@persistmemory/cli 0.5.0 → 0.7.0

package/dist/bin.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-// node_modules/@persistmemory/sdk/dist/index.js
+// ../sdk-js/dist/index.js
 function encodeQuery(params) {
   if (!params) return "";
   const search = new URLSearchParams();
@@ -234,6 +234,27 @@ var HttpClient = class {
       ...options ? { options } : {}
     });
   }
+  /** POST with a file as the body. The type describes the bytes, not JSON. */
+  async postBytes(path, bytes, contentType, query, options) {
+    return this.#request({
+      method: "POST",
+      path,
+      rawBody: bytes,
+      contentType,
+      ...query ? { query } : {},
+      ...options ? { options } : {}
+    });
+  }
+  /** GET that returns bytes rather than JSON, for downloading a file. */
+  async getBytes(path, query, options) {
+    return this.#request({
+      method: "GET",
+      path,
+      rawResponse: true,
+      ...query ? { query } : {},
+      ...options ? { options } : {}
+    });
+  }
   async patch(path, body, options) {
     return this.#request({
       method: "PATCH",
@@ -286,11 +307,20 @@ var HttpClient = class {
         this.#fetch(url, {
           method: request.method,
           headers: this.#headers(request),
-          ...request.body !== void 0 ? { body: JSON.stringify(request.body) } : {},
+          ...request.rawBody !== void 0 ? { body: request.rawBody } : request.body !== void 0 ? { body: JSON.stringify(request.body) } : {},
           signal: deadline.signal
         }),
         deadline.signal
       );
+      if (request.rawResponse && response.ok) {
+        const disposition = response.headers.get("content-disposition") ?? "";
+        const named = /filename="([^"]+)"/.exec(disposition)?.[1];
+        return {
+          bytes: new Uint8Array(await response.arrayBuffer()),
+          contentType: response.headers.get("content-type") ?? "application/octet-stream",
+          ...named ? { filename: named } : {}
+        };
+      }
       const payload = await readBody(response);
       if (!response.ok) throw errorFromResponse(response.status, payload, response.headers);
       return payload;
@@ -311,9 +341,11 @@ var HttpClient = class {
     return {
       // The only place the key is ever read.
       authorization: `Bearer ${this.#apiKey}`,
-      accept: "application/json",
+      // A download route answers with the file's own type, so `*/*` rather
+      // than a promise to accept only JSON that the server would have to break.
+      accept: request.rawResponse ? "*/*" : "application/json",
       "user-agent": this.#userAgent,
-      ...request.body !== void 0 ? { "content-type": "application/json" } : {},
+      ...request.rawBody !== void 0 ? { "content-type": request.contentType ?? "application/octet-stream" } : request.body !== void 0 ? { "content-type": "application/json" } : {},
       ...request.options?.idempotencyKey ? { "idempotency-key": request.options.idempotencyKey } : {}
     };
   }
@@ -344,7 +376,7 @@ var SignalFired = class extends Error {
 };
 function untilAborted(work, signal) {
   work.catch(() => void 0);
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve8, reject) => {
     if (signal.aborted) {
       reject(new SignalFired());
       return;
@@ -354,7 +386,7 @@ function untilAborted(work, signal) {
     work.then(
       (value) => {
         signal.removeEventListener("abort", onAbort);
-        resolve9(value);
+        resolve8(value);
       },
       (error) => {
         signal.removeEventListener("abort", onAbort);
@@ -364,14 +396,14 @@ function untilAborted(work, signal) {
   });
 }
 function defaultSleep(ms, signal) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve8, reject) => {
     if (signal?.aborted) {
       reject(new AbortError());
       return;
     }
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", onAbort);
-      resolve9();
+      resolve8();
     }, ms);
     function onAbort() {
       clearTimeout(timer);
@@ -617,17 +649,22 @@ var Spaces = class {
   /**
    * The memories filed in a Space.
    *
-   * This endpoint answers `{ data, pagination: { limit } }` with no cursor: it
-   * returns the first `limit` members and stops. Wrapped in a `Paginated`
-   * anyway so it reads like every other list, and it simply yields one page -
-   * a caller who needs more should filter `memories.list` by `spaceIds`, which
-   * is the endpoint that actually pages.
+   * The cursor is PASSED. This fetch used to ignore the paginator's cursor
+   * on the stale belief that the endpoint had none — the server has minted
+   * `pagination.nextCursor` since it started paging, and its own comment
+   * says "both SDKs iterate by reading pagination". Ignoring it meant every
+   * page request was identical: the loop guard saw a non-advancing fetch and
+   * stopped silently, so `all()` returned the first page twice and dropped
+   * everything after it — duplicated AND truncated data, with no error.
    */
   memories(id, params = {}, options) {
     return new Paginated(
-      () => this.#http.get(
+      (cursor) => this.#http.get(
         `/api/v1/spaces/${encodeURIComponent(id)}/memories`,
-        { ...params.limit !== void 0 ? { limit: params.limit } : {} },
+        {
+          ...params.limit !== void 0 ? { limit: params.limit } : {},
+          ...cursor !== void 0 ? { cursor } : {}
+        },
         options
       )
     );
@@ -653,6 +690,94 @@ var Spaces = class {
       options
     );
   }
+  /* ----------------------- who else can see it ----------------------- */
+  /**
+   * Who can see this Space, including invitations nobody has accepted.
+   *
+   * A DIFFERENT EDGE from `memories()` next door, and the difference is worth
+   * holding on to: that one maps a MEMORY to a Space, this one maps a PERSON
+   * to a Space. The server keeps them in two tables with two names for exactly
+   * that reason.
+   *
+   * Read `acceptedAt` before you render a row. An invitation grants nothing
+   * until it is accepted, so a list that draws invited and accepted people the
+   * same way tells its user somebody is reading their memories when nobody is.
+   *
+   * Paginated like every other list here. A Space has a handful of
+   * collaborators rather than thousands, so this will usually be one page -
+   * which costs a caller nothing and means the shape does not change if a
+   * Space ever has an organisation on it.
+   */
+  collaborators(id, params = {}, options) {
+    return new Paginated(
+      (cursor) => this.#http.get(
+        `/api/v1/sharing/spaces/${encodeURIComponent(id)}/collaborators`,
+        {
+          ...params.limit !== void 0 ? { limit: params.limit } : {},
+          ...cursor !== void 0 ? { cursor } : {}
+        },
+        options
+      )
+    );
+  }
+  /**
+   * Offers somebody sight of a Space. Answers with the invitation.
+   *
+   * AN OFFER, NOT A GRANT, and the returned `acceptedAt` will be absent to
+   * prove it. The recipient has to accept before they can see anything, which
+   * is the property that keeps "nothing enters your memory without you" true
+   * even when somebody else starts the sharing. Do not tell your user their
+   * Space "has been shared" on the strength of a 2xx here.
+   *
+   * WHAT THEY GET IS THE WHOLE SPACE: every memory already filed in it and
+   * every memory that lands in it afterwards. There is no narrower grant, and
+   * `role` does not make one - it decides what they may do BESIDES read.
+   *
+   * Worth an idempotency key when a person is behind it. A double-clicked
+   * "share" is two invitations to the same address, and the second one is a
+   * second email arriving at somebody who has already been asked.
+   */
+  async share(id, params, options) {
+    return this.#http.post(
+      `/api/v1/sharing/spaces/${encodeURIComponent(id)}/collaborators`,
+      params,
+      options
+    );
+  }
+  /**
+   * Ends somebody's access, or withdraws an invitation they never accepted.
+   *
+   * Nothing was ever copied into their account - a collaborator SEES the
+   * owner's memories rather than holding a duplicate - so this is one write
+   * and not a cascade, and there is no orphaned copy left behind.
+   *
+   * A body on a DELETE, matching `removeMemories` above. The alternative is an
+   * address in a path segment, where every `.`, `+` and `@` is a chance for a
+   * proxy or a router to normalise somebody else's email into the one that
+   * gets revoked.
+   */
+  async unshare(id, email, options) {
+    return this.#http.delete(
+      `/api/v1/sharing/spaces/${encodeURIComponent(id)}/collaborators`,
+      { email },
+      options
+    );
+  }
+  /**
+   * Changes what an existing collaborator may do. Never invites anybody.
+   *
+   * The quiet one. Moving somebody from `viewer` to `owner` sends no
+   * invitation and needs no acceptance, and afterwards they can share the
+   * Space onward and revoke the person who promoted them. Show your user what
+   * `owner` means before you send this, not after.
+   */
+  async setRole(id, params, options) {
+    return this.#http.patch(
+      `/api/v1/sharing/spaces/${encodeURIComponent(id)}/collaborators`,
+      params,
+      options
+    );
+  }
 };
 var Sources = class {
   #http;
@@ -890,6 +1015,119 @@ var Conversations = class {
     );
   }
 };
+var Google = class {
+  #http;
+  constructor(http) {
+    this.#http = http;
+  }
+  /** Files by name, newest first. Omit the query for recently changed ones. */
+  async searchDrive(params = {}, options) {
+    return this.#http.get(
+      "/api/v1/google/drive/files",
+      {
+        ...params.query !== void 0 ? { query: params.query } : {},
+        ...params.limit !== void 0 ? { limit: params.limit } : {}
+      },
+      options
+    );
+  }
+  async getDriveFile(fileId, options) {
+    return this.#http.get(
+      `/api/v1/google/drive/files/${encodeURIComponent(fileId)}`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * The bytes of a Drive file.
+   *
+   * A Google Doc, Sheet or Slide holds no bytes of its own and is exported on
+   * the way - a document as PDF, a spreadsheet as CSV - so `filename` comes
+   * back describing what it BECAME. Writing it under the id instead produces a
+   * file nothing will open.
+   */
+  async downloadDriveFile(fileId, options) {
+    return this.#http.getBytes(
+      `/api/v1/google/drive/files/${encodeURIComponent(fileId)}/content`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * Writes a file into the user's Drive.
+   *
+   * Needs one of the Drive write permissions on their connection. A read-only
+   * grant is refused by Google, and the error names the missing permission
+   * rather than reporting a failed upload - one is fixed with a checkbox and
+   * the other sends somebody looking for a bug.
+   */
+  async saveToDrive(params, options) {
+    return this.#http.postBytes(
+      "/api/v1/google/drive/files",
+      params.bytes,
+      params.contentType ?? "application/octet-stream",
+      {
+        name: params.name,
+        ...params.folderId !== void 0 ? { folderId: params.folderId } : {}
+      },
+      options
+    );
+  }
+  /**
+   * Recent messages - senders, subjects and a one-line preview, never bodies.
+   *
+   * `query` is Gmail's own syntax passed through as written: `from:priya`,
+   * `has:attachment`, `newer_than:7d`. It selects within the connected mailbox
+   * and cannot reach another one.
+   */
+  async searchMail(params = {}, options) {
+    return this.#http.get(
+      "/api/v1/google/mail",
+      {
+        ...params.query !== void 0 ? { query: params.query } : {},
+        ...params.limit !== void 0 ? { limit: params.limit } : {}
+      },
+      options
+    );
+  }
+  /** One message, with its body and the names of what is attached. */
+  async readMail(messageId, options) {
+    return this.#http.get(
+      `/api/v1/google/mail/${encodeURIComponent(messageId)}`,
+      void 0,
+      options
+    );
+  }
+  /**
+   * The bytes of one attachment.
+   *
+   * Separate from `readMail` so listing a mailbox never drags attachments
+   * across the network: a message with a 40 MB deck should not cost 40 MB to
+   * summarise.
+   */
+  async downloadAttachment(messageId, attachmentId, options) {
+    return this.#http.getBytes(
+      `/api/v1/google/mail/${encodeURIComponent(messageId)}/attachments/${encodeURIComponent(attachmentId)}`,
+      void 0,
+      options
+    );
+  }
+  /** Sends as the connected account. Needs the send permission. */
+  async sendMail(params, options) {
+    return this.#http.post("/api/v1/google/mail/send", params, options);
+  }
+  /** People in the user's contacts. Omit the query to list them. */
+  async contacts(params = {}, options) {
+    return this.#http.get(
+      "/api/v1/google/contacts",
+      {
+        ...params.query !== void 0 ? { query: params.query } : {},
+        ...params.limit !== void 0 ? { limit: params.limit } : {}
+      },
+      options
+    );
+  }
+};
 var Integrations = class {
   #http;
   constructor(http) {
@@ -1020,6 +1258,8 @@ var PersistMemory = class {
   conflicts;
   conversations;
   integrations;
+  /** Drive, mail and contacts on the user's connected Google account. */
+  google;
   health;
   agent;
   #http;
@@ -1036,6 +1276,7 @@ var PersistMemory = class {
     this.conflicts = new Conflicts(this.#http);
     this.conversations = new Conversations(this.#http);
     this.integrations = new Integrations(this.#http);
+    this.google = new Google(this.#http);
     this.health = new Health(this.#http);
     this.agent = new Agent(this.#http);
   }
@@ -1293,6 +1534,23 @@ function maskToken(token) {
   return `${token.slice(0, 4)}\u2026${token.slice(-4)}`;
 }
 
