheredSymlinkResult.removed + symlinkResult.removed,
+    skipped: symlinkResult.skipped,
+    failedLinks: [...assignmentFailures, ...failedDownloads, ...(symlinkResult.failures ?? []).filter(
+      (failure) => !failedDownloads.some((download) => download.name === failure.name)
+    )],
+    lastSyncedAt,
+    failedPushes
+  };
+}
+
+// src/runtime/sync-skills.js
+import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
+import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname4, join as join4 } from "node:path";
+
+// src/runtime/base-skills.js
+import { dirname as dirname3, join as join3, relative, resolve as resolve2 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var BASE_SKILL_NAMES2 = Object.freeze([
+  "notis-apps",
+  "notis-query",
+  "notis-cli"
+]);
+var HERE = dirname3(fileURLToPath2(import.meta.url));
+
+// src/runtime/sync-skills.js
+var DEFAULT_LOCK_TIMEOUT_MS = 3e4;
+var DEFAULT_LOCK_STALE_MS = 10 * 6e4;
+var DEFAULT_LOCK_POLL_MS = 50;
+async function lockSnapshot(lockDirectory) {
+  try {
+    const [raw, metadata] = await Promise.all([
+      readFile(join4(lockDirectory, "owner"), "utf8").catch(() => ""),
+      stat(lockDirectory)
+    ]);
+    let owner = {};
+    try {
+      owner = raw ? JSON.parse(raw) : {};
+    } catch {
+    }
+    return {
+      id: typeof owner.id === "string" ? owner.id : null,
+      pid: Number.isInteger(Number(owner.pid)) ? Number(owner.pid) : null,
+      at: Number.isFinite(Number(owner.at)) ? Number(owner.at) : metadata.mtimeMs,
+      mtimeMs: metadata.mtimeMs
+    };
+  } catch {
+    return null;
+  }
+}
+function sameLockSnapshot(left, right) {
+  return Boolean(
+    left && right && left.id === right.id && left.pid === right.pid && left.at === right.at && left.mtimeMs === right.mtimeMs
+  );
+}
+function processIsAlive2(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === "EPERM";
+  }
+}
+function delay(milliseconds) {
+  return new Promise((resolve3) => setTimeout(resolve3, milliseconds));
+}
+async function quarantineStaleLock(lockDirectory, snapshot) {
+  const quarantineRoot = join4(dirname4(lockDirectory), ".stale-operation-locks");
+  const snapshotToken = createHash4("sha256").update(JSON.stringify(snapshot)).digest("hex");
+  await mkdir(quarantineRoot, { recursive: true, mode: 448 });
+  try {
+    await rename(lockDirectory, join4(quarantineRoot, snapshotToken));
+    return true;
+  } catch (error) {
+    if (["EEXIST", "ENOTEMPTY", "ENOENT"].includes(error?.code)) return false;
+    throw error;
+  }
+}
+async function writeLockOwnerAtomically(lockDirectory, owner) {
+  const temporaryOwnerPath = join4(lockDirectory, `.owner.${owner.id}.tmp`);
+  const ownerPath = join4(lockDirectory, "owner");
+  await writeFile(temporaryOwnerPath, JSON.stringify(owner), { mode: 384 });
+  await rename(temporaryOwnerPath, ownerPath);
+}
+async function releaseOwnedLock(lockDirectory, ownerId) {
+  const owner = await lockSnapshot(lockDirectory);
+  if (owner?.id !== ownerId) return;
+  const quarantineRoot = join4(dirname4(lockDirectory), ".stale-operation-locks");
+  const releasedDirectory = join4(quarantineRoot, `released.${ownerId}`);
+  await mkdir(quarantineRoot, { recursive: true, mode: 448 });
+  try {
+    await rename(lockDirectory, releasedDirectory);
+  } catch (error) {
+    if (error?.code === "ENOENT") return;
+    throw error;
+  }
+  await rm(releasedDirectory, { recursive: true, force: true });
+}
+async function withSkillSyncLock(callback, {
+  home = homedir3(),
+  timeoutMs = DEFAULT_LOCK_TIMEOUT_MS,
+  staleMs = DEFAULT_LOCK_STALE_MS,
+  pollMs = DEFAULT_LOCK_POLL_MS,
+  now = () => Date.now()
+} = {}) {
+  const lockDirectory = join4(home, ".notis", "skills", ".operation-lock");
+  const ownerId = `${process.pid}.${randomUUID2()}`;
+  const deadline = now() + timeoutMs;
+  await mkdir(dirname4(lockDirectory), { recursive: true, mode: 448 });
+  for (; ; ) {
+    try {
+      await mkdir(lockDirectory, { mode: 448 });
+      try {
