@notis_ai/cli 0.2.0-beta.197.1 → 0.2.0-beta.198.1

package/dist/skill-sync-worker.mjs

@@ -1,21 +1,18 @@
 // src/skill-sync-worker.js
-import { mkdirSync as mkdirSync3, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { join as join6 } from "node:path";
+import { mkdirSync as mkdirSync5, renameSync as renameSync5, writeFileSync as writeFileSync5 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join8 } from "node:path";
 
 // src/runtime/profiles.js
-import { randomUUID } from "node:crypto";
 import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  statSync,
-  writeFileSync
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, parse, resolve } from "node:path";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname2, join as join2, parse, resolve as resolve2 } from "node:path";
 
 // src/runtime/errors.js
 var EXIT_CODES = {
@@ -51,6 +48,109 @@ var CliError = class extends Error {
   }
 };
 
+// src/runtime/config-lock.js
+import { randomUUID } from "node:crypto";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+var CONFIG_WRITE_LOCK_TIMEOUT_MS = 5e3;
+var CONFIG_WRITE_LOCK_STALE_MS = 2e3;
+var CONFIG_WRITE_LOCK_POLL_MS = 10;
+function resolveCliConfigFile() {
+  const envConfigFile = process.env.NOTIS_CLI_CONFIG_FILE;
+  if (envConfigFile) {
+    return resolve(envConfigFile);
+  }
+  return join(homedir(), ".notis", "config.json");
+}
+function readLockOwner(lockDirectory) {
+  try {
+    return JSON.parse(readFileSync(join(lockDirectory, "owner"), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function lockDirectoryMtime(lockDirectory) {
+  try {
+    return statSync(lockDirectory).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+function publishConfigWriteLock(lockDirectory, ownerId) {
+  const candidateDirectory = `${lockDirectory}.candidate-${ownerId}`;
+  try {
+    mkdirSync(candidateDirectory);
+    writeFileSync(
+      join(candidateDirectory, "owner"),
+      JSON.stringify({ id: ownerId, at: Date.now() }),
+      { mode: 384 }
+    );
+    try {
+      renameSync(candidateDirectory, lockDirectory);
+      return true;
+    } catch (error) {
+      if (!existsSync(lockDirectory)) throw error;
+      return false;
+    }
+  } finally {
+    rmSync(candidateDirectory, { recursive: true, force: true });
+  }
+}
+function withConfigFileWriteLock(configFile, callback) {
+  const lockDirectory = `${configFile}.write-lock`;
+  const ownerId = `${process.pid}.${randomUUID()}`;
+  const deadline = Date.now() + CONFIG_WRITE_LOCK_TIMEOUT_MS;
+  mkdirSync(dirname(configFile), { recursive: true });
+  for (; ; ) {
+    if (!existsSync(lockDirectory) && publishConfigWriteLock(lockDirectory, ownerId)) {
+      break;
+    }
+    const owner = readLockOwner(lockDirectory);
+    const observedMtime = lockDirectoryMtime(lockDirectory);
+    const ownerIsStale = owner?.id && Date.now() - Number(owner.at) > CONFIG_WRITE_LOCK_STALE_MS;
+    const ownerlessIsStale = !owner && observedMtime !== null && Date.now() - observedMtime > CONFIG_WRITE_LOCK_STALE_MS;
+    if (ownerIsStale || ownerlessIsStale) {
+      try {
+        const currentOwner = readLockOwner(lockDirectory);
+        const ownerUnchanged = owner?.id ? currentOwner?.id === owner.id : !currentOwner && lockDirectoryMtime(lockDirectory) === observedMtime;
+        if (ownerUnchanged) {
+          rmSync(lockDirectory, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+      }
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting to update ${configFile}`);
+    }
+    Atomics.wait(
+      new Int32Array(new SharedArrayBuffer(4)),
+      0,
+      0,
+      CONFIG_WRITE_LOCK_POLL_MS
+    );
+  }
+  try {
+    return callback(configFile);
+  } finally {
+    try {
+      if (readLockOwner(lockDirectory)?.id === ownerId) {
+        rmSync(lockDirectory, { recursive: true, force: true });
+      }
+    } catch {
+    }
+  }
+}
+
 // src/runtime/channel.js
 var RELEASE_CHANNELS = ["stable", "beta"];
 var CHANNEL_TAGS = { stable: "latest", beta: "beta" };
@@ -115,9 +215,9 @@ function getAuthRecovery(runtime = {}, { mode = "expired" } = {}) {
 }
 
 // src/runtime/profiles.js
-var CONFIG_DIR = join(homedir(), ".notis");
-var CONFIG_FILE = join(CONFIG_DIR, "config.json");
-var WORKSPACE_DIR = join(CONFIG_DIR, "workspace");
+var CONFIG_DIR = join2(homedir2(), ".notis");
+var CONFIG_FILE = join2(CONFIG_DIR, "config.json");
+var WORKSPACE_DIR = join2(CONFIG_DIR, "workspace");
 var DEFAULT_API_BASE = "https://api.notis.ai";
 var BETA_API_BASE = "https://api-beta.notis.ai";
 var DEFAULT_PROFILE = "default";
@@ -131,13 +231,10 @@ var LEGACY_DESKTOP_PROFILE_KEYS = [
   "desktop_app_name",
   "desktop_pid"
 ];
-var WORKTREE_RUNTIME_FILENAME = join(".context", "notis-runtime.json");
-var WORKTREE_ROUTING_FILENAME = join(".context", "notis-routing.json");
+var WORKTREE_RUNTIME_FILENAME = join2(".context", "notis-runtime.json");
+var WORKTREE_ROUTING_FILENAME = join2(".context", "notis-routing.json");