+// src/display-safe.ts
+var NEUTRALISED = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u061c\u200b\u200e\u200f\u202a-\u202e\u2060-\u2064\u2066-\u206f\ufeff\ufff9-\ufffb]|[\u{e0000}-\u{e007f}]/gu;
+var LINE_BREAKS = /\r\n|[\r\u2028\u2029]/g;
+function displaySafe(text) {
+  return text.replace(LINE_BREAKS, "\n").replace(NEUTRALISED, "");
+}
+function jsonSafe(value) {
+  return JSON.stringify(value, void 0, 2).replace(
+    NEUTRALISED,
+    (match) => (
+      // Per UTF-16 unit, so a tags-block codepoint becomes its surrogate pair
+      // rather than one escape JSON cannot represent.
+      match.split("").map((unit) => "\\u" + unit.charCodeAt(0).toString(16).padStart(4, "0")).join("")
+    )
+  );
+}
+
 // src/output.ts
 var OUTPUT_FORMATS = ["table", "json", "yaml", "csv", "tsv"];
 function isOutputFormat(value) {
@@ -1301,7 +1559,7 @@ function isOutputFormat(value) {
 function render(rows, columns, options) {
   switch (options.format) {
     case "json":
-      return JSON.stringify(rows, null, 2);
+      return jsonSafe(rows);
     case "yaml":
       return toYaml(rows);
     case "csv":
@@ -1313,13 +1571,13 @@ function render(rows, columns, options) {
   }
 }
 function renderOne(row, fields, options) {
-  if (options.format === "json") return JSON.stringify(row, null, 2);
+  if (options.format === "json") return jsonSafe(row);
   if (options.format === "yaml") return toYaml(row);
   if (options.format === "csv" || options.format === "tsv") {
     return delimited([row], fields, options.format === "csv" ? "," : "	");
   }
   const width = Math.max(...fields.map((field) => field.header.length));
-  return fields.map((field) => `${field.header.padEnd(width)}  ${field.value(row)}`).join("\n");
+  return fields.map((field) => `${field.header.padEnd(width)}  ${displaySafe(field.value(row))}`).join("\n");
 }
 function table(rows, columns, width = process.stdout.columns || 120) {
   if (rows.length === 0) return "";
@@ -1379,7 +1637,8 @@ function isBlock(value) {
   if (Array.isArray(value)) return value.length > 0;
   return typeof value === "object" && value !== null && Object.keys(value).length > 0;
 }
-function yamlString(value) {
+function yamlString(text) {
+  const value = displaySafe(text);
   if (value === "") return '""';
   if (value.includes("\n")) {
     return `|-
@@ -1391,7 +1650,7 @@ ${value.split("\n").map((line) => `  ${line}`).join("\n")}`;
   return ambiguous ? `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : value;
 }
 function oneLine(value) {
-  return value.replace(/\s*\n\s*/g, " ").trim();
+  return displaySafe(value).replace(/\s*\n\s*/g, " ").trim();
 }
 function clip(value, width) {
   if (value.length <= width) return value;
@@ -1404,7 +1663,7 @@ function shortDate(iso) {
 }
 
 // src/help.ts
-var VERSION = true ? "0.5.0" : versionFromManifest();
+var VERSION = true ? "0.7.0" : versionFromManifest();
 var PACKAGE = "@persistmemory/cli";
 var HELP = `
   pm \u2014 PersistMemory from your terminal
@@ -1442,28 +1701,31 @@ var HELP = `
                                      to what is in it
     spaces merge "A" "B" --name "C"  a new Space holding both, originals kept
 
+    spaces sharing "Acme"            who can see it, and who has accepted
+    spaces share "Acme" <email> --role viewer|editor
+                                     offer somebody sight of EVERYTHING in it,
+                                     now and later. You must say the role.
+                                     They see nothing until they accept.
+    spaces unshare "Acme" <email>    end their access
+    spaces role "Acme" <email> editor
+                                     change what an existing collaborator may do
+
     remember <text>                  capture text
     remember -                       capture whatever is piped in
     remember --file <path>           capture a file's contents
 
     agent                            answer file and command requests from this
-                                     machine. Reads the folders in your home
-                                     directory \u2014 never anything hidden \u2014 and
-                                     nothing outside them. It says which ones
-                                     when it starts. Stays in the foreground;
-                                     background it and stop it later with:
+                                     machine. Reads anywhere on it \u2014 you
+                                     approve every request first, and see the
+                                     exact path or command before you do.
+                                     Stays in the foreground; background it
+                                     and stop it later with:
                                        nohup pm agent > ~/agent.log 2>&1 &
                                        pkill -f "pm agent"
-    agent --root <dir> [--root ...]  choose the folders for this run
+    agent --root <dir> [--root ...]  narrow it to these folders, for this run
 