+        await writeLockOwnerAtomically(lockDirectory, {
+          id: ownerId,
+          pid: process.pid,
+          at: now()
+        });
+      } catch (error) {
+        await rm(lockDirectory, { recursive: true, force: true });
+        throw error;
+      }
+      break;
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+    }
+    const observed = await lockSnapshot(lockDirectory);
+    if (observed && now() - observed.at > staleMs && !processIsAlive2(observed.pid)) {
+      await delay(Math.max(pollMs, 10));
+      const current = await lockSnapshot(lockDirectory);
+      if (sameLockSnapshot(observed, current) && !processIsAlive2(current?.pid)) {
+        if (await quarantineStaleLock(lockDirectory, current)) continue;
+      }
+    }
+    if (now() >= deadline) {
+      throw new Error("Timed out waiting for another Notis skill sync to finish.");
+    }
+    await delay(pollMs);
+  }
+  const heartbeatMs = Math.max(10, Math.min(3e4, Math.floor(staleMs / 3)));
+  let heartbeatStopped = false;
+  let heartbeatInFlight = Promise.resolve();
+  const refreshHeartbeat = async () => {
+    if (heartbeatStopped) return;
+    const temporaryOwnerPath = join4(lockDirectory, `.owner.${ownerId}.tmp`);
+    await writeFile(
+      temporaryOwnerPath,
+      JSON.stringify({ id: ownerId, pid: process.pid, at: now() }),
+      { mode: 384 }
+    );
+    const owner = await lockSnapshot(lockDirectory);
+    if (owner?.id !== ownerId) {
+      await rm(temporaryOwnerPath, { force: true });
+      return;
+    }
+    await rename(temporaryOwnerPath, join4(lockDirectory, "owner"));
+  };
+  const heartbeat = setInterval(() => {
+    heartbeatInFlight = heartbeatInFlight.then(refreshHeartbeat).catch(() => void 0);
+  }, heartbeatMs);
+  heartbeat.unref?.();
+  try {
+    return await callback();
+  } finally {
+    heartbeatStopped = true;
+    clearInterval(heartbeat);
+    await heartbeatInFlight;
+    await releaseOwnedLock(lockDirectory, ownerId);
+  }
+}
+
+// src/skill-sync-worker.js
+async function runAutomaticSkillSync({ profile, apiBase, userId }, {
+  resolveRuntime = resolveRuntimeProfile,
+  refresh = ensureFreshOAuthCredential,
+  settings = fetchSyncSettings,
+  sync = runSkillSync,
+  lock = withSkillSyncLock
+} = {}) {
+  const runtime = resolveRuntime({ profile }, { requireAuth: true });
+  if (runtime.credentialKind !== "oauth" || runtime.apiBase !== apiBase || runtime.oauthUserId !== userId) throw new Error("Automatic skill sync account changed; run notis skills sync to rebind");
+  await refresh(runtime);
+  const saved = await settings(runtime.apiBase, runtime.jwt);
+  if (saved.user_id !== userId) throw new Error("Automatic skill sync identity mismatch");
+  if (!saved.sync_enabled) return { status: "disabled" };
+  const result = await lock(() => sync(runtime.apiBase, runtime.jwt, {
+    fetchSyncSettings: async () => saved
+  }, { honorSyncEnabled: true }));
+  return { status: result.failedLinks?.length || result.failedPushes?.length ? "partial" : "synced", ...result };
+}
+async function main(args = process.argv.slice(2)) {
+  const [profile, apiBase, userId] = args;
+  const root = join5(homedir4(), ".notis", "skills", "service");
+  const record = (value) => {
+    mkdirSync3(root, { recursive: true, mode: 448 });
+    const target = join5(root, "status.json");
+    const temporary = `${target}.${process.pid}.tmp`;
+    writeFileSync3(temporary, JSON.stringify({ ...value, profile, at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2), { mode: 384 });
+    renameSync3(temporary, target);
+  };
+  const deadline = setTimeout(() => {
+    record({ status: "error", code: "sync_timeout" });
+    process.exit(1);
+  }, 24e4);
+  try {
+    record(await runAutomaticSkillSync({ profile, apiBase, userId }));
+  } catch (error) {
+    record({ status: "error", code: error.code || "sync_failed" });
+    process.exitCode = 1;
+  } finally {
+    clearTimeout(deadline);
+  }
+}
+
+// src/skill-sync-worker-entry.js
+await main();