 var LOCAL_API_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
 var LIVE_API_HOSTS = /* @__PURE__ */ new Set(["api.notis.ai", "api-beta.notis.ai"]);
-var CONFIG_WRITE_LOCK_TIMEOUT_MS = 5e3;
-var CONFIG_WRITE_LOCK_STALE_MS = 2e3;
-var CONFIG_WRITE_LOCK_POLL_MS = 10;
 function clone(value) {
   return JSON.parse(JSON.stringify(value));
 }
@@ -211,23 +308,23 @@ function normalizeConfig(rawConfig = {}) {
 }
 function readJsonFile(path3) {
   try {
-    return JSON.parse(readFileSync(path3, "utf-8"));
+    return JSON.parse(readFileSync2(path3, "utf-8"));
   } catch {
     return null;
   }
 }
 function findUp(filename, startDir = process.cwd()) {
-  let current = resolve(startDir);
+  let current = resolve2(startDir);
   const root = parse(current).root;
   while (true) {
-    const candidate = join(current, filename);
-    if (existsSync(candidate)) {
+    const candidate = join2(current, filename);
+    if (existsSync2(candidate)) {
       return candidate;
     }
     if (current === root) {
       return null;
     }
-    current = dirname(current);
+    current = dirname2(current);
   }
 }
 function processIsAlive(pid) {
@@ -298,17 +395,17 @@ function resolveWorktreeRuntime(startDir = process.cwd()) {
 function resolveConfigFile() {
   const envConfigFile = process.env.NOTIS_CLI_CONFIG_FILE;
   if (envConfigFile) {
-    return resolve(envConfigFile);
+    return resolve2(envConfigFile);
   }
   return CONFIG_FILE;
 }
 function loadConfig() {
   const configFile = resolveConfigFile();
-  if (!existsSync(configFile)) {
+  if (!existsSync2(configFile)) {
     return normalizeConfig({});
   }
   try {
-    return normalizeConfig(JSON.parse(readFileSync(configFile, "utf-8")));
+    return normalizeConfig(JSON.parse(readFileSync2(configFile, "utf-8")));
   } catch {
     return normalizeConfig({});
   }
@@ -316,7 +413,7 @@ function loadConfig() {
 function writeConfig(configFile, config) {
   let rawConfig = null;
   try {
-    rawConfig = JSON.parse(readFileSync(configFile, "utf-8"));
+    rawConfig = JSON.parse(readFileSync2(configFile, "utf-8"));
   } catch {
   }
   const normalized = normalizeConfig(config);
@@ -334,90 +431,13 @@ function writeConfig(configFile, config) {
   writeRawConfig(configFile, persisted);
 }
 function writeRawConfig(configFile, config) {
-  mkdirSync(dirname(configFile), { recursive: true });
+  mkdirSync2(dirname2(configFile), { recursive: true });
   const temporaryFile = `${configFile}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync(temporaryFile, JSON.stringify(config, null, 2), { mode: 384 });
-  renameSync(temporaryFile, configFile);
-}
-function readLockOwner(lockDirectory) {
-  try {
-    return JSON.parse(readFileSync(join(lockDirectory, "owner"), "utf-8"));
-  } catch {
-    return null;
-  }
-}
-function lockDirectoryMtime(lockDirectory) {
-  try {
-    return statSync(lockDirectory).mtimeMs;
-  } catch {
-    return null;
-  }
-}
-function publishConfigWriteLock(lockDirectory, ownerId) {
-  const candidateDirectory = `${lockDirectory}.candidate-${ownerId}`;
-  try {
-    mkdirSync(candidateDirectory);
-    writeFileSync(
-      join(candidateDirectory, "owner"),
-      JSON.stringify({ id: ownerId, at: Date.now() }),
-      { mode: 384 }
-    );
-    try {
-      renameSync(candidateDirectory, lockDirectory);
-      return true;
-    } catch (error) {
-      if (!existsSync(lockDirectory)) throw error;
-      return false;
-    }
-  } finally {
-    rmSync(candidateDirectory, { recursive: true, force: true });
-  }
+  writeFileSync2(temporaryFile, JSON.stringify(config, null, 2), { mode: 384 });
+  renameSync2(temporaryFile, configFile);
 }
 function withConfigWriteLock(callback) {
-  const configFile = resolveConfigFile();
-  const lockDirectory = `${configFile}.write-lock`;
-  const ownerId = `${process.pid}.${randomUUID()}`;
-  const deadline = Date.now() + CONFIG_WRITE_LOCK_TIMEOUT_MS;
-  mkdirSync(dirname(configFile), { recursive: true });
-  for (; ; ) {
-    if (!existsSync(lockDirectory) && publishConfigWriteLock(lockDirectory, ownerId)) {
-      break;
-    }
-    const owner = readLockOwner(lockDirectory);
-    const observedMtime = lockDirectoryMtime(lockDirectory);
-    const ownerIsStale = owner?.id && Date.now() - Number(owner.at) > CONFIG_WRITE_LOCK_STALE_MS;
-    const ownerlessIsStale = !owner && observedMtime !== null && Date.now() - observedMtime > CONFIG_WRITE_LOCK_STALE_MS;
-    if (ownerIsStale || ownerlessIsStale) {
-      try {
-        const currentOwner = readLockOwner(lockDirectory);
-        const ownerUnchanged = owner?.id ? currentOwner?.id === owner.id : !currentOwner && lockDirectoryMtime(lockDirectory) === observedMtime;
-        if (ownerUnchanged) {
-          rmSync(lockDirectory, { recursive: true, force: true });
-          continue;
-        }
-      } catch {
-      }
-    }
-    if (Date.now() >= deadline) {
-      throw new Error(`Timed out waiting to update ${configFile}`);
-    }