-    Settings live in ~/.persistmemory/agent.json, and apply every time:
-
-      {
-        "roots": ["~/code", "~/Documents"],
-        "mode":  "ask",          ask | auto-read | plan
-        "allow": ["swift"],      programs this machine treats as reads
-        "deny":  ["rm"]          programs it refuses, whatever is approved
-      }
+    A command that reaches the network, or that runs a language, is refused by
+    this machine whatever anybody approves.
 
     search <query>                   search your memory
     list memories                    the most recent memories
@@ -1622,8 +1884,8 @@ async function startLoopback(options = {}) {
   const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
   let resolveCallback;
   let rejectCallback;
-  const received = new Promise((resolve9, reject) => {
-    resolveCallback = resolve9;
+  const received = new Promise((resolve8, reject) => {
+    resolveCallback = resolve8;
     rejectCallback = reject;
   });
   const server = createServer((request, response) => {
@@ -1659,9 +1921,9 @@ async function startLoopback(options = {}) {
     response.end(donePage(callback));
     resolveCallback?.(callback);
   });
-  await new Promise((resolve9, reject) => {
+  await new Promise((resolve8, reject) => {
     server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve9);
+    server.listen(0, "127.0.0.1", resolve8);
   });
   const address = server.address();
   if (address === null || typeof address === "string") {
@@ -1925,7 +2187,7 @@ function safeEqual(a, b) {
 }
 async function openBrowser(url) {
   const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
-  await new Promise((resolve9, reject) => {
+  await new Promise((resolve8, reject) => {
     const child = spawn(command, args, {
       stdio: "ignore",
       // Detached so closing the terminal does not close the browser, and so
@@ -1934,7 +2196,7 @@ async function openBrowser(url) {
     });
     child.once("error", reject);
     child.unref();
-    resolve9();
+    resolve8();
   });
 }
 async function describe(response) {
@@ -1996,16 +2258,16 @@ async function currentCredential(resolved, deps) {
 // src/context.ts
 import { createInterface } from "node:readline";
 async function askOnTty(prompt, input = process.stdin, output = process.stdout) {
-  return new Promise((resolve9) => {
+  return new Promise((resolve8) => {
     const readline = createInterface({ input, output });
     let answered = false;
     readline.question(prompt, (answer3) => {
       answered = true;
-      resolve9(answer3.trim());
+      resolve8(answer3.trim());
       readline.close();
     });
     readline.once("close", () => {
-      if (!answered) resolve9("");
+      if (!answered) resolve8("");
     });
   });
 }
@@ -2015,16 +2277,16 @@ var BACKSPACE = "\b";
 async function readSecretFromTty(prompt) {
   const input = process.stdin;
   if (!input.isTTY) {
-    return new Promise((resolve9) => {
+    return new Promise((resolve8) => {
       const readline = createInterface({ input });
       let answered = false;
       readline.once("line", (line) => {
         answered = true;
-        resolve9(line.trim());
+        resolve8(line.trim());
         readline.close();
       });
       readline.once("close", () => {
-        if (!answered) resolve9("");
+        if (!answered) resolve8("");
       });
     });
   }
@@ -2033,14 +2295,14 @@ async function readSecretFromTty(prompt) {
   input.setRawMode?.(true);
   input.resume();
   input.setEncoding("utf8");
-  return new Promise((resolve9) => {
+  return new Promise((resolve8) => {
     let value = "";
     const finish2 = () => {
       input.removeListener("data", onData);
       input.setRawMode?.(previouslyRaw);
       input.pause();
       process.stdout.write("\n");
-      resolve9(value.trim());
+      resolve8(value.trim());
     };
     const onData = (chunk) => {
       for (const character of chunk) {
@@ -2076,9 +2338,9 @@ async function readStdin() {
 
 // src/commands/agent.ts
 import { hostname } from "node:os";
-import { homedir as homedir3 } from "node:os";
-import { basename, join as join6, resolve as resolve4 } from "node:path";
-import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { basename, join as join5, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync, statSync as statSync3, writeFileSync as writeFileSync4 } from "node:fs";
 
