@notis_ai/cli 0.2.0-beta.197.1 → 0.2.0-beta.198.1

package/dist/agent-hooks/notis-agent-hook.mjs

@@ -100,6 +100,114 @@ var init_errors = __esm({
   }
 });
 
+// src/runtime/config-lock.js
+import { randomUUID as randomUUID2 } from "node:crypto";
+import {
+  existsSync as existsSync7,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync7,
+  renameSync as renameSync2,
+  rmSync as rmSync3,
+  statSync as statSync4,
+  writeFileSync as writeFileSync4
+} from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname6, join as join7, resolve as resolve6 } from "node:path";
+function resolveCliConfigFile() {
+  const envConfigFile = process.env.NOTIS_CLI_CONFIG_FILE;
+  if (envConfigFile) {
+    return resolve6(envConfigFile);
+  }
+  return join7(homedir2(), ".notis", "config.json");
+}
+function readLockOwner(lockDirectory) {
+  try {
+    return JSON.parse(readFileSync7(join7(lockDirectory, "owner"), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function lockDirectoryMtime(lockDirectory) {
+  try {
+    return statSync4(lockDirectory).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+function publishConfigWriteLock(lockDirectory, ownerId) {
+  const candidateDirectory = `${lockDirectory}.candidate-${ownerId}`;
+  try {
+    mkdirSync4(candidateDirectory);
+    writeFileSync4(
+      join7(candidateDirectory, "owner"),
+      JSON.stringify({ id: ownerId, at: Date.now() }),
+      { mode: 384 }
+    );
+    try {
+      renameSync2(candidateDirectory, lockDirectory);
+      return true;
+    } catch (error) {
+      if (!existsSync7(lockDirectory)) throw error;
+      return false;
+    }
+  } finally {
+    rmSync3(candidateDirectory, { recursive: true, force: true });
+  }
+}
+function withConfigFileWriteLock(configFile, callback) {
+  const lockDirectory = `${configFile}.write-lock`;
+  const ownerId = `${process.pid}.${randomUUID2()}`;
+  const deadline = Date.now() + CONFIG_WRITE_LOCK_TIMEOUT_MS;
+  mkdirSync4(dirname6(configFile), { recursive: true });
+  for (; ; ) {
+    if (!existsSync7(lockDirectory) && publishConfigWriteLock(lockDirectory, ownerId)) {
+      break;
+    }
+    const owner = readLockOwner(lockDirectory);
+    const observedMtime = lockDirectoryMtime(lockDirectory);
+    const ownerIsStale = owner?.id && Date.now() - Number(owner.at) > CONFIG_WRITE_LOCK_STALE_MS;
+    const ownerlessIsStale = !owner && observedMtime !== null && Date.now() - observedMtime > CONFIG_WRITE_LOCK_STALE_MS;
+    if (ownerIsStale || ownerlessIsStale) {
+      try {
+        const currentOwner = readLockOwner(lockDirectory);
+        const ownerUnchanged = owner?.id ? currentOwner?.id === owner.id : !currentOwner && lockDirectoryMtime(lockDirectory) === observedMtime;
+        if (ownerUnchanged) {
+          rmSync3(lockDirectory, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+      }
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting to update ${configFile}`);
+    }
+    Atomics.wait(
+      new Int32Array(new SharedArrayBuffer(4)),
+      0,
+      0,
+      CONFIG_WRITE_LOCK_POLL_MS
+    );
+  }
+  try {
+    return callback(configFile);
+  } finally {
+    try {
+      if (readLockOwner(lockDirectory)?.id === ownerId) {
+        rmSync3(lockDirectory, { recursive: true, force: true });
+      }
+    } catch {
+    }
+  }
+}
+var CONFIG_WRITE_LOCK_TIMEOUT_MS, CONFIG_WRITE_LOCK_STALE_MS, CONFIG_WRITE_LOCK_POLL_MS;
+var init_config_lock = __esm({
+  "src/runtime/config-lock.js"() {
+    CONFIG_WRITE_LOCK_TIMEOUT_MS = 5e3;
+    CONFIG_WRITE_LOCK_STALE_MS = 2e3;
+    CONFIG_WRITE_LOCK_POLL_MS = 10;
+  }
+});
+
 // src/runtime/channel.js
 function isReleaseChannel(value) {
   return RELEASE_CHANNELS.includes(value);
@@ -279,18 +387,15 @@ var init_auth_recovery = __esm({
 });
 
 // src/runtime/profiles.js
-import { randomUUID as randomUUID2 } from "node:crypto";
 import {
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync7,
-  renameSync as renameSync2,
-  rmSync as rmSync3,
-  statSync as statSync4,
-  writeFileSync as writeFileSync4
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync8,
+  renameSync as renameSync3,
+  writeFileSync as writeFileSync5
 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { dirname as dirname6, join as join7, parse, resolve as resolve6 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname7, join as join8, parse, resolve as resolve7 } from "node:path";
 function clone(value) {
   return JSON.parse(JSON.stringify(value));
 }
@@ -390,23 +495,23 @@ function listProfiles(config) {
 }
 function readJsonFile2(path3) {
   try {
-    return JSON.parse(readFileSync7(path3, "utf-8"));
+    return JSON.parse(readFileSync8(path3, "utf-8"));
   } catch {
     return null;
   }
 }
 function findUp(filename, startDir = process.cwd()) {
-  let current = resolve6(startDir);
+  let current = resolve7(startDir);
   const root = parse(current).root;
   while (true) {
-    const candidate = join7(current, filename);
-    if (existsSync7(candidate)) {
+    const candidate = join8(current, filename);
+    if (existsSync8(candidate)) {
       return candidate;
     }
     if (current === root) {
       return null;
     }
-    current = dirname6(current);
+    current = dirname7(current);
   }
 }
 function processIsAlive(pid) {
@@ -477,17 +582,17 @@ function resolveWorktreeRuntime(startDir = process.cwd()) {
 function resolveConfigFile() {
   const envConfigFile = process.env.NOTIS_CLI_CONFIG_FILE;
   if (envConfigFile) {
-    return resolve6(envConfigFile);
+    return resolve7(envConfigFile);
   }
   return CONFIG_FILE;
 }
 function loadConfig() {
   const configFile = resolveConfigFile();
-  if (!existsSync7(configFile)) {
+  if (!existsSync8(configFile)) {
     return normalizeConfig({});
   }
   try {
-    return normalizeConfig(JSON.parse(readFileSync7(configFile, "utf-8")));
+    return normalizeConfig(JSON.parse(readFileSync8(configFile, "utf-8")));
   } catch {
     return normalizeConfig({});
   }
@@ -495,7 +600,7 @@ function loadConfig() {
 function writeConfig(configFile, config) {
   let rawConfig = null;
   try {
-    rawConfig = JSON.parse(readFileSync7(configFile, "utf-8"));
+    rawConfig = JSON.parse(readFileSync8(configFile, "utf-8"));
   } catch {
   }
   const normalized = normalizeConfig(config);
@@ -513,90 +618,13 @@ function writeConfig(configFile, config) {
   writeRawConfig(configFile, persisted);
 }
 function writeRawConfig(configFile, config) {
-  mkdirSync4(dirname6(configFile), { recursive: true });
+  mkdirSync5(dirname7(configFile), { recursive: true });
   const temporaryFile = `${configFile}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync4(temporaryFile, JSON.stringify(config, null, 2), { mode: 384 });
-  renameSync2(temporaryFile, configFile);
-}
-function readLockOwner(lockDirectory) {
-  try {
-    return JSON.parse(readFileSync7(join7(lockDirectory, "owner"), "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function lockDirectoryMtime(lockDirectory) {
-  try {
-    return statSync4(lockDirectory).mtimeMs;
-  } catch {
-    return null;
-  }
-}
-function publishConfigWriteLock(lockDirectory, ownerId) {
-  const candidateDirectory = `${lockDirectory}.candidate-${ownerId}`;
-  try {
-    mkdirSync4(candidateDirectory);
-    writeFileSync4(
-      join7(candidateDirectory, "owner"),
-      JSON.stringify({ id: ownerId, at: Date.now() }),
-      { mode: 384 }
-    );
-    try {
-      renameSync2(candidateDirectory, lockDirectory);
-      return true;
-    } catch (error) {
-      if (!existsSync7(lockDirectory)) throw error;
-      return false;
-    }
-  } finally {
-    rmSync3(candidateDirectory, { recursive: true, force: true });
-  }
+  writeFileSync5(temporaryFile, JSON.stringify(config, null, 2), { mode: 384 });
+  renameSync3(temporaryFile, configFile);
 }
 function withConfigWriteLock(callback) {
-  const configFile = resolveConfigFile();
-  const lockDirectory = `${configFile}.write-lock`;
-  const ownerId = `${process.pid}.${randomUUID2()}`;
-  const deadline = Date.now() + CONFIG_WRITE_LOCK_TIMEOUT_MS;
-  mkdirSync4(dirname6(configFile), { recursive: true });
-  for (; ; ) {
-    if (!existsSync7(lockDirectory) && publishConfigWriteLock(lockDirectory, ownerId)) {
-      break;
-    }
-    const owner = readLockOwner(lockDirectory);
-    const observedMtime = lockDirectoryMtime(lockDirectory);
-    const ownerIsStale = owner?.id && Date.now() - Number(owner.at) > CONFIG_WRITE_LOCK_STALE_MS;
-    const ownerlessIsStale = !owner && observedMtime !== null && Date.now() - observedMtime > CONFIG_WRITE_LOCK_STALE_MS;
-    if (ownerIsStale || ownerlessIsStale) {
-      try {
-        const currentOwner = readLockOwner(lockDirectory);
-        const ownerUnchanged = owner?.id ? currentOwner?.id === owner.id : !currentOwner && lockDirectoryMtime(lockDirectory) === observedMtime;
-        if (ownerUnchanged) {
-          rmSync3(lockDirectory, { recursive: true, force: true });
-          continue;
-        }
-      } catch {
-      }
-    }
-    if (Date.now() >= deadline) {
-      throw new Error(`Timed out waiting to update ${configFile}`);
-    }
-    Atomics.wait(
-      new Int32Array(new SharedArrayBuffer(4)),
-      0,
-      0,
-      CONFIG_WRITE_LOCK_POLL_MS
-    );
-  }
-  try {
-    return callback(configFile);
-  } finally {
-    try {
-      if (readLockOwner(lockDirectory)?.id === ownerId) {
-        rmSync3(lockDirectory, { recursive: true, force: true });
-      }
-    } catch {
-    }
-  }
+  return withConfigFileWriteLock(resolveConfigFile(), callback);
 }
 function updateConfig(updater) {
   return withConfigWriteLock((configFile) => {
@@ -611,6 +639,13 @@ function getProfile(config, profileName) {
   const normalized = normalizeConfig(config);
   return Object.hasOwn(normalized.profiles, profileName) ? normalized.profiles[profileName] : {};
 }
+function getCurrentProfileName(config, preferredName) {
+  const normalized = normalizeConfig(config);
+  if (preferredName && Object.hasOwn(normalized.profiles, preferredName)) {
+    return preferredName;
+  }
+  return normalized.current_profile || DEFAULT_PROFILE;
+}
 function resolveProfileSelection(globalOptions = {}, worktreeRuntime = null, config, { allowUnknownProfile = false } = {}) {
   const normalized = normalizeConfig(config);
   const requested = globalOptions.profile || process.env.NOTIS_PROFILE || "";
@@ -989,17 +1024,18 @@ function credentialIsExpired(runtime, profile = {}, nowSeconds = Math.floor(Date
   }
 }
 function workspacePath(appId) {
-  return join7(WORKSPACE_DIR, appId);
+  return join8(WORKSPACE_DIR, appId);
 }
-var CONFIG_DIR, CONFIG_FILE, WORKSPACE_DIR, DEFAULT_API_BASE, BETA_API_BASE, DEFAULT_PROFILE, PROFILE_NAME_PATTERN, LEGACY_DESKTOP_PROFILE_KEYS, WORKTREE_RUNTIME_FILENAME, WORKTREE_ROUTING_FILENAME, LOCAL_API_HOSTS, LIVE_API_HOSTS, CONFIG_WRITE_LOCK_TIMEOUT_MS, CONFIG_WRITE_LOCK_STALE_MS, CONFIG_WRITE_LOCK_POLL_MS;
+var CONFIG_DIR, CONFIG_FILE, WORKSPACE_DIR, DEFAULT_API_BASE, BETA_API_BASE, DEFAULT_PROFILE, PROFILE_NAME_PATTERN, LEGACY_DESKTOP_PROFILE_KEYS, WORKTREE_RUNTIME_FILENAME, WORKTREE_ROUTING_FILENAME, LOCAL_API_HOSTS, LIVE_API_HOSTS;
 var init_profiles = __esm({
   "src/runtime/profiles.js"() {
     init_errors();
+    init_config_lock();
     init_auth_recovery();
     init_channel();
-    CONFIG_DIR = join7(homedir2(), ".notis");
-    CONFIG_FILE = join7(CONFIG_DIR, "config.json");
-    WORKSPACE_DIR = join7(CONFIG_DIR, "workspace");
+    CONFIG_DIR = join8(homedir3(), ".notis");
+    CONFIG_FILE = join8(CONFIG_DIR, "config.json");
+    WORKSPACE_DIR = join8(CONFIG_DIR, "workspace");
     DEFAULT_API_BASE = "https://api.notis.ai";
     BETA_API_BASE = "https://api-beta.notis.ai";
     DEFAULT_PROFILE = "default";
@@ -1013,13 +1049,120 @@ var init_profiles = __esm({
       "desktop_app_name",
       "desktop_pid"
     ];
-    WORKTREE_RUNTIME_FILENAME = join7(".context", "notis-runtime.json");
-    WORKTREE_ROUTING_FILENAME = join7(".context", "notis-routing.json");
+    WORKTREE_RUNTIME_FILENAME = join8(".context", "notis-runtime.json");
+    WORKTREE_ROUTING_FILENAME = join8(".context", "notis-routing.json");
     LOCAL_API_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
     LIVE_API_HOSTS = /* @__PURE__ */ new Set(["api.notis.ai", "api-beta.notis.ai"]);
-    CONFIG_WRITE_LOCK_TIMEOUT_MS = 5e3;
-    CONFIG_WRITE_LOCK_STALE_MS = 2e3;
-    CONFIG_WRITE_LOCK_POLL_MS = 10;
+  }
+});
+
+// src/runtime/computer-identity.js
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync9, renameSync as renameSync4, writeFileSync as writeFileSync6 } from "node:fs";
+import { hostname as osHostname } from "node:os";
+import { dirname as dirname8, join as join9 } from "node:path";
+function computerIdentityFile(configFile = resolveCliConfigFile()) {
+  return join9(dirname8(configFile), "computer.json");
+}
+function normalizeComputerName(value) {
+  if (typeof value !== "string") return null;
+  const collapsed = value.replace(/\s+/gu, " ").trim();
+  if (!collapsed) return null;
+  const characters = Array.from(collapsed);
+  if (characters.length <= COMPUTER_NAME_MAX_LENGTH) return collapsed;
+  return characters.slice(0, COMPUTER_NAME_MAX_LENGTH).join("").trim();
+}
+function readMacComputerName() {
+  try {
+    return execFileSync("/usr/sbin/scutil", ["--get", "ComputerName"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    });
+  } catch {
+    return null;
+  }
+}
+function defaultComputerName(options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    const macName = normalizeComputerName((options.readMacComputerName ?? readMacComputerName)());
+    if (macName) return macName;
+  }
+  let host = "";
+  try {
+    host = String((options.hostname ?? osHostname)() || "");
+  } catch {
+    host = "";
+  }
+  return normalizeComputerName(host.replace(/\.local\.?$/iu, "")) || FALLBACK_COMPUTER_NAME;
+}
+function parseIdentityFile(file) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync9(file, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  return raw;
+}
+function validStored(raw) {
+  if (!raw || raw.version !== COMPUTER_IDENTITY_VERSION) return null;
+  if (typeof raw.computer_id !== "string" || !COMPUTER_ID_PATTERN.test(raw.computer_id)) return null;
+  return {
+    computerId: raw.computer_id.toLowerCase(),
+    name: normalizeComputerName(raw.name)
+  };
+}
+function writeIdentityFile(file, stored) {
+  mkdirSync6(dirname8(file), { recursive: true });
+  const contents = {
+    version: COMPUTER_IDENTITY_VERSION,
+    computer_id: stored.computerId,
+    ...stored.name ? { name: stored.name } : {}
+  };
+  const temporaryFile = `${file}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync6(temporaryFile, `${JSON.stringify(contents, null, 2)}
+`, { mode: 384 });
+  renameSync4(temporaryFile, file);
+}
+function withIdentity(stored, options) {
+  const defaultName = defaultComputerName(options);
+  return {
+    computerId: stored.computerId,
+    name: stored.name,
+    defaultName,
+    displayName: stored.name ?? defaultName
+  };
+}
+function readOrCreateLocked(configFile, file) {
+  const raw = parseIdentityFile(file);
+  const existing = validStored(raw);
+  if (existing) return existing;
+  const created = {
+    computerId: randomUUID3(),
+    // A file with a broken id keeps the name the user chose.
+    name: normalizeComputerName(raw?.name)
+  };
+  writeIdentityFile(file, created);
+  return created;
+}
+function readComputerIdentity(options = {}) {
+  const configFile = options.configFile ?? resolveCliConfigFile();
+  const file = computerIdentityFile(configFile);
+  const stored = validStored(parseIdentityFile(file)) ?? withConfigFileWriteLock(configFile, () => readOrCreateLocked(configFile, file));
+  return withIdentity(stored, options);
+}
+var COMPUTER_IDENTITY_VERSION, COMPUTER_NAME_MAX_LENGTH, COMPUTER_ID_PATTERN, FALLBACK_COMPUTER_NAME;
+var init_computer_identity = __esm({
+  "src/runtime/computer-identity.js"() {
+    init_config_lock();
+    COMPUTER_IDENTITY_VERSION = 1;
+    COMPUTER_NAME_MAX_LENGTH = 64;
+    COMPUTER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    FALLBACK_COMPUTER_NAME = "Computer";
   }
 });
 
