@task0/cli 0.5.0 → 0.8.0

package/dist/main.js

@@ -9,38 +9,30 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// ../../packages/shared/dist/types/task.js
-function isActiveTaskStatus(status) {
-  return ACTIVE_TASK_STATUS_SET.has(status);
+// ../../packages/shared/dist/node/yaml.js
+import fs from "fs";
+import path from "path";
+import yaml from "js-yaml";
+function readYaml(filePath) {
+  if (!fs.existsSync(filePath))
+    return null;
+  const raw = fs.readFileSync(filePath, "utf-8");
+  return yaml.load(raw);
 }
-var TASK_STATUS_VALUES, ACTIVE_TASK_STATUSES, ATTENTION_TASK_STATUSES, ACTIVE_TASK_STATUS_SET, ATTENTION_TASK_STATUS_SET;
-var init_task = __esm({
-  "../../packages/shared/dist/types/task.js"() {
+function writeYaml(filePath, data) {
+  fs.writeFileSync(filePath, yaml.dump(data, { lineWidth: 120 }), "utf-8");
+}
+function readContext(taskDir) {
+  const files = fs.readdirSync(taskDir).filter((f) => f.endsWith(".md"));
+  if (files.length === 0)
+    return void 0;
+  const content = fs.readFileSync(path.join(taskDir, files[0]), "utf-8");
+  const stripped = content.replace(/^---[\s\S]*?---\s*/, "");
+  return stripped.trim() || void 0;
+}
+var init_yaml = __esm({
+  "../../packages/shared/dist/node/yaml.js"() {
     "use strict";
-    TASK_STATUS_VALUES = [
-      "todo",
-      "triaging",
-      "triaged",
-      "planning",
-      "planned",
-      "refining",
-      "refined",
-      "executing",
-      "blocked",
-      "done",
-      "archived"
-    ];
-    ACTIVE_TASK_STATUSES = [
-      "triaging",
-      "planning",
-      "refining",
-      "executing"
-    ];
-    ATTENTION_TASK_STATUSES = [
-      "blocked"
-    ];
-    ACTIVE_TASK_STATUS_SET = new Set(ACTIVE_TASK_STATUSES);
-    ATTENTION_TASK_STATUS_SET = new Set(ATTENTION_TASK_STATUSES);
   }
 });
 
@@ -116,57 +108,65 @@ var init_object_id = __esm({
   }
 });
 
-// ../../packages/shared/dist/node/yaml.js
-import fs5 from "fs";
-import path6 from "path";
-import yaml3 from "js-yaml";
-function readYaml(filePath) {
-  if (!fs5.existsSync(filePath))
-    return null;
-  const raw = fs5.readFileSync(filePath, "utf-8");
-  return yaml3.load(raw);
-}
-function writeYaml(filePath, data) {
-  fs5.writeFileSync(filePath, yaml3.dump(data, { lineWidth: 120 }), "utf-8");
-}
-function readContext(taskDir) {
-  const files = fs5.readdirSync(taskDir).filter((f) => f.endsWith(".md"));
-  if (files.length === 0)
-    return void 0;
-  const content = fs5.readFileSync(path6.join(taskDir, files[0]), "utf-8");
-  const stripped = content.replace(/^---[\s\S]*?---\s*/, "");
-  return stripped.trim() || void 0;
+// ../../packages/shared/dist/types/task.js
+function isActiveTaskStatus(status) {
+  return ACTIVE_TASK_STATUS_SET.has(status);
 }
-var init_yaml = __esm({
-  "../../packages/shared/dist/node/yaml.js"() {
+var TASK_STATUS_VALUES, ACTIVE_TASK_STATUSES, ATTENTION_TASK_STATUSES, ACTIVE_TASK_STATUS_SET, ATTENTION_TASK_STATUS_SET;
+var init_task = __esm({
+  "../../packages/shared/dist/types/task.js"() {
     "use strict";
+    TASK_STATUS_VALUES = [
+      "todo",
+      "triaging",
+      "triaged",
+      "planning",
+      "planned",
+      "refining",
+      "refined",
+      "executing",
+      "blocked",
+      "done",
+      "archived"
+    ];
+    ACTIVE_TASK_STATUSES = [
+      "triaging",
+      "planning",
+      "refining",
+      "executing"
+    ];
+    ATTENTION_TASK_STATUSES = [
+      "blocked"
+    ];
+    ACTIVE_TASK_STATUS_SET = new Set(ACTIVE_TASK_STATUSES);
+    ATTENTION_TASK_STATUS_SET = new Set(ATTENTION_TASK_STATUSES);
   }
 });
 
 // ../../packages/shared/dist/node/scanner.js
-import fs6 from "fs";
-import path7 from "path";
+import fs2 from "fs";
+import path2 from "path";
 function scanProject(projectPath, sourceName) {
-  const absPath = path7.resolve(projectPath);
-  const resolvedSourceName = sourceName ?? path7.basename(absPath);
+  const absPath = path2.resolve(projectPath);
+  const resolvedSourceName = sourceName ?? path2.basename(absPath);
   const errors = [];
   const tasks = [];
   const repairs = [];
-  const projectYml = path7.join(absPath, "task0.yml");
+  const projectYml = path2.join(absPath, "task0.yml");
   const projectConfig = readYaml(projectYml);
   if (!projectConfig)
     return { tasks, errors: [`${projectYml} not found`], repairs };
   if (projectConfig.kind !== "project")
     return { tasks, errors: [`Invalid: kind="${projectConfig.kind}"`], repairs };
-  const tasksDir = path7.join(absPath, projectConfig.tasks_dir);
-  if (!fs6.existsSync(tasksDir))
+  const tasksDir = path2.join(absPath, projectConfig.tasks_dir);
+  if (!fs2.existsSync(tasksDir))
     return { tasks, errors: [`tasks_dir not found: ${tasksDir}`], repairs };
-  const entries = fs6.readdirSync(tasksDir, { withFileTypes: true });
+  const entries = fs2.readdirSync(tasksDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const taskDir = path7.join(tasksDir, entry.name);
-    const taskYml = path7.join(taskDir, "task0.yml");
+    const taskDir = path2.join(tasksDir, entry.name);
+    const taskYml = path2.join(taskDir, "task0.yml");
     const raw = readYaml(taskYml);
     if (!raw || raw.kind !== "task")
       continue;
@@ -202,7 +202,7 @@ function scanProject(projectPath, sourceName) {
       continue;
     }
     const context = readContext(taskDir);
-    const stat = fs6.statSync(taskYml);
+    const stat = fs2.statSync(taskYml);
     const tags = raw.tags || [];
     const summary = raw.summary || void 0;
     const displayTitle = summary?.title || title;
@@ -245,18 +245,18 @@ var init_scanner = __esm({
 });
 
 // ../../packages/shared/dist/node/open-questions.js
-import fs7 from "fs";
-import path8 from "path";
+import fs3 from "fs";
+import path3 from "path";
 function readOpenQuestions(taskDir, issueFiles) {
   const result = [];
   for (const file of issueFiles) {
     const m = file.match(/^ISSUE-(\d+)\.md$/);
     if (!m)
       continue;
-    const fullPath = path8.join(taskDir, file);
-    if (!fs7.existsSync(fullPath))
+    const fullPath = path3.join(taskDir, file);
+    if (!fs3.existsSync(fullPath))
       continue;
-    const md = fs7.readFileSync(fullPath, "utf-8");
+    const md = fs3.readFileSync(fullPath, "utf-8");
     const match = md.match(OPEN_QUESTIONS_SECTION_RE);
     if (!match)
       continue;
@@ -279,34 +279,34 @@ var init_open_questions = __esm({
 });
 
 // ../../packages/shared/dist/node/task-state.js
-import fs8 from "fs";
-import os3 from "os";
-import path9 from "path";
-import yaml4 from "js-yaml";
+import fs4 from "fs";
+import os from "os";
+import path4 from "path";
+import yaml2 from "js-yaml";
 function findProjectRoot(start = process.cwd()) {
-  let dir = path9.resolve(start);
+  let dir = path4.resolve(start);
   while (true) {
-    const ymlPath = path9.join(dir, "task0.yml");
-    if (fs8.existsSync(ymlPath)) {
+    const ymlPath = path4.join(dir, "task0.yml");
+    if (fs4.existsSync(ymlPath)) {
       try {
-        const raw = yaml4.load(fs8.readFileSync(ymlPath, "utf-8"));
+        const raw = yaml2.load(fs4.readFileSync(ymlPath, "utf-8"));
         if (raw?.kind === "project")
           return dir;
       } catch {
       }
     }
-    const parent = path9.dirname(dir);
+    const parent = path4.dirname(dir);
     if (parent === dir)
       return null;
     dir = parent;
   }
 }
 function readProjectConfig(projectRoot) {
-  return yaml4.load(fs8.readFileSync(path9.join(projectRoot, "task0.yml"), "utf-8"));
+  return yaml2.load(fs4.readFileSync(path4.join(projectRoot, "task0.yml"), "utf-8"));
 }
 function resolveTasksDir(projectRoot, projectConfig) {
   const cfg = projectConfig ?? readProjectConfig(projectRoot);
-  return path9.isAbsolute(cfg.tasks_dir) ? cfg.tasks_dir : path9.join(projectRoot, cfg.tasks_dir);
+  return path4.isAbsolute(cfg.tasks_dir) ? cfg.tasks_dir : path4.join(projectRoot, cfg.tasks_dir);
 }
 function resolveTaskByObjectId(objectId, projectRoot) {
   const root = projectRoot ?? findProjectRoot();
@@ -317,16 +317,16 @@ function resolveTaskByObjectId(objectId, projectRoot) {
     throw new Error(`Expected a task object_id like 'tsk_XXXXX', got '${objectId}'. Directory names are no longer accepted; run 'task0 task list' to find the object_id.`);
   }
   const tasksDir = resolveTasksDir(root);
-  const entries = fs8.readdirSync(tasksDir, { withFileTypes: true });
+  const entries = fs4.readdirSync(tasksDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const taskDir = path9.join(tasksDir, entry.name);
-    const taskYml = path9.join(taskDir, "task0.yml");
-    if (!fs8.existsSync(taskYml))
+    const taskDir = path4.join(tasksDir, entry.name);
+    const taskYml = path4.join(taskDir, "task0.yml");
+    if (!fs4.existsSync(taskYml))
       continue;
     try {
-      const raw = yaml4.load(fs8.readFileSync(taskYml, "utf-8"));
+      const raw = yaml2.load(fs4.readFileSync(taskYml, "utf-8"));
       if (raw && raw.object_id === objectId) {
         return { projectRoot: root, tasksDir, taskDir, taskYml };
       }
@@ -336,15 +336,15 @@ function resolveTaskByObjectId(objectId, projectRoot) {
   throw new Error(`No task with object_id '${objectId}' found under ${tasksDir}. If tasks pre-date object_id, run 'task0 task migrate' to seed them.`);
 }
 function readTaskYaml(taskYml) {
-  if (!fs8.existsSync(taskYml))
+  if (!fs4.existsSync(taskYml))
     throw new Error(`task0.yml not found: ${taskYml}`);
-  return yaml4.load(fs8.readFileSync(taskYml, "utf-8")) || {};
+  return yaml2.load(fs4.readFileSync(taskYml, "utf-8")) || {};
 }
 function writeTaskYaml(taskYml, data) {
-  fs8.writeFileSync(taskYml, yaml4.dump(data, { lineWidth: 120 }), "utf-8");
+  fs4.writeFileSync(taskYml, yaml2.dump(data, { lineWidth: 120 }), "utf-8");
 }
 function taskYamlLockPath(taskDir) {
-  return path9.join(taskDir, TASK_YAML_LOCKFILE);
+  return path4.join(taskDir, TASK_YAML_LOCKFILE);
 }
 function isProcessAlive(pid) {
   try {
@@ -356,17 +356,17 @@ function isProcessAlive(pid) {
 }
 function readTaskYamlLockInfo(file) {
   try {
-    return JSON.parse(fs8.readFileSync(file, "utf-8"));
+    return JSON.parse(fs4.readFileSync(file, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeTaskYamlLockInfo(file, info) {
-  const fd = fs8.openSync(file, "wx");
+  const fd = fs4.openSync(file, "wx");
   try {
-    fs8.writeFileSync(fd, JSON.stringify(info, null, 2), "utf-8");
+    fs4.writeFileSync(fd, JSON.stringify(info, null, 2), "utf-8");
   } finally {
-    fs8.closeSync(fd);
+    fs4.closeSync(fd);
   }
 }
 function sleep(ms) {
@@ -376,7 +376,7 @@ async function acquireTaskYamlLock(taskDir) {
   const file = taskYamlLockPath(taskDir);
   const info = {
     pid: process.pid,
-    hostname: os3.hostname(),
+    hostname: os.hostname(),
     started_at: (/* @__PURE__ */ new Date()).toISOString()
   };
   const deadline = Date.now() + TASK_YAML_LOCK_TIMEOUT_MS;
@@ -392,7 +392,7 @@ async function acquireTaskYamlLock(taskDir) {
     const existing = readTaskYamlLockInfo(file);
     if (existing && existing.hostname === info.hostname && !isProcessAlive(existing.pid)) {
       try {
-        fs8.unlinkSync(file);
+        fs4.unlinkSync(file);
         continue;
       } catch (err) {
         if (err.code !== "ENOENT") {
@@ -414,7 +414,7 @@ function releaseTaskYamlLock(taskDir, info) {
     return;
   }
   try {
-    fs8.unlinkSync(file);
+    fs4.unlinkSync(file);
   } catch (err) {
     if (err.code !== "ENOENT") {
       throw err;
@@ -422,7 +422,7 @@ function releaseTaskYamlLock(taskDir, info) {
   }
 }
 async function withTaskYamlLock(taskDir, fn) {
-  const key = path9.resolve(taskDir);
+  const key = path4.resolve(taskDir);
   const prev = yamlLocks.get(key) ?? Promise.resolve();
   const next = prev.then(async () => {
     const lock = await acquireTaskYamlLock(taskDir);
@@ -453,7 +453,7 @@ function readTaskWorkflow(taskYml) {
   return raw.workflow || {};
 }
 async function updateTaskWorkflow(taskYml, patch) {
-  const taskDir = path9.dirname(taskYml);
+  const taskDir = path4.dirname(taskYml);
   return withTaskYamlLock(taskDir, () => {
     const raw = readTaskYaml(taskYml);
     const current = raw.workflow || {};
@@ -492,6 +492,90 @@ var init_task_state = __esm({
   }
 });
 
+// ../../packages/shared/dist/node/paths.js
+import fs5 from "fs";
+import os2 from "os";
+import path5 from "path";
+function task0Home() {
+  const override = process.env.TASK0_HOME;
+  if (override && override.length > 0)
+    return override;
+  return path5.join(os2.homedir(), ".task0");
+}
+function profilesRoot() {
+  return path5.join(task0Home(), "profiles");
+}
+function currentProfileName() {
+  const fromEnv = process.env.TASK0_PROFILE?.trim();
+  if (fromEnv && PROFILE_NAME_RE.test(fromEnv))
+    return fromEnv;
+  const fromFile = readCurrentProfileFile();
+  if (fromFile && PROFILE_NAME_RE.test(fromFile))
+    return fromFile;
+  return DEFAULT_PROFILE_NAME;
+}
+function readCurrentProfileFile() {
+  const file = path5.join(profilesRoot(), CURRENT_PROFILE_FILE);
+  if (!fs5.existsSync(file))
+    return null;
+  try {
+    return fs5.readFileSync(file, "utf-8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function currentProfileFilePath() {
+  return path5.join(profilesRoot(), CURRENT_PROFILE_FILE);
+}
+function writeCurrentProfile(name) {
+  fs5.mkdirSync(profilesRoot(), { recursive: true });
+  const file = currentProfileFilePath();
+  if (name === null) {
+    if (fs5.existsSync(file))
+      fs5.unlinkSync(file);
+    return;
+  }
+  if (!PROFILE_NAME_RE.test(name)) {
+    throw new Error(`Invalid profile name "${name}". Must match ${PROFILE_NAME_RE}.`);
+  }
+  fs5.writeFileSync(file, name + "\n", "utf-8");
+}
+function profileDir(name) {
+  const resolved = name ?? currentProfileName();
+  if (!PROFILE_NAME_RE.test(resolved)) {
+    throw new Error(`Invalid profile name "${resolved}". Must match ${PROFILE_NAME_RE}.`);
+  }
+  return path5.join(profilesRoot(), resolved);
+}
+function listProfileNames() {
+  const root = profilesRoot();
+  if (!fs5.existsSync(root))
+    return [];
+  try {
+    return fs5.readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && PROFILE_NAME_RE.test(entry.name)).map((entry) => entry.name).sort();
+  } catch {
+    return [];
+  }
+}
+function isValidProfileName(name) {
+  return PROFILE_NAME_RE.test(name);
+}
+function serverWorkingDir() {
+  const fromEnv = process.env.TASK0_SERVER_DIR?.trim();
+  if (fromEnv)
+    return fromEnv;
+  return path5.join(task0Home(), "server");
+}
+var DEFAULT_PROFILE_NAME, CURRENT_PROFILE_FILE, PROFILE_NAME_RE;
+var init_paths = __esm({
+  "../../packages/shared/dist/node/paths.js"() {
+    "use strict";
+    DEFAULT_PROFILE_NAME = "default";
+    CURRENT_PROFILE_FILE = ".current";
+    PROFILE_NAME_RE = /^[a-zA-Z0-9_-]+$/;
+  }
+});
+
 // ../../packages/shared/dist/types/error-report.js
 var ERROR_REPORT_SCHEMA_VERSION;
 var init_error_report = __esm({
@@ -583,19 +667,12 @@ var init_redact = __esm({
 });
 