 // src/files.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync, statSync, writeFileSync as writeFileSync3 } from "node:fs";
@@ -2189,9 +2451,26 @@ ${head.join("\n")}`;
 // src/commands/run-command.ts
 import { spawn as spawn2 } from "node:child_process";
 import { existsSync as existsSync4, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join4, resolve as resolvePath } from "node:path";
+import { isAbsolute as isAbsolute2, join as join4, relative as relative2, resolve as resolvePath } from "node:path";
 var CLASSES = new Map([
-  // Reads. Report on the filesystem and change nothing.
+  /*
+      Reads. Report on the machine and change nothing.
+  
+      Several of these are reads only until a particular flag is passed —
+      `find -exec` runs any program, `sort -o` writes a file, `dmesg -C` empties
+      the kernel buffer — and the name alone cannot see that. `FLAG_CHANGES_CLASS`
+      below is where those come back out again; a name in this list is the
+      starting point, not the verdict.
+  
+      `journalctl`, `dmesg` and `zcat` are here because of what people actually
+      ask for. "Check the logs on my server" is `journalctl -n 200 -u nginx`,
+      `dmesg -T`, or `zcat` on a rotated `.gz`, and leaving all three in
+      `unknown` bought nothing: every command already waits for a person, so the
+      only thing an honest `read` label changes is that it stops being a lie.
+      `zcat` earns it by only ever writing to stdout — `gunzip` and `gzip -d`
+      delete their input, which is why neither is here — and the decompression
+      bomb it can be handed is bounded by the output cap rather than by trust.
+    */
   ...[
     "ls",
     "cat",
@@ -2219,7 +2498,10 @@ var CLASSES = new Map([
     "dirname",
     "realpath",
     "ps",
-    "env"
+    "env",
+    "journalctl",
+    "dmesg",
+    "zcat"
   ].map((name) => [name, "read"]),
   // Writes. Recoverable or not, they change the machine.
   ...[
@@ -2266,16 +2548,159 @@ var SUBCOMMAND_READS = /* @__PURE__ */ new Map([
       "blame",
       "shortlog",
       "ls-files",
-      "rev-parse",
-      "config"
+      "rev-parse"
     ])
   ],
-  ["npm", /* @__PURE__ */ new Set(["ls", "list", "view", "outdated", "why", "config"])],
-  ["yarn", /* @__PURE__ */ new Set(["list", "why", "info", "config"])],
-  ["docker", /* @__PURE__ */ new Set(["ps", "images", "logs", "inspect"])]
+  ["npm", /* @__PURE__ */ new Set(["ls", "list", "view", "outdated", "why"])],
+  ["yarn", /* @__PURE__ */ new Set(["list", "why", "info"])],
+  /*
+      `docker logs` STAYS a read, having been looked at again.
+  
+      The case against it is real: every docker subcommand is a request to a
+      daemon running as root, so "it only reads" is a statement about the
+      subcommand and not about the socket it is sent down. The case for keeping
+      it is that `logs` cannot start, stop or change anything — it prints what a
+      container already wrote to its own stdout — and it is one of the three
+      things anybody means by "check the logs on my server".
+  
+      What actually needed fixing was not the label but the flags in front of
+      it: see `REMOTE_FLAGS`. The residue this leaves is `docker --config=<dir>
+      logs x`, which could load a CLI plugin from a directory the argv chose;
+      `logs` is built in rather than a plugin, and a plugin has to be planted on
+      the disk first, so it is left standing rather than papered over here.
+    */
+  ["docker", /* @__PURE__ */ new Set(["ps", "images", "logs", "inspect"])],
+  /*
+      `systemctl`, which was in no table at all and so was `unknown` whole.
+  
+      It is the same shape as `git` and the reason this map exists: `systemctl
+      status nginx` asks the manager a question over its bus, and `systemctl
+      stop nginx` takes somebody's website down. One name, two powers, and the
+      first non-flag word is the whole difference. Everything not listed —
+      start, stop, restart, enable, mask, daemon-reload — lands in `write`,
+      which is where it belongs and where it already effectively was.
+  
+      `-H user@host` is not here because it is not a subcommand: it makes
+      systemctl talk to ANOTHER machine over ssh, which is `REMOTE_FLAGS` below
+      and a refusal, not a class.
+    */
+  [
+    "systemctl",
+    /* @__PURE__ */ new Set([
+      "status",
+      "show",
+      "cat",
+      "list-units",
+      "list-unit-files",
+      "list-timers",
+      "list-sockets",
+      "list-dependencies",
+      "list-jobs",
+      "list-machines",
+      "is-active",
+      "is-enabled",
+      "is-failed",
+      "is-system-running",
+      "get-default",
+      "show-environment"
+    ])
+  ]
+]);
+var FLAG_CHANGES_CLASS = /* @__PURE__ */ new Map([
+  [
+    "find",
+    new Map([
+      // Runs anything, once per file found. A model that cannot get `bash`
+      // past this file can get `find . -name x -exec bash {} ;` past it.
+      ...["-exec", "-execdir", "-ok", "-okdir"].map(
+        (flag) => [flag, "interpreter"]
+      ),
+      ...["-delete", "-fprint", "-fprint0", "-fprintf", "-fls"].map(
+        (flag) => [flag, "write"]
+      )
+    ])
+  ],
+  ["sort", /* @__PURE__ */ new Map([["-o", "write"], ["--output", "write"]])],
+  /*
+      `fd`, `rg` and `tree` were left in the read table with no entry here, and
+      the first two run arbitrary programs exactly the way `find -exec` does.
+  
+      `fd -x` IS `find -exec` under a newer name, and `rg --pre` runs a program
+      per file to decode it. Both were classified `read` and therefore ran
+      automatically: `fd --exec curl http://…` reached the network, which is the
+      one refusal nothing is supposed to override. They were refused only when
+      the helper was spelled with a slash — `pathOutsideRoots` catching
+      `/bin/sh` — so naming it `sh`, or putting it inside the roots, evaporated
+      the refusal. That is not a boundary, it is a coincidence about spelling.
+  
+      `tree -o` writes a file, the same shape as `sort -o`.
+    */
+  [
+    "fd",
+    new Map(
+      ["-x", "--exec", "-X", "--exec-batch"].map(
+        (flag) => [flag, "interpreter"]
+      )
+    )
+  ],
+  [
+    "rg",
+    new Map(
+      ["--pre", "--hostname-bin"].map((flag) => [flag, "interpreter"])
+    )
+  ],
+  ["tree", /* @__PURE__ */ new Map([["-o", "write"]])],
+  [
+    "journalctl",
+    new Map(
+      [
+        "--vacuum-size",
+        "--vacuum-time",
+        "--vacuum-files",
+        "--rotate",
+        "--flush",
+        "--sync",
+        "--relinquish-var",
+        "--smart-relinquish-var",
+        "--setup-keys",
+        "--update-catalog"
+      ].map((flag) => [flag, "write"])
+    )
+  ],
+  [
+    "dmesg",
+    new Map(
+      // `-c` reads AND clears, which is the one that costs somebody the
+      // evidence they were reading the log to find.
+      [
+        "-C",
+        "--clear",
+        "-c",
+        "--read-clear",
+        "-D",
+        "--console-off",
+        "-E",
+        "--console-on",
+        "-n",
+        "--console-level"
+      ].map((flag) => [flag, "write"])
+    )
+  ]
+]);
+var REMOTE_FLAGS = /* @__PURE__ */ new Map([
+  ["docker", /* @__PURE__ */ new Set(["-H", "--host", "--context"])],
+  ["systemctl", /* @__PURE__ */ new Set(["-H", "--host"])]
+]);
+var ENDLESS_FLAGS = /* @__PURE__ */ new Map([
+  ["tail", /* @__PURE__ */ new Set(["-f", "-F", "--follow"])],
+  ["journalctl", /* @__PURE__ */ new Set(["-f", "--follow"])],
+  ["dmesg", /* @__PURE__ */ new Set(["-w", "--follow", "-W", "--follow-new"])],
+  ["docker logs", /* @__PURE__ */ new Set(["-f", "--follow"])],
+  ["kubectl logs", /* @__PURE__ */ new Set(["-f", "--follow"])]
 ]);
 var MAX_OUTPUT_BYTES = 256 * 1024;
 var TIMEOUT_MS = 2e4;
+var AFTER_KILL_MS = 1e3;
 function describe2(argv) {
   return argv.join(" ");
 }
@@ -2283,15 +2708,73 @@ function programOf(argv) {
   const first = argv[0] ?? "";
   return first.split("/").pop() ?? first;
 }
+function subcommandOf(argv) {
+  return argv.slice(1).find((one) => !one.startsWith("-"));
+}
+function flagsIn(argv) {
+  const found = /* @__PURE__ */ new Set();
+  for (const argument of argv.slice(1)) {
+    if (argument === "--") break;
+    if (argument === "-" || !argument.startsWith("-")) continue;
+    const name = argument.split("=")[0] ?? argument;
+    found.add(name);
+    if (!name.startsWith("--")) {
+      for (const letter of name.slice(1)) found.add(`-${letter}`);
+    }
+  }
+  return found;
+}
+function anyFlag(argv, flags) {
+  if (!flags) return void 0;
+  for (const flag of flagsIn(argv)) {
+    if (flags.has(flag)) return flag;
+  }
+  return void 0;
+}
+function keysFor(argv) {
+  const program = programOf(argv);
+  const sub = subcommandOf(argv);
+  return sub ? [program, `${program} ${sub}`] : [program];
+}
+function remoteFlag(argv) {
+  return anyFlag(argv, REMOTE_FLAGS.get(programOf(argv)));
+}
+function endlessFlag(argv) {
+  for (const key of keysFor(argv)) {
+    const found = anyFlag(argv, ENDLESS_FLAGS.get(key));
+    if (found) return found;
+  }
+  return void 0;
+}
+function flagClass(argv) {
+  for (const key of keysFor(argv)) {
+    const table2 = FLAG_CHANGES_CLASS.get(key);
+    if (!table2) continue;
+    for (const flag of flagsIn(argv)) {
+      const found = table2.get(flag);
+      if (found) return found;
+    }
+  }
+  return void 0;
+}
+function runsAnotherProgram(argv) {
+  if (programOf(argv) !== "env") return false;
+  return argv.slice(1).some((one) => !one.startsWith("-") && !one.includes("="));
+}
 function classify(argv, policy) {
   const program = programOf(argv);
+  if (remoteFlag(argv)) return "network";
+  const imposed = flagClass(argv);
+  if (imposed === "interpreter" || runsAnotherProgram(argv)) return "interpreter";
+  const known = CLASSES.get(program);
+  if (known === "network" || known === "interpreter") return known;
   if (policy.allow.includes(program)) return "read";
   const reads = SUBCOMMAND_READS.get(program);
   if (reads) {
-    const sub = argv.slice(1).find((one) => !one.startsWith("-"));
+    const sub = subcommandOf(argv);
     return sub && reads.has(sub) ? "read" : "write";
   }
-  return CLASSES.get(program) ?? "unknown";
+  return imposed ?? known ?? "unknown";
 }
 function judge(argv, policy) {
   const program = programOf(argv);
@@ -2308,21 +2791,32 @@ function judge(argv, policy) {
   }
   const commandClass = classify(argv, policy);
   if (commandClass === "network") {
+    const remote = remoteFlag(argv);
     return {
       commandClass,
       automatic: false,
-      refusal: `"${program}" can reach the network. This machine will not run it, and no approval enables it: a command that reads private files and can also send them is the one combination nobody can review by looking at it.`,
+      refusal: (remote ? `"${program} ${remote}" points at another machine, so it can reach the network. ` : `"${program}" can reach the network. `) + "This machine will not run it, and no approval enables it: a command that reads private files and can also send them is the one combination nobody can review by looking at it.",
       reason: "reads private data and has a way out"
     };
   }
   if (commandClass === "interpreter") {
+    const language = CLASSES.get(program) === "interpreter";
     return {
       commandClass,
       automatic: false,
-      refusal: `"${program}" runs a language, which is every command at once. Ask for the specific command instead.`,
+      refusal: language ? `"${program}" runs a language, which is every command at once. Ask for the specific command instead.` : `"${describe2(argv)}" runs a program of its own, which is every command at once. Ask for the specific command instead.`,
       reason: "an interpreter is not one command"
     };
   }
+  const endless = endlessFlag(argv);
+  if (endless) {
+    return {
+      commandClass,
+      automatic: false,
+      refusal: `"${program} ${endless}" follows the log and never finishes, and nothing here streams \u2014 the reply is sent when the command exits. Ask for the end of the log instead: \`tail -n 500 <file>\`, \`journalctl -n 500 -u <unit>\`, \`docker logs --tail 500 <container>\`.`,
+      reason: "a follow never produces an answer"
+    };
+  }
   const outside = pathOutsideRoots(argv, policy.roots);
   if (outside) {
     return {
@@ -2346,42 +2840,81 @@ function judge(argv, policy) {
   };
 }
 function pathOutsideRoots(argv, roots) {
+  const realRoots = roots.map((root) => realLocation(resolvePath(root)));
   for (const argument of argv.slice(1)) {
-    if (argument.startsWith("-")) continue;
-    if (!argument.startsWith("/") && !argument.startsWith("~") && !argument.startsWith(".") && !argument.includes("/")) {
+    const attached = /^-[A-Za-z]([/~.].*)$/.exec(argument)?.[1];
+    const value = argument.startsWith("-") ? argument.includes("=") ? argument.slice(argument.indexOf("=") + 1) : attached ?? "" : argument;
+    if (argument.startsWith("-") && !argument.includes("=") && attached === void 0) continue;
+    if (!value.startsWith("/") && !value.startsWith("~") && !value.startsWith(".") && !value.includes("/")) {
       continue;
     }
-    const resolved = expand(argument, roots[0] ?? process.cwd());
-    if (!roots.some((root) => resolved === root || resolved.startsWith(`${root}/`))) {
+    const real = realLocation(expand(value, roots[0] ?? process.cwd()));
+    if (!realRoots.some((root) => contains(root, real))) {
       return argument;
     }
   }
   return void 0;
 }
+function contains(root, path) {
+  const rel = relative2(root, path);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+}
 function expand(argument, base) {
   const home = process.env["HOME"] ?? "";
   const withHome = argument.startsWith("~") ? join4(home, argument.slice(1)) : argument;
   return isAbsolute2(withHome) ? resolvePath(withHome) : resolvePath(base, withHome);
 }
-async function runCommand(argv, policy) {
+function refusal(text) {
+  return { ok: false, text, bytes: 0 };
+}
+async function runCommand(argv, policy, limits = {}) {
+  const maxOutputBytes = limits.maxOutputBytes ?? MAX_OUTPUT_BYTES;
+  const timeoutMs = limits.timeoutMs ?? TIMEOUT_MS;
   const verdict = judge(argv, policy);
-  if (verdict.refusal) return { ok: false, text: verdict.refusal };
+  if (verdict.refusal) return refusal(verdict.refusal);
   if (policy.mode === "plan") {
-    return { ok: false, text: `Plan mode: this machine did not run \`${describe2(argv)}\`.` };
+    return refusal(`Plan mode: this machine did not run \`${describe2(argv)}\`.`);
   }
   const cwd = policy.roots[0];
-  if (!cwd) return { ok: false, text: "This machine has no folders it may read." };
+  if (!cwd) return refusal("This machine has no folders it may read.");
   try {
-    if (!statSync2(cwd).isDirectory()) return { ok: false, text: `${cwd} is not a folder.` };
+    if (!statSync2(cwd).isDirectory()) return refusal(`${cwd} is not a folder.`);
   } catch {
-    return { ok: false, text: `${cwd} does not exist.` };
+    return refusal(`${cwd} does not exist.`);
   }
-  return new Promise((resolve9) => {
+  return new Promise((resolve8) => {
     const child = spawn2(argv[0], argv.slice(1), {
       cwd,
       // NO shell. With one, every character a model can produce is a character
       // the shell can act on, and the argument list stops meaning anything.
       shell: false,
+      /*
+              ITS OWN PROCESS GROUP, so the timeout can kill everything it started.
+      
+              A signal to one pid stops one process. `zcat` is a shell wrapper around
+              `gzip` on most systems, a script spawns what it likes, and killing the
+              parent leaves the child running and holding the stdout pipe — which is
+              what `close` waits for, so the promise below waited too, and the loop
+              with it. A negative pid signals the group.
+      
+              The cost is that this child no longer sees the Ctrl-C that stops the
+              agent, which is the right way round: the loop finishes the request it
+              is holding, and a half-killed command is not a better answer.
+      
+              Not on Windows, which has no process groups to signal; there the
+              backstop below is the whole guarantee.
+            */
+      detached: process.platform !== "win32",
+      /*
+              NO STDIN, which is a bound as much as the timeout is.
+      
+              The default is a pipe nobody ever writes to, so anything that reads
+              standard input — `cat` with no file, `grep` with a pattern and no path,
+              a program that stops to ask something — waited for the full twenty
+              seconds and came back empty, indistinguishable from a hang. There is
+              nobody at a keyboard here. Closed, so those read EOF and exit at once.
+            */
+      stdio: ["ignore", "pipe", "pipe"],
       /*
               A bare environment.
       