@@ -1029,6 +1172,7 @@ __export(oauth_exports, {
   DEFAULT_CLI_OAUTH_SCOPES: () => DEFAULT_CLI_OAUTH_SCOPES,
   acquireListenerGlobalLock: () => acquireListenerGlobalLock,
   browserOpenCommand: () => browserOpenCommand,
+  buildAuthorizeUrl: () => buildAuthorizeUrl,
   clearListenerState: () => clearListenerState,
   createLoopbackReceiver: () => createLoopbackReceiver,
   createPkce: () => createPkce,
@@ -1050,20 +1194,20 @@ import {
   timingSafeEqual
 } from "node:crypto";
 import {
-  mkdirSync as mkdirSync5,
+  mkdirSync as mkdirSync7,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync8,
-  renameSync as renameSync3,
+  readFileSync as readFileSync10,
+  renameSync as renameSync5,
   rmdirSync as rmdirSync2,
   rmSync as rmSync4,
   statSync as statSync5,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync7
 } from "node:fs";
 import { createServer as createServer3 } from "node:http";
-import { homedir as homedir3 } from "node:os";
-import { basename as basename2, dirname as dirname7, join as join8 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { basename as basename2, dirname as dirname9, join as join10 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { execFileSync, spawn as spawn3 } from "node:child_process";
+import { execFileSync as execFileSync2, spawn as spawn3 } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 function oauthError(code, message, hints = null, details = {}) {
   return new CliError({
@@ -1453,13 +1597,13 @@ async function createLoopbackReceiver({
   let pendingResponse = null;
   const sockets = /* @__PURE__ */ new Set();
   let responseFlushed = Promise.resolve();
-  const result = new Promise((resolve18, reject) => {
-    resolveCode = resolve18;
+  const result = new Promise((resolve19, reject) => {
+    resolveCode = resolve19;
     rejectCode = reject;
   });
   const endResponse = (response, body) => {
-    responseFlushed = new Promise((resolve18) => {
-      response.end(body, resolve18);
+    responseFlushed = new Promise((resolve19) => {
+      response.end(body, resolve19);
     });
   };
   const server = createServer3((request, response) => {
@@ -1508,11 +1652,11 @@ async function createLoopbackReceiver({
     sockets.add(socket);
     socket.on("close", () => sockets.delete(socket));
   });
-  await new Promise((resolve18, reject) => {
+  await new Promise((resolve19, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       server.off("error", reject);
-      resolve18();
+      resolve19();
     });
   });
   const address = server.address();
@@ -1536,14 +1680,14 @@ async function createLoopbackReceiver({
     }
     await Promise.race([
       responseFlushed,
-      new Promise((resolve18) => {
-        setTimeout(resolve18, RESPONSE_FLUSH_GRACE_MS).unref?.();
+      new Promise((resolve19) => {
+        setTimeout(resolve19, RESPONSE_FLUSH_GRACE_MS).unref?.();
       })
     ]);
     for (const socket of sockets) socket.destroy();
     sockets.clear();
     if (!server.listening) return;
-    await new Promise((resolve18) => server.close(resolve18));
+    await new Promise((resolve19) => server.close(resolve19));
   };
   return {
     port,
@@ -1611,6 +1755,14 @@ function storedOAuthMetadata(runtime, profile) {
     revocationEndpoint: `${issuer}/oauth/revoke`
   };
 }
+function cliDeviceParams() {
+  try {
+    const identity = readComputerIdentity({ configFile: resolveConfigFile() });
+    return { device_id: identity.computerId, device_name: identity.displayName };
+  } catch {
+    return {};
+  }
+}
 function buildAuthorizeUrl(metadata, {
   redirectUri,
   challenge,
@@ -1626,6 +1778,9 @@ function buildAuthorizeUrl(metadata, {
   url.searchParams.set("code_challenge", challenge);
   url.searchParams.set("code_challenge_method", "S256");
   url.searchParams.set("state", state);
+  for (const [key2, value] of Object.entries(cliDeviceParams())) {
+    url.searchParams.set(key2, value);
+  }
   return url.toString();
 }
 async function exchangeCode(metadata, {
@@ -1701,8 +1856,8 @@ function legacyPendingAuthorizationFile(runtime) {
 }
 function savePendingAuthorization(runtime, pending) {
   const file = pendingAuthorizationFile(runtime);
-  mkdirSync5(dirname7(file), { recursive: true });
-  writeFileSync5(file, JSON.stringify(pending, null, 2), { mode: 384 });
+  mkdirSync7(dirname9(file), { recursive: true });
+  writeFileSync7(file, JSON.stringify(pending, null, 2), { mode: 384 });
 }
 function readPendingAuthorization(runtime, { includeExpired = false } = {}) {
   for (const file of [
@@ -1711,7 +1866,7 @@ function readPendingAuthorization(runtime, { includeExpired = false } = {}) {
   ]) {
     let pending;
     try {
-      pending = JSON.parse(readFileSync8(file, "utf-8"));
+      pending = JSON.parse(readFileSync10(file, "utf-8"));
     } catch {
       continue;
     }
@@ -1732,7 +1887,7 @@ function clearPendingAuthorizations(runtime) {
   clearPendingAuthorization(runtime);
   const legacyFile = legacyPendingAuthorizationFile(runtime);
   try {
-    const pending = JSON.parse(readFileSync8(legacyFile, "utf-8"));
+    const pending = JSON.parse(readFileSync10(legacyFile, "utf-8"));
     if (pending?.profile === runtime.profileName) rmSync4(legacyFile);
   } catch {
   }
@@ -1780,11 +1935,11 @@ function listenerGlobalLockDir() {
   return `${resolveConfigFile()}.oauth-listener-global.lock`;
 }
 function listenerGlobalLockOwnerFile(lockDir) {
-  return join8(lockDir, "owner.json");
+  return join10(lockDir, "owner.json");
 }
 function readListenerGlobalLockOwner(lockDir) {
   try {
-    return JSON.parse(readFileSync8(listenerGlobalLockOwnerFile(lockDir), "utf-8"));
+    return JSON.parse(readFileSync10(listenerGlobalLockOwnerFile(lockDir), "utf-8"));
   } catch {
     return null;
   }
@@ -1792,7 +1947,7 @@ function readListenerGlobalLockOwner(lockDir) {
 function writeListenerGlobalLockOwner(lock) {
   const current = readListenerGlobalLockOwner(lock.lockDir);
   if (current && current.owner_token !== lock.ownerToken) return false;
-  writeFileSync5(listenerGlobalLockOwnerFile(lock.lockDir), JSON.stringify({
+  writeFileSync7(listenerGlobalLockOwnerFile(lock.lockDir), JSON.stringify({
     owner_token: lock.ownerToken,
     owner_pid: process.pid,
     updated_at: Date.now()
@@ -1813,7 +1968,7 @@ function listenerGlobalLockIsStale(lockDir, staleMs) {
 function retireStaleListenerGlobalLock(lockDir) {
   const retiredDir = `${lockDir}.stale-${process.pid}-${base64url(randomBytes(8))}`;
   try {
-    renameSync3(lockDir, retiredDir);
+    renameSync5(lockDir, retiredDir);
   } catch {
     return false;
   }
@@ -1822,11 +1977,11 @@ function retireStaleListenerGlobalLock(lockDir) {
 }
 async function acquireListenerStartLock(runtime) {
   const lockDir = listenerStartLockDir(runtime);
-  mkdirSync5(dirname7(lockDir), { recursive: true });
+  mkdirSync7(dirname9(lockDir), { recursive: true });
   const deadline = Date.now() + LISTENER_START_LOCK_STALE_MS * 2;
   for (; ; ) {
     try {
-      mkdirSync5(lockDir);
+      mkdirSync7(lockDir);
       return lockDir;
     } catch (error) {
       if (error?.code !== "EEXIST") throw error;
@@ -1843,7 +1998,7 @@ async function acquireListenerStartLock(runtime) {
           "Timed out waiting for another CLI process to start browser authorization."
         );
       }
-      await new Promise((resolve18) => setTimeout(resolve18, 50));
+      await new Promise((resolve19) => setTimeout(resolve19, 50));
     }
   }
 }
@@ -1860,11 +2015,11 @@ async function acquireListenerGlobalLock({
   heartbeatMs = LISTENER_GLOBAL_LOCK_HEARTBEAT_MS
 } = {}) {
   const lockDir = listenerGlobalLockDir();
-  mkdirSync5(dirname7(lockDir), { recursive: true });
+  mkdirSync7(dirname9(lockDir), { recursive: true });
   const deadline = Date.now() + waitMs;
   for (; ; ) {
     try {
-      mkdirSync5(lockDir);
+      mkdirSync7(lockDir);
       const lock = {
         lockDir,
         ownerToken: base64url(randomBytes(24)),
@@ -1890,7 +2045,7 @@ async function acquireListenerGlobalLock({
           "Timed out waiting for another CLI process to finish OAuth account changes."
         );
       }
-      await new Promise((resolve18) => setTimeout(resolve18, 50));
+      await new Promise((resolve19) => setTimeout(resolve19, 50));
     }
   }
 }
@@ -1901,14 +2056,14 @@ function releaseListenerGlobalLock(lock) {
   if (owner?.owner_token !== lock.ownerToken) return;
   const releasedDir = `${lock.lockDir}.released-${process.pid}-${lock.ownerToken}`;
   try {
-    renameSync3(lock.lockDir, releasedDir);
+    renameSync5(lock.lockDir, releasedDir);
   } catch {
     return;
   }
   const movedOwner = readListenerGlobalLockOwner(releasedDir);
   if (movedOwner?.owner_token !== lock.ownerToken) {
     try {
-      renameSync3(releasedDir, lock.lockDir);
+      renameSync5(releasedDir, lock.lockDir);
     } catch {
     }
     return;
@@ -1917,12 +2072,12 @@ function releaseListenerGlobalLock(lock) {
 }
 function saveListenerState(runtime, state) {
   const file = listenerStateFile(runtime);
-  mkdirSync5(dirname7(file), { recursive: true });
-  writeFileSync5(file, JSON.stringify(state, null, 2), { mode: 384 });
+  mkdirSync7(dirname9(file), { recursive: true });
+  writeFileSync7(file, JSON.stringify(state, null, 2), { mode: 384 });
 }
 function readListenerState(runtime) {
   try {
-    const state = JSON.parse(readFileSync8(listenerStateFile(runtime), "utf-8"));
+    const state = JSON.parse(readFileSync10(listenerStateFile(runtime), "utf-8"));
     return state?.profile === runtime.profileName ? state : null;
   } catch {
     return null;
@@ -1937,7 +2092,7 @@ function listenerStateAllowsPersistence(runtime, ownerPid) {
 function clearListenerState(runtime, { ownerPid = null } = {}) {
   if (ownerPid !== null) {
     try {
-      const state = JSON.parse(readFileSync8(listenerStateFile(runtime), "utf-8"));
+      const state = JSON.parse(readFileSync10(listenerStateFile(runtime), "utf-8"));
       if (Number(state?.pid) !== Number(ownerPid)) return;
     } catch {
       return;
@@ -1962,7 +2117,7 @@ function readLiveListener(runtime, { sameApiBase = true } = {}) {
 }
 function listenerProcessIsAlive(pid, {
   platform = process.platform,
-  run = execFileSync,
+  run = execFileSync2,
   signal = process.kill.bind(process),
   expectedIdentity = null,
   expectedScriptPath = null
@@ -2035,8 +2190,8 @@ async function startDetachedLoopbackListener(runtime, {
   const identityToken = randomBytes(24).toString("base64url");
   const payloadFile = `${listenerStateFile(runtime)}.payload.${process.pid}.${randomBytes(8).toString("hex")}`;
   try {
-    mkdirSync5(dirname7(payloadFile), { recursive: true });
-    writeFileSync5(payloadFile, JSON.stringify({
+    mkdirSync7(dirname9(payloadFile), { recursive: true });
+    writeFileSync7(payloadFile, JSON.stringify({
       profile: runtime.profileName,
       api_base: runtime.apiBase,
       verifier,
@@ -2067,7 +2222,7 @@ async function startDetachedLoopbackListener(runtime, {
     }
     return null;
   }
-  const port = await new Promise((resolve18) => {
+  const port = await new Promise((resolve19) => {
     let settled = false;
     const finish = (value) => {
       if (settled) return;
@@ -2076,7 +2231,7 @@ async function startDetachedLoopbackListener(runtime, {
       child.off("message", onMessage);
       child.off("error", onFailure);
       child.off("exit", onFailure);
-      resolve18(value);
+      resolve19(value);
     };
     const onMessage = (message) => finish(Number(message?.port) || null);
     const onFailure = () => finish(null);
@@ -2128,7 +2283,7 @@ async function revokeCancelledToken(metadata, tokenResponse, fetchImpl) {
 async function runDetachedLoginListener(payloadFile, fetchImpl = fetch, identityToken = process.argv[3] || null) {
   let payload;
   try {
-    payload = JSON.parse(readFileSync8(payloadFile, "utf-8"));
+    payload = JSON.parse(readFileSync10(payloadFile, "utf-8"));
   } catch {
     return 1;
   }
@@ -2835,7 +2990,7 @@ function pendingListenerProfiles() {
   const prefix = `${basename2(configFile)}.login-listener.`;
   let entries;
   try {
-    entries = readdirSync4(dirname7(configFile));
+    entries = readdirSync4(dirname9(configFile));
   } catch {
     return [];
   }
@@ -2843,7 +2998,7 @@ function pendingListenerProfiles() {
   for (const entry of entries) {
     if (!entry.startsWith(prefix) || entry.includes(".payload") || entry.endsWith(".lock")) continue;
     try {
-      const state = JSON.parse(readFileSync8(join8(dirname7(configFile), entry), "utf-8"));
+      const state = JSON.parse(readFileSync10(join10(dirname9(configFile), entry), "utf-8"));
       if (typeof state?.profile === "string" && state.profile) profiles.add(state.profile);
     } catch {
     }
@@ -2857,7 +3012,7 @@ function pendingAuthorizationProfiles() {
   const legacyName = `${configName}.pending-login`;
   let entries;
   try {
-    entries = readdirSync4(dirname7(configFile));
+    entries = readdirSync4(dirname9(configFile));
   } catch {
     return [];
   }
@@ -2865,7 +3020,7 @@ function pendingAuthorizationProfiles() {
   for (const entry of entries) {
     if (entry !== legacyName && !entry.startsWith(prefix)) continue;
     try {
-      const pending = JSON.parse(readFileSync8(join8(dirname7(configFile), entry), "utf-8"));
+      const pending = JSON.parse(readFileSync10(join10(dirname9(configFile), entry), "utf-8"));
       if (typeof pending?.profile === "string" && pending.profile) profiles.add(pending.profile);
     } catch {
     }
@@ -2880,11 +3035,11 @@ function lockIsStale() {
   }
 }
 async function acquireRefreshLock(runtime, waitMs = 6e4) {
-  mkdirSync5(join8(homedir3(), ".notis"), { recursive: true });
+  mkdirSync7(join10(homedir4(), ".notis"), { recursive: true });
   const deadline = Date.now() + waitMs;
   for (; ; ) {
     try {
-      mkdirSync5(OAUTH_LOCK_DIR);
+      mkdirSync7(OAUTH_LOCK_DIR);
       return true;
     } catch (error) {
       if (error?.code !== "EEXIST") throw error;
@@ -2903,7 +3058,7 @@ async function acquireRefreshLock(runtime, waitMs = 6e4) {
       if (Date.now() >= deadline) {
         throw oauthError("oauth_refresh_lock_timeout", "Timed out waiting for another CLI process to refresh OAuth.");
       }
-      await new Promise((resolve18) => setTimeout(resolve18, 100));
+      await new Promise((resolve19) => setTimeout(resolve19, 100));
     }
   }
 }
@@ -2938,7 +3093,8 @@ async function refreshOAuthCredential(runtime, fetchImpl = fetch) {
           grant_type: "refresh_token",
           refresh_token: profile.oauth_refresh_token,
           client_id: profile.oauth_client_id,
-          resource: metadata.resource
+          resource: metadata.resource,
+          ...cliDeviceParams()
         })
       },
       fetchImpl
@@ -3065,6 +3221,7 @@ var DEFAULT_CLI_OAUTH_SCOPES, OAUTH_LOCK_DIR, DEFAULT_LOGIN_TIMEOUT_MS, DEFAULT_
 var init_oauth = __esm({
   "src/runtime/oauth.js"() {
     init_errors();
+    init_computer_identity();
     init_auth_recovery();
     init_channel();
     init_profiles();
@@ -3074,7 +3231,7 @@ var init_oauth = __esm({
       "notis:connections",
       "notis:apps"
     ];
-    OAUTH_LOCK_DIR = join8(homedir3(), ".notis", "oauth.lock");
+    OAUTH_LOCK_DIR = join10(homedir4(), ".notis", "oauth.lock");
     DEFAULT_LOGIN_TIMEOUT_MS = 3e5;
     DEFAULT_REFRESH_EXPIRES_IN = 30 * 24 * 60 * 60;
     PENDING_LOGIN_TTL_SECONDS = 30 * 60;
@@ -3122,7 +3279,8 @@ __export(skill_sync_exports, {
   shouldWriteCloudSkill: () => shouldWriteCloudSkill
 });
 import { createHash as createHash42 } from "node:crypto";
-import { join as join16 } from "node:path";
+import { promises as fs3 } from "node:fs";
+import { dirname as dirname17, join as join18 } from "node:path";
 import { createHash as createHash10 } from "node:crypto";
 import { createHash as createHash22 } from "crypto";
 import { execFile } from "child_process";
@@ -3231,8 +3389,16 @@ function previousNativeState(state, skill) {
 function nativeLocalReady(skill, local) {
   return Boolean(local?.nativeFilesCurrent && local.folderHash === local.nativeBaseFolderHash && local.cloudId === skill.id && local.nativeScope === skill.native_scope && sameNativeReference(local.nativeReference, skill.native_reference));
 }
-function nativeLinkRows(response, locals) {
-  return response.skills.map((skill) => isNativeSkill(skill) && !nativeLocalReady(skill, locals.find((row) => row.name === skill.name)) ? { ...skill, status: "disabled" } : skill);
+function pendingLegacyUpgrade(skill, local, state) {
+  if (!isNativeSkill(skill) || !local || local.nativeReference || local.cloudId) return false;
+  const previous = previousNativeState(state, skill);
+  return Boolean(previous && !previous.nativeReference);
+}
+function nativeLinkRows(response, locals, state) {
+  return response.skills.map((skill) => {
+    const local = locals.find((row) => row.name === skill.name);
+    return isNativeSkill(skill) && !nativeLocalReady(skill, local) && !(state && pendingLegacyUpgrade(skill, local, state)) ? { ...skill, status: "disabled" } : skill;
+  });
 }
 function retainMissingNativeState(previous, next) {
   const present = new Set(Object.values(next.skills).map((row) => row.cloudId));
@@ -3960,7 +4126,12 @@ async function replaceSkillDirectoryAtomically(skillDir, populateDir, preserve)
     }
     await populateDir(stagingDir);
     if (preserve && await pathExists(skillDir)) {
-      await preserveUnmanagedFiles(skillDir, stagingDir, preserve.previouslyApplied, preserve.native);
+      await preserveUnmanagedFiles(
+        skillDir,
+        stagingDir,
+        preserve.previouslyApplied,
+        preserve.native && !preserve.legacyBaseline
+      );
     }
     if (preserve?.native) {
       const markerPath = path2.join(stagingDir, NATIVE_IDENTITY_FILE);
@@ -4057,7 +4228,9 @@ async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PA
   const preserve = {
     previouslyApplied: options.previouslyApplied,
     expectedFolderHash: options.expectedFolderHash,
-    native: isNativeSkill(skill)
+    native: isNativeSkill(skill),
+    // An unchanged legacy folder upgrading in place: shared files take the cloud version.
+    legacyBaseline: isNativeSkill(skill) && options.legacyBaseline === true && options.expectedFolderHash !== void 0
   };
   if (bundleBytes?.length) {
     const bundlePath2 = path2.join(
@@ -4578,17 +4751,50 @@ function withoutBaseSkillState(state) {
     )
   };
 }
+async function forgetOtherAccountsAgentLinks(paths) {
+  const usersDir = dirname17(dirname17(paths.syncStatePath));
+  let entries;
+  try {
+    entries = await fs3.readdir(usersDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const statePath2 = join18(usersDir, entry.name, ".notis-sync.json");
+    if (statePath2 === paths.syncStatePath) continue;
+    let state = null;
+    try {
+      state = JSON.parse(await fs3.readFile(statePath2, "utf8"));
+    } catch {
+      continue;
+    }
+    if (!state || typeof state !== "object" || !state.skills || typeof state.skills !== "object") continue;
+    let changed = false;
+    for (const skill of Object.values(state.skills)) {
+      if (skill && typeof skill === "object" && "verifiedAgentLinks" in skill) {
+        delete skill.verifiedAgentLinks;
+        changed = true;
+      }
+    }
+    if (!changed) continue;
+    const temporaryPath = `${statePath2}.${process.pid}.${Date.now()}.tmp`;
+    await fs3.writeFile(temporaryPath, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+    await fs3.rename(temporaryPath, statePath2);
+  }
+}
 function isolatedLinkOptions(paths) {
   if (!paths.isolatedNamespace && !paths.homeDir) return void 0;
-  const root = paths.isolatedNamespace ? join16(paths.syncRoot, "environments", paths.isolatedNamespace, "agents") : paths.homeDir;
+  const root = paths.isolatedNamespace ? join18(paths.syncRoot, "environments", paths.isolatedNamespace, "agents") : paths.homeDir;
   return {
     agentSkillDirs: {
       notis: paths.skillsDir,
-      claude_code: join16(root, ".claude", "skills"),
-      cursor: join16(root, ".cursor", "skills"),
-      codex: join16(root, ".codex", "skills")
+      claude_code: join18(root, ".claude", "skills"),
+      cursor: join18(root, ".cursor", "skills"),
+      codex: join18(root, ".codex", "skills")
     },
-    legacyGlobalSkillsDir: join16(root, ".agents", "skills")
+    legacyGlobalSkillsDir: join18(root, ".agents", "skills")
   };
 }
 function assertSyncEnvironment(pull, settings) {
@@ -4665,6 +4871,10 @@ function buildSyncState(pullResponse, localSkills, lastSyncedAt, verifiedAgentLi
       const localSkill = localSkillMap.get(skill.name);
       const appliedCloudFolderHash = appliedRevisions[skill.name];
       const appliedFileList = appliedFiles[skill.name];
+      if (pendingLegacyUpgrade(skill, localSkill, previousState)) {
+        const { nativeUnavailable: _unavailable, ...previous } = previousNativeState(previousState, skill);
+        return [skill.name, { ...previous, verifiedAgentLinks: verifiedAgentLinks[skill.name] ?? {} }];
+      }
       if (isNativeSkill(skill) && !nativeLocalReady(skill, localSkill)) {
         const previous = previousNativeState(previousState, skill);
         return [skill.name, { ...previous || {
@@ -4728,7 +4938,7 @@ function buildLocalSymlinkCandidates(pullResponse, localSkills, previousState) {
       status: "active"
     };
   });
-  return [...nativeLinkRows(pullResponse, localSkills), ...localOnlySkills];
+  return [...nativeLinkRows(pullResponse, localSkills, previousState), ...localOnlySkills];
 }
 function isEmptySyncState(state) {
   return state.lastSyncedAt === null && Object.keys(state.skills).length === 0;
@@ -4764,6 +4974,7 @@ async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previo
   for (const cloudSkill of selectCloudSkillsToApply(pullResponse.skills)) {
     const local = localSkillMap.get(cloudSkill.name);
     const acknowledged = isNativeSkill(cloudSkill) && local && acknowledgedNative.get(cloudSkill.id) === local.folderHash;
+    const legacyBaseline = Boolean(local && pendingLegacyUpgrade(cloudSkill, local, previousState) && previousNativeState(previousState, cloudSkill)?.folderHash === local.folderHash);
     if (!acknowledged && !shouldWriteCloudSkill(cloudSkill, localSkillMap, previousState)) {
       if (isNativeSkill(cloudSkill) && !nativeLocalReady(cloudSkill, local)) {
         failures.push({ name: cloudSkill.name, error: "Local native Skill changes were retained; resolve the version or identity conflict before using them." });
@@ -4776,7 +4987,8 @@ async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previo
         // What the last write put there. Everything else in the folder was
         // produced locally and survives this one.
         previouslyApplied: previousNativeState(previousState, skill)?.appliedFiles,
-        ...isNativeSkill(skill) && local ? { expectedFolderHash: local.folderHash } : {}
+        ...isNativeSkill(skill) && local ? { expectedFolderHash: local.folderHash } : {},
+        ...legacyBaseline ? { legacyBaseline } : {}
       }),
       onWarning: warnSkillSync
     });
@@ -4845,7 +5057,7 @@ async function materializeCloudSkillsForLocalShell(serverUrl, jwt, dependencies
   }
   if (relinkSkillNames.size > 0) {
     const relinked = await deps.syncSymlinks(
-      nativeLinkRows(pullResponse, finalLocalSkills).filter((skill) => relinkSkillNames.has(skill.name)),
+      nativeLinkRows(pullResponse, finalLocalSkills, previousState).filter((skill) => relinkSkillNames.has(skill.name)),
       syncPaths.skillsDir,
       { ...isolatedLinkOptions(syncPaths), removeUndesired: false }
     );
@@ -4882,7 +5094,8 @@ async function materializeCloudSkillsForLocalShell(serverUrl, jwt, dependencies
   for (const [name, previous] of Object.entries(previousState.skills)) {
     if (!previous.nativeReference && !previous.nativeUnavailable) continue;
     const current = pullResponse.skills.find((skill) => skill.id === previous.cloudId);
-    if (!current || !nativeLocalReady(current, finalLocalSkills.find((local) => local.name === current.name))) {
+    const local = current && finalLocalSkills.find((row) => row.name === current.name);
+    if (!current || !nativeLocalReady(current, local) && !pendingLegacyUpgrade(current, local, previousState)) {
       removed += await deps.removeAllSymlinksForSkill(name, syncPaths.skillsDir, isolatedLinkOptions(syncPaths));
     }
   }
@@ -4968,9 +5181,11 @@ async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previo
   return deactivated;
 }
 async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
+  const linkAgentFolders = options.linkAgentFolders !== false;
   const deps = {
     ...DEFAULT_RUN_SKILL_SYNC_DEPS,
-    ...dependencies
+    ...dependencies,
+    ...linkAgentFolders ? {} : MIRROR_ONLY_DEPS
   };
   const syncSettings = await deps.fetchSyncSettings(
     serverUrl,
@@ -5009,13 +5224,16 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
     syncPaths.skillsDir,
     isolatedLinkOptions(syncPaths)
   );
+  if (linkAgentFolders && !syncPaths.isolatedNamespace) {
+    await forgetOtherAccountsAgentLinks(syncPaths);
+  }
   const cloudCuratedSkillNames = new Set(
     pullResponse.skills.filter((skill) => skill.source === "curated").map((skill) => skill.name)
   );
   const protectedSkillNames = /* @__PURE__ */ new Set([...cloudCuratedSkillNames, ...BASE_SKILL_NAMES2]);
   const scopedState = withoutBaseSkillState(await deps.readSyncState(syncPaths));
   const assignmentFailures = [];
-  const deactivated = !syncPaths.isolatedNamespace && syncSettings.agent_targets_conditional_updates === true ? await deactivateDeletedAgentSkills(
+  const deactivated = linkAgentFolders && !syncPaths.isolatedNamespace && syncSettings.agent_targets_conditional_updates === true ? await deactivateDeletedAgentSkills(
     serverUrl,
     jwt,
     pullResponse,
@@ -5037,7 +5255,7 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
       protectedSkillNames
     });
   }
-  if (!syncPaths.isolatedNamespace) {
+  if (linkAgentFolders && !syncPaths.isolatedNamespace) {
     await deps.gatherTopLevelLocalSkills(syncPaths, { protectedSkillNames });
   }
   const localSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES2.has(skill.name));
@@ -5151,7 +5369,7 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
     failedPushes
   };
 }
-var DEFAULT_AGENT_TARGETS, NATIVE_IDENTITY_FILE, UUID, HOME_DIR, execFileAsync, NativeSkillIdentityError, AGENTS_DIR, LEGACY_AGENTS_SKILLS_DIR, NOTIS_SKILL_SYNC_ROOT, LEGACY_NOTIS_SYNC_STATE_PATH, AGENTS_SKILLS_DIR, SKILL_LOCK_PATH, DEFAULT_SYNC_STATE, EXCLUDED_TOP_LEVEL_ROOT_NAMES, DEFAULT_SYNC_PATHS, IGNORED_SKILL_DIRECTORIES, HOME_DIR2, EXTERNAL_AGENT_SKILL_DIRS, EXTERNAL_AGENTS, AGENT_FAILURE_LABELS, BASE_SKILL_NAMES2, DEFAULT_RUN_SKILL_SYNC_DEPS;
+var DEFAULT_AGENT_TARGETS, NATIVE_IDENTITY_FILE, UUID, HOME_DIR, execFileAsync, NativeSkillIdentityError, AGENTS_DIR, LEGACY_AGENTS_SKILLS_DIR, NOTIS_SKILL_SYNC_ROOT, LEGACY_NOTIS_SYNC_STATE_PATH, AGENTS_SKILLS_DIR, SKILL_LOCK_PATH, DEFAULT_SYNC_STATE, EXCLUDED_TOP_LEVEL_ROOT_NAMES, DEFAULT_SYNC_PATHS, IGNORED_SKILL_DIRECTORIES, HOME_DIR2, EXTERNAL_AGENT_SKILL_DIRS, EXTERNAL_AGENTS, AGENT_FAILURE_LABELS, BASE_SKILL_NAMES2, DEFAULT_RUN_SKILL_SYNC_DEPS, MIRROR_ONLY_DEPS;
 var init_skill_sync = __esm({
   "dist/skill-sync/index.js"() {
     DEFAULT_AGENT_TARGETS = {
@@ -5240,6 +5458,11 @@ var init_skill_sync = __esm({
       removeForeignAccountSymlinks,
       updateAgentTargets
     };
+    MIRROR_ONLY_DEPS = {
+      removeForeignAccountSymlinks: async () => 0,
+      removeAllSymlinksForSkill: async () => 0,
+      syncSymlinks: async () => ({ linked: 0, removed: 0, skipped: 0, verifiedAgentLinks: {} })
+    };
   }
 });
 