 // ../../packages/shared/dist/node/error-reports.js
-import fs9 from "fs";
-import os4 from "os";
-import path10 from "path";
+import fs6 from "fs";
+import path6 from "path";
 import { spawnSync } from "child_process";
 import crypto from "crypto";
-function task0Home() {
-  const override = process.env.TASK0_HOME;
-  if (override && override.length > 0)
-    return override;
-  return path10.join(os4.homedir(), ".task0");
-}
 function errorsRoot() {
-  return path10.join(task0Home(), "errors");
+  return path6.join(profileDir(), "errors");
 }
 function createErrorReportId() {
   return `err_${crypto.randomBytes(4).toString("hex")}`;
@@ -696,13 +773,13 @@ function buildErrorReport(input) {
 function writeErrorReportSync(report, rootOverride) {
   const root = rootOverride ?? errorsRoot();
   const dirName = errorReportDirName(new Date(report.captured_at), report.id);
-  const dir = path10.join(root, dirName);
-  fs9.mkdirSync(dir, { recursive: true });
-  const finalPath = path10.join(dir, REPORT_FILENAME);
-  const tmpPath = path10.join(dir, TMP_FILENAME);
+  const dir = path6.join(root, dirName);
+  fs6.mkdirSync(dir, { recursive: true });
+  const finalPath = path6.join(dir, REPORT_FILENAME);
+  const tmpPath = path6.join(dir, TMP_FILENAME);
   const json = JSON.stringify(report, null, 2);
-  fs9.writeFileSync(tmpPath, json, "utf-8");
-  fs9.renameSync(tmpPath, finalPath);
+  fs6.writeFileSync(tmpPath, json, "utf-8");
+  fs6.renameSync(tmpPath, finalPath);
   return { dir, path: finalPath };
 }
 function parseReportDir(name) {
@@ -719,7 +796,7 @@ function listErrorReports(rootOverride) {
   };
   let entries;
   try {
-    entries = fs9.readdirSync(root, { withFileTypes: true });
+    entries = fs6.readdirSync(root, { withFileTypes: true });
   } catch (err) {
     if (err.code === "ENOENT")
       return result;
@@ -731,11 +808,11 @@ function listErrorReports(rootOverride) {
     const parsed = parseReportDir(entry.name);
     if (!parsed)
       continue;
-    const dir = path10.join(root, entry.name);
-    const file = path10.join(dir, REPORT_FILENAME);
+    const dir = path6.join(root, entry.name);
+    const file = path6.join(dir, REPORT_FILENAME);
     let raw;
     try {
-      raw = fs9.readFileSync(file, "utf-8");
+      raw = fs6.readFileSync(file, "utf-8");
     } catch {
       result.skipped.unreadable += 1;
       continue;
@@ -753,7 +830,7 @@ function listErrorReports(rootOverride) {
     }
     let size = 0;
     try {
-      size = fs9.statSync(file).size;
+      size = fs6.statSync(file).size;
     } catch {
     }
     result.reports.push({
@@ -788,7 +865,7 @@ function resolveErrorReport(query, rootOverride) {
   return { kind: "miss", query };
 }
 function readErrorReport(summary) {
-  const raw = fs9.readFileSync(summary.path, "utf-8");
+  const raw = fs6.readFileSync(summary.path, "utf-8");
   return JSON.parse(raw);
 }
 function pruneErrorReports(opts, rootOverride) {
@@ -826,7 +903,7 @@ function pruneErrorReports(opts, rootOverride) {
 }
 function removeReportDir(dir) {
   try {
-    fs9.rmSync(dir, { recursive: true, force: true });
+    fs6.rmSync(dir, { recursive: true, force: true });
     return true;
   } catch {
     return false;
@@ -837,6 +914,7 @@ var init_error_reports = __esm({
   "../../packages/shared/dist/node/error-reports.js"() {
     "use strict";
     init_error_report();
+    init_paths();
     init_redact();
     REPORT_FILENAME = "report.json";
     TMP_FILENAME = "report.json.tmp";
@@ -844,9 +922,9 @@ var init_error_reports = __esm({
 });
 
 // ../../packages/shared/dist/node/file-lock.js
-import fs10 from "fs";
-import os5 from "os";
-import path11 from "path";
+import fs7 from "fs";
+import os3 from "os";
+import path7 from "path";
 var init_file_lock = __esm({
   "../../packages/shared/dist/node/file-lock.js"() {
     "use strict";
@@ -862,9 +940,9 @@ var init_tmux = __esm({
 });
 