-    Atomics.wait(
-      new Int32Array(new SharedArrayBuffer(4)),
-      0,
-      0,
-      CONFIG_WRITE_LOCK_POLL_MS
-    );
-  }
-  try {
-    return callback(configFile);
-  } finally {
-    try {
-      if (readLockOwner(lockDirectory)?.id === ownerId) {
-        rmSync(lockDirectory, { recursive: true, force: true });
-      }
-    } catch {
-    }
-  }
+  return withConfigFileWriteLock(resolveConfigFile(), callback);
 }
 function updateConfig(updater) {
   return withConfigWriteLock((configFile) => {
@@ -432,6 +452,13 @@ function getProfile(config, profileName) {
   const normalized = normalizeConfig(config);
   return Object.hasOwn(normalized.profiles, profileName) ? normalized.profiles[profileName] : {};
 }
+function getCurrentProfileName(config, preferredName) {
+  const normalized = normalizeConfig(config);
+  if (preferredName && Object.hasOwn(normalized.profiles, preferredName)) {
+    return preferredName;
+  }
+  return normalized.current_profile || DEFAULT_PROFILE;
+}
 function resolveProfileSelection(globalOptions = {}, worktreeRuntime = null, config, { allowUnknownProfile = false } = {}) {
   const normalized = normalizeConfig(config);
   const requested = globalOptions.profile || process.env.NOTIS_PROFILE || "";
@@ -813,20 +840,126 @@ import {
   timingSafeEqual
 } from "node:crypto";
 import {
-  mkdirSync as mkdirSync2,
+  mkdirSync as mkdirSync4,
   readdirSync,
-  readFileSync as readFileSync2,
-  renameSync as renameSync2,
+  readFileSync as readFileSync4,
+  renameSync as renameSync4,
   rmdirSync,
   rmSync as rmSync2,
   statSync as statSync2,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync4
 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { basename, dirname as dirname2, join as join2 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { basename, dirname as dirname4, join as join4 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
-var OAUTH_LOCK_DIR = join2(homedir2(), ".notis", "oauth.lock");
+
+// src/runtime/computer-identity.js
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { hostname as osHostname } from "node:os";
+import { dirname as dirname3, join as join3 } from "node:path";
+var COMPUTER_IDENTITY_VERSION = 1;
+var COMPUTER_NAME_MAX_LENGTH = 64;
+var COMPUTER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var FALLBACK_COMPUTER_NAME = "Computer";
+function computerIdentityFile(configFile = resolveCliConfigFile()) {
+  return join3(dirname3(configFile), "computer.json");
+}
+function normalizeComputerName(value) {
+  if (typeof value !== "string") return null;
+  const collapsed = value.replace(/\s+/gu, " ").trim();
+  if (!collapsed) return null;
+  const characters = Array.from(collapsed);
+  if (characters.length <= COMPUTER_NAME_MAX_LENGTH) return collapsed;
+  return characters.slice(0, COMPUTER_NAME_MAX_LENGTH).join("").trim();
+}
+function readMacComputerName() {
+  try {
+    return execFileSync("/usr/sbin/scutil", ["--get", "ComputerName"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    });
+  } catch {
+    return null;
+  }
+}
+function defaultComputerName(options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    const macName = normalizeComputerName((options.readMacComputerName ?? readMacComputerName)());
+    if (macName) return macName;
+  }
+  let host = "";
+  try {
+    host = String((options.hostname ?? osHostname)() || "");
+  } catch {
+    host = "";
+  }
+  return normalizeComputerName(host.replace(/\.local\.?$/iu, "")) || FALLBACK_COMPUTER_NAME;
+}
+function parseIdentityFile(file) {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync3(file, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  return raw;
+}
+function validStored(raw) {
+  if (!raw || raw.version !== COMPUTER_IDENTITY_VERSION) return null;
+  if (typeof raw.computer_id !== "string" || !COMPUTER_ID_PATTERN.test(raw.computer_id)) return null;
+  return {
+    computerId: raw.computer_id.toLowerCase(),
+    name: normalizeComputerName(raw.name)
+  };
+}
+function writeIdentityFile(file, stored) {
+  mkdirSync3(dirname3(file), { recursive: true });
+  const contents = {
+    version: COMPUTER_IDENTITY_VERSION,
+    computer_id: stored.computerId,
+    ...stored.name ? { name: stored.name } : {}
+  };
+  const temporaryFile = `${file}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync3(temporaryFile, `${JSON.stringify(contents, null, 2)}
+`, { mode: 384 });
+  renameSync3(temporaryFile, file);
+}
+function withIdentity(stored, options) {
+  const defaultName = defaultComputerName(options);
+  return {
+    computerId: stored.computerId,
+    name: stored.name,
+    defaultName,
+    displayName: stored.name ?? defaultName
+  };
+}
+function readOrCreateLocked(configFile, file) {
+  const raw = parseIdentityFile(file);
+  const existing = validStored(raw);
+  if (existing) return existing;
+  const created = {
+    computerId: randomUUID2(),
+    // A file with a broken id keeps the name the user chose.