@@ -8194,7 +8417,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve18.call(this, root, ref);
+      let _sch = resolve19.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -8221,7 +8444,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve18(root, ref) {
+    function resolve19(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -9051,7 +9274,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve18(baseURI, relativeURI, options) {
+    function resolve19(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -9420,7 +9643,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve18,
+      resolve: resolve19,
       resolveComponent,
       equal,
       serialize,
@@ -13220,12 +13443,12 @@ var require_dist = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats2(ajv, list, fs3, exportName) {
+    function addFormats2(ajv, list, fs4, exportName) {
       var _a;
       var _b;
       (_a = (_b = ajv.opts.code).formats) !== null && _a !== void 0 ? _a : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs3[f]);
+        ajv.addFormat(f, fs4[f]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -27826,8 +28049,8 @@ var require_lib = __commonJS({
 });
 
 // src/cli.js
-import { readFileSync as readFileSync23 } from "node:fs";
-import { dirname as dirname21, join as join25 } from "node:path";
+import { readFileSync as readFileSync25 } from "node:fs";
+import { dirname as dirname24, join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
 
 // node_modules/commander/lib/error.js
@@ -31200,9 +31423,9 @@ var program = new Command();
 
 // src/command-specs/apps.js
 init_errors();
-import { mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, rmSync as rmSync5 } from "node:fs";
+import { mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readdirSync as readdirSync5, rmSync as rmSync5 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { basename as basename3, join as join9, relative as relative3 } from "node:path";
+import { basename as basename3, join as join11, relative as relative3 } from "node:path";
 
 // src/runtime/output.js
 init_errors();
@@ -35899,9 +36122,9 @@ async function composeStoreScreenshot({
 
 // src/runtime/transport.js
 init_errors();
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { dirname as dirname8 } from "node:path";
+import { dirname as dirname10 } from "node:path";
 