 // ../../packages/shared/dist/node/agent-skills.js
-import fs11 from "fs";
-import path12 from "path";
-import yaml5 from "js-yaml";
+import fs8 from "fs";
+import path8 from "path";
+import yaml3 from "js-yaml";
 function isRecord(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -873,7 +951,7 @@ function extractFrontmatter(raw) {
   if (!match)
     return null;
   try {
-    const parsed = yaml5.load(match[1]);
+    const parsed = yaml3.load(match[1]);
     return isRecord(parsed) ? parsed : null;
   } catch {
     return null;
@@ -881,9 +959,9 @@ function extractFrontmatter(raw) {
 }
 function readTextIfExists(filePath) {
   try {
-    if (!fs11.existsSync(filePath))
+    if (!fs8.existsSync(filePath))
       return null;
-    return fs11.readFileSync(filePath, "utf-8");
+    return fs8.readFileSync(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -891,13 +969,13 @@ function readTextIfExists(filePath) {
 function getSymlinkInfo(...candidatePaths) {
   for (const candidatePath of candidatePaths) {
     try {
-      const stat = fs11.lstatSync(candidatePath);
+      const stat = fs8.lstatSync(candidatePath);
       if (!stat.isSymbolicLink())
         continue;
-      const target = fs11.readlinkSync(candidatePath);
+      const target = fs8.readlinkSync(candidatePath);
       return {
         isSymlink: true,
-        symlinkTarget: path12.isAbsolute(target) ? target : path12.resolve(path12.dirname(candidatePath), target)
+        symlinkTarget: path8.isAbsolute(target) ? target : path8.resolve(path8.dirname(candidatePath), target)
       };
     } catch {
     }
@@ -930,7 +1008,7 @@ function normalizeBoolean(value) {
 function sortSkills(skills) {
   return skills.sort((a, b) => AGENT_ORDER[a.agent] - AGENT_ORDER[b.agent] || SCOPE_ORDER[a.scope] - SCOPE_ORDER[b.scope] || KIND_ORDER[a.kind] - KIND_ORDER[b.kind] || a.name.localeCompare(b.name) || a.filePath.localeCompare(b.filePath));
 }
-function pushInstructionIfExists(skills, agent2, scope, filePath, name = path12.basename(filePath), description2 = "", kind = "instruction") {
+function pushInstructionIfExists(skills, agent2, scope, filePath, name = path8.basename(filePath), description2 = "", kind = "instruction") {
   const raw = readTextIfExists(filePath);
   if (raw === null)
     return;
@@ -947,17 +1025,17 @@ function pushInstructionIfExists(skills, agent2, scope, filePath, name = path12.
 function scanClaudeSkillDir(skills, skillsDir, scope) {
   let entries = [];
   try {
-    if (!fs11.existsSync(skillsDir))
+    if (!fs8.existsSync(skillsDir))
       return;
-    entries = fs11.readdirSync(skillsDir, { withFileTypes: true });
+    entries = fs8.readdirSync(skillsDir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (!entry.isDirectory() && !entry.isSymbolicLink())
       continue;
-    const skillDirPath = path12.join(skillsDir, entry.name);
-    const skillFilePath = path12.join(skillDirPath, "SKILL.md");
+    const skillDirPath = path8.join(skillsDir, entry.name);
+    const skillFilePath = path8.join(skillDirPath, "SKILL.md");
     const raw = readTextIfExists(skillFilePath);
     if (raw === null)
       continue;
@@ -978,7 +1056,7 @@ function scanCursorRuleFile(skills, filePath, scope) {
   if (raw === null)
     return;
   const frontmatter = extractFrontmatter(raw);
-  const baseName = path12.basename(filePath, ".mdc");
+  const baseName = path8.basename(filePath, ".mdc");
   skills.push({
     agent: "cursor",
     scope,
@@ -994,9 +1072,9 @@ function scanCursorRuleFile(skills, filePath, scope) {
 function scanCursorRulesDir(skills, rulesDir, scope) {
   let entries = [];
   try {
-    if (!fs11.existsSync(rulesDir))
+    if (!fs8.existsSync(rulesDir))
       return;
-    entries = fs11.readdirSync(rulesDir, { withFileTypes: true });
+    entries = fs8.readdirSync(rulesDir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -1005,26 +1083,26 @@ function scanCursorRulesDir(skills, rulesDir, scope) {
       continue;
     if (!entry.isFile() && !entry.isSymbolicLink())
       continue;
-    scanCursorRuleFile(skills, path12.join(rulesDir, entry.name), scope);
+    scanCursorRuleFile(skills, path8.join(rulesDir, entry.name), scope);
   }
 }
 function getProjectAgentSkills(projectPath) {
-  const absProjectPath = path12.resolve(projectPath);
+  const absProjectPath = path8.resolve(projectPath);
   let projectStat;
   try {
-    projectStat = fs11.statSync(absProjectPath);
+    projectStat = fs8.statSync(absProjectPath);
   } catch {
     return [];
   }
   if (!projectStat.isDirectory())
     return [];
   const skills = [];
-  scanClaudeSkillDir(skills, path12.join(absProjectPath, ".claude", "skills"), "project");
-  pushInstructionIfExists(skills, "claude_code", "project", path12.join(absProjectPath, "CLAUDE.md"));
-  pushInstructionIfExists(skills, "claude_code", "project", path12.join(absProjectPath, "AGENTS.md"));
-  pushInstructionIfExists(skills, "codex", "project", path12.join(absProjectPath, "AGENTS.md"));
-  scanCursorRulesDir(skills, path12.join(absProjectPath, ".cursor", "rules"), "project");
-  pushInstructionIfExists(skills, "cursor", "project", path12.join(absProjectPath, ".cursorrules"), "Legacy Cursor Rules", "", "rule");
+  scanClaudeSkillDir(skills, path8.join(absProjectPath, ".claude", "skills"), "project");
+  pushInstructionIfExists(skills, "claude_code", "project", path8.join(absProjectPath, "CLAUDE.md"));
+  pushInstructionIfExists(skills, "claude_code", "project", path8.join(absProjectPath, "AGENTS.md"));
+  pushInstructionIfExists(skills, "codex", "project", path8.join(absProjectPath, "AGENTS.md"));
+  scanCursorRulesDir(skills, path8.join(absProjectPath, ".cursor", "rules"), "project");
+  pushInstructionIfExists(skills, "cursor", "project", path8.join(absProjectPath, ".cursorrules"), "Legacy Cursor Rules", "", "rule");
   return sortSkills(skills);
 }
 function getGlobalAgentSkills() {
@@ -1032,8 +1110,8 @@ function getGlobalAgentSkills() {
   if (!homeDir)
     return [];
   const skills = [];
-  scanClaudeSkillDir(skills, path12.join(homeDir, ".claude", "skills"), "global");
-  scanCursorRulesDir(skills, path12.join(homeDir, ".cursor", "rules"), "global");
+  scanClaudeSkillDir(skills, path8.join(homeDir, ".claude", "skills"), "global");
+  scanCursorRulesDir(skills, path8.join(homeDir, ".cursor", "rules"), "global");
   return sortSkills(skills);
 }
 var AGENT_ORDER, SCOPE_ORDER, KIND_ORDER;
@@ -1065,6 +1143,7 @@ var init_node = __esm({
     init_scanner();
     init_open_questions();
     init_task_state();
+    init_paths();
     init_error_reports();
     init_redact();
     init_file_lock();
@@ -1089,7 +1168,7 @@ __export(task_state_exports, {
   withTaskYamlLock: () => withTaskYamlLock,
   writeTaskYaml: () => writeTaskYaml
 });
-import fs12 from "fs";
+import fs15 from "fs";
 function readWorkflow(taskYml) {
   return readTaskWorkflow(taskYml);
 }
@@ -1098,48 +1177,364 @@ async function updateWorkflow(taskYml, patch) {
 }
 function nextArtifactIndex(taskDir, prefix, ext = "md") {
   const pattern = new RegExp(`^${prefix}-(\\d+).*\\.${ext}$`);
-  const entries = fs12.readdirSync(taskDir);
+  const entries = fs15.readdirSync(taskDir);
   const indices = entries.map((name) => name.match(pattern)?.[1]).filter((v) => v != null).map(Number);
   const next = indices.length > 0 ? Math.max(...indices) + 1 : 1;
   return String(next).padStart(2, "0");
 }
 function latestArtifact(taskDir, pattern) {
-  if (!fs12.existsSync(taskDir)) return null;
-  const matches = fs12.readdirSync(taskDir).filter((name) => pattern.test(name));
+  if (!fs15.existsSync(taskDir)) return null;
+  const matches = fs15.readdirSync(taskDir).filter((name) => pattern.test(name));
   if (matches.length === 0) return null;
   matches.sort();
   return matches[matches.length - 1] || null;
 }
-var init_task_state2 = __esm({
-  "src/core/task-state.ts"() {
-    "use strict";
-    init_node();
+var init_task_state2 = __esm({
+  "src/core/task-state.ts"() {
+    "use strict";
+    init_node();
+  }
+});
+
+// src/main.ts
+import { Command as Command25 } from "commander";
+import chalk25 from "chalk";
+
+// src/core/profile.ts
+init_node();
+import fs10 from "fs";
+
+// src/core/config.ts
+init_node();
+import fs9 from "fs";
+import path9 from "path";
+import yaml4 from "js-yaml";
+function configFile() {
+  return path9.join(profileDir(), "config.yml");
+}
+function defaultConfig() {
+  return { sources: [] };
+}
+function loadConfig() {
+  const file = configFile();
+  if (!fs9.existsSync(file)) return defaultConfig();
+  try {
+    const raw = fs9.readFileSync(file, "utf-8");
+    const data = yaml4.load(raw) ?? {};
+    return {
+      ...data,
+      sources: Array.isArray(data?.sources) ? data.sources : []
+    };
+  } catch {
+    return defaultConfig();
+  }
+}
+function saveConfig(config) {
+  const file = configFile();
+  fs9.mkdirSync(path9.dirname(file), { recursive: true });
+  fs9.writeFileSync(file, yaml4.dump(config, { lineWidth: 120 }), "utf-8");
+}
+function addSource(entry) {
+  const config = loadConfig();
+  const existing = config.sources.findIndex((s) => s.name === entry.name);
+  if (existing >= 0) {
+    config.sources[existing] = entry;
+  } else {
+    config.sources.push(entry);
+  }
+  saveConfig(config);
+}
+function removeSource(name) {
+  const config = loadConfig();
+  const idx = config.sources.findIndex((s) => s.name === name);
+  if (idx < 0) return false;
+  config.sources.splice(idx, 1);
+  saveConfig(config);
+  return true;
+}
+function getApiUrl() {
+  return loadConfig().api_url;
+}
+
+// src/core/profile.ts
+var ProfileNotFoundError = class extends Error {
+  constructor(name, available) {
+    const list = available.length > 0 ? available.join(", ") : "(none)";
+    super(`Profile "${name}" not found. Available: ${list}. Run "task0 profile list" to inspect.`);
+    this.name = "ProfileNotFoundError";
+  }
+};
+function parseProfileFlag(argv) {
+  for (let i = 2; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--") return null;
+    if (arg === "--profile") {
+      const next = argv[i + 1];
+      if (typeof next === "string" && !next.startsWith("-")) return next;
+      return null;
+    }
+    if (typeof arg === "string" && arg.startsWith("--profile=")) {
+      const value = arg.slice("--profile=".length);
+      return value.length > 0 ? value : null;
+    }
+  }
+  return null;
+}
+function isProfileSubcommandInvocation(argv) {
+  for (let i = 2; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--") break;
+    if (typeof arg !== "string") continue;
+    if (arg.startsWith("-")) {
+      if (arg === "--profile" || arg === "-C") i++;
+      continue;
+    }
+    return arg === "profile";
+  }
+  return true;
+}
+function ensureDefaultProfile() {
+  fs10.mkdirSync(profileDir(DEFAULT_PROFILE_NAME), { recursive: true });
+  fs10.mkdirSync(profilesRoot(), { recursive: true });
+}
+function profileExists(name) {
+  if (!isValidProfileName(name)) return false;
+  try {
+    return fs10.statSync(profileDir(name)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+var activeProfileCache = null;
+function activateProfile(argv) {
+  ensureDefaultProfile();
+  const flagValue = parseProfileFlag(argv);
+  let name;
+  if (flagValue !== null) {
+    if (!isValidProfileName(flagValue) || !profileExists(flagValue)) {
+      if (!isProfileSubcommandInvocation(argv)) {
+        throw new ProfileNotFoundError(flagValue, listProfileNames());
+      }
+      name = DEFAULT_PROFILE_NAME;
+    } else {
+      name = flagValue;
+    }
+  } else {
+    name = currentProfileNameFromEnvOrFile();
+    if (!profileExists(name)) {
+      if (!isProfileSubcommandInvocation(argv)) {
+        throw new ProfileNotFoundError(name, listProfileNames());
+      }
+      name = DEFAULT_PROFILE_NAME;
+    }
+  }
+  process.env.TASK0_PROFILE = name;
+  const apiUrl = getApiUrl();
+  activeProfileCache = { name, ...apiUrl ? { apiUrl } : {} };
+  if (apiUrl && !process.env.TASK0_API_URL) {
+    process.env.TASK0_API_URL = apiUrl;
+  }
+}
+function currentProfileNameFromEnvOrFile() {
+  const fromEnv = process.env.TASK0_PROFILE?.trim();
+  if (fromEnv && isValidProfileName(fromEnv)) return fromEnv;
+  try {
+    const file = `${profilesRoot()}/.current`;
+    if (fs10.existsSync(file)) {
+      const v = fs10.readFileSync(file, "utf-8").trim();
+      if (v && isValidProfileName(v)) return v;
+    }
+  } catch {
+  }
+  return DEFAULT_PROFILE_NAME;
+}
+
+// src/core/migrate-layout.ts
+init_node();
+import fs11 from "fs";
+import os4 from "os";
+import path10 from "path";
+import yaml5 from "js-yaml";
+var MIGRATION_MARKER = ".migrated-v1";
+function legacyDaemonJson() {
+  return path10.join(task0Home(), "daemon.json");
+}
+function legacyErrorsDir() {
+  return path10.join(task0Home(), "errors");
+}
+function legacyAgentRunDir() {
+  return path10.join(task0Home(), "agent-run");
+}
+function legacyLogsDir() {
+  return path10.join(task0Home(), "logs");
+}
+function legacyServerConfigYml() {
+  return path10.join(task0Home(), "config.yml");
+}
+function legacyRegistryDir() {
+  return path10.join(process.env.HOME || process.env.USERPROFILE || os4.homedir(), ".config", "task0");
+}
+function legacyRegistryFile() {
+  return path10.join(legacyRegistryDir(), "config.yml");
+}
+function migrationMarkerPath() {
+  return path10.join(profilesRoot(), MIGRATION_MARKER);
+}
+function safeMv(from, to, steps, opts = {}) {
+  if (!fs11.existsSync(from)) return false;
+  if (fs11.existsSync(to)) {
+    steps.push({ kind: "skip", from, to, detail: "destination already exists" });
+    return false;
+  }
+  if (!opts.dryRun) {
+    fs11.mkdirSync(path10.dirname(to), { recursive: true });
+    fs11.renameSync(from, to);
+  }
+  steps.push({ kind: "mv", from, to });
+  return true;
+}
+function readYamlSafe(file) {
+  if (!fs11.existsSync(file)) return null;
+  try {
+    const raw = fs11.readFileSync(file, "utf-8");
+    return yaml5.load(raw) ?? null;
+  } catch {
+    return null;
+  }
+}
+function extractCliKeysFromLegacyConfig() {
+  const data = readYamlSafe(legacyServerConfigYml());
+  if (!data || typeof data !== "object") return null;
+  const out = {};
+  if (Array.isArray(data.sources)) {
+    const projects = data.sources.filter((s) => s?.type === "project");
+    if (projects.length > 0) out.sources = projects;
+  }
+  if (data.agentModels && typeof data.agentModels === "object") {
+    out.agentModels = data.agentModels;
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}
+function reconstructProfilesFromRegistry(steps, opts = {}) {
+  const file = legacyRegistryFile();
+  const data = readYamlSafe(file);
+  if (!data?.profiles || typeof data.profiles !== "object") return;
+  for (const [name, entry] of Object.entries(data.profiles)) {
+    if (!isValidProfileName(name)) continue;
+    const dir = profileDir(name);
+    if (!opts.dryRun) fs11.mkdirSync(dir, { recursive: true });
+    steps.push({ kind: "mkdir", to: dir });
+    const profileConfig = {};
+    if (entry.api_url) profileConfig.api_url = entry.api_url;
+    const profileConfigFile = path10.join(dir, "config.yml");
+    if (!fs11.existsSync(profileConfigFile) && Object.keys(profileConfig).length > 0) {
+      if (!opts.dryRun) {
+        fs11.writeFileSync(profileConfigFile, yaml5.dump(profileConfig, { lineWidth: 120 }), "utf-8");
+      }
+      steps.push({ kind: "write", to: profileConfigFile, detail: `api_url=${entry.api_url}` });
+    }
+    if (entry.task0_home) {
+      const oldDaemonJson = path10.join(entry.task0_home, "daemon.json");
+      const newDaemonJson = path10.join(dir, "daemon.json");
+      if (fs11.existsSync(oldDaemonJson) && !fs11.existsSync(newDaemonJson)) {
+        safeMv(oldDaemonJson, newDaemonJson, steps, opts);
+      }
+    }
   }
-});
-
-// src/main.ts
-import { Command as Command23 } from "commander";
+  if (data.current_profile && isValidProfileName(data.current_profile)) {
+    if (!opts.dryRun) writeCurrentProfile(data.current_profile);
+    steps.push({ kind: "write", to: path10.join(profilesRoot(), ".current"), detail: data.current_profile });
+  }
+  const backup = file + ".migrated-bak";
+  if (fs11.existsSync(file) && !fs11.existsSync(backup)) {
+    if (!opts.dryRun) fs11.renameSync(file, backup);
+    steps.push({ kind: "mv", from: file, to: backup, detail: "legacy v0.7.0 registry archived" });
+  }
+}
+function migrateCliLayout(opts = {}) {
+  const result = { ran: false, steps: [], alreadyMigrated: false };
+  if (fs11.existsSync(migrationMarkerPath())) {
+    result.alreadyMigrated = true;
+    return result;
+  }
+  if (!opts.dryRun) fs11.mkdirSync(profilesRoot(), { recursive: true });
+  const defaultDir = profileDir(DEFAULT_PROFILE_NAME);
+  if (!fs11.existsSync(defaultDir)) {
+    if (!opts.dryRun) fs11.mkdirSync(defaultDir, { recursive: true });
+    result.steps.push({ kind: "mkdir", to: defaultDir });
+  }
+  safeMv(legacyDaemonJson(), path10.join(defaultDir, "daemon.json"), result.steps, opts);
+  safeMv(legacyErrorsDir(), path10.join(defaultDir, "errors"), result.steps, opts);
+  safeMv(legacyAgentRunDir(), path10.join(defaultDir, "agent-run"), result.steps, opts);
+  safeMv(legacyLogsDir(), path10.join(defaultDir, "logs"), result.steps, opts);
+  const cliKeys = extractCliKeysFromLegacyConfig();
+  if (cliKeys) {
+    const target = path10.join(defaultDir, "config.yml");
+    if (!fs11.existsSync(target)) {
+      if (!opts.dryRun) {
+        fs11.writeFileSync(target, yaml5.dump(cliKeys, { lineWidth: 120 }), "utf-8");
+      }
+      result.steps.push({ kind: "write", to: target, detail: "extracted CLI keys from legacy config.yml" });
+    }
+    const data = readYamlSafe(legacyServerConfigYml());
+    if (data) {
+      let dirty = false;
+      if (Array.isArray(data.sources)) {
+        const nonProjectOnly = data.sources.filter((s) => s?.type !== "project");
+        if (nonProjectOnly.length !== data.sources.length) {
+          data.sources = nonProjectOnly;
+          dirty = true;
+        }
+      }
+      if (data.agentModels) {
+        delete data.agentModels;
+        dirty = true;
+      }
+      if (dirty) {
+        if (!opts.dryRun) {
+          fs11.writeFileSync(legacyServerConfigYml(), yaml5.dump(data, { lineWidth: 120 }), "utf-8");
+        }
+        result.steps.push({ kind: "extract", from: legacyServerConfigYml(), detail: "stripped CLI-owned keys" });
+      }
+    }
+  }
+  if (fs11.existsSync(legacyRegistryFile())) {
+    reconstructProfilesFromRegistry(result.steps, opts);
+  }
+  if (!opts.dryRun) {
+    fs11.writeFileSync(migrationMarkerPath(), (/* @__PURE__ */ new Date()).toISOString() + "\n", "utf-8");
+  }
+  result.ran = result.steps.length > 0;
+  return result;
+}
+function resetMigrationMarker() {
+  const marker = migrationMarkerPath();
+  if (!fs11.existsSync(marker)) return false;
+  fs11.unlinkSync(marker);
+  return true;
+}
 
 // src/commands/source.ts
 import { Command } from "commander";
-import path3 from "path";
+import path13 from "path";
 import chalk from "chalk";
 
 // src/types.ts
 init_task();
 
 // src/core/admin-token.ts
-import fs from "fs";
-import os from "os";
-import path from "path";
-var CONFIG_DIR = path.join(os.homedir(), ".config", "task0");
-var TOKEN_FILE = path.join(CONFIG_DIR, "admin.token");
+init_node();
+import fs12 from "fs";
+import path11 from "path";
+function tokenFile() {
+  return path11.join(serverWorkingDir(), "admin.token");
+}
 var cached = null;
 var AdminTokenUnavailableError = class extends Error {
   constructor() {
     super(
       `Admin token not found.
-  \u2022 If the task0 server runs on this host, run the task0-server binary once \u2014 the token will be generated at ${TOKEN_FILE}.
+  \u2022 If the task0 server runs on this host, run the task0-server binary once \u2014 the token will be generated at ${tokenFile()}.
   \u2022 Otherwise, copy the token from the server host and set TASK0_ADMIN_TOKEN.`
     );
     this.name = "AdminTokenUnavailableError";
@@ -1152,8 +1547,9 @@ function readAdminToken() {
     cached = fromEnv;
     return cached;
   }
-  if (fs.existsSync(TOKEN_FILE)) {
-    const v = fs.readFileSync(TOKEN_FILE, "utf-8").trim();
+  const file = tokenFile();
+  if (fs12.existsSync(file)) {
+    const v = fs12.readFileSync(file, "utf-8").trim();
     if (v) {
       cached = v;
       return cached;
@@ -1166,34 +1562,38 @@ function adminAuthHeader() {
 }
 
 // src/core/daemon-config.ts
-import fs2 from "fs";
-import os2 from "os";
-import path2 from "path";
-var CONFIG_DIR2 = path2.join(os2.homedir(), ".config", "task0");
-var CONFIG_FILE = path2.join(CONFIG_DIR2, "daemon.json");
+init_node();
+import fs13 from "fs";
+import path12 from "path";
+function configFile2() {
+  return path12.join(profileDir(), "daemon.json");
+}
 function daemonConfigPath() {
-  return CONFIG_FILE;
+  return configFile2();
 }
 function readDaemonIdentity() {
-  if (!fs2.existsSync(CONFIG_FILE)) return null;
+  const file = configFile2();
+  if (!fs13.existsSync(file)) return null;
   try {
-    const raw = fs2.readFileSync(CONFIG_FILE, "utf-8");
+    const raw = fs13.readFileSync(file, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
   }
 }
 function writeDaemonIdentity(identity) {
-  fs2.mkdirSync(CONFIG_DIR2, { recursive: true });
-  fs2.writeFileSync(CONFIG_FILE, JSON.stringify(identity, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  const file = configFile2();
+  fs13.mkdirSync(path12.dirname(file), { recursive: true });
+  fs13.writeFileSync(file, JSON.stringify(identity, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
   try {
-    fs2.chmodSync(CONFIG_FILE, 384);
+    fs13.chmodSync(file, 384);
   } catch {
   }
 }
 function clearDaemonIdentity() {
-  if (!fs2.existsSync(CONFIG_FILE)) return false;
-  fs2.unlinkSync(CONFIG_FILE);
+  const file = configFile2();
+  if (!fs13.existsSync(file)) return false;
+  fs13.unlinkSync(file);
   return true;
 }
 
@@ -1231,7 +1631,7 @@ function resolveAuthHeader() {
   } catch (error2) {
     if (error2 instanceof AdminTokenUnavailableError) {
       throw new Error(
-        `No CLI credential available. Set TASK0_API_TOKEN (preferred \u2014 issue one via the dashboard) or place a server admin token at ${error2.message.includes(".token") ? error2.message.split("at ")[1]?.split(".")[0] + ".token" : "~/.config/task0/admin.token"}.`
+        `No CLI credential available. Set TASK0_API_TOKEN (preferred \u2014 issue one via the dashboard) or place a server admin token at ${error2.message.includes(".token") ? error2.message.split("at ")[1]?.split(".")[0] + ".token" : "~/.task0/admin.token"}.`
       );
     }
     throw error2;
@@ -1302,8 +1702,8 @@ function requireLocalDaemon() {
 }
 var source = new Command("source").description("Manage task sources");
 source.command("add <path>").description("Register a local project on this host's daemon (via hub)").option("-n, --name <name>", "Source name (defaults to directory name)").action(async (inputPath, opts) => {
-  const absPath = path3.resolve(inputPath);
-  const name = opts.name || path3.basename(absPath);
+  const absPath = path13.resolve(inputPath);
+  const name = opts.name || path13.basename(absPath);
   const daemonId = requireLocalDaemon();
   let resp;
   try {
@@ -1401,9 +1801,9 @@ ${project2}`));
 
 // src/commands/project.ts
 import { Command as Command2 } from "commander";
-import fs3 from "fs";
-import path4 from "path";
-import yaml from "js-yaml";
+import fs14 from "fs";
+import path14 from "path";
+import yaml6 from "js-yaml";
 import chalk2 from "chalk";
 