+    name: normalizeComputerName(raw?.name)
+  };
+  writeIdentityFile(file, created);
+  return created;
+}
+function readComputerIdentity(options = {}) {
+  const configFile = options.configFile ?? resolveCliConfigFile();
+  const file = computerIdentityFile(configFile);
+  const stored = validStored(parseIdentityFile(file)) ?? withConfigFileWriteLock(configFile, () => readOrCreateLocked(configFile, file));
+  return withIdentity(stored, options);
+}
+
+// src/runtime/oauth.js
+var OAUTH_LOCK_DIR = join4(homedir3(), ".notis", "oauth.lock");
 var DEFAULT_REFRESH_EXPIRES_IN = 30 * 24 * 60 * 60;
 var PENDING_LOGIN_TTL_SECONDS = 30 * 60;
 var OAUTH_HTTP_TIMEOUT_MS = 1e4;
@@ -903,6 +1036,14 @@ function storedOAuthMetadata(runtime, profile) {
     revocationEndpoint: `${issuer}/oauth/revoke`
   };
 }
+function cliDeviceParams() {
+  try {
+    const identity = readComputerIdentity({ configFile: resolveConfigFile() });
+    return { device_id: identity.computerId, device_name: identity.displayName };
+  } catch {
+    return {};
+  }
+}
 function persistOAuthTokenResponse(runtime, metadata, tokenResponse) {
   const now = Math.floor(Date.now() / 1e3);
   const payload = decodeJwtPayload(tokenResponse.access_token);
@@ -959,11 +1100,11 @@ function listenerGlobalLockDir() {
   return `${resolveConfigFile()}.oauth-listener-global.lock`;
 }
 function listenerGlobalLockOwnerFile(lockDir) {
-  return join2(lockDir, "owner.json");
+  return join4(lockDir, "owner.json");
 }
 function readListenerGlobalLockOwner(lockDir) {
   try {
-    return JSON.parse(readFileSync2(listenerGlobalLockOwnerFile(lockDir), "utf-8"));
+    return JSON.parse(readFileSync4(listenerGlobalLockOwnerFile(lockDir), "utf-8"));
   } catch {
     return null;
   }
@@ -971,7 +1112,7 @@ function readListenerGlobalLockOwner(lockDir) {
 function writeListenerGlobalLockOwner(lock) {
   const current = readListenerGlobalLockOwner(lock.lockDir);
   if (current && current.owner_token !== lock.ownerToken) return false;
-  writeFileSync2(listenerGlobalLockOwnerFile(lock.lockDir), JSON.stringify({
+  writeFileSync4(listenerGlobalLockOwnerFile(lock.lockDir), JSON.stringify({
     owner_token: lock.ownerToken,
     owner_pid: process.pid,
     updated_at: Date.now()
@@ -992,7 +1133,7 @@ function listenerGlobalLockIsStale(lockDir, staleMs) {
 function retireStaleListenerGlobalLock(lockDir) {
   const retiredDir = `${lockDir}.stale-${process.pid}-${base64url(randomBytes(8))}`;
   try {
-    renameSync2(lockDir, retiredDir);
+    renameSync4(lockDir, retiredDir);
   } catch {
     return false;
   }
@@ -1001,11 +1142,11 @@ function retireStaleListenerGlobalLock(lockDir) {
 }
 async function acquireListenerStartLock(runtime) {
   const lockDir = listenerStartLockDir(runtime);
-  mkdirSync2(dirname2(lockDir), { recursive: true });
+  mkdirSync4(dirname4(lockDir), { recursive: true });
   const deadline = Date.now() + LISTENER_START_LOCK_STALE_MS * 2;
   for (; ; ) {
     try {
-      mkdirSync2(lockDir);
+      mkdirSync4(lockDir);
       return lockDir;
     } catch (error) {
       if (error?.code !== "EEXIST") throw error;
@@ -1022,7 +1163,7 @@ async function acquireListenerStartLock(runtime) {
           "Timed out waiting for another CLI process to start browser authorization."
         );
       }
-      await new Promise((resolve3) => setTimeout(resolve3, 50));
+      await new Promise((resolve4) => setTimeout(resolve4, 50));
     }
   }
 }
@@ -1039,11 +1180,11 @@ async function acquireListenerGlobalLock({
   heartbeatMs = LISTENER_GLOBAL_LOCK_HEARTBEAT_MS
 } = {}) {
   const lockDir = listenerGlobalLockDir();
-  mkdirSync2(dirname2(lockDir), { recursive: true });
+  mkdirSync4(dirname4(lockDir), { recursive: true });
   const deadline = Date.now() + waitMs;
   for (; ; ) {
     try {
-      mkdirSync2(lockDir);
+      mkdirSync4(lockDir);
       const lock = {
         lockDir,
         ownerToken: base64url(randomBytes(24)),
@@ -1069,7 +1210,7 @@ async function acquireListenerGlobalLock({
           "Timed out waiting for another CLI process to finish OAuth account changes."