 // src/runtime/delegated-context.js
 init_errors();
@@ -35982,7 +36205,7 @@ async function* multipartFileBody(boundary, payload, bindingMetadata, fileBindin
 `);
 }
 function createMultipartFileUpload(payload, bindingMetadata, fileBindings) {
-  const boundary = `----notis-cli-${randomUUID3().replace(/-/g, "")}`;
+  const boundary = `----notis-cli-${randomUUID4().replace(/-/g, "")}`;
   const textParts = [
     multipartTextPart(boundary, "payload", JSON.stringify(payload)),
     multipartTextPart(boundary, "file_bindings", JSON.stringify(bindingMetadata))
@@ -36078,7 +36301,7 @@ function reloadDevJwt(runtime, loadedProfile = null) {
   const expectedUserId = runtime.worktreeRuntime?.expected_user_id;
   const runtimePath = runtime.worktreeRuntime?.runtime_path;
   if (runtimePath) {
-    const refreshedRuntime = resolveWorktreeRuntime(dirname8(runtimePath));
+    const refreshedRuntime = resolveWorktreeRuntime(dirname10(runtimePath));
     if (refreshedRuntime && !refreshedRuntime.unavailable && refreshedRuntime.runtime_path === runtimePath && refreshedRuntime.profile === runtime.profileName && refreshedRuntime.api_base === runtime.apiBase) {
       if (expectedUserId && refreshedRuntime.expected_user_id !== expectedUserId) {
         throw new CliError({
@@ -36157,7 +36380,7 @@ async function httpRequest({
   }
   let controller = new AbortController();
   let timeout = setTimeout(() => controller.abort(), runtime.timeoutMs);
-  const requestId2 = `req_${randomUUID3().replace(/-/g, "")}`;
+  const requestId2 = `req_${randomUUID4().replace(/-/g, "")}`;
   const resetTimeout = () => {
     clearTimeout(timeout);
     controller = new AbortController();
@@ -36283,7 +36506,7 @@ async function callTool({
   idempotencyKey,
   fileBindings = []
 }) {
-  const requestId2 = idempotencyKey || (runtime.mutating ? randomUUID3() : null);
+  const requestId2 = idempotencyKey || (runtime.mutating ? randomUUID4() : null);
   const payload = {
     tool_name: toolName,
     arguments: argumentsPayload,
@@ -36329,7 +36552,7 @@ init_oauth();
 
 // src/command-specs/helpers.js
 init_errors();
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var COMPOSIO_SEARCH_TOOLS = "COMPOSIO_SEARCH_TOOLS";
 var COMPOSIO_GET_TOOL_SCHEMAS = "COMPOSIO_GET_TOOL_SCHEMAS";
 var COMPOSIO_MULTI_EXECUTE_TOOL = "COMPOSIO_MULTI_EXECUTE_TOOL";
@@ -36367,7 +36590,7 @@ function parseMaybeJson(value, label) {
   return parseJson(value, label);
 }
 function nextIdempotencyKey(globalOptions) {
-  return globalOptions.idempotencyKey || randomUUID4();
+  return globalOptions.idempotencyKey || randomUUID5();
 }
 async function runToolCommand({
   runtime,
@@ -36591,7 +36814,7 @@ function pruneStaleScreenshotFiles(outputDir, keepCount) {
     if (!entry.isFile()) continue;
     const match = /^screenshot-(\d+)\.png$/i.exec(entry.name);
     if (match && Number.parseInt(match[1], 10) > keepCount) {
-      rmSync5(join9(outputDir, entry.name), { force: true });
+      rmSync5(join11(outputDir, entry.name), { force: true });
     }
   }
 }
@@ -37076,7 +37299,7 @@ ${listing.errors.map((error) => `  - ${error}`).join("\n")}`);
       browserTouched = true;
       results = [];
       for (const { route, url } of urls) {
-        const snapshotPath = join9(projectDir, ".notis", "output", ".harness", `${route.slug}.snapshot.txt`);
+        const snapshotPath = join11(projectDir, ".notis", "output", ".harness", `${route.slug}.snapshot.txt`);
         const result = await runHarnessRoute({
           url,
           sessionName: browserSessionName,
@@ -37204,7 +37427,7 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
   }
   const width = parsePositiveInt(ctx.options.width) || 2e3;
   const height = parsePositiveInt(ctx.options.height) || 1250;
-  const outputDir = ctx.options.outputDir ? resolveProjectDir(ctx.options.outputDir) : join9(projectDir, "metadata");
+  const outputDir = ctx.options.outputDir ? resolveProjectDir(ctx.options.outputDir) : join11(projectDir, "metadata");
   const port = parsePort(ctx.options.port) || await getAvailablePort();
   const appSlug = slugify(appConfig.name || manifest.app?.name || "app") || "app";
   const baseUrl = `http://127.0.0.1:${port}/a/${appSlug}`;
@@ -37235,7 +37458,7 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
     theme: "light",
     fileName: `screenshot-${screenshotSlots.get(route.slug) || index + 1}.png`
   }));
-  const rawOutputDir = ctx.options.raw ? null : mkdtempSync3(join9(tmpdir2(), "notis-store-screenshots-"));
+  const rawOutputDir = ctx.options.raw ? null : mkdtempSync3(join11(tmpdir2(), "notis-store-screenshots-"));
   let testServer = null;
   let browserTouched = false;
   let cleanupPromise;
@@ -37260,12 +37483,12 @@ ${problems.map((p) => `  - ${p}`).join("\n")}`);
 `)
     });
     browserTouched = true;
-    mkdirSync6(outputDir, { recursive: true });
+    mkdirSync8(outputDir, { recursive: true });
     const results = [];
     for (const capture of captures) {
       const { route, scenario, focus, theme, fileName } = capture;
-      const screenshotPath = join9(outputDir, fileName);
-      const browserScreenshotPath = rawOutputDir ? join9(rawOutputDir, fileName) : screenshotPath;
+      const screenshotPath = join11(outputDir, fileName);
+      const browserScreenshotPath = rawOutputDir ? join11(rawOutputDir, fileName) : screenshotPath;
       const scenarioParam = scenario ? `&scenario=${encodeURIComponent(scenario)}` : "";
       const themeParam = `&theme=${encodeURIComponent(theme || "light")}`;
       const captureSessionName = `${browserSessionName}-${results.length + 1}`;
@@ -38050,7 +38273,7 @@ var appsCommandSpecs = [
 
 // src/command-specs/tools.js
 init_errors();
-import { accessSync, constants as fsConstants2, createReadStream as createReadStream2, existsSync as existsSync8, readFileSync as readFileSync9, statSync as statSync6 } from "node:fs";
+import { accessSync, constants as fsConstants2, createReadStream as createReadStream2, existsSync as existsSync9, readFileSync as readFileSync11, statSync as statSync6 } from "node:fs";
 import { createHash as createHash3 } from "node:crypto";
 import { basename as basename4 } from "node:path";
 async function resolveJsonInput(value, label) {
@@ -38064,10 +38287,10 @@ async function resolveJsonInput(value, label) {
   }
   if (value.startsWith("@")) {
     const filePath = value.slice(1);
-    if (!existsSync8(filePath)) {
+    if (!existsSync9(filePath)) {
       throw usageError(`File not found: ${filePath}`);
     }
-    return parseJson(readFileSync9(filePath, "utf-8"), label);
+    return parseJson(readFileSync11(filePath, "utf-8"), label);
   }
   return parseJson(value, label);
 }
@@ -38265,7 +38488,7 @@ async function parseFileBindingSpec(spec, index) {
   if (!localPath2) {
     throw usageError("--file local path is required");
   }
-  if (!existsSync8(localPath2)) {
+  if (!existsSync9(localPath2)) {
     throw usageError(`File not found: ${localPath2}`);
   }
   let stats;
@@ -38669,7 +38892,7 @@ var toolsCommandSpecs = [
 ];
 
 // src/command-specs/meta.js
-import { dirname as dirname9 } from "node:path";
+import { dirname as dirname11 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // src/runtime/help.js
@@ -38738,7 +38961,7 @@ function doctorToolRoundtripRuntime(runtime) {
     timeoutMs: Math.max(runtime.timeoutMs || 0, DOCTOR_TOOL_ROUNDTRIP_TIMEOUT_MS)
   };
 }
-function doctorChannelSummary(runtime, moduleDirectory = dirname9(fileURLToPath6(import.meta.url))) {
+function doctorChannelSummary(runtime, moduleDirectory = dirname11(fileURLToPath6(import.meta.url))) {
   const decision = resolveChannelSwitch({
     runningVersion: runtime.cliVersion,
     profile: {
@@ -38955,8 +39178,8 @@ init_errors();
 init_auth_recovery();
 init_profiles();
 init_oauth();
-import { readFileSync as readFileSync12 } from "node:fs";
-import { dirname as dirname12, join as join12 } from "node:path";
+import { readFileSync as readFileSync14 } from "node:fs";
+import { dirname as dirname14, join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 
 // src/command-specs/auth.js
@@ -38969,20 +39192,20 @@ import { basename as basename5 } from "node:path";
 // src/runtime/agent-setup.js
 import {
   chmodSync,
-  existsSync as existsSync9,
-  mkdirSync as mkdirSync7,
-  readFileSync as readFileSync10,
+  existsSync as existsSync10,
+  mkdirSync as mkdirSync9,
+  readFileSync as readFileSync12,
   readdirSync as readdirSync6,
-  renameSync as renameSync4,
-  writeFileSync as writeFileSync6
+  renameSync as renameSync6,
+  writeFileSync as writeFileSync8
 } from "node:fs";
 import { createHash as createHash4 } from "node:crypto";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname10, join as join10 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname12, join as join12 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
-var HERE = dirname10(fileURLToPath7(import.meta.url));
-var INSTRUCTIONS_PATH = join10(HERE, "..", "..", "skills", "notis-cli", "AGENT_INSTRUCTIONS.md");
-var HOOK_BUNDLE_PATH = join10(HERE, "..", "..", "dist", "agent-hooks", "notis-agent-hook.mjs");
+var HERE = dirname12(fileURLToPath7(import.meta.url));
+var INSTRUCTIONS_PATH = join12(HERE, "..", "..", "skills", "notis-cli", "AGENT_INSTRUCTIONS.md");
+var HOOK_BUNDLE_PATH = join12(HERE, "..", "..", "dist", "agent-hooks", "notis-agent-hook.mjs");
 var START_MARKER = "<!-- notis-cli:instructions:start -->";
 var END_MARKER = "<!-- notis-cli:instructions:end -->";
 var LEGACY_SENTINEL = "Use the Notis CLI (`npx --package @notis_ai/cli@latest -- notis ...`)";
@@ -38990,20 +39213,20 @@ var MANAGED_HOOK_MARKER = "--notis-managed-agent-hook";
 var LEGACY_MANAGED_HOOK_MARKER = "NOTIS_MANAGED_AGENT_HOOK=1";
 var AGENT_IDS = Object.freeze(["codex", "claude-code"]);
 function atomicWrite(filePath, contents, mode = 384) {
-  mkdirSync7(dirname10(filePath), { recursive: true, mode: 448 });
+  mkdirSync9(dirname12(filePath), { recursive: true, mode: 448 });
   const temporaryPath = `${filePath}.notis-${process.pid}-${Date.now()}.tmp`;
-  writeFileSync6(temporaryPath, contents, { mode });
-  renameSync4(temporaryPath, filePath);
+  writeFileSync8(temporaryPath, contents, { mode });
+  renameSync6(temporaryPath, filePath);
 }
 function readText(filePath) {
-  return existsSync9(filePath) ? readFileSync10(filePath, "utf-8") : "";
+  return existsSync10(filePath) ? readFileSync12(filePath, "utf-8") : "";
 }
 function activeCodexInstructionsPath(home) {
-  const overridePath = join10(home, ".codex", "AGENTS.override.md");
-  if (existsSync9(overridePath) && readText(overridePath).trim()) {
+  const overridePath = join12(home, ".codex", "AGENTS.override.md");
+  if (existsSync10(overridePath) && readText(overridePath).trim()) {
     return overridePath;
   }
-  return join10(home, ".codex", "AGENTS.md");
+  return join12(home, ".codex", "AGENTS.md");
 }
 function upsertInstructionBlock(filePath, block) {
   const existing = readText(filePath);
@@ -39038,8 +39261,8 @@ function upsertInstructionBlock(filePath, block) {
   return { path: filePath, status };
 }
 function readJsonObject(filePath) {
-  if (!existsSync9(filePath)) return {};
-  const raw = readFileSync10(filePath, "utf-8");
+  if (!existsSync10(filePath)) return {};
+  const raw = readFileSync12(filePath, "utf-8");
   try {
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -39086,14 +39309,14 @@ function shellQuote(value) {
   return `'${String(value).replaceAll("'", `'"'"'`)}'`;
 }
 function installManagedHookRuntime({
-  home = homedir4(),
+  home = homedir5(),
   bundlePath: bundlePath2 = HOOK_BUNDLE_PATH,
   nodePath = process.execPath,
   platform = process.platform
 } = {}) {
-  const bundle = readFileSync10(bundlePath2);
+  const bundle = readFileSync12(bundlePath2);
   const digest = createHash4("sha256").update(bundle).digest("hex");
-  const runtimePath = join10(
+  const runtimePath = join12(
     home,
     ".notis",
     "agent-hooks",
@@ -39101,10 +39324,10 @@ function installManagedHookRuntime({
     digest,
     "notis-agent-hook.mjs"
   );
-  const existingDigest = existsSync9(runtimePath) ? createHash4("sha256").update(readFileSync10(runtimePath)).digest("hex") : null;
+  const existingDigest = existsSync10(runtimePath) ? createHash4("sha256").update(readFileSync12(runtimePath)).digest("hex") : null;
   if (existingDigest !== digest) atomicWrite(runtimePath, bundle, 320);
   chmodSync(runtimePath, 320);
-  const launcherPath = join10(
+  const launcherPath = join12(
     home,
     ".notis",
     "agent-hooks",
@@ -39129,7 +39352,7 @@ function installManagedHookRuntime({
     ""
   ].join("\n");
   if (readText(launcherPath) !== launcher) {
-    if (platform === "win32" && existsSync9(launcherPath)) {
+    if (platform === "win32" && existsSync10(launcherPath)) {
       chmodSync(launcherPath, 448);
     }
     atomicWrite(launcherPath, launcher, 320);
@@ -39182,30 +39405,30 @@ function upsertPromptHooks(filePath, agentId, profileName, enabled, launcherPath
   atomicWrite(filePath, serialized);
   return {
     path: filePath,
-    status: enabled ? existsSync9(filePath) && existing ? "updated" : "installed" : "removed"
+    status: enabled ? existsSync10(filePath) && existing ? "updated" : "installed" : "removed"
   };
 }
 function agentPaths(agentId, home) {
   if (agentId === "codex") {
     return {
-      root: join10(home, ".codex"),
+      root: join12(home, ".codex"),
       instructions: activeCodexInstructionsPath(home),
-      hooks: join10(home, ".codex", "hooks.json")
+      hooks: join12(home, ".codex", "hooks.json")
     };
   }
   if (agentId === "claude-code") {
     return {
-      root: join10(home, ".claude"),
-      instructions: join10(home, ".claude", "CLAUDE.md"),
-      hooks: join10(home, ".claude", "settings.json")
+      root: join12(home, ".claude"),
+      instructions: join12(home, ".claude", "CLAUDE.md"),
+      hooks: join12(home, ".claude", "settings.json")
     };
   }
   throw new Error(`Unsupported agent: ${agentId}`);
 }
-function shouldInstallLocalAgentSetup(env = process.env, home = homedir4()) {
+function shouldInstallLocalAgentSetup(env = process.env, home = homedir5()) {
   if (env.NOTIS_JWT || env.NOTIS_AGENT === "1" || env.NOTIS_DELEGATED_CONTEXT === "1") return false;
   if (env.CONDUCTOR_IS_LOCAL === "0") return false;
-  if (existsSync9("/vercel/sandbox")) return false;
+  if (existsSync10("/vercel/sandbox")) return false;
   return Boolean(home);
 }
 function installAgentSetup({
@@ -39214,19 +39437,19 @@ function installAgentSetup({
   memoryHooks = true,
   onlyExisting = false,
   detectedAgents = null,
-  home = homedir4(),
+  home = homedir5(),
   platform = process.platform
 } = {}) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(String(profileName || ""))) {
     throw new Error("A valid authenticated Notis profile is required for agent setup");
   }
-  const instructions = readFileSync10(INSTRUCTIONS_PATH, "utf-8").trim();
+  const instructions = readFileSync12(INSTRUCTIONS_PATH, "utf-8").trim();
   const results = [];
   const shouldRepairManagedHooks = memoryHooks === true || memoryHooks === null && agents.some((agentId) => fileHasManagedNotisHook(agentPaths(agentId, home).hooks));
   const hookRuntime = shouldRepairManagedHooks ? installManagedHookRuntime({ home, platform }) : null;
   for (const agentId of agents) {
     const paths = agentPaths(agentId, home);
-    const detected = Array.isArray(detectedAgents) ? detectedAgents.includes(agentId) : existsSync9(paths.root);
+    const detected = Array.isArray(detectedAgents) ? detectedAgents.includes(agentId) : existsSync10(paths.root);
     if (onlyExisting && !detected) {
       results.push({ agent: agentId, status: "not_detected" });
       continue;
@@ -39264,28 +39487,28 @@ function installAgentSetup({
 // src/runtime/agent-memory-state.js
 import { createHash as createHash5 } from "node:crypto";
 import {
-  existsSync as existsSync10,
-  mkdirSync as mkdirSync8,
-  readFileSync as readFileSync11,
-  renameSync as renameSync5,
-  writeFileSync as writeFileSync7
+  existsSync as existsSync11,
+  mkdirSync as mkdirSync10,
+  readFileSync as readFileSync13,
+  renameSync as renameSync7,
+  writeFileSync as writeFileSync9
 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { dirname as dirname11, join as join11 } from "node:path";
+import { homedir as homedir6 } from "node:os";
+import { dirname as dirname13, join as join13 } from "node:path";
 var MAX_SEEN_HASHES = 500;
 var MAX_PROMPT_CHARS = 12e3;
 function hash(value) {
   return createHash5("sha256").update(String(value || "")).digest("hex").slice(0, 24);
 }
-function statePath(sessionId, home = homedir5()) {
+function statePath(sessionId, home = homedir6()) {
   if (!sessionId) return null;
-  return join11(home, ".notis", "agent-memory-hooks", `${hash(sessionId)}.json`);
+  return join13(home, ".notis", "agent-memory-hooks", `${hash(sessionId)}.json`);
 }
 function readState(sessionId, home) {
   const filePath = statePath(sessionId, home);
-  if (!filePath || !existsSync10(filePath)) return { seen: [], pending: null };
+  if (!filePath || !existsSync11(filePath)) return { seen: [], pending: null };
   try {
-    const parsed = JSON.parse(readFileSync11(filePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync13(filePath, "utf-8"));
     return parsed && typeof parsed === "object" ? {
       seen: Array.isArray(parsed.seen) ? parsed.seen.filter((item) => typeof item === "string") : [],
       pending: parsed.pending && typeof parsed.pending === "object" ? parsed.pending : null,
@@ -39315,13 +39538,13 @@ function stateForInput(sessionId, input, home) {
 function writeState(sessionId, state, home) {
   const filePath = statePath(sessionId, home);
   if (!filePath) return;
-  mkdirSync8(dirname11(filePath), { recursive: true, mode: 448 });
+  mkdirSync10(dirname13(filePath), { recursive: true, mode: 448 });
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync7(temporaryPath, `${JSON.stringify(state)}
+  writeFileSync9(temporaryPath, `${JSON.stringify(state)}
 `, { mode: 384 });
-  renameSync5(temporaryPath, filePath);
+  renameSync7(temporaryPath, filePath);
 }
-function rememberPendingTurn(input, home = homedir5()) {
+function rememberPendingTurn(input, home = homedir6()) {
   const sessionId = input?.session_id;
   const prompt = typeof input?.prompt === "string" ? input.prompt.trim() : "";
   if (!sessionId || !prompt || ["/", "!", "#"].includes(prompt[0])) return;
@@ -39334,7 +39557,7 @@ function rememberPendingTurn(input, home = homedir5()) {
   };
   writeState(sessionId, state, home);
 }
-function pendingTurn(input, home = homedir5()) {
+function pendingTurn(input, home = homedir6()) {
   const sessionId = input?.session_id;
   const state = readState(sessionId, home);
   const identity = inputIdentity(input);
@@ -39346,17 +39569,17 @@ function pendingTurn(input, home = homedir5()) {
   if (state.pending.turn_id && input?.turn_id && state.pending.turn_id !== input.turn_id) return null;
   return state.pending;
 }
-function completePendingTurn(input, home = homedir5()) {
+function completePendingTurn(input, home = homedir6()) {
   const sessionId = input?.session_id;
   if (!sessionId) return;
   const filePath = statePath(sessionId, home);
-  if (!filePath || !existsSync10(filePath)) return;
+  if (!filePath || !existsSync11(filePath)) return;
   const state = readState(sessionId, home);
   if (!state.pending) return;
   state.pending = null;
   writeState(sessionId, state, home);
 }
-function freshRecallItems(input, items, home = homedir5()) {
+function freshRecallItems(input, items, home = homedir6()) {
   const sessionId = input?.session_id;
   if (!sessionId) return items;
   const state = stateForInput(sessionId, input, home);
@@ -39799,8 +40022,8 @@ var authCommandSpecs = [
   },
   {
     command_path: ["logout"],
-    summary: "Revoke and remove the OAuth credential for one CLI profile.",
-    when_to_use: "Use this to disconnect a single account. Other profiles keep their credentials unless you pass --all-profiles.",
+    summary: "Sign this computer out of one CLI profile: revoke and remove its OAuth credential.",
+    when_to_use: "Use this to disconnect a single account on this computer. Its sign-ins on other computers stay, and other profiles keep their credentials unless you pass --all-profiles.",
     args_schema: {
       arguments: [],
       options: [
@@ -39820,8 +40043,8 @@ var authCommandSpecs = [
 ];
 