 // ../../packages/shared/dist/index.js
@@ -1441,15 +1841,15 @@ project.command("list").description("List registered projects (queries the hub)"
 });
 project.command("init").description("Initialize task0.yml in the current directory").option("-d, --tasks-dir <dir>", "Tasks directory", ".task0/tasks").action((opts) => {
   const cwd = process.cwd();
-  const ymlPath = path4.join(cwd, "task0.yml");
-  if (fs3.existsSync(ymlPath)) {
+  const ymlPath = path14.join(cwd, "task0.yml");
+  if (fs14.existsSync(ymlPath)) {
     console.error(chalk2.yellow("task0.yml already exists"));
     process.exit(1);
   }
   const config = { kind: "project", object_id: generateObjectId("project"), tasks_dir: opts.tasksDir };
-  fs3.writeFileSync(ymlPath, yaml.dump(config), "utf-8");
-  const tasksDir = path4.join(cwd, opts.tasksDir);
-  fs3.mkdirSync(tasksDir, { recursive: true });
+  fs14.writeFileSync(ymlPath, yaml6.dump(config), "utf-8");
+  const tasksDir = path14.join(cwd, opts.tasksDir);
+  fs14.mkdirSync(tasksDir, { recursive: true });
   console.log(chalk2.green("Initialized task0 project"));
   console.log(`  ${ymlPath}`);
   console.log(`  ${tasksDir}/`);
@@ -1458,9 +1858,9 @@ project.command("init").description("Initialize task0.yml in the current directo
 // src/commands/task.ts
 import { Command as Command8 } from "commander";
 import { execSync } from "child_process";
-import fs17 from "fs";
-import path15 from "path";
-import yaml6 from "js-yaml";
+import fs20 from "fs";
+import path17 from "path";
+import yaml7 from "js-yaml";
 import chalk8 from "chalk";
 
 // src/lib/api.ts
@@ -1497,18 +1897,18 @@ async function request(method, pathname, body) {
   }
 }
 var api = {
-  get: (path29) => request("GET", path29),
-  post: (path29, body) => request("POST", path29, body ?? {}),
-  put: (path29, body) => request("PUT", path29, body ?? {}),
-  patch: (path29, body) => request("PATCH", path29, body ?? {}),
-  del: (path29) => request("DELETE", path29)
+  get: (path32) => request("GET", path32),
+  post: (path32, body) => request("POST", path32, body ?? {}),
+  put: (path32, body) => request("PUT", path32, body ?? {}),
+  patch: (path32, body) => request("PATCH", path32, body ?? {}),
+  del: (path32) => request("DELETE", path32)
 };
 
 // src/commands/task/triage.ts
 import { Command as Command3 } from "commander";
 import chalk3 from "chalk";
-import fs13 from "fs";
-import path13 from "path";
+import fs16 from "fs";
+import path15 from "path";
 
 // src/core/agent-run-wait.ts
 async function getAgentRun(id) {
@@ -1532,54 +1932,6 @@ async function waitForAgentRun(id, opts = {}) {
   }
 }
 
-// src/core/config.ts
-import fs4 from "fs";
-import path5 from "path";
-import yaml2 from "js-yaml";
-var CONFIG_DIR3 = path5.join(
-  process.env.HOME || process.env.USERPROFILE || "~",
-  ".config",
-  "task0"
-);
-var CONFIG_FILE2 = path5.join(CONFIG_DIR3, "config.yml");
-function ensureConfigDir() {
-  fs4.mkdirSync(CONFIG_DIR3, { recursive: true });
-}
-function defaultConfig() {
-  return { sources: [] };
-}
-function loadConfig() {
-  if (!fs4.existsSync(CONFIG_FILE2)) return defaultConfig();
-  const raw = fs4.readFileSync(CONFIG_FILE2, "utf-8");
-  const data = yaml2.load(raw);
-  return {
-    ...data ?? {},
-    sources: Array.isArray(data?.sources) ? data.sources : []
-  };
-}
-function saveConfig(config) {
-  ensureConfigDir();
-  fs4.writeFileSync(CONFIG_FILE2, yaml2.dump(config, { lineWidth: 120 }), "utf-8");
-}
-function addSource(entry) {
-  const config = loadConfig();
-  const existing = config.sources.findIndex((s) => s.name === entry.name);
-  if (existing >= 0) {
-    config.sources[existing] = entry;
-  } else {
-    config.sources.push(entry);
-  }
-  saveConfig(config);
-}
-function removeSource(name) {
-  const config = loadConfig();
-  const idx = config.sources.findIndex((s) => s.name === name);
-  if (idx < 0) return false;
-  config.sources.splice(idx, 1);
-  saveConfig(config);
-  return true;
-}
-
 // src/core/model-options.ts
 function resolveModelOptions(agent2, cli, warn = () => {
 }) {
@@ -1607,8 +1959,8 @@ init_task_state2();
 var ISSUE_DETAIL_RE = /^ISSUE-\d+\.md$/;
 var TRIAGE_SKILL_NAME = "triage";
 function resolveSkillFilePath(projectRoot, skillName) {
-  const p = path13.join(projectRoot, ".claude", "skills", skillName, "SKILL.md");
-  return fs13.existsSync(p) ? p : null;
+  const p = path15.join(projectRoot, ".claude", "skills", skillName, "SKILL.md");
+  return fs16.existsSync(p) ? p : null;
 }
 var triage = new Command3("triage").description("Decompose IDEA into ISSUE.md + ISSUE-NN.md").argument("<objectId>", "Task object_id (tsk_XXXXX)").option("--agent <name>", "Agent (claude-code|codex)", "claude-code").option("--model <id>", "Model id or alias (see `task0 models refresh`)").option("--effort <level>", "Reasoning effort (e.g. low|medium|high)").option("--idea <file>", "IDEA file (default: latest IDEA-NN.md)").option("--force", "Overwrite existing ISSUE files").option("--wait", "Wait for completion").option("--json", "Output JSON").action(async (objectId, opts) => {
   try {
@@ -1627,7 +1979,7 @@ var triage = new Command3("triage").description("Decompose IDEA into ISSUE.md +
         process.exit(1);
       }
       for (const name of existingIssues) {
-        fs13.rmSync(path13.join(loc.taskDir, name), { force: true });
+        fs16.rmSync(path15.join(loc.taskDir, name), { force: true });
       }
     }
     if (opts.model || opts.effort) {
@@ -1665,8 +2017,8 @@ var triage = new Command3("triage").description("Decompose IDEA into ISSUE.md +
         console.error(chalk3.red(`triage failed: ${final.error || "unknown"}`));
         process.exit(1);
       }
-      const hasOverview = fs13.existsSync(path13.join(loc.taskDir, "ISSUE.md"));
-      const issueFiles = fs13.readdirSync(loc.taskDir).filter((name) => ISSUE_DETAIL_RE.test(name)).sort();
+      const hasOverview = fs16.existsSync(path15.join(loc.taskDir, "ISSUE.md"));
+      const issueFiles = fs16.readdirSync(loc.taskDir).filter((name) => ISSUE_DETAIL_RE.test(name)).sort();
       if (!hasOverview || issueFiles.length === 0) {
         const missing = [];
         if (!hasOverview) missing.push("ISSUE.md");
@@ -1676,7 +2028,7 @@ var triage = new Command3("triage").description("Decompose IDEA into ISSUE.md +
       }
       let blockingQuestionCount = 0;
       for (const name of issueFiles) {
-        const content = fs13.readFileSync(path13.join(loc.taskDir, name), "utf-8");
+        const content = fs16.readFileSync(path15.join(loc.taskDir, name), "utf-8");
         blockingQuestionCount += countBlockingQuestions(content);
       }
       await updateWorkflow(loc.taskYml, {
@@ -1704,8 +2056,8 @@ var triage = new Command3("triage").description("Decompose IDEA into ISSUE.md +
   }
 });
 function listIssueArtifacts(taskDir) {
-  if (!fs13.existsSync(taskDir)) return [];
-  return fs13.readdirSync(taskDir).filter((name) => name === "ISSUE.md" || ISSUE_DETAIL_RE.test(name)).sort();
+  if (!fs16.existsSync(taskDir)) return [];
+  return fs16.readdirSync(taskDir).filter((name) => name === "ISSUE.md" || ISSUE_DETAIL_RE.test(name)).sort();
 }
 function countBlockingQuestions(md) {
   const match = md.match(/## Open Questions\s*\n([\s\S]*?)(\n## |\n*$)/i);
@@ -1719,13 +2071,13 @@ function countBlockingQuestions(md) {
 // src/commands/task/exec.ts
 import { Command as Command4 } from "commander";
 import chalk4 from "chalk";
-import fs14 from "fs";
-import path14 from "path";
+import fs17 from "fs";
+import path16 from "path";
 init_task_state2();
 var PLAN_EXECUTE_SKILL_NAME = "plan-execute";
 function resolveSkillFilePath2(projectRoot, skillName) {
-  const p = path14.join(projectRoot, ".claude", "skills", skillName, "SKILL.md");
-  return fs14.existsSync(p) ? p : null;
+  const p = path16.join(projectRoot, ".claude", "skills", skillName, "SKILL.md");
+  return fs17.existsSync(p) ? p : null;
 }
 var exec = new Command4("exec").description("Execute a plan against the task (cwd = project root; agent sets up its own worktree if needed)").argument("<objectId>", "Task object_id (tsk_XXXXX)").option("--agent <name>", "Agent (claude-code|codex|cursor)", "claude-code").option("--model <id>", "Model id or alias (see `task0 models refresh`)").option("--effort <level>", "Reasoning effort (e.g. low|medium|high)").option("--plan <file>", "Plan file (default: refined plan, else latest PLAN)").option("--no-commit", "Skip commit").option("--wait", "Wait for completion").option("--json", "Output JSON").action(async (objectId, opts) => {
   try {
@@ -1818,7 +2170,7 @@ var summarize = new Command5("summarize").description("Generate a concise title
 });
 
 // src/commands/task/comment.ts
-import fs15 from "fs";
+import fs18 from "fs";
 import { Command as Command6 } from "commander";
 import chalk6 from "chalk";
 var comment = new Command6("comment").description("Manage comments on a task");
@@ -1828,8 +2180,8 @@ function fail(err) {
 }
 function readBodyFromOpts(opts) {
   if (opts.body !== void 0) return opts.body;
-  if (opts.file === "-") return fs15.readFileSync(0, "utf-8");
-  if (opts.file) return fs15.readFileSync(opts.file, "utf-8");
+  if (opts.file === "-") return fs18.readFileSync(0, "utf-8");
+  if (opts.file) return fs18.readFileSync(opts.file, "utf-8");
   throw new Error("Provide --body or --file");
 }
 function preview(body, width = 60) {
@@ -1928,7 +2280,7 @@ comment.command("delete <cmtId>").description("Delete a comment by its cmt_ id")
 });
 
 // src/commands/task/description.ts
-import fs16 from "fs";
+import fs19 from "fs";
 import { Command as Command7 } from "commander";
 import chalk7 from "chalk";
 var description = new Command7("description").description("Show or update the task description");
@@ -1938,8 +2290,8 @@ function fail2(err) {
 }
 function readBodyFromOpts2(opts) {
   if (opts.body !== void 0) return opts.body;
-  if (opts.file === "-") return fs16.readFileSync(0, "utf-8");
-  if (opts.file) return fs16.readFileSync(opts.file, "utf-8");
+  if (opts.file === "-") return fs19.readFileSync(0, "utf-8");
+  if (opts.file) return fs19.readFileSync(opts.file, "utf-8");
   throw new Error("Provide --body or --file (use --file - to read stdin)");
 }
 description.command("show <taskId>").description("Print the current description (taskId is short id or tsk_)").option("--json", "Output JSON").action(async (taskId, opts) => {
@@ -1988,12 +2340,12 @@ task.addCommand(comment);
 task.addCommand(description);
 task.command("init <input>").description("Create a task from a description or Linear/GitHub issue URL").action(async (input) => {
   const cwd = process.cwd();
-  const projectYml = path15.join(cwd, "task0.yml");
-  if (!fs17.existsSync(projectYml)) {
+  const projectYml = path17.join(cwd, "task0.yml");
+  if (!fs20.existsSync(projectYml)) {
     console.error(chalk8.red("Not a task0 project (task0.yml not found). Run `task0 project init` first."));
     process.exit(1);
   }
-  const projectConfig = yaml6.load(fs17.readFileSync(projectYml, "utf-8"));
+  const projectConfig = yaml7.load(fs20.readFileSync(projectYml, "utf-8"));
   if (projectConfig.kind !== "project") {
     console.error(chalk8.red('Invalid task0.yml: kind is not "project"'));
     process.exit(1);
@@ -2009,38 +2361,38 @@ task.command("init <input>").description("Create a task from a description or Li
 });
 task.command("migrate").description("Add task0.yml to legacy task directories that lack one").option("--dry-run", "Show what would be created without writing").action((opts) => {
   const cwd = process.cwd();
-  const projectYml = path15.join(cwd, "task0.yml");
-  if (!fs17.existsSync(projectYml)) {
+  const projectYml = path17.join(cwd, "task0.yml");
+  if (!fs20.existsSync(projectYml)) {
     console.error(chalk8.red("Not a task0 project (task0.yml not found). Run `task0 project init` first."));
     process.exit(1);
   }
-  const projectConfig = yaml6.load(fs17.readFileSync(projectYml, "utf-8"));
+  const projectConfig = yaml7.load(fs20.readFileSync(projectYml, "utf-8"));
   if (projectConfig.kind !== "project") {
     console.error(chalk8.red('Invalid task0.yml: kind is not "project"'));
     process.exit(1);
   }
-  const tasksDir = path15.join(cwd, projectConfig.tasks_dir);
-  if (!fs17.existsSync(tasksDir)) {
+  const tasksDir = path17.join(cwd, projectConfig.tasks_dir);
+  if (!fs20.existsSync(tasksDir)) {
     console.error(chalk8.red(`Tasks directory not found: ${tasksDir}`));
     process.exit(1);
   }
-  const entries = fs17.readdirSync(tasksDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+  const entries = fs20.readdirSync(tasksDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   let migrated = 0;
   let skipped = 0;
   let seededObjectIds = 0;
   for (const name of entries) {
-    const taskDir = path15.join(tasksDir, name);
-    const taskYml = path15.join(taskDir, "task0.yml");
-    if (fs17.existsSync(taskYml)) {
+    const taskDir = path17.join(tasksDir, name);
+    const taskYml = path17.join(taskDir, "task0.yml");
+    if (fs20.existsSync(taskYml)) {
       skipped++;
       try {
-        const raw = yaml6.load(fs17.readFileSync(taskYml, "utf-8"));
+        const raw = yaml7.load(fs20.readFileSync(taskYml, "utf-8"));
         if (raw && raw.kind === "task" && !raw.object_id) {
           raw.object_id = generateObjectId("task");
           if (opts.dryRun) {
             console.log(chalk8.dim(`[dry-run] seed object_id: ${taskYml}`));
           } else {
-            fs17.writeFileSync(taskYml, yaml6.dump(raw, { lineWidth: 120 }), "utf-8");
+            fs20.writeFileSync(taskYml, yaml7.dump(raw, { lineWidth: 120 }), "utf-8");
             console.log(chalk8.green(`  seed object_id: ${taskYml}`));
           }
           seededObjectIds++;
@@ -2065,7 +2417,7 @@ task.command("migrate").description("Add task0.yml to legacy task directories th
     if (opts.dryRun) {
       console.log(chalk8.dim(`[dry-run] ${taskYml}`));
     } else {
-      fs17.writeFileSync(taskYml, yaml6.dump(taskConfig), "utf-8");
+      fs20.writeFileSync(taskYml, yaml7.dump(taskConfig), "utf-8");
       console.log(chalk8.green(`  ${taskYml}`));
     }
     migrated++;
@@ -2125,7 +2477,7 @@ task.command("done <id>").description("Write task lifecycle state to task0.yml \
   try {
     const { resolveTaskByObjectId: resolveTaskByObjectId2 } = await Promise.resolve().then(() => (init_task_state2(), task_state_exports));
     const loc = resolveTaskByObjectId2(id);
-    const raw = yaml6.load(fs17.readFileSync(loc.taskYml, "utf-8"));
+    const raw = yaml7.load(fs20.readFileSync(loc.taskYml, "utf-8"));
     if (opts.phase) {
       const phase = opts.phase.trim();
       if (!phase) {
@@ -2138,7 +2490,7 @@ task.command("done <id>").description("Write task lifecycle state to task0.yml \
         return;
       }
       raw.workflow = { ...workflow2, phase };
-      fs17.writeFileSync(loc.taskYml, yaml6.dump(raw, { lineWidth: 120 }), "utf-8");
+      fs20.writeFileSync(loc.taskYml, yaml7.dump(raw, { lineWidth: 120 }), "utf-8");
       console.log(chalk8.green(`${id} phase: ${phase}`));
       return;
     }
@@ -2149,7 +2501,7 @@ task.command("done <id>").description("Write task lifecycle state to task0.yml \
     raw.status = "done";
     const workflow = raw.workflow ?? {};
     raw.workflow = { ...workflow, phase: "completed" };
-    fs17.writeFileSync(loc.taskYml, yaml6.dump(raw, { lineWidth: 120 }), "utf-8");
+    fs20.writeFileSync(loc.taskYml, yaml7.dump(raw, { lineWidth: 120 }), "utf-8");
     console.log(chalk8.green(`${id} marked as done`));
   } catch (err) {
     console.error(chalk8.red(err.message));
@@ -2158,33 +2510,33 @@ task.command("done <id>").description("Write task lifecycle state to task0.yml \
 });
 task.command("archive <id>").description("Archive a task (append to tasks.tar, remove from tasks/)").action((id) => {
   const cwd = process.cwd();
-  const projectYml = path15.join(cwd, "task0.yml");
-  if (!fs17.existsSync(projectYml)) {
+  const projectYml = path17.join(cwd, "task0.yml");
+  if (!fs20.existsSync(projectYml)) {
     console.error(chalk8.red("Not a task0 project (task0.yml not found)."));
     process.exit(1);
   }
-  const projectConfig = yaml6.load(fs17.readFileSync(projectYml, "utf-8"));
+  const projectConfig = yaml7.load(fs20.readFileSync(projectYml, "utf-8"));
   if (projectConfig.kind !== "project") {
     console.error(chalk8.red('Invalid task0.yml: kind is not "project"'));
     process.exit(1);
   }
-  const tasksDir = path15.join(cwd, projectConfig.tasks_dir);
-  const taskDir = path15.join(tasksDir, id);
-  if (!fs17.existsSync(taskDir)) {
+  const tasksDir = path17.join(cwd, projectConfig.tasks_dir);
+  const taskDir = path17.join(tasksDir, id);
+  if (!fs20.existsSync(taskDir)) {
     console.error(chalk8.red(`Task "${id}" not found at ${taskDir}`));
     process.exit(1);
   }
   const tarFile = tasksDir + ".tar";
   archiveTaskToTar(tasksDir, id, tarFile);
-  fs17.rmSync(taskDir, { recursive: true });
+  fs20.rmSync(taskDir, { recursive: true });
   console.log(chalk8.green(`Archived "${id}" \u2192 ${tarFile}`));
 });
 function archiveTaskToTar(tasksDir, taskId, tarFile) {
-  if (fs17.existsSync(tarFile) && !fs17.statSync(tarFile).isFile()) {
+  if (fs20.existsSync(tarFile) && !fs20.statSync(tarFile).isFile()) {
     console.error(chalk8.red(`${tarFile} exists but is not a file (likely a leftover directory). Remove it manually first.`));
     process.exit(1);
   }
-  if (fs17.existsSync(tarFile)) {
+  if (fs20.existsSync(tarFile)) {
     execSync(`tar -rf ${JSON.stringify(tarFile)} -C ${JSON.stringify(tasksDir)} ${JSON.stringify(taskId)}`);
   } else {
     execSync(`tar -cf ${JSON.stringify(tarFile)} -C ${JSON.stringify(tasksDir)} ${JSON.stringify(taskId)}`);
@@ -2194,9 +2546,9 @@ function archiveTaskToTar(tasksDir, taskId, tarFile) {
 // src/commands/ui.ts
 import { Command as Command9 } from "commander";
 import { spawn } from "child_process";
-import path16 from "path";
+import path18 from "path";
 import chalk9 from "chalk";
-var DASHBOARD_DIR = path16.resolve(
+var DASHBOARD_DIR = path18.resolve(
   import.meta.dirname,
   "..",
   "..",
@@ -2230,17 +2582,17 @@ import chalk10 from "chalk";
 // ../../packages/shared/dist/types/agent.js
 var AGENT_KINDS = ["coding", "llm_api", "workflow"];
 var AGENT_KIND_SET = new Set(AGENT_KINDS);
-var CODING_RUNTIME_AGENTS = ["claude-code", "codex", "cursor"];
-var CODING_RUNTIME_AGENT_SET = new Set(CODING_RUNTIME_AGENTS);
-function isCodingRuntimeAgent(value) {
-  return typeof value === "string" && CODING_RUNTIME_AGENT_SET.has(value);
+var AGENT_PROVIDERS = ["claude-code", "codex", "cursor-agent"];
+var AGENT_PROVIDER_SET = new Set(AGENT_PROVIDERS);
+function isAgentProvider(value) {
+  return typeof value === "string" && AGENT_PROVIDER_SET.has(value);
 }
 