@@ -2395,126 +2928,87 @@ async function runCommand(argv, policy) {
         LANG: process.env["LANG"] ?? "C"
       }
     });
-    let output = "";
-    let truncated = false;
+    const started = Date.now();
+    const chunks = [];
+    let bytes = 0;
+    let lastOutput;
+    let stopped;
+    let settled = false;
+    let backstop;
+    const kill = () => {
+      try {
+        if (child.pid !== void 0 && process.platform !== "win32") {
+          process.kill(-child.pid, "SIGKILL");
+        } else {
+          child.kill("SIGKILL");
+        }
+      } catch {
+      }
+    };
+    const finished = (code) => {
+      const elapsed = (Date.now() - started) / 1e3;
+      const notes = [];
+      if (stopped === "output") {
+        notes.push(
+          `[CUT OFF. This is the first ${bytes} bytes and this machine stopped the command there \u2014 there was more, and it is not below. For a log, ask for the end of it instead: \`tail -n 500 <file>\`, \`journalctl -n 500 -u <unit>\`.]`
+        );
+      }
+      if (stopped === "time") {
+        notes.push(
+          `[STOPPED after ${elapsed.toFixed(1)}s. ` + (lastOutput === void 0 ? "It had produced nothing at all in that time" : `It had produced ${bytes} bytes, the last of them ${((lastOutput - started) / 1e3).toFixed(1)}s in`) + ", so this is a fragment of the answer rather than the answer.]"
+        );
+      }
+      if (code !== null && code !== 0) notes.push(`[exit code ${code}]`);
+      const head = notes.length > 0 ? `${notes.join("\n")}
+
+` : "";
+      const body = bytes === 0 ? "(no output)\n" : Buffer.concat(chunks).toString("utf8");
+      return {
+        // See `ok` on CommandOutcome: a non-zero exit with something to say is
+        // an answer, and a silent failure is a sentence.
+        ok: bytes > 0 || code === 0,
+        text: `$ ${describe2(argv)}
+
+${head}${body}`,
+        bytes,
+        ...code !== null ? { exitCode: code } : {},
+        ...stopped ? { stopped } : {}
+      };
+    };
+    const settle = (outcome) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (backstop) clearTimeout(backstop);
+      resolve8(outcome);
+    };
+    const stop = (why) => {
+      if (stopped) return;
+      stopped = why;
+      kill();
+      backstop = setTimeout(() => settle(finished(null)), AFTER_KILL_MS);
+    };
     const collect = (chunk) => {
-      if (truncated) return;
-      output += chunk.toString("utf8");
-      if (output.length > MAX_OUTPUT_BYTES) {
-        output = output.slice(0, MAX_OUTPUT_BYTES);
-        truncated = true;
-        child.kill("SIGKILL");
+      if (stopped) return;
+      lastOutput = Date.now();
+      const room = maxOutputBytes - bytes;
+      if (chunk.length > room) {
+        chunks.push(chunk.subarray(0, room));
+        bytes += room;
+        stop("output");
+        return;
       }
+      chunks.push(chunk);
+      bytes += chunk.length;
     };
     child.stdout.on("data", collect);
     child.stderr.on("data", collect);
-    const timer = setTimeout(() => child.kill("SIGKILL"), TIMEOUT_MS);
-    child.on("error", (error) => {
-      clearTimeout(timer);
-      resolve9({ ok: false, text: `Could not run it: ${error.message}` });
-    });
-    child.on("close", (code) => {
-      clearTimeout(timer);
-      const notes = [
-        truncated ? `
-
-[output cut off at ${MAX_OUTPUT_BYTES} bytes]` : "",
-        code !== 0 && code !== null ? `
-
-[exit code ${code}]` : ""
-      ].join("");
-      resolve9({ ok: code === 0, text: `$ ${describe2(argv)}
-
-${output}${notes}` });
-    });
+    const timer = setTimeout(() => stop("time"), timeoutMs);
+    child.on("error", (error) => settle(refusal(`Could not run it: ${error.message}`)));
+    child.on("close", (code) => settle(finished(code)));
   });
 }
 