 // src/command-specs/onboarding.js
-var HERE2 = dirname12(fileURLToPath8(import.meta.url));
-var BUNDLED_BRIEF_PATH = join12(HERE2, "..", "..", "skills", "notis-onboarding", "BRIEF.md");
+var HERE2 = dirname14(fileURLToPath8(import.meta.url));
+var BUNDLED_BRIEF_PATH = join14(HERE2, "..", "..", "skills", "notis-onboarding", "BRIEF.md");
 async function fetchOnboardingState(runtime) {
   try {
     const { payload } = await runToolCommand({
@@ -39862,7 +40085,7 @@ async function fetchBrief(apiBase, timeoutMs) {
   } catch {
   }
   try {
-    return { markdown: readFileSync12(BUNDLED_BRIEF_PATH, "utf-8"), source: "bundled" };
+    return { markdown: readFileSync14(BUNDLED_BRIEF_PATH, "utf-8"), source: "bundled" };
   } catch {
     return { markdown: null, source: null };
   }
@@ -40030,8 +40253,8 @@ var onboardingCommandSpecs = [
 
 // src/command-specs/diagnostics.js
 init_errors();
-import { createHash as createHash7, randomUUID as randomUUID5 } from "node:crypto";
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
+import { createHash as createHash7, randomUUID as randomUUID6 } from "node:crypto";
+import { existsSync as existsSync12, readFileSync as readFileSync15 } from "node:fs";
 var ENTITLEMENT_FIELDS = [
   "created_at",
   "included_credit_seat_count",
@@ -40160,7 +40383,7 @@ async function executeReadOnlySql(ctx, query, phase) {
     // Always a fresh key, never the operator's --idempotency-key: a diagnostic
     // must observe current state rather than replay a cached response, and two
     // different queries under one reused key would collide on the request hash.
-    idempotencyKey: randomUUID5(),
+    idempotencyKey: randomUUID6(),
     sendIdempotencyKeyWhenReading: true
   });
   if (result.payload?.successful === false || result.payload?.error) {
@@ -40441,8 +40664,8 @@ ORDER BY i.created_at ASC;`;
 }
 function traceFileDiagnostics(path3) {
   if (!path3) return null;
-  if (!existsSync11(path3)) throw usageError(`Trace file not found: ${path3}`);
-  const trace = JSON.parse(readFileSync13(path3, "utf-8"));
+  if (!existsSync12(path3)) throw usageError(`Trace file not found: ${path3}`);
+  const trace = JSON.parse(readFileSync15(path3, "utf-8"));
   const text2 = JSON.stringify(trace).toLowerCase();
   const modelCounts = {};
   const generationIds = /* @__PURE__ */ new Set();
@@ -40673,15 +40896,15 @@ var diagnosticCommandSpecs = [
 
 // src/command-specs/smoke.js
 init_errors();
-import { createHash as createHash8, randomUUID as randomUUID6 } from "node:crypto";
+import { createHash as createHash8, randomUUID as randomUUID7 } from "node:crypto";
 import {
   mkdtempSync as mkdtempSync4,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync16,
   rmSync as rmSync6,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync10
 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { basename as basename6, join as join13 } from "node:path";
+import { basename as basename6, join as join15 } from "node:path";
 import { setTimeout as delay2 } from "node:timers/promises";
 function discoveryNames(payload) {
   return [...new Set(
@@ -40762,12 +40985,12 @@ function remotePath(folder, name) {
   return `${normalizedFolder}/${name}`;
 }
 async function smokeFileUploadHandler(ctx) {
-  const tempDir = mkdtempSync4(join13(tmpdir3(), "notis-smoke-file-upload-"));
-  const marker = `${(/* @__PURE__ */ new Date()).toISOString().replaceAll(/[-:.]/g, "")}-${randomUUID6().slice(0, 8)}`;
+  const tempDir = mkdtempSync4(join15(tmpdir3(), "notis-smoke-file-upload-"));
+  const marker = `${(/* @__PURE__ */ new Date()).toISOString().replaceAll(/[-:.]/g, "")}-${randomUUID7().slice(0, 8)}`;
   const generatedFixture = !ctx.options.sourceFile;
-  const fixturePath = ctx.options.sourceFile || join13(tempDir, `notis-file-upload-${marker}.txt`);
+  const fixturePath = ctx.options.sourceFile || join15(tempDir, `notis-file-upload-${marker}.txt`);
   if (generatedFixture) {
-    writeFileSync8(
+    writeFileSync10(
       fixturePath,
       `Notis Dropbox file-upload smoke
 marker=${marker}
@@ -40777,7 +41000,7 @@ unicode=\xE9t\xE9 Z\xFCrich \u6771\u4EAC
     );
   }
   const localHash = await hashFileSha256(fixturePath);
-  const localBytes = readFileSync14(fixturePath);
+  const localBytes = readFileSync16(fixturePath);
   const destination = remotePath(
     ctx.options.remoteFolder,
     `notis-file-upload-${marker}-${basename6(fixturePath)}`
@@ -41020,9 +41243,11 @@ var smokeCommandSpecs = [
 ];
 
 // src/command-specs/profile.js
+init_channel();
 init_errors();
 init_auth_recovery();
 init_profiles();
+import { spawn as spawn4 } from "node:child_process";
 function describeProfile(config, name, worktreeRuntime) {
   const entry = listProfiles(config).find((candidate) => candidate.name === name);
   if (worktreeRuntime?.profile === name) {
@@ -41099,6 +41324,33 @@ async function listHandler(ctx) {
     ]
   });
 }
+var SKILL_SYNC_API_BASE_PATTERN = /^https:\/\/api(?:-beta)?\.notis\.ai\/?$/;
+var RELINK_DROPPED_ENV = ["NOTIS_JWT", "NOTIS_API_BASE", "NOTIS_PROFILE", CHANNEL_SWITCH_ENV];
+function relinkSkillsInBackground(name, profile, {
+  env = process.env,
+  argv = process.argv,
+  execPath = process.execPath,
+  spawnImpl = spawn4
+} = {}) {
+  if (env.NODE_ENV === "test" || env.NODE_TEST_CONTEXT || !argv[1]) return false;
+  if (!profile?.oauth_access_token && !profile?.oauth_refresh_token) return false;
+  if (!SKILL_SYNC_API_BASE_PATTERN.test(String(profile.api_base || ""))) return false;
+  const childEnv = { ...env };
+  for (const key2 of RELINK_DROPPED_ENV) delete childEnv[key2];
+  try {
+    const child = spawnImpl(
+      execPath,
+      [argv[1], "skills", "sync", "--json", "--profile", name],
+      { detached: true, stdio: "ignore", env: childEnv }
+    );
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function useHandler(ctx) {
   const requested = ctx.args.name;
   const config = loadConfig();
@@ -41114,6 +41366,7 @@ async function useHandler(ctx) {
   const worktreeOverride = Boolean(worktreeRuntime);
   const worktreeBlocked = Boolean(worktreeUnavailable);
   const authenticated = profileHasCredential(profile);
+  if (authenticated) relinkSkillsInBackground(requested, profile);
   return ctx.output.emitSuccess({
     command: ctx.spec.command_path.join(" "),
     data: {
@@ -41242,7 +41495,7 @@ var profileCommandSpecs = [
   {
     command_path: ["profile", "use"],
     summary: "Switch the default profile without signing any profile out.",
-    when_to_use: "Use this to change which account and API subsequent commands target. Every other profile keeps its credential.",
+    when_to_use: "Use this to change which account and API subsequent commands target. Every other profile keeps its credential. Its skills replace the previous default's in the agent folders (Claude Code, Codex, Cursor) straight away.",
     args_schema: {
       arguments: [{ token: "<name>", key: "name", description: "Profile to make active." }],
       options: []
@@ -41305,8 +41558,8 @@ init_errors();
 // src/runtime/git.js
 init_errors();
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { lstatSync as lstatSync2, readFileSync as readFileSync15 } from "node:fs";
-import { basename as basename7, relative as relative4, resolve as resolve7, sep as sep2 } from "node:path";
+import { lstatSync as lstatSync2, readFileSync as readFileSync17 } from "node:fs";
+import { basename as basename7, relative as relative4, resolve as resolve8, sep as sep2 } from "node:path";
 var GIT_TIMEOUT_MS = 12e4;
 var MAX_SECRET_SCAN_BYTES = 1e6;
 var SAFE_ENV_TEMPLATES = /^\.env\.(?:example|sample|template)$/i;
@@ -41360,10 +41613,10 @@ function filesToAutoCommit(repository) {
   ])];
 }
 function sensitiveAutoCommitFiles(repository) {
-  const root = resolve7(repository.toplevel);
+  const root = resolve8(repository.toplevel);
   const sensitive = [];
   for (const path3 of filesToAutoCommit(repository)) {
-    const absolute = resolve7(root, path3);
+    const absolute = resolve8(root, path3);
     const insideRoot = relative4(root, absolute);
     if (insideRoot === ".." || insideRoot.startsWith(`..${sep2}`) || insideRoot === "") continue;
     const name = basename7(path3);
@@ -41374,7 +41627,7 @@ function sensitiveAutoCommitFiles(repository) {
     try {
       const stat2 = lstatSync2(absolute);
       if (!stat2.isFile() || stat2.size > MAX_SECRET_SCAN_BYTES) continue;
-      const content = readFileSync15(absolute, "utf8");
+      const content = readFileSync17(absolute, "utf8");
       if (SENSITIVE_CONTENT.some((pattern) => pattern.test(content))) sensitive.push(path3);
     } catch {
     }
@@ -41772,98 +42025,98 @@ var handoverCommandSpecs = [
 init_profiles();
 
 // src/runtime/sync-skills.js
-import { createHash as createHash9, randomUUID as randomUUID7 } from "node:crypto";
+import { createHash as createHash9, randomUUID as randomUUID8 } from "node:crypto";
 import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
-import { homedir as homedir7 } from "node:os";
-import { dirname as dirname14, join as join15 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { dirname as dirname16, join as join17 } from "node:path";
 