         );
       }
-      await new Promise((resolve3) => setTimeout(resolve3, 50));
+      await new Promise((resolve4) => setTimeout(resolve4, 50));
     }
   }
 }
@@ -1080,14 +1221,14 @@ function releaseListenerGlobalLock(lock) {
   if (owner?.owner_token !== lock.ownerToken) return;
   const releasedDir = `${lock.lockDir}.released-${process.pid}-${lock.ownerToken}`;
   try {
-    renameSync2(lock.lockDir, releasedDir);
+    renameSync4(lock.lockDir, releasedDir);
   } catch {
     return;
   }
   const movedOwner = readListenerGlobalLockOwner(releasedDir);
   if (movedOwner?.owner_token !== lock.ownerToken) {
     try {
-      renameSync2(releasedDir, lock.lockDir);
+      renameSync4(releasedDir, lock.lockDir);
     } catch {
     }
     return;
@@ -1159,11 +1300,11 @@ function lockIsStale() {
   }
 }
 async function acquireRefreshLock(runtime, waitMs = 6e4) {
-  mkdirSync2(join2(homedir2(), ".notis"), { recursive: true });
+  mkdirSync4(join4(homedir3(), ".notis"), { recursive: true });
   const deadline = Date.now() + waitMs;
   for (; ; ) {
     try {
-      mkdirSync2(OAUTH_LOCK_DIR);
+      mkdirSync4(OAUTH_LOCK_DIR);
       return true;
     } catch (error) {
       if (error?.code !== "EEXIST") throw error;
@@ -1182,7 +1323,7 @@ async function acquireRefreshLock(runtime, waitMs = 6e4) {
       if (Date.now() >= deadline) {
         throw oauthError("oauth_refresh_lock_timeout", "Timed out waiting for another CLI process to refresh OAuth.");
       }
-      await new Promise((resolve3) => setTimeout(resolve3, 100));
+      await new Promise((resolve4) => setTimeout(resolve4, 100));
     }
   }
 }
@@ -1217,7 +1358,8 @@ async function refreshOAuthCredential(runtime, fetchImpl = fetch) {
           grant_type: "refresh_token",
           refresh_token: profile.oauth_refresh_token,
           client_id: profile.oauth_client_id,
-          resource: metadata.resource
+          resource: metadata.resource,
+          ...cliDeviceParams()
         })
       },
       fetchImpl
@@ -1257,7 +1399,8 @@ async function refreshOAuthCredential(runtime, fetchImpl = fetch) {
 
 // dist/skill-sync/index.js
 import { createHash as createHash4 } from "node:crypto";
-import { join as join3 } from "node:path";
+import { promises as fs3 } from "node:fs";
+import { dirname as dirname5, join as join5 } from "node:path";
 import { createHash as createHash2 } from "node:crypto";
 import { createHash as createHash22 } from "crypto";
 import { execFile } from "child_process";
@@ -1374,8 +1517,16 @@ function previousNativeState(state, skill) {
 function nativeLocalReady(skill, local) {
   return Boolean(local?.nativeFilesCurrent && local.folderHash === local.nativeBaseFolderHash && local.cloudId === skill.id && local.nativeScope === skill.native_scope && sameNativeReference(local.nativeReference, skill.native_reference));
 }
-function nativeLinkRows(response, locals) {
-  return response.skills.map((skill) => isNativeSkill(skill) && !nativeLocalReady(skill, locals.find((row) => row.name === skill.name)) ? { ...skill, status: "disabled" } : skill);
+function pendingLegacyUpgrade(skill, local, state) {
+  if (!isNativeSkill(skill) || !local || local.nativeReference || local.cloudId) return false;
+  const previous = previousNativeState(state, skill);
+  return Boolean(previous && !previous.nativeReference);
+}
+function nativeLinkRows(response, locals, state) {
+  return response.skills.map((skill) => {
+    const local = locals.find((row) => row.name === skill.name);
+    return isNativeSkill(skill) && !nativeLocalReady(skill, local) && !(state && pendingLegacyUpgrade(skill, local, state)) ? { ...skill, status: "disabled" } : skill;
+  });
 }
 function retainMissingNativeState(previous, next) {
   const present = new Set(Object.values(next.skills).map((row) => row.cloudId));
@@ -2149,7 +2300,12 @@ async function replaceSkillDirectoryAtomically(skillDir, populateDir, preserve)
     }
     await populateDir(stagingDir);
     if (preserve && await pathExists(skillDir)) {
-      await preserveUnmanagedFiles(skillDir, stagingDir, preserve.previouslyApplied, preserve.native);
+      await preserveUnmanagedFiles(
+        skillDir,
+        stagingDir,
+        preserve.previouslyApplied,
+        preserve.native && !preserve.legacyBaseline
+      );
     }
     if (preserve?.native) {
       const markerPath = path.join(stagingDir, NATIVE_IDENTITY_FILE);
@@ -2246,7 +2402,9 @@ async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PA
   const preserve = {
     previouslyApplied: options.previouslyApplied,
     expectedFolderHash: options.expectedFolderHash,
-    native: isNativeSkill(skill)
+    native: isNativeSkill(skill),
+    // An unchanged legacy folder upgrading in place: shared files take the cloud version.