 // ../../packages/shared/dist/types/runtime.js
 var AGENT_RUN_STATUS_VALUES = ["starting", "running", "done", "error"];
 var AGENT_RUN_STATUS_SET = new Set(AGENT_RUN_STATUS_VALUES);
-var RUNTIME_AGENTS = CODING_RUNTIME_AGENTS;
-var isRuntimeAgent = isCodingRuntimeAgent;
+var RUNTIME_AGENTS = AGENT_PROVIDERS;
+var isRuntimeAgent = isAgentProvider;
 var AGENT_MODEL_DEFAULTS = {
   "claude-code": [
     { id: "opus", label: "Opus" },
@@ -2252,7 +2604,7 @@ var AGENT_MODEL_DEFAULTS = {
     { id: "o3", label: "o3" },
     { id: "o4-mini", label: "o4-mini" }
   ],
-  cursor: [
+  "cursor-agent": [
     { id: "", label: "Default" },
     { id: "gpt-5", label: "GPT-5" },
     { id: "sonnet-4", label: "Sonnet 4" },
@@ -2260,12 +2612,12 @@ var AGENT_MODEL_DEFAULTS = {
   ]
 };
 function defaultAgentModelFetchCommand(agent2) {
-  if (agent2 === "cursor")
+  if (agent2 === "cursor-agent")
     return "cursor-agent models";
   return void 0;
 }
 function defaultAgentModelOutputFormat(agent2) {
-  if (agent2 === "cursor")
+  if (agent2 === "cursor-agent")
     return "lines";
   return void 0;
 }
@@ -2477,12 +2829,12 @@ models.command("default <agent>").description("Get or set default model / effort
 });
 
 // src/commands/agent-run.ts
-import fs18 from "fs";
-import path17 from "path";
+import fs21 from "fs";
+import path19 from "path";
 import { Command as Command11 } from "commander";
 import chalk11 from "chalk";
 import { spawn as spawn2, spawnSync as spawnSync3 } from "child_process";
-import yaml7 from "js-yaml";
+import yaml8 from "js-yaml";
 var agentRun = new Command11("agent-run").description("Inspect and control agent runs");
 agentRun.command("list").description("List active agent runs").option("--json", "Output JSON").option("--task <id>", "Filter by task id").action(async (opts) => {
   try {
@@ -2606,7 +2958,7 @@ profile.command("get <ref>").description("Show one runtime profile by slug or ob
     console.log(formatProfile(result.runtime));
     console.log();
     console.log(chalk11.dim("--- exec ---"));
-    console.log(yaml7.dump(result.runtime.exec, { lineWidth: 100 }));
+    console.log(yaml8.dump(result.runtime.exec, { lineWidth: 100 }));
   } catch (err) {
     const apiErr = err;
     if (apiErr.status === 404) failProfile(`not found: ${ref}`);
@@ -2616,7 +2968,7 @@ profile.command("get <ref>").description("Show one runtime profile by slug or ob
 profile.command("create").description("Create a runtime profile from a YAML spec file").requiredOption("--from-file <file>", "YAML spec file with kind, slug, exec").option("--scope <scope>", "Storage scope: user (default) or project", "user").option("--project-root <path>", "Project root (required for --scope project)").action(async (opts) => {
   let parsed;
   try {
-    parsed = yaml7.load(fs18.readFileSync(path17.resolve(opts.fromFile), "utf-8"));
+    parsed = yaml8.load(fs21.readFileSync(path19.resolve(opts.fromFile), "utf-8"));
   } catch (err) {
     failProfile(`cannot read ${opts.fromFile}: ${err.message}`);
   }
@@ -2632,14 +2984,14 @@ profile.command("edit <ref>").description("Open the runtime profile YAML in $EDI
   try {
     const result = await api.get(`/api/runtime-profiles/${encodeURIComponent(ref)}`);
     if (result.runtime.system) failProfile("cannot edit a system runtime profile");
-    const tmp = path17.join(process.env.TMPDIR || "/tmp", `task0-runtime-${result.runtime.slug}-${Date.now()}.yml`);
-    fs18.writeFileSync(tmp, yaml7.dump(result.runtime, { lineWidth: 100 }), "utf-8");
+    const tmp = path19.join(process.env.TMPDIR || "/tmp", `task0-runtime-${result.runtime.slug}-${Date.now()}.yml`);
+    fs21.writeFileSync(tmp, yaml8.dump(result.runtime, { lineWidth: 100 }), "utf-8");
     const editor = process.env.EDITOR || "vi";
     const r = spawnSync3(editor, [tmp], { stdio: "inherit" });
     if (r.status !== 0) failProfile(`editor exited with status ${r.status}`);
-    const updated = yaml7.load(fs18.readFileSync(tmp, "utf-8"));
+    const updated = yaml8.load(fs21.readFileSync(tmp, "utf-8"));
     await api.put(`/api/runtime-profiles/${encodeURIComponent(ref)}`, updated);
-    fs18.unlinkSync(tmp);
+    fs21.unlinkSync(tmp);
     console.log(chalk11.green(`updated ${ref}`));
   } catch (err) {
     failProfile(err.message);
@@ -2659,13 +3011,13 @@ agentRun.addCommand(profile);
 // src/commands/plan.ts
 import { Command as Command12 } from "commander";
 import chalk12 from "chalk";
-import fs19 from "fs";
-import path18 from "path";
+import fs22 from "fs";
+import path20 from "path";
 init_task_state2();
 var PLAN_GENERATE_SKILL_NAME = "plan-generate";
 function resolveSkillFilePath3(projectRoot, skillName) {
-  const p = path18.join(projectRoot, ".claude", "skills", skillName, "SKILL.md");
-  return fs19.existsSync(p) ? p : null;
+  const p = path20.join(projectRoot, ".claude", "skills", skillName, "SKILL.md");
+  return fs22.existsSync(p) ? p : null;
 }
 var plan = new Command12("plan").description("Generate and refine plans");
 plan.command("generate <objectId>").description("Generate plan(s) from an IDEA file \u2014 supports agent fan-out").option("-a, --agents <list>", "Comma-separated agents (claude-code,codex,cursor)", "codex,claude-code").option("--model <id>", "Model id or alias \u2014 only with a single agent; use `task0 models default` for fan-out").option("--effort <level>", "Reasoning effort \u2014 only with a single agent; use `task0 models default` for fan-out").option("--idea <file>", "IDEA file name (default: latest IDEA-NN.md)").option("--additional-prompt <text>", "Extra prompt content").option("--wait", "Wait for completion").option("--force", "Overwrite existing plan files").option("--json", "Output JSON").action(async (objectId, opts) => {
@@ -2797,7 +3149,7 @@ var PLAN_REFINE_SKILL_NAME = "plan-refine";
 plan.command("refine <objectId>").description("Synthesize plan files + ISSUE files into a refined plan").option("--agent <name>", "Agent to run refine (claude-code|codex)", "claude-code").option("--model <id>", "Model id or alias (see `task0 models refresh`)").option("--effort <level>", "Reasoning effort (e.g. low|medium|high)").option("--wait", "Wait for completion").option("--json", "Output JSON").action(async (objectId, opts) => {
   try {
     const loc = resolveTaskByObjectId(objectId);
-    const files = fs19.readdirSync(loc.taskDir);
+    const files = fs22.readdirSync(loc.taskDir);
     const planFiles = files.filter((f) => /^PLAN-\d+-(codex|claude-code|cursor)\.md$/.test(f));
     if (planFiles.length === 0) {
       console.error(chalk12.red("No PLAN-NN-<agent>.md files found. Run `task0 plan generate` first."));
@@ -2839,8 +3191,8 @@ plan.command("refine <objectId>").description("Synthesize plan files + ISSUE fil
           if (!opts.json) console.log(chalk12.dim(`[refine] ${s.status}${s.phase ? " " + s.phase : ""}`));
         }
       });
-      const refinedPath = path18.join(loc.taskDir, refinedFile);
-      const wrote = fs19.existsSync(refinedPath);
+      const refinedPath = path20.join(loc.taskDir, refinedFile);
+      const wrote = fs22.existsSync(refinedPath);
       if (final.status === "done" && wrote) {
         await updateWorkflow(loc.taskYml, {
           phase: "refined",
@@ -2992,8 +3344,8 @@ import { Command as Command14 } from "commander";
 import chalk14 from "chalk";
 
 // src/lib/project.ts
-import path19 from "path";
-import fs20 from "fs";
+import path21 from "path";
+import fs23 from "fs";
 function resolveProjectName(opts) {
   if (opts.project && opts.project.length > 0) return opts.project;
   const config = loadConfig();
@@ -3003,15 +3355,15 @@ function resolveProjectName(opts) {
       "Cannot resolve project: no registered projects. Use `task0 source add <path>` first, or pass --project <name>."
     );
   }
-  const cwd = fs20.realpathSync(process.cwd());
+  const cwd = fs23.realpathSync(process.cwd());
   for (const source2 of projects) {
     let sourceAbs;
     try {
-      sourceAbs = fs20.realpathSync(path19.resolve(source2.path));
+      sourceAbs = fs23.realpathSync(path21.resolve(source2.path));
     } catch {
-      sourceAbs = path19.resolve(source2.path);
+      sourceAbs = path21.resolve(source2.path);
     }
-    if (cwd === sourceAbs || cwd.startsWith(sourceAbs + path19.sep)) {
+    if (cwd === sourceAbs || cwd.startsWith(sourceAbs + path21.sep)) {
       return source2.name;
     }
   }
@@ -3651,12 +4003,12 @@ import chalk17 from "chalk";
 