 // src/runtime/base-skills.js
 import {
   cpSync as cpSync2,
-  existsSync as existsSync12,
+  existsSync as existsSync13,
   lstatSync as lstatSync3,
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync11,
   readlinkSync,
-  renameSync as renameSync6,
+  renameSync as renameSync8,
   rmSync as rmSync7,
   symlinkSync
 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { dirname as dirname13, join as join14, relative as relative5, resolve as resolve8 } from "node:path";
+import { homedir as homedir7 } from "node:os";
+import { dirname as dirname15, join as join16, relative as relative5, resolve as resolve9 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 var BASE_SKILL_NAMES = Object.freeze([
   "notis-apps",
   "notis-query",
   "notis-cli"
 ]);
-var HERE3 = dirname13(fileURLToPath9(import.meta.url));
+var HERE3 = dirname15(fileURLToPath9(import.meta.url));
 function resolveBundledBaseSkillsRoot({ resourcesPath = process.resourcesPath } = {}) {
-  const sourceCheckout = resolve8(HERE3, "../../../../server/skills");
-  const packaged = resolve8(HERE3, "../../dist/base-skills");
-  const desktopResource = resourcesPath ? join14(resourcesPath, "base-skills") : null;
+  const sourceCheckout = resolve9(HERE3, "../../../../server/skills");
+  const packaged = resolve9(HERE3, "../../dist/base-skills");
+  const desktopResource = resourcesPath ? join16(resourcesPath, "base-skills") : null;
   const desktopPackagerRoot = resourcesPath || null;
   for (const candidate of [sourceCheckout, packaged, desktopResource, desktopPackagerRoot]) {
-    if (candidate && BASE_SKILL_NAMES.every((name) => existsSync12(join14(candidate, name, "SKILL.md")))) {
+    if (candidate && BASE_SKILL_NAMES.every((name) => existsSync13(join16(candidate, name, "SKILL.md")))) {
       return candidate;
     }
   }
   return packaged;
 }
-function getBaseSkillPaths({ home = homedir6(), userId = null } = {}) {
-  const notisRoot = join14(home, ".notis", "skills");
+function getBaseSkillPaths({ home = homedir7(), userId = null } = {}) {
+  const notisRoot = join16(home, ".notis", "skills");
   const targetRoots = [
-    join14(home, ".agents", "skills"),
-    join14(home, ".codex", "skills"),
-    join14(home, ".cursor", "skills"),
-    join14(home, ".claude", "skills")
+    join16(home, ".agents", "skills"),
+    join16(home, ".codex", "skills"),
+    join16(home, ".cursor", "skills"),
+    join16(home, ".claude", "skills")
   ];
   if (userId) {
-    targetRoots.push(join14(notisRoot, "users", userId, "skills"));
+    targetRoots.push(join16(notisRoot, "users", userId, "skills"));
   }
   return {
-    baseRoot: join14(notisRoot, "base"),
-    backupRoot: join14(notisRoot, "backups"),
+    baseRoot: join16(notisRoot, "base"),
+    backupRoot: join16(notisRoot, "backups"),
     targetRoots
   };
 }
 function sameLinkTarget(linkPath, expectedTarget) {
   try {
     if (!lstatSync3(linkPath).isSymbolicLink()) return false;
-    return resolve8(dirname13(linkPath), readlinkSync(linkPath)) === resolve8(expectedTarget);
+    return resolve9(dirname15(linkPath), readlinkSync(linkPath)) === resolve9(expectedTarget);
   } catch {
     return false;
   }
 }
 function backupConflict(linkPath, backupRoot, targetLabel, skillName, now) {
-  const backupPath = join14(backupRoot, String(now), targetLabel, skillName);
-  mkdirSync9(dirname13(backupPath), { recursive: true, mode: 448 });
-  renameSync6(linkPath, backupPath);
+  const backupPath = join16(backupRoot, String(now), targetLabel, skillName);
+  mkdirSync11(dirname15(backupPath), { recursive: true, mode: 448 });
+  renameSync8(linkPath, backupPath);
   return backupPath;
 }
 function replaceDirectory(source, destination) {
-  mkdirSync9(dirname13(destination), { recursive: true, mode: 448 });
+  mkdirSync11(dirname15(destination), { recursive: true, mode: 448 });
   const temporary = `${destination}.tmp-${process.pid}-${Date.now()}`;
   const previous = `${destination}.previous-${process.pid}-${Date.now()}`;
   rmSync7(temporary, { recursive: true, force: true });
   cpSync2(source, temporary, { recursive: true });
   let movedPrevious = false;
   try {
-    if (existsSync12(destination)) {
-      renameSync6(destination, previous);
+    if (existsSync13(destination)) {
+      renameSync8(destination, previous);
       movedPrevious = true;
     }
-    renameSync6(temporary, destination);
+    renameSync8(temporary, destination);
     if (movedPrevious) rmSync7(previous, { recursive: true, force: true });
   } catch (error) {
     rmSync7(temporary, { recursive: true, force: true });
-    if (movedPrevious && !existsSync12(destination) && existsSync12(previous)) {
-      renameSync6(previous, destination);
+    if (movedPrevious && !existsSync13(destination) && existsSync13(previous)) {
+      renameSync8(previous, destination);
     }
     throw error;
   }
 }
 function reconcileBaseSkills({
-  home = homedir6(),
+  home = homedir7(),
   userId = null,
   sourceRoot = resolveBundledBaseSkillsRoot(),
   now = Date.now()
@@ -41877,24 +42130,24 @@ function reconcileBaseSkills({
     skills: [...BASE_SKILL_NAMES]
   };
   for (const name of BASE_SKILL_NAMES) {
-    const source = join14(sourceRoot, name);
-    if (!existsSync12(join14(source, "SKILL.md"))) {
+    const source = join16(sourceRoot, name);
+    if (!existsSync13(join16(source, "SKILL.md"))) {
       throw new Error(`Bundled base skill is missing: ${name}`);
     }
-    replaceDirectory(source, join14(paths.baseRoot, name));
+    replaceDirectory(source, join16(paths.baseRoot, name));
     result.installed += 1;
   }
   for (const targetRoot of paths.targetRoots) {
-    mkdirSync9(targetRoot, { recursive: true, mode: 448 });
+    mkdirSync11(targetRoot, { recursive: true, mode: 448 });
     const targetLabel = relative5(home, targetRoot).replaceAll("/", "_") || "home";
     for (const name of BASE_SKILL_NAMES) {
-      const skillTarget2 = join14(paths.baseRoot, name);
-      const linkPath = join14(targetRoot, name);
+      const skillTarget2 = join16(paths.baseRoot, name);
+      const linkPath = join16(targetRoot, name);
       if (sameLinkTarget(linkPath, skillTarget2)) {
         result.unchanged += 1;
         continue;
       }
-      if (existsSync12(linkPath) || (() => {
+      if (existsSync13(linkPath) || (() => {
         try {
           lstatSync3(linkPath);
           return true;
@@ -41923,7 +42176,7 @@ var DEFAULT_LOCK_POLL_MS = 50;
 async function lockSnapshot(lockDirectory) {
   try {
     const [raw, metadata] = await Promise.all([
-      readFile(join15(lockDirectory, "owner"), "utf8").catch(() => ""),
+      readFile(join17(lockDirectory, "owner"), "utf8").catch(() => ""),
       stat(lockDirectory)
     ]);
     let owner = {};
@@ -41956,14 +42209,14 @@ function processIsAlive2(pid) {
   }
 }
 function delay3(milliseconds) {
-  return new Promise((resolve18) => setTimeout(resolve18, milliseconds));
+  return new Promise((resolve19) => setTimeout(resolve19, milliseconds));
 }
 async function quarantineStaleLock(lockDirectory, snapshot) {
-  const quarantineRoot = join15(dirname14(lockDirectory), ".stale-operation-locks");
+  const quarantineRoot = join17(dirname16(lockDirectory), ".stale-operation-locks");
   const snapshotToken = createHash9("sha256").update(JSON.stringify(snapshot)).digest("hex");
   await mkdir(quarantineRoot, { recursive: true, mode: 448 });
   try {
-    await rename(lockDirectory, join15(quarantineRoot, snapshotToken));
+    await rename(lockDirectory, join17(quarantineRoot, snapshotToken));
     return true;
   } catch (error) {
     if (["EEXIST", "ENOTEMPTY", "ENOENT"].includes(error?.code)) return false;
@@ -41971,16 +42224,16 @@ async function quarantineStaleLock(lockDirectory, snapshot) {
   }
 }
 async function writeLockOwnerAtomically(lockDirectory, owner) {
-  const temporaryOwnerPath = join15(lockDirectory, `.owner.${owner.id}.tmp`);
-  const ownerPath = join15(lockDirectory, "owner");
+  const temporaryOwnerPath = join17(lockDirectory, `.owner.${owner.id}.tmp`);
+  const ownerPath = join17(lockDirectory, "owner");
   await writeFile(temporaryOwnerPath, JSON.stringify(owner), { mode: 384 });
   await rename(temporaryOwnerPath, ownerPath);
 }
 async function releaseOwnedLock(lockDirectory, ownerId) {
   const owner = await lockSnapshot(lockDirectory);
   if (owner?.id !== ownerId) return;
-  const quarantineRoot = join15(dirname14(lockDirectory), ".stale-operation-locks");
-  const releasedDirectory = join15(quarantineRoot, `released.${ownerId}`);
+  const quarantineRoot = join17(dirname16(lockDirectory), ".stale-operation-locks");
+  const releasedDirectory = join17(quarantineRoot, `released.${ownerId}`);
   await mkdir(quarantineRoot, { recursive: true, mode: 448 });
   try {
     await rename(lockDirectory, releasedDirectory);
@@ -41991,16 +42244,16 @@ async function releaseOwnedLock(lockDirectory, ownerId) {
   await rm(releasedDirectory, { recursive: true, force: true });
 }
 async function withSkillSyncLock(callback, {
-  home = homedir7(),
+  home = homedir8(),
   timeoutMs = DEFAULT_LOCK_TIMEOUT_MS,
   staleMs = DEFAULT_LOCK_STALE_MS,
   pollMs = DEFAULT_LOCK_POLL_MS,
   now = () => Date.now()
 } = {}) {
-  const lockDirectory = join15(home, ".notis", "skills", ".operation-lock");
-  const ownerId = `${process.pid}.${randomUUID7()}`;
+  const lockDirectory = join17(home, ".notis", "skills", ".operation-lock");
+  const ownerId = `${process.pid}.${randomUUID8()}`;
   const deadline = now() + timeoutMs;
-  await mkdir(dirname14(lockDirectory), { recursive: true, mode: 448 });
+  await mkdir(dirname16(lockDirectory), { recursive: true, mode: 448 });
   for (; ; ) {
     try {
       await mkdir(lockDirectory, { mode: 448 });
@@ -42036,7 +42289,7 @@ async function withSkillSyncLock(callback, {
   let heartbeatInFlight = Promise.resolve();
   const refreshHeartbeat = async () => {
     if (heartbeatStopped) return;
-    const temporaryOwnerPath = join15(lockDirectory, `.owner.${ownerId}.tmp`);
+    const temporaryOwnerPath = join17(lockDirectory, `.owner.${ownerId}.tmp`);
     await writeFile(
       temporaryOwnerPath,
       JSON.stringify({ id: ownerId, pid: process.pid, at: now() }),
@@ -42047,7 +42300,7 @@ async function withSkillSyncLock(callback, {
       await rm(temporaryOwnerPath, { force: true });
       return;
     }
-    await rename(temporaryOwnerPath, join15(lockDirectory, "owner"));
+    await rename(temporaryOwnerPath, join17(lockDirectory, "owner"));
   };
   const heartbeat = setInterval(() => {
     heartbeatInFlight = heartbeatInFlight.then(refreshHeartbeat).catch(() => void 0);
@@ -42070,15 +42323,20 @@ async function reconcileAllSkills({
   home,
   runAccountSync,
   reconcileBase = reconcileBaseSkills,
-  lockOptions = {}
+  lockOptions = {},
+  linkAgentFolders = true
 }) {
   return withSkillSyncLock(async () => {
-    const base = reconcileBase({ userId, ...home ? { home } : {} });
+    const base = linkAgentFolders ? reconcileBase({ userId, ...home ? { home } : {} }) : { skills: [], installed: 0, linked: 0, unchanged: 0, backups: [] };
     const account = await runAccountSync(
       serverUrl,
       jwt,
       {},
-      { honorSyncEnabled, ...home ? { syncHome: home } : {} }
+      {
+        honorSyncEnabled,
+        ...home ? { syncHome: home } : {},
+        ...linkAgentFolders ? {} : { linkAgentFolders: false }
+      }
     );
     return {
       ...account,
@@ -42097,17 +42355,17 @@ init_oauth();
 init_profiles();
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync16, renameSync as renameSync7, writeFileSync as writeFileSync9 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname15, join as join17 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync12, readFileSync as readFileSync18, renameSync as renameSync9, writeFileSync as writeFileSync11 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { dirname as dirname18, join as join19 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 var SKILL_SYNC_SERVICE_LABEL = "ai.notis.skills-sync";
 var bundlePath = fileURLToPath10(new URL("../../dist/skill-sync-worker.mjs", import.meta.url));
 function atomicWrite2(target, value, mode = 384) {
-  mkdirSync10(dirname15(target), { recursive: true, mode: 448 });
+  mkdirSync12(dirname18(target), { recursive: true, mode: 448 });
   const temporary = `${target}.${process.pid}.tmp`;
-  writeFileSync9(temporary, value, { mode });
-  renameSync7(temporary, target);
+  writeFileSync11(temporary, value, { mode });
+  renameSync9(temporary, target);
 }
 function xml(value) {
   return String(value).replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
@@ -42119,9 +42377,9 @@ async function maybeInstallSkillSyncService(runtime, {
   refresh
 } = {}) {
   if (process.platform !== "darwin" || runtime.credentialKind !== "oauth" || config.current_profile !== runtime.profileName || !["https://api.notis.ai", "https://api-beta.notis.ai"].includes(runtime.apiBase)) return;
-  const plist = join17(homedir8(), "Library", "LaunchAgents", `${SKILL_SYNC_SERVICE_LABEL}.plist`);
-  if (existsSync13(plist)) {
-    const saved = readFileSync16(plist, "utf8");
+  const plist = join19(homedir9(), "Library", "LaunchAgents", `${SKILL_SYNC_SERVICE_LABEL}.plist`);
+  if (existsSync14(plist)) {
+    const saved = readFileSync18(plist, "utf8");
     if (runtime.oauthUserId && [runtime.profileName, runtime.apiBase, runtime.oauthUserId].every((value) => saved.includes(`<string>${xml(value)}</string>`))) return install(runtime);
     return;
   }
@@ -42142,7 +42400,7 @@ async function installSkillSyncService(runtime, options = {}) {
   );
 }
 async function installSkillSyncServiceLocked(runtime, {
-  home = homedir8(),
+  home = homedir9(),
   platform = process.platform,
   nodePath = process.execPath,
   source = bundlePath,
@@ -42153,11 +42411,11 @@ async function installSkillSyncServiceLocked(runtime, {
   if (runtime.credentialKind !== "oauth" || runtime.envCredentialOverride || !isValidProfileName(runtime.profileName) || !["https://api.notis.ai", "https://api-beta.notis.ai"].includes(runtime.apiBase)) {
     return { status: "skipped_non_personal_profile" };
   }
-  const root = join17(home, ".notis", "skills", "service");
-  const bundle = readFileSync16(source);
+  const root = join19(home, ".notis", "skills", "service");
+  const bundle = readFileSync18(source);
   const digest = createHash11("sha256").update(bundle).digest("hex");
-  const installedBundle = join17(root, "runtime", digest, "worker.mjs");
-  if (!existsSync13(installedBundle) || !readFileSync16(installedBundle).equals(bundle)) atomicWrite2(installedBundle, bundle, 320);
+  const installedBundle = join19(root, "runtime", digest, "worker.mjs");
+  if (!existsSync14(installedBundle) || !readFileSync18(installedBundle).equals(bundle)) atomicWrite2(installedBundle, bundle, 320);
   const args = [nodePath, installedBundle, runtime.profileName, runtime.apiBase, runtime.oauthUserId];
   if (!runtime.oauthUserId) return { status: "skipped_missing_account" };
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
@@ -42170,10 +42428,10 @@ async function installSkillSyncServiceLocked(runtime, {
 <key>ProcessType</key><string>Background</string>
 </dict></plist>
 `;
-  const plistPath = join17(home, "Library", "LaunchAgents", `${SKILL_SYNC_SERVICE_LABEL}.plist`);
+  const plistPath = join19(home, "Library", "LaunchAgents", `${SKILL_SYNC_SERVICE_LABEL}.plist`);
   const domain = `gui/${uid}`;
   const target = `${domain}/${SKILL_SYNC_SERVICE_LABEL}`;
-  const unchanged = existsSync13(plistPath) && readFileSync16(plistPath, "utf8") === plist;
+  const unchanged = existsSync14(plistPath) && readFileSync18(plistPath, "utf8") === plist;
   const loaded = run("/bin/launchctl", ["print", target], { encoding: "utf8", timeout: 5e3 });
   if (unchanged && loaded.status === 0) return { status: "installed", intervalSeconds: 60, profile: runtime.profileName };
   if (loaded.status === 0) {
@@ -42185,15 +42443,15 @@ async function installSkillSyncServiceLocked(runtime, {
   for (let attempt = 0; attempt < 10; attempt++) {
     started = run("/bin/launchctl", ["bootstrap", domain, plistPath], { encoding: "utf8", timeout: 5e3 });
     if (started.status === 0) break;
-    await new Promise((resolve18) => setTimeout(resolve18, 100));
+    await new Promise((resolve19) => setTimeout(resolve19, 100));
   }
   if (started?.status !== 0) throw new Error("Could not register automatic skill sync with macOS");
   return { status: "installed", intervalSeconds: 60, profile: runtime.profileName };
 }
 