-// src/commands/agent-config.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync, statSync as statSync3 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import { join as join5, resolve as resolve3 } from "node:path";
-var NOT_MATERIAL = /* @__PURE__ */ new Set([
-  "Library",
-  "Applications",
-  "System",
-  "Public",
-  "node_modules",
-  "go",
-  "Parallels",
-  "VirtualBox VMs"
-]);
-function discoverRoots(home = homedir2(), list = (path) => {
-  try {
-    return readdirSync(path);
-  } catch {
-    return [];
-  }
-}, isDirectory = (path) => {
-  try {
-    return statSync3(path).isDirectory();
-  } catch {
-    return false;
-  }
-}) {
-  return list(home).filter((name) => !name.startsWith(".")).filter((name) => !NOT_MATERIAL.has(name)).map((name) => join5(home, name)).filter(isDirectory).sort();
-}
-function expandHome(path, home = homedir2()) {
-  return path.startsWith("~") ? resolve3(home, path.slice(1).replace(/^[/\\]/, "")) : resolve3(path);
-}
-var MODES = /* @__PURE__ */ new Set(["ask", "auto-read", "plan"]);
-function readAgentConfig(path, read2 = (at) => readFileSync5(at, "utf8"), exists = (at) => existsSync5(at), home = homedir2()) {
-  if (!exists(path)) return {};
-  let parsed;
-  try {
-    parsed = JSON.parse(read2(path));
-  } catch (error) {
-    return { error: `${path} is not valid JSON: ${error instanceof Error ? error.message : ""}` };
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return { error: `${path} should hold an object, like {"roots": ["~/code"]}.` };
-  }
-  const held = parsed;
-  const config = {};
-  if (held["roots"] !== void 0) {
-    if (!Array.isArray(held["roots"]) || held["roots"].some((one) => typeof one !== "string")) {
-      return { error: `${path}: "roots" should be a list of folders.` };
-    }
-    config.roots = held["roots"].map((one) => expandHome(one, home));
-  }
-  if (held["mode"] !== void 0) {
-    if (typeof held["mode"] !== "string" || !MODES.has(held["mode"])) {
-      return { error: `${path}: "mode" should be "ask", "auto-read" or "plan".` };
-    }
-    config.mode = held["mode"];
-  }
-  for (const key of ["allow", "deny"]) {
-    if (held[key] === void 0) continue;
-    if (!Array.isArray(held[key]) || held[key].some((one) => typeof one !== "string")) {
-      return { error: `${path}: "${key}" should be a list of program names.` };
-    }
-    config[key] = held[key];
-  }
-  return { config };
-}
-function resolveAgentConfig(args) {
-  const roots = args.flagRoots && args.flagRoots.length > 0 ? args.flagRoots : args.stored?.roots && args.stored.roots.length > 0 ? args.stored.roots : args.discovered ?? [];
-  return {
-    roots,
-    /*
-          `ask` unless the owner said otherwise.
-    
-          The mode decides how much happens with nobody watching, so the default
-          is the one that does least. `auto-read` is a reasonable thing to choose
-          and an unreasonable thing to be given.
-        */
-    mode: args.stored?.mode ?? "ask",
-    allow: args.stored?.allow ?? [],
-    deny: args.stored?.deny ?? [],
-    source: args.flagRoots && args.flagRoots.length > 0 ? "flags" : args.stored?.roots && args.stored.roots.length > 0 ? "config" : "discovered"
-  };
-}
-
 // src/commands/agent.ts
 async function said(response, fallback) {
   const body = await response.json().catch(() => void 0);
@@ -2522,7 +3016,7 @@ async function said(response, fallback) {
   return message2 ?? `${fallback} (${response.status})`;
 }
 function locate(roots, requested) {
-  const expanded = requested.startsWith("~") ? resolve4(homedir3(), requested.slice(1).replace(/^[/\\]/, "")) : requested;
+  const expanded = requested.startsWith("~") ? resolve3(homedir2(), requested.slice(1).replace(/^[/\\]/, "")) : requested;
   if (!expanded.includes("/") && !expanded.includes("\\")) {
     const wanted2 = expanded.trim().toLowerCase();
     const named = roots.find((root) => basename(root).toLowerCase() === wanted2);
@@ -2538,29 +3032,23 @@ function locate(roots, requested) {
   throw new Error(`${requested} is not inside any allowed folder (${roots.join(", ")})`);
 }
 function uncontested(target) {
-  if (!existsSync6(target)) return target;
+  if (!existsSync5(target)) return target;
   const dot = target.lastIndexOf(".");
   const stem = dot > target.lastIndexOf("/") && dot !== -1 ? target.slice(0, dot) : target;
   const extension = stem === target ? "" : target.slice(dot);
   for (let n = 1; n < 1e3; n += 1) {
     const candidate = `${stem} (${n})${extension}`;
-    if (!existsSync6(candidate)) return candidate;
+    if (!existsSync5(candidate)) return candidate;
   }
   throw new Error(`${target} and a thousand names beside it are taken.`);
 }
-async function answer(context, apiUrl, token, settings, request) {
-  const roots = settings.roots;
+async function answer(context, apiUrl, token, roots, request) {
   let located;
   if (request.kind === "run_command") {
     if (!request.argv || request.argv.length === 0) {
       return { ok: false, error: "No command was given." };
     }
-    const policy = {
-      mode: settings.mode,
-      allow: settings.allow,
-      deny: settings.deny,
-      roots
-    };
+    const policy = { mode: "ask", allow: [], deny: [], roots };
     const outcome = await runCommand(request.argv, policy);
     if (!outcome.ok) return { ok: false, error: outcome.text };
     return upload(
@@ -2590,10 +3078,10 @@ async function answer(context, apiUrl, token, settings, request) {
     }
     try {
       let target = located;
-      if (existsSync6(located) && statSync4(located).isDirectory()) {
+      if (existsSync5(located) && statSync3(located).isDirectory()) {
         const disposition = fetched.headers.get("content-disposition") ?? "";
         const named = /filename="([^"]+)"/.exec(disposition)?.[1];
-        target = join6(located, basename(named ?? "file"));
+        target = join5(located, basename(named ?? "file"));
       }
       target = uncontested(target);
       writeFileSync4(target, downloaded, { flag: "wx" });
@@ -2616,21 +3104,9 @@ ${downloaded.length} bytes
   let filename = request.path.split("/").pop() ?? "file";
   if (request.kind === "list_dir") {
     try {
-      const stats = statSync4(located);
+      const stats = statSync3(located);
       if (!stats.isDirectory()) return { ok: false, error: `${request.path} is not a folder.` };
-      const entries = readdirSync2(located, { withFileTypes: true }).filter((entry) => !entry.name.startsWith(".")).slice(0, MAX_LISTED).map((entry) => {
-        if (entry.isDirectory()) return `${entry.name}/`;
-        try {
-          return `${entry.name}  ${sizeOf(join6(located, entry.name))}`;
-        } catch {
-          return entry.name;
-        }
-      }).sort();
-      const listing = entries.length > 0 ? entries.join("\n") : "(empty)";
-      bytes = Buffer.from(`${request.path}
-
-${listing}
-`, "utf8");
+      bytes = Buffer.from(folderListing(request.path, located), "utf8");
       filename = `${request.path.split("/").filter(Boolean).pop() ?? "listing"}.txt`;
       const grant = await upload(apiUrl, token, filename, bytes);
       return grant;
@@ -2639,9 +3115,9 @@ ${listing}
     }
   }
   try {
-    const stats = statSync4(located);
+    const stats = statSync3(located);
     if (!stats.isFile()) return { ok: false, error: `${request.path} is not a file.` };
-    bytes = readFileSync6(located);
+    bytes = readFileSync5(located);
   } catch (error) {
     return { ok: false, error: error instanceof Error ? error.message : "could not read it" };
   }
@@ -2682,8 +3158,27 @@ async function upload(apiUrl, token, filename, bytes) {
   return { ok: true, attachToken: stored.attachToken, bytes: bytes.length };
 }
 var MAX_LISTED = 200;
+function folderListing(requested, located) {
+  const all = readdirSync(located, { withFileTypes: true }).filter((entry) => !entry.name.startsWith(".")).sort((a, b) => a.name.localeCompare(b.name));
+  const shown = all.slice(0, MAX_LISTED).map((entry) => {
+    if (entry.isDirectory()) return `${entry.name}/`;
+    try {
+      return `${entry.name}  ${sizeOf(join5(located, entry.name))}`;
+    } catch {
+      return entry.name;
+    }
+  });
+  const listing = shown.length > 0 ? shown.join("\n") : "(empty)";
+  const rest = all.length > shown.length ? `
+
+[\u2026${all.length - shown.length} more entries not listed: this is the first ${MAX_LISTED} by name, not the whole folder]` : "";
+  return `${requested}
+
+${listing}${rest}
+`;
+}
 function sizeOf(path) {
-  const size = statSync4(path).size;
+  const size = statSync3(path).size;
   if (size < 1024) return `${size} B`;
   if (size < 1024 * 1024) return `${Math.round(size / 1024)} KB`;
   return `${(size / (1024 * 1024)).toFixed(1)} MB`;
@@ -2695,41 +3190,16 @@ async function agentCommand(context) {
     return 1;
   }
   const roots = (listFlag(context.args, "root") ?? []).map(
-    (one) => resolve4(one.startsWith("~") ? resolve4(homedir3(), one.slice(1).replace(/^[/\\]/, "")) : one)
+    (one) => resolve3(one.startsWith("~") ? resolve3(homedir2(), one.slice(1).replace(/^[/\\]/, "")) : one)
   );
-  const configPath = join6(context.paths.dir, "agent.json");
-  const stored = readAgentConfig(configPath);
-  if (stored.error) {
-    context.error(stored.error);
-    return 1;
-  }
-  const settings = resolveAgentConfig({
-    flagRoots: roots,
-    ...stored.config ? { stored: stored.config } : {},
-    discovered: discoverRoots()
-  });
-  if (settings.roots.length === 0) {
-    context.error(
-      "There is nothing in your home directory this machine would offer, so say which folders it may read from:"
-    );
-    context.error("");
-    context.error("  pm agent --root ~/projects");
-    context.error("");
-    context.error(`Or write them once in ${configPath}:`);
-    context.error("");
-    context.error('  { "roots": ["~/projects"], "mode": "ask" }');
-    return 1;
-  }
-  roots.length = 0;
-  roots.push(...settings.roots);
-  const shown = settings.roots.map((path) => path.replace(homedir3(), "~"));
-  const where = settings.source === "flags" ? "" : settings.source === "config" ? ` (from ${configPath})` : " (found in your home directory)";
+  const everywhere = roots.length === 0;
+  if (everywhere) roots.push("/");
   context.print(
-    `Reading ${shown.join(", ")} \u2014 nothing outside them${where}. Mode: ${settings.mode}.`
+    everywhere ? "Reading anywhere on this machine. You approve every request first, and see the exact path or command before you do. Narrow it with --root if you want to." : `Reading ${roots.map((path) => path.replace(homedir2(), "~")).join(", ")} \u2014 nothing outside them.`
   );
   for (const root of roots) {
     try {
-      if (!statSync4(root).isDirectory()) {
+      if (!statSync3(root).isDirectory()) {
         context.error(`${root} is not a folder.`);
         return 1;
       }
@@ -2802,8 +3272,10 @@ async function agentCommand(context) {
       } else {
         const { items } = await claimed.json();
         for (const request of items) {
-          context.print(`Reading ${request.path}`);
-          const outcome = await answer(context, apiUrl, await authorization(), settings, request);
+          context.print(
+            request.kind === "run_command" ? `Running ${request.path}` : `Reading ${request.path}`
+          );
+          const outcome = await answer(context, apiUrl, await authorization(), roots, request);
           const done = await call(
             `complete/${encodeURIComponent(request.id)}`,
             outcome.ok ? { result: { attachToken: outcome.attachToken } } : { error: outcome.error }
@@ -2825,8 +3297,8 @@ async function agentCommand(context) {
 