 // src/core/issue/decision.ts
 init_node();
-import fs21 from "fs";
-import path20 from "path";
+import fs24 from "fs";
+import path22 from "path";
 init_task_state2();
 var DECISION_FILE_RE = /^DECISION-(\d+)-([a-z0-9-]+)\.md$/;
 function selectBlockingIssues(taskDir, explicitIssue) {
-  const files = fs21.existsSync(taskDir) ? fs21.readdirSync(taskDir) : [];
+  const files = fs24.existsSync(taskDir) ? fs24.readdirSync(taskDir) : [];
   const issueFiles = files.filter((f) => /^ISSUE-\d+\.md$/.test(f)).sort();
   const all = readOpenQuestions(taskDir, issueFiles);
   if (!explicitIssue) return all;
@@ -3760,12 +4112,12 @@ function parseConsolidatedAnswers(md) {
   return sections;
 }
 function rewriteIssueWithDecisions(taskDir, issueFile, consolidatedFile) {
-  const issuePath = path20.join(taskDir, issueFile);
-  const consolidatedPath = path20.join(taskDir, consolidatedFile);
-  if (!fs21.existsSync(issuePath)) throw new Error(`${issueFile} not found in ${taskDir}`);
-  if (!fs21.existsSync(consolidatedPath)) throw new Error(`${consolidatedFile} not found in ${taskDir}`);
-  const issueMd = fs21.readFileSync(issuePath, "utf-8");
-  const consolidatedMd = fs21.readFileSync(consolidatedPath, "utf-8");
+  const issuePath = path22.join(taskDir, issueFile);
+  const consolidatedPath = path22.join(taskDir, consolidatedFile);
+  if (!fs24.existsSync(issuePath)) throw new Error(`${issueFile} not found in ${taskDir}`);
+  if (!fs24.existsSync(consolidatedPath)) throw new Error(`${consolidatedFile} not found in ${taskDir}`);
+  const issueMd = fs24.readFileSync(issuePath, "utf-8");
+  const consolidatedMd = fs24.readFileSync(consolidatedPath, "utf-8");
   const answers = parseConsolidatedAnswers(consolidatedMd);
   if (answers.length === 0) {
     throw new Error(`${consolidatedFile} has no "## Qn" sections; cannot derive Decisions`);
@@ -3787,7 +4139,7 @@ _Resolved from [${consolidatedFile}](${consolidatedFile}); see that file for rea
     throw new Error(`${issueFile} has no "## Open Questions" section to replace`);
   }
   const next = issueMd.replace(openQRe, decisionsSection.trimEnd() + "\n");
-  fs21.writeFileSync(issuePath, next, "utf-8");
+  fs24.writeFileSync(issuePath, next, "utf-8");
   return { replaced: answers.length };
 }
 async function propose(opts) {
@@ -3815,8 +4167,8 @@ async function propose(opts) {
     const kicks = [];
     for (const agent2 of opts.agents) {
       const decisionFile = decisionFileName(issue2, agent2);
-      const decisionPath = path20.join(loc.taskDir, decisionFile);
-      if (fs21.existsSync(decisionPath) && !opts.force) {
+      const decisionPath = path22.join(loc.taskDir, decisionFile);
+      if (fs24.existsSync(decisionPath) && !opts.force) {
         if (opts.ifNeeded) {
           kicks.push({
             issue: issue2.file,
@@ -3891,7 +4243,7 @@ async function propose(opts) {
           const final = await waitForAgentRun(k.agentRunId);
           if (final.status !== "done") {
             k.error = final.error || `runtime ${k.agentRunId} ended with ${final.status}`;
-          } else if (!fs21.existsSync(path20.join(loc.taskDir, k.decisionFile))) {
+          } else if (!fs24.existsSync(path22.join(loc.taskDir, k.decisionFile))) {
             k.error = `runtime completed but ${k.decisionFile} was not written`;
           }
         } catch (err) {
@@ -3912,7 +4264,7 @@ async function consolidate(opts) {
   const kicks = [];
   const modelOpts = resolveModelOptions(opts.agent, { model: opts.model, effort: opts.effort }, opts.warn);
   for (const issue2 of issues) {
-    const files = fs21.readdirSync(loc.taskDir);
+    const files = fs24.readdirSync(loc.taskDir);
     const proposalFiles = files.filter((f) => {
       const m = f.match(DECISION_FILE_RE);
       return !!m && m[1] === issue2.index && m[2] !== "consolidated";
@@ -3958,7 +4310,7 @@ async function consolidate(opts) {
       if (opts.wait) {
         try {
           const final = await waitForAgentRun(agentRunId);
-          const wrote = fs21.existsSync(path20.join(loc.taskDir, consolidatedFile));
+          const wrote = fs24.existsSync(path22.join(loc.taskDir, consolidatedFile));
           if (final.status !== "done") {
             kick.error = final.error || `runtime ${agentRunId} ended with ${final.status}`;
           } else if (!wrote) {
@@ -4024,7 +4376,7 @@ async function approve(opts) {
   return { updated };
 }
 function buildReferenceFiles(taskDir, issue2) {
-  const names = fs21.readdirSync(taskDir);
+  const names = fs24.readdirSync(taskDir);
   const refs = [issue2.file];
   if (names.includes("ISSUE.md")) refs.push("ISSUE.md");
   const ideaFile = `IDEA-${issue2.index}.md`;
@@ -4132,12 +4484,12 @@ issue.command("approve <taskId>").description("Apply the consolidated decisions
 });
 
 // src/commands/agent.ts
-import fs22 from "fs";
-import path21 from "path";
+import fs25 from "fs";
+import path23 from "path";
 import { spawnSync as spawnSync5 } from "child_process";
 import { Command as Command18 } from "commander";
 import chalk18 from "chalk";
-import yaml8 from "js-yaml";
+import yaml9 from "js-yaml";
 function statusBadge(s) {
   if (s === "working") return chalk18.cyan("\u25CF");
   if (s === "error") return chalk18.red("\u25CF");
@@ -4156,7 +4508,7 @@ function fail5(message, code = 1) {
   process.exit(code);
 }
 function formatAgent(a, withDetails = false) {
-  const tag = a.system ? chalk18.dim("(system)") : a.scope ? chalk18.dim(`(${a.scope})`) : "";
+  const tag = a.scope ? chalk18.dim(`(${a.scope})`) : "";
   const dot = statusBadge(a.status);
   const head = `${dot} ${chalk18.bold(a.slug.padEnd(24))} ${chalk18.dim(a.object_id.padEnd(16))} ${a.kind.padEnd(10)} ${tag}`;
   if (!withDetails) return head;
@@ -4197,10 +4549,10 @@ agent.command("get <ref>").description("Show one agent by object_id or slug").op
     }
     console.log();
     console.log(chalk18.dim("--- spec ---"));
-    console.log(yaml8.dump(result.agent.spec, { lineWidth: 100 }));
+    console.log(yaml9.dump(result.agent.spec, { lineWidth: 100 }));
     if (result.agent.mcp_config) {
       console.log(chalk18.dim("--- mcp_config ---"));
-      console.log(yaml8.dump(result.agent.mcp_config, { lineWidth: 100 }));
+      console.log(yaml9.dump(result.agent.mcp_config, { lineWidth: 100 }));
     }
   } catch (err) {
     const apiErr = err;
@@ -4211,8 +4563,8 @@ agent.command("get <ref>").description("Show one agent by object_id or slug").op
 agent.command("create").description("Create an agent from a YAML spec file").requiredOption("--from-file <file>", "YAML spec file with at least kind, slug, spec").option("--scope <scope>", "Storage scope: user (default) or project", "user").option("--project-root <path>", "Project root (required for --scope project)").action(async (opts) => {
   let parsed;
   try {
-    const raw = fs22.readFileSync(path21.resolve(opts.fromFile), "utf-8");
-    parsed = yaml8.load(raw);
+    const raw = fs25.readFileSync(path23.resolve(opts.fromFile), "utf-8");
+    parsed = yaml9.load(raw);
   } catch (err) {
     fail5(`cannot read ${opts.fromFile}: ${err.message}`);
   }
@@ -4227,18 +4579,17 @@ agent.command("create").description("Create an agent from a YAML spec file").req
 agent.command("edit <ref>").description("Open the agent YAML in $EDITOR and save changes").action(async (ref) => {
   try {
     const result = await api.get(`/api/agents/${encodeURIComponent(ref)}`);
-    if (result.agent.system) fail5("cannot edit a system agent");
-    const tmp = path21.join(
+    const tmp = path23.join(
       process.env.TMPDIR || "/tmp",
       `task0-agent-${result.agent.slug}-${Date.now()}.yml`
     );
-    fs22.writeFileSync(tmp, yaml8.dump(result.agent, { lineWidth: 100 }), "utf-8");
+    fs25.writeFileSync(tmp, yaml9.dump(result.agent, { lineWidth: 100 }), "utf-8");
     const editor = process.env.EDITOR || "vi";
     const r = spawnSync5(editor, [tmp], { stdio: "inherit" });
     if (r.status !== 0) fail5(`editor exited with status ${r.status}`);
-    const updated = yaml8.load(fs22.readFileSync(tmp, "utf-8"));
+    const updated = yaml9.load(fs25.readFileSync(tmp, "utf-8"));
     await api.put(`/api/agents/${encodeURIComponent(ref)}`, updated);
-    fs22.unlinkSync(tmp);
+    fs25.unlinkSync(tmp);
     console.log(chalk18.green(`updated ${ref}`));
   } catch (err) {
     fail5(err.message);
@@ -4309,7 +4660,7 @@ var mcp = new Command18("mcp").description("Manage per-agent MCP config (mcp_con
 mcp.command("set <ref>").description("Set mcp_config from a JSON file (replaces existing config)").requiredOption("--from-file <file>", "JSON file containing the mcp_config object").action(async (ref, opts) => {
   let parsed;
   try {
-    parsed = JSON.parse(fs22.readFileSync(path21.resolve(opts.fromFile), "utf-8"));
+    parsed = JSON.parse(fs25.readFileSync(path23.resolve(opts.fromFile), "utf-8"));
   } catch (err) {
     fail5(`cannot parse ${opts.fromFile}: ${err.message}`);
   }
@@ -4352,7 +4703,8 @@ async function streamOutput(ref, agentRunId) {
 }
 
 // src/commands/daemon.ts
-import os8 from "os";
+import os6 from "os";
+import { execFileSync as execFileSync2 } from "child_process";
 import { Command as Command19 } from "commander";
 import chalk19 from "chalk";
 import WebSocket from "ws";
@@ -4431,7 +4783,7 @@ var RegisterAuthUnavailableError = class extends Error {
       `No registration credential available.
   \u2022 Pass --token <apit_...> with an API token created in the dashboard, or
   \u2022 Set TASK0_API_TOKEN in the environment, or
-  \u2022 Fall back to the server's admin token (TASK0_ADMIN_TOKEN or ~/.config/task0/admin.token).`
+  \u2022 Fall back to the server's admin token (TASK0_ADMIN_TOKEN or ~/.task0/admin.token).`
     );
     this.name = "RegisterAuthUnavailableError";
   }
@@ -4457,36 +4809,36 @@ function pickRegisterAuth(flagToken) {
 
 // src/core/daemon-rpc-handlers.ts
 init_node();
-import fs25 from "fs";
-import path24 from "path";
+import fs28 from "fs";
+import path26 from "path";
 
 // src/core/daemon-agent-run-runner.ts
 import { execFileSync } from "child_process";
-import fs24 from "fs";
-import path23 from "path";
+import fs27 from "fs";
+import path25 from "path";
 
 // src/core/daemon-agent-run-dir.ts
-import fs23 from "fs";
-import os6 from "os";
-import path22 from "path";
+init_node();
+import fs26 from "fs";
+import path24 from "path";
 function agentRunRoot() {
-  return process.env.TASK0_DAEMON_AGENT_RUN_DIR || path22.join(os6.homedir(), ".config", "task0", "agent-run");
+  return process.env.TASK0_DAEMON_AGENT_RUN_DIR || path24.join(profileDir(), "agent-run");
 }
 function agentRunDir(runId) {
-  return path22.join(agentRunRoot(), runId);
+  return path24.join(agentRunRoot(), runId);
 }
 function agentRunStatusPath(runId) {
-  return path22.join(agentRunDir(runId), "status.json");
+  return path24.join(agentRunDir(runId), "status.json");
 }
 function ensureAgentRunDir(runId) {
   const dir = agentRunDir(runId);
-  fs23.mkdirSync(dir, { recursive: true });
+  fs26.mkdirSync(dir, { recursive: true });
   return dir;
 }
 function removeAgentRunDir(runId) {
   const dir = agentRunDir(runId);
-  if (!fs23.existsSync(dir)) return;
-  fs23.rmSync(dir, { recursive: true, force: true });
+  if (!fs26.existsSync(dir)) return;
+  fs26.rmSync(dir, { recursive: true, force: true });
 }
 