 // src/command-specs/skills.js
-import { readFileSync as readFileSync17 } from "node:fs";
-import { resolve as resolve9 } from "node:path";
+import { readFileSync as readFileSync19 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
 init_errors();
 async function nativeSkillAuthoring(ctx, body, path3 = "/portal_skills/native-authoring") {
   const spaceTarget = Boolean(body.target?.space_id || body.destination?.space_id || body.links);
@@ -42263,6 +42521,14 @@ function linkEntries(value, option, required, optional = []) {
 async function loadSkillSyncEngine() {
   return Promise.resolve().then(() => (init_skill_sync(), skill_sync_exports));
 }
+function cliDefaultOwnsAgentFolders(runtime) {
+  if (runtime.profileSource !== "explicit" || !runtime.profileName) return true;
+  try {
+    return runtime.profileName === getCurrentProfileName(loadConfig());
+  } catch {
+    return true;
+  }
+}
 async function syncSkillsHandler(ctx, {
   refresh = ensureFreshOAuthCredential,
   loadEngine = loadSkillSyncEngine,
@@ -42278,6 +42544,9 @@ async function syncSkillsHandler(ctx, {
     jwt: ctx.runtime.jwt,
     userId: settings.user_id || userId,
     honorSyncEnabled: Boolean(ctx.options.electronRepeat),
+    // Only the CLI default's skills go into the agent folders; another profile
+    // syncs its own folder.
+    linkAgentFolders: cliDefaultOwnsAgentFolders(ctx.runtime),
     runAccountSync: (serverUrl, jwt, dependencies, options) => runSkillSync2(
       serverUrl,
       jwt,
@@ -42358,7 +42627,7 @@ var skillsCommandSpecs = [
     require_auth: true,
     backend_call: { type: "http", path: "/portal_skills/native-create" },
     handler(ctx) {
-      const payload = parseJson(readFileSync17(resolve9(ctx.args.file), "utf8"), "Skill creation file");
+      const payload = parseJson(readFileSync19(resolve10(ctx.args.file), "utf8"), "Skill creation file");
       if (!payload || typeof payload !== "object" || Array.isArray(payload) || Object.keys(payload).some((key2) => !["destination", "name", "description", "skill_md", "files"].includes(key2))) {
         throw usageError("Provide a name, complete instructions or files, and an optional current destination; never override ownership.");
       }
@@ -42404,7 +42673,7 @@ var skillsCommandSpecs = [
     require_auth: true,
     backend_call: { type: "http", path: "/portal_skills/native-settings" },
     handler(ctx) {
-      const payload = parseJson(readFileSync17(resolve9(ctx.args.file), "utf8"), "Skill settings file");
+      const payload = parseJson(readFileSync19(resolve10(ctx.args.file), "utf8"), "Skill settings file");
       if (!payload || typeof payload !== "object" || Array.isArray(payload) || Object.keys(payload).sort().join(",") !== "patch,revision,target" || !payload.target || Object.keys(payload.target).sort().join(",") !== "access_revision,skill_id") {
         throw usageError("Use a current standalone target, settings revision and personal settings patch.");
       }
@@ -42456,7 +42725,7 @@ var skillsCommandSpecs = [
     require_auth: true,
     backend_call: { type: "http", path: "/portal_skills/native-authoring" },
     handler(ctx) {
-      const payload = parseJson(readFileSync17(resolve9(ctx.args.file), "utf8"), "Skill edit file");
+      const payload = parseJson(readFileSync19(resolve10(ctx.args.file), "utf8"), "Skill edit file");
       if (!payload || typeof payload !== "object" || Array.isArray(payload) || Object.keys(payload).some((key2) => !["target", "version", "skill_md", "files", "name", "description", "links"].includes(key2))) {
         throw usageError("Use an exact target, version, skill_md or files, and optional links; never override ownership.");
       }
@@ -42529,8 +42798,8 @@ var skillsCommandSpecs = [
 ];
 
 // src/runtime/space-collection-scaffold.js
-import { writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "node:fs";
-import { join as join18 } from "node:path";
+import { writeFileSync as writeFileSync12, mkdirSync as mkdirSync13 } from "node:fs";
+import { join as join20 } from "node:path";
 
 // src/runtime/space-view-manifest.js
 init_errors();
@@ -42838,8 +43107,8 @@ async function scaffoldSpaceCollection({ projectDir, name, databaseKey, path: pa
   if (typeof name !== "string" || !name.trim() || typeof titleProperty !== "string" || !titleProperty.trim()) throw usageError("Choose a Space name and title property.");
   validateViewPath(path3);
   await scaffoldProject({ projectDir, appName: name });
-  mkdirSync11(join18(projectDir, "spaces", "collection"), { recursive: true });
-  writeFileSync10(join18(projectDir, "notis.config.ts"), `import { defineSpaces } from '@notis/sdk/config';
+  mkdirSync13(join20(projectDir, "spaces", "collection"), { recursive: true });
+  writeFileSync12(join20(projectDir, "notis.config.ts"), `import { defineSpaces } from '@notis/sdk/config';
 export default defineSpaces({ spaces: { collection: { definition: 'spaces/collection/space.config.ts' } } });
 `);
   const definition = {
@@ -42863,11 +43132,11 @@ export default defineSpaces({ spaces: { collection: { definition: 'spaces/collec
       properties: { request: { type: "object" } }
     }, arguments: { database_id: { $asset: "items" }, request: { $input: "request" } } } }
   };
-  writeFileSync10(join18(projectDir, "spaces/collection/space.config.ts"), `import { defineSpace } from '@notis/sdk/config';
+  writeFileSync12(join20(projectDir, "spaces/collection/space.config.ts"), `import { defineSpace } from '@notis/sdk/config';
 export default defineSpace(${JSON.stringify(definition, null, 2)});
 `);
-  writeFileSync10(join18(projectDir, "spaces/collection/view.tsx"), COLLECTION_VIEW);
-  writeFileSync10(join18(projectDir, "spaces/collection/verification.json"), JSON.stringify({
+  writeFileSync12(join20(projectDir, "spaces/collection/view.tsx"), COLLECTION_VIEW);
+  writeFileSync12(join20(projectDir, "spaces/collection/verification.json"), JSON.stringify({
     actions: {},
     shown: { items: [{ params: {}, result: { rows: [], has_more: false, schema_revision: 1 } }] }
   }, null, 2) + "\n");
@@ -42907,13 +43176,13 @@ export default function CollectionView() {
 `;
 
 // src/runtime/space-platform.js
-import { existsSync as existsSync14, mkdirSync as mkdirSync12, readFileSync as readFileSync18, symlinkSync as symlinkSync2, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname17, join as join20, relative as relative7, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync14, readFileSync as readFileSync20, symlinkSync as symlinkSync2, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname20, join as join22, relative as relative7, resolve as resolve12 } from "node:path";
 
 // src/runtime/space-source.js
 import { createRequire as createRequire3 } from "node:module";
 import { realpathSync as realpathSync2 } from "node:fs";
-import { dirname as dirname16, extname as extname2, join as join19, relative as relative6, resolve as resolve10, sep as sep3 } from "node:path";
+import { dirname as dirname19, extname as extname2, join as join21, relative as relative6, resolve as resolve11, sep as sep3 } from "node:path";
 init_errors();
 var CONFIG_FIELDS = /* @__PURE__ */ new Set(["name", "description", "icon", "accent", "entry", "layout", "readableContext", "resources", "actions", "navigation", "viewerReads", "cloudComputer", "collection", "sourceIncludes", "verificationFixtures", ...VIEW_DEFINITION_FIELDS]);
 var VIEWER_READ_FAMILIES = Object.freeze(["databases", "skills"]);
@@ -42934,25 +43203,25 @@ var ROOT_CONFIGS = [
   "tailwind.config.mjs"
 ];
 function sourceCompiler(projectDir, files) {
-  const require3 = createRequire3(join19(projectDir, "package.json"));
+  const require3 = createRequire3(join21(projectDir, "package.json"));
   let ts;
   try {
     ts = require3("typescript");
   } catch {
     throw usageError("Install this workspace's TypeScript dependency before packaging Space source.");
   }
-  const codeFiles = Object.keys(files).filter((path3) => /\.[cm]?[jt]sx?$/.test(path3)).map((path3) => join19(projectDir, path3));
+  const codeFiles = Object.keys(files).filter((path3) => /\.[cm]?[jt]sx?$/.test(path3)).map((path3) => join21(projectDir, path3));
   let source, checker, syntax, close = () => {
   };
   if (typeof ts.createProgram === "function") {
     let options = { moduleResolution: ts.ModuleResolutionKind.Bundler, allowJs: true };
     if (files["tsconfig.json"]) {
-      const config = ts.readConfigFile(join19(projectDir, "tsconfig.json"), ts.sys.readFile);
+      const config = ts.readConfigFile(join21(projectDir, "tsconfig.json"), ts.sys.readFile);
       if (config.error) throw usageError("Fix tsconfig.json before building this Space.");
       options = { ...options, ...ts.parseJsonConfigFileContent(config.config, ts.sys, projectDir).options, allowJs: true };
     }
     const program3 = ts.createProgram(codeFiles, options), projectChecker = program3.getTypeChecker();
-    source = (file) => program3.getSourceFile(join19(projectDir, file));
+    source = (file) => program3.getSourceFile(join21(projectDir, file));
     checker = () => projectChecker;
     syntax = ts.SyntaxKind;
   } else {
@@ -42961,8 +43230,8 @@ function sourceCompiler(projectDir, files) {
     const api = new API({ cwd: projectDir });
     try {
       const snapshot = api.updateSnapshot({ openFiles: codeFiles });
-      const project = (file) => snapshot.getDefaultProjectForFile(join19(projectDir, file));
-      source = (file) => project(file)?.program.getSourceFile(join19(projectDir, file));
+      const project = (file) => snapshot.getDefaultProjectForFile(join21(projectDir, file));
+      source = (file) => project(file)?.program.getSourceFile(join21(projectDir, file));
       checker = (file) => project(file)?.checker;
       close = () => {
         try {
@@ -43036,7 +43305,7 @@ async function loadSelectedSpace(projectDir, selectedKey) {
   }
   const resolveDefinitionPath = (value) => {
     if (typeof value !== "string" || !value || value.startsWith("/") || value.includes("\\") || value.includes("\0")) throw usageError("Use a workspace-relative source path.");
-    return localPath(relative6(projectDir, resolve10(projectDir, dirname16(definitionPath), value)).split(sep3).join("/"));
+    return localPath(relative6(projectDir, resolve11(projectDir, dirname19(definitionPath), value)).split(sep3).join("/"));
   };
   const entry = definition.entry ? resolveDefinitionPath(definition.entry) : null;
   const layout = definition.layout ? resolveDefinitionPath(definition.layout) : null;
@@ -43124,7 +43393,7 @@ function collectSelectedSpaceSource(projectDir, selection, { buildInputs = [] }
         if (!specifier.startsWith(".")) return;
       }
       const raw = specifier.split(/[?#]/, 1)[0];
-      const path3 = relative6(projectDir, resolve10(dirname16(join19(projectDir, importer)), raw)).split(sep3).join("/");
+      const path3 = relative6(projectDir, resolve11(dirname19(join21(projectDir, importer)), raw)).split(sep3).join("/");
       const candidate = [path3, ...[".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs", ".d.ts", "/index.ts", "/index.tsx", "/index.js"].map((suffix) => path3 + suffix)].find((name) => Object.hasOwn(files, name));
       if (candidate) {
         add(candidate);
@@ -43230,25 +43499,25 @@ function generateSpaceManifest(selection) {
 function prepareSelectedArtifact(projectDir, selection) {
   validateProjectBoundary(projectDir);
   validateProjectDesign(projectDir);
-  const entryPath = join20(projectDir, ".notis/_entry.tsx");
-  const manifestPath = join20(projectDir, ".notis/output/manifest.json");
-  mkdirSync12(dirname17(entryPath), { recursive: true });
-  mkdirSync12(dirname17(manifestPath), { recursive: true });
+  const entryPath = join22(projectDir, ".notis/_entry.tsx");
+  const manifestPath = join22(projectDir, ".notis/output/manifest.json");
+  mkdirSync14(dirname20(entryPath), { recursive: true });
+  mkdirSync14(dirname20(manifestPath), { recursive: true });
   if (selection.entry) {
-    const reference = (path3) => JSON.stringify("./" + relative7(dirname17(entryPath), join20(projectDir, path3)).replaceAll("\\", "/"));
+    const reference = (path3) => JSON.stringify("./" + relative7(dirname20(entryPath), join22(projectDir, path3)).replaceAll("\\", "/"));
     const lines = [`export { default as SpaceView } from ${reference(selection.entry)};`];
     if (selection.layout) lines.push(`export { default as __AppShell } from ${reference(selection.layout)};`);
     if (selection.markdown) lines.push(`export { default as SpaceMarkdown } from ${reference(selection.markdown)};`);
-    writeFileSync11(entryPath, lines.join("\n") + "\n");
+    writeFileSync13(entryPath, lines.join("\n") + "\n");
   }
-  writeFileSync11(manifestPath, JSON.stringify(generateSpaceManifest(selection), null, 2) + "\n");
+  writeFileSync13(manifestPath, JSON.stringify(generateSpaceManifest(selection), null, 2) + "\n");
 }
 function finalizeSelectedArtifact(projectDir) {
-  const manifestPath = join20(projectDir, ".notis/output/manifest.json");
-  const manifest = JSON.parse(readFileSync18(manifestPath, "utf8"));
-  if (manifest.bundle?.css && !existsSync14(join20(projectDir, ".notis/output", manifest.bundle.css))) {
+  const manifestPath = join22(projectDir, ".notis/output/manifest.json");
+  const manifest = JSON.parse(readFileSync20(manifestPath, "utf8"));
+  if (manifest.bundle?.css && !existsSync15(join22(projectDir, ".notis/output", manifest.bundle.css))) {
     delete manifest.bundle.css;
-    writeFileSync11(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+    writeFileSync13(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
   }
 }
 async function buildSpaceRelease(projectDir, selectedKey, { stdio = "inherit", refreshSdk = true, runBuild } = {}) {
@@ -43260,8 +43529,8 @@ async function buildSpaceRelease(projectDir, selectedKey, { stdio = "inherit", r
   const staging = freezeSourceWorkspace(projectDir, sourceFiles);
   let release;
   try {
-    if (existsSync14(join20(projectDir, "node_modules"))) {
-      symlinkSync2(join20(projectDir, "node_modules"), join20(staging.projectDir, "node_modules"), process.platform === "win32" ? "junction" : "dir");
+    if (existsSync15(join22(projectDir, "node_modules"))) {
+      symlinkSync2(join22(projectDir, "node_modules"), join22(staging.projectDir, "node_modules"), process.platform === "win32" ? "junction" : "dir");
     }
     const frozenSelection = await loadSelectedSpace(staging.projectDir, selectedKey);
     await buildArtifact(staging.projectDir, {
@@ -43315,18 +43584,18 @@ async function prepareSpaceRelease(projectDir, selectedKey) {
 