 // src/commands/google.ts
 import { writeFileSync as writeFileSync5 } from "node:fs";
-import { basename as basename2, resolve as resolve5 } from "node:path";
-import { readFileSync as readFileSync7 } from "node:fs";
+import { basename as basename2, resolve as resolve4 } from "node:path";
+import { readFileSync as readFileSync6 } from "node:fs";
 async function callApi(context, path, init = {}) {
   const credential = context.resolved.credential;
   if (!credential) {
@@ -2891,7 +3363,7 @@ async function driveGet(context, fileId) {
   const disposition = response.headers.get("content-disposition") ?? "";
   const named = /filename="([^"]+)"/.exec(disposition)?.[1];
   const out = stringFlag(context.args, "out");
-  const target = resolve5(out ?? basename2(named ?? fileId));
+  const target = resolve4(out ?? basename2(named ?? fileId));
   writeFileSync5(target, Buffer.from(await response.arrayBuffer()));
   context.print(target);
   return 0;
@@ -2903,7 +3375,7 @@ async function drivePut(context, path) {
   }
   let bytes;
   try {
-    bytes = readFileSync7(resolve5(path));
+    bytes = readFileSync6(resolve4(path));
   } catch {
     context.error(`Cannot read ${path}.`);
     return 1;
@@ -2987,8 +3459,8 @@ async function mailCommand(context) {
 }
 
 // src/commands/requests.ts
-import { existsSync as existsSync7, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve6 } from "node:path";
+import { existsSync as existsSync6, writeFileSync as writeFileSync6 } from "node:fs";
+import { basename as basename3, resolve as resolve5 } from "node:path";
 async function requestsCommand(context) {
   if (context.args.words[1] === "get") return collectCommand(context);
   const credential = context.resolved.credential;
@@ -3055,9 +3527,8 @@ async function collectCommand(context) {
     context.error(`The download refused it (${file.status}). Links expire in minutes \u2014 try again.`);
     return 1;
   }
-  const name = stringFlag(context.args, "output", "o") ?? filename;
-  const target = resolve6(name);
-  if (existsSync7(target)) {
+  const target = downloadTarget(filename, stringFlag(context.args, "output", "o"));
+  if (existsSync6(target)) {
     context.error(`${target} already exists. Pass --output to write somewhere else.`);
     return 1;
   }
@@ -3065,16 +3536,19 @@ async function collectCommand(context) {
   context.print(`Wrote ${target}`);
   return 0;
 }
+function downloadTarget(filename, output) {
+  return resolve5(output ?? (basename3(filename) || "file"));
+}
 
 // src/workspace.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname3, join as join7, resolve as resolvePath2 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname3, join as join6, resolve as resolvePath2 } from "node:path";
 var WORKSPACE_FILE = ".persistmemory.json";
 function findWorkspace(from = process.cwd()) {
   let dir = resolvePath2(from);
   for (; ; ) {
-    const file = join7(dir, WORKSPACE_FILE);
-    if (existsSync8(file)) {
+    const file = join6(dir, WORKSPACE_FILE);
+    if (existsSync7(file)) {
       const config = readWorkspace(file);
       if (config) return { file, dir, config };
     }
@@ -3085,7 +3559,7 @@ function findWorkspace(from = process.cwd()) {
 }
 function readWorkspace(file) {
   try {
-    const parsed = JSON.parse(readFileSync8(file, "utf8"));
+    const parsed = JSON.parse(readFileSync7(file, "utf8"));
     const space = parsed.space;
     if (space && typeof space === "object" && typeof space.id === "string" && space.id !== "" && typeof space.name === "string") {
       return { space: { id: space.id, name: space.name } };
@@ -3096,7 +3570,7 @@ function readWorkspace(file) {
   }
 }
 function writeWorkspace(dir, config) {
-  const file = join7(dir, WORKSPACE_FILE);
+  const file = join6(dir, WORKSPACE_FILE);
   writeFileSync7(file, `${JSON.stringify(config, null, 2)}
 `, "utf8");
   return file;
@@ -3366,9 +3840,9 @@ function message(error) {
 }
 
 // src/commands/maintain.ts
-import { existsSync as existsSync9, rmSync } from "node:fs";
+import { existsSync as existsSync8, rmSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { dirname as dirname4, resolve as resolve8 } from "node:path";
+import { dirname as dirname4, resolve as resolve7 } from "node:path";
 import { fileURLToPath } from "node:url";
 function installArgs(pkg = PACKAGE) {
   return ["install", "-g", "--prefer-online", `${pkg}@latest`];
@@ -3432,7 +3906,7 @@ Delete the file it runs from: ${processPath()}`
   return 0;
 }
 async function deleteCommand(context) {
-  if (!existsSync9(context.paths.dir)) {
+  if (!existsSync8(context.paths.dir)) {
     context.print(`Nothing to delete: ${context.paths.dir} does not exist.`);
     return 0;
   }
@@ -3461,7 +3935,7 @@ async function deleteCommand(context) {
   return 0;
 }
 function removeEverything(context) {
-  const dir = resolve8(context.paths.dir);
+  const dir = resolve7(context.paths.dir);
   if (dir === "/" || dir.split("/").filter(Boolean).length < 2) {
     context.error(`Refusing to delete ${dir}: that does not look like a data directory.`);
     return;
@@ -3473,7 +3947,7 @@ function installer() {
 }
 function processPath() {
   try {
-    return resolve8(dirname4(fileURLToPath(import.meta.url)));
+    return resolve7(dirname4(fileURLToPath(import.meta.url)));
   } catch {
     return process.argv[1] ?? "";
   }
@@ -3482,15 +3956,15 @@ function processPath() {
 // src/commands/session.ts
 import { createInterface as createInterface2 } from "node:readline";
 import { randomUUID } from "node:crypto";
-import { relative as relative2 } from "node:path";
+import { relative as relative3 } from "node:path";
 