 // src/core/daemon-agent-run-runner.ts
@@ -4528,9 +4880,9 @@ function killSession2(sessionName) {
 }
 function readStatusFile(runId) {
   const filePath = agentRunStatusPath(runId);
-  if (!fs24.existsSync(filePath)) return null;
+  if (!fs27.existsSync(filePath)) return null;
   try {
-    const raw = fs24.readFileSync(filePath, "utf-8");
+    const raw = fs27.readFileSync(filePath, "utf-8");
     const parsed = JSON.parse(raw);
     return { raw, parsed };
   } catch {
@@ -4555,22 +4907,22 @@ function launchAgentRun(params) {
   if (active.has(params.runId)) {
     throw Object.assign(new Error(`agent run already active: ${params.runId}`), { code: "already_running" });
   }
-  if (!fs24.existsSync(params.workspace)) {
+  if (!fs27.existsSync(params.workspace)) {
     throw Object.assign(new Error(`workspace not found: ${params.workspace}`), { code: "workspace_missing" });
   }
   const runDir = ensureAgentRunDir(params.runId);
-  const scriptPath = path23.join(runDir, "script.sh");
-  fs24.writeFileSync(scriptPath, params.scriptContent, { mode: 493 });
+  const scriptPath = path25.join(runDir, "script.sh");
+  fs27.writeFileSync(scriptPath, params.scriptContent, { mode: 493 });
   if (params.promptContent !== void 0) {
-    fs24.writeFileSync(path23.join(runDir, "prompt.txt"), params.promptContent, "utf-8");
+    fs27.writeFileSync(path25.join(runDir, "prompt.txt"), params.promptContent, "utf-8");
   }
   for (const [name, content] of Object.entries(params.auxFiles ?? {})) {
     if (name.includes("/") || name.includes("\\") || name === ".." || name === ".") {
       throw Object.assign(new Error(`invalid aux file name: ${name}`), { code: "invalid_params" });
     }
-    fs24.writeFileSync(path23.join(runDir, name), content, "utf-8");
+    fs27.writeFileSync(path25.join(runDir, name), content, "utf-8");
   }
-  fs24.writeFileSync(
+  fs27.writeFileSync(
     agentRunStatusPath(params.runId),
     JSON.stringify({ status: "starting", updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2),
     "utf-8"
@@ -4649,6 +5001,20 @@ function ensureString(value, name) {
   }
   return value;
 }
+function ensureSafeTaskId(value) {
+  const id = ensureString(value, "taskId");
+  if (id.includes("/") || id.includes("\\") || id.includes("\0") || id === "." || id === ".." || path26.isAbsolute(id)) {
+    throw Object.assign(new Error(`invalid taskId: ${id}`), { code: "invalid_params" });
+  }
+  return id;
+}
+function assertContained(rootAbs, resolvedAbs) {
+  const root = path26.resolve(rootAbs);
+  const target = path26.resolve(resolvedAbs);
+  if (target !== root && !target.startsWith(root + path26.sep)) {
+    throw Object.assign(new Error("path escapes containment root"), { code: "invalid_params" });
+  }
+}
 function optionalString(value) {
   if (value === void 0 || value === null) return void 0;
   if (typeof value !== "string") {
@@ -4687,7 +5053,7 @@ var rpcHandlers = {
   // missing object_id / id mismatches applied in place on the daemon's FS.
   async scan_project(params) {
     const rootPath = ensureString(params.rootPath, "rootPath");
-    const name = typeof params.name === "string" && params.name ? params.name : path24.basename(rootPath);
+    const name = typeof params.name === "string" && params.name ? params.name : path26.basename(rootPath);
     const result = scanProjectWithRepair(rootPath, name);
     return { tasks: result.tasks, errors: result.errors };
   },
@@ -4698,7 +5064,7 @@ var rpcHandlers = {
     const filePath = ensureString(params.path, "path");
     let stat;
     try {
-      stat = fs25.statSync(filePath);
+      stat = fs28.statSync(filePath);
     } catch {
       throw Object.assign(new Error("file not found"), { code: "not_found" });
     }
@@ -4708,7 +5074,7 @@ var rpcHandlers = {
     if (stat.size > MAX_FILE_BYTES) {
       throw Object.assign(new Error(`file too large (${stat.size} bytes > ${MAX_FILE_BYTES})`), { code: "too_large" });
     }
-    const content = fs25.readFileSync(filePath, "utf-8");
+    const content = fs28.readFileSync(filePath, "utf-8");
     return { content, size: stat.size, modifiedAt: stat.mtime.toISOString() };
   },
   // ---------------------------------------------------------------------
@@ -4723,15 +5089,15 @@ var rpcHandlers = {
   },
   async project_add(params, ctx) {
     const rawPath = ensureString(params.path, "path");
-    const absPath = path24.resolve(rawPath);
-    if (!fs25.existsSync(absPath)) {
+    const absPath = path26.resolve(rawPath);
+    if (!fs28.existsSync(absPath)) {
       throw Object.assign(new Error(`path does not exist: ${absPath}`), { code: "not_found" });
     }
-    const stat = fs25.statSync(absPath);
+    const stat = fs28.statSync(absPath);
     if (!stat.isDirectory()) {
       throw Object.assign(new Error(`path is not a directory: ${absPath}`), { code: "invalid_target" });
     }
-    const name = optionalString(params.name)?.trim() || path24.basename(absPath);
+    const name = optionalString(params.name)?.trim() || path26.basename(absPath);
     const result = scanProjectWithRepair(absPath, name);
     addSource({ name, type: "project", path: absPath, enabled: true });
     ctx.notifyManifestChanged();
@@ -4775,36 +5141,38 @@ var rpcHandlers = {
   // in the same task directory. Path is resolved from (projectName, taskId).
   async task_read(params) {
     const projectName = ensureString(params.projectName, "projectName");
-    const taskId = ensureString(params.taskId, "taskId");
+    const taskId = ensureSafeTaskId(params.taskId);
     const project2 = listProjects().find((p) => p.name === projectName);
     if (!project2) {
       throw Object.assign(new Error(`project not found: ${projectName}`), { code: "not_found" });
     }
-    const projectAbs = path24.resolve(project2.path);
-    const projectConfig = readYaml(path24.join(projectAbs, "task0.yml"));
+    const projectAbs = path26.resolve(project2.path);
+    const projectConfig = readYaml(path26.join(projectAbs, "task0.yml"));
     if (!projectConfig) {
       throw Object.assign(new Error(`invalid project: missing task0.yml at ${projectAbs}`), { code: "invalid_project" });
     }
-    const taskDir = path24.join(projectAbs, projectConfig.tasks_dir, taskId);
-    if (!fs25.existsSync(taskDir)) {
+    const tasksRoot = path26.resolve(projectAbs, projectConfig.tasks_dir);
+    const taskDir = path26.resolve(tasksRoot, taskId);
+    assertContained(tasksRoot, taskDir);
+    if (!fs28.existsSync(taskDir)) {
       throw Object.assign(new Error(`task not found: ${taskId}`), { code: "not_found" });
     }
-    const taskYml = path24.join(taskDir, "task0.yml");
-    const yaml9 = readYaml(taskYml);
-    if (!yaml9) {
+    const taskYml = path26.join(taskDir, "task0.yml");
+    const yaml11 = readYaml(taskYml);
+    if (!yaml11) {
       throw Object.assign(new Error(`task yaml missing or unreadable: ${taskYml}`), { code: "not_found" });
     }
-    const files = fs25.readdirSync(taskDir).filter((name) => name !== "task0.yml");
-    return { task_dir: taskDir, yaml: yaml9, files };
+    const files = fs28.readdirSync(taskDir).filter((name) => name !== "task0.yml");
+    return { task_dir: taskDir, yaml: yaml11, files };
   },
   // Create a task directory + write task0.yml + write any additional named
   // files. Hub decides the taskId and yaml content (slug/object_id are
   // generated server-side); daemon just commits to disk.
   async task_create(params, ctx) {
     const projectName = ensureString(params.projectName, "projectName");
-    const taskId = ensureString(params.taskId, "taskId");
-    const yaml9 = params.yaml;
-    if (!yaml9 || typeof yaml9 !== "object") {
+    const taskId = ensureSafeTaskId(params.taskId);
+    const yaml11 = params.yaml;
+    if (!yaml11 || typeof yaml11 !== "object") {
       throw Object.assign(new Error("yaml (object) is required"), { code: "invalid_params" });
     }
     const files = params.files ?? {};
@@ -4812,22 +5180,24 @@ var rpcHandlers = {
     if (!project2) {
       throw Object.assign(new Error(`project not found: ${projectName}`), { code: "not_found" });
     }
-    const projectAbs = path24.resolve(project2.path);
-    const projectConfig = readYaml(path24.join(projectAbs, "task0.yml"));
+    const projectAbs = path26.resolve(project2.path);
+    const projectConfig = readYaml(path26.join(projectAbs, "task0.yml"));
     if (!projectConfig) {
       throw Object.assign(new Error(`invalid project: missing task0.yml at ${projectAbs}`), { code: "invalid_project" });
     }
-    const taskDir = path24.join(projectAbs, projectConfig.tasks_dir, taskId);
-    if (fs25.existsSync(taskDir)) {
+    const tasksRoot = path26.resolve(projectAbs, projectConfig.tasks_dir);
+    const taskDir = path26.resolve(tasksRoot, taskId);
+    assertContained(tasksRoot, taskDir);
+    if (fs28.existsSync(taskDir)) {
       throw Object.assign(new Error(`task already exists: ${taskId}`), { code: "already_exists" });
     }
-    fs25.mkdirSync(taskDir, { recursive: true });
-    writeYaml(path24.join(taskDir, "task0.yml"), yaml9);
+    fs28.mkdirSync(taskDir, { recursive: true });
+    writeYaml(path26.join(taskDir, "task0.yml"), yaml11);
     for (const [name, content] of Object.entries(files)) {
       if (name.includes("/") || name.includes("\\") || name === ".." || name === ".") {
         throw Object.assign(new Error(`invalid file name: ${name}`), { code: "invalid_params" });
       }
-      fs25.writeFileSync(path24.join(taskDir, name), content, "utf-8");
+      fs28.writeFileSync(path26.join(taskDir, name), content, "utf-8");
     }
     ctx.notifyManifestChanged();
     return { task_dir: taskDir };
@@ -4838,26 +5208,28 @@ var rpcHandlers = {
   // partial writes.
   async task_write_yaml(params, ctx) {
     const projectName = ensureString(params.projectName, "projectName");
-    const taskId = ensureString(params.taskId, "taskId");
-    const yaml9 = params.yaml;
-    if (!yaml9 || typeof yaml9 !== "object") {
+    const taskId = ensureSafeTaskId(params.taskId);
+    const yaml11 = params.yaml;
+    if (!yaml11 || typeof yaml11 !== "object") {
       throw Object.assign(new Error("yaml (object) is required"), { code: "invalid_params" });
     }
     const project2 = listProjects().find((p) => p.name === projectName);
     if (!project2) {
       throw Object.assign(new Error(`project not found: ${projectName}`), { code: "not_found" });
     }
-    const projectAbs = path24.resolve(project2.path);
-    const projectConfig = readYaml(path24.join(projectAbs, "task0.yml"));
+    const projectAbs = path26.resolve(project2.path);
+    const projectConfig = readYaml(path26.join(projectAbs, "task0.yml"));
     if (!projectConfig) {
       throw Object.assign(new Error(`invalid project: missing task0.yml at ${projectAbs}`), { code: "invalid_project" });
     }
-    const taskDir = path24.join(projectAbs, projectConfig.tasks_dir, taskId);
-    const taskYml = path24.join(taskDir, "task0.yml");
-    if (!fs25.existsSync(taskYml)) {
+    const tasksRoot = path26.resolve(projectAbs, projectConfig.tasks_dir);
+    const taskDir = path26.resolve(tasksRoot, taskId);
+    assertContained(tasksRoot, taskDir);
+    const taskYml = path26.join(taskDir, "task0.yml");
+    if (!fs28.existsSync(taskYml)) {
       throw Object.assign(new Error(`task yaml not found: ${taskYml}`), { code: "not_found" });
     }
-    writeYaml(taskYml, yaml9);
+    writeYaml(taskYml, yaml11);
     ctx.notifyManifestChanged();
     return { task_dir: taskDir };
   },
@@ -4865,21 +5237,23 @@ var rpcHandlers = {
   // workflows). Returns the deleted path so the hub can emit an event.
   async task_delete(params, ctx) {
     const projectName = ensureString(params.projectName, "projectName");
-    const taskId = ensureString(params.taskId, "taskId");
+    const taskId = ensureSafeTaskId(params.taskId);
     const project2 = listProjects().find((p) => p.name === projectName);
     if (!project2) {
       throw Object.assign(new Error(`project not found: ${projectName}`), { code: "not_found" });
     }
-    const projectAbs = path24.resolve(project2.path);
-    const projectConfig = readYaml(path24.join(projectAbs, "task0.yml"));
+    const projectAbs = path26.resolve(project2.path);
+    const projectConfig = readYaml(path26.join(projectAbs, "task0.yml"));
     if (!projectConfig) {
       throw Object.assign(new Error(`invalid project: missing task0.yml at ${projectAbs}`), { code: "invalid_project" });
     }
-    const taskDir = path24.join(projectAbs, projectConfig.tasks_dir, taskId);
-    if (!fs25.existsSync(taskDir)) {
+    const tasksRoot = path26.resolve(projectAbs, projectConfig.tasks_dir);
+    const taskDir = path26.resolve(tasksRoot, taskId);
+    assertContained(tasksRoot, taskDir);
+    if (!fs28.existsSync(taskDir)) {
       throw Object.assign(new Error(`task not found: ${taskId}`), { code: "not_found" });
     }
-    fs25.rmSync(taskDir, { recursive: true, force: true });
+    fs28.rmSync(taskDir, { recursive: true, force: true });
     ctx.notifyManifestChanged();
     return { task_dir: taskDir, deleted: true };
   },
@@ -4910,9 +5284,9 @@ var rpcHandlers = {
     const projectSkills = getProjectAgentSkills(workspace);
     const globalSkills = getGlobalAgentSkills();
     const all = [...projectSkills, ...globalSkills];
-    const resolved = path24.resolve(filePath);
+    const resolved = path26.resolve(filePath);
     const skill = all.find(
-      (s) => s.agent === agent2 && path24.resolve(s.filePath) === resolved
+      (s) => s.agent === agent2 && path26.resolve(s.filePath) === resolved
     ) ?? null;
     return { skill };
   },
@@ -4945,16 +5319,16 @@ var rpcHandlers = {
 
 // src/core/daemon-service/launchd.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import fs27 from "fs";
-import path26 from "path";
+import fs30 from "fs";
+import path28 from "path";
 
 // src/core/daemon-service/binary.ts
-import fs26 from "fs";
+import fs29 from "fs";
 import { fileURLToPath } from "url";
 function resolveTask0Invocation() {
   const node = process.execPath;
   const argv1 = process.argv[1] ?? fileURLToPath(import.meta.url);
-  const main2 = fs26.realpathSync(argv1);
+  const main2 = fs29.realpathSync(argv1);
   if (!isInstalledBuild(main2) && process.env.TASK0_ALLOW_DEV_SERVICE !== "1") {
     throw new Error(
       `Refusing to install autostart service pointing at ${main2}.
@@ -4970,31 +5344,44 @@ function isInstalledBuild(p) {
 }
 
 // src/core/daemon-service/paths.ts
-import os7 from "os";
-import path25 from "path";
+init_node();
+import os5 from "os";
+import path27 from "path";
 
 // src/core/daemon-service/types.ts
-var SERVICE_LABEL = "cc.cy0.task0";
+init_node();
+import crypto2 from "crypto";
+var BASE_SERVICE_LABEL = "cc.cy0.task0";
+function serviceLabel() {
+  const home = process.env.TASK0_HOME ?? "";
+  const profile3 = currentProfileName();
+  if ((!home || home.length === 0) && profile3 === DEFAULT_PROFILE_NAME) {
+    return BASE_SERVICE_LABEL;
+  }
+  const hash = crypto2.createHash("sha256").update(`${home}\0${profile3}`).digest("hex").slice(0, 8);
+  return `${BASE_SERVICE_LABEL}.${hash}`;
+}
 
 // src/core/daemon-service/paths.ts
 function unitPath(scope) {
   const platform = process.platform;
+  const label = serviceLabel();
   if (platform === "darwin") {
-    return scope === "user" ? path25.join(os7.homedir(), "Library", "LaunchAgents", `${SERVICE_LABEL}.plist`) : path25.join("/", "Library", "LaunchDaemons", `${SERVICE_LABEL}.plist`);
+    return scope === "user" ? path27.join(os5.homedir(), "Library", "LaunchAgents", `${label}.plist`) : path27.join("/", "Library", "LaunchDaemons", `${label}.plist`);
   }
   if (platform === "linux") {
-    return scope === "user" ? path25.join(os7.homedir(), ".config", "systemd", "user", `${SERVICE_LABEL}.service`) : path25.join("/", "etc", "systemd", "system", `${SERVICE_LABEL}.service`);
+    return scope === "user" ? path27.join(os5.homedir(), ".config", "systemd", "user", `${label}.service`) : path27.join("/", "etc", "systemd", "system", `${label}.service`);
   }
   throw new Error(`Unsupported platform for service install: ${platform}`);
 }
 function logDir() {
-  return path25.join(os7.homedir(), ".task0", "logs");
+  return path27.join(profileDir(), "logs");
 }
 function logPaths() {
   const dir = logDir();
   return {
-    out: path25.join(dir, "daemon.out.log"),
-    err: path25.join(dir, "daemon.err.log")
+    out: path27.join(dir, "daemon.out.log"),
+    err: path27.join(dir, "daemon.err.log")
   };
 }
 
@@ -5002,14 +5389,29 @@ function logPaths() {
 function escapeXml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
+function collectTask0Env() {
+  const out = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (k.startsWith("TASK0_") && typeof v === "string") out[k] = v;
+  }
+  return out;
+}
 function renderPlist(opts) {
   const programArgs = [opts.node, opts.main, ...opts.args].map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
+  const envLines = [
+    `    <key>PATH</key>`,
+    `    <string>/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin</string>`,
+    ...Object.entries(opts.task0Env ?? {}).flatMap(([k, v]) => [
+      `    <key>${escapeXml(k)}</key>`,
+      `    <string>${escapeXml(v)}</string>`
+    ])
+  ].join("\n");
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
   <key>Label</key>
-  <string>${SERVICE_LABEL}</string>
+  <string>${serviceLabel()}</string>
   <key>ProgramArguments</key>
   <array>
 ${programArgs}
@@ -5031,8 +5433,7 @@ ${programArgs}
   <string>${escapeXml(opts.home)}</string>
   <key>EnvironmentVariables</key>
   <dict>
-    <key>PATH</key>
-    <string>/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin</string>
+${envLines}
   </dict>
 </dict>
 </plist>
@@ -5044,7 +5445,7 @@ function domainTarget(scope) {
   return `gui/${uid}`;
 }
 function serviceTarget(scope) {
-  return `${domainTarget(scope)}/${SERVICE_LABEL}`;
+  return `${domainTarget(scope)}/${serviceLabel()}`;
 }
 function run2(cmd, args) {
   const res = spawnSync6(cmd, args, { encoding: "utf-8" });
@@ -5055,17 +5456,18 @@ function createLaunchdManager(scope) {
   const logs = logPaths();
   async function install() {
     const inv = resolveTask0Invocation();
-    fs27.mkdirSync(logDir(), { recursive: true });
-    fs27.mkdirSync(path26.dirname(file), { recursive: true });
+    fs30.mkdirSync(logDir(), { recursive: true });
+    fs30.mkdirSync(path28.dirname(file), { recursive: true });
     const body = renderPlist({
       node: inv.node,
       main: inv.main,
       args: inv.args,
       home: process.env.HOME ?? "/",
       out: logs.out,
-      err: logs.err
+      err: logs.err,
+      task0Env: collectTask0Env()
     });
-    fs27.writeFileSync(file, body, { mode: 420 });
+    fs30.writeFileSync(file, body, { mode: 420 });
     const bootstrap = run2("launchctl", ["bootstrap", domainTarget(scope), file]);
     if (bootstrap.code !== 0) {
       const already = /already loaded|service already bootstrapped/i.test(bootstrap.stderr);
@@ -5091,9 +5493,9 @@ function createLaunchdManager(scope) {
   }
   async function uninstall() {
     run2("launchctl", ["bootout", serviceTarget(scope)]);
-    if (fs27.existsSync(file)) {
+    if (fs30.existsSync(file)) {
       run2("launchctl", ["unload", file]);
-      fs27.unlinkSync(file);
+      fs30.unlinkSync(file);
     }
   }
   async function start() {
@@ -5112,7 +5514,7 @@ function createLaunchdManager(scope) {
     }
   }
   async function status() {
-    if (!fs27.existsSync(file)) return "absent";
+    if (!fs30.existsSync(file)) return "absent";
     const printed = run2("launchctl", ["print", serviceTarget(scope)]);
     if (printed.code !== 0) return "installed";
     const out = printed.stdout;
@@ -5135,15 +5537,26 @@ function createLaunchdManager(scope) {
 
 // src/core/daemon-service/systemd.ts
 import { spawnSync as spawnSync7 } from "child_process";
-import fs28 from "fs";
-import path27 from "path";
+import fs31 from "fs";
+import path29 from "path";
 function shellEscape(s) {
   if (!/[\s"\\$]/.test(s)) return s;
   return `"${s.replace(/[\\"]/g, (m) => `\\${m}`)}"`;
 }
+function collectTask0Env2() {
+  const out = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (k.startsWith("TASK0_") && typeof v === "string") out[k] = v;
+  }
+  return out;
+}
 function renderUnit(opts) {
   const execStart = [opts.node, opts.main, ...opts.args].map(shellEscape).join(" ");
   const wantedBy = opts.scope === "user" ? "default.target" : "multi-user.target";
+  const envLines = ["Environment=NODE_ENV=production"];
+  for (const [k, v] of Object.entries(opts.task0Env ?? {})) {
+    envLines.push(`Environment=${k}=${shellEscape(v)}`);
+  }
   return `[Unit]
 Description=task0 daemon \u2014 central-server bridge
 After=network-online.target
@@ -5156,7 +5569,7 @@ Restart=on-failure
 RestartSec=5s
 StandardOutput=append:${opts.out}
 StandardError=append:${opts.err}
-Environment=NODE_ENV=production
+${envLines.join("\n")}
 