 // src/runtime/space-verification.js
 import { createHash as createHash13 } from "node:crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync19 } from "node:fs";
+import { existsSync as existsSync16, readFileSync as readFileSync21 } from "node:fs";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 
 // src/runtime/space-test-server.js
 import { createHash as createHash12 } from "node:crypto";
 var import__ = __toESM(require__(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
-import { dirname as dirname18, join as join21, resolve as resolve12 } from "node:path";
+import { dirname as dirname21, join as join23, resolve as resolve13 } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 init_errors();
-var ROOT = resolve12(dirname18(fileURLToPath11(import.meta.url)), "../..");
+var ROOT = resolve13(dirname21(fileURLToPath11(import.meta.url)), "../..");
 function object(value) {
   return value && typeof value === "object" && !Array.isArray(value);
 }
@@ -43620,11 +43889,11 @@ async function loadSpaceVerificationRenderer() {
   const candidates = [new URL("../../dist/view-renderer/", import.meta.url), new URL("../../../view-renderer/", import.meta.url)];
   for (const root of candidates) {
     const entry = new URL("src/index.js", root);
-    if (!existsSync15(fileURLToPath12(entry))) continue;
+    if (!existsSync16(fileURLToPath12(entry))) continue;
     const digest = createHash13("sha256");
     for (const file of ["src/renderer.js", "src/dom.js", "src/pool.js", "dist/host.js", "dist/host.css", "dist/theme.css"]) {
       digest.update(file);
-      digest.update(readFileSync19(new URL(file, root)));
+      digest.update(readFileSync21(new URL(file, root)));
     }
     return { ...await import(entry.href), rendererDigest: digest.digest("hex") };
   }
@@ -43749,14 +44018,14 @@ async function verifySpaceRelease(release, {
 // src/runtime/space-database-structures.js
 var import_parser = __toESM(require_lib(), 1);
 init_errors();
-import { existsSync as existsSync16, readFileSync as readFileSync20, realpathSync as realpathSync3, writeFileSync as writeFileSync12 } from "node:fs";
-import { dirname as dirname19, join as join22, relative as relative8, resolve as resolve13, sep as sep4 } from "node:path";
+import { existsSync as existsSync17, readFileSync as readFileSync22, realpathSync as realpathSync3, writeFileSync as writeFileSync14 } from "node:fs";
+import { dirname as dirname22, join as join24, relative as relative8, resolve as resolve14, sep as sep4 } from "node:path";
 var nameOf = (node) => node?.type === "Identifier" ? node.name : node?.type === "StringLiteral" ? node.value : null;
 function refreshSpaceAuthoring(projectDir, localKey, { databaseStructures, authoringOverrides } = {}) {
   let rewritten = /* @__PURE__ */ new Map();
   if (Object.keys(databaseStructures || {}).length) rewritten = planSpaceAuthoring(projectDir, localKey, { databaseStructures }, rewritten);
   if (authoringOverrides) rewritten = planSpaceAuthoring(projectDir, localKey, { authoringOverrides }, rewritten);
-  for (const [file, source] of rewritten) writeFileSync12(file, source);
+  for (const [file, source] of rewritten) writeFileSync14(file, source);
   return [...rewritten.keys()].map((file) => relative8(realpathSync3(projectDir), file).split(sep4).join("/"));
 }
 function planSpaceAuthoring(projectDir, localKey, { databaseStructures: structures, authoringOverrides: overrides }, staged) {
@@ -43766,7 +44035,7 @@ function planSpaceAuthoring(projectDir, localKey, { databaseStructures: structur
     file = realpathSync3(file);
     if (!file.startsWith(root + sep4) || file.includes(`${sep4}node_modules${sep4}`)) throw fail();
     if (modules.has(file)) return modules.get(file);
-    const source = staged.get(file) ?? readFileSync20(file, "utf8");
+    const source = staged.get(file) ?? readFileSync22(file, "utf8");
     const ast = (0, import_parser.parse)(source, { sourceType: "module", plugins: ["typescript", "jsx"] });
     const unit2 = { file, source, ast, bindings: /* @__PURE__ */ new Map(), exports: /* @__PURE__ */ new Map() };
     modules.set(file, unit2);
@@ -43794,8 +44063,8 @@ function planSpaceAuthoring(projectDir, localKey, { databaseStructures: structur
   }
   function imported(reference) {
     if (!reference.from?.startsWith(".")) throw fail();
-    const base = resolve13(dirname19(reference.unit.file), reference.from);
-    const file = ["", ".ts", ".tsx", ".js", ".mjs", "/index.ts", "/index.js"].map((suffix) => base + suffix).find(existsSync16);
+    const base = resolve14(dirname22(reference.unit.file), reference.from);
+    const file = ["", ".ts", ".tsx", ".js", ".mjs", "/index.ts", "/index.js"].map((suffix) => base + suffix).find(existsSync17);
     if (!file) throw fail();
     return load(file);
   }
@@ -43840,12 +44109,12 @@ function planSpaceAuthoring(projectDir, localKey, { databaseStructures: structur
     if (value.node?.type !== "StringLiteral") throw fail();
     return value.node.value;
   }
-  const indexFile = ["notis.config.ts", "notis.config.js", "notis.config.mjs"].map((file) => join22(root, file)).find(existsSync16);
+  const indexFile = ["notis.config.ts", "notis.config.js", "notis.config.mjs"].map((file) => join24(root, file)).find(existsSync17);
   if (!indexFile) throw fail();
   const index = load(indexFile);
   const workspace = index.exports.get("default");
   const definition = scalar(property(property(property(workspace, "spaces"), localKey), "definition"));
-  const unit = load(resolve13(root, definition));
+  const unit = load(resolve14(root, definition));
   const resources = property(unit.exports.get("default"), "resources");
   const edits = /* @__PURE__ */ new Map();
   for (const [alias, structure] of Object.entries(structures || {})) {
@@ -43964,9 +44233,9 @@ function planSpaceAuthoring(projectDir, localKey, { databaseStructures: structur
 
 // src/runtime/space-lock.js
 import { createHash as createHash14 } from "node:crypto";
-import { existsSync as existsSync17, lstatSync as lstatSync4, mkdirSync as mkdirSync13, readdirSync as readdirSync7, readFileSync as readFileSync21, renameSync as renameSync8, rmSync as rmSync8, writeFileSync as writeFileSync13 } from "node:fs";
-import { randomUUID as randomUUID8 } from "node:crypto";
-import { dirname as dirname20, join as join23, resolve as resolve14 } from "node:path";
+import { existsSync as existsSync18, lstatSync as lstatSync4, mkdirSync as mkdirSync15, readdirSync as readdirSync7, readFileSync as readFileSync23, renameSync as renameSync10, rmSync as rmSync8, writeFileSync as writeFileSync15 } from "node:fs";
+import { randomUUID as randomUUID9 } from "node:crypto";
+import { dirname as dirname23, join as join25, resolve as resolve15 } from "node:path";
 init_errors();
 var SPACE_LOCK_FILE = "space-lock.json";
 var RESOURCES_FILE = "resources.json";
@@ -44020,12 +44289,12 @@ function writeSpaceLock(projectDir, lock) {
   return writeSpaceStateFile(projectDir, SPACE_LOCK_FILE, lock);
 }
 function readResourceList(projectDir) {
-  const path3 = join23(resolve14(projectDir), RESOURCES_FILE);
-  if (!existsSync17(path3)) return null;
+  const path3 = join25(resolve15(projectDir), RESOURCES_FILE);
+  if (!existsSync18(path3)) return null;
   if (lstatSync4(path3).isSymbolicLink()) throw usageError(`${RESOURCES_FILE} must be a regular file.`);
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync21(path3, "utf8"));
+    parsed = JSON.parse(readFileSync23(path3, "utf8"));
   } catch {
     throw usageError(`${RESOURCES_FILE} must be valid JSON.`);
   }
@@ -44042,11 +44311,11 @@ function readResourceList(projectDir) {
   });
 }
 function writeResourceList(projectDir, entries) {
-  const root = resolve14(projectDir);
-  const temporary = join23(root, `.${RESOURCES_FILE}-${randomUUID8()}`);
+  const root = resolve15(projectDir);
+  const temporary = join25(root, `.${RESOURCES_FILE}-${randomUUID9()}`);
   try {
-    writeFileSync13(temporary, JSON.stringify(entries, null, 2) + "\n", { flag: "wx" });
-    renameSync8(temporary, join23(root, RESOURCES_FILE));
+    writeFileSync15(temporary, JSON.stringify(entries, null, 2) + "\n", { flag: "wx" });
+    renameSync10(temporary, join25(root, RESOURCES_FILE));
   } finally {
     rmSync8(temporary, { force: true });
   }
@@ -44055,19 +44324,19 @@ function walkSkillFolder(directory, prefix, files) {
   for (const entry of readdirSync7(directory, { withFileTypes: true })) {
     if (entry.isSymbolicLink() || excluded(entry.name)) continue;
     const path3 = prefix ? `${prefix}/${entry.name}` : entry.name;
-    if (entry.isDirectory()) walkSkillFolder(join23(directory, entry.name), path3, files);
-    else if (entry.isFile()) files[path3] = readFileSync21(join23(directory, entry.name)).toString("base64");
+    if (entry.isDirectory()) walkSkillFolder(join25(directory, entry.name), path3, files);
+    else if (entry.isFile()) files[path3] = readFileSync23(join25(directory, entry.name)).toString("base64");
   }
 }
 function collectSkillFolders(projectDir) {
-  const root = join23(resolve14(projectDir), SKILLS_DIR);
+  const root = join25(resolve15(projectDir), SKILLS_DIR);
   const folders = {};
-  if (!existsSync17(root) || lstatSync4(root).isSymbolicLink() || !lstatSync4(root).isDirectory()) return folders;
+  if (!existsSync18(root) || lstatSync4(root).isSymbolicLink() || !lstatSync4(root).isDirectory()) return folders;
   for (const entry of readdirSync7(root, { withFileTypes: true })) {
     if (entry.isSymbolicLink() || !entry.isDirectory()) continue;
     if (!ALIAS.test(entry.name)) throw usageError(`${SKILLS_DIR}/${entry.name}: name the folder with the Skill alias (lowercase letters, digits, - or _).`);
     const files = {};
-    walkSkillFolder(join23(root, entry.name), "", files);
+    walkSkillFolder(join25(root, entry.name), "", files);
     if (!files["SKILL.md"]) throw usageError(`${SKILLS_DIR}/${entry.name} needs a SKILL.md.`);
     folders[entry.name] = { files, digest: appFilesDigest(files) };
   }
@@ -44078,7 +44347,7 @@ function skillFolderFiles(files) {
 }
 function writeSkillFolder(projectDir, alias, files, { sourceSnapshot } = {}) {
   if (!ALIAS.test(alias)) throw usageError(`Unsafe Skill alias: ${alias}`);
-  const root = join23(resolve14(projectDir), SKILLS_DIR, alias);
+  const root = join25(resolve15(projectDir), SKILLS_DIR, alias);
   const entries = Object.entries(files || {}).map(([path3, encoded]) => {
     safeRelativePath(path3, `Skill ${alias}`);
     return [path3, Buffer.from(encoded, "base64")];
@@ -44087,13 +44356,13 @@ function writeSkillFolder(projectDir, alias, files, { sourceSnapshot } = {}) {
     const changed = () => usageError(`${SKILLS_DIR}/${alias} changed while pulling its current Skill. Keep these local files and pull into a new directory.`);
     const readSnapshot = () => {
       const current = {};
-      if (!existsSync17(root) || lstatSync4(root).isSymbolicLink() || !lstatSync4(root).isDirectory() || lstatSync4(dirname20(root)).isSymbolicLink()) throw changed();
+      if (!existsSync18(root) || lstatSync4(root).isSymbolicLink() || !lstatSync4(root).isDirectory() || lstatSync4(dirname23(root)).isSymbolicLink()) throw changed();
       const walk = (directory, prefix = "") => {
         for (const entry of readdirSync7(directory, { withFileTypes: true })) {
           if (entry.isSymbolicLink() || excluded(entry.name)) throw changed();
           const path3 = prefix + entry.name;
-          if (entry.isDirectory()) walk(join23(directory, entry.name), path3 + "/");
-          else if (entry.isFile()) current[path3] = readFileSync21(join23(directory, entry.name)).toString("base64");
+          if (entry.isDirectory()) walk(join25(directory, entry.name), path3 + "/");
+          else if (entry.isFile()) current[path3] = readFileSync23(join25(directory, entry.name)).toString("base64");
           else throw changed();
         }
       };
@@ -44103,23 +44372,23 @@ function writeSkillFolder(projectDir, alias, files, { sourceSnapshot } = {}) {
     const expected = appFilesDigest(sourceSnapshot);
     if (appFilesDigest(readSnapshot()) !== expected) throw changed();
     if (appFilesDigest(files) === expected) return;
-    const staging = join23(resolve14(projectDir), ".notis", `skill-pull-${randomUUID8()}`);
+    const staging = join25(resolve15(projectDir), ".notis", `skill-pull-${randomUUID9()}`);
     const backup = `${staging}-previous`;
-    mkdirSync13(staging, { recursive: true });
+    mkdirSync15(staging, { recursive: true });
     let displaced = false;
     try {
       for (const [path3, bytes] of entries) {
-        const target = join23(staging, path3);
-        mkdirSync13(dirname20(target), { recursive: true });
-        writeFileSync13(target, bytes, { flag: "wx" });
+        const target = join25(staging, path3);
+        mkdirSync15(dirname23(target), { recursive: true });
+        writeFileSync15(target, bytes, { flag: "wx" });
       }
       if (appFilesDigest(readSnapshot()) !== expected) throw changed();
-      renameSync8(root, backup);
+      renameSync10(root, backup);
       displaced = true;
       try {
-        renameSync8(staging, root);
+        renameSync10(staging, root);
       } catch (error) {
-        renameSync8(backup, root);
+        renameSync10(backup, root);
         displaced = false;
         throw error;
       }
@@ -44132,10 +44401,10 @@ function writeSkillFolder(projectDir, alias, files, { sourceSnapshot } = {}) {
     return;
   }
   for (const [path3, bytes] of entries) {
-    const target = join23(root, path3);
-    mkdirSync13(dirname20(target), { recursive: true });
+    const target = join25(root, path3);
+    mkdirSync15(dirname23(target), { recursive: true });
     try {
-      writeFileSync13(target, bytes, { flag: "wx" });
+      writeFileSync15(target, bytes, { flag: "wx" });
     } catch (error) {
       if (error?.code === "EEXIST") throw usageError(`${SKILLS_DIR}/${alias}/${path3} already exists in the pulled source; the Skill folder cannot be written over it.`);
       throw error;
@@ -44277,24 +44546,24 @@ function describeAppliedChanges(result) {
 
 // src/command-specs/spaces.js
 init_errors();
-import { readFileSync as readFileSync22 } from "node:fs";
-import { resolve as resolve17 } from "node:path";
+import { readFileSync as readFileSync24 } from "node:fs";
+import { resolve as resolve18 } from "node:path";
 import { createHash as createHash15 } from "node:crypto";
 
 // src/command-specs/views.js
 init_errors();
 
 // src/runtime/view-render.js
-import { existsSync as existsSync18 } from "node:fs";
+import { existsSync as existsSync19 } from "node:fs";
 import { mkdir as mkdir2, writeFile as writeFile2, unlink } from "node:fs/promises";
-import { resolve as resolve15, join as join24 } from "node:path";
+import { resolve as resolve16, join as join26 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 init_errors();
 async function rendererLibrary() {
   const packaged = new URL("../../dist/view-renderer/src/index.js", import.meta.url);
-  if (existsSync18(fileURLToPath13(packaged))) return import(packaged.href);
+  if (existsSync19(fileURLToPath13(packaged))) return import(packaged.href);
   const development = new URL("../../../view-renderer/src/index.js", import.meta.url);
-  if (existsSync18(fileURLToPath13(development))) return import(development.href);
+  if (existsSync19(fileURLToPath13(development))) return import(development.href);
   throw usageError("The shared view renderer is missing. Rebuild or reinstall this CLI package.");
 }
 async function renderViewWithCliRuntime({
@@ -44334,7 +44603,7 @@ async function renderViewWithCliRuntime({
     throw error;
   }
   if (!directory) return { result, artifacts: null };
-  const root = resolve15(directory), created = [], artifacts = {};
+  const root = resolve16(directory), created = [], artifacts = {};
   await mkdir2(root, { recursive: true });
   try {
     for (const [kind, name, bytes] of [
@@ -44342,7 +44611,7 @@ async function renderViewWithCliRuntime({
       ["screenshot", "view.png", result.screenshot ? Buffer.from(result.screenshot.data_base64, "base64") : void 0]
     ]) {
       if (bytes === void 0) continue;
-      const path3 = join24(root, name);
+      const path3 = join26(root, name);
       await writeFile2(path3, bytes, { flag: "wx", mode: 384 });
       created.push(path3);
       artifacts[kind] = path3;
@@ -44355,8 +44624,8 @@ async function renderViewWithCliRuntime({
 }
 
 // src/command-specs/views.js
-import { resolve as resolve16 } from "node:path";
-import { randomUUID as randomUUID9 } from "node:crypto";
+import { resolve as resolve17 } from "node:path";
+import { randomUUID as randomUUID10 } from "node:crypto";
 function viewRenderCommandSpec({ screenshotOnly = false } = {}) {
   const command_path = screenshotOnly ? ["spaces", "screenshot"] : ["views", "render"];
   return {
@@ -44379,7 +44648,7 @@ function viewRenderCommandSpec({ screenshotOnly = false } = {}) {
         throw usageError("Choose markdown, screenshot, or markdown,screenshot.");
       }
       const width = ctx.options.width === void 0 ? 1440 : Number(ctx.options.width);
-      const directory = resolve16(ctx.options.outputDir || `.notis/renders/${randomUUID9()}`);
+      const directory = resolve17(ctx.options.outputDir || `.notis/renders/${randomUUID10()}`);
       const controller = new AbortController(), cancel = () => controller.abort();
       process.once("SIGINT", cancel);
       process.once("SIGTERM", cancel);
@@ -44780,7 +45049,7 @@ var spacesCommandSpecs = [
       const sourceLink = { space_id: ctx.args.spaceId, api_base: ctx.runtime.apiBase.replace(/\/$/, "") };
       let databaseStructures, authoringOverrides;
       const result = await pullAppSource({
-        targetDir: resolve17(ctx.args.dir || ctx.args.spaceId),
+        targetDir: resolve18(ctx.args.dir || ctx.args.spaceId),
         force: false,
         sourceKind: "space",
         sourceLink,
@@ -45003,7 +45272,7 @@ var spacesCommandSpecs = [
       return remote(ctx, "grant-authorize", { body: {
         space_id: ctx.args.spaceId,
         request_id: requestId(ctx),
-        template: object3(readFileSync22(resolve17(ctx.options.template), "utf8"), "--template"),
+        template: object3(readFileSync24(resolve18(ctx.options.template), "utf8"), "--template"),
         document_id: ctx.options.record,
         dry_run: Boolean(ctx.options.dryRun)
       } });
@@ -45424,8 +45693,8 @@ init_channel();
 init_profiles();
 function readCliVersion() {
   try {
-    const manifestPath = join25(dirname21(fileURLToPath14(import.meta.url)), "..", "package.json");
-    const version = JSON.parse(readFileSync23(manifestPath, "utf-8")).version;
+    const manifestPath = join27(dirname24(fileURLToPath14(import.meta.url)), "..", "package.json");
+    const version = JSON.parse(readFileSync25(manifestPath, "utf-8")).version;
     if (typeof version === "string" && version.trim()) {
       return version.trim();
     }