+    legacyBaseline: isNativeSkill(skill) && options.legacyBaseline === true && options.expectedFolderHash !== void 0
   };
   if (bundleBytes?.length) {
     const bundlePath = path.join(
@@ -2799,17 +2957,55 @@ var DEFAULT_RUN_SKILL_SYNC_DEPS = {
   removeForeignAccountSymlinks,
   updateAgentTargets
 };
+var MIRROR_ONLY_DEPS = {
+  removeForeignAccountSymlinks: async () => 0,
+  removeAllSymlinksForSkill: async () => 0,
+  syncSymlinks: async () => ({ linked: 0, removed: 0, skipped: 0, verifiedAgentLinks: {} })
+};
+async function forgetOtherAccountsAgentLinks(paths) {
+  const usersDir = dirname5(dirname5(paths.syncStatePath));
+  let entries;
+  try {
+    entries = await fs3.readdir(usersDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const statePath = join5(usersDir, entry.name, ".notis-sync.json");
+    if (statePath === paths.syncStatePath) continue;
+    let state = null;
+    try {
+      state = JSON.parse(await fs3.readFile(statePath, "utf8"));
+    } catch {
+      continue;
+    }
+    if (!state || typeof state !== "object" || !state.skills || typeof state.skills !== "object") continue;
+    let changed = false;
+    for (const skill of Object.values(state.skills)) {
+      if (skill && typeof skill === "object" && "verifiedAgentLinks" in skill) {
+        delete skill.verifiedAgentLinks;
+        changed = true;
+      }
+    }
+    if (!changed) continue;
+    const temporaryPath = `${statePath}.${process.pid}.${Date.now()}.tmp`;
+    await fs3.writeFile(temporaryPath, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+    await fs3.rename(temporaryPath, statePath);
+  }
+}
 function isolatedLinkOptions(paths) {
   if (!paths.isolatedNamespace && !paths.homeDir) return void 0;
-  const root = paths.isolatedNamespace ? join3(paths.syncRoot, "environments", paths.isolatedNamespace, "agents") : paths.homeDir;
+  const root = paths.isolatedNamespace ? join5(paths.syncRoot, "environments", paths.isolatedNamespace, "agents") : paths.homeDir;
   return {
     agentSkillDirs: {
       notis: paths.skillsDir,
-      claude_code: join3(root, ".claude", "skills"),
-      cursor: join3(root, ".cursor", "skills"),
-      codex: join3(root, ".codex", "skills")
+      claude_code: join5(root, ".claude", "skills"),
+      cursor: join5(root, ".cursor", "skills"),
+      codex: join5(root, ".codex", "skills")
     },
-    legacyGlobalSkillsDir: join3(root, ".agents", "skills")
+    legacyGlobalSkillsDir: join5(root, ".agents", "skills")
   };
 }
 function assertSyncEnvironment(pull, settings) {
@@ -2886,6 +3082,10 @@ function buildSyncState(pullResponse, localSkills, lastSyncedAt, verifiedAgentLi
       const localSkill = localSkillMap.get(skill.name);
       const appliedCloudFolderHash = appliedRevisions[skill.name];
       const appliedFileList = appliedFiles[skill.name];
+      if (pendingLegacyUpgrade(skill, localSkill, previousState)) {
+        const { nativeUnavailable: _unavailable, ...previous } = previousNativeState(previousState, skill);
+        return [skill.name, { ...previous, verifiedAgentLinks: verifiedAgentLinks[skill.name] ?? {} }];
+      }
       if (isNativeSkill(skill) && !nativeLocalReady(skill, localSkill)) {
         const previous = previousNativeState(previousState, skill);
         return [skill.name, { ...previous || {
@@ -2949,7 +3149,7 @@ function buildLocalSymlinkCandidates(pullResponse, localSkills, previousState) {
       status: "active"
     };
   });
-  return [...nativeLinkRows(pullResponse, localSkills), ...localOnlySkills];
+  return [...nativeLinkRows(pullResponse, localSkills, previousState), ...localOnlySkills];
 }
 function isEmptySyncState(state) {
   return state.lastSyncedAt === null && Object.keys(state.skills).length === 0;
@@ -2985,6 +3185,7 @@ async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previo
   for (const cloudSkill of selectCloudSkillsToApply(pullResponse.skills)) {
     const local = localSkillMap.get(cloudSkill.name);
     const acknowledged = isNativeSkill(cloudSkill) && local && acknowledgedNative.get(cloudSkill.id) === local.folderHash;
+    const legacyBaseline = Boolean(local && pendingLegacyUpgrade(cloudSkill, local, previousState) && previousNativeState(previousState, cloudSkill)?.folderHash === local.folderHash);
     if (!acknowledged && !shouldWriteCloudSkill(cloudSkill, localSkillMap, previousState)) {
       if (isNativeSkill(cloudSkill) && !nativeLocalReady(cloudSkill, local)) {
         failures.push({ name: cloudSkill.name, error: "Local native Skill changes were retained; resolve the version or identity conflict before using them." });
@@ -2997,7 +3198,8 @@ async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previo
         // What the last write put there. Everything else in the folder was
         // produced locally and survives this one.