 [Install]
 WantedBy=${wantedBy}
@@ -5172,20 +5585,21 @@ function run3(cmd, args) {
 function createSystemdManager(scope) {
   const file = unitPath(scope);
   const logs = logPaths();
-  const unitName = `${SERVICE_LABEL}.service`;
+  const unitName = `${serviceLabel()}.service`;
   async function install() {
     const inv = resolveTask0Invocation();
-    fs28.mkdirSync(logDir(), { recursive: true });
-    fs28.mkdirSync(path27.dirname(file), { recursive: true });
+    fs31.mkdirSync(logDir(), { recursive: true });
+    fs31.mkdirSync(path29.dirname(file), { recursive: true });
     const body = renderUnit({
       node: inv.node,
       main: inv.main,
       args: inv.args,
       out: logs.out,
       err: logs.err,
-      scope
+      scope,
+      task0Env: collectTask0Env2()
     });
-    fs28.writeFileSync(file, body, { mode: 420 });
+    fs31.writeFileSync(file, body, { mode: 420 });
     const reload = run3("systemctl", [...scopeFlag(scope), "daemon-reload"]);
     if (reload.code !== 0) {
       throw new Error(`systemctl daemon-reload failed: ${reload.stderr}`);
@@ -5194,8 +5608,8 @@ function createSystemdManager(scope) {
   }
   async function uninstall() {
     run3("systemctl", [...scopeFlag(scope), "disable", "--now", unitName]);
-    if (fs28.existsSync(file)) {
-      fs28.unlinkSync(file);
+    if (fs31.existsSync(file)) {
+      fs31.unlinkSync(file);
     }
     run3("systemctl", [...scopeFlag(scope), "daemon-reload"]);
   }
@@ -5212,7 +5626,7 @@ function createSystemdManager(scope) {
     }
   }
   async function status() {
-    if (!fs28.existsSync(file)) return "absent";
+    if (!fs31.existsSync(file)) return "absent";
     const res = run3("systemctl", [...scopeFlag(scope), "is-active", unitName]);
     const out = res.stdout.trim();
     if (out === "active") return "running";
@@ -5248,14 +5662,14 @@ function getServiceManager(scope) {
 // src/core/cli-version.ts
 import { readFileSync } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import path28 from "path";
+import path30 from "path";
 var cached2 = null;
 function readCliVersion() {
   if (cached2 !== null) return cached2;
-  const here = path28.dirname(fileURLToPath2(import.meta.url));
+  const here = path30.dirname(fileURLToPath2(import.meta.url));
   const candidates = [
-    path28.resolve(here, "..", "package.json"),
-    path28.resolve(here, "..", "..", "package.json")
+    path30.resolve(here, "..", "package.json"),
+    path30.resolve(here, "..", "..", "package.json")
   ];
   for (const candidate of candidates) {
     try {
@@ -5331,6 +5745,41 @@ function pushManifest(ws) {
   const manifest = buildManifest();
   ws.send(JSON.stringify(manifest));
 }
+var AGENT_PROVIDER_BINARIES = {
+  "claude-code": "claude",
+  codex: "codex",
+  "cursor-agent": "cursor-agent"
+};
+function detectAgentProvider(provider) {
+  const binary = AGENT_PROVIDER_BINARIES[provider];
+  let resolvedPath;
+  try {
+    resolvedPath = execFileSync2("which", [binary], {
+      encoding: "utf-8",
+      timeout: 2e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+  if (!resolvedPath) return null;
+  let version = null;
+  try {
+    version = execFileSync2(binary, ["--version"], {
+      encoding: "utf-8",
+      timeout: 3e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    version = null;
+  }
+  return { agent_provider: provider, path: resolvedPath, version };
+}
+function detectInstalledAgentProviders() {
+  return AGENT_PROVIDERS.map(detectAgentProvider).filter(
+    (entry) => entry !== null
+  );
+}
 function fail6(message, code = 1) {
   console.error(chalk19.red(message));
   process.exit(code);
@@ -5401,7 +5850,7 @@ daemonCmd.command("register").description("Register this host with a central ser
     throw error2;
   }
   const body = {
-    hostname: os8.hostname(),
+    hostname: os6.hostname(),
     platform: process.platform,
     name: opts.name
   };
@@ -5506,12 +5955,23 @@ daemonCmd.command("run").description("Run the daemon WebSocket loop in foregroun
     ws.on("open", () => {
       reconnectDelay = 1e3;
       console.log(chalk19.green(`[${(/* @__PURE__ */ new Date()).toISOString()}] connected`));
+      const installedAgentProviders = detectInstalledAgentProviders();
+      if (installedAgentProviders.length > 0) {
+        console.log(
+          chalk19.dim(
+            `detected agent providers: ${installedAgentProviders.map((p) => `${p.agent_provider}${p.version ? ` (${p.version})` : ""}`).join(", ")}`
+          )
+        );
+      } else {
+        console.log(chalk19.yellow("no agent providers detected on PATH (claude / codex / cursor-agent)"));
+      }
       const hello = {
         type: "hello",
         daemon_id: identity.daemon_id,
         version: readCliVersion(),
         hostname: identity.hostname,
-        platform: identity.platform
+        platform: identity.platform,
+        installed_agent_providers: installedAgentProviders
       };
       ws.send(JSON.stringify(hello));
       const manifest = buildManifest();
@@ -5688,16 +6148,15 @@ daemonCmd.command("logout").description("Stop and uninstall the autostart servic
 // src/commands/user.ts
 import { Command as Command20 } from "commander";
 import chalk20 from "chalk";
-var DEFAULT_BASE = (process.env.TASK0_API_URL || "http://127.0.0.1:4318").replace(/\/$/, "");
 function serverBase2() {
-  return DEFAULT_BASE;
+  return (process.env.TASK0_API_URL || "http://127.0.0.1:4318").replace(/\/$/, "");
 }
 function fail7(message, code = 1) {
   console.error(chalk20.red(message));
   process.exit(code);
 }
-async function callServer(path29, init = {}) {
-  const url = `${serverBase2()}${path29}`;
+async function callServer(path32, init = {}) {
+  const url = `${serverBase2()}${path32}`;
   let auth;
   try {
     auth = adminAuthHeader();
@@ -6200,6 +6659,186 @@ automation.command("runs <id>").description("List recent runs for an automation"
   for (const run4 of automation_runs) printRun(run4);
 });
 
+// src/commands/profile.ts
+init_node();
+import fs32 from "fs";
+import path31 from "path";
+import { Command as Command23 } from "commander";
+import chalk23 from "chalk";
+import yaml10 from "js-yaml";
+function fail9(msg) {
+  console.error(chalk23.red(msg));
+  process.exit(1);
+}
+function readDaemonAt(dir) {
+  const file = path31.join(dir, "daemon.json");
+  if (!fs32.existsSync(file)) return null;
+  try {
+    return JSON.parse(fs32.readFileSync(file, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function readProfileApiUrl(name) {
+  const file = path31.join(profileDir(name), "config.yml");
+  if (!fs32.existsSync(file)) return void 0;
+  try {
+    const data = yaml10.load(fs32.readFileSync(file, "utf-8"));
+    return data?.api_url;
+  } catch {
+    return void 0;
+  }
+}
+var profile2 = new Command23("profile").description("Manage CLI profiles (directories under ~/.task0/profiles/)");
+profile2.command("list").description("List configured profiles (one directory per profile)").action(() => {
+  const names = listProfileNames();
+  const current = currentProfileName();
+  if (names.length === 0) {
+    console.log("No profiles configured.");
+    return;
+  }
+  for (const name of names) {
+    const marker = name === current ? chalk23.green("\u25CF ") : "  ";
+    const apiUrl = readProfileApiUrl(name);
+    const url = apiUrl ? chalk23.dim(` \u2192 ${apiUrl}`) : "";
+    console.log(`${marker}${name}${url}`);
+  }
+});
+profile2.command("add <name>").description("Create a new profile directory (use `task0 profile use <name>` to activate)").option("--api-url <url>", "API server URL the CLI should call when this profile is active").action((name, opts) => {
+  if (!isValidProfileName(name)) {
+    fail9(`Invalid profile name "${name}". Must match /^[a-zA-Z0-9_-]+$/.`);
+  }
+  if (name === DEFAULT_PROFILE_NAME) {
+    fail9(`"${DEFAULT_PROFILE_NAME}" is reserved; it always exists.`);
+  }
+  const dir = profileDir(name);
+  if (fs32.existsSync(dir)) {
+    fail9(`Profile "${name}" already exists at ${dir}.`);
+  }
+  fs32.mkdirSync(dir, { recursive: true });
+  const prev = process.env.TASK0_PROFILE;
+  process.env.TASK0_PROFILE = name;
+  try {
+    const config = loadConfig();
+    if (opts.apiUrl) config.api_url = opts.apiUrl;
+    saveConfig(config);
+  } finally {
+    if (prev === void 0) delete process.env.TASK0_PROFILE;
+    else process.env.TASK0_PROFILE = prev;
+  }
+  console.log(chalk23.green(`Added profile "${name}"`));
+  console.log(`  dir:     ${dir}`);
+  if (opts.apiUrl) console.log(`  api_url: ${opts.apiUrl}`);
+  console.log(chalk23.dim(`Use \`task0 profile use ${name}\` to activate.`));
+});
+profile2.command("remove <name>").description('Delete a profile directory (refuses to delete "default")').option("-f, --force", `Remove even if it's the current profile (resets current to "default")`).action((name, opts) => {
+  if (!isValidProfileName(name)) {
+    fail9(`Invalid profile name "${name}".`);
+  }
+  if (name === DEFAULT_PROFILE_NAME) {
+    fail9(`"${DEFAULT_PROFILE_NAME}" cannot be removed.`);
+  }
+  const dir = profileDir(name);
+  if (!fs32.existsSync(dir)) {
+    fail9(`Profile "${name}" not found.`);
+  }
+  const current = currentProfileName();
+  if (current === name && !opts.force) {
+    fail9(`Profile "${name}" is current. Re-run with --force to remove it.`);
+  }
+  fs32.rmSync(dir, { recursive: true, force: true });
+  if (current === name) {
+    writeCurrentProfile(null);
+    console.log(chalk23.dim('Current profile reset to "default".'));
+  }
+  console.log(chalk23.green(`Removed profile "${name}".`));
+});
+profile2.command("use <name>").description("Set the current profile").action((name) => {
+  if (!isValidProfileName(name)) {
+    fail9(`Invalid profile name "${name}".`);
+  }
+  if (!fs32.existsSync(profileDir(name))) {
+    const names = listProfileNames();
+    fail9(`Profile "${name}" not found. Available: ${names.join(", ")}.`);
+  }
+  writeCurrentProfile(name);
+  console.log(chalk23.green(`Now using profile "${name}".`));
+});
+profile2.command("current").description('Print the current profile name (always succeeds; defaults to "default")').action(() => {
+  console.log(currentProfileName());
+});
+profile2.command("show [name]").description("Show a profile's configuration and daemon registration").action((name) => {
+  const target = name ?? currentProfileName();
+  if (!isValidProfileName(target)) {
+    fail9(`Invalid profile name "${target}".`);
+  }
+  const dir = profileDir(target);
+  if (!fs32.existsSync(dir)) {
+    fail9(`Profile "${target}" not found.`);
+  }
+  const current = currentProfileName();
+  const apiUrl = readProfileApiUrl(target);
+  const identity = readDaemonAt(dir);
+  console.log(`${chalk23.bold(target)}${current === target ? chalk23.green(" (current)") : ""}`);
+  console.log(`  dir:        ${dir}`);
+  console.log(`  config:     ${path31.join(dir, "config.yml")}`);
+  console.log(`  api_url:    ${apiUrl ?? chalk23.dim("(unset)")}`);
+  if (!identity) {
+    console.log(chalk23.dim("  daemon.json: (not registered yet)"));
+    return;
+  }
+  console.log(`  daemon_id:  ${identity.daemon_id ?? chalk23.dim("(missing)")}`);
+  console.log(`  daemon.server_url: ${identity.server_url ?? chalk23.dim("(missing)")}`);
+  if (apiUrl && identity.server_url && apiUrl !== identity.server_url) {
+    console.log(chalk23.yellow(`  warn: profile.api_url and daemon.json.server_url disagree.`));
+    console.log(chalk23.dim(`        Re-register the daemon to align: task0 --profile ${target} daemon register --server ${apiUrl}`));
+  }
+});
+
+// src/commands/migrate-layout.ts
+import { Command as Command24 } from "commander";
+import chalk24 from "chalk";
+var migrateLayout = new Command24("migrate-layout").description("Move legacy daemon-side files into the v0.8 ~/.task0/profiles/<name>/ layout").option("-n, --dry-run", "Show what would happen without modifying disk").option("-f, --force", "Reset the migration marker first; useful when the previous run was interrupted").action((opts) => {
+  if (opts.force && !opts.dryRun) {
+    const removed = resetMigrationMarker();
+    if (removed) console.log(chalk24.dim("Reset migration marker."));
+  }
+  const result = migrateCliLayout({ dryRun: opts.dryRun });
+  if (result.alreadyMigrated) {
+    console.log(chalk24.dim("Already migrated \u2014 nothing to do."));
+    console.log(chalk24.dim("Pass --force to rerun."));
+    return;
+  }
+  if (result.steps.length === 0) {
+    console.log("No legacy files found.");
+    return;
+  }
+  if (opts.dryRun) {
+    console.log(chalk24.bold("Dry run \u2014 no changes written:"));
+  } else {
+    console.log(chalk24.bold(`Migrated ${result.steps.length} item(s):`));
+  }
+  for (const step of result.steps) {
+    console.log(`  ${formatStep(step)}`);
+  }
+});
+function formatStep(step) {
+  switch (step.kind) {
+    case "mv":
+      return `mv     ${step.from} \u2192 ${step.to}${step.detail ? ` (${step.detail})` : ""}`;
+    case "mkdir":
+      return `mkdir  ${step.to}`;
+    case "write":
+      return `write  ${step.to}${step.detail ? ` (${step.detail})` : ""}`;
+    case "extract":
+      return `update ${step.from}${step.detail ? ` (${step.detail})` : ""}`;
+    case "skip":
+      return `skip   ${step.from ?? step.to}${step.detail ? ` (${step.detail})` : ""}`;
+    case "note":
+      return `note   ${step.detail ?? ""}`;
+  }
+}
+
 // src/core/error-capture.ts
 init_node();
 var DEFAULT_KEEP = 50;
@@ -6298,7 +6937,7 @@ function captureTopLevel(err, options) {
 
 // src/main.ts
 var TASK0_VERSION = readCliVersion();
-var program = new Command23().name("task0").description("Task-centric control layer for agent workflow").version(TASK0_VERSION);
+var program = new Command25().name("task0").description("Task-centric control layer for agent workflow").version(TASK0_VERSION).option("--profile <name>", "Use a named profile under ~/.task0/profiles/<name>/ (overrides .current pointer and TASK0_PROFILE env)");
 program.addCommand(source);
 program.addCommand(project);
 program.addCommand(task);
@@ -6316,7 +6955,28 @@ program.addCommand(daemonCmd);
 program.addCommand(userCmd);
 program.addCommand(error);
 program.addCommand(automation);
+program.addCommand(profile2);
+program.addCommand(migrateLayout);
 async function main() {
+  try {
+    const result = migrateCliLayout();
+    if (result.ran && process.env.TASK0_LOG_MIGRATION !== "off") {
+      console.error(chalk25.dim(`task0: migrated CLI layout (${result.steps.length} step(s))`));
+    }
+  } catch (err) {
+    console.error(chalk25.yellow(
+      `task0: layout migration failed: ${err instanceof Error ? err.message : String(err)}. Continuing.`
+    ));
+  }
+  try {
+    activateProfile(process.argv);
+  } catch (err) {
+    if (err instanceof ProfileNotFoundError) {
+      console.error(chalk25.red(err.message));
+      process.exit(1);
+    }
+    throw err;
+  }
   installErrorCapture({ version: TASK0_VERSION });
   try {
     await program.parseAsync(process.argv);