 // src/events.ts
-import { appendFileSync, existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync9 } from "node:fs";
-import { join as join8 } from "node:path";
+import { appendFileSync, existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync8 } from "node:fs";
+import { join as join7 } from "node:path";
 function openSessionLog(paths, id) {
-  const directory = join8(paths.dir, "sessions");
+  const directory = join7(paths.dir, "sessions");
   mkdirSync3(directory, { recursive: true, mode: 448 });
-  const path = join8(directory, `${id}.jsonl`);
+  const path = join7(directory, `${id}.jsonl`);
   return {
     id,
     path,
@@ -3502,8 +3976,8 @@ function openSessionLog(paths, id) {
       }
     },
     read() {
-      if (!existsSync10(path)) return [];
-      return readFileSync9(path, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
+      if (!existsSync9(path)) return [];
+      return readFileSync8(path, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
         try {
           return [JSON.parse(line)];
         } catch {
@@ -3580,9 +4054,9 @@ async function sessionCommand(context) {
   context.print(`  Ask anything. /help for commands, /exit to leave.
 `);
   const readline = createInterface2({ input: process.stdin, output: process.stdout });
-  const ask = (prompt) => new Promise((resolve9) => {
-    readline.question(prompt, resolve9);
-    readline.once("close", () => resolve9(void 0));
+  const ask = (prompt) => new Promise((resolve8) => {
+    readline.question(prompt, resolve8);
+    readline.once("close", () => resolve8(void 0));
   });
   const root = process.cwd();
   let running = true;
@@ -3654,11 +4128,11 @@ async function handleInput(args) {
         path: file.path,
         bytes: file.bytes
       });
-      context.print(`  read ${relative2(root, file.path)} (${Math.round(file.bytes / 1024)} KB)`);
+      context.print(`  read ${relative3(root, file.path)} (${Math.round(file.bytes / 1024)} KB)`);
       if (command === "capture") {
         const client = await context.client();
         const result = await client.memories.remember(
-          { text: file.text, title: relative2(root, file.path) },
+          { text: file.text, title: relative3(root, file.path) },
           { idempotencyKey: `cli:capture:${file.path}:${file.bytes}` }
         );
         log.append({
@@ -3762,11 +4236,189 @@ async function write2(args) {
     return;
   }
   commitWrite(proposed, true);
-  context.print(`  Wrote ${relative2(root, proposed.path)}.`);
+  context.print(`  Wrote ${relative3(root, proposed.path)}.`);
+}
+
+// src/commands/sharing.ts
+var collaboratorColumns = [
+  { header: "email", value: (one) => one.email },
+  { header: "name", value: (one) => one.name ?? "" },
+  { header: "role", value: (one) => one.role },
+  // The column that matters. See `standing`.
+  { header: "access", value: (one) => standing(one) },
+  { header: "invited by", value: (one) => one.invitedBy ?? "" }
+];
+function standing(one) {
+  return one.acceptedAt ? `yes, since ${one.acceptedAt.slice(0, 10)}` : "no \u2014 invitation not accepted";
+}
+function sharingArgs(context) {
+  const words = context.args.words.slice(2);
+  const at = words.findIndex((one) => one.includes("@"));
+  const email = at >= 0 ? words[at] ?? "" : "";
+  const named = at > 0 ? words.slice(0, at).join(" ") : "";
+  const trailing = at >= 0 ? words[at + 1] : void 0;
+  return { named, email, role: stringFlag(context.args, "role") ?? trailing };
+}
+var ROLES = ["viewer", "editor"];
+function isRole(value) {
+  return value !== void 0 && ROLES.includes(value);
+}
+async function resolveSpace(context, named) {
+  const client = await context.client();
+  const { data } = await client.spaces.list({ limit: 200 }).first();
+  if (named.startsWith("space_")) {
+    const byId = data.find((one) => one.id === named);
+    if (byId) return byId;
+    context.error(`No Space with id ${named}. Run \`pm spaces list\` to see yours.`);
+    return 1;
+  }
+  const wanted2 = named.trim().toLowerCase();
+  const matches = data.filter((one) => one.name.trim().toLowerCase() === wanted2);
+  const only = matches[0];
+  if (matches.length === 1 && only) return only;
+  if (matches.length === 0) {
+    context.error(`No Space called "${named}". Run \`pm spaces list\` to see yours.`);
+    return 1;
+  }
+  context.error(
+    `More than one Space is called "${named}": ${matches.map((one) => one.id).join(", ")}.`
+  );
+  context.error("Name it by id \u2014 sharing the wrong one gives somebody the wrong memories.");
+  return 1;
+}
+async function shareSpaceCommand(context) {
+  const { named, email, role } = sharingArgs(context);
+  if (named === "" || email === "") {
+    context.error("Which Space, and who?");
+    context.error("");
+    context.error('  pm spaces share "Work" priya@example.com --role viewer');
+    return 2;
+  }
+  if (!isRole(role)) {
+    context.error("Say what they may do \u2014 there is no default:");
+    context.error("");
+    context.error(`  pm spaces share "${named}" ${email} --role viewer   read everything in it`);
+    context.error(`  pm spaces share "${named}" ${email} --role editor   read it, and add to it`);
+    if (role !== void 0) {
+      context.error("");
+      context.error(
+        role.toLowerCase() === "owner" ? "A Space cannot be handed over. Its owner is whoever created it." : `Roles are viewer and editor. "${role}" is neither.`
+      );
+    }
+    return 2;
+  }
+  const space = await resolveSpace(context, named);
+  if (typeof space === "number") return space;
+  const client = await context.client();
+  const invitation = await client.spaces.share(
+    space.id,
+    { email, role },
+    {
+      /*
+              Derived from what is being shared, not random.
+      
+              The SDK will not retry a POST without a key, and a random one per
+              attempt would defeat the point: a share that timed out after the
+              server recorded it would send a second invitation to a real person's
+              inbox. Same Space, same address, one invitation.
+            */
+      idempotencyKey: `cli:share:${space.id}:${email}`
+    }
+  );
+  if (context.flags.output !== "table") {
+    context.print(renderOne(invitation, collaboratorColumns, { format: context.flags.output }));
+    return 0;
+  }
+  context.print(`Invited ${invitation.email} to "${space.name}" as ${invitation.role}.`);
+  context.print("");
+  context.print(
+    `They will see everything filed in "${space.name}" \u2014 including memories added later.`
+  );
+  context.print("Nothing is shared yet: they have to accept the invitation first.");
+  if (invitation.role === "owner") {
+    context.print("");
+    context.print("As an owner they can share it onward and revoke anybody, including you.");
+  }
+  context.print("");
+  context.print(`Undo it with:  pm spaces unshare "${space.name}" ${invitation.email}`);
+  return 0;
+}
+async function unshareSpaceCommand(context) {
+  const { named, email } = sharingArgs(context);
+  if (named === "" || email === "") {
+    context.error("Which Space, and who?");
+    context.error("");
+    context.error('  pm spaces unshare "Work" priya@example.com');
+    return 2;
+  }
+  const space = await resolveSpace(context, named);
+  if (typeof space === "number") return space;
+  const client = await context.client();
+  const { email: ended } = await client.spaces.unshare(space.id, email);
+  if (context.flags.output !== "table") {
+    context.print(JSON.stringify({ spaceId: space.id, email: ended }, void 0, 2));
+    return 0;
+  }
+  context.print(`${ended} can no longer see "${space.name}".`);
+  context.print("Nothing of it was ever copied into their account, so nothing of it remains.");
+  return 0;
+}
+async function spaceRoleCommand(context) {
+  const { named, email, role } = sharingArgs(context);
+  if (named === "" || email === "" || !isRole(role)) {
+    context.error("Which Space, who, and what to:");
+    context.error("");
+    context.error('  pm spaces role "Work" priya@example.com editor');
+    context.error("");
+    context.error(`Roles: ${ROLES.join(", ")}. This changes somebody who already has access \u2014`);
+    context.error("use `pm spaces share` to invite a new person.");
+    return 2;
+  }
+  const space = await resolveSpace(context, named);
+  if (typeof space === "number") return space;
+  const client = await context.client();
+  const changed = await client.spaces.setRole(space.id, { email, role });
+  if (context.flags.output !== "table") {
+    context.print(renderOne(changed, collaboratorColumns, { format: context.flags.output }));
+    return 0;
+  }
+  context.print(`${changed.email} is now ${changed.role} on "${space.name}".`);
+  if (changed.role === "owner") {
+    context.print("As an owner they can share it onward and revoke anybody, including you.");
+  }
+  return 0;
+}
+async function spaceSharingCommand(context) {
+  const named = context.args.words.slice(2).join(" ").trim();
+  if (named === "") {
+    context.error('Which Space? Try `pm spaces sharing "Work"`.');
+    return 2;
+  }
+  const space = await resolveSpace(context, named);
+  if (typeof space === "number") return space;
+  const client = await context.client();
+  const { data } = await client.spaces.collaborators(space.id, { limit: 200 }).first();
+  if (context.flags.output !== "table") {
+    context.print(render(data, collaboratorColumns, { format: context.flags.output }));
+    return 0;
+  }
+  if (data.length === 0) {
+    context.print(`Nobody else can see "${space.name}". It has never been shared.`);
+    return 0;
+  }
+  context.print(render(data, collaboratorColumns, { format: context.flags.output }));
+  const waiting = data.filter((one) => one.acceptedAt === void 0).length;
+  if (waiting > 0) {
+    context.print("");
+    context.print(
+      `${waiting} ${waiting === 1 ? "invitation has" : "invitations have"} not been accepted. ${waiting === 1 ? "That person can" : "Those people can"} see nothing yet.`
+    );
+  }
+  return 0;
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync10 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 
 // src/spaces.ts
 async function spacesFor(context, client, env = process.env) {
@@ -3830,7 +4482,7 @@ async function rememberCommand(context) {
   let text;
   if (file) {
     try {
-      text = readFileSync10(file, "utf8");
+      text = readFileSync9(file, "utf8");
     } catch {
       context.error(`Could not read ${file}.`);
       return 1;
@@ -4234,8 +4886,14 @@ async function dispatch(context) {
       if (noun === "create" || noun === "new") return createSpaceCommand(context);
       if (noun === "delete" || noun === "remove") return deleteSpaceCommand(context);
       if (noun === "merge") return mergeSpacesCommand(context);
+      if (noun === "share") return shareSpaceCommand(context);
+      if (noun === "unshare") return unshareSpaceCommand(context);
+      if (noun === "role") return spaceRoleCommand(context);
+      if (noun === "sharing") return spaceSharingCommand(context);
       if (noun === void 0 || noun === "list") return listSpacesCommand(context);
-      context.error(`Cannot "pm spaces ${noun}". Try list, create, delete or merge.`);
+      context.error(
+        `Cannot "pm spaces ${noun}". Try list, create, delete, merge, share, unshare, role or sharing.`
+      );
       return 2;
     case "list":
       if (noun === "memories" || noun === "memory") return listMemoriesCommand(context);