         previouslyApplied: previousNativeState(previousState, skill)?.appliedFiles,
-        ...isNativeSkill(skill) && local ? { expectedFolderHash: local.folderHash } : {}
+        ...isNativeSkill(skill) && local ? { expectedFolderHash: local.folderHash } : {},
+        ...legacyBaseline ? { legacyBaseline } : {}
       }),
       onWarning: warnSkillSync
     });
@@ -3093,9 +3295,11 @@ async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previo
   return deactivated;
 }
 async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
+  const linkAgentFolders = options.linkAgentFolders !== false;
   const deps = {
     ...DEFAULT_RUN_SKILL_SYNC_DEPS,
-    ...dependencies
+    ...dependencies,
+    ...linkAgentFolders ? {} : MIRROR_ONLY_DEPS
   };
   const syncSettings = await deps.fetchSyncSettings(
     serverUrl,
@@ -3134,13 +3338,16 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
     syncPaths.skillsDir,
     isolatedLinkOptions(syncPaths)
   );
+  if (linkAgentFolders && !syncPaths.isolatedNamespace) {
+    await forgetOtherAccountsAgentLinks(syncPaths);
+  }
   const cloudCuratedSkillNames = new Set(
     pullResponse.skills.filter((skill) => skill.source === "curated").map((skill) => skill.name)
   );
   const protectedSkillNames = /* @__PURE__ */ new Set([...cloudCuratedSkillNames, ...BASE_SKILL_NAMES]);
   const scopedState = withoutBaseSkillState(await deps.readSyncState(syncPaths));
   const assignmentFailures = [];
-  const deactivated = !syncPaths.isolatedNamespace && syncSettings.agent_targets_conditional_updates === true ? await deactivateDeletedAgentSkills(
+  const deactivated = linkAgentFolders && !syncPaths.isolatedNamespace && syncSettings.agent_targets_conditional_updates === true ? await deactivateDeletedAgentSkills(
     serverUrl,
     jwt,
     pullResponse,
@@ -3162,7 +3369,7 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
       protectedSkillNames
     });
   }
-  if (!syncPaths.isolatedNamespace) {
+  if (linkAgentFolders && !syncPaths.isolatedNamespace) {
     await deps.gatherTopLevelLocalSkills(syncPaths, { protectedSkillNames });
   }
   const localSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
@@ -3278,20 +3485,20 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
 }
 
 // src/runtime/sync-skills.js
-import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID3 } from "node:crypto";
 import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { dirname as dirname4, join as join5 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { dirname as dirname7, join as join7 } from "node:path";
 
 // src/runtime/base-skills.js
-import { dirname as dirname3, join as join4, relative, resolve as resolve2 } from "node:path";
+import { dirname as dirname6, join as join6, relative, resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 var BASE_SKILL_NAMES2 = Object.freeze([
   "notis-apps",
   "notis-query",
   "notis-cli"
 ]);
-var HERE = dirname3(fileURLToPath2(import.meta.url));
+var HERE = dirname6(fileURLToPath2(import.meta.url));
 
 // src/runtime/sync-skills.js
 var DEFAULT_LOCK_TIMEOUT_MS = 3e4;
@@ -3300,7 +3507,7 @@ var DEFAULT_LOCK_POLL_MS = 50;
 async function lockSnapshot(lockDirectory) {
   try {
     const [raw, metadata] = await Promise.all([
-      readFile(join5(lockDirectory, "owner"), "utf8").catch(() => ""),
+      readFile(join7(lockDirectory, "owner"), "utf8").catch(() => ""),
       stat(lockDirectory)
     ]);
     let owner = {};
@@ -3333,14 +3540,14 @@ function processIsAlive2(pid) {
   }
 }
 function delay(milliseconds) {
-  return new Promise((resolve3) => setTimeout(resolve3, milliseconds));
+  return new Promise((resolve4) => setTimeout(resolve4, milliseconds));
 }
 async function quarantineStaleLock(lockDirectory, snapshot) {
-  const quarantineRoot = join5(dirname4(lockDirectory), ".stale-operation-locks");
+  const quarantineRoot = join7(dirname7(lockDirectory), ".stale-operation-locks");
   const snapshotToken = createHash5("sha256").update(JSON.stringify(snapshot)).digest("hex");
   await mkdir(quarantineRoot, { recursive: true, mode: 448 });
   try {
-    await rename(lockDirectory, join5(quarantineRoot, snapshotToken));
+    await rename(lockDirectory, join7(quarantineRoot, snapshotToken));
     return true;
   } catch (error) {
     if (["EEXIST", "ENOTEMPTY", "ENOENT"].includes(error?.code)) return false;
@@ -3348,16 +3555,16 @@ async function quarantineStaleLock(lockDirectory, snapshot) {
   }
 }
 async function writeLockOwnerAtomically(lockDirectory, owner) {
-  const temporaryOwnerPath = join5(lockDirectory, `.owner.${owner.id}.tmp`);
-  const ownerPath = join5(lockDirectory, "owner");
+  const temporaryOwnerPath = join7(lockDirectory, `.owner.${owner.id}.tmp`);
+  const ownerPath = join7(lockDirectory, "owner");
   await writeFile(temporaryOwnerPath, JSON.stringify(owner), { mode: 384 });
   await rename(temporaryOwnerPath, ownerPath);
 }
 async function releaseOwnedLock(lockDirectory, ownerId) {
   const owner = await lockSnapshot(lockDirectory);
   if (owner?.id !== ownerId) return;
-  const quarantineRoot = join5(dirname4(lockDirectory), ".stale-operation-locks");
-  const releasedDirectory = join5(quarantineRoot, `released.${ownerId}`);
+  const quarantineRoot = join7(dirname7(lockDirectory), ".stale-operation-locks");
+  const releasedDirectory = join7(quarantineRoot, `released.${ownerId}`);
   await mkdir(quarantineRoot, { recursive: true, mode: 448 });
   try {
     await rename(lockDirectory, releasedDirectory);
@@ -3368,16 +3575,16 @@ async function releaseOwnedLock(lockDirectory, ownerId) {
   await rm(releasedDirectory, { recursive: true, force: true });
 }
 async function withSkillSyncLock(callback, {
-  home = homedir3(),
+  home = homedir4(),
   timeoutMs = DEFAULT_LOCK_TIMEOUT_MS,
   staleMs = DEFAULT_LOCK_STALE_MS,
   pollMs = DEFAULT_LOCK_POLL_MS,
   now = () => Date.now()
 } = {}) {
-  const lockDirectory = join5(home, ".notis", "skills", ".operation-lock");
-  const ownerId = `${process.pid}.${randomUUID2()}`;
+  const lockDirectory = join7(home, ".notis", "skills", ".operation-lock");
+  const ownerId = `${process.pid}.${randomUUID3()}`;
   const deadline = now() + timeoutMs;
-  await mkdir(dirname4(lockDirectory), { recursive: true, mode: 448 });
+  await mkdir(dirname7(lockDirectory), { recursive: true, mode: 448 });
   for (; ; ) {
     try {
       await mkdir(lockDirectory, { mode: 448 });
@@ -3413,7 +3620,7 @@ async function withSkillSyncLock(callback, {
   let heartbeatInFlight = Promise.resolve();
   const refreshHeartbeat = async () => {
     if (heartbeatStopped) return;
-    const temporaryOwnerPath = join5(lockDirectory, `.owner.${ownerId}.tmp`);
+    const temporaryOwnerPath = join7(lockDirectory, `.owner.${ownerId}.tmp`);
     await writeFile(
       temporaryOwnerPath,
       JSON.stringify({ id: ownerId, pid: process.pid, at: now() }),
@@ -3424,7 +3631,7 @@ async function withSkillSyncLock(callback, {
       await rm(temporaryOwnerPath, { force: true });
       return;
     }
-    await rename(temporaryOwnerPath, join5(lockDirectory, "owner"));
+    await rename(temporaryOwnerPath, join7(lockDirectory, "owner"));
   };
   const heartbeat = setInterval(() => {
     heartbeatInFlight = heartbeatInFlight.then(refreshHeartbeat).catch(() => void 0);
@@ -3441,12 +3648,20 @@ async function withSkillSyncLock(callback, {
 }
 
 // src/skill-sync-worker.js
+function currentCliProfile() {
+  try {
+    return getCurrentProfileName(loadConfig());
+  } catch {
+    return null;
+  }
+}
 async function runAutomaticSkillSync({ profile, apiBase, userId }, {
   resolveRuntime = resolveRuntimeProfile,
   refresh = ensureFreshOAuthCredential,
   settings = fetchSyncSettings,
   sync = runSkillSync,
-  lock = withSkillSyncLock
+  lock = withSkillSyncLock,
+  currentProfile = currentCliProfile
 } = {}) {
   const runtime = resolveRuntime({ profile }, { requireAuth: true });
   if (runtime.credentialKind !== "oauth" || runtime.apiBase !== apiBase || runtime.oauthUserId !== userId) throw new Error("Automatic skill sync account changed; run notis skills sync to rebind");
@@ -3454,20 +3669,21 @@ async function runAutomaticSkillSync({ profile, apiBase, userId }, {
   const saved = await settings(runtime.apiBase, runtime.jwt);
   if (saved.user_id !== userId) throw new Error("Automatic skill sync identity mismatch");
   if (!saved.sync_enabled) return { status: "disabled" };
+  const linkAgentFolders = (currentProfile() ?? profile) === profile;
   const result = await lock(() => sync(runtime.apiBase, runtime.jwt, {
     fetchSyncSettings: async () => saved
-  }, { honorSyncEnabled: true }));
+  }, { honorSyncEnabled: true, ...linkAgentFolders ? {} : { linkAgentFolders: false } }));
   return { status: result.failedLinks?.length || result.failedPushes?.length ? "partial" : "synced", ...result };
 }
 async function main(args = process.argv.slice(2)) {
   const [profile, apiBase, userId] = args;
-  const root = join6(homedir4(), ".notis", "skills", "service");
+  const root = join8(homedir5(), ".notis", "skills", "service");
   const record = (value) => {
-    mkdirSync3(root, { recursive: true, mode: 448 });
-    const target = join6(root, "status.json");
+    mkdirSync5(root, { recursive: true, mode: 448 });
+    const target = join8(root, "status.json");
     const temporary = `${target}.${process.pid}.tmp`;
-    writeFileSync3(temporary, JSON.stringify({ ...value, profile, at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2), { mode: 384 });
-    renameSync3(temporary, target);
+    writeFileSync5(temporary, JSON.stringify({ ...value, profile, at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2), { mode: 384 });
+    renameSync5(temporary, target);
   };
   const deadline = setTimeout(() => {
     record({ status: "error", code: "sync_timeout" });